v1.3.0: DIBBS/SBIR/exclusions support + reverse shape-coverage gate

[makegov-mark]

Releases v1.3.0. Four related problems, all found by pulling one thread: "what about DIBBS/SBIR/exclusions?"

What

1. The vendored contract had gone stale by seven resources. It tracked 25 against Tango's current 32, so both the conformance check and the new coverage gate were validating against out-of-date truth — they could not see DIBBS, exclusions, SBIR, or budget/accounts at all. Refreshed. That alone surfaced 72 additional fields on existing resources. Nested routes are also keyed with a slash now (budget/accounts), which had silently broken the old budget_accounts mapping; both keys are accepted.

2. The SDK under-captured what the API returns. The conformance check only validated one direction — that shape constants reference allowed fields. Nothing checked that the SDK captures everything Tango exposes. It had fallen 200+ fields behind: 209 leaf fields, 41 nested expand branches, and 3 resources unreachable through the typed shape API.

3. Six endpoint families had no SDK support at all — no models, no methods.

4. The webhook docs listed 5 of 8 alert types. No SDK change was needed — event types are served by the API and never hardcoded, so the new types already worked — but the hand-written list had drifted the same way the contract had.

How

Shape coverage. tango/shapes/generated_overlay.py (generated, merged over the curated base by SchemaRegistry) closes every gap, with types resolved from live-API sampling rather than guessed: observation → structural equivalence (vehicles.awardees mirror IDVs, .orders mirror contracts) → name heuristic. Code-object expands (set_aside, award_type, idv_type, …), previously modeled inconsistently as str / bare dict, now uniformly resolve to {code, description}.

Reverse-coverage gate. scripts/check_shape_coverage.py fails when Tango's shape trees expose anything the SDK misses that isn't baselined. Offline against the vendored contract — no token, runs on forks — and wired into the lint.yml conformance job. Baseline is empty: coverage is real, not deferred. This gate is what caught the stale contract once it had current input.

New endpoint families (Tango v4.16–v4.18), full list_* + get_* pairs:

family	detail key	filters
dibbs/rfqs, dibbs/rfps, dibbs/awards	uuid	42
exclusions	exclusion_key	18
sbir/topics, sbir/solicitations	topic_id / solicitation_id	25

Plus 6 models, shape schemas, and ShapeConfig defaults. Two API behaviors are documented in-code because they bite: is_open / is_currently_excluded are derived at query time (filter with open / active, don't shape on them), and DIBBS total_contract_price is the order total repeated on every line item — never sum it across rows.

Webhooks. Documented alerts.exclusion.match, alerts.dibbs_rfq.match, alerts.dibbs_rfp.match, plus two things that surprise people: DIBBS awards are not alertable, and nothing fires when a record merely lapses (an exclusion hitting its termination date, or an RFQ/RFP passing its close date, emits no event — alerts fire on matching a saved search, not the passage of time). A production smoke test now asserts every live event type appears in the doc; verified it fails with a precise message when one is removed. Note docs/ here is the coloc source for the SDK pages on docs.makegov.com, so this propagates to the public site.

Conformance checker fix. It resolved SDK args to API params only through an explicit api_param_mapping dict, so methods expressing the translation as tuple tables — ("account_title__icontains", account_title) and range_filters = (("apportioned", apportioned, apportioned_gte, ...)) — looked like they exposed ~55 params the API rejects. They do not: list_budget_accounts correctly sends apportioned__gte, fiscal_year__lte, account_title__icontains (verified empirically). The checker now understands both tuple forms across Assign, AnnAssign, and inline for iterables, with explicit api_param_mapping still taking precedence. This let budget/accounts be conformance-checked for the first time; its genuinely missing lookup variants (agency_code__in, bureau_name__icontains, …) are baselined.

Versioning

Minor (1.2.0 → 1.3.0): this only adds surface and fixes drift. Nothing is removed or narrowed, and the overlay only widens what the typed shape API accepts, so existing callers are unaffected.

Testing

• 450 tests pass (+22 new), 31 skipped
• mypy clean · ruff check/format clean
• Conformance: 0 errors · reverse-coverage gate: 0 gaps
• All 12 new methods exercised against the live API — list + detail round-trip for each family
• Previously-uncapturable shapes now validate end-to-end; unknown fields still correctly rejected
• uv build produces 1.3.0 artifacts; pyproject.toml and __version__ agree

Notes for review

• generated_overlay.py is a generated artifact — review scripts/generate_shape_overlay.py for the logic. Regenerable with no API key from the vendored contract + contracts/observed_shape_types.json; refresh the observations with scripts/probe_shape_types.py (maintainer-run, needs a key).
• Scalar type inference is observation-first, with name heuristics for sparsely-populated fields. Annotations only — values pass through as the API returns them.
• Upstream follow-up: budget/accounts accepts search (verified live: 21,170 results vs 0 for a nonsense term) but the contract omits it, because Tango's generator only surfaces view-handled search for filtersets declaring min_length_params. Allowlisted locally with the verification noted; the real fix belongs in Tango's contract generator.

🤖 Generated with Claude Code