agent-paranoid-android 0.5.0__tar.gz

agent_paranoid_android-0.5.0/.env.example

@@ -0,0 +1,6 @@
+TRINO_HOST=trino.example.internal
+TRINO_PORT=443
+TRINO_USER=your_user
+TRINO_HTTP_SCHEME=https
+TRINO_ALLOWED_CATALOGS=hive,iceberg
+TRINO_ALLOWED_SCHEMAS=dev,test,staging

agent_paranoid_android-0.5.0/.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,68 @@
+name: Bug report
+description: Report incorrect behavior using synthetic reproduction data.
+title: "[Bug]: "
+labels: ["bug"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for reporting a bug. Do not include secrets, raw PII, production rows, or internal hostnames.
+  - type: textarea
+    id: summary
+    attributes:
+      label: Summary
+      description: What happened?
+    validations:
+      required: true
+  - type: textarea
+    id: reproduce
+    attributes:
+      label: Reproduction
+      description: Use minimal synthetic data and exact commands when possible.
+      placeholder: |
+        1. Create synthetic fixture ...
+        2. Run ...
+        3. Observe ...
+    validations:
+      required: true
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected Behavior
+    validations:
+      required: true
+  - type: textarea
+    id: actual
+    attributes:
+      label: Actual Behavior
+    validations:
+      required: true
+  - type: dropdown
+    id: safety
+    attributes:
+      label: Safety Impact
+      options:
+        - No known safety impact
+        - Possible source-row copying
+        - Possible raw PII exposure
+        - Possible unsafe SQL acceptance
+        - Possible workspace/path escape
+        - Other safety concern
+    validations:
+      required: true
+  - type: input
+    id: version
+    attributes:
+      label: Version Or Commit
+      placeholder: "0.3.0 or commit SHA"
+  - type: textarea
+    id: environment
+    attributes:
+      label: Environment
+      placeholder: "Python version, OS, install method"
+  - type: textarea
+    id: logs
+    attributes:
+      label: Logs
+      description: Paste sanitized logs only.
+      render: text

agent_paranoid_android-0.5.0/.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,5 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Security vulnerability
+    url: https://github.com/wa-pis/agent-paranoid-android/security/advisories/new
+    about: Please report vulnerabilities privately. Do not post secrets, raw PII, or exploit details in public issues.

agent_paranoid_android-0.5.0/.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,47 @@
+name: Feature request
+description: Suggest a scoped improvement or new capability.
+title: "[Feature]: "
+labels: ["enhancement"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Please keep requests safety-focused. Do not include production data, raw PII, secrets, or internal schema details.
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem
+      description: What user or production-readiness problem should this solve?
+    validations:
+      required: true
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposal
+      description: What should change?
+    validations:
+      required: true
+  - type: dropdown
+    id: area
+    attributes:
+      label: Area
+      options:
+        - CSV profiling
+        - Trino MCP
+        - Generator MCP
+        - DatasetSpec
+        - Deterministic generation
+        - Validation
+        - Agent workflow
+        - Documentation
+        - Release/security
+        - Other
+    validations:
+      required: true
+  - type: textarea
+    id: safety
+    attributes:
+      label: Safety Considerations
+      description: How should this preserve no-copy, no-PII, read-only SQL, and deterministic-generation guarantees?
+    validations:
+      required: true

agent_paranoid_android-0.5.0/.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,22 @@
+## Summary
+
+-
+
+## Safety Checklist
+
+- [ ] The change does not copy source rows into generated output.
+- [ ] The change does not expose raw PII, secrets, or production data.
+- [ ] Trino-facing changes keep SQL read-only, allowlisted, and bounded.
+- [ ] Generated data remains reproducible when a seed is supplied.
+- [ ] New fixtures, examples, logs, and docs use synthetic data only.
+
+## Validation
+
+- [ ] `python3 -m ruff check src tests scripts`
+- [ ] `python3 -m compileall -q src tests scripts`
+- [ ] `python3 -m pytest`
+- [ ] `scripts/check_release.sh`
+
+Explain any unchecked item:
+
+-

agent_paranoid_android-0.5.0/.github/dependabot.yml

@@ -0,0 +1,25 @@
+version: 2
+updates:
+  - package-ecosystem: "pip"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5
+    labels:
+      - "dependencies"
+      - "python"
+    commit-message:
+      prefix: "chore"
+      include: "scope"
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5
+    labels:
+      - "dependencies"
+      - "github-actions"
+    commit-message:
+      prefix: "chore"
+      include: "scope"

agent_paranoid_android-0.5.0/.github/workflows/ci.yml

@@ -0,0 +1,146 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  quality:
+    name: Python ${{ matrix.python-version }}
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.11", "3.12"]
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+
+      - name: Set up Python
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
+        with:
+          python-version: ${{ matrix.python-version }}
+
+      - name: Set up uv
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
+        with:
+          version: "0.11.23"
+          enable-cache: true
+
+      - name: Install locked development environment
+        run: |
+          uv sync --frozen --extra dev --python python --no-install-project
+          uv sync --frozen --extra dev --python python --no-editable --no-build-isolation
+
+      - name: Audit Python dependencies
+        run: |
+          uv export --quiet --frozen --extra dev --no-emit-project --output-file /tmp/audit-requirements.txt
+          uv run --no-sync python -m pip_audit --require-hashes --requirement /tmp/audit-requirements.txt
+
+      - name: Run lint checks
+        run: uv run --no-sync python -m ruff check src tests
+
+      - name: Run static type checks
+        run: uv run --no-sync python -m mypy
+
+      - name: Compile source and tests
+        run: uv run --no-sync python -m compileall -q src tests
+
+      - name: Run tests with coverage gate
+        run: >-
+          uv run --no-sync python -m pytest
+          --cov=test_data_agent
+          --cov-report=term-missing
+          --cov-fail-under=85
+
+  package:
+    name: Wheel smoke
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+
+      - name: Set up Python
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
+        with:
+          python-version: "3.12"
+
+      - name: Set up uv
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
+        with:
+          version: "0.11.23"
+          enable-cache: true
+
+      - name: Install locked build environment
+        run: |
+          uv sync --frozen --extra dev --python python --no-install-project
+          uv sync --frozen --extra dev --python python --no-editable --no-build-isolation
+
+      - name: Build wheel and source distribution
+        run: uv build --no-build-isolation
+
+      - name: Verify installed wheel
+        run: |
+          uv run --isolated --no-project --with ./dist/*.whl python scripts/check_installed_package.py
+          uv run --isolated --no-project --with ./dist/*.whl test-data-agent doctor --skip-smoke
+
+  trino-integration:
+    name: Trino integration
+    runs-on: ubuntu-latest
+    services:
+      trino:
+        image: trinodb/trino:483@sha256:db58cc93e593a2706553745f276bb119c9810e69918be56ecde088ba7ccb0534
+        ports:
+          - 8080:8080
+        options: >-
+          --health-cmd /usr/lib/trino/bin/health-check
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 12
+    env:
+      TEST_TRINO_INTEGRATION: "1"
+      TRINO_HOST: localhost
+      TRINO_PORT: "8080"
+      TRINO_USER: integration_test
+      TRINO_HTTP_SCHEME: http
+      TRINO_ALLOW_INSECURE_HTTP: "true"
+      TRINO_ALLOWED_CATALOGS: tpch
+      TRINO_ALLOWED_SCHEMAS: tiny
+      TRINO_REQUEST_TIMEOUT_SECONDS: "30"
+      TRINO_MAX_RESULT_ROWS: "100"
+      TRINO_QUERY_MAX_EXECUTION_TIME: 30s
+      TRINO_QUERY_MAX_RUN_TIME: 45s
+      TRINO_QUERY_MAX_SCAN_PHYSICAL_BYTES: 64MB
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+
+      - name: Set up Python
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
+        with:
+          python-version: "3.12"
+
+      - name: Set up uv
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
+        with:
+          version: "0.11.23"
+          enable-cache: true
+
+      - name: Install locked development environment
+        run: |
+          uv sync --frozen --extra dev --python python --no-install-project
+          uv sync --frozen --extra dev --python python --no-editable --no-build-isolation
+
+      - name: Run live Trino integration tests
+        run: >-
+          uv run --no-sync python -m pytest
+          -m integration
+          tests/integration/test_trino_integration.py

agent_paranoid_android-0.5.0/.github/workflows/release.yml

@@ -0,0 +1,106 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - "v*.*.*"
+
+concurrency:
+  group: release-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  release:
+    name: Build, attest, and release
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      id-token: write
+      attestations: write
+      artifact-metadata: write
+    steps:
+      - name: Check out tagged source
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+
+      - name: Set up Python
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
+        with:
+          python-version: "3.12"
+
+      - name: Set up uv
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
+        with:
+          version: "0.11.23"
+          enable-cache: true
+
+      - name: Install locked release environment
+        run: |
+          uv sync --frozen --extra dev --python python --no-install-project
+          uv sync --frozen --extra dev --python python --no-editable --no-build-isolation
+
+      - name: Verify tag matches package version
+        run: uv run --no-sync python scripts/check_release_tag.py "${GITHUB_REF_NAME}"
+
+      - name: Run release gate
+        run: uv run --no-sync scripts/check_release.sh
+
+      - name: Build wheel and source distribution
+        run: uv build --no-build-isolation
+
+      - name: Verify installed wheel
+        run: |
+          uv run --isolated --no-project --with ./dist/*.whl python scripts/check_installed_package.py
+          uv run --isolated --no-project --with ./dist/*.whl test-data-agent doctor --skip-smoke
+
+      - name: Export CycloneDX SBOM from lockfile
+        run: >-
+          uv export
+          --frozen
+          --no-dev
+          --format cyclonedx1.5
+          --preview-features sbom-export
+          --quiet
+          --output-file dist/sbom.cdx.json
+
+      - name: Write artifact checksums
+        run: sha256sum dist/*.whl dist/*.tar.gz dist/sbom.cdx.json > dist/SHA256SUMS
+
+      - name: Attest build provenance
+        uses: actions/attest@f7c74d28b9d84cb8768d0b8ca14a4bac6ef463e6 # v4
+        with:
+          subject-path: |
+            dist/*.whl
+            dist/*.tar.gz
+
+      - name: Attest package SBOM
+        uses: actions/attest@f7c74d28b9d84cb8768d0b8ca14a4bac6ef463e6 # v4
+        with:
+          subject-path: |
+            dist/*.whl
+            dist/*.tar.gz
+          sbom-path: dist/sbom.cdx.json
+
+      - name: Preserve release artifacts
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: release-${{ github.ref_name }}
+          path: |
+            dist/*.whl
+            dist/*.tar.gz
+            dist/sbom.cdx.json
+            dist/SHA256SUMS
+          if-no-files-found: error
+
+      - name: Create GitHub Release
+        uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3
+        with:
+          files: |
+            dist/*.whl
+            dist/*.tar.gz
+            dist/sbom.cdx.json
+            dist/SHA256SUMS
+          fail_on_unmatched_files: true
+          generate_release_notes: true
+          make_latest: true

agent_paranoid_android-0.5.0/.github/workflows/security.yml

@@ -0,0 +1,66 @@
+name: Security
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  schedule:
+    - cron: "17 4 * * 1"
+  workflow_dispatch:
+
+concurrency:
+  group: security-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  dependency-review:
+    name: Dependency review
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+
+      - name: Review dependency changes
+        uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0
+        with:
+          fail-on-severity: moderate
+
+  codeql:
+    name: CodeQL
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      security-events: write
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4
+        with:
+          languages: python
+          queries: security-extended
+
+      - name: Analyze
+        uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4
+
+  secrets:
+    name: Secret history scan
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Check out complete history
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          fetch-depth: 0
+
+      - name: Scan repository history
+        uses: gitleaks/gitleaks-action@e0c47f4f8be36e29cdc102c57e68cb5cbf0e8d1e # v3
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITLEAKS_ENABLE_COMMENTS: "false"
+          GITLEAKS_ENABLE_UPLOAD_ARTIFACT: "false"