arango-query-core 0.2.1__tar.gz → 0.2.3__tar.gz

arango_query_core-0.2.3/.claude/settings.json

@@ -0,0 +1,8 @@
+{
+  "permissions": {
+    "allow": [
+      "Bash(gh run *)",
+      "Bash(git worktree *)"
+    ]
+  }
+}

arango_query_core-0.2.3/.cursor/rules/fix-upstream-dont-fork.mdc

@@ -0,0 +1,104 @@
+---
+description: When a library we own lacks something or gets it wrong, fix it in the library or file it there; a workaround in the consumer is temporary, marked and tracked
+alwaysApply: true
+---
+
+# Fix Upstream, Don't Fork
+
+> **Scope:** Any code that depends on a library we own — arango-sparql-py,
+> arango-query-core, r2g / r2g-arango, arango-schema-analyzer, arango-cypher-py,
+> arango-entity-resolution, or any other library the team maintains. Every one of
+> these is also a consumer of the others, so this applies inside the libraries too.
+
+> **"We own the library. A gap in it is an issue there, not a fork here."**
+
+Written after a 2026-10-15 finding in contextual-data-fabric: its English→SPARQL
+translator was never the library's. In July, arango-sparql-py could only check a
+generated query against one schema, so the consumer took the library's model client
+and wrote its own prompt, check and repair loop around it. That was a reasonable
+call — but no library issue was filed and nothing in the code said it was
+temporary. When the shared engine gained the seam the consumer needed, nobody
+noticed. Three months later there were three implementations, the design record
+still said the engine was reused, and the library's docstring named a function the
+consumer never imported.
+
+The same audit found the pattern again around arango-entity-resolution: a consumer
+guard that copies the resolver's checks line for line, configuration defects worked
+around in a comment instead of filed, and a service that declares the library as a
+dependency, says in its docstring that it runs the library's pipeline, and imports
+none of it.
+
+## When an owned library falls short
+
+| Do, in this order | Not |
+| --- | --- |
+| 1. **Check it isn't already there** — `main`, open branches, and the other org's copy | Assume the version you have pinned is the latest |
+| 2. **Fix it in the library** — we own it; open the pull request there | Patch around it here because this is the repo you have open |
+| 3. **Or file it there** — a bug or feature request on the repo that leads, saying what the consumer needs and why | File it on the mirror, or mention it only in this repo's pull request |
+| 4. **Only if this repo cannot wait** for a library release and a pin bump — a temporary workaround, held to the rules below | A permanent workaround nobody can find |
+
+**Which repo leads.** Most of these libraries exist under two owners, and which one
+leads has changed during 2026. Do not trust the remotes of your clone — a fresh
+clone has only the URL you were handed. The repository with recent pull requests is
+the one that leads:
+
+```sh
+gh pr list --repo <owner>/<name> --state all --limit 5
+```
+
+Run it against both candidates. If neither has recent pull requests, ask.
+
+## A workaround that is allowed
+
+- **Behind the seam the library would provide**, so removing it touches one place:
+  an adapter, or a wrapper with the library's own shape.
+- **Marked where it lives**, on one line at the code that works around the library:
+
+  ```python
+  # upstream: <org>/arango-sparql-py#<n> — remove when the engine accepts a caller's validator
+  ```
+
+  Where a repo has `tests/test_upstream_markers.py`, that test holds the format: an
+  `owner/repo#number` issue a person can open, and a `remove when` condition someone
+  can check. The shared-memory installers place this rule but not the test, so a
+  repo without it copies it from arango-shared-memory
+  `templates/tests/test_upstream_markers.py`.
+- **Listed in this repo's known-debt issue**, if it keeps one, with the same link.
+- **Removed in the pin bump that ships the fix**, not in a later cleanup: when you
+  bump a pin, search for `upstream:` markers that name that library.
+
+## What counts as a fork
+
+| Fork | Why it costs |
+| --- | --- |
+| Taking a library's low-level piece (a client, a parser) and writing your own version of its main entry point around it | Fixes and new capabilities land in the library's version and never reach yours |
+| Copying library code into the consumer | The two copies drift |
+| Patching the library at runtime | The next pin bump breaks it without a word |
+| Reaching past the library's public API into its internals | Internals move without a release note |
+| Defining a public function or class with the same name and job as one the library exports | Readers take one for the other |
+| Declaring a library as a dependency and reimplementing what you would have called | The dependency says one thing and the code does another |
+| Holding a pin back to dodge a bug, with no issue | Nobody knows when it can move |
+
+A fork that is deliberate and permanent — the consumer needs something the library
+should not hold — is a **design record (ADR) in the consumer** plus an **issue in the
+library** for the seam that would let the two share the rest. It is never a silent
+decision.
+
+## The other side: claims about the other repo
+
+A library that says a consumer uses it ("this is what the fabric calls") must be able
+to point at the consumer's import. A consumer that says it uses a library ("runs the
+entity-resolution pipeline") must import it. If either cannot, the claim is a plan,
+and it is written as one.
+
+## Anti-Patterns
+
+| Anti-Pattern | Consequence |
+| --- | --- |
+| "The library can't do X, so I'll write X here" | A fork nobody tracks |
+| A workaround with no `upstream:` marker | Nobody removes it when the fix ships |
+| An issue filed in the consumer instead of the library | The library's maintainers never see it |
+| A library defect documented only in a config comment | The next consumer hits it too |
+| "It's our library, I'll fix it there later" | Later is after the third implementation |
+
+**We own the library: fix it there, or say where it will be fixed.**

{arango_query_core-0.2.1 → arango_query_core-0.2.3}/CHANGELOG.md

@@ -6,6 +6,47 @@ exact versions (contextual-data-fabric CC-9) and re-run their golden /
 eval suites on every bump — pre-1.0, **minor** bumps may break the API
 and this file must say so explicitly.
 
+## [0.2.3] - 2026-10-21
+
+### Added
+
+- `PostconditionViolation.soft` (default `False`): a soft violation is
+  retried like any other, but when the retry budget is spent
+  `NLQueryEngine.generate` returns the first valid candidate whose only
+  objection was soft, instead of failing closed. The candidate still passes
+  guardrails, and the violation stays on `NLResult.postcondition` (`ok` True
+  with a non-None `postcondition` marks a soft fallback). For checks such as
+  "the query returned no rows", where empty is sometimes the right answer.
+  `run_postconditions` now returns the first *hard* violation ahead of any
+  soft one, so a hard check listed after a soft one still applies. Additive;
+  existing checks are unaffected. Part of #4.
+
+## [0.2.2] - 2026-10-21
+
+### Fixed
+
+- **Traversals no longer hint an array-expanded edge index.** `resolve_indexes`
+  treated any edge index led by `_from` / `_to` as a vertex-centric index, so
+  `[_from, type, toLabels[*]]` (r2g's opt-in `LpgLayout.index_edge_labels`
+  shape) could become arango-cypher-py's traversal `indexHint`. A persistent
+  index stores one entry per array element and a traversal scans all of them,
+  so the hinted traversal returned each edge once per label -- inflated counts,
+  no error (measured on ArangoDB 3.12.9: 20x the rows at one hop, 400x at two).
+  Such an index is now never `vci`, even with an explicit `vci: true` flag. With
+  only that index, arango-cypher-py reports a missing VCI instead of hinting it;
+  next to a flat `[_from, type]` index, the flat one is hinted, whatever the
+  order.
+- **The schema analyzer's verdict is honored.** When a relationship mapping
+  carries arangodb-schema-analyzer's `vci.indexLevel.indexes[].traversalSafe:
+  false` (analyzer 0.15.2+), that index is not traversal-safe, whatever its
+  shape. Older exports carry no verdict; the local array-expansion check still
+  applies to them.
+
+### Added
+
+- `IndexInfo.traversal_safe` (default `True`): False when a traversal must not
+  use the index. Additive; existing callers are unaffected.
+
 ## [0.2.1] - 2026-10-16
 
 ### Fixed

{arango_query_core-0.2.1 → arango_query_core-0.2.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: arango-query-core
-Version: 0.2.1
+Version: 0.2.3
 Summary: Shared conceptual-model and NL substrate for ArangoDB query transpilers (arango-cypher-py, arango-sparql-py)
 Project-URL: Repository, https://github.com/ArthurKeen/arango-query-core
 Project-URL: Changelog, https://github.com/ArthurKeen/arango-query-core/blob/main/CHANGELOG.md

{arango_query_core-0.2.1 → arango_query_core-0.2.3}/arango_query_core/mapping.py

@@ -87,9 +87,49 @@ def _is_structural_vci(index_type: str, fields: tuple[str, ...]) -> bool:
     return any(f not in _SYSTEM_INDEX_FIELDS for f in fields)
 
 
+def _has_array_expansion(fields: tuple[str, ...]) -> bool:
+    """True when any indexed field is an array expansion (``labels[*]``).
+
+    A persistent index stores one entry per array element, and a traversal
+    scans every entry under the ``_from`` / ``_to`` prefix, so a traversal that
+    uses such an index returns each edge once per element -- inflated counts,
+    no error. The index is still correct for a pattern-match lookup
+    (``FOR e IN edges FILTER e._from == ...``), but never for a traversal hint.
+    """
+    return any("[*]" in f for f in fields)
+
+
+def _analyzer_unsafe_index_fields(mapping: JsonObj) -> set[tuple[str, ...]]:
+    """Field tuples the schema analyzer marked ``traversalSafe: false``.
+
+    arangodb-schema-analyzer (0.15.2+) records its verdict per relationship
+    under ``vci.indexLevel.indexes``; ``traversalSafe`` is present only when
+    false. Older exports carry no verdict, so absence means "no opinion" and
+    the local :func:`_has_array_expansion` check still applies.
+    """
+    vci = mapping.get("vci")
+    index_level = vci.get("indexLevel") if isinstance(vci, dict) else None
+    indexes = index_level.get("indexes") if isinstance(index_level, dict) else None
+    if not isinstance(indexes, list):
+        return set()
+    unsafe: set[tuple[str, ...]] = set()
+    for entry in indexes:
+        if not isinstance(entry, dict) or entry.get("traversalSafe") is not False:
+            continue
+        fields = entry.get("fields")
+        if isinstance(fields, list):
+            unsafe.add(tuple(str(f) for f in fields))
+    return unsafe
+
+
 @dataclass(frozen=True)
 class IndexInfo:
-    """Metadata for a single index on a collection."""
+    """Metadata for a single index on a collection.
+
+    ``traversal_safe`` is False when a traversal must not use the index
+    (array-expanded fields, or the schema analyzer's ``traversalSafe: false``
+    verdict). Such an index is never ``vci``, whatever its shape or flags.
+    """
 
     type: str
     fields: tuple[str, ...]
@@ -98,6 +138,7 @@ class IndexInfo:
     name: str = ""
     vci: bool = False
     deduplicate: bool = False
+    traversal_safe: bool = True
 
 
 @dataclass(frozen=True)
@@ -573,6 +614,7 @@ class MappingResolver:
         if not isinstance(indexes_raw, list):
             return []
 
+        unsafe = _analyzer_unsafe_index_fields(mapping)
         result: list[IndexInfo] = []
         for idx in indexes_raw:
             if not isinstance(idx, dict):
@@ -583,6 +625,8 @@ class MappingResolver:
             else:
                 continue
             index_type = str(idx.get("type", "persistent"))
+            traversal_safe = fields not in unsafe and not _has_array_expansion(fields)
+            vci = bool(idx.get("vci", False)) or _is_structural_vci(index_type, fields)
             result.append(
                 IndexInfo(
                     type=index_type,
@@ -590,8 +634,9 @@ class MappingResolver:
                     unique=bool(idx.get("unique", False)),
                     sparse=bool(idx.get("sparse", False)),
                     name=str(idx.get("name", "")),
-                    vci=bool(idx.get("vci", False)) or _is_structural_vci(index_type, fields),
+                    vci=vci and traversal_safe,
                     deduplicate=bool(idx.get("deduplicate", False)),
+                    traversal_safe=traversal_safe,
                 )
             )
         return result

{arango_query_core-0.2.1 → arango_query_core-0.2.3}/arango_query_core/nl/engine.py

@@ -39,7 +39,10 @@ class NLResult:
     """Outcome of one NL→query generation.
 
     ``query`` is empty when generation failed (``ok`` False); ``error``
-    then carries the last validation failure or guardrail refusal.
+    then carries the last validation failure, postcondition violation or
+    guardrail refusal. ``ok`` True with a non-None ``postcondition`` means a
+    soft fallback: the retry budget ran out and ``query`` is the first valid
+    candidate whose only objection was soft (``PostconditionViolation.soft``).
     Token fields accumulate across retries so cost accounting sees the
     whole conversation, not the last attempt.
     """
@@ -96,6 +99,9 @@ class NLQueryEngine:
         failure: ValidationResult | None = None
         violation: PostconditionViolation | None = None
         candidate = ""
+        # First valid candidate whose only objection was soft: what the call
+        # returns if the budget runs out without a clean candidate.
+        fallback: tuple[str, ValidationResult, PostconditionViolation] | None = None
 
         for attempt in range(self.max_retries + 1):
             if attempt > 0:
@@ -138,13 +144,25 @@ class NLQueryEngine:
             result.postcondition = violation
             if violation is None:
                 break
+            # Soft only if no check objected as hard (run_postconditions
+            # returns a hard violation ahead of any soft one).
+            if violation.soft and fallback is None:
+                fallback = (candidate, failure, violation)
+        else:
+            # Budget spent without a clean candidate. If one drew only a soft
+            # objection, return it — with the objection on the result — rather
+            # than refuse a query that may well be right.
+            if fallback is not None:
+                candidate, result.validation, result.postcondition = fallback
+                failure, violation = result.validation, None
 
         if failure is None or not failure.ok:
             result.error = failure.error if failure else "provider returned nothing"
             return result
         if violation is not None:
-            # Budget spent on a valid-but-semantically-rejected query — fail
-            # closed rather than return a plausible wrong answer.
+            # Budget spent on a valid-but-semantically-rejected query with no
+            # soft-only candidate to fall back on — fail closed rather than
+            # return a plausible wrong answer.
             result.error = f"{violation.reason} ({violation.code})"
             return result
 

{arango_query_core-0.2.1 → arango_query_core-0.2.3}/arango_query_core/nl/postconditions.py

@@ -15,14 +15,19 @@ budget as parse and translate: the model is told the rule up front (via
 :meth:`Postcondition.prompt_section`, rendered once into the cacheable system
 prefix), and a violation is fed back into the next prompt exactly like a
 validation failure — so the loop gets a chance to *correct* the query rather
-than just reject it, and fails closed when the budget is spent.
+than just reject it, and fails closed when the budget is spent — unless a
+candidate drew only a *soft* violation (``PostconditionViolation.soft``), in
+which case the first such candidate is returned instead.
 
 Semantics (mirrors ``nl2cypher``'s original, language-agnostic here):
 
 * Postconditions run **after** the adapter's ``validate`` succeeds — a retry is
   only ever spent on an already-valid query.
-* The **first** violation wins; checks are not accumulated. One clear, specific
-  correction beats a pile of them.
+* The **first hard** violation wins; checks are not accumulated. One clear,
+  specific correction beats a pile of them. A *soft* violation does not stop
+  the run: the remaining checks still see the query, and any hard violation
+  among them takes precedence. Only a query no check objects to as hard can
+  become a soft fallback, whatever order the checks are listed in.
 * A check that **raises** is treated as a violation, not an error — a broken
   postcondition must not turn a safety mechanism into an outage. Fail closed.
 * :meth:`Postcondition.prompt_section` renders **once**; it must not vary
@@ -60,6 +65,19 @@ class PostconditionViolation:
     """How to fix it. Also fed into the retry prompt, after ``reason``."""
     code: str = "postcondition_violation"
     """Stable identifier for telemetry / assertions, e.g. ``"time_windowed"``."""
+    soft: bool = False
+    """A soft violation asks for a retry but does not make the query unusable.
+
+    Use it for an objection that is sometimes the right answer — e.g. "the query
+    returned no rows" when the honest answer may be "none". When the retry
+    budget is spent, the engine returns the first valid candidate whose only
+    objection was soft (with this violation on ``NLResult.postcondition``)
+    instead of failing closed. Hard violations (the default) still fail closed.
+
+    Only that first soft candidate is offered to the guardrails: if they refuse
+    it, the call fails closed with the guardrail's reason, even when a later
+    soft candidate would have passed — the conservative reading.
+    """
 
 
 @dataclass(frozen=True)
@@ -109,15 +127,22 @@ def run_postconditions(
     postconditions: Sequence[Postcondition] | None,
     context: PostconditionContext,
 ) -> PostconditionViolation | None:
-    """Run *postconditions* in order, returning the first violation.
+    """Run *postconditions* in order, returning the first hard violation, or
+    else the first soft one.
+
+    A soft violation does not stop the run, so a hard check listed after it
+    still sees the query; otherwise a query breaking a hard rule could be
+    returned as a soft fallback.
 
-    A check that raises is treated as a violation rather than being allowed to
-    abort the translation: a broken check must not be able to turn a safety
-    mechanism into an outage, and failing closed is the conservative reading.
+    A check that raises is treated as a (hard) violation rather than being
+    allowed to abort the translation: a broken check must not be able to turn a
+    safety mechanism into an outage, and failing closed is the conservative
+    reading.
     """
     if not postconditions:
         return None
 
+    first_soft: PostconditionViolation | None = None
     for pc in postconditions:
         code = getattr(pc, "code", pc.__class__.__name__)
         try:
@@ -128,9 +153,13 @@ def run_postconditions(
                 reason=f"Postcondition {code!r} raised {type(exc).__name__}: {exc}",
                 suggested_hint="Simplify the query; the check could not evaluate it.",
             )
-        if violation is not None:
+        if violation is None:
+            continue
+        if not violation.soft:
             return violation
-    return None
+        if first_soft is None:
+            first_soft = violation
+    return first_soft
 
 
 def postcondition_prompt_sections(

{arango_query_core-0.2.1 → arango_query_core-0.2.3}/docs/PRD.md

@@ -127,7 +127,7 @@ to prevent a three-way fork.
 | `nl.fewshot` | `FewShotIndex` over `(question, query)` pairs (legacy corpus keys accepted); `BM25Retriever` (rank_bm25, `nl` extra) and `DenseRetriever` (sentence-transformers, `dense` extra), selected via `mode="bm25"\|"dense"\|"auto"`; `cached_few_shot_index` memoizes the expensive dense build |
 | `nl.grounding` | Seam 6/7 retrieval: `LabelIndex`/`GroundedEntity` (entity grounding) and `PredicateIndex`/`GroundedPredicate` (predicate/schema-convention grounding, renders IRI local names not labels), sharing one token-substring scorer |
 | `nl.pathindex` | Seam 8: `ClassPathIndex`/`ClassPath` — bounded shortest predicate paths between two seam-6/7-anchored classes over the TBox's class-connectivity graph |
-| `nl.postconditions` | Caller-supplied semantic invariants (`Postcondition`, `PostconditionContext`, `PostconditionViolation`, `run_postconditions`) enforced through the engine's own retry budget; fails closed on exhaustion |
+| `nl.postconditions` | Caller-supplied semantic invariants (`Postcondition`, `PostconditionContext`, `PostconditionViolation`, `run_postconditions`) enforced through the engine's own retry budget; fails closed on exhaustion, unless a valid candidate drew only a soft violation (`PostconditionViolation.soft`); the first such candidate is returned, with the violation on `NLResult.postcondition` |
 | `nl.synthbank` | `SHAPE_CATALOG`/`ShapeTemplate` — 9 ontology-agnostic compositional query-shape templates for synthetic few-shot bank generation |
 | `nl.seams` | `QueryLanguageAdapter` — the eight language-specific seams: (1) grammar prompt section, (2) few-shot corpus, (3) syntax validator, (4) repair rules keyed on validator errors, (5) guardrail checks, (6) entity grounding index, (7) predicate grounding index, (8) relationship-path grounding index. Plus `ValidationResult`, `GuardrailVerdict` |
 

{arango_query_core-0.2.1 → arango_query_core-0.2.3}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "arango-query-core"
-version = "0.2.1"
+version = "0.2.3"
 description = "Shared conceptual-model and NL substrate for ArangoDB query transpilers (arango-cypher-py, arango-sparql-py)"
 readme = "README.md"
 license = { file = "LICENSE" }

{arango_query_core-0.2.1 → arango_query_core-0.2.3}/tests/test_mapping_vci_detection.py

@@ -86,3 +86,61 @@ class TestResolverStructuralVci:
     def test_no_indexes_means_no_vci(self) -> None:
         b = _bundle_with_edge_indexes([])
         assert MappingResolver(b).has_vci("REL") is False
+
+
+class TestArrayExpandedIndexIsNotTraversalSafe:
+    """An edge index with an array-expanded field must never be hinted in a traversal.
+
+    A persistent index stores one entry per array element and a traversal scans
+    every entry under the _from/_to prefix, so ``[_from, type, toLabels[*]]``
+    returns each edge once per label (measured on ArangoDB 3.12.9: 20 labels
+    per edge -> 20x the rows at one hop, 400x at two). r2g provisions this shape
+    when ``LpgLayout.index_edge_labels`` is on.
+    """
+
+    def test_array_expanded_index_is_not_vci(self) -> None:
+        b = _bundle_with_edge_indexes(
+            [{"type": "persistent", "fields": ["_from", "type", "toLabels[*]"], "name": "lbl"}]
+        )
+        r = MappingResolver(b)
+        (idx,) = r.resolve_indexes("REL")
+        assert idx.traversal_safe is False
+        assert idx.vci is False
+        assert r.has_vci("REL") is False
+
+    def test_explicit_flag_does_not_override_array_expansion(self) -> None:
+        b = _bundle_with_edge_indexes(
+            [{"type": "persistent", "fields": ["_from", "toLabels[*]"], "name": "lbl", "vci": True}]
+        )
+        assert MappingResolver(b).has_vci("REL") is False
+
+    def test_safe_index_still_vci_alongside_risky_one(self) -> None:
+        b = _bundle_with_edge_indexes(
+            [
+                {"type": "persistent", "fields": ["_from", "type"], "name": "flat"},
+                {"type": "persistent", "fields": ["_from", "type", "toLabels[*]"], "name": "lbl"},
+            ]
+        )
+        by_name = {i.name: i for i in MappingResolver(b).resolve_indexes("REL")}
+        assert by_name["flat"].vci is True and by_name["flat"].traversal_safe is True
+        assert by_name["lbl"].vci is False
+
+    def test_analyzer_verdict_is_honored(self) -> None:
+        # The schema analyzer's traversalSafe: false wins even for a shape the
+        # local check would accept -- its verdict is the source of truth.
+        b = _bundle_with_edge_indexes([{"type": "persistent", "fields": ["_from", "type"], "name": "flat"}])
+        b.physical_mapping["relationships"]["REL"]["vci"] = {
+            "indexLevel": {"indexes": [{"fields": ["_from", "type"], "traversalSafe": False}]}
+        }
+        (idx,) = MappingResolver(b).resolve_indexes("REL")
+        assert idx.traversal_safe is False and idx.vci is False
+
+    def test_analyzer_block_without_verdict_keeps_safe_index(self) -> None:
+        # Exports before analyzer 0.15.2 have a vci block but no traversalSafe:
+        # absence is "no opinion", not "unsafe".
+        b = _bundle_with_edge_indexes([{"type": "persistent", "fields": ["_from", "type"], "name": "flat"}])
+        b.physical_mapping["relationships"]["REL"]["vci"] = {
+            "indexLevel": {"indexes": [{"fields": ["_from", "type"], "discriminatorFields": ["type"]}]}
+        }
+        (idx,) = MappingResolver(b).resolve_indexes("REL")
+        assert idx.traversal_safe is True and idx.vci is True

{arango_query_core-0.2.1 → arango_query_core-0.2.3}/tests/test_nl_postconditions.py

@@ -4,7 +4,9 @@ Covers the semantics the feature promises: postconditions run only on valid
 queries, share the retry budget, feed their correction back into the next
 prompt, fail closed on exhaustion, first-violation-wins, a raising check is a
 violation (not an outage), the rule is announced once in the system prompt,
-and the guardrail gate still runs after. All with fakes — no network.
+and the guardrail gate still runs after. Soft violations: retried the same way,
+returned as a fallback on exhaustion, never ahead of a hard violation whatever
+the check order. All with fakes — no network.
 """
 
 from __future__ import annotations
@@ -208,3 +210,133 @@ def test_run_postconditions_helper_empty_is_none():
     ctx = PostconditionContext(schema_summary="", question="q", attempt=0)
     assert run_postconditions("SELECT 1", None, ctx) is None
     assert run_postconditions("SELECT 1", [], ctx) is None
+
+
+class NonEmpty:
+    """Soft stand-in for "the query returned no rows": a candidate without
+    'WHERE' is treated as empty. Sometimes empty is the right answer, so the
+    objection is soft."""
+
+    code = "non_empty"
+
+    def prompt_section(self) -> str:
+        return ""
+
+    def check(self, query: str, *, context: PostconditionContext):
+        if "WHERE" in query:
+            return None
+        return PostconditionViolation(
+            code=self.code,
+            reason="The query returned no rows.",
+            suggested_hint="Check literals and labels.",
+            soft=True,
+        )
+
+
+def test_soft_violation_is_retried_like_a_hard_one():
+    eng = _engine(["SELECT *", "SELECT * WHERE {}"], [NonEmpty()])
+    r = eng.generate("q")
+    assert r.ok is True and r.retries == 1
+    assert r.query == "SELECT * WHERE {}"
+    assert r.postcondition is None
+    assert "Check literals and labels." in eng.provider.calls[1][1]
+
+
+def test_soft_exhaustion_returns_first_soft_candidate():
+    eng = _engine(["SELECT 1", "SELECT 2", "SELECT 3"], [NonEmpty()], max_retries=2)
+    r = eng.generate("q")
+    assert r.ok is True and r.error == ""
+    assert r.retries == 2  # the whole budget was spent first
+    assert r.query == "SELECT 1"  # the first candidate, not the last
+    assert r.postcondition is not None and r.postcondition.soft
+    assert r.postcondition.code == "non_empty"
+
+
+def test_soft_fallback_survives_a_later_invalid_candidate():
+    eng = _engine(["SELECT 1", "nonsense"], [NonEmpty()], max_retries=1)
+    r = eng.generate("q")
+    assert r.ok is True and r.query == "SELECT 1"
+    assert r.validation is not None and r.validation.ok
+
+
+def test_soft_fallback_survives_a_later_hard_violation():
+    # Soft-only first candidate (has LIMIT, no WHERE); the second breaks the
+    # hard invariant. The soft candidate is the one worth returning.
+    eng = _engine(["SELECT * LIMIT 1", "SELECT *"], [NeedsLimit(), NonEmpty()], max_retries=1)
+    r = eng.generate("q")
+    assert r.ok is True and r.query == "SELECT * LIMIT 1"
+    assert r.postcondition is not None and r.postcondition.code == "non_empty"
+
+
+def test_hard_violation_still_fails_closed_beside_a_soft_check():
+    # Every candidate breaks the hard rule first (first violation wins), so
+    # none is ever soft-only: no fallback, fail closed as before.
+    eng = _engine(["SELECT *"], [NeedsLimit(), NonEmpty()], max_retries=2)
+    r = eng.generate("q")
+    assert r.ok is False and r.query == ""
+    assert r.postcondition is not None and r.postcondition.code == "needs_limit"
+
+
+def test_soft_fallback_still_passes_the_guardrail_gate():
+    eng = _engine(["SELECT 1"], [NonEmpty()], allow=False, max_retries=1)
+    r = eng.generate("q")
+    assert r.ok is False and r.query == ""
+    assert "tenant scope" in r.error
+
+
+def test_violation_is_hard_by_default():
+    assert PostconditionViolation(reason="r", suggested_hint="h").soft is False
+
+
+def test_hard_check_after_a_soft_one_still_applies():
+    # Regression: the soft check used to short-circuit the run, so a query
+    # breaking the hard rule listed after it came back ok as a soft fallback.
+    eng = _engine(["SELECT *"], [NonEmpty(), NeedsLimit()], max_retries=2)
+    r = eng.generate("q")
+    assert r.ok is False and r.query == ""
+    assert r.postcondition is not None and r.postcondition.code == "needs_limit"
+
+
+def test_soft_then_hard_reports_the_hard_correction():
+    eng = _engine(["SELECT *", "SELECT * LIMIT 1 WHERE {}"], [NonEmpty(), NeedsLimit()])
+    r = eng.generate("q")
+    assert r.ok is True and r.retries == 1
+    assert "Add LIMIT 100." in eng.provider.calls[1][1]  # the hard hint, not the soft one
+
+
+def test_raising_check_after_a_soft_one_still_fails_closed():
+    class Boom:
+        code = "boom"
+
+        def prompt_section(self):
+            return ""
+
+        def check(self, query, *, context):
+            raise ValueError("kaboom")
+
+    eng = _engine(["SELECT 1"], [NonEmpty(), Boom()], max_retries=1)
+    r = eng.generate("q")
+    assert r.ok is False and r.query == ""
+    assert r.postcondition is not None and r.postcondition.code == "boom_error"
+
+
+def test_soft_fallback_with_no_retries():
+    eng = _engine(["SELECT 1"], [NonEmpty()], max_retries=0)
+    r = eng.generate("q")
+    assert r.ok is True and r.retries == 0 and r.query == "SELECT 1"
+    assert r.postcondition is not None and r.postcondition.soft
+
+
+def test_clean_last_candidate_beats_the_soft_fallback():
+    eng = _engine(["SELECT 1 LIMIT 1", "SELECT * LIMIT 1 WHERE {}"], [NeedsLimit(), NonEmpty()])
+    r = eng.generate("q")
+    assert r.ok is True and r.query == "SELECT * LIMIT 1 WHERE {}"
+    assert r.postcondition is None
+
+
+def test_run_postconditions_prefers_hard_over_earlier_soft():
+    ctx = PostconditionContext(schema_summary="", question="q", attempt=0)
+    v = run_postconditions("SELECT *", [NonEmpty(), NeedsLimit()], ctx)
+    assert v is not None and v.code == "needs_limit" and not v.soft
+    v = run_postconditions("SELECT * LIMIT 1", [NonEmpty(), NeedsLimit()], ctx)
+    assert v is not None and v.code == "non_empty" and v.soft

arango_query_core-0.2.3/tests/test_upstream_markers.py

@@ -0,0 +1,173 @@
+"""A workaround for a library we own names its upstream issue
+(`.cursor/rules/fix-upstream-dont-fork.mdc`).
+
+A gap in an owned library is fixed or filed in that library. When this repo
+cannot wait for the release, the workaround is allowed only while it is marked
+where it lives::
+
+    # upstream: <owner>/<repo>#<n> — remove when <condition>
+
+so the pin bump that ships the fix can find it. This holds the marker's shape in
+every scanned file: an issue a person can open, and a condition someone can
+check. Whether that issue is still open needs the network, so it is not checked
+here.
+
+Shared source: arango-shared-memory ``templates/tests/test_upstream_markers.py``.
+Copy changes back there so every repository keeps the same check.
+"""
+
+from __future__ import annotations
+
+import os
+import re
+from pathlib import Path
+
+import pytest
+
+ROOT = Path(__file__).resolve().parents[1]
+RULE = ROOT / ".cursor" / "rules" / "fix-upstream-dont-fork.mdc"
+
+#: Files whose comments start with ``#``.
+SCANNED_SUFFIXES = frozenset({".py", ".sh", ".yml", ".yaml", ".toml", ".cfg"})
+SCANNED_NAMES = frozenset({"Makefile", "Dockerfile"})
+#: Directories that hold no code of ours. Hidden directories are skipped too,
+#: except ``.github``, where CI steps can work around a library.
+SKIPPED_DIRS = frozenset(
+    {
+        "__pycache__",
+        "build",
+        "dist",
+        "node_modules",
+        "site-packages",
+        "venv",
+    }
+)
+KEPT_HIDDEN_DIRS = frozenset({".github"})
+
+#: Any comment that claims to be a marker, however it is written.
+MARKER = re.compile(r"#\s*upstream\s*:(?P<rest>.*)$", re.IGNORECASE)
+#: What a marker must say: an issue (owner/repo#n), then when to remove it.
+WELL_FORMED = re.compile(
+    r"^\s*(?P<repo>[A-Za-z0-9][\w.-]*/[A-Za-z0-9][\w.-]*)#(?P<issue>[1-9]\d*)"
+    r"\s+(?:—|–|--?)\s+remove when\s+(?P<when>\S.*?)\s*$"
+)
+
+
+def marker_problems(text: str, where: str) -> list[str]:
+    """Each malformed ``upstream:`` marker in ``text``, as ``where:line: why``."""
+    problems = []
+    for number, line in enumerate(text.splitlines(), start=1):
+        found = MARKER.search(line)
+        if found is None:
+            continue
+        if WELL_FORMED.match(found.group("rest")) is None:
+            problems.append(
+                f"{where}:{number}: {line.strip()!r} — write it as "
+                "'# upstream: <owner>/<repo>#<n> — remove when <condition>'"
+            )
+    return problems
+
+
+def _skipped_dir(name: str) -> bool:
+    if name in SKIPPED_DIRS or name.endswith(".egg-info"):
+        return True
+    return name.startswith(".") and name not in KEPT_HIDDEN_DIRS
+
+
+def _skipped(relative: Path) -> bool:
+    return any(_skipped_dir(part) for part in relative.parts[:-1])
+
+
+def _scanned_files() -> list[Path]:
+    files = []
+    # os.walk with pruning, so .git, virtualenvs and node_modules are never entered.
+    for current, dirs, names in os.walk(ROOT):
+        dirs[:] = sorted(name for name in dirs if not _skipped_dir(name))
+        for name in sorted(names):
+            path = Path(current) / name
+            if path.suffix in SCANNED_SUFFIXES or name in SCANNED_NAMES:
+                files.append(path)
+    # This file states malformed markers on purpose, to prove they are caught.
+    return [path for path in files if path.resolve() != Path(__file__).resolve()]
+
+
+# -- the tree --------------------------------------------------------------------
+
+
+def test_every_upstream_marker_names_an_issue_and_when_to_remove_it() -> None:
+    problems = []
+    for path in _scanned_files():
+        text = path.read_text(encoding="utf-8", errors="replace")
+        problems.extend(marker_problems(text, str(path.relative_to(ROOT))))
+    assert not problems, "malformed upstream markers:\n  " + "\n  ".join(problems)
+
+
+def test_the_scan_reaches_this_repositorys_code() -> None:
+    """A scan that silently finds nothing would pass forever."""
+    scanned = {path.relative_to(ROOT).parts[0] for path in _scanned_files()}
+    assert "tests" in scanned
+    assert len(_scanned_files()) > 1
+
+
+@pytest.mark.parametrize(
+    ("relative", "skipped"),
+    [
+        ("src/pkg/module.py", False),
+        (".github/workflows/ci.yml", False),
+        (".venv/lib/python3.11/site-packages/x.py", True),
+        ("pkg.egg-info/PKG-INFO.py", True),
+        ("frontend/node_modules/x/setup.py", True),
+        (".claude/hooks/x.py", True),
+    ],
+)
+def test_the_scan_skips_only_what_is_not_ours(relative: str, skipped: bool) -> None:
+    assert _skipped(Path(relative)) is skipped
+
+
+# -- the check itself ------------------------------------------------------------
+
+
+@pytest.mark.parametrize(
+    "line",
+    [
+        "# upstream: ArthurKeen/arango-sparql-py#123 — remove when the engine takes a validator",
+        "x = build()  # upstream: arango-solutions-org/r2g-arango#7 -- remove when 0.7 ships",
+        "    # upstream: org/arango-query-core#42 – remove when LabelIndex accepts aliases",
+        "  run: make gate  # upstream: org/arango-cypher#9 - remove when the pin moves",
+    ],
+)
+def test_a_well_formed_marker_passes(line: str) -> None:
+    assert marker_problems(line, "example") == []
+
+
+@pytest.mark.parametrize(
+    ("line", "missing"),
+    [
+        ("# upstream: TODO file an issue", "no issue at all"),
+        ("# upstream: arango-sparql-py#12 — remove when fixed", "no owner"),
+        ("# upstream: org/arango-sparql-py — remove when fixed", "no issue number"),
+        ("# upstream: org/arango-sparql-py#0 — remove when fixed", "issue zero"),
+        ("# upstream: org/arango-sparql-py#12", "no removal condition"),
+        ("# upstream: org/arango-sparql-py#12 — remove when ", "an empty condition"),
+        ("# Upstream: org/arango-sparql-py#12 remove when fixed", "no separator"),
+        ("#upstream:https://github.com/org/arango-sparql-py/issues/12", "a URL, not owner/repo#n"),
+    ],
+)
+def test_a_malformed_marker_is_named_with_where_it_is(line: str, missing: str) -> None:
+    problems = marker_problems(f"first line\n{line}\n", "src/example.py")
+    assert len(problems) == 1, f"{missing}: {problems}"
+    assert problems[0].startswith("src/example.py:2: ")
+
+
+def test_a_line_that_only_mentions_upstream_is_not_a_marker() -> None:
+    text = "# fixed upstream in 0.6.1\n# the upstream repository leads\nupstream = 'x'\n"
+    assert marker_problems(text, "example") == []
+
+
+# -- the rule says what this test holds ------------------------------------------
+
+
+def test_the_rule_names_this_test_and_the_marker_format() -> None:
+    rule = RULE.read_text(encoding="utf-8")
+    assert "tests/test_upstream_markers.py" in rule
+    assert "# upstream: <org>/" in rule and "remove when" in rule