arango-query-core 0.2.2__tar.gz → 0.2.3__tar.gz

arango_query_core-0.2.3/.claude/settings.json

@@ -0,0 +1,8 @@
+{
+  "permissions": {
+    "allow": [
+      "Bash(gh run *)",
+      "Bash(git worktree *)"
+    ]
+  }
+}

{arango_query_core-0.2.2 → arango_query_core-0.2.3}/CHANGELOG.md

@@ -6,6 +6,21 @@ exact versions (contextual-data-fabric CC-9) and re-run their golden /
 eval suites on every bump — pre-1.0, **minor** bumps may break the API
 and this file must say so explicitly.
 
+## [0.2.3] - 2026-10-21
+
+### Added
+
+- `PostconditionViolation.soft` (default `False`): a soft violation is
+  retried like any other, but when the retry budget is spent
+  `NLQueryEngine.generate` returns the first valid candidate whose only
+  objection was soft, instead of failing closed. The candidate still passes
+  guardrails, and the violation stays on `NLResult.postcondition` (`ok` True
+  with a non-None `postcondition` marks a soft fallback). For checks such as
+  "the query returned no rows", where empty is sometimes the right answer.
+  `run_postconditions` now returns the first *hard* violation ahead of any
+  soft one, so a hard check listed after a soft one still applies. Additive;
+  existing checks are unaffected. Part of #4.
+
 ## [0.2.2] - 2026-10-21
 
 ### Fixed

{arango_query_core-0.2.2 → arango_query_core-0.2.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: arango-query-core
-Version: 0.2.2
+Version: 0.2.3
 Summary: Shared conceptual-model and NL substrate for ArangoDB query transpilers (arango-cypher-py, arango-sparql-py)
 Project-URL: Repository, https://github.com/ArthurKeen/arango-query-core
 Project-URL: Changelog, https://github.com/ArthurKeen/arango-query-core/blob/main/CHANGELOG.md

{arango_query_core-0.2.2 → arango_query_core-0.2.3}/arango_query_core/nl/engine.py

@@ -39,7 +39,10 @@ class NLResult:
     """Outcome of one NL→query generation.
 
     ``query`` is empty when generation failed (``ok`` False); ``error``
-    then carries the last validation failure or guardrail refusal.
+    then carries the last validation failure, postcondition violation or
+    guardrail refusal. ``ok`` True with a non-None ``postcondition`` means a
+    soft fallback: the retry budget ran out and ``query`` is the first valid
+    candidate whose only objection was soft (``PostconditionViolation.soft``).
     Token fields accumulate across retries so cost accounting sees the
     whole conversation, not the last attempt.
     """
@@ -96,6 +99,9 @@ class NLQueryEngine:
         failure: ValidationResult | None = None
         violation: PostconditionViolation | None = None
         candidate = ""
+        # First valid candidate whose only objection was soft: what the call
+        # returns if the budget runs out without a clean candidate.
+        fallback: tuple[str, ValidationResult, PostconditionViolation] | None = None
 
         for attempt in range(self.max_retries + 1):
             if attempt > 0:
@@ -138,13 +144,25 @@ class NLQueryEngine:
             result.postcondition = violation
             if violation is None:
                 break
+            # Soft only if no check objected as hard (run_postconditions
+            # returns a hard violation ahead of any soft one).
+            if violation.soft and fallback is None:
+                fallback = (candidate, failure, violation)
+        else:
+            # Budget spent without a clean candidate. If one drew only a soft
+            # objection, return it — with the objection on the result — rather
+            # than refuse a query that may well be right.
+            if fallback is not None:
+                candidate, result.validation, result.postcondition = fallback
+                failure, violation = result.validation, None
 
         if failure is None or not failure.ok:
             result.error = failure.error if failure else "provider returned nothing"
             return result
         if violation is not None:
-            # Budget spent on a valid-but-semantically-rejected query — fail
-            # closed rather than return a plausible wrong answer.
+            # Budget spent on a valid-but-semantically-rejected query with no
+            # soft-only candidate to fall back on — fail closed rather than
+            # return a plausible wrong answer.
             result.error = f"{violation.reason} ({violation.code})"
             return result
 

{arango_query_core-0.2.2 → arango_query_core-0.2.3}/arango_query_core/nl/postconditions.py

@@ -15,14 +15,19 @@ budget as parse and translate: the model is told the rule up front (via
 :meth:`Postcondition.prompt_section`, rendered once into the cacheable system
 prefix), and a violation is fed back into the next prompt exactly like a
 validation failure — so the loop gets a chance to *correct* the query rather
-than just reject it, and fails closed when the budget is spent.
+than just reject it, and fails closed when the budget is spent — unless a
+candidate drew only a *soft* violation (``PostconditionViolation.soft``), in
+which case the first such candidate is returned instead.
 
 Semantics (mirrors ``nl2cypher``'s original, language-agnostic here):
 
 * Postconditions run **after** the adapter's ``validate`` succeeds — a retry is
   only ever spent on an already-valid query.
-* The **first** violation wins; checks are not accumulated. One clear, specific
-  correction beats a pile of them.
+* The **first hard** violation wins; checks are not accumulated. One clear,
+  specific correction beats a pile of them. A *soft* violation does not stop
+  the run: the remaining checks still see the query, and any hard violation
+  among them takes precedence. Only a query no check objects to as hard can
+  become a soft fallback, whatever order the checks are listed in.
 * A check that **raises** is treated as a violation, not an error — a broken
   postcondition must not turn a safety mechanism into an outage. Fail closed.
 * :meth:`Postcondition.prompt_section` renders **once**; it must not vary
@@ -60,6 +65,19 @@ class PostconditionViolation:
     """How to fix it. Also fed into the retry prompt, after ``reason``."""
     code: str = "postcondition_violation"
     """Stable identifier for telemetry / assertions, e.g. ``"time_windowed"``."""
+    soft: bool = False
+    """A soft violation asks for a retry but does not make the query unusable.
+
+    Use it for an objection that is sometimes the right answer — e.g. "the query
+    returned no rows" when the honest answer may be "none". When the retry
+    budget is spent, the engine returns the first valid candidate whose only
+    objection was soft (with this violation on ``NLResult.postcondition``)
+    instead of failing closed. Hard violations (the default) still fail closed.
+
+    Only that first soft candidate is offered to the guardrails: if they refuse
+    it, the call fails closed with the guardrail's reason, even when a later
+    soft candidate would have passed — the conservative reading.
+    """
 
 
 @dataclass(frozen=True)
@@ -109,15 +127,22 @@ def run_postconditions(
     postconditions: Sequence[Postcondition] | None,
     context: PostconditionContext,
 ) -> PostconditionViolation | None:
-    """Run *postconditions* in order, returning the first violation.
+    """Run *postconditions* in order, returning the first hard violation, or
+    else the first soft one.
+
+    A soft violation does not stop the run, so a hard check listed after it
+    still sees the query; otherwise a query breaking a hard rule could be
+    returned as a soft fallback.
 
-    A check that raises is treated as a violation rather than being allowed to
-    abort the translation: a broken check must not be able to turn a safety
-    mechanism into an outage, and failing closed is the conservative reading.
+    A check that raises is treated as a (hard) violation rather than being
+    allowed to abort the translation: a broken check must not be able to turn a
+    safety mechanism into an outage, and failing closed is the conservative
+    reading.
     """
     if not postconditions:
         return None
 
+    first_soft: PostconditionViolation | None = None
     for pc in postconditions:
         code = getattr(pc, "code", pc.__class__.__name__)
         try:
@@ -128,9 +153,13 @@ def run_postconditions(
                 reason=f"Postcondition {code!r} raised {type(exc).__name__}: {exc}",
                 suggested_hint="Simplify the query; the check could not evaluate it.",
             )
-        if violation is not None:
+        if violation is None:
+            continue
+        if not violation.soft:
             return violation
-    return None
+        if first_soft is None:
+            first_soft = violation
+    return first_soft
 
 
 def postcondition_prompt_sections(

{arango_query_core-0.2.2 → arango_query_core-0.2.3}/docs/PRD.md

@@ -127,7 +127,7 @@ to prevent a three-way fork.
 | `nl.fewshot` | `FewShotIndex` over `(question, query)` pairs (legacy corpus keys accepted); `BM25Retriever` (rank_bm25, `nl` extra) and `DenseRetriever` (sentence-transformers, `dense` extra), selected via `mode="bm25"\|"dense"\|"auto"`; `cached_few_shot_index` memoizes the expensive dense build |
 | `nl.grounding` | Seam 6/7 retrieval: `LabelIndex`/`GroundedEntity` (entity grounding) and `PredicateIndex`/`GroundedPredicate` (predicate/schema-convention grounding, renders IRI local names not labels), sharing one token-substring scorer |
 | `nl.pathindex` | Seam 8: `ClassPathIndex`/`ClassPath` — bounded shortest predicate paths between two seam-6/7-anchored classes over the TBox's class-connectivity graph |
-| `nl.postconditions` | Caller-supplied semantic invariants (`Postcondition`, `PostconditionContext`, `PostconditionViolation`, `run_postconditions`) enforced through the engine's own retry budget; fails closed on exhaustion |
+| `nl.postconditions` | Caller-supplied semantic invariants (`Postcondition`, `PostconditionContext`, `PostconditionViolation`, `run_postconditions`) enforced through the engine's own retry budget; fails closed on exhaustion, unless a valid candidate drew only a soft violation (`PostconditionViolation.soft`); the first such candidate is returned, with the violation on `NLResult.postcondition` |
 | `nl.synthbank` | `SHAPE_CATALOG`/`ShapeTemplate` — 9 ontology-agnostic compositional query-shape templates for synthetic few-shot bank generation |
 | `nl.seams` | `QueryLanguageAdapter` — the eight language-specific seams: (1) grammar prompt section, (2) few-shot corpus, (3) syntax validator, (4) repair rules keyed on validator errors, (5) guardrail checks, (6) entity grounding index, (7) predicate grounding index, (8) relationship-path grounding index. Plus `ValidationResult`, `GuardrailVerdict` |
 

{arango_query_core-0.2.2 → arango_query_core-0.2.3}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "arango-query-core"
-version = "0.2.2"
+version = "0.2.3"
 description = "Shared conceptual-model and NL substrate for ArangoDB query transpilers (arango-cypher-py, arango-sparql-py)"
 readme = "README.md"
 license = { file = "LICENSE" }

{arango_query_core-0.2.2 → arango_query_core-0.2.3}/tests/test_nl_postconditions.py

@@ -4,7 +4,9 @@ Covers the semantics the feature promises: postconditions run only on valid
 queries, share the retry budget, feed their correction back into the next
 prompt, fail closed on exhaustion, first-violation-wins, a raising check is a
 violation (not an outage), the rule is announced once in the system prompt,
-and the guardrail gate still runs after. All with fakes — no network.
+and the guardrail gate still runs after. Soft violations: retried the same way,
+returned as a fallback on exhaustion, never ahead of a hard violation whatever
+the check order. All with fakes — no network.
 """
 
 from __future__ import annotations
@@ -208,3 +210,133 @@ def test_run_postconditions_helper_empty_is_none():
     ctx = PostconditionContext(schema_summary="", question="q", attempt=0)
     assert run_postconditions("SELECT 1", None, ctx) is None
     assert run_postconditions("SELECT 1", [], ctx) is None
+
+
+class NonEmpty:
+    """Soft stand-in for "the query returned no rows": a candidate without
+    'WHERE' is treated as empty. Sometimes empty is the right answer, so the
+    objection is soft."""
+
+    code = "non_empty"
+
+    def prompt_section(self) -> str:
+        return ""
+
+    def check(self, query: str, *, context: PostconditionContext):
+        if "WHERE" in query:
+            return None
+        return PostconditionViolation(
+            code=self.code,
+            reason="The query returned no rows.",
+            suggested_hint="Check literals and labels.",
+            soft=True,
+        )
+
+
+def test_soft_violation_is_retried_like_a_hard_one():
+    eng = _engine(["SELECT *", "SELECT * WHERE {}"], [NonEmpty()])
+    r = eng.generate("q")
+    assert r.ok is True and r.retries == 1
+    assert r.query == "SELECT * WHERE {}"
+    assert r.postcondition is None
+    assert "Check literals and labels." in eng.provider.calls[1][1]
+
+
+def test_soft_exhaustion_returns_first_soft_candidate():
+    eng = _engine(["SELECT 1", "SELECT 2", "SELECT 3"], [NonEmpty()], max_retries=2)
+    r = eng.generate("q")
+    assert r.ok is True and r.error == ""
+    assert r.retries == 2  # the whole budget was spent first
+    assert r.query == "SELECT 1"  # the first candidate, not the last
+    assert r.postcondition is not None and r.postcondition.soft
+    assert r.postcondition.code == "non_empty"
+
+
+def test_soft_fallback_survives_a_later_invalid_candidate():
+    eng = _engine(["SELECT 1", "nonsense"], [NonEmpty()], max_retries=1)
+    r = eng.generate("q")
+    assert r.ok is True and r.query == "SELECT 1"
+    assert r.validation is not None and r.validation.ok
+
+
+def test_soft_fallback_survives_a_later_hard_violation():
+    # Soft-only first candidate (has LIMIT, no WHERE); the second breaks the
+    # hard invariant. The soft candidate is the one worth returning.
+    eng = _engine(["SELECT * LIMIT 1", "SELECT *"], [NeedsLimit(), NonEmpty()], max_retries=1)
+    r = eng.generate("q")
+    assert r.ok is True and r.query == "SELECT * LIMIT 1"
+    assert r.postcondition is not None and r.postcondition.code == "non_empty"
+
+
+def test_hard_violation_still_fails_closed_beside_a_soft_check():
+    # Every candidate breaks the hard rule first (first violation wins), so
+    # none is ever soft-only: no fallback, fail closed as before.
+    eng = _engine(["SELECT *"], [NeedsLimit(), NonEmpty()], max_retries=2)
+    r = eng.generate("q")
+    assert r.ok is False and r.query == ""
+    assert r.postcondition is not None and r.postcondition.code == "needs_limit"
+
+
+def test_soft_fallback_still_passes_the_guardrail_gate():
+    eng = _engine(["SELECT 1"], [NonEmpty()], allow=False, max_retries=1)
+    r = eng.generate("q")
+    assert r.ok is False and r.query == ""
+    assert "tenant scope" in r.error
+
+
+def test_violation_is_hard_by_default():
+    assert PostconditionViolation(reason="r", suggested_hint="h").soft is False
+
+
+def test_hard_check_after_a_soft_one_still_applies():
+    # Regression: the soft check used to short-circuit the run, so a query
+    # breaking the hard rule listed after it came back ok as a soft fallback.
+    eng = _engine(["SELECT *"], [NonEmpty(), NeedsLimit()], max_retries=2)
+    r = eng.generate("q")
+    assert r.ok is False and r.query == ""
+    assert r.postcondition is not None and r.postcondition.code == "needs_limit"
+
+
+def test_soft_then_hard_reports_the_hard_correction():
+    eng = _engine(["SELECT *", "SELECT * LIMIT 1 WHERE {}"], [NonEmpty(), NeedsLimit()])
+    r = eng.generate("q")
+    assert r.ok is True and r.retries == 1
+    assert "Add LIMIT 100." in eng.provider.calls[1][1]  # the hard hint, not the soft one
+
+
+def test_raising_check_after_a_soft_one_still_fails_closed():
+    class Boom:
+        code = "boom"
+
+        def prompt_section(self):
+            return ""
+
+        def check(self, query, *, context):
+            raise ValueError("kaboom")
+
+    eng = _engine(["SELECT 1"], [NonEmpty(), Boom()], max_retries=1)
+    r = eng.generate("q")
+    assert r.ok is False and r.query == ""
+    assert r.postcondition is not None and r.postcondition.code == "boom_error"
+
+
+def test_soft_fallback_with_no_retries():
+    eng = _engine(["SELECT 1"], [NonEmpty()], max_retries=0)
+    r = eng.generate("q")
+    assert r.ok is True and r.retries == 0 and r.query == "SELECT 1"
+    assert r.postcondition is not None and r.postcondition.soft
+
+
+def test_clean_last_candidate_beats_the_soft_fallback():
+    eng = _engine(["SELECT 1 LIMIT 1", "SELECT * LIMIT 1 WHERE {}"], [NeedsLimit(), NonEmpty()])
+    r = eng.generate("q")
+    assert r.ok is True and r.query == "SELECT * LIMIT 1 WHERE {}"
+    assert r.postcondition is None
+
+
+def test_run_postconditions_prefers_hard_over_earlier_soft():
+    ctx = PostconditionContext(schema_summary="", question="q", attempt=0)
+    v = run_postconditions("SELECT *", [NonEmpty(), NeedsLimit()], ctx)
+    assert v is not None and v.code == "needs_limit" and not v.soft
+    v = run_postconditions("SELECT * LIMIT 1", [NonEmpty(), NeedsLimit()], ctx)
+    assert v is not None and v.code == "non_empty" and v.soft