canot 0.1.0__py3-none-any.whl

canot/__init__.py

@@ -0,0 +1 @@
+__version__ = "0.1.0"

canot/cli.py

@@ -0,0 +1,195 @@
+from __future__ import annotations
+
+import argparse
+import json
+import sys
+from pathlib import Path
+
+from . import __version__
+
+
+def _p(*a):
+    print(*a, flush=True)
+
+
+def main(argv: list[str] | None = None) -> int:
+    ap = argparse.ArgumentParser(prog="canot", description="Prouvez que vous pouvez partir.")
+    ap.add_argument("--version", action="version", version=__version__)
+    sub = ap.add_subparsers(dest="cmd", required=True)
+
+    s = sub.add_parser("scan", help="radiographie en lecture seule : inventaire, enfermement, coût de sortie estimé")
+    s.add_argument("--from", dest="src", required=True)
+    s.add_argument("--out", default="canot-out")
+    s.add_argument("--credit-price", type=float, default=3.90, help="prix du crédit Snowflake (est. Enterprise, AWS Paris)")
+
+    d = sub.add_parser("drill", help="exercice de sortie complet : copie, comparaison, dossier de preuve")
+    d.add_argument("--from", dest="src", required=True)
+    d.add_argument("--to", dest="dst", required=True, help="dossier local, s3://..., ou scaleway:fr-par, ovh:gra, outscale:eu-west-2, ionos:de..., avec --bucket")
+    d.add_argument("--bucket")
+    d.add_argument("--out", default="canot-out")
+    d.add_argument("--queries", help="optionnel : fichier SQL à rejouer. Par défaut, les requêtes les plus coûteuses de l'historique de la plateforme.")
+    d.add_argument("--top", type=int, default=20)
+    d.add_argument("--tolerances", help="fichier TOML (voir `canot init-tolerances`)")
+    d.add_argument("--tables", nargs="*", help="limiter à ces tables (SCHEMA.TABLE)")
+    d.add_argument("--key", default=str(Path.home() / ".canot" / "evidence.key"))
+    d.add_argument("--credit-price", type=float, default=3.90)
+
+    t = sub.add_parser("teardown", help="supprime les données copiées")
+    t.add_argument("--to", dest="dst", required=True)
+    t.add_argument("--bucket")
+    t.add_argument("--out", default="canot-out")
+
+    v = sub.add_parser("verify-evidence", help="vérifie la chaîne et la signature d'un dossier")
+    v.add_argument("dir")
+
+    ss = sub.add_parser("snowflake-setup", help="affiche le script SQL d'accès en lecture seule à relire")
+    ss.add_argument("--generate-key", action="store_true", help="crée la paire de clés ici et met la clé publique dans le script")
+    ss.add_argument("--base", default="<BASE>", help="base Snowflake à copier")
+    dm = sub.add_parser("demo", help="démonstration complète en 30 secondes, sans compte : distributeur fictif, exercice, dossier de preuve")
+    dm.add_argument("--out", default="canot-demo")
+    dm.add_argument("--rows", type=int, default=50_000)
+    dm.add_argument("--no-open", action="store_true", help="n'ouvre pas le rapport dans le navigateur")
+    it = sub.add_parser("init-tolerances", help="écrit un fichier de tolérances à relire avec le client")
+    it.add_argument("path", nargs="?", default="tolerances.toml")
+    dd = sub.add_parser("demo-data", help="crée une base DuckDB de démonstration")
+    dd.add_argument("path")
+    dd.add_argument("--rows", type=int, default=20_000)
+    dd.add_argument("--retail", action="store_true", help="jeu fictif de distributeur (tickets avec lignes imbriquées)")
+
+    a = ap.parse_args(argv)
+    out = Path(getattr(a, "out", "canot-out"))
+
+    if a.cmd == "snowflake-setup":
+        from .sources.snowflake_src import SETUP_SQL
+
+        sql = SETUP_SQL.replace("<BASE>", a.base)
+        if a.generate_key:
+            from cryptography.hazmat.primitives import serialization
+            from cryptography.hazmat.primitives.asymmetric import rsa
+            import os
+
+            kp = Path.home() / ".canot" / "snowflake_rsa_key.p8"
+            if kp.exists():
+                key = serialization.load_pem_private_key(kp.read_bytes(), password=None)
+            else:
+                kp.parent.mkdir(parents=True, exist_ok=True)
+                key = rsa.generate_private_key(public_exponent=65537, key_size=2048)
+                kp.write_bytes(key.private_bytes(serialization.Encoding.PEM, serialization.PrivateFormat.PKCS8, serialization.NoEncryption()))
+                os.chmod(kp, 0o600)
+            pub = key.public_key().public_bytes(serialization.Encoding.PEM, serialization.PublicFormat.SubjectPublicKeyInfo).decode()
+            pub = "".join(l for l in pub.splitlines() if not l.startswith("-----"))
+            sql = sql.replace("<clé publique, sans les lignes BEGIN/END>", pub)
+            print(f"-- Clé privée : {kp} (reste sur cette machine). Puis : export SNOWFLAKE_PRIVATE_KEY_PATH={kp}", file=sys.stderr)
+        _p(sql)
+        return 0
+    if a.cmd == "demo":
+        import webbrowser
+
+        from .demo import RETAIL_QUERIES, make_retail
+        from .drill import run_drill
+        from .report import write_report
+        from .source_loader import open_demo
+        from .target import parse_target
+        from .tolerances import Tolerances
+
+        work = Path(a.out)
+        work.mkdir(parents=True, exist_ok=True)
+        db = work / "maison.duckdb"
+        if db.exists():
+            db.unlink()
+        _p("Canot : démonstration sur un distributeur fictif (données inventées)\n")
+        make_retail(str(db), a.rows)
+        qf = work / "requetes.sql"
+        qf.write_text(RETAIL_QUERIES)
+        src = open_demo(str(db))
+        try:
+            res = run_drill(src, parse_target(str(work / "lac"), None, work), work / "dossier", Path.home() / ".canot" / "evidence.key", str(qf), Tolerances(), log=_p)
+        finally:
+            src.close()
+        rep = write_report(res, work / "dossier")
+        _p(f"\n{res['summary']['parity'] == 'complète' and 'Parité complète' or 'Des écarts ont été trouvés'} : {res['summary']['tables_ok']}/{res['summary']['tables_total']} tables, {res['summary']['queries_match']}/{res['summary']['queries_total']} requêtes.")
+        _p(f"Dossier de preuve : {rep}")
+        _p("Vérifier qu'il n'a pas été modifié : canot verify-evidence " + str(work / "dossier"))
+        _p("\nEt maintenant, sur vos données (lecture seule) :  canot scan --from \"bigquery://MON-PROJET/mon_dataset?location=EU\"")
+        _p("Besoin d'aide pour l'exécuter sur votre périmètre ? https://canot.io/#contact")
+        if not a.no_open:
+            webbrowser.open(rep.resolve().as_uri())
+        return 0
+    if a.cmd == "init-tolerances":
+        from .tolerances import DEFAULT_TOML
+
+        Path(a.path).write_text(DEFAULT_TOML)
+        _p(f"écrit : {a.path}")
+        return 0
+    if a.cmd == "demo-data":
+        from .demo import DEMO_QUERIES, RETAIL_QUERIES, make_demo, make_retail
+
+        if a.retail:
+            make_retail(a.path, a.rows)
+        else:
+            make_demo(a.path, a.rows)
+        q = Path(a.path).with_suffix(".queries.sql")
+        q.write_text(RETAIL_QUERIES if a.retail else DEMO_QUERIES)
+        _p(f"écrit : {a.path} et {q}")
+        return 0
+    if a.cmd == "verify-evidence":
+        from .evidence import verify_dir
+
+        ok, msg = verify_dir(Path(a.dir))
+        _p(("OK : " if ok else "ÉCHEC : ") + msg)
+        return 0 if ok else 2
+
+    if a.cmd == "teardown":
+        from .target import parse_target
+
+        _p(parse_target(a.dst, a.bucket, out).teardown())
+        return 0
+
+    from .sources import open_source
+
+    src = open_source(a.src)
+    try:
+        if a.cmd == "scan":
+            from .scan import scan
+
+            res = scan(src, a.credit_price)
+            out.mkdir(parents=True, exist_ok=True)
+            (out / "scan.json").write_text(json.dumps(res, indent=2, default=str, ensure_ascii=False))
+            tt = res["totals"]
+            _p(f"Source : {res['source']}")
+            _p(f"{tt['tables']} tables, {tt['rows']} lignes, {tt['gb']} Go")
+            e = res["exit_estimate"]
+            _p(f"Sortie estimée : {e['duration_hours'][0]} à {e['duration_hours'][1]} h de copie ({e['assumed_throughput_mb_s'][0]}-{e['assumed_throughput_mb_s'][1]} Mo/s, est.)")
+            if "cost_usd" in e:
+                _p(f"Coût de lecture estimé : {e['cost_usd'][0]} à {e['cost_usd'][1]} $ ({e['credits'][0]}-{e['credits'][1]} crédits)")
+            if res["egress_note"]:
+                _p(res["egress_note"])
+            if res["usage_90d"]:
+                _p(f"Consommation 90 jours : {res['usage_90d']}")
+            _p(f"Colonnes à type propre à la plateforme : {len(res['non_portable_columns'])}")
+            for k, n in res["object_counts"].items():
+                if n:
+                    _p(f"  {k} à reconstruire : {n}")
+            _p(f"Détail : {out / 'scan.json'}")
+            return 0
+
+        if a.cmd == "drill":
+            from .drill import run_drill
+            from .report import write_report
+            from .target import parse_target
+            from .tolerances import Tolerances
+
+            target = parse_target(a.dst, a.bucket, out)
+            res = run_drill(src, target, out, Path(a.key), a.queries, Tolerances.load(a.tolerances), a.top, a.tables, a.credit_price, _p)
+            rep = write_report(res, out)
+            s = res["summary"]
+            _p(f"\nParité : {s['parity']} — {s['tables_ok']}/{s['tables_total']} tables, {s['queries_match']}/{s['queries_total']} requêtes")
+            _p(f"Dossier : {rep}")
+            return 0 if s["parity"] == "complète" else 1
+    finally:
+        src.close()
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

canot/convert.py

@@ -0,0 +1,97 @@
+"""Arrow -> Iceberg-compatible schema, row fingerprints."""
+from __future__ import annotations
+
+from dataclasses import dataclass
+
+import duckdb
+import pyarrow as pa
+
+from .model import q
+
+BUCKETS = 64
+
+
+@dataclass
+class Conversion:
+    table: str
+    column: str
+    source_type: str
+    target_type: str
+    lossy: bool
+    note: str
+
+
+def _convert_type(t: pa.DataType) -> tuple[pa.DataType, str | None, bool]:
+    if pa.types.is_timestamp(t) and t.unit == "ns":
+        return pa.timestamp("us", tz=t.tz), "ns -> us (Iceberg v2 ne garde pas les nanosecondes)", True
+    if pa.types.is_large_string(t):
+        return pa.string(), None, False
+    if pa.types.is_null(t):
+        return pa.string(), "colonne entièrement nulle, typée texte", False
+    if pa.types.is_unsigned_integer(t):
+        wider = {8: pa.int16(), 16: pa.int32(), 32: pa.int64(), 64: pa.int64()}[t.bit_width]
+        return wider, "entier non signé -> signé", t.bit_width == 64
+    if pa.types.is_decimal(t) and t.precision > 38:
+        return pa.string(), "précision > 38 stockée en texte", True
+    if pa.types.is_struct(t) and {f.name.lower() for f in t} >= {"epoch", "timezone"}:
+        return pa.string(), "TIMESTAMP_TZ natif Snowflake : fuseau d'origine gardé en texte", True
+    if pa.types.is_list(t) or pa.types.is_large_list(t):
+        inner, _, lossy = _convert_type(t.value_type)
+        return pa.list_(inner), None, lossy
+    if pa.types.is_struct(t):
+        fields, lossy = [], False
+        for f in t:
+            ft, _, l = _convert_type(f.type)
+            fields.append(pa.field(f.name, ft))
+            lossy = lossy or l
+        return pa.struct(fields), None, lossy
+    if pa.types.is_dictionary(t):
+        return t.value_type, None, False
+    return t, None, False
+
+
+def target_schema(table: str, schema: pa.Schema, source_types: dict[str, str]) -> tuple[pa.Schema, list[Conversion]]:
+    fields, convs = [], []
+    for f in schema:
+        nt, note, lossy = _convert_type(f.type)
+        if note or nt != f.type:
+            convs.append(Conversion(table, f.name, source_types.get(f.name, str(f.type)), str(nt), lossy, note or "type normalisé"))
+        fields.append(pa.field(f.name, nt, nullable=True))
+    return pa.schema(fields), convs
+
+
+def conform(batch: pa.RecordBatch | pa.Table, schema: pa.Schema) -> pa.Table:
+    t = batch if isinstance(batch, pa.Table) else pa.Table.from_batches([batch])
+    cols = []
+    for f in schema:
+        col = t.column(f.name)
+        if col.type != f.type:
+            if pa.types.is_string(f.type) and pa.types.is_struct(col.type):
+                col = pa.array([None if v is None else str(v) for v in col.to_pylist()], type=pa.string())
+            else:
+                col = col.cast(f.type, safe=False)
+        cols.append(col)
+    return pa.Table.from_arrays(cols, schema=schema)
+
+
+def fingerprint(table: pa.Table) -> dict[int, list[int]]:
+    """Per-bucket [row_count, sum_of_row_hashes]. Additive, so batches can be merged."""
+    if table.num_rows == 0 or table.num_columns == 0:
+        return {}
+    con = duckdb.connect()
+    con.register("t", table)
+    parts = ", ".join(f"({q(n)} is null), coalesce(cast({q(n)} as varchar), '')" for n in table.column_names)
+    rows = con.execute(
+        f"select h % {BUCKETS} b, count(*), sum(h % 1000000007) from (select hash({parts}) h from t) group by 1"
+    ).fetchall()
+    con.close()
+    return {int(b): [int(c), int(s)] for b, c, s in rows}
+
+
+def merge_fp(a: dict[int, list[int]], b: dict[int, list[int]]) -> dict[int, list[int]]:
+    out = {k: list(v) for k, v in a.items()}
+    for k, (c, s) in b.items():
+        cur = out.setdefault(k, [0, 0])
+        cur[0] += c
+        cur[1] += s
+    return out

canot/copy.py

@@ -0,0 +1,68 @@
+from __future__ import annotations
+
+import time
+from dataclasses import dataclass, field
+
+import pyarrow as pa
+
+from .convert import Conversion, conform, fingerprint, merge_fp, target_schema
+from .model import TableInfo
+from .sources.base import Source
+
+
+@dataclass
+class CopyResult:
+    table: TableInfo
+    rows: int = 0
+    bytes: int = 0
+    seconds: float = 0.0
+    fingerprint: dict[int, list[int]] = field(default_factory=dict)
+    conversions: list[Conversion] = field(default_factory=list)
+    schema: pa.Schema | None = None
+    error: str | None = None
+
+
+def copy_table(src: Source, t: TableInfo, catalog, chunk_rows: int = 500_000) -> CopyResult:
+    res = CopyResult(t)
+    t0 = time.monotonic()
+    ns = t.schema
+    try:
+        catalog.create_namespace_if_not_exists(ns)
+        types = {c.name: c.type for c in t.columns}
+        ice = None
+        buf: list[pa.RecordBatch] = []
+        buf_rows = 0
+
+        def flush():
+            nonlocal buf, buf_rows
+            if not buf:
+                return
+            tbl = conform(pa.Table.from_batches(buf), res.schema)
+            ice.append(tbl)
+            res.fingerprint = merge_fp(res.fingerprint, fingerprint(tbl))
+            res.rows += tbl.num_rows
+            res.bytes += tbl.nbytes
+            buf, buf_rows = [], 0
+
+        for batch in src.read(t):
+            if ice is None:
+                res.schema, res.conversions = target_schema(t.fqn, batch.schema, types)
+                ident = (ns, t.name)
+                if catalog.table_exists(ident):
+                    catalog.drop_table(ident)
+                ice = catalog.create_table(ident, schema=res.schema)
+            buf.append(batch)
+            buf_rows += batch.num_rows
+            if buf_rows >= chunk_rows:
+                flush()
+        if ice is None:  # empty table: schema from source column list is not available as arrow; create from a limit-0 read
+            empty = src.query(f"select * from {t.sql} limit 0") if src.dialect == "duckdb" else None
+            if empty is not None:
+                res.schema, res.conversions = target_schema(t.fqn, empty.schema, types)
+                catalog.create_table((ns, t.name), schema=res.schema)
+        else:
+            flush()
+    except Exception as e:  # keep going: one broken table must not hide the others
+        res.error = f"{type(e).__name__}: {e}"
+    res.seconds = time.monotonic() - t0
+    return res

canot/demo.py

@@ -0,0 +1,98 @@
+"""Synthetic data that exercises the usual traps (decimals, timestamps, NULLs, JSON, unicode)."""
+from __future__ import annotations
+
+import duckdb
+
+
+def make_demo(path: str, n: int = 20_000) -> None:
+    con = duckdb.connect(path)
+    con.execute("create schema if not exists shop")
+    con.execute(f"""
+        create or replace table shop.customers as
+        select i as id, 'client_' || i as name,
+               case when i % 7 = 0 then null else 'ville_' || (i % 50) end as city,
+               case when i % 11 = 0 then 'Zoé ☃ ' || i else 'plain ' || i end as note
+        from range(1, {n // 10 + 1}) t(i)""")
+    con.execute(f"""
+        create or replace table shop.orders as
+        select i as id, 1 + (i % {n // 10}) as customer_id,
+               cast((i * 37 % 100000) / 100.0 as decimal(18,2)) as total,
+               (i * 0.137)::double as score,
+               timestamp '2026-01-01 00:00:00' + to_seconds(i * 997) + to_microseconds(i % 1000000) as created_at,
+               case when i % 13 = 0 then null else date '2026-01-01' + (i % 300)::int end as ship_date,
+               '{{"k":' || i || ',"tags":["a","b"]}}' as payload
+        from range(1, {n + 1}) t(i)""")
+    con.execute("""
+        create or replace table shop.empty_table (id integer, label varchar)""")
+    con.close()
+
+
+DEMO_QUERIES = """\
+select city, count(*) as n, sum(o.total) as revenue
+from shop.orders o join shop.customers c on c.id = o.customer_id
+group by city order by revenue desc nulls last;
+
+select date_trunc('month', created_at) as m, count(*) as n, avg(score) as avg_score
+from shop.orders group by 1 order by 1;
+
+select customer_id, max(total) as biggest
+from shop.orders where ship_date is not null group by 1 order by biggest desc limit 20;
+
+select * from shop.orders order by ship_date limit 50;
+"""
+
+
+def make_retail(path: str, tickets: int = 50_000) -> None:
+    """Fictional grocery retailer ("Maison Marché"): invented data only. Includes nested lines
+    (ARRAY<STRUCT>, as BigQuery exports them), decimals, NULLs, accents and a JSON-as-text column."""
+    con = duckdb.connect(path)
+    con.execute("create schema if not exists distrib")
+    con.execute("""
+        create or replace table distrib.stores as
+        select i as store_id, 'Magasin ' || i as name,
+               (['hyper','super','proxi','drive'])[1 + i % 4] as format,
+               (['Île-de-France','Occitanie','Bretagne','Hauts-de-France','Auvergne-Rhône-Alpes'])[1 + i % 5] as region,
+               date '2008-01-01' + (i * 37 % 6000)::int as opened_on
+        from range(1, 301) t(i)""")
+    con.execute("""
+        create or replace table distrib.products as
+        select i as product_id, 'Produit ' || i as label,
+               (['frais','épicerie','boissons','hygiène','bazar'])[1 + i % 5] as category,
+               cast(0.5 + (i * 13 % 2500) / 100.0 as decimal(10,2)) as unit_price,
+               case when i % 9 = 0 then null else 'marque_' || (i % 40) end as brand
+        from range(1, 2001) t(i)""")
+    con.execute(f"""
+        create or replace table distrib.loyalty_customers as
+        select i as customer_id, case when i % 5 = 0 then null else 'ville_' || (i % 80) end as city,
+               timestamp '2022-01-01' + to_days((i % 1400)::int) as joined_at,
+               '{{"opt_in":' || (i % 2 = 0) || ',"segment":"s' || (i % 6) || '"}}' as prefs
+        from range(1, 8001) t(i)""")
+    con.execute(f"""
+        create or replace table distrib.tickets as
+        select i as ticket_id, 1 + (i * 7 % 300) as store_id,
+               case when i % 4 = 0 then null else 1 + (i * 11 % 8000) end as customer_id,
+               timestamp '2026-03-01 08:00:00' + to_seconds((i * 53) % 2500000) as sold_at,
+               cast(timestamp '2026-03-01 08:00:00' + to_seconds((i * 53) % 2500000) + to_microseconds(i % 997) as timestamp_ns) as scanned_at,
+               cast(((i * 97) % 20000) / 100.0 + 1 as decimal(12,2)) as total,
+               [struct_pack(product_id := 1 + (i * 3 % 2000), qty := 1 + i % 4),
+                struct_pack(product_id := 1 + (i * 5 % 2000), qty := 1 + i % 2)] as lines
+        from range(1, {tickets + 1}) t(i)""")
+    con.close()
+
+
+RETAIL_QUERIES = """\
+select s.region, s.format, count(*) as tickets, sum(t.total) as revenue, avg(t.total) as basket
+from distrib.tickets t join distrib.stores s using (store_id)
+group by 1, 2 order by revenue desc;
+
+select date_trunc('week', sold_at) as week, count(*) as tickets, sum(total) as revenue
+from distrib.tickets group by 1 order by 1;
+
+select c.city, count(*) as tickets, sum(t.total) as revenue
+from distrib.tickets t join distrib.loyalty_customers c using (customer_id)
+group by 1 order by revenue desc nulls last limit 30;
+
+select p.category, sum(l.qty * p.unit_price) as revenue
+from distrib.tickets t, unnest(t.lines) as u(l) join distrib.products p on p.product_id = l.product_id
+group by 1 order by 2 desc;
+"""

canot/drill.py

@@ -0,0 +1,103 @@
+from __future__ import annotations
+
+import time
+from dataclasses import asdict
+from pathlib import Path
+
+import duckdb
+import pyarrow
+import pyiceberg
+import sqlglot
+
+from . import __version__
+from .copy import copy_table
+from .evidence import EvidenceLog
+from .scan import scan as run_scan
+from .sources.base import Source
+from .target import Target
+from .tolerances import Tolerances
+from .verify import check_table, replay_queries, split_sql
+
+
+def run_drill(src: Source, target: Target, out: Path, key_path: Path, queries_file: str | None,
+              tol: Tolerances, top_n: int = 20, only: list[str] | None = None,
+              credit_price: float | None = 3.90, log=print) -> dict:
+    out.mkdir(parents=True, exist_ok=True)
+    ev = EvidenceLog(out)
+    t_start = time.monotonic()
+    env = {"canot": __version__, "duckdb": duckdb.__version__, "pyarrow": pyarrow.__version__,
+           "pyiceberg": pyiceberg.__version__, "sqlglot": sqlglot.__version__}
+    ev.add("start", {"source": src.describe(), "target": target.label, "env": env, "tolerances": tol.to_dict()})
+
+    log("→ inventaire")
+    scan_res = run_scan(src, credit_price)
+    ev.add("scan", {"totals": scan_res["totals"], "objects": scan_res["object_counts"]})
+    tables = [t for t in src.tables() if not only or t.fqn.lower() in {o.lower() for o in only}]
+
+    cat = target.catalog()
+    log(f"→ copie de {len(tables)} table(s) vers {target.label}")
+    copies = {}
+    conversions = []
+    for t in tables:
+        r = copy_table(src, t, cat)
+        copies[t.fqn] = r
+        conversions += r.conversions
+        mb = r.bytes / 1e6
+        log(f"   {t.fqn}: {r.rows} lignes, {mb:.1f} Mo, {r.seconds:.1f}s" + (f"  ERREUR {r.error}" if r.error else ""))
+        ev.add("copy", {"table": t.fqn, "rows": r.rows, "bytes": r.bytes, "seconds": round(r.seconds, 3), "error": r.error,
+                        "fingerprint": r.fingerprint})
+    copy_seconds = sum(r.seconds for r in copies.values())
+    copy_bytes = sum(r.bytes for r in copies.values())
+
+    log("→ comparaison des tables")
+    checks = []
+    for t in tables:
+        r = copies[t.fqn]
+        if r.error:
+            continue
+        c = check_table(src, t, cat.load_table((t.schema, t.name)), r.fingerprint, tol)
+        checks.append(c)
+        log(f"   {t.fqn}: {'OK' if c.ok else 'ÉCART'}")
+        ev.add("table_check", asdict(c) | {"ok": c.ok})
+
+    queries = split_sql(Path(queries_file).read_text()) if queries_file else src.history_queries(top_n)
+    qres = []
+    if queries:
+        log(f"→ rejeu de {len(queries)} requête(s) des deux côtés")
+        qres = replay_queries(src, queries[:top_n], cat, [t for t in tables if not copies[t.fqn].error], tol)
+        for q in qres:
+            log(f"   [{q.status}] {q.sql[:70].replace(chr(10), ' ')}")
+            ev.add("query", asdict(q))
+    else:
+        log("→ aucune requête fournie (--queries) ni trouvée dans l'historique : rejeu sauté")
+
+    mbps = (copy_bytes / 1e6) / copy_seconds if copy_seconds > 0 else None
+    total_bytes = scan_res["totals"]["bytes"] or copy_bytes
+    rto = None
+    if mbps:
+        center = total_bytes / 1e6 / mbps
+        rto = {"seconds": [round(center * 0.7, 1), round(center * 1.5, 1)], "basis": "débit mesuré ±, hors validation humaine et reprise des applications"}
+    credits = round(copy_seconds / 3600 * src.credits_per_hour, 4) if src.dialect == "snowflake" else None
+    summary = {
+        "tables_total": len(tables),
+        "tables_ok": sum(1 for c in checks if c.ok),
+        "tables_error": [t for t, r in copies.items() if r.error],
+        "queries_total": len(qres),
+        "queries_match": sum(1 for q in qres if q.status == "match"),
+        "queries_mismatch": sum(1 for q in qres if q.status == "mismatch"),
+        "queries_untranslatable": sum(1 for q in qres if q.status in ("untranslatable", "error")),
+        "queries_order_differs": sum(1 for q in qres if q.order_differs),
+        "lossy_conversions": sum(1 for c in conversions if c.lossy),
+        "throughput_mb_s": round(mbps, 2) if mbps else None,
+        "rto": rto,
+        "warehouse_credits_used_est": credits,
+        "cost_usd_est": round(credits * credit_price, 2) if credits is not None and credit_price else None,
+        "duration_s": round(time.monotonic() - t_start, 1),
+    }
+    summary["parity"] = ("complète" if summary["tables_ok"] == summary["tables_total"] and not summary["tables_error"]
+                         and not summary["queries_mismatch"] else "écarts")
+    ev.add("summary", summary)
+    seal = ev.seal(key_path)
+    return {"summary": summary, "scan": scan_res, "checks": [asdict(c) | {"ok": c.ok} for c in checks],
+            "queries": [asdict(q) for q in qres], "conversions": [asdict(c) for c in conversions],
+            "env": env, "seal": seal, "source": src.describe(), "target": target.label, "tolerances": tol.to_dict()}

canot/evidence.py

@@ -0,0 +1,72 @@
+"""Tamper-evident log: every entry holds the hash of the previous one; the last hash is signed
+with an Ed25519 key created in the customer's environment."""
+from __future__ import annotations
+
+import hashlib
+import json
+import os
+from datetime import datetime, timezone
+from pathlib import Path
+
+from cryptography.exceptions import InvalidSignature
+from cryptography.hazmat.primitives import serialization
+from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey, Ed25519PublicKey
+
+
+def _h(b: bytes) -> str:
+    return hashlib.sha256(b).hexdigest()
+
+
+class EvidenceLog:
+    def __init__(self, out: Path):
+        self.out = out
+        out.mkdir(parents=True, exist_ok=True)
+        self.path = out / "evidence.jsonl"
+        self.entries: list[dict] = []
+        self.prev = "0" * 64
+
+    def add(self, event: str, data: dict) -> None:
+        data = json.loads(json.dumps(data, sort_keys=True, default=str))  # normalise (clés int -> str) avant de hacher
+        e = {"seq": len(self.entries), "ts": datetime.now(timezone.utc).isoformat(timespec="seconds"),
+             "event": event, "data": data, "prev": self.prev}
+        e["hash"] = _h(json.dumps({k: e[k] for k in ("seq", "ts", "event", "data", "prev")}, sort_keys=True, default=str).encode())
+        self.prev = e["hash"]
+        self.entries.append(e)
+
+    def seal(self, key_path: Path) -> dict:
+        key = load_or_create_key(key_path)
+        sig = key.sign(self.prev.encode())
+        pub = key.public_key().public_bytes(serialization.Encoding.PEM, serialization.PublicFormat.SubjectPublicKeyInfo)
+        self.path.write_text("\n".join(json.dumps(e, sort_keys=True, default=str) for e in self.entries) + "\n")
+        (self.out / "evidence.sig").write_text(sig.hex())
+        (self.out / "evidence.pub").write_bytes(pub)
+        return {"last_hash": self.prev, "signature": sig.hex(), "entries": len(self.entries)}
+
+
+def load_or_create_key(path: Path) -> Ed25519PrivateKey:
+    if path.exists():
+        return serialization.load_pem_private_key(path.read_bytes(), password=None)  # type: ignore[return-value]
+    path.parent.mkdir(parents=True, exist_ok=True)
+    key = Ed25519PrivateKey.generate()
+    path.write_bytes(key.private_bytes(serialization.Encoding.PEM, serialization.PrivateFormat.PKCS8, serialization.NoEncryption()))
+    os.chmod(path, 0o600)
+    return key
+
+
+def verify_dir(d: Path) -> tuple[bool, str]:
+    try:
+        lines = [json.loads(l) for l in (d / "evidence.jsonl").read_text().splitlines() if l.strip()]
+        prev = "0" * 64
+        for e in lines:
+            body = {k: e[k] for k in ("seq", "ts", "event", "data", "prev")}
+            if e["prev"] != prev or _h(json.dumps(body, sort_keys=True, default=str).encode()) != e["hash"]:
+                return False, f"chaîne rompue à l'entrée {e['seq']}"
+            prev = e["hash"]
+        pub = serialization.load_pem_public_key((d / "evidence.pub").read_bytes())
+        assert isinstance(pub, Ed25519PublicKey)
+        pub.verify(bytes.fromhex((d / "evidence.sig").read_text().strip()), prev.encode())
+        return True, f"{len(lines)} entrées, chaîne intacte, signature valide"
+    except InvalidSignature:
+        return False, "signature invalide"
+    except Exception as e:
+        return False, f"{type(e).__name__}: {e}"

canot/model.py

@@ -0,0 +1,36 @@
+from __future__ import annotations
+
+from dataclasses import dataclass, field
+
+from sqlglot import exp
+
+
+def q(ident: str, dialect: str = "duckdb") -> str:
+    """Quote an SQL identifier for the given dialect (backticks for BigQuery/Databricks, double quotes otherwise)."""
+    return exp.to_identifier(ident, quoted=True).sql(dialect=dialect)
+
+
+@dataclass
+class ColumnInfo:
+    name: str
+    type: str
+
+
+@dataclass
+class TableInfo:
+    schema: str
+    name: str
+    rows: int | None = None
+    bytes: int | None = None
+    columns: list[ColumnInfo] = field(default_factory=list)
+
+    @property
+    def fqn(self) -> str:
+        return f"{self.schema}.{self.name}"
+
+    def sql_for(self, dialect: str = "duckdb") -> str:
+        return f"{q(self.schema, dialect)}.{q(self.name, dialect)}"
+
+    @property
+    def sql(self) -> str:
+        return self.sql_for("duckdb")