code-standards 8.132.4__tar.gz → 8.134.0__tar.gz

{code_standards-8.132.4 → code_standards-8.134.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: code-standards
-Version: 8.132.4
+Version: 8.134.0
 Summary: One deterministic quality gate for Sarj Python, TypeScript, Swift, Kotlin, shell, SQL, IaC, and repository policy.
 Project-URL: Homepage, https://code-standards.sarj.ai/
 Project-URL: Documentation, https://code-standards.sarj.ai/cli/
@@ -31,9 +31,9 @@ Requires-Dist: referencing==0.37.0
 Requires-Dist: repo-standards==6.12.9
 Requires-Dist: ruff==0.17.2
 Requires-Dist: sarj-iac-lint==0.30.1
-Requires-Dist: sarj-python-lint==1.77.3
+Requires-Dist: sarj-python-lint==1.79.0
 Requires-Dist: sarj-rule-contracts==0.4.1
-Requires-Dist: sarj-sql-lint==0.26.1
+Requires-Dist: sarj-sql-lint==0.28.0
 Requires-Dist: shellcheck-py==0.11.0.1; (sys_platform == 'darwin' and platform_machine == 'arm64') or (sys_platform == 'darwin' and platform_machine == 'x86_64') or (sys_platform == 'linux' and platform_machine == 'x86_64') or (sys_platform == 'win32' and platform_machine == 'AMD64')
 Requires-Dist: typer==0.27.3
 Description-Content-Type: text/markdown

{code_standards-8.132.4 → code_standards-8.134.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "code-standards"
-version = "8.132.4"
+version = "8.134.0"
 description = "One deterministic quality gate for Sarj Python, TypeScript, Swift, Kotlin, shell, SQL, IaC, and repository policy."
 readme = "README.md"
 requires-python = ">=3.14"
@@ -32,8 +32,8 @@ dependencies = [
   "ruff==0.17.2",
   "shellcheck-py==0.11.0.1; (sys_platform == 'darwin' and platform_machine == 'arm64') or (sys_platform == 'darwin' and platform_machine == 'x86_64') or (sys_platform == 'linux' and platform_machine == 'x86_64') or (sys_platform == 'win32' and platform_machine == 'AMD64')",
   "sarj-iac-lint==0.30.1",
-  "sarj-python-lint==1.77.3",
-  "sarj-sql-lint==0.26.1",
+  "sarj-python-lint==1.79.0",
+  "sarj-sql-lint==0.28.0",
   "typer==0.27.3",
 ]
 

{code_standards-8.132.4 → code_standards-8.134.0}/src/sarj_standards/configs/cli-reference.v1.json

@@ -3316,6 +3316,6 @@
   },
   "program": "code-standards",
   "schemaVersion": 1,
-  "summary": "Adopt, check, fix, diagnose, and update sarj-ai standards (v8.132.4).",
-  "version": "8.132.4"
+  "summary": "Adopt, check, fix, diagnose, and update sarj-ai standards (v8.134.0).",
+  "version": "8.134.0"
 }

{code_standards-8.132.4 → code_standards-8.134.0}/src/sarj_standards/configs/rule-calibration-campaign.v1.json

@@ -527,8 +527,8 @@
       "family": "python",
       "ruleId": "no-analytical-aggregation-in-postgres-store",
       "state": "complete",
-      "evidence": "Three fresh independent reviews ran 152 focused tests and scanned up to 13,930 Python files. They found 13 raw findings across eight files, including six already-suppressed bounded or transactional aggregates; only cache and task statistics were plausible analytics. All reviewers reproduced false positives for transactional SUM, scheduler MIN, version MAX, bounded DISTINCT and JSON aggregation, SQLite or MySQL stores, and executable-looking SQL in docstrings. File-wide ClickHouse and BigQuery exclusions also hid PostgreSQL queries in mixed-backend modules. Ruff, Pylint, and SQLFluff do not own this datastore-placement policy.",
-      "outcome": "Kept no-analytical-aggregation-in-postgres-store for selector compatibility and made SARJ020 explicitly warning-only. The rule now requires positive PostgreSQL ownership evidence and reports only statistical aggregates or time-bucketed grouped rollups; ordinary operational aggregates and mutations intentionally abstain. Added generated-source and AST-docstring exclusions, replaced provider-wide exemptions with per-query ClickHouse and BigQuery syntax classification, rewrote the UI pair around an unmistakable reporting rollup versus a bounded transactional invariant, and made the diagnostic request bounds and execution-plan review rather than unconditional offload. Post-change calibration produced zero warnings across 2,757 consumer Python files while retaining focused synthetic coverage for newly introduced reporting scans."
+      "evidence": "Three fresh independent reviews ran 152 focused tests and scanned up to 13,930 Python files. They found 13 raw findings across eight files, including six already-suppressed bounded or transactional aggregates; only cache and task statistics were plausible analytics. All reviewers reproduced false positives for transactional SUM, scheduler MIN, version MAX, bounded DISTINCT and JSON aggregation, SQLite or MySQL stores, and executable-looking SQL in docstrings. File-wide ClickHouse and BigQuery exclusions also hid PostgreSQL queries in mixed-backend modules. Ruff, Pylint, and SQLFluff do not own this datastore-placement policy. Follow-up policy change: the user explicitly requested a ban on transactional DISTINCT, GROUP BY, and aggregates. Earlier bounded-aggregate exemptions no longer describe the requested architecture. The new implementation parses SQL, recognizes native PostgreSQL/MySQL/SQLite and analytical drivers, preserves scalar near misses, and requires native receiver proof in mixed modules. Calibration is recorded in the transactional SQL benchmark report. Final native qualification compared three before/after trials with cold/warm analyses over 3,956 files per trial, with unchanged semantic input closures and deterministic complete diagnostic tuples. All 367 labeled cases passed (200 positives, 167 controls); all 47 actual consumer findings were independently inspected or reconciled against identical previously inspected source and full tuples, with zero known false positives. Namespace, declared dependency, generated-provider and re-export ownership, quoted function identity, executing EXPLAIN, metadata-free aggregates, dialect-native comment/identifier masking and multi-statement suppression boundaries are covered. See packages/python/benchmarks/transactional-sql-policy.json for redacted counts, observed performance and scope limits.",
+      "outcome": "Replace the historical advisory policy with blocking SARJ020 enforcement at the explicit user request. Retain the selector and permanent code, remove store-filename and reporting-size exemptions, include recoverable f-strings, CTEs, writes and windowed aggregates, and give the error precedence over the same-query SARJ437 warning. Keep analytical backends, ambiguous ownership, nonproduction code, scalar functions and exact reviewed exceptions intact. No datastore autofix is safe."
     },
     {
       "task": "rule-audit/python/no-comment-cruft",
@@ -2485,7 +2485,7 @@
       "family": "python",
       "ruleId": "require-explicit-service-contract",
       "state": "pending",
-      "evidence": "Precision follow-up (2026-10-02): two independent policy/contract reviews reproduced existing Protocol, ABCMeta, abstract-declaration, value-dependency and unreachable-call misclassification. The refined rule passes 466 focused cases with SARJ071/466/467, full Python type checking, Ruff and all registered native rules on its source/tests. Generic adversarial regressions preserve services backed by stores and pools, a single operation and no substitution consumer. Private corpus evaluation is scoped separately; no fleet-wide precision claim. The pinned local-code reviewer caught a false negative where child-state assignment was mistaken for collaborator replacement; the fix preserves direct injected identity and four additional mutation regressions. The 96-case focused/combined/precedence suite passes after that correction. Follow-up 2026-10-12 additional thirty-pass campaign: Five judge rounds review strict typing and maintainability admission; bounded native WARNING tiers preserve runtime special signatures, source-visible model effects, variance/Self and frame/regex lifetime where relevant. Exact verification, corpus controls, sampling, performance and CI gate evidence is recorded in packages/python/benchmarks/error-promotion-next-30-passes.json. Follow-up: packages/python/benchmarks/service-contracts-and-ids-100-passes.json records 100 distinct semantic cases (39 true positives, 61 true negatives, no labeled false positives/negatives), five exact motivating blocking findings, deterministic three-trial cold/warm measurements on 296 guarded sample files, and completed local canonical gates. Private source and identifying pins remain local. Exact-head CI and broader review remain separate gates.",
+      "evidence": "Precision follow-up (2026-10-02): two independent policy/contract reviews reproduced existing Protocol, ABCMeta, abstract-declaration, value-dependency and unreachable-call misclassification. The refined rule passes 466 focused cases with SARJ071/466/467, full Python type checking, Ruff and all registered native rules on its source/tests. Generic adversarial regressions preserve services backed by stores and pools, a single operation and no substitution consumer. Private corpus evaluation is scoped separately; no fleet-wide precision claim. The pinned local-code reviewer caught a false negative where child-state assignment was mistaken for collaborator replacement; the fix preserves direct injected identity and four additional mutation regressions. The 96-case focused/combined/precedence suite passes after that correction. Follow-up 2026-10-12 additional thirty-pass campaign: Five judge rounds review strict typing and maintainability admission; bounded native WARNING tiers preserve runtime special signatures, source-visible model effects, variance/Self and frame/regex lifetime where relevant. Exact verification, corpus controls, sampling, performance and CI gate evidence is recorded in packages/python/benchmarks/error-promotion-next-30-passes.json. Follow-up: packages/python/benchmarks/service-contracts-and-ids-100-passes.json records 100 distinct semantic cases (39 true positives, 61 true negatives, no labeled false positives/negatives), five exact motivating blocking findings, deterministic three-trial cold/warm measurements on 296 guarded sample files, and completed local canonical gates. Private source and identifying pins remain local. Exact-head CI and broader review remain separate gates. Follow-up whole-consumer adoption audit found diagnostic-wording churn invalidating 24 existing native baseline identities. Restored the legacy message header without changing detector coverage; one external-diagnostic regression and the existing callback/HTTP controls verify compatibility. Follow-up generated HTTP wrapper calibration: packages/python/benchmarks/service-http-callbacks-followup.json records 44 additional labels (nine positives, 35 controls, zero false positives or negatives), three before/after cold/warm trials, unchanged semantic closures and deterministic complete diagnostic tuples. Both linked service reproductions emit ERROR. All 24 preexisting consumer findings retain identical diagnostics; no new consumer finding requires inspection. Declared distribution ownership, generated/type-only re-exports, active resource lifetime, callback typing, full and partial contracts, mutation and escape exclusions have independent semantic reviews. The earlier two 100-case campaigns remain separate historical evidence; finite labels and selected-rule shared-VM measurements do not establish universal precision or full-preset fleet overhead.",
       "outcome": "Retain SARJ465 at ERROR without autofix. Native retained-callback dispatch and per-call HTTP operations establish a service boundary regardless of Queue/Client suffixes. Reuse an ABC or Protocol that covers the operations. Preserve value/lifecycle exclusions, proven contract ancestry and unresolved/escaping ownership guards."
     },
     {
@@ -2859,8 +2859,16 @@
       "family": "python",
       "ruleId": "prefer-grouped-settings",
       "state": "pending",
-      "evidence": "Twenty-eight focused settings checks cover repeated Python field namespaces, environment-alias independence, owned and inherited fields, ClassVar and Final metadata, private fields, generated and test exclusions, imported BaseSettings ancestry, stable locations and exact suppressions. Private source, paths and identifying pins stay outside public artifacts. Follow-up: packages/python/benchmarks/service-contracts-and-ids-100-passes.json records 100 distinct semantic cases (39 true positives, 61 true negatives, no labeled false positives/negatives), five exact motivating blocking findings, deterministic three-trial cold/warm measurements on 296 guarded sample files, and completed local canonical gates. Private source and identifying pins remain local. Exact-head CI and broader review remain separate gates.",
+      "evidence": "Twenty-eight focused settings checks cover repeated Python field namespaces, environment-alias independence, owned and inherited fields, ClassVar and Final metadata, private fields, generated and test exclusions, imported BaseSettings ancestry, stable locations and exact suppressions. Private source, paths and identifying pins stay outside public artifacts. Follow-up: packages/python/benchmarks/service-contracts-and-ids-100-passes.json records 100 distinct semantic cases (39 true positives, 61 true negatives, no labeled false positives/negatives), five exact motivating blocking findings, deterministic three-trial cold/warm measurements on 296 guarded sample files, and completed local canonical gates. Private source and identifying pins remain local. Exact-head CI and broader review remain separate gates. The second post-merge audit passed 100 distinct native checks against the actual published sarj-python-lint 1.76.0 wheel, 25 per repaired rule, with zero failures or skips.",
       "outcome": "Stage SARJ532 at WARNING without autofix. At least two directly owned public BaseSettings fields must share a complete Python namespace token; environment aliases alone do not qualify. Forty-four matching groups in the private sample remain API/environment review advisories. Preserve existing loading, aliases, defaults and source precedence when grouping manually."
+    },
+    {
+      "task": "rule-audit/sql/no-analytical-queries-in-transactional-db",
+      "family": "sql",
+      "ruleId": "no-analytical-queries-in-transactional-db",
+      "state": "complete",
+      "evidence": "Native semantic fixtures cover DISTINCT and DISTINCT ON, grouping without aggregates, built-in aggregates including JSON, CTEs, nested writes, views, windows, placeholders, comments and values, scalar lookalikes, analytical dialects, physical locations, malformed input and exact suppressions. Broader corpus and performance qualification is recorded separately; private sources and identifying pins remain local. Final native qualification compared three before/after trials with cold/warm analyses over 3,956 files per trial, with unchanged semantic input closures and deterministic complete diagnostic tuples. All 367 labeled cases passed (200 positives, 167 controls); all 47 actual consumer findings were independently inspected or reconciled against identical previously inspected source and full tuples, with zero known false positives. Namespace, declared dependency, generated-provider and re-export ownership, quoted function identity, executing EXPLAIN, metadata-free aggregates, dialect-native comment/identifier masking and multi-statement suppression boundaries are covered. See packages/python/benchmarks/transactional-sql-policy.json for redacted counts, observed performance and scope limits.",
+      "outcome": "Ship SARJ122 as an error at the explicit user request to ban transactional SQL aggregation. PostgreSQL is the SQL linter default, MySQL and SQLite select native parsers, and declared analytical dialects or database directories remain valid. Treat this as an organization datastore policy, not a cost estimator; preserve atomicity and require an exact reviewed exception for an unavoidable transactional invariant."
     }
   ]
 }