continuo-python-runtime 0.1.0__py3-none-any.whl → 0.3.0__py3-none-any.whl

continuo_python_runtime/validation/runner.py

@@ -0,0 +1,245 @@
+"""Build a single node as an empty table in the candidate schema (blue/green validation).
+
+Dispatches on ``VALIDATION_OP`` env var (default ``build_from_sql``):
+- ``build_from_sql``: fetch the node's compiled SQL from S3 (``CANDIDATE_SQL_URI``) and
+  materialize it empty (models/snapshots).
+- ``clone_from_prod``: clone an existing prod table's shape empty from ``PROD_SCHEMA``
+  (unchanged upstreams, including seeds).
+- ``build_from_columns``: for python nodes, which have no SELECT to shape their output
+  from. Fetch the node's validation spec JSON from S3 (``CANDIDATE_SPEC_URI`` —
+  ``{"reads": [sql, ...], "output_columns": [{"name","type","nullable"}, ...],
+  "config": {...}}``; ``config`` is optional and defaults to ``{}``), bind-check every
+  declared read against the candidate schema so an upstream that
+  dropped a column the script reads fails the release gate, then materialize the
+  output table empty from the declared typed columns and the declared physical layout.
+
+The engine adapter is discovered from the single installed
+``continuo_engine.adapters`` entry point — each runner image installs exactly one.
+stdout is reserved exclusively for the runner's one structured ``result_block``,
+printed as its last line; all diagnostics go to stderr via the ``logging`` module.
+A non-zero exit marks the node failed.
+"""
+import json
+import logging
+import os
+import sys
+
+from continuo_engine_contract import result  # type: ignore[import-untyped]
+from continuo_engine_contract.port import (  # type: ignore[import-untyped]
+    AdapterDiscoveryError,
+    discover_adapter,
+)
+from continuo_python_runtime.validation import s3
+
+logger = logging.getLogger("validation_runner")
+
+
+def _node_id() -> str:
+    """Best-known node identity for a result block: ``NODE_ID`` env, else ``""``.
+
+    The single source of NODE_ID resolution shared by every block-emitting path.
+    ``main`` layers a ``model.{table}`` fallback on top once TABLE_NAME is known;
+    the early ``_require`` failures (which may be the missing TABLE_NAME itself)
+    cannot, so they fall back to this bare value.
+    """
+    return os.environ.get("NODE_ID", "")
+
+
+def _require(name: str) -> str:
+    value = os.environ.get(name)
+    if not value:
+        logger.error("missing required env var %s", name)
+        print(
+            result.result_block(
+                "error", f"missing required env var {name}",
+                unique_id=_node_id(),
+            ),
+            flush=True,
+        )
+        sys.exit(2)
+    return value
+
+
+def load_candidate_sql() -> str:
+    """Fetch this node's candidate SQL from S3 at ``CANDIDATE_SQL_URI``.
+
+    Returns the raw UTF-8 body (no stripping; the caller normalizes). Returns ``""``
+    when ``CANDIDATE_SQL_URI`` is unset/empty (nothing to validate). Raises on
+    invalid-URI or S3-download errors so ``main`` maps them to a structured block.
+    """
+    uri = os.environ.get("CANDIDATE_SQL_URI", "")
+    if not uri:
+        return ""
+    bucket, key = s3.parse_s3_uri(uri)
+    client = s3.make_s3_client()
+    body = client.get_object(Bucket=bucket, Key=key)["Body"].read()
+    decoded: str = body.decode("utf-8")
+    return decoded
+
+
+def load_candidate_spec() -> dict:
+    """Fetch this node's validation spec JSON from S3 at ``CANDIDATE_SPEC_URI``.
+
+    Returns the parsed dict. Raises on unset/empty URI, invalid URI, S3
+    download errors, invalid JSON, or JSON that parses to something other than
+    an object (e.g. a list, ``null``, a number, or a string) — ``main`` maps
+    every failure to a structured block.
+    """
+    uri = os.environ.get("CANDIDATE_SPEC_URI", "")
+    if not uri:
+        raise ValueError("CANDIDATE_SPEC_URI is unset or empty")
+    bucket, key = s3.parse_s3_uri(uri)
+    client = s3.make_s3_client()
+    body = client.get_object(Bucket=bucket, Key=key)["Body"].read()
+    spec = json.loads(body.decode("utf-8"))
+    if not isinstance(spec, dict):
+        raise ValueError(
+            f"candidate spec must be a JSON object, got {type(spec).__name__}"
+        )
+    return spec
+
+
+_NODE_OPS = ("build_from_sql", "clone_from_prod", "build_from_columns")
+_SCHEMA_OPS = ("ensure_schema", "drop_schema")
+
+
+def main() -> None:
+    """Run one validation op end to end; exits non-zero on failure.
+
+    Node ops (``build_from_sql``/``clone_from_prod``/``build_from_columns``)
+    materialize one empty node table and require ``TABLE_NAME``. Schema ops
+    (``ensure_schema``/``drop_schema``) act on the whole candidate schema —
+    the executor schedules them as one-shot engine-image Jobs to own the
+    candidate-schema lifecycle without connecting to the warehouse itself —
+    and take no table.
+    """
+    logging.basicConfig(
+        level=logging.INFO, stream=sys.stderr, format="%(levelname)s %(name)s: %(message)s"
+    )
+    schema = _require("DBT_TARGET_SCHEMA")
+    op = os.environ.get("VALIDATION_OP", "build_from_sql")
+
+    # Gather op-specific inputs and identity BEFORE touching the adapter, surfacing
+    # input errors as a structured block (preserves the prior contract + exit codes).
+    table = None
+    candidate_sql = None
+    prod_schema = None
+    spec: dict | None = None
+    config: dict = {}
+    if op in _NODE_OPS:
+        table = _require("TABLE_NAME")
+        unique_id = _node_id() or f"model.{table}"
+        if op == "build_from_sql":
+            try:
+                raw_sql = load_candidate_sql()
+            except Exception as exc:
+                uri = os.environ.get("CANDIDATE_SQL_URI", "")
+                logger.error("ERROR fetching candidate SQL from %r: %s", uri, exc)
+                print(result.result_block("error", str(exc), unique_id=unique_id), flush=True)
+                sys.exit(1)
+            if not raw_sql:
+                logger.error(
+                    "CANDIDATE_SQL_URI is unset or the object is empty for a "
+                    "build_from_sql node; cannot validate"
+                )
+                print(result.result_block("error", "CANDIDATE_SQL_URI is unset or empty",
+                                          unique_id=unique_id), flush=True)
+                sys.exit(2)
+            candidate_sql = raw_sql
+        elif op == "build_from_columns":
+            try:
+                spec = load_candidate_spec()
+            except (ValueError, json.JSONDecodeError) as exc:
+                logger.error("invalid candidate spec: %s", exc)
+                print(result.result_block("error", str(exc), unique_id=unique_id), flush=True)
+                sys.exit(2)
+            except Exception as exc:
+                uri = os.environ.get("CANDIDATE_SPEC_URI", "")
+                logger.error("ERROR fetching candidate spec from %r: %s", uri, exc)
+                print(result.result_block("error", str(exc), unique_id=unique_id), flush=True)
+                sys.exit(1)
+            if not spec.get("output_columns"):
+                logger.error("candidate spec has no output_columns; cannot validate")
+                print(result.result_block("error", "candidate spec has no output_columns",
+                                          unique_id=unique_id), flush=True)
+                sys.exit(2)
+            raw_config = spec.get("config")
+            if raw_config is not None and not isinstance(raw_config, dict):
+                # Engine-blind: the runner only decides that the block is a JSON
+                # object. Which keys are legal is the installed adapter's call.
+                msg = (
+                    f"candidate spec 'config' must be a JSON object, "
+                    f"got {type(raw_config).__name__}"
+                )
+                logger.error("%s", msg)
+                print(result.result_block("error", msg, unique_id=unique_id), flush=True)
+                sys.exit(2)
+            config = raw_config or {}
+        else:
+            prod_schema = _require("PROD_SCHEMA")
+    elif op in _SCHEMA_OPS:
+        unique_id = _node_id() or f"schema.{schema}"
+    else:
+        unique_id = _node_id() or f"schema.{schema}"
+        logger.error("unknown VALIDATION_OP %r", op)
+        print(result.result_block("error", f"unknown VALIDATION_OP {op!r}",
+                                  unique_id=unique_id), flush=True)
+        sys.exit(2)
+
+    # Engine selection is discovery, not configuration: the image installs one adapter.
+    try:
+        engine, adapter_cls = discover_adapter()
+    except AdapterDiscoveryError as exc:
+        logger.error("%s", exc)
+        print(result.result_block("error", str(exc), unique_id=unique_id), flush=True)
+        sys.exit(2)
+
+    missing = [v for v in adapter_cls.required_env() if not os.environ.get(v)]
+    if missing:
+        msg = f"missing required env for engine {engine!r}: {', '.join(missing)}"
+        logger.error("%s", msg)
+        print(result.result_block("error", msg, unique_id=unique_id), flush=True)
+        sys.exit(2)
+
+    # close() runs exactly once, in the finally, on every path: the success case,
+    # the op error (sys.exit raises SystemExit, which still unwinds finally), and
+    # a from_env() failure (adapter stays None). A close() failure only logs — the
+    # primary error, if any, is already the SystemExit propagating through.
+    adapter = None
+    try:
+        adapter = adapter_cls.from_env()
+        if op == "ensure_schema":
+            adapter.ensure_schema(schema)
+        elif op == "drop_schema":
+            adapter.drop_schema(schema)
+        else:
+            adapter.ensure_schema(schema)
+            assert table is not None, "table must be set for a node op"
+            if op == "build_from_sql":
+                assert candidate_sql is not None, "candidate_sql must be set for build_from_sql"
+                adapter.build_empty_from_sql(schema, table, candidate_sql)
+            elif op == "build_from_columns":
+                assert spec is not None, "spec must be set for build_from_columns"
+                for read_sql in spec.get("reads", []):
+                    adapter.check_binds(read_sql)
+                adapter.build_empty_from_columns(schema, table, spec["output_columns"], config)
+            else:
+                assert prod_schema is not None, "prod_schema must be set for clone_from_prod"
+                adapter.clone_empty_from_prod(schema, prod_schema, table)
+    except Exception as exc:
+        logger.error("ERROR op=%s on schema %s: %s", op, schema, exc)
+        print(result.result_block("error", str(exc), unique_id=unique_id), flush=True)
+        sys.exit(1)
+    finally:
+        if adapter is not None:
+            try:
+                adapter.close()
+            except Exception as close_exc:  # never mask the primary outcome
+                logger.error("adapter close failed: %s", close_exc)
+
+    logger.info("ran op=%s on schema=%s (engine=%s)", op, schema, engine)
+    print(result.result_block("success", unique_id=unique_id), flush=True)
+
+
+if __name__ == "__main__":
+    main()

continuo_python_runtime/validation/s3.py

@@ -0,0 +1,45 @@
+"""S3 helpers for the validation runner.
+
+``parse_s3_uri`` and ``make_s3_client`` back the runner's candidate-SQL fetch
+from ``CANDIDATE_SQL_URI``.
+"""
+import os
+
+from typing import Any
+
+import boto3  # type: ignore[import-untyped]
+
+
+def parse_s3_uri(uri: str) -> tuple[str, str]:
+    """Parse an ``s3://bucket/key`` URI and return ``(bucket, key)``.
+
+    Raises :class:`ValueError` for non-s3:// URIs, a missing bucket, or a
+    missing/empty key (e.g. ``s3://bucket-only`` or ``s3://bucket/``).
+    """
+    if not uri.startswith("s3://"):
+        raise ValueError(f"invalid S3 URI (must start with s3://): {uri!r}")
+    bucket, _, key = uri[len("s3://"):].partition("/")
+    if not bucket or not key:
+        raise ValueError(f"invalid S3 URI (missing bucket or key): {uri!r}")
+    return bucket, key
+
+
+def make_s3_client() -> Any:
+    """Construct a boto3 S3 client, letting boto3 resolve credentials itself.
+
+    Only ``S3_ENDPOINT_URL`` (when set and non-empty, e.g. for MinIO) is passed
+    explicitly. Credentials and region are left for boto3's own chain, which
+    natively reads ``AWS_ACCESS_KEY_ID``, ``AWS_SECRET_ACCESS_KEY``,
+    ``AWS_SESSION_TOKEN``, and ``AWS_DEFAULT_REGION`` from the environment, and
+    falls through to IAM roles / web identity / instance profiles when those are
+    absent. Passing raw (possibly blank or missing) env values as explicit
+    keyword args would instead select empty/explicit credentials or drop
+    temporary-credential session tokens, breaking that chain.
+
+    Tests patch ``s3.boto3`` to intercept the underlying ``client`` call.
+    """
+    kwargs: dict[str, Any] = {}
+    endpoint_url = os.environ.get("S3_ENDPOINT_URL")
+    if endpoint_url:
+        kwargs["endpoint_url"] = endpoint_url
+    return boto3.client("s3", **kwargs)

{continuo_python_runtime-0.1.0.dist-info → continuo_python_runtime-0.3.0.dist-info}/METADATA

@@ -1,6 +1,6 @@
-Metadata-Version: 2.4
+Metadata-Version: 2.5
 Name: continuo-python-runtime
-Version: 0.1.0
+Version: 0.3.0
 Summary: Runtime harness, contract tooling, and CI lint for Continuo python nodes.
 Author: Simone Carolini
 Maintainer: Simone Carolini
@@ -8,9 +8,11 @@ Classifier: Development Status :: 4 - Beta
 Classifier: Intended Audience :: Developers
 Classifier: Programming Language :: Python :: 3.14
 Requires-Python: >=3.14
-Requires-Dist: continuo-validation-contract==0.3.0
+Requires-Dist: boto3==1.43.59
+Requires-Dist: continuo-engine-contract==0.7.0
 Requires-Dist: pyarrow==25.0.0
 Requires-Dist: pyyaml==6.0.3
+Requires-Dist: sqlglot==30.15.0
 Description-Content-Type: text/markdown
 
 # Continuo Python Runtime
@@ -23,44 +25,69 @@ and register the release with Continuo.
 
 ## What this repo is
 
-Three artifacts come out of this repository:
+Four artifacts come out of this repository:
 
 - **The `continuo-python-runtime` PyPI package** — the `continuo-runtime` CLI
-  (`validate` / `merge` / `hash` / `lint` / `run`) and the harness library
-  (`conform()`, `RunContext`, the error taxonomy) that domain repos install.
-- **Per-engine base images**, one per warehouse engine (`...-postgres`,
-  `...-trino`), that domain repos build `FROM`. Each image bakes in the
-  runtime, a single `RuntimeAdapter` for that engine, and the
-  `continuo-runtime run` entrypoint.
+  (`validate` / `merge` / `hash` / `lint` / `run` / `validation-op`) and the
+  harness library (`conform()`, `RunContext`, the error taxonomy) that domain
+  repos install.
+- **The `continuo-engine-contract` PyPI package** — the `WarehouseAdapter`
+  port, the contract schema, the shared SQL/type/config guards, and the
+  sentinel result-block format. Adapter authors outside this repo pin it.
+- **Per-engine base images**, one per warehouse engine
+  (`continuo-python-runtime-postgres`, `continuo-python-runtime-trino`), that
+  domain repos build `FROM`. Each image bakes in the runtime and a single
+  `WarehouseAdapter` for that engine, and serves both roles that adapter has:
+  the node harness (`ENTRYPOINT ["continuo-runtime"]`, `CMD ["run"]`) and the
+  validation runner (`continuo-runtime validation-op`).
 - **`template/`** — a copy-ready domain repo: `Dockerfile`, `contracts/`,
   `scripts/`, and the `release.yml` CI/CD workflow.
 
-Base images and the PyPI publication of this package land with this repo's
-PR 9 (the image pipeline); until then, install the runtime from git as noted
-in `template/.github/workflows/release.yml`.
+One `vX.Y.Z` git tag releases all of it: `publish-pypi.yml` builds both
+distributions into a single `dist/` and publishes them together, and
+`images.yml` builds and pushes both engine images multi-arch under the same
+tag.
 
-### Package map
+### What this repo owns
 
-Each per-engine base image bakes together three PyPI packages: the harness,
-the engine adapter, and the published contract. The harness and both engine
-adapters live in *this* repo (`continuo-python-runtime`) as a uv workspace;
-`continuo-validation-runners` owns the *validation-side* (offline lint/merge)
-counterparts of the same engines, which is a separate concern from the
-data-plane adapters here.
+This repository owns the entire python-node surface: the engine contract, both
+engine adapters, the validation runner, and the node harness. The former
+`continuo-validation` repository was merged in — there is no longer a separate
+validation-side port, adapter class, entry-point group, or image. One
+`WarehouseAdapter` per engine serves both the data plane (`fetch` /
+`ensure_table` / `load`) and validation (`ensure_schema` / `drop_schema` /
+`build_empty_from_sql` / `build_empty_from_columns` / `clone_empty_from_prod` /
+`check_binds`), and one image per engine runs both roles.
 
 | Package (distribution name) | Module | Lives in | Role |
 | --- | --- | --- | --- |
-| `continuo-python-runtime` | `continuo_python_runtime` | this repo (root) | Harness: CLI, `conform()`, `RunContext`, error taxonomy. |
-| `continuo-python-runtime-postgres` | `continuo_python_runtime_postgres` | this repo, `python-runtime-postgres/` | Data-plane `RuntimeAdapter` for Postgres (`fetch`/`ensure_table`/`load`). |
-| `continuo-python-runtime-trino` | `continuo_python_runtime_trino` | this repo, `python-runtime-trino/` | Data-plane `RuntimeAdapter` for Trino/Iceberg. |
-| `continuo-validation-contract` | `continuo_validation_contract` | `continuo-validation-runners` | The published contract (schema, `RuntimeAdapter` port, result-block format) both sides depend on. |
-| `continuo-validation-postgres` / `continuo-validation-trino` | `continuo_validation_postgres` / `continuo_validation_trino` | `continuo-validation-runners` | Validation-side (lint/merge, no live warehouse I/O) adapters — not to be confused with the data-plane adapters above. |
-
-All three packages built in this repo resolve `continuo-validation-contract`
-from PyPI (`==0.3.0`); the two adapter packages are uv workspace members
-(`[tool.uv.workspace]` in the root `pyproject.toml`), so `uv sync
---all-packages --all-groups` at the repo root installs everything for local
-development.
+| `continuo-python-runtime` | `continuo_python_runtime` | this repo (root) | Harness (CLI, `conform()`, `RunContext`, error taxonomy) **and** the validation runner (`continuo-runtime validation-op`). Published to PyPI. |
+| `continuo-engine-contract` | `continuo_engine_contract` | this repo, `contract/` | The `WarehouseAdapter` port, contract schema, the SQL/type/config guards adapters must run, and the result-block format. Published to PyPI. |
+| `continuo-python-runtime-postgres` | `continuo_python_runtime_postgres` | this repo, `adapters/postgres/` | `PostgresAdapter` — one class, both roles. **Not published to PyPI** — built from source into the image. |
+| `continuo-python-runtime-trino` | `continuo_python_runtime_trino` | this repo, `adapters/trino/` | `TrinoAdapter` — one class, both roles, for Trino/Iceberg. **Not published to PyPI** — built from source into the image. |
+
+All four are uv workspace members (`[tool.uv.workspace]` in the root
+`pyproject.toml`), so `uv sync --all-packages --all-groups` at the repo root
+installs everything for local development.
+
+**Only `continuo-python-runtime` and `continuo-engine-contract` are published
+to PyPI.** The two engine adapters are built **from source into the engine
+images**: `Dockerfile.postgres` and `Dockerfile.trino` install them out of the
+build context, so each image ships exactly one adapter and the runtime
+discovers it through the `continuo_engine.adapters` entry-point group at run
+time. Nothing installs them from an index — the harness package does not
+depend on them, and domain repos get their adapter by building `FROM` a
+published base image. They are still built, type-checked, and tested by CI on
+every change.
+
+### The result block is a frozen wire contract
+
+`continuo_engine_contract.result` writes a sentinel-framed JSON block as the
+last line of stdout, and Continuo's Go side parses it byte-for-byte
+(`pkg/validationresult` in the `continuo` repository). That wire format — the
+sentinel markers, the framing, and the field names inside the block — is
+**frozen**. Reuse it; never change it from this side alone. A change here that
+the Go parser has not been taught is a production outage, not a refactor.
 
 ## Quickstart for domain teams
 
@@ -85,6 +112,28 @@ development.
    and merges the contracts, builds and pushes the image, uploads the merged
    contract to S3, and POSTs the release.
 
+### Upgrading an existing domain repo
+
+`validate` / `merge` / `hash` now hand every declared read to a real SQL
+parser (sqlglot, via `continuo_engine_contract.sql.ensure_single_read`)
+instead of scanning it for a leading `SELECT`/`WITH`. Two things follow for a
+repo written before this, on its next release: SQL a driver would accept but
+a parser will not — most commonly a driver-specific bind placeholder like
+psycopg2's `%(name)s`, which `ctx.read(name)` could never have used anyway —
+now fails validation, and engine-specific syntax (postgres `~`, `@>`, …)
+needs `--dialect <engine>`, which a repo should be passing regardless since
+Continuo bind-checks every read in the install's own warehouse dialect. Run
+the pre-flight check once before your next release; it reports every affected
+read at once:
+
+```bash
+continuo-runtime validate contracts/ --dialect postgres   # or trino
+```
+
+The runtime image does not re-run this gate, so a read that passes here is
+not re-judged under a different grammar in production. See
+`docs/boundary-contract.md` §13.1.
+
 ## The script API
 
 A node script is a Python file with exactly one required entry point:
@@ -106,9 +155,13 @@ def run(ctx):
   example a polars DataFrame. Returning anything else raises `ScriptError`.
 - The dataframe library is your choice. No dataframe library is baked into
   the base image — the package's own runtime dependencies are `pyarrow`,
-  `PyYAML`, and `continuo-validation-contract`. Add whatever you script
+  `PyYAML`, and `continuo-engine-contract`. Add whatever you script
   against (pandas, polars, …) as a `RUN pip install` line in your own
-  `Dockerfile`, on top of the base image.
+  `Dockerfile`, on top of the base image. The base image runs as non-root
+  (uid 65532), which pip cannot install under, so switch to root for the
+  install and back afterward — `USER root`, then the `RUN pip install`
+  line, then `USER 65532:65532` — since the executor's pod spec expects
+  the image to end at uid 65532. See `template/Dockerfile` for the pattern.
 - Scripts do not import warehouse drivers, write raw SQL literals, or call
   data-access methods directly — `continuo-runtime lint` rejects those:
   - forbidden driver imports (`psycopg2`/`sqlalchemy`/`trino`/etc.),
@@ -125,6 +178,17 @@ def run(ctx):
   are the driver-import and data-access-call rules, together with the fact
   that `RunContext` only exposes `ctx.read()` — all warehouse access goes
   through it.
+- Scripts may import shared in-repo helpers. Before executing a script the
+  harness puts the repo root (`APP_ROOT`) and the script's own directory on
+  `sys.path`, so both `import helpers` (a sibling of the script) and
+  `from lib.shared import ...` (anywhere under the repo root) work, including
+  from inside `run()`. Every helper a script reaches transitively is folded
+  into `shared_code_hash`, so editing one re-fingerprints the node — but the
+  hash does not put the file in the image: **`COPY` every directory your
+  scripts import from in your `Dockerfile`**, or the release is valid and the
+  node dies with `ModuleNotFoundError` on its first run. Because the repo root
+  precedes the standard library on `sys.path`, avoid naming a top-level module
+  after a stdlib one (`types.py`, `json.py`, `logging.py`, …).
 - The harness — not the script — performs the write. It calls `conform()`
   on whatever `run()` returned and issues the only INSERT; the script never
   writes directly.
@@ -165,19 +229,20 @@ A domain repo picks its warehouse engine by which base image it builds
 `FROM`:
 
 ```dockerfile
-FROM ghcr.io/carolsimone/continuo-python-runtime:v0.1.0-postgres
+FROM ghcr.io/carolsimone/continuo-python-runtime-postgres:v0.3.0
 # or
-FROM ghcr.io/carolsimone/continuo-python-runtime:v0.1.0-trino
+FROM ghcr.io/carolsimone/continuo-python-runtime-trino:v0.3.0
 ```
 
-Each image bakes in exactly one `RuntimeAdapter` for that engine — installed
-from this repo's `python-runtime-postgres/` or `python-runtime-trino/`
-package (see the package map above; both adapters live in this repo, not
-`continuo-validation-runners`) — registered under the
-`continuo_runtime.adapters` entry-point group (entry names `postgres` /
-`trino`). The harness discovers it via `discover_runtime_adapter()` at run
-time, so a single image serves every node in the service. The executor
-injects the
+The engine is part of the image **name**; the tag is the bare version, so
+Continuo's Helm chart can pin an image as `<name>:vX.Y.Z@sha256:<digest>`.
+
+Each image bakes in exactly one `WarehouseAdapter` for that engine — installed
+from this repo's `adapters/postgres/` or `adapters/trino/` package (see the
+table above) — registered under the `continuo_engine.adapters` entry-point
+group (entry names `postgres` / `trino`). The runtime discovers it via
+`discover_adapter()` at run time, so a single image serves every node in the
+service and the release-time validation Job for it. The executor injects the
 warehouse connection as environment variables (engine-native, e.g.
 `POSTGRES_HOST`/`POSTGRES_DB`/`POSTGRES_USER`) plus the node-selection
 environment (`NODE_ID`, `TABLE_NAME`, `TARGET_SCHEMA`, and optionally

continuo_python_runtime-0.3.0.dist-info/RECORD

@@ -0,0 +1,22 @@
+continuo_python_runtime/__init__.py,sha256=otNaXEPsTtRXJV5FLtDUsFO8VD4OC-MLAzwhtimHfOE,70
+continuo_python_runtime/cli.py,sha256=X4JBC4FDpgFOeDdtBbeX9GTq1XTuJCghDpemlR_CPvE,5925
+continuo_python_runtime/closure.py,sha256=6e-IAQp8Lieb0bGKP1F6JE4TgVBJ_COTGXRUult2xeI,12991
+continuo_python_runtime/conform.py,sha256=a9CKCA-gT9Zerzr6c5H8aByTFOUd6uBMo02sNKSDnXg,9199
+continuo_python_runtime/context.py,sha256=K-9XXYlQ4OZ250rCOq6EJNq7fg_D5sK6tOcu7DLZfVg,1856
+continuo_python_runtime/errors.py,sha256=nfZzfBhQ2ajm7USAWKKaGY2uUlh8eNjNPNYYuaOJgZE,1032
+continuo_python_runtime/harness.py,sha256=1b_ze2_AJ9vncY-yj88TgJylVzKwGw1-idxHoaYAymE,12101
+continuo_python_runtime/hashing.py,sha256=70iXQb0CmjGqniTPofXY6WapydQ7aK2XOk5dzpEf-zk,3354
+continuo_python_runtime/lint.py,sha256=M59UtCHHVQnJKNolIkvkRk_AgGAFvxD9zkKAMMK-7GI,12984
+continuo_python_runtime/types.py,sha256=_ssxNE2Lq5782n9_Ihs-u_6ybCCy8XaL6iYbE35tBug,5057
+continuo_python_runtime/contract/__init__.py,sha256=S79x6j_P0CmaSuCGzeWoK1U0507KvD2MZXwQl9DFWMM,37
+continuo_python_runtime/contract/loader.py,sha256=WeKngAe6VH-WxgRTVdCERPMdsGBszJM9RkanUTTs9-w,15611
+continuo_python_runtime/contract/merge.py,sha256=XCCeE2vJUm0KA60d2XsHpjRh5fIdVfFu_HsBzEyUWow,6505
+continuo_python_runtime/contract/model.py,sha256=2hKI04M0WwvTkOy9eDGl2dRZgY3bAuJYktAG-ICI-AU,936
+continuo_python_runtime/contract/paths.py,sha256=SRn70pJkDAIpXw0IcMU2iNKPKvct8w_SZP2ec-lV91M,1458
+continuo_python_runtime/validation/__init__.py,sha256=hz5oGXsoaUoygR0_pBby9PS6cEfrre518EE0HGB58eE,79
+continuo_python_runtime/validation/runner.py,sha256=zHs5CR3Wr9512sh6eY9hpN8NG3weJPYUFRDPJf2BNnc,10875
+continuo_python_runtime/validation/s3.py,sha256=q8nRrT9R7L1-M4dSlDnkL7CUJMPmq86MHY_UKYFlEf8,1785
+continuo_python_runtime-0.3.0.dist-info/METADATA,sha256=SjKFljTkhZUCsswm3WWkstA2eOtrfdRonXKEJA4Sf-Q,14898
+continuo_python_runtime-0.3.0.dist-info/WHEEL,sha256=zOwg4jB6zX2kU910N-cMawjivD6tO8NEWvE12je1bVk,87
+continuo_python_runtime-0.3.0.dist-info/entry_points.txt,sha256=ZvIwSm9f9B9ZmZMf6CyF5Zt4QONn8rqaIk-u-B1CF2Y,70
+continuo_python_runtime-0.3.0.dist-info/RECORD,,

{continuo_python_runtime-0.1.0.dist-info → continuo_python_runtime-0.3.0.dist-info}/WHEEL

@@ -1,4 +1,4 @@
 Wheel-Version: 1.0
-Generator: hatchling 1.31.0
+Generator: hatchling 1.32.0
 Root-Is-Purelib: true
 Tag: py3-none-any

continuo_python_runtime-0.1.0.dist-info/RECORD

@@ -1,18 +0,0 @@
-continuo_python_runtime/__init__.py,sha256=otNaXEPsTtRXJV5FLtDUsFO8VD4OC-MLAzwhtimHfOE,70
-continuo_python_runtime/cli.py,sha256=Qki4Mfoab74D0DvguZd5yzSfI-FRQDmtvwC0OacxrAc,4860
-continuo_python_runtime/conform.py,sha256=a9CKCA-gT9Zerzr6c5H8aByTFOUd6uBMo02sNKSDnXg,9199
-continuo_python_runtime/context.py,sha256=ZyeN_dA2DihQbegBiiqHj1_EKk79GsxS-tATPVymUPg,1856
-continuo_python_runtime/errors.py,sha256=nfZzfBhQ2ajm7USAWKKaGY2uUlh8eNjNPNYYuaOJgZE,1032
-continuo_python_runtime/harness.py,sha256=YcWy4ummKY3HQYQ4JQ3-UI5jxDgYwJDQlWT88_GRPH4,7504
-continuo_python_runtime/hashing.py,sha256=6D4MntcjaHTEC55IQBBX2Pq9K59D0TWlxTSXGJ5Jsro,1159
-continuo_python_runtime/lint.py,sha256=HgB0BAuiQuS3DgT6BsOoB2M5A-_OKcFsGbaTWhuM7XU,11897
-continuo_python_runtime/types.py,sha256=z1qnBbbaP6nFN2mmRySXM4ZAesv5N6_4E9vZ4kv74HU,7138
-continuo_python_runtime/contract/__init__.py,sha256=S79x6j_P0CmaSuCGzeWoK1U0507KvD2MZXwQl9DFWMM,37
-continuo_python_runtime/contract/loader.py,sha256=wlxI6XZIoUZ4z9rDe1G8s26jbL0tGXnAHPGajTAM0ag,12828
-continuo_python_runtime/contract/merge.py,sha256=WFde9lzrojlMNjuEU7YW8FWOs6VPSrWPY2_Sri0ljZE,2567
-continuo_python_runtime/contract/model.py,sha256=6luq3SJcgshKoG0QsQhJPZ5fzLa8AcGAev9D4jiGgxA,849
-continuo_python_runtime/contract/paths.py,sha256=SRn70pJkDAIpXw0IcMU2iNKPKvct8w_SZP2ec-lV91M,1458
-continuo_python_runtime-0.1.0.dist-info/METADATA,sha256=YQWMZaYiS3gpRnIutzgKhT3KeB5BtUpeMrwi0qKLRUU,10953
-continuo_python_runtime-0.1.0.dist-info/WHEEL,sha256=lCkmxWfQsSc9CfIClYeavTdQeEX2toPqufh9gI35EQA,87
-continuo_python_runtime-0.1.0.dist-info/entry_points.txt,sha256=ZvIwSm9f9B9ZmZMf6CyF5Zt4QONn8rqaIk-u-B1CF2Y,70
-continuo_python_runtime-0.1.0.dist-info/RECORD,,