continuo-python-runtime 0.2.0__py3-none-any.whl → 0.3.1__py3-none-any.whl

continuo_python_runtime/cli.py

@@ -73,6 +73,13 @@ def main(argv: list[str] | None = None) -> int:
         "run", help="Execute a node script (container entrypoint)"
     )
 
+    # validation-op subcommand
+    subparsers.add_parser(
+        "validation-op",
+        help="Execute one blue/green validation operation (container command; "
+             "driven by VALIDATION_OP and the engine Secret env)",
+    )
+
     args = parser.parse_args(argv)
 
     try:
@@ -88,6 +95,10 @@ def main(argv: list[str] | None = None) -> int:
             return cmd_lint(args.path)
         elif args.command == "run":
             return cmd_run()
+        elif args.command == "validation-op":
+            from continuo_python_runtime.validation.runner import main as validation_op_main
+            validation_op_main()
+            return 0
     except HarnessError as exc:
         logger.error("%s", exc)
         return 1

continuo_python_runtime/context.py

@@ -10,13 +10,13 @@ from continuo_python_runtime.contract.model import Node
 from continuo_python_runtime.errors import ReadError
 
 if TYPE_CHECKING:
-    from continuo_validation_contract.port import RuntimeAdapter  # type: ignore[import-untyped]
+    from continuo_engine_contract.port import WarehouseAdapter  # type: ignore[import-untyped]
 
 
 class RunContext:
     """Manages declared read access for a node execution."""
 
-    def __init__(self, node: Node, adapter: "RuntimeAdapter") -> None:
+    def __init__(self, node: Node, adapter: "WarehouseAdapter") -> None:
         """Initialize context with a node and adapter.
 
         Args:

continuo_python_runtime/contract/loader.py

@@ -11,7 +11,7 @@ from pathlib import Path
 from typing import Any
 
 import yaml
-from continuo_validation_contract.sql import ensure_single_read  # type: ignore[import-untyped]
+from continuo_engine_contract.sql import ensure_single_read  # type: ignore[import-untyped]
 from sqlglot import Dialect
 from sqlglot.errors import TokenError
 
@@ -149,7 +149,7 @@ def parse_node(
     ``source`` is the originating filename; it appears in every error message.
     ``dialect`` is a sqlglot dialect name (e.g. ``"postgres"``, ``"trino"``)
     each declared read is checked against via
-    :func:`~continuo_validation_contract.sql.ensure_single_read`; ``None``
+    :func:`~continuo_engine_contract.sql.ensure_single_read`; ``None``
     (the default) uses sqlglot's dialect-neutral parser.
 
     ``check_reads=False`` skips *only* that :func:`ensure_single_read` call —
@@ -306,7 +306,7 @@ def load_contract_dir(
     """Load and validate every `*.yml`/`*.yaml` contract file under ``path``.
 
     ``check_reads=False`` skips the per-read
-    :func:`~continuo_validation_contract.sql.ensure_single_read` gate and
+    :func:`~continuo_engine_contract.sql.ensure_single_read` gate and
     nothing else; every other rule in :func:`parse_node` and every rule here
     (dialect validity, document shape, duplicate relations, "no contract
     files found") still runs. The runtime

continuo_python_runtime/harness.py

@@ -21,10 +21,10 @@ from pathlib import Path
 from types import ModuleType
 from typing import Any
 
-from continuo_validation_contract.port import (  # type: ignore[import-untyped]
-    discover_runtime_adapter,
+from continuo_engine_contract.port import (  # type: ignore[import-untyped]
+    discover_adapter,
 )
-from continuo_validation_contract.result import result_block  # type: ignore[import-untyped]
+from continuo_engine_contract.result import result_block  # type: ignore[import-untyped]
 
 from continuo_python_runtime.conform import conform, to_arrow
 from continuo_python_runtime.context import RunContext
@@ -141,13 +141,13 @@ def load_script(node: Node, repo_root: Path) -> ModuleType:
 
 
 def build_adapter() -> Any:
-    """Discover and construct the single installed runtime adapter.
+    """Discover and construct the single installed warehouse adapter.
 
     Raises:
         LoadError: If any of the adapter's ``required_env()`` vars are unset
             or empty in ``os.environ``.
     """
-    _, cls = discover_runtime_adapter()
+    _, cls = discover_adapter()
     required = cls.required_env()
     missing = [key for key in required if not os.environ.get(key)]
     if missing:
@@ -178,13 +178,12 @@ def _validate_config_early(adapter: Any, node: Node) -> None:
     but it is called *after* the script has executed and its result has been
     conformed, so a single typo (``config: {index: [...]}``) burned the whole
     node run before failing. This is the tripwire that fails it in the first
-    second instead. Validation-time checking of the same vocabulary is a future
-    cross-repo dependency (continuo-validation step 3a), and `continuo-runtime
-    validate` runs on a CI runner where no engine adapter is installed at all,
-    so this is the earliest point the engine's own rules can be applied.
+    second instead. `continuo-runtime validate` cannot do it earlier still: it
+    runs on a domain repo's CI runner, where no engine adapter is installed at
+    all, so this is the earliest point the engine's own rules can be applied.
 
     The call is skipped for an adapter that does not provide ``validate_config``:
-    the abstract ``RuntimeAdapter`` in the pinned ``continuo-validation-contract``
+    the abstract ``WarehouseAdapter`` in ``continuo-engine-contract``
     does not declare it (this repo ships the harness and both adapters as one
     coordinated release), and an adapter without it loses only earliness —
     ``ensure_table`` still fails closed on the same config.

continuo_python_runtime/types.py

@@ -10,7 +10,7 @@ import re
 from dataclasses import dataclass
 
 import pyarrow as pa  # type: ignore[import-untyped]
-from continuo_validation_contract.types import validate_column_type  # type: ignore[import-untyped]
+from continuo_engine_contract.types import validate_column_type  # type: ignore[import-untyped]
 
 from continuo_python_runtime.errors import ContractError
 
@@ -37,7 +37,7 @@ class SqlType:
 def parse_sql_type(raw: str) -> SqlType:
     """Parse a SQL type string into a canonical SqlType.
 
-    ``continuo_validation_contract.types.validate_column_type`` is the single
+    ``continuo_engine_contract.types.validate_column_type`` is the single
     acceptance authority for the grammar shape (case-insensitive, injection-
     guarded): it runs first, and anything it rejects is rejected here too. The
     logic below only extracts precision/scale/length and enforces the NUMERIC

continuo_python_runtime/validation/__init__.py

@@ -0,0 +1 @@
+"""Blue/green validation runner: op dispatch, artifact fetch, result block."""

continuo_python_runtime/validation/runner.py

@@ -0,0 +1,245 @@
+"""Build a single node as an empty table in the candidate schema (blue/green validation).
+
+Dispatches on ``VALIDATION_OP`` env var (default ``build_from_sql``):
+- ``build_from_sql``: fetch the node's compiled SQL from S3 (``CANDIDATE_SQL_URI``) and
+  materialize it empty (models/snapshots).
+- ``clone_from_prod``: clone an existing prod table's shape empty from ``PROD_SCHEMA``
+  (unchanged upstreams, including seeds).
+- ``build_from_columns``: for python nodes, which have no SELECT to shape their output
+  from. Fetch the node's validation spec JSON from S3 (``CANDIDATE_SPEC_URI`` —
+  ``{"reads": [sql, ...], "output_columns": [{"name","type","nullable"}, ...],
+  "config": {...}}``; ``config`` is optional and defaults to ``{}``), bind-check every
+  declared read against the candidate schema so an upstream that
+  dropped a column the script reads fails the release gate, then materialize the
+  output table empty from the declared typed columns and the declared physical layout.
+
+The engine adapter is discovered from the single installed
+``continuo_engine.adapters`` entry point — each runner image installs exactly one.
+stdout is reserved exclusively for the runner's one structured ``result_block``,
+printed as its last line; all diagnostics go to stderr via the ``logging`` module.
+A non-zero exit marks the node failed.
+"""
+import json
+import logging
+import os
+import sys
+
+from continuo_engine_contract import result  # type: ignore[import-untyped]
+from continuo_engine_contract.port import (  # type: ignore[import-untyped]
+    AdapterDiscoveryError,
+    discover_adapter,
+)
+from continuo_python_runtime.validation import s3
+
+logger = logging.getLogger("validation_runner")
+
+
+def _node_id() -> str:
+    """Best-known node identity for a result block: ``NODE_ID`` env, else ``""``.
+
+    The single source of NODE_ID resolution shared by every block-emitting path.
+    ``main`` layers a ``model.{table}`` fallback on top once TABLE_NAME is known;
+    the early ``_require`` failures (which may be the missing TABLE_NAME itself)
+    cannot, so they fall back to this bare value.
+    """
+    return os.environ.get("NODE_ID", "")
+
+
+def _require(name: str) -> str:
+    value = os.environ.get(name)
+    if not value:
+        logger.error("missing required env var %s", name)
+        print(
+            result.result_block(
+                "error", f"missing required env var {name}",
+                unique_id=_node_id(),
+            ),
+            flush=True,
+        )
+        sys.exit(2)
+    return value
+
+
+def load_candidate_sql() -> str:
+    """Fetch this node's candidate SQL from S3 at ``CANDIDATE_SQL_URI``.
+
+    Returns the raw UTF-8 body (no stripping; the caller normalizes). Returns ``""``
+    when ``CANDIDATE_SQL_URI`` is unset/empty (nothing to validate). Raises on
+    invalid-URI or S3-download errors so ``main`` maps them to a structured block.
+    """
+    uri = os.environ.get("CANDIDATE_SQL_URI", "")
+    if not uri:
+        return ""
+    bucket, key = s3.parse_s3_uri(uri)
+    client = s3.make_s3_client()
+    body = client.get_object(Bucket=bucket, Key=key)["Body"].read()
+    decoded: str = body.decode("utf-8")
+    return decoded
+
+
+def load_candidate_spec() -> dict:
+    """Fetch this node's validation spec JSON from S3 at ``CANDIDATE_SPEC_URI``.
+
+    Returns the parsed dict. Raises on unset/empty URI, invalid URI, S3
+    download errors, invalid JSON, or JSON that parses to something other than
+    an object (e.g. a list, ``null``, a number, or a string) — ``main`` maps
+    every failure to a structured block.
+    """
+    uri = os.environ.get("CANDIDATE_SPEC_URI", "")
+    if not uri:
+        raise ValueError("CANDIDATE_SPEC_URI is unset or empty")
+    bucket, key = s3.parse_s3_uri(uri)
+    client = s3.make_s3_client()
+    body = client.get_object(Bucket=bucket, Key=key)["Body"].read()
+    spec = json.loads(body.decode("utf-8"))
+    if not isinstance(spec, dict):
+        raise ValueError(
+            f"candidate spec must be a JSON object, got {type(spec).__name__}"
+        )
+    return spec
+
+
+_NODE_OPS = ("build_from_sql", "clone_from_prod", "build_from_columns")
+_SCHEMA_OPS = ("ensure_schema", "drop_schema")
+
+
+def main() -> None:
+    """Run one validation op end to end; exits non-zero on failure.
+
+    Node ops (``build_from_sql``/``clone_from_prod``/``build_from_columns``)
+    materialize one empty node table and require ``TABLE_NAME``. Schema ops
+    (``ensure_schema``/``drop_schema``) act on the whole candidate schema —
+    the executor schedules them as one-shot engine-image Jobs to own the
+    candidate-schema lifecycle without connecting to the warehouse itself —
+    and take no table.
+    """
+    logging.basicConfig(
+        level=logging.INFO, stream=sys.stderr, format="%(levelname)s %(name)s: %(message)s"
+    )
+    schema = _require("DBT_TARGET_SCHEMA")
+    op = os.environ.get("VALIDATION_OP", "build_from_sql")
+
+    # Gather op-specific inputs and identity BEFORE touching the adapter, surfacing
+    # input errors as a structured block (preserves the prior contract + exit codes).
+    table = None
+    candidate_sql = None
+    prod_schema = None
+    spec: dict | None = None
+    config: dict = {}
+    if op in _NODE_OPS:
+        table = _require("TABLE_NAME")
+        unique_id = _node_id() or f"model.{table}"
+        if op == "build_from_sql":
+            try:
+                raw_sql = load_candidate_sql()
+            except Exception as exc:
+                uri = os.environ.get("CANDIDATE_SQL_URI", "")
+                logger.error("ERROR fetching candidate SQL from %r: %s", uri, exc)
+                print(result.result_block("error", str(exc), unique_id=unique_id), flush=True)
+                sys.exit(1)
+            if not raw_sql:
+                logger.error(
+                    "CANDIDATE_SQL_URI is unset or the object is empty for a "
+                    "build_from_sql node; cannot validate"
+                )
+                print(result.result_block("error", "CANDIDATE_SQL_URI is unset or empty",
+                                          unique_id=unique_id), flush=True)
+                sys.exit(2)
+            candidate_sql = raw_sql
+        elif op == "build_from_columns":
+            try:
+                spec = load_candidate_spec()
+            except (ValueError, json.JSONDecodeError) as exc:
+                logger.error("invalid candidate spec: %s", exc)
+                print(result.result_block("error", str(exc), unique_id=unique_id), flush=True)
+                sys.exit(2)
+            except Exception as exc:
+                uri = os.environ.get("CANDIDATE_SPEC_URI", "")
+                logger.error("ERROR fetching candidate spec from %r: %s", uri, exc)
+                print(result.result_block("error", str(exc), unique_id=unique_id), flush=True)
+                sys.exit(1)
+            if not spec.get("output_columns"):
+                logger.error("candidate spec has no output_columns; cannot validate")
+                print(result.result_block("error", "candidate spec has no output_columns",
+                                          unique_id=unique_id), flush=True)
+                sys.exit(2)
+            raw_config = spec.get("config")
+            if raw_config is not None and not isinstance(raw_config, dict):
+                # Engine-blind: the runner only decides that the block is a JSON
+                # object. Which keys are legal is the installed adapter's call.
+                msg = (
+                    f"candidate spec 'config' must be a JSON object, "
+                    f"got {type(raw_config).__name__}"
+                )
+                logger.error("%s", msg)
+                print(result.result_block("error", msg, unique_id=unique_id), flush=True)
+                sys.exit(2)
+            config = raw_config or {}
+        else:
+            prod_schema = _require("PROD_SCHEMA")
+    elif op in _SCHEMA_OPS:
+        unique_id = _node_id() or f"schema.{schema}"
+    else:
+        unique_id = _node_id() or f"schema.{schema}"
+        logger.error("unknown VALIDATION_OP %r", op)
+        print(result.result_block("error", f"unknown VALIDATION_OP {op!r}",
+                                  unique_id=unique_id), flush=True)
+        sys.exit(2)
+
+    # Engine selection is discovery, not configuration: the image installs one adapter.
+    try:
+        engine, adapter_cls = discover_adapter()
+    except AdapterDiscoveryError as exc:
+        logger.error("%s", exc)
+        print(result.result_block("error", str(exc), unique_id=unique_id), flush=True)
+        sys.exit(2)
+
+    missing = [v for v in adapter_cls.required_env() if not os.environ.get(v)]
+    if missing:
+        msg = f"missing required env for engine {engine!r}: {', '.join(missing)}"
+        logger.error("%s", msg)
+        print(result.result_block("error", msg, unique_id=unique_id), flush=True)
+        sys.exit(2)
+
+    # close() runs exactly once, in the finally, on every path: the success case,
+    # the op error (sys.exit raises SystemExit, which still unwinds finally), and
+    # a from_env() failure (adapter stays None). A close() failure only logs — the
+    # primary error, if any, is already the SystemExit propagating through.
+    adapter = None
+    try:
+        adapter = adapter_cls.from_env()
+        if op == "ensure_schema":
+            adapter.ensure_schema(schema)
+        elif op == "drop_schema":
+            adapter.drop_schema(schema)
+        else:
+            adapter.ensure_schema(schema)
+            assert table is not None, "table must be set for a node op"
+            if op == "build_from_sql":
+                assert candidate_sql is not None, "candidate_sql must be set for build_from_sql"
+                adapter.build_empty_from_sql(schema, table, candidate_sql)
+            elif op == "build_from_columns":
+                assert spec is not None, "spec must be set for build_from_columns"
+                for read_sql in spec.get("reads", []):
+                    adapter.check_binds(read_sql)
+                adapter.build_empty_from_columns(schema, table, spec["output_columns"], config)
+            else:
+                assert prod_schema is not None, "prod_schema must be set for clone_from_prod"
+                adapter.clone_empty_from_prod(schema, prod_schema, table)
+    except Exception as exc:
+        logger.error("ERROR op=%s on schema %s: %s", op, schema, exc)
+        print(result.result_block("error", str(exc), unique_id=unique_id), flush=True)
+        sys.exit(1)
+    finally:
+        if adapter is not None:
+            try:
+                adapter.close()
+            except Exception as close_exc:  # never mask the primary outcome
+                logger.error("adapter close failed: %s", close_exc)
+
+    logger.info("ran op=%s on schema=%s (engine=%s)", op, schema, engine)
+    print(result.result_block("success", unique_id=unique_id), flush=True)
+
+
+if __name__ == "__main__":
+    main()

continuo_python_runtime/validation/s3.py

@@ -0,0 +1,45 @@
+"""S3 helpers for the validation runner.
+
+``parse_s3_uri`` and ``make_s3_client`` back the runner's candidate-SQL fetch
+from ``CANDIDATE_SQL_URI``.
+"""
+import os
+
+from typing import Any
+
+import boto3  # type: ignore[import-untyped]
+
+
+def parse_s3_uri(uri: str) -> tuple[str, str]:
+    """Parse an ``s3://bucket/key`` URI and return ``(bucket, key)``.
+
+    Raises :class:`ValueError` for non-s3:// URIs, a missing bucket, or a
+    missing/empty key (e.g. ``s3://bucket-only`` or ``s3://bucket/``).
+    """
+    if not uri.startswith("s3://"):
+        raise ValueError(f"invalid S3 URI (must start with s3://): {uri!r}")
+    bucket, _, key = uri[len("s3://"):].partition("/")
+    if not bucket or not key:
+        raise ValueError(f"invalid S3 URI (missing bucket or key): {uri!r}")
+    return bucket, key
+
+
+def make_s3_client() -> Any:
+    """Construct a boto3 S3 client, letting boto3 resolve credentials itself.
+
+    Only ``S3_ENDPOINT_URL`` (when set and non-empty, e.g. for MinIO) is passed
+    explicitly. Credentials and region are left for boto3's own chain, which
+    natively reads ``AWS_ACCESS_KEY_ID``, ``AWS_SECRET_ACCESS_KEY``,
+    ``AWS_SESSION_TOKEN``, and ``AWS_DEFAULT_REGION`` from the environment, and
+    falls through to IAM roles / web identity / instance profiles when those are
+    absent. Passing raw (possibly blank or missing) env values as explicit
+    keyword args would instead select empty/explicit credentials or drop
+    temporary-credential session tokens, breaking that chain.
+
+    Tests patch ``s3.boto3`` to intercept the underlying ``client`` call.
+    """
+    kwargs: dict[str, Any] = {}
+    endpoint_url = os.environ.get("S3_ENDPOINT_URL")
+    if endpoint_url:
+        kwargs["endpoint_url"] = endpoint_url
+    return boto3.client("s3", **kwargs)

{continuo_python_runtime-0.2.0.dist-info → continuo_python_runtime-0.3.1.dist-info}/METADATA

@@ -1,14 +1,18 @@
-Metadata-Version: 2.4
+Metadata-Version: 2.5
 Name: continuo-python-runtime
-Version: 0.2.0
+Version: 0.3.1
 Summary: Runtime harness, contract tooling, and CI lint for Continuo python nodes.
 Author: Simone Carolini
 Maintainer: Simone Carolini
+License-Expression: Apache-2.0
+License-File: LICENSE
+License-File: NOTICE
 Classifier: Development Status :: 4 - Beta
 Classifier: Intended Audience :: Developers
 Classifier: Programming Language :: Python :: 3.14
 Requires-Python: >=3.14
-Requires-Dist: continuo-validation-contract==0.4.0
+Requires-Dist: boto3==1.43.59
+Requires-Dist: continuo-engine-contract==0.7.1
 Requires-Dist: pyarrow==25.0.0
 Requires-Dist: pyyaml==6.0.3
 Requires-Dist: sqlglot==30.15.0
@@ -16,6 +20,10 @@ Description-Content-Type: text/markdown
 
 # Continuo Python Runtime
 
+[![CI](https://github.com/carolsimone/continuo-python-runtime/actions/workflows/ci.yml/badge.svg)](https://github.com/carolsimone/continuo-python-runtime/actions/workflows/ci.yml)
+[![License: Apache 2.0](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](LICENSE)
+[![Release](https://img.shields.io/github/v/release/carolsimone/continuo-python-runtime?label=release)](https://github.com/carolsimone/continuo-python-runtime/releases)
+
 Runtime harness, contract tooling, and CI lint for Continuo python nodes.
 This repo is what domain data teams (marketing, finance, …) template from to
 ship a python node into Continuo: write a contract + a `run(ctx)` script,
@@ -24,53 +32,69 @@ and register the release with Continuo.
 
 ## What this repo is
 
-Three artifacts come out of this repository:
+Four artifacts come out of this repository:
 
 - **The `continuo-python-runtime` PyPI package** — the `continuo-runtime` CLI
-  (`validate` / `merge` / `hash` / `lint` / `run`) and the harness library
-  (`conform()`, `RunContext`, the error taxonomy) that domain repos install.
-- **Per-engine base images**, one per warehouse engine (`...-postgres`,
-  `...-trino`), that domain repos build `FROM`. Each image bakes in the
-  runtime, a single `RuntimeAdapter` for that engine, and the
-  `continuo-runtime run` entrypoint.
+  (`validate` / `merge` / `hash` / `lint` / `run` / `validation-op`) and the
+  harness library (`conform()`, `RunContext`, the error taxonomy) that domain
+  repos install.
+- **The `continuo-engine-contract` PyPI package** — the `WarehouseAdapter`
+  port, the contract schema, the shared SQL/type/config guards, and the
+  sentinel result-block format. Adapter authors outside this repo pin it.
+- **Per-engine base images**, one per warehouse engine
+  (`continuo-python-runtime-postgres`, `continuo-python-runtime-trino`), that
+  domain repos build `FROM`. Each image bakes in the runtime and a single
+  `WarehouseAdapter` for that engine, and serves both roles that adapter has:
+  the node harness (`ENTRYPOINT ["continuo-runtime"]`, `CMD ["run"]`) and the
+  validation runner (`continuo-runtime validation-op`).
 - **`template/`** — a copy-ready domain repo: `Dockerfile`, `contracts/`,
   `scripts/`, and the `release.yml` CI/CD workflow.
 
-Base images and the PyPI publication of this package land with this repo's
-PR 9 (the image pipeline); until then, install the runtime from git as noted
-in `template/.github/workflows/release.yml`.
+One `vX.Y.Z` git tag releases all of it: `publish-pypi.yml` builds both
+distributions into a single `dist/` and publishes them together, and
+`images.yml` builds and pushes both engine images multi-arch under the same
+tag.
 
-### Package map
+### What this repo owns
 
-Each per-engine base image bakes together three PyPI packages: the harness,
-the engine adapter, and the published contract. The harness and both engine
-adapters live in *this* repo (`continuo-python-runtime`) as a uv workspace;
-`continuo-validation-runners` owns the *validation-side* (offline lint/merge)
-counterparts of the same engines, which is a separate concern from the
-data-plane adapters here.
+This repository owns the entire python-node surface: the engine contract, both
+engine adapters, the validation runner, and the node harness. The former
+`continuo-validation` repository was merged in — there is no longer a separate
+validation-side port, adapter class, entry-point group, or image. One
+`WarehouseAdapter` per engine serves both the data plane (`fetch` /
+`ensure_table` / `load`) and validation (`ensure_schema` / `drop_schema` /
+`build_empty_from_sql` / `build_empty_from_columns` / `clone_empty_from_prod` /
+`check_binds`), and one image per engine runs both roles.
 
 | Package (distribution name) | Module | Lives in | Role |
 | --- | --- | --- | --- |
-| `continuo-python-runtime` | `continuo_python_runtime` | this repo (root) | Harness: CLI, `conform()`, `RunContext`, error taxonomy. |
-| `continuo-python-runtime-postgres` | `continuo_python_runtime_postgres` | this repo, `python-runtime-postgres/` | Data-plane `RuntimeAdapter` for Postgres (`fetch`/`ensure_table`/`load`). **Not published to PyPI** — built from source into the image. |
-| `continuo-python-runtime-trino` | `continuo_python_runtime_trino` | this repo, `python-runtime-trino/` | Data-plane `RuntimeAdapter` for Trino/Iceberg. **Not published to PyPI** — built from source into the image. |
-| `continuo-validation-contract` | `continuo_validation_contract` | `continuo-validation-runners` | The published contract (schema, `RuntimeAdapter` port, result-block format) both sides depend on. |
-| `continuo-validation-postgres` / `continuo-validation-trino` | `continuo_validation_postgres` / `continuo_validation_trino` | `continuo-validation-runners` | Validation-side (lint/merge, no live warehouse I/O) adapters — not to be confused with the data-plane adapters above. |
-
-All three packages built in this repo resolve `continuo-validation-contract`
-from PyPI (`==0.4.0`); the two adapter packages are uv workspace members
-(`[tool.uv.workspace]` in the root `pyproject.toml`), so `uv sync
---all-packages --all-groups` at the repo root installs everything for local
-development.
-
-**Only `continuo-python-runtime` is published to PyPI.** The two engine
-adapters are built **from source into the runtime images**: `Dockerfile.postgres`
-and `Dockerfile.trino` `pip install` them out of the build context, so each
-image ships exactly one adapter and the harness discovers it through the
-`continuo_runtime.adapters` entry-point group at run time. Nothing installs
-them from an index — the harness package does not depend on them, and domain
-repos get their adapter by building `FROM` a published base image. They are
-still built, type-checked, and tested by CI on every change.
+| `continuo-python-runtime` | `continuo_python_runtime` | this repo (root) | Harness (CLI, `conform()`, `RunContext`, error taxonomy) **and** the validation runner (`continuo-runtime validation-op`). Published to PyPI. |
+| `continuo-engine-contract` | `continuo_engine_contract` | this repo, `contract/` | The `WarehouseAdapter` port, contract schema, the SQL/type/config guards adapters must run, and the result-block format. Published to PyPI. |
+| `continuo-python-runtime-postgres` | `continuo_python_runtime_postgres` | this repo, `adapters/postgres/` | `PostgresAdapter` — one class, both roles. **Not published to PyPI** — built from source into the image. |
+| `continuo-python-runtime-trino` | `continuo_python_runtime_trino` | this repo, `adapters/trino/` | `TrinoAdapter` — one class, both roles, for Trino/Iceberg. **Not published to PyPI** — built from source into the image. |
+
+All four are uv workspace members (`[tool.uv.workspace]` in the root
+`pyproject.toml`), so `uv sync --all-packages --all-groups` at the repo root
+installs everything for local development.
+
+**Only `continuo-python-runtime` and `continuo-engine-contract` are published
+to PyPI.** The two engine adapters are built **from source into the engine
+images**: `Dockerfile.postgres` and `Dockerfile.trino` install them out of the
+build context, so each image ships exactly one adapter and the runtime
+discovers it through the `continuo_engine.adapters` entry-point group at run
+time. Nothing installs them from an index — the harness package does not
+depend on them, and domain repos get their adapter by building `FROM` a
+published base image. They are still built, type-checked, and tested by CI on
+every change.
+
+### The result block is a frozen wire contract
+
+`continuo_engine_contract.result` writes a sentinel-framed JSON block as the
+last line of stdout, and Continuo's Go side parses it byte-for-byte
+(`pkg/validationresult` in the `continuo` repository). That wire format — the
+sentinel markers, the framing, and the field names inside the block — is
+**frozen**. Reuse it; never change it from this side alone. A change here that
+the Go parser has not been taught is a production outage, not a refactor.
 
 ## Quickstart for domain teams
 
@@ -98,7 +122,7 @@ still built, type-checked, and tested by CI on every change.
 ### Upgrading an existing domain repo
 
 `validate` / `merge` / `hash` now hand every declared read to a real SQL
-parser (sqlglot, via `continuo_validation_contract.sql.ensure_single_read`)
+parser (sqlglot, via `continuo_engine_contract.sql.ensure_single_read`)
 instead of scanning it for a leading `SELECT`/`WITH`. Two things follow for a
 repo written before this, on its next release: SQL a driver would accept but
 a parser will not — most commonly a driver-specific bind placeholder like
@@ -138,9 +162,13 @@ def run(ctx):
   example a polars DataFrame. Returning anything else raises `ScriptError`.
 - The dataframe library is your choice. No dataframe library is baked into
   the base image — the package's own runtime dependencies are `pyarrow`,
-  `PyYAML`, and `continuo-validation-contract`. Add whatever you script
+  `PyYAML`, and `continuo-engine-contract`. Add whatever you script
   against (pandas, polars, …) as a `RUN pip install` line in your own
-  `Dockerfile`, on top of the base image.
+  `Dockerfile`, on top of the base image. The base image runs as non-root
+  (uid 65532), which pip cannot install under, so switch to root for the
+  install and back afterward — `USER root`, then the `RUN pip install`
+  line, then `USER 65532:65532` — since the executor's pod spec expects
+  the image to end at uid 65532. See `template/Dockerfile` for the pattern.
 - Scripts do not import warehouse drivers, write raw SQL literals, or call
   data-access methods directly — `continuo-runtime lint` rejects those:
   - forbidden driver imports (`psycopg2`/`sqlalchemy`/`trino`/etc.),
@@ -208,19 +236,20 @@ A domain repo picks its warehouse engine by which base image it builds
 `FROM`:
 
 ```dockerfile
-FROM ghcr.io/carolsimone/continuo-python-runtime:v0.2.0-postgres
+FROM ghcr.io/carolsimone/continuo-python-runtime-postgres:v0.3.1
 # or
-FROM ghcr.io/carolsimone/continuo-python-runtime:v0.2.0-trino
+FROM ghcr.io/carolsimone/continuo-python-runtime-trino:v0.3.1
 ```
 
-Each image bakes in exactly one `RuntimeAdapter` for that engine — installed
-from this repo's `python-runtime-postgres/` or `python-runtime-trino/`
-package (see the package map above; both adapters live in this repo, not
-`continuo-validation-runners`) — registered under the
-`continuo_runtime.adapters` entry-point group (entry names `postgres` /
-`trino`). The harness discovers it via `discover_runtime_adapter()` at run
-time, so a single image serves every node in the service. The executor
-injects the
+The engine is part of the image **name**; the tag is the bare version, so
+Continuo's Helm chart can pin an image as `<name>:vX.Y.Z@sha256:<digest>`.
+
+Each image bakes in exactly one `WarehouseAdapter` for that engine — installed
+from this repo's `adapters/postgres/` or `adapters/trino/` package (see the
+table above) — registered under the `continuo_engine.adapters` entry-point
+group (entry names `postgres` / `trino`). The runtime discovers it via
+`discover_adapter()` at run time, so a single image serves every node in the
+service and the release-time validation Job for it. The executor injects the
 warehouse connection as environment variables (engine-native, e.g.
 `POSTGRES_HOST`/`POSTGRES_DB`/`POSTGRES_USER`) plus the node-selection
 environment (`NODE_ID`, `TABLE_NAME`, `TARGET_SCHEMA`, and optionally

continuo_python_runtime-0.3.1.dist-info/RECORD

@@ -0,0 +1,24 @@
+continuo_python_runtime/__init__.py,sha256=otNaXEPsTtRXJV5FLtDUsFO8VD4OC-MLAzwhtimHfOE,70
+continuo_python_runtime/cli.py,sha256=X4JBC4FDpgFOeDdtBbeX9GTq1XTuJCghDpemlR_CPvE,5925
+continuo_python_runtime/closure.py,sha256=6e-IAQp8Lieb0bGKP1F6JE4TgVBJ_COTGXRUult2xeI,12991
+continuo_python_runtime/conform.py,sha256=a9CKCA-gT9Zerzr6c5H8aByTFOUd6uBMo02sNKSDnXg,9199
+continuo_python_runtime/context.py,sha256=K-9XXYlQ4OZ250rCOq6EJNq7fg_D5sK6tOcu7DLZfVg,1856
+continuo_python_runtime/errors.py,sha256=nfZzfBhQ2ajm7USAWKKaGY2uUlh8eNjNPNYYuaOJgZE,1032
+continuo_python_runtime/harness.py,sha256=1b_ze2_AJ9vncY-yj88TgJylVzKwGw1-idxHoaYAymE,12101
+continuo_python_runtime/hashing.py,sha256=70iXQb0CmjGqniTPofXY6WapydQ7aK2XOk5dzpEf-zk,3354
+continuo_python_runtime/lint.py,sha256=M59UtCHHVQnJKNolIkvkRk_AgGAFvxD9zkKAMMK-7GI,12984
+continuo_python_runtime/types.py,sha256=_ssxNE2Lq5782n9_Ihs-u_6ybCCy8XaL6iYbE35tBug,5057
+continuo_python_runtime/contract/__init__.py,sha256=S79x6j_P0CmaSuCGzeWoK1U0507KvD2MZXwQl9DFWMM,37
+continuo_python_runtime/contract/loader.py,sha256=WeKngAe6VH-WxgRTVdCERPMdsGBszJM9RkanUTTs9-w,15611
+continuo_python_runtime/contract/merge.py,sha256=XCCeE2vJUm0KA60d2XsHpjRh5fIdVfFu_HsBzEyUWow,6505
+continuo_python_runtime/contract/model.py,sha256=2hKI04M0WwvTkOy9eDGl2dRZgY3bAuJYktAG-ICI-AU,936
+continuo_python_runtime/contract/paths.py,sha256=SRn70pJkDAIpXw0IcMU2iNKPKvct8w_SZP2ec-lV91M,1458
+continuo_python_runtime/validation/__init__.py,sha256=hz5oGXsoaUoygR0_pBby9PS6cEfrre518EE0HGB58eE,79
+continuo_python_runtime/validation/runner.py,sha256=zHs5CR3Wr9512sh6eY9hpN8NG3weJPYUFRDPJf2BNnc,10875
+continuo_python_runtime/validation/s3.py,sha256=q8nRrT9R7L1-M4dSlDnkL7CUJMPmq86MHY_UKYFlEf8,1785
+continuo_python_runtime-0.3.1.dist-info/METADATA,sha256=CbkAD-RaAJiq31POHm89uDUFgQEYQMN2DCCfwhAJqVo,15416
+continuo_python_runtime-0.3.1.dist-info/WHEEL,sha256=zOwg4jB6zX2kU910N-cMawjivD6tO8NEWvE12je1bVk,87
+continuo_python_runtime-0.3.1.dist-info/entry_points.txt,sha256=ZvIwSm9f9B9ZmZMf6CyF5Zt4QONn8rqaIk-u-B1CF2Y,70
+continuo_python_runtime-0.3.1.dist-info/licenses/LICENSE,sha256=hfXfFCk-8gnps4YvHA6bjCNaSYqOrq2gAdqkXYycAQc,11345
+continuo_python_runtime-0.3.1.dist-info/licenses/NOTICE,sha256=ykgYyQkAMx3uas90FZHzt0aTca9IgJQCLpZ4d74Pl3U,465
+continuo_python_runtime-0.3.1.dist-info/RECORD,,

{continuo_python_runtime-0.2.0.dist-info → continuo_python_runtime-0.3.1.dist-info}/WHEEL

@@ -1,4 +1,4 @@
 Wheel-Version: 1.0
-Generator: hatchling 1.31.0
+Generator: hatchling 1.32.0
 Root-Is-Purelib: true
 Tag: py3-none-any

continuo_python_runtime-0.3.1.dist-info/licenses/LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the
+      purposes of this License, Derivative Works shall not include works
+      that remain separable from, or merely link (or bind by name) to the
+      interfaces of, the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright 2026 Simone Carolini
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

continuo_python_runtime-0.3.1.dist-info/licenses/NOTICE

@@ -0,0 +1,11 @@
+Continuo Python Runtime
+Copyright 2026 Simone Carolini
+
+Licensed under the Apache License, Version 2.0 (the "License"); you may not use
+this product except in compliance with the License. You may obtain a copy of the
+License in the LICENSE file at the root of this repository, or at:
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+This product includes third-party software. See `uv.lock` for the full
+dependency inventory and each dependency's declared license.

continuo_python_runtime-0.2.0.dist-info/RECORD

@@ -1,19 +0,0 @@
-continuo_python_runtime/__init__.py,sha256=otNaXEPsTtRXJV5FLtDUsFO8VD4OC-MLAzwhtimHfOE,70
-continuo_python_runtime/cli.py,sha256=FlY1GqEKrtx4O34zMzlFVBuM6wAPaFEyAHjhN0lDcdA,5495
-continuo_python_runtime/closure.py,sha256=6e-IAQp8Lieb0bGKP1F6JE4TgVBJ_COTGXRUult2xeI,12991
-continuo_python_runtime/conform.py,sha256=a9CKCA-gT9Zerzr6c5H8aByTFOUd6uBMo02sNKSDnXg,9199
-continuo_python_runtime/context.py,sha256=ZyeN_dA2DihQbegBiiqHj1_EKk79GsxS-tATPVymUPg,1856
-continuo_python_runtime/errors.py,sha256=nfZzfBhQ2ajm7USAWKKaGY2uUlh8eNjNPNYYuaOJgZE,1032
-continuo_python_runtime/harness.py,sha256=SF5ciKsc1RawAQ41h_TuYqqkOp5mf5SSeELv0_B2EvI,12211
-continuo_python_runtime/hashing.py,sha256=70iXQb0CmjGqniTPofXY6WapydQ7aK2XOk5dzpEf-zk,3354
-continuo_python_runtime/lint.py,sha256=M59UtCHHVQnJKNolIkvkRk_AgGAFvxD9zkKAMMK-7GI,12984
-continuo_python_runtime/types.py,sha256=kecwFUMkfglv0h6fkcXTlHkEHeLziWyzJvBsimy-Bl0,5065
-continuo_python_runtime/contract/__init__.py,sha256=S79x6j_P0CmaSuCGzeWoK1U0507KvD2MZXwQl9DFWMM,37
-continuo_python_runtime/contract/loader.py,sha256=6w8uC7kZzGKMDj45pXJtWVI7Pa675CsjJG3e37LcelI,15623
-continuo_python_runtime/contract/merge.py,sha256=XCCeE2vJUm0KA60d2XsHpjRh5fIdVfFu_HsBzEyUWow,6505
-continuo_python_runtime/contract/model.py,sha256=2hKI04M0WwvTkOy9eDGl2dRZgY3bAuJYktAG-ICI-AU,936
-continuo_python_runtime/contract/paths.py,sha256=SRn70pJkDAIpXw0IcMU2iNKPKvct8w_SZP2ec-lV91M,1458
-continuo_python_runtime-0.2.0.dist-info/METADATA,sha256=Dvmmo8AgQ3gg0jFhJbcSDC3tCagVG_dSy5gfUj6L_bk,13607
-continuo_python_runtime-0.2.0.dist-info/WHEEL,sha256=lCkmxWfQsSc9CfIClYeavTdQeEX2toPqufh9gI35EQA,87
-continuo_python_runtime-0.2.0.dist-info/entry_points.txt,sha256=ZvIwSm9f9B9ZmZMf6CyF5Zt4QONn8rqaIk-u-B1CF2Y,70
-continuo_python_runtime-0.2.0.dist-info/RECORD,,