duckdb-safe-snapshot 0.1.0__tar.gz

duckdb_safe_snapshot-0.1.0/.github/workflows/ci.yml

@@ -0,0 +1,26 @@
+name: CI
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    runs-on: ubuntu-24.04
+    strategy:
+      matrix:
+        python-version: ["3.10", "3.11", "3.12"]
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        with:
+          python-version: ${{ matrix.python-version }}
+      - run: python -m pip install --upgrade pip build pytest duckdb==1.5.5
+      - run: python -m build
+      - run: python -m venv consumer
+      - run: consumer/bin/python -m pip install dist/*.whl pytest duckdb==1.5.5
+      - run: consumer/bin/python -m pytest tests

duckdb_safe_snapshot-0.1.0/.github/workflows/release.yml

@@ -0,0 +1,60 @@
+name: Publish to PyPI
+
+on:
+  push:
+    tags: ["v*"]
+
+permissions:
+  contents: read
+
+jobs:
+  publish:
+    runs-on: ubuntu-24.04
+    environment:
+      name: pypi
+      url: https://pypi.org/p/duckdb-safe-snapshot
+    permissions: {contents: read, id-token: write}
+    env:
+      RELEASE_TAG: ${{ github.ref_name }}
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          ref: ${{ github.sha }}
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        with: {python-version: '3.12'}
+      - run: |
+          set -euo pipefail
+          test "$RELEASE_TAG" = "v$(python -c 'import tomllib; print(tomllib.load(open("pyproject.toml", "rb"))["project"]["version"])')"
+          python -m pip install --upgrade pip build pytest duckdb==1.5.5
+          python -m build
+          python -m venv consumer
+          consumer/bin/python -m pip install dist/*.whl pytest duckdb==1.5.5
+          consumer/bin/python -m pytest tests
+      - id: existing
+        env:
+          DIST_DIR: dist
+          PYPI_PACKAGE: duckdb-safe-snapshot
+          PYPI_VERSION: ${{ github.ref_name }}
+        run: python tools/pypi_release_state.py
+      - if: steps.existing.outputs.state == 'publish'
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
+        with: {skip-existing: true}
+      - env:
+          DIST_DIR: dist
+          MODE: post
+          PYPI_PACKAGE: duckdb-safe-snapshot
+          PYPI_VERSION: ${{ github.ref_name }}
+        run: python tools/pypi_release_state.py
+  release:
+    needs: publish
+    runs-on: ubuntu-24.04
+    permissions: {contents: write}
+    env:
+      GH_TOKEN: ${{ github.token }}
+      GH_REPO: ${{ github.repository }}
+      RELEASE_TAG: ${{ github.ref_name }}
+    steps:
+      - run: |
+          gh release view "$RELEASE_TAG" >/dev/null 2>&1 && exit 0
+          if [[ "$RELEASE_TAG" == *-* ]]; then gh release create "$RELEASE_TAG" --verify-tag --generate-notes --prerelease
+          else gh release create "$RELEASE_TAG" --verify-tag --generate-notes; fi

duckdb_safe_snapshot-0.1.0/.gitignore

@@ -0,0 +1,6 @@
+__pycache__/
+*.py[cod]
+.pytest_cache/
+dist/
+build/
+*.egg-info/

duckdb_safe_snapshot-0.1.0/AGENT_INTEGRATION.md

@@ -0,0 +1,24 @@
+# Agent integration guide
+
+`duckdb-safe-snapshot` creates and verifies lock-coordinated DuckDB database
+and WAL snapshot sets on Linux. It requires an external `flock` path that every
+participating writer acquires before modifying either source file.
+
+Install a pinned release with `python -m pip install duckdb-safe-snapshot==0.1.0`.
+Add it to the consumer's Python dependency file and lockfile, then configure an
+explicit `Config` with absolute database, WAL, lock, backup, and state paths plus
+source/lock/snapshot owner UIDs and database/WAL artifact names. Application
+scheduling, service ordering, ACL setup, backup retention policy, and recovery
+remain consumer-owned policy.
+
+Before integration, inspect the consumer's writers and confirm each takes the
+same lock. Use a disposable DuckDB database to run `create_snapshot(config)` and
+`verify_latest(config)`, then copy the database and optional WAL artifacts to a
+recovery filename and reopen it with DuckDB. Verify imports resolve from the
+installed package rather than a source checkout.
+
+To undo a first migration, restore the consumer's previous implementation or
+commit, dependency/lockfile, and its tested scheduling configuration. Do not
+delete recovery sets as part of rollback. Report unsupported filesystem behavior
+or a failed verification with synthetic, non-secret diagnostics; use
+[SECURITY.md](SECURITY.md) for a vulnerability.

duckdb_safe_snapshot-0.1.0/CONTRIBUTING.md

@@ -0,0 +1,12 @@
+# Contributing
+
+Use Python 3.10–3.12 on Linux. Install test dependencies in an isolated
+environment, then run:
+
+```bash
+python -m pytest
+```
+
+Tests create synthetic DuckDB databases and snapshot directories only. Do not
+add real databases, production paths, credentials, or provider data. By
+submitting a contribution, you agree that it may be distributed under Apache-2.0.

duckdb_safe_snapshot-0.1.0/LICENSE

@@ -0,0 +1,182 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      Copyright 2026 Sid Kalla
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

duckdb_safe_snapshot-0.1.0/NOTICE

@@ -0,0 +1,5 @@
+Gale Finance Open Source Software
+Copyright 2026 Sid Kalla
+
+This product includes software originally developed by Sid Kalla for
+Gale Finance (https://gale.finance/).

duckdb_safe_snapshot-0.1.0/PKG-INFO

@@ -0,0 +1,157 @@
+Metadata-Version: 2.5
+Name: duckdb-safe-snapshot
+Version: 0.1.0
+Summary: Lock-coordinated, checksummed DuckDB database and WAL snapshots
+Project-URL: Homepage, https://github.com/sidko/duckdb-safe-snapshot
+Project-URL: Issues, https://github.com/sidko/duckdb-safe-snapshot/issues
+Author: Sid Kalla
+License: Apache-2.0
+License-File: LICENSE
+License-File: NOTICE
+Keywords: backup,duckdb,snapshot
+Classifier: Development Status :: 4 - Beta
+Classifier: License :: OSI Approved :: Apache Software License
+Classifier: Operating System :: POSIX :: Linux
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3 :: Only
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+
+# duckdb-safe-snapshot
+
+Create private, checksummed snapshot sets of a DuckDB database and its WAL while
+cooperating writers share one external file lock. It is a small Linux library
+and CLI for applications that own their own scheduling and recovery process.
+
+![Illustrative synthetic snapshot terminal transcript](docs/assets/synthetic-snapshot-result.svg)
+
+The image is an illustrative static terminal transcript with synthetic values;
+it is not captured output from a snapshot run.
+
+```bash
+python -m pip install duckdb-safe-snapshot==0.1.0
+```
+
+Every path and owner policy is explicit; the package has no application,
+account, service, or production-path defaults.
+
+```bash
+duckdb-safe-snapshot \
+  --database /var/lib/example/app.duckdb \
+  --wal /var/lib/example/app.duckdb.wal \
+  --lock /run/example/writer.lock \
+  --backup-root /var/backups/example/snapshots \
+  --state-root /var/lib/example/snapshot-state \
+  --source-owner-uid 1001 \
+  --lock-owner-uid 1001 \
+  --snapshot-owner-uid 1002 \
+  --database-artifact database.duckdb \
+  --wal-artifact app.duckdb.wal \
+  --metadata-json '{"application":"example"}' \
+  --release release-42 \
+  snapshot --keep 7
+
+duckdb-safe-snapshot \
+  --database /var/lib/example/app.duckdb --wal /var/lib/example/app.duckdb.wal \
+  --lock /run/example/writer.lock \
+  --backup-root /var/backups/example/snapshots \
+  --state-root /var/lib/example/snapshot-state \
+  --source-owner-uid 1001 --lock-owner-uid 1001 --snapshot-owner-uid 1002 \
+  --database-artifact database.duckdb --wal-artifact app.duckdb.wal \
+  verify latest
+```
+
+The JSON response includes the timestamped snapshot id, artifact SHA-256 values,
+and pruned recognized snapshots. Copy the database artifact and, when present,
+the WAL artifact to the same recovery location before opening the recovery copy.
+
+## Safety model
+
+This package does not make an uncoordinated DuckDB writer safe. Every writer
+that can modify the database or WAL must acquire the exact same Linux `flock`
+lock before changing either file. The snapshot takes that exclusive lock, checks
+source identity before and after copying, and fails if it observes a change.
+
+Completed snapshot directories are created privately (`0700`) and contain only
+the configured database artifact, optional WAL, a canonical JSON manifest, and
+its SHA-256 checksum (`0600`). A temporary directory becomes visible as a
+completed set only through `rename`; the set is then verified before `latest`
+is atomically updated. Verification rejects symlinks, hardlinked files,
+unexpected ownership or modes, missing/extra entries, malformed manifests, and
+checksum or size mismatches. Retention deletes only recognized, already-verified
+timestamped sets.
+
+`Config` resolves existing path aliases and rejects relative paths, output-root
+aliases, output-root nesting, and
+database/lock paths inside private output roots. It also requires all three
+owner UIDs and simple, distinct database/WAL artifact names. The caller must
+create the shared lock under an ownership/mode policy accepted by `Config`.
+For a service launcher that acquires this lock before selecting application
+code, `inherited_lock_fd` may carry that open descriptor into `create_snapshot`.
+It must be a non-negative integer descriptor for the exact configured lock;
+the package validates its inode and reuses it without closing or unlocking it,
+so the launcher retains the lock for the full child-process lifetime.
+
+This is intentionally not a restore tool, service manager, or scheduler. Its
+file checks protect leaf files and configured private roots; callers must also
+keep each parent directory trusted against replacement. Use a
+disposable recovery copy to test your own restoration procedure. The package
+uses POSIX `fcntl.flock`, `O_NOFOLLOW`, directory fsync, and POSIX permissions;
+it is supported on Linux filesystems with those semantics. Network filesystems
+and writers that do not honor the shared lock are outside its consistency claim.
+
+## Python API
+
+```python
+from pathlib import Path
+from duckdb_safe_snapshot import Config, create_snapshot, verify_latest
+
+config = Config(
+    database_path=Path("/var/lib/example/app.duckdb"),
+    wal_path=Path("/var/lib/example/app.duckdb.wal"),
+    lock_path=Path("/run/example/writer.lock"),
+    backup_root=Path("/var/backups/example/snapshots"),
+    state_root=Path("/var/lib/example/snapshot-state"),
+    source_owner_uid=1001,
+    lock_owner_uid=1001,
+    snapshot_owner_uid=1002,
+    database_artifact_name="database.duckdb",
+    wal_artifact_name="app.duckdb.wal",
+    metadata={"application": "example"},
+    release=lambda: "release-42",  # optional caller-owned identifier
+)
+
+created = create_snapshot(config, keep=7)
+assert verify_latest(config)["snapshot_id"] == created["snapshot_id"]
+```
+
+## Compatibility and maintenance
+
+The source requires Python 3.10–3.12. CI tests those Python versions with
+DuckDB 1.5.5, the version used to produce the initial real database/WAL recovery
+test. DuckDB is not a runtime dependency because this package copies files; it
+is a test dependency only. No compatibility promise is made for other DuckDB,
+Python, operating-system, or filesystem versions until they are tested.
+
+An application can pass `release` as a string or no-argument callback. Its
+result (a string or `null`) is recorded as the manifest's top-level `release`
+field while the writer lock is held. Release meaning and validation stay with
+the application; existing schema-1 manifests without that field remain
+verifiable.
+
+This project was extracted from a private application maintained by
+[Sid Kalla](https://github.com/sidko). The public package contains synthetic
+tests and generic configuration only. It is Apache-2.0 licensed; that license
+does not grant rights to Gale Finance names, logos, or visual identity. Support
+is best effort from the current release.
+
+See [CONTRIBUTING.md](CONTRIBUTING.md), [SECURITY.md](SECURITY.md), and
+[AGENT_INTEGRATION.md](AGENT_INTEGRATION.md).
+
+The public history begins with the 2026 extraction work. The private source
+mapping is retained outside this repository because it names Gale-only paths
+and operational context. Some early development used Claude as a coding
+assistant; Sid Kalla selected, reviewed and maintains this code.

duckdb_safe_snapshot-0.1.0/README.md

@@ -0,0 +1,135 @@
+# duckdb-safe-snapshot
+
+Create private, checksummed snapshot sets of a DuckDB database and its WAL while
+cooperating writers share one external file lock. It is a small Linux library
+and CLI for applications that own their own scheduling and recovery process.
+
+![Illustrative synthetic snapshot terminal transcript](docs/assets/synthetic-snapshot-result.svg)
+
+The image is an illustrative static terminal transcript with synthetic values;
+it is not captured output from a snapshot run.
+
+```bash
+python -m pip install duckdb-safe-snapshot==0.1.0
+```
+
+Every path and owner policy is explicit; the package has no application,
+account, service, or production-path defaults.
+
+```bash
+duckdb-safe-snapshot \
+  --database /var/lib/example/app.duckdb \
+  --wal /var/lib/example/app.duckdb.wal \
+  --lock /run/example/writer.lock \
+  --backup-root /var/backups/example/snapshots \
+  --state-root /var/lib/example/snapshot-state \
+  --source-owner-uid 1001 \
+  --lock-owner-uid 1001 \
+  --snapshot-owner-uid 1002 \
+  --database-artifact database.duckdb \
+  --wal-artifact app.duckdb.wal \
+  --metadata-json '{"application":"example"}' \
+  --release release-42 \
+  snapshot --keep 7
+
+duckdb-safe-snapshot \
+  --database /var/lib/example/app.duckdb --wal /var/lib/example/app.duckdb.wal \
+  --lock /run/example/writer.lock \
+  --backup-root /var/backups/example/snapshots \
+  --state-root /var/lib/example/snapshot-state \
+  --source-owner-uid 1001 --lock-owner-uid 1001 --snapshot-owner-uid 1002 \
+  --database-artifact database.duckdb --wal-artifact app.duckdb.wal \
+  verify latest
+```
+
+The JSON response includes the timestamped snapshot id, artifact SHA-256 values,
+and pruned recognized snapshots. Copy the database artifact and, when present,
+the WAL artifact to the same recovery location before opening the recovery copy.
+
+## Safety model
+
+This package does not make an uncoordinated DuckDB writer safe. Every writer
+that can modify the database or WAL must acquire the exact same Linux `flock`
+lock before changing either file. The snapshot takes that exclusive lock, checks
+source identity before and after copying, and fails if it observes a change.
+
+Completed snapshot directories are created privately (`0700`) and contain only
+the configured database artifact, optional WAL, a canonical JSON manifest, and
+its SHA-256 checksum (`0600`). A temporary directory becomes visible as a
+completed set only through `rename`; the set is then verified before `latest`
+is atomically updated. Verification rejects symlinks, hardlinked files,
+unexpected ownership or modes, missing/extra entries, malformed manifests, and
+checksum or size mismatches. Retention deletes only recognized, already-verified
+timestamped sets.
+
+`Config` resolves existing path aliases and rejects relative paths, output-root
+aliases, output-root nesting, and
+database/lock paths inside private output roots. It also requires all three
+owner UIDs and simple, distinct database/WAL artifact names. The caller must
+create the shared lock under an ownership/mode policy accepted by `Config`.
+For a service launcher that acquires this lock before selecting application
+code, `inherited_lock_fd` may carry that open descriptor into `create_snapshot`.
+It must be a non-negative integer descriptor for the exact configured lock;
+the package validates its inode and reuses it without closing or unlocking it,
+so the launcher retains the lock for the full child-process lifetime.
+
+This is intentionally not a restore tool, service manager, or scheduler. Its
+file checks protect leaf files and configured private roots; callers must also
+keep each parent directory trusted against replacement. Use a
+disposable recovery copy to test your own restoration procedure. The package
+uses POSIX `fcntl.flock`, `O_NOFOLLOW`, directory fsync, and POSIX permissions;
+it is supported on Linux filesystems with those semantics. Network filesystems
+and writers that do not honor the shared lock are outside its consistency claim.
+
+## Python API
+
+```python
+from pathlib import Path
+from duckdb_safe_snapshot import Config, create_snapshot, verify_latest
+
+config = Config(
+    database_path=Path("/var/lib/example/app.duckdb"),
+    wal_path=Path("/var/lib/example/app.duckdb.wal"),
+    lock_path=Path("/run/example/writer.lock"),
+    backup_root=Path("/var/backups/example/snapshots"),
+    state_root=Path("/var/lib/example/snapshot-state"),
+    source_owner_uid=1001,
+    lock_owner_uid=1001,
+    snapshot_owner_uid=1002,
+    database_artifact_name="database.duckdb",
+    wal_artifact_name="app.duckdb.wal",
+    metadata={"application": "example"},
+    release=lambda: "release-42",  # optional caller-owned identifier
+)
+
+created = create_snapshot(config, keep=7)
+assert verify_latest(config)["snapshot_id"] == created["snapshot_id"]
+```
+
+## Compatibility and maintenance
+
+The source requires Python 3.10–3.12. CI tests those Python versions with
+DuckDB 1.5.5, the version used to produce the initial real database/WAL recovery
+test. DuckDB is not a runtime dependency because this package copies files; it
+is a test dependency only. No compatibility promise is made for other DuckDB,
+Python, operating-system, or filesystem versions until they are tested.
+
+An application can pass `release` as a string or no-argument callback. Its
+result (a string or `null`) is recorded as the manifest's top-level `release`
+field while the writer lock is held. Release meaning and validation stay with
+the application; existing schema-1 manifests without that field remain
+verifiable.
+
+This project was extracted from a private application maintained by
+[Sid Kalla](https://github.com/sidko). The public package contains synthetic
+tests and generic configuration only. It is Apache-2.0 licensed; that license
+does not grant rights to Gale Finance names, logos, or visual identity. Support
+is best effort from the current release.
+
+See [CONTRIBUTING.md](CONTRIBUTING.md), [SECURITY.md](SECURITY.md), and
+[AGENT_INTEGRATION.md](AGENT_INTEGRATION.md).
+
+The public history begins with the 2026 extraction work. The private source
+mapping is retained outside this repository because it names Gale-only paths
+and operational context. Some early development used Claude as a coding
+assistant; Sid Kalla selected, reviewed and maintains this code.

duckdb_safe_snapshot-0.1.0/RELEASING.md

@@ -0,0 +1,7 @@
+# Releasing
+
+After `main` CI passes, push the matching `v<version>` tag over SSH. The release
+workflow checks out the event SHA, validates the version, builds the package,
+and runs the clean-consumer test. PyPI retries compare normalized archive
+contents, ignore container timestamps, and skip only matching files. A GitHub
+Release follows a successful registry publish.

duckdb_safe_snapshot-0.1.0/SECURITY.md

@@ -0,0 +1,8 @@
+# Security policy
+
+Supported versions: the latest `0.x` release.
+
+Please use GitHub's private vulnerability reporting for this repository. Do not
+include database files, credentials, customer paths, or recovery artifacts in a
+public issue. If private reporting is unavailable, open a minimal public issue
+asking for a secure contact channel.

duckdb_safe_snapshot-0.1.0/docs/assets/synthetic-snapshot-result.svg

@@ -0,0 +1,12 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="840" height="230" viewBox="0 0 840 230" role="img" aria-label="Illustrative terminal transcript with synthetic DuckDB snapshot values">
+  <rect width="840" height="230" rx="14" fill="#101722"/>
+  <circle cx="34" cy="30" r="8" fill="#ff6b6b"/><circle cx="58" cy="30" r="8" fill="#ffd166"/><circle cx="82" cy="30" r="8" fill="#06d6a0"/>
+  <g font-family="ui-monospace, SFMono-Regular, Menlo, monospace" font-size="17">
+    <text x="28" y="58" fill="#a9bfd7">Illustrative terminal transcript — synthetic values, not a captured run</text>
+    <text x="28" y="92" fill="#9cdcfe">$ duckdb-safe-snapshot … snapshot --keep 7</text>
+    <text x="28" y="126" fill="#b5cea8">{"artifacts":[{"name":"database.duckdb","size":53248}],</text>
+    <text x="28" y="155" fill="#b5cea8"> "snapshot_id":"20260909T010203.000000Z","status":"created"}</text>
+    <text x="28" y="202" fill="#9cdcfe">$ duckdb-safe-snapshot … verify latest</text>
+    <text x="585" y="202" fill="#4ec9b0">"status":"verified"</text>
+  </g>
+</svg>