frontier-runner 0.2.0__tar.gz → 0.2.2__tar.gz

{frontier_runner-0.2.0 → frontier_runner-0.2.2}/CHANGELOG.md

@@ -5,6 +5,20 @@ All notable changes to frontier-runner are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.2.2] — 2026-09-22
+
+- Disposable repair validation is the authoritative repaired-vs-head check. The unchanged materialized mart versus head comparison is an expected pre-repair difference and no longer fails the run.
+- `assert_repaired_equals_reference`, mismatch counts, targeted-repair safety, GitHub comments, and run detail now follow `repairValidation`. Production apply remains not requested unless explicitly applied.
+- Mart baseline, candidate certification, disposable repair, production apply, economics, and execution stay independent dimensions. `NOT_EVALUATED` economics does not fail a correct assessment.
+
+## [0.2.1] — 2026-09-22
+
+- Made filter-v1 eligibility and the RowCover candidate compiler authoritative for `compare` and `prove`. Ineligible plans stay `UNCERTIFIED` and are not reported as safe for targeted repair.
+- Failed `prove` writes a fresh uniquely identified run artifact. `upload` refuses a stale `frontier-run.json`.
+- Targeted SQL generation failures are classified as execution failures instead of being swallowed.
+- Mixed compiled dbt environments fail before warehouse execution with `ENVIRONMENT_MISMATCH`.
+- Economics stay independent of `SQL_CERTIFIED` and use measured bytes rather than a demonstrated cost saving.
+
 ## [0.2.0] — 2026-09-21
 
 - Added browser-based CLI authentication.
@@ -86,6 +100,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - SaaS commands resolve stored keychain credentials through one shared
   resolver instead of requiring `FRONTIER_API_KEY` in the environment.
 
+[0.2.2]: https://github.com/jadsamara/frontier-runner/compare/v0.2.1...v0.2.2
+[0.2.1]: https://github.com/jadsamara/frontier-runner/compare/v0.2.0...v0.2.1
 [0.2.0]: https://github.com/jadsamara/frontier-runner/compare/v0.1.3...v0.2.0
 [0.1.3]: https://github.com/jadsamara/frontier-runner/compare/v0.1.2...v0.1.3
 [0.1.2]: https://github.com/jadsamara/frontier-runner/compare/v0.1.1...v0.1.2

{frontier_runner-0.2.0/frontier_runner.egg-info → frontier_runner-0.2.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: frontier-runner
-Version: 0.2.0
+Version: 0.2.2
 Summary: Customer-side Frontier CLI for dbt + Snowflake or BigQuery + GitHub impact assessments.
 Author: Frontier
 License: MIT License
@@ -92,7 +92,7 @@ Until the package is on PyPI, install the GitHub Release wheel for a version
 tag. You do not need a commit SHA:
 
 ```bash
-pipx install \ "frontier-runner[snowflake] @ https://github.com/jadsamara/frontier-runner/releases/download/v0.2.0/frontier_runner-0.2.0-py3-none-any.whl"
+pipx install \ "frontier-runner[snowflake] @ https://github.com/jadsamara/frontier-runner/releases/download/v0.2.2/frontier_runner-0.2.2-py3-none-any.whl"
 pipx inject frontier-runner "snowflake-connector-python>=3.12,<4"
 ```
 
@@ -222,9 +222,9 @@ workflow uses `FRONTIER_BLOCKING=false` unless you pass `--blocking`.
 Pin an immutable released version:
 
 ```bash
-pip install "frontier-runner[snowflake]==0.2.0"
+pip install "frontier-runner[snowflake]==0.2.2"
 # or
-pip install "frontier-runner[bigquery]==0.2.0"
+pip install "frontier-runner[bigquery]==0.2.2"
 ```
 
 Until PyPI trusted publishing is reviewed and live, install the GitHub Release

{frontier_runner-0.2.0 → frontier_runner-0.2.2}/README.md

@@ -34,7 +34,7 @@ Until the package is on PyPI, install the GitHub Release wheel for a version
 tag. You do not need a commit SHA:
 
 ```bash
-pipx install \ "frontier-runner[snowflake] @ https://github.com/jadsamara/frontier-runner/releases/download/v0.2.0/frontier_runner-0.2.0-py3-none-any.whl"
+pipx install \ "frontier-runner[snowflake] @ https://github.com/jadsamara/frontier-runner/releases/download/v0.2.2/frontier_runner-0.2.2-py3-none-any.whl"
 pipx inject frontier-runner "snowflake-connector-python>=3.12,<4"
 ```
 
@@ -164,9 +164,9 @@ workflow uses `FRONTIER_BLOCKING=false` unless you pass `--blocking`.
 Pin an immutable released version:
 
 ```bash
-pip install "frontier-runner[snowflake]==0.2.0"
+pip install "frontier-runner[snowflake]==0.2.2"
 # or
-pip install "frontier-runner[bigquery]==0.2.0"
+pip install "frontier-runner[bigquery]==0.2.2"
 ```
 
 Until PyPI trusted publishing is reviewed and live, install the GitHub Release

{frontier_runner-0.2.0 → frontier_runner-0.2.2}/frontier/__init__.py

@@ -1,3 +1,3 @@
 """Customer-side Frontier runner."""
 
-__version__ = "0.2.0"
+__version__ = "0.2.2"

{frontier_runner-0.2.0 → frontier_runner-0.2.2}/frontier/adapters/base.py

@@ -75,3 +75,22 @@ class CursorAdapter:
 
     def get_query_history(self, run_id: str) -> list[dict[str, Any]]:
         return []
+
+    def capture_snapshot(self, relations: list[str] | tuple[str, ...], **kwargs: Any) -> Any:
+        from frontier.snapshot import SOURCE_SNAPSHOT_NOT_PINNED, unpinned_snapshot
+
+        del relations, kwargs
+        return unpinned_snapshot(
+            failure_code=SOURCE_SNAPSHOT_NOT_PINNED,
+            failure_reason=f"{self.warehouse_type} does not pin source snapshots",
+        )
+
+    def bind_query_to_snapshot(self, sql: str, snapshot: Any) -> str:
+        del snapshot
+        return sql
+
+    def verify_snapshot_binding(self, sql: str, snapshot: Any) -> bool:
+        from frontier.snapshot import ASSURANCE_ADAPTER
+
+        del sql
+        return getattr(snapshot, "assurance", None) == ASSURANCE_ADAPTER and False

{frontier_runner-0.2.0 → frontier_runner-0.2.2}/frontier/adapters/bigquery.py

@@ -183,6 +183,23 @@ class BigQueryAdapter:
             "location": self.location,
         }
 
+    def capture_snapshot(self, relations: list[str] | tuple[str, ...], **kwargs: Any) -> Any:
+        from frontier.snapshot import SOURCE_SNAPSHOT_NOT_PINNED, unpinned_snapshot
+
+        del relations, kwargs
+        return unpinned_snapshot(
+            failure_code=SOURCE_SNAPSHOT_NOT_PINNED,
+            failure_reason="BigQuery source snapshots are not implemented",
+        )
+
+    def bind_query_to_snapshot(self, sql: str, snapshot: Any) -> str:
+        del snapshot
+        return sql
+
+    def verify_snapshot_binding(self, sql: str, snapshot: Any) -> bool:
+        del sql, snapshot
+        return False
+
     def close(self) -> None:
         client = self._client
         if client is not None and hasattr(client, "close"):

{frontier_runner-0.2.0 → frontier_runner-0.2.2}/frontier/adapters/snowflake.py

@@ -124,7 +124,8 @@ class SnowflakeAdapter(CursorAdapter):
             return {}
         try:
             rows = self.execute(
-                "select query_id, bytes_scanned, partitions_scanned, rows_produced "
+                "select query_id, bytes_scanned, rows_produced, total_elapsed_time, "
+                "credits_used_cloud_services "
                 "from table(information_schema.query_history()) "
                 f"where query_id = {sql_string(token)} "
                 "order by start_time desc limit 1"
@@ -134,13 +135,171 @@ class SnowflakeAdapter(CursorAdapter):
         if not rows:
             return {}
         row = rows[0]
+        elapsed = row[3] if len(row) > 3 else None
         return {
             "query_id": row[0],
             "bytes_scanned": row[1] if len(row) > 1 else None,
-            "partitions_scanned": row[2] if len(row) > 2 else None,
-            "rows_produced": row[3] if len(row) > 3 else None,
+            "rows_produced": row[2] if len(row) > 2 else None,
+            "elapsed_ms": elapsed,
+            "total_elapsed_ms": elapsed,
+            "cloud_services_credits": float(row[4]) if len(row) > 4 and row[4] is not None else None,
         }
 
+    def capture_snapshot(self, relations: list[str] | tuple[str, ...], **kwargs: Any) -> Any:
+        from frontier.snapshot import capture_from_catalog, utc_now_iso
+
+        identifier = self._current_timestamp_literal()
+        catalog = self._inventory_relations(relations)
+        return capture_from_catalog(
+            relations,
+            catalog=catalog,
+            identifier=identifier,
+            captured_at=utc_now_iso(),
+            attestation_source=kwargs.get("attestation_source"),
+        )
+
+    def bind_query_to_snapshot(self, sql: str, snapshot: Any) -> str:
+        from frontier.snapshot import bind_sql_to_snapshot
+
+        return bind_sql_to_snapshot(sql, snapshot, dialect=self.dialect)
+
+    def verify_snapshot_binding(self, sql: str, snapshot: Any) -> bool:
+        from frontier.snapshot import verify_snapshot_binding as verify
+
+        return verify(sql, snapshot, dialect=self.dialect)
+
+    def _current_timestamp_literal(self) -> str:
+        rows = self.execute(
+            "select to_varchar(current_timestamp(), 'YYYY-MM-DD HH24:MI:SS.FF3 TZHTZM')"
+        )
+        if not rows or rows[0][0] is None:
+            from frontier.snapshot import SnapshotError, SOURCE_SNAPSHOT_NOT_PINNED
+
+            raise SnapshotError(SOURCE_SNAPSHOT_NOT_PINNED, "Snowflake did not return a snapshot timestamp")
+        return str(rows[0][0]).strip()
+
+    def _inventory_relations(self, relations: list[str] | tuple[str, ...]) -> dict[str, dict[str, Any]]:
+        from frontier.snapshot import DYNAMIC_TABLE, EXTERNAL_TABLE, MATERIALIZED_VIEW, VIEW
+        from frontier.warehouse import split_relation_parts
+
+        catalog: dict[str, dict[str, Any]] = {}
+        pending = [str(item).strip() for item in relations if str(item).strip()]
+        seen: set[str] = set()
+        while pending:
+            name = pending.pop(0)
+            key = name.lower()
+            if key in seen:
+                continue
+            seen.add(key)
+            database, schema, table = split_relation_parts(name)
+            if not table:
+                continue
+            entry = self._lookup_table(database, schema, table)
+            if entry is None:
+                continue
+            kind = str(entry.get("kind") or "")
+            if kind == VIEW:
+                definition = self._view_definition(database, schema, table)
+                if definition:
+                    entry["view_sql"] = definition
+                    from frontier.snapshot import collect_source_relations
+
+                    pending.extend(collect_source_relations(definition, dialect="snowflake"))
+            elif kind in {MATERIALIZED_VIEW, EXTERNAL_TABLE, DYNAMIC_TABLE}:
+                entry["kind"] = kind
+            catalog[name] = entry
+            dynamic = self._is_dynamic_table(database, schema, table)
+            if dynamic:
+                catalog[name]["kind"] = DYNAMIC_TABLE
+        return catalog
+
+    def _lookup_table(
+        self,
+        database: str | None,
+        schema: str | None,
+        table: str,
+    ) -> dict[str, Any] | None:
+        sql = (
+            "select table_catalog, table_schema, table_name, table_type, "
+            "is_transient, retention_time "
+            "from information_schema.tables "
+            f"where lower(table_name) = lower({sql_string(table)})"
+        )
+        if schema:
+            sql += f" and lower(table_schema) = lower({sql_string(schema)})"
+        if database:
+            sql += f" and lower(table_catalog) = lower({sql_string(database)})"
+        sql += " limit 1"
+        try:
+            rows = self.execute(sql)
+        except Exception:
+            return None
+        if not rows:
+            return None
+        row = rows[0]
+        table_type = str(row[3] or "").strip().upper()
+        is_transient = str(row[4] or "").strip().upper() == "YES"
+        retention = row[5] if len(row) > 5 else None
+        kind = table_type.lower()
+        if table_type == "BASE TABLE" and is_transient:
+            kind = "transient"
+        elif table_type == "BASE TABLE":
+            kind = "permanent_table"
+        return {
+            "kind": kind,
+            "retention_days": int(retention) if retention is not None else None,
+        }
+
+    def _view_definition(
+        self,
+        database: str | None,
+        schema: str | None,
+        table: str,
+    ) -> str | None:
+        sql = (
+            "select view_definition from information_schema.views "
+            f"where lower(table_name) = lower({sql_string(table)})"
+        )
+        if schema:
+            sql += f" and lower(table_schema) = lower({sql_string(schema)})"
+        if database:
+            sql += f" and lower(table_catalog) = lower({sql_string(database)})"
+        sql += " limit 1"
+        try:
+            rows = self.execute(sql)
+        except Exception:
+            return None
+        if not rows or rows[0][0] is None:
+            return None
+        text = str(rows[0][0]).strip().rstrip(";")
+        if text.lower().startswith("create "):
+            lowered = text.lower()
+            marker = " as "
+            index = lowered.find(marker)
+            if index != -1:
+                text = text[index + len(marker) :].strip()
+        return text or None
+
+    def _is_dynamic_table(
+        self,
+        database: str | None,
+        schema: str | None,
+        table: str,
+    ) -> bool:
+        sql = (
+            "select 1 from information_schema.dynamic_tables "
+            f"where lower(table_name) = lower({sql_string(table)})"
+        )
+        if schema:
+            sql += f" and lower(table_schema) = lower({sql_string(schema)})"
+        if database:
+            sql += f" and lower(table_catalog) = lower({sql_string(database)})"
+        sql += " limit 1"
+        try:
+            return bool(self.execute(sql))
+        except Exception:
+            return False
+
     def describe(self) -> dict[str, Any]:
         if self._config is None:
             return {"warehouse_type": self.warehouse_type}

{frontier_runner-0.2.0 → frontier_runner-0.2.2}/frontier/api.py

@@ -73,6 +73,9 @@ def build_ingest_payload(
     semantic_manifest_version: int | None = None,
     semantic_manifest_fingerprint: str | None = None,
     manifest_source: str | None = None,
+    runner_version: str | None = None,
+    dbt_target: str | None = None,
+    assessment_identity: dict[str, Any] | None = None,
 ) -> dict[str, Any]:
     payload = {
         "externalRunId": external_run_id,
@@ -121,6 +124,12 @@ def build_ingest_payload(
             payload["semanticManifestFingerprint"] = semantic_manifest_fingerprint
         if manifest_source:
             payload["manifestSource"] = manifest_source
+    if runner_version:
+        payload["runnerVersion"] = runner_version
+    if dbt_target:
+        payload["dbtTarget"] = dbt_target
+    if assessment_identity:
+        payload["assessmentIdentity"] = assessment_identity
     assert_payload_has_no_secrets(payload)
     assert_no_raw_rows(payload)
     return payload

frontier_runner-0.2.2/frontier/certification.py

@@ -0,0 +1,263 @@
+"""Separated assessment result dimensions for filter-v1.
+
+Certification, validation, economics, and execution are independent
+claims. Warehouse execution failure, economic fallback, and
+full-reference validation must not overwrite certification status.
+"""
+
+from __future__ import annotations
+
+from typing import Any
+
+from frontier.snapshot import (
+    ASSURANCE_ADAPTER,
+    MODE_NONE,
+    RULE_SET_VERSION,
+    SOURCE_SNAPSHOT_NOT_PINNED,
+    SourceSnapshot,
+    unpinned_snapshot,
+)
+
+SQL_CERTIFIED = "SQL_CERTIFIED"
+CONTRACT_CERTIFIED = "CONTRACT_CERTIFIED"
+UNCERTIFIED = "UNCERTIFIED"
+_LEGACY_UNCIFIED = "UNCIFIED"
+
+
+def normalize_certification_status(value: str | None) -> str:
+    """Accept the 21A UNCIFIED misspelling; emit only UNCERTIFIED."""
+    if value == _LEGACY_UNCIFIED:
+        return UNCERTIFIED
+    if value in {SQL_CERTIFIED, CONTRACT_CERTIFIED, UNCERTIFIED}:
+        return value
+    return UNCERTIFIED
+
+
+VALIDATION_NOT_RUN = "NOT_RUN"
+CANDIDATES_CONFIRMED = "CANDIDATES_CONFIRMED"
+FULL_REFERENCE_VALIDATED = "FULL_REFERENCE_VALIDATED"
+VALIDATION_FAILED = "FAILED"
+
+TARGETED_REPAIR_RECOMMENDED = "TARGETED_REPAIR_RECOMMENDED"
+FULL_REBUILD_RECOMMENDED = "FULL_REBUILD_RECOMMENDED"
+ECONOMICS_NOT_EVALUATED = "NOT_EVALUATED"
+
+EXECUTION_PENDING = "PENDING"
+EXECUTION_SUCCEEDED = "SUCCEEDED"
+EXECUTION_FAILED = "FAILED"
+
+
+def certification_status(
+    snapshot: SourceSnapshot | None,
+    *,
+    static_certified: bool = False,
+    contract_certified: bool = False,
+) -> tuple[str, str | None]:
+    """Return (status, failure_code). Never inspects execution or validation."""
+    pinned = snapshot if snapshot is not None else unpinned_snapshot()
+    if not pinned.allows_sql_certified():
+        code = pinned.failure_code or SOURCE_SNAPSHOT_NOT_PINNED
+        return UNCERTIFIED, code
+    if static_certified:
+        return SQL_CERTIFIED, None
+    if contract_certified:
+        return CONTRACT_CERTIFIED, None
+    return UNCERTIFIED, None
+
+
+def validation_status(
+    *,
+    full_reference_validated: bool = False,
+    full_reference_failed: bool = False,
+    candidates_confirmed: bool = False,
+    confirmation_failed: bool = False,
+) -> str:
+    if full_reference_validated:
+        return FULL_REFERENCE_VALIDATED
+    if full_reference_failed or confirmation_failed:
+        return VALIDATION_FAILED
+    if candidates_confirmed:
+        return CANDIDATES_CONFIRMED
+    return VALIDATION_NOT_RUN
+
+
+def economics_decision(
+    *,
+    full_rebuild_recommended: bool = False,
+    targeted_ran: bool = False,
+    frontier_bytes: int | None = None,
+    full_comparison_bytes: int | None = None,
+    warehouse_credits: float | None = None,
+) -> str:
+    """Bytes and wall time are not billed credits. Do not recommend targeted repair from running alone."""
+    del targeted_ran
+    if full_rebuild_recommended:
+        return FULL_REBUILD_RECOMMENDED
+    if frontier_bytes is not None and full_comparison_bytes is not None:
+        if frontier_bytes >= full_comparison_bytes:
+            return FULL_REBUILD_RECOMMENDED
+        if warehouse_credits is None:
+            return ECONOMICS_NOT_EVALUATED
+        return TARGETED_REPAIR_RECOMMENDED
+    return ECONOMICS_NOT_EVALUATED
+
+
+def execution_status(
+    *,
+    execution_failed: bool = False,
+    execution_ran: bool = False,
+) -> str:
+    if execution_failed:
+        return EXECUTION_FAILED
+    if execution_ran:
+        return EXECUTION_SUCCEEDED
+    return EXECUTION_PENDING
+
+
+def build_assessment_dimensions(
+    *,
+    snapshot: SourceSnapshot | None,
+    static_certified: bool = False,
+    contract_certified: bool = False,
+    execution_failed: bool = False,
+    execution_ran: bool = False,
+    full_rebuild_recommended: bool = False,
+    targeted_ran: bool = False,
+    frontier_bytes: int | None = None,
+    full_comparison_bytes: int | None = None,
+    warehouse_credits: float | None = None,
+    candidates_confirmed: bool = False,
+    confirmation_failed: bool = False,
+    full_reference_validated: bool = False,
+    full_reference_failed: bool = False,
+    failure_phase: str | None = None,
+    failure_code: str | None = None,
+    failure_reason: str | None = None,
+) -> dict[str, Any]:
+    cert_status, cert_code = certification_status(
+        snapshot,
+        static_certified=static_certified,
+        contract_certified=contract_certified,
+    )
+    if cert_status == SQL_CERTIFIED and (snapshot is None or not snapshot.allows_sql_certified()):
+        cert_status = UNCERTIFIED
+        cert_code = SOURCE_SNAPSHOT_NOT_PINNED
+    certification: dict[str, Any] = {
+        "status": cert_status,
+        "ruleSetVersion": RULE_SET_VERSION,
+    }
+    if cert_code:
+        certification["failureCode"] = cert_code
+    source = snapshot or unpinned_snapshot()
+    upload = source.to_upload_payload()
+    economics = {
+        "decision": economics_decision(
+            full_rebuild_recommended=full_rebuild_recommended,
+            targeted_ran=targeted_ran,
+            frontier_bytes=frontier_bytes,
+            full_comparison_bytes=full_comparison_bytes,
+            warehouse_credits=warehouse_credits,
+        )
+    }
+    if frontier_bytes is not None:
+        economics["frontierBytesScanned"] = int(frontier_bytes)
+    if full_comparison_bytes is not None:
+        economics["fullComparisonBytesScanned"] = int(full_comparison_bytes)
+    execution: dict[str, Any] = {
+        "status": execution_status(
+            execution_failed=execution_failed,
+            execution_ran=execution_ran,
+        )
+    }
+    if failure_phase:
+        execution["failurePhase"] = failure_phase[:64]
+    if failure_code:
+        execution["failureCode"] = failure_code[:64]
+    if failure_reason:
+        execution["failureReason"] = failure_reason[:512]
+    return {
+        "certification": certification,
+        "validation": {"status": validation_status(
+            full_reference_validated=full_reference_validated,
+            full_reference_failed=full_reference_failed,
+            candidates_confirmed=candidates_confirmed,
+            confirmation_failed=confirmation_failed,
+        )},
+        "economics": economics,
+        "execution": execution,
+        "sourceSnapshot": upload,
+        "baselineBoundary": dict(BASELINE_BOUNDARY),
+    }
+
+
+BASELINE_BOUNDARY = {
+    "comparesSqlVersionsAtPinnedSnapshot": True,
+    "existingMaterializedMartRepresentsSnapshot": False,
+    "safeInPlaceProductionRepair": False,
+}
+
+
+def filter_v1_sql_certified(
+    *,
+    eligible: bool,
+    compiled: bool,
+    confirmed: bool,
+    execution_failed: bool,
+) -> bool:
+    """All four 21C gates except snapshot, which certification_status still checks."""
+    return bool(eligible and compiled and confirmed and not execution_failed)
+
+
+def enrich_certification_record(
+    dimensions: dict[str, Any],
+    *,
+    eligibility: dict[str, Any] | None,
+    snapshot: SourceSnapshot | None,
+    candidate_fingerprint: str | None = None,
+    execution_failed: bool = False,
+) -> dict[str, Any]:
+    """Attach plan, taint, assumption, and snapshot identity to certification."""
+    certification = dict(dimensions.get("certification") or {})
+    eligibility = eligibility or {}
+    for src, dest in (
+        ("oldPlanFingerprint", "oldPlanFingerprint"),
+        ("newPlanFingerprint", "newPlanFingerprint"),
+        ("changedFilterNodeId", "changedFilterNodeId"),
+        ("coveredNodeIds", "coveredNodeIds"),
+        ("operators", "operators"),
+        ("joinTaint", "joinTaint"),
+        ("checkedAssumptions", "checkedAssumptions"),
+        ("manifestDependencies", "manifestDependencies"),
+        ("candidateFingerprint", "candidateQueryFingerprint"),
+    ):
+        value = eligibility.get(src)
+        if value:
+            certification[dest] = value
+    if candidate_fingerprint:
+        certification["candidateQueryFingerprint"] = candidate_fingerprint
+    source = snapshot or unpinned_snapshot()
+    if source.identifier:
+        certification["snapshotIdentifier"] = source.identifier
+    if eligibility.get("eligible") is False:
+        certification["status"] = UNCERTIFIED
+        certification["failureCode"] = eligibility.get("reasonCode") or UNCERTIFIED
+    elif execution_failed:
+        certification["status"] = UNCERTIFIED
+        if snapshot is not None and (
+            snapshot.assurance == ASSURANCE_ADAPTER or snapshot.allows_sql_certified()
+        ):
+            certification["failureCode"] = EXECUTION_FAILED
+    dimensions["certification"] = certification
+    dimensions["baselineBoundary"] = dict(BASELINE_BOUNDARY)
+    return dimensions
+
+
+def display_evidence_level(evidence_level: str, validation: dict[str, Any] | None) -> str:
+    """Never label empirically validated unless full-reference actually ran."""
+    if (
+        validation
+        and validation.get("status") != FULL_REFERENCE_VALIDATED
+        and evidence_level == "empirically_validated"
+    ):
+        return "aggregates"
+    return evidence_level