openstatspec 0.1.0__tar.gz → 0.3.0__tar.gz

openstatspec-0.3.0/.github/verify_release_ref.py

@@ -0,0 +1,63 @@
+"""Fail closed unless the requested release tag names HEAD and the package version."""
+
+from __future__ import annotations
+
+import os
+from pathlib import Path
+import subprocess
+import sys
+import tomllib
+
+
+def _git(*arguments: str) -> str:
+    completed = subprocess.run(
+        ["git", *arguments],
+        check=False,
+        stdout=subprocess.PIPE,
+        stderr=subprocess.PIPE,
+        text=True,
+    )
+    if completed.returncode:
+        detail = completed.stderr.strip() or completed.stdout.strip()
+        raise RuntimeError(detail or f"git {' '.join(arguments)} failed")
+    return completed.stdout.strip()
+
+
+def verify_release_ref() -> None:
+    release_tag = os.environ.get("RELEASE_TAG", "")
+    version = str(
+        tomllib.loads(Path("pyproject.toml").read_text(encoding="utf-8"))["project"]["version"]
+    )
+    expected_tag = f"v{version}"
+    if release_tag != expected_tag:
+        raise RuntimeError(
+            f"release tag {release_tag!r} does not match package version {version!r}"
+        )
+
+    tag_ref = f"refs/tags/{release_tag}"
+    exists = subprocess.run(
+        ["git", "show-ref", "--verify", "--quiet", tag_ref],
+        check=False,
+    )
+    if exists.returncode:
+        raise RuntimeError(f"release tag ref {tag_ref!r} does not exist")
+
+    tag_commit = _git("rev-parse", "--verify", f"{tag_ref}^{{commit}}")
+    head_commit = _git("rev-parse", "--verify", "HEAD^{commit}")
+    if tag_commit != head_commit:
+        raise RuntimeError(
+            f"release tag {release_tag!r} resolves to {tag_commit}, not HEAD {head_commit}"
+        )
+
+
+def main() -> int:
+    try:
+        verify_release_ref()
+    except (KeyError, OSError, RuntimeError, tomllib.TOMLDecodeError) as error:
+        print(f"release ref verification failed: {error}", file=sys.stderr)
+        return 1
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

{openstatspec-0.1.0 → openstatspec-0.3.0}/.github/workflows/ci.yml

@@ -20,7 +20,7 @@ jobs:
         uses: actions/checkout@v7
         with: &specification-checkout
           repository: OpenStatSpec/specification
-          ref: 6b9d1fc38f2f083c0ac5cf1c64874a6d07b95045
+          ref: 79339ec3d8f8aa81789b7e85f6b8afa6f1374e50
           path: openstatspec-specification
       - name: Checkout required SPSS engine
         uses: actions/checkout@v7
@@ -63,7 +63,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        postgres: ["17", "18"]
+        postgres: ["17.10", "18.4"]
     services:
       postgres:
         image: postgres:${{ matrix.postgres }}
@@ -77,6 +77,7 @@ jobs:
           --health-interval 10s --health-timeout 5s --health-retries 5
     env:
       OPENSTATSPEC_POSTGRES_URL: postgresql+psycopg://openstatspec:openstatspec@localhost:5432/openstatspec
+      OPENSTATSPEC_EXPECTED_POSTGRES_VERSION: ${{ matrix.postgres }}
     steps: &sql-test-steps
       - uses: actions/checkout@v7
       - name: Checkout OpenStatSpec specification fixtures
@@ -99,7 +100,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        mysql: ["8.4", "9.7"]
+        mysql: ["8.4.11", "9.7.2"]
     services:
       mysql:
         image: mysql:${{ matrix.mysql }}
@@ -114,6 +115,7 @@ jobs:
           --health-interval 10s --health-timeout 5s --health-retries 10
     env:
       OPENSTATSPEC_MYSQL_URL: mysql+pymysql://openstatspec:openstatspec@localhost:3306/openstatspec
+      OPENSTATSPEC_EXPECTED_MYSQL_VERSION: ${{ matrix.mysql }}
     steps: *sql-test-steps
 
   mariadb-integration:
@@ -122,7 +124,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        mariadb: ["11.4", "11.8", "12.3"]
+        mariadb: ["11.4.12", "11.8.8", "12.3.2"]
     services:
       mariadb:
         image: mariadb:${{ matrix.mariadb }}
@@ -137,4 +139,91 @@ jobs:
           --health-interval 10s --health-timeout 5s --health-retries 10
     env:
       OPENSTATSPEC_MARIADB_URL: mysql+pymysql://openstatspec:openstatspec@localhost:3306/openstatspec
+      OPENSTATSPEC_EXPECTED_MARIADB_VERSION: ${{ matrix.mariadb }}
     steps: *sql-test-steps
+
+  dolt-integration:
+    name: Dolt ${{ matrix.dolt }} integration
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - dolt: "2.2.2"
+            image: dolthub/dolt:2.2.2@sha256:ae85afdd95317f0a982cab87fa3092a5a2e6689bc5de822ad7ae4f65b86d39a1
+          - dolt: "2.2.3"
+            image: dolthub/dolt:2.2.3@sha256:1a651e738a2e7275b9c69fec8c5f42c6e23954314405c412f4dc9287ee7c0080
+    env:
+      OPENSTATSPEC_DOLT_URL: mysql+pymysql://openstatspec:openstatspec@127.0.0.1:13308/openstatspec
+      OPENSTATSPEC_EXPECTED_DOLT_VERSION: ${{ matrix.dolt }}
+      OPENSTATSPEC_DOLT_IMAGE: ${{ matrix.image }}
+    steps:
+      - uses: actions/checkout@v7
+      - name: Checkout OpenStatSpec specification fixtures
+        uses: actions/checkout@v7
+        with: *specification-checkout
+      - name: Checkout required SPSS engine
+        uses: actions/checkout@v7
+        with: *engine-checkout
+      - uses: actions/setup-python@v7
+        with:
+          python-version: "3.12"
+      - name: Initialize Dolt ${{ matrix.dolt }}
+        run: |
+          mkdir -p "$RUNNER_TEMP/openstatspec-dolt"
+          docker run --rm \
+            --volume "$RUNNER_TEMP/openstatspec-dolt:/var/lib/dolt" \
+            --workdir /var/lib/dolt \
+            "$OPENSTATSPEC_DOLT_IMAGE" init \
+            --name "OpenStatSpec CI" --email "ci@openstatspec.org"
+          docker run --rm \
+            --volume "$RUNNER_TEMP/openstatspec-dolt:/var/lib/dolt" \
+            --workdir /var/lib/dolt \
+            "$OPENSTATSPEC_DOLT_IMAGE" sql \
+            -q "CREATE DATABASE openstatspec"
+          docker run --rm \
+            --volume "$RUNNER_TEMP/openstatspec-dolt:/var/lib/dolt" \
+            --workdir /var/lib/dolt \
+            "$OPENSTATSPEC_DOLT_IMAGE" sql \
+            -q "CREATE USER 'openstatspec'@'%' IDENTIFIED BY 'openstatspec'; GRANT ALL PRIVILEGES ON openstatspec.* TO 'openstatspec'@'%'"
+          docker run --detach --name openstatspec-dolt \
+            --publish 127.0.0.1:13308:3306 \
+            --volume "$RUNNER_TEMP/openstatspec-dolt:/var/lib/dolt" \
+            --workdir /var/lib/dolt \
+            "$OPENSTATSPEC_DOLT_IMAGE" sql-server -H 0.0.0.0 -l warning
+      - run: python -m pip install --upgrade pip
+      - run: python -m pip install ./openstatspec-pyspssio
+      - run: python -m pip install -e ".[dev,sql]"
+      - name: Wait for Dolt
+        run: |
+          python - <<'PY'
+          import time
+          import pymysql
+
+          for attempt in range(30):
+              try:
+                  connection = pymysql.connect(
+                      host="127.0.0.1",
+                      port=13308,
+                      user="openstatspec",
+                      password="openstatspec",
+                      database="openstatspec",
+                  )
+              except pymysql.MySQLError:
+                  if attempt == 29:
+                      raise
+                  time.sleep(2)
+              else:
+                  connection.close()
+                  break
+          PY
+      - run: python -m pytest -m services
+      - name: Show Dolt logs on failure and stop server
+        if: always()
+        run: |
+          if docker inspect openstatspec-dolt >/dev/null 2>&1; then
+            if [ "${{ job.status }}" != "success" ]; then
+              docker logs openstatspec-dolt
+            fi
+            docker rm --force openstatspec-dolt
+          fi

{openstatspec-0.1.0 → openstatspec-0.3.0}/.github/workflows/release.yml

@@ -7,6 +7,12 @@ on:
   push:
     tags:
       - "v*"
+  workflow_dispatch:
+    inputs:
+      release_ref:
+        description: "Existing release tag to rebuild and publish idempotently"
+        required: true
+        type: string
 
 permissions:
   contents: read
@@ -16,11 +22,32 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
+        with:
+          ref: refs/tags/${{ inputs.release_ref || github.ref_name }}
+          fetch-depth: 0
+      - uses: actions/setup-python@v7
+        with:
+          python-version: "3.13"
+      - name: Verify release tag exists and targets this package version
+        env:
+          RELEASE_TAG: ${{ inputs.release_ref || github.ref_name }}
+        run: |
+          set -eu
+          git fetch --force --no-tags origin "refs/tags/${RELEASE_TAG}:refs/tags/${RELEASE_TAG}"
+          python .github/verify_release_ref.py
+      - run: python -m pip install --upgrade pip build
+      - name: Verify required SPSS engine is publicly installable
+        run: >-
+          python -m pip download --only-binary=:all: --no-deps
+          --dest /tmp/openstatspec-engine-release
+          openstatspec-pyspssio==0.5.1.post2
+      - name: Build clean release distributions
+        run: python -m build
       - name: Checkout normative specification fixtures
         uses: actions/checkout@v7
         with:
           repository: OpenStatSpec/specification
-          ref: 6b9d1fc38f2f083c0ac5cf1c64874a6d07b95045
+          ref: 79339ec3d8f8aa81789b7e85f6b8afa6f1374e50
           path: openstatspec-specification
       - name: Checkout required SPSS engine
         uses: actions/checkout@v7
@@ -28,19 +55,9 @@ jobs:
           repository: TonisOrmisson/pyspssio
           ref: e069adf33c70bcd9e8e6ee495106479463a84fa2
           path: openstatspec-pyspssio
-      - uses: actions/setup-python@v7
-        with:
-          python-version: "3.13"
-      - run: python -m pip install --upgrade pip build
-      - name: Verify required SPSS engine is publicly installable
-        run: >-
-          python -m pip download --only-binary=:all: --no-deps
-          --dest /tmp/openstatspec-engine-release
-          openstatspec-pyspssio==0.5.1.post2
       - run: python -m pip install ./openstatspec-pyspssio
       - run: python -m pip install -e ".[dev]"
       - run: python -m pytest -m "not services"
-      - run: python -m build
       - run: python -m venv /tmp/openstatspec-release-smoke
       - run: /tmp/openstatspec-release-smoke/bin/python -m pip install ./openstatspec-pyspssio
       - run: /tmp/openstatspec-release-smoke/bin/python -m pip install dist/*.whl
@@ -64,3 +81,5 @@ jobs:
           name: python-distributions
           path: dist/
       - uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          skip-existing: true

openstatspec-0.3.0/CHANGELOG.md

@@ -0,0 +1,92 @@
+# Changelog
+
+All notable changes to this reference implementation are documented here.
+
+## 0.3.0 — 2026-07-31
+
+### Added
+
+- Added a bounded SPSS-like `RECODE`, `VARIABLE LABELS`, and `VALUE LABELS`
+  parser with stable diagnostics and conformance fixtures.
+- Added canonical Transformation Plan serialization, RFC 8785 hashes, schema
+  binding, deterministic typed operations, and an agent-facing CLI/API.
+- Added product-neutral in-place execution with same dataset/table identity,
+  direct data and metadata mutation, and compact operation audit. Dolt adds
+  expected branch/HEAD and clean-working-set checks.
+
+### Changed
+
+- Version history, diff, rollback, restoration, and commit remain database
+  responsibilities; the transformer creates no derived/copy/snapshot/recovery
+  layer and performs no `DOLT_COMMIT`.
+- SQL server support now distinguishes conservative family claims from exact
+  CI evidence: PostgreSQL 17.x/18.x at 17.10/18.4, MySQL 8.4.x/9.7.x at
+  8.4.11/9.7.2, and MariaDB 11.4.x/11.8.x/12.3.x at
+  11.4.12/11.8.8/12.3.2. Each service job verifies the live normalized version.
+- Dolt remains an independent core profile, now claiming canonical stable
+  versions `>=2.2.2,<2.3.0` and running its complete service suite at exact
+  versions 2.2.2 and 2.2.3 from immutable container-image pins.
+  SQLite retains its core `>=3.24.0,<4.0.0` and optional workflow
+  `>=3.35.0,<4.0.0` tiers. MSSQL remains unsupported and roadmap-only.
+
+### Specification basis
+
+- CI, release validation, and machine-readable capabilities use OpenStatSpec
+  specification release `v0.2.0` at exact commit
+  `79339ec3d8f8aa81789b7e85f6b8afa6f1374e50`.
+
+## 0.2.0 — 2026-07-30
+
+This release extends the reference adapter while keeping imported source
+datasets immutable and all unsupported paths fail-closed.
+
+### Added
+
+- An optional SQLite-only Transformation Workflow for immutable, versioned,
+  parameterized SELECT definitions; materialized derived datasets; lineage and
+  weights; public catalog APIs; and CLI operations.
+- An independent Dolt core SQL profile for exact product version 2.2.2, with
+  service-backed coverage, conservative adapter limits, complete compensating
+  cleanup, and pre-DDL rejection of unsupported values. Transformation Workflow
+  support on Dolt is not claimed.
+
+### Changed
+
+- SAV and ZSAV validation now rewrites legacy compatible names consistently
+  across type-2 records and subtype-13/subtype-14 long-name metadata.
+- Transformation publication, interrupted-run reconciliation, retirement, and
+  physical-removal recovery now preserve auditable state and fail closed on
+  catalog or relation drift.
+- Release automation builds distributions before test-only source checkouts and
+  supports idempotent rebuilds of an existing release tag.
+
+### Specification basis
+
+- CI and release validation are pinned to OpenStatSpec specification release
+  `v1.0.0-rc.1` at exact commit
+  `fef0dc6f4b17ff7141dad3f49d0524c63efbfed5`.
+
+## 0.1.0 — 2026-07-29
+
+First public reference implementation of the OpenStatSpec strict wide-table
+SPSS profile.
+
+### Included
+
+- Import of unencrypted SAV and ZSAV sources into one dedicated wide SQL table
+  and its metadata catalog.
+- Export of supported dataset semantics to SAV and ZSAV.
+- SQLite, PostgreSQL, MySQL, and MariaDB profiles, including service-backed
+  PostgreSQL 17/18, MySQL 8.4/9.7, and MariaDB 11.4/11.8/12.3 CI coverage.
+- Preflight checks for target profile limits, atomic imports, validation, a
+  command-line interface, and machine-readable capability and loss reports.
+
+### Important boundaries
+
+- This release promises semantic round-trip equivalence only for supported
+  features; it never promises byte-identical SAV/ZSAV output.
+- The adapter requires explicit `allow_loss` consent before exporting known
+  unsupported or lossy dictionary semantics.
+- Multiple-response sets, variable alignment, variable sets, and custom
+  attributes have explicit capability diagnostics; see the SAV profile.
+- Encrypted SPSS files are not supported.

openstatspec-0.3.0/PKG-INFO

@@ -0,0 +1,180 @@
+Metadata-Version: 2.4
+Name: openstatspec
+Version: 0.3.0
+Summary: Reference adapter for the OpenStatSpec relational contract
+Author: OpenStatSpec
+License: Apache-2.0
+Requires-Python: >=3.11
+Requires-Dist: openstatspec-pyspssio==0.5.1.post2
+Requires-Dist: pandas>=2.2
+Requires-Dist: rfc8785>=0.1.4
+Requires-Dist: sqlalchemy>=2.0
+Requires-Dist: sqlglot>=30.14
+Provides-Extra: dev
+Requires-Dist: pytest>=8; extra == 'dev'
+Provides-Extra: sql
+Requires-Dist: psycopg[binary]>=3.2; extra == 'sql'
+Requires-Dist: pymysql>=1.1; extra == 'sql'
+Description-Content-Type: text/markdown
+
+# OpenStatSpec Python
+
+The reference Python implementation of the OpenStatSpec specification.
+
+This package implements the specification; it does not define or extend it.
+The normative model lives in the `OpenStatSpec/specification` repository.
+
+## Boundaries
+
+For each supported import, one source dataset becomes one dedicated wide SQL
+table. Cases are rows and source variables are physical SQL columns. The
+singular UUID-keyed tables from the specification (`dataset`, `variable`,
+`operation`, `fidelity_event`, and related metadata tables) are the public
+catalog contract. Historical `*_catalog` tables are an internal compatibility
+layer for the current exporter and are not the standard database interface.
+The adapter does not reshape data, create EAV
+or long-form tables, or harmonize studies or waves.
+
+Unsupported source features, SQL targets, or export paths fail explicitly.
+There is no silent truncation, type conversion, metadata loss, or partial
+import.
+
+## Package layout
+
+- `openstatspec.core`: pure standard concepts, validation, versions,
+  capabilities, and loss reports.
+- `openstatspec.sql`: database connection and wide-table/catalog operations.
+- `openstatspec.spss`: SAV/ZSAV adapter boundary.
+
+## Intended workflow
+
+```python
+from openstatspec import export_sav, import_sav
+
+import_sav("responses.sav", database_url="postgresql+psycopg://user:password@server/database", dataset_id="responses-2026")
+export_sav(database_url="postgresql+psycopg://user:password@server/database", dataset_id="responses-2026", destination="responses-roundtrip.sav")
+```
+
+```text
+openstatspec import responses.sav --database-url postgresql+psycopg://... --dataset-id responses-2026
+openstatspec export --database-url postgresql+psycopg://... --dataset-id responses-2026 --output responses-roundtrip.sav
+```
+
+## Optional database-first SQL workflow
+
+Imported datasets remain immutable source records. The optional SQL
+transformation profile can register versioned, parameterized SQLite SELECT queries,
+materialize results, record lineage and weights, and expose
+derived datasets through a public catalog API. It uses a separate profile
+catalog and never presents SQL output as an imported source dataset.
+Workflow operations support SQLite only in this milestone and fail closed on
+PostgreSQL/MySQL/MariaDB; core import/export database support is unchanged.
+The core SQLite import/export profile accepts SQLite `>=3.24.0,<4.0.0`; the
+optional transformation workflow deliberately has the narrower
+`>=3.35.0,<4.0.0` runtime preflight. These independent tiers do not change the
+server-profile matrix. Microsoft SQL Server is not supported; its future
+dialect is scoped only in the specification's
+[MSSQL roadmap](https://github.com/OpenStatSpec/specification/blob/main/docs/mssql-dialect-roadmap.md).
+
+See [the SQL transformation workflow](docs/sql-transformation-workflow.md) for
+Python and CLI examples, migration behavior, hashing, atomicity, and the exact
+implemented capability boundary.
+
+## SPSS-like transformation frontend
+
+The transformation frontend accepts `RECODE`, `VARIABLE LABELS`, and
+`VALUE LABELS`, lowers them to a canonical OpenStatSpec Transformation Plan,
+and mutates the same logical dataset and physical wide table. SQLite,
+PostgreSQL, MySQL, MariaDB, and Dolt connections are allowed. It creates no
+derived dataset, copied table, snapshot, or OpenStatSpec rollback/version layer.
+
+Install the compact operation-audit relation separately, then apply syntax:
+
+```python
+from openstatspec import (
+    apply_spss_in_place,
+    install_in_place_transformation_schema,
+)
+
+database_url = "postgresql+psycopg://user:password@host/database"
+install_in_place_transformation_schema(database_url=database_url)
+result = apply_spss_in_place(
+    database_url=database_url,
+    dataset_id="...",
+    actor="agent@example.org",
+    source_text="""
+      RECODE age (18 THRU 34 = 1) (35 THRU 64 = 2) INTO age_group.
+      VARIABLE LABELS age_group 'Age group'.
+      VALUE LABELS age_group 1 '18-34' 2 '35-64'.
+    """,
+)
+```
+
+Existing-target recodes and metadata mutations use direct DML. SQLite and
+PostgreSQL may also add a target column in the same native transaction. MySQL,
+MariaDB, and Dolt reject such schema-changing plans before mutation because
+their implicit-commit DDL could otherwise leave a partial apply. On Dolt, the
+caller additionally supplies expected branch and HEAD identities, and the
+working set must be clean. The transformer never calls `DOLT_COMMIT`.
+
+See [in-place transformations](docs/in-place-transformation.md) for the full
+execution boundary and CLI form.
+
+## Current support status
+
+The adapter requires `openstatspec-pyspssio==0.5.1.post2` as its sole SPSS
+engine. Its import module remains `pyspssio`; the exact source commit is recorded
+in operation metadata. There is no fallback reader or writer. It supports unencrypted SAV and ZSAV import and
+SAV/ZSAV export for the semantics exposed by that engine. SQLite is the local
+reference path.
+PostgreSQL, MySQL, MariaDB, and Dolt are each covered by separate service-backed CI
+conformance checks. Dolt support is an independent core profile for the
+canonical stable range `>=2.2.2,<2.3.0`; earlier patches, other families,
+noncanonical versions, and unknown MySQL-wire products fail closed.
+
+The supported family claims are broader than the deliberately exact CI
+evidence points: PostgreSQL 17.x/18.x is exercised at 17.10/18.4, MySQL
+8.4.x/9.7.x at 8.4.11/9.7.2, and MariaDB 11.4.x/11.8.x/12.3.x at
+11.4.12/11.8.8/12.3.2. Each service job checks the normalized live server
+version against its exact matrix entry before that run can count as evidence.
+Dolt claims the conservative 2.2.x range `>=2.2.2,<2.3.0`; its full service
+suite is exercised independently at exact versions 2.2.2 and 2.2.3 using
+immutable container-image digests.
+
+| Engine/profile | Runtime supported policy | Exact CI-tested versions |
+| --- | --- | --- |
+| SQLite core / optional workflow | Core `>=3.24.0,<4.0.0`; optional workflow `>=3.35.0,<4.0.0` | Runtime-provided SQLite on Python 3.11–3.14 runners; not a pinned server image |
+| PostgreSQL | 17.x and 18.x | 17.10 and 18.4 |
+| MySQL | 8.4.x and 9.7.x | 8.4.11 and 9.7.2 |
+| MariaDB | 11.4.x, 11.8.x, and 12.3.x | 11.4.12, 11.8.8, and 12.3.2 |
+| Dolt | 2.2.x with `>=2.2.2,<2.3.0` | 2.2.2 and 2.2.3 |
+
+Microsoft SQL Server (MSSQL) remains roadmap-only and is not a supported
+runtime profile; see the specification's [MSSQL roadmap](https://github.com/OpenStatSpec/specification/blob/main/docs/mssql-dialect-roadmap.md).
+
+Use these explicit SQLAlchemy URLs:
+
+- SQLite: `sqlite:///dataset.sqlite`
+- PostgreSQL: `postgresql+psycopg://user:password@host/database`
+- MySQL/MariaDB: `mysql+pymysql://user:password@host/database`
+- Dolt `>=2.2.2,<2.3.0`: `mysql+pymysql://user:password@host/database` (detected by server identity)
+
+The Dolt core profile supports strict wide-table import, validation, and export;
+the separate Transformation Workflow is unsupported.
+
+Run `openstatspec capabilities` before an integration to inspect the
+machine-readable feature matrix. Export is deliberately strict: if known
+dictionary semantics cannot be reproduced, it stops until you pass the exact
+diagnostic code with `--allow-loss`. This avoids silent loss while making an
+intentional lossy export auditable.
+
+The matrix is also available to Python callers as
+`openstatspec.capability_matrix()`. It distinguishes supported semantics from
+unobservable and fail-closed paths; see the SAV profile for the exact
+the openstatspec-pyspssio boundary.
+
+See [the SAV profile](docs/sav-profile.md) for feature boundaries and
+[release readiness](docs/release-readiness.md) for the pre-tag checklist.
+Read [third-party notices](THIRD_PARTY_NOTICES.md) before distributing a
+bundled application: the required engine includes IBM redistributables under
+separate terms.