openstatspec 0.7.0__tar.gz → 0.8.0__tar.gz

{openstatspec-0.7.0 → openstatspec-0.8.0}/.github/workflows/ci.yml

@@ -20,7 +20,7 @@ jobs:
         uses: actions/checkout@v7
         with: &specification-checkout
           repository: OpenStatSpec/specification
-          ref: f2fdf687d8cb32b944ca55a3e9e7215ffc603019
+          ref: 864e84479f554b8ee250ffed44c4dfb963750d4a
           path: openstatspec-specification
       - name: Checkout required SPSS engine
         uses: actions/checkout@v7
@@ -53,9 +53,9 @@ jobs:
       - run: python -m pip install --upgrade pip build
       - run: python -m build
       - run: python -m venv /tmp/openstatspec-wheel-smoke
-      - run: /tmp/openstatspec-wheel-smoke/bin/python -m pip install ./openstatspec-pyspssio
       - run: /tmp/openstatspec-wheel-smoke/bin/python -m pip install dist/*.whl
-      - run: /tmp/openstatspec-wheel-smoke/bin/openstatspec capabilities
+      - run: env -u PYTHONPATH /tmp/openstatspec-wheel-smoke/bin/openstatspec capabilities
+        working-directory: /tmp
 
   postgres-integration:
     name: PostgreSQL ${{ matrix.postgres }} integration
@@ -143,7 +143,7 @@ jobs:
     steps: *sql-test-steps
 
   dolt-integration:
-    name: Dolt ${{ matrix.dolt }} read-only / fail-closed integration
+    name: Dolt ${{ matrix.dolt }} default-write integration
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
@@ -155,6 +155,7 @@ jobs:
             image: dolthub/dolt:2.2.3@sha256:1a651e738a2e7275b9c69fec8c5f42c6e23954314405c412f4dc9287ee7c0080
     env:
       OPENSTATSPEC_DOLT_URL: mysql+pymysql://openstatspec:openstatspec@127.0.0.1:13308/openstatspec
+      OPENSTATSPEC_TEST_DOLT_ADMIN_URL: mysql+pymysql://openstatspec_test_admin:ci-admin@127.0.0.1:13308/
       OPENSTATSPEC_EXPECTED_DOLT_VERSION: ${{ matrix.dolt }}
       OPENSTATSPEC_DOLT_IMAGE: ${{ matrix.image }}
     steps:
@@ -186,6 +187,11 @@ jobs:
             --workdir /var/lib/dolt \
             "$OPENSTATSPEC_DOLT_IMAGE" sql \
             -q "CREATE USER 'openstatspec'@'%' IDENTIFIED BY 'openstatspec'; GRANT ALL PRIVILEGES ON openstatspec.* TO 'openstatspec'@'%'"
+          docker run --rm \
+            --volume "$RUNNER_TEMP/openstatspec-dolt:/var/lib/dolt" \
+            --workdir /var/lib/dolt \
+            "$OPENSTATSPEC_DOLT_IMAGE" sql \
+            -q "CREATE USER 'openstatspec_test_admin'@'%' IDENTIFIED BY 'ci-admin'; GRANT ALL PRIVILEGES ON *.* TO 'openstatspec_test_admin'@'%' WITH GRANT OPTION"
           docker run --detach --name openstatspec-dolt \
             --publish 127.0.0.1:13308:3306 \
             --volume "$RUNNER_TEMP/openstatspec-dolt:/var/lib/dolt" \
@@ -218,6 +224,7 @@ jobs:
                   break
           PY
       - run: python -m pytest -m "services and not candidate_evidence"
+      - run: python -m pytest tests/test_read_only_export.py
       - name: Show Dolt logs on failure and stop server
         if: always()
         run: |

{openstatspec-0.7.0 → openstatspec-0.8.0}/.github/workflows/release.yml

@@ -48,7 +48,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: OpenStatSpec/specification
-          ref: f2fdf687d8cb32b944ca55a3e9e7215ffc603019
+          ref: 864e84479f554b8ee250ffed44c4dfb963750d4a
           path: openstatspec-specification
       - name: Checkout specification package source
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -159,9 +159,9 @@ jobs:
       - run: python -m pip install -e ".[dev]"
       - run: python -m pytest -m "not services"
       - run: python -m venv /tmp/openstatspec-release-smoke
-      - run: /tmp/openstatspec-release-smoke/bin/python -m pip install ./openstatspec-pyspssio
       - run: /tmp/openstatspec-release-smoke/bin/python -m pip install dist/openstatspec/openstatspec-*.whl
-      - run: /tmp/openstatspec-release-smoke/bin/openstatspec capabilities
+      - run: env -u PYTHONPATH /tmp/openstatspec-release-smoke/bin/openstatspec capabilities
+        working-directory: /tmp
       - name: Smoke-test specification wheel
         run: |
           python -m venv /tmp/openstatspec-specification-release-smoke

{openstatspec-0.7.0 → openstatspec-0.8.0}/CHANGELOG.md

@@ -6,6 +6,38 @@ All notable changes to this reference implementation are documented here.
 
 _No unreleased changes._
 
+## 0.8.0 - 2026-09-07
+
+### Changed
+
+- Pin released specification `v0.5.0` at exact commit
+  `864e84479f554b8ee250ffed44c4dfb963750d4a`, with normative status `released`.
+  Capabilities identify adapter version 0.8.0 and explicitly select SAV/ZSAV 1.0
+  with `database_io_policy=openstatspec-database-io-v1`.
+- Reads, inspection, validation, and SAV/ZSAV export no longer write database
+  operation/fidelity audit records, including on failure. Export diagnostics
+  and loss consent remain operation-scoped; export results omit `operation_id`.
+- Default Dolt writes use the packaged tested exact-version policy for 2.2.2
+  and 2.2.3 without user-supplied evidence files. Unknown/untested versions
+  remain blocked before mutation; explicit external overrides remain strict.
+  Safety budgets are not claimed as proven native server limits.
+- Dolt reads no longer require write-version declarations or the write
+  variable-count ceiling. Missing SQLite files are rejected without creation.
+- Exact Dolt 2.2.2/2.2.3 CI explicitly runs SELECT-only export success/failure
+  tests using a separate fixture-admin account; normal service permissions
+  and adapter permissions are unchanged. Wheel smoke installs resolve the
+  required engine from PyPI rather than a source checkout.
+
+No optional Transformation Workflow 0.3 implementation is claimed.
+
+## 0.7.1 - 2026-08-12
+
+### Changed
+
+- Pinned capability declarations, conformance fixtures, and release validation
+  to the published OpenStatSpec specification `v0.3.0` at exact commit
+  `cd8f198c68b849eb8ed018a894670a0904c2181d`.
+
 ## 0.7.0 - 2026-08-11
 
 ### Added

{openstatspec-0.7.0 → openstatspec-0.8.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: openstatspec
-Version: 0.7.0
+Version: 0.8.0
 Summary: Reference adapter for the OpenStatSpec relational contract
 Author: OpenStatSpec
 License: Apache-2.0
@@ -23,6 +23,10 @@ The reference Python implementation of the OpenStatSpec specification.
 
 This package implements the specification; it does not define or extend it.
 The normative model lives in the `OpenStatSpec/specification` repository.
+Python 0.8.0 pins released specification `v0.5.0` at
+`864e84479f554b8ee250ffed44c4dfb963750d4a` and selects SAV/ZSAV 1.0 with
+`database_io_policy=openstatspec-database-io-v1`. This does not claim
+implementation of the optional Transformation Workflow 0.3 profile.
 
 ## Boundaries
 
@@ -115,17 +119,19 @@ SAV/ZSAV export for the semantics exposed by that engine. SQLite is the local
 reference path.
 PostgreSQL, MySQL, MariaDB, and Dolt are each covered by separate service-backed CI
 conformance checks. Dolt support is an independent core profile for the
-canonical stable range `>=2.2.2,<2.3.0`; earlier patches, other families,
-noncanonical versions, and unknown MySQL-wire products fail closed.
+exact write-supported versions 2.2.2 and 2.2.3; all other versions (including
+2.3.0), noncanonical versions, and unknown MySQL-wire products fail closed for writes.
 
 The supported family claims are broader than the deliberately exact CI
 evidence points: PostgreSQL 17.x/18.x is exercised at 17.10/18.4, MySQL
 8.4.x/9.7.x at 8.4.11/9.7.2, and MariaDB 11.4.x/11.8.x/12.3.x at
 11.4.12/11.8.8/12.3.2. Each service job checks the normalized live server
 version against its exact matrix entry before that run can count as evidence.
-Dolt claims the conservative 2.2.x range `>=2.2.2,<2.3.0`; its full service
-suite is exercised independently at exact versions 2.2.2 and 2.2.3 using
-immutable container-image digests.
+Dolt's default-write service checks run independently at exact versions 2.2.2
+and 2.2.3 using immutable container-image digests. Release/CI owns this evidence;
+normal callers need no declaration or evidence files. The optional explicit
+`DoltConformanceSource` override remains strict and does not fall back to the
+default policy if its declarations are missing, invalid, or mismatched.
 
 | Engine/profile | Runtime supported policy | Exact CI-tested versions |
 | --- | --- | --- |
@@ -133,7 +139,7 @@ immutable container-image digests.
 | PostgreSQL | 17.x and 18.x | 17.10 and 18.4 |
 | MySQL | 8.4.x and 9.7.x | 8.4.11 and 9.7.2 |
 | MariaDB | 11.4.x, 11.8.x, and 12.3.x | 11.4.12, 11.8.8, and 12.3.2 |
-| Dolt | 2.2.x with `>=2.2.2,<2.3.0` | 2.2.2 and 2.2.3 |
+| Dolt writes | Exactly 2.2.2 and 2.2.3 | 2.2.2 and 2.2.3 |
 
 Microsoft SQL Server (MSSQL) remains roadmap-only and is not a supported
 runtime profile; see the specification's [MSSQL roadmap](https://github.com/OpenStatSpec/specification/blob/main/docs/mssql-dialect-roadmap.md).
@@ -143,7 +149,7 @@ Use these explicit SQLAlchemy URLs:
 - SQLite: `sqlite:///dataset.sqlite`
 - PostgreSQL: `postgresql+psycopg://user:password@host/database`
 - MySQL/MariaDB: `mysql+pymysql://user:password@host/database`
-- Dolt `>=2.2.2,<2.3.0`: `mysql+pymysql://user:password@host/database` (detected by server identity)
+- Dolt 2.2.2 or 2.2.3: `mysql+pymysql://user:password@host/database` (detected by server identity)
 
 The Dolt core profile supports strict wide-table import, validation, and export;
 the separate Transformation Workflow is unsupported.
@@ -151,8 +157,16 @@ the separate Transformation Workflow is unsupported.
 Run `openstatspec capabilities` before an integration to inspect the
 machine-readable feature matrix. Export is deliberately strict: if known
 dictionary semantics cannot be reproduced, it stops until you pass the exact
-diagnostic code with `--allow-loss`. This avoids silent loss while making an
-intentional lossy export auditable.
+diagnostic code with `--allow-loss`. Diagnostics are returned to the caller, not
+persisted. Reads, validation, and SAV/ZSAV export never write to the database,
+including on failure. Export returns no `operation_id` and needs only read
+permissions; Dolt reads have no write-version or write-variable-count gate.
+Read operations reject missing SQLite files without creating them. Imports and transformations
+use the packaged exact-version policy by default. Active driver/identity checks,
+limit preflight, and the clean expected branch/HEAD guard for in-place apply
+remain mandatory. Dolt's reported limits are adapter safety budgets, narrowed
+by the active packet limit, not proven native server ceilings; full boundary
+conformance is not claimed.
 
 The matrix is also available to Python callers as
 `openstatspec.capability_matrix()`. It distinguishes supported semantics from

{openstatspec-0.7.0 → openstatspec-0.8.0}/README.md

@@ -4,6 +4,10 @@ The reference Python implementation of the OpenStatSpec specification.
 
 This package implements the specification; it does not define or extend it.
 The normative model lives in the `OpenStatSpec/specification` repository.
+Python 0.8.0 pins released specification `v0.5.0` at
+`864e84479f554b8ee250ffed44c4dfb963750d4a` and selects SAV/ZSAV 1.0 with
+`database_io_policy=openstatspec-database-io-v1`. This does not claim
+implementation of the optional Transformation Workflow 0.3 profile.
 
 ## Boundaries
 
@@ -96,17 +100,19 @@ SAV/ZSAV export for the semantics exposed by that engine. SQLite is the local
 reference path.
 PostgreSQL, MySQL, MariaDB, and Dolt are each covered by separate service-backed CI
 conformance checks. Dolt support is an independent core profile for the
-canonical stable range `>=2.2.2,<2.3.0`; earlier patches, other families,
-noncanonical versions, and unknown MySQL-wire products fail closed.
+exact write-supported versions 2.2.2 and 2.2.3; all other versions (including
+2.3.0), noncanonical versions, and unknown MySQL-wire products fail closed for writes.
 
 The supported family claims are broader than the deliberately exact CI
 evidence points: PostgreSQL 17.x/18.x is exercised at 17.10/18.4, MySQL
 8.4.x/9.7.x at 8.4.11/9.7.2, and MariaDB 11.4.x/11.8.x/12.3.x at
 11.4.12/11.8.8/12.3.2. Each service job checks the normalized live server
 version against its exact matrix entry before that run can count as evidence.
-Dolt claims the conservative 2.2.x range `>=2.2.2,<2.3.0`; its full service
-suite is exercised independently at exact versions 2.2.2 and 2.2.3 using
-immutable container-image digests.
+Dolt's default-write service checks run independently at exact versions 2.2.2
+and 2.2.3 using immutable container-image digests. Release/CI owns this evidence;
+normal callers need no declaration or evidence files. The optional explicit
+`DoltConformanceSource` override remains strict and does not fall back to the
+default policy if its declarations are missing, invalid, or mismatched.
 
 | Engine/profile | Runtime supported policy | Exact CI-tested versions |
 | --- | --- | --- |
@@ -114,7 +120,7 @@ immutable container-image digests.
 | PostgreSQL | 17.x and 18.x | 17.10 and 18.4 |
 | MySQL | 8.4.x and 9.7.x | 8.4.11 and 9.7.2 |
 | MariaDB | 11.4.x, 11.8.x, and 12.3.x | 11.4.12, 11.8.8, and 12.3.2 |
-| Dolt | 2.2.x with `>=2.2.2,<2.3.0` | 2.2.2 and 2.2.3 |
+| Dolt writes | Exactly 2.2.2 and 2.2.3 | 2.2.2 and 2.2.3 |
 
 Microsoft SQL Server (MSSQL) remains roadmap-only and is not a supported
 runtime profile; see the specification's [MSSQL roadmap](https://github.com/OpenStatSpec/specification/blob/main/docs/mssql-dialect-roadmap.md).
@@ -124,7 +130,7 @@ Use these explicit SQLAlchemy URLs:
 - SQLite: `sqlite:///dataset.sqlite`
 - PostgreSQL: `postgresql+psycopg://user:password@host/database`
 - MySQL/MariaDB: `mysql+pymysql://user:password@host/database`
-- Dolt `>=2.2.2,<2.3.0`: `mysql+pymysql://user:password@host/database` (detected by server identity)
+- Dolt 2.2.2 or 2.2.3: `mysql+pymysql://user:password@host/database` (detected by server identity)
 
 The Dolt core profile supports strict wide-table import, validation, and export;
 the separate Transformation Workflow is unsupported.
@@ -132,8 +138,16 @@ the separate Transformation Workflow is unsupported.
 Run `openstatspec capabilities` before an integration to inspect the
 machine-readable feature matrix. Export is deliberately strict: if known
 dictionary semantics cannot be reproduced, it stops until you pass the exact
-diagnostic code with `--allow-loss`. This avoids silent loss while making an
-intentional lossy export auditable.
+diagnostic code with `--allow-loss`. Diagnostics are returned to the caller, not
+persisted. Reads, validation, and SAV/ZSAV export never write to the database,
+including on failure. Export returns no `operation_id` and needs only read
+permissions; Dolt reads have no write-version or write-variable-count gate.
+Read operations reject missing SQLite files without creating them. Imports and transformations
+use the packaged exact-version policy by default. Active driver/identity checks,
+limit preflight, and the clean expected branch/HEAD guard for in-place apply
+remain mandatory. Dolt's reported limits are adapter safety budgets, narrowed
+by the active packet limit, not proven native server ceilings; full boundary
+conformance is not claimed.
 
 The matrix is also available to Python callers as
 `openstatspec.capability_matrix()`. It distinguishes supported semantics from

{openstatspec-0.7.0 → openstatspec-0.8.0}/docs/release-readiness.md

@@ -1,8 +1,15 @@
-# 0.7.0 release readiness
+# 0.8.0 release readiness
 
 This page records the expected release contract, not a publication event.
 Creating a version tag remains a separate maintainer action.
 
+The release selects SAV/ZSAV 1.0 with the optional Database I/O Execution
+Policy `openstatspec-database-io-v1`. Reads and exports, including failures,
+write no database audit records; export results omit `operation_id` and return
+diagnostics to the caller. Reads must not create missing SQLite files or apply
+Dolt write-variable-count ceilings. This release does not claim implementation
+of the optional Transformation Workflow 0.3 profile.
+
 ## Supported workflow
 
 For a supported unencrypted SAV or ZSAV source, the adapter imports one source
@@ -20,15 +27,17 @@ database contract.
 | PostgreSQL | `postgresql+psycopg://…` | 17.x and 18.x | 17.10 and 18.4 |
 | MySQL | `mysql+pymysql://…` | 8.4.x and 9.7.x | 8.4.11 and 9.7.2 |
 | MariaDB | `mysql+pymysql://…` | 11.4.x, 11.8.x, and 12.3.x | 11.4.12, 11.8.8, and 12.3.2 |
-| Dolt | `mysql+pymysql://…` | 2.2.x with `>=2.2.2,<2.3.0` | 2.2.2 and 2.2.3 |
+| Dolt writes | `mysql+pymysql://…` | Exactly 2.2.2 and 2.2.3 | 2.2.2 and 2.2.3 |
 
 Separate service matrices test the shared MySQL/MariaDB profile contract while
 retaining distinct active-server identities and version claims. Dolt is an
-independent core profile that accepts only canonical stable versions in
-`>=2.2.2,<2.3.0`; the optional Transformation Workflow remains SQLite-only. This does not
-claim coverage for every server configuration. The machine-readable capability
-declaration reports both the theoretical profile boundaries and effective
-limits observed from the active connection.
+independent core profile with a packaged exact-version write policy; normal
+callers supply no conformance files. An explicit external declaration source
+remains a strict override. Read-only validation/export has no write-version gate.
+The optional Transformation Workflow remains SQLite-only. This does not claim
+coverage for every server configuration or proven Dolt native limit ceilings.
+Dolt capabilities report adapter safety budgets and active packet constraints;
+full boundary conformance remains pending.
 Every server service job compares the normalized live product version with its
 exact matrix entry, so a moved or mismatched image cannot substantiate the CI
 declaration. SQLite's optional Transformation Workflow retains its narrower
@@ -102,6 +111,51 @@ implemented openstatspec.frontends.spss package. Stata and SAS remain empty
 source-tree placeholders and must expose no compiler, apply API, CLI choice,
 capability claim, or implied support.
 
+## Prior default Dolt write verification (before the 0.8.0 pin)
+
+Local release verification used the exact 2.2.2 and 2.2.3 image digests in
+`.github/workflows/ci.yml`, isolated ports 13482/13483, and disposable `/tmp`
+database directories. With `PYTHONPATH=src:../pyspssio`,
+`OPENSTATSPEC_SPECIFICATION_DIR=/tmp/oss-php-spec-cd8f198`, and each matching
+`OPENSTATSPEC_DOLT_URL` / `OPENSTATSPEC_EXPECTED_DOLT_VERSION`:
+
+- `../python/.venv/bin/python -m pytest`: **366 passed, 49 skipped per pin**.
+- CI selection `-m 'services and not candidate_evidence'`: **7 passed,
+  41 skipped per pin**; other database services were not configured locally.
+- Dolt 2.3.0 on port 13387: read-only export and unknown-version write rejection
+  checks passed (**19 passed**) using disposable fixture databases/users.
+- `python -m compileall -q src tests` and `git diff --check` passed.
+
+Live failures exposed and now cover two previously dormant write blockers:
+owned table additions being misclassified as unrelated diffs, and Dolt retaining
+`@@autocommit=1` despite the driver's setting. Writes now explicitly begin their
+transaction. The candidate storage/identifier/column smoke probe also passed on
+both pins; it does **not** establish full value/row/statement limit conformance.
+
+## 0.8.0 local verification
+
+Using `../python/.venv/bin/python`, `PYTHONPATH=src:../pyspssio`, and
+`OPENSTATSPEC_SPECIFICATION_DIR=/tmp/oss-python-spec-v050-5dSTna` (an archive
+of exact `864e84479f554b8ee250ffed44c4dfb963750d4a`):
+
+- `python -m pytest -ra`: **381 passed, 49 skipped**, with
+  `OPENSTATSPEC_TEST_DOLT_ADMIN_URL=mysql+pymysql://root@127.0.0.1:13387/`
+  exercising live Dolt 2.3.0 through disposable SELECT-only users.
+- Both immutable CI images, exact Dolt 2.2.2/2.2.3, bootstrapped with the
+  unchanged service user and separate global fixture admin on ports 13582/13583:
+  `python -m pytest -m 'services and not candidate_evidence'`: **7 passed,
+  41 skipped, 382 deselected per pin**; explicit
+  `python -m pytest tests/test_read_only_export.py`: **33 passed per pin**.
+- `python -m compileall -q src tests`, `git diff --check`, wheel/sdist build,
+  and `python -m twine check /tmp/oss-python-v080-dist/*` passed.
+- A clean wheel install resolved the required engine from PyPI. Isolated
+  imports came only from the smoke environment's `site-packages`; installed
+  capabilities reported adapter 0.8.0, the selected policy, released v0.5.0
+  provenance, and exactly 2.2.2/2.2.3 for default Dolt writes.
+
+Other database services were not configured locally. This is local evidence,
+not a claim that the updated remote CI or release publication has completed.
+
 ## Maintainer checks before tagging
 
 1. Publish the pinned `openstatspec-pyspssio==0.5.1.post2` engine distribution
@@ -110,16 +164,28 @@ capability claim, or implied support.
 2. Run `python -m pytest -m "not services"`.
 3. Confirm the GitHub Actions matrix is green for exact PostgreSQL 17.10/18.4,
    MySQL 8.4.11/9.7.2, MariaDB 11.4.12/11.8.8/12.3.2, and exact Dolt
-   2.2.2/2.2.3 service evidence from the immutable image pins in CI.
+   2.2.2/2.2.3 service evidence from the immutable image pins in CI. The Dolt
+   jobs must perform default import/validate/SAV+ZSAV export, in-place recode
+   and labels with unchanged dataset/table counts and HEAD, injected data,
+   catalog, and audit rollback checks, and failed-import cleanup. Release/CI
+   owns this evidence, not per-user runtime declaration files. Candidate limit
+   probes remain non-claiming and separate from these write gates.
+   Each Dolt job must also run `python -m pytest tests/test_read_only_export.py`
+   explicitly, outside the `services` marker filter. Bootstrap a separate
+   `openstatspec_test_admin` on the isolated CI server with global database/user
+   creation and grant privileges, and set `OPENSTATSPEC_TEST_DOLT_ADMIN_URL`.
+   The fixture creates its own database and SELECT-only reader and removes
+   both afterward; the normal service user remains unchanged.
 4. Build with `python -m build` and install the generated wheel in a clean
-   environment.
+   environment, resolving `openstatspec-pyspssio==0.5.1.post2` from PyPI.
+   Run the installed CLI outside the source checkout with `PYTHONPATH` unset;
+   verify adapter version `0.8.0` and the selected database I/O policy.
 5. Confirm `openstatspec capabilities` reflects the intended support boundary.
-6. Confirm CI, release fixtures, and capabilities use the untagged OpenStatSpec
-   specification release candidate at exact commit
-   `f2fdf687d8cb32b944ca55a3e9e7215ffc603019`, publish
-   `specification_status=release_candidate`, and leave
-   `specification_release` null. If that exact commit receives a stable tag
-   before this package is tagged, update the identity and re-run every gate.
+6. Confirm CI, release fixtures, and capabilities use the published OpenStatSpec
+   specification `v0.5.0` at exact commit
+   `864e84479f554b8ee250ffed44c4dfb963750d4a`, publish
+   `specification_status=released`, and set `specification_release` to `v0.5.0`.
+   Use an exact checkout via `OPENSTATSPEC_SPECIFICATION_DIR` for local tests.
 7. Review this document, the README, and CHANGELOG for accurate scope.
 
 The tag-triggered release workflow repeats the non-service test suite, builds

{openstatspec-0.7.0 → openstatspec-0.8.0}/docs/sav-profile.md

@@ -49,7 +49,7 @@ equivalence of supported values, order, and dictionary metadata.
 
 The `openstatspec capabilities` command and the
 `openstatspec.capability_matrix()` function are the machine-readable declaration
-of this boundary. It records the pinned source commit and installed engine version, and the adapter stores the same identity in every import and export operation record. The matrix deliberately distinguishes a supported feature from a feature that the underlying engine cannot observe or write faithfully.
+of this boundary. It records the pinned source commit and installed engine version, and the adapter stores the same identity in import operation records. Export is database-read-only: no operation, fidelity, recovery, or Dolt-history records are written, even on failure. Loss diagnostics are returned to the caller. Dolt export identifies the server and validates the catalog and data without requiring write-conformance declarations; write entry points retain that requirement. The matrix deliberately distinguishes a supported feature from a feature that the underlying engine cannot observe or write faithfully.
 
 | SPSS semantic | Pinned pyspssio status | Behaviour |
 | --- | --- | --- |

openstatspec-0.8.0/docs/superpowers/plans/2026-08-12-python-v071-stable-pin.md

@@ -0,0 +1,158 @@
+# Python 0.7.1 Stable Specification Pin Implementation Plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Release Python adapter `0.7.1` with stable, exact provenance for specification `v0.3.0`.
+
+**Architecture:** Keep the provenance values centralized in `src/openstatspec/sql/capabilities.py`; tests and capability declarations consume those values. CI and release-readiness documentation pin the same immutable specification commit, while the package version changes only in packaging metadata.
+
+**Tech Stack:** Python 3.11–3.14, pytest, GitHub Actions, `python -m build`, Twine, PyPI Trusted Publishing.
+
+## Global Constraints
+
+- Specification commit: `cd8f198c68b849eb8ed018a894670a0904c2181d`.
+- Specification status: `stable`.
+- Specification release: `v0.3.0`.
+- Package version: `0.7.1`.
+- Keep the SPSS engine pin, companion package pin, SQL profile matrix, and runtime behavior unchanged.
+- Do not publish or change the normative specification package in this task.
+
+---
+
+### Task 1: Update provenance contract tests first
+
+**Files:**
+- Modify: `tests/test_cli.py:44-48`
+- Modify: `tests/test_sql_profiles.py:32-40`
+
+**Interfaces:**
+- Consumes: public `openstatspec.capability_matrix()` and SQL profile declarations.
+- Produces: executable expectations for stable `v0.3.0` provenance.
+
+- [ ] **Step 1: Change the assertions to the stable identity**
+
+Replace the candidate expectations with:
+
+```python
+assert matrix["specification_status"] == "stable"
+assert matrix["specification_release"] == "v0.3.0"
+assert matrix["specification_commit"] == "cd8f198c68b849eb8ed018a894670a0904c2181d"
+```
+
+Apply the same three values to each profile declaration assertion.
+
+- [ ] **Step 2: Run the focused tests and confirm the expected red state**
+
+Run:
+
+```bash
+python -m pytest -q tests/test_cli.py::test_capability_matrix_is_public_and_cli_matches_engine_boundary tests/test_sql_profiles.py::test_profile_declarations_publish_stable_specification_provenance
+```
+
+Expected: both tests fail because production constants still expose the old release-candidate identity.
+
+- [ ] **Step 3: Commit the failing-test update**
+
+```bash
+git add tests/test_cli.py tests/test_sql_profiles.py
+git commit -m "test: expect stable specification v0.3.0"
+```
+
+### Task 2: Bind production provenance and release metadata
+
+**Files:**
+- Modify: `src/openstatspec/sql/capabilities.py:20-23`
+- Modify: `pyproject.toml:7`
+- Modify: `.github/workflows/ci.yml:23`
+- Modify: `.github/workflows/release.yml:51`
+- Modify: `docs/release-readiness.md:1,116-123`
+- Modify: `CHANGELOG.md` after the `Unreleased` section
+
+**Interfaces:**
+- Consumes: the exact specification commit from the published `v0.3.0` tag.
+- Produces: capability output and release automation identifying `stable`, `v0.3.0`, and `cd8f198c...`.
+
+- [ ] **Step 1: Update the centralized capability constants**
+
+Set the declarations to:
+
+```python
+SPECIFICATION_COMMIT = "cd8f198c68b849eb8ed018a894670a0904c2181d"
+SPECIFICATION_STATUS = "stable"
+SPECIFICATION_RELEASE: str | None = "v0.3.0"
+```
+
+- [ ] **Step 2: Bump the package and CI fixture pin**
+
+Set `project.version` in `pyproject.toml` to `0.7.1`. Replace the old specification checkout ref in both workflows with the exact commit `cd8f198c68b849eb8ed018a894670a0904c2181d`; leave the companion package ref unchanged.
+
+- [ ] **Step 3: Update release documentation and changelog**
+
+Rename the readiness heading to `0.7.1 release readiness`, change its specification checklist to the stable commit/release identity, and add a dated `0.7.1` entry explaining that the adapter now pins published specification `v0.3.0`.
+
+- [ ] **Step 4: Run focused tests and confirm green**
+
+Run the focused command from Task 1. Expected: both tests pass.
+
+- [ ] **Step 5: Commit the implementation and metadata**
+
+```bash
+git add src/openstatspec/sql/capabilities.py pyproject.toml .github/workflows/ci.yml .github/workflows/release.yml docs/release-readiness.md CHANGELOG.md
+git commit -m "release: pin Python adapter to specification v0.3.0"
+```
+
+### Task 3: Verify the complete Python release candidate
+
+**Files:**
+- Verify: all tracked files in the Python repository.
+
+- [ ] **Step 1: Check the diff and stale current references**
+
+Run:
+
+```bash
+git diff --check
+rg -n 'f2fdf687d8cb32b944ca55a3e9e7215ffc603019|specification_status.*release_candidate|specification_release.*None|version = "0\.7\.0"' src tests .github docs pyproject.toml
+```
+
+Expected: no stale current references; historical changelog entries may retain their original release evidence.
+
+- [ ] **Step 2: Run the non-service test suite**
+
+```bash
+python -m pytest -m "not services"
+```
+
+Expected: zero failures.
+
+- [ ] **Step 3: Build and smoke-test the package**
+
+```bash
+rm -rf /tmp/openstatspec-v071-dist /tmp/openstatspec-v071-smoke
+python -m build --outdir /tmp/openstatspec-v071-dist
+python -m twine check /tmp/openstatspec-v071-dist/*
+python -m venv /tmp/openstatspec-v071-smoke
+/tmp/openstatspec-v071-smoke/bin/python -m pip install ./openstatspec-pyspssio
+/tmp/openstatspec-v071-smoke/bin/python -m pip install /tmp/openstatspec-v071-dist/openstatspec-0.7.1-*.whl
+/tmp/openstatspec-v071-smoke/bin/openstatspec capabilities
+```
+
+Expected: build and Twine checks pass, and capabilities reports `stable`, `v0.3.0`, and the exact commit.
+
+### Task 4: Review, publish, and release
+
+- [ ] **Step 1: Run the local review loop and fix every actionable finding**
+
+Review the complete branch diff against `origin/main`; repeat the tests after each fix until no actionable findings remain.
+
+- [ ] **Step 2: Push the branch and open a draft PR**
+
+Push `agent/stable-spec-v071` to `OpenStatSpec/python`, open a PR targeting `main`, mark it ready for review, and add `@codex review`.
+
+- [ ] **Step 3: Iterate on GitHub review and CI**
+
+Inspect every Codex review finding and failing check, fix actionable issues locally, push, and repeat until the review and required checks are clean.
+
+- [ ] **Step 4: After merge, create and push annotated tag `v0.7.1`**
+
+Verify the tag targets the merge commit and wait for tag-context CI to pass before relying on the existing PyPI workflow.

openstatspec-0.8.0/docs/superpowers/specs/2026-08-12-python-stable-specification-pin-design.md

@@ -0,0 +1,35 @@
+# Python 0.7.1 stable specification pin
+
+## Goal
+
+Publish the Python adapter's first patch release after Python adapter `v0.7.0`
+with its capability declarations and conformance fixtures bound to the
+published OpenStatSpec specification `v0.3.0`.
+
+## Scope
+
+- Bump the Python distribution from `0.7.0` to `0.7.1`.
+- Replace the release-candidate specification identity with:
+  - commit `cd8f198c68b849eb8ed018a894670a0904c2181d`;
+  - status `stable`;
+  - release `v0.3.0`.
+- Update unit expectations, CI fixture checkouts, release-readiness guidance,
+  and the changelog so every release surface carries the same identity.
+- Keep the required SPSS engine pin, specification companion package pin,
+  database version matrix, and runtime behavior unchanged.
+- Separately update the specification repository roadmap to mark the completed
+  `v0.3.0` release gates and current public release.
+
+## Release and verification
+
+The Python change is reviewed through a pull request. Before tagging `v0.7.1`,
+run the non-service suite, package build and wheel smoke test, and the full
+GitHub CI matrix. The annotated `v0.7.1` tag must target the merged release
+commit; its tag-context workflow must pass before the existing trusted-PyPI
+workflow publishes the package artifacts.
+
+## Non-goals
+
+This work does not add transformation behavior, change SQL dialect support,
+modify the normative specification, or publish a new specification package
+version.

openstatspec-0.8.0/openstatspec-specification/.github/workflows/ci.yml

@@ -0,0 +1,24 @@
+name: CI
+
+on:
+  push:
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  specification:
+    runs-on: ubuntu-latest
+    steps:
+      # v7.0.1: https://github.com/actions/checkout/commit/3d3c42e5aac5ba805825da76410c181273ba90b1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        with:
+          persist-credentials: false
+      # v7.0.0: https://github.com/actions/setup-python/commit/5fda3b95a4ea91299a34e894583c3862153e4b97
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
+        with:
+          python-version: "3.13"
+      - run: python -m pip install --disable-pip-version-check -e ".[dev]"
+      - run: python -m pytest
+      - run: python tools/validate_repository.py