sdr-visualizer 1.2.7__tar.gz → 1.2.9__tar.gz

{sdr_visualizer-1.2.7 → sdr_visualizer-1.2.9}/CHANGELOG.md

@@ -4,6 +4,95 @@ All notable changes to `sdr-visualizer` will be documented here. The format foll
 
 ## [Unreleased]
 
+## [1.2.9] - 2026-11-12
+
+### Changed
+
+- State in the README and on the project site that sdr-visualizer is not
+  affiliated with Adobe, and add a trademark notice.
+- Replace the README's "public preview" label with a plain "Scope and limits"
+  section, and mark the package as production/stable on PyPI. The 1.x semantic
+  versioning promise is unchanged.
+- Remove the 1.1.2 adapter review record from `docs/`. Its evidence stays in
+  pull request #41.
+- Leave the maintainer-only Dependabot and release evidence documents out of
+  the source distribution.
+- Maintainer tooling only: add a version-sync check and README badge, warm up
+  the browser before the first timed report in the performance gate, and
+  update the pytest and hypothesis development dependencies.
+
+## [1.2.8] - 2026-10-31
+
+### Fixed
+
+- Treat a number too large to convert, such as a 400-digit
+  `complexity_score` or an infinite segment `nesting_depth`, as invalid input
+  (exit 3) instead of an unexpected error (exit 1). `--trend` skips such a
+  snapshot with a warning instead of stopping.
+- Treat an `--at` value that its UTC offset pushes outside the supported date
+  range, and standard input that is not UTF-8, as invalid input (exit 3)
+  instead of an unexpected error. The stdin change matches sdr-grader.
+- Skip a `*.json` entry whose file metadata cannot be read, such as a broken
+  symlink, when a directory is ordered by modification time. It no longer
+  stops the run, and it is still protected from being overwritten by an output.
+- Stop error messages from repeating snapshot content. A record without an ID
+  is now reported by its list and position, such as `CJA metrics[3]`, instead
+  of by printing the whole record. Number errors name the value's type, not
+  the value. A failed live run reports the generator's exit status but no
+  longer prints its error output. These match sdr-grader.
+- Leave out an AA calculated metric's `attribution` or `allocation` when it is
+  not a string, so the embedded payload and `--json` sidecar match
+  `docs/payload-schema.json`.
+- Reject an HTML and `--json` destination pair whose names differ only in
+  letter case or Unicode normalization, in the same directory. On a
+  case-insensitive filesystem, such as the macOS default, the JSON used to
+  replace the report. A Workspace usage output or config path that reaches a
+  snapshot directory through a different letter case is now also rejected.
+- Print "Workspace artifact writing interrupted" when Ctrl-C stops usage file
+  writing; the message was empty.
+- Drop null, number, boolean and empty-string values from a component's tags
+  instead of turning them into tags such as `"None"` or `"7"`. Tag objects
+  still contribute their `name`, or else their `id`. This matches sdr-grader.
+- Reject a definition, tag list or reference list whose embedded JSON repeats
+  a key within one object, as invalid input (exit 3), instead of keeping the
+  last value. Snapshot files already reject this. This matches sdr-grader.
+- Report a snapshot directory that cannot be read as an input error. Before,
+  it looked like an empty directory. This matches sdr-grader.
+- Decode standard input as UTF-8 whatever the terminal's locale encoding is.
+  This matches sdr-grader.
+- Reject an empty `--dataview` or `--rsid` ID, or one that starts with `-`,
+  before running the generator (exit 3). The generator would read such a value
+  as an option. This matches sdr-grader.
+- Detect an AA snapshot from the same `report_suite` key the AA adapter reads.
+  This matches sdr-grader.
+- Treat a NaN or infinite component, derived field, calculated metric or
+  segment name, a component type, or an AA report suite name as missing,
+  instead of showing "nan". Spreadsheet-based exports write NaN for an empty
+  cell. This matches sdr-grader.
+- `cja-lineage` now checks that the output's parent directory exists before
+  reading discovery input, and exits 3 as LINEAGE.md documents. It used to
+  exit 1 after discovery had already run.
+
+### Changed
+
+- Advance the AA tested-through generator marker to `aa_auto_sdr` 1.24.6.
+  Snapshots that declare that version no longer print a newer-than-tested
+  warning. The CJA marker stays at `cja_auto_sdr` 3.13.6, the current release.
+- Build reports faster. The check for invalid Unicode in snapshot text now
+  uses the same compiled pattern as sdr-grader. Median build time is 39% to
+  46% lower across the synthetic performance tiers. Output is byte-identical.
+- Maintainer tooling only: Dependabot auto-merge now also covers `pytest-xdist`
+  patch updates and `hypothesis` minor and patch updates. Every automatically
+  merged release must be at least 3 days old on PyPI, and Dependabot waits 3
+  days before opening `uv` update PRs.
+- Maintainer tooling only: `uv.lock` now uses lockfile revision 5, which is the
+  format Dependabot writes, so Dependabot lockfile PRs no longer fail the
+  policy's settings check. No package versions changed.
+- Maintainer tooling only: make tests independent of pytest 9.2.0 internals
+  and of machine load. One test no longer fakes `os.fstat` for the whole
+  process, two collection tests no longer depend on interpreter startup time,
+  and browser tests wait for results instead of sleeping.
+
 ## [1.2.7] - 2026-10-30
 
 ### Changed
@@ -815,7 +904,9 @@ The following are explicitly internal and may change without notice:
 - Workspace project visualization (v0.4)
 - Schema map view (v0.5)
 
-[Unreleased]: https://github.com/brian-a-au/sdr-visualizer/compare/v1.2.7...HEAD
+[Unreleased]: https://github.com/brian-a-au/sdr-visualizer/compare/v1.2.9...HEAD
+[1.2.9]: https://github.com/brian-a-au/sdr-visualizer/releases/tag/v1.2.9
+[1.2.8]: https://github.com/brian-a-au/sdr-visualizer/releases/tag/v1.2.8
 [1.2.7]: https://github.com/brian-a-au/sdr-visualizer/releases/tag/v1.2.7
 [1.2.6]: https://github.com/brian-a-au/sdr-visualizer/releases/tag/v1.2.6
 [1.2.5]: https://github.com/brian-a-au/sdr-visualizer/releases/tag/v1.2.5

{sdr_visualizer-1.2.7 → sdr_visualizer-1.2.9}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: sdr-visualizer
-Version: 1.2.7
+Version: 1.2.9
 Summary: Static-output visual catalog generator for Adobe Customer Journey Analytics and Adobe Analytics implementations.
 Project-URL: Homepage, https://brian-a-au.github.io/sdr-visualizer/
 Project-URL: Documentation, https://github.com/brian-a-au/sdr-visualizer#documentation
@@ -11,6 +11,7 @@ Author: Brian Au
 License-Expression: MIT
 License-File: LICENSE
 License-File: THIRD_PARTY_LICENSES
+Classifier: Development Status :: 5 - Production/Stable
 Classifier: Environment :: Console
 Classifier: Intended Audience :: Developers
 Classifier: Programming Language :: Python :: 3
@@ -35,6 +36,7 @@ Description-Content-Type: text/markdown
 [![PyPI](https://img.shields.io/pypi/v/sdr-visualizer)](https://pypi.org/project/sdr-visualizer/)
 [![Tests](https://github.com/brian-a-au/sdr-visualizer/actions/workflows/test.yml/badge.svg)](https://github.com/brian-a-au/sdr-visualizer/actions/workflows/test.yml)
 [![Lint](https://github.com/brian-a-au/sdr-visualizer/actions/workflows/lint.yml/badge.svg)](https://github.com/brian-a-au/sdr-visualizer/actions/workflows/lint.yml)
+[![Version Sync](https://github.com/brian-a-au/sdr-visualizer/actions/workflows/version-sync.yml/badge.svg)](https://github.com/brian-a-au/sdr-visualizer/actions/workflows/version-sync.yml)
 [![Python 3.11+](https://img.shields.io/badge/python-3.11%2B-blue.svg)](https://www.python.org/downloads/)
 [![Coverage](https://img.shields.io/badge/coverage-99%25-brightgreen.svg)](https://github.com/brian-a-au/sdr-visualizer/tree/main/tests)
 [![Ruff](https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/astral-sh/ruff/main/assets/badge/v2.json)](https://github.com/astral-sh/ruff)
@@ -68,9 +70,12 @@ Treat it as derived from the source snapshot. Move, email, post, or attach it
 only in authorized locations and in accordance with your organization's
 confidentiality and data-handling policy.
 
-## Public preview scope
+sdr-visualizer is an independent open source project. It is not affiliated
+with, endorsed by, or supported by Adobe. See [Trademarks](#trademarks).
 
-This project is in public preview. A report shows what a snapshot configures. It
+## Scope and limits
+
+A report shows what a snapshot configures. It
 does not grade the implementation or confirm that it works. Check the details
 against the source implementation before you act on them.
 
@@ -330,8 +335,9 @@ sidecar share one schema, published at
 and validated in CI against every payload shape produced by the bundled
 fixtures. Removing or retyping a field is major; adding optional fields is
 minor. The `segment_trees` / `formula_trees` node internals are documented in
-the schema as loosely specified. Current-generator and private-corpus
-validation is a separate, recorded release gate; see
+the schema as loosely specified. Before each release, the maintainer also
+checks the payload against fresh generator output and a private set of real
+snapshots. Those snapshots contain customer data and are never published. See
 [`docs/RELEASING.md`](https://github.com/brian-a-au/sdr-visualizer/blob/main/docs/RELEASING.md).
 
 **CJA lineage.** `cja-lineage` adds a separate CJA-only command. Its documented
@@ -413,3 +419,13 @@ is governed by the [`CODE_OF_CONDUCT.md`](https://github.com/brian-a-au/sdr-visu
 MIT — see [`LICENSE`](https://github.com/brian-a-au/sdr-visualizer/blob/main/LICENSE). The output bundles [D3](https://d3js.org) v7,
 vendored under the ISC license; see
 [`THIRD_PARTY_LICENSES`](https://github.com/brian-a-au/sdr-visualizer/blob/main/THIRD_PARTY_LICENSES) for the full notice.
+
+## Trademarks
+
+sdr-visualizer is an independent project. It is not affiliated with, endorsed
+by, sponsored by, or supported by Adobe Inc. Adobe, Adobe Analytics, and
+Customer Journey Analytics are trademarks or registered trademarks of Adobe
+Inc. in the United States and other countries. This project uses those names
+only to say which products its input comes from. For help with an Adobe
+product, contact Adobe. For help with this tool, open an issue in this
+repository.

{sdr_visualizer-1.2.7 → sdr_visualizer-1.2.9}/README.md

@@ -3,6 +3,7 @@
 [![PyPI](https://img.shields.io/pypi/v/sdr-visualizer)](https://pypi.org/project/sdr-visualizer/)
 [![Tests](https://github.com/brian-a-au/sdr-visualizer/actions/workflows/test.yml/badge.svg)](https://github.com/brian-a-au/sdr-visualizer/actions/workflows/test.yml)
 [![Lint](https://github.com/brian-a-au/sdr-visualizer/actions/workflows/lint.yml/badge.svg)](https://github.com/brian-a-au/sdr-visualizer/actions/workflows/lint.yml)
+[![Version Sync](https://github.com/brian-a-au/sdr-visualizer/actions/workflows/version-sync.yml/badge.svg)](https://github.com/brian-a-au/sdr-visualizer/actions/workflows/version-sync.yml)
 [![Python 3.11+](https://img.shields.io/badge/python-3.11%2B-blue.svg)](https://www.python.org/downloads/)
 [![Coverage](https://img.shields.io/badge/coverage-99%25-brightgreen.svg)](https://github.com/brian-a-au/sdr-visualizer/tree/main/tests)
 [![Ruff](https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/astral-sh/ruff/main/assets/badge/v2.json)](https://github.com/astral-sh/ruff)
@@ -36,9 +37,12 @@ Treat it as derived from the source snapshot. Move, email, post, or attach it
 only in authorized locations and in accordance with your organization's
 confidentiality and data-handling policy.
 
-## Public preview scope
+sdr-visualizer is an independent open source project. It is not affiliated
+with, endorsed by, or supported by Adobe. See [Trademarks](#trademarks).
 
-This project is in public preview. A report shows what a snapshot configures. It
+## Scope and limits
+
+A report shows what a snapshot configures. It
 does not grade the implementation or confirm that it works. Check the details
 against the source implementation before you act on them.
 
@@ -298,8 +302,9 @@ sidecar share one schema, published at
 and validated in CI against every payload shape produced by the bundled
 fixtures. Removing or retyping a field is major; adding optional fields is
 minor. The `segment_trees` / `formula_trees` node internals are documented in
-the schema as loosely specified. Current-generator and private-corpus
-validation is a separate, recorded release gate; see
+the schema as loosely specified. Before each release, the maintainer also
+checks the payload against fresh generator output and a private set of real
+snapshots. Those snapshots contain customer data and are never published. See
 [`docs/RELEASING.md`](https://github.com/brian-a-au/sdr-visualizer/blob/main/docs/RELEASING.md).
 
 **CJA lineage.** `cja-lineage` adds a separate CJA-only command. Its documented
@@ -381,3 +386,13 @@ is governed by the [`CODE_OF_CONDUCT.md`](https://github.com/brian-a-au/sdr-visu
 MIT — see [`LICENSE`](https://github.com/brian-a-au/sdr-visualizer/blob/main/LICENSE). The output bundles [D3](https://d3js.org) v7,
 vendored under the ISC license; see
 [`THIRD_PARTY_LICENSES`](https://github.com/brian-a-au/sdr-visualizer/blob/main/THIRD_PARTY_LICENSES) for the full notice.
+
+## Trademarks
+
+sdr-visualizer is an independent project. It is not affiliated with, endorsed
+by, sponsored by, or supported by Adobe Inc. Adobe, Adobe Analytics, and
+Customer Journey Analytics are trademarks or registered trademarks of Adobe
+Inc. in the United States and other countries. This project uses those names
+only to say which products its input comes from. For help with an Adobe
+product, contact Adobe. For help with this tool, open an issue in this
+repository.

{sdr_visualizer-1.2.7 → sdr_visualizer-1.2.9}/docs/ADAPTER_GUIDE.md

@@ -167,13 +167,36 @@ The fixtures may diverge from sdr-grader's over time — the visualizer wants mo
   window-cap filtering (including an empty list for an empty directory) and
   maps discovery failures to `InvalidSnapshotError`.
   The grader mirrors this loader primitive even though it has no trend mode.
+  The grader also drops non-regular files here. The visualizer keeps them,
+  because a dangling symlink or `*.json` directory must stay a protected output
+  candidate; mtime-based selection skips a candidate whose metadata cannot be
+  read, with a warning (1.2.8).
+- Record diagnostics — a malformed or ID-less record is reported by collection
+  and index (`CJA metrics[3]`, `AA segments[0]`) through `_record_context`,
+  never by echoing record content. Mirrored from sdr-grader `011b3d2` in 1.2.8.
+- `input.shell_out` failure messages — a nonzero generator exit reports the
+  tool and exit status only; generator stderr is not echoed (sdr-grader
+  `011b3d2`). An empty or dash-leading `--dataview` / `--rsid` ID is rejected
+  before the generator starts, because it would be read as an option
+  (sdr-grader `90a9b3f`). The grader's capture byte limits and process-group
+  cleanup are not yet mirrored.
+- `input.loader` stdin — stdin bytes are decoded as UTF-8 whatever the locale
+  encoding, and undecodable stdin is invalid input ("stdin is not valid UTF-8"),
+  mirrored from sdr-grader `2b18cd1` and `82c742e` in 1.2.8.
+- `input.detect` — AA detection reads `report_suite` whenever that key is
+  present, the same key choice as the AA adapter (sdr-grader `5736d46`).
+- `_present` — component, derived-field, calculated-metric and segment names
+  and component types (plus the AA report suite name) treat a non-finite float
+  as missing, because pandas writes NaN for an empty cell (sdr-grader `7cf980b`).
 - `_parse_tag_list` / `_parse_ref_list` — parse `tags` and reference fields
   that `cja_auto_sdr` ships as JSON-encoded list strings (`'["a"]'`) while
   tolerating native lists. Ordinary JSON syntax failures drop to `[]`;
   decoder resource failures raise `InvalidSnapshotError`. Every successful
   decode is limited to depth 100 and 10,000 nodes before shape fallback or
   coercion; this decoded-structure guard is part of the required sibling
-  parity behavior.
+  parity behavior. A tag list keeps non-empty strings and the `name` (or else
+  `id`) of tag objects. Null, numbers, booleans and empty strings are dropped,
+  so they never count a component as tagged.
 - Snapshot structure validation rejects surrogate code points in string values
   and mapping keys before normalization. Embedded definition, tag, and
   reference helpers repeat that Unicode-scalar check after decoding, when
@@ -181,21 +204,45 @@ The fixtures may diverge from sdr-grader's over time — the visualizer wants mo
 - `input/json_io.py` (`unique_object`, `DuplicateJSONKeyError`) — snapshot
   files, stdin, and generator output reject a JSON object that repeats a member
   name, mirrored from sdr-grader #127 (`c8e7316`). The helper body is
-  identical; only the module docstring differs.
+  identical; only the module docstring differs. The embedded JSON in
+  definitions, tag lists and reference lists uses the same hook and raises
+  "<label> JSON contains duplicate object keys" (sdr-grader #156).
 - `_optional_list` (AA) — an absent/null optional section is `[]`, but a present non-list value raises `InvalidSnapshotError` (a malformed export, not an empty one). CJA gets the same guarantee through `_section_records`.
 - `generator_version_warning` / `_version_tuple` / `TESTED_THROUGH_GENERATOR_VERSION` — the Q5 version-compat warning mechanism (1.0.0). The helper bodies are behavior-identical; the constant's *value* is per-platform and per-release by design (the newest generator version that release was validated against).
 - `_optional_timestamp` — guards `created_at`/`modified_at`: keeps the value only if it's already a non-empty string, else `None`, so `_compact` drops a non-string timestamp (an epoch int, say) instead of leaking it into the payload. Present in both `cja.py` and `aa.py` here, and mirrored into the grader's copies of both adapters — a non-string timestamp is *missing*, not a value worth coercing to a numeric string.
 - `_optional_str` (CJA only) — guards `owner` and the derived-field `data_type` at the CJA record builders that previously passed them straight through unguarded (`str(x) if x else None`, the same pattern the metric/dimension `data_type` path already used). No grader-side mirror needed for `owner`: the grader's `_normalize_owner` (governance helper, see below) already reduces a non-string owner to `None` — a different mechanism, the same outcome — so grader `owner` needs no additional guard. AA needs no `_optional_str` mirror either: its three `owner_id` builder sites and its one `data_type` site were already cast (`str(x) if x else None`) before this cycle.
 
+**Reviewed for 1.2.8 and not mirrored:** sdr-grader 1.7.0 also changed these
+shared paths. Each is a deliberate project difference, not a missed defensive
+fix:
+
+- `49ed033` computes CJA segment `nesting_depth` from the definition's
+  containers so a grading threshold means the same on both platforms. The
+  visualizer describes the exported value, so it keeps `cja_auto_sdr`'s
+  `nesting_depth`.
+- `f63704a` adds a grader warning for a degraded AA `fetch_status`. It is a new
+  diagnostic tied to grading findings, not input hardening.
+- `0ceb788` and the earlier `19c9e94` accept a UTF-8 BOM. The visualizer still
+  rejects a BOM on file and stdin input alike; accepting it would widen input
+  acceptance and is left to a feature release.
+- `2bed8a1` raises the grader's snapshot node budget to 1,000,000. The
+  visualizer's 250,000-node budget is its own published contract limit.
+
 **Grader-only (do not port — evaluative, not descriptive):** the grader carries logic that exists only to serve its grading rules — governance signals (`_governance_approved`, `_governance_shared_to_count`, `_normalize_owner`, `_aa_governance_signals`) and inline-echo de-duplication (`_echoes_derived_field`, which drops a metric/dimension that merely re-declares a derived field so rule SCH-001 doesn't false-fire on the duplicate name). The visualizer describes rather than grades: it keeps such echoes and instead warns on duplicate component ids (last-writer-wins for anatomy), so it never adopts these helpers.
 
 **Visualizer-only numeric coercion — intentional divergence, do NOT reconcile to the grader:** `_as_float` / `_as_int` are the visualizer's variant of the grader's tolerant `_safe_float` / `_safe_int`. Two deltas, both driven by visualizer-only features:
 
-1. A present-but-unconvertible numeric **raises** `InvalidSnapshotError` (the grader defaults). Trend mode relies on the raise to *skip* a malformed snapshot rather than chart a fabricated value; a single snapshot exits 3.
+1. A present-but-unconvertible numeric **raises** `InvalidSnapshotError` (the grader defaults). Trend mode relies on the raise to *skip* a malformed snapshot rather than chart a fabricated value; a single snapshot exits 3. This includes values that overflow the conversion, such as a 400-digit integer or an infinite `nesting_depth` (1.2.8). The message names the value's type, not the value.
 2. `NaN` / `Infinity` **pass through** to the renderer's `allow_nan=False` guard, which rejects the whole report (audit H2). The grader coerces them to a default. A visualizer report that embeds `NaN` cannot boot in a browser, so rejecting loudly beats substituting `0.0`.
 
 These deltas are pinned by `test_nan_snapshot_exits_3`, `test_nan_in_snapshot_raises_invalid_snapshot_error`, and the trend bad-scalar skip test — a sync that "fixes" the divergence will fail them.
 
+**AA calculated-metric attribution — intentional divergence:** the visualizer
+keeps `attribution`/`attribution_model` and `allocation` only when they are
+strings and otherwise omits them, so the payload matches its published schema
+(1.2.8). The grader rejects a non-string attribution or allocation as invalid
+input (sdr-grader #156).
+
 **Visualizer-only output protection — do not port to the grader:** before its
 first write, the visualizer compares both HTML and optional JSON destinations
 with every explicit snapshot and every directory candidate. Resolved paths and
@@ -241,4 +288,5 @@ Unlike the grader, the visualizer never treats an omitted built-in as an
 available node. Raw segment definitions remain outside snapshot comparison,
 and CJA comparison still uses exported formula summaries and reference arrays;
 this patch does not claim semantic equivalence checking for arbitrary ASTs.
-See [the adapter review](ADAPTER_CORRECTNESS_1.1.2.md) for evidence and limits.
+The 1.1.2 review evidence is recorded in
+[PR #41](https://github.com/brian-a-au/sdr-visualizer/pull/41).

{sdr_visualizer-1.2.7 → sdr_visualizer-1.2.9}/docs/PERFORMANCE.md

@@ -169,7 +169,10 @@ Build time is the median of three runs.
 
 `scripts/perf_browser_check.py` opens generated reports in headless Chromium
 through Playwright. It measures initial render time, cold and warm catalog
-filtering, and the main-thread pause when the graph initializes.
+filtering, and the main-thread pause when the graph initializes. Every report
+embeds the same JavaScript, so the browser compiles it once and reuses it. The
+gate opens the first report once without timing it, so that one-time compile is
+not charged only to whichever report happens to be measured first.
 
 The browser gate exercises all declared size tiers and enforces a 700 ms graph
 initialization cap, including a deterministic graph of roughly 1,000 nodes and

{sdr_visualizer-1.2.7 → sdr_visualizer-1.2.9}/docs/PRODUCT_CONTRACT.md

@@ -91,7 +91,9 @@ Before the first write, the visualizer verifies that the HTML and optional JSON
 destinations do not alias one another or any filesystem snapshot input. For a
 primary, baseline, or trend directory, every `*.json` candidate is protected,
 including corrupt, skipped, retained, and capped-out members. The check covers
-resolved paths, symlinks, symlinked parents, and existing hard links; a
+resolved paths, symlinks, symlinked parents, existing hard links, and new
+names in one directory that differ only in letter case or Unicode
+normalization (which a case-insensitive filesystem stores as one file); a
 collision is invalid input and leaves source bytes unchanged.
 
 Offline is a transport property, not a confidentiality classification.
@@ -214,12 +216,13 @@ unusable, and capped-out members do not warn. The current markers are:
 | Platform | Warning threshold |
 |---|---:|
 | CJA (`cja_auto_sdr`) | 3.13.6 |
-| AA (`aa_auto_sdr`) | 1.24.5 |
+| AA (`aa_auto_sdr`) | 1.24.6 |
 
 A marker is evidence of exercised compatibility, not a promise about every
 possible snapshot produced by that version. It may advance only after a
 fresh, production-representative snapshot from that exact upstream version and
-the full historical private corpus pass the release checks in
+the maintainer's private set of real historical snapshots pass the release
+checks in
 [`RELEASING.md`](RELEASING.md). Bundled fixtures and CI do not replace that
 evidence.
 

{sdr_visualizer-1.2.7 → sdr_visualizer-1.2.9}/docs/RELEASING.md

@@ -333,7 +333,7 @@ non-critical item is backlog.
 
 ## Requirement evidence matrix
 
-Start from the tracked [release evidence template](RELEASE_EVIDENCE_TEMPLATE.md),
+Start from the tracked [release evidence template](https://github.com/brian-a-au/sdr-visualizer/blob/main/docs/RELEASE_EVIDENCE_TEMPLATE.md),
 copy it into the release pull request, and replace every `pending` with durable
 evidence tied to the candidate SHA. The template is a copy source; this
 checklist remains authoritative.

{sdr_visualizer-1.2.7 → sdr_visualizer-1.2.9}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "sdr-visualizer"
-version = "1.2.7"
+version = "1.2.9"
 description = "Static-output visual catalog generator for Adobe Customer Journey Analytics and Adobe Analytics implementations."
 readme = "README.md"
 license = "MIT"
@@ -8,6 +8,7 @@ license-files = ["LICENSE", "THIRD_PARTY_LICENSES"]
 authors = [{ name = "Brian Au" }]
 requires-python = ">=3.11"
 classifiers = [
+    "Development Status :: 5 - Production/Stable",
     "Environment :: Console",
     "Intended Audience :: Developers",
     "Programming Language :: Python :: 3",
@@ -84,6 +85,8 @@ exclude = [
     "tests/fixtures/cja_snapshot_large.json",
     "tests/fixtures/cja_snapshot_xl.json",
     "tests/fixtures/aa_snapshot_large.json",
+    "docs/DEPENDABOT_AUTOMATION.md",
+    "docs/RELEASE_EVIDENCE_TEMPLATE.md",
 ]
 
 [tool.pytest.ini_options]

{sdr_visualizer-1.2.7 → sdr_visualizer-1.2.9}/scripts/dependabot_review.py

@@ -16,12 +16,26 @@ import re
 import subprocess
 import sys
 import tomllib
+from datetime import UTC, datetime, timedelta
 from pathlib import Path
 from typing import Any
 from urllib.parse import unquote, urlsplit
 from urllib.request import urlopen
 
-ALLOWED_PACKAGES = frozenset({"ruff", "pytest", "pytest-cov"})
+# The furthest update each automated package may take: "patch" keeps the
+# major and minor version, "minor" keeps the major version. Every other
+# package, and any larger update, needs a manual merge.
+UPDATE_LEVELS = {
+    "ruff": "patch",
+    "pytest": "patch",
+    "pytest-cov": "patch",
+    "pytest-xdist": "patch",
+    "hypothesis": "minor",
+}
+ALLOWED_PACKAGES = frozenset(UPDATE_LEVELS)
+# Matches Dependabot's cooldown. A release this new could still be yanked
+# or found compromised, so it waits for a manual merge instead.
+MIN_RELEASE_AGE = timedelta(days=3)
 REQUIRED_CHECKS = frozenset(
     {
         "dependabot-policy",
@@ -130,7 +144,7 @@ def _valid_artifact(artifact: dict[str, Any], name: str, version: str, *, wheel:
 
 
 def review_locks(before: dict[str, Any], after: dict[str, Any]) -> tuple[bool, str]:
-    """Conservatively approve only direct dev patches with no other changes."""
+    """Conservatively approve only allowlisted direct dev updates with no other changes."""
     if {key: value for key, value in before.items() if key != "package"} != {
         key: value for key, value in after.items() if key != "package"
     }:
@@ -159,8 +173,10 @@ def review_locks(before: dict[str, Any], after: dict[str, Any]) -> tuple[bool, s
         old_version, new_version = [
             tuple(map(int, match.groups())) for match in versions if match is not None
         ]
-        if old_version[:2] != new_version[:2] or new_version[2] <= old_version[2]:
-            return False, f"{name} is not a forward patch update"
+        level = UPDATE_LEVELS[name]
+        kept = 2 if level == "patch" else 1
+        if old_version[:kept] != new_version[:kept] or new_version <= old_version:
+            return False, f"{name} is not a forward {level} update"
         allowed_fields = {"version", "sdist", "wheels"}
         if {key: value for key, value in previous.items() if key not in allowed_fields} != {
             key: value for key, value in updated.items() if key not in allowed_fields
@@ -186,8 +202,16 @@ def read_lock(repo: str, sha: str) -> dict[str, Any]:
     return tomllib.loads(base64.b64decode(content["content"]).decode("utf-8"))
 
 
-def verify_pypi_artifacts(before: dict[str, Any], after: dict[str, Any]) -> None:
-    """Compare every changed artifact with the registry's published metadata."""
+def verify_pypi_artifacts(
+    before: dict[str, Any], after: dict[str, Any], *, now: datetime | None = None
+) -> str | None:
+    """Compare every changed artifact with the registry's published metadata.
+
+    Mismatched or yanked artifacts raise. A release younger than
+    MIN_RELEASE_AGE returns the reason it must wait for a manual merge.
+    """
+    now = now or datetime.now(UTC)
+    too_new = []
     old, new = _packages(before), _packages(after)
     for name, resolutions in new.items():
         if resolutions == old[name]:
@@ -209,6 +233,15 @@ def verify_pypi_artifacts(before: dict[str, Any], after: dict[str, Any]) -> None
                 or artifact["size"] != match["size"]
             ):
                 raise ValueError("Artifact differs from PyPI metadata or has been yanked")
+            uploaded = datetime.fromisoformat(match["upload_time_iso_8601"])
+            if uploaded.tzinfo is None:
+                raise ValueError("PyPI upload time has no timezone")
+            if now - uploaded < MIN_RELEASE_AGE:
+                too_new.append(name)
+    if too_new:
+        days = MIN_RELEASE_AGE.days
+        return f"{', '.join(sorted(set(too_new)))} was released less than {days} days ago"
+    return None
 
 
 def evaluate_pr(repo: str, pr: dict[str, Any]) -> tuple[bool, str]:
@@ -222,8 +255,8 @@ def evaluate_pr(repo: str, pr: dict[str, Any]) -> tuple[bool, str]:
         return False, "Only an existing uv.lock may be modified"
     before, after = read_lock(repo, pr["base"]["sha"]), read_lock(repo, pr["head"]["sha"])
     eligible, reason = review_locks(before, after)
-    if eligible:
-        verify_pypi_artifacts(before, after)
+    if eligible and (wait := verify_pypi_artifacts(before, after)):
+        return False, wait
     return eligible, reason
 
 
@@ -289,7 +322,8 @@ def apply_review(repo: str, pr: dict[str, Any], reason: str) -> None:
             "body": (
                 f"Automatic policy review: {reason}.\n\n"
                 "Verified a lockfile-only update of exclusively direct development dependencies, "
-                "unchanged dependency metadata, forward patch versions, and PyPI artifact URLs and hashes. "
+                "unchanged dependency metadata, forward updates within each package's allowed level, "
+                f"PyPI artifact URLs and hashes, and releases at least {MIN_RELEASE_AGE.days} days old. "
                 "All required CI checks passed. GitHub must also enforce an up-to-date branch at merge time."
             ),
         },

{sdr_visualizer-1.2.7 → sdr_visualizer-1.2.9}/scripts/perf_browser_check.py

@@ -413,6 +413,7 @@ def main() -> int:
         browser = pw.chromium.launch(headless=True)
         page = browser.new_page()
         with tempfile.TemporaryDirectory() as tmp:
+            warmed_up = False
             for case in FIXTURES:
                 snap = json.loads(case.path.read_text(encoding="utf-8"))
                 implementation = adapters[case.adapter](snap)
@@ -421,6 +422,15 @@ def main() -> int:
                     failures.append(mismatch)
                 html_path = Path(tmp) / f"{case.path.stem}.html"
                 html_path.write_text(render(implementation), encoding="utf-8")
+                if not warmed_up:
+                    # Untimed warm-up load. Every report embeds the same
+                    # JavaScript and D3, so V8 reuses its compiled code from
+                    # the second report on. Without this, only the first
+                    # fixture pays that one-time compile (~60-80ms on CI)
+                    # and its budget measures a different thing from the rest.
+                    page.goto(html_path.as_uri())
+                    page.wait_for_selector("#catalog-body tr", state="attached", timeout=10_000)
+                    warmed_up = True
                 failures += _check(
                     page,
                     html_path,

{sdr_visualizer-1.2.7 → sdr_visualizer-1.2.9}/src/sdr_visualizer/__init__.py

@@ -1,3 +1,3 @@
 """sdr-visualizer: visual catalog generator for CJA / AA implementations."""
 
-__version__ = "1.2.7"
+__version__ = "1.2.9"