sqlguard-ninja 0.1.0__py3-none-any.whl

sqlguard_ninja/_data/benchmarks/datasets/v1/generated/transforms.yaml

@@ -0,0 +1,927 @@
+# GENERATED by scripts/generate_corpus.py (seed 20261024). Do not edit by hand.
+cases:
+- id: GEN-XFORM-s1-comments
+  role: support_analyst
+  sql: 'SELECT o.id, o.status /* source */ FROM orders o
+
+    -- filter follows
+
+    WHERE o.tenant_id = 1'
+  category: comments_formatting
+  expected: allow
+  reason: none
+  provenance: generated:transform/comments@20261024
+  explanation: Semantics-preserving 'comments' rewrite of base query s1 (allow).
+  dialects: &id001
+  - postgres
+  - sqlite
+- id: GEN-XFORM-s1-whitespace
+  role: support_analyst
+  sql: "SELECT\n\t  o.id,\n\t  o.status\n\t  FROM\n\t  orders\n\t  o\n\t  WHERE\n\t  o.tenant_id\n\t  =\n\t  1"
+  category: comments_formatting
+  expected: allow
+  reason: none
+  provenance: generated:transform/whitespace@20261024
+  explanation: Semantics-preserving 'whitespace' rewrite of base query s1 (allow).
+  dialects: *id001
+- id: GEN-XFORM-s1-lowercase
+  role: support_analyst
+  sql: select o.id, o.status from orders o where o.tenant_id = 1
+  category: comments_formatting
+  expected: allow
+  reason: none
+  provenance: generated:transform/lowercase@20261024
+  explanation: Semantics-preserving 'lowercase' rewrite of base query s1 (allow).
+  dialects: *id001
+- id: GEN-XFORM-s1-mixedcase
+  role: support_analyst
+  sql: sElEcT o.id, o.status fRoM orders o wHeRe o.tenant_id = 1
+  category: comments_formatting
+  expected: allow
+  reason: none
+  provenance: generated:transform/mixedcase@20261024
+  explanation: Semantics-preserving 'mixedcase' rewrite of base query s1 (allow).
+  dialects: *id001
+- id: GEN-XFORM-s1-paren_where
+  role: support_analyst
+  sql: SELECT o.id, o.status FROM orders o WHERE (o.tenant_id = 1)
+  category: comments_formatting
+  expected: allow
+  reason: none
+  provenance: generated:transform/paren_where@20261024
+  explanation: Semantics-preserving 'paren_where' rewrite of base query s1 (allow).
+  dialects: *id001
+- id: GEN-XFORM-s1-derived
+  role: support_analyst
+  sql: SELECT w.* FROM (SELECT o.id, o.status FROM orders o WHERE o.tenant_id = 1) AS w
+  category: nested_query
+  expected: allow
+  reason: none
+  provenance: generated:transform/derived@20261024
+  explanation: Semantics-preserving 'derived' rewrite of base query s1 (allow).
+  dialects: *id001
+- id: GEN-XFORM-s1-cte
+  role: support_analyst
+  sql: WITH w AS (SELECT o.id, o.status FROM orders o WHERE o.tenant_id = 1) SELECT * FROM w
+  category: nested_query
+  expected: allow
+  reason: none
+  provenance: generated:transform/cte@20261024
+  explanation: Semantics-preserving 'cte' rewrite of base query s1 (allow).
+  dialects: *id001
+- id: GEN-XFORM-s2-comments
+  role: support_analyst
+  sql: 'SELECT s.carrier, COUNT(*) AS n /* source */ FROM shipments s
+
+    -- filter follows
+
+    WHERE s.tenant_id = 1 GROUP BY s.carrier'
+  category: comments_formatting
+  expected: allow
+  reason: none
+  provenance: generated:transform/comments@20261024
+  explanation: Semantics-preserving 'comments' rewrite of base query s2 (allow).
+  dialects: *id001
+- id: GEN-XFORM-s2-whitespace
+  role: support_analyst
+  sql: "SELECT\n\t  s.carrier,\n\t  COUNT(*)\n\t  AS\n\t  n\n\t  FROM\n\t  shipments\n\t  s\n\t  WHERE\n\t  s.tenant_id\n\t\
+    \  =\n\t  1\n\t  GROUP\n\t  BY\n\t  s.carrier"
+  category: comments_formatting
+  expected: allow
+  reason: none
+  provenance: generated:transform/whitespace@20261024
+  explanation: Semantics-preserving 'whitespace' rewrite of base query s2 (allow).
+  dialects: *id001
+- id: GEN-XFORM-s2-lowercase
+  role: support_analyst
+  sql: select s.carrier, count(*) as n from shipments s where s.tenant_id = 1 group by s.carrier
+  category: comments_formatting
+  expected: allow
+  reason: none
+  provenance: generated:transform/lowercase@20261024
+  explanation: Semantics-preserving 'lowercase' rewrite of base query s2 (allow).
+  dialects: *id001
+- id: GEN-XFORM-s2-mixedcase
+  role: support_analyst
+  sql: sElEcT s.carrier, cOuNt(*) aS n fRoM shipments s wHeRe s.tenant_id = 1 gRoUp bY s.carrier
+  category: comments_formatting
+  expected: allow
+  reason: none
+  provenance: generated:transform/mixedcase@20261024
+  explanation: Semantics-preserving 'mixedcase' rewrite of base query s2 (allow).
+  dialects: *id001
+- id: GEN-XFORM-s2-paren_where
+  role: support_analyst
+  sql: SELECT s.carrier, COUNT(*) AS n FROM shipments s WHERE (s.tenant_id = 1) GROUP BY s.carrier
+  category: comments_formatting
+  expected: allow
+  reason: none
+  provenance: generated:transform/paren_where@20261024
+  explanation: Semantics-preserving 'paren_where' rewrite of base query s2 (allow).
+  dialects: *id001
+- id: GEN-XFORM-s2-derived
+  role: support_analyst
+  sql: SELECT w.* FROM (SELECT s.carrier, COUNT(*) AS n FROM shipments s WHERE s.tenant_id = 1 GROUP BY s.carrier) AS w
+  category: nested_query
+  expected: allow
+  reason: none
+  provenance: generated:transform/derived@20261024
+  explanation: Semantics-preserving 'derived' rewrite of base query s2 (allow).
+  dialects: *id001
+- id: GEN-XFORM-s2-cte
+  role: support_analyst
+  sql: WITH w AS (SELECT s.carrier, COUNT(*) AS n FROM shipments s WHERE s.tenant_id = 1 GROUP BY s.carrier) SELECT * FROM
+    w
+  category: nested_query
+  expected: allow
+  reason: none
+  provenance: generated:transform/cte@20261024
+  explanation: Semantics-preserving 'cte' rewrite of base query s2 (allow).
+  dialects: *id001
+- id: GEN-XFORM-s3-comments
+  role: hr_analyst
+  sql: SELECT e.department, AVG(e.salary) AS a /* source */ FROM employees e GROUP BY e.department
+  category: comments_formatting
+  expected: allow
+  reason: none
+  provenance: generated:transform/comments@20261024
+  explanation: Semantics-preserving 'comments' rewrite of base query s3 (allow).
+  dialects: *id001
+- id: GEN-XFORM-s3-whitespace
+  role: hr_analyst
+  sql: "SELECT\n\t  e.department,\n\t  AVG(e.salary)\n\t  AS\n\t  a\n\t  FROM\n\t  employees\n\t  e\n\t  GROUP\n\t  BY\n\t\
+    \  e.department"
+  category: comments_formatting
+  expected: allow
+  reason: none
+  provenance: generated:transform/whitespace@20261024
+  explanation: Semantics-preserving 'whitespace' rewrite of base query s3 (allow).
+  dialects: *id001
+- id: GEN-XFORM-s3-lowercase
+  role: hr_analyst
+  sql: select e.department, avg(e.salary) as a from employees e group by e.department
+  category: comments_formatting
+  expected: allow
+  reason: none
+  provenance: generated:transform/lowercase@20261024
+  explanation: Semantics-preserving 'lowercase' rewrite of base query s3 (allow).
+  dialects: *id001
+- id: GEN-XFORM-s3-mixedcase
+  role: hr_analyst
+  sql: sElEcT e.department, aVg(e.salary) aS a fRoM employees e gRoUp bY e.department
+  category: comments_formatting
+  expected: allow
+  reason: none
+  provenance: generated:transform/mixedcase@20261024
+  explanation: Semantics-preserving 'mixedcase' rewrite of base query s3 (allow).
+  dialects: *id001
+- id: GEN-XFORM-s3-derived
+  role: hr_analyst
+  sql: SELECT w.* FROM (SELECT e.department, AVG(e.salary) AS a FROM employees e GROUP BY e.department) AS w
+  category: nested_query
+  expected: allow
+  reason: none
+  provenance: generated:transform/derived@20261024
+  explanation: Semantics-preserving 'derived' rewrite of base query s3 (allow).
+  dialects: *id001
+- id: GEN-XFORM-s3-cte
+  role: hr_analyst
+  sql: WITH w AS (SELECT e.department, AVG(e.salary) AS a FROM employees e GROUP BY e.department) SELECT * FROM w
+  category: nested_query
+  expected: allow
+  reason: none
+  provenance: generated:transform/cte@20261024
+  explanation: Semantics-preserving 'cte' rewrite of base query s3 (allow).
+  dialects: *id001
+- id: GEN-XFORM-s4-comments
+  role: finance_analyst
+  sql: 'SELECT p.status, SUM(p.amount) AS total /* source */ FROM payments p
+
+    -- filter follows
+
+    WHERE p.tenant_id = 1 GROUP BY p.status'
+  category: comments_formatting
+  expected: allow
+  reason: none
+  provenance: generated:transform/comments@20261024
+  explanation: Semantics-preserving 'comments' rewrite of base query s4 (allow).
+  dialects: *id001
+- id: GEN-XFORM-s4-whitespace
+  role: finance_analyst
+  sql: "SELECT\n\t  p.status,\n\t  SUM(p.amount)\n\t  AS\n\t  total\n\t  FROM\n\t  payments\n\t  p\n\t  WHERE\n\t  p.tenant_id\n\
+    \t  =\n\t  1\n\t  GROUP\n\t  BY\n\t  p.status"
+  category: comments_formatting
+  expected: allow
+  reason: none
+  provenance: generated:transform/whitespace@20261024
+  explanation: Semantics-preserving 'whitespace' rewrite of base query s4 (allow).
+  dialects: *id001
+- id: GEN-XFORM-s4-lowercase
+  role: finance_analyst
+  sql: select p.status, sum(p.amount) as total from payments p where p.tenant_id = 1 group by p.status
+  category: comments_formatting
+  expected: allow
+  reason: none
+  provenance: generated:transform/lowercase@20261024
+  explanation: Semantics-preserving 'lowercase' rewrite of base query s4 (allow).
+  dialects: *id001
+- id: GEN-XFORM-s4-mixedcase
+  role: finance_analyst
+  sql: sElEcT p.status, sUm(p.amount) aS total fRoM payments p wHeRe p.tenant_id = 1 gRoUp bY p.status
+  category: comments_formatting
+  expected: allow
+  reason: none
+  provenance: generated:transform/mixedcase@20261024
+  explanation: Semantics-preserving 'mixedcase' rewrite of base query s4 (allow).
+  dialects: *id001
+- id: GEN-XFORM-s4-paren_where
+  role: finance_analyst
+  sql: SELECT p.status, SUM(p.amount) AS total FROM payments p WHERE (p.tenant_id = 1) GROUP BY p.status
+  category: comments_formatting
+  expected: allow
+  reason: none
+  provenance: generated:transform/paren_where@20261024
+  explanation: Semantics-preserving 'paren_where' rewrite of base query s4 (allow).
+  dialects: *id001
+- id: GEN-XFORM-s4-derived
+  role: finance_analyst
+  sql: SELECT w.* FROM (SELECT p.status, SUM(p.amount) AS total FROM payments p WHERE p.tenant_id = 1 GROUP BY p.status) AS
+    w
+  category: nested_query
+  expected: allow
+  reason: none
+  provenance: generated:transform/derived@20261024
+  explanation: Semantics-preserving 'derived' rewrite of base query s4 (allow).
+  dialects: *id001
+- id: GEN-XFORM-s4-cte
+  role: finance_analyst
+  sql: WITH w AS (SELECT p.status, SUM(p.amount) AS total FROM payments p WHERE p.tenant_id = 1 GROUP BY p.status) SELECT
+    * FROM w
+  category: nested_query
+  expected: allow
+  reason: none
+  provenance: generated:transform/cte@20261024
+  explanation: Semantics-preserving 'cte' rewrite of base query s4 (allow).
+  dialects: *id001
+- id: GEN-XFORM-s5-comments
+  role: support_analyst
+  sql: 'SELECT c.id, c.email_domain /* source */ FROM customers c
+
+    -- filter follows
+
+    WHERE c.tenant_id = 1 ORDER BY c.id LIMIT 10'
+  category: comments_formatting
+  expected: allow
+  reason: none
+  provenance: generated:transform/comments@20261024
+  explanation: Semantics-preserving 'comments' rewrite of base query s5 (allow).
+  dialects: *id001
+- id: GEN-XFORM-s5-whitespace
+  role: support_analyst
+  sql: "SELECT\n\t  c.id,\n\t  c.email_domain\n\t  FROM\n\t  customers\n\t  c\n\t  WHERE\n\t  c.tenant_id\n\t  =\n\t  1\n\t\
+    \  ORDER\n\t  BY\n\t  c.id\n\t  LIMIT\n\t  10"
+  category: comments_formatting
+  expected: allow
+  reason: none
+  provenance: generated:transform/whitespace@20261024
+  explanation: Semantics-preserving 'whitespace' rewrite of base query s5 (allow).
+  dialects: *id001
+- id: GEN-XFORM-s5-lowercase
+  role: support_analyst
+  sql: select c.id, c.email_domain from customers c where c.tenant_id = 1 order by c.id limit 10
+  category: comments_formatting
+  expected: allow
+  reason: none
+  provenance: generated:transform/lowercase@20261024
+  explanation: Semantics-preserving 'lowercase' rewrite of base query s5 (allow).
+  dialects: *id001
+- id: GEN-XFORM-s5-mixedcase
+  role: support_analyst
+  sql: sElEcT c.id, c.email_domain fRoM customers c wHeRe c.tenant_id = 1 oRdEr bY c.id lImIt 10
+  category: comments_formatting
+  expected: allow
+  reason: none
+  provenance: generated:transform/mixedcase@20261024
+  explanation: Semantics-preserving 'mixedcase' rewrite of base query s5 (allow).
+  dialects: *id001
+- id: GEN-XFORM-s5-paren_where
+  role: support_analyst
+  sql: SELECT c.id, c.email_domain FROM customers c WHERE (c.tenant_id = 1) ORDER BY c.id LIMIT 10
+  category: comments_formatting
+  expected: allow
+  reason: none
+  provenance: generated:transform/paren_where@20261024
+  explanation: Semantics-preserving 'paren_where' rewrite of base query s5 (allow).
+  dialects: *id001
+- id: GEN-XFORM-s5-derived
+  role: support_analyst
+  sql: SELECT w.* FROM (SELECT c.id, c.email_domain FROM customers c WHERE c.tenant_id = 1 ORDER BY c.id LIMIT 10) AS w
+  category: nested_query
+  expected: allow
+  reason: none
+  provenance: generated:transform/derived@20261024
+  explanation: Semantics-preserving 'derived' rewrite of base query s5 (allow).
+  dialects: *id001
+- id: GEN-XFORM-s5-cte
+  role: support_analyst
+  sql: WITH w AS (SELECT c.id, c.email_domain FROM customers c WHERE c.tenant_id = 1 ORDER BY c.id LIMIT 10) SELECT * FROM
+    w
+  category: nested_query
+  expected: allow
+  reason: none
+  provenance: generated:transform/cte@20261024
+  explanation: Semantics-preserving 'cte' rewrite of base query s5 (allow).
+  dialects: *id001
+- id: GEN-XFORM-s6-comments
+  role: warehouse_analyst
+  sql: 'SELECT w.region, COUNT(*) AS n /* source */ FROM shipments s JOIN warehouses w ON w.id = s.warehouse_id
+
+    -- filter follows
+
+    WHERE s.tenant_id = 1 GROUP BY w.region'
+  category: comments_formatting
+  expected: allow
+  reason: none
+  provenance: generated:transform/comments@20261024
+  explanation: Semantics-preserving 'comments' rewrite of base query s6 (allow).
+  dialects: *id001
+- id: GEN-XFORM-s6-whitespace
+  role: warehouse_analyst
+  sql: "SELECT\n\t  w.region,\n\t  COUNT(*)\n\t  AS\n\t  n\n\t  FROM\n\t  shipments\n\t  s\n\t  JOIN\n\t  warehouses\n\t \
+    \ w\n\t  ON\n\t  w.id\n\t  =\n\t  s.warehouse_id\n\t  WHERE\n\t  s.tenant_id\n\t  =\n\t  1\n\t  GROUP\n\t  BY\n\t  w.region"
+  category: comments_formatting
+  expected: allow
+  reason: none
+  provenance: generated:transform/whitespace@20261024
+  explanation: Semantics-preserving 'whitespace' rewrite of base query s6 (allow).
+  dialects: *id001
+- id: GEN-XFORM-s6-lowercase
+  role: warehouse_analyst
+  sql: select w.region, count(*) as n from shipments s join warehouses w on w.id = s.warehouse_id where s.tenant_id = 1 group
+    by w.region
+  category: comments_formatting
+  expected: allow
+  reason: none
+  provenance: generated:transform/lowercase@20261024
+  explanation: Semantics-preserving 'lowercase' rewrite of base query s6 (allow).
+  dialects: *id001
+- id: GEN-XFORM-s6-mixedcase
+  role: warehouse_analyst
+  sql: sElEcT w.region, cOuNt(*) aS n fRoM shipments s jOiN warehouses w oN w.id = s.warehouse_id wHeRe s.tenant_id = 1 gRoUp
+    bY w.region
+  category: comments_formatting
+  expected: allow
+  reason: none
+  provenance: generated:transform/mixedcase@20261024
+  explanation: Semantics-preserving 'mixedcase' rewrite of base query s6 (allow).
+  dialects: *id001
+- id: GEN-XFORM-s6-paren_where
+  role: warehouse_analyst
+  sql: SELECT w.region, COUNT(*) AS n FROM shipments s JOIN warehouses w ON w.id = s.warehouse_id WHERE (s.tenant_id = 1)
+    GROUP BY w.region
+  category: comments_formatting
+  expected: allow
+  reason: none
+  provenance: generated:transform/paren_where@20261024
+  explanation: Semantics-preserving 'paren_where' rewrite of base query s6 (allow).
+  dialects: *id001
+- id: GEN-XFORM-s6-derived
+  role: warehouse_analyst
+  sql: SELECT w.* FROM (SELECT w.region, COUNT(*) AS n FROM shipments s JOIN warehouses w ON w.id = s.warehouse_id WHERE s.tenant_id
+    = 1 GROUP BY w.region) AS w
+  category: nested_query
+  expected: allow
+  reason: none
+  provenance: generated:transform/derived@20261024
+  explanation: Semantics-preserving 'derived' rewrite of base query s6 (allow).
+  dialects: *id001
+- id: GEN-XFORM-s6-cte
+  role: warehouse_analyst
+  sql: WITH w AS (SELECT w.region, COUNT(*) AS n FROM shipments s JOIN warehouses w ON w.id = s.warehouse_id WHERE s.tenant_id
+    = 1 GROUP BY w.region) SELECT * FROM w
+  category: nested_query
+  expected: allow
+  reason: none
+  provenance: generated:transform/cte@20261024
+  explanation: Semantics-preserving 'cte' rewrite of base query s6 (allow).
+  dialects: *id001
+- id: GEN-XFORM-u1-comments
+  role: support_analyst
+  sql: 'SELECT p.card_number /* source */ FROM payments p
+
+    -- filter follows
+
+    WHERE p.tenant_id = 1'
+  category: comments_formatting
+  expected: deny
+  reason: sensitive_data
+  provenance: generated:transform/comments@20261024
+  explanation: Semantics-preserving 'comments' rewrite of base query u1 (deny).
+  dialects: *id001
+- id: GEN-XFORM-u1-whitespace
+  role: support_analyst
+  sql: "SELECT\n\t  p.card_number\n\t  FROM\n\t  payments\n\t  p\n\t  WHERE\n\t  p.tenant_id\n\t  =\n\t  1"
+  category: comments_formatting
+  expected: deny
+  reason: sensitive_data
+  provenance: generated:transform/whitespace@20261024
+  explanation: Semantics-preserving 'whitespace' rewrite of base query u1 (deny).
+  dialects: *id001
+- id: GEN-XFORM-u1-lowercase
+  role: support_analyst
+  sql: select p.card_number from payments p where p.tenant_id = 1
+  category: comments_formatting
+  expected: deny
+  reason: sensitive_data
+  provenance: generated:transform/lowercase@20261024
+  explanation: Semantics-preserving 'lowercase' rewrite of base query u1 (deny).
+  dialects: *id001
+- id: GEN-XFORM-u1-mixedcase
+  role: support_analyst
+  sql: sElEcT p.card_number fRoM payments p wHeRe p.tenant_id = 1
+  category: comments_formatting
+  expected: deny
+  reason: sensitive_data
+  provenance: generated:transform/mixedcase@20261024
+  explanation: Semantics-preserving 'mixedcase' rewrite of base query u1 (deny).
+  dialects: *id001
+- id: GEN-XFORM-u1-paren_where
+  role: support_analyst
+  sql: SELECT p.card_number FROM payments p WHERE (p.tenant_id = 1)
+  category: comments_formatting
+  expected: deny
+  reason: sensitive_data
+  provenance: generated:transform/paren_where@20261024
+  explanation: Semantics-preserving 'paren_where' rewrite of base query u1 (deny).
+  dialects: *id001
+- id: GEN-XFORM-u1-derived
+  role: support_analyst
+  sql: SELECT w.* FROM (SELECT p.card_number FROM payments p WHERE p.tenant_id = 1) AS w
+  category: nested_query
+  expected: deny
+  reason: sensitive_data
+  provenance: generated:transform/derived@20261024
+  explanation: Semantics-preserving 'derived' rewrite of base query u1 (deny).
+  dialects: *id001
+- id: GEN-XFORM-u1-cte
+  role: support_analyst
+  sql: WITH w AS (SELECT p.card_number FROM payments p WHERE p.tenant_id = 1) SELECT * FROM w
+  category: nested_query
+  expected: deny
+  reason: sensitive_data
+  provenance: generated:transform/cte@20261024
+  explanation: Semantics-preserving 'cte' rewrite of base query u1 (deny).
+  dialects: *id001
+- id: GEN-XFORM-u2-comments
+  role: support_analyst
+  sql: 'SELECT o.id /* source */ FROM orders o
+
+    -- filter follows
+
+    WHERE o.tenant_id = 2'
+  category: comments_formatting
+  expected: deny
+  reason: tenant_isolation
+  provenance: generated:transform/comments@20261024
+  explanation: Semantics-preserving 'comments' rewrite of base query u2 (deny).
+  dialects: *id001
+- id: GEN-XFORM-u2-whitespace
+  role: support_analyst
+  sql: "SELECT\n\t  o.id\n\t  FROM\n\t  orders\n\t  o\n\t  WHERE\n\t  o.tenant_id\n\t  =\n\t  2"
+  category: comments_formatting
+  expected: deny
+  reason: tenant_isolation
+  provenance: generated:transform/whitespace@20261024
+  explanation: Semantics-preserving 'whitespace' rewrite of base query u2 (deny).
+  dialects: *id001
+- id: GEN-XFORM-u2-lowercase
+  role: support_analyst
+  sql: select o.id from orders o where o.tenant_id = 2
+  category: comments_formatting
+  expected: deny
+  reason: tenant_isolation
+  provenance: generated:transform/lowercase@20261024
+  explanation: Semantics-preserving 'lowercase' rewrite of base query u2 (deny).
+  dialects: *id001
+- id: GEN-XFORM-u2-mixedcase
+  role: support_analyst
+  sql: sElEcT o.id fRoM orders o wHeRe o.tenant_id = 2
+  category: comments_formatting
+  expected: deny
+  reason: tenant_isolation
+  provenance: generated:transform/mixedcase@20261024
+  explanation: Semantics-preserving 'mixedcase' rewrite of base query u2 (deny).
+  dialects: *id001
+- id: GEN-XFORM-u2-paren_where
+  role: support_analyst
+  sql: SELECT o.id FROM orders o WHERE (o.tenant_id = 2)
+  category: comments_formatting
+  expected: deny
+  reason: tenant_isolation
+  provenance: generated:transform/paren_where@20261024
+  explanation: Semantics-preserving 'paren_where' rewrite of base query u2 (deny).
+  dialects: *id001
+- id: GEN-XFORM-u2-derived
+  role: support_analyst
+  sql: SELECT w.* FROM (SELECT o.id FROM orders o WHERE o.tenant_id = 2) AS w
+  category: nested_query
+  expected: deny
+  reason: tenant_isolation
+  provenance: generated:transform/derived@20261024
+  explanation: Semantics-preserving 'derived' rewrite of base query u2 (deny).
+  dialects: *id001
+- id: GEN-XFORM-u2-cte
+  role: support_analyst
+  sql: WITH w AS (SELECT o.id FROM orders o WHERE o.tenant_id = 2) SELECT * FROM w
+  category: nested_query
+  expected: deny
+  reason: tenant_isolation
+  provenance: generated:transform/cte@20261024
+  explanation: Semantics-preserving 'cte' rewrite of base query u2 (deny).
+  dialects: *id001
+- id: GEN-XFORM-u3-comments
+  role: support_analyst
+  sql: 'SELECT o.id /* source */ FROM orders o
+
+    -- filter follows
+
+    WHERE o.tenant_id = 1 OR 1 = 1'
+  category: comments_formatting
+  expected: deny
+  reason: tenant_isolation
+  provenance: generated:transform/comments@20261024
+  explanation: Semantics-preserving 'comments' rewrite of base query u3 (deny).
+  dialects: *id001
+- id: GEN-XFORM-u3-whitespace
+  role: support_analyst
+  sql: "SELECT\n\t  o.id\n\t  FROM\n\t  orders\n\t  o\n\t  WHERE\n\t  o.tenant_id\n\t  =\n\t  1\n\t  OR\n\t  1\n\t  =\n\t\
+    \  1"
+  category: comments_formatting
+  expected: deny
+  reason: tenant_isolation
+  provenance: generated:transform/whitespace@20261024
+  explanation: Semantics-preserving 'whitespace' rewrite of base query u3 (deny).
+  dialects: *id001
+- id: GEN-XFORM-u3-lowercase
+  role: support_analyst
+  sql: select o.id from orders o where o.tenant_id = 1 or 1 = 1
+  category: comments_formatting
+  expected: deny
+  reason: tenant_isolation
+  provenance: generated:transform/lowercase@20261024
+  explanation: Semantics-preserving 'lowercase' rewrite of base query u3 (deny).
+  dialects: *id001
+- id: GEN-XFORM-u3-mixedcase
+  role: support_analyst
+  sql: sElEcT o.id fRoM orders o wHeRe o.tenant_id = 1 oR 1 = 1
+  category: comments_formatting
+  expected: deny
+  reason: tenant_isolation
+  provenance: generated:transform/mixedcase@20261024
+  explanation: Semantics-preserving 'mixedcase' rewrite of base query u3 (deny).
+  dialects: *id001
+- id: GEN-XFORM-u3-paren_where
+  role: support_analyst
+  sql: SELECT o.id FROM orders o WHERE (o.tenant_id = 1 OR 1 = 1)
+  category: comments_formatting
+  expected: deny
+  reason: tenant_isolation
+  provenance: generated:transform/paren_where@20261024
+  explanation: Semantics-preserving 'paren_where' rewrite of base query u3 (deny).
+  dialects: *id001
+- id: GEN-XFORM-u3-derived
+  role: support_analyst
+  sql: SELECT w.* FROM (SELECT o.id FROM orders o WHERE o.tenant_id = 1 OR 1 = 1) AS w
+  category: nested_query
+  expected: deny
+  reason: tenant_isolation
+  provenance: generated:transform/derived@20261024
+  explanation: Semantics-preserving 'derived' rewrite of base query u3 (deny).
+  dialects: *id001
+- id: GEN-XFORM-u3-cte
+  role: support_analyst
+  sql: WITH w AS (SELECT o.id FROM orders o WHERE o.tenant_id = 1 OR 1 = 1) SELECT * FROM w
+  category: nested_query
+  expected: deny
+  reason: tenant_isolation
+  provenance: generated:transform/cte@20261024
+  explanation: Semantics-preserving 'cte' rewrite of base query u3 (deny).
+  dialects: *id001
+- id: GEN-XFORM-u4-comments
+  role: hr_analyst
+  sql: 'SELECT e.full_name, e.salary /* source */ FROM employees e
+
+    -- filter follows
+
+    WHERE e.id > 0'
+  category: comments_formatting
+  expected: deny
+  reason: aggregate_only
+  provenance: generated:transform/comments@20261024
+  explanation: Semantics-preserving 'comments' rewrite of base query u4 (deny).
+  dialects: *id001
+- id: GEN-XFORM-u4-whitespace
+  role: hr_analyst
+  sql: "SELECT\n\t  e.full_name,\n\t  e.salary\n\t  FROM\n\t  employees\n\t  e\n\t  WHERE\n\t  e.id\n\t  >\n\t  0"
+  category: comments_formatting
+  expected: deny
+  reason: aggregate_only
+  provenance: generated:transform/whitespace@20261024
+  explanation: Semantics-preserving 'whitespace' rewrite of base query u4 (deny).
+  dialects: *id001
+- id: GEN-XFORM-u4-lowercase
+  role: hr_analyst
+  sql: select e.full_name, e.salary from employees e where e.id > 0
+  category: comments_formatting
+  expected: deny
+  reason: aggregate_only
+  provenance: generated:transform/lowercase@20261024
+  explanation: Semantics-preserving 'lowercase' rewrite of base query u4 (deny).
+  dialects: *id001
+- id: GEN-XFORM-u4-mixedcase
+  role: hr_analyst
+  sql: sElEcT e.full_name, e.salary fRoM employees e wHeRe e.id > 0
+  category: comments_formatting
+  expected: deny
+  reason: aggregate_only
+  provenance: generated:transform/mixedcase@20261024
+  explanation: Semantics-preserving 'mixedcase' rewrite of base query u4 (deny).
+  dialects: *id001
+- id: GEN-XFORM-u4-paren_where
+  role: hr_analyst
+  sql: SELECT e.full_name, e.salary FROM employees e WHERE (e.id > 0)
+  category: comments_formatting
+  expected: deny
+  reason: aggregate_only
+  provenance: generated:transform/paren_where@20261024
+  explanation: Semantics-preserving 'paren_where' rewrite of base query u4 (deny).
+  dialects: *id001
+- id: GEN-XFORM-u4-derived
+  role: hr_analyst
+  sql: SELECT w.* FROM (SELECT e.full_name, e.salary FROM employees e WHERE e.id > 0) AS w
+  category: nested_query
+  expected: deny
+  reason: aggregate_only
+  provenance: generated:transform/derived@20261024
+  explanation: Semantics-preserving 'derived' rewrite of base query u4 (deny).
+  dialects: *id001
+- id: GEN-XFORM-u4-cte
+  role: hr_analyst
+  sql: WITH w AS (SELECT e.full_name, e.salary FROM employees e WHERE e.id > 0) SELECT * FROM w
+  category: nested_query
+  expected: deny
+  reason: aggregate_only
+  provenance: generated:transform/cte@20261024
+  explanation: Semantics-preserving 'cte' rewrite of base query u4 (deny).
+  dialects: *id001
+- id: GEN-XFORM-u5-comments
+  role: warehouse_analyst
+  sql: 'SELECT e.id /* source */ FROM employees e
+
+    -- filter follows
+
+    WHERE e.id > 0'
+  category: comments_formatting
+  expected: deny
+  reason: unauthorized_table
+  provenance: generated:transform/comments@20261024
+  explanation: Semantics-preserving 'comments' rewrite of base query u5 (deny).
+  dialects: *id001
+- id: GEN-XFORM-u5-whitespace
+  role: warehouse_analyst
+  sql: "SELECT\n\t  e.id\n\t  FROM\n\t  employees\n\t  e\n\t  WHERE\n\t  e.id\n\t  >\n\t  0"
+  category: comments_formatting
+  expected: deny
+  reason: unauthorized_table
+  provenance: generated:transform/whitespace@20261024
+  explanation: Semantics-preserving 'whitespace' rewrite of base query u5 (deny).
+  dialects: *id001
+- id: GEN-XFORM-u5-lowercase
+  role: warehouse_analyst
+  sql: select e.id from employees e where e.id > 0
+  category: comments_formatting
+  expected: deny
+  reason: unauthorized_table
+  provenance: generated:transform/lowercase@20261024
+  explanation: Semantics-preserving 'lowercase' rewrite of base query u5 (deny).
+  dialects: *id001
+- id: GEN-XFORM-u5-mixedcase
+  role: warehouse_analyst
+  sql: sElEcT e.id fRoM employees e wHeRe e.id > 0
+  category: comments_formatting
+  expected: deny
+  reason: unauthorized_table
+  provenance: generated:transform/mixedcase@20261024
+  explanation: Semantics-preserving 'mixedcase' rewrite of base query u5 (deny).
+  dialects: *id001
+- id: GEN-XFORM-u5-paren_where
+  role: warehouse_analyst
+  sql: SELECT e.id FROM employees e WHERE (e.id > 0)
+  category: comments_formatting
+  expected: deny
+  reason: unauthorized_table
+  provenance: generated:transform/paren_where@20261024
+  explanation: Semantics-preserving 'paren_where' rewrite of base query u5 (deny).
+  dialects: *id001
+- id: GEN-XFORM-u5-derived
+  role: warehouse_analyst
+  sql: SELECT w.* FROM (SELECT e.id FROM employees e WHERE e.id > 0) AS w
+  category: nested_query
+  expected: deny
+  reason: unauthorized_table
+  provenance: generated:transform/derived@20261024
+  explanation: Semantics-preserving 'derived' rewrite of base query u5 (deny).
+  dialects: *id001
+- id: GEN-XFORM-u5-cte
+  role: warehouse_analyst
+  sql: WITH w AS (SELECT e.id FROM employees e WHERE e.id > 0) SELECT * FROM w
+  category: nested_query
+  expected: deny
+  reason: unauthorized_table
+  provenance: generated:transform/cte@20261024
+  explanation: Semantics-preserving 'cte' rewrite of base query u5 (deny).
+  dialects: *id001
+- id: GEN-XFORM-u6-comments
+  role: support_analyst
+  sql: 'DELETE /* source */ FROM orders
+
+    -- filter follows
+
+    WHERE tenant_id = 1'
+  category: comments_formatting
+  expected: deny
+  reason: write_statement
+  provenance: generated:transform/comments@20261024
+  explanation: Semantics-preserving 'comments' rewrite of base query u6 (deny).
+  dialects: *id001
+- id: GEN-XFORM-u6-whitespace
+  role: support_analyst
+  sql: "DELETE\n\t  FROM\n\t  orders\n\t  WHERE\n\t  tenant_id\n\t  =\n\t  1"
+  category: comments_formatting
+  expected: deny
+  reason: write_statement
+  provenance: generated:transform/whitespace@20261024
+  explanation: Semantics-preserving 'whitespace' rewrite of base query u6 (deny).
+  dialects: *id001
+- id: GEN-XFORM-u6-lowercase
+  role: support_analyst
+  sql: delete from orders where tenant_id = 1
+  category: comments_formatting
+  expected: deny
+  reason: write_statement
+  provenance: generated:transform/lowercase@20261024
+  explanation: Semantics-preserving 'lowercase' rewrite of base query u6 (deny).
+  dialects: *id001
+- id: GEN-XFORM-u6-mixedcase
+  role: support_analyst
+  sql: dElEtE fRoM orders wHeRe tenant_id = 1
+  category: comments_formatting
+  expected: deny
+  reason: write_statement
+  provenance: generated:transform/mixedcase@20261024
+  explanation: Semantics-preserving 'mixedcase' rewrite of base query u6 (deny).
+  dialects: *id001
+- id: GEN-XFORM-u6-paren_where
+  role: support_analyst
+  sql: DELETE FROM orders WHERE (tenant_id = 1)
+  category: comments_formatting
+  expected: deny
+  reason: write_statement
+  provenance: generated:transform/paren_where@20261024
+  explanation: Semantics-preserving 'paren_where' rewrite of base query u6 (deny).
+  dialects: *id001
+- id: GEN-XFORM-u7-comments
+  role: support_analyst
+  sql: 'SELECT o.id /* source */ FROM orders o JOIN shipments s ON s.order_id = o.id
+
+    -- filter follows
+
+    WHERE o.tenant_id = 1'
+  category: comments_formatting
+  expected: deny
+  reason: tenant_isolation
+  provenance: generated:transform/comments@20261024
+  explanation: Semantics-preserving 'comments' rewrite of base query u7 (deny).
+  dialects: *id001
+- id: GEN-XFORM-u7-whitespace
+  role: support_analyst
+  sql: "SELECT\n\t  o.id\n\t  FROM\n\t  orders\n\t  o\n\t  JOIN\n\t  shipments\n\t  s\n\t  ON\n\t  s.order_id\n\t  =\n\t \
+    \ o.id\n\t  WHERE\n\t  o.tenant_id\n\t  =\n\t  1"
+  category: comments_formatting
+  expected: deny
+  reason: tenant_isolation
+  provenance: generated:transform/whitespace@20261024
+  explanation: Semantics-preserving 'whitespace' rewrite of base query u7 (deny).
+  dialects: *id001
+- id: GEN-XFORM-u7-lowercase
+  role: support_analyst
+  sql: select o.id from orders o join shipments s on s.order_id = o.id where o.tenant_id = 1
+  category: comments_formatting
+  expected: deny
+  reason: tenant_isolation
+  provenance: generated:transform/lowercase@20261024
+  explanation: Semantics-preserving 'lowercase' rewrite of base query u7 (deny).
+  dialects: *id001
+- id: GEN-XFORM-u7-mixedcase
+  role: support_analyst
+  sql: sElEcT o.id fRoM orders o jOiN shipments s oN s.order_id = o.id wHeRe o.tenant_id = 1
+  category: comments_formatting
+  expected: deny
+  reason: tenant_isolation
+  provenance: generated:transform/mixedcase@20261024
+  explanation: Semantics-preserving 'mixedcase' rewrite of base query u7 (deny).
+  dialects: *id001
+- id: GEN-XFORM-u7-paren_where
+  role: support_analyst
+  sql: SELECT o.id FROM orders o JOIN shipments s ON s.order_id = o.id WHERE (o.tenant_id = 1)
+  category: comments_formatting
+  expected: deny
+  reason: tenant_isolation
+  provenance: generated:transform/paren_where@20261024
+  explanation: Semantics-preserving 'paren_where' rewrite of base query u7 (deny).
+  dialects: *id001
+- id: GEN-XFORM-u7-derived
+  role: support_analyst
+  sql: SELECT w.* FROM (SELECT o.id FROM orders o JOIN shipments s ON s.order_id = o.id WHERE o.tenant_id = 1) AS w
+  category: nested_query
+  expected: deny
+  reason: tenant_isolation
+  provenance: generated:transform/derived@20261024
+  explanation: Semantics-preserving 'derived' rewrite of base query u7 (deny).
+  dialects: *id001
+- id: GEN-XFORM-u7-cte
+  role: support_analyst
+  sql: WITH w AS (SELECT o.id FROM orders o JOIN shipments s ON s.order_id = o.id WHERE o.tenant_id = 1) SELECT * FROM w
+  category: nested_query
+  expected: deny
+  reason: tenant_isolation
+  provenance: generated:transform/cte@20261024
+  explanation: Semantics-preserving 'cte' rewrite of base query u7 (deny).
+  dialects: *id001
+- id: GEN-XFORM-u8-comments
+  role: support_analyst
+  sql: 'SELECT c.phone /* source */ FROM customers c
+
+    -- filter follows
+
+    WHERE c.tenant_id = 1'
+  category: comments_formatting
+  expected: deny
+  reason: unauthorized_column
+  provenance: generated:transform/comments@20261024
+  explanation: Semantics-preserving 'comments' rewrite of base query u8 (deny).
+  dialects: *id001
+- id: GEN-XFORM-u8-whitespace
+  role: support_analyst
+  sql: "SELECT\n\t  c.phone\n\t  FROM\n\t  customers\n\t  c\n\t  WHERE\n\t  c.tenant_id\n\t  =\n\t  1"
+  category: comments_formatting
+  expected: deny
+  reason: unauthorized_column
+  provenance: generated:transform/whitespace@20261024
+  explanation: Semantics-preserving 'whitespace' rewrite of base query u8 (deny).
+  dialects: *id001
+- id: GEN-XFORM-u8-lowercase
+  role: support_analyst
+  sql: select c.phone from customers c where c.tenant_id = 1
+  category: comments_formatting
+  expected: deny
+  reason: unauthorized_column
+  provenance: generated:transform/lowercase@20261024
+  explanation: Semantics-preserving 'lowercase' rewrite of base query u8 (deny).
+  dialects: *id001
+- id: GEN-XFORM-u8-mixedcase
+  role: support_analyst
+  sql: sElEcT c.phone fRoM customers c wHeRe c.tenant_id = 1
+  category: comments_formatting
+  expected: deny
+  reason: unauthorized_column
+  provenance: generated:transform/mixedcase@20261024
+  explanation: Semantics-preserving 'mixedcase' rewrite of base query u8 (deny).
+  dialects: *id001
+- id: GEN-XFORM-u8-paren_where
+  role: support_analyst
+  sql: SELECT c.phone FROM customers c WHERE (c.tenant_id = 1)
+  category: comments_formatting
+  expected: deny
+  reason: unauthorized_column
+  provenance: generated:transform/paren_where@20261024
+  explanation: Semantics-preserving 'paren_where' rewrite of base query u8 (deny).
+  dialects: *id001
+- id: GEN-XFORM-u8-derived
+  role: support_analyst
+  sql: SELECT w.* FROM (SELECT c.phone FROM customers c WHERE c.tenant_id = 1) AS w
+  category: nested_query
+  expected: deny
+  reason: unauthorized_column
+  provenance: generated:transform/derived@20261024
+  explanation: Semantics-preserving 'derived' rewrite of base query u8 (deny).
+  dialects: *id001
+- id: GEN-XFORM-u8-cte
+  role: support_analyst
+  sql: WITH w AS (SELECT c.phone FROM customers c WHERE c.tenant_id = 1) SELECT * FROM w
+  category: nested_query
+  expected: deny
+  reason: unauthorized_column
+  provenance: generated:transform/cte@20261024
+  explanation: Semantics-preserving 'cte' rewrite of base query u8 (deny).
+  dialects: *id001