sqlguard-ninja 0.1.0__tar.gz

sqlguard_ninja-0.1.0/.gitignore

@@ -0,0 +1,30 @@
+# Python
+__pycache__/
+*.py[cod]
+*.egg-info/
+build/
+dist/
+.eggs/
+# Environments
+.venv/
+.venvs/
+venv/
+# Tooling caches
+.pytest_cache/
+.mypy_cache/
+.ruff_cache/
+.hypothesis/
+.coverage
+.coverage.*
+coverage.xml
+htmlcov/
+# Local artefacts
+/results/
+*.sqlite3
+*.db
+.pgdata/
+.env
+.env.*
+!.env.example
+audit*.jsonl
+.pytest_tmp/

sqlguard_ninja-0.1.0/CHANGELOG.md

@@ -0,0 +1,41 @@
+# Changelog
+
+All notable changes are documented here. The project follows
+[Semantic Versioning](https://semver.org/); before 1.0, minor versions may change the API.
+
+## [0.1.0] — 2026-10-24
+
+First release.
+
+### Added
+* Policy schema v1: catalog, classification labels, roles, tenant settings, function policy,
+  limits, cost thresholds, disclosure mode. Policies are validated on load.
+* Guard and rules on sqlglot 30: read-only statements, system catalogs, functions,
+  table/column grants, privacy labels (deny / aggregate-only / review, JSON paths, small
+  cohort, minimisation), tenant isolation, structure limits, static cost score.
+* `SQLCheckpoint` with block / review / audit modes, approvals bound to the SQL hash
+  (single use, expiry, no self-approval), retry lock-out, redacted audit events.
+* LangChain tool, LangGraph nodes and router, FastAPI router, read-only executors.
+* PostgreSQL `EXPLAIN (FORMAT JSON)` inspector with guard gating and a read-only,
+  time-limited, rolled-back transaction.
+* Benchmark corpus v1.0.0 (530 cases, 1,002 evaluations), seeded generator, metrics,
+  adapters (native, callable, isolated external workers for three existing tools), JSON
+  and Markdown reports, baseline comparison with a label-change gate.
+* `sqlninja` CLI and a composite GitHub Action.
+
+### Known limitations
+* The benchmark corpus does not contain cases for two categories: **restricted functions** (e.g. calls to server file-access, sleep, dynamic-SQL or administrative functions) and **system catalogs** (PostgreSQL `pg_catalog`/`information_schema`, SQLite `sqlite_master`/`sqlite_schema`, in qualified, joined, CTE and nested positions). The corresponding rules (`function.*`, `catalog.system_object`) ship and run by default; their mechanics are unit-tested with fictitious function names, but their detection is not measured by the benchmark.
+* Writes are always denied; only PostgreSQL and SQLite are tested.
+
+### Packaging
+* The reference corpus and policy are bundled in the wheel (`builtin:v1`, `builtin:retail_saas`).
+* Published to PyPI through GitHub Actions Trusted Publishing (OIDC).
+
+### Fixed during development (each with a regression test)
+* Unknown select-list columns were allowed when qualification aliased them to themselves.
+* `Guard.validate` raised on lone UTF-16 surrogates.
+* Quoted mixed-case identifiers were re-lowercased, so PostgreSQL `"Orders"` matched `orders`.
+* A cast of the tenant column was accepted as a tenant pin.
+* LangGraph nodes did not receive the run config (it needs a `RunnableConfig` annotation).
+* The shared SQLite connection could not be used from FastAPI worker threads.
+* CLI output crashed on cp1252 consoles.

sqlguard_ninja-0.1.0/LICENSE

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

sqlguard_ninja-0.1.0/PKG-INFO

@@ -0,0 +1,370 @@
+Metadata-Version: 2.5
+Name: sqlguard-ninja
+Version: 0.1.0
+Summary: Security testing, policy enforcement, agent integration, privacy analysis and CI benchmarking for LLM-generated SQL.
+Project-URL: Homepage, https://github.com/Pratik653/SQLGuard_Ninjapy
+Project-URL: Documentation, https://github.com/Pratik653/SQLGuard_Ninjapy/tree/main/docs
+Project-URL: Issues, https://github.com/Pratik653/SQLGuard_Ninjapy/issues
+Author: SQLGuard Ninja contributors
+License-Expression: Apache-2.0
+License-File: LICENSE
+License-File: THIRD_PARTY_NOTICES.md
+Keywords: benchmark,guardrail,langchain,langgraph,llm,privacy,security,sql,sqlglot,text-to-sql
+Classifier: Development Status :: 3 - Alpha
+Classifier: Intended Audience :: Developers
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: SQL
+Classifier: Topic :: Database
+Classifier: Topic :: Security
+Classifier: Typing :: Typed
+Requires-Python: >=3.11
+Requires-Dist: pydantic<3.0,>=2.6
+Requires-Dist: pyyaml>=6.0
+Requires-Dist: sqlglot<31.0,>=30.0
+Provides-Extra: all
+Requires-Dist: fastapi>=0.110; extra == 'all'
+Requires-Dist: langchain-core>=0.3; extra == 'all'
+Requires-Dist: langgraph>=0.2; extra == 'all'
+Requires-Dist: psycopg[binary]>=3.1; extra == 'all'
+Provides-Extra: dev
+Requires-Dist: build>=1.2; extra == 'dev'
+Requires-Dist: fastapi>=0.110; extra == 'dev'
+Requires-Dist: httpx>=0.27; extra == 'dev'
+Requires-Dist: hypothesis>=6.100; extra == 'dev'
+Requires-Dist: langchain-core>=0.3; extra == 'dev'
+Requires-Dist: langgraph>=0.2; extra == 'dev'
+Requires-Dist: mypy>=1.10; extra == 'dev'
+Requires-Dist: psycopg[binary]>=3.1; extra == 'dev'
+Requires-Dist: pytest-cov>=5.0; extra == 'dev'
+Requires-Dist: pytest>=8.0; extra == 'dev'
+Requires-Dist: ruff>=0.6; extra == 'dev'
+Requires-Dist: types-pyyaml; extra == 'dev'
+Provides-Extra: fastapi
+Requires-Dist: fastapi>=0.110; extra == 'fastapi'
+Provides-Extra: langchain
+Requires-Dist: langchain-core>=0.3; extra == 'langchain'
+Provides-Extra: langgraph
+Requires-Dist: langchain-core>=0.3; extra == 'langgraph'
+Requires-Dist: langgraph>=0.2; extra == 'langgraph'
+Provides-Extra: postgres
+Requires-Dist: psycopg[binary]>=3.1; extra == 'postgres'
+Description-Content-Type: text/markdown
+
+# SQLGuard Ninja
+
+**Security testing, policy enforcement, agent integration, privacy analysis and CI
+benchmarking for LLM-generated SQL.**
+
+[![CI](https://github.com/Pratik653/SQLGuard_Ninjapy/actions/workflows/ci.yml/badge.svg)](https://github.com/Pratik653/SQLGuard_Ninjapy/actions/workflows/ci.yml)
+[![PyPI](https://img.shields.io/pypi/v/sqlguard-ninja)](https://pypi.org/project/sqlguard-ninja/)
+![Python](https://img.shields.io/badge/python-3.11%20%7C%203.12%20%7C%203.13-blue)
+![License](https://img.shields.io/badge/license-Apache--2.0-green)
+
+When an LLM writes SQL, the system prompt is not a security boundary. SQLGuard Ninja sits
+between the model and the database. It checks every statement against a declared policy for
+the *authenticated* caller: which tables and columns a role may use, which data classes may
+appear only in aggregates or only after human approval, and which tenant the caller belongs
+to. It records an audit trail and gives the agent an explanation it can act on.
+
+It ships with a labelled benchmark corpus (530 cases, 1,002 dialect evaluations) and a
+regression gate for CI. The same benchmark harness can evaluate other open-source guards
+side by side.
+
+> **One layer, not the only one.** Static SQL inspection cannot guarantee database security.
+> Use a read-only least-privilege role, row-level security and statement timeouts as well.
+> See the [threat model](docs/security/THREAT_MODEL.md).
+
+## What it does
+
+| Workstream | What you get | Status |
+|---|---|---|
+| **Policy engine** | Read-only enforcement, table/column grants, tenant isolation, function and catalog rules, structural limits. Built on [sqlglot](https://github.com/tobymao/sqlglot). Fails closed when analysis is incomplete. | PostgreSQL + SQLite tested |
+| **Privacy pack** | Explicit classification labels, `deny` / `aggregate_only` / `review` per role, JSON-path labels, small-cohort review, minimisation hints and alternatives | implemented |
+| **Agent integrations** | `SQLCheckpoint` with block / review / audit modes, hash-bound single-use approvals, retry lock-out, redacted audit events. LangChain tool, LangGraph nodes, FastAPI router | implemented |
+| **Benchmark engine** | Versioned corpus, metrics (recall, precision, FPR, FNR, exact match, per category/dialect, latency percentiles), adapters for native, callable and isolated external validators, JSON and Markdown reports | implemented |
+| **Query cost** | Explainable static score; optional PostgreSQL `EXPLAIN (FORMAT JSON)` inspection, gated and read-only | implemented |
+| **CI** | Composite GitHub Action and CLI gate: security, usability, label-change and error regressions against an approved baseline | implemented |
+
+Not yet included: governed writes (all writes are denied in v0.1); benchmark cases for
+restricted functions and system catalogs (the rules exist, but the corpus does not cover
+them); dialects beyond PostgreSQL and SQLite (they parse, but are untested). Full list:
+[KNOWN_LIMITATIONS.md](KNOWN_LIMITATIONS.md).
+
+## Architecture
+
+```mermaid
+flowchart LR
+    subgraph App["Your application"]
+      Auth["Auth layer"] --> Ctx["RequestContext<br/>(principal, role, tenant)"]
+      LLM["LLM / agent"] -->|SQL text| CP
+      Ctx --> CP["SQLCheckpoint<br/>block / review / audit"]
+    end
+    CP --> G["Guard"]
+    G --> AN["Analyser<br/>sqlglot qualify + scopes"]
+    AN --> R1["Statement / catalog / function rules"]
+    AN --> R2["Table and column grants"]
+    AN --> R3["Privacy labels"]
+    AN --> R4["Tenant pins"]
+    AN --> R5["Limits + static cost"]
+    CP -->|authorized only| EX["Read-only executor"] --> DB[("Database<br/>grants, RLS, timeouts")]
+    CP --> AU["Audit sink<br/>hash + redacted SQL"]
+    CP -.review.-> AP["ApprovalQueue (human)"]
+    G -.ALLOW only.-> PI["PostgreSQL EXPLAIN inspector"]
+    subgraph Bench["Benchmark + CI"]
+      DS["Corpus v1"] --> RUN["Runner"] --> ADP["Adapters: native, callable,<br/>isolated external workers"]
+      RUN --> RES["Result JSON / Markdown"] --> CMP["Baseline compare"] --> GATE["GitHub Action gate"]
+    end
+```
+
+Design decisions and their trade-offs are recorded in
+[ARCHITECTURE_DECISIONS.md](docs/architecture/ARCHITECTURE_DECISIONS.md).
+
+## Five-minute quick start
+
+```bash
+python -m pip install sqlguard-ninja            # core: sqlglot, pydantic, PyYAML
+python -m pip install "sqlguard-ninja[all]"     # + LangChain, LangGraph, FastAPI, psycopg
+```
+
+Extras: `langchain`, `langgraph`, `fastapi`, `postgres`, `all`. Python 3.11+.
+
+Validate a query against the bundled reference policy (`builtin:retail_saas`, a synthetic
+multi-tenant retail schema):
+
+```bash
+sqlninja validate --policy builtin:retail_saas --role support_analyst --tenant 1   --sql "SELECT o.id FROM orders o WHERE o.tenant_id = 1 OR 1 = 1"
+```
+
+```
+DENY:
+  [deny] tenant.missing_predicate: Every read of table 'orders' must filter on the caller's tenant. Suggestion: Add `o.tenant_id = :tenant_id` to the WHERE clause of the scope that reads this table.
+```
+
+Exit codes: 0 allow, 1 deny, 3 review, 2 usage error.
+
+Run the bundled benchmark corpus, then start your own project:
+
+```bash
+sqlninja benchmark run --dataset builtin:v1 --output results/native.json
+sqlninja init my-project && cd my-project
+sqlninja benchmark run --config sqlninja.yaml
+```
+
+The runnable demos live in the repository (deterministic; no API key needed):
+
+```bash
+git clone https://github.com/Pratik653/SQLGuard_Ninjapy.git && cd SQLGuard_Ninjapy
+python -m pip install -e ".[all]"
+python examples/sdk/quickstart.py
+python examples/sqlite/text_to_sql_demo.py
+python examples/langgraph/sql_agent_demo.py
+```
+
+## Python SDK
+
+```python
+from sqlguard_ninja import Guard, Policy
+
+from sqlguard_ninja.benchmarking.builtin import resolve
+
+guard = Guard(Policy.from_file(resolve("builtin:retail_saas", "policy")))
+result = guard.validate(
+    "SELECT department, AVG(salary) FROM employees GROUP BY department",
+    role="hr_analyst",
+    dialect="postgres",
+)
+result.allowed      # True
+result.findings     # () - structured Finding objects with rule_id, action, message, remediation
+
+guard.validate("SELECT full_name, salary FROM employees", role="hr_analyst").explain()
+# DENY:
+#   [deny] privacy.aggregate_only: The column 'employees.salary' may only be used inside
+#   statistical aggregates (COUNT, SUM, AVG, ...), not as individual values. ...
+```
+
+## LangGraph
+
+```python
+from sqlguard_ninja.integrations import RequestContext, SQLCheckpoint
+from sqlguard_ninja.integrations.langgraph import (
+    CONTEXT_KEY, make_execute_node, make_guard_node, route_after_guard)
+
+checkpoint = SQLCheckpoint(guard, mode="block", max_denied_attempts=3)
+graph.add_node("guard", make_guard_node(checkpoint))
+graph.add_node("execute", make_execute_node(checkpoint, executor))   # re-validates
+graph.add_conditional_edges("guard", route_after_guard(3),
+                            {"execute": "execute", "revise": "generate", "end": END})
+
+ctx = RequestContext(principal=user.id, role=user.role, tenant_id=user.tenant_id)
+app.invoke(state, config={"configurable": {CONTEXT_KEY: ctx}})       # nodes cannot alter config
+```
+
+More in [AGENT_INTEGRATION.md](docs/guides/AGENT_INTEGRATION.md): the LangChain tool (its
+schema accepts only `query`), the FastAPI router, review-mode approvals and audit sinks.
+
+## Privacy policies
+
+Sensitivity comes from labels **you** assign in the policy, never from column names, and
+access is resolved per role:
+
+```yaml
+labels:
+  payment_card: {sensitivity: critical, masking: use card_last4 and card_brand}
+  financial:    {sensitivity: high}
+catalog:
+  tables:
+    payments:
+      tenant_column: tenant_id
+      columns:
+        card_number: {labels: [payment_card], alternatives: [card_last4]}
+        card_last4: text
+roles:
+  support_analyst:
+    tables: {payments: [id, tenant_id, card_last4, card_brand, amount, status]}
+    labels: {payment_card: deny, financial: deny}
+  hr_analyst:
+    tables: {employees: "*"}
+    labels: {hr: allow, financial: aggregate_only}   # salary only inside COUNT/SUM/AVG
+```
+
+```text
+support_analyst> SELECT p.card_number FROM payments p WHERE p.tenant_id = 1
+DENY:
+  [deny] privacy.label_denied: The column 'payments.card_number' contains classified data (payment_card) that this role may not access. Suggestion: Use column 'payments.card_last4' instead. ...
+
+hr_analyst> SELECT AVG(salary) FROM employees WHERE id = 7
+REVIEW:
+  [review] privacy.small_cohort: An aggregate of restricted data is filtered or grouped by an identifying column, which can reveal individual values. ...
+```
+
+Labels also apply to paths inside JSON columns (`profile->'health'->>'allergies'`).
+`sqlninja policy suggest` proposes labels from column names for a human to review; those
+suggestions are never enforced. This is a technical control, not a certification of GDPR
+compliance. Full semantics: [POLICY_REFERENCE.md](docs/guides/POLICY_REFERENCE.md).
+
+## Query cost analysis
+
+Every validation includes an explainable static score that uses the catalog's
+`estimated_rows`:
+
+```text
+platform_admin> SELECT o.id, i.id FROM orders o CROSS JOIN order_items i
+DENY:
+  [deny] cost.static_score: Estimated query cost risk is 100/100: join with i has no join condition (Cartesian product); o has an estimated 10,000,000 rows and is read without a filter; ...
+```
+
+Optionally, compare it with PostgreSQL's planner. This runs `EXPLAIN (FORMAT JSON)` only,
+never `ANALYZE`, and only on SQL the guard allowed, inside a read-only, time-limited,
+rolled-back transaction:
+
+```python
+from sqlguard_ninja.query_cost.postgres import PostgresPlanInspector
+report = PostgresPlanInspector(guard, lambda: psycopg.connect(READER_DSN)).inspect(
+    sql, role="support_analyst", context={"tenant_id": 1})
+report.total_cost, report.plan_rows, report.static.score, report.findings
+```
+
+See [QUERY_COST.md](docs/guides/QUERY_COST.md) and `examples/postgresql/plan_inspection_demo.py`.
+
+## Benchmark
+
+```bash
+sqlninja benchmark run --dataset builtin:v1 --adapter native
+python scripts/setup_external_adapters.py          # (repository) isolated venvs for other tools
+sqlninja benchmark run --dataset builtin:v1 --adapter external:sql-guardrail
+sqlninja benchmark compare --baseline benchmarks/baselines/native.json --candidate results/latest.json
+```
+
+Results for corpus v1.0.0 (Windows 11, Python 3.11, 1,002 evaluations). Details and raw files:
+[RESULTS_v1.md](docs/benchmarks/RESULTS_v1.md).
+
+| Validator | Recall | Precision | FPR | Recall / FPR within declared capability | p95 ms |
+|---|---:|---:|---:|---:|---:|
+| SQLGuard Ninja 0.1.0 | 100.0% | 100.0% | 0.0% | 100.0% / 0.0% | 2.15 |
+| sql-guardrail 0.5.2 | 98.6% | 86.6% | 21.2% | 98.3% / 19.3% | 1.72 |
+| agent-sql-guard 0.2.0 | 67.9% | 86.6% | 14.5% | 89.5% / 17.2% | 1.26 |
+| krish2105/sqlguard 0.1.0 | 65.8% | 91.4% | 8.6% | 83.5% / 5.2% | 1.22 |
+
+**Read the native row with care.** The corpus and the engine were developed together, and
+every disagreement was triaged by fixing the engine or correcting a label (both are logged).
+100% shows consistency with the documented semantics, not independent detection quality. The
+other tools have smaller policy models (no roles, labels, aggregate-only access or review), so
+the "within capability" column is the fairer comparison. Methodology and threats to validity:
+[BENCHMARK_METHODOLOGY.md](docs/guides/BENCHMARK_METHODOLOGY.md).
+
+## How it relates to existing tools
+
+SQLGuard Ninja uses **sqlglot** for parsing, dialects and scope analysis, and does not
+re-implement them. [sql-guardrail](https://github.com/nickusevich/sql-guardrail) is a
+thorough read-only validator with a tautology catch-all, which this project does not
+duplicate. [agent-sql-guard](https://github.com/sakura-sky/sql-guard) has a careful
+schema-less PII denylist. What SQLGuard Ninja adds: role- and label-based policies, the agent
+checkpoint contract, a shared benchmark with isolated adapters, planner inspection, and the
+CI gate. Full comparison: [COMPETITIVE_ANALYSIS.md](docs/research/COMPETITIVE_ANALYSIS.md).
+
+## Security limitations
+
+* Static inspection can be wrong where sqlglot and the real database parse SQL differently.
+  Only PostgreSQL and SQLite are tested.
+* It cannot see inside views or user-defined functions, and it does not stop inference
+  across many permitted queries.
+* Cost scores and planner estimates are indicators, not guarantees.
+* v0.1 denies all writes.
+* The benchmark has no restricted-function or system-catalog cases yet. The rules exist,
+  but those two categories are not measured.
+
+Use database grants, row-level security and timeouts as the authoritative controls. See the
+[threat model](docs/security/THREAT_MODEL.md) and [KNOWN_LIMITATIONS.md](KNOWN_LIMITATIONS.md).
+
+## Roadmap
+
+Next: restricted-function and system-catalog benchmark cases, an independent held-out
+corpus, lineage-aware aggregate checks, and tenant predicate push-down. Later: governed
+writes, more tested dialects, and SARIF output. Details in [ROADMAP.md](ROADMAP.md).
+
+## Links
+
+* Repository: https://github.com/Pratik653/SQLGuard_Ninjapy
+* Releases: https://github.com/Pratik653/SQLGuard_Ninjapy/releases
+* PyPI: https://pypi.org/project/sqlguard-ninja/
+* Issues: https://github.com/Pratik653/SQLGuard_Ninjapy/issues
+* Security policy: [SECURITY.md](SECURITY.md) · Contributing: [CONTRIBUTING.md](CONTRIBUTING.md)
+
+## Documentation
+
+* [Policy reference](docs/guides/POLICY_REFERENCE.md)
+* [Agent integration](docs/guides/AGENT_INTEGRATION.md)
+* [Query cost](docs/guides/QUERY_COST.md)
+* [CI integration](docs/guides/CI_INTEGRATION.md)
+* [Benchmark methodology](docs/guides/BENCHMARK_METHODOLOGY.md)
+* [Threat model](docs/security/THREAT_MODEL.md)
+* [Architecture decisions](docs/architecture/ARCHITECTURE_DECISIONS.md)
+* [Known limitations](KNOWN_LIMITATIONS.md) · [Roadmap](ROADMAP.md) · [Changelog](CHANGELOG.md)
+
+## Supported versions
+
+* Python 3.11, 3.12, 3.13 (CI matrix on Linux and Windows).
+* SQL dialects: **PostgreSQL** (tested against PostgreSQL 16) and **SQLite**. Other sqlglot
+  dialects parse but are experimental and untested.
+
+## Development
+
+```bash
+python -m pip install -e ".[dev]"
+ruff check src tests scripts examples && ruff format --check src tests scripts examples
+mypy
+pytest                          # PostgreSQL tests run if SQLNINJA_PG_DSN is set or pgserver is installed
+python scripts/generate_corpus.py --check
+```
+
+See [CONTRIBUTING.md](CONTRIBUTING.md). Report vulnerabilities privately per
+[SECURITY.md](SECURITY.md).
+
+## Licence
+
+Apache-2.0. No third-party code is vendored; dependencies and their licences are listed in
+[THIRD_PARTY_NOTICES.md](THIRD_PARTY_NOTICES.md). All benchmark data is synthetic.