sqlguard-ninja 0.1.0__tar.gz → 0.1.1__tar.gz

{sqlguard_ninja-0.1.0 → sqlguard_ninja-0.1.1}/CHANGELOG.md

@@ -3,6 +3,26 @@
 All notable changes are documented here. The project follows
 [Semantic Versioning](https://semver.org/); before 1.0, minor versions may change the API.
 
+## [0.1.1] — 2026-10-24
+
+Documentation and governance patch. No changes to policy decisions.
+
+### Fixed
+* README links were relative and broke on the PyPI project page. They are now absolute
+  GitHub URLs, and a test keeps relative links out of the README.
+
+### Added
+* `docs/security/STATIC_ANALYSIS_LIMITS.md`: limits of static analysis, compensating
+  controls, and a dialect support matrix (supported / experimental / untested).
+* `docs/guides/BENCHMARK_BIAS_REVIEW.md`: quantified review of corpus v1 bias
+  (co-development, generated labels, input distribution, outcome imbalance).
+* `benchmarks/datasets/external/`: intake rules for independently sourced, held-out
+  evaluation sets (no cases yet).
+* `.github/CODEOWNERS`, and branch protection on `main` (pull requests and CI required).
+
+### Unchanged known limitations
+* No restricted-function or system-catalog benchmark cases; no external dataset yet.
+
 ## [0.1.0] — 2026-10-24
 
 First release.

{sqlguard_ninja-0.1.0 → sqlguard_ninja-0.1.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: sqlguard-ninja
-Version: 0.1.0
+Version: 0.1.1
 Summary: Security testing, policy enforcement, agent integration, privacy analysis and CI benchmarking for LLM-generated SQL.
 Project-URL: Homepage, https://github.com/Pratik653/SQLGuard_Ninjapy
 Project-URL: Documentation, https://github.com/Pratik653/SQLGuard_Ninjapy/tree/main/docs
@@ -76,7 +76,7 @@ side by side.
 
 > **One layer, not the only one.** Static SQL inspection cannot guarantee database security.
 > Use a read-only least-privilege role, row-level security and statement timeouts as well.
-> See the [threat model](docs/security/THREAT_MODEL.md).
+> See the [threat model](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/security/THREAT_MODEL.md).
 
 ## What it does
 
@@ -92,7 +92,7 @@ side by side.
 Not yet included: governed writes (all writes are denied in v0.1); benchmark cases for
 restricted functions and system catalogs (the rules exist, but the corpus does not cover
 them); dialects beyond PostgreSQL and SQLite (they parse, but are untested). Full list:
-[KNOWN_LIMITATIONS.md](KNOWN_LIMITATIONS.md).
+[KNOWN_LIMITATIONS.md](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/KNOWN_LIMITATIONS.md).
 
 ## Architecture
 
@@ -121,7 +121,7 @@ flowchart LR
 ```
 
 Design decisions and their trade-offs are recorded in
-[ARCHITECTURE_DECISIONS.md](docs/architecture/ARCHITECTURE_DECISIONS.md).
+[ARCHITECTURE_DECISIONS.md](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/architecture/ARCHITECTURE_DECISIONS.md).
 
 ## Five-minute quick start
 
@@ -203,7 +203,7 @@ ctx = RequestContext(principal=user.id, role=user.role, tenant_id=user.tenant_id
 app.invoke(state, config={"configurable": {CONTEXT_KEY: ctx}})       # nodes cannot alter config
 ```
 
-More in [AGENT_INTEGRATION.md](docs/guides/AGENT_INTEGRATION.md): the LangChain tool (its
+More in [AGENT_INTEGRATION.md](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/guides/AGENT_INTEGRATION.md): the LangChain tool (its
 schema accepts only `query`), the FastAPI router, review-mode approvals and audit sinks.
 
 ## Privacy policies
@@ -244,7 +244,7 @@ REVIEW:
 Labels also apply to paths inside JSON columns (`profile->'health'->>'allergies'`).
 `sqlninja policy suggest` proposes labels from column names for a human to review; those
 suggestions are never enforced. This is a technical control, not a certification of GDPR
-compliance. Full semantics: [POLICY_REFERENCE.md](docs/guides/POLICY_REFERENCE.md).
+compliance. Full semantics: [POLICY_REFERENCE.md](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/guides/POLICY_REFERENCE.md).
 
 ## Query cost analysis
 
@@ -268,7 +268,7 @@ report = PostgresPlanInspector(guard, lambda: psycopg.connect(READER_DSN)).inspe
 report.total_cost, report.plan_rows, report.static.score, report.findings
 ```
 
-See [QUERY_COST.md](docs/guides/QUERY_COST.md) and `examples/postgresql/plan_inspection_demo.py`.
+See [QUERY_COST.md](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/guides/QUERY_COST.md) and `examples/postgresql/plan_inspection_demo.py`.
 
 ## Benchmark
 
@@ -280,7 +280,7 @@ sqlninja benchmark compare --baseline benchmarks/baselines/native.json --candida
 ```
 
 Results for corpus v1.0.0 (Windows 11, Python 3.11, 1,002 evaluations). Details and raw files:
-[RESULTS_v1.md](docs/benchmarks/RESULTS_v1.md).
+[RESULTS_v1.md](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/benchmarks/RESULTS_v1.md).
 
 | Validator | Recall | Precision | FPR | Recall / FPR within declared capability | p95 ms |
 |---|---:|---:|---:|---:|---:|
@@ -294,7 +294,7 @@ every disagreement was triaged by fixing the engine or correcting a label (both
 100% shows consistency with the documented semantics, not independent detection quality. The
 other tools have smaller policy models (no roles, labels, aggregate-only access or review), so
 the "within capability" column is the fairer comparison. Methodology and threats to validity:
-[BENCHMARK_METHODOLOGY.md](docs/guides/BENCHMARK_METHODOLOGY.md).
+[BENCHMARK_METHODOLOGY.md](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/guides/BENCHMARK_METHODOLOGY.md).
 
 ## How it relates to existing tools
 
@@ -304,7 +304,7 @@ thorough read-only validator with a tautology catch-all, which this project does
 duplicate. [agent-sql-guard](https://github.com/sakura-sky/sql-guard) has a careful
 schema-less PII denylist. What SQLGuard Ninja adds: role- and label-based policies, the agent
 checkpoint contract, a shared benchmark with isolated adapters, planner inspection, and the
-CI gate. Full comparison: [COMPETITIVE_ANALYSIS.md](docs/research/COMPETITIVE_ANALYSIS.md).
+CI gate. Full comparison: [COMPETITIVE_ANALYSIS.md](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/research/COMPETITIVE_ANALYSIS.md).
 
 ## Security limitations
 
@@ -318,13 +318,14 @@ CI gate. Full comparison: [COMPETITIVE_ANALYSIS.md](docs/research/COMPETITIVE_AN
   but those two categories are not measured.
 
 Use database grants, row-level security and timeouts as the authoritative controls. See the
-[threat model](docs/security/THREAT_MODEL.md) and [KNOWN_LIMITATIONS.md](KNOWN_LIMITATIONS.md).
+[threat model](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/security/THREAT_MODEL.md), [limits of static analysis](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/security/STATIC_ANALYSIS_LIMITS.md),
+the [benchmark bias review](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/guides/BENCHMARK_BIAS_REVIEW.md) and [KNOWN_LIMITATIONS.md](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/KNOWN_LIMITATIONS.md).
 
 ## Roadmap
 
 Next: restricted-function and system-catalog benchmark cases, an independent held-out
 corpus, lineage-aware aggregate checks, and tenant predicate push-down. Later: governed
-writes, more tested dialects, and SARIF output. Details in [ROADMAP.md](ROADMAP.md).
+writes, more tested dialects, and SARIF output. Details in [ROADMAP.md](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/ROADMAP.md).
 
 ## Links
 
@@ -332,18 +333,20 @@ writes, more tested dialects, and SARIF output. Details in [ROADMAP.md](ROADMAP.
 * Releases: https://github.com/Pratik653/SQLGuard_Ninjapy/releases
 * PyPI: https://pypi.org/project/sqlguard-ninja/
 * Issues: https://github.com/Pratik653/SQLGuard_Ninjapy/issues
-* Security policy: [SECURITY.md](SECURITY.md) · Contributing: [CONTRIBUTING.md](CONTRIBUTING.md)
+* Security policy: [SECURITY.md](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/SECURITY.md) · Contributing: [CONTRIBUTING.md](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/CONTRIBUTING.md)
 
 ## Documentation
 
-* [Policy reference](docs/guides/POLICY_REFERENCE.md)
-* [Agent integration](docs/guides/AGENT_INTEGRATION.md)
-* [Query cost](docs/guides/QUERY_COST.md)
-* [CI integration](docs/guides/CI_INTEGRATION.md)
-* [Benchmark methodology](docs/guides/BENCHMARK_METHODOLOGY.md)
-* [Threat model](docs/security/THREAT_MODEL.md)
-* [Architecture decisions](docs/architecture/ARCHITECTURE_DECISIONS.md)
-* [Known limitations](KNOWN_LIMITATIONS.md) · [Roadmap](ROADMAP.md) · [Changelog](CHANGELOG.md)
+* [Policy reference](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/guides/POLICY_REFERENCE.md)
+* [Agent integration](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/guides/AGENT_INTEGRATION.md)
+* [Query cost](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/guides/QUERY_COST.md)
+* [CI integration](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/guides/CI_INTEGRATION.md)
+* [Benchmark methodology](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/guides/BENCHMARK_METHODOLOGY.md)
+* [Threat model](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/security/THREAT_MODEL.md)
+* [Limits of static SQL analysis and dialect support](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/security/STATIC_ANALYSIS_LIMITS.md)
+* [Benchmark bias review](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/guides/BENCHMARK_BIAS_REVIEW.md)
+* [Architecture decisions](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/architecture/ARCHITECTURE_DECISIONS.md)
+* [Known limitations](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/KNOWN_LIMITATIONS.md) · [Roadmap](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/ROADMAP.md) · [Changelog](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/CHANGELOG.md)
 
 ## Supported versions
 
@@ -361,10 +364,10 @@ pytest                          # PostgreSQL tests run if SQLNINJA_PG_DSN is set
 python scripts/generate_corpus.py --check
 ```
 
-See [CONTRIBUTING.md](CONTRIBUTING.md). Report vulnerabilities privately per
-[SECURITY.md](SECURITY.md).
+See [CONTRIBUTING.md](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/CONTRIBUTING.md). Report vulnerabilities privately per
+[SECURITY.md](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/SECURITY.md).
 
 ## Licence
 
 Apache-2.0. No third-party code is vendored; dependencies and their licences are listed in
-[THIRD_PARTY_NOTICES.md](THIRD_PARTY_NOTICES.md). All benchmark data is synthetic.
+[THIRD_PARTY_NOTICES.md](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/THIRD_PARTY_NOTICES.md). All benchmark data is synthetic.

{sqlguard_ninja-0.1.0 → sqlguard_ninja-0.1.1}/README.md

@@ -20,7 +20,7 @@ side by side.
 
 > **One layer, not the only one.** Static SQL inspection cannot guarantee database security.
 > Use a read-only least-privilege role, row-level security and statement timeouts as well.
-> See the [threat model](docs/security/THREAT_MODEL.md).
+> See the [threat model](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/security/THREAT_MODEL.md).
 
 ## What it does
 
@@ -36,7 +36,7 @@ side by side.
 Not yet included: governed writes (all writes are denied in v0.1); benchmark cases for
 restricted functions and system catalogs (the rules exist, but the corpus does not cover
 them); dialects beyond PostgreSQL and SQLite (they parse, but are untested). Full list:
-[KNOWN_LIMITATIONS.md](KNOWN_LIMITATIONS.md).
+[KNOWN_LIMITATIONS.md](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/KNOWN_LIMITATIONS.md).
 
 ## Architecture
 
@@ -65,7 +65,7 @@ flowchart LR
 ```
 
 Design decisions and their trade-offs are recorded in
-[ARCHITECTURE_DECISIONS.md](docs/architecture/ARCHITECTURE_DECISIONS.md).
+[ARCHITECTURE_DECISIONS.md](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/architecture/ARCHITECTURE_DECISIONS.md).
 
 ## Five-minute quick start
 
@@ -147,7 +147,7 @@ ctx = RequestContext(principal=user.id, role=user.role, tenant_id=user.tenant_id
 app.invoke(state, config={"configurable": {CONTEXT_KEY: ctx}})       # nodes cannot alter config
 ```
 
-More in [AGENT_INTEGRATION.md](docs/guides/AGENT_INTEGRATION.md): the LangChain tool (its
+More in [AGENT_INTEGRATION.md](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/guides/AGENT_INTEGRATION.md): the LangChain tool (its
 schema accepts only `query`), the FastAPI router, review-mode approvals and audit sinks.
 
 ## Privacy policies
@@ -188,7 +188,7 @@ REVIEW:
 Labels also apply to paths inside JSON columns (`profile->'health'->>'allergies'`).
 `sqlninja policy suggest` proposes labels from column names for a human to review; those
 suggestions are never enforced. This is a technical control, not a certification of GDPR
-compliance. Full semantics: [POLICY_REFERENCE.md](docs/guides/POLICY_REFERENCE.md).
+compliance. Full semantics: [POLICY_REFERENCE.md](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/guides/POLICY_REFERENCE.md).
 
 ## Query cost analysis
 
@@ -212,7 +212,7 @@ report = PostgresPlanInspector(guard, lambda: psycopg.connect(READER_DSN)).inspe
 report.total_cost, report.plan_rows, report.static.score, report.findings
 ```
 
-See [QUERY_COST.md](docs/guides/QUERY_COST.md) and `examples/postgresql/plan_inspection_demo.py`.
+See [QUERY_COST.md](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/guides/QUERY_COST.md) and `examples/postgresql/plan_inspection_demo.py`.
 
 ## Benchmark
 
@@ -224,7 +224,7 @@ sqlninja benchmark compare --baseline benchmarks/baselines/native.json --candida
 ```
 
 Results for corpus v1.0.0 (Windows 11, Python 3.11, 1,002 evaluations). Details and raw files:
-[RESULTS_v1.md](docs/benchmarks/RESULTS_v1.md).
+[RESULTS_v1.md](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/benchmarks/RESULTS_v1.md).
 
 | Validator | Recall | Precision | FPR | Recall / FPR within declared capability | p95 ms |
 |---|---:|---:|---:|---:|---:|
@@ -238,7 +238,7 @@ every disagreement was triaged by fixing the engine or correcting a label (both
 100% shows consistency with the documented semantics, not independent detection quality. The
 other tools have smaller policy models (no roles, labels, aggregate-only access or review), so
 the "within capability" column is the fairer comparison. Methodology and threats to validity:
-[BENCHMARK_METHODOLOGY.md](docs/guides/BENCHMARK_METHODOLOGY.md).
+[BENCHMARK_METHODOLOGY.md](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/guides/BENCHMARK_METHODOLOGY.md).
 
 ## How it relates to existing tools
 
@@ -248,7 +248,7 @@ thorough read-only validator with a tautology catch-all, which this project does
 duplicate. [agent-sql-guard](https://github.com/sakura-sky/sql-guard) has a careful
 schema-less PII denylist. What SQLGuard Ninja adds: role- and label-based policies, the agent
 checkpoint contract, a shared benchmark with isolated adapters, planner inspection, and the
-CI gate. Full comparison: [COMPETITIVE_ANALYSIS.md](docs/research/COMPETITIVE_ANALYSIS.md).
+CI gate. Full comparison: [COMPETITIVE_ANALYSIS.md](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/research/COMPETITIVE_ANALYSIS.md).
 
 ## Security limitations
 
@@ -262,13 +262,14 @@ CI gate. Full comparison: [COMPETITIVE_ANALYSIS.md](docs/research/COMPETITIVE_AN
   but those two categories are not measured.
 
 Use database grants, row-level security and timeouts as the authoritative controls. See the
-[threat model](docs/security/THREAT_MODEL.md) and [KNOWN_LIMITATIONS.md](KNOWN_LIMITATIONS.md).
+[threat model](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/security/THREAT_MODEL.md), [limits of static analysis](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/security/STATIC_ANALYSIS_LIMITS.md),
+the [benchmark bias review](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/guides/BENCHMARK_BIAS_REVIEW.md) and [KNOWN_LIMITATIONS.md](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/KNOWN_LIMITATIONS.md).
 
 ## Roadmap
 
 Next: restricted-function and system-catalog benchmark cases, an independent held-out
 corpus, lineage-aware aggregate checks, and tenant predicate push-down. Later: governed
-writes, more tested dialects, and SARIF output. Details in [ROADMAP.md](ROADMAP.md).
+writes, more tested dialects, and SARIF output. Details in [ROADMAP.md](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/ROADMAP.md).
 
 ## Links
 
@@ -276,18 +277,20 @@ writes, more tested dialects, and SARIF output. Details in [ROADMAP.md](ROADMAP.
 * Releases: https://github.com/Pratik653/SQLGuard_Ninjapy/releases
 * PyPI: https://pypi.org/project/sqlguard-ninja/
 * Issues: https://github.com/Pratik653/SQLGuard_Ninjapy/issues
-* Security policy: [SECURITY.md](SECURITY.md) · Contributing: [CONTRIBUTING.md](CONTRIBUTING.md)
+* Security policy: [SECURITY.md](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/SECURITY.md) · Contributing: [CONTRIBUTING.md](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/CONTRIBUTING.md)
 
 ## Documentation
 
-* [Policy reference](docs/guides/POLICY_REFERENCE.md)
-* [Agent integration](docs/guides/AGENT_INTEGRATION.md)
-* [Query cost](docs/guides/QUERY_COST.md)
-* [CI integration](docs/guides/CI_INTEGRATION.md)
-* [Benchmark methodology](docs/guides/BENCHMARK_METHODOLOGY.md)
-* [Threat model](docs/security/THREAT_MODEL.md)
-* [Architecture decisions](docs/architecture/ARCHITECTURE_DECISIONS.md)
-* [Known limitations](KNOWN_LIMITATIONS.md) · [Roadmap](ROADMAP.md) · [Changelog](CHANGELOG.md)
+* [Policy reference](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/guides/POLICY_REFERENCE.md)
+* [Agent integration](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/guides/AGENT_INTEGRATION.md)
+* [Query cost](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/guides/QUERY_COST.md)
+* [CI integration](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/guides/CI_INTEGRATION.md)
+* [Benchmark methodology](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/guides/BENCHMARK_METHODOLOGY.md)
+* [Threat model](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/security/THREAT_MODEL.md)
+* [Limits of static SQL analysis and dialect support](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/security/STATIC_ANALYSIS_LIMITS.md)
+* [Benchmark bias review](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/guides/BENCHMARK_BIAS_REVIEW.md)
+* [Architecture decisions](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/architecture/ARCHITECTURE_DECISIONS.md)
+* [Known limitations](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/KNOWN_LIMITATIONS.md) · [Roadmap](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/ROADMAP.md) · [Changelog](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/CHANGELOG.md)
 
 ## Supported versions
 
@@ -305,10 +308,10 @@ pytest                          # PostgreSQL tests run if SQLNINJA_PG_DSN is set
 python scripts/generate_corpus.py --check
 ```
 
-See [CONTRIBUTING.md](CONTRIBUTING.md). Report vulnerabilities privately per
-[SECURITY.md](SECURITY.md).
+See [CONTRIBUTING.md](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/CONTRIBUTING.md). Report vulnerabilities privately per
+[SECURITY.md](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/SECURITY.md).
 
 ## Licence
 
 Apache-2.0. No third-party code is vendored; dependencies and their licences are listed in
-[THIRD_PARTY_NOTICES.md](THIRD_PARTY_NOTICES.md). All benchmark data is synthetic.
+[THIRD_PARTY_NOTICES.md](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/THIRD_PARTY_NOTICES.md). All benchmark data is synthetic.

sqlguard_ninja-0.1.1/benchmarks/datasets/external/README.md

@@ -0,0 +1,28 @@
+# External evaluation datasets — intake requirements
+
+This directory is reserved for evaluation sets that were **not** written by SQLGuard Ninja's
+authors. It is intentionally empty in v0.1.1. See
+[`docs/guides/BENCHMARK_BIAS_REVIEW.md`](../../../docs/guides/BENCHMARK_BIAS_REVIEW.md) for
+why it exists.
+
+## Rules
+
+1. **Independent provenance.** Each dataset lives in its own sub-directory with a
+   `PROVENANCE.md` that names the author or organisation, the creation method, the date, the
+   source URL or commit, and how labels were assigned and reviewed.
+2. **Licence first.** The dataset's licence must allow redistribution under, or alongside,
+   Apache-2.0. Record the SPDX identifier in `PROVENANCE.md` and `THIRD_PARTY_NOTICES.md`.
+   No dataset with an unknown or restrictive licence is merged.
+3. **Synthetic data only.** No real personal data, customer data or credentials.
+4. **Held out.** External cases must never be used to tune the engine. If a case reveals an
+   engine bug, fix it, add a *separate* regression case under `benchmarks/datasets/v1`, and
+   leave the external case and its label unchanged.
+5. **Same schema format** as `benchmarks/datasets/v1` (a `manifest.yaml` with `case_files`
+   and a policy). Every case uses
+   `provenance: external:<dataset-name>@<version>` so reports break it out separately.
+6. **Label validation.** `allow` cases must execute on the fixture databases, as in v1.
+7. **Separate reporting.** Results are published per dataset and never merged into the v1
+   headline numbers.
+
+Proposals: open a "Benchmark case" issue first so licence and provenance can be checked
+before any data is submitted.

sqlguard_ninja-0.1.1/docs/guides/BENCHMARK_BIAS_REVIEW.md

@@ -0,0 +1,74 @@
+# Benchmark bias review (corpus v1.0.0)
+
+_Written 2026-10-24 for v0.1.1. Every number below was computed from the corpus with
+`load_dataset("benchmarks/datasets/v1")`. The purpose is to say plainly how much the v1
+results can be trusted, and what an external evaluation set must fix._
+
+## Summary
+
+The v1 corpus measures **consistency with SQLGuard Ninja's documented policy semantics**. It
+does not measure real-world detection ability. The native 100% score should not be quoted
+without this caveat. The four biases below are structural, not incidental.
+
+## Findings
+
+### B1. Co-development and single authorship (high)
+
+The engine and all 530 cases were written by the same author in the same development
+session. Every disagreement between them was resolved by changing one of the two, and those
+changes are logged in IMPLEMENTATION_STATUS.md. A corpus tuned this way always converges
+toward 100% for its own engine, so the score carries no information about cases the author
+did not think of.
+
+### B2. Generated labels restate the engine's semantics (high, for 51% of cases)
+
+268 of the 530 unique cases (51%) are generated. The generator does not import the engine,
+but its oracle encodes the **same** semantics (grant lookup, label resolution, tenant-pin
+rules). The `label_matrix` (43 cases) and `tenant_matrix` (70) agree with the engine by
+construction whenever both implement the specification correctly. That checks the
+implementation against the specification. It cannot show that the specification is the
+right policy.
+
+### B3. Narrow input distribution (medium)
+
+| Measure | Value | Why it matters |
+|---|---|---|
+| Cases using the `alias.column` style | 424 / 530 (80%) | LLMs often emit unqualified columns, where the analyser's fail-closed path for unresolvable columns dominates |
+| Leading keyword in upper case | 426 / 530 | formatting variety comes mostly from 7 transform templates |
+| Median SQL length | 64 characters (max 346) | real text-to-SQL output is often longer, with more joins |
+| Cases with two or more JOINs | 1 | multi-join reasoning is barely exercised |
+| Tenant context | tenant 1 in 528 / 530 | value-handling bugs specific to other ids would go unseen |
+| Literal tenant pin vs bind parameter | 297 vs 8 | parameterised queries are under-represented |
+| Role mix | `support_analyst` in 355 / 530 | other roles' policies are lightly covered |
+
+### B4. Outcome and category imbalance (medium)
+
+Of the 1,002 evaluations, 568 are deny, 420 allow and **14 review** (8 unique cases). Metrics
+for the review outcome are therefore not statistically meaningful. Two policy categories,
+restricted functions and system catalogs, have **no cases at all**.
+
+### B5. Single synthetic schema and policy (medium)
+
+All cases use one ten-table retail schema with explicit labels. Results may not transfer to
+schemas with views, many-to-many joins, wide tables or naming conventions unlike this one.
+
+### B6. Ground truth is policy semantics, not harm (by design)
+
+Labels encode what the *policy* says, for example the scope-local tenant pin and
+reference-based aggregate-only checks. A safe query can be labelled deny. That is documented,
+but it means "false positive" here is measured against the policy, not against actual risk.
+
+## What reduces these biases
+
+1. **An external evaluation set** with independent provenance, kept separate from v1 and
+   never used to tune the engine. Requirements: [`benchmarks/datasets/external/README.md`](../../benchmarks/datasets/external/README.md).
+2. Reporting external results **separately** (the `by_provenance` breakdown already does this)
+   and never merging them into the headline v1 figure.
+3. More schemas and policies, LLM-generated SQL captured from real text-to-SQL runs against
+   the fixture schema, and larger review and multi-join slices.
+
+## Status
+
+No external dataset is included in v0.1.1. One was requested, but this release does not add
+new benchmark cases. It ships the intake process and these findings; the work is tracked as a
+GitHub issue. Adding cases written by the engine's own author would not reduce B1 in any case.

{sqlguard_ninja-0.1.0 → sqlguard_ninja-0.1.1}/docs/guides/BENCHMARK_METHODOLOGY.md

@@ -100,6 +100,8 @@ decision is not `allow`.
 
 ## Threats to validity
 
+A quantified review is in [BENCHMARK_BIAS_REVIEW.md](BENCHMARK_BIAS_REVIEW.md).
+
 * The corpus and the native engine were co-developed by the same authors. Native results
   show consistency with the stated semantics, not independent detection quality.
 * Some semantics are deliberately strict (reference-based privacy, scope-local tenant pins).

sqlguard_ninja-0.1.1/docs/releases/v0.1.1.md

@@ -0,0 +1,29 @@
+# SQLGuard Ninja v0.1.1
+
+Documentation and governance patch release. **The enforcement behaviour is identical to v0.1.0.**
+v0.1.0 remains published and unchanged on PyPI.
+
+## Fixed
+* The README's documentation links now work on the PyPI project page (they were relative in 0.1.0).
+
+## Added
+* [Limits of static SQL analysis and dialect support](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/security/STATIC_ANALYSIS_LIMITS.md)
+* [Benchmark bias review](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/guides/BENCHMARK_BIAS_REVIEW.md):
+  the v1 results reflect consistency with the engine's own semantics, not independent detection quality.
+* [External dataset intake rules](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/benchmarks/datasets/external/README.md); no external cases yet.
+* CODEOWNERS and branch protection on `main`.
+
+## Known limitations (unchanged)
+* No benchmark cases for restricted functions (server file access, sleep, dynamic SQL,
+  administrative functions) or system catalogs (`pg_catalog`, `information_schema`,
+  `sqlite_master`, `sqlite_schema`). The rules ship and run, but their detection is not measured.
+* Writes are denied. Only PostgreSQL and SQLite are supported. No guarantee against SQL injection or data leakage.
+
+## Installation
+
+```bash
+python -m pip install sqlguard-ninja==0.1.1
+python -m pip install "sqlguard-ninja[all]==0.1.1"
+```
+
+PyPI: https://pypi.org/project/sqlguard-ninja/0.1.1/

sqlguard_ninja-0.1.1/docs/security/STATIC_ANALYSIS_LIMITS.md

@@ -0,0 +1,49 @@
+# Limits of static SQL analysis
+
+SQLGuard Ninja decides by **reading** SQL, never by running it. That makes it fast,
+deterministic and safe to run before execution. It also puts hard limits on what it can
+know. This page lists those limits so deployers can put the right controls around it.
+
+## What a static analyser cannot know
+
+| Limit | Consequence | Compensating control |
+|---|---|---|
+| **Parser differential:** sqlglot's parse can differ from the database engine's parse for unusual syntax | A query the guard reads as harmless could mean something else to the server | Only use tested dialects; unparseable input is denied; least-privilege DB role |
+| **Object definitions:** views, functions, triggers and rules are opaque | A permitted view or function can read or change data the policy would deny | Grant only vetted views; `functions.mode: allowlist`; no SECURITY DEFINER functions for the agent role |
+| **Runtime data:** values, row counts, NULL patterns | Aggregates and filters can still leak information across many permitted queries (inference) | Small-cohort review, rate limits, auditing, minimum-group-size controls in the database or app |
+| **Session state:** `search_path`, settings, temporary objects created elsewhere | An unqualified name may resolve to a different object at runtime | Fixed `search_path` for the agent role; deny session statements (default) |
+| **Cost:** actual rows, cache state, concurrency | Static scores and planner estimates can be wrong in both directions | `statement_timeout`, connection limits, resource groups |
+| **Intent:** why the query was written | A legitimate query can serve a harmful goal | Human review mode for sensitive labels; audit trail |
+| **Writes:** governed DML is out of scope | All writes are denied in v0.1 | Separate, explicitly designed write paths |
+
+The guard **fails closed** where it detects uncertainty: parse errors, incomplete qualification,
+unattributable columns, `*` over unknown sources and unknown tables are denied by default. It
+cannot detect uncertainty it does not know about. That is why the controls in the right-hand
+column are required, not optional.
+
+## Dialect support
+
+| Dialect | Status | Evidence |
+|---|---|---|
+| PostgreSQL | **Supported.** Tested against PostgreSQL 16. | Corpus cases; every `allow` case executed on PostgreSQL 16 as a SELECT-only role (locally and in CI); plan inspection tested |
+| SQLite | **Supported.** | Corpus cases; every `allow` case executed on the fixture database; SQLite-specific session statements denied |
+| MySQL family | **Experimental.** | Executable-comment rule only; no corpus cases; not tested |
+| Other sqlglot dialects (Snowflake, BigQuery, T-SQL, ...) | **Untested.** | Parsing may work. Policy behaviour, quoting and catalog rules are not verified. |
+
+Treat "experimental" and "untested" as unsupported for security decisions.
+Identifier-case handling follows each dialect's rules through sqlglot. For example, quoted
+identifiers are case-sensitive in PostgreSQL but not in SQLite, and the corpus covers both.
+
+## Coverage of the benchmark
+
+The benchmark does **not** contain restricted-function or system-catalog cases in v1.0.0.
+Those rules exist and run by default, but their detection rate is not measured. See
+[BENCHMARK_BIAS_REVIEW.md](../guides/BENCHMARK_BIAS_REVIEW.md) for what the existing results
+can and cannot show.
+
+## Non-claims
+
+SQLGuard Ninja does **not** guarantee protection against SQL injection, prompt injection or
+data leakage, and it does not certify compliance with GDPR or any other regulation. It is one
+defence-in-depth layer between an LLM and a database whose own permissions, row-level security
+and resource limits remain authoritative. See the [threat model](THREAT_MODEL.md).

{sqlguard_ninja-0.1.0 → sqlguard_ninja-0.1.1}/docs/security/THREAT_MODEL.md

@@ -78,6 +78,10 @@ flowchart LR
 * Store audit events in append-only storage. Treat `sql_redacted` as potentially sensitive.
 * Protect policy files and baselines with code review (CODEOWNERS).
 
+## Further reading
+
+* [Limits of static SQL analysis and dialect support](STATIC_ANALYSIS_LIMITS.md)
+
 ## Reporting vulnerabilities
 
 See [`SECURITY.md`](../../SECURITY.md).

sqlguard_ninja-0.1.1/src/sqlguard_ninja/_version.py

@@ -0,0 +1 @@
+__version__ = "0.1.1"

{sqlguard_ninja-0.1.0 → sqlguard_ninja-0.1.1}/tests/unit/test_docs.py

@@ -87,6 +87,7 @@ def test_policy_reference_custom_rule():
 
 
 LINK = re.compile(r"\]\(([^)#\s]+)(#[^)]*)?\)")
+REPO_BLOB = "https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/"
 
 
 @pytest.mark.parametrize("doc", DOCS, ids=lambda p: str(p.relative_to(ROOT)))
@@ -94,6 +95,11 @@ def test_relative_links_resolve(doc: Path):
     text = doc.read_text(encoding="utf-8")
     missing = []
     for target, _ in LINK.findall(text):
+        if target.startswith(REPO_BLOB):
+            # Absolute links into this repository must still point at real files.
+            if not (ROOT / target.removeprefix(REPO_BLOB)).exists():
+                missing.append(target)
+            continue
         if re.match(r"^[a-z]+:", target):
             continue  # external URL
         if not (doc.parent / target).resolve().exists():
@@ -128,3 +134,10 @@ def test_readme_privacy_yaml_fragment_is_valid():
     for role, spec in fragment["roles"].items():
         for label, access in spec["labels"].items():
             assert full["roles"][role]["labels"][label] == access
+
+
+def test_readme_has_no_relative_links():
+    """The README is the PyPI long description; relative links break there (0.1.0 defect)."""
+    text = (ROOT / "README.md").read_text(encoding="utf-8")
+    relative = [t for t, _ in LINK.findall(text) if not re.match(r"^[a-z]+:", t)]
+    assert relative == []

sqlguard_ninja-0.1.0/src/sqlguard_ninja/_version.py

@@ -1 +0,0 @@
-__version__ = "0.1.0"