sqlguard-ninja 0.1.0__tar.gz → 0.2.0__tar.gz

{sqlguard_ninja-0.1.0 → sqlguard_ninja-0.2.0}/CHANGELOG.md

@@ -3,6 +3,50 @@
 All notable changes are documented here. The project follows
 [Semantic Versioning](https://semver.org/); before 1.0, minor versions may change the API.
 
+## [0.2.0] — 2026-10-24
+
+### Added
+* **Lineage-aware privacy** (`core/lineage.py`). An `aggregate_only` column projected raw in a
+  CTE or derived table is accepted only when every downstream consumer aggregates it
+  statistically. Whole-row use, filters, ordering, windows, MIN/MAX and a raw use by any
+  consumer stay denied (issue #8).
+* **Tenant push-down.** An outer tenant pin on an unmodified projection of the tenant column
+  satisfies the inner read when the inner scope has no aggregation, window, LIMIT, OFFSET or
+  FETCH and every consumer pins it, recursively (issue #9).
+* The small-cohort check follows identifiers through CTEs and derived tables, so the lineage
+  relaxation cannot bypass it (found by new boundary case LIN-012).
+* Privacy findings carry structured lineage metadata (base column, JSON path, scope, labels).
+* Benchmark: `internal` / `independent` dataset tiers, flag basis (policy vs unsupported SQL),
+  F1, 95% Wilson intervals, throughput, CSV output (`--csv`), per-file SHA-256 dataset hashes
+  in results and `sqlninja dataset stats`.
+* Approved-relabel workflow: `LABEL_CHANGES.yaml` (CODEOWNERS-protected) lists reviewed label
+  changes; `benchmark compare --approved-label-changes` / `ci.approved_label_changes`.
+* Corpus 1.1.0: 21 lineage boundary cases; 2 approved relabels (PRV-026, TEN-021).
+
+### Changed
+* Decisions changed for exactly two corpus cases (PRV-026, TEN-021: deny → allow); all other
+  1,042 evaluations are unchanged.
+
+## [0.1.1] — 2026-10-24
+
+Documentation and governance patch. No changes to policy decisions.
+
+### Fixed
+* README links were relative and broke on the PyPI project page. They are now absolute
+  GitHub URLs, and a test keeps relative links out of the README.
+
+### Added
+* `docs/security/STATIC_ANALYSIS_LIMITS.md`: limits of static analysis, compensating
+  controls, and a dialect support matrix (supported / experimental / untested).
+* `docs/guides/BENCHMARK_BIAS_REVIEW.md`: quantified review of corpus v1 bias
+  (co-development, generated labels, input distribution, outcome imbalance).
+* `benchmarks/datasets/external/`: intake rules for independently sourced, held-out
+  evaluation sets (no cases yet).
+* `.github/CODEOWNERS`, and branch protection on `main` (pull requests and CI required).
+
+### Unchanged known limitations
+* No restricted-function or system-catalog benchmark cases; no external dataset yet.
+
 ## [0.1.0] — 2026-10-24
 
 First release.

{sqlguard_ninja-0.1.0 → sqlguard_ninja-0.2.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: sqlguard-ninja
-Version: 0.1.0
+Version: 0.2.0
 Summary: Security testing, policy enforcement, agent integration, privacy analysis and CI benchmarking for LLM-generated SQL.
 Project-URL: Homepage, https://github.com/Pratik653/SQLGuard_Ninjapy
 Project-URL: Documentation, https://github.com/Pratik653/SQLGuard_Ninjapy/tree/main/docs
@@ -70,29 +70,29 @@ the *authenticated* caller: which tables and columns a role may use, which data
 appear only in aggregates or only after human approval, and which tenant the caller belongs
 to. It records an audit trail and gives the agent an explanation it can act on.
 
-It ships with a labelled benchmark corpus (530 cases, 1,002 dialect evaluations) and a
+It ships with a labelled benchmark corpus (551 cases, 1,044 dialect evaluations) and a
 regression gate for CI. The same benchmark harness can evaluate other open-source guards
 side by side.
 
 > **One layer, not the only one.** Static SQL inspection cannot guarantee database security.
 > Use a read-only least-privilege role, row-level security and statement timeouts as well.
-> See the [threat model](docs/security/THREAT_MODEL.md).
+> See the [threat model](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/security/THREAT_MODEL.md).
 
 ## What it does
 
 | Workstream | What you get | Status |
 |---|---|---|
 | **Policy engine** | Read-only enforcement, table/column grants, tenant isolation, function and catalog rules, structural limits. Built on [sqlglot](https://github.com/tobymao/sqlglot). Fails closed when analysis is incomplete. | PostgreSQL + SQLite tested |
-| **Privacy pack** | Explicit classification labels, `deny` / `aggregate_only` / `review` per role, JSON-path labels, small-cohort review, minimisation hints and alternatives | implemented |
+| **Privacy pack** | Explicit classification labels, `deny` / `aggregate_only` / `review` per role, JSON-path labels, lineage through CTEs and derived tables, small-cohort review, minimisation hints and alternatives | implemented |
 | **Agent integrations** | `SQLCheckpoint` with block / review / audit modes, hash-bound single-use approvals, retry lock-out, redacted audit events. LangChain tool, LangGraph nodes, FastAPI router | implemented |
-| **Benchmark engine** | Versioned corpus, metrics (recall, precision, FPR, FNR, exact match, per category/dialect, latency percentiles), adapters for native, callable and isolated external validators, JSON and Markdown reports | implemented |
+| **Benchmark engine** | Versioned corpus with per-file SHA-256 hashes, internal and independent tiers, metrics (recall, precision, F1, FPR, FNR with 95% Wilson intervals, exact match, throughput, latency percentiles, per category/dialect/tier), adapters for native, callable and isolated external validators, JSON, CSV and Markdown reports | implemented |
 | **Query cost** | Explainable static score; optional PostgreSQL `EXPLAIN (FORMAT JSON)` inspection, gated and read-only | implemented |
 | **CI** | Composite GitHub Action and CLI gate: security, usability, label-change and error regressions against an approved baseline | implemented |
 
 Not yet included: governed writes (all writes are denied in v0.1); benchmark cases for
 restricted functions and system catalogs (the rules exist, but the corpus does not cover
 them); dialects beyond PostgreSQL and SQLite (they parse, but are untested). Full list:
-[KNOWN_LIMITATIONS.md](KNOWN_LIMITATIONS.md).
+[KNOWN_LIMITATIONS.md](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/KNOWN_LIMITATIONS.md).
 
 ## Architecture
 
@@ -121,7 +121,7 @@ flowchart LR
 ```
 
 Design decisions and their trade-offs are recorded in
-[ARCHITECTURE_DECISIONS.md](docs/architecture/ARCHITECTURE_DECISIONS.md).
+[ARCHITECTURE_DECISIONS.md](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/architecture/ARCHITECTURE_DECISIONS.md).
 
 ## Five-minute quick start
 
@@ -203,7 +203,7 @@ ctx = RequestContext(principal=user.id, role=user.role, tenant_id=user.tenant_id
 app.invoke(state, config={"configurable": {CONTEXT_KEY: ctx}})       # nodes cannot alter config
 ```
 
-More in [AGENT_INTEGRATION.md](docs/guides/AGENT_INTEGRATION.md): the LangChain tool (its
+More in [AGENT_INTEGRATION.md](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/guides/AGENT_INTEGRATION.md): the LangChain tool (its
 schema accepts only `query`), the FastAPI router, review-mode approvals and audit sinks.
 
 ## Privacy policies
@@ -244,7 +244,7 @@ REVIEW:
 Labels also apply to paths inside JSON columns (`profile->'health'->>'allergies'`).
 `sqlninja policy suggest` proposes labels from column names for a human to review; those
 suggestions are never enforced. This is a technical control, not a certification of GDPR
-compliance. Full semantics: [POLICY_REFERENCE.md](docs/guides/POLICY_REFERENCE.md).
+compliance. Full semantics: [POLICY_REFERENCE.md](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/guides/POLICY_REFERENCE.md).
 
 ## Query cost analysis
 
@@ -268,7 +268,7 @@ report = PostgresPlanInspector(guard, lambda: psycopg.connect(READER_DSN)).inspe
 report.total_cost, report.plan_rows, report.static.score, report.findings
 ```
 
-See [QUERY_COST.md](docs/guides/QUERY_COST.md) and `examples/postgresql/plan_inspection_demo.py`.
+See [QUERY_COST.md](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/guides/QUERY_COST.md) and `examples/postgresql/plan_inspection_demo.py`.
 
 ## Benchmark
 
@@ -279,22 +279,24 @@ sqlninja benchmark run --dataset builtin:v1 --adapter external:sql-guardrail
 sqlninja benchmark compare --baseline benchmarks/baselines/native.json --candidate results/latest.json
 ```
 
-Results for corpus v1.0.0 (Windows 11, Python 3.11, 1,002 evaluations). Details and raw files:
-[RESULTS_v1.md](docs/benchmarks/RESULTS_v1.md).
-
-| Validator | Recall | Precision | FPR | Recall / FPR within declared capability | p95 ms |
-|---|---:|---:|---:|---:|---:|
-| SQLGuard Ninja 0.1.0 | 100.0% | 100.0% | 0.0% | 100.0% / 0.0% | 2.15 |
-| sql-guardrail 0.5.2 | 98.6% | 86.6% | 21.2% | 98.3% / 19.3% | 1.72 |
-| agent-sql-guard 0.2.0 | 67.9% | 86.6% | 14.5% | 89.5% / 17.2% | 1.26 |
-| krish2105/sqlguard 0.1.0 | 65.8% | 91.4% | 8.6% | 83.5% / 5.2% | 1.22 |
-
-**Read the native row with care.** The corpus and the engine were developed together, and
-every disagreement was triaged by fixing the engine or correcting a label (both are logged).
-100% shows consistency with the documented semantics, not independent detection quality. The
-other tools have smaller policy models (no roles, labels, aggregate-only access or review), so
-the "within capability" column is the fairer comparison. Methodology and threats to validity:
-[BENCHMARK_METHODOLOGY.md](docs/guides/BENCHMARK_METHODOLOGY.md).
+Results for corpus v1.1.0 (551 cases, 1,044 evaluations; SQLGuard Ninja 0.2.0; Windows 11,
+Python 3.11). Intervals are 95% Wilson intervals. Details, CSV and raw files:
+[RESULTS_v1.1.md](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/benchmarks/RESULTS_v1.1.md).
+
+| Validator | Recall (95% CI) | Precision | F1 | FPR (95% CI) | Recall / FPR within declared capability | p95 ms |
+|---|---:|---:|---:|---:|---:|---:|
+| SQLGuard Ninja 0.2.0 | 100.0% (99.4–100.0) | 100.0% | 1.000 | 0.0% (0.0–0.9) | 100.0% / 0.0% | 3.33 |
+| sql-guardrail 0.5.2 | 98.7% (97.4–99.3) | 85.1% | 0.914 | 24.1% (20.3–28.3) | 98.3% / 19.7% | 2.63 |
+| agent-sql-guard 0.2.0 | 67.3% (63.4–70.9) | 85.2% | 0.752 | 16.3% (13.1–20.0) | 89.4% / 17.7% | 1.87 |
+| krish2105/sqlguard 0.1.0 | 65.3% (61.4–69.0) | 89.6% | 0.755 | 10.5% (8.0–13.8) | 83.5% / 5.2% | 1.95 |
+
+**All of these are internal results.** The corpus was written by this project, alongside the
+engine. The native 100% shows consistency with the documented semantics, not independent
+detection quality. No independently sourced dataset exists yet ([intake rules](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/benchmarks/datasets/external/README.md),
+issue #6). Reports keep `internal` and `independent` tiers separate, and they also separate
+policy denials from unsupported-SQL denials. Methodology and bias review:
+[BENCHMARK_METHODOLOGY.md](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/guides/BENCHMARK_METHODOLOGY.md),
+[BENCHMARK_BIAS_REVIEW.md](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/guides/BENCHMARK_BIAS_REVIEW.md).
 
 ## How it relates to existing tools
 
@@ -304,7 +306,7 @@ thorough read-only validator with a tautology catch-all, which this project does
 duplicate. [agent-sql-guard](https://github.com/sakura-sky/sql-guard) has a careful
 schema-less PII denylist. What SQLGuard Ninja adds: role- and label-based policies, the agent
 checkpoint contract, a shared benchmark with isolated adapters, planner inspection, and the
-CI gate. Full comparison: [COMPETITIVE_ANALYSIS.md](docs/research/COMPETITIVE_ANALYSIS.md).
+CI gate. Full comparison: [COMPETITIVE_ANALYSIS.md](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/research/COMPETITIVE_ANALYSIS.md).
 
 ## Security limitations
 
@@ -318,13 +320,14 @@ CI gate. Full comparison: [COMPETITIVE_ANALYSIS.md](docs/research/COMPETITIVE_AN
   but those two categories are not measured.
 
 Use database grants, row-level security and timeouts as the authoritative controls. See the
-[threat model](docs/security/THREAT_MODEL.md) and [KNOWN_LIMITATIONS.md](KNOWN_LIMITATIONS.md).
+[threat model](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/security/THREAT_MODEL.md), [limits of static analysis](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/security/STATIC_ANALYSIS_LIMITS.md),
+the [benchmark bias review](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/guides/BENCHMARK_BIAS_REVIEW.md) and [KNOWN_LIMITATIONS.md](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/KNOWN_LIMITATIONS.md).
 
 ## Roadmap
 
 Next: restricted-function and system-catalog benchmark cases, an independent held-out
 corpus, lineage-aware aggregate checks, and tenant predicate push-down. Later: governed
-writes, more tested dialects, and SARIF output. Details in [ROADMAP.md](ROADMAP.md).
+writes, more tested dialects, and SARIF output. Details in [ROADMAP.md](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/ROADMAP.md).
 
 ## Links
 
@@ -332,18 +335,20 @@ writes, more tested dialects, and SARIF output. Details in [ROADMAP.md](ROADMAP.
 * Releases: https://github.com/Pratik653/SQLGuard_Ninjapy/releases
 * PyPI: https://pypi.org/project/sqlguard-ninja/
 * Issues: https://github.com/Pratik653/SQLGuard_Ninjapy/issues
-* Security policy: [SECURITY.md](SECURITY.md) · Contributing: [CONTRIBUTING.md](CONTRIBUTING.md)
+* Security policy: [SECURITY.md](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/SECURITY.md) · Contributing: [CONTRIBUTING.md](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/CONTRIBUTING.md)
 
 ## Documentation
 
-* [Policy reference](docs/guides/POLICY_REFERENCE.md)
-* [Agent integration](docs/guides/AGENT_INTEGRATION.md)
-* [Query cost](docs/guides/QUERY_COST.md)
-* [CI integration](docs/guides/CI_INTEGRATION.md)
-* [Benchmark methodology](docs/guides/BENCHMARK_METHODOLOGY.md)
-* [Threat model](docs/security/THREAT_MODEL.md)
-* [Architecture decisions](docs/architecture/ARCHITECTURE_DECISIONS.md)
-* [Known limitations](KNOWN_LIMITATIONS.md) · [Roadmap](ROADMAP.md) · [Changelog](CHANGELOG.md)
+* [Policy reference](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/guides/POLICY_REFERENCE.md)
+* [Agent integration](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/guides/AGENT_INTEGRATION.md)
+* [Query cost](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/guides/QUERY_COST.md)
+* [CI integration](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/guides/CI_INTEGRATION.md)
+* [Benchmark methodology](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/guides/BENCHMARK_METHODOLOGY.md)
+* [Threat model](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/security/THREAT_MODEL.md)
+* [Limits of static SQL analysis and dialect support](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/security/STATIC_ANALYSIS_LIMITS.md)
+* [Benchmark bias review](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/guides/BENCHMARK_BIAS_REVIEW.md)
+* [Architecture decisions](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/architecture/ARCHITECTURE_DECISIONS.md)
+* [Known limitations](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/KNOWN_LIMITATIONS.md) · [Roadmap](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/ROADMAP.md) · [Changelog](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/CHANGELOG.md)
 
 ## Supported versions
 
@@ -361,10 +366,10 @@ pytest                          # PostgreSQL tests run if SQLNINJA_PG_DSN is set
 python scripts/generate_corpus.py --check
 ```
 
-See [CONTRIBUTING.md](CONTRIBUTING.md). Report vulnerabilities privately per
-[SECURITY.md](SECURITY.md).
+See [CONTRIBUTING.md](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/CONTRIBUTING.md). Report vulnerabilities privately per
+[SECURITY.md](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/SECURITY.md).
 
 ## Licence
 
 Apache-2.0. No third-party code is vendored; dependencies and their licences are listed in
-[THIRD_PARTY_NOTICES.md](THIRD_PARTY_NOTICES.md). All benchmark data is synthetic.
+[THIRD_PARTY_NOTICES.md](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/THIRD_PARTY_NOTICES.md). All benchmark data is synthetic.

{sqlguard_ninja-0.1.0 → sqlguard_ninja-0.2.0}/README.md

@@ -14,29 +14,29 @@ the *authenticated* caller: which tables and columns a role may use, which data
 appear only in aggregates or only after human approval, and which tenant the caller belongs
 to. It records an audit trail and gives the agent an explanation it can act on.
 
-It ships with a labelled benchmark corpus (530 cases, 1,002 dialect evaluations) and a
+It ships with a labelled benchmark corpus (551 cases, 1,044 dialect evaluations) and a
 regression gate for CI. The same benchmark harness can evaluate other open-source guards
 side by side.
 
 > **One layer, not the only one.** Static SQL inspection cannot guarantee database security.
 > Use a read-only least-privilege role, row-level security and statement timeouts as well.
-> See the [threat model](docs/security/THREAT_MODEL.md).
+> See the [threat model](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/security/THREAT_MODEL.md).
 
 ## What it does
 
 | Workstream | What you get | Status |
 |---|---|---|
 | **Policy engine** | Read-only enforcement, table/column grants, tenant isolation, function and catalog rules, structural limits. Built on [sqlglot](https://github.com/tobymao/sqlglot). Fails closed when analysis is incomplete. | PostgreSQL + SQLite tested |
-| **Privacy pack** | Explicit classification labels, `deny` / `aggregate_only` / `review` per role, JSON-path labels, small-cohort review, minimisation hints and alternatives | implemented |
+| **Privacy pack** | Explicit classification labels, `deny` / `aggregate_only` / `review` per role, JSON-path labels, lineage through CTEs and derived tables, small-cohort review, minimisation hints and alternatives | implemented |
 | **Agent integrations** | `SQLCheckpoint` with block / review / audit modes, hash-bound single-use approvals, retry lock-out, redacted audit events. LangChain tool, LangGraph nodes, FastAPI router | implemented |
-| **Benchmark engine** | Versioned corpus, metrics (recall, precision, FPR, FNR, exact match, per category/dialect, latency percentiles), adapters for native, callable and isolated external validators, JSON and Markdown reports | implemented |
+| **Benchmark engine** | Versioned corpus with per-file SHA-256 hashes, internal and independent tiers, metrics (recall, precision, F1, FPR, FNR with 95% Wilson intervals, exact match, throughput, latency percentiles, per category/dialect/tier), adapters for native, callable and isolated external validators, JSON, CSV and Markdown reports | implemented |
 | **Query cost** | Explainable static score; optional PostgreSQL `EXPLAIN (FORMAT JSON)` inspection, gated and read-only | implemented |
 | **CI** | Composite GitHub Action and CLI gate: security, usability, label-change and error regressions against an approved baseline | implemented |
 
 Not yet included: governed writes (all writes are denied in v0.1); benchmark cases for
 restricted functions and system catalogs (the rules exist, but the corpus does not cover
 them); dialects beyond PostgreSQL and SQLite (they parse, but are untested). Full list:
-[KNOWN_LIMITATIONS.md](KNOWN_LIMITATIONS.md).
+[KNOWN_LIMITATIONS.md](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/KNOWN_LIMITATIONS.md).
 
 ## Architecture
 
@@ -65,7 +65,7 @@ flowchart LR
 ```
 
 Design decisions and their trade-offs are recorded in
-[ARCHITECTURE_DECISIONS.md](docs/architecture/ARCHITECTURE_DECISIONS.md).
+[ARCHITECTURE_DECISIONS.md](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/architecture/ARCHITECTURE_DECISIONS.md).
 
 ## Five-minute quick start
 
@@ -147,7 +147,7 @@ ctx = RequestContext(principal=user.id, role=user.role, tenant_id=user.tenant_id
 app.invoke(state, config={"configurable": {CONTEXT_KEY: ctx}})       # nodes cannot alter config
 ```
 
-More in [AGENT_INTEGRATION.md](docs/guides/AGENT_INTEGRATION.md): the LangChain tool (its
+More in [AGENT_INTEGRATION.md](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/guides/AGENT_INTEGRATION.md): the LangChain tool (its
 schema accepts only `query`), the FastAPI router, review-mode approvals and audit sinks.
 
 ## Privacy policies
@@ -188,7 +188,7 @@ REVIEW:
 Labels also apply to paths inside JSON columns (`profile->'health'->>'allergies'`).
 `sqlninja policy suggest` proposes labels from column names for a human to review; those
 suggestions are never enforced. This is a technical control, not a certification of GDPR
-compliance. Full semantics: [POLICY_REFERENCE.md](docs/guides/POLICY_REFERENCE.md).
+compliance. Full semantics: [POLICY_REFERENCE.md](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/guides/POLICY_REFERENCE.md).
 
 ## Query cost analysis
 
@@ -212,7 +212,7 @@ report = PostgresPlanInspector(guard, lambda: psycopg.connect(READER_DSN)).inspe
 report.total_cost, report.plan_rows, report.static.score, report.findings
 ```
 
-See [QUERY_COST.md](docs/guides/QUERY_COST.md) and `examples/postgresql/plan_inspection_demo.py`.
+See [QUERY_COST.md](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/guides/QUERY_COST.md) and `examples/postgresql/plan_inspection_demo.py`.
 
 ## Benchmark
 
@@ -223,22 +223,24 @@ sqlninja benchmark run --dataset builtin:v1 --adapter external:sql-guardrail
 sqlninja benchmark compare --baseline benchmarks/baselines/native.json --candidate results/latest.json
 ```
 
-Results for corpus v1.0.0 (Windows 11, Python 3.11, 1,002 evaluations). Details and raw files:
-[RESULTS_v1.md](docs/benchmarks/RESULTS_v1.md).
-
-| Validator | Recall | Precision | FPR | Recall / FPR within declared capability | p95 ms |
-|---|---:|---:|---:|---:|---:|
-| SQLGuard Ninja 0.1.0 | 100.0% | 100.0% | 0.0% | 100.0% / 0.0% | 2.15 |
-| sql-guardrail 0.5.2 | 98.6% | 86.6% | 21.2% | 98.3% / 19.3% | 1.72 |
-| agent-sql-guard 0.2.0 | 67.9% | 86.6% | 14.5% | 89.5% / 17.2% | 1.26 |
-| krish2105/sqlguard 0.1.0 | 65.8% | 91.4% | 8.6% | 83.5% / 5.2% | 1.22 |
-
-**Read the native row with care.** The corpus and the engine were developed together, and
-every disagreement was triaged by fixing the engine or correcting a label (both are logged).
-100% shows consistency with the documented semantics, not independent detection quality. The
-other tools have smaller policy models (no roles, labels, aggregate-only access or review), so
-the "within capability" column is the fairer comparison. Methodology and threats to validity:
-[BENCHMARK_METHODOLOGY.md](docs/guides/BENCHMARK_METHODOLOGY.md).
+Results for corpus v1.1.0 (551 cases, 1,044 evaluations; SQLGuard Ninja 0.2.0; Windows 11,
+Python 3.11). Intervals are 95% Wilson intervals. Details, CSV and raw files:
+[RESULTS_v1.1.md](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/benchmarks/RESULTS_v1.1.md).
+
+| Validator | Recall (95% CI) | Precision | F1 | FPR (95% CI) | Recall / FPR within declared capability | p95 ms |
+|---|---:|---:|---:|---:|---:|---:|
+| SQLGuard Ninja 0.2.0 | 100.0% (99.4–100.0) | 100.0% | 1.000 | 0.0% (0.0–0.9) | 100.0% / 0.0% | 3.33 |
+| sql-guardrail 0.5.2 | 98.7% (97.4–99.3) | 85.1% | 0.914 | 24.1% (20.3–28.3) | 98.3% / 19.7% | 2.63 |
+| agent-sql-guard 0.2.0 | 67.3% (63.4–70.9) | 85.2% | 0.752 | 16.3% (13.1–20.0) | 89.4% / 17.7% | 1.87 |
+| krish2105/sqlguard 0.1.0 | 65.3% (61.4–69.0) | 89.6% | 0.755 | 10.5% (8.0–13.8) | 83.5% / 5.2% | 1.95 |
+
+**All of these are internal results.** The corpus was written by this project, alongside the
+engine. The native 100% shows consistency with the documented semantics, not independent
+detection quality. No independently sourced dataset exists yet ([intake rules](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/benchmarks/datasets/external/README.md),
+issue #6). Reports keep `internal` and `independent` tiers separate, and they also separate
+policy denials from unsupported-SQL denials. Methodology and bias review:
+[BENCHMARK_METHODOLOGY.md](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/guides/BENCHMARK_METHODOLOGY.md),
+[BENCHMARK_BIAS_REVIEW.md](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/guides/BENCHMARK_BIAS_REVIEW.md).
 
 ## How it relates to existing tools
 
@@ -248,7 +250,7 @@ thorough read-only validator with a tautology catch-all, which this project does
 duplicate. [agent-sql-guard](https://github.com/sakura-sky/sql-guard) has a careful
 schema-less PII denylist. What SQLGuard Ninja adds: role- and label-based policies, the agent
 checkpoint contract, a shared benchmark with isolated adapters, planner inspection, and the
-CI gate. Full comparison: [COMPETITIVE_ANALYSIS.md](docs/research/COMPETITIVE_ANALYSIS.md).
+CI gate. Full comparison: [COMPETITIVE_ANALYSIS.md](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/research/COMPETITIVE_ANALYSIS.md).
 
 ## Security limitations
 
@@ -262,13 +264,14 @@ CI gate. Full comparison: [COMPETITIVE_ANALYSIS.md](docs/research/COMPETITIVE_AN
   but those two categories are not measured.
 
 Use database grants, row-level security and timeouts as the authoritative controls. See the
-[threat model](docs/security/THREAT_MODEL.md) and [KNOWN_LIMITATIONS.md](KNOWN_LIMITATIONS.md).
+[threat model](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/security/THREAT_MODEL.md), [limits of static analysis](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/security/STATIC_ANALYSIS_LIMITS.md),
+the [benchmark bias review](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/guides/BENCHMARK_BIAS_REVIEW.md) and [KNOWN_LIMITATIONS.md](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/KNOWN_LIMITATIONS.md).
 
 ## Roadmap
 
 Next: restricted-function and system-catalog benchmark cases, an independent held-out
 corpus, lineage-aware aggregate checks, and tenant predicate push-down. Later: governed
-writes, more tested dialects, and SARIF output. Details in [ROADMAP.md](ROADMAP.md).
+writes, more tested dialects, and SARIF output. Details in [ROADMAP.md](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/ROADMAP.md).
 
 ## Links
 
@@ -276,18 +279,20 @@ writes, more tested dialects, and SARIF output. Details in [ROADMAP.md](ROADMAP.
 * Releases: https://github.com/Pratik653/SQLGuard_Ninjapy/releases
 * PyPI: https://pypi.org/project/sqlguard-ninja/
 * Issues: https://github.com/Pratik653/SQLGuard_Ninjapy/issues
-* Security policy: [SECURITY.md](SECURITY.md) · Contributing: [CONTRIBUTING.md](CONTRIBUTING.md)
+* Security policy: [SECURITY.md](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/SECURITY.md) · Contributing: [CONTRIBUTING.md](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/CONTRIBUTING.md)
 
 ## Documentation
 
-* [Policy reference](docs/guides/POLICY_REFERENCE.md)
-* [Agent integration](docs/guides/AGENT_INTEGRATION.md)
-* [Query cost](docs/guides/QUERY_COST.md)
-* [CI integration](docs/guides/CI_INTEGRATION.md)
-* [Benchmark methodology](docs/guides/BENCHMARK_METHODOLOGY.md)
-* [Threat model](docs/security/THREAT_MODEL.md)
-* [Architecture decisions](docs/architecture/ARCHITECTURE_DECISIONS.md)
-* [Known limitations](KNOWN_LIMITATIONS.md) · [Roadmap](ROADMAP.md) · [Changelog](CHANGELOG.md)
+* [Policy reference](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/guides/POLICY_REFERENCE.md)
+* [Agent integration](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/guides/AGENT_INTEGRATION.md)
+* [Query cost](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/guides/QUERY_COST.md)
+* [CI integration](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/guides/CI_INTEGRATION.md)
+* [Benchmark methodology](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/guides/BENCHMARK_METHODOLOGY.md)
+* [Threat model](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/security/THREAT_MODEL.md)
+* [Limits of static SQL analysis and dialect support](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/security/STATIC_ANALYSIS_LIMITS.md)
+* [Benchmark bias review](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/guides/BENCHMARK_BIAS_REVIEW.md)
+* [Architecture decisions](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/architecture/ARCHITECTURE_DECISIONS.md)
+* [Known limitations](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/KNOWN_LIMITATIONS.md) · [Roadmap](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/ROADMAP.md) · [Changelog](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/CHANGELOG.md)
 
 ## Supported versions
 
@@ -305,10 +310,10 @@ pytest                          # PostgreSQL tests run if SQLNINJA_PG_DSN is set
 python scripts/generate_corpus.py --check
 ```
 
-See [CONTRIBUTING.md](CONTRIBUTING.md). Report vulnerabilities privately per
-[SECURITY.md](SECURITY.md).
+See [CONTRIBUTING.md](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/CONTRIBUTING.md). Report vulnerabilities privately per
+[SECURITY.md](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/SECURITY.md).
 
 ## Licence
 
 Apache-2.0. No third-party code is vendored; dependencies and their licences are listed in
-[THIRD_PARTY_NOTICES.md](THIRD_PARTY_NOTICES.md). All benchmark data is synthetic.
+[THIRD_PARTY_NOTICES.md](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/THIRD_PARTY_NOTICES.md). All benchmark data is synthetic.