sqlguard-ninja 0.5.0__tar.gz → 0.7.0__tar.gz

{sqlguard_ninja-0.5.0 → sqlguard_ninja-0.7.0}/.gitignore

@@ -28,3 +28,7 @@ htmlcov/
 !.env.example
 audit*.jsonl
 .pytest_tmp/
+
+# Static demo build output and download cache
+/.cache/
+/site/

{sqlguard_ninja-0.5.0 → sqlguard_ninja-0.7.0}/CHANGELOG.md

@@ -3,6 +3,62 @@
 All notable changes are documented here. The project follows
 [Semantic Versioning](https://semver.org/); before 1.0, minor versions may change the API.
 
+## [0.7.0] — 2026-10-24
+
+### Added
+* **Interactive playground** (`sqlguard_ninja.demo`, extra `[demo]`, `sqlninja demo serve`).
+  It runs on a synthetic retail database with three enforceable roles: Sales Analyst,
+  Customer Support and Store Manager. Features:
+  * an SQL editor and 20 example queries; tests check each one's expected decision
+  * plain-language explanations with how-to-fix hints
+  * lineage (output → base column, column usage with access per role)
+  * tenant-isolation demonstrations and a role-permission browser
+  * a benchmark dashboard that separates the 1,070 internal evaluations from the 0
+    independent ones
+* **Restricted sandbox** for allowed demo queries. The database enforces it: an authorizer
+  allowlist, `query_only`, engine limits, a step/time budget and a row cap.
+* **Static build** (`scripts/build_static_demo.py`). The same service runs in the browser with
+  Pyodide. Everything is self-hosted and checksum-verified, and the site makes no third-party
+  requests.
+* **Deployment references:**
+  * a hardened `Dockerfile`: non-root, digest-pinned base, healthcheck
+  * a Compose file: read-only, no capabilities, resource limits
+  * Kubernetes manifests: restricted security context, probes, NetworkPolicy without
+    egress, PDB, example Ingress
+  * a manual GitHub Pages workflow
+* **Server hardening:**
+  * validated `SQLNINJA_DEMO_*` settings
+  * per-client rate limiting, a body cap and 411 on chunked bodies
+  * strict CSP and security headers
+  * `/healthz` and `/readyz`
+* **Browser end-to-end tests** (Playwright) in server mode and against the offline static
+  build, including axe-core accessibility checks, keyboard use, small screens and XSS-safe
+  rendering. New CI jobs cover these tests and the container and manifests.
+* ADR-014, threat model T20, `docs/guides/DEPLOYMENT.md`.
+
+## [0.6.0] — 2026-10-24
+
+### Added
+* **Observability** (`sqlguard_ninja.observability`, extras `[otel]` and `[prometheus]`):
+  * `Telemetry` and `InstrumentedGuard` emit OpenTelemetry spans `sqlguard.checkpoint` and
+    `sqlguard.validate`.
+  * `GuardMetrics` exports Prometheus counters and histograms for decisions, findings,
+    latency, errors, resource-limit rejections, checkpoint outcomes and policy identity.
+  * `SQLCheckpoint(telemetry=...)` instruments its guard automatically.
+* **SARIF 2.1.0**: `sqlninja scan PATH... --format sarif|json|text --fail-on deny|review|never`.
+  It validates every statement in SQL files, with stable fingerprints. Tests and CI validate the
+  output against the OASIS schema.
+* **Grafana dashboard** `deploy/grafana/sqlguard-ninja.json`, and a Prometheus + Grafana +
+  synthetic-traffic stack (`examples/observability/`). A new CI job runs that stack.
+* Audit events gain `schema_version` and `rate_limited`. New
+  `SQLCheckpoint(principal_hmac_key=...)` option to pseudonymise principals.
+
+### Security
+* `redact_sql` now redacts hex, bit, byte (`E''`), dollar-quoted, Unicode (`U&''`) and
+  national (`N''`) strings and whole `INTERVAL` expressions. Previously these could reach
+  `sql_redacted` in audit logs. Comments are dropped, and if any literal token survives,
+  redacted SQL is withheld. See threat model T19.
+
 ## [0.5.0] — 2026-10-24
 
 ### Added

{sqlguard_ninja-0.5.0 → sqlguard_ninja-0.7.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: sqlguard-ninja
-Version: 0.5.0
+Version: 0.7.0
 Summary: Security testing, policy enforcement, agent integration, privacy analysis and CI benchmarking for LLM-generated SQL.
 Project-URL: Homepage, https://github.com/Pratik653/SQLGuard_Ninjapy
 Project-URL: Documentation, https://github.com/Pratik653/SQLGuard_Ninjapy/tree/main/docs
@@ -30,23 +30,34 @@ Requires-Dist: fastapi>=0.110; extra == 'all'
 Requires-Dist: langchain-core>=0.3; extra == 'all'
 Requires-Dist: langgraph>=0.2; extra == 'all'
 Requires-Dist: mcp<3,>=2.3; extra == 'all'
+Requires-Dist: opentelemetry-api>=1.25; extra == 'all'
+Requires-Dist: prometheus-client>=0.20; extra == 'all'
 Requires-Dist: psycopg[binary]>=3.1; extra == 'all'
 Requires-Dist: pymysql>=1.1; extra == 'all'
+Requires-Dist: uvicorn>=0.30; extra == 'all'
+Provides-Extra: demo
+Requires-Dist: fastapi>=0.110; extra == 'demo'
+Requires-Dist: uvicorn>=0.30; extra == 'demo'
 Provides-Extra: dev
 Requires-Dist: build>=1.2; extra == 'dev'
 Requires-Dist: fastapi>=0.110; extra == 'dev'
 Requires-Dist: httpx>=0.27; extra == 'dev'
 Requires-Dist: hypothesis>=6.100; extra == 'dev'
+Requires-Dist: jsonschema>=4.20; extra == 'dev'
 Requires-Dist: langchain-core>=0.3; extra == 'dev'
 Requires-Dist: langgraph>=0.2; extra == 'dev'
 Requires-Dist: mcp<3,>=2.3; extra == 'dev'
 Requires-Dist: mypy>=1.10; extra == 'dev'
+Requires-Dist: opentelemetry-api>=1.25; extra == 'dev'
+Requires-Dist: opentelemetry-sdk>=1.25; extra == 'dev'
+Requires-Dist: prometheus-client>=0.20; extra == 'dev'
 Requires-Dist: psycopg[binary]>=3.1; extra == 'dev'
 Requires-Dist: pymysql>=1.1; extra == 'dev'
 Requires-Dist: pytest-cov>=5.0; extra == 'dev'
 Requires-Dist: pytest>=8.0; extra == 'dev'
 Requires-Dist: ruff>=0.6; extra == 'dev'
 Requires-Dist: types-pyyaml; extra == 'dev'
+Requires-Dist: uvicorn>=0.30; extra == 'dev'
 Provides-Extra: fastapi
 Requires-Dist: fastapi>=0.110; extra == 'fastapi'
 Provides-Extra: langchain
@@ -58,8 +69,12 @@ Provides-Extra: mcp
 Requires-Dist: mcp<3,>=2.3; extra == 'mcp'
 Provides-Extra: mysql
 Requires-Dist: pymysql>=1.1; extra == 'mysql'
+Provides-Extra: otel
+Requires-Dist: opentelemetry-api>=1.25; extra == 'otel'
 Provides-Extra: postgres
 Requires-Dist: psycopg[binary]>=3.1; extra == 'postgres'
+Provides-Extra: prometheus
+Requires-Dist: prometheus-client>=0.20; extra == 'prometheus'
 Description-Content-Type: text/markdown
 
 # SQLGuard Ninja
@@ -290,6 +305,40 @@ The four tools are `validate_sql`, `explain_policy_decision`, `inspect_query_cos
 to a database, and it exposes no execution tool. Tested with the official MCP Python SDK
 client over stdio. See [MCP_INTEGRATION.md](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/guides/MCP_INTEGRATION.md).
 
+## Interactive playground
+
+A web app on a synthetic retail database. It has:
+
+* three enforceable roles (Sales Analyst, Customer Support, Store Manager)
+* example queries, with explanations and how-to-fix hints
+* lineage, tenant-isolation demonstrations and role permissions
+* a benchmark dashboard that separates internal from independent results
+
+```bash
+python -m pip install "sqlguard-ninja[demo]"
+sqlninja demo serve          # http://127.0.0.1:8000
+```
+
+Allowed queries run in a restricted in-memory sandbox. The database itself enforces this
+with an authorizer allowlist, engine limits and a time budget. A static build
+(`scripts/build_static_demo.py`) runs the whole thing in the browser with Pyodide, with no
+server. See [DEPLOYMENT.md](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/guides/DEPLOYMENT.md)
+for Docker, Compose and Kubernetes.
+
+## Observability and SARIF
+
+```bash
+python -m pip install "sqlguard-ninja[otel,prometheus]"
+sqlninja scan sql/ --policy policy.yaml --role reporting --tenant 1 --format sarif --output sqlninja.sarif
+```
+
+`Telemetry(tracer=..., metrics=GuardMetrics())` adds OpenTelemetry spans and Prometheus metrics
+to the checkpoint: decisions, findings by rule, latency, errors, resource-limit rejections and
+checkpoint outcomes. By default no signal contains SQL text, literals, request-context values,
+tenant ids or principals, and tests check this with canary values. A Grafana dashboard
+(`deploy/grafana/`) and a synthetic-traffic Prometheus/Grafana stack are included. SARIF output
+validates against the OASIS 2.1.0 schema. See [OBSERVABILITY.md](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/guides/OBSERVABILITY.md).
+
 ## Query cost analysis
 
 Every validation includes an explainable static score that uses the catalog's
@@ -371,9 +420,9 @@ the [benchmark bias review](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/m
 
 ## Roadmap
 
-Next: restricted-function and system-catalog benchmark cases, an independent held-out
-corpus, lineage-aware aggregate checks, and tenant predicate push-down. Later: governed
-writes, more tested dialects, and SARIF output. Details in [ROADMAP.md](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/ROADMAP.md).
+Next: restricted-function and system-catalog benchmark cases (issue #5), an independent
+held-out corpus (issue #6) and public hosting of the playground. Later:
+governed writes, and database-verified SQL Server and Oracle support. Details in [ROADMAP.md](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/ROADMAP.md).
 
 ## Links
 
@@ -391,6 +440,9 @@ writes, more tested dialects, and SARIF output. Details in [ROADMAP.md](https://
 * [Agent integration](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/guides/AGENT_INTEGRATION.md)
 * [Query cost](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/guides/QUERY_COST.md)
 * [CI integration](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/guides/CI_INTEGRATION.md)
+* [Playground and deployment](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/guides/DEPLOYMENT.md)
+* [Observability and SARIF](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/guides/OBSERVABILITY.md)
+* [Database compatibility](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/guides/DATABASE_COMPATIBILITY.md)
 * [Benchmark methodology](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/guides/BENCHMARK_METHODOLOGY.md)
 * [Threat model](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/security/THREAT_MODEL.md)
 * [Limits of static SQL analysis and dialect support](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/security/STATIC_ANALYSIS_LIMITS.md)

{sqlguard_ninja-0.5.0 → sqlguard_ninja-0.7.0}/README.md

@@ -226,6 +226,40 @@ The four tools are `validate_sql`, `explain_policy_decision`, `inspect_query_cos
 to a database, and it exposes no execution tool. Tested with the official MCP Python SDK
 client over stdio. See [MCP_INTEGRATION.md](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/guides/MCP_INTEGRATION.md).
 
+## Interactive playground
+
+A web app on a synthetic retail database. It has:
+
+* three enforceable roles (Sales Analyst, Customer Support, Store Manager)
+* example queries, with explanations and how-to-fix hints
+* lineage, tenant-isolation demonstrations and role permissions
+* a benchmark dashboard that separates internal from independent results
+
+```bash
+python -m pip install "sqlguard-ninja[demo]"
+sqlninja demo serve          # http://127.0.0.1:8000
+```
+
+Allowed queries run in a restricted in-memory sandbox. The database itself enforces this
+with an authorizer allowlist, engine limits and a time budget. A static build
+(`scripts/build_static_demo.py`) runs the whole thing in the browser with Pyodide, with no
+server. See [DEPLOYMENT.md](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/guides/DEPLOYMENT.md)
+for Docker, Compose and Kubernetes.
+
+## Observability and SARIF
+
+```bash
+python -m pip install "sqlguard-ninja[otel,prometheus]"
+sqlninja scan sql/ --policy policy.yaml --role reporting --tenant 1 --format sarif --output sqlninja.sarif
+```
+
+`Telemetry(tracer=..., metrics=GuardMetrics())` adds OpenTelemetry spans and Prometheus metrics
+to the checkpoint: decisions, findings by rule, latency, errors, resource-limit rejections and
+checkpoint outcomes. By default no signal contains SQL text, literals, request-context values,
+tenant ids or principals, and tests check this with canary values. A Grafana dashboard
+(`deploy/grafana/`) and a synthetic-traffic Prometheus/Grafana stack are included. SARIF output
+validates against the OASIS 2.1.0 schema. See [OBSERVABILITY.md](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/guides/OBSERVABILITY.md).
+
 ## Query cost analysis
 
 Every validation includes an explainable static score that uses the catalog's
@@ -307,9 +341,9 @@ the [benchmark bias review](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/m
 
 ## Roadmap
 
-Next: restricted-function and system-catalog benchmark cases, an independent held-out
-corpus, lineage-aware aggregate checks, and tenant predicate push-down. Later: governed
-writes, more tested dialects, and SARIF output. Details in [ROADMAP.md](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/ROADMAP.md).
+Next: restricted-function and system-catalog benchmark cases (issue #5), an independent
+held-out corpus (issue #6) and public hosting of the playground. Later:
+governed writes, and database-verified SQL Server and Oracle support. Details in [ROADMAP.md](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/ROADMAP.md).
 
 ## Links
 
@@ -327,6 +361,9 @@ writes, more tested dialects, and SARIF output. Details in [ROADMAP.md](https://
 * [Agent integration](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/guides/AGENT_INTEGRATION.md)
 * [Query cost](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/guides/QUERY_COST.md)
 * [CI integration](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/guides/CI_INTEGRATION.md)
+* [Playground and deployment](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/guides/DEPLOYMENT.md)
+* [Observability and SARIF](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/guides/OBSERVABILITY.md)
+* [Database compatibility](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/guides/DATABASE_COMPATIBILITY.md)
 * [Benchmark methodology](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/guides/BENCHMARK_METHODOLOGY.md)
 * [Threat model](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/security/THREAT_MODEL.md)
 * [Limits of static SQL analysis and dialect support](https://github.com/Pratik653/SQLGuard_Ninjapy/blob/main/docs/security/STATIC_ANALYSIS_LIMITS.md)

{sqlguard_ninja-0.5.0 → sqlguard_ninja-0.7.0}/THIRD_PARTY_NOTICES.md

@@ -1,7 +1,8 @@
 # Third-party notices
 
 SQLGuard Ninja is licensed under Apache-2.0. **It does not vendor or copy third-party source
-code.** The projects below are used as ordinary dependencies, installed by the package
+code.** The only third-party file in the repository is a test fixture, the SARIF schema
+(below). The projects below are used as ordinary dependencies, installed by the package
 manager under their own licences. Licences were read from installed package metadata on
 2026-10-24. Always check the version you install.
 
@@ -21,6 +22,11 @@ manager under their own licences. Licences were read from installed package meta
 | `langgraph` | langgraph | 1.2.17 | MIT |
 | `fastapi` | fastapi / starlette | 0.162.0 / 1.9.0 | MIT / BSD-3-Clause |
 | `postgres` | psycopg (+ psycopg-binary) | 3.3.6 | LGPL-3.0-only |
+| `mcp` | mcp (official MCP Python SDK) | 2.3.0 | MIT |
+| `mysql` | PyMySQL | 1.2.3 | MIT |
+| `otel` | opentelemetry-api | 1.45.1 | Apache-2.0 |
+| `prometheus` | prometheus-client | 0.26.0 | Apache-2.0 AND BSD-2-Clause |
+| `demo` | fastapi / uvicorn | 0.162.0 / 0.54.0 | MIT / BSD-3-Clause |
 
 psycopg is LGPL-3.0. SQLGuard Ninja only imports it at runtime when the `postgres` extra is
 installed. It is not modified or bundled, which is compatible with distributing SQLGuard Ninja
@@ -33,6 +39,29 @@ mypy (MIT), build (MIT). `pgserver` is optionally used for local PostgreSQL test
 declared dependency, and its package metadata on PyPI does not declare a licence. It bundles
 PostgreSQL binaries (PostgreSQL License).
 
+Tests also use jsonschema (MIT), opentelemetry-sdk (Apache-2.0), Playwright and
+pytest-playwright (Apache-2.0), and axe-core 4.10.3 (MPL-2.0), which is downloaded at test time.
+
+The **static playground build** (`scripts/build_static_demo.py`, not part of the package)
+bundles Pyodide 0.29.5 (MPL-2.0, including CPython under the PSF License and SQLite, which is
+public domain), sqlglot (MIT), and pydantic, PyYAML and their dependencies as packaged by
+Pyodide. Their licences are listed in the generated `NOTICE.txt`.
+
+## Test fixture: SARIF 2.1.0 JSON schema
+
+`tests/data/sarif-schema-2.1.0.json` is the unmodified OASIS SARIF 2.1.0 (Errata 01) schema,
+downloaded from
+https://docs.oasis-open.org/sarif/sarif/v2.1.0/errata01/os/schemas/sarif-schema-2.1.0.json
+(SHA-256 `c3b4bb2d6093897483348925aaa73af03b3e3f4bd4ca38cef26dcb4212a2682e`). It is used only to
+validate SARIF output in tests and is not part of the wheel.
+
+> Copyright © OASIS Open 2020. All Rights Reserved. This document and translations of it may be
+> copied and furnished to others, and derivative works that comment on or otherwise explain it
+> or assist in its implementation may be prepared, copied, published, and distributed, in whole
+> or in part, without restriction of any kind, provided that the above copyright notice and this
+> section are included on all such copies and derivative works. (OASIS IPR Policy notice; see
+> https://www.oasis-open.org/policies-guidelines/ipr/)
+
 ## External validators used for benchmarking only
 
 Installed into isolated virtual environments by `scripts/setup_external_adapters.py`, never

{sqlguard_ninja-0.5.0 → sqlguard_ninja-0.7.0}/docs/architecture/ARCHITECTURE_DECISIONS.md

@@ -166,3 +166,16 @@ MySQL with server defaults, so the executor refuses sessions whose `sql_mode` co
 **Consequences.** This refines ADR-005: the executed string differs from the validated one only
 in placeholder nodes, which carry server-side values, never user input. Literals and identifiers
 are not rewritten. MySQL support is limited to the scope the CI service-container tests cover.
+
+## ADR-014 — Playground: one service, static-first hosting, database-enforced sandbox
+
+**Decision.** One Python `DemoService` backs both a FastAPI server and a static build in which
+Pyodide runs the same code in the visitor's browser. Allowed queries run only in an in-memory
+synthetic SQLite database. That database enforces read-only access itself: an authorizer
+allowlist, `query_only`, engine limits and a step/time budget. The public deployment is the
+static build on GitHub Pages: there is no server to abuse, no credentials, and no cost. The
+static build self-hosts Pyodide and the wheels and verifies their checksums.
+
+**Consequences.** The first static load downloads about 16 MB. The server mode stays available
+for private use behind a proxy (Docker/Compose/Kubernetes references). In-process rate limits
+are per replica.

{sqlguard_ninja-0.5.0 → sqlguard_ninja-0.7.0}/docs/development/IMPLEMENTATION_PROGRESS.md

@@ -10,4 +10,7 @@
 | 2c Opt-in AST tenant-filter rewrite + checkpoint | VERIFIED (local) | b0b5ade | test_tenant_rewrite (32, executes on SQLite, tenants 1-3) | |
 | 2d Docs, ADR-011/012, v0.3.0 bump | RELEASED v0.3.0 | 198a308 | full gate 1,804 passed, 94% | |
 | 3 MCP server (stdio, validation-only) | RELEASED v0.4.0 | ecec4da | 9 tests incl. real SDK client; published-package stdio smoke test | version targets adapted |
-| 4 MySQL tested dialect; SQL Server/Oracle experimental; compatibility matrix | VERIFIED (local, CI pending) | see PR | full gate 1,881 passed, 94%; 15 MySQL server tests run in CI | sql_mode parser differential found and closed (T18) |
+| 4 MySQL tested dialect; SQL Server/Oracle experimental; compatibility matrix | RELEASED v0.5.0 | de4d03f | full gate 1,881 passed, 94%; CI MySQL 8.4: 15 passed, 0 skipped | sql_mode parser differential found and closed (T18) |
+| 5 Observability: OTel spans, Prometheus metrics, audit schema, SARIF scan, Grafana + synthetic stack | RELEASED v0.6.0 | 3867989 | full gate 1,916 passed, 94%; CI stack: 224 decisions scraped, Grafana query success | redaction leak (hex/E''/$$/U&/N''/INTERVAL) found and fixed (T19) |
+| 6 Playground: 3 roles, examples, explanations, lineage, tenant demo, permissions, benchmark dashboard; static Pyodide build | VERIFIED (local, CI pending) | see PR | 1,959 passed, 94%; 14 browser tests incl. axe + offline static | database-enforced sandbox |
+| 7 Deployment: Dockerfile, Compose, Kubernetes, health, config validation, rate/body limits | VERIFIED (local tests; container in CI pending) | see PR | manifest and hardening tests | no Docker locally |

sqlguard_ninja-0.7.0/docs/development/NEXT_ACTIONS.md

@@ -0,0 +1,5 @@
+# Next actions (development program)
+
+1. SQL Server/Oracle real-database tests need vendor licence acceptance (maintainer decision); MySQL function/catalog cases stay under #5.
+2. Merge the v0.7.0 PR after CI (demo e2e + container jobs); add both jobs to required checks; release; verify PyPI + fresh `[demo]` install and `sqlninja demo serve`.
+3. Phase 8: public hosting needs maintainer authorization: enable GitHub Pages (Source: GitHub Actions), then run `pages.yml` and verify the real HTTPS URL in an unauthenticated browser.

{sqlguard_ninja-0.5.0 → sqlguard_ninja-0.7.0}/docs/development/TEST_EVIDENCE.md

@@ -16,3 +16,9 @@
 | 2026-10-24 | v0.4.0 release | PR #20 12/12; main CI on ecec4da success; release.yml run 40117676554 success | wheel and sdist on PyPI, both provenance endpoints 200; 0.1.0-0.3.0 unchanged |
 | 2026-10-24 | v0.4.0 fresh install + MCP stdio | `pip install --no-cache-dir "sqlguard-ninja[mcp]==0.4.0"` (Python 3.13, outside repo, 4th attempt; CDN lag), then SDK `stdio_client`/`ClientSession` against installed `sqlninja mcp` | 4 tools; allow/deny/cross-tenant deny; 100,001-char input `invalid_input`; forged `role` argument has no effect (deny); capabilities hide denied tables, `read_only: true`; no finding detail leaked |
 | 2026-10-24 | v0.5.0 candidate (MySQL) | full gate (`ruff`, `mypy`, corpus `--check`, `pytest --cov -m "not mysql"` incl. embedded PostgreSQL, build, `twine check --strict`) | 1,881 passed, 94%; twine PASSED; corpus 1.2.0: 1,070 evaluations, 4 adapters regenerated |
+| 2026-10-24 | v0.5.0 release | PR #22 13/13 (MySQL job: 15 passed, 0 skipped); MySQL job added to required checks; main CI 40119298660 on de4d03f success; release.yml 40119480081 success | wheel and sdist on PyPI, both provenance endpoints 200; 0.1.0-0.4.0 unchanged |
+| 2026-10-24 | v0.5.0 fresh install | `pip install --no-cache-dir "sqlguard-ninja[mysql]==0.5.0"` (Python 3.13, outside repo, `-I`; 2nd attempt) | PyMySQL 1.2.3; dialects include mysql; bundled corpus 1.2.0, 26 MySQL cases 0 mismatches; binding and sql_mode refusals; `o.ID` and card column denied. No MySQL server locally, so execution is evidenced by CI only |
+| 2026-10-24 | v0.6.0 candidate (observability) | full gate (`ruff`, `mypy`, corpus `--check`, `pytest --cov -m "not mysql"`, build, `twine check --strict`) | 1,916 passed, 94%; twine PASSED; SARIF schema-valid; canary privacy tests over 13 literal forms |
+| 2026-10-24 | v0.6.0 release | PR #24 14/14 (observability job: SARIF valid, decisions=224, 9 panels, grafana_query=success; 2nd run after tmpfs noexec fix); job added to required checks; main CI 40127541718 success; release.yml 40127737479 success | wheel + sdist on PyPI, both provenance 200; 0.1.0-0.5.0 unchanged |
+| 2026-10-24 | v0.6.0 fresh install | `pip install --no-cache-dir "sqlguard-ninja[otel,prometheus]==0.6.0"` + opentelemetry-sdk, jsonschema (Python 3.13, outside repo, `-I`) | spans checkpoint+validate; decisions allow 2 / deny 1; canary in literal, hex, comment and context not leaked; redacted SQL correct; `scan` SARIF valid against OASIS schema fetched separately |
+| 2026-10-24 | v0.7.0 candidate (playground + deployment) | full gate + `pytest -m e2e` (Playwright Chromium; static site built with verified downloads; external requests blocked) | 1,959 passed, 94%; 14 e2e passed incl. axe serious/critical = 0, 360/768 px no overflow; build + twine PASSED |

{sqlguard_ninja-0.5.0 → sqlguard_ninja-0.7.0}/docs/development/progress.json

@@ -62,54 +62,64 @@
     {
       "id": 5,
       "name": "Database dialects",
-      "status": "VERIFIED",
+      "status": "RELEASED",
       "release": "v0.5.0",
       "issues": [
         11
       ],
       "evidence": [
-        "MySQL executor/binding/sql_mode guard, 26 corpus cases; 1,881 local tests; CI MySQL job pending"
+        "MySQL executor/binding/sql_mode guard, 26 corpus cases; 1,881 local tests; CI MySQL job pending",
+        "v0.5.0 on PyPI with provenance; CI MySQL 8.4 15/15; fresh [mysql] install verified"
       ],
       "blockers": []
     },
     {
       "id": 6,
       "name": "Observability and SARIF",
-      "status": "NOT_STARTED",
-      "release": "v0.4.0",
+      "status": "RELEASED",
+      "release": "v0.6.0",
       "issues": [
         14
       ],
-      "evidence": [],
+      "evidence": [
+        "OTel/Prometheus/SARIF/Grafana + canary privacy tests; 1,916 local tests; CI pending",
+        "v0.6.0 on PyPI with provenance; fresh [otel,prometheus] install verified"
+      ],
       "blockers": []
     },
     {
       "id": 7,
       "name": "Web dashboard and playground",
-      "status": "NOT_STARTED",
-      "release": "v0.5.0",
+      "status": "VERIFIED",
+      "release": "v0.7.0",
       "issues": [],
-      "evidence": [],
+      "evidence": [
+        "FastAPI + static Pyodide playground; 14 Playwright tests incl. axe; CI pending"
+      ],
       "blockers": []
     },
     {
       "id": 8,
       "name": "Production deployment",
-      "status": "NOT_STARTED",
-      "release": "v0.5.0",
+      "status": "VERIFIED",
+      "release": "v0.7.0",
       "issues": [],
-      "evidence": [],
+      "evidence": [
+        "Dockerfile/Compose/Kubernetes with hardening tests; container CI pending"
+      ],
       "blockers": []
     },
     {
       "id": 9,
       "name": "Public zero-API-key demo",
-      "status": "NOT_STARTED",
+      "status": "BLOCKED",
       "release": "v0.5.0",
       "issues": [],
-      "evidence": [],
+      "evidence": [
+        "static build ready and tested offline; pages.yml manual workflow prepared"
+      ],
       "blockers": [
-        "public hosting needs maintainer account authorization"
+        "needs maintainer authorization to enable GitHub Pages"
       ]
     }
   ]

{sqlguard_ninja-0.5.0 → sqlguard_ninja-0.7.0}/docs/guides/CI_INTEGRATION.md

@@ -11,6 +11,28 @@ git add benchmarks/baseline.json  # baselines change only through reviewed commi
 
 `sqlninja benchmark baseline` refuses to run when `CI` is set. CI never updates baselines.
 
+## SARIF and GitHub code scanning
+
+`sqlninja scan` writes SARIF 2.1.0. Upload it with GitHub's own action, pinned to a commit SHA
+you have reviewed. Uploading needs `security-events: write`, and code scanning must be available
+for the repository.
+
+```yaml
+permissions:
+  contents: read
+  security-events: write
+steps:
+  - uses: actions/checkout@<sha>
+  - run: pip install sqlguard-ninja
+  - run: sqlninja scan sql/ --policy policy.yaml --role reporting --tenant 1 --format sarif --output sqlninja.sarif --fail-on never
+  - uses: github/codeql-action/upload-sarif@<sha>
+    with:
+      sarif_file: sqlninja.sarif
+```
+
+Results are fingerprinted per file, rule and literal-insensitive query, so changing only a
+literal does not open a new alert. The log contains rule messages but no SQL snippet.
+
 ## GitHub Action
 
 See [`examples/github-actions/sql-security.yml`](../../examples/github-actions/sql-security.yml).

sqlguard_ninja-0.7.0/docs/guides/DEPLOYMENT.md

@@ -0,0 +1,122 @@
+# Playground and deployment
+
+The playground is a web app on a synthetic retail database. It has:
+
+* three roles: Sales Analyst, Customer Support and Store Manager
+* example queries and plain-language explanations
+* lineage, tenant isolation, role permissions and a benchmark dashboard
+
+It needs no login, API key or credentials.
+
+It runs in two modes from the same frontend and the same Python `DemoService`:
+
+| Mode | How | Where SQL is validated and run |
+|---|---|---|
+| **Static** (recommended for public hosting) | `python scripts/build_static_demo.py site/` | in the visitor's browser, through Pyodide in a Web Worker; no server |
+| **Server** | `pip install "sqlguard-ninja[demo]"` then `sqlninja demo serve` | FastAPI server, restricted in-memory sandbox |
+
+## Execution safety
+
+The demo does not rely on the parser alone, or on rolling back a transaction. Only queries
+the policy **allows** run, and they run against an in-memory SQLite database of synthetic
+data. That database enforces its own restrictions (`sqlguard_ninja/demo/sandbox.py`):
+
+* `PRAGMA query_only`.
+* An **authorizer** that allows only `SELECT`, reads of the catalog's tables and an allowlist
+  of side-effect-free functions. ATTACH, PRAGMA, writes, schema changes, `sqlite_master` and
+  `load_extension` are refused by the engine.
+* **Engine limits**: string length, SQL length, expression depth, compound selects, zero
+  attached databases, and few variables.
+* A **step and time budget** through the progress handler. Recursive CTEs and cartesian
+  products are interrupted.
+* A row cap of 100, plus value truncation.
+
+The database holds no real data. In the static build it exists only in the visitor's browser.
+Set `SQLNINJA_DEMO_EXECUTE=false` for a validation-only server.
+
+`tests/unit/test_demo.py` checks every one of these refusals.
+
+## Server settings
+
+Settings are read from the environment and validated at start-up. Unknown or invalid values
+stop the server.
+
+| Variable | Default | Meaning |
+|---|---|---|
+| `SQLNINJA_DEMO_EXECUTE` | `true` | run allowed queries in the sandbox |
+| `SQLNINJA_DEMO_RATE_LIMIT_PER_MINUTE` | `60` | per-client API requests per minute (per process) |
+| `SQLNINJA_DEMO_MAX_BODY_BYTES` | `16384` | request body cap; bodies without `Content-Length` are refused |
+| `SQLNINJA_DEMO_TRUST_PROXY_HEADERS` | `false` | take the client from `X-Forwarded-For`; enable only behind a proxy that overwrites it |
+| `SQLNINJA_DEMO_MAX_TRACKED_CLIENTS` | `10000` | memory bound for the rate limiter |
+
+The server also:
+
+* sends a strict CSP with no inline script, `frame-ancestors 'none'`, `nosniff`, and
+  `no-referrer`
+* disables the OpenAPI and docs pages
+* exposes `/healthz` (liveness) and `/readyz` (the sandbox answers)
+* rejects identity forgery: role and tenant come from fixed enums, and extra fields are
+  rejected with 422
+
+## Docker and Compose
+
+```bash
+docker build -t sqlguard-ninja-demo .
+docker compose -f deploy/compose/docker-compose.yml up -d --build --wait
+```
+
+The image is multi-stage, with the base pinned by digest. It runs as non-root (UID 10001) and
+has a `HEALTHCHECK`. The Compose file adds:
+
+* a read-only root filesystem with a small tmpfs
+* `cap_drop: ALL` and `no-new-privileges`
+* memory, CPU and PID limits
+* port binding to localhost only
+
+CI builds the image and runs it under those restrictions. It then checks that the user is
+UID 10001, that the probes pass, that the CSP header is present, and that one allowed and one
+denied API call behave correctly.
+
+## Kubernetes (example)
+
+`deploy/kubernetes/` (Kustomize) contains:
+
+* a Deployment:
+  * non-root with a RuntimeDefault seccomp profile
+  * read-only root filesystem with all capabilities dropped
+  * no service-account token
+  * resource limits
+  * startup, liveness and readiness probes
+* a Service and a PodDisruptionBudget
+* a NetworkPolicy that allows ingress only from the ingress controller and **no egress**
+* an example Ingress with edge rate limits
+
+CI validates these manifests against the Kubernetes schemas with `kubernetes-validate --strict`.
+Replace the image reference with the digest you built and scanned. The in-process rate
+limiter is per replica, so keep the edge limit.
+
+## Public hosting (decision)
+
+Hosting is recorded as ADR-014. Several free options were compared.
+
+**Static options:**
+
+* **GitHub Pages** is free for public repositories and serves over HTTPS. It is already
+  part of the project's GitHub account, with no new vendor, and the build is a single
+  workflow.
+* **Cloudflare Pages** and **Netlify** have free static tiers. Each would need a new
+  account and adds a vendor.
+
+**Server options:** Render, Fly.io and Koyeb have free or trial container tiers. They add an
+always-on attack surface, can sleep on idle, may change their terms, and some require a
+payment card.
+
+**Chosen: the static build on GitHub Pages.** Validation and execution happen in each
+visitor's browser, so there is no shared server to abuse and no database to protect. It runs
+at zero cost. The `_headers` file sets the CSP and related headers on hosts that support it.
+On GitHub Pages, a `<meta>` CSP applies instead.
+
+`.github/workflows/pages.yml` builds the site, tests that exact build in Chromium with every
+external request blocked, and deploys it. It runs **only when started manually**, after the
+maintainer enables Pages (Settings → Pages → Source: GitHub Actions). Do not describe the demo
+as live until an unauthenticated browser has loaded the real HTTPS URL and run a query.