sqllocks-shape 0.9.0__tar.gz

sqllocks_shape-0.9.0/.devcontainer/devcontainer.json

@@ -0,0 +1,6 @@
+{
+  "name": "Shape Dev",
+  "image": "mcr.microsoft.com/devcontainers/python:1-3.12-bookworm",
+  "postCreateCommand": "python -m pip install -e '.[dev]'",
+  "remoteUser": "vscode"
+}

sqllocks_shape-0.9.0/.env.example

@@ -0,0 +1 @@
+# Shape core requires no credentials or network service.

sqllocks_shape-0.9.0/.github/ISSUE_TEMPLATE/bug.md

@@ -0,0 +1,10 @@
+---
+name: Bug
+about: Report reproducible incorrect behavior
+---
+## Reproduction
+## Expected
+## Actual
+## Shape version/environment
+## Security/privacy impact
+Do not attach secrets, PII, classified data, or proprietary datasets.

sqllocks_shape-0.9.0/.github/pull_request_template.md

@@ -0,0 +1,6 @@
+## What changed
+## Requirement/spec impact
+## Tests/evidence
+## Determinism/bounded-memory impact
+## Privacy/security impact
+## Compatibility/migration impact

sqllocks_shape-0.9.0/.github/workflows/ci.yml

@@ -0,0 +1,109 @@
+name: CI
+on: [push, pull_request]
+permissions: {contents: read}
+jobs:
+  test:
+    # T-06: the full Python 3.11-3.14 matrix on Linux; 3.11 and 3.14 on macOS and Windows.
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest]
+        python: ['3.11', '3.12', '3.13', '3.14']
+        include:
+          - {os: macos-latest, python: '3.11'}
+          - {os: macos-latest, python: '3.14'}
+          - {os: windows-latest, python: '3.11'}
+          - {os: windows-latest, python: '3.14'}
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with: {python-version: '${{ matrix.python }}', allow-prereleases: true}
+      - run: python -m pip install -U pip
+      - run: pip install -e '.[dev,streaming]'
+      # T-27 scope: src tests plugins benchmarks/vs_spindle rust (only the paths that exist yet).
+      - run: ruff check src tests benchmarks/vs_spindle
+      - run: ruff format --check src tests benchmarks/vs_spindle
+      # [tool.mypy] targets python_version 3.11. On 3.12+ legs pip installs a numpy whose
+      # stubs use 3.12-only syntax (`type` statements), which mypy rejects under a 3.11
+      # target, so the type check runs on the 3.11 legs (every OS).
+      - if: matrix.python == '3.11'
+        run: mypy
+      - run: python -m compileall -q src/shape
+      # The Fabric demo tests need Java, PySpark and unixODBC, and the demo content tests need
+      # the pinned Spindle checkout; both run in the fabric-demo job below.
+      # --cov-fail-under is the measured coverage (86.55% on P0-06), rounded down.
+      - run: >-
+          python -m pytest -q -m "not emulator and not live"
+          --ignore=tests/demo/fabric --ignore=tests/demo/content
+          --cov=shape --cov-fail-under=86
+  audit:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with: {python-version: '3.13'}
+      - run: python -m pip install -U pip
+      - run: pip install -e '.[dev,streaming]'
+      - run: pip-audit --skip-editable
+  fabric-demo:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with: {python-version: '3.11'}
+      - uses: actions/setup-java@v4
+        with: {distribution: temurin, java-version: '17'}
+      - run: sudo apt-get update -q && sudo apt-get install -y -q unixodbc
+      - run: python -m pip install -U pip
+      - run: pip install -e '.[dev]' -r tests/demo/fabric/requirements.txt
+      # demo/make_data.py reads Spindle's schema and reference data (plan section 1.2); read only.
+      - name: Pinned Spindle checkout
+        run: |
+          git init -q "$RUNNER_TEMP/spindle"
+          git -C "$RUNNER_TEMP/spindle" fetch -q --depth 1 https://github.com/sqllocks/spindle 422e78df2267e73bb2fa976267e48cb437861e2f
+          git -C "$RUNNER_TEMP/spindle" checkout -q FETCH_HEAD
+          echo "SPINDLE_ROOT=$RUNNER_TEMP/spindle" >> "$GITHUB_ENV"
+      - run: python -m pytest -q tests/demo/fabric tests/demo/content
+  bench-quick:
+    # Verifiers, then the quick benchmark (D1, D2, retail small+medium; 3 runs) against the
+    # pinned Spindle. On a private repository the standard runner has 2 vCPUs, so ratios are
+    # informational until the repository is public (O-05).
+    runs-on: ubuntu-latest
+    timeout-minutes: 90
+    env: {BENCH_OUT_DIR: "${{ github.workspace }}/bench-out"}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with: {python-version: '3.11'}
+      - name: Pinned Spindle baseline and venv (plan section 1.2)
+        run: source scripts/env.sh && bash benchmarks/vs_spindle/setup_spindle.sh
+      - name: Shape venv (pyarrow pinned like the Spindle venv)
+        run: |
+          source scripts/env.sh
+          python -m venv "$SHAPE_VENV"
+          "$SHAPE_VENV/bin/pip" install -U pip
+          "$SHAPE_VENV/bin/pip" install -e '.[dev]' 'pyarrow==25.0.1'
+      - run: source scripts/env.sh && python benchmarks/vs_spindle/check_coverage.py
+      - run: source scripts/env.sh && python benchmarks/vs_spindle/run.py --quick --out "$BENCH_OUT_DIR/results.json"
+      - uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: benchmark-results-quick
+          path: |
+            ${{ github.workspace }}/bench-out/results.json
+            ${{ github.workspace }}/bench-out/verify/
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with: {python-version: '3.13'}
+      - run: pip install build twine pip-audit
+      - run: python -m pip install --upgrade pip
+      - run: pip install .
+      - run: python -m build
+      - run: python -m twine check dist/*
+      - run: pip-audit
+      - uses: actions/upload-artifact@v4
+        with: {name: distributions, path: dist/*}

sqllocks_shape-0.9.0/.github/workflows/nightly.yml

@@ -0,0 +1,42 @@
+name: Nightly
+on:
+  schedule: [{cron: '17 3 * * *'}]
+  workflow_dispatch: {}
+permissions: {contents: read}
+jobs:
+  benchmarks-full:
+    # Every workload of plan section 3.4 (5 runs each): verifiers first, then timings.
+    # Timings are ratios measured in this one job (T-19). A public repository gets 4-vCPU
+    # standard runners; on a private repository use a 4-vCPU larger runner (O-05).
+    runs-on: ubuntu-latest
+    timeout-minutes: 360
+    env: {BENCH_OUT_DIR: "${{ github.workspace }}/bench-out"}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with: {python-version: '3.11'}
+      - name: Pinned Spindle baseline and venv (plan section 1.2)
+        run: source scripts/env.sh && bash benchmarks/vs_spindle/setup_spindle.sh
+      - name: Shape venv (pyarrow pinned like the Spindle venv, so timings share one pyarrow)
+        run: |
+          source scripts/env.sh
+          python -m venv "$SHAPE_VENV"
+          "$SHAPE_VENV/bin/pip" install -U pip
+          "$SHAPE_VENV/bin/pip" install -e '.[dev]' 'pyarrow==25.0.1'
+      - run: source scripts/env.sh && python benchmarks/vs_spindle/check_coverage.py
+      - run: source scripts/env.sh && python benchmarks/vs_spindle/run.py --full
+      - uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: benchmark-results-full
+          path: |
+            benchmarks/vs_spindle/results.json
+            ${{ github.workspace }}/bench-out/verify/
+            ${{ github.workspace }}/bench-out/spindle_freeze.txt
+  emulator-compose:
+    # The emulator-backed test jobs (Kafka, Event Hubs + Azurite, SQL Server) arrive with the
+    # work packages that own those connectors; until then, keep the compose file valid.
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - run: docker compose -f ci/emulators/docker-compose.yml config --quiet

sqllocks_shape-0.9.0/.github/workflows/publish.yml

@@ -0,0 +1,80 @@
+# Early-access publish of the pure-Python wheel and an sdist (plan DM-03b).
+#
+# Trusted publishing only: no API tokens and no passwords. The PyPI (and TestPyPI) project
+# "sqllocks-shape" must have a trusted publisher registered for this repository, workflow file
+# "publish.yml" and environment "pypi" (TestPyPI: environment "testpypi").
+#
+# Owner triggers it: Actions > "Publish" > Run workflow, repository = testpypi first, then pypi.
+# Pushing a tag "v<version>" publishes to PyPI (the tag must equal the package version).
+name: Publish
+
+on:
+  workflow_dispatch:
+    inputs:
+      repository:
+        description: "Where to publish"
+        required: true
+        default: testpypi
+        type: choice
+        options:
+          - testpypi
+          - pypi
+  push:
+    tags:
+      - "v*"
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    name: Build and test the wheel and sdist
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+      - run: python -m pip install --upgrade pip build twine
+      - name: Tag must match the package version
+        if: startsWith(github.ref, 'refs/tags/v')
+        run: |
+          version="$(python -c "import tomllib; print(tomllib.load(open('pyproject.toml','rb'))['project']['version'])")"
+          test "v${version}" = "${GITHUB_REF_NAME}" || {
+            echo "tag ${GITHUB_REF_NAME} does not match version ${version}"; exit 1; }
+      - name: README must say this is early access
+        run: grep -qi "early access" README.md
+      - name: Build the pure wheel, install it in a clean venv and run tests/demo/core
+        run: python scripts/build_pure_wheel.py --verify --python python3.11
+      - name: Build the sdist
+        run: python -m build --sdist
+      - name: twine check
+        run: python -m twine check dist/*
+      - run: ls -l dist
+      - uses: actions/upload-artifact@v4
+        with:
+          name: dist
+          path: dist/*
+          if-no-files-found: error
+
+  publish:
+    name: Publish to ${{ (github.event_name == 'workflow_dispatch' && inputs.repository == 'testpypi') && 'TestPyPI' || 'PyPI' }}
+    needs: build
+    runs-on: ubuntu-latest
+    environment: ${{ (github.event_name == 'workflow_dispatch' && inputs.repository == 'testpypi') && 'testpypi' || 'pypi' }}
+    permissions:
+      id-token: write
+      contents: read
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          name: dist
+          path: dist
+      - name: Publish to TestPyPI
+        if: github.event_name == 'workflow_dispatch' && inputs.repository == 'testpypi'
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          repository-url: https://test.pypi.org/legacy/
+      - name: Publish to PyPI
+        if: github.event_name != 'workflow_dispatch' || inputs.repository == 'pypi'
+        uses: pypa/gh-action-pypi-publish@release/v1

sqllocks_shape-0.9.0/.github/workflows/release.yml

@@ -0,0 +1,24 @@
+name: Release candidate
+on: {workflow_dispatch: {}}
+permissions: {contents: read, id-token: write}
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with: {python-version: '3.13'}
+      - run: python -m pip install --upgrade pip
+      - run: pip install build twine pip-audit cyclonedx-bom
+      - run: pip install '.[dev]'
+      - run: make check
+      - run: python -m build
+      - run: python -m twine check dist/*
+      - run: pip-audit
+      - run: cyclonedx-py environment -o sbom.json
+      - uses: actions/upload-artifact@v4
+        with:
+          name: release-candidate
+          path: |
+            dist/*
+            sbom.json

sqllocks_shape-0.9.0/.github/workflows/security.yml

@@ -0,0 +1,17 @@
+name: Security
+on: [push, pull_request]
+permissions: {contents: read}
+jobs:
+  security:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with: {python-version: "3.12"}
+      - run: python -m pip install --upgrade pip
+      - run: python -m pip install -e ".[dev,streaming]"
+      - run: pip-audit --skip-editable
+      - run: bandit -q -r src -ll
+      - run: python scripts/check_secrets.py
+      # The Fabric demo tests need extra packages and run in ci.yml's fabric-demo job.
+      - run: pytest -m security --ignore=tests/demo/fabric

sqllocks_shape-0.9.0/.gitignore

@@ -0,0 +1,25 @@
+__pycache__/
+*.py[cod]
+.venv/
+.pytest_cache/
+.mypy_cache/
+.ruff_cache/
+dist/
+build/
+*.egg-info/
+.env
+.env.*
+!.env.example
+*.pem
+*.key
+*.p12
+*.pfx
+.hypothesis/
+.coverage
+htmlcov/
+.DS_Store
+Thumbs.db
+*.swp
+
+# benchmark scratch output in CI
+/bench-out/

sqllocks_shape-0.9.0/CHANGELOG.md

@@ -0,0 +1,11 @@
+# Changelog
+
+Shape is in **early access**. Profiling is available now; data generation and
+pipeline integration are in progress. See `docs/plans/COMPLETION_PLAN.md`.
+
+## Unreleased
+
+- Relicensed under the MIT license.
+- Repository cleaned up for public release: removed internal milestone and
+  qualification records.
+- README and changelog rewritten to describe the current state.

sqllocks_shape-0.9.0/CLAUDE.md

@@ -0,0 +1,41 @@
+# CLAUDE.md
+
+This repository is being rebuilt against a fixed, fully decided plan:
+**`docs/plans/COMPLETION_PLAN.md`**.
+
+Before doing anything in this repo:
+
+1. Read §0 (Builder guide), §1 (Environment setup) and §6 (Execution rules) of the
+   plan, in full.
+2. Find the next work package in §11 (Status tracker). It is the first `todo` whose
+   `Depends` are all `done`.
+3. Build exactly that work package to its acceptance criteria in §7. Then update the
+   tracker, commit with the work-package ID as the message prefix, and push.
+
+**48-hour Fabric demo lanes:** if your session prompt names a demo lane (L1, L2 or
+L3), follow §12 of the plan instead of step 2. Edit only the paths that §12.5 gives
+your lane, and record completion in `docs/plans/demo_status/<WP>.md`, never in the
+plan's tables.
+
+Rules that override everything else:
+
+- Every decision in §2 (D-xx and T-xx), every gate and every tolerance is fixed. Do
+  not change one; escalate instead (§0.4).
+- Never lower a gate, loosen a tolerance, skip or xfail a test, or fabricate
+  benchmark results.
+- Equivalence verification comes before any timing (§6.4).
+- Never modify the pinned Spindle checkout (`$SPINDLE_ROOT`).
+- Never report something as done without running its checks in this session.
+- Shell state does not persist between tool calls. Start every command that uses the
+  plan's environment variables with `source scripts/env.sh &&`, run from the repo
+  root. P0-00 creates that file; until then, use the §1 block from the plan.
+- Performance numbers count only after the equivalence verifier for that workload
+  exits 0.
+
+Useful commands (once P0-06 and P0-07 are done):
+
+```bash
+make check                                                           # lint, format, types, tests (T-27 scope)
+pytest -m "not emulator and not live"                                # local test run
+source scripts/env.sh && python benchmarks/vs_spindle/run.py --quick # verifiers + benchmarks vs pinned Spindle
+```

sqllocks_shape-0.9.0/CODEOWNERS

@@ -0,0 +1,4 @@
+# Replace placeholder after GitHub repository creation.
+/docs/PRODUCT_ARCHITECTURE.md @OWNER
+/docs/SECURITY_SPECIFICATION.md @OWNER
+/security/ @OWNER

sqllocks_shape-0.9.0/CONTRIBUTING.md

@@ -0,0 +1,3 @@
+# Contributing
+
+Changes should preserve deterministic behavior, bounded-memory semantics where promised, sensitivity/provenance propagation and fail-closed handling of ambiguous or unsafe input. Add tests and requirement traceability for new normative behavior. Avoid mandatory network dependencies in core.

sqllocks_shape-0.9.0/GOVERNANCE.md

@@ -0,0 +1,3 @@
+# Governance
+
+Shape uses specification-first governance. Public behavior is defined by versioned specifications and conformance tests, not incidental Python implementation details. Breaking changes require a major specification version and migration path. Security fixes may tighten previously permissive behavior.

sqllocks_shape-0.9.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025-2026 SQLLocks (Jonathan Stewart)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

sqllocks_shape-0.9.0/Makefile

@@ -0,0 +1,17 @@
+PYTHON ?= python
+.PHONY: bootstrap check test security
+bootstrap:
+	$(PYTHON) -m pip install -e ".[dev]"
+# Same commands as the `test` job in .github/workflows/ci.yml (T-27 scope: only paths that exist).
+check:
+	ruff check src tests benchmarks/vs_spindle
+	ruff format --check src tests benchmarks/vs_spindle
+	mypy
+	$(PYTHON) -m compileall -q src/shape
+	$(PYTHON) scripts/check_requirements.py
+	$(PYTHON) scripts/check_secrets.py
+	pytest -q -m "not emulator and not live" --ignore=tests/demo/fabric --ignore=tests/demo/content --cov=shape --cov-fail-under=86
+test:
+	pytest -m "not emulator and not live"
+security:
+	pytest -m security

sqllocks_shape-0.9.0/PKG-INFO

@@ -0,0 +1,105 @@
+Metadata-Version: 2.5
+Name: sqllocks-shape
+Version: 0.9.0
+Summary: Shape by SQLLocks — Shape as Code: profile, check and compare how your data behaves. Early access.
+Project-URL: Homepage, https://github.com/sqllocks/shape
+Project-URL: Repository, https://github.com/sqllocks/shape
+Project-URL: Issues, https://github.com/sqllocks/shape/issues
+License-Expression: MIT
+License-File: LICENSE
+License-File: THIRD_PARTY_NOTICES.md
+Requires-Python: >=3.11
+Requires-Dist: numpy<3,>=2.0
+Requires-Dist: pyarrow>=14.0.1
+Provides-Extra: delta
+Requires-Dist: deltalake>=0.17; extra == 'delta'
+Provides-Extra: dev
+Requires-Dist: bandit>=1.8; extra == 'dev'
+Requires-Dist: build>=1.2; extra == 'dev'
+Requires-Dist: cryptography<51,>=50; extra == 'dev'
+Requires-Dist: deltalake>=0.17; extra == 'dev'
+Requires-Dist: hypothesis>=6.115; extra == 'dev'
+Requires-Dist: import-linter>=2; extra == 'dev'
+Requires-Dist: maturin<2,>=1.15; extra == 'dev'
+Requires-Dist: mypy>=1.13; extra == 'dev'
+Requires-Dist: pandas>=2; extra == 'dev'
+Requires-Dist: pip-audit>=2.7; extra == 'dev'
+Requires-Dist: py-spy>=0.4; extra == 'dev'
+Requires-Dist: pytest-cov>=6; extra == 'dev'
+Requires-Dist: pytest>=8.3; extra == 'dev'
+Requires-Dist: pyyaml>=6; extra == 'dev'
+Requires-Dist: ruff>=0.8; extra == 'dev'
+Requires-Dist: sqlglot>=25; extra == 'dev'
+Requires-Dist: twine>=5; extra == 'dev'
+Requires-Dist: vulture>=2.11; extra == 'dev'
+Requires-Dist: xxhash>=3.5; extra == 'dev'
+Provides-Extra: eventhubs
+Requires-Dist: azure-eventhub<6,>=5.12; extra == 'eventhubs'
+Provides-Extra: kafka
+Requires-Dist: confluent-kafka<4,>=2.5; extra == 'kafka'
+Provides-Extra: pandas
+Requires-Dist: pandas>=2; extra == 'pandas'
+Provides-Extra: sign
+Requires-Dist: cryptography<51,>=50; extra == 'sign'
+Provides-Extra: streaming
+Requires-Dist: azure-eventhub<6,>=5.12; extra == 'streaming'
+Requires-Dist: confluent-kafka<4,>=2.5; extra == 'streaming'
+Provides-Extra: yaml
+Requires-Dist: pyyaml>=6; extra == 'yaml'
+Description-Content-Type: text/markdown
+
+# Shape
+
+[![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
+
+**Shape by SQLLocks** — Shape as Code: a portable, executable description of how
+data behaves, not merely its schema.
+
+> **Early access.** Profiling is available now; data generation and pipeline
+> integration are in progress. See `docs/plans/COMPLETION_PLAN.md`.
+
+Install with `pip install sqllocks-shape`. Python imports use `import shape`, the
+command is `shape`, and artifacts use the `.shape` extension.
+
+## Quick start
+
+```python
+import shape
+
+p = shape.profile("customers.csv")      # also: Parquet, JSONL, Delta tables, pandas, pyarrow
+shape.save(p, "customers.shape")
+print(p.summary())                      # small JSON-safe summary per column
+
+result = shape.check(p, {"columns": {"customer_id": {"unique": True, "nullable": False}}})
+print(result.passed, result.violations)
+
+drift = shape.diff(shape.load("customers.shape"), shape.profile("customers_next.csv"))
+print(drift.drifted, drift.changes)
+```
+
+```bash
+shape profile customers.csv -o customers.shape --html report.html --json summary.json
+shape check customers.shape contract.json          # exit code 1 if the contract fails
+shape diff customers.shape customers_next.shape --fail-on-drift
+```
+
+## What a `.shape` file contains
+
+A profile keeps real values from your data, as Spindle's profiler does: up to the 500
+most frequent values per column with their counts, and each column's minimum and maximum.
+Treat a `.shape` file, its HTML report and its JSON summary as you would the source data,
+and don't share one from a sensitive table. A privacy-safe profile, with rare values
+suppressed, is planned.
+
+## Design principles
+
+- evidence carries provenance and algorithm parameters
+- deterministic generation and replay
+- offline by default: no network access or cloud service is required
+- `.shape` readers fail closed on unsafe or corrupt containers
+
+See `docs/PRODUCT_ARCHITECTURE.md` and `docs/specs/`.
+
+## License
+
+MIT. See `LICENSE` and `THIRD_PARTY_NOTICES.md`.

sqllocks_shape-0.9.0/README.md

@@ -0,0 +1,55 @@
+# Shape
+
+[![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
+
+**Shape by SQLLocks** — Shape as Code: a portable, executable description of how
+data behaves, not merely its schema.
+
+> **Early access.** Profiling is available now; data generation and pipeline
+> integration are in progress. See `docs/plans/COMPLETION_PLAN.md`.
+
+Install with `pip install sqllocks-shape`. Python imports use `import shape`, the
+command is `shape`, and artifacts use the `.shape` extension.
+
+## Quick start
+
+```python
+import shape
+
+p = shape.profile("customers.csv")      # also: Parquet, JSONL, Delta tables, pandas, pyarrow
+shape.save(p, "customers.shape")
+print(p.summary())                      # small JSON-safe summary per column
+
+result = shape.check(p, {"columns": {"customer_id": {"unique": True, "nullable": False}}})
+print(result.passed, result.violations)
+
+drift = shape.diff(shape.load("customers.shape"), shape.profile("customers_next.csv"))
+print(drift.drifted, drift.changes)
+```
+
+```bash
+shape profile customers.csv -o customers.shape --html report.html --json summary.json
+shape check customers.shape contract.json          # exit code 1 if the contract fails
+shape diff customers.shape customers_next.shape --fail-on-drift
+```
+
+## What a `.shape` file contains
+
+A profile keeps real values from your data, as Spindle's profiler does: up to the 500
+most frequent values per column with their counts, and each column's minimum and maximum.
+Treat a `.shape` file, its HTML report and its JSON summary as you would the source data,
+and don't share one from a sensitive table. A privacy-safe profile, with rare values
+suppressed, is planned.
+
+## Design principles
+
+- evidence carries provenance and algorithm parameters
+- deterministic generation and replay
+- offline by default: no network access or cloud service is required
+- `.shape` readers fail closed on unsafe or corrupt containers
+
+See `docs/PRODUCT_ARCHITECTURE.md` and `docs/specs/`.
+
+## License
+
+MIT. See `LICENSE` and `THIRD_PARTY_NOTICES.md`.

sqllocks_shape-0.9.0/SECURITY.md

@@ -0,0 +1,11 @@
+# Security Policy
+
+Report suspected vulnerabilities privately to the maintainer at
+**sqllocks@sqlbites.com**, or through GitHub's private vulnerability reporting on
+this repository, rather than opening a public issue. Do not include real secrets,
+PII or customer datasets in reports.
+
+Shape is in early access; only the latest release receives fixes.
+
+Shape treats artifacts, packs, plugins, connector responses and reference assets as
+untrusted inputs. See `docs/THREAT_MODEL.md`.

sqllocks_shape-0.9.0/THIRD_PARTY_NOTICES.md

@@ -0,0 +1,20 @@
+# Third-Party Notices
+
+Shape is released under the MIT license (see `LICENSE`).
+
+## Spindle
+
+Parts of Shape's reference data and behaviour are derived from Spindle.
+
+Spindle: MIT, Copyright (c) 2025-2026 SQLLocks (Jonathan Stewart). Where code or
+data copied or substantially derived from Spindle is included, its MIT notice is
+retained.
+
+## GeoNames
+
+Postal-code and place reference data is derived from GeoNames (https://www.geonames.org/).
+
+GeoNames data is licensed under the Creative Commons Attribution 4.0 International
+license (CC-BY-4.0), https://creativecommons.org/licenses/by/4.0/. Attribution:
+"This work includes data from GeoNames (https://www.geonames.org/), licensed under
+CC-BY-4.0." Any distribution that includes this data must retain this attribution.