Prepare Python 0.8.0 release metadata and CI

Author: TonisOrmisson

.github/workflows/ci.yml

@@ -20,7 +20,7 @@ jobs:
         uses: actions/checkout@v7
         with: &specification-checkout
           repository: OpenStatSpec/specification
-          ref: cd8f198c68b849eb8ed018a894670a0904c2181d
+          ref: 864e84479f554b8ee250ffed44c4dfb963750d4a
           path: openstatspec-specification
       - name: Checkout required SPSS engine
         uses: actions/checkout@v7
@@ -53,9 +53,9 @@ jobs:
       - run: python -m pip install --upgrade pip build
       - run: python -m build
       - run: python -m venv /tmp/openstatspec-wheel-smoke
-      - run: /tmp/openstatspec-wheel-smoke/bin/python -m pip install ./openstatspec-pyspssio
       - run: /tmp/openstatspec-wheel-smoke/bin/python -m pip install dist/*.whl
-      - run: /tmp/openstatspec-wheel-smoke/bin/openstatspec capabilities
+      - run: env -u PYTHONPATH /tmp/openstatspec-wheel-smoke/bin/openstatspec capabilities
+        working-directory: /tmp
 
   postgres-integration:
     name: PostgreSQL ${{ matrix.postgres }} integration
@@ -155,6 +155,7 @@ jobs:
             image: dolthub/dolt:2.2.3@sha256:1a651e738a2e7275b9c69fec8c5f42c6e23954314405c412f4dc9287ee7c0080
     env:
       OPENSTATSPEC_DOLT_URL: mysql+pymysql://openstatspec:openstatspec@127.0.0.1:13308/openstatspec
+      OPENSTATSPEC_TEST_DOLT_ADMIN_URL: mysql+pymysql://openstatspec_test_admin:ci-admin@127.0.0.1:13308/
       OPENSTATSPEC_EXPECTED_DOLT_VERSION: ${{ matrix.dolt }}
       OPENSTATSPEC_DOLT_IMAGE: ${{ matrix.image }}
     steps:
@@ -186,6 +187,11 @@ jobs:
             --workdir /var/lib/dolt \
             "$OPENSTATSPEC_DOLT_IMAGE" sql \
             -q "CREATE USER 'openstatspec'@'%' IDENTIFIED BY 'openstatspec'; GRANT ALL PRIVILEGES ON openstatspec.* TO 'openstatspec'@'%'"
+          docker run --rm \
+            --volume "$RUNNER_TEMP/openstatspec-dolt:/var/lib/dolt" \
+            --workdir /var/lib/dolt \
+            "$OPENSTATSPEC_DOLT_IMAGE" sql \
+            -q "CREATE USER 'openstatspec_test_admin'@'%' IDENTIFIED BY 'ci-admin'; GRANT ALL PRIVILEGES ON *.* TO 'openstatspec_test_admin'@'%' WITH GRANT OPTION"
           docker run --detach --name openstatspec-dolt \
             --publish 127.0.0.1:13308:3306 \
             --volume "$RUNNER_TEMP/openstatspec-dolt:/var/lib/dolt" \
@@ -218,6 +224,7 @@ jobs:
                   break
           PY
       - run: python -m pytest -m "services and not candidate_evidence"
+      - run: python -m pytest tests/test_read_only_export.py
       - name: Show Dolt logs on failure and stop server
         if: always()
         run: |

.github/workflows/release.yml

@@ -48,7 +48,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: OpenStatSpec/specification
-          ref: cd8f198c68b849eb8ed018a894670a0904c2181d
+          ref: 864e84479f554b8ee250ffed44c4dfb963750d4a
           path: openstatspec-specification
       - name: Checkout specification package source
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -159,9 +159,9 @@ jobs:
       - run: python -m pip install -e ".[dev]"
       - run: python -m pytest -m "not services"
       - run: python -m venv /tmp/openstatspec-release-smoke
-      - run: /tmp/openstatspec-release-smoke/bin/python -m pip install ./openstatspec-pyspssio
       - run: /tmp/openstatspec-release-smoke/bin/python -m pip install dist/openstatspec/openstatspec-*.whl
-      - run: /tmp/openstatspec-release-smoke/bin/openstatspec capabilities
+      - run: env -u PYTHONPATH /tmp/openstatspec-release-smoke/bin/openstatspec capabilities
+        working-directory: /tmp
       - name: Smoke-test specification wheel
         run: |
           python -m venv /tmp/openstatspec-specification-release-smoke

CHANGELOG.md

@@ -6,6 +6,30 @@ All notable changes to this reference implementation are documented here.
 
 _No unreleased changes._
 
+## 0.8.0 - 2026-09-07
+
+### Changed
+
+- Pin released specification `v0.5.0` at exact commit
+  `864e84479f554b8ee250ffed44c4dfb963750d4a`, with normative status `released`.
+  Capabilities identify adapter version 0.8.0 and explicitly select SAV/ZSAV 1.0
+  with `database_io_policy=openstatspec-database-io-v1`.
+- Reads, inspection, validation, and SAV/ZSAV export no longer write database
+  operation/fidelity audit records, including on failure. Export diagnostics
+  and loss consent remain operation-scoped; export results omit `operation_id`.
+- Default Dolt writes use the packaged tested exact-version policy for 2.2.2
+  and 2.2.3 without user-supplied evidence files. Unknown/untested versions
+  remain blocked before mutation; explicit external overrides remain strict.
+  Safety budgets are not claimed as proven native server limits.
+- Dolt reads no longer require write-version declarations or the write
+  variable-count ceiling. Missing SQLite files are rejected without creation.
+- Exact Dolt 2.2.2/2.2.3 CI explicitly runs SELECT-only export success/failure
+  tests using a separate fixture-admin account; normal service permissions
+  and adapter permissions are unchanged. Wheel smoke installs resolve the
+  required engine from PyPI rather than a source checkout.
+
+No optional Transformation Workflow 0.3 implementation is claimed.
+
 ## 0.7.1 - 2026-08-12
 
 ### Changed

README.md

@@ -4,6 +4,10 @@ The reference Python implementation of the OpenStatSpec specification.
 
 This package implements the specification; it does not define or extend it.
 The normative model lives in the `OpenStatSpec/specification` repository.
+Python 0.8.0 pins released specification `v0.5.0` at
+`864e84479f554b8ee250ffed44c4dfb963750d4a` and selects SAV/ZSAV 1.0 with
+`database_io_policy=openstatspec-database-io-v1`. This does not claim
+implementation of the optional Transformation Workflow 0.3 profile.
 
 ## Boundaries
 
@@ -137,7 +141,8 @@ dictionary semantics cannot be reproduced, it stops until you pass the exact
 diagnostic code with `--allow-loss`. Diagnostics are returned to the caller, not
 persisted. Reads, validation, and SAV/ZSAV export never write to the database,
 including on failure. Export returns no `operation_id` and needs only read
-permissions; Dolt reads have no write-version gate. Imports and transformations
+permissions; Dolt reads have no write-version or write-variable-count gate.
+Read operations reject missing SQLite files without creating them. Imports and transformations
 use the packaged exact-version policy by default. Active driver/identity checks,
 limit preflight, and the clean expected branch/HEAD guard for in-place apply
 remain mandatory. Dolt's reported limits are adapter safety budgets, narrowed

docs/release-readiness.md

@@ -1,8 +1,15 @@
-# 0.7.1 release readiness
+# 0.8.0 release readiness
 
 This page records the expected release contract, not a publication event.
 Creating a version tag remains a separate maintainer action.
 
+The release selects SAV/ZSAV 1.0 with the optional Database I/O Execution
+Policy `openstatspec-database-io-v1`. Reads and exports, including failures,
+write no database audit records; export results omit `operation_id` and return
+diagnostics to the caller. Reads must not create missing SQLite files or apply
+Dolt write-variable-count ceilings. This release does not claim implementation
+of the optional Transformation Workflow 0.3 profile.
+
 ## Supported workflow
 
 For a supported unencrypted SAV or ZSAV source, the adapter imports one source
@@ -104,7 +111,7 @@ implemented openstatspec.frontends.spss package. Stata and SAS remain empty
 source-tree placeholders and must expose no compiler, apply API, CLI choice,
 capability claim, or implied support.
 
-## Default Dolt write verification
+## Prior default Dolt write verification (before the 0.8.0 pin)
 
 Local release verification used the exact 2.2.2 and 2.2.3 image digests in
 `.github/workflows/ci.yml`, isolated ports 13482/13483, and disposable `/tmp`
@@ -125,6 +132,30 @@ owned table additions being misclassified as unrelated diffs, and Dolt retaining
 transaction. The candidate storage/identifier/column smoke probe also passed on
 both pins; it does **not** establish full value/row/statement limit conformance.
 
+## 0.8.0 local verification
+
+Using `../python/.venv/bin/python`, `PYTHONPATH=src:../pyspssio`, and
+`OPENSTATSPEC_SPECIFICATION_DIR=/tmp/oss-python-spec-v050-5dSTna` (an archive
+of exact `864e84479f554b8ee250ffed44c4dfb963750d4a`):
+
+- `python -m pytest -ra`: **381 passed, 49 skipped**, with
+  `OPENSTATSPEC_TEST_DOLT_ADMIN_URL=mysql+pymysql://root@127.0.0.1:13387/`
+  exercising live Dolt 2.3.0 through disposable SELECT-only users.
+- Both immutable CI images, exact Dolt 2.2.2/2.2.3, bootstrapped with the
+  unchanged service user and separate global fixture admin on ports 13582/13583:
+  `python -m pytest -m 'services and not candidate_evidence'`: **7 passed,
+  41 skipped, 382 deselected per pin**; explicit
+  `python -m pytest tests/test_read_only_export.py`: **33 passed per pin**.
+- `python -m compileall -q src tests`, `git diff --check`, wheel/sdist build,
+  and `python -m twine check /tmp/oss-python-v080-dist/*` passed.
+- A clean wheel install resolved the required engine from PyPI. Isolated
+  imports came only from the smoke environment's `site-packages`; installed
+  capabilities reported adapter 0.8.0, the selected policy, released v0.5.0
+  provenance, and exactly 2.2.2/2.2.3 for default Dolt writes.
+
+Other database services were not configured locally. This is local evidence,
+not a claim that the updated remote CI or release publication has completed.
+
 ## Maintainer checks before tagging
 
 1. Publish the pinned `openstatspec-pyspssio==0.5.1.post2` engine distribution
@@ -139,13 +170,22 @@ both pins; it does **not** establish full value/row/statement limit conformance.
    catalog, and audit rollback checks, and failed-import cleanup. Release/CI
    owns this evidence, not per-user runtime declaration files. Candidate limit
    probes remain non-claiming and separate from these write gates.
+   Each Dolt job must also run `python -m pytest tests/test_read_only_export.py`
+   explicitly, outside the `services` marker filter. Bootstrap a separate
+   `openstatspec_test_admin` on the isolated CI server with global database/user
+   creation and grant privileges, and set `OPENSTATSPEC_TEST_DOLT_ADMIN_URL`.
+   The fixture creates its own database and SELECT-only reader and removes
+   both afterward; the normal service user remains unchanged.
 4. Build with `python -m build` and install the generated wheel in a clean
-   environment.
+   environment, resolving `openstatspec-pyspssio==0.5.1.post2` from PyPI.
+   Run the installed CLI outside the source checkout with `PYTHONPATH` unset;
+   verify adapter version `0.8.0` and the selected database I/O policy.
 5. Confirm `openstatspec capabilities` reflects the intended support boundary.
 6. Confirm CI, release fixtures, and capabilities use the published OpenStatSpec
-   specification `v0.3.0` at exact commit
-   `cd8f198c68b849eb8ed018a894670a0904c2181d`, publish
-   `specification_status=stable`, and set `specification_release` to `v0.3.0`.
+   specification `v0.5.0` at exact commit
+   `864e84479f554b8ee250ffed44c4dfb963750d4a`, publish
+   `specification_status=released`, and set `specification_release` to `v0.5.0`.
+   Use an exact checkout via `OPENSTATSPEC_SPECIFICATION_DIR` for local tests.
 7. Review this document, the README, and CHANGELOG for accurate scope.
 
 The tag-triggered release workflow repeats the non-service test suite, builds

pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "openstatspec"
-version = "0.7.1"
+version = "0.8.0"
 description = "Reference adapter for the OpenStatSpec relational contract"
 readme = "README.md"
 requires-python = ">=3.11"

src/openstatspec/api.py

@@ -34,6 +34,7 @@
 )
 from .transform import TransformationPlan
 from .sql.database_urls import require_existing_database_url
+from .sql.dolt_conformance import ADAPTER_VERSION
 from .sql.capabilities import (
     SPECIFICATION_COMMIT, SPECIFICATION_RELEASE, SPECIFICATION_STATUS,
     active_connection, catalog_binding,
@@ -58,6 +59,7 @@ def capability_matrix(
         require_existing_database_url(database_url)
     declaration = {
         "specification": "OpenStatSpec",
+        "adapter_version": ADAPTER_VERSION,
         "database_io_policy": "openstatspec-database-io-v1",
         "specification_status": SPECIFICATION_STATUS,
         "specification_release": SPECIFICATION_RELEASE,

src/openstatspec/sql/capabilities.py

@@ -20,9 +20,9 @@
 
 # Release/build automation binds the adapter to the exact language-neutral
 # specification revision used for normative fixtures and profile semantics.
-SPECIFICATION_COMMIT = "cd8f198c68b849eb8ed018a894670a0904c2181d"
-SPECIFICATION_STATUS = "stable"
-SPECIFICATION_RELEASE: str | None = "v0.3.0"
+SPECIFICATION_COMMIT = "864e84479f554b8ee250ffed44c4dfb963750d4a"
+SPECIFICATION_STATUS = "released"
+SPECIFICATION_RELEASE: str | None = "v0.5.0"
 
 DOLT_WRITE_CONFORMANCE = {
     "declaration_schema_id": "openstatspec-dolt-adapter-declaration-v1",

tests/test_cli.py

@@ -42,9 +42,11 @@ def test_cli_import_inspect_validate_and_export_emit_json(tmp_path, capsys) -> N
 
 def test_capability_matrix_is_public_and_cli_matches_engine_boundary(capsys) -> None:
     matrix = openstatspec.capability_matrix()
-    assert matrix["specification_status"] == "stable"
-    assert matrix["specification_release"] == "v0.3.0"
-    assert matrix["specification_commit"] == "cd8f198c68b849eb8ed018a894670a0904c2181d"
+    assert matrix["adapter_version"] == "0.8.0"
+    assert matrix["database_io_policy"] == "openstatspec-database-io-v1"
+    assert matrix["specification_status"] == "released"
+    assert matrix["specification_release"] == "v0.5.0"
+    assert matrix["specification_commit"] == "864e84479f554b8ee250ffed44c4dfb963750d4a"
     assert matrix["directions"] == ["import", "export", "semantic_round_trip"]
     assert matrix["active_connection"] is None
     assert matrix["engine"]["package"] == "openstatspec-pyspssio"
@@ -82,6 +84,7 @@ def test_capability_matrix_is_public_and_cli_matches_engine_boundary(capsys) ->
 
 def test_capability_matrix_reports_active_sqlite_limits(tmp_path) -> None:
     database_url = f"sqlite:///{tmp_path / 'capabilities.sqlite'}"
+    sqlite3.connect(tmp_path / "capabilities.sqlite").close()
     matrix = openstatspec.capability_matrix(database_url=database_url)
     active = matrix["active_connection"]
     assert active["profile"] == "sqlite"

tests/test_sql_profiles.py

@@ -29,13 +29,13 @@ def test_profile_detection_tracks_supported_dialect_urls() -> None:
     assert profile_for_url("mariadb+mariadbconnector://user@host/database") is MYSQL
     assert profile_for_url("mysql+pymysql://user@host/dolt_database") is MYSQL
 
-def test_profile_declarations_publish_stable_specification_provenance() -> None:
+def test_profile_declarations_publish_released_specification_provenance() -> None:
     for declaration in capabilities.profile_declarations().values():
-        assert declaration["specification_status"] == "stable"
-        assert declaration["specification_release"] == "v0.3.0"
+        assert declaration["specification_status"] == "released"
+        assert declaration["specification_release"] == "v0.5.0"
         assert (
             declaration["specification_commit"]
-            == "cd8f198c68b849eb8ed018a894670a0904c2181d"
+            == "864e84479f554b8ee250ffed44c4dfb963750d4a"
         )
 
 def test_profile_preflight_fails_without_transforming_a_wide_dataset() -> None: