Repository navigation
Tags: stackql/stackql
Tags
windows-multiarch-in-parallel (#841) * windows-multiarch-in-parallel Summary: - Support for native windows build and test on both `amd64` and `arm64`. - Builds run in parallel, realising time saving from prior. * windows-multiarch-workflow-cleanup --------- Co-authored-by: Jeffrey Aven <javen@stackql.io>
omnisdk-query-replacement-opt-in (#797) Summary: - Support for limited, lightweight streamed queries via `preview` opt in. - Pass each document-driven provider's configured stackql auth, basic included, to omnisdk, and report each method's SQL verb in SHOW METHODS. - Added developer documentation for preview features in `docs/preview.md`. - Added robot test `Unstable Google Kms Key Rings Joined To Crypto Keys Jsonl Row Set Matches Expectation`. - Added robot test `Unstable Github Org Members Filtered By In List Jsonl Row Set Matches Expectation`. - Added robot test `Unstable Github Org Update Reports Despatch`. - Added robot test `Unstable Github Org Update Returning Jsonl Row Set Matches Expectation`. - Added robot test `Unstable Google Kms Key Ring Insert Returning Jsonl Row Set Matches Expectation`. - Pass each document-driven provider's configured stackql auth, basic included, to omnisdk, and report each method's SQL verb in SHOW METHODS.
mcp-go-sdk-1.8.0-and-protocol-version-pin (#796) * mcp updates * retire describe_resource MCP tool; discovery via list_methods -> describe_method The MCP describe_resource tool wrapped DESCRIBE provider.service.resource, which reports the schema of one select method resolved without WHERE parameters, while a SELECT routes by its parameters and can land on a method with a different shape. describe_method is the exact contract (inputs with param_type, output fields) for the method a query routes to, so it is now the single column source. - Remove the tool registration, Backend.DescribeResource and its implementations, the interrogator SQL builder and the description file. The SQL DESCRIBE statement is unchanged. - Rewrite the discovery instructions as a numbered drill-down ending in describe_method; sharpen the describe_method and list_methods descriptions; repoint dialect rules, error recovery, prompts and the deploy-stack resource at describe_method output fields. - Docs: drop the tool from docs/mcp.md, the package README and the bundle README; the docs tool table now also lists the query library tools. - Tests: unit test asserting the tool is not published; robot list-tools scenario asserts its absence and describe_method's presence; the describe-resource robot scenario is removed. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
migrate-embedded-sqlite-to-pure-go-modernc (#786) * modernc sqlite migration prep * migrate-embedded-sqlite-to-pure-go-modernc (#783) * docs(sqlfuncs): mirror CLAUDE.md as AGENTS.md for all agent sessions Co-authored-by: jeffreyaven <5146499+jeffreyaven@users.noreply.github.com> * deps: adopt any-sdk pure-Go sqlite backend, drop mattn/cgo fork replace Co-authored-by: jeffreyaven <5146499+jeffreyaven@users.noreply.github.com> * ci: retire cgo - CGO_ENABLED=0, drop C toolchains and sqlite_stackql tag, add per-artifact function smoke Co-authored-by: jeffreyaven <5146499+jeffreyaven@users.noreply.github.com> * docs+test: modernc backend invariants, release notes draft, robot ext-function smoke scenario Co-authored-by: jeffreyaven <5146499+jeffreyaven@users.noreply.github.com> * deps: bump any-sdk to alpha02 (aws_policy_equal tags parity, boolean decltype); pin sqlite_version fixture to 3.53.4 Co-authored-by: jeffreyaven <5146499+jeffreyaven@users.noreply.github.com> * burn: remove executed migration work order Co-authored-by: jeffreyaven <5146499+jeffreyaven@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: jeffreyaven <5146499+jeffreyaven@users.noreply.github.com> * finalize-pure-go-sqlite-migration-cleanup (#785) * retire remaining cgo configuration and stale migration artifacts Co-authored-by: jeffreyaven <5146499+jeffreyaven@users.noreply.github.com> * preserve migration smoke-test documentation Co-authored-by: jeffreyaven <5146499+jeffreyaven@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: jeffreyaven <5146499+jeffreyaven@users.noreply.github.com> * shard-postgres-docker-robot-tests Co-authored-by: jeffreyaven <5146499+jeffreyaven@users.noreply.github.com> * keep-stateful-robot-tests-in-one-shard Co-authored-by: jeffreyaven <5146499+jeffreyaven@users.noreply.github.com> * rename-release-process-doc-without-spaces Rename `docs/stackql release process.md` to `docs/stackql_release_process.md` per review, and update the three references to it (two workflow header comments and the mcpb packaging notes) so nothing points at the old name. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * move-extension-function-smoke-to-robot Remove the six workflow-level extension function smoke steps from build.yml per review. The check lives in the robot scenario `Sqlite Extension Functions Smoke Working`, which now carries the stronger aws_policy_equal comparison the workflow steps used (Version plus scalar-vs-array Resource), so nothing is lost in the move. The scenario runs wherever the functional suite runs: winbuild, linuxtest, linuxarmbuild, macosbuild, wsltest and the docker sqlite leg. winarmsmoke and macosarmbuild have no robot harness, so the check is no longer exercised in those two jobs. Also drop the stale "cgo" wording from the winarmsmoke comment. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * assert-shard-completeness-after-docker-tests Sharding splits one robot run across several dockertest legs, so no single leg can attest that the whole suite ran. Add a dockertestverify job that runs once all legs conclude and fails unless, for each (platform, db backend) group, the shards together account for every functional test exactly once. - Each robot-running dockertest leg uploads its output.xml; unsharded legs upload as shard 1 of 1. - robot_shard.py gains a verifier. The expected tests are parsed from test/robot/functional with no shard modifier applied, then compared as a multiset against the union of the shard reports, so the total count and each individual test are checked independently. - Anything that prevents verification fails it: absent shard, absent output.xml, inconsistent shard counts, a NOT RUN test, an expected group with no reports, or reports from a group that is not listed. - dockermerge now needs dockertestverify, so an image cannot be pushed past a failed verification. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * run-robot-suite-on-arm-runners Per review: now that GitHub hosts arm64 macOS and Windows runners, run the robot functional suite on both rather than leaving the extension function check unexercised there. - macosarmbuild: mirror the macosbuild robot harness (libpq, python deps, registry rewrite, certificates, robot run, report upload). The libpq path is resolved with `brew --prefix` because homebrew's prefix differs on Apple Silicon. - winarmsmoke: mirror the winbuild robot harness against the amd64 binary under x64 emulation. Python is x64 because psycopg2-binary, psycopg-binary and cryptography publish no win_arm64 wheels. The job now checks out the repo (before the artifact downloads, since checkout cleans the workspace) and moves from the short to the standard job timeout. - winbuild: upload the MCP client as an artifact so the MCP scenarios run in winarmsmoke rather than being skipped. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> --------- Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com> Co-authored-by: jeffreyaven <5146499+jeffreyaven@users.noreply.github.com> Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
reload-credentials-redesign (#761) * reload_credentials: report installed providers, invalidate doc auth contexts, changed flag, actionable credential errors The reload_credentials MCP tool read the lazily populated auth context registry, so an unscoped call before any query returned no rows and a scoped call for an installed, credentialed provider errored with "cannot find AUTH context" (after the env re-source had already run). The handler is now three ordered phases: re-source the configured env file (a configured file that has gone missing is an explicit error naming the path), invalidate auth contexts registered lazily from provider documents (--auth contexts are retained; the cached provider object is dropped with its context because doc auth only registers on provider creation), then report every installed provider against the now-current environment. Scoping is a filter; an unknown provider name is the only scoped error. Each row carries a new `changed` field: a sha256 comparison of the resolved credential material (successor chain included) before and after the re-source, never emitted. Query tools: credential resolution failures on run_select_query, run_mutation_query and run_lifecycle_operation now name the provider (parsed from the statement) and the recovery sequence (fix the env file, call reload_credentials, retry). execQuery propagates statement errors, which mutation, lifecycle and pull_provider previously swallowed into an empty success payload. Tool description rewritten to forbid preemptive calls and to make `changed: false` after a failure the stop signal. Tests: scripted stdio harness (run_stdio_credential_script) driving the stackql_auth_testing dummy-credential provider; robot scenarios for fresh-session scoped/unscoped/unknown, rotation after a registered context (stale key rejected by the mock, new key used post-reload), rotation before first query, recovery from failed resolution (select and mutation error text, no-op reload), missing env file. The pull_provider scenario now runs against a mocked HTTP registry server (9927) so the install is real rather than a swallowed local-mode error. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * mcp: master tool descriptions as markdown under content/tools Tool descriptions were inline Go string literals spread across server.go and query_library.go while instructions, prompts and resources were already authored as markdown under pkg/mcp_server/content. Move the 16 descriptions to content/tools/<tool_name>.md (frontmatter `name`, body is the description prose; soft line breaks collapse to spaces, blank lines keep paragraph breaks) and load them through the same embedded content framework. addToolWithGate attaches the mastered description and returns an error when a registered tool has none, so registration failures surface at server construction like prompt and resource failures do. Published bytes are unchanged for every tool. The build-time gate test now checks coverage in both directions: every published tool has a file and every file names a published tool. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * mcp: test that markdown tool description prose is what tools/list publishes Reads content/tools/run_select_query.md from disk independently of the loader, strips the frontmatter and joins the wrapped lines, then compares with the description returned by an in-process tools/list. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * robot: assert server/discover serves instructions on the stateless HTTP server The 2026-07-28 stateless roundtrip now opens with server/discover, the SEP-2575 replacement for the initialize handshake, and the 9926 scenario asserts the response lists the revision and carries the embedded content/instructions text. Closes the black-box gap where the new-revision instructions path was only covered by the in-process unit test. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * tool descriptions * mcp: align server instructions with the on-demand tool descriptions server_info and reload_credentials are on-demand recovery and diagnostic tools, never session-start steps; the instructions said otherwise. Session guidance now states the defaults (sqlite3, safe), that credentials resolve at query time with no preceding step, and the fail -> fix file -> reload -> retry sequence with changed: false as the stop signal. The 401 recovery rule gates the retry on changed: true. Discovery points at the query library before the drill-down, dialect rules describe validate_select_query as an on-demand pre-flight rather than a routine step, and the mutation shapes gain the EXEC statement form behind run_lifecycle_operation. validate_select_query: the "no credentials required" claim was checked against the binary and is false (EXPLAIN resolves credentials and fails before reporting a bad column when they are missing); the description now says so. Trailing newlines restored on the tool files. The stateless discover scenario anchors on the "# Discovery workflow" heading rather than a sentence that the rewrite reworded. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * test: retire the bespoke credential reload roundtrip in favour of the scripted driver The Sources Env File Mid Session scenario now runs through run_stdio_credential_script like the other reload scenarios, and the superseded run_stdio_credential_reload_roundtrip helper is removed. This also clears the CodeQL clear-text-storage alert (pre-existing on main) that the helper's secret_value write carried. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
Bump github.com/dvsekhvalnov/jose2go from 1.6.0 to 1.7.0 (#757) Bumps [github.com/dvsekhvalnov/jose2go](https://github.com/dvsekhvalnov/jose2go) from 1.6.0 to 1.7.0. - [Commits](dvsekhvalnov/jose2go@v1.6.0...v1.7.0) --- updated-dependencies: - dependency-name: github.com/dvsekhvalnov/jose2go dependency-version: 1.7.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
immutable-release-assets + retire gleam/kotlin/swift (#720) * packaging/mcpb: make publish never overwrites existing release assets Release assets are immutable once pinned (npm/pypi/SDK wrappers, the registry entry, and the releases.stackql.io cache all pin the bytes), and rebuilt bundles are never byte-identical. 'make publish' now skips assets already on the release (FORCE=1 to overwrite), so the CI publish job and re-dispatches for an existing release cannot invalidate pins - which the 0.10.601 dispatch on 2026-08-18 briefly did (originals restored from the run artifacts). * packaging/mcpb: retire the gleam, kotlin and swift SDK vectors Only Rust (crates.io), Go (module mirror) and .NET (NuGet) are supported; the three vectors, their renderer/Makefile/workflow entries and docs are removed. The archived stackql-mcp-{gleam,kotlin,swift} repos keep the code. * packaging/mcpb: retry transient failures fetching .sha256 pins in the renderer
PreviousNext