Task 14: verification and handoff

[roachitect-aman]

The last task in the plan: run every check, prove the negative, and record the results.

Results

Check	Result
python3 -m unittest	382 tests, OK
python3.9 -m unittest	382 tests, OK — oldest supported interpreter
python3 dbprofiler.py --check-safety	OK, 14 SQL constants checked, exit 0
python3 dbprofiler.py --version	dev
python3 -m unittest integration_test	50 tests, OK, against PostgreSQL 16.15 in Docker
ruff check	All checks passed
git diff --check	clean, exit 0
working tree	clean; nothing uncommitted, nothing untracked

An end-to-end run against the live server published a bundle with all ten members — manifest.json written last, nine payloads hashed in it, zero warnings, stats_reset recorded.

The credential sweep went after the bundle bytes, not just the source

Every assignment in the local test configuration was searched for in the published ZIP's stored bytes, in each member decompressed, and in captured stderr. Host, port, user, password, the connection URL, and the token key are absent from all three.

source.database in manifest.json and profile.json does hold the database name. That is the bundle identifying what it profiled, next to schema.sql, and is not a credential.

mypy --strict is not clean, and mypy is not adopted

The checklist gates it on "if adopted", and it is not: no CI workflow, no config file, no pre-commit list. Run anyway for the record, it reports 51 errors — 27 no-untyped-def and 10 no-untyped-call on internal helpers, 8 type-arg, and six others. All six were read and none is a defect: violations = [] needs an annotation mypy cannot infer, sum(1 for _ in ...) trips mypy's bool overload of sum, and env = os.environ if env is None else env widens to _Environ[str], which Mapping[str, str] would have described better than dict[str, str] | None.

Annotating the file to satisfy --strict is a real improvement and a real diff across a file whose reviewability is the product, so it is left for a change that is about that and nothing else. Flagging it rather than quietly doing it here.

Two things worth knowing

• --version reports dev. Deliberate. The release workflow refuses to publish unless the tag equals v$(dbprofiler.py --version), so dev means no tag can ship until someone bumps VERSION on purpose. The first release is a VERSION commit followed by a tag, not a tag alone.
• The handoff bundle came from an empty database. The integration fixtures are created and dropped inside integration_test.py, so the standalone run profiled a server with no user tables. It proves bundle structure, manifest hashing, atomic publication, and the absence of credentials; the 50 integration tests are what prove content — table shape, FK fan-out, extended statistics, tokenization, and Tier 1 telemetry against a seeded schema.