v0.17.0 — resource-scoped approvals and safer reports

dbt-plan v0.17.0 — resource-scoped approvals and safer reports

This release tightens acknowledgement policy and protects snapshot and report
boundaries. It also includes machine-readable project statistics.

Upgrade: review acknowledgements

pip install --upgrade dbt-plan==0.17.0

An acknowledgement now covers only the named resource's known findings.
Acknowledging an upstream model no longer accepts downstream risks automatically.
Review existing acknowledge_models lists and --acknowledge flags: previously
passing CI can now exit 1 (destructive) or 2 (warning).

For example, if the view stg_orders loses a column inherited by the incremental
fct_orders model using sync_all_columns, acknowledging only stg_orders does
not waive the drop on fct_orders. Review and explicitly acknowledge the affected
resource if that change is intended. Unknown findings and ambiguous identities
cannot be acknowledged away. Raw JSON and MCP risks stay visible even when policy
permits the change.

See the migration guide.

Improvements

• Recoverable snapshot publication preserves the previous baseline when staging
  or publication fails. A failed restoration retains a backup and reports where
  to recover it. Concurrent writers and power-loss durability are not guaranteed.
• MCP validates report structure and consistency before classifying safety.
  Malformed or incomplete reports are errors, not all-clear results.
• A versioned JSON Schema and actual CLI contract tests cover check reports.
  Additive fields remain compatible; schema validation is not a safety verdict.
• dbt-plan stats --format json exposes project statistics for automation.

Verification

Required CI covers Linux and Windows on Python 3.10–3.14, minimum dependencies,
built packages, real dbt/DuckDB execution, MCP and the composite Action. The release
workflow tests and builds the tagged source, checks packaged artifacts, then
publishes to PyPI, GitHub Releases and the MCP registry.

Full changelog