v0.1.8: 0.1.8: the OCI stack, certified

Stack only -- no library change. The version bump exists so the Deploy to
Oracle Cloud button stops handing people the 0.1.7 stack, which could not
apply at all.

verify.sh reached 6/6 CERTIFIED on a live tenancy: plan, apply, the MCP
endpoint answering, the instance reaching the database, and keyless
cataloguing through OCI Generative AI. Sixteen objects reflected out of the
stack's own Autonomous Database over one-way TLS, every description written by
Oracle's model with no API key and nothing leaving the tenancy.

Nine applies to get there. The CHANGELOG lists what each one found; all
twenty-one invariants in tests/test_oci_stack.py came from a real failure, not
from imagination.

Also: pyyaml is declared in the dev extra. tests/test_oci_stack.py has parsed
cloud-init.yaml since before tonight and was relying on whatever the runner
happened to have installed.

v0.1.7

0.1.7: the stack could never apply, and verify.sh hid the reason

Applied end to end in a real tenancy for the first time. Terraform planned
ten resources cleanly and then the API refused one of them:

  400-InvalidParameter: Internet Gateway target cannot be used together with
  Service Gateway target for All Services in the same routing table

0.1.4 added that service gateway so the database's access-control list could
name the VCN, which Oracle honours only when traffic arrives through one.
But the instance needs the internet gateway to install anything at all, and
OCI will not have both in one route table. Every apply since 0.1.4 would
have failed at exactly this point, after provisioning the database.

The service gateway is gone, and with it the VCN-scoped ACL -- naming the
instance's public IP instead is circular, since cloud-init already carries
the database's connection descriptor. The demo database is now reachable
over TLS with the ADMIN password and nothing else; it is created empty and
destroyed with the stack, adb_allowed_cidrs narrows it, and the README says
so rather than implying a protection that is not there.

verify.sh waited with `oci resource-manager job get --wait-for-state`, a flag
that subcommand does not accept. The non-zero exit tripped set -e and ran the
teardown trap before any diagnostic printed, so a failed job looked like the
script silently skipping three steps. Every wait is now an explicit poll.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PnwqraF2VmmnoTKoNFdSBb

v0.1.6

0.1.6: the stack's keyless cataloguing raced the policy that authoris…

v0.1.5 - PostgreSQL fix (upgrade if you use Postgres)

PostgreSQL users on 0.1.1-0.1.4 should upgrade: their catalog was empty.

• Fixed: PostgreSQL reflected nothing at all. 0.1.1 added an
  internal-schema filter for Oracle Autonomous Database and put public on
  the list, because PUBLIC is a pseudo-schema on Oracle. On PostgreSQL
  public is the user's entire database, so every schema was filtered out and
  Catalog.bootstrap() returned zero objects. Caught by running
  scripts/certify_dialect.py against a live PostgreSQL 16, which failed 7 of
  10 checks.
• Internal-schema detection now lives behind a per-dialect hook
  (schemagate.dialects.is_internal_schema) and applies only to the engine
  that defines it. A test asserts no cross-dialect list exists in
  introspect.py, because that is what caused this.
• PostgreSQL 16 re-certified live: certify script 10/10, plus the dialect
  and 260-object hostile suites.
• The OCI stack installs the driver matching your database URL instead of
  always Oracle, so create_adb = false with a PostgreSQL, SQL Server or MySQL
  URL now works rather than failing at import.
• Stack: shape_config for Flex shapes (A1.Flex is the other Always Free
  option and would 400 without it), a selectable availability domain for the
  "out of host capacity" case, GenAI policy scoped to the compartment instead
  of the tenancy, and preconditions that catch a missing password or database
  URL at plan time.

v0.1.4

An audit of the OCI stack — which had never been applied — found that its
headline feature never ran and that a default deploy could not have worked.

• Fixed: describe --provider oci ignored instance-principal auth. On an
  OCI VM there is no ~/.oci/config; the machine authenticates as itself. The
  CLI built OCIGenAIProvider with the default auth="config", failed with
  ConfigFileNotFound, and the stack's || true swallowed it — so the
  first-boot cataloguing the README promised silently never happened. The CLI
  now honours OCI_CLI_AUTH, as every other OCI tool does.
• The stack now creates a service gateway. The database's access-control
  list admits the VCN, and Oracle only honours a VCN entry when traffic arrives
  through a service gateway. Without one the database refused the VM's
  connections — the stack applied cleanly and never worked.
• The DSN is now selected as the LOW, server-authentication profile rather than
  profiles[0], which can be a mutual-TLS profile that thin-mode
  python-oracledb cannot use without a wallet.
• adb_version defaults to 19c: Always Free offers it in every home region,
  while 26ai and 23ai exist in only a few and 23ai stops being a valid value in
  December 2026.
• Database, dynamic-group and policy names are suffixed from the compartment,
  so a second deploy in one tenancy no longer collides.
• The image lookup asserts it found one instead of indexing an empty list.
• allowed_cidr and ssh_cidr are now separate and have no defaults — the
  MCP endpoint has no authentication of its own, so the stack refuses
  0.0.0.0/0 rather than shipping an internet-facing schema browser.
• Password validation matches Oracle's actual rule, including its rejection of
  passwords containing "admin".
• cloud-init: online firewall-cmd instead of firewall-offline-cmd, an env
  file the documented re-run command can actually read, and cataloguing output
  captured to /var/log/schemagate-catalog.log instead of discarded.
• The stack README now states plainly that it has not been applied end to end,
  and lists the home-region, tenancy-admin and credential-exposure caveats.

v0.1.2

One click onto Oracle Cloud, and the OCI provider no longer truncates.

• Deploy to Oracle Cloud. Resource Manager accepts a stack from a zip URL,
  so the button in the README gives the same one-click install a Marketplace
  listing would, with no partner membership, supplier registration or separate
  tenancy involved. Each release now carries schemagate-oci-stack.zip with the
  Terraform at the zip root, which is what Resource Manager reads.
• oci/quickstart.sh: schemagate against an existing Autonomous Database from
  OCI Cloud Shell in about a minute — no VM, no Terraform, no API key.
• oci/stack/ catalogues on first boot: a dynamic group and policy let that one
  instance call OCI Generative AI through its instance principal, so
  descriptions are written with no key and no prompt leaving the tenancy.
• Fixed: descriptions arrived truncated from OCI. _oci_text read only the
  first content part of a reply, so every Gemini description on a live run was
  cut off mid-sentence at about ten tokens and business-language recall fell
  twenty points with nothing logged. It now walks every response shape the
  service returns.
• A reply that stops mid-clause is retried with real headroom, and anything
  still short is collected on SchemaDescriber.truncated and raised as one
  RuntimeWarning. A provider that caps output can no longer degrade a catalog
  in silence.

v0.1.1

0.1.1: Oracle certified live on Autonomous Database 26ai

Bump 0.1.0 -> 0.1.1. README and TESTING now record the live certification:
certify script 10/10, native VECTOR store conformance, dialect suite, and a
127-object / ~7M-row stress schema, all on Oracle AI Database 26ai. CHANGELOG
0.1.1 covers the connect-args plumbing, the OCI GenAI and local providers, the
describe-prompt everyday-words change (56% -> 92% blind), and the oci-extra
split. AnthropicProvider gains max_retries. Local ATP test harnesses stay out
of the package (.gitignore).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PnwqraF2VmmnoTKoNFdSBb

v0.1.0

Rename ashiq -> schemagate