release: v0.1.7 — SQL injection won't compile + docs sweep

[aallan]

v0.1.7 — SQL injection won't compile

The sprint-closing release. The headline is the flagship guarantee: SQL injection is a compile-time error. Everything that ships in it already merged to main on its own PR; this PR cuts the version and does the release-wide documentation sweep.

What's in the release

• The built-in <DB> effect (#229) — query / execute against a host SQLite database, Array<Option<String>> positional parameters (SQL NULL = None), host-backed and configured by VERA_DB_URL.
• SQL injection as a compile-time error (#309) — the SQL argument of DB.query / DB.execute must be literal-provenance; a runtime-derived query is E207, a placeholder/parameter mismatch E208, a numbered/named placeholder E209. A deterministic type error, no solver. Hardened across three external adversarial reviews and two self-authored workflow rounds (a SEVERE generic-parameter launder caught before merge).
• Bare effect-op routing check (#1148, E217) — a bare op the backend can't route is now a clean checker error instead of a confusing vera compile failure.
• Float64 rounding-assertion CI-flake fix (#1121) — the soundness assertion is widened to accept the sanctioned Tier-3 timeout, keeping verified a hard failure.

Release machinery

• Version 0.1.6 → 0.1.7 across the check_version_sync surface (pyproject, vera/__init__.py, README, docs/index.html, uv.lock).
• CHANGELOG [Unreleased] → [0.1.7] (2026-07-24) + fresh [Unreleased] + compare-link refs.
• HISTORY v0.1.7 row in the Stage 19/20 table.
• Regenerated site assets (llms.txt, llms-full.txt, index.md, docs/SKILL.md).

Documentation sweep

• spec §9.5 built-in-effects summary aligned with the shipped set (Async, Inference, HttpServer, DB) — the "future effects for concurrency and LLM inference" wording predated them.
• Removed the now-shipped #309 from the ROADMAP standard-library horizon.
• Dropped the fixed #1121 row from KNOWN_ISSUES (caught by check_limitations_sync --check-states).
• Verified the DB/SQL feature is documented consistently across README, docs/index.html, SKILL, and the spec, with current limitation rows; no stale example/test workarounds.
• Filed #1150 for the drifted, ungated vera/README module-map line counts (tracked under ROADMAP compiler-internals rather than hand-patched).

No compiler behaviour changes — docs, version metadata, and generated site assets only.

Merge is yours; the release tag + PyPI publish are handled by the GitHub Actions release workflow on the version bump.

🤖 Generated with Claude Code

Summary by CodeRabbit

• New Features
  • Added the DB built-in effect.
  • SQL injection is now detected at compile time, with clearer diagnostic errors.
  • Added validation for bare effect operations.
• Bug Fixes
  • Fixed an intermittent Float64 rounding assertion failure in CI.
• Documentation
  • Updated project documentation and specifications for version 0.1.7.
  • Refreshed the known issues and roadmap entries.

[coderabbitai]

📝 Walkthrough

Walkthrough

Vera is updated from v0.1.6 to v0.1.7 across package metadata and project status. Release history, changelog references, standard-library documentation, roadmap entries, and the known-issues snapshot are aligned with the new release.

Changes

v0.1.7 release alignment

Layer / File(s)	Summary
Version metadata alignment pyproject.toml, vera/__init__.py, README.md	Project and package versions are updated to v0.1.7, and the README release metric is incremented from 203 to 204.
Release records and changelog links CHANGELOG.md, HISTORY.md	The v0.1.7 release heading, documentation-sweep entry, history row, and compare-link references are added or updated.
Specification, roadmap, and issue status spec/09-standard-library.md, ROADMAP.md, KNOWN_ISSUES.md	The built-in effects list now includes Async, Inference, HttpServer, and DB; roadmap items are revised; and issue #1121 is removed from the known-issues table.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Possibly related PRs

• aallan/vera#327: Updates related version metadata used by generated site assets.
• aallan/vera#375: Adds version consistency checks covering README, package metadata, and __version__.
• aallan/vera#963: Modifies overlapping roadmap horizon sections.

Suggested labels: compiler, spec, docs

🚥 Pre-merge checks | ✅ 6 | ❌ 2

❌ Failed checks (2 warnings)

Check name	Status	Explanation	Resolution
Linked Issues check	⚠️ Warning	The PR does not touch the test in #1121, so the required Float64 assertion fix is not implemented.	Update tests/test_float64_fp.py::TestFloat64FpSoundness797::test_rounding_relation_not_proved to accept violated or timeout, while still rejecting verified.
Out of Scope Changes check	⚠️ Warning	The release version, changelog, roadmap, README and spec edits are unrelated to the only linked issue, which is about a Float64 test fix.	Split the release/docs/version updates into a separate PR or add matching issue scope, and keep this PR focused on the #1121 test change.

✅ Passed checks (6 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title is concise and accurately reflects the v0.1.7 release and documentation sweep.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Changelog Covers Public-Surface Changes	✅ Passed	PASS — the only public-surface change is spec/09-standard-library.md, and CHANGELOG.md explicitly notes the v0.1.7 built-in-effects sweep (Async/Inference/HttpServer/DB).
Spec And Implementation Move Together	✅ Passed	No compiler semantics changed in vera/; the spec’s built-in effects and Async wording match existing registrations and checker/runtime behaviour.
Diagnostics Carry An Error Code	✅ Passed	PASS: The only added diagnostic-bearing lines are the release notes, and each uses stable codes (E207/E208/E209/E217); no new code-less diagnostic was introduced.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch release/v0.1.7

---

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.80%. Comparing base (abd2424) to head (e27ffde).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #1151   +/-   ##
=======================================
  Coverage   93.80%   93.80%           
=======================================
  Files          99       99           
  Lines       33434    33434           
  Branches      458      458           
=======================================
  Hits        31364    31364           
  Misses       2057     2057           
  Partials       13       13           

Flag	Coverage Δ
javascript	78.61% <ø> (ø)
python	95.53% <100.00%> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@spec/09-standard-library.md`:
- Line 11: Update the built-in effects description in the standard-library
specification to describe Async as supporting asynchronous or concurrent
computation while explicitly noting that the reference executor currently
evaluates it eagerly and sequentially, without runtime concurrency.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 889d4e7b-1393-4bc7-915b-518790cbf28d

📥 Commits

Reviewing files that changed from the base of the PR and between abd2424 and e27ffde.

⛔ Files ignored due to path filters (5)

• docs/index.html is excluded by !docs/**
• docs/index.md is excluded by !docs/**
• docs/llms-full.txt is excluded by !docs/**
• docs/llms.txt is excluded by !docs/**
• uv.lock is excluded by !**/*.lock, !uv.lock

📒 Files selected for processing (8)

• CHANGELOG.md
• HISTORY.md
• KNOWN_ISSUES.md
• README.md
• ROADMAP.md
• pyproject.toml
• spec/09-standard-library.md
• vera/__init__.py

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

• aallan/vera-bench (manual)

💤 Files with no reviewable changes (1)

• KNOWN_ISSUES.md