# franken_snowflake — Technical Due-Diligence Assessment

**The hook:** A 62,062-line, Tokio-free, clean-room Snowflake SQL API connector for coding agents — whose own issue tracker says the end-to-end live proof is still open, while its README badge already claims live success.

**Tier legend (Rulebook §1):** **[Verified]** direct inspection of the pinned clone or a live page read by the analyst — flavors **[Counted]** (I ran the count), **[Git-observed]** (git metadata), **[Code-verified]** (source read). **[CI-observed]** is Tier 2 (seen executing on live CI pages — attests the suite *runs*, not that it is green). **[Maintainer claim]** asserted in README/docs, not independently executed. **[External]** independent sources. **[Inference]** analyst judgment, always labeled. Confidence: **High** / **Medium** / **Low**.

## TL;DR

franken_snowflake is a **genuine, working, 14-crate Rust workspace** that speaks Snowflake's SQL API v2 over HTTPS with no ODBC, no JDBC, no third-party Snowflake crate — and, most unusually, **no Tokio anywhere in its 589-package dependency graph** [Verified, High]: the HTTP/1.1 + TLS transport is built on Asupersync (`=0.3.5`, exact-pinned), enforced by a cargo-tree admissibility gate that fails the build if a forbidden crate appears in any of the ~21 feature lanes, dev included [Verified, High]. Around the transport sits the project's real contribution: an **agent-ergonomics and safety layer** — deterministic versioned JSON envelopes with `data_source` provenance, a self-describing capability registry, an MCP server sharing the CLI handlers, a write-safety ladder built on **explicit arming** (`WRITE_ENABLED` opt-in → writes execute directly once armed → dry-run/confirm ceremony re-armable via `WRITE_REQUIRE_CONFIRM` → DDL behind separate `WRITE_ALLOW_DDL`), a compile-time secret-leak gate (a build script that fails the build if a credential-shaped field derives `Debug`), and BLAKE3 content-addressed receipts with an append-only audit log [all Verified in code, High]. It ships: four GitHub releases (v0.0.1→v0.0.4, 2026-06-30→2026-09-12) with 16 checksummed multi-arch binary assets, plus crates.io publication (0.0.4, 36 downloads, flagged by crates.io as license "non-standard") [Verified, High]. **But:** the "read + write live-success" badge is a **maintainer claim with in-repo tension** — the repo's own Beads tracker leaves the end-to-end live-account proof bead **in_progress** at HEAD and the empirical jsonv2 live-golden bead **open**, and `docs/live_proof.md` states "only the credentialed evidence run — against a fresh Snowflake trial, since the June UA70404 trial is past its 30-day window — remains" [Verified, High]; zero independent benchmarks, reviews, or production deployments found [External, High within recall]. The MIT+OpenAI/Anthropic-rider license is **not OSI open source** and withholds even benchmarking rights from the two leading AI labs [Verified, High] — a hard ceiling for a project whose entire thesis is agent infrastructure. **TRL 6. NODUS ring: Explore** (a near-miss on Pilot, argued below). Strongest strength: the dependency-hygiene and evidence machinery is real and machine-checked, not aspirational — the no-Tokio policy is proven by the lock file, not promised in a README. Strongest ceiling: bus factor 1 with contributions explicitly refused, zero adoption signal (6 stars, 2 forks), and a license that legally bars the exact labs that would validate it.

## Quick Links

- Repository: https://github.com/Dicklesworthstone/franken_snowflake
- README: https://github.com/dicklesworthstone/franken_snowflake/blob/HEAD/README.md
- License (MIT + OpenAI/Anthropic rider, read verbatim): https://github.com/dicklesworthstone/franken_snowflake/blob/HEAD/LICENSE
- Changelog (releases v0.0.1–v0.0.4, live lanes): https://github.com/dicklesworthstone/franken_snowflake/blob/HEAD/CHANGELOG.md
- Live proof lanes (opt-in battery, typed-skip contract): https://github.com/dicklesworthstone/franken_snowflake/blob/HEAD/docs/live_proof.md
- Dependency admissibility gate (the no-Tokio policy): https://github.com/dicklesworthstone/franken_snowflake/blob/HEAD/docs/dependency_admissibility.md
- Agent instructions (incl. the "never uses GitHub Actions" policy): https://github.com/dicklesworthstone/franken_snowflake/blob/HEAD/AGENTS.md
- Release v0.0.4 (16 assets, published 2026-09-12): https://github.com/Dicklesworthstone/franken_snowflake/releases/tag/v0.0.4
- crates.io: `franken-snowflake-sqlapi` 0.0.4 (36 downloads, license "non-standard") — verified via https://crates.io/api/v1/crates/franken-snowflake-sqlapi ; crate page https://crates.io/crates/franken-snowflake-sqlapi
- New-at-HEAD CI workflow (policy tension, see §4.8): https://github.com/dicklesworthstone/franken_snowflake/blob/HEAD/.github/workflows/ci.yml
- Latest CI run (#140, red, 2026-09-13 — per-job conclusions via API): https://github.com/Dicklesworthstone/franken_snowflake/actions/runs/34737903108

## Did you know?

**The headline.** The project's `AGENTS.md` states "This repository never uses GitHub Actions. Do not add `.github/workflows`... cite `dsr` output, never an Actions run, as proof" — and the v0.0.3 changelog records a previous workflow *deleted* for violating that policy after 52 parse-failed runs. But the Actions API tells a different story: a new `.github/workflows/ci.yml` was executing by 2026-09-13, has 140 total runs, and the latest run (#140) is **red** — the `cli live,mcp` feature lane failed on ubuntu-latest and windows-latest, macos-latest failed on the "installer shell UI safety" assertion, and no run has executed on the HEAD commit (2026-09-22). The policy and the tree contradict each other, in the open, sustained across 140 runs — and the tree's own CI is currently failing [Verified via Actions REST API + clone, High].

**The tell.** The repo's Bead tracker keeps its own proof accounting honest: bead `fsnow-agent-ergonomic-cli-gap-docs-truth-79s` (closed) records the maintainer discovering the empirical jsonv2 golden bead had been *falsely closed* and reopening it. A tracker that publicly corrects its own closures is the behavior the live-proof dispute needs more of — and it cuts against the cynical read of the open proof beads [Verified from `.beads/issues.jsonl` at HEAD, High].

**The deep cut.** The README's contributions section (L929–936) says of outside submissions: "I'll have Claude or Codex review submissions via `gh` and independently decide whether and how to address them." Meanwhile the LICENSE rider names Anthropic, PBC a Restricted Party to whom "no rights are granted" — not even benchmarking. This is irony of posture, not legal contradiction (the rider restricts Anthropic's *use of this software*, not the maintainer's use of Claude), but it is the same structural irony the FrankenRedis packet found in its Anthropic co-author: the project is built with the tools of a party it legally excludes [Verified verbatim, High].

## Franken-worthy next steps

These are research directions, not engineering tickets: each is novel, specific, falsifiable, and backed by rigor this project has already demonstrated.

1. **Receipt chain → tamper-evident agent-action ledger for the warehouse.** Every live execution already writes a BLAKE3 content-addressed receipt plus partition evidence and an append-only audit event [Verified in code]. Hash-chain the receipts (each receipt commits to the previous chain head) and sign the chain head with the profile's key-pair, turning "auditable after the fact" into a tamper-evident provenance log for agent-driven mutations. **Falsification:** a red-team exercise corrupts or rewrites a receipt after a malicious `query write`; any undetected history rewrite kills the thesis. This codebase is unusually qualified to attempt it honestly: it already ships a compile-time secret-leak gate, planted-canary redaction tests, and a sanitized-envelope pass — the evidence culture exists before the ledger does.
2. **Close the empirical wire golden (the open bead) as a public method.** Bead `fsnow-native-snowflake-connector-w0i.13` ("Capture empirical jsonv2 result-encoding live golden") is open at HEAD, and the `fsnow-golden-teeth/jsonv2-wire-golden.json` fixture in-tree is synthetic, not captured from a live account. Capture real jsonv2 wire responses across all 15 supported types from a live trial, check them in, and assert the SWAR zero-copy decoder's bitwise parity against them in the offline CI lane. **Falsification:** if any real Snowflake encoding (fractional epoch seconds edge cases, `TIMESTAMP_TZ` offsets, `FIXED` decimal strings) breaks the decoder's assumptions, the zero-copy thesis fails in public — which is exactly why doing it is valuable.
3. **Export the dependency-admissibility gate as a reusable method.** `scripts/check-dependency-admissibility.py` runs `cargo tree` across every feature lane (default, no-default, each production feature, all combined, *and* dev/test lanes) and fails on any forbidden crate — a machine-checked "dependency diet" that produced the verified zero-Tokio lock file. **Falsification:** apply the script to a second FrankenSuite repo with its own policy list (e.g. frankenredis) and publish the lane-verdict JSON; if the gate cannot be decoupled from franken_snowflake's policy table within one focused workstream, it is product scaffolding, not a method.
4. **The honest benchmark: asupersync HTTP vs the mainstream stack.** The project's largest structural bet is a custom HTTP/1.1+TLS transport on asupersync instead of battle-tested hyper/reqwest/rustls, justified by "one audited foundation" — but no performance or correctness comparison has ever been published, and the only throughput number in the repo (350 MB/s decoder) is a self-gated threshold on synthetic data with no A/A null. Run statement submit/poll/partition-fetch workloads through both stacks on pinned hardware with A/A null controls and publish the result. **Falsification:** if the custom stack is materially slower, fails TLS edge cases rustls handles, or shows retry-path races the DPOR suite misses, the Tokio-free thesis costs more than it saves — and the project should say so in its own README, the way it already publishes the things it loses.
5. **Typed-skip live proof as a general pattern for credential-gated CI.** The live-proof lanes' most original testing idea isn't the mock server — it's the contract that a credential-less run emits a *structured skip event* (`franken_snowflake.live_gate.v1`) instead of silently passing, so "no credentials" is never confused with "green." **Falsification:** extract the skip-event contract (opt-in env, typed skip, secret scan, spawned-process env sanitization) into the testkit crate's public API and have one downstream consumer adopt it; if no second project can adopt it without the franken_snowflake tree, it stays a local convention.

---
## 4.1 Header

| Field | Value |
|---|---|
| Repository | https://github.com/Dicklesworthstone/franken_snowflake |
| Pinned revision | `e5f6312b2aa0fc2a74757b9eab09c6e14ccdef86` — 2026-09-22 13:28:48 UTC (commit date 09:28:48 -0400) [Verified, High] |
| Assessment date | 2026-09-22 |
| Language / toolchain | Rust, edition 2024, pinned `nightly-2026-08-31` (`rust-toolchain.toml`), `rust-version = "1.95"` [Verified, High] |
| License | MIT License **with OpenAI/Anthropic Rider** — NOT OSI open source; full text read verbatim, rider scope quoted in §4.8; crates.io independently flags the published crate's license as "non-standard" [Verified, High] |
| Scale | 14 workspace crates; 78 Rust files; **62,062 first-party lines** (crates only) [Verified, High] |
| Stars / forks | 6 stars / 2 forks (GitHub API, 2026-09-22) [External, High] |
| Releases / tags | v0.0.0 (tag only, 2026-06-29), v0.0.1 (2026-06-30), v0.0.2 (2026-08-24), v0.0.3 (2026-09-04), v0.0.4 (published 2026-09-12T03:11:07Z per GitHub API; CHANGELOG dates it 2026-09-11 — one-day drift) [Verified, High] |
| crates.io | `franken-snowflake-sqlapi` 0.0.4 published 2026-09-12, 36 downloads, license "non-standard" [Verified via crates.io API, High] |
| Last push | HEAD commit 2026-09-22; GitHub `pushed_at` 2026-09-22T13:35:25Z (7 min after the commit) [External, High] |
| Maintainer | Single: Dicklesworthstone (Jeffrey Emanuel, per LICENSE copyright and Cargo.toml authors); README "About Contributions": outside contributions not accepted — bus factor 1 by policy [Verified, High] |
| Inception | 2026-06-24/25 per CHANGELOG and GitHub repo creation date 2026-06-25T00:48:46Z [Verified, High] |

**Analyst method.** Fresh shallow clone of HEAD to `~/workspace/.scratch/franken-snowflake-verify/` (6.0 MB; no giant corpus). Read: README (942 lines, all), LICENSE (verbatim), CHANGELOG (731 lines, targeted), `docs/live_proof.md` (all), `docs/dependency_admissibility.md` (headers), `docs/RELEASE.md` (headers), `AGENTS.md` (all), `UPGRADE_LOG.md` (all), `.github/workflows/ci.yml` (all), `.beads/issues.jsonl` (128 issues, status census). Grep-verified: workspace members (14), Rust line/file counts, per-crate counts, `#![forbid(unsafe_code)]` enforcement path (workspace lints + 14/14 `[lints] workspace = true`), zero actual `unsafe` blocks/impls/externs in first-party code, clippy deny table + test exemption, asupersync pin and features, Cargo.lock absence of tokio/reqwest/hyper/axum/tower/sqlx/diesel/sea-orm (all 589 packages), auth-lane enum (4 variants), WRITE_* handles, blake3 dependency, the secret-leak `build.rs`, MCP tool list, `#[test]` count (576), zero-copy decoder SWAR vs SIMD, absence of any fuzz harness in the lock. Fetched and confirmed resolution of every Quick Link except the crates.io HTML page (browser fetch failed once; the crates.io API endpoint for the same crate returned the full record). Web-searched for independent coverage. **Not done:** did not compile, run tests, execute the binary, reproduce any benchmark, or contact Snowflake — all behavioral and performance claims rest on maintainer evidence plus revision-bound documentation. CI status checked via the Actions REST API (140 runs; latest #140, 2026-09-13, red — see §4.5). Did not run the admissibility script itself (it requires `cargo metadata`; the lock-file grep is the independent check).

## 4.2 Executive verdict

franken_snowflake is a **genuinely substantive, unusually disciplined clean-room Rust connector for Snowflake's SQL API v2**, built for coding agents rather than humans [Inference, High]: 14 crates and 62,062 lines of first-party Rust [Verified, High]; a real HTTPS transport over a custom asupersync HTTP/1.1+TLS stack with a **provably Tokio-free dependency graph** (zero forbidden crates in the entire 589-package lock, including dev lanes) [Verified, High]; four auth lanes (PAT, key-pair JWT with re-signing, OAuth bearer, RFC 7523 OIDC workload identity) verified in code [Verified, High]; a write-safety ladder, a compile-time secret-leak gate, BLAKE3 receipts and an append-only audit log [Verified in code, High]; a deterministic testkit (mock SQL API server, codec lane under the lab runtime, DPOR race suite) [Verified structure, High]; and four shipped releases with 16 checksummed multi-arch binaries plus crates.io publication [Verified, High]. Its most original contribution is the **machine-checked dependency-hygiene and proof-lane machinery** — the admissibility gate, the typed-skip live-proof contract, the redaction canaries — a genesis-stage discipline no connector incumbent ships [Inference, Medium]. **But:** the README's "read + write live-success" badge is **ahead of the repo's own proof tracking** — the end-to-end live-account proof bead is `in_progress` at HEAD, the empirical wire-golden bead is `open`, and `docs/live_proof.md` says the credentialed evidence run "remains" against a fresh trial since the June trial expired [Verified, High]; zero independent validation of any kind was found [External, High within recall]; the single throughput number in the repo (350 MB/s) is a self-gated threshold on synthetic data, not a benchmark [Verified, High]; and the MIT+OpenAI/Anthropic-rider license withholds all rights — including benchmarking and analysis — from OpenAI, Anthropic, their affiliates, and anyone acting for them [Verified, High]: it is **not OSI open source** and is a hard adoption ceiling for an agent-infrastructure play, confirmed independently by crates.io's "non-standard" license flag [Verified, High]. **NODUS: Explore** (a near-miss on Pilot, argued in §4.9). **Wardley:** commodity SQL connectivity, custom-built agent contract layer, genesis-stage proof machinery. The most durable contribution today may be the **methodology** (dependency admissibility, typed-skip proof lanes, compile-time leak gating), not the connector [Inference, Medium].

## 4.3 Claim inventory: demonstrated vs aspirational

Status values: *demonstrated* / *partially demonstrated* / *aspirational* / *disproven* / *stale*.

| # | Claim | Status | Evidence |
|---|---|---|---|
| 1 | Live reads and writes against Snowflake accounts ("read + write live-success" badge) | **Partially demonstrated** — with in-repo tension | [Maintainer claim, Medium] — v0.0.3 release notes assert "real reads and writes against live Snowflake accounts"; June UA70404 trial referenced in docs. **Counter-evidence [Verified, High]:** bead `fsnow-agent-ergonomic-cli-cli-live-e2e-and-receipts-bvf` (end-to-end live-account proof) is `in_progress` at HEAD; `docs/live_proof.md`: "only the credentialed evidence run — against a fresh Snowflake trial, since the June UA70404 trial is past its 30-day window — remains." No in-repo live artifact. |
| 2 | `forbid(unsafe_code)` workspace-wide | **Demonstrated** | [Verified, High] — `[workspace.lints.rust] unsafe_code = "forbid"`; all 14 crates carry `[lints] workspace = true`; grep finds zero `unsafe` blocks, `unsafe fn`, `unsafe impl`, or `unsafe extern` in first-party code |
| 3 | Clippy denies `unwrap_used` / `expect_used` / `panic` / `todo` / `dbg!` | **Demonstrated** (non-test code) | [Verified, High] — `[workspace.lints.clippy]` denies all five; `clippy.toml` documents `allow-*-in-tests = true` switches so the denials are scoped to non-test code; the auth `build.rs` leak gate carries its own documented `#![allow(...)]` |
| 4 | No Tokio, reqwest, hyper, axum, tower (etc.) in the production graph | **Demonstrated** — stronger than claimed | [Verified, High] — zero occurrences in all 589 `Cargo.lock` packages, i.e. no forbidden crate in *any* lane including dev; the admissibility gate (`scripts/check-dependency-admissibility.py`) checks ~21 feature lanes per `docs/dependency_admissibility.md` |
| 5 | Asupersync-native HTTP/1.1 + TLS transport | **Demonstrated** | [Verified, High] — `asupersync = "=0.3.5"`, `default-features = false`, features `[proc-macros, tls, tls-native-roots, compression]`, from crates.io; `crates/franken-snowflake-http` (3,562 lines, single file) builds the client on it; single-version gate script at `scripts/check-asupersync-single-version.sh` |
| 6 | Four auth lanes: PAT, key-pair JWT, OAuth bearer, OIDC workload identity | **Demonstrated** | [Verified, High] — `AuthLane` enum in `crates/franken-snowflake-auth/src/lib.rs` has all four variants with re-sign/refresh logic; OIDC lane (`workload_identity.rs`, RFC 7523) is new in [Unreleased]; tests exist (`tests/oidc_workload_identity.rs` with mock exchanger) |
| 7 | Write-safety ladder: explicit arming, not always-on ceremony | **Demonstrated** (mechanism in code; live writes rest on claim 1) | [Verified, High] — `crates/franken-snowflake-cli/src/lib.rs`: "Once the profile sets WRITE_ENABLED, a bare `query write` runs DML/COPY INTO/PUT directly and returns the live receipt; --dry-run previews and emits a confirmation token; --confirm <token> executes a previewed write. Set WRITE_REQUIRE_CONFIRM=true to require the dry-run/confirm ceremony; DDL needs WRITE_ALLOW_DDL." The dry-run token is deterministic and bound to statement kind + request ID (`confirm:{kind}:{request_id}` in `core/src/write_intent.rs`). Typed refusals FSNOW-3007/3008/3009 surface with exact repair commands |
| 8 | Secret-leak compile gate (credential-shaped fields must not derive `Debug`) | **Demonstrated** | [Verified, High] — `crates/franken-snowflake-auth/build.rs` scans the crate's own `src/` for credential markers and fails the build on violation; planted-canary redaction tests referenced in CHANGELOG [Maintainer claim on test outcomes, Medium] |
| 9 | BLAKE3 content-addressed receipts + append-only audit log per live execution | **Partially demonstrated** | [Verified code exists, High] — `blake3` dep in cache crate (with `pure` feature for Windows ARM), receipt/audit types in code; **live** receipt production depends on claim 1, and `receipt show` round-trip is exercised only in the offline lane + the pending live battery |
| 10 | Deterministic testkit: mock SQL API server, codec lane under lab runtime, DPOR race suite; "420 passed, 0 failed across 32 targets" | **Partially demonstrated** / figure **stale** | [Verified structure, High] — testkit crate (6,220 lines), `race.rs` DPOR suite, mock server per docs; 576 `#[test]` annotations counted at HEAD vs the 420 figure quoted from the v0.0.2 gate — the number drifted ~37% with no updated figure published [Verified, High] |
| 11 | MCP server exposes read verbs as tools over stdio/HTTP, sharing CLI handlers | **Demonstrated** | [Verified, High] — `franken-snowflake-mcp` crate; README lists 19 tools (`capabilities`…`dataset_describe_operator`); stdio handshake/parity integration test exists per `docs/RELEASE.md` |
| 12 | "Zero-Copy SIMD" jsonv2 decoder exceeding 350 MB/s, "comprehensive differential fuzzing suite and bitwise parity tests" | **Partially demonstrated** — framing overstated | [Verified, High] — `zero_copy_decoder.rs` (1,306 lines) uses **SWAR** (SIMD Within A Register), not hardware SIMD intrinsics; the 350 MB/s is a **self-gated assertion** in `tests/zero_copy_parity.rs` (best-of-3 runs on synthetic payload, release target 350 / debug target 20, no A/A null, no hardware pinning); the debug target was *lowered* per CHANGELOG because of "CPU scheduling contention on shared remote workers." **No fuzzing harness exists** (no cargo-fuzz/proptest in the lock) — the "differential fuzzing suite" claim is unsupported by the tree |
| 13 | 14-crate workspace | **Demonstrated** | [Verified, High] — 14 members in `Cargo.toml`; matches README |
| 14 | Multi-arch release binaries with checksums, glibc-floor checks | **Demonstrated** | [Verified, High] — v0.0.4: 16 assets including 6 platform archives with sha256 sidecars, a manifest, and SHA256SUMS; per-asset download counts 2–4; built via `dsr` per CHANGELOG |
| 15 | "Clean-room" (third-party crates studied read-only, never copied) | **Aspirational** | [Maintainer claim, Low] — stated in README and AGENTS.md; unverifiable from outside without provenance analysis; no counter-evidence found |
| 16 | Empirical jsonv2 result-encoding live golden | **Aspirational** | [Verified, High] — bead `fsnow-native-snowflake-connector-w0i.13` is **open** at HEAD; in-tree `fsnow-golden-teeth/jsonv2-wire-golden.json` is a 3-key synthetic fixture, not a live capture |
| 17 | "18 feature lanes" clean under clippy `-D warnings` | **Stale** | [Verified, High] — v0.0.4 section says 18 lanes; the [Unreleased]/Fixed section says "all 21 feature combinations"; drift within one document |
| 18 | Release date v0.0.4 = 2026-09-11 | **Stale** (one-day drift) | [Verified, High] — CHANGELOG says 2026-09-11; GitHub API `published_at` is 2026-09-12T03:11:07Z |

## 4.4 Architecture (reconstructed, not summarized)

[Verified from the clone; README diagrams treated as claims where noted]

**Crate topology (14 workspace members):** `franken-snowflake-core` (envelope, error registry `FSNOW-xxxx`, guardrails, budgets, cancellation, redaction, write-intent state machine — 5,242 lines), `franken-snowflake-auth` (4 auth lanes, JWT lifecycle, OIDC federation, redaction policy + the build.rs leak gate — 4,492 lines), `franken-snowflake-http` (**single 3,562-line `lib.rs`**: the asupersync HTTP/1.1 + TLS client, retries, `Retry-After`, submit-retry guard), `franken-snowflake-sqlapi` (submit/poll/partition/cancel, jsonv2 wire codec, statement lifecycle as asupersync `bracket`s — 5,893 lines), `franken-snowflake-catalog` (INFORMATION_SCHEMA discovery, manifests, dataset planner with pushed-down SQL + positional typed bindings, Time Travel `AT(TIMESTAMP => ...)` — 4,931 lines), `franken-snowflake-frame` (columnar frames, the SWAR zero-copy jsonv2 decoder — 3,105 lines), `franken-snowflake-graph` (lineage, Mermaid/SVG via FrankenNetworkX crates — 1,311 lines), `franken-snowflake-cache` (append-only JSONL store; FrankenSQLite backend opt-in behind its feature — 3,515 lines), `franken-snowflake-export` (Snowflake-side `COPY INTO` plans + local CSV/JSONL/Parquet writers; the Parquet writer is a self-contained v2.0 implementation, 1,929-line `parquet.rs` — 4,177 lines), `franken-snowflake-text-indexing` (frankensearch `hash`/`lexical` only — 866 lines), `franken-snowflake-testkit` (mock SQL API server, codec lane, DPOR race suite, golden/clock/canary harness — 6,220 lines), `franken-snowflake-cli` (**15,733 lines, 13 files; `lib.rs` alone is 7,239 lines** — the monolith), `franken-snowflake-mcp` (1,523 lines, single file), `franken-snowflake-tui` (1,492 lines, single file).

**Data flow:** agent/CLI → shared handler set → `core` (envelope, guardrails, redaction) → `live` feature gate → `auth` (lane → headers) → `http` (asupersync TLS) → `sqlapi` (submit → poll → partition stream → cancel) → `frame`/`export` (materialize) → `cache` (receipt + audit). Statements are modeled as asupersync `bracket`s so local cancellation fires the remote SQL API cancel endpoint — including on error paths after a handle exists (`abandon_with_error` → best-effort masked remote cancel), a 2026-09-02 fix documented in a commit message found via search [Verified in code + commit record, High]. No `tokio`, no `reqwest`, no `hyper` anywhere in the graph [Verified, High].

**Memory-safety posture** [Verified, High]: `unsafe_code = "forbid"` at the workspace level, inherited by all 14 crates; zero `unsafe` blocks/functions/impls/externs in first-party code. The clippy denials (`unwrap_used`, `expect_used`, `panic`, `todo`, `dbg_macro`) are scoped to non-test code via `clippy.toml` switches — the README's claim reads absolute, but the exemption is documented in-tree, so this is precision, not drift.

**Dependency posture:** thin and exact-pinned — asupersync `=0.3.5` (the single allowed drift: `asupersync-macros` is held at 0.3.5 while upstream drifted to 0.1.10 per CHANGELOG), fsqlite family held uniform at 0.1.16 (20 members, one version), jsonwebtoken 10.4.0 (pure-Rust RS256, no OpenSSL), rustls via asupersync's `tls` feature, blake3 (with `pure` fallback for Windows ARM). 589 packages in the lock; zero forbidden crates in any lane [Verified, High]. **Asupersync: native and load-bearing** — runtime, HTTP/TLS, cancellation, budgets, deterministic lab tests — not evaluated-and-rejected (contrast FrankenRedis). An in-progress bead (`fsnow-agent-ergonomic-cli-ufb`: "Migrate the native runtime and optional integration graph to Asupersync 0.5") tracks the version risk openly: upstream pinning is a known liability, not a hidden one [Verified, High].

**README-vs-code drift (governance signal):** the test figure (420 vs 576 counted), the feature-lane count (18 vs 21 in the same document), the CHANGELOG scope header ("through HEAD 096d726 (2026-08-19)") while content covers 2026-09-11, the v0.0.4 date (09-11 vs API 09-12), and the headliner — `.github/workflows/ci.yml` present at HEAD (executing by 2026-09-13 per the Actions API, 140 runs, latest red) against an explicit AGENTS.md prohibition that had already been enforced once (workflow deleted at v0.0.3 after 52 failed parse runs). Each instance is minor; the pattern — docs lagging a ~10-commit/day tree — is the signal the Rulebook asks for [Verified, High].

## 4.5 Benchmark and conformance audit

### Maintainer-produced numbers

| Number | What it actually is | Would it survive an independent rerun? |
|---|---|---|
| 350 MB/s jsonv2 zero-copy decode | **Not a benchmark** — a self-gated `assert!` in `tests/zero_copy_parity.rs`: best-of-3 `Instant` timings on a synthetic in-memory payload, release target 350 / debug target 20, no A/A null, no core pinning, no comparison target | No — it is a regression tripwire, and a fragile one: the CHANGELOG admits the debug target was lowered for "CPU scheduling contention on shared remote workers." The parity test asserts *correctness* against the serde parser and the timing asserts a *threshold* — the repo never measures the SWAR decoder's actual margin over the plain serde baseline, so even the "zero-copy is faster" thesis is unmeasured, not just un-benchmarked. Do not quote 350 MB/s as a result. |
| 420 passed, 0 failed across 32 targets | The v0.0.2 `cargo test --workspace` gate (2026-08-24) | Stale — 576 `#[test]` annotations at HEAD; no updated figure published |
| Parquet v2.0 writer "conformance verified via cross-engine round-trips against external PyArrow 25.0.5 and DuckDB 1.5.5" | Maintainer-run round-trip check [Maintainer claim, Medium] | Plausible to reproduce given the pinned external versions, but the harness and its pass/fail record are not in the packet's evidence; treat as provisional |
| "100% test pass rate across all 14 crates" | `UPGRADE_LOG.md` (2026-09-11) [Maintainer claim, Medium] | Maintainer-run; not independently observed |

**There is no published benchmark against any competitor or baseline.** No criterion benches, no `[[bench]]` targets, no throughput/latency comparison vs official drivers or `snowflake-connector-rs`. The repo makes no performance claims beyond the decoder tripwire — which is honest restraint, and the packet must not invent a performance story the maintainer didn't tell.

**Reproduction cost (honest):** 6 MB checkout; builds on pinned `nightly-2026-08-31`; the no-credential test suite runs anywhere. Reproducing the *live* numbers requires a Snowflake account (trial works), the `live` feature build, and the opt-in battery (`scripts/live-proof.sh`); expect tens of minutes plus account setup. Reproducing the 350 MB/s tripwire requires only `cargo test -p franken-snowflake-frame --release` — minutes — but it measures the maintainer's synthetic payload, not a workload.

### Conformance evidence

- **jsonv2 wire codec:** a 15-type canonical fixture (`jsonv2_codec_cells.json`) plus bitwise-parity tests of the SWAR decoder against the serde-based parser [Verified in tree, High; behavioral results Maintainer claim, Medium]. The *empirical* live golden is still an open bead (claim 16).
- **Protocol state machine:** `ResponseClass` keeps 200/202/408/422/429 distinct (poll vs retry vs terminal) with unit tests "proving the states are never conflated" per a 2026-06-24 commit message [Maintainer claim, Medium].
- **Mock-server lane:** the testkit's mock SQL API server exercises submit/poll/partition/cancel/retry/redaction without credentials [Verified structure, High].
- **DPOR race suite:** `testkit/src/race.rs` covers cancel/retry interleavings under the lab runtime, including an in-flight-cancel case added 2026-09-02 [Verified in code, High].
- **Live lanes:** opt-in, typed-skip without credentials; the credentialed battery is designed but its closing run is pending (see claim 1).

### Third-party-executed evidence (a rung below independent validation)

One rung exists between "the maintainer ran it" and "a third party validated it": the maintainer-authored `ci` workflow executed on GitHub-hosted runners. Latest run #140 (2026-09-13, 4 jobs): "Workspace tests (default features)" **passed** on ubuntu-latest and windows-latest; "Assert dependency admissibility" **passed** on all three OS jobs — the no-Tokio gate, executed green outside the maintainer's machines; "Feature lane - cli live,mcp" **failed** on ubuntu and windows (remaining lanes skipped on fail-fast); macos-latest **failed** at "Assert installer shell UI safety." No run exists for the HEAD commit (2026-09-22). Read plainly: the default test suite has third-party-executed evidence of passing 9 days ago; the flagship `live,mcp` combination has third-party-executed evidence of *failing*; the current tree has no CI evidence at all [Verified via Actions REST API, High].

### Independent numbers

**None found.** Web search returns only the repository itself, its docs/commit pages, and the crates.io record [External, High within recall caveats]. No third-party benchmark, code review, or production deployment found. **Independent validation: zero.**

## 4.6 Comparison: who owns the lane

**The incumbent** is Snowflake itself: official drivers for Go, JDBC, .NET, Node.js, ODBC, PHP, and Python — but **not Rust**, which is the gap this project exists in [External, High]. The community filled it with **`estie-inc/snowflake-connector-rs`** (43 stars, 27 forks, plain MIT, Tokio-based *library*, last push 2026-07-19) [External, High] — the closest direct competitor, and the honest comparison: it is a driver for humans writing Rust services; franken_snowflake is a CLI/MCP surface for agents. **Why the incumbent wins today, in one paragraph:** trust and ecosystem — Snowflake's official drivers have years of production hardening, client matrices, and support contracts; the community Rust crate has 7x the stars and a plain-MIT license any enterprise can sign. franken_snowflake has 6 stars, a license that bars the two AI labs from even benchmarking it, a nightly-only toolchain, and a live-proof bead that is still open. Nobody migrates warehouse access to a 0.0.4 single-maintainer connector on a README badge.

**Adjacent lanes:** ODBC/JDBC bridges (the incumbent's escape hatch for Rust), `dbt`-style ELT tooling, and the broader "agent + data warehouse" surface (MCP servers for databases, text-to-SQL layers) — none of which offer the deterministic-envelope + write-ladder + receipt package.

**The genuinely unoccupied lane [Inference, Medium]:** an *explicit-arming, write-safe* Snowflake connector — deterministic JSON contracts, self-describing capabilities, MCP tools sharing the CLI handlers, nothing mutating until the profile opts in (`WRITE_ENABLED`), a re-armable dry-run/confirm ceremony (`WRITE_REQUIRE_CONFIRM`), DDL behind its own opt-in, and content-addressed execution receipts. `snowflake-connector-rs` doesn't do the agent contract; official drivers don't do the write ladder or the dependency diet; nobody does the compile-time secret-leak gate. It is a narrow lane — but it is empty, and the emptiness is verifiable, not asserted.

## 4.7 Technical merit and adversarial review

**Strengths:**
1. **Machine-checked dependency hygiene, not promised hygiene.** The no-Tokio policy is proven by the lock file (zero forbidden crates in 589 packages, dev included) and enforced by a cargo-tree gate across ~21 feature lanes — the strongest "dependency diet" evidence found in any of the 44 assessed repos [Verified, High].
2. **The agent-safety layer is a coherent system, not a feature list — and its real protection is explicit arming, not always-on ceremony.** Deterministic versioned envelopes with `data_source` provenance, a capability registry with per-command JSON Schemas, the write ladder (nothing mutates until the profile sets `WRITE_ENABLED`; a bare `query write` then executes directly; the dry-run/confirm ceremony is re-armable via `WRITE_REQUIRE_CONFIRM`; DDL stays behind `WRITE_ALLOW_DDL`), typed refusals with exact repair commands, and BLAKE3 receipts with an append-only audit trail — each piece verified in code [Verified, High]. Be precise about what this buys: it makes *unintended* mutation structurally difficult (no silent writes from a default profile), not *intended* mutation slow — an agent with `WRITE_ENABLED` set runs writes directly. The honesty about frictionless-by-default semantics, stated in the CLI's own help text, is itself evidence for the design culture [Verified in code, High].
3. **The proof-lane discipline is exportable.** Mock SQL API server + deterministic codec lane under the lab runtime + DPOR race suite + golden/clock/canary harness + the typed-skip contract (a credential-less live run emits a structured skip event, never a silent pass) — this is methodology that would survive the product [Verified structure, High].
4. **Release engineering is unusually disciplined for a 6-star repo.** Pinned dependency families held uniform, glibc-floor-pinned multi-arch binaries, checksums + manifest published, crates.io publication with topological ordering, clippy `-D warnings` gates across all feature lanes [Verified: assets, checksums, registry record — High]; the pre-upload `file(1)`/`objdump` verification ritual is a maintainer claim [Medium].
5. **The cancellation story is genuinely careful.** Statements as asupersync `bracket`s; a 2026-09-02 fix closed the orphan-statement gap on every error path after a handle exists (best-effort masked remote cancel); budget cancellations fire the remote cancel endpoint — cancel-correctness is the kind of thing most connectors get wrong silently [Verified in code + commit record, High].

**Weaknesses:**
1. **The live-success badge is ahead of the repo's own proof.** The end-to-end live-account proof bead is `in_progress` and the empirical wire-golden bead is `open` at HEAD; the June trial expired; no in-repo live artifact exists. A badge is not evidence, and the repo's own tracker says the evidence isn't closed [Verified, High].
2. **The flagship `live,mcp` feature lane is red in the project's own CI.** Run #140 (2026-09-13): the `cli live,mcp` lane failed on ubuntu-latest and windows-latest while default-feature tests passed on both — and no CI run has covered the 9 days of commits since, including HEAD. A buyer evaluating "agent-ergonomic Snowflake" would run exactly this combination [Verified via Actions REST API, High].
3. **Bus factor 1, by explicit policy.** The README's "About Contributions" refuses outside contributions ("I do not accept outside contributions for any of my projects... it's my name on the thing"). Combined with 2 forks and a nightly-pinned 62k-line tree, succession is not a plan — it is a hope [Verified, High].
4. **The custom HTTP/TLS stack is the largest structural risk.** TLS and HTTP correctness on a bespoke asupersync transport get far less adversarial review than hyper/reqwest/rustls; the "one audited foundation" justification has never been tested against the mainstream stack in any published comparison, and the only throughput number in the repo is a self-gated tripwire [Inference, High].
5. **The bespoke TLS stack has no adversarial review surface in-tree.** The DPOR race suite covers cancel/retry interleavings under the lab runtime, but no test the packet could find exercises TLS edge cases (session resumption, cert rotation, SNI, ALPN negotiation) against the asupersync transport — the exact failure class where bespoke stacks diverge from hyper/reqwest/rustls, and where the project's "one audited foundation" justification is thinnest [Inference, High].
6. **Zero independent validation of any kind.** No third-party benchmark, review, deployment, or contributor. All 576 tests, all release gates, and all live claims are maintainer-produced. The nearest rung is maintainer-authored CI executed on GitHub runners (default-feature tests green 2026-09-13) — independent execution, not independent validation [Verified/External, High].
7. **The license is a strategic own-goal for the stated mission.** The rider withholds *all* rights — including benchmarking, testing, and analyzing — from OpenAI, Anthropic, affiliates, and anyone acting for them. For a project whose entire reason to exist is *coding-agent infrastructure*, legally excluding the frontier labs (and chilling any independent benchmark, since benchmarking is a withheld right) sabotages exactly the adoption and validation paths the technology needs [Verified, High].
8. **Docs chronically lag the tree.** 420 vs 576 tests, 18 vs 21 feature lanes, the stale CHANGELOG scope header, the v0.0.4 date drift, and the `.github/workflows` resurrection against an explicit prohibition — each minor, but the pattern is the governance signal [Verified, High].

**Steelman of the bear case:** franken_snowflake is a monumentally careful answer to a question almost nobody asked. The Rust-Snowflake gap is real but tiny — the community crate with 43 stars and a plain MIT license already fills it for humans, and agents can already shell out to the Python connector. The cheaper terminal state doesn't even need Snowflake's involvement: `estie-inc/snowflake-connector-rs` is one thin agent-friendly CLI/MCP wrapper away from occupying the "agent ergonomics" half of the lane, with 7x the stars and a license an enterprise can sign. The Tokio-free stance is an ideological differentiator with unpriced costs: a bespoke TLS stack nobody else reviews (and which faces no TLS-edge-case testing in-tree), a nightly toolchain, and a 62k-line tree only one human understands. The agent-ergonomics layer is thoughtful but unvalidated — no agent team has adopted it, the live proof is unfinished, and the license legally bars the labs building the agent infrastructure it targets. The realistic terminal state is a well-engineered personal tool whose methodology (dependency admissibility, typed-skip proof lanes, compile-time leak gating) outlives its product — which, to be fair, may be the point.

**Hook audit (the packet grades its own hook):** "A 62,062-line, Tokio-free, clean-room Snowflake SQL API connector for coding agents — whose own issue tracker says the end-to-end live proof is still open, while its README badge already claims live success." Line count verified by fresh grep; Tokio-free verified by lock-file grep (stronger than the README's claim); "clean-room" is a maintainer claim and is presented as the project's self-description, not as a verified fact; the bead status (`in_progress`) and the badge text are both verified. The hook survives — it makes exactly one claim the packet then proves with the repo's own tracker.

## 4.8 License and governance (material, not boilerplate)

**License text, read verbatim** [Verified, High]: `LICENSE` is the MIT License **with an "ADDITIONAL RIDER / RESTRICTION (OpenAI / Anthropic)"** that is "part of the 'conditions' of this License" and "controls" in any conflict. Quoted scope: *"Restricted Parties" means OpenAI, L.L.C.; Anthropic, PBC; any of their respective Affiliates; and any person or entity acting directly or indirectly on behalf of, for the benefit of, or under the direction of any of the foregoing (including any officer, director, employee, contractor, agent, consultant, service provider, or representative).* *"Notwithstanding any other provision of this License, no rights are granted to any Restricted Party."* Disclosure/hosting/distribution to them is forbidden. *"use" includes, without limitation: copying, modifying, merging, publishing, distributing, sublicensing, selling, transferring, making available, hosting, deploying, executing, benchmarking, testing, analyzing, indexing, or incorporating the Software or any Derivative Works into any dataset, training corpus, evaluation harness, or pipeline for machine learning or other automated systems.* Breach terminates all permissions automatically; injunctive relief and attorneys' fees reserved to Jeffrey Emanuel (copyright holder, 2026). **Classification: NOT OSI open source** — named-party discrimination plus a use restriction covering even benchmarking and analysis. This is source-available with a targeted exclusion. Unlike the FrankenRedis packet's finding, the disclosure here is upfront: the README badge reads "MIT + OpenAI/Anthropic rider" and the License section names it — no plain-"MIT" misrepresentation was found.

**Independent corroboration:** crates.io lists the published `franken-snowflake-sqlapi` 0.0.4 crate's license as **"non-standard"** — the registry's own flag confirming the rider takes it outside the SPDX-recognized set [External, High].

**The rider as strategy:** defensively coherent (it prevents the two labs best positioned to absorb the work from doing so without permission); offensively self-sabotaging for this project in particular. The mission is *coding-agent infrastructure*; the excluded parties *are* the coding-agent infrastructure builders. Worse, the rider withholds *benchmarking and analysis* rights, which chills the independent validation the project most needs — no third party can publish a benchmark without lawyering the rider first, which helps explain why independent validation is zero [Inference, Medium]. Adoption ceiling: hard — enterprises, acquirers, lab-adjacent users, and benchmark publishers must treat it as proprietary-with-permission.

**Governance:** owner-directed single maintainer; outside contributions explicitly refused by policy; 128 Beads issues at HEAD (125 closed, 2 in_progress, 1 open) as the planning surface; commit velocity ~10/day since v0.0.4 (99 commits in 10 days per the release page) [Verified, High]. One signal cuts the other way: bead `fsnow-agent-ergonomic-cli-gap-docs-truth-79s` (closed) records the maintainer *reopening the falsely-closed jsonv2 golden bead* — the tracker corrects its own proof accounting, which is exactly the behavior the live-proof dispute needs more of [Verified, High]. The `.github/workflows/ci.yml` resurrection against the enforced AGENTS.md prohibition is both a process signal and a practical one — and the Actions API deepens it: the workflow executed 140 runs starting by 2026-09-13 while the prohibition stayed verbatim in AGENTS.md, so this is a sustained contradiction, not a one-off accident. The latest run (#140, 2026-09-13) is red: the `cli live,mcp` feature lane failed on ubuntu and windows (after default-feature workspace tests passed on both), macos failed on the installer shell UI safety assertion — a shell-script gate, not Rust code — and no run covers the HEAD commit [Verified via Actions REST API, High]. **What breaks first if velocity decays:** the 62k-line tree on a pinned nightly with no second maintainer and no contributor on-ramp — bit-rot within quarters, starting with the asupersync 0.5 migration bead that is already open.

## 4.9 NODUS factsheet

| Criterion | Score | One-line justification |
|---|---|---|
| Technology readiness (TRL 1–9) | **6** | Working system with 4 releases, real multi-arch binaries, crates.io presence, and maintainer-observed live operation. **The rule applied:** TRL grades the artifact's *demonstrated state*, and the maintainer's v0.0.3 release-note assertion of live reads/writes counts as demonstration in a relevant environment (a live Snowflake account) — but the *independent-proof* gap (the e2e bead is open, no third party has run it) is what caps this at 6 and denies 7. If the live assertion were retracted or failed, this would be a 5. |
| Strategic relevance (1–5) | **3** | Agent-native warehouse access is a real strategic gap; capped by the rider, pre-1.0 state, and single-vendor scope |
| Impact potential (1–5) | **3** | Real unserved niche (Rust + agents + Snowflake + write-safety), but bounded by ~zero adoption, the rider, and official-driver dominance everywhere else |
| Implementation feasibility (1–5) | **4** | Already implemented and shipping; what remains (live-proof closure, asupersync 0.5 migration, empirical goldens) is bounded and tracked in beads |
| Time to mainstream (1–5) | **2** | No plausible mainstream path without independent validation, a license an enterprise can sign, and a stable toolchain; the niche path is shorter |
| Collaboration potential (1–5) | **1–2** | Source-available; contributions explicitly refused by policy; rider blocks the two most likely AI-lab collaborators; bus factor 1 by design — **1** as scored, with the methodology (not the code) as the collaboration surface |

**Ring: Explore** — and it is a genuine near-miss on Pilot, so the reasoning is stated in full. *Pilot* requires "a release artifact plus a bounded, real workload fit." The release artifacts exist (four releases, 16 checksummed binaries, crates.io). The bounded workload exists on paper (an agent team with a Snowflake account running governed reads/writes from Rust). What is missing is any *demonstration* of that fit by anyone: the maintainer's own live-proof bead is open, the June trial expired, no external user or deployment is known, the flagship `live,mcp` lane is red in the project's own CI with no run on HEAD, and the license bars the labs most likely to pilot it. Per the ring rules — "when in doubt, ring down, not up" — Explore is the correct assignment. The distance to Pilot is short and concrete, which is why the revisit triggers matter.

## 4.10 Wardley placement

- **Snowflake SQL connectivity (submit/poll/partition/cancel over HTTPS):** Commodity — the protocol is documented and Snowflake plus the community crate own the trust.
- **Tokio-free Rust connector assembly (asupersync transport, 14 crates):** Custom-built — works in the maintainer's lab, pre-1.0, validated against mocks but not by third parties; moves toward Product with a closed live-proof bead + independent validation.
- **Agent contract layer (deterministic envelopes, capability registry, write ladder, BLAKE3 receipts):** Genesis → early Custom-built — individual pieces (typed errors, JSON envelopes) are commonplace in MCP database surfaces, but the *packaged combination* — deterministic versioned envelopes with `data_source` provenance, a self-describing capability registry, explicit-arming write ladder with deterministic confirmation tokens, and content-addressed execution receipts — has no equivalent the packet could find in any incumbent connector or MCP database server [Inference, Medium]; moves right if an agent team adopts it as their warehouse interface, left into obscurity if the rider keeps labs away.
- **Proof machinery (dependency-admissibility gate, typed-skip live lanes, compile-time leak gate, DPOR race suite):** Custom-built — novel as a packaged discipline and the most transferable component; moves toward Product the moment a second project adopts any piece of it (see next steps 3 and 5).

**The decoupling lens:** franken_snowflake represents *runtime-from-ecosystem* (the Tokio-free stance: the async runtime is a choice, not an inheritance), advances *contract-from-transport* (the agent envelope/write-ladder/receipt layer is separable from the SQL API wire code), and gestures at the next decoupling the deep-dive named — *memory-from-the-store*: BLAKE3 content-addressed receipts plus an append-only audit log are a proto-mechanism for portable, provenance-attested records of what an agent did to a warehouse, with the warehouse becoming an interchangeable executor. That third decoupling is the project's only credible claim to a future the incumbents aren't occupying.

## 4.11 Trajectory (12 / 24 / 60 months) — [Inference]

- **12 months:** continued high-velocity single-maintainer work; the asupersync 0.5 migration bead closes or the pin becomes a liability; the empirical jsonv2 golden either lands (closing the loop on the SWAR decoder) or the "live golden" stays open; the `cli live,mcp` lane either goes green in CI or the flagship combination stays red; a credentialed live-proof run either closes the e2e bead (Pilot becomes arguable) or stays pending (the badge keeps its asterisk). Stays in Explore.
- **24 months:** bifurcation. **Upside:** the live-proof bead closes with published artifacts, one external agent team adopts the connector for governed warehouse access, and the admissibility-gate method is adopted by a second project — Pilot for the narrow "agent + Snowflake + Rust" workload, with the methodology as the durable export. **Decay:** velocity slows with no successor (contributions refused by policy); the pinned nightly ages; the bespoke TLS stack accumulates unreviewed risk; drifts to Monitor as a research artifact whose proof machinery outlives its connector.
- **60 months:** binary. Either a niche-but-real artifact (the write-safe, receipt-bearing agent/warehouse interface — the lane nobody else is building), or superseded: Snowflake ships an official Rust offering or an MCP-native warehouse surface, the community crate adds the agent ergonomics, and the transport half of this project's value compresses to zero. The verification methodology is the more likely survivor either way.

**Revisit triggers (concrete, observable):** the `cli-live-e2e-and-receipts` bead closes with published credentialed-run artifacts; the empirical jsonv2 live golden lands; any independent benchmark, code review, or production deployment; a second human maintainer or a change to the no-contributions policy; any change to the license rider; the asupersync 0.5 migration completing or stalling.

## 4.12 Limitations and open questions (mandatory)

**Not done:** did not compile the workspace, run any test, execute the binary, contact Snowflake, or reproduce any benchmark — all behavioral and performance claims rest on maintainer evidence plus revision-bound documentation. Shallow clone only (no history beyond HEAD). The admissibility gate script was read but not executed (no cargo toolchain run); the lock-file grep is the independent check. CI status was checked via the Actions REST API: 140 runs, latest (#140, 2026-09-13) red — the `cli live,mcp` lane failed on ubuntu/windows, macos failed on the installer shell UI safety assertion; default-feature workspace tests passed on ubuntu/windows and the dependency-admissibility gate passed on all three OSes; no run covers the HEAD commit. Star/fork/download counts are a 2026-09-22 snapshot. The crates.io HTML page fetch failed once; the API record for the same crate was verified instead. Web search for independent coverage carries the usual recall caveats.

**Open questions that would most change the verdict:** whether the `cli live,mcp` feature lane — the flagship combination the mission statement sells — currently passes (it failed in the project's own CI on 2026-09-13 and no run has covered the tree since); the credentialed live-proof battery's actual pass/fail record; whether the June UA70404 trial run left any reviewable evidence; upstream-Tcl-style conformance numbers (none exist — the SQL API has no such suite); whether any enterprise has evaluated the rider's legal exposure; the maintainer's succession intentions given the no-contributions policy; whether the asupersync 0.5 migration completes; what happens to the tree when the nightly pin ages out; what the AGENTS.md "never uses GitHub Actions" prohibition is for if the tree has ignored it for 140 runs — and whether the policy doc will be updated to match reality.

## The eight deepening questions (one paragraph each)

1. **Provenance.** franken_snowflake records more provenance than most connectors: every live execution writes a BLAKE3 content-addressed receipt plus per-partition evidence and an append-only audit event to a local store, and every envelope carries a `data_source` field distinguishing `live` from offline/fixture sources — with a stated rule that the live path "never substitutes fixture or empty data" [Verified in code/docs, High]. What it does *not* record is *who or what* produced the artifact beyond the profile handle: receipts are content-addressed but not hash-chained and not signed, so a hostile operator with disk access could rewrite history undetectably. Making attestation portable would require chaining each receipt to its predecessor and signing the chain head with the profile's key-pair — the exact direction of next step 1 — plus binding the agent identity (not just the profile name) at write time, per the necessity result in arXiv 2606.24322 [Inference, Medium].

2. **The embeddable unit.** The smallest useful adoptable piece is `franken-snowflake-sqlapi` (protocol schemas, wire codec, statement lifecycle) plus `franken-snowflake-auth` (the four auth lanes) — and the maintainer has already made the move: `franken-snowflake-sqlapi` 0.0.4 is published on crates.io (36 downloads) with the workspace's internal path dependencies converted to version requirements for registry distribution [Verified, High]. The adoption cost is real but bounded: nightly toolchain (edition 2024), the asupersync `=0.3.5` pin inherited transitively, and the license rider follows every derivative — so embedding means accepting a nightly-only, rider-encumbered dependency for the sake of a Tokio-free graph [Verified, High].

3. **Unexercised option value.** The architecture holds at least four unused capabilities: the mock SQL API server + deterministic codec lane is a general SQL API conformance harness currently aimed only at itself; the typed-skip live-proof contract (`FRANKEN_SNOWFLAKE_LIVE=1` opt-in, structured skip events, spawned-process env sanitization) is a general pattern for credential-gated CI that no second project uses; the dependency-admissibility gate is a general "dependency diet" CI method with one customer; and the BLAKE3 receipt + audit log is one hash-chain away from a tamper-evident agent-action ledger [Verified structure, High]. What unlocks them is, respectively, publishing the harness as a standalone crate, extracting the skip contract into the testkit's public API, decoupling the gate script from franken_snowflake's policy table, and chaining the receipts — all product decisions, none blocked on research [Inference, Medium].

4. **Benchmark honesty.** The numbers most likely to survive an independent rerun are the *structural* ones — 62,062 lines, 14 crates, 576 `#[test]` annotations, zero forbidden crates in 589 lock packages, 16 release assets — because they are counted, not measured [Inference, High]. The 350 MB/s decoder figure would *not* survive as a quoted result: it is a self-gated assertion on synthetic data with no A/A null, and its own CHANGELOG entry documents the debug target being lowered for shared-worker contention — the maintainer's honesty about the fragility is to their credit, but the number is a tripwire, not a benchmark [Verified, High]. No number in the repo is load-bearing for the thesis, because the thesis ("a write-safe, agent-ergonomic, Tokio-free connector") is architectural, not performance-based — which is the honest position, and the packet must not invent a performance story [Inference, Medium].

5. **The governance path.** The credible route from one maintainer to an institution runs through the one thing this project already has: shipped releases. A 0.1.0 or 1.0 release with the live-proof bead closed creates the first artifact an external user can adopt without the maintainer in the room — but the README's "About Contributions" explicitly refuses outside contributions, so the on-ramp is currently *use without contribution*, which selects for users, not maintainers [Inference, Medium]. What breaks first if velocity decays is the dependency pin set: asupersync `=0.3.5` with an open 0.5-migration bead, a pinned nightly, and a bespoke TLS stack mean a slowdown without a successor doesn't stabilize the project — it strands 62,062 lines on aging pins with nobody who understands the whole statement lifecycle, and bit-rot sets in within quarters [Inference, High].

6. **The license as strategy.** The rider excludes exactly OpenAI, L.L.C., Anthropic, PBC, their affiliates, and anyone acting for, benefiting, or under the direction of them — and it defines "use" to include benchmarking, testing, analyzing, indexing, and training-data incorporation, with automatic termination and injunctive relief reserved to Jeffrey Emanuel [Verified verbatim, High]. As strategy it is coherent defensively (it prevents the two labs best positioned to absorb the work from doing so without permission) and self-sabotaging offensively *for this project specifically*: the mission is coding-agent infrastructure, the excluded parties are the coding-agent infrastructure builders, and the rider's breadth (even benchmarking is forbidden) chills the independent validation the project most needs — which helps explain why independent validation is zero and why crates.io flags the license "non-standard" [Inference, Medium].

7. **Agent-era fit.** The concrete workload that would pick franken_snowflake over the official Python driver or `snowflake-connector-rs` is a Rust-first coding agent (or agent fleet) that needs governed warehouse access: deterministic JSON envelopes it can parse, a capability registry it can discover, `did_you_mean` recovery it can act on, an explicit-arming write ladder that makes *unintended* mutation structurally difficult while keeping intended writes frictionless, and receipts it can audit — the whole package no incumbent offers [Inference, Medium]. What would have to become true first: the live-proof bead closes with published artifacts (an agent team needs the badge to be evidence, not aspiration), one external deployment exists to copy, the nightly toolchain story stabilizes, and — unavoidably — a license an agent-platform company can actually sign [Inference, Medium].

8. **The kill test.** The single event that would falsify the core thesis — "agents need a purpose-built, write-safe, Tokio-free Snowflake connector" — is Snowflake shipping an official Rust offering or an MCP-native warehouse surface with governed writes: a vendor-blessed agent interface would commoditize the connector half and shrink the project to its write-ladder/receipt ideas, which are portable patterns, not a product [Inference, Medium]. The experimental falsifications are nearly as decisive: a credentialed live-proof run that fails (statements orphaned, receipts not written, redaction leaking under the planted canaries), or a benchmark showing the asupersync transport materially worse than the mainstream stack on identical workloads — either would collapse the two pillars (trustworthy live operation, the Tokio-free bet) the thesis stands on [Inference, Medium].

---

**Working notes:** fresh shallow clone at `~/workspace/.scratch/franken-snowflake-verify/` (HEAD `e5f6312`, 2026-09-22 13:28:48 UTC). No durable user-facing files created besides this assessment. The v1 draft (`franken_snowflake-assessment.md` as of 2026-09-22 04:34) was used as a starting point only; every number, link, and claim above was re-verified at the new HEAD — several v1 figures were stale (README is 942 lines not 1425; test count moved 420 → 576; releases now include v0.0.3/v0.0.4; crates.io publication is real).