From cf8930b593048cec9f01a8ccce731532721d0a6d Mon Sep 17 00:00:00 2001
From: ZdenekSrotyr <zdenek.srotyr@keboola.com>
Date: Mon, 4 May 2026 14:37:52 +0200
Subject: [PATCH] =?UTF-8?q?chore(release):=20cut=200.32.0=20=E2=80=94=20#1?=
 =?UTF-8?q?60=20da=20query=20--remote=20on=20VIEW=20+=204=20reinforcing=20?=
 =?UTF-8?q?fixes?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

CHANGELOG: rename [Unreleased] → [0.32.0] — 2026-05-04, prepend a new
empty [Unreleased] for next-PR landing zone.
pyproject.toml: version 0.31.0 → 0.32.0.

Per repo discipline (memory: feedback_release_cut_with_pr.md), the
release-cut commit lands as the FINAL commit of the PR that contained
the user-visible behavior change — it does not get a separate PR.

After merge: tag v0.32.0 on the merge commit + create a GitHub Release
(memory: feedback_github_release_per_tag.md — the tag alone isn't
enough; the Release prose is the operator-visible artifact).

Headline: closes #160. da query --remote now resolves query_mode='remote'
BQ rows whose entity is VIEW or MATERIALIZED_VIEW (the bug Pavel hit).
Plus 4 reinforcing fixes — server-side cost guardrail (bq_max_scan_bytes,
default 5 GiB), registry-gating of direct bq.* paths, bigquery_query()
function-call backdoor closed, structured CLI render of typed BQ errors —
and one operator-side admin convenience (BQ test-connection endpoint +
billing_project placeholder UI).

14 issues caught and addressed across 6 iterations of Devin Review.
E2E verified on agnes-zsrotyr.groupondev.com (commit 7f743d03):
  - VIEW path resolves (count=23 from active_inventory_view)
  - VIEW aggregate parity vs filtered BASE TABLE
  - cost guardrail rejects with structured 400 detail
  - bq_path_not_registered 403 (incl. quoted "bq" variant)
  - bigquery_query() blocklist 400
  - test-connection endpoint 200 with elapsed_ms
---
 CHANGELOG.md   | 11 +++++++++++
 pyproject.toml |  2 +-
 2 files changed, 12 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6270ef3..b492d44 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -10,6 +10,17 @@ CalVer image tags (`stable-YYYY.MM.N`, `dev-YYYY.MM.N`) are produced for every C
 
 ## [Unreleased]
 
+## [0.32.0] — 2026-05-04
+
+Closes #160. Headline fix: `da query --remote` now resolves
+`query_mode='remote'` BigQuery rows whose underlying entity is a `VIEW`
+or `MATERIALIZED_VIEW`. Plus four reinforcing fixes that surfaced during
+the work — server-side cost guardrail, registry-gating of direct `bq.*`
+paths, function-call backdoor closed, structured CLI error rendering —
+and one operator-side admin convenience (BQ test-connection endpoint +
+billing_project placeholder UI). 14 issues caught + fixed across 6
+iterations of Devin Review.
+
 ### Added
 - **`/admin/server-config` BQ test connection**: admin-only `POST
   /api/admin/bigquery/test-connection` runs a 10s-timeout `SELECT 1`
diff --git a/pyproject.toml b/pyproject.toml
index 4bfc365..9988dc4 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -1,6 +1,6 @@
 [project]
 name = "agnes-the-ai-analyst"
-version = "0.31.0"
+version = "0.32.0"
 description = "Agnes — AI Data Analyst platform for AI analytical systems"
 requires-python = ">=3.11,<3.14"
 license = "MIT"