diff --git a/Makefile b/Makefile
index 27c3223..d03291f 100644
--- a/Makefile
+++ b/Makefile
@@ -1,4 +1,4 @@
-.PHONY: all build release run test clean fmt help install
+.PHONY: all build release run test clean fmt help install sdk_test
 
 # Project configuration
 PROJECT_NAME := jormundb
@@ -16,6 +16,8 @@ CXX := g++
 AR  := ar
 CXXFLAGS := -O2 -fPIC -std=c++20 $(INCLUDE_PATH)
 
+# name of the docker compose file for the python tests
+SDK_TEST_COMPOSE := docker-compose-python-sdk-test.yaml
 
 # RocksDB and compression libraries
 ROCKSDB_LIBS := -lrocksdb -lstdc++ -lsnappy -llz4 -lzstd -lz -lbz2
@@ -174,6 +176,13 @@ aws-test: run &
 		--table-name TestTable
 	@echo "\n$(GREEN)✓ AWS CLI test complete$(NC)"
 
+# Python SDK integration tests (requires JormunDB running on localhost)
+sdk_test:
+	@echo "$(BLUE)Running Python SDK tests against localhost:$(PORT)...$(NC)"
+	@docker compose -f $(SDK_TEST_COMPOSE) down --remove-orphans 2>/dev/null || true
+	@JORMUN_PORT=$(PORT) docker compose -f $(SDK_TEST_COMPOSE) run --rm --build sdk-test
+	@docker compose -f $(SDK_TEST_COMPOSE) down --remove-orphans 2>/dev/null || true
+
 # Development workflow
 dev: clean build run
 
@@ -199,6 +208,7 @@ help:
 	@echo "$(GREEN)Test Commands:$(NC)"
 	@echo "  make test           - Run unit tests"
 	@echo "  make aws-test       - Test with AWS CLI commands"
+	@echo "  make sdk_test       - Run Python SDK integration tests (requires running server)"
 	@echo ""
 	@echo "$(GREEN)Utility Commands:$(NC)"
 	@echo "  make fmt            - Format source code"
diff --git a/TODO.md b/TODO.md
index df63de1..5ddb6ee 100644
--- a/TODO.md
+++ b/TODO.md
@@ -60,9 +60,10 @@ Goal: "aws cli works reliably for CreateTable/ListTables/PutItem/GetItem/DeleteI
   - TLV decode failure cases (corrupt bytes)
 
 ### 7) Secondary indexes
-- [ ] Global Secondary Indexes (GSI)
+- [x] Global Secondary Indexes (GSI)
 - [ ] Local Secondary Indexes (LSI)
-- [ ] Index backfill + write-path maintenance
+- [ ] Index backfill (existing data when GSI added to populated table)
+- [x] Write-path maintenance (GSI)
 
 ### 8) Performance / ops
 - [ ] Connection reuse / keep-alive tuning
diff --git a/docker-compose-python-sdk-test.yaml b/docker-compose-python-sdk-test.yaml
new file mode 100644
index 0000000..3feeb4e
--- /dev/null
+++ b/docker-compose-python-sdk-test.yaml
@@ -0,0 +1,14 @@
+services:
+  sdk-test:
+    image: python:3.12-slim
+    network_mode: host
+    working_dir: /tests
+    volumes:
+      - ./tests/sdk:/tests
+    environment:
+      - JORMUN_ENDPOINT=http://localhost:${JORMUN_PORT:-8002}
+      - AWS_ACCESS_KEY_ID=local
+      - AWS_SECRET_ACCESS_KEY=local
+      - AWS_DEFAULT_REGION=us-east-1
+    command: >
+      sh -c "pip install --quiet boto3 && python test_sdk.py"
diff --git a/dynamodb/condition.odin b/dynamodb/condition.odin
index 82bafeb..06a8b36 100644
--- a/dynamodb/condition.odin
+++ b/dynamodb/condition.odin
@@ -96,7 +96,6 @@ evaluate_condition_expression :: proc(
 	}
 	defer {
 		filter_node_destroy(filter_node)
-		free(filter_node)
 	}
 
 	// If there is no existing item, build an empty item for evaluation.
diff --git a/dynamodb/filter.odin b/dynamodb/filter.odin
index 963d6a9..5b1bfaf 100644
--- a/dynamodb/filter.odin
+++ b/dynamodb/filter.odin
@@ -160,15 +160,12 @@ filter_node_destroy :: proc(node: ^Filter_Node) {
 
 	if node.left != nil {
 		filter_node_destroy(node.left)
-		free(node.left)
 	}
 	if node.right != nil {
 		filter_node_destroy(node.right)
-		free(node.right)
 	}
 	if node.child != nil {
 		filter_node_destroy(node.child)
-		free(node.child)
 	}
 }
 
@@ -208,7 +205,6 @@ parse_or_expr :: proc(
 			right, right_ok := parse_and_expr(t, names, values)
 			if !right_ok {
 				filter_node_destroy(left)
-				free(left)
 				return nil, false
 			}
 
@@ -248,7 +244,6 @@ parse_and_expr :: proc(
 			right, right_ok := parse_not_expr(t, names, values)
 			if !right_ok {
 				filter_node_destroy(left)
-				free(left)
 				return nil, false
 			}
 
@@ -312,7 +307,6 @@ parse_primary_expr :: proc(
 		rparen, rp_ok := next_token(t)
 		if !rp_ok || rparen != ")" {
 			filter_node_destroy(inner)
-			free(inner)
 			return nil, false
 		}
 		return inner, true
diff --git a/dynamodb/transact.odin b/dynamodb/transact.odin
index 0c145d7..5a592ee 100644
--- a/dynamodb/transact.odin
+++ b/dynamodb/transact.odin
@@ -244,7 +244,6 @@ transact_write_items :: proc(
 			}
 			defer {
 				filter_node_destroy(filter_node)
-				free(filter_node)
 			}
 
 			eval_item: Item
diff --git a/main.odin b/main.odin
index ef81a34..ef9af77 100644
--- a/main.odin
+++ b/main.odin
@@ -1427,7 +1427,6 @@ apply_filter_to_items :: proc(
 	}
 	defer {
 		dynamodb.filter_node_destroy(filter_node)
-		free(filter_node)
 	}
 
 	// Filter items