Skip to content

sbx-mgr: route every SQLite statement through db/ and fence the rest with cargo arch #561

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ac-pplx merged 1 commit into from
Oct 19, 2026
Merged

sbx-mgr: route every SQLite statement through db/ and fence the rest with cargo arch #561

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
84 changes: 84 additions & 0 deletions ARCHITECTURE.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -244,6 +244,90 @@ mode = "required"
[rules.pattern_ratchet.node_manager_commands.stale_entries]
mode = "required"

# sbx-mgr's node-local SQLite database (`sandboxes` and every other sbx-mgr
# table) is opened, migrated and queried only by its store, `src/db` of the
# server crate. Within sbx-mgr's crates, naming rusqlite, opening a
# connection or transaction, using the shared SQLite open and migration
# helpers or the shared job store's SQL functions, binding parameters,
# executing a statement, or writing an SQL statement literal outside the
# store is a crossing. Other services' crates use rusqlite for their own
# databases, so `paths` limits the rule to sbx-mgr's. Existing callers that
# still name the connection, error and transaction types are baselined
# until they use the store's own.
[rules.pattern_ratchet.sbxmgr_sqlite]
patterns = [
'\brusqlite\s*::',
'\buse\s+(?:::\s*)?rusqlite\b',
'\bextern\s+crate\s+rusqlite\b',
'\b(?:Connection|Transaction)\s*::\s*(?:open\w*|new\w*)\s*\(',
'\bsql\s*::\s*sqlite\b',
'\bpplx_space_common_jobs\s*::\s*(?:db\b|\{[^}]*\bdb\b)',
'\b(?:named_)?params\s*!',
'\.\s*(?:execute|execute_batch|prepare|prepare_cached|query_row|query_row_and_then|query_one|query_map|query_and_then|transaction|unchecked_transaction|transaction_with_behavior|savepoint|pragma_update|pragma_query|pragma_query_value)\s*\(',
'\.\s*(?:query|exists)\s*\(\s*[^)\s]',
'\bimmediate_transaction\s*\(',
'"\s*(?:SELECT\b|INSERT\s+(?:OR\s+[A-Z]+\s+)?INTO\b|REPLACE\s+INTO\b|UPDATE\s+(?:OR\s+[A-Z]+\s+)?\w+(?:\s+SET\b|\s*$)|DELETE\s+FROM\b|(?:CREATE|DROP|ALTER)\s+(?:TEMP\s+|TEMPORARY\s+|UNIQUE\s+)?(?:TABLE|INDEX|TRIGGER|VIEW)\b|PRAGMA\s+\w|WITH\s+(?:RECURSIVE\s+)?\w+\s+AS\b|(?:BEGIN|COMMIT|ROLLBACK|SAVEPOINT|RELEASE|VACUUM)\b[\w\s]*;?\s*")',
'^\s*(?:SELECT\s|INSERT\s+(?:OR\s+[A-Z]+\s+)?INTO\s|UPDATE\s+(?:OR\s+[A-Z]+\s+)?\w+(?:\s+SET\s|\s*$)|DELETE\s+FROM\s|WITH\s+(?:RECURSIVE\s+)?\w+\s+AS\b)',
]
paths = ["crates/libs/sbx/mgr/**", "crates/apps/sbx/**"]
allow = [
"crates/libs/sbx/mgr/server/src/db.rs",
"crates/libs/sbx/mgr/server/src/db/**",
]

[rules.pattern_ratchet.sbxmgr_sqlite.no_crossing]
mode = "required"

# Seeding the ratchet reports its initial entries against the base.
[rules.pattern_ratchet.sbxmgr_sqlite.no_new_entries]
mode = "advisory"

[rules.pattern_ratchet.sbxmgr_sqlite.no_raised_caps]
mode = "required"

[rules.pattern_ratchet.sbxmgr_sqlite.listed_no_growth]
mode = "required"

[rules.pattern_ratchet.sbxmgr_sqlite.stale_entries]
mode = "required"

# The same database's schema and location, in any crate: its migrations, its
# path and file name, and the migrator's default-path helper for it belong to
# the store, which opens and migrates it. The migrations crate defines the
# migrators and common-core the path. These names are
# specific enough to check workspace-wide, unlike `sbxmgr_sqlite`'s patterns,
# which other services' crates match for their own databases.
[rules.pattern_ratchet.sbxmgr_sqlite_schema]
patterns = [
'\bpplx_space_sbxmgr_migrations\b',
'\bSANDBOX_MANAGER_(?:DB|MIGRATOR)\b',
'\bsqlite_sandbox_manager\b',
'\bsbx-manager\.db\b',
'\bdb/sandbox-manager\b',
]
allow = [
"crates/libs/sbx/mgr/server/src/db.rs",
"crates/libs/sbx/mgr/server/src/db/**",
"crates/libs/sbx/mgr/migrations/src/**",
"crates/libs/common/core/src/host/linux.rs",
]

[rules.pattern_ratchet.sbxmgr_sqlite_schema.no_crossing]
mode = "required"

# Seeding the ratchet reports its initial entries against the base.
[rules.pattern_ratchet.sbxmgr_sqlite_schema.no_new_entries]
mode = "advisory"

[rules.pattern_ratchet.sbxmgr_sqlite_schema.no_raised_caps]
mode = "required"

[rules.pattern_ratchet.sbxmgr_sqlite_schema.listed_no_growth]
mode = "required"

[rules.pattern_ratchet.sbxmgr_sqlite_schema.stale_entries]
mode = "required"

[rules.crate_names]
# A crate matches if a part of its package or library name, lowercased and
# split on `-` and `_`, is one of these.
Expand Down
53 changes: 49 additions & 4 deletions architecture-baseline.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -75,13 +75,13 @@
"crates/libs/object-store/src/lib.rs" = 1810
"crates/libs/observability/src/lib.rs" = 1063
"crates/libs/public/api/src/lib.rs" = 1793
"crates/libs/sbx/mgr/server/src/auto_lifecycle_delete_receipts/db.rs" = 1158
"crates/libs/sbx/mgr/server/src/db/auto_lifecycle_delete_receipts.rs" = 1158
"crates/libs/sbx/mgr/server/src/db/cleanup_episodes.rs" = 1833
"crates/libs/sbx/mgr/server/src/db/quarantine_recovery.rs" = 1042
"crates/libs/sbx/mgr/server/src/db/sandboxes.rs" = 1553
"crates/libs/sbx/mgr/server/src/db/state_transitions.rs" = 1018
"crates/libs/sbx/mgr/server/src/db/sandboxes.rs" = 1547
"crates/libs/sbx/mgr/server/src/db/state_transitions.rs" = 1016
"crates/libs/sbx/mgr/server/src/run.rs" = 1101
"crates/libs/sbx/mgr/server/src/sandbox_eviction.rs" = 1273
"crates/libs/sbx/mgr/server/src/sandbox_eviction.rs" = 1253
"crates/libs/sbx/mgr/server/src/service/activation_support.rs" = 1574
"crates/libs/sbx/mgr/server/src/service/auth_lookup.rs" = 1221
"crates/libs/sbx/mgr/server/src/service/cache_cleanup.rs" = 1455
Expand Down Expand Up @@ -145,6 +145,51 @@
"crates/libs/node/mgr/server/src/service/artifact_fs/receive.rs" = 4
"crates/libs/node/mgr/server/src/net/fallback.rs" = 1

# sbx-mgr code outside its SQLite store that still names rusqlite types, the
# shared SQLite helpers or the shared job store, or opens a transaction itself.
[pattern_ratchet.sbxmgr_sqlite]
"crates/libs/sbx/mgr/server/src/lifecycle_metrics.rs" = 1

Check warning on line 151 in architecture-baseline.toml

View workflow job for this annotation

GitHub Actions / rust_static / Rust clippy 

[archcheck] reported by reviewdog 🐶
crates/libs/sbx/mgr/server/src/lifecycle_metrics.rs is in [pattern_ratchet.sbxmgr_sqlite] in architecture-baseline.toml but not in the base branch's copy; files outside the paths [rules.pattern_ratchet.sbxmgr_sqlite] in ARCHITECTURE.toml allows can't be added (a renamed file counts as added unless --renames pairs it with an old path the base branch's copy lists). Move that code behind an allowed path instead.

Raw Output:
message:"crates/libs/sbx/mgr/server/src/lifecycle_metrics.rs is in [pattern_ratchet.sbxmgr_sqlite] in architecture-baseline.toml but not in the base branch's copy; files outside the paths [rules.pattern_ratchet.sbxmgr_sqlite] in ARCHITECTURE.toml allows can't be added (a renamed file counts as added unless --renames pairs it with an old path the base branch's copy lists). Move that code behind an allowed path instead."  location:{path:"architecture-baseline.toml"  range:{start:{line:151}}}  severity:WARNING  source:{name:"archcheck"}  code:{value:"pattern_ratchet.sbxmgr_sqlite.no_new_entries"}
"crates/libs/sbx/mgr/server/src/local_artifacts.rs" = 28

Check warning on line 152 in architecture-baseline.toml

View workflow job for this annotation

GitHub Actions / rust_static / Rust clippy 

[archcheck] reported by reviewdog 🐶
crates/libs/sbx/mgr/server/src/local_artifacts.rs is in [pattern_ratchet.sbxmgr_sqlite] in architecture-baseline.toml but not in the base branch's copy; files outside the paths [rules.pattern_ratchet.sbxmgr_sqlite] in ARCHITECTURE.toml allows can't be added (a renamed file counts as added unless --renames pairs it with an old path the base branch's copy lists). Move that code behind an allowed path instead.

Raw Output:
message:"crates/libs/sbx/mgr/server/src/local_artifacts.rs is in [pattern_ratchet.sbxmgr_sqlite] in architecture-baseline.toml but not in the base branch's copy; files outside the paths [rules.pattern_ratchet.sbxmgr_sqlite] in ARCHITECTURE.toml allows can't be added (a renamed file counts as added unless --renames pairs it with an old path the base branch's copy lists). Move that code behind an allowed path instead."  location:{path:"architecture-baseline.toml"  range:{start:{line:152}}}  severity:WARNING  source:{name:"archcheck"}  code:{value:"pattern_ratchet.sbxmgr_sqlite.no_new_entries"}
"crates/libs/sbx/mgr/server/src/node_state_sync.rs" = 1

Check warning on line 153 in architecture-baseline.toml

View workflow job for this annotation

GitHub Actions / rust_static / Rust clippy 

[archcheck] reported by reviewdog 🐶
crates/libs/sbx/mgr/server/src/node_state_sync.rs is in [pattern_ratchet.sbxmgr_sqlite] in architecture-baseline.toml but not in the base branch's copy; files outside the paths [rules.pattern_ratchet.sbxmgr_sqlite] in ARCHITECTURE.toml allows can't be added (a renamed file counts as added unless --renames pairs it with an old path the base branch's copy lists). Move that code behind an allowed path instead.

Raw Output:
message:"crates/libs/sbx/mgr/server/src/node_state_sync.rs is in [pattern_ratchet.sbxmgr_sqlite] in architecture-baseline.toml but not in the base branch's copy; files outside the paths [rules.pattern_ratchet.sbxmgr_sqlite] in ARCHITECTURE.toml allows can't be added (a renamed file counts as added unless --renames pairs it with an old path the base branch's copy lists). Move that code behind an allowed path instead."  location:{path:"architecture-baseline.toml"  range:{start:{line:153}}}  severity:WARNING  source:{name:"archcheck"}  code:{value:"pattern_ratchet.sbxmgr_sqlite.no_new_entries"}
"crates/libs/sbx/mgr/server/src/route_activation_claims.rs" = 2

Check warning on line 154 in architecture-baseline.toml

View workflow job for this annotation

GitHub Actions / rust_static / Rust clippy 

[archcheck] reported by reviewdog 🐶
crates/libs/sbx/mgr/server/src/route_activation_claims.rs is in [pattern_ratchet.sbxmgr_sqlite] in architecture-baseline.toml but not in the base branch's copy; files outside the paths [rules.pattern_ratchet.sbxmgr_sqlite] in ARCHITECTURE.toml allows can't be added (a renamed file counts as added unless --renames pairs it with an old path the base branch's copy lists). Move that code behind an allowed path instead.

Raw Output:
message:"crates/libs/sbx/mgr/server/src/route_activation_claims.rs is in [pattern_ratchet.sbxmgr_sqlite] in architecture-baseline.toml but not in the base branch's copy; files outside the paths [rules.pattern_ratchet.sbxmgr_sqlite] in ARCHITECTURE.toml allows can't be added (a renamed file counts as added unless --renames pairs it with an old path the base branch's copy lists). Move that code behind an allowed path instead."  location:{path:"architecture-baseline.toml"  range:{start:{line:154}}}  severity:WARNING  source:{name:"archcheck"}  code:{value:"pattern_ratchet.sbxmgr_sqlite.no_new_entries"}
"crates/libs/sbx/mgr/server/src/run.rs" = 6

Check warning on line 155 in architecture-baseline.toml

View workflow job for this annotation

GitHub Actions / rust_static / Rust clippy 

[archcheck] reported by reviewdog 🐶
crates/libs/sbx/mgr/server/src/run.rs is in [pattern_ratchet.sbxmgr_sqlite] in architecture-baseline.toml but not in the base branch's copy; files outside the paths [rules.pattern_ratchet.sbxmgr_sqlite] in ARCHITECTURE.toml allows can't be added (a renamed file counts as added unless --renames pairs it with an old path the base branch's copy lists). Move that code behind an allowed path instead.

Raw Output:
message:"crates/libs/sbx/mgr/server/src/run.rs is in [pattern_ratchet.sbxmgr_sqlite] in architecture-baseline.toml but not in the base branch's copy; files outside the paths [rules.pattern_ratchet.sbxmgr_sqlite] in ARCHITECTURE.toml allows can't be added (a renamed file counts as added unless --renames pairs it with an old path the base branch's copy lists). Move that code behind an allowed path instead."  location:{path:"architecture-baseline.toml"  range:{start:{line:155}}}  severity:WARNING  source:{name:"archcheck"}  code:{value:"pattern_ratchet.sbxmgr_sqlite.no_new_entries"}
"crates/libs/sbx/mgr/server/src/runtime_reconciliation.rs" = 1

Check warning on line 156 in architecture-baseline.toml

View workflow job for this annotation

GitHub Actions / rust_static / Rust clippy 

[archcheck] reported by reviewdog 🐶
crates/libs/sbx/mgr/server/src/runtime_reconciliation.rs is in [pattern_ratchet.sbxmgr_sqlite] in architecture-baseline.toml but not in the base branch's copy; files outside the paths [rules.pattern_ratchet.sbxmgr_sqlite] in ARCHITECTURE.toml allows can't be added (a renamed file counts as added unless --renames pairs it with an old path the base branch's copy lists). Move that code behind an allowed path instead.

Raw Output:
message:"crates/libs/sbx/mgr/server/src/runtime_reconciliation.rs is in [pattern_ratchet.sbxmgr_sqlite] in architecture-baseline.toml but not in the base branch's copy; files outside the paths [rules.pattern_ratchet.sbxmgr_sqlite] in ARCHITECTURE.toml allows can't be added (a renamed file counts as added unless --renames pairs it with an old path the base branch's copy lists). Move that code behind an allowed path instead."  location:{path:"architecture-baseline.toml"  range:{start:{line:156}}}  severity:WARNING  source:{name:"archcheck"}  code:{value:"pattern_ratchet.sbxmgr_sqlite.no_new_entries"}
"crates/libs/sbx/mgr/server/src/sandbox_eviction.rs" = 5

Check warning on line 157 in architecture-baseline.toml

View workflow job for this annotation

GitHub Actions / rust_static / Rust clippy 

[archcheck] reported by reviewdog 🐶
crates/libs/sbx/mgr/server/src/sandbox_eviction.rs is in [pattern_ratchet.sbxmgr_sqlite] in architecture-baseline.toml but not in the base branch's copy; files outside the paths [rules.pattern_ratchet.sbxmgr_sqlite] in ARCHITECTURE.toml allows can't be added (a renamed file counts as added unless --renames pairs it with an old path the base branch's copy lists). Move that code behind an allowed path instead.

Raw Output:
message:"crates/libs/sbx/mgr/server/src/sandbox_eviction.rs is in [pattern_ratchet.sbxmgr_sqlite] in architecture-baseline.toml but not in the base branch's copy; files outside the paths [rules.pattern_ratchet.sbxmgr_sqlite] in ARCHITECTURE.toml allows can't be added (a renamed file counts as added unless --renames pairs it with an old path the base branch's copy lists). Move that code behind an allowed path instead."  location:{path:"architecture-baseline.toml"  range:{start:{line:157}}}  severity:WARNING  source:{name:"archcheck"}  code:{value:"pattern_ratchet.sbxmgr_sqlite.no_new_entries"}
"crates/libs/sbx/mgr/server/src/service/activation_support.rs" = 9

Check warning on line 158 in architecture-baseline.toml

View workflow job for this annotation

GitHub Actions / rust_static / Rust clippy 

[archcheck] reported by reviewdog 🐶
crates/libs/sbx/mgr/server/src/service/activation_support.rs is in [pattern_ratchet.sbxmgr_sqlite] in architecture-baseline.toml but not in the base branch's copy; files outside the paths [rules.pattern_ratchet.sbxmgr_sqlite] in ARCHITECTURE.toml allows can't be added (a renamed file counts as added unless --renames pairs it with an old path the base branch's copy lists). Move that code behind an allowed path instead.

Raw Output:
message:"crates/libs/sbx/mgr/server/src/service/activation_support.rs is in [pattern_ratchet.sbxmgr_sqlite] in architecture-baseline.toml but not in the base branch's copy; files outside the paths [rules.pattern_ratchet.sbxmgr_sqlite] in ARCHITECTURE.toml allows can't be added (a renamed file counts as added unless --renames pairs it with an old path the base branch's copy lists). Move that code behind an allowed path instead."  location:{path:"architecture-baseline.toml"  range:{start:{line:158}}}  severity:WARNING  source:{name:"archcheck"}  code:{value:"pattern_ratchet.sbxmgr_sqlite.no_new_entries"}
"crates/libs/sbx/mgr/server/src/service/auth_lookup.rs" = 5

Check warning on line 159 in architecture-baseline.toml

View workflow job for this annotation

GitHub Actions / rust_static / Rust clippy 

[archcheck] reported by reviewdog 🐶
crates/libs/sbx/mgr/server/src/service/auth_lookup.rs is in [pattern_ratchet.sbxmgr_sqlite] in architecture-baseline.toml but not in the base branch's copy; files outside the paths [rules.pattern_ratchet.sbxmgr_sqlite] in ARCHITECTURE.toml allows can't be added (a renamed file counts as added unless --renames pairs it with an old path the base branch's copy lists). Move that code behind an allowed path instead.

Raw Output:
message:"crates/libs/sbx/mgr/server/src/service/auth_lookup.rs is in [pattern_ratchet.sbxmgr_sqlite] in architecture-baseline.toml but not in the base branch's copy; files outside the paths [rules.pattern_ratchet.sbxmgr_sqlite] in ARCHITECTURE.toml allows can't be added (a renamed file counts as added unless --renames pairs it with an old path the base branch's copy lists). Move that code behind an allowed path instead."  location:{path:"architecture-baseline.toml"  range:{start:{line:159}}}  severity:WARNING  source:{name:"archcheck"}  code:{value:"pattern_ratchet.sbxmgr_sqlite.no_new_entries"}
"crates/libs/sbx/mgr/server/src/service/cache_cleanup.rs" = 12

Check warning on line 160 in architecture-baseline.toml

View workflow job for this annotation

GitHub Actions / rust_static / Rust clippy 

[archcheck] reported by reviewdog 🐶
crates/libs/sbx/mgr/server/src/service/cache_cleanup.rs is in [pattern_ratchet.sbxmgr_sqlite] in architecture-baseline.toml but not in the base branch's copy; files outside the paths [rules.pattern_ratchet.sbxmgr_sqlite] in ARCHITECTURE.toml allows can't be added (a renamed file counts as added unless --renames pairs it with an old path the base branch's copy lists). Move that code behind an allowed path instead.

Raw Output:
message:"crates/libs/sbx/mgr/server/src/service/cache_cleanup.rs is in [pattern_ratchet.sbxmgr_sqlite] in architecture-baseline.toml but not in the base branch's copy; files outside the paths [rules.pattern_ratchet.sbxmgr_sqlite] in ARCHITECTURE.toml allows can't be added (a renamed file counts as added unless --renames pairs it with an old path the base branch's copy lists). Move that code behind an allowed path instead."  location:{path:"architecture-baseline.toml"  range:{start:{line:160}}}  severity:WARNING  source:{name:"archcheck"}  code:{value:"pattern_ratchet.sbxmgr_sqlite.no_new_entries"}
"crates/libs/sbx/mgr/server/src/service/cleanup.rs" = 15
"crates/libs/sbx/mgr/server/src/service/cleanup_executor.rs" = 7
"crates/libs/sbx/mgr/server/src/service/cleanup_support.rs" = 7
"crates/libs/sbx/mgr/server/src/service/cleanup_targets.rs" = 1
"crates/libs/sbx/mgr/server/src/service/create_support.rs" = 5
"crates/libs/sbx/mgr/server/src/service/grpc_lifecycle/pause_resume.rs" = 2
"crates/libs/sbx/mgr/server/src/service/grpc_lifecycle/teardown_suspend.rs" = 2
"crates/libs/sbx/mgr/server/src/service/grpc_pool_wait_clone.rs" = 1
"crates/libs/sbx/mgr/server/src/service/grpc_spaced_process_snapshots/rollback_state.rs" = 1
"crates/libs/sbx/mgr/server/src/service/grpc_state_snapshot.rs" = 1
"crates/libs/sbx/mgr/server/src/service/mod.rs" = 13
"crates/libs/sbx/mgr/server/src/service/network_runtime.rs" = 5
"crates/libs/sbx/mgr/server/src/service/recovery.rs" = 5
"crates/libs/sbx/mgr/server/src/service/recovery_cross_node.rs" = 12
"crates/libs/sbx/mgr/server/src/service/start_support.rs" = 1
"crates/libs/sbx/mgr/server/src/service/startup_resident.rs" = 1
"crates/libs/sbx/mgr/server/src/service/storage.rs" = 1
"crates/libs/sbx/mgr/server/src/service/template_snapshot_support.rs" = 3
"crates/libs/sbx/mgr/server/src/service/test_options.rs" = 1
"crates/libs/sbx/mgr/server/src/snapshot_gc.rs" = 1
"crates/libs/sbx/mgr/server/src/snapshot_restore.rs" = 5
"crates/libs/sbx/mgr/server/src/snapshot_scheduler.rs" = 3
"crates/libs/sbx/mgr/server/src/snapshot_upload_jobs.rs" = 19
"crates/libs/sbx/mgr/server/src/watchdog.rs" = 21

# Code outside the store that still names sbx-mgr's migrations or database
# path: its open and migration in `run.rs`, and the migrator, until it calls
# the store.
[pattern_ratchet.sbxmgr_sqlite_schema]
"crates/libs/db/migrator/src/lib.rs" = 5
"crates/libs/sbx/mgr/server/src/run.rs" = 3

# [crate_names] maps each workspace package with a catch-all name (a part such
# as `common`, `utils` or `core`) to its member path. Only remove entries: a pull
# request that adds one is reported, and fails the check.
Expand Down
1 change: 0 additions & 1 deletion crates/libs/sbx/mgr/server/src/auto_lifecycle_delete_receipts/mod.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,6 @@ use pplx_space_common_core::types::{
};
use pplx_space_common_svc::types::AutoLifecyclePolicyFingerprint;

pub(crate) mod db;
#[cfg(test)]
mod tests;

Expand Down
Loading
Loading