[the-gigi-pplx]

Summary

Declares node_environment_certifications as Postgres state owned by pplx-space-runtime-environment-catalog-store. It's one line in the store's [package.metadata.space.state]. No migration creates the table yet, so nothing reads or writes it, and no runtime behavior changes.

Terms

• State declaration: the [package.metadata.space.state] table in a store crate's Cargo.toml, which lists the database tables that store owns. archcheck's layers rule uses it to check which crate may write each table (crates/tools/archcheck/README.md#state-ownership).
• layers.state.pending: archcheck's advisory finding for a declared table that no migration creates yet.

The problem

PR #1274 adds the migration that creates node_environment_certifications. Two guards stop that migration from bringing its owner along:

1. The Postgres migration isolation guard (scripts/check-postgres-migrations-isolated.sh) fails a pull request that changes db/postgres together with anything under crates/, so the migration's PR can't edit the store's Cargo.toml.
2. Without a declaration, the new table is live and owned by no store, which archcheck's layers.unowned.no_crossing rejects. Listing it in the [layers.unowned] baseline instead is what layers.unowned.no_new_entries rejects.

archcheck's README describes the order that satisfies both: the owning store declares the table first, reported as layers.state.pending, and the migration follows in its own pull request.

How this fixes it

• Declare the table in its owning store. postgres = [] becomes postgres = ["node_environment_certifications"] in crates/l30_storage/runtime/environment/catalog/store/Cargo.toml. This store is the environment catalog's storage crate (it reads runtime_environments), and the certification rows feed that catalog's edges.

Nothing else changes. Once PR #1274 rebases on this and merges, the table is live and owned, and the pending finding goes away.

Validation

• cargo arch with the base comparisons CI runs (--base-baseline, --renames and --base-architecture taken from main) exits 0 with one finding: the advisory layers.state.pending for postgres.node_environment_certifications. No required findings.
• The declared name matches the CREATE TABLE node_environment_certifications in PR [db] add the node_environment_certifications table #1274's migration.

Not validated: workspace build and tests. The change is package metadata that only archcheck reads; CI covers the rest on this head.

Dependencies

None. This merges on its own. PR #1274 rebases on it.

Severity and risk

Severity: low. It unblocks the migration PR; nothing is broken today.

Risk: low. No compiled code changes. Until PR #1274 lands, archcheck reports one advisory finding. Roll back by reverting the line.

AI assistance: Claude Code drafted the change and this description.

[coderabbitai]

No actionable comments were generated in the recent review.

Walkthrough

The PostgreSQL package state metadata now lists node_environment_certifications instead of an empty list.

Possibly related PRs

• perplexityai/SPACE#1429: Both changes declare database table ownership in package state metadata. This PR updates PostgreSQL runtime-environment state; #1429 updates SQLite template-manager state.

Merge Risk: Minimal · up to c846b

This metadata-only change is supported by the repository’s state-checking contract and has no identified merge-blocking risk.

Security architecture risk: Minimal · up to c846b

The change assigns the future table to its owning store using the documented declaration-before-migration process. It does not create the table, add database operations, or change deployed permissions. No material security risk was identified in this PR; the later migration requires its own assessment.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — The current change is bounded to the declared ownership of one table by one store. The metadata-only diff introduces no attacker-controlled input path, database operation, or deployed privilege grant.

Trust Boundaries and Controls

• observed — The relevant control is repository-level static ownership enforcement. It identifies the permitted owning store and configured co-writers; it does not establish production PostgreSQL privileges or tenant-isolation behavior.

Pre-merge checks: 5

Check name	Status	Explanation
Title check		The title uses the required bracketed area and starts its summary with the lowercase word "declare". It accurately describes the PostgreSQL state declaration change and has no trailing period, ticket …
Description Follows The Pr Template		The description contains all required content: a non-empty ## Summary section, a ## Validation section naming cargo arch and its result, a ## Severity and risk section with severity and risk, …
Bug Fixes Name A Regression Test		PASS. The pull request changes only Cargo.toml state metadata: it adds node_environment_certifications to postgres. It does not change application behavior under crates/, shim/, or ui/, so t…
Weakened Safeguards Are Justified		The diff changes only crates/l30_storage/runtime/environment/catalog/store/Cargo.toml:11, from an empty PostgreSQL state declaration to postgres = ["node_environment_certifications"]. It does not …
Public-Safe Content		The diff changes only the PostgreSQL state list to add node_environment_certifications. It contains no credentials, tokens, keys, private URLs, account IDs, ARNs, workstation paths, logs, measuremen…

Full details: Title check

Explanation

The title uses the required bracketed area and starts its summary with the lowercase word "declare". It accurately describes the PostgreSQL state declaration change and has no trailing period, ticket ID, or internal link.

Full details: Description Follows The Pr Template

Explanation

The description contains all required content: a non-empty ## Summary section, a ## Validation section naming cargo arch and its result, a ## Severity and risk section with severity and risk, and an AI assistance: line identifying Claude Code and the drafted content.

Full details: Bug Fixes Name A Regression Test

Explanation

PASS. The pull request changes only Cargo.toml state metadata: it adds node_environment_certifications to postgres. It does not change application behavior under crates/, shim/, or ui/, so the regression-test requirement does not apply.

Full details: Weakened Safeguards Are Justified

Explanation

The diff changes only crates/l30_storage/runtime/environment/catalog/store/Cargo.toml:11, from an empty PostgreSQL state declaration to postgres = ["node_environment_certifications"]. It does not remove, disable, narrow, or weaken a test, assertion, lint, CI check, or repository guard.

Full details: Public-Safe Content

Explanation

The diff changes only the PostgreSQL state list to add node_environment_certifications. It contains no credentials, tokens, keys, private URLs, account IDs, ARNs, workstation paths, logs, measurements, incident details, or undisclosed vulnerability details. The title and description contain public repository references and code identifiers only.

Recent review info

Automatic approval policy

Commit: c846bac31b67.

Setting	Effective value	Source
Automatic approvals	Enabled	Global configuration
Merge risk	Low	Override 2
Security risk	Not set	Global configuration

Matching overrides (numbered as in the resolved configuration):

• Override 2 — any author; paths: **, !ui/**; merge risk: Low.

Any matching disabled override withholds approval, regardless of risk. Otherwise, the strictest explicitly set limit wins for each score. Limits omitted by all matching overrides inherit the global configuration.

Not set means no limit was configured after inheritance. Use @coderabbitai configuration to inspect the resolved settings and their sources.

Run configuration

• Source mode: Auto
• Repository: perplexityai/SPACE
• Branch: gigi/pla-7396-declare-node-environment-certifications
• File: .coderabbit.yaml
• Commit: c846bac
• Layers: Repository YAML; Enforced overrides: Organization
• Review profile: CHILL
• Plan: Enterprise
• Run ID: a6e7f3ab-9447-4955-8011-376f4c41bc1c

Commits

Reviewing files that changed from the base of the PR and between 45e963a and c846bac.

Files selected for processing: 1

• crates/l30_storage/runtime/environment/catalog/store/Cargo.toml

Included review availability: This review used your included allowance. Your plan provides up to 12 included reviews per hour; 11 remain after this review.