Skip to content

archcheck: count writes of the sandboxes row outside sandbox-store #690

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ac-pplx merged 1 commit into from
Oct 21, 2026
Merged

archcheck: count writes of the sandboxes row outside sandbox-store #690

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
81 changes: 81 additions & 0 deletions ARCHITECTURE.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -181,6 +181,87 @@ mode = "required"
[rules.pattern_ratchet.substrate_literals.stale_entries] # entries with fewer matches, none, or gone
mode = "required"

# Writes of the control-plane Postgres `public.sandboxes` row move into its
# store, `pplx-space-sandbox-store`; this ratchet only shrinks. It counts each
# production line that opens a statement writing the row (`UPDATE`,
# `INSERT INTO`, `DELETE FROM`, `MERGE INTO` or `TRUNCATE` naming `sandboxes`,
# in any case, schema-qualified or quoted, before any alias, including right
# after a `\n`, `\r` or `\t` escape in a one-line string), and each call to
# the sandbox-portability renderers that compose part of its SET list
# (`sandbox_assignments()`, as a method or a path call, and the
# `*_current_local_artifact_marker_assignments` functions, after punctuation,
# a line start or `return`, `match`, `if`, `in`, `else` or `while`), so a file
# with a composed `UPDATE sandboxes s SET {...}` counts the head and each
# renderer call.
# Not caught: a statement head split across lines (`UPDATE` and `sandboxes` on
# different lines) or built at run time (`format!("UPDATE {table} ...")`); a
# `COPY sandboxes FROM ...`; a statement in a non-`.rs` file, such as the
# placement state machine's `include_str!` claim statements under
# `postgres/sql/`; a head right after an escape other than `\n`, `\r` or
# `\t` (`\0`, `\x0a`); a renderer called through an alias or a `use ... as`
# rename, passed as a function value
# (`.map(SuspendedK8sFinalizationSql::sandbox_assignments)`), or called
# right after `break` or `yield`; database triggers; scripts and smoke
# harnesses outside workspace members' `src/`.
# False positives: the same text in a trailing `//` or `/* */` comment, in
# `#[doc = "..."]`, in a SQL `--` comment or in an ordinary string such as an
# error message ("failed to update sandboxes"); a statement on another
# database's table of the same name.
# sbx-mgr's node-local SQLite database also has a `sandboxes` table, a
# different database on a different machine with its own store and fences
# (`sbxmgr_sqlite` and `dependency_fence.sbxmgr_*` below), so its crates are
# allowed whole: those rules guard `crates/libs/sbx/mgr/**` and
# `crates/apps/sbx/**`, which today are all of `crates/libs/sbx` and
# `crates/apps/sbx`, and a narrower glob would make this required rule fire
# on moves within sbx-mgr. Test files are
# filename-based, so `allow` adds the `#[cfg(test)]` support modules and
# fixtures, which write rows to set up their cases; `#[cfg(test)]` code inline
# in a production file counts, so test-only writes go in a `*_tests` file.
# Exception paths, each a reviewed baseline edit: a new writer outside the
# store is a new entry (`no_new_entries`); another write in a listed file is a
# raised cap (`no_raised_caps`); splitting a listed file into modules needs
# entries for the new files and a lower cap on the old one, since `--renames`
# pairs only whole-file renames. Portability calls its private
# `sandbox_assignments` helper bare; a path-qualified call to it there
# (`Self::...`, `super::...`) matches and needs a reviewed entry.
[rules.pattern_ratchet.sandbox_writes]
patterns = [
# A statement head on the row's table
'''(?i)(?:\\[nrt]|\b)(?:UPDATE|DELETE\s+FROM|INSERT\s+INTO|MERGE\s+INTO|TRUNCATE(?:\s+TABLE)?)\s+(?:ONLY\s+)?(?:\\?"?public\\?"?\s*\.\s*)?\\?"?sandboxes\b''',
# Calls to the portability renderers of the row's assignments
'''(?:\.|::)\s*sandbox_assignments\s*\(''',
'''(?:^|[^\w\s]|\b(?:return|match|if|in|else|while)\s)\s*(?:\w+\s*::\s*)*(?:clear|write|publish_clear_or_preserve)_current_local_artifact_marker_assignments\s*\(''',
]
allow = [
"crates/libs/sandbox/store/**",
# node-local sbx-mgr SQLite `sandboxes`: a different database
"crates/libs/sbx/**",
"crates/apps/sbx/**",
"**/*_tests/**",
"**/test_support.rs",
"**/test_support/**",
"**/*_test_support.rs",
"**/test_fixtures.rs",
"**/*_test_fixture.rs",
"**/scripted_test_doubles.rs",
"crates/libs/db-test-fixtures/**",
]

[rules.pattern_ratchet.sandbox_writes.no_crossing] # only allowed and listed files may match
mode = "required"

[rules.pattern_ratchet.sandbox_writes.no_new_entries] # a pull request may not add entries to the baseline
mode = "advisory"

[rules.pattern_ratchet.sandbox_writes.no_raised_caps] # a pull request may not raise a cap in the baseline
mode = "advisory"

[rules.pattern_ratchet.sandbox_writes.listed_no_growth] # listed files may not gain matching lines
mode = "required"

[rules.pattern_ratchet.sandbox_writes.stale_entries] # entries with fewer matches, none, or gone
mode = "required"

# Rootfs copies must preserve NoCoW and sparse extents through common-io's
# reflink helper. A line matcher cannot infer a path variable's contents, so
# conservatively fence all new plain filesystem copies and cp launches.
Expand Down
33 changes: 33 additions & 0 deletions architecture-baseline.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -144,6 +144,39 @@
"crates/libs/node/mgr/server/src/service/artifact_fs/receive.rs" = 4
"crates/libs/node/mgr/server/src/net/fallback.rs" = 1

# Writers of the control-plane Postgres `sandboxes` row outside sandbox-store,
# and their calls to sandbox-portability's assignment renderers. They move into
# the store; lower each cap as they go.
[pattern_ratchet.sandbox_writes]
"crates/libs/api/src/controllers/sandbox/lifecycle.rs" = 4

Check warning on line 151 in architecture-baseline.toml

View workflow job for this annotation

GitHub Actions / rust_static / Rust clippy 

[archcheck] reported by reviewdog 🐶
crates/libs/api/src/controllers/sandbox/lifecycle.rs is in [pattern_ratchet.sandbox_writes] in architecture-baseline.toml but not in the base branch's copy; files outside the paths [rules.pattern_ratchet.sandbox_writes] in ARCHITECTURE.toml allows can't be added (a renamed file counts as added unless --renames pairs it with an old path the base branch's copy lists). Move that code behind an allowed path instead.

Raw Output:
message:"crates/libs/api/src/controllers/sandbox/lifecycle.rs is in [pattern_ratchet.sandbox_writes] in architecture-baseline.toml but not in the base branch's copy; files outside the paths [rules.pattern_ratchet.sandbox_writes] in ARCHITECTURE.toml allows can't be added (a renamed file counts as added unless --renames pairs it with an old path the base branch's copy lists). Move that code behind an allowed path instead."  location:{path:"architecture-baseline.toml"  range:{start:{line:151}}}  severity:WARNING  source:{name:"archcheck"}  code:{value:"pattern_ratchet.sandbox_writes.no_new_entries"}
"crates/libs/api/src/controllers/sandbox/queries.rs" = 4

Check warning on line 152 in architecture-baseline.toml

View workflow job for this annotation

GitHub Actions / rust_static / Rust clippy 

[archcheck] reported by reviewdog 🐶
crates/libs/api/src/controllers/sandbox/queries.rs is in [pattern_ratchet.sandbox_writes] in architecture-baseline.toml but not in the base branch's copy; files outside the paths [rules.pattern_ratchet.sandbox_writes] in ARCHITECTURE.toml allows can't be added (a renamed file counts as added unless --renames pairs it with an old path the base branch's copy lists). Move that code behind an allowed path instead.

Raw Output:
message:"crates/libs/api/src/controllers/sandbox/queries.rs is in [pattern_ratchet.sandbox_writes] in architecture-baseline.toml but not in the base branch's copy; files outside the paths [rules.pattern_ratchet.sandbox_writes] in ARCHITECTURE.toml allows can't be added (a renamed file counts as added unless --renames pairs it with an old path the base branch's copy lists). Move that code behind an allowed path instead."  location:{path:"architecture-baseline.toml"  range:{start:{line:152}}}  severity:WARNING  source:{name:"archcheck"}  code:{value:"pattern_ratchet.sandbox_writes.no_new_entries"}
"crates/libs/api/src/controllers/sandbox/responses.rs" = 3

Check warning on line 153 in architecture-baseline.toml

View workflow job for this annotation

GitHub Actions / rust_static / Rust clippy 

[archcheck] reported by reviewdog 🐶
crates/libs/api/src/controllers/sandbox/responses.rs is in [pattern_ratchet.sandbox_writes] in architecture-baseline.toml but not in the base branch's copy; files outside the paths [rules.pattern_ratchet.sandbox_writes] in ARCHITECTURE.toml allows can't be added (a renamed file counts as added unless --renames pairs it with an old path the base branch's copy lists). Move that code behind an allowed path instead.

Raw Output:
message:"crates/libs/api/src/controllers/sandbox/responses.rs is in [pattern_ratchet.sandbox_writes] in architecture-baseline.toml but not in the base branch's copy; files outside the paths [rules.pattern_ratchet.sandbox_writes] in ARCHITECTURE.toml allows can't be added (a renamed file counts as added unless --renames pairs it with an old path the base branch's copy lists). Move that code behind an allowed path instead."  location:{path:"architecture-baseline.toml"  range:{start:{line:153}}}  severity:WARNING  source:{name:"archcheck"}  code:{value:"pattern_ratchet.sandbox_writes.no_new_entries"}
"crates/libs/api/src/controllers/sandbox/updates.rs" = 4

Check warning on line 154 in architecture-baseline.toml

View workflow job for this annotation

GitHub Actions / rust_static / Rust clippy 

[archcheck] reported by reviewdog 🐶
crates/libs/api/src/controllers/sandbox/updates.rs is in [pattern_ratchet.sandbox_writes] in architecture-baseline.toml but not in the base branch's copy; files outside the paths [rules.pattern_ratchet.sandbox_writes] in ARCHITECTURE.toml allows can't be added (a renamed file counts as added unless --renames pairs it with an old path the base branch's copy lists). Move that code behind an allowed path instead.

Raw Output:
message:"crates/libs/api/src/controllers/sandbox/updates.rs is in [pattern_ratchet.sandbox_writes] in architecture-baseline.toml but not in the base branch's copy; files outside the paths [rules.pattern_ratchet.sandbox_writes] in ARCHITECTURE.toml allows can't be added (a renamed file counts as added unless --renames pairs it with an old path the base branch's copy lists). Move that code behind an allowed path instead."  location:{path:"architecture-baseline.toml"  range:{start:{line:154}}}  severity:WARNING  source:{name:"archcheck"}  code:{value:"pattern_ratchet.sandbox_writes.no_new_entries"}
"crates/libs/api/src/controllers/sandbox/wake_completion.rs" = 1

Check warning on line 155 in architecture-baseline.toml

View workflow job for this annotation

GitHub Actions / rust_static / Rust clippy 

[archcheck] reported by reviewdog 🐶
crates/libs/api/src/controllers/sandbox/wake_completion.rs is in [pattern_ratchet.sandbox_writes] in architecture-baseline.toml but not in the base branch's copy; files outside the paths [rules.pattern_ratchet.sandbox_writes] in ARCHITECTURE.toml allows can't be added (a renamed file counts as added unless --renames pairs it with an old path the base branch's copy lists). Move that code behind an allowed path instead.

Raw Output:
message:"crates/libs/api/src/controllers/sandbox/wake_completion.rs is in [pattern_ratchet.sandbox_writes] in architecture-baseline.toml but not in the base branch's copy; files outside the paths [rules.pattern_ratchet.sandbox_writes] in ARCHITECTURE.toml allows can't be added (a renamed file counts as added unless --renames pairs it with an old path the base branch's copy lists). Move that code behind an allowed path instead."  location:{path:"architecture-baseline.toml"  range:{start:{line:155}}}  severity:WARNING  source:{name:"archcheck"}  code:{value:"pattern_ratchet.sandbox_writes.no_new_entries"}
"crates/libs/api/src/controllers/substrate/direct.rs" = 5

Check warning on line 156 in architecture-baseline.toml

View workflow job for this annotation

GitHub Actions / rust_static / Rust clippy 

[archcheck] reported by reviewdog 🐶
crates/libs/api/src/controllers/substrate/direct.rs is in [pattern_ratchet.sandbox_writes] in architecture-baseline.toml but not in the base branch's copy; files outside the paths [rules.pattern_ratchet.sandbox_writes] in ARCHITECTURE.toml allows can't be added (a renamed file counts as added unless --renames pairs it with an old path the base branch's copy lists). Move that code behind an allowed path instead.

Raw Output:
message:"crates/libs/api/src/controllers/substrate/direct.rs is in [pattern_ratchet.sandbox_writes] in architecture-baseline.toml but not in the base branch's copy; files outside the paths [rules.pattern_ratchet.sandbox_writes] in ARCHITECTURE.toml allows can't be added (a renamed file counts as added unless --renames pairs it with an old path the base branch's copy lists). Move that code behind an allowed path instead."  location:{path:"architecture-baseline.toml"  range:{start:{line:156}}}  severity:WARNING  source:{name:"archcheck"}  code:{value:"pattern_ratchet.sandbox_writes.no_new_entries"}
"crates/libs/api/src/controllers/substrate/kubernetes/store/activation_fence.rs" = 1

Check warning on line 157 in architecture-baseline.toml

View workflow job for this annotation

GitHub Actions / rust_static / Rust clippy 

[archcheck] reported by reviewdog 🐶
crates/libs/api/src/controllers/substrate/kubernetes/store/activation_fence.rs is in [pattern_ratchet.sandbox_writes] in architecture-baseline.toml but not in the base branch's copy; files outside the paths [rules.pattern_ratchet.sandbox_writes] in ARCHITECTURE.toml allows can't be added (a renamed file counts as added unless --renames pairs it with an old path the base branch's copy lists). Move that code behind an allowed path instead.

Raw Output:
message:"crates/libs/api/src/controllers/substrate/kubernetes/store/activation_fence.rs is in [pattern_ratchet.sandbox_writes] in architecture-baseline.toml but not in the base branch's copy; files outside the paths [rules.pattern_ratchet.sandbox_writes] in ARCHITECTURE.toml allows can't be added (a renamed file counts as added unless --renames pairs it with an old path the base branch's copy lists). Move that code behind an allowed path instead."  location:{path:"architecture-baseline.toml"  range:{start:{line:157}}}  severity:WARNING  source:{name:"archcheck"}  code:{value:"pattern_ratchet.sandbox_writes.no_new_entries"}
"crates/libs/api/src/controllers/substrate/kubernetes/store/execution_rows.rs" = 1

Check warning on line 158 in architecture-baseline.toml

View workflow job for this annotation

GitHub Actions / rust_static / Rust clippy 

[archcheck] reported by reviewdog 🐶
crates/libs/api/src/controllers/substrate/kubernetes/store/execution_rows.rs is in [pattern_ratchet.sandbox_writes] in architecture-baseline.toml but not in the base branch's copy; files outside the paths [rules.pattern_ratchet.sandbox_writes] in ARCHITECTURE.toml allows can't be added (a renamed file counts as added unless --renames pairs it with an old path the base branch's copy lists). Move that code behind an allowed path instead.

Raw Output:
message:"crates/libs/api/src/controllers/substrate/kubernetes/store/execution_rows.rs is in [pattern_ratchet.sandbox_writes] in architecture-baseline.toml but not in the base branch's copy; files outside the paths [rules.pattern_ratchet.sandbox_writes] in ARCHITECTURE.toml allows can't be added (a renamed file counts as added unless --renames pairs it with an old path the base branch's copy lists). Move that code behind an allowed path instead."  location:{path:"architecture-baseline.toml"  range:{start:{line:158}}}  severity:WARNING  source:{name:"archcheck"}  code:{value:"pattern_ratchet.sandbox_writes.no_new_entries"}
"crates/libs/api/src/controllers/substrate/kubernetes/store/pod_placement.rs" = 1

Check warning on line 159 in architecture-baseline.toml

View workflow job for this annotation

GitHub Actions / rust_static / Rust clippy 

[archcheck] reported by reviewdog 🐶
crates/libs/api/src/controllers/substrate/kubernetes/store/pod_placement.rs is in [pattern_ratchet.sandbox_writes] in architecture-baseline.toml but not in the base branch's copy; files outside the paths [rules.pattern_ratchet.sandbox_writes] in ARCHITECTURE.toml allows can't be added (a renamed file counts as added unless --renames pairs it with an old path the base branch's copy lists). Move that code behind an allowed path instead.

Raw Output:
message:"crates/libs/api/src/controllers/substrate/kubernetes/store/pod_placement.rs is in [pattern_ratchet.sandbox_writes] in architecture-baseline.toml but not in the base branch's copy; files outside the paths [rules.pattern_ratchet.sandbox_writes] in ARCHITECTURE.toml allows can't be added (a renamed file counts as added unless --renames pairs it with an old path the base branch's copy lists). Move that code behind an allowed path instead."  location:{path:"architecture-baseline.toml"  range:{start:{line:159}}}  severity:WARNING  source:{name:"archcheck"}  code:{value:"pattern_ratchet.sandbox_writes.no_new_entries"}
"crates/libs/api/src/controllers/substrate/kubernetes/store/pod_tracking.rs" = 5

Check warning on line 160 in architecture-baseline.toml

View workflow job for this annotation

GitHub Actions / rust_static / Rust clippy 

[archcheck] reported by reviewdog 🐶
crates/libs/api/src/controllers/substrate/kubernetes/store/pod_tracking.rs is in [pattern_ratchet.sandbox_writes] in architecture-baseline.toml but not in the base branch's copy; files outside the paths [rules.pattern_ratchet.sandbox_writes] in ARCHITECTURE.toml allows can't be added (a renamed file counts as added unless --renames pairs it with an old path the base branch's copy lists). Move that code behind an allowed path instead.

Raw Output:
message:"crates/libs/api/src/controllers/substrate/kubernetes/store/pod_tracking.rs is in [pattern_ratchet.sandbox_writes] in architecture-baseline.toml but not in the base branch's copy; files outside the paths [rules.pattern_ratchet.sandbox_writes] in ARCHITECTURE.toml allows can't be added (a renamed file counts as added unless --renames pairs it with an old path the base branch's copy lists). Move that code behind an allowed path instead."  location:{path:"architecture-baseline.toml"  range:{start:{line:160}}}  severity:WARNING  source:{name:"archcheck"}  code:{value:"pattern_ratchet.sandbox_writes.no_new_entries"}
"crates/libs/api/src/controllers/substrate/kubernetes/store/restore_lease.rs" = 5
"crates/libs/api/src/controllers/substrate/kubernetes/store/suspend.rs" = 8
"crates/libs/api/src/controllers/substrate/mod.rs" = 1
"crates/libs/cluster/controller/server/src/drained_node_terminator/store.rs" = 2
"crates/libs/cluster/controller/server/src/failed_restorable_repair/store.rs" = 3
"crates/libs/cluster/controller/server/src/node_drain/store.rs" = 15
"crates/libs/cluster/controller/server/src/orphaned_sandboxes.rs" = 5
"crates/libs/cluster/controller/server/src/orphaned_sandboxes/quarantine_recovery/store.rs" = 1
"crates/libs/cluster/controller/server/src/started_sandbox_repair/store.rs" = 3
"crates/libs/cluster/controller/server/src/suspended_execution_reaper/store.rs" = 1
"crates/libs/cluster/controller/server/src/tombstone_retention.rs" = 1
"crates/libs/cluster/controller/server/src/transient_lifecycle_sweeper/store.rs" = 10
"crates/libs/internal/api/server/src/data_plane_sessions/service_route.rs" = 1
"crates/libs/internal/api/server/src/published_state.rs" = 9
"crates/libs/internal/api/server/src/sandbox_quarantine_store.rs" = 3
"crates/libs/internal/api/server/src/status.rs" = 1
"crates/libs/placement/machine/src/postgres.rs" = 1
"crates/libs/sandbox/teardown/src/lib.rs" = 1

# sbx-mgr code outside its SQLite store uses only the store's own handle,
# transaction and error types, so no file is listed.
[pattern_ratchet.sbxmgr_sqlite]
Expand Down
Loading