Uh oh!
There was an error while loading. Please reload this page.
scaffold: SeaORM shared ORM crate - #1
Conversation
ORESoftware
commented
Aug 8, 2026
Follow-up context from the coordination sweep: entities for this crate should come from the generated SeaORM adapter in k8s-libs-and-shared-defs — 🤖 Generated with Claude Code |
ORESoftware
left a comment
There was a problem hiding this comment.
ChatGPT cross-thread review confirms this repository is the canonical ownership direction, but the exact head is not yet a functional DEN-2788 implementation: read.rs is documentation only, there is no connection/search-path/read-only verification code, and Cargo does not import a pinned shared-defs package despite the PR description.
Please port the useful implementation from zed-lib#1 here while correcting its raw-session exposure. Keep SeaORM and DatabaseConnection private; expose an opaque default-feature read context and compile write context/functions only with read-write. Add compile-fail consumer tests, a real named health/read query, conflicting/duplicate options URL tests, and live Postgres/Cockroach evidence that the web identity and session both reject writes. Consumer server PRs should pin this repository's exact reviewed SHA, never the competing embedded crate.
ORESoftware
commented
Aug 8, 2026
A mergeable stacked hardening PR is ready at #2. It targets this scaffold branch so it can be reviewed/cherry-picked before #1 merges without colliding with unrelated work. #2 adds opaque contexts, default read-only startup verification, feature-gated write symbols, an exact Remaining combined merge gates are the generated Zed entity slice and real tenant-scoped named operations from the pinned shared-defs revision, Rust CI, and PostgreSQL/CockroachDB role-denial evidence. |
…context work The scaffold PR (#1) was squash-merged to main while the hardening branch was stacked on the pre-squash branch, so git saw both lineages as divergent adds and conflicted on every shared file. Resolved by carrying both intents rather than taking a side: - the hardening branch's implementation is kept everywhere (opaque ReadContext/ WriteContext, crate-private connections, compile_fail doctest, shared-defs lockfile, CI, live denial probe); - content the hardening branch had dropped from the scaffold is folded back: the `get_published_items_for_tenant(tenant_id)` named-contract guidance (read.rs), the database-grants defense-in-depth point (write.rs), explicit migration ownership via declarative-migrations plus the SELECT-only web identity (lib.rs), the release version-pinning / schema-event rule and the dual-engine testing caveat (README), and the shared-defs provenance clause (Cargo.toml description); - the dead `docs/ORM_CORE_LIBRARY.md` reference from the scaffold README is deliberately NOT carried: that addendum was superseded, and its content now lives in the canonical SERVICE_AND_DATA_ARCHITECTURE.md. Also aligns the docs with the ChatGPT external review (DEN-2882) item 1: the Cargo feature split is an intent/ergonomics boundary, not a security one, because feature resolution is additive across a dependency graph. The authoritative control is the SELECT-only database role.
Scaffolds
zed-orm-coreper the adopted shared-ORM-layer decision (seezed-pkg/.githubPR "docs: shared ORM layer addendum — *-orm-core (SeaORM)" andSERVICE_AND_DATA_ARCHITECTURE.md):sqlx-postgresbackend, works for PostgreSQL and CockroachDB)read-only(default) vsread-writefeature split: web servers get named policy-aware query functions only; API servers opt into the write surfaceEntity generation from the shared defs is intentionally left as follow-up work.
🤖 Generated with Claude Code