didericis
44e2b5a897
test / integration-docker (pull_request) Successful in 13s
tracker-policy-pr / check-pr (pull_request) Successful in 14s
test / unit (pull_request) Successful in 42s
lint / lint (push) Failing after 54s
test / integration-firecracker (pull_request) Successful in 3m17s
test / coverage (pull_request) Successful in 17s
test / publish-infra (pull_request) Has been skipped
Give each service its own store package + manager, and cut the supervise module
along the control/data-plane boundary so nothing in the shared layer reaches up
into the orchestrator.
Stores, by owner:
- bot_bottle/store/ keeps only the shared base (DbStore, migrations) and the
concrete stores that aren't service-owned (audit_store, config_store).
- bot_bottle/orchestrator/store/ now houses the orchestrator-owned stores —
queue_store (supervise queue), secret_store, config_store — plus a new
orchestrator store_manager that migrates them (composing audit/config
downward from the base). The old shared store_manager is gone.
Supervise plane, by tier:
- bot_bottle/supervisor/ (NEUTRAL, importable by every tier including the
gateway): types.py (the Proposal/Response/AuditEntry wire types + the tool/
status/poll constants + the shared daemon constants moved out of
supervise.py) and plan.py (SupervisePlan, a pure DTO).
- bot_bottle/orchestrator/supervisor/ (orchestrator-only): queue.py (the
queue/audit I/O wrappers + render_diff + sha256_hex) and supervise.py (the
Supervise lifecycle that stages the DB via the store manager). Its __init__
re-exports the neutral vocabulary so orchestrator-side callers import from
one place.
The gateway now imports only bot_bottle.supervisor.types (never
bot_bottle.supervise), so the data plane holds no code dependency on the
orchestrator — it reaches the queue over the control-plane RPC. This removes
the circular import that moving queue_store under orchestrator introduced
(supervise -> orchestrator -> service -> supervise).
supervise_types.py -> supervisor/types.py; supervise.py deleted (split). Full
unit suite green (2251).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
94 lines
3.4 KiB
Python
94 lines
3.4 KiB
Python
"""SQLite-backed audit store for supervise (PRD 0013)."""
|
|
|
|
from __future__ import annotations
|
|
|
|
import sqlite3
|
|
from pathlib import Path
|
|
|
|
try:
|
|
from ..supervisor.types import AuditEntry
|
|
from ..paths import host_db_path
|
|
from .db_store import DbStore
|
|
from .migrations import TableMigrations
|
|
except ImportError:
|
|
from supervisor.types import AuditEntry # type: ignore[import-not-found] # pylint: disable=import-error,no-name-in-module
|
|
from paths import host_db_path # type: ignore[import-not-found] # pylint: disable=import-error,no-name-in-module
|
|
from db_store import DbStore # type: ignore[import-not-found] # pylint: disable=import-error,no-name-in-module
|
|
from migrations import TableMigrations # type: ignore[import-not-found] # pylint: disable=import-error,no-name-in-module
|
|
|
|
|
|
class AuditStore(DbStore):
|
|
"""SQLite-backed persistent store for supervise audit entries."""
|
|
|
|
def __init__(self, db_path: Path | None = None) -> None:
|
|
# One entry per schema version: migrations[0] brings a fresh DB to
|
|
# version 1, [1] to version 2, etc. Add new entries at the end; never
|
|
# edit existing ones.
|
|
migrations = TableMigrations("audit_store", [
|
|
# v1 — initial schema
|
|
"""
|
|
CREATE TABLE IF NOT EXISTS supervise_audit_entries (
|
|
id INTEGER PRIMARY KEY AUTOINCREMENT,
|
|
timestamp TEXT NOT NULL,
|
|
bottle_slug TEXT NOT NULL,
|
|
component TEXT NOT NULL,
|
|
operator_action TEXT NOT NULL,
|
|
operator_notes TEXT NOT NULL,
|
|
justification TEXT NOT NULL,
|
|
diff TEXT NOT NULL
|
|
)
|
|
""",
|
|
])
|
|
super().__init__(db_path or host_db_path(), migrations)
|
|
|
|
def write_audit_entry(self, entry: AuditEntry) -> Path:
|
|
with self._connection() as conn:
|
|
conn.execute(
|
|
"""
|
|
INSERT INTO supervise_audit_entries (
|
|
timestamp, bottle_slug, component, operator_action,
|
|
operator_notes, justification, diff
|
|
) VALUES (?, ?, ?, ?, ?, ?, ?)
|
|
""",
|
|
(
|
|
entry.timestamp,
|
|
entry.bottle_slug,
|
|
entry.component,
|
|
entry.operator_action,
|
|
entry.operator_notes,
|
|
entry.justification,
|
|
entry.diff,
|
|
),
|
|
)
|
|
self._chmod()
|
|
return self.db_path
|
|
|
|
def read_audit_entries(self, component: str, slug: str) -> list[AuditEntry]:
|
|
if not self.db_path.is_file():
|
|
return []
|
|
with self._connection() as conn:
|
|
rows = conn.execute(
|
|
"""
|
|
SELECT * FROM supervise_audit_entries
|
|
WHERE component = ? AND bottle_slug = ?
|
|
ORDER BY id
|
|
""",
|
|
(component, slug),
|
|
).fetchall()
|
|
return [self._row_to_entry(row) for row in rows]
|
|
|
|
@staticmethod
|
|
def _row_to_entry(row: sqlite3.Row) -> AuditEntry:
|
|
return AuditEntry(
|
|
timestamp=row["timestamp"],
|
|
bottle_slug=row["bottle_slug"],
|
|
component=row["component"],
|
|
operator_action=row["operator_action"],
|
|
operator_notes=row["operator_notes"],
|
|
justification=row["justification"],
|
|
diff=row["diff"],
|
|
)
|
|
|
|
|
|
__all__ = ["AuditStore"]
|