71 lines
2.7 KiB
Markdown
71 lines
2.7 KiB
Markdown
---
|
|
id: sqlite-substrate-safety-comments
|
|
name: SAFETY comments on the substrate UDF blocks, riding a PROVENANCE delta (review 004 item 15)
|
|
status: pending
|
|
depends_on: []
|
|
scope: narrow
|
|
risk: low
|
|
impact: isolated
|
|
level: implementation
|
|
tags: [review-004-fixes, sqlite-engine, substrate, provenance]
|
|
---
|
|
|
|
## Description
|
|
|
|
The eight `unsafe { ctx.get_connection() }` UDF blocks
|
|
(`alkstore-sqlite/src/substrate/ops.rs:147-236`) carry no `// SAFETY`
|
|
justification comments, per
|
|
`docs/reviews/004-pre-release-general-review.md` §"Findings recorded,
|
|
not fixed" item 15. The pattern is the standard rusqlite UDF shape and
|
|
provably constrained, but AGENTS.md's own carve-out ("inline comments
|
|
when a non-obvious safety constraint would otherwise be missed") says
|
|
this is where they'd live.
|
|
|
|
**The constraint that shapes this task**: the substrate is
|
|
lineage-port code under ADR-012 §3's diff-fidelity posture — comments
|
|
must ride a PROVENANCE delta. This task *is* the deliberate delta
|
|
vehicle: add the comments and register the delta; do not treat this as
|
|
a casual edit.
|
|
|
|
Each comment must state the *concrete* invariant that makes the access
|
|
sound (derive it from the rusqlite UDF contract and the substrate's
|
|
actual registration/usage — e.g. the connection the ctx hands out is
|
|
confined to the registered UDF call path on the single connection
|
|
thread), not a generic "this is safe" hand-wave.
|
|
|
|
While there: the review scoped to the eight blocks at ops.rs:147-236,
|
|
but the same `unsafe { ctx.get_connection() }` shape also appears at
|
|
`schema.rs:104` and `ops.rs:742` — check whether they are the same
|
|
class; if so, include them in the same delta (and say so in Notes);
|
|
if not, leave them and record why.
|
|
|
|
## Acceptance Criteria
|
|
|
|
- [ ] Each of the eight UDF blocks (plus any same-class neighbors
|
|
included) carries a `// SAFETY` comment stating the concrete
|
|
soundness invariant
|
|
- [ ] `src/substrate/PROVENANCE.md` carries a dated delta entry
|
|
registering the comment-only change (diff-fidelity posture
|
|
honored; the entry classifies the delta per the register's
|
|
conventions)
|
|
- [ ] No behavioral change: the substrate floor tests and the engine's
|
|
tests green unchanged
|
|
- [ ] `cargo test -p alkstore-sqlite`, clippy `-D warnings`, fmt
|
|
clean; workspace gates green server-less
|
|
|
|
## References
|
|
|
|
- docs/reviews/004-pre-release-general-review.md §"Findings recorded,
|
|
not fixed" item 15 (the finding, the PROVENANCE-delta requirement)
|
|
- docs/architecture/decisions/012-forked-substrate-design.md §3 (the
|
|
diff-fidelity posture)
|
|
- alkstore-sqlite/src/substrate/PROVENANCE.md (the delta register)
|
|
- alkstore-sqlite/src/substrate/ops.rs:147-236 (the eight blocks)
|
|
|
|
## Notes
|
|
|
|
> To be filled by implementation agent
|
|
|
|
## Summary
|
|
|
|
> To be filled on completion |