Store security profiles¶
Store security profiles make each official adapter's data-handling and operational boundary inspectable in code. They are configuration claims for the tested adapter—not legal, regulatory, or third-party certifications.
from threvo_actions.store_security import official_store_security_profiles
for profile in official_store_security_profiles():
print(profile.identifier, profile.support_tier)
for claim in profile.guarantee_enforcement:
print(claim.guarantee, claim.level)
Current profiles¶
| Profile | Intended topology | Privilege boundary | Qualification targets |
|---|---|---|---|
postgresql/v1 |
Multi-process | Separate database roles | PostgreSQL 15 and 16 |
mysql/v1 |
Multi-process | Separate users with direct grants | MySQL 8.0 and 8.4 |
sqlite/v1 |
Bounded single writer | Process boundary only | CPython sqlite3 on Python 3.11-3.13 |
Every profile requires the host to protect private state before persistence. No official adapter configures storage encryption, authenticates the issuer named in evidence, or erases WAL/binary logs/journals, replicas, snapshots, exports, and backups. The profile exposes those facts as false fields so an application cannot infer them from adapter support.
Per-guarantee enforcement¶
Each profile reports where four security-relevant persistence guarantees are
enforced. database_engine means database constraints, transactions, triggers,
procedures, or privileges defend the guarantee beneath ordinary adapter code.
adapter_process means bypassing that process also bypasses the claim.
unsupported means the profile does not provide the guarantee.
| Guarantee | PostgreSQL | MySQL | SQLite |
|---|---|---|---|
| Lifecycle transitions | Database engine | Database engine | Database engine |
| Atomic effect admission | Database engine | Database engine | Database engine |
| Append-only active evidence | Database engine | Database engine | Adapter process |
| Role-separated erasure | Database engine | Database engine | Unsupported |
These levels describe the qualified adapter configuration, not every account with administrative access. Database owners and infrastructure operators remain outside the ordinary runtime/retention boundary.
independent_connection_conformance=True means the repository runs the shared
race scenario for that official profile. PostgreSQL and MySQL receive two
separately created pools; SQLite receives two store instances that independently
open the same file. The scenario proves:
- a write through one connection source is visible through the other;
- two stale compare-and-set attempts have exactly one winner;
- two proposals racing one semantic effect produce one acquisition and one conflict; and
- both connection sources resolve the same effect owner.
It does not prove network security, credential rotation, backup deletion, availability, or exactly-once effects outside the action database.
Qualify a custom store¶
Run the generic store contract first. Then supply two adapters backed by separately created connection sources to the independent-connection check:
from threvo_actions.conformance import (
IndependentStoreConformanceCase,
assert_independent_store_connections_conform,
)
report = await assert_independent_store_connections_conform(
IndependentStoreConformanceCase(
first_store=store_from_first_pool,
second_store=store_from_second_pool,
original=fresh_proposal,
evidence=bound_evidence,
observed_at=clock.now(),
security_profile_identifier="acme-document-store/v1",
)
)
print(report.checks)
The helper cannot inspect whether the caller truly created independent connections. Your test fixture owns that proof and must use a fresh isolated database. Record the database product/version, isolation level, connection topology, migration state, and test run outside this deterministic report.
store_security ¶
Machine-readable security boundaries for official action stores.
_DATABASE_ENGINE_GUARANTEES
module-attribute
¶
_DATABASE_ENGINE_GUARANTEES = tuple(StoreGuaranteeEnforcement(guarantee, StoreGuaranteeLevel.DATABASE_ENGINE) for guarantee in StoreGuarantee)
POSTGRESQL_STORE_SECURITY_PROFILE
module-attribute
¶
POSTGRESQL_STORE_SECURITY_PROFILE = StoreSecurityProfile(identifier='postgresql/v1', adapter=DatabaseAdapter.POSTGRESQL, support_tier=StoreSupportTier.PRODUCTION_ORIENTED_OFFICIAL, writer_topology=StoreWriterTopology.MULTI_PROCESS, privilege_boundary=StorePrivilegeBoundary.DATABASE_ROLES, guarantee_enforcement=_DATABASE_ENGINE_GUARANTEES, qualification_targets=('PostgreSQL 15', 'PostgreSQL 16'), independent_connection_conformance=True, requires_host_protected_private_state=True, adapter_manages_at_rest_encryption=False, adapter_authenticates_evidence_issuers=False, adapter_erases_external_copies=False, limitations=('logical erasure does not erase WAL, replicas, snapshots, exports, or backups', 'target-side idempotency and authoritative verification remain host responsibilities'))
MYSQL_STORE_SECURITY_PROFILE
module-attribute
¶
MYSQL_STORE_SECURITY_PROFILE = StoreSecurityProfile(identifier='mysql/v1', adapter=DatabaseAdapter.MYSQL, support_tier=StoreSupportTier.PRODUCTION_ORIENTED_OFFICIAL, writer_topology=StoreWriterTopology.MULTI_PROCESS, privilege_boundary=StorePrivilegeBoundary.DATABASE_ROLES, guarantee_enforcement=_DATABASE_ENGINE_GUARANTEES, qualification_targets=('MySQL 8.0', 'MySQL 8.4'), independent_connection_conformance=True, requires_host_protected_private_state=True, adapter_manages_at_rest_encryption=False, adapter_authenticates_evidence_issuers=False, adapter_erases_external_copies=False, limitations=('logical erasure does not erase binary logs, undo history, replicas, exports, or backups', 'MariaDB and MySQL 5.7 are outside the official profile'))
SQLITE_STORE_SECURITY_PROFILE
module-attribute
¶
SQLITE_STORE_SECURITY_PROFILE = StoreSecurityProfile(identifier='sqlite/v1', adapter=DatabaseAdapter.SQLITE, support_tier=StoreSupportTier.BOUNDED_USE_OFFICIAL, writer_topology=StoreWriterTopology.BOUNDED_SINGLE_WRITER, privilege_boundary=StorePrivilegeBoundary.PROCESS_ONLY, guarantee_enforcement=(StoreGuaranteeEnforcement(StoreGuarantee.LIFECYCLE_TRANSITIONS, StoreGuaranteeLevel.DATABASE_ENGINE), StoreGuaranteeEnforcement(StoreGuarantee.ATOMIC_EFFECT_ADMISSION, StoreGuaranteeLevel.DATABASE_ENGINE), StoreGuaranteeEnforcement(StoreGuarantee.APPEND_ONLY_EVIDENCE, StoreGuaranteeLevel.ADAPTER_PROCESS), StoreGuaranteeEnforcement(StoreGuarantee.ROLE_SEPARATED_ERASURE, StoreGuaranteeLevel.UNSUPPORTED)), qualification_targets=('CPython sqlite3 on Python 3.11-3.13',), independent_connection_conformance=True, requires_host_protected_private_state=True, adapter_manages_at_rest_encryption=False, adapter_authenticates_evidence_issuers=False, adapter_erases_external_copies=False, limitations=('no database-role separation between runtime and retention', 'logical erasure does not erase free pages, journals, WAL files, snapshots, or backups', 'not qualified for general multi-worker financial production use'))
DatabaseAdapter ¶
StoreSupportTier ¶
StoreWriterTopology ¶
StorePrivilegeBoundary ¶
StoreGuarantee ¶
Bases: StrEnum
A persistence guarantee that an adapter may enforce at different levels.
StoreGuaranteeLevel ¶
Bases: StrEnum
The boundary responsible for enforcing one persistence guarantee.
StoreGuaranteeEnforcement
dataclass
¶
StoreGuaranteeEnforcement(guarantee: StoreGuarantee, level: StoreGuaranteeLevel)
The enforcement level claimed for one qualified store guarantee.
StoreSecurityProfile
dataclass
¶
StoreSecurityProfile(identifier: str, adapter: DatabaseAdapter, support_tier: StoreSupportTier, writer_topology: StoreWriterTopology, privilege_boundary: StorePrivilegeBoundary, guarantee_enforcement: tuple[StoreGuaranteeEnforcement, ...], qualification_targets: tuple[str, ...], independent_connection_conformance: bool, requires_host_protected_private_state: bool, adapter_manages_at_rest_encryption: bool, adapter_authenticates_evidence_issuers: bool, adapter_erases_external_copies: bool, limitations: tuple[str, ...])
Data-handling and operating claims for one store configuration.
guarantee_enforcement
instance-attribute
¶
guarantee_enforcement: tuple[StoreGuaranteeEnforcement, ...]
requires_host_protected_private_state
instance-attribute
¶
adapter_authenticates_evidence_issuers
instance-attribute
¶
official_store_security_profiles ¶
official_store_security_profiles() -> tuple[StoreSecurityProfile, ...]
Return the immutable profiles maintained by this project.