Fence commit action writes

Author: cardmagic

CHANGELOG.md

@@ -2,6 +2,8 @@
 
 ## Unreleased
 
+- Keep guarded application databases read-only during commit actions so the
+  supplied fenced transaction connection is the only atomic write path.
 - Persist the start of graceful runtime-role shutdown and expose its timestamp
   so operators can distinguish actively draining processes from dead owners.
 - Release actor, message, effect, reminder, and broadcast ownership atomically

README.md

@@ -442,10 +442,10 @@ const applicationDatabase = guardApplicationDatabase(sqlite({ path: "application
 
 During actor execution, observable and payload projection, and state migration,
 the facade permits `SELECT` through `get()` and `all()` and rejects `run()` or
-row-returning write statements. Registered commit actions run outside that
-read-only context and may write through the same facade. This boundary is
-opt-in: Solid Objects cannot intercept a separate ORM pool or an unwrapped
-database client.
+row-returning write statements. A commit action stays inside the same read-only
+context and writes only through its supplied fenced `context.connection`. This
+boundary is opt-in: Solid Objects cannot intercept a separate ORM pool or an
+unwrapped database client.
 
 ## Inspect and retry terminal failures
 

docs/correctness.md

@@ -35,9 +35,9 @@
   newer owner or generation.
 - `guardApplicationDatabase()` rejects direct application writes during actor
   operations, observable and payload projections, and state migrations. It
-  permits only `SELECT` through row-returning methods; commit actions remain the
-  fenced write path. The guarantee applies only to clients passed through the
-  facade.
+  permits only `SELECT` through row-returning methods. Commit actions remain in
+  that read-only context and may write only through their supplied fenced
+  connection. The guarantee applies only to clients passed through the facade.
 - Snapshots hydrate one committed state image and evaluate every inferred getter
   against it. Getter mutation or staged durable work rejects the whole snapshot;
   successful snapshots and their nested JSON values are frozen copies.

docs/parity.md

@@ -33,7 +33,7 @@ Reference: Ruby `solid_objects` 0.12.0 at commit `a01b6f5`.
 | One-shot and recurring reminders                                                                              | Native  | Scheduling, replacement events, catch-up policy, stale-claim recovery, pausing, authorized inspection, and idempotent resume are implemented.                                                                      |
 | Same-database commit actions                                                                                  | Native  | Registered actions receive source-message identity, mailbox sequence, activation generation, and the fenced transaction connection.                                                                                |
 | Ambient transaction rejection                                                                                 | Native  | Committed calls and message waits fail before blocking when the current async context already owns a transaction on the Solid Objects adapter.                                                                     |
-| Direct application-write isolation during actor code                                                          | Partial | `guardApplicationDatabase()` fails closed for operations, projections, and migrations, while registered commit actions remain writable. Unwrapped ORM pools and third-party clients cannot be intercepted.         |
+| Direct application-write isolation during actor code                                                          | Partial | `guardApplicationDatabase()` fails closed for operations, projections, migrations, and commit actions; only the supplied fenced commit-action connection may write. Unwrapped clients cannot be intercepted.       |
 | Committed snapshots                                                                                           | Native  | `snapshot()` returns authorized persisted fields and inferred getters from one read-only committed state image; realtime replay reads explicit observables without mailbox history.                                |
 | Actor destruction and incarnation fencing                                                                     | Native  | Authorized cascading deletion creates a fresh instance ID on recreation; an authorized waiter receives `ActorDestroyed` when that incarnation disappears.                                                          |
 | Result recovery and sync timeout diagnostics                                                                  | Native  | Status, result, and wait reauthorize the stored operation; terminal failure raises structured `MessageFailed`; whole-call adapter deadlines distinguish enqueue, wait, database, activation, and mailbox blockers. |

src/runtime.ts

@@ -8,7 +8,12 @@ import {
   type ComponentRegistration,
   type SolidObjectsConfiguration,
 } from "./configuration.js"
-import { currentActor, withActorContext, withActorProjection } from "./context.js"
+import {
+  currentActor,
+  withActorContext,
+  withActorProjection,
+  withApplicationWritesForbidden,
+} from "./context.js"
 import { DeadLetterManager, type DeadLetter } from "./dead-letters.js"
 import { Doctor } from "./doctor.js"
 import { clearDefaultRuntime, setDefaultRuntime } from "./default-runtime.js"
@@ -1149,15 +1154,17 @@ export class SolidObjectsRuntime {
           }
           this.emitInstrumentation("commit_action.started", attributes)
           try {
-            await handler(intent.arguments, {
-              actorType: turn.message.actor_type,
-              actorId: turn.message.actor_id,
-              messageId: turn.message.id,
-              requestId: turn.message.request_id,
-              sequence: BigInt(turn.message.sequence),
-              activationGeneration: turn.activationGeneration,
-              connection,
-            })
+            await withApplicationWritesForbidden(() =>
+              handler(intent.arguments, {
+                actorType: turn.message.actor_type,
+                actorId: turn.message.actor_id,
+                messageId: turn.message.id,
+                requestId: turn.message.request_id,
+                sequence: BigInt(turn.message.sequence),
+                activationGeneration: turn.activationGeneration,
+                connection,
+              }),
+            )
             this.emitInstrumentation("commit_action.completed", attributes)
           } catch (error) {
             this.emitInstrumentation("commit_action.failed", {

test/application-database.test.ts

@@ -36,6 +36,10 @@ class DatabaseActor extends Actor {
   writeAfterCommit(): void {
     this.commitAction("writeRecord", { value: "committed" })
   }
+
+  writeOutsideFence(): void {
+    this.commitAction("writeExternalRecord", { value: "escaped" })
+  }
 }
 
 afterEach(async () => {
@@ -57,12 +61,30 @@ describe("guarded application database", () => {
     await expect(actor.read()).resolves.toBe("initial")
   })
 
-  it("allows a registered commit action to use the same facade", async () => {
+  it("allows a registered commit action to use its fenced connection", async () => {
     await configureDatabases()
 
     await DatabaseActor.ref("commit").writeAfterCommit()
 
-    await expect(DatabaseActor.ref("commit").read()).resolves.toBe("committed")
+    const record = await runtime?.settings.database.connection((connection) =>
+      connection.get<{ value: string }>("SELECT value FROM committed_records WHERE id = 1"),
+    )
+    expect(record?.value).toBe("committed")
+  })
+
+  it("rolls back a commit action that writes outside its fenced connection", async () => {
+    await configureDatabases()
+    const message = await DatabaseActor.ref("external").send.writeOutsideFence()
+
+    expect(await runtime?.worker().runUntilIdle()).toBe(1)
+
+    await expect(message.result()).rejects.toMatchObject({
+      details: {
+        name: "ApplicationWriteForbidden",
+        message: "application database writes are forbidden during actor execution",
+      },
+    })
+    await expect(DatabaseActor.ref("external").read()).resolves.toBe("initial")
   })
 
   it("rejects write statements disguised as row-returning reads", async () => {
@@ -129,7 +151,14 @@ async function configureDatabases(): Promise<void> {
     maxAttempts: 1,
   })
   runtime.register(DatabaseActor)
-  runtime.registerCommitAction("writeRecord", async ({ value }) => {
+  await runtime.settings.database.connection(async (connection) => {
+    await connection.run("CREATE TABLE committed_records (id INTEGER PRIMARY KEY, value TEXT)")
+    await connection.run("INSERT INTO committed_records (id, value) VALUES (1, 'initial')")
+  })
+  runtime.registerCommitAction("writeRecord", async ({ value }, context) => {
+    await context.connection.run("UPDATE committed_records SET value = ? WHERE id = 1", [value])
+  })
+  runtime.registerCommitAction("writeExternalRecord", async ({ value }) => {
     await applicationDatabase.connection((connection) =>
       connection.run("UPDATE records SET value = ? WHERE id = 1", [value]),
     )