cadrumo.application.storage_write_policy module

Runtime write-policy decisions for operator command dispatch.

The CLI root asks inspect_storage_write_policy() before opening profile-bound storage. The returned StorageWritePolicyDecision combines the matched StorageWritePolicyCode with the StorageRouteKind derived from Settings.

This module is the application-side route query, not the session opener. The CLI callback’s attached execution policy supplies the write-route scope; this query refuses profile-bound mutations when storage is routed to the root fallback database or to an explicit CADRUMO_DATABASE_URL. A stale settings object with a valid active-profile pointer is reclassified through settings_for_active_profile_bucket() so the root callback sees the same active-bucket route the storage runtime would use.

See also

cadrumo.entrypoints.cli

Root command callback that resolves callback policy, consults this policy, and opens active bucket sessions only after the policy allows dispatch.

cadrumo.core.config.classify_storage_route()

Produces the StorageRouteClassification inspected for guarded mutation paths.

cadrumo.application.operator_actions

Canonical failed-condition, evidence, action, and no-recovery records returned for write-policy refusals.

class StorageWritePolicyCode(*values)[source]

Bases: StrEnum

Machine-readable outcomes from the root write-policy query.

The values distinguish allowed active-bucket writes, state-free or bootstrap-root paths, and the two route-level denials the CLI root must stop before opening profile storage. Each value is carried in the code field of StorageWritePolicyDecision, returned from inspect_storage_write_policy().

ALLOWED_ACTIVE_BUCKET
BOOTSTRAP_EXEMPT
NON_PROFILE_BOUND_VERB
REFUSED_ROOT_FALLBACK
REFUSED_EXPLICIT_DATABASE_URL
class StorageWritePolicyCondition(*values)[source]

Bases: StrEnum

Stable failed-condition identities owned by the write policy.

PROFILE_ACTIVE
ACTIVE_BUCKET_ROUTE
class StorageWritePolicyEvidence(*values)[source]

Bases: StrEnum

Stable evidence identities emitted for write-policy failures.

PROFILE_STORAGE_ROUTE
ACTIVE_BUCKET_ROUTE_CLASSIFICATION
class StorageWritePolicyDecision(**data)[source]

Bases: BaseModel

Decision returned by the backend storage write-policy query.

The CLI root converts refusing decisions into CliRefusedBoundaryError instances; allowed decisions let dispatch continue toward the active-bucket session opener.

Variables:

  • allowed – Whether root dispatch may continue.

  • code – The StorageWritePolicyCode that determined the result.

  • profile_bound_write – Whether callback policy declares a profile-bound storage write route.

  • bootstrap_exempt – Whether callback policy declares a bootstrap-root write route that is permitted before an active bucket exists.

  • route_kind – Effective StorageRouteKind for guarded writes, or None when no route was inspected.

  • message_key – Locale key for a refusal message rendered at the CLI boundary.

  • detail_message_key – Optional nested detail key for the refusal message.

  • verdict – Typed failed-condition outcome for a refusal. Allowed decisions never carry a failed verdict.

Parameters:

data (Any)

allowed: bool
code: StorageWritePolicyCode
profile_bound_write: bool
bootstrap_exempt: bool
route_kind: StorageRouteKind | None
message_key: str
detail_message_key: str
verdict: PreconditionVerdict | None
render_refusal_message(*, locale=None)[source]

Render the translated user-facing refusal message through tr().

Return type:

str

Parameters:

locale (str | None)

inspect_storage_write_policy(write_route, *, settings=None)[source]

Return whether a callback’s declared route may perform storage writes.

Bootstrap-root and non-profile-bound policies are allowed without route inspection. Guarded mutation paths are allowed only when the effective storage route is an active bucket; root fallback and explicit database routes return refusing StorageWritePolicyDecision values before the CLI opens a bucket session. The effective route comes from StorageRouteClassification so root dispatch does not duplicate storage-routing logic.

Unknown values fail closed. The caller obtains the value from validated, CommandSpec-owned policy rather than reconstructing a command path.

Return type:

StorageWritePolicyDecision

Parameters: