eSlider/swarm-house
1
0
Fork 0
Code Issues 2 Pull Requests 3 Actions Packages Projects 1 Releases 13 Wiki Activity

docs: adopt read-only SQL-over-SSH as the peer query decision

Browse Source 
Record the full reasoning path (GraphQL service, Arrow Flight, raw SSH,
forced-command synthesis) and specify read-only enforcement as five
fail-safe layers: key-per-operation, SELECT-only statement gate,
read-only OS user, engine hardening, resource caps. Promote 'SQL is
the contract' to a top-level design principle.
This commit is contained in:
eSlider
2026-07-08 13:29:41 +01:00
parent 8f98a0c994
commit 523e15f490
3 changed files with 32 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/02-architecture.md
+1 -1
View File
@@ -56,7 +56,7 @@ graph TB
- The **event hook** is the on-board "lambda": when the writer lands new *derived* rows (state, detections), it triggers registered actions — broadcast, MinIO upload, or a local mission-logic callback. Nothing polls.
- The **state publisher** broadcasts compact position/attitude/detection payloads over the mesh pub/sub (transport analysis in [04 — Swarm sync](04-swarm-sync.md)).
- **Bulk sync** pulls sealed derived partitions from peers over persistent SSH (rsync delta transfer); MinIO remains optional where an S3 API is wanted.
- **Peer queries** run against local DuckDB via SSH forced commands — allow-listed query templates, columnar responses (the standard is in [04](04-swarm-sync.md)).
- **Peer queries** are read-only DuckDB SQL over SSH forced commands — SELECT-only gate, read-only OS user, columnar responses (the design decision and its reasoning are in [04](04-swarm-sync.md)).
## Communication planes