Skip to content

0011: Separate RSDB access from domain behavior

Services owns legacy behavior; RSDB owns typed MySQL access and resources

  • Status: Accepted
  • Date: 2026-09-18
  • Decision maker: Trevor Gerhardt

Context

MIDOT uses legacy property value projects stored in Rackspace MySQL. They are distinct from shared organization Projects. A generic SQL reader would let application code select a database and query outside a reviewed boundary.

Decision

A database-specific Services entry point owns legacy domain operations, validation, calculations, and safe errors. A matching RSDB entry point binds one registered database and its complete generated schema, and holds the repositories that query it. RSDB owns Drizzle sessions, queries, transactions, deadlines, connection cleanup, and one private reusable MySQL engine. Application code cannot access the generic factory or choose an arbitrary database.

The concrete read capability exposes selection in a read-only transaction. The write capability exposes typed selection and data changes in one database transaction. Neither exposes raw execution, stored procedures, or cross-database atomicity. Each operation owns its connection. Uncertain connections are destroyed. Layer construction opens no network connection.

Property value operations use their legacy numeric user and project IDs. The caller supplies the authorized user ID. These operations do not use Concourse organization permissions or the SQLite audit writer. MySQL write failures have an unknown outcome and do not trigger automatic retries. MIDOT exposes the property value operations for the signed-in TREDIS account only. The Global Dynamic operations have no HTTP routes. MIDOT sign-in uses only the Global Dynamic sign-in service, through the MIDOT sign-in workflows in the same Services entry point.

The RSDB guide owns database bindings and resource limits. The Services guide owns the domain operations. The Rackspace security page owns the shared credential and its accepted risks.

Global Dynamic follows the same boundary. PRD-0007 owns its product requirements, including which operations stay unsupported.

Consequences

  • Each new application database needs a reviewed concrete binding.
  • Generation, inspection, and verification remain read-only despite the credential's data-change grants.
  • The current MIDOT flow does not expose the new write operations to users.