Architecture Validation: 5 violations found (2 critical)

[vybe]

Automated Architecture Validation Report

Date: 2026-04-28
Result: 5 violations found — 2 critical (P0-P1), 3 moderate

Critical Findings (P0-P1)

Invariant #1 — Three-Layer Backend: Router → Service → DB

Raw SQL found in router files (routers must not contain SQL):

• routers/telegram.py
• routers/public.py
• routers/auth.py
• routers/fan_out.py
• routers/slack.py
• routers/triggers.py
• routers/voice.py
• routers/processes.py
• routers/git.py

Fix: Move all SQL into db/ layer modules.

Invariant #3 — Schema in db/schema.py, Migrations in db/migrations.py

CREATE TABLE statements found outside schema.py/migrations.py:

• routers/processes.py — CREATE TABLE IF NOT EXISTS process_schedules
• services/process_engine/services/templates.py — CREATE TABLE IF NOT EXISTS process_templates
• services/process_engine/services/alerts.py — CREATE TABLE IF NOT EXISTS cost_thresholds, cost_alerts

Fix: Move DDL to db/schema.py and add versioned migrations in db/migrations.py.

Moderate Findings

Invariant #6 — Frontend: Store = Domain, View = Page

Direct api.get/post calls in view components (should go through Pinia stores):

• ProcessList.vue:404
• ProcessWizard.vue:522, 600
• ProcessEditor.vue:1100, 1181, 1230, 1339, 1500

Invariant #10 — Process Engine: DDD Isolation

Router files import directly from process_engine.domain and process_engine.repositories (should only interact via service facades):

• routers/executions.py — multiple domain/engine imports
• routers/processes.py — multiple domain/repository imports
• routers/approvals.py, routers/audit.py, routers/triggers.py, routers/alerts.py

Invariant #15 — Pydantic Models Centralized in models.py

87 model classes defined in routers vs 26 in models.py (77% scattered):

• Heaviest offenders: settings.py (8), processes.py (8), telegram.py (6), executions.py (6)

Recommended Actions

1. P0: Move SQL out of all router files into db/ layer modules (Fix: Add missing Docker labels to system agent container #1)
2. P0: Move ad-hoc CREATE TABLE into schema.py + migrations.py (Feature/vector log retention #3)
3. P1: Refactor Process Engine router imports to use service facades only (Feature/process engine #10)
4. P2: Move view-level API calls into Pinia stores (Feature/process engine #6)
5. P2: Migrate scattered Pydantic models to models.py (Security: Agent Credential Leakage in Execution Logs [FIXED] #15)

---

Generated by scheduled /validate-architecture run

[pavshulin]

Superseded by today's daily reports: #603 (architecture), #604 (schema), #605 (config). Closing to keep the latest snapshot canonical.