[Arch] Overuse of module-level global state for cross-request coordination (informational) #69

Closed
opened 2026-07-01 07:27:27 +02:00 by bullitt · 1 comment
Owner

Severity: Low | Category: Architecture

_write_timestamps, _ingest_timestamps (main.py), _last_manual_scrape (scheduler.py), _login_attempts (auth.py) are plain module-level mutable globals shared across concurrent requests and the background scheduler task.

Recommendation: No urgent action — safe under the current single-instance, single-process deployment (an equivalent trade-off is already made consciously in notifiers/mqtt.py, per docs/architecture.md). If multi-instance deployment is ever planned, this is the exact list of state that needs to move to a shared store first.

Full detail: docs/architecture-review.md § C, Finding "Overuse of module-level global state..." and § G

**Severity:** Low | **Category:** Architecture `_write_timestamps`, `_ingest_timestamps` (main.py), `_last_manual_scrape` (scheduler.py), `_login_attempts` (auth.py) are plain module-level mutable globals shared across concurrent requests and the background scheduler task. **Recommendation:** No urgent action — safe under the current single-instance, single-process deployment (an equivalent trade-off is already made consciously in `notifiers/mqtt.py`, per docs/architecture.md). If multi-instance deployment is ever planned, this is the exact list of state that needs to move to a shared store first. Full detail: `docs/architecture-review.md` § C, Finding "Overuse of module-level global state..." and § G
Author
Owner

Closing without a code change. This finding was explicitly informational in docs/architecture-review.md: "No urgent action — safe under the current single-instance, single-process deployment... If multi-instance deployment is ever planned, this is the exact list of state that needs to move to a shared store first." All other actionable findings from the review have now been implemented on architecture-rework. Re-open if multi-instance deployment is ever planned — the finding body lists the exact globals (_write_rate_limiter/_ingest_rate_limiter/_manual_scrape_rate_limiter after the rate_limit.py consolidation, plus _login_attempts in auth.py) that would need to move to shared storage first.

Closing without a code change. This finding was explicitly informational in `docs/architecture-review.md`: "No urgent action — safe under the current single-instance, single-process deployment... If multi-instance deployment is ever planned, this is the exact list of state that needs to move to a shared store first." All other actionable findings from the review have now been implemented on `architecture-rework`. Re-open if multi-instance deployment is ever planned — the finding body lists the exact globals (`_write_rate_limiter`/`_ingest_rate_limiter`/`_manual_scrape_rate_limiter` after the rate_limit.py consolidation, plus `_login_attempts` in auth.py) that would need to move to shared storage first.
Sign in to join this conversation.
No labels
arch
harness
security
ux
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
bullitt/trackbox#69
No description provided.