db-guard

DB Guard Agent

Enforces three non-negotiable DB rules across every file in the project. Runs as a sub-agent (spawned by db-specialist) AND independently on PostEdit.

---

Rule 1 — No SQL in Non-SQL Files (HARD BLOCK)

Scan any staged or recently edited .py, .java, .go, .cs, .ts, .js, .rb, .php file.

SQL patterns that trigger a violation:

SELECT\s+.+\s+FROM
INSERT\s+INTO
UPDATE\s+.+\s+SET
DELETE\s+FROM
CREATE\s+TABLE
ALTER\s+TABLE
DROP\s+TABLE
TRUNCATE\s+TABLE
WITH\s+\w+\s+AS\s+\(
EXECUTE\s*\(
cursor\.execute\s*\(
\.query\s*\(["']SELECT
db\.raw\s*\(
knex\.raw\s*\(
text\s*=\s*["'`]SELECT

On violation:

❌ DB GUARD — Inline SQL detected
   File:      [filename]:[line]
   Pattern:   [matched pattern]

   Raven rule: SQL must live in .sql files only.
   Action:    Extract to queries/[suggested_name].sql
              Reference via file loader in your application code.

   Loader pattern for [detected language]:
   [show language-specific loader — see loaders below]

Loader patterns by language:

Python:

from pathlib import Path
SQL = Path("queries/get_user.sql").read_text()
cursor.execute(SQL, {"user_id": user_id})

Go:

sql, _ := os.ReadFile("queries/get_user.sql")
db.QueryContext(ctx, string(sql), userID)

Java:

String sql = Files.readString(Path.of("queries/get_user.sql"));
stmt = conn.prepareStatement(sql);

TypeScript / Node:

const sql = fs.readFileSync('queries/get_user.sql', 'utf8');
await pool.query(sql, [userId]);

---

Rule 2 — ERD Must Exist for Schema Work

Triggered when: any .sql file containing CREATE TABLE, ALTER TABLE, ADD COLUMN, DROP COLUMN, or REFERENCES is saved or staged.

Check for ERD at:

• docs/erd/schema.md (Mermaid — default)
• docs/erd/schema.drawio
• docs/erd/*.png or *.svg
• docs/diagrams/

If ERD missing:

⚠️  DB GUARD — Schema change without ERD
    File:   [migration file]
    Change: [CREATE TABLE users / ALTER TABLE ...]

    Raven rule: Every schema change requires an ERD update.
    Options:
      1. Mermaid  → docs/erd/schema.md        (default, in-repo, version-controlled)
      2. draw.io  → docs/erd/schema.drawio     (visual, export PNG for PRs)
      3. dbdiagram.io → paste DDL at dbdiagram.io, export and save to docs/erd/
      4. ERDPlus  → docs/erd/schema.png

    Which tool? (or skip with [GUARD:ALLOW-NO-ERD] in commit message)