Story: Add sandboxes and virtual books
Table of Contents
This page documents a story in Sprint 26. It captures the goal, current status, acceptance criteria, and the tasks that compose it.
1. Goal
Let users import and experiment without disturbing official data, as the Sandbox note describes, and within the regulatory boundary it checks.
2. Status
| Field | Value |
|---|---|
| State | DONE |
| Parent sprint | Sprint 26 |
| Now | Nothing. |
| Waiting on | Nothing. |
| Next | Nothing. |
| Last touched | 2026-10-03 |
3. Acceptance
- A sandbox is an entity with purpose, anchor, owner, visibility, status and review date, and its own portfolio tree that no official portfolio contains.
- Opening a sandbox needs the right at its anchor; visibility follows the anchor's permissions or named members.
- A virtual book belongs to exactly one sandbox and has no ledger book.
- Official reports cannot select a sandbox.
4. Tasks
| Task | State | Start | End | Description |
|---|---|---|---|---|
| Grant rights at portfolio nodes | DONE | 2026-10-03 | 2026-10-03 | Let an account hold a named right at a node of the portfolio tree, inherited by everything below it, starting with the rights to read a node and to open sandboxes there. |
| Model sandboxes | DONE | 2026-10-03 | 2026-10-03 | Generate sandbox and sandbox_member in ores.refdata, give portfolios a sandbox so each sandbox has its own tree, and check the right to open one at its anchor. |
| Model virtual books | DONE | 2026-10-03 | 2026-10-03 | Let a book belong to a sandbox: a virtual book sits in its sandbox's portfolio tree, never maps to the ledger, and is seen only by those who may see the sandbox. |
| Keep sandboxes out of official reports | DONE | 2026-10-03 | 2026-10-03 | Mark report definitions as official or not, and keep sandbox portfolios and virtual books out of an official report's scope and of the books it resolves. |
| Close the official report loopholes | DONE | 2026-10-03 | 2026-10-03 | Refuse moving a risk report configuration with sandbox scope under an official definition, and keep a sandbox portfolio's books out of an official report's resolved set. |
5. Decisions
- Rights at a node of the portfolio tree did not exist; the story adds the smallest model that meets its acceptance: an account holds a named right at a node, inherited down the tree. General book access adopts it later.
- The rule that a booking names a virtual book only for a draft, a test or a hypothetical moves to the story that splits the trade, which creates the booking.
6. Out of scope
7. Result
Users can import and experiment in sandboxes without touching official data, and the database enforces it.
- Rights at portfolio nodes:
readandopen_sandbox, inherited down the tree (PR 2544). - Sandboxes anchored at the official tree, with members, their own portfolio tree, the open right checked at the anchor, and a row-level security policy that hides a sandbox's portfolios from everyone who may not see it (PR 2550).
- Virtual books: books in a sandbox, with no ledger reference, never a sweep target, covered by the same policy (PR 2552).
- Official reports: report definitions are official by default, and an official report can neither scope nor resolve sandbox data (PR 2561, with the review's two loopholes closed in a follow-up).
- 35 pgTAP cases cover the story's database rules.
- The rule that a booking names a virtual book only for a draft, a test or a hypothetical moved to the story that splits the trade.