loom-kernel 10.1.0__tar.gz → 10.3.0__tar.gz

{loom_kernel-10.1.0 → loom_kernel-10.3.0}/CHANGELOG.md

@@ -1,7 +1,90 @@
 # Unreleased
 
+## 💥 Breaking
+
+### lambda
+
+- **lambda:** `identity` is required on `eventbridge`, `s3`, `sns` and
+  `schedule` triggers: a trigger without one fails to load, so no automatic
+  change runs without an actor. An `identity.attributes` key under the
+  reserved `loom:` prefix fails to load too.
+
+- **lambda:** the deploy manifest reuses the loader: `served_routes(source,
+  select_interfaces=None)` reads and validates `app.rest.interfaces` and
+  `app.rest.disable_routes` itself, the placeholders are read by OmegaConf's
+  grammar (`loom.core.config.resolver.referenced`; an escaped `\${secrets:...}`
+  is no longer listed, `${secrets:a,b}` names `a`), the resolvers' `.reference()`
+  methods are gone and `FunctionManifest.event` is a `dict` with the same keys
+  the removed `Route`, `HttpEvent`, `QueueEvent`, `OnFailure` and `DirectEvent`
+  structs encoded. The JSON does not change. `omegaconf` is bound to `<2.4`:
+  the manifest reads its generated grammar (`loom.core.config._interpolations`).
+
+- **lambda:** one adapter, `LambdaAdapter`, serves every Lambda function: it
+  binds the handler of the trigger the deployed function declares. Nothing
+  of the previous surface remains:
+
+  | Before | Now |
+  |---|---|
+  | `LambdaHTTPAdapter()` | `LambdaAdapter()` |
+  | `LambdaSQSAdapter(jobs=...)` | `LambdaAdapter(jobs=...)` on a function with `trigger: {source: jobs}` |
+  | `app.entry: lambda_http` | `app.entry: lambda` |
+  | `app.entry: lambda_sqs` | `app.entry: <function>` with `trigger: {source: jobs}` |
+  | `lambda.functions.<f>.http: [...]` | `lambda.functions.<f>.trigger: {source: http, interfaces: [...]}` |
+  | `lambda.functions.<f>.auth` | `lambda.functions.<f>.trigger.auth` |
+  | `lambda.functions.<f>.sqs: true` | `lambda.functions.<f>.trigger: {source: jobs, queue: {name: ...}}` |
+  | `lambda.functions.<f>.queue`, `batch_size`, `batching_window_s`, `max_concurrency`, `report_batch_item_failures` | The same keys under `trigger.queue` (`queue` becomes `queue.name`) |
+  | `loom.serverless.aws.lambda_.http` | `loom.serverless.aws.lambda_.triggers.http` |
+  | `loom.serverless.aws.lambda_.sqs.SQSBatchFailedError` | `loom.serverless.aws.lambda_.SQSBatchFailedError` |
+  | `loom.serverless.aws.lambda_.sqs.SQSHandler` | `loom.serverless.aws.lambda_.LambdaHandler` |
+  | `loom.serverless.aws.lambda_.LambdaHTTPHandler` | `LambdaHandler`; the class is internal |
+  | `loom.serverless.aws.lambda_.sqs.DuplicateJobName` | `loom.core.discovery.worker.DuplicateJobName` |
+  | `loom.serverless.aws.lambda_.sqs.MALFORMED_JOB`, `TIMEOUT_SAFETY_MARGIN_MS` | Internal |
+  | `loom.testing.sqs_record(Job, payload, ...)` | `loom.testing.LambdaEvent.jobs(Job, payload, ...)` |
+  | `loom.testing.sqs_raw_record(body, ...)` | `loom.testing.LambdaEvent.sqs_record(body, ...)["Records"][0]` |
+  | Deploy manifest `manifest_version: 1`, event `type` (`http`, `sqs`) | `manifest_version: 2`: each function's `source` and `via` |
+
+  `loom.serverless.aws.lambda_` exports `LambdaAdapter`, `LambdaHandler`,
+  `LambdaUnservedConfigError`, `S3Object` and `SQSBatchFailedError` only.
+
+### config
+
+- **config:** a `config.overridable` entry reaching `lambda.handler`,
+  `app.discovery` or `lambda.functions.*.trigger` stops every load, as one
+  reaching `aws` or `sqs.queues` does; `app.*` is such an entry.
+
 ## ✨ Features
 
+### audit
+
+- **audit:** a model marked `Audited` records every insert, delete and
+  value-changing update in its store's `audit_log`: the person
+  (`subject`, `mechanism`, `on_behalf_of`), the request (`trace_id`), the
+  changed columns, the row's scopes and the connection. Written by a trigger
+  of guard revision 3 in the same transaction, append-only for everyone,
+  readable only by the `<schema>_auditor` role, partitioned by month.
+  Excluded and secret columns are recorded as redacted. Configured under
+  `stores.<name>.schema.audit` (`enabled`, `retention_months`, `reader`).
+  Run `loom schema bootstrap` from this release before marking a table:
+  revision 3 is one-way, and an application with audited tables refuses to
+  start on an older guard. See "Audit" in the Postgres RLS guide and ADR 0009.
+- **audit:** every transaction on an external Postgres store sets
+  `loom.actor.subject`, `loom.actor.mechanism`, `loom.actor.on_behalf_of`
+  and `loom.trace_id`, scoped store or not. A product `SessionSettings` may
+  not set any `loom.` key.
+- **audit:** the identity of an event trigger acts on behalf of the caller
+  AWS recorded: an S3 record's `userIdentity.principalId`, or the
+  `detail.userIdentity.arn` of an EventBridge event from an `aws.` source.
+  `loom:on_behalf_of` is reserved: JWT claims under `loom:` are dropped.
+- **cli:** `loom schema bootstrap` (as the superuser, sets the migrator's and
+  each login's password from `LOOM_DB_PASSWORD_<USER>`), `loom schema verify`
+  (exit 1 on drift, lists expired audit partitions) and
+  `loom schema audit drop-expired` (one partition past the retention per run).
+- **audit:** the log's partitions are UTC months kept twelve months ahead by
+  every deploy and by `loom schema audit ensure-partitions`, meant for a
+  scheduler; `verify` fails and startup warns with fewer than three months left.
+- **check:** `loom check --deploy` warns (`loom.audit.W001`) about a store
+  whose audit is disabled.
+
 ### jobs
 
 - **jobs:** `app.job_service` (`inline`, `celery` or `module:Class` built with
@@ -11,30 +94,38 @@
   injecting `JobService`.
 - **jobs:** `app.job_service: sqs` (extra `loom[sqs]`) sends each job to the
   SQS queue `sqs.queues` maps its queue to, after the commit, as the
-  `JobEnvelope` the Lambda SQS adapter runs. `sqs:` inherits `aws:`.
+  `JobEnvelope` a Lambda `jobs` function runs. `sqs:` inherits `aws:`.
   FIFO queues take the SHA-256 of the new `Job.__group_by__` payload field as
   `MessageGroupId`. Callbacks, priorities, delays SQS cannot honour and bodies
   over 256 KiB raise `SQSDispatchError`; unmapped queues stop startup.
 - **jobs:** an execution's SQS jobs leave after the commit in
   `SendMessageBatch` calls per queue, in dispatch order (`sqs.batch`,
   `sqs.batch_size`, `sqs.max_concurrent_sends`); a standard queue resends the
-  entries SQS refuses once, a FIFO queue stops at its first failure. `lambda.functions.<name>` with `sqs: true` declares `batch_size`,
+  entries SQS refuses once, a FIFO queue stops at its first failure. A
+  Lambda `jobs` trigger's `queue` block declares `batch_size`,
   `batching_window_s`, `max_concurrency` and `report_batch_item_failures`;
   `false` makes the SQS handler fail the whole batch.
 
 ### lambda
 
+- **lambda:** event triggers: `trigger: {source: eventbridge | s3 | sns |
+  schedule, job, identity}` runs the job for each event, directly or through
+  a `queue:` block, as the configured identity only. A failed job fails the
+  event, which Lambda retries, then sends to its on-failure destination;
+  through a queue it is reported, then dead-lettered. See "Event triggers" in
+  the composition guide.
 - **lambda:** `loom deploy manifest <config> [--function x]` prints a
-  versioned JSON manifest (`manifest_version: 1`) of each function of
+  versioned JSON manifest (`manifest_version: 2`) of each function of
   `lambda.functions` for a deployment tool: the handler, code path and
-  queues once, then per function its http routes and `auth` or its sqs queue
-  and event source mapping, and the secret and SSM parameter names it
-  resolves (never values; no resolver runs). It runs the deploy
-  checks of `loom check --deploy` first, prints their findings to stderr and
-  no manifest when one fails. New keys: `lambda.handler` and
-  `lambda.functions.<name>.queue` (a key of `sqs.queues`), both required by
-  the manifest only.
-- **rest:** `loom.rest.E001` also fails a `lambda.functions.<name>.auth`
+  queues once, then per function its trigger's `source` and `via`, what its
+  event needs deployed (http routes and `auth`, the queue and its event
+  source mapping, or a direct trigger's job, identity and `on_failure`), and
+  the secret and SSM parameter names it resolves (never values; no resolver
+  runs). It runs the deploy checks of `loom check --deploy` first, prints
+  their findings to stderr and no manifest when one fails. `lambda.handler`
+  and a trigger's `queue` (a key of `sqs.queues`) are required by the
+  manifest only.
+- **rest:** `loom.rest.E001` also fails a `lambda.functions.<name>.trigger.auth`
   that names no mechanism (`{}`, `jwt: null`, `custom: false`): it replaces
   `app.rest.auth` for that function.
 
@@ -42,9 +133,10 @@
 
 - **testing:** Lambda functions are tested in process, without AWS:
   `LambdaTestClient`, an `httpx.Client` like FastAPI's `TestClient`, sends API
-  Gateway HTTP API or REST events to the real handler; `sqs_record` and
-  `sqs_raw_record` drive the SQS handler with the `JobEnvelope`
-  `SQSJobService` sends; `RecordingJobService`
+  Gateway HTTP API or REST events to the real handler;
+  `LambdaEvent` builds the event AWS delivers, one typed constructor per
+  trigger source (`LambdaEvent.s3([...])`, `.sns({...})`, `.jobs(Job, ...)`)
+  and `.via_sqs()` for the queue in between; `RecordingJobService`
   (`app.job_service: loom.testing:RecordingJobService`) records each dispatch
   after the commit. The `testing` extra now includes `httpx`.
 
@@ -150,6 +242,52 @@
   raise `NotImplementedError`. Cache scenarios and frames, not runners: tests
   that mutate state need a function-scoped runner on their own `tmp_path`.
 
+## 💥 Breaking
+
+### errors
+
+- **errors:** `loom.core.errors` is a package split by area (`base`, `domain`,
+  `auth`, `model`, `jobs`, `stores`, `codes`) and re-exports every error, so
+  `from loom.core.errors import X` is unchanged. The errors below are
+  importable only from `loom.core.errors`; their old paths, and the package
+  re-exports that pointed at them, are gone:
+
+  | Old path | New path |
+  |---|---|
+  | every class of the removed `errors` submodule of `loom.core.errors` | `loom.core.errors` |
+  | `loom.core.uow.scope.ScopeOwnershipError`, `UnitOfWorkInsideScope`, `UndeclaredStoreWrite`, `NestedIdentityMismatch`, `NestedElevation`, `StoresNotCommitted` (also `loom.core.uow.*`) | `loom.core.errors` |
+  | `loom.core.uow.coordinator.UncomposedStore` | `loom.core.errors` |
+  | `loom.core.job.handle.JobTimeoutError`, `JobFailedError` (also `loom.core.job.*`) | `loom.core.errors` |
+  | `loom.core.job.router.MixedJobBackendsError` (also `loom.core.job.*`) | `loom.core.errors` |
+  | `loom.core.engine.post_commit.PostCommitError` (also `loom.core.engine.*`) | `loom.core.errors` |
+  | `loom.core.model._loom_type.BoundaryValidationError`, `UnsupportedBoundaryType` (also `loom.core.model.*`) | `loom.core.errors` |
+  | `loom.core.repository.abc.errors.UnsupportedQuery` (also `loom.core.repository.abc.*`; the module is removed) | `loom.core.errors` |
+  | `loom.jobs.aws.sqs.SQSDispatchError` | `loom.jobs.aws.errors` |
+  | `loom.serverless.aws.lambda_.triggers.sqs.SQSBatchFailedError` | `loom.serverless.aws.lambda_.errors` (also `loom.serverless.aws.lambda_`) |
+  | `loom.rest.auth.abc.AuthenticationUnavailable` | `loom.rest.auth.errors` (also `loom.rest.auth`) |
+  | `loom.etl.backends._format_registry.UnsupportedFormatError` | `loom.etl.runner.errors` (also `loom.etl`) |
+
+- **errors:** a `LoomError` code is a catalogue member, never a literal
+  string: `LoomError(message, code=)` is typed `StrEnum`, `ErrorCode` gains
+  `JOB_TIMEOUT`, `JOB_FAILED`, `JOB_BACKENDS_MIXED` and
+  `BOUNDARY_TYPE_UNSUPPORTED` (same string values, mapped to 500 explicitly),
+  and the SQS adapters' `sqs_*` codes are the members of
+  `loom.jobs.aws.errors.SQSErrorCode`, which `SQSDispatchError(message, code=)`
+  now requires. An application catalogue is its own `StrEnum`.
+  `AuthenticationUnavailable` is a `SystemError`, so the generic retry and
+  circuit-breaker handlers see the outage it reports.
+
+- **errors:** every error belongs to a family. `BoundaryValidationError` and
+  `UnsupportedFormatError` are `DomainError`s (still `ValueError`s);
+  `JobTimeoutError`, `JobFailedError`, `MixedJobBackendsError`,
+  `PostCommitError`, `UnsupportedBoundaryType`, `SQSDispatchError` and
+  `SQSBatchFailedError` are `SystemError`s. HTTP statuses do not change. A
+  `DomainError` is never retryable: Celery and the SQS consumers consume a
+  job that raises one instead of requeuing it, and the streaming boundary
+  files a `BoundaryValidationError` as a business error. `UnsupportedQuery`
+  takes `(reason, *, backend=None, model=None)` and its message names the
+  model and the reason, never the backend.
+
 ## ⚠ Behaviour changes
 
 ### jobs

{loom_kernel-10.1.0 → loom_kernel-10.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: loom-kernel
-Version: 10.1.0
+Version: 10.3.0
 Summary: Loom Python project
 License-File: LICENSE
 Classifier: Programming Language :: Python :: 3
@@ -13,7 +13,7 @@ Classifier: Typing :: Typed
 Requires-Python: >=3.11
 Requires-Dist: aiocache<1.0,>=0.12
 Requires-Dist: msgspec<1.0,>=0.18
-Requires-Dist: omegaconf<3.0,>=2.3
+Requires-Dist: omegaconf<2.4,>=2.3
 Requires-Dist: opentelemetry-api<2.0,>=1.27
 Requires-Dist: prometheus-client>=0.20
 Requires-Dist: structlog<27.0,>=24.4
@@ -37,7 +37,7 @@ Provides-Extra: ai-typesafe
 Requires-Dist: pydantic-ai-slim[typesafe]<3,>=2.45; extra == 'ai-typesafe'
 Provides-Extra: cache
 Requires-Dist: aiocache<1.0,>=0.12; extra == 'cache'
-Requires-Dist: omegaconf<3.0,>=2.3; extra == 'cache'
+Requires-Dist: omegaconf<2.4,>=2.3; extra == 'cache'
 Provides-Extra: celery
 Requires-Dist: celery<6.0,>=5.3; extra == 'celery'
 Requires-Dist: kombu<6.0,>=5.3; extra == 'celery'
@@ -49,11 +49,11 @@ Provides-Extra: clickhouse
 Requires-Dist: clickhouse-connect<1.0,>=0.9.2; extra == 'clickhouse'
 Provides-Extra: config
 Requires-Dist: fsspec>=2024.2.0; extra == 'config'
-Requires-Dist: omegaconf<3.0,>=2.3; extra == 'config'
+Requires-Dist: omegaconf<2.4,>=2.3; extra == 'config'
 Provides-Extra: config-ssm
 Requires-Dist: boto3>=1.35; extra == 'config-ssm'
 Requires-Dist: fsspec>=2024.2.0; extra == 'config-ssm'
-Requires-Dist: omegaconf<3.0,>=2.3; extra == 'config-ssm'
+Requires-Dist: omegaconf<2.4,>=2.3; extra == 'config-ssm'
 Provides-Extra: dynamodb
 Requires-Dist: boto3>=1.35; extra == 'dynamodb'
 Provides-Extra: etl-otel
@@ -96,7 +96,7 @@ Provides-Extra: prefect
 Requires-Dist: boto3>=1.35; extra == 'prefect'
 Requires-Dist: docker>=7.0; extra == 'prefect'
 Requires-Dist: fsspec>=2024.2.0; extra == 'prefect'
-Requires-Dist: omegaconf<3.0,>=2.3; extra == 'prefect'
+Requires-Dist: omegaconf<2.4,>=2.3; extra == 'prefect'
 Requires-Dist: prefect<4.0,>=3.0; extra == 'prefect'
 Requires-Dist: pyyaml>=6.0; extra == 'prefect'
 Provides-Extra: prometheus

{loom_kernel-10.1.0 → loom_kernel-10.3.0}/pyproject.toml

@@ -16,7 +16,7 @@ classifiers = [
 dependencies = [
     "msgspec>=0.18,<1.0",
     "structlog>=24.4,<27.0",
-    "omegaconf>=2.3,<3.0",
+    "omegaconf>=2.3,<2.4",
     "prometheus-client>=0.20",
     "aiocache>=0.12,<1.0",
     "typing_extensions>=4.12",
@@ -62,17 +62,17 @@ jwt = [
     "pyjwt[crypto]>=2.8,<3",
 ]
 config = [
-    "omegaconf>=2.3,<3.0",
+    "omegaconf>=2.3,<2.4",
     "fsspec>=2024.2.0",
 ]
 config-ssm = [
-    "omegaconf>=2.3,<3.0",
+    "omegaconf>=2.3,<2.4",
     "fsspec>=2024.2.0",
     "boto3>=1.35",
 ]
 cache = [
     "aiocache>=0.12,<1.0",
-    "omegaconf>=2.3,<3.0",
+    "omegaconf>=2.3,<2.4",
 ]
 etl-polars = [
     "polars>=1.24,<2.0",
@@ -107,7 +107,7 @@ prefect = [
     "prefect>=3.0,<4.0",
     "fsspec>=2024.2.0",
     "pyyaml>=6.0",
-    "omegaconf>=2.3,<3.0",
+    "omegaconf>=2.3,<2.4",
     "boto3>=1.35",
     "docker>=7.0",
 ]
@@ -256,7 +256,7 @@ dev = [
     "fastapi>=0.115,<1.0",
     "greenlet>=3.0.0",
     "mypy>=1.11.0,<2.0",
-    "omegaconf>=2.3,<3.0",
+    "omegaconf>=2.3,<2.4",
     "pydantic>=2.0,<3.0",
     "pre-commit>=3.8.0",
     "pyright>=1.1.390,<2.0",

{loom_kernel-10.1.0 → loom_kernel-10.3.0}/src/loom/ai/compiler/phases/_output.py

@@ -36,7 +36,8 @@ from loom.ai.abc import OutputCheck
 from loom.ai.compiler._plan import CompiledOutput
 from loom.ai.declarative import JsonSchemaOutput, OutputSpec, TypeRefOutput
 from loom.ai.errors import AgentCompilationIssue, AgentErrorCode
-from loom.core.model import LoomType, UnsupportedBoundaryType, loom_type, msgspec_type
+from loom.core.errors import UnsupportedBoundaryType
+from loom.core.model import LoomType, loom_type, msgspec_type
 from loom.core.symbols import import_symbol
 
 _CompileResult = tuple[CompiledOutput | None, list[AgentCompilationIssue]]

{loom_kernel-10.1.0 → loom_kernel-10.3.0}/src/loom/ai/compiler/phases/_state.py

@@ -38,7 +38,8 @@ import msgspec
 from loom.ai.abc import StateShape
 from loom.ai.compiler.phases._output import _resolve_symbol, _schema_to_annotation
 from loom.ai.errors import AgentCompilationIssue, AgentErrorCode
-from loom.core.model import UnsupportedBoundaryType, loom_type, msgspec_type
+from loom.core.errors import UnsupportedBoundaryType
+from loom.core.model import loom_type, msgspec_type
 
 _CompileResult = tuple[StateShape | None, list[AgentCompilationIssue]]
 

{loom_kernel-10.1.0 → loom_kernel-10.3.0}/src/loom/ai/engines/pydantic_ai/_output.py

@@ -48,7 +48,7 @@ from pydantic_ai.messages import ModelResponse, TextPart, ToolCallPart
 
 from loom.ai.compiler import CompiledOutput
 from loom.ai.errors import AgentRunError, AgentRunErrorCode
-from loom.core.model import BoundaryValidationError
+from loom.core.errors import BoundaryValidationError
 
 
 class MissingOutputPayload(Exception):

{loom_kernel-10.1.0 → loom_kernel-10.3.0}/src/loom/ai/fastapi/endpoints.py

@@ -56,8 +56,9 @@ from loom.ai.fastapi.response import AgentJSONResponse, error_response, result_p
 from loom.ai.fastapi.streaming import encode_sse_event, stream_sse
 from loom.ai.runtime import AgentRuntime
 from loom.core.config.errors import ConfigError
+from loom.core.errors import BoundaryValidationError
 from loom.core.identity import Identity, current_identity
-from loom.core.model import BoundaryValidationError, LoomFrozenStruct
+from loom.core.model import LoomFrozenStruct
 from loom.core.observability.event import Scope
 from loom.core.observability.runtime import ObservabilityRuntime
 from loom.core.observability.span import LoomSpan

{loom_kernel-10.1.0 → loom_kernel-10.3.0}/src/loom/ai/runtime/_grants.py

@@ -49,8 +49,9 @@ from loom.ai._roles import bound_query_roles
 from loom.ai.abc import McpHandle, McpSession, McpToolInfo, SqlGrantHandle
 from loom.ai.compiler import CompiledMcpCapability, CompiledSqlCapability
 from loom.ai.errors import AgentRunError, AgentRunErrorCode
+from loom.core.errors import BoundaryValidationError, UnsupportedBoundaryType
 from loom.core.identity import Identity
-from loom.core.model import BoundaryValidationError, UnsupportedBoundaryType, loom_type_of
+from loom.core.model import loom_type_of
 from loom.core.observability.event import Scope
 from loom.core.observability.runtime import ObservabilityRuntime
 from loom.core.sql.abc import SqlQueryResult

{loom_kernel-10.1.0 → loom_kernel-10.3.0}/src/loom/ai/runtime/_lifecycle.py

@@ -79,8 +79,9 @@ from loom.ai.runtime._mcp import (
     mcp_session_for,
 )
 from loom.core.di import LoomContainer
+from loom.core.errors import BoundaryValidationError
 from loom.core.identity import ANONYMOUS, Identity
-from loom.core.model import BoundaryValidationError, LoomType
+from loom.core.model import LoomType
 from loom.core.sql.config import SqlConfig
 from loom.core.use_case.invoker import ApplicationInvoker
 

{loom_kernel-10.1.0 → loom_kernel-10.3.0}/src/loom/celery/errors.py

@@ -4,7 +4,7 @@ from __future__ import annotations
 
 import re
 
-from loom.core.errors.errors import SystemError
+from loom.core.errors import SystemError
 from loom.core.model.redaction import mask_dsn
 
 _ADDRESS = re.compile(r"[A-Za-z][A-Za-z0-9+.-]*://\S+")

{loom_kernel-10.1.0 → loom_kernel-10.3.0}/src/loom/celery/runner.py

@@ -233,7 +233,7 @@ def _make_job_task(
     decoded from the envelope is forwarded, so a job declaring ``Caller()``
     fails closed rather than running as an unknown caller.
 
-    A :class:`~loom.core.engine.post_commit.PostCommitError` whose
+    A :class:`~loom.core.errors.PostCommitError` whose
     transaction committed is terminal: the task is not retried, since the
     write already stands.  One raised without a commit is retried like any
     other failure.

{loom_kernel-10.1.0 → loom_kernel-10.3.0}/src/loom/cli/check.py

@@ -32,6 +32,7 @@ from loom.core.config.errors import ConfigError
 from loom.core.config.overrides import load_application_config
 from loom.core.environment import Environment, resolve_environment, select_config_paths
 from loom.core.locator import DEFAULT_CODE_PATH, add_code_path
+from loom.serverless.aws.lambda_.checks import check_triggers
 
 
 def check(
@@ -79,7 +80,8 @@ def load_checked(config: list[Path], env: str | None, skip: tuple[str, ...]) ->
     """Load *config* for *env*, put its code path on the import path and run the deploy checks.
 
     Raises:
-        ConfigError: When the configuration does not load.
+        ConfigError: When the configuration does not load, or ``lambda`` is
+            one startup would refuse.
     """
     _load_check_packages()
     environment = resolve_environment(env)
@@ -89,6 +91,7 @@ def load_checked(config: list[Path], env: str | None, skip: tuple[str, ...]) ->
     )
     config_root = Path(paths[0]).resolve().parent
     code_path = _add_code_path(context, config_root)
+    check_triggers(context)
     report = run_deploy_checks(context, skip=skip)
     return CheckedConfig(context, environment, report, skip, config_root, code_path)
 
@@ -97,6 +100,7 @@ def _load_check_packages() -> None:
     """Import the packages registering loom's checks; the REST ones need the rest extra."""
     importlib.import_module("loom.core.logger")
     importlib.import_module("loom.core.repository.abc")
+    importlib.import_module("loom.core.persistence.audit_checks")
     if importlib.util.find_spec("fastapi") is not None:
         importlib.import_module("loom.rest")