Elementary Runtime

Early development. This package is a skeleton and is not usable yet.

Elementary Runtime is a small service that customers run in their own environment. It uses local warehouse credentials to execute SQL prepared by Elementary Cloud, so Cloud never holds credentials that can read customer business tables.

Warehouse drivers will be optional extras. Installing the base package for task models will not pull in every warehouse driver or the full runtime.

A license has not been chosen yet.

Security-critical code

Local safety controls live under src/elementary_runtime/execution/. That tree is the audited surface: SQL validation, query execution with limits applied while rows are fetched and encoded, and redaction of SQL, row values, credentials, and unrestricted warehouse errors from logs and telemetry.

Repository layout

src/elementary_runtime/
  protocol/      Task and result wire formats
  config/        Versioned YAML configuration and local limits
  common/        Shared helpers used by protocol and config
  warehouses/    Warehouse clients (drivers behind extras)
  execution/     Audited local safety controls
    sql/         SQL validation
    worker/      Worker pool, query execution, limit enforcement
    redaction/   Error, log, and telemetry scrubbing
  coordinator/   Register, task streams, heartbeat, submit, retries, shutdown

Configuration

version: 1
cloud:
  token_file: /run/secrets/elementary_runtime_token
connections:
  - warehouse_connection_id: connection-id
    type: snowflake
    account: ab12345.eu-central-1
    user: elementary_runtime
    password_file: /run/secrets/snowflake_password
    role: ELEMENTARY_RUNTIME
    warehouse: ELEMENTARY_WH
    database: ANALYTICS

Development

Requires uv and Python 3.10–3.14. Local development uses Python 3.12.

After a clone or a new Git worktree, install the environment and hooks:

./script/setup.sh

Then:

uv run pytest
uv run mypy src tests
uvx prek run --all-files

The package version lives in pyproject.toml. Bump it with uv version --bump patch (or minor / major). At runtime, elementary_runtime.__version__ is read from the installed distribution metadata.