Use this recipe when the mutation you need is outside the native database delivery contract — calling a Postgres function, enforcing a custom conflict rule, touching more than one table in your own transaction. For ordinary table publishing (append / upsert / replace), prefer native delivery: it is transactional, retry-safe, and receipted without any code.

The recipe

A kind: python writeback with one table input and a secret reference:
The secrets entry maps a stored tenant secret onto an environment variable inside the sandbox. The connection string never appears in the node, the graph document, or version history — rotating it in Secrets requires no graph change.

Why the scaffolding matters

  • input_table() is the governed bulk channel: the platform stages the frozen input for this invocation, so a retry re-delivers the exact rows that were approved — not whatever the upstream table contains later.
  • writeback.record_request / record_progress / record_response populate the sealed effect log, so the delivery is auditable like any native one.
  • Secret references keep credentials out of code. Never inline a connection string; anything you print is redacted, but the contract is to reference, not embed.
  • Use the Supabase direct connection (or session-mode pooler) URL as the secret value; transaction-mode poolers interact badly with your own engine.begin() transaction.

Invocation and observation

Identical to native delivery: fire it from a threshold trigger, an action chain, or core_invoke_writeback; watch outcomes in run history or via core_list_writeback_outcomes, and drill into the effect log for the per-attempt record. Failures surface with sanitized errors — your Python exception text is captured, credentials are not.