rewrite box.validation to decouple validation from sqlalchemy