A Rust safety gateway between AI agents and PostgreSQL. The security seam sits below the agent: least-privilege roles, a proxy-only read path, bounded disclosure, cancellation, explicit write certification, and tamper-evident audit evidence.
Current verdict: a credible MVP and research-grade safety kernel—not a production-safe control plane for arbitrary PostgreSQL databases. Production Read is the only posture eligible for production evaluation. Writes remain explicitly experimental.
Five read tools through the proxy to a physical replica. Row, byte, time, and in-process cumulative budgets; cancellation; warden monitoring; verified TCP transport; and authoritative audit evidence. Every deployment prerequisite must be proven; unknown means unsupported.
A tiny exact-literal-key UPDATE/DELETE
envelope with catalog-bound identity, instance-separated rehearsal,
exact-set approval, durable Recovery Material, and compare-and-swap
revert. Clone governance remains operator-attested.
Throwaway PostgreSQL, primary transaction rehearsal, local file/HMAC anchoring, demos, and benchmark fixtures. This posture cannot produce a production verdict.
Fail-closed writes for explicitly certified PostgreSQL shapes. This is an experimental envelope, not a claim over PostgreSQL's entire behavioral surface.
Bounded disclosure, not unreadability. Returned bytes cannot be recalled. The cumulative meter resets on proxy restart and is independent per proxy process.
Tamper-evident, not tamper-proof. Coverage is event-class-specific. MCP-local and some early refusals do not enter the authoritative chain. Experimental primary mutations and final audit rows are not atomically co-committed.
The machine-readable capability registry is the source of truth. CI checks active documentation against it and the integration matrix exercises the covered safety suite on PostgreSQL 14–18.