{ "schema_version": 1, "updated": "2026-07-10", "decision": "docs/adr/0001-v0-1-safety-postures.md", "public_write_guarantee": "Fail-closed writes for explicitly certified PostgreSQL shapes.", "maturity_definitions": { "implemented": "Present in the shipped tree and covered by named evidence; production use still requires every posture prerequisite to be proven.", "experimental": "Present in whole or in part, but not production-supported.", "development-only": "Suitable only for local, CI, benchmark, or demonstration use.", "parsed-but-inert": "Accepted by configuration or represented by a type, but does not affect runtime behavior.", "deferred": "Not implemented in the current tree." }, "postures": [ { "id": "production-read", "name": "Production Read Posture", "maturity": "implemented", "summary": "The only v0.1 posture eligible for production evaluation: five read tools through the proxy to a physical replica, with a least-privilege role, bounded disclosure, cancellation, warden monitoring, and authoritative audit evidence.", "eligibility": "The repository does not confer production support by itself. Every load-bearing network, process identity, credential, transport, schema, replica, audit-retention, and operational prerequisite must be proven; unknown is unsupported. Doctor checks database-visible evidence, while external topology and controls require separate evidence." }, { "id": "experimental-write", "name": "Experimental Write Posture", "maturity": "experimental", "summary": "Explicitly enabled, non-production exact-key UPDATE/DELETE work only; catalog-bound certification, operator-provisioned rehearsal, exact-set approval, and durable restart-safe recovery are implemented.", "eligibility": "Applyd refuses startup unless clone.provider=dblab, a distinct rehearsal DSN and running-postmaster identity, approval, and recovery prerequisites are present. The apply and rehearsal roles need EXECUTE on pg_control_system(); the operator—not applyd—attests clone provenance, freshness, external-side-effect isolation, and governance." }, { "id": "development", "name": "Development Posture", "maturity": "development-only", "summary": "Throwaway Postgres, primary transaction rehearsal, local file anchors, demos, and benchmark fixtures.", "eligibility": "Cannot produce a production-supported verdict." } ], "capabilities": [ { "id": "wall-role-hardening", "name": "Least-privilege WALL roles", "maturity": "implemented", "postures": ["production-read", "experimental-write", "development"], "summary": "Agent-scoped role hardening, explicit read grants, and a separate applier role whose effective table/column write grants, WALL attributes, CREATE/TRUNCATE/TRIGGER privileges, memberships, and ownership across persistent owner-bearing catalogs are rejected unless they fit the DML-only envelope. Replica role checks run against the actual configured read endpoint.", "limitations": ["The shared-database default deliberately leaves PUBLIC privileges unchanged; the proxy-origin requirement remains load-bearing.", "Doctor evidence is point-in-time and must be rerun after role, ownership, grant, replica, or schema changes."], "evidence": ["deploy/sql/10_hardened_role.sql", "deploy/test/wall_matrix.sh", "crates/cli/src/main.rs", "crates/cli/tests/doctor_it.rs"] }, { "id": "proxy-read-floor", "name": "Proxy read enforcement", "maturity": "implemented", "postures": ["production-read", "experimental-write", "development"], "summary": "Extended-protocol-only, default-deny handling of the recognized SQL subset, and rejection of user-created Parse parameter type OIDs before Bind; 64 KiB startup/16 MiB tagged-frame allocation caps; per-agent-frame receive deadlines; a process-local concurrent-connection cap; statement row/byte/time limits; a shared in-process per-policy-role cumulative meter; cancellation; statement audit; and posture-owned backend routing.", "limitations": ["The classifier uses a generic parser and curated semantic allowlist rather than PostgreSQL-native parsing and catalog resolution. Production eligibility therefore depends on a current green doctor assessment of the granted PostgreSQL catalog surface plus schema-change controls; classifier acceptance alone is not certification.", "The cumulative meter and connection cap are process-local. The meter resets on restart and neither control is coordinated across multiple proxy instances."], "evidence": ["crates/pgwire/src/codec.rs", "crates/pgwire/tests/codec_async.rs", "crates/pgwire/tests/classifier.rs", "crates/proxy/src/enforce.rs", "crates/proxy/src/session.rs", "crates/proxy/src/main.rs", "crates/proxy/src/budget.rs", "crates/proxy/src/window.rs", "crates/proxy/tests/proxy_it.rs"] }, { "id": "policy-select-whitelist", "name": "Policy select_whitelist enforcement", "maturity": "parsed-but-inert", "postures": ["production-read", "experimental-write", "development"], "summary": "RolePolicy.select_whitelist is deserialized and retained for forward-compatible policy shape, but no proxy or daemon enforces it.", "limitations": ["An empty list does not make the runtime role unable to read, and listed relations do not grant access. Explicit PostgreSQL SELECT grants define the actual read surface; doctor inventories the resulting live semantic surface and both controls remain load-bearing."], "evidence": ["crates/policy/src/config.rs", "crates/proxy/src/config.rs", "deploy/sql/10_hardened_role.sql", "crates/cli/src/main.rs"] }, { "id": "policy-autonomy", "name": "Policy autonomy enforcement", "maturity": "parsed-but-inert", "postures": ["production-read", "experimental-write", "development"], "summary": "RolePolicy.autonomy is deserialized and values above L2 are rejected, but L0-L2 do not currently change runtime authorization or approval behavior.", "limitations": ["The proxy consumes only the selected role's budget. Production Read exposes no write tools; Experimental Write always uses the signed single-use operator approval workflow regardless of the autonomy label."], "evidence": ["crates/policy/src/config.rs", "crates/proxy/src/config.rs", "crates/applyd/src/service.rs", "crates/mcp/src/bin/pgb_mcp.rs"] }, { "id": "backend-transport", "name": "Verified agent and read-backend transport", "maturity": "implemented", "postures": ["production-read", "experimental-write", "development"], "summary": "Production postures require TLS on the agent-facing proxy endpoint. The proxy originates SCRAM-SHA-256 with server-signature verification and uses configured CA plus hostname verification on its PostgreSQL read-backend hop without plaintext downgrade.", "limitations": ["Certificate issuance, hostname selection, rotation, and key custody remain operator responsibilities. Development may explicitly use the local cleartext proxy fixture."], "evidence": ["crates/proxy/src/auth.rs", "crates/proxy/src/config.rs", "crates/proxy/src/session.rs"] }, { "id": "control-plane-transport", "name": "Verified synchronous PostgreSQL transport", "maturity": "implemented", "postures": ["production-read", "experimental-write", "development"], "summary": "Applyd, warden, audit, doctor, and MCP audit-reader TCP clients share one connector that promotes omitted/prefer SSL modes to certificate- and hostname-validated TLS with no plaintext fallback. Unix sockets are accepted as local OS transport.", "limitations": ["Explicit sslmode=disable TCP is Development-only; production postures reject it at startup. Applyd, warden, and doctor additionally require PGB_DEV_ALLOW_PLAINTEXT_PG=true for Development plaintext. Operators must provide correct DSN hostnames and, when platform roots are insufficient, PGB_PG_ROOT_CERT or PGSSLROOTCERT."], "evidence": ["crates/pg-client/src/lib.rs", "crates/applyd/src/main.rs", "crates/warden/src/main.rs", "crates/audit/src/pg.rs", "crates/cli/src/main.rs", "crates/mcp/src/bin/pgb_mcp.rs"] }, { "id": "warden", "name": "Out-of-band warden", "maturity": "implemented", "postures": ["production-read", "experimental-write", "development"], "summary": "Observes the posture-selected PostgreSQL target, terminates tagged runaway agent sessions, emits slot alarms, and trips/audits its in-process breaker state.", "limitations": ["The proxy does not consume warden breaker state, so a breaker trip does not currently shed new proxy traffic.", "The breaker credential is a publicly mintable in-process marker, not an authenticated warden-to-proxy channel or external authorization boundary.", "Operational safety depends on correct target selection, deployment identity, audit connectivity, and termination privileges."], "evidence": ["crates/warden/src/run.rs", "crates/warden/tests/warden_it.rs"] }, { "id": "native-mcp", "name": "Native Rust MCP server", "maturity": "implemented", "postures": ["production-read", "experimental-write", "development"], "summary": "The current agent-facing stdio server; cooperative UX, never a security seam. Production Read advertises five read tools; Experimental Write and Development advertise the full nine-tool catalog, with no agent-facing approve tool.", "limitations": ["MCP-local validation failures are process-logged, not automatically appended to the authoritative audit chain."], "evidence": ["crates/mcp/src/bin/pgb_mcp.rs", "crates/mcp/tests/read_path_e2e.rs", "crates/mcp/tests/write_path_e2e.rs"] }, { "id": "mcp-audit-reader-confinement", "name": "Exact MCP audit-reader confinement", "maturity": "implemented", "postures": ["production-read", "experimental-write", "development"], "summary": "MCP consumes only PGB_MCP_META_READER_DSN for get_audit; it refuses PGB_META_DSN and never falls back to policy audit.target. Doctor inspects that exact credential for audit-tail read only, including effective table/column privileges, other readable data, ownership, memberships/escalation, create/temp, and reachable user-defined routines.", "limitations": ["The audit hardening assumes a dedicated _meta database. The doctor result is point-in-time, so any later role, grant, schema, default-privilege, or routine change requires migration controls and a fresh preflight."], "evidence": ["crates/mcp/src/bin/pgb_mcp.rs", "crates/cli/src/main.rs", "crates/cli/src/doctor.rs", "crates/cli/tests/doctor_it.rs", "crates/audit/sql/10_audit_meta.sql", "crates/audit/tests/pg_meta_it.rs"] }, { "id": "audit-chain", "name": "Authoritative audit chain", "maturity": "implemented", "postures": ["production-read", "experimental-write", "development"], "summary": "Canonical hash-chained records in the _meta sink for covered proxy statement decisions, applyd lifecycle records, a structurally bound apply_precommit_intent after inverse staging and before primary COMMIT, a bound revert_precommit_intent before the primary revert transaction, and successfully appended warden action records.", "limitations": ["Primary apply/revert commits and final _meta audit appends are separate transactions. A post-commit recovery-finalization or audit-sink failure can leave an explicit ambiguous recovery record and no definitive final audit record; no atomic cross-database audit guarantee exists.", "MCP-local validation, requests rejected before proxy/applyd, and some early applyd lookups are process logs or uncovered rather than authoritative chain records.", "The shipped SQL hardening assumes a dedicated _meta database and point-in-time doctor validation after relevant catalog/grant changes.", "Tamper-evident does not mean tamper-proof."], "evidence": ["crates/audit/src/chain.rs", "crates/audit/src/pg.rs", "crates/audit/tests/pg_meta_it.rs"] }, { "id": "development-anchor", "name": "Local development anchor", "maturity": "development-only", "postures": ["development"], "summary": "A local file/HMAC Adapter exercises anchor verification semantics.", "limitations": ["Deleting the file allows a new baseline; it is not independently retained, production key-separated, or WORM storage. Runtime startup may use this Adapter, but that use does not upgrade its maturity."], "evidence": ["crates/audit/src/anchor.rs", "crates/audit/src/kms.rs", "crates/audit/tests/anchor.rs"] }, { "id": "production-anchor", "name": "Production WORM/transparency anchor", "maturity": "deferred", "postures": ["production-read", "experimental-write"], "summary": "Independently administered retention enforcement and production key separation.", "limitations": ["No production Adapter exists in v0.1."], "evidence": ["KNOWN_BYPASSES.md"] }, { "id": "audit-anchor-endpoint", "name": "Policy audit.anchor_endpoint wiring", "maturity": "parsed-but-inert", "postures": ["production-read", "experimental-write", "development"], "summary": "Policy can represent a future external anchor endpoint.", "limitations": ["No runtime path sends chain heads to audit.anchor_endpoint; current anchoring uses the configured local Development Anchor path."], "evidence": ["crates/policy/src/config.rs", "crates/policy/policy.example.yaml"] }, { "id": "replica-routing", "name": "Read-replica routing", "maturity": "implemented", "postures": ["production-read", "experimental-write", "development"], "summary": "Production Read Posture requires and uses typed replica.target with no primary fallback; Experimental Write prefers it, while Development uses the primary.", "limitations": ["Legacy replica.dsn is rejected. Doctor and the proxy attest recovery/read-only state, while operators must still prove intended topology, lag, and failover behavior."], "evidence": ["crates/policy/src/config.rs", "crates/proxy/src/main.rs", "crates/proxy/src/session.rs", "crates/cli/src/main.rs"] }, { "id": "deployment-attestation", "name": "Deployment prerequisite attestation", "maturity": "implemented", "postures": ["production-read", "experimental-write"], "summary": "pgb-cli doctor makes missing/open HBA evidence, replica evidence, effective table/column grants, PostgreSQL-native readable semantic hazards (including generated columns and every user-created cast), exact MCP reader confinement, and audit-chain/anchor evidence blocking outside explicit Development Posture.", "limitations": ["Database HBA evidence cannot by itself prove external firewalls, cloud security groups, Kubernetes network policy, or dedicated egress/process identity.", "Production doctor also has no provider-evidence override: missing or unreadable exact hostssl/SCRAM HBA evidence is blocking. No AWS, Google Cloud, Supabase, or Kubernetes evidence Adapter is shipped, so a managed service unable to expose the exact matching rule is unsupported in v0.1."], "evidence": ["crates/cli/src/doctor.rs", "crates/cli/tests/doctor_it.rs", "deploy/hba/NETWORK-POLICY.md", "docs/deployment-patterns.md"] }, { "id": "provider-network-evidence", "name": "Managed-provider network evidence Adapters", "maturity": "deferred", "postures": ["production-read"], "summary": "Future Adapters could validate provider-native network and workload-identity controls when PostgreSQL HBA state is unavailable.", "limitations": ["No Adapter or doctor override exists. The managed-cloud, Supabase, and external-managed Kubernetes sections are reference designs, not current Production Read support."], "evidence": ["docs/deployment-patterns.md", "crates/cli/src/doctor.rs"] }, { "id": "production-read-launcher", "name": "Production Read runtime launcher", "maturity": "implemented", "postures": ["production-read"], "summary": "A fail-closed launcher runs doctor, starts only the proxy and warden, and prints read-only MCP wiring. Its dedicated teardown verifies marked state and tracked executable identity, signals only those processes, and retains logs.", "limitations": ["The scripts provision no infrastructure and do not establish a production verdict; operators must supply and separately prove every external prerequisite.", "PID tracking and retained logs are local to one launcher state directory. The Development deploy/down.sh is not a Production Read teardown."], "evidence": ["deploy/read-only-up.sh", "deploy/read-only-down.sh", "deploy/test/read_only_state_guards.sh", "docs/deployment-patterns.md"] }, { "id": "secret-ref-resolution", "name": "Policy secret_ref resolution", "maturity": "parsed-but-inert", "postures": ["production-read", "experimental-write", "development"], "summary": "Typed targets can carry a credential-less secret_ref for forward-compatible policy shape.", "limitations": ["No runtime secret-manager Adapter resolves secret_ref; supported out-of-band environment secret inputs remain required."], "evidence": ["crates/policy/src/config.rs", "crates/policy/policy.example.yaml"] }, { "id": "approval-key-ref-resolution", "name": "Policy approval-key reference resolution", "maturity": "parsed-but-inert", "postures": ["experimental-write", "development"], "summary": "Policy can carry approvers.cli_signing_key_id for a future KMS/keyring Adapter.", "limitations": ["No runtime Adapter resolves this field. Applyd currently requires PGB_APPROVER_PUBKEY and pgb-cli reads PGB_APPROVER_SEED_HEX locally."], "evidence": ["crates/policy/src/config.rs", "crates/policy/policy.example.yaml", "crates/applyd/src/main.rs", "crates/cli/src/main.rs"] }, { "id": "isolated-rehearsal", "name": "Operator-provisioned rehearsal target", "maturity": "experimental", "postures": ["experimental-write", "development"], "summary": "Experimental Write requires clone.provider=dblab, a distinct PGB_REHEARSAL_DSN, and a different running PostgreSQL instance identified by system_identifier plus postmaster start time; aliases and separate databases on one postmaster are refused. Only Development may use primary transaction rehearsal.", "limitations": ["The apply and rehearsal roles need EXECUTE on pg_control_system(). Applyd does not provision or cryptographically attest DBLab; instance separation does not prove clone provenance, freshness, isolation from external side effects, lifecycle, or governance."], "evidence": ["crates/applyd/src/isolation.rs", "crates/applyd/src/main.rs", "crates/applyd/tests/applyd_it.rs", "crates/clone-orchestrator/tests/clone_governance_it.rs"] }, { "id": "primary-transaction-rehearsal", "name": "Primary transaction rehearsal", "maturity": "development-only", "postures": ["development"], "summary": "Runs candidate SQL on the primary and rolls back ordinary transactional changes.", "limitations": ["Rollback cannot undo sequence, external, remote, filesystem, or other non-transactional side effects; it is prohibited in Experimental Write Posture."], "evidence": ["crates/clone-orchestrator/src/dry_run.rs", "docs/adr/0001-v0-1-safety-postures.md"] }, { "id": "certified-write-envelope", "name": "Exact-key Certified Write Envelope", "maturity": "experimental", "postures": ["experimental-write", "development"], "summary": "One schema-qualified ordinary permanent table with no alias; one UPDATE or DELETE; the sole int4 primary key compared by equality or IN to int4 literals; literal-only UPDATE assignments; full-row pre-images; no primary-key update. Catalog OIDs, key attnum/type OID, exact quoted names, and a catalog fingerprint flow through rehearsal, exact-set approval, guarded apply, recovery, and revert.", "limitations": ["UPDATE FROM, DELETE USING, joins, RETURNING, ORDER BY, LIMIT, target modifiers, expressions/casts/functions/defaults/placeholders in assignments, and broad predicates are refused.", "Only heap tables with the primary-key index are accepted: triggers, rules, RLS/policies, inheritance/partitions, foreign tables, generated/identity columns, cascading/SET NULL/SET DEFAULT foreign keys, CHECK/exclusion constraints, and secondary/expression/partial indexes are refused.", "Restorable columns are limited to int2, int4, int8, text, varchar, bpchar, name, and bytea. The envelope remains Experimental while independent review and production hardening of clone lifecycle, operator identity/workflow, and audit anchoring remain incomplete."], "evidence": ["CONTEXT.md", "docs/adr/0001-v0-1-safety-postures.md", "crates/clone-orchestrator/src/write_envelope.rs", "crates/clone-orchestrator/src/apply.rs", "crates/clone-orchestrator/src/conn.rs", "crates/clone-orchestrator/src/revert.rs", "crates/clone-orchestrator/tests/envelope_it.rs", "crates/clone-orchestrator/tests/identity_it.rs", "crates/clone-orchestrator/tests/apply_grant_it.rs"] }, { "id": "operator-approval", "name": "Local signed operator approval", "maturity": "experimental", "postures": ["experimental-write", "development"], "summary": "The CLI asks applyd to inspect the canonical binding, displays the exact SQL/role/session/catalog identity/cap/typed keys/nonce/expiry, requires typed confirmation or explicit change evidence, signs locally, and sends only the binding, signature, approver id, and confirmation evidence. Applyd revalidates the stored request, inspected binding, execution role, configured authority, hard TTL, and single-use state.", "limitations": ["The shipped workflow is an owner-only Unix-socket CLI, not an operator UI, WebAuthn flow, dual control, or hosted identity system. The approver-id string is authorized by socket/operator custody and must differ from the requester; no separate identity-provider attestation is implemented.", "PGB_APPLYD_SOCKET must be absolute. A missing parent is created mode 0700; an existing parent must already be a non-symlink directory with no group/other access and is never chmod'd into compliance. The socket is mode 0600."], "evidence": ["crates/applyd/src/protocol.rs", "crates/applyd/src/service.rs", "crates/applyd/src/main.rs", "crates/cli/src/main.rs", "crates/cli/tests/approval_flow.rs", "crates/applyd/tests/service_unit.rs"] }, { "id": "durable-recovery", "name": "Durable restart-safe recovery", "maturity": "experimental", "postures": ["experimental-write"], "summary": "Inverse JSON and its SHA-256 digest are staged in _meta before primary commit; STAGED/APPLIED/REVERTING/REVERTED state, Recovery Receipts, and signed expiring single-use operator revert survive daemon restart. Revert revalidates catalog identity, compare-and-swaps captured after-images, and requires exact cardinality before committing.", "limitations": ["A crash or post-commit finalization failure with unknown primary outcome leaves explicit STAGED or REVERTING material and blocks later writes until operator reconciliation.", "Primary commit, recovery-state finalization, and final audit append are not one atomic transaction; a committed mutation may lack a definitive final audit record when a later sink append fails.", "Byte-for-byte independent comparison is integration-test evidence; the runtime verifier is catalog validation plus after-image compare-and-swap and cardinality, not a separate external diff system. This remains Experimental Write Posture only."], "evidence": ["crates/audit/sql/10_audit_meta.sql", "crates/applyd/src/recovery.rs", "crates/applyd/src/protocol.rs", "crates/applyd/src/service.rs", "crates/applyd/src/main.rs", "crates/cli/src/main.rs", "crates/applyd/tests/applyd_it.rs", "crates/applyd/tests/service_unit.rs"] }, { "id": "frozen-benchmark", "name": "Frozen deterministic benchmark", "maturity": "implemented", "postures": ["development"], "summary": "A CI-gated corpus contains 32 dangerous frozen scenarios and 11 adversarial-legitimate scenarios; all currently match their expected containment/allow outcomes.", "limitations": ["This is a regression result for a self-authored frozen corpus, not a proof over PostgreSQL's behavioral surface or a public product guarantee."], "evidence": ["dbsafe-bench/golden/expected_outcomes.json", "dbsafe-bench/tests/gate.rs"] }, { "id": "llm-risk-gate", "name": "LLM risk gate", "maturity": "deferred", "postures": ["production-read", "experimental-write"], "summary": "Future tighten-only semantic risk evaluation.", "limitations": ["The current RiskEngine is an Allow stub and supplies no safety guarantee."], "evidence": ["crates/policy/src/risk.rs"] } ], "audit_coverage": { "authoritative_chain": [ "proxy-observed statement allows, blocks, rejects, and budget cutoffs", "covered applyd structural and rehearsal refusals after enough proposal context exists", "approval inspection and signed-grant events handled by enforcement processes", "staged inverse material plus hash-chained apply_precommit_intent and revert_precommit_intent records bound to the recovery identity/digest before primary mutation; definitive post-commit records are not guaranteed across a later sink/finalization failure", "warden action records successfully appended by the running enforcement loop" ], "process_log_only": [ "MCP-local schema and argument validation failures", "requests rejected before proxy or applyd is reached", "local MCP configuration failures", "some early applyd lookups such as unknown proposal identifiers" ] }, "claim_policy": { "active_docs": [ "CLAUDE.md", "README.md", "CONTEXT.md", "docs/README.md", "docs/index.html", "docs/adr/0001-v0-1-safety-postures.md", "docs/architecture.md", "docs/components.md", "docs/demo.md", "docs/development.md", "docs/deployment-patterns.md", "docs/quickstart.md", "KNOWN_BYPASSES.md", "KNOWN_DANGERS.md", "deploy/README.md", "deploy/hba/NETWORK-POLICY.md", "deploy/marquee.sh", "deploy/read-only-up.sh", "deploy/read-only-down.sh", "deploy/test/read_only_state_guards.sh", "deploy/proxy.env.example", "deploy/applyd.env.example", "deploy/warden.env.example", "deploy/sql/10_hardened_role.sql", "deploy/init/10_hardened_role.sql", "fuzz/README.md", "proto/README.md", "crates/audit/sql/10_audit_meta.sql", "crates/applyd/src/main.rs", "crates/cli/src/main.rs", "crates/mcp/src/bin/pgb_mcp.rs", "crates/policy/policy.example.yaml", "crates/proxy/src/main.rs", "crates/warden/src/main.rs", "scripts/build-site.sh" ], "historical_docs": [ "docs/spec/SPEC.md", "docs/spec/SPEC.amendments.md", "docs/spec/decisions.md", "docs/spec/brief.md", "docs/spec/brief.html", "docs/spec/fidelity-spike-report.md" ], "published_historical_docs": [ "docs/spec/SPEC.md", "docs/spec/decisions.md", "docs/spec/brief.md", "docs/spec/brief.html" ], "required_active_phrases": { "CLAUDE.md": [ "Current product claims are governed", "they are useful background", "Production Read disables write tools", "tiny Certified Write Envelope" ], "README.md": [ "fail-closed writes for explicitly certified PostgreSQL shapes", "bounded disclosure, not zero disclosure", "tamper-evident, not tamper-proof", "is non-production. Writes must fail closed", "cumulative meter is shared across connections", "proxy does not yet consume that state", "final audit appends are separate transactions", "publicly mintable" ], "docs/index.html": [ "Current implementation status", "Fail-closed writes for explicitly", "certified PostgreSQL shapes", "not atomically co-committed", "Historical concept brief" ], "scripts/build-site.sh": [ "docs/index.html", "site/index.html", "site/historical/brief.html", "copy_markdown_for_pages", "https://github.com/${REPOSITORY}/blob/${REVISION}", "Pages link audit passed" ], "deploy/hba/NETWORK-POLICY.md": [ "Doctor inspects readable HBA evidence", "cannot prove the external firewall" ], "deploy/read-only-up.sh": [ "repository does not itself", "production support: deployment topology", "PGB_PROXY_SOURCE_CIDR", "writes: disabled; pgb-applyd was not started", "PGB_PROXY_HOST='$PGB_PROXY_TLS_SERVER_NAME'", "PGB_PG_ROOT_CERT" ], "deploy/read-only-down.sh": [ "never recursively removes", "refusing an unmarked or foreign state directory", "logs retained" ], "deploy/warden.env.example": [ "does not consume PGB_BACKEND_{HOST,PORT,DB}", "PGB_DEV_ALLOW_WARDEN_TARGET_OVERRIDE=true", "PGB_PG_ROOT_CERT" ], "deploy/proxy.env.example": [ "PGB_CLIENT_FRAME_TIMEOUT_MS=300000", "PGB_MAX_CONNECTIONS=128" ], "deploy/applyd.env.example": [ "applyd does not consume PGB_POLICY_ROLE", "not atomically", "DEVELOPMENT ANCHOR ONLY" ], "deploy/sql/10_hardened_role.sql": [ "Role creation, attributes, memberships, and ALTER ROLE SET", "Doctor performs that point-in-time catalog", "ProxyConfig::DEFAULT_SEARCH_PATH is exactly" ], "deploy/init/10_hardened_role.sql": [ "Role creation, attributes, memberships, and ALTER ROLE SET", "Doctor performs that point-in-time catalog", "ProxyConfig::DEFAULT_SEARCH_PATH is exactly" ], "fuzz/README.md": [ "one scoped parser invariant", "does not establish Postgres-native catalog resolution" ], "proto/README.md": [ "intentional placeholder", "current agent-facing MCP server is the native Rust" ], "KNOWN_BYPASSES.md": [ "Record-population and", "jsonb_to_recordset", "custom_cast_and_generic_type_literal_are_not_read" ], "crates/applyd/src/main.rs": [ "deletable Development Anchor", "separate `_meta` transaction" ], "crates/cli/src/main.rs": [ "exact SELECT-only PGB_MCP_META_READER_DSN", "Missing, invalid, or visibly open HBA evidence is blocking outside Development" ], "crates/mcp/src/bin/pgb_mcp.rs": [ "PGB_MCP_META_READER_DSN", "writers and is rejected if it leaks into the MCP runtime environment" ], "crates/proxy/src/main.rs": [ "Development file-anchor path", "operator can delete and" ], "crates/warden/src/main.rs": [ "a trip does not shed new traffic" ], "docs/deployment-patterns.md": [ "managed service that cannot expose an exact matching HBA rule is unsupported in v0.1", "no AWS, Google Cloud, Supabase, or Kubernetes evidence Adapter" ], "crates/policy/policy.example.yaml": [ "select_whitelist is parsed but not enforced", "autonomy is parsed and validated but does not change runtime authorization" ] }, "forbidden_active_phrases": [ "0 catastrophic data-loss false-negatives", "0 catastrophic false-negatives", "zero catastrophic false negatives", "zero catastrophic data-loss false negatives", "can't cause disaster", "cannot cause disaster", "by construction", "by construction (writes bounded", "fail-closed read classifier", "only v0.1 posture eligible for production support", "production-supported read-only posture", "every action lands", "Every decision", "executed mutations", "independently authenticated operator identity", "authenticated circuit breaker", "production apply caller", "externally-anchored audit", "owns circuit-breaker actions", "independently verifies restored state", "replica routing is parsed-but-inert", "replica targets are parsed but do not route reads", "backend PostgreSQL hop does not yet support production TLS", "durable restart-safe recovery is deferred", "deployed recovery is not restart-safe", "does not yet provide durable restart-safe Recovery Material", "isolated placement is not mandatory", "production wire does not retain a restart-safe inverse", "durable recovery are incomplete", "safe to point an agent", "unqualified custom-type/input-function residual", "bare user-defined type input functions" ] } }