# Capability status Current as of **2026-07-10**. The machine-readable source is [`capabilities.json`](https://github.com/NikolayS/pg_brakes/blob/65d169e0177015a8b5ddb73b541a5112d7d6fdd1/capabilities.json); the governing decision is [`ADR-0001`](https://github.com/NikolayS/pg_brakes/blob/65d169e0177015a8b5ddb73b541a5112d7d6fdd1/docs/adr/0001-v0-1-safety-postures.md). Public write guarantee: **Fail-closed writes for explicitly certified PostgreSQL shapes.** Maturity describes the current tree, not deployment eligibility. An implemented capability is production-eligible only when every prerequisite for its runtime posture is proven. ## Runtime postures | Posture | Maturity | Scope and eligibility | |---|---|---| | Production Read Posture | `implemented` | The only v0.1 posture eligible for production evaluation: five read tools through the proxy to a physical replica, with a least-privilege role, bounded disclosure, cancellation, warden monitoring, and authoritative audit evidence. The repository does not confer production support by itself. Every load-bearing network, process identity, credential, transport, schema, replica, audit-retention, and operational prerequisite must be proven; unknown is unsupported. Doctor checks database-visible evidence, while external topology and controls require separate evidence. | | Experimental Write Posture | `experimental` | Explicitly enabled, non-production exact-key UPDATE/DELETE work only; catalog-bound certification, operator-provisioned rehearsal, exact-set approval, and durable restart-safe recovery are implemented. Applyd refuses startup unless clone.provider=dblab, a distinct rehearsal DSN and running-postmaster identity, approval, and recovery prerequisites are present. The apply and rehearsal roles need EXECUTE on pg_control_system(); the operator—not applyd—attests clone provenance, freshness, external-side-effect isolation, and governance. | | Development Posture | `development-only` | Throwaway Postgres, primary transaction rehearsal, local file anchors, demos, and benchmark fixtures. Cannot produce a production-supported verdict. | ## Capabilities | Capability | Maturity | Postures | Current scope | |---|---|---|---| | Least-privilege WALL roles | `implemented` | Production Read Posture, Experimental Write Posture, Development Posture | Agent-scoped role hardening, explicit read grants, and a separate applier role whose effective table/column write grants, WALL attributes, CREATE/TRUNCATE/TRIGGER privileges, memberships, and ownership across persistent owner-bearing catalogs are rejected unless they fit the DML-only envelope. Replica role checks run against the actual configured read endpoint. Limitation: The shared-database default deliberately leaves PUBLIC privileges unchanged; the proxy-origin requirement remains load-bearing. Limitation: Doctor evidence is point-in-time and must be rerun after role, ownership, grant, replica, or schema changes. | | Proxy read enforcement | `implemented` | Production Read Posture, Experimental Write Posture, Development Posture | Extended-protocol-only, default-deny handling of the recognized SQL subset, and rejection of user-created Parse parameter type OIDs before Bind; 64 KiB startup/16 MiB tagged-frame allocation caps; per-agent-frame receive deadlines; a process-local concurrent-connection cap; statement row/byte/time limits; a shared in-process per-policy-role cumulative meter; cancellation; statement audit; and posture-owned backend routing. Limitation: The classifier uses a generic parser and curated semantic allowlist rather than PostgreSQL-native parsing and catalog resolution. Production eligibility therefore depends on a current green doctor assessment of the granted PostgreSQL catalog surface plus schema-change controls; classifier acceptance alone is not certification. Limitation: The cumulative meter and connection cap are process-local. The meter resets on restart and neither control is coordinated across multiple proxy instances. | | Policy select_whitelist enforcement | `parsed-but-inert` | Production Read Posture, Experimental Write Posture, Development Posture | RolePolicy.select_whitelist is deserialized and retained for forward-compatible policy shape, but no proxy or daemon enforces it. Limitation: An empty list does not make the runtime role unable to read, and listed relations do not grant access. Explicit PostgreSQL SELECT grants define the actual read surface; doctor inventories the resulting live semantic surface and both controls remain load-bearing. | | Policy autonomy enforcement | `parsed-but-inert` | Production Read Posture, Experimental Write Posture, Development Posture | RolePolicy.autonomy is deserialized and values above L2 are rejected, but L0-L2 do not currently change runtime authorization or approval behavior. Limitation: The proxy consumes only the selected role's budget. Production Read exposes no write tools; Experimental Write always uses the signed single-use operator approval workflow regardless of the autonomy label. | | Verified agent and read-backend transport | `implemented` | Production Read Posture, Experimental Write Posture, Development Posture | Production postures require TLS on the agent-facing proxy endpoint. The proxy originates SCRAM-SHA-256 with server-signature verification and uses configured CA plus hostname verification on its PostgreSQL read-backend hop without plaintext downgrade. Limitation: Certificate issuance, hostname selection, rotation, and key custody remain operator responsibilities. Development may explicitly use the local cleartext proxy fixture. | | Verified synchronous PostgreSQL transport | `implemented` | Production Read Posture, Experimental Write Posture, Development Posture | Applyd, warden, audit, doctor, and MCP audit-reader TCP clients share one connector that promotes omitted/prefer SSL modes to certificate- and hostname-validated TLS with no plaintext fallback. Unix sockets are accepted as local OS transport. Limitation: Explicit sslmode=disable TCP is Development-only; production postures reject it at startup. Applyd, warden, and doctor additionally require PGB_DEV_ALLOW_PLAINTEXT_PG=true for Development plaintext. Operators must provide correct DSN hostnames and, when platform roots are insufficient, PGB_PG_ROOT_CERT or PGSSLROOTCERT. | | Out-of-band warden | `implemented` | Production Read Posture, Experimental Write Posture, Development Posture | Observes the posture-selected PostgreSQL target, terminates tagged runaway agent sessions, emits slot alarms, and trips/audits its in-process breaker state. Limitation: The proxy does not consume warden breaker state, so a breaker trip does not currently shed new proxy traffic. Limitation: The breaker credential is a publicly mintable in-process marker, not an authenticated warden-to-proxy channel or external authorization boundary. Limitation: Operational safety depends on correct target selection, deployment identity, audit connectivity, and termination privileges. | | Native Rust MCP server | `implemented` | Production Read Posture, Experimental Write Posture, Development Posture | The current agent-facing stdio server; cooperative UX, never a security seam. Production Read advertises five read tools; Experimental Write and Development advertise the full nine-tool catalog, with no agent-facing approve tool. Limitation: MCP-local validation failures are process-logged, not automatically appended to the authoritative audit chain. | | Exact MCP audit-reader confinement | `implemented` | Production Read Posture, Experimental Write Posture, Development Posture | MCP consumes only PGB_MCP_META_READER_DSN for get_audit; it refuses PGB_META_DSN and never falls back to policy audit.target. Doctor inspects that exact credential for audit-tail read only, including effective table/column privileges, other readable data, ownership, memberships/escalation, create/temp, and reachable user-defined routines. Limitation: The audit hardening assumes a dedicated _meta database. The doctor result is point-in-time, so any later role, grant, schema, default-privilege, or routine change requires migration controls and a fresh preflight. | | Authoritative audit chain | `implemented` | Production Read Posture, Experimental Write Posture, Development Posture | Canonical hash-chained records in the _meta sink for covered proxy statement decisions, applyd lifecycle records, a structurally bound apply_precommit_intent after inverse staging and before primary COMMIT, a bound revert_precommit_intent before the primary revert transaction, and successfully appended warden action records. Limitation: Primary apply/revert commits and final _meta audit appends are separate transactions. A post-commit recovery-finalization or audit-sink failure can leave an explicit ambiguous recovery record and no definitive final audit record; no atomic cross-database audit guarantee exists. Limitation: MCP-local validation, requests rejected before proxy/applyd, and some early applyd lookups are process logs or uncovered rather than authoritative chain records. Limitation: The shipped SQL hardening assumes a dedicated _meta database and point-in-time doctor validation after relevant catalog/grant changes. Limitation: Tamper-evident does not mean tamper-proof. | | Local development anchor | `development-only` | Development Posture | A local file/HMAC Adapter exercises anchor verification semantics. Limitation: Deleting the file allows a new baseline; it is not independently retained, production key-separated, or WORM storage. Runtime startup may use this Adapter, but that use does not upgrade its maturity. | | Production WORM/transparency anchor | `deferred` | Production Read Posture, Experimental Write Posture | Independently administered retention enforcement and production key separation. Limitation: No production Adapter exists in v0.1. | | Policy audit.anchor_endpoint wiring | `parsed-but-inert` | Production Read Posture, Experimental Write Posture, Development Posture | Policy can represent a future external anchor endpoint. Limitation: No runtime path sends chain heads to audit.anchor_endpoint; current anchoring uses the configured local Development Anchor path. | | Read-replica routing | `implemented` | Production Read Posture, Experimental Write Posture, Development Posture | Production Read Posture requires and uses typed replica.target with no primary fallback; Experimental Write prefers it, while Development uses the primary. Limitation: Legacy replica.dsn is rejected. Doctor and the proxy attest recovery/read-only state, while operators must still prove intended topology, lag, and failover behavior. | | Deployment prerequisite attestation | `implemented` | Production Read Posture, Experimental Write Posture | pgb-cli doctor makes missing/open HBA evidence, replica evidence, effective table/column grants, PostgreSQL-native readable semantic hazards (including generated columns and every user-created cast), exact MCP reader confinement, and audit-chain/anchor evidence blocking outside explicit Development Posture. Limitation: Database HBA evidence cannot by itself prove external firewalls, cloud security groups, Kubernetes network policy, or dedicated egress/process identity. Limitation: Production doctor also has no provider-evidence override: missing or unreadable exact hostssl/SCRAM HBA evidence is blocking. No AWS, Google Cloud, Supabase, or Kubernetes evidence Adapter is shipped, so a managed service unable to expose the exact matching rule is unsupported in v0.1. | | Managed-provider network evidence Adapters | `deferred` | Production Read Posture | Future Adapters could validate provider-native network and workload-identity controls when PostgreSQL HBA state is unavailable. Limitation: No Adapter or doctor override exists. The managed-cloud, Supabase, and external-managed Kubernetes sections are reference designs, not current Production Read support. | | Production Read runtime launcher | `implemented` | Production Read Posture | A fail-closed launcher runs doctor, starts only the proxy and warden, and prints read-only MCP wiring. Its dedicated teardown verifies marked state and tracked executable identity, signals only those processes, and retains logs. Limitation: The scripts provision no infrastructure and do not establish a production verdict; operators must supply and separately prove every external prerequisite. Limitation: PID tracking and retained logs are local to one launcher state directory. The Development deploy/down.sh is not a Production Read teardown. | | Policy secret_ref resolution | `parsed-but-inert` | Production Read Posture, Experimental Write Posture, Development Posture | Typed targets can carry a credential-less secret_ref for forward-compatible policy shape. Limitation: No runtime secret-manager Adapter resolves secret_ref; supported out-of-band environment secret inputs remain required. | | Policy approval-key reference resolution | `parsed-but-inert` | Experimental Write Posture, Development Posture | Policy can carry approvers.cli_signing_key_id for a future KMS/keyring Adapter. Limitation: No runtime Adapter resolves this field. Applyd currently requires PGB_APPROVER_PUBKEY and pgb-cli reads PGB_APPROVER_SEED_HEX locally. | | Operator-provisioned rehearsal target | `experimental` | Experimental Write Posture, Development Posture | Experimental Write requires clone.provider=dblab, a distinct PGB_REHEARSAL_DSN, and a different running PostgreSQL instance identified by system_identifier plus postmaster start time; aliases and separate databases on one postmaster are refused. Only Development may use primary transaction rehearsal. Limitation: The apply and rehearsal roles need EXECUTE on pg_control_system(). Applyd does not provision or cryptographically attest DBLab; instance separation does not prove clone provenance, freshness, isolation from external side effects, lifecycle, or governance. | | Primary transaction rehearsal | `development-only` | Development Posture | Runs candidate SQL on the primary and rolls back ordinary transactional changes. Limitation: Rollback cannot undo sequence, external, remote, filesystem, or other non-transactional side effects; it is prohibited in Experimental Write Posture. | | Exact-key Certified Write Envelope | `experimental` | Experimental Write Posture, Development Posture | One schema-qualified ordinary permanent table with no alias; one UPDATE or DELETE; the sole int4 primary key compared by equality or IN to int4 literals; literal-only UPDATE assignments; full-row pre-images; no primary-key update. Catalog OIDs, key attnum/type OID, exact quoted names, and a catalog fingerprint flow through rehearsal, exact-set approval, guarded apply, recovery, and revert. Limitation: UPDATE FROM, DELETE USING, joins, RETURNING, ORDER BY, LIMIT, target modifiers, expressions/casts/functions/defaults/placeholders in assignments, and broad predicates are refused. Limitation: Only heap tables with the primary-key index are accepted: triggers, rules, RLS/policies, inheritance/partitions, foreign tables, generated/identity columns, cascading/SET NULL/SET DEFAULT foreign keys, CHECK/exclusion constraints, and secondary/expression/partial indexes are refused. Limitation: Restorable columns are limited to int2, int4, int8, text, varchar, bpchar, name, and bytea. The envelope remains Experimental while independent review and production hardening of clone lifecycle, operator identity/workflow, and audit anchoring remain incomplete. | | Local signed operator approval | `experimental` | Experimental Write Posture, Development Posture | The CLI asks applyd to inspect the canonical binding, displays the exact SQL/role/session/catalog identity/cap/typed keys/nonce/expiry, requires typed confirmation or explicit change evidence, signs locally, and sends only the binding, signature, approver id, and confirmation evidence. Applyd revalidates the stored request, inspected binding, execution role, configured authority, hard TTL, and single-use state. Limitation: The shipped workflow is an owner-only Unix-socket CLI, not an operator UI, WebAuthn flow, dual control, or hosted identity system. The approver-id string is authorized by socket/operator custody and must differ from the requester; no separate identity-provider attestation is implemented. Limitation: PGB_APPLYD_SOCKET must be absolute. A missing parent is created mode 0700; an existing parent must already be a non-symlink directory with no group/other access and is never chmod'd into compliance. The socket is mode 0600. | | Durable restart-safe recovery | `experimental` | Experimental Write Posture | Inverse JSON and its SHA-256 digest are staged in _meta before primary commit; STAGED/APPLIED/REVERTING/REVERTED state, Recovery Receipts, and signed expiring single-use operator revert survive daemon restart. Revert revalidates catalog identity, compare-and-swaps captured after-images, and requires exact cardinality before committing. Limitation: A crash or post-commit finalization failure with unknown primary outcome leaves explicit STAGED or REVERTING material and blocks later writes until operator reconciliation. Limitation: Primary commit, recovery-state finalization, and final audit append are not one atomic transaction; a committed mutation may lack a definitive final audit record when a later sink append fails. Limitation: Byte-for-byte independent comparison is integration-test evidence; the runtime verifier is catalog validation plus after-image compare-and-swap and cardinality, not a separate external diff system. This remains Experimental Write Posture only. | | Frozen deterministic benchmark | `implemented` | Development Posture | A CI-gated corpus contains 32 dangerous frozen scenarios and 11 adversarial-legitimate scenarios; all currently match their expected containment/allow outcomes. Limitation: This is a regression result for a self-authored frozen corpus, not a proof over PostgreSQL's behavioral surface or a public product guarantee. | | LLM risk gate | `deferred` | Production Read Posture, Experimental Write Posture | Future tighten-only semantic risk evaluation. Limitation: The current RiskEngine is an Allow stub and supplies no safety guarantee. | ## Evidence - **Least-privilege WALL roles:** [`deploy/sql/10_hardened_role.sql`](https://github.com/NikolayS/pg_brakes/blob/65d169e0177015a8b5ddb73b541a5112d7d6fdd1/deploy/sql/10_hardened_role.sql), [`deploy/test/wall_matrix.sh`](https://github.com/NikolayS/pg_brakes/blob/65d169e0177015a8b5ddb73b541a5112d7d6fdd1/deploy/test/wall_matrix.sh), [`crates/cli/src/main.rs`](https://github.com/NikolayS/pg_brakes/blob/65d169e0177015a8b5ddb73b541a5112d7d6fdd1/crates/cli/src/main.rs), [`crates/cli/tests/doctor_it.rs`](https://github.com/NikolayS/pg_brakes/blob/65d169e0177015a8b5ddb73b541a5112d7d6fdd1/crates/cli/tests/doctor_it.rs) - **Proxy read enforcement:** [`crates/pgwire/src/codec.rs`](https://github.com/NikolayS/pg_brakes/blob/65d169e0177015a8b5ddb73b541a5112d7d6fdd1/crates/pgwire/src/codec.rs), [`crates/pgwire/tests/codec_async.rs`](https://github.com/NikolayS/pg_brakes/blob/65d169e0177015a8b5ddb73b541a5112d7d6fdd1/crates/pgwire/tests/codec_async.rs), [`crates/pgwire/tests/classifier.rs`](https://github.com/NikolayS/pg_brakes/blob/65d169e0177015a8b5ddb73b541a5112d7d6fdd1/crates/pgwire/tests/classifier.rs), [`crates/proxy/src/enforce.rs`](https://github.com/NikolayS/pg_brakes/blob/65d169e0177015a8b5ddb73b541a5112d7d6fdd1/crates/proxy/src/enforce.rs), [`crates/proxy/src/session.rs`](https://github.com/NikolayS/pg_brakes/blob/65d169e0177015a8b5ddb73b541a5112d7d6fdd1/crates/proxy/src/session.rs), [`crates/proxy/src/main.rs`](https://github.com/NikolayS/pg_brakes/blob/65d169e0177015a8b5ddb73b541a5112d7d6fdd1/crates/proxy/src/main.rs), [`crates/proxy/src/budget.rs`](https://github.com/NikolayS/pg_brakes/blob/65d169e0177015a8b5ddb73b541a5112d7d6fdd1/crates/proxy/src/budget.rs), [`crates/proxy/src/window.rs`](https://github.com/NikolayS/pg_brakes/blob/65d169e0177015a8b5ddb73b541a5112d7d6fdd1/crates/proxy/src/window.rs), [`crates/proxy/tests/proxy_it.rs`](https://github.com/NikolayS/pg_brakes/blob/65d169e0177015a8b5ddb73b541a5112d7d6fdd1/crates/proxy/tests/proxy_it.rs) - **Policy select_whitelist enforcement:** [`crates/policy/src/config.rs`](https://github.com/NikolayS/pg_brakes/blob/65d169e0177015a8b5ddb73b541a5112d7d6fdd1/crates/policy/src/config.rs), [`crates/proxy/src/config.rs`](https://github.com/NikolayS/pg_brakes/blob/65d169e0177015a8b5ddb73b541a5112d7d6fdd1/crates/proxy/src/config.rs), [`deploy/sql/10_hardened_role.sql`](https://github.com/NikolayS/pg_brakes/blob/65d169e0177015a8b5ddb73b541a5112d7d6fdd1/deploy/sql/10_hardened_role.sql), [`crates/cli/src/main.rs`](https://github.com/NikolayS/pg_brakes/blob/65d169e0177015a8b5ddb73b541a5112d7d6fdd1/crates/cli/src/main.rs) - **Policy autonomy enforcement:** [`crates/policy/src/config.rs`](https://github.com/NikolayS/pg_brakes/blob/65d169e0177015a8b5ddb73b541a5112d7d6fdd1/crates/policy/src/config.rs), [`crates/proxy/src/config.rs`](https://github.com/NikolayS/pg_brakes/blob/65d169e0177015a8b5ddb73b541a5112d7d6fdd1/crates/proxy/src/config.rs), [`crates/applyd/src/service.rs`](https://github.com/NikolayS/pg_brakes/blob/65d169e0177015a8b5ddb73b541a5112d7d6fdd1/crates/applyd/src/service.rs), [`crates/mcp/src/bin/pgb_mcp.rs`](https://github.com/NikolayS/pg_brakes/blob/65d169e0177015a8b5ddb73b541a5112d7d6fdd1/crates/mcp/src/bin/pgb_mcp.rs) - **Verified agent and read-backend transport:** [`crates/proxy/src/auth.rs`](https://github.com/NikolayS/pg_brakes/blob/65d169e0177015a8b5ddb73b541a5112d7d6fdd1/crates/proxy/src/auth.rs), [`crates/proxy/src/config.rs`](https://github.com/NikolayS/pg_brakes/blob/65d169e0177015a8b5ddb73b541a5112d7d6fdd1/crates/proxy/src/config.rs), [`crates/proxy/src/session.rs`](https://github.com/NikolayS/pg_brakes/blob/65d169e0177015a8b5ddb73b541a5112d7d6fdd1/crates/proxy/src/session.rs) - **Verified synchronous PostgreSQL transport:** [`crates/pg-client/src/lib.rs`](https://github.com/NikolayS/pg_brakes/blob/65d169e0177015a8b5ddb73b541a5112d7d6fdd1/crates/pg-client/src/lib.rs), [`crates/applyd/src/main.rs`](https://github.com/NikolayS/pg_brakes/blob/65d169e0177015a8b5ddb73b541a5112d7d6fdd1/crates/applyd/src/main.rs), [`crates/warden/src/main.rs`](https://github.com/NikolayS/pg_brakes/blob/65d169e0177015a8b5ddb73b541a5112d7d6fdd1/crates/warden/src/main.rs), [`crates/audit/src/pg.rs`](https://github.com/NikolayS/pg_brakes/blob/65d169e0177015a8b5ddb73b541a5112d7d6fdd1/crates/audit/src/pg.rs), [`crates/cli/src/main.rs`](https://github.com/NikolayS/pg_brakes/blob/65d169e0177015a8b5ddb73b541a5112d7d6fdd1/crates/cli/src/main.rs), [`crates/mcp/src/bin/pgb_mcp.rs`](https://github.com/NikolayS/pg_brakes/blob/65d169e0177015a8b5ddb73b541a5112d7d6fdd1/crates/mcp/src/bin/pgb_mcp.rs) - **Out-of-band warden:** [`crates/warden/src/run.rs`](https://github.com/NikolayS/pg_brakes/blob/65d169e0177015a8b5ddb73b541a5112d7d6fdd1/crates/warden/src/run.rs), [`crates/warden/tests/warden_it.rs`](https://github.com/NikolayS/pg_brakes/blob/65d169e0177015a8b5ddb73b541a5112d7d6fdd1/crates/warden/tests/warden_it.rs) - **Native Rust MCP server:** [`crates/mcp/src/bin/pgb_mcp.rs`](https://github.com/NikolayS/pg_brakes/blob/65d169e0177015a8b5ddb73b541a5112d7d6fdd1/crates/mcp/src/bin/pgb_mcp.rs), [`crates/mcp/tests/read_path_e2e.rs`](https://github.com/NikolayS/pg_brakes/blob/65d169e0177015a8b5ddb73b541a5112d7d6fdd1/crates/mcp/tests/read_path_e2e.rs), [`crates/mcp/tests/write_path_e2e.rs`](https://github.com/NikolayS/pg_brakes/blob/65d169e0177015a8b5ddb73b541a5112d7d6fdd1/crates/mcp/tests/write_path_e2e.rs) - **Exact MCP audit-reader confinement:** [`crates/mcp/src/bin/pgb_mcp.rs`](https://github.com/NikolayS/pg_brakes/blob/65d169e0177015a8b5ddb73b541a5112d7d6fdd1/crates/mcp/src/bin/pgb_mcp.rs), [`crates/cli/src/main.rs`](https://github.com/NikolayS/pg_brakes/blob/65d169e0177015a8b5ddb73b541a5112d7d6fdd1/crates/cli/src/main.rs), [`crates/cli/src/doctor.rs`](https://github.com/NikolayS/pg_brakes/blob/65d169e0177015a8b5ddb73b541a5112d7d6fdd1/crates/cli/src/doctor.rs), [`crates/cli/tests/doctor_it.rs`](https://github.com/NikolayS/pg_brakes/blob/65d169e0177015a8b5ddb73b541a5112d7d6fdd1/crates/cli/tests/doctor_it.rs), [`crates/audit/sql/10_audit_meta.sql`](https://github.com/NikolayS/pg_brakes/blob/65d169e0177015a8b5ddb73b541a5112d7d6fdd1/crates/audit/sql/10_audit_meta.sql), [`crates/audit/tests/pg_meta_it.rs`](https://github.com/NikolayS/pg_brakes/blob/65d169e0177015a8b5ddb73b541a5112d7d6fdd1/crates/audit/tests/pg_meta_it.rs) - **Authoritative audit chain:** [`crates/audit/src/chain.rs`](https://github.com/NikolayS/pg_brakes/blob/65d169e0177015a8b5ddb73b541a5112d7d6fdd1/crates/audit/src/chain.rs), [`crates/audit/src/pg.rs`](https://github.com/NikolayS/pg_brakes/blob/65d169e0177015a8b5ddb73b541a5112d7d6fdd1/crates/audit/src/pg.rs), [`crates/audit/tests/pg_meta_it.rs`](https://github.com/NikolayS/pg_brakes/blob/65d169e0177015a8b5ddb73b541a5112d7d6fdd1/crates/audit/tests/pg_meta_it.rs) - **Local development anchor:** [`crates/audit/src/anchor.rs`](https://github.com/NikolayS/pg_brakes/blob/65d169e0177015a8b5ddb73b541a5112d7d6fdd1/crates/audit/src/anchor.rs), [`crates/audit/src/kms.rs`](https://github.com/NikolayS/pg_brakes/blob/65d169e0177015a8b5ddb73b541a5112d7d6fdd1/crates/audit/src/kms.rs), [`crates/audit/tests/anchor.rs`](https://github.com/NikolayS/pg_brakes/blob/65d169e0177015a8b5ddb73b541a5112d7d6fdd1/crates/audit/tests/anchor.rs) - **Production WORM/transparency anchor:** [`KNOWN_BYPASSES.md`](https://github.com/NikolayS/pg_brakes/blob/65d169e0177015a8b5ddb73b541a5112d7d6fdd1/KNOWN_BYPASSES.md) - **Policy audit.anchor_endpoint wiring:** [`crates/policy/src/config.rs`](https://github.com/NikolayS/pg_brakes/blob/65d169e0177015a8b5ddb73b541a5112d7d6fdd1/crates/policy/src/config.rs), [`crates/policy/policy.example.yaml`](https://github.com/NikolayS/pg_brakes/blob/65d169e0177015a8b5ddb73b541a5112d7d6fdd1/crates/policy/policy.example.yaml) - **Read-replica routing:** [`crates/policy/src/config.rs`](https://github.com/NikolayS/pg_brakes/blob/65d169e0177015a8b5ddb73b541a5112d7d6fdd1/crates/policy/src/config.rs), [`crates/proxy/src/main.rs`](https://github.com/NikolayS/pg_brakes/blob/65d169e0177015a8b5ddb73b541a5112d7d6fdd1/crates/proxy/src/main.rs), [`crates/proxy/src/session.rs`](https://github.com/NikolayS/pg_brakes/blob/65d169e0177015a8b5ddb73b541a5112d7d6fdd1/crates/proxy/src/session.rs), [`crates/cli/src/main.rs`](https://github.com/NikolayS/pg_brakes/blob/65d169e0177015a8b5ddb73b541a5112d7d6fdd1/crates/cli/src/main.rs) - **Deployment prerequisite attestation:** [`crates/cli/src/doctor.rs`](https://github.com/NikolayS/pg_brakes/blob/65d169e0177015a8b5ddb73b541a5112d7d6fdd1/crates/cli/src/doctor.rs), [`crates/cli/tests/doctor_it.rs`](https://github.com/NikolayS/pg_brakes/blob/65d169e0177015a8b5ddb73b541a5112d7d6fdd1/crates/cli/tests/doctor_it.rs), [`deploy/hba/NETWORK-POLICY.md`](https://github.com/NikolayS/pg_brakes/blob/65d169e0177015a8b5ddb73b541a5112d7d6fdd1/deploy/hba/NETWORK-POLICY.md), [`docs/deployment-patterns.md`](https://github.com/NikolayS/pg_brakes/blob/65d169e0177015a8b5ddb73b541a5112d7d6fdd1/docs/deployment-patterns.md) - **Managed-provider network evidence Adapters:** [`docs/deployment-patterns.md`](https://github.com/NikolayS/pg_brakes/blob/65d169e0177015a8b5ddb73b541a5112d7d6fdd1/docs/deployment-patterns.md), [`crates/cli/src/doctor.rs`](https://github.com/NikolayS/pg_brakes/blob/65d169e0177015a8b5ddb73b541a5112d7d6fdd1/crates/cli/src/doctor.rs) - **Production Read runtime launcher:** [`deploy/read-only-up.sh`](https://github.com/NikolayS/pg_brakes/blob/65d169e0177015a8b5ddb73b541a5112d7d6fdd1/deploy/read-only-up.sh), [`deploy/read-only-down.sh`](https://github.com/NikolayS/pg_brakes/blob/65d169e0177015a8b5ddb73b541a5112d7d6fdd1/deploy/read-only-down.sh), [`deploy/test/read_only_state_guards.sh`](https://github.com/NikolayS/pg_brakes/blob/65d169e0177015a8b5ddb73b541a5112d7d6fdd1/deploy/test/read_only_state_guards.sh), [`docs/deployment-patterns.md`](https://github.com/NikolayS/pg_brakes/blob/65d169e0177015a8b5ddb73b541a5112d7d6fdd1/docs/deployment-patterns.md) - **Policy secret_ref resolution:** [`crates/policy/src/config.rs`](https://github.com/NikolayS/pg_brakes/blob/65d169e0177015a8b5ddb73b541a5112d7d6fdd1/crates/policy/src/config.rs), [`crates/policy/policy.example.yaml`](https://github.com/NikolayS/pg_brakes/blob/65d169e0177015a8b5ddb73b541a5112d7d6fdd1/crates/policy/policy.example.yaml) - **Policy approval-key reference resolution:** [`crates/policy/src/config.rs`](https://github.com/NikolayS/pg_brakes/blob/65d169e0177015a8b5ddb73b541a5112d7d6fdd1/crates/policy/src/config.rs), [`crates/policy/policy.example.yaml`](https://github.com/NikolayS/pg_brakes/blob/65d169e0177015a8b5ddb73b541a5112d7d6fdd1/crates/policy/policy.example.yaml), [`crates/applyd/src/main.rs`](https://github.com/NikolayS/pg_brakes/blob/65d169e0177015a8b5ddb73b541a5112d7d6fdd1/crates/applyd/src/main.rs), [`crates/cli/src/main.rs`](https://github.com/NikolayS/pg_brakes/blob/65d169e0177015a8b5ddb73b541a5112d7d6fdd1/crates/cli/src/main.rs) - **Operator-provisioned rehearsal target:** [`crates/applyd/src/isolation.rs`](https://github.com/NikolayS/pg_brakes/blob/65d169e0177015a8b5ddb73b541a5112d7d6fdd1/crates/applyd/src/isolation.rs), [`crates/applyd/src/main.rs`](https://github.com/NikolayS/pg_brakes/blob/65d169e0177015a8b5ddb73b541a5112d7d6fdd1/crates/applyd/src/main.rs), [`crates/applyd/tests/applyd_it.rs`](https://github.com/NikolayS/pg_brakes/blob/65d169e0177015a8b5ddb73b541a5112d7d6fdd1/crates/applyd/tests/applyd_it.rs), [`crates/clone-orchestrator/tests/clone_governance_it.rs`](https://github.com/NikolayS/pg_brakes/blob/65d169e0177015a8b5ddb73b541a5112d7d6fdd1/crates/clone-orchestrator/tests/clone_governance_it.rs) - **Primary transaction rehearsal:** [`crates/clone-orchestrator/src/dry_run.rs`](https://github.com/NikolayS/pg_brakes/blob/65d169e0177015a8b5ddb73b541a5112d7d6fdd1/crates/clone-orchestrator/src/dry_run.rs), [`docs/adr/0001-v0-1-safety-postures.md`](https://github.com/NikolayS/pg_brakes/blob/65d169e0177015a8b5ddb73b541a5112d7d6fdd1/docs/adr/0001-v0-1-safety-postures.md) - **Exact-key Certified Write Envelope:** [`CONTEXT.md`](https://github.com/NikolayS/pg_brakes/blob/65d169e0177015a8b5ddb73b541a5112d7d6fdd1/CONTEXT.md), [`docs/adr/0001-v0-1-safety-postures.md`](https://github.com/NikolayS/pg_brakes/blob/65d169e0177015a8b5ddb73b541a5112d7d6fdd1/docs/adr/0001-v0-1-safety-postures.md), [`crates/clone-orchestrator/src/write_envelope.rs`](https://github.com/NikolayS/pg_brakes/blob/65d169e0177015a8b5ddb73b541a5112d7d6fdd1/crates/clone-orchestrator/src/write_envelope.rs), [`crates/clone-orchestrator/src/apply.rs`](https://github.com/NikolayS/pg_brakes/blob/65d169e0177015a8b5ddb73b541a5112d7d6fdd1/crates/clone-orchestrator/src/apply.rs), [`crates/clone-orchestrator/src/conn.rs`](https://github.com/NikolayS/pg_brakes/blob/65d169e0177015a8b5ddb73b541a5112d7d6fdd1/crates/clone-orchestrator/src/conn.rs), [`crates/clone-orchestrator/src/revert.rs`](https://github.com/NikolayS/pg_brakes/blob/65d169e0177015a8b5ddb73b541a5112d7d6fdd1/crates/clone-orchestrator/src/revert.rs), [`crates/clone-orchestrator/tests/envelope_it.rs`](https://github.com/NikolayS/pg_brakes/blob/65d169e0177015a8b5ddb73b541a5112d7d6fdd1/crates/clone-orchestrator/tests/envelope_it.rs), [`crates/clone-orchestrator/tests/identity_it.rs`](https://github.com/NikolayS/pg_brakes/blob/65d169e0177015a8b5ddb73b541a5112d7d6fdd1/crates/clone-orchestrator/tests/identity_it.rs), [`crates/clone-orchestrator/tests/apply_grant_it.rs`](https://github.com/NikolayS/pg_brakes/blob/65d169e0177015a8b5ddb73b541a5112d7d6fdd1/crates/clone-orchestrator/tests/apply_grant_it.rs) - **Local signed operator approval:** [`crates/applyd/src/protocol.rs`](https://github.com/NikolayS/pg_brakes/blob/65d169e0177015a8b5ddb73b541a5112d7d6fdd1/crates/applyd/src/protocol.rs), [`crates/applyd/src/service.rs`](https://github.com/NikolayS/pg_brakes/blob/65d169e0177015a8b5ddb73b541a5112d7d6fdd1/crates/applyd/src/service.rs), [`crates/applyd/src/main.rs`](https://github.com/NikolayS/pg_brakes/blob/65d169e0177015a8b5ddb73b541a5112d7d6fdd1/crates/applyd/src/main.rs), [`crates/cli/src/main.rs`](https://github.com/NikolayS/pg_brakes/blob/65d169e0177015a8b5ddb73b541a5112d7d6fdd1/crates/cli/src/main.rs), [`crates/cli/tests/approval_flow.rs`](https://github.com/NikolayS/pg_brakes/blob/65d169e0177015a8b5ddb73b541a5112d7d6fdd1/crates/cli/tests/approval_flow.rs), [`crates/applyd/tests/service_unit.rs`](https://github.com/NikolayS/pg_brakes/blob/65d169e0177015a8b5ddb73b541a5112d7d6fdd1/crates/applyd/tests/service_unit.rs) - **Durable restart-safe recovery:** [`crates/audit/sql/10_audit_meta.sql`](https://github.com/NikolayS/pg_brakes/blob/65d169e0177015a8b5ddb73b541a5112d7d6fdd1/crates/audit/sql/10_audit_meta.sql), [`crates/applyd/src/recovery.rs`](https://github.com/NikolayS/pg_brakes/blob/65d169e0177015a8b5ddb73b541a5112d7d6fdd1/crates/applyd/src/recovery.rs), [`crates/applyd/src/protocol.rs`](https://github.com/NikolayS/pg_brakes/blob/65d169e0177015a8b5ddb73b541a5112d7d6fdd1/crates/applyd/src/protocol.rs), [`crates/applyd/src/service.rs`](https://github.com/NikolayS/pg_brakes/blob/65d169e0177015a8b5ddb73b541a5112d7d6fdd1/crates/applyd/src/service.rs), [`crates/applyd/src/main.rs`](https://github.com/NikolayS/pg_brakes/blob/65d169e0177015a8b5ddb73b541a5112d7d6fdd1/crates/applyd/src/main.rs), [`crates/cli/src/main.rs`](https://github.com/NikolayS/pg_brakes/blob/65d169e0177015a8b5ddb73b541a5112d7d6fdd1/crates/cli/src/main.rs), [`crates/applyd/tests/applyd_it.rs`](https://github.com/NikolayS/pg_brakes/blob/65d169e0177015a8b5ddb73b541a5112d7d6fdd1/crates/applyd/tests/applyd_it.rs), [`crates/applyd/tests/service_unit.rs`](https://github.com/NikolayS/pg_brakes/blob/65d169e0177015a8b5ddb73b541a5112d7d6fdd1/crates/applyd/tests/service_unit.rs) - **Frozen deterministic benchmark:** [`dbsafe-bench/golden/expected_outcomes.json`](https://github.com/NikolayS/pg_brakes/blob/65d169e0177015a8b5ddb73b541a5112d7d6fdd1/dbsafe-bench/golden/expected_outcomes.json), [`dbsafe-bench/tests/gate.rs`](https://github.com/NikolayS/pg_brakes/blob/65d169e0177015a8b5ddb73b541a5112d7d6fdd1/dbsafe-bench/tests/gate.rs) - **LLM risk gate:** [`crates/policy/src/risk.rs`](https://github.com/NikolayS/pg_brakes/blob/65d169e0177015a8b5ddb73b541a5112d7d6fdd1/crates/policy/src/risk.rs) ## Audit coverage Authoritative `_meta` chain: - proxy-observed statement allows, blocks, rejects, and budget cutoffs - covered applyd structural and rehearsal refusals after enough proposal context exists - approval inspection and signed-grant events handled by enforcement processes - staged inverse material plus hash-chained apply_precommit_intent and revert_precommit_intent records bound to the recovery identity/digest before primary mutation; definitive post-commit records are not guaranteed across a later sink/finalization failure - warden action records successfully appended by the running enforcement loop Cooperative process log only: - MCP-local schema and argument validation failures - requests rejected before proxy or applyd is reached - local MCP configuration failures - some early applyd lookups such as unknown proposal identifiers The local file/HMAC anchor is a Development Anchor. No production retention-enforced anchor Adapter exists in v0.1. ## Maturity vocabulary - **`implemented`:** Present in the shipped tree and covered by named evidence; production use still requires every posture prerequisite to be proven. - **`experimental`:** Present in whole or in part, but not production-supported. - **`development-only`:** Suitable only for local, CI, benchmark, or demonstration use. - **`parsed-but-inert`:** Accepted by configuration or represented by a type, but does not affect runtime behavior. - **`deferred`:** Not implemented in the current tree.