VARUX AXIS Deterministic PostgreSQL Write-Path Control
v0.6 · Pilot Readiness
AXIS Documentation / Getting Started / Overview

Overview

v0.6 · Pilot ReadinessCore verifiedWire lab POCProduction gates open

AXIS is a deterministic control layer for PostgreSQL write paths. It classifies SQL, evaluates versioned policy, enforces the decision, and records durable, hash-linked evidence — so no protected production write happens without a paper trail.

VARUX Cyber varuxcyber.com — visit our main site →

What AXIS does

Status summary

AreaStatusEvidence / note
SQL classification & policy engineVerifiedContract v1.0 (ACTIVE – Locked, 2026-08-07); CI mutation tests; evasion corpus
Approval workflowVerifiedImmutable resolve; explicit retry with approval_id; TTL
Audit & evidenceVerifiedWAL + hash chain; restart continuity; /evidence/verify; Evidence Bundle V1
Policy lifecycleVerifiedManifest SHA-256 startup; validate/diff/dry-run; activation & rollback
Real-driver integration37 tests / driverpsycopg3, asyncpg, Prisma, pgJDBC single-statement (2026-07-05)
Operating modesVerifiedshadow → approval_first → enforce; emergency_bypass explicit + logged
Native PG wire protocolExperimentalSimple Query lab POC 65/65; chaos 14/14; Extended Query planned; RFC v1.2 draft
TLS / mTLSPartialVariables exist; pilot runs plaintext on the trusted lab network
Identity, RBAC/SSO, KMS, external ledgerPlannedv1 identity fields are unverified claims; JWT context opt-in in v0.9
Enterprise production / complianceNot certifiedv0.6 = controlled demos, local review, non-production pilot

Decision model

1. Intercept SQL arrives at the protected write path (POST /query) 2. Evaluate classify → policy engine (deterministic, versioned) 3. Decide ALLOW · BLOCK REQUIRE_APPROVAL 4. Evidence decision evidence before execution · WAL + hash chain "No protected production write without durable evidence."
Intercept → Evaluate → Decide → Evidence: the four-step model from the AXIS pilot documentation.
DecisionHTTPBehavior
ALLOW200Evidence written, then executes via the DB adapter; result evidence appended
BLOCK403No database execution; controlled structured error
REQUIRE_APPROVAL202Approval record created with approval_id; executes only after a human approves and the client explicitly retries

Documentation map

Getting Started

Five-minute evaluation: stack up, first query, blocked write, approval drill.

Architecture

Gate components, trust boundaries, read/write split, Control Plane boundary.

SQL Classification

Contract v1.0, QueryType, risk signals, fail-closed ambiguity rules.

Policy Engine

Defaults, rules, manifest startup, validate/diff/dry-run, activation, rollback.

Approval Workflow

Consent-first model: resolve, explicit retry, TTL, immutability.

Audit & Evidence

WAL, hash chain, verification endpoints, Evidence Bundle V1, signing.

API Reference

Every endpoint with payloads and outcomes.

Error Codes

Full registry with HTTP statuses and meaning.

Troubleshooting

Symptom → Cause → Verify → Resolution for common problems.

Security Review

Claims matrix, accepted risks, production review gates.

Limitations

Honest boundaries: what v0.6 cannot do.

Pilot

Scope, acceptance criteria, operator checklist, exit criteria.

Native PG Wire Protocol

Lab POC, RFC v1.2, CancelRequest, EQ roadmap.

Changelog

v0.4 → v0.9 milestones and roadmap.

Quick tour

1 · Health
curl -sS http://localhost:6543/health
# {"status":"ok","version":"0.6.0","uptime_seconds":N}
2 · A safe read
curl -sS -X POST http://localhost:6543/query \
  -H "Content-Type: application/json" \
  -d '{"actor":"demo-ops","app":"demo-read","tenant":"acme","role":"app_ops","host":"localhost","env":"staging","sql":"SELECT 1 AS ok"}'
3 · A blocked delete
curl -sS -X POST http://localhost:6543/query \
  -H "Content-Type: application/json" \
  -d '{"actor":"demo-ops","app":"demo-batch","tenant":"acme","role":"app_ops","host":"localhost","env":"prod","sql":"DELETE FROM accounts"}'

Full walkthroughs: Getting Started · Installation · Configuration

Notes on this documentation