Native PG Wire Protocol
AXIS can speak the PostgreSQL wire protocol directly, letting unmodified PostgreSQL clients (psql, drivers, pgAdmin) connect to AXIS instead of the database. This is a lab POC — experimental, disabled by default, and not the production integration path.
Status summary
| Area | Status | Evidence |
|---|---|---|
| Wire listener | Experimental | AXIS_PGWIRE_ENABLED=false by default; listener on :6544 in lab mode (AXIS_PGWIRE_LAB_MODE=true) |
Simple Query (Q) intercept & enforce | Experimental | Text query parsed/classified/policy-evaluated before forwarding; ALLOW forward, BLOCK/REQUIRE_APPROVAL rejected client-side; 65/65 regression, 14/14 chaos |
Extended Query (P/B/E) | Planned | EQ0–EQ5 stages; required before OLTP pilot; JDBC batch pipeline enabled in lab (bounded) |
CancelRequest (F) | Accepted & implemented | RFC-032 (2026-07-10); BackendKeyData substitution; proxy key registry; SQLSTATE 57014; chaos case pgwire_concurrent_mid_query_cancel (110 sessions) |
| Transport TLS/mTLS | Implemented | Client-to-AXIS and AXIS-to-backend mTLS on shared write-path transport; negative matrix 18/18; cleartext lab-only |
| Regression suite | 65/65 passed | Lab harness |
| Chaos suite | 14/14 passed | Backend down, wrong target, slow backend, cancel, reconnect |
Draft RFC v1.2 (2026-05-21) + RFC-032 (2026-07-10)
The integration design is specified as a draft RFC: a wire-level listener in front of the database, Simple Query enforced end-to-end, Extended Query parameterized flow planned with bind-value classification, and COPY handling fail-closed. RFC-032 (CancelRequest) is accepted and implemented: AXIS intercepts the backend BackendKeyData, substitutes an AXIS-generated (proxy_pid, proxy_secret) from the OS RNG, keeps a process-local registry (24-hour safety TTL), and forwards cancels with the real backend key. Real backend process IDs and secrets are never sent to clients or logs.
CancelRequest (RFC-032) details
| Aspect | Behavior |
|---|---|
| Protocol flow | Client sends 16-byte CancelRequest with proxy key on a new TCP connection; AXIS resolves the key, opens a backend connection, writes the real-key CancelRequest, and closes both without returning client bytes |
| Unknown / expired / closed-session keys | Identical wire behavior: no response and connection close; audited |
| Rate limiting | 128 cancel attempts per source IP per second; excess attempts silently rejected and audited |
| Duplicate suppression | Repeated requests for one key inside 250 ms audited and suppressed; the key stays usable after that window |
| Timing envelope | 100 ms minimum response envelope; 75 ms backend connect/write timeout |
| Lifecycle | Memory-only registry; AXIS restart invalidates all proxy keys (drivers must reconnect) |
| Audit events | AXIS_BACKEND_KEYDATA_INTERCEPTED, AXIS_BACKEND_KEYDATA_SUBSTITUTED, AXIS_CANCEL_REQUEST_RECEIVED, AXIS_CANCEL_REQUEST_VALIDATED, AXIS_CANCEL_FORWARDED_TO_BACKEND, AXIS_CANCEL_BACKEND_RESULT, AXIS_CANCEL_REJECTED |
| Mid-query cancellation | Verified: test_psycopg3_mid_query_cancel_reaches_backend_and_connection_recovers; chaos case with 110 simultaneous sessions + 110 concurrent random key guesses verifies SQLSTATE 57014, zero-byte rejection, connection recovery, process health |
AXIS_CANCEL_BACKEND_RESULT=cancel_packet_sent_no_response_expected proves delivery to the backend TCP socket, not that PostgreSQL found a running query. If audit intent cannot be recorded before forwarding, AXIS fails closed and does not contact the backend.
Simple Query flow
Per-message handling in the lab
| Message | Behavior |
|---|---|
Q (Simple Query) | Parse → classify → policy; ALLOW forwards, others rejected with error responses |
P/B/E (Extended Query) | Not implemented; client fails closed (error response) rather than bypassing |
F (CancelRequest) | Implemented per RFC-032; propagates cancel; unknown keys rejected |
COPY (H/D/c) | Fail-closed in the POC; copy is not silently allowed |
| SSLRequest / GSSENCRequest | Handled per protocol (POC may skip encryption with documented lab caveat) |
Limits and warnings
- POC is lab-only (
AXIS_PGWIRE_LAB_MODE=true) and disabled by default; do not use it for production traffic. - Extended Query is the required gate for real OLTP clients (parameterized statements); until EQ ships, drivers using prepared statements fail closed.
- Approval-driven writes are not interactive on the wire path: REQUIRE_APPROVAL is rejected to the client (no human-in-the-loop UI on the wire).
- Chaos tests cover backend-down, wrong-target, slow backend, cancel and reconnect scenarios (14/14 in the lab).
- The RFC is a draft: treat all wire behavior as subject to change until an RFC becomes stable.
Do not point production clients at the lab wire listener. It is an experiment for RFC validation, not an OLTP path.
Related: ORM & Extended Query · Architecture · Changelog