VA.2026.016 · Floor 0 · service · hall 04
“the database stays in its room; only the question travels.”
va-sqlGate exists because a database that must not face the network still has clients that do. It opens one narrow passage: a POST for a single statement, a POST for a batch that either lands entirely or not at all. The origin stays on loopback; the question travels instead of the database.
Authority is never chosen by the caller. Every token in the registry is mapped to exactly one database and one capability set, and the gateway reads that registry per request — so a rotation takes effect on the next statement while an already-authorized request is allowed to finish. Capabilities are deliberately coarse: read-write, or read-write with a small, enumerated slice of DDL.
The late work was not the happy path but the way back. A door that can rotate credentials and change schemas must also be able to recover a damaged state and reconcile what it believes with what is actually there. Those drills were committed last, which is the correct order for an exhibit about restraint.
VA.2026.016
va-sqlGate
Database Gateway · SQL-over-HTTP · Capability Tokens · Go + PostgreSQL
First commit: a Go service with layered modules, validated requests, a token registry, and migrations — one statement, one batch, nothing else.
Documentation written for operators rather than developers: quickstart, architecture, HTTP contract, database operations, exposure and security.
Safe recovery and reconciliation added — the gateway can now restore a database and check that its registry, migrations, and reality agree.
concepts — kept & discarded
kept — the database stays local; the statement travels
rejected — letting a token choose its own destination or scope
held — any public exposure until a review says otherwise
archive ref — VA.2026.016/CON
cross ref — timeline fig. 01
curator annotations
a gateway with features is a database wearing a badge.
capability is a property of the key, never of the request.
a credential change is a promise; the old key failing is the proof.
| materials | single-statement endpoint · atomic batch endpoint · token-to-database registry · capability scopes · restricted DDL · registry reload per request · token rotation · migration runner · recovery and reconciliation · generated HTTP documentation | dimensions | endpoints — 2 · capabilities — crud · restricted ddl · commits — 3 · built in — 4 days · exposure — loopback · runtime — Go |
|---|---|---|---|
| condition | prototype · loopback only · token registry · atomic batch · recovery + reconciliation | acquired | Oct 2026 |
| revision | Rev. A | archive location | DWG-016 · floor Floor 0 · service |
| internal reference | VA.2026.016/M | origin | built so a private database could be reached without being exposed, Oct 2026 |
failed experiments
the gateway is not a sandbox for untrusted input. Every client must already be trusted; the door narrows exposure, it does not remove it.
the companion jobs module stores metadata only — no worker, no fetcher, no URL fetching. A queue with no consumer is a drawer.
loopback by design, unfinished for the public. Exposure needs a tunnel, a security review, and a reason — in that order.
draft concepts
research notes
— SQL over HTTP is cheaper than exposing a port — the attack surface becomes one validated statement, not a protocol.
— reading the registry per request buys instant rotation without sticky connections; the cost is a file read, not a restart.
— an operator-facing dry run prevents the class of mistake that no amount of code review catches.
Two endpoints and one registry. Every future feature must justify itself against the risk it adds to a service whose only job is to carry statements to a private room.
Callers do not negotiate authority. A token arrives already knowing which database it may reach and which verbs it may use; anything outside the mapping is not a policy decision but a refusal.
Rotation and migration are only trustworthy when recovery is rehearsed. An infrastructure exhibit is judged on the day something goes wrong, not the day it was installed.
within the collection
future vision
va-sqlGate stays a side door. The tunnel is drawn, the review is written, and the registry waits — but nothing crosses loopback until someone can explain exactly what would be gained by opening it.