zeekayandHanzo Dev d8c451003f A base is an address, not a connection ...

url.Parse refuses the percent-encoded form libpq accepts for a socket
directory, so spelling a base as postgres://%2Fvar%2Frun%2Fpostgresql
could never have worked — and a co-located egress reaching hanzo-sql over
its socket is the one deployment that needs no pg_hba change at all.

So a base carries the same address grammar the listener is bound by: an
absolute path is a socket directory, anything else is host:port. That is
also the mode stated in the data. There is nobody to be at a base of ours
and nothing to prove, so there is nowhere in its address for a user or a
credential to go; a database that is not ours is a whole connection URL
because that is what a tenant holds and what they sealed.

Alongside: refuse a principal whose token said nothing about when it
stops, rather than passing a zero time to SetDeadline and clearing the
deadline that bounds the session; bound what a caller can write into a
record; take the handshake deadline before the first refusal is written.

Co-authored-by: Hanzo Dev <[email protected]>

2026-09-04 14:47:13 -07:00

..

architecture.md

architecture and threat model: the design, and what it does not close

2026-08-14 23:03:17 -07:00

using-egress.md

A base is an address, not a connection

2026-09-04 14:47:13 -07:00