Roadmap

Broker production data access as reviewed, signed, expiring grants Status: accepted

What exists: The three binaries do M1's flow in skeleton form: marque submits, approves and reads; harbourmaster serves and stores; pilot runs one approved statement and reports it. None of this record's own substance is built — no analysis, no rehearsal, no marque, no signing, no logbook — so every job in the component table is still unfilled, and this stays `none` rather than `partial`.

One bootstrap URL is the only client configuration Status: accepted

Every principal is federated, and every token is bound to a key Status: accepted

A marque is a doubly-signed lease, verified by computation Status: accepted

The control plane never holds a target credential Status: accepted

What exists: The Harbourmaster serves and links a PostgreSQL driver for its OWN store, and cmd/pilot links one to reach a target — the two homes EDR-0042 permits, and no others. The Harbourmaster opens no target connection and holds no target credential: the Pilot takes --target-dsn and the control plane never sees it. What is absent is everything the relay half needs — there is no Tender, no operator signature on a read, and no quota.

Every statement names a role, and the role is the real limit Status: accepted

Prove object scope, fence row scope, and escalate anything unprovable Status: accepted

Approve routine work once, as a parameterised standing order Status: accepted

The Leadsman advises and can never decide Status: accepted

Rehearse the statement in a transaction that never commits Status: accepted

Execution is idempotent, fenced, and budgeted Status: accepted

What exists: M1's executions table, RecordExecution and cmd/pilot carry a nonce, and it makes the REPORT idempotent: repeating a recorded one returns the stored outcome instead of writing a second row, and a fresh one against a terminal request is refused. It does NOT make the execution idempotent — if the first report never lands, the request is still approved and running the Pilot again executes the statement before anything looks at the nonce. Nothing claims a nonce BEFORE running, accounts for a budget, or carries an incarnation, so a crash loses the attempt and the count alike; the ledger this record decides does not exist (issue #34). The Pilot does honour the no-transparent-retry rule and reports a lost commit as indeterminate.

The logbook is an append-only hash-chained journal Status: accepted

Async work rides the write-ahead log, not a job table Status: accepted

Reach isolated targets through a relay the Pilot dials out to Status: accepted

Who may approve what is reviewed configuration, not a console setting Status: accepted

Compile a written delegation, and have the human sign the compilation Status: accepted

A model may choose a route, never widen a bound Status: accepted

What exists: .golangci.yml enables the exhaustive linter and cites this record's two outcomes as the reason, so the guard is ready for the enum. There is no Surveyor, no panel and no enum.

An agent's authority is the intersection of three scopes, including its own Status: accepted

What exists: The only mention in code is .golangci.yml, which anchors its gen/ exclusion so that a future agent package will not be silenced by it. No agent surface, no scope intersection, and not the test asserting an agent cannot approve.

Escalation is a chain of named stages, and every stage is a person Status: accepted

What exists: A stage exists and is recorded: approvals is keyed on (tenant, request, stage, approver), and the service refuses any stage but 1 because M1 has no chain to define a second. The record's substance is absent — no chain, no per-stage thresholds, no timers, and nothing that treats a stage as escalation rather than as a column.

Speak the PostgreSQL wire protocol locally, and broker every statement across it Status: accepted

Enrol approver keys in hardware, and require an existing approver to enrol the next Status: accepted

The console is for deciding, and it has no bulk approve Status: accepted

Publish what each engine can actually enforce, and disable what it cannot Status: accepted

Be psql first, then be better than psql Status: accepted

Open the statement pipeline to providers that may narrow or veto, never widen Status: accepted

On a fast path the human signed the shape, and the Pilot verifies that artefact Status: accepted

A marque states how many approvers it needs, inside what every signature covers Status: accepted

Anchor the approver key set outside the control plane, or the second signature is theatre Status: accepted

Bind the executor, the tenant and the Pilot into the marque Status: accepted

Assert the transaction's whole write set, not just the named relation Status: accepted

Give the whole Pilot API an authorisation model, not just Execute Status: accepted

Execution freshness belongs to the approval, not to the executing principal Status: accepted

Anchor what is signed and what it claims, not only who may sign Status: accepted

An emergency changes who is asked and how loudly, not what is checked Status: accepted

The checkable grammar is parsed by PostgreSQL's own parser Status: accepted

What exists: The consequences are staged for it — the Makefile exports CGO_ENABLED=1 for every target, CI builds on four platforms, and the conformance corpus at testdata/conformance/ has its format, its validator and its subset_version field, though it holds no vectors yet. Nothing that decides anything exists: libpg_query is not linked in, there is no internal/grammar, and nothing reads a statement.

One schema generates every client, and annotates what may be retried Status: accepted

What exists: Built: the schema, the annotation extension, the build failure for an unannotated method (internal/schema/annotations.go), committed Go and Connect stubs, and the `buf breaking` check on every pull request. All five methods are served, and four of them are called: cmd/marque is the generated client for Submit, GetRequest and Approve, and cmd/pilot calls GetRequest and RecordExecution. GetVersion is served and has no caller — the binaries print their own build information locally. Not built: clients/ts/, the Pilot, Surveyor and relay schemas, typed errors, streams, and an interceptor that honours keyed and unsafe. Five methods exist — GetVersion, Submit, GetRequest, Approve and RecordExecution.

Connect as the operator where the database can, and never let a driver retry a write Status: accepted

What exists: One rule of this record is built and tested: transparent retry is OFF for writes, so a commit whose answer never arrives is reported as indeterminate rather than replayed — internal/pilot, with the classification that tells a refused commit from a lost one. Nothing else is: no connection identity, no read routing, no pooling policy, and no session settings pinned on a target.

Partition every tenant from day one, including its logbook chain and its signing key Status: accepted

What exists: The schema half exists from migration one: a tenants table, tenant_id NOT NULL on every domain table, composite foreign keys so a row cannot reference another tenant's parent, and tenant_id leading both indexes (EDR-0042). Every query is tenant-scoped — but to a CONFIGURED CONSTANT rather than to anyone's identity, because M1 has none, and no request field can reach it. Nothing structurally stops a query that omits the scope: issue #43.

A request is a shareable, watchable object with a live status Status: accepted

What exists: The `req_…` reference exists, is randomly generated so it cannot be enumerated, and resolves through GetRequest — where an unknown one and another tenant's are the same NotFound, never a PermissionDenied that would confirm it. All seven states are in the schema and the proto, and M1 produces four of them. There is no status block, no chain, no watch and no notification; and the entitlement the 404 rule protects has nothing to enforce it against, because M1 has no identity.

Spell a scope the same way in every artefact Status: accepted

What exists: The vector half exists: `internal/conformance` already decodes `operation`, `schema` and `relation` in this spelling and rejects anything else. The artefact half — delegations, compiled delegations, grants, marque payloads — is prose in records, because nothing parses one yet.

Give the control plane's store a schema, a migrator, and a driver rule that survives PostgreSQL Status: accepted

What exists: The schema, the migrator, the confinement test and the depguard block exist, in the same change as store.Open. `harbourmaster migrate` is an explicit command and `harbourmaster serve` verifies and refuses rather than migrating. CI runs the loader offline and the whole store against a real PostgreSQL behind a build tag, including M1's steps end to end.

Declare a method's behaviour in one annotation, and never weaken it Status: accepted

What exists: The one MethodBehaviour extension, the strengthen-only comparison (internal/schema/compat.go) and the idempotency_level agreement check all run in CI, via make lint and make breaking. The absent retry interceptor is not a missing half: this record's Scope section puts client-side retry behaviour outside it and leaves that obligation with EDR-0020.