DB: Postgres remote access for venus/lezama (pg_hba + TLS or SSH tunnel; lean config)

Sub-tickets

Questions

Activity

• system created · 2026-05-29
  wi cli; parent=#580
• db-basquetwi-cc assigned · 2026-06-04
  assigned to db-basquetwi-cc
• system commented · 2026-06-04
  PM hold: architecture is UTCP->HTTP->PG with the HTTP svc as single writer of record enforcing invariants. Direct remote PG write access from venus/lezama would bypass event-row/cycle enforcement. Reconsidering scope: remote agents go through HTTP svc (#584); direct PG remote access, if any, limited to read-only/admin. Deferred pending #584 landing.
• system statusChanged · 2026-06-04
  Deferred pending #584 HTTP svc — scope under review (HTTP svc may obsolete direct remote PG access).
• system canceled · 2026-06-04
  Obsoleted by architecture. HTTP svc (#584) is the sole remote write path — direct remote PG writes would bypass event-row/cycle invariants. Admin/migrations/backups run locally on whey (ssh+psql, pg_dump), no network PG. PG stays localhost-only. A read-only monitoring role for venus/lezama, if ever wanted, is a new small pg_hba WI — not part of this epic.