The event log: what the daemon did and why. Every action site calls emit; mitosis events
lists the rows and --follow streams them. An event never holds a password or a URL with
one: build detail from known fields only, never from free text, and run any URL through
templates::redact_url.
Masking files (template --mask): which columns to replace and which rows to keep, and the SQL
that does it. Every masking strategy is idempotent, so a layered build can mask again in place.
Promote: turn a running clone into a new generation of a template. The clone’s Postgres is
stopped cleanly, its folder is copied with a copy-on-write clone, and the clone is started again on the same
port, socket and password, so its URL keeps working (open connections are dropped).
The router: one TCP port for every clone, the clone picked by the database name of the startup
message. Auth stays end to end: the router forwards the client’s startup message (with the
database renamed) to the clone’s TCP port and then copies bytes. It never connects over the
clone’s Unix socket, which trusts every local user. It never logs message bodies.
Automatic template builds: interval schedules, auto-migrate, and the background refresh a clone
of a stale template asks for. Every build runs on its own task and holds the template’s build
slot, so there is at most one build per template at a time.
Template upgrade: moves a template’s current generation to a newer Postgres major with
pg_upgrade --clone. The current generation is copied (copy-on-write clone) into side folder A, a new
cluster B is made with the target’s initdb (same encoding, locale and checksums as A), and
pg_upgrade fills B from A. B becomes an Upgraded generation of the same template, or
generation 1 of a new one (--as). The source generation is never touched.