Capability group 04

Serverless & branching

A claim provisions in one API call with a ready binding — no capacity planning. Branching is expressed as point-in-time restore to a NEW claim: fork the state of any claim as of a timestamp into a fresh, independently-credentialed database. A CDC pull seam drains ordered change events, and dynamic Vault leases keep every credential short-lived. We are candid where we trail Neon — see the honest gap below.

Instant provisioning · PITR branches · CDC

≤30 min
PITR of 10 GB
RPO ≤5 min
recovery point objective
≤1h TTL
dynamic credential leases

Sub-capabilities

Instant claims, point-in-time branches, and a change-data-capture seam.

Instant claim provisioning

POST /claims provisions the real resource on the named engine, pins a version, mints a Vault credential and returns a ready binding — one call, no console clickops, no capacity request.

Branches as point-in-time restore

Restore is always to a NEW cluster, never in place: fork a claim's state as of at into a fresh claim named new_name. That fresh claim is a branch — independently credentialed, safe to write, cheap to throw away.

Point-in-time restore (PITR)

The same primitive is disaster recovery: restore to any point in the retention window. PITR of 10 GB completes in ≤30 min with RPO ≤5 min; the request, actor and target timestamp are audit-chained.

Change-data-capture seam

GET …/cdc is the CDC pull seam: the SS-03 relay drains ordered change events (put/delete/expire) and republishes them to the claim's declared subject. Read forward from ?cursor= and resume from the returned cursor.

Dynamic credential leases

Every consumer draws a short-lived lease per claim (≤1h TTL), validated engine-side; rotation mints a new Vault version with no downtime. A stolen credential has a one-hour blast radius.

Endpoints

6 real operations on the /api/v1 contract.

Method + path straight from the SS-02 OpenAPI spec. Governed routes take an SS-01 bearer token and, where marked, an X-Tenant-Id; the S3 wire gateway authenticates with AWS SigV4 instead.

POST/api/v1/claimsbearertenantidempotency-key

Instant provisioning: create + provision a claim and return a ready binding.

POST/api/v1/claims/{name}/restorebearertenant

PITR/branch — restore the source claim as of at into a NEW claim new_name.

GET/api/v1/claims/{name}/cdcbearertenant

CDC pull seam; read forward from ?cursor=, resume from the returned cursor.

POST/api/v1/claims/{name}/leasesbearertenant

Issue a dynamic credential lease (TTL capped at the one-hour ceiling).

GET/api/v1/claims/{name}/leases/{id}bearertenant

Validate a lease engine-side; expired/rotated/foreign leases fail.

POST/api/v1/claims/{name}/rotatebearertenantidempotency-key

Rotate the credential with no downtime; DSN unchanged.

Worked example

Create a Postgres branch — fork prod state into a fresh claim.

Create a Postgres branch — fork prod state into a fresh claim · bash
# A branch is a point-in-time restore to a NEW claim. Fork the state
# of `orders` as of 11:00 into an independently-credentialed database.
curl -X POST "$BASE/claims/orders/restore" \
  -H "Authorization: Bearer $TOKEN" -H "X-Tenant-Id: acme" \
  -H "Content-Type: application/json" \
  -d '{"new_name":"orders-preview","at":"2026-07-05T11:00:00Z"}'
#   → 201 the newly-provisioned claim `orders-preview`
#     (same shape as POST /claims) with its OWN binding & secret_ref.

# Read the branch's credential-free binding and connect a driver.
curl "$BASE/claims/orders-preview/binding" \
  -H "Authorization: Bearer $TOKEN" -H "X-Tenant-Id: acme"
#   → {"dsn":"postgresql://orders-preview.acme.ss-02.svc:5433/…",…}

# Refusals are explicit: new_name must differ from the source
# (in-place restore is refused → 400).

This is our branching primitive today — a real fork with its own credentials. It is NOT yet Neon-class copy-on-write / scale-to-zero branching; that is our stated direction, and we say so on /compare.

In the architecture

Where it sits on the data plane.

Provisioning, restore and CDC all run on the one claim plane, so a branch inherits the source engine's isolation, encryption and backup posture automatically. Restore-to-new-cluster is deliberate: it never mutates the source, so a branch can never corrupt production. CDC hands off to the SS-03 bus relay; leases resolve against SS-05 Vault.

ADR-0056DBaaS is the only data planeADR-0064DBaaS claim expansion (CDC seam)