Connector architecture
The local host owns recovery and storage; supervised native connectors own database-specific operations.
Host and connector responsibilities
The base CLI and core own policies, SQLite jobs and queues, execution budgets, checkpoints, Parquet encoding, publication and verification. Local, S3, Azure Blob and GCS destinations are built-in adapters behind a shared sink interface. Separately installed postgres, mysql and mongodb executables own database drivers, discovery, planning, source identity, value encodings, restore transactions and verified deletion. Sink adapters are not separately downloadable connector packages.
Data and control flow
Database records travel over supervised local process pipes to the host and into customer-controlled Parquet storage. Restore and explicitly authorized deletion use the same connector boundary. The package registry distributes code and trust metadata, not customer rows. Cloud receives only the allowlisted metadata sent by agent sync.
Customer database <-> native connector <-> local host
|
+-> SQLite jobs / queue / checkpoints
+-> Parquet files / immutable manifest
+-> explicit metadata sync -> CloudVersioned protocol and failure handling
The runtime negotiates protocol version, required features and source/restore capabilities before configuration. Framed requests carry session/request identity and bounded deadlines; payload sizes and integrity are checked. stdout is protocol traffic and stderr is handled separately. Crashes, mismatched responses and timeouts end the session; recovery uses durable checkpoints rather than guessing whether a write committed. verified-delete-v1 is an optional negotiated feature required by deletion.
Pinning and independent upgrades
An archive records the connector identity, version and binary digest so resume can use its exact approved package. Changing the active connector affects new sessions, not pinned incomplete jobs. Package leases and resumable-job references prevent unsafe removal. Verified deletion may use a newer approved connector with the deletion feature while rechecking the original source and dataset identity.
Trust boundary
Connectors execute native code as the agent account. Separate processes isolate failures but are not a security sandbox. The installer checks signed TUF metadata, pinned root trust, package hashes, compatibility and revocation state before credentials are released. Use only trusted packages and restrict the service account. Normal installation does not require development bypass environment variables.