Alpenglow Land & Records Registry

Book 01 · Vault status

One command each way: make demo raises the vault, runs the checksummed migrations, generates about 38,000 rows in-engine, and files fresh evidence. make teardown destroys every billing resource. While deployed, five idle minutes seal the vault at 0 ACU; the capacity trace, the countdown, and the wake log above are read from CloudWatch and the wake ledger, so watching the seal close costs nothing and never resets the clock. The first exhibit you run unseals it, and the measured wake is filed on the record.

Book 02 · Chain of access

How a request reaches the record

The cluster's security group has zero ingress rules; nothing can open a connection to it. The API signs in as app_user, a Postgres role that may read the registry books and write only the practice ledger. Its DELETE and DROP attempts dying in the engine is one of the exhibits.

Book 03 · Request slips

Present a request at the counter

Each slip files fixed SQL over the Data API and shows you exactly what the engine said back: result rows, planner output, or the refusal, verbatim.

Book 04 · Title search

Search the grantor index

The one place on this plank where your own text reaches the database, and it never becomes SQL. The value is bound server-side as an RDS Data API parameter, compared as a literal against the trigram-indexed owner column. Try a name fragment, then try the classic injection payload and watch it arrive as harmless data.

Each address gets 30 searches a day; the canned exhibits are not metered per address.

Book 05 · Certified copy

No evidence has been filed yet. The first make demo cycle will populate this section.

Book 06 · Terms of record

What this plank proves

• The relational fundamentals, live: foreign keys, CHECK constraints, and atomic transactions demonstrated by the engine's own refusals, not slideware claims. Every integrity exhibit runs inside a transaction that is always rolled back.
• Scale-to-zero is real, and instrumented: min capacity 0 ACU with auto-pause. The seal watch shows the capacity trace, counts down to the seal, and files every measured unsealing in a wake ledger that survives teardown.
• Auditability in the engine: a SECURITY DEFINER trigger keeps a chain of title for every permit, so the registry can answer what it said on any date. Amendments carry who, when, and why.
• Concurrency and tenancy, refereed by the engine: row locks, a genuine deadlock with one victim, and row-level security that gives two district desks two different books over one table.
• Injection-proof by construction: the title search binds visitor text as a Data API parameter over a trigram index; no user SQL surface exists anywhere.
• No-socket access pattern: the RDS Data API means HTTPS + IAM + Secrets Manager instead of connection strings: a security group with zero ingress rules, no VPC-attached Lambdas, no NAT to pay for.
• Least privilege below the IAM layer too: the public API's Postgres role may read the books, amend only two columns, and write only the practice ledger; the exhibit shows its DELETE and DROP dying in the engine.
• Schema as code: ordered, checksummed migrations recorded in the database they shaped, rerunnable idempotently. And cost-honest architecture: RDS is banned always-on in this portfolio, so the whole cluster is deploy-demo-teardown with the evidence report persisted between windows.