HeliosProxy v0.4.0 Release Notes
HeliosProxy v0.4.0 Release Notes
HeliosProxy v0.4.0 expands the proxy from a connection router into a programmable PostgreSQL data plane. The release adds 22 modules, bringing the platform to 46 feature modules across routing, plugin execution, admin operations, and companion infrastructure.
Highlights
- In-process anomaly detection for rate spikes, credential-stuffing bursts, SQL-injection patterns, and novel query shapes.
- Edge mode with local cache, home-proxy invalidation, and bounded-staleness reads for geo-distributed deployments.
- Stateful WebAssembly plugins through namespaced host KV imports.
- Host-provided SHA-256 and optional Ed25519 plugin signature verification.
- Portable
.tar.gzplugin artifacts with manifest, WASM module, and optional signature sidecar. RouteResult::Blockfor clean route-hook rejection over PostgreSQL wire errors.- Embedded admin Web UI and expanded admin REST API.
- Kubernetes Operator, Terraform provider, and Pulumi provider companion projects.
New Core Modules
| Module | Capability |
|---|---|
| Anomaly Detection | Records rate spikes, credential abuse, SQL-injection signals, and novel query fingerprints. |
| Edge / Geo Proxy | Provides local cache at edges with home-proxy table invalidation. |
| Plugin Host KV | Adds env.kv_get, env.kv_set, and env.kv_delete for plugin-local persistent state. |
| Plugin Host Crypto | Adds env.sha256_hex backed by the host runtime. |
| Plugin Signatures | Verifies loaded plugins against an Ed25519 trust root. |
| Plugin OCI Artifacts | Loads packaged plugin artifacts containing manifest, WASM, and optional signature. |
| Route Blocking | Lets route hooks reject a query with a clear PostgreSQL error response. |
| Plugin Trust Root Config | Adds [plugins].trust_root to require signed plugins in production. |
First-Party Plugins
| Plugin | Purpose |
|---|---|
cost-governor | Per-tenant query cost budgets using minute, hour, and day windows. |
ai-classifier | Tags likely LLM-generated SQL for downstream policy plugins. |
token-budget | Applies per-agent and per-model token budgets to AI traffic. |
llm-guardrail | Blocks high-risk SQL patterns from AI-tagged traffic. |
pgvector-router | Routes top-K vector queries to a vector-optimized node. |
column-mask | Rewrites selected columns through masking functions based on role. |
audit-chain | Maintains a tamper-evident hash chain of query audit records. |
residency-router | Routes or blocks requests based on user data-residency policy. |
Admin And Operations
The admin surface now exposes both a browser UI and JSON endpoints for topology, plugins, anomalies, edge mode, chaos overrides, shadow execution, and replay. The same API shape supports human operators and automation.
Companion Projects
| Project | Purpose |
|---|---|
| Kubernetes Operator | CRDs for HeliosProxy, PoolProfile, RoutingRule, AuditPolicy, and TenantQuota. |
| Terraform Provider | Infrastructure-as-code resources mirroring the operator CRDs. |
| Pulumi Provider | Pulumi resource bindings generated through the Terraform provider bridge. |
helios-plugin CLI | Packs, inspects, signs, and verifies portable WASM plugin artifacts. |
Compatibility
HeliosProxy v0.4.0 keeps the PostgreSQL-wire-compatible proxy model and remains compatible with PostgreSQL 12+ backends and PostgreSQL-wire-compatible services. Existing v0.3 connection-routing deployments can upgrade incrementally and enable the new modules through configuration.