The database engine
engineered to the laws of physics.
An off-heap δ-CRDT database with tri-temporal state, a zero-allocation hot path, and leaderless convergence measured across 100 node processes on three machines in three regions — on real silicon, not a marketing claim.
Watch the evidence 5:09Every number re-run on a fresh 32-core machine, on camera. 22 September 2026.
A product of first-principles engineering
Explore the documentation.
Start with the system model, trace the architecture, or run the core algorithms in your browser.
Not workflow rules. Physics.
The engine is governed by five laws, each enforced by a named test gate and each tied to a measured failure mode that made it non-optional.
Memory law
0 allocs/op on the hot path. One make() on the write path at the core rate (63M+ ops/s) = stop-the-world ~every 4ms.
Cache law
128-byte stride for every contended atomic. Two atomics on one cache line at 32 cores = a HITM storm = 1.1M ops/s, 1.6% efficiency vs the 63M+ core range.
Lock law
No sync.Mutex on the write path. CAS + EBR only. A futex is a scheduler stall, and a stall at the core rate (63M+ ops/s) is a cliff.
WAL law
Replay restores the recorded dot — it never re-mints. Each mutation is applied at its WAL-recorded (NodeID, Counter); the tail is cut by record sequence, not a scalar clock. Re-minting double-mints, and double-minting is corruption.
Honesty law
Report numbers, not adjectives — and report the layer. “The core microbench gate passes at 50,736,038 ops/s @32 cores; this tree re-measures 68,278,197; production ingest is 5.7–6.0M δ/sec” is a fact. Quoting any peak as “sustained throughput” is the round-up we forbid.
A moat built from mechanisms, not marketing.
Every differentiator is grounded in a real package, type, and test — and where a feature is preview, stub, or dormant, it is labeled as such.
Tri-temporal CRDT state
Keyed by system_time × valid_time × assertion_time, materialized as a 40-byte composite key + 9-field Arrow IPC rows — answering queries a mutable-row or log-only model cannot answer without an auxiliary history store.
CRDTEntry @hamt.go · internal/databaseOff-heap, zero-GC hot path
State lives in a mmap’d segregated-slab HamtArena (17 size classes, 256-way sharded Treiber free-lists). NodePtr is a GC-invisible uintptr — the foundation of true zero-GC.
pkg/sync/hamt_arena.goCAS + EBR, no futex on the write path
Join, InsertLocal, NextDot use compare-and-swap and epoch-based reclamation with hazard pointers. The only sync.Mutex guards disk fsync in a decoupled background worker.
pkg/sync/reclamation.goSpatial-ready data model (H3)
An H3 index rides every entry on the wire and in the durable tier, so time-and-place queries are first-class. The cache-line-exact SPSC ring that offloads geocoding to an isolated C++ worker is built — and the portal is explicit that wiring it in is operator-supplied, not claimed live.
CRDTEntry @hamt.go:112 · internal/spatialPost-quantum from day one
X25519MLKEM768 key exchange is the default, and a test asserts the negotiated curve ID rather than trusting the config. A hybrid Ed25519 + ML-DSA-65 signature is wired with a BOTH-required verify, but it stays opt-in behind --hybrid-sign / --hybrid-verify so the default wire format is byte-identical for peers without it. A hedged (randomized-nonce) Ed25519 signer stays compatible with the unchanged classical verifier.
pkg/identity · pkg/transportHonest-negative measurement culture
Every benchmark carries its hardware label, and a regression is recorded verbatim rather than re-run until it passes. The load-bearing core is pinned by content checksum so it cannot change silently.
CI gates · pkg/syncOne frozen core, wrapped by seams.
A layered system organized around a single frozen δ-CRDT core, wrapped by an ingress gate stack, a durable LSM tier, a replication mesh, and operator surfaces.
What ships. What’s opt-in. What’s a stub.
The engine reports its own readiness — production-wired, opt-in, dormant, bench-only, or stub — with the test that proves each claim.
| Capability | Readiness | Evidence |
|---|---|---|
| δ-CRDT core (Join, HAMT, IBLT, EBR) | Verified | The merge law and wire schema are frozen and property-tested; property tests + partition-heal convergence; 0 allocs/op on the hot path |
| Per-shard point reads | Verified | O(log N) reads against one shard — retired the whole-state read that rebuilt the index on every call |
| Wire-integrity + skew bound | Verified | Digest, attribution, and Lamport-skew checks run before any merge |
| TLS 1.3 mTLS mesh + control port | Verified | TLS 1.3-only, mutual authentication; the client API rides the same trust root |
| Certificate + CA + revocation hot-reload | Verified | A revoked or expired certificate is rejected at the handshake; rotation needs no restart |
| Admission (rate + clock) | Verified | Per-peer Sybil-burst isolation plus a Byzantine clock cap, before the signature check |
| WAL + bounded snapshot recovery | Verified | Group commit — one fsync per batch; exact-dot replay; a recovered node re-equals the fleet |
| WAL + snapshot integrity (CRC32C) | Verified | Every record is checksummed; corruption fails loud and never replays silently |
| Checkpoint decouple + delta-batch | Verified | Checkpoint fsyncs moved off the commit path (110,000 → 0 per checkpoint) |
| Convergence — 100 node processes on 3 machines, 3 regions | Verified | The sub-10-second target is met on the published run (8.95 s) and on six of seven logged runs; one run missed at 10.15 s |
| Crash recovery + integrity verification | Verified | Bounded recovery re-equals the checkpoint root with the integrity check armed |
| Retention horizon (auto-inferred) | Verified | Tracks the live query frontier; never retreats below the operator-set floor |
| Read-your-writes | Verified | An insert is immediately queryable — no wait for the next checkpoint |
| Ed25519 verify + hedged signer | Verified | A canonical-verify gate plus a randomized-nonce signer that stays compatible with it |
| Post-quantum transport | Verified | X25519MLKEM768 key exchange on by default; hybrid Ed25519 + ML-DSA-65 signing is opt-in |
| Region-aware gossip | Opt-in | Intra-region mesh + inter-region fan-out; off by default |
| IBLT digest exchange | Opt-in | Ships only the minimal difference; the saturation bound is disclosed, not hidden |
| Peer provisioning | Opt-in | A pre-provisioned peer directory lets a node verify a peer before first contact |
| L0→L1 compaction + pruning | Opt-in | Off by default; the operator sets the retention horizon |
| L0 reaper | Opt-in | Off by default; never runs unless enabled |
| eBPF SK_REUSEPORT steering | Verified | Kernel-level flow pinning — 0/1000 mis-routes measured on silicon; ships behind a build tag |
| Zero-GC PII masking | Verified | Deterministic redaction on the write path with no allocation |
| Telemetry → Prometheus | Verified | New counters surface on /metrics automatically; the scrape reads cumulative values |
| Skip-list range iterator | Dormant | Proven correct but not yet wired into the durable scan path |
| EPOLLET Cap’n Proto ingestion | Partial | Proven end-to-end on a Unix socket; not the default ingest path |
| H3 spatial (C++ worker) | Partial | A reserved spatial axis on the data model and wire; the indexing pipeline is built but not wired in |
| aws-lc hedged bridge | Stub | A placeholder; the real CGO bridge is not built |
| Development PKI | Dev only | Rotation + revocation are wired; it remains a development CA, not production PKI |
| Cedar ABAC | Bench-only | Benchmarked, but no authorization engine is wired into the request path |
| Chaos harness | Bench-only | The verification layer; the process-crash survival test is opt-in |
Readiness is per-capability: a “Verified” badge means the capability is wired into the serving path and backed by a named test gate or a silicon run — not that the engine as a whole is production-ready. Sovereign Engine is a research preview, not production-ready software.