Key Features & Specialties
The concrete specialties surfaced by the source, with the package/file where each lives — and an honest label where the feature is bench-only, stub, dormant, or opt-in.
The CRDT core (pkg/sync)
| Specialty | Mechanism | Status |
|---|---|---|
| Sharded lock-free HAMT | DeltaCRDTEngine.shards []shardRoot (default 256) + routeShard; per-shard atomic.Pointer[HAMT] CAS | Verified |
Merge-union Join | crdt.go:1167; per-element routing through the wire-integrity seam | Verified |
| IBLT + Strata Estimator | iblt.go; XOR-accumulator buckets (0.00% FP purity); StrataEstimator = 32 fixed IBLTs; DynamicIBLTSize(dEst) | Verified |
| EBR + hazard pointers | reclamation.go; 3-epoch × 256-shard retired ring; 2-epoch grace window; ABA-immune | Verified |
| Wire-integrity seam | crdt_reconstruct.go + crdt_reconstruct_skew.go; 3 axes (digest, attribution, skew bound); closes the far-future-dot and disk-state-poisoning attacks | Verified |
| Capnp wire | crdt_capnp_wire.go (marshal-only BuildCRDTDeltaEvent); CRDTDeltaEvent 13-field schema; version/format guards | Verified |
| IBLT wire codec | iblt_wire.go; deliberate little-endian (non-capnp) IBL1/STRA magic | Verified |
| Allocator strategy candidates | elimination.go (elimination-backoff), flatcomb.go (flat-combining), sharded.go (SEC-sharded) | Bench-only |
| Residency hardening | residency.go — mlock/madvise/prefault page-fault mitigation | Opt-in |
| Lamport durability decoupling | persistCh chan uint64 (unbuffered) + persistWorkerLoop; lastSavedCounter monotone CAS loop | Verified |
The allocation-strategy candidates
The three candidates (elimination-backoff, flat-combining, SEC-sharded) coexist; the active candidate for TestStage5ScalingGate is chosen by init() override ordering (SEC wins). There is no single committed winner — this is honestly labeled bench/experiment.
Tri-temporal state
State is keyed by (system_time × valid_time × assertion_time) with decision_time on the wire (CRDTEntry fields @72–104). The durable tier materializes this as the 40-byte composite key + 9-field Arrow IPC rows. The read path enforces the four-filter bitemporal discipline; Range uses interval-intersection (not point-in-window). Dominance pruning (DominancePrune, l1_compactor.go) is the tri-temporal lattice's GC: a structural sweep, [vs,ve) containment, and a txTime <= horizon floor. T_gc auto-inference tracks the observed live-query txTime frontier as a monotone atomic maximum at AsOf-entry and feeds effective = max(operatorFloor, observedFrontier - backoff) into the unchanged DominancePrune — the inferrer floors the operator knob (never replaces it); retreats are refused, counted, and logged.
H3 spatial CRDT
H3Index uint64 is carried on every CRDTEntry (@112) and in the Arrow schema (h3_index Uint64) — a reserved spatial axis on the data model and wire. The in-tree Go producer is a memfd-backed SPSC shared-memory ring (internal/spatial/h3_spsc_ring.go): RingSlot exactly 64 B, RingHeader exactly 192 B (3 cache lines), MAP_SHARED|MAP_POPULATE pre-faulted, survives execve via ExtraFiles at fd 3 — the ring's file descriptor is passed to the child, because an anonymous mmap is severed at execve, fronted by an EpochBatcher (epoch_batcher.go, DefaultEpochSize=4096, CollectTimeout=100ms) batching coordinate submissions. This producer ships but is currently unwired — internal/spatial is imported by zero non-test files (only its own unit tests exercise it), and the C++ h3_worker consumer that would compute real H3 cells is operator-supplied and absent from the repo. The only in-tree H3Index assignment is the synthetic key-derived uint64(k) << 8 in the internal/chaos partition harness. H3 today is a reserved spatial axis with a placeholder producer, not a live native geospatial index — an operator wires in the producer + worker to make it operational.
Honest caveat — H3 worker
The C++ h3_worker binary is operator-supplied and absent from the repo. The in-tree Go SPSC-ring producer + EpochBatcher ship but are not yet wired into the engine's data path (no non-test importer — only their own unit tests, e.g. TestNewSPSCRing_MemfdCreated proves the ring structurally, not with the real worker). H3 is a reserved spatial axis, not a live index.
Post-quantum + hedged cryptography
| Feature | Location | Status |
|---|---|---|
| ZIP-215 Ed25519 verify | pkg/identity/verify.go — circl v1.6.4 (RFC-8032-strict canonical-Y/S) + RejectSmallOrderKey cofactor-8/small-order rejection | Verified |
| Hedged (randomized-nonce) EdDSA | pkg/identity/eddsa_hedge.go (!aws_lc_hedged tag) — RFC-8032 §5.1.6 with a 64-byte crypto/rand nonce prefix; verifies under unchanged circl.Verify | Verified |
| ML-DSA-65 (FIPS 204) | pkg/identity/pq_mldsa.go — randomized sk.Sign, context domain-separation, filippo.io/mldsa; sig=3309B, pub=1952B. Opt-in via hybrid Ed25519 + ML-DSA-65 signing | Opt-in |
| Hybrid Ed25519 + ML-DSA-65 | pkg/identity/hybrid_sign.go — both signatures over one shared pad; a BOTH-required verify (hybrid_verify.go) so a classical or PQ break alone cannot forge a frame | Opt-in |
| aws-lc hedged bridge | pkg/identity/aws_lc_hedged_stub.go (aws_lc_hedged tag, OFF) | Stub |
| X25519MLKEM768 key exchange | inherited from the TLS 1.3 stack by default; verified negotiated on the wire | Verified |
| Dev-mesh x509 PKI | pkg/crypto/certgen.go — Ed25519 self-signed CA issuing server+client leaves, with leaf rotation and a CRL so a revoked or expired cert is rejected at the handshake | Dev only |
| Zero-GC PII masking | internal/crypto/pii.go — MaskPII three-pass scan; no-PII fast path returns input verbatim with identical data pointer; rare path one exact alloc; //go:nosplit///go:noinline; xxhash-deterministic redaction | Verified |
aws-lc hedged bridge is a panic stub
aws_lc_hedged_stub.go is a panic stub; the real CGO bridge is deferred. The Go binding github.com/aws/aws-lc-go is repo-not-found.
eBPF reuseport steering
pkg/transport/ebpf_reuseport.go (//go:build ebpf_kernel) loads a live BPF_PROG_TYPE_SK_REUSEPORT program via cilium/ebpf v0.22.0 (the first production-loadable eBPF dep), keyed on OriginNodeID via BPF_MAP_TYPE_SOCKHASH (bpf_sk_select_reuseport helper id 82). The program reads ctx->data[88:104] (= udpHeaderSize(8) + originNodeIDWireOffset(80)). A miss is never a drop (SK_PASS → kernel hash fallback → delivered, not dropped). AttachProgram uses SO_ATTACH_REUSEPORT_EBPF=0x34; DetachProgram uses SO_DETACH_REUSEPORT_BPF=0x44 (a detach path that avoids an EINVAL on kernel 6.18). Proven on silicon: TestEBPFRoamStickiness_32Sockets (32 sockets, 1000 frames, 4-tuple roam / CID constant → all 1000 on pinned socket 0), TestEBPFDeterminism, TestNoCryptoBeforeRoute_EBPF.
Honest caveat — eBPF opt-out
ebpf_kernel is opt-out by default; default ingress stays on the in-process ReusePortFanout; silicon tests t.Skip cleanly on a capability-absent box (require sudo + c8g kernel 6.18).
TLS 1.3 mesh
pkg/transport/tls_transport.go's TLSConnections is 1.3-only mTLS (Min==Max==VersionTLS13 — 1.2/1.1/1.0 impossible; RequireAndVerifyClientCert), with GetCertificate/GetClientCertificate hooks serving a live leaf for SIGHUP rotation (Reload() re-reads the leaf cert+key and atomically swaps it; ReloadCA() (ADR-0035) hot-reloads the CA pool atomically, so a trust-root change no longer requires a transport restart; LoadCRL()/ReloadCRL() hot-reload the revocation list, and the VerifyPeerCertificate handshake callback rejects revoked/expired leaves). Gates: TestTLSHandshake_13_Only (Version==TLS1.3, AEAD cipher in {AES_128_GCM_SHA256, AES_256_GCM_SHA384}), TestTLSRejectWithoutClientCert, TestTLSCertRotation_SIGHUP (new leaf to same paths + Reload() → re-Dial presents new leaf within 5s). The peer data plane, the /metrics+/livecheck plain-HTTP surface, and the /v1/* mTLS control port share one trust root but ride separate listeners.
Cedar ABAC
Cedar ABAC is a pinned dependency (pkg/identity/bridges.go), not yet wired into the request path — no production authorization engine ships. bridges.go blank-imports github.com/koblas/cedar-go (package cedar, v0.1.0) solely to pin the module hash in go.sum; the cedar.NewAuthorizer/ParsePolicies/Request symbols are not yet called, and there is no Authorizer integrated with the engine's request path. ABAC wiring is future work.
Telemetry → Prometheus bridge
internal/telemetry's Counter is a zero-GC, lock-free, sharded LongAdder (64 stripes, each exactly one 64-byte cache line via //go:align 64); the hot path is wait-free (each writer CAS-loops only on its own stripe). A singleton registry binds 24 named instruments (3 gauges + 21 counters): ArrowSerialBytes, MemTableFlushTotal, OffHeapAllocatedBytes, QueryL0ListCapped, QueryL1FilesScanned, CompactionMerged, CompactionL1Written, CompactionRowsPruned, L0ReapSweeps, L0ReapL0Deleted, L0ReapManifestsReaped, L0ReapSkippedOrphan, QueryTxTimeHighWaterMark, PruningHorizonEffective, PruningHorizonRetreatRefused, QueryDownloadSkippedFirstSys, QueryManifestSkippedFirstSys, QueryLiveSourceReads, StratifiedAntiEntropyFallback, CertRotationTriggered, CertRevokedRejected, PQHandshakeNegotiated, HybridFrameAccepted, InterRegionEnvelopesShipped.
pkg/metrics's TelemetryBridge (telemetry_bridge.go) is a prometheus.Collector that enumerates the counters at construction and dispatches on their mode at collect time — so adding a counter to the registry surfaces it as a new supremum_* series with zero bridge code edits (the name mapping is the only transformation). The double-count trap is closed: the bridge reads only the 64-stripe cumulative value and never the per-interval delta cursor, so it stays correct whether or not an OTel exporter is bound. Two metric families coexist by prefix and never collide: sovereign_* (labelled, from the recorder) and supremum_* (cumulative, from the bridge).
The chaos harness
internal/chaos (covered in the Design Rationale) is the verification layer proving the three hardest invariants under hostile conditions: semantic Byzantine injection, Merkle convergence under partition, and off-heap crash survival via supervisor/worker process isolation + WAL recovery. It is explicitly a VERIFICATION layer, not the CRDT core apply hot path (the 50.7M–68.3M ops/s microbench).
Honest-negative measurement culture
The hardware-honesty gates, the honest-negative benchmark recording, and the SDK's originator-vs-peer payload boundary are themselves a specialty: the engine treats measurement discipline as a load-bearing engineering property, enforced by CI gates, not a convention.