Key Features & Specialties
The concrete specialties surfaced by the source, with the package/file where each lives — and an honest label where the feature is bench-only, stub, dormant, or opt-in.
The CRDT core (pkg/sync)
| Specialty | Mechanism | Status |
|---|---|---|
| Sharded lock-free HAMT | DeltaCRDTEngine.shards []shardRoot (default 256) + routeShard; per-shard atomic.Pointer[HAMT] CAS | Production |
Merge-union Join | crdt.go:1089; FROZEN; per-element routing through the wire-integrity seam | Production |
| IBLT + Strata Estimator | iblt.go; XOR-accumulator buckets (0.00% FP purity); StrataEstimator = 32 fixed IBLTs; DynamicIBLTSize(dEst) | Production |
| EBR + hazard pointers | reclamation.go; 3-epoch × 256-shard retired ring; 2-epoch grace window; ABA-immune | Production |
| Wire-integrity seam | crdt_reconstruct.go + crdt_reconstruct_skew.go; 3 axes (digest, attribution, skew bound); closes Byzantine A1/A4 | Production |
| Capnp wire | crdt_capnp_wire.go (marshal-only BuildCRDTDeltaEvent); CRDTDeltaEvent 13-field schema; C5/C6 version/format guards | Production |
| IBLT wire codec | iblt_wire.go; deliberate little-endian (non-capnp) IBL1/STRA magic | Production |
| Stage-5 stack candidates | elimination.go (elimination-backoff), flatcomb.go (flat-combining), sharded.go (SEC-sharded) | Bench-only |
| Residency hardening | residency.go — mlock/madvise/prefault page-fault mitigation (Stage-6) | Opt-in |
| Lamport durability decoupling | persistCh chan uint64 (unbuffered) + persistWorkerLoop; lastSavedCounter monotone CAS loop | Production |
Stage-5 stack — three candidates coexist
The three Stage-5 candidates (elimination-backoff, flat-combining, SEC-sharded) coexist; the active candidate for TestStage5ScalingGate is chosen by init() override ordering (SEC wins). There is no single committed winner — this is honestly labeled bench/experiment.
Tri-temporal state
State is keyed by (system_time × valid_time × assertion_time) with decision_time on the wire (CRDTEntry fields @72–104). The durable tier materializes this as the 40-byte composite key + 9-field Arrow IPC rows. The read path enforces the four-filter bitemporal discipline; Range uses interval-intersection (not point-in-window). Dominance pruning (DominancePrune, l1_compactor.go) is the tri-temporal lattice's GC: C1 structural, C2 [vs,ve) containment, C3 txTime <= horizon FLOOR. T_gc auto-inference (Day-22, ADR-0027) tracks the observed live-query txTime frontier as a monotone atomic MAX at AsOf-entry and feeds effective = max(operatorFloor, observedFrontier - backoff) into the unchanged DominancePrune — the inferrer floors the operator knob (never replaces); retreats are refused + counted (telemetry.PruningHorizonRetreatRefused) + logged.
H3 spatial CRDT
H3Index uint64 is carried on every CRDTEntry (@112) and in the Arrow schema (h3_index Uint64). Enrichment runs in an isolated C++ worker over a memfd-backed SPSC shared-memory ring (internal/spatial/h3_spsc_ring.go): RingSlot exactly 64 B, RingHeader exactly 192 B (3 cache lines), MAP_SHARED|MAP_POPULATE pre-faulted, survives execve via ExtraFiles at fd 3 (the post-audit fix replacing Mmap(-1, MAP_ANON) which severed at execve → EBADF deadlock). EpochBatcher (epoch_batcher.go) batches coordinate submissions (DefaultEpochSize=4096, CollectTimeout=100ms) to amortize cross-process round-trips.
Honest caveat — H3 worker
The C++ h3_worker binary is operator-supplied; in-tree tests use mock Go consumers, so cross-process memfd-inheritance + real H3 computation is proven only structurally (TestNewSPSCRing_MemfdCreated).
Post-quantum + hedged cryptography
| Feature | Location | Status |
|---|---|---|
| ZIP-215 Ed25519 verify | pkg/identity/verify.go — circl v1.6.4 (RFC-8032-strict canonical-Y/S) + RejectSmallOrderKey cofactor-8/small-order rejection | Production |
| Hedged (randomized-nonce) EdDSA | pkg/identity/eddsa_hedge.go (!aws_lc_hedged tag) — RFC-8032 §5.1.6 with a 64-byte crypto/rand nonce prefix; verifies under unchanged circl.Verify | Production |
| ML-DSA-65 (FIPS 204) preview | pkg/identity/pq_mldsa.go (pq_preview tag) — randomized sk.Sign, context domain-separation, filippo.io/mldsa; sig=3309B, pub=1952B | Preview |
| aws-lc hedged bridge | pkg/identity/aws_lc_hedged_stub.go (aws_lc_hedged tag, OFF) | Stub |
| X25519MLKEM768 | (intent named in the engine context) | Preview |
| Dev-mesh x509 PKI | pkg/crypto/certgen.go — Ed25519 self-signed CA (10-year, IsCA) issuing 1-year server+client leaves; stdlib crypto/ed25519 + crypto/x509 (distinct key space from CRDT-delta signing) | Dev only |
| Zero-GC PII masking | internal/crypto/pii.go — MaskPII three-pass scan; no-PII fast path returns input verbatim with identical data pointer; rare path one exact alloc; //go:nosplit///go:noinline; xxhash-deterministic redaction | Production |
aws-lc hedged bridge is a panic stub
aws_lc_hedged_stub.go is a panic stub; the real CGO bridge is deferred to Subphase 1.2. The Go binding github.com/aws/aws-lc-go is repo-not-found.
eBPF reuseport steering
pkg/transport/ebpf_reuseport.go (//go:build ebpf_kernel) loads a live BPF_PROG_TYPE_SK_REUSEPORT program via cilium/ebpf v0.22.0 (the first production-loadable eBPF dep), keyed on OriginNodeID via BPF_MAP_TYPE_SOCKHASH (bpf_sk_select_reuseport helper id 82). The program reads ctx->data[88:104] (= udpHeaderSize(8) + originNodeIDWireOffset(80)) — the post-audit correction; the prior draft's [80:96] read half-dotCounter+half-originNodeID garbage and the kernel fell back to hash. A miss is never a drop (SK_PASS → kernel hash fallback → delivered, not dropped). AttachProgram uses SO_ATTACH_REUSEPORT_EBPF=0x34; DetachProgram uses SO_DETACH_REUSEPORT_BPF=0x44 (the 12.2 root-cause fix — the fd=0 SO_ATTACH trick EINVAL'd on kernel 6.18). Proven on silicon: TestEBPFRoamStickiness_32Sockets (32 sockets, 1000 frames, 4-tuple roam / CID constant → all 1000 on pinned socket 0), TestEBPFDeterminism, TestNoCryptoBeforeRoute_EBPF.
Honest caveat — eBPF opt-out
ebpf_kernel is opt-out by default; default ingress stays on the in-process ReusePortFanout; silicon tests t.Skip cleanly on a capability-absent box (require sudo + c8g kernel 6.18).
TLS 1.3 mesh
pkg/transport/tls_transport.go's TLSConnections is 1.3-only mTLS (Min==Max==VersionTLS13 — 1.2/1.1/1.0 impossible; RequireAndVerifyClientCert), with GetCertificate/GetClientCertificate hooks serving a live leaf for SIGHUP rotation (Reload() re-reads leaf cert+key, atomically swaps; the CA pool is NOT reloaded — a trust-root change requires transport restart). Gates: TestTLSHandshake_13_Only (Version==TLS1.3, AEAD cipher in {AES_128_GCM_SHA256, AES_256_GCM_SHA384}), TestTLSRejectWithoutClientCert, TestTLSCertRotation_SIGHUP (new leaf to same paths + Reload() → re-Dial presents new leaf within 5s). The peer data plane, the /metrics+/livecheck plain-HTTP surface, and the /v1/* mTLS control port share one trust root but ride separate listeners.
Cedar ABAC
pkg/authorization is bench-only — it contains only _test.go files; there is no production Authorizer type, no IsAuthorized call site outside the bench, no integration with the request path. cedar_bench_test.go measures cedar-go v0.1.0 in two regimes (attribute-free identity-only AST-walk vs attribute-resolving with a real cedar.Store), gated by TestGateCedar_GearHonesty (asserts NumCPU==4, scans for a forbidden _32c tag) and TestGateCedar_FROZENUntouched (FROZEN files byte-identical — the authorization track touched no FROZEN file). Honest finding: cedar-go EmptyStore.Get returns (nil,nil) → nil-pointer panic on attribute resolution, so StoreFromJson is mandatory. Production ABAC wiring is a future track.
Telemetry → Prometheus bridge
internal/telemetry's Counter is a zero-GC, lock-free, sharded LongAdder (64 stripes, each exactly one 64-byte cache line via //go:align 64); the hot path is wait-free (each writer CAS-loops only on its own stripe). A singleton registry binds 19 named instruments (3 gauges + 16 counters): ArrowSerialBytes, MemTableFlushTotal, OffHeapAllocatedBytes, QueryL0ListCapped, QueryL1FilesScanned, CompactionMerged, CompactionL1Written, CompactionRowsPruned, L0ReapSweeps, L0ReapL0Deleted, L0ReapManifestsReaped, L0ReapSkippedOrphan, QueryTxTimeHighWaterMark, PruningHorizonEffective, PruningHorizonRetreatRefused, QueryDownloadSkippedFirstSys, QueryManifestSkippedFirstSys, QueryLiveSourceReads, StratifiedAntiEntropyFallback (the 19th, Day-29).
pkg/metrics's TelemetryBridge (telemetry_bridge.go, ADR-0023) is a prometheus.Collector that enumerates telemetry.Counters() at construction and dispatches on Mode() at Collect — SSoT-grows-auto: adding a counter to internal/telemetry's allCounters() slice surfaces it as a new supremum_* series with zero bridge code edits (name mapping is strings.ReplaceAll(name, ".", "_"), the only transformation). The double-count trap is closed: the bridge reads ONLY c.Value() (the 64-stripe cumulative sum) and NEVER reads lastReported (the OTel delta-dedup cursor), making it safe whether or not an OTel MeterProvider is bound. The two metric families coexist by name prefix: sovereign_* (labelled, from Recorder) and supremum_* (cumulative, from the bridge) — never collide. SSoT growth history (honest): Day 18: 12 → Day 22: 15 → Day 24: 16 → Day 25: 17 → Day 27: 18 → Day 29: 19.
The chaos harness
internal/chaos (covered in the Design Rationale) is the verification layer proving the three hardest invariants under hostile conditions: semantic Byzantine injection, Merkle convergence under partition, and off-heap SIGSEGV survival via supervisor/worker process isolation + WAL recovery. It is explicitly a VERIFICATION layer, not the CRDT core apply hot path (50.7M–57.6M ops/s microbench).
Honest-negative measurement culture
The gear-honesty teeth, FROZEN-file MD5 teeth, honest-negative bench recording, and the SDK's originator-vs-peer payload boundary are themselves a specialty: the engine treats measurement discipline as a load-bearing engineering property, enforced by CI gates, not a convention.