Building toward the beta (beta = v1). Nothing is deployed to customers. Work lands on main continuously, each change only after Sol's review and an exact-tip gate pass. Most beta features are designed and in active build; the qualification runs (smoke 11, the 72-hour Railway run, release qualification) come last.
Beta (v1)
BuildingOn track but large. 21 lanes are defined, 17 have an owner and active work. Every beta byte format is approved or in review, and 4 of 55 beta checklist rows are fully done, with about 20 more partly on main. The long poles are the schema runtime (L4), peer slice 2 (L2), the generation-3 reclamation line (L3), zero-downtime handoff and upgrades (L6), and the new bucket-free and mirror lanes (L7/L8/L12). The beta ends with smoke 11, the 72-hour Railway run and release qualification.
Risks and drag
- Gate capacity: about ten gates queue for nine boats, so landing is slower than building.
- The owner's standing token rule (every async completion carries its operation token) keeps finding real pre-existing bugs. That's good for quality, and it adds review rounds.
- Three lanes have no dedicated owner yet: L19 measurement, and parts of L20 integration. L21 Jepsen is paused by owner choice.
GA
PlannedGA's 12 rows are designed or planned; none is in build. GA adds split and routing (scale-out), branches and point-in-time restore, deploy requests and Insights, home regions, full-text and vector indexes, pooled tenancy, and the cloud's metering and billing. Most GA work starts after the beta artifact is qualified.
Beyond GA
ProposedBeyond GA: beyond-SQL products (a key-value API and the rest of Fable section 6.7), automatic split of hot shards (P6.6), and Durable Object mode (P6.7). These are proposals only, with no design work scheduled.
Merging now
Every change needs a Sol review and a gate pass on its exact commit before it lands on main. Stages: building → Sol review → gate → on main.
| Change | Stage |
|---|---|
| L1 txid fence merge-tier gate on boat-7 | In gate |
| L17 SQL error redaction re-gate after a clean merge of main; Sol GO | In gate |
| L16 loopback credentials Sol GO | In gate |
| L17 libSQL HTTP profile long gate; Sol GO | In gate |
| L10 joint fixtures + codec r2 Sol GO | In gate |
| L6 helper-decision token fix Sol GO | In gate |
| L6 R4 live-handoff tests Sol GO; lands after the helper fix | In gate |
| L6 membership token fix Sol GO on B1-B3; test-only fix after | In gate |
| L5 deletion-permit models + packet Sol review after | In gate |
| L17 introspection continuation compile OK; Sol review after | In gate |
| L17 ORM probe matrix compile OK; Sol review after | In gate |
| L15 warm-rank fix Sol GO; waits on the warm-on seed result | Sol review |
| L4 schema runtime + jobs/images packet + codecs Sol NO-GO r2; fixes in progress | Fixing review findings |
| Bucket-free plan r3 + sign-off packet Plan GO; packet has one blocker (predecessor rule) | Fixing review findings |
| L17 retry follow-ups compiling | Building |
| L9 tenancy format packet + codec compiling; owner sign-off later | Building |
| L14 fast-reopen merge test triage | Building |
| L3/L11 mint permits step 2 test seed re-pin | Building |
Landed on main today
| Retry SDK (TypeScript/Python retry and handoff rules) | Done |
| Hexadecimal integer literals | Done |
| L18 qualification status docs | Done |
| Lane plan + acceptance refresh (owner decisions 21-25) | Done |
| Owner F1 floor-cost approval record | Done |
| L6 format claims: lease 3, test-only record 9 | Done |
| L4 and L10 format claims | Done |
| Standing rule 8: async completions carry their operation token | Done |
| L16 roles steps 1-2 + security contract tests | Done |
| L15 standby reanalysis + cold-audit fixes | Done |
| Fault-check unresolved split | Done |
| Reserved hash domain for fast reopen (proposed) | Done |
Lanes (who is building what)
Rows B8 · Opus (txid)
Now
Merge-tier gate running on the exact tip daba872a; owner floor-cost approval landed, which unblocks it.
Next
Land first in the queue.
Rows B23, B24 · Opus (lane A)
Now
Pieces 4 and 5a have Sol GO; the protocol-12 header is claimed on main.
Next
Pieces 5 to 7 after L1 lands.
Rows B10, B13 · Opus (C0/C2, clock)
Now
C0/C2 repair on a fresh main merge; mint-permit step 2 is green apart from a test seed that drifted under the new txid format.
Next
Re-pin the seed, gate, then land minting.
Rows B3, B4 · Opus (L4)
Now
Runtime slices and the schema-jobs/images packet are in review. Sol found a cross-gateway cleanup gap, missing token rules and three codec bounds issues; one DDL test fails.
Next
Fix, Sol re-check, gate, land the runtime; then the packet goes to the owner.
Rows B14 · ChatGPT Pro (GX-M25)
Now
M2 models and the runtime packet are pushed; the gate is queued.
Next
Sol review, then owner sign-off.
Rows B18, B20, B22 · Opus (L6)
Now
Two token fixes (helper decision, membership) and the R4 handoff tests have Sol GO; gates are queued.
Next
Land helper, then R4, then membership; then lease format 3 step 2.
Rows B26 · Opus (bucket-free)
Now
Plan GO from Sol. The sign-off packet has one blocker: the first published cut after a revoked slot cannot name its predecessor. Being fixed.
Next
Sol re-check of that one item, then the packet goes to the owner.
Rows B16 · Opus (bucket-free)
Now
MirrorCut models are running. The model already found and fixed a collector race.
Next
Models pushed, then slices after L12.
Rows B29 · Opus (L17)
Now
Owner approved all design decisions; the byte packet and unarmed codec are pushed and compiling.
Next
Sol review, then owner format sign-off.
Rows B25, B46 · Opus (L10)
Now
Claims on main. Fixtures and the codec r2 have Sol GO; gates are queued.
Next
Land, then swap in L4's real types and build P3.
Rows B11 · Opus (clock)
Now
Step 2 is green; the lease control test is being re-pinned.
Next
Gate, land onto the generation-3 line, then step 3.
Rows B44 · Opus (bucket-free)
Now
C0 models done (30 configs, mutants caught).
Next
C1 type, C2 tests, C3 as-of reader.
Rows B12 · Opus (clock)
Now
Design 1 has Sol GO.
Next
Lands off after the L3 minting line.
Rows B17 · Opus (L14/L18)
Now
Plan GO. Fast-reopen merge is in test triage; the cache-cleanup fence and hold tokens are written.
Next
Separate real failures from environment, then land R1.
Rows B19 · Opus (L15)
Now
Failover landed off on main; the warm-rank fix has Sol GO; one seed fails with warm followers on (pre-existing).
Next
Fix the seed, warm-on gate campaign, then the three cost-gating steps.
Rows B28, B30 · Opus (L16)
Now
Roles steps 1-2 on main; loopback credentials have Sol GO and are in their gate.
Next
Follow-ups (Unicode-whitespace tokens), then roles step 3.
Rows B5, B6, B7 · Opus (L17) + ChatGPT Pro (GX-M26)
Now
Retry SDK and hex integers landed today. SQL error redaction and libSQL HTTP are in gates; introspection and the ORM matrix are queued.
Next
Land the rest, retry follow-ups, then tenancy (L9).
Rows B36, B47-B50, B53, B55 · Opus (L14/L18)
Now
Plan GO. First hand-run qualification attempt is queued on two boats; the Railway driver merge is done.
Next
Measure the nightly duration; smoke 11 contract.
Rows B31-B35 · none
Now
Partly measured (12 Nov, one node). No owner.
Next
Needs an owner.
Rows B27, B37, B39-B43, B51, B52 · Coordinator (Claude)
Now
Register claims for lane A, L4, L6 and L10 on main; the standing token rule is in AGENTS.md; docs refreshed today.
Next
Owner packets as they clear Sol; public spec later.
Rows B38 · Opus (paused)
Now
Sol GO to build; paused by the owner (Jepsen runs last).
Next
Resumes near the end of the beta.
Beta checklist (55 rows)
Engine, SQL and schema
Transactions, outcomes and clocks
Storage, reclamation and deletion
Availability and zero downtime
Peer durability and beyond the bucket
Security and tenancy
Measurement, cost and capacity
Verification, specification and claims
The beta's tuple, artifact and qualification
Rows and status text come from docs/acceptance.md on main; the coloured state is the coordinator's current reading.
Plan of attack: 62 of 106 boxes ticked
From docs/plan-of-attack.md on main (last edited 2026-11-14 09:26 UTC). Phase 10 (the feature-gap phase) lives in the acceptance list above rather than as boxes here. Some open boxes are partly done (noted in the item text).
Phase 0 — Reset5/5 Done
- P0.1 Merge PR #1 into main
- P0.2 Fix the flaky catalog test
- P0.3 HTTP request admission
- P0.4 Make --ack-after-decision the default
- P0.5 Idle polling:
Phase 1 — Turso feasibility spike (throwaway branch)9/9 Done
- P1.1 Can a native virtual-table cursor return "I/O pending" and be
- P1.2 Gateway-owned transactions
- P1.3 Rowid mapping for text and composite primary keys
- P1.4 best_index → key ranges for PK/index lookups
- P1.5 Error propagation: unique violation, conflict, outcome unknown
- P1.6 Every conflict mode
- P1.7 Point read/update latency and per-row overhead against the legacy
- P1.8 Turso with a deterministic clock and RNG
- P1.9 Confirm that Turso cannot open the VOD libSQL file
Phase 2 — Deterministic simulation9/12 Building
- P2.0 MVP, first:
- P2.1 Design note (§4.3 choice, determinism inventory, fault model,
- P2.2 Environment layer: clock, RNG, spawn, blocking. Route every
- P2.3 Core purity: time as an argument in gauntlet-core
- P2.4 Simulated bucket and network, fully seeded, with the §4.4 faults:
- P2.5 Cluster harness: N nodes, crash/restart at any suspending task poll,
- P2.6 Workloads and history recorder
- P2.7 Checkers: serializability
- P2.8 BUGGIFY hooks on the rare paths. Done
- P2.9 Mutation set (§4.7)
- P2.10 Seed budgets: per-merge enforcement is done locally
- P2.11 Move the timing-sensitive tests
Phase 3 — Many databases per deployment9/11 Building
- P3.1 Design note covering:
- P3.2 Layout:
- P3.3 One node process serves many databases:
- P3.4 Shards per database
- P3.5 Nodes register and find each other through lease records in the
- P3.6 Clients choose the database by name:
- P3.7 Bucket check at every node start, using the operations Gauntlet
- P3.8 DST: workloads across many databases with activation and release
- P3.9 Client admission before activation
- P3.10 Idle release ends all-or-recover
- P3.11 Bound inactive registry entries
Phase 4 — Turso cutover14/17 Building
- P4.1 TableAccess over the coordinator Attempt
- P4.2 Pin turso_core; Gauntlet I/O/clock/RNG for the in-memory session
- P4.3 Module: schema, best_index, async cursors, rowid map
- P4.4 Writes, constraints and index maintenance, moved from sql/mod.rs
- P4.5 Gateway transaction control and autocommit
- P4.6 DDL through the Gauntlet catalog
- P4.7 UPSERT / INSERT OR REPLACE handling
- P4.8 pg wire and HTTP on Turso statements
- P4.9 SQLSTATE mapping table in compatibility.md
- P4.10 Differential corpora on both engines
- P4.11 SQL workloads through the Turso path in DST. The named
- P4.12 VPS benchmark: legacy vs Turso through scripts/vps/turso-wire.sh.
- P4.13 Make Turso the default. [REVIEW] Then delete the legacy
- P4.14 SQLite removal: gauntlet-import tool, rusqlite only in dev
- P4.15 Bound native execution:
- P4.16 Move benchmark and diagnostic code
- P4.17 Reconcile compatibility.md and the client contract
Phase 5 — Performance to targets3/9 Building
- P5.1 Per-operation phase timing
- P5.2 Explain and fix the single-row update cost. It measured about 5
- P5.3 Group commit: the actor pumps immediately after append installation,
- P5.4 Read leases derived from journal appends — [REVIEW] design.
- P5.5 Stop scans starving under writes
- P5.7 One process memory budget, shared by every resident database,
- P5.8 Nightly VPS benchmark with stored history and a 10% regression
- P5.10 Large-database run
- P5.9 Opt-in peer-durable acknowledgement per database — [REVIEW]
Phase 6 — Scale-out0/7 Not started
- P6.1 Durable routing generations and fenced handoff, modelled first
- P6.2 One operator-driven shard split/move with bounded, resumable
- P6.3 Add and remove nodes in static node mode, and move data when
- P6.4 Remove the shard-0 hot spot
- P6.5 Mixed-version rolling upgrades
- P6.6 Automatic split of hot or large shards
- P6.7 Durable Object mode
Phase 7 — Reclamation11/21 Building
- P7.1a Decision authority and typed decision errors. [REVIEW] This is
- P7.1b Decision-object retirement with a named outcome-lookup window, plus
- C0 unarmed foundation (25 Oct)
- C1 unarmed implementation
- C3 unarmed implementation
- M7 H (DR/OS) model gate (25 Oct)
- C2 merged-head qualification
- P7.2 Checkpoint/block reachability and deletion, including readers
- D7 started-image refusal
- D5 reader protection, unarmed
- P7.3 Receipt and floor cleanup, with a named authority that excludes late
- D1 foundation: GNTF2 floor-pair and closed-gate historical maturity
- D2 implementation, unarmed
- D3 implementation, unarmed
- D8 marker-first handoff: implemented on pro/l-d8. Exact-release
- D4 reader implementation prepared, unarmed
- D8 marker-first handoff: the unapplied candidate builds, but a healthy
- P7.4 Each deletion authority has a model and a broken variant, plus
- M7, Track I model-only: reclamation timing composition
- P7.5 Dropped and abandoned databases
- M7 DatabaseReclamation timing model
Phase 8 — Hardening2/9 Building
- P8.1 TLS (rustls) between nodes and for clients
- P8.2 Metrics (Prometheus), tracing and structured logs.
- P8.3 Scheduled backups to the second provider
- P8.4 The real-process fault harness on dedicated hosts, not the shared
- P8.5 Runbooks: failover, restore, upgrade, rollback, capacity.
- P8.6 Version policy and upgrades
- P8.7 A packaged release, qualified as the exact artifact
- P8.8 Close the 22 Oct docs audit
- P8.9 Observability (with P8.2) names its signals:
Phase 9 — Release qualification0/5 Not started
- P9.1 One exact version, provider and configuration.
- P9.2 Seven-day sustained run at target load with faults.
- P9.3 Restore rehearsal from the independent backup.
- P9.4 Independent protocol review, against a maintained map of
- P9.5 Published limits and SLOs.
V1 client compatibility — owner additions (12 Nov 2026)0/1 Not started
- P10.7 Retry rules and Apache-2.0 TypeScript/Python SDKs. The
GA and beyond
Beyond GA: beyond-SQL products (a key-value API and the rest of Fable section 6.7), automatic split of hot shards (P6.6), and Durable Object mode (P6.7). These are proposals only, with no design work scheduled.
What is deployed
| Website and docs gauntlet-db.stavros.xyz Since 12 Nov; source on pro/l-web (not on main). Docs refresh drafted after the current batch lands, deployed only on owner go. | Live |
| Console (control plane) gauntlet-db-console.stavros.xyz Console 0925b131, quiet. | Live |
| Console's Gauntlet node (VPS 2) internal Runs 35c03cda (13 Nov), without the S1 escape and redaction fixes. Owner-approved upgrade right after redaction lands. | Behind main |
| Railway beta cluster Railway (EU West) Approved for the 72-hour run; runs only on the qualified beta artifact. | No owner |
| Customer production - Nothing customer-facing until the beta is qualified and the owner says go. | Nothing deployed |
Test fleet: 9 boats (2 temporary until 12:15Z 15 Nov) + 5 ib boxes + the PC. Gates queue for boats; heavy model checks run on ib boxes.
Waiting on the owner
- Sign the L4 schema-jobs/images format packet (after Sol's re-check).
- Sign the bucket-free/mirror/verified-cut format packet (Sol is reviewing).
- Sign the tenancy byte packet (coming after Sol).
- Later: approve the reserved fast-reopen hash domain when that feature lands.
- Decide whether R2 counts as an independent provider in public wording.
- Decide on S3 Standard (deferred) and the ~3 s failover target (post-beta).
- Rotate the Cloudflare logs token, the Railway token and the web deploy token.
Not being worked on
- L19 measurement: no owner (latency and cost receipts, capacity contract, 100k databases).
- L21 Jepsen suite: paused by owner choice until late in the beta.
- Phase 6 scale-out (split, routing, node add/remove): GA, not started.
- Public format specification and offline reader (B39): no design yet.
- aarch64 packaging, and the seven-day run on dedicated hardware (hardware-gated).
- All GA rows G1-G12 and beyond-GA products.