tidaldb

jordan/tidaldb

Fork 0

Commit Graph

Author	SHA1	Message	Date
jx12n	6651c14adc	feat(m11): cluster security (m11p7) + perf instrumentation floor m11p7 — secure the cluster, all opt-in (pre-m11p7 byte-for-byte): - gRPC replication mTLS by default via a custom tokio-rustls acceptor + DynamicCertResolver; zero-drop content-hash cert rotation (k8s ..data swap, no pod restart, no inotify) - inter-node HTTP TLS sharing the same resolver (one rotation, both planes) + per-node keyed-BLAKE3 signed x-tidal-node-token; marker-without-token -> 403 - admin audit log (operator-leg only) + per-principal rate limit (engine RateLimiter; sibling nodes exempt) - k8s cert-manager manifest (certs.yaml) + scripts/gen-cluster-certs.sh fallback; secret.example.yaml gains TIDAL_CLUSTER_KEY (file-mounted, hot-rotatable) - exit gate verified real: mtls.rs (gRPC foreign-pod), cluster_security.rs (HTTP foreign + zero-drop rotation under load), 7 security unit tests perf — instrument floor (sweep Wave 1): - new tidal/benches/wal.rs + tidal-server/benches/scatter.rs - p99->mean honesty relabel; sweep manifest at docs/reviews/perf-sweep-2026-06-13.md - add @tidal-performance agent (Martin Thompson) new: cluster/{audit,http_tls,security}.rs, tests/cluster_security.rs, docs/planning/milestone-11/phase-7.md	2026-06-13 01:25:35 -06:00
jx12n	b55ad70141	fix: M0-M10 third-pass remediation — durability, replication, and CLI hardening Resolves the 142 findings from tidal/docs/reviews/CODE_REVIEW_m0-m10.md across the engine, server, net, and CLI surfaces: - WAL/session-journal durability, checkpoint format, and crash-recovery hardening - Replication shipper/receiver, tenant isolation, and migration paths - Cluster scatter-gather, router, standalone server + health/offload endpoints - tidalctl refactored into command modules with JSON output and WAL-state tooling - Cohort, governance, signal-ledger, and vector-registry correctness fixes - Expanded UAT/integration/durability test coverage across all milestones	2026-06-08 10:28:34 -06:00

Author

SHA1

Message

Date

jx12n

6651c14adc

feat(m11): cluster security (m11p7) + perf instrumentation floor

m11p7 — secure the cluster, all opt-in (pre-m11p7 byte-for-byte):
- gRPC replication mTLS by default via a custom tokio-rustls acceptor +
  DynamicCertResolver; zero-drop content-hash cert rotation (k8s ..data swap,
  no pod restart, no inotify)
- inter-node HTTP TLS sharing the same resolver (one rotation, both planes) +
  per-node keyed-BLAKE3 signed x-tidal-node-token; marker-without-token -> 403
- admin audit log (operator-leg only) + per-principal rate limit (engine
  RateLimiter; sibling nodes exempt)
- k8s cert-manager manifest (certs.yaml) + scripts/gen-cluster-certs.sh fallback;
  secret.example.yaml gains TIDAL_CLUSTER_KEY (file-mounted, hot-rotatable)
- exit gate verified real: mtls.rs (gRPC foreign-pod), cluster_security.rs
  (HTTP foreign + zero-drop rotation under load), 7 security unit tests

perf — instrument floor (sweep Wave 1):
- new tidal/benches/wal.rs + tidal-server/benches/scatter.rs
- p99->mean honesty relabel; sweep manifest at docs/reviews/perf-sweep-2026-06-13.md
- add @tidal-performance agent (Martin Thompson)

new: cluster/{audit,http_tls,security}.rs, tests/cluster_security.rs,
docs/planning/milestone-11/phase-7.md

2026-06-13 01:25:35 -06:00

jx12n

b55ad70141

fix: M0-M10 third-pass remediation — durability, replication, and CLI hardening

Resolves the 142 findings from tidal/docs/reviews/CODE_REVIEW_m0-m10.md across
the engine, server, net, and CLI surfaces:

- WAL/session-journal durability, checkpoint format, and crash-recovery hardening
- Replication shipper/receiver, tenant isolation, and migration paths
- Cluster scatter-gather, router, standalone server + health/offload endpoints
- tidalctl refactored into command modules with JSON output and WAL-state tooling
- Cohort, governance, signal-ledger, and vector-registry correctness fixes
- Expanded UAT/integration/durability test coverage across all milestones

2026-06-08 10:28:34 -06:00

2 Commits