Changelog
Every merged change, by date.
The commits that changed what UltraFabric does, newest first, with their ids so you can read the diff. Work-in-progress and test-only commits are left out. Every measurement named here was taken on a shared development host and is indicative.
Phases closed
P0 through P3b, each with a written gate and a status note in its plan. Gate P2's speed target was missed and re-scoped in an ADR rather than waved through.
What is counted
feat, fix, perf, bench, docs releases and merges. wip commits, test-only commits and formatting are not listed.
Phases
Phase gates passed
Each phase ends with a gate written before the work starts. The date is the day the plan's status note was written.
| Phase | Closed | Scope |
|---|---|---|
P3b | 23 Oct 2026 | OLTP core: key seeks, extended protocol, UPDATE/DELETE, operator credential |
P3a | 23 Oct 2026 | SQL gateway and token identity; psql and pgx connect |
P3c | 22 Oct 2026 | Columnar collections; TPC-H gate met |
P2e | 21 Oct 2026 | Vectorized expressions and batch aggregation |
P2d | 21 Oct 2026 | Projected scans and typed decimals |
P2c | 21 Oct 2026 | Noninterference harness, 10⁷ differential plans, Lean proofs, TPC-H baseline |
P2b | 21 Oct 2026 | Catalog, vectorized executor, rule optimizer, verified queries in ufd |
P2a | 19 Oct 2026 | Ultra IR foundation: types, encoding, fingerprints, validator, verifier core, reference interpreter |
P1 | 19 Oct 2026 | Storage engine (pending a long soak and dedicated-host runs) |
P0 | 9 Oct 2026 | Foundations: simulator, fault-injecting disk, model-checked log, benchmark harness |
Commits
Changes by date
Newest first. The id is the short commit hash in the UltraFabric repository; the phase is the plan the change belongs to.
| Commit | Phase | Change |
|---|---|---|
b09a617 | P3b | Final-review fixes for P3b: UPDATE and DELETE may only write rows the requester read through the security chain; tenant tokens can no longer use the replace-style insert; binary numerics rounded once, binary infinities refused; caps on prepared statements and portals. |
ad6e278 | P3b | P3b recorded complete: OLTP bench (indicative), ADR-003/005 addenda, roadmap items P3d (transactions, ORMs) and P3e (parallel reads). |
d53e520 | P3b | Operator credential: node-wide requests need a token with uf_operator and no tenant; the Go and Rust token verifiers agree on a shared corpus of malformed and forged tokens. |
0c2d1ea | P3b | SQL UPDATE and DELETE run as verified plans applied atomically at the node (protocol requests 17 and 18). |
0b56385 | P3b | Extended query protocol in the gateway: prepared statements with typed $n parameters, portals, text and binary formats, catalog cached per session. Drivers connect in their default mode. |
208c8f1 | P3b | Differential run with key predicates: 1,000,000 generated plans, 0 failures. |
5f2f6bf | P3b | Primary-key seeks: scans read only the key ranges a filter implies. A point lookup through psql fell from 5.5 ms to 0.29 ms (later 0.143 ms with the extended protocol; indicative, shared host). |
c33bb02 | P3a | Final-review fixes for P3a: exponent literals keep their scale; float division, varchar(n), timestamp(p) and multi-statement writes are 0A000; PostgreSQL float text; login deadline, 16 KiB pre-login messages and a connection cap (53300). |
16c25d9 | P3a | Differential run after the gateway: 2,000,000 generated plans, 0 failures. |
24ce65d | P3a | P3a recorded complete: first SQL latency bench (indicative), roadmap updated. |
31b9b4c | P3a | Budget errors reach clients without byte counts, because the counts include other tenants' rows. Docs: SQL and psql page, protocol kinds 14–16 and codes 110–112. |
130a58c | P3a | End-to-end SQL over the gateway: SQL INSERT rejects existing keys (new node request InsertNew, SQLSTATE 23505) instead of replacing the row; numeric × integer keeps the numeric's scale; answers compared with DuckDB; psql smoke test. |
e89a959 | P3a | ufgw: the PostgreSQL wire protocol in front of ufd, a SQL subset bound to verified Ultra IR, token login. |
30cbe0c | P3a | Go node client, token verifier and SQL binder; the plans it builds are checked by the Rust validator and verifier. |
826a76f | P3a | The garbage-collection horizon follows a snapshot retention window (--snapshot-retention-secs, default 60). |
fc12452 | P3a | Token login at the node: the query environment is derived only from the verified token; catalog request; error codes 110–112. |
| Commit | Phase | Change |
|---|---|---|
44a9288 | P3a | Go port of the canonical encoding (UCE) for types, values and plans, byte-identical to Rust on cross-language test vectors. |
f5e4368 | P3a | ADR-005: SQL gateway and identity; the P3a plan. |
be964fb | P3c | P3c bench re-run at a clean commit with a same-day row-storage baseline; ranges corrected; site labelled indicative. |
a69b309 | P3c | Columnar fixes from the final review: compaction batches bounded by bytes, zone-map bounds only for short strings, header errors propagate, at most 65,534 columnar fields; compaction no longer retried on every insert. |
17e2daf | P3c | TPC-H SF 0.1 on columnar collections: Q1 0.31 s, Q6 0.074 s, answers equal to DuckDB (indicative, shared host). |
ca684d9 | P3c | Executor: digit counting by comparison, typed group-key bytes; uf-tpch advances the GC horizon after a columnar load. |
47d56fd | P3c | Markers of moved rows kept in their own subspace, so delta scans never walk them; uf-tpch --columnar. |
53c3e12 | P3c | Columnar collections over protocol v0; an existing key in an append-only collection is code 109. |
4349ee0 | P3c | Scans of columnar collections read only the chunks the plan needs. |
16cce4a | P3c | Columnar collections in the catalog: row groups, an append-only delta, atomic compaction. |
c170462 | P3c | Column chunk codec. |
ffe2eaa | P3c | Specification §5.7 columnar collections; the P3c plan. |
| Commit | Phase | Change |
|---|---|---|
009427b | P2e | P2e measured: TPC-H Q1 1.16 s, Q6 0.54 s at SF 0.1, answers unchanged (gate met; indicative). |
2ff38b4 | P2e | P2e mutation pass; ten-million-plan differential run, 0 failures. |
7c144c8 | P2e | Projection pruning above security chains (rewrite L11). |
8bbffa5 | P2e | Aggregation over typed batches; typed decimal arithmetic; borrowed columns and typed comparisons; typed gather and tenant isolation (commits 8a9b07d, 7f5eeb8, 6118a4c, 4d1ec75). |
4b99ee6 | P2d | Pruned columns charge only validity flags against the budget; docs state the scan figure is a one-column best case. |
1855540 | P2d | P2d scan path measured: the lineitem scan 5.1× faster, answers unchanged; ADR-004 accepted. |
d13707e | P2d | Scans decode only the columns a plan can observe; typed decimal columns; projected row decoding (commits 2837a9d, 96b6c9a). |
7631915 | P2c | Ten-million-plan differential re-run after review fixes, 0 failures; a panicking check now counts as a failure; noninterference also checks the optimized plan. |
6dd5e4e | P2c | P2c complete; Gate P2 report: correctness items pass, the TPC-H 3× target missed and re-scoped by ADR-004. |
2d70123 | P2c | 10,000,000 differential plans with noninterference checks, 0 failures. |
5ea32e3 | P2c | Rewrite laws L1–L8 and noninterference for the core security fragment mechanized in Lean 4. |
789f024 | P2c | ufdiff: parallel differential runner (executor, rewrites, encoding round trip, noninterference) and the nightly script. |
e9e99b8 | P2c | Decimal multiplication and AVG in the IR, reference interpreter and executor. |
54dd4a3 | P2c | Raw key-value requests can no longer reach collection rows (code 108); executed and fallback plans are always verified. |
7a815fa | P2c | Noninterference harness for the reference interpreter and the executor, with a planted leak it must detect. |
1d2fc2c | P2b | P2b merged: catalog, vectorized executor, rule optimizer, verified queries in ufd. |
bb4cfd7 | P2b | Scans charged against the budget as they stream; a work limit for joins that never match; optimizer size cap (final-review findings). |
4615c14 | P2b | Rewrite L7 no longer pushes atoms over float grouping keys (+0 and −0 share a group). |
e58c9b3 | P2b | Verified, optimized queries over stored collections in ufd (protocol kinds 11–13, codes 101–107). |
0a0bcc3 | P2b | Rewrite engine with L1–L8, L10–L13 and L15 behind a security barrier and a verifier gate; plan cache; 20,000-case rule differential. |
d1c0a3a | P2b | Canonicalization no longer reorders UNION inputs: a LIMIT above a UNION observes their order. |
5805ab8 | P2b | Fail-closed canonical plan decoder. |
0b09508 | P2b | Vectorized operators (hash join, hash aggregate, sort and top-k) with a per-query memory budget; 25,000 generated plans agree with the reference. |
3c08cda | P2b | Collections in a reserved keyspace, memcomparable row keys, row codec, tenant-prefix storage scans. |
69f25b6 | P2b | Verifier: joins of two different secured collections were wrongly rejected; obligations now combine per collection (found by the plan generator). |
eb03e45 | site | ultrafabric.dev live behind Cloudflare. |
| Commit | Phase | Change |
|---|---|---|
151c9ce | site | The site: landing page with the verifier plan panel, eight developer docs pages, updates and early access. |
| Commit | Phase | Change |
|---|---|---|
914bebb | P2a | P2a recorded complete: status, mutation results, specification amendments, P2b/P2c split. |
8e757c7 | P2a | Verifier: security typing per the specification, with reject and mutation corpora. |
8b395b8 | P2a | Reference interpreter with SQL NULL semantics, order-independent errors and security atoms decided first. |
bcafb09 | P2a | Canonicalization, UCE plan encoding and fingerprints; protoc decodes the canonical plan and re-encodes it byte-identically. |
72a9735 | P2a | Expressions, schemas, plans and a validator that recomputes every type; text form for plans with exact round-trip (commit 1584749). |
fe283e4 | P2a | Protobuf wire primitives and fail-closed canonical encoding (UCE v1) for types and values; IR types and values with normal forms and total orderings; in-tree BLAKE3 checked against the official vectors (commits b479bbc, 47e03d5). |
8260bf5 | P1 | Group commit: many batches share one fdatasync; ufd groups waiting writes. |
3d28c5b | P1 | Engine metrics and Prometheus exposition with per-operation latency in ufd. |
86bf0f1 | P1 | ufd: the daemon serving the engine over a Unix socket with a checksummed v0 protocol; ADR-003. |
92f0474 | P1 | Idempotent writes, recorded in a hidden keyspace atomically with the batch. |
75fc866 | P1 | Snapshot-isolation transactions (first committer wins) over any engine. |
2f98517 | P1 | Incremental compaction in bounded steps per write: worst write latency 371 ms → 23 ms (indicative). |
de1c61b | P1 | Slicing-by-8 CRC32C in safe code, checked against the bytewise reference. |
b00e98a | P1 | Scans decode entry by entry from cached raw blocks (fixes the YCSB-E regression). |
aa3ff9d | P1 | Bench re-run: memory and disk at or below RocksDB, point reads +81%. |
7a6ec7e | P1 | Table file format v2 with restart points and a raw-block cache; streaming compaction with bounded memory (commit b0ddcf7). |
6a41c81 | P1 | The write-ahead log rolls on flush so flushed segments are deleted (disk growth seen in benchmarks). |
| Commit | Phase | Change |
|---|---|---|
f7e95a0 | P1 | First indicative results against RocksDB, with analysis. |
a0ae43e | P1 | Lazy k-way merge for range scans: reads only the blocks needed. |
afb62e1 | P1 | kvbench: RocksDB oracle engine, three-way differential test and YCSB runner. |
bd8d5b8 | P1 | Memory governor: cgroup-aware budget and pressure ladder, with a hard memtable cap. |
70a6c30 | P1 | Block cache, two-level compaction and MVCC garbage collection with a durable GC horizon. |
3d510be | P1 | Real-file I/O backend (pread/pwrite, fdatasync, directory fsync). |
| Commit | Phase | Change |
|---|---|---|
de3dcf0 | P1 | Manifest, crash-safe flush protocol, WAL truncation and layered reads. |
0d8a36a | P1 | Table file format with checksummed blocks, Bloom filter, index and footer; writer, reader and memtable flush. |
5bd4ac8 | P1 | Engine seam, model-engine oracle, memtable and the first durable engine (WAL + memtable) with a key-value crash matrix. |
cbbd1ab | P1 | Segmented write-ahead log with group commit, crash recovery and poisoning; one-million-seed crash campaign. |
137e5dd | P0 | Benchmark harness: histograms, YCSB A–F mixes, Zipfian keys, JSON results. |
e978a75 | P0 | P0 specification amendments (v1.1) and the TLA+ write-ahead log model checked with TLC. |
dd401ae | P0 | Deterministic simulation kernel and fault-injecting simulated disk. |
Source: git log --format='%h %ad %s' in the repository and the status notes in docs/plans/. The updates page tells the same story in prose, with what was found while building each piece.
Want the diffs?
Early-access teams receive the benchmark scripts with the build, so the measurements behind these entries can be repeated on your hardware.