status.json

{
  "updated": "2026-10-25",
  "product": "KeyLoad development preview. Not production ready.",
  "concept": "Orleans owns all clustering and activation scaling. The API reaches one grain per connected client, logical database/partition grains, storage owners and bounded result aggregation. Shared volumes require one open owner per physical partition without copies; isolated volumes use typed Orleans calls between owners. Shared-volume ownership and distributed partition-query execution are not yet qualified.",
  "qualification": {
    "build": "open: the complete local Debug solution builds with warnings treated as errors (zero warnings and errors), and dotnet format verification passes after Core operation extraction and test policy cleanup. The analyzer suite passes all 397 local cases. Exact delivered-source Linux qualification remains required",
    "unitTests": "open: the complete unit execution remains incomplete. On 2026-10-23 the OrleansExecution (200), StorageRecovery (239), RelationalStorage (27) and analyzer (460) suites pass locally with --maximum-parallel-tests 4; 103 cases (61 in 25 classes, mostly Messaging queue capacity, Model head authority and Subscription flows, plus 42 store-image oracles that predate the system/last-command row) fail identically on the 2026-10-22 baseline and need their own repair. The 2026-10-24 Linux run with unlimited parallelism failed 234 of 3718 cases, about 105 of them load cancellations, and stopped before the recovery and Aspire suites; the workflow now bounds unit parallelism to the runner's processors and runs every suite after a failing one.",
    "processRecoveryTests": "open: the last completed local Debug run passed all 215 discovered process-recovery cases, including analytics shutdown and cold-process checksum refusal followed by repair and healthy replay; the current build-policy cleanup and exact delivered-source Linux qualification remain required",
    "aspireClusterSdkMcpTests": "open: local Debug startup repair passed 27 focused AppHost controls, the original cold-bootstrap CLI/SDK scenario and an official MCP capabilities/execution-ID scenario on real three-process clusters, with joined cleanup. The previously recorded five public partition-query SDK/MCP cases passed locally in each configured three-silo SharedVolume and IsolatedVolumes run. Complete exact-source Linux cluster and fault/endurance qualification remains required",
    "coverage": "open: original Linux analyzer measurements exist; current source mapping and required numeric gates are not qualified. Functional coverage remains open.",
    "adminConsole": "open: Blazor Server and Fluent UI components replace the static JavaScript application; Playwright replaces the custom CDP client. Focused browser, complete suite and exact-source Linux qualification must be recorded separately.",
    "performance": "No published claim without authenticated GitHub Benchmarks evidence. The 2026-10-24 Benchmarks run measured PostgreSQL, Redis (1 node), Qdrant, RabbitMQ, KurrentDB, HelixDB and SurrealDB (3 nodes) workloads but published nothing: the finalize validator, KeyLoad process-identity verification, the Neo4j session id, the Redis replica oracle, the SurrealDB volume and the runner kernel each rejected or stopped cells. The repairs are in source and await the next Linux run; the heavy-load ingestion gate has not passed on a hosted runner. The benchmark source now selects TimescaleDB, SQL Server, MySQL, ClickHouse and InfluxDB as well (16 systems, 32 topology rows). The complete local Debug solution build and formatter verification pass. Native one-node correctness tests pass locally through real Aspire containers for TimescaleDB, MySQL, ClickHouse and InfluxDB; SQL Server awaits Linux x86-64 execution. Million-record Linux qualification remains open; the added three-node deployments are unavailable and no new performance figures are qualified.",
    "powerLossDurability": "Not proven; process-kill tests do not prove it.",
    "endurance": "open",
    "sharedVolumeStorage": "open: lazy single-owner sessions are in source; execution runtime, owner loss/reopen and deployed filesystem locking/flush qualification remain required",
    "distributedPartitionQueries": "open: execution logical-partition dispatch is in source; exact owner, budget, authorization and aggregation behavior requires runtime and delivered-source qualification",
    "operationLimits": "open: the removal of the configured operation limits (ADR-149) is in source; only focused local unit tests have run. Tests that asserted removed refusals, the complete unit, process recovery and Aspire cluster suites, and delivered-source Linux qualification remain required.",
    "fileStorage": "open: published ManagedCode.Storage.Server/FileSystem 10.1.5 are composed with metadata-only ZoneTree publication, persisted scope/row authorization, quotas, verified reads and bounded cleanup. Complete Debug solution build and nine focused file tests pass, including native MVC route discovery. Real HTTP acceptance is blocked during startup by TextEnvelopeCodec receipt decoding; physical restore, cancellation/endurance and shared-provider cluster qualification remain open."
  },
  "evidence": "Qualification evidence lives only in GitHub Actions runs and their original artifacts for the exact delivered source.",
  "implementation": "Orleans-execution runtime integration is in progress. The commit grain caches copy owners per membership version instead of reading every silo per write; the ZoneTree engine runs without its own WAL because commands.wal is the only redo log; the SQL gateway lowers SELECT once to the typed plan and the SDK carries no parser; stateless background workers sweep persisted work with one polling activation per silo and no in-memory buffer; internal grain requests are typed Orleans envelopes validated by scope on every receiving grain, with no per-hop string token or HMAC (ADR-144); a store commit holds the exclusive gate only while applying, so readers no longer wait for the journal fsync; key encoding takes typed components without boxing; the comparison harness has no warm-up phase anywhere. Request handling imposes no concurrency, request-count or reserved-byte admission on callers (ADR-145): the HTTP, command and MCP memory admission pools, the per-connection, per-silo producer and connection caps, the ANN reader caps, the per-engine analytical-read cap, the change-outbox producer quota and progress reserve, and the full-text reader and maintenance-session count caps are gone; only the server-wide request-body limit and the physical reply and protocol bounds remain, and the KeyLoad benchmark cells no longer carry an admission profile. Operations have no configured size or work limits (ADR-149): KeyLoad:DatabaseLimits keeps only the optional queue transfer attempt policies; document size, JSON depth, batch, scan, result, SQL text/depth/token, read-byte, search-token, projection and fixed-deadline refusals are gone; reads account work and stop only on caller cancellation and explicit expiries, complete ranges page through the storage range page, recursive SQL, AST and JSON walkers fail with Validation only when the execution stack runs short, and result bytes are bounded by the grain reply ceilings and the optional QueryExecutionOptions.MaximumResultBytes. Concurrent canonical commands commit in batches (ADR-146): the reentrant commit grain queues them, every copy applies a batch as one ZoneTree commit with one journal flush and parallel copy calls, each command keeps its own canonical sequence and outcome, and a copy that missed the last batch is completed from its retained commands; the engine and store contracts have unit tests, while cluster throughput and fault qualification of the batch path remain open. Queries ordered by ascending document id continue after the last emitted id instead of an offset (ADR-147): a full scan seeks past that id and stops one row past the page, so reading a collection page by page reads each document once, and no query range read asks storage for more than its per-range maximum. Build and Tests runs as parallel jobs (ADR-148): one solution build gate, four unit shards, analyzers with process recovery, and twelve Aspire shards of two serial lanes each with at most one cluster per lane, all from scripts/Features/TestInfrastructure/ci-test-shards.json; a final job checks that every test class ran exactly once, and Release runs this workflow before publishing; its first real CI run is pending. IsolatedVolumes uses silo-local full copies; SharedVolume acquires one physical session through an ordinary database activation and joins its borrowers before close. PartitionQuery and DistributedSearch dispatch bounded leaves through ordinary Orleans partition grains and pin one actual owner per logical partition. Workers and durable coordinators use typed owner reads. Complete runtime and delivered-source qualification is open."
}