Status and Roadmap
No capability moves from limited to verified because its code exists. It moves when reproducible evidence from the environment the claim implies says so.
Decentralized.Host M1–M8 is implemented and verified on one macOS machine (record REF-MAC-A03, PASS). It is not yet a production release: the next gate is PV-1, reproducing that result on independent Linux machines, then across a LAN, under real failures, and over WAN and NAT.
Where it is
- M1–M8 implementation · done→
- Production validation (PV-1, P0) · now→
- Release candidate→
- Externally reproduced evidence→
- Production release
Every validation attempt
evidence/INDEX.mdFailed and infrastructure-failed attempts stay on the record next to the ones that superseded them.
| Record | Environment | Source | Outcome | Signature | Notes |
|---|---|---|---|---|---|
| PV1-S1-A01 | Colima VM on macOS | b3:5bde0c09… (digest/0) | INFRA FAILURE | no record | The VM stopped before anything ran. Says nothing about the software. |
| PV1-S1-A02 | Linux container in a 2-vCPU Colima VM | b3:5bde0c09… (digest/0) | FAIL | VERIFIED | Diagnostic only. Found product defects D1 (an edge refused its own replica) and D2 (rolling updates dropped requests); both reproduced on macOS and were fixed with regression tests. |
| REF-MAC-A01 | macOS reference (Mac mini, i5-8500B, 8 GB) | b3:73d7ee46… (digest/1) | PASS | VERIFIED | All 13 steps passed, but digest/1 left pkg/evidence out of the source identity. Superseded. |
| REF-MAC-A02 | macOS reference, same machine | b3:2832989a… (digest/2) | FAIL | VERIFIED | A test race in the dead-holder regression test, and an M2 read timeout that refuted the first diagnosis of D4. |
| REF-MAC-A03 | macOS reference, same machine | b3:2a23e1da… (digest/2) | PASS | VERIFIED | Current baseline. All 13 steps on the first attempt: 10/10 integration, 17/17 chaos with no skips, gossip join 20/20, conformance including Python, scripted TLS install. |
| PV1-S1-A03 | independent Linux VM (≥ 4 vCPU, 8 GB) | must be b3:2a23e1da… | PENDING | — | The first authoritative Linux run. An offline kit for Linux amd64 is published on the pv1-offline-kit branch. |
The baseline: REF-MAC-A03
macOS reference environment: the development Mac mini (Intel i5-8500B, 6 cores, 8 GB, APFS), multi-process over loopback; Docker via Colima for the oom and postgres scenarios.
- ✓build2s
- ✓vet1s
- ✓gofmt0s
- ✓unit tests with -race13s
- ✓gossip join × 2013s
- ✓tools (Pebble)2s
- ✓conformance drift check0s
- ✓conformance — Go in process0s
- ✓conformance — Go over stdio0s
- ✓conformance — independent Python3s
- ✓integration (M1–M7 + regressions)223s
- ✓chaos (17 scenarios)397s
- ✓scripted TLS install runbook10s
Excluded from this record: multi-machine behaviour (single machine, loopback transport); public ACME (Pebble only).
release ref-mac-a03 · source b3:2a23e1da…Defects found by validation
Each fixed defect has a regression test that fails without the fix.
- D1An edge host could not route to a replica it ran itself.fixed; tests/integration/edge_self_test.go
- D2Rolling updates dropped requests (stop-before-start).fixed with make-before-break; tests/integration/rollout_test.go
- D3A rescheduled replica could wait minutes on a dead artifact holder.fixed with failed-holder backoff; fetch_dead_holder_test.go
- D4The D2 fallback could send a request to a dead host and hang it.fixed: draining endpoints need proof of life within 3 s; pkg/edge/pick_test.go
- D5A revoking member kept the revoked host as a mesh peer for up to 2 s.fixed: committed changes refresh the member's mesh at once; M3
- M1"host-mode offline-hold" ledger entry missing after an outage (2 of 3 runs on 2026-09-24).OPEN — not reproduced since; cause not established; diagnostics added
PV-1: real infrastructure, in order
Each stage must pass before the next starts. WAN comes last. The development Mac is the reference only; it promotes nothing.
moving from macOS to Linux changes no protocol or runtime behaviour
identity, TLS bootstrap, WireGuard, gossip, storage replication, edge routing, failover — across real machine boundaries
power-off, NIC down, real firewall partitions, disk-full on a real filesystem, latency, loss, reordering
mesh through NAT, edge over WAN, failover under WAN latency
P0: required for a release candidate
P1: planned capability
- › containerd runtime; gVisor and Firecracker behind the runtime interface
- › Erasure-coded volumes
- › HTTP/3 at the edge
- › Conformance vectors for manifests, admission, bundles and mesh bindings
- › did:dh owner identities validated in manifests
- › Opt-in, self-hosted metrics export (never telemetry)
- › Console TLS trust UX and finer-grained operator roles
Measured so far
One development machine, loopback. Indicative, not benchmarks.
- Control-plane failover1.2–2.2 s to a new leaderM5 test and chaos leader-crash (several runs)
- Requests failed during leader loss0 of 204–240edge traffic every 20 ms during failover
- Userspace WireGuard throughput~73 MiB/spkg/mesh benchmark, loopback
- Mesh RTT~1–2 mshost-measured HTTP round trips over WireGuard
- Artifact fetch (9 MiB, 125 chunks)~45 mshost journal artifact-verified timing
- Anti-entropy repair (26–28 objects)~3.7–4.0 schaos storage-replica-loss
- Conformance run (136 vectors)~60 ms in processdh-conformance
NOT MEASURED: scheduling rate, storage IOPS, replication throughput, agent CPU and memory overhead, edge requests per second, any multi-machine latency.