Skip to content

Graphus v0.0.2

Choose a tag to compare

View all tags
@FlavioCFOliveira FlavioCFOliveira released this 30 Jun 06:29
v0.0.2
68fe753

Graphus v0.0.2

Version: 0.0.2
Date: 2026-06-29
Tag: v0.0.2

Summary

Graphus v0.0.2 is a hardening, performance, and production-readiness release of
Graphus, the Label Property Graph (LPG) database server written in Rust for extreme
load and concurrency. It contains 156 changes since v0.0.1
(55 features, 47 fixes, 35 performance improvements, plus tests, refactors, and docs) and
introduces no breaking changes: the public Cypher, Bolt, and REST contracts are
unchanged, so v0.0.2 is a drop-in upgrade from v0.0.1.

The headline of this release is reliability and resource discipline under hostility.
Multiple empirical audit-and-remediation rounds — crash × fault × interleaving durability
audits and an extreme-concurrency, production-confidence security audit — closed every
reachable critical and high-severity issue and added a full denial-of-service (DoS)
resistance suite. In parallel, performance campaigns brought native columnar storage,
intra-query and off-thread parallelism, and broad CPU, RAM, and storage optimizations.

Throughout this work, the four inviolable guarantees held:

  • 100% ACID — full transactional reliability under power loss, faults, and crashes.
  • 100% openCypher TCK — 3914 / 3914 scenarios passing, zero failed, errored, or
    unsupported.
  • 100% Bolt protocol — byte-for-byte interoperability with the Neo4j driver ecosystem.
  • 100% PackStream — exact wire-level serialization.

Highlights

  • Denial-of-service resistance. A per-statement execution timeout, a per-transaction
    maximum-age cap, per-source-IP connection caps, pre-authentication deadlines, per-value
    memory budgets, a bounded query planner, and PackStream decode guards — closing CPU-bomb,
    memory-bomb, connection-flood, slow-loris, and stack-overflow vectors.
  • Durability hardening. The doublewrite buffer is wired into the production checkpoint
    and recovery paths, closing several committed-data-loss windows under crash combined with
    disk faults, validated deterministically by the DST simulator.
  • Native columnar storage. A dependency-light columnar codec, a .gcol bulk format, a
    vectorized columnar property store, zone-map data skipping, a Roaring-bitmap index, and an
    immutable cold tier for aged time-series.
  • Parallel query execution. Morsel-driven intra-query parallelism and off-thread
    concurrent reads, so a single heavy query and concurrent readers can use multiple cores.
  • Deterministic Simulation Testing (DST) maturation. First-class VOPR safety and
    liveness modes, a unified seeded fault scheduler, crash + ARIES interleaving, swarm
    testing, and a CI gate plus a nightly fuzz job.
  • Instrumented examples suite. Realistic end-to-end scenarios that each collect CPU,
    RAM, and storage evidence against committed baselines.
  • UDS on Apple Silicon. Unix-domain-socket peer-credential authentication now works on
    macOS/BSD (via getpeereid), not only Linux, so the IPC interface is usable on every
    Tier-1 target.

What changed

Reliability and durability

This release is anchored by repeated, empirical audit-and-remediation rounds focused on the
hardest regime for a database: crash, combined with disk and clock faults, combined with
concurrent interleavings.

  • Doublewrite durability. The doublewrite buffer is now wired into the production
    checkpoint and open paths, with disjoint checkpoint-batch and eviction regions, a
    per-eviction serialized stage → home-write → sync, a persisted checkpoint-floor LSN
    gate, a multi-slot eviction ring, WAL-before-data enforcement, and an orphan-page check on
    open. Together these closed several committed-data-loss windows under crash × disk-fault.
  • Recovery correctness. Committed nodes and self-loops are recovered after interleaved
    live-rollback plus crash-undo; ARIES double-crash defects (including transaction-id reuse
    across recovery) are fixed; a double-panic in recovery rollback is caught.
  • Transaction isolation. A concurrent NODE KEY duplicate commit is closed, dangling
    SSI read-write edges are scrubbed, abort state is released unconditionally so a panicking
    undo cannot leak a transaction, and a cross-type equality seek (1 = 1.0) no longer
    admits duplicates or misses the index.
  • Index correctness. MVCC-correct full-text and spatial indexed reads fix a
    cross-snapshot stale-read; geographic (WGS-84) spatial seeks decline to scan rather than
    return silent false negatives.
  • Server robustness. A panicking statement is isolated and can no longer brick the
    engine; the server tracks a per-engine degraded state with a clean startup and shutdown
    lifecycle.

Security and denial-of-service resistance

A production-confidence audit, conducted under extreme hostility and concurrency, added a
comprehensive suite of resource bounds. Each control ships with a safe default:

Control Default Vector closed
Per-statement execution timeout 2 minutes CPU-bomb queries
Per-transaction maximum-age cap 1 hour GC-watermark pinning
Per-source-IP connection cap + pre-auth deadline enabled Connection floods
Pre-authentication read deadline enabled Slow-loris clients
Per-value materialized-size budget enabled Single-value memory bombs
Bounded join-order planner greedy above 8 operands Plan-time blow-up
Bounded expression depth + larger engine stack enabled ~1 KB query process abort
PackStream struct-decode depth guard MAX_DECODE_DEPTH 64 Pre-auth stack overflow
PackStream decode-bomb preallocation ceiling 512 KiB Decode-bomb allocation
Incremental REST result egress enabled Remote out-of-memory

The per-value budget extends to list and string builtins and to list + concatenation,
map literals, and properties(). The audit also fixed a graph-scoped RBAC defect,
discovered through the security-multitenant example, where the REST interface false-denied
every per-tenant grant.

Performance

Performance campaigns spanned the query engine, the storage layer, and concurrency:

  • Query execution. Hash-bucket aggregation grouping removes an O(rows × groups) cliff;
    schema-shared positional rows and reduced hot-loop allocation cut per-row overhead; result
    cells are moved, not cloned, into Bolt and REST values; the planner reverses
    expand-direction by cost and filters relationship types by integer id.
  • Concurrency and scaling. A sharded RwLock device buffer pool serves concurrent
    cache-miss reads; a reverse SSI write-index makes record_read O(writers-of-key); the
    TimestampOracle releases timestamps in O(log N); the compute-thread budget is bounded;
    the RUN path reuses the plan cache.
  • Storage, I/O, and WAL. A page-batched scan primitive amortizes latching; write-back is
    coalesced with a copy-free pwritev fast path; WAL patches use inline buffers with
    borrowed redo; B+-tree validation is amortized per (page, LSN); a live-engine checkpoint
    trigger with memory-freeing log-sink reclaim bounds RAM and WAL growth.
  • Cryptography. Per-target AES/GHASH compilation seals WAL frames in place, and a
    buffered ChaCha20 CSPRNG nonce source eliminates a per-nonce getrandom syscall.
  • Graph Data Science. Betweenness and closeness centrality are parallelized across cores
    over a shared flat-CSR adjacency built once per sweep.

Native columnar storage

Graphus gains a native, dependency-light columnar subsystem for analytical workloads:

  • graphus-columnar, a native columnar codec foundation.
  • A .gcol bulk dump and import format.
  • A complementary columnar property store with vectorized aggregation.
  • A zone-map data-skipping sidecar for non-indexed scans.
  • A Roaring-bitmap secondary index for low-cardinality columns.
  • An immutable columnar cold tier for aged time-series data.
  • Internal-id-aligned numeric GDS node columns with zero-copy export.
  • A native columnar REST result channel for analytical queries.

Concurrency and parallelism

The read path was refactored to a &self, Send + Sync model over a shared buffer pool and
a metadata snapshot, unlocking two forms of parallelism:

  • Off-thread concurrent reads via a reader pool, so concurrent readers scale across
    cores.
  • Morsel-driven intra-query parallelism for grouped aggregation, for
    scan → filter → project with a stable ORDER BY/top-k, and for ExpandAll, so a single
    heavy query can use multiple cores.

The loom-validated concurrent buffer pool is now the production pool, and the SSI tracker is
concurrency-ready via per-reader deferred read buffers.

Deterministic Simulation Testing (DST)

The DST simulator matured into a first-class correctness engine:

  • First-class VOPR safety and liveness modes.
  • A deterministic cooperative interleaver over overlapping explicit transactions.
  • A unified, seeded fault scheduler covering disk faults (bit-rot, misdirected I/O, latent
    sectors, ENOSPC, write reordering, sector-granular torn writes), clock faults, and
    transport faults.
  • Crash plus ARIES restart woven into the running interleave, with an acked-versus-in-flight
    crash-split oracle and a cell-by-cell reference-model oracle.
  • Swarm testing, failing-seed minimization with replayable artifacts, and a continuous,
    time-budgeted, multi-core fuzzer.
  • A pull-request CI gate (safety, liveness, and determinism sweeps) and a nightly swarmed
    fuzz job with artifact upload.

Examples suite

A new examples/* suite provides realistic, end-to-end demonstrations, each instrumented to
collect CPU, RAM, and storage evidence against a committed baseline:

  • social-network-uds and social-network-large (1M-user target).
  • fraud-oltp (extreme-concurrency SSI detection).
  • gds-analytics (full gds.* algorithm workload with exact ground truth).
  • bulk-etl (LDBC-SNB-like CSV generation with a lossless round-trip).
  • durability-crash-recovery (DST-driven crash and ARIES replay).
  • knowledge-graph-rest (REST discovery workload with content negotiation).
  • security-multitenant (encrypted multi-tenant datasets with an RBAC allow/deny matrix).
  • iot-timeseries (sustained ingest and retention churn with a storage-reclamation proof).

Upgrade notes

  • Drop-in upgrade. No public Cypher, Bolt, or REST contract changed. Upgrading from
    v0.0.1 to v0.0.2 requires no query, driver, or schema changes.
  • New safe defaults. The DoS-resistance controls listed above ship enabled with
    conservative defaults (for example, a 2-minute per-statement timeout and a 1-hour
    per-transaction cap). Long-running analytical statements or transactions may need these
    limits raised; tune them in the server configuration.
  • PackStream depth. The PackStream struct-decode depth guard now defaults to 64, which
    is far beyond any legitimate query but rejects pathologically nested structures. No
    conforming Neo4j-ecosystem driver is affected.
  • Container image. The multi-architecture image (linux/amd64, linux/arm64) is rebuilt
    and published to the GitHub Container Registry (GHCR) automatically on the v0.0.2 tag.

Verification evidence

The following gate was run against the v0.0.2 source tree on Linux (x86_64, Rust toolchain
pinned via rust-toolchain.toml, edition 2024, MSRV 1.85):

Gate Command Result
Build cargo build --all-targets Passed — workspace and all targets compiled.

This build is the final release sanity check on top of a green certification gate completed
immediately before tagging, in which the workspace was verified end to end:

  • Format — cargo fmt --all -- --check clean.
  • Lint — cargo clippy --all-features clean.
  • Tests — the Cypher, server, REST, and DST suites green.
  • openCypher TCK — 3914 / 3914 scenarios passing, with zero failed, errored, or
    unsupported (asserted by an explicit shape gate, not merely a pass floor).

The four inviolable pillars (100% ACID, 100% openCypher TCK, 100% Bolt, 100% PackStream)
were upheld throughout. DST safety, liveness, and determinism sweeps gate every pull request,
crash-recovery soaks are wired into CI, and each example in examples/* emits measured CPU,
RAM, and storage evidence against a committed baseline.

Compatibility

  • Operating systems: Linux, macOS, and Raspberry Pi OS.
  • Architectures: x86_64 / amd64 and aarch64 / arm64 (Apple Silicon and
    Raspberry Pi 5+ included).
  • Drivers: Neo4j-ecosystem drivers via Bolt 5.x (bolt://, bolt+s://, bolt+ssc://).

Links

Assets 2
Loading