ChaosSQL v1.6.0 — Reliable Cloud Ingestion, Multi-Tenant Control Plane & Managed Deployment

Release Date: September 23, 2026
Tag: v1.6.0
Theme: Reliable ChaosSQL Cloud ingestion, multi-tenant control plane, and managed deployment

---

Summary

v1.6.0 makes ChaosSQL Cloud dependable enough for early adopters. Ingestion is
now transactional and idempotent, baselines compare real commits with a stable
scenario fingerprint, hosted payloads carry metadata only, and one server can
host several isolated organizations. A managed deployment with continuous
backups and a tested restore procedure is included.

The full list of changes is in CHANGELOG.md.

Highlights

• Reliable ingestion. Run, findings, baseline decision, stored response,
  and webhook outbox commit together. Each execution has its own idempotency
  key: identical retries return the original response and conflicting content
  returns 409.
• Trustworthy regression detection. Baselines use the real commit time of
  the SHA and a fingerprint computed locally from the scenario semantics
  (not the PRNG seed). Different fingerprints are never compared.
• Privacy by construction. The client uploads metadata only: no SQL,
  parameter values, schema, table names, traces, or reproduction code.
• Multi-tenant control plane. chaossql server org create|list|set-plan
  provisions isolated organizations with a one-time owner token.
• Plan retention (opt-in) deletes history outside each plan's window while
  keeping baseline runs and pending alerts.
• Managed deployment. deploy/fly/ and docs/managed-deployment.md:
  API and dashboard on one origin, Litestream replication, automatic restore on
  an empty volume, and a restore drill that never writes to the backup.
• GitHub Action. Inputs are passed through environment variables, and the
  step exposes cloud-run-id, cloud-run-url, and is-regression.

Upgrade notes

• Database migrations run automatically on the first start of
  chaossql server or chaossql-server. Back up the SQLite file first (see
  docs/self-hosted.md). Commit times recorded by older versions were upload
  times; the migration clears them so new baselines are not blocked.
• server create-token requires an existing organization. A mistyped
  --org now fails instead of creating a tenant. Use server org create to add
  organizations.
• Retention is off by default. Enable it with --enforce-retention only
  after taking a backup; deletion is permanent.
• Run links changed from /#/dashboard?run=<id> to /dashboard?run=<id>.
  Old links still work: the site migrates hash URLs on load.
• Action pin: update workflows to bregaldahq/chaossql@v1.6.0.
• Container images: no image is published to a registry for this release.
  The Helm chart's default ghcr.io/bregaldahq/chaossql-server:1.6.0 must be
  built and pushed by the operator, or overridden with image.repository and
  image.tag.

Verification

make verify (harness, lint, race-enabled tests, WASM, frontend, and language
checks) passes on the release commit. The managed image was verified end to end
against disposable object storage: startup guard without backups, same-origin
dashboard, tenant provisioning, restore drill, and restore onto an empty volume.

ChaosSQL v1.5.0 — ChaosSQL Cloud, Real-Time Regression Engine, PR Bot & Concurrency Health Dashboard

What's New in ChaosSQL v1.5.0

☁️ ChaosSQL Cloud Control Plane (chaossql-server)

• Pure-Go SQLite Persistence (Zero CGO):
  • Database store powered by modernc.org/sqlite with zero external dependencies.
  • Automated migrations for organizations, api_tokens (with salted SHA-256 tokens), repositories, scenarios, runs, findings, and baselines.
• Continuous Concurrency Regression Engine:
  • Automatically establishes verified baselines on the repository default branch (main).
  • Evaluates Pull Request runs against baseline: if baseline was PASS and PR is FAIL, immediately flags Concurrency Regression (is_regression: true).
• REST Control Plane Handlers:
  • POST /v1/runs: Authenticated execution ingestion with payload sanitization and regression evaluation.
  • GET /v1/runs/{id}: Detailed finding inspection with causal traces and reproduction artifacts.
  • GET /v1/organizations/{id}/subscription: Real-time subscription tier and repository limit inspection.
  • GET /v1/health: Operational monitoring endpoint.
• Standalone Control Plane Binary (cmd/chaossql-server):
  • chaossql-server start --port 8080 --db chaossql-cloud.db with graceful OS signal shutdown.
  • chaossql-server create-token --org <id> --name <name> for instant token provisioning.

---

🤖 Pull Request Experience & GitHub Action Comment Bot

• High-Impact Markdown Summary Generator:
  • Formats GitHub Action and Pull Request reports matching Section 7 of the 90-Day SaaS Plan:
    • Concurrency Regression Header Banner (Red Alert 🚨 or Green Seal ✅).
    • Comparative baseline table (main vs PR).
    • Failing invariant box (Assertion vs Actual).
    • Minimal causal trace with worker thread steps (T1 vs T2).
    • 1-click links to Cloud and CLI local reproduction command.
• Native CI Dispatch:
  • Writes directly to $GITHUB_STEP_SUMMARY.
  • Posts automated PR comments via GitHub REST API using GITHUB_TOKEN.
  • New CLI flags: --cloud-token, --cloud-url, --cloud-fail-fast, --github-token, --pr-comment.
  • Updated action.yml with native inputs: cloud-token, cloud-url, cloud-fail-fast, github-token, post-pr-comment.

---

📊 Concurrency Health Dashboard MVP (#/dashboard)

• Concurrency Health Score (98.7%):
  • Central operational health gauge with 30-day telemetry (Runs: 184, Schedules: 284,128, Regressions: 3 caught, 2 resolved, 1 open).
• Recent Runs Observation Table:
  • Full execution history across repositories, branches, and PRs with anomaly tags (P4 Lost Update, Deadlock Cycle, Write Skew A5A).
• Interactive Filters & Search:
  • Instant filtering by All Runs, Regressions Only 🚨, Pull Requests, and Passed.
• Finding Detail Inspector (Section 16 of 90-Day Plan):
  • Step-by-step causal trace visualization.
  • Invariant assertion vs actual database state comparison.
  • Standalone Go test reproducer preview with 1-click Copy Go and Download repro_test.go.
  • Open in WASM Playground ↗ jumping directly into the interactive browser fuzzer.

---

💎 Repository-Based Pricing & Concurrency Safety Audit Pack (#/pricing)

• Repository-Based Billing (Zero Per-Seat Fees):
  • Open Source ($0), Cloud Developer ($0/mo, 1 private repo), Cloud Team ($39/mo, 10 private repos, regression gating), Cloud Pro ($99/mo, 30 private repos, scheduled fuzzing).
  • Annual billing toggle with 20% savings.
• Flagship Concurrency Safety Audit Package ($1,490 one-time):
  • 1-week deep-dive concurrency analysis by database experts on critical transactional workflows.
  • Full Hermitage isolation diagnosis, synthesized minimal Go reproducers, and surgical SQL mitigations (SELECT FOR UPDATE, row locks).
  • Interactive onboarding and lead capture modal with dual persistence (localStorage + webhook).

ChaosSQL v1.4.0 — Layer-7 Transparent Reverse Proxy, Shadow DSG & Multi-Engine Differential Swarm

What's New in ChaosSQL v1.4.0

🔌 Layer-7 Transparent Database Reverse Proxy (chaossql proxy)

• Zero-Code Application Interception: Test real production applications, services, and ORMs (Prisma, GORM, Hibernate, pgx) against isolation defects without changing a single line of backend application code.
• Pure-Go Wire Protocol Streaming (Zero CGO):
  • Streaming decoder for PostgreSQL Wire Protocol 3.0 with SSLRequest negotiation, Simple Query ('Q'), Extended Query Parse ('P'), CommandComplete ('C'), and ReadyForQuery ('Z').
  • Binary command decoder for MySQL Client/Server Protocol with 4-byte framing, COM_QUERY, COM_STMT_PREPARE, COM_STMT_EXECUTE, OK_Packet, and ERR_Packet (deadlock 1213 handling).
• Stochastic PCT Micro-Jitter & Commit Barrier Injection:
  • Deterministic microsecond socket delay perturbation (\mu\text{s}$ to \text{ms}$) with PRNG seed reproducibility (--seed).
  • Stalls transaction execution right before the COMMIT packet reaches the upstream server, widening race windows across concurrent transactions.
• Online Shadow Dependency Serialization Graph (Shadow DSG):
  • Tracks active concurrent transactions, table/row key access sets ( able:pk), and constructs real-time , ww, rw$ dependency edges.
  • Detects directed cycles on the fly and classifies isolation anomalies according to formal Adya / Berenson criteria:
    • $ (Lost Update): Concurrent read-modify-write overwrites on identical rows.
    • $ (Write Skew): Concurrent transactions making interdependent decisions across different rows.
    • $ (Dirty Read): Read dependencies on uncommitted or rolled-back values.
    • $ (Anti-Dependency Cycles): Generalized multi-transaction serialization cycles.
• OASIS SARIF 2.1.0 & Diagnostic Web Dashboard:
  • Emits OASIS SARIF 2.1.0 reports (--export-sarif) compatible with GitHub Security & Code Scanning.
  • Built-in real-time HTTP diagnostic server (--ui-port) exposing /api/status, /api/anomalies, /api/sarif, and /api/trace.
  • Lipgloss terminal status table summarizing connections, latency percentiles, and detected anomalies upon graceful SIGINT/SIGTERM shutdown.

---

🌪️ Autonomous Multi-Engine Differential Swarm & Adversarial Mutations

• Multi-Engine Differential Swarm (chaossql swarm):
  • Concurrently runs test suites across SQLite, PostgreSQL, and MySQL using bounded worker pools.
  • Automatically identifies cross-engine isolation discrepancies and serialization failures.
  • Generates GitHub Flavored Markdown (GFM) step summaries for automated CI/CD and pull request quality gates.
• Stochastic DSL Scenario Mutator (chaossql mutate):
  • Injects adversarial AST and schedule mutations into chaos.yaml specifications.
  • Operators: Micro-Jitter Delay (InterleaveDelayMutation), Nested LIFO Savepoint Rollback (SavepointRollbackMutation), Causal DAG Topological Step Shuffle (StepShuffleMutation), and Lock Acquisition Inversion (LockOrderInversionMutation).

---

⚡ Client-Side WebAssembly & Web Worker Stress Engine

• Headless WebAssembly & Web Worker stress harness executing 100 consecutive scenario runs.
• Invariant verification for bounded memory ($\le 32\text{MB}$ WASM linear memory delta, $< 100\text{MB}$ process RSS) and 60 FPS non-blocking SVG layout latency ($< 16.6\text{ms}$).

---

📚 Comprehensive Documentation & Specifications

• Added formal capability specification specs/16_transparent_database_proxy.md.
• Added comprehensive changelog CHANGELOG.md.
• Updated README.md with proxy architecture, CLI command references, and operational flags.

ChaosSQL v1.3.0 — In-Browser WebAssembly Studio & Client-Side Verification Engine

ChaosSQL v1.3.0 Release Notes

Release Date: September 5, 2026
Tag: v1.3.0
Theme: In-Browser WebAssembly Studio & Client-Side Verification Engine

---

Executive Summary

ChaosSQL v1.3.0 marks a major milestone in database concurrency research and developer accessibility. Prior to v1.3.0, evaluating transaction isolation levels, detecting Adya anomalies ($G0$, $A3$, $A5A$, $A5B$, $G1a$, $G1c$, $G2$, $G\text{-DL}$), and synthesizing 1-minimal causal counterexamples required local Go CLI or Docker installations.

With v1.3.0, the core ChaosSQL engine—including the deterministic PRNG fuzzer, micro-jitter scheduler, Adya Direct Serialization Graph (DSG) cycle classifier, Elle-style register linearizability checker, and Zeller causal delta-debugging ($ddmin$) shrinker—is compiled directly to WebAssembly (GOOS=js GOARCH=wasm). The entire formal verification engine executes 100% client-side inside browser Web Workers, enabling instant, zero-install interactive experimentation with complete data privacy and zero server-side state.

---

Key Highlights & Capabilities

1. In-Browser WebAssembly Engine (site/assets/chaossql.wasm)

• Zero-CGO Pure-Go Compilation: Compiled with -ldflags="-s -w -X main.version=1.3.0" -trimpath into a static WebAssembly binary under 8MB uncompressed (< 2.2MB gzipped / brotli).
• Virtual SQL Driver Bridge: Operates via an isolated in-memory SQL virtual engine and driver bridge, decoupling transactional execution from host OS operating system primitives.
• Identical Formal Guarantees: Retains the exact same mathematical properties, cycle classification algorithms, and $ddmin$ 1-minimality proofs as the native CLI.

2. Dedicated Web Worker RPC Protocol (site/assets/wasm-worker.js)

• Non-Blocking 60 FPS Execution: Heavy CPU execution, graph cycle traversals, and $ddmin$ reduction loops are isolated within a dedicated Web Worker, guaranteeing the browser main UI thread never drops frames.
• Asynchronous Event Protocol:
  • INIT: Loads wasm_exec.js and instantiates chaossql.wasm.
  • VALIDATE: Performs AST syntax and schema validation on YAML scenarios.
  • RUN: Dispatches concurrent transactions and streams real-time progress events (PROGRESS, CYCLE_DETECTED, SHRINK_PROGRESS, COMPLETE).
  • CANCEL: Aborts running schedule instantaneously via Go context.WithCancel.

3. Interactive Web Playground Studio (site/#/playground)

• 10 Canonical Preset Scenarios: 1-click loading of all flagship test cases:
  1. Fintech Lost Update ($P4$)
  2. E-Commerce Inventory Oversell ($A3$)
  3. Hospital Write Skew ($A5B$)
  4. Financial Audit Read Skew ($A5A$)
  5. Auction Bidding Dirty Write ($G0$)
  6. Crypto Arbitrage Circular Information ($G1c$)
  7. Flash Crash Liquidation Dirty Read ($G1a$)
  8. Ticket Seat Reservation Anti-Dependency ($G2$)
  9. Deadlock Cycle & Timeout Diagnostics
  10. Foreign Key Cascade Deadlock & Lock Hierarchy Inversion ($G\text{-DL}$)
• Live YAML Scenario Editor: Syntax-highlighted YAML editor with real-time validation and reactive error markers.
• Interactive Runtime Controls: Interactive sliders for worker concurrency (1–8), test iterations (5–50), micro-jitter perturbation (0–50ms), and deterministic PRNG seed.
• Dynamic Adya Conflict Graph: Responsive SVG visualization rendering transactions as nodes ($T_1, T_2, ...$) and directed conflict dependencies ($ww, wr, rw$) with pulsing anomaly cycle animations.
• Microsecond Gantt Swimlane: Interactive timeline illustrating worker goroutine interleavings and statement execution intervals.
• Causal Delta-Debugging Inspector: Visual side-by-side comparison showing original schedule vs the 1-minimal causal reproduction schedule.

4. Dynamic Bilingual Localization (PT / EN)

• Seamless Real-Time Language Switcher: Full bilingual toggle (PT / EN) in the portal header.
• Dynamic Trace Localization: Execution traces, status badges (executing, violated, serializable, retrying), timeline swimlane markers, and interactive console logs translate dynamically in real time without reloading the application.
• Automated i18n Symmetry Gate: Guarded by tools/audit_i18n.js and tools/test_playground_ui.js Suite 6 (100% translation key parity).

5. Performance Telemetry & Bounded Resource Guarantees

• Frame Budget Compliance: Adya graph SVG layout generation achieves average latency < 0.1ms (P95 < 0.2ms), well within the 16.66ms frame budget required for 60 FPS.
• Memory Bounds: Continuous 100-iteration stress testing (tools/headless_worker_stress.js and site/assets/wasm-bench.js) verifies V8 heap growth < 15MB and WebAssembly linear memory stability (< 32MB growth).

6. Automated Quality & Security Verification Gates

• Automated English Purity Gate (tools/test_english_purity.js): Permanently ensures that 100% of the repository outside the bilingual site/ portal remains in English.
• DOM Structural Integrity Suite (tools/test_playground_ui.js): Formally asserts that all portal view containers are properly closed first-level siblings under <main>, preventing display occlusion regressions.
• Harness Verification (tools/harness_check.go): Validates the presence and integrity of all system specifications, ADRs, evals, and tools.

---

Technical Specifications & Cross-References

Area	Documentation / Spec Link
Formal Specification	specs/14_wasm_in_browser_playground.md
Academic Foundations	docs/ACADEMIC_FOUNDATIONS.md
Web Worker Implementation	site/assets/wasm-worker.js
WebAssembly Bridge Entrypoint	cmd/chaossql-wasm/main.go
Headless Stress Harness	tools/headless_worker_stress.js
Bilingual UI Test Suite	tools/test_playground_ui.js

---

Upgrade & Compatibility Notes

• Zero Breaking Changes: Fully backwards-compatible with all YAML scenarios and CLI configurations from ChaosSQL v1.0, v1.1, and v1.2.
• Browser Compatibility: Compatible with all modern evergreen browsers supporting WebAssembly and Web Workers (Chrome 80+, Firefox 78+, Safari 14.1+, Edge 80+).
• Offline / Air-Gapped Ready: The compiled WebAssembly bundle and portal assets operate 100% offline once cached by the browser service worker.

ChaosSQL v1.2.0 — Bilingual Docs Hub, Trace Visualizer & OASIS SARIF 2.1.0

What's New in ChaosSQL v1.2.0

🌐 Bilingual Documentation Hub (chaossql.bregalda.com)

• Segmented Pill Switcher [ PT | EN ]: Seamless instant switching between Portuguese and English across 100% of the portal without page reloads.
• 8 Comprehensive Technical Chapters: Quickstart Guide, chaos.yaml DSL specification, complete CLI reference (9 subcommands, 12 flags), Trace Visualizer, CI/CD SARIF 2.1.0 & GitHub Actions, Database Drivers (Pure Go SQLite, PostgreSQL pgx, MySQL), Go SDK (pkg/chaostest), and Formal Concurrency Theory.
• Hermitage Isolation Matrix: Empirical isolation anomaly matrix across SQLite, PostgreSQL, and MySQL.

🖥️ Interactive Trace Visualizer (chaossql ui)

• Embedded microsecond-resolution Gantt swimlane inspector for concurrent workers.
• Interactive SVG Adya Direct Serialization Graph (DSG) with pulsing conflict cycles ($rw, ww, wr$).
• Side-by-side comparison of noisy raw execution traces vs 1-minimal reproductions via Causal Delta-Debugging ($ddmin$).
• Deep statement inspector displaying dynamic variables, latencies, and invariant evaluations.

🛡️ OASIS SARIF 2.1.0 & GitHub Code Scanning

• Standardized OASIS SARIF 2.1.0 export (--export-sarif) for native display in GitHub Security / Code Scanning alerts (CWE-362).
• Complete GitHub Action (action.yml) for automated pull request quality gates.
• Formally mapped SARIF rule catalog covering CHAOS001 through CHAOS009.

🔬 10 Flagship Concurrency Scenarios & Production Fixes

• Added 10th flagship scenario: Foreign Key Cascade Deadlock ($G\text{-DL}$) with referential lock hierarchy inversion.
• Added dedicated "Production Fix & Database Mitigation" guidance with battle-tested SQL for all 10 scenarios (atomic updates, guarded decrements, SSI, OCC monotonic versioning, canonical lock ordering).

⚡ Performance & Core Engine

• Zero CGO dependencies (modernc.org/sqlite) achieving 13.9M ops/sec with cross-platform portability.
• Strict deterministic replay convergence: identical PRNG seed guarantees identical concurrency interleaving.