mirror of
https://github.com/lux-apps/papers.git
synced 2026-10-30 18:15:21 +00:00
zeekay
abf99d05fc
Restructured from flat .tex/.pdf files into per-paper subdirectories. Added Antje Worring as co-author on all papers. Synced PDFs to pdfs/ for download site.
49 lines
2.2 KiB
TeX
49 lines
2.2 KiB
TeX
\section{Introduction}
|
|
\label{sec:intro}
|
|
%% ============================================================
|
|
|
|
Lux ecosystem services---ATS, Broker, Transfer Agent, IAM, KMS---run
|
|
on Hanzo Base, an embedded SQLite runtime. Each organization (tenant)
|
|
gets its own SQLite database file, isolated by design. This per-org
|
|
model eliminates multi-tenant query scoping bugs, simplifies backups,
|
|
and enables true data sovereignty: an org's data is a single file that
|
|
can be encrypted, moved, or deleted atomically.
|
|
|
|
The problem is durability. SQLite databases live on local disk. In
|
|
Kubernetes, local disk is either emptyDir (lost on pod restart) or a
|
|
Persistent Volume Claim (PVC). PVCs on cloud providers fail: GCE
|
|
persistent disks detach during node migrations, EBS volumes hit
|
|
``attaching'' limbo during AZ failovers, and local SSDs on bare-metal
|
|
nodes die without warning. A securities exchange cannot tolerate data
|
|
loss of compliance records, audit trails, or KYC state.
|
|
|
|
The solution is continuous WAL-based replication to durable object
|
|
storage with end-to-end encryption. This proposal standardizes that
|
|
solution.
|
|
|
|
\subsection{Design Goals}
|
|
|
|
\begin{enumerate}[nosep]
|
|
\item \textbf{Zero data loss}: Every committed WAL frame reaches
|
|
durable storage within the sync interval (default 1\,s).
|
|
\item \textbf{End-to-end encryption}: No plaintext database content
|
|
exists outside the pod boundary.
|
|
\item \textbf{Per-principal isolation}: Each org/user derives a unique
|
|
encryption keypair; compromise of one principal's key reveals
|
|
nothing about other principals.
|
|
\item \textbf{Transparent recovery}: A fresh pod restores from S3
|
|
automatically via init container; no operator intervention.
|
|
\item \textbf{No new dependencies}: Uses existing ecosystem
|
|
components---\texttt{hanzoai/replicate}, \texttt{hanzoai/age},
|
|
\texttt{hanzoai/s3}, \texttt{hanzoai/kms}.
|
|
\end{enumerate}
|
|
|
|
\subsection{Scope}
|
|
|
|
This standard applies to all services in the Lux and Hanzo ecosystems
|
|
that use SQLite as their primary data store. It does not apply to
|
|
PostgreSQL-backed services (which use standard streaming replication)
|
|
or to on-chain state (which is durable by construction).
|
|
|
|
%% ============================================================
|