RURALRoadmap
The native prototype acceptance gates and the evidence still required.
Gate: P29. Test on the final binaries and an isolated profile. Every row is required unless explicitly labelled later. Record command, build/dependency versions, machine, fixture seed, actual result and evidence location. A screenshot from concept/2077, an in-memory mock, or a passing build is insufficient.
Visual and functional proof#
| ID | Perform in the real Zig native client | Required evidence |
|---|---|---|
| V01 | Start service/client, create project/task/note/relation, edit fields, delete a record and inspect receipts | Visible store/branch/head; matching CLI reads and request IDs; deleted value absent; no hidden file backend |
| V02 | Switch 2D -> 3D -> structured record, select the same object and edit a supported field | Identical ID/revision/units/scope; new revision seen in every lens; hidden fields unchanged |
| V03 | Add a new supported schema, create its record and open it | Editor derives from semantic definitions without a new per-collection component; unknown-critical action disabled |
| V04 | Fork child then grandchild, edit separately, delete parent; compare and merge | Child/grandchild isolation and surviving roots; explicit conflicts; stale target fails; lineage and selected branch visible |
| V05 | Run event producer during typing, query and camera movement | Attempted/accepted/duplicate/rejected/pending, coverage and processed positions visible; exact totals after drain; UI responsive |
| V06 | Change/retire Compass priority, compare two plans, inspect personal/shared mandate | Qualitative/unknown evidence retained; no universal score; shared view hides private scope; revoked mandate cannot dispatch |
| V07 | Reserve8.00 test credits, simulate2.50 charge, release5.50; repeat with lost reply | Conserved ledger, one effect per identity, unresolved reservation remains held, no real payment or branch balance duplication |
| V08 | Restart both processes, back up during use, restore to a new empty directory | Same records/schemas/branches/receipts/totals (receipts: since 927f53f (T1 restore seam), clear WAL restore binds a fresh store identity with an empty retry ledger and receipt floor captured sequence + 1; original receipts stay valid only on the source store. see backup-recovery.md:114-120); fresh credentials, no copied active effects; original store unchanged |
| V09 | Discover/call Oracle through a real MCP client and execute five golden typed queries | Real stdio handshake/calls, correct answers/coverage/evidence and scoped denial; gateway connects to sole owner |
| V10 | Turn off model access and external networking; operate normally | Local loopback remains available. Launch/CRUD/query/branch/lenses/Compass/templates/export/restore work; no model or registry dependency at runtime |
Native interaction checklist: keyboard-only core navigation and edits; mouse selection/picking; text including Čarolija živi — déjà vu; paste/insert/delete without byte corruption; clear focus; resize and Retina scale; loading/empty/forbidden/stale/disconnected/conflict/storage-error views. Disconnect disables writes and exposes the last stamp. Capture one native screenshot per meaningful scene plus CLI/receipt evidence, not a screenshot of a scene that merely resembles the feature.
Full screen-reader/IME certification, every OS and every device are later qualification. Record the prototype's concrete limits honestly; never claim accessibility certification from the keyboard checks.
Storage, authority and hostile-input proof#
Use deterministic fault injection plus actual child-process termination at selected boundaries. Acknowledged IDs must be present after recovery. Distinguish process-kill proof from physical power-loss/device certification. Test complete frame corruption, incomplete unacknowledged tail, partial backup, wrong format/version, full-disk/admission limits, wrong store/session and second owner. No repair may silently discard acknowledged data.
Replay the same logical mutation after schema/head changes and branch deletion, reject changed logical input under an old identity, and verify that immutable commit receipts retain their original hashes/position while delivery authorization is current.
Race revocation against read/commit/delivery, cursor expansion, Compass change and simulated dispatch. Check current authority on old branches/snapshots and after restore. A response already started cannot be unsent; a new delivery admission cannot use revoked authority. Fuzz bounded JSON, HTTP and MCP inputs, duplicate keys, invalid UTF-8, overflow, depth, length, invalid credentials, scope manipulation and unsupported protocols. Preserve any failing seeds.
Verify relation-index rebuild, schema/unique rollback, cursor lifetime, root reclamation and merge-base pins. Repeated branch/delete/restore cycles must not create unbounded retained memory. Raw internal control namespaces are inaccessible to generic CRUD/query and read-only Oracle.
Local load envelope#
This is an initial qualification target, not a benchmark claim. Use the actual Mac, release-safe build, durable sync enabled, batches of64, fixed recipe from P03 and average encoded event size recorded. Separate requests/s, events/s and bytes/s.
| Run | Offered workload | Pass condition |
|---|---|---|
| Baseline | 20k events at500 unique events/s, two interactive queries/s, one CRUD update/s for40s; at least1,000 visible candidate records with bounded viewport selection | All acknowledged unique IDs and golden totals correct after drain/restart; no silent sampling; achieved rate and actual rejected/pending counts recorded |
| Responsive use | Same load, native2D and3D camera/selection, typing and inspector edits | Native input-to-visible-update p95≤100ms; frame-time p95≤33ms for the declared visible set; no network/sync work on UI thread |
| Commit latency | Same load after5s warm-up | Durable batch/interactive mutation p95≤200ms; reads p95≤250ms for declared bounded plans; report p50/p95/p99 and maxima |
| Overload | Calibrate capacity C (below), then offer new batches open-loop at max(4 × baseline, 4 × C) for 30 s or the declared cap-safe window, then resume baseline for ≥ 10 s and drain | Explicit typed refusal before acceptance (HTTP 503 busy, rejection_proven, Retry-After/retry_after_ms; connection-level refusals or resets do not count); accepted goodput ≥ 0.9 × C; admitted durable batch-ack p95 ≤ 200 ms and queue sojourn p99 ≤ the 50 ms shed deadline; no lost acknowledged IDs, duplicate effect or indefinite starvation; backlog drains at ≥ 0.8 × (C − baseline) with drain time measured; queue within its admission limit; identity set exact after drain and restart |
| Snapshot/branches | Pinned analytical reader plus100 fork/edit/drop cycles within configured active-branch cap | Writes progress; reader's result stable; surviving descendant valid; retained memory returns to a declared bounded level |
| Soak | 10 minutes at baseline offered rate cycling the fixed 20k-event identities, with periodic CRUD updates, backup and rolling-window expiry; the service runs in its own process | Runtime resources sampled by PID every 5 s (current RSS, descriptors, threads, connections, queue depth) show no sustained growth: least-squares slope over minutes 2–10 projected over ten more minutes < 5% of the mean, queue and connection maxima within caps. Lifetime-capped resources (receipts, per-request result records, journal bytes) report growth rate and time-to-cap ≥ 10× run length with no cap reached. Zero 503 refusals at baseline; no stalled work; post-drain results exact |
Capacity calibration (frozen 2026-09-24): closed-loop producers, each with one in-flight batch on a persistent connection, sweep P ∈ {1,2,4,8,12} (12 is the admission limit) on a fresh store per step, 5 s warm-up then 20 s measured; a step stops early before 60,000 batches so it stays below lifetime caps, and its window shrinks accordingly. C is the highest acknowledged events/s whose batch-ack p95 ≤ 50 ms with zero refusals. Repeat three times and report the median and coefficient of variation; above 10% the run is inconclusive, neither pass nor fail. Events/s here counts every event in acknowledged batches, novel or duplicate. The overload window is 30 s unless 30 s of accepted work at C would exceed 75% of a fresh store's per-branch record cap left after the 20k event records; it is then min(30, max(10, floor(0.75 × 80,000 / (C/64)))) seconds, declared in the artifact. Each overload producer keeps a bounded 64-batch outbox; a scheduled batch that finds it full is counted as source-deferred, and because identities are drawn on enqueue the event stream is delayed, never gapped. Refused batches retry with the same identity after the jittered server hint; retries are reported separately and are not new offered load. Admission defaults: 16 listener workers, kernel backlog 128, 12 queued commands, 2 MiB queued bodies, 50 ms queue-wait deadline. scripts/check_mixed_load.py (schema rural-p26-mixed-load/v2) recomputes these criteria from the raw artifact.
The soak measures bounded steady-state retry/refresh behavior; it is not a ten-minute novel-event intake benchmark. The 40-second baseline separately tests new events. Internal indexes and lifetime receipts count toward advertised caps; capacity rejection is explicit and never erases accepted identities.
Target total resident memory≤1GiB for service+client under this fixture. Record logical working set, allocator peaks, disk bytes and display/GPU constraints separately. These initial usability/resource targets gate P29; if missed, return the measured failure to the coordinator for a bounded optimization packet or explicit scoped target revision. Do not silently lower them or disable durability. They make no claim about viral worldwide capacity, lower costs than another database, larger-than-memory execution or surviving host destruction.
Oracle efficiency proof#
Compare equivalent authorized questions and exact results. Include catalog/schema discovery, query, context, expansion, unchanged polling and all follow-ups in the total. Record request/response bytes, calls and cold/warm time. A prepared unchanged refresh should return one bounded unchanged response rather than the whole result again. Actual tokens are reported only if deliberately connected model instrumentation supplies them; otherwise mark tokens unmeasured. No benchmark needs private repository text sent to an LLM.
Package and documentation proof#
P27 supplies a normal launch path outside the checkout, required licensed assets/notices, exact source/dependency versions, cached/offline build instructions and new-directory restore. Validate a populated-cache build without internet separately from an offline runtime launch. Do not promise a clean-machine build from an absent toolchain/cache. Local .app may be unsigned; notarization/distribution are later work.
P28 must verify every published command and example against actual artifacts. P29 checks final artifact hashes against evidence, performs a normal visible run and records supported/planned/limited capabilities. The current metadata-only plan validation is not any of these acceptance tests.
Separate original UNIVERSE integration gate#
The native prototype can host a selected project's observations and new RURAL records. It does not establish that the existing UNIVERSE-25 application's canonical backend has changed. M1 requires current RepositoryV2 conformance, real application writes/reads/explorer/graph, actual Oracle integration, normal startup, restart/restore and unchanged source repositories in an isolated profile. Its integration contract must be refreshed before implementation; any non-Zig compatibility glue requires an explicit scope decision. Do not mark M1 complete at P29.