Fail-closed identity and tenancy
Resolve tenant and principal before routing. Missing tenant state, revoked credentials, or residency mismatch deny the request.
Security and trust
Trust is a property of the context.
SolarflareDB should show who wrote an item, which tenant owns it, what policy admitted it, when it was true, which index returned it, and how the operation can be replayed.
Policy-covered operations
Integrity envelopes include graph, region, writer epoch, sequence bounds, schema generation, request identity, and checksums.
Verifiable recovery
Packed WAL, immutable root generations, closure-verified mirrors, checkpoints, and semantic digests support audit and replay.
Mandatory Stage 0
No public multi-tenant launch before these gates pass.
The supplied research prototype contains valuable ideas but requires a correctness and security phase before scale or commercial claims.
Strict storage and replay
Reads distinguish error from absence; malformed records halt advancement; per-region progress is contiguous; segment identity and checksums are verified.
All-or-nothing mutation
Atom and type batches validate in staged state and commit in one transaction with deduplication, HLC persistence, log entry, and outboxes.
Authenticated control plane
Every data, schema, seal, checkpoint, sync, and administrative route is authenticated, scoped, rate-limited, and separated by privilege.
Safe seal and mirror protocols
Region sealing coordinates with the writer. A destination root is published only after the complete immutable object closure is verified.
Data protection target
Keep identity, access, encryption, retention, and erasure aligned.
Append-only history is valuable only when the platform can also honor lifecycle boundaries across authoritative state, indexes, cache, archive, and disaster recovery.
Encryption hierarchy
Envelope-encrypt sensitive payloads using tenant and subject/entity key hierarchy; define rotation and destruction procedures.
Projection erasure
Orchestrate removal from hot shards, lexical and vector indexes, caches, excerpts, exports, mirrors, and key stores.
Verified completion
Track each projection past the erasure bookmark and retain only legally permitted non-PII audit state.
Trust center states
Separate implemented, planned, and verified.
The public security page should never present architecture intent as a completed control or a compliance logo as evidence of operating quality.
| Status | Meaning | Public presentation |
|---|---|---|
| Implemented | Control exists in the deployed product and has test evidence. | Describe exact scope and limitations. |
| Preview | Control is present but not contractually supported or fully operationalized. | Label technical preview and avoid absolutes. |
| Planned | Architecture or roadmap target only. | Keep in roadmap, not security claims. |
| Verified | Independent assessment, certification, or test has current evidence. | Publish date, scope, report or attestation. |
Security starts before the first API route.
Review the technical product architecture, then test the intended onboarding flow as a developer would see it.