Remediation status
Tracks the root-cause remediation program. A finding is verified only when its regression tests passed in public CI (and, for storage, keys, events, transactions, TTL and Raft, the crash/restart harness).
Phases
| Phase | Title | Status | Findings verified |
|---|---|---|---|
| 0 | Honesty and tracking | gate_passed | 6/6 |
| 1 | Harness and baseline | not_started | 0/2 |
| 2 | Format v2 and single-node root fixes | not_started | 0/15 |
| 3 | Semantics | not_started | 0/9 |
| 4 | Raft | not_started | 0/13 |
| 5 | Documentation and release | not_started | 0/9 |
Findings
| ID | Severity | Phase | Status | Title |
|---|---|---|---|---|
| EVT-01 | critical | 2 | open | static OUTBOX_SEQ resets on restart; persisted consumer offsets skip new events |
| RFT-01 | critical | 4 | open | current_term/voted_for start at 0/None and are never persisted; double vote produces two leaders |
| RFT-02 | critical | 4 | open | Raft log never reloaded; entries stored under a random UUID without index/term |
| RFT-03 | critical | 4 | open | Commit index computed by ascending sort()/indices[len/2]; wrong majority on even node counts |
| RFT-04 | critical | 4 | open | log_start_index ignored after compaction/snapshot install; apply loop advances last_applied over gaps |
| STO-01 | critical | 2 | open | Checkpoint recovery drops pre-checkpoint keys |
| STO-02 | critical | 2 | open | Writes acked before fsync; SyncMode::Durable never honored |
| DOC-02 | high | 5 | open | Rust client samples use PrkDbClient::new without credentials; Python client has no credential parameter |
| DOC-03 | high | 5 | open | Transactions, TTL, secondary-index, custom-adapter, and ORM doc samples do not compile |
| EVT-02 | high | 2 | open | Default WAL adapter keeps outbox in memory only; partitioned adapter discards outbox writes and returns Ok |
| EVT-03 | high | 3 | open | Mixed-partition batch routes all events to the first item's partition |
| EVT-04 | high | 3 | open | Sled "atomic" outbox methods apply two independent tree batches |
| EVT-05 | high | 3 | open | put_with_outbox errors fall back to a non-atomic path, hiding real errors |
| EVT-06 | high | 3 | open | Auto-commit commits inside poll() before processing; no generation fencing; unassigned consumer falls back to partition 0 |
| KEY-01 | high | 2 | open | Primary keys not namespaced by collection; different types can overwrite each other |
| KEY-02 | high | 2 | open | upsert removes the new record's index entries instead of the old; unique index unenforced |
| KEY-03 | high | 2 | open | AHasher::default() is randomly seeded per process; a key's partition changes after restart |
| REL-01 | high | 5 | open | prkdb-client path dep has no version; dry-run failures suppressed; validate_all.sh reports success on failure |
| RFT-05 | high | 4 | open | Commit waiters keyed by index only; not failed on step-down, so a deposed leader's client can see another leader's entry |
| RFT-06 | high | 4 | open | ReadIndex heartbeat sends prev_log_index:0 with leader_commit; no no-op on election lets a linearizable read miss an acked write |
| RFT-07 | high | 4 | open | Failed InstallSnapshot counts toward commit; restore never clears old keys; stale snapshots accepted |
| RFT-10 | high | 4 | open | CLUSTER_NODES rejects hostnames; 3-node compose cluster cannot start |
| SCH-02 | high | 2 | open | Schema reload accepts missing descriptors; non-atomic writes; concurrent registrations can reuse a version |
| STO-06 | high | 2 | open | Four WAL implementations in use; all data writes hash to one shard so fixes do not propagate |
| STO-07 | high | 2 | open | BatchAccumulator::flush() sleeps and returns Ok while dropping executor errors |
| TST-01 | high | 4 | open | Chaos monkey tolerates 20% of acknowledged writes missing |
| TXN-01 | high | 3 | open | Commit writes puts then deletes in separate append_batch calls; crash between leaves a torn commit |
| TXN-02 | high | 3 | open | Indexed "atomic" transaction loops over independent puts |
| TXN-03 | high | 3 | open | Serializable read set keeps only the last read hash; ReadCommitted writers bypass the barrier, losing updates |
| DOC-04 | medium | 5 | open | Global --credential flag ignored by schema/codegen subcommands |
| DOC-05 | medium | 5 | open | README CLI commands and binary name do not exist; referenced examples missing |
| DOC-07 | medium | 5 | open | prkdb_writer_healthy alert only exported by prkdb-cli serve; /metrics needs Admin; capability split undocumented |
| DOC-08 | medium | 5 | open | Missing pages: consumer groups, Docker, CLI reference, Raft ops, troubleshooting, Python client, upgrade |
| DOC-12 | medium | 5 | open | Nothing in CI runs the documented deploy recipes (docker compose up, 3-node setup) |
| RFT-08 | medium | 4 | open | RPC client never sends x-prkdb-cluster-secret; mTLS mode configures no server TLS, so cluster cannot elect |
| RFT-09 | medium | 4 | open | a_committed_write_replicates_to_every_node failed the unmutated baseline in CI run 34021601202 |
| STO-03 | medium | 2 | open | WAL append outside publish_barrier can leave the live index pointing at a stale offset |
| STO-04 | medium | 2 | open | scan_mmap skips CRC on open; torn records become invisible; directories never fsynced |
| STO-05 | medium | 2 | open | WAL routing uses unstable DefaultHasher; replay ordered by segment id, not global order |
| TST-02 | medium | 4 | open | Linearizability workloads use 1 writer, 1 reader, ~25 ops; failed reads dropped |
| TST-03 | medium | 1 | open | No restart/crash testing against a reference model |
| TST-05 | medium | 2 | open | No power-loss (unsynced-data) testing; needs the WAL routed through Vfs |
| TST-06 | medium | 4 | open | No deterministic simulation of the cluster |
| TTL-01 | medium | 3 | open | Expiry deletes without re-checking the version; value and TTL metadata written non-atomically |
| TXN-04 | medium | 3 | open | Default isolation is ReadCommitted; D5 makes Serializable the default |
| DOC-10 | low | 5 | open | ignoreDeadLinks: true hides orphaned methodology/status pages |
| TST-04 | low | 1 | open | e2e_throughput_bench not declared harness = false; Criterion main likely never runs |
| TST-07 | low | 2 | open | No fuzzing of WAL record, segment, snapshot, and proto decoding |
| DOC-01 | high | 0 | verified | Cluster docs and compose files misdescribe multi-node setup (env vars, peer auth, metrics auth) |
| SCH-01 | high | 0 | verified | Schema collection name joined into a path allows writes outside the registry dir |
| DOC-11 | medium | 0 | verified | Transactions page claims Serializable is the default; code defaults to ReadCommitted |
| TST-08 | medium | 0 | verified | replication_tests binds fixed port 13197 and fails under parallel nextest runs |
| DOC-06 | low | 0 | verified | Rust version stated as 1.75+/1.95+ while the actual toolchain is 1.98 |
| DOC-09 | low | 0 | verified | Unsourced performance claims (10x less resources, ~10 MB binary, <1s startup, 99.4% write success) |