Current Status: 0.2.0-dev (Experimental, C-grade)
⚠️ EXPERIMENTAL: These engines are not production-ready. See ASSURANCE_MATRIX.md for evidence levels and ROADMAP.md for the path to production.
Multi-language append-only ledger fabric with:
- Zig Storage Engine — Durable append-only segments with CRC32 integrity, atomic manifest, crash recovery
- Ada SPARK Formal Specification — Machine-checkable invariants for all write-once guarantees
- OCaml Policy Layer — Flexible policy composition for record validation and retention
- Erlang Replication Mesh — Distributed recovery coordination across replicas
- C ABI Integration Boundary — Zero-copy interop with external systems
All components enforcing a unified set of 12 formal invariants.
| Component | Evidence Level | Status |
|---|---|---|
| Zig Storage (C+) | Implemented, Unit Tested | Segments, manifest, recovery, validation, CRC32 |
| C ABI (C) | Specified | Function signatures only |
| Cross-Language (B) | Integrated | Zig ↔ C only; OCaml + Erlang pending |
| SPARK (C) | Specified | Invariants documented; proofs pending |
| Erlang (C-) | Designed | Architecture only |
| Overall | Experimental | All 10 P0 bugs fixed; moving to evidence cycle |
See ASSURANCE_MATRIX.md for the full 7-level evidence scale and detailed component breakdown.
Commercial Only — Business Source License 1.1 (Elastic Commons Clause)
- ✅ Community free use via BSL with change date Dec 31, 2027 → auto-converts to AGPL-3.0-only
- ✅ Professional license: $5K–15K/year
- ✅ Enterprise: custom pricing
- ✅ OEM integration: custom terms
NOT open source. These engines are for commercial licensing. See COMMERCIAL.md for terms and LICENSE for the full legal text.
cd zig-engine
zig build
./zig-cache/bin/worm-enginecd zig-engine
zig build testcd zig-engine
zig build
./zig-cache/bin/crash-harness # 30-scenario deterministic recovery testZig segment format:
- Magic bytes:
0x574F524D("WORM") - Version: u16 big-endian
- Records: length (u32) + CBOR payload + CRC32
- Manifest: atomic temp-rename pattern
Recovery: Scan segments → validate CRC → rebuild hash chain → truncate at first error
All 12 invariants enforced at record validation:
- Write-Once: No rewritten records
- Sequence Order: Monotonic increments
- Hash Chain: Unbroken cryptographic linkage
- Timestamp Monotonicity: Time never rewinds
- Writer Consistency: Same writer_id across session
- Manifest Integrity: Atomic updates via temp-rename
- Segment Durability: fsync() after every write
- CRC32 Protection: Bit-flip detection
- Crash Recovery: Deterministic rebuild from segments
- Concurrency Safety: No partial records
- Deterministic Output: Identical CBOR + SHA256 on replay
- Policy Enforcement: OCaml layer validation before durability
- ✅ All 10 P0 bugs fixed (memory safety, determinism, error handling)
- ✅ Zig storage layer complete (423 lines, recovery + validation)
- ✅ Crash injection harness (10+ points, 30 scenarios)
- ✅ Honest assurance matrix (no inflated claims)
- ✅ Professional branding (SVG mark + hero)
v0.3.0 (Evidence Cycle) — 4 weeks
- GNATprove formal verification of SPARK invariants
- Complete 4-language cross-determinism testing
- C ABI implementation + signing/verification
v0.4.0 (Complete Implementation) — 4 weeks
- Erlang NIF wiring
- Key management and policy engine
- Full documentation
v0.5.0 (Hardening) — 6 weeks
- Crash recovery matrix (fuzz-driven)
- External security audit ($30–60K)
- Reproducible builds + signed artifacts
v1.0.0 (Production) — 2 weeks
- SLA enforcement
- Production release
See ROADMAP.md for full details, resource requirements, and quality gates.
For production deployments, commercial licensing is required:
- Professional: $5K–15K/year (single deployment)
- Enterprise: Custom pricing (unlimited deployments)
- OEM Integration: Custom terms with key management
Contact: licensing@worm-engines.dev
- ASSURANCE_MATRIX.md — Evidence levels by component (Specified → Externally Audited)
- ROADMAP.md — 5-phase path to v1.0.0 (v0.3.0 Evidence → v0.5.0 Audit → v1.0.0 Release)
- AUDIT_SCOPE.md — External audit engagement scope ($30-60K, 4-6 weeks)
- GATE_5_SPARK_PROOF.md — Formal invariant specifications (12 invariants, machine-checkable)
- GATE_6_REPLICATION_HARNESS.md — Erlang replication protocol design
- GATE_7_EVIDENCE_COLLECTION.md — Evidence framework (v0.3.0 → v0.5.0 checkpoints)
- spark/GNATPROVE_INSTRUCTIONS.md — GNATprove proof generation for all 12 invariants
- COMMERCIAL.md — Commercial licensing tiers (Professional $5-15K/year, Enterprise custom)
- docs/assets/brand/BRAND-GUIDE.md — Brand identity (hero, mark, colors, typography)
worm-engines/
├── zig-engine/ # Durable storage in Zig
│ ├── src/
│ │ ├── storage.zig # Core ledger lifecycle (create/open/recover)
│ │ ├── segment.zig # Append-only segment format
│ │ ├── manifest.zig # Atomic manifest coordination
│ │ ├── constants.zig # Shared types and limits
│ │ ├── codec.zig # CBOR encoding
│ │ ├── hash.zig # SHA-256 hash chain
│ │ └── crash_harness.zig # Deterministic crash testing
│ └── build.zig # Zig build script
├── spark/ # Formal specification in Ada SPARK
│ └── worm_invariants.spark # 12 machine-checkable invariants
├── erlang/ # Replication mesh (in progress)
├── spec/ # Protocol specifications
├── docs/
│ └── assets/
│ └── brand/ # SVG mark + hero + brand guide
├── ASSURANCE_MATRIX.md # Evidence and status
├── COMMERCIAL.md # Licensing tiers
├── ROADMAP.md # Path to production
├── LICENSE # BSL 1.1 (Elastic Commons Clause)
└── README.md # This file
Copyright © 2026 Sovereign Source Foundation. All rights reserved.
Licensed under Business Source License 1.1 (Elastic Commons Clause).
Change Date: December 31, 2027
Change License: AGPL-3.0-only
See LICENSE and COMMERCIAL.md for complete terms.
WORM Engines
Multi-language append-only ledger fabric for commercial infrastructure.
Built with precision. Verified by design.