GQODB stores market data the way research actually needs it: every record keeps the bytes as they arrived, the moment they arrived, and the evidence for the clock that measured it. Ask a question at a past cutoff and you get what was available then — not what the database learned afterwards.
Corrections arrive as new revisions against a fixed capture watermark, so a late append can never change an answer you already recorded. Availability bounds and clock error intervals decide what a strategy could see — not a single timestamp column.
Functionally tested · causal queries, late corrections, tombstonesRaw bytes become durable before anything derived runs, and the receipt follows the sync rather than the intent. An invalid record is kept exactly as received and explained by the quality check, so you can see what the venue actually sent you.
Functionally tested · 8,192-record import survived a real process killEach number here names its dataset, its host and its measurement boundary — including the runs where this system loses. If a figure does not exist, the cell says so instead of being filled with an estimate.
Hash checked · 30 result files matched their build receipts · codec going open1,048,576 Bybit order-book level rows from 7,265 events. One warm-up, six measured rounds, medians, warm cache, one host. File-sync counted.
−37.75% bytes and −36.67% write time against dictionary-LZ4 Parquet, plus a measured −3.96% on the full read. In the in-memory codec test the book profile is 38–43% smaller than that same Parquet baseline — and 14% slower to decode than it. Both directions are on the benchmarks page, with their sample sizes.
| If you use | What it does well | What it costs you here |
|---|---|---|
| Parquet files and scripts | Portable, universally supported, excellent scan performance | No arrival time, no clock evidence, no revision model — point-in-time correctness becomes your own convention, enforced by nothing |
| PostgreSQL or MongoDB | Mature, transactional, operationally familiar; PostgreSQL was faster at individual durable writes in our own news test | Storing every revision and arrival time is schema work you write and maintain; resident queries were 29× to 250× slower in that same test |
| kdb+ / q | The proven answer for tick data at scale, with decades of production use | Licence cost and a language your team has to learn. GQODB has never been measured against it — that comparison is written and unrun |
| A vendor market-data API | No infrastructure to run, and someone else's problem when it breaks | You get the vendor's current view of history; silent restatements are invisible to you and unauditable afterwards |
| GQODB | Raw bytes, arrival time, clock evidence and revisions as first-class data, with exact integers and causal reads | A prototype: no published build, no live feed connector, no SQL, and warm-cache benchmarks only |
Read the numbers like an engineer, not a brochure. Benchmark figures are observations from named runs; package counts are an inventory; the 1 TB input cap is a configured limit; roadmap items are future work. An empty cell says either not shown here or not measured in that study — the two are different, and the tables keep them apart.
Systematic traders and quant researchers who run their own data stack and need a backtest they can defend — where "what did we know at 09:31:04.221?" has one answer that survives re-running it next year.
Anyone who needs a managed feed today. There is no hosted service, no published build and no live venue connector — offline fixtures and file imports are what exists now.
Two different problems live in this system. A shared-memory bus moves data between processes on one host in roughly a microsecond. A storage route writes bytes to a file, syncs them and records what is committed. They have different costs and different guarantees, and a bus figure is never a recording latency.
The runtime in the audited copy takes normalised trades and full L10 snapshots. A universal live connector does not exist yet; offline FIX, news and the other domains have their own entry paths.
Six states, deliberately distinguished. Most systems collapse the middle four.
| State | Meaning |
|---|---|
| Accepted in RAM | No durable promise at all |
| Written to the OS | Not necessarily synced |
| Raw synced, receipt not yet delivered | The data may already exist; the sender does not know it yet |
| Prefix committed | Raw and the commit record are stored under the filesystem contract, and the receipt is offered |
| Quality processed | The background check has a verdict — which may be a rejection |
| Compressed | A derived storage form is updated; a separate progress boundary |
A checksum detects damage; it does not restore vanished bytes. fsync and atomic publication are not an audit of every storage device, controller cache or power-loss scenario. "No receipt seen" is also not "definitely not stored" — recovery can find complete records whose reply was lost.
Syncing each record separately is expensive. A bounded batch shares the sync and ledger cost across records — and the acknowledgement still waits until the batch is durable.
256 records, 1 MiB payload, a 10 ms flush timer. These are settings, not measured maximum latencies: the timer says when flushing must start, and scheduling and storage still take time after that.
RAM-only batch records can be lost. They were never acknowledged, so they must stay available upstream. The per-record API remains available for callers that want it.
There is no unbounded event queue in RAM. A bounded, coalescing wake signal points at the real backlog, which lives in the raw journal; the worker reads the committed prefix and does the actual quality, feature and codec work.
processed_records and compressed_through are not the same boundary. A green verdict on old data must never hide a new backlog, so both stay visible.
State is rebuilt from raw into a new generation — not simply resumed from a persistent per-engine checkpoint. Old generations are kept rather than silently dropped.
A compression failure is reported while raw capture continues, and a rebuild stays possible. Tested — but a finite disk still fills, and a slow receipt consumer or clock check can slow the input path.
Not measured is unknown, never zero and never automatically green.
To know what an algorithm could have known at a historical moment, six questions need separate answers.
| Time | The question it answers |
|---|---|
| Source / broker time | When does the source say the event happened? |
| Local receipt | When did it arrive here? |
| Availability | From when could this input be used here? |
| Feature ready time | When was the derived computation finished? |
| Clock evidence and error interval | How well founded is that local UTC estimate? |
| Monotonic time and epoch | What was the local ordering inside the same clock and boot? |
Illustrative, not a measurement: an event claims source time 12:00:00.090, arrives at
.100 and is available at .103. A backtest at .095 may not use it.
With a 2 ms error margin on availability the estimated upper bound is .105, and strict
visibility before .105 is refused. Valid clock evidence arriving later never retro-fits
trustworthy times onto earlier events, and a missing historical feature-ready time is left missing
rather than invented. Nanosecond units do not imply nanosecond accuracy, and the system can only
assess the evidence an adapter supplies.
"Exact" means two different things here, and a codec benchmark can only measure the second one for a selected projection.
Original input bytes are preserved. An invalid JSON line is still recorded as received input; the quality check later says why it is not usable market data.
Specified values, types and metadata read back without precision loss. A price is an integer plus its scale — 10001 at scale 2 is 100.01 — and a ratio can stay a numerator and denominator instead of a rounded result.
Normalised trade and book prices use scaled integers. That is not a project-wide absence of floating point: generic Arrow codecs can preserve float bits, and the B09 quote fixtures deliberately keep original float64 bits.
Read big integers and ns timestamps exactly. A plain JavaScript Number loses precision on both. Arrow exchange checks units, types and metadata rather than silently converting milliseconds to nanoseconds.
| Format | Holds | Status |
|---|---|---|
.gqodb.raw | Original received bytes with framing and integrity checks — the base for every recheck and reprocess | Working |
.gqodb.tick | Native tick segments. Shares GQOBHDR1 framing with the book family, but the header selects the adaptive tick codec profile | Working |
.gqodb.ob | Native order-book segments with block index, range read and prefix recovery; header selects the book codec profile | Working |
.gqodb.replay | Offline capture and book replay produced by the CLI | Working |
.gqo.txt | News, documents and typed fundamentals — readable raw or losslessly compressed, revisions kept | Working |
.gqo.model | Lossless archive of an opaque model file with CRC and SHA-256, verified before publication | Working |
| Arrow / Parquet | Explicit exchange contract and benchmark reference, with exact scales and UTC nanoseconds | Working |
Detection uses the magic header, not the extension: renaming a .tick file to .ob changes neither its contents nor its codec, and the facade checks this explicitly.
A cumulative 1,000,000,000,000 input bytes per data directory over its lifetime — decimal TB, not TiB, not a monthly quota, and not a cap on total disk space. A configuration may lower it.
Reserves its external byte size, whitespace and newlines included. An identical, already-completed re-import is not charged twice.
Counts offered raw bytes — invalid records and resent traffic included. There is no global producer deduplication.
Recovery, recompression, indices and derived output cost no second input charge — but they do cost disk space.
A local ledger, not a tamper-resistant licence server. The same user owns the files. Commercial policy on machines, accounts and migrations is a separate, unsettled question.
The standalone query layer separates event time from what was already known, against a fixed capture watermark. It can select the last visible revision, show every revision, or apply tombstones; for features, the availability bounds of declared dependencies count too.
The watermark stops later appended records that happen to share a timestamp from changing a fixed
snapshot: a correction becomes a new revision rather than silently rewriting an older answer. This
holds within the input contract — wrong supplied times, hidden future information in an external file
or an untrustworthy adapter are not made impossible by it. The runtime's own asof is
narrower: it scans raw history and picks the last qualified event per stream. It is not a SQL engine
and not a large persistent multi-archive index.
The audited source copy holds 30 workspace packages — gqodb-codec and gco-ops
now carry source and tests, so the earlier "design only" pair is gone. "Prototype" still means source
and tests exist, not a qualified release. The limit column is the part most inventories leave out.
| Package | What exists | Main limit |
|---|---|---|
types | Exact event and time types: scales, receipt and ready time, clock evidence, error intervals, staleness | Certifies no physical clock of its own; nanosecond units are not nanosecond accuracy |
blocks | Lossless codec kernels with adaptive column predictors, schema and null preservation, batch workers, Parquet counter-tests | Codec kernels are not a standalone database |
store | Indexed native segments, block index, range read and committed-prefix recovery | Not a complete catalog or retention product |
codec | Native facade with format and schema inspection; selects the tick or book profile from the header | Venue meaning stays elsewhere; the facade classifies bytes, not markets |
journal | Raw framing, receipts, sync modes and readers, with checksums, disk reserve and a synced vs OS-written distinction | The caller defines payload semantics; OnSeal means an earlier append may be OS-written only |
ingest | Bounded capture, compression and CSV building blocks with optional CPU pinning and visible deferred work | No universal source collector |
recovery | Separate quality and compression lanes over a fixed committed raw snapshot, with hashes and crash injection | Callbacks can re-run on retry; not a live-writer recovery |
bus | Volatile same-host shared-memory transfer over iceoryx2; full queues never overwrite unread events | Not durable messaging, not a network database, and polling costs CPU |
state | Consistent immutable generations with atomic compare-and-publish, epoch and watermark | No disk checkpoint and no lock-free guarantee |
book | L2 snapshots, deltas, top-N and checks on gaps, resets, capacity and source coverage | No L3 engine and no venue connector |
replay | Causal event access: later information cannot change an earlier view | No sandbox against external future information |
query | Resident typed as-of and revision queries with watermark, tombstones, projection and limits | No SQL, no joins, no persistent disk index |
arrow | Exact Arrow and Parquet exchange with scales, metadata and UTC ns | No implicit casts and no clock qualification |
| Package | What exists | Main limit |
|---|---|---|
runtime | Raw and ledger handling, quality, features, native storage and as-of reads, with group commit and documented counting rules | Input is normalised trades and L10 today; controlled release qualification is open |
fix | Offline FIX 4.4 fixture profile: framing, checksums, fragments, snapshots, deltas, gaps, resnapshot behaviour | No live FIX session and no order router |
clock | Admission and assessment of time evidence: UTC checks, proof age, error budget, host and boot identity, step monitoring | Not a synchronisation daemon — chrony or equivalent does that |
calibrate | A separate real IPC qualification tool with histograms, CPU and RSS, and hashed receipts | Qualifies only the measured path — not the runtime, the disk or a feed |
cli | Local commands and dispatch, including doctor against an ops config | Module presence is not health evidence and not a binary hash |
dist | Offline build, package, verify, install, rollback and targeted uninstall, against a trusted manifest digest | A build receipt is not a cryptographic signature; no universal ABI and no published release |
| Package | What exists | Main limit |
|---|---|---|
news | News archive with append-only revisions and causal as-of views in .gqo.txt, lossless compression, byte-exact unpack | Continuous source and retention integration still open |
reference | Instrument metadata with effective time and known time: symbols, scales, contract factors, tick and quantity steps, sessions | Calendar, DST and corporate actions are limited |
fundamentals | Exact releases and vintages on the news storage, with units and periods; missing stays missing, never zero | No connected vendor feed |
quality | Record validation, stream continuity and freshness, with a bounded worker | Missed checks stay explicit; streaming saturation is not qualified |
features | Five exact incremental features — spread, L10 imbalance, microprice, rolling return, rolling volume — with provenance and availability | No full feature store; a trade correction is not yet handled as a distinct event |
models | Lossless artifact storage with CRC and SHA-256 and verified restore | No training, inference or quantisation — fewer bytes on disk is not less inference RAM |
backtest | Single-instrument fill simulation with explicit assumptions, latency, partial fills and exact fees | No real exchange queue |
execution | Paper order lifecycle, idempotency, cancel races and exact accounting | No broker router, and no authorisation for live trading |
risk | Explicit feasibility and constraint checks, with internal targets kept separate | No optimizer and no execution authorisation |
experiments | Immutable manifests with config, code, input and result hashes, seed and verified run status; functional tests present | Launches no workload of its own |
ops | Read-only doctor, deterministic health assessment and policy checks over progress, clock, quota and latency observations | Missing measurements stay unknown, never zero and never green |
Suite totals: 13 + 6 + 11 = 30 workspace packages in the audited copy, listed in the audited source manifest of the private engine repository (226 files).
Historical runs on fixed datasets and configurations. Figures were recomputed from the stored JSON results for this audit, and 30 result files matched the hashes in their historical build receipts. A cell says either not shown — the figure exists but is not reproduced here — or not measured, which means the study never produced it.
1,048,576 Bybit level rows from 7,265 events, 32 blocks or row groups. One warm-up, six measured rounds, medians. Warm page cache, one host. File-sync counted; directory sync, atomic publication and physical power-loss qualification not.
| Format | Bytes | Write + file-sync | Full read |
|---|---|---|---|
| GQODB | 3,703,770 | 198.361740 ms | 39.972222 ms |
| Parquet dictionary-LZ4 | 5,950,242 | 313.210893 ms | 41.620335 ms |
| Parquet delta-LZ4 | 9,242,314 | 248.710886 ms | 56.811581 ms |
Against dictionary-LZ4: −37.7543% bytes, −36.6683% write, −3.9599% read, using 100 × (1 − GQODB / reference). This is an order-book measurement, not a tick or trade storage measurement, and it excludes the original collector envelope — so it is not evidence that the same saving holds for all original source bytes. Nothing here is a claim about cold disk, network access or a full database replacement.
Two pre-selected Bybit level samples, Arrow → bytes → Arrow in memory, one warm-up and nine measured passes per codec. No full file I/O.
| Sample | Codec | MB | Encode | Decode |
|---|---|---|---|---|
| hour06 | Previous GQODB adaptive | 7.350 | 206.842 ms | 43.348 ms |
| hour06 | GQODB book | 3.693 | 179.077 ms | 40.016 ms |
| hour06 | Parquet dictionary-LZ4 | 5.995 | 298.941 ms | 34.941 ms |
| hour07 | Previous GQODB adaptive | 6.901 | 204.962 ms | 40.480 ms |
| hour07 | GQODB book | 3.529 | 178.008 ms | 39.289 ms |
| hour07 | Parquet dictionary-LZ4 | 6.183 | 299.867 ms | 34.372 ms |
48.9–49.8% smaller than the previous GQODB codec and 38.4–42.9% smaller than dictionary-LZ4 Parquet, at 14.3–14.5% longer decode than that Parquet baseline. Note what this does not say: the new codec decodes faster than the old GQODB one — it is Parquet that decodes faster than both. B11 and B15 are different source versions and different measurement boundaries.
2,000 real AG News documents, 6,000 records with synthetic revisions and arrival times; five rounds of 1,024 queries per engine. GQO reads from an already-loaded embedded archive; PostgreSQL and MongoDB include client, driver and TCP cost. This is not a comparison of five equivalent network servers.
| Engine | Read p99 | Durable write p99 |
|---|---|---|
| GQO resident | 3.967 µs | 2,039.667 µs |
| PostgreSQL pglz | 116.370 µs | 998.859 µs |
| PostgreSQL lz4 | 156.490 µs | 1,008.402 µs |
| MongoDB Snappy | 989.414 µs | 2,216.059 µs |
| MongoDB Zstd | 773.916 µs | 2,150.121 µs |
Opening, decompressing and validating the compact-wide archive costs a warm median of 95.923 ms — so the 3.967 µs query is not the total time of a fresh CLI process. PostgreSQL is faster at individual durable writes here. The small write differences against MongoDB are not a general ranking.
| Stored form | Heldout, 6,000 records | Originals, 2,000 records |
|---|---|---|
| GQO compact-wide archive | 379,451 B | 245,996 B |
| GQO raw + compact-wide | 4,618,086 B | 1,582,053 B |
| PostgreSQL data + indices | 5,734,400 B | 1,818,624 B |
| MongoDB Snappy data + indices | 2,031,616 B | 692,224 B |
| MongoDB Zstd data + indices | 1,396,736 B | 483,328 B |
Keeping the raw bytes and the archive is smaller than the PostgreSQL relation storage and larger than both MongoDB variants on these samples. Shared WAL, journal and cluster allocations are not a fair per-dataset measure and are outside this table. PostgreSQL effectively did not compress these short payloads, which proves nothing about its compression on long articles.
| File | Original | Compact archive | Saved |
|---|---|---|---|
| One UBJ model | 341,702 B | 59,727 B | 82.5207% |
| One predictor file | 117,919,359 B | 20,342,194 B | 82.7491% |
Exact restore was verified in the historical run. The second file is a predictor artifact, not a large weight model. Both source files were recomputed from existing receipts for this audit rather than reopened; that run's output lived on tmpfs. No claim about inference, training, quantisation or disk power loss.
p99 minimum to maximum across three runs, measured from scheduled offer to usable receive.
| Route | p99 | Conditions |
|---|---|---|
| Shared memory | 0.895 – 0.912 µs | Actively polling endpoints — costs CPU |
| Unix socket | 7.893 – 14.443 µs | Different waiting behaviour |
| Redis Pub/Sub over Unix socket | 49.082 – 51.062 µs | Same binary payload, no TCP, no AOF or snapshot persistence, bounded PUBLISH pipeline |
| TCP network or durable bus | not measured | No equivalent comparison exists |
A local Redis comparison exists — it is simply not an equal CPU, durability and network contract. B08 measured 64-byte shared-memory messages at 500k/s at 0.964–0.990 µs scheduled-to-usable p99, which does not extend to every payload or rate. The B09 L10 case cycles 744 real snapshots for load.
| Variant | Trials | Measured events | Sequence / payload errors | Trials with scheduled p99 ≤ 1 µs |
|---|---|---|---|---|
| Baseline | 20 | 5,200,000 | 0 / 0 | 3 |
| Speed mode | 20 | 5,200,000 | 0 / 0 | 5 |
| Together | 40 | 10,400,000 | 0 / 0 | 8 |
Zero detected errors is an observation in these runs, not a guarantee of lossless delivery after a crash. Speed mode is not consistently better, and the largest single latency in the assessment is 292.345 µs.
| Path | p99 across three runs | What it measures |
|---|---|---|
Feature Engine::process | 0.551 – 0.553 µs | A local computation with synthetic times on already-normalised input |
Quality spin try_submit | 0.521 – 0.527 µs | Offering work to a separate worker thread — the check is not necessarily finished |
| Quality spin, report retrieved | 2.225 – 2.405 µs | Caller plus worker plus fetching the result |
Only the feature path is a single local engine call; the quality figures involve a caller and a worker thread. The quality study keeps one job outstanding at a time, so it does not establish streaming capacity under saturation, and spin can occupy a logical CPU continuously. Real clock acquisition, the feed, raw fsync and downstream publication are all outside these numbers — and none of them is a theoretical floor for other implementations.
An engineering baseline, not a release comparison: 1,000 synthetic records — 500 trades and 500 L10 snapshots — through raw and ledger sync with real quality, feature and compression workers on ext4. The host was running concurrent builds and checks at the time.
| Measure | Observation |
|---|---|
| Input | 2,658,033 B |
| Native derived files | 2,654,936 B |
| Valid records / feature frames | 1,000 / 1,000 |
| Capture duration | 18.522 s |
| Capture rate | 53.989 records/s |
| Consecutive receipt interval p99 | 38.900 ms |
| Capture plus background completion | 18.554 s |
The output bytes above exclude raw journals and quality and feature reports, so total storage exceeds input: this small-block run shows no meaningful net compression win. The receipt interval is not a bus hop and not full upstream event latency. The run predates part of the group-commit and metadata work in the audited copy, so no untested improvement should be credited to it. This belongs beside the favourable microbenchmarks, not behind them.
| Measurement | Result | Status |
|---|---|---|
| Controlled release benchmark of the full chain | not measured | An engineering baseline exists; an equal-workload, equal-durability comparison does not |
| kdb+ / q comparison | not measured | Protocol written; never run |
| Cold disk, full disk, large datasets | not measured | Every storage figure above is warm-cache |
| Physical power loss | not measured | Fault injection is tested; a physically cut machine is not |
| Long-running load, multiple consumers, source reconnects | not measured | Including receipt ambiguity and producer deduplication |
| Current group-commit and metadata work | not measured | Historical per-record figures must not be swapped for it without a new run |
| Installed-suite chain from an empty prefix | not measured | Fixture install is tested; a published suite install is not |
Every claim on this site sits at one of five evidence levels, named where the claim is made. The source directory kept changing during development, so the tests ran against a frozen copy with a per-file hash manifest — 226 files, captured at 20:12:15 UTC on 18 September 2026. The earlier 19:32 snapshot is not retroactively treated as if it already contained the later code.
| Level | What it supports | What it does not support |
|---|---|---|
| Source present | A function and its contract exist in the frozen version | That every path is correct, or that it runs in production |
| Functionally tested | Concrete fixtures, error cases and assertions pass on this host | Universal correctness, proven performance, or recovery from every hardware fault |
| Historically measured | A stored run holds results for one fixed workload and measurement boundary | The same outcome on another machine, source version or dataset |
| Hash checked | The bytes checked equal the bytes named in a receipt | Independent authentication of the author, or a correct measurement method |
| Still open | The evidence was not found here, or was never produced | That the thing never happens anywhere outside this repository |
$ CARGO_TARGET_DIR=/…/gqodb/target \ cargo test --workspace --locked --offline --lib --tests -j 2 # 282 passed · 0 failed · 0 ignored · 85 completed test targets
This does not re-accept doc-tests, every example, Clippy, formatting or a release build. Workspace tests do include the short, explicitly unqualified IPC selftest.
Imports 8,192 records, waits for a partially committed durable prefix, kills its own subprocess, reopens, recovers, and completes the import.
Record count, a single input charge, the recovered raw SHA-256, and recognition of the re-import. Strong evidence for this import path under process failure.
Not a physical power-loss test, and not a broker reconnecting mid-stream. The test environment is temporary local storage.
30 result files matched the hashes in their historical build receipts. That proves byte agreement with a chosen digest — not that the measurement method was right.
An installer fixture is not a complete published suite installation, and a kill test of a bounded import is not a live-feed soak test. Green tests do not widen their own scope.
No live feed, no trading service, no training run, no long latency qualification, and no physical host-clock calibration were started. It is new functional test evidence plus a recomputation of existing measurements — not a new performance benchmark and not a production certification.
| Evidence file | Contents |
|---|---|
source-manifest.json | The frozen source copy: 226 files with per-file hashes |
cargo-test.log | The full test log behind the 282 / 0 / 0 result |
test-result.json | Machine-readable test summary |
verified-metrics.json | Recomputed benchmark figures and the receipt hash checks |
verify_evidence.py | The reproducible check script |
All in the private engine repository.
The open layer is a public repository with its evidence beside it — result files, build receipts and a script that recomputes every codec figure on this site, so you can check them instead of trusting them. The engine is not published, and its audit evidence stays private. Both are stated here rather than implied.
A benchmark you cannot reproduce is marketing. The point of publishing the source and the evidence together is that every figure on this site becomes checkable: the frozen manifest says which bytes were tested, the log says what passed, the receipts say which result files are untouched.
| Part | What it is | Licence |
|---|---|---|
| Tick codec | The lossless trade and tick compression profile, with its format header and reader | Apache-2.0 |
| Book codec | The order-book profile: run reduction and byte planes over level rows, with no depth limit — B15 averaged 144 level rows per event | Apache-2.0 |
| Format spec and reader | Segment framing, header detection and a reader that restores exact values and checks integrity | Apache-2.0 |
| Benchmark protocols and evidence | The written protocol per run, the test log, the source manifest and the verification script | Apache-2.0 |
| The database around it | Raw journal, ledger and receipts, recovery, quality, features, causal query, ops and connectors | commercial |
The split is deliberate. A codec is worth giving away: it is checkable in an afternoon, it is the
part these benchmarks actually measure, and every file it writes is a .gqodb file. The
database is a different kind of work — a journal, a ledger, receipts, recovery and causal reads — and
that is the part with a price on it.
The repository holds the four open crates, the format notes, the B06 and B11–B15 result files with their receipts, and a verifier that recomputes the figures. The Apache-2.0 licence covers that repository only; the engine is not part of it.
The open layer stays free. The intended commercial model is one clear single-node price, followed by custom contracts only when a deployment needs more nodes, availability or operational commitments. There is no released engine binary and both commercial options remain unavailable for purchase.
Sales are not open. “Coming soon” is a product announcement, not a checkout or an offer to transact. Purchase links will remain disabled until the release, seller details, VAT treatment, written terms, refund rule and delivery boundary are published.
Nothing here is a link yet. A row fills in when a build has a platform, a version and a manifest digest published beside it.
| Artifact | Platform | Version | Manifest SHA-256 | Size |
|---|---|---|---|---|
| Suite bundle, offline | not published | not published | not published | not published |
gqodb CLI | not published | not published | not published | not published |
| Source tarball | not published | not published | not published | not published |
A bundle is only meaningful with its build receipt and manifest digest beside it. A build receipt is also not a cryptographic signature: SHA-256 proves agreement with a chosen digest, not that the publisher is trustworthy.
These exist today. The build refuses a dirty working tree, reads Cargo's actual binary paths and writes hashed receipts; install checks the bundle manifest against an explicitly trusted digest, stages a full release, then swaps the activation link atomically.
$ gqodb-dist build SOURCE_ROOT NEW_RECEIPT.json $ gqodb-dist package RECEIPT.json NEW_BUNDLE VERSION $ gqodb-dist verify-bundle BUNDLE MANIFEST_SHA256 $ gqodb-dist install BUNDLE PREFIX MANIFEST_SHA256 $ gqodb-dist verify PREFIX $ gqodb-dist rollback PREFIX RELEASE_ID $ gqodb-dist uninstall PREFIX RELEASE_ID
Older releases stay available for an explicit rollback. Uninstall removes checked manifest-owned files; modified or extra files can make it refuse rather than delete.
Placeholders in capitals are yours to fill in. setup writes a configuration — it does not start a feed or initialise a runtime data directory.
$ gqodb --help $ gqodb --version $ gqodb modules # configuration, then a check of it $ gqodb setup NEW_CONFIG.json native $ gqodb check CONFIG.json # a demo capture, then read the book at one UTC nanosecond $ gqodb demo NEW_FILE.gqodb.replay $ gqodb show FILE.gqodb.replay 2026-09-08 12:00:00:123:456:790 # offline FIX 4.4 fixture import $ gqodb import-fix FIX_CONFIG.json INPUT.jsonl NEW_OUTPUT.gqodb.replay # host and runtime health, and an explicit clock check $ gqodb doctor OPS_CONFIG.json RUNTIME_DIR $ gqodb clock-check REPORT.json MAX_ERROR_NS
doctor is read-only and deterministic: a missing measurement stays unknown rather than passing as green. Module presence is not health evidence.
Native Linux x86_64 and aarch64 are the build targets. The audited tests ran on one local host only — no distribution, glibc or clean-machine release is qualified.
External synchronisation required. The host must be UTC and synchronised; GQODB admits and assesses clock evidence, it does not discipline the clock.
One writer at a time, with a free-space reserve held back so a full disk fails cleanly instead of corrupting a segment.
1 TB cumulative input per data directory (1,000,000,000,000 bytes, decimal), tracked in a local ledger a configuration may lower. The counting rules are documented; commercial policy is not.
This page records what the current static site does, what it does not do, and which safeguards must exist before sales open. A checklist is useful evidence of work; it is not a guarantee of legal compliance and it does not replace advice for the final seller, licence or customer jurisdiction.
The deployed site runs no analytics, advertising pixels, account system or contact form. If you email contact@gqodb.com, the sender address and message are used to answer the request.
Hosting infrastructure may process ordinary request data such as IP address, requested path, time and user agent to deliver and secure the site. Exact controller identity, legal bases, retention and processor terms still require final publication.
The public site sets no cookies and writes no application data to local storage. It therefore shows no consent banner: asking for consent when there is nothing optional to accept would be misleading.
If analytics, embedded media or another non-essential service is added later, this statement and the consent mechanism must be reviewed before deployment.
The €250 single-node price and Custom tier announce an intended model, not an available offer. There is no payment link and no hidden checkout fee.
Seller identity, address, VAT treatment, licence terms, delivery definition, cancellation or withdrawal handling and refund policy must be published before a purchase control is enabled.
Use contact@gqodb.com for access, correction or deletion requests, or to report an accessibility problem. Identity may need to be verified before personal data is disclosed or changed.
The site targets semantic HTML, visible focus, keyboard navigation, readable contrast, reflow and text alternatives. It has not yet received an independent WCAG conformance audit.
mailto: link.Open items, with the ones the audit closed marked as done. Nothing here is scheduled, and the order is a grouping, not a commitment.
doctor and deterministic health assessment, in gco-ops and through the CLI.gqodb-codec and gco-ops now carry source and tests — 30 packages, no design-only pair.