Docs / Reference
Roadmap
What is true today, what is planned for v1 and what comes after. Planned work is worth nothing until it is built.
Pre-beta View Markdown
# Roadmap
> Status: Pre-beta. What is true today, what is planned for v1 and what comes after. Planned work is worth nothing until it is built.
Phases have exit conditions, not dates. Plan item numbers are given so that a claim here can be checked against the project's plan.
## Today
- Strict serializability for every transaction, including across shards.
- Every acknowledged write in the bucket; disposable nodes.
- PostgreSQL wire and an HTTP JSON API.
- Many named databases per deployment; activation on first request and release when idle.
- Whole-image backup, verification, scheduled backups and restore into a new database.
- Tigris and Cloudflare R2 exercised by the project.
## Before the beta
- The beta acceptance run: three hosts, node kills, 48–72 hours of load and a restore drill.
- Storage reclamation, switched on step by step with evidence.
## v1
| Area | Planned | Item |
|---|---|---|
| Schema changes | `ADD COLUMN`, `CREATE INDEX`, `DROP TABLE` | P10.1 |
| Clients | libSQL-compatible endpoint and ORM support | P10.2 |
| Keys and defaults | Generated integer keys; `DEFAULT CURRENT_TIMESTAMP` | P10.3, P10.4 |
| Introspection | A schema surface for migration tools | P10.5 |
| Leaving | Dump and load; one-command import from SQLite-dialect sources | P10.6, P10.6a |
| Client helpers | SDK retry on `40001`, lookup on `40003`; server-side retry of standalone statements | P10.7 |
| Certified list | What works, what is partial, what is refused | P10.8 |
| Vectors | A published contract for exact vector search | P10.9 |
| Tokens | A read-only token; platform-issued short-lived tokens | P10.10, P10.13a |
| Fleet proof | Qualification at 100,000 databases | P10.11 |
| Tenancy | Scopes, paged listing, per-scope limits | P10.12 |
| Failover | 10 s or less at the median, kill to first SQL | P5.11 |
## After v1
| Area | Planned | Item |
|---|---|---|
| Branches | Fork by copy, then copy-on-write | P10.16, P6.8 |
| Recovery | Restore to a transaction ID | P10.17 |
| Insights | Query fingerprints, runtime share, read amplification | P10.23 |
| Fleet | Labels for agent, tenant and environment; listing that never activates | P10.53 |
| Change stream | One resumable cursor in commit order | P10.14 |
| Deploy requests | Diff, lint, gated apply, revert | P10.37 |
| Moves | One procedure for every data move; a home region per database | P10.41, P10.30 |
| Search | Full-text and approximate vector indexes | P10.18, P10.19 |
| Fleet proof | Qualification at one million databases | P10.25 |
| MCP | A server per database with a credential per query | P10.40 |
| Latency | Optional peer-durable mode; shared commit objects | P5.9, P10.55 |
## Gauntlet Cloud
A managed service is designed and not built. The plan is an invited alpha on dedicated deployments in one EU region, then a private beta with billing, then open sign-up. Bring-your-own-cloud packaging follows. No prices are published; see [pricing](https://gauntlet-db.stavros.xyz/pricing) for the model.
## Not planned
- An in-process library with offline sync. A write made offline cannot be strictly serializable against the bucket.
- PostgreSQL SQL in v1.
- Embedding generation inside the server.
---
Source: https://gauntlet-db.stavros.xyz/docs/roadmap
Connect this project to my existing Gauntlet database.
Context:
- Documentation index for agents: https://gauntlet-db.stavros.xyz/llms.txt
- Quickstart: https://gauntlet-db.stavros.xyz/docs/quickstart.md
- SQL compatibility and error codes: https://gauntlet-db.stavros.xyz/docs/sql/compatibility.md
- Database: the one already configured for this project
- Protocol: PostgreSQL wire or the native HTTP JSON API, whichever this project already uses
- Connection values are in environment variables: GAUNTLET_DATABASE_URL (PostgreSQL wire),
GAUNTLET_HTTP_URL (HTTP base URL) and GAUNTLET_DATABASE_TOKEN (the database token).
These names are a convention, not a shipped SDK setting. Keep this project's own names if it has them.
Before editing, read the Gauntlet documentation above and inspect how this project
already talks to its database. Gauntlet is pre-beta software; where the documentation
and my deployment disagree, tell me instead of guessing.
What Gauntlet is:
- A distributed SQL database. SQL is the SQLite family, run by the Turso engine.
- The PostgreSQL wire protocol is a transport only. There is no PostgreSQL SQL dialect,
no pg_catalog or information_schema, no extensions, and no ORM is certified yet.
- libSQL client compatibility is not available yet. Do not assume it.
Connecting:
- PostgreSQL wire: dbname is the database name, the user name is ignored, and the
password is the database token. Authentication is SCRAM-SHA-256. Keep TLS
verification on (sslmode=verify-full with the deployment's CA certificate).
- HTTP: POST <GAUNTLET_HTTP_URL>/db/<name>/sql with a JSON body
{"sql": "...", "params": [...]} and the header "Authorization: Bearer <token>".
POST /db/<name>/tx runs a list of statements atomically.
SQL rules that differ from PostgreSQL:
- Every table needs an explicit primary key, and INSERT supplies the key value.
- CREATE TABLE is a standalone statement outside a transaction. There is no ALTER TABLE,
DROP TABLE or CREATE INDEX; an index comes only from a UNIQUE constraint at creation.
- Parameters are $1, ?1 or ?. Names are single-part (no schema.table).
- Column types follow SQLite affinity. In prepared statements ordinary columns are
described as text; CAST(x AS INTEGER) when the driver needs a number.
Errors you must handle (SQLSTATE):
- 40001: conflict. Roll back and retry the whole transaction. Locking is no-wait, so
this is normal under contention.
- 40003: commit outcome unknown. Do NOT retry. Look the transaction up with
GET /db/<name>/txn/<txid> and replay only if the status is `aborted`.
- 57P03: cannot serve right now. Roll back, then retry the whole transaction with backoff.
- 53300: too many connections. Back off; keep the pool below the node's limit.
Credentials and scope:
- Use only the database token for this one database. Keep it server-side and out of
source, logs, browser bundles and this conversation.
- Never use or ask for a deployment admin token, a client token or bucket credentials.
- Do not create, drop, back up, restore or branch databases, and do not rotate credentials.
Task:
1. Add the smallest connection integration that fits this project.
2. Run one explicit `SELECT 1` connectivity check. It may activate this database if it
is idle; do not probe or wake any other database.
3. Do not change the schema or write application data unless I ask for it.
Report the files changed, the protocol and client used, the result of the check, and
anything this project needs that Gauntlet does not support.Phases have exit conditions, not dates. Plan item numbers are given so that a claim here can be checked against the project's plan.
#Today
- Strict serializability for every transaction, including across shards.
- Every acknowledged write in the bucket; disposable nodes.
- PostgreSQL wire and an HTTP JSON API.
- Many named databases per deployment; activation on first request and release when idle.
- Whole-image backup, verification, scheduled backups and restore into a new database.
- Tigris and Cloudflare R2 exercised by the project.
#Before the beta
- The beta acceptance run: three hosts, node kills, 48–72 hours of load and a restore drill.
- Storage reclamation, switched on step by step with evidence.
#v1
| Area | Planned | Item |
|---|---|---|
| Schema changes | ADD COLUMN, CREATE INDEX, DROP TABLE |
P10.1 |
| Clients | libSQL-compatible endpoint and ORM support | P10.2 |
| Keys and defaults | Generated integer keys; DEFAULT CURRENT_TIMESTAMP |
P10.3, P10.4 |
| Introspection | A schema surface for migration tools | P10.5 |
| Leaving | Dump and load; one-command import from SQLite-dialect sources | P10.6, P10.6a |
| Client helpers | SDK retry on 40001, lookup on 40003; server-side retry of standalone statements |
P10.7 |
| Certified list | What works, what is partial, what is refused | P10.8 |
| Vectors | A published contract for exact vector search | P10.9 |
| Tokens | A read-only token; platform-issued short-lived tokens | P10.10, P10.13a |
| Fleet proof | Qualification at 100,000 databases | P10.11 |
| Tenancy | Scopes, paged listing, per-scope limits | P10.12 |
| Failover | 10 s or less at the median, kill to first SQL | P5.11 |
#After v1
| Area | Planned | Item |
|---|---|---|
| Branches | Fork by copy, then copy-on-write | P10.16, P6.8 |
| Recovery | Restore to a transaction ID | P10.17 |
| Insights | Query fingerprints, runtime share, read amplification | P10.23 |
| Fleet | Labels for agent, tenant and environment; listing that never activates | P10.53 |
| Change stream | One resumable cursor in commit order | P10.14 |
| Deploy requests | Diff, lint, gated apply, revert | P10.37 |
| Moves | One procedure for every data move; a home region per database | P10.41, P10.30 |
| Search | Full-text and approximate vector indexes | P10.18, P10.19 |
| Fleet proof | Qualification at one million databases | P10.25 |
| MCP | A server per database with a credential per query | P10.40 |
| Latency | Optional peer-durable mode; shared commit objects | P5.9, P10.55 |
#Gauntlet Cloud
A managed service is designed and not built. The plan is an invited alpha on dedicated deployments in one EU region, then a private beta with billing, then open sign-up. Bring-your-own-cloud packaging follows. No prices are published; see pricing for the model.
#Not planned
- An in-process library with offline sync. A write made offline cannot be strictly serializable against the bucket.
- PostgreSQL SQL in v1.
- Embedding generation inside the server.