KoutenDB v0.14.0

KoutenDB v0.14.0 adds a reproducible self-host operations path and hardens the database’s confidentiality and trust boundaries. The release combines versioned multi-architecture images, verified recovery workflows, safe lifecycle automation, explicit service roles, stricter authorization, and bounded protocol and C ABI inputs.

Self-Hosted Operations

  • official TLS-enabled linux/amd64 and linux/arm64 OCI image publishing through ghcr.io/puffball1567/koutendb;
  • a non-root, read-only single-node Compose deployment with persistent strong-durability storage, generated TLS/auth configuration, and health checks;
  • bounded watchdog restart behavior that distinguishes an unhealthy process from a persistent operational fault;
  • checkpoint creation, staged export, independent restore verification, scheduled backups, and verified-generation retention;
  • rollback-safe versioned image upgrades and certificate rotation;
  • bounded capacity history and forecasts plus content-derived, explicitly approved execution plans.

The operator executes only typed KoutenDB actions. It does not provision cloud instances, resize physical storage, or execute arbitrary infrastructure hooks.

Confidentiality And Access Control

  • separate reader, writer, replicator, and admin roles;
  • explicit peerAuth credentials for node-to-node replication and coordinator traffic;
  • galaxy-bound authenticated sessions and authorization-aware ring retrieval, listing, counting, querying, updates, deletes, and statistics;
  • admin-only topology migration and maintenance boundaries;
  • fail-closed non-loopback password deployment unless TLS, secret-key transport, or an explicit development override is configured;
  • bounded authentication guessing and identity-neutral challenge negotiation;
  • stable remote error categories that do not expose internal exception text.

Storage And API Hardening

  • new encrypted backups use Argon2id password derivation plus authenticated secretbox encryption while legacy V1 backups remain readable;
  • passphrases can come from owner-managed files or environment variables;
  • newly created POSIX data directories use mode 0700, managed artifacts use mode 0600, and symbolic-link output targets are rejected;
  • request and response framing limits are enforced before allocation;
  • C ABI payload, vector, batch, string, boolean, and orbital inputs are bounded and validated;
  • C ABI handles fail closed after close, and public API misuse raises catchable errors instead of process-ending assertions.

Validation

The release branch passed the complete core and smoke suites. The validation includes Linux and macOS C ABI builds, CA-verified TLS, role and peer-service authorization, galaxy and ring isolation, malformed protocol frames, encrypted backup migration, POSIX artifact permissions, crash and storage-failure recovery, topology migration, coordinator failover, Universe synchronization, and OCI image construction.

The security guarantees and their executable evidence are listed in the Security Validation Matrix. Self-host lifecycle invariants and operational boundaries are documented in v0.14 Self-Hosted Operations.

External driver repository releases remain independent from this core release. KoutenDB does not claim transparent WAL encryption, distributed login throttling, managed fleet PKI, automatic cloud provisioning, or independent penetration-test certification.