What shipped
Signed notes live on GitHub Releases. This page is the public summary, not a substitute for git tags.
Canonical URLs, sitemap, and website/CNAME point at dbxdb.co.in. GitHub Pages still needs the custom domain saved in repo Settings and GoDaddy DNS A/CNAME records (see website/README.md). Mail to hello@dbxdb.io is unchanged and still has no MX.
A 20-slide 16:9 briefing for incubation meetings: thesis, USPs, Isolation Kernel, certified v1.1.0 numbers, BSL business model, 18-month plan, and the ask. Present at pitch.html (arrow keys, full screen, Print → PDF). Claims stay aligned with positioning and isolation docs — no invented ARR, no Redis-replacement language, no SOC 2 badge.
Published as GitHub Release v1.1.0 with dbx-server / dbx-orchestrator archives (linux/darwin/windows) and SHA256SUMS. Product stamps match this cut: dbx-server -version, HELLO/INFO, GET /info, the Python SDK, and the dashboard package. Publishing the tag also builds GHCR dbx-orchestrator:v1.1.0. Since v1.0.0: Linux strict Isolation Kernel, Unix-socket engines, faster vector ingest, tenant checkpoints, the public site on GitHub Pages, and the recorded product walkthrough. Landlock restrict_self is pinned to one OS thread so a busy Go runtime cannot get EPERM and fail-closed a tenant worker.
A recorded demo walks the public site (isolation bench, product pages, docs, pricing) and the operator dashboard (login, provision, tenant keys, console SET/GET/VADD, explorer, backup). Companion page: Walkthrough. The dashboard itself stays on :8000; GitHub Pages only serves the marketing site.
dbxdb.io has no DNS or MX (NXDOMAIN). Mail to hello@dbxdb.io and security@dbxdb.io cannot be delivered. The contact page now says so, copies the composed message, and opens a GitHub issue draft for non-security topics. The LICENSE address is unchanged; it starts working when the domain has a mailbox.
The marketing site keeps the ice-on-navy identity but reads more like a product surface: aurora wash, pointer glow, pill CTAs, tenant color-coding (acme / harbor / lumen), scroll reveals, a perspective SaaS grid, fluid orbs, themed scrollbars, screenshot lightbox, tenant inspector popups, hover tips, a command rail, and a back-to-top control. The isolation bench now accepts AUTH / SET / GET / VADD in the browser, ⌘K jumps across pages, certified counts animate in, and the architecture schematic uses the same tenant colors. Copy and certified limits are unchanged.
Orchestrator-managed engines bind Unix sockets on Linux/macOS instead of a loopback TCP port each. Public :6380 still AUTH's once, then reuses a small pool of unused worker dials. Vector ingest no longer holds the index write lock across HNSW insert, so search can run during graph construction. Checkpoints flush vector metadata, record per-index seals, and name the live snapshot in CURRENT so recovery does not pick a file by mtime.
The marketing and docs site is live at vanshjain-0702.github.io/DBX-Database-Extreme. Canonical URLs, sitemap, and the README globe link point there. dbxdb.io stays the intended custom domain; do not add website/CNAME until DNS is actually pointed at Pages.
Each tenant is a separate dbx-server process on Linux strict mode. Landlock LSM stops cross-tenant file access. WAL, snapshots, .vec.meta, and .hnsw are AES-256-GCM sealed under a per-tenant DEK; shredding the DEK provides O(1) cryptographic deletion. Unix sockets with SO_PEERCRED accept only the orchestrator PID. Per-worker control tokens prevent neighbour authentication. Production (TLS or DBX_PRODUCTION=1) refuses inprocess unless DBX_ALLOW_INPROCESS=1. Set DBX_REQUIRE_DISK_ENCRYPTION=1 to refuse boot on a plaintext volume.
Python SDK: TenantMemory.remember / recall / forget plus ControlPlane.shred. Measured under strict: 50k keys + 20k vectors survived restart; 100k sealed vectors at recall@10 0.950; idle worker ~14–17 MiB RSS. Honest limits: SQ8 rows unencrypted (use LUKS/fscrypt), Landlock governs file opens only, cgroup best-effort in containers.
Marketing and docs pages live in website/ and deploy from GitHub Actions Pages (.github/workflows/pages.yml). Live host is vanshjain-0702.github.io/DBX-Database-Extreme; dbxdb.io is reserved for a later custom domain. Python Lint runs flake8, Black, and pytest; live AUTH tests skip without env. make python-check is the local match. Docker publish and the root Dockerfile build deploy/Dockerfile (cmd/dbx-orchestrator), not the old cmd/orchestrator entrypoint. GHCR tags appear when a GitHub Release is published.
Reader keys cannot SET or VADD (tested). Orchestrator tenants have no default superuser. Production /metrics requires a Bearer JWT or DBX_INTERNAL_API_TOKEN. Dashboard Tenant keys mints reader/writer/tenant-admin credentials. Still a single-node profile: 100 tenants/node, 100k vectors/tenant. Not SOC 2. Not a cluster.
Per-tenant usage API and Prometheus /metrics. Export/import aliases for the portable tenant archive. Hibernate/wake evicts a cold engine without deleting it. CI runs a 12/4 density soak plus backup/restore; operators run make soak for 100 idle / 25 active. Python 15-minute path: examples/quickstart.py. Durable SETEX (node-redis setEx) sits on the same WAL path as SET … EX. Next.js and LangChain examples AUTH on :6380.
Cleared for production under 100 tenants/node, 100k vectors/tenant, durable strings + vectors. Windows certification: SET 186,147 ops/s, GET 284,785, ingest 7,233 vec/s, search p50/p95/p99 2.304 / 3.132 / 3.730 ms, recall@10 0.920 / p05 0.800. Hardware is attached on the performance page.
WAL v2, quotas, bounded expiry, panic boundaries, scoped keys, single RESP ingress on :6380, tombstones, and checksummed restore shipped in the August hardening. Optional async WAL replicas ack locally. Raft, cluster, tiering, and non-string RESP mutations fail closed.
Remaining follow-up from the roadmap is raising engine-package test coverage. Async replicas are available; they do not replace an operator 100/25 soak on your hardware.