Codec open, engine closed

A benchmark you cannot reproduce is marketing. The point of publishing the source and the evidence together is that every figure on this site becomes checkable: the frozen manifest says which bytes were tested, the log says what passed, the receipts say which result files are untouched.

The split is deliberate. A codec is worth giving away: it is checkable in an afternoon, it is the part these benchmarks actually measure, and every file it writes is a .gqodb file. The database is a different kind of work — a journal, a ledger, receipts, recovery and causal reads — and that is the part with a price on it.

Every published benchmark asset in the open repository — runner source, protocol and stored evidence — is named in a Git-tracked manifest; CI rejects result files outside Git. Raw market captures are not redistributed, and the manifest marks the two historical runs whose paired baseline commits predate the extracted public history. The installer builds the open tools from source with Rust 1.96, runs all tests and records the installed commit and binary hashes; eight consent tests also verify that missing prerequisites are never installed after Enter, n or end-of-input. Inspect scripts before running them. The Apache-2.0 licence covers that repository only; the engine is not part of it.

The open layer stays free. The intended commercial model is one clear single-node price, followed by custom contracts only when a deployment needs more nodes, availability or operational commitments. There is no released engine binary and both commercial options remain unavailable for purchase.

Sales are not open. “Coming soon” is a product announcement, not a checkout or an offer to transact. Purchase links will remain disabled until the release, seller details, VAT treatment, written terms, refund rule and delivery boundary are published.

Nothing here is a link yet. A row fills in when a build has a platform, a version and a manifest digest published beside it.

A bundle is only meaningful with its build receipt and manifest digest beside it. A build receipt is also not a cryptographic signature: SHA-256 proves agreement with a chosen digest, not that the publisher is trustworthy.

These exist today. The build refuses a dirty working tree, reads Cargo’s actual binary paths and writes hashed receipts; install checks the bundle manifest against an explicitly trusted digest, stages a full release, then swaps the activation link atomically.

$ gqodb-dist build SOURCE_ROOT NEW_RECEIPT.json
$ gqodb-dist package RECEIPT.json NEW_BUNDLE VERSION
$ gqodb-dist verify-bundle BUNDLE MANIFEST_SHA256
$ gqodb-dist install BUNDLE PREFIX MANIFEST_SHA256
$ gqodb-dist verify PREFIX
$ gqodb-dist rollback PREFIX RELEASE_ID
$ gqodb-dist uninstall PREFIX RELEASE_ID

Older releases stay available for an explicit rollback. Uninstall removes checked manifest-owned files; modified or extra files can make it refuse rather than delete.

Placeholders in capitals are yours to fill in. setup writes a configuration — it does not start a feed or initialise a runtime data directory.

$ gqodb --help
$ gqodb --version
$ gqodb modules

# configuration, then a check of it
$ gqodb setup NEW_CONFIG.json native
$ gqodb check CONFIG.json

# a demo capture, then read the book at one UTC nanosecond
$ gqodb demo NEW_FILE.gqodb.replay
$ gqodb show FILE.gqodb.replay 2026-09-08 12:00:00:123:456:790

# offline FIX 4.4 fixture import
$ gqodb import-fix FIX_CONFIG.json INPUT.jsonl NEW_OUTPUT.gqodb.replay

# host and runtime health, and an explicit clock check
$ gqodb doctor OPS_CONFIG.json RUNTIME_DIR
$ gqodb clock-check REPORT.json MAX_ERROR_NS

doctor is read-only and deterministic: a missing measurement stays unknown rather than passing as green. Module presence is not health evidence.

Requirements and limits