Rift
Go and C++, MIT license
A distributed, transactional key-value database built from scratch. It has Raft, snapshots, membership changes, multi-raft with range splits, MVCC over hybrid logical clocks, Percolator-style transactions and linearizable reads.
I built the simulator before the database. The whole system runs inside it with no wall clocks, no goroutines and no global randomness, so any crash, network partition or clock jump replays exactly from one seed number. When a run fails, that seed fails the same way every time.
It has been through 25,000 fault-injected runs on each of the transaction and read-index layers with no safety violations. Along the way I found and fixed 67 bugs, and each one has a stored reproduction.
My favorite is BUG-060. After a leader was killed, the cluster served nothing for fourteen seconds, and every safety check still passed, because a cluster with no leader hasn't technically violated anything. A performance threshold caught it instead.
Umbra
C++, Apache-2.0 license
Sync for a folder of markdown notes where the server can't read anything. It only stores ciphertext, so it never sees note contents, file names or folder structure.
Since the server can't see edits, it can't resolve conflicts either. Merging happens on the devices, using CRDTs I wrote from scratch (Fugue for text, Kleppmann's move operation for the file tree). Search runs locally on a hand-written HNSW index.
It's tested against 23 adversarial schedules that cover partitions, message reordering, duplicate delivery, crashes and a misbehaving relay.
The command line tools work end to end. The desktop app is only partly done.
The LSM-tree storage engine that Rift and Umbra both run on. It has a write-ahead log, a skiplist memtable, SSTables with bloom filters, compaction and snapshots. It started inside Rift, and I moved it into its own library when Umbra needed it too.
It isn't fast. Writes are within 1.5x of LevelDB, but reads are about 9x slower. The numbers are in the benchmarks file.
It's built to survive being killed at any point during a write. The test for that kills it at every filesystem call (4,840 kill points in total), reopens the database, and checks that the recovered state is one the write could legitimately have produced.
