CIP-001–013: read/write distributed storage program

[ralyodio]

Introduces the CIP (c0mpute Improvement Protocol) process in docs/prds/ and plans the whole storage program end to end: durable distributed object storage, provider payouts, and a read/write POSIX mount.

CIPs are PRDs for shippable phases — scope, API surface, acceptance criteria, estimate. DIPs stay the record of why; a CIP implements a DIP and cites it. Numbering is independent.

Phases

#	Title	Est.
001	Durability model, tiers, economics	1 wk
002	Storage HTTP API on the gateway	1.5–2 wk
003	Cross-node shard placement + streaming transport	3–4 wk
004	Metadata durability: manifests, volumes, root pointer	3–4 wk
005	Auto-repair daemon	3–4 wk
006	Challenges, metering, provider payouts	4–6 wk
007	c0mputefs: mutable filesystem over immutable content	4–6 wk
008	Write path: chunking, journal, crash consistency	4–5 wk
009	c0mpute storage CLI + FUSE mount	3–4 wk
010	Single-writer leases and multi-mount coherence	3–4 wk
011	Client-side encryption and key management	2–3 wk
012	S3-compatible gateway	2–3 wk
013	Databases on c0mpute storage: support matrix	2–3 wk

35–49 engineer-weeks total; 21–29 on the critical path; ~5–7 months calendar with parallel tracks.

Key decisions

RS 10/14 stays default over 3-copy replication. The expansion factor is cost of goods: 1.4x vs 3.0x, and 1.97x cheaper than Storj's RS 29/80 at the same provider payout. Replication becomes the hot tier, where its 1x repair amplification is exactly the right trade for small, hot, frequently-rewritten data (filesystem metadata, inline small files).

Retail $0.0035/GB-month, undercutting Storj's $0.004. We cannot beat Filecoin ($0.0001) or Sia ($0.001) and CIP-001 says so plainly — they are cold or commitment-bound, and a POSIX mount over them is not a product. The defensible claim is "the cheapest p2p storage you can actually mount".

Repair egress is an unpaid provider obligation. Paying it at 5% churn costs $0.0014/GB-month against a $0.0014/GB-month gross margin — the entire margin. Storj handles it the same way, but it must be explicit in provider terms because it makes metered residential uplinks a bad fit.

RS 10/14 gives ~3.4 nines on 95%-available nodes, not 11. The "11 nines" in storage-pricing.csv needs ~99.9% per-node availability. So placement is reputation-gated (≥0.9 reputation, ≥99% uptime) and CIP-005's repair is load-bearing rather than a follow-up: our cost advantage is bought by spending the durability margin Storj keeps. scripts/storage-durability-sim.py reproduces every figure and is re-runnable with different (k, n, p).

All mutability is confined to one signed 32-byte root pointer per volume. Blocks, manifests and snapshot nodes stay immutable and content-addressed. The filesystem is a naming layer above that, not a change to the storage layer — which is what makes atomic rename and consistent reader snapshots nearly free.

v1 is one writer, many readers, enforced by an epoch-fenced lease rather than documented and hoped for. A fenced writer goes read-only and its divergent work is exported for a human, never auto-merged.

Two doc bugs fixed along the way

• dips/ contained two DIP-0012 files, both Accepted, both dated 2026-05-03, asserting opposite things — "compute-only, no storage network" vs "c0mpute hosts files". Neither declared supersession. The withdrawn v1 draft is now marked Superseded with a banner, and the index is fixed.
• The storage-plugin DIP listed "filesystem-style mutable objects" as out of scope. Amended, since v1 ships a read/write mount, with the reasoning recorded in CIP-007.

Notes for review

• Nothing here is implemented — this is planning. No Rust changes.
• The one executable artifact is scripts/storage-durability-sim.py (stdlib only), which backs CIP-001's tables.
• CIP-001 should be Approved before 002 starts; every later phase hard-codes its numbers.
• Open questions worth settling in review: whether repair egress should be partially paid to fix CIP-005's incentive gap (affordable at ~25% of rate, not full), and whether standard should be RS 10/14 or RS 16/24 if measured node availability lands under 99%.

🤖 Generated with Claude Code

https://claude.ai/code/session_01LsQAuvXkmyHTgnvquLHrRx

[github-actions]

ThreatCrush Security Scan

8 finding(s)

HIGH/CRITICAL: 5 | MEDIUM: 3

Severity	Rule	Location
HIGH	sh-remote-script-execution	scripts/dev-setup.sh:25
HIGH	sh-remote-script-execution	scripts/install.sh:159
HIGH	sh-remote-script-execution	scripts/install.sh:184
HIGH	sh-remote-script-execution	scripts/install.sh:277
HIGH	sh-remote-script-execution	scripts/install.sh:294
MEDIUM	js-unescaped-html-sink	apps/web/src/app/blog/[slug]/page.tsx:53
MEDIUM	js-unescaped-html-sink	apps/web/src/app/layout.tsx:89
MEDIUM	sh-eval-expansion	scripts/dev-setup.sh:35

Snippets are redacted; ThreatCrush never prints matched credential material.