FerroDruid - Rust-native Apache-Druid-compatible OLAP

FerroDruid is a Rust-native, Apache-Druid-spec-compatible real-time OLAP database. It speaks the Druid REST API, native query JSON, and Druid SQL, and it reads Apache Druid segment v9 binary files (read compatibility verified against segments written by Druid 31.0.2 and 35.0.1, on local disk) - without a JVM, without ZooKeeper, and without a six-process control plane to operate. A classic Apache Druid cluster needs six or more JVM processes plus ZooKeeper plus an external metadata database, and 16 GB or more of RAM, before it serves a single query. FerroDruid's single-binary mode replaces all of that with one process that starts in under a second, uses under 200 MB of RAM, and ships as a self-contained AMI. What FerroDruid does today (v1.2.0): it serves all eight Druid native query types (timeseries, topN, groupBy, scan, search, segmentMetadata, dataSourceMetadata, timeBoundary); it runs Druid SQL with SELECT, WHERE, GROUP BY, HAVING, ORDER BY, LIMIT, more than 30 functions, EXPLAIN PLAN FOR, and an MSQ task endpoint (core SQL parity approximately 95 percent); it exposes more than 40 Druid-compatible REST endpoints; it reads Apache Druid segment v9 binaries - verified against segments written by Druid 31.0.2 and 35.0.1 - and writes segments in its own native format (the supported single-binary path uses SQLite metadata plus local-filesystem deep storage); it ingests from Kafka and Kinesis supervisors and via native batch; and it enforces Basic authentication (Argon2id) with role-based access control on by default and TLS via rustls. Admin password security: on first boot the AMI generates a NEW RANDOM admin password UNIQUE to that instance (never a default or shared password) and writes it once to the instance system log. The admin account is flagged must-change, so EVERY API endpoint returns HTTP 403 until the operator rotates the password by POSTing a new one to /druid-ext/basic-security/authentication/db/basic/users/admin/credential; the rotated credential is persisted and survives restarts. This enforces a password change on first login. Hardening posture: every crate uses forbid(unsafe_code); clippy is clean at -D warnings workspace-wide; 57k+ test functions in-tree; 21 fuzz targets on a continuous 24h farm; CycloneDX SBOM in CI; cargo-audit 0 advisory. Live wire deep-match is clean against Apache Druid 31.0.2, 32.0.1, 33.0.0, 34.0.0, 35.0.1 and 36.0.0: on each version, 42 of 48 deep-compared queries match byte-for-byte with 0 mismatches (Sections 1 through 4 are 30 of 30 deep on every version), plus 5 of 5 with an Apache Superset connector; Druid 30.0.1 is the one partial version at 24 of 48, where every diff is Druid 30's own upstream empty-result behaviour for SQL window functions, not a FerroDruid defect. New in v1.2.0: SQL UNION ALL with Druid-compatible positional column mapping; a null-generation load path so NULL-typed columns round-trip faithfully; fail-closed Historical segment routing with exact O(1) cache-limit accounting; and a verified read of a real Apache Druid v9 segment round-tripped through real AWS S3 deep storage. 3-host EC2 nemesis matrix (sym-partition, asym-partition, leader-kill, disk-full, OOM, corrupted-segment, clockskew multi-host) all PASS at the safety layer with dup_leader_terms=0 term_regressions=0 recovery_ok=1. Cluster-wire mTLS election-storm root-caused (Wave 2 W2-E) and source-fixed (Wave 2 continuation B1+B2): cluster-wire promotions per second collapsed from 0.93-1.20 to 0.19 on same-shape 3-host c7g.large re-fire, a 4.9x reduction, within 19 percent of the PSK-baseline 0.16 per second. Honest scope: single-binary mode is the supported Marketplace topology, with the multi-node classic 6-role topology in scope in-tree; multi-node deployments fail closed by default. Per-version residuals and honest limitations are disclosed in docs/known-limitations.md. Honest limitations carried forward for v1.x are enumerated in the release notes and in the in-tree docs/known-limitations.md file: CL-A1-R-mTLS-residual-churn (post-fix 0.19 per second cluster-wide steady-state, safety intact), CL-1.0-in-memory-raft (single-binary Raft log is in-memory), CL-A1-R-oomkill-choom-need-workload-rss, CL-5-R-longrun-chaos-2h-window, TG-1-finding-W2A-1-index-drd, CL-1-R1 multi-broker Kafka MSK, CL-B5 mTLS CRL-OCSP, CL-J1-R2 broker-to-coordinator wire, CL-J1-R4 single-port permissive. This listing sells a hardened, scanned, supported distribution built from the Business Source License 1.1 source at a pinned release version (github.com/abyo-software/ferrodruid; each release converts to Apache-2.0 four years after publication). The AMI is metered automatically by AWS per running instance-hour, with no metering code in the product.