FerroDruid - Rust-native Apache-Druid-compatible OLAP

FerroDruid is a Rust-native, Apache-Druid-spec-compatible real-time OLAP database. It speaks the Druid REST API, native query JSON, and Druid SQL, and it reads and writes Druid segment v9/v10 binary files - without a JVM, without ZooKeeper, and without a six-process control plane to operate. A classic Apache Druid cluster needs six or more JVM processes plus ZooKeeper plus an external metadata database, and 16 GB or more of RAM, before it serves a single query. FerroDruid's single-binary mode replaces all of that with one process that starts in under a second, uses under 200 MB of RAM, and ships as a self-contained AMI. What FerroDruid does today (v1.0 GA): it serves all eight Druid native query types (timeseries, topN, groupBy, scan, search, segmentMetadata, dataSourceMetadata, timeBoundary); it runs Druid SQL with SELECT, WHERE, GROUP BY, HAVING, ORDER BY, LIMIT, more than 30 functions, EXPLAIN PLAN FOR, and an MSQ task endpoint (core SQL parity approximately 95 percent); it exposes more than 40 Druid-compatible REST endpoints; it reads and writes Druid segment v9/v10 (the supported single-binary path uses SQLite metadata plus local-filesystem deep storage); it ingests from Kafka and Kinesis supervisors and via native batch; and it enforces Basic authentication (Argon2id) with role-based access control on by default and TLS via rustls. Admin password security: on first boot the AMI generates a NEW RANDOM admin password UNIQUE to that instance (never a default or shared password) and writes it once to the instance system log. The admin account is flagged must-change, so EVERY API endpoint returns HTTP 403 until the operator rotates the password by POSTing a new one to /druid-ext/basic-security/authentication/db/basic/users/admin/credential; the rotated credential is persisted and survives restarts. This enforces a password change on first login. v1.0 GA hardening posture: every crate uses forbid(unsafe_code); clippy is clean at -D warnings workspace-wide; 57k+ test functions in-tree; 21 fuzz targets on a continuous 24h farm; CycloneDX SBOM in CI; cargo-audit 0 advisory. Live wire deep-match is 5 of 5 against Apache Druid 30.0.1 and 5 of 5 with an Apache Superset connector, plus a byte-eq conformance harness covering Druid 30-36. 3-host EC2 nemesis matrix (sym-partition, asym-partition, leader-kill, disk-full, OOM, corrupted-segment, clockskew multi-host) all PASS at the safety layer with dup_leader_terms=0 term_regressions=0 recovery_ok=1. Cluster-wire mTLS election-storm root-caused (Wave 2 W2-E) and source-fixed (Wave 2 continuation B1+B2): cluster-wire promotions per second collapsed from 0.93-1.20 to 0.19 on same-shape 3-host c7g.large re-fire, a 4.9x reduction, within 19 percent of the PSK-baseline 0.16 per second. Honest scope: live validation covers Apache Druid 30-36 via the byte-eq harness (Druid 30 deep-matched; 31-36 covered by residuals honestly disclosed in docs/KNOWN_LIMITATIONS.md and docs/due-diligence/honest-limitations.md); single-binary mode is the supported Marketplace topology, with multi-node classic 6-role topology in scope in-tree; multi-node deployments fail closed by default. Honest limitations carried forward for v1.x are enumerated in the release notes and in the in-tree docs/KNOWN_LIMITATIONS.md and docs/due-diligence/honest-limitations.md files: CL-A1-R-mTLS-residual-churn (post-fix 0.19 per second cluster-wide steady-state, safety intact), CL-1.0-in-memory-raft (single-binary Raft log is in-memory), CL-A1-R-oomkill-choom-need-workload-rss, CL-5-R-longrun-chaos-2h-window, TG-1-finding-W2A-1-index-drd, CL-1-R1 multi-broker Kafka MSK, CL-B5 mTLS CRL-OCSP, CL-J1-R2 broker-to-coordinator wire, CL-J1-R4 single-port permissive. This listing sells a hardened, scanned, supported distribution built from the Apache-2.0 source at a pinned release version; the code itself remains Apache-2.0. The AMI is metered automatically by AWS per running instance-hour, with no metering code in the product.