ADR 0015: A maturity label is earned by a checklist, not asserted

Status: Proposed Date: 2026-10-25 Scope: orbit-rs Deciders:

Context

The public overview, docs/features.md, docs/status.md, docs/index.md and docs/quick_start.md call orbit-rs “Production-Ready”, mark nearly every feature “Production Ready”, and say “7 complete protocols”. Against the facts: the PostgreSQL conformance floor is 768 of 816 records (94.1%) and the corpus does not yet cover the extended protocol, COPY, ORM traffic, pg_dump, psql \d* or concurrency; pg_dump cannot read orbit-rs; no other protocol has a corpus (ADR 0002, ADR 0006); and ADR 0008 says Symphony does not adopt orbit-rs until an exit gate passes. “Production Ready” was a label someone wrote, not something anyone could check.

Decision

Every component (a protocol layer, the SQL engine, replication, the storage engine) carries exactly one of three labels, and a label is used only when its checklist is met and recorded in docs/content/status/MATURITY.md with the date and the evidence.

  1. Experimental: the default. No conformance corpus, or one that is not run in CI. May change without notice.
  2. Preview: all of
    • a conformance corpus for the component’s target version (ADR 0006) that the real server also passes 100%, run in CI with a ratchet (ADR 0002);
    • durable storage, with a restart and recovery test;
    • for a replicated component, a test that kills the leader while it is in use and checks no acknowledged write is lost;
    • authentication on by default (no anonymous listener).
  3. General availability (GA): Preview and also all of
    • the corpus pass rate is 100%, or the failures are listed by name with the reason, in the status page;
    • a tested upgrade path, including a rolling upgrade for a replicated component (the guard in ADR 0014 is an example);
    • a tested backup and restore using the component’s standard tools (for PostgreSQL, pg_dump and pg_restore);
    • a soak or chaos run of at least 24 hours with the result recorded;
    • published benchmarks that meet ADR 0016 for the workloads the component claims to serve;
    • a security review recorded.

The words “production-ready”, “production grade”, “enterprise-grade”, “complete” and “100%” are not used for a component below GA. A status page row says “Experimental”, “Preview” or “GA”, with the date.

At the date of this record the evidence supports: PostgreSQL SQL engine Preview (corpus in CI, durable, Raft replication with a leader-kill test, authentication on by default; not GA because pg_dump fails and the corpus is below 100%); every other protocol and the storage tiers Experimental until a corpus exists. The owner decides these assignments when accepting this record.

Consequences

  • Status badges and “Production Ready” markers in docs/ are replaced by one of the three labels or removed.
  • A label can go down: a ratchet failure or a lost test moves a component back until the checklist is met again.
  • Symphony’s adoption gate (ADR 0008) refers to GA of the PostgreSQL SQL engine as one input.

Canonical wording

Status: <Experimental Preview GA> as of YYYY-MM-DD. See the maturity page for what that means and the evidence.

Verification

scripts/check_adr.py rejects the retired words in the documents it scans (make adr-check); the maturity page lists the evidence for each label; a label is changed in the same commit as the evidence.