quorumdb · distributed SQL
zero safety violations.
Designed, built and measured by Sankur KunduOpen source (Apache-2.0) · page updated 15 Oct 2026
A distributed SQL database that psql connects to, built one proven layer at a time: a crash-safe LSM storage engine, Raft consensus, a sharded multi-Raft store that splits and rebalances itself, and serializable transactions across machines. Every layer is tested the way FoundationDB is.
$ quorumdb raft-sim --seeds 10000 ok: 10000 clusters x 10s simulated 198745186 messages (22893424 lost) 610064 crashes, 144354 partitions 118136 leaders elected 14289650 writes acknowledged 5844923 linearizable reads 0 safety violations
Built one proven layer at a time
Each layer is finished only when its own checker passes under random crashes, partitions and clock skew.
Storage and consensus
A crash-safe LSM storage engine under Raft consensus, and a sharded multi-Raft store that splits and rebalances itself.
Transactions
ACID transactions across machines at snapshot and serializable isolation, protocol model-checked in TLA+.
SQL
The PostgreSQL wire protocol: psql connects, with joins, aggregates, EXPLAIN and serializable transactions.
Every run replays from one seed
Deterministic simulation, as FoundationDB pioneered: one seed replays a whole run of random work, crashes, partitions and clock skew exactly, and a checker proves every history linearizable or serializable.
610,064 crashes
Across 10,000 simulated clusters and 198.7 million messages, 22.9 million of them lost: zero safety violations.
15 / 15 planted bugs
From torn log tails to the Raft paper's Figure 8, every planted bug is caught; the method found 6 real bugs before release.
Time-travel debugger
Steps any simulated Raft cluster event by event, and backward by replay.
TPC-C, serializable
A TPC-C-derived benchmark drives the whole stack through SQL, one terminal for 60 seconds.
| Transaction | Commits | p50 | p99 |
|---|---|---|---|
| NewOrder | 1,503 | 18 ms | 284 ms |
| Payment | 1,414 | 9 ms | 55 ms |
| Delivery | 142 | 12 ms | 51 ms |
1,503 tpmC; TPC-C consistency conditions 1 and 2 hold after the run. A derived benchmark, not an audited TPC-C result.
Correctness you can replay
The verification methods of FoundationDB and AWS, applied to a database built from scratch.
Deterministic simulation
10,000 clusters, 610K crashes, every run replayable from one seed.
Model-checked protocol
The transaction protocol in TLA+: 337K states, zero violations.
Bugs found before users
15 of 15 planted bugs caught and 6 real bugs found before release.
Real SQL on top
PostgreSQL wire protocol and serializable transactions under a TPC-C-derived load.
Throughput is measured with one terminal on a TPC-C-derived benchmark, not an audited TPC-C run, and quorumdb has not been compared with production databases under the same load.
@software{kundu2026quorumdb,
author = {Kundu, Sankur},
title = {quorumdb: a distributed SQL database verified by deterministic simulation and TLA+},
year = {2026},
url = {https://github.com/Shakhtar-Sankur/quorumdb},
license = {Apache-2.0}
}Sankur Kundu
ML systems engineer & independent researcher · Bhubaneswar, India · sankur.kundu.tw@gmail.com
Builds the systems that train and serve language models. Also the author of lipi, a tokenizer that needs fewer tokens than GPT-4o's and Gemini's in 23 of 24 Indian languages; Babelguard, an open early-warning system for scams across languages; ratchet, RL post-training from scratch; kessler, an independent space-traffic audit that runs every day. Fixes merged into Apple's MLX, Meta's ExecuTorch, Hugging Face's OpenEnv and Oxford's PyZX, and pull requests in review at Google's JAX, NVIDIA, MIT, Carnegie Mellon and ETH Zurich.