Rust core & runtime
Typed workflow identities, DAG validation, bounded scheduling, handler registry, cancellation, and dependency outputs.
Rust-native workflow infrastructure
Workflows that survive the crash.
AetherFlow is building a durable workflow engine around recoverable execution, explicit state transitions, and event delivery you can reason about — even when processes disappear.
Rust · Tokio
PostgreSQL 18
NATS JetStream
Control plane / M07
Workflow definitionValidated DAG · deterministic IDs
READY
Durable workerLease · heartbeat · fencing token
RUNNING
PostgreSQL + outboxAtomic state · retryable delivery
DURABLE
JetStream + inboxBroker ack · deduplicated consumer
AT-LEAST-ONCE
Recovery model · database-owned timev0 · experimental
Milestone
M07
Control plane · in progress
Control API
v1
PostgreSQL-backed · integration tested
Payload limit
1 MiB
Bounded task input / output
Delivery model
At-least-once
Idempotency is explicit
Architecture
Small boundaries. Strong guarantees.
The runtime stays transport-neutral. PostgreSQL owns durable execution state, while JetStream carries committed events between services.
Durable PostgreSQL
Atomic claims, migrations with checksums, attempts, leases, fencing, transactional outbox, and inbox deduplication.
Event transport
NATS JetStream publisher and pull consumer with stable message IDs, broker acknowledgements, and retry handling.
Recovery & idempotency
Fresh-process lease recovery, duplicate suppression, lease renewal, and fencing against stale workers.
Reliability model
Failure is part of the design.
A lease is temporary permission to work, not proof that the previous process has stopped. Every boundary states what happens next.
Fenced ownership
Heartbeat and completion are guarded by worker identity, version, and monotonically increasing fencing tokens.
Restart recovery
A fresh worker can recover expired work from database state without relying on the old process's memory.
Transactional outbox
Events are published outside database transactions and acknowledged only after JetStream confirms storage.
Durable inbox
Logical duplicates are keyed by consumer and event ID. A repeated delivery does not re-run a completed handler.
Long-handler heartbeat
Active inbox leases are renewed and JetStream receives progress acknowledgements while a handler continues.
Honest delivery guarantees
Delivery is at-least-once, not magical exactly-once. External side effects still need idempotency or a shared transaction.
Project status
Built in verifiable milestones.
This is an active engineering project. M00–M06 are complete and verified. M07 now includes tenant-authenticated HTTP routes, tenant-scoped workers and event processing, PostgreSQL v6/v7 forced-RLS and worker grant-lock policies, a separate restricted runtime role, and HTTPS enforcement for non-loopback listeners. HTTPS listener tests and live PostgreSQL TLS trust/hostname integration are hosted-verified (PostgreSQL/NATS run 41609705469); CLI/SDK, dashboard, and operational hardening remain.
M06 · complete
100%
M00–M06 are complete, including the WASM sandbox and its scheduler-backed task-handler integration. M07 tenant routes, grant-gated event paths, forced RLS, role separation, and HTTPS listener enforcement passed the exact-source hosted CI matrix; live PostgreSQL TLS verification and developer tooling remain.
M00Architecture baselineProject charter, ADRs, recovery planComplete
M01Rust workspaceCrates, CI, health endpointComplete
M02Execution domainTyped IDs, lifecycle, retry semanticsComplete
M03Single-node runtimeScheduler, DAGs, cancellation, shutdownComplete
M04Durable persistencePostgreSQL, outbox, inbox, JetStream, process recoveryComplete
M05Distributed coordinationNode membership, worker registration, partition fencingComplete
M06WASM extension runtimeWIT ABI, Wasmtime sandbox, scheduler-backed plugin tasksComplete
M07Control planeAxum v1 API, durable PostgreSQL routes, versioned cancellationIn progress
Explore the implementation
Follow the code, not the hype.
Browse the source, inspect the persistence contract, or pick up from the next unchecked milestone.