id: investigate: TigerBeetle — multi-currency ledgers, conversions, per-coin vs balance model, 3-node cluster topology #2040

Activity

1. dezren39

   added

   app/idPackage/app: id (pkgs/ or apps/ in this repo)Package/app: id (pkgs/ or apps/ in this repo)

   on Oct 29, 2026
2. developing-today commented on Oct 29, 2026

   

   developing-todayBot

   on Oct 29, 2026 – with developing.today

   Contributor

   More actions

   CODE-961
3. dezren39 commented on Oct 29, 2026

   

   dezren39

   on Oct 29, 2026

   MemberAuthor

   More actions

   Parent epic: #2056 — ID platform expansion (2026-10-28 directive).
4. dezren39 commented on Oct 29, 2026

   

   dezren39

   on Oct 29, 2026

   MemberAuthor

   More actions

   Investigation COMPLETE (2026-10-28, Muse research pass; full report lands in-repo via the program docs PR — local copy: ~/workspace/id-program-2026-10-28/investigations/tigerbeetle.md, 525 lines, cited to official TigerBeetle docs + the Jepsen analysis).

   Headlines:

   • Dynamic currencies: YES with caveats — a currency is a bare u32 ledger value, created implicitly (no DDL/restart), ceiling ~4B ledgers; but TigerBeetle stores NO name/symbol/scale/issuer metadata (control plane is ours — see id: design: currency control plane — registry, account factory, gateway #2062), and a ledger's asset scale is effectively immutable.
   • Conversions: NOT native — cross-ledger transfers are explicitly forbidden. A conversion is an application-composed pair of atomically linked same-ledger transfers through a liquidity provider's accounts at an application-computed rate; there is no rate/authorisation/AMM concept, and leg linkage must be stamped into user_data_128 ourselves (design: id: design: conversion engine — linked transfer pairs, rate authorisation, liquidity accounts #2063).
   • Per-coin identity: NO — balance-only accounts (four 128-bit counters); units are fungible by construction.
   • Cluster: NOT one-active-plus-backups — all replicas run under Viewstamped Replication with an elected primary; 3 replicas tolerate ONE failure; vendor production recommendation is 6 across 3 sites; cluster size is fixed at format time (decision: id: investigate: TigerBeetle cluster topology decision — 3 vs 6 replicas, site placement, commit latency #2064).
   • Refunds/revocation: posted transfers are immutable; a clawback can FAIL if the holder spent the balance; no freeze/seizure primitive. Mitigation designed in id: design: refundable grants via pending transfers — Steam premium tokens voidable through the refund window #2065: issue refundable grants (Steam premium tokens) as pending transfers voidable through the refund window.
   • No authentication in TigerBeetle — a gateway performing ID-signature checks is mandatory (id: design: currency control plane — registry, account factory, gateway #2062). Currency also cannot run in the Workers edition, making it the centralised exception (id: design: currency as the centralised exception — how the hosted (Workers) edition reaches the currency service #2066).
5. dezren39

   added a commit that references this issue on Oct 29, 2026

   docs(id): 2026-10-28 program investigations — TigerBeetle + Cloudflar…

   ...

   8bbefca
6. github-actions

   assigned

   dezren39

   on Oct 29, 2026
7. dezren39

   added a commit that references this issue on Oct 29, 2026

   docs(id): design refundable grants as pending transfers (#2065)

   ...

   15a7c76
8. dezren39

   added a parent issue on Nov 1, 2026

   • epic: ID platform expansion — apps, comms, currency, hosting, boards (2026-10-28 directive, LIST 6–15) #2056
9. dezren39

   added

   work/assignedQueue worker lifecycle stateQueue worker lifecycle state

   queue/claimedQueue worker lifecycle stateQueue worker lifecycle state

   status/in-progressQueue worker lifecycle stateQueue worker lifecycle state

   on Nov 3, 2026
10. dezren39

    closed this as completedon Nov 3, 2026
11. dezren39

    added

    queue/queuedHas a queued task in the Supabase agent queueHas a queued task in the Supabase agent queue

    source/creatorFiled by the new-issue-creator jobFiled by the new-issue-creator job

    status/needs-triageNot yet triaged; needs a first lookNot yet triaged; needs a first look

    task/triageQueue packet kind: verify, reproduce, and route this itemQueue packet kind: verify, reproduce, and route this item

    and removed

    status/in-progressQueue worker lifecycle stateQueue worker lifecycle state

    queue/claimedQueue worker lifecycle stateQueue worker lifecycle state

    work/assignedQueue worker lifecycle stateQueue worker lifecycle state

    on Nov 3, 2026
12. dezren39 commented on Nov 3, 2026

    

    dezren39

    on Nov 3, 2026

    MemberAuthor

    More actions

    agent-note:v1
    state: triaged (coverage pass)
    Coverage pass 2026-11-03: reviewed in the fleet-wide per-issue pass (drift / overlap / already-handled / stale / blockers / ordering). Verdict: still live; queued in repo-health-code-pilot as triage at priority 30 (priority/none). If this is already handled at current main, the triage closes it with evidence; if it needs splitting, the triage files the split.
    Found via: coverage pass 2026-11-03
13. dezren39 commented on Nov 3, 2026

    

    dezren39

    on Nov 3, 2026

    MemberAuthor

    More actions

    Agent note — triage: already done, closing with evidence

    • Task: task 7829 (repo-health-code-pilot, lane F / code-f shift, 2026-11-03). This issue's deliverable was the TigerBeetle capability investigation (LIST 11a under parent epic epic: ID platform expansion — apps, comms, currency, hosting, boards (2026-10-28 directive, LIST 6–15) #2056).
    • Investigation completed 2026-10-28 and the full report landed in-repo: PR docs(id): 2026-10-28 program investigations — TigerBeetle + Cloudflare Workers fit #2067 merged 2026-10-29 ("docs(id): 2026-10-28 program investigations — TigerBeetle + Cloudflare Workers fit") — present at current main as doc/2026-10-28T23-34-15Z_investigation_tigerbeetle_currency_backend/2026-10-28T23-34-15Z_investigation_tigerbeetle_currency_backend.md.
    • The 3-node cluster topology question got its own landed investigation: PR docs(id): TigerBeetle cluster topology investigation — 6 replicas / 3 near sites (#2064) #2291 merged 2026-10-30 — doc/2026-10-29T11-57-00Z_investigation_tigerbeetle_cluster_topology/ (6 replicas / 3 near sites, id: investigate: TigerBeetle cluster topology decision — 3 vs 6 replicas, site placement, commit latency #2064).
    • Every follow-up the report named is filed as its own issue and has a landed design: id: design: currency control plane — registry, account factory, gateway #2062 control plane (PR design(id): currency control plane — registry, account factory, gateway (#2062) #2315 merged), id: design: conversion engine — linked transfer pairs, rate authorisation, liquidity accounts #2063 conversion design (doc/2026-11-01_design_id2063.md on main), id: design: refundable grants via pending transfers — Steam premium tokens voidable through the refund window #2065 refundable grants (PR docs(id): design refundable grants as pending transfers (#2065) #2293 merged), id: design: currency as the centralised exception — how the hosted (Workers) edition reaches the currency service #2066 centralised exception (PR doc: currency as the centralised exception — hosted boundary design (#2066) #2297 merged); the PoC the design called for exists (pkgs/id/src/currency_poc/) and is being hardened under its own issues (e.g. id: PoC: conversion executor — linked transfer pairs, write-ahead intent, recovery scanner #2289, PR id: conversion-executor PoC — linked transfer pairs, write-ahead intent, recovery scanner (#2289) #3873 merged).
    • Nothing from this issue's scope remains untracked, so it closes as already_done. If the program wants a further investigation round, that is a new issue under epic epic: ID platform expansion — apps, comms, currency, hosting, boards (2026-10-28 directive, LIST 6–15) #2056, not a reopen of this one.