This page is the public, strict comparison of Peregrine swift-rust to
upstream OpenStack Swift. Partial implementation is treated as not
implemented. Product and fairness claims must stay inside what is green here.
Canonical long form in-repo:
docs/fairness-lab/RUST-VS-PYTHON-PARITY.md.
Historical snapshot: 2026-08-18 · Contabo lab · not PRODUCTION-GO-LIVE.
Claim: IMPLEMENTED_SUBSET_ONLY. Dual-oracle 57-case last run
(post-GUARD, identical failing set to post-GATE / post-PY-XML-CT) 49/8 (rc=1).
Guard (3d0138d5…) was the recorded VIP generation for that run. Rust extras Python 2.33 does not
implement (object-ACL write, tagging/CORS mutate, RestoreObject) stay
implemented and are not forced to 501; the second scoreboard scores
them 7/7 against AWS semantics. Remaining 8 on the frozen runner =
7 extras + 1 Python residual (x-amz-delete-marker on current GET). Not
GREEN. Details:
docs/fairness-lab/S3-ALIGN-20260815.md.
On this site: methodology and scoreboard on Dual-oracle · client-visible behavior on the S3 API reference · which binary is live on Releases.
Headline
| Area | Status |
|---|---|
| Swift v1 core CRUD + common middleware | Mostly implemented |
| TempAuth + Keystone lab + EC + S3 core/MPU + bulk upload | Implemented (lab-proven) |
| S3 SigV4 + SigV2 + chunk-sig, multi-version, Transition metadata, WORM, ACP | Implemented at the stated test levels |
| Runtime-wired IAM and physical cold-tier routing | Not implemented (strict) |
| Arbitrary third-party Paste plugin loading | Not implemented; unknown filters fail closed |
| process_workers prefork | Implemented |
| eventlet/greenlet serving semantics | Not implemented by design; candidate uses native Hyper/Tokio async serving instead |
| native async HTTP/1.1 serving | Implemented in candidate; acceptance open (G3/G7 proof required) |
| Multi-primary auto-shrink | Not implemented; disabled by default |
| Multi-cluster sync / operator PEM / KMIP | Not implemented |
Swift REST (v1)
| Capability | Python | Rust |
|---|---|---|
| TempAuth v1.0 | yes | yes |
| Account / container / object CRUD | yes | yes |
| Range, conditionals, COPY, expiry | yes | yes |
| SLO / DLO (inline, streaming heartbeat, sync/async manifest-delete, concurrent HEAD, listing etag refetch) | yes | yes |
| TempURL (incl. ip_range) / FormPost / bulk delete | yes | yes |
| Bulk upload / extract-archive (tar/tar.gz/tar.bz2) | yes | yes |
| allow_account_management | yes | yes |
| Implemented Rust Paste pipeline filters | yes | yes |
| Full standard-filter behavior | yes | no (some names are explicit no-op aliases) |
| Unlimited arbitrary third-party Paste plugins | yes | no (no dynamic code loader) |
Middleware
| Filter | Python | Rust |
|---|---|---|
| catch_errors, gatekeeper, healthcheck, proxy_logging, cache, listing_formats | yes | yes |
| tempauth, copy, slo, dlo, quotas, versioned_writes, symlink, staticweb, ratelimit | yes | yes |
| name_check, etag_quoter, crossdomain, read_only, domain_remap, cname_lookup, backend_ratelimit | yes | yes (on-by-config) |
| keystoneauth + authtoken (lab Keystone) | yes | yes |
| s3api + s3token (core path) + ListParts | yes | yes |
| container-sync filter + daemon (HTTP/HTTPS + CA knobs) | yes | yes (unit; multi-cluster live not claimed) |
| encrypter / decrypter / keymaster | yes | yes (on-by-config; KMIP residual) |
| xprofile, list_endpoints | yes | yes (unit) |
| memcache/recon/healthcheck aliases as NamedPassthrough slots | yes | yes |
Dynamic third-party plugin loading (use= / plugin=) |
yes | no |
S3
| Capability | Python | Rust |
|---|---|---|
| SigV4 CRUD, List v1/v2, MultiDelete, MPU path, ListMPU, ListParts | yes | yes (lab) |
| SigV2 (HMAC-SHA1 header + query) | yes | yes (unit; AWS vector) |
| s3token / EC2 → Keystone | yes | yes (lab) |
| Canned ACL + multi-rule CORS + object ?acl | yes | yes |
| aws-chunked / STREAMING-* (per-chunk HMAC enforced) | yes | yes (unit) |
| Versioning + multi-version data plane + ListVersions pagination | yes | yes (unit) |
| Lifecycle Expiration + Transition metadata (cold GET + restore) + AbortIncompleteMPU | yes | yes (unit) |
| Physical cold-tier storage-policy routing | yes | no (library unit only; proxy does not load the map) |
| Object Lock WORM + GOVERNANCE bypass header | yes | yes (unit) |
| Grant-header + ACP XML store/GET + enforcement | yes | yes (unit) |
| Multi-tenant local IAM policy engine | yes | no (library unit only; proxy does not load policies) |
| Hosted AWS IAM cloud product | yes | no |
EC & consistency / platform
| Capability | Python | Rust |
|---|---|---|
| EC policy encode/decode, multiphase PUT, ranged GET, heal | yes | yes (Linux ec) |
| Local sharder + manage-shard-ranges + shrink path | yes | yes |
| Multi-device same-host shrink helper | yes | yes (unit) |
| Multi-primary auto-shrink product | yes | no (disabled by default; cross-node safety unproven) |
| Cross-node multi-primary shrink over HTTP | yes | no (residual) |
| container-sync daemon (same-cluster) | yes | yes |
| Multi-cluster container-sync realm soak | yes | no |
| process_workers prefork | yes | yes |
| eventlet/greenlet serving semantics | yes | no (native async model instead; not an Eventlet clone) |
| native async HTTP/1.1 serve | no | candidate yes; G3/G7 acceptance open |
| Operator VIP TLS PEM go-live | yes | no (script GREEN; Contabo self-signed LAB) |
| Full ansible Python role twin | yes | partial (v3 subset) |
Lab evidence anchors
- TempAuth func VIP 54/54; soak 1h fail=0
- S3 MPU deep 11/11; EC2 s3token green
- 2026-08-07/08 SLO full audit: Contabo live SLO matrix + s3cmd MPU KEEP
- 2026-08-08 hard9 residual: Paste/xprofile, Transition, ACP+IAM, SLO concurrent —
tools/test-results/hard9-residual-wave-20260808/ - 2026-08-08 hard residual wave: unit evidence for SigV2 and several helper/library surfaces; see the 2026-08-09 correction in
tools/test-results/hard-residual-wave-20260808/ - Operator TLS PEM deferred → not PRODUCTION-GO-LIVE
How to use this matrix
- Fairness A/B: only compare surfaces marked yes on both sides.
- Marketing: do not say “full Swift compatibility.”