Bondy Connect

Appearance

Glossary ​

Active Anti-entropy (AAE) ​

AAE is a periodic automatic synchronisation protocol used by Bondy to remove inconsistencies between data replicas (aka Entropy). Bondy uses it to proactively identify and repair inconsistent or missing data across all nodes in the cluster.

Bondy uses a pull-based anti-entropy strategy. In a sync session, a node compares its Merkle Search Tree with a peer's tree and pulls the pages it is missing. Each node of a pair pulls from the other, so both replicas converge to the same root. Concurrent values of a key merge through the table's CRDT.

Anti-entropy ​

Anti-entropy is the background process by which Bondy nodes converge replicated state: peers compare what they hold and reconcile whatever differs, rather than requiring synchronous agreement on every write before it is considered durable. Bondy's storage layer, bondy_db, runs anti-entropy through its bondy_oplog component by comparing Merkle Search Tree root hashes and exchanging only the divergent pages. See Active Anti-entropy (AAE) for Bondy's proactively scheduled implementation of this process, and Clustering for how it fits into cluster-wide replication.

Applier ​

The applier is the per-node, per-shard process that writes accepted operations into that shard's local projection — the materialised CRDT state that anti-entropy and clients both read. Each shard has exactly one applier per node holding a replica of it. See Reclamation Configuration Reference for how the applier's sweep interacts with reclamation.

Authentication Method (authmethod) ​

The authentication method a session used, or is permitted to use, to establish itself on a realm, carried in the WAMP authmethod field. Bondy supports:

  • anonymous: Allows access to clients which connect without credentials, assigning them as members of the 'anonymous' group. You can configure the allowed sources for the anonymous user and the permissions assigned to the anonymous group - but you cannot make the anonymous group a member of another group.
  • password: Allows access to clients which connect with an existing username (WAMP authid field) and password, where the password is sent in clear-text and is therefore vulnerable to password "sniffing" attacks, unless the connection is protected by TLS encryption. It should be avoided and replaced by the use of wampcra or wamp-scram challenge-response methods if possible.
  • wampcra: WAMP Challenge-Response Authentication. Bondy issues a challenge and the client returns an HMAC of it keyed by a secret derived from the user's password, so the password itself never crosses the wire.
  • wamp-scram: An adaptation of SCRAM (RFC 5802) to WAMP. Like wampcra, the password never crosses the wire, but it adds mutual authentication and per-session salting and iteration counts that resist precomputed-hash attacks.
  • cryptosign: Public-key challenge-response authentication using Ed25519. The client signs a server-issued challenge with its private key, and Bondy verifies it against the user's registered public key — no secret of any kind crosses the wire.
  • ticket: Allows access to clients which connect with an existing username (WAMP authid field) and a ticket previously generated by Bondy. If the transport is not encrypted, this method is vulnerable to ticket "sniffing" attacks, a man-in-the-middle can sniff and possibly hijack the ticket. If the ticket value is reused, that might enable replay attacks. It should be used only when the connection is protected by TLS encryption.
  • cookie: Authenticates using a previously-issued HTTP cookie, letting a browser-based session ride on existing web login state — typically established via OIDC authentication.
  • tls: Reserved for authentication by TLS client certificate. Bondy lists the method but does not implement it, and refuses a session that requests it.
  • oidcrp: The method of a user who authenticated through an OpenID Connect login in which Bondy is the relying party. The login happens outside a WAMP HELLO, so Bondy never offers this method to a session that requests it. See OIDC authentication.
  • trust: Allows access to clients which connect with an existing username (WAMP authid field) but does not request them to authenticate. This is to be used in conjunction with source definition e.g. trust only clients within a defined network (CIDR).
  • oauth2: Authenticates using an OAuth2 access token. See the OAuth2 Token WAMP API Reference.

Causal stability ​

Causal stability is the property that licenses Bondy to physically reclaim deleted data: a timestamp becomes causally stable once every operation that could still be delivered is provably newer than it, so the concurrent write its tombstone exists to reject can no longer arrive. Bondy computes stability from the durable frontier every cluster member last reported rather than from a timeout, so a single unreachable node holds reclamation back until it leaves the cluster. See Deletion and Reclamation for the full mechanism.

Cell ​

A cell is the smallest unit of replicated state that anti-entropy and reclamation operate on: one key's materialised value, together with its causal metadata, within a shard's projection. Not to be confused with a page of a Merkle Search Tree: a page indexes many cells for comparison purposes, but is not itself one.

Conflict-free Replicated Data Type (CRDT) ​

A Conflict-free Replicated Data Type (CRDT) is a data structure whose replicas converge to the same value automatically, regardless of the order in which updates are delivered and without coordination between replicas. Every table in Bondy's storage layer, bondy_db, is backed by a CRDT, so concurrent writes accepted on different nodes merge deterministically once anti-entropy delivers them.

Convergence ​

Convergence is the state anti-entropy exists to reach: every node's replica of a given piece of state holds the same value, once every operation in flight when they last differed has been delivered and applied. Bondy's replication is eventually consistent rather than synchronously consistent (see Anti-entropy and Conflict-free Replicated Data Type (CRDT)), so convergence is a property nodes reach over time after a write or a network partition heals, not a guarantee available at write time.

Distributed application ​

Distributed applications are applications or software that run on network-connect devices and communicate with each other using one or more communication patterns.

Entropy ​

In a distributed system like Bondy, conflicts between object replicas stored on different cluster nodes are an expected by-product of node failure, concurrent client updates, physical data loss and corruption, and other events that distributed systems are built to handle.

These conflicts occur when objects are either:

  • missing, as when one node holds a replica of the object and another node does not, or
  • divergent, as when the values of an existing object differ across nodes.

Frontier ​

The frontier (applied frontier) is the version vector summarising which operations an oplog instance has applied. Each entry is a prefix bound: the largest sequence number of that origin below which nothing is missing. The durable frontier is the applied frontier as the instance last checkpointed it; compaction and reclamation read every member's durable frontier. Anti-entropy and monitoring compare two instances' frontier hashes to judge whether they have converged, without walking the full Merkle Search Tree. See the "Sync / AAE — frontier convergence" panel described in How to Monitor a Bondy Cluster.

Hybrid Logical Clock (HLC) ​

A Hybrid Logical Clock (HLC) is a timestamp that combines wall-clock time with a logical counter, ordering events consistently with causality without requiring cluster nodes' clocks to be synchronized. Bondy stamps every replicated operation with an HLC, which its CRDTs use to resolve concurrent writes deterministically and which anti-entropy uses to determine causal stability.

Merkle Search Tree (MST) ​

A Merkle Search Tree (MST) is a search tree whose nodes are also content-hashed, so comparing two trees' root hashes reveals whether they hold the same data, and walking down from a mismatched root isolates exactly which pages differ. Bondy's storage layer, bondy_db, keeps one MST per table; anti-entropy compares root hashes between peers and exchanges only the divergent pages rather than comparing every key. Not to be confused with a plain Merkle Tree: an MST is also an ordered, incrementally updatable search structure, not just a hash tree over a fixed set of leaves.

Merkle Trees ​

A Merkle Tree is a hash tree where leaves are hashes of the values of individual keys. Parent nodes are hashes of their respective children.

This feature helps to recover data loss in the event of disk corruption.

Mesh topology ​

In a mesh topology there is no central connection point. Instead, each node is connected to at least one other node and usually to more than one. Each node is capable of sending messages to and receiving messages from other nodes. The nodes act as relays, passing on a message towards its final destination.

There are two types of mesh topology:

  • full mesh topology
  • partial mesh topology

Microservices Architecture ​

The microservice architecture is an evolutionary approach to building effective, manageable, and scalable distributed applications. Using this approach an application is structured as a collection of small, independent services that communicate with each other over a network.

Each microservice is treated as a black box that exposes an API, and is responsible for a single specific task. It can be developed and deployed independently of the other services. This allows for greater deployment flexibility and scalability, as well as easier maintenance and evolution.

The key goal of a microservices architecture is to modularize application development into independent yet collaborating components, each delivered by smaller team of developers that don't need to understand the entire application and allowing each team to work at their own cadence[1].

Node ​

A node is a single running Bondy instance, identified by a name@host nodename, that joins a cluster and hosts sessions, shards, and routing state. Not to be confused with Peer: "node" names the instance itself; "peer" names another node considered relationally, from a given node's point of view.

Origin ​

The origin of a replicated operation is the identity of the replica that authored it: an opaque identity created with the replica's storage and destroyed with it, not the node name. Origin retirement reaps the bookkeeping for origins whose node has permanently left the cluster — a distinct concern from causal stability, which is about whether an operation's data can still be superseded, not about who wrote it. See Reclamation Configuration Reference.

Peer ​

A peer is another node as seen from a given node's perspective, within the cluster's masterless, peer-to-peer topology — a relationship, not a synonym for Node. Bondy's configuration surface reflects this distinction directly: cluster.peer_port and cluster.peer_discovery.* configure how a node reaches its peers, and the Partisan peer plane is the set of connections nodes use to reach each other.

Process ​

Unless otherwise specified in the documentation, the word "process" refers to an Erlang process, a lighweight concurrency primitive with small memory footprint that operates independently and is scheduled by the Erlang VM.

A Bondy node can manage millions of concurrently executing processes.

Publish/Subscribe ​

Publish/Subscribe (PubSub) is a message-oriented communication pattern where message senders (Publishers) do not program the messages to be sent directly to specific receivers (Subscribers). Instead, published messages are characterized into topics without knowledge of which subscribers, if any, may be interested.

In WAMP's Publish/Subscribe pattern:

  • A Subscriber expresses interest in a topic by providing the topic URI (or URI pattern)
  • A Publisher publishes events on a topic by providing the topic URI
  • The Router routes published messages to all interested subscribers
  • Publishers and Subscribers are decoupled and unaware of each other's existence

This pattern is one of the two core messaging patterns provided by WAMP (the other being Remote Procedure Call).

Realm ​

A realm is an administrative and routing domain that segregates authentication, authorization, and message routing: no message routed in one realm leaks into another. All resources in Bondy — users, groups, grants, sessions — belong to exactly one realm. See Realms for the full concept.

Registry ​

The registry is Bondy's ephemeral, in-memory bondy_db database holding registrations and subscriptions. Not to be confused with Routing Information Base (RIB): the registry holds the actual registration and subscription entries on the node that owns them; the RIB is the compact, replicated summary that lets other nodes route to those entries without replicating them cluster-wide.

Remote Procedure Call ​

Remote Procedure Call (RPC) is a communication pattern that allows a program to execute a procedure (subroutine) on a remote system as if it were a local call, abstracting the details of the network communication.

In WAMP's Routed RPC pattern:

  • A Callee registers a procedure with the Router by providing the procedure URI (or URI pattern)
  • A Caller invokes a remote procedure by sending a call request to the Router with the procedure URI
  • The Router routes the call to an appropriate Callee and returns the result back to the Caller
  • Callers and Callees are decoupled and communicate through the Router, enabling peer-to-peer RPC

Unlike traditional RPC frameworks which are addressed directly and strictly unidirectional (client-to-server), WAMP RPCs are routed by the Router and work bidirectionally. This means any WAMP client can act as both Caller and Callee, enabling flexible architectures where browser clients can call procedures on other browser clients.

This pattern is one of the two core messaging patterns provided by WAMP (the other being Publish/Subscribe).

Router ​

The Router is the WAMP role Bondy implements: it routes calls between Callers and Callees, and events between Publishers and Subscribers, so that neither side needs to know the other's identity or location. See Remote Procedure Call and Publish/Subscribe for the two patterns it routes.

Routing Information Base (RIB) ​

The Routing Information Base (RIB) is Bondy's mechanism for routing WAMP calls and events across cluster nodes without replicating every registration and subscription to every node. Each node publishes only a compact summary cell per (realm, match policy, URI, node) it serves; other nodes merge these summaries into a stub view used to pick the right node for a remote call or event, then resolve the actual callee or subscribers locally. See Registry Routing (RIB) for the full mechanism.

Service Mesh ​

A service mesh is a dedicated network layer that sits above the service layer and enables service-to-service communication. Its communication channels rely on distributed APIs instead of centralized and discrete appliances.

Messages are transported within the service mesh, but the messaging functions are performed alongside the services receiving the messages. Each instance is attached to a proxy that relays messages to and from the service mesh. These proxies then perform many functions traditionally performed by middleware such as message routing and blocking, service discovery, load balancing, encryption, authentication, and authorization. They additionally support features such as discovery, routing, reliability (failure handling, circuit-breaking), observability and request tracing.

Session ​

A session is an authenticated, stateful link between a client and the Router, attached to exactly one realm for its entire lifetime. See Session for the full reference.

Shard ​

A shard is an independently replicated partition of a bondy_db table, each with its own write-ahead log, Merkle Search Tree, and projection. See Data Storage & Active Anti-entropy Configuration Reference for how tables are partitioned into shards.

  1. Christopher Meiklejohn, Strangeloop 2022 Resilient Microservices without the Chaos ↩︎