Erasure coding & durability
KWAM splits your data into 8 data + 4 parity fragments: RS(8,4) over GF(28). Any 8 of the 12 rebuild the exact original, bit-for-bit, by pure deterministic math. Six nines is a number we can measure and reproduce, not a promise of perfection.
RS(8,4) over GF(28): 8 data + 4 parity, any 8 of 12 rebuild the exact original, six nines as a design target.
Reed–Solomon over GF(28): a standard systematic MDS construction, so it tolerates the loss of any 4 of 12.
Each object is split into 8 data fragments and 4 parity fragments. The code is MDS, so any 8 of the 12 reconstruct the exact original, bit-for-bit, exhaustively tested.
Lose any 4 of the 12 fragments and the data still rebuilds. Below 8 survivors the data is gone; KWAM reports that, it does not fabricate it.
Every fragment carries a SHA-256 content address: cid = sha256:<64hex>. A corrupted fragment fails its hash and becomes a known erasure: detected, never silently used.
A millibit is stored bits per logical bit × 1000: a unit of fractional redundancy (information), not a sub-bit storage cell. A stored bit is indivisible.
KWAM signs the number it can measure and reproduce: six nines (99.9999%) durability, as a design target, not a guarantee of perfection. It is discounted from naive arithmetic for real-world correlation.
A guard block declares a durability in nines. The validator checks it against replication factor, fault-domain independence, MTTR and audited node/domain MTBF via a closed form.
Assert more nines than the math supports and the validator rejects the guard with a reproducible verdict. For example, claiming 11nines at factor 3 is rejected; backed: 6 nines.
This is demonstrated in the shipped validator's conformance suite: the unbacked-guard rejection above is a passing test, and the verdict is deterministic and reproducible. We still say compiler-checked against a stated model, never "compiler-verified": the check is only as strong as the declared failure-model inputs.
The architecture itself is grounded in practice, not invented: exabyte-scale physics archives run the same shape today, where a failed integrity check converts corruption into an erasure repaired by deterministic Reed–Solomon reconstruction, and the same code family has flown on spacecraft data recorders for decades. KWAM's difference is that the gate is cryptographic (SHA-256), closing the documented failure mode where lightweight checksums collide and miss real corruption.
Rejected counter-example
guard durability {
durability: 11nines
factor: 3
}
# validator verdict
# REJECTED — claimed 11 nines,
# math backs 6 nines at factor 3Per-bit replica restore is fast. Fleet-scale correlated recovery is not, and we will not pretend otherwise.
| Scenario | Recovery target | Notes |
|---|---|---|
| (a) Per-bit replica restore | p99 < 60–90s | Under independent single-node loss, KWAM-controlled. |
| (b) Fleet recovery, correlated AZ-scale loss | minutes to hours | Throughput-bounded; explicitly not 60s. Surfaced as time_to_full_redundancy. |
| (c) Code-activation | bounded by safe-point | Cooperative hot-swap; a non-cooperative reexec path for security-critical swaps. |
Embeddable from Python. The codec produces the bytes; the SHA gate verifies them.
from kwam import protect, recover
# split into 8 data + 4 parity, each SHA-256 content-addressed
fragments = protect(data, k=8, m=4)
# lose any 4 of 12 — corrupted fragments fail their hash and
# become known erasures, never silently used
survivors = drop_any(fragments, 4)
# pure deterministic math rebuilds the exact original
original = recover(survivors)
assert original == data # bit-for-bit, exhaustively testedRS(8,4) is in production today. These are additional codes on the roadmap, and they stay design targets: none ships until its durability math is verified the same way RS(8,4) was.
Six nines as a design target, no silently-corrupted bits, and a residual we surface rather than hide. Tell us about your fleet.
KWAM is our intellectual property, grounded in Swiss law.
KWAM — its source code, the KWAM language, the JHMM reconstruction orchestrator, the deterministic codec runtime, and all associated AI components — is a proprietary computer program and the sole and exclusive intellectual property of KWAM.CH. As a computer program it is a protected work under the Swiss Federal Act on Copyright and Related Rights (Copyright Act, CopA), and the exclusive rights of use vest in KWAM as employer; it is further protected as a trade secret under the Swiss Federal Act Against Unfair Competition (UCA). KWAM is offered by private licence only. All rights reserved.
CopA (SR 231.1) Art. 2 para. 3 & Art. 17 · UCA (SR 241) Art. 6 · Governed by the laws of Switzerland · Place of jurisdiction: Zürich