Pepper 0.2.0

Pepper 0.2.0 turns the immutable storage fabric into a transactional data platform. Three-node Raft groups publish durable ordered-map revisions that power linearizable KV, versioned buckets, immutable filesystem trees, and the optional S3-compatible gateway.

• Canonical ordered Merkle radix maps with bounded point, range, and prefix reads; deterministic roots; root-bound cursors; whole-tree validation; and DAG-aware retention.
• Deterministic namespace transactions with read-your-writes, generation/CID conflicts, idempotent replay, immutable history, named snapshots, monotonic rollback, and checkpoint recovery.
• OpenRaft-backed groups with exactly three voters, authenticated QUIC Raft/forwarding RPCs, leader discovery, capacity-aware placement, restart recovery, safe learner replacement, and membership fencing.
• Durability-gated publication with staging and read leases, atomic protection records, distributed pin reconciliation, conflict-retained uploads, and abandoned-staging cleanup.

• Native namespace and KV commands for lifecycle, historical reads, scans, conditional writes, atomic transactions, diff, snapshots, and rollback.
• Versioned buckets with immutable object/tombstone chains, conditional operations, stable listing, historical reads, and durability-gated publication.
• Filesystem roots and inodes with Merkle-map directories, object-backed files, structurally shared commits, history, diff, checkout, restore, rollback, and cloning.
• An opt-in S3 gateway with SigV4 headers, presigned URLs, browser POST, object/list/range/copy/conditional/multi-delete operations, checksums, durable multipart uploads, tagging, CORS, and lifecycle cleanup.

• Namespace/Raft/publication/Merkle metrics, namespace-aware readiness, persisted-group startup recovery, and bounded payload-redacted diagnostics.
• Signed identity-bound backup manifests, verified restore, single-live-process identity fencing, checkpointing, replica rebalance/replacement, and explicit fork-risk recovery.
• Transactional metadata migrations from schema 1 to schema 4 and peer protocol v8; all cluster nodes must be upgraded together.
• Backend-neutral storage, namespace, bucket, filesystem, fault-injection, linearizability, chaos, soak, WAN, and host-gated Firecracker qualification suites.

Version 0.2.0 remains a developer preview for evaluation and controlled private-cluster deployments. It is not a production multi-tenant boundary and does not provide Byzantine durability, public-federation abuse resistance, confidential compute, or attestation. Keep HTTP on loopback, protect P2P with network boundaries and the cluster secret, and review S3 credentials, Firecracker rootfs images, jailer settings, and resource limits.