taba (束) Self-describing, capability-aware workload units composed through a distributed solver.

taba replaces the container + orchestrator model (Docker + Kubernetes) with typed, signed workload units that carry their own contracts. The control plane isn't a separate system — it emerges from the composition of deployed units. Complexity scales linearly with what you actually run.

Why

Every step in the infrastructure abstraction trajectory — VMs, containers, Kubernetes — increased control plane complexity monotonically. The diagnosis: the container is too dumb (opaque black box) and the control plane is too smart (unbounded state reconciliation engine). The separation between workload description and orchestration is drawn in the wrong place.

taba draws it differently. Units describe themselves — what they need, what they provide, what they tolerate, who they trust. A deterministic solver composes them. The result is the desired state. There is no separate desired state store.

Core design

Five pillars

1. Self-describing typed units — workload, data, policy, governance. Each carries capability declarations, behavioral contracts, and security requirements.
2. Emergent control plane — the control plane is the union of deployed units' operational semantics. One unit = trivial control plane. A thousand = the union of their contracts.
3. Security as first class — zero-access default, capability-based, fail-closed on conflicts. Units are Ed25519-signed by their author. Taint propagation is structural.
4. Data as first-class unit — datasets carry schema, classification, provenance, retention, and consent. Lineage falls out of the composition graph.
5. Peer-to-peer — no masters, no leaders, no external metadata store. CRDT graph, erasure-coded, gossip membership.

Decision	Rationale
No masters	All nodes are peers. Same binary, same protocol, 1 node or 10,000.
CRDT graph	No consensus for normal operations. Eventually consistent, partition-tolerant.
Fail closed	Security conflicts are never implicitly resolved.
Deterministic solver	Same graph + same nodes = same placement on any node. Fixed-point arithmetic (ppm).
Signed units	Ed25519 signatures bound to context (trust domain, cluster, validity window). Verified at graph merge.
Erasure coding	Not replication. k-of-n with fleet-adaptive parameters.
Gossip (SWIM)	Authenticated messages, 2-witness failure confirmation.

Quick start

Installation

Download pre-built binaries from the latest release:

# Linux x86_64
curl -LO https://github.com/witlox/taba/releases/latest/download/taba-x86_64.tar.gz
tar xzf taba-x86_64.tar.gz -C /usr/local/bin/

# macOS (Apple Silicon)
curl -LO https://github.com/witlox/taba/releases/latest/download/taba-aarch64-macos.tar.gz
tar xzf taba-aarch64-macos.tar.gz -C /usr/local/bin/

Or build from source:

curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh
git clone https://github.com/witlox/taba.git
cd taba && cargo build --workspace --release

Quick start

# Initialize a local node (generates keypair, trust domain, role assignment)
taba init

# Author and apply a workload unit
echo '[unit]
name = "hello-web"
image = "nginx:alpine"' > hello.taba.toml
taba apply hello.taba.toml

# Check status and run the solver
taba status
taba compose
taba unit list

Architecture

taba-common          types, config, protobuf
    |
taba-core            unit type system, capabilities, contracts
    |
taba-security        signing, verification, taint, Shamir ceremony
   / \
taba-graph  taba-solver    CRDT graph + deterministic solver (parallel)
   / \         |
taba-erasure  taba-gossip  erasure coding + membership (parallel)
       \       /
       taba-node            per-node daemon, WAL, reconciliation
           |
        taba-cli            command-line interface
           |
        taba-k8s            K8s manifest converter

14 crates. Acyclic dependency graph. Single-node works before multi-node (progressive complexity).

Unit model

Everything in taba is a typed, self-describing unit:

# Example: a workload unit declaration
[unit]
type = "workload"
trust_domain = "acme-prod"

[needs]
postgres-store = { type = "data-store", purpose = "analytics" }

[provides]
aggregation-api = { type = "http-api" }

[tolerates]
max_latency_ms = 10
failure_mode = "restart"

[scaling]
min_instances = 2
max_instances = 10

Four unit types:

• Workload — compute process (container, microVM, Wasm, native)
  • Container — Docker/Podman via bollard
  • MicroVM — Firecracker, cloud-hypervisor, or QEMU (auto-detected)
  • Wasm — WebAssembly modules (wasmtime-compatible)
  • Native — standalone binaries via std::process
  • The solver matches workload ArtifactType to node RuntimeCapability.
  • RuntimeSelector dispatches to the correct executor at reconcile time.
• Data — dataset with classification, provenance, retention, consent
• Policy — resolves a specific capability conflict between units
• Governance — trust domain definitions, role assignments, certifications

Security model

• Zero-access default: units access nothing unless explicitly declared and policy-approved
• Capability-based: typed capabilities with optional purpose qualifiers
• Fail closed: ambiguous security decisions are denied, not guessed
• Taint propagation: PII in = PII out, unless multi-party policy declassifies
• Signed units: Ed25519 signatures verified at merge (INV-S3)
• Signed gossip: all membership messages authenticated
• Signed ceremonies: Shamir key events cryptographically signed
• Scoped authority: authors are parameterized by (unit type scope x trust domain scope)

K8s migration

# Convert K8s manifests to taba unit declarations
cargo run --bin taba-k8s -- convert deployment.yaml --output-dir ./units

# Apply the generated units
cargo run --bin taba -- apply units/api-server.taba.toml

Supported: Deployment, StatefulSet, DaemonSet, Pod, Service, ConfigMap, Secret, NetworkPolicy, Role, ClusterRole, RoleBinding, ClusterRoleBinding.

Technology

• Language: Rust (workspace), edition 2024
• Config: TOML (human), protobuf (wire) via prost + tonic
• Async: tokio multi-threaded
• CLI: clap
• Errors: thiserror, typed enums
• Testing: proptest (properties), cucumber-rs (BDD), criterion (benchmarks)
• License: Apache-2.0

Building

cargo build --workspace
cargo test --workspace
cargo clippy --workspace --all-targets -- -D warnings
cargo fmt --all -- --check
cargo deny check

Documentation

Full documentation at witlox.github.io/taba — or build locally:

mdbook serve --open    # http://localhost:3000

License

Apache-2.0. See LICENSE.