Docs
Architecture
GPUCache is the G3.5 shared KV hot tier. The implemented data path uses host memory and TCP. RustFS is the colder G4 object tier, outside the hot request path.
BlueField-3, GDS and real RDMA are targets in development: NOT_RUN_HARDWARE. The current implementation performs host copies and does not claim zero-copy or CPU bypass.
The path that runs today
The Rust service handles Lookup, Reserve/Put, Commit, Get, Release/Cancel and Invalidate over TCP. MemoryStore and FileStore provide CPU backends; FileStore uses ordinary files. TCP authorization checks each data operation. It is not mTLS.
Identity before reuse
Only committed blocks with a compatible tenant, trust domain, model and complete layout identity can be hits. A prefix hit returns a whole stored block; it never silently slices inside a block. Misses, timeouts and checksum failures mean recompute.
One node or multiple shards
One process can serve one shard with the same client operations. The directory holds bounded metadata; the client bounds routes, connections and retry records. Membership changes fence in-flight work. Operators publish fenced epoch snapshots; automatic discovery and consensus are not implemented.
Cold storage stays separate
G4 packing and refill use manifest v3, content-derived keys and full identity checks. Legacy manifests miss. Slow or unavailable cold storage yields Missing. Failed sink jobs retain bounded credit; an ambiguous PUT does not trigger DELETE. Mock coverage is available; live RustFS is NOT_RUN_HARDWARE.
The DPU target
HostSimulation exercises typed messages, cancellation, faults and explicit drain. Features rdma-nixl and dpu-bf3 do not link device SDKs; device opens fail closed. An aarch64 CPU build is not BlueField offload. Real engine export/import remains unqualified; engine-spike uses fake blocks.
Failure is recompute
G3.5 adds no erasure coding or durability replicas. Unknown transfer completion stays quarantined until explicit drain or a newer fence permits reuse. RustFS owns cold-data durability. This is a cache contract, not disaster recovery or proof of fleet-scale readiness.
Related documentation
Quick start · Roadmap · Scaling and deployment boundaries · CPU_COMPLETION.md
Real I/O deadlines belong to the cold adapter. The synchronous core cannot preempt an arbitrarily blocking object-store call.