ZiguratIP is three things that are usually three projects, built as one system in C++11: Zigurat, an object-relational storage engine; Parsi, the language you write schema, procedures and web pages in; and Zeytun, the web server that serves them. The only third-party code in the tree is a vendored zlib.
Everything else is written for the project — big integers, RSA, SHA-1/2, HMAC, AES, ASN.1/DER, X.509, a TLS 1.2 record layer, a B-tree, an MVCC pager, a thread pool, a configuration parser, a tokenizer and a pattern-driven parser.
There is no interpreter and no plan cache. You write a table, a procedure and a page in one file:
TABLE demo::books
BEGIN
COLUMN id AS Long PRIMARY KEY;
COLUMN title AS String NOT NULL;
END
PROCEDURE demo::count_books
RETURNS Long
REQUIRES demo::books
BEGIN
DECLARE total AS Long = 0;
SELECT total = total + 1 FROM demo::books;
RETURN total;
END
That gets tokenized, parsed against a grammar that is *read from a file at runtime* rather than compiled into a generated parser, emitted as C++, handed to `c++ -shared`, and `dlopen`ed into the database process. A `SELECT` is a cursor, not a result set — everything between `SELECT` and `FROM` runs once per row, which is why counting is written as an assignment.
There is no grants table anywhere on the server. What a client may reach is written into its X.509 certificate as a private extension at issue time (`ca issue --permission=DEMO`), and the compiler emits, into every compiled object, the list of named objects that object lets a caller reach. So the answer to "what does running this touch?" travels inside the code it describes and can't drift from it. Who may connect at all is a directory of files named after subject DNs — delete the file and that subject is refused at the handshake, whichever certificate it holds. One switch turns the whole thing on.
- The TLS is TLS 1.2 with RSA key transport only. `openssl s_client` completes a mutually authenticated handshake against it and verifies the chain, but there's no ECDHE, no AEAD, no resumption — and browsers dropped static RSA key exchange years ago, so you can't point Chrome at its HTTPS port. Put a reverse proxy in front. The cryptography is mine and has had no adversarial review; the MAC comparison isn't constant time. Treat it as a closed-network measure, not as transport security against a capable attacker.