Registry — Self-Hosted ↔ External pairs

<!-- Registry of self-hosted ↔ external pairs. Generated by manual sweep of [self_hosted] blocks across the monorepo on 2026-05-02 (RFC-002 Phase 2). Will be replaced by the output of koder-spec-audit self-hosted --report once Phase 5 of policies-RFC-002 ships the binary. Authors should NOT edit this file by hand from now on — edit the [self_hosted] block in the relevant module's koder.toml and regenerate.

Policy: policies/self-hosted-first.kmd RFC: rfcs/policies-RFC-002-self-hosted-first.md -->

This registry agglomerates every koder.toml [self_hosted] block in the monorepo. AI sessions reading policies/self-hosted-first.kmd consult this file (not the policy text) when applying the decision protocol.

Status (2026-05-02): RFC-002 Phase 2 done — all seven seed components are now annotated with [self_hosted] blocks in their koder.toml. The table below is the manual sweep equivalent of koder-spec-audit self-hosted --report. Once Phase 5 of policies-RFC-002 ships the binary, this file becomes auto-regenerated and any manual edits are overwritten.

Active pairs

# Self-hosted (Koder) koder.toml location Replaces Status Gates passed Gates pending
1 Koder Jet infra/net/jet/koder.toml nginx, caddy, apache, traefik official 9 (incl. tls, reverseproxy, hotreload, staticserving, http3, productionproven) 0
2 kodec engines/kodec/koder.toml ffmpeg, gstreamer, libavcodec stable for mp3mp4wav 9 (mp3mp4wav parity + perf, stability, production_proven; av1 functional parity 2026-06-24; vp9 functional parity 2026-06-24) 1 (av1 + vp9 perf — structural, see below). HEVC: DELEGATED out of the engine (not a gate). VP9 slice (kodec #144/#152, 2026-06-24): VP9 decode + encode both via libvpx (BSD-3, royalty-free — RFC-003 §3.1 ratified-interim C-FFI adoption 2026-06-24) landed in kodec-codec-vp9, wired through kodec-decode::video_codec per the AV1 template. libvpx is bound in-tree (build.rs bindgen over system libvpx-dev + pkg-config; the published vpx-sys pins a bindgen too old for libvpx 1.15). Functional parity won: decode is bit-identical to ffmpeg's libvpx-vp9 (PSNR ∞, 8 frames @128×128); kodec encode round-trips at ~48–54 dB luma. vp9 perf: structural — kodec wraps the same libvpx ffmpeg does (encode ~158 fps @128×128 speed6; output 2728 B vs ffmpeg 2799 B), so not strictly faster. AV1 slice (kodec #145/#153, 2026-06-24): AV1 decode via dav1d + encode via rav1e landed in kodec-codec-av1, wired through the new kodec-decode::video_codec dispatch registry (the per-codec pattern VP9 replicated). Functional parity won: decode is bit-identical to ffmpeg's libdav1d (PSNR ∞, 8 frames); rav1e output is ffmpeg-decodable (av1 128x128) at ~44 dB round-trip. av1 perf gate still open: kodec wraps the same dav1drav1e backends ffmpeg does, so kodec is not strictly faster than ffmpeg on AV1 — perf parity is structural, not a win. HEVC delegation (owner /k-go 2026-06-24): H.265 (#142 decode / #151 encode) is NOT a software codec in the linkable engine — delegated to (a) HW codecs (NVENCVAAPIVideoToolbox) + (b) the existing `servicesmediatranscode` x265 service, to contain HEVC's patent surface (MPEG-LAHEVC Advance pools) to one boundary instead of every product that links kodec. The engine outputs royalty-free AV1/VP9. video_*_for(H265) → UnsupportedCodec by design (deliberate non-gap; see RFC-003 §7). Container consumer (kruze#235, 2026-06-02): Kruze's SDK record path muxes its MP4 via the kodec container (KcapEncoder.startMp4Kodec → EncodeFormat::Mp4H264AacKodec, default within the KRUZE_SDK_RECORDING gate; `KRUZERECORDMUXffmpeg escapes back to ffmpeg's muxer) — the **muxer is self-hosted**, the H.264/AAC **codec is still ffmpeg** until the native kodec encoder lands (kcap#007). The recording ships its CaptureManifest as a .kcap.json` sidecar.
3 kicon products/dev/kicon/koder.toml imagemagick, hand-drawn-pngs, rsvg-convert-scripts official 11 (full platform set: android mipmaps, ios icons, hicolor, web favicons, store listing, macos iconset, windows ico) 0
4 Koder Hub products/dev/hub/koder.toml oci (live — hub.koder.devv2, FLEET-048: OCI distribution-spec v2 — v2 version check, content-addressed blobs, manifests by tag+digest, Bearer on writes; routed through Jet before the SPA fallback), npm (live — hub.koder.devnpm, HUB#180), aptdeb, app-bundle; cargopypi/rubygems planned (reuse the npm spine) official 8 (publish, install, versioncheck, federation, signing, productionproven) 0 (deltadelivery + upgradechains tracked in hub-RFC-001/004)
5 kdb infra/data/kdb/koder.toml (path move tracked in #730a'..#730f) postgresql, sqlite, redis, mysql field-test (soft-promoted from experimental 2026-05-22 per #730a) 8 (pgdumpv17compat 2026-05-11 + performance 2026-05-14 / re-valid. 2026-05-20 + transactions 2026-05-20 #725 + replication 2026-05-20 #726 + backuprestore 2026-05-20 #727 + featureparity 2026-05-20 #729 + stability 2026-05-28 #728 via field-test attestation audit — S1S2S5 pass / S3/S4 deferred to obs#060 + *ultitenant_isolation 2026-05-28 #743*via field-test attestation audit — T1-T9 covered, 24-day live multi-tenant across 4 axes, T9 cascade static-only) 1 (productionproven — C1 satisfied 2026-05-28 with `productionref=["koder-flow","koder-talk","koder-kortex"] after #745 Kortex flip; **C2 7-day clock** running until 2026-06-04 *(recalibrated from 30d to 7d under field-test posture 2026-05-28 — symmetry with S1, long-tail covered by obs#060)*, C3 failover drill pending, C4 SLO 7-day window pending in parallel with C2). Field-test posture (#730a): production_proven` fecha por adoção (Phase 7.x flips done). Disk format break window aberta até 2026-06-30.
6 Koder Koda engines/lang/lang/koder.toml rust, go, c, c++ stable for hot-path lib 7 (hotpath parity + perf, lib stability, nativeaot, simd, zeroalloc, kodec productionproven) 7 (general use, clinking, asyncruntime, idedebug, profiling, sanitizers, beyondkodec)
7 Koder Talk products/horizontal/talk/engine/koder.toml matrix, signal, xmpp, rocket_chat experimental 0 5 (featureparity, performance, stability, crossimpltests, productionproven)
8 Kmail products/horizontal/kmail/koder.toml imapsmtp, gmailprotocol, outlookprotocol, msexchange experimental 0 7 (featureparity, performance, stability, imapbridge, smtpbridge, crossimpltests, productionproven)
9 Koder Krep engines/search/krep/koder.toml ripgrep, grep, ack, ag, git-grep experimental 0 15 (per-mode featureparity + performance for textstructuralrecord, stability, capability:mcpcontract, capability:structuralcoverage, capability:gracefulshutdown, capability:indexversioning, capability:ndjsonoutput, capability:concurrencysafety, capability:resultdeterminism, capability:taillatencyp99, production_proven). RFC: search-RFC-001. Gate framework: search-tooling-first.kmd.
10 kasm engines/lang/lang/self-hosted/koder_asm.toml nasm, yasm, fasm, gas stable 5 (featureparity:x8664baseline, featureparity:sse42, featureparity:elf64objectoutput, capability:relocationsfullset, capability:etrel_mode) 2 (performance:assemblythroughput, productionproven). Gate 1 passed (#706 2026-05-26). Default in make build since v7.28.0 (#711). Component policy: engines/lang/lang/policies/full-self-hosted.kmd.
11 klink engines/lang/lang/self-hosted/koder_link.toml ld, mold, lld stable 5 (featureparity:staticlinkx8664, capability:relocationsfullset, capability:multiobjectlink, capability:weaksymbols, capability:elf64executable_output) 3 (performance:staticlinkgate2, stability:3releases, productionproven). Gate 1 passed (#709 2026-05-28, geomean 0.89× ld). Default in make build since v7.28.0 (#711). Spec: engines/lang/lang/docs/spec/linker.kmd.
12 Koder Kodix infra/linux/kodix/koder.toml ubuntudev, fedoraworkstation, popos, manualdevenvironmentsetup experimental 8 (featureparity, stability via #010 boot test, capability:customde, capability:containernative, capability:waylandcompositor, capability:claudecodepreinstalled, capability:liveisohardened, capability:kodersuiteconsumer_chain) 9 (performance, productionproven, capability:luksinstall, capability:i18n, capability:oemmode, capability:securebootendtoend, capability:apparmorprofiles, capability:reproduciblebuild, capability:osupdatemechanism). Foundation: debiantrixie + livebuild + wlroots0.18. Tickets #018, #031, #033, #034, #037, #038, #039, #040.
13 Kbox infra/net/kbox/koder.toml docker, podman, containerd, buildah, nerdctl, lxc/incus (system mode, per infra-RFC-001 Phase 1-2), firecracker subset of qemu/kvm (microVM, Phase 3) stable for single-node runtime, build, registry, compose, CRIU, multi-tenant labels, OAuth, OTLP, signing (sign+verify), SBOM, CVE scan, WASM detect, CDI passthrough, self-update; experimental for cluster state, system container mode, microVM dispatch 16 (featureparity:ociruntime, imagebuild, registrypushpull, compose, networkingpastamacvlannetavark, criucheckpointrestoremigrate, buildfarm, capability:rootless, capability:multitenantlabels, capability:oauthkoderid, capability:tracingotlp, capability:icpbrasilimagesigning, capability:cvescan, capability:wasmworkload, capability:cdideviceinterface, capability:self_update) 7 (performance:coldstartbenchmark, productionproven, capability:clusterstatebackend, capability:systemcontainermode, capability:microvmdispatch, capability:lxcreplacement, capability:hubpublication). RFC: infra-RFC-001-koder-runtime-strategy (draft 2026-05-20). Tickets #128-#132 trackeam as 5 fases da convergência Stack-wide (DockerLXCQEMU → kbox). Run-path substantiation (BOX-134, 2026-05-30): the pull → run path was found broken on a clean host (the runtime gates above were nominal — a freshly-pulled image could not actually run). BOX-134 fixed 7 layered bugs (image-store persistence to ImagesDir; library/-namespaced image resolution; the unprivileged launch sequence — shim-after-unshare + user-ns root mapping + AppArmor via aa_change_onexec + capno-new-privs ordering; the kbox stats io.stat panic; kbox exec nsenter mount-flag + forked-init pid). Verified on s.khost1: kbox run -d alpine:3.20 sleep 120 runs an unprivileged container with full security (user-ns + cap drops + no-new-privs + AppArmor); pauseunpausestatsrm and exec <c> id→uid=0(root) all round-trip — so feature_parity:oci_runtime is now genuinely substantiated, not just nominal. First consumer: the koder-lease kbox backend (LEASE-003, validated against real kbox). Remaining run-path follow-up: exec sees the host fs (shim uses chroot, not pivot_root — BOX-134 2f). First persistent deploy (FLEET-048, 2026-06-07): kbox.service daemon LIVE on s.khost1 (host systemd, socket /var/run/kbox/kbox.sock) + hub_publication partially substantiated — kbox pull hub.koder.dev/library/alpine (from the live Hub OCI /v2/ surface, hub#184) → kbox run proven end-to-end. Still open: production_proven (infra-RFC-001 Phase 0 = Docker replacement on s.poc.vivver.com, owner-ratified) + standard-client push to the Hub OCI registry (hub#405).
14 Koder eDiscovery services/foundation/ediscovery/koder.toml google_vault (Workspace Vault: retention + legal hold + cross-component search + export) planning (RFC-001 Draft 2026-05-22) 0 5 (featureparity:retentionregistry, featureparity:legalhold, featureparity:federatedsearch, featureparity:exportwithmanifest, productionproven). RFC: services/foundation/ediscovery/docs/rfcs/RFC-001-architecture.kmd. Sister Sector: services/foundation/compliance (row 16). Bootstrap via meta/context/research/google-inventory-2026-05-22/.
15 Koder Keep products/horizontal/keep/koder.toml google_keep (notes app: text + checklist + image + audio + reminders + sync) planning (RFC-001 Draft 2026-05-22) 0 6 (featureparity:notecrudtext, featureparity:checklistimageaudiotypes, featureparity:crdtsync, featureparity:reminders, featureparity:sharing, productionproven). RFC: products/horizontal/keep/docs/rfcs/RFC-001-architecture.kmd. Bootstrap via meta/context/research/google-inventory-2026-05-22/.
16 Koder Compliance services/foundation/compliance/koder.toml google_checks (privacycompliance scanning for apps + LGPDGDPR helpers) planning (RFC-001 Draft 2026-05-22) 0 6 (featureparity:privacypostureschema, featureparity:consentregistry, featureparity:dsrpipeline, featureparity:piiscanner, featureparity:breachincidentlog, production_proven). RFC: services/foundation/compliance/docs/rfcs/RFC-001-architecture.kmd. Sister Sector: services/foundation/ediscovery (row 14). Bootstrap via meta/context/research/google-inventory-2026-05-22/.
17 Koder Flow products/dev/flow/engine/koder.toml forgejo, gitea, github, gitlab, bitbucket stable (owner may promote to official on PR review) 13 (G1 capability: githttpssh + issues + pullrequests + wiki + packagesregistry + orgsandteams + oauthprovider + oauthconsumerkoderid + ldap + webhooks + actionscompatibleci; G3 stableapi via Forgejo upstream + Koder customizations; G5 productionproven via flow.koder.dev) 3 (G2 performance: no head-to-head Forgejo bench yet, FLOW-116 is a public-API client baseline only; crossimpltests: contract + replay-diff harness landed FLOW-185 (spec wire-compat/flow-vs-forgejo.kmd, T1-T4 green in default suite + CI stub); live replay vs pinned Forgejo on the GUIcontainer runner still pending (shared gate w FLOW-181 e2e + infraci#001); capability:hubbinaryupgrade_chain: Hub-side version-drift auto-bump still manual, sibling to [kruze#157](........productshorizontalkruzeappbacklogpending157-hub-version-drift.md)). Reference impl for the Koder ID OAuth conformance row in [koder-id-auth-coverage.md](.koder-id-auth-coverage.md) (2026-05-12 incident recovery). Hub state: OK_CANONICAL (koder-flow slug). Closes FLOW-113. SUCCEEDED-BY → Koder KVS (row 24) per kvs-RFC-002 (ratified 2026-06-10): KVS is the next-gen forge; Flow becomes the legacy host migrated off + decommissioned at parity cutover.
25 Koder KMS services/crypto/kms/koder.toml aws-kms, gcp-cloud-kms, azure-key-vault, hashicorp-vault-transit stable 7 (featureparity:envelopewrapunwraprotate [AES-256-GCM versioned-KEK envelope + generate-data-key, KMS#001], capability:oauthkoderid [JWKS, audkoder-kms, tenant-from-token, KMS#002], capability:multitenantrls [per-tenant RLS on kms_keks@kdb, non-superuser role, KMS#002], capability:serviceaccountallowlist [principal→keyid, KMS#002], capability:rootkekoffbare_file [Phase-1 root sealed via systemd-creds `LoadCredentialEncryptedkms-root-key, host-sealed at rest], capability:fail_closed_root_unwrap [startup exits non-zero if the sealed root can't be unwrapped — never mints a fresh root nor silently downgrades; KMS#001 Phase-1 hardening 2026-06-24], production_proven [live on the crypto` LXC 10.0.1.248:9432; kterm-vault consumer in prod, KMS#002/003 + kterm#034]) 2 — DOCUMENTED-OPEN custody gate (self-hosted-first.kmd): capability:hardware_sealed_root (KMS#003) — the Phase-1 root-of-trust is honestly weaker than a cloud-KMS HSM root: the root KEK is host-key-sealed, so host-root can read the host key and decrypt the root KEK. Phase 3 binds root decryption to a TPM 2.0 / PKCS#11 HSM so even host-root cannot extract it (true cloud-KMS-custody parity). Owner-gated on hardware (TPM 2.0 BIOS-enable on s.khost1 (HPE DL380 Gen10, TPM present-but-hidden), or a PKCS#11 token); swtpm rejected as security theater (stack-principles §2). Until then the file-sealed posture is the accepted, documented ceiling for this environment, not a claimed parity. Also: performance (no head-to-head AWS-KMS latency bench yet).
24 Koder KVS (forge / host face) products/dev/kvs/koder.toml koder-flow, gitea, forgejo, github, gitlab, bitbucket experimental (kvs-RFC-002 ratified 2026-06-10) 0 10 (capability: git_http [live — internal/host/githttp + PAT auth via Koder ID, id#241] · gitssh [kvs-RFC-002 §8] · pullrequests [conflict-as-data, KVS#179] · issues · webhooksactions · packagesregistry · mirroring · featureparity · stability · productionproven). Successor to Koder Flow (row 17) — the serverhost face of KVS supersedes the Gitea-fork forge (client face = CLITUIdesktopweb porcelain). Differentiators: conflict-free concurrent writes for AI-agent fleets + AI-firstMCP surface co-equal to git+web, on a recursive namespace tree over kdb-next + kdb-obj. Migration (kvs-RFC-002 §9): first-class Flow→KVS importer + coexistence (mirrorimport until parity) + per-reponamespace cutover, Flow decommissioned after; Koder-replaces-Koder succession gated on functional+regression parity (self-hosted-first.kmd). Parity epic: [kvs#277](........productsdevkvsbacklogpending). RFC: kvs-RFC-002.
18 KVG web renderer (koda→wasm) engines/lang/kvg/koder.toml gotoolchainwasm, emscripten, rustc_wasm planning (north-star, KVG-047) 0 5 (featureparity, performance, stability, capability:crossimpltests, productionproven). North-star: the kvg.wasm web artifact is today Go→wasm (external Go toolchain). Self-hosted target = Koda's own wasm backend (engines/lang/koda/self-hosted/koder_wasm_compiler.kd) compiling the KVG renderer (or a Koda port) → zero-Go web toolchain. Flip DECISION gated_by:evidence-soak on Koda wasm production-readiness — koda's wasm compiler is north-star-early (~48 lines, 2026-06-01) and Koda is still hardening (GChashmap). Pair + gates recorded (KVG-047 actionable half); the evaldecision waits on Koda wasm maturity.
18 kdb-obj (proposed layer — not yet bootstrapped) pending — fragment infra/data/kdb/self-hosted/kdb_obj.toml (separate [self_hosted] table per the kasm/klink fragment pattern, note below) minio, s3-compat object stores (the object/blob plane under kdrive) planning (stack-RFC-006 Draft 2026-05-24) 0 5 (featureparity:s3api, capability:erasurecoding, capability:streamingrangeio, performance:throughputvsminio, productionproven). RFC: stack-RFC-006. Substrate-distinct from the kdb-next transactional core (object-native substrate, NOT WALMVCCRaft) per stack-RFC-001 §Non-goals 1. Empty object-store backend slot waiting on it: Hub depot Storage iface (products/dev/hub/depot/storage/storage.go), kdrive bytes, Flow git objects (FLOW-147).
19 Koder Fleet infra/net/fleet/koder.toml kubernetes (k8s), k3s, nomad, docker_swarm experimental 10 (G1 featureparity: deploymentreplicasetdaemonsetjobcronjobpod, service+dns, ingress, hpa, scheduler:affinitytaintstolerations, networkpolicy, pvpvc, namespaces+quotas, probes [FLEET-015]; featureparity:configmapsecretobjects + at-rest sealing [FLEET-016]; capability:rbacserviceaccount — default-deny authz + SA tokens + Koder ID human-token JWKS [FLEET-017/020]; capability:crdoperators — CRDs + dynamic API + reconcile loop [FLEET-011]; capability:admissionwebhooks — mutating+validating chain after RBAC [FLEET-012]; capability:leaderelectionha — coordination-lease active-passive control plane [FLEET-019]) 3 (capability:csicnidriverinterfaces [FLEET-018], capability:poddisruptionbudget [FLEET-013], productionproven). Canonical impl = Go (internal/); Koder Koda port in src/ (shadow, pre-flip). The full k8s request pipeline (authn→authz→admission) is present. Parity matrix: modules/fleet.md. Runtime substrate = Kbox (row 13). Pre-production — not yet deployed; build/test on dev-linux-fleet.
20 Koder Beam products/horizontal/beam/koder.toml parsec, moonlightgamestream, geforcenow, nicedcv, steamremote_play planning (stack-RFC-010 ratified 2026-06-04) 0 8 (featureparity, performance, stability, capability:nvenchwencode, capability:webrtctransport, capability:inputreturnlowrtt, capability:multiregionaffinity, productionproven). Parsec-category GPU streaming (cloud gaming + remote GPU workstation). Build-vs-adopt A→B: adopt Sunshine (host) + Moonlight (protocol) as shadow-active interim → native engines/kodec (NVENC) + WebRTC flip, gated on kodec parity. Encode-leg de-risked (BEAM-001, 2026-06-04: NVENC H.264HEVC viable 1080p60 on a Tesla T4 in-LXC; AV1 needs AdaRTX40+). RFC: stack-RFC-010. Scoping #164. Prod blocker: GPU pool (Arcade #092 Onda 4).
20 Koder backup target (kdrive → cross-domain; proposed — cross-cutting target architecture, no single koder.toml) pending — infra-RFC-006 (target arch, not a single module) google_drive as the backup destination (today: Flow nightly kzip → Drive) shadow/bridge (T2 structured Drive live + validated 2026-05-31; T1 self-hosted buildable) 0 — the T2 dedicated-SA + Shared Drive bridge is provisioned + end-to-end validated (restic→rclone-SA→Koder Flow Backups Shared Drive 0AOyPgucC0Mp9Uk9PVA), but the bridge is still Google, not self-hosted flip target = kdrivekdb-obj (row 18) replicated cross-failure-domain (T3); gate = a 2nd Koder failure domain exists (none today — all hosts EVEO, the real DR blocker named in the RFC). T1 (restic→kdrive, same-domain, fast local restore) buildable now. RFC: [infra-RFC-006](..rfcs/infra-RFC-006-backup-dr-target-architecture.kmd).
21 Koder Translate services/ai/translate/koder.toml deepl, google-translate-api, google-ml-kit (edge fallback) bootstrapping 0 5 (g1featureparity, g2performance, g3stability, g4capability, g5criticalpath). Edge exception (dek#151, 2026-06-06): Dek's OFFLINE / signed-out translation falls back to Google ML Kit on-device (products/horizontal/dek, `googlemlkit_translation). Documented external-dependency fallback per self-hosted-first.kmd — ML Kit is a *fallback only*, never primary; fails g1/g3/g4 for edge (not Koder-owned, no glossary/SLO, Android/iOS-only). Canonical remote path = this service (still bootstrapping, translate.koder.dev not prod-serving yet — dek interim translation runs through v1llmcomplete`, dek#146). Self-hosted edge replacement tracked by dek#152 (embedded NLLBMADLAD).
22 kwasm engines/lang/kwasm/koder.toml wazero, wasmtime, wasmer, wasmedge bootstrapping 1 (Jet wasm middleware) 5 — g4_capability DONE (2026-06-08); g1featureparity, g2performance, g3stability, g5criticalpath pending. Embeddable self-hosted WebAssembly runtime for serverembedded execution outside V8 (NOT a KruzeV8 page-wasm replacement). Best-case flip realized: the first of three placeholder consumers now runs on kwasm — Jet wasm middleware (infra/net/jet/internal/middleware/wasm.go) flipped from the "wazero next iteration" placeholder to kwasm (kwasm#005 fatia 2: request headerpath + response body mutation over a documented koder.* host ABI, per-request fueltimeout bound, 3 e2e tests green); wazero was never taken on. Remaining embedding-consumer candidate: kdev kode-plugins (products/dev/kdev/crates/kode-plugins/src/sandbox.rs, "wasmtime") — but it is Rust, so embedding the Go runtime is a cross-language owner-decision (cgoFFI vs IPC sidecar vs a Rust-side runtime); kwasm#016, gated. Note: `servicesaisandbox is **not** a kwasm-embedding consumer — its WASM tier (SANDBOX-024, sandbox-RFC-002) dispatches via kbox run (kbox capability:wasm_workload, row 13), not an embedded engine. Go v1, sliced ([engineslangkwasmbacklog`](........engineslangkwasmbacklog)); decode(+SIMD)+validate+execute+embed+WASI all done. Origin: stack#155. Distinct from kbox's capability:wasm_workload (row 13), which dispatches OCI-wasm container workloads, not an embeddable GoRust runtime.
23 Koder Herald infra/net/dns/koder.toml cloudns, route53, cloudflare-dns, ns1, dnsmadeeasy shadow-active hospedagem autoritativa + DDNS (dns#005) + failoverhealth (failoverengine #003) + geo-rules (GeoService) implementados, mas servidos via provider ClouDNS (control-plane Phase 0) flip = serving autoritativo nativo (Phase 1, dns#001) com paridade total + desligar adapter provider/cloudns. Programa de substituição: épico dns#023 (DNSSEC signing dns#024, secondaryAXFR dns#025, ANAME dns#026, DoTDoQ dns#027, record types dns#028, reverse dns#029, importexport dns#030, web redirect jet#231, email forward mail#001) + GSLB nativo (épico dns#016) + anycast (dns#022 sobre PoPs `dns#008009010`, ASNPI dns#006/007). Herald já LIVE em dns-api.koder.dev. Motor de serving ratificado = Go-nativo internal/authoritative (NÃO Knot) — ADR-001; programa parity canônico = série DNSP-* (infra/net/dns/platform/backlog, 35 done).

kdb-obj is substrate-distinct (added 2026-05-24, stack-RFC-006). Unlike rows 5's kdb (which replaces transactional stores on the TiKVMVCC substrate), kdb-obj is the object-storage member of the kdb family and runs on its own object-native substrate (erasure coding, no consensus on immutable bytes, streaming). Multi-model ≠ multi-substrate: it shares the kdb brandAPIauth but not the transactional substrate. Its [self_hosted] block will live in a `self-hostedkdbobj.toml fragment (TOML forbids two top-level [selfhosted]` tables in one file — same reason kasm/klink use fragments, note above) once the layer is bootstrapped; until then this row is a manual planning entry.

Engine selected 2026-06-08 (OSS-006 → ADR-001). stack-RFC-006 §7 decisions 1 (BUILD) + 4 (substrate) are resolved. No single embeddable-as-a-library durable Rust object engine exists in 2026 (Garage = AGPL + service; RustFS = alpha + service; SeaweedFS = Go + service) — so kdb-obj composes proven Rust primitives instead of wrapping a monolith: s3s (Apache-2.0, S3 protocol) + reed-solomon-simd (MITBSD, erasure coding) + kdb (object→shard metadata + RLS), behind a swappable object_store-shaped ObjectEngine trait. Gate mapping: s3_api←s3sOSS-008, erasure_coding←reed-solomon-simd/OSS-009, streaming_range_io←OSS-009, throughput_vs_minio+production_proven←OSS-011. Build: OSS-007..OSS-011 (owner-scheduled, multi-quarter). RustFS watch-listed for the EC layer (rustfs-ecstore) at its 1.0.

Talk and Kmail share the messaging/protocol space but cover orthogonal protocols (E2E messaging vs email). Counted as two pairs in the seed list per RFC-002 §4 conventions.

Koder Krep (added 2026-05-02) is the seed consumer of the new search-tooling-first.kmd sub-policy. It is the first self-hosted-first pair with per-case (mode) gate evaluation declared in gates_pending — text, structural, and record modes are evaluated independently per RFC search-RFC-001 §15.

kasm and klink (added 2026-05-02) form the toolchain self-hosting chain for Koder Koda. Both pairs gate the Full Self-Hosted directive (engines/lang/lang/policies/full-self-hosted.kmd, component-level, severity strict). They live in dedicated koder_*.toml fragment files inside engines/lang/lang/self-hosted/ rather than the parent engines/lang/lang/koder.toml because TOML does not allow multiple top-level [self_hosted] tables in a single file. The parent module's own [self_hosted] block (row 6 above, Koder Koda) tracks the language-as-Rust-substitute axis; rows 10–11 track the toolchain-as-binutils-substitute axis.

Skipped pairs (explicit out-of-scope decisions)

Pairs where a bootstrapped parity ticket was reviewed and explicitly declined with rationale. Recorded here so future inventory sweeps do not re-bootstrap the same ticket without referencing the prior decision. A Skip is reversible — when concrete demand surfaces, open a new ticket and remove the row.

# External Bootstrapped against Decision Rationale Source ticket
S1 Google Developer Connect API products/dev/flow/engine Skip (2026-05-24) Bridges third-party SCMs to GCP Cloud Build. Koder Flow is already the canonical SCM and products/dev/ci is the canonical CI surface — there is no Koder-internal consumer of an outbound bridge. If a Flow⇄GCP adapter is ever needed, file it under infra/net/cloud (GCP adapter sector), not as Flow engine parity. FLOW-111

Status enum

Status Meaning Effect on AI decision
experimental Public API may change; gate G3 fails. AI prefers external alternative; documents the gap and (optionally) opens a promotion ticket on the candidate.
stable API stable; gate G3 passes for documented cases. AI may prefer the Koder candidate when other gates close; case-by-case.
official Stack default for documented cases; gates clear universally for those cases. AI MUST prefer the Koder candidate unless an explicit gate fails for the specific case at hand.
legacy Superseded by another self-hosted component. AI MUST NOT use it for new code; existing legacy follows runtime-lib-first.kmd § Strict SemVer deprecation cycles.

Gate-check schedule

Per RFC-002 §5 Phase 5, koder-spec-audit self-hosted --gate-check will validate the claims in this table against evidence (benchmark files, productionref reachability, CHANGELOG markers). Until that phase lands, the table is regenerated by manual sweep of the `[selfhosted]` blocks.

Adding a new pair

  1. Open the candidate Koder component's koder.toml.
  2. Add a [self_hosted] block with replaces, status, gates_passed, gates_pending, and evidence pointers (benchmark_ref, production_ref).
  3. Validate the TOML with python3 -c "import tomllib; tomllib.load(open('koder.toml','rb'))" (until koder-spec-audit self-hosted --validate <module> ships).
  4. Update this registry by manual sweep (until --report ships in Phase 5).
  5. PR.

Cross-references