Retries become duplicate effects
The write committed. The response vanished. Does the caller try again?
Contract-first operational database
Vibe fast.
Commit safely.
RiffDB is the contract-first data layer for multi-tenant SaaS built by agents: business rules become checked contracts, writes become compiled commands, and unsafe paths disappear from the application interface.
POC
Open source and running today as a standalone, local-only Rust proof of concept. It is not a production release.See the boundaries.
SDK
CLI
MCP
One semantic pathCompiled
commandcommit 0042
commandcommit 0042
authorized
validated
durable
The application changed
Code is abundant.
Correctness isn’t.
Agents can produce a remarkable amount of application code. They can also reproduce every fragile pattern we spent decades learning to avoid, only faster and across more services in more variations.
Read, check, write becomes a race
Each line looks reasonable. Concurrent execution breaks the business rule.
Invariants scatter across code
Every service remembers a different fragment of what must remain true.
RiffDB’s thesis
The safest operation is the one an application cannot express incorrectly.
Why one data layer
Agents make assembly cheap.
They do not make seams correct.
Connecting a database, queue, search engine, and vector store does not create one transaction, one freshness contract, or one coherent backup. Fast glue code cannot remove a dual-write problem that exists in the architecture.
Wired together
- Database
- Event bus
- Search
- Vectors
Dual writes · stale indexes · fractured recovery
RiffDB’s direction
One ordered data layer
- One commit orderState, events, and derived work share a sequence.
- One freshness vocabularyConsumers can state exactly which committed fact they need to observe.
- One operational unitBackup and recovery cover the data layer as a coherent whole.
The contract is executable
Move the rules to where state becomes fact.
A RiffDB contract declares entities, commands, outcomes, invariants, relationships, durable events, indexes, and projections. The compiler resolves and bounds the plan before it can run.
Understand contract-first statebudget.riff
command AllocateBudget(
organization_id: Uuid,
amount: Decimal<2>
) returns Allocated
| InsufficientFunds {
// one declared dependency
read budget by organization_id
else BudgetNotFound;
require budget.remaining >= amount
else InsufficientFunds;
set budget.remaining =
budget.remaining - amount;
emit BudgetAllocated { amount };
}Bounds proven · dependencies visible · outcome closed
Database-enforced semantics
Correctness is not a convention.
The guarantees travel with the command, regardless of which supported interface invokes it.
Commands, not arbitrary writes
Applications invoke compiled domain operations. There is no generic insert, update, delete, or transaction callback in the supported application surface.
Uncertainty is a first-class outcome
Idempotency identity and durable outcomes let a caller retry after a lost response without duplicating the mutation or its events.
One atomic fact
State, outcome, events, provenance, outbox intent, and the commit record become durable together. Otherwise, none of them do.
Agents get a safe vocabulary
Native MCP exposes only authorized commands and bounded context. It is a policy-filtered transport, never a privileged storage bypass.
One semantic path
Every door leads to the same rules.
Generated clients, CLI, gRPC, and native MCP share authentication, authorization, deterministic execution, conflict validation, and commit coordination.
SDKCLIgRPCMCP
Authorize→Evaluate→Validate→Commit
Authoritative statesequence 0042
Why now
The future of OLTP is a safer interface.
Agent-built applications need more than a faster way to emit queries. They need an operational substrate that turns intent into a bounded, attributable, recoverable state transition.
RiffDB begins with a single-node semantic kernel. The long path points toward managed, replicated execution without giving up the contracts that make automated development trustworthy.
Beyond the current POC, the product direction brings transactions, schema migrations, event subscribers, projections, full-text search, vectors, and bounded analytics together as opt-in native parts of one data layer.
Boundary 01
Data authority, not identity
RiffDB governs what an application principal may read and write. Identity, sessions, sign-in, and OAuth remain in the application.
Boundary 02
Use what fits. Keep a path out.
Capabilities are à la carte. When a specialist system becomes the right tool, the changelog and supported export path let RiffDB feed it without holding application data hostage.
Managed RiffDB
Be first in line.
We’re working toward a managed service. Join the early-access list for material project updates and the first invitations.