A single-author Rust project that treats encryption as load-bearing.
Not an option, not an extension, not a wrapper. A 20-crate Rust workspace: a full SQL engine, a key-value API, AES-256-CTR + HMAC encryption at the page level, shadow paging, an encrypted memory engine, and a reproducible benchmark suite against SQLite.
Encryption is load-bearing.
Every page is AES-256-CTR ciphertext with an HMAC-SHA256 tag. There is no unencrypted mode. You cannot disable it, forget to enable it, or ship a build without it. The file format itself refuses to exist in plaintext.
Crash-safety without a WAL.
Commits use shadow paging: modified pages are written to fresh locations, then a single-byte flip in the file header atomically publishes the new commit slot. No separate log to replay, no fsync storm, no partial-write window.
Embedded means no server.
Citadel is a library. There is no daemon, no listener, no network code path in the default build. Your application's process is the database, the same deployment model as SQLite, with crypto as a property of the file format.
Memory is encrypted the same way.
The memory engine, citadel-mem, stores vectors, atoms, and edges on the exact same encrypted pages. Forgetting is cryptographic: destroy an atom's or region's key and the ciphertext that remains is unrecoverable, with a verifiable erasure receipt.
The benchmarks are reproducible.
The 50 head-to-head benchmarks against unencrypted SQLite live in citadeldb-sql/benches/h2h_bench.rs. Run them yourself with cargo bench. We publish what the bench output says, not a marketing average.
A Cargo workspace of 20 crates, layered from the bytes on disk up to the SQL frontend, the memory engine, and the bindings. Each crate has its own tests; 5,200+ in total, with 100% pass on cargo test --workspace. 15 crates publish to crates.io, plus a citadeldb wheel to PyPI.
@citadeldb/wasm on npm.citadeldb wheel on PyPI.Every number here is either in the README, in a source file, or returned by the test suite. No marketing approximations.
Rust 1.75+AES-256-CTRHMAC-SHA256Argon2idEach capability below lives in the open-source tree. Here is where to find it:
ON CONFLICT), RETURNING, generated columns, JSON/JSONB with 14 PostgreSQL operators, triggers, materialized views, full-text search, partial / GIN indexes, native DATE/TIMESTAMP, and a VECTOR(N) type with an ANN index. Implemented in citadel-sql and citadel-vector.citadel-mem stores regions of typed atoms and edges with hybrid recall and cryptographic erasure; citadel-mcp serves it over the Model Context Protocol; the 85.5% LoCoMo score is measured by citadel-membench.citadel-ffi, and the citadel CLI.Citadel is a one-person project. If you want to contribute, the crate list in section 02 is a good map of where help is welcome - each crate is a self-contained area: parser extensions in citadel-sql, new code paths in citadel-crypto, recall tuning in citadel-mem, and more language bindings.
Encrypted by construction. Not by option.