arunaengine · St4NNi · Jun 1, 2026 · Jun 1, 2026 · Jun 1, 2026 · Jun 1, 2026
diff --git a/Cargo.lock b/Cargo.lock
diff --git a/Cargo.toml b/Cargo.toml
@@ -15,7 +15,7 @@ resolver = "3"
 
 [workspace.package]
 description = "A federated data orchestration network"
-version = "3.0.0-alpha.1"
+version = "3.0.0-alpha.32"
 edition = "2024"
 license = "MIT OR Apache-2.0"
 repository = "https://github.com/arunaengine/aruna"
@@ -35,23 +35,23 @@ aruna-tasks = { path = "tasks" }
 # Third-party crates
 ahash = "0.8.12"
 async-trait = "0.1.89"
-automerge = "0.8.0"
-autosurgeon = "0.11.0"
-aws-config = "1.8.16"
-aws-sdk-s3 = "1.132.0"
+aws-config = "1.8.18"
+aws-sdk-s3 = "1.135.0"
 axum = "0.8.9"
-axum-extra = { version = "0.12.5", features = ["query"] }
+axum-extra = { version = "0.12.6", features = ["query"] }
 bao-tree = "0.16.0"
 base64 = "0.22.1"
 blake3 = { version = "1.8.5", features = ["serde"] }
 byteview = "0.10.1"
-bytes = "1"
-chrono = { version = "0.4.44", features = ["serde"] }
+bytes = "1.11.1"
+chrono = { version = "0.4.45", features = ["serde"] }
 clap = { version = "4.6.1", features = ["derive"] }
 console-subscriber = "0.5.0"
-craqle = { git = "https://github.com/arunaengine/craqle" }
-crc-fast = "1.9.0"
-crossfire = "3.1.12"
+craqle = { git = "https://github.com/arunaengine/craqle", branch = "feat/irokle", features = [
+    "iroh",
+] }
+crc-fast = "1.10.0"
+crossfire = "3.1.16"
 crypto_box = "0.9.1"
 data-encoding = "2.11.0"
 dotenvy = "0.15.7"
@@ -61,9 +61,9 @@ futures = "0.3.32"
 futures-core = "0.3.32"
 futures-util = "0.3.32"
 globset = "0.4.18"
-hex = "0.4"
-http = "1.4.0"
-hyper = { version = "1.9.0", features = ["full"] }
+hex = "0.4.3"
+http = "1.4.1"
+hyper = { version = "1.10.1", features = ["full"] }
 hyper-util = { version = "0.1.20", features = [
     "server",
     "server-auto",
@@ -72,52 +72,58 @@ hyper-util = { version = "0.1.20", features = [
     "tokio",
     "service",
 ] }
-iroh = "1.0.0-rc.0"
-iroh-base = "1.0.0-rc.0"
-iroh-gossip = "0.99.0"
+iroh = "1.0.0-rc.1"
+iroh-base = "1.0.0-rc.1"
+irokle = { git = "https://github.com/arunaengine/irokle.git", branch = "main", features = [
+    "fjall",
+    "iroh",
+] }
 iroh-io = "0.6.2"
 iroh-quinn = "0.16.1"
-jsonwebtoken = { version = "10.3.0", features = ["rust_crypto"] }
+jsonwebtoken = { version = "10.4.0", features = ["rust_crypto"] }
 md5 = "0.8.0"
 n0-future = "0.3.2"
-opendal = { version = "0.56", features = [
+opendal = { version = "0.57", features = [
     "services-postgresql",
     "services-fs",
     "services-ftp",
     "services-s3",
     "services-http",
     "services-webdav",
 ] }
-opentelemetry = { version = "0.31.0", default-features = false, features = ["trace"] }
-opentelemetry-otlp = { version = "0.31.1", default-features = false, features = [
+opentelemetry = { version = "0.32.0", default-features = false, features = [
+    "trace",
+] }
+opentelemetry-otlp = { version = "0.32.0", default-features = false, features = [
     "trace",
     "grpc-tonic",
 ] }
-opentelemetry_sdk = { version = "0.31.0", default-features = false, features = [
+opentelemetry_sdk = { version = "0.32.1", default-features = false, features = [
     "trace",
     "rt-tokio",
 ] }
-oxrdf = "0.3"
+oxrdf = "0.3.3"
 parking_lot = { version = "0.12.5", features = ["deadlock_detection"] }
 percent-encoding = "2.3.2"
 postcard = { version = "1.1.3", features = ["alloc"] }
 rand = "0.10.1"
-reqwest = { version = "0.13.3", default-features = false, features = [
+reqwest = { version = "0.13.4", default-features = false, features = [
     "json",
     "rustls",
 ] }
 s3s = { git = "https://github.com/s3s-project/s3s" }
 serde = { version = "1.0.228", features = ["derive"] }
-serde_json = "1.0.149"
+serde_json = "1.0.150"
 sha1 = "0.11.0"
 sha2 = "0.11.0"
 smallvec = "1.15.1"
+spargebra = "0.4.6"
 tempfile = "3.27.0"
 thiserror = "2.0.18"
-tokio = { version = "1.52.1", features = ["full", "tracing"] }
+tokio = { version = "1.52.3", features = ["full", "tracing"] }
 tokio-util = "0.7.18"
 tracing = "0.1.44"
-tracing-opentelemetry = { version = "0.32.1", default-features = false }
+tracing-opentelemetry = { version = "0.33.0", default-features = false }
 tracing-subscriber = { version = "0.3.23", features = [
     "env-filter",
     "time",
@@ -126,7 +132,7 @@ tracing-subscriber = { version = "0.3.23", features = [
 ] }
 ulid = { version = "1.2.1", features = ["serde"] }
 url = "2.5.8"
-utoipa = { version = "5.4.0", features = [
+utoipa = { version = "5.5.0", features = [
     "chrono",
     "axum_extras",
     "ulid",

diff --git a/Dockerfile b/Dockerfile
@@ -1,5 +1,5 @@
 # Build Stage
-FROM rust:1-alpine3.23 AS builder
+FROM rust:1-alpine3.24 AS builder
 WORKDIR /build
 RUN apk update
 RUN apk upgrade
@@ -9,9 +9,9 @@ RUN apk add llvm cmake gcc ca-certificates libc-dev pkgconfig openssl-dev musl-d
 COPY . .
 RUN cargo build --release -p aruna
 RUN cargo build --release -p aruna-doctor
-RUN cargo install --root target iroh-doctor
+RUN cargo install --locked --root target iroh-doctor
 
-FROM alpine:3.23
+FROM alpine:3.24
 WORKDIR /run
 RUN apk update
 RUN apk upgrade

diff --git a/README.md b/README.md
@@ -46,7 +46,7 @@ The system is organized around **realms**. A realm is an organizational trust bo
 
 Each Aruna node exposes an **S3-compatible API**, so researchers can keep using the tools, scripts, workflow systems, and libraries they already have instead of learning a new storage protocol. Buckets are virtual collections that mix local data, replicated data, and references to remote resources. To a user, this looks like one coherent access point. Underneath, Aruna tracks where data actually lives, which permissions apply, and whether an object should be materialized locally or fetched on demand.
 
-Metadata is part of the core system, not an external catalog bolted on afterwards. Descriptions are stored as **RO-Crate JSON-LD**, so datasets, files, people, instruments, workflows, software, and process runs can be described in a shared format. These descriptions live in a CRDT-based triple store, which allows concurrent edits on different nodes and merges them without a single authority arbitrating the result. Management resources such as users and groups follow the same idea through Automerge documents, which lets nodes keep working through network outages and reconcile state once they reconnect.
+Metadata is part of the core system, not an external catalog bolted on afterwards. Descriptions are stored as **RO-Crate JSON-LD**, so datasets, files, people, instruments, workflows, software, and process runs can be described in a shared format. These descriptions live in a CRDT-based triple store, which allows concurrent edits on different nodes and merges them without a single authority arbitrating the result. Management resources such as users and groups are synchronized through durable Irokle document topics, which lets nodes keep working through network outages and reconcile state once they reconnect.
 
 File contents go into a content-addressed blob layer. Objects are hashed with **BLAKE3**, making integrity checks and deduplication part of the storage model rather than a separate step. If the same file shows up under different paths or on different nodes, it is recognized by its content instead of its location. Replication uses Bao-tree verified streaming, so data can be checked incrementally as it arrives.
 
@@ -156,4 +156,4 @@ at your option. Unless you explicitly state otherwise, any contribution intentio
 
 ## Feedback & Contributions
 
-If you have any ideas, suggestions, or issues, please don't hesitate to open an issue and/or PR. Contributions to this project are always welcome ! We appreciate your help in making this project better. Please have a look at our [Contributor Guidelines](./CONTRIBUTING.md) as well as our [Code of Conduct](./CODE_OF_CONDUCT.md) for more information.
+If you have any ideas, suggestions, or issues, please don't hesitate to open an issue and/or PR. Contributions to this project are always welcome ! We appreciate your help in making this project better. Please have a look at our [Contributor Guidelines](./CONTRIBUTING.md) as well as our [Code of Conduct](./CODE_OF_CONDUCT.md) for more information.
diff --git a/api/Cargo.toml b/api/Cargo.toml
@@ -19,6 +19,7 @@ opentelemetry = { workspace = true }
 percent-encoding = { workspace = true }
 serde = { workspace = true }
 serde_json = { workspace = true }
+spargebra = { workspace = true }
 thiserror = { workspace = true }
 tokio = { workspace = true }
 tracing = { workspace = true }
@@ -44,6 +45,7 @@ utoipa-swagger-ui = { workspace = true }
 # S3
 async-trait = { workspace = true }
 futures-core = { workspace = true }
+futures-util = { workspace = true }
 http = { workspace = true }
 hyper = { workspace = true }
 hyper-util = { workspace = true }

diff --git a/api/src/auth.rs b/api/src/auth.rs
@@ -436,7 +436,8 @@ pub async fn auth_middleware(
     // Extract and validate token, get Option<AuthContext>
     // We clone headers to avoid borrowing issues with the async function
     let headers = request.headers().clone();
-    let auth_ctx: Option<AuthContext> = extract_auth_context(&state, &headers).await;
+    let auth_ctx: Option<AuthContext> =
+        aruna_core::telemetry::time_stage("auth", extract_auth_context(&state, &headers)).await;
     record_auth_context(auth_ctx.as_ref());
 
     // Always insert (Some or None) - handlers decide if auth is required
@@ -471,13 +472,16 @@ pub(crate) async fn ensure_permission(
     path: String,
     required_permission: Permission,
 ) -> ServerResult<()> {
-    let allowed = drive(
-        CheckPermissionsOperation::new(CheckPermissionsConfig {
-            auth_context: auth.clone(),
-            path,
-            required_permission,
-        }),
-        &state.get_ctx(),
+    let allowed = aruna_core::telemetry::time_stage(
+        "permission",
+        drive(
+            CheckPermissionsOperation::new(CheckPermissionsConfig {
+                auth_context: auth.clone(),
+                path,
+                required_permission,
+            }),
+            &state.get_ctx(),
+        ),
     )
     .await
     .map_err(|err| ServerError::InternalError(err.to_string()))?;
@@ -563,7 +567,6 @@ mod test {
                 storage_handle,
                 net_handle: None,
                 blob_handle: None,
-                automerge_handle: None,
                 metadata_handle: None,
                 task_handle: None,
             }),
@@ -1103,7 +1106,6 @@ mod test {
         let driver_ctx = Arc::new(DriverContext {
             storage_handle,
             net_handle: None,
-            automerge_handle: None,
             metadata_handle: None,
             task_handle: None,
             blob_handle: None,
@@ -1284,7 +1286,6 @@ mod test {
         let driver_ctx = Arc::new(DriverContext {
             storage_handle,
             net_handle: Some(net_handle.clone()),
-            automerge_handle: None,
             metadata_handle: None,
             task_handle: Some(task_handle),
             blob_handle: None,
@@ -1381,7 +1382,6 @@ mod test {
         let driver_ctx = Arc::new(DriverContext {
             storage_handle,
             net_handle: None,
-            automerge_handle: None,
             metadata_handle: None,
             task_handle: None,
             blob_handle: None,

diff --git a/api/src/error.rs b/api/src/error.rs
@@ -32,6 +32,8 @@ pub enum ServerError {
     BadRequest,
     #[error("Bad gateway")]
     BadGateway,
+    #[error("Service unavailable")]
+    ServiceUnavailable,
 }
 
 #[derive(Debug, Error)]
@@ -145,7 +147,14 @@ impl IntoResponse for ServerError {
 
         let body = ErrorResponse::new(&message).with_code(code);
 
-        (status, Json(body)).into_response()
+        let mut response = (status, Json(body)).into_response();
+        if matches!(self, ServerError::ServiceUnavailable) {
+            response.headers_mut().insert(
+                axum::http::header::RETRY_AFTER,
+                axum::http::HeaderValue::from_static("1"),
+            );
+        }
+        response
     }
 }
 
@@ -159,6 +168,7 @@ impl ServerError {
             ServerError::InternalError(_) => StatusCode::INTERNAL_SERVER_ERROR,
             ServerError::BadRequest => StatusCode::BAD_REQUEST,
             ServerError::BadGateway => StatusCode::BAD_GATEWAY,
+            ServerError::ServiceUnavailable => StatusCode::SERVICE_UNAVAILABLE,
         }
     }
 
@@ -171,6 +181,7 @@ impl ServerError {
             ServerError::InternalError(_) => "Internal error".to_string(),
             ServerError::BadRequest => "Bad request".to_string(),
             ServerError::BadGateway => "Bad gateway".to_string(),
+            ServerError::ServiceUnavailable => "Service unavailable".to_string(),
         }
     }
 

diff --git a/api/src/routes/connectors.rs b/api/src/routes/connectors.rs
@@ -642,7 +642,6 @@ mod tests {
             storage_handle,
             net_handle: None,
             blob_handle: None,
-            automerge_handle: None,
             metadata_handle: None,
             task_handle: None,
         });