Development records for the Ferro products that are publicly available today — one page per product, with the measured build record behind each one: first commit, commit counts, code size, test counts, the quality gates it passed, and — just as important — what is not being claimed.
As of 2026-07-10, five Ferro products are live on AWS Marketplace:
| Product | Compat target | Version | Devlog |
|---|---|---|---|
| FerroSCA | SBOM / SCA / vulnerability management (CycloneDX, SPDX) | v1.0.0 | record |
| FerroDruid | Apache Druid–compatible OLAP | v1.0.0 | record |
| FerroStash | Logstash-compatible pipeline (source on GitHub) | v1.0.0 | record |
| FerroAir | Apache Airflow™ 3.x orchestration | v0.1.0 | record |
| FerroRepo | Universal artifact repository (OCI, Cargo, Maven, PyPI, Helm, Go, APT/YUM) | v0.1.0 | record |
The fleet these came from, measured
The five public products are part of a larger fleet. Measured 2026-07-10 with git and tokei (code lines exclude comments, blanks, and anything in .gitignore; test counts are #[test]/#[tokio::test] annotations on git-tracked files only). Scope: the Ferro product workspace — 21 repositories covering the products, their compatibility editions, and the conformance / Jepsen / bench harnesses. All four numbers below are over that same 21-repo set:
- 6,549 commits between 2026-03-31 and 2026-07-10
- ~2.08M lines of Rust (3.16M total code lines)
- 55,177 test annotations (a portion is generated conformance tests — see each product page for what that means)
How it is built
One developer, orchestrating Claude Code — that part is stated openly, because the interesting result is not “AI wrote code” but what the git history looks like when the operating rules are strict:
- Parallel agents with isolated file scopes (3–4 at a time, measured zero file conflicts across 40+ agent runs), with push rights reserved to the orchestrating session.
- Adversarial review until it goes quiet. Release gates require zero new Critical/High findings for two consecutive review rounds — reviews run through a competing vendor’s model on purpose, so blind spots don’t line up.
- A nightly fuzz farm (53 targets) that has self-found 17+ production DoS bugs, each fixed the same day it surfaced.
- Conformance over vibes: byte-equivalence harnesses against the upstream products (Elasticsearch, Logstash, Druid, Flink, Kafka clients) rather than “it looks compatible.”
- Vocabulary rules: “verified” requires driving the real flow end-to-end; “X× faster” requires full-mode benchmarks on real data; “production-ready” requires the release gate plus a written list of remaining work.
The longer story is in Building Ferro, the launch post from 2026-04-26.
What these numbers do and don’t mean
Commit counts and line counts are proxy metrics, and this corpus contains template fan-out and generated tests like any large one. They are published anyway because they are reproducible — the measurement method is stated above, and where a number is soft (generated tests, synthetic suites), the product page says so. The load-bearing quality artifacts are the per-product diligence logs, conformance results, and fuzz findings, not the totals.