FerroDruid - Rust-native Apache-Druid-compatible OLAP

FerroDruid is a Rust-native, Apache-Druid-spec-compatible real-time OLAP database. It speaks the Druid REST API, native query JSON, and Druid SQL, and it reads and writes Druid segment v9/v10 binary files - without a JVM, without ZooKeeper, and without a six-process control plane to operate. A classic Apache Druid cluster needs six or more JVM processes plus ZooKeeper plus an external metadata database, and 16 GB or more of RAM, before it serves a single query. FerroDruid's single-binary mode replaces all of that with one process that starts in under a second, uses under 200 MB of RAM, and ships as a self-contained AMI. What FerroDruid does today (v0.2.0): it serves all eight Druid native query types (timeseries, topN, groupBy, scan, search, segmentMetadata, dataSourceMetadata, timeBoundary); it runs Druid SQL with SELECT, WHERE, GROUP BY, HAVING, ORDER BY, LIMIT, more than 30 functions, EXPLAIN PLAN FOR, and an MSQ task endpoint (core SQL parity approximately 95 percent); it exposes more than 40 Druid-compatible REST endpoints; it reads and writes Druid segment v9/v10 (the supported single-binary path uses SQLite metadata plus local-filesystem deep storage); it ingests from Kafka and Kinesis supervisors and via native batch; and it enforces Basic authentication (Argon2id) with role-based access control on by default and TLS via rustls. Admin password security: on first boot the AMI generates a NEW RANDOM admin password UNIQUE to that instance (never a default or shared password) and writes it once to the instance system log. The admin account is flagged must-change, so EVERY API endpoint returns HTTP 403 until the operator rotates the password by POSTing a new one to /druid-ext/basic-security/authentication/db/basic/users/admin/credential; the rotated credential is persisted and survives restarts. This enforces a password change on first login. Engineering posture: every crate uses forbid(unsafe_code), clippy is clean at -D warnings, a CycloneDX SBOM and 18 fuzz targets run in CI. Live wire deep-match is 5 of 5 against Apache Druid 30.0.1 and 5 of 5 with an Apache Superset connector. Honest scope: live validation is against Apache Druid 30.0.1 and single-binary mode; Druid 31 through 36 is a spec-driven design target not yet cross-validated against a running cluster; multi-node topologies fail closed by default. This listing sells a hardened, scanned, supported distribution built from the Apache-2.0 source at a pinned release version; the code itself remains Apache-2.0. The AMI is metered automatically by AWS per running instance-hour, with no metering code in the product.