Abstract
Move policy work out of the request path while preserving its semantics.
Research question / RQ-02
Can expressive edge policy be compiled into a stable execution artifact that remains fast at thousands of rules while preserving authored order and behavior?
01 / Method
Trace policy from structured rules through compilation, safe optimization, immutable publication, and request evaluation; then exercise the same path with release measurements and semantic tests.
02 / Measured answer
On this host, the representative 109-instruction policy evaluated in 407.7 ns and the generated 3,000-rule workload in 6.765 µs. These are engine measurements, not end-to-end CDN latency.
03 / Publication boundary
This study reports architecture, behavior, measurements, and correctness constraints. It omits constants and implementation detail that would make the production engine reconstructable.
Execution model
Author once. Compile once. Evaluate against a finished program.
A-01 / policy lifecycle
control plane → immutable artifact → request path
Ingest
Domain and global policy arrive as structured rules with explicit priority and actions.
Classify
Exactly answerable shapes are separated from conditions requiring the general execution path.
Compile
Conditions and actions become a stable domain-specific artifact; pattern work happens before requests arrive.
Verify
Only branch-safe optimization passes run, with semantic and jump-bound regressions around them.
Publish
The completed artifact replaces its predecessor atomically in the runtime cache.
E3 · E5 · E6 · E8 / public model intentionally abstracts reconstructable mechanics
Controlled measurements
Sub-microsecond on representative policy. Single-digit microseconds at 3,000 rules.
M-01 / release-mode host run
11 July 2026 / lower is better
Representative clean evaluation
407.7ns
109 instructions / 1.5M measured executions
The number measures rule evaluation only. Network, parsing, logging, and downstream enforcement are outside the timing boundary.
| Workload | Policy size | Residual instructions | Recorded cost | Measurement |
|---|---|---|---|---|
| Representative policy | ~40 conditions | 109 | 407.7 ns | 1.5M measured executions |
| Ruleset scale / 100 | 100 rules | 1 | 295.7 ns | 200K measured executions |
| Ruleset scale / 500 | 500 rules | 1 | 332.5 ns | 200K measured executions |
| Ruleset scale / 1,000 | 1,000 rules | 1 | 348.4 ns | 200K measured executions |
| Ruleset scale / 3,000 | 3,000 rules | 1 | 6,765.0 ns | 200K measured executions |
Internal release build · local host · warm cache · controlled synthetic inputs · results vary with CPU, compiler, policy shape, and request data
Experimental design
Measure the engine, isolate the operators, then challenge the semantics.
Representative policy
A production-shaped mix of methods, paths, agents, regular expressions, geolocation, IP lists, headers, query parameters, and compound conditions.
Result / 407.7 ns per clean evaluation across 1.5 million measured executions after warmup.
Ruleset scaling
Generated clean-request workloads at 100, 500, 1,000, and 3,000 rules, each measured for 200,000 executions after warmup.
Result / 295.7 ns through 6.765 µs on this host; the curve is workload-shaped rather than a universal constant.
Operator isolation
Single non-matching conditions isolate equality, substring, prefix, suffix, regex, list, IP-list, numeric, header, and query-field costs.
Result / 8.7 ns for baseline method equality; 34.7 ns for query-field equality in the recorded run.
Semantic oracle
Accelerated execution is compared with the linear path across generated requests and rule shapes, including ordering and duplicate-match behavior.
Result / The indexed path is constrained to reproduce linear semantics, not merely approximate the same decision.
Semantic preservation
An optimization is valid only when the decision remains identical.
C-01 / correctness constraints
accelerated path = authored policy
Exact classification
Only conditions with an exact accelerated reformulation leave the general path. Compound and unsupported semantics stay intact.
Stable precedence
Matches from different execution paths are returned to authored priority and action urgency before enforcement.
Branch integrity
Instruction removal and fusion must remap every control-flow target; regressions cover nested Boolean policy and bounds.
Failure isolation
Invalid or oversized patterns fail closed at their own rule boundary without corrupting unrelated policy groups.
The research lineage extends beyond one engine. Thompson (1968) established compiled automata for regular-expression search; Aho and Corasick (1975) showed how to search many fixed patterns in one pass; Forgy (1982) examined many-pattern production systems. Hyx applies the same systems principle by moving repeated work into structure while meeting the semantic and latency constraints of an edge request.
Runtime operations
Policy changes become new artifacts, not mutations inside live requests.
Domain isolation
Each domain receives its own compiled policy artifact, while global policy occupies a separate slot and does not force per-domain recompilation.
Prewarm and negative knowledge
Known policy and known-empty domains have separate cache behavior, reducing repeated control-plane work around request arrival.
Streamed replacement
Update and delete events compile or clear the relevant artifact, then publish the finished state with explicit lifecycle logging.
Interpretation
Fast in the measured boundary is not a universal latency claim.
Host-specific measurements
These results come from one release-mode run on the current development host. CPU, compiler, allocator, and thermal state can move the absolute numbers.
Policy shape matters
Rule count alone does not determine cost. Field diversity, compound expressions, pattern complexity, match position, and request content change the path taken.
No external competitor claim
This study does not benchmark another commercial rule engine. Its comparison is between Hyx execution shapes and repository-defined correctness oracles.
The defensible conclusion is precise: the measured Hyx engine evaluates a representative policy in hundreds of nanoseconds and a generated 3,000-rule workload in single-digit microseconds on this host, while repository tests constrain acceleration, ordering, branch safety, and live replacement.
Evidence register
Every performance and semantics claim has a repository anchor.
Release timing test
The release test measures two million representative clean evaluations after a 100,000-iteration warmup; the refreshed host run recorded 408.0 ns.
Production-scale harness
The scaling harness measures 100, 500, 1,000, and 3,000-rule clean-request workloads with explicit warmup and iteration counts.
Compiler and execution index
The compiler classifies only rule shapes that can be answered exactly; unsupported or compound forms retain the general execution path.
Focused test suite
Compiler, optimizer, executor, cache, invalidation, and plugin tests cover ordering, fields, operators, malformed inputs, lifecycle events, and execution parity.
Jump-safe optimization
Optimization passes rebuild instruction mappings before remapping branches; regression tests constrain nested Boolean expressions and jump bounds.
Bounded pattern compilation
Pattern compilation has explicit size limits and isolates invalid expressions so one malformed rule does not poison unrelated groups.
Zero-copy request context
Common request fields are borrowed from the request context, while dynamic headers, query parameters, signals, and actor state have dedicated access paths.
Live replacement
The update listener compiles incoming domain or global policy before publishing the completed artifact into the cache, with explicit clear and delete behavior.
References / Harvard style
Regular-expression compilation
Thompson, K. (1968) ‘Programming Techniques: Regular expression search algorithm’, Communications of the ACM, 11(6), pp. 419–422. doi: 10.1145/363347.363387.
Open source ↗Reference / 02Multiple-pattern matching
Aho, A.V. and Corasick, M.J. (1975) ‘Efficient string matching: An aid to bibliographic search’, Communications of the ACM, 18(6), pp. 333–340. doi: 10.1145/360825.360855.
Open source ↗Reference / 03Production rule matching
Forgy, C.L. (1982) ‘Rete: A fast algorithm for the many pattern/many object pattern match problem’, Artificial Intelligence, 19(1), pp. 17–37. doi: 10.1016/0004-3702(82)90020-0.
Open source ↗Research archive
Return to the systems studies.
Measured claims, explicit boundaries, and the source evidence behind both.