HYX

Study 02 / policy execution

Hyx research study

Policy at wire speed.

A production study of compiled rules, exact acceleration, and policy replacement without interpretation on every request.

Research classification

Host measurements / repository invariants / primary literature

E1 / finding
407.7ns
representative clean request
109 instructions / release build / this host
E2 / finding
6.77µs
3,000-rule evaluation
clean request / 200k iterations / this host
E3 / finding
1 load
per indexed field cluster
compile-time classification / runtime reuse
E4 / finding
64
library tests in focused suite
semantics / optimization / lifecycle

Abstract

Move policy work out of the request path while preserving its semantics.

Research question / RQ-02

Can expressive edge policy be compiled into a stable execution artifact that remains fast at thousands of rules while preserving authored order and behavior?

01 / Method

Trace policy from structured rules through compilation, safe optimization, immutable publication, and request evaluation; then exercise the same path with release measurements and semantic tests.

02 / Measured answer

On this host, the representative 109-instruction policy evaluated in 407.7 ns and the generated 3,000-rule workload in 6.765 µs. These are engine measurements, not end-to-end CDN latency.

03 / Publication boundary

This study reports architecture, behavior, measurements, and correctness constraints. It omits constants and implementation detail that would make the production engine reconstructable.

Execution model

Author once. Compile once. Evaluate against a finished program.

A-01 / policy lifecycle

control plane → immutable artifact → request path

01

Ingest

Domain and global policy arrive as structured rules with explicit priority and actions.

02

Classify

Exactly answerable shapes are separated from conditions requiring the general execution path.

03

Compile

Conditions and actions become a stable domain-specific artifact; pattern work happens before requests arrive.

04

Verify

Only branch-safe optimization passes run, with semantic and jump-bound regressions around them.

05

Publish

The completed artifact replaces its predecessor atomically in the runtime cache.

E3 · E5 · E6 · E8 / public model intentionally abstracts reconstructable mechanics

Controlled measurements

Sub-microsecond on representative policy. Single-digit microseconds at 3,000 rules.

M-01 / release-mode host run

11 July 2026 / lower is better

Representative clean evaluation

407.7ns

109 instructions / 1.5M measured executions

The number measures rule evaluation only. Network, parsing, logging, and downstream enforcement are outside the timing boundary.

WorkloadPolicy sizeResidual instructionsRecorded costMeasurement
Representative policy~40 conditions109407.7 ns1.5M measured executions
Ruleset scale / 100100 rules1295.7 ns200K measured executions
Ruleset scale / 500500 rules1332.5 ns200K measured executions
Ruleset scale / 1,0001,000 rules1348.4 ns200K measured executions
Ruleset scale / 3,0003,000 rules16,765.0 ns200K measured executions

Internal release build · local host · warm cache · controlled synthetic inputs · results vary with CPU, compiler, policy shape, and request data

Experimental design

Measure the engine, isolate the operators, then challenge the semantics.

01E1

Representative policy

A production-shaped mix of methods, paths, agents, regular expressions, geolocation, IP lists, headers, query parameters, and compound conditions.

Result / 407.7 ns per clean evaluation across 1.5 million measured executions after warmup.

02E2

Ruleset scaling

Generated clean-request workloads at 100, 500, 1,000, and 3,000 rules, each measured for 200,000 executions after warmup.

Result / 295.7 ns through 6.765 µs on this host; the curve is workload-shaped rather than a universal constant.

03E3

Operator isolation

Single non-matching conditions isolate equality, substring, prefix, suffix, regex, list, IP-list, numeric, header, and query-field costs.

Result / 8.7 ns for baseline method equality; 34.7 ns for query-field equality in the recorded run.

04E4

Semantic oracle

Accelerated execution is compared with the linear path across generated requests and rule shapes, including ordering and duplicate-match behavior.

Result / The indexed path is constrained to reproduce linear semantics, not merely approximate the same decision.

Semantic preservation

An optimization is valid only when the decision remains identical.

C-01 / correctness constraints

accelerated path = authored policy

01

Exact classification

Only conditions with an exact accelerated reformulation leave the general path. Compound and unsupported semantics stay intact.

02

Stable precedence

Matches from different execution paths are returned to authored priority and action urgency before enforcement.

03

Branch integrity

Instruction removal and fusion must remap every control-flow target; regressions cover nested Boolean policy and bounds.

04

Failure isolation

Invalid or oversized patterns fail closed at their own rule boundary without corrupting unrelated policy groups.

The research lineage extends beyond one engine. Thompson (1968) established compiled automata for regular-expression search; Aho and Corasick (1975) showed how to search many fixed patterns in one pass; Forgy (1982) examined many-pattern production systems. Hyx applies the same systems principle by moving repeated work into structure while meeting the semantic and latency constraints of an edge request.

Runtime operations

Policy changes become new artifacts, not mutations inside live requests.

01

Domain isolation

Each domain receives its own compiled policy artifact, while global policy occupies a separate slot and does not force per-domain recompilation.

02

Prewarm and negative knowledge

Known policy and known-empty domains have separate cache behavior, reducing repeated control-plane work around request arrival.

03

Streamed replacement

Update and delete events compile or clear the relevant artifact, then publish the finished state with explicit lifecycle logging.

Interpretation

Fast in the measured boundary is not a universal latency claim.

01

Host-specific measurements

These results come from one release-mode run on the current development host. CPU, compiler, allocator, and thermal state can move the absolute numbers.

02

Policy shape matters

Rule count alone does not determine cost. Field diversity, compound expressions, pattern complexity, match position, and request content change the path taken.

03

No external competitor claim

This study does not benchmark another commercial rule engine. Its comparison is between Hyx execution shapes and repository-defined correctness oracles.

The defensible conclusion is precise: the measured Hyx engine evaluates a representative policy in hundreds of nanoseconds and a generated 3,000-rule workload in single-digit microseconds on this host, while repository tests constrain acceleration, ordering, branch safety, and live replacement.

Evidence register

Every performance and semantics claim has a repository anchor.

E1

Release timing test

The release test measures two million representative clean evaluations after a 100,000-iteration warmup; the refreshed host run recorded 408.0 ns.

E2

Production-scale harness

The scaling harness measures 100, 500, 1,000, and 3,000-rule clean-request workloads with explicit warmup and iteration counts.

E3

Compiler and execution index

The compiler classifies only rule shapes that can be answered exactly; unsupported or compound forms retain the general execution path.

E4

Focused test suite

Compiler, optimizer, executor, cache, invalidation, and plugin tests cover ordering, fields, operators, malformed inputs, lifecycle events, and execution parity.

E5

Jump-safe optimization

Optimization passes rebuild instruction mappings before remapping branches; regression tests constrain nested Boolean expressions and jump bounds.

E6

Bounded pattern compilation

Pattern compilation has explicit size limits and isolates invalid expressions so one malformed rule does not poison unrelated groups.

E7

Zero-copy request context

Common request fields are borrowed from the request context, while dynamic headers, query parameters, signals, and actor state have dedicated access paths.

E8

Live replacement

The update listener compiles incoming domain or global policy before publishing the completed artifact into the cache, with explicit clear and delete behavior.

Research archive

Return to the systems studies.

Measured claims, explicit boundaries, and the source evidence behind both.

Open the archive