Everything they deleted was on the inside: ten years of HashiCorp, read from its own repositories
Which decisions in a long-lived platform stay reversible, and which harden the moment a third party builds on them, traced through one company's repositories from 2016 to 2026.
HashiCorp spent a decade deleting things from the inside of its products: a Raft log store, a dependency cluster, a process on every node, four products. In the same decade it could not move its plugin protocol, could not retire its old provider SDK, and could not change its licence without forking the ecosystem. This guide reconstructs both halves from changelogs, licence files, design documents and archived READMEs, and gives an architect a test for telling the two kinds of decision apart before publishing either.
OpenTofu's copy of the plugin protocol documentation still dates protocol 5.0 to "OpenTofu v0.12", a release that never existed: a fork created over the licence changed everything except the boundary its users' binaries compile against.
What you get out of it
- Every architectural change HashiCorp completed in ten years was a deletion from the interior: Vault absorbed its storage in 1.4, Consul removed the client agent in 1.14, the Raft log store went LMDB to BoltDB to bbolt to an opt-in WAL.
- Nothing at the perimeter moved. The replacement provider framework reached general availability in December 2022 and the SDK it replaced still shipped a release on the same day in March 2026.
- The replacement Raft log store has been labelled experimental since February 2023 and is still not the default in the newest documentation the repositories carry.
- The licence is a perimeter decision wearing a commercial disguise: Terraform 1.6.0 shipped the Business Source License, the SDKs stayed under MPL 2.0 because they could not be closed, and the fork kept the wire protocol verbatim.
- HashiCorp publishes no incident reports for Consul, Vault, Nomad or Terraform, so its own documentation of failure modes and other organisations' postmortems are the only public record of what breaks.
Scope
Why this, now. The acquisition by IBM completed in February 2025 and the suite took coordinated 2.0 releases in April and May 2026, which closes the decade cleanly enough to read as a finished experiment.
What it does not cover. The hosted HashiCorp Cloud Platform control plane, Enterprise-only replication internals, Terraform language semantics, and any assessment of the commercial strategy behind the licence change.
Other field guides
Keeping the main branch green: thirteen years of merge queues, read from the repositories that ran them
The merge-queue pattern traced through its primary record: Rust's three generations of bors, Zuul's speculative gating, Kubernetes' Tide, GitLab's tr…
20 sources · 11 organisations · 2 postmortemsReplacing the engine room in public: ten years of Sentry, read from its RFCs, releases and self-host floor
A decade of component replacement inside one product, measured in the artefact other people install: seven containers at the 9.1.2 tag, thirty by the…
32 sources · 3 organisations · 5 postmortemsScaling without splitting: a decade of Shopify, read from the code it published
A decade of one company's architecture, reconstructed from the ring of repositories around a closed monolith: a boundary checker whose stricter half …
26 sources · 8 organisations · 4 postmortems