pubkey/rxdb

The local-first data layer, squarely within the brief's CRDT/sync-engine case: the database is on the client and replication targets a backend you already run, so the application works — and holds its data — without a round trip. No AI in it, which the brief explicitly allows; practitioners building local-first AI applications raise exactly this layer unprompted. The "no vendor, no lock-in" claim is checkable against the replication design, which is protocol-agnostic rather than pointed at a hosted RxDB service.