One Protocol. Everything Ships.
Git has one protocol for code and npm/pip/cargo for packages. Graf unifies both. GTP – the Graf Transfer Protocol – handles version control, package distribution, and identity in a single wire protocol. Push code and publish packages through the same endpoint, with the same key.
Challenge-Response Auth
Ed25519 challenge → sign → session nonce. No passwords stored. No tokens to rotate.
BLAKE3(challenge ++ sig ++ secret) Content-Addressed Storage
R2-backed CAS. Push objects by CID, pull by CID. HEAD to check existence. Every write is idempotent.
Atomic Ref Updates
Compare-and-swap on every ref write. Race-safe. Tags are immutable once created.
old_cid must match or reject GPAK Bulk Transfer
Pack multiple objects into a single framed stream. Length-prefixed frames, BLAKE3 footer checksum.
Package Distribution
Same protocol, same identity. graf publish seals a package with your SoulKey, pushes to the registry.
graf publish → graf resolve Tested End-to-End
62 integration tests + an 8-program smoke suite that spins up a git fixture server and exercises the full CLI surface. The release gate refuses to tag a red smoke run.
Architecture
Five subsystems. Auditable in an afternoon. No magic.
Content-Addressed Store
BLAKE3 CIDs with graf1 prefix. Prefix-sharded object directory, transparent deflate compression. graf fsck verifies the entire graph.
Object Model
Five types: Blob → Tree → Change → Checkpoint → Release. All CBOR-serialized. Checkpoints form the DAG. Releases are cryptographic – not faith.
SoulKey Identity
Ed25519 keypair = identity. SoulKeyID = grf: + BLAKE3(pubkey)[0:8]. 20 characters, zero PII. Challenge-response auth – no passwords on the wire.
Merge Engine
LCA via alternating BFS (depth limit 10K). Three-way tree + line-level merge. Conflict entries carry base, ours, theirs CIDs for programmatic resolution.
Release Certificates
Ed25519-signed release objects binding version + checkpoint + tree CID. --run-tests embeds verified test counts. Git tags are faith. Graf releases are receipts.
GTP Wire Protocol
17 endpoints over HTTPS. CAS per-object, refs with atomic CAS, GPAK bulk transfer, challenge-response auth. BLAKE3 WASM at the edge.