Graf Forge — Sovereign Package Registry

Cloud Infrastructure

The Forge at the Edge

Graf Forge is cloud-native registry infrastructure. R2 for objects, D1 for refs, KV for sessions. BLAKE3 WASM at every edge node. GTP v1.1 as the single wire protocol.

⚙

GTP v1.1 Transport

Unified wire protocol for VCS + package distribution. One connection, all operations.

🔒

Ed25519 Auth

Challenge-response session tokens. Your Soul Key never leaves your machine.

📁

CAS + Refs

BLAKE3 content-addressed storage with atomic compare-and-swap ref updates.

📦

GPAK Streaming

Bulk object transfer with length-prefixed frames and BLAKE3 footer checksum.

GTP v1.1

One Protocol. Everything Ships.

GTP — Graf Transfer Protocol — handles version control, package distribution, and identity in a single wire protocol.

AUTH Challenge-Response

Ed25519 challenge → sign → session nonce. No passwords. No tokens to rotate.

BLAKE3(challenge ++ sig ++ secret)

CAS Content-Addressed Storage

R2-backed CAS. Push objects by CID, pull by CID. Every write is idempotent.

REF Atomic Ref Updates

Compare-and-swap on every ref write. Race-safe. Tags are immutable once created.

old_cid must match or reject

SBI Zero-Copy Encoding

Binary serialization for high-performance sync. No JSON overhead. CBOR-native.

PKG Package Distribution

Same protocol, same identity. graf publish seals with your SoulKey, pushes to registry.

GPAK Bulk Transfer

Pack multiple objects into a single framed stream. Length-prefixed frames, BLAKE3 footer.

API Reference

GTP v1.1 Endpoints

Base URL: https://graf-forge.org/v1/repo/{owner}/{name}

GET / Content negotiation root (SBI, JSON, HTML)

POST /auth {owner}/{name} Initiate Ed25519 challenge-response

POST /auth/verify {owner}/{name} Verify signed challenge, issue session

PUT /cas/{cid} Upload CAS object by BLAKE3 CID

GET /cas/{cid} Retrieve CAS object by CID

POST /cas/exists {owner}/{name} Batch-check CID existence

GET /refs {owner}/{name} List all refs (branches, tags)

PUT /refs/{ref_path} Atomic CAS update with old_cid check

POST /negotiate {owner}/{name} DAG sync negotiation

GET /health Service health + dependency status

SBI Native For Agents

agent.sbi

// Content negotiation — binary first
GET /
Accept: application/x-sbi

// Authentication — Ed25519 challenge-response
POST /v1/repo/{owner}/{name}/auth
POST /v1/repo/{owner}/{name}/auth/verify

// CAS — push/pull by BLAKE3 CID
PUT  /v1/repo/{owner}/{name}/cas/{cid}
GET  /v1/repo/{owner}/{name}/cas/{cid}
POST /v1/repo/{owner}/{name}/cas/exists

// Refs — atomic compare-and-swap
GET  /v1/repo/{owner}/{name}/refs
PUT  /v1/repo/{owner}/{name}/refs/{ref_path}

// DAG sync
POST /v1/repo/{owner}/{name}/negotiate

challenge-response blake3-cids session-tokens per-agent-branches

JSON API For Developers

graf.tools
Download CLI tools: graf, hinge, nip
grafhub.org
Discover and publish packages, browse repositories
docs.janus-lang.org
Documentation, guides, and protocol specs
GTP Specification
Ed25519 challenge-response, BLAKE3 addressing, wire format
SBI Encoding
Zero-copy binary serialization for high-performance sync

Quick Start

Init. Auth. Push.

Single static binary. GTP-native push. No build step required.

terminal

# Install Graf CLI
$ curl -fsSL https://graf.tools/install.sh | sh

# Create a repository
$ graf init --name my-project

# Generate your Soul Key identity
$ graf key generate
# → SoulKey: grf:a8b7c9d2 + Ed25519 keypair

# Authenticate with the forge
$ graf auth graf-forge.org

# Push to registry — GTP native
$ graf push graf-forge.org
# → Push complete: 4 objects, 176 bytes, 1 ref updated

Live Status

Operational

Forge Operational

Native Push Live

Protocol GTP v1.1

Encoding SBI v1.0

Crypto BLAKE3 + Ed25519

Runtime Cloudflare Workers

Storage R2 + D1 + KV

SHA-256 Zero. None.