A sovereign VCS — making git's bolt-ons first-class

Operator directive: build our own state-of-the-art version-control + code platform, integer-deterministic and sovereign, that makes first-class what git left as bolt-ons — API (Swagger/OpenAPI), secrets (Vault), dependency graphs/SBOM, team-native benchmarking tied to sovereign work, research linked to history — native to the Nishi OS AND interoperable as an app on Linux, the way git ships. Four-pillar grounded (researcher-fetched SOTA, adversarial census, honest roadmap). Rungs X0 + X1 are COMPLETE (2026-07-14): the sovereign object store, and the full git wire — a stock git can clone and push against our own sovereign HTTP server (no nginx, no framework), all proven against stock git 2.43 — details below. The rest of the field remains the honest roadmap.

Rungs X0 + X1 shipped — a stock git clone and push against our sovereign server

And the interop runs both ways. X0 — our tool writes a loose object, and stock git cat-file + git fsck --strict read it back clean. X1a — our assembler builds a bare repo (objects + refs + HEAD + object-format=sha256 config) that a stock git clone round-trips: HEAD→commit→tree→blob→checkout hello.txt=hello, git fsck clean. X1b — our packfile generator emits a PACK v2 (+ sha256 trailer) that stock git index-pack --strict, verify-pack, unpack-objects validate (our blob 5 / tree 49 / commit 142). Gates nx_sovgit_obj_gate / _repo_gate / _pack_gate — all GREEN. X1c — a sovereign HTTP server (nx_sovgit_serve, built on our own sockets via nx_http_server, no nginx, no framework) serves the repo over git's dumb-HTTP protocol, so a stock git clone http:// round-trips over the network. X1e/f — the sovereign smart-HTTP server nx_sovgit_git (pkt-line protocol, still our own sockets) speaks the full bidirectional git wire to a stock git (2.43, GIT_TRACE_PACKET-proven): clone via git-upload-pack (ref advertisement + our X1b pack → checkout hello), and push via git-receive-pack — we parse the ref-update, unpack the client's pack (X1d), update the ref, and report unpack ok / ok refs/heads/master. A stock git push exits 0 and the server's ref advances (02acc3e8→b0b8d54a, world.txt=world landed, git fsck clean). X1 is complete — a stock git can clone and push against our sovereign server, so gitea can be sunset. AUTH rung (2026-07-14) — the server now stands behind the sovereign ocap wall: it binds loopback-only and self-gates with nx_login_gate (gate 9/9) — one capability token accepted in any wire form (X-Nishi-Cap header, Authorization: Bearer, or git's Authorization: Basic x:<cap>), fail-closed on tamper / expiry / wrong-scope / foreign key, with a proper 401 WWW-Authenticate: Basic realm="nishi-git" challenge. Same cap system that secures the MCP tools API — mint git access with nx_cap_mint … git …, attenuate or revoke it like any Nishi capability. This is the first consumer of the Nishi Login auth product. PUBLIC-LIVE 2026-07-15 at nishifamily.com/git — deployed on the NAS behind the real edge (TLS → SNI → sites.elf gated route → loopback ocap wall). Full round-trip proven over the public internet with a stock git: an unauthenticated clone is denied; an authenticated git clone succeeds; a git push advances the server ref (02acc3e→fbd5749); and a fresh clone sees the pushed file (proof.txt). Fixing that round-trip surfaced a real serving≠working bug — the smart-HTTP read path had been serving a startup snapshot (a push reported success but a re-clone didn't reflect it); now the advertisement reads the on-disk ref per request and the pack is built by walking the actual loose objects on disk, so push→persist→reclone is real. Next: hostctl-supervise the daemon (durability) + X2 multi-repo host + delta-encoding.

The census — us vs the field (organ-scored, honest)

The roadmap & raw census

SOVEREIGN VCS / CODE-PLATFORM CENSUS -- 2026-07-14. Them = git object model + Fossil (all-in-one) + Jujutsu (modern UX) + Radicle (sovereignty) + deps.dev (supply-chain) + the bolt-ons (OpenAPI/Vault/Actions). Us = a NISHI-native VCS that makes the bolt-ons FIRST-CLASS, integer-deterministic, OS-native AND git-interoperable. RUNG 0 -- nothing native is built yet (we shell to /usr/bin/git).

AXIS VCS object store      HAVE     HAVE -- X0+X1a+X1b BUILT 2026-07-14, ALL byte-exact vs STOCK git 2.39 (object-format=sha256): loose blob/tree/commit (git cat-file/fsck read them), a bare repo a STOCK `git clone` round-trips (checkout hello.txt=hello, fsck clean), a PACKFILE `git index-pack`/`verify-pack`/`unpack-objects` validate (blob 5 / tree 49 / commit 142 + sha256 trailer). Built on sovereign sha256_digest + zlib. Remaining = delta-compression (optimization) + the network smart-HTTP wire (rung X1 proper)
AXIS git-client interop     HAVE     HAVE -- X1 COMPLETE 2026-07-14: nx_sovgit_git = a SOVEREIGN SMART-HTTP git server (nx_http_server sockets, no nginx/framework, pkt-line) -> a STOCK git speaks the FULL BIDIRECTIONAL wire (git 2.43, GIT_TRACE_PACKET-proven): CLONE (git-upload-pack advertisement + POST streams X1b pack -> checkout hello) + PUSH (git-receive-pack: parse ref-update + UNPACK client pack via X1d + update ref + report unpack-ok/ok-refs -> git push exit 0, ref 02acc3e8->b0b8d54a, world.txt=world landed, fsck clean). +dumb-HTTP fallback. Remaining refinements: delta-encoding + multi-repo host (X2)
AXIS bundled platform       PARTIAL  PARTIAL: Fossil's 'GitHub-in-a-box' (VCS+tickets+wiki+forum+chat+RBAC in ONE binary) is the model; we HAVE the pieces as ISLANDS (nx_wiki_*, /project mgmt, workflow automation, /relate CRM) + a gitea REST client. FIRST WIRING LANDED 2026-07-14: the RBAC clause -- the repo host now enforces ocap access IN-BINARY (nx_login_gate import; stock-git-with-cap proven). Tickets/wiki/forum still unwired
AXIS modern VCS UX          GAP      GAP (rung X8): no operation-log/undo, no first-class conflicts, no working-copy-as-commit (the Jujutsu leap). Our integer-determinism makes an EXACT, replayable oplog a natural exceed
AXIS sovereign p2p          PARTIAL  PARTIAL: Radicle = local-first p2p, cryptographic DID identity, gossip replication, no central server. We HAVE the substrate (opaque cryptographic identity + caps + a sovereign SSH stack + a torrent stack -- the code already flags 'sovereign pack/push on own torrent stack') -- unwired to a repo layer
AXIS first-class API        PARTIAL  PARTIAL + EXCEED-direction (WHY): git makes the API a bolt-on (GitHub REST/GraphQL); our mgmt API is ALREADY OpenAPI-first (/api/openapi.json + a native console) -> a Nishi VCS would be API-FIRST BY DEFAULT, every repo+platform op a typed documented endpoint
AXIS first-class secrets     PARTIAL  PARTIAL, access-half PROVEN 2026-07-14: Vault's DYNAMIC-CREDS story is now WIRED TO THE REPO HOST -- nx_login_gate (gate 9/9) validates a scoped/attenuable/revocable ocap presented as X-Nishi-Cap | Bearer | Basic, and the git server self-gates with it (STOCK git clones with a cap as its Basic password; unauth=401 WWW-Authenticate; tamper/expiry/foreign-key/wrong-scope denied). Remaining half = repo SECRETS STORAGE (per-repo secret material, signing-key mgmt) -- unwired
AXIS dependency graph/SBOM  GAP      GAP (rung X5, operator-named): no transitive dependency graph, no SBOM (SPDX/CycloneDX), no vuln (OSV) or provenance/attestation. 'Is this code safe/legal/trustworthy?' -- the supply-chain layer git lacks, to be built FIRST-CLASS
AXIS team-native benchmark   PARTIAL  PARTIAL: GitHub Actions is a bolt-on CI; we HAVE nx_forge (codegen->sovereign build->BYTE-EXACT judge->bounded repair) + the census-gate discipline + the team -- the substrate to natively benchmark every commit AND grab code to benchmark tied to sovereign work; unwired to repos
AXIS research linkage        GAP      GAP (rung X7, operator-named, NOVEL): research (our deep-research organs) tied FIRST-CLASS to repos/commits -- invoke the researcher on the code, link findings to history. No forge does this; the organs exist but are not wired to a repo layer
AXIS OS-native + Linux app  GAP      GAP (rung X11): the dual mode -- native to the Nishi OS (repos as first-class OS objects) AND shipping as an interoperable app on Linux (the way git ships). Nothing built
AXIS determinism/reproduce  GAP      GAP-but-EXCEED-direction (WHY): git's SHA-1/256 addressing is deterministic but its ecosystem (CI, builds, deps) is not reproducible; our 100%-integer substrate makes bit-exact reproducible builds + a replayable oplog + deterministic benchmarks the STRUCTURAL exceed -- a code platform where every artifact is reproducible by construction

SCORE 333/1000 (HAVE 2 / PARTIAL 5 / GAP 5 of 12)

★THE EXCEED THESIS (why sovereign, with a WHY -- not 'special'): git (unix-philosophy core) + GitHub/gitea (bolt-on platform) + a dozen SaaS (Dependabot/Vault/Swagger/Actions/Sourcegraph) = fragmented, non-sovereign, non-reproducible. A Nishi VCS makes them ONE integer-DETERMINISTIC first-class system: reproducible-by-construction builds, a bit-exact replayable oplog, API-first + cap-secured by default, the team benchmarking every commit, research linked to history -- OS-native AND a git-interoperable Linux app.

COACH ROADMAP (hardware/protocol up, each rung gate-proven like the infinigen ladder):
  X0 OBJECT STORE   sovereign content-addressed blob/tree/commit (SHA-256(hdr+content), zlib loose objects) -- reuse our inflate/deflate; gate: write an object, read it back byte-exact, verify the hash matches git's
  X1 PACK + WIRE    read/write packfiles + smart-HTTP git-upload-pack/receive-pack; gate: a STOCK `git clone`/`git push` against our server round-trips a real repo (the interop proof)
  X2 REPO HOST      multi-repo, refs/branches/tags, over the sovereign HTTP + SSH stacks; gate: host + serve N repos, clone each
  X3 API-FIRST      every op a typed OpenAPI endpoint from day one (we already do this) -- the API is not a bolt-on
  X4 SECRETS        Vault-class repo secrets/signing keys on the ocap substrate -- first-class, cap-scoped
  X5 DEP GRAPH      parse manifests -> transitive graph + SBOM (SPDX/CycloneDX) + OSV vuln + provenance; gate: graph a real repo
  X6 TEAM CI/BENCH  wire nx_forge + the team + gates to benchmark every commit + grab code to benchmark, tied to sovereign work
  X7 RESEARCH LINK  the deep-research organs invokable on repos/commits; findings first-class in history (novel)
  X8 MODERN UX      oplog/undo + first-class conflicts + working-copy-as-commit (Jujutsu-class), replayable via our determinism
  X9 SOVEREIGN P2P  cryptographic identity + gossip/torrent replication, no central server (Radicle-class)
  X10 PLATFORM      issues/wiki/forum/PRs in one (Fossil-class), wired to the existing wiki/project/workflow organs
  X11 DUAL MODE     native to the Nishi OS (repos as OS objects) AND a shipped git-interoperable Linux app

FIRST BUILD = X0 (the object store) then X1 (the wire) -- once a stock `git clone` works against our sovereign server, gitea can be sunset; everything above X2 is where we EXCEED the field.

First build = X0 (the sovereign object store) → X1 (the git wire). The moment a stock git clone/git push round-trips against our sovereign server, gitea can be sunset — and everything from X2 up is where we exceed the field. Meanwhile gitea keeps running (a copy is banked; it can de-containerize onto the native supervisor as a bridge any time).