KeyHive-Automerge Git Vault

A pure-Rust system that encrypts every Automerge change set using KeyHive and distributes them through a local git repository managed entirely via gix.

Problem

KeyHive provides forward secrecy: a member added at epoch N normally cannot decrypt content from before N. Automerge requires every participant to possess every change set to converge. This tension is resolved through a tombstone mechanism: whenever a document key rotates, a tombstone commit encrypts the previous epoch key under the new one, allowing current members to follow the chain backward while revoked members cannot follow forward.

Architecture

• waggle-core — library combining KeyHive, Automerge, and gix
• spike/ — feasibility proof tests (Phase 0)

Main abstractions: Participant, Identity, DocSession, GitStore, KeyLog, EncryptedCommit.

See docs/architecture.md for details.

Quick Start

# Prerequisites: Rust 1.80+, Cargo
cargo test --manifest-path waggle/Cargo.toml

See docs/getting-started.md for detailed setup.

Test Suite

Phase	Tests	Description
0 - Spike	6	Feasibility and API contracts
1 - Harness	7	Workspace, dependencies, test harness
2 - Protocol	8	Encrypted commit protocol
3 - Sync	7	Automerge change set synchronization
4 - Membership	17	Membership, revocation, tombstones
5 - E2E	2	Full Alice/Bob/Cindy/Dan scenario
6 - Property	11	Proptest, fuzz, model checking
Total	58	All passing

Documentation

• Architecture
• Theory of Operation
• Getting Started
• Operations Guide
• Troubleshooting
• Claim-to-Test Mapping
• Architecture Decision Records

License

Apache 2.0 — see LICENSE.