Repository Core

Repo-core is Tempest's content-addressed repository engine. It is implemented in pure Elixir and is the byte-level compatibility boundary for records, commits, CAR exports, and firehose commit slices.

Concepts

An AT Protocol repository is a signed data store for one DID. Records live at paths shaped like:

<collection-nsid>/<record-key>

The current set of records is represented by a Merkle Search Tree (MST). Record blocks, MST nodes, and commit blocks are content-addressed by CIDs. A commit signs the current root and gives the repo a new revision (rev).

A CAR file is a portable bundle of content-addressed blocks. Sync endpoints use CAR to export repo data or selected blocks.

Implementation

Important modules under Tempest.RepoCore include:

• AtUri, Did, Handle, Nsid, RecordKey, Tid: syntax and identifiers
• Cid: CID encoding/decoding
• Drisl: deterministic DAG-CBOR subset used by atproto data
• Car: CAR v1 encode/decode
• Mst: deterministic Merkle Search Tree operations
• Commit: signed repository commit creation and verification

Tempest.RepoStorage persists blocks, records, commits, and metadata in a per-DID SQLite database. Record writes rebuild the MST for correctness, sign a new commit, store new blocks, update indexes, and emit a sequencer event.

Compatibility notes

The repo engine enforces canonical encoding, CID digest checks, syntax checks, and decode limits. Tests cover parser behavior, CBOR/CAR round trips, MST operations, commit signatures, and storage persistence.

Correctness matters more than incremental MST performance. Rebuilding the MST on write is acceptable until profiling proves otherwise.

Verification

mix test test/tempest/repo_core test/tempest/repo_storage_test.exs
hurl --test --jobs 1 --variable base_url=http://localhost:4000 test/smoke/records.hurl
hurl --test --jobs 1 --variable base_url=http://localhost:4000 test/smoke/car-sync.hurl