Status and limits

One honest page for beta testers: what hav is for today, what not to trust it with yet, and what to send when something breaks. Current release: v0.1.0.

What hav is for (today)

Real version control on real projects, solo or small-team, on one machine or shared through a hub or harbor you run yourself. The core model (snaps, knots, buoys, workspaces, tie/sync, conflicts-as-data, op-log undo), sealed crews, variant sets (per-crew encrypted .envs inside a public tree, swapped with hav crew use), the harbor (anonymous reads, one push token), and two-regime storage are all implemented and tested (200+ unit and CLI integration tests, including end-to-end runs of every path in the quickstart).

It is a good fit for your own projects, agent-driven workflows (scan-on-command capture means no staging sequence), and kicking the tires on the model.

What not to trust it with yet

• The crypto is unaudited. Sealed crews and sealed variants use standard primitives (X25519, XChaCha20-Poly1305, BLAKE3) in a reviewed but unaudited composition. Do not put genuinely sensitive secrets behind them yet.
• Variant sets hide content, not shape. The path name, exec bit, which crews have a variant, approximate size (via the ciphertext row), and change activity are all public. Deterministic commitments give an ex-member who kept keys a confirmation oracle against future versions. Versions captured before hav seal stay public forever (no expunge in v1). See the honest-limits box.
• A non-member clone of a repo using sealed variants cannot sweep. It holds ciphertext it cannot prove anything about, so the sweep refuses.
• Key loss is data loss. Your identity keyfile (~/.config/hav/identity) is the only thing that unwraps sealed crews. There are no recovery codes in v1: lose the file and you lose every sealed thing, forever. Back it up.
• Single machine + harbor only. Remotes are paths or harbor URLs. There is no P2P and no hosted service, and mixing path-writes and harbor-writes to one hub is unsupported.
• No git import/export. hav is standalone by design, with no bridge in or out. The way in is files, and the way out is files.
• One shared push credential. The harbor has a single push token and no accounts: everyone who pushes shares it, reads are anonymous, and nothing records who fetched or pushed what. Per-user access control and audit are the hosting product's job.
• Transfer is whole-history. Every push, pull, and clone ships the full travel-safe row set. hav pack shrinks storage rather than the wire.
• Undo reaches back 50 operations by default (hav op limit <n> to change, 0 = unlimited), and older actions can no longer be undone. hav sweep reclaims the space their drafts held. It is explicit, so the database grows until you run it, and it needs every sealed crew readable, so run it on a machine that holds your keys.
• dir/file merge collisions take "ours" with a warning (documented v1 limitation).

Platforms

Developed and tested on macOS. Linux uses the same code paths and is expected to work, but hasn't been exercised. Windows builds and is fully supported in design (the exec bit is preserved from tracked history, since NTFS can't represent it). The binary cross-compiles cleanly but has not yet run on a real Windows machine, so treat it as the least-proven platform. The shell snippets in these docs assume a POSIX shell (use Git Bash or WSL on Windows).

Performance envelope

Capture re-scans and re-hashes every tracked file on every command, which is the price of "the working copy is the knot". Measured on an Apple-silicon laptop (2026-07, ~2 KB files):

Rule of thumb: comfortable to a few thousand tracked files, noticeable at 10k, sluggish past 30k. Keep build output and dependencies in .havignore, since hav ships no ignore rules of its own. hav preview shows what a capture would ingest before you write the file. A first capture that looks like an unignored dependency tree (≥5000 files or ≥100 MB) asks for consent before storing anything, and a later capture adding ≥5000 files warns.

Reporting bugs

Email sdvgab@gmail.com. The op journal makes bugs unusually reproducible, so please include:

1. The exact command and its one-line error (or the wrong output).
2. hav op log -n 20, the numbered journal of every mutation leading up to it.
3. If the repo isn't sensitive, the .hav/repo.db file itself, which contains the full before/after view of every operation.

Include the output of hav --version, since this is a moving beta.

hav undo is safe to try after any misbehaving command: every mutation is one op, and failed multi-step mutations roll back atomically.

Reporting a security issue

Same address, sdvgab@gmail.com, with "security" in the subject line. Please report privately and give it a chance to be fixed before describing it publicly.

The crypto is unaudited and hav is maintained by one person, so treat a reply as best-effort rather than guaranteed. There is no bounty. Findings against sealed crews and sealed variants are especially welcome — see the honest-limits box for what is already known to be public by design, so you can tell a real finding from a documented limit.