.vast Portable Graph Format

Implemented meaning

.vast is a file convention backed by runtime code, not an acronym expanded by the contracts. The repository does not establish “Vertex Action Surface Tie” as the technical meaning of the name. Version vast/1 serializes a portable closure in JSON.

The canonical body contains System-relative vertices and ties. The manifest records package ID and version, closure kind and root, vertex and tie counts, compatibility, boundary references and a SHA-256 packageHash. Stable canonicalization makes identity independent from the target System ID.

Two closure forms

• System closure exports the complete structural partition, including its root Vertex.
• Subtree closure follows containment from an anchor. Ties crossing the selected boundary must be refused or externalized as declared references; they cannot be silently copied.

Verified round-trip

The internal round-trip scenario is concrete:

export System A → write .vast JSON → read and verify
→ import into a fresh runtime as System B
→ execute a canonical Action
→ re-export an untouched import
→ compare packageHash

Tests verify identical sealed identity before subsequent writes, continued runtime execution after import, rejection of unsupported format versions, tamper rejection and collision failure. Another E2E scenario exports a VAB-born production graph and a lived-in Workspace subtree.

Portable versus local

Portable: graph identity relative to the package, Vertex/Tie data, structural closure, manifest, provenance declarations, compatibility and boundary references.

Local: active Environment, credentials, secrets, processes, filesystem placement, provider configuration, resource grants and effective authority. These must be resolved or revalidated on arrival.

Limits

vast/1 is experimental. A package hash provides integrity, not author trust. Signature and provenance structures are not yet a marketplace-grade verification chain. Multi-package mounting, atomic upgrade, migrations, resource limits and hostile-input hardening are not presented as released guarantees. Current tests are internal repository validation, not independent certification.