Neighbours

git Version control for source trees, and a Merkle DAG underneath

• Purpose Git records how a source tree changed and lets many people change it at once: a Merkle DAG of trees and commits, tuned for the working practice of writing software.
• Where it goes further Branching, merging, diffing, blame, rebase. Everything you do to code while you are writing it, which Ranke leaves alone.
• Where Ranke goes further A repository's history is its own. A squash or a force-push drops what it drops, and nothing in the repository links a commit to the scan that passed it, the ticket that asked for it, or the decision that shipped it.
• Together ranke-git snapshots a repository into an archive, byte-identical, and the commits sit beside the other records of the same release. This is the one adapter that exists today.
• Terms Self-hosted. Open source under GPL-2.0, that version and no later one, which COPYING states in Torvalds' own words. Free.

git-scm.com

TerminusDB Git-like branching and time travel over an RDF knowledge graph

• Purpose TerminusDB gives an RDF knowledge graph git-like versioning: branch, merge and time travel, over append-only delta encoding.
• Where it goes further Versioning as a workflow on a schema'd knowledge graph, shipping today. Branch a whole database, merge it back, query any past state.
• Where Ranke goes further The foundation paper puts the difference at what changed against why. TerminusDB records the revisions and carries no derivation chain, no archive of the sources a revision was built from, and no contributor whose authorship is verifiable.
• Together Both hold a versioned graph. An archive beneath one would keep the sources its revisions were drawn from.
• Terms Self-hosted, or TerminusCMS as a hosted service. Open source under Apache 2.0, which replaced GPLv3 with v4.0 in December 2020. Free to run yourself; the hosted tiers are paid above a free one.

terminusdb.com

Neo4j Property graph database, queried with Cypher, updated in place

• Purpose Neo4j stores a property graph and queries it: traversals over relationships at speed, with Cypher, indexes and transactions, updated in place.
• Where it goes further Query planning, traversal performance, and the tooling built around them over two decades. An archive kept in Neo4j inherits all of it.
• Where Ranke goes further A property graph holds the current value of a property. A Ranke-Graph holds every claim ever made about it, each signed, each citing what it was built from, and each permanent.
• Together Neo4j is one of the backends RankeDB writes to, and Graphiti runs on it as well: one store underneath two disciplines.
• Terms Self-hosted, or AuraDB in the cloud. Two editions: Community is open source under GPL-3.0, Enterprise is closed and licensed commercially. Community and an AuraDB free tier cost nothing, and clustering, online backup and role-based access control are Enterprise features priced through sales.

neo4j.com

Datomic Immutable facts on one system timeline, with the database as a value

• Purpose Datomic keeps immutable facts along a single system timeline. A query runs against the database as a value, and any earlier point is reachable with as-of.
• Where it goes further A schema, Datalog queries and transactions, with time travel on the ordinary query path.
• Where Ranke goes further One timeline, and it is the system's own. Datomic records when a fact was asserted or retracted, and not who derived it from what. The foundation paper calls that temporal history against epistemic history.
• Together An immutable store beneath an archive is a reasonable fit, with the archive supplying the derivation the datoms have nowhere to put.
• Terms Self-hosted as Datomic Pro, or Datomic Cloud on AWS. Closed source and free at once: since April 2023 Nubank has shipped the binaries under Apache 2.0 with no licence fees, and answered plainly that the source is not following them. Paid support is sold separately.

datomic.com

XTDB Immutable database with a valid-time axis beside transaction time

• Purpose XTDB is an immutable database with two time axes: transaction time, when the database was told, and valid time, when the fact held in the world. Writes can be made retroactively along valid time.
• Where it goes further Bitemporal SQL with time travel as an ordinary query, over a schemaless document model.
• Where Ranke goes further Those two axes are the archive's two dates under other names, and archival practice reached them first; the Library of Congress standardised the uncertain half as EDTF. What the schema has no place for is the derivation: which claims a record was built from, and who built it.
• Together Bitemporality is the shared idea. An archive adds the chain of derivation to it.
• Terms Self-hosted, on your own hardware or your own cloud account. Open source under MPL-2.0. Free; JUXT, the consultancy behind it, sells support.

xtdb.com

Fluree RDF graph over a hash-chained commit log

• Purpose Fluree is an RDF graph database on a hash-chained commit log: every commit is kept and addressed by its content, and any earlier state stays queryable. Transactions can be signed as JWS or presented as Verifiable Credentials, SHACL validation and OWL reasoning are built in, and it queries with SPARQL. The engine is an embeddable Rust library under the Business Source Licence, which converts to Apache 2.0 on a change date, and a separate server runs it in a consensus cluster; Fluree AI is the managed platform on top.
• Where it goes further A working database around the immutable log: a query surface, a reasoner, validation, policy, and Raft for distributed deployment. Ranke has a data structure and two reference implementations.
• Where Ranke goes further The sharpest line is the licence. Fluree's engine is source-available under the Business Source Licence, which holds back the hosted-service use until each version's change date four years out, with a managed platform sold above it. The licence still governs who may do what, and for four years it is Fluree who decides. Ranke's implementations are Apache 2.0 and its papers CC BY 4.0, so an archive can be run, forked and outlived by whoever holds it. After that comes signing: optional in Fluree, so authorship is a feature a transaction may carry, where Ranke folds the signature into a claim's identity and an unsigned claim is not a claim. And Fluree versions a database, where Ranke's unit is a claim citing what it was derived from.
• Together The nearest neighbour among the databases. Underneath the platform framing sits a hash-chained log with optional verification, and that log is a reasonable store beneath an archive.
• Terms Self-hosted, or Fluree's own platform. Source-available under the Business Source Licence 1.1: each version turns Apache 2.0 four years after it ships, and until then the grant covers every use except offering Fluree itself as a hosted Database Service. Free to run; the platform above it is paid.

flur.ee

Zep Agent memory: a bi-temporal knowledge graph built from episodes

• Purpose Zep, and Graphiti underneath it, gives an agent a memory: episodes come in, an LLM extracts entities and facts, and every edge carries a validity interval so the agent can be handed what currently holds. It runs on Neo4j, FalkorDB or Amazon Neptune.
• Where it goes further Extraction, entity resolution and contradiction handling are built and running, and retrieval is tuned to hand an agent one current view. Nothing in Ranke does this today: the workers that would populate its semantic layer are a paper still to be written.
• Where Ranke goes further Ranke carries the semantic layer in the structure itself, as relations held as claims and read with their direction. Graphiti updates entity summaries destructively, and holds provenance as annotation on the knowledge graph rather than as its content, where a Ranke-Graph keeps the sources inside itself, content-addressed, and every claim about them stays exactly as written.
• Together The closest neighbour here, and the foundation paper says so: it reads the Ranke-Graph as an extension of Graphiti's philosophy, adding immutability, sources kept within the graph, and provenance as the substrate. Both run on Neo4j, so one store can hold either.
• Terms Two answers, because the layers part company. Graphiti, the engine underneath, is open source under Apache 2.0 and self-hostable, given a graph database of its own to run on. Zep itself is a cloud service: its Community Edition was wound down in April 2025, the company saying the open and the commercial product had each constrained the other, so what sits above Graphiti is hosted only, free to a monthly credit allowance and paid past it.

getzep.com

Utopia Bitemporal knowledge graph over extracted documents, on an ontology it revises

• Purpose Utopia is DeepLethe's enterprise world model: one Rust binary and one Postgres that takes documents in, extracts entities and facts against an ontology you can edit, and keeps them in a bitemporal graph. Every fact records when it held in the world and where it came from, and correcting one closes the old version and links the new to it rather than overwriting. Five ontology packs ship inside the binary, PROV-O among them. Search fuses Tantivy and pgvector, answers cite the passage they came from, and any OpenAI-compatible endpoint serves the models, so a deployment runs air-gapped.
• Where it goes further Nearly the whole working system. Entity resolution in three stages with a review queue and an undo on every merge, conflict detection that offers remedies rather than a verdict, forward-chaining derivation whose results carry the premises they came from, precision on each end of an interval so that ended, date unknown is held apart from still holds, and an RDF export in Turtle or JSON-LD written so that a regulator can read a base without the vendor's help. It is a product that installs and runs, where Ranke is a specification and two reference implementations, and the workers that would populate Ranke's semantic layer are a paper still to be written.
• Where Ranke goes further The trust boundary. Utopia's provenance is fields the application maintains, so an export is worth what the deployment that produced it is worth, and the auditor its own design notes have in mind still has to trust the exporter. A Ranke claim is signed, and its id is computed over the closure of claims it cites, so authorship and derivation are checkable away from the system that recorded them. The decision ledger is append-only by policy; a Ranke-Graph is append-only by construction, and a correction is a further claim rather than a version the writer closed.
• Together The closest structural neighbour on this page. Two timelines, provenance on every fact, correction by supersession, and uncertainty carried on the dates are the commitments the foundation paper argues for, reached from enterprise knowledge rather than from archival practice — and the paper names Graphiti as the nearest neighbour because it was written before this existed. PROV-O is already in the box, which is one of the standards this format aligns with, so the two would meet on a vocabulary neither has to invent. An archive beneath it would hold the documents its facts were extracted from, content-addressed, and sign what its ledger records.
• Terms Self-hosted, one Rust binary and one Postgres, and offline by design. Open source under Apache 2.0. Free: the repository offers no paid edition and names no hosted service, and the enterprise items, SSO and backup among them, sit on the same public roadmap as everything else. It is v0.1, the schema moves between versions and migrations only roll forward, so a deployment pins an image and backs up before it upgrades.

github.com

Chainloop Evidence store and policy engine wired into CI pipelines

• Purpose Chainloop is an evidence store and policy engine for the software lifecycle. It collects attestations, SBOMs, VEX, SARIF and QA reports out of GitHub Actions, GitLab, Jenkins, CircleCI and TeamCity together with the build environment's own metadata, stores each attestation as a Sigstore bundle, keeps the materials in content-addressed storage, and evaluates Rego policies whose results are written into the attestation before it is signed. A Workflow Contract declares what evidence a pipeline has to produce.
• Where it goes further For the release-documentation case this site opens with, Chainloop is the more finished answer today: pipeline integrations, contracts that fail a build when evidence goes missing, policy evaluation, and compliance reporting on top. Ranke has one adapter, for git.
• Where Ranke goes further Three places. Its scope is the software lifecycle, so the mail thread, the incident report and the analysis written a year later have nowhere to go. Its graph belongs to the service: the attestations verify on their own with cosign, while the relationships between them live in the control plane's database, where a Ranke claim carries its edges inside the record its id is computed over. And it decides, by design, because a contract that fails a build is the product; the foundation paper draws the opposite line, that the graph documents and does not decide.
• Together An adapter over Chainloop would be the shortest path from a working pipeline to an archive that outlives the tool. The gate stays in the pipeline where it belongs, and the record of what it saw goes somewhere a later claim can contradict it with both staying readable.
• Terms Self-hosted, or hosted at app.chainloop.dev. Open core: the core is Apache 2.0, and the installer's --oss flag is what marks the boundary, since leaving it off installs the enterprise edition instead. Free core, paid enterprise.

chainloop.dev

Archivista and Witness Signed in-toto attestations, produced in the pipeline and served from a store

• Purpose Archivista stores and serves signed in-toto attestations, and Witness produces them in the pipeline: what was built, from which inputs, by which steps. Together they answer supply-chain questions and feed policy checks.
• Where it goes further One question, worked all the way through, inside the in-toto and CNCF ecosystem: attestation formats a wider community already verifies, and policy evaluation against them.
• Where Ranke goes further Ranke takes any source. The attestation, the mail thread that argued about it, the ticket that asked for it, the analysis written a year later: one archive, one derivation model.
• Together An attestation is a signed claim that cites its inputs, which is a Ranke claim in every respect that matters. An adapter over Archivista would put supply-chain evidence beside everything else the release touched.
• Terms Self-hosted. Open source under Apache 2.0: TestifySec built both and donated them to in-toto under the CNCF, so the code is the community's. Free, and TestifySec sells managed hosting and support beside it under its own terms.

github.com

GUAC One queryable graph from SBOMs, SLSA attestations and Scorecard data

• Purpose GUAC aggregates SBOMs, SLSA attestations, Scorecard results and deps.dev data into one queryable graph, through collectors and an ingestor that normalises them into a common model. Its stated aim is what you do not know about your supply chain.
• Where it goes further Normalising the ecosystem's formats into one graph and answering questions across them: which artefact carries which dependency, and where the data is missing altogether. It is an OpenSSF project with adopters, where Ranke has no supply-chain adapter at all.
• Where Ranke goes further GUAC builds a current picture from documents it re-reads. Ranke keeps the documents, dates them twice, and keeps every earlier picture beside the current one.
• Together GUAC's collectors and Ranke's adapters work the same seam. A graph GUAC built is a derivation like any other, and filing it as one would keep the answer it gave on the day it was asked.
• Terms Self-hosted, with a Helm chart to stand it up. Open source under Apache 2.0, an OpenSSF incubating project since before its 1.0 in June 2025. Free; Kusari, which started it with Google and Purdue, sells a commercial platform built on it.

guac.sh

Velociraptor Forensic artefact collection across a fleet of endpoints

• Purpose Velociraptor hunts for forensic artefacts across a fleet of endpoints. An analyst writes a VQL query, starts a hunt, and agents on every enrolled machine answer within minutes. It also collects events continuously and keeps them centrally for later review. It descends from Google's GRR.
• Where it goes further Getting the evidence off the machines at all: agents, a query language for artefacts, and the scale to run it over a fleet while an incident is live. Ranke has nothing that collects anything.
• Where Ranke goes further What a hunt returns is a collection. In a Ranke-Graph each item would carry a contributor, an entry date, a presumed date of origin, and edges to whatever it was derived from, so an analysis of it is filed beside it rather than kept elsewhere. The structure holds that for anything ingested; no adapter for Velociraptor exists.
• Together Collection and custody are different jobs, and Velociraptor is among the first adapters an archive of this kind would want.
• Terms Self-hosted. Open source under AGPL-3.0, and it stayed that way through Rapid7's acquisition of the project in April 2021. Free, with no per-seat fee; Rapid7 sells support, and gates a feature-restricted build inside the top tier of its own platform, where the gRPC API is withheld and quarantine is switched off.

docs.velociraptor.app

Timesketch and Plaso One searchable timeline from many forensic sources, annotated by a team

• Purpose Timesketch, with Plaso underneath it, builds one searchable timeline from many sources: supertimelines, KAPE and Velociraptor output, ELK exports, Sysmon logs, plain CSV. Analysts tag, annotate and build stories on it together, and built-in analysers flag patterns such as lateral movement.
• Where it goes further The analytical surface of an investigation in progress: correlation across sources, collaborative annotation, and a timeline a human can work. Ranke offers no analysis tooling of any kind.
• Where Ranke goes further A sketch is built for a case. An archive would keep the evidence base across cases, hold each annotation as a claim with its own author and time, and keep the sources the timeline was derived from. No adapter for Timesketch exists.
• Together A sketch is a derivation over sources. Filed as claims, the reasoning of an investigation would survive the investigation.
• Terms Self-hosted, and that is the only way: Google runs no hosted Timesketch, and the third-party cloud images are somebody else's packaging of the same software. Open source under Apache 2.0. Free.

timesketch.org

DFIR-IRIS Incident case management with evidence and chain of custody

• Purpose DFIR-IRIS runs incident cases: summaries, notes, assets, indicators, tasks and evidence. Each evidence entry records the acquisition timestamp, the analyst who collected it, where it is stored and a SHA-256, and a case can be turned into a report. TheHive covers similar ground under a licence that narrowed in 2022.
• Where it goes further The case as a working object, with the reporting that has to come out of it at the end.
• Where Ranke goes further Custody in IRIS is a field on a record inside one case. In a Ranke-Graph custody is the structure: the contributor is signed into the claim's identity, and a claim cannot be written without citing what it rests on.
• Together The same discipline at two altitudes. A case would be a branch, and its evidence entries claims.
• Terms Self-hosted, five Docker services. Open source under LGPL-3.0. Free, with no paid edition and nothing held back from it; support is arranged through the project's OpenCollective, where a sponsorship tier buys hours of it.

dfir-iris.org

Archivematica OAIS preservation: accession, normalise, and package for a repository

• Purpose Archivematica runs institutional preservation to the OAIS model: material is accessioned, formats are normalised by policy, and archival packages come out in METS, PREMIS and BagIt for any repository to hold.
• Where it goes further Keeping bytes readable for decades. Format identification and normalisation, fixity checking, and the ingest workflow archivists actually run. Ranke has none of this.
• Where Ranke goes further Ranke is concerned with what records say and where claims came from: derivation as queryable data, with later analysis filed as claims of its own.
• Together Preservation and provenance are different jobs on the same material. An archival package is a source like any other.
• Terms Self-hosted, or Artefactual's hosted Digital Preservation Service, which places the storage in a region you pick and replicates it to two more. Open source under AGPL-3.0. Free to download and run; the hosting, the storage and the support are what Artefactual sells.

archivematica.org

IPFS Content addressed by a hash over its bytes, distributed between peers

• Purpose IPFS addresses immutable content by a hash over its bytes and moves it between peers, so a name verifies what it names wherever it is fetched from.
• Where it goes further Distribution and storage at scale, which Ranke does not attempt: a DAG of storage chunks, and a network to move them.
• Where Ranke goes further The foundation paper draws the line at what the links carry. In a Ranke-Graph the Merkle links are the provenance edges, so each id commits to the full closure of claims a record was built from, and content addressing and provenance coincide rather than sit in separate layers.
• Together The Universe is a content-addressed key/value store, so a content-addressed network is one shape it can take.
• Terms Self-hosted node. Kubo, the Go implementation, is dual-licensed MIT or Apache 2.0, at the user's choice. Free to run, and keeping content reachable is where money enters: a pinning service charges for it, or an IPFS Cluster of your own does the same job on your hardware.

ipfs.tech

Sigstore Keyless signing for artefacts, recorded in a public append-only log

• Purpose Sigstore signs software artefacts with short-lived certificates bound to an OIDC identity and records the signature in Rekor, a public append-only transparency log anyone can query. Cosign verifies without a key server of your own.
• Where it goes further Running public infrastructure with wide adoption and mature tooling.
• Where Ranke goes further A Sigstore signature is a detached attestation about content. Ranke folds the signature into the record its address names, so a claim's identity commits to its author as well as to its bytes.
• Together Ranke anchors into logs of this kind for time rather than replacing them.
• Terms A public-good instance of Fulcio and Rekor, operated by the OpenSSF community, and the whole stack can be run privately instead. Open source under Apache 2.0, which the OpenSSF charter requires of every project it holds. Free, with no paid tier anywhere in it; the commercial products built on these primitives, Chainguard's and GitHub's, are other companies' offerings rather than Sigstore's.

sigstore.dev

C2PA Content credentials: a signed manifest of how media was captured and edited

• Purpose C2PA specifies content credentials for media: a manifest recording how an image or a video was captured and edited, signed and bound to the file itself.
• Where it goes further A signed standard with camera and tool vendors behind it, addressing provenance where it is hardest, in media that is copied and re-encoded.
• Where Ranke goes further A C2PA manifest travels with one asset. A Ranke claim sits in a graph with everything else that asset relates to, and later claims can cite, qualify or contradict it.
• Together The foundation paper proposes COSE_Sign1 for a claim's envelope, which is what a C2PA claim signature already is. A manifest is a source that arrives with its provenance intact.
• Terms A specification rather than a system, so there is nothing to host. Royalty-free, which is what lets open and closed implementations both exist, and the c2pa-rs SDK is Apache 2.0 or MIT. Free to implement, and the cost sits one step further on: credentials that validate against the C2PA trust list need a signing certificate from an authority on that list, priced by the authority under its own commercial terms.

c2pa.org

SCITT and Certificate Transparency Public append-only logs of signed statements, with inclusion proofs

• Purpose Certificate Transparency puts every issued certificate into a public append-only log, so misissuance is discoverable by anyone watching. IETF SCITT generalises the pattern to signed statements about any supply-chain artefact, registered in a transparency service.
• Where it goes further The discipline of a public log: independent monitors, inclusion proofs, and in Certificate Transparency's case a decade of operation at internet scale.
• Where Ranke goes further A transparency log orders statements and proves inclusion. It does not say what a statement was derived from, where in a Ranke-Graph the citation is a condition of writing at all.
• Together An anchor in such a log fixes a whole closure in time, which is what the foundation paper's anchoring rests on.
• Terms Specifications, free to read and to implement. Certificate Transparency is RFC 9162, published as an Experimental protocol; SCITT is still an Internet-Draft, at revision 22, so what it says can change under an implementer. Trillian, the Merkle-tree log Certificate Transparency is usually run on, is Apache 2.0. Operating a log is where the expense lands, and it is the reason log operators are few.

datatracker.ietf.org

Nanopublications and Trusty URIs Small immutable scholarly assertions, named by a hash of their content

• Purpose A nanopublication is a small immutable scholarly assertion published with its own provenance and attribution, identified by a Trusty URI: a name containing a hash of the content, so the name verifies what it names.
• Where it goes further A working publishing practice in the sciences, with a network, conventions and a community that uses it.
• Where Ranke goes further They are a flat collection of independent assertions: no derivation DAG connecting them through chains of processing, and no semantic graph layer.
• Together A nanopublication is already a claim with provenance, so ingesting one would lose nothing.
• Terms A decentralised server network anybody can publish to, and anybody can join by running a server of their own. nanopub-java, the reference library, is MIT. Free throughout, and the nanopublications themselves carry their own licences, most often CC0 or CC BY.

nanopub.net