Graph Kernel Technical Architecture

**OpenClaw CompCore — cc-graph-kernel** **Version:** 1.0.0 · **Schema:** 1.0.0 **Date:** 2026-02-13 **Author:** Mohamed Diomande 1. [System Overview](#1-system-overview) 2. [Architecture Diagrams](#2-architecture-diagrams) 3. [API Reference](#3-api-reference) 4. [Data Model](#4-data-model) 5. [Core Engine](#5-core-engine) 6. [Security Model](#6-security-model) 7. [Atlas Subsystem](#7-atlas-subsystem) 8. [Deployment Guide](#8-deployment-guide) 9. [Configuration Reference](#9-configuration-reference) 10. [Operational Runbook](#10-operational-runbook) The Graph Kernel is a deterministic context slicing engine for conversation DAGs. It answers one question: It provides: - **Deterministic context slicing** — same anchor + same policy + same graph state → identical `slice_id` - **HMAC-signed admissibility tokens** — unforgeable proof that a context slice was authorized by the kernel - **Policy-governed expansion** — phase-weighted priority queues with configurable budgets - **Knowledge graph triple store** — subject–predicate–object triples with confidence and provenance | Component | Technology | Purpose | |-----------|-----------|---------| | Language | Rust 2021 edition | Performance, safety, single binary | | Web Framework | Axum 0.7 | Async HTTP with Tower middleware | | Async Runtime | Tokio 1.x | Multi-threaded async I/O | | Database Driver | sqlx 0.7 | Async PostgreSQL with compile-time query checking | | Hashing | xxhash-rust (xxh64) | Fast, deterministic fingerprinting | | Cryptography | hmac + sha2 | HMAC-SHA256 for admissibility tokens | | Serialization | serde + serde_json | JSON request/response handling | | Logging | tracing + tracing-subscriber | Structured JSON logging | | Caching | lru + parking_lot | Token verification cache | | UUID | uuid v1 (v4 generation) | Turn and entity identifiers |