The policy I use in my personal lab to keep forked storage, cryptographic and SDK repositories independent of upstream changes: separate remotes, own releases, semantic versioning. It is a design decision with trade-offs (maintenance cost, drift from upstream), not a claim of production readiness.
As documented in the official @lgcorzo/docs architectural charter, the lab aims to stay decoupled from external upstream entities (including upstream MinIO and third-party tooling). All software artifacts running in production are compiled, scanned, packaged, and deployed solely through controlled sovereign pipelines.
No upstream remotes configured for pushing. Default branches (main/master) push exclusively to github.com/lgcorzo/* under isolated access controls and mandatory branch protection.
Upstream image registries (quay.io, docker.io) are decommissioned. All images are compiled hermetically via GitHub Actions and published directly to ghcr.io/lgcorzo/*.
All production manifests, Helm charts, and Kustomize overlays bind to immutable semantic tags (v*.*.*-lgcorzo.*), preventing silent downstream poisoning or non-reproducible deployments.
Upstream commits are treated as third-party reference sources, not as authoritative base branches. No destructive automated rebases occur; all updates pass through human-in-the-loop validation.
Workflow enforcing AST-driven vulnerability scanning, human sign-off, and hermetic multi-arch container releases.
Full breakdown of storage, crypto acceleration, SDKs, and tooling repositories operating under the sovereign umbrella.
| Tier | Component Classification | Repositories Under @lgcorzo | Role in Sovereign AI Factory |
|---|---|---|---|
| Tier 1 | Core Storage & Infrastructure | minio, mc, operator, kes, console, directpv, warp, sidekick, certgen, dperf |
High-throughput object storage engine, Kubernetes Operator orchestration, KMS secret management, bare-metal NVMe CSI storage, and storage benchmarking. |
| Tier 2 | Crypto & SIMD Acceleration | sha256-simd, md5-simd, blake2b-simd, simdjson-go, highwayhash, crc64nvme, sio, asm2plan9s |
Hardware-accelerated AVX-512 / ARM Neon cryptographic primitives, SIMD JSON parsing, and streaming encryption libraries ensuring wire-speed throughput. |
| Tier 3 | SDKs & Core Client Libraries | minio-go, madmin-go, kms-go, pkg, cli, colorjson, csvparser, dnscache, filepath, mtls, multipart-debug, mux, pkger, selfupdate, websocket, xxml, zipindex |
Client SDKs, cluster administration APIs, KMS integration layers, and low-level networking primitives for autonomous agentic services. |
| Tier 4 | Testing, Documentation & Infra | mint, docs, minio-cf |
Automated end-to-end integration test suites, Sphinx documentation compilation engines, and cloud provider configuration templates. |
The sovereign cluster is not a theoretical fork—it powers live enterprise production workloads with verified runtime immutability:
Deployments in the storage namespace use strictly sovereign images:
• ghcr.io/lgcorzo/operator:v7.1.1-lgcorzo.3
• ghcr.io/lgcorzo/minio:v0.1.0-lgcorzo.2
• ghcr.io/lgcorzo/mc:v0.1.1-lgcorzo.2
All tools compile hermetically against golang:1.26-alpine with multi-arch (linux/amd64, linux/arm64) binary releases, independent of upstream build environments.
All enhancements follow the AIStor extension standard: multi-tenancy, autonomous agent streaming, and formal regulatory compliance with EU AI Act and SOC 2 Type II specifications.
Review the complete Go Module decoupling specifications, cluster deployment manifests, and active repository status matrix on GitHub.