1. Overview
Engineered by the creator of SQLite. Packages version control, tickets, bug tracking, and wiki documentation into one durable SQLite file that runs an instant local web UI that works offline.
Category: VCS & Core.
2. Version and scope assessed
Version assessed: Pinned source 9f1ea15e06b9be018175d231a939d19372fd4b8b.
3. Overall determination
Computing determination
4. Principle profile
| Order | Principle | Finding |
|---|---|---|
| I | Sovereignty | Not assessed |
| II | Longevity | Not assessed |
| III | Locality | ✓ Meets |
| IV | Transparency and Control | Not assessed |
5. Fundamental requirements
| Requirement | Status |
|---|---|
| E1 Independent access to essential information | ✓ Pass |
| E2 Practicable exit and migration | ? Not Verified |
| E3 Independent interpretation and recovery | ? Not Verified |
| E4 Continuing authority and custody over already-created work | ✓ Pass |
| E5 Governability of consequential actions | ? Not Verified |
6. Evidence and verification
- E1: Fossil repositories are single local files, and the project documents cloning and consistent repository backups. (source), confidence medium
- E2: Fossil documents Git export and repository cloning, but a complete migration of tickets, wiki, configuration, and private data was not tested. (source), confidence medium
- E3: The pinned export implementation limits --git export to check-ins, excluding tickets, wiki, technical notes and attachments. Git migration cannot replace a complete Fossil repository backup. (source), confidence medium
- E4: Local repository operations, checkouts, history, and synchronization can be performed under user control without a mandatory hosted service. (source), confidence medium
- E5: Purge retains removed artifacts in local purgeevent/purgeitem graveyard tables, with undo and --explain/--dry-run. Obliterate removes that recovery path and prompts unless --force bypasses confirmation. These graveyard tables are not synchronized. (source), confidence medium
- sovereignty: A single local repository file and export paths give users strong custody, with hosted synchronization remaining optional. (source), confidence medium
- longevity: E3 remains Not Verified for the existing essential-record scope. The methodology requires established E3 before a positive Longevity finding, so the earlier positive rating is withdrawn pending recovery evidence; source/format strengths are retained as facts, not graded as a failure. (source), confidence medium
- locality: Core version control and repository operations work locally; synchronization extends rather than defines the workflow. (source), confidence medium
- transparency: E5 remains Not Verified. The methodology's Partially meets threshold requires demonstrated minimum oversight, so the earlier positive Transparency and Control finding is withdrawn rather than retained on the strength of one documented control. This is Not assessed, not Does not meet. (source), confidence medium
- E3: The retained source proves Git export omits wiki, tickets, technical notes and attachments, but that is a limitation of this exit route, not proof that native Fossil recovery fails. Complete native restoration of artifacts, accounts, settings, private/shunned content and attachments has not been demonstrated. E3 therefore remains Not Verified. (source), confidence medium
- E5: Purge preview, local graveyard undo and obliterate confirmation are positively established by source inspection. They do not cover the full consequential-operation surface: synchronization/configuration propagation, shunning/rebuild and effective recovery have not been sufficiently established. A guarded purge routine alone does not establish whole-scope E5. (source), confidence medium
7. Migration and recovery
Native storage format: Single Standalone SQLite Database File.
Synchronization or runtime model: Peer-to-peer HTTP/SSH sync.
Example export or inspection command (not verified against any particular version or data set): fossil ui repository.fossil
8. Architectural strengths
Established strengths and their scope are recorded in the evidence and assessment findings on this page.
9. Architectural limitations
- Pinned source inspection, not application execution.
- Full repository restoration, private/shunned artifacts, account/settings coverage and real purge recovery remain untested.
10. Assessment findings and remaining work
Verification scenario: Clone a repository, transfer wiki, tickets, users, and attachments, and operate without the origin server.
What may invalidate an overconfident claim: Check what fossil ui demonstrates versus a portable full export.
Documentation starting point: https://fossil-scm.org/home/doc/trunk/www/index.wiki
Evidence update: 23 October 2026
- Resolved: The pinned export implementation limits –git export to check-ins, excluding tickets, wiki, technical notes and attachments. Git migration cannot replace a complete Fossil repository backup. Source.
- Resolved: Purge retains removed artifacts in local purgeevent/purgeitem graveyard tables, with undo and –explain/–dry-run. Obliterate removes that recovery path and prompts unless –force bypasses confirmation. These graveyard tables are not synchronized. Source.
- Open: Full repository restoration, private/shunned artifacts, account/settings coverage and real purge recovery remain untested.
Assessment follow-up: E3/E5 and their associated principle findings are now reconciled in rating batch 1 below. Earlier source/fixture observations remain valid within their stated scope; they are not themselves blanket Pass decisions.
Human-readable criteria: Can users retain complete history and metadata, operate and recover locally, migrate to another implementation, and understand the effects of synchronization or automation?
Rating reconciliation: 23 October 2026
Scope: The existing source-pinned application scope; no new application execution. Individual-custodian perspective. The existing broad preservation/workflow scope is retained, rather than narrowed to the one successfully inspected source path.
| Criterion | Current finding |
|---|---|
| E3 Independent interpretation and recovery | Not Verified |
| E5 Governability of consequential actions | Not Verified |
| Longevity | Not assessed |
| Transparency and Control | Not assessed |
E3: The retained source proves Git export omits wiki, tickets, technical notes and attachments, but that is a limitation of this exit route, not proof that native Fossil recovery fails. Complete native restoration of artifacts, accounts, settings, private/shunned content and attachments has not been demonstrated. E3 therefore remains Not Verified.
E5: Purge preview, local graveyard undo and obliterate confirmation are positively established by source inspection. They do not cover the full consequential-operation surface: synchronization/configuration propagation, shunning/rebuild and effective recovery have not been sufficiently established. A guarded purge routine alone does not establish whole-scope E5.
longevity: E3 remains Not Verified for the existing essential-record scope. The methodology requires established E3 before a positive Longevity finding, so the earlier positive rating is withdrawn pending recovery evidence; source/format strengths are retained as facts, not graded as a failure.
transparency: E5 remains Not Verified. The methodology’s Partially meets threshold requires demonstrated minimum oversight, so the earlier positive Transparency and Control finding is withdrawn rather than retained on the strength of one documented control. This is Not assessed, not Does not meet.
Evidence record: evidence/rating-reconciliation/batch-1/README.md and runtime-results.json. No target software was installed. Source inspections remain source inspections; no application-level recovery or destructive action was executed.
Remaining work: The existing open recovery and consequential-action scenarios remain pending; the individually explained E3/E5 blockers above determine the current Not Verified and Not assessed findings.
Contribute verification evidence for Fossil SCM
Have you tested clean-machine restoration, format migration, or failure rollback for Fossil SCM? We welcome reproducible laboratory logs, synthetic test fixtures, and independent assessments to resolve open findings.
Read the evaluation protocol · Submit verification records on GitHub
Rating reconciliation batch 1: E3 Not Verified; E5 Not Verified. Longevity Not assessed; Transparency and Control Not assessed. See the declared scope and reasons below; earlier bounded evidence findings remain recorded. The assessment procedure is described in the methodology.