Org-specific forks, maintained by AI
AI is going to make software move faster and faster. Most of those changes touch code your machines never run. graft keeps your own fork of upstream and carries only the changes that reach what you actually run, so you update when it matters to you.
There is security in differentiation, too. An instance that carries 21% of upstream's changes skips the exposure of the rest, and an instance unique to you can be a harder target than the copy everyone else runs.
01
An enterprise Linux vendor pins a release and maintains a patch set on top of it, so customers get fixes without absorbing every upstream change. graft extends that model down to the customer. Each org keeps its own fork that tracks upstream, and AI maintains a patch series of just the changes that matter to what the org actually runs.
02
Read-only probes record what the running instance actually uses: bound drivers, loaded modules, the kernel config, mounted filesystems, socket families, listening ports, extensions and machine-config features.
Every upstream change is placed against that surface. Rules decide first:
CONFIG_ symbols and module a kernel file compiles into.A local model judges only what the rules can't. It runs on the org's own GPU, so the attack-surface map never leaves. The model can raise a tier, and it can never lower a rule's floor.
A pinned upstream base plus cherry-picks of only the carried changes. The branch is regenerated from the series, so the series is the source of truth and every branch is reproducible from it.
graft builds the org's own Talos installer and boots it in a QEMU VM. The test records the exact series digest it booted, and only that digest can be promoted.
A release happens only when something that matters changed. A new upstream release on its own never causes one. The release pipeline is model-checked in TLA+, and TLC found three real races in the naive design:
First target Talos Linux. The first customer is a Talos VM in QEMU. A Dell server running Talos is next, with a different profile and a different patch set.
03
We replayed upstream Talos from v1.13.0 to v1.13.10 (27 April 2026 to 3 September 2026) against one instance, deciding and releasing the way the live loop would. 6,911 upstream changes arrived: 156 in talos, 65 in pkgs and 6,690 in linux-stable (Linux 6.18.24 → 6.18.48).
Changes installed
1,458
of 6,911 upstream (21%)
CVE fixes deferred as off-surface
2,088
of 2,981, each with a stated reason
Days until a ship-now fix runs
2.0
fast policy, vs 7.9 following upstream
The trade is cadence against speed. Upstream-paced releases 11 times against upstream's 10 while installing 21% of the changes. Fast releases 45 times and has a ship-now fix running in 2.0 days instead of 7.9. Weekly sits in between. Every policy installs the same 1,458 carried changes; only the timing differs.
| Policy | Releases | Ship-now fix, days | CVE fix, days | Installed |
|---|---|---|---|---|
| Follow upstream | 10 | 7.9 | 7.6 | 6,911 |
| graft, fasturgent releases at least 1 day apart, fixes batched every 7 days | 45 | 2.0 | 2.0 | 1,458 |
| graft, weeklyurgent releases at least 7 days apart, fixes batched every 7 days | 20 | 3.8 | 3.8 | 1,458 |
| graft, upstream-pacedurgent releases at least 14 days apart, fixes batched every 30 days | 11 | 7.5 | 7.3 | 1,458 |
Days are the mean time from a fix being available upstream to the instance running it. CVE fix days for graft cover the 893 CVE fixes it carries. Changed lines installed: 168,575 following upstream, 36,354 with graft.
04
Many fixes land without a CVE or a security note. Triage is rules-first for that reason, and the model can only raise a tier above a rule's floor, so a model mistake costs an extra release rather than a fix the rules required.
Code the instance does not compile or load is treated as unreachable. Physical access is out of scope for the VM profile: plugging in a USB NIC loads a driver the profile never saw. Profiles for real hardware have to account for it.
A pinned base is only safe while upstream supports it. The org must rebase before its base goes end of life, and graft flags the rebase ahead of that date.
05
Same upstream, a different profile (real network and storage hardware), so a different patch set. The second instance is where per-org stops being a claim.
The local model judged 526 changes the rules could not place. Its share will grow, and the numbers above will move.
The differentiation step. Build a kernel that compiles in only what the profile uses, so the 2,088 deferred CVE fixes point at code that is absent from the image, not merely idle in it.