@amalgm/core

The Amalgm kernel SDK: identity, transport, and supervision contracts — every law a machine needs to boot the platform, prove who it is, stay alive, and route traffic to everything else. Start with PURPOSE.md (the charter) and docs/responsibilities.md (every duty, and the knife table mapping the engine monolith onto its target repos).

The evolving product contract for the top-level command, modular service installation, and mandatory managed updates is docs/amalgm-cli.md.

src/identity/     labels, layout grammar, ids, auth records
src/transport/    the auth boundary, ONE routing table, admission, ingress
src/supervision/  health contracts, restart machines, updater laws,
                  service registration
src/adapters/     the ports a host injects (clock, hash, random, hmac…)
surfaces/         cli · api · mcp — thin doors over src/
skills/core/      the skill that teaches an agent this kernel

npm install
npm test                      # build + every exam
node surfaces/cli/amalgm-core.mjs label canary

Rules of the house: zero runtime dependencies; nothing in src/ imports node:* or reads process.env; contracts are byte-exact against the shipped engine (the production source until cutover — PURPOSE.md axiom 9); tests are exams — each states a law, and a mutant must be convicted by at least one.

Package releases use .github/workflows/publish-package.yml. A reviewed main commit is tagged exactly v<package version>; trusted npm publishing stages that package, and a maintainer approves the staged artifact with 2FA. Manual dirty-worktree publishing is not a release path.