Development

Contribute / quality bar

The kernel is developed to stringent pre-audit security standards.

Before changing code

• choose the owning repository from the boundary map;
• treat every external byte as adversarial;
• preserve deterministic, bounded, offline verification;
• prefer strong domain types over manual validation;
• add property tests and fuzz coverage for parsers and state transitions;
• document every exported API; and
• avoid new dependencies unless their security and determinism cost is justified.

Core checks

cargo xtask ci
cargo xtask arch
cargo xtask wire
cargo xtask conformance
cargo xtask fuzz-smoke

Never modify canonical .cbor fixtures by hand. Intentional wire changes are generated through cargo xtask wire --update and reviewed byte-for-byte.

Documentation checks

bun run generate
bun run generate:check
bun run check

The docs generator reads the actual three-repository workspace and commits a deterministic source inventory. Source changes that affect documentation make the check fail until the generated data is reviewed.