Who a kernel is: the seed it derives, the root claim it records, and the secrets only it can open.
README examples 1–2: the documented compound seed, and a callable reseed. Run live on the Core guarantees page.
Usernames are validated and the root claim is recorded. Row A1 of the live axioms page.
A secret branch opens only for the identity, scope secrets and noise boundary that wrote it.
Data encrypted under one .me identity root does not open under another.
A kernel rebuilt from its memories has the same state. Runs only in fire.test.ts, which is in neither npm test nor CI.