The Sovereign
Kernel.
The runtime that unifies everything. One kernel to rule identity, keys, policy, events, and intelligence. Where every byte is yours, every operation is proven, and every system speaks the same language.
Built on Trust
Real teams. Real scale. Real sovereignty.
“Finally, infrastructure that doesn't pretend complexity is a feature. Core just works.”
“We replaced 7 auth systems with Core. Audit went from nightmare to non-event.”
“The event bus alone saved us 3 months. The policy engine saved our sanity.”
The Integration Tax
You're building on quicksand. Every new service duplicates auth. Every integration leaks context. Every audit reveals what you already know: the foundation is broken.
17 different auth systems, zero source of truth. Your identity layer is a distributed monolith.
Secrets scattered across 5 vaults, 3 clouds, and that .env file someone forgot about.
Webhooks that fail silently at 3am. Events lost in the void. State machines that aren't.
When the auditor asks 'who did what, when?'—you have 50 logs and zero answers.
You don't need another tool. You need a kernel.
What GalyarderCore Is
A disciplined kernel that standardizes identity, keys, capability tokens, policy, events, storage, scheduling, model routing, and audit—so every product builds on the same spine.
One source of truth for identity, permissions, and policies.
Deterministic execution with retries and idempotence.
Evidence by default through signed actions and immutable logs.
The Stack Hierarchy
Every layer speaks the same language. Every component shares the same spine.
Applications
Your products built on Core
Core Runtime
The sovereign kernel
Primitives
Foundational building blocks
Infrastructure
Your choice of deployment
Initialize, Configure, Compose, Operate
Initialize
Bootstrap DID, keys, and core policies. Connect your vault.
Configure
Declare capabilities, adapters, schedules, and routing budgets.
Compose
Bind modules and protocols; wire events and approvals.
Operate
Run with observability, audit trails, and safe recovery paths.
See It In Action
Real code. Real sovereignty. No abstractions hiding the truth.
1// Bootstrap sovereign identity2const core = await GalyarderCore.init({3 did: { method: 'key', curve: 'ed25519' },4 vault: process.env.VAULT_ENDPOINT5});6 7// Create service identity with capabilities8const service = await core.identity.create({9 type: 'service',10 capabilities: ['data:read', 'events:publish'],11 expiry: '30d',12 audience: ['api.example.com']13});14 15// Verify and rotate automatically16await core.identity.rotate({ 17 schedule: '0 0 * * 0',18 notify: true 19});Core Primitives
Identity (DIDs)
User, service, and agent identities you control.
Keys (KMS/BYOK)
Local-first keys; hardware enclaves optional; rotation supported.
Capabilities
UCAN-style tokens with scopes, expiry, and audience.
Policy Engine
Least privilege; declarative rules; denials logged.
Event Bus
Durable events; idempotent handlers; retries with backoff.
Scheduler
Cron and event triggers with jitter and budget guards.
Model Router
BYOK; stage-aware routing (plan/draft/verify) with cost ceilings.
Storage Abstractions
Vault-respecting connectors; encrypted at source.
Secrets
Namespaced secret stores with audit and rollovers.
Audit Log
Signed actions and state transitions; exportable evidence.
Runtime Modes
Airspeed fast, no data leaves the machine.
Developer Surface
SDKs
TypeScript and Rust first; stable contracts and versioned schemas.
CLI
Bootstrap, key ops, capability minting, and policy validation.
Templates
App, agent, and service starters wired to Core primitives.
Webhooks+
Signed, retried, idempotent; contract-tested with fixtures.
Built for Composability
Protocol DSL
Objectives, approvals, and exit criteria as code.
Observability
Structured logs, traces, and metrics with correlation IDs.
Migration Paths
Schema/version gates and automated upgrades.
Sandbox Mode
Dry-runs with synthetic events and trace diffs.
Budget Guards
Rate/volume caps and model cost ceilings.
Contract Tests
Validate adapters before going live.
Integrated with the Stack
Core is the spine; every product speaks the same language.
Security & Resilience
Least privilege everywhere; explicit scopes; deny-by-default.
Signed events and actions; tamper-evident logs; recovery points.
Key rotation and secret rollovers without downtime.
No implicit network or filesystem access; adapters declare scopes.
Introspect the Kernel
Fetch a demo list of primitives to see the Core contract surface.
FAQ
Join the Core Early Access
We are onboarding teams that need a disciplined kernel. Early access includes Core primitives, SDK/CLI, and contract fixtures.