# ArmorBreak Core Public API Contract (ABU-101)

Status: frozen for the P1 host-neutral boundary. Breaking changes require a new
contract version and a migration note; the legacy DSH entry remains separate.

## Exports

`@armorbreak/core` exports the constructors/stores needed by host adapters,
protocol validators, envelope helpers and `createCore`. `getRuntime({stateRoot})`
is the shared per-stateRoot process instance used by DSH, Core and Engine.
The machine-readable list is `packages/core/api-contract.json`.

## createCore

```js
const core = await createCore({ stateRoot })
await core.capabilities(invocation)
await core.health(invocation)
await core.close()
```

- `stateRoot` is mandatory and is the single source of task/authorization facts.
- Invocation fields are validated by `@armorbreak/protocol` before calls.
- The Core has no Cordis/DSH/DOM/Electron import; DSH-specific wiring stays in
  `packages/adapter-dsh` and the legacy plugin.

## Result guarantees

- capabilities: at least `id`, `title`, `riskLevel`, `domain`; exactly 46 in the
  V2 baseline.
- health: includes the resolved workspace, tasks and policy state.
- task: includes task id, workspace, state, operator and timestamps.
- L3 remains always denied; model identity is never an authorization principal.

## Dependency graph

`packages/core/dependency-graph.json` is generated by
`scripts/v2/core-dependency-graph.mjs`; the contract test fails on forbidden
dependencies or a missing export.