agent/

Package capture contains the node agent's transparent-capture controller: it watches the generated selectorless mesh Services (proposal 018, Phase 3a) and projects their cluster.local authorities into the snapshot cache, which builds the cap_http route table the per-pod capture listeners serve.

Package cmd provides command-line interface configuration for the Aether agent.

Package server implements a gRPC server for the CNI plugin interface.

Package configimport materializes cross-cluster GAMMA config on a spoke (proposal 026, multi-cluster config propagation — the consumer side).

Package gatewayapi contains the edge proxy's Gateway API controller: it watches Gateway API HTTPRoutes, TCPRoutes, and TLSRoutes attached to a Gateway of the aether GatewayClass and projects them into the edge data plane (proposal 018 — north-south).

Package attachment holds the edge Gateway API controller's route→listener attachment resolution: parentRef matching, allowedRoutes (namespaces/kinds) admission, ReferenceGrant-gated backendRef admission, and listener/route hostname intersection.

Package portalloc provides deterministic internal-port allocation for per-Gateway edge listeners (proposal 021 Phase 2).

Package secret resolves edge downstream-TLS certificates from pluggable backends (the SecretProvider enum).

Package endpointpolicy contains the node agent's EndpointPolicy controller: it watches the service-scoped delivery policies (proposal 034 Phase 1b) and projects them into the snapshot cache as a "<ns>/<svc>" → "<volume>/<file>" map.

Package gamma contains the node agent's GAMMA controller: it watches Gateway API HTTPRoutes attached to a Service (parentRef kind=Service) and projects their L7 rules into the node proxy's outbound routing (proposal 018, Phase 2 — east-west).

Package gatewaystatus contains shared helpers for writing Gateway API status: controller-owned RouteParentStatus entries on Routes and conditions on Gateways/GatewayClasses.

Package l4route contains the node agent's L4 route controller: it watches Gateway API TCPRoutes, TLSRoutes, and UDPRoutes (parentRef kind=Service) and projects their rules into the node proxy's capture listener filter chains.

Package meshdns is the node agent's in-process DNS resolver (Istio-style, proposal 018 mesh-global FQDN).

Package node provides node-level operations for the agent — notably removing the aether startup taint once the agent's CNI is serving, so workload pods can schedule onto the node (the Cilium-style cold-start gate; see issue #261).

Package hotrestart implements a supervisor that manages the aether-proxy Envoy process and performs Envoy hot restarts across restart epochs, replicating the behavior of Envoy's hot-restarter.py in Go (see docs/proposals/001_proxy-hot-restart.md).

Package spire provides integration with SPIRE for X.509 SVID management.

Package ack tracks Envoy's delta-xDS ACK/NACKs per resource, replacing admin /config_dump polling (which serializes config on Envoy's main thread) as the agent's confirmation that a config update reached the proxy.

Package cache manages Envoy xDS snapshot resources for the agent.

Package cachemetrics holds the agent xDS snapshot-generation instruments.

Package snapversion generates xDS snapshot version strings for the agent cache.

Package config provides Envoy configuration helpers for xDS resources.

Package proxy provides functions to generate Envoy resource types (listeners, clusters, endpoints, routes, filter chains) from pod and service registry data.

Package server implements the agent-specific Envoy xDS server.

Package xdsconst holds the Aether pod annotation keys consumed exclusively by the agent's xDS proxy-config generation (proxy/cache/server), keeping them out of the cross-tree common/constants fan-in.