internal/

Package agentpki issues the mTLS client certificates of AnixOps Agents (node-ops-service.md, section 5.3).

Package agentreports keeps the record of report batches the Agent Control stream applied (reports.v1, node-ops-service.md section 5.5), so that a batch an agent resends is applied at most once per node.

Package agentstreams is the kernel's view of its live agent sessions: the Agent Control streams, by node kind, and the legacy agent WebSocket.

Package agenttransport carries the agent transport transition of node-ops-service.md, section 5.6 (A2-6): the agent_control.mtls policy on the legacy AnixOps-agent HTTP and WebSocket paths, the deprecation signals, the legacy request counters, and the transport inventory (which channel each node's agent was last seen on).

Package agentws defines the internal context keys shared by the v2 gateway and the kernel-side compatibility adapter for preauthenticated agent sockets.

Package authn verifies the kernel's user access tokens in one place: the HTTP middleware, the admin monitor WebSocket and the gRPC interceptor all call it.

Package branding contains product names shared by the control-plane runtime.

Package edition decides which features the configured product edition (app.edition) serves.

Package health serves the process probes shared by the API and frontend servers: /livez (the process is running), /readyz (the process can serve traffic), and the legacy /health.

Package identitybridge defines the narrow, kernel-owned operations exposed to the identity-platform package host.

Package identitycutover moves credential authority between the kernel's legacy handlers and the identity module, for identity-platform's group A (service.IdentityGroupARoutes):

Package identityimport copies Control's legacy identity data (v2_user identity columns and v2_user_mfa) into the identity module with IdentityService.ImportAccounts.

Package identitykeys keeps the identity module's token verification keys in the kernel: pulled with IdentityService.GetTokenKeys, persisted in v4_kernel_identity_token_key so tokens keep verifying while the identity module is down, and cached in memory for every request.

Package kernelidentity serves the KernelIdentity contract: the kernel side of the identity module.

Package kernelnodeops serves the KernelNodeOps contract (sdk/api/kernelnodeops/v1, docs/architecture/node-ops-service.md) to official packages: typed, idempotent operations on nodes that the kernel records in its ledger (v4_kernel_node_operation), carries out with the executor of each kind and answers by polling and a watch stream.

Package kernelorder serves the KernelOrder contract (sdk/api/kernelorder/v1, docs/architecture/order-service.md) to official packages: the order writes that span domains, which the kernel performs in one transaction with the same code its legacy handlers use.

Package kernelsettings serves the KernelSettings contract (sdk/api/kernelsettings/v1, docs/architecture/settings-service.md) to official packages: the system settings in v2_system_config and the backup configuration row, per namespace (service.SettingsNamespaces).

Package kernelsubscriber serves the KernelSubscriber contract (sdk/api/kernelsubscriber/v1, docs/architecture/subscriber-service.md) to official packages: shared subscriber state behind internal/subscriber and the kernel's user update path.

Package kerneltelemetry serves the KernelTelemetry contract (sdk/api/kerneltelemetry/v1, docs/architecture/kernel-caches.md) to official packages: the telemetry the kernel computes and caches in its memory, read through the same function and cache as the kernel's legacy handlers.

Package lease provides database-backed leases so that work which must run in exactly one Control process (periodic resets, stats collection, the forward job executors) stays single even when several processes share one database: during a rolling update, or with more than one replica.

Package logging configures process-wide log output from the log config block.

Package modulepki is the kernel's built-in certificate authority for network modules.

Package moduleruntime runs the kernel side of network modules: the mTLS module listener that serves ModulePKI and the remote package bridge.

Package nodesecrets is the one writer of the node credential split (docs/architecture/node-ops-service.md, section 4).

Package packagebridge exposes narrow, generation-bound kernel operations to a single supervised package host.

Package packagestore provisions least-privilege database storage for package hosts.

Package panicrecovery converts panics on kernel request paths into ordinary errors so one faulty handler cannot terminate the kernel process.

Package payment 提供可插拔的支付网关注册表。

Package plugincontrol contains the Control-side runtime boundary for officially signed packages.

Package pluginhost supervises local Control package processes.

Package requestorigin resolves the scheme, host and client IP of an HTTP request.

Package sealedsecrets keeps node secrets away from package hosts (docs/architecture/node-ops-service.md section 3.7, NO-4).

Package shadowsamples stores the sanitized shadow-mode mismatch samples package hosts report, and serves them to the route-mode administration.

Package subscriber is the kernel's single writer of shared subscriber state: entitlements, traffic counters, subscription credentials and balances in v2_user and v2_user_subscription_group (docs/architecture/subscriber-service.md).