internal/

The agent version endpoints: publication and observation of an immutable publication.

Package auth defines the authenticated identity carried by control-plane requests.

Package bao implements the reference Secret Broker backed by OpenBao (ADR-012).

Package admission evaluates deterministic pre-scheduling requirements.

Package agentpkg defines the signed Agent Package manifest (ADR-010) and its admission verification.

Package agentversion defines the bounded AgentVersion vocabulary of the Agent OS kernel: the canonical reference grammar, the immutable published spec, and the deterministic digest over that spec.

Package capability enforces immutable AgentVersion grants at Gateway boundaries without coupling the Agent manifest vocabulary to persistence.

Package domain defines the stable lifecycle vocabulary enforced by the Fenced kernel.

Package memory implements the v0.1 Memory decision chain (ADR-009): the canonical store lives in PostgreSQL (FTS + pg_trgm + pgvector share the transaction system), embeddings are produced by a pluggable Embedder, and retrieval filters tenant/sensitivity before scoring.

Package model implements the Model Gateway decision chain of the Fenced kernel: versioned model descriptors with price tables, policy checks, incremental token/cost settlement against the task budget ledger, and the hard stop when a reservation is exhausted (tech baseline §12.1; invariant 12).

Package provider implements the real model execution layer behind the Model Gateway decision chain: an HTTP executor covering two wire dialects.

Package tokens provides tokenizer-aware token estimation for model budget reservations.

Package money provides the fixed-point representation used by every accounting ledger.

Package observability provides the read-side surface for the Phase 7 observability contract: every execution exposes a full correlation chain (Workflow → Step → Task → Run → Attempt → Model/Tool Call → Memory → Result) plus the core metrics the platform guarantees.

Package policy evaluates default-deny Rego policies inside the kernel process.

Package recovery reconciles expired runtime leases into fenced retries.

Package scheduler provides deterministic, explainable runtime placement.

Package store defines the transactional persistence contract used by kernel controllers.

Package postgres implements the Fenced kernel persistence contract on PostgreSQL.

Package tool implements the Tool Gateway decision chain of the Fenced kernel: versioned descriptors, canonical argument normalization, policy evaluation, human approval binding, budget hard-stop and durable side-effect receipts (architecture §9.2, §12.2; invariants 6 and 9).

The orchestrator controller.

Package workload defines the bounded task specification understood by admission and placement.

Package agentmetrics owns Fenced operational metrics.

Package artifact provides content-addressed Artifact storage adapters.

Package compat provides backward-compatibility shims for the AgentOS → Fenced rename.

Package errorcode is the canonical registry for stable public Fenced error codes.

Package grpcx centralizes the transport options every fenced gRPC boundary uses: message size ceilings above the largest payloads (assignments embed the full workload spec and receipt lists), keepalive so long-lived worker connections detect dead peers promptly instead of hanging on a half-open transport, bounded connect attempts so a down endpoint surfaces quickly instead of wedging the first call, and OpenTelemetry interceptors so every boundary participates in the reference observability stack.

Package migrate applies ordered, checksum-protected SQL migrations.

Package opensearch is the minimal REST client for the OpenSearch projection target (ADR-013).

Package otel wires the reference observability stack (tech baseline §15): OTLP trace/metric/log exporters configured through the standard OTEL_* environment variables, plus a bounded async slog → OTel log bridge.

Package outbox delivers PostgreSQL outbox events to a durable publisher.

Package projector applies canonical store events to the OpenSearch search projection (ADR-013).

Package redact contains cross-cutting trust-boundary sanitizers.

Package slo evaluates immutable v1 GA service objectives from a measured observation window.

Package spiffe implements the X.509-SVID identity boundary of the Secure Runtime (ADR-011): every fenced gRPC peer presents a certificate whose SPIFFE ID names its exact principal, and every boundary verifies the chain against the trust bundle and matches the presented identity against the claims of the request.

Package adapter implements the Runtime Protocol provider that delegates an assignment to a language/framework-neutral Agent Runtime Interface endpoint.

Package attemptstate helps Runtime Protocol workers converge after an optimistic-concurrency conflict without weakening fencing.

Package bindings resolves Runtime Interface endpoints and the transport policy that guards them.

gRPC broker clients: the adapter worker's loopback MCP endpoint reaches the Model execution layer and the Memory store through the same fenced gateway services every other runtime uses.

Package control implements the fenced Kernel-to-Runtime gRPC boundary.

Package leasekeeper keeps a Runtime Protocol lease alive while a worker executes a workload, and stops the execution when the lease can no longer be renewed.

Package oci provides the OCI + gVisor (runsc) Runtime Provider worker.

Package reference provides a deterministic Runtime Protocol conformance worker.