internal/

Package answers runs plugins on a fetched file and turns their outcomes into what the agent may see: per plugin 1, 0, or no answer with a code from a closed list.

Package marketplace installs plugins from a signed marketplace index: the index, then the artifact, are checked against the marketplace's trust root, and every downloaded byte against the hashes the signed index lists.

Package plugin is the local plugin store: verified plugin binaries and manifests under <Dir>/plugins/<qualified name>/<version>/ (0500), and <Dir>/plugins.lock recording what was verified at install time.

Package source fetches one object by its exact key from S3 (or an S3-compatible store), SFTP or a local directory.

Package verify checks signatures of marketplace indexes and plugin artifacts against a trust root.

Package workspace holds fetched files in the lockfile account: one private directory per handle, a random file name, never the source name.