platform/

Package agenttoken mints and parses fleet agent credentials.

Package binregistry verifies tool-binary integrity before execution (F5).

Package buildinfo reports dependency + application versions from the compiled binary's build metadata, used to record scan reproducibility.

Package config loads runtime configuration from the environment.

Package httpserver runs an HTTP server with graceful shutdown.

Package idgen provides Clock and IDGenerator implementations for the platform.

Package jobs is a small bounded worker pool: a fixed number of workers draining a fixed-size queue.

Package logging builds the application's structured logger.

Package redact is the shared belt-and-suspenders scrubber for secret material on its way to any sink – logs, the audit writer, the evidence seal, tool output.

Package untrusted is the shared guard for any UNTRUSTED text a source-reading AI ingests – dependency source excerpts, files a SAST/threat brain reads, or a tool's stdout.

Package worksign is the platform adapter that signs and verifies fleet work order payloads with an HMAC-SHA256 keyed MAC.