internal/

Package apigen provides primitives to interact with the openapi HTTP API.

Package access is the Authorizer for an access list (docs/adr/0011, TAXONOMY.md D27): four roles, each a bundle of permissions, and teams that scope a contributor's work.

Package proxy is the Authenticator for a deployment behind an authenticating reverse proxy (oauth2-proxy, Pomerium, Authelia, an ingress with OIDC): the proxy verifies the person and forwards their identity in a header, and this adapter trusts that header.

Package roles is a role-based Authorizer: principals in a write role may read and write, principals in a read role may read, everyone else is refused.

Package conformance is the suite every codec.Codec adapter must pass: what the engine relies on, written once, run against each syntax.

Package json is the JSON codec.

Package yaml is the YAML codec: yaml.v3 to read, yamlfmt to write, so a file saved by Cartograph keeps the two-space indentation the vaults are written in by hand.

Package automerge is the crdt port's adapter: Automerge, compiled to WebAssembly from the crate in crdt/ and run on wazero, so the engine stays pure Go (CGO_ENABLED=0) and speaks the same document format and sync protocol as every interface using the stock Automerge libraries (docs/adr/0007).

Package conformance is the suite every adapter of the crdt port must pass.

Package conformance is what every decide.Decider must do: answer every question asked, pick a Choice from its own options with probabilities that are probabilities, give a YesNo a probability, and stop when its context is cancelled.

Package fake is a decide.Decider for the gate's tests: it answers each question as a test scripts it, by the question's name, and any question not scripted as a model unsure of it would (every option alike, a yes or no at one half).

Package laya is a Decider backed by Laya, an open decision model, run as a sidecar beside Cartograph (deploy/laya): the model needs a runtime the static binary does not carry, so it is reached over HTTP on the same host or network.

Package conformance is the suite every fanout.Bus adapter must pass.

Package memory is the in-process fanout.Bus: every Bus made from one Hub delivers to every subscriber of that Hub.

Package postgres is the fanout.Bus over Postgres LISTEN/NOTIFY, so a deployment whose state is in Postgres needs no second service for fan-out (docs/adr/0008).

Package goal implements the Goal kind's rules beyond its JSON Schema: parent presence by level (a goal has no parent; an objective requires a goal as parent; an outcome requires an objective goal as parent), unique key result ids within the goal, the key result unit-by-kind rule, and the objective must-be-qualitative rule.

Package kit holds the small, dependency-free types that both the engine and the per-kind rule packages need.

Package kpireadings validates a KPI's series beyond its JSON Schema.

Package operation implements the Operation kind's rules beyond its JSON Schema: a service's recurring funding lines (TAXONOMY.md D39) and its mandate's issuer (D43).

Package portfolio implements the Portfolio kind's rules beyond its JSON Schema (TAXONOMY.md D32).

Package portfoliodecisions implements the PortfolioDecisions kind's rules beyond its JSON Schema (TAXONOMY.md D32).

Package programme implements the Programme kind's rules beyond its JSON Schema: the risk list a project and a programme share, checked here without phases, because a programme holds no timeline, and the gap citations they also share.

Package project implements the Project kind's rules beyond its JSON Schema: unique key result ids within each objective, the key result unit-by-kind rule, the objective must-be-qualitative rule, unique deliverable ids, unique success criteria ids, a success criterion's derivedFrom must name exactly one key result or deliverable that actually exists in this project, at most one funding line per currency, and a risk's escalate.reason is required when escalate.flag is true; every local reference resolves to an item this project actually has; and a dependency edge belongs to the dependency type and lands by a phase the timeline actually has.

Package purpose implements the Purpose kind's one rule beyond its JSON Schema: a workspace states one purpose, so its metadata.id is always "default".

Package reportingcycle holds the ReportingCycle kind's rules and the one derivation every reader of a cycle must agree on: which periods it has.

Package segment validates the slice tree beyond its JSON Schema.

Package settings implements the Settings kind's one rule beyond its JSON Schema: it is the only singleton kind, so its metadata.id must always be "default".

Package stakeholdermap implements the StakeholderMap kind's rules beyond its JSON Schema: a map is scoped to a piece of work rather than to any manifest at all, and it scores each resource once.

Package team holds the Team kind's rules.

Package conformance is what every layout.Layout must do: place every node somewhere finite, the same way every time, keep what is connected nearer than what is not, and keep a group together.

Package force is a force-directed Layout: edges are springs, nodes push apart at short range, and each group drifts towards its own place on a ring, so the same kinds gather and a node sits between what it connects.

Package layered is a Layout for a directed acyclic graph: each group is a layer, drawn as a band from the top down in the order the engine numbers them, so every edge runs from a band to one above it or along its own.

Package chromium prints HTML to PDF with a headless Chromium.

Package computed is the reporting adapter that works out each report when asked, from the engine's reads: no storage of its own, the same on every store (docs/adr/0014).

Package conformance holds a reporting adapter to another's rows over the same record: every standard report, column for column, row for row, in any order.

Package postgres is the reporting adapter that answers reports from views in the deployment's own Postgres (docs/adr/0014), so SQL and BI tools read the same rows the API serves.

Package conformance holds any semantic layer exporter to the port's promises: every KPI and data source in the layer is in what it writes, and the same layer always gives the same files.

Package dbt writes a semantic layer as dbt's: one YAML file of semantic_models and metrics, in the shape dbt's semantic layer reads (dbt 1.6 and later), for an analytics engineer to put in a dbt project beside the models it refers to.

Package conformance is the one test suite every store adapter must pass, proving the SQLite, in-memory and Postgres adapters are interchangeable behind the store ports.

Package manifestmeta reads metadata.name and metadata.labels out of a manifest's text, for the store adapters that index both beside each version.

Package memory is the in-memory ManifestStore and OperationalStore adapter used by tests and by the conformance suite.

Package postgres is the Postgres adapter for the ports a stateless deployment needs (docs/adr/0008): store.ManifestStore, store.OperationalStore, store.BundleStore and store.DocStore, over one database through pgx, a pure-Go driver, so the binary stays CGO_ENABLED=0.

Package sqlite is the SQLite adapter for both store.ManifestStore and store.OperationalStore, backed by modernc.org/sqlite (a pure-Go driver, no cgo).

Package vault implements store.ManifestStore over a directory tree: files are the source of truth.

Package jsonl keeps traced calls as JSON lines appended to a file, one call a line, for any tool that reads JSON lines (and for cartograph traces) to analyse.