internal/

Package apigen provides primitives to interact with the openapi HTTP API.

Package access is the Authorizer for an access list (docs/adr/0011, TAXONOMY.md D27): four roles, each a bundle of permissions, and teams that scope a contributor's work.

Package proxy is the Authenticator for a deployment behind an authenticating reverse proxy (oauth2-proxy, Pomerium, Authelia, an ingress with OIDC): the proxy verifies the person and forwards their identity in a header, and this adapter trusts that header.

Package roles is a role-based Authorizer: principals in a write role may read and write, principals in a read role may read, everyone else is refused.

Package conformance is the suite every codec.Codec adapter must pass: what the engine relies on, written once, run against each syntax.

Package json is the JSON codec.

Package yaml is the YAML codec: yaml.v3 to read, yamlfmt to write, so a file saved by Cartograph keeps the two-space indentation the vaults are written in by hand.

Package automerge is the crdt port's adapter: Automerge, compiled to WebAssembly from the crate in crdt/ and run on wazero, so the engine stays pure Go (CGO_ENABLED=0) and speaks the same document format and sync protocol as every interface using the stock Automerge libraries (docs/adr/0007).

Package conformance is the suite every adapter of the crdt port must pass.

Package conformance is the suite every fanout.Bus adapter must pass.

Package memory is the in-process fanout.Bus: every Bus made from one Hub delivers to every subscriber of that Hub.

Package postgres is the fanout.Bus over Postgres LISTEN/NOTIFY, so a deployment whose state is in Postgres needs no second service for fan-out (docs/adr/0008).

Package goal implements the Goal kind's rules beyond its JSON Schema: parent presence by level (a goal has no parent; an objective requires a goal as parent; an outcome requires an objective goal as parent), unique key result ids within the goal, the key result unit-by-kind rule, and the objective must-be-qualitative rule.

Package kit holds the small, dependency-free types that both the engine and the per-kind rule packages need.

Package kpireadings validates a KPI's series beyond its JSON Schema.

Package programme implements the Programme kind's rules beyond its JSON Schema: the risk list a project and a programme share, checked here without phases, because a programme holds no timeline, and the gap citations they also share.

Package project implements the Project kind's rules beyond its JSON Schema: unique key result ids within each objective, the key result unit-by-kind rule, the objective must-be-qualitative rule, unique deliverable ids, unique success criteria ids, a success criterion's derivedFrom must name exactly one key result or deliverable that actually exists in this project, at most one funding line per currency, and a risk's escalate.reason is required when escalate.flag is true; every local reference resolves to an item this project actually has; and a dependency edge belongs to the dependency type and lands by a phase the timeline actually has.

Package segment validates the slice tree beyond its JSON Schema.

Package settings implements the Settings kind's one rule beyond its JSON Schema: it is the only singleton kind, so its metadata.id must always be "default".

Package stakeholdermap implements the StakeholderMap kind's rules beyond its JSON Schema: a map is scoped to a piece of work rather than to any manifest at all, and it scores each resource once.

Package chromium prints HTML to PDF with a headless Chromium.

Package computed is the reporting adapter that works out each report when asked, from the engine's reads: no storage of its own, the same on every store (docs/adr/0014).

Package conformance holds a reporting adapter to another's rows over the same record: every standard report, column for column, row for row, in any order.

Package postgres is the reporting adapter that answers reports from views in the deployment's own Postgres (docs/adr/0014), so SQL and BI tools read the same rows the API serves.

Package conformance is the one test suite every store adapter must pass, proving the SQLite, in-memory and Postgres adapters are interchangeable behind the store ports.

Package manifestmeta reads metadata.name and metadata.labels out of a manifest's text, for the store adapters that index both beside each version.

Package memory is the in-memory ManifestStore and OperationalStore adapter used by tests and by the conformance suite.

Package postgres is the Postgres adapter for the ports a stateless deployment needs (docs/adr/0008): store.ManifestStore, store.OperationalStore, store.BundleStore and store.DocStore, over one database through pgx, a pure-Go driver, so the binary stays CGO_ENABLED=0.

Package sqlite is the SQLite adapter for both store.ManifestStore and store.OperationalStore, backed by modernc.org/sqlite (a pure-Go driver, no cgo).

Package vault implements store.ManifestStore over a directory tree: files are the source of truth.