internal/

Package adminui embeds the minimal reviewer console served at GET /admin.

Package approval implements the three-tier mechanism for Class C (irreversible) tools, replacing naive "approve or deny every call" HITL - which trains reviewers to rubber-stamp - with a tiered design where only the irreducible remainder ever reaches a live person.

Package audit is the append-only event log every decision lands in: a local JSONL file by default, or a Postgres table in multi-instance mode (postgres.go).

Package authn verifies the delegated human's identity.

Real Vault dynamic AWS credentials, alongside dbsecrets.go.

Package classify infers a tool's reversibility class from its name, description, and schema - the single biggest onboarding barrier this system had.

Package compliance turns the raw material this proxy already collects - the tamper-evident audit log (internal/audit) and the reversibility registry (internal/registry) - into the thing a SOC2 auditor or a customer's compliance team actually wants: a structured summary over a time period, not a JSONL file they have to grep themselves.

Package discover turns a live MCP server into a runnable tool catalog with no human in the loop, which is what makes a one-command start possible at all.

AWS-backed tool execution - the real Vault dynamic-secrets path (aws/sts/<role>, a genuine sts:AssumeRole against the actual AWS account) alongside the existing biscuit/HTTP and DB paths.

Package mcpclient is the client half of MCP - what this proxy needs to forward a call ONWARD to an upstream MCP server, as opposed to internal/adapter/mcp which is the server half that agents connect to.

Package metrics records per-stage durations from internal/handler and exposes p50/p95 via cmd/rinwall's /metrics endpoint, so the latency claims in docs/REFERENCE.md are numbers rather than assertions.

Package policy embeds OPA directly in the proxy process - no network hop to a separate policy service, no per-call serialization round trip.

Real implementation, validated against the live Anthropic API before being wired in here: forced tool-use (not a plain text response asking for JSON) is what guarantees structured output - a plain-text prompt asking for JSON came back markdown-fenced in testing, which forced tool-use avoids entirely.

Package proxytypes is the transport-agnostic core representation an intercepted tool call is normalized into, regardless of whether it arrived over the REST adapter or the MCP adapter.

Package registry holds the one contract every mutating tool must satisfy before an agent is ever allowed to call it: a declared reversibility class and an allowlist argument schema.

Package risk computes a continuous score used ONLY to add friction, never to grant access on its own - the earlier design critique was explicit that an ML/heuristic risk score is a soft, adversarially-attackable signal, and must never be a standalone ALLOW condition for a mutating call.

Persistence for the saga Store - same reasoning as internal/approval's: a proxy restart mid-run must not silently lose the ability to compensate steps that already executed.

Package usage turns the audit log's real, per-call judge token usage into a cost report - both judges this project has: the text provenance judge (internal/provenance, PROVENANCE_JUDGE_USAGE entries) and the screenshot-reasoning one (internal/visualprovenance, VISUAL_PROVENANCE_JUDGE_USAGE entries).

Package validate implements allowlist-only payload validation: recursively canonicalize known encodings, then check the decoded value against a strict per-field schema.

Real implementation, validated against the live Anthropic API with three deliberately-constructed test screenshots before this file was written - a legitimate order-review page, a fake "System Notice" payment-approval dialog embedded in an email, and a page where the stated intent ("clicking Cancel") didn't match the actual button at the target coordinate ("Delete Account").