internal/

Package anchor defines the external-witness sink the daemon writes rotation (and, in a later phase, checkpoint) events to (ADR-0015).

Package binresolve locates sibling binaries that ship together.

Package chain owns the daemon's in-memory chain state — the next sequence number and the previous-receipt-hash for each chain id.

Package doctorcli implements the `agent-receipts doctor` subcommand: an end-to-end health check of the receipts pipeline (emitter → socket → daemon → SQLite → verify) described by ADR-0010.

Package keyscli implements the `obsigna keys` subcommands — generate, pubkey, and rotate — that manage the daemon's Ed25519 signing key from the read-side CLI.

Package keysource defines the interface the daemon uses to sign receipts.

Package listcli implements the `agent-receipts list` subcommand: query recent receipts from a daemon-written SQLite store and print them in tabular or JSON form.

Package pipeline maps an emitter frame plus an OS-attested peer credential into a signed AgentReceipt and persists it to the store.

Package showcli implements the `agent-receipts show <seq>` subcommand: inspect a single receipt by its chain sequence number, read from a daemon-written SQLite store.

Package socket owns the daemon's Unix-domain-socket listener, the per-OS peer-credential capture, and the length-prefix message framing.

Package sockettest provides shared helpers for AF_UNIX socket tests.

Package verifycli implements the `agent-receipts verify` subcommand: validate a stored chain's signatures and hash links using a daemon-written SQLite store and the daemon-published public key.

Package verifyeventcli implements the `agent-receipts verify-event` subcommand: end-to-end pipeline-provenance evidence for a single historical receipt.