internal/

Package log is Brigade's one redacting slog handler (plan 7.3, T12): every diagnostic line an adapter or the harness writes to stderr or a log file goes through it, because the harness captures adapter stderr at debug level and a leak here puts a credential in a 0600-but-still- on-disk log file (U-09, U-23).

Package fs implements the Brigade filesystem adapter: a second BAP/1 implementation whose backend is a directory on disk.

Package supabase is the bundled Brigade adapter for a Supabase backend (plan section 5, protocol docs/protocol-v1.md): one anonymous GoTrue principal per profile, every write through the `brigade.*` RPCs of the finished migrations over PostgREST, and a Phoenix channel over coder/websocket for the watch.

Package cases holds the conformance cases of plan 9.2, one file per case, coded against the T API of internal/conformance.

Package account reads the Claude account's email address from Claude Code's own configuration file, best effort and READ-ONLY (Trello card 24, part B): the `oauthAccount.emailAddress` string in `.claude.json`, which Claude Code keeps at $CLAUDE_CONFIG_DIR/.claude.json when that variable is set and at $HOME/.claude.json otherwise (E0-5, E0-7 — E0-7 also records a fresh config directory whose `.claude.json` has no `oauthAccount` key at all, which is exactly the "" case below).

Package adapterclient is the one place the harness spawns an adapter child (plan 3.4, 4.1, 6.6; brief section 2.2).

Package backoff is the retry arithmetic of plan 6.6 and 6.8 item 7 (U-16): an exponential schedule with jitter for the watcher's restart of its `message watch` child (1 s doubling to a 30 s cap, and a fixed 5 min once that pace has failed ten times — card 34) and for adapter errors (1 s doubling to a 5 min cap), and the retryability predicate — only `rate_limited` and `unavailable` (and a crash or signal, which adapterkit.Spawn already maps to `unavailable`) are ever retried; `invalid_input`, `unauthorized`, `loop_detected` and every other code are terminal.

Package bootstrap holds no Go code that ships.

Package commands implements the human and model command surface of the `brigade` binary (plan 6.4): `sessions`, `send`, `whoami`, `doing` (card 25, doing.go), `sync status` (card 33, sync.go), `team members`, the hold policy's `inbox` and `inbox release` (inbox.go), and the terminal pass-through of `team create|join|leave` and `profile init|status|reset|revoke-credentials`.

Package config is the only harness package that reads configuration from the environment (plan 3.2, 6.5, 7.3; forbidigo enforces the static half).

Package doing holds what the harness knows about a session's doing line (card 25, plan .context/plans/session-doing.md): the one sentence a session's own model publishes as `session_description` so teammates can route by it.

Package e2e holds the end-to-end harness tests of plan 9.5 (the integrator's half of P3-3/P3-4/P3-5, E2E-01's fs precursor): the built `brigade` binary and the built fs adapter, driven as real processes — the terminal pass-through that creates and joins a team, the three lifecycle hooks with their stdin documents and session environments, the REAL detached watcher the SessionStart hook spawns, `brigade send` from a second principal's own session, the frame arriving at a fake inbox socket, and the token appearing in no file and on no argv afterwards (U-25's whole-tree grep).

Package foldersync is the harness side of the sync-adapter protocol (folder-sync plan §4.3, docs/sync-adapters.md): the request and result shapes of its five verbs, the Client that resolves a sync adapter by NAME and runs one verb through adapterkit.Spawn, and the derivations both ends of a team must agree on byte for byte — the folder id, path and label handed to `apply`, and the `<adapter>:<descriptor>` form a session's peer takes on the wire (sync_peer, C-47).

Package frame renders and parses the `<brigade-message>` frame of plan 6.7 — the text a receiving model actually reads — in the shape D19 settled on (variant C, decided by E0-3 at an interactive sitting on 2026-08-31): Brigade's own frame, nested by Wrap inside the native `<cross-session-message from-name="…">` wrapper that the Claude Code harness consumes into its "Message from @<name>" attribution.

Package hook implements the three Claude Code lifecycle hooks of plan 6.3 — `brigade hook session-start`, `brigade hook prompt` and `brigade hook session-end` — the processes Claude Code runs from plugin/hooks/hooks.json with a JSON document on stdin and the session's environment (6.5).

Package inbound is the receive-side pipeline of plan 6.8 — the ordered controls every `message` event passes before it is framed and handed to an injector — implemented once, PURE, so that P3-5's watcher (socket post or `--sink`) and P3-4's prompt-hook poll (6.3) run the same code:

Package notice is the watcher's notice file (plan 3.2, card 34): the lines a watcher has for its session, which the next prompt hook prints once and removes.

Package notify resolves the fixed programs a session's watcher runs when a teammate's message arrives and the member asked to be told (cards 35 and 36): a quiet system sound through the platform's own player (`message_sound`), and a desktop notification through the platform's own notifier (`message_notification`).

Package pidfile is the watcher's single-instance guard (plan 6.6, the `${BRIGADE_STATE_DIR}/watchers/<claude_pid>.json` row of 3.2, corrected by E0-5 items 1 and 3; package tree 7.1).

Package policy decides the inbound policy a session runs under — the step 3 of plan 6.8, with the native `crossSessionInbound` scan of 6.10 folded in — and is the ONLY implementation of that decision: the SessionStart hook (P3-4) calls it to fill the by-pid map's `inbound`, the prompt-hook poll and the watcher's pipeline (internal/harness/ inbound) run under the value it produced.

Package registry reads Claude Code's own session registry, best effort and read-only (plan 6.5, A.3): $CLAUDE_CONFIG_DIR/sessions/<pid>.json, an undocumented file that carries the session's display name (set with --name or /rename), its busy/idle status, the inbox socket path and the Claude Code version.

Package sessionmap is the hook-written state that binds a Claude Code process to its Brigade session (plan 3.2, 6.5): the by-pid map at ${stateDir}/sessions/by-pid/<claude_pid>.json, from which the session-bound commands and the watcher resolve EVERYTHING (profile, config dir, adapter argv, Brigade session id, team, socket path), and the by-native map at ${stateDir}/sessions/by-native/<claude_session_id>.json, which lets a later `claude --resume` re-open the same Brigade session (3.7).

Package socketpost is the inbox socket client of plan 6.7 and A.2: it writes one frame into a Claude Code session's `CLAUDE_CODE_MESSAGING_SOCKET` as the two NDJSON lines the harness reads — an auth line carrying the session's messaging token, then a user line carrying the content — and closes.

Package teamfile reads the one file a project may commit to name its Brigade team: `.brigade.json` at the repository toplevel (plan P7-2, brief §1).

Package teamstore is the user-side trust root of the repo-file model (plan P7-4, brief §3/§5): the team KEY that names a credential directory, the BINDING (`teams/<key>/team.json`, the adapterkit profile schema) verified field-by-field against a parsed repo file — the hash is never trusted alone — and the per-checkout PINS in `projects.json` that separate membership from attachment: a repo file attaches a session only where a human ran `team join` in that checkout.

Package write holds every writer of the team store.

Package transcript reads Claude Code's own session transcript — the append-only NDJSON file whose path the hooks receive as `transcript_path` — for the two facts `brigade sessions` shows beside a session's name and activity: the model it runs and how much of its context window is in use.

Package watch is the detached inbound watcher of plan 6.6 and 6.8 — the process `brigade hook session-start` spawns with Setsid and the hook-built environment, and which then supervises the adapter's `message watch` child, runs every `message` event through the shared receive-side pipeline (internal/harness/inbound), injects each frame into the Claude Code session's inbox socket (internal/harness/socketpost) or, in the test harness's sink mode, appends it to a file, acknowledges only what was injected, heartbeats the Brigade session, and exits when the Claude Code process, the by-pid map or a SIGTERM says the session is over.

Package watchstate is the one fact a running watcher writes down about its connection, for `brigade whoami` to read (card 34): whether the watch child is up, and since when.

Package schema generates the JSON Schema (draft 2020-12) document for the wire shapes of the Brigade Adapter Protocol v1 (plan 7.3): one document with a $defs entry per protocol type, reflected from the Go structs of internal/protocol with invopop/jsonschema and then patched where reflection cannot see the protocol's rules — the C-23 forbidden SendRequest members become `false` property schemas, pointer-typed members become nullable, and the 4.4.1 code-point caps become maxLength.

Package syncthing is Brigade's bundled sync adapter (plan folder-sync 4.4): `brigade sync-adapter syncthing <verb>`, one JSON request on stdin, one 4.3 result envelope on stdout, the verbs of the sync-adapter protocol (plan 4.3: describe, attach, apply, status, detach).

Package fakeadapter is a scripted BAP/1 adapter used as a test fixture (plan 9.5; brief section 2.10).

Package fakeregistry is the test double for Claude Code's session registry (plan 9.5, A.3): an fstest.MapFS holding <pid>.json entries in the observed shape, served through the fs.FS the registry reader takes, wrapped in a recorder that FAILS THE TEST when any name ending in .key is opened and records every name that was.

Package fakesock is the fake inbox socket of plan 9.5: a unix-domain server standing in for a Claude Code session's `CLAUDE_CODE_MESSAGING_SOCKET`, so the socket poster (6.7, U-17, U-19, U-20) and later the watcher can be tested against a real socket with no Claude process anywhere near.

Package fakesync is a fake sync adapter for tests of the harness side of the sync-adapter protocol (folder-sync plan §4.3, docs/sync-adapters.md): a POSIX shell script the test writes into its own temp directory and launches as `/bin/sh <script> <verb>` — an argv array, never `sh -c`, and the fresh file is READ by the shell rather than exec'd, which is what macOS's first-exec assessment and Linux's ETXTBSY need (the repository's rule for a script fixture).

Package tscmd holds the custom testscript commands the Brigade scripts use.