Directories
¶
| Path | Synopsis |
|---|---|
|
Package adoscope is the Azure DevOps CAPABILITY CATALOGUE: it names the access an Azure DevOps request needs, classifies one request to exactly one name, and maps a set of those names to the Entra scopes a token must carry.
|
Package adoscope is the Azure DevOps CAPABILITY CATALOGUE: it names the access an Azure DevOps request needs, classifies one request to exactly one name, and maps a set of those names to the Entra scopes a token must carry. |
|
Access / role-mapping CRUD (Phase 2 lane A, migration 0051): the console's Getting Started -> People editor over the store half of internal/auth/oidc's RoleMappingSource.
|
Access / role-mapping CRUD (Phase 2 lane A, migration 0051): the console's Getting Started -> People editor over the store half of internal/auth/oidc's RoleMappingSource. |
|
Package approval implements the ApprovalRequest FSM service.
|
Package approval implements the ApprovalRequest FSM service. |
|
Package audit defines the append-only audit contract.
|
Package audit defines the append-only audit contract. |
|
sinks
Package sinks provides production audit.Sink implementations (syslog, webhook, file) plus a Fanout multiplexer and config wiring.
|
Package sinks provides production audit.Sink implementations (syslog, webhook, file) plus a Fanout multiplexer and config wiring. |
|
auth
|
|
|
oidc
derive.go holds the IDENTITY-DERIVATION seam: everything that turns an ID token's claims into what a Wardyn session carries about WHO this human is — their role (deriveRole, Config.RoleMap, the legacy operator allowlist) and their group snapshot (sessionGroups, the subject a capability grant matches).
|
derive.go holds the IDENTITY-DERIVATION seam: everything that turns an ID token's claims into what a Wardyn session carries about WHO this human is — their role (deriveRole, Config.RoleMap, the legacy operator allowlist) and their group snapshot (sessionGroups, the subject a capability grant matches). |
|
Package broker implements Wardyn's token broker: the ONLY component that holds long-lived secrets and the sole issuer of short-lived run credentials.
|
Package broker implements Wardyn's token broker: the ONLY component that holds long-lived secrets and the sole issuer of short-lived run credentials. |
|
Package cliutil holds tiny env/flag helpers shared by Wardyn's cmd/* main packages (each cmd is its own `main` package, so these can't just live in one of them without the others importing "main"), plus ScrubChildEnv, the one env denylist shared by every host-exec'd third-party CLI child.
|
Package cliutil holds tiny env/flag helpers shared by Wardyn's cmd/* main packages (each cmd is its own `main` package, so these can't just live in one of them without the others importing "main"), plus ScrubChildEnv, the one env denylist shared by every host-exec'd third-party CLI child. |
|
Package component provides the shared registry that backs Wardyn's pluggable component seams: identity provider, secret store, recording store, and the confinement substrate.
|
Package component provides the shared registry that backs Wardyn's pluggable component seams: identity provider, secret store, recording store, and the confinement substrate. |
|
THE comparator for "which ceiling grant bounds this proposed grant".
|
THE comparator for "which ceiling grant bounds this proposed grant". |
|
Package contentscan implements Wardyn's OPTIONAL, off-by-default outbound content-inspection layer ("egress content inspection" / inadvertent-leak guardrail).
|
Package contentscan implements Wardyn's OPTIONAL, off-by-default outbound content-inspection layer ("egress content inspection" / inadvertent-leak guardrail). |
|
Package db provides Postgres connection bootstrapping and schema migration for the Wardyn control plane.
|
Package db provides Postgres connection bootstrapping and schema migration for the Wardyn control plane. |
|
Package directory turns what an admin TYPES into what Wardyn STORES.
|
Package directory turns what an admin TYPES into what Wardyn STORES. |
|
Package egress defines the L2 proxy decision model shared by cmd/wardyn-proxy and the control plane's policy/approval wiring.
|
Package egress defines the L2 proxy decision model shared by cmd/wardyn-proxy and the control plane's policy/approval wiring. |
|
evaluatortest
Package evaluatortest provides a reusable conformance suite for any egress.Evaluator implementation, so the blessed default (builtin) and a future alternate (OPA/Cedar) are held to the identical policy-verdict contract.
|
Package evaluatortest provides a reusable conformance suite for any egress.Evaluator implementation, so the blessed default (builtin) and a future alternate (OPA/Cedar) are held to the identical policy-verdict contract. |
|
proxy
Package proxy implements the L2 per-workspace egress sidecar (wardyn-proxy): an HTTP forward proxy that enforces the internal/egress decision model (default-deny domain allowlist, method rules, first-use approval), streams decision logs, and injects credentials proxy-side.
|
Package proxy implements the L2 per-workspace egress sidecar (wardyn-proxy): an HTTP forward proxy that enforces the internal/egress decision model (default-deny domain allowlist, method rules, first-use approval), streams decision logs, and injects credentials proxy-side. |
|
Package gitremote deterministically detects the git remotes configured in a local directory tree, so Wardyn can ground a composed run's GitHub grant on the workspace's ACTUAL remotes rather than an LLM guess.
|
Package gitremote deterministically detects the git remotes configured in a local directory tree, so Wardyn can ground a composed run's GitHub grant on the workspace's ACTUAL remotes rather than an LLM guess. |
|
Package groundtruth maps kernel-level observations (from an eBPF sensor — specifically Tetragon) into Wardyn's append-only audit vocabulary (types.AuditEvent).
|
Package groundtruth maps kernel-level observations (from an eBPF sensor — specifically Tetragon) into Wardyn's append-only audit vocabulary (types.AuditEvent). |
|
Package hoptls is the TLS on the hop between wardynd and each run's wardyn-proxy: the hop the proxy resolves credential VALUES over (GET /api/v1/internal/injection/{grant}), and every other internal call it makes (mints, token renewal, decisions, approvals, uploads).
|
Package hoptls is the TLS on the hop between wardynd and each run's wardyn-proxy: the hop the proxy resolves credential VALUES over (GET /api/v1/internal/injection/{grant}), and every other internal call it makes (mints, token renewal, decisions, approvals, uploads). |
|
Package hostrules holds the host-shape rules and artifact-registry tables the RUNTIME governance paths depend on — approval write-back, egress substitution, site-config validation and the artifact-redirect emitter.
|
Package hostrules holds the host-shape rules and artifact-registry tables the RUNTIME governance paths depend on — approval write-back, egress substitution, site-config validation and the artifact-redirect emitter. |
|
Package identity defines the per-run workload identity contract.
|
Package identity defines the per-run workload identity contract. |
|
embedded
Package embedded implements the default, SPIFFE-shaped JWT-SVID identity provider satisfying identity.Provider.
|
Package embedded implements the default, SPIFFE-shaped JWT-SVID identity provider satisfying identity.Provider. |
|
identitytest
Package identitytest provides a reusable conformance suite for any identity.Provider implementation, so the blessed default (embedded) and a future alternate (SPIRE) are held to the identical security contract.
|
Package identitytest provides a reusable conformance suite for any identity.Provider implementation, so the blessed default (embedded) and a future alternate (SPIRE) are held to the identical security contract. |
|
Package ipguard holds the SSRF private/reserved membership test shared by the egress proxy's policy guard (internal/egress/proxy) and the composer transport guard (internal/composer/backends/transport).
|
Package ipguard holds the SSRF private/reserved membership test shared by the egress proxy's policy guard (internal/egress/proxy) and the composer transport guard (internal/composer/backends/transport). |
|
Package lifecycle implements workspace lifecycle automation: the Reaper loop finds RUNNING agent runs that have been idle past their policy's AutoStopAfterSec threshold and stops them, emitting a "run.autostop" audit event for each.
|
Package lifecycle implements workspace lifecycle automation: the Reaper loop finds RUNNING agent runs that have been idle past their policy's AutoStopAfterSec threshold and stops them, emitting a "run.autostop" audit event for each. |
|
Package recording provides storage and HTTP serving of asciicast session recordings produced by wardyn-rec.
|
Package recording provides storage and HTTP serving of asciicast session recordings produced by wardyn-rec. |
|
recordingtest
Package recordingtest provides a reusable conformance suite for any recording.Store implementation.
|
Package recordingtest provides a reusable conformance suite for any recording.Store implementation. |
|
Package recordmode is the deterministic core of Wardyn's "Recording Mode": it OBSERVES what a fully-open (allow-all-egress, broad-grant) run actually used — purely from already-captured audit events — and SYNTHESIZES a tightened, least-privilege RunPolicySpec the operator can review and promote.
|
Package recordmode is the deterministic core of Wardyn's "Recording Mode": it OBSERVES what a fully-open (allow-all-egress, broad-grant) run actually used — purely from already-captured audit events — and SYNTHESIZES a tightened, least-privilege RunPolicySpec the operator can review and promote. |
|
Package runner defines the target-agnostic sandbox lifecycle contract.
|
Package runner defines the target-agnostic sandbox lifecycle contract. |
|
orchestrator
Package orchestrator is the build-tag-free runner.Runner the control plane talks to.
|
Package orchestrator is the build-tag-free runner.Runner the control plane talks to. |
|
substrate
Package substrate defines the confinement-substrate sub-interface: the seam beneath the runner.Runner surface that lets a non-OCI microVM VMM (SmolVM, Firecracker, …) back a Confinement Class alongside the OCI/Docker substrate, without the control plane (or each substrate) re-implementing the runner contract.
|
Package substrate defines the confinement-substrate sub-interface: the seam beneath the runner.Runner surface that lets a non-OCI microVM VMM (SmolVM, Firecracker, …) back a Confinement Class alongside the OCI/Docker substrate, without the control plane (or each substrate) re-implementing the runner contract. |
|
Package secretmask implements Wardyn's output-masking layer for PTY capture and asciicast streams.
|
Package secretmask implements Wardyn's output-masking layer for PTY capture and asciicast streams. |
|
Package secretstore defines the at-rest secret storage contract.
|
Package secretstore defines the at-rest secret storage contract. |
|
kek
Package kek holds the key-encryption keys that wrap each stored credential's data key (DEK), and the envelope framing both layers share (credential-storage design §2.2, "The row (envelope v1)").
|
Package kek holds the key-encryption keys that wrap each stored credential's data key (DEK), and the envelope framing both layers share (credential-storage design §2.2, "The row (envelope v1)"). |
|
pg
Package pg implements secretstore.Store over the Postgres `secrets` table, one envelope-encrypted row per credential (credential-storage design §2.2, envelope v1): every Put mints a fresh 32-byte data key (DEK), seals the value under it with AES-256-GCM bound to the row's (owned_by, name), and stores the DEK wrapped by a key-encryption key (package kek).
|
Package pg implements secretstore.Store over the Postgres `secrets` table, one envelope-encrypted row per credential (credential-storage design §2.2, envelope v1): every Put mints a fresh 32-byte data key (DEK), seals the value under it with AES-256-GCM bound to the row's (owned_by, name), and stores the DEK wrapped by a key-encryption key (package kek). |
|
secretstoretest
Package secretstoretest provides a reusable conformance suite for any secretstore.Store implementation.
|
Package secretstoretest provides a reusable conformance suite for any secretstore.Store implementation. |
|
Package setup provides host-environment detection for the first-run setup surface (GET /api/v1/setup/status): which resident coding-agent CLIs are present, and the OS/WSL posture the environment-step copy keys off.
|
Package setup provides host-environment detection for the first-run setup surface (GET /api/v1/setup/status): which resident coding-agent CLIs are present, and the OS/WSL posture the environment-step copy keys off. |
|
Package sidecar holds the small brokered-PUT plumbing shared by Wardyn's in-sandbox result-uploader binaries (wardyn-scan, wardyn-aws-sso): validate WARDYN_PROXY_URL/WARDYN_RUN_ID, build the brokered result URL, and PUT a JSON body.
|
Package sidecar holds the small brokered-PUT plumbing shared by Wardyn's in-sandbox result-uploader binaries (wardyn-scan, wardyn-aws-sso): validate WARDYN_PROXY_URL/WARDYN_RUN_ID, build the brokered result URL, and PUT a JSON body. |
|
Governance profiles and their subject assignments (migration 0052).
|
Governance profiles and their subject assignments (migration 0052). |
|
Package subscription yields the operator's LIVE Anthropic subscription OAuth access token from the resident ~/.claude credentials, so the egress proxy can inject a fresh token per request instead of the sandbox holding a COPY that goes stale (access-token expiry + refresh-token rotation lock the copy out).
|
Package subscription yields the operator's LIVE Anthropic subscription OAuth access token from the resident ~/.claude credentials, so the egress proxy can inject a fresh token per request instead of the sandbox holding a COPY that goes stale (access-token expiry + refresh-token rotation lock the copy out). |
|
Package testlive is the opt-in live-local harness: tests that reach the owner's real identity provider, Azure DevOps organisation and AWS account.
|
Package testlive is the opt-in live-local harness: tests that reach the owner's real identity provider, Azure DevOps organisation and AWS account. |
|
Governance profiles (migration 0052): the wire + store types for an ASSIGNABLE ceiling and the row that binds one to a subject.
|
Governance profiles (migration 0052): the wire + store types for an ASSIGNABLE ceiling and the row that binds one to a subject. |
|
Package version holds Wardyn's ONE shipped version string.
|
Package version holds Wardyn's ONE shipped version string. |
|
Package workspacescan deterministically detects a local directory's (or a cloned repo's) development conventions — languages, package managers, implied egress registries, dev-container/Dockerfile presence, tools, and git remotes — so Wardyn can onboard a workspace with a profile grounded in what's ACTUALLY in the tree, not an LLM guess.
|
Package workspacescan deterministically detects a local directory's (or a cloned repo's) development conventions — languages, package managers, implied egress registries, dev-container/Dockerfile presence, tools, and git remotes — so Wardyn can onboard a workspace with a profile grounded in what's ACTUALLY in the tree, not an LLM guess. |
Click to show internal directories.
Click to hide internal directories.