internal/

Package astaudit derives the USOSS-6 source-claim evidence table from the Go AST of the the source tree, and refuses to report success unless it derived every row the table claims.

Package auth verifies upstream identities and manages identity-bound browser sessions with local admission rechecks and CSRF protection.

Package awscode holds the one declaration of the AWS wire codes this repository classifies as retryable.

Package boundary checks the architectural constraint that makes ConductorOne optional: no package may depend on ConductorOne unless it is explicitly allowed to.

Package citations resolves the file:line citations this repository's Go comments and Markdown documents make, and reports the one class of defect that can be decided mechanically.

Package cli implements user commands over the authenticated HTTP SDK.

Package controlplane owns authenticated application intent and durable deployment operations.

Package credhttp owns the HTTP policy for every request in this repository that carries credential material.

Package decisions checks the structure of the decision record.

Package detect provides advisory repository introspection for the "simple deploy" flow: given a repository's file tree, best-effort locate a Dockerfile, parse its EXPOSE directive to suggest a container port, preview any docker-compose services, and guess which managed database the repository wants.

Package disclosure checks that the module tree publishes no detection vocabulary: no classifier, weakness-catalogue entry, or check identifier naming something a scanner looks for.

Package errhygiene states one invariant, and lets each package obliged to hold it drive that invariant on itself.

Package ghappkey durably stores the admin-managed GitHub App private key in AWS SSM Parameter Store, as a SecureString, and resolves it back.

Package githubapp is the GitHub App plumbing this repository's consumers need: mint an app-level RS256 JWT from an App ID and an RSA private key, exchange it for a scoped installation access token, and list or look up the accounts that have installed the app.

Package hermetic asserts that this repository's CI needs no credentials.

Package httpapi hosts AppHub's same-origin HTTP transports and frontend.

Package logs is the narrow, read-only CloudWatch Logs surface the authenticated API process ("serve") holds directly -- unlike every other AWS capability in this repository, which lives only in the isolated worker.

Package mcpserver exposes the application service through the official MCP transports.

Package oauth implements AppHub's public-client authorization server.

Package reachable answers one question for the redacting types in this repository: what bytes can ordinary reflection get out of a value?

Package secrethandoff moves an application secret value from the API process to the worker through the control-plane table without it ever being stored there in plaintext, using one symmetric KMS key.

Package serverconfig loads operator policy without constructing cloud providers.

Package source acquires one approved repository revision per deployment.

Package testutil provides hermetic test support.

Package worker executes durable deployment operations outside the HTTP process.