services/

Package api serves the platform runtime API (pkg/runtimeapi): /v1/* for seats, /internal/v1/* for the controller, the optional read-only /console/v1/* for the console, health and metrics.

Package auth authenticates the platform's callers (§13.2).

Package connections builds and supervises connector adapters for every declared connection (§10).

Package credentials delivers explicitly sandbox-authorized credentials.

Package egress is the egress gateway: an HTTP proxy that lets seats reach the hosts their access profiles allow, and nothing else (docs/sandbox.html).

Package gateway is the capability gateway and operation ledger for work-tracker connections (§10.1, §10.3, contracts.md "Gateway and operation ledger").

Package ingress accepts verified inbound human events (§9.1, §9.2).

Package metrics defines the platform's Prometheus metrics (§14).

Package outbox delivers representatives' replies to humans through the communication adapter (§9.2).

Package platform assembles the trusted platform service: the runtime API, connection manager with ingress loops, outbox dispatcher and background scheduler (§3, §13).

Package policy evaluates a seat's committed capability manifest.

Package publisher projects work items to a tracker for people to follow (work_publication).

Package representative exposes a deliberately small MCP interface to an external agent.

Package retirement completes graceful seat retirement (§5.5).

Package scheduler runs the platform's durable background work: running due automations (§9.3), returning expired delivery leases to the queue, recording interrupted connector attempts as unknown, and refreshing the operational gauges (§14).

Package store is the platform's durable operational store on PostgreSQL (design §13.1).

Package tools implements the seat tool surface (contracts.md "Tools").