internal/

Package sandbox holds the container boundary kibble executes inside: the hardening flags every run carries, the metadata hostnames it closes, and the plumbing that names, reaches, and tears down containers.

Package verdict holds kibble's outcome taxonomy: the statuses a check can reach, the coarse buckets they roll up into, and the machine-readable reasons behind the ones that need explaining.