internal/

Package control is the harness side of the control channel: it hosts the local listener the governed server's servant dials, authenticates the first message against the bootstrap token, negotiates a protocol version, and then dispatches envelopes.

Package enforce is the harness's refusal seam: it sits on the proxy's interception hook, decides each decidable client request against the policy engine, and — on a denial — synthesizes the refusal in the exact shape the method requires, so the governed server never sees a request the harness refused.

Package harness orchestrates one governed session: it hosts the control channel, spawns the governed server as a child with the bootstrap environment, pumps the MCP stdio streams through the proxy, records and fingerprints the conversation through the observer, and supervises the pieces until the session ends.

Package inject adds the harness's own tools to the proxied manifest and answers their calls, for a session where the governed server has shed its GuardrailStatus/Kill tools (enforce mode).

Package observe is the harness's read-only view of the proxied MCP conversation.

Package proxy is the MCP stdio pump: it sits between an MCP client and the governed server, forwarding newline-delimited JSON-RPC frames byte-for-byte while observing them, and giving the harness two abilities the transport alone would not: injecting its own requests toward the server (with their responses routed out of band, never to the client) and — in later phases — replacing a frame with a synthesized refusal.