internal/

Package agent contains the worker-side logic that runs inside the task container: building the user process command, injecting XCom inputs, reading the return value, and retry backoff.

Package agentrpc implements the control-plane side of the agent gRPC protocol: it authenticates each in-pod agent by its per-task-instance token, serves the task specification, and records the state transitions the agent reports.

Package alerts sends native on-failure notifications (#424).

Package api implements the Airflow-compatible HTTP control plane (ADR 0007).

Package auth provides JWT authentication, password hashing, the RBAC permission model, and login rate limiting for the control plane (ADR 0008).

Package build produces the container image of a DAG project and reports what it pushed.

Package cioidc verifies the OIDC tokens CI providers mint for their jobs (GitHub Actions, GitLab CI, Google Cloud Build), so a pipeline deploys without a stored credential (ADR 0092, #1882).

Package cli implements the dexaflow command-line interface.

Package config loads Dexaflow configuration from defaults, an optional config file, and LEOFLOW_* environment variables, with flags taking precedence.

Package connectors is the single source of truth for the Airflow connector types Dexaflow knows about.

Package dbt renders a dbt project's manifest.json into Dexaflow tasks (ADR 0042).

Package dispatch launches pod-path task instances: it resolves a task's execution context, mints the agent's identity token, and routes the request to the executor.

Package domain defines the core Dexaflow types (DAG, Task, project config) and validates them against the canonical JSON Schemas in docs/api.

Package egress guards outbound HTTP requests whose destination comes from tenant-controlled data, such as an alert connection's webhook URL.

Package envcompat keeps the pre-rename LEOFLOW_* environment variables and their DEXAFLOW_* names interchangeable.

Package executor runs task instances via Kubernetes, Docker, or a subprocess.

Package failurealert adapts a DAG's on-failure alert rules (#424) to the scheduler's Alerter seam: it resolves each rule's managed connection to an endpoint URL, renders the message, and sends it via the alerts notifier — best-effort, so a delivery failure is logged and never fails the run.

Package gatedtick runs the control plane's periodic background cycles: a ticker gated on scheduler leadership (the pod reconciler, the staging GC, the warm-pool reconcile, the retention janitor), the leader-bounded context one cycle of such a loop runs under, and the panic isolation every periodic loop shares.

Package issuer verifies tokens from a trusted external issuer, so a platform that already authenticates its users can open a Dexaflow UI session for them without holding Dexaflow's own signing secret (#1284).

Package kubeexchange implements the Kubernetes-backed half of the agent token-exchange transport (ADR 0055 Fix #3): validating a pod's projected ServiceAccount token via the apiserver TokenReview API, and resolving the reviewed pod to the task-instance identity the control plane stamped on it.

Package logs ships task logs from the agent to durable storage and serves them back via the API, so logs remain available after the task pod is gone.

Package mcp is the Dexaflow Model Context Protocol server (ADR 0050).

Package migrator applies the Dexaflow SQL migrations with golang-migrate over pgx v5 and turns the driver's errors into messages that name the cause, the remedy and the chart value involved (#1020).

Package observability wires structured logging, Prometheus metrics, and OpenTelemetry tracing for the Dexaflow control plane (ADR 0010).

Package oidc implements the OIDC/SSO login flow: the Authorization Code + PKCE redirect, keyless ID-token verification against the issuer's public JWKS, fail-closed tenant pinning, and group→role mapping.

Package procgroup records and probes the process group a Lite agent runs its user task in.

Package retention deletes metadata rows past an operator-configured age.

Package scheduler implements the Dexaflow scheduling state machine and loop.

Package secrets encrypts sensitive values (e.g.

Package setup implements host detection and bootstrap for `dexaflow setup` and `dexaflow doctor`: it determines the platform, which dependencies are present, and which operating tier is achievable, preferring relocatable downloads into ~/.dexaflow over system package managers.

Package storage wraps the Postgres and Redis connections used by the control plane, exposing the sqlc-generated query set and health checks.

Package storeerr classifies the errors the control plane's stores (Postgres and Redis) return, so a caller can tell an outage that a retry outlasts from a failure that repeats on every attempt.

Package taskoutcome defines the durable task-outcome record the agent writes to its container termination message before delivering the report, and the reconciler reads back as the source of truth over pod phase (ADR 0052).

Package ui embeds and serves the pinned Apache Airflow React SPA bundle (AIRFLOW_UI_VERSION in the Makefile, recorded in assets/VERSION).

Package version exposes build metadata embedded into the binary at link time.

Package workspace provides a filesystem confined to a single root directory.

Package xcom implements the Dexaflow XCom subsystem: small typed payloads passed between tasks, stored in Redis with a hard size limit and a TTL, with metadata indexed in Postgres for retrieval (ADR 0006).