pkg/

Package cache stores scan results keyed by content hash so unchanged targets are not re-scanned.

Package engine orchestrates a run: it expands a Saga into scan jobs (controllers × components), executes them with bounded parallelism, and aggregates each control's results.

Package norn evaluates scan results against policy to produce a verdict (pass/fail) per control and overall.

Package plugin is the Draugr plugin SDK.

Package saga defines the Draugr descriptor ("Saga") — the declarative account of an application's security surface (repositories, images, hosts, infrastructure) plus the controller configuration that drives a scan.

Package sarif provides Draugr's result currency: a pragmatic model of SARIF 2.1.0 findings, plus merge and deduplication.

Package skald renders scan results and verdicts into evidence: a JSON summary and merged SARIF.

Package surveyor is the Raven framework: discovery plugins that inspect an environment and return Saga fragments, which are merged so the descriptor can write itself.

Package tooladapter turns an external command-line security tool into a Draugr Scanner declaratively: describe how to build the command for a target, and the adapter runs it and parses its SARIF output.