internal/

Package cellblueprint resolves daemon-stored CellBlueprint templates into CellDocs for `kuke run -b`.

Package cellconfig holds the identity primitives for a daemon-stored CellConfig (kind: CellConfig, issue #624, phase 4b-i of #423): the back-reference label a materialized cell carries, the deterministic stable-name derivation, and the slot-fill validation that checks a Config's repo/secret fills against the referenced blueprint's declared structural slots.

Package cgroupcheck implements the host-cgroup pre-flight that catches missing or undelegated cgroup-v2 controllers before kukeon's bootstrap path tries (and fails) to enable them.

Package clientconfig loads a kuke ClientConfiguration document from disk.

Package daemon implements the kukeond process: it owns a controller.Exec, exposes the kukeonv1 API over a unix socket using net/rpc + jsonrpc, and manages its own lifecycle (listener, PID file, graceful shutdown).

Package firewall manages host-level iptables state owned by kukeon — the FORWARD admission chain that admits traffic to/from kukeon bridges.

Package instance records the host-instance ServerConfiguration values (containerd namespace suffix and cgroup root) that a given runPath was bootstrapped under, so the daemon can refuse to start when reconfigured to a different layout.

Package kuketeams parses and validates the team-distribution documents (kuketeams.io/v1: ProjectTeam, TeamsConfig, Role, Harness, ImageCatalog; issue #793, epic #792).

Package netpolicy renders space-level egress policies into iptables rules and applies them on the host firewall.

Package serverconfig loads a kukeond ServerConfiguration document from disk.

Package sysuser provisions the kukeon system user/group and applies kukeon-managed file ownership during `kuke init`.

Package teambuild orchestrates the local `kuke team init --build` path: it walks the FROM directives of the catalog entries a project selected, derives the transitive base-before-leaves build order (the bases base/base-user/ base-root are intermediates that live in the agents source tree, not in images.yaml), and invokes the standalone kukebuild binary once per image into the target realm's containerd namespace.

Package teamhost owns the host-side, on-disk lifecycle of the team-distribution config maintained by `kuke team init` (epic #792, step 1 #796): the operator-global facts file (~/.kuke/kuketeams.yaml) and the per-project drop-in directory (~/.kuke/kuketeam.d/<project>.yaml).

Package teamrender renders a project's ProjectTeam roster into a set of CellBlueprint and CellConfig documents — one (CellBlueprint, CellConfig) pair per `(role × harness)` (epic #792, step 3 #1042).

Package teamsecrets composes a team's secret material from two `secrets.env` layers — a shared host-wide default at `~/.kuke/teams/secrets.env` and a per-team override at `<teamDir>/secrets.env` — and renders the merged non-empty entries as `kind: Secret` documents the daemon-side apply pipeline (#1029) consumes alongside the project's CellBlueprints and CellConfigs.

Package teamsource resolves a kuketeams.io/v1 ProjectTeam's structured `source` reference to a local clone of the agents repo and loads the Role, Harness, and ImageCatalog documents the project's roster references (epic #792).