internal/

Package agents is the domain of agent-manager: an agent on the platform is a Flux HelmRelease of the agent chart (one release renders one kagent Agent), sharing a per-namespace OCIRepository that tracks the chart.

Package api exposes the service twice from one process: REST/JSON under /api/v1 for the portal backend, and MCP tools for muster.

Package chart knows the agent chart: where it lives, which version a Flux OCIRepository tracking the configured semver range resolves to right now, and the values.schema.json of that version — the contract every agent's values are validated against before anything is applied.

Package identity carries the authenticated caller through a request: who the OAuth layer validated (subject, email, groups) and, when the server acts on the caller's behalf towards the Kubernetes API, the caller's own IdP token.

Package kube builds the Kubernetes clients agent-manager reads and writes with, and hides them behind an interface so the identity a call runs under is a deployment choice: one shared client authenticated as the pod's ServiceAccount (a server nothing but a trusted proxy can reach), or — with OAuth and downstream OAuth on — a client per caller that presents the caller's own IdP token, so the apiserver authenticates the real user and the user's RBAC decides.

Package server assembles the single HTTP listener: health endpoints, the REST API and the MCP streamable-HTTP endpoint, both behind the same OAuth guard when configured.

Package skills discovers agent skills in git repositories the way the portal backend's /agent-skills endpoint does: every SKILL.md in a GitHub repository is one skill, its frontmatter name and description describe it, and its directory is the kagent spec.skills.gitRefs entry (url + path + ref) an agent mounts.