internal/

Package agents is the domain of agent-manager: an agent on the platform is a Flux HelmRelease of the Generic agent chart (1.x) — one release renders one kagent.dev/v1alpha3 AgentTemplate plus the agent's own muster RemoteMCPServer, the toolset carrier — sharing a per-namespace OCIRepository that tracks the chart.

Package api exposes the service twice from one process: REST/JSON under /api/v1 for the portal backend, and MCP tools for muster.

Package buildinfo resolves the version agent-manager reports: what the build stamped with -ldflags -X when it did, else what the Go toolchain recorded from version control — the tag at HEAD as the module version, the commit and its time — so a binary built from a tagged checkout names its release without a build flag.

Package chart knows the agent chart: where it lives, which version a Flux OCIRepository tracking the configured semver range resolves to right now, and the values.schema.json of that version — the contract every agent's values are validated against before anything is applied.

Package identity carries the authenticated caller through a request: who the OAuth layer validated (subject, email, groups) and, when the server acts on the caller's behalf towards the Kubernetes API, the caller's own IdP token.

Package kube builds the Kubernetes clients agent-manager reads and writes with, and hides them behind an interface so the identity a call runs under is a deployment choice: one shared client authenticated as the pod's ServiceAccount (a server nothing but a trusted proxy can reach), or — with OAuth and downstream OAuth on — a client per caller that presents the caller's own IdP token, so the apiserver authenticates the real user and the user's RBAC decides.

Package migrate is the `agent-manager migrate` command: the expand–contract migration of an installation's agents from Generic chart 0.x releases (kagent.dev/v1alpha2 Agent) to Generic chart 1.x releases (kagent.dev/v1alpha3 AgentTemplate).

Package oci is the minimal OCI distribution client agent-manager needs: anonymous pulls with the registry's bearer-token challenge (RFC 6750 style Www-Authenticate), the tag list of a repository, one file out of a Helm chart archive, and the digest a tag resolves to — the way Flux's source-controller reads the agent chart, and the way a tagged skill image is pinned to the digest kagent requires.

Package server assembles the single HTTP listener: health endpoints, the REST API and the MCP streamable-HTTP endpoint, both behind the same OAuth guard when configured.

Package skills discovers agent skills in git repositories the way the portal backend's /agent-skills endpoint does: every SKILL.md in a GitHub repository is one skill, its frontmatter name and description describe it, and its directory is the skill an agent mounts (url + path).