internal/

Package actor names who or what caused something steps records: a person, or the automatic thing that stood in for one.

Package agent runs an agent step's LLM tool-calling conversation: it resolves the agent's model/connection, compiles the step's granted tools, drives the request/tool-execute/append loop (see runAgentConversation), and enforces required: true tools via the provider's tool_choice.

Package blobstore is a content-addressed store for artifact trees on S3.

Package cli implements steps' command-line grammar and every command behind it.

Package compress is the one opinion about zstd this repo holds.

Package config parses and resolves a Concourse-style pipeline YAML file (resource_types/resources/jobs) and the config-merge logic (task and agent-invocation resolution) that both plan-time hashing and run-time execution share.

Package dockerapi talks to a docker engine, and is the only package in this repo that holds an engine client.

Package events is the run-event bus: a stdlib-only leaf that carries what a run is doing, as it does it, from the packages executing a job to whatever is watching.

Package exprlang evaluates the expression form of a resource type's check/in/out — the JSON-over-HTTP alternative to writing those three as shell commands.

Package mcp is the shared MCP (Model Context Protocol) client layer: it connects to a configured mcp_servers: entry (config.MCPServer) over either Streamable HTTP (endpoint:) or a local subprocess speaking newline- delimited JSON on stdin/stdout (command:, see stdio.go), lists its tools, and calls one.

Package merkle plans a job's steps into content-addressed chains and computes the hashes used to skip already-succeeded work.

Package outcome classifies a step's or job's error into the categories the hook system dispatches on: a task-level failure (nonzero exit / red verdict / a required tool that never succeeded), an infrastructure error, or an abort (the job's context was canceled).

Package pipeline orchestrates a job's plan: resolving/fetching get steps, running task/put/agent steps in order, and recording each step's outcome so later runs can skip unchanged work (see internal/merkle).

Package redact masks credentials in text that leaves the process.

Package resource runs a resource type's check/in/out shell commands and selects among the versions a check returns.

Package retry provides a linear-backoff retry loop.

Package runview folds a run's recorded events into the step tree a reader sees.

Package scheduler is the daemon's job-scheduling engine: it drains each held pipeline's durable queue in this process — workers, the --max-runs slots, the circuit breaker, pause, abort, the shutdown grace — and holds the workspace provider each pipeline's runs materialize in.

Package sealbox encrypts the secrets steps keeps in its state database, so a copy of the database without the key is worth nothing.

Package shell runs pipeline-defined commands via `sh -c`, either on the host (HostRunner) or inside a container (DockerRunner, see docker.go).

Package store is the contract steps holds its state database to: the row types every driver returns, the errors every driver raises, and the Store interface every driver implements.

Package telemetry is the one place steps meets the OpenTelemetry SDK, off unless OTEL_* asks: the docker and GCE clients already trace against the global provider, so installing one is all their calls need.

Package template renders Go templates against source/version data.

Package testdocker is a test's docker half of the setup: whether a daemon is reachable, and a directory it can bind-mount.

Package testpostgres runs a real Postgres for tests from embedded-postgres' downloaded binaries, so the Postgres-backed tests need no docker daemon.

Package testsshd is an in-process sshd so worker venues are testable without a network, a credential or a second machine; only OpenSSH's own config surface is missing.

Package treedigest lets a worker with no steps code (busybox only) name a tree exactly as the orchestrator does, so outputs can stay where they were made (steps#206).

Package trigger polls resources named by a get step's trigger: true and runs every job affected by a version change — the cross-job counterpart to internal/pipeline's single-job orchestration.

Package usage is the spend domain: what an agent step reported, the accumulator a job rolls those reports into, and the ceilings measured against it.

Package venue runs a step's commands somewhere other than this machine.

Package web serves the pipeline UI: a read-and-operate view of what the runner has done and is doing, over the same sqlite store the CLI writes.

Package webhook turns one delivery into a version; expressions reach it compiled, so one can build a string but never decide that a signature is valid.

Package wire is the tree codec: a step's directory as a tar stream, packed and unpacked the way every transfer of one agrees on, symlinks kept and never followed, and nothing written outside the tree on the way in.

Package workspace materializes the per-step/per-build filesystem views a job's steps run against: per-step directories, copied (copy-on-write where the filesystem offers it), built from each step's declared inputs/outputs.