internal/

Package addons is the Go port of the addon render pipeline (.lok8s/libs/addons: addons::render) — the SINGLE canonical khelm render shared by the bootstrap engine and the KubeOne driver's pre-apply addon staging.

Package assets ships the framework's first-party files inside the binary and materializes them into a project on first use (the "eject model").

Package audit is the Go port of the argsh static security-posture audit (.lok8s/libs/audit): a linter-style command that reads cluster.lok8s.yaml + the rendered addon/kustomize inputs (exactly like `lo lint` — NO live cluster needed) and reports security findings with a severity, a per-cluster score, and a non-zero exit when any FAIL-level finding is present.

Package bootstrap is the Go port of the framework-level cluster infrastructure addon system (.lok8s/libs/bootstrap, all 1413 lines — bash wins on any divergence).

Package bootstrapspec is the ONE reader of spec.bootstrap entries.

Package build is the Go port of the argsh build pipeline (.lok8s/libs/build): kustomize render of a domain's composed kustomization into one clusters/<domain>/artifacts.yaml, plus the spec-declared split emit into per-resource GitOps files under clusters/<domain>/artifacts/.

Package cli builds the lo command tree.

Package clock holds the wait seam every retry and poll loop sleeps through.

Package config resolves the lok8s project layout and settings.

Package crds is the Go port of .lok8s/libs/crds — operator CRD generation from a single schema source.

Package credentials holds the two guards every driver runs before it talks to a cloud API: the provider credential presence check (bash: utils/credentials.sh, credentials::require) and the HTTPS-only URL check (bash: utils/http.sh, http::require_https).

Package deploy is the Go port of the domain artifact deployment (.lok8s/libs/deploy: deploy::apply / deploy::apply_filtered / deploy::_apply / deploy::wait_crds — bash wins on any divergence; the `lo destroy` half of that file stays with the provision port).

Package domain is the ONE place domain resolution + driver identity live — the Go port of .lok8s/utils/domain.sh, preserving its precedence chain, warnings, and error contract exactly.

Package driver defines the Go driver contract — the port of the bash driver contract (.lok8s/drivers/README.md): every cluster-architecture driver implements provision/destroy/status/kubeconfig, plus the optional export and post-provision hooks.

Package env is the Go port of .lok8s/libs/env — environment and service configuration.

Package execx locates and runs the external tools lo still shells out to.

Package fsutil holds the file-existence predicates the bash `[[ -f ]]`, `[[ -d ]]` and `[[ -e ]]` tests port to.

Package gitops is the Go port of .lok8s/libs/gitops — DEFERRED (post-refactor redesign), exactly like the bash.

Package hooks is the Go port of .lok8s/libs/hooks — dev-time lifecycle actions on rendered artifacts, selected by label.

Package image is the Go port of .lok8s/libs/image — pre-pull private images into the local cache registry.

Package initctx reads the room for a bare `lo init`: where the user stands (a project root, a subdirectory, a service directory, a submodule under an umbrella project, an empty or a bare directory), what git says about it, what the project already has, and whether a terminal is attached.

Package inventory is the Go port of the ClusterInventory writer (.lok8s/libs/inventory/main — bash wins on any divergence).

apply.go — the Go port of kapply::apply and its healing half (.lok8s/utils/kapply.sh): server-side kubectl apply with bounded, interactive-or-opt-in self-healing.

Package kubehz is the Go port of the kubehz platform integration (.lok8s/libs/kubehz/{main,shared,hosted,node,handover,deploy} and the vendored manifests/ tree): the spec.kubehz config reader + validator, the platform-api client (register / deregister / status / assess / re-enroll / claim), the hosted-control-plane flows the kubeone and capi drivers call through their Hooks, Spaces on the shared control plane (hosting: shared — the kubehz driver), the static-pool node verbs, the control-plane handover target side, and the in-cluster agent deploy.

Package lint is the Go port of .lok8s/libs/lint — structure and spec validation.

Package oidc reads spec.oidc from a cluster spec into the LOK8S_SPEC_OIDC_* environment — the Go port of .lok8s/utils/oidc.sh (oidc::enabled / oidc::load_spec).

Package operator is the Go port of the shell-operator hooks (operator/hooks/*.sh, frozen at .archive/legacy/operator/hooks/): the three reconcilers behind `lo operator <hook>`, which the hook shims exec.

Package provision is the Go port of the cluster-lifecycle dispatch (.lok8s/libs/provision): spec resolution, the real-infrastructure gate, provider-credential loading, and the provision/destroy/status dispatch over the driver registry (internal/driver).

Package recover is the Go port of `lo recover <domain>` — rebuild a cluster from bare metal (disaster recovery); .lok8s/libs/recover, bash wins on any divergence.

Package render is the single kustomize entry point for the Go binary.

Package scaffold is the Go port of .lok8s/libs/init — `lo init service` and `lo init test`: scaffold lok8s project/service config from a correct template.

Package secrets is the Go port of .lok8s/libs/secrets — secret cache management with SOPS/age encryption.

Package testutil holds the fixture helpers the package tests share: the repo root (for tests that read the checked-in tree), the mkdir-then-write fixture writer, the drift gate (drift.go) and the golden compare with its -update rewrite.

Package tilt is the Go port of .lok8s/libs/tilt — Tilt lifecycle management (`lo tilt {up,ci,down,status,restart,preflight}`).

Package toolchain owns the consumer toolchain of a lok8s project: the pinned versions of the tools `lo` execs, the .bin/b.yaml template that declares them for b (github.com/fentas/b), the verified bootstrap of b itself, and the doctor checks that verify what landed.

Package ui carries the CLI's output conventions, matching the bash implementation's verbose.sh helpers byte for byte so ported commands stay indistinguishable from their argsh originals.

Package yqsem is the ONE yq-semantics reader over yaml.v3 nodes.