Directories
¶
| Path | Synopsis |
|---|---|
|
cmd
|
|
|
acceptance-guard-preflight
command
Command acceptance-guard-preflight is the activation entry point for internal/acceptanceharness's ambient-credential guard: run it before any acceptance suite starts (see mise.toml's test-acceptance-fast task).
|
Command acceptance-guard-preflight is the activation entry point for internal/acceptanceharness's ambient-credential guard: run it before any acceptance suite starts (see mise.toml's test-acceptance-fast task). |
|
acceptance-style-guard
command
Command acceptance-style-guard fails if any acceptance_test.go or *_acceptance_test.go under the module root does not import github.com/onsi/ginkgo/v2 and reference a Ginkgo suite/spec API, except an explicit allowlist (see internal/acceptancestyle).
|
Command acceptance-style-guard fails if any acceptance_test.go or *_acceptance_test.go under the module root does not import github.com/onsi/ginkgo/v2 and reference a Ginkgo suite/spec API, except an explicit allowlist (see internal/acceptancestyle). |
|
coach
command
Command coach is the composition-root CLI for the coach project.
|
Command coach is the composition-root CLI for the coach project. |
|
coach-api
command
Command coach-api is the composition-root HTTP service for the coach platform: it wires internal/authn (Coach JWT auth, optional GitHub OAuth login, config-gated test mint) and internal/coachapi (POST /v1/jobs, GET /v1/jobs/{id}, GET /v1/jobs/{id}/report) behind a live authz.RepoAuthorizer and a Redis Streams queue.TaskQueue into one runnable server.
|
Command coach-api is the composition-root HTTP service for the coach platform: it wires internal/authn (Coach JWT auth, optional GitHub OAuth login, config-gated test mint) and internal/coachapi (POST /v1/jobs, GET /v1/jobs/{id}, GET /v1/jobs/{id}/report) behind a live authz.RepoAuthorizer and a Redis Streams queue.TaskQueue into one runnable server. |
|
coach-worker
command
Command coach-worker claims work through queue.TaskQueue, persists claim/heartbeat/fenced writes via coachapi.WorkerJobStore, and runs the repo_baseline_scan handler.
|
Command coach-worker claims work through queue.TaskQueue, persists claim/heartbeat/fenced writes via coachapi.WorkerJobStore, and runs the repo_baseline_scan handler. |
|
codesignal-report
command
Command codesignal-report reads a batch of NDJSON lines from stdin, accumulates a single codesignal.Input, and writes exactly one JSON codesignal.Report to stdout.
|
Command codesignal-report reads a batch of NDJSON lines from stdin, accumulates a single codesignal.Input, and writes exactly one JSON codesignal.Report to stdout. |
|
fakegithub-server
command
Command fakegithub-server runs internal/fakegithub as a standalone HTTP process, packaging the issue #79 Task 0.3 thin-offline-proof fixture (internal/acceptanceharness/thinproof) as an internal-network Compose service rather than an in-process httptest.Server.
|
Command fakegithub-server runs internal/fakegithub as a standalone HTTP process, packaging the issue #79 Task 0.3 thin-offline-proof fixture (internal/acceptanceharness/thinproof) as an internal-network Compose service rather than an in-process httptest.Server. |
|
model-stub
command
Command model-stub serves the compose OpenAI-compatible HTTP stub from internal/modelgateway so core smoke can exercise worker → Envoy AI Gateway → backend without model weights.
|
Command model-stub serves the compose OpenAI-compatible HTTP stub from internal/modelgateway so core smoke can exercise worker → Envoy AI Gateway → backend without model weights. |
|
platform-smoke
command
Command platform-smoke is the end-to-end credential-free smoke for the local platform compose stack (Baseline Scan Story 4 / Task 10): mint → submit repo_baseline_scan → poll → assert provenance-tagged report.
|
Command platform-smoke is the end-to-end credential-free smoke for the local platform compose stack (Baseline Scan Story 4 / Task 10): mint → submit repo_baseline_scan → poll → assert provenance-tagged report. |
|
semantics-json
command
Command semantics-json exposes internal/jsbridge as a long-running newline-delimited-JSON server on stdin/stdout, so non-Go hosts (the js/semantics package) can call pkg/semantics without linking CGO themselves.
|
Command semantics-json exposes internal/jsbridge as a long-running newline-delimited-JSON server on stdin/stdout, so non-Go hosts (the js/semantics package) can call pkg/semantics without linking CGO themselves. |
|
semantics-wasm-smoke
command
Stub entry point so `go build ./...` / `go vet ./...` on native platforms don't fail with "build constraints exclude all Go files".
|
Stub entry point so `go build ./...` / `go vet ./...` on native platforms don't fail with "build constraints exclude all Go files". |
|
source-layout-guard
command
Command source-layout-guard fails if any Go file under the module root is named, or declares identifiers named, by position or hash rather than by responsibility (see internal/sourcelayout and ADR-007).
|
Command source-layout-guard fails if any Go file under the module root is named, or declares identifiers named, by position or hash rather than by responsibility (see internal/sourcelayout and ADR-007). |
|
thinproof-preflight
command
Command thinproof-preflight is the no-pull/offline Compose preflight for issue #79's Task 0.3 thin offline proof (see docs/architecture/acceptance-harness.md section 2's binding contract): it checks, via `docker image inspect`, that the two local images deploy/compose/thinproof's docker-compose.yml expects already exist, before any `docker compose up` runs.
|
Command thinproof-preflight is the no-pull/offline Compose preflight for issue #79's Task 0.3 thin offline proof (see docs/architecture/acceptance-harness.md section 2's binding contract): it checks, via `docker image inspect`, that the two local images deploy/compose/thinproof's docker-compose.yml expects already exist, before any `docker compose up` runs. |
|
thinproof-runner
command
Command thinproof-runner is the external test-runner container for issue #79's Task 0.3 thin offline proof: it exercises the fake-GitHub -> pkg/githubingest -> pkg/semantics -> pkg/codesignal path against a fake GitHub service reachable only at FAKE_GITHUB_BASE_URL (e.g.
|
Command thinproof-runner is the external test-runner container for issue #79's Task 0.3 thin offline proof: it exercises the fake-GitHub -> pkg/githubingest -> pkg/semantics -> pkg/codesignal path against a fake GitHub service reachable only at FAKE_GITHUB_BASE_URL (e.g. |
|
deploy
|
|
|
internal
|
|
|
acceptanceharness
Package acceptanceharness provides the offline acceptance-test guard rails for Feature Zero (GitHub issue #76, epic #73): an ambient-credential scanner that flags leaked-in, CI-style GitHub/AWS credentials before an acceptance suite runs, and a no-egress http.RoundTripper that makes an accidental public network call (e.g.
|
Package acceptanceharness provides the offline acceptance-test guard rails for Feature Zero (GitHub issue #76, epic #73): an ambient-credential scanner that flags leaked-in, CI-style GitHub/AWS credentials before an acceptance suite runs, and a no-egress http.RoundTripper that makes an accidental public network call (e.g. |
|
acceptanceharness/agentloopharness
Package agentloopharness defines test/harness seams that a later epic's internal/agentloop package will import from its own tests: a scripted model-gateway stand-in (ScriptedGateway) and a recording tool-call broker (RecordingToolRegistry).
|
Package agentloopharness defines test/harness seams that a later epic's internal/agentloop package will import from its own tests: a scripted model-gateway stand-in (ScriptedGateway) and a recording tool-call broker (RecordingToolRegistry). |
|
acceptanceharness/queueconformance
Package queueconformance defines a black-box behavioral contract for the eventual TaskQueue port described by ADR-006, and a reusable conformance suite (Run) that exercises any Queue implementation against it.
|
Package queueconformance defines a black-box behavioral contract for the eventual TaskQueue port described by ADR-006, and a reusable conformance suite (Run) that exercises any Queue implementation against it. |
|
acceptanceharness/thinproof
Package thinproof is the shared, data-as-code fixture for GitHub issue #79's Task 0.3 thin offline proof: a single small file, at a fixed owner/repo/ref/path, served by internal/fakegithub and read back through pkg/githubingest's public GitHubFileReader API.
|
Package thinproof is the shared, data-as-code fixture for GitHub issue #79's Task 0.3 thin offline proof: a single small file, at a fixed owner/repo/ref/path, served by internal/fakegithub and read back through pkg/githubingest's public GitHubFileReader API. |
|
acceptancestyle
Package acceptancestyle mechanically checks that every acceptance_test.go and *_acceptance_test.go imports github.com/onsi/ginkgo/v2 and references a Ginkgo suite/spec API (RunSpecs, Describe, It, …), except an explicit allowlist.
|
Package acceptancestyle mechanically checks that every acceptance_test.go and *_acceptance_test.go imports github.com/onsi/ginkgo/v2 and references a Ginkgo suite/spec API (RunSpecs, Describe, It, …), except an explicit allowlist. |
|
agentloop
Package agentloop is a bounded tool-call broker over a typed registry (ADR-005).
|
Package agentloop is a bounded tool-call broker over a typed registry (ADR-005). |
|
authn
Package authn implements Coach-signed JWT issue, validation, jti denylist revocation, HTTP auth middleware, optional GitHub OAuth App login (no scope), and a config-gated test-mint path for protected /v1 routes (ADR-001).
|
Package authn implements Coach-signed JWT issue, validation, jti denylist revocation, HTTP auth middleware, optional GitHub OAuth App login (no scope), and a config-gated test-mint path for protected /v1 routes (ADR-001). |
|
authz
Package authz implements ADR-003's synchronous, submit-time repository authorization check: a principal may submit a scan of owner/repo only if the Coach GitHub App installation can read the repository and the principal has a GitHub-recognized role in it.
|
Package authz implements ADR-003's synchronous, submit-time repository authorization check: a principal may submit a scan of owner/repo only if the Coach GitHub App installation can read the repository and the principal has a GitHub-recognized role in it. |
|
coachapi
Package coachapi is the coach platform's job domain: job, finding, and report types; the stable API contract (error codes and envelope); the authenticated Principal; and the JobStore and WorkerJobStore persistence ports.
|
Package coachapi is the coach platform's job domain: job, finding, and report types; the stable API contract (error codes and envelope); the authenticated Principal; and the JobStore and WorkerJobStore persistence ports. |
|
coachapi/baseline
Package baseline runs one repo_baseline_scan job attempt: it resolves and reads the repository tree (GitHub Contents API, or the operator-configured smoke fixture), analyzes it through agentloop tools into deterministic findings, then judges hidden-mutation and change-cohesion findings with rubric tools, persisting rows through a fenced JobWriter as it goes.
|
Package baseline runs one repo_baseline_scan job attempt: it resolves and reads the repository tree (GitHub Contents API, or the operator-configured smoke fixture), analyzes it through agentloop tools into deterministic findings, then judges hidden-mutation and change-cohesion findings with rubric tools, persisting rows through a fenced JobWriter as it goes. |
|
coachapi/httpapi
Package httpapi serves POST /v1/jobs, GET /v1/jobs/{id}, and GET /v1/jobs/{id}/report over a coachapi.JobStore, an authz.RepoAuthorizer, and a queue.TaskQueue.
|
Package httpapi serves POST /v1/jobs, GET /v1/jobs/{id}, and GET /v1/jobs/{id}/report over a coachapi.JobStore, an authz.RepoAuthorizer, and a queue.TaskQueue. |
|
coachapi/queue
Package queue defines the application-owned TaskQueue and EventBus ports required by ADR-006 (docs/architecture/ADR-006-watermill-queue-abstraction.md): coach-api and coach-worker depend only on these interfaces, never on Watermill or a specific broker's types, so the backend (Redis Streams, SQS, ...) can be swapped without touching domain code.
|
Package queue defines the application-owned TaskQueue and EventBus ports required by ADR-006 (docs/architecture/ADR-006-watermill-queue-abstraction.md): coach-api and coach-worker depend only on these interfaces, never on Watermill or a specific broker's types, so the backend (Redis Streams, SQS, ...) can be swapped without touching domain code. |
|
coachapi/queue/redisstream
Package redisstream implements the internal/coachapi/queue.TaskQueue port (ADR-006, docs/architecture/ADR-006-watermill-queue-abstraction.md) on top of Watermill's Redis Streams pub/sub (github.com/ThreeDotsLabs/watermill-redisstream), for coach's non-AWS / self-hosted deployment target.
|
Package redisstream implements the internal/coachapi/queue.TaskQueue port (ADR-006, docs/architecture/ADR-006-watermill-queue-abstraction.md) on top of Watermill's Redis Streams pub/sub (github.com/ThreeDotsLabs/watermill-redisstream), for coach's non-AWS / self-hosted deployment target. |
|
coachapi/queue/sqs
Package sqs implements the internal/coachapi/queue.TaskQueue port (ADR-006, "Provider configuration" -> aws-sqs) on top of Amazon SQS.
|
Package sqs implements the internal/coachapi/queue.TaskQueue port (ADR-006, "Provider configuration" -> aws-sqs) on top of Amazon SQS. |
|
coachapi/store/memory
Package memory is the in-process coachapi.WorkerJobStore used for local development and tests.
|
Package memory is the in-process coachapi.WorkerJobStore used for local development and tests. |
|
coachapi/store/postgres
Package postgres is the durable coachapi.WorkerJobStore backed by Postgres; its schema is internal/coachapi/migrations.
|
Package postgres is the durable coachapi.WorkerJobStore backed by Postgres; its schema is internal/coachapi/migrations. |
|
codesignalcli
Package codesignalcli is the scan use case behind `coach codesignal`: it analyzes the selected files of a diff or a repository baseline, hands a validated project policy to its language's project backend (Go or TypeScript), and discloses worktree state the committed report cannot see.
|
Package codesignalcli is the scan use case behind `coach codesignal`: it analyzes the selected files of a diff or a repository baseline, hands a validated project policy to its language's project backend (Go or TypeScript), and discloses worktree state the committed report cannot see. |
|
codesignalcli/configauthoring
Package configauthoring helps a user produce a project-policy candidate: guided interactive authoring for TypeScript, and non-interactive root suggestion from a committed revision, written create-only.
|
Package configauthoring helps a user produce a project-policy candidate: guided interactive authoring for TypeScript, and non-interactive root suggestion from a committed revision, written create-only. |
|
codesignalcli/gitrepo
Package gitrepo is the git process adapter behind coach codesignal: revision resolution, changed and tracked file selection, bounded and batched object reads, revision archives, and worktree status.
|
Package gitrepo is the git process adapter behind coach codesignal: revision resolution, changed and tracked file selection, bounded and batched object reads, revision archives, and worktree status. |
|
codesignalcli/internal/gitfixture
Package gitfixture builds throwaway Git repositories for codesignalcli tests: one initialized repository per test, and one commit per file.
|
Package gitfixture builds throwaway Git repositories for codesignalcli tests: one initialized repository per test, and one commit per file. |
|
codesignalcli/pkgmanager
Package pkgmanager detects which package manager (npm, pnpm, Bun, or yarn) a TypeScript project declares, from the worktree or a committed revision, probes the version on PATH, and rejects configuration that would redirect package resolution.
|
Package pkgmanager detects which package manager (npm, pnpm, Bun, or yarn) a TypeScript project declares, from the worktree or a committed revision, probes the version on PATH, and rejects configuration that would redirect package resolution. |
|
codesignalcli/projectcheck
Package projectcheck runs `coach codesignal --check-project`: it evaluates the committed policy, project shape, host runtime, compiler, package manager, and dirty worktree, then aggregates them into one readiness result with ordered gaps and next actions.
|
Package projectcheck runs `coach codesignal --check-project`: it evaluates the committed policy, project shape, host runtime, compiler, package manager, and dirty worktree, then aggregates them into one readiness result with ordered gaps and next actions. |
|
codesignalcli/projectconfig
Package projectconfig owns the project-policy document (project.json): its frozen schema-1 shape, strict decoding and validation, and the bounded read of the committed document at an analyzed revision.
|
Package projectconfig owns the project-policy document (project.json): its frozen schema-1 shape, strict decoding and validation, and the bounded read of the committed document at an analyzed revision. |
|
codesignalcli/projectreadiness
Package projectreadiness is the --check-project result model: the checks, gaps, warnings, and next actions a readiness run reports, and the gap-code table that fixes each gap's status and remediation kind.
|
Package projectreadiness is the --check-project result model: the checks, gaps, warnings, and next actions a readiness run reports, and the gap-code table that fixes each gap's status and remediation kind. |
|
codesignalcli/prompt
Package prompt reads answers from an interactive session one line at a time.
|
Package prompt reads answers from an interactive session one line at a time. |
|
codesignalcli/render
Package render presents CodeSignal reports and project-readiness results as the CLI's text and JSON output.
|
Package render presents CodeSignal reports and project-readiness results as the CLI's text and JSON output. |
|
codesignalcli/revisionfs
Package revisionfs serves one immutable Git revision as a read-only fs.FS, so project analysis never reads the live worktree.
|
Package revisionfs serves one immutable Git revision as a read-only fs.FS, so project analysis never reads the live worktree. |
|
codesignalcli/sourcescope
Package sourcescope labels each selected file as production, test-only, excluded, or unknown from the analyzed revision's own Go build graph and tsconfig.json, and filters or tallies files by that label.
|
Package sourcescope labels each selected file as production, test-only, excluded, or unknown from the analyzed revision's own Go build graph and tsconfig.json, and filters or tallies files by that label. |
|
codesignalcli/subprocess
Package subprocess runs short, bounded probes of host executables (node, mise, package managers) with a wall-time limit and an output cap.
|
Package subprocess runs short, bounded probes of host executables (node, mise, package managers) with a wall-time limit and an output cap. |
|
codesignalcli/terminal
Package terminal detects whether a file is an interactive controlling terminal, the precondition for every prompt the CLI shows.
|
Package terminal detects whether a file is an interactive controlling terminal, the precondition for every prompt the CLI shows. |
|
codesignalcli/tssetup
Package tssetup runs the consented TypeScript compiler setup a failed readiness check offers: it builds the menu of verified installation choices, previews the exact frozen command, executes it only after a single explicit confirmation, and rechecks readiness afterwards.
|
Package tssetup runs the consented TypeScript compiler setup a failed readiness check offers: it builds the menu of verified installation choices, previews the exact frozen command, executes it only after a single explicit confirmation, and rechecks readiness afterwards. |
|
codesignalcli/tstoolchain
Package tstoolchain resolves the host toolchain a TypeScript project scan runs on: the supported Node runtime and the one approved TypeScript compiler, found across the project manifest, project mise, and global mise origins, with mise's own trust gates applied before mise is ever asked.
|
Package tstoolchain resolves the host toolchain a TypeScript project scan runs on: the supported Node runtime and the one approved TypeScript compiler, found across the project manifest, project mise, and global mise origins, with mise's own trust gates applied before mise is ever asked. |
|
fakegithub
Package fakegithub is a Coach-owned, fixture-driven fake GitHub HTTP service for offline acceptance testing.
|
Package fakegithub is a Coach-owned, fixture-driven fake GitHub HTTP service for offline acceptance testing. |
|
jsbridge
Package jsbridge defines the JSON protocol that exposes pkg/semantics to JavaScript/TypeScript consumers, plus the single handler both transport backends (WASM and stdio CLI) call.
|
Package jsbridge defines the JSON protocol that exposes pkg/semantics to JavaScript/TypeScript consumers, plus the single handler both transport backends (WASM and stdio CLI) call. |
|
modelgateway
Package modelgateway is the sole inference seam for structured judgment: request in → schema-validated response out.
|
Package modelgateway is the sole inference seam for structured judgment: request in → schema-validated response out. |
|
projectbridge
Package projectbridge defines the JSON protocol between pkg/projectmodel's TypeScript sidecar client (the pkg/projectmodel/internal/tssidecar process adapter) and a pinned local Node/TypeScript sidecar subprocess that produces raw TypeScript/TSX import facts from an immutable snapshot (issue #214).
|
Package projectbridge defines the JSON protocol between pkg/projectmodel's TypeScript sidecar client (the pkg/projectmodel/internal/tssidecar process adapter) and a pinned local Node/TypeScript sidecar subprocess that produces raw TypeScript/TSX import facts from an immutable snapshot (issue #214). |
|
rubrics
Package rubrics holds versioned LLM-as-judge definitions, prompt assembly, and agent-loop tool adapters for seed rubrics (ADR-005).
|
Package rubrics holds versioned LLM-as-judge definitions, prompt assembly, and agent-loop tool adapters for seed rubrics (ADR-005). |
|
sourcelayout
Package sourcelayout enforces ADR-007's naming rule: a Go file and the identifiers it declares are named for their responsibility, never for the position they were cut from (main_part2.go, body_mainPart2Test_44) or a generated hash (sigstartRecordingProxyListener39957725).
|
Package sourcelayout enforces ADR-007's naming rule: a Go file and the identifiers it declares are named for their responsibility, never for the position they were cut from (main_part2.go, body_mainPart2Test_44) or a generated hash (sigstartRecordingProxyListener39957725). |
|
tstestutil
Package tstestutil holds helpers shared by Ginkgo acceptance tests that copy this repository's installed TypeScript compiler into a fixture worktree.
|
Package tstestutil holds helpers shared by Ginkgo acceptance tests that copy this repository's installed TypeScript compiler into a fixture worktree. |
|
pkg
|
|
|
codesignal
Package codesignal turns pkg/semantics analysis results into prioritized, change-aware coaching signals.
|
Package codesignal turns pkg/semantics analysis results into prioritized, change-aware coaching signals. |
|
domain
Package domain holds project facts that both the use-case layer (pkg/codesignal) and the adapter that builds them (pkg/projectmodel) are allowed to depend on.
|
Package domain holds project facts that both the use-case layer (pkg/codesignal) and the adapter that builds them (pkg/projectmodel) are allowed to depend on. |
|
githubingest
Package githubingest reads individual file contents from a GitHub repository via the GitHub Contents API, authenticated as a GitHub App installation.
|
Package githubingest reads individual file contents from a GitHub repository via the GitHub Contents API, authenticated as a GitHub App installation. |
|
projectmodel
Package projectmodel defines deterministic, offline, whole-repository structural facts about a codebase.
|
Package projectmodel defines deterministic, offline, whole-repository structural facts about a codebase. |
|
projectmodel/internal/ssaload
Package ssaload is pkg/projectmodel's driven adapter for building Go SSA programs: it writes an fs.FS snapshot to a temporary directory and loads it through golang.org/x/tools/go/packages, which runs the local Go toolchain against those files.
|
Package ssaload is pkg/projectmodel's driven adapter for building Go SSA programs: it writes an fs.FS snapshot to a temporary directory and loads it through golang.org/x/tools/go/packages, which runs the local Go toolchain against those files. |
|
projectmodel/internal/tssidecar
Package tssidecar runs the pinned Node/TypeScript project sidecar as a child process for one internal/projectbridge request.
|
Package tssidecar runs the pinned Node/TypeScript project sidecar as a child process for one internal/projectbridge request. |
|
semantics
Package semantics extracts deterministic structural facts from raw source bytes (syntax validity, imports, branching metrics, constructor-like patterns, mutates_input) using Tree-sitter grammars.
|
Package semantics extracts deterministic structural facts from raw source bytes (syntax validity, imports, branching metrics, constructor-like patterns, mutates_input) using Tree-sitter grammars. |
|
semantics/internal/engine
Package engine defines the narrow tree-sitter surface pkg/semantics relies on.
|
Package engine defines the narrow tree-sitter surface pkg/semantics relies on. |
Click to show internal directories.
Click to hide internal directories.