internal/

Package approval stores local, operator-created approval records.

Package attestation measures the executable and security configuration used by one Turnwire process.

Package audit provides a small append-only, tamper-evident event log.

Package budget provides durable fail-closed fixed-window accounting.

Package cli implements the turnwire command-line interface.

Package config loads and validates Turnwire configuration.

Package guard implements deterministic and model-based message policy checks.

Package identity manages the endpoint signing identity and signed envelopes.

Package owneronly validates security-sensitive files through their open descriptors, so path replacement cannot invalidate the result.

Package securestore provides small immutable files in an owner-only directory.

Package strictjson rejects text encodings that Go's JSON decoders would otherwise repair lossily before callers can enforce exact-text guarantees.