pkg/

Package discovery detects HTTP services running on the edge host next to the agent (e.g.

Package harnessplane makes a machine a harness host for its workspace.

Package reconciler reconciles workloads on the agent side: it watches the edge's Placements in the tenant workspace and materializes each as a local Deployment.

Package supervisor runs one long-lived child process for a supervised harness runner and keeps it running.

Package status reports agent status back to the hub.

Package tunnel implements reverse-dial tunneling between agent and hub.

Package auth handles OIDC authentication for the CLI.

Package cmd implements the railgrid CLI commands.

Package cmd provides the railgrid dev command and its subcommands.

Package plugin provides the implementation for railgrid dev command plugins.

Package actionproof signs the human and tenant context of a kcp custom subresource request so a provider can make a narrowly authorized hub REST call without forwarding the caller's bearer token.

Package admin implements the platform-admin surface mounted at /api/admin/* and surfaced in the portal's gated /bonkers area.

Package appauth is the hub's login-time authorization endpoint for published applications.

Package bootstrap embeds bootstrap resources for hub initialization.

Package mcpserver reconciles MCPServer objects.

Package membershipindex implements the UMI invariant reconciler: a controller that watches UserMembershipIndex CRs in root:railgrid:users and repairs rows that strand a user.

Package organization gives every new organization the same bootstrap lifecycle.

Package softdelete implements roadmap step 8: the soft-delete reconciler that honours the 30-day grace window from docs/organizations.md decisions O-8 (User delete) and O-13 (Org + Workspace delete).

Package hubaccess implements the hub-access half of the provider contract: the hub REST capabilities a provider may exercise with an admitted caller context, supplied either by a delegated user token or a short-lived action proof minted at the authenticated kcp front door.

Package identity is the hub's scoped-identity service: the one place a runtime credential for a tenant object is created.

Package kcp bootstraps kcp API resources.

Package leaderelection gates the hub's singleton controllers so a hub scaled to multiple replicas still reconciles each object exactly once.

Package mcpaggregate serves the hub's always-on aggregate MCP endpoint.

Package metering is how the hub finds the contrib-metering deployment and lets the admin area read it.

Package providerclaims is the one answer to "which permission claims does a tenant's APIBinding to a provider's export carry".

Package providerinstall runs durable Helm installations through Kubernetes Edges.

Package providers backs the hub's pluggable-provider extension surface: an in-memory routing table, reverse proxies for /ui/providers/{name}/* and /services/providers/{name}/*, and the controller that keeps the table in sync with ProviderCatalogEntry resources.

Package quota implements the organizations-per-user caps pinned by decision O-5 in docs/organizations.md: how many Organizations one User may create, and how many of the Organizations they administer may be on the free plan at once.

Package restapi implements roadmap step 10: the hub-mediated REST surface for Org / Workspace / Membership / User CRUD per docs/organizations.md decision O-10 ("Org workspaces are hub-mediated only"), plus the undelete actions wired to PR #212's soft-delete reconciler, the self-leave / role PATCH from O-12, and the ?cascade=true shortcut from O-9.

Package serviceaccounts implements roadmap step 9 (O-14): bot identity for child Workspaces via native kube `core/v1.ServiceAccount`s marked with railgrid annotations.

Package sharedstore is the hub's cross-replica key/value store for short-lived login state: browser sessions and published-app authorization codes.

Package tenant implements the hub-side tenant middleware described in docs/organizations.md §Switch the active context.

Package workloadidentity owns the production provider-action workload capability exchange.

Package client reaches one enrolled railgrid runner through the edges provider's published Service proxy, speaking the typed runner/v1 protocol in pkg/runner.

Package dispatch is the runner/v1 attempt lifecycle, written once.

Package harness defines the public execution seam for runner adapters.

Package claude adapts headless Claude Code to the runner harness.

Package codex adapts the Codex app-server protocol to the runner harness.

Package runnercli holds the launch logic shared by the standalone railgrid-runner binary (cmd/railgrid-runner) and the `railgrid runner run` subcommand of the main CLI (pkg/cli/cmd/runner.go).

Package auth provides server-side OIDC token verification.

Package proxy reverse-proxies authenticated requests to kcp.

Package confighelpers provides bootstrap helpers inspired by github.com/kcp-dev/kcp/config/helpers.

Package conncontext stores and retrieves net.Conn from context.

Package identity builds the cross-workspace ServiceAccount identity railgrid authorizes foreign SAs under.

Package localuser resolves the local account a privileged installer or supervisor drops privileges to.

Package safeio writes files and directories into a location that a less privileged account can influence, without letting that account redirect the write.