adapter/

Package acp is the Agent Client Protocol (ACP) adapter: it lets an ACP editor (Zed, and others that speak ACP) drive the mecatl harness as a subprocess over stdio.

Package agentimport converts local Codex and Claude Code artifacts into provider-neutral Mecatl data.

Package attemptstore persists bounded learning attempts in a crash-safe, owner-partitioned document.

Package authfile is the adapter-layer leaf for mecatl's credentials file: a settings.yaml-sibling YAML file (conventionally $XDG_CONFIG_HOME/mecatl/auth.yaml) holding per-provider secrets: an api_key for the existing keyed providers or a manually supplied OAuth access-token snapshot for openai-codex.

Package automaticstore persists automatic-admission accounting in one flock-serialized, crash-safe document shared by cooperating processes.

Package cedarauthority provides the optional Cedar-backed authority evaluator.

Package clientauth provides durable, target-bound public-client OIDC credentials.

Package credentialstore defines a host-internal, credential-format-agnostic port for opaque binary records and provides namespace-bound backend handles.

Package daemonconfig is a strict, versioned, operator-selected daemon configuration file loaded ONLY when `mecated serve --config PATH` is explicitly supplied.

Package dream implements opt-in background memory consolidation.

Package envscrub builds the SECRET-neutralised process environment every agent-facing command shell runs with.

Package executionclient implements the private mTLS client and placement adapter for the independently deployed Kubernetes execution provider.

Package executioncontroller implements the authenticated provider gRPC boundary.

Package flocklease is the single-host port.SessionLease implementation.

Package forker implements the default tool.EnvironmentForker used by fork-join parallelism (harness pattern 8).

Package gitenv builds the git-neutralizing process environment shared by the forker (its own fork-time git invocations) and the sandboxed team-member command runner.

Package guardraileval defines the offline-first paired guardrail measurement protocol.

Package hashutil is the shared, stdlib-only content-fingerprint primitive for the adapter layer.

Package hookexec implements port.HookRunner by running a configured shell command per lifecycle HookPhase.

Package jevrouter adapts Typesafe System One decisions to Mecatl's delegated-model router.

Package k8slease is the Kubernetes-backed port.SessionLease: cross-process, cross-HOST single-writer enforcement for the multi-replica cloud-native posture, backed by a coordination.k8s.io/v1 Lease object per session id.

Package llmendpoint validates host-internal native LLM endpoint identities and confines gateway request URLs before credential retrieval.

Package llmresilience provides a harness-level resilience decorator around any port.LLMProvider.

Package managedtemp owns the private Unix filesystem namespace used by managed command temporary storage.

Package mcp adapts tools served by external Model Context Protocol (MCP) servers into the harness's tool.Tool interface, so the agent loop can call remote MCP tools exactly as it calls built-in ones.

Package mcpauthority carries the exclusive MCP construction selection between command-side profile loading and application composition.

Package mcpbroker implements the in-process, session-scoped MCP broker.

Package mcpcredential provides the small, root-pinned custody seam used by local MCP onboarding.

Package mcplifecycle contains the reusable, non-UI part of direct MCP profile lifecycle operations.

Package mcpperf serves this Go process's runtime performance data over a read-only Model Context Protocol (MCP) server, so an agent can introspect the harness's own latency, memory, goroutine, and profile state through MCP tools and resources instead of a human reading raw /metrics or /debug/pprof.

Package mcpsecretfile reads bounded operator-owned OAuth client secrets.

Package memory implements harness pattern 3 (tiered memory): a conservative, cross-session memory facility exposed to the model as two tools (Remember and Recall) backed by a pluggable tool.MemoryStore.

Package microvm provides the root module's thin UDS adapter for microvmd.

Package microvmmanager owns idempotent readiness and explicit diagnostics for the user-local microvmd lifecycle.

Package mockscript loads bounded deterministic mock LLM response scripts.

Package modelhook contains the contextual guardrail rule matcher, exact-action grant store, and the narrow verdict checker retained for path-escape policy.

Package modeltext contains protocol-neutral hygiene for model catalog text.

Package oidcclient contains target-independent host-side OIDC public-client mechanics.

Package openaibearer injects rotating file-backed credentials into OpenAI requests.

Package openaicodex supplies the credential and HTTP request policy for the experimental ChatGPT Codex backend.

Package openaicompat is a stdlib-only LEAF adapter that fetches a LIVE model catalog from any endpoint speaking the OpenAI-shaped GET /v1/models protocol — it names the PROTOCOL, not a specific vendor.

Package openrouter is a stdlib-only LEAF adapter that fetches the LIVE OpenRouter model catalog from the public, UNAUTHENTICATED models endpoint and maps it into a neutral, package-own result type.

Package osfs implements tool.FileSystem over the real operating-system filesystem and a tool.Workspace that scopes every path under a single session root.

Package permclassify provides an OPTIONAL layer-2 model-based command/tool risk classifier, implemented as a pluggable decorator over a layer-1 port.PermissionPolicy.

Package permconfig is the file-based permission-config adapter (issue #13).

Package privatefile updates small owner-private files by atomic replacement.

Package procgroup puts a child process in its own process group so a context cancellation kills the WHOLE group — not just the direct child.

Package productmetrics is a fully independent, opt-out-by-default OTel metrics adapter reporting bounded adoption/usage counters to Stacklok's public metrics collector.

Package providercatalog is a stdlib-only LEAF DATA adapter exposing a pinned, embed-vendored subset of the models.dev model catalog as a typed, read-only Go API.

Package providerid owns the root-internal provider identifier grammar shared by operator configuration and credential persistence.

Package reflectionstore persists bounded learning proposals in a crash-safe, principal/project-partitioned document.

Package remoteenv is a deterministic, in-process, protocol-level reference fake of a REMOTE execution environment (issue #462 phase 3).

Package resourceurl defines the canonical protected-resource URL identity shared by the server, enrollment registry, and discovery client.

Package scheduler is the in-process tick loop for the scheduled-tasks feature (issue #189).

Package server is the API adapter for mecatl: it exposes the agent loop over two network surfaces that share one domain Event taxonomy.

Package sessiondebug provides the target-bound, read-only evidence tool used by dedicated debug sessions.

Package skills is the in-repo adapter for Agent Skills.

Package skillstore persists agent-owned skill lifecycle records in a flocked, crash-safe manifest with immutable content-addressed SKILL.md files.

Package slogdiag is an outbound adapter implementing port.Diagnostics over the standard library's log/slog.

Package soul implements issue #14: a user-scoped, agent-READ-ONLY persona/"soul" fragment loaded into the turn-0 conversation as data.

Package telemetry is an outbound adapter that derives OpenTelemetry traces and Prometheus metrics from the harness's domain event stream.

Package tlsreload owns hot reload and expiry observation for a server TLS certificate.

Package tokenizer provides a tiktoken-backed agent.TokenCounter.

Package toolhivellm is the ToolHive-aware code in mecatl (issue #262 + #265): it detects, by reading ToolHive's OWN on-disk config file, whether a ToolHive LLM gateway proxy is set up for this user — and, if so, what LOOPBACK port it listens on — and (issue #265, tokensource.go) builds an in-process OIDC token source so both ToolHive protocol providers can talk DIRECTLY to the real gateway_url with no local proxy hop.

Package toolkit holds the small, tool-agnostic helpers shared by the adapter-layer tool packages (internal/adapter/tools and internal/adapter/memory).

Package tools composes the model-facing tool catalog of the mecatl kit.

Package workspacetrust is the adapter-layer reader/writer for workspace trust (Workspace-Trust feature).

Package xdgconfig is the shared adapter-layer seam for resolving user-global configuration locations against the process environment.

Package yamldiag classifies goccy YAML parser errors without exposing YAML content.