internal/

Package contextengine implements the Proactive Context Engine.

Package lifecycle manages graceful shutdown with auto-save of session state, cache flush, and database closure.

Package orchestrator implements the DIP Heartbeat Orchestrator.

Package resilience implements the Sentinel Autonomous Resilience Layer (SARL).

Package resources provides MCP resource implementations.

Package shadow_ai implements the Sentinel Shadow AI Control Module.

Package sidecar implements the Universal Sidecar (§5.5) — a zero-dependency Go binary that runs alongside SENTINEL sensors, tails their STDOUT/logs, and pushes parsed security events to the SOC Event Bus.

Package soc provides SOC analytics: event trends, severity distribution, top sources, MITRE ATT&CK coverage, and time-series aggregation.

Package tools — Apathy Detection and Apoptosis Recovery (DIP H1.4).

Package alert defines the Alert domain entity and severity levels for the DIP-Watcher proactive monitoring system.

Package causal defines domain entities for causal reasoning chains.

Package circuitbreaker implements a state machine that controls the health of recursive pipelines (DIP H1.1).

Package context defines domain entities for the Proactive Context Engine.

Package crystal defines domain entities for code crystal indexing (C³).

Package entropy implements the Entropy Gate — a DIP H0.3 component that measures Shannon entropy of text signals and blocks anomalous patterns.

Package eval implements the CLASP Evaluation Framework (SDD-005).

Package guidance implements the Security Context MCP server domain (SDD-006).

Package hooks implements the Syntrex Hook Provider domain logic (SDD-004).

Package identity implements Non-Human Identity (NHI) for AI agents (SDD-003).

Package intent provides the Intent Distiller — recursive compression of user input into a pure intent vector (DIP H0.2).

Package memory defines domain entities for hierarchical memory (H-MEM).

Package mimicry provides semantic text transformation for OPSEC (v3.8 Strike Force).

Package oracle implements the Action Oracle — deterministic verification of distilled intent against a whitelist of permitted actions (DIP H1.2).

Package peer defines domain entities for Peer-to-Peer Genome Verification and Distributed Fact Synchronization (DIP H1: Synapse).

Package pipeline implements the Intent Pipeline — the end-to-end chain that processes signals through DIP components (H1.3).

Package pivot implements the autonomous multi-step attack engine (v3.8 Strike Force).

Package router implements the Neuroplastic Router (DIP H2.2).

Package session defines domain entities for cognitive state persistence.

Package soc defines domain entities for the SENTINEL AI SOC subsystem.

Package synapse defines domain entities for semantic fact connections.

Package vectorstore implements persistent storage for intent vectors (DIP H2.1).

Package antitamper implements SEC-005 Anti-Tamper Protection.

Package audit provides an append-only audit trail for Zero-G operations.

Package auth provides JWT authentication for the SOC HTTP API.

Package email provides email notification service for the SYNTREX SOC platform.

Package formalspec implements SEC-012 TLA+ Formal Verification.

Package guard implements the SEC-002 eBPF Runtime Guard policy engine.

Package hardware provides infrastructure for physical and logical security controls: Soft Leash file-based kill switch (v3.1) and Zero-G State Machine (v3.2).

Package ipc provides a cross-platform inter-process communication layer for SENTINEL SOC Process Isolation (SEC-001).

Package logging provides structured logging via Go's log/slog.

Package postgres provides PostgreSQL persistence for the SENTINEL SOC.

Package pqcrypto implements SEC-013 (Homomorphic Encryption research) and SEC-014 (Post-Quantum Signatures).

Package pybridge provides a bridge to the Python RLM toolkit for NLP operations that require embeddings, semantic search, and other ML capabilities.

Package sbom implements SEC-010 SBOM + Release Signing.

Package secureboot implements SEC-007 Secure Boot Integration.

Package sqlite provides SQLite-based persistence using modernc.org/sqlite (pure Go, no CGO).

Package tpmaudit implements SEC-006 TPM-Sealed Decision Logger.

Package tracing provides OpenTelemetry instrumentation for the SOC platform.

Package wasmsandbox implements SEC-009 Wasm Sandbox for Playbooks.

Package watchdog implements the SEC-004 Watchdog Mesh Framework.

Package zerotrust implements SEC-008 Zero-Trust Internal Networking.

Package httpserver provides an HTTP API transport for GoMCP SOC dashboard.

Package mcpserver wires MCP tools and resources to application services.

Package tui provides the SENTINEL TUI Dashboard.