internal/

Package instanceauth owns RC's sealed, per-generation Runtime authority.

Package skillset owns Runtime Controller's independent validation of a frozen, organization-scoped system-Skill collection.

Package tunnelclient sends only the private Egress generation registration.