cmd/

Command acceptance exercises access-issuer against a real Kubernetes API server.

Command resource-proxy fronts a service that knows nothing about sluis with a sluis resource server's front door: it verifies the caller's token, serves the RFC 9728 metadata, writes an audit line per request, and proxies to the service -- and, optionally, gives the service an identity of its own for what it calls in turn.

Command sluis is the whole product in one binary, one image and one chart (docs/decisions/0032).

Command sluis-lambda is sluis as AWS Lambda functions: one arm64 `bootstrap` binary in one zip, deployed as three functions whose role is SLUIS_ROLE (http, github or slack).

Command sluisctl is what a person on a laptop runs.