core/

Package address changes where a configured app is reached (R-162, R-163, R-165).

Package appdelete deletes an app: settles its storage (R-204), archives it and starts its teardown.

Package applimit decides how many apps a person may own (R-244, issue #131).

Package approval is deploy approval (R-154 – R-159): whether a deploy needs somebody's sign-off, and the request, approval, rejection and expiry of one.

Package assertion mints the identity assertions the proxy passes to apps, and publishes the keys that verify them.

Package assist is which AI adapter performs each AI function (R-259), and the administrative functions built on that: drafting access and policy, searching the audit log, and answering from the reference (R-343 … R-346).

Package audit writes the append-only event log.

Package auditstream pushes the audit log to audit sinks as it is written (R-382, R-383, design 12 §5).

Package authz evaluates the two authorization planes.

Package autodeploy is the service behind an app's automatic deploy settings and its webhook (R-141, R-142).

Package bootstrap creates the first administrative account on a fresh install.

Package capacity is what GET /capacity shows: each runtime's room, beside what Pando has committed to apps on it (R-242, R-243, R-245).

Package clock provides the time source core depends on.

Package cluster is what lets several Pando processes serve one install against one database (issue #72).

Package deploy runs the deployment pipeline: everything after the plan boundary (design 05 §3, steps 8-16).

Package detection runs the detection job for an app and records the result.

Package disklimit holds apps to their disk limits (R-403, issue #130).

Package edge runs what routing adapters need in front of Pando (R-174).

Package edgecert issues the edge's certificates when the edge cannot issue its own (R-169, R-174; notes-kubernetes-runtime-issue-72.md, "Certificates with several replicas").

Package events is the catalog of things Pando tells subscribers about (R-364, issue #50, design 11).

Package idle stops, and later deletes, apps nobody uses (R-393 – R-398, issue #131).

Package idp is external identity: the providers an administrator connects, redirect sign-in through them, linking their identities to accounts, the groups they sync, and SCIM provisioning (R-043, R-045, R-047, R-048, R-050).

Package imageregistry is the install's image registry: where a build is pushed when the runtime pulls rather than imports (issue #72, PR 5, docs/design/notes-image-registry-issue-72.md).

Package logstream shares one live log stream per app part between everyone watching it on a replica (O-51).

Package observe shares what a runtime reports about an app between the requests that ask for it at the same moment (issue #72).

Package oci reads what a registry says about an image, before anything is pulled.

Package planner turns a spec plus host policy plus adapter capabilities into a bundle plan, or into a plan-time error.

Package policy evaluates host policy.

Package reconciler runs the loop that converges observed state toward pinned specs.

Package retention removes what Pando keeps only for a while: old deploys, scans, sessions, notifications, idempotency keys, sign-in flows, the event outbox, and what deleted apps left behind (issue #72, R-224).

Package screening turns an AI adapter's proposed amendments into changes to a draft spec, or refuses them.

Package security turns a scanner's findings into a number, and that number into a decision.

Package source fetches an app's source and exposes it read-only.

Package sourceconn is the install's source connections (R-091; O-3 as re-resolved with issue #127): which connection reads a repository, what it reads it with, and the OAuth authorizations that give a connection its token.

Package spec defines the AppSpec: the sole record of how an app runs.

Package specgate decides whether somebody may write a spec revision, for the parts of a spec that app.spec.edit alone does not cover: an app's egress rules (R-182 – R-184) and automatic deploys on an app whose deploys need approval (R-158).

Package state holds sqlc-generated queries and repository types.

Package subscription delivers Pando's events to the people who asked for them: webhooks and notification channels, retried until they arrive or plainly fail (issue #50, R-366 – R-374, design 11).

Package tokenkey holds the key API token digests are made with (R-063).

Package twofactor is the second factor of a local account (R-405): an authenticator app's time-based codes (TOTP, RFC 6238) and recovery codes.

Package update knows whether a newer Pando has been released (R-349–R-352).

Package upgrade replaces the running Pando with a newer release (R-355 – R-361): checked, backed up, swapped by a helper, and put back on its own when the new version does not come up.

Package work runs work held in Postgres on a bounded number of goroutines (issue #72, O-32).