internal/

Package aikit is what every AI adapter does the same way, whatever its provider: the prompts, the tools a model is given and their schemas, the budgeted reader a model reads the repository through, and what a tool call does.

Package aitest holds what the AI adapters' tests share: a repository in memory.

Package anthropic screens deployment plans with Claude (design 10 §6).

Package local performs Pando's AI functions with a model served on your own hardware, by any server that speaks the OpenAI Chat Completions API: Ollama, LM Studio, llama.cpp's server, vLLM.

Package openai performs Pando's AI functions with OpenAI's models, through the Responses API.

Package api defines the seven adapter interfaces.

Package https is the audit sink adapter for a SIEM's HTTPS ingest endpoint (R-382, design 12 §5.1): one POST per batch, in the body shape the destination reads — newline-delimited JSON, a JSON array, Splunk HEC's envelope, Elastic's bulk action lines, or Datadog log items.

Package sinkkit holds what the audit sink kinds share: the settings that narrow and shape what core sends (R-384), reading inline credentials out of plain configuration (R-190), and a trusted certificate bundle.

Package syslog is the audit sink adapter for a syslog collector (R-382, design 12 §5.1): RFC 5424 messages over TCP, octet-counted as RFC 5425 and RFC 6587 frame them, with TLS unless the operator turns it off.

Package local stores backup bundles on a filesystem path.

Package buildkit implements the builder adapter: rootless, containerized, no socket.

Package checkkit lets a kind of adapter check a configuration as it is saved, by running its own Configure on it, without anything stored.

Package local implements the local identity adapter: username and password, argon2id.

Package oidc is the generic OpenID Connect identity adapter (R-043).

Package saml is the SAML 2.0 identity adapter (R-043).

Package ecr is the image registry adapter for Amazon ECR.

Package oci is the image registry adapter for any registry that signs in with a username and password, or not at all: the Distribution registry docker-compose.registry.yml runs, Harbor, GitHub Container Registry, Google Artifact Registry, Zot.

Package registrykit is what the image registry adapters share: reading a registry address, laying built images out in it, and deleting a deleted app's (R-224).

Package chat is the notify adapters for chat platforms that take an incoming webhook: Slack, Microsoft Teams and Discord (R-374, issue #50).

Package console is the v1 notification adapter (R-230, R-231).

Package ntfy is the notify adapter for ntfy, the push notification service (R-374, issue #50): ntfy.sh or a server of your own.

Package smtp is the email notify adapter (R-232, R-374, issue #50).

Package cloudflare routes apps through a Cloudflare Tunnel (R-160, design 03 §4.5).

Package loopback implements port-mode routing with no TLS: the laptop default.

Package traefik implements subdomain and path routing with TLS.

Package docker implements the runtime adapter for local containers.

Package incus runs each app in its own Incus virtual machine (notes-incus-runtime.md).

Package incusapi is the part of the Incus REST API the Incus runtime uses: the types, with Incus's own JSON names, and a client for them.

Package kubernetes runs apps on a Kubernetes cluster (issue #72, PR 6, O-33).

Package multidocker runs apps on several Docker hosts (notes-multi-host-docker-issue-72.md, issue #72 PR 7).

Package trivy scans what an app deploys, with Trivy in a container.

Package local implements the secrets adapter, encrypted at rest with the key on disk (R-190).

Package docker provisions services that fill declared slots: postgres, mysql, redis.

Package azuredevops is the source adapter for Azure DevOps Services and Azure DevOps Server (R-091).

Package bitbucket is the source adapter for Bitbucket Cloud and Bitbucket Data Center (R-091).

Package forgekit is what source adapters share: reading a repository address in each of the forms people write one, deciding whether a connection covers it, and building the credential core clones with.

Package generic is the source adapter for any git host (R-091): an HTTPS username and token, or an SSH key with the host's key pinned.

Package gitea is the source adapter for Gitea and Forgejo, Codeberg among them (R-091).

Package github is the source adapter for GitHub (R-091): github.com and GitHub Enterprise Server, reached with a GitHub App installation, an OAuth application, a personal access token or a deploy key.

Package gitlab is the source adapter for GitLab, on gitlab.com or self-managed (R-091).

Package address changes where a configured app is reached (R-162, R-163, R-165).

Package appdelete deletes an app: settles its storage (R-204), archives it and starts its teardown.

Package applimit decides how many apps a person may own (R-244, issue #131).

Package approval is deploy approval (R-154 – R-159): whether a deploy needs somebody's sign-off, and the request, approval, rejection and expiry of one.

Package assertion mints the identity assertions the proxy passes to apps, and publishes the keys that verify them.

Package assist is which AI adapter performs each AI function (R-259), and the administrative functions built on that: drafting access and policy, searching the audit log, and answering from the reference (R-343 … R-346).

Package audit writes the append-only event log.

Package ocsf encodes native audit lines as OCSF events (design 12 §6.2, R-384).

Package auditstream pushes the audit log to audit sinks as it is written (R-382, R-383, design 12 §5).

Package authz evaluates the two authorization planes.

Package autodeploy is the service behind an app's automatic deploy settings and its webhook (R-141, R-142).

Package bootstrap creates the first administrative account on a fresh install.

Package capacity is what GET /capacity shows: each runtime's room, beside what Pando has committed to apps on it (R-242, R-243, R-245).

Package clock provides the time source core depends on.

Package cluster is what lets several Pando processes serve one install against one database (issue #72).

Package deploy runs the deployment pipeline: everything after the plan boundary (design 05 §3, steps 8-16).

Package detection runs the detection job for an app and records the result.

Package disklimit holds apps to their disk limits (R-403, issue #130).

Package edge runs what routing adapters need in front of Pando (R-174).

Package edgecert issues the edge's certificates when the edge cannot issue its own (R-169, R-174; notes-kubernetes-runtime-issue-72.md, "Certificates with several replicas").

Package events is the catalog of things Pando tells subscribers about (R-364, issue #50, design 11).

Package idle stops, and later deletes, apps nobody uses (R-393 – R-398, issue #131).

Package idp is external identity: the providers an administrator connects, redirect sign-in through them, linking their identities to accounts, the groups they sync, and SCIM provisioning (R-043, R-045, R-047, R-048, R-050).

Package imageregistry is the install's image registry: where a build is pushed when the runtime pulls rather than imports (issue #72, PR 5, docs/design/notes-image-registry-issue-72.md).

Package logstream shares one live log stream per app part between everyone watching it on a replica (O-51).

Package observe shares what a runtime reports about an app between the requests that ask for it at the same moment (issue #72).

Package oci reads what a registry says about an image, before anything is pulled.

Package planner turns a spec plus host policy plus adapter capabilities into a bundle plan, or into a plan-time error.

Package policy evaluates host policy.

Package reconciler runs the loop that converges observed state toward pinned specs.

Package retention removes what Pando keeps only for a while: old deploys, scans, sessions, notifications, idempotency keys, sign-in flows, the event outbox, and what deleted apps left behind (issue #72, R-224).

Package screening turns an AI adapter's proposed amendments into changes to a draft spec, or refuses them.

Package security turns a scanner's findings into a number, and that number into a decision.

Package source fetches an app's source and exposes it read-only.

Package sourceconn is the install's source connections (R-091; O-3 as re-resolved with issue #127): which connection reads a repository, what it reads it with, and the OAuth authorizations that give a connection its token.

Package spec defines the AppSpec: the sole record of how an app runs.

Package specgate decides whether somebody may write a spec revision, for the parts of a spec that app.spec.edit alone does not cover: an app's egress rules (R-182 – R-184) and automatic deploys on an app whose deploys need approval (R-158).

Package state holds sqlc-generated queries and repository types.

Package statetest gives integration tests a database of their own, quickly.

Package subscription delivers Pando's events to the people who asked for them: webhooks and notification channels, retried until they arrive or plainly fail (issue #50, R-366 – R-374, design 11).

Package tokenkey holds the key API token digests are made with (R-063).

Package twofactor is the second factor of a local account (R-405): an authenticator app's time-based codes (TOTP, RFC 6238) and recovery codes.

Package update knows whether a newer Pando has been released (R-349–R-352).

Package upgrade replaces the running Pando with a newer release (R-355 – R-361): checked, backed up, swapped by a helper, and put back on its own when the new version does not come up.

Package work runs work held in Postgres on a bounded number of goroutines (issue #72, O-32).

Package registryprobe looks for images a project already publishes.

Package telemetrytest reads back what Pando recorded, for tests asserting that a piece of work is measured (R-399).