internal/

Package cliconfig manages the CLI-side configuration (~/.config/zattera/config.toml): named contexts pointing at clusters, with tokens.

Package ui centralizes CLI output: lipgloss styles, success/error lines in the Vercel-style format, tables, and a --json mode that suppresses all decoration.

Package provider is a production cloud-infrastructure client: it spins, inspects, and destroys VMs on a real provider (Hetzner today; others later).

Package agent is the node-side runtime that keeps a node in sync with the control plane.

Package api hosts the public control-plane API.

Package archive gives audit entries and events durability beyond their in-state rings (T-92).

Package backup implements full-platform disaster recovery (spec §3.11, T-66): a leader backs up the raft state, the cluster CA material and the sealed data key to the same S3 object store the volume snapshots use; `zatterad restore` rebuilds a fresh single-node cluster from the latest backup.

Package builder builds container images from source using a managed buildkitd (spec §3.4).

Package ca implements the embedded cluster certificate authority.

Package github implements push-to-deploy: a webhook endpoint that turns GitHub push events into builds, and GitHub App authentication for cloning private repos and posting commit statuses (spec F9, T-37).

Package intdns is the per-node internal DNS resolver (F26).

Package leaderrunner factors the "run this loop only while we hold raft leadership" boilerplate shared by every leader-gated control-plane loop (scheduler, orchestrator, dispatcher, janitors).

Package livestate holds the leader's in-memory view of connected nodes: presence, last heartbeat time and the most recent live sample.

Package logstore defines the per-node log storage contract (spec §3.10).

Package mesh owns the WireGuard overlay (ADR-0003).

Package meshsock is the custom wireguard-go conn.Bind (ADR-0003 Phase C/D): one UDP socket multiplexes WireGuard transport packets and disco probe frames, a per-peer path state machine upgrades hub-routed peers to direct or hole-punched UDP paths, and (Phase D) falls back to a TCP relay when no UDP path works.

Package relay is the Phase D DERP-lite fallback (ADR-0003): every control node runs an mTLS TCP relay; a meshsock node with no working UDP path frames its already-encrypted WireGuard packets as (dst node, payload) and the relay forwards them to the destination's connection.

Package nodehealth holds the pure node-liveness decision types shared by the gossip failure detector (internal/daemon/mesh) and the liveness monitor (internal/daemon/api).

Package nodeinfo detects a node's static capacity (CPU / memory / disk) for registration in state.

Package notify is the alert engine (T-74): the leader evaluates AlertRules against metrics (TSDB/livestate) and cluster events, and delivers firing and resolved notifications to NotificationChannels (webhook, Slack, email) with per-rule dedupe.

Package proxy hosts the embedded L7/L4 proxy (tasks T-41..T-48).

Package raftstore wires hashicorp/raft to the in-memory state store (ADR-0004).

Package registry implements Zattera's embedded OCI image registry (spec §3.5).

docker.go is the ONLY file permitted to import the Docker SDK (spec rule 3).

Package scheduler runs on the leader and reconciles desired replica counts into Assignments: it decides WHAT should run WHERE, writing only desired state (agents converge it, T-15).

Package secrets implements envelope encryption for cluster secrets (spec §3.13, design §2.10):

Package tlsmgr manages TLS certificates for the ingress: ACME issuance via certmagic backed by the raft KV (cluster-wide, one issuer serialized by a distributed lock), and a dev mode that mints self-signed certs from the cluster CA on demand (T-44).

Package tsdb defines the embedded time-series store contract (spec §3.10): per-series ring buffers, 15s raw resolution for 24h + 5m downsampled for 30d.

Package upgrade resolves release artifacts for a rolling cluster upgrade (T-95).

Package volumes implements the content-addressed snapshot engine (spec §3.11): a deterministic tar of a volume's host path is content-defined-chunked (FastCDC), each chunk is deduplicated by sha256, compressed (zstd), encrypted (AES-GCM), and stored as an object; a per-snapshot manifest lists the ordered chunk hashes.

Package clock abstracts time for testability.

Package ids generates the ULID identifiers used for every first-class object.

Package platform normalizes and matches OCI platform strings ("linux/amd64").

Package version carries the build version, stamped via -ldflags.

Package fakeruntime is an in-memory ContainerRuntime for unit and simcluster tests.

Package freeport hands out free TCP ports for tests.

Package simcluster runs an in-process multi-node Zattera control plane for unit and chaos tests: real hashicorp/raft with in-memory transports, real FSM/state, fake container runtime, fake clock.