host/

Package api is the control-plane HTTP API.

Package catalog is the human-facing, host-side description of what an agent can be made of: the built-in TOOLS a sandbox already implements (with friendly, operator-readable copy and grouping) and a small set of starter TEMPLATES that pre-fill a sensible persona + toolset.

Package channels is the channel-adapter registry plus adapters.

Package delivery polls the outbound queue via contract.OutboundReader, delivers messages through channel adapters, and dedups in an in-memory delivered set (the host never writes outbound).

Package egress is the host-side broker for sandbox-originated calls to approved EXTERNAL APIs beyond the model host.

Package gateway is the single choke point through which every control-plane mutation flows (persona, enabled tools, packages, wiring, permissions, mounts).

DockerIsolator launches each sandbox as a plain Docker container (the default runc runtime — NOT gVisor) via the Docker Engine API over its unix socket.

Package keys handles per-session SessionKey generation and custody (a host keystore encrypted under a host master key) plus secure hand-off to the sandbox at launch.

Package mcp is the host-side Model Context Protocol implementation IronClaw uses to extend agents with externally-served tools WITHOUT giving the sandbox network access or a runtime to run MCP servers in.

Package metrics is a dependency-free metrics registry for the IronClaw control plane.

Package modelproxy is the host-side model egress proxy: it listens on a unix socket bound into the sandbox and forwards to the model API with a destination allowlist.

Package onboard implements the guided first-run wizard behind `ironctl onboard`.

Package questions holds the host-side store of pending ask_user_question requests a sandbox raised (RFC-0003).

Package queue provides the host-side queue implementations: a contract.InboundWriter (the host is the sole writer of inbound) and a contract.OutboundReader (the host reads outbound read-only, with the reopen-per-poll discipline).

Package registry is the control-plane's own data model: agent groups, messaging groups, wirings, sessions, users, roles, and members.

Package router performs inbound routing: messaging-group resolution, fan-out to wired agent groups, engage-mode evaluation, session resolution, and sender/access gating.

Package sandboxexec is the single source of truth for IronClaw's ephemeral, hardened one-shot code-exec box.

Package scan implements `ironctl scan`: a containment self-audit that grades the isolation posture of ANY container, docker-compose service, or Kubernetes pod/manifest on a 0-100 scale across the same dimensions IronClaw's own containment benchmark checks (IRO-369): non-root user, dropped capabilities, seccomp, network isolation, read-only rootfs, docker.sock exposure, and shared host namespaces.

Package scheduling holds the pure logic for scheduled prompts: validation and next-occurrence computation.

Package session composes the per-session live lifecycle.

Package skills implements IronClaw's host-side skills system.

Package sweep runs the periodic maintenance loop: stale-sandbox detection via heartbeat file mtime, due-message wake, recurrence expansion, and orphan reset with backoff.

Package types holds the small shared host-internal structs that flow between the router, delivery, and sweep packages.

Package vaultinjector is IronClaw's minimal in-tree reference credential injector: the SEPARATE host-side principal the egress broker forwards a vault:// request TO.