internal/

Package agentstack is a connector that inventories the cryptography of AI-agent infrastructure itself — the trust surface of the agent-governance stack, not just the systems it governs.

Package agility scores how easily a cryptographic asset can be migrated and recommends a post-quantum or strong replacement target.

Package attest signs and verifies compliance-evidence digests.

Package binscan discovers cryptography in compiled binaries (ELF, PE, Mach-O).

Package exporter emits qryx findings as agent-event envelopes (agent-passport SPEC.md §6), the producer half of the adoption-cost table's Qryx row (§9): qryx was already Passport-aware as a consumer (internal/agentstack resolves agent_id as an evidence subject), this package is the emitter that row calls out as "not started."

Package graph aggregates flat findings into a cryptographic asset graph: one node per logical asset, carrying every place it occurs across all sources.

Package imagescan scans a local container image tarball (the output of `docker save` or an OCI image layout) for cryptography.

Package model defines the core data types of the qryx cryptography graph.

Package policy evaluates a cryptographic asset graph against a declarative policy so CI can block on crypto-hygiene violations (forbidden algorithms, weak key sizes, hardcoded keys, ...).

Package probe actively connects to network endpoints to discover the cryptography they negotiate: TLS version, cipher suite, and certificate chain.

Package remediate turns scan findings into concrete, reviewable source patches.

Package report renders scan results as CBOM and human-readable output.

Package risk classifies cryptographic assets by the threat they carry.

Package scan walks a target tree and runs detectors to produce findings.

Package store persists the cryptographic asset graph and diffs snapshots to detect drift between runs.

Package x509util holds certificate helpers shared by the file-based and network-based crypto detectors.