internal/

Package agent is the embeddable agent loop: it builds requests, calls the Upstream, parses responses, dispatches tools, and applies Mechanisms at the loop's hook points.

Package context manages the model's working context: Budget allocation, the context builder, generative Compaction (the default reducer), and tool-result capping.

Package domain is the ubiquitous language (CONTEXT.md) rendered as Go: every type, interface, enum, sentinel error, and hook working-value in Apogee's public surface, plus the pure logic intrinsic to those types (the Mechanism registry's ordering-cycle detection, ConfinementCaps.AutoEligible, the Session envelope and its versioning).

Package library is Apogee's cross-session, per-model learning substrate (CONTEXT "Library").

Package mcp is Apogee's Model Context Protocol client, built on the official Go SDK (github.com/modelcontextprotocol/go-sdk) over stdio / SSE / streamable-http.

Package mechanisms is the curated Mechanism catalogue: a constraint-declared registry that the loop resolves into a deterministic total order (topo-sort with a stable canonical-ID tiebreak — ADR 0003).

Package platform abstracts shell execution and path handling across POSIX and Windows, and hosts the Confiner backends (seatbelt / landlock / AppContainer) that gate Auto mode as a capability matrix (ADR 0004).

Package present holds the HOST-SIDE mechanisms of the presentation ladder (ADR 0019): the locality/desktop detection that decides which rung applies, the OS opener that auto-opens a deliverable on a user's own desktop, and the capability-token doc server that makes one reachable from the user's machine when Apogee runs remotely.

Package processing turns an Upstream response into the loop's domain values: it parses tool calls into domain.ToolCall and strips inline thinking / harmony channels from the assistant's visible content.

Package provider talks to the Upstream: it owns the Responder seam (the interface the engine calls instead of net/http), the provider-local wire types, and the OpenAI-compatible Client that implements the seam — non-streaming Respond plus a streaming Stream, with bounded retries and timeouts, /v1/models discovery, and a local server-process manager.

Package security holds Apogee's human-in-the-loop safety guardrails — the layer that runs in EVERY mode, distinct from Auto-mode Confinement (the OS-level Confiner in package platform).

Package session persists and reloads Agent snapshots — the same primitive the bench composes into forking and counterfactuals, which Apogee itself does not expose (ADR 0001).

Package skills discovers user-authored skills from disk and serves them as a catalog.

Package tools holds the built-in Tool implementations that sit behind the public domain.Tool interface — an open extension point (ADR 0002).

Package tui is the Bubble Tea terminal UI: a thin renderer over the agent's typed Events that supplies the Approval delegate.

Package validated implements the Validated-set runtime surface (ADR 0016 and its 2026-07-19 runtime-surface realisation): loading per-model Validated-set entries from the two sources (the embedded shipped bundle and the user-local drop-in dir), matching them against the resolved model fingerprint under the confidence-graded rule — auto-apply at ≥ medium confidence, offer at low, alias applies at any — and validating that an entry's enable set is whole and buildable against the current Mechanism catalogue (whole-set-or-nothing: a subset is an unvalidated stack and must not apply).