internal/

Package agent joins the tunnel to the tool plane: it accepts channels the SaaS opens and serves the ones it is willing to serve.

Package identity holds the agent's per-cluster mTLS identity.

Package toolplane serves the AI plane: read-only tools the SaaS may invoke over a tool channel.