pkg/

Package cache stores scan results keyed by content hash so unchanged targets are not re-scanned.

Package config is Draugr's machine- and organization-level configuration, kept apart from the Saga on purpose.

Package diff compares two Draugr scan results and classifies every finding as new, fixed, or unchanged — the security delta of a change (typically a PR's head vs the base branch).

Package engine orchestrates a run: it expands a Saga into scan jobs (controllers × components), executes them with bounded parallelism, and aggregates each control's results.

Package exploit enriches a finding's severity with real-world exploitability signals: CISA KEV (Known Exploited Vulnerabilities — confirmed exploited in the wild) and FIRST EPSS (Exploit Prediction Scoring System — probability of exploitation).

Package norn evaluates scan results against policy to produce a verdict (pass/fail) per control and overall.

Package plugin is the Draugr plugin SDK.

Package prioritization turns a finding's severity and its component's risk classification (exposure × business criticality) into a single Priority band.

Package publish delivers rendered reports (report.Artifact) to destinations.

Package report renders a scan result in a chosen format.

Package saga defines the Draugr descriptor ("Saga") — the declarative account of an application's security surface (repositories, images, hosts, infrastructure) plus the controller configuration that drives a scan.

Package sarif provides Draugr's result currency: a pragmatic model of SARIF 2.1.0 findings, plus merge and deduplication.

Package sbom is the Software Bill of Materials surface: the document type a run produces and the contract for producing one.

Package skald renders scan results and verdicts into evidence: a JSON summary and merged SARIF.

Package surveyor is the discovery framework: plugins that inspect an environment and return Saga fragments, which are merged so the descriptor can write itself.

Package tooladapter turns an external command-line security tool into a Draugr Scanner declaratively: describe how to build the command for a target, and the adapter runs it and parses its SARIF output.

Package tui holds the terminal-presentation rules Draugr applies everywhere it writes for a person: when color is allowed, what the colors mean, and how to link to more detail.

Package vex reads OpenVEX documents somebody else wrote.