kernel/

Package actions runs named verbs: each goes through policy, runs as a job and, unless it only reads, lands in the audit log.

Package audit appends every write to a JSONL log, secrets redacted.

Package cache keeps source answers for their TTL and runs one fetch per key at a time.

Package catalog lists what a project has, as typed resources: core kinds from rig.yaml and kinds plugins add, such as terraform.stack.

Package config composes a project's configuration from its layers and remembers where each value came from.

Package cron reads 5-field cron schedules.

Package events is the bus: plugins, the engine and agents publish typed events such as deploy.finished, and hooks subscribe by topic pattern.

Package frames reads and builds protocol frames: columnar, typed rows.

Package identity says who is calling: a person, the AI, an agent or an API token.

Package inbox keeps writes waiting for another person's approval, one JSON file each, with the plan of what they would do.

Package jobs keeps the operations a session runs (a build, a deploy, a task, a plugin action): their output, progress and end, for any renderer to show while they run and after.

Package policy decides whether a subject may run an action: allow, deny, confirm (the same person again), reauth (password or TOTP again) or approve (another person).

Package refs handles the URIs every resource and row can carry, such as svc://api or jira://PAY-12.

Package view turns view specs into renderer-neutral widget trees, fetches the frames widgets bind to and transforms them.