Help us shape the future of Go! Take the 2026 Go Developer Survey

knowledge-engine-toolkit

module
v0.0.19 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Oct 23, 2026 License: MIT

README

Tech AI Knowledge Engine

A generic, layered service substrate for building multi-language (Go + Python) backend systems — the reusable "how we build services" library. It carries no product-domain logic: just the foundation, clients, repositories, services, pipelines, workflows, transport, and batch-execution machinery that a service stack is assembled from, behind dependency-free core interfaces.

MIT-licensed and semantically versioned (the git tag is the source of truth). The design rules — layers, swappable components, decorators, error codes — are in ARCHITECTURE.md; contribution rules are in CONTRIBUTING.md.

Layout

go.mod                  ONE Go module: github.com/gt-tech-ai/knowledge-engine-toolkit (packages under go/)
go/
  core/                 Layer 0 — pure interfaces + types (no external deps)
  foundation/           Layer 1 — config, logger, metrics, tracer, resilience, cache, stream (bounded backpressured results),
                        codebase snapshot, reports, generators (gen, scaffold, pins, schemagen), dataset
  clients/              Layer 2 — external-system integration (db, cache, messaging, rpc, storage, lock, codebase,
                        git/helm/kubectl/docker/terraform, AWS, process, toolchain)
  repos/                Layer 3 — data-access base (repository, cursor, decorators)
  services/             Layer 4 — domain-service base, probe sets, tool runs
  pipelines/            Layer 5 — stateless transforms
  workflows/            Layer 6 — multi-step orchestration
  transport/            Layer 7 — HTTP/RPC/JSON:API, MCP, Cobra and cron front-ends
  execution/            batch fan-out substrate (discover → map → fan-out → aggregate), operations
                        registry and background runs
  helpers/              small shared utilities
  tests/                black-box tests (unit + integration via testcontainers), fixtures, generated mocks
python/
  techai_webutils/      the Python mirror of the Go substrate (published to PyPI)

Layers import downward only (core → foundation → clients → … → transport); .golangci.yml carries depguard rules for the boundaries. Every swappable component is a Kind + Config + factory (NewFromConfig in Go, new_<type>_from_config in Python), selected by configuration and injected at a composition root. See ARCHITECTURE.md.

Consuming

Go:

go get github.com/gt-tech-ai/knowledge-engine-toolkit@latest

import "github.com/gt-tech-ai/knowledge-engine-toolkit/go/foundation/logger"

Python:

pip install techai-webutils   # or: uv add techai-webutils

Developing

Mocks are generated by mockgen into go/tests/mocks/; regenerate them (as CI does) after changing a mocked interface:

go install go.uber.org/mock/mockgen@v0.6.0
go generate ./go/tests/mocks/...

Then run the checks:

# Go
go vet ./go/...
golangci-lint run ./go/...          # layer-boundary rules + the linter set
go test ./go/...                    # unit
go test -tags=integration ./go/...  # integration (real deps via testcontainers)

# Python
cd python/techai_webutils
uv run ruff check . && uv run basedpyright src && uv run pytest

Integration tests use real dependencies in throwaway Docker containers (testcontainers) — never fakes.

License

MIT — see LICENSE.

Directories

Path Synopsis
go
clients/analytics
Package analytics builds the AnalyticsStore: the zero-infrastructure stub (the default) or the CQL store (Apache Cassandra locally, Amazon Keyspaces in staging, chosen by the nested CQL config).
 Package analytics builds the AnalyticsStore: the zero-infrastructure stub (the default) or the CQL store (Apache Cassandra locally, Amazon Keyspaces in staging, chosen by the nested CQL config).
clients/analytics/cassandra
Package cassandra is the Cassandra-protocol AnalyticsStore (Apache Cassandra or Amazon Keyspaces behind clients/interfaces.CQLSession).
 Package cassandra is the Cassandra-protocol AnalyticsStore (Apache Cassandra or Amazon Keyspaces behind clients/interfaces.CQLSession).
clients/analytics/stub
Package stub is the default analytics store: it accepts every write and answers every query with an empty result, so the graph boots with no Cassandra.
 Package stub is the default analytics store: it accepts every write and answers every query with an empty result, so the graph boots with no Cassandra.
clients/aws/account
Package account resolves a named environment to an AWS session verified against the account it must run in: the config is loaded from the ambient credential chain or the env's shared profile, the credentials are retrieved once and pinned, and STS confirms whose they are, so a command can never act with credentials for another account.
 Package account resolves a named environment to an AWS session verified against the account it must run in: the config is loaded from the ambient credential chain or the env's shared profile, the credentials are retrieved once and pinned, and STS confirms whose they are, so a command can never act with credentials for another account.
clients/aws/bedrock
Package bedrock builds the Amazon Bedrock runtime client from config: the stub (the default) or the AWS SDK client over an injected aws.Config (sdk), run through the client tier (Decorate).
 Package bedrock builds the Amazon Bedrock runtime client from config: the stub (the default) or the AWS SDK client over an injected aws.Config (sdk), run through the client tier (Decorate).
clients/aws/iam
Package iam builds the AWS IAM client from config: the stub (the default) or the AWS SDK client over an injected aws.Config (sdk), run through the client tier (Decorate).
 Package iam builds the AWS IAM client from config: the stub (the default) or the AWS SDK client over an injected aws.Config (sdk), run through the client tier (Decorate).
clients/aws/route53
Package route53 builds the Amazon Route 53 client from config: the stub (the default) or the AWS SDK client over an injected aws.Config (sdk), run through the client tier (Decorate).
 Package route53 builds the Amazon Route 53 client from config: the stub (the default) or the AWS SDK client over an injected aws.Config (sdk), run through the client tier (Decorate).
clients/aws/secretsmanager
Package secretsmanager builds the AWS Secrets Manager client from config: the stub (the default) or the AWS SDK client over an injected aws.Config (sdk), run through the client tier (Decorate).
 Package secretsmanager builds the AWS Secrets Manager client from config: the stub (the default) or the AWS SDK client over an injected aws.Config (sdk), run through the client tier (Decorate).
clients/aws/servicequotas
Package servicequotas builds the AWS Service Quotas client from config: the stub (the default) or the AWS SDK client over an injected aws.Config (sdk), run through the client tier (Decorate).
 Package servicequotas builds the AWS Service Quotas client from config: the stub (the default) or the AWS SDK client over an injected aws.Config (sdk), run through the client tier (Decorate).
clients/aws/ses
Package ses builds the Amazon SES (v2) client from config: the stub (the default) or the AWS SDK client over an injected aws.Config (sdk), run through the client tier (Decorate).
 Package ses builds the Amazon SES (v2) client from config: the stub (the default) or the AWS SDK client over an injected aws.Config (sdk), run through the client tier (Decorate).
clients/aws/sts
Package sts builds the AWS STS client from config: the stub (the default) or the AWS SDK client over an injected aws.Config (sdk), run through the client tier (Decorate).
 Package sts builds the AWS STS client from config: the stub (the default) or the AWS SDK client over an injected aws.Config (sdk), run through the client tier (Decorate).
clients/cache
Package cache builds a ByteCache from config: the always-miss stub (the default) or Redis.
 Package cache builds a ByteCache from config: the always-miss stub (the default) or Redis.
clients/cache/redis
Package redis provides a Redis-backed cache implementation with singleflight support.
 Package redis provides a Redis-backed cache implementation with singleflight support.
clients/cache/stub
Package stub is the zero-infrastructure ByteCache: every Get misses and every write is dropped, so a graph boots and runs uncached without Redis.
 Package stub is the zero-infrastructure ByteCache: every Get misses and every write is dropped, so a graph boots and runs uncached without Redis.
clients/chaos
Package chaos builds the fault injector from config: the stub (the default), which injects nothing, or chaos-mesh, which creates and deletes Chaos Mesh custom resources with kubectl, run through the client tier (Decorate).
 Package chaos builds the fault injector from config: the stub (the default), which injects nothing, or chaos-mesh, which creates and deletes Chaos Mesh custom resources with kubectl, run through the client tier (Decorate).
clients/client
Package client is the client tier: the one decoration every outbound client (an SDK, a datastore, an HTTP API) runs its operations through.
 Package client is the client tier: the one decoration every outbound client (an SDK, a datastore, an HTTP API) runs its operations through.
clients/codebase
Package codebase builds a Codebase from config: the in-memory kind (the default), a plain directory, or a git working tree, each composed with the foundation/codebase views and run through the client tier (Decorate).
 Package codebase builds a Codebase from config: the in-memory kind (the default), a plain directory, or a git working tree, each composed with the foundation/codebase views and run through the client tier (Decorate).
clients/codebase/fs
Package fs is the plain-directory CodebaseSource: every file under a root, except the `.git` directory, with no version control.
 Package fs is the plain-directory CodebaseSource: every file under a root, except the `.git` directory, with no version control.
clients/codebase/git
Package git is the git working-tree CodebaseSource: the files git tracks plus the untracked files it does not ignore, read from disk, with Changed answered by `git diff --merge-base`.
 Package git is the git working-tree CodebaseSource: the files git tracks plus the untracked files it does not ignore, read from disk, with Changed answered by `git diff --merge-base`.
clients/codebase/memory
Package memory is the in-memory CodebaseSource: a map of root-relative paths to contents, with no version control.
 Package memory is the in-memory CodebaseSource: a map of root-relative paths to contents, with no version control.
clients/connector
Package connector builds ConnectorSources for the connector family: S3 now, a future GDrive/Salesforce kind added as a kinds-table entry + sibling package (ARCHITECTURE.md#the-one-idea).
 Package connector builds ConnectorSources for the connector family: S3 now, a future GDrive/Salesforce kind added as a kinds-table entry + sibling package (ARCHITECTURE.md#the-one-idea).
clients/connector/s3
Package s3 implements the S3 ConnectorSource for the connector family: a "test connection" probe that lists a bounded page under a connector's bucket/prefix using the connector's OWN credentials, over the shared StorageClient (INJECTED — this package never imports go/clients/storage, so there is no lateral same-layer import).
 Package s3 implements the S3 ConnectorSource for the connector family: a "test connection" probe that lists a bounded page under a connector's bucket/prefix using the connector's OWN credentials, over the shared StorageClient (INJECTED — this package never imports go/clients/storage, so there is no lateral same-layer import).
clients/cql
Package cql builds a CQL (Cassandra-protocol) Session — self-managed Apache Cassandra (KindCassandra, local and dev) or Amazon Keyspaces (KindKeyspaces, staging) — behind the consumer-side Session seam, so the choice is a config change.
 Package cql builds a CQL (Cassandra-protocol) Session — self-managed Apache Cassandra (KindCassandra, local and dev) or Amazon Keyspaces (KindKeyspaces, staging) — behind the consumer-side Session seam, so the choice is a config change.
clients/cql/cassandra
Package cassandra is the self-managed Apache Cassandra kind of clients/cql (local Compose, dev): a token-aware, DC-aware host policy, optional password auth and TLS, and speculative execution on idempotent reads.
 Package cassandra is the self-managed Apache Cassandra kind of clients/cql (local Compose, dev): a token-aware, DC-aware host policy, optional password auth and TLS, and speculative execution on idempotent reads.
clients/cql/driver
Package driver adapts the gocql driver to the CQLSession contract: Dial opens a session on a cluster configuration (built by a cql kind's subpackage), and every driver error is coded at this boundary.
 Package driver adapts the gocql driver to the CQLSession contract: Dial opens a session on a cluster configuration (built by a cql kind's subpackage), and every driver error is coded at this boundary.
clients/cql/keyspaces
Package keyspaces is the Amazon Keyspaces kind of clients/cql: the regional endpoint on port 9142, mandatory TLS with host verification, SigV4 authentication (the AWS SigV4 gocql plugin, credentials from an AWS credentials provider — the default chain, IRSA in-cluster) and DisableInitialHostLookup, per AWS guidance.
 Package keyspaces is the Amazon Keyspaces kind of clients/cql: the regional endpoint on port 9142, mandatory TLS with host verification, SigV4 authentication (the AWS SigV4 gocql plugin, credentials from an AWS credentials provider — the default chain, IRSA in-cluster) and DisableInitialHostLookup, per AWS guidance.
clients/database
Package database builds the SQL connection pool from config: PostgreSQL (postgres/) today, behind interfaces.DatabasePool, so switching engines is a config change.
 Package database builds the SQL connection pool from config: PostgreSQL (postgres/) today, behind interfaces.DatabasePool, so switching engines is a config change.
clients/database/postgres
Package postgres is the PostgreSQL backend of the database client tier: a lifecycle-managed *sql.DB pool (Client) plus ORM-independent pool utilities — a boot-time reachability probe (Ping) and a Prometheus pool-stats collector.
 Package postgres is the PostgreSQL backend of the database client tier: a lifecycle-managed *sql.DB pool (Client) plus ORM-independent pool utilities — a boot-time reachability probe (Ping) and a Prometheus pool-stats collector.
clients/docker
Package docker builds the DockerClient from config: the stub (the default) or the docker binary run through a CommandRunner (exec), run through the client tier (Decorate).
 Package docker builds the DockerClient from config: the stub (the default) or the docker binary run through a CommandRunner (exec), run through the client tier (Decorate).
clients/docker/exec
Package exec is the DockerClient that runs the docker binary through a CommandRunner.
 Package exec is the DockerClient that runs the docker binary through a CommandRunner.
clients/docker/stub
Package stub is the DockerClient with no daemon: builds, pushes and stacks succeed without effect, and no image exists.
 Package stub is the DockerClient with no daemon: builds, pushes and stacks succeed without effect, and no image exists.
clients/git
Package git builds the GitClient from config: the stub (the default) or the git binary run through a CommandRunner (exec), run through the client tier (Decorate).
 Package git builds the GitClient from config: the stub (the default) or the git binary run through a CommandRunner (exec), run through the client tier (Decorate).
clients/git/exec
Package exec is the GitClient that runs the git binary through a CommandRunner.
 Package exec is the GitClient that runs the git binary through a CommandRunner.
clients/git/stub
Package stub is the GitClient that touches nothing: every listing is empty, nothing has changed, and no directory is a repository.
 Package stub is the GitClient that touches nothing: every listing is empty, nothing has changed, and no directory is a repository.
clients/helm
Package helm builds the HelmClient from config: the stub (the default) or the helm binary run through a CommandRunner (exec), run through the client tier (Decorate), and adapts a HelmClient to the Renderer a Codebase renders charts with.
 Package helm builds the HelmClient from config: the stub (the default) or the helm binary run through a CommandRunner (exec), run through the client tier (Decorate), and adapts a HelmClient to the Renderer a Codebase renders charts with.
clients/helm/exec
Package exec is the HelmClient that runs the helm binary through a CommandRunner.
 Package exec is the HelmClient that runs the helm binary through a CommandRunner.
clients/helm/stub
Package stub is the HelmClient that renders nothing and fetches nothing.
 Package stub is the HelmClient that renders nothing and fetches nothing.
clients/jobs/river
Package river is the River job-queue client: the worker Runtime (pool + work loop), the InsertClient that enqueues from outside a worker, and Migrate for River's schema.
 Package river is the River job-queue client: the worker Runtime (pool + work loop), the InsertClient that enqueues from outside a worker, and Migrate for River's schema.
clients/kubectl
Package kubectl builds the KubectlClient from config: the stub (the default) or the kubectl binary run through a CommandRunner (exec), run through the client tier (Decorate).
 Package kubectl builds the KubectlClient from config: the stub (the default) or the kubectl binary run through a CommandRunner (exec), run through the client tier (Decorate).
clients/kubectl/exec
Package exec is the KubectlClient that runs the kubectl binary through a CommandRunner.
 Package exec is the KubectlClient that runs the kubectl binary through a CommandRunner.
clients/kubectl/stub
Package stub is the KubectlClient with no cluster: reads return empty lists and writes that name files succeed without effect.
 Package stub is the KubectlClient with no cluster: reads return empty lists and writes that name files succeed without effect.
clients/lock
Package lock builds a config-selected core/interfaces.Locker — a DistributedLock (keyed, token-fenced, best-effort) plus Hold, the managed acquire-with-watchdog helper a single-active-operation guard depends on.
 Package lock builds a config-selected core/interfaces.Locker — a DistributedLock (keyed, token-fenced, best-effort) plus Hold, the managed acquire-with-watchdog helper a single-active-operation guard depends on.
clients/lock/local
Package local provides an in-process DistributedLock backend for single-pod deployments (dev / replica=1), where cross-process coordination is unnecessary.
 Package local provides an in-process DistributedLock backend for single-pod deployments (dev / replica=1), where cross-process coordination is unnecessary.
clients/lock/redis
Package redis provides a cross-pod DistributedLock backend over Redis, for multi-replica deployments (staging/prod).
 Package redis provides a cross-pod DistributedLock backend over Redis, for multi-replica deployments (staging/prod).
clients/messaging
Package messaging builds the message publisher and consumer from config: the in-process memory broker (the default), SQS, or Redis Pub/Sub.
 Package messaging builds the message publisher and consumer from config: the in-process memory broker (the default), SQS, or Redis Pub/Sub.
clients/messaging/memory
Package memory provides an in-process messaging backend for no-infra builds and tests.
 Package memory provides an in-process messaging backend for no-infra builds and tests.
clients/messaging/redis
Package redis provides a Redis Pub/Sub messaging integration (publisher + subscriber) implementing the core MessagePublisher / MessageConsumer contracts over PUBLISH / SUBSCRIBE / PSUBSCRIBE.
 Package redis provides a Redis Pub/Sub messaging integration (publisher + subscriber) implementing the core MessagePublisher / MessageConsumer contracts over PUBLISH / SUBSCRIBE / PSUBSCRIBE.
clients/messaging/sqs
Package sqs provides an AWS-SDK-backed SQS messaging integration (publisher + subscriber) usable against real AWS SQS and against ElasticMQ for local dev.
 Package sqs provides an AWS-SDK-backed SQS messaging integration (publisher + subscriber) usable against real AWS SQS and against ElasticMQ for local dev.
clients/outbox
Package outbox builds the OutboxSink a transactional-outbox relay delivers through: the zero-infrastructure stub (the default), an SQS queue, or an S3 bucket, selected by Kind.
 Package outbox builds the OutboxSink a transactional-outbox relay delivers through: the zero-infrastructure stub (the default), an SQS queue, or an S3 bucket, selected by Kind.
clients/outbox/s3
Package s3 is the S3 OutboxSink: it writes each record as one object, keyed by a template, with a SHA-256 integrity checksum (Object Lock buckets require an integrity checksum and accept it in place of Content-MD5) and SSE-KMS when the record names a key.
 Package s3 is the S3 OutboxSink: it writes each record as one object, keyed by a template, with a SHA-256 integrity checksum (Object Lock buckets require an integrity checksum and accept it in place of Content-MD5) and SSE-KMS when the record names a key.
clients/outbox/sqs
Package sqs is the SQS OutboxSink: it routes each record to a queue, sends each queue's records with SendMessageBatch (at most 10 per request) and maps each entry's result back to its record.
 Package sqs is the SQS OutboxSink: it routes each record to a queue, sends each queue's records with SendMessageBatch (at most 10 per request) and maps each entry's result back to its record.
clients/outbox/stub
Package stub is the zero-infrastructure OutboxSink: it accepts every record and delivers nothing, so the graph boots with no queue or bucket.
 Package stub is the zero-infrastructure OutboxSink: it accepts every record and delivers nothing, so the graph boots with no queue or bucket.
clients/planstore
Package planstore builds the saved-plan store from config: local (the default), which leaves the plans where they were written, or object, which keeps them in an object store behind a SHA-256 manifest so a later job on another machine applies exactly them.
 Package planstore builds the saved-plan store from config: local (the default), which leaves the plans where they were written, or object, which keeps them in an object store behind a SHA-256 manifest so a later job on another machine applies exactly them.
clients/process
Package process builds the Supervisor from config: the stub (the default; starts nothing) or real operating-system processes (exec).
 Package process builds the Supervisor from config: the stub (the default; starts nothing) or real operating-system processes (exec).
clients/process/exec
Package exec is the Supervisor that runs real operating-system processes.
 Package exec is the Supervisor that runs real operating-system processes.
clients/process/stub
Package stub is the Supervisor that starts nothing: every process is ready at once and exits cleanly when stopped.
 Package stub is the Supervisor that starts nothing: every process is ready at once and exits cleanly when stopped.
clients/prometheus
Package prometheus builds the MetricsQuerier from config: the zero-infrastructure stub (the default) or the HTTP query API, its requests run through the client tier.
 Package prometheus builds the MetricsQuerier from config: the zero-infrastructure stub (the default) or the HTTP query API, its requests run through the client tier.
clients/prometheus/http
Package http is the HTTP backend of the Prometheus querier: instant queries reduced to one sample, and range queries reduced to one series, over a Prometheus server's HTTP query API.
 Package http is the HTTP backend of the Prometheus querier: instant queries reduced to one sample, and range queries reduced to one series, over a Prometheus server's HTTP query API.
clients/prometheus/stub
Package stub is the zero-infrastructure metrics querier: every instant query is 0 and every range query an empty series, with no network I/O.
 Package stub is the zero-infrastructure metrics querier: every instant query is 0 and every range query an empty series, with no network I/O.
clients/prompt
Package prompt builds the Prompter from config: deny (the default), which refuses every question for a front-end with no operator, or tty, which asks an operator through injected streams, so a capability never reads process stdin.
 Package prompt builds the Prompter from config: deny (the default), which refuses every question for a front-end with no operator, or tty, which asks an operator through injected streams, so a capability never reads process stdin.
clients/prompt/deny
Package deny is the Prompter backend for a front-end with no operator (an MCP server, a web app, CI): it refuses every question with the --yes guidance instead of blocking.
 Package deny is the Prompter backend for a front-end with no operator (an MCP server, a web app, CI): it refuses every question with the --yes guidance instead of blocking.
clients/prompt/tty
Package tty is the interactive Prompter backend: it writes the question to an injected writer and reads a y/N answer from an injected reader.
 Package tty is the interactive Prompter backend: it writes the question to an injected writer and reads a y/N answer from an injected reader.
clients/replaybuffer
Package replaybuffer builds a ReplayBuffer from config — the in-process memory buffer (single pod; the default) or Redis (cross-pod) — and runs it through the client tier (Decorate).
 Package replaybuffer builds a ReplayBuffer from config — the in-process memory buffer (single pod; the default) or Redis (cross-pod) — and runs it through the client tier (Decorate).
clients/replaybuffer/memory
Package memory provides an in-process ReplayBuffer backend for single-pod deployments (dev / replica=1), where a reconnect lands on the same pod so cross-pod sharing is unnecessary.
 Package memory provides an in-process ReplayBuffer backend for single-pod deployments (dev / replica=1), where a reconnect lands on the same pod so cross-pod sharing is unnecessary.
clients/replaybuffer/redis
Package redis provides a cross-pod ReplayBuffer backend over Redis, for multi-replica deployments (staging/prod) where a reconnect may land on a different pod than the one that buffered the tail.
 Package redis provides a cross-pod ReplayBuffer backend over Redis, for multi-replica deployments (staging/prod) where a reconnect may land on a different pod than the one that buffered the tail.
clients/rpc
Package rpc builds the RPC client from config: gRPC (grpc/) today, behind RPCClient, so switching RPC frameworks is a config change.
 Package rpc builds the RPC client from config: gRPC (grpc/) today, behind RPCClient, so switching RPC frameworks is a config change.
clients/rpc/connect/interceptors
Package interceptors runs a generated Connect client's calls through the client tier (client.Tier): ClientOptions installs it as a Connect client interceptor.
 Package interceptors runs a generated Connect client's calls through the client tier (client.Tier): ClientOptions installs it as a Connect client interceptor.
clients/rpc/grpc
Package grpc dials gRPC client connections: NewClient builds one, and Client manages it as a lifecycle-managed, health-checkable client (interfaces.Client).
 Package grpc dials gRPC client connections: NewClient builds one, and Client manages it as a lifecycle-managed, health-checkable client (interfaces.Client).
clients/rpc/grpc/interceptors
Package interceptors runs a gRPC client connection's calls through the client tier (client.Tier): ClientOptions installs it as dial options, carrying the trace context and the service token on every call.
 Package interceptors runs a gRPC client connection's calls through the client tier (client.Tier): ClientOptions installs it as dial options, carrying the trace context and the service token on every call.
clients/rpc/wire
Package wire is the codec between RPC status codes (Connect and gRPC share one code space) and the domain's apperr codes.
 Package wire is the codec between RPC status codes (Connect and gRPC share one code space) and the domain's apperr codes.
clients/secrets
Package secrets is the credential-source client tier: it selects a secret backend — an environment variable (env/), a git-ignored local file (file/), or AWS Secrets Manager (awssm/) — by Kind (env when empty) and returns the interfaces.Source contract, so switching where a credential is read is a configuration change, not a caller edit.
 Package secrets is the credential-source client tier: it selects a secret backend — an environment variable (env/), a git-ignored local file (file/), or AWS Secrets Manager (awssm/) — by Kind (env when empty) and returns the interfaces.Source contract, so switching where a credential is read is a configuration change, not a caller edit.
clients/secrets/awssm
Package awssm implements the AWS Secrets Manager credential Source: it reads a credential from a Secrets Manager secret (a JSON object) named by a caller-supplied Ref→location mapping, extracting the configured JSON field.
 Package awssm implements the AWS Secrets Manager credential Source: it reads a credential from a Secrets Manager secret (a JSON object) named by a caller-supplied Ref→location mapping, extracting the configured JSON field.
clients/secrets/env
Package env implements the environment-variable credential Source: it resolves a Ref to a configured environment variable name and reads its value via os.Getenv.
 Package env implements the environment-variable credential Source: it resolves a Ref to a configured environment variable name and reads its value via os.Getenv.
clients/secrets/file
Package file implements the file-backed credential Source: it reads and writes credentials in a git-ignored local file (a dotenv-style KEY=value store) named by a caller-supplied Ref→location mapping.
 Package file implements the file-backed credential Source: it reads and writes credentials in a git-ignored local file (a dotenv-style KEY=value store) named by a caller-supplied Ref→location mapping.
clients/session
Package session resolves a credential from a secrets Source, verifies it once, and projects it into the environment a command runs with: the session a CLI command opens before it calls a cloud or an identity provider.
 Package session resolves a credential from a secrets Source, verifies it once, and projects it into the environment a command runs with: the session a CLI command opens before it calls a cloud or an identity provider.
clients/storage
Package storage builds the StorageClient from config: the in-memory backend (the default) or an S3-compatible one (AWS S3 or MinIO), run through the client tier (Decorate).
 Package storage builds the StorageClient from config: the in-memory backend (the default) or an S3-compatible one (AWS S3 or MinIO), run through the client tier (Decorate).
clients/storage/memory
Package memory provides an in-memory StorageClient backend for no-infra builds and tests.
 Package memory provides an in-memory StorageClient backend for no-infra builds and tests.
clients/storage/s3
Package s3 implements the StorageClient against S3-compatible object stores (AWS S3 and MinIO), selected by configuration.
 Package s3 implements the StorageClient against S3-compatible object stores (AWS S3 and MinIO), selected by configuration.
clients/terraform
Package terraform builds the TerraformClient from config: the stub (the default) or the terraform binary run through a CommandRunner (exec), run through the client tier (Decorate).
 Package terraform builds the TerraformClient from config: the stub (the default) or the terraform binary run through a CommandRunner (exec), run through the client tier (Decorate).
clients/terraform/exec
Package exec is the TerraformClient that runs the terraform binary through a CommandRunner.
 Package exec is the TerraformClient that runs the terraform binary through a CommandRunner.
clients/terraform/stub
Package stub is the TerraformClient that plans no changes and applies nothing.
 Package stub is the TerraformClient that plans no changes and applies nothing.
clients/toolchain
Package toolchain owns a developer tool chain's lifecycle, projected from one list of types.ToolEntry values (a tool manifest the consumer loads and checks with types.ValidateToolEntries; the manifest's schema lives in core/types so a foundation-tier manifest can hold it).
 Package toolchain owns a developer tool chain's lifecycle, projected from one list of types.ToolEntry values (a tool manifest the consumer loads and checks with types.ValidateToolEntries; the manifest's schema lives in core/types so a foundation-tier manifest can hold it).
core/errors
Package errors provides application error types and codes, and the request-scoped error sink that keeps a domain error's real cause behind its sanitized transport error.
 Package errors provides application error types and codes, and the request-scoped error sink that keeps a domain error's real cause behind its sanitized transport error.
core/events
Package events is the generic event contract: the Event interface, the metadata every event carries, and a Registry a consumer fills with its own event catalog to parse payloads.
 Package events is the generic event contract: the Event interface, the metadata every event carries, and a Registry a consumer fills with its own event catalog to parse payloads.
core/interfaces
Package interfaces defines the core contracts for the Tech AI Knowledge Engine.
 Package interfaces defines the core contracts for the Tech AI Knowledge Engine.
core/principal
Package principal carries the request's resolved principal — the consumer's own caller type (its authorization model) — in a context.Context.
 Package principal carries the request's resolved principal — the consumer's own caller type (its authorization model) — in a context.Context.
core/tenant
Package tenant carries the request-scoped tenant (organization) identity in a context.Context.
 Package tenant carries the request-scoped tenant (organization) identity in a context.Context.
core/types
Package types provides shared domain types used across the platform.
 Package types provides shared domain types used across the platform.
execution/engine
Package engine provides execution infrastructure: bounded concurrent fan-out, observer dispatch, job-group execution, and simple function steps.
 Package engine provides execution infrastructure: bounded concurrent fan-out, observer dispatch, job-group execution, and simple function steps.
execution/gate
Package gate composes AnyJobs into a Gate of ordered phases, run with stop-on-failure and error aggregation.
 Package gate composes AnyJobs into a Gate of ordered phases, run with stop-on-failure and error aggregation.
execution/job
Package job is the job tier: a Base, one per job, decorates the job it builds with the job tier (recovery, logging, tracing, metrics, timeout), so a job is a function plus its name and group, never a hand-written AnyJob type.
 Package job is the job tier: a Base, one per job, decorates the job it builds with the job tier (recovery, logging, tracing, metrics, timeout), so a job is a function plus its name and group, never a hand-written AnyJob type.
execution/ops
Package ops is an operations registry: one set of typed operations that several front-ends run the same way, such as a CLI, an MCP server (transport/mcp) and a scheduled job (transport/cron).
 Package ops is an operations registry: one set of typed operations that several front-ends run the same way, such as a CLI, an MCP server (transport/mcp) and a scheduled job (transport/cron).
execution/runs
Package runs is the background-run table a front-end uses for long_running operations: Start reserves the operations registry's working-tree slot under a new run id and runs the operation in a goroutine, and Status / Result / Cancel / List address the run by that id afterwards.
 Package runs is the background-run table a front-end uses for long_running operations: Start reserves the operations registry's working-tree slot under a new run id and runs the operation in a goroutine, and Status / Result / Cancel / List address the run by that id afterwards.
foundation/cache
Package cache provides caching utilities for the foundation layer.
 Package cache provides caching utilities for the foundation layer.
foundation/cache/decorators
Package decorators provides cache decorators for cross-cutting concerns.
 Package decorators provides cache decorators for cross-cutting concerns.
foundation/chartspec
Package chartspec is the pure visual-algebra compiler of the analytics engine.
 Package chartspec is the pure visual-algebra compiler of the analytics engine.
foundation/codebase
Package codebase builds a Codebase, a read-only view of one codebase, over a CodebaseSource: file selection, contents, pattern matches, the Go and YAML parsed forms and rendered charts.
 Package codebase builds a Codebase, a read-only view of one codebase, over a CodebaseSource: file selection, contents, pattern matches, the Go and YAML parsed forms and rendered charts.
foundation/config
Package config provides a factory for ConfigLoader implementations with multiple backends.
 Package config provides a factory for ConfigLoader implementations with multiple backends.
foundation/config/schema/decoration
Package decoration is the config surface for every decorated component — controllers, clients, workflows, pipelines, services, repositories, stores, jobs and gates.
 Package decoration is the config surface for every decorated component — controllers, clients, workflows, pipelines, services, repositories, stores, jobs and gates.
foundation/config/schema/infra
Package infra provides typed configuration structures for Tech AI Knowledge Engine services.
 Package infra provides typed configuration structures for Tech AI Knowledge Engine services.
foundation/config/schema/listquery
Package listquery is the config surface for the list-query value-suggestion facet: the row threshold above which a facet-eligible field is served from the maintained distinct_values table instead of a live DISTINCT, and the interval at which the reconcile job recomputes refcounts.
 Package listquery is the config surface for the list-query value-suggestion facet: the row threshold above which a facet-eligible field is served from the maintained distinct_values table instead of a live DISTINCT, and the interval at which the reconcile job recomputes refcounts.
foundation/config/schema/pipelines
Package pipelines is the config surface for the pipeline (orchestration) layer: the multipart-upload sizing (a pipeline's timeout is a decoration layer, decoration.pipelines).
 Package pipelines is the config surface for the pipeline (orchestration) layer: the multipart-upload sizing (a pipeline's timeout is a decoration layer, decoration.pipelines).
foundation/config/schema/repos
Package repos is the config surface for the repository (data-access) layer: the entity cache's TTL, version and key prefix.
 Package repos is the config surface for the repository (data-access) layer: the entity cache's TTL, version and key prefix.
foundation/config/schema/resilience
Package resilience is the tunable config surface for the foundation resilience decorators (retry, breaker, rate-limit, bulkhead, timeout, budget) — the per-environment knobs threaded through the repo/client/interceptor providers Each struct mirrors its primitive's tunable fields with defaults identical to the primitive's DefaultConfig(), so adopting the config surface is behavior-preserving; the providers convert these into the primitive's options.
 Package resilience is the tunable config surface for the foundation resilience decorators (retry, breaker, rate-limit, bulkhead, timeout, budget) — the per-environment knobs threaded through the repo/client/interceptor providers Each struct mirrors its primitive's tunable fields with defaults identical to the primitive's DefaultConfig(), so adopting the config surface is behavior-preserving; the providers convert these into the primitive's options.
foundation/config/schema/stores
Package stores is the config surface for the data (stores) layer: the ORM the stores are built on (Kind), the page-size cap, the per-resource default page sizes and the list-query caches, so a deployer can tune pagination without a rebuild.
 Package stores is the config surface for the data (stores) layer: the ORM the stores are built on (Kind), the page-size cap, the per-resource default page sizes and the list-query caches, so a deployer can tune pagination without a rebuild.
foundation/config/schema/transport
Package transport is the config surface for the edge (transport) layer: WebSocket, gRPC, CORS and HTTP tuning.
 Package transport is the config surface for the edge (transport) layer: WebSocket, gRPC, CORS and HTTP tuning.
foundation/config/schema/workers
Package workers is the shared config surface for background workers: the common tunables (name, telemetry, relay and sweep cadences, batching) plus the sweep-timing cross-field invariant, so every worker inherits the typed-field + Validate shape.
 Package workers is the shared config surface for background workers: the common tunables (name, telemetry, relay and sweep cadences, batching) plus the sweep-timing cross-field invariant, so every worker inherits the typed-field + Validate shape.
foundation/config/viper
Package viper provides a Viper-backed ConfigLoader implementation.
 Package viper provides a Viper-backed ConfigLoader implementation.
foundation/convert
Package convert maps values across an API boundary: EnumMapper pairs a proto enum with a domain enum from one table, ParseUUID parses a request id as invalid input when malformed, and Int32OrPanic / CountToInt32 narrow counts to a proto int32.
 Package convert maps values across an API boundary: EnumMapper pairs a proto enum with a domain enum from one table, ParseUUID parses a request id as invalid input when malformed, and Int32OrPanic / CountToInt32 narrow counts to a proto int32.
foundation/crypto
Package crypto provides authenticated symmetric encryption for data at rest — e.g.
 Package crypto provides authenticated symmetric encryption for data at rest — e.g.
foundation/dataset
Package dataset merge-loads a directory of YAML data files into one set of top-level sections and decodes each section strictly into a typed value, so a front-end's repository data (tools, paths, checks) can be split across files by topic without a key silently overriding another or a misspelled field being dropped.
 Package dataset merge-loads a directory of YAML data files into one set of top-level sections and decodes each section strictly into a typed value, so a front-end's repository data (tools, paths, checks) can be split across files by topic without a key silently overriding another or a misspelled field being dropped.
foundation/decorate
Package decorate is the type-agnostic operation-decoration mechanism: a common OpMiddleware interface, a Chain composer, and a generic Exec[R] runner that wraps ANY named operation with the cross-cutting decorator stack, regardless of the operation's return type.
 Package decorate is the type-agnostic operation-decoration mechanism: a common OpMiddleware interface, a Chain composer, and a generic Exec[R] runner that wraps ANY named operation with the cross-cutting decorator stack, regardless of the operation's return type.
foundation/dtovalidate
Package dtovalidate is the leaf rule library the generated DTO Validate() methods compose Each rule is a small, hand-written check that REUSES the standard library (google/uuid, net/url, path/filepath, net/mail) rather than a hand-rolled regex, and returns a core/errors CodeInvalidInput AppError on violation so the failure classifies to 400 / InvalidArgument at the boundary.
 Package dtovalidate is the leaf rule library the generated DTO Validate() methods compose Each rule is a small, hand-written check that REUSES the standard library (google/uuid, net/url, path/filepath, net/mail) rather than a hand-rolled regex, and returns a core/errors CodeInvalidInput AppError on violation so the failure classifies to 400 / InvalidArgument at the boundary.
foundation/fsys
Package fsys provides a real-OS filesystem implementation of the FS interface defined in core/interfaces.
 Package fsys provides a real-OS filesystem implementation of the FS interface defined in core/interfaces.
foundation/gen
Package gen checks a Generator's committed outputs for drift and writes fresh ones.
 Package gen checks a Generator's committed outputs for drift and writes fresh ones.
foundation/git
Package git provides reusable git operations for the CLI and tooling layers.
 Package git provides reusable git operations for the CLI and tooling layers.
foundation/impact
Package impact maps changed paths to the units they affect: a deploy row, a module, a chart.
 Package impact maps changed paths to the units they affect: a deploy row, a module, a chart.
foundation/jsonapi
Package jsonapi is the [JSON:API](https://jsonapi.org/format/) codec: it rewrites a proto-JSON REST response into the {data, meta, links, errors} envelope (TransformSingleResource, TransformCollection, TransformMeta, TransformError).
 Package jsonapi is the [JSON:API](https://jsonapi.org/format/) codec: it rewrites a proto-JSON REST response into the {data, meta, links, errors} envelope (TransformSingleResource, TransformCollection, TransformMeta, TransformError).
foundation/lifecycle
Package lifecycle provides a Manager that starts a set of lifecycle-managed clients in registration order and stops them in reverse for graceful shutdown, so a composition root wires its clients once and coordinates their startup and teardown centrally instead of by hand.
 Package lifecycle provides a Manager that starts a set of lifecycle-managed clients in registration order and stops them in reverse for graceful shutdown, so a composition root wires its clients once and coordinates their startup and teardown centrally instead of by hand.
foundation/listquery
Package listquery is the pure, ORM-free half of the list-query SDK a per-resource filter allow-list (Map) + sort allow-list (Set), a JSON filter-DSL parser that compiles a client filter string into the core/types Filter contract (gated by the allow-list so only allow-listed fields with type-checked values reach a query), and the shared Compile/CompileOrder fold that walks that IR through a core/interfaces.QueryBackend algebra.
 Package listquery is the pure, ORM-free half of the list-query SDK a per-resource filter allow-list (Map) + sort allow-list (Set), a JSON filter-DSL parser that compiles a client filter string into the core/types Filter contract (gated by the allow-list so only allow-listed fields with type-checked values reach a query), and the shared Compile/CompileOrder fold that walks that IR through a core/interfaces.QueryBackend algebra.
foundation/logger
Package logger provides structured logging with multiple backend implementations.
 Package logger provides structured logging with multiple backend implementations.
foundation/logger/logctx
Package logctx provides shared context utilities for logger sub-packages.
 Package logctx provides shared context utilities for logger sub-packages.
foundation/logger/stdlib
Package stdlib provides a pure stdlib slog logger implementation.
 Package stdlib provides a pure stdlib slog logger implementation.
foundation/logger/zap
Package zap provides a zap-backed logger implementation with PII redaction.
 Package zap provides a zap-backed logger implementation with PII redaction.
foundation/metrics
Package metrics provides a builder for the Prometheus metrics implementation.
 Package metrics provides a builder for the Prometheus metrics implementation.
foundation/metrics/noop
Package noop provides a no-op metrics implementation that silently discards all metric operations.
 Package noop provides a no-op metrics implementation that silently discards all metric operations.
foundation/metrics/prom
Package prom provides a Prometheus-backed metrics implementation.
 Package prom provides a Prometheus-backed metrics implementation.
foundation/middleware
Package middleware provides stdlib net/http middleware for composing request processing pipelines without external web frameworks.
 Package middleware provides stdlib net/http middleware for composing request processing pipelines without external web frameworks.
foundation/options
Package options provides a generic functional options pattern for configuring types.
 Package options provides a generic functional options pattern for configuring types.
foundation/pins
Package pins keeps a Renovate config in step with a codebase: it detects which dependency ecosystems the codebase holds (Detect), renders renovate.json from them and a consumer's update Policy (Render), and exposes the render as a Generator, so a drift check fails when an ecosystem appears and the config was not regenerated.
 Package pins keeps a Renovate config in step with a codebase: it detects which dependency ecosystems the codebase holds (Detect), renders renovate.json from them and a consumer's update Policy (Render), and exposes the render as a Generator, so a drift check fails when an ecosystem appears and the config was not regenerated.
foundation/report
Package report renders a gate's progress and a CLI's console output.
 Package report renders a gate's progress and a CLI's console output.
foundation/resilience
Package resilience provides fault-tolerance primitives as standalone subpackages.
 Package resilience provides fault-tolerance primitives as standalone subpackages.
foundation/resilience/adaptivethrottle
Package adaptivethrottle provides a client-side adaptive throttler (Google SRE "Handling Overload"): it sheds a growing fraction of outbound requests locally when a backend's accept-rate drops, protecting the backend from a client-side retry storm.
 Package adaptivethrottle provides a client-side adaptive throttler (Google SRE "Handling Overload"): it sheds a growing fraction of outbound requests locally when a backend's accept-rate drops, protecting the backend from a client-side retry storm.
foundation/resilience/budget
Package budget tracks retry consumption across a call chain via context propagation.
 Package budget tracks retry consumption across a call chain via context propagation.
foundation/resilience/bulkhead
Package bulkhead provides a builder for Bulkhead implementations with multiple backends.
 Package bulkhead provides a builder for Bulkhead implementations with multiple backends.
foundation/resilience/bulkhead/adaptive
Package adaptive provides a self-tuning (AIMD) concurrency-limiting Bulkhead.
 Package adaptive provides a self-tuning (AIMD) concurrency-limiting Bulkhead.
foundation/resilience/bulkhead/channel
Package channel provides a channel-based semaphore bulkhead implementation.
 Package channel provides a channel-based semaphore bulkhead implementation.
foundation/resilience/bulkhead/keyed
Package keyed is the in-process KeyedLimiter: a per-key counting semaphore that refuses, rather than waits, once a key holds its cap.
 Package keyed is the in-process KeyedLimiter: a per-key counting semaphore that refuses, rather than waits, once a key holds its cap.
foundation/resilience/circuitbreaker
Package circuitbreaker provides a builder for CircuitBreaker implementations with multiple backends.
 Package circuitbreaker provides a builder for CircuitBreaker implementations with multiple backends.
foundation/resilience/circuitbreaker/gobreaker
Package gobreaker provides a circuit breaker backed by sony/gobreaker/v2.
 Package gobreaker provides a circuit breaker backed by sony/gobreaker/v2.
foundation/resilience/deadletter
Package deadletter provides the dead-letter-queue facade — the Go mirror of techai_webutils.foundation.resilience.dlq.
 Package deadletter provides the dead-letter-queue facade — the Go mirror of techai_webutils.foundation.resilience.dlq.
foundation/resilience/dedup
Package dedup provides message deduplication for exactly-once processing under at-least-once delivery.
 Package dedup provides message deduplication for exactly-once processing under at-least-once delivery.
foundation/resilience/hedge
Package hedge provides a builder for Hedger implementations that reduce tail latency by racing a backup attempt.
 Package hedge provides a builder for Hedger implementations that reduce tail latency by racing a backup attempt.
foundation/resilience/leader
Package leader provides leader election for single-instance job execution.
 Package leader provides leader election for single-instance job execution.
foundation/resilience/pausegate
Package pausegate stops a consumer pulling work while its downstream is unavailable.
 Package pausegate stops a consumer pulling work while its downstream is unavailable.
foundation/resilience/ratelimiter
Package ratelimiter provides a builder for RateLimiter implementations with multiple backends.
 Package ratelimiter provides a builder for RateLimiter implementations with multiple backends.
foundation/resilience/ratelimiter/token
Package token provides a token-bucket rate limiter backed by golang.org/x/time/rate.
 Package token provides a token-bucket rate limiter backed by golang.org/x/time/rate.
foundation/resilience/reswire
Package reswire builds the resilience primitives that are not decoration layers — the tail-latency hedger and the adaptive throttle — from a ConfigLoader and the schema/resilience config surface, starting from the schema defaults so an absent overlay is behavior-preserving.
 Package reswire builds the resilience primitives that are not decoration layers — the tail-latency hedger and the adaptive throttle — from a ConfigLoader and the schema/resilience config surface, starting from the schema defaults so an absent overlay is behavior-preserving.
foundation/resilience/retry
Package retry provides a builder for Retrier implementations with multiple backends.
 Package retry provides a builder for Retrier implementations with multiple backends.
foundation/resilience/retry/exponential
Package exponential provides an exponential backoff retrier using cenkalti/backoff/v5.
 Package exponential provides an exponential backoff retrier using cenkalti/backoff/v5.
foundation/scaffold
Package scaffold plans and applies the files a template set generates into a codebase, honoring each file's policy (written once, regenerated, or regenerated above a preserve marker).
 Package scaffold plans and applies the files a template set generates into a codebase, honoring each file's policy (written once, regenerated, or regenerated above a preserve marker).
foundation/schemagen
Package schemagen derives documentation artifacts from Go and Python config sources: JSON Schema (Draft 2020-12) reflected from Go types (For, Reflect), the allowed values of each config-selected Kind (ExtractGoKinds, ExtractPythonKinds), and a markdown config reference rendered as a Generator (NewConfigDocs) with its documentation audit (AuditContract).
 Package schemagen derives documentation artifacts from Go and Python config sources: JSON Schema (Draft 2020-12) reflected from Go types (For, Reflect), the allowed values of each config-selected Kind (ExtractGoKinds, ExtractPythonKinds), and a markdown config reference rendered as a Generator (NewConfigDocs) with its documentation audit (AuditContract).
foundation/stepcache
Package stepcache builds a StepCache from config: off (the default, never hits) or dir (one marker file per passed key under a directory), and derives the content-addressed key a step is cached under.
 Package stepcache builds a StepCache from config: off (the default, never hits) or dir (one marker file per passed key under a directory), and derives the content-addressed key a step is cached under.
foundation/stream
Package stream is the engine's substrate for large, pull-based results over interfaces.Stream.
 Package stream is the engine's substrate for large, pull-based results over interfaces.Stream.
foundation/system
Package system provides CommandRunner implementations for executing external commands.
 Package system provides CommandRunner implementations for executing external commands.
foundation/tracer
Package tracer provides distributed tracing with swappable backends.
 Package tracer provides distributed tracing with swappable backends.
foundation/tracer/nooptracer
Package nooptracer provides a no-op tracer that satisfies interfaces.Tracer.
 Package nooptracer provides a no-op tracer that satisfies interfaces.Tracer.
foundation/tracer/oteltracer
Package oteltracer provides an OpenTelemetry-backed tracer implementation.
 Package oteltracer provides an OpenTelemetry-backed tracer implementation.
foundation/validator
Package validator provides a small, generic business-rule validator for the service layer — the below-transport-boundary complement to the proto/request validation performed at the transport edge (connect ValidateInterceptor).
 Package validator provides a small, generic business-rule validator for the service layer — the below-transport-boundary complement to the proto/request validation performed at the transport edge (connect ValidateInterceptor).
foundation/yamlq
Package yamlq queries and edits YAML documents by path.
 Package yamlq queries and edits YAML documents by path.
helpers
pipelines/pipeline
Package pipeline is the pipeline tier: a Base, built from the pipeline's contract, is the embeddable core of a consumer's pipeline, running each operation through the tier's decoration (Tier) with the promoted Exec or as a stage (Base.Stage) that composes with Stage.Then or runs side by side with Base.FanOut.
 Package pipeline is the pipeline tier: a Base, built from the pipeline's contract, is the embeddable core of a consumer's pipeline, running each operation through the tier's decoration (Tier) with the promoted Exec or as a stage (Base.Stage) that composes with Stage.Then or runs side by side with Base.FanOut.
repos/outbox
Package outbox is the repository tier of the transactional outbox: the relay's seam over an outbox store (stores/outbox).
 Package outbox is the repository tier of the transactional outbox: the relay's seam over an outbox store (stores/outbox).
repos/repository
Package repository is the repository tier: a Base, built from the repository's contract, is the embeddable core of a consumer's repository, running its custom queries through the tier's decoration (Tier) with the promoted Exec.
 Package repository is the repository tier: a Base, built from the repository's contract, is the embeddable core of a consumer's repository, running its custom queries through the tier's decoration (Tier) with the promoted Exec.
services/guard
Package guard builds repository checks from data: each types.GuardRow becomes one or more interfaces.Guard probes over a codebase.
 Package guard builds repository checks from data: each types.GuardRow becomes one or more interfaces.Guard probes over a codebase.
services/probe
Package probe runs a set of probes against one target as one service operation: in parallel, each under its own deadline, retrying transient failures, with one step per probe in probe order.
 Package probe runs a set of probes against one target as one service operation: in parallel, each under its own deadline, retrying transient failures, with one step per probe in probe order.
services/probe/readiness
Package readiness holds the read-only probes that a cloud deployment's prerequisites are in place before it is rolled out: bootstrap secrets, DNS delegation, SES production access, invokable Bedrock models, service quotas, registry pull grants, an OIDC tenant's discovery document and cluster access.
 Package readiness holds the read-only probes that a cloud deployment's prerequisites are in place before it is rolled out: bootstrap secrets, DNS delegation, SES production access, invokable Bedrock models, service quotas, registry pull grants, an OIDC tenant's discovery document and cluster access.
services/procedure
Package procedure runs procedures from data: ordered steps that invoke toolchain tools over variables, capture their output, branch and loop on CEL expressions, ask for confirmation, call other procedures and hand the residue to registered Go steps.
 Package procedure runs procedures from data: ordered steps that invoke toolchain tools over variables, capture their output, branch and loop on CEL expressions, ask for confirmation, call other procedures and hand the residue to registered Go steps.
services/service
Package service is the service tier: a Base, built from the service's contract, is the embeddable core of a consumer's service, running its custom operations through the tier's decoration (Tier) with the promoted Exec.
 Package service is the service tier: a Base, built from the service's contract, is the embeddable core of a consumer's service, running its custom operations through the tier's decoration (Tier) with the promoted Exec.
services/suite
Package suite builds the gate of a suite-backed command from data: a types.Suite selects entries of a catalog (tool runs, guards, procedures and registered steps) by flag, and runs one decorated job per entry in the suite's phases.
 Package suite builds the gate of a suite-backed command from data: a types.Suite selects entries of a catalog (tool runs, guards, procedures and registered steps) by flag, and runs one decorated job per entry in the suite's phases.
services/toolrun
Package toolrun executes tool runs, the manifest rows that drive an external binary: it checks the tool is installed, selects targets (selectors/), fans out one invocation per target or runs once over all of them, skips steps whose inputs a previous pass already covered (the step cache), and turns output into a verdict (parsers/).
 Package toolrun executes tool runs, the manifest rows that drive an external binary: it checks the tool is installed, selects targets (selectors/), fans out one invocation per target or runs once over all of them, skips steps whose inputs a previous pass already covered (the step cache), and turns output into a verdict (parsers/).
services/toolrun/parsers
Package parsers holds the Parser kinds that turn a tool's output into a verdict: exit_code, gcc, json_lines, sarif and empty_output.
 Package parsers holds the Parser kinds that turn a tool's output into a verdict: exit_code, gcc, json_lines, sarif and empty_output.
services/toolrun/selectors
Package selectors holds the TargetSelector kinds a tool run picks its targets with: files, go_modules, python_projects, ts_workspace and staged_files.
 Package selectors holds the TargetSelector kinds a tool run picks its targets with: files, go_modules, python_projects, ts_workspace and staged_files.
stores/ent
Package ent is the Ent kind of the store tier (store.KindEnt): the Ent/SQL backend of the list-query compiler — it interprets the list-query IR into Ent dialect/sql predicates and order options, the func(*sql.Selector) shape every Ent query accepts via query.Where(predicate.T(pred)) and query.Order(opt) — plus Apply and the FoldFilters/FoldOrder glue an Ent store's list adapters share.
 Package ent is the Ent kind of the store tier (store.KindEnt): the Ent/SQL backend of the list-query compiler — it interprets the list-query IR into Ent dialect/sql predicates and order options, the func(*sql.Selector) shape every Ent query accepts via query.Where(predicate.T(pred)) and query.Order(opt) — plus Apply and the FoldFilters/FoldOrder glue an Ent store's list adapters share.
stores/errors
Package errors maps a store's database errors to domain errors: each mapper translates driver-specific errors (constraint violations, not-found, schema errors) into a coded core/errors.AppError.
 Package errors maps a store's database errors to domain errors: each mapper translates driver-specific errors (constraint violations, not-found, schema errors) into a coded core/errors.AppError.
stores/errors/postgres
Package postgres provides PostgreSQL-specific DB error mapping.
 Package postgres provides PostgreSQL-specific DB error mapping.
stores/gorm
Package gorm is the GORM kind of the store tier (store.KindGORM): a lifecycle-managed opener for the *gorm.DB a GORM store runs its statements on, its SQL dialect selected by Kind (lazily, in Start), so a consumer can put its stores on GORM, or switch another ORM it owns for this one, as a composition-root wiring change rather than a rewrite.
 Package gorm is the GORM kind of the store tier (store.KindGORM): a lifecycle-managed opener for the *gorm.DB a GORM store runs its statements on, its SQL dialect selected by Kind (lazily, in Start), so a consumer can put its stores on GORM, or switch another ORM it owns for this one, as a composition-root wiring change rather than a rewrite.
stores/outbox
Package outbox builds the durable side of a transactional outbox from config: the store the relay (workflows/outbox) leases rows from and finalizes them in.
 Package outbox builds the durable side of a transactional outbox from config: the store the relay (workflows/outbox) leases rows from and finalizes them in.
stores/outbox/postgres
Package postgres is the PostgreSQL kind of the outbox store (stores/outbox): the relay's claim, lease and finalize operations over a product's own outbox table, named by configuration.
 Package postgres is the PostgreSQL kind of the outbox store (stores/outbox): the relay's claim, lease and finalize operations over a product's own outbox table, named by configuration.
stores/outbox/stub
Package stub is the stub kind of the outbox store (stores/outbox): an outbox with no rows, so a relay graph boots and runs with no database.
 Package stub is the stub kind of the outbox store (stores/outbox): an outbox with no rows, so a relay graph boots and runs with no database.
stores/sqltx
Package sqltx is the database/sql transaction manager: the interfaces.TransactionManager a workflow opens its transactions through when its stores run raw SQL on a *sql.DB (the postgres outbox store).
 Package sqltx is the database/sql transaction manager: the interfaces.TransactionManager a workflow opens its transactions through when its stores run raw SQL on a *sql.DB (the postgres outbox store).
stores/store
Package store is the store tier: the persistence layer a repository is built on.
 Package store is the store tier: the persistence layer a repository is built on.
tests/fixtures
Package fixtures provides thin, hand-written factories over the GENERATED gomock mocks in the sibling mocks package.
 Package fixtures provides thin, hand-written factories over the GENERATED gomock mocks in the sibling mocks package.
tests/fixtures/dbtest/cassandra
Package cassandra provides a testcontainers-based Apache Cassandra 5 instance for integration tests.
 Package cassandra provides a testcontainers-based Apache Cassandra 5 instance for integration tests.
tests/fixtures/dbtest/elasticmq
Package elasticmq provides a testcontainers-based ElasticMQ (SQS-compatible) instance for integration tests.
 Package elasticmq provides a testcontainers-based ElasticMQ (SQS-compatible) instance for integration tests.
tests/fixtures/dbtest/minio
Package minio provides a testcontainers-based MinIO instance for integration tests.
 Package minio provides a testcontainers-based MinIO instance for integration tests.
tests/fixtures/dbtest/postgres
Package postgres provides a generic testcontainers-based PostgreSQL database for integration tests.
 Package postgres provides a generic testcontainers-based PostgreSQL database for integration tests.
tests/fixtures/dbtest/redis
Package redis provides a testcontainers-based Redis instance for integration tests.
 Package redis provides a testcontainers-based Redis instance for integration tests.
tests/fixtures/e2ekit
Package e2ekit is the gen-free shared test-kit for endpoint E2E + telemetry suites.
 Package e2ekit is the gen-free shared test-kit for endpoint E2E + telemetry suites.
tests/fixtures/outboxtest
Package outboxtest is the reusable OutboxStore conformance suite (Run) and the routing-sink suite (RunRouting) a consumer runs against its own store and sink over real infrastructure; the engine runs them against the postgres outbox-store kind.
 Package outboxtest is the reusable OutboxStore conformance suite (Run) and the routing-sink suite (RunRouting) a consumer runs against its own store and sink over real infrastructure; the engine runs them against the postgres outbox-store kind.
tests/fixtures/store
Package store (testutil) provides a interfaces.Store implementation that supports call counting and error injection for use in tests.
 Package store (testutil) provides a interfaces.Store implementation that supports call counting and error injection for use in tests.
tests/fixtures/suite
Package suite provides test suite constructors for unit and integration tests.
 Package suite provides test suite constructors for unit and integration tests.
tests/fixtures/suite/base
Package base provides the base test suite with shared utilities.
 Package base provides the base test suite with shared utilities.
tests/integration
Package integration holds the Go integration tests: each file exercises a clients-tier backend against the real service it wraps, started in a throwaway testcontainers container by the fixtures under go/tests/fixtures/dbtest — Redis (cache, lock, messaging, replay buffer), MinIO (S3 storage and the S3 connector), ElasticMQ (SQS messaging), and PostgreSQL (River's runtime and migrations).
 Package integration holds the Go integration tests: each file exercises a clients-tier backend against the real service it wraps, started in a throwaway testcontainers container by the fixtures under go/tests/fixtures/dbtest — Redis (cache, lock, messaging, replay buffer), MinIO (S3 storage and the S3 connector), ElasticMQ (SQS messaging), and PostgreSQL (River's runtime and migrations).
tests/mocks
Package mocks is a generated GoMock package.
 Package mocks is a generated GoMock package.
transport
Package transport is the controller tier: the edge every inbound request enters by — a REST or RPC handler.
 Package transport is the controller tier: the edge every inbound request enters by — a REST or RPC handler.
transport/cobra
Package cobra is the command-line front-end of an operations registry (execution/ops): Command builds a Cobra command for one registered operation, its flags and positional arguments derived from the operation's input type, so a CLI and the other front-ends run the operation on the same input.
 Package cobra is the command-line front-end of an operations registry (execution/ops): Command builds a Cobra command for one registered operation, its flags and positional arguments derived from the operation's input type, so a CLI and the other front-ends run the operation on the same input.
transport/connect
Package connect provides a Connect/gRPC server factory that mounts proto-generated handlers on a standard net/http.ServeMux.
 Package connect provides a Connect/gRPC server factory that mounts proto-generated handlers on a standard net/http.ServeMux.
transport/connect/interceptors
Package interceptors provides Connect RPC interceptors for cross-cutting concerns.
 Package interceptors provides Connect RPC interceptors for cross-cutting concerns.
transport/cron
Package cron is the scheduled-job front-end of an operations registry (execution/ops): a job's entrypoint names one operation and its JSON arguments, and Run executes it unattended under the registry's exposure policy.
 Package cron is the scheduled-job front-end of an operations registry (execution/ops): a job's entrypoint names one operation and its JSON arguments, and Run executes it unattended under the registry's exposure policy.
transport/docs
Package docs provides reusable HTTP handlers for serving OpenAPI specs and Redoc UI documentation pages.
 Package docs provides reusable HTTP handlers for serving OpenAPI specs and Redoc UI documentation pages.
transport/grpc
Package grpc builds a configured gRPC server (NewServer) and registers the gRPC health service on it; interceptors/ runs its RPCs through the controller tier.
 Package grpc builds a configured gRPC server (NewServer) and registers the gRPC health service on it; interceptors/ runs its RPCs through the controller tier.
transport/grpc/interceptors
Package interceptors runs a gRPC server's RPCs through the controller tier (transport.Tier): ServerOptions lays the tier out as unary and stream server interceptors, with gRPC-native tracing, metrics and logging standing in for the tier's own.
 Package interceptors runs a gRPC server's RPCs through the controller tier (transport.Tier): ServerOptions lays the tier out as unary and stream server interceptors, with gRPC-native tracing, metrics and logging standing in for the tier's own.
transport/jsonapi
Package jsonapi provides HTTP middleware that transforms Vanguard REST responses into [JSON:API](https://jsonapi.org/format/) envelopes with the foundation/jsonapi codec.
 Package jsonapi provides HTTP middleware that transforms Vanguard REST responses into [JSON:API](https://jsonapi.org/format/) envelopes with the foundation/jsonapi codec.
transport/mcp
Package mcp is a Model Context Protocol front-end for an operations registry (execution/ops): it advertises one tool per operation the registry admits and runs each tool call through the registry, a bounded operation inline and a long-running one as a background run (execution/runs) that the runs.* tools observe and cancel.
 Package mcp is a Model Context Protocol front-end for an operations registry (execution/ops): it advertises one tool per operation the registry admits and runs each tool call through the registry, a bounded operation inline and a long-running one as a background run (execution/runs) that the runs.* tools observe and cancel.
transport/rest
Package rest provides HTTP response helpers for REST API handlers.
 Package rest provides HTTP response helpers for REST API handlers.
transport/rpc
Package rpc provides Connect RPC utilities for bidirectional mapping between domain AppErrors and Connect/gRPC status codes.
 Package rpc provides Connect RPC utilities for bidirectional mapping between domain AppErrors and Connect/gRPC status codes.
transport/server
Package server builds the ServerTransport from config: an unserved stub (the default) or Connect over net/http.
 Package server builds the ServerTransport from config: an unserved stub (the default) or Connect over net/http.
transport/server/stub
Package stub is the zero-infrastructure ServerTransport: handlers register on a mux that is never served, so a graph boots and its routes can be exercised in process (httptest) without opening a port.
 Package stub is the zero-infrastructure ServerTransport: handlers register on a mux that is never served, so a graph boots and its routes can be exercised in process (httptest) without opening a port.
workflows/loop
Package loop runs background work as periodic workflow passes.
 Package loop runs background work as periodic workflow passes.
workflows/outbox
Package outbox is the transactional-outbox relay: it leases due rows from an interfaces.OutboxRepository, delivers them through an interfaces.OutboxSink in bounded-concurrency chunks, and finalizes each row by its own outcome — sent, retried with capped exponential backoff and full jitter, or parked once its attempts are exhausted.
 Package outbox is the transactional-outbox relay: it leases due rows from an interfaces.OutboxRepository, delivers them through an interfaces.OutboxSink in bounded-concurrency chunks, and finalizes each row by its own outcome — sent, retried with capped exponential backoff and full jitter, or parked once its attempts are exhausted.
workflows/workflow
Package workflow is the workflow tier: the one boundary observed in every environment and the only tier that opens a transaction.
 Package workflow is the workflow tier: the one boundary observed in every environment and the only tier that opens a transaction.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.