Directories
¶
| Path | Synopsis |
|---|---|
|
api
|
|
|
gateway/v1alpha1
Package v1alpha1 contains API schema definitions for the gateway.orka.ai API group.
|
Package v1alpha1 contains API schema definitions for the gateway.orka.ai API group. |
|
v1alpha1
Package v1alpha1 contains API Schema definitions for the core v1alpha1 API group.
|
Package v1alpha1 contains API Schema definitions for the core v1alpha1 API group. |
|
build/helmify
command
Modified from open-policy-agent/gatekeeper cmd/build/helmify at c9b67657102032a460a28e7f3b9c88ec0c193453.
|
Modified from open-policy-agent/gatekeeper cmd/build/helmify at c9b67657102032a460a28e7f3b9c88ec0c193453. |
|
build/release
command
Command release prepares, qualifies, and publishes one immutable Orka release candidate.
|
Command release prepares, qualifies, and publishes one immutable Orka release candidate. |
|
cli
command
|
|
|
orka-acp-exec-helper
command
|
|
|
orka-acp-runtime
command
|
|
|
orka-admission
command
orka-admission serves the stateless, fail-closed admission boundary shared by isolated harness-v1 and harness-v2 installations.
|
orka-admission serves the stateless, fail-closed admission boundary shared by isolated harness-v1 and harness-v2 installations. |
|
orka-agent-harness-wrapper
command
|
|
|
orka-compat-router
command
|
|
|
orka-gateway-conformance
command
|
|
|
orka-gateway-e2e-worker
command
Test-only deterministic native worker.
|
Test-only deterministic native worker. |
|
orka-gateway-reference-adapter
command
|
|
|
orka-harness-v2-e2e-fixture
command
|
|
|
orka-image-ref-validator
command
|
|
|
orka-mcp-e2e-server
command
|
|
|
orka-provider-auth-proxy
command
|
|
|
orka-scm-egress-proxy
command
|
|
|
orka-substrate-doctor
command
|
|
|
orka-tool-e2e-client
command
|
|
|
orka-workspace-agent
command
|
|
|
orka-workspace-publisher
command
|
|
|
examples
|
|
|
human-approval-v2/profile
command
Command profile renders the immutable inputs for one approval demo runtime.
|
Command profile renders the immutable inputs for one approval demo runtime. |
|
internal
|
|
|
acp/toolbox
Package toolbox implements the untrusted-image toolbox copier and checks used by the ACP runtime Pod.
|
Package toolbox implements the untrusted-image toolbox copier and checks used by the ACP runtime Pod. |
|
admission
Package admission contains Kubernetes admission handlers for Orka CRDs.
|
Package admission contains Kubernetes admission handlers for Orka CRDs. |
|
agentcontext
Package agentcontext resolves explicit, non-secret Agent persona configuration.
|
Package agentcontext resolves explicit, non-secret Agent persona configuration. |
|
agentruntimepolicy
Package agentruntimepolicy resolves registered external runtime policy for Task producers that must materialize the exact brokered tool request.
|
Package agentruntimepolicy resolves registered external runtime policy for Task producers that must materialize the exact brokered tool request. |
|
aitools
Package aitools resolves the effective built-in and configured tool set exposed to AI workers and brokered agent runtimes.
|
Package aitools resolves the effective built-in and configured tool set exposed to AI workers and brokered agent runtimes. |
|
codexstate
Package codexstate carries the supported SessionKit bundle between Orka and local Codex homes.
|
Package codexstate carries the supported SessionKit bundle between Orka and local Codex homes. |
|
connectors
Package connectors validates ConnectorProvider and Connection resources and resolves their references.
|
Package connectors validates ConnectorProvider and Connection resources and resolves their references. |
|
connectors/credential
Package credential resolves a person's linked-account access token for a tool call, refreshing it lazily with single-flight per Connection and writing rotated material back to custody.
|
Package credential resolves a person's linked-account access token for a tool call, refreshing it lazily with single-flight per Connection and writing rotated material back to custody. |
|
envutil
Package envutil parses process environment variables with the canonical, fail-closed rules shared by the Orka binaries.
|
Package envutil parses process environment variables with the canonical, fail-closed rules shared by the Orka binaries. |
|
executionmode
Package executionmode defines the immutable execution-plane identity shared by controllers and admission.
|
Package executionmode defines the immutable execution-plane identity shared by controllers and admission. |
|
gateway/conformance
Package conformance probes and validates the orka.gateway.v1 adapter contract.
|
Package conformance probes and validates the orka.gateway.v1 adapter contract. |
|
gateway/protocol
Package protocol defines the provider-neutral orka.gateway.v1 HTTP contract.
|
Package protocol defines the provider-neutral orka.gateway.v1 HTTP contract. |
|
gateway/referenceadapter
Package referenceadapter provides a deterministic, provider-neutral orka.gateway.v1 implementation for conformance and end-to-end tests.
|
Package referenceadapter provides a deterministic, provider-neutral orka.gateway.v1 implementation for conformance and end-to-end tests. |
|
gateway/workerclient
Package workerclient implements the native worker's task-bound gateway reply transport.
|
Package workerclient implements the native worker's task-bound gateway reply transport. |
|
harness/ledger
Package ledger implements the durable harness v1 wrapper admission ledger.
|
Package ledger implements the durable harness v1 wrapper admission ledger. |
|
harness/v2
Package v2 defines the portable orka.harness.v2 wire contract.
|
Package v2 defines the portable orka.harness.v2 wire contract. |
|
harness/v2/conformance
Package conformance validates external orka.harness.v2 runtimes before an AgentRuntime becomes Ready.
|
Package conformance validates external orka.harness.v2 runtimes before an AgentRuntime becomes Ready. |
|
providerproxy
Package providerproxy holds the security-critical request/response filtering shared by Orka's provider-facing HTTP proxies: the standalone orka-provider-auth-proxy binary and the ACP supervisor's per-session provider proxy.
|
Package providerproxy holds the security-critical request/response filtering shared by Orka's provider-facing HTTP proxies: the standalone orka-provider-auth-proxy binary and the ACP supervisor's per-session provider proxy. |
|
publisher
Package publisher implements the clean-room Git publication boundary.
|
Package publisher implements the clean-room Git publication boundary. |
|
publisher/service
Package service exposes the clean-room Workspace/Publisher boundary around internal/publisher.
|
Package service exposes the clean-room Workspace/Publisher boundary around internal/publisher. |
|
safesymlink
Package safesymlink validates repository-relative symbolic-link graphs without following links on the host filesystem.
|
Package safesymlink validates repository-relative symbolic-link graphs without following links on the host filesystem. |
|
store/kube
Package kube implements Kubernetes-authoritative ACP control records.
|
Package kube implements Kubernetes-authoritative ACP control records. |
|
substratepb
Package ateapipb contains the unmodified upstream Agent Substrate control protocol, generated with an Orka-local Go import path.
|
Package ateapipb contains the unmodified upstream Agent Substrate control protocol, generated with an Orka-local Go import path. |
|
tokenexchange
Package tokenexchange implements reusable RFC 8693 token exchange and RFC 7523 JWT bearer grants.
|
Package tokenexchange implements reusable RFC 8693 token exchange and RFC 7523 JWT bearer grants. |
|
tracing/genai
Package genai contains the small hand-rolled subset of the OpenTelemetry GenAI semantic conventions Orka emits.
|
Package genai contains the small hand-rolled subset of the OpenTelemetry GenAI semantic conventions Orka emits. |
|
transactiontoken
Package transactiontoken defines Orka's strict, vendor-neutral OAuth Transaction Token profile.
|
Package transactiontoken defines Orka's strict, vendor-neutral OAuth Transaction Token profile. |
|
transactiontoken/testutil
Package testutil provides local standards-based transaction-token fixtures.
|
Package testutil provides local standards-based transaction-token fixtures. |
|
uiembed
Package uiembed provides the embedded frontend assets.
|
Package uiembed provides the embedded frontend assets. |
|
usage
Package usage builds cohort reports from retained counts and verified links.
|
Package usage builds cohort reports from retained counts and verified links. |
|
workerenv
Package workerenv defines the process contract shared by the controller job builder and worker binaries.
|
Package workerenv defines the process contract shared by the controller job builder and worker binaries. |
|
workspace
Package workspace defines Orka's internal durable-workspace execution boundary.
|
Package workspace defines Orka's internal durable-workspace execution boundary. |
|
workspace/daemonprotocol
Package daemonprotocol preserves the legacy provider-routed client surface while the public DTOs live in orka-workspace/sdk/workspaceagent.
|
Package daemonprotocol preserves the legacy provider-routed client surface while the public DTOs live in orka-workspace/sdk/workspaceagent. |
|
workspace/statusrules
Package statusrules owns provider-neutral Execution Workspace status safety rules shared by API, worker, and controller adapters.
|
Package statusrules owns provider-neutral Execution Workspace status safety rules shared by API, worker, and controller adapters. |
|
workspacedelta
Package workspacedelta captures and compares bounded workspace trees and produces deterministic, publication-safe change artifacts.
|
Package workspacedelta captures and compares bounded workspace trees and produces deterministic, publication-safe change artifacts. |
|
scripts
|
|
|
fixtures/openai-responses
command
|
|
|
fixtures/remote-mcp-gateway
command
Command remote-mcp-gateway is a LOCAL PROOF FIXTURE, not a production gateway.
|
Command remote-mcp-gateway is a LOCAL PROOF FIXTURE, not a production gateway. |
|
fixtures/security-scan-fake-acp
command
|
|
|
fixtures/substrate-conformance
command
Native provider conformance reads credentials only from projected files.
|
Native provider conformance reads credentials only from projected files. |
|
test
|
|
|
fixtures/aimockauthority
Package aimockauthority supplies isolated, synthetic transaction authority for deployed authorization evals.
|
Package aimockauthority supplies isolated, synthetic transaction authority for deployed authorization evals. |
|
fixtures/aimockauthority/cmd
command
|
|
|
fixtures/aimockcapture
Package aimockcapture is a test-only, in-memory capture proxy for aimock.
|
Package aimockcapture is a test-only, in-memory capture proxy for aimock. |
|
fixtures/aimockcapture/cmd
command
|
|
|
fixtures/compatmodel
Package compatmodel supplies a deterministic OpenAI model for compatibility routing tests.
|
Package compatmodel supplies a deterministic OpenAI model for compatibility routing tests. |
|
fixtures/compatmodel/cmd
command
|
|
|
fixtures/connectors
Package connectorsfixture is the deterministic stand-in for everything the connectors E2E needs outside Orka: an OIDC issuer that signs in a person, an OAuth provider that consents, issues short-lived tokens, refreshes and revokes them, a resource API that only honours those tokens, and an OpenAI-compatible model that drives a read, an approval-gated write, and a second read.
|
Package connectorsfixture is the deterministic stand-in for everything the connectors E2E needs outside Orka: an OIDC issuer that signs in a person, an OAuth provider that consents, issues short-lived tokens, refreshes and revokes them, a resource API that only honours those tokens, and an OpenAI-compatible model that drives a read, an approval-gated write, and a second read. |
|
fixtures/connectors/cmd
command
The connectors E2E fixture binary: plain HTTP for the OIDC issuer, model, and state; TLS for the OAuth provider and resource API.
|
The connectors E2E fixture binary: plain HTTP for the OIDC issuer, model, and state; TLS for the OAuth provider and resource API. |
|
fixtures/fakeforge
Package fakeforge serves the subset of GitHub the clean-room workspace publisher uses: real Git smart HTTP for clone, fetch, and push (via `git http-backend`), plus the REST endpoints for pull request reconciliation.
|
Package fakeforge serves the subset of GitHub the clean-room workspace publisher uses: real Git smart HTTP for clone, fetch, and push (via `git http-backend`), plus the REST endpoints for pull request reconciliation. |
|
fixtures/fakeforge/cmd
command
|
|
|
workers
|
|
|
acp/images
command
Command artifact-tool performs the two deterministic supply-chain checks used by the ACP image definitions.
|
Command artifact-tool performs the two deterministic supply-chain checks used by the ACP image definitions. |
|
ai
command
|
|
|
general
command
|
|
Click to show internal directories.
Click to hide internal directories.