internal/

Package covbuild is test-only support for measuring coverage inside a subprocess.

Package pathsec answers one question for every surface in this repository that opens something an attacker must not be able to substitute: can another identity replace any part of the path this process is about to resolve?

Package schemaifacepilot contains the bounded experiment for issue #1227.

Package temporaltest owns the Temporal dev-server process used by tests.