internal/

Package admincore holds the protocol-agnostic configuration operations outpost exposes — pairing, app CRUD, outbound mounts, built-in toggles, cluster kubeconfig, restart.

Package adminui serves the local-only configuration web UI for outpost.

Package apphealth provides per-app reachability measurement over outpost-owned TCP/HTTP paths (no ICMP/raw sockets).

Package backup is the outpost-side, app-opaque folder watcher that produces backup candidates on a cron schedule.

Package brain is cloudbox/outpost/bashy's built-in decision-maker — the faculty that lets the platform DECIDE, not just execute, for any operation that needs judgment.

Package clusterllm is outpost's passive integrator for an intra-home distributed-inference backend — a runtime that tensor/pipeline-splits a single model across several member machines so a home can serve a model too large for any one box.

Package conf holds the matrix-agent runtime configuration.

mDNS advertisement: register ourselves on `_outpost._tcp.local`.

Package fleetreg pushes this host's fleet inventory — the tools, agents, and skills it has installed — up to cloudbox.

Package heartbeat owns the outpost → cloudbox active liveness push (Layer-5 defense).

Package hostauth verifies the host OS's own credentials.

Package mcpapi exposes outpost's configuration surface to agent tools (Claude Code, Windsurf, the outpost CLI, ...) over the Model Context Protocol.

Package mesh is the outpost's libp2p peer data plane — the node that carries authenticated, encrypted, NAT-traversing peer↔peer streams.

Package mirror supervises mobility-aware continuous directory mirrors.

Package ollama owns the outpost-side of the LLM pool: it watches the local Ollama daemon's model inventory, publishes the inventory to cloudbox so the pool scheduler can route by model presence, and tracks in-flight request counts so cloudbox can avoid over-scheduling a host with limited GPU capacity.

Package osversion returns a one-line human-readable OS version label for the running host, e.g.

Package otel discovers the local `ycode serve` observability stack (Prometheus + Alertmanager + VictoriaLogs + Jaeger + Perses, all reverse-proxied under one bearer-authed HTTP server) and lets outpost expose each surface through the matrix tunnel as a built-in app.

Package peerhosts caches the list of paired outpost hostnames as returned by cloudbox's /api/v1/ssh/hosts endpoint.

Package peerplane is the outpost side of the dhnt p2p resource fabric's peer data plane.

Package peerstatus is a thin client for cloudbox's GET /api/v1/peers — the peer status board.

Package peerticket verifies short-lived JWTs ("peer tickets") cloudbox issues at `POST /api/v1/ssh/peer-ticket`.

Package portal speaks to the cloud portal's pairing endpoint (POST /api/register/exchange).

Package repair provides the POST /admin/repair receiver — the cloudbox-driven trigger that starts a CI-failure self-fix on this host.

Package runtime supervises a podman container that hosts this outpost's k3s-agent kubelet.

Command outpost-cni implements a minimal Container Network Interface (CNI) plugin for Phase 3 of the outpost overlay design.

Package sandbox implements outpost's safe-by-default container "sandbox" provider: a filtered libpod/docker API proxy that strips the escape-bearing knobs (privileged, host namespaces, host bind-mounts, added capabilities, devices) and injects per-request resource caps, so a remote caller who clears the cloudbox elevation gate can run containers without getting root-equivalent control of the host.

Package selfcheck owns the Layer-2 defense: detect partial outpost corruption and self-heal from durable inputs.

Package shard orchestrates a Prima.cpp pipelined-ring shard over the mesh forwarder: serving a model bigger than any single node by splitting its layers across paired mesh peers.

Embedded coreutils fallback for the in-process shell.

In-process SSH client over the cloudbox matrix tunnel.

Package supervisor is a minimal process supervisor: it keeps a fixed set of child Programs alive — start them, restart on exit with capped backoff, and gracefully stop them on shutdown.

Package sysinfo collects host capability information the outpost reports to cloudbox via the /apps poll loop.

Package sysload is the outpost's considerate system-load profiler.

Package upgrade carries the self-upgrade machinery shared by the CLI (`outpost upgrade`, `outpost rollback`) and the cloudbox-pushed daemon route (POST /admin/upgrade).

Package userkube owns the workflow for materializing a kubectl- ready kubeconfig from cloudbox onto this host's disk.

Package vknode is the per-outpost half of the cloudbox cluster: it joins a cloud-side Kubernetes API server as a virtual node and runs scheduled Pods as podman containers on the host.

Package warm implements the outpost's adaptive, considerate, always-on warm-serving plane.

Package ycode discovers and lifecycle-manages a `ycode serve` process running side-by-side with outpost on the same OS user account.