internal/

Package artifact implements the artifact model shared by every a2ahub surface: the two §3.3 ID classes (standing, exchange/broadcast), ULID lifecycle-event IDs, structural frontmatter parse/serialize, and digests.

Package avatar owns the disposable, machine-local GitHub avatar cache.

Package cache implements the P7 read surface (spec docs/features/archive/v1-min-2026-07/specs/07-read-surface-statusline.md): it composes internal/fold over the committed history of every connected space's local mirror clone (internal/space) into the inbox/outbox query sets §4.2/§7.2 defines, plus per-system read cursors, the pending-merge overlay, and mirror staleness/sync-age.

Real internal/cache-backed PendingMarker/CacheRemover (plan 07 Placement decision, binding): internal/cli's own P6-defined seams (adapters.go) filled with the P7 primitives that back them.

Package contract owns the pure contract carried-set domain model.

Package coveragepolicy is the SINGLE SOURCE OF TRUTH for a2ahub's test- coverage thresholds — one global floor plus per-package minimums — shared by two consumers: the coverage gate that runs under `go test` (policy_test.go) and the CI/local checker (covercheck.go, run by `make coverage`).

Package datapackage implements the contract data exchange loop: packing a result against an exact contract version, delivering it as one immutable attempt, fetching it back with its digests verified, and judging it into a structured verification report.

Package e2e — coverage.go implements the P26 coverage manifest (spec 26 §1/§11): a table mapping every catalog CLI verb to real evidence — a verb-invoking txtar scenario OR a direct-construction Go test — or an explicit, justified skip.

Package feedback is the P25 agent-feedback core: draft/validate/ledger/ triage/submit for the consumer-agent -> product-repo feedback channel (docs/features/archive/v1-min-2026-07/specs/25-agent-feedback.md).

Package fold implements the a2ahub lifecycle fold engine (spec docs/features/archive/v1-min-2026-07/specs/04-fold-engine.md, plan docs/the-plan/plan/03-domain.md §3.4-3.5).

Package host implements the §T1 5-primitive host adapter interface plus its v1 GitHub implementation: push an ephemeral branch, open a PR with auto-merge always enabled, read the required-check and review-approval state, and locate an already-open/merged PR by its deterministic head branch (the idempotent-retry read path).

Package html assembles the `a2a html` / `a2a dashboard` local view's data model (Data) from the shipped read surface (internal/cache Store + space manifests + consumes.yaml) and renders it into a self-contained static HTML page by injecting the model as JSON into an embedded, designed template.

Package livee2e is the LIVE-GitHub e2e tier (spec 36): it drives the real binary against a real, throwaway GitHub space and reports, per scenario, what works.

Package mcp implements P14 (`a2a mcp`, OP-216): a stdio JSON-RPC 2.0 MCP server whose tool registry maps 1:1 to the §7.7-enumerated OP subset.

Package notes parses and range-queries the P31 release-notes corpus: an authored, version-keyed YAML file per shipped a2a version plus one standing current-known-issues document (releasenotes/*.yaml and releasenotes/current/known-issues.yaml), embedded by the releasenotes package.

Package notification owns the canonical local notification projection, personal project registry, independent delivery leases, and trusted route ledger.

Package operation derives stable, private idempotency keys from semantic write intent.

Package operational builds the immutable, versioned operational read model.

Package operationalsource composes production cache and local-lease evidence into the one pure operational snapshot shared by HTML and serve.

Package provenance owns the bounded, diagnostic-only projection of event actor and producer attribution.

Package release implements the P19 (OP-217) self-update primitives: fetching the latest product-repo release (Source), verifying a downloaded asset (Verifier — an unconditional ChecksumVerifier plus a T2-interim UNVERIFIED signature slot, checksum-only per the 2026-07-22 amendment), downloading the platform asset triplet (Download), the post-download version self-check (SelfCheckVersion), the atomic same-filesystem binary swap (Swap), version-floor resolution (Resolve), and the TTL'd machine-level "latest known release" cache (CheckState/ReadCheck/ WriteCheck/ReadLatest) plus its background checker (NewChecker).

Package schema loads and compiles the embedded, version-keyed product schema corpus (schemas.FS: envelope bases and registered type extensions, event, manifest, consumes, release notes, and known issues) with santhosh-tekuri/jsonschema/v6, and loads the error-code registry (schemas/errors/v1/registry.yaml).

Package sensitive owns the closed, pure credential-shape matchers shared by validation and read-model redaction.

Package space implements the §4.2 space layout model, space.yaml manifest load, project/machine configuration (§7.4), credential resolution (§7.4/§10.5), mirror clones, and the D-002/D-026 write funnel.

Package surface holds the provider-surface registry: the verified facts about where each AI coding agent looks for a skill (its "skills home") and where it reads always-on context (CLAUDE.md, AGENTS.md, …), plus the detection and link logic that use those facts.

P37 wave C2 (spec 37 §2 T1, decision D-D): `a2a contract new` scaffolds a starter JSON Schema + matching valid fixture alongside a freshly-drafted contract.md, so a JSON-Schema contract is publishable (validate.

This file adds the §5.4b computed-compatibility check (D-010, CC-080): for a declared minor/patch bump, every fixture that validated under the PRIOR contract version's schema must still validate under the NEW version's schema.

Package version is the SSOT for reasoning about bare dotted major.minor.patch versions: parsing, strict-older comparison, canonicalisation, major extraction, and baseline selection.