Baseline: main@bee77a6125dbccb58f166ec363e978cd960f43f3 (2026-10-11). Scope: every direct idkmesh/*.py file, including __init__.py (85 at the pinned baseline; tests/test_module_map_docs.py keeps the table complete as modules are added; GitHub ledger and governance-preflight rows below are post-baseline additions). This is a source navigation and responsibility map, not a claim that all modules form a deployable service, a list of supported public Python APIs, or a test-coverage/qualification certificate. Public claims must follow the canonical capability matrix.
Each row points to real source code inspected for its module-level contract and exported declarations. A module can be pure/experimental, CLI-wired, local-only, or an adapter boundary; mere presence in the installable package does not grant execution, acceptance, human decision, or merge authority. See the as-built flow and CLI/HTTP reference for exposed behavior.
Primary context: subsystem contract.
| Source file | Responsibility / authority limit |
|---|---|
__init__.py |
Package boundary and version metadata |
cli.py |
Argument parser and command handlers; does not replace domain services |
api_client.py |
Stdlib Python read/inspection client with typed errors and digest checks |
api_observability.py |
Privacy-safe bounded-cardinality HTTP metrics |
control_tower_api.py |
Evidence validation, read models, and OpenAPI document |
control_tower_ui.py |
Loopback-only Control Tower HTTP/UI adapter |
gate_audit_ui.py |
Loopback-only verdict-panel browser UI |
local_ui_security.py |
Loopback host, local session token, and security headers |
otel_metrics.py |
Offline canonical-metrics to OTLP/HTTP JSON mapping |
service_runtime.py |
Request IDs, readiness, limits, logging, and draining |
Primary context: subsystem contract.
| Source file | Responsibility / authority limit |
|---|---|
candidate_reference.py |
Provider-neutral candidate identities, not verification results |
gate_audit.py |
Panel error, dependence, effective-vote, and probe diagnostics |
gate_audit_dependence.py |
Per-pair measured verifier error correlation |
gate_audit_uncertainty.py |
Optional seeded finite-sample bootstrap uncertainty |
local_candidate_reader.py |
Confined, content-addressed local artifact identity |
marginal_evidence.py |
Retrospective add-one-verifier analysis |
marginal_evidence_benchmark.py |
Held-out selector-versus-baselines benchmark |
marginal_evidence_synthesis.py |
Cross-cohort synthesis of frozen benchmark reports |
result_manifest_builder.py |
Candidate-to-ResultManifest normalization |
verification_handoff.py |
Exact WorkUnit/candidate/policy handoff; no verifier selection |
work_unit_binding.py |
WorkUnit digest bound to an exact Git source revision |
Primary context: subsystem contract.
| Source file | Responsibility / authority limit |
|---|---|
coordination_preflight.py |
Read-only prerequisite/effort/readiness projection |
executor_admission.py |
Revalidated local claim admission and stale-input submission fence |
human_decision_service.py |
Authenticated actor input and immutable local decision record; no HTTP mutation adapter |
product_spine.py |
Pure run and attempt lifecycle state transitions |
product_spine_idempotency.py |
Local restart-safe offline request reservation |
product_spine_offline.py |
Deterministic offline lifecycle/evidence composition |
product_spine_run_store.py |
SQLite-backed bounded run CRUD/read/event projections |
task_claims.py |
Atomic local claims and occupancy-aware recovery |
Primary context: subsystem contract.
| Source file | Responsibility / authority limit |
|---|---|
connector_control_read.py |
Safe read-only persisted-connection projection |
connector_errors.py |
Typed errors and credential redaction |
connector_inspection.py |
Offline probe/doctor/route explanation |
connector_probe.py |
Normalized observational driver probe |
connector_profiles.py |
Versioned connector-profile parsing and validation |
connector_registry.py |
Provider-neutral driver declarations and fake registry |
connector_routing.py |
Pure capability, risk, and cost routing eligibility |
connector_secrets.py |
Environment secret-reference/grant boundary |
connector_store.py |
Local SQLite metadata and idempotency; not hosted ledger |
Primary context: subsystem contract.
| Source file | Responsibility / authority limit |
|---|---|
github_actions_summary.py |
Bounded digest-bound Actions step-summary renderer |
github_bootstrap.py |
GitHub-first bootstrap file/owner-action plan (pure) |
github_bootstrap_render.py |
Deterministic bootstrap config rendering (pure) |
github_branch_reader.py |
Exact immutable branch-head observation |
github_candidate_reader.py |
PR discovery reconciled to trusted GitHub head identity |
github_delivery_idempotency.py |
Delivery reservation before external side effects |
github_dispatch_authorization.py |
Explicit trusted-actor/label authorization |
github_evidence_link.py |
Immutable Git-backed evidence URL validation |
github_explicit_dispatch.py |
Idempotent explicitly authorized dispatch boundary |
github_governance_policy.py |
Declarative GitHub repository governance rules |
github_governance_preflight.py |
Read-only C12 governance evaluation, workflow-source linting, CODEOWNERS recommendations, and OIDC shape checks; no GitHub admin mutation |
github_issue_preview.py |
Untrusted issue-to-policy-owned WorkUnit preview |
github_issue_source.py |
Bounded GitHub REST issue read adapter |
github_ledger_admission.py |
Idempotent dispatch admission by compare-and-set on a per-key ref; duplicate dispatch resolves to the existing run; no push or GitHub call |
github_ledger_append.py |
Local compare-and-set optimistic append to a per-run Git-ref ledger with bounded retry; no push or GitHub call |
github_ledger_github_store.py |
GitHub-native durable C9 storage on a dedicated orphan ledger branch with fast-forward-only ref updates, remote admission/recovery composition, and no application-branch or merge authority |
github_ledger_recovery.py |
Read-only derivation of a run’s current state from its ledger records; keeps negative evidence and flags ambiguous submissions |
github_ledger_recovery_plan.py |
Pure advisory safe-next-step plan for a recovered ledger run; reconciles unconfirmed provider submissions instead of resubmitting; grants no authority |
github_ledger_serialization.py |
Pure canonical serialization and append-only chain verification for GitHub ledger records; performs no Git or GitHub action |
github_public_evidence.py |
Strict public-safe evidence publication projection |
github_rest_source.py |
Bounded GitHub identity REST transport |
github_routing_projection.py |
Read-only GitHub UI projection of routing decision |
github_status_comment.py |
One idempotently synchronized run-status comment |
github_status_update.py |
Immutable single-comment publication and recovery |
github_webhook_ingress.py |
HMAC-verified bounded webhook normalization |
Primary context: subsystem contract.
| Source file | Responsibility / authority limit |
|---|---|
jules_actions.py |
Explicit operator authorization for approve/message actions |
jules_candidate_binding.py |
Untrusted PR hint to trusted SCM identity bridge |
jules_candidates.py |
Untrusted provider PR-output hint discovery |
jules_client.py |
Bounded provider REST transport and errors |
jules_lifecycle.py |
Session completion plus independent candidate readiness |
jules_observation.py |
Normalized session/activity snapshots without raw messages |
jules_revision_binding.py |
Authorized source revision matched to observed Git head |
jules_sessions.py |
Session creation only with verified revision binding |
jules_sources.py |
Source/repository/branch validation |
Primary context: subsystem contract.
| Source file | Responsibility / authority limit |
|---|---|
agent_presets.py |
Maintainer-owned executable/argument/network presets |
local_agent_artifacts.py |
Controller-owned bounded candidate artifact capture |
local_agent_runner.py |
Worktree/process limits and fail-closed sandbox interface |
local_agent_sandbox.py |
Linux bubblewrap network-disabled sandbox backend |
local_loop.py |
Checkout-only two-attempt R1 execution and evidence bundle |
Primary context: subsystem contract.
| Source file | Responsibility / authority limit |
|---|---|
openai_compatible.py |
Pure model connection validation |
openai_compatible_capabilities.py |
Explicit model capability evidence and identity |
openai_compatible_http.py |
Provider-neutral HTTP transport and models probe |
openai_compatible_inference.py |
Normalized non-streaming text/chat completion |
openai_compatible_smoke.py |
Secret-safe probe and completion digest evidence |
Primary context: subsystem contract.
| Source file | Responsibility / authority limit |
|---|---|
enterprise_audit.py |
Tenant-scoped tamper-evident audit ledger and exports |
enterprise_authz.py |
Actor/policy/action authorization kernel |
enterprise_identity_github.py |
Trusted GitHub actor binding to ActorContext |
enterprise_identity_oidc.py |
Trusted IdP claims binding to ActorContext |
enterprise_profile.py |
Strict enterprise profile and cross-field validation |
tenant_scope.py |
Tenant-scoped resource/idempotency identities and memory fixture |
Primary context: subsystem contract.
| Source file | Responsibility / authority limit |
|---|---|
steward_history.py |
Offline deterministic report aggregation |
steward_history_ui.py |
Loopback static history dashboard |
steward_report.py |
Offline contract-validated steward report reader |
steward_report_ui.py |
Loopback static single-report dashboard |
The wider repository is more than its installable package. These directories have their own specifications, CI contracts, and experimental maturity; the counts below are from the same pinned Git tree, not claims of line-by-line semantic validation:
| Area | Files at baseline | Closest maintained navigation |
|---|---|---|
experiments/*.py |
26 | research index, test practice |
tools/*.py |
67 | operations, contribution workflow |
scripts/*.py |
38 | test practice, architecture |
sim/*.py |
42 | sim guide, research index |
randomness_lab/*.py |
23 | randomness lab guide |
interop/*.py (excluding tests) |
5 | interop guide |
.github/workflows/*.yml |
61 | testing/CI, operations |
tests/**/*.py |
318 | testing/CI |
These areas and their validation needs are recorded as the follow-up code-by-code documentation pass in the dated audit. Do not infer an external deployment from a GitHub Action definition or infer a product guarantee from a synthetic test.
idkmesh/*.py module, verify its public entry points, authority boundary, and tests, then revise its row and the appropriate subsystem specification in the same PR.idkmesh/cli.py, idkmesh/control_tower_ui.py, or idkmesh/control_tower_api.py changes. The generated GET /api/v1/openapi.json document and CLI --help are the executable reference.main and its test/evidence contract. Record unmerged PR behavior as pending only.