Architecture

Architecture

flowchart TB
    CLI[cmd/pandaward] --> ENG
    MCP[internal/mcp<br/>stdio JSON-RPC] --> ENG
    HOOKS[internal/hooks] --> ENG
    ENG[internal/engine<br/>plan, scan, observe, triage] --> INV[internal/inventory]
    ENG --> ADP[internal/adapters]
    ENG --> SC[internal/scope]
    ENG --> EVD[internal/evidence]
    ENG --> ST[internal/store<br/>SQLite WAL]
    ADP --> RED[internal/redact]
    EVD --> RED
    REP[internal/report] --> ST
    CAT[internal/catalog] --> ENG

Loading

Package	Responsibility
catalog	Versioned domains, controls and seed edge rules
inventory	Read-only walk, language and feature detection, route extraction, git metadata
adapters	Built-in checks and wrappers for optional scanners behind one interface
engine	Planning, adapter orchestration, finding lifecycle, edges, coverage, network observe profile
scope	Scope manifest parsing, validation, URL and address guards
redact	Secret and PII masking, control character stripping
evidence	Content-addressed redacted records with integrity verification
store	SQLite schema, migrations, events, approvals
report	HTML, Markdown, JSON, SARIF, CSV
mcp	Model Context Protocol server
hooks	Claude Code lifecycle hooks
bundle	Evidence bundle export and verification
benchmark	Rule corpus and TP/FP/FN/TN measurement
adversarial	Hostile-repository self-test
schema	Golden test that pins every public format

Adapter contract

type Adapter interface {
    Name() string
    Controls() []string   // controls this adapter decides
    Maturity() string
    Network() bool        // needs network for its tool
    Run(ctx context.Context, c *Context) (Result, model.Run)
}

The engine runs each adapter in isolation (a panic becomes ERROR), maps signals to control status (Confirmed signals make FAIL, hypotheses make SUSPECTED, info-only listings keep PASS), writes evidence, and updates finding lifecycle.

Ledger tables

meta, projects, assessments, assets, file_hashes, controls, edges, runs, findings, evidence, events, stale_files, approvals, observations. Every state change appends an event. The schema changes only through new migrations; published migrations are never edited.