How sakararya43-web/ratchet works
RATCHET is an independent access-change security control plane. A request is assessed against post-change graph reachability and signed policy, routed for independent passkey approval when sensitive, guarded again before execution, then verified against target state and recorded for audit. The repository also includes a simulated target and Kubernetes connector paths, a separately governed security authority, and console workspaces. The graph centers on the documented workflow; several subsystem connections are shown as unverified because their implementation was not sampled.
Main entry points: service.go Workflow Service · ingest.go Message Ingest · engine.go Policy Engine · main.go Connector Runtime
Components 18
Change Review
- Workflow Service
internal/workflow/service.go - Change Domain
internal/domain/change.go - Reachability Graph
internal/graph - Policy Engine
internal/policy/engine.go - Approval Review
internal/approval
Independent Trust
- Passkey Evidence
internal/passkeyevidence/verify.go - Security Authority
cmd/ratchet-authority/main.go - Trust Store
internal/trust/store.go
Target Connectors
- Message Ingest
internal/bus/ingest.go - Connector Runtime
cmd/ratchet-connector/main.go - Simulator Adapter
internal/connector/sim/adapter.go - Simulated Target
cmd/ratchet-sim/server/server.go - Kubernetes Connector
internal/connector/k8s/runtime.go
Operations and Console
- API Routes
internal/api - Event Store
internal/eventstore/store.go - Audit Ledger
internal/ledger/chain.go - Console UI
web/src/console
Other components
- Requester
Connections 20
- Requester → API Routes: submits change
- API Routes → Workflow Service: routes requests
- Workflow Service → Change Domain: evaluates changes
internal/workflow/service.go - Workflow Service → Reachability Graph: reads impact
internal/workflow/service.go - Workflow Service → Policy Engine: evaluates policy
internal/workflow/service.go - Workflow Service → Event Store: mutates records
internal/workflow/service.go - Policy Engine → Change Domain: returns decision
internal/policy/engine.go - Approval Review → Passkey Evidence: verifies evidence
- Workflow Service → Approval Review: routes approvals
- Security Authority → Trust Store: serves governance
cmd/ratchet-authority/main.go - Policy Engine → Trust Store: verifies trust
internal/policy/engine.go - Connector Runtime → Message Ingest: publishes snapshots
cmd/ratchet-connector/main.go - Message Ingest → Event Store: ingests graph
internal/bus/ingest.go - Message Ingest → Reachability Graph: refreshes graph
internal/bus/ingest.go - Connector Runtime → Simulator Adapter: configures adapter
cmd/ratchet-connector/main.go - Simulator Adapter → Simulated Target: reads and executes
- Kubernetes Connector → Message Ingest: publishes state
- Workflow Service → Audit Ledger: records audit
- Console UI → API Routes: uses workspaces
- Workflow Service → Connector Runtime: dispatches execution