Architecture
============

The repository uses a Rust workspace. The primary validator crate is
crates/panda-rpki-validator and is organized around these responsibilities:

* command-line parsing and operator-facing commands;
* trust-anchor and publication-point retrieval;
* parsing and validation of RPKI signed objects;
* validation-tree scheduling and traversal;
* storage, caches, and run state; and
* report generation and output serialization.

Source boundaries should follow these responsibilities. Large orchestration
modules are refactored in small, test-protected steps so public behavior and
fixed-input results remain stable.

Data flow
---------

Trust-anchor inputs seed repository retrieval. Parsed objects enter the
validation tree, which applies cryptographic and resource-validation rules.
The resulting state is persisted and rendered into the configured reports.
Network transport, cache lifetime, and output retention are operational
concerns and must remain explicit in their respective modules.