Écluse sits between clients and a package registry and applies a configurable resilience policy before any dependency reaches a build. It hosts no packages: the operator's own backend stores them, and Écluse governs only what may be fetched from, and mirrored to, those backends. The rules engine is deny by default and mirroring is demand-driven, so a mirror write never runs on a request's critical path. run, the entry point the ecluse executable invokes, reads the command line and starts that command through Ecluse.Startup with the shipped adapters.