usecase/

Package advisoryingest loads the owned normalized-advisory store from a bulk feed.

Package agenttools is the agent's tool catalog: the bounded set of capabilities the LLM is allowed to invoke.

Package analysis runs the evidence-gated lifecycle for AI "judgments" – the generalized twin of the exploitation gate.

Package approval is the Human-In-The-Loop gate for AI-proposed actions.

Package audit is the read/verify use case over the append-only audit log.

Package aup (use case) implements first-run Acceptable-Use-Policy logic.

Package codequality assembles the code-quality findings for a source tree: it runs the deterministic maintainability/reliability rule engine and layers on the metric-derived signals (duplication, and complexity when an AST backend is available), mapping everything to first-party finding.Finding values (Kind=quality/reliability, ungated, publishable like SAST).

Package credentials is the management use case over the credential vault (secrets never enter logs): an operator stores per-engagement secrets (write-only) and lists or deletes them by NAME.

Package crosscheckjudge turns cross-check DISAGREEMENTS into Judgments for human review.

Package dastrunner executes narrowly-scoped, approved runtime verification probes.

Package dastverifier ingests runtime-verifier results for AppSec findings.

Package dastworkflow coordinates the governed DAST verification lifecycle.

Package egress compiles an engagement scope into a default-deny egress policy: the concrete set of {destination, ports} a sandboxed tool may reach.

Package engagement (use case) implements engagement application logic.

Package evidence is the tamper-evident evidence vault: it appends sealed, hash-chained links, stores artifacts content-addressed in a blob store, and verifies the chain on read – emitting an append-only tamper ALERT on any mismatch.

Package execution holds the shared server-side execution guard: engagement scope + legal authorization-window enforcement with append-only audit, applied BEFORE any tool runs.

Package exploitation is the evidence-gated lifecycle for AI/exploitation findings.

Package export builds deterministic SARIF 2.1.0 + OpenVEX documents from stored findings.

Package findings handles the human findings workflow: manual authoring, triage status transitions (with optimistic concurrency), assignment, and the persisted comment thread.

Package fptriage runs an LLM-assisted false-positive critique over first-party source-analysis findings (SAST, secret, misconfig).

Package hotspots contains Project Security Hotspot projection use cases.

Package issues contains Project code-quality issue projection use cases.

Package llmverifier is the automated LLM judgment-verifier: it makes SYNAPSE_VERIFIER_MODEL live on the server.

Package orchestrator is the AI orchestrator – the typed Go state machine that owns control flow.

Package ports declares the interfaces (driven ports) that use cases depend on.

Package projectuc implements project application logic.

Package pyreach answers Tier-1 Python reachability by IMPORT: a vulnerable PyPI package is "reachable" iff first-party code imports it.

Package qualitygates manages tenant-scoped quality-gate definitions.

Package qualityprofiles manages named, per-language quality profiles: built-in defaults generated from the rule catalog plus tenant-scoped custom copies, and their per-project assignment.

Package reachability is the Tier-2 reachability query API: it wraps a ports.CallGraphBuilder + the deterministic callgraph domain queries into the service consumers use to turn "is this vulnerable symbol actually called?" into an evidence-backed reachability judgment.

Package reachproof is the coordinator that turns a deterministic reachability result into a CONFIRMED reachability Judgment, reusing the existing audited propose→verify gate rather than any new confirmed-state path.

Package recon orchestrates reconnaissance runs.

Package report generates an engagement's report from stored data and seals it with a SHA-256 (chain-of-custody).

Package safety is the single admission gate for AI-proposed actions and the structural embodiment of the rule that AI orchestration is a typed Go state machine, not prompt-driven control flow.

Package sbomcrosscheckjudge (SBOM side) turns SBOM-PRODUCER cross-check DISAGREEMENTS into Judgments for human review.

Package sca orchestrates the Software Composition Analysis pipeline.

Package taintscan is the coordinator that turns a target's deterministic taint analysis into PROPOSED, gated CapSAST judgments – one per reported injection path × injection class – reusing the existing propose→verify gate.

Package threatmodeluc is the architecture-input threat-model ingest use case: it accepts an UNTRUSTED architecture model (from the API), bounds its size, runs the domain's fail-closed Validate (referential integrity), persists it per engagement, and audits the action – the server-side enforcement the domain seam (internal/domain/threatmodel) is reasoned over by.

Package transfer implements engagement export/import: a portable bundle of an engagement's scope/findings/comments and its tamper-evident evidence chain.

Package users manages operator identities + API keys.

Package vex consumes OpenVEX documents (CRA-aligned): a client hands Synapse a VEX doc asserting the exploitability status of vulnerabilities in their products, and Synapse applies each statement to the matching finding – e.g.

Package worker is the durable-queue claim-loop: it pulls jobs from a ports.JobQueue, dispatches each to a Handler registered by Kind, heartbeats long runs so their lease does not expire mid-flight, and Completes or Fails (with backoff) the job.

Package writeupdraftuc is the use case for AI-proposed, human-gated finding write-up drafts ("human-gated authoritative drafts").