internal/

Package httpapi is the HTTP driving adapter: it maps routes to use case services.

Package mcpserver exposes Synapse's agent tool catalog to external AI clients over the Model Context Protocol.

Package advisory is the OWNED vulnerability-advisory matching brain: it decides whether a component version is affected by an advisory's version ranges WITHOUT querying a third-party service (OSV.dev / Grype), so detection does not depend on any one external matcher.

Package agent holds the pure domain types for AI orchestration: the LLM conversation values (messages, tool-calls, usage) and the orchestration state (session, proposed action, risk class, approval decision).

Package audit makes the audit trail tamper-evident: each entry's Hash covers its content AND the previous entry's Hash, exactly like the evidence chain (golden rule 6).

Package aup models acceptance of the Acceptable-Use Policy.

Package callgraph is the deterministic call-graph domain model (Tier-2 shared foundation): a directed graph of function-call edges plus the entrypoints reachability is measured from, and the pure query primitives over it.

Package compliance maps a finding's CWE to the regulatory/standard controls it bears on (compliance mapping).

Package distro captures the operating-system distribution of a scanned target (from its OS packages) and flags releases that are past End-of-Life – i.e.

Package engagement is the aggregate root for a security-testing project: its scope, legal authorization window, and lifecycle status.

Package evidence models tamper-evident, hash-chained records of what an engagement produced (scans, findings, reports).

Package finding models a confirmed or candidate security issue in an engagement.

Package hotspot models Project-scoped Security Hotspot projections.

Package ignore models a repo-committed, declarative finding-suppression policy: the accepted-risk decisions a team version-controls alongside its code – Synapse's take on Trivy's .trivyignore, made governance-first.

Package importedsbom models a client-supplied SBOM attached to an engagement.

Package issue models Project-scoped code-quality issue projections and their triage lifecycle (open / accepted / false-positive / won't-fix).

Package judgment is the AI "analysis brain" primitive: a propose→verify→confirm CLAIM about a subject (a finding, component, vulnerability, or the engagement), evidence-gated and hash-chainable, that generalizes the exploitation gate.

Package measure holds numeric, non-finding project measures (code size, complexity, duplication, coverage).

Package project is the aggregate root for a long-lived code-quality project.

Package projectanalysis models immutable, tenant-scoped Project analysis snapshots.

Package qualitygate is the deterministic pass/fail gate over a codebase's measured metrics – the "Clean as You Code" quality gate.

Package qualityprofile models named, per-language rule sets — the industry-standard "Quality Profile".

Package rating turns findings + size measures into deterministic project health grades (A-E) and a technical-debt estimate, the counterpart on the code-quality side to risk priority on the security side.

Package recon holds the domain types for reconnaissance runs.

Package sbom models a Software Bill of Materials and its components/licenses.

Package shared holds value objects and errors common to all domain packages.

Package taint is the deterministic taint-analysis domain model: a data-flow graph from untrusted SOURCES to dangerous SINKS, with SANITIZER nodes that neutralize a flow, plus the pure query that reports an injection – a source→sink path that crosses no sanitizer.

Package threatmodel is the architecture-input model that threat modeling reasons over: a data-flow diagram – components (processes, data stores, external entities), directed data flows between them, trust boundaries that partition them by trust level, and the assets at stake.

Package user models operator identities: each consultant is a distinct user with their own API key, so every action – comments, findings, assignments, audit, evidence – is attributable to a real person, not a shared "operator".

Package verdict is the shared adversarial-verdict value type + evidence bar used by BOTH finding (exploitation) and judgment (AI analysis).

Package vex holds the OpenVEX domain vocabulary (the closed justification enum, shared by the VEX export and the AI vex-justification judgment) AND the consume-side parser + product-to-finding matcher (document.go: Parse, Statement.Suppresses, Statement.MatchesFinding) shared by the post-scan VEX apply and the in-scan .vex consumer.

Package vulnerability models a known issue affecting an SBOM component.

Package writeup holds the built-in finding-writeup library: reusable, curated finding text + remediation an operator inserts when authoring a manual finding, so report prose is consistent.

Package writeupdraft holds AI-proposed, human-gated finding write-up DRAFTS ("human-gated authoritative drafts").

Package acquire prepares an isolated workspace for an SCA target.

Package blob provides content-addressed artifact storage for the evidence vault a MinIO/S3 adapter for deployments and an in-memory store for dev/tests.

Package sbomcache is a filesystem-backed, content-addressed cache of generated SBOMs.

Package ebpf is the egress connection observer: a cgroup connect4/connect6 eBPF program (compiled to bytecode by clang, embedded, loaded by cilium/ebpf – no toolchain at runtime) attached to a per-run cgroup.

Package egress applies a compiled egress.Policy as a real, kernel-enforced network namespace.

Package openai implements ports.LLM against an OpenAI-compatible Chat Completions API – the reference provider, tested against the LLM gateway.

Package logstream is an in-memory pub/sub for recon-run logs, backing the SSE endpoint (ports.LogStream).

Package file provides simple file-backed stores for single-tenant self-host mode and tests.

Package memory provides in-memory repository implementations for the walking skeleton and tests.

Package postgres provides PostgreSQL-backed repositories (pgx/v5) and applies migrations via goose.

Package recon provides ports.ReconTool adapters: each knows one recon binary's argv and output format.

DOCX report renderer.

Package sandbox implements ports.ToolRunner by confining each argv tool run in an unprivileged sandbox (see docs/08-security-model.md for the as-built control set).

Package signing implements ports.ChainSigner with ed25519: it attests to an evidence chain head so a custody chain proves origin (non-repudiation), not just integrity.

Package sourcesnippet reads a bounded source excerpt from a scanned workspace for the AI false-positive triage.

Package timestamp implements ports.TimestampAuthority with an RFC-3161 client: it anchors a custody chain head to an EXTERNAL trusted timestamp, so a head can be proven to have existed before a given instant independent of the server's own ed25519 key – i.e.

Package toolrunner runs argv-based tools for the recon use case.

Package ast adapts the synapse-ast sidecar to the ports.ASTProvider port: it shells out (argv only, no shell) to the binary, which parses the target with tree-sitter and returns per-language function counts as JSON.

Package astwalk is the source-tree walk + result model shared by the synapse-ast sidecar's CGO (tree-sitter) and CGO-free (stub) builds.

Package bincat catalogs installed language packages from a materialized image root filesystem that a lockfile would miss: Go module dependencies embedded in compiled Go binaries (via stdlib debug/buildinfo) and Python distributions installed on disk (*.dist-info / *.egg-info metadata).

Package codeanalysis is a deterministic, pure-Go maintainability + reliability rule engine: it walks a source tree and flags code smells (Kind=quality) and likely bugs (Kind=reliability) per (file, line), mirroring the SAST pattern analyzer.

Package codeinventory is a deterministic, pure-Go code-size inventory: it walks a source tree, classifies each file's language with go-enry, and counts code / comment / blank lines per language, plus functions where a first-party parser exists (Go today, via go/parser).

Package coverage parses a test-coverage report (lcov, Cobertura XML, or JaCoCo XML) into per-file, per-line coverage.

Package doctor provides an offline, read-only preflight report for synapse-cli.

Package duplication is a deterministic, pure-Go copy-paste (clone) detector: it walks a source tree, tokenizes each file (comment- and whitespace-insensitive, language-aware comment stripping), and finds runs of duplicated tokens across and within files via a Rabin-Karp rolling hash, then reports the standard duplication metrics (blocks, duplicated lines, files, density).

Package enry adapts source-language detection to the LanguageDetector port, backed by go-enry (the GitHub Linguist port).

Package gitdiff computes the set of added/changed lines per file between a base ref and the working tree, for "new code" (Clean-as-You-Code) gating: a finding is "new" when it sits on a changed line.

Package gomodgraph resolves the transitive dependency EDGES of a Go module by shelling out to `go mod graph` via argv and mapping its module-graph output onto the SBOM's existing golang components.

Package govulncheck adapts the Go call-graph builder to the CallGraphBuilder port by shelling out to a pinned govulncheck binary via argv.

Package gradleresolve resolves a Gradle project's full dependency tree (direct + transitive, with the resolved versions) by shelling out (argv only) to a pinned `gradle` with a Synapse init script that walks the resolution-result GRAPH of the `runtimeClasspath` of EVERY project in the build (root + all subprojects) and prints each resolved Maven module.

Package grype is a DetectionSource that augments OSV.

Package ignorefile loads a repo-committed .synapseignore suppression policy from a prepared workspace.

Package jarchecksum captures the artifact SHA-1 of JVM components by hashing the JAR files in the prepared workspace.

Package jarhash recovers the Maven coordinate of a shaded / relocated / metadata-less JVM component from its artifact SHA-1, by querying Maven Central's SHA-1 search API.

Package jarlicense recovers component licenses from the license TEXT embedded in JARs in the prepared workspace, for components the registry lookup left unknown.

Package jvmreach computes COARSE, deterministic class-level reachability for JVM projects: starting from the application's own compiled classes, does anything (transitively) reference a dependency's classes at all? A dependency whose classes are never referenced is "present but not wired in" – the signal behind the field complaint that a scan lists packages the project does not use.

Package license adapts license classification + policy to the LicenseScanner port.

Package licensefile recovers component licenses by classifying the LICENSE / COPYING files present in the prepared workspace – the cross-ecosystem equivalent of Trivy's `--license-full`, but for ANY language (not just JARs, which jarlicense handles).

Package licensemeta enriches SBOM components with license metadata from package registries (license recovery).

Package licensetext classifies license FILE TEXT into an SPDX id with a confidence score, using github.com/google/licensecheck (the classifier deps.dev/pkgsite use).

Package manifest enriches a generator's SBOM from dependency manifests the generator under-uses: it reconstructs missing dependency edges (Gemfile.lock), recovers dependencies the generator cannot resolve from source (Maven pom.xml, Gradle version catalogs), and refines component scope via pnpm workspace attribution.

Package manifestresolve resolves the dependency tree of a lockfile-less package manifest by shelling out (argv only, no shell) to the ecosystem's own tool in a LOCK-ONLY, NO-SCRIPTS mode over a THROWAWAY COPY of the manifest, then reusing the owned lockfile parser to emit pinned components.

Package mavencoord recovers authoritative Maven coordinates for SBOM components whose groupId was mis-derived during SBOM generation.

Package mavenresolve resolves a Maven project's full dependency tree (direct + transitive, with the real versions) by shelling out to `mvn dependency:list` via argv, then parsing the resolved coordinates into SBOM components.

Package misconfig is an owned, deterministic infrastructure-as-code / config scanner over a prepared workspace.

Package msi parses a Windows Installer (.msi) file — a pure-Go, dependency-free reader for the OLE2 Compound File Binary Format (MS-CFB) container plus the MSI table layout on top of it — to recover the installed product's identity (name, version, manufacturer, product code) for cataloging.

Package notebook decodes the small, stable subset of the Jupyter notebook format needed by source analyzers.

Package npmresolve resolves an npm project's dependency tree (direct + transitive, with pinned versions) from a package.json that has NO committed lockfile — the common raw-source state where the manifest declares only semver RANGES (^1.2.3, ~1.0, >=2) and the SBOM otherwise sees no resolvable version to advisory-match.

Package nvd backfills the severity of vulnerabilities the detection sources left UNKNOWN (an OSV-only distro CVE often carries no CVSS) by looking up the CVE's CVSS base score in the NVD CVE API.

Package ospkg catalogs installed OS packages from a materialized image root filesystem: Debian/Ubuntu dpkg (/var/lib/dpkg/status), Alpine apk (/lib/apk/db/installed), and RHEL-family rpm (/var/lib/rpm/rpmdb.sqlite), with the distro release read from /etc/os-release.

Package osv is a DetectionSource that queries OSV.dev – the primary vuln source (free, no auth, no rate limit).

Package ownadvisory is the OWNED advisory DetectionSource: it matches an SBOM against Synapse's own normalized advisory store using the owned matcher (internal/domain/advisory), producing the same vulnerability.RawFinding the OSV/Grype adapters do – but WITHOUT querying any third-party service.

Package ownsbom is Synapse's OWNED SBOM producer: a per-ecosystem parser registry that reads dependency manifests/lockfiles directly and emits a normalized sbom.SBOM, WITHOUT shelling out to a third-party scanner.

Package pyimports is a SOURCE-ONLY Python import scanner: it reads a target's first-party .py files and extracts the top-level modules they import, plus whether the code uses dynamic imports.

Package qualityprofile loads the .synapse-gate.yaml (quality gate) and .synapse-rules.yaml (rule profile) config files into the pure-domain qualitygate types.

Package risk enriches vulnerabilities with CISA KEV + FIRST EPSS so they can be ordered by real risk priority (KEV -> EPSS x CVSS).

Package sast is a deterministic, pure-Go pattern scanner: it walks a source tree and flags high-signal weaknesses (weak crypto, hardcoded secrets/keys, insecure TLS config) by regex, emitting one finding per (file, line, rule).

Package secretscan is an owned, deterministic secret scanner over a prepared workspace.

Package ssacallgraph builds a deterministic call graph from Go SOURCE using go/ssa – the general, first-party call graph taint analysis needs.

Package syft adapts SBOM generation to the SBOMGenerator port by shelling out to a pinned Syft binary.

Package taintcallgraph is the adapter that produces a general first-party call graph for E39 taint analysis by shelling out to the sandboxed `synapse-callgraph` argv binary (which runs the heavy go/ssa builder, internal/infrastructure/tools/ssacallgraph).

Package vexfile loads an in-repo OpenVEX document (.synapse.vex.json) from a prepared workspace.

Package vault is the credential store: per-engagement secrets encrypted at rest with AES-256-GCM under a master key that never touches the database, logs, or the LLM transcript.

Package binregistry verifies tool-binary integrity before execution (F5).

Package buildinfo reports dependency + application versions from the compiled binary's build metadata, used to record scan reproducibility.

Package config loads runtime configuration from the environment.

Package httpserver runs an HTTP server with graceful shutdown.

Package idgen provides Clock and IDGenerator implementations for the platform.

Package jobs is a small bounded worker pool: a fixed number of workers draining a fixed-size queue.

Package logging builds the application's structured logger.

Package redact is the shared belt-and-suspenders scrubber for secret material on its way to any sink – logs, the audit writer, the evidence seal, tool output.

Package untrusted is the shared guard for any UNTRUSTED text a source-reading AI ingests – dependency source excerpts, files a SAST/threat brain reads, or a tool's stdout.

Package advisoryingest loads the owned normalized-advisory store from a bulk feed.

Package agenttools is the agent's tool catalog: the bounded set of capabilities the LLM is allowed to invoke.

Package analysis runs the evidence-gated lifecycle for AI "judgments" – the generalized twin of the exploitation gate.

Package approval is the Human-In-The-Loop gate for AI-proposed actions.

Package audit is the read/verify use case over the append-only audit log.

Package aup (use case) implements first-run Acceptable-Use-Policy logic.

Package codequality assembles the code-quality findings for a source tree: it runs the deterministic maintainability/reliability rule engine and layers on the metric-derived signals (duplication, and complexity when an AST backend is available), mapping everything to first-party finding.Finding values (Kind=quality/reliability, ungated, publishable like SAST).

Package credentials is the management use case over the credential vault (secrets never enter logs): an operator stores per-engagement secrets (write-only) and lists or deletes them by NAME.

Package crosscheckjudge turns cross-check DISAGREEMENTS into Judgments for human review.

Package dastrunner executes narrowly-scoped, approved runtime verification probes.

Package dastverifier ingests runtime-verifier results for AppSec findings.

Package dastworkflow coordinates the governed DAST verification lifecycle.

Package egress compiles an engagement scope into a default-deny egress policy: the concrete set of {destination, ports} a sandboxed tool may reach.

Package engagement (use case) implements engagement application logic.

Package evidence is the tamper-evident evidence vault: it appends sealed, hash-chained links, stores artifacts content-addressed in a blob store, and verifies the chain on read – emitting an append-only tamper ALERT on any mismatch.

Package execution holds the shared server-side execution guard: engagement scope + legal authorization-window enforcement with append-only audit, applied BEFORE any tool runs.

Package exploitation is the evidence-gated lifecycle for AI/exploitation findings.

Package export builds deterministic SARIF 2.1.0 + OpenVEX documents from stored findings.

Package findings handles the human findings workflow: manual authoring, triage status transitions (with optimistic concurrency), assignment, and the persisted comment thread.

Package fptriage runs an LLM-assisted false-positive critique over first-party source-analysis findings (SAST, secret, misconfig).

Package hotspots contains Project Security Hotspot projection use cases.

Package issues contains Project code-quality issue projection use cases.

Package llmverifier is the automated LLM judgment-verifier: it makes SYNAPSE_VERIFIER_MODEL live on the server.

Package orchestrator is the AI orchestrator – the typed Go state machine that owns control flow.

Package ports declares the interfaces (driven ports) that use cases depend on.

Package projectuc implements project application logic.

Package pyreach answers Tier-1 Python reachability by IMPORT: a vulnerable PyPI package is "reachable" iff first-party code imports it.

Package qualitygates manages tenant-scoped quality-gate definitions.

Package qualityprofiles manages named, per-language quality profiles: built-in defaults generated from the rule catalog plus tenant-scoped custom copies, and their per-project assignment.

Package reachability is the Tier-2 reachability query API: it wraps a ports.CallGraphBuilder + the deterministic callgraph domain queries into the service consumers use to turn "is this vulnerable symbol actually called?" into an evidence-backed reachability judgment.

Package reachproof is the coordinator that turns a deterministic reachability result into a CONFIRMED reachability Judgment, reusing the existing audited propose→verify gate rather than any new confirmed-state path.

Package recon orchestrates reconnaissance runs.

Package report generates an engagement's report from stored data and seals it with a SHA-256 (chain-of-custody).

Package safety is the single admission gate for AI-proposed actions and the structural embodiment of the rule that AI orchestration is a typed Go state machine, not prompt-driven control flow.

Package sbomcrosscheckjudge (SBOM side) turns SBOM-PRODUCER cross-check DISAGREEMENTS into Judgments for human review.

Package sca orchestrates the Software Composition Analysis pipeline.

Package taintscan is the coordinator that turns a target's deterministic taint analysis into PROPOSED, gated CapSAST judgments – one per reported injection path × injection class – reusing the existing propose→verify gate.

Package threatmodeluc is the architecture-input threat-model ingest use case: it accepts an UNTRUSTED architecture model (from the API), bounds its size, runs the domain's fail-closed Validate (referential integrity), persists it per engagement, and audits the action – the server-side enforcement the domain seam (internal/domain/threatmodel) is reasoned over by.

Package transfer implements engagement export/import: a portable bundle of an engagement's scope/findings/comments and its tamper-evident evidence chain.

Package users manages operator identities + API keys.

Package vex consumes OpenVEX documents (CRA-aligned): a client hands Synapse a VEX doc asserting the exploitability status of vulnerabilities in their products, and Synapse applies each statement to the matching finding – e.g.

Package worker is the durable-queue claim-loop: it pulls jobs from a ports.JobQueue, dispatches each to a Handler registered by Kind, heartbeats long runs so their lease does not expire mid-flight, and Completes or Fails (with backoff) the job.

Package writeupdraftuc is the use case for AI-proposed, human-gated finding write-up drafts ("human-gated authoritative drafts").