internal/

Package httpapi is the HTTP driving adapter: it maps routes to use case services.

Package mcpserver exposes Synapse's agent tool catalog to external AI clients over the Model Context Protocol.

Package advisory is the OWNED vulnerability-advisory matching brain: it decides whether a component version is affected by an advisory's version ranges WITHOUT querying a third-party service (OSV.dev / Grype), so detection does not depend on any one external matcher.

Package agent holds the pure domain types for AI orchestration: the LLM conversation values (messages, tool-calls, usage) and the orchestration state (session, proposed action, risk class, approval decision).

Package aitriagereview models the human decision that follows an AI false-positive critique which the deterministic gate policy refused to authorize on its own.

Package asset contains the technical fleet Asset and business-level BusinessAsset models.

Package attackpath derives bounded, evidence-carrying paths from estate assets to findings.

Package audit makes the audit trail tamper-evident: each entry's Hash covers its content AND the previous entry's Hash, exactly like the evidence chain (golden rule 6).

Package aup models acceptance of the Acceptable-Use Policy.

Package callgraph is the deterministic call-graph domain model (Tier-2 shared foundation): a directed graph of function-call edges plus the entrypoints reachability is measured from, and the pure query primitives over it.

Package cloudposture models vendor-neutral live cloud inventory and posture.

Package clusterinventory is the pure-domain core of the Kubernetes cluster agent (#411, epic #405): it maps a vendor-neutral snapshot of a cluster to the fleet asset model (domain/asset).

Package compliance maps a finding's CWE to the regulatory/standard controls it bears on (compliance mapping).

Package dastcheck defines the metadata contract for first-party DAST checks.

Package dastsession defines secret-free authenticated DAST session configuration.

Package dastsurface models the deterministic, bounded DAST application surface.

Package detection is the pure domain for the agent-side blue-team detection engine (issue #422): the typed event classes an eBPF sensor observes, the clean-room rules that match over them, the detection a match emits, and the coverage honesty that says a class the agent could not observe is a GAP, never a clean host.

Package distro captures the operating-system distribution of a scanned target (from its OS packages) and flags releases that are past End-of-Life – i.e.

Package emulation is the pure domain for adversary emulation (issue #421): techniques mapped to a public taxonomy, each declaring the detection it should produce, and the coverage record that pairs what executed with what was detected.

Package engagement is the aggregate root for a security-testing project: its scope, legal authorization window, and lifecycle status.

Package evidence models tamper-evident, hash-chained records of what an engagement produced (scans, findings, reports).

Package exploitation is the pure domain for a multi-step attack chain (issue #420).

Package finding models a confirmed or candidate security issue in an engagement.

Package fleetagent is the epic-#405 fleet agent identity model: an enrolled, addressable agent and the single-use enrolment token that mints it.

Package fleetcoverage is the pure-domain truth model for fleet coverage (#413, epic #405): given the facts about one (asset, capability) pair, it resolves a single coverage verdict.

Package fleetrollout decides whether ONE agent is offered an update, and to which version.

Package fleetversion is the pure-domain version model for fleet agent/control-plane version skew (#412, epic #405).

Package hostinventory is the fleet VM-agent inventory model (#410, epic #405): the facts and installed packages an agent collects from a host that is not a container.

Package hotspot models Project-scoped Security Hotspot projections.

Package ignore models a repo-committed, declarative finding-suppression policy: the accepted-risk decisions a team version-controls alongside its code – Synapse's take on Trivy's .trivyignore, made governance-first.

Package importedfinding models a finding produced by a THIRD-PARTY scanner and ingested into this system's governance path.

Package importedsbom models a client-supplied SBOM attached to an engagement.

Package issue models Project-scoped code-quality issue projections and their triage lifecycle (open / accepted / false-positive / won't-fix).

Package jsresolution models deterministic JavaScript and TypeScript package identity resolution without embedding filesystem or parser implementation details.

Package jssymbols holds the decision rules for Tier-2 JavaScript and TypeScript reachability: given what first-party source statically does with an imported npm package, can a specific AFFECTED SYMBOL of that package be reached?

Package judgment is the AI "analysis brain" primitive: a propose→verify→confirm CLAIM about a subject (a finding, component, vulnerability, or the engagement), evidence-gated and hash-chainable, that generalizes the exploitation gate.

Package measure holds numeric, non-finding project measures (code size, complexity, duplication, coverage).

Package modulegraph defines the deterministic, source-only JavaScript and TypeScript module graph used by the first phase of import reachability.

Package offensivepolicy is the machine-readable half of the offensive governance policy (docs/redteam/offensive-policy.md, issue #418).

Package project is the aggregate root for a long-lived code-quality project.

Package projectanalysis models immutable, tenant-scoped Project analysis snapshots.

Package promotion defines deterministic cross-pillar finding-priority rules.

Package purplecoverage is the pure domain that closes the purple loop (issue #426): it joins the detection each emulated technique EXPECTED (#421) with the detections that ACTUALLY fired (#422/#423) and resolves a coverage verdict.

Package qualitygate is the deterministic pass/fail gate over a codebase's measured metrics – the "Clean as You Code" quality gate.

Package qualityprofile models named, per-language rule sets — the industry-standard "Quality Profile".

Package rating turns findings + size measures into deterministic project health grades (A-E) and a technical-debt estimate, the counterpart on the code-quality side to risk priority on the security side.

Package recon holds the domain types for reconnaissance runs.

Package response is the pure domain for governed defensive response actions (issue #425): contain, isolate, quarantine.

Package riskstory is the pure, deterministic domain for the unified per-asset risk story (issue #427): one narrative per asset assembled from records already produced by the other pillars — the asset inventory (#431), the findings of every engine + their reachability verdicts, the attack-path graph (#419), runtime detections (#423), and the continuous vulnerability occurrences/assessments (#514).

Package sbom models a Software Bill of Materials and its components/licenses.

Package shared holds value objects and errors common to all domain packages.

Package sla is the pure, deterministic domain for the risk-based remediation SLA (issue #80, Phase 0).

Package sourcepolicy defines the server-authoritative policy for durable Code source snapshots.

Package taint is the deterministic taint-analysis domain model: a data-flow graph from untrusted SOURCES to dangerous SINKS, with SANITIZER nodes that neutralize a flow, plus the pure query that reports an injection – a source→sink path that crosses no sanitizer.

Package threatmodel is the architecture-input model that threat modeling reasons over: a data-flow diagram – components (processes, data stores, external entities), directed data flows between them, trust boundaries that partition them by trust level, and the assets at stake.

Package user models operator identities: each consultant is a distinct user with their own API key, so every action – comments, findings, assignments, audit, evidence – is attributable to a real person, not a shared "operator".

Package verdict is the shared adversarial-verdict value type + evidence bar used by BOTH finding (exploitation) and judgment (AI analysis).

Package vex holds the OpenVEX domain vocabulary (the closed justification enum, shared by the VEX export and the AI vex-justification judgment) AND the consume-side parser + product-to-finding matcher (document.go: Parse, Statement.Suppresses, Statement.MatchesFinding) shared by the post-scan VEX apply and the in-scan .vex consumer.

Package vulnerability models a known issue affecting an SBOM component.

Package workorder is the epic-#405 fleet work order model: a unit of work addressed to a specific agent identity, authorised by an engagement, signed by the control plane, and driven through an explicit state machine.

Package writeup holds the built-in finding-writeup library: reusable, curated finding text + remediation an operator inserts when authoring a manual finding, so report prose is consistent.

Package writeupdraft holds AI-proposed, human-gated finding write-up DRAFTS ("human-gated authoritative drafts").

Package acquire prepares an isolated workspace for an SCA target.

Package blob provides content-addressed artifact storage for the evidence vault a MinIO/S3 adapter for deployments and an in-memory store for dev/tests.

Package fptriagecache provides a bounded, filesystem-backed cache for typed AI false-positive triage claims.

Package sbomcache is a filesystem-backed, content-addressed cache of generated SBOMs.

Package aws implements the read-only AWS cloud posture connector.

Package azure implements the read-only Azure Resource Graph cloud-posture connector.

Package gcp provides the read-only Google Cloud posture connector.

Package cloudsandbox executes credentialed cloud SDK helpers inside the hardened sandbox.

Package dastchecks evaluates deterministic, passive DAST observations.

Package dastengine runs authenticated DAST plans through a dedicated helper.

Package detectsink provides the milestone-1 landing spot for the detections the agent-side engine (#422) emits: an append-only JSONL file on the host.

Package ebpf is the egress connection observer: a cgroup connect4/connect6 eBPF program (compiled to bytecode by clang, embedded, loaded by cilium/ebpf – no toolchain at runtime) attached to a per-run cgroup.

Package egress applies a compiled egress.Policy as a real, kernel-enforced network namespace.

Package fleetca is the control-plane certificate authority for fleet agents (#408).

Package fleetclient is the agent-side HTTP client for the fleet transport (#410): it enrols, heartbeats, claims work and reports results against the control plane's /api/v1/fleet API.

Package fleetupdate is the agent self-update state machine (#412, epic #405): download a control-plane-offered version, VERIFY its checksum and signature BEFORE replacing anything, install atomically, then gate on a successful health check and AUTOMATICALLY ROLL BACK if the new version does not become healthy within a bounded window.

Package hostinv collects a fleet VM agent's host inventory (#410): host facts and installed OS packages, read from the host filesystem under a configurable root.

Package k8sinv is the Kubernetes infrastructure adapter for the cluster agent (#411, epic #405).

Package openai implements ports.LLM against an OpenAI-compatible Chat Completions API – the reference provider, tested against the LLM gateway.

Package logstream is an in-memory pub/sub for recon-run logs, backing the SSE endpoint (ports.LogStream).

Package file provides simple file-backed stores for single-tenant self-host mode and tests.

Package memory provides in-memory repository implementations for the walking skeleton and tests.

Package postgres provides PostgreSQL-backed repositories (pgx/v5) and applies migrations via goose.

Package recon provides ports.ReconTool adapters: each knows one recon binary's argv and output format.

DOCX report renderer.

Package sandbox implements ports.ToolRunner by confining each argv tool run in an unprivileged sandbox (see docs/08-security-model.md for the as-built control set).

Package signing implements ports.ChainSigner with ed25519: it attests to an evidence chain head so a custody chain proves origin (non-repudiation), not just integrity.

Package sourceartifact stores immutable Project analysis source on local disk.

Package sourcesnippet reads a bounded source excerpt from a scanned workspace for the AI false-positive triage.

Package timestamp implements ports.TimestampAuthority with an RFC-3161 client: it anchors a custody chain head to an EXTERNAL trusted timestamp, so a head can be proven to have existed before a given instant independent of the server's own ed25519 key – i.e.

Package toolrunner runs argv-based tools for the recon use case.

Package ast adapts the synapse-ast sidecar to the ports.ASTProvider port: it shells out (argv only, no shell) to the binary, which parses the target with tree-sitter and returns per-language function counts as JSON.

Package astwalk is the source-tree walk + result model shared by the synapse-ast sidecar's CGO (tree-sitter) and CGO-free (stub) builds.

Package bincat catalogs installed language packages from a materialized image root filesystem that a lockfile would miss: Go module dependencies embedded in compiled Go binaries (via stdlib debug/buildinfo) and Python distributions installed on disk (*.dist-info / *.egg-info metadata).

Package codeanalysis is a deterministic, pure-Go maintainability and reliability rule engine.

Package codeinventory is a deterministic, pure-Go code-size inventory: it walks a source tree, classifies each file's language with go-enry, and counts code / comment / blank lines per language, plus functions where a first-party parser exists (Go today, via go/parser).

Package coverage parses a test-coverage report (lcov, Cobertura XML, or JaCoCo XML) into per-file, per-line coverage.

Package doctor provides an offline, read-only preflight report for synapse-cli.

Package duplication is a deterministic, pure-Go copy-paste (clone) detector: it walks a source tree, tokenizes each file (comment- and whitespace-insensitive, language-aware comment stripping), and finds runs of duplicated tokens across and within files via a Rabin-Karp rolling hash, then reports the standard duplication metrics (blocks, duplicated lines, files, density).

Package enry adapts source-language detection to the LanguageDetector port, backed by go-enry (the GitHub Linguist port).

Package gitdiff computes the set of added/changed lines per file between a base ref and the working tree, for "new code" (Clean-as-You-Code) gating: a finding is "new" when it sits on a changed line.

Package gomodgraph resolves the transitive dependency EDGES of a Go module by shelling out to `go mod graph` via argv and mapping its module-graph output onto the SBOM's existing golang components.

Package govulncheck adapts the Go call-graph builder to the CallGraphBuilder port by shelling out to a pinned govulncheck binary via argv.

Package gradleresolve resolves a Gradle project's full dependency tree (direct + transitive, with the resolved versions) by shelling out (argv only) to a pinned `gradle` with a Synapse init script that walks the resolution-result GRAPH of the `runtimeClasspath` of EVERY project in the build (root + all subprojects) and prints each resolved Maven module.

Package grype is a DetectionSource that augments OSV.

Package ignorefile loads a repo-committed .synapseignore suppression policy from a prepared workspace.

Package jarchecksum captures the artifact SHA-1 of JVM components by hashing the JAR files in the prepared workspace.

Package jarhash recovers the Maven coordinate of a shaded / relocated / metadata-less JVM component from its artifact SHA-1, by querying Maven Central's SHA-1 search API.

Package jarlicense recovers component licenses from the license TEXT embedded in JARs in the prepared workspace, for components the registry lookup left unknown.

Package jsimports implements the deterministic, source-only JavaScript and TypeScript module-import scanner behind ports.JSImportScanner (epic #378 phase R1).

Package jsresolve provides offline, deterministic JavaScript and TypeScript package-identity metadata processing.

Package jvmreach computes COARSE, deterministic class-level reachability for JVM projects: starting from the application's own compiled classes, does anything (transitively) reference a dependency's classes at all? A dependency whose classes are never referenced is "present but not wired in" – the signal behind the field complaint that a scan lists packages the project does not use.

Package license adapts license classification + policy to the LicenseScanner port.

Package licensefile recovers component licenses by classifying the LICENSE / COPYING files present in the prepared workspace – the cross-ecosystem equivalent of Trivy's `--license-full`, but for ANY language (not just JARs, which jarlicense handles).

Package licensemeta enriches SBOM components with license metadata from package registries (license recovery).

Package licensetext classifies license FILE TEXT into an SPDX id with a confidence score, using github.com/google/licensecheck (the classifier deps.dev/pkgsite use).

Package manifest enriches a generator's SBOM from dependency manifests the generator under-uses: it reconstructs missing dependency edges (Gemfile.lock), recovers dependencies the generator cannot resolve from source (Maven pom.xml, Gradle version catalogs), and refines component scope via pnpm workspace attribution.

Package manifestresolve resolves the dependency tree of a lockfile-less package manifest by shelling out (argv only, no shell) to the ecosystem's own tool in a LOCK-ONLY, NO-SCRIPTS mode over a THROWAWAY COPY of the manifest, then reusing the owned lockfile parser to emit pinned components.

Package mavencoord recovers authoritative Maven coordinates for SBOM components whose groupId was mis-derived during SBOM generation.

Package mavenresolve resolves a Maven project's full dependency tree (direct + transitive, with the real versions) by shelling out to `mvn dependency:list` via argv, then parsing the resolved coordinates into SBOM components.

Package misconfig is an owned, deterministic infrastructure-as-code / config scanner over a prepared workspace.

Package msi parses a Windows Installer (.msi) file — a pure-Go, dependency-free reader for the OLE2 Compound File Binary Format (MS-CFB) container plus the MSI table layout on top of it — to recover the installed product's identity (name, version, manufacturer, product code) for cataloging.

Package notebook decodes the small, stable subset of the Jupyter notebook format needed by source analyzers.

Package npmresolve resolves an npm project's dependency tree (direct + transitive, with pinned versions) from a package.json that has NO committed lockfile — the common raw-source state where the manifest declares only semver RANGES (^1.2.3, ~1.0, >=2) and the SBOM otherwise sees no resolvable version to advisory-match.

Package nvd backfills the severity of vulnerabilities the detection sources left UNKNOWN (an OSV-only distro CVE often carries no CVSS) by looking up the CVE's CVSS base score in the NVD CVE API.

Package ospkg catalogs installed OS packages from a materialized image root filesystem: Debian/Ubuntu dpkg (/var/lib/dpkg/status), Alpine apk (/lib/apk/db/installed), and RHEL-family rpm (/var/lib/rpm/rpmdb.sqlite), with the distro release read from /etc/os-release.

Package osv is a DetectionSource that queries OSV.dev – the primary vuln source (free, no auth, no rate limit).

Package ownadvisory is the OWNED advisory DetectionSource: it matches an SBOM against Synapse's own normalized advisory store using the owned matcher (internal/domain/advisory), producing the same vulnerability.RawFinding the OSV/Grype adapters do – but WITHOUT querying any third-party service.

Package ownsbom is Synapse's OWNED SBOM producer: a per-ecosystem parser registry that reads dependency manifests/lockfiles directly and emits a normalized sbom.SBOM, WITHOUT shelling out to a third-party scanner.

Package pyimports is a SOURCE-ONLY Python import scanner: it reads a target's first-party .py files and extracts the top-level modules they import, plus whether the code uses dynamic imports.

Package qualityprofile loads the .synapse-gate.yaml (quality gate) and .synapse-rules.yaml (rule profile) config files into the pure-domain qualitygate types.

Package risk enriches vulnerabilities with CISA KEV + FIRST EPSS so they can be ordered by real risk priority (KEV -> EPSS x CVSS).

Package sast is a deterministic, pure-Go pattern scanner: it walks a source tree and flags high-signal weaknesses (weak crypto, hardcoded secrets/keys, insecure TLS config) by regex, emitting one finding per (file, line, rule).

Package secretscan is an owned, deterministic secret scanner over a prepared workspace.

Package srcimports implements source-only first-party import scanners for languages whose dependency usage is observable as an import/require/use statement (Rust, PHP, Ruby).

Package ssacallgraph builds a deterministic call graph from Go SOURCE using go/ssa – the general, first-party call graph taint analysis needs.

Package syft adapts SBOM generation to the SBOMGenerator port by shelling out to a pinned Syft binary.

Package taintcallgraph is the adapter that produces a general first-party call graph for E39 taint analysis by shelling out to the sandboxed `synapse-callgraph` argv binary (which runs the heavy go/ssa builder, internal/infrastructure/tools/ssacallgraph).

Package vexfile loads an in-repo OpenVEX document (.synapse.vex.json) from a prepared workspace.

Package vault is the credential store: per-engagement secrets encrypted at rest with AES-256-GCM under a master key that never touches the database, logs, or the LLM transcript.

Package agenttoken mints and parses fleet agent credentials.

Package binregistry verifies tool-binary integrity before execution (F5).

Package buildinfo reports dependency + application versions from the compiled binary's build metadata, used to record scan reproducibility.

Package config loads runtime configuration from the environment.

Package httpserver runs an HTTP server with graceful shutdown.

Package idgen provides Clock and IDGenerator implementations for the platform.

Package jobs is a small bounded worker pool: a fixed number of workers draining a fixed-size queue.

Package logging builds the application's structured logger.

Package redact is the shared belt-and-suspenders scrubber for secret material on its way to any sink – logs, the audit writer, the evidence seal, tool output.

Package untrusted is the shared guard for any UNTRUSTED text a source-reading AI ingests – dependency source excerpts, files a SAST/threat brain reads, or a tool's stdout.

Package worksign is the platform adapter that signs and verifies fleet work order payloads with an HMAC-SHA256 keyed MAC.

Package advisoryingest loads the owned normalized-advisory store from a bulk feed.

Package agenttools is the agent's tool catalog: the bounded set of capabilities the LLM is allowed to invoke.

Package aitriagereviewuc implements the durable human-review workflow for AI false-positive recommendations held back by the deterministic policy.

Package analysis runs the evidence-gated lifecycle for AI "judgments" – the generalized twin of the exploitation gate.

Package approval is the Human-In-The-Loop gate for AI-proposed actions.

Package assetuc is the use-case layer for the fleet asset model (#431, epic #405).

Package attackpath assembles tenant-scoped attack paths from existing records.

Package audit is the read/verify use case over the append-only audit log.

Package aup (use case) implements first-run Acceptable-Use-Policy logic.

Package codequality assembles the code-quality findings for a source tree: it runs the deterministic maintainability/reliability rule engine and layers on the metric-derived signals (duplication, and complexity when an AST backend is available), mapping everything to first-party finding.Finding values (Kind=quality/reliability, ungated, publishable like SAST).

Package credentials is the management use case over the credential vault (secrets never enter logs): an operator stores per-engagement secrets (write-only) and lists or deletes them by NAME.

Package crosscheckjudge turns cross-check DISAGREEMENTS into Judgments for human review.

Package cspm orchestrates read-only live cloud posture scans.

Package dastcrawl derives a bounded, deterministic HTTP surface from authenticated observations.

Package dastrunner executes narrowly-scoped, approved runtime verification probes.

Package dastsession executes approved, authenticated DAST request batches.

Package dastverifier ingests runtime-verifier results for AppSec findings.

Package dastworkflow coordinates the governed DAST verification lifecycle.

Package egress compiles an engagement scope into a default-deny egress policy: the concrete set of {destination, ports} a sandboxed tool may reach.

Package emulation runs adversary emulation (issue #421) as a SUBSET of the exploitation machine's guarantees, never a looser path.

Package engagement (use case) implements engagement application logic.

Package evidence is the tamper-evident evidence vault: it appends sealed, hash-chained links, stores artifacts content-addressed in a blob store, and verifies the chain on read – emitting an append-only tamper ALERT on any mismatch.

Package execution holds the shared server-side execution guard: engagement scope + legal authorization-window enforcement with append-only audit, applied BEFORE any tool runs.

Package exploitation is the evidence-gated lifecycle for AI/exploitation findings.

Package export builds deterministic SARIF 2.1.0 + OpenVEX documents from stored findings.

Package findings handles the human findings workflow: manual authoring, triage status transitions (with optimistic concurrency), assignment, and the persisted comment thread.

Package clusterinventory is the use-case layer for the Kubernetes cluster agent (#411, epic #405).

Package coverage is the fleet coverage read model (#413, epic #405): a tenant-scoped PROJECTION over agents, work orders and the asset model that answers, for each (asset, capability), what the coverage verdict is — with unknown/stale/refused/unauthorized/agent-missing kept as distinct states (domain/fleetcoverage) rather than collapsed into "clean".

Package detect is the agent-side detection engine (issue #422, phase 3).

Package detectledger turns the agent-side detection engine's output (#422) into hash-chained, attributable evidence (#423).

Package hostinventory is the use-case layer for the VM host agent (#410/#446, epic #405).

Package telemetry is the agent-side raw-telemetry tier's control plane (#424, ADR 0001).

Package fleetagentuc is the use-case layer for fleet agent identity (#409, epic #405): an operator mints a single-use enrolment token; an agent exchanges it for a long-lived bearer credential; the API authenticates every subsequent call by that credential.

Package fleetrolloutuc is the operator-facing lifecycle of an agent update rollout: set a target, promote it past the canary, pause it, resume it, and answer what one agent should be offered.

Package fleetwork is the use-case layer for the fleet work order lifecycle (#407, epic #405): issue a signed, addressed, authorised order; let an agent claim orders addressed to it; and drive orders through the validated state machine.

Package fptriage runs an LLM-assisted false-positive critique over safe-to-transmit first-party source-analysis findings (SAST and misconfig).

Package hotspots contains Project Security Hotspot projection use cases.

Package issues contains Project code-quality issue projection use cases.

Package jsreach implements deterministic Tier-1 reachability for npm components: does first-party JavaScript or TypeScript source actually import a given package?

Package leaderuc runs leader election over a fenced lease (#406, epic #405) so more than one control-plane instance can run while exactly one is the scheduler leader at a time.

Package llmverifier is the automated LLM judgment-verifier: it makes SYNAPSE_VERIFIER_MODEL live on the server.

Package offensivepolicy enforces the offensive governance policy (docs/redteam/offensive-policy.md, issue #418) before an offensive action is admitted.

Package orchestrator is the AI orchestrator – the typed Go state machine that owns control flow.

Package ports defines application boundaries.

Package projectuc implements project application logic.

Package promotion implements the use-case layer for deterministic finding-priority promotion.

Package purplecoverage is the control plane that closes the purple loop (#426): it joins the offensive half of the ledger (an emulation.Run's per-technique coverage records — what each technique executed and EXPECTED to be detected, #421) with the defensive half (the detections that ACTUALLY fired on the same asset in the run window, #422/#423) and resolves a per-technique coverage verdict through the pure domain.

Package pyreach answers Tier-1 Python reachability by IMPORT: a vulnerable PyPI package is "reachable" iff first-party code imports it.

Package qualitygates manages tenant-scoped quality-gate definitions.

Package qualityprofiles manages named, per-language quality profiles: built-in defaults generated from the rule catalog plus tenant-scoped custom copies, and their per-project assignment.

Package reachability is the Tier-2 reachability query API: it wraps a ports.CallGraphBuilder + the deterministic callgraph domain queries into the service consumers use to turn "is this vulnerable symbol actually called?" into an evidence-backed reachability judgment.

Package reachproof is the coordinator that turns a deterministic reachability result into a CONFIRMED reachability Judgment, reusing the existing audited propose→verify gate rather than any new confirmed-state path.

Package recon orchestrates reconnaissance runs.

Package report generates an engagement's report from stored data and seals it with a SHA-256 (chain-of-custody).

Package response applies governed defensive response actions (issue #425): isolate a host, quarantine a file, stop a process.

Package riskstoryuc is the read-model assembler for the unified per-asset risk story (issue #427).

Package safety is the single admission gate for AI-proposed actions and the structural embodiment of the rule that AI orchestration is a typed Go state machine, not prompt-driven control flow.

Package sarifingest accepts SARIF 2.1.0 from third-party scanners so external findings enter the same asset model, prioritisation and governance path as first-party ones — without ever being presented as this system's own analysis.

Package sbomcrosscheckjudge (SBOM side) turns SBOM-PRODUCER cross-check DISAGREEMENTS into Judgments for human review.

Package sca orchestrates the Software Composition Analysis pipeline.

Package slauc coordinates tenant policy versions, immutable SLA assessments, and human-owned remediation transitions.

Package srcreach implements deterministic Tier-1 reachability over a first-party source import scan, shared by every language whose dependency usage is observable as an import/require/use statement.

Package taintscan is the coordinator that turns a target's deterministic taint analysis into PROPOSED, gated CapSAST judgments – one per reported injection path × injection class – reusing the existing propose→verify gate.

Package threatmodeluc is the architecture-input threat-model ingest use case: it accepts an UNTRUSTED architecture model (from the API), bounds its size, runs the domain's fail-closed Validate (referential integrity), persists it per engagement, and audits the action – the server-side enforcement the domain seam (internal/domain/threatmodel) is reasoned over by.

Package transfer implements engagement export/import: a portable bundle of an engagement's scope/findings/comments and its tamper-evident evidence chain.

Package users manages operator identities + API keys.

Package vex consumes OpenVEX documents (CRA-aligned): a client hands Synapse a VEX doc asserting the exploitability status of vulnerabilities in their products, and Synapse applies each statement to the matching finding – e.g.

Package worker is the durable-queue claim-loop: it pulls jobs from a ports.JobQueue, dispatches each to a Handler registered by Kind, heartbeats long runs so their lease does not expire mid-flight, and Completes or Fails (with backoff) the job.

Package writeupdraftuc is the use case for AI-proposed, human-gated finding write-up drafts ("human-gated authoritative drafts").