synapse-worker

Overview ¶

Command synapse-worker is the privileged execution worker: it claims recon jobs the API enqueued to the durable queue and runs them under the SAME gate/audit/evidence invariants as the in-process path, but with the sandbox + kernel egress allowlist (it runs with CAP_NET_ADMIN/SYS_ADMIN, which the API lacks). It is a composition root only – no business logic. It coexists with the API via a role-scoped single-instance lock, and the evidence chain is multi-writer-safe.