usecase/

Package advisoryingest loads the owned normalized-advisory store from a bulk feed.

Package agenttools is the agent's tool catalog: the bounded set of capabilities the LLM is allowed to invoke.

Package aitriagereviewuc implements the durable human-review workflow for AI false-positive recommendations held back by the deterministic policy.

Package analysis runs the evidence-gated lifecycle for AI "judgments" – the generalized twin of the exploitation gate.

Package approval is the Human-In-The-Loop gate for AI-proposed actions.

Package assetuc is the use-case layer for the fleet asset model (#431, epic #405).

Package attackpath assembles tenant-scoped attack paths from existing records.

Package audit is the read/verify use case over the append-only audit log.

Package aup (use case) implements first-run Acceptable-Use-Policy logic.

Package codequality assembles the code-quality findings for a source tree: it runs the deterministic maintainability/reliability rule engine and layers on the metric-derived signals (duplication, and complexity when an AST backend is available), mapping everything to first-party finding.Finding values (Kind=quality/reliability, ungated, publishable like SAST).

Package credentials is the management use case over the credential vault (secrets never enter logs): an operator stores per-engagement secrets (write-only) and lists or deletes them by NAME.

Package crosscheckjudge turns cross-check DISAGREEMENTS into Judgments for human review.

Package cspm orchestrates read-only live cloud posture scans.

Package dastcrawl derives a bounded, deterministic HTTP surface from authenticated observations.

Package dastrunner executes narrowly-scoped, approved runtime verification probes.

Package dastsession executes approved, authenticated DAST request batches.

Package dastverifier ingests runtime-verifier results for AppSec findings.

Package dastworkflow coordinates the governed DAST verification lifecycle.

Package egress compiles an engagement scope into a default-deny egress policy: the concrete set of {destination, ports} a sandboxed tool may reach.

Package emulation runs adversary emulation (issue #421) as a SUBSET of the exploitation machine's guarantees, never a looser path.

Package engagement (use case) implements engagement application logic.

Package evidence is the tamper-evident evidence vault: it appends sealed, hash-chained links, stores artifacts content-addressed in a blob store, and verifies the chain on read – emitting an append-only tamper ALERT on any mismatch.

Package execution holds the shared server-side execution guard: engagement scope + legal authorization-window enforcement with append-only audit, applied BEFORE any tool runs.

Package exploitation is the evidence-gated lifecycle for AI/exploitation findings.

Package export builds deterministic SARIF 2.1.0 + OpenVEX documents from stored findings.

Package findings handles the human findings workflow: manual authoring, triage status transitions (with optimistic concurrency), assignment, and the persisted comment thread.

Package fleetagentuc is the use-case layer for fleet agent identity (#409, epic #405): an operator mints a single-use enrolment token; an agent exchanges it for a long-lived bearer credential; the API authenticates every subsequent call by that credential.

Package fleetrolloutuc is the operator-facing lifecycle of an agent update rollout: set a target, promote it past the canary, pause it, resume it, and answer what one agent should be offered.

Package fleetwork is the use-case layer for the fleet work order lifecycle (#407, epic #405): issue a signed, addressed, authorised order; let an agent claim orders addressed to it; and drive orders through the validated state machine.

Package fptriage runs an LLM-assisted false-positive critique over safe-to-transmit first-party source-analysis findings (SAST and misconfig).

Package hotspots contains Project Security Hotspot projection use cases.

Package issues contains Project code-quality issue projection use cases.

Package jsreach implements deterministic Tier-1 reachability for npm components: does first-party JavaScript or TypeScript source actually import a given package?

Package leaderuc runs leader election over a fenced lease (#406, epic #405) so more than one control-plane instance can run while exactly one is the scheduler leader at a time.

Package llmverifier is the automated LLM judgment-verifier: it makes SYNAPSE_VERIFIER_MODEL live on the server.

Package offensivepolicy enforces the offensive governance policy (docs/redteam/offensive-policy.md, issue #418) before an offensive action is admitted.

Package orchestrator is the AI orchestrator – the typed Go state machine that owns control flow.

Package ports defines application boundaries.

Package projectuc implements project application logic.

Package promotion implements the use-case layer for deterministic finding-priority promotion.

Package purplecoverage is the control plane that closes the purple loop (#426): it joins the offensive half of the ledger (an emulation.Run's per-technique coverage records — what each technique executed and EXPECTED to be detected, #421) with the defensive half (the detections that ACTUALLY fired on the same asset in the run window, #422/#423) and resolves a per-technique coverage verdict through the pure domain.

Package pyreach answers Tier-1 Python reachability by IMPORT: a vulnerable PyPI package is "reachable" iff first-party code imports it.

Package qualitygates manages tenant-scoped quality-gate definitions.

Package qualityprofiles manages named, per-language quality profiles: built-in defaults generated from the rule catalog plus tenant-scoped custom copies, and their per-project assignment.

Package reachability is the Tier-2 reachability query API: it wraps a ports.CallGraphBuilder + the deterministic callgraph domain queries into the service consumers use to turn "is this vulnerable symbol actually called?" into an evidence-backed reachability judgment.

Package reachproof is the coordinator that turns a deterministic reachability result into a CONFIRMED reachability Judgment, reusing the existing audited propose→verify gate rather than any new confirmed-state path.

Package recon orchestrates reconnaissance runs.

Package report generates an engagement's report from stored data and seals it with a SHA-256 (chain-of-custody).

Package response applies governed defensive response actions (issue #425): isolate a host, quarantine a file, stop a process.

Package riskstoryuc is the read-model assembler for the unified per-asset risk story (issue #427).

Package safety is the single admission gate for AI-proposed actions and the structural embodiment of the rule that AI orchestration is a typed Go state machine, not prompt-driven control flow.

Package sarifingest accepts SARIF 2.1.0 from third-party scanners so external findings enter the same asset model, prioritisation and governance path as first-party ones — without ever being presented as this system's own analysis.

Package sbomcrosscheckjudge (SBOM side) turns SBOM-PRODUCER cross-check DISAGREEMENTS into Judgments for human review.

Package sca orchestrates the Software Composition Analysis pipeline.

Package slauc coordinates tenant policy versions, immutable SLA assessments, and human-owned remediation transitions.

Package srcreach implements deterministic Tier-1 reachability over a first-party source import scan, shared by every language whose dependency usage is observable as an import/require/use statement.

Package taintscan is the coordinator that turns a target's deterministic taint analysis into PROPOSED, gated CapSAST judgments – one per reported injection path × injection class – reusing the existing propose→verify gate.

Package threatmodeluc is the architecture-input threat-model ingest use case: it accepts an UNTRUSTED architecture model (from the API), bounds its size, runs the domain's fail-closed Validate (referential integrity), persists it per engagement, and audits the action – the server-side enforcement the domain seam (internal/domain/threatmodel) is reasoned over by.

Package transfer implements engagement export/import: a portable bundle of an engagement's scope/findings/comments and its tamper-evident evidence chain.

Package users manages operator identities + API keys.

Package vex consumes OpenVEX documents (CRA-aligned): a client hands Synapse a VEX doc asserting the exploitability status of vulnerabilities in their products, and Synapse applies each statement to the matching finding – e.g.

Package worker is the durable-queue claim-loop: it pulls jobs from a ports.JobQueue, dispatches each to a Handler registered by Kind, heartbeats long runs so their lease does not expire mid-flight, and Completes or Fails (with backoff) the job.

Package writeupdraftuc is the use case for AI-proposed, human-gated finding write-up drafts ("human-gated authoritative drafts").