synapse-worker

Overview ¶

Command synapse-worker is the privileged execution worker: it claims recon jobs the API enqueued to the durable queue and runs them under the SAME gate/audit/evidence invariants as the in-process path, but with the sandbox + kernel egress allowlist (through a narrow root-owned broker on hardened execution hosts). It is a composition root only – no business logic. It coexists with the API via a role-scoped concurrent queue claim loops, and the evidence chain is multi-writer-safe.