domain/

Package accuracy holds the domain model for a persisted detection-accuracy regression run: the owned engine's precision/recall over the golden corpus, captured over time so the console can show a trend.

Package advisory is the OWNED vulnerability-advisory matching brain: it decides whether a component version is affected by an advisory's version ranges WITHOUT querying a third-party service (OSV.dev / Grype), so detection does not depend on any one external matcher.

Package agent holds the pure domain types for AI orchestration: the LLM conversation values (messages, tool-calls, usage) and the orchestration state (session, proposed action, risk class, approval decision).

Package aitriagereview models the human decision that follows an AI false-positive critique which the deterministic gate policy refused to authorize on its own.

Package alerting is the domain of operator notifications: the alert a defender receives when the platform records something that needs a human, and the rule that decides which events qualify.

Package assessmentsnapshot defines immutable, comparison-ready Assessment snapshots.

Package asset contains the technical fleet Asset and business-level BusinessAsset models.

Package attackpath derives bounded, evidence-carrying paths from estate assets to findings.

Package audit makes the audit trail tamper-evident: each entry's Hash covers its content AND the previous entry's Hash, exactly like the evidence chain (golden rule 6).

Package aup models acceptance of the Acceptable-Use Policy.

Package baseline is the pure-domain behavioral-baseline model for Phase D of the EDR data plane (#594, D1-D4).

Package callgraph is the deterministic call-graph domain model (Tier-2 shared foundation): a directed graph of function-call edges plus the entrypoints reachability is measured from, and the pure query primitives over it.

Package cloudposture models vendor-neutral live cloud inventory and posture.

Package clusterinventory is the pure-domain core of the Kubernetes cluster agent (#411, epic #405): it maps a vendor-neutral snapshot of a cluster to the fleet asset model (domain/asset).

Package compliance maps a finding's CWE to the regulatory/standard controls it bears on (compliance mapping).

Package correlation is the pure-domain, deterministic engine that folds runtime detection signals into incidents for Phase C of the EDR data plane (#594, C2 #676).

Package dastcheck defines the metadata contract for first-party DAST checks.

Package dastrun is the durable record of a governed DAST verification run.

Package dastsession defines secret-free authenticated DAST session configuration.

Package dastsurface models the deterministic, bounded DAST application surface.

Package detection is the pure domain for the agent-side blue-team detection engine (issue #422): the typed event classes an eBPF sensor observes, the clean-room rules that match over them, the detection a match emits, and the coverage honesty that says a class the agent could not observe is a GAP, never a clean host.

Package distro captures the operating-system distribution of a scanned target (from its OS packages) and flags releases that are past End-of-Life – i.e.

Package emulation is the pure domain for adversary emulation (issue #421): techniques mapped to a public taxonomy, each declaring the detection it should produce, and the coverage record that pairs what executed with what was detected.

Package endpoint is Phase B of the security data plane (#594): it turns the raw, per-event telemetry the A-phase data plane delivers (telemetry.TelemetryEnvelope) into queryable ENDPOINT VISIBILITY — stable entities (processes, network connections, …) with lifecycle state, plus a per-asset State Timeline of their transitions.

Package engagement is the aggregate root for a security-testing project: its scope, legal authorization window, and lifecycle status.

Package evidence models tamper-evident, hash-chained records of what an engagement produced (scans, findings, reports).

Package exploitation is the pure domain for a multi-step attack chain (issue #420).

Package exposure is the pure-domain continuous-exposure fusion for cross-cutting workstream X5 (#634): it fuses per-component vulnerability exposures for one asset into a single riskassessment.RiskContext Exposure factor (0..100).

Package finding models a confirmed or candidate security issue in an engagement.

Package fleetagent is the epic-#405 fleet agent identity model: an enrolled, addressable agent and the single-use enrolment token that mints it.

Package fleetcoverage is the pure-domain truth model for fleet coverage (#413, epic #405): given the facts about one (asset, capability) pair, it resolves a single coverage verdict.

Package fleetdesired defines control-plane-owned fleet intent for canonical technical assets.

Package fleetrollout decides whether ONE agent is offered an update, and to which version.

Package fleetversion is the pure-domain version model for fleet agent/control-plane version skew (#412, epic #405).

Package hostinventory is the fleet VM-agent inventory model (#410, epic #405): the facts and installed packages an agent collects from a host that is not a container.

Package hotspot models Project-scoped Security Hotspot projections.

Package identity defines persisted OIDC identities, authorization transactions, and sessions.

Package ignore models a repo-committed, declarative finding-suppression policy: the accepted-risk decisions a team version-controls alongside its code – Synapse's take on Trivy's .trivyignore, made governance-first.

Package importedfinding models a finding produced by a THIRD-PARTY scanner and ingested into this system's governance path.

Package importedsbom models a client-supplied SBOM attached to an engagement.

Package importreceipt models durable receipts for logical external imports.

Package incident is the pure-domain, event-sourced Incident primitive for Phase C of the EDR data plane (#594, C1 #675).

Package integration models tenant-scoped external CI/CD connections and provider-neutral build provenance.

Package issue models Project-scoped code-quality issue projections and their triage lifecycle (open / accepted / false-positive / won't-fix).

Package javaprogram defines the deterministic, source-only semantic facts used by Java value-flow taint.

Package jsprogram defines the deterministic, source-only semantic facts used by JavaScript/TypeScript value-flow taint.

Package jsresolution models deterministic JavaScript and TypeScript package identity resolution without embedding filesystem or parser implementation details.

Package jssymbols holds the decision rules for Tier-2 JavaScript and TypeScript reachability: given what first-party source statically does with an imported npm package, can a specific AFFECTED SYMBOL of that package be reached?

Package judgment is the AI "analysis brain" primitive: a propose→verify→confirm CLAIM about a subject (a finding, component, vulnerability, or the engagement), evidence-gated and hash-chainable, that generalizes the exploitation gate.

Package legalhold is the pure domain for a LEGAL HOLD on an engagement's data (#635 privacy & data governance).

Package measure holds numeric, non-finding project measures (code size, complexity, duplication, coverage).

Package modulegraph defines the deterministic, source-only JavaScript and TypeScript module graph used by the first phase of import reachability.

Package notification defines tenant-owned notification channels, rules, events, and durable delivery history.

Package offensivepolicy is the machine-readable half of the offensive governance policy (docs/redteam/offensive-policy.md, issue #418).

Package ownership models explainable team routing without granting access to findings.

Package privacy is the SOURCE-SIDE telemetry redaction classifier (A6, #627 — the A0.6 privacy half of #611).

Package project is the aggregate root for a long-lived code-quality project.

Package projectanalysis models immutable, tenant-scoped Project analysis snapshots.

Package promotion defines deterministic cross-pillar finding-priority rules.

Package purplecoverage is the pure domain that closes the purple loop (issue #426): it joins the detection each emulated technique EXPECTED (#421) with the detections that ACTUALLY fired (#422/#423) and resolves a coverage verdict.

Package pythonprogram defines the deterministic, source-only semantic facts used by Python Tier-2 reachability and value-flow taint.

Package qualitygate is the deterministic pass/fail gate over a codebase's measured metrics – the "Clean as You Code" quality gate.

Package qualityprofile models named, per-language rule sets — the industry-standard "Quality Profile".

Package rating turns findings + size measures into deterministic project health grades (A-E) and a technical-debt estimate, the counterpart on the code-quality side to risk priority on the security side.

Package recon holds the domain types for reconnaissance runs.

Package response is the pure domain for governed defensive response actions (issue #425): contain, isolate, quarantine.

Package responsesaga is the pure-domain state machine for a GOVERNED response action's full lifecycle (Phase C, C6 #680) — the distributed saga from proposal through approval, agent execution, and a TELEMETRY-VERIFIED post-condition to an optional rollback.

Package riskassessment is the pure-domain tri-score risk model for Phase C of the EDR data plane (#594, C3 #677).

Package riskstory is the pure, deterministic domain for the unified per-asset risk story (issue #427): one narrative per asset assembled from records already produced by the other pillars — the asset inventory (#431), the findings of every engine + their reachability verdicts, the attack-path graph (#419), runtime detections (#423), and the continuous vulnerability occurrences/assessments (#514).

Package rulepack models signed, versioned detection content and its release metadata (#630).

Package runtimereach models the deterministic join from an OBSERVED runtime library load on a monitored host (EPIC #1042 #1061) to the OS package that owns the loaded file, and from that package to the finding it affects.

Package sbom models a Software Bill of Materials and its components/licenses.

Package scmconnector is the aggregate for a tenant-scoped source-control credential binding: a git host and the username a personal access token authenticates as, so the server can clone a PRIVATE repository on that host.

Package sensorstate defines immutable endpoint sensor-state observations.

Package shared holds value objects and errors common to all domain packages.

Package sla is the pure, deterministic domain for the risk-based remediation SLA (issue #80, Phase 0).

Package sourcepolicy defines the server-authoritative policy for durable Code source snapshots.

Package suppression models .synapseignore: operator-declared suppressions that hide known/accepted findings, each REQUIRING a reason and an expiry date.

Package symbolcanon canonicalizes vulnerable-symbol names so the advisory side and the reachability/observed side compare identically.

Package taint is the deterministic taint-analysis domain model: a data-flow graph from untrusted SOURCES to dangerous SINKS, with SANITIZER nodes that neutralize a flow, plus the pure query that reports an injection – a source→sink path that crosses no sanitizer.

Package telemetry is the pure domain for the raw-telemetry tier's HONESTY semantics (#611, A0.4/A0.6): how a batch's fidelity is classified so coverage/confidence never lie.

Package telemetryschema owns the wire-format version of telemetry events and batches (A0.3, epic #594).

Package threatmodel is the architecture-input model that threat modeling reasons over: a data-flow diagram – components (processes, data stores, external entities), directed data flows between them, trust boundaries that partition them by trust level, and the assets at stake.

Package user models operator identities: each consultant is a distinct user with their own API key, so every action – comments, findings, assignments, audit, evidence – is attributable to a real person, not a shared "operator".

Package verdict is the shared adversarial-verdict value type + evidence bar used by BOTH finding (exploitation) and judgment (AI analysis).

Package vex holds the OpenVEX domain vocabulary (the closed justification enum, shared by the VEX export and the AI vex-justification judgment) AND the consume-side parser + product-to-finding matcher (document.go: Parse, Statement.Suppresses, Statement.MatchesFinding) shared by the post-scan VEX apply and the in-scan .vex consumer.

Package vulnerability models a known issue affecting an SBOM component.

Package workorder is the epic-#405 fleet work order model: a unit of work addressed to a specific agent identity, authorised by an engagement, signed by the control plane, and driven through an explicit state machine.

Package writeup holds the built-in finding-writeup library: reusable, curated finding text + remediation an operator inserts when authoring a manual finding, so report prose is consistent.

Package writeupdraft holds AI-proposed, human-gated finding write-up DRAFTS ("human-gated authoritative drafts").