domain/

Package advisory is the OWNED vulnerability-advisory matching brain: it decides whether a component version is affected by an advisory's version ranges WITHOUT querying a third-party service (OSV.dev / Grype), so detection does not depend on any one external matcher.

Package agent holds the pure domain types for AI orchestration: the LLM conversation values (messages, tool-calls, usage) and the orchestration state (session, proposed action, risk class, approval decision).

Package aitriagereview models the human decision that follows an AI false-positive critique which the deterministic gate policy refused to authorize on its own.

Package asset contains the technical fleet Asset and business-level BusinessAsset models.

Package attackpath derives bounded, evidence-carrying paths from estate assets to findings.

Package audit makes the audit trail tamper-evident: each entry's Hash covers its content AND the previous entry's Hash, exactly like the evidence chain (golden rule 6).

Package aup models acceptance of the Acceptable-Use Policy.

Package callgraph is the deterministic call-graph domain model (Tier-2 shared foundation): a directed graph of function-call edges plus the entrypoints reachability is measured from, and the pure query primitives over it.

Package cloudposture models vendor-neutral live cloud inventory and posture.

Package clusterinventory is the pure-domain core of the Kubernetes cluster agent (#411, epic #405): it maps a vendor-neutral snapshot of a cluster to the fleet asset model (domain/asset).

Package compliance maps a finding's CWE to the regulatory/standard controls it bears on (compliance mapping).

Package dastcheck defines the metadata contract for first-party DAST checks.

Package dastsession defines secret-free authenticated DAST session configuration.

Package dastsurface models the deterministic, bounded DAST application surface.

Package detection is the pure domain for the agent-side blue-team detection engine (issue #422): the typed event classes an eBPF sensor observes, the clean-room rules that match over them, the detection a match emits, and the coverage honesty that says a class the agent could not observe is a GAP, never a clean host.

Package distro captures the operating-system distribution of a scanned target (from its OS packages) and flags releases that are past End-of-Life – i.e.

Package emulation is the pure domain for adversary emulation (issue #421): techniques mapped to a public taxonomy, each declaring the detection it should produce, and the coverage record that pairs what executed with what was detected.

Package engagement is the aggregate root for a security-testing project: its scope, legal authorization window, and lifecycle status.

Package evidence models tamper-evident, hash-chained records of what an engagement produced (scans, findings, reports).

Package exploitation is the pure domain for a multi-step attack chain (issue #420).

Package finding models a confirmed or candidate security issue in an engagement.

Package fleetagent is the epic-#405 fleet agent identity model: an enrolled, addressable agent and the single-use enrolment token that mints it.

Package fleetcoverage is the pure-domain truth model for fleet coverage (#413, epic #405): given the facts about one (asset, capability) pair, it resolves a single coverage verdict.

Package fleetrollout decides whether ONE agent is offered an update, and to which version.

Package fleetversion is the pure-domain version model for fleet agent/control-plane version skew (#412, epic #405).

Package hostinventory is the fleet VM-agent inventory model (#410, epic #405): the facts and installed packages an agent collects from a host that is not a container.

Package hotspot models Project-scoped Security Hotspot projections.

Package ignore models a repo-committed, declarative finding-suppression policy: the accepted-risk decisions a team version-controls alongside its code – Synapse's take on Trivy's .trivyignore, made governance-first.

Package importedfinding models a finding produced by a THIRD-PARTY scanner and ingested into this system's governance path.

Package importedsbom models a client-supplied SBOM attached to an engagement.

Package issue models Project-scoped code-quality issue projections and their triage lifecycle (open / accepted / false-positive / won't-fix).

Package jsresolution models deterministic JavaScript and TypeScript package identity resolution without embedding filesystem or parser implementation details.

Package jssymbols holds the decision rules for Tier-2 JavaScript and TypeScript reachability: given what first-party source statically does with an imported npm package, can a specific AFFECTED SYMBOL of that package be reached?

Package judgment is the AI "analysis brain" primitive: a propose→verify→confirm CLAIM about a subject (a finding, component, vulnerability, or the engagement), evidence-gated and hash-chainable, that generalizes the exploitation gate.

Package measure holds numeric, non-finding project measures (code size, complexity, duplication, coverage).

Package modulegraph defines the deterministic, source-only JavaScript and TypeScript module graph used by the first phase of import reachability.

Package offensivepolicy is the machine-readable half of the offensive governance policy (docs/redteam/offensive-policy.md, issue #418).

Package project is the aggregate root for a long-lived code-quality project.

Package projectanalysis models immutable, tenant-scoped Project analysis snapshots.

Package promotion defines deterministic cross-pillar finding-priority rules.

Package purplecoverage is the pure domain that closes the purple loop (issue #426): it joins the detection each emulated technique EXPECTED (#421) with the detections that ACTUALLY fired (#422/#423) and resolves a coverage verdict.

Package qualitygate is the deterministic pass/fail gate over a codebase's measured metrics – the "Clean as You Code" quality gate.

Package qualityprofile models named, per-language rule sets — the industry-standard "Quality Profile".

Package rating turns findings + size measures into deterministic project health grades (A-E) and a technical-debt estimate, the counterpart on the code-quality side to risk priority on the security side.

Package recon holds the domain types for reconnaissance runs.

Package response is the pure domain for governed defensive response actions (issue #425): contain, isolate, quarantine.

Package riskstory is the pure, deterministic domain for the unified per-asset risk story (issue #427): one narrative per asset assembled from records already produced by the other pillars — the asset inventory (#431), the findings of every engine + their reachability verdicts, the attack-path graph (#419), runtime detections (#423), and the continuous vulnerability occurrences/assessments (#514).

Package sbom models a Software Bill of Materials and its components/licenses.

Package shared holds value objects and errors common to all domain packages.

Package sla is the pure, deterministic domain for the risk-based remediation SLA (issue #80, Phase 0).

Package sourcepolicy defines the server-authoritative policy for durable Code source snapshots.

Package taint is the deterministic taint-analysis domain model: a data-flow graph from untrusted SOURCES to dangerous SINKS, with SANITIZER nodes that neutralize a flow, plus the pure query that reports an injection – a source→sink path that crosses no sanitizer.

Package threatmodel is the architecture-input model that threat modeling reasons over: a data-flow diagram – components (processes, data stores, external entities), directed data flows between them, trust boundaries that partition them by trust level, and the assets at stake.

Package user models operator identities: each consultant is a distinct user with their own API key, so every action – comments, findings, assignments, audit, evidence – is attributable to a real person, not a shared "operator".

Package verdict is the shared adversarial-verdict value type + evidence bar used by BOTH finding (exploitation) and judgment (AI analysis).

Package vex holds the OpenVEX domain vocabulary (the closed justification enum, shared by the VEX export and the AI vex-justification judgment) AND the consume-side parser + product-to-finding matcher (document.go: Parse, Statement.Suppresses, Statement.MatchesFinding) shared by the post-scan VEX apply and the in-scan .vex consumer.

Package vulnerability models a known issue affecting an SBOM component.

Package workorder is the epic-#405 fleet work order model: a unit of work addressed to a specific agent identity, authorised by an engagement, signed by the control plane, and driven through an explicit state machine.

Package writeup holds the built-in finding-writeup library: reusable, curated finding text + remediation an operator inserts when authoring a manual finding, so report prose is consistent.

Package writeupdraft holds AI-proposed, human-gated finding write-up DRAFTS ("human-gated authoritative drafts").