This document defines the shared technical architecture of the repository. It is the canonical read for how runtime surfaces, shared packages, and Python modules fit together.
This file is the source of truth for:
This file does not define:
docs/planning/MASTER.md)AGENTS.md, CONTRIBUTING.md)docs/operations.md)SynaWeave is a shallow, multi-surface architecture with one shared contract layer.
The platform shape is intentionally strict:
apps/extension)apps/web)apps/api)apps/ingest)apps/mcp, apps/ml, apps/eval)packages/python/No second documentation runtime exists in apps/, and no other top-level app runtime is part of Sprint 1.
apps/extension: in-context capture and quick study shellapps/web: authenticated workspace control planeapps/api: request-serving boundary and first durable write pathapps/ingest: job boundary for asynchronous operationsapps/mcp: standardized tool interface surfaceapps/ml: online and offline ML-serving or orchestration surface when separated from the APIapps/eval: evaluation and benchmark surface when separated from jobs or ML toolingpackages/contracts: typed shape contracts for all cross-surface payloadspackages/config: shared configuration contract and loading helpers for TypeScript runtimespackages/tokens: visual and theme tokenspackages/ui: shared UI primitivespython/common: cross-cutting Python primitives (retry, errors, typing, telemetry helpers)python/data: ingestion and data-prep primitivespython/evaluation: reusable evaluation utilities and offline scoring supportpython/graph: graph modeling and relationship-oriented helperspython/models: model-facing integration seams and shared model contractspython/retrieval: retrieval utilities and retrieval-adjacent contractspython/training: training and experiment-prep support kept outside app entrypointsThe platform data path is explicit and short:
User action
-> apps/extension or apps/web
-> apps/api (public contract only)
-> Python/JS service modules
-> infra stores/services
-> response with stable contract + event telemetry
Rules in this flow:
packages/contractsapps/apiSecurity is split by boundary class:
apps/extension and apps/web can only use browser-safe config valuesapps/api and apps/ingest can use server-only credentials through environment/classified configThis architecture intentionally keeps shared responsibilities separated:
apps/: executable surfaces and integration shellspackages/: shared TypeScript boundaries and contractspython/: shared intelligence modules and reusable domain logicinfra/: deployment, policy, and operations envelopestools/verify: executable repository assertionstesting/: quality signal taxonomy and guardrailsNo folder should hide mixed concerns across these lines.
The observability model follows a single event model:
Evidence obligations:
Sprint 1 architecture decisions are intentionally conservative:
apps/docs/)docs/ may be published statically, but remains the only canonical documentation sourceThe next sprints may refine depth but may not discard these boundaries without a new ADR entry.