Internals

Layer	Location
Main process: registry leases, import, inspect and setup requests	apps/desktop/src/main/lysis.ts
Opening check that registers REA	apps/desktop/src/renderer/lysis.tsx
Start wizard, first-thread send, next steps	lysis-start.tsx, lysis-autostart.ts, lysis-next-steps.tsx
Investigation sidebar and Synoec hand-off	lysis-navigation.tsx, lysis-handoff.tsx
Shared view model and validation	apps/desktop/src/shared/lysis.ts
Project creation and management	@synoec/workspace/lysis, @synoec/client-host/lysis-requests

• Storage. Investigations live at <SYNOEC_HOME>/lysis/projects/<UUID>/ with targets, analysis, evidence, notes and an editable AGENTS.md. Organizational registration owns identity and name; removing an investigation archives the registration and keeps files, chats and memory.
• Intake. A file import copies it, records SHA-256, size and time, and deduplicates by digest; changed inputs and unsafe symlinks fail. A folder or app bundle keeps its tree; escaping or absolute links and special files are rejected, imported files lose executable bits, and a versioned tree SHA-256 binds paths, kinds, link text, lengths and digests. Limits: 2 GiB per target, 8,192 entries, 64 levels, 512 receipts per investigation. Cancelling removes unfinished copies; CLI Ctrl-C returns 130 and SIGTERM 143. Closing the import or inspection sheet leaves its operation running, and returning to the sheet shows that same job rather than starting another. A target whose receipt is already written reports completed even when you cancel at the last moment; quitting the app cancels unfinished work.
• Shared execution. Investigations use their workspace’s Profiles, connections, Persona, Specialists, permissions, memory and repository intelligence. The engine derives Lysis operating guidance from verified registration; target data never becomes instructions. Off-topic requests end with a send_to_synoec wrap-up whose brief (at most 2,000 characters) prefills a Synoec draft; nothing is sent until the person sends it.
• REA registration. The desktop bundle carries pinned rea-agents@6.3.0 and Node 24.21.0 (bun run rea:fetch, verified against bundle.json digests). Creating or inspecting an investigation registers it as the deferred workspace-owned rea MCP connection (lysis-rea-connection.ts): a stale managed connection moves to the bundled copy and a person-owned rea is left alone. Unset GHIDRA_INSTALL_DIR and JAVA_HOME are filled from usual install locations (lysis-engine-detection.ts). The CLI without a bundle keeps the managed download. Agents ask mcp.tools.list for a schema, then call mcp.tools.call.