work

src/Scanner/StellaOps.Scanner.WebService/Program.cs

@@ -297,8 +297,20 @@ else
     });
 }
 
-var app = builder.Build();
-
+var app = builder.Build();
+
+// Fail fast if surface configuration is invalid at startup.
+using (var validationScope = app.Services.CreateScope())
+{
+    var services = validationScope.ServiceProvider;
+    var env = services.GetRequiredService<ISurfaceEnvironment>();
+    var runner = services.GetRequiredService<ISurfaceValidatorRunner>();
+    await runner.EnsureAsync(
+        SurfaceValidationContext.Create(services, "Scanner.WebService.Startup", env.Settings),
+        app.Lifetime.ApplicationStopping)
+        .ConfigureAwait(false);
+}
+
 var resolvedOptions = app.Services.GetRequiredService<IOptions<ScannerWebServiceOptions>>().Value;
 var authorityConfigured = resolvedOptions.Authority.Enabled;
 if (authorityConfigured && resolvedOptions.Authority.AllowAnonymousFallback)