work

src/Scanner/StellaOps.Scanner.Worker/Processing/CompositeScanAnalyzerDispatcher.cs

@@ -110,6 +110,22 @@ internal sealed class CompositeScanAnalyzerDispatcher : IScanAnalyzerDispatcher
         var loggerFactory = services.GetRequiredService<ILoggerFactory>();
         var results = new List<OSPackageAnalyzerResult>(analyzers.Count);
 
+        var surfaceEnvironment = services.GetRequiredService<ISurfaceEnvironment>();
+        var validatorRunner = services.GetRequiredService<ISurfaceValidatorRunner>();
+        var validationContext = SurfaceValidationContext.Create(
+            services,
+            "Scanner.Worker.OSAnalyzers",
+            surfaceEnvironment.Settings,
+            new Dictionary<string, object?>(StringComparer.OrdinalIgnoreCase)
+            {
+                ["jobId"] = context.JobId,
+                ["scanId"] = context.ScanId,
+                ["rootfsPath"] = rootfsPath,
+                ["analyzerCount"] = analyzers.Count
+            });
+
+        await validatorRunner.EnsureAsync(validationContext, cancellationToken).ConfigureAwait(false);
+
         foreach (var analyzer in analyzers)
         {
             cancellationToken.ThrowIfCancellationRequested();

src/Scanner/StellaOps.Scanner.Worker/Processing/EntryTraceExecutionService.cs

@@ -119,6 +119,20 @@ public sealed class EntryTraceExecutionService : IEntryTraceExecutionService
             return;
         }
 
+        var validationContext = SurfaceValidationContext.Create(
+            _serviceProvider,
+            "Scanner.Worker.EntryTrace",
+            _surfaceEnvironment.Settings,
+            new Dictionary<string, object?>(StringComparer.OrdinalIgnoreCase)
+            {
+                ["jobId"] = context.JobId,
+                ["scanId"] = context.ScanId,
+                ["configPath"] = configPath,
+                ["rootfs"] = metadata.TryGetValue(_workerOptions.Analyzers.RootFilesystemMetadataKey, out var rootfs) ? rootfs : null
+            });
+
+        await _validatorRunner.EnsureAsync(validationContext, cancellationToken).ConfigureAwait(false);
+
         var fileSystemHandle = BuildFileSystem(context.JobId, metadata);
         if (fileSystemHandle is null)
         {

src/Scanner/StellaOps.Scanner.Worker/Program.cs

@@ -145,6 +145,18 @@ builder.Logging.Configure(options =>
 
 var host = builder.Build();
 
+// Fail fast if surface configuration is invalid at startup.
+using (var scope = host.Services.CreateScope())
+{
+    var services = scope.ServiceProvider;
+    var env = services.GetRequiredService<ISurfaceEnvironment>();
+    var runner = services.GetRequiredService<ISurfaceValidatorRunner>();
+    await runner.EnsureAsync(
+        SurfaceValidationContext.Create(services, "Scanner.Worker.Startup", env.Settings),
+        host.Services.GetRequiredService<IHostApplicationLifetime>().ApplicationStopping)
+        .ConfigureAwait(false);
+}
+
 await host.RunAsync();
 
 public partial class Program;
@@ -189,9 +201,8 @@ public sealed class SurfaceManifestStoreOptionsConfigurator : IConfigureOptions<
 
         if (string.IsNullOrWhiteSpace(options.RootDirectory))
         {
-            options.RootDirectory = Path.Combine(
-                _cacheOptions.Value.ResolveRoot(),
-                "manifests");
+            var cacheRoot = _cacheOptions.Value.RootDirectory ?? Path.Combine(Path.GetTempPath(), "stellaops", "surface-cache");
+            options.RootDirectory = Path.Combine(cacheRoot, "manifests");
         }
     }
 }