work

src/Scanner/StellaOps.Scanner.Worker/Processing/CompositeScanAnalyzerDispatcher.cs

@@ -110,6 +110,22 @@ internal sealed class CompositeScanAnalyzerDispatcher : IScanAnalyzerDispatcher
         var loggerFactory = services.GetRequiredService<ILoggerFactory>();
         var results = new List<OSPackageAnalyzerResult>(analyzers.Count);
 
+        var surfaceEnvironment = services.GetRequiredService<ISurfaceEnvironment>();
+        var validatorRunner = services.GetRequiredService<ISurfaceValidatorRunner>();
+        var validationContext = SurfaceValidationContext.Create(
+            services,
+            "Scanner.Worker.OSAnalyzers",
+            surfaceEnvironment.Settings,
+            new Dictionary<string, object?>(StringComparer.OrdinalIgnoreCase)
+            {
+                ["jobId"] = context.JobId,
+                ["scanId"] = context.ScanId,
+                ["rootfsPath"] = rootfsPath,
+                ["analyzerCount"] = analyzers.Count
+            });
+
+        await validatorRunner.EnsureAsync(validationContext, cancellationToken).ConfigureAwait(false);
+
         foreach (var analyzer in analyzers)
         {
             cancellationToken.ThrowIfCancellationRequested();

src/Scanner/StellaOps.Scanner.Worker/Processing/EntryTraceExecutionService.cs

@@ -119,6 +119,20 @@ public sealed class EntryTraceExecutionService : IEntryTraceExecutionService
             return;
         }
 
+        var validationContext = SurfaceValidationContext.Create(
+            _serviceProvider,
+            "Scanner.Worker.EntryTrace",
+            _surfaceEnvironment.Settings,
+            new Dictionary<string, object?>(StringComparer.OrdinalIgnoreCase)
+            {
+                ["jobId"] = context.JobId,
+                ["scanId"] = context.ScanId,
+                ["configPath"] = configPath,
+                ["rootfs"] = metadata.TryGetValue(_workerOptions.Analyzers.RootFilesystemMetadataKey, out var rootfs) ? rootfs : null
+            });
+
+        await _validatorRunner.EnsureAsync(validationContext, cancellationToken).ConfigureAwait(false);
+
         var fileSystemHandle = BuildFileSystem(context.JobId, metadata);
         if (fileSystemHandle is null)
         {