feat: Document completed tasks for KMS, Cryptography, and Plugin Libraries

- Added detailed task completion records for KMS interface implementation and CLI support for file-based keys. - Documented security enhancements including Argon2id password hashing, audit event contracts, and rate limiting configurations. - Included scoped service support and integration updates for the Plugin platform, ensuring proper DI handling and testing coverage.
2025-10-31 14:37:45 +02:00
parent 240e8ff25d
commit 15b4a1de6a
312 changed files with 6399 additions and 3319 deletions
--- a/src/Scanner/StellaOps.Scanner.WebService/Contracts/OrchestratorEventContracts.cs
+++ b/src/Scanner/StellaOps.Scanner.WebService/Contracts/OrchestratorEventContracts.cs
@@ -226,28 +226,40 @@ internal sealed record ReportDeltaPayload
    public IReadOnlyList<string>? Kev { get; init; }
 }

-internal sealed record ReportLinksPayload
-{
-    [JsonPropertyName("ui")]
-    [JsonPropertyOrder(0)]
-    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
-    public string? Ui { get; init; }
-
-    [JsonPropertyName("report")]
-    [JsonPropertyOrder(1)]
-    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
-    public string? Report { get; init; }
-
-    [JsonPropertyName("policy")]
-    [JsonPropertyOrder(2)]
-    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
-    public string? Policy { get; init; }
-
-    [JsonPropertyName("attestation")]
-    [JsonPropertyOrder(3)]
-    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
-    public string? Attestation { get; init; }
-}
+internal sealed record ReportLinksPayload
+{
+    [JsonPropertyName("report")]
+    [JsonPropertyOrder(0)]
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    public LinkTarget? Report { get; init; }
+
+    [JsonPropertyName("policy")]
+    [JsonPropertyOrder(1)]
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    public LinkTarget? Policy { get; init; }
+
+    [JsonPropertyName("attestation")]
+    [JsonPropertyOrder(2)]
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    public LinkTarget? Attestation { get; init; }
+}
+
+internal sealed record LinkTarget(
+    [property: JsonPropertyName("ui"), JsonPropertyOrder(0), JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)] string? Ui,
+    [property: JsonPropertyName("api"), JsonPropertyOrder(1), JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)] string? Api)
+{
+    public static LinkTarget? Create(string? ui, string? api)
+    {
+        if (string.IsNullOrWhiteSpace(ui) && string.IsNullOrWhiteSpace(api))
+        {
+            return null;
+        }
+
+        return new LinkTarget(
+            string.IsNullOrWhiteSpace(ui) ? null : ui,
+            string.IsNullOrWhiteSpace(api) ? null : api);
+    }
+}

 internal sealed record FindingSummaryPayload
 {
--- a/src/Scanner/StellaOps.Scanner.WebService/Endpoints/PolicyEndpoints.cs
+++ b/src/Scanner/StellaOps.Scanner.WebService/Endpoints/PolicyEndpoints.cs
@@ -16,9 +16,11 @@ using StellaOps.Scanner.WebService.Services;
 using StellaOps.Zastava.Core.Contracts;
 using RuntimePolicyVerdict = StellaOps.Zastava.Core.Contracts.PolicyVerdict;

-namespace StellaOps.Scanner.WebService.Endpoints;
-
-internal static class PolicyEndpoints
+namespace StellaOps.Scanner.WebService.Endpoints;
+
+#pragma warning disable ASPDEPR002
+
+internal static class PolicyEndpoints
 {
    private static readonly JsonSerializerOptions SerializerOptions = new(JsonSerializerDefaults.Web)
    {
@@ -335,3 +337,5 @@ internal static class PolicyEndpoints
            _ => "unknown"
        };
 }
+
+#pragma warning restore ASPDEPR002
--- a/src/Scanner/StellaOps.Scanner.WebService/Endpoints/ReportEndpoints.cs
+++ b/src/Scanner/StellaOps.Scanner.WebService/Endpoints/ReportEndpoints.cs
@@ -13,9 +13,11 @@ using StellaOps.Scanner.WebService.Infrastructure;
 using StellaOps.Scanner.WebService.Security;
 using StellaOps.Scanner.WebService.Services;

-namespace StellaOps.Scanner.WebService.Endpoints;
-
-internal static class ReportEndpoints
+namespace StellaOps.Scanner.WebService.Endpoints;
+
+#pragma warning disable ASPDEPR002
+
+internal static class ReportEndpoints
 {
    private const string PayloadType = "application/vnd.stellaops.report+json";

@@ -25,7 +27,7 @@ internal static class ReportEndpoints
        Converters = { new JsonStringEnumConverter() }
    };

-    public static void MapReportEndpoints(this RouteGroupBuilder apiGroup, string reportsSegment)
+    public static void MapReportEndpoints(this RouteGroupBuilder apiGroup, string reportsSegment)
    {
        ArgumentNullException.ThrowIfNull(apiGroup);

@@ -33,11 +35,11 @@ internal static class ReportEndpoints
            .MapGroup(NormalizeSegment(reportsSegment))
            .WithTags("Reports");

-        reports.MapPost("/", HandleCreateReportAsync)
-            .WithName("scanner.reports.create")
-            .Produces<ReportResponseDto>(StatusCodes.Status200OK)
-            .Produces(StatusCodes.Status400BadRequest)
-            .Produces(StatusCodes.Status503ServiceUnavailable)
+        reports.MapPost("/", HandleCreateReportAsync)
+            .WithName("scanner.reports.create")
+            .Produces<ReportResponseDto>(StatusCodes.Status200OK)
+            .Produces(StatusCodes.Status400BadRequest)
+            .Produces(StatusCodes.Status503ServiceUnavailable)
            .RequireAuthorization(ScannerPolicies.Reports)
            .WithOpenApi(operation =>
            {
@@ -263,4 +265,6 @@ internal static class ReportEndpoints
        var payload = JsonSerializer.Serialize(value, SerializerOptions);
        return Results.Content(payload, "application/json", Encoding.UTF8);
    }
-}
+}
+
+#pragma warning restore ASPDEPR002
--- a/src/Scanner/StellaOps.Scanner.WebService/Serialization/OrchestratorEventSerializer.cs
+++ b/src/Scanner/StellaOps.Scanner.WebService/Serialization/OrchestratorEventSerializer.cs
@@ -98,13 +98,17 @@ internal static class OrchestratorEventSerializer
                "newHigh",
                "kev"
            },
-            [typeof(ReportLinksPayload)] = new[]
-            {
-                "ui",
-                "report",
-                "policy",
-                "attestation"
-            },
+            [typeof(ReportLinksPayload)] = new[]
+            {
+                "report",
+                "policy",
+                "attestation"
+            },
+            [typeof(LinkTarget)] = new[]
+            {
+                "ui",
+                "api"
+            },
            [typeof(FindingSummaryPayload)] = new[]
            {
                "id",
@@ -158,12 +162,12 @@ internal static class OrchestratorEventSerializer
            _inner = inner ?? throw new ArgumentNullException(nameof(inner));
        }

-        public JsonTypeInfo GetTypeInfo(Type type, JsonSerializerOptions options)
-        {
-            var info = _inner.GetTypeInfo(type, options)
-                       ?? throw new InvalidOperationException($"Unable to resolve JsonTypeInfo for '{type}'.");
-
-            if (info.Kind is JsonTypeInfoKind.Object && info.Properties is { Count: > 1 })
+        public JsonTypeInfo GetTypeInfo(Type type, JsonSerializerOptions options)
+        {
+            var info = _inner.GetTypeInfo(type, options)
+                       ?? throw new InvalidOperationException($"Unable to resolve JsonTypeInfo for '{type}'.");
+
+            if (info.Kind is JsonTypeInfoKind.Object && info.Properties is { Count: > 1 })
            {
                var ordered = info.Properties
                    .OrderBy(property => GetOrder(type, property.Name))
@@ -174,25 +178,52 @@ internal static class OrchestratorEventSerializer
                foreach (var property in ordered)
                {
                    info.Properties.Add(property);
-                }
-            }
-
-            return info;
-        }
-
-        private static int GetOrder(Type type, string propertyName)
-        {
+                }
+            }
+
+            ConfigurePolymorphism(info);
+            return info;
+        }
+
+        private static int GetOrder(Type type, string propertyName)
+        {
            if (PropertyOrder.TryGetValue(type, out var order) && Array.IndexOf(order, propertyName) is { } index and >= 0)
            {
                return index;
            }
-
-            if (type.BaseType is not null)
-            {
-                return GetOrder(type.BaseType, propertyName);
-            }
-
-            return int.MaxValue;
-        }
-    }
-}
+
+            if (type.BaseType is not null)
+            {
+                return GetOrder(type.BaseType, propertyName);
+            }
+
+            return int.MaxValue;
+        }
+
+        private static void ConfigurePolymorphism(JsonTypeInfo info)
+        {
+            if (info.Type != typeof(OrchestratorEventPayload))
+            {
+                return;
+            }
+
+            info.PolymorphismOptions ??= new JsonPolymorphismOptions
+            {
+                UnknownDerivedTypeHandling = JsonUnknownDerivedTypeHandling.Fail
+            };
+
+            AddDerivedType(info.PolymorphismOptions, typeof(ReportReadyEventPayload));
+            AddDerivedType(info.PolymorphismOptions, typeof(ScanCompletedEventPayload));
+        }
+
+        private static void AddDerivedType(JsonPolymorphismOptions options, Type derivedType)
+        {
+            if (options.DerivedTypes.Any(d => d.DerivedType == derivedType))
+            {
+                return;
+            }
+
+            options.DerivedTypes.Add(new JsonDerivedType(derivedType));
+        }
+    }
+}
--- a/src/Scanner/StellaOps.Scanner.WebService/Services/ReportEventDispatcher.cs
+++ b/src/Scanner/StellaOps.Scanner.WebService/Services/ReportEventDispatcher.cs
@@ -247,23 +247,33 @@ internal sealed class ReportEventDispatcher : IReportEventDispatcher
            return new ReportLinksPayload();
        }

-        var uiLink = BuildAbsoluteUri(context, "ui", "reports", document.ReportId);
-        var reportLink = BuildAbsoluteUri(context, ConcatSegments(_apiBaseSegments, _reportsSegment, document.ReportId));
-        var policyLink = string.IsNullOrWhiteSpace(document.Policy.RevisionId)
-            ? null
-            : BuildAbsoluteUri(context, ConcatSegments(_apiBaseSegments, _policySegment, "revisions", document.Policy.RevisionId));
-        var attestationLink = envelope is null
-            ? null
-            : BuildAbsoluteUri(context, "ui", "attestations", document.ReportId);
-
-        return new ReportLinksPayload
-        {
-            Ui = uiLink,
-            Report = reportLink,
-            Policy = policyLink,
-            Attestation = attestationLink
-        };
-    }
+        var reportUi = BuildAbsoluteUri(context, "ui", "reports", document.ReportId);
+        var reportApi = BuildAbsoluteUri(context, ConcatSegments(_apiBaseSegments, _reportsSegment, document.ReportId));
+
+        LinkTarget? policyLink = null;
+        if (!string.IsNullOrWhiteSpace(document.Policy.RevisionId))
+        {
+            var policyRevision = document.Policy.RevisionId!;
+            var policyUi = BuildAbsoluteUri(context, "ui", "policy", "revisions", policyRevision);
+            var policyApi = BuildAbsoluteUri(context, ConcatSegments(_apiBaseSegments, _policySegment, "revisions", policyRevision));
+            policyLink = LinkTarget.Create(policyUi, policyApi);
+        }
+
+        LinkTarget? attestationLink = null;
+        if (envelope is not null)
+        {
+            var attestationUi = BuildAbsoluteUri(context, "ui", "attestations", document.ReportId);
+            var attestationApi = BuildAbsoluteUri(context, ConcatSegments(_apiBaseSegments, _reportsSegment, document.ReportId, "attestation"));
+            attestationLink = LinkTarget.Create(attestationUi, attestationApi);
+        }
+
+        return new ReportLinksPayload
+        {
+            Report = LinkTarget.Create(reportUi, reportApi),
+            Policy = policyLink,
+            Attestation = attestationLink
+        };
+    }

    private static ReportDeltaPayload? BuildDelta(PolicyPreviewResponse preview, ReportRequestDto request)
    {
--- a/src/Scanner/StellaOps.Scanner.WebService/TASKS.completed.md
+++ b/src/Scanner/StellaOps.Scanner.WebService/TASKS.completed.md
@@ -0,0 +1,19 @@
+# Completed Tasks
+
+| ID | Status | Owner(s) | Depends on | Description | Exit Criteria |
+|----|--------|----------|------------|-------------|---------------|
+| SCANNER-WEB-09-101 | DONE (2025-10-18) | Scanner WebService Guild | SCANNER-CORE-09-501 | Stand up minimal API host with Authority OpTok + DPoP enforcement, health/ready endpoints, and restart-time plug-in loader per architecture §1, §4. | Host boots with configuration validation, `/healthz` and `/readyz` return 200, Authority middleware enforced in integration tests. |
+| SCANNER-WEB-09-102 | DONE (2025-10-18) | Scanner WebService Guild | SCANNER-WEB-09-101, SCANNER-QUEUE-09-401 | Implement `/api/v1/scans` submission/status endpoints with deterministic IDs, validation, and cancellation tokens. | Contract documented, e2e test posts scan request and retrieves status, cancellation token honoured. |
+| SCANNER-WEB-09-103 | DONE (2025-10-19) | Scanner WebService Guild | SCANNER-WEB-09-102, SCANNER-CORE-09-502 | Emit scan progress via SSE/JSONL with correlation IDs and deterministic timestamps; document API reference. | Streaming endpoint verified in tests, timestamps formatted ISO-8601 UTC, docs updated in `docs/09_API_CLI_REFERENCE.md`. |
+| SCANNER-WEB-09-104 | DONE (2025-10-19) | Scanner WebService Guild | SCANNER-STORAGE-09-301, SCANNER-QUEUE-09-401 | Bind configuration for Mongo, MinIO, queue, feature flags; add startup diagnostics and fail-fast policy for missing deps. | Misconfiguration fails fast with actionable errors, configuration bound tests pass, diagnostics logged with correlation IDs. |
+| SCANNER-POLICY-09-105 | DONE (2025-10-19) | Scanner WebService Guild | POLICY-CORE-09-001 | Integrate policy schema loader + diagnostics + OpenAPI (YAML ignore rules, VEX include/exclude, vendor precedence). | Policy endpoints documented; validation surfaces actionable errors; OpenAPI schema published. |
+| SCANNER-POLICY-09-106 | DONE (2025-10-19) | Scanner WebService Guild | POLICY-CORE-09-002, SCANNER-POLICY-09-105 | `/reports` verdict assembly (Feedser/Vexer/Policy merge) + signed response envelope. | Aggregated report includes policy metadata; integration test verifies signed response; docs updated. |
+| SCANNER-POLICY-09-107 | DONE (2025-10-19) | Scanner WebService Guild | POLICY-CORE-09-005, SCANNER-POLICY-09-106 | Surface score inputs, config version, and `quietedBy` provenance in `/reports` response and signed payload; document schema changes. | `/reports` JSON + DSSE contain score, reachability, sourceTrust, confidenceBand, quiet provenance; contract tests updated; docs refreshed. |
+| SCANNER-WEB-10-201 | DONE (2025-10-19) | Scanner WebService Guild | SCANNER-CACHE-10-101 | Register scanner cache services and maintenance loop within WebService host. | `AddScannerCache` wired for configuration binding; maintenance service skips when disabled; project references updated. |
+| SCANNER-RUNTIME-12-301 | DONE (2025-10-20) | Scanner WebService Guild | ZASTAVA-CORE-12-201 | Implement `/runtime/events` ingestion endpoint with validation, batching, and storage hooks per Zastava contract. | Observer fixtures POST events, data persisted and acked; invalid payloads rejected with deterministic errors. |
+| SCANNER-RUNTIME-12-302 | DONE (2025-10-24) | Scanner WebService Guild | SCANNER-RUNTIME-12-301, ZASTAVA-CORE-12-201 | Implement `/policy/runtime` endpoint joining SBOM baseline + policy verdict, returning admission guidance. Coordinate with CLI (`CLI-RUNTIME-13-008`) before GA to lock response field names/metadata. | Webhook integration test passes; responses include verdict, TTL, reasons; metrics/logging added; CLI contract review signed off. |
+| SCANNER-RUNTIME-12-303 | DONE (2025-10-24) | Scanner WebService Guild | SCANNER-RUNTIME-12-302 | Replace `/policy/runtime` heuristic with canonical policy evaluation (Feedser/Vexer inputs, PolicyPreviewService) so results align with `/reports`. | Runtime policy endpoint now pipes findings through `PolicyPreviewService`, emits canonical verdicts/confidence/quiet metadata, and updated tests cover pass/warn/fail paths + CLI contract fixtures. |
+| SCANNER-RUNTIME-12-304 | DONE (2025-10-24) | Scanner WebService Guild | SCANNER-RUNTIME-12-302 | Surface attestation verification status by integrating Authority/Attestor Rekor validation (beyond presence-only). | `/policy/runtime` maps Rekor UUIDs through the runtime attestation verifier so `rekor.verified` reflects attestor outcomes; webhook/CLI coverage added. |
+| SCANNER-RUNTIME-12-305 | DONE (2025-10-24) | Scanner WebService Guild | SCANNER-RUNTIME-12-301, SCANNER-RUNTIME-12-302 | Promote shared fixtures with Zastava/CLI and add end-to-end automation for `/runtime/events` + `/policy/runtime`. | Runtime policy integration test + CLI-aligned fixture assert confidence, metadata JSON, and Rekor verification; docs note shared contract. |
+| SCANNER-EVENTS-15-201 | DONE (2025-10-20) | Scanner WebService Guild | NOTIFY-QUEUE-15-401 | Emit `scanner.report.ready` and `scanner.scan.completed` events (bus adapters + tests). | Event envelopes published to queue with schemas; fixtures committed; Notify consumption test passes. |
+| SCANNER-RUNTIME-17-401 | DONE (2025-10-25) | Scanner WebService Guild | SCANNER-RUNTIME-12-301, ZASTAVA-OBS-17-005, SCANNER-EMIT-17-701, POLICY-RUNTIME-17-201 | Persist runtime build-id observations and expose them via `/runtime/events` + policy joins for debug-symbol correlation. | Runtime events store normalized digests + build IDs with supporting indexes, runtime policy responses surface `buildIds`, tests/docs updated, and CLI/API consumers can derive debug-store paths deterministically. |
--- a/src/Scanner/StellaOps.Scanner.WebService/TASKS.md
+++ b/src/Scanner/StellaOps.Scanner.WebService/TASKS.md
@@ -2,23 +2,8 @@

 | ID | Status | Owner(s) | Depends on | Description | Exit Criteria |
 |----|--------|----------|------------|-------------|---------------|
-| SCANNER-WEB-09-101 | DONE (2025-10-18) | Scanner WebService Guild | SCANNER-CORE-09-501 | Stand up minimal API host with Authority OpTok + DPoP enforcement, health/ready endpoints, and restart-time plug-in loader per architecture §1, §4. | Host boots with configuration validation, `/healthz` and `/readyz` return 200, Authority middleware enforced in integration tests. |
-| SCANNER-WEB-09-102 | DONE (2025-10-18) | Scanner WebService Guild | SCANNER-WEB-09-101, SCANNER-QUEUE-09-401 | Implement `/api/v1/scans` submission/status endpoints with deterministic IDs, validation, and cancellation tokens. | Contract documented, e2e test posts scan request and retrieves status, cancellation token honoured. |
-| SCANNER-WEB-09-103 | DONE (2025-10-19) | Scanner WebService Guild | SCANNER-WEB-09-102, SCANNER-CORE-09-502 | Emit scan progress via SSE/JSONL with correlation IDs and deterministic timestamps; document API reference. | Streaming endpoint verified in tests, timestamps formatted ISO-8601 UTC, docs updated in `docs/09_API_CLI_REFERENCE.md`. |
-| SCANNER-WEB-09-104 | DONE (2025-10-19) | Scanner WebService Guild | SCANNER-STORAGE-09-301, SCANNER-QUEUE-09-401 | Bind configuration for Mongo, MinIO, queue, feature flags; add startup diagnostics and fail-fast policy for missing deps. | Misconfiguration fails fast with actionable errors, configuration bound tests pass, diagnostics logged with correlation IDs. |
-| SCANNER-POLICY-09-105 | DONE (2025-10-19) | Scanner WebService Guild | POLICY-CORE-09-001 | Integrate policy schema loader + diagnostics + OpenAPI (YAML ignore rules, VEX include/exclude, vendor precedence). | Policy endpoints documented; validation surfaces actionable errors; OpenAPI schema published. |
-| SCANNER-POLICY-09-106 | DONE (2025-10-19) | Scanner WebService Guild | POLICY-CORE-09-002, SCANNER-POLICY-09-105 | `/reports` verdict assembly (Feedser/Vexer/Policy merge) + signed response envelope. | Aggregated report includes policy metadata; integration test verifies signed response; docs updated. |
-| SCANNER-POLICY-09-107 | DONE (2025-10-19) | Scanner WebService Guild | POLICY-CORE-09-005, SCANNER-POLICY-09-106 | Surface score inputs, config version, and `quietedBy` provenance in `/reports` response and signed payload; document schema changes. | `/reports` JSON + DSSE contain score, reachability, sourceTrust, confidenceBand, quiet provenance; contract tests updated; docs refreshed. |
-| SCANNER-WEB-10-201 | DONE (2025-10-19) | Scanner WebService Guild | SCANNER-CACHE-10-101 | Register scanner cache services and maintenance loop within WebService host. | `AddScannerCache` wired for configuration binding; maintenance service skips when disabled; project references updated. |
-| SCANNER-RUNTIME-12-301 | DONE (2025-10-20) | Scanner WebService Guild | ZASTAVA-CORE-12-201 | Implement `/runtime/events` ingestion endpoint with validation, batching, and storage hooks per Zastava contract. | Observer fixtures POST events, data persisted and acked; invalid payloads rejected with deterministic errors. |
-| SCANNER-RUNTIME-12-302 | DONE (2025-10-24) | Scanner WebService Guild | SCANNER-RUNTIME-12-301, ZASTAVA-CORE-12-201 | Implement `/policy/runtime` endpoint joining SBOM baseline + policy verdict, returning admission guidance. Coordinate with CLI (`CLI-RUNTIME-13-008`) before GA to lock response field names/metadata. | Webhook integration test passes; responses include verdict, TTL, reasons; metrics/logging added; CLI contract review signed off. |
-| SCANNER-RUNTIME-12-303 | DONE (2025-10-24) | Scanner WebService Guild | SCANNER-RUNTIME-12-302 | Replace `/policy/runtime` heuristic with canonical policy evaluation (Feedser/Vexer inputs, PolicyPreviewService) so results align with `/reports`. | Runtime policy endpoint now pipes findings through `PolicyPreviewService`, emits canonical verdicts/confidence/quiet metadata, and updated tests cover pass/warn/fail paths + CLI contract fixtures. |
-| SCANNER-RUNTIME-12-304 | DONE (2025-10-24) | Scanner WebService Guild | SCANNER-RUNTIME-12-302 | Surface attestation verification status by integrating Authority/Attestor Rekor validation (beyond presence-only). | `/policy/runtime` maps Rekor UUIDs through the runtime attestation verifier so `rekor.verified` reflects attestor outcomes; webhook/CLI coverage added. |
-| SCANNER-RUNTIME-12-305 | DONE (2025-10-24) | Scanner WebService Guild | SCANNER-RUNTIME-12-301, SCANNER-RUNTIME-12-302 | Promote shared fixtures with Zastava/CLI and add end-to-end automation for `/runtime/events` + `/policy/runtime`. | Runtime policy integration test + CLI-aligned fixture assert confidence, metadata JSON, and Rekor verification; docs note shared contract. |
-| SCANNER-EVENTS-15-201 | DONE (2025-10-20) | Scanner WebService Guild | NOTIFY-QUEUE-15-401 | Emit `scanner.report.ready` and `scanner.scan.completed` events (bus adapters + tests). | Event envelopes published to queue with schemas; fixtures committed; Notify consumption test passes. |
 | SCANNER-EVENTS-16-301 | BLOCKED (2025-10-26) | Scanner WebService Guild | ORCH-SVC-38-101, NOTIFY-SVC-38-001 | Emit orchestrator-compatible envelopes (`scanner.event.*`) and update integration tests to verify Notifier ingestion (no Redis queue coupling). | Tests assert envelope schema + orchestrator publish; Notifier consumer harness passes; docs updated with new event contract. Blocked by .NET 10 preview OpenAPI/Auth dependency drift preventing `dotnet test` completion. |
 | SCANNER-EVENTS-16-302 | DOING (2025-10-26) | Scanner WebService Guild | SCANNER-EVENTS-16-301 | Extend orchestrator event links (report/policy/attestation) once endpoints are finalised across gateway + console. | Links section covers UI/API targets; downstream consumers validated; docs/samples updated. |
-| SCANNER-RUNTIME-17-401 | DONE (2025-10-25) | Scanner WebService Guild | SCANNER-RUNTIME-12-301, ZASTAVA-OBS-17-005, SCANNER-EMIT-17-701, POLICY-RUNTIME-17-201 | Persist runtime build-id observations and expose them via `/runtime/events` + policy joins for debug-symbol correlation. | Runtime events store normalized digests + build IDs with supporting indexes, runtime policy responses surface `buildIds`, tests/docs updated, and CLI/API consumers can derive debug-store paths deterministically. |

 ## Graph Explorer v1 (Sprint 21)

@@ -41,5 +26,6 @@
 - 2025-10-21: Hardened progress streaming determinism by sorting `data` payload keys within `ScanProgressStream`; added regression `ProgressStreamDataKeysAreSortedDeterministically` ensuring JSONL ordering.
 - 2025-10-24: `/policy/runtime` now streams through PolicyPreviewService + attestation verifier; CLI and webhook fixtures updated alongside Zastava observer batching completion.
 - 2025-10-26: SCANNER-EVENTS-16-302 populates orchestrator link payloads (UI, API report lookup, policy revision, attestation) pending cross-service integration; samples/tests updated.
+- 2025-10-30: SCANNER-EVENTS-16-302 upgraded link payloads to nested UI/API targets, refreshed JSON schemas/docs/samples, and updated dispatcher/tests; downstream consumers to validate before closure.
 - 2025-10-26: Coordinate with Gateway + Console owners to confirm final API/UX paths for report, policy revision, and attestation links before promoting SCANNER-EVENTS-16-301 out of BLOCKED.
 - 2025-10-26: SCANNER-EVENTS-16-301 emitting new orchestrator envelopes; solution-wide `dotnet test` currently blocked by preview `Microsoft.AspNetCore.OpenApi` APIs and missing `StellaOps.Auth` dependency wiring. JSON Schemas validated via `ajv`; service-level verification pending SDK alignment.