semi implemented and features implemented save checkpoint

docs/implplan-blocked/audits/csproj-standards/AdvisoryAI/StellaOps.AdvisoryAI.Hosting/StellaOps.AdvisoryAI.Hosting.md

@@ -0,0 +1,43 @@
+# Audit - StellaOps.AdvisoryAI.Hosting
+
+## Project
+- Path: `src/AdvisoryAI/StellaOps.AdvisoryAI.Hosting/StellaOps.AdvisoryAI.Hosting.csproj`
+- Module: `AdvisoryAI`
+- Kind: `Service`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 4
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI.Hosting/FileSystemAdvisoryPlanCache.cs` (468 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI.Hosting/ServiceCollectionExtensions.cs` (280 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI.Hosting/FileSystemAdvisoryTaskQueue.cs` (190 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI.Hosting/FileSystemAdvisoryOutputStore.cs` (180 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: FAIL
+- Expected layers: Unit
+- Detected test projects: none
+- Missing layers: Unit
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- Add a unit test project named `<Project>.Tests` (or document exception).

docs/implplan-blocked/audits/csproj-standards/AdvisoryAI/StellaOps.AdvisoryAI.Plugin.Unified/StellaOps.AdvisoryAI.Plugin.Unified.md

@@ -0,0 +1,44 @@
+# Audit - StellaOps.AdvisoryAI.Plugin.Unified
+
+## Project
+- Path: `src/AdvisoryAI/StellaOps.AdvisoryAI.Plugin.Unified/StellaOps.AdvisoryAI.Plugin.Unified.csproj`
+- Module: `AdvisoryAI`
+- Kind: `Plugin`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 2
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI.Plugin.Unified/LlmPluginAdapter.cs` (217 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI.Plugin.Unified/LlmPluginAdapterFactory.cs` (137 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: FAIL
+- Expected layers: Unit, Integration, Security, Offline
+- Detected test projects: none
+- Missing layers: Unit, Integration, Security, Offline
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- Add a unit test project named `<Project>.Tests` (or document exception).
+- Add integration tests for cross-component flows.
+- Add security tests for authn/authz or input validation.
+- Add offline/airgap coverage with fixtures only.

docs/implplan-blocked/audits/csproj-standards/AdvisoryAI/StellaOps.AdvisoryAI.Scm.Plugin.Unified/StellaOps.AdvisoryAI.Scm.Plugin.Unified.md

@@ -0,0 +1,44 @@
+# Audit - StellaOps.AdvisoryAI.Scm.Plugin.Unified
+
+## Project
+- Path: `src/AdvisoryAI/StellaOps.AdvisoryAI.Scm.Plugin.Unified/StellaOps.AdvisoryAI.Scm.Plugin.Unified.csproj`
+- Module: `AdvisoryAI`
+- Kind: `Plugin`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 2
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI.Scm.Plugin.Unified/ScmPluginAdapter.cs` (347 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI.Scm.Plugin.Unified/ScmPluginAdapterFactory.cs` (134 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: FAIL
+- Expected layers: Unit, Integration, Security, Offline
+- Detected test projects: none
+- Missing layers: Unit, Integration, Security, Offline
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- Add a unit test project named `<Project>.Tests` (or document exception).
+- Add integration tests for cross-component flows.
+- Add security tests for authn/authz or input validation.
+- Add offline/airgap coverage with fixtures only.

docs/implplan-blocked/audits/csproj-standards/AdvisoryAI/StellaOps.AdvisoryAI.WebService/StellaOps.AdvisoryAI.WebService.md

@@ -0,0 +1,61 @@
+# Audit - StellaOps.AdvisoryAI.WebService
+
+## Project
+- Path: `src/AdvisoryAI/StellaOps.AdvisoryAI.WebService/StellaOps.AdvisoryAI.WebService.csproj`
+- Module: `AdvisoryAI`
+- Kind: `WebService`
+- SDK: `Microsoft.NET.Sdk.Web`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 15
+- Service locator usage (BuildServiceProvider/GetService): 4
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI.WebService/Program.cs` (1316 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI.WebService/Endpoints/ChatEndpoints.cs` (1224 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI.WebService/Endpoints/RunEndpoints.cs` (907 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI.WebService/Endpoints/EvidencePackEndpoints.cs` (896 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI.WebService/Contracts/ChatContracts.cs` (398 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI.WebService/Endpoints/AttestationEndpoints.cs` (331 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI.WebService/Contracts/PolicyStudioContracts.cs` (241 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI.WebService/Contracts/RemediationContracts.cs` (235 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI.WebService/Services/IAiJustificationGenerator.cs` (221 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI.WebService/Contracts/ExplainResponse.cs` (157 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI.WebService/Contracts/ConsentContracts.cs` (127 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI.WebService/Contracts/JustifyContracts.cs` (126 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI.WebService/Services/IAiConsentStore.cs` (117 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI.WebService/Services/AuthorizationService.cs` (116 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI.WebService/Services/RateLimitsService.cs` (108 lines)
+- Service locator matches:
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI.WebService/Endpoints/AttestationEndpoints.cs`:90 var store = httpContext.RequestServices.GetService<IAiAttestationStore>();
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI.WebService/Endpoints/EvidencePackEndpoints.cs`:230 var store = httpContext.RequestServices.GetService<IEvidencePackStore>();
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI.WebService/Endpoints/EvidencePackEndpoints.cs`:312 var store = httpContext.RequestServices.GetService<IEvidencePackStore>();
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI.WebService/Endpoints/EvidencePackEndpoints.cs`:344 var store = httpContext.RequestServices.GetService<IEvidencePackStore>();
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+- Replace service locator usage with constructor injection.
+
+## Testing Fullness Findings
+- Status: FAIL
+- Expected layers: Unit, Integration, Security, Offline
+- Detected test projects: none
+- Missing layers: Unit, Integration, Security, Offline
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- Add a unit test project named `<Project>.Tests` (or document exception).
+- Add integration tests for cross-component flows.
+- Add security tests for authn/authz or input validation.
+- Add offline/airgap coverage with fixtures only.

docs/implplan-blocked/audits/csproj-standards/AdvisoryAI/StellaOps.AdvisoryAI.Worker/StellaOps.AdvisoryAI.Worker.md

@@ -0,0 +1,43 @@
+# Audit - StellaOps.AdvisoryAI.Worker
+
+## Project
+- Path: `src/AdvisoryAI/StellaOps.AdvisoryAI.Worker/StellaOps.AdvisoryAI.Worker.csproj`
+- Module: `AdvisoryAI`
+- Kind: `Worker`
+- SDK: `Microsoft.NET.Sdk.Worker`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 1
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI.Worker/Services/AdvisoryTaskWorker.cs` (157 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: FAIL
+- Expected layers: Unit, Integration, E2E, Offline
+- Detected test projects: none
+- Missing layers: Unit, Integration, E2E, Offline
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- Add a unit test project named `<Project>.Tests` (or document exception).
+- Add integration tests for cross-component flows.
+- Add E2E coverage for user-visible workflows.
+- Add offline/airgap coverage with fixtures only.

docs/implplan-blocked/audits/csproj-standards/AdvisoryAI/StellaOps.AdvisoryAI/StellaOps.AdvisoryAI.md

@@ -0,0 +1,168 @@
+# Audit - StellaOps.AdvisoryAI
+
+## Project
+- Path: `src/AdvisoryAI/StellaOps.AdvisoryAI/StellaOps.AdvisoryAI.csproj`
+- Module: `AdvisoryAI`
+- Kind: `Service`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 129
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI/Chat/Services/AdvisoryChatService.cs` (895 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI/PolicyStudio/PolicyBundleCompiler.cs` (773 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI/Chat/ConversationService.cs` (732 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI/Runs/RunService.cs` (723 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI/Chat/Audit/AdvisoryChatAuditEnvelopeBuilder.cs` (708 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI/Chat/Assembly/EvidenceBundleAssembler.cs` (685 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI/Chat/GroundingValidator.cs` (601 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI/Inference/LlmProviders/LlamaServerLlmProvider.cs` (592 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI/Inference/LlmProviders/OpenAiLlmProvider.cs` (590 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI/Inference/LlmProviders/GeminiLlmProvider.cs` (575 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI/Inference/LlmProviders/LlmInferenceCache.cs` (570 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI/Inference/LlmProviders/ClaudeLlmProvider.cs` (567 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI/Inference/LlmProviders/OllamaLlmProvider.cs` (536 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI/Chat/Services/PostgresAdvisoryChatAuditLogger.cs` (530 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI/Chat/ChatResponseStreamer.cs` (488 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI/Chat/Routing/AdvisoryChatIntentRouter.cs` (462 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI/Replay/AIArtifactReplayer.cs` (461 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI/Actions/ActionExecutor.cs` (456 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI/Actions/ActionRegistry.cs` (433 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI/Runs/IRunService.cs` (429 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI/Runs/Models/RunEvent.cs` (428 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI/Orchestration/AdvisoryPipelineOrchestrator.cs` (425 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI/Chat/Models/AdvisoryChatModels.cs` (406 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI/Inference/SignedModelBundleManager.cs` (397 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI/Prompting/AdvisoryPromptAssembler.cs` (390 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI/Remediation/ScmConnector/AzureDevOpsScmConnector.cs` (386 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI/Tools/DeterministicToolset.cs` (382 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI/Guardrails/AdvisoryGuardrailPipeline.cs` (381 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI/Chat/ConversationContextBuilder.cs` (377 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI/Storage/ConversationStore.cs` (376 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI/Remediation/AiRemediationPlanner.cs` (364 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI/Chat/Assembly/DataProviders.cs` (362 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI/Inference/LlmProviders/LlmProviderFactory.cs` (361 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI/Actions/ActionPolicyGate.cs` (359 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI/Actions/IActionPolicyGate.cs` (358 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI/Actions/IActionExecutor.cs` (349 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI/Chat/AttestationIntegration.cs` (348 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI/Chat/EvidencePackChatIntegration.cs` (346 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI/Chat/Inference/ClaudeInferenceClient.cs` (342 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI/Remediation/ScmConnector/GitLabScmConnector.cs` (335 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI/Chat/Models/AdvisoryChatResponseModels.cs` (330 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI/Chat/Inference/OpenAIInferenceClient.cs` (328 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI/Chat/Options/AdvisoryChatOptions.cs` (328 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI/Remediation/ScmConnector/GiteaScmConnector.cs` (327 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI/PolicyStudio/PropertyBasedTestSynthesizer.cs` (326 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI/Remediation/PrTemplateBuilder.cs` (325 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI/Remediation/RemediationDeltaService.cs` (324 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI/Remediation/ScmConnector/GitHubScmConnector.cs` (323 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI/Chat/Inference/LocalInferenceClient.cs` (318 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI/Remediation/GitHubPullRequestGenerator.cs` (310 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI/Inference/LlmBenchmark.cs` (308 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI/Chat/Services/AdvisoryChatQuotaService.cs` (307 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI/Chat/Inference/OllamaInferenceClient.cs` (295 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI/Chat/OpsMemoryIntegration.cs` (294 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI/Chat/ActionProposalParser.cs` (289 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI/Actions/IApprovalWorkflowAdapter.cs` (283 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI/Explanation/ExplanationPromptTemplates.cs` (282 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI/Inference/ModelBundle.cs` (280 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI/Runs/Models/Run.cs` (278 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI/Chunking/CsafDocumentChunker.cs` (278 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI/PolicyStudio/AiPolicyIntentParser.cs` (277 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI/Actions/IActionAuditLedger.cs` (276 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI/Actions/ApprovalWorkflowAdapter.cs` (275 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI/Remediation/ScmConnector/IScmConnector.cs` (272 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI/Chat/ChatPromptAssembler.cs` (270 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI/PolicyStudio/LatticeRuleGenerator.cs` (268 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI/Tools/SemanticVersion.cs` (256 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI/Inference/LlmProviders/ILlmProviderPlugin.cs` (248 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI/Inference/ProviderBasedAdvisoryInferenceClient.cs` (235 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI/Chat/Settings/AdvisoryChatToolPolicy.cs` (234 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI/Providers/SbomContextHttpClient.cs` (234 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI/Remediation/RemediationPlan.cs` (224 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI/Remediation/IPullRequestGenerator.cs` (224 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI/Explanation/EvidenceAnchoredExplanationGenerator.cs` (217 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI/Inference/AdvisoryInferenceClient.cs` (215 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI/Actions/IdempotencyHandler.cs` (213 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI/Chat/Assembly/Providers/ProvenanceDataProvider.cs` (210 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI/Chat/Assembly/Providers/SbomDataProvider.cs` (210 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI/Retrievers/SbomContextRetriever.cs` (209 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI/Chat/Assembly/Providers/OpsMemoryDataProvider.cs` (207 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI/Chat/Settings/AdvisoryChatSettingsService.cs` (203 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI/Chat/DependencyInjection/AdvisoryChatServiceCollectionExtensions.cs` (202 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI/Providers/ExcititorVexDocumentProvider.cs` (202 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI/Chunking/OpenVexDocumentChunker.cs` (199 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI/PolicyStudio/PolicyIntent.cs` (196 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI/Providers/ISbomContextClient.cs` (196 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI/Chat/Assembly/Providers/FixDataProvider.cs` (192 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI/Context/SbomContextResult.cs` (189 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI/Remediation/ScmConnector/ScmConnectorCatalog.cs` (189 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI/Runs/Models/RunArtifact.cs` (182 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI/Inference/LlamaCppRuntime.cs` (182 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI/PolicyStudio/IPolicyRuleGenerator.cs` (180 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI/Inference/LlmProviders/ILlmProvider.cs` (178 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI/Outputs/AdvisoryOutputStore.cs` (178 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI/Caching/IAdvisoryPlanCache.cs` (172 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI/PolicyStudio/ITestCaseSynthesizer.cs` (170 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI/Chat/Assembly/Providers/ReachabilityDataProvider.cs` (169 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI/Inference/LlmProviders/LlmProviderOptions.cs` (168 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI/Inference/LocalLlmConfig.cs` (161 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI/Runs/InMemoryRunStore.cs` (161 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI/Remediation/ScmConnector/ScmConnectorBase.cs` (159 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI/Orchestration/AdvisoryPipelineOptions.cs` (159 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI/Explanation/DefaultExplanationPromptService.cs` (157 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI/Chat/Assembly/Providers/VexDataProvider.cs` (154 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI/Actions/ActionAuditLedger.cs` (151 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI/Chat/Assembly/IEvidenceBundleAssembler.cs` (151 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI/Chat/OpsMemoryLinkResolver.cs` (147 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI/Explanation/ExplanationResult.cs` (142 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI/Remediation/AzureDevOpsPullRequestGenerator.cs` (142 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI/Chat/Settings/AdvisoryChatSettingsStore.cs` (140 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI/Chunking/OsvDocumentChunker.cs` (138 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI/Inference/OnnxRuntime.cs` (138 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI/Inference/ILocalLlmRuntime.cs` (136 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI/Actions/ActionDefinition.cs` (135 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI/Execution/AdvisoryPipelineExecutor.cs` (132 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI/Inference/LocalInferenceOptions.cs` (129 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI/Providers/ConcelierAdvisoryDocumentProvider.cs` (125 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI/Chat/Assembly/Providers/PolicyDataProvider.cs` (124 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI/Explanation/IEvidenceRetrievalService.cs` (122 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI/Chat/Assembly/Providers/BinaryPatchDataProvider.cs` (122 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI/Tools/SemanticVersionRange.cs` (121 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI/Remediation/GitLabMergeRequestGenerator.cs` (121 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI/PolicyStudio/NullPolicyIntentParser.cs` (114 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI/Chat/Assembly/Providers/ContextDataProvider.cs` (110 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI/Orchestration/AdvisoryPipelinePlanResponse.cs` (110 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI/Metrics/AdvisoryPipelineMetrics.cs` (110 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI/DependencyInjection/ToolsetServiceCollectionExtensions.cs` (105 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI/Runs/IRunStore.cs` (104 lines)
+  - `src/AdvisoryAI/StellaOps.AdvisoryAI/Chat/Inference/SystemPromptLoader.cs` (104 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: PASS
+- Expected layers: Unit
+- Detected test projects: src/__Libraries/__Tests/StellaOps.AdvisoryAI.Attestation.Tests/StellaOps.AdvisoryAI.Attestation.Tests.csproj [Unit], src/AdvisoryAI/__Tests/StellaOps.AdvisoryAI.Tests/StellaOps.AdvisoryAI.Tests.csproj [Unit]
+- Missing layers: none
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- None.

docs/implplan-blocked/audits/csproj-standards/AirGap/StellaOps.AirGap.Controller/StellaOps.AirGap.Controller.md

@@ -0,0 +1,47 @@
+# Audit - StellaOps.AirGap.Controller
+
+## Project
+- Path: `src/AirGap/StellaOps.AirGap.Controller/StellaOps.AirGap.Controller.csproj`
+- Module: `AirGap`
+- Kind: `WebService`
+- SDK: `Microsoft.NET.Sdk.Web`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 6
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/AirGap/StellaOps.AirGap.Controller/Endpoints/AirGapEndpoints.cs` (267 lines)
+  - `src/AirGap/StellaOps.AirGap.Controller/Services/AirGapTelemetry.cs` (177 lines)
+  - `src/AirGap/StellaOps.AirGap.Controller/Services/AirGapStartupDiagnosticsHostedService.cs` (174 lines)
+  - `src/AirGap/StellaOps.AirGap.Controller/Services/AirGapStateService.cs` (118 lines)
+  - `src/AirGap/StellaOps.AirGap.Controller/Endpoints/RequestValidation.cs` (107 lines)
+  - `src/AirGap/StellaOps.AirGap.Controller/Auth/HeaderScopeAuthenticationHandler.cs` (105 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: FAIL
+- Expected layers: Unit, Integration, Security, Offline
+- Detected test projects: src/AirGap/__Tests/StellaOps.AirGap.Controller.Tests/StellaOps.AirGap.Controller.Tests.csproj [Unit]
+- Missing layers: Integration, Security, Offline
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- Add integration tests for cross-component flows.
+- Add security tests for authn/authz or input validation.
+- Add offline/airgap coverage with fixtures only.

docs/implplan-blocked/audits/csproj-standards/AirGap/StellaOps.AirGap.Importer/StellaOps.AirGap.Importer.md

@@ -0,0 +1,64 @@
+# Audit - StellaOps.AirGap.Importer
+
+## Project
+- Path: `src/AirGap/StellaOps.AirGap.Importer/StellaOps.AirGap.Importer.csproj`
+- Module: `AirGap`
+- Kind: `Service`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 25
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/AirGap/StellaOps.AirGap.Importer/Validation/RekorOfflineReceiptVerifier.cs` (655 lines)
+  - `src/AirGap/StellaOps.AirGap.Importer/Reconciliation/Parsers/SbomNormalizer.cs` (512 lines)
+  - `src/AirGap/StellaOps.AirGap.Importer/Validation/ReferrerValidator.cs` (480 lines)
+  - `src/AirGap/StellaOps.AirGap.Importer/Validation/ImportValidator.cs` (448 lines)
+  - `src/AirGap/StellaOps.AirGap.Importer/Reconciliation/Parsers/AttestationCollector.cs` (438 lines)
+  - `src/AirGap/StellaOps.AirGap.Importer/Validation/RuleBundleValidator.cs` (432 lines)
+  - `src/AirGap/StellaOps.AirGap.Importer/Quarantine/FileSystemQuarantineService.cs` (395 lines)
+  - `src/AirGap/StellaOps.AirGap.Importer/Reconciliation/EvidenceReconciler.cs` (394 lines)
+  - `src/AirGap/StellaOps.AirGap.Importer/Reconciliation/Parsers/CycloneDxParser.cs` (342 lines)
+  - `src/AirGap/StellaOps.AirGap.Importer/Reconciliation/EvidenceGraph.cs` (333 lines)
+  - `src/AirGap/StellaOps.AirGap.Importer/Reconciliation/Parsers/SpdxParser.cs` (315 lines)
+  - `src/AirGap/StellaOps.AirGap.Importer/Reconciliation/Parsers/DsseAttestationParser.cs` (300 lines)
+  - `src/AirGap/StellaOps.AirGap.Importer/Reconciliation/JsonNormalizer.cs` (281 lines)
+  - `src/AirGap/StellaOps.AirGap.Importer/Reconciliation/SourcePrecedenceLattice.cs` (264 lines)
+  - `src/AirGap/StellaOps.AirGap.Importer/Policy/OfflineVerificationPolicy.cs` (213 lines)
+  - `src/AirGap/StellaOps.AirGap.Importer/Validation/DsseVerifier.cs` (211 lines)
+  - `src/AirGap/StellaOps.AirGap.Importer/Reconciliation/Parsers/IAttestationParser.cs` (204 lines)
+  - `src/AirGap/StellaOps.AirGap.Importer/Reconciliation/Parsers/ISbomParser.cs` (188 lines)
+  - `src/AirGap/StellaOps.AirGap.Importer/Reconciliation/Parsers/OpenVexParser.cs` (182 lines)
+  - `src/AirGap/StellaOps.AirGap.Importer/Reconciliation/Signing/EvidenceGraphDsseSigner.cs` (182 lines)
+  - `src/AirGap/StellaOps.AirGap.Importer/Reconciliation/Parsers/SbomCollector.cs` (173 lines)
+  - `src/AirGap/StellaOps.AirGap.Importer/Versioning/BundleVersion.cs` (144 lines)
+  - `src/AirGap/StellaOps.AirGap.Importer/Reconciliation/ArtifactIndex.cs` (143 lines)
+  - `src/AirGap/StellaOps.AirGap.Importer/Telemetry/OfflineKitMetrics.cs` (142 lines)
+  - `src/AirGap/StellaOps.AirGap.Importer/Policy/OfflineVerificationPolicyLoader.cs` (132 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: PASS
+- Expected layers: Unit
+- Detected test projects: src/AirGap/__Tests/StellaOps.AirGap.Importer.Tests/StellaOps.AirGap.Importer.Tests.csproj [Unit]
+- Missing layers: none
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- None.

docs/implplan-blocked/audits/csproj-standards/AirGap/StellaOps.AirGap.Policy/StellaOps.AirGap.Policy.Analyzers/StellaOps.AirGap.Policy.Analyzers.md

@@ -0,0 +1,40 @@
+# Audit - StellaOps.AirGap.Policy.Analyzers
+
+## Project
+- Path: `src/AirGap/StellaOps.AirGap.Policy/StellaOps.AirGap.Policy.Analyzers/StellaOps.AirGap.Policy.Analyzers.csproj`
+- Module: `AirGap`
+- Kind: `Service`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `netstandard2.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 1
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/AirGap/StellaOps.AirGap.Policy/StellaOps.AirGap.Policy.Analyzers/HttpClientUsageAnalyzer.cs` (106 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: PASS
+- Expected layers: Unit
+- Detected test projects: src/AirGap/StellaOps.AirGap.Policy/StellaOps.AirGap.Policy.Analyzers.Tests/StellaOps.AirGap.Policy.Analyzers.Tests.csproj [Unit]
+- Missing layers: none
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- None.

docs/implplan-blocked/audits/csproj-standards/AirGap/StellaOps.AirGap.Policy/StellaOps.AirGap.Policy/StellaOps.AirGap.Policy.md

@@ -0,0 +1,42 @@
+# Audit - StellaOps.AirGap.Policy
+
+## Project
+- Path: `src/AirGap/StellaOps.AirGap.Policy/StellaOps.AirGap.Policy/StellaOps.AirGap.Policy.csproj`
+- Module: `AirGap`
+- Kind: `Service`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 3
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/AirGap/StellaOps.AirGap.Policy/StellaOps.AirGap.Policy/EgressPolicyServiceCollectionExtensions.cs` (293 lines)
+  - `src/AirGap/StellaOps.AirGap.Policy/StellaOps.AirGap.Policy/EgressPolicy.cs` (243 lines)
+  - `src/AirGap/StellaOps.AirGap.Policy/StellaOps.AirGap.Policy/EgressRule.cs` (127 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: PASS
+- Expected layers: Unit
+- Detected test projects: src/AirGap/StellaOps.AirGap.Policy/StellaOps.AirGap.Policy.Tests/StellaOps.AirGap.Policy.Tests.csproj [Unit], src/AirGap/StellaOps.AirGap.Policy/StellaOps.AirGap.Policy.Analyzers.Tests/StellaOps.AirGap.Policy.Analyzers.Tests.csproj [Unit]
+- Missing layers: none
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- None.

docs/implplan-blocked/audits/csproj-standards/AirGap/StellaOps.AirGap.Time/StellaOps.AirGap.Time.md

@@ -0,0 +1,46 @@
+# Audit - StellaOps.AirGap.Time
+
+## Project
+- Path: `src/AirGap/StellaOps.AirGap.Time/StellaOps.AirGap.Time.csproj`
+- Module: `AirGap`
+- Kind: `WebService`
+- SDK: `Microsoft.NET.Sdk.Web`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 3
+- Service locator usage (BuildServiceProvider/GetService): 2
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/AirGap/StellaOps.AirGap.Time/Services/RoughtimeVerifier.cs` (430 lines)
+  - `src/AirGap/StellaOps.AirGap.Time/Services/Rfc3161Verifier.cs` (339 lines)
+  - `src/AirGap/StellaOps.AirGap.Time/Services/TimeAnchorPolicyService.cs` (306 lines)
+- Service locator matches:
+  - `src/AirGap/StellaOps.AirGap.Time/Hooks/StartupValidationExtensions.cs`:17 var validator = scope.ServiceProvider.GetRequiredService<SealedStartupValidator>();
+  - `src/AirGap/StellaOps.AirGap.Time/Hooks/StartupValidationExtensions.cs`:18 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("AirGap.Time.Startup");
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+- Replace service locator usage with constructor injection.
+
+## Testing Fullness Findings
+- Status: FAIL
+- Expected layers: Unit, Integration, Security, Offline
+- Detected test projects: src/AirGap/__Tests/StellaOps.AirGap.Time.Tests/StellaOps.AirGap.Time.Tests.csproj [Unit]
+- Missing layers: Integration, Security, Offline
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- Add integration tests for cross-component flows.
+- Add security tests for authn/authz or input validation.
+- Add offline/airgap coverage with fixtures only.

docs/implplan-blocked/audits/csproj-standards/AirGap/__Libraries/StellaOps.AirGap.Bundle/StellaOps.AirGap.Bundle.md

@@ -0,0 +1,65 @@
+# Audit - StellaOps.AirGap.Bundle
+
+## Project
+- Path: `src/AirGap/__Libraries/StellaOps.AirGap.Bundle/StellaOps.AirGap.Bundle.csproj`
+- Module: `AirGap`
+- Kind: `Library`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 26
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/AirGap/__Libraries/StellaOps.AirGap.Bundle/TrustSnapshot/TrustSnapshotImporter.cs` (686 lines)
+  - `src/AirGap/__Libraries/StellaOps.AirGap.Bundle/Services/BundleBuilder.cs` (639 lines)
+  - `src/AirGap/__Libraries/StellaOps.AirGap.Bundle/Services/SnapshotBundleReader.cs` (620 lines)
+  - `src/AirGap/__Libraries/StellaOps.AirGap.Bundle/Services/SnapshotBundleWriter.cs` (601 lines)
+  - `src/AirGap/__Libraries/StellaOps.AirGap.Bundle/TrustSnapshot/TrustSnapshotBuilder.cs` (595 lines)
+  - `src/AirGap/__Libraries/StellaOps.AirGap.Bundle/Services/KnowledgeSnapshotImporter.cs` (567 lines)
+  - `src/AirGap/__Libraries/StellaOps.AirGap.Bundle/Services/SnapshotManifestSigner.cs` (488 lines)
+  - `src/AirGap/__Libraries/StellaOps.AirGap.Bundle/Extractors/PolicySnapshotExtractor.cs` (374 lines)
+  - `src/AirGap/__Libraries/StellaOps.AirGap.Bundle/TrustSnapshot/TrustSnapshotManifest.cs` (359 lines)
+  - `src/AirGap/__Libraries/StellaOps.AirGap.Bundle/Services/TimeAnchorService.cs` (319 lines)
+  - `src/AirGap/__Libraries/StellaOps.AirGap.Bundle/Extractors/VexSnapshotExtractor.cs` (295 lines)
+  - `src/AirGap/__Libraries/StellaOps.AirGap.Bundle/Services/TsaChainBundler.cs` (271 lines)
+  - `src/AirGap/__Libraries/StellaOps.AirGap.Bundle/Models/BundleManifest.cs` (270 lines)
+  - `src/AirGap/__Libraries/StellaOps.AirGap.Bundle/Extractors/AdvisorySnapshotExtractor.cs` (269 lines)
+  - `src/AirGap/__Libraries/StellaOps.AirGap.Bundle/Services/ConcelierAdvisoryImportTarget.cs` (269 lines)
+  - `src/AirGap/__Libraries/StellaOps.AirGap.Bundle/Models/BundleFormatV2.cs` (266 lines)
+  - `src/AirGap/__Libraries/StellaOps.AirGap.Bundle/Services/ExcititorVexImportTarget.cs` (265 lines)
+  - `src/AirGap/__Libraries/StellaOps.AirGap.Bundle/Services/PolicyRegistryImportTarget.cs` (251 lines)
+  - `src/AirGap/__Libraries/StellaOps.AirGap.Bundle/FunctionMap/FunctionMapBundleIntegration.cs` (239 lines)
+  - `src/AirGap/__Libraries/StellaOps.AirGap.Bundle/Validation/BundleValidator.cs` (224 lines)
+  - `src/AirGap/__Libraries/StellaOps.AirGap.Bundle/Services/LocalRbacBundleExtensions.cs` (179 lines)
+  - `src/AirGap/__Libraries/StellaOps.AirGap.Bundle/Models/KnowledgeSnapshotManifest.cs` (166 lines)
+  - `src/AirGap/__Libraries/StellaOps.AirGap.Bundle/Services/Abstractions.cs` (162 lines)
+  - `src/AirGap/__Libraries/StellaOps.AirGap.Bundle/Services/CrlFetcher.cs` (160 lines)
+  - `src/AirGap/__Libraries/StellaOps.AirGap.Bundle/Services/OcspResponseFetcher.cs` (138 lines)
+  - `src/AirGap/__Libraries/StellaOps.AirGap.Bundle/Services/TrustProfileLoader.cs` (111 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: PASS
+- Expected layers: Unit
+- Detected test projects: src/AirGap/__Libraries/__Tests/StellaOps.AirGap.Bundle.Tests/StellaOps.AirGap.Bundle.Tests.csproj [Unit]
+- Missing layers: none
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- None.

docs/implplan-blocked/audits/csproj-standards/AirGap/__Libraries/StellaOps.AirGap.Persistence/StellaOps.AirGap.Persistence.md

@@ -0,0 +1,41 @@
+# Audit - StellaOps.AirGap.Persistence
+
+## Project
+- Path: `src/AirGap/__Libraries/StellaOps.AirGap.Persistence/StellaOps.AirGap.Persistence.csproj`
+- Module: `AirGap`
+- Kind: `Library`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 2
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/AirGap/__Libraries/StellaOps.AirGap.Persistence/Postgres/Repositories/PostgresBundleVersionStore.cs` (361 lines)
+  - `src/AirGap/__Libraries/StellaOps.AirGap.Persistence/Postgres/Repositories/PostgresAirGapStateStore.cs` (341 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: PASS
+- Expected layers: Unit
+- Detected test projects: src/AirGap/__Tests/StellaOps.AirGap.Persistence.Tests/StellaOps.AirGap.Persistence.Tests.csproj [Unit]
+- Missing layers: none
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- None.

docs/implplan-blocked/audits/csproj-standards/AirGap/__Libraries/StellaOps.AirGap.Sync/StellaOps.AirGap.Sync.md

@@ -0,0 +1,53 @@
+# Audit - StellaOps.AirGap.Sync
+
+## Project
+- Path: `src/AirGap/__Libraries/StellaOps.AirGap.Sync/StellaOps.AirGap.Sync.csproj`
+- Module: `AirGap`
+- Kind: `Library`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 13
+- Service locator usage (BuildServiceProvider/GetService): 1
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/AirGap/__Libraries/StellaOps.AirGap.Sync/Services/AirGapBundleImporter.cs` (316 lines)
+  - `src/AirGap/__Libraries/StellaOps.AirGap.Sync/Services/AirGapBundleDsseSigner.cs` (275 lines)
+  - `src/AirGap/__Libraries/StellaOps.AirGap.Sync/Transport/RouterJobSyncTransport.cs` (272 lines)
+  - `src/AirGap/__Libraries/StellaOps.AirGap.Sync/Services/AirGapBundleExporter.cs` (270 lines)
+  - `src/AirGap/__Libraries/StellaOps.AirGap.Sync/Stores/FileBasedOfflineJobLogStore.cs` (246 lines)
+  - `src/AirGap/__Libraries/StellaOps.AirGap.Sync/Transport/FileBasedJobSyncTransport.cs` (222 lines)
+  - `src/AirGap/__Libraries/StellaOps.AirGap.Sync/Services/AirGapSyncService.cs` (198 lines)
+  - `src/AirGap/__Libraries/StellaOps.AirGap.Sync/Services/OfflineHlcManager.cs` (172 lines)
+  - `src/AirGap/__Libraries/StellaOps.AirGap.Sync/Services/HlcMergeService.cs` (169 lines)
+  - `src/AirGap/__Libraries/StellaOps.AirGap.Sync/Telemetry/AirGapSyncMetrics.cs` (161 lines)
+  - `src/AirGap/__Libraries/StellaOps.AirGap.Sync/AirGapSyncServiceCollectionExtensions.cs` (153 lines)
+  - `src/AirGap/__Libraries/StellaOps.AirGap.Sync/Transport/IJobSyncTransport.cs` (123 lines)
+  - `src/AirGap/__Libraries/StellaOps.AirGap.Sync/Services/ConflictResolver.cs` (114 lines)
+- Service locator matches:
+  - `src/AirGap/__Libraries/StellaOps.AirGap.Sync/AirGapSyncServiceCollectionExtensions.cs`:44 var timeProvider = sp.GetService<TimeProvider>() ?? TimeProvider.System;
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+- Replace service locator usage with constructor injection.
+
+## Testing Fullness Findings
+- Status: PASS
+- Expected layers: Unit
+- Detected test projects: src/AirGap/__Tests/StellaOps.AirGap.Sync.Tests/StellaOps.AirGap.Sync.Tests.csproj [Unit]
+- Missing layers: none
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- None.

docs/implplan-blocked/audits/csproj-standards/Aoc/__Analyzers/StellaOps.Aoc.Analyzers/StellaOps.Aoc.Analyzers.md

@@ -0,0 +1,40 @@
+# Audit - StellaOps.Aoc.Analyzers
+
+## Project
+- Path: `src/Aoc/__Analyzers/StellaOps.Aoc.Analyzers/StellaOps.Aoc.Analyzers.csproj`
+- Module: `Aoc`
+- Kind: `Analyzer`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `netstandard2.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 1
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/Aoc/__Analyzers/StellaOps.Aoc.Analyzers/AocForbiddenFieldAnalyzer.cs` (631 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: PASS
+- Expected layers: Unit
+- Detected test projects: src/Aoc/__Tests/StellaOps.Aoc.Analyzers.Tests/StellaOps.Aoc.Analyzers.Tests.csproj [Unit]
+- Missing layers: none
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- None.

docs/implplan-blocked/audits/csproj-standards/Aoc/__Libraries/StellaOps.Aoc.AspNetCore/StellaOps.Aoc.AspNetCore.md

@@ -0,0 +1,44 @@
+# Audit - StellaOps.Aoc.AspNetCore
+
+## Project
+- Path: `src/Aoc/__Libraries/StellaOps.Aoc.AspNetCore/StellaOps.Aoc.AspNetCore.csproj`
+- Module: `Aoc`
+- Kind: `Library`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 1
+- Service locator usage (BuildServiceProvider/GetService): 4
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/Aoc/__Libraries/StellaOps.Aoc.AspNetCore/Routing/AocGuardEndpointFilter.cs` (142 lines)
+- Service locator matches:
+  - `src/Aoc/__Libraries/StellaOps.Aoc.AspNetCore/Routing/AocGuardEndpointFilter.cs`:41 var logger = context.HttpContext.RequestServices.GetService<ILogger<AocGuardEndpointFilter<TRequest>>>();
+  - `src/Aoc/__Libraries/StellaOps.Aoc.AspNetCore/Routing/AocGuardEndpointFilter.cs`:56 var logger = context.HttpContext.RequestServices.GetService<ILogger<AocGuardEndpointFilter<TRequest>>>();
+  - `src/Aoc/__Libraries/StellaOps.Aoc.AspNetCore/Routing/AocGuardEndpointFilter.cs`:84 var logger = context.HttpContext.RequestServices.GetService<ILogger<AocGuardEndpointFilter<TRequest>>>();
+  - `src/Aoc/__Libraries/StellaOps.Aoc.AspNetCore/Routing/AocGuardEndpointFilter.cs`:103 var options = services.GetService<IOptions<AocGuardOptions>>();
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+- Replace service locator usage with constructor injection.
+
+## Testing Fullness Findings
+- Status: PASS
+- Expected layers: Unit
+- Detected test projects: src/Aoc/__Tests/StellaOps.Aoc.AspNetCore.Tests/StellaOps.Aoc.AspNetCore.Tests.csproj [Unit]
+- Missing layers: none
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- None.

docs/implplan-blocked/audits/csproj-standards/Aoc/__Libraries/StellaOps.Aoc/StellaOps.Aoc.md

@@ -0,0 +1,40 @@
+# Audit - StellaOps.Aoc
+
+## Project
+- Path: `src/Aoc/__Libraries/StellaOps.Aoc/StellaOps.Aoc.csproj`
+- Module: `Aoc`
+- Kind: `Library`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 1
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/Aoc/__Libraries/StellaOps.Aoc/AocWriteGuard.cs` (193 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: PASS
+- Expected layers: Unit
+- Detected test projects: src/Aoc/__Tests/StellaOps.Aoc.Tests/StellaOps.Aoc.Tests.csproj [Unit], src/Aoc/__Tests/StellaOps.Aoc.AspNetCore.Tests/StellaOps.Aoc.AspNetCore.Tests.csproj [Unit], src/Aoc/__Tests/StellaOps.Aoc.Analyzers.Tests/StellaOps.Aoc.Analyzers.Tests.csproj [Unit]
+- Missing layers: none
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- None.

docs/implplan-blocked/audits/csproj-standards/Attestor/StellaOps.Attestation/StellaOps.Attestation.md

@@ -0,0 +1,42 @@
+# Audit - StellaOps.Attestation
+
+## Project
+- Path: `src/Attestor/StellaOps.Attestation/StellaOps.Attestation.csproj`
+- Module: `Attestor`
+- Kind: `Service`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 2
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/Attestor/StellaOps.Attestation/DsseVerifier.cs` (301 lines)
+  - `src/Attestor/StellaOps.Attestation/IDsseVerifier.cs` (151 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: PASS
+- Expected layers: Unit
+- Detected test projects: src/Attestor/StellaOps.Attestation.Tests/StellaOps.Attestation.Tests.csproj [Unit]
+- Missing layers: none
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Intent tagging required for regulatory modules.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- None.

docs/implplan-blocked/audits/csproj-standards/Attestor/StellaOps.Attestor.Envelope/StellaOps.Attestor.Envelope.md

@@ -0,0 +1,44 @@
+# Audit - StellaOps.Attestor.Envelope
+
+## Project
+- Path: `src/Attestor/StellaOps.Attestor.Envelope/StellaOps.Attestor.Envelope.csproj`
+- Module: `Attestor`
+- Kind: `Service`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 4
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/Attestor/StellaOps.Attestor.Envelope/DsseEnvelopeSerializer.cs` (317 lines)
+  - `src/Attestor/StellaOps.Attestor.Envelope/EnvelopeKey.cs` (301 lines)
+  - `src/Attestor/StellaOps.Attestor.Envelope/EnvelopeSignatureService.cs` (190 lines)
+  - `src/Attestor/StellaOps.Attestor.Envelope/__Tests/StellaOps.Attestor.Envelope.Tests/DsseEnvelopeSerializerTests.cs` (159 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: PASS
+- Expected layers: Unit
+- Detected test projects: src/Attestor/StellaOps.Attestor.Envelope/__Tests/StellaOps.Attestor.Envelope.Tests/StellaOps.Attestor.Envelope.Tests.csproj [Unit]
+- Missing layers: none
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Intent tagging required for regulatory modules.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- None.

docs/implplan-blocked/audits/csproj-standards/Attestor/StellaOps.Attestor.TileProxy/StellaOps.Attestor.TileProxy.md

@@ -0,0 +1,49 @@
+# Audit - StellaOps.Attestor.TileProxy
+
+## Project
+- Path: `src/Attestor/StellaOps.Attestor.TileProxy/StellaOps.Attestor.TileProxy.csproj`
+- Module: `Attestor`
+- Kind: `WebService`
+- SDK: `Microsoft.NET.Sdk.Web`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 6
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/Attestor/StellaOps.Attestor.TileProxy/Services/ContentAddressedTileStore.cs` (433 lines)
+  - `src/Attestor/StellaOps.Attestor.TileProxy/Services/TileProxyService.cs` (409 lines)
+  - `src/Attestor/StellaOps.Attestor.TileProxy/Endpoints/TileEndpoints.cs` (286 lines)
+  - `src/Attestor/StellaOps.Attestor.TileProxy/Jobs/TileSyncJob.cs` (278 lines)
+  - `src/Attestor/StellaOps.Attestor.TileProxy/TileProxyOptions.cs` (198 lines)
+  - `src/Attestor/StellaOps.Attestor.TileProxy/Program.cs` (137 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: FAIL
+- Expected layers: Unit, Integration, Security, Offline
+- Detected test projects: none
+- Missing layers: Unit, Integration, Security, Offline
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Intent tagging required for regulatory modules.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- Add a unit test project named `<Project>.Tests` (or document exception).
+- Add integration tests for cross-component flows.
+- Add security tests for authn/authz or input validation.
+- Add offline/airgap coverage with fixtures only.

docs/implplan-blocked/audits/csproj-standards/Attestor/StellaOps.Attestor.Types/Tools/StellaOps.Attestor.Types.Generator/StellaOps.Attestor.Types.Generator.md

@@ -0,0 +1,43 @@
+# Audit - StellaOps.Attestor.Types.Generator
+
+## Project
+- Path: `src/Attestor/StellaOps.Attestor.Types/Tools/StellaOps.Attestor.Types.Generator/StellaOps.Attestor.Types.Generator.csproj`
+- Module: `Attestor`
+- Kind: `Tool`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 1
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/Attestor/StellaOps.Attestor.Types/Tools/StellaOps.Attestor.Types.Generator/Program.cs` (1730 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: FAIL
+- Expected layers: Unit, CLI, Offline
+- Detected test projects: none
+- Missing layers: Unit, CLI, Offline
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Intent tagging required for regulatory modules.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- Add a unit test project named `<Project>.Tests` (or document exception).
+- Add offline/airgap coverage with fixtures only.
+- Add CLI tests for exit codes and golden output.

docs/implplan-blocked/audits/csproj-standards/Attestor/StellaOps.Attestor.Verify/StellaOps.Attestor.Verify.md

@@ -0,0 +1,42 @@
+# Audit - StellaOps.Attestor.Verify
+
+## Project
+- Path: `src/Attestor/StellaOps.Attestor.Verify/StellaOps.Attestor.Verify.csproj`
+- Module: `Attestor`
+- Kind: `Service`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 2
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/Attestor/StellaOps.Attestor.Verify/AttestorVerificationEngine.cs` (1014 lines)
+  - `src/Attestor/StellaOps.Attestor.Verify/Providers/DistributedVerificationProvider.cs` (439 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: PASS
+- Expected layers: Unit
+- Detected test projects: src/Attestor/__Tests/StellaOps.Attestor.Verify.Tests/StellaOps.Attestor.Verify.Tests.csproj [Unit]
+- Missing layers: none
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Intent tagging required for regulatory modules.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- None.

docs/implplan-blocked/audits/csproj-standards/Attestor/StellaOps.Attestor/StellaOps.Attestor.Core/StellaOps.Attestor.Core.md

@@ -0,0 +1,103 @@
+# Audit - StellaOps.Attestor.Core
+
+## Project
+- Path: `src/Attestor/StellaOps.Attestor/StellaOps.Attestor.Core/StellaOps.Attestor.Core.csproj`
+- Module: `Attestor`
+- Kind: `Service`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 63
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/Attestor/StellaOps.Attestor/StellaOps.Attestor.Core/Verification/CheckpointSignatureVerifier.cs` (566 lines)
+  - `src/Attestor/StellaOps.Attestor/StellaOps.Attestor.Core/Chain/AttestationLinkResolver.cs` (564 lines)
+  - `src/Attestor/StellaOps.Attestor/StellaOps.Attestor.Core/Verification/RekorVerificationService.cs` (486 lines)
+  - `src/Attestor/StellaOps.Attestor/StellaOps.Attestor.Core/Rekor/CheckpointDivergenceDetector.cs` (470 lines)
+  - `src/Attestor/StellaOps.Attestor/StellaOps.Attestor.Core/Layers/LayerAttestationService.cs` (445 lines)
+  - `src/Attestor/StellaOps.Attestor/StellaOps.Attestor.Core/Options/AttestorOptions.cs` (430 lines)
+  - `src/Attestor/StellaOps.Attestor/StellaOps.Attestor.Core/Rekor/RekorReceipt.cs` (429 lines)
+  - `src/Attestor/StellaOps.Attestor/StellaOps.Attestor.Core/Transparency/TransparencyStatus.cs` (425 lines)
+  - `src/Attestor/StellaOps.Attestor/StellaOps.Attestor.Core/Verification/IRekorVerificationService.cs` (416 lines)
+  - `src/Attestor/StellaOps.Attestor/StellaOps.Attestor.Core/InToto/Layout/LayoutVerifier.cs` (408 lines)
+  - `src/Attestor/StellaOps.Attestor/StellaOps.Attestor.Core/Verification/RekorVerificationJob.cs` (381 lines)
+  - `src/Attestor/StellaOps.Attestor/StellaOps.Attestor.Core/Rekor/ICheckpointDivergenceDetector.cs` (374 lines)
+  - `src/Attestor/StellaOps.Attestor/StellaOps.Attestor.Core/Verification/RekorVerificationHealthCheck.cs` (368 lines)
+  - `src/Attestor/StellaOps.Attestor/StellaOps.Attestor.Core/Resilience/CircuitBreaker.cs` (367 lines)
+  - `src/Attestor/StellaOps.Attestor/StellaOps.Attestor.Core/Rekor/RekorSyncBackgroundService.cs` (362 lines)
+  - `src/Attestor/StellaOps.Attestor/StellaOps.Attestor.Core/Rekor/FileSystemRekorTileCache.cs` (352 lines)
+  - `src/Attestor/StellaOps.Attestor/StellaOps.Attestor.Core/Transparency/TransparencyStatusProvider.cs` (347 lines)
+  - `src/Attestor/StellaOps.Attestor/StellaOps.Attestor.Core/Chain/AttestationChainBuilder.cs` (345 lines)
+  - `src/Attestor/StellaOps.Attestor/StellaOps.Attestor.Core/Chain/AttestationChainValidator.cs` (334 lines)
+  - `src/Attestor/StellaOps.Attestor/StellaOps.Attestor.Core/Rekor/RekorEntryEvent.cs` (333 lines)
+  - `src/Attestor/StellaOps.Attestor/StellaOps.Attestor.Core/Delta/DeltaAttestationService.cs` (322 lines)
+  - `src/Attestor/StellaOps.Attestor/StellaOps.Attestor.Core/InToto/LinkRecorder.cs` (300 lines)
+  - `src/Attestor/StellaOps.Attestor/StellaOps.Attestor.Core/Rekor/CheckpointDivergenceAlertPublisher.cs` (293 lines)
+  - `src/Attestor/StellaOps.Attestor/StellaOps.Attestor.Core/InToto/LinkBuilder.cs` (293 lines)
+  - `src/Attestor/StellaOps.Attestor/StellaOps.Attestor.Core/Signing/DsseSigningService.cs` (290 lines)
+  - `src/Attestor/StellaOps.Attestor/StellaOps.Attestor.Core/Layers/LayerAttestation.cs` (283 lines)
+  - `src/Attestor/StellaOps.Attestor/StellaOps.Attestor.Core/InToto/Layout/ILayoutVerifier.cs` (269 lines)
+  - `src/Attestor/StellaOps.Attestor/StellaOps.Attestor.Core/InToto/Layout/InTotoLayout.cs` (266 lines)
+  - `src/Attestor/StellaOps.Attestor/StellaOps.Attestor.Core/PoEArtifactGenerator.cs` (244 lines)
+  - `src/Attestor/StellaOps.Attestor/StellaOps.Attestor.Core/Chain/AttestationChain.cs` (243 lines)
+  - `src/Attestor/StellaOps.Attestor/StellaOps.Attestor.Core/InToto/InTotoLinkPredicate.cs` (242 lines)
+  - `src/Attestor/StellaOps.Attestor/StellaOps.Attestor.Core/PoEModels.cs` (239 lines)
+  - `src/Attestor/StellaOps.Attestor/StellaOps.Attestor.Core/Submission/AttestorSubmissionValidator.cs` (233 lines)
+  - `src/Attestor/StellaOps.Attestor/StellaOps.Attestor.Core/Verification/TimeSkewValidator.cs` (224 lines)
+  - `src/Attestor/StellaOps.Attestor/StellaOps.Attestor.Core/Serialization/CanonicalJsonSerializer.cs` (217 lines)
+  - `src/Attestor/StellaOps.Attestor/StellaOps.Attestor.Core/Verification/RekorOfflineReceiptVerifier.cs` (217 lines)
+  - `src/Attestor/StellaOps.Attestor/StellaOps.Attestor.Core/Verification/RekorVerificationMetrics.cs` (210 lines)
+  - `src/Attestor/StellaOps.Attestor/StellaOps.Attestor.Core/Rekor/IRekorTileClient.cs` (208 lines)
+  - `src/Attestor/StellaOps.Attestor/StellaOps.Attestor.Core/Options/RekorVerificationOptions.cs` (199 lines)
+  - `src/Attestor/StellaOps.Attestor/StellaOps.Attestor.Core/Chain/IAttestationLinkResolver.cs` (194 lines)
+  - `src/Attestor/StellaOps.Attestor/StellaOps.Attestor.Core/Chain/InTotoStatementMaterials.cs` (193 lines)
+  - `src/Attestor/StellaOps.Attestor/StellaOps.Attestor.Core/Validation/PredicateSchemaValidator.cs` (191 lines)
+  - `src/Attestor/StellaOps.Attestor/StellaOps.Attestor.Core/IProofEmitter.cs` (187 lines)
+  - `src/Attestor/StellaOps.Attestor/StellaOps.Attestor.Core/Verification/VerificationReport.cs` (185 lines)
+  - `src/Attestor/StellaOps.Attestor/StellaOps.Attestor.Core/Delta/IDeltaAttestationService.cs` (184 lines)
+  - `src/Attestor/StellaOps.Attestor/StellaOps.Attestor.Core/Signing/FileKeyProvider.cs` (182 lines)
+  - `src/Attestor/StellaOps.Attestor/StellaOps.Attestor.Core/Observability/AttestorMetrics.cs` (180 lines)
+  - `src/Attestor/StellaOps.Attestor/StellaOps.Attestor.Core/Rekor/IRekorTileCache.cs` (173 lines)
+  - `src/Attestor/StellaOps.Attestor/StellaOps.Attestor.Core/Configuration/RekorVerificationOptions.cs` (171 lines)
+  - `src/Attestor/StellaOps.Attestor/StellaOps.Attestor.Core/InToto/InTotoLink.cs` (169 lines)
+  - `src/Attestor/StellaOps.Attestor/StellaOps.Attestor.Core/Chain/InMemoryAttestationLinkStore.cs` (169 lines)
+  - `src/Attestor/StellaOps.Attestor/StellaOps.Attestor.Core/InToto/ArtifactDigests.cs` (163 lines)
+  - `src/Attestor/StellaOps.Attestor/StellaOps.Attestor.Core/Verification/MerkleProofVerifier.cs` (159 lines)
+  - `src/Attestor/StellaOps.Attestor/StellaOps.Attestor.Core/InToto/IInTotoLinkSigningService.cs` (158 lines)
+  - `src/Attestor/StellaOps.Attestor/StellaOps.Attestor.Core/Chain/AttestationLink.cs` (143 lines)
+  - `src/Attestor/StellaOps.Attestor/StellaOps.Attestor.Core/Storage/AttestorEntry.cs` (142 lines)
+  - `src/Attestor/StellaOps.Attestor/StellaOps.Attestor.Core/Rekor/IRekorCheckpointStore.cs` (133 lines)
+  - `src/Attestor/StellaOps.Attestor/StellaOps.Attestor.Core/Layers/ILayerAttestationService.cs` (128 lines)
+  - `src/Attestor/StellaOps.Attestor/StellaOps.Attestor.Core/InToto/MaterialSpec.cs` (128 lines)
+  - `src/Attestor/StellaOps.Attestor/StellaOps.Attestor.Core/Submission/AttestorSubmissionResult.cs` (116 lines)
+  - `src/Attestor/StellaOps.Attestor/StellaOps.Attestor.Core/Queue/IRekorSubmissionQueue.cs` (114 lines)
+  - `src/Attestor/StellaOps.Attestor/StellaOps.Attestor.Core/Chain/InMemoryAttestationNodeProvider.cs` (105 lines)
+  - `src/Attestor/StellaOps.Attestor/StellaOps.Attestor.Core/Verification/InstrumentedTimeSkewValidator.cs` (102 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: PASS
+- Expected layers: Unit
+- Detected test projects: src/Attestor/StellaOps.Attestor/StellaOps.Attestor.Core.Tests/StellaOps.Attestor.Core.Tests.csproj [Unit]
+- Missing layers: none
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Intent tagging required for regulatory modules.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- None.

docs/implplan-blocked/audits/csproj-standards/Attestor/StellaOps.Attestor/StellaOps.Attestor.Infrastructure/StellaOps.Attestor.Infrastructure.md

@@ -0,0 +1,61 @@
+# Audit - StellaOps.Attestor.Infrastructure
+
+## Project
+- Path: `src/Attestor/StellaOps.Attestor/StellaOps.Attestor.Infrastructure/StellaOps.Attestor.Infrastructure.csproj`
+- Module: `Attestor`
+- Kind: `Service`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 21
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/Attestor/StellaOps.Attestor/StellaOps.Attestor.Infrastructure/Submission/AttestorSubmissionService.cs` (786 lines)
+  - `src/Attestor/StellaOps.Attestor/StellaOps.Attestor.Infrastructure/Queue/PostgresRekorSubmissionQueue.cs` (538 lines)
+  - `src/Attestor/StellaOps.Attestor/StellaOps.Attestor.Infrastructure/Rekor/HttpRekorTileClient.cs` (469 lines)
+  - `src/Attestor/StellaOps.Attestor/StellaOps.Attestor.Infrastructure/Watchlist/PostgresWatchlistRepository.cs` (414 lines)
+  - `src/Attestor/StellaOps.Attestor/StellaOps.Attestor.Infrastructure/Signing/AttestorSigningKeyRegistry.cs` (404 lines)
+  - `src/Attestor/StellaOps.Attestor/StellaOps.Attestor.Infrastructure/Rekor/HttpRekorClient.cs` (388 lines)
+  - `src/Attestor/StellaOps.Attestor/StellaOps.Attestor.Infrastructure/Verification/AttestorVerificationService.cs` (381 lines)
+  - `src/Attestor/StellaOps.Attestor/StellaOps.Attestor.Infrastructure/Rekor/ResilientRekorClient.cs` (362 lines)
+  - `src/Attestor/StellaOps.Attestor/StellaOps.Attestor.Infrastructure/Rekor/ServiceMapAwareRekorBackendResolver.cs` (285 lines)
+  - `src/Attestor/StellaOps.Attestor/StellaOps.Attestor.Infrastructure/Offline/AttestorBundleService.cs` (269 lines)
+  - `src/Attestor/StellaOps.Attestor/StellaOps.Attestor.Infrastructure/Signing/AttestorSigningService.cs` (260 lines)
+  - `src/Attestor/StellaOps.Attestor/StellaOps.Attestor.Infrastructure/Workers/RekorRetryWorker.cs` (256 lines)
+  - `src/Attestor/StellaOps.Attestor/StellaOps.Attestor.Infrastructure/Bulk/BulkVerificationWorker.cs` (240 lines)
+  - `src/Attestor/StellaOps.Attestor/StellaOps.Attestor.Infrastructure/Transparency/HttpTransparencyWitnessClient.cs` (223 lines)
+  - `src/Attestor/StellaOps.Attestor/StellaOps.Attestor.Infrastructure/ServiceCollectionExtensions.cs` (208 lines)
+  - `src/Attestor/StellaOps.Attestor/StellaOps.Attestor.Infrastructure/Storage/S3AttestorArchiveStore.cs` (183 lines)
+  - `src/Attestor/StellaOps.Attestor/StellaOps.Attestor.Infrastructure/InToto/InTotoLinkSigningService.cs` (175 lines)
+  - `src/Attestor/StellaOps.Attestor/StellaOps.Attestor.Infrastructure/Storage/InMemoryAttestorEntryRepository.cs` (170 lines)
+  - `src/Attestor/StellaOps.Attestor/StellaOps.Attestor.Infrastructure/Verification/InMemoryAttestorVerificationCache.cs` (115 lines)
+  - `src/Attestor/StellaOps.Attestor/StellaOps.Attestor.Infrastructure/Rekor/StubRekorClient.cs` (110 lines)
+  - `src/Attestor/StellaOps.Attestor/StellaOps.Attestor.Infrastructure/Verification/MessagingAttestorVerificationCache.cs` (107 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: PASS
+- Expected layers: Unit
+- Detected test projects: src/Attestor/__Tests/StellaOps.Attestor.Infrastructure.Tests/StellaOps.Attestor.Infrastructure.Tests.csproj [Unit]
+- Missing layers: none
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Intent tagging required for regulatory modules.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- None.

docs/implplan-blocked/audits/csproj-standards/Attestor/StellaOps.Attestor/StellaOps.Attestor.WebService/StellaOps.Attestor.WebService.md

@@ -0,0 +1,67 @@
+# Audit - StellaOps.Attestor.WebService
+
+## Project
+- Path: `src/Attestor/StellaOps.Attestor/StellaOps.Attestor.WebService/StellaOps.Attestor.WebService.csproj`
+- Module: `Attestor`
+- Kind: `WebService`
+- SDK: `Microsoft.NET.Sdk.Web`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 23
+- Service locator usage (BuildServiceProvider/GetService): 1
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/Attestor/StellaOps.Attestor/StellaOps.Attestor.WebService/AttestorWebServiceEndpoints.cs` (710 lines)
+  - `src/Attestor/StellaOps.Attestor/StellaOps.Attestor.WebService/Controllers/BundlesController.cs` (483 lines)
+  - `src/Attestor/StellaOps.Attestor/StellaOps.Attestor.WebService/AttestorWebServiceComposition.cs` (483 lines)
+  - `src/Attestor/StellaOps.Attestor/StellaOps.Attestor.WebService/WatchlistEndpoints.cs` (454 lines)
+  - `src/Attestor/StellaOps.Attestor/StellaOps.Attestor.WebService/Controllers/VerdictController.cs` (420 lines)
+  - `src/Attestor/StellaOps.Attestor/StellaOps.Attestor.WebService/Services/ChainQueryService.cs` (362 lines)
+  - `src/Attestor/StellaOps.Attestor/StellaOps.Attestor.WebService/Models/ProofChainModels.cs` (330 lines)
+  - `src/Attestor/StellaOps.Attestor/StellaOps.Attestor.WebService/Services/ProofChainQueryService.cs` (303 lines)
+  - `src/Attestor/StellaOps.Attestor/StellaOps.Attestor.WebService/Contracts/InTotoLinkContracts.cs` (247 lines)
+  - `src/Attestor/StellaOps.Attestor/StellaOps.Attestor.WebService/Controllers/ChainController.cs` (244 lines)
+  - `src/Attestor/StellaOps.Attestor/StellaOps.Attestor.WebService/Services/PredicateTypeRouter.cs` (225 lines)
+  - `src/Attestor/StellaOps.Attestor/StellaOps.Attestor.WebService/Contracts/Spdx3BuildProfileContracts.cs` (221 lines)
+  - `src/Attestor/StellaOps.Attestor/StellaOps.Attestor.WebService/Contracts/BulkVerificationContracts.cs` (217 lines)
+  - `src/Attestor/StellaOps.Attestor/StellaOps.Attestor.WebService/Services/ProofVerificationService.cs` (215 lines)
+  - `src/Attestor/StellaOps.Attestor/StellaOps.Attestor.WebService/Models/ChainApiModels.cs` (205 lines)
+  - `src/Attestor/StellaOps.Attestor/StellaOps.Attestor.WebService/Controllers/ProofChainController.cs` (191 lines)
+  - `src/Attestor/StellaOps.Attestor/StellaOps.Attestor.WebService/Controllers/AnchorsController.cs` (187 lines)
+  - `src/Attestor/StellaOps.Attestor/StellaOps.Attestor.WebService/Contracts/Proofs/ProofDtos.cs` (170 lines)
+  - `src/Attestor/StellaOps.Attestor/StellaOps.Attestor.WebService/Contracts/Anchors/AnchorDtos.cs` (158 lines)
+  - `src/Attestor/StellaOps.Attestor/StellaOps.Attestor.WebService/Contracts/AttestationListContracts.cs` (145 lines)
+  - `src/Attestor/StellaOps.Attestor/StellaOps.Attestor.WebService/Controllers/ProofsController.cs` (140 lines)
+  - `src/Attestor/StellaOps.Attestor/StellaOps.Attestor.WebService/Services/IPredicateTypeRouter.cs` (124 lines)
+  - `src/Attestor/StellaOps.Attestor/StellaOps.Attestor.WebService/Controllers/VerifyController.cs` (103 lines)
+- Service locator matches:
+  - `src/Attestor/StellaOps.Attestor/StellaOps.Attestor.WebService/AttestorWebServiceComposition.cs`:370 var guidProvider = app.Services.GetService<IGuidProvider>() ?? SystemGuidProvider.Instance;
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+- Replace service locator usage with constructor injection.
+
+## Testing Fullness Findings
+- Status: FAIL
+- Expected layers: Unit, Integration, Security, Offline
+- Detected test projects: none
+- Missing layers: Unit, Integration, Security, Offline
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Intent tagging required for regulatory modules.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- Add a unit test project named `<Project>.Tests` (or document exception).
+- Add integration tests for cross-component flows.
+- Add security tests for authn/authz or input validation.
+- Add offline/airgap coverage with fixtures only.

docs/implplan-blocked/audits/csproj-standards/Attestor/__Libraries/StellaOps.Attestor.Bundle/StellaOps.Attestor.Bundle.md

@@ -0,0 +1,47 @@
+# Audit - StellaOps.Attestor.Bundle
+
+## Project
+- Path: `src/Attestor/__Libraries/StellaOps.Attestor.Bundle/StellaOps.Attestor.Bundle.csproj`
+- Module: `Attestor`
+- Kind: `Library`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 7
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/Attestor/__Libraries/StellaOps.Attestor.Bundle/Verification/SigstoreBundleVerifier.cs` (670 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.Bundle/Builder/SigstoreBundleBuilder.cs` (310 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.Bundle/Serialization/SigstoreBundleSerializer.cs` (194 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.Bundle/Verification/BundleVerificationResult.cs` (171 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.Bundle/Models/TransparencyLogEntry.cs` (102 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.Bundle/Models/VerificationMaterial.cs` (101 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.Bundle/Models/SigstoreBundle.cs` (101 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: PASS
+- Expected layers: Unit
+- Detected test projects: src/Attestor/__Tests/StellaOps.Attestor.Bundle.Tests/StellaOps.Attestor.Bundle.Tests.csproj [Unit]
+- Missing layers: none
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Intent tagging required for regulatory modules.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- None.

docs/implplan-blocked/audits/csproj-standards/Attestor/__Libraries/StellaOps.Attestor.Bundling/StellaOps.Attestor.Bundling.md

@@ -0,0 +1,48 @@
+# Audit - StellaOps.Attestor.Bundling
+
+## Project
+- Path: `src/Attestor/__Libraries/StellaOps.Attestor.Bundling/StellaOps.Attestor.Bundling.csproj`
+- Module: `Attestor`
+- Kind: `Library`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 8
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/Attestor/__Libraries/StellaOps.Attestor.Bundling/Services/RetentionPolicyEnforcer.cs` (533 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.Bundling/Services/AttestationBundler.cs` (397 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.Bundling/Configuration/BundlingOptions.cs` (387 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.Bundling/Services/OfflineKitBundleProvider.cs` (363 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.Bundling/Models/AttestationBundle.cs` (361 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.Bundling/Signing/KmsOrgKeySigner.cs` (361 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.Bundling/Abstractions/IAttestationBundler.cs` (157 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.Bundling/Abstractions/IBundleStore.cs` (138 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: PASS
+- Expected layers: Unit
+- Detected test projects: src/Attestor/__Tests/StellaOps.Attestor.Bundling.Tests/StellaOps.Attestor.Bundling.Tests.csproj [Unit]
+- Missing layers: none
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Intent tagging required for regulatory modules.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- None.

docs/implplan-blocked/audits/csproj-standards/Attestor/__Libraries/StellaOps.Attestor.EvidencePack/StellaOps.Attestor.EvidencePack.md

@@ -0,0 +1,45 @@
+# Audit - StellaOps.Attestor.EvidencePack
+
+## Project
+- Path: `src/Attestor/__Libraries/StellaOps.Attestor.EvidencePack/StellaOps.Attestor.EvidencePack.csproj`
+- Module: `Attestor`
+- Kind: `Library`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 5
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/Attestor/__Libraries/StellaOps.Attestor.EvidencePack/ReleaseEvidencePackSerializer.cs` (773 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.EvidencePack/ReleaseEvidencePackBuilder.cs` (414 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.EvidencePack/Models/ReleaseEvidencePackManifest.cs` (346 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.EvidencePack/Services/VerificationReplayLogBuilder.cs` (334 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.EvidencePack/Models/VerificationReplayLog.cs` (236 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: PASS
+- Expected layers: Unit
+- Detected test projects: src/Attestor/__Tests/StellaOps.Attestor.EvidencePack.Tests/StellaOps.Attestor.EvidencePack.Tests.csproj [Unit], src/Attestor/__Tests/StellaOps.Attestor.EvidencePack.IntegrationTests/StellaOps.Attestor.EvidencePack.IntegrationTests.csproj [Integration]
+- Missing layers: none
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Intent tagging required for regulatory modules.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- None.

docs/implplan-blocked/audits/csproj-standards/Attestor/__Libraries/StellaOps.Attestor.FixChain/StellaOps.Attestor.FixChain.md

@@ -0,0 +1,45 @@
+# Audit - StellaOps.Attestor.FixChain
+
+## Project
+- Path: `src/Attestor/__Libraries/StellaOps.Attestor.FixChain/StellaOps.Attestor.FixChain.csproj`
+- Module: `Attestor`
+- Kind: `Library`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 5
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/Attestor/__Libraries/StellaOps.Attestor.FixChain/FixChainAttestationService.cs` (506 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.FixChain/FixChainStatementBuilder.cs` (276 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.FixChain/FixChainValidator.cs` (248 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.FixChain/FixChainPredicate.cs` (145 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.FixChain/FixChainModels.cs` (141 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: PASS
+- Expected layers: Unit
+- Detected test projects: src/Attestor/__Tests/StellaOps.Attestor.FixChain.Tests/StellaOps.Attestor.FixChain.Tests.csproj [Unit], src/Attestor/__Libraries/__Tests/StellaOps.Attestor.FixChain.Tests/StellaOps.Attestor.FixChain.Tests.csproj [Unit]
+- Missing layers: none
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Intent tagging required for regulatory modules.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- None.

docs/implplan-blocked/audits/csproj-standards/Attestor/__Libraries/StellaOps.Attestor.GraphRoot/StellaOps.Attestor.GraphRoot.md

@@ -0,0 +1,44 @@
+# Audit - StellaOps.Attestor.GraphRoot
+
+## Project
+- Path: `src/Attestor/__Libraries/StellaOps.Attestor.GraphRoot/StellaOps.Attestor.GraphRoot.csproj`
+- Module: `Attestor`
+- Kind: `Library`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 3
+- Service locator usage (BuildServiceProvider/GetService): 1
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/Attestor/__Libraries/StellaOps.Attestor.GraphRoot/GraphRootAttestor.cs` (692 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.GraphRoot/Models/GraphRootPredicate.cs` (120 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.GraphRoot/Models/GraphRootResults.cs` (105 lines)
+- Service locator matches:
+  - `src/Attestor/__Libraries/StellaOps.Attestor.GraphRoot/GraphRootServiceCollectionExtensions.cs`:49 var timeProvider = sp.GetService<TimeProvider>();
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+- Replace service locator usage with constructor injection.
+
+## Testing Fullness Findings
+- Status: PASS
+- Expected layers: Unit
+- Detected test projects: src/Attestor/__Tests/StellaOps.Attestor.GraphRoot.Tests/StellaOps.Attestor.GraphRoot.Tests.csproj [Unit], src/Attestor/__Libraries/__Tests/StellaOps.Attestor.GraphRoot.Tests/StellaOps.Attestor.GraphRoot.Tests.csproj [Unit]
+- Missing layers: none
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Intent tagging required for regulatory modules.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- None.

docs/implplan-blocked/audits/csproj-standards/Attestor/__Libraries/StellaOps.Attestor.Oci/StellaOps.Attestor.Oci.md

@@ -0,0 +1,45 @@
+# Audit - StellaOps.Attestor.Oci
+
+## Project
+- Path: `src/Attestor/__Libraries/StellaOps.Attestor.Oci/StellaOps.Attestor.Oci.csproj`
+- Module: `Attestor`
+- Kind: `Library`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 5
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/Attestor/__Libraries/StellaOps.Attestor.Oci/Services/OrasAttestationAttacher.cs` (471 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.Oci/Services/IOciAttestationAttacher.cs` (360 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.Oci/Services/SbomOciPublisher.cs` (305 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.Oci/Services/IOciRegistryClient.cs` (186 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.Oci/Services/ISbomOciPublisher.cs` (166 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: PASS
+- Expected layers: Unit
+- Detected test projects: src/Attestor/__Tests/StellaOps.Attestor.Oci.Tests/StellaOps.Attestor.Oci.Tests.csproj [Unit]
+- Missing layers: none
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Intent tagging required for regulatory modules.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- None.

docs/implplan-blocked/audits/csproj-standards/Attestor/__Libraries/StellaOps.Attestor.Offline/StellaOps.Attestor.Offline.md

@@ -0,0 +1,46 @@
+# Audit - StellaOps.Attestor.Offline
+
+## Project
+- Path: `src/Attestor/__Libraries/StellaOps.Attestor.Offline/StellaOps.Attestor.Offline.csproj`
+- Module: `Attestor`
+- Kind: `Library`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 6
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/Attestor/__Libraries/StellaOps.Attestor.Offline/Services/OfflineVerifier.cs` (1068 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.Offline/Services/FileSystemRootStore.cs` (642 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.Offline/Services/RuleBundleSignatureVerifier.cs` (346 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.Offline/Abstractions/IRuleBundleSignatureVerifier.cs` (168 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.Offline/Abstractions/IOfflineRootStore.cs` (118 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.Offline/Models/OfflineVerificationResult.cs` (112 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: FAIL
+- Expected layers: Unit
+- Detected test projects: src/Attestor/__Tests/StellaOps.Attestor.Offline.Tests/StellaOps.Attestor.Offline.Tests.csproj [Offline]
+- Missing layers: Unit
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Intent tagging required for regulatory modules.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- Add a unit test project named `<Project>.Tests` (or document exception).

docs/implplan-blocked/audits/csproj-standards/Attestor/__Libraries/StellaOps.Attestor.Persistence/StellaOps.Attestor.Persistence.md

@@ -0,0 +1,44 @@
+# Audit - StellaOps.Attestor.Persistence
+
+## Project
+- Path: `src/Attestor/__Libraries/StellaOps.Attestor.Persistence/StellaOps.Attestor.Persistence.csproj`
+- Module: `Attestor`
+- Kind: `Library`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 4
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/Attestor/__Libraries/StellaOps.Attestor.Persistence/Services/TrustAnchorMatcher.cs` (325 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.Persistence/Repositories/PostgresVerdictLedgerRepository.cs` (240 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.Persistence/ProofChainDbContext.cs` (225 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.Persistence/Repositories/IProofChainRepository.cs` (206 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: PASS
+- Expected layers: Unit
+- Detected test projects: src/Attestor/__Tests/StellaOps.Attestor.Persistence.Tests/StellaOps.Attestor.Persistence.Tests.csproj [Unit]
+- Missing layers: none
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Intent tagging required for regulatory modules.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- None.

docs/implplan-blocked/audits/csproj-standards/Attestor/__Libraries/StellaOps.Attestor.ProofChain/StellaOps.Attestor.ProofChain.md

@@ -0,0 +1,92 @@
+# Audit - StellaOps.Attestor.ProofChain
+
+## Project
+- Path: `src/Attestor/__Libraries/StellaOps.Attestor.ProofChain/StellaOps.Attestor.ProofChain.csproj`
+- Module: `Attestor`
+- Kind: `Library`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 52
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/Attestor/__Libraries/StellaOps.Attestor.ProofChain/Verification/VerificationPipeline.cs` (716 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.ProofChain/Generators/BackportProofGenerator.cs` (555 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.ProofChain/Verification/AIArtifactVerificationStep.cs` (442 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.ProofChain/Predicates/AI/AIAuthorityClassifier.cs` (366 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.ProofChain/Json/IJsonSchemaValidator.cs` (360 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.ProofChain/Statements/ReachabilityWitnessStatement.cs` (316 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.ProofChain/Json/Rfc8785JsonCanonicalizer.cs` (315 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.ProofChain/Generators/VexProofIntegrator.cs` (297 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.ProofChain/Graph/InMemoryProofGraphService.cs` (291 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.ProofChain/Rekor/EnhancedRekorProof.cs` (288 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.ProofChain/Predicates/VerdictDeltaPredicate.cs` (287 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.ProofChain/Audit/AuditHashLogger.cs` (283 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.ProofChain/Graph/IProofGraphService.cs` (276 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.ProofChain/Predicates/AI/AIRemediationPlanPredicate.cs` (273 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.ProofChain/Linking/ComponentRefExtractor.cs` (265 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.ProofChain/Predicates/BinaryMicroWitnessPredicate.cs` (262 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.ProofChain/Predicates/AI/AIPolicyDraftPredicate.cs` (258 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.ProofChain/Statements/ReachabilityDriftStatement.cs` (257 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.ProofChain/Statements/UncertaintyBudgetStatement.cs` (257 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.ProofChain/Predicates/SbomDeltaPredicate.cs` (239 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.ProofChain/Predicates/ChangeTracePredicate.cs` (238 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.ProofChain/Predicates/ReachabilityDriftPredicate.cs` (221 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.ProofChain/Predicates/VexAttestationPredicate.cs` (217 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.ProofChain/Predicates/BinaryFingerprintEvidencePredicate.cs` (215 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.ProofChain/Merkle/DeterministicMerkleTreeBuilder.cs` (214 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.ProofChain/Generators/BinaryFingerprintEvidenceGenerator.cs` (214 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.ProofChain/ChangeTrace/ChangeTraceAttestationService.cs` (208 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.ProofChain/Predicates/VexDeltaPredicate.cs` (203 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.ProofChain/Statements/VerdictReceiptStatement.cs` (200 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.ProofChain/Assembly/IProofSpineAssembler.cs` (198 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.ProofChain/Verification/IVerificationPipeline.cs` (198 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.ProofChain/Signing/ProofChainSigner.cs` (196 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.ProofChain/Predicates/DeltaVerdictPredicate.cs` (191 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.ProofChain/Predicates/BudgetCheckPredicate.cs` (178 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.ProofChain/Replay/IAIArtifactReplayer.cs` (169 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.ProofChain/Identifiers/ContentAddressedIdGenerator.cs` (169 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.ProofChain/Identifiers/ContentAddressedId.cs` (168 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.ProofChain/Predicates/AI/AIArtifactBasePredicate.cs` (162 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.ProofChain/Statements/UncertaintyStatement.cs` (162 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.ProofChain/Predicates/AI/AIVexDraftPredicate.cs` (155 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.ProofChain/Pipeline/IProofChainPipeline.cs` (150 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.ProofChain/Replay/AIArtifactReplayManifest.cs` (150 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.ProofChain/Receipts/IReceiptGenerator.cs` (140 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.ProofChain/Builders/StatementBuilder.cs` (136 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.ProofChain/Statements/SbomLinkageStatement.cs` (136 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.ProofChain/Services/UnknownsAggregator.cs` (136 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.ProofChain/Predicates/AI/AIExplanationPredicate.cs` (134 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.ProofChain/Signing/IProofChainSigner.cs` (122 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.ProofChain/Builders/IStatementBuilder.cs` (117 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.ProofChain/Predicates/PolicyDecisionPredicate.cs` (117 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.ProofChain/Predicates/UnknownsBudgetPredicate.cs` (108 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.ProofChain/Merkle/IMerkleTreeBuilder.cs` (105 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: PASS
+- Expected layers: Unit
+- Detected test projects: src/Attestor/__Tests/StellaOps.Attestor.ProofChain.Tests/StellaOps.Attestor.ProofChain.Tests.csproj [Unit]
+- Missing layers: none
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Intent tagging required for regulatory modules.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- None.

docs/implplan-blocked/audits/csproj-standards/Attestor/__Libraries/StellaOps.Attestor.Spdx3/StellaOps.Attestor.Spdx3.md

@@ -0,0 +1,45 @@
+# Audit - StellaOps.Attestor.Spdx3
+
+## Project
+- Path: `src/Attestor/__Libraries/StellaOps.Attestor.Spdx3/StellaOps.Attestor.Spdx3.csproj`
+- Module: `Attestor`
+- Kind: `Library`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 5
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/Attestor/__Libraries/StellaOps.Attestor.Spdx3/DsseSpdx3Signer.cs` (476 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.Spdx3/CombinedDocumentBuilder.cs` (282 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.Spdx3/IBuildAttestationMapper.cs` (172 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.Spdx3/BuildRelationshipBuilder.cs` (160 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.Spdx3/BuildAttestationMapper.cs` (147 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: PASS
+- Expected layers: Unit
+- Detected test projects: src/Attestor/__Libraries/__Tests/StellaOps.Attestor.Spdx3.Tests/StellaOps.Attestor.Spdx3.Tests.csproj [Unit]
+- Missing layers: none
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Intent tagging required for regulatory modules.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- None.

docs/implplan-blocked/audits/csproj-standards/Attestor/__Libraries/StellaOps.Attestor.StandardPredicates/StellaOps.Attestor.StandardPredicates.md

@@ -0,0 +1,59 @@
+# Audit - StellaOps.Attestor.StandardPredicates
+
+## Project
+- Path: `src/Attestor/__Libraries/StellaOps.Attestor.StandardPredicates/StellaOps.Attestor.StandardPredicates.csproj`
+- Module: `Attestor`
+- Kind: `Library`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 19
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/Attestor/__Libraries/StellaOps.Attestor.StandardPredicates/Models/SbomDocument.cs` (3783 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.StandardPredicates/Writers/CycloneDxWriter.cs` (3653 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.StandardPredicates/Writers/SpdxWriter.cs` (3521 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.StandardPredicates/VexOverride/VexOverridePredicateParser.cs` (438 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.StandardPredicates/Validation/SlsaSchemaValidator.cs` (435 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.StandardPredicates/Licensing/SpdxLicenseList.cs` (406 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.StandardPredicates/VexOverride/VexOverridePredicateBuilder.cs` (333 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.StandardPredicates/BinaryDiff/BinaryDiffPredicateBuilder.cs` (303 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.StandardPredicates/Parsers/CycloneDxPredicateParser.cs` (300 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.StandardPredicates/Parsers/SlsaProvenancePredicateParser.cs` (267 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.StandardPredicates/Parsers/SpdxPredicateParser.cs` (255 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.StandardPredicates/BinaryDiff/BinaryDiffSchema.cs` (247 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.StandardPredicates/BinaryDiff/BinaryDiffDsseVerifier.cs` (213 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.StandardPredicates/Writers/SpdxTimestampExtension.cs` (207 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.StandardPredicates/VexOverride/VexOverridePredicate.cs` (165 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.StandardPredicates/BinaryDiff/BinaryDiffPredicateSerializer.cs` (159 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.StandardPredicates/BinaryDiff/BinaryDiffModels.cs` (155 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.StandardPredicates/Writers/CycloneDxTimestampExtension.cs` (133 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.StandardPredicates/Canonicalization/SbomCanonicalizer.cs` (124 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: PASS
+- Expected layers: Unit
+- Detected test projects: src/Attestor/__Tests/StellaOps.Attestor.StandardPredicates.Tests/StellaOps.Attestor.StandardPredicates.Tests.csproj [Unit]
+- Missing layers: none
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Intent tagging required for regulatory modules.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- None.

docs/implplan-blocked/audits/csproj-standards/Attestor/__Libraries/StellaOps.Attestor.Timestamping/StellaOps.Attestor.Timestamping.md

@@ -0,0 +1,46 @@
+# Audit - StellaOps.Attestor.Timestamping
+
+## Project
+- Path: `src/Attestor/__Libraries/StellaOps.Attestor.Timestamping/StellaOps.Attestor.Timestamping.csproj`
+- Module: `Attestor`
+- Kind: `Library`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: inherited true
+- Deterministic: inherited true
+- 100-line rule violations: 6
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/Attestor/__Libraries/StellaOps.Attestor.Timestamping/AttestationTimestampService.cs` (308 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.Timestamping/IAttestationTimestampService.cs` (267 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.Timestamping/AttestationTimestampPolicyContext.cs` (235 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.Timestamping/TimeCorrelationValidator.cs` (200 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.Timestamping/ITimeCorrelationValidator.cs` (194 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.Timestamping/TimestampedAttestation.cs` (126 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: FAIL
+- Expected layers: Unit
+- Detected test projects: none
+- Missing layers: Unit
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Intent tagging required for regulatory modules.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- Add a unit test project named `<Project>.Tests` (or document exception).

docs/implplan-blocked/audits/csproj-standards/Attestor/__Libraries/StellaOps.Attestor.TrustRepo/StellaOps.Attestor.TrustRepo.md

@@ -0,0 +1,50 @@
+# Audit - StellaOps.Attestor.TrustRepo
+
+## Project
+- Path: `src/Attestor/__Libraries/StellaOps.Attestor.TrustRepo/StellaOps.Attestor.TrustRepo.csproj`
+- Module: `Attestor`
+- Kind: `Library`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 10
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/Attestor/__Libraries/StellaOps.Attestor.TrustRepo/TufClient.cs` (600 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.TrustRepo/TufMetadataStore.cs` (367 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.TrustRepo/TufMetadataVerifier.cs` (341 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.TrustRepo/SigstoreServiceMapLoader.cs` (329 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.TrustRepo/TufKeyLoader.cs` (319 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.TrustRepo/Models/TufModels.cs` (231 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.TrustRepo/ITufClient.cs` (188 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.TrustRepo/Models/SigstoreServiceMap.cs` (185 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.TrustRepo/TrustRepoServiceCollectionExtensions.cs` (174 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.TrustRepo/TrustRepoOptions.cs` (157 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: PASS
+- Expected layers: Unit
+- Detected test projects: src/Attestor/__Libraries/__Tests/StellaOps.Attestor.TrustRepo.Tests/StellaOps.Attestor.TrustRepo.Tests.csproj [Unit]
+- Missing layers: none
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Intent tagging required for regulatory modules.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- None.

docs/implplan-blocked/audits/csproj-standards/Attestor/__Libraries/StellaOps.Attestor.TrustVerdict/StellaOps.Attestor.TrustVerdict.md

@@ -0,0 +1,48 @@
+# Audit - StellaOps.Attestor.TrustVerdict
+
+## Project
+- Path: `src/Attestor/__Libraries/StellaOps.Attestor.TrustVerdict/StellaOps.Attestor.TrustVerdict.csproj`
+- Module: `Attestor`
+- Kind: `Library`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 8
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/Attestor/__Libraries/StellaOps.Attestor.TrustVerdict/Persistence/TrustVerdictRepository.cs` (627 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.TrustVerdict/Services/TrustVerdictService.cs` (610 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.TrustVerdict/Caching/TrustVerdictCache.cs` (543 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.TrustVerdict/Predicates/TrustVerdictPredicate.cs` (501 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.TrustVerdict/Oci/TrustVerdictOciAttacher.cs` (404 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.TrustVerdict/Evidence/TrustEvidenceMerkleBuilder.cs` (380 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.TrustVerdict/Telemetry/TrustVerdictMetrics.cs` (298 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.TrustVerdict/TrustVerdictServiceCollectionExtensions.cs` (142 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: PASS
+- Expected layers: Unit
+- Detected test projects: src/Attestor/__Libraries/StellaOps.Attestor.TrustVerdict.Tests/StellaOps.Attestor.TrustVerdict.Tests.csproj [Unit]
+- Missing layers: none
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Intent tagging required for regulatory modules.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- None.

docs/implplan-blocked/audits/csproj-standards/Attestor/__Libraries/StellaOps.Attestor.Watchlist/StellaOps.Attestor.Watchlist.md

@@ -0,0 +1,51 @@
+# Audit - StellaOps.Attestor.Watchlist
+
+## Project
+- Path: `src/Attestor/__Libraries/StellaOps.Attestor.Watchlist/StellaOps.Attestor.Watchlist.csproj`
+- Module: `Attestor`
+- Kind: `Library`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 11
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/Attestor/__Libraries/StellaOps.Attestor.Watchlist/Storage/PostgresWatchlistRepository.cs` (397 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.Watchlist/Matching/PatternCompiler.cs` (339 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.Watchlist/Monitoring/IdentityMonitorBackgroundService.cs` (269 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.Watchlist/Models/WatchedIdentity.cs` (258 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.Watchlist/Monitoring/IdentityMonitorService.cs` (235 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.Watchlist/Matching/IdentityMatcher.cs` (217 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.Watchlist/Storage/InMemoryWatchlistRepository.cs` (208 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.Watchlist/Events/IdentityAlertEvent.cs` (203 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.Watchlist/Storage/IWatchlistRepository.cs` (152 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.Watchlist/Models/IdentityMatchResult.cs` (128 lines)
+  - `src/Attestor/__Libraries/StellaOps.Attestor.Watchlist/ServiceCollectionExtensions.cs` (103 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: PASS
+- Expected layers: Unit
+- Detected test projects: src/Attestor/__Tests/StellaOps.Attestor.Watchlist.Tests/StellaOps.Attestor.Watchlist.Tests.csproj [Unit]
+- Missing layers: none
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Intent tagging required for regulatory modules.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- None.

docs/implplan-blocked/audits/csproj-standards/Authority/StellaOps.Authority/StellaOps.Auth.Abstractions/StellaOps.Auth.Abstractions.md

@@ -0,0 +1,46 @@
+# Audit - StellaOps.Auth.Abstractions
+
+## Project
+- Path: `src/Authority/StellaOps.Authority/StellaOps.Auth.Abstractions/StellaOps.Auth.Abstractions.csproj`
+- Module: `Authority`
+- Kind: `Service`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 6
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/Authority/StellaOps.Authority/StellaOps.Auth.Abstractions/StellaOpsScopes.cs` (625 lines)
+  - `src/Authority/StellaOps.Authority/StellaOps.Auth.Abstractions/StellaOpsPrincipalBuilder.cs` (287 lines)
+  - `src/Authority/StellaOps.Authority/StellaOps.Auth.Abstractions/NetworkMask.cs` (181 lines)
+  - `src/Authority/StellaOps.Authority/StellaOps.Auth.Abstractions/StellaOpsClaimTypes.cs` (152 lines)
+  - `src/Authority/StellaOps.Authority/StellaOps.Auth.Abstractions/NetworkMaskMatcher.cs` (139 lines)
+  - `src/Authority/StellaOps.Authority/StellaOps.Auth.Abstractions/StellaOpsProblemResultFactory.cs` (114 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: PASS
+- Expected layers: Unit
+- Detected test projects: src/Authority/StellaOps.Authority/StellaOps.Auth.Abstractions.Tests/StellaOps.Auth.Abstractions.Tests.csproj [Unit]
+- Missing layers: none
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Intent tagging required for regulatory modules.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- None.

docs/implplan-blocked/audits/csproj-standards/Authority/StellaOps.Authority/StellaOps.Auth.Client/StellaOps.Auth.Client.md

@@ -0,0 +1,52 @@
+# Audit - StellaOps.Auth.Client
+
+## Project
+- Path: `src/Authority/StellaOps.Authority/StellaOps.Auth.Client/StellaOps.Auth.Client.csproj`
+- Module: `Authority`
+- Kind: `Service`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 7
+- Service locator usage (BuildServiceProvider/GetService): 5
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/Authority/StellaOps.Authority/StellaOps.Auth.Client/StellaOpsTokenClient.cs` (236 lines)
+  - `src/Authority/StellaOps.Authority/StellaOps.Auth.Client/StellaOpsAuthClientOptions.cs` (205 lines)
+  - `src/Authority/StellaOps.Authority/StellaOps.Auth.Client/StellaOpsBearerTokenHandler.cs` (177 lines)
+  - `src/Authority/StellaOps.Authority/StellaOps.Auth.Client/FileTokenCache.cs` (166 lines)
+  - `src/Authority/StellaOps.Authority/StellaOps.Auth.Client/ServiceCollectionExtensions.cs` (151 lines)
+  - `src/Authority/StellaOps.Authority/StellaOps.Auth.Client/StellaOpsDiscoveryCache.cs` (145 lines)
+  - `src/Authority/StellaOps.Authority/StellaOps.Auth.Client/StellaOpsJwksCache.cs` (119 lines)
+- Service locator matches:
+  - `src/Authority/StellaOps.Authority/StellaOps.Auth.Client/ServiceCollectionExtensions.cs`:67 var logger = provider.GetService<Microsoft.Extensions.Logging.ILogger<FileTokenCache>>();
+  - `src/Authority/StellaOps.Authority/StellaOps.Auth.Client/ServiceCollectionExtensions.cs`:69 var timeProvider = provider.GetService<TimeProvider>();
+  - `src/Authority/StellaOps.Authority/StellaOps.Auth.Client/ServiceCollectionExtensions.cs`:93 provider.GetService<TimeProvider>(),
+  - `src/Authority/StellaOps.Authority/StellaOps.Auth.Client/ServiceCollectionExtensions.cs`:94 provider.GetService<ILogger<StellaOpsBearerTokenHandler>>()));
+  - `src/Authority/StellaOps.Authority/StellaOps.Auth.Client/ServiceCollectionExtensions.cs`:142 var policy = provider.GetService<IEgressPolicy>();
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+- Replace service locator usage with constructor injection.
+
+## Testing Fullness Findings
+- Status: FAIL
+- Expected layers: Unit
+- Detected test projects: src/Authority/StellaOps.Authority/StellaOps.Auth.Client.Tests/StellaOps.Auth.Client.Tests.csproj [CLI]
+- Missing layers: Unit
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Intent tagging required for regulatory modules.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- Add a unit test project named `<Project>.Tests` (or document exception).

docs/implplan-blocked/audits/csproj-standards/Authority/StellaOps.Authority/StellaOps.Auth.ServerIntegration/StellaOps.Auth.ServerIntegration.md

@@ -0,0 +1,44 @@
+# Audit - StellaOps.Auth.ServerIntegration
+
+## Project
+- Path: `src/Authority/StellaOps.Authority/StellaOps.Auth.ServerIntegration/StellaOps.Auth.ServerIntegration.csproj`
+- Module: `Authority`
+- Kind: `Service`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 4
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/Authority/StellaOps.Authority/StellaOps.Auth.ServerIntegration/StellaOpsScopeAuthorizationHandler.cs` (1083 lines)
+  - `src/Authority/StellaOps.Authority/StellaOps.Auth.ServerIntegration/StellaOpsAuthorityConfigurationManager.cs` (209 lines)
+  - `src/Authority/StellaOps.Authority/StellaOps.Auth.ServerIntegration/StellaOpsResourceServerOptions.cs` (193 lines)
+  - `src/Authority/StellaOps.Authority/StellaOps.Auth.ServerIntegration/StellaOpsResourceServerPolicies.cs` (120 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: PASS
+- Expected layers: Unit
+- Detected test projects: src/Authority/StellaOps.Authority/StellaOps.Auth.ServerIntegration.Tests/StellaOps.Auth.ServerIntegration.Tests.csproj [Unit]
+- Missing layers: none
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Intent tagging required for regulatory modules.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- None.

docs/implplan-blocked/audits/csproj-standards/Authority/StellaOps.Authority/StellaOps.Authority.Plugin.Ldap/StellaOps.Authority.Plugin.Ldap.md

@@ -0,0 +1,52 @@
+# Audit - StellaOps.Authority.Plugin.Ldap
+
+## Project
+- Path: `src/Authority/StellaOps.Authority/StellaOps.Authority.Plugin.Ldap/StellaOps.Authority.Plugin.Ldap.csproj`
+- Module: `Authority`
+- Kind: `Plugin`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 9
+- Service locator usage (BuildServiceProvider/GetService): 1
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/Authority/StellaOps.Authority/StellaOps.Authority.Plugin.Ldap/LdapPluginOptions.cs` (783 lines)
+  - `src/Authority/StellaOps.Authority/StellaOps.Authority.Plugin.Ldap/Credentials/LdapCredentialStore.cs` (667 lines)
+  - `src/Authority/StellaOps.Authority/StellaOps.Authority.Plugin.Ldap/ClientProvisioning/LdapClientProvisioningStore.cs` (438 lines)
+  - `src/Authority/StellaOps.Authority/StellaOps.Authority.Plugin.Ldap/Connections/DirectoryServicesLdapConnectionFactory.cs` (397 lines)
+  - `src/Authority/StellaOps.Authority/StellaOps.Authority.Plugin.Ldap/Claims/LdapClaimsEnricher.cs` (248 lines)
+  - `src/Authority/StellaOps.Authority/StellaOps.Authority.Plugin.Ldap/LdapIdentityProviderPlugin.cs` (239 lines)
+  - `src/Authority/StellaOps.Authority/StellaOps.Authority.Plugin.Ldap/ClientProvisioning/LdapCapabilityProbe.cs` (161 lines)
+  - `src/Authority/StellaOps.Authority/StellaOps.Authority.Plugin.Ldap/ClientProvisioning/LdapDistinguishedNameHelper.cs` (113 lines)
+  - `src/Authority/StellaOps.Authority/StellaOps.Authority.Plugin.Ldap/LdapPluginRegistrar.cs` (109 lines)
+- Service locator matches:
+  - `src/Authority/StellaOps.Authority/StellaOps.Authority.Plugin.Ldap/LdapPluginRegistrar.cs`:108 => services.GetService<TimeProvider>() ?? TimeProvider.System;
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+- Replace service locator usage with constructor injection.
+
+## Testing Fullness Findings
+- Status: FAIL
+- Expected layers: Unit, Integration, Security, Offline
+- Detected test projects: src/Authority/StellaOps.Authority/StellaOps.Authority.Plugin.Ldap.Tests/StellaOps.Authority.Plugin.Ldap.Tests.csproj [Unit]
+- Missing layers: Integration, Security, Offline
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Intent tagging required for regulatory modules.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- Add integration tests for cross-component flows.
+- Add security tests for authn/authz or input validation.
+- Add offline/airgap coverage with fixtures only.

docs/implplan-blocked/audits/csproj-standards/Authority/StellaOps.Authority/StellaOps.Authority.Plugin.Oidc/StellaOps.Authority.Plugin.Oidc.md

@@ -0,0 +1,45 @@
+# Audit - StellaOps.Authority.Plugin.Oidc
+
+## Project
+- Path: `src/Authority/StellaOps.Authority/StellaOps.Authority.Plugin.Oidc/StellaOps.Authority.Plugin.Oidc.csproj`
+- Module: `Authority`
+- Kind: `Plugin`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 3
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/Authority/StellaOps.Authority/StellaOps.Authority.Plugin.Oidc/Credentials/OidcCredentialStore.cs` (302 lines)
+  - `src/Authority/StellaOps.Authority/StellaOps.Authority.Plugin.Oidc/OidcPluginOptions.cs` (265 lines)
+  - `src/Authority/StellaOps.Authority/StellaOps.Authority.Plugin.Oidc/OidcIdentityProviderPlugin.cs` (131 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: FAIL
+- Expected layers: Unit, Integration, Security, Offline
+- Detected test projects: src/Authority/StellaOps.Authority/StellaOps.Authority.Plugin.Oidc.Tests/StellaOps.Authority.Plugin.Oidc.Tests.csproj [Unit]
+- Missing layers: Integration, Security, Offline
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Intent tagging required for regulatory modules.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- Add integration tests for cross-component flows.
+- Add security tests for authn/authz or input validation.
+- Add offline/airgap coverage with fixtures only.

docs/implplan-blocked/audits/csproj-standards/Authority/StellaOps.Authority/StellaOps.Authority.Plugin.Saml/StellaOps.Authority.Plugin.Saml.md

@@ -0,0 +1,45 @@
+# Audit - StellaOps.Authority.Plugin.Saml
+
+## Project
+- Path: `src/Authority/StellaOps.Authority/StellaOps.Authority.Plugin.Saml/StellaOps.Authority.Plugin.Saml.csproj`
+- Module: `Authority`
+- Kind: `Plugin`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 3
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/Authority/StellaOps.Authority/StellaOps.Authority.Plugin.Saml/Credentials/SamlCredentialStore.cs` (466 lines)
+  - `src/Authority/StellaOps.Authority/StellaOps.Authority.Plugin.Saml/SamlPluginOptions.cs` (247 lines)
+  - `src/Authority/StellaOps.Authority/StellaOps.Authority.Plugin.Saml/SamlIdentityProviderPlugin.cs` (134 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: FAIL
+- Expected layers: Unit, Integration, Security, Offline
+- Detected test projects: src/Authority/StellaOps.Authority/StellaOps.Authority.Plugin.Saml.Tests/StellaOps.Authority.Plugin.Saml.Tests.csproj [Unit]
+- Missing layers: Integration, Security, Offline
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Intent tagging required for regulatory modules.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- Add integration tests for cross-component flows.
+- Add security tests for authn/authz or input validation.
+- Add offline/airgap coverage with fixtures only.

docs/implplan-blocked/audits/csproj-standards/Authority/StellaOps.Authority/StellaOps.Authority.Plugin.Standard/StellaOps.Authority.Plugin.Standard.md

@@ -0,0 +1,49 @@
+# Audit - StellaOps.Authority.Plugin.Standard
+
+## Project
+- Path: `src/Authority/StellaOps.Authority/StellaOps.Authority.Plugin.Standard/StellaOps.Authority.Plugin.Standard.csproj`
+- Module: `Authority`
+- Kind: `Plugin`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 5
+- Service locator usage (BuildServiceProvider/GetService): 2
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/Authority/StellaOps.Authority/StellaOps.Authority.Plugin.Standard/Storage/StandardUserCredentialStore.cs` (603 lines)
+  - `src/Authority/StellaOps.Authority/StellaOps.Authority.Plugin.Standard/Storage/StandardClientProvisioningStore.cs` (248 lines)
+  - `src/Authority/StellaOps.Authority/StellaOps.Authority.Plugin.Standard/StandardPluginOptions.cs` (191 lines)
+  - `src/Authority/StellaOps.Authority/StellaOps.Authority.Plugin.Standard/Security/StandardCredentialAuditLogger.cs` (178 lines)
+  - `src/Authority/StellaOps.Authority/StellaOps.Authority.Plugin.Standard/StandardPluginRegistrar.cs` (127 lines)
+- Service locator matches:
+  - `src/Authority/StellaOps.Authority/StellaOps.Authority.Plugin.Standard/Bootstrap/StandardPluginBootstrapper.cs`:30 var optionsMonitor = scope.ServiceProvider.GetRequiredService<IOptionsMonitor<StandardPluginOptions>>();
+  - `src/Authority/StellaOps.Authority/StellaOps.Authority.Plugin.Standard/Bootstrap/StandardPluginBootstrapper.cs`:31 var credentialStore = scope.ServiceProvider.GetRequiredService<StandardUserCredentialStore>();
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+- Replace service locator usage with constructor injection.
+
+## Testing Fullness Findings
+- Status: FAIL
+- Expected layers: Unit, Integration, Security, Offline
+- Detected test projects: src/Authority/StellaOps.Authority/StellaOps.Authority.Plugin.Standard.Tests/StellaOps.Authority.Plugin.Standard.Tests.csproj [Unit]
+- Missing layers: Integration, Security, Offline
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Intent tagging required for regulatory modules.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- Add integration tests for cross-component flows.
+- Add security tests for authn/authz or input validation.
+- Add offline/airgap coverage with fixtures only.

docs/implplan-blocked/audits/csproj-standards/Authority/StellaOps.Authority/StellaOps.Authority.Plugin.Unified/StellaOps.Authority.Plugin.Unified.md

@@ -0,0 +1,44 @@
+# Audit - StellaOps.Authority.Plugin.Unified
+
+## Project
+- Path: `src/Authority/StellaOps.Authority/StellaOps.Authority.Plugin.Unified/StellaOps.Authority.Plugin.Unified.csproj`
+- Module: `Authority`
+- Kind: `Plugin`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 1
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/Authority/StellaOps.Authority/StellaOps.Authority.Plugin.Unified/AuthPluginAdapter.cs` (220 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: FAIL
+- Expected layers: Unit, Integration, Security, Offline
+- Detected test projects: none
+- Missing layers: Unit, Integration, Security, Offline
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Intent tagging required for regulatory modules.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- Add a unit test project named `<Project>.Tests` (or document exception).
+- Add integration tests for cross-component flows.
+- Add security tests for authn/authz or input validation.
+- Add offline/airgap coverage with fixtures only.

docs/implplan-blocked/audits/csproj-standards/Authority/StellaOps.Authority/StellaOps.Authority.Plugins.Abstractions/StellaOps.Authority.Plugins.Abstractions.md

@@ -0,0 +1,45 @@
+# Audit - StellaOps.Authority.Plugins.Abstractions
+
+## Project
+- Path: `src/Authority/StellaOps.Authority/StellaOps.Authority.Plugins.Abstractions/StellaOps.Authority.Plugins.Abstractions.csproj`
+- Module: `Authority`
+- Kind: `Plugin`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 3
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/Authority/StellaOps.Authority/StellaOps.Authority.Plugins.Abstractions/IdentityProviderContracts.cs` (900 lines)
+  - `src/Authority/StellaOps.Authority/StellaOps.Authority.Plugins.Abstractions/AuthorityPluginContracts.cs` (227 lines)
+  - `src/Authority/StellaOps.Authority/StellaOps.Authority.Plugins.Abstractions/AuthoritySecretHasher.cs` (128 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: FAIL
+- Expected layers: Unit, Integration, Security, Offline
+- Detected test projects: src/Authority/StellaOps.Authority/StellaOps.Authority.Plugins.Abstractions.Tests/StellaOps.Authority.Plugins.Abstractions.Tests.csproj [Unit]
+- Missing layers: Integration, Security, Offline
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Intent tagging required for regulatory modules.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- Add integration tests for cross-component flows.
+- Add security tests for authn/authz or input validation.
+- Add offline/airgap coverage with fixtures only.

docs/implplan-blocked/audits/csproj-standards/Authority/StellaOps.Authority/StellaOps.Authority/StellaOps.Authority.md

@@ -0,0 +1,111 @@
+# Audit - StellaOps.Authority
+
+## Project
+- Path: `src/Authority/StellaOps.Authority/StellaOps.Authority/StellaOps.Authority.csproj`
+- Module: `Authority`
+- Kind: `WebService`
+- SDK: `Microsoft.NET.Sdk.Web`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 61
+- Service locator usage (BuildServiceProvider/GetService): 8
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/Authority/StellaOps.Authority/StellaOps.Authority/Program.cs` (3204 lines)
+  - `src/Authority/StellaOps.Authority/StellaOps.Authority/OpenIddict/Handlers/ClientCredentialsHandlers.cs` (2192 lines)
+  - `src/Authority/StellaOps.Authority/StellaOps.Authority/OpenIddict/Handlers/PasswordGrantHandlers.cs` (1783 lines)
+  - `src/Authority/StellaOps.Authority/StellaOps.Authority/Console/ConsoleEndpointExtensions.cs` (940 lines)
+  - `src/Authority/StellaOps.Authority/StellaOps.Authority/OpenIddict/Handlers/DpopHandlers.cs` (762 lines)
+  - `src/Authority/StellaOps.Authority/StellaOps.Authority/Console/Admin/ConsoleAdminEndpointExtensions.cs` (746 lines)
+  - `src/Authority/StellaOps.Authority/StellaOps.Authority/OpenIddict/Handlers/TokenValidationHandlers.cs` (675 lines)
+  - `src/Authority/StellaOps.Authority/StellaOps.Authority/Console/ConsoleWorkspaceSampleService.cs` (623 lines)
+  - `src/Authority/StellaOps.Authority/StellaOps.Authority/LocalPolicy/BreakGlassSessionManager.cs` (551 lines)
+  - `src/Authority/StellaOps.Authority/StellaOps.Authority/Storage/Postgres/PostgresTokenStore.cs` (539 lines)
+  - `src/Authority/StellaOps.Authority/StellaOps.Authority/Console/ConsoleWorkspaceModels.cs` (484 lines)
+  - `src/Authority/StellaOps.Authority/StellaOps.Authority/LocalPolicy/FileBasedPolicyStore.cs` (483 lines)
+  - `src/Authority/StellaOps.Authority/StellaOps.Authority/Signing/AuthoritySigningKeyManager.cs` (427 lines)
+  - `src/Authority/StellaOps.Authority/StellaOps.Authority/Notifications/Ack/AuthorityAckTokenKeyManager.cs` (425 lines)
+  - `src/Authority/StellaOps.Authority/StellaOps.Authority/Console/Admin/ConsoleBrandingEndpointExtensions.cs` (401 lines)
+  - `src/Authority/StellaOps.Authority/StellaOps.Authority/LocalPolicy/PolicyStoreFallback.cs` (378 lines)
+  - `src/Authority/StellaOps.Authority/StellaOps.Authority/Plugins/AuthorityPluginLoader.cs` (342 lines)
+  - `src/Authority/StellaOps.Authority/StellaOps.Authority/Airgap/AirgapAuditEndpointExtensions.cs` (321 lines)
+  - `src/Authority/StellaOps.Authority/StellaOps.Authority/LocalPolicy/LocalPolicyModels.cs` (319 lines)
+  - `src/Authority/StellaOps.Authority/StellaOps.Authority/OpenApi/AuthorityOpenApiDocumentProvider.cs` (319 lines)
+  - `src/Authority/StellaOps.Authority/StellaOps.Authority/Security/AuthorityClientCertificateValidator.cs` (319 lines)
+  - `src/Authority/StellaOps.Authority/StellaOps.Authority/RateLimiting/AuthorityRateLimiterMetadataMiddleware.cs` (296 lines)
+  - `src/Authority/StellaOps.Authority/StellaOps.Authority/OpenIddict/Handlers/TokenPersistenceHandlers.cs` (283 lines)
+  - `src/Authority/StellaOps.Authority/StellaOps.Authority/OpenIddict/Handlers/ClientCredentialsAuditHelper.cs` (269 lines)
+  - `src/Authority/StellaOps.Authority/StellaOps.Authority/Airgap/AuthoritySealedModeEvidenceValidator.cs` (269 lines)
+  - `src/Authority/StellaOps.Authority/StellaOps.Authority/LegacyAuthDeprecationMiddleware.cs` (254 lines)
+  - `src/Authority/StellaOps.Authority/StellaOps.Authority/Notifications/Ack/AckTokenPayload.cs` (253 lines)
+  - `src/Authority/StellaOps.Authority/StellaOps.Authority/Audit/AuthorityAuditSink.cs` (237 lines)
+  - `src/Authority/StellaOps.Authority/StellaOps.Authority/Vulnerability/Workflow/VulnWorkflowAntiForgeryTokenIssuer.cs` (234 lines)
+  - `src/Authority/StellaOps.Authority/StellaOps.Authority/Revocation/RevocationBundleBuilder.cs` (220 lines)
+  - `src/Authority/StellaOps.Authority/StellaOps.Authority/Notifications/Ack/AuthorityAckTokenIssuer.cs` (210 lines)
+  - `src/Authority/StellaOps.Authority/StellaOps.Authority/Permalinks/VulnPermalinkService.cs` (193 lines)
+  - `src/Authority/StellaOps.Authority/StellaOps.Authority/Signing/AuthorityJwksService.cs` (183 lines)
+  - `src/Authority/StellaOps.Authority/StellaOps.Authority/OpenIddict/Handlers/RefreshTokenHandlers.cs` (166 lines)
+  - `src/Authority/StellaOps.Authority/StellaOps.Authority/AuthorityIdentityProviderRegistry.cs` (157 lines)
+  - `src/Authority/StellaOps.Authority/StellaOps.Authority/LocalPolicy/ILocalPolicyStore.cs` (156 lines)
+  - `src/Authority/StellaOps.Authority/StellaOps.Authority/AdvisoryAi/AuthorityAdvisoryAiConsentEvaluator.cs` (151 lines)
+  - `src/Authority/StellaOps.Authority/StellaOps.Authority/Storage/Postgres/PostgresAirgapAuditStore.cs` (146 lines)
+  - `src/Authority/StellaOps.Authority/StellaOps.Authority/Airgap/AuthorityAirgapAuditService.cs` (146 lines)
+  - `src/Authority/StellaOps.Authority/StellaOps.Authority/Notifications/Ack/AuthorityAckTokenVerifier.cs` (143 lines)
+  - `src/Authority/StellaOps.Authority/StellaOps.Authority/OpenApi/OpenApiDiscoveryEndpointExtensions.cs` (143 lines)
+  - `src/Authority/StellaOps.Authority/StellaOps.Authority/Vulnerability/Attachments/VulnAttachmentTokenIssuer.cs` (143 lines)
+  - `src/Authority/StellaOps.Authority/StellaOps.Authority/OpenIddict/Handlers/RevocationHandlers.cs` (142 lines)
+  - `src/Authority/StellaOps.Authority/StellaOps.Authority/Signing/FileAuthoritySigningKeySource.cs` (140 lines)
+  - `src/Authority/StellaOps.Authority/StellaOps.Authority/Storage/Postgres/PostgresLoginAttemptStore.cs` (136 lines)
+  - `src/Authority/StellaOps.Authority/StellaOps.Authority/RateLimiting/AuthorityRateLimiterMetadataAccessor.cs` (129 lines)
+  - `src/Authority/StellaOps.Authority/StellaOps.Authority/OpenIddict/TokenRequestTamperInspector.cs` (127 lines)
+  - `src/Authority/StellaOps.Authority/StellaOps.Authority/Storage/Postgres/PostgresClientStore.cs` (124 lines)
+  - `src/Authority/StellaOps.Authority/StellaOps.Authority/Revocation/RevocationBundleSigner.cs` (122 lines)
+  - `src/Authority/StellaOps.Authority/StellaOps.Authority/Vulnerability/Workflow/VulnWorkflowAntiForgeryTokenVerifier.cs` (122 lines)
+  - `src/Authority/StellaOps.Authority/StellaOps.Authority/Storage/Postgres/PostgresBootstrapInviteStore.cs` (120 lines)
+  - `src/Authority/StellaOps.Authority/StellaOps.Authority/AuthorityRateLimiter.cs` (117 lines)
+  - `src/Authority/StellaOps.Authority/StellaOps.Authority/Signing/KmsAuthoritySigningKeySource.cs` (117 lines)
+  - `src/Authority/StellaOps.Authority/StellaOps.Authority/Signing/AuthorityDsseStatementSigner.cs` (116 lines)
+  - `src/Authority/StellaOps.Authority/StellaOps.Authority/Vulnerability/VulnTokenVerificationUtilities.cs` (115 lines)
+  - `src/Authority/StellaOps.Authority/StellaOps.Authority/Vulnerability/Attachments/VulnAttachmentTokenVerifier.cs` (115 lines)
+  - `src/Authority/StellaOps.Authority/StellaOps.Authority/Vulnerability/VulnTokenUtilities.cs` (110 lines)
+  - `src/Authority/StellaOps.Authority/StellaOps.Authority/Notifications/AuthorityWebhookAllowlistEvaluator.cs` (107 lines)
+  - `src/Authority/StellaOps.Authority/StellaOps.Authority/Bootstrap/BootstrapInviteCleanupService.cs` (106 lines)
+  - `src/Authority/StellaOps.Authority/StellaOps.Authority/Observability/IncidentAuditEndpointExtensions.cs` (102 lines)
+  - `src/Authority/StellaOps.Authority/StellaOps.Authority/OpenIddict/AuthoritySenderConstraintHelper.cs` (102 lines)
+- Service locator matches:
+  - `src/Authority/StellaOps.Authority/StellaOps.Authority/AuthorityRateLimiter.cs`:32 logger ??= httpContext.RequestServices.GetService(typeof(ILoggerFactory)) is ILoggerFactory loggerFactory
+  - `src/Authority/StellaOps.Authority/StellaOps.Authority/AuthorityRateLimiter.cs`:108 ? serviceProvider.GetService(typeof(IAuthorityRateLimiterPartitionKeyResolver)) as IAuthorityRateLimiterPartitionKeyResolver ?? FallbackPartitionKeyResolver
+  - `src/Authority/StellaOps.Authority/StellaOps.Authority/AuthorityIdentityProviderRegistry.cs`:30 var providerInstances = scope.ServiceProvider.GetServices<IIdentityProviderPlugin>();
+  - `src/Authority/StellaOps.Authority/StellaOps.Authority/Program.cs`:172 builder.Services.TryAddSingleton<IDpopReplayCache>(provider => new InMemoryDpopReplayCache(provider.GetService<TimeProvider>()));
+  - `src/Authority/StellaOps.Authority/StellaOps.Authority/Program.cs`:182 var timeProvider = provider.GetService<TimeProvider>();
+  - `src/Authority/StellaOps.Authority/StellaOps.Authority/Program.cs`:190 var timeProvider = provider.GetService<TimeProvider>();
+  - `src/Authority/StellaOps.Authority/StellaOps.Authority/Program.cs`:191 var nonceLogger = provider.GetService<ILogger<InMemoryDpopNonceStore>>();
+  - `src/Authority/StellaOps.Authority/StellaOps.Authority/Plugins/AuthorityPluginLoader.cs`:255 provider = services.BuildServiceProvider(new ServiceProviderOptions
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+- Replace service locator usage with constructor injection.
+
+## Testing Fullness Findings
+- Status: FAIL
+- Expected layers: Unit, Integration, Security, Offline
+- Detected test projects: src/Authority/__Tests/StellaOps.Authority.Persistence.Tests/StellaOps.Authority.Persistence.Tests.csproj [Unit], src/Authority/__Tests/StellaOps.Authority.Core.Tests/StellaOps.Authority.Core.Tests.csproj [Unit], src/Authority/__Tests/StellaOps.Authority.ConfigDiff.Tests/StellaOps.Authority.ConfigDiff.Tests.csproj [Unit], src/Authority/StellaOps.Authority/StellaOps.Authority.Tests/StellaOps.Authority.Tests.csproj [Unit], src/Authority/StellaOps.Authority/StellaOps.Authority.Plugins.Abstractions.Tests/StellaOps.Authority.Plugins.Abstractions.Tests.csproj [Unit], src/Authority/StellaOps.Authority/StellaOps.Authority.Plugin.Standard.Tests/StellaOps.Authority.Plugin.Standard.Tests.csproj [Unit], src/Authority/StellaOps.Authority/StellaOps.Authority.Plugin.Saml.Tests/StellaOps.Authority.Plugin.Saml.Tests.csproj [Unit], src/Authority/StellaOps.Authority/StellaOps.Authority.Plugin.Oidc.Tests/StellaOps.Authority.Plugin.Oidc.Tests.csproj [Unit], src/Authority/StellaOps.Authority/StellaOps.Authority.Plugin.Ldap.Tests/StellaOps.Authority.Plugin.Ldap.Tests.csproj [Unit]
+- Missing layers: Integration, Security, Offline
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Intent tagging required for regulatory modules.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- Add integration tests for cross-component flows.
+- Add security tests for authn/authz or input validation.
+- Add offline/airgap coverage with fixtures only.

docs/implplan-blocked/audits/csproj-standards/Authority/__Libraries/StellaOps.Authority.Core/StellaOps.Authority.Core.md

@@ -0,0 +1,45 @@
+# Audit - StellaOps.Authority.Core
+
+## Project
+- Path: `src/Authority/__Libraries/StellaOps.Authority.Core/StellaOps.Authority.Core.csproj`
+- Module: `Authority`
+- Kind: `Library`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 5
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/Authority/__Libraries/StellaOps.Authority.Core/Verdicts/VerdictReplayVerifier.cs` (234 lines)
+  - `src/Authority/__Libraries/StellaOps.Authority.Core/Verdicts/VerdictManifestBuilder.cs` (227 lines)
+  - `src/Authority/__Libraries/StellaOps.Authority.Core/Verdicts/VerdictManifest.cs` (199 lines)
+  - `src/Authority/__Libraries/StellaOps.Authority.Core/Verdicts/InMemoryVerdictManifestStore.cs` (155 lines)
+  - `src/Authority/__Libraries/StellaOps.Authority.Core/Verdicts/IVerdictManifestStore.cs` (102 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: PASS
+- Expected layers: Unit
+- Detected test projects: src/Authority/__Tests/StellaOps.Authority.Core.Tests/StellaOps.Authority.Core.Tests.csproj [Unit]
+- Missing layers: none
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Intent tagging required for regulatory modules.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- None.

docs/implplan-blocked/audits/csproj-standards/Authority/__Libraries/StellaOps.Authority.Persistence/StellaOps.Authority.Persistence.md

@@ -0,0 +1,60 @@
+# Audit - StellaOps.Authority.Persistence
+
+## Project
+- Path: `src/Authority/__Libraries/StellaOps.Authority.Persistence/StellaOps.Authority.Persistence.csproj`
+- Module: `Authority`
+- Kind: `Library`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 20
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/Authority/__Libraries/StellaOps.Authority.Persistence/InMemory/Stores/InMemoryStores.cs` (719 lines)
+  - `src/Authority/__Libraries/StellaOps.Authority.Persistence/Postgres/Repositories/OidcTokenRepository.cs` (410 lines)
+  - `src/Authority/__Libraries/StellaOps.Authority.Persistence/Postgres/Repositories/UserRepository.cs` (378 lines)
+  - `src/Authority/__Libraries/StellaOps.Authority.Persistence/Postgres/VerdictManifestStore.cs` (356 lines)
+  - `src/Authority/__Libraries/StellaOps.Authority.Persistence/InMemory/Documents/AuthorityDocuments.cs` (287 lines)
+  - `src/Authority/__Libraries/StellaOps.Authority.Persistence/Postgres/Repositories/TokenRepository.cs` (252 lines)
+  - `src/Authority/__Libraries/StellaOps.Authority.Persistence/Postgres/Repositories/BootstrapInviteRepository.cs` (194 lines)
+  - `src/Authority/__Libraries/StellaOps.Authority.Persistence/Postgres/Repositories/TenantRepository.cs` (194 lines)
+  - `src/Authority/__Libraries/StellaOps.Authority.Persistence/Postgres/Repositories/ClientRepository.cs` (162 lines)
+  - `src/Authority/__Libraries/StellaOps.Authority.Persistence/Postgres/Repositories/PermissionRepository.cs` (158 lines)
+  - `src/Authority/__Libraries/StellaOps.Authority.Persistence/Postgres/Repositories/RoleRepository.cs` (156 lines)
+  - `src/Authority/__Libraries/StellaOps.Authority.Persistence/InMemory/Driver/InMemoryDriverShim.cs` (153 lines)
+  - `src/Authority/__Libraries/StellaOps.Authority.Persistence/Postgres/Repositories/ServiceAccountRepository.cs` (141 lines)
+  - `src/Authority/__Libraries/StellaOps.Authority.Persistence/Postgres/Repositories/AuditRepository.cs` (139 lines)
+  - `src/Authority/__Libraries/StellaOps.Authority.Persistence/Postgres/Repositories/ApiKeyRepository.cs` (139 lines)
+  - `src/Authority/__Libraries/StellaOps.Authority.Persistence/Postgres/Repositories/SessionRepository.cs` (138 lines)
+  - `src/Authority/__Libraries/StellaOps.Authority.Persistence/Postgres/Repositories/RevocationRepository.cs` (121 lines)
+  - `src/Authority/__Libraries/StellaOps.Authority.Persistence/Postgres/Models/UserEntity.cs` (112 lines)
+  - `src/Authority/__Libraries/StellaOps.Authority.Persistence/InMemory/Stores/IAuthorityStores.cs` (110 lines)
+  - `src/Authority/__Libraries/StellaOps.Authority.Persistence/Postgres/Repositories/OfflineKitAuditRepository.cs` (103 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: PASS
+- Expected layers: Unit
+- Detected test projects: src/Authority/__Tests/StellaOps.Authority.Persistence.Tests/StellaOps.Authority.Persistence.Tests.csproj [Unit]
+- Missing layers: none
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Intent tagging required for regulatory modules.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- None.

docs/implplan-blocked/audits/csproj-standards/Authority/__Libraries/StellaOps.Authority.Timestamping.Abstractions/StellaOps.Authority.Timestamping.Abstractions.md

@@ -0,0 +1,45 @@
+# Audit - StellaOps.Authority.Timestamping.Abstractions
+
+## Project
+- Path: `src/Authority/__Libraries/StellaOps.Authority.Timestamping.Abstractions/StellaOps.Authority.Timestamping.Abstractions.csproj`
+- Module: `Authority`
+- Kind: `Library`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: inherited true
+- Deterministic: inherited true
+- 100-line rule violations: 5
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/Authority/__Libraries/StellaOps.Authority.Timestamping.Abstractions/TimeStampVerificationResult.cs` (247 lines)
+  - `src/Authority/__Libraries/StellaOps.Authority.Timestamping.Abstractions/TimeStampToken.cs` (164 lines)
+  - `src/Authority/__Libraries/StellaOps.Authority.Timestamping.Abstractions/TimeStampResponse.cs` (155 lines)
+  - `src/Authority/__Libraries/StellaOps.Authority.Timestamping.Abstractions/TsaClientOptions.cs` (142 lines)
+  - `src/Authority/__Libraries/StellaOps.Authority.Timestamping.Abstractions/TimeStampRequest.cs` (123 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: FAIL
+- Expected layers: Unit
+- Detected test projects: none
+- Missing layers: Unit
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Intent tagging required for regulatory modules.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- Add a unit test project named `<Project>.Tests` (or document exception).

docs/implplan-blocked/audits/csproj-standards/Authority/__Libraries/StellaOps.Authority.Timestamping/StellaOps.Authority.Timestamping.md

@@ -0,0 +1,48 @@
+# Audit - StellaOps.Authority.Timestamping
+
+## Project
+- Path: `src/Authority/__Libraries/StellaOps.Authority.Timestamping/StellaOps.Authority.Timestamping.csproj`
+- Module: `Authority`
+- Kind: `Library`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: inherited true
+- Deterministic: inherited true
+- 100-line rule violations: 8
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/Authority/__Libraries/StellaOps.Authority.Timestamping/Asn1/TimeStampRespDecoder.cs` (362 lines)
+  - `src/Authority/__Libraries/StellaOps.Authority.Timestamping/TsaProviderRegistry.cs` (262 lines)
+  - `src/Authority/__Libraries/StellaOps.Authority.Timestamping/TimeStampTokenVerifier.cs` (223 lines)
+  - `src/Authority/__Libraries/StellaOps.Authority.Timestamping/ITsaProviderRegistry.cs` (219 lines)
+  - `src/Authority/__Libraries/StellaOps.Authority.Timestamping/HttpTsaClient.cs` (217 lines)
+  - `src/Authority/__Libraries/StellaOps.Authority.Timestamping/Asn1/TimeStampReqEncoder.cs` (165 lines)
+  - `src/Authority/__Libraries/StellaOps.Authority.Timestamping/Caching/InMemoryTsaCacheStore.cs` (120 lines)
+  - `src/Authority/__Libraries/StellaOps.Authority.Timestamping/TimestampingServiceCollectionExtensions.cs` (107 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: FAIL
+- Expected layers: Unit
+- Detected test projects: none
+- Missing layers: Unit
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Intent tagging required for regulatory modules.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- Add a unit test project named `<Project>.Tests` (or document exception).

docs/implplan-blocked/audits/csproj-standards/Bench/StellaOps.Bench/LinkNotMerge.Vex/StellaOps.Bench.LinkNotMerge.Vex/StellaOps.Bench.LinkNotMerge.Vex.md

@@ -0,0 +1,44 @@
+# Audit - StellaOps.Bench.LinkNotMerge.Vex
+
+## Project
+- Path: `src/Bench/StellaOps.Bench/LinkNotMerge.Vex/StellaOps.Bench.LinkNotMerge.Vex/StellaOps.Bench.LinkNotMerge.Vex.csproj`
+- Module: `Bench`
+- Kind: `Service`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 5
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/Bench/StellaOps.Bench/LinkNotMerge.Vex/StellaOps.Bench.LinkNotMerge.Vex/Program.cs` (376 lines)
+  - `src/Bench/StellaOps.Bench/LinkNotMerge.Vex/StellaOps.Bench.LinkNotMerge.Vex/VexObservationGenerator.cs` (195 lines)
+  - `src/Bench/StellaOps.Bench/LinkNotMerge.Vex/StellaOps.Bench.LinkNotMerge.Vex/VexScenarioConfig.cs` (183 lines)
+  - `src/Bench/StellaOps.Bench/LinkNotMerge.Vex/StellaOps.Bench.LinkNotMerge.Vex/Reporting/BenchmarkJsonWriter.cs` (151 lines)
+  - `src/Bench/StellaOps.Bench/LinkNotMerge.Vex/StellaOps.Bench.LinkNotMerge.Vex/VexLinksetAggregator.cs` (150 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: FAIL
+- Expected layers: Unit
+- Detected test projects: src/Bench/StellaOps.Bench/LinkNotMerge.Vex/StellaOps.Bench.LinkNotMerge.Vex.Tests/StellaOps.Bench.LinkNotMerge.Vex.Tests.csproj [Performance]
+- Missing layers: Unit
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- Add a unit test project named `<Project>.Tests` (or document exception).

docs/implplan-blocked/audits/csproj-standards/Bench/StellaOps.Bench/LinkNotMerge/StellaOps.Bench.LinkNotMerge/StellaOps.Bench.LinkNotMerge.md

@@ -0,0 +1,45 @@
+# Audit - StellaOps.Bench.LinkNotMerge
+
+## Project
+- Path: `src/Bench/StellaOps.Bench/LinkNotMerge/StellaOps.Bench.LinkNotMerge/StellaOps.Bench.LinkNotMerge.csproj`
+- Module: `Bench`
+- Kind: `Service`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 6
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/Bench/StellaOps.Bench/LinkNotMerge/StellaOps.Bench.LinkNotMerge/Program.cs` (375 lines)
+  - `src/Bench/StellaOps.Bench/LinkNotMerge/StellaOps.Bench.LinkNotMerge/BenchmarkConfig.cs` (210 lines)
+  - `src/Bench/StellaOps.Bench/LinkNotMerge/StellaOps.Bench.LinkNotMerge/ObservationData.cs` (199 lines)
+  - `src/Bench/StellaOps.Bench/LinkNotMerge/StellaOps.Bench.LinkNotMerge/Reporting/BenchmarkJsonWriter.cs` (151 lines)
+  - `src/Bench/StellaOps.Bench/LinkNotMerge/StellaOps.Bench.LinkNotMerge/LinksetAggregator.cs` (121 lines)
+  - `src/Bench/StellaOps.Bench/LinkNotMerge/StellaOps.Bench.LinkNotMerge/Reporting/PrometheusWriter.cs` (101 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: FAIL
+- Expected layers: Unit
+- Detected test projects: src/Bench/StellaOps.Bench/LinkNotMerge.Vex/StellaOps.Bench.LinkNotMerge.Vex.Tests/StellaOps.Bench.LinkNotMerge.Vex.Tests.csproj [Performance], src/Bench/StellaOps.Bench/LinkNotMerge/StellaOps.Bench.LinkNotMerge.Tests/StellaOps.Bench.LinkNotMerge.Tests.csproj [Performance]
+- Missing layers: Unit
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- Add a unit test project named `<Project>.Tests` (or document exception).

docs/implplan-blocked/audits/csproj-standards/Bench/StellaOps.Bench/Notify/StellaOps.Bench.Notify/StellaOps.Bench.Notify.md

@@ -0,0 +1,43 @@
+# Audit - StellaOps.Bench.Notify
+
+## Project
+- Path: `src/Bench/StellaOps.Bench/Notify/StellaOps.Bench.Notify/StellaOps.Bench.Notify.csproj`
+- Module: `Bench`
+- Kind: `Service`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 4
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/Bench/StellaOps.Bench/Notify/StellaOps.Bench.Notify/NotifyScenarioRunner.cs` (386 lines)
+  - `src/Bench/StellaOps.Bench/Notify/StellaOps.Bench.Notify/Program.cs` (364 lines)
+  - `src/Bench/StellaOps.Bench/Notify/StellaOps.Bench.Notify/BenchmarkConfig.cs` (220 lines)
+  - `src/Bench/StellaOps.Bench/Notify/StellaOps.Bench.Notify/Reporting/BenchmarkJsonWriter.cs` (147 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: FAIL
+- Expected layers: Unit
+- Detected test projects: src/Bench/StellaOps.Bench/Notify/StellaOps.Bench.Notify.Tests/StellaOps.Bench.Notify.Tests.csproj [Performance]
+- Missing layers: Unit
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- Add a unit test project named `<Project>.Tests` (or document exception).

docs/implplan-blocked/audits/csproj-standards/Bench/StellaOps.Bench/PolicyEngine/StellaOps.Bench.PolicyEngine/StellaOps.Bench.PolicyEngine.md

@@ -0,0 +1,44 @@
+# Audit - StellaOps.Bench.PolicyEngine
+
+## Project
+- Path: `src/Bench/StellaOps.Bench/PolicyEngine/StellaOps.Bench.PolicyEngine/StellaOps.Bench.PolicyEngine.csproj`
+- Module: `Bench`
+- Kind: `Service`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 5
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/Bench/StellaOps.Bench/PolicyEngine/StellaOps.Bench.PolicyEngine/Program.cs` (373 lines)
+  - `src/Bench/StellaOps.Bench/PolicyEngine/StellaOps.Bench.PolicyEngine/PolicyScenarioRunner.cs` (249 lines)
+  - `src/Bench/StellaOps.Bench/PolicyEngine/StellaOps.Bench.PolicyEngine/BenchmarkConfig.cs` (155 lines)
+  - `src/Bench/StellaOps.Bench/PolicyEngine/StellaOps.Bench.PolicyEngine/Reporting/BenchmarkJsonWriter.cs` (125 lines)
+  - `src/Bench/StellaOps.Bench/PolicyEngine/StellaOps.Bench.PolicyEngine/ScenarioResult.cs` (110 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: FAIL
+- Expected layers: Unit
+- Detected test projects: none
+- Missing layers: Unit
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- Add a unit test project named `<Project>.Tests` (or document exception).

docs/implplan-blocked/audits/csproj-standards/Bench/StellaOps.Bench/Scanner.Analyzers/StellaOps.Bench.ScannerAnalyzers/StellaOps.Bench.ScannerAnalyzers.md

@@ -0,0 +1,44 @@
+# Audit - StellaOps.Bench.ScannerAnalyzers
+
+## Project
+- Path: `src/Bench/StellaOps.Bench/Scanner.Analyzers/StellaOps.Bench.ScannerAnalyzers/StellaOps.Bench.ScannerAnalyzers.csproj`
+- Module: `Bench`
+- Kind: `Service`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 5
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/Bench/StellaOps.Bench/Scanner.Analyzers/StellaOps.Bench.ScannerAnalyzers/Program.cs` (396 lines)
+  - `src/Bench/StellaOps.Bench/Scanner.Analyzers/StellaOps.Bench.ScannerAnalyzers/ScenarioRunners.cs` (297 lines)
+  - `src/Bench/StellaOps.Bench/Scanner.Analyzers/StellaOps.Bench.ScannerAnalyzers/NodeBenchMetrics.cs` (268 lines)
+  - `src/Bench/StellaOps.Bench/Scanner.Analyzers/StellaOps.Bench.ScannerAnalyzers/Reporting/BenchmarkJsonWriter.cs` (110 lines)
+  - `src/Bench/StellaOps.Bench/Scanner.Analyzers/StellaOps.Bench.ScannerAnalyzers/BenchmarkConfig.cs` (104 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: FAIL
+- Expected layers: Unit
+- Detected test projects: src/Bench/StellaOps.Bench/Scanner.Analyzers/StellaOps.Bench.ScannerAnalyzers.Tests/StellaOps.Bench.ScannerAnalyzers.Tests.csproj [Performance]
+- Missing layers: Unit
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- Add a unit test project named `<Project>.Tests` (or document exception).

docs/implplan-blocked/audits/csproj-standards/BinaryIndex/StellaOps.BinaryIndex.WebService/StellaOps.BinaryIndex.WebService.md

@@ -0,0 +1,48 @@
+# Audit - StellaOps.BinaryIndex.WebService
+
+## Project
+- Path: `src/BinaryIndex/StellaOps.BinaryIndex.WebService/StellaOps.BinaryIndex.WebService.csproj`
+- Module: `BinaryIndex`
+- Kind: `WebService`
+- SDK: `Microsoft.NET.Sdk.Web`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 7
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/BinaryIndex/StellaOps.BinaryIndex.WebService/Controllers/GoldenSetController.cs` (775 lines)
+  - `src/BinaryIndex/StellaOps.BinaryIndex.WebService/Controllers/PatchCoverageController.cs` (331 lines)
+  - `src/BinaryIndex/StellaOps.BinaryIndex.WebService/Controllers/BinaryIndexOpsController.cs` (322 lines)
+  - `src/BinaryIndex/StellaOps.BinaryIndex.WebService/Middleware/RateLimitingMiddleware.cs` (275 lines)
+  - `src/BinaryIndex/StellaOps.BinaryIndex.WebService/Telemetry/ResolutionTelemetry.cs` (218 lines)
+  - `src/BinaryIndex/StellaOps.BinaryIndex.WebService/Services/CachedResolutionService.cs` (189 lines)
+  - `src/BinaryIndex/StellaOps.BinaryIndex.WebService/Controllers/ResolutionController.cs` (174 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: FAIL
+- Expected layers: Unit, Integration, Security, Offline
+- Detected test projects: src/BinaryIndex/__Tests/StellaOps.BinaryIndex.WebService.Tests/StellaOps.BinaryIndex.WebService.Tests.csproj [Unit]
+- Missing layers: Integration, Security, Offline
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- Add integration tests for cross-component flows.
+- Add security tests for authn/authz or input validation.
+- Add offline/airgap coverage with fixtures only.

docs/implplan-blocked/audits/csproj-standards/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Analysis/StellaOps.BinaryIndex.Analysis.md

@@ -0,0 +1,49 @@
+# Audit - StellaOps.BinaryIndex.Analysis
+
+## Project
+- Path: `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Analysis/StellaOps.BinaryIndex.Analysis.csproj`
+- Module: `BinaryIndex`
+- Kind: `Library`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 10
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Analysis/Interfaces.cs` (408 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Analysis/GoldenSetAnalysisPipeline.cs` (368 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Analysis/SignatureMatcher.cs` (359 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Analysis/Models/AnalysisResultModels.cs` (349 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Analysis/ReachGraphBinaryReachabilityService.cs` (291 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Analysis/Models/FingerprintModels.cs` (285 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Analysis/Implementations.cs` (278 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Analysis/Models/SignatureIndexModels.cs` (249 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Analysis/TaintGateExtractor.cs` (183 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Analysis/ServiceCollectionExtensions.cs` (107 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: PASS
+- Expected layers: Unit
+- Detected test projects: src/BinaryIndex/__Tests/StellaOps.BinaryIndex.Analysis.Tests/StellaOps.BinaryIndex.Analysis.Tests.csproj [Unit]
+- Missing layers: none
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- None.

docs/implplan-blocked/audits/csproj-standards/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Builders/StellaOps.BinaryIndex.Builders.md

@@ -0,0 +1,53 @@
+# Audit - StellaOps.BinaryIndex.Builders
+
+## Project
+- Path: `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Builders/StellaOps.BinaryIndex.Builders.csproj`
+- Module: `BinaryIndex`
+- Kind: `Library`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 14
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Builders/SymbolDiff/SymbolTableDiffAnalyzer.cs` (805 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Builders/PatchDiffEngine.cs` (488 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Builders/ReproducibleBuildJobTypes.cs` (429 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Builders/IReproducibleBuilder.cs` (428 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Builders/SymbolDiff/NameDemangler.cs` (387 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Builders/SymbolDiff/SymbolTableDiff.cs` (315 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Builders/FingerprintClaimModels.cs` (304 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Builders/SymbolDiff/DynamicLinkingDiff.cs` (244 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Builders/IPatchDiffEngine.cs` (233 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Builders/IFunctionFingerprintExtractor.cs` (228 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Builders/SymbolDiff/AbiCompatibility.cs` (207 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Builders/BuilderOptions.cs` (175 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Builders/SymbolDiff/ISymbolTableDiffAnalyzer.cs` (162 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Builders/SymbolDiff/VersionMapDiff.cs` (113 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: PASS
+- Expected layers: Unit
+- Detected test projects: src/BinaryIndex/__Tests/StellaOps.BinaryIndex.Builders.Tests/StellaOps.BinaryIndex.Builders.Tests.csproj [Unit]
+- Missing layers: none
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- None.

docs/implplan-blocked/audits/csproj-standards/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Cache/StellaOps.BinaryIndex.Cache.md

@@ -0,0 +1,44 @@
+# Audit - StellaOps.BinaryIndex.Cache
+
+## Project
+- Path: `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Cache/StellaOps.BinaryIndex.Cache.csproj`
+- Module: `BinaryIndex`
+- Kind: `Library`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 5
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Cache/CachedBinaryVulnerabilityService.cs` (539 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Cache/ResolutionCacheService.cs` (328 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Cache/FunctionIrCacheService.cs` (316 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Cache/BinaryCacheServiceExtensions.cs` (106 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Cache/CacheOptionsValidation.cs` (101 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: PASS
+- Expected layers: Unit
+- Detected test projects: src/BinaryIndex/__Tests/StellaOps.BinaryIndex.Cache.Tests/StellaOps.BinaryIndex.Cache.Tests.csproj [Unit]
+- Missing layers: none
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- None.

docs/implplan-blocked/audits/csproj-standards/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Contracts/StellaOps.BinaryIndex.Contracts.md

@@ -0,0 +1,40 @@
+# Audit - StellaOps.BinaryIndex.Contracts
+
+## Project
+- Path: `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Contracts/StellaOps.BinaryIndex.Contracts.csproj`
+- Module: `BinaryIndex`
+- Kind: `Library`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 1
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Contracts/Resolution/VulnResolutionContracts.cs` (248 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: PASS
+- Expected layers: Unit
+- Detected test projects: src/BinaryIndex/__Tests/StellaOps.BinaryIndex.Contracts.Tests/StellaOps.BinaryIndex.Contracts.Tests.csproj [Unit]
+- Missing layers: none
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- None.

docs/implplan-blocked/audits/csproj-standards/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Core/StellaOps.BinaryIndex.Core.md

@@ -0,0 +1,46 @@
+# Audit - StellaOps.BinaryIndex.Core
+
+## Project
+- Path: `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Core/StellaOps.BinaryIndex.Core.csproj`
+- Module: `BinaryIndex`
+- Kind: `Library`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 7
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Core/Configuration/BinaryIndexOpsModels.cs` (494 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Core/Resolution/ResolutionService.cs` (463 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Core/Services/IBinaryVulnerabilityService.cs` (386 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Core/Services/MachoFeatureExtractor.cs` (305 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Core/Services/PeFeatureExtractor.cs` (281 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Core/Configuration/BinaryIndexOptions.cs` (276 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Core/Services/ElfFeatureExtractor.cs` (210 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: PASS
+- Expected layers: Unit
+- Detected test projects: src/BinaryIndex/__Tests/StellaOps.BinaryIndex.Core.Tests/StellaOps.BinaryIndex.Core.Tests.csproj [Unit]
+- Missing layers: none
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- None.

docs/implplan-blocked/audits/csproj-standards/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Corpus.Alpine/StellaOps.BinaryIndex.Corpus.Alpine.md

@@ -0,0 +1,42 @@
+# Audit - StellaOps.BinaryIndex.Corpus.Alpine
+
+## Project
+- Path: `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Corpus.Alpine/StellaOps.BinaryIndex.Corpus.Alpine.csproj`
+- Module: `BinaryIndex`
+- Kind: `Library`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 3
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Corpus.Alpine/AlpinePackageExtractor.cs` (227 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Corpus.Alpine/AlpineCorpusConnector.cs` (162 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Corpus.Alpine/ApkBuildSecfixesExtractor.cs` (111 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: PASS
+- Expected layers: Unit
+- Detected test projects: src/BinaryIndex/__Tests/StellaOps.BinaryIndex.Corpus.Alpine.Tests/StellaOps.BinaryIndex.Corpus.Alpine.Tests.csproj [Unit]
+- Missing layers: none
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- None.

docs/implplan-blocked/audits/csproj-standards/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Corpus.Debian/StellaOps.BinaryIndex.Corpus.Debian.md

@@ -0,0 +1,42 @@
+# Audit - StellaOps.BinaryIndex.Corpus.Debian
+
+## Project
+- Path: `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Corpus.Debian/StellaOps.BinaryIndex.Corpus.Debian.csproj`
+- Module: `BinaryIndex`
+- Kind: `Library`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 3
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Corpus.Debian/DebianMirrorPackageSource.cs` (275 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Corpus.Debian/DebianPackageExtractor.cs` (223 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Corpus.Debian/DebianCorpusConnector.cs` (178 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: PASS
+- Expected layers: Unit
+- Detected test projects: src/BinaryIndex/__Tests/StellaOps.BinaryIndex.Corpus.Debian.Tests/StellaOps.BinaryIndex.Corpus.Debian.Tests.csproj [Unit]
+- Missing layers: none
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- None.

docs/implplan-blocked/audits/csproj-standards/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Corpus.Rpm/StellaOps.BinaryIndex.Corpus.Rpm.md

@@ -0,0 +1,42 @@
+# Audit - StellaOps.BinaryIndex.Corpus.Rpm
+
+## Project
+- Path: `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Corpus.Rpm/StellaOps.BinaryIndex.Corpus.Rpm.csproj`
+- Module: `BinaryIndex`
+- Kind: `Library`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 3
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Corpus.Rpm/RpmPackageExtractor.cs` (382 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Corpus.Rpm/RpmCorpusConnector.cs` (175 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Corpus.Rpm/SrpmChangelogExtractor.cs` (133 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: PASS
+- Expected layers: Unit
+- Detected test projects: src/BinaryIndex/__Tests/StellaOps.BinaryIndex.Corpus.Rpm.Tests/StellaOps.BinaryIndex.Corpus.Rpm.Tests.csproj [Unit]
+- Missing layers: none
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- None.

docs/implplan-blocked/audits/csproj-standards/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Corpus/StellaOps.BinaryIndex.Corpus.md

@@ -0,0 +1,54 @@
+# Audit - StellaOps.BinaryIndex.Corpus
+
+## Project
+- Path: `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Corpus/StellaOps.BinaryIndex.Corpus.csproj`
+- Module: `BinaryIndex`
+- Kind: `Library`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 15
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Corpus/Connectors/OpenSslCorpusConnector.cs` (554 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Corpus/Connectors/GlibcCorpusConnector.cs` (549 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Corpus/Services/FunctionClusteringService.cs` (531 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Corpus/Services/CorpusIngestionService.cs` (466 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Corpus/Services/BatchFingerprintPipeline.cs` (464 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Corpus/Connectors/ZlibCorpusConnector.cs` (452 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Corpus/Connectors/CurlCorpusConnector.cs` (447 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Corpus/Services/CveFunctionMappingUpdater.cs` (423 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Corpus/Services/CorpusQueryService.cs` (419 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Corpus/ICorpusRepository.cs` (327 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Corpus/Models/FunctionCorpusModels.cs` (273 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Corpus/IBinaryCorpusConnector.cs` (190 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Corpus/ICorpusQueryService.cs` (186 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Corpus/ILibraryCorpusConnector.cs` (155 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Corpus/ICorpusIngestionService.cs` (135 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: PASS
+- Expected layers: Unit
+- Detected test projects: src/BinaryIndex/__Tests/StellaOps.BinaryIndex.Corpus.Tests/StellaOps.BinaryIndex.Corpus.Tests.csproj [Unit], src/BinaryIndex/__Tests/StellaOps.BinaryIndex.Corpus.Rpm.Tests/StellaOps.BinaryIndex.Corpus.Rpm.Tests.csproj [Unit], src/BinaryIndex/__Tests/StellaOps.BinaryIndex.Corpus.Debian.Tests/StellaOps.BinaryIndex.Corpus.Debian.Tests.csproj [Unit], src/BinaryIndex/__Tests/StellaOps.BinaryIndex.Corpus.Alpine.Tests/StellaOps.BinaryIndex.Corpus.Alpine.Tests.csproj [Unit]
+- Missing layers: none
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- None.

docs/implplan-blocked/audits/csproj-standards/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Decompiler/StellaOps.BinaryIndex.Decompiler.md

@@ -0,0 +1,45 @@
+# Audit - StellaOps.BinaryIndex.Decompiler
+
+## Project
+- Path: `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Decompiler/StellaOps.BinaryIndex.Decompiler.csproj`
+- Module: `BinaryIndex`
+- Kind: `Library`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 6
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Decompiler/DecompiledCodeParser.cs` (950 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Decompiler/CodeNormalizer.cs` (534 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Decompiler/AstComparisonEngine.cs` (392 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Decompiler/Models.cs` (377 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Decompiler/GhidraDecompilerAdapter.cs` (291 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Decompiler/IDecompilerService.cs` (157 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: PASS
+- Expected layers: Unit
+- Detected test projects: src/BinaryIndex/__Tests/StellaOps.BinaryIndex.Decompiler.Tests/StellaOps.BinaryIndex.Decompiler.Tests.csproj [Unit]
+- Missing layers: none
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- None.

docs/implplan-blocked/audits/csproj-standards/BinaryIndex/__Libraries/StellaOps.BinaryIndex.DeltaSig/StellaOps.BinaryIndex.DeltaSig.md

@@ -0,0 +1,61 @@
+# Audit - StellaOps.BinaryIndex.DeltaSig
+
+## Project
+- Path: `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.DeltaSig/StellaOps.BinaryIndex.DeltaSig.csproj`
+- Module: `BinaryIndex`
+- Kind: `Library`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 19
+- Service locator usage (BuildServiceProvider/GetService): 3
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.DeltaSig/DeltaSigService.cs` (616 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.DeltaSig/Attestation/DeltaSigPredicateV2.cs` (548 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.DeltaSig/CfgExtractor.cs` (502 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.DeltaSig/Attestation/DeltaSigPredicate.cs` (491 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.DeltaSig/DeltaSignatureGenerator.cs` (487 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.DeltaSig/Attestation/DeltaSigAttestorIntegration.cs` (485 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.DeltaSig/Models.cs` (462 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.DeltaSig/IDeltaSigService.cs` (444 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.DeltaSig/DeltaSignatureMatcher.cs` (436 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.DeltaSig/Policy/DeltaScopePolicyGate.cs` (428 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.DeltaSig/DeltaSigServiceV2.cs` (419 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.DeltaSig/VexIntegration/DeltaSigVexBridge.cs` (345 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.DeltaSig/Provenance/GroundTruthProvenanceResolver.cs` (282 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.DeltaSig/IrDiff/IIrDiffGenerator.cs` (277 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.DeltaSig/Attestation/DeltaSigPredicateConverter.cs` (251 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.DeltaSig/SymbolChangeTracer.cs` (237 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.DeltaSig/IrDiff/IrDiffGenerator.cs` (222 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.DeltaSig/Provenance/ISymbolProvenanceResolver.cs` (145 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.DeltaSig/ServiceCollectionExtensions.cs` (107 lines)
+- Service locator matches:
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.DeltaSig/ServiceCollectionExtensions.cs`:33 var irLifting = sp.GetService<IIrLiftingService>();
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.DeltaSig/ServiceCollectionExtensions.cs`:34 var graphExtractor = sp.GetService<ISemanticGraphExtractor>();
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.DeltaSig/ServiceCollectionExtensions.cs`:35 var fingerprintGenerator = sp.GetService<ISemanticFingerprintGenerator>();
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+- Replace service locator usage with constructor injection.
+
+## Testing Fullness Findings
+- Status: PASS
+- Expected layers: Unit
+- Detected test projects: src/BinaryIndex/__Tests/StellaOps.BinaryIndex.DeltaSig.Tests/StellaOps.BinaryIndex.DeltaSig.Tests.csproj [Unit]
+- Missing layers: none
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- None.

docs/implplan-blocked/audits/csproj-standards/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Diff/StellaOps.BinaryIndex.Diff.md

@@ -0,0 +1,48 @@
+# Audit - StellaOps.BinaryIndex.Diff
+
+## Project
+- Path: `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Diff/StellaOps.BinaryIndex.Diff.csproj`
+- Module: `BinaryIndex`
+- Kind: `Library`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 9
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Diff/Models/PatchDiffModels.cs` (376 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Diff/Models/DiffEvidenceModels.cs` (335 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Diff/FunctionDiffer.cs` (330 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Diff/PatchDiffEngine.cs` (284 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Diff/Storage/InMemoryDiffResultStore.cs` (245 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Diff/Storage/IDiffResultStore.cs` (218 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Diff/VerdictCalculator.cs` (169 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Diff/FunctionRenameDetector.cs` (166 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Diff/Interfaces.cs` (160 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: PASS
+- Expected layers: Unit
+- Detected test projects: src/BinaryIndex/__Tests/StellaOps.BinaryIndex.Diff.Tests/StellaOps.BinaryIndex.Diff.Tests.csproj [Unit]
+- Missing layers: none
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- None.

docs/implplan-blocked/audits/csproj-standards/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Disassembly.Abstractions/StellaOps.BinaryIndex.Disassembly.Abstractions.md

@@ -0,0 +1,41 @@
+# Audit - StellaOps.BinaryIndex.Disassembly.Abstractions
+
+## Project
+- Path: `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Disassembly.Abstractions/StellaOps.BinaryIndex.Disassembly.Abstractions.csproj`
+- Module: `BinaryIndex`
+- Kind: `Library`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 2
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Disassembly.Abstractions/Models.cs` (348 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Disassembly.Abstractions/IDisassemblyPlugin.cs` (140 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: FAIL
+- Expected layers: Unit
+- Detected test projects: none
+- Missing layers: Unit
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- Add a unit test project named `<Project>.Tests` (or document exception).

docs/implplan-blocked/audits/csproj-standards/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Disassembly.B2R2/StellaOps.BinaryIndex.Disassembly.B2R2.md

@@ -0,0 +1,42 @@
+# Audit - StellaOps.BinaryIndex.Disassembly.B2R2
+
+## Project
+- Path: `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Disassembly.B2R2/StellaOps.BinaryIndex.Disassembly.B2R2.csproj`
+- Module: `BinaryIndex`
+- Kind: `Library`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 3
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Disassembly.B2R2/B2R2LowUirLiftingService.cs` (697 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Disassembly.B2R2/B2R2DisassemblyPlugin.cs` (686 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Disassembly.B2R2/B2R2LifterPool.cs` (384 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: FAIL
+- Expected layers: Unit
+- Detected test projects: none
+- Missing layers: Unit
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- Add a unit test project named `<Project>.Tests` (or document exception).

docs/implplan-blocked/audits/csproj-standards/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Disassembly.Iced/StellaOps.BinaryIndex.Disassembly.Iced.md

@@ -0,0 +1,40 @@
+# Audit - StellaOps.BinaryIndex.Disassembly.Iced
+
+## Project
+- Path: `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Disassembly.Iced/StellaOps.BinaryIndex.Disassembly.Iced.csproj`
+- Module: `BinaryIndex`
+- Kind: `Library`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 1
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Disassembly.Iced/IcedDisassemblyPlugin.cs` (596 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: FAIL
+- Expected layers: Unit
+- Detected test projects: none
+- Missing layers: Unit
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- Add a unit test project named `<Project>.Tests` (or document exception).

docs/implplan-blocked/audits/csproj-standards/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Disassembly/StellaOps.BinaryIndex.Disassembly.md

@@ -0,0 +1,42 @@
+# Audit - StellaOps.BinaryIndex.Disassembly
+
+## Project
+- Path: `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Disassembly/StellaOps.BinaryIndex.Disassembly.csproj`
+- Module: `BinaryIndex`
+- Kind: `Library`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 3
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Disassembly/HybridDisassemblyService.cs` (572 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Disassembly/DisassemblyService.cs` (220 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Disassembly/DisassemblyServiceCollectionExtensions.cs` (146 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: PASS
+- Expected layers: Unit
+- Detected test projects: src/BinaryIndex/__Tests/StellaOps.BinaryIndex.Disassembly.Tests/StellaOps.BinaryIndex.Disassembly.Tests.csproj [Unit]
+- Missing layers: none
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- None.

docs/implplan-blocked/audits/csproj-standards/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Ensemble/StellaOps.BinaryIndex.Ensemble.md

@@ -0,0 +1,45 @@
+# Audit - StellaOps.BinaryIndex.Ensemble
+
+## Project
+- Path: `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Ensemble/StellaOps.BinaryIndex.Ensemble.csproj`
+- Module: `BinaryIndex`
+- Kind: `Library`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 6
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Ensemble/EnsembleDecisionEngine.cs` (460 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Ensemble/Models.cs` (446 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Ensemble/WeightTuningService.cs` (180 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Ensemble/FunctionAnalysisBuilder.cs` (165 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Ensemble/IEnsembleDecisionEngine.cs` (129 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Ensemble/EnsembleServiceCollectionExtensions.cs` (110 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: PASS
+- Expected layers: Unit
+- Detected test projects: src/BinaryIndex/__Tests/StellaOps.BinaryIndex.Ensemble.Tests/StellaOps.BinaryIndex.Ensemble.Tests.csproj [Unit]
+- Missing layers: none
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- None.

docs/implplan-blocked/audits/csproj-standards/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Fingerprints/StellaOps.BinaryIndex.Fingerprints.md

@@ -0,0 +1,49 @@
+# Audit - StellaOps.BinaryIndex.Fingerprints
+
+## Project
+- Path: `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Fingerprints/StellaOps.BinaryIndex.Fingerprints.csproj`
+- Module: `BinaryIndex`
+- Kind: `Library`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 10
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Fingerprints/Generators/BasicBlockFingerprintGenerator.cs` (464 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Fingerprints/Generators/ControlFlowGraphFingerprintGenerator.cs` (433 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Fingerprints/Pipeline/ReferenceBuildPipeline.cs` (427 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Fingerprints/Matching/FingerprintMatcher.cs` (377 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Fingerprints/Generators/StringRefsFingerprintGenerator.cs` (282 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Fingerprints/Generators/CombinedFingerprintGenerator.cs` (185 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Fingerprints/Models/VulnFingerprint.cs` (183 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Fingerprints/Generators/IVulnFingerprintGenerator.cs` (114 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Fingerprints/Matching/IFingerprintMatcher.cs` (108 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Fingerprints/Storage/FingerprintBlobStorage.cs` (104 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: PASS
+- Expected layers: Unit
+- Detected test projects: src/BinaryIndex/__Tests/StellaOps.BinaryIndex.Fingerprints.Tests/StellaOps.BinaryIndex.Fingerprints.Tests.csproj [Unit]
+- Missing layers: none
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- None.

docs/implplan-blocked/audits/csproj-standards/BinaryIndex/__Libraries/StellaOps.BinaryIndex.FixIndex/StellaOps.BinaryIndex.FixIndex.md

@@ -0,0 +1,44 @@
+# Audit - StellaOps.BinaryIndex.FixIndex
+
+## Project
+- Path: `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.FixIndex/StellaOps.BinaryIndex.FixIndex.csproj`
+- Module: `BinaryIndex`
+- Kind: `Library`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 5
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.FixIndex/Parsers/RpmChangelogParser.cs` (244 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.FixIndex/Services/FixIndexBuilder.cs` (141 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.FixIndex/Services/IFixIndexBuilder.cs` (123 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.FixIndex/Repositories/IFixIndexRepository.cs` (112 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.FixIndex/Parsers/AlpineSecfixesParser.cs` (109 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: PASS
+- Expected layers: Unit
+- Detected test projects: src/BinaryIndex/__Tests/StellaOps.BinaryIndex.FixIndex.Tests/StellaOps.BinaryIndex.FixIndex.Tests.csproj [Unit]
+- Missing layers: none
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- None.

docs/implplan-blocked/audits/csproj-standards/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Ghidra/StellaOps.BinaryIndex.Ghidra.md

@@ -0,0 +1,53 @@
+# Audit - StellaOps.BinaryIndex.Ghidra
+
+## Project
+- Path: `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Ghidra/StellaOps.BinaryIndex.Ghidra.csproj`
+- Module: `BinaryIndex`
+- Kind: `Library`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 14
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Ghidra/Services/GhidriffBridge.cs` (707 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Ghidra/Services/GhidraDisassemblyPlugin.cs` (545 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Ghidra/Services/GhidraService.cs` (516 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Ghidra/Services/GhidraHeadlessManager.cs` (450 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Ghidra/Services/VersionTrackingService.cs` (437 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Ghidra/Services/BSimService.cs` (285 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Ghidra/Abstractions/IVersionTrackingService.cs` (255 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Ghidra/Exceptions/GhidraExceptions.cs` (245 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Ghidra/Abstractions/IGhidriffBridge.cs` (207 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Ghidra/Options/GhidraOptions.cs` (188 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Ghidra/Abstractions/IBSimService.cs` (168 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Ghidra/Models/GhidraModels.cs` (157 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Ghidra/Abstractions/IGhidraService.cs` (144 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Ghidra/Extensions/GhidraServiceCollectionExtensions.cs` (114 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: PASS
+- Expected layers: Unit
+- Detected test projects: src/BinaryIndex/__Tests/StellaOps.BinaryIndex.Ghidra.Tests/StellaOps.BinaryIndex.Ghidra.Tests.csproj [Unit]
+- Missing layers: none
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- None.

docs/implplan-blocked/audits/csproj-standards/BinaryIndex/__Libraries/StellaOps.BinaryIndex.GoldenSet/StellaOps.BinaryIndex.GoldenSet.md

@@ -0,0 +1,58 @@
+# Audit - StellaOps.BinaryIndex.GoldenSet
+
+## Project
+- Path: `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.GoldenSet/StellaOps.BinaryIndex.GoldenSet.csproj`
+- Module: `BinaryIndex`
+- Kind: `Library`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 19
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.GoldenSet/Storage/PostgresGoldenSetStore.cs` (665 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.GoldenSet/Authoring/UpstreamCommitAnalyzer.cs` (519 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.GoldenSet/Authoring/GoldenSetExtractor.cs` (421 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.GoldenSet/Validation/GoldenSetValidator.cs` (406 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.GoldenSet/Storage/IGoldenSetStore.cs` (346 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.GoldenSet/Authoring/GoldenSetReviewService.cs` (323 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.GoldenSet/Authoring/GoldenSetEnrichmentService.cs` (281 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.GoldenSet/Authoring/IGoldenSetExtractor.cs` (266 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.GoldenSet/Models/GoldenSetDefinition.cs` (261 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.GoldenSet/Authoring/IGoldenSetEnrichmentService.cs` (235 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.GoldenSet/Serialization/GoldenSetYamlSerializer.cs` (227 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.GoldenSet/Authoring/IGoldenSetReviewService.cs` (224 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.GoldenSet/Services/SinkRegistry.cs` (214 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.GoldenSet/Validation/IGoldenSetValidator.cs` (198 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.GoldenSet/Authoring/Extractors/IGoldenSetSourceExtractor.cs` (197 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.GoldenSet/Authoring/Extractors/FunctionHintExtractor.cs` (181 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.GoldenSet/Authoring/Extractors/CweToSinkMapper.cs` (174 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.GoldenSet/Authoring/Extractors/NvdGoldenSetExtractor.cs` (148 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.GoldenSet/Configuration/GoldenSetOptions.cs` (124 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: PASS
+- Expected layers: Unit
+- Detected test projects: src/BinaryIndex/__Tests/StellaOps.BinaryIndex.GoldenSet.Tests/StellaOps.BinaryIndex.GoldenSet.Tests.csproj [Unit]
+- Missing layers: none
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- None.

docs/implplan-blocked/audits/csproj-standards/BinaryIndex/__Libraries/StellaOps.BinaryIndex.GroundTruth.Abstractions/StellaOps.BinaryIndex.GroundTruth.Abstractions.md

@@ -0,0 +1,51 @@
+# Audit - StellaOps.BinaryIndex.GroundTruth.Abstractions
+
+## Project
+- Path: `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.GroundTruth.Abstractions/StellaOps.BinaryIndex.GroundTruth.Abstractions.csproj`
+- Module: `BinaryIndex`
+- Kind: `Library`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 12
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.GroundTruth.Abstractions/IValidationHarness.cs` (698 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.GroundTruth.Abstractions/IKpiRepository.cs` (605 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.GroundTruth.Abstractions/SymbolObservation.cs` (410 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.GroundTruth.Abstractions/SymbolSourceDefinitions.cs` (314 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.GroundTruth.Abstractions/ISecurityPairService.cs` (290 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.GroundTruth.Abstractions/SymbolObservationWriteGuard.cs` (264 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.GroundTruth.Abstractions/KpiComputation.cs` (256 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.GroundTruth.Abstractions/ISymbolObservationRepository.cs` (242 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.GroundTruth.Abstractions/ISymbolSourceConnector.cs` (229 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.GroundTruth.Abstractions/Services/SecurityPairService.cs` (174 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.GroundTruth.Abstractions/SymbolSourceConnectorBase.cs` (154 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.GroundTruth.Abstractions/ISymbolObservationWriteGuard.cs` (128 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: PASS
+- Expected layers: Unit
+- Detected test projects: src/BinaryIndex/__Tests/StellaOps.BinaryIndex.GroundTruth.Abstractions.Tests/StellaOps.BinaryIndex.GroundTruth.Abstractions.Tests.csproj [Unit]
+- Missing layers: none
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- None.

docs/implplan-blocked/audits/csproj-standards/BinaryIndex/__Libraries/StellaOps.BinaryIndex.GroundTruth.Buildinfo/StellaOps.BinaryIndex.GroundTruth.Buildinfo.md

@@ -0,0 +1,42 @@
+# Audit - StellaOps.BinaryIndex.GroundTruth.Buildinfo
+
+## Project
+- Path: `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.GroundTruth.Buildinfo/StellaOps.BinaryIndex.GroundTruth.Buildinfo.csproj`
+- Module: `BinaryIndex`
+- Kind: `Library`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 2
+- Service locator usage (BuildServiceProvider/GetService): 1
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.GroundTruth.Buildinfo/Internal/BuildinfoParser.cs` (382 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.GroundTruth.Buildinfo/BuildinfoConnector.cs` (240 lines)
+- Service locator matches:
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.GroundTruth.Buildinfo/BuildinfoConnectorPlugin.cs`:19 var options = services.GetService<IOptions<BuildinfoOptions>>();
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+- Replace service locator usage with constructor injection.
+
+## Testing Fullness Findings
+- Status: PASS
+- Expected layers: Unit
+- Detected test projects: src/BinaryIndex/__Tests/StellaOps.BinaryIndex.GroundTruth.Buildinfo.Tests/StellaOps.BinaryIndex.GroundTruth.Buildinfo.Tests.csproj [Unit]
+- Missing layers: none
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- None.

docs/implplan-blocked/audits/csproj-standards/BinaryIndex/__Libraries/StellaOps.BinaryIndex.GroundTruth.Ddeb/StellaOps.BinaryIndex.GroundTruth.Ddeb.md

@@ -0,0 +1,46 @@
+# Audit - StellaOps.BinaryIndex.GroundTruth.Ddeb
+
+## Project
+- Path: `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.GroundTruth.Ddeb/StellaOps.BinaryIndex.GroundTruth.Ddeb.csproj`
+- Module: `BinaryIndex`
+- Kind: `Library`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 6
+- Service locator usage (BuildServiceProvider/GetService): 1
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.GroundTruth.Ddeb/DdebConnector.cs` (580 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.GroundTruth.Ddeb/Internal/DebPackageExtractor.cs` (253 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.GroundTruth.Ddeb/Internal/DdebCache.cs` (203 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.GroundTruth.Ddeb/Internal/PackagesIndexParser.cs` (161 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.GroundTruth.Ddeb/Configuration/DdebOptions.cs` (104 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.GroundTruth.Ddeb/Internal/IDebPackageExtractor.cs` (103 lines)
+- Service locator matches:
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.GroundTruth.Ddeb/DdebConnectorPlugin.cs`:20 var options = services.GetService<Microsoft.Extensions.Options.IOptions<DdebOptions>>();
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+- Replace service locator usage with constructor injection.
+
+## Testing Fullness Findings
+- Status: PASS
+- Expected layers: Unit
+- Detected test projects: src/BinaryIndex/__Tests/StellaOps.BinaryIndex.GroundTruth.Ddeb.Tests/StellaOps.BinaryIndex.GroundTruth.Ddeb.Tests.csproj [Unit]
+- Missing layers: none
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- None.

docs/implplan-blocked/audits/csproj-standards/BinaryIndex/__Libraries/StellaOps.BinaryIndex.GroundTruth.Debuginfod/StellaOps.BinaryIndex.GroundTruth.Debuginfod.md

@@ -0,0 +1,44 @@
+# Audit - StellaOps.BinaryIndex.GroundTruth.Debuginfod
+
+## Project
+- Path: `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.GroundTruth.Debuginfod/StellaOps.BinaryIndex.GroundTruth.Debuginfod.csproj`
+- Module: `BinaryIndex`
+- Kind: `Library`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 4
+- Service locator usage (BuildServiceProvider/GetService): 1
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.GroundTruth.Debuginfod/DebuginfodConnector.cs` (460 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.GroundTruth.Debuginfod/Internal/ImaVerificationService.cs` (331 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.GroundTruth.Debuginfod/Internal/DebuginfodCache.cs` (312 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.GroundTruth.Debuginfod/DebuginfodServiceCollectionExtensions.cs` (108 lines)
+- Service locator matches:
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.GroundTruth.Debuginfod/DebuginfodConnectorPlugin.cs`:21 var options = services.GetService<Microsoft.Extensions.Options.IOptions<DebuginfodOptions>>();
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+- Replace service locator usage with constructor injection.
+
+## Testing Fullness Findings
+- Status: PASS
+- Expected layers: Unit
+- Detected test projects: src/BinaryIndex/__Tests/StellaOps.BinaryIndex.GroundTruth.Debuginfod.Tests/StellaOps.BinaryIndex.GroundTruth.Debuginfod.Tests.csproj [Unit]
+- Missing layers: none
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- None.

docs/implplan-blocked/audits/csproj-standards/BinaryIndex/__Libraries/StellaOps.BinaryIndex.GroundTruth.Mirror/StellaOps.BinaryIndex.GroundTruth.Mirror.md

@@ -0,0 +1,45 @@
+# Audit - StellaOps.BinaryIndex.GroundTruth.Mirror
+
+## Project
+- Path: `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.GroundTruth.Mirror/StellaOps.BinaryIndex.GroundTruth.Mirror.csproj`
+- Module: `BinaryIndex`
+- Kind: `Library`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 6
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.GroundTruth.Mirror/Parsing/OsvDumpParser.cs` (1004 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.GroundTruth.Mirror/MirrorService.cs` (681 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.GroundTruth.Mirror/IMirrorService.cs` (432 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.GroundTruth.Mirror/Connectors/DebianSnapshotMirrorConnector.cs` (429 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.GroundTruth.Mirror/Models/MirrorManifest.cs` (389 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.GroundTruth.Mirror/Connectors/OsvDumpMirrorConnector.cs` (285 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: PASS
+- Expected layers: Unit
+- Detected test projects: src/BinaryIndex/__Tests/StellaOps.BinaryIndex.GroundTruth.Mirror.Tests/StellaOps.BinaryIndex.GroundTruth.Mirror.Tests.csproj [Unit]
+- Missing layers: none
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- None.

docs/implplan-blocked/audits/csproj-standards/BinaryIndex/__Libraries/StellaOps.BinaryIndex.GroundTruth.Reproducible/StellaOps.BinaryIndex.GroundTruth.Reproducible.md

@@ -0,0 +1,58 @@
+# Audit - StellaOps.BinaryIndex.GroundTruth.Reproducible
+
+## Project
+- Path: `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.GroundTruth.Reproducible/StellaOps.BinaryIndex.GroundTruth.Reproducible.csproj`
+- Module: `BinaryIndex`
+- Kind: `Library`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: inherited true
+- Deterministic: inherited true
+- 100-line rule violations: 18
+- Service locator usage (BuildServiceProvider/GetService): 1
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.GroundTruth.Reproducible/BundleImportService.cs` (1333 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.GroundTruth.Reproducible/BundleExportService.cs` (921 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.GroundTruth.Reproducible/SymbolExtractor.cs` (577 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.GroundTruth.Reproducible/ValidationHarnessService.cs` (571 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.GroundTruth.Reproducible/SbomStabilityValidator.cs` (499 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.GroundTruth.Reproducible/Services/KpiRegressionService.cs` (468 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.GroundTruth.Reproducible/LocalRebuildBackend.cs` (459 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.GroundTruth.Reproducible/RebuildModels.cs` (458 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.GroundTruth.Reproducible/Models/BundleImportModels.cs` (449 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.GroundTruth.Reproducible/AirGapRebuildBundle.cs` (446 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.GroundTruth.Reproducible/DeterminismValidator.cs` (439 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.GroundTruth.Reproducible/ReproduceDebianClient.cs` (332 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.GroundTruth.Reproducible/Models/KpiRegressionModels.cs` (313 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.GroundTruth.Reproducible/Models/BundleExportModels.cs` (282 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.GroundTruth.Reproducible/RebuildService.cs` (173 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.GroundTruth.Reproducible/ServiceCollectionExtensions.cs` (165 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.GroundTruth.Reproducible/IBundleExportService.cs` (159 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.GroundTruth.Reproducible/IBundleImportService.cs` (135 lines)
+- Service locator matches:
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.GroundTruth.Reproducible/ServiceCollectionExtensions.cs`:59 var options = sp.GetService<Microsoft.Extensions.Options.IOptions<ReproduceDebianOptions>>()?.Value
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+- Replace service locator usage with constructor injection.
+
+## Testing Fullness Findings
+- Status: PASS
+- Expected layers: Unit
+- Detected test projects: src/BinaryIndex/__Tests/StellaOps.BinaryIndex.GroundTruth.Reproducible.Tests/StellaOps.BinaryIndex.GroundTruth.Reproducible.Tests.csproj [Unit]
+- Missing layers: none
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- None.

docs/implplan-blocked/audits/csproj-standards/BinaryIndex/__Libraries/StellaOps.BinaryIndex.GroundTruth.SecDb/StellaOps.BinaryIndex.GroundTruth.SecDb.md

@@ -0,0 +1,42 @@
+# Audit - StellaOps.BinaryIndex.GroundTruth.SecDb
+
+## Project
+- Path: `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.GroundTruth.SecDb/StellaOps.BinaryIndex.GroundTruth.SecDb.csproj`
+- Module: `BinaryIndex`
+- Kind: `Library`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 2
+- Service locator usage (BuildServiceProvider/GetService): 1
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.GroundTruth.SecDb/SecDbConnector.cs` (295 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.GroundTruth.SecDb/Internal/SecDbParser.cs` (268 lines)
+- Service locator matches:
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.GroundTruth.SecDb/SecDbConnectorPlugin.cs`:19 var options = services.GetService<IOptions<SecDbOptions>>();
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+- Replace service locator usage with constructor injection.
+
+## Testing Fullness Findings
+- Status: PASS
+- Expected layers: Unit
+- Detected test projects: src/BinaryIndex/__Tests/StellaOps.BinaryIndex.GroundTruth.SecDb.Tests/StellaOps.BinaryIndex.GroundTruth.SecDb.Tests.csproj [Unit]
+- Missing layers: none
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- None.

docs/implplan-blocked/audits/csproj-standards/BinaryIndex/__Libraries/StellaOps.BinaryIndex.ML/StellaOps.BinaryIndex.ML.md

@@ -0,0 +1,53 @@
+# Audit - StellaOps.BinaryIndex.ML
+
+## Project
+- Path: `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.ML/StellaOps.BinaryIndex.ML.csproj`
+- Module: `BinaryIndex`
+- Kind: `Library`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 14
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.ML/OnnxInferenceEngine.cs` (381 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.ML/Training/GroundTruthCorpusBuilder.cs` (355 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.ML/Training/OnnxFunctionEmbeddingService.cs` (309 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.ML/Training/TrainingCorpusModels.cs` (299 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.ML/BinaryCodeTokenizer.cs` (269 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.ML/Models.cs` (259 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.ML/Training/GhidraDecompilerAdapter.cs` (249 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.ML/Training/B2R2IrTokenizer.cs` (244 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.ML/IEmbeddingService.cs` (174 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.ML/Training/MlEmbeddingMatcherAdapter.cs` (172 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.ML/Training/ICorpusBuilder.cs` (147 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.ML/InMemoryEmbeddingIndex.cs` (138 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.ML/Training/IDecompilerAdapter.cs` (133 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.ML/Training/IFunctionEmbeddingService.cs` (123 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: FAIL
+- Expected layers: Unit
+- Detected test projects: none
+- Missing layers: Unit
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- Add a unit test project named `<Project>.Tests` (or document exception).

docs/implplan-blocked/audits/csproj-standards/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Normalization/StellaOps.BinaryIndex.Normalization.md

@@ -0,0 +1,42 @@
+# Audit - StellaOps.BinaryIndex.Normalization
+
+## Project
+- Path: `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Normalization/StellaOps.BinaryIndex.Normalization.csproj`
+- Module: `BinaryIndex`
+- Kind: `Library`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 3
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Normalization/X64/X64NormalizationPipeline.cs` (662 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Normalization/Arm64/Arm64NormalizationPipeline.cs` (459 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Normalization/Models.cs` (206 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: PASS
+- Expected layers: Unit
+- Detected test projects: src/BinaryIndex/__Tests/StellaOps.BinaryIndex.Normalization.Tests/StellaOps.BinaryIndex.Normalization.Tests.csproj [Unit]
+- Missing layers: none
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- None.

docs/implplan-blocked/audits/csproj-standards/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Persistence/StellaOps.BinaryIndex.Persistence.md

@@ -0,0 +1,54 @@
+# Audit - StellaOps.BinaryIndex.Persistence
+
+## Project
+- Path: `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Persistence/StellaOps.BinaryIndex.Persistence.csproj`
+- Module: `BinaryIndex`
+- Kind: `Library`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 15
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Persistence/Repositories/FunctionCorpusRepository.cs` (1336 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Persistence/Repositories/DeltaSignatureRepository.cs` (767 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Persistence/Services/BinaryVulnerabilityService.cs` (630 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Persistence/Repositories/IDeltaSignatureRepository.cs` (380 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Persistence/Repositories/GroundTruth/SecurityPairRepository.cs` (363 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Persistence/Repositories/FingerprintRepository.cs` (339 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Persistence/Repositories/FixIndexRepository.cs` (336 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Persistence/Repositories/GroundTruth/SymbolObservationRepository.cs` (304 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Persistence/Repositories/BinaryIdentityRepository.cs` (255 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Persistence/Repositories/GroundTruth/RawDocumentRepository.cs` (188 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Persistence/Repositories/GroundTruth/SymbolSourceRepository.cs` (185 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Persistence/Repositories/GroundTruth/SourceStateRepository.cs` (164 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Persistence/Repositories/CorpusSnapshotRepository.cs` (154 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Persistence/BinaryIndexMigrationRunner.cs` (148 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Persistence/Repositories/GroundTruth/ISecurityPairRepository.cs` (102 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: PASS
+- Expected layers: Unit
+- Detected test projects: src/BinaryIndex/__Tests/StellaOps.BinaryIndex.Persistence.Tests/StellaOps.BinaryIndex.Persistence.Tests.csproj [Unit]
+- Missing layers: none
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- None.

docs/implplan-blocked/audits/csproj-standards/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Semantic/StellaOps.BinaryIndex.Semantic.md

@@ -0,0 +1,50 @@
+# Audit - StellaOps.BinaryIndex.Semantic
+
+## Project
+- Path: `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Semantic/StellaOps.BinaryIndex.Semantic.csproj`
+- Module: `BinaryIndex`
+- Kind: `Library`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 11
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Semantic/SemanticGraphExtractor.cs` (515 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Semantic/IrLiftingService.cs` (458 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Semantic/SemanticMatcher.cs` (358 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Semantic/Lifting/B2R2LifterPool.cs` (351 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Semantic/CallNgramGenerator.cs` (325 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Semantic/Models/IrModels.cs` (318 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Semantic/Models/FingerprintModels.cs` (309 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Semantic/Models/GraphModels.cs` (261 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Semantic/Internal/WeisfeilerLehmanHasher.cs` (228 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Semantic/SemanticFingerprintGenerator.cs` (184 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Semantic/Internal/GraphCanonicalizer.cs` (113 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: PASS
+- Expected layers: Unit
+- Detected test projects: src/BinaryIndex/__Tests/StellaOps.BinaryIndex.Semantic.Tests/StellaOps.BinaryIndex.Semantic.Tests.csproj [Unit]
+- Missing layers: none
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- None.

docs/implplan-blocked/audits/csproj-standards/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Validation.Abstractions/StellaOps.BinaryIndex.Validation.Abstractions.md

@@ -0,0 +1,44 @@
+# Audit - StellaOps.BinaryIndex.Validation.Abstractions
+
+## Project
+- Path: `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Validation.Abstractions/StellaOps.BinaryIndex.Validation.Abstractions.csproj`
+- Module: `BinaryIndex`
+- Kind: `Library`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 5
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Validation.Abstractions/MismatchAnalysis.cs` (295 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Validation.Abstractions/MatchResult.cs` (208 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Validation.Abstractions/ValidationRun.cs` (197 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Validation.Abstractions/ValidationMetrics.cs` (196 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Validation.Abstractions/ValidationConfig.cs` (151 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: FAIL
+- Expected layers: Unit
+- Detected test projects: none
+- Missing layers: Unit
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- Add a unit test project named `<Project>.Tests` (or document exception).

docs/implplan-blocked/audits/csproj-standards/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Validation/StellaOps.BinaryIndex.Validation.md

@@ -0,0 +1,49 @@
+# Audit - StellaOps.BinaryIndex.Validation
+
+## Project
+- Path: `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Validation/StellaOps.BinaryIndex.Validation.csproj`
+- Module: `BinaryIndex`
+- Kind: `Library`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 10
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Validation/Reports/ReportGenerators.cs` (461 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Validation/ValidationHarness.cs` (441 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Validation/Attestation/ValidationRunAttestor.cs` (349 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Validation/Persistence/ValidationRunRepository.cs` (266 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Validation/Matchers/MatcherAdapters.cs` (248 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Validation/Persistence/MatchResultRepository.cs` (217 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Validation/MismatchAnalyzer.cs` (209 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Validation/GroundTruthOracle.cs` (196 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Validation/Interfaces.cs` (185 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Validation/Matchers/MatcherAdapterFactory.cs` (105 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: PASS
+- Expected layers: Unit
+- Detected test projects: src/BinaryIndex/__Tests/StellaOps.BinaryIndex.Validation.Tests/StellaOps.BinaryIndex.Validation.Tests.csproj [Unit]
+- Missing layers: none
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- None.

docs/implplan-blocked/audits/csproj-standards/BinaryIndex/__Libraries/StellaOps.BinaryIndex.VexBridge/StellaOps.BinaryIndex.VexBridge.md

@@ -0,0 +1,41 @@
+# Audit - StellaOps.BinaryIndex.VexBridge
+
+## Project
+- Path: `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.VexBridge/StellaOps.BinaryIndex.VexBridge.csproj`
+- Module: `BinaryIndex`
+- Kind: `Library`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 2
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.VexBridge/VexEvidenceGenerator.cs` (522 lines)
+  - `src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.VexBridge/BinaryMatchEvidenceSchema.cs` (185 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: PASS
+- Expected layers: Unit
+- Detected test projects: src/BinaryIndex/__Tests/StellaOps.BinaryIndex.VexBridge.Tests/StellaOps.BinaryIndex.VexBridge.Tests.csproj [Unit]
+- Missing layers: none
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- None.

docs/implplan-blocked/audits/csproj-standards/Cartographer/StellaOps.Cartographer/StellaOps.Cartographer.md

@@ -0,0 +1,42 @@
+# Audit - StellaOps.Cartographer
+
+## Project
+- Path: `src/Cartographer/StellaOps.Cartographer/StellaOps.Cartographer.csproj`
+- Module: `Cartographer`
+- Kind: `WebService`
+- SDK: `Microsoft.NET.Sdk.Web`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 1
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/Cartographer/StellaOps.Cartographer/Options/CartographerAuthorityOptions.cs` (101 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: FAIL
+- Expected layers: Unit, Integration, Security, Offline
+- Detected test projects: src/Cartographer/__Tests/StellaOps.Cartographer.Tests/StellaOps.Cartographer.Tests.csproj [Unit]
+- Missing layers: Integration, Security, Offline
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- Add integration tests for cross-component flows.
+- Add security tests for authn/authz or input validation.
+- Add offline/airgap coverage with fixtures only.

docs/implplan-blocked/audits/csproj-standards/Cli/StellaOps.Cli/StellaOps.Cli.md

@@ -0,0 +1,857 @@
+# Audit - StellaOps.Cli
+
+## Project
+- Path: `src/Cli/StellaOps.Cli/StellaOps.Cli.csproj`
+- Module: `Cli`
+- Kind: `Tool`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 285
+- Service locator usage (BuildServiceProvider/GetService): 532
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs` (33868 lines)
+  - `src/Cli/StellaOps.Cli/Commands/CommandFactory.cs` (14742 lines)
+  - `src/Cli/StellaOps.Cli/Services/BackendOperationsClient.cs` (5321 lines)
+  - `src/Cli/StellaOps.Cli/Commands/SbomCommandGroup.cs` (4163 lines)
+  - `src/Cli/StellaOps.Cli/Commands/EvidenceCommandGroup.cs` (2431 lines)
+  - `src/Cli/StellaOps.Cli/Commands/ScoreGateCommandGroup.cs` (2198 lines)
+  - `src/Cli/StellaOps.Cli/Commands/GroundTruthCommandGroup.cs` (2099 lines)
+  - `src/Cli/StellaOps.Cli/Commands/ReachabilityCommandGroup.cs` (1744 lines)
+  - `src/Cli/StellaOps.Cli/Commands/ScoreCommandGroup.cs` (1714 lines)
+  - `src/Cli/StellaOps.Cli/Commands/AttestCommandGroup.cs` (1671 lines)
+  - `src/Cli/StellaOps.Cli/Commands/UnknownsCommandGroup.cs` (1669 lines)
+  - `src/Cli/StellaOps.Cli/Commands/BundleVerifyCommand.cs` (1417 lines)
+  - `src/Cli/StellaOps.Cli/Commands/PolicyCommandGroup.cs` (1409 lines)
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.Offline.cs` (1373 lines)
+  - `src/Cli/StellaOps.Cli/Commands/AnalyticsCommandGroup.cs` (1243 lines)
+  - `src/Cli/StellaOps.Cli/Commands/ReleaseCommandGroup.cs` (1240 lines)
+  - `src/Cli/StellaOps.Cli/Commands/Chain/ChainCommandGroup.cs` (1218 lines)
+  - `src/Cli/StellaOps.Cli/Services/Models/PolicyWorkspaceModels.cs` (1202 lines)
+  - `src/Cli/StellaOps.Cli/Commands/DoctorCommandGroup.cs` (1165 lines)
+  - `src/Cli/StellaOps.Cli/Commands/ExceptionCommandGroup.cs` (1137 lines)
+  - `src/Cli/StellaOps.Cli/Services/PromotionAssembler.cs` (1127 lines)
+  - `src/Cli/StellaOps.Cli/Commands/GuardCommandGroup.cs` (1052 lines)
+  - `src/Cli/StellaOps.Cli/Commands/FunctionMap/FunctionMapCommandGroup.cs` (1021 lines)
+  - `src/Cli/StellaOps.Cli/Services/PackClient.cs` (1018 lines)
+  - `src/Cli/StellaOps.Cli/Commands/WatchlistCommandGroup.cs` (991 lines)
+  - `src/Cli/StellaOps.Cli/Commands/ScoreReplayCommandGroup.cs` (962 lines)
+  - `src/Cli/StellaOps.Cli/Commands/Binary/BinaryCommandHandlers.cs` (938 lines)
+  - `src/Cli/StellaOps.Cli/Commands/Budget/RiskBudgetCommandGroup.cs` (932 lines)
+  - `src/Cli/StellaOps.Cli/Commands/Binary/BinaryCommandGroup.cs` (922 lines)
+  - `src/Cli/StellaOps.Cli/CliApplication.cs` (917 lines)
+  - `src/Cli/StellaOps.Cli/Services/Models/PackModels.cs` (915 lines)
+  - `src/Cli/StellaOps.Cli/Commands/DbCommandGroup.cs` (887 lines)
+  - `src/Cli/StellaOps.Cli/Commands/LayerSbomCommandGroup.cs` (879 lines)
+  - `src/Cli/StellaOps.Cli/Commands/Binary/DeltaSigCommandGroup.cs` (873 lines)
+  - `src/Cli/StellaOps.Cli/Audit/AuditBundleService.cs` (869 lines)
+  - `src/Cli/StellaOps.Cli/Commands/Scan/BinaryDiffService.cs` (862 lines)
+  - `src/Cli/StellaOps.Cli/Services/DeterminismHarness.cs` (850 lines)
+  - `src/Cli/StellaOps.Cli/Commands/Trust/TrustCommandHandlers.cs` (846 lines)
+  - `src/Cli/StellaOps.Cli/Commands/DeltaSig/DeltaSigCommandHandlers.cs` (841 lines)
+  - `src/Cli/StellaOps.Cli/Services/Models/SbomerModels.cs` (834 lines)
+  - `src/Cli/StellaOps.Cli/Commands/Admin/AdminCommandHandlers.cs` (826 lines)
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.Federation.cs` (818 lines)
+  - `src/Cli/StellaOps.Cli/Commands/GitHubCommandGroup.cs` (806 lines)
+  - `src/Cli/StellaOps.Cli/Commands/LicenseCommandGroup.cs` (798 lines)
+  - `src/Cli/StellaOps.Cli/Commands/Watchlist/WatchlistCommandHandlers.cs` (795 lines)
+  - `src/Cli/StellaOps.Cli/Commands/AuthCommandGroup.cs` (794 lines)
+  - `src/Cli/StellaOps.Cli/Commands/AuditCommandGroup.cs` (787 lines)
+  - `src/Cli/StellaOps.Cli/Services/NotifyClient.cs` (781 lines)
+  - `src/Cli/StellaOps.Cli/Commands/Advise/AdviseChatCommandGroup.cs` (776 lines)
+  - `src/Cli/StellaOps.Cli/Commands/BundleExportCommand.cs` (775 lines)
+  - `src/Cli/StellaOps.Cli/Commands/CryptoCommandGroup.cs` (769 lines)
+  - `src/Cli/StellaOps.Cli/Commands/Setup/SetupCommandHandler.cs` (745 lines)
+  - `src/Cli/StellaOps.Cli/Commands/Policy/PolicyInteropCommandGroup.cs` (740 lines)
+  - `src/Cli/StellaOps.Cli/Services/Models/SbomModels.cs` (739 lines)
+  - `src/Cli/StellaOps.Cli/Commands/KeysCommandGroup.cs` (729 lines)
+  - `src/Cli/StellaOps.Cli/Commands/ReplayCommandGroup.cs` (723 lines)
+  - `src/Cli/StellaOps.Cli/Commands/OrchestratorCommandGroup.cs` (720 lines)
+  - `src/Cli/StellaOps.Cli/Commands/NotifyCommandGroup.cs` (708 lines)
+  - `src/Cli/StellaOps.Cli/Services/Models/NotifyModels.cs` (693 lines)
+  - `src/Cli/StellaOps.Cli/Commands/VexGateScanCommandGroup.cs` (687 lines)
+  - `src/Cli/StellaOps.Cli/Commands/SignalsCommandGroup.cs` (682 lines)
+  - `src/Cli/StellaOps.Cli/Commands/FixChainCommandGroup.cs` (678 lines)
+  - `src/Cli/StellaOps.Cli/Commands/Observations/ObservationsCommandGroup.cs` (671 lines)
+  - `src/Cli/StellaOps.Cli/Services/Models/OrchestratorModels.cs` (671 lines)
+  - `src/Cli/StellaOps.Cli/Commands/ExplainCommandGroup.cs` (669 lines)
+  - `src/Cli/StellaOps.Cli/Commands/TaskRunnerCommandGroup.cs` (652 lines)
+  - `src/Cli/StellaOps.Cli/Commands/GateCommandGroup.cs` (635 lines)
+  - `src/Cli/StellaOps.Cli/Commands/Proof/KeyRotationCommandGroup.cs` (628 lines)
+  - `src/Cli/StellaOps.Cli/Commands/RegistryCommandGroup.cs` (626 lines)
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.VerdictVerify.cs` (621 lines)
+  - `src/Cli/StellaOps.Cli/Validation/LocalValidator.cs` (615 lines)
+  - `src/Cli/StellaOps.Cli/Services/SbomClient.cs` (603 lines)
+  - `src/Cli/StellaOps.Cli/Services/ExceptionClient.cs` (598 lines)
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.VerifyBundle.cs` (597 lines)
+  - `src/Cli/StellaOps.Cli/Services/ForensicVerifier.cs` (594 lines)
+  - `src/Cli/StellaOps.Cli/Commands/CheckpointCommands.cs` (593 lines)
+  - `src/Cli/StellaOps.Cli/Commands/Witness/WitnessCoreCommandHandlers.cs` (583 lines)
+  - `src/Cli/StellaOps.Cli/Services/VerdictAttestationVerifier.cs` (583 lines)
+  - `src/Cli/StellaOps.Cli/GitOps/GitOpsController.cs` (582 lines)
+  - `src/Cli/StellaOps.Cli/Commands/PatchAttestCommandGroup.cs` (580 lines)
+  - `src/Cli/StellaOps.Cli/Commands/VerifyCommandGroup.cs` (577 lines)
+  - `src/Cli/StellaOps.Cli/Commands/Proof/FuncProofCommandHandlers.cs` (576 lines)
+  - `src/Cli/StellaOps.Cli/Commands/Admin/AdminCommandGroup.cs` (575 lines)
+  - `src/Cli/StellaOps.Cli/Commands/ProveCommandGroup.cs` (570 lines)
+  - `src/Cli/StellaOps.Cli/Services/ObservabilityClient.cs` (558 lines)
+  - `src/Cli/StellaOps.Cli/Commands/GoldenSet/GoldenSetCommandGroup.cs` (551 lines)
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.VerifyOffline.cs` (549 lines)
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.Feeds.cs` (543 lines)
+  - `src/Cli/StellaOps.Cli/Commands/TrustAnchorsCommandGroup.cs` (543 lines)
+  - `src/Cli/StellaOps.Cli/Services/Models/ObservabilityModels.cs` (542 lines)
+  - `src/Cli/StellaOps.Cli/Commands/Scan/DeltaScanCommandGroup.cs` (539 lines)
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.Witness.cs` (538 lines)
+  - `src/Cli/StellaOps.Cli/Commands/Compare/CompareCommandBuilder.cs` (536 lines)
+  - `src/Cli/StellaOps.Cli/Services/AttestationBundleVerifier.cs` (533 lines)
+  - `src/Cli/StellaOps.Cli/Commands/VexGenCommandGroup.cs` (529 lines)
+  - `src/Cli/StellaOps.Cli/Commands/ScanGraphCommandGroup.cs` (521 lines)
+  - `src/Cli/StellaOps.Cli/Services/Models/ReachabilityModels.cs` (521 lines)
+  - `src/Cli/StellaOps.Cli/Commands/ZastavaCommandGroup.cs` (520 lines)
+  - `src/Cli/StellaOps.Cli/Commands/ProvCommandGroup.cs` (511 lines)
+  - `src/Cli/StellaOps.Cli/Commands/Binary/BinaryIndexOpsCommandGroup.cs` (511 lines)
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.Model.cs` (511 lines)
+  - `src/Cli/StellaOps.Cli/Commands/CiTemplates.cs` (510 lines)
+  - `src/Cli/StellaOps.Cli/Services/Models/AdvisoryLinksetModels.cs` (503 lines)
+  - `src/Cli/StellaOps.Cli/Commands/SignCommandGroup.cs` (487 lines)
+  - `src/Cli/StellaOps.Cli/Commands/ExportCommandGroup.cs` (485 lines)
+  - `src/Cli/StellaOps.Cli/Commands/DeltaSig/DeltaSigCommandGroup.cs` (483 lines)
+  - `src/Cli/StellaOps.Cli/Services/Models/WitnessModels.cs` (481 lines)
+  - `src/Cli/StellaOps.Cli/Commands/TrustProfileCommandGroup.cs` (480 lines)
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.AirGap.cs` (480 lines)
+  - `src/Cli/StellaOps.Cli/Commands/AirGapCommandGroup.cs` (479 lines)
+  - `src/Cli/StellaOps.Cli/Services/MirrorBundleImportService.cs` (476 lines)
+  - `src/Cli/StellaOps.Cli/Commands/BenchCommandBuilder.cs` (476 lines)
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.Audit.cs` (475 lines)
+  - `src/Cli/StellaOps.Cli/Commands/Watchlist/WatchlistCommandGroup.cs` (473 lines)
+  - `src/Cli/StellaOps.Cli/Services/OciAttestationRegistryClient.cs` (473 lines)
+  - `src/Cli/StellaOps.Cli/Services/Models/PromotionModels.cs` (468 lines)
+  - `src/Cli/StellaOps.Cli/Services/OrchestratorClient.cs` (467 lines)
+  - `src/Cli/StellaOps.Cli/Commands/Trust/TrustCommandGroup.cs` (466 lines)
+  - `src/Cli/StellaOps.Cli/Commands/PatchVerifyCommandGroup.cs` (461 lines)
+  - `src/Cli/StellaOps.Cli/Services/ImageAttestationVerifier.cs` (456 lines)
+  - `src/Cli/StellaOps.Cli/Configuration/CliProfile.cs` (455 lines)
+  - `src/Cli/StellaOps.Cli/Commands/ChangeTraceCommandGroup.cs` (450 lines)
+  - `src/Cli/StellaOps.Cli/Services/Models/RiskModels.cs` (448 lines)
+  - `src/Cli/StellaOps.Cli/Commands/ReachGraph/ReachGraphCommandHandlers.cs` (446 lines)
+  - `src/Cli/StellaOps.Cli/Commands/Setup/Steps/Implementations/LlmSetupStep.cs` (441 lines)
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.Secrets.cs` (440 lines)
+  - `src/Cli/StellaOps.Cli/Commands/Setup/Steps/Implementations/ScmSetupStep.cs` (438 lines)
+  - `src/Cli/StellaOps.Cli/Extensions/CommandLineCompatExtensions.cs` (437 lines)
+  - `src/Cli/StellaOps.Cli/Configuration/CliBootstrapper.cs` (436 lines)
+  - `src/Cli/StellaOps.Cli/Commands/Advise/ChatRenderer.cs` (431 lines)
+  - `src/Cli/StellaOps.Cli/Commands/IncidentCommandGroup.cs` (431 lines)
+  - `src/Cli/StellaOps.Cli/Commands/ConfigCatalog.cs` (431 lines)
+  - `src/Cli/StellaOps.Cli/Commands/Setup/Config/YamlSetupConfigParser.cs` (429 lines)
+  - `src/Cli/StellaOps.Cli/Services/Models/Chat/ChatModels.cs` (429 lines)
+  - `src/Cli/StellaOps.Cli/Program.cs` (423 lines)
+  - `src/Cli/StellaOps.Cli/Commands/FederationCommandGroup.cs` (423 lines)
+  - `src/Cli/StellaOps.Cli/Commands/Setup/Steps/Implementations/SettingsStoreSetupStep.cs` (422 lines)
+  - `src/Cli/StellaOps.Cli/Services/Models/ExceptionModels.cs` (422 lines)
+  - `src/Cli/StellaOps.Cli/Commands/EvidenceHoldsCommandGroup.cs` (420 lines)
+  - `src/Cli/StellaOps.Cli/Commands/Setup/Steps/Implementations/SourcesSetupStep.cs` (420 lines)
+  - `src/Cli/StellaOps.Cli/Services/Models/DeterminismModels.cs` (420 lines)
+  - `src/Cli/StellaOps.Cli/Commands/VexCommandGroup.cs` (413 lines)
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.Crypto.cs` (410 lines)
+  - `src/Cli/StellaOps.Cli/Commands/Proof/ProofCommandGroup.cs` (408 lines)
+  - `src/Cli/StellaOps.Cli/Commands/PoE/VerifyCommand.cs` (405 lines)
+  - `src/Cli/StellaOps.Cli/Commands/Setup/Steps/Implementations/NotifySetupStep.cs` (405 lines)
+  - `src/Cli/StellaOps.Cli/Output/OutputRenderer.cs` (395 lines)
+  - `src/Cli/StellaOps.Cli/Services/ConcelierObservationsClient.cs` (392 lines)
+  - `src/Cli/StellaOps.Cli/Services/AttestationReader.cs` (390 lines)
+  - `src/Cli/StellaOps.Cli/Commands/ReleaseCommandHandler.cs` (382 lines)
+  - `src/Cli/StellaOps.Cli/Services/DevPortalBundleVerifier.cs` (381 lines)
+  - `src/Cli/StellaOps.Cli/Commands/Ir/IrCommandGroup.cs` (380 lines)
+  - `src/Cli/StellaOps.Cli/Output/CliError.cs` (380 lines)
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.Drift.cs` (377 lines)
+  - `src/Cli/StellaOps.Cli/Commands/Sources/SourcesCommandHandlers.cs` (376 lines)
+  - `src/Cli/StellaOps.Cli/Services/OciRegistryClient.cs` (374 lines)
+  - `src/Cli/StellaOps.Cli/Services/ForensicSnapshotClient.cs` (372 lines)
+  - `src/Cli/StellaOps.Cli/Commands/DeployCommandHandler.cs` (370 lines)
+  - `src/Cli/StellaOps.Cli/Commands/PoE/ExportCommand.cs` (366 lines)
+  - `src/Cli/StellaOps.Cli/Commands/HlcCommandGroup.cs` (363 lines)
+  - `src/Cli/StellaOps.Cli/Commands/DeltaCommandGroup.cs` (356 lines)
+  - `src/Cli/StellaOps.Cli/Commands/Scan/BinaryDiffCommandGroup.cs` (355 lines)
+  - `src/Cli/StellaOps.Cli/Services/Models/ForensicVerificationModels.cs` (347 lines)
+  - `src/Cli/StellaOps.Cli/Commands/AuditVerifyCommand.cs` (344 lines)
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.Sign.cs` (344 lines)
+  - `src/Cli/StellaOps.Cli/Services/Transport/StellaOpsClientBase.cs` (340 lines)
+  - `src/Cli/StellaOps.Cli/Commands/IssuerKeysCommandGroup.cs` (339 lines)
+  - `src/Cli/StellaOps.Cli/Commands/Setup/Steps/Implementations/VaultSetupStep.cs` (337 lines)
+  - `src/Cli/StellaOps.Cli/Services/ScannerExecutor.cs` (331 lines)
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.Image.cs` (330 lines)
+  - `src/Cli/StellaOps.Cli/Commands/Sbom/SbomGenerateCommand.cs` (328 lines)
+  - `src/Cli/StellaOps.Cli/Commands/Slice/SliceCommandHandlers.cs` (327 lines)
+  - `src/Cli/StellaOps.Cli/Commands/DriftCommandGroup.cs` (324 lines)
+  - `src/Cli/StellaOps.Cli/Commands/VerdictCommandGroup.cs` (321 lines)
+  - `src/Cli/StellaOps.Cli/Commands/Setup/State/FileSetupStateStore.cs` (311 lines)
+  - `src/Cli/StellaOps.Cli/Commands/PromoteCommandHandler.cs` (311 lines)
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.Config.cs` (303 lines)
+  - `src/Cli/StellaOps.Cli/Commands/ModelCommandGroup.cs` (303 lines)
+  - `src/Cli/StellaOps.Cli/Commands/Setup/Steps/Implementations/UsersSetupStep.cs` (301 lines)
+  - `src/Cli/StellaOps.Cli/Services/Models/VexModels.cs` (299 lines)
+  - `src/Cli/StellaOps.Cli/Commands/Setup/Steps/Implementations/CryptoSetupStep.cs` (296 lines)
+  - `src/Cli/StellaOps.Cli/Services/Models/VexObservationModels.cs` (292 lines)
+  - `src/Cli/StellaOps.Cli/Commands/Scan/BinaryDiffRenderer.cs` (292 lines)
+  - `src/Cli/StellaOps.Cli/Services/Models/VulnModels.cs` (291 lines)
+  - `src/Cli/StellaOps.Cli/Commands/Proof/FuncProofCommandGroup.cs` (289 lines)
+  - `src/Cli/StellaOps.Cli/Commands/Setup/Steps/SetupStepResults.cs` (287 lines)
+  - `src/Cli/StellaOps.Cli/Telemetry/SealedModeTelemetry.cs` (284 lines)
+  - `src/Cli/StellaOps.Cli/Commands/TimelineCommandGroup.cs` (283 lines)
+  - `src/Cli/StellaOps.Cli/Commands/Setup/Steps/Implementations/AuthoritySetupStep.cs` (283 lines)
+  - `src/Cli/StellaOps.Cli/Services/Models/SdkModels.cs` (282 lines)
+  - `src/Cli/StellaOps.Cli/Commands/FeedsCommandGroup.cs` (281 lines)
+  - `src/Cli/StellaOps.Cli/Services/Models/ForensicSnapshotModels.cs` (279 lines)
+  - `src/Cli/StellaOps.Cli/Plugins/CliCommandModuleLoader.cs` (278 lines)
+  - `src/Cli/StellaOps.Cli/Commands/Setup/Steps/Implementations/AgentsSetupStep.cs` (277 lines)
+  - `src/Cli/StellaOps.Cli/Services/RationaleClient.cs` (274 lines)
+  - `src/Cli/StellaOps.Cli/Commands/AgentCommandGroup.cs` (274 lines)
+  - `src/Cli/StellaOps.Cli/Telemetry/CliMetrics.cs` (274 lines)
+  - `src/Cli/StellaOps.Cli/Commands/WitnessCommandGroup.cs` (273 lines)
+  - `src/Cli/StellaOps.Cli/Commands/SealCommandGroup.cs` (270 lines)
+  - `src/Cli/StellaOps.Cli/Commands/Sources/SourcesCommandGroup.cs` (267 lines)
+  - `src/Cli/StellaOps.Cli/Commands/MigrateArtifactsCommand.cs` (266 lines)
+  - `src/Cli/StellaOps.Cli/Services/Models/VexExplainModels.cs` (264 lines)
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.VerifyImage.cs` (264 lines)
+  - `src/Cli/StellaOps.Cli/Services/SbomerClient.cs` (262 lines)
+  - `src/Cli/StellaOps.Cli/Commands/Slice/SliceCommandGroup.cs` (259 lines)
+  - `src/Cli/StellaOps.Cli/Commands/CiCommandGroup.cs` (258 lines)
+  - `src/Cli/StellaOps.Cli/Output/CliErrorRenderer.cs` (255 lines)
+  - `src/Cli/StellaOps.Cli/Services/Models/MirrorBundleModels.cs` (249 lines)
+  - `src/Cli/StellaOps.Cli/Commands/Scan/BinaryDiffRegistryAuth.cs` (247 lines)
+  - `src/Cli/StellaOps.Cli/Commands/SecretsCommandGroup.cs` (247 lines)
+  - `src/Cli/StellaOps.Cli/Commands/Setup/Steps/Implementations/DatabaseSetupStep.cs` (246 lines)
+  - `src/Cli/StellaOps.Cli/Commands/Setup/Steps/Implementations/CacheSetupStep.cs` (246 lines)
+  - `src/Cli/StellaOps.Cli/Commands/Agent/ConfigCommands.cs` (245 lines)
+  - `src/Cli/StellaOps.Cli/Commands/Setup/Steps/Implementations/EnvironmentsSetupStep.cs` (245 lines)
+  - `src/Cli/StellaOps.Cli/Commands/Proof/AnchorCommandGroup.cs` (244 lines)
+  - `src/Cli/StellaOps.Cli/Commands/SystemCommandBuilder.cs` (240 lines)
+  - `src/Cli/StellaOps.Cli/Commands/Agent/BootstrapCommands.cs` (237 lines)
+  - `src/Cli/StellaOps.Cli/Services/Chat/ChatClient.cs` (235 lines)
+  - `src/Cli/StellaOps.Cli/Commands/Setup/SetupCommandGroup.cs` (235 lines)
+  - `src/Cli/StellaOps.Cli/Services/VexObservationsClient.cs` (232 lines)
+  - `src/Cli/StellaOps.Cli/Commands/TimestampCommandGroup.cs` (231 lines)
+  - `src/Cli/StellaOps.Cli/Commands/Witness/WitnessCoreCommandGroup.cs` (231 lines)
+  - `src/Cli/StellaOps.Cli/Services/Models/AttestationModels.cs` (230 lines)
+  - `src/Cli/StellaOps.Cli/Configuration/StellaOpsCliOptions.cs` (230 lines)
+  - `src/Cli/StellaOps.Cli/Commands/Setup/Steps/Implementations/RegistrySetupStep.cs` (228 lines)
+  - `src/Cli/StellaOps.Cli/Commands/ToolsCommandGroup.cs` (226 lines)
+  - `src/Cli/StellaOps.Cli/Commands/Agent/DoctorCommands.cs` (224 lines)
+  - `src/Cli/StellaOps.Cli/Commands/Setup/Steps/Implementations/TelemetrySetupStep.cs` (224 lines)
+  - `src/Cli/StellaOps.Cli/Services/AuthorityRevocationClient.cs` (223 lines)
+  - `src/Cli/StellaOps.Cli/Commands/Setup/Config/ISetupConfigParser.cs` (223 lines)
+  - `src/Cli/StellaOps.Cli/Services/Models/ApiSpecModels.cs` (223 lines)
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.VerdictRationale.cs` (221 lines)
+  - `src/Cli/StellaOps.Cli/Services/TrustPolicyLoader.cs` (218 lines)
+  - `src/Cli/StellaOps.Cli/Replay/ReplayBundleStoreAdapter.cs` (212 lines)
+  - `src/Cli/StellaOps.Cli/Commands/GoldenSet/VerifyFixCommandGroup.cs` (208 lines)
+  - `src/Cli/StellaOps.Cli/Infrastructure/CommandGroupBuilder.cs` (208 lines)
+  - `src/Cli/StellaOps.Cli/Services/Models/AttestorTransportModels.cs` (207 lines)
+  - `src/Cli/StellaOps.Cli/Infrastructure/RouteMappingConfiguration.cs` (203 lines)
+  - `src/Cli/StellaOps.Cli/Services/DsseSignatureVerifier.cs` (200 lines)
+  - `src/Cli/StellaOps.Cli/Export/DeterministicExportUtilities.cs` (199 lines)
+  - `src/Cli/StellaOps.Cli/Telemetry/TraceparentHttpMessageHandler.cs` (193 lines)
+  - `src/Cli/StellaOps.Cli/Commands/Setup/Steps/Implementations/MigrationsSetupStep.cs` (190 lines)
+  - `src/Cli/StellaOps.Cli/Services/Models/RationaleModels.cs` (189 lines)
+  - `src/Cli/StellaOps.Cli/Services/Transport/OfflineTransport.cs` (186 lines)
+  - `src/Cli/StellaOps.Cli/Commands/Setup/Steps/Implementations/SetupStepBase.cs` (185 lines)
+  - `src/Cli/StellaOps.Cli/Services/Models/Transport/ProblemDocument.cs` (184 lines)
+  - `src/Cli/StellaOps.Cli/Commands/DriftExitCodes.cs` (182 lines)
+  - `src/Cli/StellaOps.Cli/Infrastructure/CommandRouter.cs` (179 lines)
+  - `src/Cli/StellaOps.Cli/Commands/Setup/Steps/SetupStepCatalog.cs` (179 lines)
+  - `src/Cli/StellaOps.Cli/Commands/ReachGraph/ReachGraphCommandGroup.cs` (179 lines)
+  - `src/Cli/StellaOps.Cli/Services/CryptoProfileValidator.cs` (175 lines)
+  - `src/Cli/StellaOps.Cli/Commands/Setup/State/ISetupStateStore.cs` (174 lines)
+  - `src/Cli/StellaOps.Cli/Audit/IAuditBundleService.cs` (172 lines)
+  - `src/Cli/StellaOps.Cli/Services/Transport/HttpTransport.cs` (166 lines)
+  - `src/Cli/StellaOps.Cli/Commands/OfflineCommandGroup.cs` (164 lines)
+  - `src/Cli/StellaOps.Cli/Services/CvssClient.cs` (164 lines)
+  - `src/Cli/StellaOps.Cli/Commands/Agent/UpdateCommands.cs` (163 lines)
+  - `src/Cli/StellaOps.Cli/Services/IBackendOperationsClient.cs` (155 lines)
+  - `src/Cli/StellaOps.Cli/Plugins/CliPluginManifestLoader.cs` (150 lines)
+  - `src/Cli/StellaOps.Cli/Commands/Proof/ReceiptCommandGroup.cs` (149 lines)
+  - `src/Cli/StellaOps.Cli/Services/Models/AdvisoryAi/AdvisoryAiModels.cs` (148 lines)
+  - `src/Cli/StellaOps.Cli/Services/OciImageReferenceParser.cs` (142 lines)
+  - `src/Cli/StellaOps.Cli/Services/TenantProfileStore.cs` (141 lines)
+  - `src/Cli/StellaOps.Cli/Infrastructure/DeprecationWarningService.cs` (137 lines)
+  - `src/Cli/StellaOps.Cli/Replay/TimelineQueryAdapter.cs` (134 lines)
+  - `src/Cli/StellaOps.Cli/Services/Models/SymbolBundleModels.cs` (130 lines)
+  - `src/Cli/StellaOps.Cli/Commands/Agent/CertificateCommands.cs` (128 lines)
+  - `src/Cli/StellaOps.Cli/Services/Models/AttestationBundleModels.cs` (126 lines)
+  - `src/Cli/StellaOps.Cli/Services/Transport/TransportFactory.cs` (126 lines)
+  - `src/Cli/StellaOps.Cli/Services/IPackClient.cs` (124 lines)
+  - `src/Cli/StellaOps.Cli/Services/MigrationCommandService.cs` (123 lines)
+  - `src/Cli/StellaOps.Cli/Services/AuthorityDiagnosticsReporter.cs` (123 lines)
+  - `src/Cli/StellaOps.Cli/Services/FileBundleVersionStore.cs` (120 lines)
+  - `src/Cli/StellaOps.Cli/Services/Models/AdvisoryObservationsModels.cs` (117 lines)
+  - `src/Cli/StellaOps.Cli/Extensions/StellaOpsTokenClientExtensions.cs` (115 lines)
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.ExportCache.cs` (113 lines)
+  - `src/Cli/StellaOps.Cli/Services/AuthorityConsoleClient.cs` (112 lines)
+  - `src/Cli/StellaOps.Cli/Services/Models/OfflineKitModels.cs` (111 lines)
+  - `src/Cli/StellaOps.Cli/Output/IOutputRenderer.cs` (109 lines)
+  - `src/Cli/StellaOps.Cli/Commands/Setup/Steps/SetupStepContext.cs` (108 lines)
+  - `src/Cli/StellaOps.Cli/Output/IOutputWriter.cs` (107 lines)
+  - `src/Cli/StellaOps.Cli/Services/Models/Transport/PolicyFindingsTransport.cs` (106 lines)
+  - `src/Cli/StellaOps.Cli/Services/Models/Transport/OfflineKitTransport.cs` (103 lines)
+  - `src/Cli/StellaOps.Cli/Services/Models/OciModels.cs` (103 lines)
+  - `src/Cli/StellaOps.Cli/Services/IOrchestratorClient.cs` (102 lines)
+- Service locator matches:
+  - `src/Cli/StellaOps.Cli/Configuration/HttpClientBuilderExtensions.cs`:19 var policy = sp.GetService<IEgressPolicy>();
+  - `src/Cli/StellaOps.Cli/Commands/AttestCommandGroup.cs`:568 var policyEvaluator = services.GetService<StellaOps.Policy.Interop.Abstractions.IPolicyEvaluator>();
+  - `src/Cli/StellaOps.Cli/Program.cs`:359 await using var serviceProvider = services.BuildServiceProvider();
+  - `src/Cli/StellaOps.Cli/Commands/Advise/AdviseChatCommandGroup.cs`:748 var client = services.GetService<IChatClient>();
+  - `src/Cli/StellaOps.Cli/Commands/Advise/AdviseChatCommandGroup.cs`:755 var httpClientFactory = services.GetService<IHttpClientFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/ChangeTraceCommandGroup.cs`:84 var builder = services.GetService(typeof(IChangeTraceBuilder)) as IChangeTraceBuilder
+  - `src/Cli/StellaOps.Cli/Commands/BundleExportCommand.cs`:140 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/Budget/RiskBudgetCommandGroup.cs`:359 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/Budget/RiskBudgetCommandGroup.cs`:361 var httpClientFactory = services.GetService<IHttpClientFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/Budget/RiskBudgetCommandGroup.cs`:422 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/Budget/RiskBudgetCommandGroup.cs`:424 var httpClientFactory = services.GetService<IHttpClientFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/Budget/RiskBudgetCommandGroup.cs`:484 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/Budget/RiskBudgetCommandGroup.cs`:486 var httpClientFactory = services.GetService<IHttpClientFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/Budget/RiskBudgetCommandGroup.cs`:552 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/Budget/RiskBudgetCommandGroup.cs`:554 var httpClientFactory = services.GetService<IHttpClientFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/Budget/RiskBudgetCommandGroup.cs`:613 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/Budget/RiskBudgetCommandGroup.cs`:615 var httpClientFactory = services.GetService<IHttpClientFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/CheckpointCommands.cs`:187 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/CheckpointCommands.cs`:271 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/BundleVerifyCommand.cs`:161 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/Binary/BinaryCommandHandlers.cs`:598 GeneratedAt = (services.GetService<TimeProvider>() ?? TimeProvider.System).GetUtcNow().ToString("O", CultureInfo.InvariantCulture)
+  - `src/Cli/StellaOps.Cli/Commands/Binary/BinaryCommandHandlers.cs`:666 var timeProvider = services.GetService<TimeProvider>() ?? TimeProvider.System;
+  - `src/Cli/StellaOps.Cli/Commands/Binary/BinaryCommandHandlers.cs`:677 var timeProvider = services.GetService<TimeProvider>() ?? TimeProvider.System;
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.AirGap.cs`:137 var exporter = scope.ServiceProvider.GetService<IAirGapBundleExporter>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.AirGap.cs`:228 var importer = scope.ServiceProvider.GetService<IAirGapBundleImporter>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.AirGap.cs`:310 var syncService = scope.ServiceProvider.GetService<IAirGapSyncService>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.AirGap.cs`:395 var transport = scope.ServiceProvider.GetService<IJobSyncTransport>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.Audit.cs`:44 var loggerFactory = scope.ServiceProvider.GetRequiredService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.Audit.cs`:46 var options = scope.ServiceProvider.GetRequiredService<StellaOpsCliOptions>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.Audit.cs`:64 var builder = scope.ServiceProvider.GetService<IAuditPackBuilder>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.Audit.cs`:135 var loggerFactory = scope.ServiceProvider.GetRequiredService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.Audit.cs`:137 var options = scope.ServiceProvider.GetRequiredService<StellaOpsCliOptions>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.Audit.cs`:165 var importer = scope.ServiceProvider.GetService<IAuditPackImporter>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.Audit.cs`:166 var replayer = scope.ServiceProvider.GetService<IAuditPackReplayer>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.Audit.cs`:250 var loggerFactory = scope.ServiceProvider.GetRequiredService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.Audit.cs`:272 var importer = scope.ServiceProvider.GetService<IAuditPackImporter>();
+  - `src/Cli/StellaOps.Cli/Commands/Binary/DeltaSigCommandGroup.cs`:587 var rekorClient = services.GetService<IRekorClient>();
+  - `src/Cli/StellaOps.Cli/Commands/Binary/DeltaSigCommandGroup.cs`:777 var gate = services.GetService<IDeltaScopePolicyGate>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.Federation.cs`:38 var httpClientFactory = services.GetService<IHttpClientFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.Federation.cs`:173 var httpClientFactory = services.GetService<IHttpClientFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.Federation.cs`:286 var httpClientFactory = services.GetService<IHttpClientFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.Federation.cs`:419 var httpClientFactory = services.GetService<IHttpClientFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.Federation.cs`:546 var httpClientFactory = services.GetService<IHttpClientFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.Federation.cs`:642 var httpClientFactory = services.GetService<IHttpClientFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.Federation.cs`:741 var httpClientFactory = services.GetService<IHttpClientFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.Image.cs`:27 var loggerFactory = scope.ServiceProvider.GetRequiredService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.Image.cs`:29 var options = scope.ServiceProvider.GetRequiredService<StellaOpsCliOptions>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.Image.cs`:73 var inspector = scope.ServiceProvider.GetRequiredService<IOciImageInspector>();
+  - `src/Cli/StellaOps.Cli/Services/CryptoProfileValidator.cs`:39 var registry = serviceProvider.GetService<ICryptoProviderRegistry>();
+  - `src/Cli/StellaOps.Cli/Services/CryptoProfileValidator.cs`:48 var optionsMonitor = serviceProvider.GetService<IOptionsMonitor<CryptoProviderRegistryOptions>>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.Sign.cs`:66 var sigstoreService = services.GetService<ISigstoreSigningService>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.Sign.cs`:183 var sigstoreService = services.GetService<ISigstoreSigningService>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.Feeds.cs`:41 var httpClientFactory = services.GetService<IHttpClientFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.Feeds.cs`:139 var httpClientFactory = services.GetService<IHttpClientFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.Feeds.cs`:229 var httpClientFactory = services.GetService<IHttpClientFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.Feeds.cs`:334 var httpClientFactory = services.GetService<IHttpClientFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.Feeds.cs`:413 var httpClientFactory = services.GetService<IHttpClientFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.VerdictRationale.cs`:39 var loggerFactory = scope.ServiceProvider.GetRequiredService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.VerdictRationale.cs`:41 var options = scope.ServiceProvider.GetRequiredService<StellaOpsCliOptions>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.VerdictRationale.cs`:63 var rationaleClient = scope.ServiceProvider.GetRequiredService<IRationaleClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.Secrets.cs`:39 var logger = services.GetService<ILoggerFactory>()?.CreateLogger("Secrets.Bundle.Create");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.Secrets.cs`:65 var builderLogger = services.GetService<ILoggerFactory>()?.CreateLogger<BundleBuilder>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.Secrets.cs`:66 var validatorLogger = services.GetService<ILoggerFactory>()?.CreateLogger<RuleValidator>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.Secrets.cs`:124 var signerLogger = services.GetService<ILoggerFactory>()?.CreateLogger<BundleSigner>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.Secrets.cs`:219 var verifierLogger = services.GetService<ILoggerFactory>()?.CreateLogger<BundleVerifier>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.Offline.cs`:42 var options = scope.ServiceProvider.GetRequiredService<StellaOpsCliOptions>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.Offline.cs`:43 var loggerFactory = scope.ServiceProvider.GetRequiredService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.Offline.cs`:45 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.Offline.cs`:856 var options = scope.ServiceProvider.GetRequiredService<StellaOpsCliOptions>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.Offline.cs`:857 var loggerFactory = scope.ServiceProvider.GetRequiredService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.Offline.cs`:859 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.VerifyBundle.cs`:37 var loggerFactory = scope.ServiceProvider.GetRequiredService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.VerifyImage.cs`:34 var loggerFactory = scope.ServiceProvider.GetRequiredService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.VerifyImage.cs`:36 var options = scope.ServiceProvider.GetRequiredService<StellaOpsCliOptions>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.VerifyImage.cs`:65 var verifier = scope.ServiceProvider.GetRequiredService<IImageAttestationVerifier>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.VerdictVerify.cs`:42 var loggerFactory = scope.ServiceProvider.GetRequiredService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.VerdictVerify.cs`:44 var options = scope.ServiceProvider.GetRequiredService<StellaOpsCliOptions>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.VerdictVerify.cs`:65 var verifier = scope.ServiceProvider.GetRequiredService<IVerdictAttestationVerifier>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.VerdictVerify.cs`:101 var loggerFactory = scope.ServiceProvider.GetRequiredService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.VerdictVerify.cs`:103 var options = scope.ServiceProvider.GetRequiredService<StellaOpsCliOptions>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.VerdictVerify.cs`:124 var verifier = scope.ServiceProvider.GetRequiredService<IVerdictAttestationVerifier>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.VerdictVerify.cs`:157 var loggerFactory = scope.ServiceProvider.GetRequiredService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.VerdictVerify.cs`:159 var options = scope.ServiceProvider.GetRequiredService<StellaOpsCliOptions>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.VerdictVerify.cs`:195 var verifier = scope.ServiceProvider.GetRequiredService<IVerdictAttestationVerifier>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.VerifyOffline.cs`:28 var loggerFactory = scope.ServiceProvider.GetRequiredService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.VerifyOffline.cs`:30 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.Witness.cs`:47 var client = scope.ServiceProvider.GetRequiredService<IBackendOperationsClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.Witness.cs`:107 var client = scope.ServiceProvider.GetRequiredService<IBackendOperationsClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.Witness.cs`:168 var client = scope.ServiceProvider.GetRequiredService<IBackendOperationsClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.Witness.cs`:230 var client = scope.ServiceProvider.GetRequiredService<IBackendOperationsClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:95 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:114 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("cvss-score");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:115 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:131 var engine = scope.ServiceProvider.GetRequiredService<ICvssV4Engine>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:134 var client = scope.ServiceProvider.GetRequiredService<ICvssClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:184 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("cvss-show");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:185 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:190 var client = scope.ServiceProvider.GetRequiredService<ICvssClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:229 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("cvss-history");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:230 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:235 var client = scope.ServiceProvider.GetRequiredService<ICvssClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:273 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("cvss-export");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:274 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:279 var client = scope.ServiceProvider.GetRequiredService<ICvssClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:348 var client = scope.ServiceProvider.GetRequiredService<IBackendOperationsClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:349 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("scanner-download");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:350 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:377 var installer = scope.ServiceProvider.GetRequiredService<IScannerInstaller>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:408 var client = scope.ServiceProvider.GetRequiredService<IBackendOperationsClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:409 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("task-runner-simulate");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:410 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:663 var executor = scope.ServiceProvider.GetRequiredService<IScannerExecutor>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:664 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("scanner-run");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:665 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:677 var options = scope.ServiceProvider.GetRequiredService<StellaOpsCliOptions>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:694 var backend = scope.ServiceProvider.GetRequiredService<IBackendOperationsClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:735 var client = scope.ServiceProvider.GetRequiredService<IBackendOperationsClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:736 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("scan-sarif");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:737 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:854 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("scan-replay");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:855 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:1018 var client = scope.ServiceProvider.GetRequiredService<IBackendOperationsClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:1019 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("scanner-upload");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:1020 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:1055 var client = scope.ServiceProvider.GetRequiredService<IBackendOperationsClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:1056 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("scan-entrytrace");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:1057 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:1111 var client = scope.ServiceProvider.GetRequiredService<IBackendOperationsClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:1112 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("advise-run");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:1113 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:1349 var client = scope.ServiceProvider.GetRequiredService<IBackendOperationsClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:1350 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("sources-ingest");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:1351 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:1467 var client = scope.ServiceProvider.GetRequiredService<IBackendOperationsClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:1468 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("aoc-verify");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:1469 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:1596 var client = scope.ServiceProvider.GetRequiredService<IBackendOperationsClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:1597 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("db-connector");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:1598 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:1639 var client = scope.ServiceProvider.GetRequiredService<IBackendOperationsClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:1640 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("db-merge");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:1641 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:1675 var client = scope.ServiceProvider.GetRequiredService<IBackendOperationsClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:1676 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("db-export");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:1677 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:1859 var client = scope.ServiceProvider.GetRequiredService<IBackendOperationsClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:1860 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("excititor-list-providers");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:1861 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:1929 var client = scopeHandle.ServiceProvider.GetRequiredService<IBackendOperationsClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:1930 var logger = scopeHandle.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("excititor-export");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:1931 var options = scopeHandle.ServiceProvider.GetRequiredService<StellaOpsCliOptions>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:1932 var verbosity = scopeHandle.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:2282 var client = scope.ServiceProvider.GetRequiredService<IBackendOperationsClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:2283 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("runtime-policy-test");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:2284 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:2379 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("auth-login");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:2389 var tokenClient = scope.ServiceProvider.GetService<IStellaOpsTokenClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:2459 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("auth-logout");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:2462 var tokenClient = scope.ServiceProvider.GetService<IStellaOpsTokenClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:2490 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("auth-status");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:2500 var tokenClient = scope.ServiceProvider.GetService<IStellaOpsTokenClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:2538 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("auth-whoami");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:2548 var tokenClient = scope.ServiceProvider.GetService<IStellaOpsTokenClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:2642 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("auth-revoke-export");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:2647 var client = scope.ServiceProvider.GetRequiredService<IAuthorityRevocationClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:2868 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("tenants-list");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:2878 var client = scope.ServiceProvider.GetService<IAuthorityConsoleClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:2958 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("tenants-use");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:2973 var client = scope.ServiceProvider.GetService<IAuthorityConsoleClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:3105 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("token-mint");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:3115 var client = scope.ServiceProvider.GetService<IAuthorityConsoleClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:3194 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("token-delegate");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:3204 var client = scope.ServiceProvider.GetService<IAuthorityConsoleClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:3330 var client = scope.ServiceProvider.GetRequiredService<IConcelierObservationsClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:3331 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("vuln-observations");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:3332 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:3496 var client = scope.ServiceProvider.GetRequiredService<IBackendOperationsClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:3497 var options = scope.ServiceProvider.GetRequiredService<StellaOpsCliOptions>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:3498 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("offline-kit-pull");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:3499 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:3572 var client = scope.ServiceProvider.GetRequiredService<IBackendOperationsClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:3573 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("policy-findings-ls");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:3574 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:3711 var client = scope.ServiceProvider.GetRequiredService<IBackendOperationsClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:3712 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("policy-findings-get");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:3713 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:3792 var client = scope.ServiceProvider.GetRequiredService<IBackendOperationsClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:3793 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("policy-findings-explain");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:3794 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:3883 var client = scope.ServiceProvider.GetRequiredService<IBackendOperationsClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:3884 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("policy-activate");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:3885 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:4009 var client = scope.ServiceProvider.GetRequiredService<IBackendOperationsClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:4010 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("policy-simulate");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:4011 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:4222 var client = scope.ServiceProvider.GetRequiredService<IBackendOperationsClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:4223 var options = scope.ServiceProvider.GetRequiredService<StellaOpsCliOptions>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:4224 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("offline-kit-import");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:4225 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:4360 var client = scope.ServiceProvider.GetRequiredService<IBackendOperationsClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:4361 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("offline-kit-status");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:4362 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:4833 var client = scope.ServiceProvider.GetRequiredService<IBackendOperationsClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:4834 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger(commandName.Replace(' ', '-'));
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:4835 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:7793 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("kms-export");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:7794 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:7872 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("kms-import");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:7873 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:8337 var loggerFactory = scope.ServiceProvider.GetRequiredService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:8339 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:8347 var registry = scope.ServiceProvider.GetService<ICryptoProviderRegistry>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:8355 var optionsMonitor = scope.ServiceProvider.GetService<IOptionsMonitor<CryptoProviderRegistryOptions>>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:8482 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger(loggerCategory);
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:8483 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:8608 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("ruby-inspect");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:8609 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:8696 var client = scope.ServiceProvider.GetRequiredService<IBackendOperationsClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:8697 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("ruby-resolve");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:8698 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:8792 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("php-inspect");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:8793 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:8882 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("python-inspect");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:8883 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:8990 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("bun-inspect");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:8991 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:9078 var client = scope.ServiceProvider.GetRequiredService<IBackendOperationsClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:9079 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("bun-resolve");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:9080 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:11404 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:11788 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:12322 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:15093 var client = scope.ServiceProvider.GetRequiredService<IBackendOperationsClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:15094 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("vex-consensus");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:15095 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:15266 var client = scope.ServiceProvider.GetRequiredService<IBackendOperationsClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:15267 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("vex-consensus");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:15268 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:15702 var client = scope.ServiceProvider.GetRequiredService<IBackendOperationsClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:15703 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("vex-simulate");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:15704 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:15916 var client = scope.ServiceProvider.GetRequiredService<IBackendOperationsClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:15917 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("vex-export");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:15918 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:16026 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("vex-verify");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:16027 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:16173 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("vex-explain");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:16174 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:16485 var client = scope.ServiceProvider.GetRequiredService<IVexObservationsClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:16486 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("vex-obs");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:16487 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:16622 var client = scope.ServiceProvider.GetRequiredService<IVexObservationsClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:16623 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("vex-linkset");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:16624 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:16829 var client = scope.ServiceProvider.GetRequiredService<IBackendOperationsClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:16830 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("vuln-list");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:16831 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:17024 var client = scope.ServiceProvider.GetRequiredService<IBackendOperationsClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:17025 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("vuln-show");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:17026 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:17284 var client = scope.ServiceProvider.GetRequiredService<IBackendOperationsClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:17285 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("vuln-workflow");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:17286 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:17469 var client = scope.ServiceProvider.GetRequiredService<IBackendOperationsClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:17470 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("vuln-simulate");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:17471 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:17676 var client = scope.ServiceProvider.GetRequiredService<IBackendOperationsClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:17677 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("vuln-export");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:17678 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:17791 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("vuln-export-verify");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:17792 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:17945 var client = scope.ServiceProvider.GetRequiredService<IConcelierObservationsClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:17946 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("advisory-obs");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:17947 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:18311 var client = scope.ServiceProvider.GetRequiredService<IConcelierObservationsClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:18312 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("advisory-linkset");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:18313 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:18496 var client = scope.ServiceProvider.GetRequiredService<IConcelierObservationsClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:18497 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("advisory-export");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:18498 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:18732 var client = scope.ServiceProvider.GetRequiredService<IForensicSnapshotClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:18733 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("forensic-snapshot");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:18734 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:18846 var client = scope.ServiceProvider.GetRequiredService<IForensicSnapshotClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:18847 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("forensic-snapshot");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:18848 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:18958 var client = scope.ServiceProvider.GetRequiredService<IForensicSnapshotClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:18959 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("forensic-snapshot");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:18960 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:19235 var verifier = scope.ServiceProvider.GetRequiredService<IForensicVerifier>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:19236 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("forensic-verify");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:19237 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:19454 var reader = scope.ServiceProvider.GetRequiredService<IAttestationReader>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:19455 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("forensic-attest");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:19456 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:19730 var assembler = scope.ServiceProvider.GetRequiredService<IPromotionAssembler>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:19731 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("promotion-assemble");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:19732 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:19921 var assembler = scope.ServiceProvider.GetRequiredService<IPromotionAssembler>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:19922 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("promotion-attest");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:19923 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:20070 var assembler = scope.ServiceProvider.GetRequiredService<IPromotionAssembler>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:20071 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("promotion-verify");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:20072 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:20320 var harness = scope.ServiceProvider.GetRequiredService<IDeterminismHarness>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:20321 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("detscore-run");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:20322 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:20591 var harness = scope.ServiceProvider.GetRequiredService<IDeterminismHarness>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:20592 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("detscore-report");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:20593 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:20794 var client = scope.ServiceProvider.GetRequiredService<IObservabilityClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:20795 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("obs-top");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:20796 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:21111 var client = scope.ServiceProvider.GetRequiredService<IObservabilityClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:21112 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("obs-trace");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:21113 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:21277 var client = scope.ServiceProvider.GetRequiredService<IObservabilityClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:21278 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("obs-logs");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:21279 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:21458 var client = scope.ServiceProvider.GetRequiredService<IObservabilityClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:21459 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("obs-incident-mode");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:21460 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:21543 var client = scope.ServiceProvider.GetRequiredService<IObservabilityClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:21544 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("obs-incident-mode");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:21545 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:21630 var client = scope.ServiceProvider.GetRequiredService<IObservabilityClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:21631 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("obs-incident-mode");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:21632 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:21766 var client = scope.ServiceProvider.GetRequiredService<IPackClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:21767 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("pack-plan");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:21768 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:21894 var client = scope.ServiceProvider.GetRequiredService<IPackClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:21895 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("pack-run");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:21896 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:22035 var client = scope.ServiceProvider.GetRequiredService<IPackClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:22036 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("pack-push");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:22037 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:22135 var client = scope.ServiceProvider.GetRequiredService<IPackClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:22136 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("pack-pull");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:22137 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:22232 var client = scope.ServiceProvider.GetRequiredService<IPackClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:22233 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("pack-verify");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:22234 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:28255 var client = scope.ServiceProvider.GetRequiredService<IBackendOperationsClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:28256 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("risk-profile-list");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:28257 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:28364 var client = scope.ServiceProvider.GetRequiredService<IBackendOperationsClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:28365 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("risk-simulate");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:28366 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:28574 var client = scope.ServiceProvider.GetRequiredService<IBackendOperationsClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:28575 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("risk-results");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:28576 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:28749 var client = scope.ServiceProvider.GetRequiredService<IBackendOperationsClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:28750 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("risk-bundle-verify");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:28751 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:28907 var client = scope.ServiceProvider.GetRequiredService<IBackendOperationsClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:28908 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("reachability-upload");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:28909 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:29039 var client = scope.ServiceProvider.GetRequiredService<IBackendOperationsClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:29040 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("reachability-list");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:29041 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:29153 var client = scope.ServiceProvider.GetRequiredService<IBackendOperationsClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:29154 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("reachability-explain");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:29155 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:29338 var client = scope.ServiceProvider.GetRequiredService<IBackendOperationsClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:29339 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("graph-explain");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:29340 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:29647 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("graph-verify");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:29648 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:29798 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("graph-bundles");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:29799 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:29925 var client = scope.ServiceProvider.GetRequiredService<IBackendOperationsClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:29926 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("api-spec-list");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:29927 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:30054 var client = scope.ServiceProvider.GetRequiredService<IBackendOperationsClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:30055 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("api-spec-download");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:30056 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:30181 var client = scope.ServiceProvider.GetRequiredService<IBackendOperationsClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:30182 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("sdk-update");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:30183 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:30343 var client = scope.ServiceProvider.GetRequiredService<IBackendOperationsClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:30344 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("sdk-list");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:30345 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:30462 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("mirror-create");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:30463 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:30718 var loggerFactory = scope.ServiceProvider.GetRequiredService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:30970 var importService = scope.ServiceProvider.GetService<IMirrorBundleImportService>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:31078 var loggerFactory = scope.ServiceProvider.GetRequiredService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:31910 var loggerFactory = scope.ServiceProvider.GetRequiredService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:32017 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("decision-export");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:32018 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:32041 var client = scope.ServiceProvider.GetRequiredService<BackendOperationsClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:32131 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("decision-verify");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:32132 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:32341 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("decision-compare");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:32342 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:33425 var verifier = services.GetService<IDsseSignatureVerifier>();
+  - `src/Cli/StellaOps.Cli/Commands/Compare/CompareCommandBuilder.cs`:93 var renderer = services.GetService<IOutputRenderer>() ?? new OutputRenderer();
+  - `src/Cli/StellaOps.Cli/Commands/Compare/CompareCommandBuilder.cs`:94 var client = services.GetService<ICompareClient>()
+  - `src/Cli/StellaOps.Cli/Commands/Compare/CompareCommandBuilder.cs`:125 var renderer = services.GetService<IOutputRenderer>() ?? new OutputRenderer();
+  - `src/Cli/StellaOps.Cli/Commands/Compare/CompareCommandBuilder.cs`:126 var client = services.GetService<ICompareClient>()
+  - `src/Cli/StellaOps.Cli/Commands/Compare/CompareCommandBuilder.cs`:146 var client = services.GetService<ICompareClient>()
+  - `src/Cli/StellaOps.Cli/Commands/Compare/CompareCommandBuilder.cs`:175 var renderer = services.GetService<IOutputRenderer>() ?? new OutputRenderer();
+  - `src/Cli/StellaOps.Cli/Commands/Compare/CompareCommandBuilder.cs`:176 var client = services.GetService<ICompareClient>()
+  - `src/Cli/StellaOps.Cli/Commands/HlcCommandGroup.cs`:101 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/DbCommandGroup.cs`:102 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/DbCommandGroup.cs`:117 var httpClientFactory = services.GetService<IHttpClientFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/DbCommandGroup.cs`:550 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/EvidenceCommandGroup.cs`:773 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/DoctorCommandGroup.cs`:880 var environment = services.GetService<IHostEnvironment>();
+  - `src/Cli/StellaOps.Cli/Commands/GuardCommandGroup.cs`:225 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/GuardCommandGroup.cs`:400 var httpClientFactory = services.GetService<IHttpClientFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/DriftCommandGroup.cs`:108 var logger = scope.ServiceProvider.GetService<ILoggerFactory>()?.CreateLogger("drift")
+  - `src/Cli/StellaOps.Cli/Commands/DriftCommandGroup.cs`:110 var timeProvider = scope.ServiceProvider.GetService<TimeProvider>() ?? TimeProvider.System;
+  - `src/Cli/StellaOps.Cli/Commands/DriftCommandGroup.cs`:114 var driftDetector = scope.ServiceProvider.GetService<IFacetDriftDetector>();
+  - `src/Cli/StellaOps.Cli/Commands/DriftCommandGroup.cs`:115 var sealStore = scope.ServiceProvider.GetService<IFacetSealStore>();
+  - `src/Cli/StellaOps.Cli/Commands/ExplainCommandGroup.cs`:232 var logger = services.GetService<ILoggerFactory>()?.CreateLogger(typeof(ExplainCommandGroup));
+  - `src/Cli/StellaOps.Cli/Commands/ExplainCommandGroup.cs`:233 var options = services.GetService<StellaOpsCliOptions>();
+  - `src/Cli/StellaOps.Cli/Commands/ExplainCommandGroup.cs`:236 var httpClientFactory = services.GetService<IHttpClientFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/ExceptionCommandGroup.cs`:388 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/ExceptionCommandGroup.cs`:504 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/ExceptionCommandGroup.cs`:592 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/ExceptionCommandGroup.cs`:679 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/ExceptionCommandGroup.cs`:748 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/ExceptionCommandGroup.cs`:812 var httpClientFactory = services.GetService<IHttpClientFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/GroundTruthCommandGroup.cs`:190 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/GroundTruthCommandGroup.cs`:225 var exportService = services.GetService<IBundleExportService>();
+  - `src/Cli/StellaOps.Cli/Commands/GroundTruthCommandGroup.cs`:509 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/GroundTruthCommandGroup.cs`:533 var importService = services.GetService<IBundleImportService>();
+  - `src/Cli/StellaOps.Cli/Commands/GroundTruthCommandGroup.cs`:828 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/GroundTruthCommandGroup.cs`:844 var regressionService = services.GetService<IKpiRegressionService>();
+  - `src/Cli/StellaOps.Cli/Commands/GroundTruthCommandGroup.cs`:963 var regressionService = services.GetService<IKpiRegressionService>();
+  - `src/Cli/StellaOps.Cli/Commands/GroundTruthCommandGroup.cs`:1496 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/GroundTruthCommandGroup.cs`:1509 var regressionService = services.GetService<IKpiRegressionService>();
+  - `src/Cli/StellaOps.Cli/Commands/ExportCommandGroup.cs`:302 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/GateCommandGroup.cs`:227 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/GateCommandGroup.cs`:273 var httpClientFactory = services.GetService<IHttpClientFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/GitHubCommandGroup.cs`:735 var client = services.GetService<IGitHubCodeScanningClient>();
+  - `src/Cli/StellaOps.Cli/Commands/LayerSbomCommandGroup.cs`:190 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/LayerSbomCommandGroup.cs`:259 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/LayerSbomCommandGroup.cs`:333 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/LayerSbomCommandGroup.cs`:576 var httpClientFactory = services.GetService<IHttpClientFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/PatchVerifyCommandGroup.cs`:150 var loggerFactory = scope.ServiceProvider.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/PatchVerifyCommandGroup.cs`:185 var orchestrator = scope.ServiceProvider.GetService<IPatchVerificationOrchestrator>();
+  - `src/Cli/StellaOps.Cli/Commands/ReachabilityCommandGroup.cs`:151 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/ReachabilityCommandGroup.cs`:385 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/ReachabilityCommandGroup.cs`:453 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/ProvCommandGroup.cs`:242 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/ProvCommandGroup.cs`:261 var exporter = services.GetService<IMinimalProofExporter>();
+  - `src/Cli/StellaOps.Cli/Commands/ProvCommandGroup.cs`:316 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/ProvCommandGroup.cs`:332 var exporter = services.GetService<IMinimalProofExporter>();
+  - `src/Cli/StellaOps.Cli/Commands/ProvCommandGroup.cs`:411 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/ProvCommandGroup.cs`:427 var exporter = services.GetService<IMinimalProofExporter>();
+  - `src/Cli/StellaOps.Cli/Commands/ProveCommandGroup.cs`:118 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/ProveCommandGroup.cs`:171 var timelineAdapter = services.GetService<ITimelineQueryAdapter>();
+  - `src/Cli/StellaOps.Cli/Commands/ProveCommandGroup.cs`:200 var timelineAdapter = services.GetService<ITimelineQueryAdapter>();
+  - `src/Cli/StellaOps.Cli/Commands/ProveCommandGroup.cs`:223 var bundleStore = services.GetService<IReplayBundleStoreAdapter>();
+  - `src/Cli/StellaOps.Cli/Commands/Observations/ObservationsCommandGroup.cs`:223 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/Observations/ObservationsCommandGroup.cs`:281 var store = services.GetService<IRuntimeObservationStore>();
+  - `src/Cli/StellaOps.Cli/Commands/FunctionMap/FunctionMapCommandGroup.cs`:207 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/FunctionMap/FunctionMapCommandGroup.cs`:241 var generator = services.GetService<IFunctionMapGenerator>();
+  - `src/Cli/StellaOps.Cli/Commands/FunctionMap/FunctionMapCommandGroup.cs`:313 var signer = services.GetService<StellaOps.Provenance.Attestation.ISigner>();
+  - `src/Cli/StellaOps.Cli/Commands/FunctionMap/FunctionMapCommandGroup.cs`:365 var rekorClient = services.GetService<StellaOps.Attestor.Core.Rekor.IRekorClient>();
+  - `src/Cli/StellaOps.Cli/Commands/FunctionMap/FunctionMapCommandGroup.cs`:688 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/FunctionMap/FunctionMapCommandGroup.cs`:779 var verifier = services.GetService<IClaimVerifier>();
+  - `src/Cli/StellaOps.Cli/Commands/ReplayCommandGroup.cs`:516 var replayEngine = services?.GetService<IReplayEngine>();
+  - `src/Cli/StellaOps.Cli/Commands/ReplayCommandGroup.cs`:617 // var verdictStore = services?.GetService<IVerdictStore>();
+  - `src/Cli/StellaOps.Cli/Commands/ScanGraphCommandGroup.cs`:146 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/ScanGraphCommandGroup.cs`:450 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/ScanGraphCommandGroup.cs`:452 var httpClientFactory = services.GetService<IHttpClientFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/ScoreGateCommandGroup.cs`:498 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/ScoreGateCommandGroup.cs`:567 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/ScoreGateCommandGroup.cs`:650 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/ScoreGateCommandGroup.cs`:941 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/ScoreGateCommandGroup.cs`:1059 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/ScoreGateCommandGroup.cs`:1208 var httpClientFactory = services.GetService<IHttpClientFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/ScoreReplayCommandGroup.cs`:115 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/ScoreReplayCommandGroup.cs`:139 var httpClientFactory = services.GetService<IHttpClientFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/ScoreReplayCommandGroup.cs`:560 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/ScoreReplayCommandGroup.cs`:562 var httpClientFactory = services.GetService<IHttpClientFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/ScoreReplayCommandGroup.cs`:658 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/ScoreReplayCommandGroup.cs`:660 var httpClientFactory = services.GetService<IHttpClientFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/ScoreReplayCommandGroup.cs`:742 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/ScoreReplayCommandGroup.cs`:744 var httpClientFactory = services.GetService<IHttpClientFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/Proof/ProofCommandGroup.cs`:135 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/Proof/ProofCommandGroup.cs`:166 var verifier = services.GetService<IAttestationBundleVerifier>();
+  - `src/Cli/StellaOps.Cli/Commands/Proof/ProofCommandGroup.cs`:171 services.GetService<ILogger<AttestationBundleVerifier>>()
+  - `src/Cli/StellaOps.Cli/Commands/Proof/ProofCommandGroup.cs`:243 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/SealCommandGroup.cs`:121 var logger = scope.ServiceProvider.GetService<ILoggerFactory>()?.CreateLogger("seal")
+  - `src/Cli/StellaOps.Cli/Commands/SealCommandGroup.cs`:123 var timeProvider = scope.ServiceProvider.GetService<TimeProvider>() ?? TimeProvider.System;
+  - `src/Cli/StellaOps.Cli/Commands/SealCommandGroup.cs`:127 var facetExtractor = scope.ServiceProvider.GetService<IFacetExtractor>();
+  - `src/Cli/StellaOps.Cli/Commands/SealCommandGroup.cs`:128 var sealStore = scope.ServiceProvider.GetService<IFacetSealStore>();
+  - `src/Cli/StellaOps.Cli/Commands/SealCommandGroup.cs`:129 var sealer = scope.ServiceProvider.GetService<FacetSealer>();
+  - `src/Cli/StellaOps.Cli/Commands/ScoreCommandGroup.cs`:494 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/ScoreCommandGroup.cs`:604 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/ScoreCommandGroup.cs`:690 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/ScoreCommandGroup.cs`:781 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/ScoreCommandGroup.cs`:911 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/ScoreCommandGroup.cs`:993 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/ScoreCommandGroup.cs`:1433 var httpClientFactory = services.GetService<IHttpClientFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/Scan/DeltaScanCommandGroup.cs`:168 var evidenceComposer = services.GetService<IDeltaEvidenceComposer>();
+  - `src/Cli/StellaOps.Cli/Commands/UnknownsCommandGroup.cs`:529 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/UnknownsCommandGroup.cs`:531 var httpClientFactory = services.GetService<IHttpClientFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/UnknownsCommandGroup.cs`:658 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/UnknownsCommandGroup.cs`:660 var httpClientFactory = services.GetService<IHttpClientFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/UnknownsCommandGroup.cs`:711 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/UnknownsCommandGroup.cs`:713 var httpClientFactory = services.GetService<IHttpClientFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/UnknownsCommandGroup.cs`:763 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/UnknownsCommandGroup.cs`:765 var httpClientFactory = services.GetService<IHttpClientFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/UnknownsCommandGroup.cs`:830 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/UnknownsCommandGroup.cs`:832 var httpClientFactory = services.GetService<IHttpClientFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/UnknownsCommandGroup.cs`:944 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/UnknownsCommandGroup.cs`:946 var httpClientFactory = services.GetService<IHttpClientFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/UnknownsCommandGroup.cs`:1015 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/UnknownsCommandGroup.cs`:1017 var httpClientFactory = services.GetService<IHttpClientFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/UnknownsCommandGroup.cs`:1145 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/UnknownsCommandGroup.cs`:1147 var httpClientFactory = services.GetService<IHttpClientFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/UnknownsCommandGroup.cs`:1218 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/UnknownsCommandGroup.cs`:1220 var httpClientFactory = services.GetService<IHttpClientFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/UnknownsCommandGroup.cs`:1439 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/UnknownsCommandGroup.cs`:1441 var httpClientFactory = services.GetService<IHttpClientFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/VexGateScanCommandGroup.cs`:159 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/VexGateScanCommandGroup.cs`:171 var httpClientFactory = services.GetService<IHttpClientFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/VexGateScanCommandGroup.cs`:270 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/VexGateScanCommandGroup.cs`:288 var httpClientFactory = services.GetService<IHttpClientFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/Watchlist/WatchlistCommandHandlers.cs`:574 var factory = services.GetService(typeof(IHttpClientFactory)) as IHttpClientFactory;
+  - `src/Cli/StellaOps.Cli/Commands/VexGenCommandGroup.cs`:149 var logger = scope.ServiceProvider.GetService<ILoggerFactory>()?.CreateLogger("vex.gen")
+  - `src/Cli/StellaOps.Cli/Commands/VexGenCommandGroup.cs`:151 var timeProvider = scope.ServiceProvider.GetService<TimeProvider>() ?? TimeProvider.System;
+  - `src/Cli/StellaOps.Cli/Commands/VexGenCommandGroup.cs`:155 var driftDetector = scope.ServiceProvider.GetService<IFacetDriftDetector>();
+  - `src/Cli/StellaOps.Cli/Commands/VexGenCommandGroup.cs`:156 var sealStore = scope.ServiceProvider.GetService<IFacetSealStore>();
+  - `src/Cli/StellaOps.Cli/Commands/VexGenCommandGroup.cs`:214 var evidenceLinker = scope.ServiceProvider.GetService<IVexEvidenceLinker>();
+  - `src/Cli/StellaOps.Cli/Commands/Witness/WitnessCoreCommandHandlers.cs`:70 var patchVerifier = services.GetService<IPatchVerificationOrchestrator>();
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+- Replace service locator usage with constructor injection.
+
+## Testing Fullness Findings
+- Status: FAIL
+- Expected layers: Unit, CLI, Offline
+- Detected test projects: src/Cli/__Tests/StellaOps.Cli.Tests/StellaOps.Cli.Tests.csproj [CLI], src/Cli/__Tests/StellaOps.Cli.Commands.Setup.Tests/StellaOps.Cli.Commands.Setup.Tests.csproj [CLI]
+- Missing layers: Unit, Offline
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- Add a unit test project named `<Project>.Tests` (or document exception).
+- Add offline/airgap coverage with fixtures only.

docs/implplan-blocked/audits/csproj-standards/Cli/__Libraries/StellaOps.Cli.Plugins.Aoc/StellaOps.Cli.Plugins.Aoc.md

@@ -0,0 +1,48 @@
+# Audit - StellaOps.Cli.Plugins.Aoc
+
+## Project
+- Path: `src/Cli/__Libraries/StellaOps.Cli.Plugins.Aoc/StellaOps.Cli.Plugins.Aoc.csproj`
+- Module: `Cli`
+- Kind: `Plugin`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 3
+- Service locator usage (BuildServiceProvider/GetService): 3
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/Cli/__Libraries/StellaOps.Cli.Plugins.Aoc/AocCliCommandModule.cs` (254 lines)
+  - `src/Cli/__Libraries/StellaOps.Cli.Plugins.Aoc/AocVerifyOptions.cs` (135 lines)
+  - `src/Cli/__Libraries/StellaOps.Cli.Plugins.Aoc/AocVerificationService.cs` (114 lines)
+- Service locator matches:
+  - `src/Cli/__Libraries/StellaOps.Cli.Plugins.Aoc/AocCliCommandModule.cs`:210 var resolvedService = services.GetService<IAocVerificationService>();
+  - `src/Cli/__Libraries/StellaOps.Cli.Plugins.Aoc/AocCliCommandModule.cs`:216 var connectionFactory = services.GetService<IAocConnectionFactory>() ?? new NpgsqlConnectionFactory();
+  - `src/Cli/__Libraries/StellaOps.Cli.Plugins.Aoc/AocCliCommandModule.cs`:217 var timeProvider = services.GetService<TimeProvider>() ?? TimeProvider.System;
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+- Replace service locator usage with constructor injection.
+
+## Testing Fullness Findings
+- Status: FAIL
+- Expected layers: Unit, Integration, Security, Offline
+- Detected test projects: none
+- Missing layers: Unit, Integration, Security, Offline
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- Add a unit test project named `<Project>.Tests` (or document exception).
+- Add integration tests for cross-component flows.
+- Add security tests for authn/authz or input validation.
+- Add offline/airgap coverage with fixtures only.

docs/implplan-blocked/audits/csproj-standards/Cli/__Libraries/StellaOps.Cli.Plugins.DeltaSig/StellaOps.Cli.Plugins.DeltaSig.md

@@ -0,0 +1,43 @@
+# Audit - StellaOps.Cli.Plugins.DeltaSig
+
+## Project
+- Path: `src/Cli/__Libraries/StellaOps.Cli.Plugins.DeltaSig/StellaOps.Cli.Plugins.DeltaSig.csproj`
+- Module: `Cli`
+- Kind: `Plugin`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 1
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/Cli/__Libraries/StellaOps.Cli.Plugins.DeltaSig/DeltaSigCliCommands.cs` (370 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: FAIL
+- Expected layers: Unit, Integration, Security, Offline
+- Detected test projects: none
+- Missing layers: Unit, Integration, Security, Offline
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- Add a unit test project named `<Project>.Tests` (or document exception).
+- Add integration tests for cross-component flows.
+- Add security tests for authn/authz or input validation.
+- Add offline/airgap coverage with fixtures only.

docs/implplan-blocked/audits/csproj-standards/Cli/__Libraries/StellaOps.Cli.Plugins.GroundTruth/StellaOps.Cli.Plugins.GroundTruth.md

@@ -0,0 +1,43 @@
+# Audit - StellaOps.Cli.Plugins.GroundTruth
+
+## Project
+- Path: `src/Cli/__Libraries/StellaOps.Cli.Plugins.GroundTruth/StellaOps.Cli.Plugins.GroundTruth.csproj`
+- Module: `Cli`
+- Kind: `Plugin`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 1
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/Cli/__Libraries/StellaOps.Cli.Plugins.GroundTruth/GroundTruthCliCommandModule.cs` (877 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: FAIL
+- Expected layers: Unit, Integration, Security, Offline
+- Detected test projects: none
+- Missing layers: Unit, Integration, Security, Offline
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- Add a unit test project named `<Project>.Tests` (or document exception).
+- Add integration tests for cross-component flows.
+- Add security tests for authn/authz or input validation.
+- Add offline/airgap coverage with fixtures only.