semi implemented and features implemented save checkpoint

docs/implplan-blocked/audits/csproj-standards/Scanner/StellaOps.Scanner.Worker/StellaOps.Scanner.Worker.md

@@ -0,0 +1,92 @@
+# Audit - StellaOps.Scanner.Worker
+
+## Project
+- Path: `src/Scanner/StellaOps.Scanner.Worker/StellaOps.Scanner.Worker.csproj`
+- Module: `Scanner`
+- Kind: `Worker`
+- SDK: `Microsoft.NET.Sdk.Worker`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 45
+- Service locator usage (BuildServiceProvider/GetService): 5
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/Scanner/StellaOps.Scanner.Worker/Processing/Surface/SurfaceManifestStageExecutor.cs` (866 lines)
+  - `src/Scanner/StellaOps.Scanner.Worker/Processing/EntryTraceExecutionService.cs` (755 lines)
+  - `src/Scanner/StellaOps.Scanner.Worker/Processing/CompositeScanAnalyzerDispatcher.cs` (605 lines)
+  - `src/Scanner/StellaOps.Scanner.Worker/Options/ScannerWorkerOptions.cs` (564 lines)
+  - `src/Scanner/StellaOps.Scanner.Worker/Processing/EpssSignalJob.cs` (554 lines)
+  - `src/Scanner/StellaOps.Scanner.Worker/Processing/DeltaSigAnalyzer.cs` (436 lines)
+  - `src/Scanner/StellaOps.Scanner.Worker/Processing/VexGateStageExecutor.cs` (431 lines)
+  - `src/Scanner/StellaOps.Scanner.Worker/Program.cs` (421 lines)
+  - `src/Scanner/StellaOps.Scanner.Worker/Processing/EpssIngestJob.cs` (405 lines)
+  - `src/Scanner/StellaOps.Scanner.Worker/Diagnostics/ScannerWorkerMetrics.cs` (402 lines)
+  - `src/Scanner/StellaOps.Scanner.Worker/Processing/Reachability/SbomReachabilityStageExecutor.cs` (395 lines)
+  - `src/Scanner/StellaOps.Scanner.Worker/Processing/EpssEnrichmentJob.cs` (391 lines)
+  - `src/Scanner/StellaOps.Scanner.Worker/Processing/Surface/SurfaceManifestPublisher.cs` (361 lines)
+  - `src/Scanner/StellaOps.Scanner.Worker/Metrics/ScanMetricsCollector.cs` (345 lines)
+  - `src/Scanner/StellaOps.Scanner.Worker/Processing/Reachability/ReachabilityEvidenceStageExecutor.cs` (321 lines)
+  - `src/Scanner/StellaOps.Scanner.Worker/Processing/NativeAnalyzerExecutor.cs` (299 lines)
+  - `src/Scanner/StellaOps.Scanner.Worker/Processing/NativeBinaryDiscovery.cs` (291 lines)
+  - `src/Scanner/StellaOps.Scanner.Worker/Processing/BinaryFindingMapper.cs` (282 lines)
+  - `src/Scanner/StellaOps.Scanner.Worker/Processing/Secrets/SecretsAnalyzerStageExecutor.cs` (235 lines)
+  - `src/Scanner/StellaOps.Scanner.Worker/Processing/VerdictPushStageExecutor.cs` (226 lines)
+  - `src/Scanner/StellaOps.Scanner.Worker/Processing/PoE/PoEGenerationStageExecutor.cs` (225 lines)
+  - `src/Scanner/StellaOps.Scanner.Worker/Processing/Surface/HmacDsseEnvelopeSigner.cs` (220 lines)
+  - `src/Scanner/StellaOps.Scanner.Worker/Processing/BinaryLookupStageExecutor.cs` (219 lines)
+  - `src/Scanner/StellaOps.Scanner.Worker/Orchestration/PoEOrchestrator.cs` (218 lines)
+  - `src/Scanner/StellaOps.Scanner.Worker/Processing/BinaryVulnerabilityAnalyzer.cs` (216 lines)
+  - `src/Scanner/StellaOps.Scanner.Worker/Determinism/FidelityMetricsService.cs` (211 lines)
+  - `src/Scanner/StellaOps.Scanner.Worker/Hosting/ScannerWorkerHostedService.cs` (205 lines)
+  - `src/Scanner/StellaOps.Scanner.Worker/Options/ScannerWorkerOptionsValidator.cs` (199 lines)
+  - `src/Scanner/StellaOps.Scanner.Worker/Processing/Entropy/EntropyStageExecutor.cs` (185 lines)
+  - `src/Scanner/StellaOps.Scanner.Worker/Processing/EpssEnrichmentStageExecutor.cs` (183 lines)
+  - `src/Scanner/StellaOps.Scanner.Worker/Processing/CryptoAnalysis/CryptoAnalysisStageExecutor.cs` (164 lines)
+  - `src/Scanner/StellaOps.Scanner.Worker/Processing/LeaseHeartbeatService.cs` (163 lines)
+  - `src/Scanner/StellaOps.Scanner.Worker/Extensions/BinaryIndexServiceExtensions.cs` (161 lines)
+  - `src/Scanner/StellaOps.Scanner.Worker/Processing/BuildProvenance/BuildProvenanceStageExecutor.cs` (154 lines)
+  - `src/Scanner/StellaOps.Scanner.Worker/Processing/AiMlSecurity/AiMlSecurityStageExecutor.cs` (150 lines)
+  - `src/Scanner/StellaOps.Scanner.Worker/Options/ScannerStorageSurfaceSecretConfigurator.cs` (141 lines)
+  - `src/Scanner/StellaOps.Scanner.Worker/Metrics/ScanCompletionMetricsIntegration.cs` (137 lines)
+  - `src/Scanner/StellaOps.Scanner.Worker/Processing/ServiceSecurity/ServiceSecurityStageExecutor.cs` (135 lines)
+  - `src/Scanner/StellaOps.Scanner.Worker/Processing/Surface/RubyPackageInventoryBuilder.cs` (112 lines)
+  - `src/Scanner/StellaOps.Scanner.Worker/Options/NativeAnalyzerOptions.cs` (110 lines)
+  - `src/Scanner/StellaOps.Scanner.Worker/Processing/RegistrySecretStageExecutor.cs` (108 lines)
+  - `src/Scanner/StellaOps.Scanner.Worker/Determinism/Calculators/PolicyFidelityCalculator.cs` (107 lines)
+  - `src/Scanner/StellaOps.Scanner.Worker/Diagnostics/TelemetryExtensions.cs` (107 lines)
+  - `src/Scanner/StellaOps.Scanner.Worker/Determinism/Calculators/SemanticFidelityCalculator.cs` (106 lines)
+  - `src/Scanner/StellaOps.Scanner.Worker/Processing/Replay/ReplayBundleFetcher.cs` (104 lines)
+- Service locator matches:
+  - `src/Scanner/StellaOps.Scanner.Worker/Processing/CompositeScanAnalyzerDispatcher.cs`:398 var binaryOptions = services.GetService<BinaryIndexOptions>();
+  - `src/Scanner/StellaOps.Scanner.Worker/Processing/CompositeScanAnalyzerDispatcher.cs`:415 var analyzer = services.GetService<BinaryVulnerabilityAnalyzer>();
+  - `src/Scanner/StellaOps.Scanner.Worker/Processing/Reachability/SbomReachabilityStageExecutor.cs`:223 var canonicalService = _serviceProvider.GetService<ICanonicalAdvisoryService>();
+  - `src/Scanner/StellaOps.Scanner.Worker/Processing/Surface/HmacDsseEnvelopeSigner.cs`:52 if ((secretBytes is null || secretBytes.Length == 0) && serviceProvider.GetService<ISurfaceSecretProvider>() is { } secretProvider)
+  - `src/Scanner/StellaOps.Scanner.Worker/Processing/Surface/HmacDsseEnvelopeSigner.cs`:54 secretBytes = TryLoadFromSurfaceSecrets(secretProvider, serviceProvider.GetService<ISurfaceEnvironment>());
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+- Replace service locator usage with constructor injection.
+
+## Testing Fullness Findings
+- Status: FAIL
+- Expected layers: Unit, Integration, E2E, Offline, Performance
+- Detected test projects: src/Scanner/__Tests/StellaOps.Scanner.Worker.Tests/StellaOps.Scanner.Worker.Tests.csproj [Unit]
+- Missing layers: Integration, E2E, Offline, Performance
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- Add integration tests for cross-component flows.
+- Add E2E coverage for user-visible workflows.
+- Add offline/airgap coverage with fixtures only.
+- Add performance regression coverage for scanner/export/release paths.