semi implemented and features implemented save checkpoint

docs/implplan-blocked/audits/csproj-standards/__Libraries/StellaOps.AdvisoryAI.Attestation/StellaOps.AdvisoryAI.Attestation.md

@@ -0,0 +1,46 @@
+# Audit - StellaOps.AdvisoryAI.Attestation
+
+## Project
+- Path: `src/__Libraries/StellaOps.AdvisoryAI.Attestation/StellaOps.AdvisoryAI.Attestation.csproj`
+- Module: `__Libraries`
+- Kind: `Library`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: inherited true
+- Deterministic: inherited true
+- 100-line rule violations: 7
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/__Libraries/StellaOps.AdvisoryAI.Attestation/AiAttestationService.cs` (274 lines)
+  - `src/__Libraries/StellaOps.AdvisoryAI.Attestation/IAiAttestationService.cs` (173 lines)
+  - `src/__Libraries/StellaOps.AdvisoryAI.Attestation/Storage/InMemoryAiAttestationStore.cs` (166 lines)
+  - `src/__Libraries/StellaOps.AdvisoryAI.Attestation/PromptTemplateRegistry.cs` (150 lines)
+  - `src/__Libraries/StellaOps.AdvisoryAI.Attestation/Models/AiClaimAttestation.cs` (139 lines)
+  - `src/__Libraries/StellaOps.AdvisoryAI.Attestation/Models/AiRunAttestation.cs` (118 lines)
+  - `src/__Libraries/StellaOps.AdvisoryAI.Attestation/Storage/IAiAttestationStore.cs` (103 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: PASS
+- Expected layers: Unit
+- Detected test projects: src/__Libraries/__Tests/StellaOps.AdvisoryAI.Attestation.Tests/StellaOps.AdvisoryAI.Attestation.Tests.csproj [Unit]
+- Missing layers: none
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- None.

docs/implplan-blocked/audits/csproj-standards/__Libraries/StellaOps.Artifact.Core/StellaOps.Artifact.Core.md

@@ -0,0 +1,42 @@
+# Audit - StellaOps.Artifact.Core
+
+## Project
+- Path: `src/__Libraries/StellaOps.Artifact.Core/StellaOps.Artifact.Core.csproj`
+- Module: `__Libraries`
+- Kind: `Library`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 3
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/__Libraries/StellaOps.Artifact.Core/Api/ArtifactController.cs` (610 lines)
+  - `src/__Libraries/StellaOps.Artifact.Core/CycloneDxExtractor.cs` (552 lines)
+  - `src/__Libraries/StellaOps.Artifact.Core/IArtifactStore.cs` (379 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: PASS
+- Expected layers: Unit
+- Detected test projects: src/__Libraries/StellaOps.Artifact.Core.Tests/StellaOps.Artifact.Core.Tests.csproj [Unit]
+- Missing layers: none
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- None.

docs/implplan-blocked/audits/csproj-standards/__Libraries/StellaOps.Artifact.Infrastructure/StellaOps.Artifact.Infrastructure.md

@@ -0,0 +1,44 @@
+# Audit - StellaOps.Artifact.Infrastructure
+
+## Project
+- Path: `src/__Libraries/StellaOps.Artifact.Infrastructure/StellaOps.Artifact.Infrastructure.csproj`
+- Module: `__Libraries`
+- Kind: `Library`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 5
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/__Libraries/StellaOps.Artifact.Infrastructure/S3UnifiedArtifactStore.cs` (429 lines)
+  - `src/__Libraries/StellaOps.Artifact.Infrastructure/ArtifactMigrationService.cs` (407 lines)
+  - `src/__Libraries/StellaOps.Artifact.Infrastructure/PostgresArtifactIndexRepository.cs` (310 lines)
+  - `src/__Libraries/StellaOps.Artifact.Infrastructure/ArtifactIndexRepository.cs` (279 lines)
+  - `src/__Libraries/StellaOps.Artifact.Infrastructure/ServiceCollectionExtensions.cs` (201 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: FAIL
+- Expected layers: Unit
+- Detected test projects: none
+- Missing layers: Unit
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- Add a unit test project named `<Project>.Tests` (or document exception).

docs/implplan-blocked/audits/csproj-standards/__Libraries/StellaOps.Audit.ReplayToken/StellaOps.Audit.ReplayToken.md

@@ -0,0 +1,41 @@
+# Audit - StellaOps.Audit.ReplayToken
+
+## Project
+- Path: `src/__Libraries/StellaOps.Audit.ReplayToken/StellaOps.Audit.ReplayToken.csproj`
+- Module: `__Libraries`
+- Kind: `Library`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 2
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/__Libraries/StellaOps.Audit.ReplayToken/ReplayToken.cs` (199 lines)
+  - `src/__Libraries/StellaOps.Audit.ReplayToken/Sha256ReplayTokenGenerator.cs` (191 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: PASS
+- Expected layers: Unit
+- Detected test projects: src/__Tests/StellaOps.Audit.ReplayToken.Tests/StellaOps.Audit.ReplayToken.Tests.csproj [Unit]
+- Missing layers: none
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- None.

docs/implplan-blocked/audits/csproj-standards/__Libraries/StellaOps.AuditPack/StellaOps.AuditPack.md

@@ -0,0 +1,56 @@
+# Audit - StellaOps.AuditPack
+
+## Project
+- Path: `src/__Libraries/StellaOps.AuditPack/StellaOps.AuditPack.csproj`
+- Module: `__Libraries`
+- Kind: `Library`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 17
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/__Libraries/StellaOps.AuditPack/Services/AuditBundleReader.cs` (667 lines)
+  - `src/__Libraries/StellaOps.AuditPack/Services/AuditBundleWriter.cs` (528 lines)
+  - `src/__Libraries/StellaOps.AuditPack/Services/ReplayExecutor.cs` (520 lines)
+  - `src/__Libraries/StellaOps.AuditPack/Services/VerdictReplayPredicate.cs` (502 lines)
+  - `src/__Libraries/StellaOps.AuditPack/Services/ReplayAttestationService.cs` (470 lines)
+  - `src/__Libraries/StellaOps.AuditPack/Services/AuditPackExportService.cs` (430 lines)
+  - `src/__Libraries/StellaOps.AuditPack/Services/ReplayTelemetry.cs` (399 lines)
+  - `src/__Libraries/StellaOps.AuditPack/Services/AuditBundleSigner.cs` (380 lines)
+  - `src/__Libraries/StellaOps.AuditPack/Services/IsolatedReplayContext.cs` (370 lines)
+  - `src/__Libraries/StellaOps.AuditPack/Services/AirGapTrustStoreIntegration.cs` (357 lines)
+  - `src/__Libraries/StellaOps.AuditPack/Services/ScanSnapshotFetcher.cs` (311 lines)
+  - `src/__Libraries/StellaOps.AuditPack/Services/AuditPackImporter.cs` (261 lines)
+  - `src/__Libraries/StellaOps.AuditPack/Services/AuditPackBuilder.cs` (248 lines)
+  - `src/__Libraries/StellaOps.AuditPack/Models/AuditBundleManifest.cs` (209 lines)
+  - `src/__Libraries/StellaOps.AuditPack/Services/ArchiveUtilities.cs` (159 lines)
+  - `src/__Libraries/StellaOps.AuditPack/Models/AuditPack.cs` (143 lines)
+  - `src/__Libraries/StellaOps.AuditPack/Services/AuditPackReplayer.cs` (134 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: PASS
+- Expected layers: Unit
+- Detected test projects: src/__Tests/unit/StellaOps.AuditPack.Tests/StellaOps.AuditPack.Tests.csproj [Unit], src/__Libraries/__Tests/StellaOps.AuditPack.Tests/StellaOps.AuditPack.Tests.csproj [Unit]
+- Missing layers: none
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- None.

docs/implplan-blocked/audits/csproj-standards/__Libraries/StellaOps.Auth.Security/StellaOps.Auth.Security.md

@@ -0,0 +1,43 @@
+# Audit - StellaOps.Auth.Security
+
+## Project
+- Path: `src/__Libraries/StellaOps.Auth.Security/StellaOps.Auth.Security.csproj`
+- Module: `__Libraries`
+- Kind: `Library`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 4
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/__Libraries/StellaOps.Auth.Security/Dpop/DpopProofValidator.cs` (258 lines)
+  - `src/__Libraries/StellaOps.Auth.Security/Dpop/InMemoryDpopNonceStore.cs` (176 lines)
+  - `src/__Libraries/StellaOps.Auth.Security/Dpop/MessagingDpopNonceStore.cs` (163 lines)
+  - `src/__Libraries/StellaOps.Auth.Security/Dpop/RedisDpopNonceStore.cs` (138 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: FAIL
+- Expected layers: Unit
+- Detected test projects: src/__Libraries/__Tests/StellaOps.Auth.Security.Tests/StellaOps.Auth.Security.Tests.csproj [Security]
+- Missing layers: Unit
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- Add a unit test project named `<Project>.Tests` (or document exception).

docs/implplan-blocked/audits/csproj-standards/__Libraries/StellaOps.Canonical.Json/StellaOps.Canonical.Json.md

@@ -0,0 +1,40 @@
+# Audit - StellaOps.Canonical.Json
+
+## Project
+- Path: `src/__Libraries/StellaOps.Canonical.Json/StellaOps.Canonical.Json.csproj`
+- Module: `__Libraries`
+- Kind: `Library`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 1
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/__Libraries/StellaOps.Canonical.Json/CanonJson.cs` (353 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: PASS
+- Expected layers: Unit
+- Detected test projects: src/__Libraries/StellaOps.Canonical.Json.Tests/StellaOps.Canonical.Json.Tests.csproj [Unit]
+- Missing layers: none
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- None.

docs/implplan-blocked/audits/csproj-standards/__Libraries/StellaOps.Canonicalization/StellaOps.Canonicalization.md

@@ -0,0 +1,41 @@
+# Audit - StellaOps.Canonicalization
+
+## Project
+- Path: `src/__Libraries/StellaOps.Canonicalization/StellaOps.Canonicalization.csproj`
+- Module: `__Libraries`
+- Kind: `Library`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 2
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/__Libraries/StellaOps.Canonicalization/Json/CanonicalJsonSerializer.cs` (142 lines)
+  - `src/__Libraries/StellaOps.Canonicalization/Verification/DeterminismVerifier.cs` (126 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: PASS
+- Expected layers: Unit
+- Detected test projects: src/__Libraries/__Tests/StellaOps.Canonicalization.Tests/StellaOps.Canonicalization.Tests.csproj [Unit]
+- Missing layers: none
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- None.

docs/implplan-blocked/audits/csproj-standards/__Libraries/StellaOps.Configuration.SettingsStore/StellaOps.Configuration.SettingsStore.md

@@ -0,0 +1,45 @@
+# Audit - StellaOps.Configuration.SettingsStore
+
+## Project
+- Path: `src/__Libraries/StellaOps.Configuration.SettingsStore/StellaOps.Configuration.SettingsStore.csproj`
+- Module: `__Libraries`
+- Kind: `Library`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 6
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/__Libraries/StellaOps.Configuration.SettingsStore/SettingsStoreConfigurationSource.cs` (231 lines)
+  - `src/__Libraries/StellaOps.Configuration.SettingsStore/Providers/AzureAppConfigurationProvider.cs` (218 lines)
+  - `src/__Libraries/StellaOps.Configuration.SettingsStore/Providers/EtcdConfigurationProvider.cs` (218 lines)
+  - `src/__Libraries/StellaOps.Configuration.SettingsStore/Providers/AwsParameterStoreConfigurationProvider.cs` (197 lines)
+  - `src/__Libraries/StellaOps.Configuration.SettingsStore/Providers/ConsulConfigurationProvider.cs` (170 lines)
+  - `src/__Libraries/StellaOps.Configuration.SettingsStore/NullSecretResolver.cs` (111 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: FAIL
+- Expected layers: Unit
+- Detected test projects: none
+- Missing layers: Unit
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- Add a unit test project named `<Project>.Tests` (or document exception).

docs/implplan-blocked/audits/csproj-standards/__Libraries/StellaOps.Configuration/StellaOps.Configuration.md

@@ -0,0 +1,45 @@
+# Audit - StellaOps.Configuration
+
+## Project
+- Path: `src/__Libraries/StellaOps.Configuration/StellaOps.Configuration.csproj`
+- Module: `__Libraries`
+- Kind: `Library`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 6
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/__Libraries/StellaOps.Configuration/StellaOpsAuthorityOptions.cs` (1575 lines)
+  - `src/__Libraries/StellaOps.Configuration/AuthorityNotificationsOptions.cs` (246 lines)
+  - `src/__Libraries/StellaOps.Configuration/AuthorityVulnerabilityExplorerOptions.cs` (180 lines)
+  - `src/__Libraries/StellaOps.Configuration/AuthorityAdvisoryAiOptions.cs` (163 lines)
+  - `src/__Libraries/StellaOps.Configuration/StellaOpsCryptoServiceCollectionExtensions.cs` (107 lines)
+  - `src/__Libraries/StellaOps.Configuration/StellaOpsConfigurationBootstrapper.cs` (106 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: PASS
+- Expected layers: Unit
+- Detected test projects: src/__Libraries/__Tests/StellaOps.Configuration.Tests/StellaOps.Configuration.Tests.csproj [Unit]
+- Missing layers: none
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- None.

docs/implplan-blocked/audits/csproj-standards/__Libraries/StellaOps.Cryptography.CertificateStatus.Abstractions/StellaOps.Cryptography.CertificateStatus.Abstractions.md

@@ -0,0 +1,43 @@
+# Audit - StellaOps.Cryptography.CertificateStatus.Abstractions
+
+## Project
+- Path: `src/__Libraries/StellaOps.Cryptography.CertificateStatus.Abstractions/StellaOps.Cryptography.CertificateStatus.Abstractions.csproj`
+- Module: `__Libraries`
+- Kind: `Library`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: inherited true
+- Deterministic: inherited true
+- 100-line rule violations: 4
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/__Libraries/StellaOps.Cryptography.CertificateStatus.Abstractions/CertificateStatusResult.cs` (175 lines)
+  - `src/__Libraries/StellaOps.Cryptography.CertificateStatus.Abstractions/StapledRevocationData.cs` (132 lines)
+  - `src/__Libraries/StellaOps.Cryptography.CertificateStatus.Abstractions/RevocationEnums.cs` (126 lines)
+  - `src/__Libraries/StellaOps.Cryptography.CertificateStatus.Abstractions/CertificateStatusOptions.cs` (106 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: FAIL
+- Expected layers: Unit
+- Detected test projects: none
+- Missing layers: Unit
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- Add a unit test project named `<Project>.Tests` (or document exception).

docs/implplan-blocked/audits/csproj-standards/__Libraries/StellaOps.Cryptography.CertificateStatus/StellaOps.Cryptography.CertificateStatus.md

@@ -0,0 +1,42 @@
+# Audit - StellaOps.Cryptography.CertificateStatus
+
+## Project
+- Path: `src/__Libraries/StellaOps.Cryptography.CertificateStatus/StellaOps.Cryptography.CertificateStatus.csproj`
+- Module: `__Libraries`
+- Kind: `Library`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: inherited true
+- Deterministic: inherited true
+- 100-line rule violations: 3
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/__Libraries/StellaOps.Cryptography.CertificateStatus/OcspClient.cs` (443 lines)
+  - `src/__Libraries/StellaOps.Cryptography.CertificateStatus/CrlFetcher.cs` (336 lines)
+  - `src/__Libraries/StellaOps.Cryptography.CertificateStatus/CertificateStatusProvider.cs` (262 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: FAIL
+- Expected layers: Unit
+- Detected test projects: none
+- Missing layers: Unit
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- Add a unit test project named `<Project>.Tests` (or document exception).

docs/implplan-blocked/audits/csproj-standards/__Libraries/StellaOps.Cryptography.DependencyInjection/StellaOps.Cryptography.DependencyInjection.md

@@ -0,0 +1,50 @@
+# Audit - StellaOps.Cryptography.DependencyInjection
+
+## Project
+- Path: `src/__Libraries/StellaOps.Cryptography.DependencyInjection/StellaOps.Cryptography.DependencyInjection.csproj`
+- Module: `__Libraries`
+- Kind: `Library`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 3
+- Service locator usage (BuildServiceProvider/GetService): 8
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/__Libraries/StellaOps.Cryptography.DependencyInjection/CryptoServiceCollectionExtensions.cs` (366 lines)
+  - `src/__Libraries/StellaOps.Cryptography.DependencyInjection/CryptoProviderRegistryValidator.cs` (143 lines)
+  - `src/__Libraries/StellaOps.Cryptography.DependencyInjection/CryptoPluginServiceCollectionExtensions.cs` (140 lines)
+- Service locator matches:
+  - `src/__Libraries/StellaOps.Cryptography.DependencyInjection/CryptoPluginServiceCollectionExtensions.cs`:42 var config = sp.GetService<IConfiguration>();
+  - `src/__Libraries/StellaOps.Cryptography.DependencyInjection/CryptoPluginServiceCollectionExtensions.cs`:57 var logger = sp.GetService<ILogger<CryptoPluginLoader>>();
+  - `src/__Libraries/StellaOps.Cryptography.DependencyInjection/CryptoPluginServiceCollectionExtensions.cs`:78 var options = sp.GetService<IOptionsMonitor<CryptoProviderRegistryOptions>>();
+  - `src/__Libraries/StellaOps.Cryptography.DependencyInjection/CryptoServiceCollectionExtensions.cs`:50 var configuration = sp.GetService<IConfiguration>();
+  - `src/__Libraries/StellaOps.Cryptography.DependencyInjection/CryptoServiceCollectionExtensions.cs`:79 var opts = sp.GetService<IOptions<SmRemoteProviderOptions>>()?.Value;
+  - `src/__Libraries/StellaOps.Cryptography.DependencyInjection/CryptoServiceCollectionExtensions.cs`:109 var opts = sp.GetService<IOptions<SimRemoteProviderOptions>>()?.Value;
+  - `src/__Libraries/StellaOps.Cryptography.DependencyInjection/CryptoServiceCollectionExtensions.cs`:150 var options = sp.GetService<IOptionsMonitor<CryptoProviderRegistryOptions>>();
+  - `src/__Libraries/StellaOps.Cryptography.DependencyInjection/CryptoServiceCollectionExtensions.cs`:289 var logger = sp.GetService<ILoggerFactory>()?.CreateLogger<CryptoPluginLoader>();
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+- Replace service locator usage with constructor injection.
+
+## Testing Fullness Findings
+- Status: FAIL
+- Expected layers: Unit
+- Detected test projects: none
+- Missing layers: Unit
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- Add a unit test project named `<Project>.Tests` (or document exception).

docs/implplan-blocked/audits/csproj-standards/__Libraries/StellaOps.Cryptography.Kms/StellaOps.Cryptography.Kms.md

@@ -0,0 +1,49 @@
+# Audit - StellaOps.Cryptography.Kms
+
+## Project
+- Path: `src/__Libraries/StellaOps.Cryptography.Kms/StellaOps.Cryptography.Kms.csproj`
+- Module: `__Libraries`
+- Kind: `Library`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 10
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/__Libraries/StellaOps.Cryptography.Kms/FileKmsClient.cs` (711 lines)
+  - `src/__Libraries/StellaOps.Cryptography.Kms/GcpKmsClient.cs` (293 lines)
+  - `src/__Libraries/StellaOps.Cryptography.Kms/Pkcs11Facade.cs` (286 lines)
+  - `src/__Libraries/StellaOps.Cryptography.Kms/AwsKmsClient.cs` (250 lines)
+  - `src/__Libraries/StellaOps.Cryptography.Kms/Pkcs11KmsClient.cs` (231 lines)
+  - `src/__Libraries/StellaOps.Cryptography.Kms/AwsKmsFacade.cs` (189 lines)
+  - `src/__Libraries/StellaOps.Cryptography.Kms/Fido2KmsClient.cs` (188 lines)
+  - `src/__Libraries/StellaOps.Cryptography.Kms/GcpKmsFacade.cs` (175 lines)
+  - `src/__Libraries/StellaOps.Cryptography.Kms/ServiceCollectionExtensions.cs` (167 lines)
+  - `src/__Libraries/StellaOps.Cryptography.Kms/KmsCryptoProvider.cs` (136 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: PASS
+- Expected layers: Unit
+- Detected test projects: src/__Libraries/__Tests/StellaOps.Cryptography.Kms.Tests/StellaOps.Cryptography.Kms.Tests.csproj [Unit]
+- Missing layers: none
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- None.

docs/implplan-blocked/audits/csproj-standards/__Libraries/StellaOps.Cryptography.Plugin.BouncyCastle/StellaOps.Cryptography.Plugin.BouncyCastle.md

@@ -0,0 +1,43 @@
+# Audit - StellaOps.Cryptography.Plugin.BouncyCastle
+
+## Project
+- Path: `src/__Libraries/StellaOps.Cryptography.Plugin.BouncyCastle/StellaOps.Cryptography.Plugin.BouncyCastle.csproj`
+- Module: `__Libraries`
+- Kind: `Plugin`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 1
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/__Libraries/StellaOps.Cryptography.Plugin.BouncyCastle/BouncyCastleEd25519CryptoProvider.cs` (214 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: FAIL
+- Expected layers: Unit, Integration, Security, Offline
+- Detected test projects: none
+- Missing layers: Unit, Integration, Security, Offline
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- Add a unit test project named `<Project>.Tests` (or document exception).
+- Add integration tests for cross-component flows.
+- Add security tests for authn/authz or input validation.
+- Add offline/airgap coverage with fixtures only.

docs/implplan-blocked/audits/csproj-standards/__Libraries/StellaOps.Cryptography.Plugin.CryptoPro/StellaOps.Cryptography.Plugin.CryptoPro.md

@@ -0,0 +1,122 @@
+# Audit - StellaOps.Cryptography.Plugin.CryptoPro
+
+## Project
+- Path: `src/__Libraries/StellaOps.Cryptography.Plugin.CryptoPro/StellaOps.Cryptography.Plugin.CryptoPro.csproj`
+- Module: `__Libraries`
+- Kind: `Plugin`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 80
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/__Libraries/StellaOps.Cryptography.Plugin.CryptoPro/third_party/AlexMAS.GostCryptography/Source/GostCryptography/Native/CryptoApiHelper.cs` (1368 lines)
+  - `src/__Libraries/StellaOps.Cryptography.Plugin.CryptoPro/third_party/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Ber/BigInteger.cs` (809 lines)
+  - `src/__Libraries/StellaOps.Cryptography.Plugin.CryptoPro/third_party/AlexMAS.GostCryptography/Source/GostCryptography/Gost_R3410/Gost_R3410_AsymmetricAlgorithm.cs` (653 lines)
+  - `src/__Libraries/StellaOps.Cryptography.Plugin.CryptoPro/third_party/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Ber/Asn1Time.cs` (569 lines)
+  - `src/__Libraries/StellaOps.Cryptography.Plugin.CryptoPro/third_party/AlexMAS.GostCryptography/Source/GostCryptography/Native/Constants.cs` (489 lines)
+  - `src/__Libraries/StellaOps.Cryptography.Plugin.CryptoPro/third_party/AlexMAS.GostCryptography/Source/GostCryptography/Gost_28147_89/Gost_3412_M_SymmetricAlgorithm.cs` (471 lines)
+  - `src/__Libraries/StellaOps.Cryptography.Plugin.CryptoPro/third_party/AlexMAS.GostCryptography/Source/GostCryptography/Gost_28147_89/Gost_3412_K_SymmetricAlgorithm.cs` (471 lines)
+  - `src/__Libraries/StellaOps.Cryptography.Plugin.CryptoPro/third_party/AlexMAS.GostCryptography/Source/GostCryptography/Gost_28147_89/Gost_28147_89_SymmetricAlgorithm.cs` (462 lines)
+  - `src/__Libraries/StellaOps.Cryptography.Plugin.CryptoPro/third_party/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Ber/Asn1BitString.cs` (455 lines)
+  - `src/__Libraries/StellaOps.Cryptography.Plugin.CryptoPro/third_party/AlexMAS.GostCryptography/Source/GostCryptography/Xml/GostEncryptedXmlImpl.cs` (446 lines)
+  - `src/__Libraries/StellaOps.Cryptography.Plugin.CryptoPro/third_party/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Ber/Asn1BerDecodeBuffer.cs` (401 lines)
+  - `src/__Libraries/StellaOps.Cryptography.Plugin.CryptoPro/third_party/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Ber/Asn1Real.cs` (371 lines)
+  - `src/__Libraries/StellaOps.Cryptography.Plugin.CryptoPro/third_party/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Ber/Asn1UtcTime.cs` (361 lines)
+  - `src/__Libraries/StellaOps.Cryptography.Plugin.CryptoPro/third_party/AlexMAS.GostCryptography/Source/GostCryptography/Xml/GostEncryptedXml.cs` (356 lines)
+  - `src/__Libraries/StellaOps.Cryptography.Plugin.CryptoPro/third_party/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Ber/Asn1GeneralizedTime.cs` (344 lines)
+  - `src/__Libraries/StellaOps.Cryptography.Plugin.CryptoPro/third_party/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Ber/Asn1Util.cs` (336 lines)
+  - `src/__Libraries/StellaOps.Cryptography.Plugin.CryptoPro/third_party/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Ber/Asn1DecodeBuffer.cs` (326 lines)
+  - `src/__Libraries/StellaOps.Cryptography.Plugin.CryptoPro/third_party/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Ber/Asn1BerEncodeBuffer.cs` (305 lines)
+  - `src/__Libraries/StellaOps.Cryptography.Plugin.CryptoPro/third_party/AlexMAS.GostCryptography/Source/GostCryptography/Reflection/X509CertificateHelper.cs` (300 lines)
+  - `src/__Libraries/StellaOps.Cryptography.Plugin.CryptoPro/third_party/AlexMAS.GostCryptography/Source/GostCryptography/Gost_28147_89/Gost_28147_89_CryptoTransform.cs` (289 lines)
+  - `src/__Libraries/StellaOps.Cryptography.Plugin.CryptoPro/third_party/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Ber/Asn1BerOutputStream.cs` (277 lines)
+  - `src/__Libraries/StellaOps.Cryptography.Plugin.CryptoPro/third_party/AlexMAS.GostCryptography/Source/GostCryptography/Config/GostCryptoConfig.cs` (237 lines)
+  - `src/__Libraries/StellaOps.Cryptography.Plugin.CryptoPro/third_party/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Ber/Asn1CerOutputStream.cs` (236 lines)
+  - `src/__Libraries/StellaOps.Cryptography.Plugin.CryptoPro/third_party/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Ber/Asn1OctetString.cs` (235 lines)
+  - `src/__Libraries/StellaOps.Cryptography.Plugin.CryptoPro/third_party/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Ber/Asn1UniversalString.cs` (227 lines)
+  - `src/__Libraries/StellaOps.Cryptography.Plugin.CryptoPro/third_party/AlexMAS.GostCryptography/Source/GostCryptography/Gost_R3410/Gost_R3410_KeyExchangeXmlSerializer.cs` (205 lines)
+  - `src/__Libraries/StellaOps.Cryptography.Plugin.CryptoPro/third_party/AlexMAS.GostCryptography/Source/GostCryptography/Pkcs/GostSignedCms.cs` (201 lines)
+  - `src/__Libraries/StellaOps.Cryptography.Plugin.CryptoPro/third_party/AlexMAS.GostCryptography/Source/GostCryptography.Tests/Xml/Encrypt/EncryptedXmlKeyContainerTest.cs` (192 lines)
+  - `src/__Libraries/StellaOps.Cryptography.Plugin.CryptoPro/third_party/AlexMAS.GostCryptography/Source/GostCryptography/Gost_R3410/Gost_R3410_KeyExchangeAlgorithm.cs` (180 lines)
+  - `src/__Libraries/StellaOps.Cryptography.Plugin.CryptoPro/third_party/AlexMAS.GostCryptography/Source/GostCryptography/Gost_R3411/Gost_R3411_PRF.cs` (174 lines)
+  - `src/__Libraries/StellaOps.Cryptography.Plugin.CryptoPro/third_party/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Ber/Asn1Value.cs` (170 lines)
+  - `src/__Libraries/StellaOps.Cryptography.Plugin.CryptoPro/third_party/AlexMAS.GostCryptography/Source/GostCryptography/Native/CryptoApi.cs` (169 lines)
+  - `src/__Libraries/StellaOps.Cryptography.Plugin.CryptoPro/third_party/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Ber/Asn1Type.cs` (168 lines)
+  - `src/__Libraries/StellaOps.Cryptography.Plugin.CryptoPro/third_party/AlexMAS.GostCryptography/Source/GostCryptography/Gost_R3410/Gost_R3410_KeyExchangeFormatter.cs` (167 lines)
+  - `src/__Libraries/StellaOps.Cryptography.Plugin.CryptoPro/third_party/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Gost/Gost_R3410/Gost_R3410_KeyExchange.cs` (165 lines)
+  - `src/__Libraries/StellaOps.Cryptography.Plugin.CryptoPro/third_party/AlexMAS.GostCryptography/Source/GostCryptography/Xml/GostSignedXmlImpl.cs` (164 lines)
+  - `src/__Libraries/StellaOps.Cryptography.Plugin.CryptoPro/CryptoProGostSigner.cs` (163 lines)
+  - `src/__Libraries/StellaOps.Cryptography.Plugin.CryptoPro/third_party/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Gost/Gost_R3410/Gost_R3410_KeyExchangeParams.cs` (161 lines)
+  - `src/__Libraries/StellaOps.Cryptography.Plugin.CryptoPro/third_party/AlexMAS.GostCryptography/Source/GostCryptography/Gost_28147_89/Gost_3412_M_ImitHashAlgorithm.cs` (156 lines)
+  - `src/__Libraries/StellaOps.Cryptography.Plugin.CryptoPro/third_party/AlexMAS.GostCryptography/Source/GostCryptography/Gost_28147_89/Gost_28147_89_ImitHashAlgorithm.cs` (156 lines)
+  - `src/__Libraries/StellaOps.Cryptography.Plugin.CryptoPro/third_party/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Ber/Tokenizer.cs` (156 lines)
+  - `src/__Libraries/StellaOps.Cryptography.Plugin.CryptoPro/third_party/AlexMAS.GostCryptography/Source/GostCryptography/Gost_28147_89/Gost_3412_K_ImitHashAlgorithm.cs` (156 lines)
+  - `src/__Libraries/StellaOps.Cryptography.Plugin.CryptoPro/third_party/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Ber/Asn1CharString.cs` (156 lines)
+  - `src/__Libraries/StellaOps.Cryptography.Plugin.CryptoPro/third_party/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Gost/Gost_28147_89/Gost_28147_89_KeyExchangeInfo.cs` (153 lines)
+  - `src/__Libraries/StellaOps.Cryptography.Plugin.CryptoPro/third_party/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Ber/Asn1RunTime.cs` (151 lines)
+  - `src/__Libraries/StellaOps.Cryptography.Plugin.CryptoPro/third_party/AlexMAS.GostCryptography/Source/GostCryptography/Xml/GostSignedXml.cs` (151 lines)
+  - `src/__Libraries/StellaOps.Cryptography.Plugin.CryptoPro/third_party/AlexMAS.GostCryptography/Source/GostCryptography/Gost_R3411/Gost_R3411_HMAC.cs` (145 lines)
+  - `src/__Libraries/StellaOps.Cryptography.Plugin.CryptoPro/third_party/AlexMAS.GostCryptography/Source/GostCryptography/Reflection/CryptographyXmlUtils.cs` (139 lines)
+  - `src/__Libraries/StellaOps.Cryptography.Plugin.CryptoPro/third_party/AlexMAS.GostCryptography/Source/GostCryptography.Tests/Xml/Sign/SignedXmlKeyContainerTest.cs` (139 lines)
+  - `src/__Libraries/StellaOps.Cryptography.Plugin.CryptoPro/third_party/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Ber/Asn1BigInteger.cs` (137 lines)
+  - `src/__Libraries/StellaOps.Cryptography.Plugin.CryptoPro/third_party/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Ber/Asn1ObjectIdentifier.cs` (137 lines)
+  - `src/__Libraries/StellaOps.Cryptography.Plugin.CryptoPro/third_party/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Ber/Asn1BerMessageDumpHandler.cs` (135 lines)
+  - `src/__Libraries/StellaOps.Cryptography.Plugin.CryptoPro/third_party/AlexMAS.GostCryptography/Source/GostCryptography/Gost_R3410/Gost_R3410_2001_AsymmetricAlgorithm.cs` (134 lines)
+  - `src/__Libraries/StellaOps.Cryptography.Plugin.CryptoPro/third_party/AlexMAS.GostCryptography/Source/GostCryptography/Reflection/SignedCmsHelper.cs` (134 lines)
+  - `src/__Libraries/StellaOps.Cryptography.Plugin.CryptoPro/third_party/AlexMAS.GostCryptography/Source/GostCryptography/Gost_R3410/Gost_R3410_2012_512_AsymmetricAlgorithm.cs` (129 lines)
+  - `src/__Libraries/StellaOps.Cryptography.Plugin.CryptoPro/third_party/AlexMAS.GostCryptography/Source/GostCryptography/Gost_R3410/Gost_R3410_2012_256_AsymmetricAlgorithm.cs` (129 lines)
+  - `src/__Libraries/StellaOps.Cryptography.Plugin.CryptoPro/third_party/AlexMAS.GostCryptography/Source/GostCryptography.Tests/Gost_R3410/SetContainerPasswordTest.cs` (128 lines)
+  - `src/__Libraries/StellaOps.Cryptography.Plugin.CryptoPro/third_party/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Ber/Asn1BmpString.cs` (125 lines)
+  - `src/__Libraries/StellaOps.Cryptography.Plugin.CryptoPro/third_party/AlexMAS.GostCryptography/Source/GostCryptography/Reflection/SignedXmlHelper.cs` (125 lines)
+  - `src/__Libraries/StellaOps.Cryptography.Plugin.CryptoPro/third_party/AlexMAS.GostCryptography/Source/GostCryptography/Gost_R3410/Gost_R3410_EphemeralAsymmetricAlgorithm.cs` (123 lines)
+  - `src/__Libraries/StellaOps.Cryptography.Plugin.CryptoPro/third_party/AlexMAS.GostCryptography/Source/GostCryptography.Tests/Gost_R3411/Gost_R3411_2012_512_PRFTest.cs` (119 lines)
+  - `src/__Libraries/StellaOps.Cryptography.Plugin.CryptoPro/third_party/AlexMAS.GostCryptography/Source/GostCryptography.Tests/Gost_R3411/Gost_R3411_2012_256_PRFTest.cs` (119 lines)
+  - `src/__Libraries/StellaOps.Cryptography.Plugin.CryptoPro/third_party/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Gost/PublicKey/PkiConstants.cs` (116 lines)
+  - `src/__Libraries/StellaOps.Cryptography.Plugin.CryptoPro/third_party/AlexMAS.GostCryptography/Source/GostCryptography/Gost_R3410/Gost_R3410_2012_512_EphemeralAsymmetricAlgorithm.cs` (114 lines)
+  - `src/__Libraries/StellaOps.Cryptography.Plugin.CryptoPro/third_party/AlexMAS.GostCryptography/Source/GostCryptography/Gost_R3410/Gost_R3410_2012_256_EphemeralAsymmetricAlgorithm.cs` (114 lines)
+  - `src/__Libraries/StellaOps.Cryptography.Plugin.CryptoPro/third_party/AlexMAS.GostCryptography/Source/GostCryptography/Gost_R3410/Gost_R3410_2001_EphemeralAsymmetricAlgorithm.cs` (114 lines)
+  - `src/__Libraries/StellaOps.Cryptography.Plugin.CryptoPro/third_party/AlexMAS.GostCryptography/Source/GostCryptography.Tests/Gost_R3411/Gost_R3411_94_PRFTest.cs` (113 lines)
+  - `src/__Libraries/StellaOps.Cryptography.Plugin.CryptoPro/third_party/AlexMAS.GostCryptography/Source/GostCryptography.Tests/Xml/Encrypt/EncryptedXmlSessionKey.cs` (112 lines)
+  - `src/__Libraries/StellaOps.Cryptography.Plugin.CryptoPro/CryptoProGostCryptoProvider.cs` (108 lines)
+  - `src/__Libraries/StellaOps.Cryptography.Plugin.CryptoPro/third_party/AlexMAS.GostCryptography/Source/GostCryptography/Gost_R3410/Gost_R3410_KeyExchangeDeformatter.cs` (108 lines)
+  - `src/__Libraries/StellaOps.Cryptography.Plugin.CryptoPro/third_party/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Ber/Asn1Tag.cs` (108 lines)
+  - `src/__Libraries/StellaOps.Cryptography.Plugin.CryptoPro/third_party/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Gost/PublicKey/AlgorithmIdentifier.cs` (104 lines)
+  - `src/__Libraries/StellaOps.Cryptography.Plugin.CryptoPro/third_party/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/OidValue.cs` (104 lines)
+  - `src/__Libraries/StellaOps.Cryptography.Plugin.CryptoPro/third_party/AlexMAS.GostCryptography/Source/GostCryptography.Tests/Xml/Sign/SignedXmlDocumentTest.cs` (104 lines)
+  - `src/__Libraries/StellaOps.Cryptography.Plugin.CryptoPro/third_party/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Ber/Asn1OpenType.cs` (103 lines)
+  - `src/__Libraries/StellaOps.Cryptography.Plugin.CryptoPro/third_party/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Ber/Asn1Boolean.cs` (102 lines)
+  - `src/__Libraries/StellaOps.Cryptography.Plugin.CryptoPro/third_party/AlexMAS.GostCryptography/Source/GostCryptography.Tests/Gost_28147_89/EncryptDecryptSessionKeyTest.cs` (102 lines)
+  - `src/__Libraries/StellaOps.Cryptography.Plugin.CryptoPro/third_party/AlexMAS.GostCryptography/Source/GostCryptography.Tests/Gost_28147_89/KuznyechikEncryptDecryptSessionKeyTest.cs` (102 lines)
+  - `src/__Libraries/StellaOps.Cryptography.Plugin.CryptoPro/third_party/AlexMAS.GostCryptography/Source/GostCryptography.Tests/Gost_28147_89/MagmaEncryptDecryptSessionKeyTest.cs` (102 lines)
+  - `src/__Libraries/StellaOps.Cryptography.Plugin.CryptoPro/third_party/AlexMAS.GostCryptography/Source/GostCryptography.Tests/Xml/Sign/SignedXmlCertificateTest.cs` (101 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: FAIL
+- Expected layers: Unit, Integration, Security, Offline
+- Detected test projects: none
+- Missing layers: Unit, Integration, Security, Offline
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- Add a unit test project named `<Project>.Tests` (or document exception).
+- Add integration tests for cross-component flows.
+- Add security tests for authn/authz or input validation.
+- Add offline/airgap coverage with fixtures only.

docs/implplan-blocked/audits/csproj-standards/__Libraries/StellaOps.Cryptography.Plugin.EIDAS/StellaOps.Cryptography.Plugin.EIDAS.md

@@ -0,0 +1,45 @@
+# Audit - StellaOps.Cryptography.Plugin.EIDAS
+
+## Project
+- Path: `src/__Libraries/StellaOps.Cryptography.Plugin.EIDAS/StellaOps.Cryptography.Plugin.EIDAS.csproj`
+- Module: `__Libraries`
+- Kind: `Plugin`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 4
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/__Libraries/StellaOps.Cryptography.Plugin.EIDAS/EidasCryptoProvider.cs` (201 lines)
+  - `src/__Libraries/StellaOps.Cryptography.Plugin.EIDAS/Configuration/EidasOptions.cs` (172 lines)
+  - `src/__Libraries/StellaOps.Cryptography.Plugin.EIDAS/LocalEidasProvider.cs` (166 lines)
+  - `src/__Libraries/StellaOps.Cryptography.Plugin.EIDAS/TrustServiceProviderClient.cs` (135 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: FAIL
+- Expected layers: Unit, Integration, Security, Offline
+- Detected test projects: src/__Libraries/StellaOps.Cryptography.Plugin.EIDAS.Tests/StellaOps.Cryptography.Plugin.EIDAS.Tests.csproj [Unit]
+- Missing layers: Integration, Security, Offline
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- Add integration tests for cross-component flows.
+- Add security tests for authn/authz or input validation.
+- Add offline/airgap coverage with fixtures only.

docs/implplan-blocked/audits/csproj-standards/__Libraries/StellaOps.Cryptography.Plugin.OfflineVerification/StellaOps.Cryptography.Plugin.OfflineVerification.md

@@ -0,0 +1,42 @@
+# Audit - StellaOps.Cryptography.Plugin.OfflineVerification
+
+## Project
+- Path: `src/__Libraries/StellaOps.Cryptography.Plugin.OfflineVerification/StellaOps.Cryptography.Plugin.OfflineVerification.csproj`
+- Module: `__Libraries`
+- Kind: `Plugin`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 1
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/__Libraries/StellaOps.Cryptography.Plugin.OfflineVerification/OfflineVerificationCryptoProvider.cs` (354 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: FAIL
+- Expected layers: Unit, Integration, Security, Offline
+- Detected test projects: src/__Libraries/__Tests/StellaOps.Cryptography.Plugin.OfflineVerification.Tests/StellaOps.Cryptography.Plugin.OfflineVerification.Tests.csproj [Offline]
+- Missing layers: Unit, Integration, Security
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- Add a unit test project named `<Project>.Tests` (or document exception).
+- Add integration tests for cross-component flows.
+- Add security tests for authn/authz or input validation.

docs/implplan-blocked/audits/csproj-standards/__Libraries/StellaOps.Cryptography.Plugin.OpenSslGost/StellaOps.Cryptography.Plugin.OpenSslGost.md

@@ -0,0 +1,44 @@
+# Audit - StellaOps.Cryptography.Plugin.OpenSslGost
+
+## Project
+- Path: `src/__Libraries/StellaOps.Cryptography.Plugin.OpenSslGost/StellaOps.Cryptography.Plugin.OpenSslGost.csproj`
+- Module: `__Libraries`
+- Kind: `Plugin`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 2
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/__Libraries/StellaOps.Cryptography.Plugin.OpenSslGost/OpenSslGostProvider.cs` (139 lines)
+  - `src/__Libraries/StellaOps.Cryptography.Plugin.OpenSslGost/OpenSslGostSigner.cs` (108 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: FAIL
+- Expected layers: Unit, Integration, Security, Offline
+- Detected test projects: none
+- Missing layers: Unit, Integration, Security, Offline
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- Add a unit test project named `<Project>.Tests` (or document exception).
+- Add integration tests for cross-component flows.
+- Add security tests for authn/authz or input validation.
+- Add offline/airgap coverage with fixtures only.

docs/implplan-blocked/audits/csproj-standards/__Libraries/StellaOps.Cryptography.Plugin.Pkcs11Gost/StellaOps.Cryptography.Plugin.Pkcs11Gost.md

@@ -0,0 +1,45 @@
+# Audit - StellaOps.Cryptography.Plugin.Pkcs11Gost
+
+## Project
+- Path: `src/__Libraries/StellaOps.Cryptography.Plugin.Pkcs11Gost/StellaOps.Cryptography.Plugin.Pkcs11Gost.csproj`
+- Module: `__Libraries`
+- Kind: `Plugin`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 3
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/__Libraries/StellaOps.Cryptography.Plugin.Pkcs11Gost/Pkcs11GostProviderCore.cs` (186 lines)
+  - `src/__Libraries/StellaOps.Cryptography.Plugin.Pkcs11Gost/Pkcs11SignerUtilities.cs` (109 lines)
+  - `src/__Libraries/StellaOps.Cryptography.Plugin.Pkcs11Gost/Pkcs11GostKeyOptions.cs` (107 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: FAIL
+- Expected layers: Unit, Integration, Security, Offline
+- Detected test projects: none
+- Missing layers: Unit, Integration, Security, Offline
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- Add a unit test project named `<Project>.Tests` (or document exception).
+- Add integration tests for cross-component flows.
+- Add security tests for authn/authz or input validation.
+- Add offline/airgap coverage with fixtures only.

docs/implplan-blocked/audits/csproj-standards/__Libraries/StellaOps.Cryptography.Plugin.PqSoft/StellaOps.Cryptography.Plugin.PqSoft.md

@@ -0,0 +1,43 @@
+# Audit - StellaOps.Cryptography.Plugin.PqSoft
+
+## Project
+- Path: `src/__Libraries/StellaOps.Cryptography.Plugin.PqSoft/StellaOps.Cryptography.Plugin.PqSoft.csproj`
+- Module: `__Libraries`
+- Kind: `Plugin`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 1
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/__Libraries/StellaOps.Cryptography.Plugin.PqSoft/PqSoftCryptoProvider.cs` (429 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: FAIL
+- Expected layers: Unit, Integration, Security, Offline
+- Detected test projects: none
+- Missing layers: Unit, Integration, Security, Offline
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- Add a unit test project named `<Project>.Tests` (or document exception).
+- Add integration tests for cross-component flows.
+- Add security tests for authn/authz or input validation.
+- Add offline/airgap coverage with fixtures only.

docs/implplan-blocked/audits/csproj-standards/__Libraries/StellaOps.Cryptography.Plugin.SimRemote/StellaOps.Cryptography.Plugin.SimRemote.md

@@ -0,0 +1,43 @@
+# Audit - StellaOps.Cryptography.Plugin.SimRemote
+
+## Project
+- Path: `src/__Libraries/StellaOps.Cryptography.Plugin.SimRemote/StellaOps.Cryptography.Plugin.SimRemote.csproj`
+- Module: `__Libraries`
+- Kind: `Plugin`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: PASS
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 0
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - none
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- None.
+
+## Testing Fullness Findings
+- Status: FAIL
+- Expected layers: Unit, Integration, Security, Offline
+- Detected test projects: none
+- Missing layers: Unit, Integration, Security, Offline
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- Add a unit test project named `<Project>.Tests` (or document exception).
+- Add integration tests for cross-component flows.
+- Add security tests for authn/authz or input validation.
+- Add offline/airgap coverage with fixtures only.

docs/implplan-blocked/audits/csproj-standards/__Libraries/StellaOps.Cryptography.Plugin.SmRemote/StellaOps.Cryptography.Plugin.SmRemote.md

@@ -0,0 +1,42 @@
+# Audit - StellaOps.Cryptography.Plugin.SmRemote
+
+## Project
+- Path: `src/__Libraries/StellaOps.Cryptography.Plugin.SmRemote/StellaOps.Cryptography.Plugin.SmRemote.csproj`
+- Module: `__Libraries`
+- Kind: `Plugin`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 1
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/__Libraries/StellaOps.Cryptography.Plugin.SmRemote/SmRemoteHttpProvider.cs` (117 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: FAIL
+- Expected layers: Unit, Integration, Security, Offline
+- Detected test projects: src/__Libraries/StellaOps.Cryptography.Plugin.SmRemote.Tests/StellaOps.Cryptography.Plugin.SmRemote.Tests.csproj [Unit]
+- Missing layers: Integration, Security, Offline
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- Add integration tests for cross-component flows.
+- Add security tests for authn/authz or input validation.
+- Add offline/airgap coverage with fixtures only.

docs/implplan-blocked/audits/csproj-standards/__Libraries/StellaOps.Cryptography.Plugin.SmSoft/StellaOps.Cryptography.Plugin.SmSoft.md

@@ -0,0 +1,42 @@
+# Audit - StellaOps.Cryptography.Plugin.SmSoft
+
+## Project
+- Path: `src/__Libraries/StellaOps.Cryptography.Plugin.SmSoft/StellaOps.Cryptography.Plugin.SmSoft.csproj`
+- Module: `__Libraries`
+- Kind: `Plugin`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 1
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/__Libraries/StellaOps.Cryptography.Plugin.SmSoft/SmSoftCryptoProvider.cs` (291 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: FAIL
+- Expected layers: Unit, Integration, Security, Offline
+- Detected test projects: src/__Libraries/StellaOps.Cryptography.Plugin.SmSoft.Tests/StellaOps.Cryptography.Plugin.SmSoft.Tests.csproj [Unit]
+- Missing layers: Integration, Security, Offline
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- Add integration tests for cross-component flows.
+- Add security tests for authn/authz or input validation.
+- Add offline/airgap coverage with fixtures only.

docs/implplan-blocked/audits/csproj-standards/__Libraries/StellaOps.Cryptography.Plugin.WineCsp/StellaOps.Cryptography.Plugin.WineCsp.md

@@ -0,0 +1,43 @@
+# Audit - StellaOps.Cryptography.Plugin.WineCsp
+
+## Project
+- Path: `src/__Libraries/StellaOps.Cryptography.Plugin.WineCsp/StellaOps.Cryptography.Plugin.WineCsp.csproj`
+- Module: `__Libraries`
+- Kind: `Plugin`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 1
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/__Libraries/StellaOps.Cryptography.Plugin.WineCsp/WineCspProvider.cs` (109 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: FAIL
+- Expected layers: Unit, Integration, Security, Offline
+- Detected test projects: none
+- Missing layers: Unit, Integration, Security, Offline
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- Add a unit test project named `<Project>.Tests` (or document exception).
+- Add integration tests for cross-component flows.
+- Add security tests for authn/authz or input validation.
+- Add offline/airgap coverage with fixtures only.

docs/implplan-blocked/audits/csproj-standards/__Libraries/StellaOps.Cryptography.PluginLoader/StellaOps.Cryptography.PluginLoader.md

@@ -0,0 +1,41 @@
+# Audit - StellaOps.Cryptography.PluginLoader
+
+## Project
+- Path: `src/__Libraries/StellaOps.Cryptography.PluginLoader/StellaOps.Cryptography.PluginLoader.csproj`
+- Module: `__Libraries`
+- Kind: `Library`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 2
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/__Libraries/StellaOps.Cryptography.PluginLoader/CryptoPluginLoader.cs` (340 lines)
+  - `src/__Libraries/StellaOps.Cryptography.PluginLoader/CryptoPluginManifest.cs` (105 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: PASS
+- Expected layers: Unit
+- Detected test projects: src/__Libraries/StellaOps.Cryptography.PluginLoader.Tests/StellaOps.Cryptography.PluginLoader.Tests.csproj [Unit]
+- Missing layers: none
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- None.

docs/implplan-blocked/audits/csproj-standards/__Libraries/StellaOps.Cryptography.Providers.OfflineVerification/StellaOps.Cryptography.Providers.OfflineVerification.md

@@ -0,0 +1,40 @@
+# Audit - StellaOps.Cryptography.Providers.OfflineVerification
+
+## Project
+- Path: `src/__Libraries/StellaOps.Cryptography.Providers.OfflineVerification/StellaOps.Cryptography.Providers.OfflineVerification.csproj`
+- Module: `__Libraries`
+- Kind: `Library`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 1
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/__Libraries/StellaOps.Cryptography.Providers.OfflineVerification/OfflineVerificationCryptoProvider.cs` (174 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: FAIL
+- Expected layers: Unit
+- Detected test projects: none
+- Missing layers: Unit
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- Add a unit test project named `<Project>.Tests` (or document exception).

docs/implplan-blocked/audits/csproj-standards/__Libraries/StellaOps.Cryptography/StellaOps.Cryptography.md

@@ -0,0 +1,57 @@
+# Audit - StellaOps.Cryptography
+
+## Project
+- Path: `src/__Libraries/StellaOps.Cryptography/StellaOps.Cryptography.csproj`
+- Module: `__Libraries`
+- Kind: `Library`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 18
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/__Libraries/StellaOps.Cryptography/DefaultCryptoHash.cs` (367 lines)
+  - `src/__Libraries/StellaOps.Cryptography/DefaultCryptoHmac.cs` (323 lines)
+  - `src/__Libraries/StellaOps.Cryptography/ComplianceProfiles.cs` (288 lines)
+  - `src/__Libraries/StellaOps.Cryptography/CompliancePolicyCryptoProviders.cs` (285 lines)
+  - `src/__Libraries/StellaOps.Cryptography/Audit/AuthEventRecord.cs` (278 lines)
+  - `src/__Libraries/StellaOps.Cryptography/CryptoSigningKey.cs` (223 lines)
+  - `src/__Libraries/StellaOps.Cryptography/DefaultCryptoProvider.cs` (192 lines)
+  - `src/__Libraries/StellaOps.Cryptography/Argon2idPasswordHasher.cs` (173 lines)
+  - `src/__Libraries/StellaOps.Cryptography/CryptoComplianceService.cs` (165 lines)
+  - `src/__Libraries/StellaOps.Cryptography/CryptoProviderRegistry.cs` (154 lines)
+  - `src/__Libraries/StellaOps.Cryptography/Pbkdf2PasswordHasher.cs` (137 lines)
+  - `src/__Libraries/StellaOps.Cryptography/CryptoProvider.cs` (135 lines)
+  - `src/__Libraries/StellaOps.Cryptography/LibsodiumCryptoProvider.cs` (128 lines)
+  - `src/__Libraries/StellaOps.Cryptography/GostSignatureEncoding.cs` (126 lines)
+  - `src/__Libraries/StellaOps.Cryptography/ComplianceProfile.cs` (125 lines)
+  - `src/__Libraries/StellaOps.Cryptography/CryptoComplianceDiagnostics.cs` (117 lines)
+  - `src/__Libraries/StellaOps.Cryptography/ICryptoHash.cs` (116 lines)
+  - `src/__Libraries/StellaOps.Cryptography/ICryptoHmac.cs` (115 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: PASS
+- Expected layers: Unit
+- Detected test projects: src/__Libraries/__Tests/StellaOps.Cryptography.Tests/StellaOps.Cryptography.Tests.csproj [Unit], src/__Libraries/__Tests/StellaOps.Cryptography.Plugin.OfflineVerification.Tests/StellaOps.Cryptography.Plugin.OfflineVerification.Tests.csproj [Offline], src/__Libraries/__Tests/StellaOps.Cryptography.Kms.Tests/StellaOps.Cryptography.Kms.Tests.csproj [Unit], src/Cryptography/__Tests/StellaOps.Cryptography.Tests/StellaOps.Cryptography.Tests.csproj [Unit], src/__Libraries/StellaOps.Cryptography.Tests/StellaOps.Cryptography.Tests.csproj [Unit], src/__Libraries/StellaOps.Cryptography.PluginLoader.Tests/StellaOps.Cryptography.PluginLoader.Tests.csproj [Unit], src/__Libraries/StellaOps.Cryptography.Plugin.SmSoft.Tests/StellaOps.Cryptography.Plugin.SmSoft.Tests.csproj [Unit], src/__Libraries/StellaOps.Cryptography.Plugin.SmRemote.Tests/StellaOps.Cryptography.Plugin.SmRemote.Tests.csproj [Unit], src/__Libraries/StellaOps.Cryptography.Plugin.EIDAS.Tests/StellaOps.Cryptography.Plugin.EIDAS.Tests.csproj [Unit]
+- Missing layers: none
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- None.

docs/implplan-blocked/audits/csproj-standards/__Libraries/StellaOps.DeltaVerdict/StellaOps.DeltaVerdict.md

@@ -0,0 +1,59 @@
+# Audit - StellaOps.DeltaVerdict
+
+## Project
+- Path: `src/__Libraries/StellaOps.DeltaVerdict/StellaOps.DeltaVerdict.csproj`
+- Module: `__Libraries`
+- Kind: `Library`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 20
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/__Libraries/StellaOps.DeltaVerdict/Bundles/VerdictBundle.cs` (533 lines)
+  - `src/__Libraries/StellaOps.DeltaVerdict/Signing/ScoringManifestRekorAnchorService.cs` (500 lines)
+  - `src/__Libraries/StellaOps.DeltaVerdict/Bundles/VerdictSigningService.cs` (481 lines)
+  - `src/__Libraries/StellaOps.DeltaVerdict/Bundles/VerdictBundleBuilder.cs` (479 lines)
+  - `src/__Libraries/StellaOps.DeltaVerdict/Bundles/VerdictRekorAnchorService.cs` (460 lines)
+  - `src/__Libraries/StellaOps.DeltaVerdict/Manifest/ScoringManifestVersioner.cs` (459 lines)
+  - `src/__Libraries/StellaOps.DeltaVerdict/__Tests/StellaOps.DeltaVerdict.Tests/Serialization/VerdictInputsSerializerTests.cs` (457 lines)
+  - `src/__Libraries/StellaOps.DeltaVerdict/Validation/AdversarialInputValidator.cs` (414 lines)
+  - `src/__Libraries/StellaOps.DeltaVerdict/__Tests/StellaOps.DeltaVerdict.Tests/Serialization/VerdictInputsGoldenSnapshotTests.cs` (397 lines)
+  - `src/__Libraries/StellaOps.DeltaVerdict/Signing/ScoringManifestSigningService.cs` (396 lines)
+  - `src/__Libraries/StellaOps.DeltaVerdict/Bundles/GateEvaluator.cs` (391 lines)
+  - `src/__Libraries/StellaOps.DeltaVerdict/Trust/ScoringTrustProvider.cs` (361 lines)
+  - `src/__Libraries/StellaOps.DeltaVerdict/Serialization/VerdictInputsSerializer.cs` (349 lines)
+  - `src/__Libraries/StellaOps.DeltaVerdict/Validation/IAdversarialInputValidator.cs` (314 lines)
+  - `src/__Libraries/StellaOps.DeltaVerdict/Manifest/ScoringManifest.cs` (302 lines)
+  - `src/__Libraries/StellaOps.DeltaVerdict/Engine/DeltaComputationEngine.cs` (296 lines)
+  - `src/__Libraries/StellaOps.DeltaVerdict/Inputs/PinnedInput.cs` (271 lines)
+  - `src/__Libraries/StellaOps.DeltaVerdict/Trust/IScoringTrustProvider.cs` (220 lines)
+  - `src/__Libraries/StellaOps.DeltaVerdict/Signing/DeltaSigningService.cs` (205 lines)
+  - `src/__Libraries/StellaOps.DeltaVerdict/Models/DeltaVerdict.cs` (158 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: PASS
+- Expected layers: Unit
+- Detected test projects: src/__Libraries/__Tests/StellaOps.DeltaVerdict.Tests/StellaOps.DeltaVerdict.Tests.csproj [Unit], src/__Libraries/StellaOps.DeltaVerdict/__Tests/StellaOps.DeltaVerdict.Tests/StellaOps.DeltaVerdict.Tests.csproj [Unit]
+- Missing layers: none
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- None.

docs/implplan-blocked/audits/csproj-standards/__Libraries/StellaOps.DependencyInjection/StellaOps.DependencyInjection.md

@@ -0,0 +1,41 @@
+# Audit - StellaOps.DependencyInjection
+
+## Project
+- Path: `src/__Libraries/StellaOps.DependencyInjection/StellaOps.DependencyInjection.csproj`
+- Module: `__Libraries`
+- Kind: `Library`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 2
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/__Libraries/StellaOps.DependencyInjection/Validation/OptionsValidatorBase.cs` (183 lines)
+  - `src/__Libraries/StellaOps.DependencyInjection/Validation/FailFastOptionsExtensions.cs` (121 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: FAIL
+- Expected layers: Unit
+- Detected test projects: none
+- Missing layers: Unit
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- Add a unit test project named `<Project>.Tests` (or document exception).

docs/implplan-blocked/audits/csproj-standards/__Libraries/StellaOps.Determinism.Abstractions/StellaOps.Determinism.Abstractions.md

@@ -0,0 +1,40 @@
+# Audit - StellaOps.Determinism.Abstractions
+
+## Project
+- Path: `src/__Libraries/StellaOps.Determinism.Abstractions/StellaOps.Determinism.Abstractions.csproj`
+- Module: `__Libraries`
+- Kind: `Library`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: PASS
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 0
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - none
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- None.
+
+## Testing Fullness Findings
+- Status: FAIL
+- Expected layers: Unit
+- Detected test projects: none
+- Missing layers: Unit
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- Add a unit test project named `<Project>.Tests` (or document exception).

docs/implplan-blocked/audits/csproj-standards/__Libraries/StellaOps.DistroIntel/StellaOps.DistroIntel.md

@@ -0,0 +1,40 @@
+# Audit - StellaOps.DistroIntel
+
+## Project
+- Path: `src/__Libraries/StellaOps.DistroIntel/StellaOps.DistroIntel.csproj`
+- Module: `__Libraries`
+- Kind: `Library`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 1
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/__Libraries/StellaOps.DistroIntel/DistroDerivative.cs` (185 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: PASS
+- Expected layers: Unit
+- Detected test projects: src/__Libraries/__Tests/StellaOps.DistroIntel.Tests/StellaOps.DistroIntel.Tests.csproj [Unit]
+- Missing layers: none
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- None.

docs/implplan-blocked/audits/csproj-standards/__Libraries/StellaOps.Doctor.Plugins.AI/StellaOps.Doctor.Plugins.AI.md

@@ -0,0 +1,52 @@
+# Audit - StellaOps.Doctor.Plugins.AI
+
+## Project
+- Path: `src/__Libraries/StellaOps.Doctor.Plugins.AI/StellaOps.Doctor.Plugins.AI.csproj`
+- Module: `__Libraries`
+- Kind: `Plugin`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 6
+- Service locator usage (BuildServiceProvider/GetService): 5
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/__Libraries/StellaOps.Doctor.Plugins.AI/Checks/ClaudeProviderCheck.cs` (204 lines)
+  - `src/__Libraries/StellaOps.Doctor.Plugins.AI/Checks/OllamaProviderCheck.cs` (202 lines)
+  - `src/__Libraries/StellaOps.Doctor.Plugins.AI/Checks/GeminiProviderCheck.cs` (192 lines)
+  - `src/__Libraries/StellaOps.Doctor.Plugins.AI/Checks/OpenAiProviderCheck.cs` (188 lines)
+  - `src/__Libraries/StellaOps.Doctor.Plugins.AI/Checks/LocalInferenceCheck.cs` (184 lines)
+  - `src/__Libraries/StellaOps.Doctor.Plugins.AI/Checks/LlmProviderConfigurationCheck.cs` (161 lines)
+- Service locator matches:
+  - `src/__Libraries/StellaOps.Doctor.Plugins.AI/Checks/GeminiProviderCheck.cs`:72 var httpClientFactory = context.Services.GetService<IHttpClientFactory>();
+  - `src/__Libraries/StellaOps.Doctor.Plugins.AI/Checks/ClaudeProviderCheck.cs`:72 var httpClientFactory = context.Services.GetService<IHttpClientFactory>();
+  - `src/__Libraries/StellaOps.Doctor.Plugins.AI/Checks/OpenAiProviderCheck.cs`:72 var httpClientFactory = context.Services.GetService<IHttpClientFactory>();
+  - `src/__Libraries/StellaOps.Doctor.Plugins.AI/Checks/OllamaProviderCheck.cs`:53 var httpClientFactory = context.Services.GetService<IHttpClientFactory>();
+  - `src/__Libraries/StellaOps.Doctor.Plugins.AI/Checks/LocalInferenceCheck.cs`:54 var httpClientFactory = context.Services.GetService<IHttpClientFactory>();
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+- Replace service locator usage with constructor injection.
+
+## Testing Fullness Findings
+- Status: FAIL
+- Expected layers: Unit, Integration, Security, Offline
+- Detected test projects: src/__Libraries/__Tests/StellaOps.Doctor.Plugins.AI.Tests/StellaOps.Doctor.Plugins.AI.Tests.csproj [Unit]
+- Missing layers: Integration, Security, Offline
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- Add integration tests for cross-component flows.
+- Add security tests for authn/authz or input validation.
+- Add offline/airgap coverage with fixtures only.

docs/implplan-blocked/audits/csproj-standards/__Libraries/StellaOps.Doctor.Plugins.Attestation/StellaOps.Doctor.Plugins.Attestation.md

@@ -0,0 +1,47 @@
+# Audit - StellaOps.Doctor.Plugins.Attestation
+
+## Project
+- Path: `src/__Libraries/StellaOps.Doctor.Plugins.Attestation/StellaOps.Doctor.Plugins.Attestation.csproj`
+- Module: `__Libraries`
+- Kind: `Plugin`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 5
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/__Libraries/StellaOps.Doctor.Plugins.Attestation/Checks/CosignKeyMaterialCheck.cs` (291 lines)
+  - `src/__Libraries/StellaOps.Doctor.Plugins.Attestation/Checks/OfflineBundleCheck.cs` (253 lines)
+  - `src/__Libraries/StellaOps.Doctor.Plugins.Attestation/Checks/ClockSkewCheck.cs` (181 lines)
+  - `src/__Libraries/StellaOps.Doctor.Plugins.Attestation/Checks/RekorConnectivityCheck.cs` (138 lines)
+  - `src/__Libraries/StellaOps.Doctor.Plugins.Attestation/Checks/AttestationCheckBase.cs` (133 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: FAIL
+- Expected layers: Unit, Integration, Security, Offline
+- Detected test projects: none
+- Missing layers: Unit, Integration, Security, Offline
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- Add a unit test project named `<Project>.Tests` (or document exception).
+- Add integration tests for cross-component flows.
+- Add security tests for authn/authz or input validation.
+- Add offline/airgap coverage with fixtures only.

docs/implplan-blocked/audits/csproj-standards/__Libraries/StellaOps.Doctor.Plugins.Authority/StellaOps.Doctor.Plugins.Authority.md

@@ -0,0 +1,46 @@
+# Audit - StellaOps.Doctor.Plugins.Authority
+
+## Project
+- Path: `src/__Libraries/StellaOps.Doctor.Plugins.Authority/StellaOps.Doctor.Plugins.Authority.csproj`
+- Module: `__Libraries`
+- Kind: `Plugin`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 5
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/__Libraries/StellaOps.Doctor.Plugins.Authority/Checks/AuthorityPluginConnectivityCheck.cs` (163 lines)
+  - `src/__Libraries/StellaOps.Doctor.Plugins.Authority/Checks/AuthorityPluginConfigurationCheck.cs` (156 lines)
+  - `src/__Libraries/StellaOps.Doctor.Plugins.Authority/Checks/UserPasswordPolicyCheck.cs` (153 lines)
+  - `src/__Libraries/StellaOps.Doctor.Plugins.Authority/Checks/BootstrapUserExistsCheck.cs` (141 lines)
+  - `src/__Libraries/StellaOps.Doctor.Plugins.Authority/Checks/SuperUserExistsCheck.cs` (126 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: FAIL
+- Expected layers: Unit, Integration, Security, Offline
+- Detected test projects: src/__Libraries/__Tests/StellaOps.Doctor.Plugins.Authority.Tests/StellaOps.Doctor.Plugins.Authority.Tests.csproj [Unit]
+- Missing layers: Integration, Security, Offline
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- Add integration tests for cross-component flows.
+- Add security tests for authn/authz or input validation.
+- Add offline/airgap coverage with fixtures only.

docs/implplan-blocked/audits/csproj-standards/__Libraries/StellaOps.Doctor.Plugins.Core/StellaOps.Doctor.Plugins.Core.md

@@ -0,0 +1,51 @@
+# Audit - StellaOps.Doctor.Plugins.Core
+
+## Project
+- Path: `src/__Libraries/StellaOps.Doctor.Plugins.Core/StellaOps.Doctor.Plugins.Core.csproj`
+- Module: `__Libraries`
+- Kind: `Plugin`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 7
+- Service locator usage (BuildServiceProvider/GetService): 3
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/__Libraries/StellaOps.Doctor.Plugins.Core/Checks/CryptoProvidersCheck.cs` (160 lines)
+  - `src/__Libraries/StellaOps.Doctor.Plugins.Core/Checks/AuthenticationConfigCheck.cs` (142 lines)
+  - `src/__Libraries/StellaOps.Doctor.Plugins.Core/Checks/ServiceHealthCheck.cs` (129 lines)
+  - `src/__Libraries/StellaOps.Doctor.Plugins.Core/Checks/DiskSpaceCheck.cs` (129 lines)
+  - `src/__Libraries/StellaOps.Doctor.Plugins.Core/Checks/MemoryUsageCheck.cs` (128 lines)
+  - `src/__Libraries/StellaOps.Doctor.Plugins.Core/Checks/RequiredSettingsCheck.cs` (104 lines)
+  - `src/__Libraries/StellaOps.Doctor.Plugins.Core/Checks/EnvironmentVariablesCheck.cs` (101 lines)
+- Service locator matches:
+  - `src/__Libraries/StellaOps.Doctor.Plugins.Core/Checks/DependencyServicesCheck.cs`:54 var service = context.Services.GetService(serviceType);
+  - `src/__Libraries/StellaOps.Doctor.Plugins.Core/Checks/ServiceHealthCheck.cs`:36 return context.Services.GetService<HealthCheckService>() is not null;
+  - `src/__Libraries/StellaOps.Doctor.Plugins.Core/Checks/ServiceHealthCheck.cs`:43 var healthService = context.Services.GetService<HealthCheckService>();
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+- Replace service locator usage with constructor injection.
+
+## Testing Fullness Findings
+- Status: FAIL
+- Expected layers: Unit, Integration, Security, Offline
+- Detected test projects: src/__Libraries/__Tests/StellaOps.Doctor.Plugins.Core.Tests/StellaOps.Doctor.Plugins.Core.Tests.csproj [Unit]
+- Missing layers: Integration, Security, Offline
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- Add integration tests for cross-component flows.
+- Add security tests for authn/authz or input validation.
+- Add offline/airgap coverage with fixtures only.

docs/implplan-blocked/audits/csproj-standards/__Libraries/StellaOps.Doctor.Plugins.Cryptography/StellaOps.Doctor.Plugins.Cryptography.md

@@ -0,0 +1,49 @@
+# Audit - StellaOps.Doctor.Plugins.Cryptography
+
+## Project
+- Path: `src/__Libraries/StellaOps.Doctor.Plugins.Cryptography/StellaOps.Doctor.Plugins.Cryptography.csproj`
+- Module: `__Libraries`
+- Kind: `Plugin`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 8
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/__Libraries/StellaOps.Doctor.Plugins.Cryptography/Checks/HsmConnectivityCheck.cs` (320 lines)
+  - `src/__Libraries/StellaOps.Doctor.Plugins.Cryptography/Checks/GostProviderCheck.cs` (209 lines)
+  - `src/__Libraries/StellaOps.Doctor.Plugins.Cryptography/Checks/EidasProviderCheck.cs` (200 lines)
+  - `src/__Libraries/StellaOps.Doctor.Plugins.Cryptography/Checks/CryptoLicenseCheck.cs` (189 lines)
+  - `src/__Libraries/StellaOps.Doctor.Plugins.Cryptography/Checks/CryptoProCheck.cs` (172 lines)
+  - `src/__Libraries/StellaOps.Doctor.Plugins.Cryptography/Checks/SmProviderCheck.cs` (160 lines)
+  - `src/__Libraries/StellaOps.Doctor.Plugins.Cryptography/Checks/FipsComplianceCheck.cs` (147 lines)
+  - `src/__Libraries/StellaOps.Doctor.Plugins.Cryptography/Checks/CryptoProviderAvailabilityCheck.cs` (130 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: FAIL
+- Expected layers: Unit, Integration, Security, Offline
+- Detected test projects: src/__Libraries/__Tests/StellaOps.Doctor.Plugins.Cryptography.Tests/StellaOps.Doctor.Plugins.Cryptography.Tests.csproj [Unit]
+- Missing layers: Integration, Security, Offline
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- Add integration tests for cross-component flows.
+- Add security tests for authn/authz or input validation.
+- Add offline/airgap coverage with fixtures only.

docs/implplan-blocked/audits/csproj-standards/__Libraries/StellaOps.Doctor.Plugins.Database/StellaOps.Doctor.Plugins.Database.md

@@ -0,0 +1,48 @@
+# Audit - StellaOps.Doctor.Plugins.Database
+
+## Project
+- Path: `src/__Libraries/StellaOps.Doctor.Plugins.Database/StellaOps.Doctor.Plugins.Database.csproj`
+- Module: `__Libraries`
+- Kind: `Plugin`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 7
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/__Libraries/StellaOps.Doctor.Plugins.Database/Checks/DatabasePermissionsCheck.cs` (158 lines)
+  - `src/__Libraries/StellaOps.Doctor.Plugins.Database/Checks/QueryLatencyCheck.cs` (153 lines)
+  - `src/__Libraries/StellaOps.Doctor.Plugins.Database/Checks/SchemaVersionCheck.cs` (137 lines)
+  - `src/__Libraries/StellaOps.Doctor.Plugins.Database/Checks/ConnectionPoolHealthCheck.cs` (132 lines)
+  - `src/__Libraries/StellaOps.Doctor.Plugins.Database/Checks/DatabaseCheckBase.cs` (125 lines)
+  - `src/__Libraries/StellaOps.Doctor.Plugins.Database/Checks/ConnectionPoolSizeCheck.cs` (119 lines)
+  - `src/__Libraries/StellaOps.Doctor.Plugins.Database/Checks/FailedMigrationsCheck.cs` (111 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: FAIL
+- Expected layers: Unit, Integration, Security, Offline
+- Detected test projects: src/__Libraries/__Tests/StellaOps.Doctor.Plugins.Database.Tests/StellaOps.Doctor.Plugins.Database.Tests.csproj [Unit]
+- Missing layers: Integration, Security, Offline
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- Add integration tests for cross-component flows.
+- Add security tests for authn/authz or input validation.
+- Add offline/airgap coverage with fixtures only.

docs/implplan-blocked/audits/csproj-standards/__Libraries/StellaOps.Doctor.Plugins.Docker/StellaOps.Doctor.Plugins.Docker.md

@@ -0,0 +1,46 @@
+# Audit - StellaOps.Doctor.Plugins.Docker
+
+## Project
+- Path: `src/__Libraries/StellaOps.Doctor.Plugins.Docker/StellaOps.Doctor.Plugins.Docker.csproj`
+- Module: `__Libraries`
+- Kind: `Plugin`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 5
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/__Libraries/StellaOps.Doctor.Plugins.Docker/Checks/DockerStorageCheck.cs` (192 lines)
+  - `src/__Libraries/StellaOps.Doctor.Plugins.Docker/Checks/DockerSocketCheck.cs` (161 lines)
+  - `src/__Libraries/StellaOps.Doctor.Plugins.Docker/Checks/DockerNetworkCheck.cs` (143 lines)
+  - `src/__Libraries/StellaOps.Doctor.Plugins.Docker/Checks/DockerApiVersionCheck.cs` (136 lines)
+  - `src/__Libraries/StellaOps.Doctor.Plugins.Docker/Checks/DockerDaemonCheck.cs` (131 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: FAIL
+- Expected layers: Unit, Integration, Security, Offline
+- Detected test projects: src/__Libraries/__Tests/StellaOps.Doctor.Plugins.Docker.Tests/StellaOps.Doctor.Plugins.Docker.Tests.csproj [Unit]
+- Missing layers: Integration, Security, Offline
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- Add integration tests for cross-component flows.
+- Add security tests for authn/authz or input validation.
+- Add offline/airgap coverage with fixtures only.

docs/implplan-blocked/audits/csproj-standards/__Libraries/StellaOps.Doctor.Plugins.Integration/StellaOps.Doctor.Plugins.Integration.md

@@ -0,0 +1,70 @@
+# Audit - StellaOps.Doctor.Plugins.Integration
+
+## Project
+- Path: `src/__Libraries/StellaOps.Doctor.Plugins.Integration/StellaOps.Doctor.Plugins.Integration.csproj`
+- Module: `__Libraries`
+- Kind: `Plugin`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 16
+- Service locator usage (BuildServiceProvider/GetService): 13
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/__Libraries/StellaOps.Doctor.Plugins.Integration/Checks/CiSystemConnectivityCheck.cs` (375 lines)
+  - `src/__Libraries/StellaOps.Doctor.Plugins.Integration/Checks/SecretsManagerConnectivityCheck.cs` (339 lines)
+  - `src/__Libraries/StellaOps.Doctor.Plugins.Integration/Checks/RegistryCapabilityProbeCheck.cs` (308 lines)
+  - `src/__Libraries/StellaOps.Doctor.Plugins.Integration/Checks/IntegrationWebhookHealthCheck.cs` (307 lines)
+  - `src/__Libraries/StellaOps.Doctor.Plugins.Integration/Checks/RegistryReferrersApiCheck.cs` (278 lines)
+  - `src/__Libraries/StellaOps.Doctor.Plugins.Integration/Checks/RegistryPullAuthorizationCheck.cs` (239 lines)
+  - `src/__Libraries/StellaOps.Doctor.Plugins.Integration/Checks/RegistryCredentialsCheck.cs` (237 lines)
+  - `src/__Libraries/StellaOps.Doctor.Plugins.Integration/Checks/RegistryPushAuthorizationCheck.cs` (221 lines)
+  - `src/__Libraries/StellaOps.Doctor.Plugins.Integration/Checks/ObjectStorageCheck.cs` (167 lines)
+  - `src/__Libraries/StellaOps.Doctor.Plugins.Integration/Checks/LdapConnectivityCheck.cs` (163 lines)
+  - `src/__Libraries/StellaOps.Doctor.Plugins.Integration/Checks/GitProviderCheck.cs` (160 lines)
+  - `src/__Libraries/StellaOps.Doctor.Plugins.Integration/Checks/SmtpCheck.cs` (158 lines)
+  - `src/__Libraries/StellaOps.Doctor.Plugins.Integration/Checks/OidcProviderCheck.cs` (156 lines)
+  - `src/__Libraries/StellaOps.Doctor.Plugins.Integration/Checks/SlackWebhookCheck.cs` (135 lines)
+  - `src/__Libraries/StellaOps.Doctor.Plugins.Integration/Checks/TeamsWebhookCheck.cs` (133 lines)
+  - `src/__Libraries/StellaOps.Doctor.Plugins.Integration/Checks/OciRegistryCheck.cs` (121 lines)
+- Service locator matches:
+  - `src/__Libraries/StellaOps.Doctor.Plugins.Integration/Checks/CiSystemConnectivityCheck.cs`:68 var httpClientFactory = context.Services.GetService<IHttpClientFactory>();
+  - `src/__Libraries/StellaOps.Doctor.Plugins.Integration/Checks/IntegrationWebhookHealthCheck.cs`:70 var httpClientFactory = context.Services.GetService<IHttpClientFactory>();
+  - `src/__Libraries/StellaOps.Doctor.Plugins.Integration/Checks/GitProviderCheck.cs`:64 var httpClientFactory = context.Services.GetService<IHttpClientFactory>();
+  - `src/__Libraries/StellaOps.Doctor.Plugins.Integration/Checks/OciRegistryCheck.cs`:56 var httpClientFactory = context.Services.GetService<IHttpClientFactory>();
+  - `src/__Libraries/StellaOps.Doctor.Plugins.Integration/Checks/OidcProviderCheck.cs`:61 var httpClientFactory = context.Services.GetService<IHttpClientFactory>();
+  - `src/__Libraries/StellaOps.Doctor.Plugins.Integration/Checks/RegistryCapabilityProbeCheck.cs`:54 var httpClientFactory = context.Services.GetService<IHttpClientFactory>();
+  - `src/__Libraries/StellaOps.Doctor.Plugins.Integration/Checks/RegistryCredentialsCheck.cs`:99 var httpClientFactory = context.Services.GetService<IHttpClientFactory>();
+  - `src/__Libraries/StellaOps.Doctor.Plugins.Integration/Checks/RegistryPushAuthorizationCheck.cs`:57 var httpClientFactory = context.Services.GetService<IHttpClientFactory>();
+  - `src/__Libraries/StellaOps.Doctor.Plugins.Integration/Checks/RegistryPullAuthorizationCheck.cs`:58 var httpClientFactory = context.Services.GetService<IHttpClientFactory>();
+  - `src/__Libraries/StellaOps.Doctor.Plugins.Integration/Checks/SlackWebhookCheck.cs`:68 var httpClientFactory = context.Services.GetService<IHttpClientFactory>();
+  - `src/__Libraries/StellaOps.Doctor.Plugins.Integration/Checks/TeamsWebhookCheck.cs`:71 var httpClientFactory = context.Services.GetService<IHttpClientFactory>();
+  - `src/__Libraries/StellaOps.Doctor.Plugins.Integration/Checks/SecretsManagerConnectivityCheck.cs`:68 var httpClientFactory = context.Services.GetService<IHttpClientFactory>();
+  - `src/__Libraries/StellaOps.Doctor.Plugins.Integration/Checks/RegistryReferrersApiCheck.cs`:57 var httpClientFactory = context.Services.GetService<IHttpClientFactory>();
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+- Replace service locator usage with constructor injection.
+
+## Testing Fullness Findings
+- Status: FAIL
+- Expected layers: Unit, Integration, Security, Offline
+- Detected test projects: src/__Tests/__Libraries/StellaOps.Doctor.Plugins.Integration.Tests/StellaOps.Doctor.Plugins.Integration.Tests.csproj [Integration], src/__Libraries/__Tests/StellaOps.Doctor.Plugins.Integration.Tests/StellaOps.Doctor.Plugins.Integration.Tests.csproj [Integration]
+- Missing layers: Unit, Security, Offline
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- Add a unit test project named `<Project>.Tests` (or document exception).
+- Add security tests for authn/authz or input validation.
+- Add offline/airgap coverage with fixtures only.

docs/implplan-blocked/audits/csproj-standards/__Libraries/StellaOps.Doctor.Plugins.Notify/StellaOps.Doctor.Plugins.Notify.md

@@ -0,0 +1,44 @@
+# Audit - StellaOps.Doctor.Plugins.Notify
+
+## Project
+- Path: `src/__Libraries/StellaOps.Doctor.Plugins.Notify/StellaOps.Doctor.Plugins.Notify.csproj`
+- Module: `__Libraries`
+- Kind: `Plugin`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 3
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/__Libraries/StellaOps.Doctor.Plugins.Notify/Checks/NotifyChannelConnectivityCheck.cs` (197 lines)
+  - `src/__Libraries/StellaOps.Doctor.Plugins.Notify/Checks/NotifyChannelConfigurationCheck.cs` (178 lines)
+  - `src/__Libraries/StellaOps.Doctor.Plugins.Notify/Checks/NotifyDeliveryTestCheck.cs` (162 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: FAIL
+- Expected layers: Unit, Integration, Security, Offline
+- Detected test projects: src/__Libraries/__Tests/StellaOps.Doctor.Plugins.Notify.Tests/StellaOps.Doctor.Plugins.Notify.Tests.csproj [Unit]
+- Missing layers: Integration, Security, Offline
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- Add integration tests for cross-component flows.
+- Add security tests for authn/authz or input validation.
+- Add offline/airgap coverage with fixtures only.

docs/implplan-blocked/audits/csproj-standards/__Libraries/StellaOps.Doctor.Plugins.Observability/StellaOps.Doctor.Plugins.Observability.md

@@ -0,0 +1,50 @@
+# Audit - StellaOps.Doctor.Plugins.Observability
+
+## Project
+- Path: `src/__Libraries/StellaOps.Doctor.Plugins.Observability/StellaOps.Doctor.Plugins.Observability.csproj`
+- Module: `__Libraries`
+- Kind: `Plugin`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 6
+- Service locator usage (BuildServiceProvider/GetService): 3
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/__Libraries/StellaOps.Doctor.Plugins.Observability/Checks/OpenTelemetryCheck.cs` (144 lines)
+  - `src/__Libraries/StellaOps.Doctor.Plugins.Observability/Checks/MetricsCollectionCheck.cs` (136 lines)
+  - `src/__Libraries/StellaOps.Doctor.Plugins.Observability/Checks/TracingConfigurationCheck.cs` (135 lines)
+  - `src/__Libraries/StellaOps.Doctor.Plugins.Observability/Checks/HealthCheckEndpointsCheck.cs` (134 lines)
+  - `src/__Libraries/StellaOps.Doctor.Plugins.Observability/Checks/AlertingConfigurationCheck.cs` (124 lines)
+  - `src/__Libraries/StellaOps.Doctor.Plugins.Observability/Checks/LoggingConfigurationCheck.cs` (108 lines)
+- Service locator matches:
+  - `src/__Libraries/StellaOps.Doctor.Plugins.Observability/Checks/HealthCheckEndpointsCheck.cs`:61 var httpClientFactory = context.Services.GetService<IHttpClientFactory>();
+  - `src/__Libraries/StellaOps.Doctor.Plugins.Observability/Checks/MetricsCollectionCheck.cs`:83 var httpClientFactory = context.Services.GetService<IHttpClientFactory>();
+  - `src/__Libraries/StellaOps.Doctor.Plugins.Observability/Checks/OpenTelemetryCheck.cs`:93 var httpClientFactory = context.Services.GetService<IHttpClientFactory>();
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+- Replace service locator usage with constructor injection.
+
+## Testing Fullness Findings
+- Status: FAIL
+- Expected layers: Unit, Integration, Security, Offline
+- Detected test projects: src/__Libraries/__Tests/StellaOps.Doctor.Plugins.Observability.Tests/StellaOps.Doctor.Plugins.Observability.Tests.csproj [Unit]
+- Missing layers: Integration, Security, Offline
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- Add integration tests for cross-component flows.
+- Add security tests for authn/authz or input validation.
+- Add offline/airgap coverage with fixtures only.

docs/implplan-blocked/audits/csproj-standards/__Libraries/StellaOps.Doctor.Plugins.Security/StellaOps.Doctor.Plugins.Security.md

@@ -0,0 +1,52 @@
+# Audit - StellaOps.Doctor.Plugins.Security
+
+## Project
+- Path: `src/__Libraries/StellaOps.Doctor.Plugins.Security/StellaOps.Doctor.Plugins.Security.csproj`
+- Module: `__Libraries`
+- Kind: `Plugin`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 11
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/__Libraries/StellaOps.Doctor.Plugins.Security/Checks/EvidenceIntegrityCheck.cs` (470 lines)
+  - `src/__Libraries/StellaOps.Doctor.Plugins.Security/Checks/TlsCertificateCheck.cs` (166 lines)
+  - `src/__Libraries/StellaOps.Doctor.Plugins.Security/Checks/PasswordPolicyCheck.cs` (153 lines)
+  - `src/__Libraries/StellaOps.Doctor.Plugins.Security/Checks/ApiKeySecurityCheck.cs` (147 lines)
+  - `src/__Libraries/StellaOps.Doctor.Plugins.Security/Checks/JwtConfigurationCheck.cs` (135 lines)
+  - `src/__Libraries/StellaOps.Doctor.Plugins.Security/Checks/RateLimitingCheck.cs` (132 lines)
+  - `src/__Libraries/StellaOps.Doctor.Plugins.Security/Checks/SecretsConfigurationCheck.cs` (129 lines)
+  - `src/__Libraries/StellaOps.Doctor.Plugins.Security/Checks/AuditLoggingCheck.cs` (128 lines)
+  - `src/__Libraries/StellaOps.Doctor.Plugins.Security/Checks/CorsConfigurationCheck.cs` (120 lines)
+  - `src/__Libraries/StellaOps.Doctor.Plugins.Security/Checks/SecurityHeadersCheck.cs` (117 lines)
+  - `src/__Libraries/StellaOps.Doctor.Plugins.Security/Checks/EncryptionKeyCheck.cs` (114 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: FAIL
+- Expected layers: Unit, Integration, Security, Offline
+- Detected test projects: src/__Libraries/__Tests/StellaOps.Doctor.Plugins.Security.Tests/StellaOps.Doctor.Plugins.Security.Tests.csproj [Security]
+- Missing layers: Unit, Integration, Offline
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- Add a unit test project named `<Project>.Tests` (or document exception).
+- Add integration tests for cross-component flows.
+- Add offline/airgap coverage with fixtures only.

docs/implplan-blocked/audits/csproj-standards/__Libraries/StellaOps.Doctor.Plugins.ServiceGraph/StellaOps.Doctor.Plugins.ServiceGraph.md

@@ -0,0 +1,49 @@
+# Audit - StellaOps.Doctor.Plugins.ServiceGraph
+
+## Project
+- Path: `src/__Libraries/StellaOps.Doctor.Plugins.ServiceGraph/StellaOps.Doctor.Plugins.ServiceGraph.csproj`
+- Module: `__Libraries`
+- Kind: `Plugin`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 5
+- Service locator usage (BuildServiceProvider/GetService): 3
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/__Libraries/StellaOps.Doctor.Plugins.ServiceGraph/Checks/ValkeyConnectivityCheck.cs` (192 lines)
+  - `src/__Libraries/StellaOps.Doctor.Plugins.ServiceGraph/Checks/BackendConnectivityCheck.cs` (156 lines)
+  - `src/__Libraries/StellaOps.Doctor.Plugins.ServiceGraph/Checks/MessageQueueCheck.cs` (152 lines)
+  - `src/__Libraries/StellaOps.Doctor.Plugins.ServiceGraph/Checks/ServiceEndpointsCheck.cs` (140 lines)
+  - `src/__Libraries/StellaOps.Doctor.Plugins.ServiceGraph/Checks/ServiceTimeoutCheck.cs` (102 lines)
+- Service locator matches:
+  - `src/__Libraries/StellaOps.Doctor.Plugins.ServiceGraph/Checks/ServiceEndpointsCheck.cs`:37 return context.Services.GetService<IHttpClientFactory>() != null;
+  - `src/__Libraries/StellaOps.Doctor.Plugins.ServiceGraph/Checks/ServiceEndpointsCheck.cs`:45 var httpClientFactory = context.Services.GetService<IHttpClientFactory>();
+  - `src/__Libraries/StellaOps.Doctor.Plugins.ServiceGraph/Checks/BackendConnectivityCheck.cs`:59 var httpClientFactory = context.Services.GetService<IHttpClientFactory>();
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+- Replace service locator usage with constructor injection.
+
+## Testing Fullness Findings
+- Status: FAIL
+- Expected layers: Unit, Integration, Security, Offline
+- Detected test projects: src/__Libraries/__Tests/StellaOps.Doctor.Plugins.ServiceGraph.Tests/StellaOps.Doctor.Plugins.ServiceGraph.Tests.csproj [Unit]
+- Missing layers: Integration, Security, Offline
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- Add integration tests for cross-component flows.
+- Add security tests for authn/authz or input validation.
+- Add offline/airgap coverage with fixtures only.

docs/implplan-blocked/audits/csproj-standards/__Libraries/StellaOps.Doctor.Plugins.Sources/StellaOps.Doctor.Plugins.Sources.md

@@ -0,0 +1,50 @@
+# Audit - StellaOps.Doctor.Plugins.Sources
+
+## Project
+- Path: `src/__Libraries/StellaOps.Doctor.Plugins.Sources/StellaOps.Doctor.Plugins.Sources.csproj`
+- Module: `__Libraries`
+- Kind: `Plugin`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 4
+- Service locator usage (BuildServiceProvider/GetService): 4
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/__Libraries/StellaOps.Doctor.Plugins.Sources/Checks/SourceConnectivityCheck.cs` (186 lines)
+  - `src/__Libraries/StellaOps.Doctor.Plugins.Sources/Checks/MirrorServerRateLimitCheck.cs` (174 lines)
+  - `src/__Libraries/StellaOps.Doctor.Plugins.Sources/Checks/MirrorServerAuthCheck.cs` (172 lines)
+  - `src/__Libraries/StellaOps.Doctor.Plugins.Sources/Checks/SourceModeConfiguredCheck.cs` (115 lines)
+- Service locator matches:
+  - `src/__Libraries/StellaOps.Doctor.Plugins.Sources/SourcesPlugin.cs`:41 return services.GetService<ISourceRegistry>() is not null;
+  - `src/__Libraries/StellaOps.Doctor.Plugins.Sources/SourcesPlugin.cs`:47 var registry = context.Services.GetService<ISourceRegistry>();
+  - `src/__Libraries/StellaOps.Doctor.Plugins.Sources/Checks/SourceConnectivityCheck.cs`:58 var registry = context.Services.GetService<ISourceRegistry>();
+  - `src/__Libraries/StellaOps.Doctor.Plugins.Sources/Checks/SourceConnectivityCheck.cs`:67 var registry = context.Services.GetService<ISourceRegistry>();
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+- Replace service locator usage with constructor injection.
+
+## Testing Fullness Findings
+- Status: FAIL
+- Expected layers: Unit, Integration, Security, Offline
+- Detected test projects: none
+- Missing layers: Unit, Integration, Security, Offline
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- Add a unit test project named `<Project>.Tests` (or document exception).
+- Add integration tests for cross-component flows.
+- Add security tests for authn/authz or input validation.
+- Add offline/airgap coverage with fixtures only.

docs/implplan-blocked/audits/csproj-standards/__Libraries/StellaOps.Doctor.Plugins.Verification/StellaOps.Doctor.Plugins.Verification.md

@@ -0,0 +1,48 @@
+# Audit - StellaOps.Doctor.Plugins.Verification
+
+## Project
+- Path: `src/__Libraries/StellaOps.Doctor.Plugins.Verification/StellaOps.Doctor.Plugins.Verification.csproj`
+- Module: `__Libraries`
+- Kind: `Plugin`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 6
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/__Libraries/StellaOps.Doctor.Plugins.Verification/Checks/TestArtifactPullCheck.cs` (264 lines)
+  - `src/__Libraries/StellaOps.Doctor.Plugins.Verification/Checks/VexValidationCheck.cs` (247 lines)
+  - `src/__Libraries/StellaOps.Doctor.Plugins.Verification/Checks/SbomValidationCheck.cs` (224 lines)
+  - `src/__Libraries/StellaOps.Doctor.Plugins.Verification/Checks/PolicyEngineCheck.cs` (218 lines)
+  - `src/__Libraries/StellaOps.Doctor.Plugins.Verification/Checks/SignatureVerificationCheck.cs` (215 lines)
+  - `src/__Libraries/StellaOps.Doctor.Plugins.Verification/Checks/VerificationCheckBase.cs` (157 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: FAIL
+- Expected layers: Unit, Integration, Security, Offline
+- Detected test projects: none
+- Missing layers: Unit, Integration, Security, Offline
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- Add a unit test project named `<Project>.Tests` (or document exception).
+- Add integration tests for cross-component flows.
+- Add security tests for authn/authz or input validation.
+- Add offline/airgap coverage with fixtures only.

docs/implplan-blocked/audits/csproj-standards/__Libraries/StellaOps.Doctor/StellaOps.Doctor.md

@@ -0,0 +1,65 @@
+# Audit - StellaOps.Doctor
+
+## Project
+- Path: `src/__Libraries/StellaOps.Doctor/StellaOps.Doctor.csproj`
+- Module: `__Libraries`
+- Kind: `Library`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 24
+- Service locator usage (BuildServiceProvider/GetService): 2
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/__Libraries/StellaOps.Doctor/Packs/DoctorPackLoader.cs` (604 lines)
+  - `src/__Libraries/StellaOps.Doctor/Packs/DoctorPackCheck.cs` (507 lines)
+  - `src/__Libraries/StellaOps.Doctor/Output/DoctorEvidenceLogWriter.cs` (404 lines)
+  - `src/__Libraries/StellaOps.Doctor/Export/DiagnosticBundleGenerator.cs` (340 lines)
+  - `src/__Libraries/StellaOps.Doctor/Detection/RuntimeDetector.cs` (339 lines)
+  - `src/__Libraries/StellaOps.Doctor/Output/MarkdownReportFormatter.cs` (305 lines)
+  - `src/__Libraries/StellaOps.Doctor/Output/JsonReportFormatter.cs` (243 lines)
+  - `src/__Libraries/StellaOps.Doctor/Packs/DoctorPackCommandRunner.cs` (243 lines)
+  - `src/__Libraries/StellaOps.Doctor/Output/TextReportFormatter.cs` (222 lines)
+  - `src/__Libraries/StellaOps.Doctor/Engine/CheckExecutor.cs` (215 lines)
+  - `src/__Libraries/StellaOps.Doctor/Engine/DoctorEngine.cs` (214 lines)
+  - `src/__Libraries/StellaOps.Doctor/Engine/CheckRegistry.cs` (211 lines)
+  - `src/__Libraries/StellaOps.Doctor/Remediation/VerificationExecutor.cs` (192 lines)
+  - `src/__Libraries/StellaOps.Doctor/Plugins/Builders/CheckResultBuilder.cs` (191 lines)
+  - `src/__Libraries/StellaOps.Doctor/Plugins/Builders/RemediationBuilder.cs` (158 lines)
+  - `src/__Libraries/StellaOps.Doctor/Remediation/PlaceholderResolver.cs` (157 lines)
+  - `src/__Libraries/StellaOps.Doctor/Export/DiagnosticBundle.cs` (147 lines)
+  - `src/__Libraries/StellaOps.Doctor/__Tests/StellaOps.Doctor.Tests/Plugins/Builders/RemediationBuilderTests.cs` (144 lines)
+  - `src/__Libraries/StellaOps.Doctor/Plugins/Builders/EvidenceBuilder.cs` (139 lines)
+  - `src/__Libraries/StellaOps.Doctor/Packs/DoctorPackPlugin.cs` (134 lines)
+  - `src/__Libraries/StellaOps.Doctor/Remediation/IVerificationExecutor.cs` (115 lines)
+  - `src/__Libraries/StellaOps.Doctor/Export/ConfigurationSanitizer.cs` (112 lines)
+  - `src/__Libraries/StellaOps.Doctor/Models/DoctorReport.cs` (111 lines)
+  - `src/__Libraries/StellaOps.Doctor/Plugins/DoctorPluginContext.cs` (103 lines)
+- Service locator matches:
+  - `src/__Libraries/StellaOps.Doctor/Engine/DoctorEngine.cs`:157 var environmentName = _services.GetService<IHostEnvironment>()?.EnvironmentName ?? "Production";
+  - `src/__Libraries/StellaOps.Doctor/Packs/DoctorPackLoader.cs`:99 var hostEnvironment = context.Services.GetService(typeof(Microsoft.Extensions.Hosting.IHostEnvironment))
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+- Replace service locator usage with constructor injection.
+
+## Testing Fullness Findings
+- Status: PASS
+- Expected layers: Unit
+- Detected test projects: tests/Doctor/StellaOps.Doctor.Plugin.Storage.Tests/StellaOps.Doctor.Plugin.Storage.Tests.csproj [Unit], src/__Tests/__Libraries/StellaOps.Doctor.Tests/StellaOps.Doctor.Tests.csproj [Unit], src/__Tests/__Libraries/StellaOps.Doctor.Plugins.Integration.Tests/StellaOps.Doctor.Plugins.Integration.Tests.csproj [Integration], src/__Libraries/__Tests/StellaOps.Doctor.Tests/StellaOps.Doctor.Tests.csproj [Unit], src/Doctor/__Tests/StellaOps.Doctor.WebService.Tests/StellaOps.Doctor.WebService.Tests.csproj [Unit], src/__Libraries/__Tests/StellaOps.Doctor.Plugins.ServiceGraph.Tests/StellaOps.Doctor.Plugins.ServiceGraph.Tests.csproj [Unit], src/Doctor/__Tests/StellaOps.Doctor.Plugin.Timestamping.Tests/StellaOps.Doctor.Plugin.Timestamping.Tests.csproj [Unit], src/__Libraries/__Tests/StellaOps.Doctor.Plugins.Security.Tests/StellaOps.Doctor.Plugins.Security.Tests.csproj [Security], src/__Libraries/__Tests/StellaOps.Doctor.Plugins.Observability.Tests/StellaOps.Doctor.Plugins.Observability.Tests.csproj [Unit], src/Doctor/__Tests/StellaOps.Doctor.Plugin.Observability.Tests/StellaOps.Doctor.Plugin.Observability.Tests.csproj [Unit], src/__Libraries/__Tests/StellaOps.Doctor.Plugins.Notify.Tests/StellaOps.Doctor.Plugins.Notify.Tests.csproj [Unit], src/__Libraries/__Tests/StellaOps.Doctor.Plugins.Integration.Tests/StellaOps.Doctor.Plugins.Integration.Tests.csproj [Integration], src/Doctor/__Tests/StellaOps.Doctor.Plugin.Notify.Tests/StellaOps.Doctor.Plugin.Notify.Tests.csproj [Unit], src/__Libraries/__Tests/StellaOps.Doctor.Plugins.Docker.Tests/StellaOps.Doctor.Plugins.Docker.Tests.csproj [Unit], src/Doctor/__Tests/StellaOps.Doctor.Plugin.BinaryAnalysis.Tests/StellaOps.Doctor.Plugin.BinaryAnalysis.Tests.csproj [Unit], src/__Libraries/__Tests/StellaOps.Doctor.Plugins.Database.Tests/StellaOps.Doctor.Plugins.Database.Tests.csproj [Unit], src/__Libraries/__Tests/StellaOps.Doctor.Plugins.Cryptography.Tests/StellaOps.Doctor.Plugins.Cryptography.Tests.csproj [Unit], src/__Libraries/__Tests/StellaOps.Doctor.Plugins.Core.Tests/StellaOps.Doctor.Plugins.Core.Tests.csproj [Unit], src/__Libraries/__Tests/StellaOps.Doctor.Plugins.Authority.Tests/StellaOps.Doctor.Plugins.Authority.Tests.csproj [Unit], src/__Libraries/__Tests/StellaOps.Doctor.Plugins.AI.Tests/StellaOps.Doctor.Plugins.AI.Tests.csproj [Unit]
+- Missing layers: none
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- None.

docs/implplan-blocked/audits/csproj-standards/__Libraries/StellaOps.Eventing/StellaOps.Eventing.md

@@ -0,0 +1,46 @@
+# Audit - StellaOps.Eventing
+
+## Project
+- Path: `src/__Libraries/StellaOps.Eventing/StellaOps.Eventing.csproj`
+- Module: `__Libraries`
+- Kind: `Library`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 7
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/__Libraries/StellaOps.Eventing/Storage/PostgresTimelineEventStore.cs` (312 lines)
+  - `src/__Libraries/StellaOps.Eventing/Outbox/TimelineOutboxProcessor.cs` (187 lines)
+  - `src/__Libraries/StellaOps.Eventing/Models/TimelineEvent.cs` (175 lines)
+  - `src/__Libraries/StellaOps.Eventing/TimelineEventEmitter.cs` (153 lines)
+  - `src/__Libraries/StellaOps.Eventing/ServiceCollectionExtensions.cs` (141 lines)
+  - `src/__Libraries/StellaOps.Eventing/Storage/InMemoryTimelineEventStore.cs` (126 lines)
+  - `src/__Libraries/StellaOps.Eventing/Telemetry/EventingTelemetry.cs` (111 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: PASS
+- Expected layers: Unit
+- Detected test projects: src/__Libraries/__Tests/StellaOps.Eventing.Tests/StellaOps.Eventing.Tests.csproj [Unit]
+- Missing layers: none
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- None.

docs/implplan-blocked/audits/csproj-standards/__Libraries/StellaOps.Evidence.Bundle/StellaOps.Evidence.Bundle.md

@@ -0,0 +1,40 @@
+# Audit - StellaOps.Evidence.Bundle
+
+## Project
+- Path: `src/__Libraries/StellaOps.Evidence.Bundle/StellaOps.Evidence.Bundle.csproj`
+- Module: `__Libraries`
+- Kind: `Library`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 1
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/__Libraries/StellaOps.Evidence.Bundle/BinaryDiffEvidence.cs` (367 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: PASS
+- Expected layers: Unit
+- Detected test projects: src/__Tests/StellaOps.Evidence.Bundle.Tests/StellaOps.Evidence.Bundle.Tests.csproj [Unit]
+- Missing layers: none
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- None.

docs/implplan-blocked/audits/csproj-standards/__Libraries/StellaOps.Evidence.Core/StellaOps.Evidence.Core.md

@@ -0,0 +1,45 @@
+# Audit - StellaOps.Evidence.Core
+
+## Project
+- Path: `src/__Libraries/StellaOps.Evidence.Core/StellaOps.Evidence.Core.csproj`
+- Module: `__Libraries`
+- Kind: `Library`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 6
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/__Libraries/StellaOps.Evidence.Core/Adapters/EvidenceBundleAdapter.cs` (370 lines)
+  - `src/__Libraries/StellaOps.Evidence.Core/Adapters/VexObservationAdapter.cs` (248 lines)
+  - `src/__Libraries/StellaOps.Evidence.Core/InMemoryEvidenceStore.cs` (167 lines)
+  - `src/__Libraries/StellaOps.Evidence.Core/Adapters/EvidenceStatementAdapter.cs` (148 lines)
+  - `src/__Libraries/StellaOps.Evidence.Core/Adapters/ProofSegmentAdapter.cs` (144 lines)
+  - `src/__Libraries/StellaOps.Evidence.Core/EvidenceRecord.cs` (123 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: PASS
+- Expected layers: Unit
+- Detected test projects: src/__Libraries/StellaOps.Evidence.Core.Tests/StellaOps.Evidence.Core.Tests.csproj [Unit]
+- Missing layers: none
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- None.

docs/implplan-blocked/audits/csproj-standards/__Libraries/StellaOps.Evidence.Pack/StellaOps.Evidence.Pack.md

@@ -0,0 +1,49 @@
+# Audit - StellaOps.Evidence.Pack
+
+## Project
+- Path: `src/__Libraries/StellaOps.Evidence.Pack/StellaOps.Evidence.Pack.csproj`
+- Module: `__Libraries`
+- Kind: `Library`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: inherited true
+- Deterministic: inherited true
+- 100-line rule violations: 10
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/__Libraries/StellaOps.Evidence.Pack/EvidencePackService.cs` (551 lines)
+  - `src/__Libraries/StellaOps.Evidence.Pack/EvidenceCardService.cs` (401 lines)
+  - `src/__Libraries/StellaOps.Evidence.Pack/Models/EvidencePack.cs` (348 lines)
+  - `src/__Libraries/StellaOps.Evidence.Pack/Models/EvidenceCard.cs` (303 lines)
+  - `src/__Libraries/StellaOps.Evidence.Pack/EvidenceResolver.cs` (256 lines)
+  - `src/__Libraries/StellaOps.Evidence.Pack/Storage/InMemoryEvidencePackStore.cs` (150 lines)
+  - `src/__Libraries/StellaOps.Evidence.Pack/Models/SignedEvidencePack.cs` (146 lines)
+  - `src/__Libraries/StellaOps.Evidence.Pack/IEvidenceCardService.cs` (137 lines)
+  - `src/__Libraries/StellaOps.Evidence.Pack/IEvidencePackService.cs` (134 lines)
+  - `src/__Libraries/StellaOps.Evidence.Pack/ServiceCollectionExtensions.cs` (130 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: PASS
+- Expected layers: Unit
+- Detected test projects: src/__Libraries/__Tests/StellaOps.Evidence.Pack.Tests/StellaOps.Evidence.Pack.Tests.csproj [Unit]
+- Missing layers: none
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- None.

docs/implplan-blocked/audits/csproj-standards/__Libraries/StellaOps.Evidence.Persistence/StellaOps.Evidence.Persistence.md

@@ -0,0 +1,40 @@
+# Audit - StellaOps.Evidence.Persistence
+
+## Project
+- Path: `src/__Libraries/StellaOps.Evidence.Persistence/StellaOps.Evidence.Persistence.csproj`
+- Module: `__Libraries`
+- Kind: `Library`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 1
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/__Libraries/StellaOps.Evidence.Persistence/Postgres/PostgresEvidenceStore.cs` (330 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: PASS
+- Expected layers: Unit
+- Detected test projects: src/__Libraries/__Tests/StellaOps.Evidence.Persistence.Tests/StellaOps.Evidence.Persistence.Tests.csproj [Unit]
+- Missing layers: none
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- None.

docs/implplan-blocked/audits/csproj-standards/__Libraries/StellaOps.Evidence/StellaOps.Evidence.md

@@ -0,0 +1,45 @@
+# Audit - StellaOps.Evidence
+
+## Project
+- Path: `src/__Libraries/StellaOps.Evidence/StellaOps.Evidence.csproj`
+- Module: `__Libraries`
+- Kind: `Library`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 6
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/__Libraries/StellaOps.Evidence/Budgets/EvidenceBudgetService.cs` (252 lines)
+  - `src/__Libraries/StellaOps.Evidence/Services/EvidenceLinker.cs` (183 lines)
+  - `src/__Libraries/StellaOps.Evidence/Retention/RetentionTierManager.cs` (153 lines)
+  - `src/__Libraries/StellaOps.Evidence/Budgets/EvidenceBudget.cs` (119 lines)
+  - `src/__Libraries/StellaOps.Evidence/Models/ProofRecord.cs` (113 lines)
+  - `src/__Libraries/StellaOps.Evidence/Models/EvidenceIndex.cs` (102 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: PASS
+- Expected layers: Unit
+- Detected test projects: src/__Tests/StellaOps.Evidence.Bundle.Tests/StellaOps.Evidence.Bundle.Tests.csproj [Unit], src/__Libraries/__Tests/StellaOps.Evidence.Tests/StellaOps.Evidence.Tests.csproj [Unit], src/__Libraries/__Tests/StellaOps.Evidence.Persistence.Tests/StellaOps.Evidence.Persistence.Tests.csproj [Unit], src/__Libraries/__Tests/StellaOps.Evidence.Pack.Tests/StellaOps.Evidence.Pack.Tests.csproj [Unit], src/__Libraries/StellaOps.Evidence.Core.Tests/StellaOps.Evidence.Core.Tests.csproj [Unit]
+- Missing layers: none
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- None.

docs/implplan-blocked/audits/csproj-standards/__Libraries/StellaOps.Facet/StellaOps.Facet.md

@@ -0,0 +1,67 @@
+# Audit - StellaOps.Facet
+
+## Project
+- Path: `src/__Libraries/StellaOps.Facet/StellaOps.Facet.csproj`
+- Module: `__Libraries`
+- Kind: `Library`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 14
+- Service locator usage (BuildServiceProvider/GetService): 14
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/__Libraries/StellaOps.Facet/GlobFacetExtractor.cs` (379 lines)
+  - `src/__Libraries/StellaOps.Facet/FacetDriftDetector.cs` (353 lines)
+  - `src/__Libraries/StellaOps.Facet/FacetDriftVexEmitter.cs` (349 lines)
+  - `src/__Libraries/StellaOps.Facet/IFacetDriftVexDraftStore.cs` (329 lines)
+  - `src/__Libraries/StellaOps.Facet/FacetDriftVexWorkflow.cs` (269 lines)
+  - `src/__Libraries/StellaOps.Facet/InMemoryFacetSealStore.cs` (238 lines)
+  - `src/__Libraries/StellaOps.Facet/FacetMerkleTree.cs` (194 lines)
+  - `src/__Libraries/StellaOps.Facet/BuiltInFacets.cs` (166 lines)
+  - `src/__Libraries/StellaOps.Facet/FacetServiceCollectionExtensions.cs` (155 lines)
+  - `src/__Libraries/StellaOps.Facet/Serialization/FacetSealJsonConverter.cs` (143 lines)
+  - `src/__Libraries/StellaOps.Facet/FacetDrift.cs` (132 lines)
+  - `src/__Libraries/StellaOps.Facet/FacetSealer.cs` (121 lines)
+  - `src/__Libraries/StellaOps.Facet/FacetSeal.cs` (114 lines)
+  - `src/__Libraries/StellaOps.Facet/IFacetSealStore.cs` (109 lines)
+- Service locator matches:
+  - `src/__Libraries/StellaOps.Facet/FacetServiceCollectionExtensions.cs`:30 var crypto = sp.GetService<ICryptoHash>() ?? DefaultCryptoHash.Instance;
+  - `src/__Libraries/StellaOps.Facet/FacetServiceCollectionExtensions.cs`:40 var timeProvider = sp.GetService<TimeProvider>() ?? TimeProvider.System;
+  - `src/__Libraries/StellaOps.Facet/FacetServiceCollectionExtensions.cs`:41 var crypto = sp.GetService<ICryptoHash>() ?? DefaultCryptoHash.Instance;
+  - `src/__Libraries/StellaOps.Facet/FacetServiceCollectionExtensions.cs`:48 var timeProvider = sp.GetService<TimeProvider>() ?? TimeProvider.System;
+  - `src/__Libraries/StellaOps.Facet/FacetServiceCollectionExtensions.cs`:55 var timeProvider = sp.GetService<TimeProvider>() ?? TimeProvider.System;
+  - `src/__Libraries/StellaOps.Facet/FacetServiceCollectionExtensions.cs`:56 var crypto = sp.GetService<ICryptoHash>() ?? DefaultCryptoHash.Instance;
+  - `src/__Libraries/StellaOps.Facet/FacetServiceCollectionExtensions.cs`:57 var logger = sp.GetService<Microsoft.Extensions.Logging.ILogger<GlobFacetExtractor>>();
+  - `src/__Libraries/StellaOps.Facet/FacetServiceCollectionExtensions.cs`:104 var crypto = sp.GetService<ICryptoHash>() ?? DefaultCryptoHash.Instance;
+  - `src/__Libraries/StellaOps.Facet/FacetServiceCollectionExtensions.cs`:111 var timeProvider = sp.GetService<TimeProvider>() ?? TimeProvider.System;
+  - `src/__Libraries/StellaOps.Facet/FacetServiceCollectionExtensions.cs`:112 var crypto = sp.GetService<ICryptoHash>() ?? DefaultCryptoHash.Instance;
+  - `src/__Libraries/StellaOps.Facet/FacetServiceCollectionExtensions.cs`:119 var timeProvider = sp.GetService<TimeProvider>() ?? TimeProvider.System;
+  - `src/__Libraries/StellaOps.Facet/FacetServiceCollectionExtensions.cs`:126 var timeProvider = sp.GetService<TimeProvider>() ?? TimeProvider.System;
+  - `src/__Libraries/StellaOps.Facet/FacetServiceCollectionExtensions.cs`:127 var crypto = sp.GetService<ICryptoHash>() ?? DefaultCryptoHash.Instance;
+  - `src/__Libraries/StellaOps.Facet/FacetServiceCollectionExtensions.cs`:128 var logger = sp.GetService<Microsoft.Extensions.Logging.ILogger<GlobFacetExtractor>>();
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+- Replace service locator usage with constructor injection.
+
+## Testing Fullness Findings
+- Status: PASS
+- Expected layers: Unit
+- Detected test projects: src/__Libraries/StellaOps.Facet.Tests/StellaOps.Facet.Tests.csproj [Unit]
+- Missing layers: none
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- None.

docs/implplan-blocked/audits/csproj-standards/__Libraries/StellaOps.FeatureFlags/StellaOps.FeatureFlags.md

@@ -0,0 +1,43 @@
+# Audit - StellaOps.FeatureFlags
+
+## Project
+- Path: `src/__Libraries/StellaOps.FeatureFlags/StellaOps.FeatureFlags.csproj`
+- Module: `__Libraries`
+- Kind: `Library`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 4
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/__Libraries/StellaOps.FeatureFlags/CompositeFeatureFlagService.cs` (302 lines)
+  - `src/__Libraries/StellaOps.FeatureFlags/Providers/SettingsStoreFeatureFlagProvider.cs` (241 lines)
+  - `src/__Libraries/StellaOps.FeatureFlags/Providers/ConfigurationFeatureFlagProvider.cs` (239 lines)
+  - `src/__Libraries/StellaOps.FeatureFlags/FeatureFlagServiceCollectionExtensions.cs` (176 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: PASS
+- Expected layers: Unit
+- Detected test projects: src/__Libraries/StellaOps.FeatureFlags.Tests/StellaOps.FeatureFlags.Tests.csproj [Unit]
+- Missing layers: none
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- None.

docs/implplan-blocked/audits/csproj-standards/__Libraries/StellaOps.HybridLogicalClock.Benchmarks/StellaOps.HybridLogicalClock.Benchmarks.md

@@ -0,0 +1,41 @@
+# Audit - StellaOps.HybridLogicalClock.Benchmarks
+
+## Project
+- Path: `src/__Libraries/StellaOps.HybridLogicalClock.Benchmarks/StellaOps.HybridLogicalClock.Benchmarks.csproj`
+- Module: `__Libraries`
+- Kind: `Library`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 2
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/__Libraries/StellaOps.HybridLogicalClock.Benchmarks/HlcTimestampBenchmarks.cs` (131 lines)
+  - `src/__Libraries/StellaOps.HybridLogicalClock.Benchmarks/HlcBenchmarks.cs` (106 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: FAIL
+- Expected layers: Unit
+- Detected test projects: none
+- Missing layers: Unit
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- Add a unit test project named `<Project>.Tests` (or document exception).

docs/implplan-blocked/audits/csproj-standards/__Libraries/StellaOps.HybridLogicalClock/StellaOps.HybridLogicalClock.md

@@ -0,0 +1,45 @@
+# Audit - StellaOps.HybridLogicalClock
+
+## Project
+- Path: `src/__Libraries/StellaOps.HybridLogicalClock/StellaOps.HybridLogicalClock.csproj`
+- Module: `__Libraries`
+- Kind: `Library`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 6
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/__Libraries/StellaOps.HybridLogicalClock/HybridLogicalClock.cs` (317 lines)
+  - `src/__Libraries/StellaOps.HybridLogicalClock/PostgresHlcStateStore.cs` (228 lines)
+  - `src/__Libraries/StellaOps.HybridLogicalClock/HlcTimestampTypeHandler.cs` (212 lines)
+  - `src/__Libraries/StellaOps.HybridLogicalClock/HlcTimestamp.cs` (206 lines)
+  - `src/__Libraries/StellaOps.HybridLogicalClock/HlcTimestampJsonConverter.cs` (175 lines)
+  - `src/__Libraries/StellaOps.HybridLogicalClock/HlcServiceCollectionExtensions.cs` (127 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: PASS
+- Expected layers: Unit
+- Detected test projects: src/__Libraries/__Tests/StellaOps.HybridLogicalClock.Tests/StellaOps.HybridLogicalClock.Tests.csproj [Unit], src/__Libraries/StellaOps.HybridLogicalClock.Tests/StellaOps.HybridLogicalClock.Tests.csproj [Unit]
+- Missing layers: none
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- None.

docs/implplan-blocked/audits/csproj-standards/__Libraries/StellaOps.Infrastructure.EfCore/StellaOps.Infrastructure.EfCore.md

@@ -0,0 +1,47 @@
+# Audit - StellaOps.Infrastructure.EfCore
+
+## Project
+- Path: `src/__Libraries/StellaOps.Infrastructure.EfCore/StellaOps.Infrastructure.EfCore.csproj`
+- Module: `__Libraries`
+- Kind: `Library`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 2
+- Service locator usage (BuildServiceProvider/GetService): 6
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/__Libraries/StellaOps.Infrastructure.EfCore/Extensions/DbContextServiceExtensions.cs` (155 lines)
+  - `src/__Libraries/StellaOps.Infrastructure.EfCore/Interceptors/TenantConnectionInterceptor.cs` (120 lines)
+- Service locator matches:
+  - `src/__Libraries/StellaOps.Infrastructure.EfCore/Extensions/DbContextServiceExtensions.cs`:43 var tenantAccessor = sp.GetService<ITenantContextAccessor>();
+  - `src/__Libraries/StellaOps.Infrastructure.EfCore/Extensions/DbContextServiceExtensions.cs`:46 var logger = sp.GetService<ILogger<TenantConnectionInterceptor>>();
+  - `src/__Libraries/StellaOps.Infrastructure.EfCore/Extensions/DbContextServiceExtensions.cs`:95 var tenantAccessor = sp.GetService<ITenantContextAccessor>();
+  - `src/__Libraries/StellaOps.Infrastructure.EfCore/Extensions/DbContextServiceExtensions.cs`:98 var logger = sp.GetService<ILogger<TenantConnectionInterceptor>>();
+  - `src/__Libraries/StellaOps.Infrastructure.EfCore/Extensions/DbContextServiceExtensions.cs`:140 var tenantAccessor = sp.GetService<ITenantContextAccessor>();
+  - `src/__Libraries/StellaOps.Infrastructure.EfCore/Extensions/DbContextServiceExtensions.cs`:143 var logger = sp.GetService<ILogger<TenantConnectionInterceptor>>();
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+- Replace service locator usage with constructor injection.
+
+## Testing Fullness Findings
+- Status: FAIL
+- Expected layers: Unit
+- Detected test projects: none
+- Missing layers: Unit
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- Add a unit test project named `<Project>.Tests` (or document exception).

docs/implplan-blocked/audits/csproj-standards/__Libraries/StellaOps.Infrastructure.Postgres/StellaOps.Infrastructure.Postgres.md

@@ -0,0 +1,49 @@
+# Audit - StellaOps.Infrastructure.Postgres
+
+## Project
+- Path: `src/__Libraries/StellaOps.Infrastructure.Postgres/StellaOps.Infrastructure.Postgres.csproj`
+- Module: `__Libraries`
+- Kind: `Library`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 10
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/__Libraries/StellaOps.Infrastructure.Postgres/Migrations/MigrationRunner.cs` (551 lines)
+  - `src/__Libraries/StellaOps.Infrastructure.Postgres/Migrations/StartupMigrationHost.cs` (479 lines)
+  - `src/__Libraries/StellaOps.Infrastructure.Postgres/Migrations/MigrationServiceExtensions.cs` (383 lines)
+  - `src/__Libraries/StellaOps.Infrastructure.Postgres/Repositories/RepositoryBase.cs` (318 lines)
+  - `src/__Libraries/StellaOps.Infrastructure.Postgres/Testing/PostgresFixture.cs` (281 lines)
+  - `src/__Libraries/StellaOps.Infrastructure.Postgres/Migrations/MigrationDependency.cs` (274 lines)
+  - `src/__Libraries/StellaOps.Infrastructure.Postgres/Connections/DataSourceBase.cs` (254 lines)
+  - `src/__Libraries/StellaOps.Infrastructure.Postgres/Migrations/MigrationValidator.cs` (241 lines)
+  - `src/__Libraries/StellaOps.Infrastructure.Postgres/Migrations/MigrationTelemetry.cs` (218 lines)
+  - `src/__Libraries/StellaOps.Infrastructure.Postgres/Migrations/IMigrationRunner.cs` (181 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: PASS
+- Expected layers: Unit
+- Detected test projects: src/__Tests/__Libraries/StellaOps.Infrastructure.Postgres.Testing/StellaOps.Infrastructure.Postgres.Testing.csproj [Unit], src/__Libraries/__Tests/StellaOps.Infrastructure.Postgres.Tests/StellaOps.Infrastructure.Postgres.Tests.csproj [Unit]
+- Missing layers: none
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- None.

docs/implplan-blocked/audits/csproj-standards/__Libraries/StellaOps.Ingestion.Telemetry/StellaOps.Ingestion.Telemetry.md

@@ -0,0 +1,40 @@
+# Audit - StellaOps.Ingestion.Telemetry
+
+## Project
+- Path: `src/__Libraries/StellaOps.Ingestion.Telemetry/StellaOps.Ingestion.Telemetry.csproj`
+- Module: `__Libraries`
+- Kind: `Library`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 1
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/__Libraries/StellaOps.Ingestion.Telemetry/IngestionTelemetry.cs` (199 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: FAIL
+- Expected layers: Unit
+- Detected test projects: none
+- Missing layers: Unit
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- Add a unit test project named `<Project>.Tests` (or document exception).

docs/implplan-blocked/audits/csproj-standards/__Libraries/StellaOps.Interop/StellaOps.Interop.md

@@ -0,0 +1,40 @@
+# Audit - StellaOps.Interop
+
+## Project
+- Path: `src/__Libraries/StellaOps.Interop/StellaOps.Interop.csproj`
+- Module: `__Libraries`
+- Kind: `Library`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 1
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/__Libraries/StellaOps.Interop/ToolManager.cs` (151 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: PASS
+- Expected layers: Unit
+- Detected test projects: src/__Tests/interop/StellaOps.Interop.Tests/StellaOps.Interop.Tests.csproj [Unit]
+- Missing layers: none
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- None.

docs/implplan-blocked/audits/csproj-standards/__Libraries/StellaOps.IssuerDirectory.Client/StellaOps.IssuerDirectory.Client.md

@@ -0,0 +1,40 @@
+# Audit - StellaOps.IssuerDirectory.Client
+
+## Project
+- Path: `src/__Libraries/StellaOps.IssuerDirectory.Client/StellaOps.IssuerDirectory.Client.csproj`
+- Module: `__Libraries`
+- Kind: `Library`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 1
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/__Libraries/StellaOps.IssuerDirectory.Client/IssuerDirectoryClient.cs` (211 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: FAIL
+- Expected layers: Unit
+- Detected test projects: none
+- Missing layers: Unit
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- Add a unit test project named `<Project>.Tests` (or document exception).

docs/implplan-blocked/audits/csproj-standards/__Libraries/StellaOps.Metrics/StellaOps.Metrics.md

@@ -0,0 +1,41 @@
+# Audit - StellaOps.Metrics
+
+## Project
+- Path: `src/__Libraries/StellaOps.Metrics/StellaOps.Metrics.csproj`
+- Module: `__Libraries`
+- Kind: `Library`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 2
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/__Libraries/StellaOps.Metrics/Kpi/KpiCollector.cs` (255 lines)
+  - `src/__Libraries/StellaOps.Metrics/Kpi/KpiModels.cs` (216 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: PASS
+- Expected layers: Unit
+- Detected test projects: src/__Libraries/__Tests/StellaOps.Metrics.Tests/StellaOps.Metrics.Tests.csproj [Unit]
+- Missing layers: none
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- None.

docs/implplan-blocked/audits/csproj-standards/__Libraries/StellaOps.Orchestrator.Schemas/StellaOps.Orchestrator.Schemas.md

@@ -0,0 +1,40 @@
+# Audit - StellaOps.Orchestrator.Schemas
+
+## Project
+- Path: `src/__Libraries/StellaOps.Orchestrator.Schemas/StellaOps.Orchestrator.Schemas.csproj`
+- Module: `__Libraries`
+- Kind: `Library`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 1
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/__Libraries/StellaOps.Orchestrator.Schemas/ScannerReportReadyPayload.cs` (124 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: PASS
+- Expected layers: Unit
+- Detected test projects: src/__Libraries/__Tests/StellaOps.Orchestrator.Schemas.Tests/StellaOps.Orchestrator.Schemas.Tests.csproj [Unit]
+- Missing layers: none
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- None.

docs/implplan-blocked/audits/csproj-standards/__Libraries/StellaOps.Plugin/StellaOps.Plugin.md

@@ -0,0 +1,47 @@
+# Audit - StellaOps.Plugin
+
+## Project
+- Path: `src/__Libraries/StellaOps.Plugin/StellaOps.Plugin.csproj`
+- Module: `__Libraries`
+- Kind: `Library`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 8
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/__Libraries/StellaOps.Plugin/Manifest/PluginManifestLoader.cs` (524 lines)
+  - `src/__Libraries/StellaOps.Plugin/Hosting/PluginHost.cs` (340 lines)
+  - `src/__Libraries/StellaOps.Plugin/Manifest/PluginRegistry.cs` (287 lines)
+  - `src/__Libraries/StellaOps.Plugin/Security/CosignPluginVerifier.cs` (260 lines)
+  - `src/__Libraries/StellaOps.Plugin/Manifest/PluginManifest.cs` (233 lines)
+  - `src/__Libraries/StellaOps.Plugin/Versioning/PluginCompatibilityChecker.cs` (209 lines)
+  - `src/__Libraries/StellaOps.Plugin/PluginContracts.cs` (172 lines)
+  - `src/__Libraries/StellaOps.Plugin/DependencyInjection/PluginServiceRegistration.cs` (169 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: PASS
+- Expected layers: Unit
+- Detected test projects: docs/dev/sdks/plugin-templates/stellaops-plugin-scheduler/__Tests/StellaOps.Plugin.MyJob.Tests/StellaOps.Plugin.MyJob.Tests.csproj [Unit], docs/dev/sdks/plugin-templates/stellaops-plugin-connector/__Tests/StellaOps.Plugin.MyConnector.Tests/StellaOps.Plugin.MyConnector.Tests.csproj [Unit], src/__Libraries/__Tests/StellaOps.Plugin.Tests/StellaOps.Plugin.Tests.csproj [Unit], src/Plugin/__Tests/StellaOps.Plugin.Sdk.Tests/StellaOps.Plugin.Sdk.Tests.csproj [Unit], src/Plugin/__Tests/StellaOps.Plugin.Sandbox.Tests/StellaOps.Plugin.Sandbox.Tests.csproj [Unit], src/Plugin/__Tests/StellaOps.Plugin.Registry.Tests/StellaOps.Plugin.Registry.Tests.csproj [Unit], src/Plugin/__Tests/StellaOps.Plugin.Host.Tests/StellaOps.Plugin.Host.Tests.csproj [Unit], src/Plugin/__Tests/StellaOps.Plugin.Abstractions.Tests/StellaOps.Plugin.Abstractions.Tests.csproj [Unit], src/Plugin/Samples/StellaOps.Plugin.Samples.HelloWorld.Tests/StellaOps.Plugin.Samples.HelloWorld.Tests.csproj [Unit]
+- Missing layers: none
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- None.

docs/implplan-blocked/audits/csproj-standards/__Libraries/StellaOps.Policy.Tools/StellaOps.Policy.Tools.md

@@ -0,0 +1,41 @@
+# Audit - StellaOps.Policy.Tools
+
+## Project
+- Path: `src/__Libraries/StellaOps.Policy.Tools/StellaOps.Policy.Tools.csproj`
+- Module: `__Libraries`
+- Kind: `Library`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 2
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/__Libraries/StellaOps.Policy.Tools/PolicySimulationSmokeRunner.cs` (525 lines)
+  - `src/__Libraries/StellaOps.Policy.Tools/PolicySchemaExporterRunner.cs` (190 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: PASS
+- Expected layers: Unit
+- Detected test projects: src/__Libraries/__Tests/StellaOps.Policy.Tools.Tests/StellaOps.Policy.Tools.Tests.csproj [Unit]
+- Missing layers: none
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- None.

docs/implplan-blocked/audits/csproj-standards/__Libraries/StellaOps.PolicyAuthoritySignals.Contracts/StellaOps.PolicyAuthoritySignals.Contracts.md

@@ -0,0 +1,40 @@
+# Audit - StellaOps.PolicyAuthoritySignals.Contracts
+
+## Project
+- Path: `src/__Libraries/StellaOps.PolicyAuthoritySignals.Contracts/StellaOps.PolicyAuthoritySignals.Contracts.csproj`
+- Module: `__Libraries`
+- Kind: `Library`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: PASS
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 0
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - none
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- None.
+
+## Testing Fullness Findings
+- Status: FAIL
+- Expected layers: Unit
+- Detected test projects: none
+- Missing layers: Unit
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- Add a unit test project named `<Project>.Tests` (or document exception).

docs/implplan-blocked/audits/csproj-standards/__Libraries/StellaOps.Provcache.Api/StellaOps.Provcache.Api.md

@@ -0,0 +1,41 @@
+# Audit - StellaOps.Provcache.Api
+
+## Project
+- Path: `src/__Libraries/StellaOps.Provcache.Api/StellaOps.Provcache.Api.csproj`
+- Module: `__Libraries`
+- Kind: `Library`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 2
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/__Libraries/StellaOps.Provcache.Api/ProvcacheEndpointExtensions.cs` (718 lines)
+  - `src/__Libraries/StellaOps.Provcache.Api/ApiModels.cs` (559 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: FAIL
+- Expected layers: Unit
+- Detected test projects: none
+- Missing layers: Unit
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- Add a unit test project named `<Project>.Tests` (or document exception).

docs/implplan-blocked/audits/csproj-standards/__Libraries/StellaOps.Provcache.Postgres/StellaOps.Provcache.Postgres.md

@@ -0,0 +1,41 @@
+# Audit - StellaOps.Provcache.Postgres
+
+## Project
+- Path: `src/__Libraries/StellaOps.Provcache.Postgres/StellaOps.Provcache.Postgres.csproj`
+- Module: `__Libraries`
+- Kind: `Library`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 2
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/__Libraries/StellaOps.Provcache.Postgres/PostgresProvcacheRepository.cs` (345 lines)
+  - `src/__Libraries/StellaOps.Provcache.Postgres/PostgresEvidenceChunkRepository.cs` (264 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: FAIL
+- Expected layers: Unit
+- Detected test projects: none
+- Missing layers: Unit
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- Add a unit test project named `<Project>.Tests` (or document exception).

docs/implplan-blocked/audits/csproj-standards/__Libraries/StellaOps.Provcache.Valkey/StellaOps.Provcache.Valkey.md

@@ -0,0 +1,40 @@
+# Audit - StellaOps.Provcache.Valkey
+
+## Project
+- Path: `src/__Libraries/StellaOps.Provcache.Valkey/StellaOps.Provcache.Valkey.csproj`
+- Module: `__Libraries`
+- Kind: `Library`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 1
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/__Libraries/StellaOps.Provcache.Valkey/ValkeyProvcacheStore.cs` (370 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: FAIL
+- Expected layers: Unit
+- Detected test projects: none
+- Missing layers: Unit
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- Add a unit test project named `<Project>.Tests` (or document exception).

docs/implplan-blocked/audits/csproj-standards/__Libraries/StellaOps.Provcache/StellaOps.Provcache.md

@@ -0,0 +1,70 @@
+# Audit - StellaOps.Provcache
+
+## Project
+- Path: `src/__Libraries/StellaOps.Provcache/StellaOps.Provcache.csproj`
+- Module: `__Libraries`
+- Kind: `Library`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 31
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/__Libraries/StellaOps.Provcache/Export/MinimalProofExporter.cs` (504 lines)
+  - `src/__Libraries/StellaOps.Provcache/ProvcacheService.cs` (395 lines)
+  - `src/__Libraries/StellaOps.Provcache/ProvcacheTelemetry.cs` (389 lines)
+  - `src/__Libraries/StellaOps.Provcache/VeriKeyBuilder.cs` (389 lines)
+  - `src/__Libraries/StellaOps.Provcache/Oci/ProvcacheOciAttestationBuilder.cs` (376 lines)
+  - `src/__Libraries/StellaOps.Provcache/IProvcacheService.cs` (363 lines)
+  - `src/__Libraries/StellaOps.Provcache/DecisionDigestBuilder.cs` (343 lines)
+  - `src/__Libraries/StellaOps.Provcache/LazyFetch/HttpChunkFetcher.cs` (336 lines)
+  - `src/__Libraries/StellaOps.Provcache/Chunking/EvidenceChunker.cs` (324 lines)
+  - `src/__Libraries/StellaOps.Provcache/Oci/ProvcachePredicateTypes.cs` (312 lines)
+  - `src/__Libraries/StellaOps.Provcache/LazyFetch/LazyFetchOrchestrator.cs` (301 lines)
+  - `src/__Libraries/StellaOps.Provcache/Revocation/RevocationReplayService.cs` (295 lines)
+  - `src/__Libraries/StellaOps.Provcache/WriteBehindQueue.cs` (271 lines)
+  - `src/__Libraries/StellaOps.Provcache/Export/MinimalProofBundle.cs` (263 lines)
+  - `src/__Libraries/StellaOps.Provcache/LazyFetch/FileChunkFetcher.cs` (257 lines)
+  - `src/__Libraries/StellaOps.Provcache/Models/InputManifest.cs` (245 lines)
+  - `src/__Libraries/StellaOps.Provcache/Entities/ProvcacheItemEntity.cs` (217 lines)
+  - `src/__Libraries/StellaOps.Provcache/IEvidenceChunkRepository.cs` (203 lines)
+  - `src/__Libraries/StellaOps.Provcache/Invalidation/FeedEpochInvalidator.cs` (184 lines)
+  - `src/__Libraries/StellaOps.Provcache/Invalidation/SignerSetInvalidator.cs` (177 lines)
+  - `src/__Libraries/StellaOps.Provcache/Models/DecisionDigest.cs` (172 lines)
+  - `src/__Libraries/StellaOps.Provcache/Revocation/IRevocationLedger.cs` (160 lines)
+  - `src/__Libraries/StellaOps.Provcache/IProvcacheStore.cs` (150 lines)
+  - `src/__Libraries/StellaOps.Provcache/ProvcacheOptions.cs` (150 lines)
+  - `src/__Libraries/StellaOps.Provcache/Revocation/InMemoryRevocationLedger.cs` (137 lines)
+  - `src/__Libraries/StellaOps.Provcache/IProvcacheRepository.cs` (137 lines)
+  - `src/__Libraries/StellaOps.Provcache/Events/FeedEpochAdvancedEvent.cs` (131 lines)
+  - `src/__Libraries/StellaOps.Provcache/LazyFetch/ILazyEvidenceFetcher.cs` (131 lines)
+  - `src/__Libraries/StellaOps.Provcache/Events/SignerRevokedEvent.cs` (116 lines)
+  - `src/__Libraries/StellaOps.Provcache/ProvcacheServiceCollectionExtensions.cs` (114 lines)
+  - `src/__Libraries/StellaOps.Provcache/Entities/ProvRevocationEntity.cs` (110 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: PASS
+- Expected layers: Unit
+- Detected test projects: src/__Libraries/__Tests/StellaOps.Provcache.Tests/StellaOps.Provcache.Tests.csproj [Unit]
+- Missing layers: none
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- None.

docs/implplan-blocked/audits/csproj-standards/__Libraries/StellaOps.Provenance/StellaOps.Provenance.md

@@ -0,0 +1,42 @@
+# Audit - StellaOps.Provenance
+
+## Project
+- Path: `src/__Libraries/StellaOps.Provenance/StellaOps.Provenance.csproj`
+- Module: `__Libraries`
+- Kind: `Library`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 3
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/__Libraries/StellaOps.Provenance/ProvenanceJsonParser.cs` (203 lines)
+  - `src/__Libraries/StellaOps.Provenance/DocumentStubs.cs` (175 lines)
+  - `src/__Libraries/StellaOps.Provenance/ProvenanceExtensions.cs` (140 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: PASS
+- Expected layers: Unit
+- Detected test projects: src/__Libraries/__Tests/StellaOps.Provenance.Tests/StellaOps.Provenance.Tests.csproj [Unit], src/Provenance/__Tests/StellaOps.Provenance.Attestation.Tests/StellaOps.Provenance.Attestation.Tests.csproj [Unit]
+- Missing layers: none
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- None.

docs/implplan-blocked/audits/csproj-standards/__Libraries/StellaOps.ReachGraph.Cache/StellaOps.ReachGraph.Cache.md

@@ -0,0 +1,40 @@
+# Audit - StellaOps.ReachGraph.Cache
+
+## Project
+- Path: `src/__Libraries/StellaOps.ReachGraph.Cache/StellaOps.ReachGraph.Cache.csproj`
+- Module: `__Libraries`
+- Kind: `Library`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 1
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/__Libraries/StellaOps.ReachGraph.Cache/ReachGraphValkeyCache.cs` (261 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: FAIL
+- Expected layers: Unit
+- Detected test projects: none
+- Missing layers: Unit
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- Add a unit test project named `<Project>.Tests` (or document exception).

docs/implplan-blocked/audits/csproj-standards/__Libraries/StellaOps.ReachGraph.Persistence/StellaOps.ReachGraph.Persistence.md

@@ -0,0 +1,41 @@
+# Audit - StellaOps.ReachGraph.Persistence
+
+## Project
+- Path: `src/__Libraries/StellaOps.ReachGraph.Persistence/StellaOps.ReachGraph.Persistence.csproj`
+- Module: `__Libraries`
+- Kind: `Library`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 2
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/__Libraries/StellaOps.ReachGraph.Persistence/PostgresReachGraphRepository.cs` (348 lines)
+  - `src/__Libraries/StellaOps.ReachGraph.Persistence/IReachGraphRepository.cs` (135 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: FAIL
+- Expected layers: Unit
+- Detected test projects: none
+- Missing layers: Unit
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- Add a unit test project named `<Project>.Tests` (or document exception).

docs/implplan-blocked/audits/csproj-standards/__Libraries/StellaOps.ReachGraph/StellaOps.ReachGraph.md

@@ -0,0 +1,45 @@
+# Audit - StellaOps.ReachGraph
+
+## Project
+- Path: `src/__Libraries/StellaOps.ReachGraph/StellaOps.ReachGraph.csproj`
+- Module: `__Libraries`
+- Kind: `Library`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 6
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/__Libraries/StellaOps.ReachGraph/Serialization/CanonicalReachGraphSerializer.cs` (462 lines)
+  - `src/__Libraries/StellaOps.ReachGraph/Signing/ReachGraphSignerService.cs` (223 lines)
+  - `src/__Libraries/StellaOps.ReachGraph/Deduplication/DeduplicatedEdge.cs` (138 lines)
+  - `src/__Libraries/StellaOps.ReachGraph/Deduplication/EdgeDeduplicator.cs` (137 lines)
+  - `src/__Libraries/StellaOps.ReachGraph/Deduplication/EdgeSemanticKey.cs` (134 lines)
+  - `src/__Libraries/StellaOps.ReachGraph/Hashing/ReachGraphDigestComputer.cs` (113 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: PASS
+- Expected layers: Unit
+- Detected test projects: src/__Libraries/__Tests/StellaOps.ReachGraph.Tests/StellaOps.ReachGraph.Tests.csproj [Unit], src/ReachGraph/__Tests/StellaOps.ReachGraph.WebService.Tests/StellaOps.ReachGraph.WebService.Tests.csproj [Unit]
+- Missing layers: none
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- None.

docs/implplan-blocked/audits/csproj-standards/__Libraries/StellaOps.Reachability.Core/StellaOps.Reachability.Core.md

@@ -0,0 +1,63 @@
+# Audit - StellaOps.Reachability.Core
+
+## Project
+- Path: `src/__Libraries/StellaOps.Reachability.Core/StellaOps.Reachability.Core.csproj`
+- Module: `__Libraries`
+- Kind: `Library`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 24
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/__Libraries/StellaOps.Reachability.Core/Symbols/NativeSymbolNormalizer.cs` (550 lines)
+  - `src/__Libraries/StellaOps.Reachability.Core/CveMapping/OsvEnricher.cs` (527 lines)
+  - `src/__Libraries/StellaOps.Reachability.Core/CveMapping/CveSymbolMappingService.cs` (501 lines)
+  - `src/__Libraries/StellaOps.Reachability.Core/Symbols/ScriptSymbolNormalizer.cs` (453 lines)
+  - `src/__Libraries/StellaOps.Reachability.Core/CveMapping/FunctionBoundaryDetector.cs` (350 lines)
+  - `src/__Libraries/StellaOps.Reachability.Core/CveMapping/GitDiffExtractor.cs` (310 lines)
+  - `src/__Libraries/StellaOps.Reachability.Core/CveMapping/UnifiedDiffParser.cs` (300 lines)
+  - `src/__Libraries/StellaOps.Reachability.Core/CveMapping/IOsvEnricher.cs` (272 lines)
+  - `src/__Libraries/StellaOps.Reachability.Core/ReachabilityIndex.cs` (266 lines)
+  - `src/__Libraries/StellaOps.Reachability.Core/HybridReachabilityResult.cs` (236 lines)
+  - `src/__Libraries/StellaOps.Reachability.Core/Symbols/JavaSymbolNormalizer.cs` (229 lines)
+  - `src/__Libraries/StellaOps.Reachability.Core/Symbols/SymbolMatcher.cs` (228 lines)
+  - `src/__Libraries/StellaOps.Reachability.Core/NodeHashRecipe.cs` (211 lines)
+  - `src/__Libraries/StellaOps.Reachability.Core/Symbols/DotNetSymbolNormalizer.cs` (203 lines)
+  - `src/__Libraries/StellaOps.Reachability.Core/EvidenceUriBuilder.cs` (187 lines)
+  - `src/__Libraries/StellaOps.Reachability.Core/ReachabilityLattice.cs` (181 lines)
+  - `src/__Libraries/StellaOps.Reachability.Core/PathHashRecipe.cs` (179 lines)
+  - `src/__Libraries/StellaOps.Reachability.Core/CveMapping/CveSymbolMapping.cs` (162 lines)
+  - `src/__Libraries/StellaOps.Reachability.Core/CveMapping/ICveSymbolMappingService.cs` (160 lines)
+  - `src/__Libraries/StellaOps.Reachability.Core/ConfidenceCalculator.cs` (152 lines)
+  - `src/__Libraries/StellaOps.Reachability.Core/Symbols/CanonicalSymbol.cs` (140 lines)
+  - `src/__Libraries/StellaOps.Reachability.Core/RuntimeReachabilityResult.cs` (130 lines)
+  - `src/__Libraries/StellaOps.Reachability.Core/SymbolRef.cs` (127 lines)
+  - `src/__Libraries/StellaOps.Reachability.Core/IReachabilityIndex.cs` (119 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: PASS
+- Expected layers: Unit
+- Detected test projects: src/__Libraries/__Tests/StellaOps.Reachability.Core.Tests/StellaOps.Reachability.Core.Tests.csproj [Unit], src/__Libraries/StellaOps.Reachability.Core.Tests/StellaOps.Reachability.Core.Tests.csproj [Unit]
+- Missing layers: none
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- None.

docs/implplan-blocked/audits/csproj-standards/__Libraries/StellaOps.Replay.Core/StellaOps.Replay.Core.md

@@ -0,0 +1,55 @@
+# Audit - StellaOps.Replay.Core
+
+## Project
+- Path: `src/__Libraries/StellaOps.Replay.Core/StellaOps.Replay.Core.csproj`
+- Module: `__Libraries`
+- Kind: `Library`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 16
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/__Libraries/StellaOps.Replay.Core/FeedSnapshot/FeedSnapshotCoordinatorService.cs` (684 lines)
+  - `src/__Libraries/StellaOps.Replay.Core/FeedSnapshot/IFeedSnapshotCoordinator.cs` (431 lines)
+  - `src/__Libraries/StellaOps.Replay.Core/Validation/DeterminismManifestValidator.cs` (429 lines)
+  - `src/__Libraries/StellaOps.Replay.Core/Export/ReplayExportModels.cs` (398 lines)
+  - `src/__Libraries/StellaOps.Replay.Core/ReplayManifestValidator.cs` (397 lines)
+  - `src/__Libraries/StellaOps.Replay.Core/Export/ReplayManifestExporter.cs` (365 lines)
+  - `src/__Libraries/StellaOps.Replay.Core/Export/IReplayManifestExporter.cs` (245 lines)
+  - `src/__Libraries/StellaOps.Replay.Core/ReplayManifest.cs` (213 lines)
+  - `src/__Libraries/StellaOps.Replay.Core/Bundle/StellaReplayBundleWriter.cs` (208 lines)
+  - `src/__Libraries/StellaOps.Replay.Core/Models/ReplayProof.cs` (204 lines)
+  - `src/__Libraries/StellaOps.Replay.Core/Models/KnowledgeSnapshot.cs` (152 lines)
+  - `src/__Libraries/StellaOps.Replay.Core/ReachabilityReplayWriter.cs` (130 lines)
+  - `src/__Libraries/StellaOps.Replay.Core/CasValidator.cs` (117 lines)
+  - `src/__Libraries/StellaOps.Replay.Core/PolicySimulationInputLock.cs` (113 lines)
+  - `src/__Libraries/StellaOps.Replay.Core/Manifest/ReplayManifestWriter.cs` (108 lines)
+  - `src/__Libraries/StellaOps.Replay.Core/FeedSnapshot/IFeedSourceProvider.cs` (105 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: PASS
+- Expected layers: Unit
+- Detected test projects: src/__Tests/reachability/StellaOps.Replay.Core.Tests/StellaOps.Replay.Core.Tests.csproj [Unit], src/__Libraries/__Tests/StellaOps.Replay.Core.Tests/StellaOps.Replay.Core.Tests.csproj [Unit], src/__Libraries/StellaOps.Replay.Core.Tests/StellaOps.Replay.Core.Tests.csproj [Unit], src/Replay/__Tests/StellaOps.Replay.Core.Tests/StellaOps.Replay.Core.Tests.csproj [Unit]
+- Missing layers: none
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- None.

docs/implplan-blocked/audits/csproj-standards/__Libraries/StellaOps.Replay/StellaOps.Replay.md

@@ -0,0 +1,40 @@
+# Audit - StellaOps.Replay
+
+## Project
+- Path: `src/__Libraries/StellaOps.Replay/StellaOps.Replay.csproj`
+- Module: `__Libraries`
+- Kind: `Library`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 1
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/__Libraries/StellaOps.Replay/Engine/ReplayEngine.cs` (188 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: PASS
+- Expected layers: Unit
+- Detected test projects: src/__Tests/reachability/StellaOps.Replay.Core.Tests/StellaOps.Replay.Core.Tests.csproj [Unit], src/__Libraries/__Tests/StellaOps.Replay.Tests/StellaOps.Replay.Tests.csproj [Unit], src/__Libraries/__Tests/StellaOps.Replay.Core.Tests/StellaOps.Replay.Core.Tests.csproj [Unit], src/__Libraries/StellaOps.Replay.Core.Tests/StellaOps.Replay.Core.Tests.csproj [Unit], src/Replay/__Tests/StellaOps.Replay.Core.Tests/StellaOps.Replay.Core.Tests.csproj [Unit], src/Replay/__Tests/StellaOps.Replay.Anonymization.Tests/StellaOps.Replay.Anonymization.Tests.csproj [Unit]
+- Missing layers: none
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- None.

docs/implplan-blocked/audits/csproj-standards/__Libraries/StellaOps.Resolver/StellaOps.Resolver.md

@@ -0,0 +1,49 @@
+# Audit - StellaOps.Resolver
+
+## Project
+- Path: `src/__Libraries/StellaOps.Resolver/StellaOps.Resolver.csproj`
+- Module: `__Libraries`
+- Kind: `Library`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 10
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/__Libraries/StellaOps.Resolver/GraphValidation.cs` (330 lines)
+  - `src/__Libraries/StellaOps.Resolver/Purity/RuntimePurity.cs` (221 lines)
+  - `src/__Libraries/StellaOps.Resolver/VerdictDelta.cs` (171 lines)
+  - `src/__Libraries/StellaOps.Resolver/DeterministicResolver.cs` (153 lines)
+  - `src/__Libraries/StellaOps.Resolver/ResolutionResult.cs` (147 lines)
+  - `src/__Libraries/StellaOps.Resolver/DefaultTrustLatticeEvaluator.cs` (128 lines)
+  - `src/__Libraries/StellaOps.Resolver/EvidenceGraph.cs` (125 lines)
+  - `src/__Libraries/StellaOps.Resolver/ResolutionVerifier.cs` (125 lines)
+  - `src/__Libraries/StellaOps.Resolver/Verdict.cs` (114 lines)
+  - `src/__Libraries/StellaOps.Resolver/EdgeDelta.cs` (111 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: PASS
+- Expected layers: Unit
+- Detected test projects: src/__Libraries/StellaOps.Resolver.Tests/StellaOps.Resolver.Tests.csproj [Unit]
+- Missing layers: none
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- None.

docs/implplan-blocked/audits/csproj-standards/__Libraries/StellaOps.Signals.Contracts/StellaOps.Signals.Contracts.md

@@ -0,0 +1,44 @@
+# Audit - StellaOps.Signals.Contracts
+
+## Project
+- Path: `src/__Libraries/StellaOps.Signals.Contracts/StellaOps.Signals.Contracts.csproj`
+- Module: `__Libraries`
+- Kind: `Library`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 5
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/__Libraries/StellaOps.Signals.Contracts/Models/Evidence/ReachabilityExplainRequest.cs` (319 lines)
+  - `src/__Libraries/StellaOps.Signals.Contracts/Models/Evidence/CallPath.cs` (305 lines)
+  - `src/__Libraries/StellaOps.Signals.Contracts/Models/Evidence/ReachabilityEvidenceChain.cs` (300 lines)
+  - `src/__Libraries/StellaOps.Signals.Contracts/Models/Evidence/CodeAnchor.cs` (167 lines)
+  - `src/__Libraries/StellaOps.Signals.Contracts/Models/Evidence/RuntimeHit.cs` (165 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: PASS
+- Expected layers: Unit
+- Detected test projects: src/__Libraries/__Tests/StellaOps.Signals.Contracts.Tests/StellaOps.Signals.Contracts.Tests.csproj [Unit]
+- Missing layers: none
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- None.

docs/implplan-blocked/audits/csproj-standards/__Libraries/StellaOps.Spdx3/StellaOps.Spdx3.md

@@ -0,0 +1,57 @@
+# Audit - StellaOps.Spdx3
+
+## Project
+- Path: `src/__Libraries/StellaOps.Spdx3/StellaOps.Spdx3.csproj`
+- Module: `__Libraries`
+- Kind: `Library`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 18
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/__Libraries/StellaOps.Spdx3/Spdx3Parser.cs` (897 lines)
+  - `src/__Libraries/StellaOps.Spdx3/Validation/Spdx3Validator.cs` (344 lines)
+  - `src/__Libraries/StellaOps.Spdx3/Model/Software/Spdx3Package.cs` (319 lines)
+  - `src/__Libraries/StellaOps.Spdx3/Model/Spdx3ExternalRef.cs` (291 lines)
+  - `src/__Libraries/StellaOps.Spdx3/Model/Spdx3Relationship.cs` (288 lines)
+  - `src/__Libraries/StellaOps.Spdx3/JsonLd/Spdx3ContextResolver.cs` (247 lines)
+  - `src/__Libraries/StellaOps.Spdx3/Model/Security/Spdx3Vulnerability.cs` (239 lines)
+  - `src/__Libraries/StellaOps.Spdx3/Model/Spdx3IntegrityMethod.cs` (225 lines)
+  - `src/__Libraries/StellaOps.Spdx3/Model/Spdx3Document.cs` (223 lines)
+  - `src/__Libraries/StellaOps.Spdx3/Spdx3VersionDetector.cs` (203 lines)
+  - `src/__Libraries/StellaOps.Spdx3/Model/Spdx3ProfileIdentifier.cs` (179 lines)
+  - `src/__Libraries/StellaOps.Spdx3/Model/Build/BuildProfileValidator.cs` (165 lines)
+  - `src/__Libraries/StellaOps.Spdx3/Model/Build/Spdx3Build.cs` (155 lines)
+  - `src/__Libraries/StellaOps.Spdx3/Validation/ISpdx3Validator.cs` (155 lines)
+  - `src/__Libraries/StellaOps.Spdx3/Model/Spdx3ExternalIdentifier.cs` (148 lines)
+  - `src/__Libraries/StellaOps.Spdx3/ISpdx3Parser.cs` (142 lines)
+  - `src/__Libraries/StellaOps.Spdx3/Model/Spdx3CreationInfo.cs` (139 lines)
+  - `src/__Libraries/StellaOps.Spdx3/Model/Spdx3Element.cs` (113 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: PASS
+- Expected layers: Unit
+- Detected test projects: src/__Libraries/__Tests/StellaOps.Spdx3.Tests/StellaOps.Spdx3.Tests.csproj [Unit]
+- Missing layers: none
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- None.

docs/implplan-blocked/audits/csproj-standards/__Libraries/StellaOps.TestKit/StellaOps.TestKit.md

@@ -0,0 +1,84 @@
+# Audit - StellaOps.TestKit
+
+## Project
+- Path: `src/__Libraries/StellaOps.TestKit/StellaOps.TestKit.csproj`
+- Module: `__Libraries`
+- Kind: `Library`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 42
+- Service locator usage (BuildServiceProvider/GetService): 3
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/__Libraries/StellaOps.TestKit/Interop/VersionCompatibilityFixture.cs` (409 lines)
+  - `src/__Libraries/StellaOps.TestKit/Environment/SkewTestRunner.cs` (398 lines)
+  - `src/__Libraries/StellaOps.TestKit/Analysis/IntentCoverageReport.cs` (396 lines)
+  - `src/__Libraries/StellaOps.TestKit/Longevity/StabilityMetrics.cs` (383 lines)
+  - `src/__Libraries/StellaOps.TestKit/Observability/MetricsContractAssert.cs` (360 lines)
+  - `src/__Libraries/StellaOps.TestKit/Incident/IncidentTestGenerator.cs` (358 lines)
+  - `src/__Libraries/StellaOps.TestKit/Interop/SchemaVersionMatrix.cs` (352 lines)
+  - `src/__Libraries/StellaOps.TestKit/Fixtures/PostgresFixture.cs` (340 lines)
+  - `src/__Libraries/StellaOps.TestKit/Evidence/EvidenceChainReporter.cs` (339 lines)
+  - `src/__Libraries/StellaOps.TestKit/Templates/WebServiceTestBase.cs` (325 lines)
+  - `src/__Libraries/StellaOps.TestKit/Templates/FlakyToDeterministicPattern.cs` (286 lines)
+  - `src/__Libraries/StellaOps.TestKit/Connectors/ConnectorSecurityTestBase.cs` (286 lines)
+  - `src/__Libraries/StellaOps.TestKit/TestCategories.cs` (282 lines)
+  - `src/__Libraries/StellaOps.TestKit/BlastRadius/BlastRadiusTestRunner.cs` (278 lines)
+  - `src/__Libraries/StellaOps.TestKit/Environment/EnvironmentProfile.cs` (270 lines)
+  - `src/__Libraries/StellaOps.TestKit/Templates/QueryDeterminismTests.cs` (258 lines)
+  - `src/__Libraries/StellaOps.TestKit/Fixtures/ValkeyFixture.cs` (253 lines)
+  - `src/__Libraries/StellaOps.TestKit/Fixtures/ContractTestHelper.cs` (242 lines)
+  - `src/__Libraries/StellaOps.TestKit/Observability/LogContractAssert.cs` (242 lines)
+  - `src/__Libraries/StellaOps.TestKit/BlastRadius/BlastRadiusValidator.cs` (241 lines)
+  - `src/__Libraries/StellaOps.TestKit/Incident/TestScaffold.cs` (232 lines)
+  - `src/__Libraries/StellaOps.TestKit/Longevity/StabilityTestRunner.cs` (231 lines)
+  - `src/__Libraries/StellaOps.TestKit/Templates/StorageConcurrencyTests.cs` (229 lines)
+  - `src/__Libraries/StellaOps.TestKit/Evidence/EvidenceChainAssert.cs` (228 lines)
+  - `src/__Libraries/StellaOps.TestKit/Observability/OTelContractAssert.cs` (223 lines)
+  - `src/__Libraries/StellaOps.TestKit/Templates/CacheIdempotencyTests.cs` (217 lines)
+  - `src/__Libraries/StellaOps.TestKit/Connectors/ConnectorHttpFixture.cs` (217 lines)
+  - `src/__Libraries/StellaOps.TestKit/Connectors/ConnectorLiveSchemaTestBase.cs` (209 lines)
+  - `src/__Libraries/StellaOps.TestKit/Connectors/ConnectorTestBase.cs` (205 lines)
+  - `src/__Libraries/StellaOps.TestKit/Connectors/FixtureUpdater.cs` (193 lines)
+  - `src/__Libraries/StellaOps.TestKit/Fixtures/WebServiceFixture.cs` (191 lines)
+  - `src/__Libraries/StellaOps.TestKit/Connectors/ConnectorResilienceTestBase.cs` (162 lines)
+  - `src/__Libraries/StellaOps.TestKit/Observability/OtelCapture.cs` (162 lines)
+  - `src/__Libraries/StellaOps.TestKit/Fixtures/HttpFixtureServer.cs` (156 lines)
+  - `src/__Libraries/StellaOps.TestKit/Assertions/CanonicalJsonAssert.cs` (148 lines)
+  - `src/__Libraries/StellaOps.TestKit/Templates/StorageIdempotencyTests.cs` (147 lines)
+  - `src/__Libraries/StellaOps.TestKit/Deterministic/DeterministicRandom.cs` (126 lines)
+  - `src/__Libraries/StellaOps.TestKit/Incident/IncidentMetadata.cs` (124 lines)
+  - `src/__Libraries/StellaOps.TestKit/Assertions/SnapshotAssert.cs` (114 lines)
+  - `src/__Libraries/StellaOps.TestKit/Extensions/HttpClientTestExtensions.cs` (111 lines)
+  - `src/__Libraries/StellaOps.TestKit/Deterministic/DeterministicTime.cs` (108 lines)
+  - `src/__Libraries/StellaOps.TestKit/Evidence/RequirementAttribute.cs` (102 lines)
+- Service locator matches:
+  - `src/__Libraries/StellaOps.TestKit/Connectors/ConnectorHttpFixture.cs`:187 _serviceProvider = services.BuildServiceProvider();
+  - `src/__Libraries/StellaOps.TestKit/Connectors/ConnectorLiveSchemaTestBase.cs`:46 return services.BuildServiceProvider();
+  - `src/__Libraries/StellaOps.TestKit/Fixtures/HttpFixtureServer.cs`:93 /// using var provider = services.BuildServiceProvider();
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+- Replace service locator usage with constructor injection.
+
+## Testing Fullness Findings
+- Status: PASS
+- Expected layers: Unit
+- Detected test projects: src/__Libraries/__Tests/StellaOps.TestKit.Tests/StellaOps.TestKit.Tests.csproj [Unit], src/__Analyzers/StellaOps.TestKit.Analyzers.Tests/StellaOps.TestKit.Analyzers.Tests.csproj [Unit]
+- Missing layers: none
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- None.

docs/implplan-blocked/audits/csproj-standards/__Libraries/StellaOps.Verdict/StellaOps.Verdict.md

@@ -0,0 +1,53 @@
+# Audit - StellaOps.Verdict
+
+## Project
+- Path: `src/__Libraries/StellaOps.Verdict/StellaOps.Verdict.csproj`
+- Module: `__Libraries`
+- Kind: `Library`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 14
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/__Libraries/StellaOps.Verdict/Oci/OciAttestationPublisher.cs` (826 lines)
+  - `src/__Libraries/StellaOps.Verdict/Schema/StellaVerdict.cs` (635 lines)
+  - `src/__Libraries/StellaOps.Verdict/Api/VerdictEndpoints.cs` (467 lines)
+  - `src/__Libraries/StellaOps.Verdict/VerdictBuilderService.cs` (453 lines)
+  - `src/__Libraries/StellaOps.Verdict/Export/VerdictBundleExporter.cs` (446 lines)
+  - `src/__Libraries/StellaOps.Verdict/Services/VerdictAssemblyService.cs` (405 lines)
+  - `src/__Libraries/StellaOps.Verdict/Persistence/PostgresVerdictStore.cs` (304 lines)
+  - `src/__Libraries/StellaOps.Verdict/Services/VerdictSigningService.cs` (304 lines)
+  - `src/__Libraries/StellaOps.Verdict/IVerdictBuilder.cs` (246 lines)
+  - `src/__Libraries/StellaOps.Verdict/PolicyLockGenerator.cs` (212 lines)
+  - `src/__Libraries/StellaOps.Verdict/Api/VerdictContracts.cs` (187 lines)
+  - `src/__Libraries/StellaOps.Verdict/VerdictServiceCollectionExtensions.cs` (175 lines)
+  - `src/__Libraries/StellaOps.Verdict/Persistence/IVerdictStore.cs` (147 lines)
+  - `src/__Libraries/StellaOps.Verdict/VerdictBuilderOptions.cs` (102 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: FAIL
+- Expected layers: Unit
+- Detected test projects: none
+- Missing layers: Unit
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- Add a unit test project named `<Project>.Tests` (or document exception).

docs/implplan-blocked/audits/csproj-standards/__Libraries/StellaOps.VersionComparison/StellaOps.VersionComparison.md

@@ -0,0 +1,44 @@
+# Audit - StellaOps.VersionComparison
+
+## Project
+- Path: `src/__Libraries/StellaOps.VersionComparison/StellaOps.VersionComparison.csproj`
+- Module: `__Libraries`
+- Kind: `Library`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 5
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/__Libraries/StellaOps.VersionComparison/Comparers/DebianVersionComparer.cs` (261 lines)
+  - `src/__Libraries/StellaOps.VersionComparison/Comparers/RpmVersionComparer.cs` (259 lines)
+  - `src/__Libraries/StellaOps.VersionComparison/Models/ApkVersion.cs` (158 lines)
+  - `src/__Libraries/StellaOps.VersionComparison/Models/RpmVersion.cs` (130 lines)
+  - `src/__Libraries/StellaOps.VersionComparison/Models/DebianVersion.cs` (126 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: PASS
+- Expected layers: Unit
+- Detected test projects: src/__Libraries/__Tests/StellaOps.VersionComparison.Tests/StellaOps.VersionComparison.Tests.csproj [Unit]
+- Missing layers: none
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- None.