up

src/Scanner/StellaOps.Scanner.Worker/Options/ScannerWorkerOptions.cs

@@ -28,6 +28,8 @@ public sealed class ScannerWorkerOptions
 
     public StellaOpsCryptoOptions Crypto { get; } = new();
 
+    public SigningOptions Signing { get; } = new();
+
     public DeterminismOptions Determinism { get; } = new();
 
     public sealed class QueueOptions
@@ -208,4 +210,35 @@ public sealed class ScannerWorkerOptions
         /// </summary>
         public int? ConcurrencyLimit { get; set; }
     }
+
+    public sealed class SigningOptions
+    {
+        /// <summary>
+        /// Enable DSSE signing for surface artifacts (composition recipe, layer fragments).
+        /// When disabled, the worker will fall back to deterministic hash envelopes.
+        /// </summary>
+        public bool EnableDsseSigning { get; set; }
+
+        /// <summary>
+        /// Identifier recorded in DSSE signatures.
+        /// </summary>
+        public string KeyId { get; set; } = "scanner-hmac";
+
+        /// <summary>
+        /// Shared secret material for HMAC-based DSSE signatures (base64 or hex).
+        /// Prefer <see cref=\"SharedSecretFile\"/> for file-based loading.
+        /// </summary>
+        public string? SharedSecret { get; set; }
+
+        /// <summary>
+        /// Optional path to a file containing the shared secret (base64 or hex).
+        /// </summary>
+        public string? SharedSecretFile { get; set; }
+
+        /// <summary>
+        /// Allow deterministic fallback when signing is enabled but no secret is provided.
+        /// Keeps offline determinism while avoiding hard failures in sealed-mode runs.
+        /// </summary>
+        public bool AllowDeterministicFallback { get; set; } = true;
+    }
 }

src/Scanner/StellaOps.Scanner.Worker/Options/ScannerWorkerOptionsValidator.cs

@@ -1,7 +1,8 @@
-using System;
-using System.Collections.Generic;
-using System.Linq;
-using Microsoft.Extensions.Options;
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using Microsoft.Extensions.Options;
 
 namespace StellaOps.Scanner.Worker.Options;
 
@@ -89,11 +90,21 @@ public sealed class ScannerWorkerOptionsValidator : IValidateOptions<ScannerWork
             }
         }
 
-        if (options.Shutdown.Timeout < TimeSpan.FromSeconds(5))
-        {
-            failures.Add("Scanner.Worker:Shutdown:Timeout must be at least 5 seconds to allow lease completion.");
-        }
-
+        if (options.Shutdown.Timeout < TimeSpan.FromSeconds(5))
+        {
+            failures.Add("Scanner.Worker:Shutdown:Timeout must be at least 5 seconds to allow lease completion.");
+        }
+
+        if (options.Signing.EnableDsseSigning)
+        {
+            var hasSecret = !string.IsNullOrWhiteSpace(options.Signing.SharedSecret)
+                            || (!string.IsNullOrWhiteSpace(options.Signing.SharedSecretFile) && File.Exists(options.Signing.SharedSecretFile));
+            if (!hasSecret && !options.Signing.AllowDeterministicFallback)
+            {
+                failures.Add("Scanner.Worker:Signing requires SharedSecret or SharedSecretFile when EnableDsseSigning is true and AllowDeterministicFallback is false.");
+            }
+        }
+
         if (options.Telemetry.EnableTelemetry)
         {
             if (!options.Telemetry.EnableMetrics && !options.Telemetry.EnableTracing)