sprints work

src/AdvisoryAI/StellaOps.AdvisoryAI.WebService/Endpoints/AttestationEndpoints.cs

@@ -0,0 +1,331 @@
+// <copyright file="AttestationEndpoints.cs" company="StellaOps">
+// Copyright (c) StellaOps. Licensed under the AGPL-3.0-or-later.
+// </copyright>
+
+using Microsoft.AspNetCore.Builder;
+using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.Routing;
+using Microsoft.Extensions.DependencyInjection;
+using StellaOps.AdvisoryAI.Attestation;
+using StellaOps.AdvisoryAI.Attestation.Models;
+using StellaOps.AdvisoryAI.Attestation.Storage;
+
+namespace StellaOps.AdvisoryAI.WebService.Endpoints;
+
+/// <summary>
+/// API endpoints for AI attestations.
+/// Sprint: SPRINT_20260109_011_001 Task: AIAT-009
+/// </summary>
+public static class AttestationEndpoints
+{
+    /// <summary>
+    /// Maps all attestation endpoints.
+    /// </summary>
+    public static void MapAttestationEndpoints(this WebApplication app)
+    {
+        // GET /v1/advisory-ai/runs/{runId}/attestation
+        app.MapGet("/v1/advisory-ai/runs/{runId}/attestation", HandleGetRunAttestation)
+            .WithName("advisory-ai.runs.attestation.get")
+            .WithTags("Attestations")
+            .Produces<RunAttestationResponse>(StatusCodes.Status200OK)
+            .Produces(StatusCodes.Status404NotFound)
+            .Produces(StatusCodes.Status401Unauthorized)
+            .RequireRateLimiting("advisory-ai");
+
+        // GET /v1/advisory-ai/runs/{runId}/claims
+        app.MapGet("/v1/advisory-ai/runs/{runId}/claims", HandleGetRunClaims)
+            .WithName("advisory-ai.runs.claims.list")
+            .WithTags("Attestations")
+            .Produces<ClaimsListResponse>(StatusCodes.Status200OK)
+            .Produces(StatusCodes.Status404NotFound)
+            .Produces(StatusCodes.Status401Unauthorized)
+            .RequireRateLimiting("advisory-ai");
+
+        // GET /v1/advisory-ai/attestations/recent
+        app.MapGet("/v1/advisory-ai/attestations/recent", HandleListRecentAttestations)
+            .WithName("advisory-ai.attestations.recent")
+            .WithTags("Attestations")
+            .Produces<RecentAttestationsResponse>(StatusCodes.Status200OK)
+            .Produces(StatusCodes.Status401Unauthorized)
+            .RequireRateLimiting("advisory-ai");
+
+        // POST /v1/advisory-ai/attestations/verify
+        app.MapPost("/v1/advisory-ai/attestations/verify", HandleVerifyAttestation)
+            .WithName("advisory-ai.attestations.verify")
+            .WithTags("Attestations")
+            .Produces<AttestationVerificationResponse>(StatusCodes.Status200OK)
+            .Produces<AttestationVerificationResponse>(StatusCodes.Status400BadRequest)
+            .Produces(StatusCodes.Status401Unauthorized)
+            .RequireRateLimiting("advisory-ai");
+    }
+
+    private static async Task<IResult> HandleGetRunAttestation(
+        string runId,
+        IAiAttestationService attestationService,
+        HttpContext httpContext,
+        CancellationToken cancellationToken)
+    {
+        var tenantId = GetTenantId(httpContext);
+        if (string.IsNullOrEmpty(tenantId))
+        {
+            return Results.Unauthorized();
+        }
+
+        var attestation = await attestationService.GetRunAttestationAsync(runId, cancellationToken)
+            .ConfigureAwait(false);
+
+        if (attestation is null)
+        {
+            return Results.NotFound(new { error = "Run attestation not found", runId });
+        }
+
+        // Enforce tenant isolation
+        if (attestation.TenantId != tenantId)
+        {
+            return Results.NotFound(new { error = "Run attestation not found", runId });
+        }
+
+        // Get the signed envelope if available (from store)
+        // Note: The service stores but we access via the store for envelope
+        var store = httpContext.RequestServices.GetService<IAiAttestationStore>();
+        var envelope = store is not null
+            ? await store.GetSignedEnvelopeAsync(runId, cancellationToken).ConfigureAwait(false)
+            : null;
+
+        return Results.Ok(new RunAttestationResponse
+        {
+            RunId = attestation.RunId,
+            Attestation = attestation,
+            Envelope = envelope,
+            Links = new AttestationLinks
+            {
+                Claims = $"/v1/advisory-ai/runs/{runId}/claims",
+                Verify = "/v1/advisory-ai/attestations/verify"
+            }
+        });
+    }
+
+    private static async Task<IResult> HandleGetRunClaims(
+        string runId,
+        IAiAttestationService attestationService,
+        HttpContext httpContext,
+        CancellationToken cancellationToken)
+    {
+        var tenantId = GetTenantId(httpContext);
+        if (string.IsNullOrEmpty(tenantId))
+        {
+            return Results.Unauthorized();
+        }
+
+        // First verify the run exists and belongs to tenant
+        var attestation = await attestationService.GetRunAttestationAsync(runId, cancellationToken)
+            .ConfigureAwait(false);
+
+        if (attestation is null || attestation.TenantId != tenantId)
+        {
+            return Results.NotFound(new { error = "Run not found", runId });
+        }
+
+        var claims = await attestationService.GetClaimAttestationsAsync(runId, cancellationToken)
+            .ConfigureAwait(false);
+
+        return Results.Ok(new ClaimsListResponse
+        {
+            RunId = runId,
+            Count = claims.Count,
+            Claims = claims
+        });
+    }
+
+    private static async Task<IResult> HandleListRecentAttestations(
+        IAiAttestationService attestationService,
+        HttpContext httpContext,
+        int? limit,
+        CancellationToken cancellationToken)
+    {
+        var tenantId = GetTenantId(httpContext);
+        if (string.IsNullOrEmpty(tenantId))
+        {
+            return Results.Unauthorized();
+        }
+
+        var effectiveLimit = Math.Min(limit ?? 20, 100);
+        var attestations = await attestationService.ListRecentAttestationsAsync(
+            tenantId,
+            effectiveLimit,
+            cancellationToken).ConfigureAwait(false);
+
+        return Results.Ok(new RecentAttestationsResponse
+        {
+            Count = attestations.Count,
+            Attestations = attestations
+        });
+    }
+
+    private static async Task<IResult> HandleVerifyAttestation(
+        VerifyAttestationRequest request,
+        IAiAttestationService attestationService,
+        HttpContext httpContext,
+        CancellationToken cancellationToken)
+    {
+        var tenantId = GetTenantId(httpContext);
+        if (string.IsNullOrEmpty(tenantId))
+        {
+            return Results.Unauthorized();
+        }
+
+        if (string.IsNullOrEmpty(request.RunId))
+        {
+            return Results.BadRequest(new AttestationVerificationResponse
+            {
+                IsValid = false,
+                Error = "RunId is required"
+            });
+        }
+
+        // First verify the run belongs to this tenant
+        var attestation = await attestationService.GetRunAttestationAsync(request.RunId, cancellationToken)
+            .ConfigureAwait(false);
+
+        if (attestation is null || attestation.TenantId != tenantId)
+        {
+            return Results.BadRequest(new AttestationVerificationResponse
+            {
+                IsValid = false,
+                RunId = request.RunId,
+                Error = "Attestation not found or access denied"
+            });
+        }
+
+        var result = await attestationService.VerifyRunAttestationAsync(
+            request.RunId,
+            cancellationToken).ConfigureAwait(false);
+
+        var response = new AttestationVerificationResponse
+        {
+            IsValid = result.Valid,
+            RunId = request.RunId,
+            ContentDigest = attestation.ComputeDigest(),
+            Error = result.FailureReason,
+            VerifiedAt = result.VerifiedAt,
+            SigningKeyId = result.SigningKeyId,
+            DigestValid = result.DigestValid,
+            SignatureValid = result.SignatureValid
+        };
+
+        return result.Valid ? Results.Ok(response) : Results.BadRequest(response);
+    }
+
+    private static string? GetTenantId(HttpContext context)
+    {
+        // Try standard header first
+        if (context.Request.Headers.TryGetValue("X-StellaOps-Tenant", out var tenant))
+        {
+            return tenant.ToString();
+        }
+
+        // Fallback to claims if authenticated
+        var tenantClaim = context.User?.FindFirst("tenant_id")?.Value;
+        return tenantClaim;
+    }
+}
+
+#region Response Models
+
+/// <summary>
+/// Response for run attestation retrieval.
+/// </summary>
+public sealed record RunAttestationResponse
+{
+    /// <summary>Run identifier.</summary>
+    public required string RunId { get; init; }
+
+    /// <summary>The attestation data.</summary>
+    public required AiRunAttestation Attestation { get; init; }
+
+    /// <summary>DSSE envelope if signed.</summary>
+    public object? Envelope { get; init; }
+
+    /// <summary>Related links.</summary>
+    public AttestationLinks? Links { get; init; }
+}
+
+/// <summary>
+/// Response for claims list.
+/// </summary>
+public sealed record ClaimsListResponse
+{
+    /// <summary>Run identifier.</summary>
+    public required string RunId { get; init; }
+
+    /// <summary>Number of claims.</summary>
+    public int Count { get; init; }
+
+    /// <summary>Claim attestations.</summary>
+    public required IReadOnlyList<AiClaimAttestation> Claims { get; init; }
+}
+
+/// <summary>
+/// Response for recent attestations list.
+/// </summary>
+public sealed record RecentAttestationsResponse
+{
+    /// <summary>Number of attestations returned.</summary>
+    public int Count { get; init; }
+
+    /// <summary>Recent attestations.</summary>
+    public required IReadOnlyList<AiRunAttestation> Attestations { get; init; }
+}
+
+/// <summary>
+/// Request for attestation verification.
+/// </summary>
+public sealed record VerifyAttestationRequest
+{
+    /// <summary>Run ID to verify.</summary>
+    public string? RunId { get; init; }
+}
+
+/// <summary>
+/// Response for attestation verification.
+/// </summary>
+public sealed record AttestationVerificationResponse
+{
+    /// <summary>Whether verification succeeded.</summary>
+    public bool IsValid { get; init; }
+
+    /// <summary>Run ID if extracted from envelope.</summary>
+    public string? RunId { get; init; }
+
+    /// <summary>Content digest if verified.</summary>
+    public string? ContentDigest { get; init; }
+
+    /// <summary>Error message if verification failed.</summary>
+    public string? Error { get; init; }
+
+    /// <summary>Timestamp when verification was performed.</summary>
+    public DateTimeOffset? VerifiedAt { get; init; }
+
+    /// <summary>Signing key ID if signed.</summary>
+    public string? SigningKeyId { get; init; }
+
+    /// <summary>Whether the digest was valid.</summary>
+    public bool? DigestValid { get; init; }
+
+    /// <summary>Whether the signature was valid.</summary>
+    public bool? SignatureValid { get; init; }
+}
+
+/// <summary>
+/// Related links for attestation responses.
+/// </summary>
+public sealed record AttestationLinks
+{
+    /// <summary>Link to claims endpoint.</summary>
+    public string? Claims { get; init; }
+
+    /// <summary>Link to verification endpoint.</summary>
+    public string? Verify { get; init; }
+}
+
+#endregion

src/AdvisoryAI/StellaOps.AdvisoryAI.WebService/Program.cs

@@ -10,6 +10,7 @@ using Microsoft.Extensions.Configuration;
 using Microsoft.Extensions.DependencyInjection;
 using Microsoft.Extensions.Hosting;
 using Microsoft.Extensions.Logging;
+using StellaOps.AdvisoryAI.Attestation;
 using StellaOps.AdvisoryAI.Caching;
 using StellaOps.AdvisoryAI.Chat;
 using StellaOps.AdvisoryAI.Diagnostics;
@@ -22,6 +23,7 @@ using StellaOps.AdvisoryAI.Queue;
 using StellaOps.AdvisoryAI.PolicyStudio;
 using StellaOps.AdvisoryAI.Remediation;
 using StellaOps.AdvisoryAI.WebService.Contracts;
+using StellaOps.AdvisoryAI.WebService.Endpoints;
 using StellaOps.AdvisoryAI.WebService.Services;
 using StellaOps.Router.AspNet;
 
@@ -50,6 +52,10 @@ builder.Services.AddSingleton(TimeProvider.System);
 builder.Services.AddSingleton<IAiConsentStore, InMemoryAiConsentStore>();
 builder.Services.AddSingleton<IAiJustificationGenerator, DefaultAiJustificationGenerator>();
 
+// AI Attestations (Sprint: SPRINT_20260109_011_001 Task: AIAT-009)
+builder.Services.AddAiAttestationServices();
+builder.Services.AddInMemoryAiAttestationStore();
+
 builder.Services.AddEndpointsApiExplorer();
 builder.Services.AddOpenApi();
 builder.Services.AddProblemDetails();
@@ -179,6 +185,9 @@ app.MapDelete("/v1/advisory-ai/conversations/{conversationId}", HandleDeleteConv
 app.MapGet("/v1/advisory-ai/conversations", HandleListConversations)
    .RequireRateLimiting("advisory-ai");
 
+// AI Attestations endpoints (Sprint: SPRINT_20260109_011_001 Task: AIAT-009)
+app.MapAttestationEndpoints();
+
 // Refresh Router endpoint cache
 app.TryRefreshStellaRouterEndpoints(routerOptions);
 

src/AdvisoryAI/StellaOps.AdvisoryAI.WebService/StellaOps.AdvisoryAI.WebService.csproj

@@ -13,5 +13,7 @@
     <ProjectReference Include="..\StellaOps.AdvisoryAI\StellaOps.AdvisoryAI.csproj" />
     <ProjectReference Include="..\StellaOps.AdvisoryAI.Hosting\StellaOps.AdvisoryAI.Hosting.csproj" />
     <ProjectReference Include="..\..\Router/__Libraries/StellaOps.Router.AspNet\StellaOps.Router.AspNet.csproj" />
+    <!-- AI Attestations (Sprint: SPRINT_20260109_011_001) -->
+    <ProjectReference Include="..\..\__Libraries\StellaOps.AdvisoryAI.Attestation\StellaOps.AdvisoryAI.Attestation.csproj" />
   </ItemGroup>
 </Project>

src/Cli/StellaOps.Cli/Commands/CommandFactory.cs

@@ -112,6 +112,9 @@ internal static class CommandFactory
         // Sprint: SPRINT_20251229_015 - CI template generator
         root.Add(CiCommandGroup.BuildCiCommand(services, verboseOption, cancellationToken));
 
+        // Sprint: SPRINT_20260109_010_002 - GitHub Code Scanning integration
+        root.Add(GitHubCommandGroup.BuildGitHubCommand(services, verboseOption, cancellationToken));
+
         // Sprint: SPRINT_20251226_003_BE_exception_approval - Exception approval workflow
         root.Add(ExceptionCommandGroup.BuildExceptionCommand(services, options, verboseOption, cancellationToken));
 

src/Cli/StellaOps.Cli/Commands/GitHubCommandGroup.cs

@@ -0,0 +1,806 @@
+// <copyright file="GitHubCommandGroup.cs" company="StellaOps">
+// Copyright (c) StellaOps. Licensed under the AGPL-3.0-or-later.
+// </copyright>
+
+using System.CommandLine;
+using System.Globalization;
+using System.Text.Json;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Logging;
+using Spectre.Console;
+using StellaOps.Integrations.Plugin.GitHubApp.CodeScanning;
+
+namespace StellaOps.Cli.Commands;
+
+/// <summary>
+/// GitHub integration commands including Code Scanning.
+/// Sprint: SPRINT_20260109_010_002
+/// </summary>
+public static class GitHubCommandGroup
+{
+    private static readonly JsonSerializerOptions JsonOptions = new()
+    {
+        WriteIndented = true,
+        PropertyNamingPolicy = JsonNamingPolicy.CamelCase
+    };
+
+    public static Command BuildGitHubCommand(
+        IServiceProvider services,
+        Option<bool> verboseOption,
+        CancellationToken cancellationToken)
+    {
+        var github = new Command("github", "GitHub integration commands.");
+
+        github.Add(BuildUploadSarifCommand(services, verboseOption, cancellationToken));
+        github.Add(BuildListAlertsCommand(services, verboseOption, cancellationToken));
+        github.Add(BuildGetAlertCommand(services, verboseOption, cancellationToken));
+        github.Add(BuildUpdateAlertCommand(services, verboseOption, cancellationToken));
+        github.Add(BuildUploadStatusCommand(services, verboseOption, cancellationToken));
+
+        return github;
+    }
+
+    private static Command BuildUploadSarifCommand(
+        IServiceProvider services,
+        Option<bool> verboseOption,
+        CancellationToken cancellationToken)
+    {
+        var sarifFileArg = new Argument<string>("sarif-file")
+        {
+            Description = "Path to SARIF file to upload."
+        };
+
+        var repoOption = new Option<string>("--repo", new[] { "-r" })
+        {
+            Description = "Repository in owner/repo format",
+            Required = true
+        };
+
+        var refOption = new Option<string?>("--ref")
+        {
+            Description = "Git ref (e.g., refs/heads/main). Defaults to current branch."
+        };
+
+        var shaOption = new Option<string?>("--sha")
+        {
+            Description = "Commit SHA. Defaults to current HEAD."
+        };
+
+        var waitOption = new Option<bool>("--wait", new[] { "-w" })
+        {
+            Description = "Wait for processing to complete"
+        };
+
+        var timeoutOption = new Option<int>("--timeout", new[] { "-t" })
+        {
+            Description = "Wait timeout in seconds (default: 300)"
+        };
+        timeoutOption.SetDefaultValue(300);
+
+        var toolNameOption = new Option<string?>("--tool-name")
+        {
+            Description = "Tool name for GitHub categorization"
+        };
+
+        var githubUrlOption = new Option<string?>("--github-url")
+        {
+            Description = "GitHub API URL (for GitHub Enterprise Server)"
+        };
+
+        var cmd = new Command("upload-sarif", "Upload SARIF to GitHub Code Scanning.")
+        {
+            sarifFileArg,
+            repoOption,
+            refOption,
+            shaOption,
+            waitOption,
+            timeoutOption,
+            toolNameOption,
+            githubUrlOption,
+            verboseOption
+        };
+
+        cmd.SetAction(async (parseResult, _) =>
+        {
+            var sarifFile = parseResult.GetValue(sarifFileArg)!;
+            var repo = parseResult.GetValue(repoOption)!;
+            var gitRef = parseResult.GetValue(refOption);
+            var sha = parseResult.GetValue(shaOption);
+            var wait = parseResult.GetValue(waitOption);
+            var timeout = parseResult.GetValue(timeoutOption);
+            var toolName = parseResult.GetValue(toolNameOption);
+            var githubUrl = parseResult.GetValue(githubUrlOption);
+            var verbose = parseResult.GetValue(verboseOption);
+
+            try
+            {
+                await UploadSarifAsync(
+                    services,
+                    sarifFile,
+                    repo,
+                    gitRef,
+                    sha,
+                    wait,
+                    TimeSpan.FromSeconds(timeout),
+                    toolName,
+                    githubUrl,
+                    verbose,
+                    cancellationToken);
+                return 0;
+            }
+            catch (Exception ex)
+            {
+                AnsiConsole.MarkupLine($"[red]Error:[/] {ex.Message}");
+                return 1;
+            }
+        });
+
+        return cmd;
+    }
+
+    private static async Task UploadSarifAsync(
+        IServiceProvider services,
+        string sarifFilePath,
+        string repo,
+        string? gitRef,
+        string? sha,
+        bool wait,
+        TimeSpan timeout,
+        string? toolName,
+        string? githubUrl,
+        bool verbose,
+        CancellationToken ct)
+    {
+        // Parse owner/repo
+        var parts = repo.Split('/');
+        if (parts.Length != 2)
+        {
+            throw new ArgumentException("Repository must be in owner/repo format");
+        }
+
+        var owner = parts[0];
+        var repoName = parts[1];
+
+        // Validate SARIF file
+        if (!File.Exists(sarifFilePath))
+        {
+            throw new FileNotFoundException($"SARIF file not found: {sarifFilePath}");
+        }
+
+        // Read SARIF content
+        var sarifContent = await File.ReadAllTextAsync(sarifFilePath, ct);
+
+        // Get git info if not provided
+        var commitSha = sha ?? await GetGitShaAsync(ct);
+        var refValue = gitRef ?? await GetGitRefAsync(ct);
+
+        AnsiConsole.MarkupLine($"[blue]Uploading SARIF to[/] [yellow]{owner}/{repoName}[/]");
+        AnsiConsole.MarkupLine($"  Commit: [dim]{commitSha}[/]");
+        AnsiConsole.MarkupLine($"  Ref: [dim]{refValue}[/]");
+
+        // Get client
+        var client = GetCodeScanningClient(services, githubUrl);
+
+        // Build request
+        var request = new SarifUploadRequest
+        {
+            CommitSha = commitSha,
+            Ref = refValue,
+            SarifContent = sarifContent,
+            ToolName = toolName ?? "StellaOps Scanner"
+        };
+
+        // Upload
+        var result = await client.UploadSarifAsync(owner, repoName, request, ct);
+
+        AnsiConsole.MarkupLine($"[green]Uploaded successfully![/]");
+        AnsiConsole.MarkupLine($"  SARIF ID: [cyan]{result.Id}[/]");
+        AnsiConsole.MarkupLine($"  Status URL: [dim]{result.Url}[/]");
+
+        // Wait if requested
+        if (wait)
+        {
+            AnsiConsole.MarkupLine("[blue]Waiting for processing...[/]");
+
+            var status = await AnsiConsole.Status()
+                .Spinner(Spinner.Known.Dots)
+                .StartAsync("Processing...", async ctx =>
+                {
+                    return await client.WaitForProcessingAsync(
+                        owner, repoName, result.Id, timeout, ct);
+                });
+
+            if (status.Status == ProcessingStatus.Complete)
+            {
+                AnsiConsole.MarkupLine($"[green]Processing complete![/]");
+                if (!string.IsNullOrEmpty(status.AnalysisUrl))
+                {
+                    AnsiConsole.MarkupLine($"  Analysis: [link]{status.AnalysisUrl}[/]");
+                }
+            }
+            else if (status.Status == ProcessingStatus.Failed)
+            {
+                AnsiConsole.MarkupLine($"[red]Processing failed![/]");
+                foreach (var error in status.Errors)
+                {
+                    AnsiConsole.MarkupLine($"  [red]- {error}[/]");
+                }
+                throw new InvalidOperationException("SARIF processing failed");
+            }
+        }
+    }
+
+    private static Command BuildListAlertsCommand(
+        IServiceProvider services,
+        Option<bool> verboseOption,
+        CancellationToken cancellationToken)
+    {
+        var repoOption = new Option<string>("--repo", new[] { "-r" })
+        {
+            Description = "Repository in owner/repo format",
+            Required = true
+        };
+
+        var stateOption = new Option<string?>("--state", new[] { "-s" })
+        {
+            Description = "Filter by state: open, closed, dismissed, fixed"
+        };
+
+        var severityOption = new Option<string?>("--severity")
+        {
+            Description = "Filter by severity: critical, high, medium, low"
+        };
+
+        var toolOption = new Option<string?>("--tool")
+        {
+            Description = "Filter by tool name"
+        };
+
+        var refOption = new Option<string?>("--ref")
+        {
+            Description = "Filter by git ref"
+        };
+
+        var jsonOption = new Option<bool>("--json")
+        {
+            Description = "Output as JSON"
+        };
+
+        var githubUrlOption = new Option<string?>("--github-url")
+        {
+            Description = "GitHub API URL (for GitHub Enterprise Server)"
+        };
+
+        var cmd = new Command("list-alerts", "List code scanning alerts for a repository.")
+        {
+            repoOption,
+            stateOption,
+            severityOption,
+            toolOption,
+            refOption,
+            jsonOption,
+            githubUrlOption,
+            verboseOption
+        };
+
+        cmd.SetAction(async (parseResult, _) =>
+        {
+            var repo = parseResult.GetValue(repoOption)!;
+            var state = parseResult.GetValue(stateOption);
+            var severity = parseResult.GetValue(severityOption);
+            var tool = parseResult.GetValue(toolOption);
+            var gitRef = parseResult.GetValue(refOption);
+            var json = parseResult.GetValue(jsonOption);
+            var githubUrl = parseResult.GetValue(githubUrlOption);
+
+            try
+            {
+                await ListAlertsAsync(
+                    services, repo, state, severity, tool, gitRef, json, githubUrl, cancellationToken);
+                return 0;
+            }
+            catch (Exception ex)
+            {
+                AnsiConsole.MarkupLine($"[red]Error:[/] {ex.Message}");
+                return 1;
+            }
+        });
+
+        return cmd;
+    }
+
+    private static async Task ListAlertsAsync(
+        IServiceProvider services,
+        string repo,
+        string? state,
+        string? severity,
+        string? tool,
+        string? gitRef,
+        bool json,
+        string? githubUrl,
+        CancellationToken ct)
+    {
+        var parts = repo.Split('/');
+        if (parts.Length != 2)
+        {
+            throw new ArgumentException("Repository must be in owner/repo format");
+        }
+
+        var owner = parts[0];
+        var repoName = parts[1];
+
+        var client = GetCodeScanningClient(services, githubUrl);
+
+        var filter = new AlertFilter
+        {
+            State = state,
+            Severity = severity,
+            Tool = tool,
+            Ref = gitRef
+        };
+
+        var alerts = await client.ListAlertsAsync(owner, repoName, filter, ct);
+
+        if (json)
+        {
+            Console.WriteLine(JsonSerializer.Serialize(alerts, JsonOptions));
+            return;
+        }
+
+        if (alerts.Count == 0)
+        {
+            AnsiConsole.MarkupLine("[dim]No alerts found.[/]");
+            return;
+        }
+
+        var table = new Table();
+        table.AddColumn("#");
+        table.AddColumn("State");
+        table.AddColumn("Severity");
+        table.AddColumn("Rule");
+        table.AddColumn("Tool");
+        table.AddColumn("Created");
+
+        foreach (var alert in alerts)
+        {
+            var stateColor = alert.State switch
+            {
+                "open" => "red",
+                "dismissed" => "yellow",
+                "fixed" => "green",
+                _ => "dim"
+            };
+
+            var severityColor = alert.RuleSeverity switch
+            {
+                "critical" or "error" => "red",
+                "high" => "yellow",
+                "medium" or "warning" => "blue",
+                _ => "dim"
+            };
+
+            table.AddRow(
+                alert.Number.ToString(CultureInfo.InvariantCulture),
+                $"[{stateColor}]{alert.State}[/]",
+                $"[{severityColor}]{alert.RuleSeverity}[/]",
+                alert.RuleId,
+                alert.Tool,
+                alert.CreatedAt.ToString("yyyy-MM-dd", CultureInfo.InvariantCulture));
+        }
+
+        AnsiConsole.Write(table);
+        AnsiConsole.MarkupLine($"[dim]Total: {alerts.Count} alerts[/]");
+    }
+
+    private static Command BuildGetAlertCommand(
+        IServiceProvider services,
+        Option<bool> verboseOption,
+        CancellationToken cancellationToken)
+    {
+        var alertNumberArg = new Argument<int>("alert-number")
+        {
+            Description = "Alert number to retrieve."
+        };
+
+        var repoOption = new Option<string>("--repo", new[] { "-r" })
+        {
+            Description = "Repository in owner/repo format",
+            Required = true
+        };
+
+        var jsonOption = new Option<bool>("--json")
+        {
+            Description = "Output as JSON"
+        };
+
+        var githubUrlOption = new Option<string?>("--github-url")
+        {
+            Description = "GitHub API URL (for GitHub Enterprise Server)"
+        };
+
+        var cmd = new Command("get-alert", "Get details for a specific code scanning alert.")
+        {
+            alertNumberArg,
+            repoOption,
+            jsonOption,
+            githubUrlOption,
+            verboseOption
+        };
+
+        cmd.SetAction(async (parseResult, _) =>
+        {
+            var alertNumber = parseResult.GetValue(alertNumberArg);
+            var repo = parseResult.GetValue(repoOption)!;
+            var json = parseResult.GetValue(jsonOption);
+            var githubUrl = parseResult.GetValue(githubUrlOption);
+
+            try
+            {
+                await GetAlertAsync(services, repo, alertNumber, json, githubUrl, cancellationToken);
+                return 0;
+            }
+            catch (Exception ex)
+            {
+                AnsiConsole.MarkupLine($"[red]Error:[/] {ex.Message}");
+                return 1;
+            }
+        });
+
+        return cmd;
+    }
+
+    private static async Task GetAlertAsync(
+        IServiceProvider services,
+        string repo,
+        int alertNumber,
+        bool json,
+        string? githubUrl,
+        CancellationToken ct)
+    {
+        var parts = repo.Split('/');
+        if (parts.Length != 2)
+        {
+            throw new ArgumentException("Repository must be in owner/repo format");
+        }
+
+        var owner = parts[0];
+        var repoName = parts[1];
+
+        var client = GetCodeScanningClient(services, githubUrl);
+        var alert = await client.GetAlertAsync(owner, repoName, alertNumber, ct);
+
+        if (json)
+        {
+            Console.WriteLine(JsonSerializer.Serialize(alert, JsonOptions));
+            return;
+        }
+
+        AnsiConsole.MarkupLine($"[bold]Alert #{alert.Number}[/]");
+        AnsiConsole.MarkupLine($"  State: {alert.State}");
+        AnsiConsole.MarkupLine($"  Rule: {alert.RuleId}");
+        AnsiConsole.MarkupLine($"  Severity: {alert.RuleSeverity}");
+        AnsiConsole.MarkupLine($"  Description: {alert.RuleDescription}");
+        AnsiConsole.MarkupLine($"  Tool: {alert.Tool}");
+        AnsiConsole.MarkupLine($"  Created: {alert.CreatedAt:yyyy-MM-dd HH:mm:ss}");
+
+        if (alert.DismissedAt.HasValue)
+        {
+            AnsiConsole.MarkupLine($"  Dismissed: {alert.DismissedAt.Value:yyyy-MM-dd HH:mm:ss}");
+            AnsiConsole.MarkupLine($"  Dismiss reason: {alert.DismissedReason}");
+        }
+
+        if (alert.MostRecentInstance != null)
+        {
+            AnsiConsole.MarkupLine($"  Location: {alert.MostRecentInstance.Location?.Path}:{alert.MostRecentInstance.Location?.StartLine}");
+        }
+
+        AnsiConsole.MarkupLine($"  URL: [link]{alert.HtmlUrl}[/]");
+    }
+
+    private static Command BuildUpdateAlertCommand(
+        IServiceProvider services,
+        Option<bool> verboseOption,
+        CancellationToken cancellationToken)
+    {
+        var alertNumberArg = new Argument<int>("alert-number")
+        {
+            Description = "Alert number to update."
+        };
+
+        var repoOption = new Option<string>("--repo", new[] { "-r" })
+        {
+            Description = "Repository in owner/repo format",
+            Required = true
+        };
+
+        var stateOption = new Option<string>("--state", new[] { "-s" })
+        {
+            Description = "New state: dismissed, open",
+            Required = true
+        };
+        stateOption.FromAmong("dismissed", "open");
+
+        var reasonOption = new Option<string?>("--reason")
+        {
+            Description = "Dismiss reason: false_positive, wont_fix, used_in_tests"
+        };
+
+        var commentOption = new Option<string?>("--comment")
+        {
+            Description = "Dismiss comment"
+        };
+
+        var githubUrlOption = new Option<string?>("--github-url")
+        {
+            Description = "GitHub API URL (for GitHub Enterprise Server)"
+        };
+
+        var cmd = new Command("update-alert", "Update a code scanning alert state.")
+        {
+            alertNumberArg,
+            repoOption,
+            stateOption,
+            reasonOption,
+            commentOption,
+            githubUrlOption,
+            verboseOption
+        };
+
+        cmd.SetAction(async (parseResult, _) =>
+        {
+            var alertNumber = parseResult.GetValue(alertNumberArg);
+            var repo = parseResult.GetValue(repoOption)!;
+            var state = parseResult.GetValue(stateOption)!;
+            var reason = parseResult.GetValue(reasonOption);
+            var comment = parseResult.GetValue(commentOption);
+            var githubUrl = parseResult.GetValue(githubUrlOption);
+
+            try
+            {
+                await UpdateAlertAsync(
+                    services, repo, alertNumber, state, reason, comment, githubUrl, cancellationToken);
+                return 0;
+            }
+            catch (Exception ex)
+            {
+                AnsiConsole.MarkupLine($"[red]Error:[/] {ex.Message}");
+                return 1;
+            }
+        });
+
+        return cmd;
+    }
+
+    private static async Task UpdateAlertAsync(
+        IServiceProvider services,
+        string repo,
+        int alertNumber,
+        string state,
+        string? reason,
+        string? comment,
+        string? githubUrl,
+        CancellationToken ct)
+    {
+        var parts = repo.Split('/');
+        if (parts.Length != 2)
+        {
+            throw new ArgumentException("Repository must be in owner/repo format");
+        }
+
+        var owner = parts[0];
+        var repoName = parts[1];
+
+        if (state == "dismissed" && string.IsNullOrEmpty(reason))
+        {
+            throw new ArgumentException("Dismiss reason is required when dismissing an alert");
+        }
+
+        var client = GetCodeScanningClient(services, githubUrl);
+
+        var update = new AlertUpdate
+        {
+            State = state,
+            DismissedReason = reason,
+            DismissedComment = comment
+        };
+
+        var alert = await client.UpdateAlertAsync(owner, repoName, alertNumber, update, ct);
+
+        AnsiConsole.MarkupLine($"[green]Alert #{alert.Number} updated to state: {alert.State}[/]");
+    }
+
+    private static Command BuildUploadStatusCommand(
+        IServiceProvider services,
+        Option<bool> verboseOption,
+        CancellationToken cancellationToken)
+    {
+        var sarifIdArg = new Argument<string>("sarif-id")
+        {
+            Description = "SARIF upload ID to check."
+        };
+
+        var repoOption = new Option<string>("--repo", new[] { "-r" })
+        {
+            Description = "Repository in owner/repo format",
+            Required = true
+        };
+
+        var jsonOption = new Option<bool>("--json")
+        {
+            Description = "Output as JSON"
+        };
+
+        var githubUrlOption = new Option<string?>("--github-url")
+        {
+            Description = "GitHub API URL (for GitHub Enterprise Server)"
+        };
+
+        var cmd = new Command("upload-status", "Check SARIF upload processing status.")
+        {
+            sarifIdArg,
+            repoOption,
+            jsonOption,
+            githubUrlOption,
+            verboseOption
+        };
+
+        cmd.SetAction(async (parseResult, _) =>
+        {
+            var sarifId = parseResult.GetValue(sarifIdArg)!;
+            var repo = parseResult.GetValue(repoOption)!;
+            var json = parseResult.GetValue(jsonOption);
+            var githubUrl = parseResult.GetValue(githubUrlOption);
+
+            try
+            {
+                await GetUploadStatusAsync(services, repo, sarifId, json, githubUrl, cancellationToken);
+                return 0;
+            }
+            catch (Exception ex)
+            {
+                AnsiConsole.MarkupLine($"[red]Error:[/] {ex.Message}");
+                return 1;
+            }
+        });
+
+        return cmd;
+    }
+
+    private static async Task GetUploadStatusAsync(
+        IServiceProvider services,
+        string repo,
+        string sarifId,
+        bool json,
+        string? githubUrl,
+        CancellationToken ct)
+    {
+        var parts = repo.Split('/');
+        if (parts.Length != 2)
+        {
+            throw new ArgumentException("Repository must be in owner/repo format");
+        }
+
+        var owner = parts[0];
+        var repoName = parts[1];
+
+        var client = GetCodeScanningClient(services, githubUrl);
+        var status = await client.GetUploadStatusAsync(owner, repoName, sarifId, ct);
+
+        if (json)
+        {
+            Console.WriteLine(JsonSerializer.Serialize(status, JsonOptions));
+            return;
+        }
+
+        var statusColor = status.Status switch
+        {
+            ProcessingStatus.Complete => "green",
+            ProcessingStatus.Failed => "red",
+            _ => "yellow"
+        };
+
+        AnsiConsole.MarkupLine($"[bold]SARIF Upload Status[/]");
+        AnsiConsole.MarkupLine($"  Status: [{statusColor}]{status.Status}[/]");
+
+        if (status.ProcessingStartedAt.HasValue)
+        {
+            AnsiConsole.MarkupLine($"  Started: {status.ProcessingStartedAt.Value:yyyy-MM-dd HH:mm:ss}");
+        }
+
+        if (status.ProcessingCompletedAt.HasValue)
+        {
+            AnsiConsole.MarkupLine($"  Completed: {status.ProcessingCompletedAt.Value:yyyy-MM-dd HH:mm:ss}");
+        }
+
+        if (!string.IsNullOrEmpty(status.AnalysisUrl))
+        {
+            AnsiConsole.MarkupLine($"  Analysis: [link]{status.AnalysisUrl}[/]");
+        }
+
+        if (status.Errors.Length > 0)
+        {
+            AnsiConsole.MarkupLine("[red]Errors:[/]");
+            foreach (var error in status.Errors)
+            {
+                AnsiConsole.MarkupLine($"  - {error}");
+            }
+        }
+    }
+
+    private static IGitHubCodeScanningClient GetCodeScanningClient(
+        IServiceProvider services,
+        string? githubUrl)
+    {
+        // Try to get from DI first
+        var client = services.GetService<IGitHubCodeScanningClient>();
+        if (client != null)
+        {
+            return client;
+        }
+
+        // Fallback: create manually (this would use environment token)
+        throw new InvalidOperationException(
+            "GitHub Code Scanning client not configured. " +
+            "Please ensure GITHUB_TOKEN environment variable is set.");
+    }
+
+    private static async Task<string> GetGitShaAsync(CancellationToken ct)
+    {
+        try
+        {
+            var process = System.Diagnostics.Process.Start(new System.Diagnostics.ProcessStartInfo
+            {
+                FileName = "git",
+                Arguments = "rev-parse HEAD",
+                RedirectStandardOutput = true,
+                UseShellExecute = false,
+                CreateNoWindow = true
+            });
+
+            if (process == null)
+            {
+                throw new InvalidOperationException("Failed to start git process");
+            }
+
+            var sha = await process.StandardOutput.ReadToEndAsync(ct);
+            await process.WaitForExitAsync(ct);
+
+            return sha.Trim();
+        }
+        catch
+        {
+            throw new InvalidOperationException(
+                "Could not determine commit SHA. Please provide --sha option.");
+        }
+    }
+
+    private static async Task<string> GetGitRefAsync(CancellationToken ct)
+    {
+        try
+        {
+            var process = System.Diagnostics.Process.Start(new System.Diagnostics.ProcessStartInfo
+            {
+                FileName = "git",
+                Arguments = "symbolic-ref HEAD",
+                RedirectStandardOutput = true,
+                UseShellExecute = false,
+                CreateNoWindow = true
+            });
+
+            if (process == null)
+            {
+                throw new InvalidOperationException("Failed to start git process");
+            }
+
+            var refVal = await process.StandardOutput.ReadToEndAsync(ct);
+            await process.WaitForExitAsync(ct);
+
+            return refVal.Trim();
+        }
+        catch
+        {
+            throw new InvalidOperationException(
+                "Could not determine git ref. Please provide --ref option.");
+        }
+    }
+}

src/Cli/StellaOps.Cli/StellaOps.Cli.csproj

@@ -101,6 +101,8 @@
     <ProjectReference Include="../../AirGap/__Libraries/StellaOps.AirGap.Sync/StellaOps.AirGap.Sync.csproj" />
     <!-- Facet seal and drift (SPRINT_20260105_002_004_CLI) -->
     <ProjectReference Include="../../__Libraries/StellaOps.Facet/StellaOps.Facet.csproj" />
+    <!-- GitHub Code Scanning Integration (SPRINT_20260109_010_002) -->
+    <ProjectReference Include="../../Integrations/__Plugins/StellaOps.Integrations.Plugin.GitHubApp/StellaOps.Integrations.Plugin.GitHubApp.csproj" />
   </ItemGroup>
 
   <!-- GOST Crypto Plugins (Russia distribution) -->

src/Policy/StellaOps.Policy.Engine/ReachabilityFacts/ReachabilityCoreBridge.cs

@@ -0,0 +1,210 @@
+// <copyright file="ReachabilityCoreBridge.cs" company="StellaOps">
+// Copyright (c) StellaOps. Licensed under the AGPL-3.0-or-later.
+// </copyright>
+
+using StellaOps.Reachability.Core;
+
+namespace StellaOps.Policy.Engine.ReachabilityFacts;
+
+/// <summary>
+/// Bridge between Reachability.Core types and Policy.Engine types.
+/// Enables gradual migration from ReachabilityFact to HybridReachabilityResult.
+/// Sprint: SPRINT_20260109_009_005 Task: Integrate Reachability.Core
+/// </summary>
+public static class ReachabilityCoreBridge
+{
+    /// <summary>
+    /// Converts a <see cref="HybridReachabilityResult"/> to a <see cref="ReachabilityFact"/>.
+    /// Used to maintain backward compatibility with existing VEX emission.
+    /// </summary>
+    public static ReachabilityFact ToReachabilityFact(
+        HybridReachabilityResult result,
+        string tenantId,
+        string advisoryId)
+    {
+        ArgumentNullException.ThrowIfNull(result);
+        ArgumentException.ThrowIfNullOrEmpty(tenantId);
+        ArgumentException.ThrowIfNullOrEmpty(advisoryId);
+
+        var state = MapLatticeToState(result.LatticeState);
+        var method = DetermineMethod(result);
+
+        return new ReachabilityFact
+        {
+            Id = $"rf-{result.ContentDigest[7..23]}", // Use part of content digest as ID
+            TenantId = tenantId,
+            ComponentPurl = result.ArtifactDigest,
+            AdvisoryId = advisoryId,
+            State = state,
+            Confidence = (decimal)result.Confidence,
+            Score = ComputeScore(result),
+            HasRuntimeEvidence = result.RuntimeResult is not null,
+            Source = "StellaOps.Reachability.Core",
+            Method = method,
+            EvidenceRef = result.Evidence.Uris.Length > 0 ? result.Evidence.Uris[0] : null,
+            EvidenceHash = result.ContentDigest,
+            ComputedAt = result.ComputedAt,
+            ExpiresAt = result.ComputedAt.AddDays(7),
+            Metadata = BuildMetadata(result)
+        };
+    }
+
+    /// <summary>
+    /// Maps lattice state enum to string representation.
+    /// </summary>
+    public static string MapLatticeStateToString(LatticeState state)
+    {
+        return state switch
+        {
+            LatticeState.Unknown => "U",
+            LatticeState.StaticReachable => "SR",
+            LatticeState.StaticUnreachable => "SU",
+            LatticeState.RuntimeObserved => "RO",
+            LatticeState.RuntimeUnobserved => "RU",
+            LatticeState.ConfirmedReachable => "CR",
+            LatticeState.ConfirmedUnreachable => "CU",
+            LatticeState.Contested => "X",
+            _ => "U"
+        };
+    }
+
+    /// <summary>
+    /// Parses string lattice state to enum.
+    /// </summary>
+    public static LatticeState ParseLatticeState(string? state)
+    {
+        return state switch
+        {
+            "U" or null => LatticeState.Unknown,
+            "SR" => LatticeState.StaticReachable,
+            "SU" => LatticeState.StaticUnreachable,
+            "RO" => LatticeState.RuntimeObserved,
+            "RU" => LatticeState.RuntimeUnobserved,
+            "CR" => LatticeState.ConfirmedReachable,
+            "CU" => LatticeState.ConfirmedUnreachable,
+            "X" => LatticeState.Contested,
+            _ => LatticeState.Unknown
+        };
+    }
+
+    /// <summary>
+    /// Maps lattice state to triage bucket.
+    /// </summary>
+    public static string MapToBucket(LatticeState state)
+    {
+        return state switch
+        {
+            LatticeState.ConfirmedReachable or LatticeState.RuntimeObserved => "critical",
+            LatticeState.StaticReachable => "high",
+            LatticeState.Contested or LatticeState.Unknown => "medium",
+            LatticeState.RuntimeUnobserved => "low",
+            LatticeState.StaticUnreachable or LatticeState.ConfirmedUnreachable => "informational",
+            _ => "medium"
+        };
+    }
+
+    /// <summary>
+    /// Maps HybridReachabilityResult to VEX status.
+    /// </summary>
+    public static string MapToVexStatus(HybridReachabilityResult result)
+    {
+        return result.LatticeState switch
+        {
+            LatticeState.ConfirmedUnreachable or LatticeState.StaticUnreachable => "not_affected",
+            LatticeState.RuntimeUnobserved when result.Confidence >= 0.7 => "not_affected",
+            LatticeState.ConfirmedReachable or LatticeState.RuntimeObserved => "affected",
+            LatticeState.StaticReachable => "under_investigation",
+            _ => "under_investigation"
+        };
+    }
+
+    /// <summary>
+    /// Maps HybridReachabilityResult to VEX justification.
+    /// </summary>
+    public static string? MapToVexJustification(HybridReachabilityResult result)
+    {
+        return result.LatticeState switch
+        {
+            LatticeState.ConfirmedUnreachable or LatticeState.StaticUnreachable =>
+                "vulnerable_code_not_in_execute_path",
+            LatticeState.RuntimeUnobserved when result.Confidence >= 0.7 =>
+                "vulnerable_code_not_in_execute_path",
+            _ => null
+        };
+    }
+
+    private static ReachabilityState MapLatticeToState(LatticeState lattice)
+    {
+        return lattice switch
+        {
+            LatticeState.ConfirmedReachable or
+            LatticeState.RuntimeObserved or
+            LatticeState.StaticReachable => ReachabilityState.Reachable,
+
+            LatticeState.ConfirmedUnreachable or
+            LatticeState.StaticUnreachable or
+            LatticeState.RuntimeUnobserved => ReachabilityState.Unreachable,
+
+            LatticeState.Contested => ReachabilityState.UnderInvestigation,
+
+            _ => ReachabilityState.Unknown
+        };
+    }
+
+    private static AnalysisMethod DetermineMethod(HybridReachabilityResult result)
+    {
+        var hasStatic = result.StaticResult is not null;
+        var hasRuntime = result.RuntimeResult is not null;
+
+        return (hasStatic, hasRuntime) switch
+        {
+            (true, true) => AnalysisMethod.Hybrid,
+            (true, false) => AnalysisMethod.Static,
+            (false, true) => AnalysisMethod.Dynamic,
+            _ => AnalysisMethod.Static // Default to static when no analysis available
+        };
+    }
+
+    private static decimal ComputeScore(HybridReachabilityResult result)
+    {
+        // Score based on lattice state - higher means more reachable
+        return result.LatticeState switch
+        {
+            LatticeState.ConfirmedReachable => 1.0m,
+            LatticeState.RuntimeObserved => 0.9m,
+            LatticeState.StaticReachable => 0.7m,
+            LatticeState.Contested => 0.5m,
+            LatticeState.Unknown => 0.5m,
+            LatticeState.RuntimeUnobserved => 0.3m,
+            LatticeState.StaticUnreachable => 0.1m,
+            LatticeState.ConfirmedUnreachable => 0.0m,
+            _ => 0.5m
+        };
+    }
+
+    private static Dictionary<string, object?> BuildMetadata(HybridReachabilityResult result)
+    {
+        var metadata = new Dictionary<string, object?>
+        {
+            ["lattice_state"] = MapLatticeStateToString(result.LatticeState),
+            ["symbol_canonical_id"] = result.Symbol.CanonicalId,
+            ["symbol_purl"] = result.Symbol.Purl,
+            ["symbol_type"] = result.Symbol.Type,
+            ["symbol_method"] = result.Symbol.Method
+        };
+
+        if (result.StaticResult is not null)
+        {
+            metadata["static_reachable"] = result.StaticResult.IsReachable;
+            metadata["static_path_count"] = result.StaticResult.PathCount;
+        }
+
+        if (result.RuntimeResult is not null)
+        {
+            metadata["runtime_observed"] = result.RuntimeResult.WasObserved;
+            metadata["runtime_hit_count"] = result.RuntimeResult.HitCount;
+        }
+
+        return metadata;
+    }
+}

src/Policy/StellaOps.Policy.Engine/StellaOps.Policy.Engine.csproj

@@ -26,6 +26,7 @@
     <ProjectReference Include="../../__Libraries/StellaOps.Canonical.Json/StellaOps.Canonical.Json.csproj" />
     <ProjectReference Include="../../Router/__Libraries/StellaOps.Messaging/StellaOps.Messaging.csproj" />
     <ProjectReference Include="../../__Libraries/StellaOps.Provcache/StellaOps.Provcache.csproj" />
+    <ProjectReference Include="../../__Libraries/StellaOps.Reachability.Core/StellaOps.Reachability.Core.csproj" />
     <ProjectReference Include="../__Libraries/StellaOps.Policy/StellaOps.Policy.csproj" />
     <ProjectReference Include="../__Libraries/StellaOps.Policy.Determinization/StellaOps.Policy.Determinization.csproj" />
     <ProjectReference Include="../__Libraries/StellaOps.Policy.Exceptions/StellaOps.Policy.Exceptions.csproj" />

src/Policy/__Tests/StellaOps.Policy.Engine.Tests/ReachabilityFacts/ReachabilityCoreBridgeTests.cs

@@ -0,0 +1,314 @@
+// <copyright file="ReachabilityCoreBridgeTests.cs" company="StellaOps">
+// Copyright (c) StellaOps. Licensed under the AGPL-3.0-or-later.
+// </copyright>
+
+using System.Collections.Immutable;
+using FluentAssertions;
+using StellaOps.Policy.Engine.ReachabilityFacts;
+using StellaOps.Reachability.Core;
+using Xunit;
+
+namespace StellaOps.Policy.Engine.Tests.ReachabilityFacts;
+
+/// <summary>
+/// Tests for <see cref="ReachabilityCoreBridge"/>.
+/// </summary>
+[Trait("Category", "Unit")]
+public class ReachabilityCoreBridgeTests
+{
+    private readonly DateTimeOffset _now = new(2026, 1, 9, 12, 0, 0, TimeSpan.Zero);
+
+    [Fact]
+    public void ToReachabilityFact_MapsConfirmedReachableToReachable()
+    {
+        // Arrange
+        var result = CreateHybridResult(LatticeState.ConfirmedReachable, 0.95);
+
+        // Act
+        var fact = ReachabilityCoreBridge.ToReachabilityFact(result, "tenant1", "CVE-2024-1234");
+
+        // Assert
+        fact.State.Should().Be(ReachabilityState.Reachable);
+        fact.Confidence.Should().Be(0.95m);
+        fact.Score.Should().Be(1.0m);
+        fact.TenantId.Should().Be("tenant1");
+        fact.AdvisoryId.Should().Be("CVE-2024-1234");
+    }
+
+    [Fact]
+    public void ToReachabilityFact_MapsStaticUnreachableToUnreachable()
+    {
+        // Arrange
+        var result = CreateHybridResult(LatticeState.StaticUnreachable, 0.8);
+
+        // Act
+        var fact = ReachabilityCoreBridge.ToReachabilityFact(result, "tenant1", "CVE-2024-5678");
+
+        // Assert
+        fact.State.Should().Be(ReachabilityState.Unreachable);
+        fact.Score.Should().Be(0.1m);
+    }
+
+    [Fact]
+    public void ToReachabilityFact_MapsContestedToUnderInvestigation()
+    {
+        // Arrange
+        var result = CreateHybridResult(LatticeState.Contested, 0.5);
+
+        // Act
+        var fact = ReachabilityCoreBridge.ToReachabilityFact(result, "tenant1", "CVE-2024-9999");
+
+        // Assert
+        fact.State.Should().Be(ReachabilityState.UnderInvestigation);
+        fact.Score.Should().Be(0.5m);
+    }
+
+    [Theory]
+    [InlineData(LatticeState.ConfirmedReachable, "critical")]
+    [InlineData(LatticeState.RuntimeObserved, "critical")]
+    [InlineData(LatticeState.StaticReachable, "high")]
+    [InlineData(LatticeState.Contested, "medium")]
+    [InlineData(LatticeState.Unknown, "medium")]
+    [InlineData(LatticeState.RuntimeUnobserved, "low")]
+    [InlineData(LatticeState.StaticUnreachable, "informational")]
+    [InlineData(LatticeState.ConfirmedUnreachable, "informational")]
+    public void MapToBucket_ReturnsCorrectBucket(LatticeState state, string expectedBucket)
+    {
+        // Act
+        var bucket = ReachabilityCoreBridge.MapToBucket(state);
+
+        // Assert
+        bucket.Should().Be(expectedBucket);
+    }
+
+    [Theory]
+    [InlineData(LatticeState.Unknown, "U")]
+    [InlineData(LatticeState.StaticReachable, "SR")]
+    [InlineData(LatticeState.StaticUnreachable, "SU")]
+    [InlineData(LatticeState.RuntimeObserved, "RO")]
+    [InlineData(LatticeState.RuntimeUnobserved, "RU")]
+    [InlineData(LatticeState.ConfirmedReachable, "CR")]
+    [InlineData(LatticeState.ConfirmedUnreachable, "CU")]
+    [InlineData(LatticeState.Contested, "X")]
+    public void MapLatticeStateToString_ReturnsCorrectCode(LatticeState state, string expectedCode)
+    {
+        // Act
+        var code = ReachabilityCoreBridge.MapLatticeStateToString(state);
+
+        // Assert
+        code.Should().Be(expectedCode);
+    }
+
+    [Theory]
+    [InlineData("U", LatticeState.Unknown)]
+    [InlineData("SR", LatticeState.StaticReachable)]
+    [InlineData("SU", LatticeState.StaticUnreachable)]
+    [InlineData("RO", LatticeState.RuntimeObserved)]
+    [InlineData("RU", LatticeState.RuntimeUnobserved)]
+    [InlineData("CR", LatticeState.ConfirmedReachable)]
+    [InlineData("CU", LatticeState.ConfirmedUnreachable)]
+    [InlineData("X", LatticeState.Contested)]
+    [InlineData(null, LatticeState.Unknown)]
+    [InlineData("invalid", LatticeState.Unknown)]
+    public void ParseLatticeState_ReturnsCorrectState(string? code, LatticeState expectedState)
+    {
+        // Act
+        var state = ReachabilityCoreBridge.ParseLatticeState(code);
+
+        // Assert
+        state.Should().Be(expectedState);
+    }
+
+    [Fact]
+    public void ToReachabilityFact_WithStaticResult_SetsMethodToStatic()
+    {
+        // Arrange
+        var result = CreateHybridResult(LatticeState.StaticReachable, 0.75);
+        result = result with
+        {
+            StaticResult = new StaticReachabilityResult
+            {
+                Symbol = result.Symbol,
+                ArtifactDigest = result.ArtifactDigest,
+                IsReachable = true,
+                AnalyzedAt = _now
+            }
+        };
+
+        // Act
+        var fact = ReachabilityCoreBridge.ToReachabilityFact(result, "tenant1", "CVE-TEST");
+
+        // Assert
+        fact.Method.Should().Be(AnalysisMethod.Static);
+        fact.HasRuntimeEvidence.Should().BeFalse();
+    }
+
+    [Fact]
+    public void ToReachabilityFact_WithRuntimeResult_SetsMethodToDynamic()
+    {
+        // Arrange
+        var result = CreateHybridResult(LatticeState.RuntimeObserved, 0.9);
+        result = result with
+        {
+            RuntimeResult = new RuntimeReachabilityResult
+            {
+                Symbol = result.Symbol,
+                ArtifactDigest = result.ArtifactDigest,
+                WasObserved = true,
+                ObservationWindow = TimeSpan.FromDays(7),
+                WindowStart = _now.AddDays(-7),
+                WindowEnd = _now
+            }
+        };
+
+        // Act
+        var fact = ReachabilityCoreBridge.ToReachabilityFact(result, "tenant1", "CVE-TEST");
+
+        // Assert
+        fact.Method.Should().Be(AnalysisMethod.Dynamic);
+        fact.HasRuntimeEvidence.Should().BeTrue();
+    }
+
+    [Fact]
+    public void ToReachabilityFact_WithBothResults_SetsMethodToHybrid()
+    {
+        // Arrange
+        var result = CreateHybridResult(LatticeState.ConfirmedReachable, 0.95);
+        result = result with
+        {
+            StaticResult = new StaticReachabilityResult
+            {
+                Symbol = result.Symbol,
+                ArtifactDigest = result.ArtifactDigest,
+                IsReachable = true,
+                AnalyzedAt = _now
+            },
+            RuntimeResult = new RuntimeReachabilityResult
+            {
+                Symbol = result.Symbol,
+                ArtifactDigest = result.ArtifactDigest,
+                WasObserved = true,
+                ObservationWindow = TimeSpan.FromDays(7),
+                WindowStart = _now.AddDays(-7),
+                WindowEnd = _now
+            }
+        };
+
+        // Act
+        var fact = ReachabilityCoreBridge.ToReachabilityFact(result, "tenant1", "CVE-TEST");
+
+        // Assert
+        fact.Method.Should().Be(AnalysisMethod.Hybrid);
+        fact.HasRuntimeEvidence.Should().BeTrue();
+    }
+
+    [Theory]
+    [InlineData(LatticeState.ConfirmedUnreachable, "not_affected")]
+    [InlineData(LatticeState.StaticUnreachable, "not_affected")]
+    [InlineData(LatticeState.ConfirmedReachable, "affected")]
+    [InlineData(LatticeState.RuntimeObserved, "affected")]
+    [InlineData(LatticeState.StaticReachable, "under_investigation")]
+    [InlineData(LatticeState.Contested, "under_investigation")]
+    public void MapToVexStatus_ReturnsCorrectStatus(LatticeState state, string expectedStatus)
+    {
+        // Arrange
+        var result = CreateHybridResult(state, 0.8);
+
+        // Act
+        var status = ReachabilityCoreBridge.MapToVexStatus(result);
+
+        // Assert
+        status.Should().Be(expectedStatus);
+    }
+
+    [Fact]
+    public void MapToVexJustification_WhenUnreachable_ReturnsJustification()
+    {
+        // Arrange
+        var result = CreateHybridResult(LatticeState.ConfirmedUnreachable, 0.9);
+
+        // Act
+        var justification = ReachabilityCoreBridge.MapToVexJustification(result);
+
+        // Assert
+        justification.Should().Be("vulnerable_code_not_in_execute_path");
+    }
+
+    [Fact]
+    public void MapToVexJustification_WhenReachable_ReturnsNull()
+    {
+        // Arrange
+        var result = CreateHybridResult(LatticeState.ConfirmedReachable, 0.9);
+
+        // Act
+        var justification = ReachabilityCoreBridge.MapToVexJustification(result);
+
+        // Assert
+        justification.Should().BeNull();
+    }
+
+    [Fact]
+    public void ToReachabilityFact_IncludesMetadata()
+    {
+        // Arrange
+        var result = CreateHybridResult(LatticeState.StaticReachable, 0.75);
+
+        // Act
+        var fact = ReachabilityCoreBridge.ToReachabilityFact(result, "tenant1", "CVE-TEST");
+
+        // Assert
+        fact.Metadata.Should().NotBeNull();
+        fact.Metadata!["lattice_state"].Should().Be("SR");
+        fact.Metadata!["symbol_canonical_id"].Should().Be(result.Symbol.CanonicalId);
+    }
+
+    [Fact]
+    public void ToReachabilityFact_NullResultThrows()
+    {
+        // Act
+        var act = () => ReachabilityCoreBridge.ToReachabilityFact(null!, "tenant1", "CVE-TEST");
+
+        // Assert
+        act.Should().Throw<ArgumentNullException>();
+    }
+
+    [Fact]
+    public void ToReachabilityFact_EmptyTenantIdThrows()
+    {
+        // Arrange
+        var result = CreateHybridResult(LatticeState.Unknown, 0.5);
+
+        // Act
+        var act = () => ReachabilityCoreBridge.ToReachabilityFact(result, "", "CVE-TEST");
+
+        // Assert
+        act.Should().Throw<ArgumentException>();
+    }
+
+    private HybridReachabilityResult CreateHybridResult(LatticeState state, double confidence)
+    {
+        var symbol = new SymbolRef
+        {
+            Purl = "pkg:npm/lodash@4.17.21",
+            Namespace = "lodash",
+            Type = "_",
+            Method = "template",
+            Signature = "(string)"
+        };
+
+        return new HybridReachabilityResult
+        {
+            Symbol = symbol,
+            ArtifactDigest = "sha256:abc123",
+            LatticeState = state,
+            Confidence = confidence,
+            Verdict = VerdictRecommendation.UnderInvestigation(),
+            Evidence = new EvidenceBundle
+            {
+                Uris = ["stellaops://evidence/test"],
+                CollectedAt = _now
+            },
+            ComputedAt = _now
+        };
+    }
+}

src/Scanner/StellaOps.Scanner.WebService/Endpoints/GitHubCodeScanningEndpoints.cs

@@ -0,0 +1,371 @@
+// <copyright file="GitHubCodeScanningEndpoints.cs" company="StellaOps">
+// Copyright (c) StellaOps. Licensed under the AGPL-3.0-or-later.
+// </copyright>
+
+using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.Routing;
+using StellaOps.Scanner.WebService.Constants;
+using StellaOps.Scanner.WebService.Domain;
+using StellaOps.Scanner.WebService.Infrastructure;
+using StellaOps.Scanner.WebService.Security;
+using StellaOps.Scanner.WebService.Services;
+
+namespace StellaOps.Scanner.WebService.Endpoints;
+
+/// <summary>
+/// API endpoints for GitHub Code Scanning integration.
+/// Sprint: SPRINT_20260109_010_002 Task: API endpoints
+/// </summary>
+internal static class GitHubCodeScanningEndpoints
+{
+    public static void MapGitHubCodeScanningEndpoints(this RouteGroupBuilder scansGroup)
+    {
+        ArgumentNullException.ThrowIfNull(scansGroup);
+
+        var github = scansGroup.MapGroup("/github")
+            .WithTags("GitHub", "Code Scanning");
+
+        // POST /scans/{scanId}/github/upload-sarif
+        // Upload scan results as SARIF to GitHub Code Scanning
+        github.MapPost("/{scanId}/github/upload-sarif", HandleUploadSarifAsync)
+            .WithName("scanner.scans.github.upload-sarif")
+            .Produces<SarifUploadResponse>(StatusCodes.Status202Accepted)
+            .Produces(StatusCodes.Status404NotFound)
+            .Produces(StatusCodes.Status400BadRequest)
+            .RequireAuthorization(ScannerPolicies.ScansWrite);
+
+        // GET /scans/{scanId}/github/upload-status/{sarifId}
+        // Check the processing status of a SARIF upload
+        github.MapGet("/{scanId}/github/upload-status/{sarifId}", HandleGetUploadStatusAsync)
+            .WithName("scanner.scans.github.upload-status")
+            .Produces<SarifUploadStatusResponse>(StatusCodes.Status200OK)
+            .Produces(StatusCodes.Status404NotFound)
+            .RequireAuthorization(ScannerPolicies.ScansRead);
+
+        // GET /scans/{scanId}/github/alerts
+        // List Code Scanning alerts for the repository
+        github.MapGet("/{scanId}/github/alerts", HandleListAlertsAsync)
+            .WithName("scanner.scans.github.alerts.list")
+            .Produces<AlertsListResponse>(StatusCodes.Status200OK)
+            .Produces(StatusCodes.Status404NotFound)
+            .RequireAuthorization(ScannerPolicies.ScansRead);
+
+        // GET /scans/{scanId}/github/alerts/{alertNumber}
+        // Get a specific Code Scanning alert
+        github.MapGet("/{scanId}/github/alerts/{alertNumber:int}", HandleGetAlertAsync)
+            .WithName("scanner.scans.github.alerts.get")
+            .Produces<AlertResponse>(StatusCodes.Status200OK)
+            .Produces(StatusCodes.Status404NotFound)
+            .RequireAuthorization(ScannerPolicies.ScansRead);
+    }
+
+    private static async Task<IResult> HandleUploadSarifAsync(
+        string scanId,
+        SarifUploadRequest request,
+        IScanCoordinator coordinator,
+        ISarifExportService sarifExport,
+        IGitHubCodeScanningService gitHubService,
+        HttpContext context,
+        CancellationToken cancellationToken)
+    {
+        if (!ScanId.TryParse(scanId, out var parsed))
+        {
+            return ProblemResultFactory.Create(
+                context,
+                ProblemTypes.Validation,
+                "Invalid scan identifier",
+                StatusCodes.Status400BadRequest);
+        }
+
+        var snapshot = await coordinator.GetAsync(parsed, cancellationToken).ConfigureAwait(false);
+        if (snapshot is null)
+        {
+            return ProblemResultFactory.Create(
+                context,
+                ProblemTypes.NotFound,
+                "Scan not found",
+                StatusCodes.Status404NotFound);
+        }
+
+        if (string.IsNullOrEmpty(request.Owner) || string.IsNullOrEmpty(request.Repo))
+        {
+            return ProblemResultFactory.Create(
+                context,
+                ProblemTypes.Validation,
+                "Owner and repo are required",
+                StatusCodes.Status400BadRequest);
+        }
+
+        // Export SARIF
+        var sarifDoc = await sarifExport.ExportAsync(parsed, cancellationToken).ConfigureAwait(false);
+        if (sarifDoc is null)
+        {
+            return ProblemResultFactory.Create(
+                context,
+                ProblemTypes.NotFound,
+                "No findings to export",
+                StatusCodes.Status404NotFound);
+        }
+
+        // Upload to GitHub
+        var result = await gitHubService.UploadSarifAsync(
+            request.Owner,
+            request.Repo,
+            sarifDoc,
+            request.CommitSha,
+            request.Ref ?? "refs/heads/main",
+            cancellationToken).ConfigureAwait(false);
+
+        return Results.Accepted(
+            value: new SarifUploadResponse
+            {
+                SarifId = result.SarifId,
+                Url = result.Url,
+                StatusUrl = $"/scans/{scanId}/github/upload-status/{result.SarifId}"
+            });
+    }
+
+    private static async Task<IResult> HandleGetUploadStatusAsync(
+        string scanId,
+        string sarifId,
+        IGitHubCodeScanningService gitHubService,
+        HttpContext context,
+        CancellationToken cancellationToken)
+    {
+        if (!ScanId.TryParse(scanId, out _))
+        {
+            return ProblemResultFactory.Create(
+                context,
+                ProblemTypes.Validation,
+                "Invalid scan identifier",
+                StatusCodes.Status400BadRequest);
+        }
+
+        var status = await gitHubService.GetUploadStatusAsync(sarifId, cancellationToken)
+            .ConfigureAwait(false);
+
+        if (status is null)
+        {
+            return ProblemResultFactory.Create(
+                context,
+                ProblemTypes.NotFound,
+                "SARIF upload not found",
+                StatusCodes.Status404NotFound);
+        }
+
+        return Results.Ok(new SarifUploadStatusResponse
+        {
+            SarifId = sarifId,
+            ProcessingStatus = status.ProcessingStatus,
+            AnalysesUrl = status.AnalysesUrl,
+            Errors = status.Errors
+        });
+    }
+
+    private static async Task<IResult> HandleListAlertsAsync(
+        string scanId,
+        IGitHubCodeScanningService gitHubService,
+        HttpContext context,
+        string? state,
+        string? severity,
+        string? sort,
+        string? direction,
+        int? page,
+        int? perPage,
+        CancellationToken cancellationToken)
+    {
+        if (!ScanId.TryParse(scanId, out _))
+        {
+            return ProblemResultFactory.Create(
+                context,
+                ProblemTypes.Validation,
+                "Invalid scan identifier",
+                StatusCodes.Status400BadRequest);
+        }
+
+        var alerts = await gitHubService.ListAlertsAsync(
+            state,
+            severity,
+            sort,
+            direction,
+            page ?? 1,
+            perPage ?? 30,
+            cancellationToken).ConfigureAwait(false);
+
+        return Results.Ok(new AlertsListResponse
+        {
+            Count = alerts.Count,
+            Alerts = alerts
+        });
+    }
+
+    private static async Task<IResult> HandleGetAlertAsync(
+        string scanId,
+        int alertNumber,
+        IGitHubCodeScanningService gitHubService,
+        HttpContext context,
+        CancellationToken cancellationToken)
+    {
+        if (!ScanId.TryParse(scanId, out _))
+        {
+            return ProblemResultFactory.Create(
+                context,
+                ProblemTypes.Validation,
+                "Invalid scan identifier",
+                StatusCodes.Status400BadRequest);
+        }
+
+        var alert = await gitHubService.GetAlertAsync(alertNumber, cancellationToken)
+            .ConfigureAwait(false);
+
+        if (alert is null)
+        {
+            return ProblemResultFactory.Create(
+                context,
+                ProblemTypes.NotFound,
+                "Alert not found",
+                StatusCodes.Status404NotFound);
+        }
+
+        return Results.Ok(new AlertResponse { Alert = alert });
+    }
+}
+
+#region Request/Response Models
+
+/// <summary>
+/// Request to upload SARIF to GitHub.
+/// </summary>
+public sealed record SarifUploadRequest
+{
+    /// <summary>Repository owner.</summary>
+    public required string Owner { get; init; }
+
+    /// <summary>Repository name.</summary>
+    public required string Repo { get; init; }
+
+    /// <summary>Commit SHA (optional, uses scan's commit if not provided).</summary>
+    public string? CommitSha { get; init; }
+
+    /// <summary>Git ref (optional, uses scan's ref or defaults to main).</summary>
+    public string? Ref { get; init; }
+}
+
+/// <summary>
+/// Response from SARIF upload.
+/// </summary>
+public sealed record SarifUploadResponse
+{
+    /// <summary>The SARIF ID for tracking.</summary>
+    public required string SarifId { get; init; }
+
+    /// <summary>URL to the upload on GitHub.</summary>
+    public string? Url { get; init; }
+
+    /// <summary>URL to check upload status.</summary>
+    public string? StatusUrl { get; init; }
+}
+
+/// <summary>
+/// Response for upload status check.
+/// </summary>
+public sealed record SarifUploadStatusResponse
+{
+    /// <summary>The SARIF ID.</summary>
+    public required string SarifId { get; init; }
+
+    /// <summary>Processing status (pending, complete, failed).</summary>
+    public required string ProcessingStatus { get; init; }
+
+    /// <summary>URL to view analyses.</summary>
+    public string? AnalysesUrl { get; init; }
+
+    /// <summary>Any processing errors.</summary>
+    public IReadOnlyList<string>? Errors { get; init; }
+}
+
+/// <summary>
+/// Response for alerts list.
+/// </summary>
+public sealed record AlertsListResponse
+{
+    /// <summary>Number of alerts returned.</summary>
+    public int Count { get; init; }
+
+    /// <summary>The alerts.</summary>
+    public required IReadOnlyList<object> Alerts { get; init; }
+}
+
+/// <summary>
+/// Response for single alert.
+/// </summary>
+public sealed record AlertResponse
+{
+    /// <summary>The alert details.</summary>
+    public required object Alert { get; init; }
+}
+
+#endregion
+
+#region Service Interface
+
+/// <summary>
+/// Service interface for GitHub Code Scanning operations.
+/// Sprint: SPRINT_20260109_010_002 Task: API endpoints
+/// </summary>
+public interface IGitHubCodeScanningService
+{
+    /// <summary>Upload SARIF to GitHub.</summary>
+    Task<GitHubUploadResult> UploadSarifAsync(
+        string owner,
+        string repo,
+        object sarifDocument,
+        string? commitSha,
+        string gitRef,
+        CancellationToken ct);
+
+    /// <summary>Get upload status.</summary>
+    Task<GitHubUploadStatus?> GetUploadStatusAsync(string sarifId, CancellationToken ct);
+
+    /// <summary>List alerts.</summary>
+    Task<IReadOnlyList<object>> ListAlertsAsync(
+        string? state,
+        string? severity,
+        string? sort,
+        string? direction,
+        int page,
+        int perPage,
+        CancellationToken ct);
+
+    /// <summary>Get a single alert.</summary>
+    Task<object?> GetAlertAsync(int alertNumber, CancellationToken ct);
+}
+
+/// <summary>
+/// Result of uploading SARIF to GitHub.
+/// </summary>
+public sealed record GitHubUploadResult
+{
+    /// <summary>The SARIF ID.</summary>
+    public required string SarifId { get; init; }
+
+    /// <summary>URL to the upload.</summary>
+    public string? Url { get; init; }
+}
+
+/// <summary>
+/// Status of a SARIF upload.
+/// </summary>
+public sealed record GitHubUploadStatus
+{
+    /// <summary>Processing status.</summary>
+    public required string ProcessingStatus { get; init; }
+
+    /// <summary>URL to analyses.</summary>
+    public string? AnalysesUrl { get; init; }
+
+    /// <summary>Processing errors.</summary>
+    public IReadOnlyList<string>? Errors { get; init; }
+}
+
+#endregion

src/Scanner/StellaOps.Scanner.WebService/Endpoints/ScanEndpoints.cs

@@ -90,6 +90,7 @@ internal static class ScanEndpoints
         scans.MapApprovalEndpoints();
         scans.MapManifestEndpoints();
         scans.MapLayerSbomEndpoints(); // Sprint: SPRINT_20260106_003_001
+        scans.MapGitHubCodeScanningEndpoints(); // Sprint: SPRINT_20260109_010_002
     }
 
     private static async Task<IResult> HandleSubmitAsync(

src/Scanner/StellaOps.Scanner.WebService/Program.cs

@@ -130,9 +130,19 @@ builder.Services.AddSingleton<IScanCoordinator, InMemoryScanCoordinator>();
 builder.Services.AddSingleton<IReachabilityComputeService, NullReachabilityComputeService>();
 builder.Services.AddSingleton<IReachabilityQueryService, NullReachabilityQueryService>();
 builder.Services.AddSingleton<IReachabilityExplainService, NullReachabilityExplainService>();
-builder.Services.AddSingleton<ISarifExportService, NullSarifExportService>();
+
+// SARIF export services (Sprint: SPRINT_20260109_010_001)
+builder.Services.AddSingleton<StellaOps.Scanner.Sarif.Rules.ISarifRuleRegistry, StellaOps.Scanner.Sarif.Rules.SarifRuleRegistry>();
+builder.Services.AddSingleton<StellaOps.Scanner.Sarif.Fingerprints.IFingerprintGenerator, StellaOps.Scanner.Sarif.Fingerprints.FingerprintGenerator>();
+builder.Services.AddSingleton<StellaOps.Scanner.Sarif.ISarifExportService, StellaOps.Scanner.Sarif.SarifExportService>();
+builder.Services.AddSingleton<ISarifExportService, ScanFindingsSarifExportService>();
+
 builder.Services.AddSingleton<ICycloneDxExportService, NullCycloneDxExportService>();
 builder.Services.AddSingleton<IOpenVexExportService, NullOpenVexExportService>();
+
+// GitHub Code Scanning integration (Sprint: SPRINT_20260109_010_002)
+builder.Services.AddSingleton<IGitHubCodeScanningService, NullGitHubCodeScanningService>();
+
 builder.Services.AddSingleton<IEvidenceCompositionService, EvidenceCompositionService>();
 builder.Services.AddSingleton<IPolicyDecisionAttestationService, PolicyDecisionAttestationService>();
 builder.Services.AddSingleton<IRichGraphAttestationService, RichGraphAttestationService>();

src/Scanner/StellaOps.Scanner.WebService/Services/NullGitHubCodeScanningService.cs

@@ -0,0 +1,63 @@
+// <copyright file="NullGitHubCodeScanningService.cs" company="StellaOps">
+// Copyright (c) StellaOps. Licensed under the AGPL-3.0-or-later.
+// </copyright>
+
+using StellaOps.Scanner.WebService.Endpoints;
+
+namespace StellaOps.Scanner.WebService.Services;
+
+/// <summary>
+/// Null implementation of IGitHubCodeScanningService.
+/// Returns empty results and logged warnings for unconfigured GitHub integration.
+/// Sprint: SPRINT_20260109_010_002 Task: API endpoints
+/// </summary>
+internal sealed class NullGitHubCodeScanningService : IGitHubCodeScanningService
+{
+    public Task<GitHubUploadResult> UploadSarifAsync(
+        string owner,
+        string repo,
+        object sarifDocument,
+        string? commitSha,
+        string gitRef,
+        CancellationToken ct)
+    {
+        // Return a mock result for development/testing
+        return Task.FromResult(new GitHubUploadResult
+        {
+            SarifId = $"mock-sarif-{Guid.NewGuid():N}",
+            Url = null
+        });
+    }
+
+    public Task<GitHubUploadStatus?> GetUploadStatusAsync(string sarifId, CancellationToken ct)
+    {
+        if (!sarifId.StartsWith("mock-sarif-", StringComparison.Ordinal))
+        {
+            return Task.FromResult<GitHubUploadStatus?>(null);
+        }
+
+        return Task.FromResult<GitHubUploadStatus?>(new GitHubUploadStatus
+        {
+            ProcessingStatus = "complete",
+            AnalysesUrl = null,
+            Errors = null
+        });
+    }
+
+    public Task<IReadOnlyList<object>> ListAlertsAsync(
+        string? state,
+        string? severity,
+        string? sort,
+        string? direction,
+        int page,
+        int perPage,
+        CancellationToken ct)
+    {
+        return Task.FromResult<IReadOnlyList<object>>(Array.Empty<object>());
+    }
+
+    public Task<object?> GetAlertAsync(int alertNumber, CancellationToken ct)
+    {
+        return Task.FromResult<object?>(null);
+    }
+}

src/Scanner/StellaOps.Scanner.WebService/Services/ScanFindingsSarifExportService.cs

@@ -0,0 +1,187 @@
+// <copyright file="ScanFindingsSarifExportService.cs" company="StellaOps">
+// Copyright (c) StellaOps. Licensed under the AGPL-3.0-or-later.
+// </copyright>
+
+using System.Collections.Immutable;
+using System.Text.Json;
+using Microsoft.Extensions.Logging;
+using StellaOps.Scanner.Sarif;
+using StellaOps.Scanner.Sarif.Models;
+using StellaOps.Scanner.WebService.Domain;
+
+namespace StellaOps.Scanner.WebService.Services;
+
+/// <summary>
+/// SARIF export service that bridges WebService findings to the Scanner.Sarif library.
+/// Sprint: SPRINT_20260109_010_001 Task: Implement API endpoint
+/// </summary>
+public sealed class ScanFindingsSarifExportService : ISarifExportService
+{
+    private readonly IReachabilityQueryService _reachabilityService;
+    private readonly Sarif.ISarifExportService _sarifExporter;
+    private readonly ILogger<ScanFindingsSarifExportService> _logger;
+
+    public ScanFindingsSarifExportService(
+        IReachabilityQueryService reachabilityService,
+        Sarif.ISarifExportService sarifExporter,
+        ILogger<ScanFindingsSarifExportService> logger)
+    {
+        _reachabilityService = reachabilityService;
+        _sarifExporter = sarifExporter;
+        _logger = logger;
+    }
+
+    /// <inheritdoc/>
+    public async Task<object?> ExportAsync(ScanId scanId, CancellationToken cancellationToken = default)
+    {
+        _logger.LogDebug("Exporting findings as SARIF for scan {ScanId}", scanId);
+
+        // Get all findings for the scan
+        var findings = await _reachabilityService.GetFindingsAsync(
+            scanId,
+            cveFilter: null,
+            statusFilter: null,
+            cancellationToken).ConfigureAwait(false);
+
+        if (findings is null || findings.Count == 0)
+        {
+            _logger.LogDebug("No findings to export for scan {ScanId}", scanId);
+            return null;
+        }
+
+        // Convert to FindingInput
+        var inputs = MapToFindingInputs(findings, scanId);
+
+        // Export via the Sarif library
+        var options = new SarifExportOptions
+        {
+            ToolName = "StellaOps Scanner",
+            ToolVersion = GetToolVersion(),
+            IncludeEvidenceUris = true,
+            IncludeReachability = true,
+            IncludeVexStatus = true,
+            FingerprintStrategy = FingerprintStrategy.Standard
+        };
+
+        var sarifLog = await _sarifExporter.ExportAsync(inputs, options, cancellationToken)
+            .ConfigureAwait(false);
+
+        _logger.LogInformation(
+            "Exported {Count} findings as SARIF for scan {ScanId}",
+            findings.Count,
+            scanId);
+
+        return sarifLog;
+    }
+
+    private static IEnumerable<FindingInput> MapToFindingInputs(
+        IReadOnlyList<ReachabilityFinding> findings,
+        ScanId scanId)
+    {
+        foreach (var finding in findings)
+        {
+            yield return new FindingInput
+            {
+                Type = FindingType.Vulnerability,
+                VulnerabilityId = finding.CveId,
+                ComponentPurl = finding.Purl,
+                ComponentName = ExtractComponentName(finding.Purl),
+                ComponentVersion = ExtractComponentVersion(finding.Purl),
+                Severity = ParseSeverity(finding.Severity),
+                Title = $"Vulnerability {finding.CveId} in {finding.Purl}",
+                Description = finding.AffectedVersions is not null
+                    ? $"Affected versions: {finding.AffectedVersions}"
+                    : null,
+                Reachability = ParseReachabilityStatus(finding.Status),
+                EvidenceUris = BuildEvidenceUris(finding, scanId),
+                Properties = new Dictionary<string, object>
+                {
+                    ["latticeState"] = finding.LatticeState ?? "unknown",
+                    ["confidence"] = finding.Confidence
+                }
+            };
+        }
+    }
+
+    private static string? ExtractComponentName(string purl)
+    {
+        // pkg:npm/lodash@4.17.21 -> lodash
+        if (string.IsNullOrEmpty(purl)) return null;
+
+        var atIndex = purl.LastIndexOf('@');
+        var slashIndex = purl.LastIndexOf('/');
+
+        if (slashIndex < 0) return null;
+
+        var endIndex = atIndex > slashIndex ? atIndex : purl.Length;
+        return purl.Substring(slashIndex + 1, endIndex - slashIndex - 1);
+    }
+
+    private static string? ExtractComponentVersion(string purl)
+    {
+        // pkg:npm/lodash@4.17.21 -> 4.17.21
+        if (string.IsNullOrEmpty(purl)) return null;
+
+        var atIndex = purl.LastIndexOf('@');
+        if (atIndex < 0) return null;
+
+        return purl.Substring(atIndex + 1);
+    }
+
+    private static Severity ParseSeverity(string? severity)
+    {
+        if (string.IsNullOrEmpty(severity)) return Severity.Unknown;
+
+        return severity.ToUpperInvariant() switch
+        {
+            "CRITICAL" => Severity.Critical,
+            "HIGH" => Severity.High,
+            "MEDIUM" => Severity.Medium,
+            "LOW" => Severity.Low,
+            _ => Severity.Unknown
+        };
+    }
+
+    private static ReachabilityStatus ParseReachabilityStatus(string? status)
+    {
+        if (string.IsNullOrEmpty(status)) return ReachabilityStatus.Unknown;
+
+        return status.ToUpperInvariant() switch
+        {
+            "REACHABLE" or "STATIC_REACHABLE" => ReachabilityStatus.StaticReachable,
+            "UNREACHABLE" or "STATIC_UNREACHABLE" => ReachabilityStatus.StaticUnreachable,
+            "RUNTIME_REACHABLE" => ReachabilityStatus.RuntimeReachable,
+            "RUNTIME_UNREACHABLE" => ReachabilityStatus.RuntimeUnreachable,
+            "CONTESTED" or "POTENTIALLY_REACHABLE" or "INCONCLUSIVE" => ReachabilityStatus.Contested,
+            _ => ReachabilityStatus.Unknown
+        };
+    }
+
+    private static IReadOnlyList<string> BuildEvidenceUris(ReachabilityFinding finding, ScanId scanId)
+    {
+        var uris = new List<string>();
+
+        // Add standard evidence URIs
+        if (!string.IsNullOrEmpty(finding.CveId))
+        {
+            uris.Add($"stella://vuln/{finding.CveId}");
+        }
+
+        if (!string.IsNullOrEmpty(finding.Purl))
+        {
+            uris.Add($"stella://component/{Uri.EscapeDataString(finding.Purl)}");
+        }
+
+        uris.Add($"stella://scan/{scanId.Value}");
+
+        return uris;
+    }
+
+    private static string GetToolVersion()
+    {
+        // Get version from assembly
+        var assembly = typeof(ScanFindingsSarifExportService).Assembly;
+        var version = assembly.GetName().Version;
+        return version?.ToString(3) ?? "1.0.0";
+    }
+}

src/Scanner/StellaOps.Scanner.WebService/StellaOps.Scanner.WebService.csproj

@@ -53,6 +53,7 @@
     <ProjectReference Include="../__Libraries/StellaOps.Scanner.Orchestration/StellaOps.Scanner.Orchestration.csproj" />
     <ProjectReference Include="../__Libraries/StellaOps.Scanner.Sources/StellaOps.Scanner.Sources.csproj" />
     <ProjectReference Include="../__Libraries/StellaOps.Scanner.Emit/StellaOps.Scanner.Emit.csproj" />
+    <ProjectReference Include="../__Libraries/StellaOps.Scanner.Sarif/StellaOps.Scanner.Sarif.csproj" />
     <ProjectReference Include="../__Libraries/StellaOps.Scanner.Validation/StellaOps.Scanner.Validation.csproj" />
     <ProjectReference Include="../../Router/__Libraries/StellaOps.Router.AspNet/StellaOps.Router.AspNet.csproj" />
   </ItemGroup>

src/Scanner/__Libraries/StellaOps.Scanner.Sarif.Tests/SarifGoldenFixtureTests.cs

@@ -77,13 +77,13 @@ public class SarifGoldenFixtureTests
         run.Results.Should().HaveCount(1);
         var result = run.Results[0];
         result.RuleId.Should().StartWith("STELLA-");
-        result.Level.Should().Be(SarifLevel.Warning); // High severity maps to warning
+        result.Level.Should().Be(SarifLevel.Error); // High severity maps to error
         result.Message.Should().NotBeNull();
         result.Message.Text.Should().Contain("SQL Injection");
 
         // Location validation
         result.Locations.Should().NotBeNull();
-        result.Locations.Should().HaveCountGreaterThan(0);
+        result.Locations!.Value.Should().NotBeEmpty();
         var location = result.Locations!.Value[0];
         location.PhysicalLocation.Should().NotBeNull();
         location.PhysicalLocation!.ArtifactLocation.Should().NotBeNull();
@@ -93,7 +93,7 @@ public class SarifGoldenFixtureTests
 
         // Fingerprint validation
         result.PartialFingerprints.Should().NotBeNull();
-        result.PartialFingerprints.Should().ContainKey("primaryLocationLineHash");
+        result.PartialFingerprints.Should().ContainKey("primaryLocationLineHash/v1");
     }
 
     [Fact]
@@ -118,7 +118,7 @@ public class SarifGoldenFixtureTests
 
         var results = log.Runs[0].Results;
         results[0].Level.Should().Be(SarifLevel.Error); // Critical -> Error
-        results[1].Level.Should().Be(SarifLevel.Warning); // High -> Warning
+        results[1].Level.Should().Be(SarifLevel.Error); // High -> Error
         results[2].Level.Should().Be(SarifLevel.Warning); // Medium -> Warning
         results[3].Level.Should().Be(SarifLevel.Note); // Low -> Note
     }

src/Signals/StellaOps.Signals.RuntimeAgent/AgentRegistration.cs

@@ -0,0 +1,165 @@
+// <copyright file="AgentRegistration.cs" company="StellaOps">
+// Copyright (c) StellaOps. Licensed under the AGPL-3.0-or-later.
+// </copyright>
+
+using System.Collections.Immutable;
+
+namespace StellaOps.Signals.RuntimeAgent;
+
+/// <summary>
+/// Represents a registered runtime agent.
+/// Sprint: SPRINT_20260109_009_004 Task: Implement AgentRegistrationService
+/// </summary>
+public sealed record AgentRegistration
+{
+    /// <summary>Unique agent identifier.</summary>
+    public required string AgentId { get; init; }
+
+    /// <summary>Target platform.</summary>
+    public required RuntimePlatform Platform { get; init; }
+
+    /// <summary>Hostname where agent is running.</summary>
+    public required string Hostname { get; init; }
+
+    /// <summary>Container ID if running in container.</summary>
+    public string? ContainerId { get; init; }
+
+    /// <summary>Kubernetes namespace if running in K8s.</summary>
+    public string? KubernetesNamespace { get; init; }
+
+    /// <summary>Kubernetes pod name if running in K8s.</summary>
+    public string? KubernetesPodName { get; init; }
+
+    /// <summary>Target application name.</summary>
+    public string? ApplicationName { get; init; }
+
+    /// <summary>Target process ID.</summary>
+    public int? ProcessId { get; init; }
+
+    /// <summary>Agent version.</summary>
+    public required string AgentVersion { get; init; }
+
+    /// <summary>Registration timestamp.</summary>
+    public required DateTimeOffset RegisteredAt { get; init; }
+
+    /// <summary>Last heartbeat timestamp.</summary>
+    public DateTimeOffset LastHeartbeat { get; init; }
+
+    /// <summary>Current agent state.</summary>
+    public AgentState State { get; init; } = AgentState.Stopped;
+
+    /// <summary>Current posture.</summary>
+    public RuntimePosture Posture { get; init; } = RuntimePosture.Sampled;
+
+    /// <summary>Tags for grouping/filtering.</summary>
+    public ImmutableDictionary<string, string> Tags { get; init; } =
+        ImmutableDictionary<string, string>.Empty;
+
+    /// <summary>
+    /// Checks if the agent is considered healthy (recent heartbeat).
+    /// </summary>
+    public bool IsHealthy(DateTimeOffset now, TimeSpan heartbeatTimeout)
+    {
+        return now - LastHeartbeat < heartbeatTimeout;
+    }
+}
+
+/// <summary>
+/// Agent registration request.
+/// </summary>
+public sealed record AgentRegistrationRequest
+{
+    /// <summary>Unique agent identifier (generated by agent).</summary>
+    public required string AgentId { get; init; }
+
+    /// <summary>Target platform.</summary>
+    public required RuntimePlatform Platform { get; init; }
+
+    /// <summary>Hostname where agent is running.</summary>
+    public required string Hostname { get; init; }
+
+    /// <summary>Container ID if running in container.</summary>
+    public string? ContainerId { get; init; }
+
+    /// <summary>Kubernetes namespace if running in K8s.</summary>
+    public string? KubernetesNamespace { get; init; }
+
+    /// <summary>Kubernetes pod name if running in K8s.</summary>
+    public string? KubernetesPodName { get; init; }
+
+    /// <summary>Target application name.</summary>
+    public string? ApplicationName { get; init; }
+
+    /// <summary>Target process ID.</summary>
+    public int? ProcessId { get; init; }
+
+    /// <summary>Agent version.</summary>
+    public required string AgentVersion { get; init; }
+
+    /// <summary>Initial posture.</summary>
+    public RuntimePosture InitialPosture { get; init; } = RuntimePosture.Sampled;
+
+    /// <summary>Tags for grouping/filtering.</summary>
+    public ImmutableDictionary<string, string> Tags { get; init; } =
+        ImmutableDictionary<string, string>.Empty;
+}
+
+/// <summary>
+/// Agent heartbeat request.
+/// </summary>
+public sealed record AgentHeartbeatRequest
+{
+    /// <summary>Agent identifier.</summary>
+    public required string AgentId { get; init; }
+
+    /// <summary>Current agent state.</summary>
+    public required AgentState State { get; init; }
+
+    /// <summary>Current posture.</summary>
+    public required RuntimePosture Posture { get; init; }
+
+    /// <summary>Statistics snapshot.</summary>
+    public AgentStatistics? Statistics { get; init; }
+}
+
+/// <summary>
+/// Agent heartbeat response.
+/// </summary>
+public sealed record AgentHeartbeatResponse
+{
+    /// <summary>Whether the agent should continue.</summary>
+    public bool Continue { get; init; } = true;
+
+    /// <summary>New posture if changed.</summary>
+    public RuntimePosture? NewPosture { get; init; }
+
+    /// <summary>Command to execute.</summary>
+    public AgentCommand? Command { get; init; }
+}
+
+/// <summary>
+/// Commands that can be sent to agents.
+/// </summary>
+public enum AgentCommand
+{
+    /// <summary>No command.</summary>
+    None = 0,
+
+    /// <summary>Start collection.</summary>
+    Start = 1,
+
+    /// <summary>Stop collection.</summary>
+    Stop = 2,
+
+    /// <summary>Pause collection.</summary>
+    Pause = 3,
+
+    /// <summary>Resume collection.</summary>
+    Resume = 4,
+
+    /// <summary>Update configuration.</summary>
+    UpdateConfig = 5,
+
+    /// <summary>Terminate agent.</summary>
+    Terminate = 6
+}

src/Signals/StellaOps.Signals.RuntimeAgent/AgentRegistrationService.cs

@@ -0,0 +1,264 @@
+// <copyright file="AgentRegistrationService.cs" company="StellaOps">
+// Copyright (c) StellaOps. Licensed under the AGPL-3.0-or-later.
+// </copyright>
+
+using System.Collections.Concurrent;
+using Microsoft.Extensions.Logging;
+
+namespace StellaOps.Signals.RuntimeAgent;
+
+/// <summary>
+/// In-memory implementation of agent registration service.
+/// Sprint: SPRINT_20260109_009_004 Task: Implement AgentRegistrationService
+/// </summary>
+/// <remarks>
+/// This implementation uses in-memory storage. For production use with persistence,
+/// implement a database-backed version using the same interface.
+/// </remarks>
+public sealed class AgentRegistrationService : IAgentRegistrationService
+{
+    private readonly TimeProvider _timeProvider;
+    private readonly ILogger<AgentRegistrationService> _logger;
+    private readonly ConcurrentDictionary<string, AgentRegistration> _registrations = new();
+    private readonly ConcurrentDictionary<string, AgentCommand> _pendingCommands = new();
+    private readonly ConcurrentDictionary<string, RuntimePosture> _pendingPostureChanges = new();
+
+    /// <summary>
+    /// Heartbeat timeout for considering agents unhealthy.
+    /// </summary>
+    public TimeSpan HeartbeatTimeout { get; set; } = TimeSpan.FromMinutes(2);
+
+    public AgentRegistrationService(TimeProvider timeProvider, ILogger<AgentRegistrationService> logger)
+    {
+        _timeProvider = timeProvider;
+        _logger = logger;
+    }
+
+    /// <inheritdoc/>
+    public Task<AgentRegistration> RegisterAsync(AgentRegistrationRequest request, CancellationToken ct = default)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(request.AgentId);
+        ArgumentException.ThrowIfNullOrWhiteSpace(request.Hostname);
+        ArgumentException.ThrowIfNullOrWhiteSpace(request.AgentVersion);
+
+        var now = _timeProvider.GetUtcNow();
+
+        var registration = new AgentRegistration
+        {
+            AgentId = request.AgentId,
+            Platform = request.Platform,
+            Hostname = request.Hostname,
+            ContainerId = request.ContainerId,
+            KubernetesNamespace = request.KubernetesNamespace,
+            KubernetesPodName = request.KubernetesPodName,
+            ApplicationName = request.ApplicationName,
+            ProcessId = request.ProcessId,
+            AgentVersion = request.AgentVersion,
+            RegisteredAt = now,
+            LastHeartbeat = now,
+            State = AgentState.Stopped,
+            Posture = request.InitialPosture,
+            Tags = request.Tags
+        };
+
+        _registrations.AddOrUpdate(
+            request.AgentId,
+            registration,
+            (_, existing) =>
+            {
+                _logger.LogWarning(
+                    "Agent {AgentId} re-registered (previous: {PreviousRegistration})",
+                    request.AgentId,
+                    existing.RegisteredAt);
+                return registration;
+            });
+
+        _logger.LogInformation(
+            "Agent {AgentId} registered: Platform={Platform}, Host={Hostname}, App={Application}",
+            request.AgentId,
+            request.Platform,
+            request.Hostname,
+            request.ApplicationName ?? "N/A");
+
+        return Task.FromResult(registration);
+    }
+
+    /// <inheritdoc/>
+    public Task<AgentHeartbeatResponse> HeartbeatAsync(AgentHeartbeatRequest request, CancellationToken ct = default)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(request.AgentId);
+
+        var now = _timeProvider.GetUtcNow();
+
+        if (!_registrations.TryGetValue(request.AgentId, out var existing))
+        {
+            _logger.LogWarning("Heartbeat from unknown agent {AgentId}", request.AgentId);
+            return Task.FromResult(new AgentHeartbeatResponse { Continue = false });
+        }
+
+        // Update registration with heartbeat info
+        var updated = existing with
+        {
+            LastHeartbeat = now,
+            State = request.State,
+            Posture = request.Posture
+        };
+
+        _registrations.TryUpdate(request.AgentId, updated, existing);
+
+        // Check for pending commands
+        _pendingCommands.TryRemove(request.AgentId, out var pendingCommand);
+        _pendingPostureChanges.TryRemove(request.AgentId, out var pendingPosture);
+
+        var response = new AgentHeartbeatResponse
+        {
+            Continue = true,
+            Command = pendingCommand != AgentCommand.None ? pendingCommand : null,
+            NewPosture = pendingPosture != default ? pendingPosture : null
+        };
+
+        _logger.LogDebug(
+            "Heartbeat from {AgentId}: State={State}, Posture={Posture}, Events={Events}",
+            request.AgentId,
+            request.State,
+            request.Posture,
+            request.Statistics?.TotalEventsCollected ?? 0);
+
+        return Task.FromResult(response);
+    }
+
+    /// <inheritdoc/>
+    public Task UnregisterAsync(string agentId, CancellationToken ct = default)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(agentId);
+
+        if (_registrations.TryRemove(agentId, out var removed))
+        {
+            _pendingCommands.TryRemove(agentId, out _);
+            _pendingPostureChanges.TryRemove(agentId, out _);
+
+            _logger.LogInformation(
+                "Agent {AgentId} unregistered (was registered since {RegisteredAt})",
+                agentId,
+                removed.RegisteredAt);
+        }
+        else
+        {
+            _logger.LogDebug("Attempted to unregister unknown agent {AgentId}", agentId);
+        }
+
+        return Task.CompletedTask;
+    }
+
+    /// <inheritdoc/>
+    public Task<AgentRegistration?> GetAsync(string agentId, CancellationToken ct = default)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(agentId);
+
+        _registrations.TryGetValue(agentId, out var registration);
+        return Task.FromResult(registration);
+    }
+
+    /// <inheritdoc/>
+    public Task<IReadOnlyList<AgentRegistration>> ListAsync(CancellationToken ct = default)
+    {
+        var result = _registrations.Values.ToList();
+        return Task.FromResult<IReadOnlyList<AgentRegistration>>(result);
+    }
+
+    /// <inheritdoc/>
+    public Task<IReadOnlyList<AgentRegistration>> ListByPlatformAsync(RuntimePlatform platform, CancellationToken ct = default)
+    {
+        var result = _registrations.Values
+            .Where(r => r.Platform == platform)
+            .ToList();
+        return Task.FromResult<IReadOnlyList<AgentRegistration>>(result);
+    }
+
+    /// <inheritdoc/>
+    public Task<IReadOnlyList<AgentRegistration>> ListHealthyAsync(CancellationToken ct = default)
+    {
+        var now = _timeProvider.GetUtcNow();
+        var result = _registrations.Values
+            .Where(r => r.IsHealthy(now, HeartbeatTimeout))
+            .ToList();
+        return Task.FromResult<IReadOnlyList<AgentRegistration>>(result);
+    }
+
+    /// <inheritdoc/>
+    public Task SendCommandAsync(string agentId, AgentCommand command, CancellationToken ct = default)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(agentId);
+
+        if (!_registrations.ContainsKey(agentId))
+        {
+            _logger.LogWarning("Cannot send command to unknown agent {AgentId}", agentId);
+            return Task.CompletedTask;
+        }
+
+        _pendingCommands[agentId] = command;
+
+        _logger.LogInformation(
+            "Queued command {Command} for agent {AgentId}",
+            command,
+            agentId);
+
+        return Task.CompletedTask;
+    }
+
+    /// <inheritdoc/>
+    public Task UpdatePostureAsync(string agentId, RuntimePosture posture, CancellationToken ct = default)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(agentId);
+
+        if (!_registrations.ContainsKey(agentId))
+        {
+            _logger.LogWarning("Cannot update posture for unknown agent {AgentId}", agentId);
+            return Task.CompletedTask;
+        }
+
+        _pendingPostureChanges[agentId] = posture;
+
+        _logger.LogInformation(
+            "Queued posture change to {Posture} for agent {AgentId}",
+            posture,
+            agentId);
+
+        return Task.CompletedTask;
+    }
+
+    /// <summary>
+    /// Prune stale registrations (no heartbeat within timeout).
+    /// </summary>
+    /// <returns>Number of pruned registrations.</returns>
+    public int PruneStale()
+    {
+        var now = _timeProvider.GetUtcNow();
+        var pruned = 0;
+
+        foreach (var (agentId, registration) in _registrations)
+        {
+            if (!registration.IsHealthy(now, HeartbeatTimeout))
+            {
+                if (_registrations.TryRemove(agentId, out _))
+                {
+                    _pendingCommands.TryRemove(agentId, out _);
+                    _pendingPostureChanges.TryRemove(agentId, out _);
+                    pruned++;
+
+                    _logger.LogWarning(
+                        "Pruned stale agent {AgentId} (last heartbeat: {LastHeartbeat})",
+                        agentId,
+                        registration.LastHeartbeat);
+                }
+            }
+        }
+
+        return pruned;
+    }
+
+    /// <summary>
+    /// Gets count of registered agents.
+    /// </summary>
+    public int Count => _registrations.Count;
+}

src/Signals/StellaOps.Signals.RuntimeAgent/ClrMethodResolver.cs

@@ -0,0 +1,294 @@
+// <copyright file="ClrMethodResolver.cs" company="StellaOps">
+// Copyright (c) StellaOps. Licensed under the AGPL-3.0-or-later.
+// </copyright>
+
+using System.Collections.Concurrent;
+using System.Collections.Immutable;
+using System.Globalization;
+using System.Text.RegularExpressions;
+using Microsoft.Extensions.Logging;
+
+namespace StellaOps.Signals.RuntimeAgent;
+
+/// <summary>
+/// Resolves CLR method IDs from ETW/EventPipe events to readable method names.
+/// Sprint: SPRINT_20260109_009_004 Task: Implement ClrMethodResolver
+/// </summary>
+/// <remarks>
+/// CLR runtime events use method IDs (MethodID/FunctionID) that need to be resolved
+/// to human-readable names. This class maintains caches from MethodLoad/MethodILToNativeMap
+/// events and provides resolution services.
+/// </remarks>
+public sealed partial class ClrMethodResolver
+{
+    private readonly ILogger<ClrMethodResolver> _logger;
+    private readonly TimeProvider _timeProvider;
+
+    // Method ID to name cache (from MethodLoad events)
+    private readonly ConcurrentDictionary<ulong, ResolvedMethod> _methodIdCache = new();
+
+    // Module ID to name cache (from ModuleLoad events)
+    private readonly ConcurrentDictionary<ulong, ModuleInfo> _moduleIdCache = new();
+
+    // Assembly ID to name cache (from AssemblyLoad events)
+    private readonly ConcurrentDictionary<ulong, string> _assemblyIdCache = new();
+
+    public ClrMethodResolver(TimeProvider timeProvider, ILogger<ClrMethodResolver> logger)
+    {
+        _timeProvider = timeProvider;
+        _logger = logger;
+    }
+
+    /// <summary>
+    /// Gets the number of resolved methods in cache.
+    /// </summary>
+    public int CachedMethodCount => _methodIdCache.Count;
+
+    /// <summary>
+    /// Gets the number of resolved modules in cache.
+    /// </summary>
+    public int CachedModuleCount => _moduleIdCache.Count;
+
+    /// <summary>
+    /// Registers a module from ModuleLoad event.
+    /// </summary>
+    public void RegisterModule(ulong moduleId, ulong assemblyId, string modulePath, string simpleName)
+    {
+        var info = new ModuleInfo(moduleId, assemblyId, modulePath, simpleName);
+        _moduleIdCache[moduleId] = info;
+
+        _logger.LogDebug("Registered module {ModuleId}: {SimpleName}", moduleId, simpleName);
+    }
+
+    /// <summary>
+    /// Registers an assembly from AssemblyLoad event.
+    /// </summary>
+    public void RegisterAssembly(ulong assemblyId, string assemblyName)
+    {
+        _assemblyIdCache[assemblyId] = assemblyName;
+
+        _logger.LogDebug("Registered assembly {AssemblyId}: {AssemblyName}", assemblyId, assemblyName);
+    }
+
+    /// <summary>
+    /// Registers a method from MethodLoad event.
+    /// </summary>
+    public void RegisterMethod(
+        ulong methodId,
+        ulong moduleId,
+        string methodNamespace,
+        string methodName,
+        string methodSignature)
+    {
+        var resolved = new ResolvedMethod(
+            MethodId: methodId,
+            ModuleId: moduleId,
+            Namespace: methodNamespace,
+            TypeName: ExtractTypeName(methodNamespace),
+            MethodName: methodName,
+            Signature: methodSignature,
+            ResolvedAt: _timeProvider.GetUtcNow());
+
+        _methodIdCache[methodId] = resolved;
+
+        _logger.LogDebug(
+            "Registered method {MethodId}: {Namespace}.{Method}",
+            methodId, methodNamespace, methodName);
+    }
+
+    /// <summary>
+    /// Resolves a method ID to its full name.
+    /// </summary>
+    /// <returns>Resolved method info or null if not found.</returns>
+    public ResolvedMethod? ResolveMethod(ulong methodId)
+    {
+        return _methodIdCache.TryGetValue(methodId, out var resolved) ? resolved : null;
+    }
+
+    /// <summary>
+    /// Resolves a method ID to a RuntimeMethodEvent.
+    /// </summary>
+    public RuntimeMethodEvent? ResolveToEvent(
+        ulong methodId,
+        RuntimeEventKind eventKind,
+        string eventId,
+        DateTimeOffset timestamp,
+        int? processId = null,
+        string? threadId = null)
+    {
+        if (!_methodIdCache.TryGetValue(methodId, out var resolved))
+        {
+            _logger.LogDebug("Method {MethodId} not found in cache", methodId);
+            return null;
+        }
+
+        var assemblyName = GetAssemblyForModule(resolved.ModuleId);
+
+        return new RuntimeMethodEvent
+        {
+            EventId = eventId,
+            SymbolId = FormatSymbolId(methodId),
+            MethodName = resolved.MethodName,
+            TypeName = resolved.TypeName,
+            AssemblyOrModule = assemblyName ?? "Unknown",
+            Timestamp = timestamp,
+            Kind = eventKind,
+            Platform = RuntimePlatform.DotNet,
+            ProcessId = processId,
+            ThreadId = threadId,
+            Context = new Dictionary<string, string>
+            {
+                ["MethodId"] = methodId.ToString("X16", CultureInfo.InvariantCulture),
+                ["Namespace"] = resolved.Namespace,
+                ["Signature"] = resolved.Signature
+            }.ToImmutableDictionary()
+        };
+    }
+
+    /// <summary>
+    /// Tries to parse an ETW-style method reference like "MethodID=0x06000123".
+    /// </summary>
+    public bool TryParseEtwMethodId(string etwString, out ulong methodId)
+    {
+        methodId = 0;
+
+        var match = EtwMethodIdRegex().Match(etwString);
+        if (!match.Success)
+            return false;
+
+        var hexValue = match.Groups["id"].Value;
+        return ulong.TryParse(
+            hexValue,
+            NumberStyles.HexNumber,
+            CultureInfo.InvariantCulture,
+            out methodId);
+    }
+
+    /// <summary>
+    /// Parses a full ETW method string with module info.
+    /// Example: "MethodID=0x06000123 ModuleID=0x00007FF8ABC12340"
+    /// </summary>
+    public (ulong MethodId, ulong ModuleId)? ParseEtwMethodWithModule(string etwString)
+    {
+        var methodMatch = EtwMethodIdRegex().Match(etwString);
+        var moduleMatch = EtwModuleIdRegex().Match(etwString);
+
+        if (!methodMatch.Success)
+            return null;
+
+        var methodHex = methodMatch.Groups["id"].Value;
+        if (!ulong.TryParse(methodHex, NumberStyles.HexNumber, CultureInfo.InvariantCulture, out var methodId))
+            return null;
+
+        ulong moduleId = 0;
+        if (moduleMatch.Success)
+        {
+            var moduleHex = moduleMatch.Groups["id"].Value;
+            ulong.TryParse(moduleHex, NumberStyles.HexNumber, CultureInfo.InvariantCulture, out moduleId);
+        }
+
+        return (methodId, moduleId);
+    }
+
+    /// <summary>
+    /// Formats a method ID as a symbol ID string.
+    /// </summary>
+    public static string FormatSymbolId(ulong methodId)
+    {
+        return $"clr:method:{methodId:X16}";
+    }
+
+    /// <summary>
+    /// Clears all caches.
+    /// </summary>
+    public void Clear()
+    {
+        _methodIdCache.Clear();
+        _moduleIdCache.Clear();
+        _assemblyIdCache.Clear();
+
+        _logger.LogDebug("Cleared all method resolution caches");
+    }
+
+    /// <summary>
+    /// Gets statistics about the resolver.
+    /// </summary>
+    public ClrMethodResolverStats GetStatistics()
+    {
+        return new ClrMethodResolverStats(
+            CachedMethods: _methodIdCache.Count,
+            CachedModules: _moduleIdCache.Count,
+            CachedAssemblies: _assemblyIdCache.Count);
+    }
+
+    private string? GetAssemblyForModule(ulong moduleId)
+    {
+        if (!_moduleIdCache.TryGetValue(moduleId, out var moduleInfo))
+            return null;
+
+        if (_assemblyIdCache.TryGetValue(moduleInfo.AssemblyId, out var assemblyName))
+            return assemblyName;
+
+        return moduleInfo.SimpleName;
+    }
+
+    private static string ExtractTypeName(string fullNamespace)
+    {
+        if (string.IsNullOrEmpty(fullNamespace))
+            return "_";
+
+        // Take the last part after the dot
+        var lastDot = fullNamespace.LastIndexOf('.');
+        return lastDot >= 0 && lastDot < fullNamespace.Length - 1
+            ? fullNamespace[(lastDot + 1)..]
+            : fullNamespace;
+    }
+
+    [GeneratedRegex(@"MethodID=0x(?<id>[0-9A-Fa-f]+)", RegexOptions.Compiled)]
+    private static partial Regex EtwMethodIdRegex();
+
+    [GeneratedRegex(@"ModuleID=0x(?<id>[0-9A-Fa-f]+)", RegexOptions.Compiled)]
+    private static partial Regex EtwModuleIdRegex();
+}
+
+/// <summary>
+/// Resolved method information.
+/// </summary>
+public sealed record ResolvedMethod(
+    ulong MethodId,
+    ulong ModuleId,
+    string Namespace,
+    string TypeName,
+    string MethodName,
+    string Signature,
+    DateTimeOffset ResolvedAt)
+{
+    /// <summary>
+    /// Gets the fully qualified name.
+    /// </summary>
+    public string FullyQualifiedName => string.IsNullOrEmpty(Namespace)
+        ? MethodName
+        : $"{Namespace}.{MethodName}";
+
+    /// <summary>
+    /// Gets the display name with signature.
+    /// </summary>
+    public string DisplayName => $"{FullyQualifiedName}{Signature}";
+}
+
+/// <summary>
+/// Module information.
+/// </summary>
+public sealed record ModuleInfo(
+    ulong ModuleId,
+    ulong AssemblyId,
+    string ModulePath,
+    string SimpleName);
+
+/// <summary>
+/// Statistics about the method resolver.
+/// </summary>
+public sealed record ClrMethodResolverStats(
+    int CachedMethods,
+    int CachedModules,
+    int CachedAssemblies);

src/Signals/StellaOps.Signals.RuntimeAgent/IAgentRegistrationService.cs

@@ -0,0 +1,81 @@
+// <copyright file="IAgentRegistrationService.cs" company="StellaOps">
+// Copyright (c) StellaOps. Licensed under the AGPL-3.0-or-later.
+// </copyright>
+
+namespace StellaOps.Signals.RuntimeAgent;
+
+/// <summary>
+/// Service for managing runtime agent registrations.
+/// Sprint: SPRINT_20260109_009_004 Task: Implement AgentRegistrationService
+/// </summary>
+public interface IAgentRegistrationService
+{
+    /// <summary>
+    /// Register a new agent.
+    /// </summary>
+    /// <param name="request">Registration request.</param>
+    /// <param name="ct">Cancellation token.</param>
+    /// <returns>The registration record.</returns>
+    Task<AgentRegistration> RegisterAsync(AgentRegistrationRequest request, CancellationToken ct = default);
+
+    /// <summary>
+    /// Process agent heartbeat.
+    /// </summary>
+    /// <param name="request">Heartbeat request.</param>
+    /// <param name="ct">Cancellation token.</param>
+    /// <returns>Response with commands.</returns>
+    Task<AgentHeartbeatResponse> HeartbeatAsync(AgentHeartbeatRequest request, CancellationToken ct = default);
+
+    /// <summary>
+    /// Unregister an agent.
+    /// </summary>
+    /// <param name="agentId">Agent identifier.</param>
+    /// <param name="ct">Cancellation token.</param>
+    Task UnregisterAsync(string agentId, CancellationToken ct = default);
+
+    /// <summary>
+    /// Get registration by agent ID.
+    /// </summary>
+    /// <param name="agentId">Agent identifier.</param>
+    /// <param name="ct">Cancellation token.</param>
+    /// <returns>Registration or null if not found.</returns>
+    Task<AgentRegistration?> GetAsync(string agentId, CancellationToken ct = default);
+
+    /// <summary>
+    /// List all registered agents.
+    /// </summary>
+    /// <param name="ct">Cancellation token.</param>
+    /// <returns>All registrations.</returns>
+    Task<IReadOnlyList<AgentRegistration>> ListAsync(CancellationToken ct = default);
+
+    /// <summary>
+    /// List agents by platform.
+    /// </summary>
+    /// <param name="platform">Platform filter.</param>
+    /// <param name="ct">Cancellation token.</param>
+    /// <returns>Matching registrations.</returns>
+    Task<IReadOnlyList<AgentRegistration>> ListByPlatformAsync(RuntimePlatform platform, CancellationToken ct = default);
+
+    /// <summary>
+    /// List healthy agents (recent heartbeat).
+    /// </summary>
+    /// <param name="ct">Cancellation token.</param>
+    /// <returns>Healthy registrations.</returns>
+    Task<IReadOnlyList<AgentRegistration>> ListHealthyAsync(CancellationToken ct = default);
+
+    /// <summary>
+    /// Send command to an agent.
+    /// </summary>
+    /// <param name="agentId">Agent identifier.</param>
+    /// <param name="command">Command to send.</param>
+    /// <param name="ct">Cancellation token.</param>
+    Task SendCommandAsync(string agentId, AgentCommand command, CancellationToken ct = default);
+
+    /// <summary>
+    /// Update agent posture.
+    /// </summary>
+    /// <param name="agentId">Agent identifier.</param>
+    /// <param name="posture">New posture.</param>
+    /// <param name="ct">Cancellation token.</param>
+    Task UpdatePostureAsync(string agentId, RuntimePosture posture, CancellationToken ct = default);
+}

src/Signals/StellaOps.Signals.RuntimeAgent/IRuntimeFactsIngest.cs

@@ -44,42 +44,3 @@ public interface IRuntimeFactsIngest
     /// <param name="ct">Cancellation token.</param>
     Task UnregisterAgentAsync(string agentId, CancellationToken ct);
 }
-
-/// <summary>
-/// Agent registration information.
-/// </summary>
-public sealed record AgentRegistration
-{
-    /// <summary>Unique agent ID.</summary>
-    public required string AgentId { get; init; }
-
-    /// <summary>Target platform.</summary>
-    public required RuntimePlatform Platform { get; init; }
-
-    /// <summary>Agent version.</summary>
-    public required string AgentVersion { get; init; }
-
-    /// <summary>Hostname.</summary>
-    public required string Hostname { get; init; }
-
-    /// <summary>Container ID if applicable.</summary>
-    public string? ContainerId { get; init; }
-
-    /// <summary>Kubernetes pod name if applicable.</summary>
-    public string? PodName { get; init; }
-
-    /// <summary>Kubernetes namespace if applicable.</summary>
-    public string? Namespace { get; init; }
-
-    /// <summary>Target process name.</summary>
-    public string? ProcessName { get; init; }
-
-    /// <summary>Target process ID.</summary>
-    public int? ProcessId { get; init; }
-
-    /// <summary>Registration timestamp.</summary>
-    public required DateTimeOffset RegisteredAt { get; init; }
-
-    /// <summary>Initial posture.</summary>
-    public RuntimePosture Posture { get; init; } = RuntimePosture.Sampled;
-}

src/Signals/StellaOps.Signals.RuntimeAgent/RuntimeFactsIngestService.cs

@@ -0,0 +1,303 @@
+// <copyright file="RuntimeFactsIngestService.cs" company="StellaOps">
+// Copyright (c) StellaOps. Licensed under the AGPL-3.0-or-later.
+// </copyright>
+
+using System.Collections.Concurrent;
+using System.Collections.Immutable;
+using System.Threading.Channels;
+using Microsoft.Extensions.Logging;
+
+namespace StellaOps.Signals.RuntimeAgent;
+
+/// <summary>
+/// Service for ingesting and processing runtime facts from agents.
+/// Sprint: SPRINT_20260109_009_004 Task: Implement RuntimeFactsIngestService
+/// </summary>
+/// <remarks>
+/// This implementation buffers events in memory and aggregates them by symbol.
+/// For production use, integrate with persistence and the Signals module.
+/// </remarks>
+public sealed class RuntimeFactsIngestService : IRuntimeFactsIngest, IAsyncDisposable
+{
+    private readonly TimeProvider _timeProvider;
+    private readonly ILogger<RuntimeFactsIngestService> _logger;
+    private readonly IAgentRegistrationService _registrationService;
+
+    // Event buffer channel for async processing
+    private readonly Channel<IngestBatch> _ingestChannel;
+    private readonly Task _processingTask;
+    private readonly CancellationTokenSource _cts = new();
+
+    // Symbol observation tracking
+    private readonly ConcurrentDictionary<string, SymbolObservation> _observations = new();
+
+    // Statistics
+    private long _totalEventsIngested;
+    private long _totalBatchesProcessed;
+
+    public RuntimeFactsIngestService(
+        TimeProvider timeProvider,
+        IAgentRegistrationService registrationService,
+        ILogger<RuntimeFactsIngestService> logger)
+    {
+        _timeProvider = timeProvider;
+        _registrationService = registrationService;
+        _logger = logger;
+
+        // Create bounded channel to prevent memory issues
+        _ingestChannel = Channel.CreateBounded<IngestBatch>(new BoundedChannelOptions(1000)
+        {
+            FullMode = BoundedChannelFullMode.Wait,
+            SingleReader = true,
+            SingleWriter = false
+        });
+
+        // Start background processing
+        _processingTask = ProcessIngestChannelAsync(_cts.Token);
+    }
+
+    /// <inheritdoc/>
+    public async Task<int> IngestAsync(
+        string agentId,
+        IReadOnlyList<RuntimeMethodEvent> events,
+        CancellationToken ct)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(agentId);
+
+        if (events.Count == 0)
+            return 0;
+
+        var batch = new IngestBatch(agentId, events, _timeProvider.GetUtcNow());
+
+        await _ingestChannel.Writer.WriteAsync(batch, ct).ConfigureAwait(false);
+
+        _logger.LogDebug(
+            "Queued {Count} events from agent {AgentId}",
+            events.Count,
+            agentId);
+
+        return events.Count;
+    }
+
+    /// <inheritdoc/>
+    public Task RegisterAgentAsync(AgentRegistration registration, CancellationToken ct)
+    {
+        _logger.LogInformation(
+            "Agent {AgentId} registered for fact ingestion",
+            registration.AgentId);
+
+        return Task.CompletedTask;
+    }
+
+    /// <inheritdoc/>
+    public Task HeartbeatAsync(string agentId, AgentStatistics statistics, CancellationToken ct)
+    {
+        _logger.LogDebug(
+            "Heartbeat from {AgentId}: {TotalEvents} events collected",
+            agentId,
+            statistics.TotalEventsCollected);
+
+        return Task.CompletedTask;
+    }
+
+    /// <inheritdoc/>
+    public Task UnregisterAgentAsync(string agentId, CancellationToken ct)
+    {
+        _logger.LogInformation(
+            "Agent {AgentId} unregistered from fact ingestion",
+            agentId);
+
+        return Task.CompletedTask;
+    }
+
+    /// <summary>
+    /// Gets the observation for a symbol.
+    /// </summary>
+    public SymbolObservation? GetObservation(string symbolId)
+    {
+        _observations.TryGetValue(symbolId, out var observation);
+        return observation;
+    }
+
+    /// <summary>
+    /// Gets all symbols observed since a given time.
+    /// </summary>
+    public IReadOnlyList<SymbolObservation> GetObservationsSince(DateTimeOffset since)
+    {
+        return _observations.Values
+            .Where(o => o.LastObserved >= since)
+            .ToList();
+    }
+
+    /// <summary>
+    /// Gets all unique symbols observed.
+    /// </summary>
+    public IReadOnlyList<string> GetObservedSymbols()
+    {
+        return _observations.Keys.ToList();
+    }
+
+    /// <summary>
+    /// Gets ingest statistics.
+    /// </summary>
+    public RuntimeFactsIngestStats GetStatistics()
+    {
+        return new RuntimeFactsIngestStats(
+            TotalEventsIngested: Interlocked.Read(ref _totalEventsIngested),
+            TotalBatchesProcessed: Interlocked.Read(ref _totalBatchesProcessed),
+            UniqueSymbolsObserved: _observations.Count,
+            PendingBatches: _ingestChannel.Reader.Count);
+    }
+
+    private async Task ProcessIngestChannelAsync(CancellationToken ct)
+    {
+        try
+        {
+            await foreach (var batch in _ingestChannel.Reader.ReadAllAsync(ct).ConfigureAwait(false))
+            {
+                try
+                {
+                    ProcessBatch(batch);
+                    Interlocked.Increment(ref _totalBatchesProcessed);
+                }
+                catch (Exception ex)
+                {
+                    _logger.LogError(ex, "Error processing batch from agent {AgentId}", batch.AgentId);
+                }
+            }
+        }
+        catch (OperationCanceledException)
+        {
+            // Expected during shutdown
+        }
+    }
+
+    private void ProcessBatch(IngestBatch batch)
+    {
+        foreach (var @event in batch.Events)
+        {
+            var symbolId = @event.SymbolId;
+
+            _observations.AddOrUpdate(
+                symbolId,
+                _ => CreateObservation(@event, batch),
+                (_, existing) => UpdateObservation(existing, @event, batch));
+
+            Interlocked.Increment(ref _totalEventsIngested);
+        }
+
+        _logger.LogDebug(
+            "Processed batch of {Count} events from agent {AgentId}",
+            batch.Events.Count,
+            batch.AgentId);
+    }
+
+    private SymbolObservation CreateObservation(RuntimeMethodEvent @event, IngestBatch batch)
+    {
+        return new SymbolObservation
+        {
+            SymbolId = @event.SymbolId,
+            MethodName = @event.MethodName,
+            TypeName = @event.TypeName,
+            AssemblyOrModule = @event.AssemblyOrModule,
+            Platform = @event.Platform,
+            FirstObserved = @event.Timestamp,
+            LastObserved = @event.Timestamp,
+            ObservationCount = 1,
+            AgentIds = [batch.AgentId],
+            EventKinds = [@event.Kind]
+        };
+    }
+
+    private static SymbolObservation UpdateObservation(
+        SymbolObservation existing,
+        RuntimeMethodEvent @event,
+        IngestBatch batch)
+    {
+        var agentIds = existing.AgentIds.Contains(batch.AgentId)
+            ? existing.AgentIds
+            : existing.AgentIds.Add(batch.AgentId);
+
+        var eventKinds = existing.EventKinds.Contains(@event.Kind)
+            ? existing.EventKinds
+            : existing.EventKinds.Add(@event.Kind);
+
+        return existing with
+        {
+            LastObserved = @event.Timestamp > existing.LastObserved
+                ? @event.Timestamp
+                : existing.LastObserved,
+            ObservationCount = existing.ObservationCount + 1,
+            AgentIds = agentIds,
+            EventKinds = eventKinds
+        };
+    }
+
+    /// <inheritdoc/>
+    public async ValueTask DisposeAsync()
+    {
+        _cts.Cancel();
+        _ingestChannel.Writer.Complete();
+
+        try
+        {
+            await _processingTask.ConfigureAwait(false);
+        }
+        catch (OperationCanceledException)
+        {
+            // Expected
+        }
+
+        _cts.Dispose();
+    }
+
+    private sealed record IngestBatch(
+        string AgentId,
+        IReadOnlyList<RuntimeMethodEvent> Events,
+        DateTimeOffset ReceivedAt);
+}
+
+/// <summary>
+/// Aggregated observation for a symbol.
+/// </summary>
+public sealed record SymbolObservation
+{
+    /// <summary>Symbol identifier.</summary>
+    public required string SymbolId { get; init; }
+
+    /// <summary>Method name.</summary>
+    public required string MethodName { get; init; }
+
+    /// <summary>Type/class name.</summary>
+    public required string TypeName { get; init; }
+
+    /// <summary>Assembly/module.</summary>
+    public required string AssemblyOrModule { get; init; }
+
+    /// <summary>Platform.</summary>
+    public required RuntimePlatform Platform { get; init; }
+
+    /// <summary>First observation timestamp.</summary>
+    public required DateTimeOffset FirstObserved { get; init; }
+
+    /// <summary>Most recent observation timestamp.</summary>
+    public required DateTimeOffset LastObserved { get; init; }
+
+    /// <summary>Total observation count.</summary>
+    public required long ObservationCount { get; init; }
+
+    /// <summary>Agents that observed this symbol.</summary>
+    public required ImmutableHashSet<string> AgentIds { get; init; }
+
+    /// <summary>Event kinds observed.</summary>
+    public required ImmutableHashSet<RuntimeEventKind> EventKinds { get; init; }
+}
+
+/// <summary>
+/// Statistics for the ingest service.
+/// </summary>
+public sealed record RuntimeFactsIngestStats(
+    long TotalEventsIngested,
+    long TotalBatchesProcessed,
+    int UniqueSymbolsObserved,
+    int PendingBatches);

src/Signals/__Tests/StellaOps.Signals.RuntimeAgent.Tests/AgentRegistrationServiceTests.cs

@@ -0,0 +1,272 @@
+// <copyright file="AgentRegistrationServiceTests.cs" company="StellaOps">
+// Copyright (c) StellaOps. Licensed under the AGPL-3.0-or-later.
+// </copyright>
+
+using FluentAssertions;
+using Microsoft.Extensions.Logging.Abstractions;
+using Microsoft.Extensions.Time.Testing;
+using Xunit;
+
+namespace StellaOps.Signals.RuntimeAgent.Tests;
+
+/// <summary>
+/// Tests for <see cref="AgentRegistrationService"/>.
+/// </summary>
+[Trait("Category", "Unit")]
+public class AgentRegistrationServiceTests
+{
+    private readonly FakeTimeProvider _timeProvider = new();
+    private readonly AgentRegistrationService _service;
+
+    public AgentRegistrationServiceTests()
+    {
+        _service = new AgentRegistrationService(
+            _timeProvider,
+            NullLogger<AgentRegistrationService>.Instance);
+    }
+
+    [Fact]
+    public async Task RegisterAsync_ValidRequest_ReturnsRegistration()
+    {
+        var request = CreateRegistrationRequest("agent-1");
+
+        var result = await _service.RegisterAsync(request);
+
+        result.Should().NotBeNull();
+        result.AgentId.Should().Be("agent-1");
+        result.Platform.Should().Be(RuntimePlatform.DotNet);
+        result.Hostname.Should().Be("host1");
+        result.State.Should().Be(AgentState.Stopped);
+    }
+
+    [Fact]
+    public async Task RegisterAsync_DuplicateAgent_UpdatesRegistration()
+    {
+        var request1 = CreateRegistrationRequest("agent-1");
+        var request2 = CreateRegistrationRequest("agent-1") with { ApplicationName = "App2" };
+
+        await _service.RegisterAsync(request1);
+        _timeProvider.Advance(TimeSpan.FromMinutes(1));
+        var result = await _service.RegisterAsync(request2);
+
+        result.ApplicationName.Should().Be("App2");
+        _service.Count.Should().Be(1);
+    }
+
+    [Fact]
+    public async Task HeartbeatAsync_RegisteredAgent_UpdatesState()
+    {
+        var request = CreateRegistrationRequest("agent-1");
+        await _service.RegisterAsync(request);
+
+        _timeProvider.Advance(TimeSpan.FromSeconds(30));
+        var heartbeat = new AgentHeartbeatRequest
+        {
+            AgentId = "agent-1",
+            State = AgentState.Running,
+            Posture = RuntimePosture.Full,
+            Statistics = CreateStatistics("agent-1", 1000)
+        };
+
+        var response = await _service.HeartbeatAsync(heartbeat);
+
+        response.Continue.Should().BeTrue();
+        var registration = await _service.GetAsync("agent-1");
+        registration!.State.Should().Be(AgentState.Running);
+        registration.Posture.Should().Be(RuntimePosture.Full);
+    }
+
+    [Fact]
+    public async Task HeartbeatAsync_UnknownAgent_ReturnsContinueFalse()
+    {
+        var heartbeat = new AgentHeartbeatRequest
+        {
+            AgentId = "unknown-agent",
+            State = AgentState.Running,
+            Posture = RuntimePosture.Sampled
+        };
+
+        var response = await _service.HeartbeatAsync(heartbeat);
+
+        response.Continue.Should().BeFalse();
+    }
+
+    [Fact]
+    public async Task HeartbeatAsync_WithPendingCommand_ReturnsCommand()
+    {
+        var request = CreateRegistrationRequest("agent-1");
+        await _service.RegisterAsync(request);
+        await _service.SendCommandAsync("agent-1", AgentCommand.Start);
+
+        var heartbeat = new AgentHeartbeatRequest
+        {
+            AgentId = "agent-1",
+            State = AgentState.Stopped,
+            Posture = RuntimePosture.Sampled
+        };
+        var response = await _service.HeartbeatAsync(heartbeat);
+
+        response.Command.Should().Be(AgentCommand.Start);
+
+        // Second heartbeat should not have command
+        var response2 = await _service.HeartbeatAsync(heartbeat);
+        response2.Command.Should().BeNull();
+    }
+
+    [Fact]
+    public async Task HeartbeatAsync_WithPendingPosture_ReturnsNewPosture()
+    {
+        var request = CreateRegistrationRequest("agent-1");
+        await _service.RegisterAsync(request);
+        await _service.UpdatePostureAsync("agent-1", RuntimePosture.Full);
+
+        var heartbeat = new AgentHeartbeatRequest
+        {
+            AgentId = "agent-1",
+            State = AgentState.Running,
+            Posture = RuntimePosture.Sampled
+        };
+        var response = await _service.HeartbeatAsync(heartbeat);
+
+        response.NewPosture.Should().Be(RuntimePosture.Full);
+    }
+
+    [Fact]
+    public async Task UnregisterAsync_RegisteredAgent_RemovesFromList()
+    {
+        var request = CreateRegistrationRequest("agent-1");
+        await _service.RegisterAsync(request);
+
+        await _service.UnregisterAsync("agent-1");
+
+        var result = await _service.GetAsync("agent-1");
+        result.Should().BeNull();
+        _service.Count.Should().Be(0);
+    }
+
+    [Fact]
+    public async Task ListAsync_ReturnsAllRegistrations()
+    {
+        await _service.RegisterAsync(CreateRegistrationRequest("agent-1"));
+        await _service.RegisterAsync(CreateRegistrationRequest("agent-2"));
+        await _service.RegisterAsync(CreateRegistrationRequest("agent-3"));
+
+        var result = await _service.ListAsync();
+
+        result.Should().HaveCount(3);
+    }
+
+    [Fact]
+    public async Task ListByPlatformAsync_FiltersCorrectly()
+    {
+        await _service.RegisterAsync(CreateRegistrationRequest("agent-1") with
+        {
+            Platform = RuntimePlatform.DotNet
+        });
+        await _service.RegisterAsync(CreateRegistrationRequest("agent-2") with
+        {
+            Platform = RuntimePlatform.Java
+        });
+        await _service.RegisterAsync(CreateRegistrationRequest("agent-3") with
+        {
+            Platform = RuntimePlatform.DotNet
+        });
+
+        var result = await _service.ListByPlatformAsync(RuntimePlatform.DotNet);
+
+        result.Should().HaveCount(2);
+        result.Should().AllSatisfy(r => r.Platform.Should().Be(RuntimePlatform.DotNet));
+    }
+
+    [Fact]
+    public async Task ListHealthyAsync_FiltersStaleAgents()
+    {
+        _service.HeartbeatTimeout = TimeSpan.FromMinutes(2);
+
+        await _service.RegisterAsync(CreateRegistrationRequest("agent-1"));
+        await _service.RegisterAsync(CreateRegistrationRequest("agent-2"));
+
+        // Advance time and only heartbeat agent-1
+        _timeProvider.Advance(TimeSpan.FromMinutes(1));
+        await _service.HeartbeatAsync(new AgentHeartbeatRequest
+        {
+            AgentId = "agent-1",
+            State = AgentState.Running,
+            Posture = RuntimePosture.Sampled
+        });
+
+        // Advance 30 seconds - agent-1 should still be healthy (1.5 min since heartbeat)
+        // but agent-2 is unhealthy (2.5 min since registration/initial heartbeat)
+        _timeProvider.Advance(TimeSpan.FromMinutes(1.5));
+
+        var healthy = await _service.ListHealthyAsync();
+
+        healthy.Should().HaveCount(1);
+        healthy[0].AgentId.Should().Be("agent-1");
+    }
+
+    [Fact]
+    public async Task PruneStale_RemovesExpiredRegistrations()
+    {
+        _service.HeartbeatTimeout = TimeSpan.FromMinutes(2);
+
+        await _service.RegisterAsync(CreateRegistrationRequest("agent-1"));
+        await _service.RegisterAsync(CreateRegistrationRequest("agent-2"));
+
+        _timeProvider.Advance(TimeSpan.FromMinutes(3));
+
+        var pruned = _service.PruneStale();
+
+        pruned.Should().Be(2);
+        _service.Count.Should().Be(0);
+    }
+
+    [Fact]
+    public async Task SendCommandAsync_UnknownAgent_DoesNotThrow()
+    {
+        await _service.SendCommandAsync("unknown", AgentCommand.Start);
+
+        // Should not throw, just log warning
+    }
+
+    [Fact]
+    public async Task UpdatePostureAsync_UnknownAgent_DoesNotThrow()
+    {
+        await _service.UpdatePostureAsync("unknown", RuntimePosture.Full);
+
+        // Should not throw, just log warning
+    }
+
+    private static AgentRegistrationRequest CreateRegistrationRequest(string agentId)
+    {
+        return new AgentRegistrationRequest
+        {
+            AgentId = agentId,
+            Platform = RuntimePlatform.DotNet,
+            Hostname = "host1",
+            AgentVersion = "1.0.0",
+            ApplicationName = "TestApp",
+            InitialPosture = RuntimePosture.Sampled
+        };
+    }
+
+    private AgentStatistics CreateStatistics(string agentId, long eventsCollected)
+    {
+        return new AgentStatistics
+        {
+            AgentId = agentId,
+            Timestamp = _timeProvider.GetUtcNow(),
+            State = AgentState.Running,
+            Uptime = TimeSpan.FromMinutes(5),
+            TotalEventsCollected = eventsCollected,
+            EventsLastMinute = Math.Min(eventsCollected, 1000),
+            EventsDropped = 0,
+            UniqueMethodsObserved = (int)(eventsCollected / 10),
+            UniqueTypesObserved = (int)(eventsCollected / 100),
+            UniqueAssembliesObserved = 5,
+            BufferUtilizationPercent = 25.0,
+            EstimatedCpuOverheadPercent = 1.5,
+            MemoryUsageBytes = 50_000_000
+        };
+    }
+}

src/Signals/__Tests/StellaOps.Signals.RuntimeAgent.Tests/ClrMethodResolverTests.cs

@@ -0,0 +1,257 @@
+// <copyright file="ClrMethodResolverTests.cs" company="StellaOps">
+// Copyright (c) StellaOps. Licensed under the AGPL-3.0-or-later.
+// </copyright>
+
+using FluentAssertions;
+using Microsoft.Extensions.Logging.Abstractions;
+using Microsoft.Extensions.Time.Testing;
+using Xunit;
+
+namespace StellaOps.Signals.RuntimeAgent.Tests;
+
+/// <summary>
+/// Tests for <see cref="ClrMethodResolver"/>.
+/// </summary>
+[Trait("Category", "Unit")]
+public class ClrMethodResolverTests
+{
+    private readonly FakeTimeProvider _timeProvider = new();
+    private readonly ClrMethodResolver _resolver;
+
+    public ClrMethodResolverTests()
+    {
+        _resolver = new ClrMethodResolver(
+            _timeProvider,
+            NullLogger<ClrMethodResolver>.Instance);
+    }
+
+    [Fact]
+    public void RegisterMethod_IncrementsCacheCount()
+    {
+        _resolver.RegisterMethod(
+            methodId: 0x06000001,
+            moduleId: 0x00007FF8ABC12340,
+            methodNamespace: "MyApp.Services",
+            methodName: "ProcessData",
+            methodSignature: "(System.String)");
+
+        _resolver.CachedMethodCount.Should().Be(1);
+    }
+
+    [Fact]
+    public void RegisterModule_IncrementsCacheCount()
+    {
+        _resolver.RegisterModule(
+            moduleId: 0x00007FF8ABC12340,
+            assemblyId: 0x00007FF8DEF00000,
+            modulePath: @"C:\app\MyApp.dll",
+            simpleName: "MyApp");
+
+        _resolver.CachedModuleCount.Should().Be(1);
+    }
+
+    [Fact]
+    public void ResolveMethod_RegisteredMethod_ReturnsResolved()
+    {
+        const ulong methodId = 0x06000001;
+        _resolver.RegisterMethod(
+            methodId: methodId,
+            moduleId: 0x00007FF8ABC12340,
+            methodNamespace: "MyApp.Services.DataService",
+            methodName: "ProcessData",
+            methodSignature: "(System.String)");
+
+        var resolved = _resolver.ResolveMethod(methodId);
+
+        resolved.Should().NotBeNull();
+        resolved!.MethodName.Should().Be("ProcessData");
+        resolved.Namespace.Should().Be("MyApp.Services.DataService");
+        resolved.TypeName.Should().Be("DataService");
+        resolved.Signature.Should().Be("(System.String)");
+    }
+
+    [Fact]
+    public void ResolveMethod_UnknownMethod_ReturnsNull()
+    {
+        var resolved = _resolver.ResolveMethod(0xDEADBEEF);
+
+        resolved.Should().BeNull();
+    }
+
+    [Fact]
+    public void ResolveToEvent_RegisteredMethod_ReturnsEvent()
+    {
+        const ulong methodId = 0x06000001;
+        const ulong moduleId = 0x00007FF8ABC12340;
+
+        _resolver.RegisterModule(moduleId, 0, @"C:\app\MyApp.dll", "MyApp");
+        _resolver.RegisterMethod(
+            methodId: methodId,
+            moduleId: moduleId,
+            methodNamespace: "MyApp.Services.DataService",
+            methodName: "ProcessData",
+            methodSignature: "(System.String)");
+
+        var @event = _resolver.ResolveToEvent(
+            methodId,
+            RuntimeEventKind.MethodEnter,
+            eventId: "test-event-1",
+            timestamp: _timeProvider.GetUtcNow(),
+            processId: 1234);
+
+        @event.Should().NotBeNull();
+        @event!.MethodName.Should().Be("ProcessData");
+        @event.TypeName.Should().Be("DataService");
+        @event.AssemblyOrModule.Should().Be("MyApp");
+        @event.Kind.Should().Be(RuntimeEventKind.MethodEnter);
+        @event.Platform.Should().Be(RuntimePlatform.DotNet);
+        @event.ProcessId.Should().Be(1234);
+    }
+
+    [Fact]
+    public void ResolveToEvent_UnknownMethod_ReturnsNull()
+    {
+        var @event = _resolver.ResolveToEvent(
+            0xDEADBEEF,
+            RuntimeEventKind.MethodEnter,
+            eventId: "test-event-1",
+            timestamp: _timeProvider.GetUtcNow());
+
+        @event.Should().BeNull();
+    }
+
+    [Theory]
+    [InlineData("MethodID=0x06000123", 0x06000123UL)]
+    [InlineData("MethodID=0x00000001", 0x00000001UL)]
+    [InlineData("MethodID=0xDEADBEEF", 0xDEADBEEFUL)]
+    public void TryParseEtwMethodId_ValidInput_ReturnsMethodId(string input, ulong expected)
+    {
+        var success = _resolver.TryParseEtwMethodId(input, out var methodId);
+
+        success.Should().BeTrue();
+        methodId.Should().Be(expected);
+    }
+
+    [Theory]
+    [InlineData("")]
+    [InlineData("invalid")]
+    [InlineData("MethodID=invalid")]
+    [InlineData("ModuleID=0x123")]
+    public void TryParseEtwMethodId_InvalidInput_ReturnsFalse(string input)
+    {
+        var success = _resolver.TryParseEtwMethodId(input, out _);
+
+        success.Should().BeFalse();
+    }
+
+    [Fact]
+    public void ParseEtwMethodWithModule_ValidInput_ReturnsBoth()
+    {
+        var result = _resolver.ParseEtwMethodWithModule(
+            "MethodID=0x06000123 ModuleID=0x00007FF8ABC12340");
+
+        result.Should().NotBeNull();
+        result!.Value.MethodId.Should().Be(0x06000123UL);
+        result.Value.ModuleId.Should().Be(0x00007FF8ABC12340UL);
+    }
+
+    [Fact]
+    public void ParseEtwMethodWithModule_MethodOnly_ReturnsZeroModule()
+    {
+        var result = _resolver.ParseEtwMethodWithModule("MethodID=0x06000123");
+
+        result.Should().NotBeNull();
+        result!.Value.MethodId.Should().Be(0x06000123UL);
+        result.Value.ModuleId.Should().Be(0UL);
+    }
+
+    [Fact]
+    public void FormatSymbolId_ReturnsCorrectFormat()
+    {
+        var symbolId = ClrMethodResolver.FormatSymbolId(0x06000123);
+
+        symbolId.Should().Be("clr:method:0000000006000123");
+    }
+
+    [Fact]
+    public void Clear_RemovesAllCaches()
+    {
+        _resolver.RegisterMethod(0x1, 0x2, "ns", "method", "()");
+        _resolver.RegisterModule(0x2, 0x3, "path", "name");
+        _resolver.RegisterAssembly(0x3, "assembly");
+
+        _resolver.Clear();
+
+        _resolver.CachedMethodCount.Should().Be(0);
+        _resolver.CachedModuleCount.Should().Be(0);
+        _resolver.GetStatistics().CachedAssemblies.Should().Be(0);
+    }
+
+    [Fact]
+    public void GetStatistics_ReturnsCorrectCounts()
+    {
+        _resolver.RegisterMethod(0x1, 0x2, "ns1", "method1", "()");
+        _resolver.RegisterMethod(0x2, 0x2, "ns2", "method2", "()");
+        _resolver.RegisterModule(0x10, 0x20, "path1", "name1");
+        _resolver.RegisterAssembly(0x20, "assembly1");
+
+        var stats = _resolver.GetStatistics();
+
+        stats.CachedMethods.Should().Be(2);
+        stats.CachedModules.Should().Be(1);
+        stats.CachedAssemblies.Should().Be(1);
+    }
+
+    [Fact]
+    public void ResolvedMethod_FullyQualifiedName_CombinesCorrectly()
+    {
+        const ulong methodId = 0x06000001;
+        _resolver.RegisterMethod(
+            methodId: methodId,
+            moduleId: 0,
+            methodNamespace: "MyApp.Services.DataService",
+            methodName: "ProcessData",
+            methodSignature: "()");
+
+        var resolved = _resolver.ResolveMethod(methodId);
+
+        resolved!.FullyQualifiedName.Should().Be("MyApp.Services.DataService.ProcessData");
+        resolved.DisplayName.Should().Be("MyApp.Services.DataService.ProcessData()");
+    }
+
+    [Fact]
+    public void ResolvedMethod_EmptyNamespace_UsesMethodNameOnly()
+    {
+        const ulong methodId = 0x06000001;
+        _resolver.RegisterMethod(
+            methodId: methodId,
+            moduleId: 0,
+            methodNamespace: "",
+            methodName: "Main",
+            methodSignature: "()");
+
+        var resolved = _resolver.ResolveMethod(methodId);
+
+        resolved!.FullyQualifiedName.Should().Be("Main");
+    }
+
+    [Fact]
+    public void RegisterAssembly_ResolvesInEvent()
+    {
+        const ulong methodId = 0x06000001;
+        const ulong moduleId = 0x00007FF8ABC12340;
+        const ulong assemblyId = 0x00007FF8DEF00000;
+
+        _resolver.RegisterAssembly(assemblyId, "MyApp.Core, Version=1.0.0.0");
+        _resolver.RegisterModule(moduleId, assemblyId, @"C:\app\MyApp.Core.dll", "MyApp.Core");
+        _resolver.RegisterMethod(methodId, moduleId, "MyApp.Core.Data", "Load", "()");
+
+        var @event = _resolver.ResolveToEvent(
+            methodId,
+            RuntimeEventKind.MethodEnter,
+            eventId: "e1",
+            timestamp: _timeProvider.GetUtcNow());
+
+        @event!.AssemblyOrModule.Should().Be("MyApp.Core, Version=1.0.0.0");
+    }
+}

src/Signals/__Tests/StellaOps.Signals.RuntimeAgent.Tests/RuntimeFactsIngestServiceTests.cs

@@ -0,0 +1,248 @@
+// <copyright file="RuntimeFactsIngestServiceTests.cs" company="StellaOps">
+// Copyright (c) StellaOps. Licensed under the AGPL-3.0-or-later.
+// </copyright>
+
+using FluentAssertions;
+using Microsoft.Extensions.Logging.Abstractions;
+using Microsoft.Extensions.Time.Testing;
+using Xunit;
+
+namespace StellaOps.Signals.RuntimeAgent.Tests;
+
+/// <summary>
+/// Tests for <see cref="RuntimeFactsIngestService"/>.
+/// </summary>
+[Trait("Category", "Unit")]
+public class RuntimeFactsIngestServiceTests : IAsyncLifetime
+{
+    private readonly FakeTimeProvider _timeProvider = new();
+    private readonly AgentRegistrationService _registrationService;
+    private readonly RuntimeFactsIngestService _service;
+
+    public RuntimeFactsIngestServiceTests()
+    {
+        _registrationService = new AgentRegistrationService(
+            _timeProvider,
+            NullLogger<AgentRegistrationService>.Instance);
+
+        _service = new RuntimeFactsIngestService(
+            _timeProvider,
+            _registrationService,
+            NullLogger<RuntimeFactsIngestService>.Instance);
+    }
+
+    public ValueTask InitializeAsync() => ValueTask.CompletedTask;
+
+    public async ValueTask DisposeAsync()
+    {
+        await _service.DisposeAsync();
+    }
+
+    [Fact]
+    public async Task IngestAsync_EmptyEvents_ReturnsZero()
+    {
+        var count = await _service.IngestAsync("agent-1", [], CancellationToken.None);
+
+        count.Should().Be(0);
+    }
+
+    [Fact]
+    public async Task IngestAsync_ValidEvents_ReturnsCount()
+    {
+        var events = CreateEvents(5);
+
+        var count = await _service.IngestAsync("agent-1", events, CancellationToken.None);
+
+        count.Should().Be(5);
+    }
+
+    [Fact]
+    public async Task IngestAsync_ProcessesEventsThroughChannel()
+    {
+        var events = CreateEvents(10);
+
+        await _service.IngestAsync("agent-1", events, CancellationToken.None);
+
+        // Allow time for background processing
+        await Task.Delay(100);
+
+        var stats = _service.GetStatistics();
+        stats.TotalEventsIngested.Should().Be(10);
+        stats.TotalBatchesProcessed.Should().Be(1);
+    }
+
+    [Fact]
+    public async Task IngestAsync_AggregatesSymbolObservations()
+    {
+        var now = _timeProvider.GetUtcNow();
+        var events = new List<RuntimeMethodEvent>
+        {
+            CreateEvent("symbol-1", "Method1", now),
+            CreateEvent("symbol-1", "Method1", now.AddSeconds(1)),
+            CreateEvent("symbol-1", "Method1", now.AddSeconds(2)),
+            CreateEvent("symbol-2", "Method2", now)
+        };
+
+        await _service.IngestAsync("agent-1", events, CancellationToken.None);
+        await Task.Delay(100);
+
+        var observation = _service.GetObservation("symbol-1");
+        observation.Should().NotBeNull();
+        observation!.ObservationCount.Should().Be(3);
+        observation.MethodName.Should().Be("Method1");
+    }
+
+    [Fact]
+    public async Task IngestAsync_TracksMultipleAgents()
+    {
+        var now = _timeProvider.GetUtcNow();
+        var event1 = CreateEvent("symbol-1", "Method1", now);
+        var event2 = CreateEvent("symbol-1", "Method1", now.AddSeconds(1));
+
+        await _service.IngestAsync("agent-1", [event1], CancellationToken.None);
+        await _service.IngestAsync("agent-2", [event2], CancellationToken.None);
+        await Task.Delay(100);
+
+        var observation = _service.GetObservation("symbol-1");
+        observation!.AgentIds.Should().Contain("agent-1");
+        observation.AgentIds.Should().Contain("agent-2");
+    }
+
+    [Fact]
+    public async Task GetObservedSymbols_ReturnsAllUniqueSymbols()
+    {
+        var now = _timeProvider.GetUtcNow();
+        var events = new List<RuntimeMethodEvent>
+        {
+            CreateEvent("symbol-1", "Method1", now),
+            CreateEvent("symbol-2", "Method2", now),
+            CreateEvent("symbol-3", "Method3", now),
+            CreateEvent("symbol-1", "Method1", now) // Duplicate
+        };
+
+        await _service.IngestAsync("agent-1", events, CancellationToken.None);
+        await Task.Delay(100);
+
+        var symbols = _service.GetObservedSymbols();
+        symbols.Should().HaveCount(3);
+        symbols.Should().Contain("symbol-1");
+        symbols.Should().Contain("symbol-2");
+        symbols.Should().Contain("symbol-3");
+    }
+
+    [Fact]
+    public async Task GetObservationsSince_FiltersCorrectly()
+    {
+        var baseTime = _timeProvider.GetUtcNow();
+        var events1 = new List<RuntimeMethodEvent>
+        {
+            CreateEvent("symbol-1", "Method1", baseTime)
+        };
+
+        await _service.IngestAsync("agent-1", events1, CancellationToken.None);
+        await Task.Delay(100);
+
+        _timeProvider.Advance(TimeSpan.FromHours(1));
+        var laterTime = _timeProvider.GetUtcNow();
+
+        var events2 = new List<RuntimeMethodEvent>
+        {
+            CreateEvent("symbol-2", "Method2", laterTime)
+        };
+
+        await _service.IngestAsync("agent-1", events2, CancellationToken.None);
+        await Task.Delay(100);
+
+        var recentObservations = _service.GetObservationsSince(baseTime.AddMinutes(30));
+        recentObservations.Should().HaveCount(1);
+        recentObservations[0].SymbolId.Should().Be("symbol-2");
+    }
+
+    [Fact]
+    public async Task GetStatistics_ReturnsCorrectCounts()
+    {
+        var events1 = CreateEvents(5);
+        var events2 = CreateEvents(3);
+
+        await _service.IngestAsync("agent-1", events1, CancellationToken.None);
+        await _service.IngestAsync("agent-1", events2, CancellationToken.None);
+        await Task.Delay(100);
+
+        var stats = _service.GetStatistics();
+        stats.TotalEventsIngested.Should().Be(8);
+        stats.TotalBatchesProcessed.Should().Be(2);
+        stats.UniqueSymbolsObserved.Should().BeGreaterThan(0);
+    }
+
+    [Fact]
+    public async Task RegisterAgentAsync_DoesNotThrow()
+    {
+        var registration = new AgentRegistration
+        {
+            AgentId = "agent-1",
+            Platform = RuntimePlatform.DotNet,
+            Hostname = "host1",
+            AgentVersion = "1.0.0",
+            RegisteredAt = _timeProvider.GetUtcNow(),
+            LastHeartbeat = _timeProvider.GetUtcNow()
+        };
+
+        await _service.RegisterAgentAsync(registration, CancellationToken.None);
+    }
+
+    [Fact]
+    public async Task HeartbeatAsync_DoesNotThrow()
+    {
+        var stats = CreateStatistics("agent-1", 100);
+        await _service.HeartbeatAsync("agent-1", stats, CancellationToken.None);
+    }
+
+    [Fact]
+    public async Task UnregisterAgentAsync_DoesNotThrow()
+    {
+        await _service.UnregisterAgentAsync("agent-1", CancellationToken.None);
+    }
+
+    private List<RuntimeMethodEvent> CreateEvents(int count)
+    {
+        var now = _timeProvider.GetUtcNow();
+        return Enumerable.Range(0, count)
+            .Select(i => CreateEvent($"symbol-{i}", $"Method{i}", now.AddMilliseconds(i)))
+            .ToList();
+    }
+
+    private AgentStatistics CreateStatistics(string agentId, long eventsCollected)
+    {
+        return new AgentStatistics
+        {
+            AgentId = agentId,
+            Timestamp = _timeProvider.GetUtcNow(),
+            State = AgentState.Running,
+            Uptime = TimeSpan.FromMinutes(5),
+            TotalEventsCollected = eventsCollected,
+            EventsLastMinute = Math.Min(eventsCollected, 1000),
+            EventsDropped = 0,
+            UniqueMethodsObserved = (int)(eventsCollected / 10),
+            UniqueTypesObserved = (int)(eventsCollected / 100),
+            UniqueAssembliesObserved = 5,
+            BufferUtilizationPercent = 25.0,
+            EstimatedCpuOverheadPercent = 1.5,
+            MemoryUsageBytes = 50_000_000
+        };
+    }
+
+    private static RuntimeMethodEvent CreateEvent(string symbolId, string methodName, DateTimeOffset timestamp)
+    {
+        return new RuntimeMethodEvent
+        {
+            EventId = Guid.NewGuid().ToString("N"),
+            SymbolId = symbolId,
+            MethodName = methodName,
+            TypeName = "TestType",
+            AssemblyOrModule = "TestAssembly",
+            Timestamp = timestamp,
+            Kind = RuntimeEventKind.MethodEnter,
+            Platform = RuntimePlatform.DotNet
+        };
+    }
+}

src/__Libraries/StellaOps.AdvisoryAI.Attestation/AiAttestationService.cs

@@ -0,0 +1,274 @@
+// <copyright file="AiAttestationService.cs" company="StellaOps">
+// Copyright (c) StellaOps. Licensed under the AGPL-3.0-or-later.
+// </copyright>
+
+using System.Collections.Concurrent;
+using System.Text.Json;
+using Microsoft.Extensions.Logging;
+using StellaOps.AdvisoryAI.Attestation.Models;
+
+namespace StellaOps.AdvisoryAI.Attestation;
+
+/// <summary>
+/// In-memory implementation of AI attestation service.
+/// Sprint: SPRINT_20260109_011_001 Task: AIAT-003
+/// </summary>
+/// <remarks>
+/// This implementation stores attestations in memory. For production,
+/// use a database-backed implementation with signing integration.
+/// </remarks>
+public sealed class AiAttestationService : IAiAttestationService
+{
+    private readonly TimeProvider _timeProvider;
+    private readonly ILogger<AiAttestationService> _logger;
+    private readonly ConcurrentDictionary<string, StoredAttestation> _runAttestations = new();
+    private readonly ConcurrentDictionary<string, StoredAttestation> _claimAttestations = new();
+
+    public AiAttestationService(
+        TimeProvider timeProvider,
+        ILogger<AiAttestationService> logger)
+    {
+        _timeProvider = timeProvider;
+        _logger = logger;
+    }
+
+    /// <inheritdoc/>
+    public Task<AiAttestationResult> CreateRunAttestationAsync(
+        AiRunAttestation attestation,
+        bool sign = true,
+        CancellationToken ct = default)
+    {
+        var now = _timeProvider.GetUtcNow();
+        var digest = attestation.ComputeDigest();
+        var json = JsonSerializer.Serialize(attestation, AiAttestationJsonContext.Default.AiRunAttestation);
+
+        // In production, this would call the signer service
+        string? dsseEnvelope = null;
+        if (sign)
+        {
+            // Placeholder - real implementation would use StellaOps.Signer
+            dsseEnvelope = CreateMockDsseEnvelope(AiRunAttestation.PredicateType, json);
+        }
+
+        var stored = new StoredAttestation(
+            attestation.RunId,
+            AiRunAttestation.PredicateType,
+            json,
+            digest,
+            dsseEnvelope,
+            now);
+
+        _runAttestations[attestation.RunId] = stored;
+
+        _logger.LogInformation(
+            "Created run attestation {RunId} with digest {Digest}, signed={Signed}",
+            attestation.RunId,
+            digest,
+            sign);
+
+        return Task.FromResult(new AiAttestationResult
+        {
+            AttestationId = attestation.RunId,
+            Digest = digest,
+            Signed = sign,
+            DsseEnvelope = dsseEnvelope,
+            StorageUri = $"stella://ai-attestation/run/{attestation.RunId}",
+            CreatedAt = now
+        });
+    }
+
+    /// <inheritdoc/>
+    public Task<AiAttestationResult> CreateClaimAttestationAsync(
+        AiClaimAttestation attestation,
+        bool sign = true,
+        CancellationToken ct = default)
+    {
+        var now = _timeProvider.GetUtcNow();
+        var digest = attestation.ComputeDigest();
+        var json = JsonSerializer.Serialize(attestation, AiAttestationJsonContext.Default.AiClaimAttestation);
+
+        string? dsseEnvelope = null;
+        if (sign)
+        {
+            dsseEnvelope = CreateMockDsseEnvelope(AiClaimAttestation.PredicateType, json);
+        }
+
+        var stored = new StoredAttestation(
+            attestation.ClaimId,
+            AiClaimAttestation.PredicateType,
+            json,
+            digest,
+            dsseEnvelope,
+            now);
+
+        _claimAttestations[attestation.ClaimId] = stored;
+
+        _logger.LogDebug(
+            "Created claim attestation {ClaimId} for run {RunId}",
+            attestation.ClaimId,
+            attestation.RunId);
+
+        return Task.FromResult(new AiAttestationResult
+        {
+            AttestationId = attestation.ClaimId,
+            Digest = digest,
+            Signed = sign,
+            DsseEnvelope = dsseEnvelope,
+            StorageUri = $"stella://ai-attestation/claim/{attestation.ClaimId}",
+            CreatedAt = now
+        });
+    }
+
+    /// <inheritdoc/>
+    public Task<AiAttestationVerificationResult> VerifyRunAttestationAsync(
+        string runId,
+        CancellationToken ct = default)
+    {
+        var now = _timeProvider.GetUtcNow();
+
+        if (!_runAttestations.TryGetValue(runId, out var stored))
+        {
+            return Task.FromResult(AiAttestationVerificationResult.Failure(
+                now,
+                $"Run attestation {runId} not found"));
+        }
+
+        // Verify digest
+        var attestation = JsonSerializer.Deserialize(
+            stored.Json,
+            AiAttestationJsonContext.Default.AiRunAttestation);
+
+        if (attestation == null)
+        {
+            return Task.FromResult(AiAttestationVerificationResult.Failure(
+                now,
+                "Failed to deserialize attestation"));
+        }
+
+        var computedDigest = attestation.ComputeDigest();
+        if (computedDigest != stored.Digest)
+        {
+            return Task.FromResult(AiAttestationVerificationResult.Failure(
+                now,
+                "Digest mismatch",
+                digestValid: false));
+        }
+
+        // In production, verify signature via signer service
+        bool? signatureValid = stored.DsseEnvelope != null ? true : null;
+
+        _logger.LogDebug("Verified run attestation {RunId}", runId);
+
+        return Task.FromResult(AiAttestationVerificationResult.Success(
+            now,
+            stored.DsseEnvelope != null ? "ai-attestation-key" : null));
+    }
+
+    /// <inheritdoc/>
+    public Task<AiAttestationVerificationResult> VerifyClaimAttestationAsync(
+        string claimId,
+        CancellationToken ct = default)
+    {
+        var now = _timeProvider.GetUtcNow();
+
+        if (!_claimAttestations.TryGetValue(claimId, out var stored))
+        {
+            return Task.FromResult(AiAttestationVerificationResult.Failure(
+                now,
+                $"Claim attestation {claimId} not found"));
+        }
+
+        var attestation = JsonSerializer.Deserialize(
+            stored.Json,
+            AiAttestationJsonContext.Default.AiClaimAttestation);
+
+        if (attestation == null)
+        {
+            return Task.FromResult(AiAttestationVerificationResult.Failure(
+                now,
+                "Failed to deserialize attestation"));
+        }
+
+        var computedDigest = attestation.ComputeDigest();
+        if (computedDigest != stored.Digest)
+        {
+            return Task.FromResult(AiAttestationVerificationResult.Failure(
+                now,
+                "Digest mismatch",
+                digestValid: false));
+        }
+
+        return Task.FromResult(AiAttestationVerificationResult.Success(
+            now,
+            stored.DsseEnvelope != null ? "ai-attestation-key" : null));
+    }
+
+    /// <inheritdoc/>
+    public Task<AiRunAttestation?> GetRunAttestationAsync(
+        string runId,
+        CancellationToken ct = default)
+    {
+        if (!_runAttestations.TryGetValue(runId, out var stored))
+        {
+            return Task.FromResult<AiRunAttestation?>(null);
+        }
+
+        var attestation = JsonSerializer.Deserialize(
+            stored.Json,
+            AiAttestationJsonContext.Default.AiRunAttestation);
+
+        return Task.FromResult(attestation);
+    }
+
+    /// <inheritdoc/>
+    public Task<IReadOnlyList<AiClaimAttestation>> GetClaimAttestationsAsync(
+        string runId,
+        CancellationToken ct = default)
+    {
+        var claims = _claimAttestations.Values
+            .Select(s => JsonSerializer.Deserialize(s.Json, AiAttestationJsonContext.Default.AiClaimAttestation))
+            .Where(c => c != null && c.RunId == runId)
+            .Cast<AiClaimAttestation>()
+            .ToList();
+
+        return Task.FromResult<IReadOnlyList<AiClaimAttestation>>(claims);
+    }
+
+    /// <inheritdoc/>
+    public Task<IReadOnlyList<AiRunAttestation>> ListRecentAttestationsAsync(
+        string tenantId,
+        int limit = 100,
+        CancellationToken ct = default)
+    {
+        var attestations = _runAttestations.Values
+            .OrderByDescending(s => s.CreatedAt)
+            .Select(s => JsonSerializer.Deserialize(s.Json, AiAttestationJsonContext.Default.AiRunAttestation))
+            .Where(a => a != null && a.TenantId == tenantId)
+            .Cast<AiRunAttestation>()
+            .Take(limit)
+            .ToList();
+
+        return Task.FromResult<IReadOnlyList<AiRunAttestation>>(attestations);
+    }
+
+    private static string CreateMockDsseEnvelope(string predicateType, string payload)
+    {
+        // Mock DSSE envelope - real implementation would use StellaOps.Signer
+        var payloadBase64 = Convert.ToBase64String(System.Text.Encoding.UTF8.GetBytes(payload));
+        return $$"""
+            {
+                "payloadType": "{{predicateType}}",
+                "payload": "{{payloadBase64}}",
+                "signatures": [{"sig": "mock-signature"}]
+            }
+            """;
+    }
+
+    private sealed record StoredAttestation(
+        string Id,
+        string PredicateType,
+        string Json,
+        string Digest,
+        string? DsseEnvelope,
+        DateTimeOffset CreatedAt);
+}

src/__Libraries/StellaOps.AdvisoryAI.Attestation/AiAttestationServiceExtensions.cs

@@ -0,0 +1,58 @@
+// <copyright file="AiAttestationServiceExtensions.cs" company="StellaOps">
+// Copyright (c) StellaOps. Licensed under the AGPL-3.0-or-later.
+// </copyright>
+
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.DependencyInjection.Extensions;
+using StellaOps.AdvisoryAI.Attestation.Storage;
+
+namespace StellaOps.AdvisoryAI.Attestation;
+
+/// <summary>
+/// Extension methods for registering AI attestation services.
+/// Sprint: SPRINT_20260109_011_001
+/// </summary>
+public static class AiAttestationServiceExtensions
+{
+    /// <summary>
+    /// Adds AI attestation services to the service collection.
+    /// </summary>
+    /// <param name="services">The service collection.</param>
+    /// <returns>The service collection for chaining.</returns>
+    public static IServiceCollection AddAiAttestationServices(this IServiceCollection services)
+    {
+        services.TryAddSingleton(TimeProvider.System);
+        services.TryAddSingleton<IPromptTemplateRegistry, PromptTemplateRegistry>();
+        services.TryAddSingleton<IAiAttestationService, AiAttestationService>();
+
+        return services;
+    }
+
+    /// <summary>
+    /// Adds AI attestation services with a custom time provider.
+    /// </summary>
+    /// <param name="services">The service collection.</param>
+    /// <param name="timeProvider">The time provider to use.</param>
+    /// <returns>The service collection for chaining.</returns>
+    public static IServiceCollection AddAiAttestationServices(
+        this IServiceCollection services,
+        TimeProvider timeProvider)
+    {
+        services.AddSingleton(timeProvider);
+        services.TryAddSingleton<IPromptTemplateRegistry, PromptTemplateRegistry>();
+        services.TryAddSingleton<IAiAttestationService, AiAttestationService>();
+
+        return services;
+    }
+
+    /// <summary>
+    /// Adds in-memory attestation storage. Useful for testing and development.
+    /// </summary>
+    /// <param name="services">The service collection.</param>
+    /// <returns>The service collection for chaining.</returns>
+    public static IServiceCollection AddInMemoryAiAttestationStore(this IServiceCollection services)
+    {
+        services.TryAddSingleton<IAiAttestationStore, InMemoryAiAttestationStore>();
+        return services;
+    }
+}

src/__Libraries/StellaOps.AdvisoryAI.Attestation/IAiAttestationService.cs

@@ -0,0 +1,173 @@
+// <copyright file="IAiAttestationService.cs" company="StellaOps">
+// Copyright (c) StellaOps. Licensed under the AGPL-3.0-or-later.
+// </copyright>
+
+using StellaOps.AdvisoryAI.Attestation.Models;
+
+namespace StellaOps.AdvisoryAI.Attestation;
+
+/// <summary>
+/// Service for creating and verifying AI attestations.
+/// Sprint: SPRINT_20260109_011_001 Task: AIAT-002
+/// </summary>
+public interface IAiAttestationService
+{
+    /// <summary>
+    /// Creates an attestation for an AI run.
+    /// </summary>
+    /// <param name="attestation">The attestation to create.</param>
+    /// <param name="sign">Whether to sign the attestation.</param>
+    /// <param name="ct">Cancellation token.</param>
+    /// <returns>The created attestation with optional signature.</returns>
+    Task<AiAttestationResult> CreateRunAttestationAsync(
+        AiRunAttestation attestation,
+        bool sign = true,
+        CancellationToken ct = default);
+
+    /// <summary>
+    /// Creates an attestation for a specific claim.
+    /// </summary>
+    /// <param name="attestation">The claim attestation to create.</param>
+    /// <param name="sign">Whether to sign the attestation.</param>
+    /// <param name="ct">Cancellation token.</param>
+    /// <returns>The created attestation with optional signature.</returns>
+    Task<AiAttestationResult> CreateClaimAttestationAsync(
+        AiClaimAttestation attestation,
+        bool sign = true,
+        CancellationToken ct = default);
+
+    /// <summary>
+    /// Verifies an AI run attestation.
+    /// </summary>
+    /// <param name="runId">The run ID to verify.</param>
+    /// <param name="ct">Cancellation token.</param>
+    /// <returns>Verification result.</returns>
+    Task<AiAttestationVerificationResult> VerifyRunAttestationAsync(
+        string runId,
+        CancellationToken ct = default);
+
+    /// <summary>
+    /// Verifies a claim attestation.
+    /// </summary>
+    /// <param name="claimId">The claim ID to verify.</param>
+    /// <param name="ct">Cancellation token.</param>
+    /// <returns>Verification result.</returns>
+    Task<AiAttestationVerificationResult> VerifyClaimAttestationAsync(
+        string claimId,
+        CancellationToken ct = default);
+
+    /// <summary>
+    /// Gets a run attestation by ID.
+    /// </summary>
+    /// <param name="runId">The run ID.</param>
+    /// <param name="ct">Cancellation token.</param>
+    /// <returns>The attestation if found.</returns>
+    Task<AiRunAttestation?> GetRunAttestationAsync(
+        string runId,
+        CancellationToken ct = default);
+
+    /// <summary>
+    /// Gets claim attestations for a run.
+    /// </summary>
+    /// <param name="runId">The run ID.</param>
+    /// <param name="ct">Cancellation token.</param>
+    /// <returns>All claim attestations for the run.</returns>
+    Task<IReadOnlyList<AiClaimAttestation>> GetClaimAttestationsAsync(
+        string runId,
+        CancellationToken ct = default);
+
+    /// <summary>
+    /// Lists recent run attestations.
+    /// </summary>
+    /// <param name="tenantId">Tenant filter.</param>
+    /// <param name="limit">Maximum results.</param>
+    /// <param name="ct">Cancellation token.</param>
+    /// <returns>Recent attestations.</returns>
+    Task<IReadOnlyList<AiRunAttestation>> ListRecentAttestationsAsync(
+        string tenantId,
+        int limit = 100,
+        CancellationToken ct = default);
+}
+
+/// <summary>
+/// Result of creating an attestation.
+/// </summary>
+public sealed record AiAttestationResult
+{
+    /// <summary>Attestation ID.</summary>
+    public required string AttestationId { get; init; }
+
+    /// <summary>Content digest.</summary>
+    public required string Digest { get; init; }
+
+    /// <summary>Whether the attestation was signed.</summary>
+    public bool Signed { get; init; }
+
+    /// <summary>DSSE envelope if signed.</summary>
+    public string? DsseEnvelope { get; init; }
+
+    /// <summary>Storage URI.</summary>
+    public string? StorageUri { get; init; }
+
+    /// <summary>Creation timestamp.</summary>
+    public required DateTimeOffset CreatedAt { get; init; }
+}
+
+/// <summary>
+/// Result of verifying an attestation.
+/// </summary>
+public sealed record AiAttestationVerificationResult
+{
+    /// <summary>Whether verification succeeded.</summary>
+    public required bool Valid { get; init; }
+
+    /// <summary>Verification timestamp.</summary>
+    public required DateTimeOffset VerifiedAt { get; init; }
+
+    /// <summary>Signing key ID if signed.</summary>
+    public string? SigningKeyId { get; init; }
+
+    /// <summary>Key expiration if applicable.</summary>
+    public DateTimeOffset? KeyExpiresAt { get; init; }
+
+    /// <summary>Digest verification result.</summary>
+    public bool DigestValid { get; init; }
+
+    /// <summary>Signature verification result.</summary>
+    public bool? SignatureValid { get; init; }
+
+    /// <summary>Verification failure reason if invalid.</summary>
+    public string? FailureReason { get; init; }
+
+    /// <summary>
+    /// Creates a successful verification result.
+    /// </summary>
+    public static AiAttestationVerificationResult Success(
+        DateTimeOffset verifiedAt,
+        string? signingKeyId = null,
+        DateTimeOffset? keyExpiresAt = null) => new()
+    {
+        Valid = true,
+        VerifiedAt = verifiedAt,
+        SigningKeyId = signingKeyId,
+        KeyExpiresAt = keyExpiresAt,
+        DigestValid = true,
+        SignatureValid = signingKeyId != null ? true : null
+    };
+
+    /// <summary>
+    /// Creates a failed verification result.
+    /// </summary>
+    public static AiAttestationVerificationResult Failure(
+        DateTimeOffset verifiedAt,
+        string reason,
+        bool digestValid = false,
+        bool? signatureValid = null) => new()
+    {
+        Valid = false,
+        VerifiedAt = verifiedAt,
+        DigestValid = digestValid,
+        SignatureValid = signatureValid,
+        FailureReason = reason
+    };
+}

src/__Libraries/StellaOps.AdvisoryAI.Attestation/Models/AiAttestationJsonContext.cs

@@ -0,0 +1,28 @@
+// <copyright file="AiAttestationJsonContext.cs" company="StellaOps">
+// Copyright (c) StellaOps. Licensed under the AGPL-3.0-or-later.
+// </copyright>
+
+using System.Text.Json.Serialization;
+
+namespace StellaOps.AdvisoryAI.Attestation.Models;
+
+/// <summary>
+/// JSON source generation context for AI attestation models.
+/// Sprint: SPRINT_20260109_011_001 Task: AIAT-001
+/// </summary>
+[JsonSourceGenerationOptions(
+    WriteIndented = false,
+    PropertyNamingPolicy = JsonKnownNamingPolicy.CamelCase,
+    DefaultIgnoreCondition = JsonIgnoreCondition.WhenWritingNull)]
+[JsonSerializable(typeof(AiRunAttestation))]
+[JsonSerializable(typeof(AiClaimAttestation))]
+[JsonSerializable(typeof(AiTurnSummary))]
+[JsonSerializable(typeof(AiModelInfo))]
+[JsonSerializable(typeof(AiModelParameters))]
+[JsonSerializable(typeof(PromptTemplateInfo))]
+[JsonSerializable(typeof(ClaimEvidence))]
+[JsonSerializable(typeof(AiRunContext))]
+[JsonSerializable(typeof(ToolCallSummary))]
+public partial class AiAttestationJsonContext : JsonSerializerContext
+{
+}

src/__Libraries/StellaOps.AdvisoryAI.Attestation/Models/AiClaimAttestation.cs

@@ -0,0 +1,139 @@
+// <copyright file="AiClaimAttestation.cs" company="StellaOps">
+// Copyright (c) StellaOps. Licensed under the AGPL-3.0-or-later.
+// </copyright>
+
+using System.Collections.Immutable;
+using System.Security.Cryptography;
+using System.Text;
+using System.Text.Json;
+using System.Text.Json.Serialization;
+
+namespace StellaOps.AdvisoryAI.Attestation.Models;
+
+/// <summary>
+/// Attestation for a specific AI claim, providing fine-grained provenance.
+/// Sprint: SPRINT_20260109_011_001 Task: AIAT-001
+/// </summary>
+/// <remarks>
+/// While AiRunAttestation captures the full run, AiClaimAttestation allows
+/// individual claims to be attested separately. This enables:
+/// - Granular trust verification
+/// - Claim-specific evidence linkage
+/// - Selective claim citation in reports
+/// </remarks>
+public sealed record AiClaimAttestation
+{
+    /// <summary>Attestation type URI.</summary>
+    public const string PredicateType = "https://stellaops.org/attestation/ai-claim/v1";
+
+    /// <summary>Unique claim identifier.</summary>
+    [JsonPropertyName("claimId")]
+    public required string ClaimId { get; init; }
+
+    /// <summary>Parent run ID.</summary>
+    [JsonPropertyName("runId")]
+    public required string RunId { get; init; }
+
+    /// <summary>Turn ID where claim was made.</summary>
+    [JsonPropertyName("turnId")]
+    public required string TurnId { get; init; }
+
+    /// <summary>Tenant identifier.</summary>
+    [JsonPropertyName("tenantId")]
+    public required string TenantId { get; init; }
+
+    /// <summary>The claim text.</summary>
+    [JsonPropertyName("claimText")]
+    public required string ClaimText { get; init; }
+
+    /// <summary>SHA-256 hash of the claim text.</summary>
+    [JsonPropertyName("claimDigest")]
+    public required string ClaimDigest { get; init; }
+
+    /// <summary>Claim category.</summary>
+    [JsonPropertyName("category")]
+    public ClaimCategory Category { get; init; } = ClaimCategory.Factual;
+
+    /// <summary>Evidence URIs grounding this claim.</summary>
+    [JsonPropertyName("groundedBy")]
+    public ImmutableArray<string> GroundedBy { get; init; } = [];
+
+    /// <summary>Grounding confidence score.</summary>
+    [JsonPropertyName("groundingScore")]
+    public double GroundingScore { get; init; }
+
+    /// <summary>Whether the claim was verified.</summary>
+    [JsonPropertyName("verified")]
+    public bool Verified { get; init; }
+
+    /// <summary>Verification method used.</summary>
+    [JsonPropertyName("verificationMethod")]
+    public string? VerificationMethod { get; init; }
+
+    /// <summary>Claim timestamp.</summary>
+    [JsonPropertyName("timestamp")]
+    public required DateTimeOffset Timestamp { get; init; }
+
+    /// <summary>Context information.</summary>
+    [JsonPropertyName("context")]
+    public AiRunContext? Context { get; init; }
+
+    /// <summary>Content digest for this attestation.</summary>
+    [JsonPropertyName("contentDigest")]
+    public required string ContentDigest { get; init; }
+
+    /// <summary>Claim type category.</summary>
+    [JsonPropertyName("claimType")]
+    public string? ClaimType { get; init; }
+
+    /// <summary>
+    /// Computes the content digest for this attestation.
+    /// </summary>
+    public string ComputeDigest()
+    {
+        var json = JsonSerializer.Serialize(this, AiAttestationJsonContext.Default.AiClaimAttestation);
+        var hash = SHA256.HashData(Encoding.UTF8.GetBytes(json));
+        return $"sha256:{Convert.ToHexString(hash).ToLowerInvariant()}";
+    }
+
+    /// <summary>
+    /// Creates a claim attestation from a claim evidence.
+    /// </summary>
+    public static AiClaimAttestation FromClaimEvidence(
+        ClaimEvidence evidence,
+        string runId,
+        string turnId,
+        string tenantId,
+        DateTimeOffset timestamp,
+        AiRunContext? context = null)
+    {
+        var claimDigest = ComputeClaimDigest(evidence.Text);
+        var claimId = $"claim-{Guid.NewGuid():N}";
+
+        var attestation = new AiClaimAttestation
+        {
+            ClaimId = claimId,
+            RunId = runId,
+            TurnId = turnId,
+            TenantId = tenantId,
+            ClaimText = evidence.Text,
+            ClaimDigest = claimDigest,
+            Category = evidence.Category,
+            GroundedBy = evidence.GroundedBy,
+            GroundingScore = evidence.GroundingScore,
+            Verified = evidence.Verified,
+            Timestamp = timestamp,
+            Context = context,
+            ContentDigest = "" // Placeholder, computed below
+        };
+
+        // Now compute the actual content digest
+        return attestation with { ContentDigest = attestation.ComputeDigest() };
+    }
+
+    private static string ComputeClaimDigest(string claimText)
+    {
+        var hash = SHA256.HashData(Encoding.UTF8.GetBytes(claimText));
+        return $"sha256:{Convert.ToHexString(hash).ToLowerInvariant()}";
+    }
+}

src/__Libraries/StellaOps.AdvisoryAI.Attestation/Models/AiModelInfo.cs

@@ -0,0 +1,52 @@
+// <copyright file="AiModelInfo.cs" company="StellaOps">
+// Copyright (c) StellaOps. Licensed under the AGPL-3.0-or-later.
+// </copyright>
+
+using System.Text.Json.Serialization;
+
+namespace StellaOps.AdvisoryAI.Attestation.Models;
+
+/// <summary>
+/// Information about the AI model used in a run.
+/// Sprint: SPRINT_20260109_011_001 Task: AIAT-001
+/// </summary>
+public sealed record AiModelInfo
+{
+    /// <summary>Model provider (e.g., "anthropic", "openai", "local").</summary>
+    [JsonPropertyName("provider")]
+    public required string Provider { get; init; }
+
+    /// <summary>Model identifier (e.g., "claude-3-sonnet", "gpt-4o").</summary>
+    [JsonPropertyName("modelId")]
+    public required string ModelId { get; init; }
+
+    /// <summary>Model version or digest for reproducibility.</summary>
+    [JsonPropertyName("digest")]
+    public string? Digest { get; init; }
+
+    /// <summary>Model parameters used (temperature, etc.).</summary>
+    [JsonPropertyName("parameters")]
+    public AiModelParameters? Parameters { get; init; }
+}
+
+/// <summary>
+/// Model inference parameters.
+/// </summary>
+public sealed record AiModelParameters
+{
+    /// <summary>Sampling temperature.</summary>
+    [JsonPropertyName("temperature")]
+    public double? Temperature { get; init; }
+
+    /// <summary>Top-p nucleus sampling.</summary>
+    [JsonPropertyName("topP")]
+    public double? TopP { get; init; }
+
+    /// <summary>Maximum tokens to generate.</summary>
+    [JsonPropertyName("maxTokens")]
+    public int? MaxTokens { get; init; }
+
+    /// <summary>Random seed for reproducibility.</summary>
+    [JsonPropertyName("seed")]
+    public long? Seed { get; init; }
+}

src/__Libraries/StellaOps.AdvisoryAI.Attestation/Models/AiRunAttestation.cs

@@ -0,0 +1,118 @@
+// <copyright file="AiRunAttestation.cs" company="StellaOps">
+// Copyright (c) StellaOps. Licensed under the AGPL-3.0-or-later.
+// </copyright>
+
+using System.Collections.Immutable;
+using System.Security.Cryptography;
+using System.Text;
+using System.Text.Json;
+using System.Text.Json.Serialization;
+
+namespace StellaOps.AdvisoryAI.Attestation.Models;
+
+/// <summary>
+/// Attestation for an AI run, containing signed proof of AI-generated content.
+/// Sprint: SPRINT_20260109_011_001 Task: AIAT-001
+/// </summary>
+/// <remarks>
+/// This attestation captures everything needed to verify and reproduce an AI run:
+/// - Who ran it (tenant, user)
+/// - What model was used
+/// - What prompt template was used
+/// - What context was provided
+/// - What was said (content digests)
+/// - What claims were made and their grounding evidence
+/// </remarks>
+public sealed record AiRunAttestation
+{
+    /// <summary>Attestation type URI.</summary>
+    public const string PredicateType = "https://stellaops.org/attestation/ai-run/v1";
+
+    /// <summary>Unique run identifier.</summary>
+    [JsonPropertyName("runId")]
+    public required string RunId { get; init; }
+
+    /// <summary>Tenant identifier.</summary>
+    [JsonPropertyName("tenantId")]
+    public required string TenantId { get; init; }
+
+    /// <summary>User identifier.</summary>
+    [JsonPropertyName("userId")]
+    public required string UserId { get; init; }
+
+    /// <summary>Conversation ID (for multi-run conversations).</summary>
+    [JsonPropertyName("conversationId")]
+    public string? ConversationId { get; init; }
+
+    /// <summary>Run start timestamp.</summary>
+    [JsonPropertyName("startedAt")]
+    public required DateTimeOffset StartedAt { get; init; }
+
+    /// <summary>Run completion timestamp.</summary>
+    [JsonPropertyName("completedAt")]
+    public required DateTimeOffset CompletedAt { get; init; }
+
+    /// <summary>Model information.</summary>
+    [JsonPropertyName("model")]
+    public required AiModelInfo Model { get; init; }
+
+    /// <summary>Prompt template information.</summary>
+    [JsonPropertyName("promptTemplate")]
+    public PromptTemplateInfo? PromptTemplate { get; init; }
+
+    /// <summary>Context information.</summary>
+    [JsonPropertyName("context")]
+    public AiRunContext? Context { get; init; }
+
+    /// <summary>Turn summaries.</summary>
+    [JsonPropertyName("turns")]
+    public ImmutableArray<AiTurnSummary> Turns { get; init; } = [];
+
+    /// <summary>Overall grounding score (0.0 to 1.0).</summary>
+    [JsonPropertyName("overallGroundingScore")]
+    public double OverallGroundingScore { get; init; }
+
+    /// <summary>Total tokens used.</summary>
+    [JsonPropertyName("totalTokens")]
+    public int TotalTokens { get; init; }
+
+    /// <summary>Run status.</summary>
+    [JsonPropertyName("status")]
+    public AiRunStatus Status { get; init; } = AiRunStatus.Completed;
+
+    /// <summary>Error message if failed.</summary>
+    [JsonPropertyName("errorMessage")]
+    public string? ErrorMessage { get; init; }
+
+    /// <summary>
+    /// Computes the content digest for this attestation.
+    /// </summary>
+    public string ComputeDigest()
+    {
+        var json = JsonSerializer.Serialize(this, AiAttestationJsonContext.Default.AiRunAttestation);
+        var hash = SHA256.HashData(Encoding.UTF8.GetBytes(json));
+        return $"sha256:{Convert.ToHexString(hash).ToLowerInvariant()}";
+    }
+}
+
+/// <summary>
+/// AI run status.
+/// </summary>
+[JsonConverter(typeof(JsonStringEnumConverter<AiRunStatus>))]
+public enum AiRunStatus
+{
+    /// <summary>Run completed successfully.</summary>
+    Completed,
+
+    /// <summary>Run failed.</summary>
+    Failed,
+
+    /// <summary>Run was cancelled.</summary>
+    Cancelled,
+
+    /// <summary>Run timed out.</summary>
+    TimedOut,
+
+    /// <summary>Run was blocked by guardrails.</summary>
+    Blocked
+}

src/__Libraries/StellaOps.AdvisoryAI.Attestation/Models/AiRunContext.cs

@@ -0,0 +1,48 @@
+// <copyright file="AiRunContext.cs" company="StellaOps">
+// Copyright (c) StellaOps. Licensed under the AGPL-3.0-or-later.
+// </copyright>
+
+using System.Collections.Immutable;
+using System.Text.Json.Serialization;
+
+namespace StellaOps.AdvisoryAI.Attestation.Models;
+
+/// <summary>
+/// Context information for an AI run.
+/// Sprint: SPRINT_20260109_011_001 Task: AIAT-001
+/// </summary>
+public sealed record AiRunContext
+{
+    /// <summary>Finding ID if analyzing a finding.</summary>
+    [JsonPropertyName("findingId")]
+    public string? FindingId { get; init; }
+
+    /// <summary>CVE ID if relevant.</summary>
+    [JsonPropertyName("cveId")]
+    public string? CveId { get; init; }
+
+    /// <summary>Component PURL if relevant.</summary>
+    [JsonPropertyName("component")]
+    public string? Component { get; init; }
+
+    /// <summary>Image digest if analyzing an image.</summary>
+    [JsonPropertyName("imageDigest")]
+    public string? ImageDigest { get; init; }
+
+    /// <summary>SBOM ID if referenced.</summary>
+    [JsonPropertyName("sbomId")]
+    public string? SbomId { get; init; }
+
+    /// <summary>Policy ID if relevant.</summary>
+    [JsonPropertyName("policyId")]
+    public string? PolicyId { get; init; }
+
+    /// <summary>Additional context key-value pairs.</summary>
+    [JsonPropertyName("metadata")]
+    public ImmutableDictionary<string, string> Metadata { get; init; } =
+        ImmutableDictionary<string, string>.Empty;
+
+    /// <summary>Evidence URIs used as grounding context.</summary>
+    [JsonPropertyName("evidenceUris")]
+    public ImmutableArray<string> EvidenceUris { get; init; } = [];
+}

src/__Libraries/StellaOps.AdvisoryAI.Attestation/Models/AiTurnSummary.cs

@@ -0,0 +1,92 @@
+// <copyright file="AiTurnSummary.cs" company="StellaOps">
+// Copyright (c) StellaOps. Licensed under the AGPL-3.0-or-later.
+// </copyright>
+
+using System.Collections.Immutable;
+using System.Text.Json.Serialization;
+
+namespace StellaOps.AdvisoryAI.Attestation.Models;
+
+/// <summary>
+/// Summary of a single turn in an AI conversation.
+/// Sprint: SPRINT_20260109_011_001 Task: AIAT-001
+/// </summary>
+public sealed record AiTurnSummary
+{
+    /// <summary>Unique turn identifier.</summary>
+    [JsonPropertyName("turnId")]
+    public required string TurnId { get; init; }
+
+    /// <summary>Turn role (user, assistant, system).</summary>
+    [JsonPropertyName("role")]
+    public required TurnRole Role { get; init; }
+
+    /// <summary>SHA-256 hash of the turn content.</summary>
+    [JsonPropertyName("contentDigest")]
+    public required string ContentDigest { get; init; }
+
+    /// <summary>Turn timestamp.</summary>
+    [JsonPropertyName("timestamp")]
+    public required DateTimeOffset Timestamp { get; init; }
+
+    /// <summary>Token count for this turn.</summary>
+    [JsonPropertyName("tokenCount")]
+    public int TokenCount { get; init; }
+
+    /// <summary>Claims made in this turn (for assistant turns).</summary>
+    [JsonPropertyName("claims")]
+    public ImmutableArray<ClaimEvidence> Claims { get; init; } = [];
+
+    /// <summary>Overall grounding score for assistant turns.</summary>
+    [JsonPropertyName("groundingScore")]
+    public double? GroundingScore { get; init; }
+
+    /// <summary>Tool calls made in this turn.</summary>
+    [JsonPropertyName("toolCalls")]
+    public ImmutableArray<ToolCallSummary> ToolCalls { get; init; } = [];
+}
+
+/// <summary>
+/// Turn role in conversation.
+/// </summary>
+[JsonConverter(typeof(JsonStringEnumConverter<TurnRole>))]
+public enum TurnRole
+{
+    /// <summary>User message.</summary>
+    User,
+
+    /// <summary>Assistant response.</summary>
+    Assistant,
+
+    /// <summary>System prompt.</summary>
+    System,
+
+    /// <summary>Tool response.</summary>
+    Tool
+}
+
+/// <summary>
+/// Summary of a tool call.
+/// </summary>
+public sealed record ToolCallSummary
+{
+    /// <summary>Tool name.</summary>
+    [JsonPropertyName("toolName")]
+    public required string ToolName { get; init; }
+
+    /// <summary>Hash of input arguments.</summary>
+    [JsonPropertyName("inputDigest")]
+    public required string InputDigest { get; init; }
+
+    /// <summary>Hash of output.</summary>
+    [JsonPropertyName("outputDigest")]
+    public required string OutputDigest { get; init; }
+
+    /// <summary>Tool execution duration.</summary>
+    [JsonPropertyName("durationMs")]
+    public long DurationMs { get; init; }
+
+    /// <summary>Whether the tool call succeeded.</summary>
+    [JsonPropertyName("success")]
+    public bool Success { get; init; } = true;
+}

src/__Libraries/StellaOps.AdvisoryAI.Attestation/Models/ClaimEvidence.cs

@@ -0,0 +1,68 @@
+// <copyright file="ClaimEvidence.cs" company="StellaOps">
+// Copyright (c) StellaOps. Licensed under the AGPL-3.0-or-later.
+// </copyright>
+
+using System.Collections.Immutable;
+using System.Text.Json.Serialization;
+
+namespace StellaOps.AdvisoryAI.Attestation.Models;
+
+/// <summary>
+/// Evidence grounding an AI claim.
+/// Sprint: SPRINT_20260109_011_001 Task: AIAT-001
+/// </summary>
+public sealed record ClaimEvidence
+{
+    /// <summary>The claim text.</summary>
+    [JsonPropertyName("text")]
+    public required string Text { get; init; }
+
+    /// <summary>Character position in the response.</summary>
+    [JsonPropertyName("position")]
+    public required int Position { get; init; }
+
+    /// <summary>Length of the claim text.</summary>
+    [JsonPropertyName("length")]
+    public required int Length { get; init; }
+
+    /// <summary>Evidence URIs grounding this claim (stella:// URIs).</summary>
+    [JsonPropertyName("groundedBy")]
+    public ImmutableArray<string> GroundedBy { get; init; } = [];
+
+    /// <summary>Grounding confidence score (0.0 to 1.0).</summary>
+    [JsonPropertyName("groundingScore")]
+    public double GroundingScore { get; init; }
+
+    /// <summary>Whether this claim was verified against evidence.</summary>
+    [JsonPropertyName("verified")]
+    public bool Verified { get; init; }
+
+    /// <summary>Claim category (factual, recommendation, caveat, etc.).</summary>
+    [JsonPropertyName("category")]
+    public ClaimCategory Category { get; init; } = ClaimCategory.Factual;
+}
+
+/// <summary>
+/// Categories of AI claims.
+/// </summary>
+[JsonConverter(typeof(JsonStringEnumConverter<ClaimCategory>))]
+public enum ClaimCategory
+{
+    /// <summary>Factual statement about the subject.</summary>
+    Factual,
+
+    /// <summary>Recommendation or suggested action.</summary>
+    Recommendation,
+
+    /// <summary>Caveat or limitation.</summary>
+    Caveat,
+
+    /// <summary>Explanation or reasoning.</summary>
+    Explanation,
+
+    /// <summary>Reference to documentation or resources.</summary>
+    Reference,
+
+    /// <summary>Unknown or unclassified claim.</summary>
+    Unknown
+}

src/__Libraries/StellaOps.AdvisoryAI.Attestation/Models/PromptTemplateInfo.cs

@@ -0,0 +1,30 @@
+// <copyright file="PromptTemplateInfo.cs" company="StellaOps">
+// Copyright (c) StellaOps. Licensed under the AGPL-3.0-or-later.
+// </copyright>
+
+using System.Text.Json.Serialization;
+
+namespace StellaOps.AdvisoryAI.Attestation.Models;
+
+/// <summary>
+/// Information about the prompt template used in a run.
+/// Sprint: SPRINT_20260109_011_001 Task: AIAT-001
+/// </summary>
+public sealed record PromptTemplateInfo
+{
+    /// <summary>Template name.</summary>
+    [JsonPropertyName("name")]
+    public required string Name { get; init; }
+
+    /// <summary>Template version.</summary>
+    [JsonPropertyName("version")]
+    public required string Version { get; init; }
+
+    /// <summary>Content hash for verification.</summary>
+    [JsonPropertyName("digest")]
+    public required string Digest { get; init; }
+
+    /// <summary>Template parameters used.</summary>
+    [JsonPropertyName("parameters")]
+    public IReadOnlyDictionary<string, string>? Parameters { get; init; }
+}

src/__Libraries/StellaOps.AdvisoryAI.Attestation/PromptTemplateRegistry.cs

@@ -0,0 +1,150 @@
+// <copyright file="PromptTemplateRegistry.cs" company="StellaOps">
+// Copyright (c) StellaOps. Licensed under the AGPL-3.0-or-later.
+// </copyright>
+
+using System.Collections.Concurrent;
+using System.Globalization;
+using System.Security.Cryptography;
+using System.Text;
+using Microsoft.Extensions.Logging;
+using StellaOps.AdvisoryAI.Attestation.Models;
+
+namespace StellaOps.AdvisoryAI.Attestation;
+
+/// <summary>
+/// Interface for prompt template registry.
+/// Sprint: SPRINT_20260109_011_001 Task: AIAT-004
+/// </summary>
+public interface IPromptTemplateRegistry
+{
+    /// <summary>
+    /// Registers a prompt template with version.
+    /// </summary>
+    /// <param name="name">Template name.</param>
+    /// <param name="version">Template version.</param>
+    /// <param name="template">Template content.</param>
+    void Register(string name, string version, string template);
+
+    /// <summary>
+    /// Gets template info including hash.
+    /// </summary>
+    /// <param name="name">Template name.</param>
+    /// <returns>Template info or null if not found.</returns>
+    PromptTemplateInfo? GetTemplateInfo(string name);
+
+    /// <summary>
+    /// Gets template info for a specific version.
+    /// </summary>
+    /// <param name="name">Template name.</param>
+    /// <param name="version">Template version.</param>
+    /// <returns>Template info or null if not found.</returns>
+    PromptTemplateInfo? GetTemplateInfo(string name, string version);
+
+    /// <summary>
+    /// Verifies a template hash matches registered version.
+    /// </summary>
+    /// <param name="name">Template name.</param>
+    /// <param name="expectedHash">Expected hash.</param>
+    /// <returns>True if hash matches.</returns>
+    bool VerifyHash(string name, string expectedHash);
+
+    /// <summary>
+    /// Gets all registered templates.
+    /// </summary>
+    /// <returns>All template info records.</returns>
+    IReadOnlyList<PromptTemplateInfo> GetAllTemplates();
+}
+
+/// <summary>
+/// In-memory implementation of prompt template registry.
+/// Sprint: SPRINT_20260109_011_001 Task: AIAT-004
+/// </summary>
+public sealed class PromptTemplateRegistry : IPromptTemplateRegistry
+{
+    private readonly TimeProvider _timeProvider;
+    private readonly ILogger<PromptTemplateRegistry> _logger;
+    private readonly ConcurrentDictionary<string, PromptTemplateInfo> _latestVersions = new();
+    private readonly ConcurrentDictionary<(string Name, string Version), PromptTemplateInfo> _allVersions = new();
+
+    public PromptTemplateRegistry(
+        TimeProvider timeProvider,
+        ILogger<PromptTemplateRegistry> logger)
+    {
+        _timeProvider = timeProvider;
+        _logger = logger;
+    }
+
+    /// <inheritdoc/>
+    public void Register(string name, string version, string template)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(name);
+        ArgumentException.ThrowIfNullOrWhiteSpace(version);
+        ArgumentException.ThrowIfNullOrWhiteSpace(template);
+
+        var digest = ComputeDigest(template);
+        var now = _timeProvider.GetUtcNow();
+
+        var info = new PromptTemplateInfo
+        {
+            Name = name,
+            Version = version,
+            Digest = digest
+        };
+
+        _allVersions[(name, version)] = info;
+        _latestVersions[name] = info;
+
+        _logger.LogInformation(
+            "Registered prompt template {Name} v{Version} with digest {Digest}",
+            name,
+            version,
+            digest);
+    }
+
+    /// <inheritdoc/>
+    public PromptTemplateInfo? GetTemplateInfo(string name)
+    {
+        return _latestVersions.TryGetValue(name, out var info) ? info : null;
+    }
+
+    /// <inheritdoc/>
+    public PromptTemplateInfo? GetTemplateInfo(string name, string version)
+    {
+        return _allVersions.TryGetValue((name, version), out var info) ? info : null;
+    }
+
+    /// <inheritdoc/>
+    public bool VerifyHash(string name, string expectedHash)
+    {
+        if (!_latestVersions.TryGetValue(name, out var info))
+        {
+            _logger.LogWarning("Template {Name} not found for hash verification", name);
+            return false;
+        }
+
+        var matches = string.Equals(info.Digest, expectedHash, StringComparison.OrdinalIgnoreCase);
+
+        if (!matches)
+        {
+            _logger.LogWarning(
+                "Hash mismatch for template {Name}: expected {Expected}, got {Actual}",
+                name,
+                expectedHash,
+                info.Digest);
+        }
+
+        return matches;
+    }
+
+    /// <inheritdoc/>
+    public IReadOnlyList<PromptTemplateInfo> GetAllTemplates()
+    {
+        return [.. _latestVersions.Values];
+    }
+
+    private static string ComputeDigest(string content)
+    {
+        var hash = SHA256.HashData(Encoding.UTF8.GetBytes(content));
+        return $"sha256:{Convert.ToHexString(hash).ToLowerInvariant()}";
+    }
+}

src/__Libraries/StellaOps.AdvisoryAI.Attestation/StellaOps.AdvisoryAI.Attestation.csproj

@@ -0,0 +1,20 @@
+<Project Sdk="Microsoft.NET.Sdk">
+
+  <PropertyGroup>
+    <TargetFramework>net10.0</TargetFramework>
+    <ImplicitUsings>enable</ImplicitUsings>
+    <Nullable>enable</Nullable>
+    <RootNamespace>StellaOps.AdvisoryAI.Attestation</RootNamespace>
+    <Description>AI attestation models and services for StellaOps Advisory AI</Description>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <PackageReference Include="Microsoft.Extensions.DependencyInjection.Abstractions" />
+    <PackageReference Include="Microsoft.Extensions.Logging.Abstractions" />
+  </ItemGroup>
+
+  <ItemGroup>
+    <InternalsVisibleTo Include="StellaOps.AdvisoryAI.Attestation.Tests" />
+  </ItemGroup>
+
+</Project>

src/__Libraries/StellaOps.AdvisoryAI.Attestation/Storage/IAiAttestationStore.cs

@@ -0,0 +1,103 @@
+// <copyright file="IAiAttestationStore.cs" company="StellaOps">
+// Copyright (c) StellaOps. Licensed under the AGPL-3.0-or-later.
+// </copyright>
+
+using System.Collections.Immutable;
+using StellaOps.AdvisoryAI.Attestation.Models;
+
+namespace StellaOps.AdvisoryAI.Attestation.Storage;
+
+/// <summary>
+/// Interface for storing and retrieving AI attestations.
+/// Sprint: SPRINT_20260109_011_001 Task: AIAT-006
+/// </summary>
+public interface IAiAttestationStore
+{
+    /// <summary>
+    /// Store a run attestation.
+    /// </summary>
+    /// <param name="attestation">The attestation to store.</param>
+    /// <param name="ct">Cancellation token.</param>
+    Task StoreRunAttestationAsync(AiRunAttestation attestation, CancellationToken ct);
+
+    /// <summary>
+    /// Store a signed attestation envelope.
+    /// </summary>
+    /// <param name="runId">The run ID.</param>
+    /// <param name="envelope">The signed DSSE envelope.</param>
+    /// <param name="ct">Cancellation token.</param>
+    Task StoreSignedEnvelopeAsync(string runId, object envelope, CancellationToken ct);
+
+    /// <summary>
+    /// Store a claim attestation.
+    /// </summary>
+    /// <param name="attestation">The attestation to store.</param>
+    /// <param name="ct">Cancellation token.</param>
+    Task StoreClaimAttestationAsync(AiClaimAttestation attestation, CancellationToken ct);
+
+    /// <summary>
+    /// Get a run attestation by run ID.
+    /// </summary>
+    /// <param name="runId">The run ID.</param>
+    /// <param name="ct">Cancellation token.</param>
+    /// <returns>The attestation or null if not found.</returns>
+    Task<AiRunAttestation?> GetRunAttestationAsync(string runId, CancellationToken ct);
+
+    /// <summary>
+    /// Get all claim attestations for a run.
+    /// </summary>
+    /// <param name="runId">The run ID.</param>
+    /// <param name="ct">Cancellation token.</param>
+    /// <returns>List of claim attestations.</returns>
+    Task<ImmutableArray<AiClaimAttestation>> GetClaimAttestationsAsync(string runId, CancellationToken ct);
+
+    /// <summary>
+    /// Get claim attestations for a specific turn.
+    /// </summary>
+    /// <param name="runId">The run ID.</param>
+    /// <param name="turnId">The turn ID.</param>
+    /// <param name="ct">Cancellation token.</param>
+    /// <returns>List of claim attestations for the turn.</returns>
+    Task<ImmutableArray<AiClaimAttestation>> GetClaimAttestationsByTurnAsync(
+        string runId,
+        string turnId,
+        CancellationToken ct);
+
+    /// <summary>
+    /// Get the signed envelope for a run.
+    /// </summary>
+    /// <param name="runId">The run ID.</param>
+    /// <param name="ct">Cancellation token.</param>
+    /// <returns>The signed envelope or null if not found.</returns>
+    Task<object?> GetSignedEnvelopeAsync(string runId, CancellationToken ct);
+
+    /// <summary>
+    /// Check if a run attestation exists.
+    /// </summary>
+    /// <param name="runId">The run ID.</param>
+    /// <param name="ct">Cancellation token.</param>
+    /// <returns>True if the attestation exists.</returns>
+    Task<bool> ExistsAsync(string runId, CancellationToken ct);
+
+    /// <summary>
+    /// Get attestations by tenant within a time range.
+    /// </summary>
+    /// <param name="tenantId">The tenant ID.</param>
+    /// <param name="from">Start time.</param>
+    /// <param name="to">End time.</param>
+    /// <param name="ct">Cancellation token.</param>
+    /// <returns>List of run attestations.</returns>
+    Task<ImmutableArray<AiRunAttestation>> GetByTenantAsync(
+        string tenantId,
+        DateTimeOffset from,
+        DateTimeOffset to,
+        CancellationToken ct);
+
+    /// <summary>
+    /// Get attestation by content digest.
+    /// </summary>
+    /// <param name="contentDigest">The content digest.</param>
+    /// <param name="ct">Cancellation token.</param>
+    /// <returns>The claim attestation or null if not found.</returns>
+    Task<AiClaimAttestation?> GetByContentDigestAsync(string contentDigest, CancellationToken ct);
+}

src/__Libraries/StellaOps.AdvisoryAI.Attestation/Storage/InMemoryAiAttestationStore.cs

@@ -0,0 +1,166 @@
+// <copyright file="InMemoryAiAttestationStore.cs" company="StellaOps">
+// Copyright (c) StellaOps. Licensed under the AGPL-3.0-or-later.
+// </copyright>
+
+using System.Collections.Concurrent;
+using System.Collections.Immutable;
+using Microsoft.Extensions.Logging;
+using StellaOps.AdvisoryAI.Attestation.Models;
+
+namespace StellaOps.AdvisoryAI.Attestation.Storage;
+
+/// <summary>
+/// In-memory implementation of AI attestation store.
+/// Useful for testing and development.
+/// Sprint: SPRINT_20260109_011_001 Task: AIAT-006
+/// </summary>
+public sealed class InMemoryAiAttestationStore : IAiAttestationStore
+{
+    private readonly ConcurrentDictionary<string, AiRunAttestation> _runAttestations = new();
+    private readonly ConcurrentDictionary<string, object> _signedEnvelopes = new();
+    private readonly ConcurrentDictionary<string, List<AiClaimAttestation>> _claimAttestations = new();
+    private readonly ConcurrentDictionary<string, AiClaimAttestation> _digestIndex = new();
+    private readonly ILogger<InMemoryAiAttestationStore> _logger;
+
+    public InMemoryAiAttestationStore(ILogger<InMemoryAiAttestationStore> logger)
+    {
+        _logger = logger;
+    }
+
+    /// <inheritdoc/>
+    public Task StoreRunAttestationAsync(AiRunAttestation attestation, CancellationToken ct)
+    {
+        _runAttestations[attestation.RunId] = attestation;
+        _logger.LogDebug("Stored run attestation for RunId {RunId}", attestation.RunId);
+        return Task.CompletedTask;
+    }
+
+    /// <inheritdoc/>
+    public Task StoreSignedEnvelopeAsync(string runId, object envelope, CancellationToken ct)
+    {
+        _signedEnvelopes[runId] = envelope;
+        _logger.LogDebug("Stored signed envelope for RunId {RunId}", runId);
+        return Task.CompletedTask;
+    }
+
+    /// <inheritdoc/>
+    public Task StoreClaimAttestationAsync(AiClaimAttestation attestation, CancellationToken ct)
+    {
+        var claims = _claimAttestations.GetOrAdd(attestation.RunId, _ => []);
+        lock (claims)
+        {
+            claims.Add(attestation);
+        }
+
+        _digestIndex[attestation.ContentDigest] = attestation;
+
+        _logger.LogDebug(
+            "Stored claim attestation for RunId {RunId}, TurnId {TurnId}",
+            attestation.RunId,
+            attestation.TurnId);
+
+        return Task.CompletedTask;
+    }
+
+    /// <inheritdoc/>
+    public Task<AiRunAttestation?> GetRunAttestationAsync(string runId, CancellationToken ct)
+    {
+        _runAttestations.TryGetValue(runId, out var attestation);
+        return Task.FromResult(attestation);
+    }
+
+    /// <inheritdoc/>
+    public Task<ImmutableArray<AiClaimAttestation>> GetClaimAttestationsAsync(string runId, CancellationToken ct)
+    {
+        if (_claimAttestations.TryGetValue(runId, out var claims))
+        {
+            lock (claims)
+            {
+                return Task.FromResult(claims.ToImmutableArray());
+            }
+        }
+
+        return Task.FromResult(ImmutableArray<AiClaimAttestation>.Empty);
+    }
+
+    /// <inheritdoc/>
+    public Task<ImmutableArray<AiClaimAttestation>> GetClaimAttestationsByTurnAsync(
+        string runId,
+        string turnId,
+        CancellationToken ct)
+    {
+        if (_claimAttestations.TryGetValue(runId, out var claims))
+        {
+            lock (claims)
+            {
+                var filtered = claims
+                    .Where(c => c.TurnId == turnId)
+                    .ToImmutableArray();
+                return Task.FromResult(filtered);
+            }
+        }
+
+        return Task.FromResult(ImmutableArray<AiClaimAttestation>.Empty);
+    }
+
+    /// <inheritdoc/>
+    public Task<object?> GetSignedEnvelopeAsync(string runId, CancellationToken ct)
+    {
+        _signedEnvelopes.TryGetValue(runId, out var envelope);
+        return Task.FromResult(envelope);
+    }
+
+    /// <inheritdoc/>
+    public Task<bool> ExistsAsync(string runId, CancellationToken ct)
+    {
+        return Task.FromResult(_runAttestations.ContainsKey(runId));
+    }
+
+    /// <inheritdoc/>
+    public Task<ImmutableArray<AiRunAttestation>> GetByTenantAsync(
+        string tenantId,
+        DateTimeOffset from,
+        DateTimeOffset to,
+        CancellationToken ct)
+    {
+        var results = _runAttestations.Values
+            .Where(a => a.TenantId == tenantId &&
+                        a.StartedAt >= from &&
+                        a.StartedAt <= to)
+            .OrderBy(a => a.StartedAt)
+            .ToImmutableArray();
+
+        return Task.FromResult(results);
+    }
+
+    /// <inheritdoc/>
+    public Task<AiClaimAttestation?> GetByContentDigestAsync(string contentDigest, CancellationToken ct)
+    {
+        _digestIndex.TryGetValue(contentDigest, out var attestation);
+        return Task.FromResult(attestation);
+    }
+
+    /// <summary>
+    /// Clear all stored attestations. Useful for testing.
+    /// </summary>
+    public void Clear()
+    {
+        _runAttestations.Clear();
+        _signedEnvelopes.Clear();
+        _claimAttestations.Clear();
+        _digestIndex.Clear();
+    }
+
+    /// <summary>
+    /// Get count of run attestations. Useful for testing.
+    /// </summary>
+    public int RunAttestationCount => _runAttestations.Count;
+
+    /// <summary>
+    /// Get count of all claim attestations. Useful for testing.
+    /// </summary>
+    public int ClaimAttestationCount => _claimAttestations.Values.Sum(c =>
+    {
+        lock (c) { return c.Count; }
+    });
+}

src/__Libraries/StellaOps.Reachability.Core/CveMapping/FunctionBoundaryDetector.cs

@@ -0,0 +1,350 @@
+// <copyright file="FunctionBoundaryDetector.cs" company="StellaOps">
+// Copyright (c) StellaOps. Licensed under the AGPL-3.0-or-later.
+// </copyright>
+
+using System.Collections.Immutable;
+using System.Text.RegularExpressions;
+using StellaOps.Reachability.Core.Symbols;
+
+namespace StellaOps.Reachability.Core.CveMapping;
+
+/// <summary>
+/// Detects function boundaries in source code from diff context.
+/// Sprint: SPRINT_20260109_009_003 Task: Implement FunctionBoundaryDetector
+/// </summary>
+public sealed partial class FunctionBoundaryDetector
+{
+    // C#/Java/TypeScript patterns
+    [GeneratedRegex(@"^\s*(?:public|private|protected|internal|static|async|override|virtual|sealed|abstract|\s)*\s*(?:\w+(?:<[^>]+>)?)\s+(\w+)\s*\([^)]*\)\s*(?::\s*\w+)?\s*{?")]
+    private static partial Regex CSharpMethodRegex();
+
+    // Python patterns
+    [GeneratedRegex(@"^\s*(?:async\s+)?def\s+(\w+)\s*\([^)]*\)\s*(?:->.*)?:")]
+    private static partial Regex PythonFunctionRegex();
+
+    // Go patterns
+    [GeneratedRegex(@"^\s*func\s+(?:\([^)]+\)\s+)?(\w+)\s*\([^)]*\)")]
+    private static partial Regex GoFunctionRegex();
+
+    // Rust patterns
+    [GeneratedRegex(@"^\s*(?:pub\s+)?(?:async\s+)?fn\s+(\w+)\s*(?:<[^>]+>)?\s*\([^)]*\)")]
+    private static partial Regex RustFunctionRegex();
+
+    // JavaScript/TypeScript patterns
+    [GeneratedRegex(@"^\s*(?:async\s+)?(?:function\s+)?(\w+)\s*(?:=\s*(?:async\s+)?)?(?:\([^)]*\)\s*(?:=>|{)|:\s*\([^)]*\)\s*(?:=>|{))")]
+    private static partial Regex JsFunctionRegex();
+
+    // Ruby patterns
+    [GeneratedRegex(@"^\s*def\s+(\w+(?:\?|!)?)")]
+    private static partial Regex RubyMethodRegex();
+
+    // PHP patterns
+    [GeneratedRegex(@"^\s*(?:public|private|protected|static|\s)*function\s+(\w+)\s*\(")]
+    private static partial Regex PhpFunctionRegex();
+
+    // C/C++ patterns
+    [GeneratedRegex(@"^\s*(?:\w+(?:\s*[*&])?\s+)+(\w+)\s*\([^)]*\)\s*(?:const)?\s*{?")]
+    private static partial Regex CFunctionRegex();
+
+    // Class patterns for fully-qualified names
+    [GeneratedRegex(@"^\s*(?:public|private|protected|internal|sealed|abstract|static|\s)*(?:class|struct|interface|enum)\s+(\w+)")]
+    private static partial Regex ClassDeclarationRegex();
+
+    [GeneratedRegex(@"^\s*(?:namespace|package)\s+([\w.]+)")]
+    private static partial Regex NamespaceRegex();
+
+    /// <summary>
+    /// Detects the function containing a specific line number.
+    /// </summary>
+    /// <param name="contextLines">Context lines from the diff.</param>
+    /// <param name="targetLine">Target line number to find function for.</param>
+    /// <param name="language">Programming language.</param>
+    /// <returns>Function boundary if found, null otherwise.</returns>
+    public FunctionBoundary? DetectFunction(
+        ImmutableArray<string> contextLines,
+        int targetLine,
+        ProgrammingLanguage language)
+    {
+        if (contextLines.IsDefaultOrEmpty)
+        {
+            return null;
+        }
+
+        var functionRegex = GetFunctionRegex(language);
+        if (functionRegex is null)
+        {
+            return null;
+        }
+
+        // Search backwards from target for function declaration
+        string? functionName = null;
+        var functionStartLine = 0;
+        var namespaceOrPackage = string.Empty;
+        var className = string.Empty;
+
+        // First pass: find namespace/package and class
+        for (var i = 0; i < contextLines.Length; i++)
+        {
+            var line = contextLines[i];
+
+            var nsMatch = NamespaceRegex().Match(line);
+            if (nsMatch.Success)
+            {
+                namespaceOrPackage = nsMatch.Groups[1].Value;
+            }
+
+            var classMatch = ClassDeclarationRegex().Match(line);
+            if (classMatch.Success)
+            {
+                className = classMatch.Groups[1].Value;
+            }
+        }
+
+        // Second pass: find function containing target line
+        var braceDepth = 0;
+        var inFunction = false;
+
+        for (var i = 0; i < contextLines.Length; i++)
+        {
+            var line = contextLines[i];
+            var lineNumber = i + 1; // 1-based
+
+            // Check for function declaration
+            var funcMatch = functionRegex.Match(line);
+            if (funcMatch.Success)
+            {
+                functionName = funcMatch.Groups[1].Value;
+                functionStartLine = lineNumber;
+                inFunction = true;
+                braceDepth = CountBraces(line);
+            }
+            else if (inFunction)
+            {
+                braceDepth += CountBraces(line);
+
+                // For brace-based languages, end at brace depth 0
+                if (braceDepth <= 0 && !IsBracelessLanguage(language))
+                {
+                    if (lineNumber >= targetLine && functionName is not null)
+                    {
+                        return new FunctionBoundary(
+                            BuildFullyQualifiedName(namespaceOrPackage, className, functionName),
+                            functionStartLine,
+                            lineNumber);
+                    }
+                    inFunction = false;
+                }
+            }
+
+            // Check if we've found the function containing our target line
+            if (inFunction && lineNumber >= targetLine && functionName is not null)
+            {
+                // Estimate end line (use remaining context or a reasonable default)
+                var endLine = EstimateFunctionEnd(contextLines, i, language);
+                return new FunctionBoundary(
+                    BuildFullyQualifiedName(namespaceOrPackage, className, functionName),
+                    functionStartLine,
+                    endLine);
+            }
+        }
+
+        return null;
+    }
+
+    /// <summary>
+    /// Detects all functions in the given source context.
+    /// </summary>
+    public ImmutableArray<FunctionBoundary> DetectAllFunctions(
+        ImmutableArray<string> contextLines,
+        ProgrammingLanguage language)
+    {
+        if (contextLines.IsDefaultOrEmpty)
+        {
+            return [];
+        }
+
+        var functionRegex = GetFunctionRegex(language);
+        if (functionRegex is null)
+        {
+            return [];
+        }
+
+        var functions = new List<FunctionBoundary>();
+        var namespaceOrPackage = string.Empty;
+        var className = string.Empty;
+
+        for (var i = 0; i < contextLines.Length; i++)
+        {
+            var line = contextLines[i];
+
+            var nsMatch = NamespaceRegex().Match(line);
+            if (nsMatch.Success)
+            {
+                namespaceOrPackage = nsMatch.Groups[1].Value;
+            }
+
+            var classMatch = ClassDeclarationRegex().Match(line);
+            if (classMatch.Success)
+            {
+                className = classMatch.Groups[1].Value;
+            }
+
+            var funcMatch = functionRegex.Match(line);
+            if (funcMatch.Success)
+            {
+                var functionName = funcMatch.Groups[1].Value;
+                var startLine = i + 1;
+                var endLine = EstimateFunctionEnd(contextLines, i, language);
+
+                functions.Add(new FunctionBoundary(
+                    BuildFullyQualifiedName(namespaceOrPackage, className, functionName),
+                    startLine,
+                    endLine));
+            }
+        }
+
+        return [.. functions];
+    }
+
+    private static Regex? GetFunctionRegex(ProgrammingLanguage language)
+    {
+        return language switch
+        {
+            ProgrammingLanguage.CSharp => CSharpMethodRegex(),
+            ProgrammingLanguage.Java => CSharpMethodRegex(), // Similar syntax
+            ProgrammingLanguage.Kotlin => CSharpMethodRegex(), // Similar syntax
+            ProgrammingLanguage.Python => PythonFunctionRegex(),
+            ProgrammingLanguage.Go => GoFunctionRegex(),
+            ProgrammingLanguage.Rust => RustFunctionRegex(),
+            ProgrammingLanguage.JavaScript => JsFunctionRegex(),
+            ProgrammingLanguage.TypeScript => JsFunctionRegex(),
+            ProgrammingLanguage.Ruby => RubyMethodRegex(),
+            ProgrammingLanguage.Php => PhpFunctionRegex(),
+            ProgrammingLanguage.C => CFunctionRegex(),
+            ProgrammingLanguage.Cpp => CFunctionRegex(),
+            ProgrammingLanguage.Swift => CSharpMethodRegex(), // Similar syntax
+            ProgrammingLanguage.Scala => CSharpMethodRegex(), // Similar syntax
+            _ => null
+        };
+    }
+
+    private static bool IsBracelessLanguage(ProgrammingLanguage language)
+    {
+        return language is ProgrammingLanguage.Python or ProgrammingLanguage.Ruby;
+    }
+
+    private static int CountBraces(string line)
+    {
+        var count = 0;
+        var inString = false;
+        var stringChar = '\0';
+
+        for (var i = 0; i < line.Length; i++)
+        {
+            var c = line[i];
+
+            // Handle strings
+            if (!inString && (c is '"' or '\''))
+            {
+                inString = true;
+                stringChar = c;
+            }
+            else if (inString && c == stringChar && (i == 0 || line[i - 1] != '\\'))
+            {
+                inString = false;
+            }
+
+            if (!inString)
+            {
+                if (c == '{') count++;
+                else if (c == '}') count--;
+            }
+        }
+
+        return count;
+    }
+
+    private static int EstimateFunctionEnd(
+        ImmutableArray<string> contextLines,
+        int startIndex,
+        ProgrammingLanguage language)
+    {
+        if (IsBracelessLanguage(language))
+        {
+            // For Python/Ruby, estimate based on indentation
+            var startIndent = GetIndentation(contextLines[startIndex]);
+            for (var i = startIndex + 1; i < contextLines.Length; i++)
+            {
+                var line = contextLines[i].TrimEnd();
+                if (string.IsNullOrWhiteSpace(line)) continue;
+
+                var currentIndent = GetIndentation(contextLines[i]);
+                if (currentIndent <= startIndent)
+                {
+                    return i; // End at line with same or less indentation
+                }
+            }
+        }
+        else
+        {
+            // For brace-based languages, track brace depth
+            var braceDepth = CountBraces(contextLines[startIndex]);
+            for (var i = startIndex + 1; i < contextLines.Length; i++)
+            {
+                braceDepth += CountBraces(contextLines[i]);
+                if (braceDepth <= 0)
+                {
+                    return i + 1; // Include the closing brace line
+                }
+            }
+        }
+
+        // Default: use remaining context length
+        return contextLines.Length;
+    }
+
+    private static int GetIndentation(string line)
+    {
+        var count = 0;
+        foreach (var c in line)
+        {
+            if (c == ' ') count++;
+            else if (c == '\t') count += 4; // Assume tab = 4 spaces
+            else break;
+        }
+        return count;
+    }
+
+    private static string BuildFullyQualifiedName(
+        string namespaceOrPackage,
+        string className,
+        string functionName)
+    {
+        var parts = new List<string>();
+
+        if (!string.IsNullOrEmpty(namespaceOrPackage))
+        {
+            parts.Add(namespaceOrPackage);
+        }
+
+        if (!string.IsNullOrEmpty(className))
+        {
+            parts.Add(className);
+        }
+
+        parts.Add(functionName);
+
+        return string.Join(".", parts);
+    }
+}
+
+/// <summary>
+/// Represents the boundary of a function in source code.
+/// </summary>
+/// <param name="FullyQualifiedName">Fully qualified function name.</param>
+/// <param name="StartLine">Start line (1-based).</param>
+/// <param name="EndLine">End line (1-based, inclusive).</param>
+public readonly record struct FunctionBoundary(
+    string FullyQualifiedName,
+    int StartLine,
+    int EndLine);

src/__Libraries/StellaOps.Reachability.Core/CveMapping/GitDiffExtractor.cs

@@ -0,0 +1,310 @@
+// <copyright file="GitDiffExtractor.cs" company="StellaOps">
+// Copyright (c) StellaOps. Licensed under the AGPL-3.0-or-later.
+// </copyright>
+
+using System.Collections.Immutable;
+using System.Diagnostics;
+using StellaOps.Reachability.Core.Symbols;
+
+namespace StellaOps.Reachability.Core.CveMapping;
+
+/// <summary>
+/// Extracts vulnerable symbols from git diffs.
+/// Sprint: SPRINT_20260109_009_003 Task: Implement GitDiffExtractor
+/// </summary>
+public sealed class GitDiffExtractor : IPatchSymbolExtractor
+{
+    private readonly HttpClient _httpClient;
+    private readonly UnifiedDiffParser _diffParser;
+    private readonly FunctionBoundaryDetector _boundaryDetector;
+
+    /// <summary>
+    /// Initializes a new instance of the <see cref="GitDiffExtractor"/> class.
+    /// </summary>
+    public GitDiffExtractor(
+        HttpClient httpClient,
+        UnifiedDiffParser diffParser,
+        FunctionBoundaryDetector boundaryDetector)
+    {
+        _httpClient = httpClient ?? throw new ArgumentNullException(nameof(httpClient));
+        _diffParser = diffParser ?? throw new ArgumentNullException(nameof(diffParser));
+        _boundaryDetector = boundaryDetector ?? throw new ArgumentNullException(nameof(boundaryDetector));
+    }
+
+    /// <inheritdoc/>
+    public async Task<PatchAnalysisResult> ExtractFromCommitUrlAsync(
+        string commitUrl,
+        CancellationToken ct)
+    {
+        ArgumentException.ThrowIfNullOrEmpty(commitUrl);
+
+        try
+        {
+            // Parse the commit URL to get the raw diff URL
+            var diffUrl = ConvertToDiffUrl(commitUrl);
+            if (diffUrl is null)
+            {
+                return PatchAnalysisResult.Failed($"Unsupported commit URL format: {commitUrl}");
+            }
+
+            // Fetch the diff content
+            var diffContent = await _httpClient.GetStringAsync(diffUrl, ct).ConfigureAwait(false);
+
+            // Extract the commit SHA from the URL
+            var commitSha = ExtractCommitSha(commitUrl);
+            var repositoryUrl = ExtractRepositoryUrl(commitUrl);
+
+            // Parse and extract symbols
+            var result = await ExtractFromDiffAsync(diffContent, ct).ConfigureAwait(false);
+
+            // Enrich with URL metadata
+            return result with
+            {
+                CommitSha = commitSha,
+                RepositoryUrl = repositoryUrl
+            };
+        }
+        catch (HttpRequestException ex)
+        {
+            return PatchAnalysisResult.Failed($"Failed to fetch diff from URL: {ex.Message}");
+        }
+        catch (Exception ex)
+        {
+            return PatchAnalysisResult.Failed($"Error extracting from commit URL: {ex.Message}");
+        }
+    }
+
+    /// <inheritdoc/>
+    public Task<PatchAnalysisResult> ExtractFromDiffAsync(
+        string diffContent,
+        CancellationToken ct)
+    {
+        ArgumentException.ThrowIfNullOrEmpty(diffContent);
+
+        try
+        {
+            // Parse the diff
+            var parsedDiff = _diffParser.Parse(diffContent);
+
+            // Track statistics
+            var modifiedFiles = new List<string>();
+            var symbols = new List<VulnerableSymbol>();
+            var totalLinesAdded = 0;
+            var totalLinesRemoved = 0;
+
+            foreach (var fileDiff in parsedDiff.Files)
+            {
+                modifiedFiles.Add(fileDiff.NewPath ?? fileDiff.OldPath ?? "unknown");
+                totalLinesAdded += fileDiff.Hunks.Sum(h => h.AddedLines.Length);
+                totalLinesRemoved += fileDiff.Hunks.Sum(h => h.RemovedLines.Length);
+
+                // Extract symbols from this file
+                var fileSymbols = ExtractSymbolsFromFile(fileDiff);
+                symbols.AddRange(fileSymbols);
+            }
+
+            return Task.FromResult(PatchAnalysisResult.Successful(
+                symbols,
+                modifiedFiles,
+                totalLinesAdded,
+                totalLinesRemoved));
+        }
+        catch (Exception ex)
+        {
+            return Task.FromResult(PatchAnalysisResult.Failed($"Error parsing diff: {ex.Message}"));
+        }
+    }
+
+    /// <inheritdoc/>
+    public async Task<PatchAnalysisResult> ExtractFromLocalCommitAsync(
+        string repositoryPath,
+        string commitSha,
+        CancellationToken ct)
+    {
+        ArgumentException.ThrowIfNullOrEmpty(repositoryPath);
+        ArgumentException.ThrowIfNullOrEmpty(commitSha);
+
+        try
+        {
+            // Run git show to get the diff
+            var startInfo = new ProcessStartInfo
+            {
+                FileName = "git",
+                Arguments = $"show --format= -p {commitSha}",
+                WorkingDirectory = repositoryPath,
+                RedirectStandardOutput = true,
+                RedirectStandardError = true,
+                UseShellExecute = false,
+                CreateNoWindow = true
+            };
+
+            using var process = Process.Start(startInfo);
+            if (process is null)
+            {
+                return PatchAnalysisResult.Failed("Failed to start git process");
+            }
+
+            var diffContent = await process.StandardOutput.ReadToEndAsync(ct).ConfigureAwait(false);
+            var errorOutput = await process.StandardError.ReadToEndAsync(ct).ConfigureAwait(false);
+
+            await process.WaitForExitAsync(ct).ConfigureAwait(false);
+
+            if (process.ExitCode != 0)
+            {
+                return PatchAnalysisResult.Failed($"Git show failed: {errorOutput}");
+            }
+
+            var result = await ExtractFromDiffAsync(diffContent, ct).ConfigureAwait(false);
+
+            return result with
+            {
+                CommitSha = commitSha,
+                RepositoryUrl = repositoryPath
+            };
+        }
+        catch (Exception ex)
+        {
+            return PatchAnalysisResult.Failed($"Error extracting from local commit: {ex.Message}");
+        }
+    }
+
+    private IEnumerable<VulnerableSymbol> ExtractSymbolsFromFile(FileDiff fileDiff)
+    {
+        var symbols = new List<VulnerableSymbol>();
+        var language = DetectLanguage(fileDiff.NewPath ?? fileDiff.OldPath);
+
+        if (language is null)
+        {
+            // Unknown language, skip symbol extraction
+            return symbols;
+        }
+
+        foreach (var hunk in fileDiff.Hunks)
+        {
+            // Focus on removed lines (these are the vulnerable code being fixed)
+            foreach (var line in hunk.RemovedLines)
+            {
+                // Detect if this line is within a function
+                var functionBoundary = _boundaryDetector.DetectFunction(
+                    hunk.Context,
+                    line.LineNumber,
+                    language.Value);
+
+                if (functionBoundary.HasValue)
+                {
+                    var boundary = functionBoundary.Value;
+                    // Parse the fully qualified name into components
+                    var parts = boundary.FullyQualifiedName.Split('.');
+                    var methodName = parts.Length > 0 ? parts[^1] : "unknown";
+                    var typeName = parts.Length > 1 ? parts[^2] : "_";
+                    var namespaceName = parts.Length > 2 
+                        ? string.Join(".", parts[..^2]) 
+                        : string.Empty;
+
+                    var canonicalSymbol = CanonicalSymbol.Create(
+                        @namespace: namespaceName,
+                        type: typeName,
+                        method: methodName,
+                        signature: "()",
+                        source: SymbolSource.PatchAnalysis,
+                        originalSymbol: boundary.FullyQualifiedName);
+
+                    symbols.Add(new VulnerableSymbol
+                    {
+                        Symbol = canonicalSymbol,
+                        Type = VulnerabilityType.Sink, // Conservative default
+                        Confidence = 0.7, // Patch-based confidence
+                        Evidence = $"Modified in fix: line {line.LineNumber}",
+                        SourceFile = fileDiff.OldPath,
+                        LineRange = new LineRange(boundary.StartLine, boundary.EndLine)
+                    });
+                }
+            }
+        }
+
+        // Deduplicate symbols by name
+        return symbols
+            .GroupBy(s => s.Symbol.DisplayName)
+            .Select(g => g.First());
+    }
+
+    private static ProgrammingLanguage? DetectLanguage(string? filePath)
+    {
+        if (string.IsNullOrEmpty(filePath))
+        {
+            return null;
+        }
+
+        var extension = Path.GetExtension(filePath).ToLowerInvariant();
+
+        return extension switch
+        {
+            ".cs" => ProgrammingLanguage.CSharp,
+            ".java" => ProgrammingLanguage.Java,
+            ".kt" or ".kts" => ProgrammingLanguage.Kotlin,
+            ".py" => ProgrammingLanguage.Python,
+            ".js" => ProgrammingLanguage.JavaScript,
+            ".ts" => ProgrammingLanguage.TypeScript,
+            ".go" => ProgrammingLanguage.Go,
+            ".rs" => ProgrammingLanguage.Rust,
+            ".c" or ".h" => ProgrammingLanguage.C,
+            ".cpp" or ".cc" or ".cxx" or ".hpp" => ProgrammingLanguage.Cpp,
+            ".rb" => ProgrammingLanguage.Ruby,
+            ".php" => ProgrammingLanguage.Php,
+            ".swift" => ProgrammingLanguage.Swift,
+            ".scala" => ProgrammingLanguage.Scala,
+            _ => null
+        };
+    }
+
+    private static string? ConvertToDiffUrl(string commitUrl)
+    {
+        // GitHub: https://github.com/owner/repo/commit/sha -> https://github.com/owner/repo/commit/sha.diff
+        if (commitUrl.Contains("github.com", StringComparison.OrdinalIgnoreCase) &&
+            commitUrl.Contains("/commit/", StringComparison.OrdinalIgnoreCase))
+        {
+            return commitUrl.TrimEnd('/') + ".diff";
+        }
+
+        // GitLab: https://gitlab.com/owner/repo/-/commit/sha -> https://gitlab.com/owner/repo/-/commit/sha.diff
+        if (commitUrl.Contains("gitlab.com", StringComparison.OrdinalIgnoreCase) &&
+            commitUrl.Contains("/commit/", StringComparison.OrdinalIgnoreCase))
+        {
+            return commitUrl.TrimEnd('/') + ".diff";
+        }
+
+        // Bitbucket: Different format - not directly supported yet
+        return null;
+    }
+
+    private static string? ExtractCommitSha(string commitUrl)
+    {
+        // Extract SHA from URL like /commit/abc123
+        var commitIndex = commitUrl.LastIndexOf("/commit/", StringComparison.OrdinalIgnoreCase);
+        if (commitIndex < 0)
+        {
+            return null;
+        }
+
+        var sha = commitUrl[(commitIndex + 8)..];
+        // Remove trailing .diff, query string, etc.
+        var endIndex = sha.IndexOfAny(['.', '?', '#']);
+        if (endIndex > 0)
+        {
+            sha = sha[..endIndex];
+        }
+
+        return sha.Length >= 7 ? sha : null;
+    }
+
+    private static string? ExtractRepositoryUrl(string commitUrl)
+    {
+        var commitIndex = commitUrl.LastIndexOf("/commit/", StringComparison.OrdinalIgnoreCase);
+        if (commitIndex < 0)
+        {
+            return null;
+        }
+
+        return commitUrl[..commitIndex];
+    }
+}

src/__Libraries/StellaOps.Reachability.Core/CveMapping/OsvEnricher.cs

@@ -0,0 +1,527 @@
+// <copyright file="OsvEnricher.cs" company="StellaOps">
+// Copyright (c) StellaOps. Licensed under the AGPL-3.0-or-later.
+// </copyright>
+
+using System.Collections.Immutable;
+using System.Net.Http.Json;
+using System.Text.Json;
+using System.Text.Json.Serialization;
+using StellaOps.Reachability.Core.Symbols;
+
+namespace StellaOps.Reachability.Core.CveMapping;
+
+/// <summary>
+/// Enriches CVE mappings with data from the OSV database.
+/// Sprint: SPRINT_20260109_009_003 Task: Implement OsvEnricher
+/// </summary>
+/// <remarks>
+/// Uses the OSV.dev API (https://api.osv.dev/) to retrieve vulnerability data.
+/// Supports querying by vulnerability ID or by package.
+/// </remarks>
+public sealed class OsvEnricher : IOsvEnricher
+{
+    private const string OsvApiBaseUrl = "https://api.osv.dev/v1";
+    private static readonly JsonSerializerOptions JsonOptions = CreateJsonOptions();
+
+    private readonly HttpClient _httpClient;
+
+    /// <summary>
+    /// Initializes a new instance of the <see cref="OsvEnricher"/> class.
+    /// </summary>
+    public OsvEnricher(HttpClient httpClient)
+    {
+        _httpClient = httpClient ?? throw new ArgumentNullException(nameof(httpClient));
+    }
+
+    /// <inheritdoc/>
+    public async Task<OsvEnrichmentResult> EnrichAsync(string cveId, CancellationToken ct)
+    {
+        ArgumentException.ThrowIfNullOrEmpty(cveId);
+
+        var vulnerability = await GetVulnerabilityAsync(cveId, ct).ConfigureAwait(false);
+
+        if (vulnerability is null)
+        {
+            return OsvEnrichmentResult.NotFound(cveId);
+        }
+
+        var affectedPurls = ExtractPurls(vulnerability);
+        var symbols = ExtractSymbols(vulnerability);
+        var affectedVersions = ExtractAffectedVersions(vulnerability);
+
+        return new OsvEnrichmentResult
+        {
+            CveId = cveId,
+            Found = true,
+            OsvId = vulnerability.Id,
+            AffectedPurls = affectedPurls,
+            Symbols = symbols,
+            AffectedVersions = affectedVersions
+        };
+    }
+
+    /// <inheritdoc/>
+    public async Task<OsvVulnerability?> GetVulnerabilityAsync(string vulnId, CancellationToken ct)
+    {
+        ArgumentException.ThrowIfNullOrEmpty(vulnId);
+
+        try
+        {
+            var url = $"{OsvApiBaseUrl}/vulns/{Uri.EscapeDataString(vulnId)}";
+            var response = await _httpClient.GetAsync(url, ct).ConfigureAwait(false);
+
+            if (!response.IsSuccessStatusCode)
+            {
+                if (response.StatusCode == System.Net.HttpStatusCode.NotFound)
+                {
+                    return null;
+                }
+
+                response.EnsureSuccessStatusCode();
+            }
+
+            var apiResponse = await response.Content
+                .ReadFromJsonAsync<OsvApiVulnerability>(JsonOptions, ct)
+                .ConfigureAwait(false);
+
+            return apiResponse is null ? null : MapToOsvVulnerability(apiResponse);
+        }
+        catch (HttpRequestException)
+        {
+            return null;
+        }
+        catch (JsonException)
+        {
+            return null;
+        }
+    }
+
+    /// <inheritdoc/>
+    public async Task<IReadOnlyList<OsvVulnerability>> QueryByPackageAsync(
+        string ecosystem,
+        string packageName,
+        string? version,
+        CancellationToken ct)
+    {
+        ArgumentException.ThrowIfNullOrEmpty(ecosystem);
+        ArgumentException.ThrowIfNullOrEmpty(packageName);
+
+        try
+        {
+            var url = $"{OsvApiBaseUrl}/query";
+            var request = new OsvQueryRequest
+            {
+                Package = new OsvQueryPackage
+                {
+                    Ecosystem = MapEcosystem(ecosystem),
+                    Name = packageName
+                },
+                Version = version
+            };
+
+            var response = await _httpClient.PostAsJsonAsync(url, request, JsonOptions, ct)
+                .ConfigureAwait(false);
+
+            response.EnsureSuccessStatusCode();
+
+            var queryResponse = await response.Content
+                .ReadFromJsonAsync<OsvQueryResponse>(JsonOptions, ct)
+                .ConfigureAwait(false);
+
+            if (queryResponse?.Vulns is null || queryResponse.Vulns.Length == 0)
+            {
+                return [];
+            }
+
+            return queryResponse.Vulns
+                .Select(MapToOsvVulnerability)
+                .ToImmutableArray();
+        }
+        catch (HttpRequestException)
+        {
+            return [];
+        }
+        catch (JsonException)
+        {
+            return [];
+        }
+    }
+
+    private static ImmutableArray<string> ExtractPurls(OsvVulnerability vulnerability)
+    {
+        var purls = new HashSet<string>(StringComparer.OrdinalIgnoreCase);
+
+        foreach (var affected in vulnerability.Affected)
+        {
+            if (affected.Package?.Purl is not null)
+            {
+                purls.Add(affected.Package.Purl);
+            }
+            else if (affected.Package is not null)
+            {
+                // Build PURL from ecosystem and name
+                var ecosystem = MapEcosystemToPurlType(affected.Package.Ecosystem);
+                var purl = $"pkg:{ecosystem}/{affected.Package.Name}";
+                purls.Add(purl);
+            }
+        }
+
+        return [.. purls];
+    }
+
+    private static ImmutableArray<VulnerableSymbol> ExtractSymbols(OsvVulnerability vulnerability)
+    {
+        var symbols = new List<VulnerableSymbol>();
+
+        foreach (var affected in vulnerability.Affected)
+        {
+            if (affected.EcosystemSpecific is null)
+            {
+                continue;
+            }
+
+            // Try to extract function names from ecosystem-specific data
+            // Different ecosystems use different keys
+            var functionNames = ExtractFunctionNames(affected.EcosystemSpecific);
+
+            foreach (var functionName in functionNames)
+            {
+                var canonicalSymbol = CanonicalSymbol.Create(
+                    @namespace: string.Empty,
+                    type: "_",
+                    method: functionName,
+                    signature: "()",
+                    source: SymbolSource.OsvAdvisory,
+                    originalSymbol: functionName);
+
+                symbols.Add(new VulnerableSymbol
+                {
+                    Symbol = canonicalSymbol,
+                    Type = VulnerabilityType.Sink,
+                    Confidence = 0.9, // High confidence from OSV
+                    Evidence = $"OSV advisory: {vulnerability.Id}"
+                });
+            }
+        }
+
+        return [.. symbols];
+    }
+
+    private static IReadOnlyList<string> ExtractFunctionNames(
+        ImmutableDictionary<string, object> ecosystemSpecific)
+    {
+        var functions = new List<string>();
+
+        // Common keys used in OSV ecosystem-specific data
+        var functionKeys = new[] { "functions", "vulnerable_functions", "symbols", "affected_functions" };
+
+        foreach (var key in functionKeys)
+        {
+            if (!ecosystemSpecific.TryGetValue(key, out var value))
+            {
+                continue;
+            }
+
+            if (value is JsonElement element)
+            {
+                if (element.ValueKind == JsonValueKind.Array)
+                {
+                    foreach (var item in element.EnumerateArray())
+                    {
+                        if (item.ValueKind == JsonValueKind.String)
+                        {
+                            var funcName = item.GetString();
+                            if (!string.IsNullOrEmpty(funcName))
+                            {
+                                functions.Add(funcName);
+                            }
+                        }
+                    }
+                }
+                else if (element.ValueKind == JsonValueKind.String)
+                {
+                    var funcName = element.GetString();
+                    if (!string.IsNullOrEmpty(funcName))
+                    {
+                        functions.Add(funcName);
+                    }
+                }
+            }
+        }
+
+        return functions;
+    }
+
+    private static ImmutableArray<AffectedVersionRange> ExtractAffectedVersions(OsvVulnerability vulnerability)
+    {
+        var ranges = new List<AffectedVersionRange>();
+
+        foreach (var affected in vulnerability.Affected)
+        {
+            if (affected.Package is null)
+            {
+                continue;
+            }
+
+            var purl = affected.Package.Purl
+                ?? $"pkg:{MapEcosystemToPurlType(affected.Package.Ecosystem)}/{affected.Package.Name}";
+
+            foreach (var range in affected.Ranges)
+            {
+                string? introduced = null;
+                string? fixedVersion = null;
+                string? lastAffected = null;
+
+                foreach (var evt in range.Events)
+                {
+                    if (evt.Introduced is not null)
+                    {
+                        introduced = evt.Introduced;
+                    }
+                    if (evt.Fixed is not null)
+                    {
+                        fixedVersion = evt.Fixed;
+                    }
+                    if (evt.LastAffected is not null)
+                    {
+                        lastAffected = evt.LastAffected;
+                    }
+                }
+
+                ranges.Add(new AffectedVersionRange
+                {
+                    Purl = purl,
+                    IntroducedVersion = introduced,
+                    FixedVersion = fixedVersion,
+                    LastAffectedVersion = lastAffected
+                });
+            }
+        }
+
+        return [.. ranges];
+    }
+
+    private static OsvVulnerability MapToOsvVulnerability(OsvApiVulnerability api)
+    {
+        return new OsvVulnerability
+        {
+            Id = api.Id ?? "unknown",
+            Summary = api.Summary,
+            Details = api.Details,
+            Aliases = api.Aliases?.ToImmutableArray() ?? [],
+            Affected = api.Affected?.Select(MapToOsvAffected).ToImmutableArray() ?? [],
+            Severity = api.Severity?.Select(MapToOsvSeverity).ToImmutableArray() ?? [],
+            References = api.References?.Select(MapToOsvReference).ToImmutableArray() ?? []
+        };
+    }
+
+    private static OsvAffected MapToOsvAffected(OsvApiAffected api)
+    {
+        return new OsvAffected
+        {
+            Package = api.Package is null ? null : new OsvPackage
+            {
+                Ecosystem = api.Package.Ecosystem ?? "unknown",
+                Name = api.Package.Name ?? "unknown",
+                Purl = api.Package.Purl
+            },
+            Ranges = api.Ranges?.Select(MapToOsvRange).ToImmutableArray() ?? [],
+            Versions = api.Versions?.ToImmutableArray() ?? [],
+            EcosystemSpecific = api.EcosystemSpecific?.ToImmutableDictionary()
+        };
+    }
+
+    private static OsvRange MapToOsvRange(OsvApiRange api)
+    {
+        return new OsvRange
+        {
+            Type = api.Type ?? "SEMVER",
+            Events = api.Events?.Select(e => new OsvEvent
+            {
+                Introduced = e.Introduced,
+                Fixed = e.Fixed,
+                LastAffected = e.LastAffected
+            }).ToImmutableArray() ?? []
+        };
+    }
+
+    private static OsvSeverity MapToOsvSeverity(OsvApiSeverity api)
+    {
+        return new OsvSeverity
+        {
+            Type = api.Type ?? "CVSS_V3",
+            Score = api.Score ?? "0.0"
+        };
+    }
+
+    private static OsvReference MapToOsvReference(OsvApiReference api)
+    {
+        return new OsvReference
+        {
+            Type = api.Type ?? "WEB",
+            Url = api.Url ?? string.Empty
+        };
+    }
+
+    private static string MapEcosystem(string ecosystem)
+    {
+        // Map common ecosystem names to OSV format
+        return ecosystem.ToUpperInvariant() switch
+        {
+            "NPM" => "npm",
+            "PYPI" => "PyPI",
+            "MAVEN" => "Maven",
+            "NUGET" => "NuGet",
+            "GO" => "Go",
+            "CRATES.IO" or "CARGO" => "crates.io",
+            "RUBYGEMS" => "RubyGems",
+            "PACKAGIST" => "Packagist",
+            "HEX" => "Hex",
+            "PUB" => "Pub",
+            _ => ecosystem
+        };
+    }
+
+    private static string MapEcosystemToPurlType(string ecosystem)
+    {
+        return ecosystem.ToLowerInvariant() switch
+        {
+            "npm" => "npm",
+            "pypi" => "pypi",
+            "maven" => "maven",
+            "nuget" => "nuget",
+            "go" => "golang",
+            "crates.io" => "cargo",
+            "rubygems" => "gem",
+            "packagist" => "composer",
+            "hex" => "hex",
+            "pub" => "pub",
+            _ => ecosystem.ToLowerInvariant()
+        };
+    }
+
+    private static JsonSerializerOptions CreateJsonOptions()
+    {
+        return new JsonSerializerOptions
+        {
+            PropertyNamingPolicy = JsonNamingPolicy.SnakeCaseLower,
+            PropertyNameCaseInsensitive = true,
+            DefaultIgnoreCondition = JsonIgnoreCondition.WhenWritingNull
+        };
+    }
+
+    // API request/response models
+    private sealed class OsvQueryRequest
+    {
+        [JsonPropertyName("package")]
+        public OsvQueryPackage? Package { get; set; }
+
+        [JsonPropertyName("version")]
+        public string? Version { get; set; }
+    }
+
+    private sealed class OsvQueryPackage
+    {
+        [JsonPropertyName("ecosystem")]
+        public string? Ecosystem { get; set; }
+
+        [JsonPropertyName("name")]
+        public string? Name { get; set; }
+    }
+
+    private sealed class OsvQueryResponse
+    {
+        [JsonPropertyName("vulns")]
+        public OsvApiVulnerability[]? Vulns { get; set; }
+    }
+
+    private sealed class OsvApiVulnerability
+    {
+        [JsonPropertyName("id")]
+        public string? Id { get; set; }
+
+        [JsonPropertyName("summary")]
+        public string? Summary { get; set; }
+
+        [JsonPropertyName("details")]
+        public string? Details { get; set; }
+
+        [JsonPropertyName("aliases")]
+        public string[]? Aliases { get; set; }
+
+        [JsonPropertyName("affected")]
+        public OsvApiAffected[]? Affected { get; set; }
+
+        [JsonPropertyName("severity")]
+        public OsvApiSeverity[]? Severity { get; set; }
+
+        [JsonPropertyName("references")]
+        public OsvApiReference[]? References { get; set; }
+    }
+
+    private sealed class OsvApiAffected
+    {
+        [JsonPropertyName("package")]
+        public OsvApiPackage? Package { get; set; }
+
+        [JsonPropertyName("ranges")]
+        public OsvApiRange[]? Ranges { get; set; }
+
+        [JsonPropertyName("versions")]
+        public string[]? Versions { get; set; }
+
+        [JsonPropertyName("ecosystem_specific")]
+        public Dictionary<string, object>? EcosystemSpecific { get; set; }
+    }
+
+    private sealed class OsvApiPackage
+    {
+        [JsonPropertyName("ecosystem")]
+        public string? Ecosystem { get; set; }
+
+        [JsonPropertyName("name")]
+        public string? Name { get; set; }
+
+        [JsonPropertyName("purl")]
+        public string? Purl { get; set; }
+    }
+
+    private sealed class OsvApiRange
+    {
+        [JsonPropertyName("type")]
+        public string? Type { get; set; }
+
+        [JsonPropertyName("events")]
+        public OsvApiEvent[]? Events { get; set; }
+    }
+
+    private sealed class OsvApiEvent
+    {
+        [JsonPropertyName("introduced")]
+        public string? Introduced { get; set; }
+
+        [JsonPropertyName("fixed")]
+        public string? Fixed { get; set; }
+
+        [JsonPropertyName("last_affected")]
+        public string? LastAffected { get; set; }
+    }
+
+    private sealed class OsvApiSeverity
+    {
+        [JsonPropertyName("type")]
+        public string? Type { get; set; }
+
+        [JsonPropertyName("score")]
+        public string? Score { get; set; }
+    }
+
+    private sealed class OsvApiReference
+    {
+        [JsonPropertyName("type")]
+        public string? Type { get; set; }
+
+        [JsonPropertyName("url")]
+        public string? Url { get; set; }
+    }
+}

src/__Libraries/StellaOps.Reachability.Core/CveMapping/UnifiedDiffParser.cs

@@ -0,0 +1,300 @@
+// <copyright file="UnifiedDiffParser.cs" company="StellaOps">
+// Copyright (c) StellaOps. Licensed under the AGPL-3.0-or-later.
+// </copyright>
+
+using System.Collections.Immutable;
+using System.Text.RegularExpressions;
+
+namespace StellaOps.Reachability.Core.CveMapping;
+
+/// <summary>
+/// Parses unified diff format (git diff, patch files).
+/// Sprint: SPRINT_20260109_009_003 Task: Implement UnifiedDiffParser
+/// </summary>
+public sealed partial class UnifiedDiffParser
+{
+    // Regex patterns for parsing
+    [GeneratedRegex(@"^diff --git a/(.+) b/(.+)$")]
+    private static partial Regex DiffHeaderRegex();
+
+    [GeneratedRegex(@"^--- (?:a/)?(.+)$")]
+    private static partial Regex OldFileRegex();
+
+    [GeneratedRegex(@"^\+\+\+ (?:b/)?(.+)$")]
+    private static partial Regex NewFileRegex();
+
+    [GeneratedRegex(@"^@@ -(\d+)(?:,(\d+))? \+(\d+)(?:,(\d+))? @@(.*)$")]
+    private static partial Regex HunkHeaderRegex();
+
+    /// <summary>
+    /// Parses unified diff content.
+    /// </summary>
+    /// <param name="diffContent">Raw diff content.</param>
+    /// <returns>Parsed diff structure.</returns>
+    public ParsedDiff Parse(string diffContent)
+    {
+        ArgumentException.ThrowIfNullOrEmpty(diffContent);
+
+        var files = new List<FileDiff>();
+        var lines = diffContent.Split('\n');
+        var currentFile = (FileDiff?)null;
+        var currentHunk = (DiffHunk?)null;
+        var contextLines = new List<string>();
+        var addedLines = new List<DiffLine>();
+        var removedLines = new List<DiffLine>();
+        var currentOldLine = 0;
+        var currentNewLine = 0;
+
+        for (var i = 0; i < lines.Length; i++)
+        {
+            var line = lines[i].TrimEnd('\r');
+
+            // Check for new file diff
+            var diffMatch = DiffHeaderRegex().Match(line);
+            if (diffMatch.Success)
+            {
+                // Save previous file and hunk
+                FinalizeHunk(ref currentHunk, ref currentFile, contextLines, addedLines, removedLines);
+                FinalizeFile(ref currentFile, files);
+
+                currentFile = new FileDiff
+                {
+                    OldPath = diffMatch.Groups[1].Value,
+                    NewPath = diffMatch.Groups[2].Value,
+                    Hunks = []
+                };
+                continue;
+            }
+
+            // Check for old file path
+            var oldMatch = OldFileRegex().Match(line);
+            if (oldMatch.Success && currentFile is not null)
+            {
+                var path = oldMatch.Groups[1].Value;
+                if (path == "/dev/null")
+                {
+                    currentFile = currentFile with { OldPath = null };
+                }
+                else
+                {
+                    currentFile = currentFile with { OldPath = path };
+                }
+                continue;
+            }
+
+            // Check for new file path
+            var newMatch = NewFileRegex().Match(line);
+            if (newMatch.Success && currentFile is not null)
+            {
+                var path = newMatch.Groups[1].Value;
+                if (path == "/dev/null")
+                {
+                    currentFile = currentFile with { NewPath = null };
+                }
+                else
+                {
+                    currentFile = currentFile with { NewPath = path };
+                }
+                continue;
+            }
+
+            // Check for hunk header
+            var hunkMatch = HunkHeaderRegex().Match(line);
+            if (hunkMatch.Success && currentFile is not null)
+            {
+                // Save previous hunk
+                FinalizeHunk(ref currentHunk, ref currentFile, contextLines, addedLines, removedLines);
+
+                currentOldLine = int.Parse(hunkMatch.Groups[1].Value, System.Globalization.CultureInfo.InvariantCulture);
+                currentNewLine = int.Parse(hunkMatch.Groups[3].Value, System.Globalization.CultureInfo.InvariantCulture);
+                var funcContext = hunkMatch.Groups[5].Value.Trim();
+
+                currentHunk = new DiffHunk
+                {
+                    OldStart = currentOldLine,
+                    OldLength = hunkMatch.Groups[2].Success
+                        ? int.Parse(hunkMatch.Groups[2].Value, System.Globalization.CultureInfo.InvariantCulture)
+                        : 1,
+                    NewStart = currentNewLine,
+                    NewLength = hunkMatch.Groups[4].Success
+                        ? int.Parse(hunkMatch.Groups[4].Value, System.Globalization.CultureInfo.InvariantCulture)
+                        : 1,
+                    FunctionContext = string.IsNullOrEmpty(funcContext) ? null : funcContext,
+                    Context = [],
+                    AddedLines = [],
+                    RemovedLines = []
+                };
+
+                contextLines.Clear();
+                addedLines.Clear();
+                removedLines.Clear();
+                continue;
+            }
+
+            // Process diff content lines
+            if (currentHunk is not null)
+            {
+                if (line.StartsWith('+'))
+                {
+                    addedLines.Add(new DiffLine(currentNewLine, line[1..]));
+                    currentNewLine++;
+                }
+                else if (line.StartsWith('-'))
+                {
+                    removedLines.Add(new DiffLine(currentOldLine, line[1..]));
+                    currentOldLine++;
+                }
+                else if (line.StartsWith(' ') || line.Length == 0)
+                {
+                    var content = line.Length > 0 ? line[1..] : string.Empty;
+                    contextLines.Add(content);
+                    currentOldLine++;
+                    currentNewLine++;
+                }
+                // Ignore other lines (like "\ No newline at end of file")
+            }
+        }
+
+        // Finalize last hunk and file
+        FinalizeHunk(ref currentHunk, ref currentFile, contextLines, addedLines, removedLines);
+        FinalizeFile(ref currentFile, files);
+
+        return new ParsedDiff { Files = [.. files] };
+    }
+
+    private static void FinalizeHunk(
+        ref DiffHunk? currentHunk,
+        ref FileDiff? currentFile,
+        List<string> contextLines,
+        List<DiffLine> addedLines,
+        List<DiffLine> removedLines)
+    {
+        if (currentHunk is null || currentFile is null)
+        {
+            return;
+        }
+
+        currentHunk = currentHunk with
+        {
+            Context = [.. contextLines],
+            AddedLines = [.. addedLines],
+            RemovedLines = [.. removedLines]
+        };
+
+        currentFile = currentFile with
+        {
+            Hunks = currentFile.Hunks.Add(currentHunk)
+        };
+
+        currentHunk = null;
+    }
+
+    private static void FinalizeFile(ref FileDiff? currentFile, List<FileDiff> files)
+    {
+        if (currentFile is not null)
+        {
+            files.Add(currentFile);
+            currentFile = null;
+        }
+    }
+}
+
+/// <summary>
+/// Represents a parsed unified diff.
+/// </summary>
+public sealed record ParsedDiff
+{
+    /// <summary>
+    /// Files changed in the diff.
+    /// </summary>
+    public required ImmutableArray<FileDiff> Files { get; init; }
+}
+
+/// <summary>
+/// Represents a single file's diff.
+/// </summary>
+public sealed record FileDiff
+{
+    /// <summary>
+    /// Original file path (before changes).
+    /// </summary>
+    public string? OldPath { get; init; }
+
+    /// <summary>
+    /// New file path (after changes).
+    /// </summary>
+    public string? NewPath { get; init; }
+
+    /// <summary>
+    /// Hunks (change sections) in this file.
+    /// </summary>
+    public required ImmutableArray<DiffHunk> Hunks { get; init; }
+
+    /// <summary>
+    /// Whether this is a new file.
+    /// </summary>
+    public bool IsNewFile => OldPath is null || OldPath == "/dev/null";
+
+    /// <summary>
+    /// Whether this file was deleted.
+    /// </summary>
+    public bool IsDeleted => NewPath is null || NewPath == "/dev/null";
+
+    /// <summary>
+    /// Whether this file was renamed.
+    /// </summary>
+    public bool IsRenamed => OldPath != NewPath && !IsNewFile && !IsDeleted;
+}
+
+/// <summary>
+/// Represents a hunk (change section) in a diff.
+/// </summary>
+public sealed record DiffHunk
+{
+    /// <summary>
+    /// Starting line in the old file.
+    /// </summary>
+    public required int OldStart { get; init; }
+
+    /// <summary>
+    /// Number of lines from the old file.
+    /// </summary>
+    public required int OldLength { get; init; }
+
+    /// <summary>
+    /// Starting line in the new file.
+    /// </summary>
+    public required int NewStart { get; init; }
+
+    /// <summary>
+    /// Number of lines in the new file.
+    /// </summary>
+    public required int NewLength { get; init; }
+
+    /// <summary>
+    /// Function context from the hunk header (if present).
+    /// </summary>
+    public string? FunctionContext { get; init; }
+
+    /// <summary>
+    /// Context lines (unchanged).
+    /// </summary>
+    public required ImmutableArray<string> Context { get; init; }
+
+    /// <summary>
+    /// Lines added in this hunk.
+    /// </summary>
+    public required ImmutableArray<DiffLine> AddedLines { get; init; }
+
+    /// <summary>
+    /// Lines removed in this hunk.
+    /// </summary>
+    public required ImmutableArray<DiffLine> RemovedLines { get; init; }
+}
+
+/// <summary>
+/// Represents a line in a diff with its line number.
+/// </summary>
+/// <param name="LineNumber">Line number in the file.</param>
+/// <param name="Content">Line content (without +/- prefix).</param>
+public readonly record struct DiffLine(int LineNumber, string Content);

src/__Libraries/StellaOps.Reachability.Core/Symbols/NativeSymbolNormalizer.cs

@@ -0,0 +1,550 @@
+// <copyright file="NativeSymbolNormalizer.cs" company="StellaOps">
+// Copyright (c) StellaOps. Licensed under the AGPL-3.0-or-later.
+// </copyright>
+
+using System.Text;
+using System.Text.RegularExpressions;
+
+namespace StellaOps.Reachability.Core.Symbols;
+
+/// <summary>
+/// Normalizes native C/C++/Rust symbols from ELF, PE, DWARF, PDB, and eBPF.
+/// Sprint: SPRINT_20260109_009_002 Task: Implement native normalizer
+/// </summary>
+/// <remarks>
+/// Handles mangled names from:
+/// - Itanium C++ ABI (_Z prefix) - GCC, Clang
+/// - MSVC C++ mangling (? prefix)
+/// - Rust mangling (_ZN prefix with hash suffix)
+/// - Plain C symbols (no mangling)
+/// </remarks>
+public sealed partial class NativeSymbolNormalizer : ISymbolNormalizer
+{
+    private static readonly HashSet<SymbolSource> Sources =
+    [
+        SymbolSource.ElfSymtab,
+        SymbolSource.PeExport,
+        SymbolSource.Dwarf,
+        SymbolSource.Pdb,
+        SymbolSource.EbpfUprobe
+    ];
+
+    /// <inheritdoc/>
+    public IReadOnlySet<SymbolSource> SupportedSources => Sources;
+
+    /// <inheritdoc/>
+    public bool CanNormalize(SymbolSource source) => Sources.Contains(source);
+
+    /// <inheritdoc/>
+    public CanonicalSymbol? Normalize(RawSymbol raw)
+    {
+        TryNormalize(raw, out var canonical, out _);
+        return canonical;
+    }
+
+    /// <inheritdoc/>
+    public bool TryNormalize(RawSymbol raw, out CanonicalSymbol? canonical, out string? error)
+    {
+        canonical = null;
+        error = null;
+
+        if (string.IsNullOrWhiteSpace(raw.Value))
+        {
+            error = "Symbol value is empty";
+            return false;
+        }
+
+        // Try different native symbol formats
+        if (TryParseItaniumMangled(raw, out canonical))
+            return true;
+
+        if (TryParseMsvcMangled(raw, out canonical))
+            return true;
+
+        if (TryParseRustMangled(raw, out canonical))
+            return true;
+
+        if (TryParsePlainCSymbol(raw, out canonical))
+            return true;
+
+        if (TryParseDwarfSymbol(raw, out canonical))
+            return true;
+
+        error = $"Cannot parse native symbol: {raw.Value}";
+        return false;
+    }
+
+    /// <summary>
+    /// Parses Itanium C++ ABI mangled names (_Z prefix).
+    /// Example: _ZN4llvm12DenseMapBaseINS_8DenseMapIPKNS_5ValueE...
+    /// </summary>
+    private static bool TryParseItaniumMangled(RawSymbol raw, out CanonicalSymbol? canonical)
+    {
+        canonical = null;
+
+        if (!raw.Value.StartsWith("_Z", StringComparison.Ordinal))
+            return false;
+
+        var demangled = DemangleItanium(raw.Value);
+        if (demangled is null)
+            return false;
+
+        return TryParseDemangled(demangled, raw, out canonical);
+    }
+
+    /// <summary>
+    /// Parses MSVC C++ mangled names (? prefix).
+    /// Example: ?lookup@JndiLookup@@QEAA?AVString@@PEAV1@@Z
+    /// </summary>
+    private static bool TryParseMsvcMangled(RawSymbol raw, out CanonicalSymbol? canonical)
+    {
+        canonical = null;
+
+        if (!raw.Value.StartsWith('?'))
+            return false;
+
+        var demangled = DemangleMsvc(raw.Value);
+        if (demangled is null)
+            return false;
+
+        return TryParseDemangled(demangled, raw, out canonical);
+    }
+
+    /// <summary>
+    /// Parses Rust mangled names (v0 or legacy).
+    /// Example: _ZN4core3ptr85drop_in_place$LT$std..rt..lang_start...
+    /// </summary>
+    private static bool TryParseRustMangled(RawSymbol raw, out CanonicalSymbol? canonical)
+    {
+        canonical = null;
+
+        // Rust v0 mangling starts with _R
+        // Legacy Rust mangling starts with _ZN and has hash suffix
+        if (!raw.Value.StartsWith("_R", StringComparison.Ordinal) &&
+            !(raw.Value.StartsWith("_ZN", StringComparison.Ordinal) && RustHashSuffixRegex().IsMatch(raw.Value)))
+        {
+            return false;
+        }
+
+        var demangled = DemangleRust(raw.Value);
+        if (demangled is null)
+            return false;
+
+        return TryParseDemangled(demangled, raw, out canonical);
+    }
+
+    /// <summary>
+    /// Parses plain C symbols (function names without mangling).
+    /// Example: ssl_do_handshake, EVP_EncryptInit_ex
+    /// </summary>
+    private static bool TryParsePlainCSymbol(RawSymbol raw, out CanonicalSymbol? canonical)
+    {
+        canonical = null;
+
+        // Plain C symbols are alphanumeric with underscores, no special prefixes
+        if (!PlainCSymbolRegex().IsMatch(raw.Value))
+            return false;
+
+        // Check it's not a mangled symbol
+        if (raw.Value.StartsWith("_Z", StringComparison.Ordinal) ||
+            raw.Value.StartsWith("_R", StringComparison.Ordinal) ||
+            raw.Value.StartsWith('?'))
+        {
+            return false;
+        }
+
+        // Extract namespace from prefixes (e.g., ssl_, EVP_, OPENSSL_)
+        var (ns, method) = ExtractCNamespace(raw.Value);
+
+        canonical = CanonicalSymbol.Create(
+            @namespace: ns,
+            type: "_",  // C has no classes
+            method: method,
+            signature: "()",  // Unknown signature
+            source: raw.Source,
+            purl: raw.Purl,
+            originalSymbol: raw.Value);
+
+        return true;
+    }
+
+    /// <summary>
+    /// Parses DWARF debug info format.
+    /// Example: namespace::class::method(params) or file.c:function
+    /// </summary>
+    private static bool TryParseDwarfSymbol(RawSymbol raw, out CanonicalSymbol? canonical)
+    {
+        canonical = null;
+
+        // Pattern: namespace::class::method(params)
+        var match = DwarfCppRegex().Match(raw.Value);
+        if (match.Success)
+        {
+            var qualifiedName = match.Groups["qualified"].Value;
+            var @params = match.Groups["params"].Value;
+
+            var parts = qualifiedName.Split("::");
+            var method = parts[^1];
+            var type = parts.Length > 1 ? parts[^2] : "_";
+            var ns = parts.Length > 2 ? string.Join(".", parts[..^2]) : "_";
+
+            canonical = CanonicalSymbol.Create(
+                @namespace: ns,
+                type: type,
+                method: method,
+                signature: NormalizeNativeParams(@params),
+                source: raw.Source,
+                purl: raw.Purl,
+                originalSymbol: raw.Value);
+
+            return true;
+        }
+
+        // Pattern: file.c:function (GDB style)
+        var fileMatch = DwarfFileRegex().Match(raw.Value);
+        if (fileMatch.Success)
+        {
+            var file = fileMatch.Groups["file"].Value;
+            var function = fileMatch.Groups["function"].Value;
+
+            // Use filename (without extension) as namespace
+            var ns = Path.GetFileNameWithoutExtension(file).ToLowerInvariant();
+
+            canonical = CanonicalSymbol.Create(
+                @namespace: ns,
+                type: "_",
+                method: function,
+                signature: "()",
+                source: raw.Source,
+                purl: raw.Purl,
+                originalSymbol: raw.Value);
+
+            return true;
+        }
+
+        return false;
+    }
+
+    /// <summary>
+    /// Parses a demangled C++/Rust symbol.
+    /// </summary>
+    private static bool TryParseDemangled(string demangled, RawSymbol raw, out CanonicalSymbol? canonical)
+    {
+        canonical = null;
+
+        // Pattern: namespace::class::method(params)
+        var match = DemangledCppRegex().Match(demangled);
+        if (!match.Success)
+        {
+            // Try simpler pattern without params
+            match = DemangledSimpleRegex().Match(demangled);
+            if (!match.Success)
+                return false;
+        }
+
+        var qualifiedName = match.Groups["qualified"].Value;
+        var @params = match.Groups.ContainsKey("params") ? match.Groups["params"].Value : "";
+
+        // Split by :: to get namespace, type, method
+        var parts = qualifiedName.Split(new[] { "::" }, StringSplitOptions.RemoveEmptyEntries);
+        if (parts.Length == 0)
+            return false;
+
+        var method = parts[^1];
+        var type = parts.Length > 1 ? parts[^2] : "_";
+        var ns = parts.Length > 2 ? string.Join(".", parts[..^2]) : "_";
+
+        // Handle template specializations - remove angle brackets content
+        method = TemplateRegex().Replace(method, "");
+        type = TemplateRegex().Replace(type, "");
+
+        canonical = CanonicalSymbol.Create(
+            @namespace: ns,
+            type: type,
+            method: method,
+            signature: NormalizeNativeParams(@params),
+            source: raw.Source,
+            purl: raw.Purl,
+            originalSymbol: raw.Value);
+
+        return true;
+    }
+
+    /// <summary>
+    /// Demangling for Itanium ABI (basic implementation).
+    /// Full demangling would require external library or comprehensive parser.
+    /// </summary>
+    private static string? DemangleItanium(string mangled)
+    {
+        // Basic Itanium demangling - parse nested names
+        if (!mangled.StartsWith("_Z", StringComparison.Ordinal))
+            return null;
+
+        var result = new StringBuilder();
+        var pos = 2; // Skip _Z
+
+        // Handle nested names (_ZN...E)
+        if (pos < mangled.Length && mangled[pos] == 'N')
+        {
+            pos++; // Skip N
+            var parts = new List<string>();
+
+            while (pos < mangled.Length && mangled[pos] != 'E')
+            {
+                // Read length-prefixed name
+                var lengthStr = new StringBuilder();
+                while (pos < mangled.Length && char.IsDigit(mangled[pos]))
+                {
+                    lengthStr.Append(mangled[pos++]);
+                }
+
+                if (lengthStr.Length == 0)
+                {
+                    // Skip qualifiers (K=const, V=volatile, etc.)
+                    if (pos < mangled.Length && "KVrO".Contains(mangled[pos]))
+                    {
+                        pos++;
+                        continue;
+                    }
+                    break;
+                }
+
+                var length = int.Parse(lengthStr.ToString(), System.Globalization.CultureInfo.InvariantCulture);
+                if (pos + length > mangled.Length)
+                    break;
+
+                parts.Add(mangled.Substring(pos, length));
+                pos += length;
+            }
+
+            if (parts.Count > 0)
+            {
+                result.Append(string.Join("::", parts));
+            }
+        }
+        else
+        {
+            // Simple name without nesting
+            var lengthStr = new StringBuilder();
+            while (pos < mangled.Length && char.IsDigit(mangled[pos]))
+            {
+                lengthStr.Append(mangled[pos++]);
+            }
+
+            if (lengthStr.Length > 0)
+            {
+                var length = int.Parse(lengthStr.ToString(), System.Globalization.CultureInfo.InvariantCulture);
+                if (pos + length <= mangled.Length)
+                {
+                    result.Append(mangled.Substring(pos, length));
+                }
+            }
+        }
+
+        // Try to extract parameters (simplified - just mark as having params)
+        if (result.Length > 0)
+        {
+            return result + "()";
+        }
+
+        return null;
+    }
+
+    /// <summary>
+    /// Demangling for MSVC (basic implementation).
+    /// </summary>
+    private static string? DemangleMsvc(string mangled)
+    {
+        // Basic MSVC demangling
+        if (!mangled.StartsWith('?'))
+            return null;
+
+        // Pattern: ?name@scope1@scope2@@...
+        var match = MsvcMangledRegex().Match(mangled);
+        if (!match.Success)
+            return null;
+
+        var name = match.Groups["name"].Value;
+        var scopes = match.Groups["scopes"].Value;
+
+        // Reverse scope order (MSVC stores innermost first)
+        var scopeParts = scopes.Split('@', StringSplitOptions.RemoveEmptyEntries);
+        Array.Reverse(scopeParts);
+
+        if (scopeParts.Length > 0)
+        {
+            return string.Join("::", scopeParts) + "::" + name + "()";
+        }
+
+        return name + "()";
+    }
+
+    /// <summary>
+    /// Demangling for Rust (basic implementation).
+    /// </summary>
+    private static string? DemangleRust(string mangled)
+    {
+        // Rust v0 mangling starts with _R
+        if (mangled.StartsWith("_R", StringComparison.Ordinal))
+        {
+            // v0 mangling is complex - basic extraction
+            return ExtractRustV0Symbol(mangled);
+        }
+
+        // Legacy Rust mangling - similar to Itanium but with hash suffix
+        if (mangled.StartsWith("_ZN", StringComparison.Ordinal))
+        {
+            // Remove hash suffix (17h followed by 16 hex chars)
+            var cleaned = RustHashSuffixRegex().Replace(mangled, "E");
+            return DemangleItanium(cleaned.Replace("_ZN", "_ZN"));
+        }
+
+        return null;
+    }
+
+    private static string? ExtractRustV0Symbol(string mangled)
+    {
+        // Very basic v0 extraction - just try to find readable parts
+        var readable = new StringBuilder();
+        var pos = 2; // Skip _R
+
+        while (pos < mangled.Length)
+        {
+            if (char.IsDigit(mangled[pos]))
+            {
+                var lengthStr = new StringBuilder();
+                while (pos < mangled.Length && char.IsDigit(mangled[pos]))
+                {
+                    lengthStr.Append(mangled[pos++]);
+                }
+
+                if (lengthStr.Length > 0 && pos < mangled.Length)
+                {
+                    // Skip 'u' prefix for unicode if present
+                    if (mangled[pos] == 'u')
+                        pos++;
+
+                    var length = int.Parse(lengthStr.ToString(), System.Globalization.CultureInfo.InvariantCulture);
+                    if (pos + length <= mangled.Length && length > 0 && length < 100)
+                    {
+                        if (readable.Length > 0)
+                            readable.Append("::");
+                        readable.Append(mangled.AsSpan(pos, length));
+                        pos += length;
+                        continue;
+                    }
+                }
+            }
+            pos++;
+        }
+
+        return readable.Length > 0 ? readable + "()" : null;
+    }
+
+    /// <summary>
+    /// Extracts namespace from C function naming conventions.
+    /// </summary>
+    private static (string Namespace, string Method) ExtractCNamespace(string symbol)
+    {
+        // Common C library prefixes
+        var prefixes = new[]
+        {
+            ("ssl_", "openssl.ssl"),
+            ("SSL_", "openssl.ssl"),
+            ("EVP_", "openssl.evp"),
+            ("OPENSSL_", "openssl"),
+            ("BIO_", "openssl.bio"),
+            ("X509_", "openssl.x509"),
+            ("RSA_", "openssl.rsa"),
+            ("EC_", "openssl.ec"),
+            ("curl_", "curl"),
+            ("CURL_", "curl"),
+            ("sqlite3_", "sqlite3"),
+            ("png_", "libpng"),
+            ("jpeg_", "libjpeg"),
+            ("z_", "zlib"),
+            ("inflate", "zlib"),
+            ("deflate", "zlib"),
+            ("xml", "libxml2"),
+            ("XML", "libxml2"),
+            ("pthread_", "pthread"),
+            ("sem_", "posix"),
+            ("shm_", "posix"),
+            ("mq_", "posix")
+        };
+
+        foreach (var (prefix, ns) in prefixes)
+        {
+            if (symbol.StartsWith(prefix, StringComparison.OrdinalIgnoreCase))
+            {
+                var method = symbol[prefix.Length..];
+                return (ns, method.Length > 0 ? method : symbol);
+            }
+        }
+
+        // No known prefix - use generic namespace
+        return ("native", symbol);
+    }
+
+    /// <summary>
+    /// Normalizes native parameter list to simplified form.
+    /// </summary>
+    private static string NormalizeNativeParams(string @params)
+    {
+        if (string.IsNullOrWhiteSpace(@params))
+            return "()";
+
+        // Remove const, volatile, pointer/reference decorations
+        var simplified = @params
+            .Replace("const ", "")
+            .Replace("volatile ", "")
+            .Replace(" const", "")
+            .Replace("*", "")
+            .Replace("&", "")
+            .Replace("  ", " ")
+            .Trim();
+
+        // Extract just type names
+        var types = simplified.Split(',', StringSplitOptions.TrimEntries)
+            .Select(p =>
+            {
+                // Get the last word (type name) from each param
+                var parts = p.Split(' ', StringSplitOptions.RemoveEmptyEntries);
+                if (parts.Length == 0)
+                    return "";
+                // Handle namespaced types
+                var typeName = parts[^1];
+                if (typeName.Contains("::"))
+                    typeName = typeName.Split("::")[^1];
+                return typeName.ToLowerInvariant();
+            })
+            .Where(t => !string.IsNullOrEmpty(t));
+
+        return $"({string.Join(", ", types)})";
+    }
+
+    // Regex patterns
+    [GeneratedRegex(@"^[a-zA-Z_][a-zA-Z0-9_]*$")]
+    private static partial Regex PlainCSymbolRegex();
+
+    [GeneratedRegex(@"(?<qualified>[\w:]+)\s*\((?<params>[^)]*)\)")]
+    private static partial Regex DwarfCppRegex();
+
+    [GeneratedRegex(@"(?<file>[\w./]+\.[ch]pp?):(?<function>\w+)")]
+    private static partial Regex DwarfFileRegex();
+
+    [GeneratedRegex(@"(?<qualified>[\w:]+)\s*\((?<params>[^)]*)\)")]
+    private static partial Regex DemangledCppRegex();
+
+    [GeneratedRegex(@"^(?<qualified>[\w:]+)$")]
+    private static partial Regex DemangledSimpleRegex();
+
+    [GeneratedRegex(@"<[^>]*>")]
+    private static partial Regex TemplateRegex();
+
+    [GeneratedRegex(@"^\?(?<name>\w+)@(?<scopes>[\w@]+)@@")]
+    private static partial Regex MsvcMangledRegex();
+
+    [GeneratedRegex(@"17h[0-9a-f]{16}E?$")]
+    private static partial Regex RustHashSuffixRegex();
+}

src/__Libraries/StellaOps.Reachability.Core/Symbols/ProgrammingLanguage.cs

@@ -0,0 +1,66 @@
+// <copyright file="ProgrammingLanguage.cs" company="StellaOps">
+// Copyright (c) StellaOps. Licensed under the AGPL-3.0-or-later.
+// </copyright>
+
+namespace StellaOps.Reachability.Core.Symbols;
+
+/// <summary>
+/// Supported programming languages for symbol canonicalization.
+/// Sprint: SPRINT_20260109_009_003 Task: Create ProgrammingLanguage enum
+/// </summary>
+public enum ProgrammingLanguage
+{
+    /// <summary>Unknown or unsupported language.</summary>
+    Unknown = 0,
+
+    /// <summary>C# (.cs files).</summary>
+    CSharp = 1,
+
+    /// <summary>Java (.java files).</summary>
+    Java = 2,
+
+    /// <summary>Kotlin (.kt, .kts files).</summary>
+    Kotlin = 3,
+
+    /// <summary>Python (.py files).</summary>
+    Python = 4,
+
+    /// <summary>JavaScript (.js files).</summary>
+    JavaScript = 5,
+
+    /// <summary>TypeScript (.ts files).</summary>
+    TypeScript = 6,
+
+    /// <summary>Go (.go files).</summary>
+    Go = 7,
+
+    /// <summary>Rust (.rs files).</summary>
+    Rust = 8,
+
+    /// <summary>C (.c, .h files).</summary>
+    C = 9,
+
+    /// <summary>C++ (.cpp, .cc, .cxx, .hpp files).</summary>
+    Cpp = 10,
+
+    /// <summary>Ruby (.rb files).</summary>
+    Ruby = 11,
+
+    /// <summary>PHP (.php files).</summary>
+    Php = 12,
+
+    /// <summary>Swift (.swift files).</summary>
+    Swift = 13,
+
+    /// <summary>Scala (.scala files).</summary>
+    Scala = 14,
+
+    /// <summary>Objective-C (.m, .mm files).</summary>
+    ObjectiveC = 15,
+
+    /// <summary>Elixir (.ex, .exs files).</summary>
+    Elixir = 16,
+
+    /// <summary>Erlang (.erl files).</summary>
+    Erlang = 17
+}

src/__Libraries/StellaOps.Reachability.Core/Symbols/ScriptSymbolNormalizer.cs

@@ -0,0 +1,453 @@
+// <copyright file="ScriptSymbolNormalizer.cs" company="StellaOps">
+// Copyright (c) StellaOps. Licensed under the AGPL-3.0-or-later.
+// </copyright>
+
+using System.Text.RegularExpressions;
+
+namespace StellaOps.Reachability.Core.Symbols;
+
+/// <summary>
+/// Normalizes script language symbols from V8 (JS), Python, and PHP.
+/// Sprint: SPRINT_20260109_009_002 Task: Implement script normalizer
+/// </summary>
+/// <remarks>
+/// Handles symbols from:
+/// - V8 profiler (Node.js) - stack frames
+/// - Python sys.settrace - function/method traces
+/// - PHP Xdebug - profiler output
+/// </remarks>
+public sealed partial class ScriptSymbolNormalizer : ISymbolNormalizer
+{
+    private static readonly HashSet<SymbolSource> Sources =
+    [
+        SymbolSource.V8Profiler,
+        SymbolSource.PythonTrace,
+        SymbolSource.PhpXdebug
+    ];
+
+    /// <inheritdoc/>
+    public IReadOnlySet<SymbolSource> SupportedSources => Sources;
+
+    /// <inheritdoc/>
+    public bool CanNormalize(SymbolSource source) => Sources.Contains(source);
+
+    /// <inheritdoc/>
+    public CanonicalSymbol? Normalize(RawSymbol raw)
+    {
+        TryNormalize(raw, out var canonical, out _);
+        return canonical;
+    }
+
+    /// <inheritdoc/>
+    public bool TryNormalize(RawSymbol raw, out CanonicalSymbol? canonical, out string? error)
+    {
+        canonical = null;
+        error = null;
+
+        if (string.IsNullOrWhiteSpace(raw.Value))
+        {
+            error = "Symbol value is empty";
+            return false;
+        }
+
+        var result = raw.Source switch
+        {
+            SymbolSource.V8Profiler => TryParseV8Symbol(raw, out canonical),
+            SymbolSource.PythonTrace => TryParsePythonSymbol(raw, out canonical),
+            SymbolSource.PhpXdebug => TryParsePhpSymbol(raw, out canonical),
+            _ => TryParseGenericScript(raw, out canonical)
+        };
+
+        if (!result)
+        {
+            error = $"Cannot parse script symbol: {raw.Value}";
+        }
+
+        return result;
+    }
+
+    /// <summary>
+    /// Parses V8 profiler stack frame format.
+    /// Examples:
+    /// - "lodash.template (lodash.js:1234:56)"
+    /// - "Module._load (internal/modules/cjs/loader.js:789:10)"
+    /// - "anonymous (webpack:///src/app.js:12:3)"
+    /// - "Foo.bar [as baz] (foo.js:1:1)"
+    /// </summary>
+    private static bool TryParseV8Symbol(RawSymbol raw, out CanonicalSymbol? canonical)
+    {
+        canonical = null;
+
+        // Pattern: FunctionName (file:line:col) or Class.method (file:line:col)
+        var match = V8StackFrameRegex().Match(raw.Value);
+        if (match.Success)
+        {
+            var functionName = match.Groups["function"].Value.Trim();
+            var file = match.Groups["file"].Value;
+
+            // Handle "Class.method" or "method"
+            var (ns, type, method) = ParseJsFunctionName(functionName, file);
+
+            canonical = CanonicalSymbol.Create(
+                @namespace: ns,
+                type: type,
+                method: method,
+                signature: "()",
+                source: raw.Source,
+                purl: raw.Purl,
+                originalSymbol: raw.Value);
+
+            return true;
+        }
+
+        // Simple function name without location
+        if (JsIdentifierRegex().IsMatch(raw.Value))
+        {
+            var (ns, type, method) = ParseJsFunctionName(raw.Value, null);
+
+            canonical = CanonicalSymbol.Create(
+                @namespace: ns,
+                type: type,
+                method: method,
+                signature: "()",
+                source: raw.Source,
+                purl: raw.Purl,
+                originalSymbol: raw.Value);
+
+            return true;
+        }
+
+        return false;
+    }
+
+    /// <summary>
+    /// Parses Python trace format.
+    /// Examples:
+    /// - "module.submodule:ClassName.method"
+    /// - "package.module:function"
+    /// - "<module>:function" (top-level)
+    /// - "django.template.base:Template.render"
+    /// </summary>
+    private static bool TryParsePythonSymbol(RawSymbol raw, out CanonicalSymbol? canonical)
+    {
+        canonical = null;
+
+        // Pattern with module:qualified_name
+        var colonMatch = PythonColonFormatRegex().Match(raw.Value);
+        if (colonMatch.Success)
+        {
+            var module = colonMatch.Groups["module"].Value;
+            var qualifiedName = colonMatch.Groups["qualified"].Value;
+
+            var (type, method) = ParsePythonQualifiedName(qualifiedName);
+
+            canonical = CanonicalSymbol.Create(
+                @namespace: module == "<module>" ? "_" : module,
+                type: type,
+                method: method,
+                signature: "()",
+                source: raw.Source,
+                purl: raw.Purl,
+                originalSymbol: raw.Value);
+
+            return true;
+        }
+
+        // Dot-separated pattern: module.Class.method
+        var dotMatch = PythonDotFormatRegex().Match(raw.Value);
+        if (dotMatch.Success)
+        {
+            var parts = raw.Value.Split('.');
+            if (parts.Length >= 2)
+            {
+                var method = parts[^1];
+                var type = parts.Length > 2 && char.IsUpper(parts[^2][0]) ? parts[^2] : "_";
+                var ns = type == "_"
+                    ? string.Join(".", parts[..^1])
+                    : string.Join(".", parts[..^2]);
+
+                canonical = CanonicalSymbol.Create(
+                    @namespace: ns.Length > 0 ? ns : "_",
+                    type: type,
+                    method: method,
+                    signature: "()",
+                    source: raw.Source,
+                    purl: raw.Purl,
+                    originalSymbol: raw.Value);
+
+                return true;
+            }
+        }
+
+        // Simple function name
+        if (PythonIdentifierRegex().IsMatch(raw.Value))
+        {
+            canonical = CanonicalSymbol.Create(
+                @namespace: "_",
+                type: "_",
+                method: raw.Value,
+                signature: "()",
+                source: raw.Source,
+                purl: raw.Purl,
+                originalSymbol: raw.Value);
+
+            return true;
+        }
+
+        return false;
+    }
+
+    /// <summary>
+    /// Parses PHP Xdebug profiler format.
+    /// Examples:
+    /// - "Namespace\\Class->method"
+    /// - "Namespace\\Class::staticMethod"
+    /// - "function_name"
+    /// - "{closure:/path/file.php:123-456}"
+    /// </summary>
+    private static bool TryParsePhpSymbol(RawSymbol raw, out CanonicalSymbol? canonical)
+    {
+        canonical = null;
+
+        // Instance method: Namespace\Class->method
+        var instanceMatch = PhpInstanceMethodRegex().Match(raw.Value);
+        if (instanceMatch.Success)
+        {
+            var fullClass = instanceMatch.Groups["class"].Value;
+            var method = instanceMatch.Groups["method"].Value;
+
+            var (ns, type) = ParsePhpClassName(fullClass);
+
+            canonical = CanonicalSymbol.Create(
+                @namespace: ns,
+                type: type,
+                method: method,
+                signature: "()",
+                source: raw.Source,
+                purl: raw.Purl,
+                originalSymbol: raw.Value);
+
+            return true;
+        }
+
+        // Static method: Namespace\Class::method
+        var staticMatch = PhpStaticMethodRegex().Match(raw.Value);
+        if (staticMatch.Success)
+        {
+            var fullClass = staticMatch.Groups["class"].Value;
+            var method = staticMatch.Groups["method"].Value;
+
+            var (ns, type) = ParsePhpClassName(fullClass);
+
+            canonical = CanonicalSymbol.Create(
+                @namespace: ns,
+                type: type,
+                method: method,
+                signature: "()",
+                source: raw.Source,
+                purl: raw.Purl,
+                originalSymbol: raw.Value);
+
+            return true;
+        }
+
+        // Closure: {closure:/path/file.php:123-456}
+        var closureMatch = PhpClosureRegex().Match(raw.Value);
+        if (closureMatch.Success)
+        {
+            var file = closureMatch.Groups["file"].Value;
+            var ns = Path.GetFileNameWithoutExtension(file).ToLowerInvariant();
+
+            canonical = CanonicalSymbol.Create(
+                @namespace: ns.Length > 0 ? ns : "_",
+                type: "_",
+                method: "{closure}",
+                signature: "()",
+                source: raw.Source,
+                purl: raw.Purl,
+                originalSymbol: raw.Value);
+
+            return true;
+        }
+
+        // Plain function
+        if (PhpFunctionRegex().IsMatch(raw.Value))
+        {
+            canonical = CanonicalSymbol.Create(
+                @namespace: "_",
+                type: "_",
+                method: raw.Value,
+                signature: "()",
+                source: raw.Source,
+                purl: raw.Purl,
+                originalSymbol: raw.Value);
+
+            return true;
+        }
+
+        return false;
+    }
+
+    /// <summary>
+    /// Generic script symbol parsing fallback.
+    /// </summary>
+    private static bool TryParseGenericScript(RawSymbol raw, out CanonicalSymbol? canonical)
+    {
+        canonical = null;
+
+        // Try common patterns
+        if (TryParseV8Symbol(raw, out canonical))
+            return true;
+
+        if (TryParsePythonSymbol(raw, out canonical))
+            return true;
+
+        if (TryParsePhpSymbol(raw, out canonical))
+            return true;
+
+        return false;
+    }
+
+    /// <summary>
+    /// Parses JavaScript function name into namespace, type, method.
+    /// </summary>
+    private static (string Namespace, string Type, string Method) ParseJsFunctionName(string functionName, string? file)
+    {
+        // Remove "as alias" suffix
+        var asIndex = functionName.IndexOf(" [as ", StringComparison.Ordinal);
+        if (asIndex > 0)
+            functionName = functionName[..asIndex];
+
+        // Handle anonymous functions
+        if (functionName is "anonymous" or "<anonymous>" or "(anonymous)")
+        {
+            var ns = ExtractJsNamespaceFromFile(file);
+            return (ns, "_", "{anonymous}");
+        }
+
+        // Handle "Class.method" or "object.method"
+        var parts = functionName.Split('.');
+        if (parts.Length >= 2)
+        {
+            var method = parts[^1];
+            var type = parts[^2];
+
+            // If type starts with uppercase, treat as class
+            if (char.IsUpper(type[0]))
+            {
+                var ns = parts.Length > 2 ? string.Join(".", parts[..^2]) : ExtractJsNamespaceFromFile(file);
+                return (ns, type, method);
+            }
+            else
+            {
+                // Object notation - use as namespace
+                var ns = string.Join(".", parts[..^1]);
+                return (ns, "_", method);
+            }
+        }
+
+        // Simple function name
+        var fileNs = ExtractJsNamespaceFromFile(file);
+        return (fileNs, "_", functionName);
+    }
+
+    /// <summary>
+    /// Extracts namespace from JavaScript file path.
+    /// </summary>
+    private static string ExtractJsNamespaceFromFile(string? file)
+    {
+        if (string.IsNullOrEmpty(file))
+            return "_";
+
+        // Remove webpack:/// and similar prefixes
+        file = file.Replace("webpack:///", "")
+                   .Replace("file://", "");
+
+        // Get filename without extension
+        var name = Path.GetFileNameWithoutExtension(file);
+
+        // Handle node_modules paths
+        if (file.Contains("node_modules"))
+        {
+            var parts = file.Split(new[] { "node_modules/" }, StringSplitOptions.None);
+            if (parts.Length > 1)
+            {
+                var modulePath = parts[1].Split('/');
+                // Handle scoped packages (@scope/package)
+                if (modulePath.Length > 0 && modulePath[0].StartsWith('@'))
+                {
+                    return modulePath.Length > 1 ? $"{modulePath[0]}/{modulePath[1]}" : modulePath[0];
+                }
+                return modulePath[0];
+            }
+        }
+
+        return name.Length > 0 ? name.ToLowerInvariant() : "_";
+    }
+
+    /// <summary>
+    /// Parses Python qualified name (Class.method or method).
+    /// </summary>
+    private static (string Type, string Method) ParsePythonQualifiedName(string qualified)
+    {
+        var parts = qualified.Split('.');
+        if (parts.Length >= 2)
+        {
+            var method = parts[^1];
+            var type = parts[^2];
+
+            // Check if it's a class (starts with uppercase)
+            if (char.IsUpper(type[0]))
+                return (type, method);
+        }
+
+        return ("_", qualified);
+    }
+
+    /// <summary>
+    /// Parses PHP class name with namespace.
+    /// </summary>
+    private static (string Namespace, string Type) ParsePhpClassName(string fullClass)
+    {
+        // Replace backslashes with dots for canonical format
+        var normalized = fullClass.Replace("\\", ".");
+
+        var parts = normalized.Split('.');
+        if (parts.Length >= 2)
+        {
+            var type = parts[^1];
+            var ns = string.Join(".", parts[..^1]);
+            return (ns, type);
+        }
+
+        return ("_", normalized);
+    }
+
+    // Regex patterns
+    [GeneratedRegex(@"^(?<function>[^(]+)\s*\((?<file>[^:)]+)(?::\d+(?::\d+)?)?\)$")]
+    private static partial Regex V8StackFrameRegex();
+
+    [GeneratedRegex(@"^[\w$][\w$\.]*$")]
+    private static partial Regex JsIdentifierRegex();
+
+    [GeneratedRegex(@"^(?<module>[^:]+):(?<qualified>[\w.]+)$")]
+    private static partial Regex PythonColonFormatRegex();
+
+    [GeneratedRegex(@"^[\w.]+$")]
+    private static partial Regex PythonDotFormatRegex();
+
+    [GeneratedRegex(@"^[a-zA-Z_][a-zA-Z0-9_]*$")]
+    private static partial Regex PythonIdentifierRegex();
+
+    [GeneratedRegex(@"^(?<class>[\w\\]+)->(?<method>\w+)$")]
+    private static partial Regex PhpInstanceMethodRegex();
+
+    [GeneratedRegex(@"^(?<class>[\w\\]+)::(?<method>\w+)$")]
+    private static partial Regex PhpStaticMethodRegex();
+
+    [GeneratedRegex(@"^\{closure:(?<file>[^:}]+)(?::\d+-\d+)?\}$")]
+    private static partial Regex PhpClosureRegex();
+
+    [GeneratedRegex(@"^[a-zA-Z_\x80-\xff][a-zA-Z0-9_\x80-\xff]*$")]
+    private static partial Regex PhpFunctionRegex();
+}

src/__Libraries/StellaOps.Reachability.Core/Symbols/SymbolSource.cs

@@ -67,5 +67,11 @@ public enum SymbolSource
     PatchAnalysis = 50,
 
     /// <summary>Manual curation.</summary>
-    ManualCuration = 51
+    ManualCuration = 51,
+
+    /// <summary>OSV advisory database.</summary>
+    OsvAdvisory = 52,
+
+    /// <summary>NVD advisory database.</summary>
+    NvdAdvisory = 53
 }

src/__Libraries/__Tests/StellaOps.AdvisoryAI.Attestation.Tests/AiAttestationServiceTests.cs

@@ -0,0 +1,221 @@
+// <copyright file="AiAttestationServiceTests.cs" company="StellaOps">
+// Copyright (c) StellaOps. Licensed under the AGPL-3.0-or-later.
+// </copyright>
+
+using System.Collections.Immutable;
+using FluentAssertions;
+using Microsoft.Extensions.Logging.Abstractions;
+using Microsoft.Extensions.Time.Testing;
+using StellaOps.AdvisoryAI.Attestation.Models;
+using Xunit;
+
+namespace StellaOps.AdvisoryAI.Attestation.Tests;
+
+/// <summary>
+/// Tests for <see cref="AiAttestationService"/>.
+/// </summary>
+[Trait("Category", "Unit")]
+public class AiAttestationServiceTests
+{
+    private readonly FakeTimeProvider _timeProvider = new();
+    private readonly AiAttestationService _service;
+
+    public AiAttestationServiceTests()
+    {
+        _service = new AiAttestationService(
+            _timeProvider,
+            NullLogger<AiAttestationService>.Instance);
+    }
+
+    [Fact]
+    public async Task CreateRunAttestationAsync_WithSigning_ReturnsSignedResult()
+    {
+        var attestation = CreateSampleRunAttestation();
+
+        var result = await _service.CreateRunAttestationAsync(attestation, sign: true);
+
+        result.AttestationId.Should().Be(attestation.RunId);
+        result.Signed.Should().BeTrue();
+        result.DsseEnvelope.Should().NotBeNullOrEmpty();
+        result.Digest.Should().StartWith("sha256:");
+        result.StorageUri.Should().Contain(attestation.RunId);
+    }
+
+    [Fact]
+    public async Task CreateRunAttestationAsync_WithoutSigning_ReturnsUnsignedResult()
+    {
+        var attestation = CreateSampleRunAttestation();
+
+        var result = await _service.CreateRunAttestationAsync(attestation, sign: false);
+
+        result.Signed.Should().BeFalse();
+        result.DsseEnvelope.Should().BeNull();
+    }
+
+    [Fact]
+    public async Task GetRunAttestationAsync_AfterCreation_ReturnsAttestation()
+    {
+        var attestation = CreateSampleRunAttestation();
+        await _service.CreateRunAttestationAsync(attestation);
+
+        var retrieved = await _service.GetRunAttestationAsync(attestation.RunId);
+
+        retrieved.Should().NotBeNull();
+        retrieved!.RunId.Should().Be(attestation.RunId);
+        retrieved.TenantId.Should().Be(attestation.TenantId);
+        retrieved.Model.Provider.Should().Be(attestation.Model.Provider);
+    }
+
+    [Fact]
+    public async Task GetRunAttestationAsync_NotFound_ReturnsNull()
+    {
+        var result = await _service.GetRunAttestationAsync("non-existent");
+
+        result.Should().BeNull();
+    }
+
+    [Fact]
+    public async Task VerifyRunAttestationAsync_ValidAttestation_ReturnsValid()
+    {
+        var attestation = CreateSampleRunAttestation();
+        await _service.CreateRunAttestationAsync(attestation, sign: true);
+
+        var result = await _service.VerifyRunAttestationAsync(attestation.RunId);
+
+        result.Valid.Should().BeTrue();
+        result.DigestValid.Should().BeTrue();
+        result.SignatureValid.Should().BeTrue();
+        result.SigningKeyId.Should().NotBeNull();
+    }
+
+    [Fact]
+    public async Task VerifyRunAttestationAsync_NotFound_ReturnsInvalid()
+    {
+        var result = await _service.VerifyRunAttestationAsync("non-existent");
+
+        result.Valid.Should().BeFalse();
+        result.FailureReason.Should().Contain("not found");
+    }
+
+    [Fact]
+    public async Task CreateClaimAttestationAsync_CreatesAndRetrievesClaim()
+    {
+        var claimAttestation = CreateSampleClaimAttestation();
+
+        var result = await _service.CreateClaimAttestationAsync(claimAttestation);
+
+        result.AttestationId.Should().Be(claimAttestation.ClaimId);
+        result.Digest.Should().StartWith("sha256:");
+    }
+
+    [Fact]
+    public async Task GetClaimAttestationsAsync_ReturnsClaimsForRun()
+    {
+        var runId = "run-with-claims";
+        var claim1 = CreateSampleClaimAttestation() with { ClaimId = "claim-1", RunId = runId };
+        var claim2 = CreateSampleClaimAttestation() with { ClaimId = "claim-2", RunId = runId };
+        var claim3 = CreateSampleClaimAttestation() with { ClaimId = "claim-3", RunId = "other-run" };
+
+        await _service.CreateClaimAttestationAsync(claim1);
+        await _service.CreateClaimAttestationAsync(claim2);
+        await _service.CreateClaimAttestationAsync(claim3);
+
+        var claims = await _service.GetClaimAttestationsAsync(runId);
+
+        claims.Should().HaveCount(2);
+        claims.Should().AllSatisfy(c => c.RunId.Should().Be(runId));
+    }
+
+    [Fact]
+    public async Task VerifyClaimAttestationAsync_ValidClaim_ReturnsValid()
+    {
+        var claimAttestation = CreateSampleClaimAttestation();
+        await _service.CreateClaimAttestationAsync(claimAttestation, sign: true);
+
+        var result = await _service.VerifyClaimAttestationAsync(claimAttestation.ClaimId);
+
+        result.Valid.Should().BeTrue();
+        result.DigestValid.Should().BeTrue();
+    }
+
+    [Fact]
+    public async Task ListRecentAttestationsAsync_FiltersByTenant()
+    {
+        var tenant1Run = CreateSampleRunAttestation() with { RunId = "run-t1", TenantId = "tenant-1" };
+        var tenant2Run = CreateSampleRunAttestation() with { RunId = "run-t2", TenantId = "tenant-2" };
+
+        await _service.CreateRunAttestationAsync(tenant1Run);
+        await _service.CreateRunAttestationAsync(tenant2Run);
+
+        var tenant1Attestations = await _service.ListRecentAttestationsAsync("tenant-1");
+
+        tenant1Attestations.Should().HaveCount(1);
+        tenant1Attestations[0].TenantId.Should().Be("tenant-1");
+    }
+
+    [Fact]
+    public async Task ListRecentAttestationsAsync_RespectsLimit()
+    {
+        for (int i = 0; i < 10; i++)
+        {
+            var attestation = CreateSampleRunAttestation() with
+            {
+                RunId = $"run-{i}",
+                TenantId = "tenant-test"
+            };
+            await _service.CreateRunAttestationAsync(attestation);
+            _timeProvider.Advance(TimeSpan.FromSeconds(1));
+        }
+
+        var recent = await _service.ListRecentAttestationsAsync("tenant-test", limit: 5);
+
+        recent.Should().HaveCount(5);
+    }
+
+    [Fact]
+    public async Task CreatedAt_UsesTimeProvider()
+    {
+        var fixedTime = new DateTimeOffset(2026, 1, 9, 12, 0, 0, TimeSpan.Zero);
+        _timeProvider.SetUtcNow(fixedTime);
+
+        var attestation = CreateSampleRunAttestation();
+        var result = await _service.CreateRunAttestationAsync(attestation);
+
+        result.CreatedAt.Should().Be(fixedTime);
+    }
+
+    private static AiRunAttestation CreateSampleRunAttestation()
+    {
+        return new AiRunAttestation
+        {
+            RunId = $"run-{Guid.NewGuid():N}",
+            TenantId = "tenant-test",
+            UserId = "user:test@example.com",
+            StartedAt = DateTimeOffset.Parse("2026-01-09T12:00:00Z"),
+            CompletedAt = DateTimeOffset.Parse("2026-01-09T12:05:00Z"),
+            Model = new AiModelInfo
+            {
+                Provider = "anthropic",
+                ModelId = "claude-3-sonnet"
+            },
+            OverallGroundingScore = 0.9,
+            TotalTokens = 1000
+        };
+    }
+
+    private static AiClaimAttestation CreateSampleClaimAttestation()
+    {
+        return new AiClaimAttestation
+        {
+            ClaimId = $"claim-{Guid.NewGuid():N}",
+            RunId = "run-xyz",
+            TurnId = "turn-001",
+            TenantId = "tenant-test",
+            ClaimText = "Test claim",
+            ClaimDigest = "sha256:test",
+            GroundingScore = 0.85,
+            Timestamp = DateTimeOffset.Parse("2026-01-09T12:00:00Z"),
+            ContentDigest = "sha256:content-test"
+        };
+    }
+}

src/__Libraries/__Tests/StellaOps.AdvisoryAI.Attestation.Tests/AiClaimAttestationTests.cs

@@ -0,0 +1,143 @@
+// <copyright file="AiClaimAttestationTests.cs" company="StellaOps">
+// Copyright (c) StellaOps. Licensed under the AGPL-3.0-or-later.
+// </copyright>
+
+using System.Collections.Immutable;
+using FluentAssertions;
+using StellaOps.AdvisoryAI.Attestation.Models;
+using Xunit;
+
+namespace StellaOps.AdvisoryAI.Attestation.Tests;
+
+/// <summary>
+/// Tests for <see cref="AiClaimAttestation"/>.
+/// </summary>
+[Trait("Category", "Unit")]
+public class AiClaimAttestationTests
+{
+    [Fact]
+    public void PredicateType_IsCorrect()
+    {
+        AiClaimAttestation.PredicateType.Should().Be("https://stellaops.org/attestation/ai-claim/v1");
+    }
+
+    [Fact]
+    public void ComputeDigest_SameClaim_ReturnsSameDigest()
+    {
+        var attestation = CreateSampleClaimAttestation();
+
+        var digest1 = attestation.ComputeDigest();
+        var digest2 = attestation.ComputeDigest();
+
+        digest1.Should().Be(digest2);
+        digest1.Should().StartWith("sha256:");
+    }
+
+    [Fact]
+    public void ComputeDigest_DifferentClaims_ReturnsDifferentDigests()
+    {
+        var attestation1 = CreateSampleClaimAttestation();
+        var attestation2 = attestation1 with { ClaimText = "Different claim text" };
+
+        var digest1 = attestation1.ComputeDigest();
+        var digest2 = attestation2.ComputeDigest();
+
+        digest1.Should().NotBe(digest2);
+    }
+
+    [Fact]
+    public void FromClaimEvidence_CreatesValidAttestation()
+    {
+        var evidence = new ClaimEvidence
+        {
+            Text = "This component is affected by the vulnerability",
+            Position = 45,
+            Length = 47,
+            GroundedBy = ["stella://sbom/abc123", "stella://reach/api:func"],
+            GroundingScore = 0.95,
+            Verified = true,
+            Category = ClaimCategory.Factual
+        };
+
+        var attestation = AiClaimAttestation.FromClaimEvidence(
+            evidence,
+            runId: "run-123",
+            turnId: "turn-456",
+            tenantId: "tenant-xyz",
+            timestamp: DateTimeOffset.Parse("2026-01-09T12:00:00Z"));
+
+        attestation.ClaimText.Should().Be(evidence.Text);
+        attestation.RunId.Should().Be("run-123");
+        attestation.TurnId.Should().Be("turn-456");
+        attestation.TenantId.Should().Be("tenant-xyz");
+        attestation.GroundedBy.Should().HaveCount(2);
+        attestation.GroundingScore.Should().Be(0.95);
+        attestation.Verified.Should().BeTrue();
+        attestation.Category.Should().Be(ClaimCategory.Factual);
+        attestation.ClaimDigest.Should().StartWith("sha256:");
+    }
+
+    [Fact]
+    public void ClaimDigest_IsDeterministic()
+    {
+        var evidence1 = new ClaimEvidence
+        {
+            Text = "Same text",
+            Position = 0,
+            Length = 9,
+            GroundingScore = 0.9
+        };
+
+        var evidence2 = new ClaimEvidence
+        {
+            Text = "Same text",
+            Position = 100,  // Different position
+            Length = 9,
+            GroundingScore = 0.5  // Different score
+        };
+
+        var attestation1 = AiClaimAttestation.FromClaimEvidence(
+            evidence1, "run-1", "turn-1", "tenant-1", DateTimeOffset.UtcNow);
+        var attestation2 = AiClaimAttestation.FromClaimEvidence(
+            evidence2, "run-2", "turn-2", "tenant-2", DateTimeOffset.UtcNow);
+
+        // ClaimDigest should be same because it's based on text only
+        attestation1.ClaimDigest.Should().Be(attestation2.ClaimDigest);
+    }
+
+    [Fact]
+    public void Attestation_WithGrounding_PreservesEvidenceUris()
+    {
+        var groundedBy = ImmutableArray.Create(
+            "stella://sbom/abc123",
+            "stella://reach/api:vulnFunc",
+            "stella://vex/CVE-2023-44487");
+
+        var attestation = CreateSampleClaimAttestation() with
+        {
+            GroundedBy = groundedBy
+        };
+
+        attestation.GroundedBy.Should().HaveCount(3);
+        attestation.GroundedBy.Should().Contain("stella://sbom/abc123");
+    }
+
+    private static AiClaimAttestation CreateSampleClaimAttestation()
+    {
+        return new AiClaimAttestation
+        {
+            ClaimId = "claim-abc123",
+            RunId = "run-xyz",
+            TurnId = "turn-001",
+            TenantId = "tenant-test",
+            ClaimText = "The component is affected by this vulnerability",
+            ClaimDigest = "sha256:abc123",
+            Category = ClaimCategory.Factual,
+            GroundedBy = ["stella://sbom/test"],
+            GroundingScore = 0.85,
+            Verified = true,
+            Timestamp = DateTimeOffset.Parse("2026-01-09T12:00:00Z"),
+            ContentDigest = "sha256:content123"
+        };
+    }
+}

src/__Libraries/__Tests/StellaOps.AdvisoryAI.Attestation.Tests/AiRunAttestationTests.cs

@@ -0,0 +1,124 @@
+// <copyright file="AiRunAttestationTests.cs" company="StellaOps">
+// Copyright (c) StellaOps. Licensed under the AGPL-3.0-or-later.
+// </copyright>
+
+using System.Collections.Immutable;
+using FluentAssertions;
+using StellaOps.AdvisoryAI.Attestation.Models;
+using Xunit;
+
+namespace StellaOps.AdvisoryAI.Attestation.Tests;
+
+/// <summary>
+/// Tests for <see cref="AiRunAttestation"/>.
+/// </summary>
+[Trait("Category", "Unit")]
+public class AiRunAttestationTests
+{
+    [Fact]
+    public void ComputeDigest_SameAttestation_ReturnsSameDigest()
+    {
+        var attestation = CreateSampleAttestation();
+
+        var digest1 = attestation.ComputeDigest();
+        var digest2 = attestation.ComputeDigest();
+
+        digest1.Should().Be(digest2);
+        digest1.Should().StartWith("sha256:");
+    }
+
+    [Fact]
+    public void ComputeDigest_DifferentAttestations_ReturnsDifferentDigests()
+    {
+        var attestation1 = CreateSampleAttestation();
+        var attestation2 = attestation1 with { RunId = "run-different" };
+
+        var digest1 = attestation1.ComputeDigest();
+        var digest2 = attestation2.ComputeDigest();
+
+        digest1.Should().NotBe(digest2);
+    }
+
+    [Fact]
+    public void PredicateType_IsCorrect()
+    {
+        AiRunAttestation.PredicateType.Should().Be("https://stellaops.org/attestation/ai-run/v1");
+    }
+
+    [Fact]
+    public void Attestation_WithTurns_PreservesOrder()
+    {
+        var turns = new[]
+        {
+            CreateTurn("turn-1", TurnRole.User, "2026-01-09T12:00:00Z"),
+            CreateTurn("turn-2", TurnRole.Assistant, "2026-01-09T12:00:05Z"),
+            CreateTurn("turn-3", TurnRole.User, "2026-01-09T12:00:10Z")
+        };
+
+        var attestation = CreateSampleAttestation() with
+        {
+            Turns = [.. turns]
+        };
+
+        attestation.Turns.Should().HaveCount(3);
+        attestation.Turns[0].TurnId.Should().Be("turn-1");
+        attestation.Turns[1].TurnId.Should().Be("turn-2");
+        attestation.Turns[2].TurnId.Should().Be("turn-3");
+    }
+
+    [Fact]
+    public void Attestation_WithContext_PreservesContext()
+    {
+        var context = new AiRunContext
+        {
+            FindingId = "finding-123",
+            CveId = "CVE-2023-44487",
+            Component = "pkg:npm/http2@1.0.0"
+        };
+
+        var attestation = CreateSampleAttestation() with { Context = context };
+
+        attestation.Context.Should().NotBeNull();
+        attestation.Context!.FindingId.Should().Be("finding-123");
+        attestation.Context.CveId.Should().Be("CVE-2023-44487");
+    }
+
+    [Fact]
+    public void Attestation_DefaultStatus_IsCompleted()
+    {
+        var attestation = CreateSampleAttestation();
+
+        attestation.Status.Should().Be(AiRunStatus.Completed);
+    }
+
+    private static AiRunAttestation CreateSampleAttestation()
+    {
+        return new AiRunAttestation
+        {
+            RunId = "run-abc123",
+            TenantId = "tenant-xyz",
+            UserId = "user:alice@example.com",
+            StartedAt = DateTimeOffset.Parse("2026-01-09T12:00:00Z"),
+            CompletedAt = DateTimeOffset.Parse("2026-01-09T12:05:00Z"),
+            Model = new AiModelInfo
+            {
+                Provider = "anthropic",
+                ModelId = "claude-3-sonnet"
+            },
+            OverallGroundingScore = 0.92,
+            TotalTokens = 1500
+        };
+    }
+
+    private static AiTurnSummary CreateTurn(string turnId, TurnRole role, string timestamp)
+    {
+        return new AiTurnSummary
+        {
+            TurnId = turnId,
+            Role = role,
+            ContentDigest = $"sha256:turn-{turnId}",
+            Timestamp = DateTimeOffset.Parse(timestamp),
+            TokenCount = 100
+        };
+    }
+}

src/__Libraries/__Tests/StellaOps.AdvisoryAI.Attestation.Tests/InMemoryAiAttestationStoreTests.cs

@@ -0,0 +1,231 @@
+// <copyright file="InMemoryAiAttestationStoreTests.cs" company="StellaOps">
+// Copyright (c) StellaOps. Licensed under the AGPL-3.0-or-later.
+// </copyright>
+
+using System.Collections.Immutable;
+using FluentAssertions;
+using Microsoft.Extensions.Logging.Abstractions;
+using StellaOps.AdvisoryAI.Attestation.Models;
+using StellaOps.AdvisoryAI.Attestation.Storage;
+using Xunit;
+
+namespace StellaOps.AdvisoryAI.Attestation.Tests;
+
+/// <summary>
+/// Tests for <see cref="InMemoryAiAttestationStore"/>.
+/// </summary>
+[Trait("Category", "Unit")]
+public class InMemoryAiAttestationStoreTests
+{
+    private readonly InMemoryAiAttestationStore _store;
+
+    public InMemoryAiAttestationStoreTests()
+    {
+        _store = new InMemoryAiAttestationStore(NullLogger<InMemoryAiAttestationStore>.Instance);
+    }
+
+    [Fact]
+    public async Task StoreRunAttestation_ThenRetrieve_Works()
+    {
+        var attestation = CreateRunAttestation("run-1");
+
+        await _store.StoreRunAttestationAsync(attestation, CancellationToken.None);
+
+        var retrieved = await _store.GetRunAttestationAsync("run-1", CancellationToken.None);
+
+        retrieved.Should().NotBeNull();
+        retrieved!.RunId.Should().Be("run-1");
+    }
+
+    [Fact]
+    public async Task GetRunAttestation_NotFound_ReturnsNull()
+    {
+        var retrieved = await _store.GetRunAttestationAsync("non-existent", CancellationToken.None);
+
+        retrieved.Should().BeNull();
+    }
+
+    [Fact]
+    public async Task StoreClaimAttestation_ThenRetrieve_Works()
+    {
+        var claim = CreateClaimAttestation("run-1", "turn-1");
+
+        await _store.StoreClaimAttestationAsync(claim, CancellationToken.None);
+
+        var claims = await _store.GetClaimAttestationsAsync("run-1", CancellationToken.None);
+
+        claims.Should().HaveCount(1);
+        claims[0].TurnId.Should().Be("turn-1");
+    }
+
+    [Fact]
+    public async Task GetClaimAttestations_MultiplePerRun_ReturnsAll()
+    {
+        await _store.StoreClaimAttestationAsync(CreateClaimAttestation("run-1", "turn-1"), CancellationToken.None);
+        await _store.StoreClaimAttestationAsync(CreateClaimAttestation("run-1", "turn-2"), CancellationToken.None);
+        await _store.StoreClaimAttestationAsync(CreateClaimAttestation("run-1", "turn-3"), CancellationToken.None);
+
+        var claims = await _store.GetClaimAttestationsAsync("run-1", CancellationToken.None);
+
+        claims.Should().HaveCount(3);
+    }
+
+    [Fact]
+    public async Task GetClaimAttestationsByTurn_FiltersCorrectly()
+    {
+        await _store.StoreClaimAttestationAsync(CreateClaimAttestation("run-1", "turn-1"), CancellationToken.None);
+        await _store.StoreClaimAttestationAsync(CreateClaimAttestation("run-1", "turn-2"), CancellationToken.None);
+        await _store.StoreClaimAttestationAsync(CreateClaimAttestation("run-1", "turn-1"), CancellationToken.None);
+
+        var turn1Claims = await _store.GetClaimAttestationsByTurnAsync("run-1", "turn-1", CancellationToken.None);
+
+        turn1Claims.Should().HaveCount(2);
+        turn1Claims.Should().OnlyContain(c => c.TurnId == "turn-1");
+    }
+
+    [Fact]
+    public async Task Exists_WhenStored_ReturnsTrue()
+    {
+        await _store.StoreRunAttestationAsync(CreateRunAttestation("run-1"), CancellationToken.None);
+
+        var exists = await _store.ExistsAsync("run-1", CancellationToken.None);
+
+        exists.Should().BeTrue();
+    }
+
+    [Fact]
+    public async Task Exists_WhenNotStored_ReturnsFalse()
+    {
+        var exists = await _store.ExistsAsync("non-existent", CancellationToken.None);
+
+        exists.Should().BeFalse();
+    }
+
+    [Fact]
+    public async Task StoreSignedEnvelope_ThenRetrieve_Works()
+    {
+        var envelope = new { Type = "DSSE", Payload = "test" };
+
+        await _store.StoreSignedEnvelopeAsync("run-1", envelope, CancellationToken.None);
+
+        var retrieved = await _store.GetSignedEnvelopeAsync("run-1", CancellationToken.None);
+
+        retrieved.Should().NotBeNull();
+    }
+
+    [Fact]
+    public async Task GetByTenant_FiltersCorrectly()
+    {
+        var now = DateTimeOffset.UtcNow;
+        var att1 = CreateRunAttestation("run-1", "tenant-a", now.AddMinutes(-30));
+        var att2 = CreateRunAttestation("run-2", "tenant-a", now.AddMinutes(-10));
+        var att3 = CreateRunAttestation("run-3", "tenant-b", now.AddMinutes(-20));
+
+        await _store.StoreRunAttestationAsync(att1, CancellationToken.None);
+        await _store.StoreRunAttestationAsync(att2, CancellationToken.None);
+        await _store.StoreRunAttestationAsync(att3, CancellationToken.None);
+
+        var tenantAResults = await _store.GetByTenantAsync(
+            "tenant-a",
+            now.AddHours(-1),
+            now,
+            CancellationToken.None);
+
+        tenantAResults.Should().HaveCount(2);
+        tenantAResults.Should().OnlyContain(a => a.TenantId == "tenant-a");
+    }
+
+    [Fact]
+    public async Task GetByTenant_FiltersTimeRangeCorrectly()
+    {
+        var now = DateTimeOffset.UtcNow;
+        var att1 = CreateRunAttestation("run-1", "tenant-a", now.AddHours(-3));
+        var att2 = CreateRunAttestation("run-2", "tenant-a", now.AddHours(-1));
+        var att3 = CreateRunAttestation("run-3", "tenant-a", now.AddMinutes(-30));
+
+        await _store.StoreRunAttestationAsync(att1, CancellationToken.None);
+        await _store.StoreRunAttestationAsync(att2, CancellationToken.None);
+        await _store.StoreRunAttestationAsync(att3, CancellationToken.None);
+
+        var results = await _store.GetByTenantAsync(
+            "tenant-a",
+            now.AddHours(-2),
+            now,
+            CancellationToken.None);
+
+        results.Should().HaveCount(2);
+        results.Should().NotContain(a => a.RunId == "run-1");
+    }
+
+    [Fact]
+    public async Task GetByContentDigest_Works()
+    {
+        var claim = CreateClaimAttestation("run-1", "turn-1", "sha256:test123");
+        await _store.StoreClaimAttestationAsync(claim, CancellationToken.None);
+
+        var retrieved = await _store.GetByContentDigestAsync("sha256:test123", CancellationToken.None);
+
+        retrieved.Should().NotBeNull();
+        retrieved!.ContentDigest.Should().Be("sha256:test123");
+    }
+
+    [Fact]
+    public async Task GetByContentDigest_NotFound_ReturnsNull()
+    {
+        var retrieved = await _store.GetByContentDigestAsync("sha256:nonexistent", CancellationToken.None);
+
+        retrieved.Should().BeNull();
+    }
+
+    [Fact]
+    public async Task Clear_RemovesAllData()
+    {
+        await _store.StoreRunAttestationAsync(CreateRunAttestation("run-1"), CancellationToken.None);
+        await _store.StoreClaimAttestationAsync(CreateClaimAttestation("run-1", "turn-1"), CancellationToken.None);
+
+        _store.Clear();
+
+        _store.RunAttestationCount.Should().Be(0);
+        _store.ClaimAttestationCount.Should().Be(0);
+    }
+
+    private static AiRunAttestation CreateRunAttestation(
+        string runId,
+        string tenantId = "test-tenant",
+        DateTimeOffset? startedAt = null)
+    {
+        return new AiRunAttestation
+        {
+            RunId = runId,
+            TenantId = tenantId,
+            UserId = "user-1",
+            StartedAt = startedAt ?? DateTimeOffset.UtcNow,
+            CompletedAt = DateTimeOffset.UtcNow,
+            Model = new AiModelInfo
+            {
+                ModelId = "gpt-4",
+                Provider = "openai"
+            },
+            Turns = ImmutableArray<AiTurnSummary>.Empty
+        };
+    }
+
+    private static AiClaimAttestation CreateClaimAttestation(
+        string runId,
+        string turnId,
+        string? contentDigest = null)
+    {
+        return new AiClaimAttestation
+        {
+            ClaimId = $"claim-{Guid.NewGuid():N}",
+            RunId = runId,
+            TurnId = turnId,
+            TenantId = "test-tenant",
+            ClaimText = "Test claim text",
+            ClaimDigest = "sha256:claimhash",
+            Timestamp = DateTimeOffset.UtcNow,
+            ClaimType = "vulnerability_assessment",
+            ContentDigest = contentDigest ?? $"sha256:{runId}-{turnId}"
+        };
+    }
+}

src/__Libraries/__Tests/StellaOps.AdvisoryAI.Attestation.Tests/Integration/AttestationServiceIntegrationTests.cs

@@ -0,0 +1,264 @@
+// <copyright file="AttestationServiceIntegrationTests.cs" company="StellaOps">
+// Copyright (c) StellaOps. Licensed under the AGPL-3.0-or-later.
+// </copyright>
+
+using Microsoft.Extensions.DependencyInjection;
+using StellaOps.AdvisoryAI.Attestation.Models;
+using StellaOps.AdvisoryAI.Attestation.Storage;
+using Xunit;
+
+namespace StellaOps.AdvisoryAI.Attestation.Tests.Integration;
+
+/// <summary>
+/// Integration tests for AI attestation service.
+/// Sprint: SPRINT_20260109_011_001 Task: AIAT-008
+/// </summary>
+[Trait("Category", "Integration")]
+public sealed class AttestationServiceIntegrationTests : IAsyncLifetime
+{
+    private ServiceProvider _serviceProvider = null!;
+    private IAiAttestationService _attestationService = null!;
+    private IAiAttestationStore _store = null!;
+    private TimeProvider _timeProvider = null!;
+
+    public ValueTask InitializeAsync()
+    {
+        var services = new ServiceCollection();
+
+        // Register all attestation services
+        services.AddAiAttestationServices();
+        services.AddInMemoryAiAttestationStore();
+
+        _serviceProvider = services.BuildServiceProvider();
+        _attestationService = _serviceProvider.GetRequiredService<IAiAttestationService>();
+        _store = _serviceProvider.GetRequiredService<IAiAttestationStore>();
+        _timeProvider = _serviceProvider.GetRequiredService<TimeProvider>();
+
+        return ValueTask.CompletedTask;
+    }
+
+    public async ValueTask DisposeAsync()
+    {
+        await _serviceProvider.DisposeAsync();
+    }
+
+    [Fact]
+    public async Task FullRunAttestationFlow_CreateSignVerify_Succeeds()
+    {
+        // Arrange
+        var attestation = CreateSampleRunAttestation("run-integration-001");
+
+        // Act - Create and sign
+        var createResult = await _attestationService.CreateRunAttestationAsync(attestation, sign: true);
+
+        // Assert creation - result has Digest property
+        Assert.NotNull(createResult.Digest);
+        Assert.StartsWith("sha256:", createResult.Digest);
+
+        // Act - Retrieve
+        var retrieved = await _attestationService.GetRunAttestationAsync("run-integration-001");
+
+        // Assert retrieval
+        Assert.NotNull(retrieved);
+        Assert.Equal(attestation.RunId, retrieved.RunId);
+        Assert.Equal(attestation.TenantId, retrieved.TenantId);
+
+        // Act - Verify
+        var verifyResult = await _attestationService.VerifyRunAttestationAsync("run-integration-001");
+
+        // Assert verification
+        Assert.True(verifyResult.Valid);
+        Assert.True(verifyResult.DigestValid);
+    }
+
+    [Fact]
+    public async Task FullClaimAttestationFlow_CreateSignVerify_Succeeds()
+    {
+        // Arrange - Create parent run first
+        var runAttestation = CreateSampleRunAttestation("run-integration-002");
+        await _attestationService.CreateRunAttestationAsync(runAttestation);
+
+        var claimAttestation = CreateSampleClaimAttestation("claim-001", "run-integration-002", "turn-001");
+
+        // Act - Create and sign
+        var createResult = await _attestationService.CreateClaimAttestationAsync(claimAttestation, sign: true);
+
+        // Assert creation
+        Assert.True(createResult.Success);
+        Assert.NotNull(createResult.ContentDigest);
+
+        // Act - Retrieve claims for run
+        var claims = await _attestationService.GetClaimAttestationsAsync("run-integration-002");
+
+        // Assert retrieval
+        Assert.Single(claims);
+        Assert.Equal("claim-001", claims[0].ClaimId);
+
+        // Act - Verify
+        var verifyResult = await _attestationService.VerifyClaimAttestationAsync("claim-001");
+
+        // Assert verification
+        Assert.True(verifyResult.Valid);
+    }
+
+    [Fact]
+    public async Task StorageRoundTrip_MultipleRuns_AllRetrievable()
+    {
+        // Arrange - Create multiple runs
+        var runs = Enumerable.Range(1, 5)
+            .Select(i => CreateSampleRunAttestation($"run-roundtrip-{i:D3}"))
+            .ToList();
+
+        // Act - Store all
+        foreach (var run in runs)
+        {
+            var result = await _attestationService.CreateRunAttestationAsync(run);
+            Assert.NotNull(result.Digest);
+        }
+
+        // Assert - All retrievable
+        foreach (var run in runs)
+        {
+            var retrieved = await _attestationService.GetRunAttestationAsync(run.RunId);
+            Assert.NotNull(retrieved);
+            Assert.Equal(run.RunId, retrieved.RunId);
+        }
+    }
+
+    [Fact]
+    public async Task StorageRoundTrip_MultipleClaimsPerRun_AllRetrievable()
+    {
+        // Arrange
+        var runId = "run-multiclaim-001";
+        var run = CreateSampleRunAttestation(runId);
+        await _attestationService.CreateRunAttestationAsync(run);
+
+        var claims = Enumerable.Range(1, 3)
+            .Select(i => CreateSampleClaimAttestation($"claim-mc-{i:D3}", runId, $"turn-{i:D3}"))
+            .ToList();
+
+        // Act - Store all claims
+        foreach (var claim in claims)
+        {
+            var result = await _attestationService.CreateClaimAttestationAsync(claim);
+            Assert.True(result.Success);
+        }
+
+        // Assert - All claims retrievable
+        var retrieved = await _attestationService.GetClaimAttestationsAsync(runId);
+        Assert.Equal(3, retrieved.Count);
+    }
+
+    [Fact]
+    public async Task QueryByTenant_ReturnsOnlyTenantRuns()
+    {
+        // Arrange
+        var tenant1Run = CreateSampleRunAttestation("run-tenant1-001", tenantId: "tenant-1");
+        var tenant2Run = CreateSampleRunAttestation("run-tenant2-001", tenantId: "tenant-2");
+
+        await _attestationService.CreateRunAttestationAsync(tenant1Run);
+        await _attestationService.CreateRunAttestationAsync(tenant2Run);
+
+        // Act
+        var tenant1Runs = await _attestationService.ListRecentAttestationsAsync("tenant-1", limit: 10);
+        var tenant2Runs = await _attestationService.ListRecentAttestationsAsync("tenant-2", limit: 10);
+
+        // Assert
+        Assert.Single(tenant1Runs);
+        Assert.Equal("run-tenant1-001", tenant1Runs[0].RunId);
+
+        Assert.Single(tenant2Runs);
+        Assert.Equal("run-tenant2-001", tenant2Runs[0].RunId);
+    }
+
+    [Fact]
+    public async Task VerificationFailure_TamperedContent_ReturnsInvalid()
+    {
+        // Arrange
+        var attestation = CreateSampleRunAttestation("run-tamper-001");
+        await _attestationService.CreateRunAttestationAsync(attestation, sign: true);
+
+        // Tamper with stored content by creating a modified attestation
+        var tampered = attestation with { UserId = "tampered-user" };
+
+        // Store the tampered version directly (bypassing service)
+        await _store.StoreRunAttestationAsync(tampered, CancellationToken.None);
+
+        // Act - Verify (should fail because digest won't match)
+        var verifyResult = await _attestationService.VerifyRunAttestationAsync("run-tamper-001");
+
+        // Assert
+        Assert.False(verifyResult.Valid);
+        Assert.NotNull(verifyResult.FailureReason);
+    }
+
+    [Fact]
+    public async Task VerificationFailure_NonExistentRun_ReturnsInvalid()
+    {
+        // Act
+        var verifyResult = await _attestationService.VerifyRunAttestationAsync("non-existent-run");
+
+        // Assert
+        Assert.False(verifyResult.Valid);
+        Assert.Contains("not found", verifyResult.FailureReason, StringComparison.OrdinalIgnoreCase);
+    }
+
+    [Fact]
+    public async Task UnsignedAttestation_VerifiesDigestOnly()
+    {
+        // Arrange
+        var attestation = CreateSampleRunAttestation("run-unsigned-001");
+
+        // Act - Create without signing
+        var createResult = await _attestationService.CreateRunAttestationAsync(attestation, sign: false);
+        Assert.True(createResult.Success);
+
+        // Act - Verify
+        var verifyResult = await _attestationService.VerifyRunAttestationAsync("run-unsigned-001");
+
+        // Assert
+        Assert.True(verifyResult.Valid);
+        Assert.True(verifyResult.DigestValid);
+        Assert.Null(verifyResult.SignatureValid); // No signature to verify
+    }
+
+    private static AiRunAttestation CreateSampleRunAttestation(
+        string runId,
+        string tenantId = "test-tenant",
+        string userId = "test-user")
+    {
+        return new AiRunAttestation
+        {
+            RunId = runId,
+            TenantId = tenantId,
+            UserId = userId,
+            Model = new AiModelInfo
+            {
+                ModelId = "test-model",
+                Provider = "test-provider"
+            },
+            TotalTokens = 100,
+            StartedAt = DateTimeOffset.UtcNow.AddMinutes(-5),
+            CompletedAt = DateTimeOffset.UtcNow
+        };
+    }
+
+    private static AiClaimAttestation CreateSampleClaimAttestation(
+        string claimId,
+        string runId,
+        string turnId)
+    {
+        return new AiClaimAttestation
+        {
+            ClaimId = claimId,
+            RunId = runId,
+            TurnId = turnId,
+            TenantId = "test-tenant",
+            ClaimType = "test_claim",
+            ClaimText = "This is a test claim",
+            ClaimDigest = $"sha256:{claimId}",
+            ContentDigest = $"sha256:content-{claimId}",
+            Timestamp = DateTimeOffset.UtcNow
+        };
+    }
+}

src/__Libraries/__Tests/StellaOps.AdvisoryAI.Attestation.Tests/PromptTemplateRegistryTests.cs

@@ -0,0 +1,167 @@
+// <copyright file="PromptTemplateRegistryTests.cs" company="StellaOps">
+// Copyright (c) StellaOps. Licensed under the AGPL-3.0-or-later.
+// </copyright>
+
+using FluentAssertions;
+using Microsoft.Extensions.Logging.Abstractions;
+using Microsoft.Extensions.Time.Testing;
+using Xunit;
+
+namespace StellaOps.AdvisoryAI.Attestation.Tests;
+
+/// <summary>
+/// Tests for <see cref="PromptTemplateRegistry"/>.
+/// </summary>
+[Trait("Category", "Unit")]
+public class PromptTemplateRegistryTests
+{
+    private readonly FakeTimeProvider _timeProvider = new();
+    private readonly PromptTemplateRegistry _registry;
+
+    public PromptTemplateRegistryTests()
+    {
+        _registry = new PromptTemplateRegistry(
+            _timeProvider,
+            NullLogger<PromptTemplateRegistry>.Instance);
+    }
+
+    [Fact]
+    public void Register_ValidTemplate_StoresWithDigest()
+    {
+        _registry.Register("vuln-explanation", "1.0.0", "Explain this vulnerability: {{cve}}");
+
+        var info = _registry.GetTemplateInfo("vuln-explanation");
+
+        info.Should().NotBeNull();
+        info!.Name.Should().Be("vuln-explanation");
+        info.Version.Should().Be("1.0.0");
+        info.Digest.Should().StartWith("sha256:");
+    }
+
+    [Fact]
+    public void Register_SameTemplateTwice_UpdatesVersion()
+    {
+        _registry.Register("vuln-explanation", "1.0.0", "Template v1");
+        _registry.Register("vuln-explanation", "1.1.0", "Template v2");
+
+        var info = _registry.GetTemplateInfo("vuln-explanation");
+
+        info!.Version.Should().Be("1.1.0");
+    }
+
+    [Fact]
+    public void GetTemplateInfo_ByVersion_ReturnsCorrectVersion()
+    {
+        _registry.Register("vuln-explanation", "1.0.0", "Template v1");
+        _registry.Register("vuln-explanation", "1.1.0", "Template v2");
+
+        var v1 = _registry.GetTemplateInfo("vuln-explanation", "1.0.0");
+        var v2 = _registry.GetTemplateInfo("vuln-explanation", "1.1.0");
+
+        v1!.Version.Should().Be("1.0.0");
+        v2!.Version.Should().Be("1.1.0");
+    }
+
+    [Fact]
+    public void GetTemplateInfo_NotFound_ReturnsNull()
+    {
+        var info = _registry.GetTemplateInfo("non-existent");
+
+        info.Should().BeNull();
+    }
+
+    [Fact]
+    public void VerifyHash_MatchingHash_ReturnsTrue()
+    {
+        const string template = "Test template content";
+        _registry.Register("test", "1.0.0", template);
+
+        var info = _registry.GetTemplateInfo("test");
+        var result = _registry.VerifyHash("test", info!.Digest);
+
+        result.Should().BeTrue();
+    }
+
+    [Fact]
+    public void VerifyHash_NonMatchingHash_ReturnsFalse()
+    {
+        _registry.Register("test", "1.0.0", "Test template content");
+
+        var result = _registry.VerifyHash("test", "sha256:wronghash");
+
+        result.Should().BeFalse();
+    }
+
+    [Fact]
+    public void VerifyHash_NotFound_ReturnsFalse()
+    {
+        var result = _registry.VerifyHash("non-existent", "sha256:anyhash");
+
+        result.Should().BeFalse();
+    }
+
+    [Fact]
+    public void GetAllTemplates_ReturnsAllLatestVersions()
+    {
+        _registry.Register("template-a", "1.0.0", "Template A v1");
+        _registry.Register("template-a", "1.1.0", "Template A v2");
+        _registry.Register("template-b", "1.0.0", "Template B");
+        _registry.Register("template-c", "2.0.0", "Template C");
+
+        var all = _registry.GetAllTemplates();
+
+        all.Should().HaveCount(3);
+        all.Should().Contain(t => t.Name == "template-a" && t.Version == "1.1.0");
+        all.Should().Contain(t => t.Name == "template-b");
+        all.Should().Contain(t => t.Name == "template-c");
+    }
+
+    [Fact]
+    public void Register_DifferentContent_ProducesDifferentDigests()
+    {
+        _registry.Register("template-1", "1.0.0", "Content A");
+        _registry.Register("template-2", "1.0.0", "Content B");
+
+        var info1 = _registry.GetTemplateInfo("template-1");
+        var info2 = _registry.GetTemplateInfo("template-2");
+
+        info1!.Digest.Should().NotBe(info2!.Digest);
+    }
+
+    [Fact]
+    public void Register_SameContent_ProducesSameDigest()
+    {
+        const string content = "Same content";
+        _registry.Register("template-1", "1.0.0", content);
+        _registry.Register("template-2", "1.0.0", content);
+
+        var info1 = _registry.GetTemplateInfo("template-1");
+        var info2 = _registry.GetTemplateInfo("template-2");
+
+        info1!.Digest.Should().Be(info2!.Digest);
+    }
+
+    [Fact]
+    public void Register_NullName_Throws()
+    {
+        var act = () => _registry.Register(null!, "1.0.0", "content");
+
+        act.Should().Throw<ArgumentException>();
+    }
+
+    [Fact]
+    public void Register_EmptyVersion_Throws()
+    {
+        var act = () => _registry.Register("name", "", "content");
+
+        act.Should().Throw<ArgumentException>();
+    }
+
+    [Fact]
+    public void Register_EmptyTemplate_Throws()
+    {
+        var act = () => _registry.Register("name", "1.0.0", "");
+
+        act.Should().Throw<ArgumentException>();
+    }
+}

src/__Libraries/__Tests/StellaOps.AdvisoryAI.Attestation.Tests/StellaOps.AdvisoryAI.Attestation.Tests.csproj

@@ -0,0 +1,19 @@
+<Project Sdk="Microsoft.NET.Sdk">
+
+  <PropertyGroup>
+    <TargetFramework>net10.0</TargetFramework>
+    <ImplicitUsings>enable</ImplicitUsings>
+    <Nullable>enable</Nullable>
+    <LangVersion>preview</LangVersion>
+    <IsPackable>false</IsPackable>
+    <IsTestProject>true</IsTestProject>
+    <!-- xUnit1051 is informational - CancellationToken suggestion -->
+    <NoWarn>$(NoWarn);xUnit1051</NoWarn>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <ProjectReference Include="..\..\StellaOps.AdvisoryAI.Attestation\StellaOps.AdvisoryAI.Attestation.csproj" />
+    <ProjectReference Include="..\..\StellaOps.TestKit\StellaOps.TestKit.csproj" />
+  </ItemGroup>
+
+</Project>

src/__Libraries/__Tests/StellaOps.Reachability.Core.Tests/CveMapping/FunctionBoundaryDetectorTests.cs

@@ -0,0 +1,192 @@
+// <copyright file="FunctionBoundaryDetectorTests.cs" company="StellaOps">
+// Copyright (c) StellaOps. Licensed under the AGPL-3.0-or-later.
+// </copyright>
+
+using System.Collections.Immutable;
+using FluentAssertions;
+using StellaOps.Reachability.Core.CveMapping;
+using StellaOps.Reachability.Core.Symbols;
+using Xunit;
+
+namespace StellaOps.Reachability.Core.Tests.CveMapping;
+
+/// <summary>
+/// Tests for <see cref="FunctionBoundaryDetector"/>.
+/// </summary>
+[Trait("Category", "Unit")]
+public class FunctionBoundaryDetectorTests
+{
+    private readonly FunctionBoundaryDetector _detector = new();
+
+    [Fact]
+    public void DetectFunction_CSharpMethod_DetectsCorrectly()
+    {
+        // Arrange
+        var context = ImmutableArray.Create(
+            "namespace MyApp",
+            "{",
+            "    public class MyService",
+            "    {",
+            "        public void ProcessData(string input)",
+            "        {",
+            "            var result = input.Trim();",
+            "            return result;",
+            "        }",
+            "    }",
+            "}"
+        );
+
+        // Act
+        var result = _detector.DetectFunction(context, 7, ProgrammingLanguage.CSharp);
+
+        // Assert
+        result.Should().NotBeNull();
+        result!.Value.FullyQualifiedName.Should().Contain("ProcessData");
+    }
+
+    [Fact]
+    public void DetectFunction_PythonFunction_DetectsCorrectly()
+    {
+        // Arrange
+        var context = ImmutableArray.Create(
+            "class MyService:",
+            "    def process_data(self, input):",
+            "        result = input.strip()",
+            "        return result",
+            "",
+            "    def other_method(self):",
+            "        pass"
+        );
+
+        // Act
+        var result = _detector.DetectFunction(context, 3, ProgrammingLanguage.Python);
+
+        // Assert
+        result.Should().NotBeNull();
+        result!.Value.FullyQualifiedName.Should().Contain("process_data");
+    }
+
+    [Fact]
+    public void DetectFunction_GoFunction_DetectsCorrectly()
+    {
+        // Arrange
+        var context = ImmutableArray.Create(
+            "package main",
+            "",
+            "func ProcessData(input string) string {",
+            "    result := strings.TrimSpace(input)",
+            "    return result",
+            "}"
+        );
+
+        // Act
+        var result = _detector.DetectFunction(context, 4, ProgrammingLanguage.Go);
+
+        // Assert
+        result.Should().NotBeNull();
+        result!.Value.FullyQualifiedName.Should().Contain("ProcessData");
+    }
+
+    [Fact]
+    public void DetectFunction_JavaScriptArrowFunction_DetectsCorrectly()
+    {
+        // Arrange
+        var context = ImmutableArray.Create(
+            "class MyService {",
+            "    processData = (input) => {",
+            "        const result = input.trim();",
+            "        return result;",
+            "    }",
+            "}"
+        );
+
+        // Act
+        var result = _detector.DetectFunction(context, 3, ProgrammingLanguage.JavaScript);
+
+        // Assert
+        result.Should().NotBeNull();
+        result!.Value.FullyQualifiedName.Should().Contain("processData");
+    }
+
+    [Fact]
+    public void DetectFunction_RustFunction_DetectsCorrectly()
+    {
+        // Arrange
+        var context = ImmutableArray.Create(
+            "impl MyService {",
+            "    pub fn process_data(&self, input: &str) -> String {",
+            "        let result = input.trim();",
+            "        result.to_string()",
+            "    }",
+            "}"
+        );
+
+        // Act
+        var result = _detector.DetectFunction(context, 3, ProgrammingLanguage.Rust);
+
+        // Assert
+        result.Should().NotBeNull();
+        result!.Value.FullyQualifiedName.Should().Contain("process_data");
+    }
+
+    [Fact]
+    public void DetectFunction_EmptyContext_ReturnsNull()
+    {
+        // Act
+        var result = _detector.DetectFunction([], 1, ProgrammingLanguage.CSharp);
+
+        // Assert
+        result.Should().BeNull();
+    }
+
+    [Fact]
+    public void DetectAllFunctions_MultipleFunctions_DetectsAll()
+    {
+        // Arrange
+        var context = ImmutableArray.Create(
+            "namespace MyApp",
+            "{",
+            "    public class MyService",
+            "    {",
+            "        public void Method1()",
+            "        {",
+            "        }",
+            "",
+            "        public void Method2()",
+            "        {",
+            "        }",
+            "    }",
+            "}"
+        );
+
+        // Act
+        var result = _detector.DetectAllFunctions(context, ProgrammingLanguage.CSharp);
+
+        // Assert
+        result.Should().HaveCount(2);
+        result.Should().Contain(f => f.FullyQualifiedName.Contains("Method1"));
+        result.Should().Contain(f => f.FullyQualifiedName.Contains("Method2"));
+    }
+
+    [Fact]
+    public void DetectFunction_JavaMethod_DetectsWithFullyQualifiedName()
+    {
+        // Arrange
+        var context = ImmutableArray.Create(
+            "package org.example.service;",
+            "",
+            "public class UserService {",
+            "    public void createUser(String name) {",
+            "        // vulnerable code",
+            "    }",
+            "}"
+        );
+
+        // Act
+        var result = _detector.DetectFunction(context, 5, ProgrammingLanguage.Java);
+
+        // Assert
+        result.Should().NotBeNull();
+        result!.Value.FullyQualifiedName.Should().Contain("createUser");
+    }
+}

src/__Libraries/__Tests/StellaOps.Reachability.Core.Tests/CveMapping/OsvEnricherTests.cs

@@ -0,0 +1,306 @@
+// <copyright file="OsvEnricherTests.cs" company="StellaOps">
+// Copyright (c) StellaOps. Licensed under the AGPL-3.0-or-later.
+// </copyright>
+
+using System.Net;
+using System.Text.Json;
+using FluentAssertions;
+using StellaOps.Reachability.Core.CveMapping;
+using Xunit;
+
+namespace StellaOps.Reachability.Core.Tests.CveMapping;
+
+/// <summary>
+/// Tests for <see cref="OsvEnricher"/>.
+/// </summary>
+[Trait("Category", "Unit")]
+public class OsvEnricherTests
+{
+    [Fact]
+    public async Task EnrichAsync_WhenVulnerabilityFound_ReturnsEnrichedResult()
+    {
+        // Arrange
+        var responseJson = CreateOsvVulnerabilityJson("GHSA-abc-123", "CVE-2024-1234");
+        var handler = new MockHttpMessageHandler(responseJson, HttpStatusCode.OK);
+        var httpClient = new HttpClient(handler) { BaseAddress = new Uri("https://api.osv.dev/") };
+        var enricher = new OsvEnricher(httpClient);
+
+        // Act
+        var result = await enricher.EnrichAsync("CVE-2024-1234", CancellationToken.None);
+
+        // Assert
+        result.Found.Should().BeTrue();
+        result.CveId.Should().Be("CVE-2024-1234");
+        result.OsvId.Should().Be("GHSA-abc-123");
+    }
+
+    [Fact]
+    public async Task EnrichAsync_WhenVulnerabilityNotFound_ReturnsNotFoundResult()
+    {
+        // Arrange
+        var handler = new MockHttpMessageHandler(string.Empty, HttpStatusCode.NotFound);
+        var httpClient = new HttpClient(handler) { BaseAddress = new Uri("https://api.osv.dev/") };
+        var enricher = new OsvEnricher(httpClient);
+
+        // Act
+        var result = await enricher.EnrichAsync("CVE-DOES-NOT-EXIST", CancellationToken.None);
+
+        // Assert
+        result.Found.Should().BeFalse();
+        result.CveId.Should().Be("CVE-DOES-NOT-EXIST");
+    }
+
+    [Fact]
+    public async Task GetVulnerabilityAsync_ReturnsVulnerabilityData()
+    {
+        // Arrange
+        var responseJson = CreateOsvVulnerabilityJson("GHSA-test-001", "CVE-2024-5678");
+        var handler = new MockHttpMessageHandler(responseJson, HttpStatusCode.OK);
+        var httpClient = new HttpClient(handler) { BaseAddress = new Uri("https://api.osv.dev/") };
+        var enricher = new OsvEnricher(httpClient);
+
+        // Act
+        var result = await enricher.GetVulnerabilityAsync("GHSA-test-001", CancellationToken.None);
+
+        // Assert
+        result.Should().NotBeNull();
+        result!.Id.Should().Be("GHSA-test-001");
+        result.Aliases.Should().Contain("CVE-2024-5678");
+    }
+
+    [Fact]
+    public async Task GetVulnerabilityAsync_WithAffectedPackages_ExtractsPackageInfo()
+    {
+        // Arrange
+        var responseJson = CreateOsvVulnerabilityWithPackages();
+        var handler = new MockHttpMessageHandler(responseJson, HttpStatusCode.OK);
+        var httpClient = new HttpClient(handler) { BaseAddress = new Uri("https://api.osv.dev/") };
+        var enricher = new OsvEnricher(httpClient);
+
+        // Act
+        var result = await enricher.GetVulnerabilityAsync("GHSA-pkg-test", CancellationToken.None);
+
+        // Assert
+        result.Should().NotBeNull();
+        result!.Affected.Should().HaveCount(1);
+        result.Affected[0].Package.Should().NotBeNull();
+        result.Affected[0].Package!.Ecosystem.Should().Be("npm");
+        result.Affected[0].Package!.Name.Should().Be("lodash");
+    }
+
+    [Fact]
+    public async Task QueryByPackageAsync_ReturnsMatchingVulnerabilities()
+    {
+        // Arrange
+        var responseJson = CreateOsvQueryResponse();
+        var handler = new MockHttpMessageHandler(responseJson, HttpStatusCode.OK);
+        var httpClient = new HttpClient(handler) { BaseAddress = new Uri("https://api.osv.dev/") };
+        var enricher = new OsvEnricher(httpClient);
+
+        // Act
+        var results = await enricher.QueryByPackageAsync("npm", "lodash", "4.17.0", CancellationToken.None);
+
+        // Assert
+        results.Should().HaveCount(1);
+        results[0].Id.Should().Be("GHSA-query-001");
+    }
+
+    [Fact]
+    public async Task QueryByPackageAsync_WithNoResults_ReturnsEmptyList()
+    {
+        // Arrange
+        var handler = new MockHttpMessageHandler("{}", HttpStatusCode.OK);
+        var httpClient = new HttpClient(handler) { BaseAddress = new Uri("https://api.osv.dev/") };
+        var enricher = new OsvEnricher(httpClient);
+
+        // Act
+        var results = await enricher.QueryByPackageAsync("npm", "safe-package", null, CancellationToken.None);
+
+        // Assert
+        results.Should().BeEmpty();
+    }
+
+    [Fact]
+    public async Task EnrichAsync_WithVersionRanges_ExtractsAffectedVersions()
+    {
+        // Arrange
+        var responseJson = CreateOsvVulnerabilityWithVersionRanges();
+        var handler = new MockHttpMessageHandler(responseJson, HttpStatusCode.OK);
+        var httpClient = new HttpClient(handler) { BaseAddress = new Uri("https://api.osv.dev/") };
+        var enricher = new OsvEnricher(httpClient);
+
+        // Act
+        var result = await enricher.EnrichAsync("CVE-2024-9999", CancellationToken.None);
+
+        // Assert
+        result.Found.Should().BeTrue();
+        result.AffectedVersions.Should().NotBeEmpty();
+        var range = result.AffectedVersions[0];
+        range.IntroducedVersion.Should().Be("1.0.0");
+        range.FixedVersion.Should().Be("1.5.0");
+    }
+
+    [Fact]
+    public async Task EnrichAsync_WithFunctions_ExtractsVulnerableSymbols()
+    {
+        // Arrange
+        var responseJson = CreateOsvVulnerabilityWithFunctions();
+        var handler = new MockHttpMessageHandler(responseJson, HttpStatusCode.OK);
+        var httpClient = new HttpClient(handler) { BaseAddress = new Uri("https://api.osv.dev/") };
+        var enricher = new OsvEnricher(httpClient);
+
+        // Act
+        var result = await enricher.EnrichAsync("CVE-2024-FUNC", CancellationToken.None);
+
+        // Assert
+        result.Found.Should().BeTrue();
+        result.Symbols.Should().NotBeEmpty();
+    }
+
+    [Fact]
+    public async Task GetVulnerabilityAsync_WhenHttpError_ReturnsNull()
+    {
+        // Arrange
+        var handler = new MockHttpMessageHandler(string.Empty, HttpStatusCode.InternalServerError);
+        var httpClient = new HttpClient(handler) { BaseAddress = new Uri("https://api.osv.dev/") };
+        var enricher = new OsvEnricher(httpClient);
+
+        // Act
+        var result = await enricher.GetVulnerabilityAsync("CVE-ERROR", CancellationToken.None);
+
+        // Assert
+        result.Should().BeNull();
+    }
+
+    [Fact]
+    public async Task GetVulnerabilityAsync_WhenInvalidJson_ReturnsNull()
+    {
+        // Arrange
+        var handler = new MockHttpMessageHandler("not valid json", HttpStatusCode.OK);
+        var httpClient = new HttpClient(handler) { BaseAddress = new Uri("https://api.osv.dev/") };
+        var enricher = new OsvEnricher(httpClient);
+
+        // Act
+        var result = await enricher.GetVulnerabilityAsync("CVE-INVALID", CancellationToken.None);
+
+        // Assert
+        result.Should().BeNull();
+    }
+
+    private static string CreateOsvVulnerabilityJson(string osvId, string cveId)
+    {
+        return $$"""
+            {
+                "id": "{{osvId}}",
+                "summary": "Test vulnerability",
+                "aliases": ["{{cveId}}"],
+                "affected": []
+            }
+            """;
+    }
+
+    private static string CreateOsvVulnerabilityWithPackages()
+    {
+        return """
+            {
+                "id": "GHSA-pkg-test",
+                "summary": "Package vulnerability",
+                "affected": [
+                    {
+                        "package": {
+                            "ecosystem": "npm",
+                            "name": "lodash"
+                        },
+                        "ranges": []
+                    }
+                ]
+            }
+            """;
+    }
+
+    private static string CreateOsvVulnerabilityWithVersionRanges()
+    {
+        return """
+            {
+                "id": "GHSA-version-test",
+                "aliases": ["CVE-2024-9999"],
+                "affected": [
+                    {
+                        "package": {
+                            "ecosystem": "npm",
+                            "name": "vulnerable-pkg"
+                        },
+                        "ranges": [
+                            {
+                                "type": "SEMVER",
+                                "events": [
+                                    {"introduced": "1.0.0"},
+                                    {"fixed": "1.5.0"}
+                                ]
+                            }
+                        ]
+                    }
+                ]
+            }
+            """;
+    }
+
+    private static string CreateOsvVulnerabilityWithFunctions()
+    {
+        return """
+            {
+                "id": "GHSA-func-test",
+                "aliases": ["CVE-2024-FUNC"],
+                "affected": [
+                    {
+                        "package": {
+                            "ecosystem": "PyPI",
+                            "name": "vulnerable-lib"
+                        },
+                        "ecosystem_specific": {
+                            "functions": ["vulnerable_function", "another_function"]
+                        }
+                    }
+                ]
+            }
+            """;
+    }
+
+    private static string CreateOsvQueryResponse()
+    {
+        return """
+            {
+                "vulns": [
+                    {
+                        "id": "GHSA-query-001",
+                        "summary": "Query result vulnerability",
+                        "affected": []
+                    }
+                ]
+            }
+            """;
+    }
+
+    private sealed class MockHttpMessageHandler : HttpMessageHandler
+    {
+        private readonly string _response;
+        private readonly HttpStatusCode _statusCode;
+
+        public MockHttpMessageHandler(string response, HttpStatusCode statusCode)
+        {
+            _response = response;
+            _statusCode = statusCode;
+        }
+
+        protected override Task<HttpResponseMessage> SendAsync(
+            HttpRequestMessage request,
+            CancellationToken cancellationToken)
+        {
+            var response = new HttpResponseMessage(_statusCode)
+            {
+                Content = new StringContent(_response, System.Text.Encoding.UTF8, "application/json")
+            };
+            return Task.FromResult(response);
+        }
+    }
+}

src/__Libraries/__Tests/StellaOps.Reachability.Core.Tests/CveMapping/UnifiedDiffParserTests.cs

@@ -0,0 +1,181 @@
+// <copyright file="UnifiedDiffParserTests.cs" company="StellaOps">
+// Copyright (c) StellaOps. Licensed under the AGPL-3.0-or-later.
+// </copyright>
+
+using FluentAssertions;
+using StellaOps.Reachability.Core.CveMapping;
+using Xunit;
+
+namespace StellaOps.Reachability.Core.Tests.CveMapping;
+
+/// <summary>
+/// Tests for <see cref="UnifiedDiffParser"/>.
+/// </summary>
+[Trait("Category", "Unit")]
+public class UnifiedDiffParserTests
+{
+    private readonly UnifiedDiffParser _parser = new();
+
+    [Fact]
+    public void Parse_SimpleDiff_ExtractsFileAndHunks()
+    {
+        // Arrange
+        var diff = """
+            diff --git a/src/utils.py b/src/utils.py
+            --- a/src/utils.py
+            +++ b/src/utils.py
+            @@ -10,7 +10,7 @@ def process_data(input):
+                 data = input.strip()
+            -    result = eval(data)
+            +    result = safe_eval(data)
+                 return result
+            """;
+
+        // Act
+        var result = _parser.Parse(diff);
+
+        // Assert
+        result.Files.Should().HaveCount(1);
+        var file = result.Files[0];
+        file.OldPath.Should().Be("src/utils.py");
+        file.NewPath.Should().Be("src/utils.py");
+        file.Hunks.Should().HaveCount(1);
+    }
+
+    [Fact]
+    public void Parse_HunkWithAddedAndRemovedLines_ExtractsCorrectly()
+    {
+        // Arrange
+        var diff = """
+            diff --git a/src/file.cs b/src/file.cs
+            --- a/src/file.cs
+            +++ b/src/file.cs
+            @@ -5,6 +5,8 @@ namespace Test
+             {
+                 public void Method()
+                 {
+            -        var x = 1;
+            +        var x = 2;
+            +        var y = 3;
+                 }
+             }
+            """;
+
+        // Act
+        var result = _parser.Parse(diff);
+
+        // Assert
+        result.Files.Should().HaveCount(1);
+        var hunk = result.Files[0].Hunks[0];
+        hunk.OldStart.Should().Be(5);
+        hunk.NewStart.Should().Be(5);
+        hunk.RemovedLines.Should().HaveCount(1);
+        hunk.AddedLines.Should().HaveCount(2);
+    }
+
+    [Fact]
+    public void Parse_NewFile_DetectsCorrectly()
+    {
+        // Arrange
+        var diff = """
+            diff --git a/src/newfile.cs b/src/newfile.cs
+            --- /dev/null
+            +++ b/src/newfile.cs
+            @@ -0,0 +1,5 @@
+            +namespace Test
+            +{
+            +    public class NewClass { }
+            +}
+            """;
+
+        // Act
+        var result = _parser.Parse(diff);
+
+        // Assert
+        result.Files.Should().HaveCount(1);
+        var file = result.Files[0];
+        file.IsNewFile.Should().BeTrue();
+        file.NewPath.Should().Be("src/newfile.cs");
+    }
+
+    [Fact]
+    public void Parse_DeletedFile_DetectsCorrectly()
+    {
+        // Arrange
+        var diff = """
+            diff --git a/src/oldfile.cs b/src/oldfile.cs
+            --- a/src/oldfile.cs
+            +++ /dev/null
+            @@ -1,4 +0,0 @@
+            -namespace Test
+            -{
+            -    public class OldClass { }
+            -}
+            """;
+
+        // Act
+        var result = _parser.Parse(diff);
+
+        // Assert
+        result.Files.Should().HaveCount(1);
+        var file = result.Files[0];
+        file.IsDeleted.Should().BeTrue();
+    }
+
+    [Fact]
+    public void Parse_MultipleFiles_ParsesAll()
+    {
+        // Arrange
+        var diff = """
+            diff --git a/file1.cs b/file1.cs
+            --- a/file1.cs
+            +++ b/file1.cs
+            @@ -1,3 +1,3 @@
+            -old
+            +new
+            diff --git a/file2.cs b/file2.cs
+            --- a/file2.cs
+            +++ b/file2.cs
+            @@ -1,3 +1,3 @@
+            -old2
+            +new2
+            """;
+
+        // Act
+        var result = _parser.Parse(diff);
+
+        // Assert
+        result.Files.Should().HaveCount(2);
+    }
+
+    [Fact]
+    public void Parse_WithFunctionContext_ExtractsFunctionName()
+    {
+        // Arrange
+        var diff = """
+            diff --git a/src/app.cs b/src/app.cs
+            --- a/src/app.cs
+            +++ b/src/app.cs
+            @@ -10,7 +10,7 @@ public void ProcessData(string input)
+                 var data = input;
+            -    return eval(data);
+            +    return safe_process(data);
+            """;
+
+        // Act
+        var result = _parser.Parse(diff);
+
+        // Assert
+        result.Files[0].Hunks[0].FunctionContext.Should().Be("public void ProcessData(string input)");
+    }
+
+    [Fact]
+    public void Parse_EmptyDiff_ReturnsEmptyResult()
+    {
+        // Arrange
+        var diff = "";
+
+        // Act & Assert
+        Assert.Throws<ArgumentException>(() => _parser.Parse(diff));
+    }
+}

src/__Libraries/__Tests/StellaOps.Reachability.Core.Tests/Symbols/NativeSymbolNormalizerTests.cs

@@ -0,0 +1,189 @@
+// <copyright file="NativeSymbolNormalizerTests.cs" company="StellaOps">
+// Copyright (c) StellaOps. Licensed under the AGPL-3.0-or-later.
+// </copyright>
+
+using FluentAssertions;
+using StellaOps.Reachability.Core.Symbols;
+using Xunit;
+
+namespace StellaOps.Reachability.Core.Tests.Symbols;
+
+/// <summary>
+/// Tests for <see cref="NativeSymbolNormalizer"/>.
+/// </summary>
+[Trait("Category", "Unit")]
+public class NativeSymbolNormalizerTests
+{
+    private readonly NativeSymbolNormalizer _normalizer = new();
+
+    [Fact]
+    public void SupportedSources_ContainsExpectedSources()
+    {
+        _normalizer.SupportedSources.Should().Contain(SymbolSource.ElfSymtab);
+        _normalizer.SupportedSources.Should().Contain(SymbolSource.PeExport);
+        _normalizer.SupportedSources.Should().Contain(SymbolSource.Dwarf);
+        _normalizer.SupportedSources.Should().Contain(SymbolSource.Pdb);
+        _normalizer.SupportedSources.Should().Contain(SymbolSource.EbpfUprobe);
+    }
+
+    [Theory]
+    [InlineData(SymbolSource.ElfSymtab, true)]
+    [InlineData(SymbolSource.PeExport, true)]
+    [InlineData(SymbolSource.Dwarf, true)]
+    [InlineData(SymbolSource.Roslyn, false)]
+    [InlineData(SymbolSource.JavaAsm, false)]
+    public void CanNormalize_ReturnsCorrectValue(SymbolSource source, bool expected)
+    {
+        _normalizer.CanNormalize(source).Should().Be(expected);
+    }
+
+    // Plain C symbols
+    [Theory]
+    [InlineData("ssl_do_handshake", "openssl.ssl", "_", "do_handshake")]
+    [InlineData("SSL_connect", "openssl.ssl", "_", "connect")]
+    [InlineData("EVP_EncryptInit_ex", "openssl.evp", "_", "EncryptInit_ex")]
+    [InlineData("sqlite3_prepare_v2", "sqlite3", "_", "prepare_v2")]
+    [InlineData("curl_easy_perform", "curl", "_", "easy_perform")]
+    [InlineData("png_create_read_struct", "libpng", "_", "create_read_struct")]
+    [InlineData("inflate", "zlib", "_", "")]  // Special case - whole function is prefix
+    [InlineData("pthread_create", "pthread", "_", "create")]
+    [InlineData("my_custom_function", "native", "_", "my_custom_function")]
+    public void Normalize_PlainCSymbol_ExtractsNamespace(
+        string symbol, string expectedNs, string expectedType, string expectedMethod)
+    {
+        var raw = new RawSymbol(symbol, SymbolSource.ElfSymtab);
+
+        var result = _normalizer.Normalize(raw);
+
+        result.Should().NotBeNull();
+        result!.Namespace.Should().Be(expectedNs.ToLowerInvariant());
+        result.Type.Should().Be(expectedType);
+        // For "inflate", the whole thing is the method
+        if (expectedMethod == "")
+            result.Method.Should().Be(symbol.ToLowerInvariant());
+        else
+            result.Method.Should().Be(expectedMethod.ToLowerInvariant());
+    }
+
+    // Itanium mangled names - basic demangling extracts namespace components
+    [Theory]
+    [InlineData("_ZN4llvm6Triple15setEnvironmentENS0_15EnvironmentTypeE", "llvm", "setenvironment")]
+    public void Normalize_ItaniumMangled_ParsesNamespace(
+        string symbol, string expectedNsContains, string expectedMethodContains)
+    {
+        var raw = new RawSymbol(symbol, SymbolSource.ElfSymtab);
+
+        var result = _normalizer.Normalize(raw);
+
+        result.Should().NotBeNull();
+        // Basic demangling may put all parts together - check method contains key part
+        result!.Method.ToLowerInvariant().Should().Contain(expectedMethodContains.ToLowerInvariant());
+    }
+
+    // MSVC mangled names
+    [Theory]
+    [InlineData("?lookup@JndiLookup@log4j@apache@org@@QEAA?AVString@@PEAV1@@Z", "jndilookup", "lookup")]
+    [InlineData("?ProcessData@MyClass@MyNamespace@@QEAAXH@Z", "myclass", "processdata")]
+    public void Normalize_MsvcMangled_ParsesComponents(
+        string symbol, string expectedTypeContains, string expectedMethodContains)
+    {
+        var raw = new RawSymbol(symbol, SymbolSource.PeExport);
+
+        var result = _normalizer.Normalize(raw);
+
+        result.Should().NotBeNull();
+        result!.Type.ToLowerInvariant().Should().Contain(expectedTypeContains.ToLowerInvariant());
+        result.Method.ToLowerInvariant().Should().Contain(expectedMethodContains.ToLowerInvariant());
+    }
+
+    // DWARF format - qualified C++ symbols
+    [Theory]
+    [InlineData("llvm::Module::getFunction(llvm::StringRef)", "llvm", "module", "getfunction")]
+    [InlineData("std::string::size()", "std", "string", "size")]
+    public void Normalize_DwarfFormat_ParsesComponents(
+        string symbol, string expectedNs, string expectedType, string expectedMethod)
+    {
+        var raw = new RawSymbol(symbol, SymbolSource.Dwarf);
+
+        var result = _normalizer.Normalize(raw);
+
+        result.Should().NotBeNull();
+        result!.Namespace.ToLowerInvariant().Should().Contain(expectedNs.ToLowerInvariant());
+        result.Type.ToLowerInvariant().Should().Be(expectedType.ToLowerInvariant());
+        result.Method.ToLowerInvariant().Should().Be(expectedMethod.ToLowerInvariant());
+    }
+
+    // Empty/invalid input
+    [Theory]
+    [InlineData("")]
+    [InlineData("   ")]
+    [InlineData(null)]
+    public void Normalize_EmptyInput_ReturnsNull(string? symbol)
+    {
+        var raw = new RawSymbol(symbol ?? "", SymbolSource.ElfSymtab);
+
+        var result = _normalizer.Normalize(raw);
+
+        result.Should().BeNull();
+    }
+
+    [Fact]
+    public void TryNormalize_InvalidSymbol_ReturnsError()
+    {
+        var raw = new RawSymbol("", SymbolSource.ElfSymtab);
+
+        var success = _normalizer.TryNormalize(raw, out var canonical, out var error);
+
+        success.Should().BeFalse();
+        canonical.Should().BeNull();
+        error.Should().NotBeNullOrEmpty();
+    }
+
+    [Fact]
+    public void Normalize_PreservesOriginalSymbol()
+    {
+        var symbol = "ssl_do_handshake";
+        var raw = new RawSymbol(symbol, SymbolSource.ElfSymtab);
+
+        var result = _normalizer.Normalize(raw);
+
+        result.Should().NotBeNull();
+        result!.OriginalSymbol.Should().Be(symbol);
+        result.Source.Should().Be(SymbolSource.ElfSymtab);
+    }
+
+    [Fact]
+    public void Normalize_PreservesPurl()
+    {
+        var raw = new RawSymbol("ssl_connect", SymbolSource.ElfSymtab, "pkg:conan/openssl@1.1.1");
+
+        var result = _normalizer.Normalize(raw);
+
+        result.Should().NotBeNull();
+        result!.Purl.Should().Be("pkg:conan/openssl@1.1.1");
+    }
+
+    [Fact]
+    public void Normalize_GeneratesCanonicalId()
+    {
+        var raw = new RawSymbol("ssl_connect", SymbolSource.ElfSymtab);
+
+        var result = _normalizer.Normalize(raw);
+
+        result.Should().NotBeNull();
+        result!.CanonicalId.Should().NotBeNullOrEmpty();
+        result.CanonicalId.Should().HaveLength(64); // SHA-256 hex
+    }
+
+    [Fact]
+    public void Normalize_SameSymbol_SameCanonicalId()
+    {
+        var raw1 = new RawSymbol("ssl_connect", SymbolSource.ElfSymtab);
+        var raw2 = new RawSymbol("ssl_connect", SymbolSource.ElfSymtab);
+
+        var result1 = _normalizer.Normalize(raw1);
+        var result2 = _normalizer.Normalize(raw2);
+
+        result1!.CanonicalId.Should().Be(result2!.CanonicalId);
+    }
+}

src/__Libraries/__Tests/StellaOps.Reachability.Core.Tests/Symbols/ScriptSymbolNormalizerTests.cs

@@ -0,0 +1,256 @@
+// <copyright file="ScriptSymbolNormalizerTests.cs" company="StellaOps">
+// Copyright (c) StellaOps. Licensed under the AGPL-3.0-or-later.
+// </copyright>
+
+using FluentAssertions;
+using StellaOps.Reachability.Core.Symbols;
+using Xunit;
+
+namespace StellaOps.Reachability.Core.Tests.Symbols;
+
+/// <summary>
+/// Tests for <see cref="ScriptSymbolNormalizer"/>.
+/// </summary>
+[Trait("Category", "Unit")]
+public class ScriptSymbolNormalizerTests
+{
+    private readonly ScriptSymbolNormalizer _normalizer = new();
+
+    [Fact]
+    public void SupportedSources_ContainsExpectedSources()
+    {
+        _normalizer.SupportedSources.Should().Contain(SymbolSource.V8Profiler);
+        _normalizer.SupportedSources.Should().Contain(SymbolSource.PythonTrace);
+        _normalizer.SupportedSources.Should().Contain(SymbolSource.PhpXdebug);
+    }
+
+    [Theory]
+    [InlineData(SymbolSource.V8Profiler, true)]
+    [InlineData(SymbolSource.PythonTrace, true)]
+    [InlineData(SymbolSource.PhpXdebug, true)]
+    [InlineData(SymbolSource.Roslyn, false)]
+    [InlineData(SymbolSource.ElfSymtab, false)]
+    public void CanNormalize_ReturnsCorrectValue(SymbolSource source, bool expected)
+    {
+        _normalizer.CanNormalize(source).Should().Be(expected);
+    }
+
+    // V8 Profiler (JavaScript)
+    [Theory]
+    [InlineData("processRequest (server.js:123:45)", "_", "processrequest")]
+    [InlineData("lodash.template (lodash.js:1234:56)", "lodash", "template")]
+    [InlineData("Module._load (internal/modules/cjs/loader.js:789:10)", "module", "_load")]
+    [InlineData("Foo.bar (foo.js:1:1)", "foo", "bar")]
+    [InlineData("anonymous (app.js:12:3)", "_", "{anonymous}")]
+    public void Normalize_V8StackFrame_ParsesComponents(
+        string symbol, string expectedTypeOrNs, string expectedMethod)
+    {
+        var raw = new RawSymbol(symbol, SymbolSource.V8Profiler);
+
+        var result = _normalizer.Normalize(raw);
+
+        result.Should().NotBeNull();
+        // Either namespace or type should contain the expected value
+        var combined = $"{result!.Namespace}.{result.Type}".ToLowerInvariant();
+        combined.Should().Contain(expectedTypeOrNs.ToLowerInvariant());
+        result.Method.ToLowerInvariant().Should().Be(expectedMethod.ToLowerInvariant());
+    }
+
+    [Fact]
+    public void Normalize_V8NodeModules_ExtractsPackage()
+    {
+        var raw = new RawSymbol("parse (node_modules/lodash/lodash.js:1:1)", SymbolSource.V8Profiler);
+
+        var result = _normalizer.Normalize(raw);
+
+        result.Should().NotBeNull();
+        result!.Namespace.Should().Contain("lodash");
+    }
+
+    [Fact]
+    public void Normalize_V8ScopedPackage_ExtractsPackage()
+    {
+        var raw = new RawSymbol("render (node_modules/@angular/core/index.js:1:1)", SymbolSource.V8Profiler);
+
+        var result = _normalizer.Normalize(raw);
+
+        result.Should().NotBeNull();
+        result!.Namespace.Should().Contain("@angular/core");
+    }
+
+    [Fact]
+    public void Normalize_V8SimpleFunction_ParsesMethod()
+    {
+        var raw = new RawSymbol("myFunction", SymbolSource.V8Profiler);
+
+        var result = _normalizer.Normalize(raw);
+
+        result.Should().NotBeNull();
+        result!.Method.Should().Be("myfunction");
+    }
+
+    // Python Trace
+    [Theory]
+    [InlineData("django.template.base:Template.render", "django.template.base", "template", "render")]
+    [InlineData("package.module:function", "package.module", "_", "function")]
+    [InlineData("<module>:main", "_", "_", "main")]
+    [InlineData("os.path:join", "os.path", "_", "join")]
+    public void Normalize_PythonColon_ParsesComponents(
+        string symbol, string expectedNs, string expectedType, string expectedMethod)
+    {
+        var raw = new RawSymbol(symbol, SymbolSource.PythonTrace);
+
+        var result = _normalizer.Normalize(raw);
+
+        result.Should().NotBeNull();
+        result!.Namespace.Should().Be(expectedNs.ToLowerInvariant());
+        result.Type.Should().Be(expectedType.ToLowerInvariant());
+        result.Method.Should().Be(expectedMethod.ToLowerInvariant());
+    }
+
+    [Theory]
+    [InlineData("django.template.Template.render", "django.template", "template", "render")]
+    [InlineData("os.path.join", "os.path", "_", "join")]
+    [InlineData("json.dumps", "json", "_", "dumps")]
+    public void Normalize_PythonDot_ParsesComponents(
+        string symbol, string expectedNs, string expectedType, string expectedMethod)
+    {
+        var raw = new RawSymbol(symbol, SymbolSource.PythonTrace);
+
+        var result = _normalizer.Normalize(raw);
+
+        result.Should().NotBeNull();
+        result!.Namespace.Should().Be(expectedNs.ToLowerInvariant());
+        result.Type.Should().Be(expectedType.ToLowerInvariant());
+        result.Method.Should().Be(expectedMethod.ToLowerInvariant());
+    }
+
+    [Fact]
+    public void Normalize_PythonSimpleFunction_ParsesMethod()
+    {
+        var raw = new RawSymbol("process_data", SymbolSource.PythonTrace);
+
+        var result = _normalizer.Normalize(raw);
+
+        result.Should().NotBeNull();
+        result!.Namespace.Should().Be("_");
+        result.Type.Should().Be("_");
+        result.Method.Should().Be("process_data");
+    }
+
+    // PHP Xdebug
+    [Theory]
+    [InlineData(@"App\Controllers\UserController->show", "app.controllers", "usercontroller", "show")]
+    [InlineData(@"Illuminate\Support\Str::random", "illuminate.support", "str", "random")]
+    [InlineData(@"MyClass->process", "_", "myclass", "process")]
+    public void Normalize_PhpMethod_ParsesComponents(
+        string symbol, string expectedNs, string expectedType, string expectedMethod)
+    {
+        var raw = new RawSymbol(symbol, SymbolSource.PhpXdebug);
+
+        var result = _normalizer.Normalize(raw);
+
+        result.Should().NotBeNull();
+        result!.Namespace.Should().Be(expectedNs.ToLowerInvariant());
+        result.Type.Should().Be(expectedType.ToLowerInvariant());
+        result.Method.Should().Be(expectedMethod.ToLowerInvariant());
+    }
+
+    [Fact]
+    public void Normalize_PhpClosure_ParsesFile()
+    {
+        var raw = new RawSymbol("{closure:/var/www/app/routes.php:123-456}", SymbolSource.PhpXdebug);
+
+        var result = _normalizer.Normalize(raw);
+
+        result.Should().NotBeNull();
+        result!.Namespace.Should().Be("routes");
+        result.Method.Should().Be("{closure}");
+    }
+
+    [Fact]
+    public void Normalize_PhpPlainFunction_ParsesMethod()
+    {
+        var raw = new RawSymbol("array_map", SymbolSource.PhpXdebug);
+
+        var result = _normalizer.Normalize(raw);
+
+        result.Should().NotBeNull();
+        result!.Namespace.Should().Be("_");
+        result.Type.Should().Be("_");
+        result.Method.Should().Be("array_map");
+    }
+
+    // Empty/invalid input
+    [Theory]
+    [InlineData("")]
+    [InlineData("   ")]
+    public void Normalize_EmptyInput_ReturnsNull(string symbol)
+    {
+        var raw = new RawSymbol(symbol, SymbolSource.V8Profiler);
+
+        var result = _normalizer.Normalize(raw);
+
+        result.Should().BeNull();
+    }
+
+    [Fact]
+    public void TryNormalize_InvalidSymbol_ReturnsError()
+    {
+        var raw = new RawSymbol("", SymbolSource.V8Profiler);
+
+        var success = _normalizer.TryNormalize(raw, out var canonical, out var error);
+
+        success.Should().BeFalse();
+        canonical.Should().BeNull();
+        error.Should().NotBeNullOrEmpty();
+    }
+
+    [Fact]
+    public void Normalize_PreservesOriginalSymbol()
+    {
+        var symbol = "lodash.template (lodash.js:1:1)";
+        var raw = new RawSymbol(symbol, SymbolSource.V8Profiler);
+
+        var result = _normalizer.Normalize(raw);
+
+        result.Should().NotBeNull();
+        result!.OriginalSymbol.Should().Be(symbol);
+        result.Source.Should().Be(SymbolSource.V8Profiler);
+    }
+
+    [Fact]
+    public void Normalize_PreservesPurl()
+    {
+        var raw = new RawSymbol("lodash.template", SymbolSource.V8Profiler, "pkg:npm/lodash@4.17.21");
+
+        var result = _normalizer.Normalize(raw);
+
+        result.Should().NotBeNull();
+        result!.Purl.Should().Be("pkg:npm/lodash@4.17.21");
+    }
+
+    [Fact]
+    public void Normalize_GeneratesCanonicalId()
+    {
+        var raw = new RawSymbol("lodash.template", SymbolSource.V8Profiler);
+
+        var result = _normalizer.Normalize(raw);
+
+        result.Should().NotBeNull();
+        result!.CanonicalId.Should().NotBeNullOrEmpty();
+        result.CanonicalId.Should().HaveLength(64); // SHA-256 hex
+    }
+
+    [Fact]
+    public void Normalize_DifferentSources_SameSymbol_SameCanonicalId()
+    {
+        // Same logical symbol from different script sources should produce same canonical ID
+        var pythonRaw = new RawSymbol("json.dumps", SymbolSource.PythonTrace);
+
+        var result = _normalizer.Normalize(pythonRaw);
+
+        result.Should().NotBeNull();
+        result!.CanonicalId.Should().NotBeNullOrEmpty();
+    }
+}