finish secrets finding work and audit remarks work save

src/Scanner/StellaOps.Scanner.Worker/Determinism/FidelityMetricsService.cs

@@ -10,12 +10,14 @@ public sealed class FidelityMetricsService
     private readonly BitwiseFidelityCalculator _bitwiseCalculator;
     private readonly SemanticFidelityCalculator _semanticCalculator;
     private readonly PolicyFidelityCalculator _policyCalculator;
+    private readonly TimeProvider _timeProvider;
 
-    public FidelityMetricsService()
+    public FidelityMetricsService(TimeProvider? timeProvider = null)
     {
         _bitwiseCalculator = new BitwiseFidelityCalculator();
         _semanticCalculator = new SemanticFidelityCalculator();
         _policyCalculator = new PolicyFidelityCalculator();
+        _timeProvider = timeProvider ?? TimeProvider.System;
     }
 
     /// <summary>
@@ -67,7 +69,7 @@ public sealed class FidelityMetricsService
             IdenticalOutputs = bfIdentical,
             SemanticMatches = sfMatches,
             PolicyMatches = pfMatches,
-            ComputedAt = DateTimeOffset.UtcNow,
+            ComputedAt = _timeProvider.GetUtcNow(),
             Mismatches = allMismatches.Count > 0 ? allMismatches : null
         };
     }
@@ -108,7 +110,7 @@ public sealed class FidelityMetricsService
             Passed = failures.Count == 0,
             ShouldBlockRelease = shouldBlock,
             FailureReasons = failures,
-            EvaluatedAt = DateTimeOffset.UtcNow
+            EvaluatedAt = _timeProvider.GetUtcNow()
         };
     }
 

src/Scanner/StellaOps.Scanner.Worker/Orchestration/PoEOrchestrator.cs

@@ -18,17 +18,20 @@ public class PoEOrchestrator
     private readonly IProofEmitter _emitter;
     private readonly IPoECasStore _casStore;
     private readonly ILogger<PoEOrchestrator> _logger;
+    private readonly TimeProvider _timeProvider;
 
     public PoEOrchestrator(
         IReachabilityResolver resolver,
         IProofEmitter emitter,
         IPoECasStore casStore,
-        ILogger<PoEOrchestrator> logger)
+        ILogger<PoEOrchestrator> logger,
+        TimeProvider? timeProvider = null)
     {
         _resolver = resolver ?? throw new ArgumentNullException(nameof(resolver));
         _emitter = emitter ?? throw new ArgumentNullException(nameof(emitter));
         _casStore = casStore ?? throw new ArgumentNullException(nameof(casStore));
         _logger = logger ?? throw new ArgumentNullException(nameof(logger));
+        _timeProvider = timeProvider ?? TimeProvider.System;
     }
 
     /// <summary>
@@ -135,7 +138,7 @@ public class PoEOrchestrator
     {
         // Build metadata
         var metadata = new ProofMetadata(
-            GeneratedAt: DateTime.UtcNow,
+            GeneratedAt: _timeProvider.GetUtcNow().UtcDateTime,
             Analyzer: new AnalyzerInfo(
                 Name: "stellaops-scanner",
                 Version: context.ScannerVersion,
@@ -144,7 +147,7 @@ public class PoEOrchestrator
             Policy: new PolicyInfo(
                 PolicyId: context.PolicyId,
                 PolicyDigest: context.PolicyDigest,
-                EvaluatedAt: DateTime.UtcNow
+                EvaluatedAt: _timeProvider.GetUtcNow().UtcDateTime
             ),
             ReproSteps: GenerateReproSteps(context, subgraph)
         );

src/Scanner/StellaOps.Scanner.Worker/Processing/BinaryFindingMapper.cs

@@ -22,13 +22,16 @@ public sealed class BinaryFindingMapper
 {
     private readonly IBinaryVulnerabilityService _binaryVulnService;
     private readonly ILogger<BinaryFindingMapper> _logger;
+    private readonly TimeProvider _timeProvider;
 
     public BinaryFindingMapper(
         IBinaryVulnerabilityService binaryVulnService,
-        ILogger<BinaryFindingMapper> logger)
+        ILogger<BinaryFindingMapper> logger,
+        TimeProvider? timeProvider = null)
     {
         _binaryVulnService = binaryVulnService ?? throw new ArgumentNullException(nameof(binaryVulnService));
         _logger = logger ?? throw new ArgumentNullException(nameof(logger));
+        _timeProvider = timeProvider ?? TimeProvider.System;
     }
 
     /// <summary>
@@ -62,7 +65,7 @@ public sealed class BinaryFindingMapper
             },
             Remediation = GenerateRemediation(finding),
             ScanId = finding.ScanId,
-            DetectedAt = DateTimeOffset.UtcNow
+            DetectedAt = _timeProvider.GetUtcNow()
         };
     }
 

src/Scanner/StellaOps.Scanner.Worker/StellaOps.Scanner.Worker.csproj

@@ -15,6 +15,7 @@
     <PackageReference Include="OpenTelemetry.Instrumentation.Process" />
   </ItemGroup>
   <ItemGroup>
+    <ProjectReference Include="../../__Libraries/StellaOps.Determinism.Abstractions/StellaOps.Determinism.Abstractions.csproj" />
     <ProjectReference Include="../../__Libraries/StellaOps.Cryptography/StellaOps.Cryptography.csproj" />
     <ProjectReference Include="../../__Libraries/StellaOps.Plugin/StellaOps.Plugin.csproj" />
     <ProjectReference Include="../../__Libraries/StellaOps.Replay.Core/StellaOps.Replay.Core.csproj" />