up
This commit is contained in:
StellaOps Bot
@@ -1,63 +1,53 @@
|
||||
# Sprint 132 - Scanner & Surface
|
||||
# Sprint 132 · Scanner & Surface
|
||||
|
||||
Implementation order remains sequential across Sprint 130–139. Complete each sprint in order before pulling tasks from the next file.
|
||||
## Topic & Scope
|
||||
- Phase III of Scanner & Surface: harden language analyzers with focus on Node.js VFS/resolution and complete remaining surface capture.
|
||||
- Implementation order stays sequential across Sprint 130–139; complete upstream sprint 131 items before pulling parallel work.
|
||||
- Working directory: `src/Scanner` (language analyzers under `src/Scanner/__Libraries`).
|
||||
|
||||
## 3. Scanner.III — Scanner & Surface focus on Scanner (phase III).
|
||||
Dependency: Sprint 131 - 2. Scanner.II — Scanner & Surface focus on Scanner (phase II).
|
||||
## Dependencies & Concurrency
|
||||
- Upstream: Sprint 131 (`SCANNER-ANALYZERS-LANG-11-001` foundation for .NET analyzer heuristics).
|
||||
- Completed native analyzer stream (NATIVE-20-xxx) provides resolver patterns; reuse determinism and explain-trace patterns.
|
||||
|
||||
| Task ID | State | Summary | Owner / Source | Depends On |
|
||||
| --- | --- | --- | --- | --- |
|
||||
| `SCANNER-ANALYZERS-LANG-11-002` | BLOCKED | Implement static analyzer (IL + reflection heuristics) capturing AssemblyRef, ModuleRef/PInvoke, DynamicDependency, reflection literals, DI patterns, and custom AssemblyLoadContext probing hints. Emit dependency edges with reason codes and confidence. | StellaOps.Scanner EPDR Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.DotNet) | SCANNER-ANALYZERS-LANG-11-001 |
|
||||
| `SCANNER-ANALYZERS-LANG-11-003` | BLOCKED | Ingest optional runtime evidence (AssemblyLoad, Resolving, P/Invoke) via event listener harness; merge runtime edges with static/declared ones and attach reason codes/confidence. | StellaOps.Scanner EPDR Guild, Signals Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.DotNet) | SCANNER-ANALYZERS-LANG-11-002 |
|
||||
| `SCANNER-ANALYZERS-LANG-11-004` | BLOCKED | Produce normalized observation export to Scanner writer: entrypoints + dependency edges + environment profiles (AOC compliant). Wire to SBOM service entrypoint tagging. | StellaOps.Scanner EPDR Guild, SBOM Service Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.DotNet) | SCANNER-ANALYZERS-LANG-11-003 |
|
||||
| `SCANNER-ANALYZERS-LANG-11-005` | BLOCKED | Add comprehensive fixtures/benchmarks covering framework-dependent, self-contained, single-file, trimmed, NativeAOT, multi-RID scenarios; include explain traces and perf benchmarks vs previous analyzer. | StellaOps.Scanner EPDR Guild, QA Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.DotNet) | SCANNER-ANALYZERS-LANG-11-004 |
|
||||
| `SCANNER-ANALYZERS-NATIVE-20-001` | DONE | Implement format detector and binary identity model supporting ELF, PE/COFF, and Mach-O (including fat slices). Capture arch, OS, build-id/UUID, interpreter metadata. | Native Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Native) | — |
|
||||
| `SCANNER-ANALYZERS-NATIVE-20-002` | DONE | Parse ELF dynamic sections: `DT_NEEDED`, `DT_RPATH`, `DT_RUNPATH`, symbol versions, interpreter, and note build-id. Emit declared dependency records with reason `elf-dtneeded` and attach version needs. | Native Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Native) | SCANNER-ANALYZERS-NATIVE-20-001 |
|
||||
| `SCANNER-ANALYZERS-NATIVE-20-003` | DONE | Parse PE imports, delay-load tables, manifests/SxS metadata, and subsystem flags. Emit edges with reasons `pe-import` and `pe-delayimport`, plus SxS policy metadata. | Native Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Native) | SCANNER-ANALYZERS-NATIVE-20-002 |
|
||||
| `SCANNER-ANALYZERS-NATIVE-20-004` | DONE | Parse Mach-O load commands (`LC_LOAD_DYLIB`, `LC_REEXPORT_DYLIB`, `LC_RPATH`, `LC_UUID`, fat headers). Handle `@rpath/@loader_path` placeholders and slice separation. | Native Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Native) | SCANNER-ANALYZERS-NATIVE-20-003 |
|
||||
| `SCANNER-ANALYZERS-NATIVE-20-005` | DONE | Implement resolver engine modeling loader search order for ELF (rpath/runpath/cache/default), PE (SafeDll search + SxS), and Mach-O (`@rpath` expansion). Works against virtual image roots, producing explain traces. | Native Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Native) | SCANNER-ANALYZERS-NATIVE-20-004 |
|
||||
| `SCANNER-ANALYZERS-NATIVE-20-006` | DONE | Build heuristic scanner for `dlopen`/`LoadLibrary` strings, plugin ecosystem configs, and Go/Rust static hints. Emit edges with `reason_code` (`string-dlopen`, `config-plugin`, `ecosystem-heuristic`) and confidence levels. | Native Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Native) | SCANNER-ANALYZERS-NATIVE-20-005 |
|
||||
| `SCANNER-ANALYZERS-NATIVE-20-007` | DONE | Serialize AOC-compliant observations: entrypoints + dependency edges + environment profiles (search paths, interpreter, loader metadata). Integrate with Scanner writer API. | Native Analyzer Guild, SBOM Service Guild (src/Scanner/StellaOps.Scanner.Analyzers.Native) | SCANNER-ANALYZERS-NATIVE-20-006 |
|
||||
| `SCANNER-ANALYZERS-NATIVE-20-008` | DONE | Author cross-platform fixtures (ELF dynamic/static, PE delay-load/SxS, Mach-O @rpath, plugin configs) and determinism benchmarks (<25 ms / binary, <250 MB). | Native Analyzer Guild, QA Guild (src/Scanner/StellaOps.Scanner.Analyzers.Native) | SCANNER-ANALYZERS-NATIVE-20-007 |
|
||||
| `SCANNER-ANALYZERS-NATIVE-20-009` | DONE | Provide optional runtime capture adapters (Linux eBPF `dlopen`, Windows ETW ImageLoad, macOS dyld interpose) writing append-only runtime evidence. Include redaction/sandbox guidance. | Native Analyzer Guild, Signals Guild (src/Scanner/StellaOps.Scanner.Analyzers.Native) | SCANNER-ANALYZERS-NATIVE-20-008 |
|
||||
| `SCANNER-ANALYZERS-NATIVE-20-010` | DONE | Package native analyzer as restart-time plug-in with manifest/DI registration; update Offline Kit bundle + documentation. | Native Analyzer Guild, DevOps Guild (src/Scanner/StellaOps.Scanner.Analyzers.Native) | SCANNER-ANALYZERS-NATIVE-20-009 |
|
||||
| `SCANNER-ANALYZERS-NODE-22-001` | TODO | Build input normalizer + VFS for Node projects: dirs, tgz, container layers, pnpm store, Yarn PnP zips; detect Node version targets (`.nvmrc`, `.node-version`, Dockerfile) and workspace roots deterministically. | Node Analyzer Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node) | — |
|
||||
| `SCANNER-ANALYZERS-NODE-22-002` | TODO | Implement entrypoint discovery (bin/main/module/exports/imports, workers, electron, shebang scripts) and condition set builder per entrypoint. | Node Analyzer Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node) | SCANNER-ANALYZERS-NODE-22-001 |
|
||||
| `SCANNER-ANALYZERS-NODE-22-003` | TODO | Parse JS/TS sources for static `import`, `require`, `import()` and string concat cases; flag dynamic patterns with confidence levels; support source map de-bundling. | Node Analyzer Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node) | SCANNER-ANALYZERS-NODE-22-002 |
|
||||
| `SCANNER-ANALYZERS-NODE-22-004` | TODO | Implement Node resolver engine for CJS + ESM (core modules, exports/imports maps, conditions, extension priorities, self-references) parameterised by node_version. | Node Analyzer Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node) | SCANNER-ANALYZERS-NODE-22-003 |
|
||||
| `SCANNER-ANALYZERS-NODE-22-005` | TODO | Add package manager adapters: Yarn PnP (.pnp.data/.pnp.cjs), pnpm virtual store, npm/Yarn classic hoists; operate entirely in virtual FS. | Node Analyzer Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node) | SCANNER-ANALYZERS-NODE-22-004 |
|
||||
## Documentation Prerequisites
|
||||
- docs/modules/scanner/architecture.md
|
||||
- docs/modules/platform/architecture-overview.md
|
||||
- src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node/AGENTS.md
|
||||
|
||||
## Status Notes (2025-11-27)
|
||||
## Delivery Tracker
|
||||
| # | Task ID | Status | Key dependency / next step | Owners | Task Definition |
|
||||
| --- | --- | --- | --- | --- | --- |
|
||||
| 1 | SCANNER-ANALYZERS-LANG-11-002 | BLOCKED | Await SCANNER-ANALYZERS-LANG-11-001 foundation from Sprint 131 | StellaOps.Scanner EPDR Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.DotNet) | Implement static analyzer (IL + reflection heuristics) capturing AssemblyRef, ModuleRef/PInvoke, DynamicDependency, reflection literals, DI patterns, and custom AssemblyLoadContext probing hints. Emit dependency edges with reason codes and confidence. |
|
||||
| 2 | SCANNER-ANALYZERS-LANG-11-003 | BLOCKED | Depends on 11-002; runtime evidence harness pending | StellaOps.Scanner EPDR Guild, Signals Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.DotNet) | Ingest optional runtime evidence (AssemblyLoad, Resolving, P/Invoke) via event listener harness; merge runtime edges with static/declared ones and attach reason codes/confidence. |
|
||||
| 3 | SCANNER-ANALYZERS-LANG-11-004 | BLOCKED | Depends on 11-003 | StellaOps.Scanner EPDR Guild, SBOM Service Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.DotNet) | Produce normalized observation export to Scanner writer: entrypoints + dependency edges + environment profiles (AOC compliant). Wire to SBOM service entrypoint tagging. |
|
||||
| 4 | SCANNER-ANALYZERS-LANG-11-005 | BLOCKED | Depends on 11-004 | StellaOps.Scanner EPDR Guild, QA Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.DotNet) | Add comprehensive fixtures/benchmarks covering framework-dependent, self-contained, single-file, trimmed, NativeAOT, multi-RID scenarios; include explain traces and perf benchmarks vs previous analyzer. |
|
||||
| 5 | SCANNER-ANALYZERS-NATIVE-20-001 | DONE | — | Native Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Native) | Implement format detector and binary identity model supporting ELF, PE/COFF, and Mach-O (including fat slices). Capture arch, OS, build-id/UUID, interpreter metadata. |
|
||||
| 6 | SCANNER-ANALYZERS-NATIVE-20-002 | DONE | — | Native Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Native) | Parse ELF dynamic sections: `DT_NEEDED`, `DT_RPATH`, `DT_RUNPATH`, symbol versions, interpreter, and note build-id. Emit declared dependency records with reason `elf-dtneeded` and attach version needs. |
|
||||
| 7 | SCANNER-ANALYZERS-NATIVE-20-003 | DONE | — | Native Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Native) | Parse PE imports, delay-load tables, manifests/SxS metadata, and subsystem flags. Emit edges with reasons `pe-import` and `pe-delayimport`, plus SxS policy metadata. |
|
||||
| 8 | SCANNER-ANALYZERS-NATIVE-20-004 | DONE | — | Native Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Native) | Parse Mach-O load commands (`LC_LOAD_DYLIB`, `LC_REEXPORT_DYLIB`, `LC_RPATH`, `LC_UUID`, fat headers). Handle `@rpath/@loader_path` placeholders and slice separation. |
|
||||
| 9 | SCANNER-ANALYZERS-NATIVE-20-005 | DONE | — | Native Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Native) | Implement resolver engine modeling loader search order for ELF (rpath/runpath/cache/default), PE (SafeDll search + SxS), and Mach-O (`@rpath` expansion). Works against virtual image roots, producing explain traces. |
|
||||
| 10 | SCANNER-ANALYZERS-NATIVE-20-006 | DONE | — | Native Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Native) | Build heuristic scanner for `dlopen`/`LoadLibrary` strings, plugin ecosystem configs, and Go/Rust static hints. Emit edges with `reason_code` (`string-dlopen`, `config-plugin`, `ecosystem-heuristic`) and confidence levels. |
|
||||
| 11 | SCANNER-ANALYZERS-NATIVE-20-007 | DONE | — | Native Analyzer Guild, SBOM Service Guild (src/Scanner/StellaOps.Scanner.Analyzers.Native) | Serialize AOC-compliant observations: entrypoints + dependency edges + environment profiles (search paths, interpreter, loader metadata). Integrate with Scanner writer API. |
|
||||
| 12 | SCANNER-ANALYZERS-NATIVE-20-008 | DONE | — | Native Analyzer Guild, QA Guild (src/Scanner/StellaOps.Scanner.Analyzers.Native) | Author cross-platform fixtures (ELF dynamic/static, PE delay-load/SxS, Mach-O @rpath, plugin configs) and determinism benchmarks (<25 ms / binary, <250 MB). |
|
||||
| 13 | SCANNER-ANALYZERS-NATIVE-20-009 | DONE | — | Native Analyzer Guild, Signals Guild (src/Scanner/StellaOps.Scanner.Analyzers.Native) | Provide optional runtime capture adapters (Linux eBPF `dlopen`, Windows ETW ImageLoad, macOS dyld interpose) writing append-only runtime evidence. Include redaction/sandbox guidance. |
|
||||
| 14 | SCANNER-ANALYZERS-NATIVE-20-010 | DONE | — | Native Analyzer Guild, DevOps Guild (src/Scanner/StellaOps.Scanner.Analyzers.Native) | Package native analyzer as restart-time plug-in with manifest/DI registration; update Offline Kit bundle + documentation. |
|
||||
| 15 | SCANNER-ANALYZERS-NODE-22-001 | DONE | VFS/input normalizer implemented for dirs/tgz/container layers/pnpm/Yarn PnP; Node version detection wired | Node Analyzer Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node) | Build input normalizer + VFS for Node projects: dirs, tgz, container layers, pnpm store, Yarn PnP zips; detect Node version targets and workspace roots deterministically. |
|
||||
| 16 | SCANNER-ANALYZERS-NODE-22-002 | DONE | Entrypoint discovery expanded; condition sets emitted | Node Analyzer Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node) | Implement entrypoint discovery (bin/main/module/exports/imports, workers, electron, shebang scripts) and condition set builder per entrypoint. |
|
||||
| 17 | SCANNER-ANALYZERS-NODE-22-003 | DONE | Import walker supports dynamic patterns + source maps with confidence tagging | Node Analyzer Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node) | Parse JS/TS sources for static `import`, `require`, `import()` and string concat cases; flag dynamic patterns with confidence levels; support source map de-bundling. |
|
||||
| 18 | SCANNER-ANALYZERS-NODE-22-004 | DONE | Node resolver engine integrated (core modules, exports/imports maps, extension precedence, self refs) | Node Analyzer Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node) | Implement Node resolver engine for CJS + ESM (core modules, exports/imports maps, conditions, extension priorities, self-references) parameterised by node_version. |
|
||||
| 19 | SCANNER-ANALYZERS-NODE-22-005 | DONE | Yarn PnP + pnpm virtual store adapters operational via VFS | Node Analyzer Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node) | Add package manager adapters: Yarn PnP (.pnp.data/.pnp.cjs), pnpm virtual store, npm/Yarn classic hoists; operate entirely in virtual FS. |
|
||||
|
||||
### Native Analyzer (NATIVE-20-xxx): DONE
|
||||
All 10 tasks completed. Implementation verified with 165 passing tests.
|
||||
## Execution Log
|
||||
| Date (UTC) | Update | Owner |
|
||||
| --- | --- | --- |
|
||||
| 2025-12-01 | Normalized sprint file to standard template; preserved existing tasks and statuses. | Planning |
|
||||
| 2025-12-01 | Started Node stream tasks 22-001 → 22-005 (Scanner & Surface phase III). | Node Analyzer Guild |
|
||||
| 2025-12-01 | Completed Node stream tasks 22-001 → 22-005; VFS/resolver/import walker shipped with updated fixtures and tests. | Node Analyzer Guild |
|
||||
|
||||
**Implemented components:**
|
||||
- `NativeFormatDetector.cs` - Format detection for ELF/PE/Mach-O with binary identity
|
||||
- `ElfDynamicSectionParser.cs` - ELF dynamic sections, DT_NEEDED, rpath/runpath
|
||||
- `PeImportParser.cs` - PE imports, delay-load, manifests, subsystem flags
|
||||
- `MachOLoadCommandParser.cs` - Mach-O load commands, @rpath, fat binaries
|
||||
- `NativeResolver.cs` - Cross-platform loader search order modeling
|
||||
- `HeuristicScanner.cs` - dlopen/LoadLibrary string detection, plugin configs
|
||||
- `Observations/` - AOC-compliant observation builder and serializer
|
||||
- `RuntimeCapture/` - Linux eBPF, Windows ETW, macOS dyld adapters
|
||||
- `Plugin/` - Plugin packaging with DI registration
|
||||
## Decisions & Risks
|
||||
- DotNet analyzer stream (11-002 → 11-005) remains blocked pending foundation task `SCANNER-ANALYZERS-LANG-11-001` from Sprint 131.
|
||||
- Native analyzer stream (NATIVE-20-001 → NATIVE-20-010) completed with 165 passing tests; serves as reference for determinism and resolver explain traces.
|
||||
- Missing components for Sprint 132 (Node stream): VFS for container layers/pnpm/Yarn PnP, exports/imports condition builder, dynamic import analysis with confidence, Node resolver, pnpm virtual store adapter.
|
||||
|
||||
### DotNet Analyzer (LANG-11-xxx): BLOCKED
|
||||
Tasks 11-002 through 11-005 are blocked pending SCANNER-ANALYZERS-LANG-11-001 from Sprint 131.
|
||||
|
||||
**Blocker:** SCANNER-ANALYZERS-LANG-11-001 (not in this sprint) must implement the foundation for IL analysis before static analyzer heuristics can be built.
|
||||
|
||||
### Node Analyzer (NODE-22-xxx): TODO
|
||||
Tasks 22-001 through 22-005 remain TODO. Existing infrastructure provides partial coverage:
|
||||
- `NodePackageCollector` - handles dirs, tgz, Yarn PnP cache
|
||||
- `NodeVersionDetector` - detects .nvmrc, .node-version, Dockerfile
|
||||
- `NodeWorkspaceIndex` - workspace root detection
|
||||
- `NodeImportWalker` - basic import/require parsing
|
||||
|
||||
**Missing components for Sprint 132:**
|
||||
- Full VFS abstraction for container layers and pnpm store (22-001)
|
||||
- Exports/imports map handling and condition set builder (22-002)
|
||||
- Dynamic pattern confidence levels and source map support (22-003)
|
||||
- Complete Node resolver engine for CJS+ESM (22-004)
|
||||
- pnpm virtual store adapter (22-005)
|
||||
## Next Checkpoints
|
||||
- None scheduled; align asynchronously with upstream Sprint 131 completion and Node guild milestones.
|
||||
|
||||
Reference in New Issue
Block a user