Add MergeUsageAnalyzer to detect legacy merge service usage

- Implemented MergeUsageAnalyzer to flag usage of AdvisoryMergeService and AddMergeModule.
- Created AnalyzerReleases.Shipped.md and AnalyzerReleases.Unshipped.md for release documentation.
- Added tests for MergeUsageAnalyzer to ensure correct diagnostics for various scenarios.
- Updated project files for analyzers and tests to include necessary dependencies and configurations.
- Introduced a sample report structure for scanner output.

src/Concelier/StellaOps.Concelier.WebService/StellaOps.Concelier.WebService.csproj

@@ -35,7 +35,7 @@
     <ProjectReference Include="../../Authority/StellaOps.Authority/StellaOps.Auth.ServerIntegration/StellaOps.Auth.ServerIntegration.csproj" />
     <ProjectReference Include="../../Aoc/__Libraries/StellaOps.Aoc/StellaOps.Aoc.csproj" />
     <ProjectReference Include="../../Aoc/__Libraries/StellaOps.Aoc.AspNetCore/StellaOps.Aoc.AspNetCore.csproj" />
-    <ProjectReference Include="../__Analyzers/StellaOps.Concelier.Analyzers/StellaOps.Concelier.Analyzers.csproj"
+    <ProjectReference Include="../__Analyzers/StellaOps.Concelier.Merge.Analyzers/StellaOps.Concelier.Merge.Analyzers.csproj"
                       OutputItemType="Analyzer"
                       ReferenceOutputAssembly="false" />
   </ItemGroup>

src/Concelier/__Analyzers/StellaOps.Concelier.Analyzers/AnalyzerReleases.Unshipped.md

@@ -2,8 +2,4 @@
 
 ### Unreleased
 
-#### New Rules
-
-Rule ID | Title | Notes
---------|-------|------
-CONCELIER0002 | Legacy merge pipeline is disabled | Flags usage of `AddMergeModule` and `AdvisoryMergeService`.
+No analyzer rules currently scheduled for release.

src/Concelier/__Analyzers/StellaOps.Concelier.Analyzers/NoMergeUsageAnalyzer.cs

@@ -1,152 +0,0 @@
-using System;
-using System.Collections.Immutable;
-using Microsoft.CodeAnalysis;
-using Microsoft.CodeAnalysis.Diagnostics;
-using Microsoft.CodeAnalysis.Operations;
-
-namespace StellaOps.Concelier.Analyzers;
-
-/// <summary>
-/// Analyzer that flags usages of the legacy merge service APIs.
-/// </summary>
-[DiagnosticAnalyzer(LanguageNames.CSharp)]
-public sealed class NoMergeUsageAnalyzer : DiagnosticAnalyzer
-{
-    /// <summary>
-    /// Diagnostic identifier for legacy merge usage violations.
-    /// </summary>
-    public const string DiagnosticId = "CONCELIER0002";
-
-    private const string Category = "Usage";
-    private const string MergeExtensionType = "StellaOps.Concelier.Merge.MergeServiceCollectionExtensions";
-    private const string MergeServiceType = "StellaOps.Concelier.Merge.Services.AdvisoryMergeService";
-
-    private static readonly LocalizableString Title = "Legacy merge pipeline is disabled";
-    private static readonly LocalizableString MessageFormat = "Do not reference the legacy Concelier merge pipeline (type '{0}')";
-    private static readonly LocalizableString Description =
-        "The legacy Concelier merge service is deprecated under MERGE-LNM-21-002. "
-        + "Switch to observation/linkset APIs or guard calls behind the concelier:features:noMergeEnabled toggle.";
-
-    private static readonly DiagnosticDescriptor Rule = new(
-        DiagnosticId,
-        Title,
-        MessageFormat,
-        Category,
-        DiagnosticSeverity.Error,
-        isEnabledByDefault: true,
-        description: Description,
-        helpLinkUri: "https://stella-ops.org/docs/migration/no-merge");
-
-    /// <inheritdoc />
-    public override ImmutableArray<DiagnosticDescriptor> SupportedDiagnostics => ImmutableArray.Create(Rule);
-
-    /// <inheritdoc />
-    public override void Initialize(AnalysisContext context)
-    {
-        context.ConfigureGeneratedCodeAnalysis(GeneratedCodeAnalysisFlags.None);
-        context.EnableConcurrentExecution();
-
-        context.RegisterOperationAction(AnalyzeInvocation, OperationKind.Invocation);
-        context.RegisterOperationAction(AnalyzeObjectCreation, OperationKind.ObjectCreation);
-    }
-
-    private static void AnalyzeInvocation(OperationAnalysisContext context)
-    {
-        if (context.Operation is not IInvocationOperation invocation)
-        {
-            return;
-        }
-
-        var targetMethod = invocation.TargetMethod;
-        if (targetMethod is null)
-        {
-            return;
-        }
-
-        if (!SymbolEquals(targetMethod.ContainingType, MergeExtensionType))
-        {
-            return;
-        }
-
-        if (!string.Equals(targetMethod.Name, "AddMergeModule", StringComparison.Ordinal))
-        {
-            return;
-        }
-
-        if (IsAllowedAssembly(context.ContainingSymbol.ContainingAssembly))
-        {
-            return;
-        }
-
-        ReportDiagnostic(context, invocation.Syntax, $"{MergeExtensionType}.{targetMethod.Name}");
-    }
-
-    private static void AnalyzeObjectCreation(OperationAnalysisContext context)
-    {
-        if (context.Operation is not IObjectCreationOperation creation)
-        {
-            return;
-        }
-
-        var createdType = creation.Type;
-        if (createdType is null || !SymbolEquals(createdType, MergeServiceType))
-        {
-            return;
-        }
-
-        if (IsAllowedAssembly(context.ContainingSymbol.ContainingAssembly))
-        {
-            return;
-        }
-
-        ReportDiagnostic(context, creation.Syntax, MergeServiceType);
-    }
-
-    private static bool SymbolEquals(ITypeSymbol? symbol, string fullName)
-    {
-        if (symbol is null)
-        {
-            return false;
-        }
-
-        var display = symbol.ToDisplayString(SymbolDisplayFormat.FullyQualifiedFormat);
-        if (display.StartsWith("global::", StringComparison.Ordinal))
-        {
-            display = display.Substring("global::".Length);
-        }
-
-        return string.Equals(display, fullName, StringComparison.Ordinal);
-    }
-
-    private static bool IsAllowedAssembly(IAssemblySymbol? assemblySymbol)
-    {
-        if (assemblySymbol is null)
-        {
-            return false;
-        }
-
-        var assemblyName = assemblySymbol.Name;
-        if (string.IsNullOrWhiteSpace(assemblyName))
-        {
-            return false;
-        }
-
-        if (assemblyName.StartsWith("StellaOps.Concelier.Merge", StringComparison.Ordinal))
-        {
-            return true;
-        }
-
-        if (assemblyName.EndsWith(".Analyzers", StringComparison.Ordinal))
-        {
-            return true;
-        }
-
-        return false;
-    }
-
-    private static void ReportDiagnostic(OperationAnalysisContext context, SyntaxNode syntax, string targetName)
-    {
-        var diagnostic = Diagnostic.Create(Rule, syntax.GetLocation(), targetName);
-        context.ReportDiagnostic(diagnostic);
-    }
-}

src/Concelier/__Analyzers/StellaOps.Concelier.Merge.Analyzers/AnalyzerReleases.Shipped.md

@@ -0,0 +1,2 @@
+; Shipped analyzer releases
+

src/Concelier/__Analyzers/StellaOps.Concelier.Merge.Analyzers/AnalyzerReleases.Unshipped.md

@@ -0,0 +1,9 @@
+## Release History
+
+### Unreleased
+
+#### New Rules
+
+Rule ID | Title | Notes
+--------|-------|------
+CONCELIER0002 | Legacy merge service usage detected | Flags references to `AdvisoryMergeService` and `AddMergeModule`.

src/Concelier/__Analyzers/StellaOps.Concelier.Merge.Analyzers/MergeUsageAnalyzer.cs

@@ -0,0 +1,237 @@
+using System;
+using System.Collections.Immutable;
+using Microsoft.CodeAnalysis;
+using Microsoft.CodeAnalysis.CSharp;
+using Microsoft.CodeAnalysis.CSharp.Syntax;
+using Microsoft.CodeAnalysis.Diagnostics;
+using Microsoft.CodeAnalysis.Operations;
+
+namespace StellaOps.Concelier.Merge.Analyzers;
+
+[DiagnosticAnalyzer(LanguageNames.CSharp)]
+public sealed class MergeUsageAnalyzer : DiagnosticAnalyzer
+{
+    public const string DiagnosticId = "CONCELIER0002";
+
+    private const string AdvisoryMergeServiceTypeName = "StellaOps.Concelier.Merge.Services.AdvisoryMergeService";
+    private const string MergeExtensionsTypeName = "StellaOps.Concelier.Merge.MergeServiceCollectionExtensions";
+    private const string AddMergeModuleMethodName = "AddMergeModule";
+
+    private static readonly DiagnosticDescriptor Rule = new(
+        DiagnosticId,
+        title: "Legacy merge service usage detected",
+        messageFormat: "Advisory merge pipeline is deprecated; remove usage of '{0}' and adopt Link-Not-Merge linkset workflows (MERGE-LNM-21-002)",
+        category: "Usage",
+        defaultSeverity: DiagnosticSeverity.Warning,
+        isEnabledByDefault: true,
+        description: "Link-Not-Merge replaces the legacy AdvisoryMergeService. Set concelier:features:noMergeEnabled=true and migrate to observation/linkset APIs instead of invoking merge services directly.",
+        helpLinkUri: "https://stella-ops.org/docs/migration/no-merge");
+
+    public override ImmutableArray<DiagnosticDescriptor> SupportedDiagnostics => ImmutableArray.Create(Rule);
+
+    public override void Initialize(AnalysisContext context)
+    {
+        context.ConfigureGeneratedCodeAnalysis(GeneratedCodeAnalysisFlags.None);
+        context.EnableConcurrentExecution();
+
+        context.RegisterOperationAction(AnalyzeInvocation, OperationKind.Invocation);
+        context.RegisterOperationAction(AnalyzeObjectCreation, OperationKind.ObjectCreation);
+        context.RegisterOperationAction(AnalyzeTypeOf, OperationKind.TypeOf);
+        context.RegisterSyntaxNodeAction(AnalyzeIdentifier, SyntaxKind.IdentifierName);
+    }
+
+    private static void AnalyzeInvocation(OperationAnalysisContext context)
+    {
+        if (context.Operation is not IInvocationOperation invocation)
+        {
+            return;
+        }
+
+        var method = invocation.TargetMethod;
+        if (!IsAddMergeModule(method) && (method.ReducedFrom is null || !IsAddMergeModule(method.ReducedFrom)))
+        {
+            return;
+        }
+
+        if (IsAllowedAssembly(method.ContainingAssembly, context.ContainingSymbol))
+        {
+            return;
+        }
+
+        ReportDiagnostic(context, invocation.Syntax.GetLocation(), $"{method.ContainingType.Name}.{method.Name}");
+    }
+
+    private static void AnalyzeObjectCreation(OperationAnalysisContext context)
+    {
+        if (context.Operation is not IObjectCreationOperation creation)
+        {
+            return;
+        }
+
+        if (creation.Type is not INamedTypeSymbol type || !IsAdvisoryMergeService(type))
+        {
+            return;
+        }
+
+        if (IsAllowedAssembly(type.ContainingAssembly, context.ContainingSymbol))
+        {
+            return;
+        }
+
+        ReportDiagnostic(context, creation.Syntax.GetLocation(), type.Name);
+    }
+
+    private static void AnalyzeTypeOf(OperationAnalysisContext context)
+    {
+        if (context.Operation is not ITypeOfOperation typeOfOperation)
+        {
+            return;
+        }
+
+        if (typeOfOperation.TypeOperand is not INamedTypeSymbol type || !IsAdvisoryMergeService(type))
+        {
+            return;
+        }
+
+        if (IsAllowedAssembly(type.ContainingAssembly, context.ContainingSymbol))
+        {
+            return;
+        }
+
+        ReportDiagnostic(context, typeOfOperation.Syntax.GetLocation(), type.Name);
+    }
+
+    private static void AnalyzeIdentifier(SyntaxNodeAnalysisContext context)
+    {
+        var identifier = (IdentifierNameSyntax)context.Node;
+        if (!IsRightMostIdentifier(identifier))
+        {
+            return;
+        }
+
+        var symbolInfo = context.SemanticModel.GetSymbolInfo(identifier, context.CancellationToken);
+        var symbol = symbolInfo.Symbol;
+        if (symbol is not INamedTypeSymbol typeSymbol || !IsAdvisoryMergeService(typeSymbol))
+        {
+            return;
+        }
+
+        if (IsAllowedAssembly(typeSymbol.ContainingAssembly, context.ContainingSymbol))
+        {
+            return;
+        }
+
+        if (IsPartOfSuppressedConstruct(identifier))
+        {
+            return;
+        }
+
+        var diagnostic = Diagnostic.Create(Rule, identifier.GetLocation(), typeSymbol.Name);
+        context.ReportDiagnostic(diagnostic);
+    }
+
+    private static bool IsPartOfSuppressedConstruct(IdentifierNameSyntax identifier)
+    {
+        foreach (var ancestor in identifier.Ancestors())
+        {
+            switch (ancestor)
+            {
+                case ObjectCreationExpressionSyntax:
+                case TypeOfExpressionSyntax:
+                    return true;
+            }
+        }
+
+        return false;
+    }
+
+    private static bool IsRightMostIdentifier(IdentifierNameSyntax identifier)
+    {
+        if (identifier.Parent is QualifiedNameSyntax qualified)
+        {
+            return qualified.Right == identifier;
+        }
+
+        if (identifier.Parent is AliasQualifiedNameSyntax aliasQualified)
+        {
+            return aliasQualified.Name == identifier;
+        }
+
+        return true;
+    }
+
+    private static bool IsAddMergeModule(IMethodSymbol methodSymbol)
+    {
+        if (!string.Equals(methodSymbol.Name, AddMergeModuleMethodName, StringComparison.Ordinal))
+        {
+            return false;
+        }
+
+        var containingType = methodSymbol.ContainingType;
+        if (containingType is null)
+        {
+            return false;
+        }
+
+        var display = containingType.ToDisplayString(SymbolDisplayFormat.FullyQualifiedFormat);
+        display = TrimGlobalPrefix(display);
+        return string.Equals(display, MergeExtensionsTypeName, StringComparison.Ordinal);
+    }
+
+    private static bool IsAdvisoryMergeService(INamedTypeSymbol symbol)
+    {
+        var display = symbol.ToDisplayString(SymbolDisplayFormat.FullyQualifiedFormat);
+        display = TrimGlobalPrefix(display);
+        return string.Equals(display, AdvisoryMergeServiceTypeName, StringComparison.Ordinal);
+    }
+
+    private static void ReportDiagnostic(OperationAnalysisContext context, Location location, string target)
+    {
+        var diagnostic = Diagnostic.Create(Rule, location, target);
+        context.ReportDiagnostic(diagnostic);
+    }
+
+    private static bool IsAllowedAssembly(IAssemblySymbol? referencedAssembly, ISymbol? containingSymbol)
+    {
+        var consumerAssembly = containingSymbol?.ContainingAssembly;
+        if (referencedAssembly is null || consumerAssembly is null)
+        {
+            return false;
+        }
+
+        var referencedName = referencedAssembly.Name;
+        if (!string.IsNullOrWhiteSpace(referencedName) &&
+            referencedName.StartsWith("StellaOps.Concelier.Merge", StringComparison.Ordinal))
+        {
+            return true;
+        }
+
+        var name = consumerAssembly.Name;
+        if (string.IsNullOrWhiteSpace(name))
+        {
+            return false;
+        }
+
+        if (name.StartsWith("StellaOps.Concelier.Merge", StringComparison.Ordinal))
+        {
+            return true;
+        }
+
+        if (name.EndsWith(".Analyzers", StringComparison.Ordinal))
+        {
+            return true;
+        }
+
+        return false;
+    }
+
+    private static string TrimGlobalPrefix(string display)
+    {
+        if (!display.StartsWith("global::", StringComparison.Ordinal))
+        {
+            return display;
+        }
+
+        return display.Substring("global::".Length);
+    }
+}

src/Concelier/__Analyzers/StellaOps.Concelier.Merge.Analyzers/StellaOps.Concelier.Merge.Analyzers.csproj

@@ -0,0 +1,23 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project Sdk="Microsoft.NET.Sdk">
+  <PropertyGroup>
+    <TargetFramework>netstandard2.0</TargetFramework>
+    <ImplicitUsings>enable</ImplicitUsings>
+    <Nullable>enable</Nullable>
+    <LangVersion>preview</LangVersion>
+    <IncludeBuildOutput>false</IncludeBuildOutput>
+    <AnalysisLevel>latest</AnalysisLevel>
+    <EnforceExtendedAnalyzerRules>true</EnforceExtendedAnalyzerRules>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <PackageReference Include="Microsoft.CodeAnalysis.CSharp" Version="4.0.1" PrivateAssets="all" />
+    <PackageReference Include="Microsoft.CodeAnalysis.Analyzers" Version="3.3.4" PrivateAssets="all" />
+  </ItemGroup>
+
+  <ItemGroup>
+    <None Include="README.md" Visible="false" />
+    <None Include="AnalyzerReleases.Shipped.md" Visible="false" />
+    <None Include="AnalyzerReleases.Unshipped.md" Visible="false" />
+  </ItemGroup>
+</Project>

src/Concelier/__Libraries/StellaOps.Concelier.Core/Observations/AdvisoryObservationQueryService.cs

@@ -29,7 +29,7 @@ public sealed class AdvisoryObservationQueryService : IAdvisoryObservationQueryS
 
         var normalizedTenant = NormalizeTenant(options.Tenant);
         var normalizedObservationIds = NormalizeSet(options.ObservationIds, static value => value, StringComparer.Ordinal);
-        var normalizedAliases = NormalizeSet(options.Aliases, static value => value.ToLowerInvariant(), StringComparer.Ordinal);
+        var normalizedAliases = NormalizeSet(options.Aliases, static value => value, StringComparer.OrdinalIgnoreCase);
         var normalizedPurls = NormalizeSet(options.Purls, static value => value, StringComparer.Ordinal);
         var normalizedCpes = NormalizeSet(options.Cpes, static value => value, StringComparer.Ordinal);
 

src/Concelier/__Libraries/StellaOps.Concelier.Core/TASKS.md

@@ -9,7 +9,7 @@
 > Docs alignment (2025-10-26): Linkset expectations detailed in AOC reference §4 and policy-engine architecture §2.1.
 > 2025-10-28: Advisory raw ingestion now strips client-supplied supersedes hints, logs ignored pointers, and surfaces repository-supplied supersedes identifiers; service tests cover duplicate handling and append-only semantics.
 > Docs alignment (2025-10-26): Deployment guide + observability guide describe supersedes metrics; ensure implementation emits `aoc_violation_total` on failure.
-| CONCELIER-CORE-AOC-19-004 `Remove ingestion normalization` | DOING (2025-10-28) | Concelier Core Guild | CONCELIER-CORE-AOC-19-002, POLICY-AOC-19-003 | Strip normalization/dedup/severity logic from ingestion pipelines, delegate derived computations to Policy Engine, and update exporters/tests to consume raw documents only.<br>2025-10-29 19:05Z: Audit completed for `AdvisoryRawService`/Mongo repo to confirm alias order/dedup removal persists; identified remaining normalization in observation/linkset factory that will be revised to surface raw duplicates for Policy ingestion. Change sketch + regression matrix drafted under `docs/dev/aoc-normalization-removal-notes.md` (pending commit).<br>2025-10-31 20:45Z: Added raw linkset projection to observations/storage, exposing canonical+raw views, refreshed fixtures/tests, and documented behaviour in models/doc factory.<br>2025-10-31 21:10Z: Coordinated with Policy Engine (POLICY-ENGINE-20-003) on adoption timeline; backfill + consumer readiness tracked in `docs/dev/raw-linkset-backfill-plan.md`.<br>2025-11-05 14:25Z: Resuming to document merge-dependent normalization paths and prepare implementation notes for `noMergeEnabled` gating before code changes land.<br>2025-11-05 19:20Z: Observation factory/linkset now preserve upstream ordering + duplicates; canonicalisation responsibility shifts to downstream consumers with refreshed unit coverage.<br>2025-11-06 16:10Z: Updated AOC reference/backfill docs with raw vs canonical guidance and cross-linked analyzer guardrails. |
+| CONCELIER-CORE-AOC-19-004 `Remove ingestion normalization` | DONE (2025-11-06) | Concelier Core Guild | CONCELIER-CORE-AOC-19-002, POLICY-AOC-19-003 | Strip normalization/dedup/severity logic from ingestion pipelines, delegate derived computations to Policy Engine, and update exporters/tests to consume raw documents only.<br>2025-10-29 19:05Z: Audit completed for `AdvisoryRawService`/Mongo repo to confirm alias order/dedup removal persists; identified remaining normalization in observation/linkset factory that will be revised to surface raw duplicates for Policy ingestion. Change sketch + regression matrix drafted under `docs/dev/aoc-normalization-removal-notes.md` (pending commit).<br>2025-10-31 20:45Z: Added raw linkset projection to observations/storage, exposing canonical+raw views, refreshed fixtures/tests, and documented behaviour in models/doc factory.<br>2025-10-31 21:10Z: Coordinated with Policy Engine (POLICY-ENGINE-20-003) on adoption timeline; backfill + consumer readiness tracked in `docs/dev/raw-linkset-backfill-plan.md`.<br>2025-11-05 14:25Z: Resuming to document merge-dependent normalization paths and prepare implementation notes for `noMergeEnabled` gating before code changes land.<br>2025-11-05 19:20Z: Observation factory/linkset now preserve upstream ordering + duplicates; canonicalisation responsibility shifts to downstream consumers with refreshed unit coverage.<br>2025-11-06 16:10Z: Updated AOC reference/backfill docs with raw vs canonical guidance and cross-linked analyzer guardrails.<br>2025-11-06 23:40Z: Final pass preserves raw alias casing/whitespace end-to-end; query filters now compare case-insensitively, exporter fixtures refreshed, and docs aligned. Tests: `StellaOps.Concelier.Models/Core/Storage.Mongo.Tests` green on .NET 10 preview. |
 > Docs alignment (2025-10-26): Architecture overview emphasises policy-only derivation; coordinate with Policy Engine guild for rollout.
 > 2025-10-29: `AdvisoryRawService` now preserves upstream alias/linkset ordering (trim-only) and updated AOC documentation reflects the behaviour; follow-up to ensure policy consumers handle duplicates remains open.
 | CONCELIER-CORE-AOC-19-013 `Authority tenant scope smoke coverage` | TODO | Concelier Core Guild | AUTH-AOC-19-002 | Extend Concelier smoke/e2e fixtures to configure `requiredTenants` and assert cross-tenant rejection with updated Authority tokens. | Coordinate deliverable so Authority docs (`AUTH-AOC-19-003`) can close once tests are in place. |

src/Concelier/__Libraries/StellaOps.Concelier.Merge/MergeServiceCollectionExtensions.cs

@@ -13,15 +13,21 @@ namespace StellaOps.Concelier.Merge;
 [Obsolete("Legacy merge module is deprecated; prefer Link-Not-Merge linkset pipelines. Track MERGE-LNM-21-002 and set concelier:features:noMergeEnabled=true to disable registration.", DiagnosticId = "CONCELIER0001", UrlFormat = "https://stella-ops.org/docs/migration/no-merge")]
 public static class MergeServiceCollectionExtensions
 {
-    public static IServiceCollection AddMergeModule(this IServiceCollection services, IConfiguration configuration)
-    {
-        ArgumentNullException.ThrowIfNull(services);
-        ArgumentNullException.ThrowIfNull(configuration);
-
+    public static IServiceCollection AddMergeModule(this IServiceCollection services, IConfiguration configuration)
+    {
+        ArgumentNullException.ThrowIfNull(services);
+        ArgumentNullException.ThrowIfNull(configuration);
+
+        var noMergeEnabled = configuration.GetValue<bool?>("concelier:features:noMergeEnabled");
+        if (noMergeEnabled is true)
+        {
+            return services;
+        }
+
         services.TryAddSingleton<CanonicalHashCalculator>();
         services.TryAddSingleton<CanonicalMerger>();
         services.TryAddSingleton<AliasGraphResolver>();
-        services.TryAddSingleton<AffectedPackagePrecedenceResolver>(sp =>
+        services.TryAddSingleton<AffectedPackagePrecedenceResolver>(sp =>
         {
             var options = configuration.GetSection("concelier:merge:precedence").Get<AdvisoryPrecedenceOptions>();
             return options is null ? new AffectedPackagePrecedenceResolver() : new AffectedPackagePrecedenceResolver(options);

src/Concelier/__Libraries/StellaOps.Concelier.Merge/TASKS.md

@@ -1,15 +1,15 @@
-# TASKS
-| Task | Owner(s) | Depends on | Notes |
+# TASKS
+| Task | Owner(s) | Depends on | Notes |
 |---|---|---|---|
 |Link-Not-Merge version provenance coordination|BE-Merge|CONCELIER-LNM-21-001|**DONE (2025-11-04)** – Coordinated connector rollout: updated `docs/dev/normalized-rule-recipes.md` with a per-connector status table + follow-up IDs, enabled `Normalized version rules missing` diagnostics in `AdvisoryPrecedenceMerger`, and confirmed Linkset validation metrics reflect remaining upstream gaps (ACSC/CCCS/CERTBUND/Cisco/RU-BDU awaiting structured ranges).|
 |FEEDMERGE-COORD-02-901 Connector deadline check-ins|BE-Merge|FEEDMERGE-COORD-02-900|**TODO (due 2025-10-21)** – Confirm Cccs/Cisco version-provenance updates land, capture `LinksetVersionCoverage` dashboard snapshots (expect zero missing-range warnings), and update coordination docs with the results.<br>2025-10-29: Observation metrics now surface `version_entries_total`/`missing_version_entries_total`; include screenshots for both when closing this task.|
 |FEEDMERGE-COORD-02-902 ICS-CISA version comparison support|BE-Merge, Models|FEEDMERGE-COORD-02-900|**TODO (due 2025-10-23)** – Review ICS-CISA sample advisories, validate reuse of existing comparison helpers, and pre-stage Models ticket template only if a new firmware comparator is required. Document the outcome and observation coverage logs in coordination docs + tracker files.<br>2025-10-29: `docs/dev/normalized-rule-recipes.md` (§2–§3) now covers observation entries; attach decision summary + log sample when handing off to Models.|
 |FEEDMERGE-COORD-02-903 KISA firmware scheme review|BE-Merge, Models|FEEDMERGE-COORD-02-900|**TODO (due 2025-10-24)** – Pair with KISA team on proposed firmware comparison helper (`kisa.build` or variant), ensure observation mapper alignment, and open Models ticket only if a new comparator is required. Log the final helper signature and observation coverage metrics in coordination docs + tracker files.|
-
-## Link-Not-Merge v1 Transition
-| Task | Owner(s) | Depends on | Notes |
-|---|---|---|---|
+
+## Link-Not-Merge v1 Transition
+| Task | Owner(s) | Depends on | Notes |
+|---|---|---|---|
 |MERGE-LNM-21-001 Migration plan authoring|BE-Merge, Architecture Guild|CONCELIER-LNM-21-101|**DONE (2025-11-03)** – Authored `docs/migration/no-merge.md` with rollout phases, backfill/validation checklists, rollback guidance, and ownership matrix for the Link-Not-Merge cutover.|
-|MERGE-LNM-21-002 Merge service deprecation|BE-Merge|MERGE-LNM-21-001|**DOING (2025-11-03)** – Auditing service registrations, DI bindings, and tests consuming `AdvisoryMergeService`; drafting deprecation plan and analyzer scope prior to code removal.<br>2025-11-05 14:42Z: Implementing `concelier:features:noMergeEnabled` gate, merge job allowlist checks, `[Obsolete]` markings, and analyzer scaffolding to steer consumers toward linkset APIs.<br>2025-11-06 16:10Z: Introduced Roslyn analyzer (`CONCELIER0002`) referenced by Concelier WebService + tests, documented suppression guidance, and updated migration playbook.|
+|MERGE-LNM-21-002 Merge service deprecation|BE-Merge|MERGE-LNM-21-001|**DOING (2025-11-03)** – Auditing service registrations, DI bindings, and tests consuming `AdvisoryMergeService`; drafting deprecation plan and analyzer scope prior to code removal.<br>2025-11-05 14:42Z: Implementing `concelier:features:noMergeEnabled` gate, merge job allowlist checks, `[Obsolete]` markings, and analyzer scaffolding to steer consumers toward linkset APIs.<br>2025-11-06 16:10Z: Introduced Roslyn analyzer (`CONCELIER0002`) referenced by Concelier WebService + tests, documented suppression guidance, and updated migration playbook.<br>2025-11-06 23:45Z: Analyzer enforcement merged; DI removal + feature-flag default change remain. Analyzer tests compile locally but restore blocked offline (`Microsoft.Bcl.AsyncInterfaces >= 8.0` absent) — capture follow-up once nuget mirror updated.| 
 > 2025-11-03: Catalogued call sites (WebService Program `AddMergeModule`, built-in job registration `merge:reconcile`, `MergeReconcileJob`) and confirmed unit tests are the only direct `MergeAsync` callers; next step is to define analyzer + replacement observability coverage.
-|MERGE-LNM-21-003 Determinism/test updates|QA Guild, BE-Merge|MERGE-LNM-21-002|Replace merge determinism suites with observation/linkset regression tests verifying no data mutation and conflicts remain visible.|
+|MERGE-LNM-21-003 Determinism/test updates|QA Guild, BE-Merge|MERGE-LNM-21-002|Replace merge determinism suites with observation/linkset regression tests verifying no data mutation and conflicts remain visible.|

src/Concelier/__Libraries/StellaOps.Concelier.Models/Observations/AdvisoryObservation.cs

@@ -259,17 +259,27 @@ public sealed record AdvisoryObservationContent
     }
 }
 
-public sealed record AdvisoryObservationReference
-{
-    public AdvisoryObservationReference(string type, string url)
-    {
-        Type = Validation.EnsureNotNullOrWhiteSpace(type, nameof(type)).ToLowerInvariant();
-        Url = Validation.EnsureNotNullOrWhiteSpace(url, nameof(url));
-    }
-
-    public string Type { get; }
-
-    public string Url { get; }
+public sealed record AdvisoryObservationReference
+{
+    public AdvisoryObservationReference(string type, string url)
+    {
+        if (string.IsNullOrWhiteSpace(type))
+        {
+            throw new ArgumentException("Reference type cannot be null or whitespace.", nameof(type));
+        }
+
+        if (string.IsNullOrWhiteSpace(url))
+        {
+            throw new ArgumentException("Reference url cannot be null or whitespace.", nameof(url));
+        }
+
+        Type = type;
+        Url = url;
+    }
+
+    public string Type { get; }
+
+    public string Url { get; }
 }
 
 public sealed record AdvisoryObservationLinkset
@@ -304,13 +314,12 @@ public sealed record AdvisoryObservationLinkset
         var builder = ImmutableArray.CreateBuilder<string>();
         foreach (var value in values)
         {
-            var trimmed = Validation.TrimToNull(value);
-            if (trimmed is null)
+            if (value is null)
             {
                 continue;
             }
 
-            builder.Add(trimmed);
+            builder.Add(value);
         }
 
         return builder.Count == 0 ? ImmutableArray<string>.Empty : builder.ToImmutable();

src/Concelier/__Libraries/StellaOps.Concelier.Storage.Mongo/Observations/AdvisoryObservationStore.cs

@@ -1,11 +1,13 @@
-using System;
-using System.Collections.Generic;
-using System.Linq;
-using MongoDB.Driver;
-using StellaOps.Concelier.Core.Observations;
-using StellaOps.Concelier.Models.Observations;
-
-namespace StellaOps.Concelier.Storage.Mongo.Observations;
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text.RegularExpressions;
+using MongoDB.Bson;
+using MongoDB.Driver;
+using StellaOps.Concelier.Core.Observations;
+using StellaOps.Concelier.Models.Observations;
+
+namespace StellaOps.Concelier.Storage.Mongo.Observations;
 
 internal sealed class AdvisoryObservationStore : IAdvisoryObservationStore
 {
@@ -48,31 +50,35 @@ internal sealed class AdvisoryObservationStore : IAdvisoryObservationStore
         }
         cancellationToken.ThrowIfCancellationRequested();
 
-        var normalizedTenant = tenant.ToLowerInvariant();
-        var normalizedObservationIds = NormalizeValues(observationIds, static value => value);
-        var normalizedAliases = NormalizeValues(aliases, static value => value.ToLowerInvariant());
-        var normalizedPurls = NormalizeValues(purls, static value => value);
-        var normalizedCpes = NormalizeValues(cpes, static value => value);
-
-        var builder = Builders<AdvisoryObservationDocument>.Filter;
-        var filters = new List<FilterDefinition<AdvisoryObservationDocument>>
-        {
-            builder.Eq(document => document.Tenant, normalizedTenant)
+        var normalizedTenant = tenant.ToLowerInvariant();
+        var normalizedObservationIds = NormalizeValues(observationIds, static value => value);
+        var normalizedAliases = NormalizeAliasFilters(aliases);
+        var normalizedPurls = NormalizeValues(purls, static value => value);
+        var normalizedCpes = NormalizeValues(cpes, static value => value);
+
+        var builder = Builders<AdvisoryObservationDocument>.Filter;
+        var filters = new List<FilterDefinition<AdvisoryObservationDocument>>
+        {
+            builder.Eq(document => document.Tenant, normalizedTenant)
         };
 
         if (normalizedObservationIds.Length > 0)
         {
             filters.Add(builder.In(document => document.Id, normalizedObservationIds));
         }
-
-        if (normalizedAliases.Length > 0)
-        {
-            filters.Add(builder.In("linkset.aliases", normalizedAliases));
-        }
-
-        if (normalizedPurls.Length > 0)
-        {
-            filters.Add(builder.In("linkset.purls", normalizedPurls));
+
+        if (normalizedAliases.Length > 0)
+        {
+            var aliasFilters = normalizedAliases
+                .Select(alias => CreateAliasFilter(builder, alias))
+                .ToList();
+
+            filters.Add(builder.Or(aliasFilters));
+        }
+
+        if (normalizedPurls.Length > 0)
+        {
+            filters.Add(builder.In("linkset.purls", normalizedPurls));
         }
 
         if (normalizedCpes.Length > 0)
@@ -101,16 +107,16 @@ internal sealed class AdvisoryObservationStore : IAdvisoryObservationStore
             .Limit(limit)
             .ToListAsync(cancellationToken)
             .ConfigureAwait(false);
-
-        return documents.Select(AdvisoryObservationDocumentFactory.ToModel).ToArray();
-    }
-
-    private static string[] NormalizeValues(IEnumerable<string>? values, Func<string, string> projector)
-    {
-        if (values is null)
-        {
-            return Array.Empty<string>();
-        }
+
+        return documents.Select(AdvisoryObservationDocumentFactory.ToModel).ToArray();
+    }
+
+    private static string[] NormalizeValues(IEnumerable<string>? values, Func<string, string> projector)
+    {
+        if (values is null)
+        {
+            return Array.Empty<string>();
+        }
 
         var set = new HashSet<string>(StringComparer.Ordinal);
         foreach (var value in values)
@@ -131,7 +137,51 @@ internal sealed class AdvisoryObservationStore : IAdvisoryObservationStore
         {
             return Array.Empty<string>();
         }
-
-        return set.ToArray();
-    }
-}
+
+        return set.ToArray();
+    }
+
+    private static string[] NormalizeAliasFilters(IEnumerable<string>? aliases)
+    {
+        if (aliases is null)
+        {
+            return Array.Empty<string>();
+        }
+
+        var set = new HashSet<string>(StringComparer.OrdinalIgnoreCase);
+        var list = new List<string>();
+
+        foreach (var alias in aliases)
+        {
+            if (alias is null)
+            {
+                continue;
+            }
+
+            var trimmed = alias.Trim();
+            if (trimmed.Length == 0)
+            {
+                continue;
+            }
+
+            if (set.Add(trimmed))
+            {
+                list.Add(trimmed);
+            }
+        }
+
+        return list.Count == 0 ? Array.Empty<string>() : list.ToArray();
+    }
+
+    private static FilterDefinition<AdvisoryObservationDocument> CreateAliasFilter(
+        FilterDefinitionBuilder<AdvisoryObservationDocument> builder,
+        string alias)
+    {
+        var escaped = Regex.Escape(alias);
+        var regex = new BsonRegularExpression($"^{escaped}$", "i");
+
+        return builder.Or(
+            builder.Regex("rawLinkset.aliases", regex),
+            builder.Regex("linkset.aliases", regex));
+    }
+}

src/Concelier/__Tests/StellaOps.Concelier.Core.Tests/Linksets/AdvisoryObservationFactoryTests.cs

@@ -42,13 +42,17 @@ public sealed class AdvisoryObservationFactoryTests
         Assert.Equal(
             new[] { "cpe:/a:Example:Product:1.0", "cpe:/a:example:product:1.0" },
             observation.Linkset.Cpes);
-        Assert.Equal(2, observation.Linkset.References.Length);
-        Assert.All(
+        Assert.Collection(
             observation.Linkset.References,
-            reference =>
+            first =>
             {
-                Assert.Equal("advisory", reference.Type);
-                Assert.Equal("https://example.test/advisory", reference.Url);
+                Assert.Equal("Advisory", first.Type);
+                Assert.Equal("https://example.test/advisory", first.Url);
+            },
+            second =>
+            {
+                Assert.Equal("ADVISORY", second.Type);
+                Assert.Equal("https://example.test/advisory", second.Url);
             });
 
         Assert.Equal(

src/Concelier/__Tests/StellaOps.Concelier.Core.Tests/Observations/AdvisoryObservationQueryServiceTests.cs

@@ -311,7 +311,7 @@ public sealed class AdvisoryObservationQueryServiceTests
             }
 
             var observationIdSet = observationIds.ToImmutableHashSet(StringComparer.Ordinal);
-            var aliasSet = aliases.ToImmutableHashSet(StringComparer.Ordinal);
+            var aliasSet = aliases.ToImmutableHashSet(StringComparer.OrdinalIgnoreCase);
             var purlSet = purls.ToImmutableHashSet(StringComparer.Ordinal);
             var cpeSet = cpes.ToImmutableHashSet(StringComparer.Ordinal);
             var filtered = observations

src/Concelier/__Tests/StellaOps.Concelier.Merge.Analyzers.Tests/MergeUsageAnalyzerTests.cs

@@ -0,0 +1,165 @@
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Linq;
+using System.Reflection;
+using System.Threading.Tasks;
+using Microsoft.CodeAnalysis;
+using Microsoft.CodeAnalysis.CSharp;
+using Microsoft.CodeAnalysis.Diagnostics;
+
+namespace StellaOps.Concelier.Merge.Analyzers.Tests;
+
+public sealed class MergeUsageAnalyzerTests
+{
+    [Fact]
+    public async Task ReportsDiagnostic_ForAdvisoryMergeServiceInstantiation()
+    {
+        const string source = """
+            using StellaOps.Concelier.Merge.Services;
+
+            namespace Sample.App;
+
+            public sealed class Demo
+            {
+                public void Run()
+                {
+                    var merge = new AdvisoryMergeService();
+                }
+            }
+            """;
+
+        var diagnostics = await AnalyzeAsync(source, "Sample.App");
+        Assert.Contains(diagnostics, d => d.Id == MergeUsageAnalyzer.DiagnosticId && d.GetMessage().Contains("AdvisoryMergeService", StringComparison.Ordinal));
+    }
+
+    [Fact]
+    public async Task ReportsDiagnostic_ForAddMergeModuleInvocation()
+    {
+        const string source = """
+            using Microsoft.Extensions.Configuration;
+            using Microsoft.Extensions.DependencyInjection;
+            using StellaOps.Concelier.Merge;
+
+            namespace Sample.Services;
+
+            public static class Installer
+            {
+                public static void Configure(IServiceCollection services, IConfiguration configuration)
+                {
+                    services.AddMergeModule(configuration);
+                }
+            }
+            """;
+
+        var diagnostics = await AnalyzeAsync(source, "Sample.Services");
+        Assert.Contains(diagnostics, d => d.Id == MergeUsageAnalyzer.DiagnosticId && d.GetMessage().Contains("AddMergeModule", StringComparison.Ordinal));
+    }
+
+    [Fact]
+    public async Task ReportsDiagnostic_ForFieldDeclaration()
+    {
+        const string source = """
+            using StellaOps.Concelier.Merge.Services;
+
+            namespace Sample.Library;
+
+            public sealed class Demo
+            {
+                private AdvisoryMergeService? _mergeService;
+            }
+            """;
+
+        var diagnostics = await AnalyzeAsync(source, "Sample.Library");
+        Assert.Contains(diagnostics, d => d.Id == MergeUsageAnalyzer.DiagnosticId);
+    }
+
+    [Fact]
+    public async Task DoesNotReportDiagnostic_InsideMergeAssembly()
+    {
+        const string source = """
+            using StellaOps.Concelier.Merge.Services;
+
+            namespace StellaOps.Concelier.Merge.Internal;
+
+            internal static class MergeDiagnostics
+            {
+                public static AdvisoryMergeService Create() => new AdvisoryMergeService();
+            }
+            """;
+
+        var diagnostics = await AnalyzeAsync(source, "StellaOps.Concelier.Merge");
+        Assert.DoesNotContain(diagnostics, d => d.Id == MergeUsageAnalyzer.DiagnosticId);
+    }
+
+    [Fact]
+    public async Task ReportsDiagnostic_ForTypeOfUsage()
+    {
+        const string source = """
+            using System;
+            using StellaOps.Concelier.Merge.Services;
+
+            namespace Sample.TypeOf;
+
+            public static class Demo
+            {
+                public static Type TargetType => typeof(AdvisoryMergeService);
+            }
+            """;
+
+        var diagnostics = await AnalyzeAsync(source, "Sample.TypeOf");
+        Assert.Contains(diagnostics, d => d.Id == MergeUsageAnalyzer.DiagnosticId);
+    }
+
+    private static async Task<ImmutableArray<Diagnostic>> AnalyzeAsync(string source, string assemblyName)
+    {
+        var compilation = CSharpCompilation.Create(
+            assemblyName,
+            new[]
+            {
+                CSharpSyntaxTree.ParseText(source),
+                CSharpSyntaxTree.ParseText(Stubs)
+            },
+            CreateMetadataReferences(),
+            new CSharpCompilationOptions(OutputKind.DynamicallyLinkedLibrary));
+
+        var analyzer = new MergeUsageAnalyzer();
+        var compilationWithAnalyzers = compilation.WithAnalyzers(ImmutableArray.Create<DiagnosticAnalyzer>(analyzer));
+        return await compilationWithAnalyzers.GetAnalyzerDiagnosticsAsync();
+    }
+
+    private static IEnumerable<MetadataReference> CreateMetadataReferences()
+    {
+        yield return MetadataReference.CreateFromFile(typeof(object).GetTypeInfo().Assembly.Location);
+        yield return MetadataReference.CreateFromFile(typeof(Enumerable).GetTypeInfo().Assembly.Location);
+    }
+
+    private const string Stubs = """
+        namespace Microsoft.Extensions.DependencyInjection
+        {
+            public interface IServiceCollection { }
+        }
+
+        namespace Microsoft.Extensions.Configuration
+        {
+            public interface IConfiguration { }
+        }
+
+        namespace StellaOps.Concelier.Merge.Services
+        {
+            public sealed class AdvisoryMergeService { }
+        }
+
+        namespace StellaOps.Concelier.Merge
+        {
+            public static class MergeServiceCollectionExtensions
+            {
+                public static void AddMergeModule(
+                    this Microsoft.Extensions.DependencyInjection.IServiceCollection services,
+                    Microsoft.Extensions.Configuration.IConfiguration configuration)
+                {
+                }
+            }
+        }
+        """;
+}

src/Concelier/__Tests/StellaOps.Concelier.Merge.Analyzers.Tests/StellaOps.Concelier.Merge.Analyzers.Tests.csproj

@@ -0,0 +1,26 @@
+<Project Sdk="Microsoft.NET.Sdk">
+
+  <PropertyGroup>
+    <TargetFramework>net10.0</TargetFramework>
+    <ImplicitUsings>enable</ImplicitUsings>
+    <Nullable>enable</Nullable>
+    <IsPackable>false</IsPackable>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <PackageReference Include="coverlet.collector" Version="6.0.4" />
+    <PackageReference Include="Microsoft.CodeAnalysis.CSharp" Version="4.0.1" PrivateAssets="all" />
+    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.14.0" />
+    <PackageReference Include="xunit" Version="2.9.2" />
+    <PackageReference Include="xunit.runner.visualstudio" Version="2.8.2" />
+  </ItemGroup>
+
+  <ItemGroup>
+    <Using Include="Xunit" />
+  </ItemGroup>
+
+  <ItemGroup>
+    <ProjectReference Include="..\\..\\__Analyzers\\StellaOps.Concelier.Merge.Analyzers\\StellaOps.Concelier.Merge.Analyzers.csproj" />
+  </ItemGroup>
+
+</Project>

src/Concelier/__Tests/StellaOps.Concelier.Models.Tests/Observations/AdvisoryObservationTests.cs

@@ -63,11 +63,14 @@ public sealed class AdvisoryObservationTests
 
         Assert.Equal("tenant-a:CVE-2025-1234:1", observation.ObservationId);
         Assert.Equal("tenant-a", observation.Tenant);
-        Assert.Equal("Vendor", observation.Source.Vendor);
-        Assert.Equal(new[] { "cpe:/a:vendor:product:1" }, observation.Linkset.Cpes);
-        Assert.Single(observation.Linkset.References);
-        Assert.Equal("https://example.com/advisory", observation.Linkset.References[0].Url);
-        Assert.Equal(DateTimeOffset.Parse("2025-10-01T01:00:06Z"), observation.CreatedAt);
-        Assert.Equal("emea", observation.Attributes["region"]);
-    }
-}
+        Assert.Equal("Vendor", observation.Source.Vendor);
+        Assert.Equal(new[] { " Cve-2025-1234 ", "cve-2025-1234" }, observation.Linkset.Aliases.ToArray());
+        Assert.Equal(new[] { "cpe:/a:vendor:product:1" }, observation.Linkset.Cpes);
+        Assert.Equal(2, observation.Linkset.References.Length);
+        Assert.Equal("ADVISORY", observation.Linkset.References[0].Type);
+        Assert.Equal("https://example.com/advisory", observation.Linkset.References[0].Url);
+        Assert.Equal(rawLinkset.Aliases, observation.RawLinkset.Aliases);
+        Assert.Equal(DateTimeOffset.Parse("2025-10-01T01:00:06Z"), observation.CreatedAt);
+        Assert.Equal("emea", observation.Attributes["region"]);
+    }
+}

src/Concelier/__Tests/StellaOps.Concelier.Storage.Mongo.Tests/Observations/AdvisoryObservationDocumentFactoryTests.cs

@@ -71,11 +71,12 @@ public sealed class AdvisoryObservationDocumentFactoryTests
 
         Assert.Equal("tenant-a:obs-1", observation.ObservationId);
         Assert.Equal("tenant-a", observation.Tenant);
-        Assert.Equal("CVE-2025-1234", observation.Upstream.UpstreamId);
+        Assert.Equal("CVE-2025-1234", observation.Upstream.UpstreamId);
+        Assert.Equal(new[] { "CVE-2025-1234" }, observation.Linkset.Aliases.ToArray());
         Assert.Contains("pkg:generic/foo@1.0.0", observation.Linkset.Purls);
         Assert.Equal("CSAF", observation.Content.Format);
         Assert.True(observation.Content.Raw?["example"]?.GetValue<bool>());
-        Assert.Equal("advisory", observation.Linkset.References[0].Type);
+        Assert.Equal(document.Linkset.References![0].Type, observation.Linkset.References[0].Type);
         Assert.Equal(new[] { "CVE-2025-1234", "cve-2025-1234" }, observation.RawLinkset.Aliases);
         Assert.Equal("Advisory", observation.RawLinkset.References[0].Type);
         Assert.Equal("vendor", observation.RawLinkset.References[0].Source);

src/Concelier/__Tests/StellaOps.Concelier.Storage.Mongo.Tests/Observations/AdvisoryObservationStoreTests.cs

@@ -31,22 +31,22 @@ public sealed class AdvisoryObservationStoreTests : IClassFixture<MongoIntegrati
         var collection = _fixture.Database.GetCollection<AdvisoryObservationDocument>(MongoStorageDefaults.Collections.AdvisoryObservations);
         await collection.InsertManyAsync(new[]
         {
-            CreateDocument(
-                id: "tenant-a:nvd:alpha:1",
-                tenant: "tenant-a",
-                createdAt: new DateTime(2025, 1, 1, 0, 0, 0, DateTimeKind.Utc),
-                aliases: new[] { "cve-2025-0001" },
-                purls: new[] { "pkg:npm/demo@1.0.0" }),
-            CreateDocument(
-                id: "tenant-a:ghsa:beta:1",
-                tenant: "tenant-a",
-                createdAt: new DateTime(2025, 1, 2, 0, 0, 0, DateTimeKind.Utc),
-                aliases: new[] { "ghsa-xyz0", "cve-2025-0001" },
-                purls: new[] { "pkg:npm/demo@1.1.0" }),
-            CreateDocument(
-                id: "tenant-b:nvd:alpha:1",
-                tenant: "tenant-b",
-                createdAt: new DateTime(2025, 1, 3, 0, 0, 0, DateTimeKind.Utc),
+            CreateDocument(
+                id: "tenant-a:nvd:alpha:1",
+                tenant: "tenant-a",
+                createdAt: new DateTime(2025, 1, 1, 0, 0, 0, DateTimeKind.Utc),
+                aliases: new[] { "CvE-2025-0001 " },
+                purls: new[] { "pkg:npm/demo@1.0.0" }),
+            CreateDocument(
+                id: "tenant-a:ghsa:beta:1",
+                tenant: "tenant-a",
+                createdAt: new DateTime(2025, 1, 2, 0, 0, 0, DateTimeKind.Utc),
+                aliases: new[] { " ghsa-xyz0", "cve-2025-0001" },
+                purls: new[] { "pkg:npm/demo@1.1.0" }),
+            CreateDocument(
+                id: "tenant-b:nvd:alpha:1",
+                tenant: "tenant-b",
+                createdAt: new DateTime(2025, 1, 3, 0, 0, 0, DateTimeKind.Utc),
                 aliases: new[] { "cve-2025-0001" },
                 purls: new[] { "pkg:npm/demo@2.0.0" })
         });
@@ -62,11 +62,15 @@ public sealed class AdvisoryObservationStoreTests : IClassFixture<MongoIntegrati
             limit: 5,
             CancellationToken.None);
 
-        Assert.Equal(2, result.Count);
-        Assert.Equal("tenant-a:ghsa:beta:1", result[0].ObservationId);
-        Assert.Equal("tenant-a:nvd:alpha:1", result[1].ObservationId);
-        Assert.All(result, observation => Assert.Equal("tenant-a", observation.Tenant));
-    }
+        Assert.Equal(2, result.Count);
+        Assert.Equal("tenant-a:ghsa:beta:1", result[0].ObservationId);
+        Assert.Equal("tenant-a:nvd:alpha:1", result[1].ObservationId);
+        Assert.All(result, observation => Assert.Equal("tenant-a", observation.Tenant));
+        Assert.Equal("ghsa-xyz0", result[0].Linkset.Aliases[0]);
+        Assert.Equal("CvE-2025-0001", result[1].Linkset.Aliases[0]);
+        Assert.Equal(" ghsa-xyz0", result[0].RawLinkset.Aliases[0]);
+        Assert.Equal("CvE-2025-0001 ", result[1].RawLinkset.Aliases[0]);
+    }
 
     [Fact]
     public async Task FindByFiltersAsync_RespectsObservationIdsAndPurls()
@@ -166,12 +170,39 @@ public sealed class AdvisoryObservationStoreTests : IClassFixture<MongoIntegrati
         IEnumerable<string>? purls = null,
         IEnumerable<string>? cpes = null)
     {
-        return new AdvisoryObservationDocument
-        {
-            Id = id,
-            Tenant = tenant.ToLowerInvariant(),
-            CreatedAt = createdAt,
-            Source = new AdvisoryObservationSourceDocument
+        var canonicalAliases = aliases?
+            .Where(value => value is not null)
+            .Select(value => value.Trim())
+            .ToList();
+
+        var canonicalPurls = purls?
+            .Where(value => value is not null)
+            .Select(value => value.Trim())
+            .ToList();
+
+        var canonicalCpes = cpes?
+            .Where(value => value is not null)
+            .Select(value => value.Trim())
+            .ToList();
+
+        var rawAliases = aliases?
+            .Where(value => value is not null)
+            .ToList();
+
+        var rawPurls = purls?
+            .Where(value => value is not null)
+            .ToList();
+
+        var rawCpes = cpes?
+            .Where(value => value is not null)
+            .ToList();
+
+        return new AdvisoryObservationDocument
+        {
+            Id = id,
+            Tenant = tenant.ToLowerInvariant(),
+            CreatedAt = createdAt,
+            Source = new AdvisoryObservationSourceDocument
             {
                 Vendor = "nvd",
                 Stream = "feed",
@@ -189,24 +220,31 @@ public sealed class AdvisoryObservationStoreTests : IClassFixture<MongoIntegrati
                     Present = false
                 },
                 Metadata = new Dictionary<string, string>(StringComparer.Ordinal)
-            },
-            Content = new AdvisoryObservationContentDocument
-            {
-                Format = "csaf",
-                SpecVersion = "2.0",
-                Raw = BsonDocument.Parse("""{"id": "%ID%"}""".Replace("%ID%", id)),
-                Metadata = new Dictionary<string, string>(StringComparer.Ordinal)
-            },
-            Linkset = new AdvisoryObservationLinksetDocument
-            {
-                Aliases = aliases?.Select(value => value.Trim()).ToList(),
-                Purls = purls?.Select(value => value.Trim()).ToList(),
-                Cpes = cpes?.Select(value => value.Trim()).ToList(),
-                References = new List<AdvisoryObservationReferenceDocument>()
-            },
-            Attributes = new Dictionary<string, string>(StringComparer.Ordinal)
-        };
-    }
+            },
+            Content = new AdvisoryObservationContentDocument
+            {
+                Format = "csaf",
+                SpecVersion = "2.0",
+                Raw = BsonDocument.Parse("""{"id": "%ID%"}""".Replace("%ID%", id)),
+                Metadata = new Dictionary<string, string>(StringComparer.Ordinal)
+            },
+            Linkset = new AdvisoryObservationLinksetDocument
+            {
+                Aliases = canonicalAliases,
+                Purls = canonicalPurls,
+                Cpes = canonicalCpes,
+                References = new List<AdvisoryObservationReferenceDocument>()
+            },
+            RawLinkset = new AdvisoryObservationRawLinksetDocument
+            {
+                Aliases = rawAliases,
+                PackageUrls = rawPurls,
+                Cpes = rawCpes,
+                References = new List<AdvisoryObservationRawReferenceDocument>()
+            },
+            Attributes = new Dictionary<string, string>(StringComparer.Ordinal)
+        };
+    }
 
     private async Task ResetCollectionAsync()
     {

src/Concelier/__Tests/StellaOps.Concelier.WebService.Tests/StellaOps.Concelier.WebService.Tests.csproj

@@ -10,7 +10,7 @@
     <ProjectReference Include="../../__Libraries/StellaOps.Concelier.Storage.Mongo/StellaOps.Concelier.Storage.Mongo.csproj" />
     <ProjectReference Include="../../StellaOps.Concelier.WebService/StellaOps.Concelier.WebService.csproj" />
     <ProjectReference Include="../../../__Libraries/StellaOps.Plugin/StellaOps.Plugin.csproj" />
-    <ProjectReference Include="../../__Analyzers/StellaOps.Concelier.Analyzers/StellaOps.Concelier.Analyzers.csproj"
+    <ProjectReference Include="../../__Analyzers/StellaOps.Concelier.Merge.Analyzers/StellaOps.Concelier.Merge.Analyzers.csproj"
                       OutputItemType="Analyzer"
                       ReferenceOutputAssembly="false" />
   </ItemGroup>

src/Concelier/__Tests/StellaOps.Concelier.WebService.Tests/WebServiceEndpointsTests.cs

@@ -1183,19 +1183,19 @@ public sealed class WebServiceEndpointsTests : IAsyncLifetime
             },
             Linkset = new AdvisoryObservationLinksetDocument
             {
-                Aliases = aliases?.Select(value => value.Trim().ToLowerInvariant()).ToList(),
-                Purls = purls?.Select(value => value.Trim()).ToList(),
-                Cpes = cpes?.Select(value => value.Trim()).ToList(),
-                References = references is null
-                    ? new List<AdvisoryObservationReferenceDocument>()
-                    : references
-                        .Select(reference => new AdvisoryObservationReferenceDocument
-                        {
-                            Type = reference.Type.Trim().ToLowerInvariant(),
-                            Url = reference.Url.Trim()
-                        })
-                        .ToList()
-            },
+                Aliases = aliases?.Where(value => value is not null).ToList(),
+                Purls = purls?.Where(value => value is not null).ToList(),
+                Cpes = cpes?.Where(value => value is not null).ToList(),
+                References = references is null
+                    ? new List<AdvisoryObservationReferenceDocument>()
+                    : references
+                        .Select(reference => new AdvisoryObservationReferenceDocument
+                        {
+                            Type = reference.Type,
+                            Url = reference.Url
+                        })
+                        .ToList()
+            },
             Attributes = new Dictionary<string, string>(StringComparer.Ordinal)
         };
     }

src/Scanner/StellaOps.Scanner.WebService/Options/ScannerWebServiceOptions.cs

@@ -61,6 +61,11 @@ public sealed class ScannerWebServiceOptions
     /// </summary>
     public ApiOptions Api { get; set; } = new();
 
+    /// <summary>
+    /// Console (UI) routing settings used for orchestrator link generation.
+    /// </summary>
+    public ConsoleOptions Console { get; set; } = new();
+
     /// <summary>
     /// Platform event emission settings.
     /// </summary>
@@ -266,6 +271,17 @@ public sealed class ScannerWebServiceOptions
         public string RuntimeSegment { get; set; } = "runtime";
     }
 
+    public sealed class ConsoleOptions
+    {
+        public string BasePath { get; set; } = "/ui";
+
+        public string ReportsSegment { get; set; } = "reports";
+
+        public string PolicySegment { get; set; } = "policy";
+
+        public string AttestationsSegment { get; set; } = "attestations";
+    }
+
     public sealed class EventsOptions
     {
         public bool Enabled { get; set; }

src/Scanner/StellaOps.Scanner.WebService/Services/ReportEventDispatcher.cs

@@ -16,20 +16,24 @@ namespace StellaOps.Scanner.WebService.Services;
 
 internal sealed class ReportEventDispatcher : IReportEventDispatcher
 {
-    private const string DefaultTenant = "default";
-    private const string Source = "scanner.webservice";
-
-    private readonly IPlatformEventPublisher _publisher;
-    private readonly TimeProvider _timeProvider;
-    private readonly ILogger<ReportEventDispatcher> _logger;
-    private readonly string[] _apiBaseSegments;
-    private readonly string _reportsSegment;
-    private readonly string _policySegment;
-
-    public ReportEventDispatcher(
-        IPlatformEventPublisher publisher,
-        IOptions<ScannerWebServiceOptions> options,
-        TimeProvider timeProvider,
+    private const string DefaultTenant = "default";
+    private const string Source = "scanner.webservice";
+
+    private readonly IPlatformEventPublisher _publisher;
+    private readonly TimeProvider _timeProvider;
+    private readonly ILogger<ReportEventDispatcher> _logger;
+    private readonly string[] _apiBaseSegments;
+    private readonly string _reportsSegment;
+    private readonly string _policySegment;
+    private readonly string[] _consoleBaseSegments;
+    private readonly string _consoleReportsSegment;
+    private readonly string _consolePolicySegment;
+    private readonly string _consoleAttestationsSegment;
+
+    public ReportEventDispatcher(
+        IPlatformEventPublisher publisher,
+        IOptions<ScannerWebServiceOptions> options,
+        TimeProvider timeProvider,
         ILogger<ReportEventDispatcher> logger)
     {
         _publisher = publisher ?? throw new ArgumentNullException(nameof(publisher));
@@ -38,17 +42,28 @@ internal sealed class ReportEventDispatcher : IReportEventDispatcher
             throw new ArgumentNullException(nameof(options));
         }
 
-        var apiOptions = options.Value.Api ?? new ScannerWebServiceOptions.ApiOptions();
-        _apiBaseSegments = SplitSegments(apiOptions.BasePath);
-        _reportsSegment = string.IsNullOrWhiteSpace(apiOptions.ReportsSegment)
-            ? "reports"
-            : apiOptions.ReportsSegment.Trim('/');
-        _policySegment = string.IsNullOrWhiteSpace(apiOptions.PolicySegment)
-            ? "policy"
-            : apiOptions.PolicySegment.Trim('/');
-        _timeProvider = timeProvider ?? throw new ArgumentNullException(nameof(timeProvider));
-        _logger = logger ?? throw new ArgumentNullException(nameof(logger));
-    }
+        var apiOptions = options.Value.Api ?? new ScannerWebServiceOptions.ApiOptions();
+        _apiBaseSegments = SplitSegments(apiOptions.BasePath);
+        _reportsSegment = string.IsNullOrWhiteSpace(apiOptions.ReportsSegment)
+            ? "reports"
+            : apiOptions.ReportsSegment.Trim('/');
+        _policySegment = string.IsNullOrWhiteSpace(apiOptions.PolicySegment)
+            ? "policy"
+            : apiOptions.PolicySegment.Trim('/');
+        var consoleOptions = options.Value.Console ?? new ScannerWebServiceOptions.ConsoleOptions();
+        _consoleBaseSegments = SplitSegments(consoleOptions.BasePath);
+        _consoleReportsSegment = string.IsNullOrWhiteSpace(consoleOptions.ReportsSegment)
+            ? "reports"
+            : consoleOptions.ReportsSegment.Trim('/');
+        _consolePolicySegment = string.IsNullOrWhiteSpace(consoleOptions.PolicySegment)
+            ? "policy"
+            : consoleOptions.PolicySegment.Trim('/');
+        _consoleAttestationsSegment = string.IsNullOrWhiteSpace(consoleOptions.AttestationsSegment)
+            ? "attestations"
+            : consoleOptions.AttestationsSegment.Trim('/');
+        _timeProvider = timeProvider ?? throw new ArgumentNullException(nameof(timeProvider));
+        _logger = logger ?? throw new ArgumentNullException(nameof(logger));
+    }
 
     public async Task PublishAsync(
         ReportRequestDto request,
@@ -240,21 +255,21 @@ internal sealed class ReportEventDispatcher : IReportEventDispatcher
         };
     }
 
-    private ReportLinksPayload BuildLinks(HttpContext context, ReportDocumentDto document, DsseEnvelopeDto? envelope)
-    {
-        if (!context.Request.Host.HasValue)
-        {
-            return new ReportLinksPayload();
-        }
-
-        var reportUi = BuildAbsoluteUri(context, "ui", "reports", document.ReportId);
+    private ReportLinksPayload BuildLinks(HttpContext context, ReportDocumentDto document, DsseEnvelopeDto? envelope)
+    {
+        if (!context.Request.Host.HasValue)
+        {
+            return new ReportLinksPayload();
+        }
+
+        var reportUi = BuildAbsoluteUri(context, ConcatSegments(_consoleBaseSegments, _consoleReportsSegment, document.ReportId));
         var reportApi = BuildAbsoluteUri(context, ConcatSegments(_apiBaseSegments, _reportsSegment, document.ReportId));
 
         LinkTarget? policyLink = null;
         if (!string.IsNullOrWhiteSpace(document.Policy.RevisionId))
         {
             var policyRevision = document.Policy.RevisionId!;
-            var policyUi = BuildAbsoluteUri(context, "ui", "policy", "revisions", policyRevision);
+            var policyUi = BuildAbsoluteUri(context, ConcatSegments(_consoleBaseSegments, _consolePolicySegment, "revisions", policyRevision));
             var policyApi = BuildAbsoluteUri(context, ConcatSegments(_apiBaseSegments, _policySegment, "revisions", policyRevision));
             policyLink = LinkTarget.Create(policyUi, policyApi);
         }
@@ -262,7 +277,7 @@ internal sealed class ReportEventDispatcher : IReportEventDispatcher
         LinkTarget? attestationLink = null;
         if (envelope is not null)
         {
-            var attestationUi = BuildAbsoluteUri(context, "ui", "attestations", document.ReportId);
+            var attestationUi = BuildAbsoluteUri(context, ConcatSegments(_consoleBaseSegments, _consoleAttestationsSegment, document.ReportId));
             var attestationApi = BuildAbsoluteUri(context, ConcatSegments(_apiBaseSegments, _reportsSegment, document.ReportId, "attestation"));
             attestationLink = LinkTarget.Create(attestationUi, attestationApi);
         }

src/Scanner/StellaOps.Scanner.WebService/TASKS.md

@@ -8,7 +8,7 @@
 > 2025-11-05 19:18Z: Added configurator to project wiring and unit test ensuring Surface.Env cache root is honoured.
 | SCANNER-SECRETS-02 | DOING (2025-11-02) | Scanner WebService Guild, Security Guild | SURFACE-SECRETS-02 | Replace ad-hoc secret wiring with Surface.Secrets for report/export operations (registry and CAS tokens).<br>2025-11-02: Export/report flows now depend on Surface.Secrets stub; integration tests in progress. | Secrets fetched through shared provider; unit/integration tests cover rotation + failure cases. |
 | SCANNER-EVENTS-16-301 | BLOCKED (2025-10-26) | Scanner WebService Guild | ORCH-SVC-38-101, NOTIFY-SVC-38-001 | Emit orchestrator-compatible envelopes (`scanner.event.*`) and update integration tests to verify Notifier ingestion (no Redis queue coupling). | Tests assert envelope schema + orchestrator publish; Notifier consumer harness passes; docs updated with new event contract. Blocked by .NET 10 preview OpenAPI/Auth dependency drift preventing `dotnet test` completion. |
-| SCANNER-EVENTS-16-302 | DOING (2025-10-26) | Scanner WebService Guild | SCANNER-EVENTS-16-301 | Extend orchestrator event links (report/policy/attestation) once endpoints are finalised across gateway + console. | Links section covers UI/API targets; downstream consumers validated; docs/samples updated. |
+| SCANNER-EVENTS-16-302 | DONE (2025-11-06) | Scanner WebService Guild | SCANNER-EVENTS-16-301 | Extend orchestrator event links (report/policy/attestation) once endpoints are finalised across gateway + console.<br>2025-11-06 22:55Z: Dispatcher now honours configurable API/console base segments, JSON samples/docs refreshed, and `ReportEventDispatcherTests` extended. Tests: `StellaOps.Scanner.WebService.Tests` build until pre-existing `SurfaceCacheOptionsConfiguratorTests` ctor signature drift (tracked separately). | Links section covers UI/API targets; downstream consumers validated; docs/samples updated. |
 
 ## Graph Explorer v1 (Sprint 21)
 

src/Scanner/__Tests/StellaOps.Scanner.WebService.Tests/ReportEventDispatcherTests.cs

@@ -1,4 +1,4 @@
-using System;
+using System;
 using System.Collections.Generic;
 using System.Collections.Immutable;
 using System.Linq;
@@ -16,108 +16,108 @@ using StellaOps.Policy;
 using StellaOps.Scanner.WebService.Contracts;
 using StellaOps.Scanner.WebService.Options;
 using StellaOps.Scanner.WebService.Services;
-
-namespace StellaOps.Scanner.WebService.Tests;
-
-public sealed class ReportEventDispatcherTests
-{
-    private static readonly JsonSerializerOptions SerializerOptions = new(JsonSerializerDefaults.Web)
-    {
-        DefaultIgnoreCondition = JsonIgnoreCondition.WhenWritingNull
-    };
-
-    [Fact]
-    public async Task PublishAsync_EmitsReportReadyAndScanCompleted()
-    {
-        var publisher = new RecordingEventPublisher();
+
+namespace StellaOps.Scanner.WebService.Tests;
+
+public sealed class ReportEventDispatcherTests
+{
+    private static readonly JsonSerializerOptions SerializerOptions = new(JsonSerializerDefaults.Web)
+    {
+        DefaultIgnoreCondition = JsonIgnoreCondition.WhenWritingNull
+    };
+
+    [Fact]
+    public async Task PublishAsync_EmitsReportReadyAndScanCompleted()
+    {
+        var publisher = new RecordingEventPublisher();
         var dispatcher = new ReportEventDispatcher(publisher, Microsoft.Extensions.Options.Options.Create(new ScannerWebServiceOptions()), TimeProvider.System, NullLogger<ReportEventDispatcher>.Instance);
-        var cancellationToken = CancellationToken.None;
-
-        var request = new ReportRequestDto
-        {
-            ImageDigest = "sha256:feedface",
-            Findings = new[]
-            {
-                new PolicyPreviewFindingDto
-                {
-                    Id = "finding-1",
-                    Severity = "Critical",
-                    Repository = "acme/edge/api",
-                    Cve = "CVE-2024-9999",
-                    Tags = new[] { "reachability:runtime", "kev:CVE-2024-9999" }
-                }
-            }
-        };
-
-        var baseline = new PolicyVerdict("finding-1", PolicyVerdictStatus.Pass, ConfigVersion: "1.0");
-        var projected = new PolicyVerdict(
-            "finding-1",
-            PolicyVerdictStatus.Blocked,
-            Score: 47.5,
-            ConfigVersion: "1.0",
-            SourceTrust: "NVD",
-            Reachability: "runtime");
-
-        var preview = new PolicyPreviewResponse(
-            Success: true,
-            PolicyDigest: "digest-123",
-            RevisionId: "rev-42",
-            Issues: ImmutableArray<PolicyIssue>.Empty,
-            Diffs: ImmutableArray.Create(new PolicyVerdictDiff(baseline, projected)),
-            ChangedCount: 1);
-
-        var document = new ReportDocumentDto
-        {
-            ReportId = "report-abc",
-            ImageDigest = "sha256:feedface",
-            GeneratedAt = DateTimeOffset.Parse("2025-10-19T12:34:56Z"),
-            Verdict = "blocked",
-            Policy = new ReportPolicyDto
-            {
-                RevisionId = "rev-42",
-                Digest = "digest-123"
-            },
-            Summary = new ReportSummaryDto
-            {
-                Total = 1,
-                Blocked = 1,
-                Warned = 0,
-                Ignored = 0,
-                Quieted = 0
-            },
-            Verdicts = new[]
-            {
-                new PolicyPreviewVerdictDto
-                {
-                    FindingId = "finding-1",
-                    Status = "Blocked",
-                    Score = 47.5,
-                    SourceTrust = "NVD",
-                    Reachability = "runtime"
-                }
-            }
-        };
-
-        var envelope = new DsseEnvelopeDto
-        {
-            PayloadType = "application/vnd.stellaops.report+json",
-            Payload = Convert.ToBase64String(JsonSerializer.SerializeToUtf8Bytes(document, SerializerOptions)),
-            Signatures = new[]
-            {
-                new DsseSignatureDto { KeyId = "test-key", Algorithm = "hs256", Signature = "signature-value" }
-            }
-        };
-
-        var context = new DefaultHttpContext();
-        context.User = new ClaimsPrincipal(new ClaimsIdentity(new[]
-        {
-            new Claim(StellaOpsClaimTypes.Tenant, "tenant-alpha")
-        }));
-        context.Request.Scheme = "https";
-        context.Request.Host = new HostString("scanner.example");
-
-        await dispatcher.PublishAsync(request, preview, document, envelope, context, cancellationToken);
-
+        var cancellationToken = CancellationToken.None;
+
+        var request = new ReportRequestDto
+        {
+            ImageDigest = "sha256:feedface",
+            Findings = new[]
+            {
+                new PolicyPreviewFindingDto
+                {
+                    Id = "finding-1",
+                    Severity = "Critical",
+                    Repository = "acme/edge/api",
+                    Cve = "CVE-2024-9999",
+                    Tags = new[] { "reachability:runtime", "kev:CVE-2024-9999" }
+                }
+            }
+        };
+
+        var baseline = new PolicyVerdict("finding-1", PolicyVerdictStatus.Pass, ConfigVersion: "1.0");
+        var projected = new PolicyVerdict(
+            "finding-1",
+            PolicyVerdictStatus.Blocked,
+            Score: 47.5,
+            ConfigVersion: "1.0",
+            SourceTrust: "NVD",
+            Reachability: "runtime");
+
+        var preview = new PolicyPreviewResponse(
+            Success: true,
+            PolicyDigest: "digest-123",
+            RevisionId: "rev-42",
+            Issues: ImmutableArray<PolicyIssue>.Empty,
+            Diffs: ImmutableArray.Create(new PolicyVerdictDiff(baseline, projected)),
+            ChangedCount: 1);
+
+        var document = new ReportDocumentDto
+        {
+            ReportId = "report-abc",
+            ImageDigest = "sha256:feedface",
+            GeneratedAt = DateTimeOffset.Parse("2025-10-19T12:34:56Z"),
+            Verdict = "blocked",
+            Policy = new ReportPolicyDto
+            {
+                RevisionId = "rev-42",
+                Digest = "digest-123"
+            },
+            Summary = new ReportSummaryDto
+            {
+                Total = 1,
+                Blocked = 1,
+                Warned = 0,
+                Ignored = 0,
+                Quieted = 0
+            },
+            Verdicts = new[]
+            {
+                new PolicyPreviewVerdictDto
+                {
+                    FindingId = "finding-1",
+                    Status = "Blocked",
+                    Score = 47.5,
+                    SourceTrust = "NVD",
+                    Reachability = "runtime"
+                }
+            }
+        };
+
+        var envelope = new DsseEnvelopeDto
+        {
+            PayloadType = "application/vnd.stellaops.report+json",
+            Payload = Convert.ToBase64String(JsonSerializer.SerializeToUtf8Bytes(document, SerializerOptions)),
+            Signatures = new[]
+            {
+                new DsseSignatureDto { KeyId = "test-key", Algorithm = "hs256", Signature = "signature-value" }
+            }
+        };
+
+        var context = new DefaultHttpContext();
+        context.User = new ClaimsPrincipal(new ClaimsIdentity(new[]
+        {
+            new Claim(StellaOpsClaimTypes.Tenant, "tenant-alpha")
+        }));
+        context.Request.Scheme = "https";
+        context.Request.Host = new HostString("scanner.example");
+
+        await dispatcher.PublishAsync(request, preview, document, envelope, context, cancellationToken);
+
         Assert.Equal(2, publisher.Events.Count);
 
         var readyEvent = Assert.Single(publisher.Events, evt => evt.Kind == OrchestratorEventKinds.ScannerReportReady);
@@ -165,6 +165,126 @@ public sealed class ReportEventDispatcherTests
         Assert.Equal("blocked", scanPayload.Report.Verdict);
     }
 
+    [Fact]
+    public async Task PublishAsync_HonoursConfiguredConsoleAndApiSegments()
+    {
+        var options = Microsoft.Extensions.Options.Options.Create(new ScannerWebServiceOptions
+        {
+            Api = new ScannerWebServiceOptions.ApiOptions
+            {
+                BasePath = "/custom-api",
+                ReportsSegment = "reports-view",
+                PolicySegment = "policy-hub"
+            },
+            Console = new ScannerWebServiceOptions.ConsoleOptions
+            {
+                BasePath = "/console",
+                ReportsSegment = "insights",
+                PolicySegment = "policy-center",
+                AttestationsSegment = "evidence"
+            }
+        });
+
+        var publisher = new RecordingEventPublisher();
+        var dispatcher = new ReportEventDispatcher(publisher, options, TimeProvider.System, NullLogger<ReportEventDispatcher>.Instance);
+        var cancellationToken = CancellationToken.None;
+
+        var request = new ReportRequestDto
+        {
+            ImageDigest = "sha256:feedface",
+            Findings = new[]
+            {
+                new PolicyPreviewFindingDto
+                {
+                    Id = "finding-1",
+                    Severity = "Critical",
+                    Repository = "acme/edge/api",
+                    Cve = "CVE-2024-9999",
+                    Tags = new[] { "reachability:runtime", "kev:CVE-2024-9999" }
+                }
+            }
+        };
+
+        var baseline = new PolicyVerdict("finding-1", PolicyVerdictStatus.Pass, ConfigVersion: "1.0");
+        var projected = new PolicyVerdict(
+            "finding-1",
+            PolicyVerdictStatus.Blocked,
+            Score: 47.5,
+            ConfigVersion: "1.0",
+            SourceTrust: "NVD",
+            Reachability: "runtime");
+
+        var preview = new PolicyPreviewResponse(
+            Success: true,
+            PolicyDigest: "digest-123",
+            RevisionId: "rev-42",
+            Issues: ImmutableArray<PolicyIssue>.Empty,
+            Diffs: ImmutableArray.Create(new PolicyVerdictDiff(baseline, projected)),
+            ChangedCount: 1);
+
+        var document = new ReportDocumentDto
+        {
+            ReportId = "report-abc",
+            ImageDigest = "sha256:feedface",
+            GeneratedAt = DateTimeOffset.Parse("2025-10-19T12:34:56Z"),
+            Verdict = "blocked",
+            Policy = new ReportPolicyDto
+            {
+                RevisionId = "rev-42",
+                Digest = "digest-123"
+            },
+            Summary = new ReportSummaryDto
+            {
+                Total = 1,
+                Blocked = 1,
+                Warned = 0,
+                Ignored = 0,
+                Quieted = 0
+            },
+            Verdicts = new[]
+            {
+                new PolicyPreviewVerdictDto
+                {
+                    FindingId = "finding-1",
+                    Status = "Blocked",
+                    Score = 47.5,
+                    SourceTrust = "NVD",
+                    Reachability = "runtime"
+                }
+            }
+        };
+
+        var envelope = new DsseEnvelopeDto
+        {
+            PayloadType = "application/vnd.stellaops.report+json",
+            Payload = Convert.ToBase64String(JsonSerializer.SerializeToUtf8Bytes(document, SerializerOptions)),
+            Signatures = new[]
+            {
+                new DsseSignatureDto { KeyId = "test-key", Algorithm = "hs256", Signature = "signature-value" }
+            }
+        };
+
+        var context = new DefaultHttpContext();
+        context.User = new ClaimsPrincipal(new ClaimsIdentity(new[]
+        {
+            new Claim(StellaOpsClaimTypes.Tenant, "tenant-alpha")
+        }));
+        context.Request.Scheme = "https";
+        context.Request.Host = new HostString("scanner.example");
+
+        await dispatcher.PublishAsync(request, preview, document, envelope, context, cancellationToken);
+
+        var readyEvent = Assert.Single(publisher.Events, evt => evt.Kind == OrchestratorEventKinds.ScannerReportReady);
+        var links = Assert.IsType<ReportReadyEventPayload>(readyEvent.Payload).Links;
+
+        Assert.Equal("https://scanner.example/console/insights/report-abc", links.Report?.Ui);
+        Assert.Equal("https://scanner.example/custom-api/reports-view/report-abc", links.Report?.Api);
+        Assert.Equal("https://scanner.example/console/policy-center/revisions/rev-42", links.Policy?.Ui);
+        Assert.Equal("https://scanner.example/custom-api/policy-hub/revisions/rev-42", links.Policy?.Api);
+        Assert.Equal("https://scanner.example/console/evidence/report-abc", links.Attestation?.Ui);
+        Assert.Equal("https://scanner.example/custom-api/reports-view/report-abc/attestation", links.Attestation?.Api);
+    }
+
     private sealed class RecordingEventPublisher : IPlatformEventPublisher
     {
         public List<OrchestratorEvent> Events { get; } = new();
@@ -173,6 +293,6 @@ public sealed class ReportEventDispatcherTests
         {
             Events.Add(@event);
             return Task.CompletedTask;
-        }
-    }
-}
+        }
+    }
+}

src/Scanner/__Tests/StellaOps.Scanner.WebService.Tests/ReportSamplesTests.cs

@@ -28,8 +28,8 @@ public sealed class ReportSamplesTests
         Assert.NotNull(response!.Report);
         Assert.NotNull(response.Dsse);
 
-        var reportBytes = JsonSerializer.SerializeToUtf8Bytes(response.Report, SerializerOptions);
-        var expectedPayload = Convert.ToBase64String(reportBytes);
-        Assert.Equal(expectedPayload, response.Dsse!.Payload);
-    }
+        var reportBytes = JsonSerializer.SerializeToUtf8Bytes(response.Report, SerializerOptions);
+        var expectedPayload = Convert.ToBase64String(reportBytes);
+        Assert.Equal(expectedPayload, response.Dsse!.Payload);
+    }
 }

src/Scanner/__Tests/StellaOps.Scanner.WebService.Tests/ScansEndpointsTests.cs

@@ -6,6 +6,7 @@ using System.Net;
 using System.Net.Http.Json;
 using System.Linq;
 using System.Text.Json;
+using System.Text.Json.Serialization;
 using System.Threading.Tasks;
 using System.Threading;
 using Microsoft.AspNetCore.Http;
@@ -22,8 +23,8 @@ using StellaOps.Scanner.WebService.Services;
 
 namespace StellaOps.Scanner.WebService.Tests;
 
-public sealed class ScansEndpointsTests
-{
+public sealed class ScansEndpointsTests
+{
     [Fact]
     public async Task SubmitScanReturnsAcceptedAndStatusRetrievable()
     {
@@ -272,7 +273,7 @@ public sealed class ScansEndpointsTests
         var response = await client.GetAsync($"/api/v1/scans/{scanId}/entrytrace");
         Assert.Equal(HttpStatusCode.OK, response.StatusCode);
 
-        var payload = await response.Content.ReadFromJsonAsync<EntryTraceResponse>();
+        var payload = await response.Content.ReadFromJsonAsync<EntryTraceResponse>(SerializerOptions, CancellationToken.None);
         Assert.NotNull(payload);
         Assert.Equal(scanId, payload!.ScanId);
         Assert.Equal("sha256:entrytrace", payload.ImageDigest);
@@ -559,7 +560,7 @@ public sealed class ScansEndpointsTests
         var response = await client.GetAsync($"/api/v1/scans/{scanId}/entrytrace");
         Assert.Equal(HttpStatusCode.OK, response.StatusCode);
 
-        var payload = await response.Content.ReadFromJsonAsync<EntryTraceResponse>();
+        var payload = await response.Content.ReadFromJsonAsync<EntryTraceResponse>(SerializerOptions, CancellationToken.None);
         Assert.NotNull(payload);
         Assert.Equal(storedResult.ScanId, payload!.ScanId);
         Assert.Equal(storedResult.ImageDigest, payload.ImageDigest);
@@ -583,7 +584,10 @@ public sealed class ScansEndpointsTests
         Assert.Equal(HttpStatusCode.NotFound, response.StatusCode);
     }
 
-    private static readonly JsonSerializerOptions SerializerOptions = new(JsonSerializerDefaults.Web);
+    private static readonly JsonSerializerOptions SerializerOptions = new(JsonSerializerDefaults.Web)
+    {
+        Converters = { new JsonStringEnumConverter() }
+    };
 
     private sealed record ProgressEnvelope(
         string ScanId,

src/Scanner/__Tests/StellaOps.Scanner.WebService.Tests/SurfaceCacheOptionsConfiguratorTests.cs

@@ -19,12 +19,12 @@ public sealed class SurfaceCacheOptionsConfiguratorTests
             "surface-cache",
             null,
             cacheRoot,
-            cacheQuotaMegabytes: 512,
-            prefetchEnabled: true,
-            featureFlags: Array.Empty<string>(),
-            secrets: new SurfaceSecretsConfiguration("file", "tenant-b", "/etc/secrets", null, null, allowInline: false),
-            tenant: "tenant-b",
-            tls: new SurfaceTlsConfiguration(null, null, new X509Certificate2Collection()));
+            512,
+            true,
+            Array.Empty<string>(),
+            new SurfaceSecretsConfiguration("file", "tenant-b", "/etc/secrets", null, null, false),
+            "tenant-b",
+            new SurfaceTlsConfiguration(null, null, new X509Certificate2Collection()));
 
         var environment = new StubSurfaceEnvironment(settings);
         var configurator = new SurfaceCacheOptionsConfigurator(environment);

src/Scanner/__Tests/StellaOps.Scanner.Worker.Tests/SurfaceCacheOptionsConfiguratorTests.cs

@@ -19,12 +19,12 @@ public sealed class SurfaceCacheOptionsConfiguratorTests
             "surface-cache",
             null,
             cacheRoot,
-            cacheQuotaMegabytes: 1024,
-            prefetchEnabled: false,
-            featureFlags: Array.Empty<string>(),
-            secrets: new SurfaceSecretsConfiguration("file", "tenant-a", "/etc/secrets", null, null, false),
-            tenant: "tenant-a",
-            tls: new SurfaceTlsConfiguration(null, null, new X509Certificate2Collection()));
+            1024,
+            false,
+            Array.Empty<string>(),
+            new SurfaceSecretsConfiguration("file", "tenant-a", "/etc/secrets", null, null, false),
+            "tenant-a",
+            new SurfaceTlsConfiguration(null, null, new X509Certificate2Collection()));
 
         var environment = new StubSurfaceEnvironment(settings);
         var configurator = new SurfaceCacheOptionsConfigurator(environment);

src/Scanner/docs/events/samples/scanner.event.report.ready@1.sample.json

@@ -3,8 +3,8 @@
     "kind": "scanner.event.report.ready",
     "version": 1,
     "tenant": "tenant-alpha",
-    "occurredAt": "2025-10-19T12:34:56Z",
-    "recordedAt": "2025-10-19T12:34:57Z",
+    "occurredAt": "2025-10-19T12:34:56+00:00",
+    "recordedAt": "2025-10-19T12:34:57+00:00",
     "source": "scanner.webservice",
     "idempotencyKey": "scanner.event.report.ready:tenant-alpha:report-abc",
     "correlationId": "report-abc",
@@ -25,7 +25,7 @@
         "reportId": "report-abc",
         "scanId": "report-abc",
         "imageDigest": "sha256:feedface",
-        "generatedAt": "2025-10-19T12:34:56Z",
+        "generatedAt": "2025-10-19T12:34:56+00:00",
         "verdict": "fail",
         "summary": {
             "total": 1,
@@ -72,7 +72,7 @@
         },
         "report": {
             "reportId": "report-abc",
-            "generatedAt": "2025-10-19T12:34:56Z",
+            "generatedAt": "2025-10-19T12:34:56+00:00",
             "imageDigest": "sha256:feedface",
             "policy": {
                 "digest": "digest-123",

src/Scanner/docs/events/samples/scanner.event.scan.completed@1.sample.json

@@ -3,8 +3,8 @@
     "kind": "scanner.event.scan.completed",
     "version": 1,
     "tenant": "tenant-alpha",
-    "occurredAt": "2025-10-19T12:34:56Z",
-    "recordedAt": "2025-10-19T12:34:57Z",
+    "occurredAt": "2025-10-19T12:34:56+00:00",
+    "recordedAt": "2025-10-19T12:34:57+00:00",
     "source": "scanner.webservice",
     "idempotencyKey": "scanner.event.scan.completed:tenant-alpha:report-abc",
     "correlationId": "report-abc",
@@ -78,7 +78,7 @@
         },
         "report": {
             "reportId": "report-abc",
-            "generatedAt": "2025-10-19T12:34:56Z",
+            "generatedAt": "2025-10-19T12:34:56+00:00",
             "imageDigest": "sha256:feedface",
             "policy": {
                 "digest": "digest-123",

src/Scanner/samples/api/reports/report-sample.dsse.json

@@ -0,0 +1,80 @@
+{
+  "report": {
+    "reportId": "report-abc",
+    "imageDigest": "sha256:feedface",
+    "generatedAt": "2025-10-19T12:34:56+00:00",
+    "verdict": "blocked",
+    "policy": {
+      "revisionId": "rev-42",
+      "digest": "digest-123"
+    },
+    "summary": {
+      "total": 1,
+      "blocked": 1,
+      "warned": 0,
+      "ignored": 0,
+      "quieted": 0
+    },
+    "verdicts": [
+      {
+        "findingId": "finding-1",
+        "reachability": "runtime",
+        "score": 47.5,
+        "sourceTrust": "NVD",
+        "status": "Blocked"
+      }
+    ],
+    "issues": [],
+    "surface": {
+      "tenant": "tenant-alpha",
+      "generatedAt": "2025-10-19T12:34:56+00:00",
+      "manifestDigest": "sha256:4fee87d186291ddfbbcc2c56c8ed0e828520b8f52e1cde0e13bba082f10918d7",
+      "manifestUri": "cas://scanner-artifacts/scanner/surface/manifests/tenant-alpha/sha256/4f/ee/4fee87d186291ddfbbcc2c56c8ed0e828520b8f52e1cde0e13bba082f10918d7.json",
+      "manifest": {
+        "schema": "stellaops.surface.manifest@1",
+        "tenant": "tenant-alpha",
+        "imageDigest": "sha256:feedface",
+        "generatedAt": "2025-10-19T12:34:56+00:00",
+        "artifacts": [
+          {
+            "kind": "entry-trace",
+            "uri": "cas://scanner-artifacts/scanner/entry-trace/f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0/entry-trace.json",
+            "digest": "sha256:f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0",
+            "mediaType": "application/json",
+            "format": "json",
+            "sizeBytes": 4096
+          },
+          {
+            "kind": "sbom-inventory",
+            "uri": "cas://scanner-artifacts/scanner/images/feedface/sbom.cdx.json",
+            "digest": "sha256:1111111111111111111111111111111111111111111111111111111111111111",
+            "mediaType": "application/vnd.cyclonedx+json;version=1.6;view=inventory",
+            "format": "cdx-json",
+            "sizeBytes": 24576,
+            "view": "inventory"
+          },
+          {
+            "kind": "sbom-usage",
+            "uri": "cas://scanner-artifacts/scanner/images/feedface/sbom-usage.cdx.json",
+            "digest": "sha256:2222222222222222222222222222222222222222222222222222222222222222",
+            "mediaType": "application/vnd.cyclonedx+json;version=1.6;view=usage",
+            "format": "cdx-json",
+            "sizeBytes": 16384,
+            "view": "usage"
+          }
+        ]
+      }
+    }
+  },
+  "dsse": {
+    "payloadType": "application/vnd.stellaops.report+json",
+    "payload": "eyJyZXBvcnRJZCI6InJlcG9ydC1hYmMiLCJpbWFnZURpZ2VzdCI6InNoYTI1NjpmZWVkZmFjZSIsImdlbmVyYXRlZEF0IjoiMjAyNS0xMC0xOVQxMjozNDo1NiswMDowMCIsInZlcmRpY3QiOiJibG9ja2VkIiwicG9saWN5Ijp7InJldmlzaW9uSWQiOiJyZXYtNDIiLCJkaWdlc3QiOiJkaWdlc3QtMTIzIn0sInN1bW1hcnkiOnsidG90YWwiOjEsImJsb2NrZWQiOjEsIndhcm5lZCI6MCwiaWdub3JlZCI6MCwicXVpZXRlZCI6MH0sInZlcmRpY3RzIjpbeyJmaW5kaW5nSWQiOiJmaW5kaW5nLTEiLCJzdGF0dXMiOiJCbG9ja2VkIiwic2NvcmUiOjQ3LjUsInNvdXJjZVRydXN0IjoiTlZEIiwicmVhY2hhYmlsaXR5IjoicnVudGltZSJ9XSwiaXNzdWVzIjpbXSwic3VyZmFjZSI6eyJ0ZW5hbnQiOiJ0ZW5hbnQtYWxwaGEiLCJnZW5lcmF0ZWRBdCI6IjIwMjUtMTAtMTlUMTI6MzQ6NTYrMDA6MDAiLCJtYW5pZmVzdERpZ2VzdCI6InNoYTI1Njo0ZmVlODdkMTg2MjkxZGRmYmJjYzJjNTZjOGVkMGU4Mjg1MjBiOGY1MmUxY2RlMGUxM2JiYTA4MmYxMDkxOGQ3IiwibWFuaWZlc3RVcmkiOiJjYXM6Ly9zY2FubmVyLWFydGlmYWN0cy9zY2FubmVyL3N1cmZhY2UvbWFuaWZlc3RzL3RlbmFudC1hbHBoYS9zaGEyNTYvNGYvZWUvNGZlZTg3ZDE4NjI5MWRkZmJiY2MyYzU2YzhlZDBlODI4NTIwYjhmNTJlMWNkZTBlMTNiYmEwODJmMTA5MThkNy5qc29uIiwibWFuaWZlc3QiOnsic2NoZW1hIjoic3RlbGxhb3BzLnN1cmZhY2UubWFuaWZlc3RAMSIsInRlbmFudCI6InRlbmFudC1hbHBoYSIsImltYWdlRGlnZXN0Ijoic2hhMjU2OmZlZWRmYWNlIiwiZ2VuZXJhdGVkQXQiOiIyMDI1LTEwLTE5VDEyOjM0OjU2KzAwOjAwIiwiYXJ0aWZhY3RzIjpbeyJraW5kIjoiZW50cnktdHJhY2UiLCJ1cmkiOiJjYXM6Ly9zY2FubmVyLWFydGlmYWN0cy9zY2FubmVyL2VudHJ5LXRyYWNlL2YwZjBmMGYwZjBmMGYwZjBmMGYwZjBmMGYwZjBmMGYwZjBmMGYwZjBmMGYwZjBmMGYwZjBmMGYwZjBmMGYwL2VudHJ5LXRyYWNlLmpzb24iLCJkaWdlc3QiOiJzaGEyNTY6ZjBmMGYwZjBmMGYwZjBmMGYwZjBmMGYwZjBmMGYwZjBmMGYwZjBmMGYwZjBmMGYwZjBmMGYwZjBmMGYwZjBmMCIsIm1lZGlhVHlwZSI6ImFwcGxpY2F0aW9uL2pzb24iLCJmb3JtYXQiOiJqc29uIiwic2l6ZUJ5dGVzIjo0MDk2fSx7ImtpbmQiOiJzYm9tLWludmVudG9yeSIsInVyaSI6ImNhczovL3NjYW5uZXItYXJ0aWZhY3RzL3NjYW5uZXIvaW1hZ2VzL2ZlZWRmYWNlL3Nib20uY2R4Lmpzb24iLCJkaWdlc3QiOiJzaGEyNTY6MTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMSIsIm1lZGlhVHlwZSI6ImFwcGxpY2F0aW9uL3ZuZC5jeWNsb25lZHhcdTAwMkJqc29uO3ZlcnNpb249MS42O3ZpZXc9aW52ZW50b3J5IiwiZm9ybWF0IjoiY2R4LWpzb24iLCJzaXplQnl0ZXMiOjI0NTc2LCJ2aWV3IjoiaW52ZW50b3J5In0seyJraW5kIjoic2JvbS11c2FnZSIsInVyaSI6ImNhczovL3NjYW5uZXItYXJ0aWZhY3RzL3NjYW5uZXIvaW1hZ2VzL2ZlZWRmYWNlL3Nib20tdXNhZ2UuY2R4Lmpzb24iLCJkaWdlc3QiOiJzaGEyNTY6MjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMiIsIm1lZGlhVHlwZSI6ImFwcGxpY2F0aW9uL3ZuZC5jeWNsb25lZHhcdTAwMkJqc29uO3ZlcnNpb249MS42O3ZpZXc9dXNhZ2UiLCJmb3JtYXQiOiJjZHgtanNvbiIsInNpemVCeXRlcyI6MTYzODQsInZpZXciOiJ1c2FnZSJ9XX19fQ==",
+    "signatures": [
+      {
+        "keyId": "test-key",
+        "algorithm": "hs256",
+        "signature": "signature-value"
+      }
+    ]
+  }
+}