Add MergeUsageAnalyzer to detect legacy merge service usage

- Implemented MergeUsageAnalyzer to flag usage of AdvisoryMergeService and AddMergeModule.
- Created AnalyzerReleases.Shipped.md and AnalyzerReleases.Unshipped.md for release documentation.
- Added tests for MergeUsageAnalyzer to ensure correct diagnostics for various scenarios.
- Updated project files for analyzers and tests to include necessary dependencies and configurations.
- Introduced a sample report structure for scanner output.

src/Concelier/StellaOps.Concelier.WebService/StellaOps.Concelier.WebService.csproj

@@ -35,7 +35,7 @@
     <ProjectReference Include="../../Authority/StellaOps.Authority/StellaOps.Auth.ServerIntegration/StellaOps.Auth.ServerIntegration.csproj" />
     <ProjectReference Include="../../Aoc/__Libraries/StellaOps.Aoc/StellaOps.Aoc.csproj" />
     <ProjectReference Include="../../Aoc/__Libraries/StellaOps.Aoc.AspNetCore/StellaOps.Aoc.AspNetCore.csproj" />
-    <ProjectReference Include="../__Analyzers/StellaOps.Concelier.Analyzers/StellaOps.Concelier.Analyzers.csproj"
+    <ProjectReference Include="../__Analyzers/StellaOps.Concelier.Merge.Analyzers/StellaOps.Concelier.Merge.Analyzers.csproj"
                       OutputItemType="Analyzer"
                       ReferenceOutputAssembly="false" />
   </ItemGroup>

src/Concelier/__Analyzers/StellaOps.Concelier.Analyzers/AnalyzerReleases.Unshipped.md

@@ -2,8 +2,4 @@
 
 ### Unreleased
 
-#### New Rules
-
-Rule ID | Title | Notes
---------|-------|------
-CONCELIER0002 | Legacy merge pipeline is disabled | Flags usage of `AddMergeModule` and `AdvisoryMergeService`.
+No analyzer rules currently scheduled for release.

src/Concelier/__Analyzers/StellaOps.Concelier.Analyzers/NoMergeUsageAnalyzer.cs

@@ -1,152 +0,0 @@
-using System;
-using System.Collections.Immutable;
-using Microsoft.CodeAnalysis;
-using Microsoft.CodeAnalysis.Diagnostics;
-using Microsoft.CodeAnalysis.Operations;
-
-namespace StellaOps.Concelier.Analyzers;
-
-/// <summary>
-/// Analyzer that flags usages of the legacy merge service APIs.
-/// </summary>
-[DiagnosticAnalyzer(LanguageNames.CSharp)]
-public sealed class NoMergeUsageAnalyzer : DiagnosticAnalyzer
-{
-    /// <summary>
-    /// Diagnostic identifier for legacy merge usage violations.
-    /// </summary>
-    public const string DiagnosticId = "CONCELIER0002";
-
-    private const string Category = "Usage";
-    private const string MergeExtensionType = "StellaOps.Concelier.Merge.MergeServiceCollectionExtensions";
-    private const string MergeServiceType = "StellaOps.Concelier.Merge.Services.AdvisoryMergeService";
-
-    private static readonly LocalizableString Title = "Legacy merge pipeline is disabled";
-    private static readonly LocalizableString MessageFormat = "Do not reference the legacy Concelier merge pipeline (type '{0}')";
-    private static readonly LocalizableString Description =
-        "The legacy Concelier merge service is deprecated under MERGE-LNM-21-002. "
-        + "Switch to observation/linkset APIs or guard calls behind the concelier:features:noMergeEnabled toggle.";
-
-    private static readonly DiagnosticDescriptor Rule = new(
-        DiagnosticId,
-        Title,
-        MessageFormat,
-        Category,
-        DiagnosticSeverity.Error,
-        isEnabledByDefault: true,
-        description: Description,
-        helpLinkUri: "https://stella-ops.org/docs/migration/no-merge");
-
-    /// <inheritdoc />
-    public override ImmutableArray<DiagnosticDescriptor> SupportedDiagnostics => ImmutableArray.Create(Rule);
-
-    /// <inheritdoc />
-    public override void Initialize(AnalysisContext context)
-    {
-        context.ConfigureGeneratedCodeAnalysis(GeneratedCodeAnalysisFlags.None);
-        context.EnableConcurrentExecution();
-
-        context.RegisterOperationAction(AnalyzeInvocation, OperationKind.Invocation);
-        context.RegisterOperationAction(AnalyzeObjectCreation, OperationKind.ObjectCreation);
-    }
-
-    private static void AnalyzeInvocation(OperationAnalysisContext context)
-    {
-        if (context.Operation is not IInvocationOperation invocation)
-        {
-            return;
-        }
-
-        var targetMethod = invocation.TargetMethod;
-        if (targetMethod is null)
-        {
-            return;
-        }
-
-        if (!SymbolEquals(targetMethod.ContainingType, MergeExtensionType))
-        {
-            return;
-        }
-
-        if (!string.Equals(targetMethod.Name, "AddMergeModule", StringComparison.Ordinal))
-        {
-            return;
-        }
-
-        if (IsAllowedAssembly(context.ContainingSymbol.ContainingAssembly))
-        {
-            return;
-        }
-
-        ReportDiagnostic(context, invocation.Syntax, $"{MergeExtensionType}.{targetMethod.Name}");
-    }
-
-    private static void AnalyzeObjectCreation(OperationAnalysisContext context)
-    {
-        if (context.Operation is not IObjectCreationOperation creation)
-        {
-            return;
-        }
-
-        var createdType = creation.Type;
-        if (createdType is null || !SymbolEquals(createdType, MergeServiceType))
-        {
-            return;
-        }
-
-        if (IsAllowedAssembly(context.ContainingSymbol.ContainingAssembly))
-        {
-            return;
-        }
-
-        ReportDiagnostic(context, creation.Syntax, MergeServiceType);
-    }
-
-    private static bool SymbolEquals(ITypeSymbol? symbol, string fullName)
-    {
-        if (symbol is null)
-        {
-            return false;
-        }
-
-        var display = symbol.ToDisplayString(SymbolDisplayFormat.FullyQualifiedFormat);
-        if (display.StartsWith("global::", StringComparison.Ordinal))
-        {
-            display = display.Substring("global::".Length);
-        }
-
-        return string.Equals(display, fullName, StringComparison.Ordinal);
-    }
-
-    private static bool IsAllowedAssembly(IAssemblySymbol? assemblySymbol)
-    {
-        if (assemblySymbol is null)
-        {
-            return false;
-        }
-
-        var assemblyName = assemblySymbol.Name;
-        if (string.IsNullOrWhiteSpace(assemblyName))
-        {
-            return false;
-        }
-
-        if (assemblyName.StartsWith("StellaOps.Concelier.Merge", StringComparison.Ordinal))
-        {
-            return true;
-        }
-
-        if (assemblyName.EndsWith(".Analyzers", StringComparison.Ordinal))
-        {
-            return true;
-        }
-
-        return false;
-    }
-
-    private static void ReportDiagnostic(OperationAnalysisContext context, SyntaxNode syntax, string targetName)
-    {
-        var diagnostic = Diagnostic.Create(Rule, syntax.GetLocation(), targetName);
-        context.ReportDiagnostic(diagnostic);
-    }
-}

src/Concelier/__Analyzers/StellaOps.Concelier.Merge.Analyzers/AnalyzerReleases.Shipped.md

@@ -0,0 +1,2 @@
+; Shipped analyzer releases
+

src/Concelier/__Analyzers/StellaOps.Concelier.Merge.Analyzers/AnalyzerReleases.Unshipped.md

@@ -0,0 +1,9 @@
+## Release History
+
+### Unreleased
+
+#### New Rules
+
+Rule ID | Title | Notes
+--------|-------|------
+CONCELIER0002 | Legacy merge service usage detected | Flags references to `AdvisoryMergeService` and `AddMergeModule`.

src/Concelier/__Analyzers/StellaOps.Concelier.Merge.Analyzers/MergeUsageAnalyzer.cs

@@ -0,0 +1,237 @@
+using System;
+using System.Collections.Immutable;
+using Microsoft.CodeAnalysis;
+using Microsoft.CodeAnalysis.CSharp;
+using Microsoft.CodeAnalysis.CSharp.Syntax;
+using Microsoft.CodeAnalysis.Diagnostics;
+using Microsoft.CodeAnalysis.Operations;
+
+namespace StellaOps.Concelier.Merge.Analyzers;
+
+[DiagnosticAnalyzer(LanguageNames.CSharp)]
+public sealed class MergeUsageAnalyzer : DiagnosticAnalyzer
+{
+    public const string DiagnosticId = "CONCELIER0002";
+
+    private const string AdvisoryMergeServiceTypeName = "StellaOps.Concelier.Merge.Services.AdvisoryMergeService";
+    private const string MergeExtensionsTypeName = "StellaOps.Concelier.Merge.MergeServiceCollectionExtensions";
+    private const string AddMergeModuleMethodName = "AddMergeModule";
+
+    private static readonly DiagnosticDescriptor Rule = new(
+        DiagnosticId,
+        title: "Legacy merge service usage detected",
+        messageFormat: "Advisory merge pipeline is deprecated; remove usage of '{0}' and adopt Link-Not-Merge linkset workflows (MERGE-LNM-21-002)",
+        category: "Usage",
+        defaultSeverity: DiagnosticSeverity.Warning,
+        isEnabledByDefault: true,
+        description: "Link-Not-Merge replaces the legacy AdvisoryMergeService. Set concelier:features:noMergeEnabled=true and migrate to observation/linkset APIs instead of invoking merge services directly.",
+        helpLinkUri: "https://stella-ops.org/docs/migration/no-merge");
+
+    public override ImmutableArray<DiagnosticDescriptor> SupportedDiagnostics => ImmutableArray.Create(Rule);
+
+    public override void Initialize(AnalysisContext context)
+    {
+        context.ConfigureGeneratedCodeAnalysis(GeneratedCodeAnalysisFlags.None);
+        context.EnableConcurrentExecution();
+
+        context.RegisterOperationAction(AnalyzeInvocation, OperationKind.Invocation);
+        context.RegisterOperationAction(AnalyzeObjectCreation, OperationKind.ObjectCreation);
+        context.RegisterOperationAction(AnalyzeTypeOf, OperationKind.TypeOf);
+        context.RegisterSyntaxNodeAction(AnalyzeIdentifier, SyntaxKind.IdentifierName);
+    }
+
+    private static void AnalyzeInvocation(OperationAnalysisContext context)
+    {
+        if (context.Operation is not IInvocationOperation invocation)
+        {
+            return;
+        }
+
+        var method = invocation.TargetMethod;
+        if (!IsAddMergeModule(method) && (method.ReducedFrom is null || !IsAddMergeModule(method.ReducedFrom)))
+        {
+            return;
+        }
+
+        if (IsAllowedAssembly(method.ContainingAssembly, context.ContainingSymbol))
+        {
+            return;
+        }
+
+        ReportDiagnostic(context, invocation.Syntax.GetLocation(), $"{method.ContainingType.Name}.{method.Name}");
+    }
+
+    private static void AnalyzeObjectCreation(OperationAnalysisContext context)
+    {
+        if (context.Operation is not IObjectCreationOperation creation)
+        {
+            return;
+        }
+
+        if (creation.Type is not INamedTypeSymbol type || !IsAdvisoryMergeService(type))
+        {
+            return;
+        }
+
+        if (IsAllowedAssembly(type.ContainingAssembly, context.ContainingSymbol))
+        {
+            return;
+        }
+
+        ReportDiagnostic(context, creation.Syntax.GetLocation(), type.Name);
+    }
+
+    private static void AnalyzeTypeOf(OperationAnalysisContext context)
+    {
+        if (context.Operation is not ITypeOfOperation typeOfOperation)
+        {
+            return;
+        }
+
+        if (typeOfOperation.TypeOperand is not INamedTypeSymbol type || !IsAdvisoryMergeService(type))
+        {
+            return;
+        }
+
+        if (IsAllowedAssembly(type.ContainingAssembly, context.ContainingSymbol))
+        {
+            return;
+        }
+
+        ReportDiagnostic(context, typeOfOperation.Syntax.GetLocation(), type.Name);
+    }
+
+    private static void AnalyzeIdentifier(SyntaxNodeAnalysisContext context)
+    {
+        var identifier = (IdentifierNameSyntax)context.Node;
+        if (!IsRightMostIdentifier(identifier))
+        {
+            return;
+        }
+
+        var symbolInfo = context.SemanticModel.GetSymbolInfo(identifier, context.CancellationToken);
+        var symbol = symbolInfo.Symbol;
+        if (symbol is not INamedTypeSymbol typeSymbol || !IsAdvisoryMergeService(typeSymbol))
+        {
+            return;
+        }
+
+        if (IsAllowedAssembly(typeSymbol.ContainingAssembly, context.ContainingSymbol))
+        {
+            return;
+        }
+
+        if (IsPartOfSuppressedConstruct(identifier))
+        {
+            return;
+        }
+
+        var diagnostic = Diagnostic.Create(Rule, identifier.GetLocation(), typeSymbol.Name);
+        context.ReportDiagnostic(diagnostic);
+    }
+
+    private static bool IsPartOfSuppressedConstruct(IdentifierNameSyntax identifier)
+    {
+        foreach (var ancestor in identifier.Ancestors())
+        {
+            switch (ancestor)
+            {
+                case ObjectCreationExpressionSyntax:
+                case TypeOfExpressionSyntax:
+                    return true;
+            }
+        }
+
+        return false;
+    }
+
+    private static bool IsRightMostIdentifier(IdentifierNameSyntax identifier)
+    {
+        if (identifier.Parent is QualifiedNameSyntax qualified)
+        {
+            return qualified.Right == identifier;
+        }
+
+        if (identifier.Parent is AliasQualifiedNameSyntax aliasQualified)
+        {
+            return aliasQualified.Name == identifier;
+        }
+
+        return true;
+    }
+
+    private static bool IsAddMergeModule(IMethodSymbol methodSymbol)
+    {
+        if (!string.Equals(methodSymbol.Name, AddMergeModuleMethodName, StringComparison.Ordinal))
+        {
+            return false;
+        }
+
+        var containingType = methodSymbol.ContainingType;
+        if (containingType is null)
+        {
+            return false;
+        }
+
+        var display = containingType.ToDisplayString(SymbolDisplayFormat.FullyQualifiedFormat);
+        display = TrimGlobalPrefix(display);
+        return string.Equals(display, MergeExtensionsTypeName, StringComparison.Ordinal);
+    }
+
+    private static bool IsAdvisoryMergeService(INamedTypeSymbol symbol)
+    {
+        var display = symbol.ToDisplayString(SymbolDisplayFormat.FullyQualifiedFormat);
+        display = TrimGlobalPrefix(display);
+        return string.Equals(display, AdvisoryMergeServiceTypeName, StringComparison.Ordinal);
+    }
+
+    private static void ReportDiagnostic(OperationAnalysisContext context, Location location, string target)
+    {
+        var diagnostic = Diagnostic.Create(Rule, location, target);
+        context.ReportDiagnostic(diagnostic);
+    }
+
+    private static bool IsAllowedAssembly(IAssemblySymbol? referencedAssembly, ISymbol? containingSymbol)
+    {
+        var consumerAssembly = containingSymbol?.ContainingAssembly;
+        if (referencedAssembly is null || consumerAssembly is null)
+        {
+            return false;
+        }
+
+        var referencedName = referencedAssembly.Name;
+        if (!string.IsNullOrWhiteSpace(referencedName) &&
+            referencedName.StartsWith("StellaOps.Concelier.Merge", StringComparison.Ordinal))
+        {
+            return true;
+        }
+
+        var name = consumerAssembly.Name;
+        if (string.IsNullOrWhiteSpace(name))
+        {
+            return false;
+        }
+
+        if (name.StartsWith("StellaOps.Concelier.Merge", StringComparison.Ordinal))
+        {
+            return true;
+        }
+
+        if (name.EndsWith(".Analyzers", StringComparison.Ordinal))
+        {
+            return true;
+        }
+
+        return false;
+    }
+
+    private static string TrimGlobalPrefix(string display)
+    {
+        if (!display.StartsWith("global::", StringComparison.Ordinal))
+        {
+            return display;
+        }
+
+        return display.Substring("global::".Length);
+    }
+}

src/Concelier/__Analyzers/StellaOps.Concelier.Merge.Analyzers/StellaOps.Concelier.Merge.Analyzers.csproj

@@ -0,0 +1,23 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project Sdk="Microsoft.NET.Sdk">
+  <PropertyGroup>
+    <TargetFramework>netstandard2.0</TargetFramework>
+    <ImplicitUsings>enable</ImplicitUsings>
+    <Nullable>enable</Nullable>
+    <LangVersion>preview</LangVersion>
+    <IncludeBuildOutput>false</IncludeBuildOutput>
+    <AnalysisLevel>latest</AnalysisLevel>
+    <EnforceExtendedAnalyzerRules>true</EnforceExtendedAnalyzerRules>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <PackageReference Include="Microsoft.CodeAnalysis.CSharp" Version="4.0.1" PrivateAssets="all" />
+    <PackageReference Include="Microsoft.CodeAnalysis.Analyzers" Version="3.3.4" PrivateAssets="all" />
+  </ItemGroup>
+
+  <ItemGroup>
+    <None Include="README.md" Visible="false" />
+    <None Include="AnalyzerReleases.Shipped.md" Visible="false" />
+    <None Include="AnalyzerReleases.Unshipped.md" Visible="false" />
+  </ItemGroup>
+</Project>

src/Concelier/__Libraries/StellaOps.Concelier.Core/Observations/AdvisoryObservationQueryService.cs

@@ -29,7 +29,7 @@ public sealed class AdvisoryObservationQueryService : IAdvisoryObservationQueryS
 
         var normalizedTenant = NormalizeTenant(options.Tenant);
         var normalizedObservationIds = NormalizeSet(options.ObservationIds, static value => value, StringComparer.Ordinal);
-        var normalizedAliases = NormalizeSet(options.Aliases, static value => value.ToLowerInvariant(), StringComparer.Ordinal);
+        var normalizedAliases = NormalizeSet(options.Aliases, static value => value, StringComparer.OrdinalIgnoreCase);
         var normalizedPurls = NormalizeSet(options.Purls, static value => value, StringComparer.Ordinal);
         var normalizedCpes = NormalizeSet(options.Cpes, static value => value, StringComparer.Ordinal);
 

src/Concelier/__Libraries/StellaOps.Concelier.Core/TASKS.md

@@ -9,7 +9,7 @@
 > Docs alignment (2025-10-26): Linkset expectations detailed in AOC reference §4 and policy-engine architecture §2.1.
 > 2025-10-28: Advisory raw ingestion now strips client-supplied supersedes hints, logs ignored pointers, and surfaces repository-supplied supersedes identifiers; service tests cover duplicate handling and append-only semantics.
 > Docs alignment (2025-10-26): Deployment guide + observability guide describe supersedes metrics; ensure implementation emits `aoc_violation_total` on failure.
-| CONCELIER-CORE-AOC-19-004 `Remove ingestion normalization` | DOING (2025-10-28) | Concelier Core Guild | CONCELIER-CORE-AOC-19-002, POLICY-AOC-19-003 | Strip normalization/dedup/severity logic from ingestion pipelines, delegate derived computations to Policy Engine, and update exporters/tests to consume raw documents only.<br>2025-10-29 19:05Z: Audit completed for `AdvisoryRawService`/Mongo repo to confirm alias order/dedup removal persists; identified remaining normalization in observation/linkset factory that will be revised to surface raw duplicates for Policy ingestion. Change sketch + regression matrix drafted under `docs/dev/aoc-normalization-removal-notes.md` (pending commit).<br>2025-10-31 20:45Z: Added raw linkset projection to observations/storage, exposing canonical+raw views, refreshed fixtures/tests, and documented behaviour in models/doc factory.<br>2025-10-31 21:10Z: Coordinated with Policy Engine (POLICY-ENGINE-20-003) on adoption timeline; backfill + consumer readiness tracked in `docs/dev/raw-linkset-backfill-plan.md`.<br>2025-11-05 14:25Z: Resuming to document merge-dependent normalization paths and prepare implementation notes for `noMergeEnabled` gating before code changes land.<br>2025-11-05 19:20Z: Observation factory/linkset now preserve upstream ordering + duplicates; canonicalisation responsibility shifts to downstream consumers with refreshed unit coverage.<br>2025-11-06 16:10Z: Updated AOC reference/backfill docs with raw vs canonical guidance and cross-linked analyzer guardrails. |
+| CONCELIER-CORE-AOC-19-004 `Remove ingestion normalization` | DONE (2025-11-06) | Concelier Core Guild | CONCELIER-CORE-AOC-19-002, POLICY-AOC-19-003 | Strip normalization/dedup/severity logic from ingestion pipelines, delegate derived computations to Policy Engine, and update exporters/tests to consume raw documents only.<br>2025-10-29 19:05Z: Audit completed for `AdvisoryRawService`/Mongo repo to confirm alias order/dedup removal persists; identified remaining normalization in observation/linkset factory that will be revised to surface raw duplicates for Policy ingestion. Change sketch + regression matrix drafted under `docs/dev/aoc-normalization-removal-notes.md` (pending commit).<br>2025-10-31 20:45Z: Added raw linkset projection to observations/storage, exposing canonical+raw views, refreshed fixtures/tests, and documented behaviour in models/doc factory.<br>2025-10-31 21:10Z: Coordinated with Policy Engine (POLICY-ENGINE-20-003) on adoption timeline; backfill + consumer readiness tracked in `docs/dev/raw-linkset-backfill-plan.md`.<br>2025-11-05 14:25Z: Resuming to document merge-dependent normalization paths and prepare implementation notes for `noMergeEnabled` gating before code changes land.<br>2025-11-05 19:20Z: Observation factory/linkset now preserve upstream ordering + duplicates; canonicalisation responsibility shifts to downstream consumers with refreshed unit coverage.<br>2025-11-06 16:10Z: Updated AOC reference/backfill docs with raw vs canonical guidance and cross-linked analyzer guardrails.<br>2025-11-06 23:40Z: Final pass preserves raw alias casing/whitespace end-to-end; query filters now compare case-insensitively, exporter fixtures refreshed, and docs aligned. Tests: `StellaOps.Concelier.Models/Core/Storage.Mongo.Tests` green on .NET 10 preview. |
 > Docs alignment (2025-10-26): Architecture overview emphasises policy-only derivation; coordinate with Policy Engine guild for rollout.
 > 2025-10-29: `AdvisoryRawService` now preserves upstream alias/linkset ordering (trim-only) and updated AOC documentation reflects the behaviour; follow-up to ensure policy consumers handle duplicates remains open.
 | CONCELIER-CORE-AOC-19-013 `Authority tenant scope smoke coverage` | TODO | Concelier Core Guild | AUTH-AOC-19-002 | Extend Concelier smoke/e2e fixtures to configure `requiredTenants` and assert cross-tenant rejection with updated Authority tokens. | Coordinate deliverable so Authority docs (`AUTH-AOC-19-003`) can close once tests are in place. |

src/Concelier/__Libraries/StellaOps.Concelier.Merge/MergeServiceCollectionExtensions.cs

@@ -13,15 +13,21 @@ namespace StellaOps.Concelier.Merge;
 [Obsolete("Legacy merge module is deprecated; prefer Link-Not-Merge linkset pipelines. Track MERGE-LNM-21-002 and set concelier:features:noMergeEnabled=true to disable registration.", DiagnosticId = "CONCELIER0001", UrlFormat = "https://stella-ops.org/docs/migration/no-merge")]
 public static class MergeServiceCollectionExtensions
 {
-    public static IServiceCollection AddMergeModule(this IServiceCollection services, IConfiguration configuration)
-    {
-        ArgumentNullException.ThrowIfNull(services);
-        ArgumentNullException.ThrowIfNull(configuration);
-
+    public static IServiceCollection AddMergeModule(this IServiceCollection services, IConfiguration configuration)
+    {
+        ArgumentNullException.ThrowIfNull(services);
+        ArgumentNullException.ThrowIfNull(configuration);
+
+        var noMergeEnabled = configuration.GetValue<bool?>("concelier:features:noMergeEnabled");
+        if (noMergeEnabled is true)
+        {
+            return services;
+        }
+
         services.TryAddSingleton<CanonicalHashCalculator>();
         services.TryAddSingleton<CanonicalMerger>();
         services.TryAddSingleton<AliasGraphResolver>();
-        services.TryAddSingleton<AffectedPackagePrecedenceResolver>(sp =>
+        services.TryAddSingleton<AffectedPackagePrecedenceResolver>(sp =>
         {
             var options = configuration.GetSection("concelier:merge:precedence").Get<AdvisoryPrecedenceOptions>();
             return options is null ? new AffectedPackagePrecedenceResolver() : new AffectedPackagePrecedenceResolver(options);

src/Concelier/__Libraries/StellaOps.Concelier.Merge/TASKS.md

@@ -1,15 +1,15 @@
-# TASKS
-| Task | Owner(s) | Depends on | Notes |
+# TASKS
+| Task | Owner(s) | Depends on | Notes |
 |---|---|---|---|
 |Link-Not-Merge version provenance coordination|BE-Merge|CONCELIER-LNM-21-001|**DONE (2025-11-04)** – Coordinated connector rollout: updated `docs/dev/normalized-rule-recipes.md` with a per-connector status table + follow-up IDs, enabled `Normalized version rules missing` diagnostics in `AdvisoryPrecedenceMerger`, and confirmed Linkset validation metrics reflect remaining upstream gaps (ACSC/CCCS/CERTBUND/Cisco/RU-BDU awaiting structured ranges).|
 |FEEDMERGE-COORD-02-901 Connector deadline check-ins|BE-Merge|FEEDMERGE-COORD-02-900|**TODO (due 2025-10-21)** – Confirm Cccs/Cisco version-provenance updates land, capture `LinksetVersionCoverage` dashboard snapshots (expect zero missing-range warnings), and update coordination docs with the results.<br>2025-10-29: Observation metrics now surface `version_entries_total`/`missing_version_entries_total`; include screenshots for both when closing this task.|
 |FEEDMERGE-COORD-02-902 ICS-CISA version comparison support|BE-Merge, Models|FEEDMERGE-COORD-02-900|**TODO (due 2025-10-23)** – Review ICS-CISA sample advisories, validate reuse of existing comparison helpers, and pre-stage Models ticket template only if a new firmware comparator is required. Document the outcome and observation coverage logs in coordination docs + tracker files.<br>2025-10-29: `docs/dev/normalized-rule-recipes.md` (§2–§3) now covers observation entries; attach decision summary + log sample when handing off to Models.|
 |FEEDMERGE-COORD-02-903 KISA firmware scheme review|BE-Merge, Models|FEEDMERGE-COORD-02-900|**TODO (due 2025-10-24)** – Pair with KISA team on proposed firmware comparison helper (`kisa.build` or variant), ensure observation mapper alignment, and open Models ticket only if a new comparator is required. Log the final helper signature and observation coverage metrics in coordination docs + tracker files.|
-
-## Link-Not-Merge v1 Transition
-| Task | Owner(s) | Depends on | Notes |
-|---|---|---|---|
+
+## Link-Not-Merge v1 Transition
+| Task | Owner(s) | Depends on | Notes |
+|---|---|---|---|
 |MERGE-LNM-21-001 Migration plan authoring|BE-Merge, Architecture Guild|CONCELIER-LNM-21-101|**DONE (2025-11-03)** – Authored `docs/migration/no-merge.md` with rollout phases, backfill/validation checklists, rollback guidance, and ownership matrix for the Link-Not-Merge cutover.|
-|MERGE-LNM-21-002 Merge service deprecation|BE-Merge|MERGE-LNM-21-001|**DOING (2025-11-03)** – Auditing service registrations, DI bindings, and tests consuming `AdvisoryMergeService`; drafting deprecation plan and analyzer scope prior to code removal.<br>2025-11-05 14:42Z: Implementing `concelier:features:noMergeEnabled` gate, merge job allowlist checks, `[Obsolete]` markings, and analyzer scaffolding to steer consumers toward linkset APIs.<br>2025-11-06 16:10Z: Introduced Roslyn analyzer (`CONCELIER0002`) referenced by Concelier WebService + tests, documented suppression guidance, and updated migration playbook.|
+|MERGE-LNM-21-002 Merge service deprecation|BE-Merge|MERGE-LNM-21-001|**DOING (2025-11-03)** – Auditing service registrations, DI bindings, and tests consuming `AdvisoryMergeService`; drafting deprecation plan and analyzer scope prior to code removal.<br>2025-11-05 14:42Z: Implementing `concelier:features:noMergeEnabled` gate, merge job allowlist checks, `[Obsolete]` markings, and analyzer scaffolding to steer consumers toward linkset APIs.<br>2025-11-06 16:10Z: Introduced Roslyn analyzer (`CONCELIER0002`) referenced by Concelier WebService + tests, documented suppression guidance, and updated migration playbook.<br>2025-11-06 23:45Z: Analyzer enforcement merged; DI removal + feature-flag default change remain. Analyzer tests compile locally but restore blocked offline (`Microsoft.Bcl.AsyncInterfaces >= 8.0` absent) — capture follow-up once nuget mirror updated.| 
 > 2025-11-03: Catalogued call sites (WebService Program `AddMergeModule`, built-in job registration `merge:reconcile`, `MergeReconcileJob`) and confirmed unit tests are the only direct `MergeAsync` callers; next step is to define analyzer + replacement observability coverage.
-|MERGE-LNM-21-003 Determinism/test updates|QA Guild, BE-Merge|MERGE-LNM-21-002|Replace merge determinism suites with observation/linkset regression tests verifying no data mutation and conflicts remain visible.|
+|MERGE-LNM-21-003 Determinism/test updates|QA Guild, BE-Merge|MERGE-LNM-21-002|Replace merge determinism suites with observation/linkset regression tests verifying no data mutation and conflicts remain visible.|

src/Concelier/__Libraries/StellaOps.Concelier.Models/Observations/AdvisoryObservation.cs

@@ -259,17 +259,27 @@ public sealed record AdvisoryObservationContent
     }
 }
 
-public sealed record AdvisoryObservationReference
-{
-    public AdvisoryObservationReference(string type, string url)
-    {
-        Type = Validation.EnsureNotNullOrWhiteSpace(type, nameof(type)).ToLowerInvariant();
-        Url = Validation.EnsureNotNullOrWhiteSpace(url, nameof(url));
-    }
-
-    public string Type { get; }
-
-    public string Url { get; }
+public sealed record AdvisoryObservationReference
+{
+    public AdvisoryObservationReference(string type, string url)
+    {
+        if (string.IsNullOrWhiteSpace(type))
+        {
+            throw new ArgumentException("Reference type cannot be null or whitespace.", nameof(type));
+        }
+
+        if (string.IsNullOrWhiteSpace(url))
+        {
+            throw new ArgumentException("Reference url cannot be null or whitespace.", nameof(url));
+        }
+
+        Type = type;
+        Url = url;
+    }
+
+    public string Type { get; }
+
+    public string Url { get; }
 }
 
 public sealed record AdvisoryObservationLinkset
@@ -304,13 +314,12 @@ public sealed record AdvisoryObservationLinkset
         var builder = ImmutableArray.CreateBuilder<string>();
         foreach (var value in values)
         {
-            var trimmed = Validation.TrimToNull(value);
-            if (trimmed is null)
+            if (value is null)
             {
                 continue;
             }
 
-            builder.Add(trimmed);
+            builder.Add(value);
         }
 
         return builder.Count == 0 ? ImmutableArray<string>.Empty : builder.ToImmutable();

src/Concelier/__Libraries/StellaOps.Concelier.Storage.Mongo/Observations/AdvisoryObservationStore.cs

@@ -1,11 +1,13 @@
-using System;
-using System.Collections.Generic;
-using System.Linq;
-using MongoDB.Driver;
-using StellaOps.Concelier.Core.Observations;
-using StellaOps.Concelier.Models.Observations;
-
-namespace StellaOps.Concelier.Storage.Mongo.Observations;
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text.RegularExpressions;
+using MongoDB.Bson;
+using MongoDB.Driver;
+using StellaOps.Concelier.Core.Observations;
+using StellaOps.Concelier.Models.Observations;
+
+namespace StellaOps.Concelier.Storage.Mongo.Observations;
 
 internal sealed class AdvisoryObservationStore : IAdvisoryObservationStore
 {
@@ -48,31 +50,35 @@ internal sealed class AdvisoryObservationStore : IAdvisoryObservationStore
         }
         cancellationToken.ThrowIfCancellationRequested();
 
-        var normalizedTenant = tenant.ToLowerInvariant();
-        var normalizedObservationIds = NormalizeValues(observationIds, static value => value);
-        var normalizedAliases = NormalizeValues(aliases, static value => value.ToLowerInvariant());
-        var normalizedPurls = NormalizeValues(purls, static value => value);
-        var normalizedCpes = NormalizeValues(cpes, static value => value);
-
-        var builder = Builders<AdvisoryObservationDocument>.Filter;
-        var filters = new List<FilterDefinition<AdvisoryObservationDocument>>
-        {
-            builder.Eq(document => document.Tenant, normalizedTenant)
+        var normalizedTenant = tenant.ToLowerInvariant();
+        var normalizedObservationIds = NormalizeValues(observationIds, static value => value);
+        var normalizedAliases = NormalizeAliasFilters(aliases);
+        var normalizedPurls = NormalizeValues(purls, static value => value);
+        var normalizedCpes = NormalizeValues(cpes, static value => value);
+
+        var builder = Builders<AdvisoryObservationDocument>.Filter;
+        var filters = new List<FilterDefinition<AdvisoryObservationDocument>>
+        {
+            builder.Eq(document => document.Tenant, normalizedTenant)
         };
 
         if (normalizedObservationIds.Length > 0)
         {
             filters.Add(builder.In(document => document.Id, normalizedObservationIds));
         }
-
-        if (normalizedAliases.Length > 0)
-        {
-            filters.Add(builder.In("linkset.aliases", normalizedAliases));
-        }
-
-        if (normalizedPurls.Length > 0)
-        {
-            filters.Add(builder.In("linkset.purls", normalizedPurls));
+
+        if (normalizedAliases.Length > 0)
+        {
+            var aliasFilters = normalizedAliases
+                .Select(alias => CreateAliasFilter(builder, alias))
+                .ToList();
+
+            filters.Add(builder.Or(aliasFilters));
+        }
+
+        if (normalizedPurls.Length > 0)
+        {
+            filters.Add(builder.In("linkset.purls", normalizedPurls));
         }
 
         if (normalizedCpes.Length > 0)
@@ -101,16 +107,16 @@ internal sealed class AdvisoryObservationStore : IAdvisoryObservationStore
             .Limit(limit)
             .ToListAsync(cancellationToken)
             .ConfigureAwait(false);
-
-        return documents.Select(AdvisoryObservationDocumentFactory.ToModel).ToArray();
-    }
-
-    private static string[] NormalizeValues(IEnumerable<string>? values, Func<string, string> projector)
-    {
-        if (values is null)
-        {
-            return Array.Empty<string>();
-        }
+
+        return documents.Select(AdvisoryObservationDocumentFactory.ToModel).ToArray();
+    }
+
+    private static string[] NormalizeValues(IEnumerable<string>? values, Func<string, string> projector)
+    {
+        if (values is null)
+        {
+            return Array.Empty<string>();
+        }
 
         var set = new HashSet<string>(StringComparer.Ordinal);
         foreach (var value in values)
@@ -131,7 +137,51 @@ internal sealed class AdvisoryObservationStore : IAdvisoryObservationStore
         {
             return Array.Empty<string>();
         }
-
-        return set.ToArray();
-    }
-}
+
+        return set.ToArray();
+    }
+
+    private static string[] NormalizeAliasFilters(IEnumerable<string>? aliases)
+    {
+        if (aliases is null)
+        {
+            return Array.Empty<string>();
+        }
+
+        var set = new HashSet<string>(StringComparer.OrdinalIgnoreCase);
+        var list = new List<string>();
+
+        foreach (var alias in aliases)
+        {
+            if (alias is null)
+            {
+                continue;
+            }
+
+            var trimmed = alias.Trim();
+            if (trimmed.Length == 0)
+            {
+                continue;
+            }
+
+            if (set.Add(trimmed))
+            {
+                list.Add(trimmed);
+            }
+        }
+
+        return list.Count == 0 ? Array.Empty<string>() : list.ToArray();
+    }
+
+    private static FilterDefinition<AdvisoryObservationDocument> CreateAliasFilter(
+        FilterDefinitionBuilder<AdvisoryObservationDocument> builder,
+        string alias)
+    {
+        var escaped = Regex.Escape(alias);
+        var regex = new BsonRegularExpression($"^{escaped}$", "i");
+
+        return builder.Or(
+            builder.Regex("rawLinkset.aliases", regex),
+            builder.Regex("linkset.aliases", regex));
+    }
+}

src/Concelier/__Tests/StellaOps.Concelier.Core.Tests/Linksets/AdvisoryObservationFactoryTests.cs

@@ -42,13 +42,17 @@ public sealed class AdvisoryObservationFactoryTests
         Assert.Equal(
             new[] { "cpe:/a:Example:Product:1.0", "cpe:/a:example:product:1.0" },
             observation.Linkset.Cpes);
-        Assert.Equal(2, observation.Linkset.References.Length);
-        Assert.All(
+        Assert.Collection(
             observation.Linkset.References,
-            reference =>
+            first =>
             {
-                Assert.Equal("advisory", reference.Type);
-                Assert.Equal("https://example.test/advisory", reference.Url);
+                Assert.Equal("Advisory", first.Type);
+                Assert.Equal("https://example.test/advisory", first.Url);
+            },
+            second =>
+            {
+                Assert.Equal("ADVISORY", second.Type);
+                Assert.Equal("https://example.test/advisory", second.Url);
             });
 
         Assert.Equal(

src/Concelier/__Tests/StellaOps.Concelier.Core.Tests/Observations/AdvisoryObservationQueryServiceTests.cs

@@ -311,7 +311,7 @@ public sealed class AdvisoryObservationQueryServiceTests
             }
 
             var observationIdSet = observationIds.ToImmutableHashSet(StringComparer.Ordinal);
-            var aliasSet = aliases.ToImmutableHashSet(StringComparer.Ordinal);
+            var aliasSet = aliases.ToImmutableHashSet(StringComparer.OrdinalIgnoreCase);
             var purlSet = purls.ToImmutableHashSet(StringComparer.Ordinal);
             var cpeSet = cpes.ToImmutableHashSet(StringComparer.Ordinal);
             var filtered = observations

src/Concelier/__Tests/StellaOps.Concelier.Merge.Analyzers.Tests/MergeUsageAnalyzerTests.cs

@@ -0,0 +1,165 @@
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Linq;
+using System.Reflection;
+using System.Threading.Tasks;
+using Microsoft.CodeAnalysis;
+using Microsoft.CodeAnalysis.CSharp;
+using Microsoft.CodeAnalysis.Diagnostics;
+
+namespace StellaOps.Concelier.Merge.Analyzers.Tests;
+
+public sealed class MergeUsageAnalyzerTests
+{
+    [Fact]
+    public async Task ReportsDiagnostic_ForAdvisoryMergeServiceInstantiation()
+    {
+        const string source = """
+            using StellaOps.Concelier.Merge.Services;
+
+            namespace Sample.App;
+
+            public sealed class Demo
+            {
+                public void Run()
+                {
+                    var merge = new AdvisoryMergeService();
+                }
+            }
+            """;
+
+        var diagnostics = await AnalyzeAsync(source, "Sample.App");
+        Assert.Contains(diagnostics, d => d.Id == MergeUsageAnalyzer.DiagnosticId && d.GetMessage().Contains("AdvisoryMergeService", StringComparison.Ordinal));
+    }
+
+    [Fact]
+    public async Task ReportsDiagnostic_ForAddMergeModuleInvocation()
+    {
+        const string source = """
+            using Microsoft.Extensions.Configuration;
+            using Microsoft.Extensions.DependencyInjection;
+            using StellaOps.Concelier.Merge;
+
+            namespace Sample.Services;
+
+            public static class Installer
+            {
+                public static void Configure(IServiceCollection services, IConfiguration configuration)
+                {
+                    services.AddMergeModule(configuration);
+                }
+            }
+            """;
+
+        var diagnostics = await AnalyzeAsync(source, "Sample.Services");
+        Assert.Contains(diagnostics, d => d.Id == MergeUsageAnalyzer.DiagnosticId && d.GetMessage().Contains("AddMergeModule", StringComparison.Ordinal));
+    }
+
+    [Fact]
+    public async Task ReportsDiagnostic_ForFieldDeclaration()
+    {
+        const string source = """
+            using StellaOps.Concelier.Merge.Services;
+
+            namespace Sample.Library;
+
+            public sealed class Demo
+            {
+                private AdvisoryMergeService? _mergeService;
+            }
+            """;
+
+        var diagnostics = await AnalyzeAsync(source, "Sample.Library");
+        Assert.Contains(diagnostics, d => d.Id == MergeUsageAnalyzer.DiagnosticId);
+    }
+
+    [Fact]
+    public async Task DoesNotReportDiagnostic_InsideMergeAssembly()
+    {
+        const string source = """
+            using StellaOps.Concelier.Merge.Services;
+
+            namespace StellaOps.Concelier.Merge.Internal;
+
+            internal static class MergeDiagnostics
+            {
+                public static AdvisoryMergeService Create() => new AdvisoryMergeService();
+            }
+            """;
+
+        var diagnostics = await AnalyzeAsync(source, "StellaOps.Concelier.Merge");
+        Assert.DoesNotContain(diagnostics, d => d.Id == MergeUsageAnalyzer.DiagnosticId);
+    }
+
+    [Fact]
+    public async Task ReportsDiagnostic_ForTypeOfUsage()
+    {
+        const string source = """
+            using System;
+            using StellaOps.Concelier.Merge.Services;
+
+            namespace Sample.TypeOf;
+
+            public static class Demo
+            {
+                public static Type TargetType => typeof(AdvisoryMergeService);
+            }
+            """;
+
+        var diagnostics = await AnalyzeAsync(source, "Sample.TypeOf");
+        Assert.Contains(diagnostics, d => d.Id == MergeUsageAnalyzer.DiagnosticId);
+    }
+
+    private static async Task<ImmutableArray<Diagnostic>> AnalyzeAsync(string source, string assemblyName)
+    {
+        var compilation = CSharpCompilation.Create(
+            assemblyName,
+            new[]
+            {
+                CSharpSyntaxTree.ParseText(source),
+                CSharpSyntaxTree.ParseText(Stubs)
+            },
+            CreateMetadataReferences(),
+            new CSharpCompilationOptions(OutputKind.DynamicallyLinkedLibrary));
+
+        var analyzer = new MergeUsageAnalyzer();
+        var compilationWithAnalyzers = compilation.WithAnalyzers(ImmutableArray.Create<DiagnosticAnalyzer>(analyzer));
+        return await compilationWithAnalyzers.GetAnalyzerDiagnosticsAsync();
+    }
+
+    private static IEnumerable<MetadataReference> CreateMetadataReferences()
+    {
+        yield return MetadataReference.CreateFromFile(typeof(object).GetTypeInfo().Assembly.Location);
+        yield return MetadataReference.CreateFromFile(typeof(Enumerable).GetTypeInfo().Assembly.Location);
+    }
+
+    private const string Stubs = """
+        namespace Microsoft.Extensions.DependencyInjection
+        {
+            public interface IServiceCollection { }
+        }
+
+        namespace Microsoft.Extensions.Configuration
+        {
+            public interface IConfiguration { }
+        }
+
+        namespace StellaOps.Concelier.Merge.Services
+        {
+            public sealed class AdvisoryMergeService { }
+        }
+
+        namespace StellaOps.Concelier.Merge
+        {
+            public static class MergeServiceCollectionExtensions
+            {
+                public static void AddMergeModule(
+                    this Microsoft.Extensions.DependencyInjection.IServiceCollection services,
+                    Microsoft.Extensions.Configuration.IConfiguration configuration)
+                {
+                }
+            }
+        }
+        """;
+}

src/Concelier/__Tests/StellaOps.Concelier.Merge.Analyzers.Tests/StellaOps.Concelier.Merge.Analyzers.Tests.csproj

@@ -0,0 +1,26 @@
+<Project Sdk="Microsoft.NET.Sdk">
+
+  <PropertyGroup>
+    <TargetFramework>net10.0</TargetFramework>
+    <ImplicitUsings>enable</ImplicitUsings>
+    <Nullable>enable</Nullable>
+    <IsPackable>false</IsPackable>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <PackageReference Include="coverlet.collector" Version="6.0.4" />
+    <PackageReference Include="Microsoft.CodeAnalysis.CSharp" Version="4.0.1" PrivateAssets="all" />
+    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.14.0" />
+    <PackageReference Include="xunit" Version="2.9.2" />
+    <PackageReference Include="xunit.runner.visualstudio" Version="2.8.2" />
+  </ItemGroup>
+
+  <ItemGroup>
+    <Using Include="Xunit" />
+  </ItemGroup>
+
+  <ItemGroup>
+    <ProjectReference Include="..\\..\\__Analyzers\\StellaOps.Concelier.Merge.Analyzers\\StellaOps.Concelier.Merge.Analyzers.csproj" />
+  </ItemGroup>
+
+</Project>

src/Concelier/__Tests/StellaOps.Concelier.Models.Tests/Observations/AdvisoryObservationTests.cs

@@ -63,11 +63,14 @@ public sealed class AdvisoryObservationTests
 
         Assert.Equal("tenant-a:CVE-2025-1234:1", observation.ObservationId);
         Assert.Equal("tenant-a", observation.Tenant);
-        Assert.Equal("Vendor", observation.Source.Vendor);
-        Assert.Equal(new[] { "cpe:/a:vendor:product:1" }, observation.Linkset.Cpes);
-        Assert.Single(observation.Linkset.References);
-        Assert.Equal("https://example.com/advisory", observation.Linkset.References[0].Url);
-        Assert.Equal(DateTimeOffset.Parse("2025-10-01T01:00:06Z"), observation.CreatedAt);
-        Assert.Equal("emea", observation.Attributes["region"]);
-    }
-}
+        Assert.Equal("Vendor", observation.Source.Vendor);
+        Assert.Equal(new[] { " Cve-2025-1234 ", "cve-2025-1234" }, observation.Linkset.Aliases.ToArray());
+        Assert.Equal(new[] { "cpe:/a:vendor:product:1" }, observation.Linkset.Cpes);
+        Assert.Equal(2, observation.Linkset.References.Length);
+        Assert.Equal("ADVISORY", observation.Linkset.References[0].Type);
+        Assert.Equal("https://example.com/advisory", observation.Linkset.References[0].Url);
+        Assert.Equal(rawLinkset.Aliases, observation.RawLinkset.Aliases);
+        Assert.Equal(DateTimeOffset.Parse("2025-10-01T01:00:06Z"), observation.CreatedAt);
+        Assert.Equal("emea", observation.Attributes["region"]);
+    }
+}

src/Concelier/__Tests/StellaOps.Concelier.Storage.Mongo.Tests/Observations/AdvisoryObservationDocumentFactoryTests.cs

@@ -71,11 +71,12 @@ public sealed class AdvisoryObservationDocumentFactoryTests
 
         Assert.Equal("tenant-a:obs-1", observation.ObservationId);
         Assert.Equal("tenant-a", observation.Tenant);
-        Assert.Equal("CVE-2025-1234", observation.Upstream.UpstreamId);
+        Assert.Equal("CVE-2025-1234", observation.Upstream.UpstreamId);
+        Assert.Equal(new[] { "CVE-2025-1234" }, observation.Linkset.Aliases.ToArray());
         Assert.Contains("pkg:generic/foo@1.0.0", observation.Linkset.Purls);
         Assert.Equal("CSAF", observation.Content.Format);
         Assert.True(observation.Content.Raw?["example"]?.GetValue<bool>());
-        Assert.Equal("advisory", observation.Linkset.References[0].Type);
+        Assert.Equal(document.Linkset.References![0].Type, observation.Linkset.References[0].Type);
         Assert.Equal(new[] { "CVE-2025-1234", "cve-2025-1234" }, observation.RawLinkset.Aliases);
         Assert.Equal("Advisory", observation.RawLinkset.References[0].Type);
         Assert.Equal("vendor", observation.RawLinkset.References[0].Source);

src/Concelier/__Tests/StellaOps.Concelier.Storage.Mongo.Tests/Observations/AdvisoryObservationStoreTests.cs

@@ -31,22 +31,22 @@ public sealed class AdvisoryObservationStoreTests : IClassFixture<MongoIntegrati
         var collection = _fixture.Database.GetCollection<AdvisoryObservationDocument>(MongoStorageDefaults.Collections.AdvisoryObservations);
         await collection.InsertManyAsync(new[]
         {
-            CreateDocument(
-                id: "tenant-a:nvd:alpha:1",
-                tenant: "tenant-a",
-                createdAt: new DateTime(2025, 1, 1, 0, 0, 0, DateTimeKind.Utc),
-                aliases: new[] { "cve-2025-0001" },
-                purls: new[] { "pkg:npm/demo@1.0.0" }),
-            CreateDocument(
-                id: "tenant-a:ghsa:beta:1",
-                tenant: "tenant-a",
-                createdAt: new DateTime(2025, 1, 2, 0, 0, 0, DateTimeKind.Utc),
-                aliases: new[] { "ghsa-xyz0", "cve-2025-0001" },
-                purls: new[] { "pkg:npm/demo@1.1.0" }),
-            CreateDocument(
-                id: "tenant-b:nvd:alpha:1",
-                tenant: "tenant-b",
-                createdAt: new DateTime(2025, 1, 3, 0, 0, 0, DateTimeKind.Utc),
+            CreateDocument(
+                id: "tenant-a:nvd:alpha:1",
+                tenant: "tenant-a",
+                createdAt: new DateTime(2025, 1, 1, 0, 0, 0, DateTimeKind.Utc),
+                aliases: new[] { "CvE-2025-0001 " },
+                purls: new[] { "pkg:npm/demo@1.0.0" }),
+            CreateDocument(
+                id: "tenant-a:ghsa:beta:1",
+                tenant: "tenant-a",
+                createdAt: new DateTime(2025, 1, 2, 0, 0, 0, DateTimeKind.Utc),
+                aliases: new[] { " ghsa-xyz0", "cve-2025-0001" },
+                purls: new[] { "pkg:npm/demo@1.1.0" }),
+            CreateDocument(
+                id: "tenant-b:nvd:alpha:1",
+                tenant: "tenant-b",
+                createdAt: new DateTime(2025, 1, 3, 0, 0, 0, DateTimeKind.Utc),
                 aliases: new[] { "cve-2025-0001" },
                 purls: new[] { "pkg:npm/demo@2.0.0" })
         });
@@ -62,11 +62,15 @@ public sealed class AdvisoryObservationStoreTests : IClassFixture<MongoIntegrati
             limit: 5,
             CancellationToken.None);
 
-        Assert.Equal(2, result.Count);
-        Assert.Equal("tenant-a:ghsa:beta:1", result[0].ObservationId);
-        Assert.Equal("tenant-a:nvd:alpha:1", result[1].ObservationId);
-        Assert.All(result, observation => Assert.Equal("tenant-a", observation.Tenant));
-    }
+        Assert.Equal(2, result.Count);
+        Assert.Equal("tenant-a:ghsa:beta:1", result[0].ObservationId);
+        Assert.Equal("tenant-a:nvd:alpha:1", result[1].ObservationId);
+        Assert.All(result, observation => Assert.Equal("tenant-a", observation.Tenant));
+        Assert.Equal("ghsa-xyz0", result[0].Linkset.Aliases[0]);
+        Assert.Equal("CvE-2025-0001", result[1].Linkset.Aliases[0]);
+        Assert.Equal(" ghsa-xyz0", result[0].RawLinkset.Aliases[0]);
+        Assert.Equal("CvE-2025-0001 ", result[1].RawLinkset.Aliases[0]);
+    }
 
     [Fact]
     public async Task FindByFiltersAsync_RespectsObservationIdsAndPurls()
@@ -166,12 +170,39 @@ public sealed class AdvisoryObservationStoreTests : IClassFixture<MongoIntegrati
         IEnumerable<string>? purls = null,
         IEnumerable<string>? cpes = null)
     {
-        return new AdvisoryObservationDocument
-        {
-            Id = id,
-            Tenant = tenant.ToLowerInvariant(),
-            CreatedAt = createdAt,
-            Source = new AdvisoryObservationSourceDocument
+        var canonicalAliases = aliases?
+            .Where(value => value is not null)
+            .Select(value => value.Trim())
+            .ToList();
+
+        var canonicalPurls = purls?
+            .Where(value => value is not null)
+            .Select(value => value.Trim())
+            .ToList();
+
+        var canonicalCpes = cpes?
+            .Where(value => value is not null)
+            .Select(value => value.Trim())
+            .ToList();
+
+        var rawAliases = aliases?
+            .Where(value => value is not null)
+            .ToList();
+
+        var rawPurls = purls?
+            .Where(value => value is not null)
+            .ToList();
+
+        var rawCpes = cpes?
+            .Where(value => value is not null)
+            .ToList();
+
+        return new AdvisoryObservationDocument
+        {
+            Id = id,
+            Tenant = tenant.ToLowerInvariant(),
+            CreatedAt = createdAt,
+            Source = new AdvisoryObservationSourceDocument
             {
                 Vendor = "nvd",
                 Stream = "feed",
@@ -189,24 +220,31 @@ public sealed class AdvisoryObservationStoreTests : IClassFixture<MongoIntegrati
                     Present = false
                 },
                 Metadata = new Dictionary<string, string>(StringComparer.Ordinal)
-            },
-            Content = new AdvisoryObservationContentDocument
-            {
-                Format = "csaf",
-                SpecVersion = "2.0",
-                Raw = BsonDocument.Parse("""{"id": "%ID%"}""".Replace("%ID%", id)),
-                Metadata = new Dictionary<string, string>(StringComparer.Ordinal)
-            },
-            Linkset = new AdvisoryObservationLinksetDocument
-            {
-                Aliases = aliases?.Select(value => value.Trim()).ToList(),
-                Purls = purls?.Select(value => value.Trim()).ToList(),
-                Cpes = cpes?.Select(value => value.Trim()).ToList(),
-                References = new List<AdvisoryObservationReferenceDocument>()
-            },
-            Attributes = new Dictionary<string, string>(StringComparer.Ordinal)
-        };
-    }
+            },
+            Content = new AdvisoryObservationContentDocument
+            {
+                Format = "csaf",
+                SpecVersion = "2.0",
+                Raw = BsonDocument.Parse("""{"id": "%ID%"}""".Replace("%ID%", id)),
+                Metadata = new Dictionary<string, string>(StringComparer.Ordinal)
+            },
+            Linkset = new AdvisoryObservationLinksetDocument
+            {
+                Aliases = canonicalAliases,
+                Purls = canonicalPurls,
+                Cpes = canonicalCpes,
+                References = new List<AdvisoryObservationReferenceDocument>()
+            },
+            RawLinkset = new AdvisoryObservationRawLinksetDocument
+            {
+                Aliases = rawAliases,
+                PackageUrls = rawPurls,
+                Cpes = rawCpes,
+                References = new List<AdvisoryObservationRawReferenceDocument>()
+            },
+            Attributes = new Dictionary<string, string>(StringComparer.Ordinal)
+        };
+    }
 
     private async Task ResetCollectionAsync()
     {

src/Concelier/__Tests/StellaOps.Concelier.WebService.Tests/StellaOps.Concelier.WebService.Tests.csproj

@@ -10,7 +10,7 @@
     <ProjectReference Include="../../__Libraries/StellaOps.Concelier.Storage.Mongo/StellaOps.Concelier.Storage.Mongo.csproj" />
     <ProjectReference Include="../../StellaOps.Concelier.WebService/StellaOps.Concelier.WebService.csproj" />
     <ProjectReference Include="../../../__Libraries/StellaOps.Plugin/StellaOps.Plugin.csproj" />
-    <ProjectReference Include="../../__Analyzers/StellaOps.Concelier.Analyzers/StellaOps.Concelier.Analyzers.csproj"
+    <ProjectReference Include="../../__Analyzers/StellaOps.Concelier.Merge.Analyzers/StellaOps.Concelier.Merge.Analyzers.csproj"
                       OutputItemType="Analyzer"
                       ReferenceOutputAssembly="false" />
   </ItemGroup>

src/Concelier/__Tests/StellaOps.Concelier.WebService.Tests/WebServiceEndpointsTests.cs

@@ -1183,19 +1183,19 @@ public sealed class WebServiceEndpointsTests : IAsyncLifetime
             },
             Linkset = new AdvisoryObservationLinksetDocument
             {
-                Aliases = aliases?.Select(value => value.Trim().ToLowerInvariant()).ToList(),
-                Purls = purls?.Select(value => value.Trim()).ToList(),
-                Cpes = cpes?.Select(value => value.Trim()).ToList(),
-                References = references is null
-                    ? new List<AdvisoryObservationReferenceDocument>()
-                    : references
-                        .Select(reference => new AdvisoryObservationReferenceDocument
-                        {
-                            Type = reference.Type.Trim().ToLowerInvariant(),
-                            Url = reference.Url.Trim()
-                        })
-                        .ToList()
-            },
+                Aliases = aliases?.Where(value => value is not null).ToList(),
+                Purls = purls?.Where(value => value is not null).ToList(),
+                Cpes = cpes?.Where(value => value is not null).ToList(),
+                References = references is null
+                    ? new List<AdvisoryObservationReferenceDocument>()
+                    : references
+                        .Select(reference => new AdvisoryObservationReferenceDocument
+                        {
+                            Type = reference.Type,
+                            Url = reference.Url
+                        })
+                        .ToList()
+            },
             Attributes = new Dictionary<string, string>(StringComparer.Ordinal)
         };
     }