feat(metrics): Add new histograms for chunk latency, results, and sources in AdvisoryAiMetrics

feat(telemetry): Record chunk latency, result count, and source count in AdvisoryAiTelemetry

fix(endpoint): Include telemetry source count in advisory chunks endpoint response

test(metrics): Enhance WebServiceEndpointsTests to validate new metrics for chunk latency, results, and sources

refactor(tests): Update test utilities for Deno language analyzer tests

chore(tests): Add performance tests for AdvisoryGuardrail with scenarios and blocked phrases

docs: Archive Sprint 137 design document for scanner and surface enhancements

docs/implplan/SPRINT_110_ingestion_evidence.md

@@ -17,9 +17,11 @@ Active items only. Completed/historic work now resides in docs/implplan/archived
   - 2025-11-09: AIAI-31-009 remains DOING after converting the guardrail harness into JSON fixtures, expanding property/perf coverage, and validating offline cache seeding; remote inference packaging (AIAI-31-008) is still TODO until the policy knob work in AIAI-31-006..007 completes.
   - 2025-11-09: DOCS-AIAI-31-004 continues DOING—guardrail/offline sections are drafted, but screenshots plus copy blocks wait on CONSOLE-VULN-29-001, CONSOLE-VEX-30-001, and EXCITITOR-CONSOLE-23-001.
   - SBOM-AIAI-31-003 and DOCS-AIAI-31-005/006/008/009 remain BLOCKED pending SBOM-AIAI-31-001, CLI-VULN-29-001, CLI-VEX-30-001, POLICY-ENGINE-31-001, and DEVOPS-AIAI-31-001.
+  - 2025-11-10: AIAI-31-009 performance suite doubled dataset coverage (blocked phrase seed + perf scenarios) and now enforces sub-400 ms guardrail batches so Advisory AI can cite deterministic budgets.
 - **Concelier (110.B)** – `/advisories/{advisoryKey}/chunks` shipped on 2025-11-07 with tenant enforcement, chunk tuning knobs, and regression fixtures; structured field/caching work (CONCELIER-AIAI-31-002) is still TODO while telemetry/guardrail instrumentation (CONCELIER-AIAI-31-003) is DOING.
   - Air-gap provenance/staleness bundles (`CONCELIER-AIRGAP-56-001` → `CONCELIER-AIRGAP-58-001`), console views/deltas (`CONCELIER-CONSOLE-23-001..003`), and attestation metadata (`CONCELIER-ATTEST-73-001/002`) remain TODO pending Link-Not-Merge plus Cartographer schema delivery.
   - Connector provenance refreshes `FEEDCONN-ICSCISA-02-012` and `FEEDCONN-KISA-02-008` are still overdue, leaving evidence parity gaps for those feeds.
+  - 2025-11-10: CONCELIER-AIAI-31-003 shipped cache/request histograms + guardrail counters/log scopes; docs now map the new metrics for Advisory AI dashboards.
 - **Excititor (110.C)** – Normalized VEX justification projections (EXCITITOR-AIAI-31-001) are DOING as of 2025-11-09; the downstream chunk API (EXCITITOR-AIAI-31-002), telemetry/guardrails (EXCITITOR-AIAI-31-003), docs/OpenAPI alignment (EXCITITOR-AIAI-31-004), and attestation payload work (`EXCITITOR-ATTEST-*`) stay TODO until that projection work plus Link-Not-Merge schema land.
   - Mirror/air-gap backlog (`EXCITITOR-AIRGAP-56-001` .. `EXCITITOR-AIRGAP-58-001`) and connector provenance parity (`EXCITITOR-CONN-TRUST-01-001`) remain unscheduled, so Advisory AI cannot yet hydrate sealed VEX evidence or cite connector signatures.
 - **Mirror (110.D)** – MIRROR-CRT-56-001 (deterministic bundle assembler) has not kicked off, so DSSE/TUF (MIRROR-CRT-56-002), OCI exports (MIRROR-CRT-57-001), time anchors (MIRROR-CRT-57-002), CLI verbs (MIRROR-CRT-58-001), and Export Center automation (MIRROR-CRT-58-002) are all blocked.

docs/implplan/SPRINT_111_advisoryai.md

@@ -5,8 +5,18 @@ Active items only. Completed/historic work now resides in docs/implplan/archived
 [Ingestion & Evidence] 110.A) AdvisoryAI
 Depends on: Sprint 100.A - Attestor
 Summary: Ingestion & Evidence focus on AdvisoryAI.
+
 Task ID | State | Task description | Owners (Source)
 --- | --- | --- | ---
+DOCS-AIAI-31-006 | BLOCKED (2025-11-03) | Update `/docs/policy/assistant-parameters.md` covering temperature, token limits, ranking weights, TTLs. Dependencies: POLICY-ENGINE-31-001. | Docs Guild, Policy Guild (docs)
+DOCS-AIAI-31-008 | BLOCKED (2025-11-03) | Publish `/docs/sbom/remediation-heuristics.md` (feasibility scoring, blast radius). Dependencies: SBOM-AIAI-31-001. | Docs Guild, SBOM Service Guild (docs)
+DOCS-AIAI-31-009 | BLOCKED (2025-11-03) | Create `/docs/runbooks/assistant-ops.md` for warmup, cache priming, model outages, scaling. Dependencies: DEVOPS-AIAI-31-001. | Docs Guild, DevOps Guild (docs)
+SBOM-AIAI-31-003 | TODO (2025-11-03) | Publish the Advisory AI hand-off kit for `/v1/sbom/context`, share base URL/API key + tenant header contract, and run a joint end-to-end retrieval smoke test with Advisory AI. Dependencies: SBOM-AIAI-31-001. | SBOM Service Guild, Advisory AI Guild (src/SbomService/StellaOps.SbomService)
+AIAI-31-008 | TODO | Package inference on-prem container, remote inference toggle, Helm/Compose manifests, scaling guidance, offline kit instructions. Dependencies: AIAI-31-006..007. | Advisory AI Guild, DevOps Guild (src/AdvisoryAI/StellaOps.AdvisoryAI)
+AIAI-31-009 | DOING (2025-11-09) | Develop unit/golden/property/perf tests, injection harness, and regression suite; ensure determinism with seeded caches. Dependencies: AIAI-31-001..006. | Advisory AI Guild, QA Guild (src/AdvisoryAI/StellaOps.AdvisoryAI) |
+
+
+
 > 2025-11-03: WebService/Worker scaffolds created with in-memory cache/queue, minimal APIs (`/api/v1/advisory/plan`, `/api/v1/advisory/queue`), metrics counters, and plan cache instrumentation; worker processes queue using orchestrator.
 > 2025-11-04: SBOM base address now flows via `SbomContextClientOptions.BaseAddress`, worker emits queue/plan metrics, and orchestrator cache keys expanded to cover SBOM hash inputs.
 DOCS-AIAI-31-004 | DOING (2025-11-07) | Create `/docs/advisory-ai/console.md` with screenshots, a11y notes, copy-as-ticket instructions. Dependencies: CONSOLE-VULN-29-001, CONSOLE-VEX-30-001, EXCITITOR-CONSOLE-23-001. | Docs Guild, Console Guild (docs)
@@ -14,10 +24,6 @@ DOCS-AIAI-31-004 | DOING (2025-11-07) | Create `/docs/advisory-ai/console.md` wi
 > 2025-11-08: Console endpoints are staffed (CONSOLE-VULN-29-001 / CONSOLE-VEX-30-001 DOING); still waiting on EXCITITOR-CONSOLE-23-001 feeds before capturing screenshots/tests.
 > 2025-11-09: Guardrail/inference sections and offline playbooks documented; screenshot placeholders remain open.
 DOCS-AIAI-31-005 | BLOCKED (2025-11-03) | Publish `/docs/advisory-ai/cli.md` covering commands, exit codes, scripting patterns. Dependencies: CLI-VULN-29-001, CLI-VEX-30-001, AIAI-31-004C. | Docs Guild, DevEx/CLI Guild (docs)
-DOCS-AIAI-31-006 | BLOCKED (2025-11-03) | Update `/docs/policy/assistant-parameters.md` covering temperature, token limits, ranking weights, TTLs. Dependencies: POLICY-ENGINE-31-001. | Docs Guild, Policy Guild (docs)
-DOCS-AIAI-31-008 | BLOCKED (2025-11-03) | Publish `/docs/sbom/remediation-heuristics.md` (feasibility scoring, blast radius). Dependencies: SBOM-AIAI-31-001. | Docs Guild, SBOM Service Guild (docs)
-DOCS-AIAI-31-009 | BLOCKED (2025-11-03) | Create `/docs/runbooks/assistant-ops.md` for warmup, cache priming, model outages, scaling. Dependencies: DEVOPS-AIAI-31-001. | Docs Guild, DevOps Guild (docs)
-SBOM-AIAI-31-003 | TODO (2025-11-03) | Publish the Advisory AI hand-off kit for `/v1/sbom/context`, share base URL/API key + tenant header contract, and run a joint end-to-end retrieval smoke test with Advisory AI. Dependencies: SBOM-AIAI-31-001. | SBOM Service Guild, Advisory AI Guild (src/SbomService/StellaOps.SbomService)
 > 2025-11-03: DOCS-AIAI-31-003 moved to DOING – drafting Advisory AI API reference (endpoints, rate limits, error model) for sprint 110.
 > 2025-11-04: AIAI-31-005 DONE – guardrail pipeline redacts secrets, enforces citation/injection policies, emits block counters, and tests (`AdvisoryGuardrailPipelineTests`) cover redaction + citation validation.
 > 2025-11-03: DOCS-AIAI-31-003 marked DONE – `docs/advisory-ai/api.md` published with scopes, request/response schemas, rate limits, and error catalogue (Docs Guild).
@@ -31,12 +37,8 @@ SBOM-AIAI-31-003 | TODO (2025-11-03) | Publish the Advisory AI hand-off kit for
 > 2025-11-03: DOCS-AIAI-31-009 marked BLOCKED – DevOps runbook inputs (DEVOPS-AIAI-31-001) outstanding.
 > 2025-11-03: Shipped `/api/v1/advisory/{task}` execution and `/api/v1/advisory/outputs/{cacheKey}` retrieval endpoints with guardrail integration, provenance hashes, and metrics (RBAC & rate limiting still pending Authority scope delivery).
 > 2025-11-06: AIAI-31-007 completed – Advisory AI WebService/Worker emit latency histograms, guardrail/validation counters, citation coverage ratios, and OTEL spans; Grafana dashboard + burn-rate alerts refreshed.
-AIAI-31-008 | TODO | Package inference on-prem container, remote inference toggle, Helm/Compose manifests, scaling guidance, offline kit instructions. Dependencies: AIAI-31-006..007. | Advisory AI Guild, DevOps Guild (src/AdvisoryAI/StellaOps.AdvisoryAI)
-AIAI-31-009 | DOING (2025-11-09) | Develop unit/golden/property/perf tests, injection harness, and regression suite; ensure determinism with seeded caches. Dependencies: AIAI-31-001..006. | Advisory AI Guild, QA Guild (src/AdvisoryAI/StellaOps.AdvisoryAI)
+
 > 2025-11-09: Guardrail harness converted to JSON fixtures + legacy payloads, property-style plan cache load tests added, and file-system cache/output suites cover seeded/offline scenarios.
-
-
-
 > 2025-11-02: AIAI-31-004 kicked off orchestration pipeline design – establishing deterministic task sequence (summary/conflict/remediation) and cache key strategy.
 > 2025-11-02: AIAI-31-004 orchestration prerequisites documented in docs/modules/advisory-ai/orchestration-pipeline.md (tasks 004A/004B/004C).
 > 2025-11-02: AIAI-31-003 moved to DOING – beginning deterministic tooling (comparators, dependency analysis) while awaiting SBOM context client. Semantic & EVR comparators shipped; toolset interface published for orchestrator adoption.

docs/implplan/execution-waves.md

@@ -9,9 +9,7 @@ Each wave groups sprints that declare the same leading dependency. Start waves o
 - Shared prerequisite(s): None (explicit)
 - Parallelism guidance: No upstream sprint recorded; confirm module AGENTS and readiness gates before parallel execution.
 - Sprints:
-  - SPRINT_110_ingestion_evidence.md — Sprint 110 - Ingestion & Evidence. Done.
   - SPRINT_130_scanner_surface.md — Sprint 130 - Scanner & Surface. Done.
-  - SPRINT_137_scanner_gap_design.md — Sprint 137 - Scanner & Surface. Done.
   - SPRINT_138_scanner_ruby_parity.md — Sprint 138 - Scanner & Surface. In progress.
   - SPRINT_140_runtime_signals.md — Sprint 140 - Runtime & Signals. In progress.
   - SPRINT_150_scheduling_automation.md — Sprint 150 - Scheduling & Automation

docs/observability/observability.md

@@ -150,6 +150,20 @@ Logs are shipped to the central Loki/Elasticsearch cluster. Use the template que
 
 to spot active AOC violations.
 
+### 1.3 · Advisory chunk API (Advisory AI feeds)
+
+Advisory AI now leans on Concelier’s `/advisories/{key}/chunks` endpoint for deterministic evidence packs. The service exports dedicated metrics so dashboards can highlight latency spikes, cache noise, or aggressive guardrail filtering before they impact Advisory AI responses.
+
+| Metric | Type | Labels | Description |
+| --- | --- | --- | --- |
+| `advisory_ai_chunk_requests_total` | Counter | `tenant`, `result`, `truncated`, `cache` | Count of chunk API calls, tagged with cache hits/misses and truncation state. |
+| `advisory_ai_chunk_latency_milliseconds` | Histogram | `tenant`, `result`, `truncated`, `cache` | End-to-end build latency (milliseconds) for each chunk request. |
+| `advisory_ai_chunk_segments` | Histogram | `tenant`, `result`, `truncated` | Number of chunk segments returned to the caller; watch for sudden drops tied to guardrails. |
+| `advisory_ai_chunk_sources` | Histogram | `tenant`, `result` | How many upstream observations/sources contributed to a response (after observation limits). |
+| `advisory_ai_guardrail_blocks_total` | Counter | `tenant`, `reason`, `cache` | Per-reason count of segments suppressed by guardrails (length, normalization, character set). |
+
+Dashboards should plot latency P95/P99 next to cache hit rates and guardrail block deltas to catch degradation early. Advisory AI CLI/Console surfaces the same metadata so support engineers can correlate with Grafana/Loki entries using `traceId`/`correlationId` headers.
+
 ---
 
 ## 4 · Dashboards

docs/updates/2025-11-07-concelier-advisory-chunks.md

@@ -9,4 +9,4 @@
 
 **Follow-ups**
 - [ ] CONCELIER-AIAI-31-002 – surface structured workaround/fix fields plus caching for downstream retrievers.
-- [ ] CONCELIER-AIAI-31-003 – wire chunk request metrics/logs and guardrail telemetry once the API stabilizes.
+- [x] CONCELIER-AIAI-31-003 – wire chunk request metrics/logs and guardrail telemetry once the API stabilizes. (2025-11-10: request/latency/source histograms + structured guardrail logs shipped.)

src/AdvisoryAI/__Tests/StellaOps.AdvisoryAI.Tests/AdvisoryGuardrailPerformanceTests.cs

@@ -0,0 +1,140 @@
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Diagnostics;
+using System.IO;
+using System.Linq;
+using System.Text;
+using System.Text.Json;
+using System.Threading;
+using System.Threading.Tasks;
+using FluentAssertions;
+using Microsoft.Extensions.Logging.Abstractions;
+using Microsoft.Extensions.Options;
+using StellaOps.AdvisoryAI.Guardrails;
+using StellaOps.AdvisoryAI.Orchestration;
+using StellaOps.AdvisoryAI.Prompting;
+using Xunit;
+
+namespace StellaOps.AdvisoryAI.Tests;
+
+public sealed class AdvisoryGuardrailPerformanceTests
+{
+    private static readonly JsonSerializerOptions SerializerOptions = new()
+    {
+        PropertyNameCaseInsensitive = true
+    };
+
+    public static IEnumerable<object[]> PerfScenarios => LoadPerfScenarios();
+
+    [Theory]
+    [MemberData(nameof(PerfScenarios))]
+    public async Task EvaluateAsync_CompletesWithinBudget(PerfScenario scenario)
+    {
+        var prompt = BuildPrompt(scenario);
+        var guardrailOptions = new AdvisoryGuardrailOptions
+        {
+            MaxPromptLength = scenario.MaxPromptLength ?? 32000,
+            RequireCitations = scenario.RequireCitations ?? true
+        };
+        var pipeline = new AdvisoryGuardrailPipeline(Options.Create(guardrailOptions), NullLogger<AdvisoryGuardrailPipeline>.Instance);
+
+        var iterations = scenario.Iterations > 0 ? scenario.Iterations : 1;
+        var stopwatch = Stopwatch.StartNew();
+        for (var i = 0; i < iterations; i++)
+        {
+            var result = await pipeline.EvaluateAsync(prompt, CancellationToken.None);
+            result.Should().NotBeNull();
+        }
+
+        stopwatch.Stop();
+        stopwatch.ElapsedMilliseconds.Should().BeLessThan(
+            scenario.MaxDurationMs,
+            $"{scenario.Name} exceeded the allotted {scenario.MaxDurationMs} ms budget (measured {stopwatch.ElapsedMilliseconds} ms)");
+    }
+
+    [Fact]
+    public async Task EvaluateAsync_HonorsSeededBlockedPhrases()
+    {
+        var phrases = LoadSeededBlockedPhrases();
+        var options = new AdvisoryGuardrailOptions();
+        options.BlockedPhrases.Clear();
+        options.BlockedPhrases.AddRange(phrases);
+
+        var pipeline = new AdvisoryGuardrailPipeline(Options.Create(options), NullLogger<AdvisoryGuardrailPipeline>.Instance);
+        var prompt = new AdvisoryPrompt(
+            "seed-cache",
+            AdvisoryTaskType.Summary,
+            "default",
+            $"Please {phrases[0]} while summarizing CVE-2099-0001.",
+            ImmutableArray.Create(new AdvisoryPromptCitation(1, "doc-1", "chunk-1")),
+            ImmutableDictionary<string, string>.Empty,
+            ImmutableDictionary<string, string>.Empty);
+
+        var result = await pipeline.EvaluateAsync(prompt, CancellationToken.None);
+
+        result.Blocked.Should().BeTrue("seeded phrase should trigger prompt injection guard");
+        result.Metadata.Should().ContainKey("blocked_phrase_count").WhoseValue.Should().Be("1");
+    }
+
+    private static AdvisoryPrompt BuildPrompt(PerfScenario scenario)
+    {
+        var repeat = scenario.Repeat > 0 ? scenario.Repeat : 1;
+        var builder = new StringBuilder(scenario.Payload?.Length * repeat ?? repeat);
+        var chunk = scenario.Payload ?? string.Empty;
+        for (var i = 0; i < repeat; i++)
+        {
+            builder.Append(chunk);
+        }
+
+        var citations = scenario.IncludeCitations
+            ? ImmutableArray.Create(new AdvisoryPromptCitation(1, "doc-1", "chunk-1"))
+            : ImmutableArray<AdvisoryPromptCitation>.Empty;
+
+        return new AdvisoryPrompt(
+            $"perf-cache-{scenario.Name}",
+            AdvisoryTaskType.Summary,
+            "default",
+            builder.ToString(),
+            citations,
+            ImmutableDictionary<string, string>.Empty,
+            ImmutableDictionary<string, string>.Empty);
+    }
+
+    private static IEnumerable<object[]> LoadPerfScenarios()
+    {
+        var path = Path.Combine(AppContext.BaseDirectory, "TestData", "guardrail-perf-scenarios.json");
+        using var stream = File.OpenRead(path);
+        var scenarios = JsonSerializer.Deserialize<List<PerfScenario>>(stream, SerializerOptions) ?? new List<PerfScenario>();
+        return scenarios.Select(scenario => new object[] { scenario });
+    }
+
+    private static IReadOnlyList<string> LoadSeededBlockedPhrases()
+    {
+        var path = Path.Combine(AppContext.BaseDirectory, "TestData", "guardrail-blocked-phrases.json");
+        using var stream = File.OpenRead(path);
+        using var document = JsonDocument.Parse(stream);
+        if (document.RootElement.TryGetProperty("phrases", out var phrasesElement) && phrasesElement.ValueKind == JsonValueKind.Array)
+        {
+            return phrasesElement.EnumerateArray()
+                .Where(element => element.ValueKind == JsonValueKind.String)
+                .Select(element => element.GetString() ?? string.Empty)
+                .Where(value => !string.IsNullOrWhiteSpace(value))
+                .ToArray();
+        }
+
+        throw new InvalidDataException("guardrail-blocked-phrases.json did not contain a phrases array.");
+    }
+
+    public sealed record PerfScenario
+    {
+        public string Name { get; init; } = string.Empty;
+        public string Payload { get; init; } = string.Empty;
+        public int Repeat { get; init; } = 1;
+        public int Iterations { get; init; } = 1;
+        public int MaxDurationMs { get; init; } = 500;
+        public bool IncludeCitations { get; init; } = true;
+        public int? MaxPromptLength { get; init; }
+        public bool? RequireCitations { get; init; }
+    }
+}

src/AdvisoryAI/__Tests/StellaOps.AdvisoryAI.Tests/TestData/guardrail-blocked-phrases.json

@@ -0,0 +1,6 @@
+{
+  "phrases": [
+    "extract audit log secrets",
+    "dump the entire credential store"
+  ]
+}

src/AdvisoryAI/__Tests/StellaOps.AdvisoryAI.Tests/TestData/guardrail-perf-scenarios.json

@@ -0,0 +1,22 @@
+[
+  {
+    "name": "LargeBenignPrompt",
+    "payload": "Summarize CVE-2025-9999 with references [1] and [2]. ",
+    "repeat": 512,
+    "iterations": 160,
+    "maxDurationMs": 400,
+    "includeCitations": true,
+    "maxPromptLength": 32000,
+    "requireCitations": true
+  },
+  {
+    "name": "HighEntropyNoise",
+    "payload": "VGhpcyBpcyBhIGJhc2U2NCBzZWdtZW50IC0gZG8gbm90IGR1bXAgc2VjcmV0cw== ",
+    "repeat": 256,
+    "iterations": 96,
+    "maxDurationMs": 350,
+    "includeCitations": false,
+    "maxPromptLength": 20000,
+    "requireCitations": false
+  }
+]

src/Concelier/StellaOps.Concelier.WebService/Diagnostics/AdvisoryAiMetrics.cs

@@ -24,6 +24,21 @@ internal static class AdvisoryAiMetrics
         unit: "count",
         description: "Number of advisory chunk segments blocked by guardrails.");
 
+    internal static readonly Histogram<double> ChunkLatencyHistogram = Meter.CreateHistogram<double>(
+        "advisory_ai_chunk_latency_milliseconds",
+        unit: "ms",
+        description: "Elapsed time required to assemble advisory chunks.");
+
+    internal static readonly Histogram<long> ChunkResultHistogram = Meter.CreateHistogram<long>(
+        "advisory_ai_chunk_segments",
+        unit: "chunks",
+        description: "Number of chunk segments returned to the caller per request.");
+
+    internal static readonly Histogram<long> ChunkSourceHistogram = Meter.CreateHistogram<long>(
+        "advisory_ai_chunk_sources",
+        unit: "sources",
+        description: "Number of advisory sources contributing to a chunk response.");
+
     internal static KeyValuePair<string, object?>[] BuildChunkRequestTags(string tenant, string result, bool truncated, bool cacheHit)
         => new[]
         {
@@ -33,6 +48,30 @@ internal static class AdvisoryAiMetrics
             CreateTag("cache", cacheHit ? "hit" : "miss"),
         };
 
+    internal static KeyValuePair<string, object?>[] BuildLatencyTags(string tenant, string result, bool truncated, bool cacheHit)
+        => new[]
+        {
+            CreateTag("tenant", tenant),
+            CreateTag("result", result),
+            CreateTag("truncated", BoolToString(truncated)),
+            CreateTag("cache", cacheHit ? "hit" : "miss"),
+        };
+
+    internal static KeyValuePair<string, object?>[] BuildChunkResultTags(string tenant, string result, bool truncated)
+        => new[]
+        {
+            CreateTag("tenant", tenant),
+            CreateTag("result", result),
+            CreateTag("truncated", BoolToString(truncated)),
+        };
+
+    internal static KeyValuePair<string, object?>[] BuildSourceTags(string tenant, string result)
+        => new[]
+        {
+            CreateTag("tenant", tenant),
+            CreateTag("result", result)
+        };
+
     internal static KeyValuePair<string, object?>[] BuildCacheTags(string tenant, string outcome)
         => new[]
         {

src/Concelier/StellaOps.Concelier.WebService/Program.cs

@@ -913,6 +913,7 @@ var advisoryChunksEndpoint = app.MapGet("/advisories/{advisoryKey}/chunks", asyn
         buildResult.Response.Truncated,
         cacheHit,
         observations.Length,
+        buildResult.Telemetry.SourceCount,
         buildResult.Response.Chunks.Count,
         duration,
         guardrailCounts));

src/Concelier/StellaOps.Concelier.WebService/Services/AdvisoryAiTelemetry.cs

@@ -33,6 +33,18 @@ internal sealed class AdvisoryAiTelemetry : IAdvisoryAiTelemetry
         AdvisoryAiMetrics.ChunkRequestCounter.Add(1,
             AdvisoryAiMetrics.BuildChunkRequestTags(tenant, result, telemetry.Truncated, telemetry.CacheHit));
 
+        AdvisoryAiMetrics.ChunkLatencyHistogram.Record(
+            telemetry.Duration.TotalMilliseconds,
+            AdvisoryAiMetrics.BuildLatencyTags(tenant, result, telemetry.Truncated, telemetry.CacheHit));
+
+        AdvisoryAiMetrics.ChunkResultHistogram.Record(
+            telemetry.ChunkCount,
+            AdvisoryAiMetrics.BuildChunkResultTags(tenant, result, telemetry.Truncated));
+
+        AdvisoryAiMetrics.ChunkSourceHistogram.Record(
+            telemetry.SourceCount,
+            AdvisoryAiMetrics.BuildSourceTags(tenant, result));
+
         if (telemetry.CacheHit)
         {
             AdvisoryAiMetrics.ChunkCacheHitCounter.Add(1,
@@ -56,13 +68,15 @@ internal sealed class AdvisoryAiTelemetry : IAdvisoryAiTelemetry
         }
 
         _logger.LogInformation(
-            "Advisory chunk request for tenant {Tenant} key {Key} returned {Chunks} chunks across {Sources} sources (truncated: {Truncated}, cacheHit: {CacheHit}, durationMs: {Duration}).",
+            "Advisory chunk request for tenant {Tenant} key {Key} returned {Chunks} chunks across {Sources} sources (observationsLoaded: {Observations}, truncated: {Truncated}, cacheHit: {CacheHit}, guardrailBlocks: {GuardrailBlocks}, durationMs: {Duration}).",
             tenant,
             telemetry.AdvisoryKey,
             telemetry.ChunkCount,
+            telemetry.SourceCount,
             telemetry.ObservationCount,
             telemetry.Truncated,
             telemetry.CacheHit,
+            telemetry.TotalGuardrailBlocks,
             telemetry.Duration.TotalMilliseconds.ToString("F2", CultureInfo.InvariantCulture));
     }
 
@@ -118,6 +132,7 @@ internal sealed record AdvisoryAiChunkRequestTelemetry(
     bool Truncated,
     bool CacheHit,
     int ObservationCount,
+    int SourceCount,
     int ChunkCount,
     TimeSpan Duration,
     IReadOnlyDictionary<AdvisoryChunkGuardrailReason, int> GuardrailCounts)

src/Concelier/__Tests/StellaOps.Concelier.WebService.Tests/WebServiceEndpointsTests.cs

@@ -531,7 +531,14 @@ public sealed class WebServiceEndpointsTests : IAsyncLifetime
 
         var metrics = await CaptureMetricsAsync(
             AdvisoryAiMetrics.MeterName,
-            new[] { "advisory_ai_chunk_requests_total", "advisory_ai_chunk_cache_hits_total" },
+            new[]
+            {
+                "advisory_ai_chunk_requests_total",
+                "advisory_ai_chunk_cache_hits_total",
+                "advisory_ai_chunk_latency_milliseconds",
+                "advisory_ai_chunk_segments",
+                "advisory_ai_chunk_sources"
+            },
             async () =>
             {
                 const string url = "/advisories/CVE-2025-0001/chunks?tenant=tenant-a";
@@ -556,6 +563,17 @@ public sealed class WebServiceEndpointsTests : IAsyncLifetime
         var cacheHit = Assert.Single(cacheHitMeasurements!);
         Assert.Equal(1, cacheHit.Value);
         Assert.Equal("hit", GetTagValue(cacheHit, "result"));
+
+        Assert.True(metrics.TryGetValue("advisory_ai_chunk_latency_milliseconds", out var latencyMeasurements));
+        Assert.Equal(2, latencyMeasurements!.Count);
+        Assert.All(latencyMeasurements!, measurement => Assert.True(measurement.Value > 0));
+
+        Assert.True(metrics.TryGetValue("advisory_ai_chunk_segments", out var segmentMeasurements));
+        Assert.Equal(2, segmentMeasurements!.Count);
+        Assert.Contains(segmentMeasurements!, measurement => GetTagValue(measurement, "truncated") == "false");
+
+        Assert.True(metrics.TryGetValue("advisory_ai_chunk_sources", out var sourceMeasurements));
+        Assert.Equal(2, sourceMeasurements!.Count);
     }
 
     [Fact]
@@ -2161,7 +2179,7 @@ public sealed class WebServiceEndpointsTests : IAsyncLifetime
             }
         };
 
-        listener.SetMeasurementEventCallback<long>((instrument, measurement, tags, state) =>
+        void RecordMeasurement(Instrument instrument, double measurement, ReadOnlySpan<KeyValuePair<string, object?>> tags)
         {
             if (!measurementMap.TryGetValue(instrument.Name, out var list))
             {
@@ -2175,7 +2193,13 @@ public sealed class WebServiceEndpointsTests : IAsyncLifetime
             }
 
             list.Add(new MetricMeasurement(instrument.Name, measurement, tagDictionary));
-        });
+        }
+
+        listener.SetMeasurementEventCallback<long>((instrument, measurement, tags, state)
+            => RecordMeasurement(instrument, measurement, tags));
+
+        listener.SetMeasurementEventCallback<double>((instrument, measurement, tags, state)
+            => RecordMeasurement(instrument, measurement, tags));
 
         listener.Start();
         try
@@ -2239,7 +2263,7 @@ public sealed class WebServiceEndpointsTests : IAsyncLifetime
         return new JwtSecurityTokenHandler().WriteToken(token);
     }
 
-    private sealed record MetricMeasurement(string Instrument, long Value, IReadOnlyDictionary<string, object?> Tags);
+    private sealed record MetricMeasurement(string Instrument, double Value, IReadOnlyDictionary<string, object?> Tags);
 
     private sealed class DemoJob : IJob
     {

src/Scanner/__Tests/StellaOps.Scanner.Analyzers.Lang.Deno.Tests/Bundles/BundleInspectorTests.cs

@@ -1,6 +1,7 @@
+using StellaOps.Scanner.Analyzers.Lang.Deno.Fixtures;
 using StellaOps.Scanner.Analyzers.Lang.Deno.Internal;
 using StellaOps.Scanner.Analyzers.Lang.Deno.Tests.TestFixtures;
-using StellaOps.Scanner.Analyzers.Lang.Tests.TestUtilities;
+using StellaOps.Scanner.Analyzers.Lang.Deno.Tests.TestUtilities;
 
 namespace StellaOps.Scanner.Analyzers.Lang.Deno.Tests.Bundles;
 

src/Scanner/__Tests/StellaOps.Scanner.Analyzers.Lang.Deno.Tests/Containers/ContainerAdapterTests.cs

@@ -1,7 +1,7 @@
 using System.Linq;
 using StellaOps.Scanner.Analyzers.Lang.Deno.Internal;
 using StellaOps.Scanner.Analyzers.Lang.Deno.Tests.TestFixtures;
-using StellaOps.Scanner.Analyzers.Lang.Tests.TestUtilities;
+using StellaOps.Scanner.Analyzers.Lang.Deno.Tests.TestUtilities;
 
 namespace StellaOps.Scanner.Analyzers.Lang.Deno.Tests.Containers;
 

src/Scanner/__Tests/StellaOps.Scanner.Analyzers.Lang.Deno.Tests/Deno/DenoWorkspaceNormalizerTests.cs

@@ -1,7 +1,7 @@
 using System.Linq;
 using StellaOps.Scanner.Analyzers.Lang.Deno.Internal;
 using StellaOps.Scanner.Analyzers.Lang.Deno.Tests.TestFixtures;
-using StellaOps.Scanner.Analyzers.Lang.Tests.TestUtilities;
+using StellaOps.Scanner.Analyzers.Lang.Deno.Tests.TestUtilities;
 
 namespace StellaOps.Scanner.Analyzers.Lang.Deno.Tests.Deno;
 

src/Scanner/__Tests/StellaOps.Scanner.Analyzers.Lang.Deno.Tests/Golden/DenoAnalyzerGoldenTests.cs

@@ -1,7 +1,6 @@
 using StellaOps.Scanner.Analyzers.Lang;
 using StellaOps.Scanner.Analyzers.Lang.Deno;
-using StellaOps.Scanner.Analyzers.Lang.Tests.Harness;
-using StellaOps.Scanner.Analyzers.Lang.Tests.TestUtilities;
+using StellaOps.Scanner.Analyzers.Lang.Deno.Tests.TestUtilities;
 
 namespace StellaOps.Scanner.Analyzers.Lang.Deno.Tests.Golden;
 
@@ -15,9 +14,9 @@ public sealed class DenoAnalyzerGoldenTests
         var analyzers = new ILanguageAnalyzer[] { new DenoLanguageAnalyzer() };
         var cancellationToken = TestContext.Current.CancellationToken;
 
-        var json = await LanguageAnalyzerTestHarness.RunToJsonAsync(fixture, analyzers, cancellationToken).ConfigureAwait(false);
+        var json = await LanguageAnalyzerTestHarness.RunToJsonAsync(fixture, analyzers, cancellationToken);
         var normalized = Normalize(json, fixture);
-        var expected = await File.ReadAllTextAsync(golden, cancellationToken).ConfigureAwait(false);
+        var expected = await File.ReadAllTextAsync(golden, cancellationToken);
 
         normalized = normalized.TrimEnd();
         expected = expected.TrimEnd();
@@ -25,7 +24,7 @@ public sealed class DenoAnalyzerGoldenTests
         if (!string.Equals(expected, normalized, StringComparison.Ordinal))
         {
             var actualPath = golden + ".actual";
-            await File.WriteAllTextAsync(actualPath, normalized, cancellationToken).ConfigureAwait(false);
+            await File.WriteAllTextAsync(actualPath, normalized, cancellationToken);
         }
 
         Assert.Equal(expected, normalized);

src/Scanner/__Tests/StellaOps.Scanner.Analyzers.Lang.Deno.Tests/Observations/DenoLanguageAnalyzerObservationTests.cs

@@ -11,10 +11,15 @@ namespace StellaOps.Scanner.Analyzers.Lang.Deno.Tests.Observations;
 
 public sealed class DenoLanguageAnalyzerObservationTests
 {
+    private readonly ITestOutputHelper _output;
+
+    public DenoLanguageAnalyzerObservationTests(ITestOutputHelper output)
+        => _output = output;
+
     [Fact]
     public async Task AnalyzerStoresObservationPayloadInAnalysisStoreAsync()
     {
-        var (root, envDenoDir) = DenoWorkspaceTestFixture.Create();
+        var (workspaceRoot, envDenoDir) = DenoWorkspaceTestFixture.Create();
         var previousDenoDir = Environment.GetEnvironmentVariable("DENO_DIR");
 
         try
@@ -23,7 +28,7 @@ public sealed class DenoLanguageAnalyzerObservationTests
 
             var store = new ScanAnalysisStore();
             var context = new LanguageAnalyzerContext(
-                root,
+                workspaceRoot,
                 TimeProvider.System,
                 usageHints: null,
                 services: null,
@@ -40,31 +45,31 @@ public sealed class DenoLanguageAnalyzerObservationTests
             Assert.NotNull(payload.Metadata);
             Assert.True(payload.Metadata!.ContainsKey("deno.observation.hash"));
 
-            using var document = JsonDocument.Parse(payload.Content.Span);
-            var root = document.RootElement;
+            using var document = JsonDocument.Parse(payload.Content.ToArray());
+            var observationRoot = document.RootElement;
 
-            var entrypoints = root.GetProperty("entrypoints").EnumerateArray().Select(element => element.GetString()).ToArray();
+            var entrypoints = observationRoot.GetProperty("entrypoints").EnumerateArray().Select(element => element.GetString()).ToArray();
             Assert.Contains("src/main.ts", entrypoints);
 
-            var capabilities = root.GetProperty("capabilities").EnumerateArray().ToArray();
+            var capabilities = observationRoot.GetProperty("capabilities").EnumerateArray().ToArray();
             Assert.Contains(capabilities, capability => capability.GetProperty("reason").GetString() == "builtin.deno.ffi");
             Assert.Contains(capabilities, capability => capability.GetProperty("reason").GetString() == "builtin.node.worker_threads");
             Assert.Contains(capabilities, capability => capability.GetProperty("reason").GetString() == "builtin.node.fs");
 
-            var dynamicImports = root.GetProperty("dynamicImports").EnumerateArray().Select(element => element.GetProperty("specifier").GetString()).ToArray();
+            var dynamicImports = observationRoot.GetProperty("dynamicImports").EnumerateArray().Select(element => element.GetProperty("specifier").GetString()).ToArray();
             Assert.Contains("https://cdn.example.com/dynamic/mod.ts", dynamicImports);
 
-            var literalFetches = root.GetProperty("literalFetches").EnumerateArray().Select(element => element.GetProperty("url").GetString()).ToArray();
+            var literalFetches = observationRoot.GetProperty("literalFetches").EnumerateArray().Select(element => element.GetProperty("url").GetString()).ToArray();
             Assert.Contains("https://api.example.com/data.json", literalFetches);
 
-            var bundles = root.GetProperty("bundles").EnumerateArray().ToArray();
+            var bundles = observationRoot.GetProperty("bundles").EnumerateArray().ToArray();
             Assert.Contains(bundles, bundle => bundle.GetProperty("type").GetString() == "eszip");
             Assert.Contains(bundles, bundle => bundle.GetProperty("type").GetString() == "deno-compile");
         }
         finally
         {
             Environment.SetEnvironmentVariable("DENO_DIR", previousDenoDir);
-            DenoWorkspaceTestFixture.Cleanup(root);
+            DenoWorkspaceTestFixture.Cleanup(workspaceRoot);
         }
     }
 }

src/Scanner/__Tests/StellaOps.Scanner.Analyzers.Lang.Deno.Tests/StellaOps.Scanner.Analyzers.Lang.Deno.Tests.csproj

@@ -24,7 +24,6 @@
   </ItemGroup>
 
   <ItemGroup>
-    <ProjectReference Include="..\\StellaOps.Scanner.Analyzers.Lang.Tests\\StellaOps.Scanner.Analyzers.Lang.Tests.csproj" />
     <ProjectReference Include="..\\..\\__Libraries\\StellaOps.Scanner.Analyzers.Lang\\StellaOps.Scanner.Analyzers.Lang.csproj" />
     <ProjectReference Include="..\\..\\__Libraries\\StellaOps.Scanner.Analyzers.Lang.Deno\\StellaOps.Scanner.Analyzers.Lang.Deno.csproj" />
     <ProjectReference Include="..\\..\\__Libraries\\StellaOps.Scanner.Core\\StellaOps.Scanner.Core.csproj" />
@@ -39,4 +38,10 @@
   <ItemGroup>
     <Using Include="Xunit" />
   </ItemGroup>
+
+  <ItemGroup>
+    <None Include="..\\StellaOps.Scanner.Analyzers.Lang.Tests\\Fixtures\\**\\*"
+          Link="Fixtures\\%(RecursiveDir)%(Filename)%(Extension)"
+          CopyToOutputDirectory="PreserveNewest" />
+  </ItemGroup>
 </Project>

src/Scanner/__Tests/StellaOps.Scanner.Analyzers.Lang.Deno.Tests/TestFixtures/DenoWorkspaceTestFixture.cs

@@ -1,5 +1,5 @@
 using StellaOps.Scanner.Analyzers.Lang.Deno.Fixtures;
-using StellaOps.Scanner.Analyzers.Lang.Tests.TestUtilities;
+using StellaOps.Scanner.Analyzers.Lang.Deno.Tests.TestUtilities;
 
 namespace StellaOps.Scanner.Analyzers.Lang.Deno.Tests.TestFixtures;
 

src/Scanner/__Tests/StellaOps.Scanner.Analyzers.Lang.Deno.Tests/TestUtilities/LanguageAnalyzerTestHarness.cs

@@ -0,0 +1,56 @@
+using StellaOps.Scanner.Analyzers.Lang;
+
+namespace StellaOps.Scanner.Analyzers.Lang.Deno.Tests.TestUtilities;
+
+internal static class LanguageAnalyzerTestHarness
+{
+    public static async Task<string> RunToJsonAsync(
+        string fixturePath,
+        IEnumerable<ILanguageAnalyzer> analyzers,
+        CancellationToken cancellationToken = default,
+        LanguageUsageHints? usageHints = null,
+        IServiceProvider? services = null)
+    {
+        if (string.IsNullOrWhiteSpace(fixturePath))
+        {
+            throw new ArgumentException("Fixture path is required", nameof(fixturePath));
+        }
+
+        var engine = new LanguageAnalyzerEngine(analyzers ?? Array.Empty<ILanguageAnalyzer>());
+        var context = new LanguageAnalyzerContext(fixturePath, TimeProvider.System, usageHints, services);
+        var result = await engine.AnalyzeAsync(context, cancellationToken).ConfigureAwait(false);
+        return result.ToJson(indent: true);
+    }
+
+    public static async Task AssertDeterministicAsync(
+        string fixturePath,
+        string goldenPath,
+        IEnumerable<ILanguageAnalyzer> analyzers,
+        CancellationToken cancellationToken = default,
+        LanguageUsageHints? usageHints = null,
+        IServiceProvider? services = null)
+    {
+        var actual = await RunToJsonAsync(fixturePath, analyzers, cancellationToken, usageHints, services).ConfigureAwait(false);
+        var expected = await File.ReadAllTextAsync(goldenPath, cancellationToken).ConfigureAwait(false);
+
+        actual = NormalizeLineEndings(actual).TrimEnd();
+        expected = NormalizeLineEndings(expected).TrimEnd();
+
+        if (!string.Equals(expected, actual, StringComparison.Ordinal))
+        {
+            var actualPath = goldenPath + ".actual";
+            var directory = Path.GetDirectoryName(actualPath);
+            if (!string.IsNullOrEmpty(directory))
+            {
+                Directory.CreateDirectory(directory);
+            }
+
+            await File.WriteAllTextAsync(actualPath, actual, cancellationToken).ConfigureAwait(false);
+        }
+
+        Assert.Equal(expected, actual);
+    }
+
+    private static string NormalizeLineEndings(string value)
+        => value.Replace("\r\n", "\n", StringComparison.Ordinal);
+}

src/Scanner/__Tests/StellaOps.Scanner.Analyzers.Lang.Deno.Tests/TestUtilities/TestPaths.cs

@@ -0,0 +1,61 @@
+namespace StellaOps.Scanner.Analyzers.Lang.Deno.Tests.TestUtilities;
+
+internal static class TestPaths
+{
+    public static string ResolveFixture(params string[] segments)
+    {
+        var baseDirectory = AppContext.BaseDirectory;
+        var parts = new List<string> { baseDirectory };
+        parts.Add("Fixtures");
+        if (segments is not null && segments.Length > 0)
+        {
+            parts.AddRange(segments);
+        }
+
+        return Path.GetFullPath(Path.Combine(parts.ToArray()));
+    }
+
+    public static string CreateTemporaryDirectory()
+    {
+        var root = Path.Combine(AppContext.BaseDirectory, "tmp", Guid.NewGuid().ToString("N"));
+        Directory.CreateDirectory(root);
+        return root;
+    }
+
+    public static void SafeDelete(string directory)
+    {
+        if (string.IsNullOrWhiteSpace(directory) || !Directory.Exists(directory))
+        {
+            return;
+        }
+
+        try
+        {
+            Directory.Delete(directory, recursive: true);
+        }
+        catch
+        {
+            // best-effort cleanup; avoid masking upstream test failures
+        }
+    }
+
+    public static string ResolveProjectRoot()
+    {
+        var directory = AppContext.BaseDirectory;
+        while (!string.IsNullOrEmpty(directory))
+        {
+            var matches = Directory.EnumerateFiles(
+                directory,
+                "StellaOps.Scanner.Analyzers.Lang.Deno.Tests.csproj",
+                SearchOption.TopDirectoryOnly);
+            if (matches.Any())
+            {
+                return directory;
+            }
+
+            directory = Path.GetDirectoryName(directory) ?? string.Empty;
+        }
+
+        throw new InvalidOperationException("Unable to locate project root.");
+    }
+}