archive audit attempts

docs-archived/implplan-blocked/audits/csproj-standards/Cli/StellaOps.Cli/StellaOps.Cli.md

@@ -0,0 +1,857 @@
+# Audit - StellaOps.Cli
+
+## Project
+- Path: `src/Cli/StellaOps.Cli/StellaOps.Cli.csproj`
+- Module: `Cli`
+- Kind: `Tool`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 285
+- Service locator usage (BuildServiceProvider/GetService): 532
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs` (33868 lines)
+  - `src/Cli/StellaOps.Cli/Commands/CommandFactory.cs` (14742 lines)
+  - `src/Cli/StellaOps.Cli/Services/BackendOperationsClient.cs` (5321 lines)
+  - `src/Cli/StellaOps.Cli/Commands/SbomCommandGroup.cs` (4163 lines)
+  - `src/Cli/StellaOps.Cli/Commands/EvidenceCommandGroup.cs` (2431 lines)
+  - `src/Cli/StellaOps.Cli/Commands/ScoreGateCommandGroup.cs` (2198 lines)
+  - `src/Cli/StellaOps.Cli/Commands/GroundTruthCommandGroup.cs` (2099 lines)
+  - `src/Cli/StellaOps.Cli/Commands/ReachabilityCommandGroup.cs` (1744 lines)
+  - `src/Cli/StellaOps.Cli/Commands/ScoreCommandGroup.cs` (1714 lines)
+  - `src/Cli/StellaOps.Cli/Commands/AttestCommandGroup.cs` (1671 lines)
+  - `src/Cli/StellaOps.Cli/Commands/UnknownsCommandGroup.cs` (1669 lines)
+  - `src/Cli/StellaOps.Cli/Commands/BundleVerifyCommand.cs` (1417 lines)
+  - `src/Cli/StellaOps.Cli/Commands/PolicyCommandGroup.cs` (1409 lines)
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.Offline.cs` (1373 lines)
+  - `src/Cli/StellaOps.Cli/Commands/AnalyticsCommandGroup.cs` (1243 lines)
+  - `src/Cli/StellaOps.Cli/Commands/ReleaseCommandGroup.cs` (1240 lines)
+  - `src/Cli/StellaOps.Cli/Commands/Chain/ChainCommandGroup.cs` (1218 lines)
+  - `src/Cli/StellaOps.Cli/Services/Models/PolicyWorkspaceModels.cs` (1202 lines)
+  - `src/Cli/StellaOps.Cli/Commands/DoctorCommandGroup.cs` (1165 lines)
+  - `src/Cli/StellaOps.Cli/Commands/ExceptionCommandGroup.cs` (1137 lines)
+  - `src/Cli/StellaOps.Cli/Services/PromotionAssembler.cs` (1127 lines)
+  - `src/Cli/StellaOps.Cli/Commands/GuardCommandGroup.cs` (1052 lines)
+  - `src/Cli/StellaOps.Cli/Commands/FunctionMap/FunctionMapCommandGroup.cs` (1021 lines)
+  - `src/Cli/StellaOps.Cli/Services/PackClient.cs` (1018 lines)
+  - `src/Cli/StellaOps.Cli/Commands/WatchlistCommandGroup.cs` (991 lines)
+  - `src/Cli/StellaOps.Cli/Commands/ScoreReplayCommandGroup.cs` (962 lines)
+  - `src/Cli/StellaOps.Cli/Commands/Binary/BinaryCommandHandlers.cs` (938 lines)
+  - `src/Cli/StellaOps.Cli/Commands/Budget/RiskBudgetCommandGroup.cs` (932 lines)
+  - `src/Cli/StellaOps.Cli/Commands/Binary/BinaryCommandGroup.cs` (922 lines)
+  - `src/Cli/StellaOps.Cli/CliApplication.cs` (917 lines)
+  - `src/Cli/StellaOps.Cli/Services/Models/PackModels.cs` (915 lines)
+  - `src/Cli/StellaOps.Cli/Commands/DbCommandGroup.cs` (887 lines)
+  - `src/Cli/StellaOps.Cli/Commands/LayerSbomCommandGroup.cs` (879 lines)
+  - `src/Cli/StellaOps.Cli/Commands/Binary/DeltaSigCommandGroup.cs` (873 lines)
+  - `src/Cli/StellaOps.Cli/Audit/AuditBundleService.cs` (869 lines)
+  - `src/Cli/StellaOps.Cli/Commands/Scan/BinaryDiffService.cs` (862 lines)
+  - `src/Cli/StellaOps.Cli/Services/DeterminismHarness.cs` (850 lines)
+  - `src/Cli/StellaOps.Cli/Commands/Trust/TrustCommandHandlers.cs` (846 lines)
+  - `src/Cli/StellaOps.Cli/Commands/DeltaSig/DeltaSigCommandHandlers.cs` (841 lines)
+  - `src/Cli/StellaOps.Cli/Services/Models/SbomerModels.cs` (834 lines)
+  - `src/Cli/StellaOps.Cli/Commands/Admin/AdminCommandHandlers.cs` (826 lines)
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.Federation.cs` (818 lines)
+  - `src/Cli/StellaOps.Cli/Commands/GitHubCommandGroup.cs` (806 lines)
+  - `src/Cli/StellaOps.Cli/Commands/LicenseCommandGroup.cs` (798 lines)
+  - `src/Cli/StellaOps.Cli/Commands/Watchlist/WatchlistCommandHandlers.cs` (795 lines)
+  - `src/Cli/StellaOps.Cli/Commands/AuthCommandGroup.cs` (794 lines)
+  - `src/Cli/StellaOps.Cli/Commands/AuditCommandGroup.cs` (787 lines)
+  - `src/Cli/StellaOps.Cli/Services/NotifyClient.cs` (781 lines)
+  - `src/Cli/StellaOps.Cli/Commands/Advise/AdviseChatCommandGroup.cs` (776 lines)
+  - `src/Cli/StellaOps.Cli/Commands/BundleExportCommand.cs` (775 lines)
+  - `src/Cli/StellaOps.Cli/Commands/CryptoCommandGroup.cs` (769 lines)
+  - `src/Cli/StellaOps.Cli/Commands/Setup/SetupCommandHandler.cs` (745 lines)
+  - `src/Cli/StellaOps.Cli/Commands/Policy/PolicyInteropCommandGroup.cs` (740 lines)
+  - `src/Cli/StellaOps.Cli/Services/Models/SbomModels.cs` (739 lines)
+  - `src/Cli/StellaOps.Cli/Commands/KeysCommandGroup.cs` (729 lines)
+  - `src/Cli/StellaOps.Cli/Commands/ReplayCommandGroup.cs` (723 lines)
+  - `src/Cli/StellaOps.Cli/Commands/OrchestratorCommandGroup.cs` (720 lines)
+  - `src/Cli/StellaOps.Cli/Commands/NotifyCommandGroup.cs` (708 lines)
+  - `src/Cli/StellaOps.Cli/Services/Models/NotifyModels.cs` (693 lines)
+  - `src/Cli/StellaOps.Cli/Commands/VexGateScanCommandGroup.cs` (687 lines)
+  - `src/Cli/StellaOps.Cli/Commands/SignalsCommandGroup.cs` (682 lines)
+  - `src/Cli/StellaOps.Cli/Commands/FixChainCommandGroup.cs` (678 lines)
+  - `src/Cli/StellaOps.Cli/Commands/Observations/ObservationsCommandGroup.cs` (671 lines)
+  - `src/Cli/StellaOps.Cli/Services/Models/OrchestratorModels.cs` (671 lines)
+  - `src/Cli/StellaOps.Cli/Commands/ExplainCommandGroup.cs` (669 lines)
+  - `src/Cli/StellaOps.Cli/Commands/TaskRunnerCommandGroup.cs` (652 lines)
+  - `src/Cli/StellaOps.Cli/Commands/GateCommandGroup.cs` (635 lines)
+  - `src/Cli/StellaOps.Cli/Commands/Proof/KeyRotationCommandGroup.cs` (628 lines)
+  - `src/Cli/StellaOps.Cli/Commands/RegistryCommandGroup.cs` (626 lines)
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.VerdictVerify.cs` (621 lines)
+  - `src/Cli/StellaOps.Cli/Validation/LocalValidator.cs` (615 lines)
+  - `src/Cli/StellaOps.Cli/Services/SbomClient.cs` (603 lines)
+  - `src/Cli/StellaOps.Cli/Services/ExceptionClient.cs` (598 lines)
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.VerifyBundle.cs` (597 lines)
+  - `src/Cli/StellaOps.Cli/Services/ForensicVerifier.cs` (594 lines)
+  - `src/Cli/StellaOps.Cli/Commands/CheckpointCommands.cs` (593 lines)
+  - `src/Cli/StellaOps.Cli/Commands/Witness/WitnessCoreCommandHandlers.cs` (583 lines)
+  - `src/Cli/StellaOps.Cli/Services/VerdictAttestationVerifier.cs` (583 lines)
+  - `src/Cli/StellaOps.Cli/GitOps/GitOpsController.cs` (582 lines)
+  - `src/Cli/StellaOps.Cli/Commands/PatchAttestCommandGroup.cs` (580 lines)
+  - `src/Cli/StellaOps.Cli/Commands/VerifyCommandGroup.cs` (577 lines)
+  - `src/Cli/StellaOps.Cli/Commands/Proof/FuncProofCommandHandlers.cs` (576 lines)
+  - `src/Cli/StellaOps.Cli/Commands/Admin/AdminCommandGroup.cs` (575 lines)
+  - `src/Cli/StellaOps.Cli/Commands/ProveCommandGroup.cs` (570 lines)
+  - `src/Cli/StellaOps.Cli/Services/ObservabilityClient.cs` (558 lines)
+  - `src/Cli/StellaOps.Cli/Commands/GoldenSet/GoldenSetCommandGroup.cs` (551 lines)
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.VerifyOffline.cs` (549 lines)
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.Feeds.cs` (543 lines)
+  - `src/Cli/StellaOps.Cli/Commands/TrustAnchorsCommandGroup.cs` (543 lines)
+  - `src/Cli/StellaOps.Cli/Services/Models/ObservabilityModels.cs` (542 lines)
+  - `src/Cli/StellaOps.Cli/Commands/Scan/DeltaScanCommandGroup.cs` (539 lines)
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.Witness.cs` (538 lines)
+  - `src/Cli/StellaOps.Cli/Commands/Compare/CompareCommandBuilder.cs` (536 lines)
+  - `src/Cli/StellaOps.Cli/Services/AttestationBundleVerifier.cs` (533 lines)
+  - `src/Cli/StellaOps.Cli/Commands/VexGenCommandGroup.cs` (529 lines)
+  - `src/Cli/StellaOps.Cli/Commands/ScanGraphCommandGroup.cs` (521 lines)
+  - `src/Cli/StellaOps.Cli/Services/Models/ReachabilityModels.cs` (521 lines)
+  - `src/Cli/StellaOps.Cli/Commands/ZastavaCommandGroup.cs` (520 lines)
+  - `src/Cli/StellaOps.Cli/Commands/ProvCommandGroup.cs` (511 lines)
+  - `src/Cli/StellaOps.Cli/Commands/Binary/BinaryIndexOpsCommandGroup.cs` (511 lines)
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.Model.cs` (511 lines)
+  - `src/Cli/StellaOps.Cli/Commands/CiTemplates.cs` (510 lines)
+  - `src/Cli/StellaOps.Cli/Services/Models/AdvisoryLinksetModels.cs` (503 lines)
+  - `src/Cli/StellaOps.Cli/Commands/SignCommandGroup.cs` (487 lines)
+  - `src/Cli/StellaOps.Cli/Commands/ExportCommandGroup.cs` (485 lines)
+  - `src/Cli/StellaOps.Cli/Commands/DeltaSig/DeltaSigCommandGroup.cs` (483 lines)
+  - `src/Cli/StellaOps.Cli/Services/Models/WitnessModels.cs` (481 lines)
+  - `src/Cli/StellaOps.Cli/Commands/TrustProfileCommandGroup.cs` (480 lines)
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.AirGap.cs` (480 lines)
+  - `src/Cli/StellaOps.Cli/Commands/AirGapCommandGroup.cs` (479 lines)
+  - `src/Cli/StellaOps.Cli/Services/MirrorBundleImportService.cs` (476 lines)
+  - `src/Cli/StellaOps.Cli/Commands/BenchCommandBuilder.cs` (476 lines)
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.Audit.cs` (475 lines)
+  - `src/Cli/StellaOps.Cli/Commands/Watchlist/WatchlistCommandGroup.cs` (473 lines)
+  - `src/Cli/StellaOps.Cli/Services/OciAttestationRegistryClient.cs` (473 lines)
+  - `src/Cli/StellaOps.Cli/Services/Models/PromotionModels.cs` (468 lines)
+  - `src/Cli/StellaOps.Cli/Services/OrchestratorClient.cs` (467 lines)
+  - `src/Cli/StellaOps.Cli/Commands/Trust/TrustCommandGroup.cs` (466 lines)
+  - `src/Cli/StellaOps.Cli/Commands/PatchVerifyCommandGroup.cs` (461 lines)
+  - `src/Cli/StellaOps.Cli/Services/ImageAttestationVerifier.cs` (456 lines)
+  - `src/Cli/StellaOps.Cli/Configuration/CliProfile.cs` (455 lines)
+  - `src/Cli/StellaOps.Cli/Commands/ChangeTraceCommandGroup.cs` (450 lines)
+  - `src/Cli/StellaOps.Cli/Services/Models/RiskModels.cs` (448 lines)
+  - `src/Cli/StellaOps.Cli/Commands/ReachGraph/ReachGraphCommandHandlers.cs` (446 lines)
+  - `src/Cli/StellaOps.Cli/Commands/Setup/Steps/Implementations/LlmSetupStep.cs` (441 lines)
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.Secrets.cs` (440 lines)
+  - `src/Cli/StellaOps.Cli/Commands/Setup/Steps/Implementations/ScmSetupStep.cs` (438 lines)
+  - `src/Cli/StellaOps.Cli/Extensions/CommandLineCompatExtensions.cs` (437 lines)
+  - `src/Cli/StellaOps.Cli/Configuration/CliBootstrapper.cs` (436 lines)
+  - `src/Cli/StellaOps.Cli/Commands/Advise/ChatRenderer.cs` (431 lines)
+  - `src/Cli/StellaOps.Cli/Commands/IncidentCommandGroup.cs` (431 lines)
+  - `src/Cli/StellaOps.Cli/Commands/ConfigCatalog.cs` (431 lines)
+  - `src/Cli/StellaOps.Cli/Commands/Setup/Config/YamlSetupConfigParser.cs` (429 lines)
+  - `src/Cli/StellaOps.Cli/Services/Models/Chat/ChatModels.cs` (429 lines)
+  - `src/Cli/StellaOps.Cli/Program.cs` (423 lines)
+  - `src/Cli/StellaOps.Cli/Commands/FederationCommandGroup.cs` (423 lines)
+  - `src/Cli/StellaOps.Cli/Commands/Setup/Steps/Implementations/SettingsStoreSetupStep.cs` (422 lines)
+  - `src/Cli/StellaOps.Cli/Services/Models/ExceptionModels.cs` (422 lines)
+  - `src/Cli/StellaOps.Cli/Commands/EvidenceHoldsCommandGroup.cs` (420 lines)
+  - `src/Cli/StellaOps.Cli/Commands/Setup/Steps/Implementations/SourcesSetupStep.cs` (420 lines)
+  - `src/Cli/StellaOps.Cli/Services/Models/DeterminismModels.cs` (420 lines)
+  - `src/Cli/StellaOps.Cli/Commands/VexCommandGroup.cs` (413 lines)
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.Crypto.cs` (410 lines)
+  - `src/Cli/StellaOps.Cli/Commands/Proof/ProofCommandGroup.cs` (408 lines)
+  - `src/Cli/StellaOps.Cli/Commands/PoE/VerifyCommand.cs` (405 lines)
+  - `src/Cli/StellaOps.Cli/Commands/Setup/Steps/Implementations/NotifySetupStep.cs` (405 lines)
+  - `src/Cli/StellaOps.Cli/Output/OutputRenderer.cs` (395 lines)
+  - `src/Cli/StellaOps.Cli/Services/ConcelierObservationsClient.cs` (392 lines)
+  - `src/Cli/StellaOps.Cli/Services/AttestationReader.cs` (390 lines)
+  - `src/Cli/StellaOps.Cli/Commands/ReleaseCommandHandler.cs` (382 lines)
+  - `src/Cli/StellaOps.Cli/Services/DevPortalBundleVerifier.cs` (381 lines)
+  - `src/Cli/StellaOps.Cli/Commands/Ir/IrCommandGroup.cs` (380 lines)
+  - `src/Cli/StellaOps.Cli/Output/CliError.cs` (380 lines)
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.Drift.cs` (377 lines)
+  - `src/Cli/StellaOps.Cli/Commands/Sources/SourcesCommandHandlers.cs` (376 lines)
+  - `src/Cli/StellaOps.Cli/Services/OciRegistryClient.cs` (374 lines)
+  - `src/Cli/StellaOps.Cli/Services/ForensicSnapshotClient.cs` (372 lines)
+  - `src/Cli/StellaOps.Cli/Commands/DeployCommandHandler.cs` (370 lines)
+  - `src/Cli/StellaOps.Cli/Commands/PoE/ExportCommand.cs` (366 lines)
+  - `src/Cli/StellaOps.Cli/Commands/HlcCommandGroup.cs` (363 lines)
+  - `src/Cli/StellaOps.Cli/Commands/DeltaCommandGroup.cs` (356 lines)
+  - `src/Cli/StellaOps.Cli/Commands/Scan/BinaryDiffCommandGroup.cs` (355 lines)
+  - `src/Cli/StellaOps.Cli/Services/Models/ForensicVerificationModels.cs` (347 lines)
+  - `src/Cli/StellaOps.Cli/Commands/AuditVerifyCommand.cs` (344 lines)
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.Sign.cs` (344 lines)
+  - `src/Cli/StellaOps.Cli/Services/Transport/StellaOpsClientBase.cs` (340 lines)
+  - `src/Cli/StellaOps.Cli/Commands/IssuerKeysCommandGroup.cs` (339 lines)
+  - `src/Cli/StellaOps.Cli/Commands/Setup/Steps/Implementations/VaultSetupStep.cs` (337 lines)
+  - `src/Cli/StellaOps.Cli/Services/ScannerExecutor.cs` (331 lines)
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.Image.cs` (330 lines)
+  - `src/Cli/StellaOps.Cli/Commands/Sbom/SbomGenerateCommand.cs` (328 lines)
+  - `src/Cli/StellaOps.Cli/Commands/Slice/SliceCommandHandlers.cs` (327 lines)
+  - `src/Cli/StellaOps.Cli/Commands/DriftCommandGroup.cs` (324 lines)
+  - `src/Cli/StellaOps.Cli/Commands/VerdictCommandGroup.cs` (321 lines)
+  - `src/Cli/StellaOps.Cli/Commands/Setup/State/FileSetupStateStore.cs` (311 lines)
+  - `src/Cli/StellaOps.Cli/Commands/PromoteCommandHandler.cs` (311 lines)
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.Config.cs` (303 lines)
+  - `src/Cli/StellaOps.Cli/Commands/ModelCommandGroup.cs` (303 lines)
+  - `src/Cli/StellaOps.Cli/Commands/Setup/Steps/Implementations/UsersSetupStep.cs` (301 lines)
+  - `src/Cli/StellaOps.Cli/Services/Models/VexModels.cs` (299 lines)
+  - `src/Cli/StellaOps.Cli/Commands/Setup/Steps/Implementations/CryptoSetupStep.cs` (296 lines)
+  - `src/Cli/StellaOps.Cli/Services/Models/VexObservationModels.cs` (292 lines)
+  - `src/Cli/StellaOps.Cli/Commands/Scan/BinaryDiffRenderer.cs` (292 lines)
+  - `src/Cli/StellaOps.Cli/Services/Models/VulnModels.cs` (291 lines)
+  - `src/Cli/StellaOps.Cli/Commands/Proof/FuncProofCommandGroup.cs` (289 lines)
+  - `src/Cli/StellaOps.Cli/Commands/Setup/Steps/SetupStepResults.cs` (287 lines)
+  - `src/Cli/StellaOps.Cli/Telemetry/SealedModeTelemetry.cs` (284 lines)
+  - `src/Cli/StellaOps.Cli/Commands/TimelineCommandGroup.cs` (283 lines)
+  - `src/Cli/StellaOps.Cli/Commands/Setup/Steps/Implementations/AuthoritySetupStep.cs` (283 lines)
+  - `src/Cli/StellaOps.Cli/Services/Models/SdkModels.cs` (282 lines)
+  - `src/Cli/StellaOps.Cli/Commands/FeedsCommandGroup.cs` (281 lines)
+  - `src/Cli/StellaOps.Cli/Services/Models/ForensicSnapshotModels.cs` (279 lines)
+  - `src/Cli/StellaOps.Cli/Plugins/CliCommandModuleLoader.cs` (278 lines)
+  - `src/Cli/StellaOps.Cli/Commands/Setup/Steps/Implementations/AgentsSetupStep.cs` (277 lines)
+  - `src/Cli/StellaOps.Cli/Services/RationaleClient.cs` (274 lines)
+  - `src/Cli/StellaOps.Cli/Commands/AgentCommandGroup.cs` (274 lines)
+  - `src/Cli/StellaOps.Cli/Telemetry/CliMetrics.cs` (274 lines)
+  - `src/Cli/StellaOps.Cli/Commands/WitnessCommandGroup.cs` (273 lines)
+  - `src/Cli/StellaOps.Cli/Commands/SealCommandGroup.cs` (270 lines)
+  - `src/Cli/StellaOps.Cli/Commands/Sources/SourcesCommandGroup.cs` (267 lines)
+  - `src/Cli/StellaOps.Cli/Commands/MigrateArtifactsCommand.cs` (266 lines)
+  - `src/Cli/StellaOps.Cli/Services/Models/VexExplainModels.cs` (264 lines)
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.VerifyImage.cs` (264 lines)
+  - `src/Cli/StellaOps.Cli/Services/SbomerClient.cs` (262 lines)
+  - `src/Cli/StellaOps.Cli/Commands/Slice/SliceCommandGroup.cs` (259 lines)
+  - `src/Cli/StellaOps.Cli/Commands/CiCommandGroup.cs` (258 lines)
+  - `src/Cli/StellaOps.Cli/Output/CliErrorRenderer.cs` (255 lines)
+  - `src/Cli/StellaOps.Cli/Services/Models/MirrorBundleModels.cs` (249 lines)
+  - `src/Cli/StellaOps.Cli/Commands/Scan/BinaryDiffRegistryAuth.cs` (247 lines)
+  - `src/Cli/StellaOps.Cli/Commands/SecretsCommandGroup.cs` (247 lines)
+  - `src/Cli/StellaOps.Cli/Commands/Setup/Steps/Implementations/DatabaseSetupStep.cs` (246 lines)
+  - `src/Cli/StellaOps.Cli/Commands/Setup/Steps/Implementations/CacheSetupStep.cs` (246 lines)
+  - `src/Cli/StellaOps.Cli/Commands/Agent/ConfigCommands.cs` (245 lines)
+  - `src/Cli/StellaOps.Cli/Commands/Setup/Steps/Implementations/EnvironmentsSetupStep.cs` (245 lines)
+  - `src/Cli/StellaOps.Cli/Commands/Proof/AnchorCommandGroup.cs` (244 lines)
+  - `src/Cli/StellaOps.Cli/Commands/SystemCommandBuilder.cs` (240 lines)
+  - `src/Cli/StellaOps.Cli/Commands/Agent/BootstrapCommands.cs` (237 lines)
+  - `src/Cli/StellaOps.Cli/Services/Chat/ChatClient.cs` (235 lines)
+  - `src/Cli/StellaOps.Cli/Commands/Setup/SetupCommandGroup.cs` (235 lines)
+  - `src/Cli/StellaOps.Cli/Services/VexObservationsClient.cs` (232 lines)
+  - `src/Cli/StellaOps.Cli/Commands/TimestampCommandGroup.cs` (231 lines)
+  - `src/Cli/StellaOps.Cli/Commands/Witness/WitnessCoreCommandGroup.cs` (231 lines)
+  - `src/Cli/StellaOps.Cli/Services/Models/AttestationModels.cs` (230 lines)
+  - `src/Cli/StellaOps.Cli/Configuration/StellaOpsCliOptions.cs` (230 lines)
+  - `src/Cli/StellaOps.Cli/Commands/Setup/Steps/Implementations/RegistrySetupStep.cs` (228 lines)
+  - `src/Cli/StellaOps.Cli/Commands/ToolsCommandGroup.cs` (226 lines)
+  - `src/Cli/StellaOps.Cli/Commands/Agent/DoctorCommands.cs` (224 lines)
+  - `src/Cli/StellaOps.Cli/Commands/Setup/Steps/Implementations/TelemetrySetupStep.cs` (224 lines)
+  - `src/Cli/StellaOps.Cli/Services/AuthorityRevocationClient.cs` (223 lines)
+  - `src/Cli/StellaOps.Cli/Commands/Setup/Config/ISetupConfigParser.cs` (223 lines)
+  - `src/Cli/StellaOps.Cli/Services/Models/ApiSpecModels.cs` (223 lines)
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.VerdictRationale.cs` (221 lines)
+  - `src/Cli/StellaOps.Cli/Services/TrustPolicyLoader.cs` (218 lines)
+  - `src/Cli/StellaOps.Cli/Replay/ReplayBundleStoreAdapter.cs` (212 lines)
+  - `src/Cli/StellaOps.Cli/Commands/GoldenSet/VerifyFixCommandGroup.cs` (208 lines)
+  - `src/Cli/StellaOps.Cli/Infrastructure/CommandGroupBuilder.cs` (208 lines)
+  - `src/Cli/StellaOps.Cli/Services/Models/AttestorTransportModels.cs` (207 lines)
+  - `src/Cli/StellaOps.Cli/Infrastructure/RouteMappingConfiguration.cs` (203 lines)
+  - `src/Cli/StellaOps.Cli/Services/DsseSignatureVerifier.cs` (200 lines)
+  - `src/Cli/StellaOps.Cli/Export/DeterministicExportUtilities.cs` (199 lines)
+  - `src/Cli/StellaOps.Cli/Telemetry/TraceparentHttpMessageHandler.cs` (193 lines)
+  - `src/Cli/StellaOps.Cli/Commands/Setup/Steps/Implementations/MigrationsSetupStep.cs` (190 lines)
+  - `src/Cli/StellaOps.Cli/Services/Models/RationaleModels.cs` (189 lines)
+  - `src/Cli/StellaOps.Cli/Services/Transport/OfflineTransport.cs` (186 lines)
+  - `src/Cli/StellaOps.Cli/Commands/Setup/Steps/Implementations/SetupStepBase.cs` (185 lines)
+  - `src/Cli/StellaOps.Cli/Services/Models/Transport/ProblemDocument.cs` (184 lines)
+  - `src/Cli/StellaOps.Cli/Commands/DriftExitCodes.cs` (182 lines)
+  - `src/Cli/StellaOps.Cli/Infrastructure/CommandRouter.cs` (179 lines)
+  - `src/Cli/StellaOps.Cli/Commands/Setup/Steps/SetupStepCatalog.cs` (179 lines)
+  - `src/Cli/StellaOps.Cli/Commands/ReachGraph/ReachGraphCommandGroup.cs` (179 lines)
+  - `src/Cli/StellaOps.Cli/Services/CryptoProfileValidator.cs` (175 lines)
+  - `src/Cli/StellaOps.Cli/Commands/Setup/State/ISetupStateStore.cs` (174 lines)
+  - `src/Cli/StellaOps.Cli/Audit/IAuditBundleService.cs` (172 lines)
+  - `src/Cli/StellaOps.Cli/Services/Transport/HttpTransport.cs` (166 lines)
+  - `src/Cli/StellaOps.Cli/Commands/OfflineCommandGroup.cs` (164 lines)
+  - `src/Cli/StellaOps.Cli/Services/CvssClient.cs` (164 lines)
+  - `src/Cli/StellaOps.Cli/Commands/Agent/UpdateCommands.cs` (163 lines)
+  - `src/Cli/StellaOps.Cli/Services/IBackendOperationsClient.cs` (155 lines)
+  - `src/Cli/StellaOps.Cli/Plugins/CliPluginManifestLoader.cs` (150 lines)
+  - `src/Cli/StellaOps.Cli/Commands/Proof/ReceiptCommandGroup.cs` (149 lines)
+  - `src/Cli/StellaOps.Cli/Services/Models/AdvisoryAi/AdvisoryAiModels.cs` (148 lines)
+  - `src/Cli/StellaOps.Cli/Services/OciImageReferenceParser.cs` (142 lines)
+  - `src/Cli/StellaOps.Cli/Services/TenantProfileStore.cs` (141 lines)
+  - `src/Cli/StellaOps.Cli/Infrastructure/DeprecationWarningService.cs` (137 lines)
+  - `src/Cli/StellaOps.Cli/Replay/TimelineQueryAdapter.cs` (134 lines)
+  - `src/Cli/StellaOps.Cli/Services/Models/SymbolBundleModels.cs` (130 lines)
+  - `src/Cli/StellaOps.Cli/Commands/Agent/CertificateCommands.cs` (128 lines)
+  - `src/Cli/StellaOps.Cli/Services/Models/AttestationBundleModels.cs` (126 lines)
+  - `src/Cli/StellaOps.Cli/Services/Transport/TransportFactory.cs` (126 lines)
+  - `src/Cli/StellaOps.Cli/Services/IPackClient.cs` (124 lines)
+  - `src/Cli/StellaOps.Cli/Services/MigrationCommandService.cs` (123 lines)
+  - `src/Cli/StellaOps.Cli/Services/AuthorityDiagnosticsReporter.cs` (123 lines)
+  - `src/Cli/StellaOps.Cli/Services/FileBundleVersionStore.cs` (120 lines)
+  - `src/Cli/StellaOps.Cli/Services/Models/AdvisoryObservationsModels.cs` (117 lines)
+  - `src/Cli/StellaOps.Cli/Extensions/StellaOpsTokenClientExtensions.cs` (115 lines)
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.ExportCache.cs` (113 lines)
+  - `src/Cli/StellaOps.Cli/Services/AuthorityConsoleClient.cs` (112 lines)
+  - `src/Cli/StellaOps.Cli/Services/Models/OfflineKitModels.cs` (111 lines)
+  - `src/Cli/StellaOps.Cli/Output/IOutputRenderer.cs` (109 lines)
+  - `src/Cli/StellaOps.Cli/Commands/Setup/Steps/SetupStepContext.cs` (108 lines)
+  - `src/Cli/StellaOps.Cli/Output/IOutputWriter.cs` (107 lines)
+  - `src/Cli/StellaOps.Cli/Services/Models/Transport/PolicyFindingsTransport.cs` (106 lines)
+  - `src/Cli/StellaOps.Cli/Services/Models/Transport/OfflineKitTransport.cs` (103 lines)
+  - `src/Cli/StellaOps.Cli/Services/Models/OciModels.cs` (103 lines)
+  - `src/Cli/StellaOps.Cli/Services/IOrchestratorClient.cs` (102 lines)
+- Service locator matches:
+  - `src/Cli/StellaOps.Cli/Configuration/HttpClientBuilderExtensions.cs`:19 var policy = sp.GetService<IEgressPolicy>();
+  - `src/Cli/StellaOps.Cli/Commands/AttestCommandGroup.cs`:568 var policyEvaluator = services.GetService<StellaOps.Policy.Interop.Abstractions.IPolicyEvaluator>();
+  - `src/Cli/StellaOps.Cli/Program.cs`:359 await using var serviceProvider = services.BuildServiceProvider();
+  - `src/Cli/StellaOps.Cli/Commands/Advise/AdviseChatCommandGroup.cs`:748 var client = services.GetService<IChatClient>();
+  - `src/Cli/StellaOps.Cli/Commands/Advise/AdviseChatCommandGroup.cs`:755 var httpClientFactory = services.GetService<IHttpClientFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/ChangeTraceCommandGroup.cs`:84 var builder = services.GetService(typeof(IChangeTraceBuilder)) as IChangeTraceBuilder
+  - `src/Cli/StellaOps.Cli/Commands/BundleExportCommand.cs`:140 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/Budget/RiskBudgetCommandGroup.cs`:359 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/Budget/RiskBudgetCommandGroup.cs`:361 var httpClientFactory = services.GetService<IHttpClientFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/Budget/RiskBudgetCommandGroup.cs`:422 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/Budget/RiskBudgetCommandGroup.cs`:424 var httpClientFactory = services.GetService<IHttpClientFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/Budget/RiskBudgetCommandGroup.cs`:484 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/Budget/RiskBudgetCommandGroup.cs`:486 var httpClientFactory = services.GetService<IHttpClientFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/Budget/RiskBudgetCommandGroup.cs`:552 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/Budget/RiskBudgetCommandGroup.cs`:554 var httpClientFactory = services.GetService<IHttpClientFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/Budget/RiskBudgetCommandGroup.cs`:613 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/Budget/RiskBudgetCommandGroup.cs`:615 var httpClientFactory = services.GetService<IHttpClientFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/CheckpointCommands.cs`:187 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/CheckpointCommands.cs`:271 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/BundleVerifyCommand.cs`:161 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/Binary/BinaryCommandHandlers.cs`:598 GeneratedAt = (services.GetService<TimeProvider>() ?? TimeProvider.System).GetUtcNow().ToString("O", CultureInfo.InvariantCulture)
+  - `src/Cli/StellaOps.Cli/Commands/Binary/BinaryCommandHandlers.cs`:666 var timeProvider = services.GetService<TimeProvider>() ?? TimeProvider.System;
+  - `src/Cli/StellaOps.Cli/Commands/Binary/BinaryCommandHandlers.cs`:677 var timeProvider = services.GetService<TimeProvider>() ?? TimeProvider.System;
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.AirGap.cs`:137 var exporter = scope.ServiceProvider.GetService<IAirGapBundleExporter>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.AirGap.cs`:228 var importer = scope.ServiceProvider.GetService<IAirGapBundleImporter>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.AirGap.cs`:310 var syncService = scope.ServiceProvider.GetService<IAirGapSyncService>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.AirGap.cs`:395 var transport = scope.ServiceProvider.GetService<IJobSyncTransport>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.Audit.cs`:44 var loggerFactory = scope.ServiceProvider.GetRequiredService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.Audit.cs`:46 var options = scope.ServiceProvider.GetRequiredService<StellaOpsCliOptions>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.Audit.cs`:64 var builder = scope.ServiceProvider.GetService<IAuditPackBuilder>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.Audit.cs`:135 var loggerFactory = scope.ServiceProvider.GetRequiredService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.Audit.cs`:137 var options = scope.ServiceProvider.GetRequiredService<StellaOpsCliOptions>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.Audit.cs`:165 var importer = scope.ServiceProvider.GetService<IAuditPackImporter>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.Audit.cs`:166 var replayer = scope.ServiceProvider.GetService<IAuditPackReplayer>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.Audit.cs`:250 var loggerFactory = scope.ServiceProvider.GetRequiredService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.Audit.cs`:272 var importer = scope.ServiceProvider.GetService<IAuditPackImporter>();
+  - `src/Cli/StellaOps.Cli/Commands/Binary/DeltaSigCommandGroup.cs`:587 var rekorClient = services.GetService<IRekorClient>();
+  - `src/Cli/StellaOps.Cli/Commands/Binary/DeltaSigCommandGroup.cs`:777 var gate = services.GetService<IDeltaScopePolicyGate>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.Federation.cs`:38 var httpClientFactory = services.GetService<IHttpClientFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.Federation.cs`:173 var httpClientFactory = services.GetService<IHttpClientFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.Federation.cs`:286 var httpClientFactory = services.GetService<IHttpClientFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.Federation.cs`:419 var httpClientFactory = services.GetService<IHttpClientFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.Federation.cs`:546 var httpClientFactory = services.GetService<IHttpClientFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.Federation.cs`:642 var httpClientFactory = services.GetService<IHttpClientFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.Federation.cs`:741 var httpClientFactory = services.GetService<IHttpClientFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.Image.cs`:27 var loggerFactory = scope.ServiceProvider.GetRequiredService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.Image.cs`:29 var options = scope.ServiceProvider.GetRequiredService<StellaOpsCliOptions>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.Image.cs`:73 var inspector = scope.ServiceProvider.GetRequiredService<IOciImageInspector>();
+  - `src/Cli/StellaOps.Cli/Services/CryptoProfileValidator.cs`:39 var registry = serviceProvider.GetService<ICryptoProviderRegistry>();
+  - `src/Cli/StellaOps.Cli/Services/CryptoProfileValidator.cs`:48 var optionsMonitor = serviceProvider.GetService<IOptionsMonitor<CryptoProviderRegistryOptions>>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.Sign.cs`:66 var sigstoreService = services.GetService<ISigstoreSigningService>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.Sign.cs`:183 var sigstoreService = services.GetService<ISigstoreSigningService>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.Feeds.cs`:41 var httpClientFactory = services.GetService<IHttpClientFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.Feeds.cs`:139 var httpClientFactory = services.GetService<IHttpClientFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.Feeds.cs`:229 var httpClientFactory = services.GetService<IHttpClientFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.Feeds.cs`:334 var httpClientFactory = services.GetService<IHttpClientFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.Feeds.cs`:413 var httpClientFactory = services.GetService<IHttpClientFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.VerdictRationale.cs`:39 var loggerFactory = scope.ServiceProvider.GetRequiredService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.VerdictRationale.cs`:41 var options = scope.ServiceProvider.GetRequiredService<StellaOpsCliOptions>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.VerdictRationale.cs`:63 var rationaleClient = scope.ServiceProvider.GetRequiredService<IRationaleClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.Secrets.cs`:39 var logger = services.GetService<ILoggerFactory>()?.CreateLogger("Secrets.Bundle.Create");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.Secrets.cs`:65 var builderLogger = services.GetService<ILoggerFactory>()?.CreateLogger<BundleBuilder>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.Secrets.cs`:66 var validatorLogger = services.GetService<ILoggerFactory>()?.CreateLogger<RuleValidator>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.Secrets.cs`:124 var signerLogger = services.GetService<ILoggerFactory>()?.CreateLogger<BundleSigner>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.Secrets.cs`:219 var verifierLogger = services.GetService<ILoggerFactory>()?.CreateLogger<BundleVerifier>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.Offline.cs`:42 var options = scope.ServiceProvider.GetRequiredService<StellaOpsCliOptions>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.Offline.cs`:43 var loggerFactory = scope.ServiceProvider.GetRequiredService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.Offline.cs`:45 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.Offline.cs`:856 var options = scope.ServiceProvider.GetRequiredService<StellaOpsCliOptions>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.Offline.cs`:857 var loggerFactory = scope.ServiceProvider.GetRequiredService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.Offline.cs`:859 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.VerifyBundle.cs`:37 var loggerFactory = scope.ServiceProvider.GetRequiredService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.VerifyImage.cs`:34 var loggerFactory = scope.ServiceProvider.GetRequiredService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.VerifyImage.cs`:36 var options = scope.ServiceProvider.GetRequiredService<StellaOpsCliOptions>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.VerifyImage.cs`:65 var verifier = scope.ServiceProvider.GetRequiredService<IImageAttestationVerifier>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.VerdictVerify.cs`:42 var loggerFactory = scope.ServiceProvider.GetRequiredService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.VerdictVerify.cs`:44 var options = scope.ServiceProvider.GetRequiredService<StellaOpsCliOptions>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.VerdictVerify.cs`:65 var verifier = scope.ServiceProvider.GetRequiredService<IVerdictAttestationVerifier>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.VerdictVerify.cs`:101 var loggerFactory = scope.ServiceProvider.GetRequiredService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.VerdictVerify.cs`:103 var options = scope.ServiceProvider.GetRequiredService<StellaOpsCliOptions>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.VerdictVerify.cs`:124 var verifier = scope.ServiceProvider.GetRequiredService<IVerdictAttestationVerifier>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.VerdictVerify.cs`:157 var loggerFactory = scope.ServiceProvider.GetRequiredService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.VerdictVerify.cs`:159 var options = scope.ServiceProvider.GetRequiredService<StellaOpsCliOptions>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.VerdictVerify.cs`:195 var verifier = scope.ServiceProvider.GetRequiredService<IVerdictAttestationVerifier>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.VerifyOffline.cs`:28 var loggerFactory = scope.ServiceProvider.GetRequiredService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.VerifyOffline.cs`:30 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.Witness.cs`:47 var client = scope.ServiceProvider.GetRequiredService<IBackendOperationsClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.Witness.cs`:107 var client = scope.ServiceProvider.GetRequiredService<IBackendOperationsClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.Witness.cs`:168 var client = scope.ServiceProvider.GetRequiredService<IBackendOperationsClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.Witness.cs`:230 var client = scope.ServiceProvider.GetRequiredService<IBackendOperationsClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:95 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:114 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("cvss-score");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:115 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:131 var engine = scope.ServiceProvider.GetRequiredService<ICvssV4Engine>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:134 var client = scope.ServiceProvider.GetRequiredService<ICvssClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:184 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("cvss-show");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:185 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:190 var client = scope.ServiceProvider.GetRequiredService<ICvssClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:229 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("cvss-history");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:230 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:235 var client = scope.ServiceProvider.GetRequiredService<ICvssClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:273 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("cvss-export");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:274 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:279 var client = scope.ServiceProvider.GetRequiredService<ICvssClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:348 var client = scope.ServiceProvider.GetRequiredService<IBackendOperationsClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:349 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("scanner-download");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:350 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:377 var installer = scope.ServiceProvider.GetRequiredService<IScannerInstaller>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:408 var client = scope.ServiceProvider.GetRequiredService<IBackendOperationsClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:409 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("task-runner-simulate");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:410 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:663 var executor = scope.ServiceProvider.GetRequiredService<IScannerExecutor>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:664 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("scanner-run");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:665 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:677 var options = scope.ServiceProvider.GetRequiredService<StellaOpsCliOptions>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:694 var backend = scope.ServiceProvider.GetRequiredService<IBackendOperationsClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:735 var client = scope.ServiceProvider.GetRequiredService<IBackendOperationsClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:736 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("scan-sarif");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:737 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:854 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("scan-replay");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:855 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:1018 var client = scope.ServiceProvider.GetRequiredService<IBackendOperationsClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:1019 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("scanner-upload");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:1020 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:1055 var client = scope.ServiceProvider.GetRequiredService<IBackendOperationsClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:1056 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("scan-entrytrace");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:1057 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:1111 var client = scope.ServiceProvider.GetRequiredService<IBackendOperationsClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:1112 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("advise-run");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:1113 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:1349 var client = scope.ServiceProvider.GetRequiredService<IBackendOperationsClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:1350 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("sources-ingest");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:1351 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:1467 var client = scope.ServiceProvider.GetRequiredService<IBackendOperationsClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:1468 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("aoc-verify");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:1469 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:1596 var client = scope.ServiceProvider.GetRequiredService<IBackendOperationsClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:1597 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("db-connector");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:1598 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:1639 var client = scope.ServiceProvider.GetRequiredService<IBackendOperationsClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:1640 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("db-merge");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:1641 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:1675 var client = scope.ServiceProvider.GetRequiredService<IBackendOperationsClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:1676 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("db-export");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:1677 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:1859 var client = scope.ServiceProvider.GetRequiredService<IBackendOperationsClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:1860 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("excititor-list-providers");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:1861 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:1929 var client = scopeHandle.ServiceProvider.GetRequiredService<IBackendOperationsClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:1930 var logger = scopeHandle.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("excititor-export");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:1931 var options = scopeHandle.ServiceProvider.GetRequiredService<StellaOpsCliOptions>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:1932 var verbosity = scopeHandle.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:2282 var client = scope.ServiceProvider.GetRequiredService<IBackendOperationsClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:2283 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("runtime-policy-test");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:2284 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:2379 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("auth-login");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:2389 var tokenClient = scope.ServiceProvider.GetService<IStellaOpsTokenClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:2459 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("auth-logout");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:2462 var tokenClient = scope.ServiceProvider.GetService<IStellaOpsTokenClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:2490 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("auth-status");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:2500 var tokenClient = scope.ServiceProvider.GetService<IStellaOpsTokenClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:2538 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("auth-whoami");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:2548 var tokenClient = scope.ServiceProvider.GetService<IStellaOpsTokenClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:2642 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("auth-revoke-export");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:2647 var client = scope.ServiceProvider.GetRequiredService<IAuthorityRevocationClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:2868 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("tenants-list");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:2878 var client = scope.ServiceProvider.GetService<IAuthorityConsoleClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:2958 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("tenants-use");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:2973 var client = scope.ServiceProvider.GetService<IAuthorityConsoleClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:3105 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("token-mint");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:3115 var client = scope.ServiceProvider.GetService<IAuthorityConsoleClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:3194 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("token-delegate");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:3204 var client = scope.ServiceProvider.GetService<IAuthorityConsoleClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:3330 var client = scope.ServiceProvider.GetRequiredService<IConcelierObservationsClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:3331 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("vuln-observations");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:3332 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:3496 var client = scope.ServiceProvider.GetRequiredService<IBackendOperationsClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:3497 var options = scope.ServiceProvider.GetRequiredService<StellaOpsCliOptions>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:3498 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("offline-kit-pull");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:3499 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:3572 var client = scope.ServiceProvider.GetRequiredService<IBackendOperationsClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:3573 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("policy-findings-ls");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:3574 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:3711 var client = scope.ServiceProvider.GetRequiredService<IBackendOperationsClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:3712 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("policy-findings-get");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:3713 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:3792 var client = scope.ServiceProvider.GetRequiredService<IBackendOperationsClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:3793 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("policy-findings-explain");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:3794 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:3883 var client = scope.ServiceProvider.GetRequiredService<IBackendOperationsClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:3884 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("policy-activate");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:3885 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:4009 var client = scope.ServiceProvider.GetRequiredService<IBackendOperationsClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:4010 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("policy-simulate");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:4011 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:4222 var client = scope.ServiceProvider.GetRequiredService<IBackendOperationsClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:4223 var options = scope.ServiceProvider.GetRequiredService<StellaOpsCliOptions>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:4224 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("offline-kit-import");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:4225 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:4360 var client = scope.ServiceProvider.GetRequiredService<IBackendOperationsClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:4361 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("offline-kit-status");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:4362 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:4833 var client = scope.ServiceProvider.GetRequiredService<IBackendOperationsClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:4834 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger(commandName.Replace(' ', '-'));
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:4835 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:7793 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("kms-export");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:7794 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:7872 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("kms-import");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:7873 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:8337 var loggerFactory = scope.ServiceProvider.GetRequiredService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:8339 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:8347 var registry = scope.ServiceProvider.GetService<ICryptoProviderRegistry>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:8355 var optionsMonitor = scope.ServiceProvider.GetService<IOptionsMonitor<CryptoProviderRegistryOptions>>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:8482 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger(loggerCategory);
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:8483 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:8608 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("ruby-inspect");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:8609 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:8696 var client = scope.ServiceProvider.GetRequiredService<IBackendOperationsClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:8697 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("ruby-resolve");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:8698 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:8792 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("php-inspect");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:8793 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:8882 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("python-inspect");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:8883 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:8990 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("bun-inspect");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:8991 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:9078 var client = scope.ServiceProvider.GetRequiredService<IBackendOperationsClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:9079 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("bun-resolve");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:9080 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:11404 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:11788 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:12322 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:15093 var client = scope.ServiceProvider.GetRequiredService<IBackendOperationsClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:15094 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("vex-consensus");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:15095 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:15266 var client = scope.ServiceProvider.GetRequiredService<IBackendOperationsClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:15267 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("vex-consensus");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:15268 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:15702 var client = scope.ServiceProvider.GetRequiredService<IBackendOperationsClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:15703 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("vex-simulate");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:15704 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:15916 var client = scope.ServiceProvider.GetRequiredService<IBackendOperationsClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:15917 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("vex-export");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:15918 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:16026 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("vex-verify");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:16027 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:16173 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("vex-explain");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:16174 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:16485 var client = scope.ServiceProvider.GetRequiredService<IVexObservationsClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:16486 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("vex-obs");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:16487 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:16622 var client = scope.ServiceProvider.GetRequiredService<IVexObservationsClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:16623 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("vex-linkset");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:16624 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:16829 var client = scope.ServiceProvider.GetRequiredService<IBackendOperationsClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:16830 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("vuln-list");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:16831 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:17024 var client = scope.ServiceProvider.GetRequiredService<IBackendOperationsClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:17025 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("vuln-show");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:17026 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:17284 var client = scope.ServiceProvider.GetRequiredService<IBackendOperationsClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:17285 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("vuln-workflow");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:17286 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:17469 var client = scope.ServiceProvider.GetRequiredService<IBackendOperationsClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:17470 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("vuln-simulate");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:17471 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:17676 var client = scope.ServiceProvider.GetRequiredService<IBackendOperationsClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:17677 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("vuln-export");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:17678 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:17791 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("vuln-export-verify");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:17792 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:17945 var client = scope.ServiceProvider.GetRequiredService<IConcelierObservationsClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:17946 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("advisory-obs");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:17947 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:18311 var client = scope.ServiceProvider.GetRequiredService<IConcelierObservationsClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:18312 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("advisory-linkset");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:18313 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:18496 var client = scope.ServiceProvider.GetRequiredService<IConcelierObservationsClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:18497 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("advisory-export");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:18498 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:18732 var client = scope.ServiceProvider.GetRequiredService<IForensicSnapshotClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:18733 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("forensic-snapshot");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:18734 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:18846 var client = scope.ServiceProvider.GetRequiredService<IForensicSnapshotClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:18847 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("forensic-snapshot");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:18848 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:18958 var client = scope.ServiceProvider.GetRequiredService<IForensicSnapshotClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:18959 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("forensic-snapshot");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:18960 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:19235 var verifier = scope.ServiceProvider.GetRequiredService<IForensicVerifier>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:19236 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("forensic-verify");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:19237 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:19454 var reader = scope.ServiceProvider.GetRequiredService<IAttestationReader>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:19455 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("forensic-attest");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:19456 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:19730 var assembler = scope.ServiceProvider.GetRequiredService<IPromotionAssembler>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:19731 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("promotion-assemble");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:19732 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:19921 var assembler = scope.ServiceProvider.GetRequiredService<IPromotionAssembler>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:19922 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("promotion-attest");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:19923 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:20070 var assembler = scope.ServiceProvider.GetRequiredService<IPromotionAssembler>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:20071 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("promotion-verify");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:20072 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:20320 var harness = scope.ServiceProvider.GetRequiredService<IDeterminismHarness>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:20321 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("detscore-run");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:20322 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:20591 var harness = scope.ServiceProvider.GetRequiredService<IDeterminismHarness>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:20592 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("detscore-report");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:20593 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:20794 var client = scope.ServiceProvider.GetRequiredService<IObservabilityClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:20795 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("obs-top");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:20796 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:21111 var client = scope.ServiceProvider.GetRequiredService<IObservabilityClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:21112 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("obs-trace");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:21113 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:21277 var client = scope.ServiceProvider.GetRequiredService<IObservabilityClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:21278 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("obs-logs");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:21279 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:21458 var client = scope.ServiceProvider.GetRequiredService<IObservabilityClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:21459 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("obs-incident-mode");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:21460 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:21543 var client = scope.ServiceProvider.GetRequiredService<IObservabilityClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:21544 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("obs-incident-mode");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:21545 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:21630 var client = scope.ServiceProvider.GetRequiredService<IObservabilityClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:21631 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("obs-incident-mode");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:21632 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:21766 var client = scope.ServiceProvider.GetRequiredService<IPackClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:21767 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("pack-plan");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:21768 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:21894 var client = scope.ServiceProvider.GetRequiredService<IPackClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:21895 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("pack-run");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:21896 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:22035 var client = scope.ServiceProvider.GetRequiredService<IPackClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:22036 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("pack-push");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:22037 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:22135 var client = scope.ServiceProvider.GetRequiredService<IPackClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:22136 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("pack-pull");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:22137 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:22232 var client = scope.ServiceProvider.GetRequiredService<IPackClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:22233 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("pack-verify");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:22234 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:28255 var client = scope.ServiceProvider.GetRequiredService<IBackendOperationsClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:28256 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("risk-profile-list");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:28257 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:28364 var client = scope.ServiceProvider.GetRequiredService<IBackendOperationsClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:28365 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("risk-simulate");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:28366 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:28574 var client = scope.ServiceProvider.GetRequiredService<IBackendOperationsClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:28575 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("risk-results");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:28576 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:28749 var client = scope.ServiceProvider.GetRequiredService<IBackendOperationsClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:28750 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("risk-bundle-verify");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:28751 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:28907 var client = scope.ServiceProvider.GetRequiredService<IBackendOperationsClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:28908 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("reachability-upload");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:28909 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:29039 var client = scope.ServiceProvider.GetRequiredService<IBackendOperationsClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:29040 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("reachability-list");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:29041 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:29153 var client = scope.ServiceProvider.GetRequiredService<IBackendOperationsClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:29154 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("reachability-explain");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:29155 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:29338 var client = scope.ServiceProvider.GetRequiredService<IBackendOperationsClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:29339 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("graph-explain");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:29340 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:29647 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("graph-verify");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:29648 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:29798 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("graph-bundles");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:29799 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:29925 var client = scope.ServiceProvider.GetRequiredService<IBackendOperationsClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:29926 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("api-spec-list");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:29927 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:30054 var client = scope.ServiceProvider.GetRequiredService<IBackendOperationsClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:30055 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("api-spec-download");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:30056 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:30181 var client = scope.ServiceProvider.GetRequiredService<IBackendOperationsClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:30182 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("sdk-update");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:30183 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:30343 var client = scope.ServiceProvider.GetRequiredService<IBackendOperationsClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:30344 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("sdk-list");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:30345 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:30462 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("mirror-create");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:30463 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:30718 var loggerFactory = scope.ServiceProvider.GetRequiredService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:30970 var importService = scope.ServiceProvider.GetService<IMirrorBundleImportService>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:31078 var loggerFactory = scope.ServiceProvider.GetRequiredService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:31910 var loggerFactory = scope.ServiceProvider.GetRequiredService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:32017 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("decision-export");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:32018 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:32041 var client = scope.ServiceProvider.GetRequiredService<BackendOperationsClient>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:32131 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("decision-verify");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:32132 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:32341 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("decision-compare");
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:32342 var verbosity = scope.ServiceProvider.GetRequiredService<VerbosityState>();
+  - `src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs`:33425 var verifier = services.GetService<IDsseSignatureVerifier>();
+  - `src/Cli/StellaOps.Cli/Commands/Compare/CompareCommandBuilder.cs`:93 var renderer = services.GetService<IOutputRenderer>() ?? new OutputRenderer();
+  - `src/Cli/StellaOps.Cli/Commands/Compare/CompareCommandBuilder.cs`:94 var client = services.GetService<ICompareClient>()
+  - `src/Cli/StellaOps.Cli/Commands/Compare/CompareCommandBuilder.cs`:125 var renderer = services.GetService<IOutputRenderer>() ?? new OutputRenderer();
+  - `src/Cli/StellaOps.Cli/Commands/Compare/CompareCommandBuilder.cs`:126 var client = services.GetService<ICompareClient>()
+  - `src/Cli/StellaOps.Cli/Commands/Compare/CompareCommandBuilder.cs`:146 var client = services.GetService<ICompareClient>()
+  - `src/Cli/StellaOps.Cli/Commands/Compare/CompareCommandBuilder.cs`:175 var renderer = services.GetService<IOutputRenderer>() ?? new OutputRenderer();
+  - `src/Cli/StellaOps.Cli/Commands/Compare/CompareCommandBuilder.cs`:176 var client = services.GetService<ICompareClient>()
+  - `src/Cli/StellaOps.Cli/Commands/HlcCommandGroup.cs`:101 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/DbCommandGroup.cs`:102 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/DbCommandGroup.cs`:117 var httpClientFactory = services.GetService<IHttpClientFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/DbCommandGroup.cs`:550 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/EvidenceCommandGroup.cs`:773 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/DoctorCommandGroup.cs`:880 var environment = services.GetService<IHostEnvironment>();
+  - `src/Cli/StellaOps.Cli/Commands/GuardCommandGroup.cs`:225 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/GuardCommandGroup.cs`:400 var httpClientFactory = services.GetService<IHttpClientFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/DriftCommandGroup.cs`:108 var logger = scope.ServiceProvider.GetService<ILoggerFactory>()?.CreateLogger("drift")
+  - `src/Cli/StellaOps.Cli/Commands/DriftCommandGroup.cs`:110 var timeProvider = scope.ServiceProvider.GetService<TimeProvider>() ?? TimeProvider.System;
+  - `src/Cli/StellaOps.Cli/Commands/DriftCommandGroup.cs`:114 var driftDetector = scope.ServiceProvider.GetService<IFacetDriftDetector>();
+  - `src/Cli/StellaOps.Cli/Commands/DriftCommandGroup.cs`:115 var sealStore = scope.ServiceProvider.GetService<IFacetSealStore>();
+  - `src/Cli/StellaOps.Cli/Commands/ExplainCommandGroup.cs`:232 var logger = services.GetService<ILoggerFactory>()?.CreateLogger(typeof(ExplainCommandGroup));
+  - `src/Cli/StellaOps.Cli/Commands/ExplainCommandGroup.cs`:233 var options = services.GetService<StellaOpsCliOptions>();
+  - `src/Cli/StellaOps.Cli/Commands/ExplainCommandGroup.cs`:236 var httpClientFactory = services.GetService<IHttpClientFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/ExceptionCommandGroup.cs`:388 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/ExceptionCommandGroup.cs`:504 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/ExceptionCommandGroup.cs`:592 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/ExceptionCommandGroup.cs`:679 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/ExceptionCommandGroup.cs`:748 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/ExceptionCommandGroup.cs`:812 var httpClientFactory = services.GetService<IHttpClientFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/GroundTruthCommandGroup.cs`:190 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/GroundTruthCommandGroup.cs`:225 var exportService = services.GetService<IBundleExportService>();
+  - `src/Cli/StellaOps.Cli/Commands/GroundTruthCommandGroup.cs`:509 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/GroundTruthCommandGroup.cs`:533 var importService = services.GetService<IBundleImportService>();
+  - `src/Cli/StellaOps.Cli/Commands/GroundTruthCommandGroup.cs`:828 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/GroundTruthCommandGroup.cs`:844 var regressionService = services.GetService<IKpiRegressionService>();
+  - `src/Cli/StellaOps.Cli/Commands/GroundTruthCommandGroup.cs`:963 var regressionService = services.GetService<IKpiRegressionService>();
+  - `src/Cli/StellaOps.Cli/Commands/GroundTruthCommandGroup.cs`:1496 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/GroundTruthCommandGroup.cs`:1509 var regressionService = services.GetService<IKpiRegressionService>();
+  - `src/Cli/StellaOps.Cli/Commands/ExportCommandGroup.cs`:302 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/GateCommandGroup.cs`:227 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/GateCommandGroup.cs`:273 var httpClientFactory = services.GetService<IHttpClientFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/GitHubCommandGroup.cs`:735 var client = services.GetService<IGitHubCodeScanningClient>();
+  - `src/Cli/StellaOps.Cli/Commands/LayerSbomCommandGroup.cs`:190 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/LayerSbomCommandGroup.cs`:259 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/LayerSbomCommandGroup.cs`:333 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/LayerSbomCommandGroup.cs`:576 var httpClientFactory = services.GetService<IHttpClientFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/PatchVerifyCommandGroup.cs`:150 var loggerFactory = scope.ServiceProvider.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/PatchVerifyCommandGroup.cs`:185 var orchestrator = scope.ServiceProvider.GetService<IPatchVerificationOrchestrator>();
+  - `src/Cli/StellaOps.Cli/Commands/ReachabilityCommandGroup.cs`:151 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/ReachabilityCommandGroup.cs`:385 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/ReachabilityCommandGroup.cs`:453 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/ProvCommandGroup.cs`:242 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/ProvCommandGroup.cs`:261 var exporter = services.GetService<IMinimalProofExporter>();
+  - `src/Cli/StellaOps.Cli/Commands/ProvCommandGroup.cs`:316 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/ProvCommandGroup.cs`:332 var exporter = services.GetService<IMinimalProofExporter>();
+  - `src/Cli/StellaOps.Cli/Commands/ProvCommandGroup.cs`:411 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/ProvCommandGroup.cs`:427 var exporter = services.GetService<IMinimalProofExporter>();
+  - `src/Cli/StellaOps.Cli/Commands/ProveCommandGroup.cs`:118 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/ProveCommandGroup.cs`:171 var timelineAdapter = services.GetService<ITimelineQueryAdapter>();
+  - `src/Cli/StellaOps.Cli/Commands/ProveCommandGroup.cs`:200 var timelineAdapter = services.GetService<ITimelineQueryAdapter>();
+  - `src/Cli/StellaOps.Cli/Commands/ProveCommandGroup.cs`:223 var bundleStore = services.GetService<IReplayBundleStoreAdapter>();
+  - `src/Cli/StellaOps.Cli/Commands/Observations/ObservationsCommandGroup.cs`:223 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/Observations/ObservationsCommandGroup.cs`:281 var store = services.GetService<IRuntimeObservationStore>();
+  - `src/Cli/StellaOps.Cli/Commands/FunctionMap/FunctionMapCommandGroup.cs`:207 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/FunctionMap/FunctionMapCommandGroup.cs`:241 var generator = services.GetService<IFunctionMapGenerator>();
+  - `src/Cli/StellaOps.Cli/Commands/FunctionMap/FunctionMapCommandGroup.cs`:313 var signer = services.GetService<StellaOps.Provenance.Attestation.ISigner>();
+  - `src/Cli/StellaOps.Cli/Commands/FunctionMap/FunctionMapCommandGroup.cs`:365 var rekorClient = services.GetService<StellaOps.Attestor.Core.Rekor.IRekorClient>();
+  - `src/Cli/StellaOps.Cli/Commands/FunctionMap/FunctionMapCommandGroup.cs`:688 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/FunctionMap/FunctionMapCommandGroup.cs`:779 var verifier = services.GetService<IClaimVerifier>();
+  - `src/Cli/StellaOps.Cli/Commands/ReplayCommandGroup.cs`:516 var replayEngine = services?.GetService<IReplayEngine>();
+  - `src/Cli/StellaOps.Cli/Commands/ReplayCommandGroup.cs`:617 // var verdictStore = services?.GetService<IVerdictStore>();
+  - `src/Cli/StellaOps.Cli/Commands/ScanGraphCommandGroup.cs`:146 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/ScanGraphCommandGroup.cs`:450 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/ScanGraphCommandGroup.cs`:452 var httpClientFactory = services.GetService<IHttpClientFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/ScoreGateCommandGroup.cs`:498 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/ScoreGateCommandGroup.cs`:567 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/ScoreGateCommandGroup.cs`:650 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/ScoreGateCommandGroup.cs`:941 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/ScoreGateCommandGroup.cs`:1059 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/ScoreGateCommandGroup.cs`:1208 var httpClientFactory = services.GetService<IHttpClientFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/ScoreReplayCommandGroup.cs`:115 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/ScoreReplayCommandGroup.cs`:139 var httpClientFactory = services.GetService<IHttpClientFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/ScoreReplayCommandGroup.cs`:560 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/ScoreReplayCommandGroup.cs`:562 var httpClientFactory = services.GetService<IHttpClientFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/ScoreReplayCommandGroup.cs`:658 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/ScoreReplayCommandGroup.cs`:660 var httpClientFactory = services.GetService<IHttpClientFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/ScoreReplayCommandGroup.cs`:742 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/ScoreReplayCommandGroup.cs`:744 var httpClientFactory = services.GetService<IHttpClientFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/Proof/ProofCommandGroup.cs`:135 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/Proof/ProofCommandGroup.cs`:166 var verifier = services.GetService<IAttestationBundleVerifier>();
+  - `src/Cli/StellaOps.Cli/Commands/Proof/ProofCommandGroup.cs`:171 services.GetService<ILogger<AttestationBundleVerifier>>()
+  - `src/Cli/StellaOps.Cli/Commands/Proof/ProofCommandGroup.cs`:243 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/SealCommandGroup.cs`:121 var logger = scope.ServiceProvider.GetService<ILoggerFactory>()?.CreateLogger("seal")
+  - `src/Cli/StellaOps.Cli/Commands/SealCommandGroup.cs`:123 var timeProvider = scope.ServiceProvider.GetService<TimeProvider>() ?? TimeProvider.System;
+  - `src/Cli/StellaOps.Cli/Commands/SealCommandGroup.cs`:127 var facetExtractor = scope.ServiceProvider.GetService<IFacetExtractor>();
+  - `src/Cli/StellaOps.Cli/Commands/SealCommandGroup.cs`:128 var sealStore = scope.ServiceProvider.GetService<IFacetSealStore>();
+  - `src/Cli/StellaOps.Cli/Commands/SealCommandGroup.cs`:129 var sealer = scope.ServiceProvider.GetService<FacetSealer>();
+  - `src/Cli/StellaOps.Cli/Commands/ScoreCommandGroup.cs`:494 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/ScoreCommandGroup.cs`:604 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/ScoreCommandGroup.cs`:690 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/ScoreCommandGroup.cs`:781 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/ScoreCommandGroup.cs`:911 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/ScoreCommandGroup.cs`:993 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/ScoreCommandGroup.cs`:1433 var httpClientFactory = services.GetService<IHttpClientFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/Scan/DeltaScanCommandGroup.cs`:168 var evidenceComposer = services.GetService<IDeltaEvidenceComposer>();
+  - `src/Cli/StellaOps.Cli/Commands/UnknownsCommandGroup.cs`:529 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/UnknownsCommandGroup.cs`:531 var httpClientFactory = services.GetService<IHttpClientFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/UnknownsCommandGroup.cs`:658 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/UnknownsCommandGroup.cs`:660 var httpClientFactory = services.GetService<IHttpClientFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/UnknownsCommandGroup.cs`:711 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/UnknownsCommandGroup.cs`:713 var httpClientFactory = services.GetService<IHttpClientFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/UnknownsCommandGroup.cs`:763 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/UnknownsCommandGroup.cs`:765 var httpClientFactory = services.GetService<IHttpClientFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/UnknownsCommandGroup.cs`:830 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/UnknownsCommandGroup.cs`:832 var httpClientFactory = services.GetService<IHttpClientFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/UnknownsCommandGroup.cs`:944 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/UnknownsCommandGroup.cs`:946 var httpClientFactory = services.GetService<IHttpClientFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/UnknownsCommandGroup.cs`:1015 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/UnknownsCommandGroup.cs`:1017 var httpClientFactory = services.GetService<IHttpClientFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/UnknownsCommandGroup.cs`:1145 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/UnknownsCommandGroup.cs`:1147 var httpClientFactory = services.GetService<IHttpClientFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/UnknownsCommandGroup.cs`:1218 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/UnknownsCommandGroup.cs`:1220 var httpClientFactory = services.GetService<IHttpClientFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/UnknownsCommandGroup.cs`:1439 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/UnknownsCommandGroup.cs`:1441 var httpClientFactory = services.GetService<IHttpClientFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/VexGateScanCommandGroup.cs`:159 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/VexGateScanCommandGroup.cs`:171 var httpClientFactory = services.GetService<IHttpClientFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/VexGateScanCommandGroup.cs`:270 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/VexGateScanCommandGroup.cs`:288 var httpClientFactory = services.GetService<IHttpClientFactory>();
+  - `src/Cli/StellaOps.Cli/Commands/Watchlist/WatchlistCommandHandlers.cs`:574 var factory = services.GetService(typeof(IHttpClientFactory)) as IHttpClientFactory;
+  - `src/Cli/StellaOps.Cli/Commands/VexGenCommandGroup.cs`:149 var logger = scope.ServiceProvider.GetService<ILoggerFactory>()?.CreateLogger("vex.gen")
+  - `src/Cli/StellaOps.Cli/Commands/VexGenCommandGroup.cs`:151 var timeProvider = scope.ServiceProvider.GetService<TimeProvider>() ?? TimeProvider.System;
+  - `src/Cli/StellaOps.Cli/Commands/VexGenCommandGroup.cs`:155 var driftDetector = scope.ServiceProvider.GetService<IFacetDriftDetector>();
+  - `src/Cli/StellaOps.Cli/Commands/VexGenCommandGroup.cs`:156 var sealStore = scope.ServiceProvider.GetService<IFacetSealStore>();
+  - `src/Cli/StellaOps.Cli/Commands/VexGenCommandGroup.cs`:214 var evidenceLinker = scope.ServiceProvider.GetService<IVexEvidenceLinker>();
+  - `src/Cli/StellaOps.Cli/Commands/Witness/WitnessCoreCommandHandlers.cs`:70 var patchVerifier = services.GetService<IPatchVerificationOrchestrator>();
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+- Replace service locator usage with constructor injection.
+
+## Testing Fullness Findings
+- Status: FAIL
+- Expected layers: Unit, CLI, Offline
+- Detected test projects: src/Cli/__Tests/StellaOps.Cli.Tests/StellaOps.Cli.Tests.csproj [CLI], src/Cli/__Tests/StellaOps.Cli.Commands.Setup.Tests/StellaOps.Cli.Commands.Setup.Tests.csproj [CLI]
+- Missing layers: Unit, Offline
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- Add a unit test project named `<Project>.Tests` (or document exception).
+- Add offline/airgap coverage with fixtures only.