feat(audit): Apply TreatWarningsAsErrors=true to 160+ production csproj files

Sprint: SPRINT_20251229_049_BE_csproj_audit_maint_tests
Tasks: AUDIT-0001 through AUDIT-0147 APPLY tasks (approved decisions 1-9)

Changes:
- Set TreatWarningsAsErrors=true for all production .NET projects
- Fixed nullable warnings in Scanner.EntryTrace, Scanner.Evidence,
  Scheduler.Worker, Concelier connectors, and other modules
- Injected TimeProvider/IGuidProvider for deterministic time/ID generation
- Added path traversal validation in AirGap.Bundle
- Fixed NULL handling in various cursor classes
- Third-party GostCryptography retains TreatWarningsAsErrors=false (preserves original)
- Test projects excluded per user decision (rejected decision 10)

Note: All 17 ACSC connector tests pass after snapshot fixture sync

src/__Libraries/StellaOps.Configuration/StellaOps.Configuration.csproj

@@ -5,6 +5,7 @@
     <TargetFramework>net10.0</TargetFramework>
     <ImplicitUsings>enable</ImplicitUsings>
     <Nullable>enable</Nullable>
+    <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
   </PropertyGroup>
 
   <ItemGroup>

src/__Libraries/StellaOps.Cryptography.DependencyInjection/StellaOps.Cryptography.DependencyInjection.csproj

@@ -4,7 +4,7 @@
     <LangVersion>preview</LangVersion>
     <ImplicitUsings>enable</ImplicitUsings>
     <Nullable>enable</Nullable>
-    <TreatWarningsAsErrors>false</TreatWarningsAsErrors>
+    <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
     <WarningsNotAsErrors>NU1701;NU1902;NU1903</WarningsNotAsErrors>
   </PropertyGroup>
 

src/__Libraries/StellaOps.Cryptography.Kms/StellaOps.Cryptography.Kms.csproj

@@ -3,6 +3,7 @@
     <TargetFramework>net10.0</TargetFramework>
     <ImplicitUsings>enable</ImplicitUsings>
     <Nullable>enable</Nullable>
+    <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
   </PropertyGroup>
   <ItemGroup>
     <PackageReference Include="Microsoft.Extensions.DependencyInjection.Abstractions" />

src/__Libraries/StellaOps.Cryptography.Plugin.BouncyCastle/StellaOps.Cryptography.Plugin.BouncyCastle.csproj

@@ -4,7 +4,7 @@
     <LangVersion>preview</LangVersion>
     <ImplicitUsings>enable</ImplicitUsings>
     <Nullable>enable</Nullable>
-    <TreatWarningsAsErrors>false</TreatWarningsAsErrors>
+    <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
   </PropertyGroup>
   <ItemGroup>
     <PackageReference Include="BouncyCastle.Cryptography" />

src/__Libraries/StellaOps.Cryptography.Plugin.CryptoPro/StellaOps.Cryptography.Plugin.CryptoPro.csproj

@@ -5,7 +5,7 @@
     <LangVersion>preview</LangVersion>
     <ImplicitUsings>enable</ImplicitUsings>
     <Nullable>enable</Nullable>
-    <TreatWarningsAsErrors>false</TreatWarningsAsErrors>
+    <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
     <!-- Exclude vendored fork files from this project (they compile via their own csproj) -->
     <DefaultItemExcludes>$(DefaultItemExcludes);third_party\**\*</DefaultItemExcludes>
   </PropertyGroup>

src/__Libraries/StellaOps.Cryptography.Plugin.CryptoPro/third_party/AlexMAS.GostCryptography/Source/GostCryptography/GostCryptography.csproj

@@ -13,6 +13,7 @@
     <AssemblyVersion>$(GostCryptographyVersion).0</AssemblyVersion>
     <FileVersion>$(GostCryptographyVersion).0</FileVersion>
     <GenerateDocumentationFile>true</GenerateDocumentationFile>
+    <!-- Third-party library - preserve original warning level -->
     <TreatWarningsAsErrors>false</TreatWarningsAsErrors>
   </PropertyGroup>
 

src/__Libraries/StellaOps.Cryptography.Plugin.EIDAS/StellaOps.Cryptography.Plugin.EIDAS.csproj

@@ -5,6 +5,7 @@
     <ImplicitUsings>enable</ImplicitUsings>
     <Nullable>enable</Nullable>
     <RootNamespace>StellaOps.Cryptography.Plugin.EIDAS</RootNamespace>
+    <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
   </PropertyGroup>
 
   <ItemGroup>

src/__Libraries/StellaOps.Cryptography.Plugin.OpenSslGost/StellaOps.Cryptography.Plugin.OpenSslGost.csproj

@@ -4,7 +4,7 @@
     <LangVersion>preview</LangVersion>
     <ImplicitUsings>enable</ImplicitUsings>
     <Nullable>enable</Nullable>
-    <TreatWarningsAsErrors>false</TreatWarningsAsErrors>
+    <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
   </PropertyGroup>
   <ItemGroup>
     <PackageReference Include="BouncyCastle.Cryptography" />

src/__Libraries/StellaOps.Cryptography.Plugin.Pkcs11Gost/StellaOps.Cryptography.Plugin.Pkcs11Gost.csproj

@@ -5,7 +5,7 @@
     <LangVersion>preview</LangVersion>
     <ImplicitUsings>enable</ImplicitUsings>
     <Nullable>enable</Nullable>
-    <TreatWarningsAsErrors>false</TreatWarningsAsErrors>
+    <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
   </PropertyGroup>
 
   <ItemGroup>

src/__Libraries/StellaOps.Cryptography.Plugin.PqSoft/StellaOps.Cryptography.Plugin.PqSoft.csproj

@@ -4,7 +4,7 @@
     <LangVersion>preview</LangVersion>
     <ImplicitUsings>enable</ImplicitUsings>
     <Nullable>enable</Nullable>
-    <TreatWarningsAsErrors>false</TreatWarningsAsErrors>
+    <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
   </PropertyGroup>
   <ItemGroup>
     <PackageReference Include="BouncyCastle.Cryptography" />

src/__Libraries/StellaOps.Cryptography.Plugin.SimRemote/StellaOps.Cryptography.Plugin.SimRemote.csproj

@@ -3,6 +3,7 @@
     <TargetFramework>net10.0</TargetFramework>
     <Nullable>enable</Nullable>
     <ImplicitUsings>enable</ImplicitUsings>
+    <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
   </PropertyGroup>
   <ItemGroup>
     <ProjectReference Include="..\\StellaOps.Cryptography\\StellaOps.Cryptography.csproj" />

src/__Libraries/StellaOps.Cryptography.Plugin.SmRemote/StellaOps.Cryptography.Plugin.SmRemote.csproj

@@ -3,6 +3,7 @@
     <TargetFramework>net10.0</TargetFramework>
     <ImplicitUsings>enable</ImplicitUsings>
     <Nullable>enable</Nullable>
+    <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
   </PropertyGroup>
   <ItemGroup>
     <ProjectReference Include="..\StellaOps.Cryptography\StellaOps.Cryptography.csproj" />

src/__Libraries/StellaOps.Cryptography.Plugin.SmSoft/StellaOps.Cryptography.Plugin.SmSoft.csproj

@@ -4,7 +4,7 @@
     <LangVersion>preview</LangVersion>
     <ImplicitUsings>enable</ImplicitUsings>
     <Nullable>enable</Nullable>
-    <TreatWarningsAsErrors>false</TreatWarningsAsErrors>
+    <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
   </PropertyGroup>
   <ItemGroup>
     <PackageReference Include="BouncyCastle.Cryptography" />

src/__Libraries/StellaOps.Cryptography.Plugin.WineCsp/StellaOps.Cryptography.Plugin.WineCsp.csproj

@@ -4,7 +4,7 @@
     <LangVersion>preview</LangVersion>
     <ImplicitUsings>enable</ImplicitUsings>
     <Nullable>enable</Nullable>
-    <TreatWarningsAsErrors>false</TreatWarningsAsErrors>
+    <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
   </PropertyGroup>
   <ItemGroup>
     <PackageReference Include="Microsoft.Extensions.DependencyInjection.Abstractions" />

src/__Libraries/StellaOps.Cryptography/StellaOps.Cryptography.csproj

@@ -4,7 +4,7 @@
     <LangVersion>preview</LangVersion>
     <ImplicitUsings>enable</ImplicitUsings>
     <Nullable>enable</Nullable>
-    <TreatWarningsAsErrors>false</TreatWarningsAsErrors>
+    <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
   </PropertyGroup>
   <PropertyGroup Condition="'$(StellaOpsCryptoSodium)' == 'true'">
     <DefineConstants>$(DefineConstants);STELLAOPS_CRYPTO_SODIUM</DefineConstants>

src/__Libraries/StellaOps.DeltaVerdict/StellaOps.DeltaVerdict.csproj

@@ -4,6 +4,7 @@
     <ImplicitUsings>enable</ImplicitUsings>
     <Nullable>enable</Nullable>
     <LangVersion>preview</LangVersion>
+    <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
   </PropertyGroup>
 
   <ItemGroup>

src/__Libraries/StellaOps.DependencyInjection/StellaOps.DependencyInjection.csproj

@@ -4,6 +4,7 @@
     <TargetFramework>net10.0</TargetFramework>
     <ImplicitUsings>enable</ImplicitUsings>
     <Nullable>enable</Nullable>
+    <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
   </PropertyGroup>
 
   <ItemGroup>

src/__Libraries/StellaOps.Determinism.Abstractions/StellaOps.Determinism.Abstractions.csproj

@@ -7,5 +7,6 @@
     <ImplicitUsings>enable</ImplicitUsings>
     <RootNamespace>StellaOps.Determinism</RootNamespace>
     <Description>Attributes and abstractions for determinism enforcement in StellaOps.</Description>
+    <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
   </PropertyGroup>
 </Project>

src/__Libraries/StellaOps.DistroIntel/StellaOps.DistroIntel.csproj

@@ -5,7 +5,7 @@
     <LangVersion>preview</LangVersion>
     <Nullable>enable</Nullable>
     <ImplicitUsings>enable</ImplicitUsings>
-    <TreatWarningsAsErrors>false</TreatWarningsAsErrors>
+    <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
     <RootNamespace>StellaOps.DistroIntel</RootNamespace>
   </PropertyGroup>
 </Project>

src/__Libraries/StellaOps.Evidence.Bundle/StellaOps.Evidence.Bundle.csproj

@@ -5,7 +5,7 @@
     <ImplicitUsings>enable</ImplicitUsings>
     <Nullable>enable</Nullable>
     <LangVersion>preview</LangVersion>
-    <TreatWarningsAsErrors>false</TreatWarningsAsErrors>
+    <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
     <RootNamespace>StellaOps.Evidence.Bundle</RootNamespace>
     <Description>Evidence bundle envelope with cryptographic signatures for offline verification</Description>
   </PropertyGroup>

src/__Libraries/StellaOps.Evidence.Core/StellaOps.Evidence.Core.csproj

@@ -6,6 +6,7 @@
     <LangVersion>preview</LangVersion>
     <RootNamespace>StellaOps.Evidence.Core</RootNamespace>
     <Description>Unified evidence model interface and core types for StellaOps content-addressed proof records.</Description>
+    <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
   </PropertyGroup>
 
   <ItemGroup>

src/__Libraries/StellaOps.Evidence.Persistence/StellaOps.Evidence.Persistence.csproj

@@ -4,6 +4,7 @@
     <Nullable>enable</Nullable>
     <ImplicitUsings>enable</ImplicitUsings>
     <LangVersion>preview</LangVersion>
+    <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
     <RootNamespace>StellaOps.Evidence.Persistence</RootNamespace>
     <AssemblyName>StellaOps.Evidence.Persistence</AssemblyName>
     <Description>Consolidated persistence layer for StellaOps Evidence module</Description>

src/__Libraries/StellaOps.Evidence/Models/ProofRecord.cs

@@ -0,0 +1,113 @@
+// Licensed to StellaOps under the AGPL-3.0-or-later license.
+
+using System.Collections.Immutable;
+
+namespace StellaOps.Evidence.Models;
+
+/// <summary>
+/// A record of proof supporting a verdict with authority classification.
+/// </summary>
+/// <remarks>
+/// ProofRecord extends the evidence model with explicit proof strength classification,
+/// enabling noise-gating logic to prioritize higher-authority evidence when resolving
+/// conflicting signals from multiple sources.
+/// </remarks>
+public sealed record ProofRecord
+{
+    /// <summary>
+    /// Gets the unique identifier for this proof record.
+    /// </summary>
+    public required string ProofId { get; init; }
+
+    /// <summary>
+    /// Gets the vulnerability this proof relates to.
+    /// </summary>
+    public required string VulnerabilityId { get; init; }
+
+    /// <summary>
+    /// Gets the component (PURL) this proof relates to.
+    /// </summary>
+    public required string ComponentPurl { get; init; }
+
+    /// <summary>
+    /// Gets the authority level of this proof.
+    /// </summary>
+    public required ProofStrength Strength { get; init; }
+
+    /// <summary>
+    /// Gets the source that provided this proof.
+    /// </summary>
+    public required string SourceId { get; init; }
+
+    /// <summary>
+    /// Gets the source type (e.g., "vendor_vex", "binary_analysis", "reachability").
+    /// </summary>
+    public required string SourceType { get; init; }
+
+    /// <summary>
+    /// Gets the conclusion drawn from this proof.
+    /// </summary>
+    public required ProofConclusion Conclusion { get; init; }
+
+    /// <summary>
+    /// Gets the optional rationale explaining the conclusion.
+    /// </summary>
+    public string? Rationale { get; init; }
+
+    /// <summary>
+    /// Gets the confidence score for this proof (0.0 to 1.0).
+    /// </summary>
+    /// <remarks>
+    /// Confidence is independent of strength. A heuristic can be high-confidence
+    /// (the version definitely matches) while still being lower authority than
+    /// a vendor statement.
+    /// </remarks>
+    public double Confidence { get; init; } = 1.0;
+
+    /// <summary>
+    /// Gets the timestamp when this proof was recorded.
+    /// </summary>
+    public required DateTimeOffset RecordedAt { get; init; }
+
+    /// <summary>
+    /// Gets additional attributes for extensibility.
+    /// </summary>
+    public ImmutableDictionary<string, string> Attributes { get; init; } =
+        ImmutableDictionary<string, string>.Empty;
+
+    /// <summary>
+    /// Gets the content-addressed digest of this proof for deduplication.
+    /// </summary>
+    public string? Digest { get; init; }
+}
+
+/// <summary>
+/// The conclusion drawn from a proof record.
+/// </summary>
+public enum ProofConclusion
+{
+    /// <summary>
+    /// The component is affected by the vulnerability.
+    /// </summary>
+    Affected,
+
+    /// <summary>
+    /// The component is not affected by the vulnerability.
+    /// </summary>
+    NotAffected,
+
+    /// <summary>
+    /// The vulnerability has been fixed in this component.
+    /// </summary>
+    Fixed,
+
+    /// <summary>
+    /// The effect is still under investigation.
+    /// </summary>
+    UnderInvestigation,
+
+    /// <summary>
+    /// The proof is inconclusive.
+    /// </summary>
+    Inconclusive
+}

src/__Libraries/StellaOps.Evidence/Models/ProofStrength.cs

@@ -0,0 +1,55 @@
+// Licensed to StellaOps under the AGPL-3.0-or-later license.
+
+using System.Text.Json.Serialization;
+
+namespace StellaOps.Evidence.Models;
+
+/// <summary>
+/// Represents the authority level of evidence supporting a verdict.
+/// Higher values indicate stronger proof that should take precedence in resolution.
+/// </summary>
+/// <remarks>
+/// This enum formalizes the evidence authority hierarchy for noise-gating:
+/// - Authoritative sources (vendor VEX, CSAF publishers) are most trusted
+/// - Binary proof (patch signatures, disassembly analysis) provides strong evidence
+/// - Static analysis (reachability, call graphs) provides moderate evidence
+/// - Heuristics (version matching, advisory correlation) provide weak evidence
+///
+/// The ordering is used by <see cref="INoiseGate"/> when resolving conflicting evidence
+/// to determine which source should take precedence.
+/// </remarks>
+[JsonConverter(typeof(JsonStringEnumConverter<ProofStrength>))]
+public enum ProofStrength
+{
+    /// <summary>
+    /// Heuristic-based evidence from version matching, advisory correlation,
+    /// or similar inference. Lowest confidence level.
+    /// </summary>
+    /// <example>Version string matches affected range in NVD advisory.</example>
+    [JsonPropertyName("heuristic")]
+    Heuristic = 40,
+
+    /// <summary>
+    /// Evidence from static analysis including reachability analysis,
+    /// call graph construction, or AST examination.
+    /// </summary>
+    /// <example>Static call graph shows function is never called.</example>
+    [JsonPropertyName("static_analysis")]
+    StaticAnalysis = 60,
+
+    /// <summary>
+    /// Evidence from binary-level analysis including patch signature detection,
+    /// disassembly comparison, or runtime instrumentation.
+    /// </summary>
+    /// <example>Binary patch signature matches known fix commit.</example>
+    [JsonPropertyName("binary_proof")]
+    BinaryProof = 80,
+
+    /// <summary>
+    /// Authoritative evidence from trusted sources including vendor VEX statements,
+    /// CSAF publishers, or verified package maintainers.
+    /// </summary>
+    /// <example>Vendor VEX states not_affected with justification.</example>
+    [JsonPropertyName("authoritative")]
+    Authoritative = 100
+}

src/__Libraries/StellaOps.Evidence/Models/ProofStrengthExtensions.cs

@@ -0,0 +1,88 @@
+// Licensed to StellaOps under the AGPL-3.0-or-later license.
+
+namespace StellaOps.Evidence.Models;
+
+/// <summary>
+/// Extension methods for <see cref="ProofStrength"/> enum.
+/// </summary>
+public static class ProofStrengthExtensions
+{
+    /// <summary>
+    /// Compares two proof strengths and returns the stronger one.
+    /// </summary>
+    /// <param name="a">First proof strength.</param>
+    /// <param name="b">Second proof strength.</param>
+    /// <returns>The proof strength with the higher authority value.</returns>
+    public static ProofStrength Max(this ProofStrength a, ProofStrength b)
+        => (int)a >= (int)b ? a : b;
+
+    /// <summary>
+    /// Gets the normalized confidence multiplier for this proof strength.
+    /// </summary>
+    /// <param name="strength">The proof strength.</param>
+    /// <returns>A value between 0.0 and 1.0 representing relative confidence.</returns>
+    /// <remarks>
+    /// The multiplier is computed as the enum value divided by the maximum (100).
+    /// - Authoritative: 1.0
+    /// - BinaryProof: 0.8
+    /// - StaticAnalysis: 0.6
+    /// - Heuristic: 0.4
+    /// </remarks>
+    public static double GetConfidenceMultiplier(this ProofStrength strength)
+        => (int)strength / 100.0;
+
+    /// <summary>
+    /// Determines if this proof strength is sufficient to override another.
+    /// </summary>
+    /// <param name="challenger">The challenging proof strength.</param>
+    /// <param name="incumbent">The incumbent proof strength.</param>
+    /// <returns>True if the challenger should override the incumbent.</returns>
+    /// <remarks>
+    /// Override requires at least one level of authority difference (20 points).
+    /// Equal strengths or insufficient difference defer to the incumbent.
+    /// </remarks>
+    public static bool CanOverride(this ProofStrength challenger, ProofStrength incumbent)
+        => (int)challenger - (int)incumbent >= 20;
+
+    /// <summary>
+    /// Converts the proof strength to a human-readable label.
+    /// </summary>
+    /// <param name="strength">The proof strength.</param>
+    /// <returns>A display label for the proof strength.</returns>
+    public static string ToLabel(this ProofStrength strength) => strength switch
+    {
+        ProofStrength.Authoritative => "Authoritative Source",
+        ProofStrength.BinaryProof => "Binary Proof",
+        ProofStrength.StaticAnalysis => "Static Analysis",
+        ProofStrength.Heuristic => "Heuristic",
+        _ => "Unknown"
+    };
+
+    /// <summary>
+    /// Maps a proof strength to a short code for serialization.
+    /// </summary>
+    /// <param name="strength">The proof strength.</param>
+    /// <returns>A 1-2 character code.</returns>
+    public static string ToCode(this ProofStrength strength) => strength switch
+    {
+        ProofStrength.Authoritative => "AU",
+        ProofStrength.BinaryProof => "BP",
+        ProofStrength.StaticAnalysis => "SA",
+        ProofStrength.Heuristic => "HE",
+        _ => "UN"
+    };
+
+    /// <summary>
+    /// Parses a code string into a proof strength.
+    /// </summary>
+    /// <param name="code">The code string.</param>
+    /// <returns>The parsed proof strength, or Heuristic if unrecognized.</returns>
+    public static ProofStrength FromCode(string? code) => code?.ToUpperInvariant() switch
+    {
+        "AU" => ProofStrength.Authoritative,
+        "BP" => ProofStrength.BinaryProof,
+        "SA" => ProofStrength.StaticAnalysis,
+        "HE" => ProofStrength.Heuristic,
+        _ => ProofStrength.Heuristic
+    };
+}

src/__Libraries/StellaOps.Evidence/StellaOps.Evidence.csproj

@@ -4,6 +4,7 @@
     <ImplicitUsings>enable</ImplicitUsings>
     <Nullable>enable</Nullable>
     <LangVersion>preview</LangVersion>
+    <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
   </PropertyGroup>
 
   <ItemGroup>

src/__Libraries/StellaOps.Infrastructure.EfCore/StellaOps.Infrastructure.EfCore.csproj

@@ -6,7 +6,7 @@
     <ImplicitUsings>enable</ImplicitUsings>
     <Nullable>enable</Nullable>
     <LangVersion>preview</LangVersion>
-    <TreatWarningsAsErrors>false</TreatWarningsAsErrors>
+    <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
     <RootNamespace>StellaOps.Infrastructure.EfCore</RootNamespace>
     <AssemblyName>StellaOps.Infrastructure.EfCore</AssemblyName>
     <Description>Shared EF Core infrastructure for StellaOps modules with tenant isolation support</Description>

src/__Libraries/StellaOps.Infrastructure.Postgres/StellaOps.Infrastructure.Postgres.csproj

@@ -6,7 +6,7 @@
     <ImplicitUsings>enable</ImplicitUsings>
     <Nullable>enable</Nullable>
     <LangVersion>preview</LangVersion>
-    <TreatWarningsAsErrors>false</TreatWarningsAsErrors>
+    <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
     <RootNamespace>StellaOps.Infrastructure.Postgres</RootNamespace>
     <AssemblyName>StellaOps.Infrastructure.Postgres</AssemblyName>
     <Description>Shared PostgreSQL infrastructure for StellaOps modules</Description>

src/__Libraries/StellaOps.Ingestion.Telemetry/StellaOps.Ingestion.Telemetry.csproj

@@ -4,5 +4,6 @@
     <TargetFramework>net10.0</TargetFramework>
     <ImplicitUsings>enable</ImplicitUsings>
     <Nullable>enable</Nullable>
+    <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
   </PropertyGroup>
 </Project>

src/__Libraries/StellaOps.Interop/StellaOps.Interop.csproj

@@ -3,6 +3,7 @@
     <TargetFramework>net10.0</TargetFramework>
     <ImplicitUsings>enable</ImplicitUsings>
     <Nullable>enable</Nullable>
+    <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
     <LangVersion>preview</LangVersion>
   </PropertyGroup>
 </Project>

src/__Libraries/StellaOps.IssuerDirectory.Client/StellaOps.IssuerDirectory.Client.csproj

@@ -4,7 +4,7 @@
     <LangVersion>preview</LangVersion>
     <Nullable>enable</Nullable>
     <ImplicitUsings>enable</ImplicitUsings>
-    <TreatWarningsAsErrors>false</TreatWarningsAsErrors>
+    <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
   </PropertyGroup>
   <ItemGroup>
     <PackageReference Include="Microsoft.Extensions.Caching.Memory" />

src/__Libraries/StellaOps.Metrics/StellaOps.Metrics.csproj

@@ -3,6 +3,7 @@
     <TargetFramework>net10.0</TargetFramework>
     <ImplicitUsings>enable</ImplicitUsings>
     <Nullable>enable</Nullable>
+    <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
     <LangVersion>preview</LangVersion>
   </PropertyGroup>
 

src/__Libraries/StellaOps.Orchestrator.Schemas/StellaOps.Orchestrator.Schemas.csproj

@@ -3,5 +3,6 @@
     <TargetFramework>net10.0</TargetFramework>
     <ImplicitUsings>enable</ImplicitUsings>
     <Nullable>enable</Nullable>
+    <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
   </PropertyGroup>
 </Project>

src/__Libraries/StellaOps.Plugin/StellaOps.Plugin.csproj

@@ -5,6 +5,7 @@
     <TargetFramework>net10.0</TargetFramework>
     <ImplicitUsings>enable</ImplicitUsings>
     <Nullable>enable</Nullable>
+    <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
     <EnableDefaultItems>false</EnableDefaultItems>
   </PropertyGroup>
 

src/__Libraries/StellaOps.Policy.Tools/StellaOps.Policy.Tools.csproj

@@ -3,6 +3,7 @@
     <TargetFramework>net10.0</TargetFramework>
     <ImplicitUsings>enable</ImplicitUsings>
     <Nullable>enable</Nullable>
+    <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
     <LangVersion>preview</LangVersion>
   </PropertyGroup>
 

src/__Libraries/StellaOps.PolicyAuthoritySignals.Contracts/StellaOps.PolicyAuthoritySignals.Contracts.csproj

@@ -3,5 +3,6 @@
     <TargetFramework>net10.0</TargetFramework>
     <ImplicitUsings>enable</ImplicitUsings>
     <Nullable>enable</Nullable>
+    <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
   </PropertyGroup>
 </Project>

src/__Libraries/StellaOps.Provcache.Api/StellaOps.Provcache.Api.csproj

@@ -6,7 +6,7 @@
     <ImplicitUsings>enable</ImplicitUsings>
     <Nullable>enable</Nullable>
     <LangVersion>preview</LangVersion>
-    <TreatWarningsAsErrors>false</TreatWarningsAsErrors>
+    <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
     <RootNamespace>StellaOps.Provcache.Api</RootNamespace>
     <AssemblyName>StellaOps.Provcache.Api</AssemblyName>
     <Description>API endpoints for Provcache - Provenance Cache for StellaOps</Description>

src/__Libraries/StellaOps.Provcache.Postgres/StellaOps.Provcache.Postgres.csproj

@@ -6,7 +6,7 @@
     <ImplicitUsings>enable</ImplicitUsings>
     <Nullable>enable</Nullable>
     <LangVersion>preview</LangVersion>
-    <TreatWarningsAsErrors>false</TreatWarningsAsErrors>
+    <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
     <RootNamespace>StellaOps.Provcache.Postgres</RootNamespace>
     <AssemblyName>StellaOps.Provcache.Postgres</AssemblyName>
     <Description>PostgreSQL storage implementation for StellaOps Provcache</Description>

src/__Libraries/StellaOps.Provcache.Valkey/StellaOps.Provcache.Valkey.csproj

@@ -6,7 +6,7 @@
     <ImplicitUsings>enable</ImplicitUsings>
     <Nullable>enable</Nullable>
     <LangVersion>preview</LangVersion>
-    <TreatWarningsAsErrors>false</TreatWarningsAsErrors>
+    <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
     <RootNamespace>StellaOps.Provcache.Valkey</RootNamespace>
     <AssemblyName>StellaOps.Provcache.Valkey</AssemblyName>
     <Description>Valkey/Redis cache store implementation for StellaOps Provcache</Description>

src/__Libraries/StellaOps.Provcache/StellaOps.Provcache.csproj

@@ -6,7 +6,7 @@
     <ImplicitUsings>enable</ImplicitUsings>
     <Nullable>enable</Nullable>
     <LangVersion>preview</LangVersion>
-    <TreatWarningsAsErrors>false</TreatWarningsAsErrors>
+    <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
     <RootNamespace>StellaOps.Provcache</RootNamespace>
     <AssemblyName>StellaOps.Provcache</AssemblyName>
     <Description>Provenance Cache for StellaOps - Maximizing trust evidence density</Description>

src/__Libraries/StellaOps.Provenance/StellaOps.Provenance.csproj

@@ -4,6 +4,7 @@
     <TargetFramework>net10.0</TargetFramework>
     <ImplicitUsings>enable</ImplicitUsings>
     <Nullable>enable</Nullable>
+    <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
   </PropertyGroup>
 
   <ItemGroup>

src/__Libraries/StellaOps.ReachGraph.Cache/StellaOps.ReachGraph.Cache.csproj

@@ -4,6 +4,7 @@
     <TargetFramework>net10.0</TargetFramework>
     <ImplicitUsings>enable</ImplicitUsings>
     <Nullable>enable</Nullable>
+    <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
     <LangVersion>preview</LangVersion>
     <RootNamespace>StellaOps.ReachGraph.Cache</RootNamespace>
     <Description>Valkey/Redis cache layer for StellaOps ReachGraph</Description>

src/__Libraries/StellaOps.ReachGraph.Persistence/StellaOps.ReachGraph.Persistence.csproj

@@ -4,6 +4,7 @@
     <TargetFramework>net10.0</TargetFramework>
     <ImplicitUsings>enable</ImplicitUsings>
     <Nullable>enable</Nullable>
+    <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
     <LangVersion>preview</LangVersion>
     <RootNamespace>StellaOps.ReachGraph.Persistence</RootNamespace>
     <Description>PostgreSQL persistence layer for StellaOps ReachGraph</Description>

src/__Libraries/StellaOps.ReachGraph/StellaOps.ReachGraph.csproj

@@ -4,6 +4,7 @@
     <TargetFramework>net10.0</TargetFramework>
     <ImplicitUsings>enable</ImplicitUsings>
     <Nullable>enable</Nullable>
+    <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
     <LangVersion>preview</LangVersion>
     <RootNamespace>StellaOps.ReachGraph</RootNamespace>
     <Description>Unified reachability subgraph store for StellaOps</Description>

src/__Libraries/StellaOps.Replay.Core/StellaOps.Replay.Core.csproj

@@ -3,6 +3,7 @@
     <TargetFramework>net10.0</TargetFramework>
     <ImplicitUsings>enable</ImplicitUsings>
     <Nullable>enable</Nullable>
+    <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
   </PropertyGroup>
   <ItemGroup>
     <PackageReference Include="YamlDotNet" />

src/__Libraries/StellaOps.Replay/StellaOps.Replay.csproj

@@ -3,6 +3,7 @@
     <TargetFramework>net10.0</TargetFramework>
     <ImplicitUsings>enable</ImplicitUsings>
     <Nullable>enable</Nullable>
+    <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
     <LangVersion>preview</LangVersion>
   </PropertyGroup>
 

src/__Libraries/StellaOps.Resolver/StellaOps.Resolver.csproj

@@ -4,6 +4,7 @@
     <TargetFramework>net10.0</TargetFramework>
     <ImplicitUsings>enable</ImplicitUsings>
     <Nullable>enable</Nullable>
+    <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
     <LangVersion>preview</LangVersion>
     <RootNamespace>StellaOps.Resolver</RootNamespace>
     <Description>Deterministic Resolver for StellaOps - unified resolver pattern guaranteeing same inputs produce same traversal, verdicts, and digests.</Description>

src/__Libraries/StellaOps.Signals.Contracts/StellaOps.Signals.Contracts.csproj

@@ -4,6 +4,7 @@
     <TargetFramework>net10.0</TargetFramework>
     <ImplicitUsings>enable</ImplicitUsings>
     <Nullable>enable</Nullable>
+    <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
     <Description>Shared signal contracts for cross-module signal communication in StellaOps</Description>
   </PropertyGroup>
 

src/__Libraries/StellaOps.TestKit/StellaOps.TestKit.csproj

@@ -5,6 +5,7 @@
     <UseAppHost>true</UseAppHost>
     <ImplicitUsings>enable</ImplicitUsings>
     <Nullable>enable</Nullable>
+    <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
     <LangVersion>preview</LangVersion>
     <IsPackable>true</IsPackable>
     <Description>Testing infrastructure and utilities for StellaOps</Description>

src/__Libraries/StellaOps.Verdict/StellaOps.Verdict.csproj

@@ -3,7 +3,7 @@
     <TargetFramework>net10.0</TargetFramework>
     <ImplicitUsings>enable</ImplicitUsings>
     <Nullable>enable</Nullable>
-    <TreatWarningsAsErrors>false</TreatWarningsAsErrors>
+    <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
   </PropertyGroup>
 
   <ItemGroup>