save checkpoint

docs/features/checked/scanner/oci-ancestry-extraction.md

@@ -0,0 +1,35 @@
+# OCI Ancestry Extraction
+
+## Module
+Scanner
+
+## Status
+VERIFIED
+
+## Description
+Extract base image references from OCI manifest config.history to populate lineage parent relationships.
+
+## Implementation Details
+- **Ancestry Extractor**:
+  - `src/Scanner/__Libraries/StellaOps.Scanner.Storage.Oci/IOciAncestryExtractor.cs` - `IOciAncestryExtractor` interface defining the ancestry extraction contract
+  - `src/Scanner/__Libraries/StellaOps.Scanner.Storage.Oci/OciAncestryExtractor.cs` - `OciAncestryExtractor` extracts base image references from OCI manifest config.history to populate lineage parent relationships
+- **Layer Dependency Graph**:
+  - `src/Scanner/__Libraries/StellaOps.Scanner.Core/Models/LayerDependencyGraph.cs` - `LayerDependencyGraph` models parent-child layer relationships from ancestry data
+
+## E2E Test Plan
+- [ ] Scan a container image built from a known base image and verify the OCI ancestry extractor identifies the base image reference from config.history
+- [ ] Verify lineage parent relationships are populated correctly linking child image to base image
+- [ ] Verify multi-stage build ancestry is correctly resolved (identifying intermediate build stages)
+- [ ] Verify images with `LABEL` or `org.opencontainers.image.base.name` annotations use those for ancestry when available
+- [ ] Verify images without config.history (scratch-based) are handled gracefully with no parent relationship
+
+---
+
+## Verification
+
+| Check | Result |
+|-------|--------|
+| Tier 0 - Source files exist | PASS |
+| Tier 1 - Build + code review | PASS |
+| Tier 2 - Integration tests | PASS |
+| Verified | 2026-02-13T18:10:00Z |