save checkpoint

docs/features/checked/scanner/oci-image-inspector-service.md

@@ -0,0 +1,37 @@
+# OCI Image Inspector Service (IOciImageInspector)
+
+## Module
+Scanner
+
+## Status
+VERIFIED
+
+## Description
+Service for inspecting OCI images including multi-arch manifest resolution, layer enumeration, platform detection, and digest extraction without pulling full image content.
+
+## Implementation Details
+- **Image Inspector**:
+  - `src/Scanner/__Libraries/StellaOps.Scanner.Storage.Oci/IOciImageInspector.cs` - `IOciImageInspector` interface for inspecting OCI images without pulling full content
+  - `src/Scanner/__Libraries/StellaOps.Scanner.Storage.Oci/OciImageInspector.cs` - `OciImageInspector` implementation supporting multi-arch manifest resolution, layer enumeration, platform detection, and digest extraction
+- **Inspection Models**:
+  - `src/Scanner/__Libraries/StellaOps.Scanner.Contracts/OciInspectionModels.cs` - `OciInspectionModels` defining inspection result types (layers, platforms, digests)
+- **DI Registration**: `src/Scanner/__Libraries/StellaOps.Scanner.Storage.Oci/ServiceCollectionExtensions.cs`
+
+## E2E Test Plan
+- [ ] Inspect a single-arch OCI image and verify layer enumeration returns correct layer digests and sizes
+- [ ] Inspect a multi-arch OCI image and verify platform detection identifies all available architectures (amd64, arm64, etc.)
+- [ ] Verify multi-arch manifest resolution selects the correct platform-specific manifest based on the runtime platform
+- [ ] Verify digest extraction returns the correct content-addressable digest for the image manifest
+- [ ] Verify inspection works without pulling full image content (manifest-only operation)
+- [ ] Verify inspection handles private registries with authentication
+
+---
+
+## Verification
+
+| Check | Result |
+|-------|--------|
+| Tier 0 - Source files exist | PASS |
+| Tier 1 - Build + code review | PASS |
+| Tier 2 - Integration tests | PASS |
+| Verified | 2026-02-13T18:10:00Z |