# Sprint 132 · Scanner & Surface

## Topic & Scope
- Phase III of Scanner & Surface: harden language analyzers with focus on Node.js VFS/resolution and complete remaining surface capture.
- Implementation order stays sequential across Sprint 130–139; complete upstream sprint 131 items before pulling parallel work.
- Working directory: `src/Scanner` (language analyzers under `src/Scanner/__Libraries`).

## Dependencies & Concurrency
- Upstream: Sprint 131 (`SCANNER-ANALYZERS-LANG-11-001` foundation for .NET analyzer heuristics).
- Completed native analyzer stream (NATIVE-20-xxx) provides resolver patterns; reuse determinism and explain-trace patterns.

## Documentation Prerequisites
- docs/modules/scanner/architecture.md
- docs/modules/platform/architecture-overview.md
- src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node/AGENTS.md

> **BLOCKED Tasks:** Before working on BLOCKED tasks, review [BLOCKED_DEPENDENCY_TREE.md](./BLOCKED_DEPENDENCY_TREE.md) for root blockers and dependencies.

## Delivery Tracker
| # | Task ID | Status | Key dependency / next step | Owners | Task Definition |
| --- | --- | --- | --- | --- | --- |
| 1 | SCANNER-ANALYZERS-LANG-11-002 | BLOCKED | Await SCANNER-ANALYZERS-LANG-11-001 foundation from Sprint 131 | StellaOps.Scanner EPDR Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.DotNet) | Implement static analyzer (IL + reflection heuristics) capturing AssemblyRef, ModuleRef/PInvoke, DynamicDependency, reflection literals, DI patterns, and custom AssemblyLoadContext probing hints. Emit dependency edges with reason codes and confidence. |
| 2 | SCANNER-ANALYZERS-LANG-11-003 | BLOCKED | Depends on 11-002; runtime evidence harness pending | StellaOps.Scanner EPDR Guild, Signals Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.DotNet) | Ingest optional runtime evidence (AssemblyLoad, Resolving, P/Invoke) via event listener harness; merge runtime edges with static/declared ones and attach reason codes/confidence. |
| 3 | SCANNER-ANALYZERS-LANG-11-004 | BLOCKED | Depends on 11-003 | StellaOps.Scanner EPDR Guild, SBOM Service Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.DotNet) | Produce normalized observation export to Scanner writer: entrypoints + dependency edges + environment profiles (AOC compliant). Wire to SBOM service entrypoint tagging. |
| 4 | SCANNER-ANALYZERS-LANG-11-005 | BLOCKED | Depends on 11-004 | StellaOps.Scanner EPDR Guild, QA Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.DotNet) | Add comprehensive fixtures/benchmarks covering framework-dependent, self-contained, single-file, trimmed, NativeAOT, multi-RID scenarios; include explain traces and perf benchmarks vs previous analyzer. |
| 5 | SCANNER-ANALYZERS-NATIVE-20-001 | DONE | — | Native Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Native) | Implement format detector and binary identity model supporting ELF, PE/COFF, and Mach-O (including fat slices). Capture arch, OS, build-id/UUID, interpreter metadata. |
| 6 | SCANNER-ANALYZERS-NATIVE-20-002 | DONE | — | Native Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Native) | Parse ELF dynamic sections: `DT_NEEDED`, `DT_RPATH`, `DT_RUNPATH`, symbol versions, interpreter, and note build-id. Emit declared dependency records with reason `elf-dtneeded` and attach version needs. |
| 7 | SCANNER-ANALYZERS-NATIVE-20-003 | DONE | — | Native Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Native) | Parse PE imports, delay-load tables, manifests/SxS metadata, and subsystem flags. Emit edges with reasons `pe-import` and `pe-delayimport`, plus SxS policy metadata. |
| 8 | SCANNER-ANALYZERS-NATIVE-20-004 | DONE | — | Native Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Native) | Parse Mach-O load commands (`LC_LOAD_DYLIB`, `LC_REEXPORT_DYLIB`, `LC_RPATH`, `LC_UUID`, fat headers). Handle `@rpath/@loader_path` placeholders and slice separation. |
| 9 | SCANNER-ANALYZERS-NATIVE-20-005 | DONE | — | Native Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Native) | Implement resolver engine modeling loader search order for ELF (rpath/runpath/cache/default), PE (SafeDll search + SxS), and Mach-O (`@rpath` expansion). Works against virtual image roots, producing explain traces. |
| 10 | SCANNER-ANALYZERS-NATIVE-20-006 | DONE | — | Native Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Native) | Build heuristic scanner for `dlopen`/`LoadLibrary` strings, plugin ecosystem configs, and Go/Rust static hints. Emit edges with `reason_code` (`string-dlopen`, `config-plugin`, `ecosystem-heuristic`) and confidence levels. |
| 11 | SCANNER-ANALYZERS-NATIVE-20-007 | DONE | — | Native Analyzer Guild, SBOM Service Guild (src/Scanner/StellaOps.Scanner.Analyzers.Native) | Serialize AOC-compliant observations: entrypoints + dependency edges + environment profiles (search paths, interpreter, loader metadata). Integrate with Scanner writer API. |
| 12 | SCANNER-ANALYZERS-NATIVE-20-008 | DONE | — | Native Analyzer Guild, QA Guild (src/Scanner/StellaOps.Scanner.Analyzers.Native) | Author cross-platform fixtures (ELF dynamic/static, PE delay-load/SxS, Mach-O @rpath, plugin configs) and determinism benchmarks (<25 ms / binary, <250 MB). |
| 13 | SCANNER-ANALYZERS-NATIVE-20-009 | DONE | — | Native Analyzer Guild, Signals Guild (src/Scanner/StellaOps.Scanner.Analyzers.Native) | Provide optional runtime capture adapters (Linux eBPF `dlopen`, Windows ETW ImageLoad, macOS dyld interpose) writing append-only runtime evidence. Include redaction/sandbox guidance. |
| 14 | SCANNER-ANALYZERS-NATIVE-20-010 | DONE | — | Native Analyzer Guild, DevOps Guild (src/Scanner/StellaOps.Scanner.Analyzers.Native) | Package native analyzer as restart-time plug-in with manifest/DI registration; update Offline Kit bundle + documentation. |
| 15 | SCANNER-ANALYZERS-NODE-22-001 | DONE | VFS/input normalizer implemented for dirs/tgz/container layers/pnpm/Yarn PnP; Node version detection wired | Node Analyzer Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node) | Build input normalizer + VFS for Node projects: dirs, tgz, container layers, pnpm store, Yarn PnP zips; detect Node version targets and workspace roots deterministically. |
| 16 | SCANNER-ANALYZERS-NODE-22-002 | DONE | Entrypoint discovery expanded; condition sets emitted | Node Analyzer Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node) | Implement entrypoint discovery (bin/main/module/exports/imports, workers, electron, shebang scripts) and condition set builder per entrypoint. |
| 17 | SCANNER-ANALYZERS-NODE-22-003 | DONE | Import walker supports dynamic patterns + source maps with confidence tagging | Node Analyzer Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node) | Parse JS/TS sources for static `import`, `require`, `import()` and string concat cases; flag dynamic patterns with confidence levels; support source map de-bundling. |
| 18 | SCANNER-ANALYZERS-NODE-22-004 | DONE | Node resolver engine integrated (core modules, exports/imports maps, extension precedence, self refs) | Node Analyzer Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node) | Implement Node resolver engine for CJS + ESM (core modules, exports/imports maps, conditions, extension priorities, self-references) parameterised by node_version. |
| 19 | SCANNER-ANALYZERS-NODE-22-005 | DONE | Yarn PnP + pnpm virtual store adapters operational via VFS | Node Analyzer Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node) | Add package manager adapters: Yarn PnP (.pnp.data/.pnp.cjs), pnpm virtual store, npm/Yarn classic hoists; operate entirely in virtual FS. |

## Execution Log
| Date (UTC) | Update | Owner |
| --- | --- | --- |
| 2025-12-01 | Normalized sprint file to standard template; preserved existing tasks and statuses. | Planning |
| 2025-12-01 | Started Node stream tasks 22-001 → 22-005 (Scanner & Surface phase III). | Node Analyzer Guild |
| 2025-12-01 | Completed Node stream tasks 22-001 → 22-005; VFS/resolver/import walker shipped with updated fixtures and tests. | Node Analyzer Guild |

## Decisions & Risks
- DotNet analyzer stream (11-002 → 11-005) remains blocked pending foundation task `SCANNER-ANALYZERS-LANG-11-001` from Sprint 131.
- Native analyzer stream (NATIVE-20-001 → NATIVE-20-010) completed with 165 passing tests; serves as reference for determinism and resolver explain traces.
- Missing components for Sprint 132 (Node stream): VFS for container layers/pnpm/Yarn PnP, exports/imports condition builder, dynamic import analysis with confidence, Node resolver, pnpm virtual store adapter.

## Next Checkpoints
- None scheduled; align asynchronously with upstream Sprint 131 completion and Node guild milestones.