# Audit - StellaOps.Graph.Api

## Project
- Path: `src/Graph/StellaOps.Graph.Api/StellaOps.Graph.Api.csproj`
- Module: `Graph`
- Kind: `WebService`
- SDK: `Microsoft.NET.Sdk.Web`
- TargetFramework: `net10.0`
- Audit date (UTC): 2026-01-30

## Coding Standards Findings
- Status: FAIL
- Nullable: enable
- TreatWarningsAsErrors: explicit true
- Deterministic: inherited true
- 100-line rule violations: 11
- Service locator usage (BuildServiceProvider/GetService): 0
- Analyzer enforcement: missing repo-wide (see summary).

### Details
- 100-line files:
  - `src/Graph/StellaOps.Graph.Api/Program.cs` (400 lines)
  - `src/Graph/StellaOps.Graph.Api/Contracts/SearchContracts.cs` (371 lines)
  - `src/Graph/StellaOps.Graph.Api/Services/InMemoryGraphRepository.cs` (351 lines)
  - `src/Graph/StellaOps.Graph.Api/Contracts/ReachabilityContracts.cs` (348 lines)
  - `src/Graph/StellaOps.Graph.Api/Services/InMemoryReachabilityDeltaService.cs` (334 lines)
  - `src/Graph/StellaOps.Graph.Api/Services/InMemoryGraphPathService.cs` (256 lines)
  - `src/Graph/StellaOps.Graph.Api/Services/InMemoryGraphQueryService.cs` (228 lines)
  - `src/Graph/StellaOps.Graph.Api/Services/InMemoryGraphDiffService.cs` (174 lines)
  - `src/Graph/StellaOps.Graph.Api/Services/InMemoryGraphExportService.cs` (151 lines)
  - `src/Graph/StellaOps.Graph.Api/Services/InMemoryGraphSearchService.cs` (136 lines)
  - `src/Graph/StellaOps.Graph.Api/Services/InMemoryOverlayService.cs` (115 lines)
- Service locator matches:
  - none

### Fix Guidance
- Split files over 100 lines into smaller types or partials.

## Testing Fullness Findings
- Status: FAIL
- Expected layers: Unit, Integration, Security, Offline
- Detected test projects: src/Graph/__Tests/StellaOps.Graph.Api.Tests/StellaOps.Graph.Api.Tests.csproj [Unit]
- Missing layers: Integration, Security, Offline

### Manual checks required
- Observability contract tests for WebService/Worker.
- Offline execution (tests must run without network access).

### Fix Guidance
- Add integration tests for cross-component flows.
- Add security tests for authn/authz or input validation.
- Add offline/airgap coverage with fixtures only.