# Audit - StellaOps.Graph.Indexer

## Project
- Path: `src/Graph/StellaOps.Graph.Indexer/StellaOps.Graph.Indexer.csproj`
- Module: `Graph`
- Kind: `Worker`
- SDK: `Microsoft.NET.Sdk`
- TargetFramework: `net10.0`
- Audit date (UTC): 2026-01-30

## Coding Standards Findings
- Status: FAIL
- Nullable: enable
- TreatWarningsAsErrors: explicit true
- Deterministic: inherited true
- 100-line rule violations: 16
- Service locator usage (BuildServiceProvider/GetService): 3
- Analyzer enforcement: missing repo-wide (see summary).

### Details
- 100-line files:
  - `src/Graph/StellaOps.Graph.Indexer/Ingestion/Sbom/SbomIngestTransformer.cs` (622 lines)
  - `src/Graph/StellaOps.Graph.Indexer/Documents/GraphSnapshotBuilder.cs` (489 lines)
  - `src/Graph/StellaOps.Graph.Indexer/Analytics/GraphAnalyticsEngine.cs` (471 lines)
  - `src/Graph/StellaOps.Graph.Indexer/Ingestion/Inspector/GraphInspectorTransformer.cs` (447 lines)
  - `src/Graph/StellaOps.Graph.Indexer/Ingestion/Sbom/SbomSnapshot.cs` (270 lines)
  - `src/Graph/StellaOps.Graph.Indexer/Documents/GraphSnapshot.cs` (261 lines)
  - `src/Graph/StellaOps.Graph.Indexer/Ingestion/Vex/VexOverlayTransformer.cs` (243 lines)
  - `src/Graph/StellaOps.Graph.Indexer/Ingestion/Policy/PolicyOverlayTransformer.cs` (237 lines)
  - `src/Graph/StellaOps.Graph.Indexer/Ingestion/Advisory/AdvisoryLinksetTransformer.cs` (208 lines)
  - `src/Graph/StellaOps.Graph.Indexer/Ingestion/Inspector/GraphInspectorSnapshot.cs` (180 lines)
  - `src/Graph/StellaOps.Graph.Indexer/Schema/GraphIdentity.cs` (152 lines)
  - `src/Graph/StellaOps.Graph.Indexer/Schema/CanonicalJson.cs` (134 lines)
  - `src/Graph/StellaOps.Graph.Indexer/Schema/GraphDocumentFactory.cs` (132 lines)
  - `src/Graph/StellaOps.Graph.Indexer/Ingestion/Policy/PolicyOverlayMetrics.cs` (124 lines)
  - `src/Graph/StellaOps.Graph.Indexer/Incremental/GraphChangeStreamProcessor.cs` (119 lines)
  - `src/Graph/StellaOps.Graph.Indexer/Ingestion/Advisory/AdvisoryLinksetMetrics.cs` (106 lines)
- Service locator matches:
  - `src/Graph/StellaOps.Graph.Indexer/Ingestion/Inspector/InspectorIngestServiceCollectionExtensions.cs`:20 var logger = provider.GetService<ILogger<GraphInspectorProcessor>>() ?? NullLogger<GraphInspectorProcessor>.Instance;
  - `src/Graph/StellaOps.Graph.Indexer/Ingestion/Sbom/SbomIngestServiceCollectionExtensions.cs`:34 var logger = provider.GetService<ILogger<SbomIngestProcessor>>() ?? NullLogger<SbomIngestProcessor>.Instance;
  - `src/Graph/StellaOps.Graph.Indexer/Ingestion/Sbom/SbomIngestServiceCollectionExtensions.cs`:35 var options = provider.GetService<IOptions<SbomIngestOptions>>();

### Fix Guidance
- Split files over 100 lines into smaller types or partials.
- Replace service locator usage with constructor injection.

## Testing Fullness Findings
- Status: FAIL
- Expected layers: Unit, Integration, E2E, Offline
- Detected test projects: src/Graph/__Tests/StellaOps.Graph.Indexer.Tests/StellaOps.Graph.Indexer.Tests.csproj [Unit], src/Graph/__Tests/StellaOps.Graph.Indexer.Persistence.Tests/StellaOps.Graph.Indexer.Persistence.Tests.csproj [Unit], src/__Tests/Graph/StellaOps.Graph.Indexer.Tests/StellaOps.Graph.Indexer.Tests.csproj [Unit]
- Missing layers: Integration, E2E, Offline

### Manual checks required
- Observability contract tests for WebService/Worker.
- Offline execution (tests must run without network access).

### Fix Guidance
- Add integration tests for cross-component flows.
- Add E2E coverage for user-visible workflows.
- Add offline/airgap coverage with fixtures only.