34 lines
1.7 KiB
Markdown
34 lines
1.7 KiB
Markdown
# StellaOps.Scanner.Analyzers.Lang — Agent Charter
|
|
|
|
## Role
|
|
Deliver deterministic language ecosystem analyzers that run inside Scanner Workers, emit component evidence for SBOM assembly, and package as restart-time plug-ins.
|
|
|
|
## Scope
|
|
- Shared analyzer abstractions for installed application ecosystems (Java, Node.js, Python, Go, .NET, Rust).
|
|
- Evidence helpers that map on-disk artefacts to canonical component identities (purl/bin sha) with provenance and usage flags.
|
|
- File-system traversal, metadata parsing, and normalization for language-specific package formats.
|
|
- Plug-in bootstrap, manifest authoring, and DI registration so Workers load analyzers at start-up.
|
|
|
|
## Out of Scope
|
|
- OS package analyzers, native link graph, or EntryTrace plug-ins (handled by other guilds).
|
|
- SBOM composition, diffing, or signing (owned by Emit/Diff/Signer groups).
|
|
- Policy adjudication or vulnerability joins.
|
|
|
|
## Expectations
|
|
- Deterministic output: identical inputs → identical component ordering and hashes.
|
|
- Memory discipline: streaming walkers, avoid loading entire trees; reuse buffers.
|
|
- Cancellation-aware and timeboxed per layer.
|
|
- Enrich telemetry (counters + timings) via Scanner.Core primitives.
|
|
- Update `TASKS.md` as work progresses (TODO → DOING → DONE/BLOCKED).
|
|
|
|
## Dependencies
|
|
- Scanner.Core contracts + observability helpers.
|
|
- Scanner.Worker analyzer dispatcher.
|
|
- Upcoming Scanner.Emit models for SBOM assembly.
|
|
- Plugin host infrastructure under `StellaOps.Plugin`.
|
|
|
|
## Testing & Artifacts
|
|
- Determinism harness with golden fixtures under `Fixtures/`.
|
|
- Microbench benchmarks recorded per language where feasible.
|
|
- Plugin manifests stored under `plugins/scanner/analyzers/lang/` with cosign workflow documented.
|