Findings Runtime Plugin Boundary

The consolidated Findings domain (src/Findings/) may consume closed shared contracts, but deployable Findings hosts must not compile optional executable plugin or analyzer implementations into their runtime graph.

Current host and reachability contract

Source verified on 2026-10-07 at 34b153ca04145478a0a87faf14cb5bf4002689e9. The serving host is src/Findings/StellaOps.Findings.WebService. Its composition references the Findings-owned ledger application, whose reachability mini-map read endpoint uses the closed StellaOps.Scanner.Reachability.Contracts project. It does not reference the full StellaOps.Scanner.Reachability implementation to reuse a DTO.

Recheck src/Findings/StellaOps.Findings.WebService/StellaOps.Findings.WebService.csproj, src/Findings/__Libraries/StellaOps.Findings.Ledger.Application/StellaOps.Findings.Ledger.Application.csproj and that application’s Endpoints/ReachabilityMapEndpoints.cs. The endpoint returns the Findings-owned read result; it does not execute a Scanner analyzer.

The host must not reference StellaOps.Scanner.Analyzers.Native. Native analysis is executable implementation owned by Scanner packaging and plugin composition. Findings runtime instrumentation is persisted and served from Findings-owned runtime tables and DTOs through src/Findings/StellaOps.Findings.Ledger and src/Findings/__Libraries/StellaOps.Findings.Ledger.Runtime.

Historical closure decision (2026-06-05)

The 2026-06-05 audit of the retired StellaOps.Findings.Ledger.WebService found an unused Native analyzer import and project reference. That audit concerned the predecessor host, now frozen under src/__Obsoleted/Findings/. It is not permission to add its dependency graph to the consolidated service. The later ledger application uses the closed reachability contracts described above; the predecessor’s full reachability implementation reference is not the current boundary.

Review Guard

Future Findings changes that need Scanner-produced evidence should use one of these boundaries:

• a closed contract/model project that contains no executable analyzer payload
• a read contract exposed by the owning Scanner service
• a Findings-local DTO when the data is only serialized through Findings APIs

Do not add a runtime ProjectReference from a Findings deployable host to a Scanner analyzer implementation project to reuse a DTO.