Findings Runtime Plugin Boundary

The consolidated Findings domain (src/Findings/) may consume stable shared contracts, but deployable Findings hosts must not compile optional executable plugin or analyzer implementations into their runtime graph.

Ledger WebService Scanner Coupling

StellaOps.Findings.Ledger.WebService exposes read surfaces that can include Scanner-derived evidence, such as reachability mini maps. That host is allowed to reference stable contract/model packages such as StellaOps.Scanner.Reachability when the endpoint contract requires the shared shape.

The host must not reference StellaOps.Scanner.Analyzers.Native. Native analysis is executable analyzer implementation owned by Scanner packaging and plugin composition. Findings runtime instrumentation is persisted and served from Findings-owned runtime tables and DTOs, through src/Findings/StellaOps.Findings.Ledger and src/Findings/__Libraries/StellaOps.Findings.Ledger.Runtime.

Closure Decision

The 2026-06-05 reference audit found that StellaOps.Findings.Ledger.WebService still referenced StellaOps.Scanner.Analyzers.Native. Code inspection showed the only source usage was a stale namespace import in Services/StubEndpointServices.cs; no Native analyzer type was consumed by the active runtime timeline endpoint. The safe closure is to remove the unused import and project reference, leaving reachability minimap contract usage in place.

Review Guard

Future Findings changes that need Scanner-produced evidence should prefer one of these boundaries:

• a shared contract/model package that is not an executable analyzer payload
• an HTTP/gRPC read contract exposed by the owning Scanner service
• a Findings-local DTO when the data is only serialized through Findings APIs

Do not add a runtime ProjectReference from a Findings deployable host to a Scanner analyzer implementation project to reuse a DTO.