Call-Paths And Build-Stage SBOM Inputs

This contract defines the Scanner inputs used when a runtime image is too slim to produce useful SBOM or call-path evidence by itself.

Metadata Contract

Scanner Worker reads these metadata keys before dependency reachability runs:

The stage publishes these downstream metadata keys:

Supported Inputs

• Attached SBOM: Scanner copies the supplied SBOM into the scan workspace and does not regenerate it from the build-stage root.
• JS/TS build-stage root: Scanner reads package.json plus package-lock.json or concrete dependencies entries and emits a CycloneDX 1.5 SBOM with npm purls. It also runs the in-process JavaScript source call-graph extractor.
• .NET source/build-stage root: Scanner detects .sln or .csproj roots and dispatches the existing Roslyn call-graph extractor. NuGet build-stage SBOM generation reads PackageReference entries from the first project file. The deterministic offline acceptance fixture is a local .sln snapshot with no package restore or external feed dependency.

Witness Shape

reachability.witness.path points to a deterministic JSON document with:

• schema=stellaops.scanner.reachability-witness@v1, scanId, graphDigest, resultDigest, richGraphHash, and language.
• releaseEvidence.component, aligned to the Release Evidence component shape: componentId, componentName, digest, tag, semVer, sourceRef, and sbomDigest when Scanner metadata can supply them. If no release component ID is provided, Scanner derives a deterministic local ID from the component identity and scan ID.
• Top-level and per-path policyGateEvidence shaped for PolicyGateEvidence consumers: subject.scanId, optional subject.purl, subject.symbolId, subject.artifactDigest, and evidence.graphHash, hasRuntimeEvidence, hasExecutionEvidence, and executionEvidenceDigest. A concrete static path adds latticeState=SR and pathLength. confidence is present only when every adjacent node pair identifies exactly one graph edge with a finite confidence in [0,1]; its value is the arithmetic mean of those edge confidences. No path, missing confidence, or an ambiguous parallel edge leaves those derived fields absent. Scanner does not emit riskScore or uncertaintyTier from this stage because it has not run the owning risk or uncertainty computation; in particular, no-path evidence is not relabelled as SU or given a synthetic zero.

This shape is policy-gate-consumable Scanner evidence. Sprint 019 (SPRINT_20260526_019_Scanner_reachability_live_forcing_function) wires the cross-module path live: the Scanner Worker’s ReachabilityPublishStageExecutor now (opt-in) posts the union graph to the ReachGraph WebService and uploads a canonical DependencyReachabilityReport JSON as a release-evidence packet, which the Release Orchestrator’s ReachabilityGateEvaluator reads back at promotion time. See:

• docs/modules/release-orchestrator/gates/reachability-gate.md
• docs/modules/reach-graph/guides/policy-gate-integration.md

Coverage Limits

• Runtime-only static images such as nginx SPA images cannot provide full package or source call-path evidence when manifests and source maps are absent. Scanner records that state and uses build-stage or attached SBOM evidence.
• .NET extraction currently covers deterministic source/build-stage solution and project inputs that Roslyn can load offline. It detects method declarations, direct/virtual/delegate invocations, ASP.NET-style method attributes, Main, hosted-service entrypoints, gRPC service methods, and registered .NET sinks. Sprint 018 RCH-018-001 adds two framework-registration shapes:
  • Minimal API Map* calls (MapGet, MapPost, MapPut, MapDelete, MapPatch, MapMethods, MapFallback) whose handler argument is a method-group reference promote the referenced method to an HttpHandler entrypoint.
  • services.AddHostedService<T>() promotes T.StartAsync and T.ExecuteAsync to BackgroundJob entrypoints when the type argument is a concrete INamedTypeSymbol.
• JS/TS call-path extraction currently covers deterministic source/build-stage patterns: named functions, named Express/Fastify-style route handlers, simple require/import aliases, direct calls, and known sink calls such as child_process.exec. Sprint 018 RCH-018-002 adds two further shapes:
  • Module Federation exposes: { './X': './x.js' } blocks in webpack.config.js / vite.config.js / module-federation.config.js / rspack.config.js promote the exported top-level functions of the referenced file to HttpHandler entrypoints (remote-callable).
  • *.bundle.js (or .mjs / .cjs) with a sibling *.map source map emits a bundled-source:<original> node per sources[] entry. This is a provenance node only – the extractor does NOT synthesize edges from bundled artifacts.
• Minified bundles WITHOUT a sibling source map remain a documented gap: the extractor adds zero nodes for them, and any reachability claim must come from a different signal (build-stage source, attached SBOM, or runtime evidence).
• Reflection-heavy DI registration (Activator.CreateInstance, Type.GetType, generic AddTransient(typeof(IFoo), runtimeType)), reflection-like JavaScript metaprogramming, generated route tables, and .NET minimal-API generated route builders that pass anonymous lambdas instead of method-group references are follow-up enrichment areas. They must not be reported as proven reachable unless a deterministic extractor or runtime signal produced the path.
• Python source extraction (Sprint 020 TIER-B-001) detects top-level def and async def plus Flask / FastAPI / Django REST decorator routes (@app.route, @app.get, @router.post, @api_view, @click.command, @app.task Celery, etc.). Two further shapes from Sprint 020:
  • asyncio.run(<funcName>) and asyncio.run(<funcName>()) at module scope promote the referenced top-level function to a BackgroundJob entrypoint. Only bareword identifier arguments are captured; lambdas, attribute access, and getattr(...) are skipped.
  • Reflection / dynamic-dispatch shapes (getattr(module, name)(), globals()[name](), importlib indirection) are an explicit gap: the referenced function is NOT auto-promoted.
• Go source extraction (Sprint 020 TIER-B-002) is the static fallback used when the stella-callgraph-go SSA tool is not present (CI lane). Three new supported shapes from Sprint 020:
  • HTTP framework registration: http.HandleFunc("/x", Handler), mux.HandleFunc(...), engine.GET/POST/PUT/DELETE/PATCH("/x", H) with an identifier handler argument promotes the referenced function to an HttpHandler entrypoint.
  • init() functions are promoted to ScheduledJob entrypoints (Go runs init() at package load before main). Previously these were silently dropped.
  • Goroutine spawns go FuncName(...) are materialised as Delegate-kind edges from a synthesised <package>.<goroutine-spawn> pseudo-node to the spawned function. The pseudo-node is NOT an entrypoint – spawning a goroutine never proves user-facing reachability; the edge just preserves transitive flow. Documented gaps: method-value handler arguments (router.GET("/x", h.Handle)), inline closure handlers, method-call goroutines (go obj.Method(...)), and reflection dispatch (reflect.ValueOf(fn).Call(...)) are all skipped.
• Java bytecode extraction (Sprint 020 TIER-B-003) covers Spring (@RestController, @GetMapping/@PostMapping/etc., @Scheduled, @KafkaListener, @RabbitListener, @JmsListener, @EventListener, @QueryMapping/@MutationMapping, @GrpcService), JAX-RS (@Path, @GET/@POST/etc., both javax and jakarta), Micronaut (@Controller, @Get/@Post/etc., @Scheduled), GraphQL annotations, static main([Ljava/lang/String;)V, classes extending HttpServlet (doGet/doPost/etc.). New from Sprint 020:
  • JSR-250 lifecycle hooks @PostConstruct and @PreDestroy (both javax.annotation and jakarta.annotation) are promoted to BackgroundJob entrypoints. The container auto-fires these at bean init / shutdown. Documented gap: CDI @Inject setters / constructors are NOT auto-promoted – DI callsites are not user-facing entrypoints and the classifier returns null for @Inject methods.
• This Scanner path emits local witness and graph artifacts. Release Orchestrator policy-gate consumption remains a separate integration boundary.