Call-Paths And Build-Stage SBOM Inputs

This contract defines the Scanner inputs used when a runtime image is too slim to produce useful SBOM or call-path evidence by itself.

Metadata Contract

Scanner Worker reads these metadata keys before dependency reachability runs:

The stage publishes these downstream metadata keys:

Supported Inputs

• Attached SBOM: Scanner copies the supplied SBOM into the scan workspace and does not regenerate it from the build-stage root.
• JS/TS build-stage root: Scanner reads package.json plus package-lock.json or concrete dependencies entries and emits a CycloneDX 1.5 SBOM with npm purls. It also runs the in-process JavaScript source call-graph extractor.
• .NET source/build-stage root: Scanner detects .sln or .csproj roots and dispatches the existing Roslyn call-graph extractor. NuGet build-stage SBOM generation reads PackageReference entries from the first project file. The deterministic offline acceptance fixture is a local .sln snapshot with no package restore or external feed dependency.

Witness Shape

reachability.witness.path points to a deterministic JSON document with:

• schema=stellaops.scanner.reachability-witness@v1, scanId, graphDigest, resultDigest, richGraphHash, and language.
• releaseEvidence.component, aligned to the Release Evidence component shape: componentId, componentName, digest, tag, semVer, sourceRef, and sbomDigest when Scanner metadata can supply them. If no release component ID is provided, Scanner derives a deterministic local ID from the component identity and scan ID.
• Top-level and per-path policyGateEvidence shaped for PolicyGateEvidence consumers: subject.scanId, optional subject.purl, subject.symbolId, subject.artifactDigest, and evidence.latticeState, uncertaintyTier, graphHash, riskScore, confidence, hasRuntimeEvidence, pathLength, hasExecutionEvidence, and executionEvidenceDigest.

This shape is policy-gate-consumable Scanner evidence. Sprint 019 (SPRINT_20260526_019_Scanner_reachability_live_forcing_function) wires the cross-module path live: the Scanner Worker’s ReachabilityPublishStageExecutor now (opt-in) posts the union graph to the ReachGraph WebService and uploads a canonical DependencyReachabilityReport JSON as a release-evidence packet, which the Release Orchestrator’s ReachabilityGateEvaluator reads back at promotion time. See:

• docs/modules/release-orchestrator/gates/reachability-gate.md
• docs/modules/reach-graph/guides/policy-gate-integration.md

Coverage Limits

• Runtime-only static images such as nginx SPA images cannot provide full package or source call-path evidence when manifests and source maps are absent. Scanner records that state and uses build-stage or attached SBOM evidence.
• .NET extraction currently covers deterministic source/build-stage solution and project inputs that Roslyn can load offline. It detects method declarations, direct/virtual/delegate invocations, ASP.NET-style method attributes, Main, hosted-service entrypoints, gRPC service methods, and registered .NET sinks. Sprint 018 RCH-018-001 adds two framework-registration shapes:
  • Minimal API Map* calls (MapGet, MapPost, MapPut, MapDelete, MapPatch, MapMethods, MapFallback) whose handler argument is a method-group reference promote the referenced method to an HttpHandler entrypoint.
  • services.AddHostedService<T>() promotes T.StartAsync and T.ExecuteAsync to BackgroundJob entrypoints when the type argument is a concrete INamedTypeSymbol.
• JS/TS call-path extraction currently covers deterministic source/build-stage patterns: named functions, named Express/Fastify-style route handlers, simple require/import aliases, direct calls, and known sink calls such as child_process.exec. Sprint 018 RCH-018-002 adds two further shapes:
  • Module Federation exposes: { './X': './x.js' } blocks in webpack.config.js / vite.config.js / module-federation.config.js / rspack.config.js promote the exported top-level functions of the referenced file to HttpHandler entrypoints (remote-callable).
  • *.bundle.js (or .mjs / .cjs) with a sibling *.map source map emits a bundled-source:<original> node per sources[] entry. This is a provenance node only – the extractor does NOT synthesize edges from bundled artifacts.
• Minified bundles WITHOUT a sibling source map remain a documented gap: the extractor adds zero nodes for them, and any reachability claim must come from a different signal (build-stage source, attached SBOM, or runtime evidence).
• Reflection-heavy DI registration (Activator.CreateInstance, Type.GetType, generic AddTransient(typeof(IFoo), runtimeType)), reflection-like JavaScript metaprogramming, generated route tables, and .NET minimal-API generated route builders that pass anonymous lambdas instead of method-group references are follow-up enrichment areas. They must not be reported as proven reachable unless a deterministic extractor or runtime signal produced the path.
• Python source extraction (Sprint 020 TIER-B-001) detects top-level def and async def plus Flask / FastAPI / Django REST decorator routes (@app.route, @app.get, @router.post, @api_view, @click.command, @app.task Celery, etc.). Two further shapes from Sprint 020:
  • asyncio.run(<funcName>) and asyncio.run(<funcName>()) at module scope promote the referenced top-level function to a BackgroundJob entrypoint. Only bareword identifier arguments are captured; lambdas, attribute access, and getattr(...) are skipped.
  • Reflection / dynamic-dispatch shapes (getattr(module, name)(), globals()[name](), importlib indirection) are an explicit gap: the referenced function is NOT auto-promoted.
• Go source extraction (Sprint 020 TIER-B-002) is the static fallback used when the stella-callgraph-go SSA tool is not present (CI lane). Three new supported shapes from Sprint 020:
  • HTTP framework registration: http.HandleFunc("/x", Handler), mux.HandleFunc(...), engine.GET/POST/PUT/DELETE/PATCH("/x", H) with an identifier handler argument promotes the referenced function to an HttpHandler entrypoint.
  • init() functions are promoted to ScheduledJob entrypoints (Go runs init() at package load before main). Previously these were silently dropped.
  • Goroutine spawns go FuncName(...) are materialised as Delegate-kind edges from a synthesised <package>.<goroutine-spawn> pseudo-node to the spawned function. The pseudo-node is NOT an entrypoint – spawning a goroutine never proves user-facing reachability; the edge just preserves transitive flow. Documented gaps: method-value handler arguments (router.GET("/x", h.Handle)), inline closure handlers, method-call goroutines (go obj.Method(...)), and reflection dispatch (reflect.ValueOf(fn).Call(...)) are all skipped.
• Java bytecode extraction (Sprint 020 TIER-B-003) covers Spring (@RestController, @GetMapping/@PostMapping/etc., @Scheduled, @KafkaListener, @RabbitListener, @JmsListener, @EventListener, @QueryMapping/@MutationMapping, @GrpcService), JAX-RS (@Path, @GET/@POST/etc., both javax and jakarta), Micronaut (@Controller, @Get/@Post/etc., @Scheduled), GraphQL annotations, static main([Ljava/lang/String;)V, classes extending HttpServlet (doGet/doPost/etc.). New from Sprint 020:
  • JSR-250 lifecycle hooks @PostConstruct and @PreDestroy (both javax.annotation and jakarta.annotation) are promoted to BackgroundJob entrypoints. The container auto-fires these at bean init / shutdown. Documented gap: CDI @Inject setters / constructors are NOT auto-promoted – DI callsites are not user-facing entrypoints and the classifier returns null for @Inject methods.
• This Scanner path emits local witness and graph artifacts. Release Orchestrator policy-gate consumption remains a separate integration boundary.