Scanner Design Dossiers

Deep technical designs for Scanner analyzers and surface components. Design notes can lead or trail the code; src/Scanner/ is the source of truth, and each note states its own status. Retired designs are archived under docs-archive/modules/scanner/design/.

Language analyzers

• ruby-analyzer.md - lockfile, runtime graph, capability signals for Ruby.
• php-autoload-design.md - composer/autoload graph for PHP.
• dotnet-analyzer-11-001.md - .NET analyzer design.
• deno-analyzer-scope.md, deno-analyzer-plan.md - Deno analyzer scope and plan.
• deno-runtime-signals.md - runtime trace and policy signal contract for the Deno analyzer.
• deno-runtime-shim.md - loader/trace shim for runtime NDJSON capture in the Deno analyzer.
• dart-swift-analyzer-scope.md, dart-analyzer-plan.md, swiftpm-coverage-plan.md - Dart and Swift scope.
• node-bundle-phase22.md - Node bundle, source-map and native/WASM observation.
• native-reachability-plan.md - native reachability plan.
• runtime-parity-plan.md - runtime parity plan for Java/.NET/PHP.

Surface & platform contracts

• surface-fs.md, surface-fs-consumers.md
• surface-env.md, surface-env-release.md
• surface-validation.md
• surface-secrets.md, surface-secrets-schema.md
• cache-key-contract.md
• entropy-transport.md
• replay-pipeline-contract.md
• determinism-ci-harness.md
• schema-governance.md
• api-ui-surfacing.md
• binary-evidence-alignment.md
• change-trace-architecture.md

SBOM standards

• cdx17-cbom-contract.md - deterministic CycloneDX 1.7 + CBOM export profile (ordering, hashes, downgrade rules).
• slsa-source-track.md - deterministic SLSA Source Track capture (repo/ref/commit, tree hash, invocation hash, provenance DSSE, CAS paths).
• standards-convergence-roadmap.md
• offline-kit-parity.md

OS ecosystem designs

• macos-analyzer.md - Homebrew, pkgutil, .app bundle plan.
• windows-analyzer.md - MSI, WinSxS, Chocolatey, registry collectors.

Competitor SBOM ingest (benchmark and import)

• competitor-ingest-normalization.md, competitor-signature-verification.md, competitor-fallback-hierarchy.md, competitor-error-taxonomy.md, competitor-db-governance.md, competitor-offline-ingest-kit.md, competitor-anomaly-tests.md, competitor-benchmark-parity.md

Demand & dashboards

• docs/benchmarks/scanner/windows-macos-demand.md - demand tracker.
• docs/benchmarks/scanner/windows-macos-interview-template.md - interview template.

Utility & reference

• ../operations/field-engagement.md - SE workflow guidance.
• ../operations/analyzers.md - operational runbook.
• ../operations/rustfs-migration.md - storage migration notes.

Policy readiness

• docs/modules/policy/secret-leak-detection-readiness.md - secret leak pipeline decisions.
• docs/modules/policy/windows-package-readiness.md - Windows analyzer policy decisions.