- Stabilize PHP analyzer pipeline (SCANNER-ENG-0010 / 27-001) by defining autoload graph handling, composer restore posture, and fixtures.
- Provide deterministic evidence suitable for CI and reachability alignment with Concelier/Signals.
composer.json + composer.lock.vendor/composer/*.php autoload files (autoload_psr4.php, autoload_classmap.php, autoload_files.php, autoload_static.php).- Installed vendor tree under
vendor/. - Optional:
composer.phar version metadata for diagnostics (no execution).
- Package inventory:
pkg:composer/<name>@<version> with source/dist hashes from lockfile. - Autoload graph:
- PSR-4/PSR-0 mappings (namespace → path), classmap entries, files includes.
- Emit edges from package → file and namespace → path with deterministic ordering.
- Restore diagnostics:
- Detect missing vendor install vs lockfile drift; emit findings instead of network restore.
- Metadata:
- Composer version (from lock/platform field when present).
- Platform PHP extensions/version constraints.
- No composer install/updates; read-only parsing of lock/autoload/vendor.
- Stable ordering: sort packages, namespaces, classmap entries, files includes (ordinal, POSIX paths).
- Hashes: use lockfile dist/shasum when present; otherwise SHA-256 over on-disk file bytes for autoloaded files.
- PSR-4 project with namespaced classes and classmap mix.
- Project with
autoload_files.php includes (functions/constants). - Lockfile present but vendor missing → expect finding, no inventory.
- Path repo override + dist hash present.
- Parser for composer.lock (packages + platform reqs) and autoload PHP arrays (psr-4, psr-0, classmap, files).
- Graph builder producing deterministic edges and evidence records.
- Findings for missing vendor, mismatched lock hash, or absent autoload files.
- Tests under
src/Scanner/__Tests/StellaOps.Scanner.Analyzers.Lang.Php.Tests with goldens for each fixture; add TRX/binlogs to readiness once stable.