Entropy Analysis for Executable Layers

Source-verified against commit 2021a48f6e (2026-10-05). Re-verify the named source contracts before applying this description to an installation. Re-verify: git show HEAD:src/Scanner/StellaOps.Scanner.Worker/Processing/Entropy/EntropyStageExecutor.cs.

Scanner’s EntropyStageExecutor computes file entropy and stores the result in the scan analysis context. SurfaceManifestStageExecutor emits entropy.report and entropy.layer-summary payloads when those analysis records exist.

Implemented boundary

Eligible executable files and large binary blobs are read from the materialized scan input. The report builder uses sliding-window Shannon entropy. The worker resolves paths inside the declared input root and records opaque-byte ratios.

The stage has no PCR trust-vector input, VEX issuer tier or trust-lattice penalty gate. An entropy report does not assert affected or not_affected and does not clear a promotion. The old thresholds, penalty formula, heatmap and dedicated CLI examples were target-state designs.

Verification

Inspect EntropyStageExecutor, EntropyReportBuilder and SurfaceManifestStageExecutor in the Scanner family. Check the emitted scan payloads for the actual run; the existence of an analyzer is not evidence that a particular file was analyzed.

For effective VEX decisions, use the consensus runbook. For the scan pipeline, use Scanner architecture.

The earlier design is frozen history. It does not describe the current runtime.