Scanner Implementation Plan

Verified against commit 942a18727c (2026-09-26). Re-verify with: grep -ln "Scanner" docs/implplan/SPRINT_*.md and git log --since=2026-09-10 --oneline -- src/Scanner.

Purpose

Point at the current Scanner work and the known open boundaries. Sprint files under docs/implplan/ are the only task ledger; this page does not track status.

Recently landed (2026-09)

• DAY-3 (SPRINT_20260925_004_Program_day_one_customer_defects.md): Docker Hub references pulled through registry-1.docker.io (RegistryApiReference); SBOM export reads the Worker-persisted CycloneDX document.
• DEF-11 (SPRINT_20260925_003_Program_closure_followups.md): per-layer SBOM routes served from the Worker’s surface-manifest layer.fragments artifact.
• RFC-1 / RFC-19 (docs-archive/implplan/SPRINT_20260916_001_Program_retention_family_convergence.md): retention classes for every Scanner table (migrations 005-010), daily observation/response cleanup, and the 12-month scanner.artifact_boms partition window.
• VRP-8: the sbom-match Concelier forward was removed from the Worker.

Open boundaries recorded in the dossier

These are documented limits of current source, not scheduled work; each needs a sprint row before it changes.

• Reachability compute/query/explain endpoints return 501 until a durable reachability backend is wired (architecture.md section 4).
• Baseline recommendation/rationale routes and POST /api/v1/triage/proof-bundle are reserved shapes.
• Smart-Diff material changes are a retrieval surface; no automatic scan-completion generation.
• The VEX-reachability filter, the VEX gate routes (gate-results, gate-summary, gate-blocked, gate-policy) and the Smart-Diff VEX-candidate routes are withdrawn (SPRINT_20260930_002 PCD-222, src/__Obsoleted/Scanner/**/PCD-222/): none had a caller or a data source. The scanner.vex_candidates table remains with no reader or writer.
• Source-triggered scanning (webhooks, SourceTriggerDispatcher) is quarantined (src/Scanner/AGENTS.md).
• The discover-vex-referrers stage, its Excititor OCI-attestation client and Scanner:Worker:ExcititorOciAttestations are withdrawn (SPRINT_20260927_003 PCD-47, src/__Obsoleted/Scanner/StellaOps.Scanner.Worker/PCD-47/): no live service serves an OpenVEX ingest for discovered attestations.
• A durable PostgreSQL IPatchSignatureStore does not exist; patch verification uses a fail-closed store unless one is registered.

Evidence of completion

• Code under src/Scanner/** (and the Scanner-named libraries under src/__Libraries/).
• Tests under src/Scanner/__Tests/, run with pwsh ./tools/scripts/test-targeted-xunit.ps1.
• Docs under docs/modules/scanner/**, updated in the same change.