Scanner Analyzer Determinism & Completion (Group F closure)

Sprint: SPRINT_20260430_012_Scanner_analyzer_determinism_and_completion Audit reference: docs-archive/qa/audits/microservice-audit-pass2-2026-04-29.md (Section F)

This release closes the four findings in pass-2 audit Group F.

F2 — Node.js: deterministic runtime-evidence component key

RuntimeEvidenceLoader no longer falls back to Guid.NewGuid() when an incoming runtime-evidence record carries no path. The fallback now derives a stable runtime-component:<sha256-lower-hex> key over the scrubbed (reason, loaderId, from, to) tuple, so two analyzer runs over identical evidence files produce byte-equal SBOM output.

F3 — Secrets: deterministic SecretFinding.Id

SecretFinding.Create no longer falls back to Guid.NewGuid(). The fallback derives a deterministic Guid via HMAC-SHA256(pepper, ruleId|filePath|lineNumber|columnNumber|artifactDigest) packing the first 16 bytes into the Id. This restores chain-hashing, dedupe, and replay invariants in the findings ledger. Caller-supplied Guid? id values continue to be honored unchanged.

F1a — Deno: SBOM emission paths

The Deno analyzer now emits SBOM components from three streams that were previously held back behind // Task 5+ placeholders:

• npm purls (pkg:npm/<name>@<version>) collapsed to one component per (name, version) pair from compatibility.NpmResolutions. Specifiers, conditions, source nodes, targets, and resolved paths are aggregated into deduped metadata lists.
• Remote modules (type: deno:remote, key deno-remote::<sha256(specifier)>) for https://... module-graph nodes that are not also covered by an npm resolution.
• Bundle components (type: deno:bundle, key deno-bundle::<relativePath>) for each DenoBundleObservation.

The existing observation::deno summary record and DenoContainerEmitter output are unchanged.

F1b — Rust: declared-deps, workspace, status lift

RustLanguageAnalyzer.DisplayName is now Rust Analyzer (previously Rust Analyzer (preview)). The plug-in manifest carries org.stellaops.analyzer.status = production.

New plumbing:

• RustCargoTomlParser (Tomlyn-backed, BSD-2-Clause) reads [package], [dependencies], [dev-dependencies], [build-dependencies], [target.<cfg>.dependencies], and [workspace] (members, default-members, dependencies).
• RustWorkspaceResolver discovers all Cargo.toml files under the scan root and expands crates/*-style member globs.
• RustAnalyzerCollector.CollectCargoManifests performs declared-vs-installed merge: declared crates with a Cargo.lock match append declared.versionSpec / declared.scope / declared.targetCfg / declared.manifestPaths metadata; declared-only crates emit fresh components with declaredOnly = "true". Workspace-member crates with their own [package] section emit components carrying workspace.member / workspace.root and (where applicable) workspace.defaultMember = "true".

Dependency added

• Tomlyn (BSD-2-Clause). Recorded in NOTICE.md, listed in docs/legal/THIRD-PARTY-DEPENDENCIES.md, license vendored at third-party-licenses/Tomlyn/LICENSE. The sprint plan stated MIT; the upstream NuGet license declaration is BSD-2-Clause. Both are BUSL-1.1 compatible (see the compatibility table in the dependencies doc).

Determinism contract

For each of the four fixes, the analyzer’s output ordering is stable across invocations and the new tests assert byte-equal component-key sequences across two consecutive runs.