Scanner WebService signed-bundle tests

The WebService probe tests build the eight base analyzer projects and create their own bundle cohort under the checkout’s tmp/scratch/scanner-web-bundle-tests/. They copy the current build’s analyzer DLLs, load the committed unsigned manifest templates, stamp payload and host-contract hashes with the Scanner signing tool, and sign the canonical DSSE payload with the central Ed25519 profile’s ephemeral test signer. Only the public trust anchor is written. The fixture deletes its private cohort after the test.

This proves the real signed-manifest admission and probe-report path using compatible inputs. The WebService reporter verifies the manifest signature and payload hash; the same cohort also exercises the Worker’s stricter host-contract stamp checks through ScannerPluginLoader. This test does not establish the state of a deployed cohort or activate analyzer entry points.

The fixture never searches for or copies .runtime/ bundles. A fresh worktree therefore uses its own built source instead of mutable primary-tree packaging output. The project records its scratch location as assembly metadata and copies the authoritative unsigned templates to its test output directory.

Run the scoped probe tests with:

pwsh tools/scripts/test-targeted-xunit.ps1 -Project src/Scanner/__Tests/StellaOps.Scanner.WebService.Tests/StellaOps.Scanner.WebService.Tests.csproj -Class "*ScannerSignedPluginProbeReporterTests" -BuildProjectReferences

The tests change manifest fields, signature bytes, analyzer DLL bytes, the public trust anchor, and a private host-contract DLL copy. Each control requires a specific refusal, restores the original bytes, and proves acceptance recovers. Missing manifests remain rejected. The positive run emits COHORT_MANIFEST records containing the signed payload hashes and host-contract stamps for the validation receipt; no private key is emitted or retained.