feat: scan runner pipeline (Plans 1-5) + performance optimizations#9

Merged

Emperiusm merged 64 commits intomainfrom

feature/scan-runner-plan5

Apr 13, 2026

Commits on Apr 12, 2026

docs: scan-runner design specification

Emperiusm
and
claude
committed
docs: fold final review additions into scan-runner spec

Emperiusm
and
claude
committed
docs: scan-runner Plan 1 — Foundation (models, store, shared infra)

Emperiusm
and
claude
committed
feat(scanner): create scanner package with enums, core models, and package structure

Emperiusm
and
claude
committed
feat(scanner): CancellationToken — cooperative async cancellation

Emperiusm
and
claude
committed
feat(scanner): static data files — CWE hierarchy, aliases, severity maps, title normalization

Emperiusm
and
claude
committed
feat(shared): async subprocess with streaming, timeout, cancellation

Emperiusm
and
claude
committed
feat(shared): retry with exponential backoff and error pattern matching

Emperiusm
and
claude
committed
feat(shared): EventBus — async progress event fan-out with backpressure

Emperiusm
and
claude
committed
feat(scanner): ScanStoreProtocol + SqliteScanStore — scan and task CRUD

Emperiusm
and
claude
committed
feat(shared): AdaptiveResourcePool — priority heap with per-group limits

Emperiusm
and
claude
committed
feat(scanner): TaskExecutor protocol + TaskOutput model

Emperiusm
and
claude
committed
feat(scanner): ShellExecutor — subprocess with streaming

Emperiusm
and
claude
committed
fix(shared): run_streaming — watchdog pattern fixes cancel-task hang

Emperiusm
and
claude
committed
feat(scanner): DockerExecExecutor — docker exec with streaming

Emperiusm
and
claude
committed
feat(scanner): McpExecutor — MCP client with connection pool, tool discovery, execute

Emperiusm
and
claude
committed
feat(scanner): OutputBuffer — backpressure with disk spillover

Emperiusm
and
claude
committed
feat(scanner): ScanEngine — DAG graph, readiness tracking, task dispatch
Emperiusm
committed
test(scanner): ScanEngine integration tests — complex DAG, caching, edges, partial failure

Emperiusm
and
claude
committed
chore(scanner): executor package re-exports all executor types

Emperiusm
and
claude
committed
docs: Plan 2 — executors + engine implementation plan

Emperiusm
and
claude
committed
feat(scanner): TargetDetector — pattern-based target type detection

Emperiusm
and
claude
committed
feat(scanner): TargetValidator — async target validation

Emperiusm
and
claude
committed
feat(scanner): profile models + YAML loading

Emperiusm
and
claude
committed
feat(scanner): built-in scan profile YAML definitions

Emperiusm
and
claude
committed

Commits on Apr 13, 2026