truf-server/openspec/changes/improve-core-scan-coverage/tasks.md

1. Docker Layer Graph Selection

• 1.1 Add and clamp docker_images_per_repository configuration through source argument construction and all Docker tag-resolution call sites.
• 1.2 Implement bounded Docker Registry token, platform-manifest, and ordered-layer resolution with strict response validation.
• 1.3 Implement deterministic distinct-graph selection, immutable child-digest targets, partial-result handling, and cache-version invalidation.
• 1.4 Add focused tests for aliases, platform children, novelty and age selection, malformed manifests, partial failures, and resolution plumbing.

2. Exact Git Revision Planning

• 2.1 Add idempotent PostgreSQL fields and fenced methods for immutable reservation plans and last successfully covered Git ref/head.
• 2.2 Implement bounded GitHub and GitLab ref/head resolvers with default-branch and explicit-ref handling.
• 2.3 Extend Git scan execution for exact no-op, pinned baseline, and unbounded-by-age/depth delta modes, including continuity-reset fallback.
• 2.4 Bind plans after claims, include them in result metadata, and advance covered heads only during matching successful ingestion.
• 2.5 Add focused tests for plan resolution, command construction, unchanged heads, failure/refund fencing, successful coverage, force-push fallback, and mid-scan updates.

3. Configuration And Verification

• 3.1 Enable three distinct Docker graphs and exact Git planning for the core sources with bounded documented defaults.
• 3.2 Run focused Docker, Git, queue, schema, lifecycle, and OpenSpec validation suites.
• 3.3 Record implementation evidence and any retained rollout limits in the change artifacts.