test(scanner-storage): contract test + architecture doc (PR 8)

[0sm0s1z]

Summary

Closes the PR 2-8 scanner-templates-fix sprint. Adds:

• Contract test at `Sirius/testing/integration/scanner-storage/` (standalone Go module). Exercises every producer/consumer pair for agent templates and NSE scripts through the shared `go-api/sirius/store/templates` helpers. Pins canonical key shapes, JSON envelopes, the `.nse` canonicalization rule (the original PR 1 regression), and `WriteNseManifest` map-key canonicalization.
• Architecture doc at `documentation/dev/architecture/README.scanner-storage.md` with `llm_context: high`. Documents producers/consumers, queues, key namespaces, record schemas, the helpers callers should be using, and the drift policy (any record-shape change must bump go-api, update the doc, and update the contract test in the same change set). Wired into the documentation index.

Companion PRs already merged for the sprint:

• PR 1 - fix(nse): write canonical KV keys so UI lookups hit app-scanner#2 (canonicalize NSE script keys)
• PR 2 - [auth/401]: Warning: failed to submit host data via source-aware API: API returned status 401 #118 (UI auth bypass fix)
• PR 3 - chore(sprint): scanner-templates-fix tracker + plan #120 + feat(server): add notify_agents action to template sync queue app-agent#2
• PR 4 - fix(ui): route agent template View/Edit through authenticated tRPC #121
• PR 5 - feat(server): engine.commands defense-in-depth consumer (PR 5) app-agent#3
• PR 6 - SiriusScan/go-api#... (v0.0.18)
• PR 7 - refactor(sirius-api): migrate agent template handler to shared schema (PR 7) #124, refactor(nse): migrate to shared go-api/store/templates package (PR 7) app-scanner#3, refactor(template): use shared go-api/store/templates schema (PR 7) app-agent#4

Test plan

• `cd Sirius/testing/integration/scanner-storage && go test -v ./...` (6 tests, all pass)
• `make lint-docs-quick` and `make lint-index` green

[github-actions]

PR Review Card

Changed surfaces

• type:docs

Risk flags

• No high-risk patterns detected by automation.

Required testing evidence

• Documentation checklist (lint-docs, lint-index)

Reference checklist

• documentation/dev/test/CHECKLIST.testing-by-type.md

Maintainer commands

• /test health
• /test integration
• /test security auth-surface

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 0187330b90

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Execute scanner-storage contract suite in integration CI

This section says the new contract suite runs via make test-integration and on every PR, but the integration runners do not invoke testing/integration/scanner-storage (checked testing/container-testing/test-integration.sh and the integration job in .github/workflows/ci.yml). As written, the test is effectively orphaned and schema drift can slip through CI despite the documented drift policy.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Cover standard template path in pairwise contract test

TestContract_TemplateWriterReaderPairs always uses sampleTemplate(), which hardcodes IsCustom: true, so even the case labeled app-agent -> sirius-api exercises only template:custom:*. That misses the template:standard:* write/read path used by app-agent sync, so a regression in standard-key handling or fallback precedence would not be caught by this contract test.

Useful? React with 👍 / 👎.