Skip to content

ADR-003: Unified Scanner Worker

Status: ACCEPTED.

Context

hxEASM needs Scanner Workers in local deployments, remote infrastructure, Kubernetes, and customer-controlled networks. These deployments differ operationally, but the scanner execution model should remain the same.

Decision

There is only one functional type of Scanner Worker.

The same Scanner Worker implementation supports:

  • local Docker Compose deployment;
  • remote physical servers;
  • Kubernetes;
  • customer-controlled infrastructure;
  • private network scanning;
  • public network scanning.

Customer-hosted Scanner Workers are not artificially limited to specific asset or threat categories. They can discover all asset and threat categories supported by their installed plugins, tools, configuration, template bundles, and assigned tasks.

Distinctions

Do not confuse:

  • Worker identity;
  • Worker deployment location;
  • organization assignments;
  • scanner capabilities;
  • future AI Worker type.

Scanner capability determines what a Worker can execute. Organization assignment determines what it is allowed to execute.

Alternatives

  • Separate CustomerWorker implementation.
  • Limit customer Workers to predefined asset/threat categories.
  • Treat deployment location as a capability.

Consequences

  • One scanner plugin execution architecture is maintained.
  • Customer-hosted and managed Workers use the same result format.
  • Gateway policy, not Worker code branches, enforces organization access.

Risks

  • Capability reporting must be accurate.
  • Gateway must never rely on deployment location as authorization.
  • Customer Workers require strong task and result validation.