work

ops/devops/aoc/aoc-ci.md

@@ -0,0 +1,25 @@
+# AOC Analyzer CI Contract (DEVOPS-AOC-19-001)
+
+## Scope
+Integrate AOC Roslyn analyzer and guard tests into CI to block banned writes in ingestion projects.
+
+## Steps
+1) Restore & build analyzers
+   - `dotnet restore src/Aoc/__Analyzers/StellaOps.Aoc.Analyzers/StellaOps.Aoc.Analyzers.csproj`
+   - `dotnet build src/Aoc/__Analyzers/StellaOps.Aoc.Analyzers/StellaOps.Aoc.Analyzers.csproj -c Release`
+2) Run analyzer on ingestion projects (Authority/Concelier/Excititor ingest paths)
+   - `dotnet build src/Concelier/StellaOps.Concelier.Ingestion/StellaOps.Concelier.Ingestion.csproj -c Release /p:RunAnalyzers=true /p:TreatWarningsAsErrors=true`
+   - `dotnet build src/Authority/StellaOps.Authority.Ingestion/StellaOps.Authority.Ingestion.csproj -c Release /p:RunAnalyzers=true /p:TreatWarningsAsErrors=true`
+   - `dotnet build src/Excititor/StellaOps.Excititor.Ingestion/StellaOps.Excititor.Ingestion.csproj -c Release /p:RunAnalyzers=true /p:TreatWarningsAsErrors=true`
+3) Guard tests
+   - `dotnet test src/Aoc/__Tests/StellaOps.Aoc.Analyzers.Tests/StellaOps.Aoc.Analyzers.Tests.csproj -c Release`
+4) Artefacts
+   - Upload `.artifacts/aoc-analyzer.log` and test TRX.
+
+## Determinism/Offline
+- Use local feeds (`local-nugets/`); no external fetches post-restore.
+- Build with `/p:ContinuousIntegrationBuild=true`.
+
+## Acceptance
+- CI fails on any analyzer warning in ingestion projects.
+- Tests pass; artefacts uploaded.

ops/devops/aoc/aoc-verify-stage.md

@@ -0,0 +1,22 @@
+# AOC Verify Stage (DEVOPS-AOC-19-002)
+
+## Purpose
+Add CI stage to run `stella aoc verify --since <commit>` against seeded Mongo snapshots for Concelier + Excititor, publishing violation reports.
+
+## Inputs
+- `STAGING_MONGO_URI` (read-only snapshot).
+- Optional `AOC_VERIFY_SINCE` (defaults to `HEAD~1`).
+
+## Steps
+1) Seed snapshot (if needed)
+   - Restore snapshot into local Mongo or point to read-only staging snapshot.
+2) Run verify
+   - `dotnet run --project src/Aoc/StellaOps.Aoc.Cli -- verify --since ${AOC_VERIFY_SINCE:-HEAD~1} --mongo $STAGING_MONGO_URI --output .artifacts/aoc-verify.json`
+3) Fail on violations
+   - Parse `.artifacts/aoc-verify.json`; if `violations > 0`, fail with summary.
+4) Publish artifacts
+   - Upload `.artifacts/aoc-verify.json` and `.artifacts/aoc-verify.ndjson` (per-violation).
+
+## Acceptance
+- Stage fails when violations exist; passes clean otherwise.
+- Artifacts attached for auditing.