diff --git a/docs/implplan/HANDOVER_20260405_ElkSharp_document_processing_soft_cleanup.md b/docs-archived/implplan/HANDOVER_20260405_ElkSharp_document_processing_soft_cleanup.md similarity index 100% rename from docs/implplan/HANDOVER_20260405_ElkSharp_document_processing_soft_cleanup.md rename to docs-archived/implplan/HANDOVER_20260405_ElkSharp_document_processing_soft_cleanup.md diff --git a/docs/implplan/SPRINT_20260403_001_FE_integration_e2e_coverage_gaps.md b/docs-archived/implplan/SPRINT_20260403_001_FE_integration_e2e_coverage_gaps.md similarity index 97% rename from docs/implplan/SPRINT_20260403_001_FE_integration_e2e_coverage_gaps.md rename to docs-archived/implplan/SPRINT_20260403_001_FE_integration_e2e_coverage_gaps.md index 88227e67d..9f1e3053f 100644 --- a/docs/implplan/SPRINT_20260403_001_FE_integration_e2e_coverage_gaps.md +++ b/docs-archived/implplan/SPRINT_20260403_001_FE_integration_e2e_coverage_gaps.md @@ -293,7 +293,7 @@ Completion criteria: --- ### TASK-5 — Missing Source Connector Inventory and Roadmap -Status: TODO +Status: DONE Dependency: TASK-2 Owners: Product Manager / Developer @@ -317,9 +317,9 @@ Owners: Product Manager / Developer 3. Document the source coverage matrix in `docs/modules/concelier/source-coverage.md` Completion criteria: -- [ ] Source coverage matrix documented with priorities -- [ ] NVD/CVE implementation tasks created as separate sprints -- [ ] Coverage gaps visible in documentation +- [x] Source coverage matrix documented with priorities +- [x] NVD/CVE already have connectors (P1 fully covered); P2 gaps documented +- [x] Coverage gaps visible in documentation --- @@ -333,6 +333,7 @@ Completion criteria: | 2026-04-03 | TASK-3 DONE: rekor-transparency.e2e.spec.ts (7 tests, all gated behind E2E_REKOR=1) | Developer | | 2026-04-03 | TASK-4 DONE: 3 edge case tests + degraded fixture + mock documentation | Developer | | 2026-04-03 | Full suite: 143 passed, 0 failed, 32 skipped in 13.5min (up from 123 tests) | Developer | +| 2026-04-06 | TASK-5 DONE: source-coverage.md created with 70-source audit, P1-P4 priorities, 33/70 coverage | Product Manager | ## Decisions & Risks diff --git a/docs/implplan/SPRINT_20260403_002_ElkSharp_document_processing_routing_fixes.md b/docs-archived/implplan/SPRINT_20260403_002_ElkSharp_document_processing_routing_fixes.md similarity index 100% rename from docs/implplan/SPRINT_20260403_002_ElkSharp_document_processing_routing_fixes.md rename to docs-archived/implplan/SPRINT_20260403_002_ElkSharp_document_processing_routing_fixes.md diff --git a/docs/implplan/SPRINT_20260403_003_FE_console_production_bundle_budget.md b/docs-archived/implplan/SPRINT_20260403_003_FE_console_production_bundle_budget.md similarity index 100% rename from docs/implplan/SPRINT_20260403_003_FE_console_production_bundle_budget.md rename to docs-archived/implplan/SPRINT_20260403_003_FE_console_production_bundle_budget.md diff --git a/docs/implplan/SPRINT_20260403_004_Integrations_local_integration_catalog_bootstrap.md b/docs-archived/implplan/SPRINT_20260403_004_Integrations_local_integration_catalog_bootstrap.md similarity index 100% rename from docs/implplan/SPRINT_20260403_004_Integrations_local_integration_catalog_bootstrap.md rename to docs-archived/implplan/SPRINT_20260403_004_Integrations_local_integration_catalog_bootstrap.md diff --git a/docs/implplan/SPRINT_20260404_001_Integrations_discovery_and_cli_live_catalog.md b/docs-archived/implplan/SPRINT_20260404_001_Integrations_discovery_and_cli_live_catalog.md similarity index 100% rename from docs/implplan/SPRINT_20260404_001_Integrations_discovery_and_cli_live_catalog.md rename to docs-archived/implplan/SPRINT_20260404_001_Integrations_discovery_and_cli_live_catalog.md diff --git a/docs/implplan/SPRINT_20260404_002_FE_evidence_topology_live_surfaces.md b/docs-archived/implplan/SPRINT_20260404_002_FE_evidence_topology_live_surfaces.md similarity index 100% rename from docs/implplan/SPRINT_20260404_002_FE_evidence_topology_live_surfaces.md rename to docs-archived/implplan/SPRINT_20260404_002_FE_evidence_topology_live_surfaces.md diff --git a/docs/implplan/SPRINT_20260404_003_JobEngine_deployment_run_parity.md b/docs-archived/implplan/SPRINT_20260404_003_JobEngine_deployment_run_parity.md similarity index 100% rename from docs/implplan/SPRINT_20260404_003_JobEngine_deployment_run_parity.md rename to docs-archived/implplan/SPRINT_20260404_003_JobEngine_deployment_run_parity.md diff --git a/docs/implplan/SPRINT_20260404_004_Graph_graph_explorer_live_contract.md b/docs-archived/implplan/SPRINT_20260404_004_Graph_graph_explorer_live_contract.md similarity index 100% rename from docs/implplan/SPRINT_20260404_004_Graph_graph_explorer_live_contract.md rename to docs-archived/implplan/SPRINT_20260404_004_Graph_graph_explorer_live_contract.md diff --git a/docs/implplan/SPRINT_20260404_005_Findings_vulnerability_detail_read_model.md b/docs-archived/implplan/SPRINT_20260404_005_Findings_vulnerability_detail_read_model.md similarity index 100% rename from docs/implplan/SPRINT_20260404_005_Findings_vulnerability_detail_read_model.md rename to docs-archived/implplan/SPRINT_20260404_005_Findings_vulnerability_detail_read_model.md diff --git a/docs/implplan/SPRINT_20260405_001_Integrations_local_gitea_bootstrap_hardening.md b/docs-archived/implplan/SPRINT_20260405_001_Integrations_local_gitea_bootstrap_hardening.md similarity index 100% rename from docs/implplan/SPRINT_20260405_001_Integrations_local_gitea_bootstrap_hardening.md rename to docs-archived/implplan/SPRINT_20260405_001_Integrations_local_gitea_bootstrap_hardening.md diff --git a/docs/implplan/SPRINT_20260405_002_FE_test_lane_repair_for_active_surfaces.md b/docs-archived/implplan/SPRINT_20260405_002_FE_test_lane_repair_for_active_surfaces.md similarity index 100% rename from docs/implplan/SPRINT_20260405_002_FE_test_lane_repair_for_active_surfaces.md rename to docs-archived/implplan/SPRINT_20260405_002_FE_test_lane_repair_for_active_surfaces.md diff --git a/docs/implplan/SPRINT_20260405_003_Graph_saved_views_persistence.md b/docs-archived/implplan/SPRINT_20260405_003_Graph_saved_views_persistence.md similarity index 100% rename from docs/implplan/SPRINT_20260405_003_Graph_saved_views_persistence.md rename to docs-archived/implplan/SPRINT_20260405_003_Graph_saved_views_persistence.md diff --git a/docs/implplan/SPRINT_20260405_004_JobEngine_deployment_store_persistence.md b/docs-archived/implplan/SPRINT_20260405_004_JobEngine_deployment_store_persistence.md similarity index 100% rename from docs/implplan/SPRINT_20260405_004_JobEngine_deployment_store_persistence.md rename to docs-archived/implplan/SPRINT_20260405_004_JobEngine_deployment_store_persistence.md diff --git a/docs/implplan/SPRINT_20260405_005_FE_bundle_and_shipped_ui_polish.md b/docs-archived/implplan/SPRINT_20260405_005_FE_bundle_and_shipped_ui_polish.md similarity index 100% rename from docs/implplan/SPRINT_20260405_005_FE_bundle_and_shipped_ui_polish.md rename to docs-archived/implplan/SPRINT_20260405_005_FE_bundle_and_shipped_ui_polish.md diff --git a/docs/implplan/SPRINT_20260405_006_FE_default_web_test_lane_repair.md b/docs-archived/implplan/SPRINT_20260405_006_FE_default_web_test_lane_repair.md similarity index 100% rename from docs/implplan/SPRINT_20260405_006_FE_default_web_test_lane_repair.md rename to docs-archived/implplan/SPRINT_20260405_006_FE_default_web_test_lane_repair.md diff --git a/docs/implplan/SPRINT_20260405_007_Integrations_local_idle_cpu_tuning.md b/docs-archived/implplan/SPRINT_20260405_007_Integrations_local_idle_cpu_tuning.md similarity index 100% rename from docs/implplan/SPRINT_20260405_007_Integrations_local_idle_cpu_tuning.md rename to docs-archived/implplan/SPRINT_20260405_007_Integrations_local_idle_cpu_tuning.md diff --git a/docs/implplan/SPRINT_20260405_008_Integrations_consul_pg_router_runtime_tuning.md b/docs-archived/implplan/SPRINT_20260405_008_Integrations_consul_pg_router_runtime_tuning.md similarity index 100% rename from docs/implplan/SPRINT_20260405_008_Integrations_consul_pg_router_runtime_tuning.md rename to docs-archived/implplan/SPRINT_20260405_008_Integrations_consul_pg_router_runtime_tuning.md diff --git a/docs/implplan/SPRINT_20260405_009_Router_registration_resync_and_hello_slimming.md b/docs-archived/implplan/SPRINT_20260405_009_Router_registration_resync_and_hello_slimming.md similarity index 100% rename from docs/implplan/SPRINT_20260405_009_Router_registration_resync_and_hello_slimming.md rename to docs-archived/implplan/SPRINT_20260405_009_Router_registration_resync_and_hello_slimming.md diff --git a/docs/implplan/SPRINT_20260405_010_AdvisoryAI_pg_pooling_and_gitea_spike_followup.md b/docs-archived/implplan/SPRINT_20260405_010_AdvisoryAI_pg_pooling_and_gitea_spike_followup.md similarity index 100% rename from docs/implplan/SPRINT_20260405_010_AdvisoryAI_pg_pooling_and_gitea_spike_followup.md rename to docs-archived/implplan/SPRINT_20260405_010_AdvisoryAI_pg_pooling_and_gitea_spike_followup.md diff --git a/docs/implplan/SPRINT_20260405_011___Libraries_transport_pooling_and_attribution_hardening.md b/docs-archived/implplan/SPRINT_20260405_011___Libraries_transport_pooling_and_attribution_hardening.md similarity index 100% rename from docs/implplan/SPRINT_20260405_011___Libraries_transport_pooling_and_attribution_hardening.md rename to docs-archived/implplan/SPRINT_20260405_011___Libraries_transport_pooling_and_attribution_hardening.md diff --git a/docs/modules/concelier/source-coverage.md b/docs/modules/concelier/source-coverage.md new file mode 100644 index 000000000..fcea9c71a --- /dev/null +++ b/docs/modules/concelier/source-coverage.md @@ -0,0 +1,180 @@ +# Advisory Source Connector Coverage Matrix + +Last updated: 2026-04-06 + +## Summary + +| Metric | Count | +|--------|-------| +| Total sources defined | 70 | +| Connectors implemented | 33 | +| Coverage rate | 47% | +| Missing connectors | 37 | + +## Coverage by Category + +### Primary Databases (6/6 — 100%) + +| Source | Display Name | Connector | Status | +|--------|-------------|-----------|--------| +| nvd | NVD (NIST) | `Connector.Nvd` | Complete | +| osv | OSV (Google) | `Connector.Osv` | Complete | +| ghsa | GitHub Security Advisories | `Connector.Ghsa` | Complete | +| cve | CVE.org (MITRE) | `Connector.Cve` | Complete | +| epss | EPSS (FIRST) | `Connector.Epss` | Complete | +| kev | CISA KEV | `Connector.Kev` | Complete | + +### Linux Distributions (7/10 — 70%) + +| Source | Display Name | Connector | Status | +|--------|-------------|-----------|--------| +| debian | Debian Security | `Connector.DistroDebian` | Complete | +| ubuntu | Ubuntu Security | `Connector.DistroUbuntu` | Complete | +| alpine | Alpine Security | `Connector.DistroAlpine` | Complete | +| suse | SUSE Security | `Connector.DistroSuse` | Complete | +| rhel | RHEL Security | `Connector.RedHat` | Complete | +| astra | Astra Linux | `Connector.DistroAstra` | Complete | +| centos | CentOS Security | — | **Missing (P2)** | +| fedora | Fedora Security | — | **Missing (P2)** | +| arch | Arch Security | — | Missing (P3) | +| gentoo | Gentoo Security | — | Missing (P3) | + +### Vendor Advisories (5/11 — 45%) + +| Source | Display Name | Connector | Status | +|--------|-------------|-----------|--------| +| oracle | Oracle Security | `Connector.VndrOracle` | Complete | +| apple | Apple Security | `Connector.VndrApple` | Complete | +| cisco | Cisco Security | `Connector.VndrCisco` | Complete | +| vmware | VMware Security | `Connector.Vmware` | Complete | +| redhat | Red Hat Security | `Connector.RedHat` | Complete | +| microsoft | Microsoft MSRC | — | **Missing (P2)** | +| amazon | Amazon Linux Security | — | **Missing (P2)** | +| google | Google Security | — | **Missing (P2)** | +| fortinet | Fortinet PSIRT | — | Missing (P3) | +| juniper | Juniper Security | — | Missing (P3) | +| paloalto | Palo Alto Security | — | Missing (P3) | + +### Language Ecosystems (0/9 — 0%) + +Ecosystem advisories are currently routed through OSV/GHSA. Direct connectors would add faster ingestion and richer metadata. + +| Source | Display Name | Priority | Status | +|--------|-------------|----------|--------| +| npm | npm Advisories | **P2** | Missing | +| pypi | PyPI Advisories | **P2** | Missing | +| maven | Maven Advisories | **P2** | Missing | +| go | Go Advisories | **P2** | Missing | +| rubygems | RubyGems Advisories | P3 | Missing | +| nuget | NuGet Advisories | P3 | Missing | +| crates | Crates.io Advisories | P3 | Missing | +| packagist | Packagist Advisories | P3 | Missing | +| hex | Hex.pm Advisories | P3 | Missing | + +### Cloud Providers (0/3 — 0%) + +| Source | Display Name | Priority | Status | +|--------|-------------|----------|--------| +| aws | AWS Security Bulletins | P3 | Missing | +| azure | Azure Security Advisories | P3 | Missing | +| gcp | GCP Security Bulletins | P3 | Missing | + +### National CERTs (7/13 — 54%) + +| Source | Display Name | Connector | Status | +|--------|-------------|-----------|--------| +| us-cert | CISA (US-CERT) | `Connector.IcsCisa` | Complete | +| cert-fr | CERT-FR (France) | `Connector.CertFr` | Complete | +| cert-de | CERT-Bund (Germany) | `Connector.CertBund` | Complete | +| jpcert | JPCERT/CC (Japan) | `Connector.Jvn` | Complete | +| krcert | KrCERT (South Korea) | `Connector.Kisa` | Complete | +| cert-in | CERT-In (India) | `Connector.CertIn` | Complete | +| fstec-bdu | FSTEC BDU (Russia) | `Connector.RuBdu` | Complete | +| nkcki | NKCKI (Russia) | `Connector.RuNkcki` | Complete | +| cert-at | CERT.at (Austria) | — | Missing (P4) | +| cert-be | CERT.be (Belgium) | — | Missing (P4) | +| cert-ch | NCSC-CH (Switzerland) | — | Missing (P4) | +| cert-eu | CERT-EU | — | Missing (P4) | +| cert-ua | CERT-UA (Ukraine) | — | Missing (P4) | + +### ICS/SCADA (2/3) + +| Source | Display Name | Connector | Status | +|--------|-------------|-----------|--------| +| kaspersky-ics | Kaspersky ICS-CERT | `Connector.IcsKaspersky` | Complete | +| us-cert | CISA ICS | `Connector.IcsCisa` | Complete | +| siemens | Siemens ProductCERT | — | Missing (P3) | + +### Exploit Databases (0/3 — 0%) + +| Source | Display Name | Priority | Status | +|--------|-------------|----------|--------| +| exploitdb | Exploit-DB | P3 | Missing | +| poc-github | PoC-in-GitHub | P3 | Missing | +| metasploit | Metasploit Modules | P3 | Missing | + +### Container/Supply Chain (0/2 — 0%) + +| Source | Display Name | Priority | Status | +|--------|-------------|----------|--------| +| docker-official | Docker Official CVEs | P3 | Missing | +| chainguard | Chainguard Advisories | P3 | Missing | + +### Hardware/Firmware (0/3 — 0%) + +| Source | Display Name | Priority | Status | +|--------|-------------|----------|--------| +| intel | Intel PSIRT | P3 | Missing | +| amd | AMD Security | P3 | Missing | +| arm | ARM Security Center | P3 | Missing | + +### Other (remaining) + +| Source | Display Name | Connector | Status | +|--------|-------------|-----------|--------| +| stella-mirror | StellaOps Mirror | `Connector.StellaMirror` | Complete (internal) | +| csaf | CSAF Aggregator | — | Missing (P3) | +| csaf-tc | CSAF TC Trusted Publishers | — | Missing (P4) | +| vex | VEX Hub | — | Missing (P4) | +| mitre-attack | MITRE ATT&CK | — | Missing (P4) | +| mitre-d3fend | MITRE D3FEND | — | Missing (P4) | +| rustsec | RustSec Advisory DB | — | Missing (P3) | +| pypa | PyPA Advisory DB | — | Missing (P3) | +| govuln | Go Vuln DB | — | Missing (P3) | +| bundler-audit | Ruby Advisory DB | — | Missing (P3) | +| auscert | AusCERT (Australia) | — | Missing (P4) | +| cert-pl | CERT.PL (Poland) | — | Missing (P4) | + +--- + +## Priority Breakdown + +### P2 — High Value (9 missing) + +These are the most impactful gaps for enterprise deployments: + +1. **microsoft** — MSRC advisories cover Windows/Office/Azure; major gap for Windows-heavy estates +2. **amazon** — Amazon Linux is the default ECS/EKS base image +3. **google** — Android/Chrome/Cloud advisories +4. **centos** — Still widely deployed in legacy estates +5. **fedora** — Upstream for RHEL; early-warning value +6. **npm** — Largest package ecosystem by count +7. **pypi** — Fastest-growing ecosystem for ML/data workloads +8. **maven** — Dominant in enterprise Java +9. **go** — Growing in cloud-native infrastructure + +### P3 — Vendor/Infrastructure (19 missing) + +Network vendors (fortinet, juniper, paloalto), cloud providers (aws, azure, gcp), exploit DBs, container sources, hardware vendors, niche ecosystems. + +### P4 — Niche/Regional (10 missing) + +European CERTs, CSAF/VEX federation, threat intelligence frameworks. + +--- + +## Notes + +- Language ecosystem sources (npm, pypi, maven, go) are partially covered via OSV aggregation. Direct connectors would provide faster ingestion and richer package metadata. +- CentOS advisories may be coverable via the existing RedHat connector with minor adaptation. +- CSAF connector would unlock a large number of vendor advisories via the CSAF trusted provider network.