feat(api): Implement Console Export Client and Models

- Added ConsoleExportClient for managing export requests and responses.
- Introduced ConsoleExportRequest and ConsoleExportResponse models.
- Implemented methods for creating and retrieving exports with appropriate headers.

feat(crypto): Add Software SM2/SM3 Cryptography Provider

- Implemented SmSoftCryptoProvider for software-only SM2/SM3 cryptography.
- Added support for signing and verification using SM2 algorithm.
- Included hashing functionality with SM3 algorithm.
- Configured options for loading keys from files and environment gate checks.

test(crypto): Add unit tests for SmSoftCryptoProvider

- Created comprehensive tests for signing, verifying, and hashing functionalities.
- Ensured correct behavior for key management and error handling.

feat(api): Enhance Console Export Models

- Expanded ConsoleExport models to include detailed status and event types.
- Added support for various export formats and notification options.

test(time): Implement TimeAnchorPolicyService tests

- Developed tests for TimeAnchorPolicyService to validate time anchors.
- Covered scenarios for anchor validation, drift calculation, and policy enforcement.

deploy/compose/README.md

@@ -4,9 +4,9 @@ These Compose bundles ship the minimum services required to exercise the scanner
 
 ## Layout
 
-| Path | Purpose |
-| ---- | ------- |
-| `docker-compose.dev.yaml` | Edge/nightly stack tuned for laptops and iterative work. |
+| Path | Purpose |
+| ---- | ------- |
+| `docker-compose.dev.yaml` | Edge/nightly stack tuned for laptops and iterative work. |
 | `docker-compose.stage.yaml` | Stable channel stack mirroring pre-production clusters. |
 | `docker-compose.prod.yaml` | Production cutover stack with front-door network hand-off and Notify events enabled. |
 | `docker-compose.airgap.yaml` | Stable stack with air-gapped defaults (no outbound hostnames). |
@@ -17,6 +17,7 @@ These Compose bundles ship the minimum services required to exercise the scanner
 | `env/*.env.example` | Seed `.env` files that document required secrets and ports per profile. |
 | `scripts/backup.sh` | Pauses workers and creates tar.gz of Mongo/MinIO/Redis volumes (deterministic snapshot). |
 | `scripts/reset.sh` | Stops the stack and removes Mongo/MinIO/Redis volumes after explicit confirmation. |
+| `scripts/quickstart.sh` | Helper to validate config and start dev stack; set `USE_MOCK=1` to include `docker-compose.mock.yaml` overlay. |
 | `docker-compose.mock.yaml` | Dev-only overlay with placeholder digests for missing services (orchestrator, policy-registry, packs, task-runner, VEX/Vuln stack). Use only with mock release manifest `deploy/releases/2025.09-mock-dev.yaml`. |
 
 ## Usage
@@ -111,10 +112,7 @@ Until official digests land, you can exercise Compose packaging with mock placeh
 
 ```bash
 # assumes docker-compose.dev.yaml as the base profile
-docker compose --env-file env/dev.env.example \
-  -f docker-compose.dev.yaml \
-  -f docker-compose.mock.yaml \
-  config
+USE_MOCK=1 ./scripts/quickstart.sh env/dev.env.example
 ```
 
 The overlay pins the missing services (orchestrator, policy-registry, packs-registry, task-runner, VEX/Vuln stack) to mock digests from `deploy/releases/2025.09-mock-dev.yaml` and uses `sleep infinity` commands. Replace with real digests and service commands as soon as releases publish.

deploy/compose/docker-compose.mock.yaml

@@ -6,7 +6,7 @@ x-release-labels: &release-labels
 services:
   orchestrator:
     image: registry.stella-ops.org/stellaops/orchestrator@sha256:97f12856ce870bafd3328bda86833bcccbf56d255941d804966b5557f6610119
-    command: ["sleep", "infinity"] # mock placeholder
+    command: ["dotnet", "StellaOps.Orchestrator.WebService.dll"]
     depends_on:
       - mongo
       - nats
@@ -15,7 +15,7 @@ services:
 
   policy-registry:
     image: registry.stella-ops.org/stellaops/policy-registry@sha256:c6cad8055e9827ebcbebb6ad4d6866dce4b83a0a49b0a8a6500b736a5cb26fa7
-    command: ["sleep", "infinity"] # mock placeholder
+    command: ["dotnet", "StellaOps.Policy.Engine.dll"]
     depends_on:
       - mongo
     labels: *release-labels
@@ -23,7 +23,7 @@ services:
 
   vex-lens:
     image: registry.stella-ops.org/stellaops/vex-lens@sha256:b44e63ecfeebc345a70c073c1ce5ace709c58be0ffaad0e2862758aeee3092fb
-    command: ["sleep", "infinity"] # mock placeholder
+    command: ["dotnet", "StellaOps.VexLens.dll"]
     depends_on:
       - mongo
     labels: *release-labels
@@ -31,7 +31,7 @@ services:
 
   issuer-directory:
     image: registry.stella-ops.org/stellaops/issuer-directory@sha256:67e8ef02c97d3156741e857756994888f30c373ace8e84886762edba9dc51914
-    command: ["sleep", "infinity"] # mock placeholder
+    command: ["dotnet", "StellaOps.IssuerDirectory.Web.dll"]
     depends_on:
       - mongo
       - authority
@@ -40,7 +40,7 @@ services:
 
   findings-ledger:
     image: registry.stella-ops.org/stellaops/findings-ledger@sha256:71d4c361ba8b2f8b69d652597bc3f2efc8a64f93fab854ce25272a88506df49c
-    command: ["sleep", "infinity"] # mock placeholder
+    command: ["dotnet", "StellaOps.Findings.Ledger.WebService.dll"]
     depends_on:
       - postgres
       - authority
@@ -49,7 +49,7 @@ services:
 
   vuln-explorer-api:
     image: registry.stella-ops.org/stellaops/vuln-explorer-api@sha256:7fc7e43a05cbeb0106ce7d4d634612e83de6fdc119aaab754a71c1d60b82841d
-    command: ["sleep", "infinity"] # mock placeholder
+    command: ["dotnet", "StellaOps.VulnExplorer.Api.dll"]
     depends_on:
       - findings-ledger
       - authority
@@ -58,7 +58,7 @@ services:
 
   packs-registry:
     image: registry.stella-ops.org/stellaops/packs-registry@sha256:1f5e9416c4dc608594ad6fad87c24d72134427f899c192b494e22b268499c791
-    command: ["sleep", "infinity"] # mock placeholder
+    command: ["dotnet", "StellaOps.PacksRegistry.dll"]
     depends_on:
       - mongo
     labels: *release-labels
@@ -66,7 +66,7 @@ services:
 
   task-runner:
     image: registry.stella-ops.org/stellaops/task-runner@sha256:eb5ad992b49a41554f41516be1a6afcfa6522faf2111c08ff2b3664ad2fc954b
-    command: ["sleep", "infinity"] # mock placeholder
+    command: ["dotnet", "StellaOps.TaskRunner.WebService.dll"]
     depends_on:
       - packs-registry
       - postgres

deploy/compose/scripts/quickstart.sh

@@ -0,0 +1,25 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+COMPOSE_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"
+
+ENV_FILE="${1:-$COMPOSE_DIR/env/dev.env.example}"
+USE_MOCK="${USE_MOCK:-0}"
+
+FILES=(-f "$COMPOSE_DIR/docker-compose.dev.yaml")
+ENV_FILES=(--env-file "$ENV_FILE")
+
+if [[ "$USE_MOCK" == "1" ]]; then
+  FILES+=(-f "$COMPOSE_DIR/docker-compose.mock.yaml")
+  ENV_FILES+=(--env-file "$COMPOSE_DIR/env/mock.env.example")
+fi
+
+echo "Validating compose config..."
+docker compose "${ENV_FILES[@]}" "${FILES[@]}" config > /tmp/compose-validated.yaml
+echo "Config written to /tmp/compose-validated.yaml"
+
+echo "Starting stack..."
+docker compose "${ENV_FILES[@]}" "${FILES[@]}" up -d
+
+echo "Stack started. To stop: docker compose ${ENV_FILES[*]} ${FILES[*]} down"

deploy/helm/stellaops/templates/orchestrator-mock.yaml

@@ -0,0 +1,22 @@
+{{- if .Values.mock.enabled }}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: orchestrator-mock
+  annotations:
+    stellaops.dev/mock: "true"
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: orchestrator-mock
+  template:
+    metadata:
+      labels:
+        app: orchestrator-mock
+    spec:
+      containers:
+        - name: orchestrator
+          image: "{{ .Values.mock.orchestrator.image }}"
+          args: ["dotnet", "StellaOps.Orchestrator.WebService.dll"]
+{{- end }}

deploy/helm/stellaops/templates/packs-mock.yaml

@@ -0,0 +1,44 @@
+{{- if .Values.mock.enabled }}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: packs-registry-mock
+  annotations:
+    stellaops.dev/mock: "true"
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: packs-registry-mock
+  template:
+    metadata:
+      labels:
+        app: packs-registry-mock
+    spec:
+      containers:
+        - name: packs-registry
+          image: "{{ .Values.mock.packsRegistry.image }}"
+          args: ["dotnet", "StellaOps.PacksRegistry.dll"]
+
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: task-runner-mock
+  annotations:
+    stellaops.dev/mock: "true"
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: task-runner-mock
+  template:
+    metadata:
+      labels:
+        app: task-runner-mock
+    spec:
+      containers:
+        - name: task-runner
+          image: "{{ .Values.mock.taskRunner.image }}"
+          args: ["dotnet", "StellaOps.TaskRunner.WebService.dll"]
+{{- end }}

deploy/helm/stellaops/templates/policy-mock.yaml

@@ -0,0 +1,22 @@
+{{- if .Values.mock.enabled }}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: policy-registry-mock
+  annotations:
+    stellaops.dev/mock: "true"
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: policy-registry-mock
+  template:
+    metadata:
+      labels:
+        app: policy-registry-mock
+    spec:
+      containers:
+        - name: policy-registry
+          image: "{{ .Values.mock.policyRegistry.image }}"
+          args: ["dotnet", "StellaOps.Policy.Engine.dll"]
+{{- end }}

deploy/helm/stellaops/templates/vex-mock.yaml

@@ -0,0 +1,22 @@
+{{- if .Values.mock.enabled }}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: vex-lens-mock
+  annotations:
+    stellaops.dev/mock: "true"
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: vex-lens-mock
+  template:
+    metadata:
+      labels:
+        app: vex-lens-mock
+    spec:
+      containers:
+        - name: vex-lens
+          image: "{{ .Values.mock.vexLens.image }}"
+          args: ["dotnet", "StellaOps.VexLens.dll"]
+{{- end }}

deploy/helm/stellaops/templates/vuln-mock.yaml

@@ -0,0 +1,44 @@
+{{- if .Values.mock.enabled }}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: findings-ledger-mock
+  annotations:
+    stellaops.dev/mock: "true"
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: findings-ledger-mock
+  template:
+    metadata:
+      labels:
+        app: findings-ledger-mock
+    spec:
+      containers:
+        - name: findings-ledger
+          image: "{{ .Values.mock.findingsLedger.image }}"
+          args: ["dotnet", "StellaOps.Findings.Ledger.WebService.dll"]
+
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: vuln-explorer-api-mock
+  annotations:
+    stellaops.dev/mock: "true"
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: vuln-explorer-api-mock
+  template:
+    metadata:
+      labels:
+        app: vuln-explorer-api-mock
+    spec:
+      containers:
+        - name: vuln-explorer-api
+          image: "{{ .Values.mock.vulnExplorerApi.image }}"
+          args: ["dotnet", "StellaOps.VulnExplorer.Api.dll"]
+{{- end }}

deploy/helm/stellaops/values-mock.yaml

@@ -0,0 +1,18 @@
+mock:
+  enabled: true
+  orchestrator:
+    image: registry.stella-ops.org/stellaops/orchestrator@sha256:97f12856ce870bafd3328bda86833bcccbf56d255941d804966b5557f6610119
+  policyRegistry:
+    image: registry.stella-ops.org/stellaops/policy-registry@sha256:c6cad8055e9827ebcbebb6ad4d6866dce4b83a0a49b0a8a6500b736a5cb26fa7
+  packsRegistry:
+    image: registry.stella-ops.org/stellaops/packs-registry@sha256:1f5e9416c4dc608594ad6fad87c24d72134427f899c192b494e22b268499c791
+  taskRunner:
+    image: registry.stella-ops.org/stellaops/task-runner@sha256:eb5ad992b49a41554f41516be1a6afcfa6522faf2111c08ff2b3664ad2fc954b
+  vexLens:
+    image: registry.stella-ops.org/stellaops/vex-lens@sha256:b44e63ecfeebc345a70c073c1ce5ace709c58be0ffaad0e2862758aeee3092fb
+  issuerDirectory:
+    image: registry.stella-ops.org/stellaops/issuer-directory@sha256:67e8ef02c97d3156741e857756994888f30c373ace8e84886762edba9dc51914
+  findingsLedger:
+    image: registry.stella-ops.org/stellaops/findings-ledger@sha256:71d4c361ba8b2f8b69d652597bc3f2efc8a64f93fab854ce25272a88506df49c
+  vulnExplorerApi:
+    image: registry.stella-ops.org/stellaops/vuln-explorer-api@sha256:7fc7e43a05cbeb0106ce7d4d634612e83de6fdc119aaab754a71c1d60b82841d

deploy/helm/stellaops/values.yaml

@@ -263,3 +263,22 @@ services:
     volumeClaims:
       - name: advisory-ai-data
         claimName: stellaops-advisory-ai-data
+
+mock:
+  enabled: false
+  orchestrator:
+    image: registry.stella-ops.org/stellaops/orchestrator@sha256:97f12856ce870bafd3328bda86833bcccbf56d255941d804966b5557f6610119
+  policyRegistry:
+    image: registry.stella-ops.org/stellaops/policy-registry@sha256:c6cad8055e9827ebcbebb6ad4d6866dce4b83a0a49b0a8a6500b736a5cb26fa7
+  packsRegistry:
+    image: registry.stella-ops.org/stellaops/packs-registry@sha256:1f5e9416c4dc608594ad6fad87c24d72134427f899c192b494e22b268499c791
+  taskRunner:
+    image: registry.stella-ops.org/stellaops/task-runner@sha256:eb5ad992b49a41554f41516be1a6afcfa6522faf2111c08ff2b3664ad2fc954b
+  vexLens:
+    image: registry.stella-ops.org/stellaops/vex-lens@sha256:b44e63ecfeebc345a70c073c1ce5ace709c58be0ffaad0e2862758aeee3092fb
+  issuerDirectory:
+    image: registry.stella-ops.org/stellaops/issuer-directory@sha256:67e8ef02c97d3156741e857756994888f30c373ace8e84886762edba9dc51914
+  findingsLedger:
+    image: registry.stella-ops.org/stellaops/findings-ledger@sha256:71d4c361ba8b2f8b69d652597bc3f2efc8a64f93fab854ce25272a88506df49c
+  vulnExplorerApi:
+    image: registry.stella-ops.org/stellaops/vuln-explorer-api@sha256:7fc7e43a05cbeb0106ce7d4d634612e83de6fdc119aaab754a71c1d60b82841d