feat(api): Implement Console Export Client and Models

- Added ConsoleExportClient for managing export requests and responses.
- Introduced ConsoleExportRequest and ConsoleExportResponse models.
- Implemented methods for creating and retrieving exports with appropriate headers.

feat(crypto): Add Software SM2/SM3 Cryptography Provider

- Implemented SmSoftCryptoProvider for software-only SM2/SM3 cryptography.
- Added support for signing and verification using SM2 algorithm.
- Included hashing functionality with SM3 algorithm.
- Configured options for loading keys from files and environment gate checks.

test(crypto): Add unit tests for SmSoftCryptoProvider

- Created comprehensive tests for signing, verifying, and hashing functionalities.
- Ensured correct behavior for key management and error handling.

feat(api): Enhance Console Export Models

- Expanded ConsoleExport models to include detailed status and event types.
- Added support for various export formats and notification options.

test(time): Implement TimeAnchorPolicyService tests

- Developed tests for TimeAnchorPolicyService to validate time anchors.
- Covered scenarios for anchor validation, drift calculation, and policy enforcement.

docs/api/graph/overlay-schema.md

@@ -1,16 +1,42 @@
 # Graph Overlay & Cache Schema (draft placeholder)
 
-**Status:** TODO · awaiting Graph Platform Guild ratification
+**Status:** Draft v0.2 · owner-proposed
 
 ## Scope
 - Overlay/cache schema for graph tiles used by Web gateway and UI overlays.
 - Validation rules for bbox/zoom/path; pagination tokens; deterministic ordering.
 - Error codes and sampling/telemetry fields.
 
-## Needed from owners
-- JSON schema (or OpenAPI fragment) for overlay response and cache metadata.
-- Allowed zoom levels/coordinate system; max nodes/edges per tile; hashing/etag rules.
-- Sample overlay bundle (happy path + rate-limit + validation error).
+## Schema (draft)
+```jsonc
+{
+  "version": "2025-12-06",
+  "tenantId": "tenant-default",
+  "tile": {
+    "id": "graph-tile::asset::<hash>::z8/x12/y5",
+    "bbox": { "minX": -122.41, "minY": 37.77, "maxX": -122.38, "maxY": 37.79 },
+    "zoom": 8,
+    "etag": "c0ffee-etag"
+  },
+  "nodes": [ { "id": "asset:...", "kind": "asset|component|vuln", "label": "", "severity": "high|medium|low|info", "reachability": "reachable|unreachable|unknown", "attributes": {} } ],
+  "edges": [ { "id": "edge-1", "source": "nodeId", "target": "nodeId", "type": "depends_on|contains|evidence", "weight": 0.0 } ],
+  "overlays": {
+    "policy": [ { "nodeId": "nodeId", "badge": "pass|warn|fail|waived", "policyId": "", "verdictAt": "2025-12-05T09:00:00Z" } ],
+    "vex": [ { "nodeId": "nodeId", "state": "not_affected|fixed|under_investigation|affected", "statementId": "", "lastUpdated": "2025-12-05T09:10:00Z" } ],
+    "aoc": [ { "nodeId": "nodeId", "status": "pass|fail|warn", "lastVerified": "2025-12-05T10:11:12Z" } ]
+  },
+  "telemetry": { "generationMs": 0, "cache": "hit|miss", "samples": 0 }
+}
+```
 
-## TODO
-- Insert ratified schema + samples; note schema hash/date; link from Web II sprint log.
+## Constraints (proposal)
+- Max nodes per tile: 2,000; max edges: 4,000.
+- Zoom range: 0–12; tiles must include bbox and etag.
+- Arrays must be pre-sorted: nodes by `id`, edges by `id`, overlays by `nodeId` then `policyId|statementId`.
+
+## Samples
+- `docs/api/graph/samples/overlay-sample.json`
+
+## Outstanding
+- Confirm max sizes, allowed edge types, and etag hashing rule.
+- Provide validation error example and rate-limit headers for gateway responses.

docs/api/graph/samples/overlay-sample.json

@@ -0,0 +1,75 @@
+{
+  "version": "2025-12-06",
+  "tenantId": "tenant-default",
+  "tile": {
+    "id": "graph-tile::asset::sha256:abc123::z8/x12/y5",
+    "bbox": {
+      "minX": -122.41,
+      "minY": 37.77,
+      "maxX": -122.38,
+      "maxY": 37.79
+    },
+    "zoom": 8,
+    "etag": "c0ffee-overlay-etag"
+  },
+  "nodes": [
+    {
+      "id": "asset:registry.local/library/app@sha256:abc123",
+      "kind": "asset",
+      "label": "app:1.2.3",
+      "severity": "high",
+      "reachability": "reachable",
+      "aoc": { "summary": "pass", "lastVerified": "2025-12-05T10:11:12Z" },
+      "attributes": {
+        "purl": "pkg:docker/app@sha256:abc123",
+        "componentCount": 42
+      }
+    },
+    {
+      "id": "component:pkg:npm/jsonwebtoken@9.0.2",
+      "kind": "component",
+      "label": "jsonwebtoken@9.0.2",
+      "severity": "high",
+      "reachability": "reachable"
+    }
+  ],
+  "edges": [
+    {
+      "id": "edge-1",
+      "source": "asset:registry.local/library/app@sha256:abc123",
+      "target": "component:pkg:npm/jsonwebtoken@9.0.2",
+      "type": "depends_on",
+      "weight": 0.87
+    }
+  ],
+  "overlays": {
+    "policy": [
+      {
+        "nodeId": "component:pkg:npm/jsonwebtoken@9.0.2",
+        "badge": "fail",
+        "policyId": "policy://tenant-default/runtime-hardening",
+        "verdictAt": "2025-12-05T09:00:00Z"
+      }
+    ],
+    "vex": [
+      {
+        "nodeId": "component:pkg:npm/jsonwebtoken@9.0.2",
+        "state": "under_investigation",
+        "statementId": "vex:tenant-default:jwt:2025-12-05",
+        "lastUpdated": "2025-12-05T09:10:00Z"
+      }
+    ],
+    "aoc": [
+      {
+        "nodeId": "asset:registry.local/library/app@sha256:abc123",
+        "status": "pass",
+        "lastVerified": "2025-12-05T10:11:12Z"
+      }
+    ]
+  },
+  "telemetry": {
+    "generationMs": 120,
+    "cache": "hit",
+    "samples": 3
+  }
+}