feat(api): Implement Console Export Client and Models

- Added ConsoleExportClient for managing export requests and responses.
- Introduced ConsoleExportRequest and ConsoleExportResponse models.
- Implemented methods for creating and retrieving exports with appropriate headers.

feat(crypto): Add Software SM2/SM3 Cryptography Provider

- Implemented SmSoftCryptoProvider for software-only SM2/SM3 cryptography.
- Added support for signing and verification using SM2 algorithm.
- Included hashing functionality with SM3 algorithm.
- Configured options for loading keys from files and environment gate checks.

test(crypto): Add unit tests for SmSoftCryptoProvider

- Created comprehensive tests for signing, verifying, and hashing functionalities.
- Ensured correct behavior for key management and error handling.

feat(api): Enhance Console Export Models

- Expanded ConsoleExport models to include detailed status and event types.
- Added support for various export formats and notification options.

test(time): Implement TimeAnchorPolicyService tests

- Developed tests for TimeAnchorPolicyService to validate time anchors.
- Covered scenarios for anchor validation, drift calculation, and policy enforcement.

docs/api/signals/reachability-contract.md

@@ -1,15 +1,66 @@
 # Signals Reachability API Contract (draft placeholder)
 
-**Status:** TODO · awaiting Signals Guild
+**Status:** Draft v0.2 · owner-proposed
 
 ## Scope
 - `/signals/callgraphs`, `/signals/facts`, reachability scoring overlays feeding UI/Web.
 - Deterministic fixtures for SIG-26 chain (columns/badges, call paths, timelines, overlays, coverage).
 
-## Needed from owners
-- OpenAPI/JSON schema for callgraphs and facts (request/response, pagination, ETags).
-- Reachability score model, states, and filtering parameters.
-- Fixture bundle (JSON/NDJSON) with checksums and performance budgets (target FPS/node caps).
+## Endpoints
+- `GET /signals/callgraphs` — returns call paths contributing to reachability.
+- `GET /signals/facts` — returns reachability/coverage facts.
 
-## TODO
-- Replace with ratified contract and fixtures; record schema hash/date; link from Web V and UI III logs.
+Common headers: `Authorization: DPoP <token>`, `DPoP: <proof>`, `X-StellaOps-Tenant`, optional `If-None-Match`.
+Pagination: cursor via `pageToken`; default 50, max 200.
+ETag: required on responses; clients must send `If-None-Match` for cache validation.
+
+### Callgraphs response (draft)
+```jsonc
+{
+  "tenantId": "tenant-default",
+  "assetId": "registry.local/library/app@sha256:abc123",
+  "paths": [
+    {
+      "id": "path-1",
+      "source": "api-gateway",
+      "target": "jwt-auth-service",
+      "hops": [
+        { "service": "api-gateway", "endpoint": "/login", "timestamp": "2025-12-05T10:00:00Z" },
+        { "service": "jwt-auth-service", "endpoint": "/verify", "timestamp": "2025-12-05T10:00:01Z" }
+      ],
+      "evidence": { "traceId": "trace-abc", "spanCount": 2, "score": 0.92 }
+    }
+  ],
+  "pagination": { "nextPageToken": null },
+  "etag": "sig-callgraphs-etag"
+}
+```
+
+### Facts response (draft)
+```jsonc
+{
+  "tenantId": "tenant-default",
+  "facts": [
+    {
+      "id": "fact-1",
+      "type": "reachability",
+      "assetId": "registry.local/library/app@sha256:abc123",
+      "component": "pkg:npm/jsonwebtoken@9.0.2",
+      "status": "reachable",
+      "confidence": 0.88,
+      "observedAt": "2025-12-05T10:10:00Z",
+      "signalsVersion": "signals-2025.310.1"
+    }
+  ],
+  "pagination": { "nextPageToken": "..." },
+  "etag": "sig-facts-etag"
+}
+```
+
+### Samples
+- Callgraphs: `docs/api/signals/samples/callgraph-sample.json`
+- Facts: `docs/api/signals/samples/facts-sample.json`
+
+### Outstanding
+- Finalize score model, accepted `type` values, and max page size.
+- Provide OpenAPI/JSON schema and error codes.

docs/api/signals/samples/callgraph-sample.json

@@ -0,0 +1,23 @@
+{
+  "tenantId": "tenant-default",
+  "assetId": "registry.local/library/app@sha256:abc123",
+  "paths": [
+    {
+      "id": "path-1",
+      "source": "api-gateway",
+      "target": "jwt-auth-service",
+      "hops": [
+        { "service": "api-gateway", "endpoint": "/login", "timestamp": "2025-12-05T10:00:00Z" },
+        { "service": "jwt-auth-service", "endpoint": "/verify", "timestamp": "2025-12-05T10:00:01Z" }
+      ],
+      "evidence": {
+        "traceId": "trace-abc",
+        "spanCount": 2,
+        "score": 0.92
+      }
+    }
+  ],
+  "pagination": {
+    "nextPageToken": null
+  }
+}

docs/api/signals/samples/facts-sample.json

@@ -0,0 +1,26 @@
+{
+  "tenantId": "tenant-default",
+  "facts": [
+    {
+      "id": "fact-1",
+      "type": "reachability",
+      "assetId": "registry.local/library/app@sha256:abc123",
+      "component": "pkg:npm/jsonwebtoken@9.0.2",
+      "status": "reachable",
+      "confidence": 0.88,
+      "observedAt": "2025-12-05T10:10:00Z",
+      "signalsVersion": "signals-2025.310.1"
+    },
+    {
+      "id": "fact-2",
+      "type": "coverage",
+      "assetId": "registry.local/library/app@sha256:abc123",
+      "metric": "sensors_present",
+      "value": 0.94,
+      "observedAt": "2025-12-05T10:11:00Z"
+    }
+  ],
+  "pagination": {
+    "nextPageToken": "eyJmYWN0SWQiOiJmYWN0LTIifQ"
+  }
+}