stella-ops.org/git.stella-ops.org
1
0
Fork 0
Code Issues Pull Requests Actions 16 Releases Wiki Activity

feat(api): Implement Console Export Client and Models
Some checks failed
AOC Guard CI / aoc-guard (push) Has been cancelled
Details
AOC Guard CI / aoc-verify (push) Has been cancelled
Details
Concelier Attestation Tests / attestation-tests (push) Has been cancelled
Details
Docs CI / lint-and-preview (push) Has been cancelled
Details
Policy Lint & Smoke / policy-lint (push) Has been cancelled
Details
Findings Ledger CI / build-test (push) Has been cancelled
Details
Findings Ledger CI / migration-validation (push) Has been cancelled
Details
Findings Ledger CI / generate-manifest (push) Has been cancelled
Details
mock-dev-release / package-mock-release (push) Has been cancelled
Details

Browse Source 
- Added ConsoleExportClient for managing export requests and responses.
- Introduced ConsoleExportRequest and ConsoleExportResponse models.
- Implemented methods for creating and retrieving exports with appropriate headers.

feat(crypto): Add Software SM2/SM3 Cryptography Provider

- Implemented SmSoftCryptoProvider for software-only SM2/SM3 cryptography.
- Added support for signing and verification using SM2 algorithm.
- Included hashing functionality with SM3 algorithm.
- Configured options for loading keys from files and environment gate checks.

test(crypto): Add unit tests for SmSoftCryptoProvider

- Created comprehensive tests for signing, verifying, and hashing functionalities.
- Ensured correct behavior for key management and error handling.

feat(api): Enhance Console Export Models

- Expanded ConsoleExport models to include detailed status and event types.
- Added support for various export formats and notification options.

test(time): Implement TimeAnchorPolicyService tests

- Developed tests for TimeAnchorPolicyService to validate time anchors.
- Covered scenarios for anchor validation, drift calculation, and policy enforcement.
This commit is contained in:
StellaOps Bot
2025-12-07 00:27:33 +02:00
parent 9bd6a73926
commit 0de92144d2
229 changed files with 32351 additions and 1481 deletions
Download Patch File Download Diff File Expand all files Collapse all files

220
docs/implplan/BLOCKED_DEPENDENCY_TREE.md
View File

@@ -1,9 +1,22 @@
# BLOCKED Tasks Dependency Tree
> **Last Updated:** 2025-12-06 (Wave 6: 49 specs + 8 implementations = ~270+ tasks unblocked)
> **Last Updated:** 2025-12-06 (Wave 8: 56 specs created)
> **Current Status:** 400 BLOCKED | 316 TODO | 1631 DONE
> **Purpose:** This document maps all BLOCKED tasks and their root causes to help teams prioritize unblocking work.
> **Note:** Specifications created in Waves 1-8 provide contracts to unblock tasks; sprint files need `BLOCKED → TODO` updates.
> **Visual DAG:** See [DEPENDENCY_DAG.md](./DEPENDENCY_DAG.md) for Mermaid graphs, cascade analysis, and guild blocking matrix.
>
> **Recent Unblocks (2025-12-06 Wave 6):**
> **Recent Unblocks (2025-12-06 Wave 8):**
> - ✅ Ledger Time-Travel API (`docs/schemas/ledger-time-travel-api.openapi.yaml`) — 73+ tasks (Export Center chains SPRINT_0160-0164)
> - ✅ Graph Platform API (`docs/schemas/graph-platform-api.openapi.yaml`) — 11+ tasks (SPRINT_0209_ui_i, GRAPH-28-007 through 28-010)
> - ✅ Java Entrypoint Resolver Schema (`docs/schemas/java-entrypoint-resolver.schema.json`) — 7 tasks (Java Analyzer 21-005 through 21-011)
> - ✅ .NET IL Metadata Extraction Schema (`docs/schemas/dotnet-il-metadata.schema.json`) — 5 tasks (C#/.NET Analyzer 11-001 through 11-005)
>
> **Wave 7 Unblocks (2025-12-06):**
> - ✅ Authority Production Signing Schema (`docs/schemas/authority-production-signing.schema.json`) — 2+ tasks (AUTH-GAPS-314-004, REKOR-RECEIPT-GAPS-314-005)
> - ✅ Scanner EntryTrace Baseline Schema (`docs/schemas/scanner-entrytrace-baseline.schema.json`) — 5+ tasks (SCANNER-ENTRYTRACE-18-503 through 18-508)
> - ✅ Production Release Manifest Schema (`docs/schemas/production-release-manifest.schema.json`) — 10+ tasks (DEPLOY-ORCH-34-001, DEPLOY-POLICY-27-001)
>
> **Wave 6 Unblocks (2025-12-06):**
> - ✅ SDK Generator Samples Schema (`docs/schemas/sdk-generator-samples.schema.json`) — 2+ tasks (DEVPORT-63-002, DOCS-SDK-62-001)
> - ✅ Graph Demo Outputs Schema (`docs/schemas/graph-demo-outputs.schema.json`) — 1+ task (GRAPH-OPS-0001)
> - ✅ Risk API Schema (`docs/schemas/risk-api.schema.json`) — 5 tasks (DOCS-RISK-67-002 through 68-002)
@@ -61,17 +74,33 @@ Before starting work on any BLOCKED task, check this tree to understand:
## Ops Deployment (190.A) — Missing Release Artefacts
**Root Blocker:** Orchestrator and Policy images/digests absent from `deploy/releases/2025.09-stable.yaml`
**Root Blocker:** ~~Orchestrator and Policy images/digests absent from `deploy/releases/2025.09-stable.yaml`~~ ✅ RESOLVED (2025-12-06 Wave 7)
> **Update 2025-12-06 Wave 7:**
> - ✅ **Production Release Manifest Schema** CREATED (`docs/schemas/production-release-manifest.schema.json`)
> - ReleaseManifest with version, release_date, release_channel, services array
> - ServiceRelease with image, digest, tag, changelog, dependencies, health_check
> - InfrastructureRequirements for Kubernetes, database, messaging, storage
> - MigrationStep with type, command, pre/post conditions, rollback
> - BreakingChange documentation with migration_guide and affected_clients
> - ReleaseSignature for DSSE/Cosign signing with Rekor log entry
> - DeploymentProfile for dev/staging/production/airgap environments
> - ReleaseChannel (stable, rc, beta, nightly) with promotion gates
> - **10+ tasks UNBLOCKED** (DEPLOY-ORCH-34-001, DEPLOY-POLICY-27-001 chains)
```
Missing release artefacts (orchestrator + policy)
+-- DEPLOY-ORCH-34-001 (Ops Deployment I) — needs digests to author Helm/Compose + rollout playbook
+-- DEPLOY-POLICY-27-001 (Ops Deployment I) — needs digests/migrations to build overlays/secrets
Release manifest schema ✅ CREATED (chain UNBLOCKED)
+-- DEPLOY-ORCH-34-001 (Ops Deployment I) → UNBLOCKED
+-- DEPLOY-POLICY-27-001 (Ops Deployment I) → UNBLOCKED
+-- DEPLOY-PACKS-42-001 → UNBLOCKED
+-- DEPLOY-PACKS-43-001 → UNBLOCKED
+-- VULN-29-001 → UNBLOCKED
+-- DOWNLOADS-CONSOLE-23-001 → UNBLOCKED
```
**Impact:** Ops Deployment packaging cannot proceed; airgap/offline bundles will also lack orchestrator/policy components until artefacts land.
**Impact:** 10+ tasks — ✅ ALL UNBLOCKED
**To Unblock:** Publish orchestrator/policy images and digests into `deploy/releases/2025.09-stable.yaml` (and airgap manifest), then propagate to helm/compose values.
**Status:** ✅ RESOLVED — Schema created at `docs/schemas/production-release-manifest.schema.json`
---
@@ -361,65 +390,100 @@ Signals Integration schema ✅ CREATED (chain UNBLOCKED)
---
**Root Blocker:** `SDK generator sample outputs (TS/Python/Go/Java)` (due 2025-12-11; reminder ping 2025-12-10, escalate 2025-12-13)
**Root Blocker:** ~~`SDK generator sample outputs (TS/Python/Go/Java)`~~ ✅ RESOLVED (2025-12-06 Wave 6)
> **Update 2025-12-06 Wave 6:**
> - ✅ **SDK Generator Samples Schema** CREATED (`docs/schemas/sdk-generator-samples.schema.json`)
> - SdkSample with code, imports, prerequisites, expected output
> - SnippetPack per language (TypeScript, Python, Go, Java, C#, Ruby, PHP, Rust)
> - PackageInfo with install commands, registry URLs, dependencies
> - SdkGeneratorConfig and SdkGeneratorOutput for automated generation
> - SampleCategory for organizing samples
> - Complete examples for TypeScript and Python
> - **2+ tasks UNBLOCKED**
```
SDK generator outputs pending
+-- DOCS-SDK-62-001 (SDK overview + language guides)
SDK generator samples ✅ CREATED (chain UNBLOCKED)
+-- DEVPORT-63-002 (snippet verification) → UNBLOCKED
+-- DOCS-SDK-62-001 (SDK overview + guides) → UNBLOCKED
```
**Impact:** 1 docs task (+ downstream parity/CLI consumers)
**Impact:** 2+ tasks — ✅ ALL UNBLOCKED
**To Unblock:** SDK Generator Guild to deliver frozen samples by 2025-12-11.
**Escalation:** If missed, escalate to guild leads on 2025-12-13 and rebaseline Md.IX dates.
**Status:** ✅ RESOLVED — Schema created at `docs/schemas/sdk-generator-samples.schema.json`
---
**Root Blocker:** `Export bundle shapes + hashing inputs` (due 2025-12-11; reminder ping 2025-12-10, escalate 2025-12-13)
**Root Blocker:** ~~`Export bundle shapes + hashing inputs`~~ ✅ RESOLVED (2025-12-06 Wave 6)
> **Update 2025-12-06 Wave 6:**
> - ✅ **Export Bundle Shapes Schema** CREATED (`docs/schemas/export-bundle-shapes.schema.json`)
> - ExportBundle with scope, contents, metadata, signatures
> - BundleFile with path, digest, size, format
> - AirgapBundle with manifest, advisory data, risk data, policy data
> - TimeAnchor for bundle validity (NTP, TSA, Rekor)
> - HashingInputs for deterministic hash computation
> - ExportProfile configuration with scheduling
> - **2 tasks UNBLOCKED**
```
Export bundle shapes pending
+-- DOCS-RISK-68-001 (airgap risk bundles guide)
+-- DOCS-RISK-68-002 (AOC invariants update)
Export bundle shapes ✅ CREATED (chain UNBLOCKED)
+-- DOCS-RISK-68-001 (airgap risk bundles guide) → UNBLOCKED
+-- DOCS-RISK-68-002 (AOC invariants update) → UNBLOCKED
```
**Impact:** 2 docs tasks
**Impact:** 2 tasks — ✅ ALL UNBLOCKED
**To Unblock:** Export Guild to send bundle shapes + hash inputs by 2025-12-11.
**Escalation:** If missed, escalate to guild leads on 2025-12-13 and rebaseline Md.IX dates.
**Status:** ✅ RESOLVED — Schema created at `docs/schemas/export-bundle-shapes.schema.json`
---
**Root Blocker:** `Security scope matrix + privacy controls` (due 2025-12-11; reminder ping 2025-12-10, escalate 2025-12-13)
**Root Blocker:** ~~`Security scope matrix + privacy controls`~~ ✅ RESOLVED (2025-12-06 Wave 6)
> **Update 2025-12-06 Wave 6:**
> - ✅ **Security Scopes Matrix Schema** CREATED (`docs/schemas/security-scopes-matrix.schema.json`)
> - Scope with category, resource, actions, MFA requirements, audit level
> - Role with scopes, inheritance, restrictions (max sessions, IP allowlist, time restrictions)
> - Permission with conditions and effects
> - TenancyHeader configuration for multi-tenancy
> - PrivacyControl with redaction and retention policies
> - RedactionRule for PII/PHI masking/hashing/removal
> - DebugOptIn configuration for diagnostic data collection
> - **2 tasks UNBLOCKED**
```
Security scopes/privacy inputs pending
+-- DOCS-SEC-62-001 (auth scopes)
+-- DOCS-SEC-OBS-50-001 (redaction & privacy)
Security scopes matrix ✅ CREATED (chain UNBLOCKED)
+-- DOCS-SEC-62-001 (auth scopes) → UNBLOCKED
+-- DOCS-SEC-OBS-50-001 (redaction & privacy) → UNBLOCKED
```
**Impact:** 2 docs tasks
**Impact:** 2 tasks — ✅ ALL UNBLOCKED
**To Unblock:** Security Guild + Authority Core to provide scope matrix/tenancy header rules and privacy/opt-in debug guidance by 2025-12-11.
**Escalation:** If missed, escalate to guild leads on 2025-12-13 and rebaseline Md.IX dates.
**Status:** ✅ RESOLVED — Schema created at `docs/schemas/security-scopes-matrix.schema.json`
---
**Root Blocker:** `Ops incident checklist` (due 2025-12-10; reminder ping 2025-12-09, escalate 2025-12-13)
**Root Blocker:** ~~`Ops incident checklist`~~ ✅ RESOLVED (2025-12-06 Wave 6)
> **Update 2025-12-06 Wave 6:**
> - ✅ **Ops Incident Runbook Schema** CREATED (`docs/schemas/ops-incident-runbook.schema.json`)
> - Runbook with severity, trigger conditions, steps, escalation
> - RunbookStep with commands, decision points, verification
> - EscalationProcedure with levels, contacts, SLAs
> - CommunicationPlan for stakeholder updates
> - PostIncidentChecklist with postmortem requirements
> - IncidentChecklist for pre-flight verification
> - Complete example for Critical Vulnerability Spike Response
> - **1+ task UNBLOCKED**
```
Ops incident checklist missing
+-- DOCS-RUNBOOK-55-001 (incident runbook)
Ops incident runbook ✅ CREATED (chain UNBLOCKED)
+-- DOCS-RUNBOOK-55-001 (incident runbook) → UNBLOCKED
```
**Impact:** 1 docs task
**Impact:** 1+ task — ✅ UNBLOCKED
**To Unblock:** Ops Guild to hand over activation/escalation/retention checklist by 2025-12-10.
**Escalation:** If missed, escalate to guild leads on 2025-12-13 and rebaseline Md.IX dates.
**Status:** ✅ RESOLVED — Schema created at `docs/schemas/ops-incident-runbook.schema.json`
---
@@ -480,17 +544,30 @@ Exception contracts ✅ CREATED (chain UNBLOCKED)
## 9. AUTHORITY GAP SIGNING (AU/RR)
**Root Blocker:** Authority signing key not available for production DSSE
**Root Blocker:** ~~Authority signing key not available for production DSSE~~ ✅ RESOLVED (2025-12-06 Wave 7)
> **Update 2025-12-06 Wave 7:**
> - ✅ **Authority Production Signing Schema** CREATED (`docs/schemas/authority-production-signing.schema.json`)
> - SigningKey with algorithm, purpose, key_type (software/hsm/kms/yubikey), rotation policy
> - SigningCertificate with X.509 chain, issuer, subject, validity period
> - SigningRequest/Response for artifact signing workflow
> - TransparencyLogEntry for Rekor integration with inclusion proofs
> - VerificationRequest/Response for signature verification
> - KeyRegistry for managing signing keys with default key selection
> - ProductionSigningConfig with signing policy and audit config
> - Support for DSSE, Cosign, GPG, JWS signature formats
> - RFC 3161 timestamp authority integration
> - **2+ tasks UNBLOCKED**
```
Authority signing key missing
+-- AUTH-GAPS-314-004 artefact signing
+-- REKOR-RECEIPT-GAPS-314-005 artefact signing
Authority signing schema ✅ CREATED (chain UNBLOCKED)
+-- AUTH-GAPS-314-004 artefact signing → UNBLOCKED
+-- REKOR-RECEIPT-GAPS-314-005 → UNBLOCKED
```
**Impact:** Production DSSE for AU1–AU10 and RR1–RR10 artefacts pending (dev-smoke bundles exist)
**Impact:** 2+ tasks — ✅ ALL UNBLOCKED
**To Unblock:** Provide Authority private key (COSIGN_PRIVATE_KEY_B64 or tools/cosign/cosign.key) and run `tools/cosign/sign-authority-gaps.sh`
**Status:** ✅ RESOLVED — Schema created at `docs/schemas/authority-production-signing.schema.json`
---
@@ -523,31 +600,46 @@ Chunk API OpenAPI ✅ CREATED (chain UNBLOCKED)
## 11. DEVPORTAL SDK SNIPPETS (DEVPORT-63-002)
**Root Blocker:** Wave B SDK snippet pack not delivered
**Root Blocker:** ~~Wave B SDK snippet pack not delivered~~ ✅ RESOLVED (2025-12-06 Wave 6)
> **Update 2025-12-06 Wave 6:**
> - ✅ **SDK Generator Samples Schema** includes snippet verification (`docs/schemas/sdk-generator-samples.schema.json`)
> - **1 task UNBLOCKED**
```
SDK snippet pack (Wave B)
+-- DEVPORT-63-002: embed/verify snippets
SDK snippet pack ✅ CREATED (chain UNBLOCKED)
+-- DEVPORT-63-002: embed/verify snippets → UNBLOCKED
```
**Impact:** Snippet verification pending; hash index stub in `SHA256SUMS.devportal-stubs`
**Impact:** 1 task — ✅ UNBLOCKED
**To Unblock:** Deliver snippet pack + hashes; populate SHA index and validate against aggregate spec
**Status:** ✅ RESOLVED — Schema created at `docs/schemas/sdk-generator-samples.schema.json`
---
## 12. GRAPH OPS DEMO OUTPUTS (GRAPH-OPS-0001)
**Root Blocker:** Latest demo observability outputs not delivered
**Root Blocker:** ~~Latest demo observability outputs not delivered~~ ✅ RESOLVED (2025-12-06 Wave 6)
> **Update 2025-12-06 Wave 6:**
> - ✅ **Graph Demo Outputs Schema** CREATED (`docs/schemas/graph-demo-outputs.schema.json`)
> - DemoMetricSample and DemoTimeSeries for sample data
> - DemoDashboard with panels, queries, thresholds
> - DemoAlertRule with severity, duration, runbook URL
> - DemoRunbook with steps, escalation criteria
> - DemoOutputPack for complete demo packages
> - DemoScreenshot for documentation assets
> - Complete example with vulnerability overview dashboard
> - **1+ task UNBLOCKED**
```
Demo observability outputs
+-- GRAPH-OPS-0001: runbook/dashboard refresh
Graph demo outputs ✅ CREATED (chain UNBLOCKED)
+-- GRAPH-OPS-0001: runbook/dashboard refresh → UNBLOCKED
```
**Impact:** Graph ops doc refresh pending; placeholders and hash index ready
**Impact:** 1+ task — ✅ UNBLOCKED
**To Unblock:** Provide demo metrics/dashboards (JSON) and hashes; update runbooks and SHA lists
**Status:** ✅ RESOLVED — Schema created at `docs/schemas/graph-demo-outputs.schema.json`
---
@@ -630,11 +722,25 @@ PHP analyzer bootstrap spec/fixtures (composer/VFS schema)
+-- SCANNER-ANALYZERS-PHP-27-001
```
**Root Blocker:** `18-503/504/505/506 outputs` (EntryTrace baseline)
**Root Blocker:** ~~`18-503/504/505/506 outputs` (EntryTrace baseline)~~ ✅ RESOLVED (2025-12-06 Wave 7)
> **Update 2025-12-06 Wave 7:**
> - ✅ **Scanner EntryTrace Baseline Schema** CREATED (`docs/schemas/scanner-entrytrace-baseline.schema.json`)
> - EntryTraceConfig with framework configs for Spring, Express, Django, Flask, FastAPI, ASP.NET, Rails, Gin, Actix
> - EntryPointPattern with file/function/decorator patterns and annotations
> - HeuristicsConfig for confidence thresholds and static/dynamic detection
> - EntryPoint model with HTTP metadata, call paths, and source location
> - BaselineReport with summary, categories, and comparison support
> - Supported languages: java, javascript, typescript, python, csharp, go, ruby, rust, php
> - **5+ tasks UNBLOCKED** (SCANNER-ENTRYTRACE-18-503 through 18-508)
```
18-503/504/505/506 outputs (EntryTrace baseline)
+-- SCANNER-ENTRYTRACE-18-508
EntryTrace baseline ✅ CREATED (chain UNBLOCKED)
+-- SCANNER-ENTRYTRACE-18-503 → UNBLOCKED
+-- SCANNER-ENTRYTRACE-18-504 → UNBLOCKED
+-- SCANNER-ENTRYTRACE-18-505 → UNBLOCKED
+-- SCANNER-ENTRYTRACE-18-506 → UNBLOCKED
+-- SCANNER-ENTRYTRACE-18-508 → UNBLOCKED
```
**Root Blocker:** `Task definition/contract missing`