feat(api): Implement Console Export Client and Models

- Added ConsoleExportClient for managing export requests and responses.
- Introduced ConsoleExportRequest and ConsoleExportResponse models.
- Implemented methods for creating and retrieving exports with appropriate headers.

feat(crypto): Add Software SM2/SM3 Cryptography Provider

- Implemented SmSoftCryptoProvider for software-only SM2/SM3 cryptography.
- Added support for signing and verification using SM2 algorithm.
- Included hashing functionality with SM3 algorithm.
- Configured options for loading keys from files and environment gate checks.

test(crypto): Add unit tests for SmSoftCryptoProvider

- Created comprehensive tests for signing, verifying, and hashing functionalities.
- Ensured correct behavior for key management and error handling.

feat(api): Enhance Console Export Models

- Expanded ConsoleExport models to include detailed status and event types.
- Added support for various export formats and notification options.

test(time): Implement TimeAnchorPolicyService tests

- Developed tests for TimeAnchorPolicyService to validate time anchors.
- Covered scenarios for anchor validation, drift calculation, and policy enforcement.

src/Policy/StellaOps.Policy.Engine/Program.cs

@@ -15,15 +15,18 @@ using StellaOps.Policy.Engine.BatchEvaluation;
 using StellaOps.Policy.Engine.DependencyInjection;
 using StellaOps.PolicyDsl;
 using StellaOps.Policy.Engine.Services;
-using StellaOps.Policy.Engine.Workers;
-using StellaOps.Policy.Engine.Streaming;
-using StellaOps.Policy.Engine.Telemetry;
-using StellaOps.Policy.Engine.ConsoleSurface;
-using StellaOps.AirGap.Policy;
-using StellaOps.Policy.Engine.Orchestration;
-using StellaOps.Policy.Engine.ReachabilityFacts;
-using StellaOps.Policy.Engine.Storage.InMemory;
-using StellaOps.Policy.Engine.Storage.Mongo.Repositories;
+using StellaOps.Policy.Engine.Workers;
+using StellaOps.Policy.Engine.Streaming;
+using StellaOps.Policy.Engine.Telemetry;
+using StellaOps.Policy.Engine.ConsoleSurface;
+using StellaOps.AirGap.Policy;
+using StellaOps.Policy.Engine.Orchestration;
+using StellaOps.Policy.Engine.ReachabilityFacts;
+using StellaOps.Policy.Engine.Storage.InMemory;
+using StellaOps.Policy.Engine.Storage.Mongo.Repositories;
+using StellaOps.Policy.Scoring.Engine;
+using StellaOps.Policy.Scoring.Receipts;
+using StellaOps.Policy.Storage.Postgres;
 
 var builder = WebApplication.CreateBuilder(args);
 
@@ -92,9 +95,16 @@ var bootstrap = StellaOpsConfigurationBootstrapper.Build<PolicyEngineOptions>(op
 
 builder.Configuration.AddConfiguration(bootstrap.Configuration);
 
-builder.ConfigurePolicyEngineTelemetry(bootstrap.Options);
-
-builder.Services.AddAirGapEgressPolicy(builder.Configuration, sectionName: "AirGap");
+builder.ConfigurePolicyEngineTelemetry(bootstrap.Options);
+
+builder.Services.AddAirGapEgressPolicy(builder.Configuration, sectionName: "AirGap");
+
+// CVSS receipts rely on PostgreSQL storage for deterministic persistence.
+builder.Services.AddPolicyPostgresStorage(builder.Configuration, sectionName: "Postgres:Policy");
+
+builder.Services.AddSingleton<ICvssV4Engine, CvssV4Engine>();
+builder.Services.AddScoped<IReceiptBuilder, ReceiptBuilder>();
+builder.Services.AddScoped<IReceiptHistoryService, ReceiptHistoryService>();
 
 builder.Services.AddOptions<PolicyEngineOptions>()
     .Bind(builder.Configuration.GetSection(PolicyEngineOptions.SectionName))
@@ -314,29 +324,30 @@ app.MapAdvisoryAiKnobs();
 app.MapBatchContext();
 app.MapOrchestratorJobs();
 app.MapPolicyWorker();
-app.MapLedgerExport();
-app.MapConsoleExportJobs();    // CONTRACT-EXPORT-BUNDLE-009
-app.MapPolicyPackBundles();    // CONTRACT-MIRROR-BUNDLE-003
-app.MapSealedMode();           // CONTRACT-SEALED-MODE-004
-app.MapStalenessSignaling();   // CONTRACT-SEALED-MODE-004 staleness
-app.MapAirGapNotifications();  // Air-gap notifications
-app.MapPolicyLint();           // POLICY-AOC-19-001 determinism linting
-app.MapVerificationPolicies(); // CONTRACT-VERIFICATION-POLICY-006 attestation policies
-app.MapVerificationPolicyEditor(); // CONTRACT-VERIFICATION-POLICY-006 editor DTOs/validation
-app.MapAttestationReports();       // CONTRACT-VERIFICATION-POLICY-006 attestation reports
-app.MapConsoleAttestationReports(); // CONTRACT-VERIFICATION-POLICY-006 Console integration
-app.MapSnapshots();
-app.MapViolations();
-app.MapPolicyDecisions();
-app.MapRiskProfiles();
-app.MapRiskProfileSchema();
-app.MapScopeAttachments();
-app.MapEffectivePolicies();  // CONTRACT-AUTHORITY-EFFECTIVE-WRITE-008
-app.MapRiskSimulation();
-app.MapOverrides();
-app.MapProfileExport();
-app.MapRiskProfileAirGap();  // CONTRACT-MIRROR-BUNDLE-003 risk profile air-gap
-app.MapProfileEvents();
+app.MapLedgerExport();
+app.MapConsoleExportJobs();    // CONTRACT-EXPORT-BUNDLE-009
+app.MapPolicyPackBundles();    // CONTRACT-MIRROR-BUNDLE-003
+app.MapSealedMode();           // CONTRACT-SEALED-MODE-004
+app.MapStalenessSignaling();   // CONTRACT-SEALED-MODE-004 staleness
+app.MapAirGapNotifications();  // Air-gap notifications
+app.MapPolicyLint();           // POLICY-AOC-19-001 determinism linting
+app.MapVerificationPolicies(); // CONTRACT-VERIFICATION-POLICY-006 attestation policies
+app.MapVerificationPolicyEditor(); // CONTRACT-VERIFICATION-POLICY-006 editor DTOs/validation
+app.MapAttestationReports();       // CONTRACT-VERIFICATION-POLICY-006 attestation reports
+app.MapConsoleAttestationReports(); // CONTRACT-VERIFICATION-POLICY-006 Console integration
+app.MapSnapshots();
+app.MapViolations();
+app.MapPolicyDecisions();
+app.MapRiskProfiles();
+app.MapRiskProfileSchema();
+app.MapScopeAttachments();
+app.MapEffectivePolicies();  // CONTRACT-AUTHORITY-EFFECTIVE-WRITE-008
+app.MapRiskSimulation();
+app.MapOverrides();
+app.MapProfileExport();
+app.MapRiskProfileAirGap();  // CONTRACT-MIRROR-BUNDLE-003 risk profile air-gap
+app.MapProfileEvents();
+app.MapCvssReceipts(); // CVSS v4 receipt CRUD & history
 
 // Phase 5: Multi-tenant PostgreSQL-backed API endpoints
 app.MapPolicySnapshotsApi();