feat: Implement Filesystem and MongoDB provenance writers for PackRun execution context

- Added `FilesystemPackRunProvenanceWriter` to write provenance manifests to the filesystem.
- Introduced `MongoPackRunArtifactReader` to read artifacts from MongoDB.
- Created `MongoPackRunProvenanceWriter` to store provenance manifests in MongoDB.
- Developed unit tests for filesystem and MongoDB provenance writers.
- Established `ITimelineEventStore` and `ITimelineIngestionService` interfaces for timeline event handling.
- Implemented `TimelineIngestionService` to validate and persist timeline events with hashing.
- Created PostgreSQL schema and migration scripts for timeline indexing.
- Added dependency injection support for timeline indexer services.
- Developed tests for timeline ingestion and schema validation.

docs/modules/zastava/AGENTS.md

@@ -15,6 +15,7 @@ Zastava monitors running workloads, verifies supply chain posture, and enforces
 - [Architecture](./architecture.md)
 - [Implementation plan](./implementation_plan.md)
 - [Task board](./TASKS.md)
+- [Observability runbook](./operations/observability.md) (offline import friendly)
 
 ## How to get started
 1. Open sprint file `/docs/implplan/SPRINT_*.md` and locate the stories referencing this module.

docs/modules/zastava/README.md

@@ -2,7 +2,12 @@
 
 Zastava monitors running workloads, verifies supply chain posture, and enforces runtime policy via Kubernetes admission webhooks.
 
-## Responsibilities
+## Latest updates (2025-11-30)
+- Sprint tracker `docs/implplan/SPRINT_0335_0001_0001_docs_modules_zastava.md` and module `TASKS.md` added to mirror status.
+- Observability runbook stub + dashboard placeholder added under `operations/` (offline import).
+- Surface.Env/Surface.Secrets adoption remains pending platform contracts; align with platform docs before enabling sealed mode.
+
+## Responsibilities
 - Observe node/container activity and emit runtime events.
 - Validate signatures, SBOM presence, and backend verdicts before allowing containers.
 - Buffer and replay events during disconnections.
@@ -18,10 +23,10 @@ Zastava monitors running workloads, verifies supply chain posture, and enforces
 - Scanner/Scheduler for remediation triggers.
 - Notify/UI for runtime alerts and dashboards.
 
-## Operational notes
-- Runbook ./operations/runtime.md with Grafana/Prometheus assets.
-- Offline kit assets bundling webhook charts.
-- DPoP/mTLS rotation guidance shared with Authority.
+## Operational notes
+- Runbook `./operations/observability.md` (stub) plus dashboard placeholder `./operations/dashboards/zastava-observability.json`.
+- Legacy runtime runbook assets remain under ./operations if present; keep offline kit bundles deterministic.
+- DPoP/mTLS rotation guidance shared with Authority.
 
 ## Related resources
 - ./operations/runtime.md

docs/modules/zastava/TASKS.md

@@ -0,0 +1,9 @@
+# Zastava · TASKS (status mirror)
+
+| Task ID | Status | Owner(s) | Notes / Evidence |
+| --- | --- | --- | --- |
+| ZASTAVA-DOCS-0001 | DONE (2025-11-30) | Docs Guild | README/architecture refreshed; Surface Env/Secrets and sprint links added. |
+| ZASTAVA-ENG-0001 | DONE (2025-11-30) | Module Team | TASKS board created; statuses mirrored with `docs/implplan/SPRINT_0335_0001_0001_docs_modules_zastava.md`. |
+| ZASTAVA-OPS-0001 | DONE (2025-11-30) | Ops Guild | Observability runbook stub + Grafana JSON placeholder added under `operations/`. |
+
+> Keep this table in lockstep with the sprint Delivery Tracker (TODO/DOING/DONE/BLOCKED updates go to both places).

docs/modules/zastava/architecture.md

@@ -486,11 +486,20 @@ webhooks:
 
 ---
 
-## 15) Roadmap
-
-* **eBPF** option for syscall/library load tracing (kernel‑level, opt‑in).
-* **Windows containers** support (ETW providers, loaded modules).
-* **Network posture** checks: listening ports vs policy.
-* **Live **used‑by‑entrypoint** synthesis**: send compact bitset diff to backend to tighten Usage view.
-* **Admission dry‑run** dashboards (simulate block lists before enforcing).
+## 15) Roadmap
+
+* **eBPF** option for syscall/library load tracing (kernel‑level, opt‑in).
+* **Windows containers** support (ETW providers, loaded modules).
+* **Network posture** checks: listening ports vs policy.
+* **Live **used‑by‑entrypoint** synthesis**: send compact bitset diff to backend to tighten Usage view.
+* **Admission dry‑run** dashboards (simulate block lists before enforcing).
+
+---
+
+## 16) Observability (stub)
+
+- Runbook + dashboard placeholder for offline import: `operations/observability.md`, `operations/dashboards/zastava-observability.json`.
+- Metrics to surface: admission latency p95/p99, allow/deny counts, Surface.Env miss rate, Surface.Secrets failures, Surface.FS cache freshness, drift events.
+- Health endpoints: `/health/liveness`, `/health/readiness`, `/status`, `/surface/fs/cache/status` (see runbook).
+- Alert hints: deny spikes, latency > 800ms p99, cache freshness lag > 10m, any secrets failure.
 

docs/modules/zastava/implementation_plan.md

@@ -13,7 +13,12 @@
 - ZASTAVA runtime tasks in ../../TASKS.md.
 - Webhook smoke tests tracked in src/Zastava/**/TASKS.md.
 
-## Coordination
-- Review ./AGENTS.md before picking up new work.
-- Sync with cross-cutting teams noted in `/docs/implplan/SPRINT_*.md`.
-- Update this plan whenever scope, dependencies, or guardrails change.
+## Coordination
+- Review ./AGENTS.md before picking up new work.
+- Sync with cross-cutting teams noted in `/docs/implplan/SPRINT_*.md`.
+- Update this plan whenever scope, dependencies, or guardrails change.
+
+## Sprint alignment (2025-11-30)
+- Docs refresh tracked in `docs/implplan/SPRINT_0335_0001_0001_docs_modules_zastava.md`; statuses mirrored in `docs/modules/zastava/TASKS.md`.
+- Observability evidence lives in `operations/observability.md` with Grafana JSON stub under `operations/dashboards/`.
+- Surface.Env/Surface.Secrets contracts remain dependencies; align with platform docs before enabling sealed mode.

docs/modules/zastava/operations/dashboards/zastava-observability.json

@@ -0,0 +1,6 @@
+{
+  "_note": "Placeholder Grafana dashboard stub for Zastava. Replace panels when metrics endpoints are available; keep offline-import friendly.",
+  "schemaVersion": 39,
+  "title": "Zastava Observability (stub)",
+  "panels": []
+}

docs/modules/zastava/operations/observability.md

@@ -0,0 +1,38 @@
+# Zastava observability runbook (stub · 2025-11-29 demo)
+
+## Dashboards (offline import)
+- Grafana JSON: `docs/modules/zastava/operations/dashboards/zastava-observability.json` (import locally; no external data sources assumed).
+- Planned panels: admission decision rate, webhook latency p95/p99, cache freshness (Surface.FS), Surface.Env key misses, Secrets fetch failures, policy violation counts, and drift events.
+
+## Key metrics
+- `zastava_admission_latency_seconds_bucket{webhook}` — admission webhook latency.
+- `zastava_admission_decisions_total{result}` — allow/deny counts.
+- `zastava_surface_env_miss_total` — Surface.Env key misses.
+- `zastava_surface_secrets_failures_total{reason}` — secret retrieval failures.
+- `zastava_surface_fs_cache_freshness_seconds` — cache age vs Scanner surface metadata.
+- `zastava_drift_events_total{type}` — drift detections by category.
+
+## Logs & traces
+- Correlate by `correlationId`, `tenant`, `cluster`, and `admissionId`. Include `policyVersion`, `surfaceEnvProfile`, and `secretsProvider` fields.
+- Traces disabled by default for air-gap; enable via `Telemetry:ExportEnabled=true` pointing to on-prem collector.
+
+## Health/diagnostics
+- `/health/liveness` and `/health/readiness` (webhook + observer) check cache reachability, Secrets provider connectivity, and policy fetch.
+- `/status` exposes build version, commit, feature flags; verify against offline bundle manifest.
+- Cache probe: `GET /surface/fs/cache/status` returns freshness and hash for cached surfaces.
+
+## Alert hints
+- Admission latency p99 > 800ms.
+- Deny rate spike > 5% over 10m without policy change.
+- Surface.Env miss rate > 1% or Secrets failure > 0 over 10m.
+- Cache freshness > 10m behind Scanner surface metadata.
+
+## Offline verification steps
+1) Import Grafana JSON locally; point to Prometheus scrape labeled `zastava`.
+2) Replay a sealed admission bundle and verify `/status` + cache probe hashes match the manifest in the offline kit.
+3) Run webhook smoke (`kubectl apply --dry-run=server -f samples/admission-request.yaml`) and confirm metrics increment locally.
+
+## Evidence locations
+- Sprint tracker: `docs/implplan/SPRINT_0335_0001_0001_docs_modules_zastava.md`.
+- Module docs: `README.md`, `architecture.md`, `implementation_plan.md`.
+- Dashboard stub: `operations/dashboards/zastava-observability.json`.