feat: Implement Filesystem and MongoDB provenance writers for PackRun execution context

- Added `FilesystemPackRunProvenanceWriter` to write provenance manifests to the filesystem.
- Introduced `MongoPackRunArtifactReader` to read artifacts from MongoDB.
- Created `MongoPackRunProvenanceWriter` to store provenance manifests in MongoDB.
- Developed unit tests for filesystem and MongoDB provenance writers.
- Established `ITimelineEventStore` and `ITimelineIngestionService` interfaces for timeline event handling.
- Implemented `TimelineIngestionService` to validate and persist timeline events with hashing.
- Created PostgreSQL schema and migration scripts for timeline indexing.
- Added dependency injection support for timeline indexer services.
- Developed tests for timeline ingestion and schema validation.

src/TaskRunner/StellaOps.TaskRunner/StellaOps.TaskRunner.Tests/PackRunApprovalDecisionServiceTests.cs

@@ -39,7 +39,7 @@ public sealed class PackRunApprovalDecisionServiceTests
             NullLogger<PackRunApprovalDecisionService>.Instance);
 
         var result = await service.ApplyAsync(
-            new PackRunApprovalDecisionRequest("run-1", "security-review", PackRunApprovalDecisionType.Approved, "approver@example.com", "LGTM"),
+            new PackRunApprovalDecisionRequest("run-1", "security-review", plan.Hash, PackRunApprovalDecisionType.Approved, "approver@example.com", "LGTM"),
             CancellationToken.None);
 
         Assert.Equal("resumed", result.Status);
@@ -62,13 +62,51 @@ public sealed class PackRunApprovalDecisionServiceTests
             NullLogger<PackRunApprovalDecisionService>.Instance);
 
         var result = await service.ApplyAsync(
-            new PackRunApprovalDecisionRequest("missing", "approval", PackRunApprovalDecisionType.Approved, "actor", null),
+            new PackRunApprovalDecisionRequest("missing", "approval", "hash", PackRunApprovalDecisionType.Approved, "actor", null),
             CancellationToken.None);
 
         Assert.Equal("not_found", result.Status);
         Assert.False(scheduler.ScheduledContexts.Any());
     }
 
+    [Fact]
+    public async Task ApplyAsync_ReturnsPlanHashMismatchWhenIncorrect()
+    {
+        var plan = TestPlanFactory.CreatePlan();
+        var state = TestPlanFactory.CreateState("run-1", plan);
+        var approval = new PackRunApprovalState(
+            "security-review",
+            new[] { "Packs.Approve" },
+            new[] { "step-a" },
+            Array.Empty<string>(),
+            null,
+            DateTimeOffset.UtcNow.AddMinutes(-5),
+            PackRunApprovalStatus.Pending);
+
+        var approvalStore = new InMemoryApprovalStore(new Dictionary<string, IReadOnlyList<PackRunApprovalState>>
+        {
+            ["run-1"] = new List<PackRunApprovalState> { approval }
+        });
+        var stateStore = new InMemoryStateStore(new Dictionary<string, PackRunState>
+        {
+            ["run-1"] = state
+        });
+        var scheduler = new RecordingScheduler();
+
+        var service = new PackRunApprovalDecisionService(
+            approvalStore,
+            stateStore,
+            scheduler,
+            NullLogger<PackRunApprovalDecisionService>.Instance);
+
+        var result = await service.ApplyAsync(
+            new PackRunApprovalDecisionRequest("run-1", "security-review", "wrong-hash", PackRunApprovalDecisionType.Approved, "actor", null),
+            CancellationToken.None);
+
+        Assert.Equal("plan_hash_mismatch", result.Status);
+        Assert.False(scheduler.ScheduledContexts.Any());
+    }
+
     private sealed class InMemoryApprovalStore : IPackRunApprovalStore
     {
         private readonly Dictionary<string, List<PackRunApprovalState>> _approvals;

src/TaskRunner/StellaOps.TaskRunner/StellaOps.TaskRunner.Tests/PackRunProvenanceWriterTests.cs

@@ -0,0 +1,95 @@
+using System.Text.Json;
+using System.Text.Json.Nodes;
+using MongoDB.Driver;
+using StellaOps.TaskRunner.Core.Execution;
+using StellaOps.TaskRunner.Core.Execution.Simulation;
+using StellaOps.TaskRunner.Core.Planning;
+using StellaOps.TaskRunner.Core.TaskPacks;
+using StellaOps.TaskRunner.Infrastructure.Execution;
+using Xunit;
+
+namespace StellaOps.TaskRunner.Tests;
+
+public sealed class PackRunProvenanceWriterTests
+{
+    [Fact]
+    public async Task Filesystem_writer_emits_manifest()
+    {
+        var (context, state) = CreateRunState();
+        var completedAt = new DateTimeOffset(2025, 11, 30, 12, 30, 0, TimeSpan.Zero);
+        var temp = Directory.CreateTempSubdirectory();
+        try
+        {
+            var ct = TestContext.Current.CancellationToken;
+            var writer = new FilesystemPackRunProvenanceWriter(temp.FullName, new FixedTimeProvider(completedAt));
+            await writer.WriteAsync(context, state, ct);
+
+            var path = Path.Combine(temp.FullName, "provenance", "run-test.json");
+            Assert.True(File.Exists(path));
+
+            using var document = JsonDocument.Parse(await File.ReadAllTextAsync(path, ct));
+            var root = document.RootElement;
+            Assert.Equal("run-test", root.GetProperty("runId").GetString());
+            Assert.Equal("tenant-alpha", root.GetProperty("tenantId").GetString());
+            Assert.Equal(context.Plan.Hash, root.GetProperty("planHash").GetString());
+            Assert.Equal(completedAt, root.GetProperty("completedAt").GetDateTimeOffset());
+        }
+        finally
+        {
+            temp.Delete(recursive: true);
+        }
+    }
+
+    [Fact]
+    public async Task Mongo_writer_upserts_manifest()
+    {
+        await using var mongo = MongoTaskRunnerTestContext.Create();
+        var (context, state) = CreateRunState();
+        var completedAt = new DateTimeOffset(2025, 11, 30, 12, 0, 0, TimeSpan.Zero);
+        var ct = TestContext.Current.CancellationToken;
+
+        var options = mongo.CreateMongoOptions();
+        var writer = new MongoPackRunProvenanceWriter(mongo.Database, options, new FixedTimeProvider(completedAt));
+        await writer.WriteAsync(context, state, ct);
+
+        var collection = mongo.Database.GetCollection<MongoDB.Bson.BsonDocument>(options.ArtifactsCollection);
+        var saved = await collection
+            .Find(Builders<MongoDB.Bson.BsonDocument>.Filter.Eq("RunId", context.RunId))
+            .FirstOrDefaultAsync(ct);
+
+        Assert.NotNull(saved);
+        var manifest = saved!["Expression"].AsBsonDocument;
+        Assert.Equal("run-test", manifest["runId"].AsString);
+        Assert.Equal("tenant-alpha", manifest["tenantId"].AsString);
+        Assert.Equal(context.Plan.Hash, manifest["planHash"].AsString);
+    }
+
+    private static (PackRunExecutionContext Context, PackRunState State) CreateRunState()
+    {
+        var loader = new TaskPackManifestLoader();
+        var planner = new TaskPackPlanner();
+        var manifest = loader.Deserialize(TestManifests.Sample);
+        var plan = planner.Plan(manifest, new Dictionary<string, JsonNode?>()).Plan ?? throw new InvalidOperationException("Plan generation failed.");
+
+        var graphBuilder = new PackRunExecutionGraphBuilder();
+        var simulationEngine = new PackRunSimulationEngine();
+        var graph = graphBuilder.Build(plan);
+
+        var requestedAt = new DateTimeOffset(2025, 11, 30, 10, 0, 0, TimeSpan.Zero);
+        var context = new PackRunExecutionContext("run-test", plan, requestedAt, "tenant-alpha");
+        var state = PackRunStateFactory.CreateInitialState(context, graph, simulationEngine, requestedAt);
+        return (context, state);
+    }
+
+    private sealed class FixedTimeProvider : TimeProvider
+    {
+        private readonly DateTimeOffset now;
+
+        public FixedTimeProvider(DateTimeOffset now)
+        {
+            this.now = now;
+        }
+
+        public override DateTimeOffset GetUtcNow() => now;
+    }
+}

src/TaskRunner/StellaOps.TaskRunner/StellaOps.TaskRunner.Tests/StellaOps.TaskRunner.Tests.csproj

@@ -24,6 +24,10 @@
     <ProjectReference Include="..\..\..\AirGap\StellaOps.AirGap.Policy\StellaOps.AirGap.Policy\StellaOps.AirGap.Policy.csproj" />
   </ItemGroup>
 
+  <ItemGroup>
+    <Compile Include="..\StellaOps.TaskRunner.WebService\OpenApiMetadataFactory.cs" Link="Web/OpenApiMetadataFactory.cs" />
+  </ItemGroup>
+
   <ItemGroup>
     <Content Include="xunit.runner.json" CopyToOutputDirectory="PreserveNewest" />
   </ItemGroup>