semi implemented and features implemented save checkpoint

docs/implplan-blocked/audits/csproj-standards/AirGap/StellaOps.AirGap.Controller/StellaOps.AirGap.Controller.md

@@ -0,0 +1,47 @@
+# Audit - StellaOps.AirGap.Controller
+
+## Project
+- Path: `src/AirGap/StellaOps.AirGap.Controller/StellaOps.AirGap.Controller.csproj`
+- Module: `AirGap`
+- Kind: `WebService`
+- SDK: `Microsoft.NET.Sdk.Web`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 6
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/AirGap/StellaOps.AirGap.Controller/Endpoints/AirGapEndpoints.cs` (267 lines)
+  - `src/AirGap/StellaOps.AirGap.Controller/Services/AirGapTelemetry.cs` (177 lines)
+  - `src/AirGap/StellaOps.AirGap.Controller/Services/AirGapStartupDiagnosticsHostedService.cs` (174 lines)
+  - `src/AirGap/StellaOps.AirGap.Controller/Services/AirGapStateService.cs` (118 lines)
+  - `src/AirGap/StellaOps.AirGap.Controller/Endpoints/RequestValidation.cs` (107 lines)
+  - `src/AirGap/StellaOps.AirGap.Controller/Auth/HeaderScopeAuthenticationHandler.cs` (105 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: FAIL
+- Expected layers: Unit, Integration, Security, Offline
+- Detected test projects: src/AirGap/__Tests/StellaOps.AirGap.Controller.Tests/StellaOps.AirGap.Controller.Tests.csproj [Unit]
+- Missing layers: Integration, Security, Offline
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- Add integration tests for cross-component flows.
+- Add security tests for authn/authz or input validation.
+- Add offline/airgap coverage with fixtures only.

docs/implplan-blocked/audits/csproj-standards/AirGap/StellaOps.AirGap.Importer/StellaOps.AirGap.Importer.md

@@ -0,0 +1,64 @@
+# Audit - StellaOps.AirGap.Importer
+
+## Project
+- Path: `src/AirGap/StellaOps.AirGap.Importer/StellaOps.AirGap.Importer.csproj`
+- Module: `AirGap`
+- Kind: `Service`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 25
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/AirGap/StellaOps.AirGap.Importer/Validation/RekorOfflineReceiptVerifier.cs` (655 lines)
+  - `src/AirGap/StellaOps.AirGap.Importer/Reconciliation/Parsers/SbomNormalizer.cs` (512 lines)
+  - `src/AirGap/StellaOps.AirGap.Importer/Validation/ReferrerValidator.cs` (480 lines)
+  - `src/AirGap/StellaOps.AirGap.Importer/Validation/ImportValidator.cs` (448 lines)
+  - `src/AirGap/StellaOps.AirGap.Importer/Reconciliation/Parsers/AttestationCollector.cs` (438 lines)
+  - `src/AirGap/StellaOps.AirGap.Importer/Validation/RuleBundleValidator.cs` (432 lines)
+  - `src/AirGap/StellaOps.AirGap.Importer/Quarantine/FileSystemQuarantineService.cs` (395 lines)
+  - `src/AirGap/StellaOps.AirGap.Importer/Reconciliation/EvidenceReconciler.cs` (394 lines)
+  - `src/AirGap/StellaOps.AirGap.Importer/Reconciliation/Parsers/CycloneDxParser.cs` (342 lines)
+  - `src/AirGap/StellaOps.AirGap.Importer/Reconciliation/EvidenceGraph.cs` (333 lines)
+  - `src/AirGap/StellaOps.AirGap.Importer/Reconciliation/Parsers/SpdxParser.cs` (315 lines)
+  - `src/AirGap/StellaOps.AirGap.Importer/Reconciliation/Parsers/DsseAttestationParser.cs` (300 lines)
+  - `src/AirGap/StellaOps.AirGap.Importer/Reconciliation/JsonNormalizer.cs` (281 lines)
+  - `src/AirGap/StellaOps.AirGap.Importer/Reconciliation/SourcePrecedenceLattice.cs` (264 lines)
+  - `src/AirGap/StellaOps.AirGap.Importer/Policy/OfflineVerificationPolicy.cs` (213 lines)
+  - `src/AirGap/StellaOps.AirGap.Importer/Validation/DsseVerifier.cs` (211 lines)
+  - `src/AirGap/StellaOps.AirGap.Importer/Reconciliation/Parsers/IAttestationParser.cs` (204 lines)
+  - `src/AirGap/StellaOps.AirGap.Importer/Reconciliation/Parsers/ISbomParser.cs` (188 lines)
+  - `src/AirGap/StellaOps.AirGap.Importer/Reconciliation/Parsers/OpenVexParser.cs` (182 lines)
+  - `src/AirGap/StellaOps.AirGap.Importer/Reconciliation/Signing/EvidenceGraphDsseSigner.cs` (182 lines)
+  - `src/AirGap/StellaOps.AirGap.Importer/Reconciliation/Parsers/SbomCollector.cs` (173 lines)
+  - `src/AirGap/StellaOps.AirGap.Importer/Versioning/BundleVersion.cs` (144 lines)
+  - `src/AirGap/StellaOps.AirGap.Importer/Reconciliation/ArtifactIndex.cs` (143 lines)
+  - `src/AirGap/StellaOps.AirGap.Importer/Telemetry/OfflineKitMetrics.cs` (142 lines)
+  - `src/AirGap/StellaOps.AirGap.Importer/Policy/OfflineVerificationPolicyLoader.cs` (132 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: PASS
+- Expected layers: Unit
+- Detected test projects: src/AirGap/__Tests/StellaOps.AirGap.Importer.Tests/StellaOps.AirGap.Importer.Tests.csproj [Unit]
+- Missing layers: none
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- None.

docs/implplan-blocked/audits/csproj-standards/AirGap/StellaOps.AirGap.Policy/StellaOps.AirGap.Policy.Analyzers/StellaOps.AirGap.Policy.Analyzers.md

@@ -0,0 +1,40 @@
+# Audit - StellaOps.AirGap.Policy.Analyzers
+
+## Project
+- Path: `src/AirGap/StellaOps.AirGap.Policy/StellaOps.AirGap.Policy.Analyzers/StellaOps.AirGap.Policy.Analyzers.csproj`
+- Module: `AirGap`
+- Kind: `Service`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `netstandard2.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 1
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/AirGap/StellaOps.AirGap.Policy/StellaOps.AirGap.Policy.Analyzers/HttpClientUsageAnalyzer.cs` (106 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: PASS
+- Expected layers: Unit
+- Detected test projects: src/AirGap/StellaOps.AirGap.Policy/StellaOps.AirGap.Policy.Analyzers.Tests/StellaOps.AirGap.Policy.Analyzers.Tests.csproj [Unit]
+- Missing layers: none
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- None.

docs/implplan-blocked/audits/csproj-standards/AirGap/StellaOps.AirGap.Policy/StellaOps.AirGap.Policy/StellaOps.AirGap.Policy.md

@@ -0,0 +1,42 @@
+# Audit - StellaOps.AirGap.Policy
+
+## Project
+- Path: `src/AirGap/StellaOps.AirGap.Policy/StellaOps.AirGap.Policy/StellaOps.AirGap.Policy.csproj`
+- Module: `AirGap`
+- Kind: `Service`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 3
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/AirGap/StellaOps.AirGap.Policy/StellaOps.AirGap.Policy/EgressPolicyServiceCollectionExtensions.cs` (293 lines)
+  - `src/AirGap/StellaOps.AirGap.Policy/StellaOps.AirGap.Policy/EgressPolicy.cs` (243 lines)
+  - `src/AirGap/StellaOps.AirGap.Policy/StellaOps.AirGap.Policy/EgressRule.cs` (127 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: PASS
+- Expected layers: Unit
+- Detected test projects: src/AirGap/StellaOps.AirGap.Policy/StellaOps.AirGap.Policy.Tests/StellaOps.AirGap.Policy.Tests.csproj [Unit], src/AirGap/StellaOps.AirGap.Policy/StellaOps.AirGap.Policy.Analyzers.Tests/StellaOps.AirGap.Policy.Analyzers.Tests.csproj [Unit]
+- Missing layers: none
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- None.

docs/implplan-blocked/audits/csproj-standards/AirGap/StellaOps.AirGap.Time/StellaOps.AirGap.Time.md

@@ -0,0 +1,46 @@
+# Audit - StellaOps.AirGap.Time
+
+## Project
+- Path: `src/AirGap/StellaOps.AirGap.Time/StellaOps.AirGap.Time.csproj`
+- Module: `AirGap`
+- Kind: `WebService`
+- SDK: `Microsoft.NET.Sdk.Web`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 3
+- Service locator usage (BuildServiceProvider/GetService): 2
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/AirGap/StellaOps.AirGap.Time/Services/RoughtimeVerifier.cs` (430 lines)
+  - `src/AirGap/StellaOps.AirGap.Time/Services/Rfc3161Verifier.cs` (339 lines)
+  - `src/AirGap/StellaOps.AirGap.Time/Services/TimeAnchorPolicyService.cs` (306 lines)
+- Service locator matches:
+  - `src/AirGap/StellaOps.AirGap.Time/Hooks/StartupValidationExtensions.cs`:17 var validator = scope.ServiceProvider.GetRequiredService<SealedStartupValidator>();
+  - `src/AirGap/StellaOps.AirGap.Time/Hooks/StartupValidationExtensions.cs`:18 var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("AirGap.Time.Startup");
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+- Replace service locator usage with constructor injection.
+
+## Testing Fullness Findings
+- Status: FAIL
+- Expected layers: Unit, Integration, Security, Offline
+- Detected test projects: src/AirGap/__Tests/StellaOps.AirGap.Time.Tests/StellaOps.AirGap.Time.Tests.csproj [Unit]
+- Missing layers: Integration, Security, Offline
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- Add integration tests for cross-component flows.
+- Add security tests for authn/authz or input validation.
+- Add offline/airgap coverage with fixtures only.

docs/implplan-blocked/audits/csproj-standards/AirGap/__Libraries/StellaOps.AirGap.Bundle/StellaOps.AirGap.Bundle.md

@@ -0,0 +1,65 @@
+# Audit - StellaOps.AirGap.Bundle
+
+## Project
+- Path: `src/AirGap/__Libraries/StellaOps.AirGap.Bundle/StellaOps.AirGap.Bundle.csproj`
+- Module: `AirGap`
+- Kind: `Library`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 26
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/AirGap/__Libraries/StellaOps.AirGap.Bundle/TrustSnapshot/TrustSnapshotImporter.cs` (686 lines)
+  - `src/AirGap/__Libraries/StellaOps.AirGap.Bundle/Services/BundleBuilder.cs` (639 lines)
+  - `src/AirGap/__Libraries/StellaOps.AirGap.Bundle/Services/SnapshotBundleReader.cs` (620 lines)
+  - `src/AirGap/__Libraries/StellaOps.AirGap.Bundle/Services/SnapshotBundleWriter.cs` (601 lines)
+  - `src/AirGap/__Libraries/StellaOps.AirGap.Bundle/TrustSnapshot/TrustSnapshotBuilder.cs` (595 lines)
+  - `src/AirGap/__Libraries/StellaOps.AirGap.Bundle/Services/KnowledgeSnapshotImporter.cs` (567 lines)
+  - `src/AirGap/__Libraries/StellaOps.AirGap.Bundle/Services/SnapshotManifestSigner.cs` (488 lines)
+  - `src/AirGap/__Libraries/StellaOps.AirGap.Bundle/Extractors/PolicySnapshotExtractor.cs` (374 lines)
+  - `src/AirGap/__Libraries/StellaOps.AirGap.Bundle/TrustSnapshot/TrustSnapshotManifest.cs` (359 lines)
+  - `src/AirGap/__Libraries/StellaOps.AirGap.Bundle/Services/TimeAnchorService.cs` (319 lines)
+  - `src/AirGap/__Libraries/StellaOps.AirGap.Bundle/Extractors/VexSnapshotExtractor.cs` (295 lines)
+  - `src/AirGap/__Libraries/StellaOps.AirGap.Bundle/Services/TsaChainBundler.cs` (271 lines)
+  - `src/AirGap/__Libraries/StellaOps.AirGap.Bundle/Models/BundleManifest.cs` (270 lines)
+  - `src/AirGap/__Libraries/StellaOps.AirGap.Bundle/Extractors/AdvisorySnapshotExtractor.cs` (269 lines)
+  - `src/AirGap/__Libraries/StellaOps.AirGap.Bundle/Services/ConcelierAdvisoryImportTarget.cs` (269 lines)
+  - `src/AirGap/__Libraries/StellaOps.AirGap.Bundle/Models/BundleFormatV2.cs` (266 lines)
+  - `src/AirGap/__Libraries/StellaOps.AirGap.Bundle/Services/ExcititorVexImportTarget.cs` (265 lines)
+  - `src/AirGap/__Libraries/StellaOps.AirGap.Bundle/Services/PolicyRegistryImportTarget.cs` (251 lines)
+  - `src/AirGap/__Libraries/StellaOps.AirGap.Bundle/FunctionMap/FunctionMapBundleIntegration.cs` (239 lines)
+  - `src/AirGap/__Libraries/StellaOps.AirGap.Bundle/Validation/BundleValidator.cs` (224 lines)
+  - `src/AirGap/__Libraries/StellaOps.AirGap.Bundle/Services/LocalRbacBundleExtensions.cs` (179 lines)
+  - `src/AirGap/__Libraries/StellaOps.AirGap.Bundle/Models/KnowledgeSnapshotManifest.cs` (166 lines)
+  - `src/AirGap/__Libraries/StellaOps.AirGap.Bundle/Services/Abstractions.cs` (162 lines)
+  - `src/AirGap/__Libraries/StellaOps.AirGap.Bundle/Services/CrlFetcher.cs` (160 lines)
+  - `src/AirGap/__Libraries/StellaOps.AirGap.Bundle/Services/OcspResponseFetcher.cs` (138 lines)
+  - `src/AirGap/__Libraries/StellaOps.AirGap.Bundle/Services/TrustProfileLoader.cs` (111 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: PASS
+- Expected layers: Unit
+- Detected test projects: src/AirGap/__Libraries/__Tests/StellaOps.AirGap.Bundle.Tests/StellaOps.AirGap.Bundle.Tests.csproj [Unit]
+- Missing layers: none
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- None.

docs/implplan-blocked/audits/csproj-standards/AirGap/__Libraries/StellaOps.AirGap.Persistence/StellaOps.AirGap.Persistence.md

@@ -0,0 +1,41 @@
+# Audit - StellaOps.AirGap.Persistence
+
+## Project
+- Path: `src/AirGap/__Libraries/StellaOps.AirGap.Persistence/StellaOps.AirGap.Persistence.csproj`
+- Module: `AirGap`
+- Kind: `Library`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 2
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/AirGap/__Libraries/StellaOps.AirGap.Persistence/Postgres/Repositories/PostgresBundleVersionStore.cs` (361 lines)
+  - `src/AirGap/__Libraries/StellaOps.AirGap.Persistence/Postgres/Repositories/PostgresAirGapStateStore.cs` (341 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: PASS
+- Expected layers: Unit
+- Detected test projects: src/AirGap/__Tests/StellaOps.AirGap.Persistence.Tests/StellaOps.AirGap.Persistence.Tests.csproj [Unit]
+- Missing layers: none
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- None.

docs/implplan-blocked/audits/csproj-standards/AirGap/__Libraries/StellaOps.AirGap.Sync/StellaOps.AirGap.Sync.md

@@ -0,0 +1,53 @@
+# Audit - StellaOps.AirGap.Sync
+
+## Project
+- Path: `src/AirGap/__Libraries/StellaOps.AirGap.Sync/StellaOps.AirGap.Sync.csproj`
+- Module: `AirGap`
+- Kind: `Library`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 13
+- Service locator usage (BuildServiceProvider/GetService): 1
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/AirGap/__Libraries/StellaOps.AirGap.Sync/Services/AirGapBundleImporter.cs` (316 lines)
+  - `src/AirGap/__Libraries/StellaOps.AirGap.Sync/Services/AirGapBundleDsseSigner.cs` (275 lines)
+  - `src/AirGap/__Libraries/StellaOps.AirGap.Sync/Transport/RouterJobSyncTransport.cs` (272 lines)
+  - `src/AirGap/__Libraries/StellaOps.AirGap.Sync/Services/AirGapBundleExporter.cs` (270 lines)
+  - `src/AirGap/__Libraries/StellaOps.AirGap.Sync/Stores/FileBasedOfflineJobLogStore.cs` (246 lines)
+  - `src/AirGap/__Libraries/StellaOps.AirGap.Sync/Transport/FileBasedJobSyncTransport.cs` (222 lines)
+  - `src/AirGap/__Libraries/StellaOps.AirGap.Sync/Services/AirGapSyncService.cs` (198 lines)
+  - `src/AirGap/__Libraries/StellaOps.AirGap.Sync/Services/OfflineHlcManager.cs` (172 lines)
+  - `src/AirGap/__Libraries/StellaOps.AirGap.Sync/Services/HlcMergeService.cs` (169 lines)
+  - `src/AirGap/__Libraries/StellaOps.AirGap.Sync/Telemetry/AirGapSyncMetrics.cs` (161 lines)
+  - `src/AirGap/__Libraries/StellaOps.AirGap.Sync/AirGapSyncServiceCollectionExtensions.cs` (153 lines)
+  - `src/AirGap/__Libraries/StellaOps.AirGap.Sync/Transport/IJobSyncTransport.cs` (123 lines)
+  - `src/AirGap/__Libraries/StellaOps.AirGap.Sync/Services/ConflictResolver.cs` (114 lines)
+- Service locator matches:
+  - `src/AirGap/__Libraries/StellaOps.AirGap.Sync/AirGapSyncServiceCollectionExtensions.cs`:44 var timeProvider = sp.GetService<TimeProvider>() ?? TimeProvider.System;
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+- Replace service locator usage with constructor injection.
+
+## Testing Fullness Findings
+- Status: PASS
+- Expected layers: Unit
+- Detected test projects: src/AirGap/__Tests/StellaOps.AirGap.Sync.Tests/StellaOps.AirGap.Sync.Tests.csproj [Unit]
+- Missing layers: none
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- None.