semi implemented and features implemented save checkpoint

docs/implplan-blocked/audits/csproj-standards/Cli/__Libraries/StellaOps.Cli.Plugins.Aoc/StellaOps.Cli.Plugins.Aoc.md

@@ -0,0 +1,48 @@
+# Audit - StellaOps.Cli.Plugins.Aoc
+
+## Project
+- Path: `src/Cli/__Libraries/StellaOps.Cli.Plugins.Aoc/StellaOps.Cli.Plugins.Aoc.csproj`
+- Module: `Cli`
+- Kind: `Plugin`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 3
+- Service locator usage (BuildServiceProvider/GetService): 3
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/Cli/__Libraries/StellaOps.Cli.Plugins.Aoc/AocCliCommandModule.cs` (254 lines)
+  - `src/Cli/__Libraries/StellaOps.Cli.Plugins.Aoc/AocVerifyOptions.cs` (135 lines)
+  - `src/Cli/__Libraries/StellaOps.Cli.Plugins.Aoc/AocVerificationService.cs` (114 lines)
+- Service locator matches:
+  - `src/Cli/__Libraries/StellaOps.Cli.Plugins.Aoc/AocCliCommandModule.cs`:210 var resolvedService = services.GetService<IAocVerificationService>();
+  - `src/Cli/__Libraries/StellaOps.Cli.Plugins.Aoc/AocCliCommandModule.cs`:216 var connectionFactory = services.GetService<IAocConnectionFactory>() ?? new NpgsqlConnectionFactory();
+  - `src/Cli/__Libraries/StellaOps.Cli.Plugins.Aoc/AocCliCommandModule.cs`:217 var timeProvider = services.GetService<TimeProvider>() ?? TimeProvider.System;
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+- Replace service locator usage with constructor injection.
+
+## Testing Fullness Findings
+- Status: FAIL
+- Expected layers: Unit, Integration, Security, Offline
+- Detected test projects: none
+- Missing layers: Unit, Integration, Security, Offline
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- Add a unit test project named `<Project>.Tests` (or document exception).
+- Add integration tests for cross-component flows.
+- Add security tests for authn/authz or input validation.
+- Add offline/airgap coverage with fixtures only.

docs/implplan-blocked/audits/csproj-standards/Cli/__Libraries/StellaOps.Cli.Plugins.DeltaSig/StellaOps.Cli.Plugins.DeltaSig.md

@@ -0,0 +1,43 @@
+# Audit - StellaOps.Cli.Plugins.DeltaSig
+
+## Project
+- Path: `src/Cli/__Libraries/StellaOps.Cli.Plugins.DeltaSig/StellaOps.Cli.Plugins.DeltaSig.csproj`
+- Module: `Cli`
+- Kind: `Plugin`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 1
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/Cli/__Libraries/StellaOps.Cli.Plugins.DeltaSig/DeltaSigCliCommands.cs` (370 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: FAIL
+- Expected layers: Unit, Integration, Security, Offline
+- Detected test projects: none
+- Missing layers: Unit, Integration, Security, Offline
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- Add a unit test project named `<Project>.Tests` (or document exception).
+- Add integration tests for cross-component flows.
+- Add security tests for authn/authz or input validation.
+- Add offline/airgap coverage with fixtures only.

docs/implplan-blocked/audits/csproj-standards/Cli/__Libraries/StellaOps.Cli.Plugins.GroundTruth/StellaOps.Cli.Plugins.GroundTruth.md

@@ -0,0 +1,43 @@
+# Audit - StellaOps.Cli.Plugins.GroundTruth
+
+## Project
+- Path: `src/Cli/__Libraries/StellaOps.Cli.Plugins.GroundTruth/StellaOps.Cli.Plugins.GroundTruth.csproj`
+- Module: `Cli`
+- Kind: `Plugin`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 1
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/Cli/__Libraries/StellaOps.Cli.Plugins.GroundTruth/GroundTruthCliCommandModule.cs` (877 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: FAIL
+- Expected layers: Unit, Integration, Security, Offline
+- Detected test projects: none
+- Missing layers: Unit, Integration, Security, Offline
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- Add a unit test project named `<Project>.Tests` (or document exception).
+- Add integration tests for cross-component flows.
+- Add security tests for authn/authz or input validation.
+- Add offline/airgap coverage with fixtures only.

docs/implplan-blocked/audits/csproj-standards/Cli/__Libraries/StellaOps.Cli.Plugins.NonCore/StellaOps.Cli.Plugins.NonCore.md

@@ -0,0 +1,44 @@
+# Audit - StellaOps.Cli.Plugins.NonCore
+
+## Project
+- Path: `src/Cli/__Libraries/StellaOps.Cli.Plugins.NonCore/StellaOps.Cli.Plugins.NonCore.csproj`
+- Module: `Cli`
+- Kind: `Plugin`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 2
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/Cli/__Libraries/StellaOps.Cli.Plugins.NonCore/NonCoreCliCommandModule.cs` (462 lines)
+  - `src/Cli/__Libraries/StellaOps.Cli.Plugins.NonCore/NonCoreCliOptionParser.cs` (105 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: FAIL
+- Expected layers: Unit, Integration, Security, Offline
+- Detected test projects: none
+- Missing layers: Unit, Integration, Security, Offline
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- Add a unit test project named `<Project>.Tests` (or document exception).
+- Add integration tests for cross-component flows.
+- Add security tests for authn/authz or input validation.
+- Add offline/airgap coverage with fixtures only.

docs/implplan-blocked/audits/csproj-standards/Cli/__Libraries/StellaOps.Cli.Plugins.Symbols/StellaOps.Cli.Plugins.Symbols.md

@@ -0,0 +1,45 @@
+# Audit - StellaOps.Cli.Plugins.Symbols
+
+## Project
+- Path: `src/Cli/__Libraries/StellaOps.Cli.Plugins.Symbols/StellaOps.Cli.Plugins.Symbols.csproj`
+- Module: `Cli`
+- Kind: `Plugin`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 1
+- Service locator usage (BuildServiceProvider/GetService): 2
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/Cli/__Libraries/StellaOps.Cli.Plugins.Symbols/SymbolsCliCommandModule.cs` (612 lines)
+- Service locator matches:
+  - `src/Cli/__Libraries/StellaOps.Cli.Plugins.Symbols/SymbolsCliCommandModule.cs`:546 var existing = services.GetService<ISymbolsClient>();
+  - `src/Cli/__Libraries/StellaOps.Cli.Plugins.Symbols/SymbolsCliCommandModule.cs`:566 var provider = serviceCollection.BuildServiceProvider();
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+- Replace service locator usage with constructor injection.
+
+## Testing Fullness Findings
+- Status: FAIL
+- Expected layers: Unit, Integration, Security, Offline
+- Detected test projects: none
+- Missing layers: Unit, Integration, Security, Offline
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- Add a unit test project named `<Project>.Tests` (or document exception).
+- Add integration tests for cross-component flows.
+- Add security tests for authn/authz or input validation.
+- Add offline/airgap coverage with fixtures only.

docs/implplan-blocked/audits/csproj-standards/Cli/__Libraries/StellaOps.Cli.Plugins.Timestamp/StellaOps.Cli.Plugins.Timestamp.md

@@ -0,0 +1,49 @@
+# Audit - StellaOps.Cli.Plugins.Timestamp
+
+## Project
+- Path: `src/Cli/__Libraries/StellaOps.Cli.Plugins.Timestamp/StellaOps.Cli.Plugins.Timestamp.csproj`
+- Module: `Cli`
+- Kind: `Plugin`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 2
+- Service locator usage (BuildServiceProvider/GetService): 5
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/Cli/__Libraries/StellaOps.Cli.Plugins.Timestamp/TimestampCliCommandModule.cs` (613 lines)
+  - `src/Cli/__Libraries/StellaOps.Cli.Plugins.Timestamp/EvidenceCliCommands.cs` (283 lines)
+- Service locator matches:
+  - `src/Cli/__Libraries/StellaOps.Cli.Plugins.Timestamp/TimestampCliCommandModule.cs`:149 var tsaClient = services.GetService<ITimestampingClient>();
+  - `src/Cli/__Libraries/StellaOps.Cli.Plugins.Timestamp/TimestampCliCommandModule.cs`:293 var verifier = services.GetService<ITimestampVerifier>();
+  - `src/Cli/__Libraries/StellaOps.Cli.Plugins.Timestamp/TimestampCliCommandModule.cs`:421 var parser = services.GetService<ITimestampTokenParser>();
+  - `src/Cli/__Libraries/StellaOps.Cli.Plugins.Timestamp/EvidenceCliCommands.cs`:87 var evidenceStore = services.GetService<IEvidenceStore>();
+  - `src/Cli/__Libraries/StellaOps.Cli.Plugins.Timestamp/EvidenceCliCommands.cs`:196 var evidenceStore = services.GetService<IEvidenceStore>();
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+- Replace service locator usage with constructor injection.
+
+## Testing Fullness Findings
+- Status: FAIL
+- Expected layers: Unit, Integration, Security, Offline
+- Detected test projects: none
+- Missing layers: Unit, Integration, Security, Offline
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- Add a unit test project named `<Project>.Tests` (or document exception).
+- Add integration tests for cross-component flows.
+- Add security tests for authn/authz or input validation.
+- Add offline/airgap coverage with fixtures only.

docs/implplan-blocked/audits/csproj-standards/Cli/__Libraries/StellaOps.Cli.Plugins.Verdict/StellaOps.Cli.Plugins.Verdict.md

@@ -0,0 +1,46 @@
+# Audit - StellaOps.Cli.Plugins.Verdict
+
+## Project
+- Path: `src/Cli/__Libraries/StellaOps.Cli.Plugins.Verdict/StellaOps.Cli.Plugins.Verdict.csproj`
+- Module: `Cli`
+- Kind: `Plugin`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 1
+- Service locator usage (BuildServiceProvider/GetService): 3
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/Cli/__Libraries/StellaOps.Cli.Plugins.Verdict/VerdictCliCommandModule.cs` (570 lines)
+- Service locator matches:
+  - `src/Cli/__Libraries/StellaOps.Cli.Plugins.Verdict/VerdictCliCommandModule.cs`:167 var logger = services.GetService<ILogger<VerdictCliCommandModule>>();
+  - `src/Cli/__Libraries/StellaOps.Cli.Plugins.Verdict/VerdictCliCommandModule.cs`:168 var timeProvider = services.GetService<TimeProvider>() ?? TimeProvider.System;
+  - `src/Cli/__Libraries/StellaOps.Cli.Plugins.Verdict/VerdictCliCommandModule.cs`:455 var httpClientFactory = services.GetService<IHttpClientFactory>();
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+- Replace service locator usage with constructor injection.
+
+## Testing Fullness Findings
+- Status: FAIL
+- Expected layers: Unit, Integration, Security, Offline
+- Detected test projects: none
+- Missing layers: Unit, Integration, Security, Offline
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- Add a unit test project named `<Project>.Tests` (or document exception).
+- Add integration tests for cross-component flows.
+- Add security tests for authn/authz or input validation.
+- Add offline/airgap coverage with fixtures only.

docs/implplan-blocked/audits/csproj-standards/Cli/__Libraries/StellaOps.Cli.Plugins.Vex/StellaOps.Cli.Plugins.Vex.md

@@ -0,0 +1,51 @@
+# Audit - StellaOps.Cli.Plugins.Vex
+
+## Project
+- Path: `src/Cli/__Libraries/StellaOps.Cli.Plugins.Vex/StellaOps.Cli.Plugins.Vex.csproj`
+- Module: `Cli`
+- Kind: `Plugin`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 5
+- Service locator usage (BuildServiceProvider/GetService): 4
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/Cli/__Libraries/StellaOps.Cli.Plugins.Vex/VexCliCommandModule.cs` (1297 lines)
+  - `src/Cli/__Libraries/StellaOps.Cli.Plugins.Vex/VexRekorCommandGroup.cs` (581 lines)
+  - `src/Cli/__Libraries/StellaOps.Cli.Plugins.Vex/AutoVexClient.cs` (302 lines)
+  - `src/Cli/__Libraries/StellaOps.Cli.Plugins.Vex/VexCliOutput.cs` (256 lines)
+  - `src/Cli/__Libraries/StellaOps.Cli.Plugins.Vex/VexCliValidation.cs` (130 lines)
+- Service locator matches:
+  - `src/Cli/__Libraries/StellaOps.Cli.Plugins.Vex/VexCliCommandModule.cs`:467 var loggerFactory = services.GetService<ILoggerFactory>();
+  - `src/Cli/__Libraries/StellaOps.Cli.Plugins.Vex/VexCliCommandModule.cs`:861 var logger = services.GetService<ILogger<VexCliCommandModule>>();
+  - `src/Cli/__Libraries/StellaOps.Cli.Plugins.Vex/VexCliCommandModule.cs`:1029 var client = services.GetService<IAutoVexClient>();
+  - `src/Cli/__Libraries/StellaOps.Cli.Plugins.Vex/VexCliCommandModule.cs`:1035 var httpClientFactory = services.GetService<IHttpClientFactory>();
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+- Replace service locator usage with constructor injection.
+
+## Testing Fullness Findings
+- Status: FAIL
+- Expected layers: Unit, Integration, Security, Offline
+- Detected test projects: none
+- Missing layers: Unit, Integration, Security, Offline
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- Add a unit test project named `<Project>.Tests` (or document exception).
+- Add integration tests for cross-component flows.
+- Add security tests for authn/authz or input validation.
+- Add offline/airgap coverage with fixtures only.