semi implemented and features implemented save checkpoint

docs/implplan-blocked/audits/csproj-standards/Cryptography/StellaOps.Cryptography.Plugin.Eidas/StellaOps.Cryptography.Plugin.Eidas.md

@@ -0,0 +1,56 @@
+# Audit - StellaOps.Cryptography.Plugin.Eidas
+
+## Project
+- Path: `src/Cryptography/StellaOps.Cryptography.Plugin.Eidas/StellaOps.Cryptography.Plugin.Eidas.csproj`
+- Module: `Cryptography`
+- Kind: `Plugin`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 12
+- Service locator usage (BuildServiceProvider/GetService): 3
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/Cryptography/StellaOps.Cryptography.Plugin.Eidas/EidasPlugin.cs` (517 lines)
+  - `src/Cryptography/StellaOps.Cryptography.Plugin.Eidas/Timestamping/EuTrustListService.cs` (405 lines)
+  - `src/Cryptography/StellaOps.Cryptography.Plugin.Eidas/Timestamping/QualifiedTimestampVerifier.cs` (403 lines)
+  - `src/Cryptography/StellaOps.Cryptography.Plugin.Eidas/Timestamping/CadesSignatureBuilder.cs` (318 lines)
+  - `src/Cryptography/StellaOps.Cryptography.Plugin.Eidas/Timestamping/QualifiedTsaConfiguration.cs` (257 lines)
+  - `src/Cryptography/StellaOps.Cryptography.Plugin.Eidas/Timestamping/TimestampModeSelector.cs` (216 lines)
+  - `src/Cryptography/StellaOps.Cryptography.Plugin.Eidas/Timestamping/IQualifiedTimestampVerifier.cs` (214 lines)
+  - `src/Cryptography/StellaOps.Cryptography.Plugin.Eidas/Timestamping/ICadesSignatureBuilder.cs` (210 lines)
+  - `src/Cryptography/StellaOps.Cryptography.Plugin.Eidas/Tests/EtsiConformanceTestVectors.cs` (189 lines)
+  - `src/Cryptography/StellaOps.Cryptography.Plugin.Eidas/Timestamping/IEuTrustListService.cs` (181 lines)
+  - `src/Cryptography/StellaOps.Cryptography.Plugin.Eidas/Timestamping/EidasTimestampingExtensions.cs` (145 lines)
+  - `src/Cryptography/StellaOps.Cryptography.Plugin.Eidas/Timestamping/ITimestampModeSelector.cs` (103 lines)
+- Service locator matches:
+  - `src/Cryptography/StellaOps.Cryptography.Plugin.Eidas/EidasPlugin.cs`:76 _cadesBuilder = context.Services.GetService<ICadesSignatureBuilder>();
+  - `src/Cryptography/StellaOps.Cryptography.Plugin.Eidas/EidasPlugin.cs`:77 _timestampModeSelector = context.Services.GetService<ITimestampModeSelector>();
+  - `src/Cryptography/StellaOps.Cryptography.Plugin.Eidas/EidasPlugin.cs`:78 _timestampVerifier = context.Services.GetService<IQualifiedTimestampVerifier>();
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+- Replace service locator usage with constructor injection.
+
+## Testing Fullness Findings
+- Status: FAIL
+- Expected layers: Unit, Integration, Security, Offline
+- Detected test projects: src/__Libraries/StellaOps.Cryptography.Plugin.EIDAS.Tests/StellaOps.Cryptography.Plugin.EIDAS.Tests.csproj [Unit]
+- Missing layers: Integration, Security, Offline
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- Add integration tests for cross-component flows.
+- Add security tests for authn/authz or input validation.
+- Add offline/airgap coverage with fixtures only.

docs/implplan-blocked/audits/csproj-standards/Cryptography/StellaOps.Cryptography.Plugin.Fips/StellaOps.Cryptography.Plugin.Fips.md

@@ -0,0 +1,43 @@
+# Audit - StellaOps.Cryptography.Plugin.Fips
+
+## Project
+- Path: `src/Cryptography/StellaOps.Cryptography.Plugin.Fips/StellaOps.Cryptography.Plugin.Fips.csproj`
+- Module: `Cryptography`
+- Kind: `Plugin`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 1
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/Cryptography/StellaOps.Cryptography.Plugin.Fips/FipsPlugin.cs` (431 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: FAIL
+- Expected layers: Unit, Integration, Security, Offline
+- Detected test projects: none
+- Missing layers: Unit, Integration, Security, Offline
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- Add a unit test project named `<Project>.Tests` (or document exception).
+- Add integration tests for cross-component flows.
+- Add security tests for authn/authz or input validation.
+- Add offline/airgap coverage with fixtures only.

docs/implplan-blocked/audits/csproj-standards/Cryptography/StellaOps.Cryptography.Plugin.Gost/StellaOps.Cryptography.Plugin.Gost.md

@@ -0,0 +1,43 @@
+# Audit - StellaOps.Cryptography.Plugin.Gost
+
+## Project
+- Path: `src/Cryptography/StellaOps.Cryptography.Plugin.Gost/StellaOps.Cryptography.Plugin.Gost.csproj`
+- Module: `Cryptography`
+- Kind: `Plugin`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 1
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/Cryptography/StellaOps.Cryptography.Plugin.Gost/GostPlugin.cs` (342 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: FAIL
+- Expected layers: Unit, Integration, Security, Offline
+- Detected test projects: none
+- Missing layers: Unit, Integration, Security, Offline
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- Add a unit test project named `<Project>.Tests` (or document exception).
+- Add integration tests for cross-component flows.
+- Add security tests for authn/authz or input validation.
+- Add offline/airgap coverage with fixtures only.

docs/implplan-blocked/audits/csproj-standards/Cryptography/StellaOps.Cryptography.Plugin.Hsm/StellaOps.Cryptography.Plugin.Hsm.md

@@ -0,0 +1,44 @@
+# Audit - StellaOps.Cryptography.Plugin.Hsm
+
+## Project
+- Path: `src/Cryptography/StellaOps.Cryptography.Plugin.Hsm/StellaOps.Cryptography.Plugin.Hsm.csproj`
+- Module: `Cryptography`
+- Kind: `Plugin`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 2
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/Cryptography/StellaOps.Cryptography.Plugin.Hsm/Pkcs11HsmClientImpl.cs` (717 lines)
+  - `src/Cryptography/StellaOps.Cryptography.Plugin.Hsm/HsmPlugin.cs` (477 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: FAIL
+- Expected layers: Unit, Integration, Security, Offline
+- Detected test projects: none
+- Missing layers: Unit, Integration, Security, Offline
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- Add a unit test project named `<Project>.Tests` (or document exception).
+- Add integration tests for cross-component flows.
+- Add security tests for authn/authz or input validation.
+- Add offline/airgap coverage with fixtures only.

docs/implplan-blocked/audits/csproj-standards/Cryptography/StellaOps.Cryptography.Plugin.Sm/StellaOps.Cryptography.Plugin.Sm.md

@@ -0,0 +1,43 @@
+# Audit - StellaOps.Cryptography.Plugin.Sm
+
+## Project
+- Path: `src/Cryptography/StellaOps.Cryptography.Plugin.Sm/StellaOps.Cryptography.Plugin.Sm.csproj`
+- Module: `Cryptography`
+- Kind: `Plugin`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 1
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/Cryptography/StellaOps.Cryptography.Plugin.Sm/SmPlugin.cs` (364 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: FAIL
+- Expected layers: Unit, Integration, Security, Offline
+- Detected test projects: none
+- Missing layers: Unit, Integration, Security, Offline
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- Add a unit test project named `<Project>.Tests` (or document exception).
+- Add integration tests for cross-component flows.
+- Add security tests for authn/authz or input validation.
+- Add offline/airgap coverage with fixtures only.

docs/implplan-blocked/audits/csproj-standards/Cryptography/StellaOps.Cryptography.Plugin/StellaOps.Cryptography.Plugin.md

@@ -0,0 +1,40 @@
+# Audit - StellaOps.Cryptography.Plugin
+
+## Project
+- Path: `src/Cryptography/StellaOps.Cryptography.Plugin/StellaOps.Cryptography.Plugin.csproj`
+- Module: `Cryptography`
+- Kind: `Service`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 1
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/Cryptography/StellaOps.Cryptography.Plugin/CryptoPluginBase.cs` (167 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: PASS
+- Expected layers: Unit
+- Detected test projects: src/__Libraries/__Tests/StellaOps.Cryptography.Plugin.OfflineVerification.Tests/StellaOps.Cryptography.Plugin.OfflineVerification.Tests.csproj [Offline], src/__Libraries/StellaOps.Cryptography.Plugin.SmSoft.Tests/StellaOps.Cryptography.Plugin.SmSoft.Tests.csproj [Unit], src/__Libraries/StellaOps.Cryptography.Plugin.SmRemote.Tests/StellaOps.Cryptography.Plugin.SmRemote.Tests.csproj [Unit], src/__Libraries/StellaOps.Cryptography.Plugin.EIDAS.Tests/StellaOps.Cryptography.Plugin.EIDAS.Tests.csproj [Unit]
+- Missing layers: none
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- None.

docs/implplan-blocked/audits/csproj-standards/Cryptography/StellaOps.Cryptography.Profiles.Ecdsa/StellaOps.Cryptography.Profiles.Ecdsa.md

@@ -0,0 +1,40 @@
+# Audit - StellaOps.Cryptography.Profiles.Ecdsa
+
+## Project
+- Path: `src/Cryptography/StellaOps.Cryptography.Profiles.Ecdsa/StellaOps.Cryptography.Profiles.Ecdsa.csproj`
+- Module: `Cryptography`
+- Kind: `Service`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: PASS
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 0
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - none
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- None.
+
+## Testing Fullness Findings
+- Status: FAIL
+- Expected layers: Unit
+- Detected test projects: none
+- Missing layers: Unit
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- Add a unit test project named `<Project>.Tests` (or document exception).

docs/implplan-blocked/audits/csproj-standards/Cryptography/StellaOps.Cryptography.Profiles.EdDsa/StellaOps.Cryptography.Profiles.EdDsa.md

@@ -0,0 +1,40 @@
+# Audit - StellaOps.Cryptography.Profiles.EdDsa
+
+## Project
+- Path: `src/Cryptography/StellaOps.Cryptography.Profiles.EdDsa/StellaOps.Cryptography.Profiles.EdDsa.csproj`
+- Module: `Cryptography`
+- Kind: `Service`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: PASS
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 0
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - none
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- None.
+
+## Testing Fullness Findings
+- Status: FAIL
+- Expected layers: Unit
+- Detected test projects: none
+- Missing layers: Unit
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- Add a unit test project named `<Project>.Tests` (or document exception).

docs/implplan-blocked/audits/csproj-standards/Cryptography/StellaOps.Cryptography/StellaOps.Cryptography.md

@@ -0,0 +1,47 @@
+# Audit - StellaOps.Cryptography
+
+## Project
+- Path: `src/Cryptography/StellaOps.Cryptography/StellaOps.Cryptography.csproj`
+- Module: `Cryptography`
+- Kind: `Service`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 8
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/Cryptography/StellaOps.Cryptography/KeyEscrow/KeyEscrowService.cs` (505 lines)
+  - `src/Cryptography/StellaOps.Cryptography/KeyEscrow/CeremonyAuthorizedRecoveryService.cs` (384 lines)
+  - `src/Cryptography/StellaOps.Cryptography/KeyEscrow/GaloisField256.cs` (260 lines)
+  - `src/Cryptography/StellaOps.Cryptography/KeyEscrow/KeyEscrowModels.cs` (254 lines)
+  - `src/Cryptography/StellaOps.Cryptography/KeyEscrow/IEscrowAgentStore.cs` (241 lines)
+  - `src/Cryptography/StellaOps.Cryptography/KeyEscrow/ShamirSecretSharing.cs` (237 lines)
+  - `src/Cryptography/StellaOps.Cryptography/KeyEscrow/IKeyEscrowService.cs` (207 lines)
+  - `src/Cryptography/StellaOps.Cryptography/MultiProfileSigner.cs` (152 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: PASS
+- Expected layers: Unit
+- Detected test projects: src/__Libraries/__Tests/StellaOps.Cryptography.Tests/StellaOps.Cryptography.Tests.csproj [Unit], src/__Libraries/__Tests/StellaOps.Cryptography.Plugin.OfflineVerification.Tests/StellaOps.Cryptography.Plugin.OfflineVerification.Tests.csproj [Offline], src/__Libraries/__Tests/StellaOps.Cryptography.Kms.Tests/StellaOps.Cryptography.Kms.Tests.csproj [Unit], src/Cryptography/__Tests/StellaOps.Cryptography.Tests/StellaOps.Cryptography.Tests.csproj [Unit], src/__Libraries/StellaOps.Cryptography.Tests/StellaOps.Cryptography.Tests.csproj [Unit], src/__Libraries/StellaOps.Cryptography.PluginLoader.Tests/StellaOps.Cryptography.PluginLoader.Tests.csproj [Unit], src/__Libraries/StellaOps.Cryptography.Plugin.SmSoft.Tests/StellaOps.Cryptography.Plugin.SmSoft.Tests.csproj [Unit], src/__Libraries/StellaOps.Cryptography.Plugin.SmRemote.Tests/StellaOps.Cryptography.Plugin.SmRemote.Tests.csproj [Unit], src/__Libraries/StellaOps.Cryptography.Plugin.EIDAS.Tests/StellaOps.Cryptography.Plugin.EIDAS.Tests.csproj [Unit]
+- Missing layers: none
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- None.