semi implemented and features implemented save checkpoint

docs/implplan-blocked/audits/csproj-standards/Signer/StellaOps.Signer/StellaOps.Signer.Core/StellaOps.Signer.Core.md

@@ -0,0 +1,52 @@
+# Audit - StellaOps.Signer.Core
+
+## Project
+- Path: `src/Signer/StellaOps.Signer/StellaOps.Signer.Core/StellaOps.Signer.Core.csproj`
+- Module: `Signer`
+- Kind: `Service`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 12
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/Signer/StellaOps.Signer/StellaOps.Signer.Core/Ceremonies/CeremonyOrchestrator.cs` (551 lines)
+  - `src/Signer/StellaOps.Signer/StellaOps.Signer.Core/Predicates/DeltaPredicateSchemas.cs` (462 lines)
+  - `src/Signer/StellaOps.Signer/StellaOps.Signer.Core/PredicateTypes.cs` (396 lines)
+  - `src/Signer/StellaOps.Signer/StellaOps.Signer.Core/Ceremonies/CeremonyModels.cs` (380 lines)
+  - `src/Signer/StellaOps.Signer/StellaOps.Signer.Core/Ceremonies/CeremonyAuditEvents.cs` (233 lines)
+  - `src/Signer/StellaOps.Signer/StellaOps.Signer.Core/SignerStatementBuilder.cs` (169 lines)
+  - `src/Signer/StellaOps.Signer/StellaOps.Signer.Core/Ceremonies/CeremonyOptions.cs` (159 lines)
+  - `src/Signer/StellaOps.Signer/StellaOps.Signer.Core/Ceremonies/ICeremonyOrchestrator.cs` (153 lines)
+  - `src/Signer/StellaOps.Signer/StellaOps.Signer.Core/SignerPipeline.cs` (147 lines)
+  - `src/Signer/StellaOps.Signer/StellaOps.Signer.Core/Ceremonies/CeremonyStateMachine.cs` (140 lines)
+  - `src/Signer/StellaOps.Signer/StellaOps.Signer.Core/Ceremonies/ICeremonyRepository.cs` (117 lines)
+  - `src/Signer/StellaOps.Signer/StellaOps.Signer.Core/SignerContracts.cs` (105 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: FAIL
+- Expected layers: Unit
+- Detected test projects: none
+- Missing layers: Unit
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Intent tagging required for regulatory modules.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- Add a unit test project named `<Project>.Tests` (or document exception).

docs/implplan-blocked/audits/csproj-standards/Signer/StellaOps.Signer/StellaOps.Signer.Infrastructure/StellaOps.Signer.Infrastructure.md

@@ -0,0 +1,44 @@
+# Audit - StellaOps.Signer.Infrastructure
+
+## Project
+- Path: `src/Signer/StellaOps.Signer/StellaOps.Signer.Infrastructure/StellaOps.Signer.Infrastructure.csproj`
+- Module: `Signer`
+- Kind: `Service`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 4
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/Signer/StellaOps.Signer/StellaOps.Signer.Infrastructure/Signing/CryptoDsseSigner.cs` (280 lines)
+  - `src/Signer/StellaOps.Signer/StellaOps.Signer.Infrastructure/Sigstore/RekorHttpClient.cs` (268 lines)
+  - `src/Signer/StellaOps.Signer/StellaOps.Signer.Infrastructure/Sigstore/SigstoreSigningService.cs` (199 lines)
+  - `src/Signer/StellaOps.Signer/StellaOps.Signer.Infrastructure/Sigstore/FulcioHttpClient.cs` (190 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: FAIL
+- Expected layers: Unit
+- Detected test projects: none
+- Missing layers: Unit
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Intent tagging required for regulatory modules.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- Add a unit test project named `<Project>.Tests` (or document exception).

docs/implplan-blocked/audits/csproj-standards/Signer/StellaOps.Signer/StellaOps.Signer.WebService/StellaOps.Signer.WebService.md

@@ -0,0 +1,46 @@
+# Audit - StellaOps.Signer.WebService
+
+## Project
+- Path: `src/Signer/StellaOps.Signer/StellaOps.Signer.WebService/StellaOps.Signer.WebService.csproj`
+- Module: `Signer`
+- Kind: `WebService`
+- SDK: `Microsoft.NET.Sdk.Web`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 3
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/Signer/StellaOps.Signer/StellaOps.Signer.WebService/Endpoints/CeremonyEndpoints.cs` (590 lines)
+  - `src/Signer/StellaOps.Signer/StellaOps.Signer.WebService/Endpoints/KeyRotationEndpoints.cs` (452 lines)
+  - `src/Signer/StellaOps.Signer/StellaOps.Signer.WebService/Endpoints/SignerEndpoints.cs` (358 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: FAIL
+- Expected layers: Unit, Integration, Security, Offline
+- Detected test projects: none
+- Missing layers: Unit, Integration, Security, Offline
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Intent tagging required for regulatory modules.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- Add a unit test project named `<Project>.Tests` (or document exception).
+- Add integration tests for cross-component flows.
+- Add security tests for authn/authz or input validation.
+- Add offline/airgap coverage with fixtures only.

docs/implplan-blocked/audits/csproj-standards/Signer/__Libraries/StellaOps.Signer.KeyManagement/StellaOps.Signer.KeyManagement.md

@@ -0,0 +1,46 @@
+# Audit - StellaOps.Signer.KeyManagement
+
+## Project
+- Path: `src/Signer/__Libraries/StellaOps.Signer.KeyManagement/StellaOps.Signer.KeyManagement.csproj`
+- Module: `Signer`
+- Kind: `Library`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 6
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/Signer/__Libraries/StellaOps.Signer.KeyManagement/KeyRotationService.cs` (537 lines)
+  - `src/Signer/__Libraries/StellaOps.Signer.KeyManagement/TrustAnchorManager.cs` (418 lines)
+  - `src/Signer/__Libraries/StellaOps.Signer.KeyManagement/KeyRotationAuditRepository.cs` (411 lines)
+  - `src/Signer/__Libraries/StellaOps.Signer.KeyManagement/IKeyRotationService.cs` (285 lines)
+  - `src/Signer/__Libraries/StellaOps.Signer.KeyManagement/ITrustAnchorManager.cs` (229 lines)
+  - `src/Signer/__Libraries/StellaOps.Signer.KeyManagement/Entities/KeyEntities.cs` (174 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: FAIL
+- Expected layers: Unit
+- Detected test projects: none
+- Missing layers: Unit
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Intent tagging required for regulatory modules.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- Add a unit test project named `<Project>.Tests` (or document exception).

docs/implplan-blocked/audits/csproj-standards/Signer/__Libraries/StellaOps.Signer.Keyless/StellaOps.Signer.Keyless.md

@@ -0,0 +1,49 @@
+# Audit - StellaOps.Signer.Keyless
+
+## Project
+- Path: `src/Signer/__Libraries/StellaOps.Signer.Keyless/StellaOps.Signer.Keyless.csproj`
+- Module: `Signer`
+- Kind: `Library`
+- SDK: `Microsoft.NET.Sdk`
+- TargetFramework: `net10.0`
+- Audit date (UTC): 2026-01-30
+
+## Coding Standards Findings
+- Status: FAIL
+- Nullable: enable
+- TreatWarningsAsErrors: explicit true
+- Deterministic: inherited true
+- 100-line rule violations: 9
+- Service locator usage (BuildServiceProvider/GetService): 0
+- Analyzer enforcement: missing repo-wide (see summary).
+
+### Details
+- 100-line files:
+  - `src/Signer/__Libraries/StellaOps.Signer.Keyless/ICertificateChainValidator.cs` (527 lines)
+  - `src/Signer/__Libraries/StellaOps.Signer.Keyless/HttpFulcioClient.cs` (308 lines)
+  - `src/Signer/__Libraries/StellaOps.Signer.Keyless/KeylessDsseSigner.cs` (208 lines)
+  - `src/Signer/__Libraries/StellaOps.Signer.Keyless/AmbientOidcTokenProvider.cs` (187 lines)
+  - `src/Signer/__Libraries/StellaOps.Signer.Keyless/SignerKeylessOptions.cs` (170 lines)
+  - `src/Signer/__Libraries/StellaOps.Signer.Keyless/EphemeralKeyPair.cs` (151 lines)
+  - `src/Signer/__Libraries/StellaOps.Signer.Keyless/KeylessSigningExceptions.cs` (134 lines)
+  - `src/Signer/__Libraries/StellaOps.Signer.Keyless/IOidcTokenProvider.cs` (131 lines)
+  - `src/Signer/__Libraries/StellaOps.Signer.Keyless/IFulcioClient.cs` (107 lines)
+- Service locator matches:
+  - none
+
+### Fix Guidance
+- Split files over 100 lines into smaller types or partials.
+
+## Testing Fullness Findings
+- Status: FAIL
+- Expected layers: Unit
+- Detected test projects: none
+- Missing layers: Unit
+
+### Manual checks required
+- Observability contract tests for WebService/Worker.
+- Intent tagging required for regulatory modules.
+- Offline execution (tests must run without network access).
+
+### Fix Guidance
+- Add a unit test project named `<Project>.Tests` (or document exception).