Add unit tests for SBOM ingestion and transformation

- Implement `SbomIngestServiceCollectionExtensionsTests` to verify the SBOM ingestion pipeline exports snapshots correctly.
- Create `SbomIngestTransformerTests` to ensure the transformation produces expected nodes and edges, including deduplication of license nodes and normalization of timestamps.
- Add `SbomSnapshotExporterTests` to test the export functionality for manifest, adjacency, nodes, and edges.
- Introduce `VexOverlayTransformerTests` to validate the transformation of VEX nodes and edges.
- Set up project file for the test project with necessary dependencies and configurations.
- Include JSON fixture files for testing purposes.

src/Scheduler/StellaOps.Scheduler.WebService/Runs/RunEndpoints.cs

@@ -3,7 +3,8 @@ using System.Collections.Generic;
 using System.Collections.Immutable;
 using System.ComponentModel.DataAnnotations;
 using System.Linq;
-using Microsoft.AspNetCore.Http;
+using System.Threading;
+using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.AspNetCore.Routing;
 using Microsoft.Extensions.Primitives;
@@ -15,31 +16,57 @@ using StellaOps.Scheduler.WebService.Auth;
 
 namespace StellaOps.Scheduler.WebService.Runs;
 
-internal static class RunEndpoints
-{
-    private const string ReadScope = "scheduler.runs.read";
-    private const string WriteScope = "scheduler.runs.write";
-    private const string PreviewScope = "scheduler.runs.preview";
+internal static class RunEndpoints
+{
+    private const string ReadScope = "scheduler.runs.read";
+    private const string WriteScope = "scheduler.runs.write";
+    private const string PreviewScope = "scheduler.runs.preview";
+    private const string ManageScope = "scheduler.runs.manage";
+    private const int DefaultRunListLimit = 50;
+
+    public static IEndpointRouteBuilder MapRunEndpoints(this IEndpointRouteBuilder routes)
+    {
+        var group = routes.MapGroup("/api/v1/scheduler/runs");
+
+        group.MapGet("/", ListRunsAsync);
+        group.MapGet("/queue/lag", GetQueueLagAsync);
+        group.MapGet("/{runId}/deltas", GetRunDeltasAsync);
+        group.MapGet("/{runId}/stream", StreamRunAsync);
+        group.MapGet("/{runId}", GetRunAsync);
+        group.MapPost("/", CreateRunAsync);
+        group.MapPost("/{runId}/cancel", CancelRunAsync);
+        group.MapPost("/{runId}/retry", RetryRunAsync);
+        group.MapPost("/preview", PreviewImpactAsync);
+
+        return routes;
+    }
 
-    public static IEndpointRouteBuilder MapRunEndpoints(this IEndpointRouteBuilder routes)
-    {
-        var group = routes.MapGroup("/api/v1/scheduler/runs");
-
-        group.MapGet("/", ListRunsAsync);
-        group.MapGet("/{runId}", GetRunAsync);
-        group.MapPost("/", CreateRunAsync);
-        group.MapPost("/{runId}/cancel", CancelRunAsync);
-        group.MapPost("/preview", PreviewImpactAsync);
-
-        return routes;
-    }
-
-    private static async Task<IResult> ListRunsAsync(
-        HttpContext httpContext,
-        [FromServices] ITenantContextAccessor tenantAccessor,
-        [FromServices] IScopeAuthorizer scopeAuthorizer,
-        [FromServices] IRunRepository repository,
-        CancellationToken cancellationToken)
+    private static IResult GetQueueLagAsync(
+        HttpContext httpContext,
+        [FromServices] ITenantContextAccessor tenantAccessor,
+        [FromServices] IScopeAuthorizer scopeAuthorizer,
+        [FromServices] IQueueLagSummaryProvider queueLagProvider)
+    {
+        try
+        {
+            scopeAuthorizer.EnsureScope(httpContext, ReadScope);
+            tenantAccessor.GetTenant(httpContext);
+
+            var summary = queueLagProvider.Capture();
+            return Results.Ok(summary);
+        }
+        catch (Exception ex) when (ex is ArgumentException or ValidationException)
+        {
+            return Results.BadRequest(new { error = ex.Message });
+        }
+    }
+
+    private static async Task<IResult> ListRunsAsync(
+        HttpContext httpContext,
+        [FromServices] ITenantContextAccessor tenantAccessor,
+        [FromServices] IScopeAuthorizer scopeAuthorizer,
+        [FromServices] IRunRepository repository,
+        CancellationToken cancellationToken)
     {
         try
         {
@@ -50,24 +77,35 @@ internal static class RunEndpoints
                 ? scheduleValues.ToString().Trim()
                 : null;
 
-            var states = ParseRunStates(httpContext.Request.Query.TryGetValue("state", out var stateValues) ? stateValues : StringValues.Empty);
-            var createdAfter = SchedulerEndpointHelpers.TryParseDateTimeOffset(httpContext.Request.Query.TryGetValue("createdAfter", out var createdAfterValues) ? createdAfterValues.ToString() : null);
-            var limit = SchedulerEndpointHelpers.TryParsePositiveInt(httpContext.Request.Query.TryGetValue("limit", out var limitValues) ? limitValues.ToString() : null);
-
-            var sortAscending = httpContext.Request.Query.TryGetValue("sort", out var sortValues) &&
-                                 sortValues.Any(value => string.Equals(value, "asc", StringComparison.OrdinalIgnoreCase));
-
-            var options = new RunQueryOptions
-            {
-                ScheduleId = string.IsNullOrWhiteSpace(scheduleId) ? null : scheduleId,
-                States = states,
-                CreatedAfter = createdAfter,
-                Limit = limit,
-                SortAscending = sortAscending,
-            };
-
-            var runs = await repository.ListAsync(tenant.TenantId, options, cancellationToken: cancellationToken).ConfigureAwait(false);
-            return Results.Ok(new RunCollectionResponse(runs));
+            var states = ParseRunStates(httpContext.Request.Query.TryGetValue("state", out var stateValues) ? stateValues : StringValues.Empty);
+            var createdAfter = SchedulerEndpointHelpers.TryParseDateTimeOffset(httpContext.Request.Query.TryGetValue("createdAfter", out var createdAfterValues) ? createdAfterValues.ToString() : null);
+            var limit = SchedulerEndpointHelpers.TryParsePositiveInt(httpContext.Request.Query.TryGetValue("limit", out var limitValues) ? limitValues.ToString() : null);
+            var cursor = SchedulerEndpointHelpers.TryParseRunCursor(httpContext.Request.Query.TryGetValue("cursor", out var cursorValues) ? cursorValues.ToString() : null);
+
+            var sortAscending = httpContext.Request.Query.TryGetValue("sort", out var sortValues) &&
+                                 sortValues.Any(value => string.Equals(value, "asc", StringComparison.OrdinalIgnoreCase));
+
+            var appliedLimit = limit ?? DefaultRunListLimit;
+            var options = new RunQueryOptions
+            {
+                ScheduleId = string.IsNullOrWhiteSpace(scheduleId) ? null : scheduleId,
+                States = states,
+                CreatedAfter = createdAfter,
+                Cursor = cursor,
+                Limit = appliedLimit,
+                SortAscending = sortAscending,
+            };
+
+            var runs = await repository.ListAsync(tenant.TenantId, options, cancellationToken: cancellationToken).ConfigureAwait(false);
+
+            string? nextCursor = null;
+            if (runs.Count == appliedLimit && runs.Count > 0)
+            {
+                var last = runs[^1];
+                nextCursor = SchedulerEndpointHelpers.CreateRunCursor(last);
+            }
+
+            return Results.Ok(new RunCollectionResponse(runs, nextCursor));
         }
         catch (Exception ex) when (ex is ArgumentException or ValidationException)
         {
@@ -75,32 +113,59 @@ internal static class RunEndpoints
         }
     }
 
-    private static async Task<IResult> GetRunAsync(
-        HttpContext httpContext,
-        string runId,
-        [FromServices] ITenantContextAccessor tenantAccessor,
-        [FromServices] IScopeAuthorizer scopeAuthorizer,
-        [FromServices] IRunRepository repository,
-        CancellationToken cancellationToken)
-    {
-        try
-        {
-            scopeAuthorizer.EnsureScope(httpContext, ReadScope);
-            var tenant = tenantAccessor.GetTenant(httpContext);
-
-            var run = await repository.GetAsync(tenant.TenantId, runId, cancellationToken: cancellationToken).ConfigureAwait(false);
-            if (run is null)
-            {
-                return Results.NotFound();
-            }
-
-            return Results.Ok(new RunResponse(run));
-        }
-        catch (Exception ex) when (ex is ArgumentException or ValidationException)
-        {
-            return Results.BadRequest(new { error = ex.Message });
-        }
-    }
+    private static async Task<IResult> GetRunAsync(
+        HttpContext httpContext,
+        string runId,
+        [FromServices] ITenantContextAccessor tenantAccessor,
+        [FromServices] IScopeAuthorizer scopeAuthorizer,
+        [FromServices] IRunRepository repository,
+        CancellationToken cancellationToken)
+    {
+        try
+        {
+            scopeAuthorizer.EnsureScope(httpContext, ReadScope);
+            var tenant = tenantAccessor.GetTenant(httpContext);
+
+            var run = await repository.GetAsync(tenant.TenantId, runId, cancellationToken: cancellationToken).ConfigureAwait(false);
+            if (run is null)
+            {
+                return Results.NotFound();
+            }
+
+            return Results.Ok(new RunResponse(run));
+        }
+        catch (Exception ex) when (ex is ArgumentException or ValidationException)
+        {
+            return Results.BadRequest(new { error = ex.Message });
+        }
+    }
+
+    private static async Task<IResult> GetRunDeltasAsync(
+        HttpContext httpContext,
+        string runId,
+        [FromServices] ITenantContextAccessor tenantAccessor,
+        [FromServices] IScopeAuthorizer scopeAuthorizer,
+        [FromServices] IRunRepository repository,
+        CancellationToken cancellationToken)
+    {
+        try
+        {
+            scopeAuthorizer.EnsureScope(httpContext, ReadScope);
+            var tenant = tenantAccessor.GetTenant(httpContext);
+
+            var run = await repository.GetAsync(tenant.TenantId, runId, cancellationToken: cancellationToken).ConfigureAwait(false);
+            if (run is null)
+            {
+                return Results.NotFound();
+            }
+
+            return Results.Ok(new RunDeltaCollectionResponse(run.Deltas));
+        }
+        catch (Exception ex) when (ex is ArgumentException or ValidationException)
+        {
+            return Results.BadRequest(new { error = ex.Message });
+        }
+    }
 
     private static async Task<IResult> CreateRunAsync(
         HttpContext httpContext,
@@ -116,7 +181,7 @@ internal static class RunEndpoints
     {
         try
         {
-            scopeAuthorizer.EnsureScope(httpContext, WriteScope);
+            scopeAuthorizer.EnsureScope(httpContext, ManageScope);
             var tenant = tenantAccessor.GetTenant(httpContext);
 
             if (string.IsNullOrWhiteSpace(request.ScheduleId))
@@ -184,11 +249,11 @@ internal static class RunEndpoints
         }
     }
 
-    private static async Task<IResult> CancelRunAsync(
-        HttpContext httpContext,
-        string runId,
-        [FromServices] ITenantContextAccessor tenantAccessor,
-        [FromServices] IScopeAuthorizer scopeAuthorizer,
+    private static async Task<IResult> CancelRunAsync(
+        HttpContext httpContext,
+        string runId,
+        [FromServices] ITenantContextAccessor tenantAccessor,
+        [FromServices] IScopeAuthorizer scopeAuthorizer,
         [FromServices] IRunRepository repository,
         [FromServices] IRunSummaryService runSummaryService,
         [FromServices] ISchedulerAuditService auditService,
@@ -243,9 +308,145 @@ internal static class RunEndpoints
         }
         catch (Exception ex) when (ex is ArgumentException or ValidationException)
         {
-            return Results.BadRequest(new { error = ex.Message });
-        }
-    }
+            return Results.BadRequest(new { error = ex.Message });
+        }
+    }
+
+    private static async Task<IResult> RetryRunAsync(
+        HttpContext httpContext,
+        string runId,
+        [FromServices] ITenantContextAccessor tenantAccessor,
+        [FromServices] IScopeAuthorizer scopeAuthorizer,
+        [FromServices] IScheduleRepository scheduleRepository,
+        [FromServices] IRunRepository runRepository,
+        [FromServices] IRunSummaryService runSummaryService,
+        [FromServices] ISchedulerAuditService auditService,
+        [FromServices] TimeProvider timeProvider,
+        CancellationToken cancellationToken)
+    {
+        try
+        {
+            scopeAuthorizer.EnsureScope(httpContext, ManageScope);
+            var tenant = tenantAccessor.GetTenant(httpContext);
+
+            var existing = await runRepository.GetAsync(tenant.TenantId, runId, cancellationToken: cancellationToken).ConfigureAwait(false);
+            if (existing is null)
+            {
+                return Results.NotFound();
+            }
+
+            if (string.IsNullOrWhiteSpace(existing.ScheduleId))
+            {
+                return Results.BadRequest(new { error = "Run cannot be retried because it is not associated with a schedule." });
+            }
+
+            if (!RunStateMachine.IsTerminal(existing.State))
+            {
+                return Results.Conflict(new { error = "Run is not in a terminal state and cannot be retried." });
+            }
+
+            var schedule = await scheduleRepository.GetAsync(tenant.TenantId, existing.ScheduleId!, cancellationToken: cancellationToken).ConfigureAwait(false);
+            if (schedule is null)
+            {
+                return Results.BadRequest(new { error = "Associated schedule no longer exists." });
+            }
+
+            var now = timeProvider.GetUtcNow();
+            var newRunId = SchedulerEndpointHelpers.GenerateIdentifier("run");
+            var baselineReason = existing.Reason ?? RunReason.Empty;
+            var manualReason = string.IsNullOrWhiteSpace(baselineReason.ManualReason)
+                ? $"retry-of:{existing.Id}"
+                : $"{baselineReason.ManualReason};retry-of:{existing.Id}";
+
+            var newReason = new RunReason(
+                manualReason,
+                baselineReason.ConselierExportId,
+                baselineReason.ExcitorExportId,
+                baselineReason.Cursor)
+            {
+                ImpactWindowFrom = baselineReason.ImpactWindowFrom,
+                ImpactWindowTo = baselineReason.ImpactWindowTo
+            };
+
+            var retryRun = new Run(
+                newRunId,
+                tenant.TenantId,
+                RunTrigger.Manual,
+                RunState.Planning,
+                RunStats.Empty,
+                now,
+                newReason,
+                existing.ScheduleId,
+                retryOf: existing.Id);
+
+            await runRepository.InsertAsync(retryRun, cancellationToken: cancellationToken).ConfigureAwait(false);
+
+            if (!string.IsNullOrWhiteSpace(retryRun.ScheduleId))
+            {
+                await runSummaryService.ProjectAsync(retryRun, cancellationToken).ConfigureAwait(false);
+            }
+
+            await auditService.WriteAsync(
+                new SchedulerAuditEvent(
+                    tenant.TenantId,
+                    "scheduler.run",
+                    "retry",
+                    SchedulerEndpointHelpers.ResolveAuditActor(httpContext),
+                    RunId: retryRun.Id,
+                    ScheduleId: retryRun.ScheduleId,
+                    Metadata: BuildMetadata(
+                        ("state", retryRun.State.ToString().ToLowerInvariant()),
+                        ("retryOf", existing.Id),
+                        ("trigger", retryRun.Trigger.ToString().ToLowerInvariant()))),
+                cancellationToken).ConfigureAwait(false);
+
+            return Results.Created($"/api/v1/scheduler/runs/{retryRun.Id}", new RunResponse(retryRun));
+        }
+        catch (InvalidOperationException ex)
+        {
+            return Results.BadRequest(new { error = ex.Message });
+        }
+        catch (Exception ex) when (ex is ArgumentException or ValidationException)
+        {
+            return Results.BadRequest(new { error = ex.Message });
+        }
+    }
+
+    private static async Task StreamRunAsync(
+        HttpContext httpContext,
+        string runId,
+        [FromServices] ITenantContextAccessor tenantAccessor,
+        [FromServices] IScopeAuthorizer scopeAuthorizer,
+        [FromServices] IRunRepository runRepository,
+        [FromServices] IRunStreamCoordinator runStreamCoordinator,
+        CancellationToken cancellationToken)
+    {
+        try
+        {
+            scopeAuthorizer.EnsureScope(httpContext, ReadScope);
+            var tenant = tenantAccessor.GetTenant(httpContext);
+
+            var run = await runRepository.GetAsync(tenant.TenantId, runId, cancellationToken: cancellationToken).ConfigureAwait(false);
+            if (run is null)
+            {
+                await Results.NotFound().ExecuteAsync(httpContext);
+                return;
+            }
+
+            await runStreamCoordinator.StreamAsync(httpContext, tenant.TenantId, run, cancellationToken).ConfigureAwait(false);
+        }
+        catch (OperationCanceledException) when (cancellationToken.IsCancellationRequested)
+        {
+            // Client disconnected; nothing to do.
+        }
+        catch (Exception ex) when (ex is ArgumentException or ValidationException)
+        {
+            if (!httpContext.Response.HasStarted)
+            {
+                await Results.BadRequest(new { error = ex.Message }).ExecuteAsync(httpContext);
+            }
+        }
+    }
 
     private static async Task<IResult> PreviewImpactAsync(
         HttpContext httpContext,