up

2025-11-29 11:08:08 +02:00
parent 7e7be4d2fd
commit 3488b22c0c
102 changed files with 18487 additions and 969 deletions
--- a/docs/product-advisories/ADVISORY_INDEX.md
+++ b/docs/product-advisories/ADVISORY_INDEX.md
@@ -157,6 +157,107 @@ These are the authoritative advisories to reference for implementation:
  - `docs/security/dpop-mtls-rollout.md` - Sender constraints
 - **Status:** Fills HIGH-priority gap - consolidates token model, scopes, multi-tenant isolation

+### CLI Developer Experience & Command UX
+- **Canonical:** `29-Nov-2025 - CLI Developer Experience and Command UX.md`
+- **Sprint:** SPRINT_0201_0001_0001_cli_i.md (PRIMARY)
+- **Related Sprints:**
+  - SPRINT_203_cli_iii.md
+  - SPRINT_205_cli_v.md
+- **Related Docs:**
+  - `docs/modules/cli/architecture.md` - Module architecture
+  - `docs/09_API_CLI_REFERENCE.md` - Command reference
+- **Status:** Fills HIGH-priority gap - covers command surface, auth model, Buildx integration
+
+### Orchestrator Event Model & Job Lifecycle
+- **Canonical:** `29-Nov-2025 - Orchestrator Event Model and Job Lifecycle.md`
+- **Sprint:** SPRINT_0151_0001_0001_orchestrator_i.md (PRIMARY)
+- **Related Sprints:**
+  - SPRINT_152_orchestrator_ii.md
+  - SPRINT_0152_0001_0002_orchestrator_ii.md
+- **Related Docs:**
+  - `docs/modules/orchestrator/architecture.md` - Module architecture
+- **Status:** Fills HIGH-priority gap - covers job lifecycle, quota governance, replay semantics
+
+### Export Center & Reporting Strategy
+- **Canonical:** `29-Nov-2025 - Export Center and Reporting Strategy.md`
+- **Sprint:** SPRINT_0160_0001_0001_export_evidence.md (PRIMARY)
+- **Related Sprints:**
+  - SPRINT_0161_0001_0001_evidencelocker.md
+- **Related Docs:**
+  - `docs/modules/export-center/architecture.md` - Module architecture
+- **Status:** Fills MEDIUM-priority gap - covers profile system, adapters, distribution channels
+
+### Runtime Posture & Observation (Zastava)
+- **Canonical:** `29-Nov-2025 - Runtime Posture and Observation with Zastava.md`
+- **Sprint:** SPRINT_0144_0001_0001_zastava_runtime_signals.md (PRIMARY)
+- **Related Sprints:**
+  - SPRINT_0140_0001_0001_runtime_signals.md
+  - SPRINT_0143_0000_0001_signals.md
+- **Related Docs:**
+  - `docs/modules/zastava/architecture.md` - Module architecture
+- **Status:** Fills MEDIUM-priority gap - covers runtime events, admission control, drift detection
+
+### Notification Rules & Alerting Engine
+- **Canonical:** `29-Nov-2025 - Notification Rules and Alerting Engine.md`
+- **Sprint:** SPRINT_0170_0001_0001_notify_engine.md (NEW)
+- **Related Sprints:**
+  - SPRINT_0171_0001_0002_notify_connectors.md
+  - SPRINT_0172_0001_0003_notify_ack_tokens.md
+- **Related Docs:**
+  - `docs/modules/notify/architecture.md` - Module architecture
+- **Status:** Fills MEDIUM-priority gap - covers rules engine, channels, noise control, ack tokens
+
+### Graph Analytics & Dependency Insights
+- **Canonical:** `29-Nov-2025 - Graph Analytics and Dependency Insights.md`
+- **Sprint:** SPRINT_0141_0001_0001_graph_indexer.md (PRIMARY)
+- **Related Sprints:**
+  - SPRINT_0401_0001_0001_reachability_evidence_chain.md
+  - SPRINT_0140_0001_0001_runtime_signals.md
+- **Related Docs:**
+  - `docs/modules/graph/architecture.md` - Module architecture
+- **Status:** Fills MEDIUM-priority gap - covers graph model, overlays, analytics, visualization
+
+### Telemetry & Observability Patterns
+- **Canonical:** `29-Nov-2025 - Telemetry and Observability Patterns.md`
+- **Sprint:** SPRINT_0180_0001_0001_telemetry_core.md (NEW)
+- **Related Sprints:**
+  - SPRINT_0181_0001_0002_telemetry_forensic.md
+  - SPRINT_0182_0001_0003_telemetry_offline.md
+- **Related Docs:**
+  - `docs/modules/telemetry/architecture.md` - Module architecture
+- **Status:** Fills MEDIUM-priority gap - covers collector topology, forensic mode, offline bundles
+
+### Policy Simulation & Shadow Gates
+- **Canonical:** `29-Nov-2025 - Policy Simulation and Shadow Gates.md`
+- **Sprint:** SPRINT_0185_0001_0001_policy_simulation.md (NEW)
+- **Related Sprints:**
+  - SPRINT_0120_0000_0001_policy_reasoning.md
+  - SPRINT_0121_0001_0001_policy_reasoning.md
+- **Related Docs:**
+  - `docs/modules/policy/architecture.md` - Module architecture
+- **Status:** Fills MEDIUM-priority gap - covers shadow runs, coverage fixtures, promotion gates
+
+### Findings Ledger & Immutable Audit Trail
+- **Canonical:** `29-Nov-2025 - Findings Ledger and Immutable Audit Trail.md`
+- **Sprint:** SPRINT_0186_0001_0001_record_deterministic_execution.md (PRIMARY)
+- **Related Sprints:**
+  - SPRINT_0120_0000_0001_policy_reasoning.md
+  - SPRINT_311_docs_tasks_md_xi.md
+- **Related Docs:**
+  - `docs/modules/findings-ledger/openapi/findings-ledger.v1.yaml` - OpenAPI spec
+- **Status:** Fills MEDIUM-priority gap - covers append-only events, Merkle anchoring, projections
+
+### Concelier Advisory Ingestion Model
+- **Canonical:** `29-Nov-2025 - Concelier Advisory Ingestion Model.md`
+- **Sprint:** SPRINT_0115_0001_0004_concelier_iv.md (PRIMARY)
+- **Related Sprints:**
+  - SPRINT_0113_0001_0002_concelier_ii.md
+  - SPRINT_0114_0001_0003_concelier_iii.md
+- **Related Docs:**
+  - `docs/modules/concelier/architecture.md` - Module architecture
+  - `docs/modules/concelier/link-not-merge-schema.md` - LNM schema
+- **Status:** Fills MEDIUM-priority gap - covers AOC, Link-Not-Merge, connectors, deterministic exports
+
 ## Files Archived

 The following files have been moved to `archived/27-Nov-2025-superseded/`:
@@ -198,6 +299,16 @@ The following issues were fixed:
 | Mirror & Offline Kit | SPRINT_0125_0001_0001 | EXISTING |
 | Task Pack Orchestration | SPRINT_0157_0001_0001 | EXISTING |
 | Auth/AuthZ Architecture | Multiple (100, 314, 0514) | EXISTING |
+| CLI Developer Experience | SPRINT_0201_0001_0001 | NEW |
+| Orchestrator Event Model | SPRINT_0151_0001_0001 | NEW |
+| Export Center Strategy | SPRINT_0160_0001_0001 | NEW |
+| Zastava Runtime Posture | SPRINT_0144_0001_0001 | NEW |
+| Notification Rules Engine | SPRINT_0170_0001_0001 | NEW |
+| Graph Analytics | SPRINT_0141_0001_0001 | NEW |
+| Telemetry & Observability | SPRINT_0180_0001_0001 | NEW |
+| Policy Simulation | SPRINT_0185_0001_0001 | NEW |
+| Findings Ledger | SPRINT_0186_0001_0001 | NEW |
+| Concelier Ingestion | SPRINT_0115_0001_0004 | NEW |

 ## Implementation Priority

@@ -210,11 +321,21 @@ Based on gap analysis:
 5. **P1 - Sovereign Crypto** (Sprint 0514) - Regional compliance enablement
 6. **P1 - Evidence Bundle & Replay** (Sprint 0161, 0187) - Audit/compliance critical
 7. **P1 - Mirror & Offline Kit** (Sprint 0125, 0150) - Air-gap deployment critical
-8. **P2 - Task Pack Orchestration** (Sprint 0157, 0158) - Automation foundation
-9. **P2 - Explainability** (Sprint 0401) - UX enhancement, existing tasks
-10. **P2 - Plugin Architecture** (Multiple) - Foundational extensibility patterns
-11. **P2 - Auth/AuthZ Architecture** (Multiple) - Security consolidation
-12. **P3 - Already Implemented** - Unknowns, Graph IDs, DSSE batching
+8. **P1 - CLI Developer Experience** (Sprint 0201) - Developer UX critical
+9. **P1 - Orchestrator Event Model** (Sprint 0151) - Job lifecycle foundation
+10. **P2 - Task Pack Orchestration** (Sprint 0157, 0158) - Automation foundation
+11. **P2 - Explainability** (Sprint 0401) - UX enhancement, existing tasks
+12. **P2 - Plugin Architecture** (Multiple) - Foundational extensibility patterns
+13. **P2 - Auth/AuthZ Architecture** (Multiple) - Security consolidation
+14. **P2 - Export Center** (Sprint 0160) - Reporting flexibility
+15. **P2 - Zastava Runtime** (Sprint 0144) - Runtime observability
+16. **P2 - Notification Rules** (Sprint 0170) - Alert management
+17. **P2 - Graph Analytics** (Sprint 0141) - Dependency insights
+18. **P2 - Telemetry** (Sprint 0180) - Observability infrastructure
+19. **P2 - Policy Simulation** (Sprint 0185) - Safe policy testing
+20. **P2 - Findings Ledger** (Sprint 0186) - Audit immutability
+21. **P2 - Concelier Ingestion** (Sprint 0115) - Advisory pipeline
+22. **P3 - Already Implemented** - Unknowns, Graph IDs, DSSE batching

 ## Implementer Quick Reference

@@ -241,6 +362,15 @@ For each topic, the implementer should read:
 | Evidence Locker | `docs/modules/evidence-locker/*.md` | `src/EvidenceLocker/*/AGENTS.md` |
 | Mirror | `docs/modules/mirror/*.md` | `src/Mirror/*/AGENTS.md` |
 | TaskRunner | `docs/modules/taskrunner/*.md` | `src/TaskRunner/*/AGENTS.md` |
+| CLI | `docs/modules/cli/architecture.md` | `src/Cli/*/AGENTS.md` |
+| Orchestrator | `docs/modules/orchestrator/architecture.md` | `src/Orchestrator/*/AGENTS.md` |
+| Export Center | `docs/modules/export-center/architecture.md` | `src/ExportCenter/*/AGENTS.md` |
+| Zastava | `docs/modules/zastava/architecture.md` | `src/Zastava/*/AGENTS.md` |
+| Notify | `docs/modules/notify/architecture.md` | `src/Notify/*/AGENTS.md` |
+| Graph | `docs/modules/graph/architecture.md` | `src/Graph/*/AGENTS.md` |
+| Telemetry | `docs/modules/telemetry/architecture.md` | `src/Telemetry/*/AGENTS.md` |
+| Findings Ledger | `docs/modules/findings-ledger/openapi/` | `src/Findings/*/AGENTS.md` |
+| Concelier | `docs/modules/concelier/architecture.md` | `src/Concelier/*/AGENTS.md` |

 ## Topical Gaps (Advisory Needed)

@@ -254,12 +384,17 @@ The following topics are mentioned in CLAUDE.md or module docs but lack dedicate
 | ~~Mirror/Offline Kit Strategy~~ | HIGH | **FILLED** | `29-Nov-2025 - Mirror and Offline Kit Strategy.md` |
 | ~~Task Pack Orchestration~~ | HIGH | **FILLED** | `29-Nov-2025 - Task Pack Orchestration and Automation.md` |
 | ~~Auth/AuthZ Architecture~~ | HIGH | **FILLED** | `29-Nov-2025 - Authentication and Authorization Architecture.md` |
+| ~~CLI Developer Experience~~ | HIGH | **FILLED** | `29-Nov-2025 - CLI Developer Experience and Command UX.md` |
+| ~~Orchestrator Event Model~~ | HIGH | **FILLED** | `29-Nov-2025 - Orchestrator Event Model and Job Lifecycle.md` |
+| ~~Export Center Strategy~~ | MEDIUM | **FILLED** | `29-Nov-2025 - Export Center and Reporting Strategy.md` |
+| ~~Runtime Posture & Observation~~ | MEDIUM | **FILLED** | `29-Nov-2025 - Runtime Posture and Observation with Zastava.md` |
+| ~~Notification Rules Engine~~ | MEDIUM | **FILLED** | `29-Nov-2025 - Notification Rules and Alerting Engine.md` |
+| ~~Graph Analytics & Clustering~~ | MEDIUM | **FILLED** | `29-Nov-2025 - Graph Analytics and Dependency Insights.md` |
+| ~~Telemetry & Observability~~ | MEDIUM | **FILLED** | `29-Nov-2025 - Telemetry and Observability Patterns.md` |
+| ~~Policy Simulation & Shadow Gates~~ | MEDIUM | **FILLED** | `29-Nov-2025 - Policy Simulation and Shadow Gates.md` |
+| ~~Findings Ledger & Audit Trail~~ | MEDIUM | **FILLED** | `29-Nov-2025 - Findings Ledger and Immutable Audit Trail.md` |
+| ~~Concelier Advisory Ingestion~~ | MEDIUM | **FILLED** | `29-Nov-2025 - Concelier Advisory Ingestion Model.md` |
 | **CycloneDX 1.6 .NET Integration** | LOW | Open | Deep Architecture covers generically; expand with .NET-specific guidance |
-| **Findings Ledger & Audit Trail** | MEDIUM | Open | Immutable verdict tracking; module exists but no advisory |
-| **Runtime Posture & Observation** | MEDIUM | Open | Zastava runtime signals; sprints exist but no advisory |
-| **Graph Analytics & Clustering** | MEDIUM | Open | Community detection, blast-radius; implementation underway |
-| **Policy Simulation & Shadow Gates** | MEDIUM | Open | Impact modeling; extensive sprints but no contract advisory |
-| **Notification Rules Engine** | MEDIUM | Open | Throttling, digests, templating; sprints active |

 ## Known Issues (Non-Blocking)

@@ -274,4 +409,4 @@ Several filenames use en-dash (U+2011) instead of regular hyphen (-). This may c

 ---
 *Index created: 2025-11-27*
-*Last updated: 2025-11-29*
+*Last updated: 2025-11-29 (added 10 new advisories filling all identified gaps)*