consolidate the tests locations

src/__Tests/AirGap/StellaOps.AirGap.Time.Tests/AirGapOptionsValidatorTests.cs

@@ -0,0 +1,35 @@
+using Microsoft.Extensions.Options;
+using StellaOps.AirGap.Time.Config;
+using StellaOps.AirGap.Time.Models;
+
+namespace StellaOps.AirGap.Time.Tests;
+
+public class AirGapOptionsValidatorTests
+{
+    [Fact]
+    public void FailsWhenTenantMissing()
+    {
+        var opts = new AirGapOptions { TenantId = "" };
+        var validator = new AirGapOptionsValidator();
+        var result = validator.Validate(null, opts);
+        Assert.True(result.Failed);
+    }
+
+    [Fact]
+    public void FailsWhenWarningExceedsBreach()
+    {
+        var opts = new AirGapOptions { TenantId = "t", Staleness = new StalenessOptions { WarningSeconds = 20, BreachSeconds = 10 } };
+        var validator = new AirGapOptionsValidator();
+        var result = validator.Validate(null, opts);
+        Assert.True(result.Failed);
+    }
+
+    [Fact]
+    public void SucceedsForValidOptions()
+    {
+        var opts = new AirGapOptions { TenantId = "t", Staleness = new StalenessOptions { WarningSeconds = 10, BreachSeconds = 20 } };
+        var validator = new AirGapOptionsValidator();
+        var result = validator.Validate(null, opts);
+        Assert.True(result.Succeeded);
+    }
+}

src/__Tests/AirGap/StellaOps.AirGap.Time.Tests/GlobalUsings.cs

@@ -0,0 +1 @@
+global using Xunit;

src/__Tests/AirGap/StellaOps.AirGap.Time.Tests/Rfc3161VerifierTests.cs

@@ -0,0 +1,93 @@
+using StellaOps.AirGap.Time.Models;
+using StellaOps.AirGap.Time.Services;
+
+namespace StellaOps.AirGap.Time.Tests;
+
+/// <summary>
+/// Tests for Rfc3161Verifier with real SignedCms verification.
+/// Per AIRGAP-TIME-57-001: Trusted time-anchor service.
+/// </summary>
+public class Rfc3161VerifierTests
+{
+    private readonly Rfc3161Verifier _verifier = new();
+
+    [Fact]
+    public void Verify_ReturnsFailure_WhenTrustRootsEmpty()
+    {
+        var token = new byte[] { 0x01, 0x02, 0x03 };
+
+        var result = _verifier.Verify(token, Array.Empty<TimeTrustRoot>(), out var anchor);
+
+        Assert.False(result.IsValid);
+        Assert.Equal("rfc3161-trust-roots-required", result.Reason);
+        Assert.Equal(TimeAnchor.Unknown, anchor);
+    }
+
+    [Fact]
+    public void Verify_ReturnsFailure_WhenTokenEmpty()
+    {
+        var trust = new[] { new TimeTrustRoot("tsa-root", new byte[] { 0x01 }, "rsa") };
+
+        var result = _verifier.Verify(ReadOnlySpan<byte>.Empty, trust, out var anchor);
+
+        Assert.False(result.IsValid);
+        Assert.Equal("rfc3161-token-empty", result.Reason);
+        Assert.Equal(TimeAnchor.Unknown, anchor);
+    }
+
+    [Fact]
+    public void Verify_ReturnsFailure_WhenInvalidAsn1Structure()
+    {
+        var token = new byte[] { 0x01, 0x02, 0x03 }; // Invalid ASN.1
+        var trust = new[] { new TimeTrustRoot("tsa-root", new byte[] { 0x01 }, "rsa") };
+
+        var result = _verifier.Verify(token, trust, out var anchor);
+
+        Assert.False(result.IsValid);
+        Assert.Contains("rfc3161-", result.Reason);
+        Assert.Equal(TimeAnchor.Unknown, anchor);
+    }
+
+    [Fact]
+    public void Verify_ProducesTokenDigest()
+    {
+        var token = new byte[] { 0x30, 0x00 }; // Empty SEQUENCE (minimal valid ASN.1)
+        var trust = new[] { new TimeTrustRoot("tsa-root", new byte[] { 0x01 }, "rsa") };
+
+        var result = _verifier.Verify(token, trust, out _);
+
+        // Should fail on CMS decode but attempt was made
+        Assert.False(result.IsValid);
+        Assert.Contains("rfc3161-", result.Reason);
+    }
+
+    [Fact]
+    public void Verify_HandlesExceptionsGracefully()
+    {
+        // Create bytes that might cause internal exceptions
+        var token = new byte[256];
+        new Random(42).NextBytes(token);
+        var trust = new[] { new TimeTrustRoot("tsa-root", new byte[] { 0x01 }, "rsa") };
+
+        var result = _verifier.Verify(token, trust, out var anchor);
+
+        // Should not throw, should return failure result
+        Assert.False(result.IsValid);
+        Assert.Contains("rfc3161-", result.Reason);
+        Assert.Equal(TimeAnchor.Unknown, anchor);
+    }
+
+    [Fact]
+    public void Verify_ReportsDecodeErrorForMalformedCms()
+    {
+        // Create something that looks like CMS but isn't valid
+        var token = new byte[] { 0x30, 0x82, 0x00, 0x10, 0x06, 0x09 };
+        var trust = new[] { new TimeTrustRoot("tsa-root", new byte[] { 0x01 }, "rsa") };
+
+        var result = _verifier.Verify(token, trust, out _);
+
+        Assert.False(result.IsValid);
+        // Should report either decode or error
+        Assert.True(result.Reason?.Contains("rfc3161-") ?? false);
+    }
+}

src/__Tests/AirGap/StellaOps.AirGap.Time.Tests/RoughtimeVerifierTests.cs

@@ -0,0 +1,150 @@
+using StellaOps.AirGap.Time.Models;
+using StellaOps.AirGap.Time.Services;
+
+namespace StellaOps.AirGap.Time.Tests;
+
+/// <summary>
+/// Tests for RoughtimeVerifier with real Ed25519 signature verification.
+/// Per AIRGAP-TIME-57-001: Trusted time-anchor service.
+/// </summary>
+public class RoughtimeVerifierTests
+{
+    private readonly RoughtimeVerifier _verifier = new();
+
+    [Fact]
+    public void Verify_ReturnsFailure_WhenTrustRootsEmpty()
+    {
+        var token = new byte[] { 0x01, 0x02, 0x03, 0x04 };
+
+        var result = _verifier.Verify(token, Array.Empty<TimeTrustRoot>(), out var anchor);
+
+        Assert.False(result.IsValid);
+        Assert.Equal("roughtime-trust-roots-required", result.Reason);
+        Assert.Equal(TimeAnchor.Unknown, anchor);
+    }
+
+    [Fact]
+    public void Verify_ReturnsFailure_WhenTokenEmpty()
+    {
+        var trust = new[] { new TimeTrustRoot("root1", new byte[32], "ed25519") };
+
+        var result = _verifier.Verify(ReadOnlySpan<byte>.Empty, trust, out var anchor);
+
+        Assert.False(result.IsValid);
+        Assert.Equal("roughtime-token-empty", result.Reason);
+        Assert.Equal(TimeAnchor.Unknown, anchor);
+    }
+
+    [Fact]
+    public void Verify_ReturnsFailure_WhenTokenTooShort()
+    {
+        var token = new byte[] { 0x01, 0x02, 0x03 };
+        var trust = new[] { new TimeTrustRoot("root1", new byte[32], "ed25519") };
+
+        var result = _verifier.Verify(token, trust, out var anchor);
+
+        Assert.False(result.IsValid);
+        Assert.Equal("roughtime-message-too-short", result.Reason);
+    }
+
+    [Fact]
+    public void Verify_ReturnsFailure_WhenInvalidTagCount()
+    {
+        // Create a minimal wire format with invalid tag count
+        var token = new byte[8];
+        // Set num_tags to 0 (invalid)
+        BitConverter.TryWriteBytes(token.AsSpan(0, 4), (uint)0);
+
+        var trust = new[] { new TimeTrustRoot("root1", new byte[32], "ed25519") };
+
+        var result = _verifier.Verify(token, trust, out var anchor);
+
+        Assert.False(result.IsValid);
+        Assert.Equal("roughtime-invalid-tag-count", result.Reason);
+    }
+
+    [Fact]
+    public void Verify_ReturnsFailure_WhenNonEd25519Algorithm()
+    {
+        // Create a minimal valid-looking wire format
+        var token = CreateMinimalRoughtimeToken();
+        var trust = new[] { new TimeTrustRoot("root1", new byte[32], "rsa") }; // Wrong algorithm
+
+        var result = _verifier.Verify(token, trust, out var anchor);
+
+        Assert.False(result.IsValid);
+        // Should fail either on parsing or signature verification
+        Assert.Contains("roughtime-", result.Reason);
+    }
+
+    [Fact]
+    public void Verify_ReturnsFailure_WhenKeyLengthWrong()
+    {
+        var token = CreateMinimalRoughtimeToken();
+        var trust = new[] { new TimeTrustRoot("root1", new byte[16], "ed25519") }; // Wrong key length
+
+        var result = _verifier.Verify(token, trust, out var anchor);
+
+        Assert.False(result.IsValid);
+        Assert.Contains("roughtime-", result.Reason);
+    }
+
+    [Fact]
+    public void Verify_ProducesTokenDigest()
+    {
+        var token = new byte[] { 0xAA, 0xBB, 0xCC, 0xDD };
+        var trust = new[] { new TimeTrustRoot("root1", new byte[32], "ed25519") };
+
+        var result = _verifier.Verify(token, trust, out _);
+
+        // Even on failure, we should get a deterministic result
+        Assert.False(result.IsValid);
+    }
+
+    /// <summary>
+    /// Creates a minimal Roughtime wire format token for testing parsing paths.
+    /// Note: This will fail signature verification but tests the parsing logic.
+    /// </summary>
+    private static byte[] CreateMinimalRoughtimeToken()
+    {
+        // Roughtime wire format:
+        // [num_tags:u32] [offsets:u32[n-1]] [tags:u32[n]] [values...]
+        // We'll create 2 tags: SIG and SREP
+
+        const uint TagSig = 0x00474953; // "SIG\0"
+        const uint TagSrep = 0x50455253; // "SREP"
+
+        var sigValue = new byte[64]; // Ed25519 signature
+        var srepValue = CreateMinimalSrep();
+
+        // Header: num_tags=2, offset[0]=64 (sig length), tags=[SIG, SREP]
+        var headerSize = 4 + 4 + 8; // num_tags + 1 offset + 2 tags = 16 bytes
+        var token = new byte[headerSize + sigValue.Length + srepValue.Length];
+
+        BitConverter.TryWriteBytes(token.AsSpan(0, 4), (uint)2); // num_tags = 2
+        BitConverter.TryWriteBytes(token.AsSpan(4, 4), (uint)64); // offset[0] = 64 (sig length)
+        BitConverter.TryWriteBytes(token.AsSpan(8, 4), TagSig);
+        BitConverter.TryWriteBytes(token.AsSpan(12, 4), TagSrep);
+        sigValue.CopyTo(token.AsSpan(16));
+        srepValue.CopyTo(token.AsSpan(16 + 64));
+
+        return token;
+    }
+
+    private static byte[] CreateMinimalSrep()
+    {
+        // SREP with MIDP tag containing 8-byte timestamp
+        const uint TagMidp = 0x5044494D; // "MIDP"
+
+        // Header: num_tags=1, tags=[MIDP]
+        var headerSize = 4 + 4; // num_tags + 1 tag = 8 bytes
+        var srepValue = new byte[headerSize + 8]; // + 8 bytes for MIDP value
+
+        BitConverter.TryWriteBytes(srepValue.AsSpan(0, 4), (uint)1); // num_tags = 1
+        BitConverter.TryWriteBytes(srepValue.AsSpan(4, 4), TagMidp);
+        // MIDP value: microseconds since Unix epoch (example: 2025-01-01 00:00:00 UTC)
+        BitConverter.TryWriteBytes(srepValue.AsSpan(8, 8), 1735689600000000L);
+
+        return srepValue;
+    }
+}

src/__Tests/AirGap/StellaOps.AirGap.Time.Tests/SealedStartupValidatorTests.cs

@@ -0,0 +1,63 @@
+using StellaOps.AirGap.Time.Models;
+using StellaOps.AirGap.Time.Services;
+using StellaOps.AirGap.Time.Stores;
+
+namespace StellaOps.AirGap.Time.Tests;
+
+public class SealedStartupValidatorTests
+{
+    [Fact]
+    public async Task FailsWhenAnchorMissing()
+    {
+        var validator = Build(out var statusService);
+        var result = await validator.ValidateAsync("t1", StalenessBudget.Default, default);
+        Assert.False(result.IsValid);
+        Assert.Equal("time-anchor-missing", result.Reason);
+    }
+
+    [Fact]
+    public async Task FailsWhenBreach()
+    {
+        var validator = Build(out var statusService);
+        var anchor = new TimeAnchor(DateTimeOffset.UnixEpoch, "src", "fmt", "fp", "digest");
+        await statusService.SetAnchorAsync("t1", anchor, new StalenessBudget(10, 20));
+        var now = DateTimeOffset.UnixEpoch.AddSeconds(25);
+        var status = await statusService.GetStatusAsync("t1", now);
+        var result = status.Staleness.IsBreach;
+        Assert.True(result);
+        var validation = await validator.ValidateAsync("t1", new StalenessBudget(10, 20), default);
+        Assert.False(validation.IsValid);
+        Assert.Equal("time-anchor-stale", validation.Reason);
+    }
+
+    [Fact]
+    public async Task SucceedsWhenFresh()
+    {
+        var validator = Build(out var statusService);
+        var now = DateTimeOffset.UtcNow;
+        var anchor = new TimeAnchor(now, "src", "fmt", "fp", "digest");
+        await statusService.SetAnchorAsync("t1", anchor, new StalenessBudget(10, 20));
+        var validation = await validator.ValidateAsync("t1", new StalenessBudget(10, 20), default);
+        Assert.True(validation.IsValid);
+    }
+
+    [Fact]
+    public async Task FailsOnBudgetMismatch()
+    {
+        var validator = Build(out var statusService);
+        var anchor = new TimeAnchor(DateTimeOffset.UtcNow, "src", "fmt", "fp", "digest");
+        await statusService.SetAnchorAsync("t1", anchor, new StalenessBudget(10, 20));
+
+        var validation = await validator.ValidateAsync("t1", new StalenessBudget(5, 15), default);
+
+        Assert.False(validation.IsValid);
+        Assert.Equal("time-anchor-budget-mismatch", validation.Reason);
+    }
+
+    private static SealedStartupValidator Build(out TimeStatusService statusService)
+    {
+        var store = new InMemoryTimeAnchorStore();
+        statusService = new TimeStatusService(store, new StalenessCalculator(), new TimeTelemetry(), Microsoft.Extensions.Options.Options.Create(new AirGapOptions()));
+        return new SealedStartupValidator(statusService);
+    }
+}

src/__Tests/AirGap/StellaOps.AirGap.Time.Tests/StalenessCalculatorTests.cs

@@ -0,0 +1,43 @@
+using StellaOps.AirGap.Time.Models;
+using StellaOps.AirGap.Time.Services;
+
+namespace StellaOps.AirGap.Time.Tests;
+
+public class StalenessCalculatorTests
+{
+    [Fact]
+    public void UnknownWhenNoAnchor()
+    {
+        var calc = new StalenessCalculator();
+        var result = calc.Evaluate(TimeAnchor.Unknown, StalenessBudget.Default, DateTimeOffset.UnixEpoch);
+        Assert.False(result.IsWarning);
+        Assert.False(result.IsBreach);
+    }
+
+    [Fact]
+    public void BreachWhenBeyondBudget()
+    {
+        var anchor = new TimeAnchor(DateTimeOffset.UnixEpoch, "source", "fmt", "fp", "digest");
+        var budget = new StalenessBudget(10, 20);
+        var calc = new StalenessCalculator();
+
+        var result = calc.Evaluate(anchor, budget, DateTimeOffset.UnixEpoch.AddSeconds(25));
+
+        Assert.True(result.IsBreach);
+        Assert.True(result.IsWarning);
+        Assert.Equal(25, result.AgeSeconds);
+    }
+
+    [Fact]
+    public void WarningWhenBetweenWarningAndBreach()
+    {
+        var anchor = new TimeAnchor(DateTimeOffset.UnixEpoch, "source", "fmt", "fp", "digest");
+        var budget = new StalenessBudget(10, 20);
+        var calc = new StalenessCalculator();
+
+        var result = calc.Evaluate(anchor, budget, DateTimeOffset.UnixEpoch.AddSeconds(15));
+
+        Assert.True(result.IsWarning);
+        Assert.False(result.IsBreach);
+    }
+}

src/__Tests/AirGap/StellaOps.AirGap.Time.Tests/StellaOps.AirGap.Time.Tests.csproj

@@ -0,0 +1,16 @@
+<Project Sdk="Microsoft.NET.Sdk">
+  <PropertyGroup>
+    <TargetFramework>net10.0</TargetFramework>
+    <IsPackable>false</IsPackable>
+    <Nullable>enable</Nullable>
+    <ImplicitUsings>enable</ImplicitUsings>
+  </PropertyGroup>
+  <ItemGroup>
+    <PackageReference Include="xunit" Version="2.9.2" />
+    <PackageReference Include="xunit.runner.visualstudio" Version="2.8.2" />
+    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.10.0" />
+  </ItemGroup>
+  <ItemGroup>
+    <ProjectReference Include="../../AirGap/StellaOps.AirGap.Time/StellaOps.AirGap.Time.csproj" />
+  </ItemGroup>
+</Project>

src/__Tests/AirGap/StellaOps.AirGap.Time.Tests/TimeAnchorLoaderTests.cs

@@ -0,0 +1,61 @@
+using Microsoft.Extensions.Options;
+using StellaOps.AirGap.Time.Models;
+using StellaOps.AirGap.Time.Parsing;
+using StellaOps.AirGap.Time.Services;
+
+namespace StellaOps.AirGap.Time.Tests;
+
+public class TimeAnchorLoaderTests
+{
+    [Fact]
+    public void RejectsInvalidHex()
+    {
+        var loader = Build();
+        var trust = new[] { new TimeTrustRoot("k1", new byte[32], "ed25519") };
+        var result = loader.TryLoadHex("not-hex", TimeTokenFormat.Roughtime, trust, out _);
+        Assert.False(result.IsValid);
+        Assert.Equal("token-hex-invalid", result.Reason);
+    }
+
+    [Fact]
+    public void LoadsHexToken()
+    {
+        var loader = Build();
+        var hex = "01020304";
+        var trust = new[] { new TimeTrustRoot("k1", new byte[32], "ed25519") };
+        var result = loader.TryLoadHex(hex, TimeTokenFormat.Roughtime, trust, out var anchor);
+
+        Assert.True(result.IsValid);
+        Assert.Equal("Roughtime", anchor.Format);
+    }
+
+    [Fact]
+    public void RejectsIncompatibleTrustRoots()
+    {
+        var loader = Build();
+        var hex = "010203";
+        var rsaKey = new byte[128];
+        var trust = new[] { new TimeTrustRoot("k1", rsaKey, "rsa") };
+
+        var result = loader.TryLoadHex(hex, TimeTokenFormat.Roughtime, trust, out _);
+
+        Assert.False(result.IsValid);
+        Assert.Equal("trust-roots-incompatible-format", result.Reason);
+    }
+
+    [Fact]
+    public void RejectsWhenTrustRootsMissing()
+    {
+        var loader = Build();
+        var result = loader.TryLoadHex("010203", TimeTokenFormat.Roughtime, Array.Empty<TimeTrustRoot>(), out _);
+
+        Assert.False(result.IsValid);
+        Assert.Equal("trust-roots-required", result.Reason);
+    }
+
+    private static TimeAnchorLoader Build()
+    {
+        var options = Options.Create(new AirGapOptions { AllowUntrustedAnchors = false });
+        return new TimeAnchorLoader(new TimeVerificationService(), new TimeTokenParser(), options);
+    }
+}

src/__Tests/AirGap/StellaOps.AirGap.Time.Tests/TimeAnchorPolicyServiceTests.cs

@@ -0,0 +1,261 @@
+using Microsoft.Extensions.Logging.Abstractions;
+using Microsoft.Extensions.Options;
+using StellaOps.AirGap.Time.Models;
+using StellaOps.AirGap.Time.Services;
+using StellaOps.AirGap.Time.Stores;
+
+namespace StellaOps.AirGap.Time.Tests;
+
+/// <summary>
+/// Tests for TimeAnchorPolicyService.
+/// Per AIRGAP-TIME-57-001: Time-anchor policy enforcement.
+/// </summary>
+public class TimeAnchorPolicyServiceTests
+{
+    private readonly TimeProvider _fixedTimeProvider;
+    private readonly InMemoryTimeAnchorStore _store;
+    private readonly StalenessCalculator _calculator;
+    private readonly TimeTelemetry _telemetry;
+    private readonly TimeStatusService _statusService;
+    private readonly AirGapOptions _airGapOptions;
+
+    public TimeAnchorPolicyServiceTests()
+    {
+        _fixedTimeProvider = new FakeTimeProvider(new DateTimeOffset(2025, 1, 15, 12, 0, 0, TimeSpan.Zero));
+        _store = new InMemoryTimeAnchorStore();
+        _calculator = new StalenessCalculator();
+        _telemetry = new TimeTelemetry();
+        _airGapOptions = new AirGapOptions
+        {
+            Staleness = new AirGapOptions.StalenessOptions { WarningSeconds = 3600, BreachSeconds = 7200 },
+            ContentBudgets = new Dictionary<string, AirGapOptions.StalenessOptions>()
+        };
+        _statusService = new TimeStatusService(_store, _calculator, _telemetry, Options.Create(_airGapOptions));
+    }
+
+    private TimeAnchorPolicyService CreateService(TimeAnchorPolicyOptions? options = null)
+    {
+        return new TimeAnchorPolicyService(
+            _statusService,
+            Options.Create(options ?? new TimeAnchorPolicyOptions()),
+            NullLogger<TimeAnchorPolicyService>.Instance,
+            _fixedTimeProvider);
+    }
+
+    [Fact]
+    public async Task ValidateTimeAnchorAsync_ReturnsFailure_WhenNoAnchor()
+    {
+        var service = CreateService();
+
+        var result = await service.ValidateTimeAnchorAsync("tenant-1");
+
+        Assert.False(result.Allowed);
+        Assert.Equal(TimeAnchorPolicyErrorCodes.AnchorMissing, result.ErrorCode);
+        Assert.NotNull(result.Remediation);
+    }
+
+    [Fact]
+    public async Task ValidateTimeAnchorAsync_ReturnsSuccess_WhenAnchorValid()
+    {
+        var service = CreateService();
+        var anchor = new TimeAnchor(
+            _fixedTimeProvider.GetUtcNow().AddMinutes(-30),
+            "test-source",
+            "Roughtime",
+            "fingerprint",
+            "digest123");
+        var budget = new StalenessBudget(3600, 7200);
+
+        await _store.SetAsync("tenant-1", anchor, budget, CancellationToken.None);
+
+        var result = await service.ValidateTimeAnchorAsync("tenant-1");
+
+        Assert.True(result.Allowed);
+        Assert.Null(result.ErrorCode);
+        Assert.NotNull(result.Staleness);
+        Assert.False(result.Staleness.IsBreach);
+    }
+
+    [Fact]
+    public async Task ValidateTimeAnchorAsync_ReturnsWarning_WhenAnchorStale()
+    {
+        var service = CreateService();
+        var anchor = new TimeAnchor(
+            _fixedTimeProvider.GetUtcNow().AddSeconds(-5000), // Past warning threshold
+            "test-source",
+            "Roughtime",
+            "fingerprint",
+            "digest123");
+        var budget = new StalenessBudget(3600, 7200);
+
+        await _store.SetAsync("tenant-1", anchor, budget, CancellationToken.None);
+
+        var result = await service.ValidateTimeAnchorAsync("tenant-1");
+
+        Assert.True(result.Allowed); // Allowed but with warning
+        Assert.NotNull(result.Staleness);
+        Assert.True(result.Staleness.IsWarning);
+        Assert.Contains("warning", result.Reason, StringComparison.OrdinalIgnoreCase);
+    }
+
+    [Fact]
+    public async Task ValidateTimeAnchorAsync_ReturnsFailure_WhenAnchorBreached()
+    {
+        var service = CreateService();
+        var anchor = new TimeAnchor(
+            _fixedTimeProvider.GetUtcNow().AddSeconds(-8000), // Past breach threshold
+            "test-source",
+            "Roughtime",
+            "fingerprint",
+            "digest123");
+        var budget = new StalenessBudget(3600, 7200);
+
+        await _store.SetAsync("tenant-1", anchor, budget, CancellationToken.None);
+
+        var result = await service.ValidateTimeAnchorAsync("tenant-1");
+
+        Assert.False(result.Allowed);
+        Assert.Equal(TimeAnchorPolicyErrorCodes.AnchorBreached, result.ErrorCode);
+        Assert.NotNull(result.Staleness);
+        Assert.True(result.Staleness.IsBreach);
+    }
+
+    [Fact]
+    public async Task EnforceBundleImportPolicyAsync_AllowsImport_WhenAnchorValid()
+    {
+        var service = CreateService();
+        var anchor = new TimeAnchor(
+            _fixedTimeProvider.GetUtcNow().AddMinutes(-30),
+            "test-source",
+            "Roughtime",
+            "fingerprint",
+            "digest123");
+        var budget = new StalenessBudget(3600, 7200);
+
+        await _store.SetAsync("tenant-1", anchor, budget, CancellationToken.None);
+
+        var result = await service.EnforceBundleImportPolicyAsync(
+            "tenant-1",
+            "bundle-123",
+            _fixedTimeProvider.GetUtcNow().AddMinutes(-15));
+
+        Assert.True(result.Allowed);
+    }
+
+    [Fact]
+    public async Task EnforceBundleImportPolicyAsync_BlocksImport_WhenDriftExceeded()
+    {
+        var options = new TimeAnchorPolicyOptions { MaxDriftSeconds = 3600 }; // 1 hour max
+        var service = CreateService(options);
+        var anchor = new TimeAnchor(
+            _fixedTimeProvider.GetUtcNow().AddMinutes(-30),
+            "test-source",
+            "Roughtime",
+            "fingerprint",
+            "digest123");
+        var budget = new StalenessBudget(86400, 172800); // Large budget
+
+        await _store.SetAsync("tenant-1", anchor, budget, CancellationToken.None);
+
+        var bundleTimestamp = _fixedTimeProvider.GetUtcNow().AddDays(-2); // 2 days ago
+
+        var result = await service.EnforceBundleImportPolicyAsync(
+            "tenant-1",
+            "bundle-123",
+            bundleTimestamp);
+
+        Assert.False(result.Allowed);
+        Assert.Equal(TimeAnchorPolicyErrorCodes.DriftExceeded, result.ErrorCode);
+    }
+
+    [Fact]
+    public async Task EnforceOperationPolicyAsync_BlocksStrictOperations_WhenNoAnchor()
+    {
+        var options = new TimeAnchorPolicyOptions
+        {
+            StrictOperations = new[] { "attestation.sign" }
+        };
+        var service = CreateService(options);
+
+        var result = await service.EnforceOperationPolicyAsync("tenant-1", "attestation.sign");
+
+        Assert.False(result.Allowed);
+        Assert.Equal(TimeAnchorPolicyErrorCodes.AnchorMissing, result.ErrorCode);
+    }
+
+    [Fact]
+    public async Task EnforceOperationPolicyAsync_AllowsNonStrictOperations_InNonStrictMode()
+    {
+        var options = new TimeAnchorPolicyOptions
+        {
+            StrictEnforcement = false,
+            StrictOperations = new[] { "attestation.sign" }
+        };
+        var service = CreateService(options);
+
+        var result = await service.EnforceOperationPolicyAsync("tenant-1", "some.other.operation");
+
+        Assert.True(result.Allowed);
+    }
+
+    [Fact]
+    public async Task CalculateDriftAsync_ReturnsNoDrift_WhenNoAnchor()
+    {
+        var service = CreateService();
+
+        var result = await service.CalculateDriftAsync("tenant-1", _fixedTimeProvider.GetUtcNow());
+
+        Assert.False(result.HasAnchor);
+        Assert.Equal(TimeSpan.Zero, result.Drift);
+        Assert.Null(result.AnchorTime);
+    }
+
+    [Fact]
+    public async Task CalculateDriftAsync_ReturnsDrift_WhenAnchorExists()
+    {
+        var service = CreateService(new TimeAnchorPolicyOptions { MaxDriftSeconds = 3600 });
+        var anchorTime = _fixedTimeProvider.GetUtcNow().AddMinutes(-30);
+        var anchor = new TimeAnchor(anchorTime, "test", "Roughtime", "fp", "digest");
+        var budget = new StalenessBudget(3600, 7200);
+
+        await _store.SetAsync("tenant-1", anchor, budget, CancellationToken.None);
+
+        var targetTime = _fixedTimeProvider.GetUtcNow().AddMinutes(15);
+        var result = await service.CalculateDriftAsync("tenant-1", targetTime);
+
+        Assert.True(result.HasAnchor);
+        Assert.Equal(anchorTime, result.AnchorTime);
+        Assert.Equal(45, (int)result.Drift.TotalMinutes); // 30 min + 15 min
+        Assert.False(result.DriftExceedsThreshold);
+    }
+
+    [Fact]
+    public async Task CalculateDriftAsync_DetectsExcessiveDrift()
+    {
+        var service = CreateService(new TimeAnchorPolicyOptions { MaxDriftSeconds = 60 }); // 1 minute max
+        var anchor = new TimeAnchor(
+            _fixedTimeProvider.GetUtcNow(),
+            "test",
+            "Roughtime",
+            "fp",
+            "digest");
+        var budget = new StalenessBudget(3600, 7200);
+
+        await _store.SetAsync("tenant-1", anchor, budget, CancellationToken.None);
+
+        var targetTime = _fixedTimeProvider.GetUtcNow().AddMinutes(5); // 5 minutes drift
+        var result = await service.CalculateDriftAsync("tenant-1", targetTime);
+
+        Assert.True(result.HasAnchor);
+        Assert.True(result.DriftExceedsThreshold);
+    }
+
+    private sealed class FakeTimeProvider : TimeProvider
+    {
+        private readonly DateTimeOffset _now;
+
+        public FakeTimeProvider(DateTimeOffset now) => _now = now;
+
+        public override DateTimeOffset GetUtcNow() => _now;
+    }
+}

src/__Tests/AirGap/StellaOps.AirGap.Time.Tests/TimeStatusDtoTests.cs

@@ -0,0 +1,24 @@
+using StellaOps.AirGap.Time.Models;
+
+namespace StellaOps.AirGap.Time.Tests;
+
+public class TimeStatusDtoTests
+{
+    [Fact]
+    public void SerializesDeterministically()
+    {
+        var status = new TimeStatus(
+            new TimeAnchor(DateTimeOffset.Parse("2025-01-01T00:00:00Z"), "source", "fmt", "fp", "digest"),
+            new StalenessEvaluation(42, 10, 20, true, false),
+            new StalenessBudget(10, 20),
+            new Dictionary<string, StalenessEvaluation>
+            {
+                { "advisories", new StalenessEvaluation(42, 10, 20, true, false) }
+            },
+            DateTimeOffset.Parse("2025-01-02T00:00:00Z"));
+
+        var json = TimeStatusDto.FromStatus(status).ToJson();
+        Assert.Contains("\"contentStaleness\":{\"advisories\":{", json);
+        Assert.Contains("\"ageSeconds\":42", json);
+    }
+}

src/__Tests/AirGap/StellaOps.AirGap.Time.Tests/TimeStatusServiceTests.cs

@@ -0,0 +1,45 @@
+using StellaOps.AirGap.Time.Models;
+using StellaOps.AirGap.Time.Services;
+using StellaOps.AirGap.Time.Stores;
+
+namespace StellaOps.AirGap.Time.Tests;
+
+public class TimeStatusServiceTests
+{
+    [Fact]
+    public async Task ReturnsUnknownWhenNoAnchor()
+    {
+        var svc = Build(out var telemetry);
+        var status = await svc.GetStatusAsync("t1", DateTimeOffset.UnixEpoch);
+        Assert.Equal(TimeAnchor.Unknown, status.Anchor);
+        Assert.False(status.Staleness.IsWarning);
+        Assert.Equal(0, telemetry.GetLatest("t1")?.AgeSeconds ?? 0);
+    }
+
+    [Fact]
+    public async Task PersistsAnchorAndBudget()
+    {
+        var svc = Build(out var telemetry);
+        var anchor = new TimeAnchor(DateTimeOffset.UnixEpoch, "source", "fmt", "fp", "digest");
+        var budget = new StalenessBudget(10, 20);
+
+        await svc.SetAnchorAsync("t1", anchor, budget);
+        var status = await svc.GetStatusAsync("t1", DateTimeOffset.UnixEpoch.AddSeconds(15));
+
+        Assert.Equal(anchor, status.Anchor);
+        Assert.True(status.Staleness.IsWarning);
+        Assert.False(status.Staleness.IsBreach);
+        Assert.Equal(15, status.Staleness.AgeSeconds);
+        var snap = telemetry.GetLatest("t1");
+        Assert.NotNull(snap);
+        Assert.Equal(status.Staleness.AgeSeconds, snap!.AgeSeconds);
+        Assert.True(snap.IsWarning);
+    }
+
+    private static TimeStatusService Build(out TimeTelemetry telemetry)
+    {
+        telemetry = new TimeTelemetry();
+        var options = Microsoft.Extensions.Options.Options.Create(new AirGapOptions());
+        return new TimeStatusService(new InMemoryTimeAnchorStore(), new StalenessCalculator(), telemetry, options);
+    }
+}

src/__Tests/AirGap/StellaOps.AirGap.Time.Tests/TimeTelemetryTests.cs

@@ -0,0 +1,27 @@
+using StellaOps.AirGap.Time.Models;
+using StellaOps.AirGap.Time.Services;
+
+namespace StellaOps.AirGap.Time.Tests;
+
+public class TimeTelemetryTests
+{
+    [Fact]
+    public void Records_latest_snapshot_per_tenant()
+    {
+        var telemetry = new TimeTelemetry();
+        var status = new TimeStatus(
+            new TimeAnchor(DateTimeOffset.UnixEpoch, "src", "fmt", "fp", "digest"),
+            new StalenessEvaluation(90, 60, 120, true, false),
+            StalenessBudget.Default,
+            new Dictionary<string, StalenessEvaluation>{{"advisories", new StalenessEvaluation(90,60,120,true,false)}},
+            DateTimeOffset.UtcNow);
+
+        telemetry.Record("t1", status);
+
+        var snap = telemetry.GetLatest("t1");
+        Assert.NotNull(snap);
+        Assert.Equal(90, snap!.AgeSeconds);
+        Assert.True(snap.IsWarning);
+        Assert.False(snap.IsBreach);
+    }
+}

src/__Tests/AirGap/StellaOps.AirGap.Time.Tests/TimeTokenParserTests.cs

@@ -0,0 +1,34 @@
+using StellaOps.AirGap.Time.Models;
+using StellaOps.AirGap.Time.Parsing;
+
+namespace StellaOps.AirGap.Time.Tests;
+
+public class TimeTokenParserTests
+{
+    [Fact]
+    public void EmptyTokenFails()
+    {
+        var parser = new TimeTokenParser();
+        var result = parser.TryParse(Array.Empty<byte>(), TimeTokenFormat.Roughtime, out var anchor);
+
+        Assert.False(result.IsValid);
+        Assert.Equal("token-empty", result.Reason);
+        Assert.Equal(TimeAnchor.Unknown, anchor);
+    }
+
+    [Fact]
+    public void RoughtimeTokenProducesDigest()
+    {
+        var parser = new TimeTokenParser();
+        var token = new byte[] { 0x01, 0x02, 0x03 };
+
+        var result = parser.TryParse(token, TimeTokenFormat.Roughtime, out var anchor);
+
+        Assert.True(result.IsValid);
+        Assert.Equal("Roughtime", anchor.Format);
+        Assert.Equal("roughtime-token", anchor.Source);
+        Assert.Equal("structure-stubbed", result.Reason);
+        Assert.Matches("^[0-9a-f]{64}$", anchor.TokenDigest);
+        Assert.NotEqual(DateTimeOffset.UnixEpoch, anchor.AnchorTime); // deterministic derivation
+    }
+}

src/__Tests/AirGap/StellaOps.AirGap.Time.Tests/TimeVerificationServiceTests.cs

@@ -0,0 +1,28 @@
+using StellaOps.AirGap.Time.Models;
+using StellaOps.AirGap.Time.Parsing;
+using StellaOps.AirGap.Time.Services;
+
+namespace StellaOps.AirGap.Time.Tests;
+
+public class TimeVerificationServiceTests
+{
+    [Fact]
+    public void FailsWithoutTrustRoots()
+    {
+        var svc = new TimeVerificationService();
+        var result = svc.Verify(new byte[] { 0x01 }, TimeTokenFormat.Roughtime, Array.Empty<TimeTrustRoot>(), out _);
+        Assert.False(result.IsValid);
+        Assert.Equal("trust-roots-required", result.Reason);
+    }
+
+    [Fact]
+    public void SucceedsForRoughtimeWithTrustRoot()
+    {
+        var svc = new TimeVerificationService();
+        var trust = new[] { new TimeTrustRoot("k1", new byte[] { 0x01 }, "rsassa-pss-sha256") };
+        var result = svc.Verify(new byte[] { 0x01, 0x02 }, TimeTokenFormat.Roughtime, trust, out var anchor);
+        Assert.True(result.IsValid);
+        Assert.Equal("Roughtime", anchor.Format);
+        Assert.Equal("k1", anchor.SignatureFingerprint);
+    }
+}