stella-ops.org/git.stella-ops.org
1
0
Fork 0
Code Issues Pull Requests Actions 2 Releases Wiki Activity

Add unit and integration tests for VexCandidateEmitter and SmartDiff repositories

Browse Source 
- Implemented comprehensive unit tests for VexCandidateEmitter to validate candidate emission logic based on various scenarios including absent and present APIs, confidence thresholds, and rate limiting.
- Added integration tests for SmartDiff PostgreSQL repositories, covering snapshot storage and retrieval, candidate storage, and material risk change handling.
- Ensured tests validate correct behavior for storing, retrieving, and querying snapshots and candidates, including edge cases and expected outcomes.
This commit is contained in:
master
2025-12-16 18:44:25 +02:00
parent 2170a58734
commit 3a2100aa78
126 changed files with 15776 additions and 542 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
src/Policy/StellaOps.Policy.Registry/AGENTS.md
View File

@@ -5,14 +5,14 @@ Stand up and operate the Policy Registry service defined in Epic 4. We own works
## Scope
- Service source under `src/Policy/StellaOps.Policy.Registry` (REST API, workers, storage schemas).
- Mongo models, migrations, and object storage bindings for policy workspaces, versions, reviews, promotions, simulations.
- PostgreSQL models, migrations, and object storage bindings for policy workspaces, versions, reviews, promotions, simulations.
- Integration with Policy Engine, Scheduler, Authority, Web Gateway, Telemetry.
- Attestation signing pipeline, evidence bundle management, and retention policies.
## Principles
1. **Immutability first** – Published versions are append-only; derive new versions rather than mutate.
2. **Determinism** – Compilation/simulation requests must produce reproducible artifacts and checksums.
3. **Tenant isolation** – Enforce scoping at every storage layer (Mongo collections, buckets, queues).
3. **Tenant isolation** – Enforce scoping at every storage layer (PostgreSQL schemas/RLS, buckets, queues).
4. **AOC alignment** – Registry stores metadata; it never mutates raw SBOM/advisory/VEX facts.
5. **Auditable** – Every transition emits structured events with actor, scope, digest, attestation IDs.
@@ -23,7 +23,7 @@ Stand up and operate the Policy Registry service defined in Epic 4. We own works
## Tooling
- .NET 10 preview (minimal API + background workers).
- MongoDB with per-tenant collections, S3-compatible object storage for bundles.
- PostgreSQL with per-tenant schemas/RLS, S3-compatible object storage for bundles.
- Background queue (Scheduler job queue or NATS) for batch simulations.
- Signing via Authority-issued OIDC tokens + cosign integration.