feat: Enhance Task Runner with simulation and failure policy support

- Added tests for output projection and failure policy population in TaskPackPlanner.
- Introduced new failure policy manifest in TestManifests.
- Implemented simulation endpoints in the web service for task execution.
- Created TaskRunnerServiceOptions for configuration management.
- Updated appsettings.json to include TaskRunner configuration.
- Enhanced PackRunWorkerService to handle execution graphs and state management.
- Added support for parallel execution and conditional steps in the worker service.
- Updated documentation to reflect new features and changes in execution flow.

src/AdvisoryAI/StellaOps.AdvisoryAI/DependencyInjection/SbomContextServiceCollectionExtensions.cs

@@ -0,0 +1,41 @@
+using System;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.DependencyInjection.Extensions;
+using Microsoft.Extensions.Options;
+using StellaOps.AdvisoryAI.Abstractions;
+using StellaOps.AdvisoryAI.Providers;
+using StellaOps.AdvisoryAI.Retrievers;
+
+namespace StellaOps.AdvisoryAI.DependencyInjection;
+
+public static class SbomContextServiceCollectionExtensions
+{
+    public static IServiceCollection AddSbomContext(this IServiceCollection services, Action<SbomContextClientOptions>? configure = null)
+    {
+        ArgumentNullException.ThrowIfNull(services);
+
+        var optionsBuilder = services.AddOptions<SbomContextClientOptions>();
+        if (configure is not null)
+        {
+            optionsBuilder.Configure(configure);
+        }
+
+        services.AddHttpClient<ISbomContextClient, SbomContextHttpClient>((serviceProvider, client) =>
+        {
+            var options = serviceProvider.GetRequiredService<IOptions<SbomContextClientOptions>>().Value;
+            if (options.BaseAddress is not null)
+            {
+                client.BaseAddress = options.BaseAddress;
+            }
+
+            if (!string.IsNullOrWhiteSpace(options.Tenant) && !string.IsNullOrWhiteSpace(options.TenantHeaderName))
+            {
+                client.DefaultRequestHeaders.Remove(options.TenantHeaderName);
+                client.DefaultRequestHeaders.Add(options.TenantHeaderName, options.Tenant);
+            }
+        });
+
+        services.TryAddSingleton<ISbomContextRetriever, SbomContextRetriever>();
+        return services;
+    }
+}

src/AdvisoryAI/StellaOps.AdvisoryAI/Orchestration/AdvisoryPipelineOrchestrator.cs

@@ -149,6 +149,49 @@ internal sealed class AdvisoryPipelineOrchestrator : IAdvisoryPipelineOrchestrat
         {
             builder["sbom_version_count"] = sbom.VersionTimeline.Count.ToString(CultureInfo.InvariantCulture);
             builder["sbom_dependency_path_count"] = sbom.DependencyPaths.Count.ToString(CultureInfo.InvariantCulture);
+
+            if (!sbom.EnvironmentFlags.IsEmpty)
+            {
+                foreach (var flag in sbom.EnvironmentFlags.OrderBy(pair => pair.Key, StringComparer.Ordinal))
+                {
+                    builder[$"sbom_env_{flag.Key}"] = flag.Value;
+                }
+            }
+
+            if (sbom.BlastRadius is not null)
+            {
+                builder["sbom_blast_impacted_assets"] = sbom.BlastRadius.ImpactedAssets.ToString(CultureInfo.InvariantCulture);
+                builder["sbom_blast_impacted_workloads"] = sbom.BlastRadius.ImpactedWorkloads.ToString(CultureInfo.InvariantCulture);
+                builder["sbom_blast_impacted_namespaces"] = sbom.BlastRadius.ImpactedNamespaces.ToString(CultureInfo.InvariantCulture);
+                if (sbom.BlastRadius.ImpactedPercentage is not null)
+                {
+                    builder["sbom_blast_impacted_percentage"] = sbom.BlastRadius.ImpactedPercentage.Value.ToString("G", CultureInfo.InvariantCulture);
+                }
+
+                if (!sbom.BlastRadius.Metadata.IsEmpty)
+                {
+                    foreach (var kvp in sbom.BlastRadius.Metadata.OrderBy(pair => pair.Key, StringComparer.Ordinal))
+                    {
+                        builder[$"sbom_blast_meta_{kvp.Key}"] = kvp.Value;
+                    }
+                }
+            }
+
+            if (!sbom.Metadata.IsEmpty)
+            {
+                foreach (var kvp in sbom.Metadata.OrderBy(pair => pair.Key, StringComparer.Ordinal))
+                {
+                    builder[$"sbom_meta_{kvp.Key}"] = kvp.Value;
+                }
+            }
+        }
+
+        if (dependency is not null)
+        {
+            foreach (var kvp in dependency.Metadata.OrderBy(pair => pair.Key, StringComparer.Ordinal))
+            {
+                builder[$"dependency_{kvp.Key}"] = kvp.Value;
+            }
         }
 
         return builder.ToImmutable();
@@ -201,12 +244,100 @@ internal sealed class AdvisoryPipelineOrchestrator : IAdvisoryPipelineOrchestrat
         {
             builder.Append("|sbom:timeline=").Append(sbom.VersionTimeline.Count);
             builder.Append("|sbom:paths=").Append(sbom.DependencyPaths.Count);
-            foreach (var kvp in sbom.Metadata.OrderBy(k => k.Key, StringComparer.Ordinal))
+            foreach (var entry in sbom.VersionTimeline
+                         .OrderBy(e => e.Version, StringComparer.Ordinal)
+                         .ThenBy(e => e.FirstObserved.ToUnixTimeMilliseconds())
+                         .ThenBy(e => e.LastObserved?.ToUnixTimeMilliseconds() ?? long.MinValue)
+                         .ThenBy(e => e.Status, StringComparer.Ordinal)
+                         .ThenBy(e => e.Source, StringComparer.Ordinal))
             {
-                builder.Append("|sbommeta:")
-                       .Append(kvp.Key)
-                       .Append('=')
-                       .Append(kvp.Value);
+                builder.Append("|timeline:")
+                       .Append(entry.Version)
+                       .Append('@')
+                       .Append(entry.FirstObserved.ToUnixTimeMilliseconds())
+                       .Append('@')
+                       .Append(entry.LastObserved?.ToUnixTimeMilliseconds() ?? -1)
+                       .Append('@')
+                       .Append(entry.Status)
+                       .Append('@')
+                       .Append(entry.Source);
+            }
+
+            foreach (var path in sbom.DependencyPaths
+                         .OrderBy(path => path.IsRuntime)
+                         .ThenBy(path => string.Join(">", path.Nodes.Select(node => node.Identifier)), StringComparer.Ordinal))
+            {
+                builder.Append("|path:")
+                       .Append(path.IsRuntime ? 'R' : 'D');
+
+                foreach (var node in path.Nodes)
+                {
+                    builder.Append(":")
+                           .Append(node.Identifier)
+                           .Append('@')
+                           .Append(node.Version ?? string.Empty);
+                }
+
+                if (!string.IsNullOrWhiteSpace(path.Source))
+                {
+                    builder.Append("|pathsrc:").Append(path.Source);
+                }
+
+                if (!path.Metadata.IsEmpty)
+                {
+                    foreach (var kvp in path.Metadata.OrderBy(pair => pair.Key, StringComparer.Ordinal))
+                    {
+                        builder.Append("|pathmeta:")
+                               .Append(kvp.Key)
+                               .Append('=')
+                               .Append(kvp.Value);
+                    }
+                }
+            }
+
+            if (!sbom.EnvironmentFlags.IsEmpty)
+            {
+                foreach (var flag in sbom.EnvironmentFlags.OrderBy(pair => pair.Key, StringComparer.Ordinal))
+                {
+                    builder.Append("|env:")
+                           .Append(flag.Key)
+                           .Append('=')
+                           .Append(flag.Value);
+                }
+            }
+
+            if (sbom.BlastRadius is not null)
+            {
+                builder.Append("|blast:")
+                       .Append(sbom.BlastRadius.ImpactedAssets)
+                       .Append(',')
+                       .Append(sbom.BlastRadius.ImpactedWorkloads)
+                       .Append(',')
+                       .Append(sbom.BlastRadius.ImpactedNamespaces)
+                       .Append(',')
+                       .Append(sbom.BlastRadius.ImpactedPercentage?.ToString("G", CultureInfo.InvariantCulture) ?? string.Empty);
+
+                if (!sbom.BlastRadius.Metadata.IsEmpty)
+                {
+                    foreach (var kvp in sbom.BlastRadius.Metadata.OrderBy(pair => pair.Key, StringComparer.Ordinal))
+                    {
+                        builder.Append("|blastmeta:")
+                               .Append(kvp.Key)
+                               .Append('=')
+                               .Append(kvp.Value);
+                    }
+                }
+            }
+
+            if (!sbom.Metadata.IsEmpty)
+            {
+                foreach (var kvp in sbom.Metadata.OrderBy(pair => pair.Key, StringComparer.Ordinal))
+                {
+                    builder.Append("|sbommeta:")
+                           .Append(kvp.Key)
+                           .Append('=')
+                           .Append(kvp.Value);
+                }
             }
         }
 
@@ -220,7 +351,20 @@ internal sealed class AdvisoryPipelineOrchestrator : IAdvisoryPipelineOrchestrat
                        .Append(':')
                        .Append(node.RuntimeOccurrences)
                        .Append(':')
-                       .Append(node.DevelopmentOccurrences);
+                       .Append(node.DevelopmentOccurrences)
+                       .Append(':')
+                       .Append(string.Join(',', node.Versions));
+            }
+
+            if (!dependency.Metadata.IsEmpty)
+            {
+                foreach (var kvp in dependency.Metadata.OrderBy(pair => pair.Key, StringComparer.Ordinal))
+                {
+                    builder.Append("|depmeta:")
+                           .Append(kvp.Key)
+                           .Append('=')
+                           .Append(kvp.Value);
+                }
             }
         }
 

src/AdvisoryAI/StellaOps.AdvisoryAI/Orchestration/AdvisoryTaskPlan.cs

@@ -2,6 +2,7 @@ using System.Collections.Immutable;
 using StellaOps.AdvisoryAI.Abstractions;
 using StellaOps.AdvisoryAI.Documents;
 using StellaOps.AdvisoryAI.Context;
+using StellaOps.AdvisoryAI.Documents;
 using StellaOps.AdvisoryAI.Tools;
 
 namespace StellaOps.AdvisoryAI.Orchestration;

src/AdvisoryAI/StellaOps.AdvisoryAI/Providers/SbomContextClientOptions.cs

@@ -0,0 +1,30 @@
+using System;
+
+namespace StellaOps.AdvisoryAI.Providers;
+
+/// <summary>
+/// Configuration for the SBOM context HTTP client.
+/// </summary>
+public sealed class SbomContextClientOptions
+{
+    /// <summary>
+    /// Base address for the SBOM service. Required.
+    /// </summary>
+    public Uri? BaseAddress { get; set; }
+
+    /// <summary>
+    /// Relative endpoint that returns SBOM context payloads.
+    /// Defaults to <c>api/sbom/context</c>.
+    /// </summary>
+    public string ContextEndpoint { get; set; } = "api/sbom/context";
+
+    /// <summary>
+    /// Optional tenant identifier that should be forwarded to the SBOM service.
+    /// </summary>
+    public string? Tenant { get; set; }
+
+    /// <summary>
+    /// Header name used when forwarding the tenant. Defaults to <c>X-StellaOps-Tenant</c>.
+    /// </summary>
+    public string TenantHeaderName { get; set; } = "X-StellaOps-Tenant";
+}

src/AdvisoryAI/StellaOps.AdvisoryAI/Providers/SbomContextHttpClient.cs

@@ -0,0 +1,232 @@
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Globalization;
+using System.Linq;
+using System.Net;
+using System.Net.Http;
+using System.Net.Http.Json;
+using System.Text.Json;
+using System.Text.Json.Serialization;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.Extensions.Logging;
+using Microsoft.Extensions.Options;
+
+namespace StellaOps.AdvisoryAI.Providers;
+
+internal sealed class SbomContextHttpClient : ISbomContextClient
+{
+    private static readonly JsonSerializerOptions SerializerOptions = new(JsonSerializerDefaults.Web)
+    {
+        PropertyNameCaseInsensitive = true
+    };
+
+    private readonly HttpClient httpClient;
+    private readonly SbomContextClientOptions options;
+    private readonly ILogger<SbomContextHttpClient>? logger;
+
+    public SbomContextHttpClient(
+        HttpClient httpClient,
+        IOptions<SbomContextClientOptions> options,
+        ILogger<SbomContextHttpClient>? logger = null)
+    {
+        this.httpClient = httpClient ?? throw new ArgumentNullException(nameof(httpClient));
+        if (options is null)
+        {
+            throw new ArgumentNullException(nameof(options));
+        }
+
+        this.options = options.Value ?? throw new ArgumentNullException(nameof(options));
+
+        if (this.options.BaseAddress is not null && this.httpClient.BaseAddress is null)
+        {
+            this.httpClient.BaseAddress = this.options.BaseAddress;
+        }
+
+        if (this.httpClient.BaseAddress is null)
+        {
+            throw new InvalidOperationException("SBOM context client requires a BaseAddress to be configured.");
+        }
+
+        this.httpClient.DefaultRequestHeaders.Accept.ParseAdd("application/json");
+        this.logger = logger;
+    }
+
+    public async Task<SbomContextDocument?> GetContextAsync(SbomContextQuery query, CancellationToken cancellationToken)
+    {
+        if (query is null)
+        {
+            throw new ArgumentNullException(nameof(query));
+        }
+
+        var endpoint = options.ContextEndpoint?.Trim() ?? string.Empty;
+        if (endpoint.Length == 0)
+        {
+            throw new InvalidOperationException("SBOM context endpoint must be configured.");
+        }
+
+        var requestUri = BuildRequestUri(endpoint, query);
+        using var request = new HttpRequestMessage(HttpMethod.Get, requestUri);
+        ApplyTenantHeader(request);
+
+        using var response = await httpClient.SendAsync(request, cancellationToken).ConfigureAwait(false);
+        if (response.StatusCode == HttpStatusCode.NotFound || response.StatusCode == HttpStatusCode.NoContent)
+        {
+            logger?.LogDebug("Received {StatusCode} for SBOM context request {Uri}; returning null.", (int)response.StatusCode, requestUri);
+            return null;
+        }
+
+        if (!response.IsSuccessStatusCode)
+        {
+            var content = response.Content is null
+                ? string.Empty
+                : await response.Content.ReadAsStringAsync(cancellationToken).ConfigureAwait(false);
+
+            logger?.LogWarning(
+                "SBOM context request {Uri} failed with status {StatusCode}. Payload: {Payload}",
+                requestUri,
+                (int)response.StatusCode,
+                content);
+
+            response.EnsureSuccessStatusCode();
+        }
+
+        var payload = await response.Content.ReadFromJsonAsync<SbomContextPayload>(SerializerOptions, cancellationToken)
+            .ConfigureAwait(false);
+
+        if (payload is null)
+        {
+            logger?.LogWarning("SBOM context response for {Uri} was empty.", requestUri);
+            return null;
+        }
+
+        return payload.ToDocument();
+    }
+
+    private Uri BuildRequestUri(string endpoint, SbomContextQuery query)
+    {
+        var relative = endpoint.StartsWith("/", StringComparison.Ordinal)
+            ? endpoint[1..]
+            : endpoint;
+
+        var queryBuilder = new StringBuilder();
+
+        AppendQuery(queryBuilder, "artifactId", query.ArtifactId);
+        AppendQuery(queryBuilder, "maxTimelineEntries", query.MaxTimelineEntries.ToString(CultureInfo.InvariantCulture));
+        AppendQuery(queryBuilder, "maxDependencyPaths", query.MaxDependencyPaths.ToString(CultureInfo.InvariantCulture));
+        AppendQuery(queryBuilder, "includeEnvironmentFlags", query.IncludeEnvironmentFlags ? "true" : "false");
+        AppendQuery(queryBuilder, "includeBlastRadius", query.IncludeBlastRadius ? "true" : "false");
+
+        if (!string.IsNullOrWhiteSpace(query.Purl))
+        {
+            AppendQuery(queryBuilder, "purl", query.Purl!);
+        }
+
+        var uriString = queryBuilder.Length > 0 ? $"{relative}?{queryBuilder}" : relative;
+        return new Uri(httpClient.BaseAddress!, uriString);
+
+        static void AppendQuery(StringBuilder builder, string name, string value)
+        {
+            if (builder.Length > 0)
+            {
+                builder.Append('&');
+            }
+
+            builder.Append(Uri.EscapeDataString(name));
+            builder.Append('=');
+            builder.Append(Uri.EscapeDataString(value));
+        }
+    }
+
+    private void ApplyTenantHeader(HttpRequestMessage request)
+    {
+        if (string.IsNullOrWhiteSpace(options.Tenant) || string.IsNullOrWhiteSpace(options.TenantHeaderName))
+        {
+            return;
+        }
+
+        if (!request.Headers.Contains(options.TenantHeaderName))
+        {
+            request.Headers.Add(options.TenantHeaderName, options.Tenant);
+        }
+    }
+
+    private sealed record SbomContextPayload(
+        [property: JsonPropertyName("artifactId")] string ArtifactId,
+        [property: JsonPropertyName("purl")] string? Purl,
+        [property: JsonPropertyName("versions")] ImmutableArray<SbomVersionPayload> Versions,
+        [property: JsonPropertyName("dependencyPaths")] ImmutableArray<SbomDependencyPathPayload> DependencyPaths,
+        [property: JsonPropertyName("environmentFlags")] ImmutableDictionary<string, string> EnvironmentFlags,
+        [property: JsonPropertyName("blastRadius")] SbomBlastRadiusPayload? BlastRadius,
+        [property: JsonPropertyName("metadata")] ImmutableDictionary<string, string> Metadata)
+    {
+        public SbomContextDocument ToDocument()
+            => new(
+                ArtifactId,
+                Purl,
+                Versions.IsDefault ? ImmutableArray<SbomVersionRecord>.Empty : Versions.Select(v => v.ToRecord()).ToImmutableArray(),
+                DependencyPaths.IsDefault ? ImmutableArray<SbomDependencyPathRecord>.Empty : DependencyPaths.Select(p => p.ToRecord()).ToImmutableArray(),
+                EnvironmentFlags == default ? ImmutableDictionary<string, string>.Empty : EnvironmentFlags,
+                BlastRadius?.ToRecord(),
+                Metadata == default ? ImmutableDictionary<string, string>.Empty : Metadata);
+    }
+
+    private sealed record SbomVersionPayload(
+        [property: JsonPropertyName("version")] string Version,
+        [property: JsonPropertyName("firstObserved")] DateTimeOffset FirstObserved,
+        [property: JsonPropertyName("lastObserved")] DateTimeOffset? LastObserved,
+        [property: JsonPropertyName("status")] string Status,
+        [property: JsonPropertyName("source")] string Source,
+        [property: JsonPropertyName("isFixAvailable")] bool IsFixAvailable,
+        [property: JsonPropertyName("metadata")] ImmutableDictionary<string, string> Metadata)
+    {
+        public SbomVersionRecord ToRecord()
+            => new(
+                Version,
+                FirstObserved,
+                LastObserved,
+                Status,
+                Source,
+                IsFixAvailable,
+                Metadata == default ? ImmutableDictionary<string, string>.Empty : Metadata);
+    }
+
+    private sealed record SbomDependencyPathPayload(
+        [property: JsonPropertyName("nodes")] ImmutableArray<SbomDependencyNodePayload> Nodes,
+        [property: JsonPropertyName("isRuntime")] bool IsRuntime,
+        [property: JsonPropertyName("source")] string? Source,
+        [property: JsonPropertyName("metadata")] ImmutableDictionary<string, string> Metadata)
+    {
+        public SbomDependencyPathRecord ToRecord()
+            => new(
+                Nodes.IsDefault ? ImmutableArray<SbomDependencyNodeRecord>.Empty : Nodes.Select(n => n.ToRecord()).ToImmutableArray(),
+                IsRuntime,
+                Source,
+                Metadata == default ? ImmutableDictionary<string, string>.Empty : Metadata);
+    }
+
+    private sealed record SbomDependencyNodePayload(
+        [property: JsonPropertyName("identifier")] string Identifier,
+        [property: JsonPropertyName("version")] string? Version)
+    {
+        public SbomDependencyNodeRecord ToRecord()
+            => new(Identifier, Version);
+    }
+
+    private sealed record SbomBlastRadiusPayload(
+        [property: JsonPropertyName("impactedAssets")] int ImpactedAssets,
+        [property: JsonPropertyName("impactedWorkloads")] int ImpactedWorkloads,
+        [property: JsonPropertyName("impactedNamespaces")] int ImpactedNamespaces,
+        [property: JsonPropertyName("impactedPercentage")] double? ImpactedPercentage,
+        [property: JsonPropertyName("metadata")] ImmutableDictionary<string, string> Metadata)
+    {
+        public SbomBlastRadiusRecord ToRecord()
+            => new(
+                ImpactedAssets,
+                ImpactedWorkloads,
+                ImpactedNamespaces,
+                ImpactedPercentage,
+                Metadata == default ? ImmutableDictionary<string, string>.Empty : Metadata);
+    }
+}

src/AdvisoryAI/StellaOps.AdvisoryAI/StellaOps.AdvisoryAI.csproj

@@ -10,7 +10,6 @@
   <ItemGroup>
     <PackageReference Include="Microsoft.Extensions.Logging.Abstractions" Version="10.0.0-rc.2.25502.107" />
     <PackageReference Include="Microsoft.Extensions.Options" Version="10.0.0-rc.2.25502.107" />
-    <PackageReference Include="System.Text.Json" Version="10.0.0-rc.2.25502.107" />
   </ItemGroup>
   <ItemGroup>
     <ProjectReference Include="..\..\Concelier\__Libraries\StellaOps.Concelier.Core\StellaOps.Concelier.Core.csproj" />

src/AdvisoryAI/StellaOps.AdvisoryAI/TASKS.md

@@ -2,16 +2,14 @@
 | ID | Status | Owner(s) | Depends on | Description | Exit Criteria |
 |----|--------|----------|------------|-------------|---------------|
 | AIAI-31-001 | DONE (2025-11-02) | Advisory AI Guild | CONCELIER-VULN-29-001, EXCITITOR-VULN-29-001 | Implement structured and vector retrievers for advisories/VEX with paragraph anchors and citation metadata. | Retrievers return deterministic chunks with source IDs/sections; unit tests cover CSAF/OSV/vendor formats. |
-| AIAI-31-002 | DOING | Advisory AI Guild, SBOM Service Guild | SBOM-VULN-29-001 | Build SBOM context retriever (purl version timelines, dependency paths, env flags, blast radius estimator). | Retriever returns paths/metrics under SLA; tests cover ecosystems. |
-| AIAI-31-003 | DOING | Advisory AI Guild | AIAI-31-001..002 | Implement deterministic toolset (version comparators, range checks, dependency analysis, policy lookup) exposed via orchestrator. | Tools validated with property tests; outputs cached; docs updated. |
+| AIAI-31-002 | DONE (2025-11-04) | Advisory AI Guild, SBOM Service Guild | SBOM-VULN-29-001 | Build SBOM context retriever (purl version timelines, dependency paths, env flags, blast radius estimator). | Retriever returns paths/metrics under SLA; tests cover ecosystems. |
+| AIAI-31-003 | DONE (2025-11-04) | Advisory AI Guild | AIAI-31-001..002 | Implement deterministic toolset (version comparators, range checks, dependency analysis, policy lookup) exposed via orchestrator. | Tools validated with property tests; outputs cached; docs updated. |
 | AIAI-31-004 | DOING | Advisory AI Guild | AIAI-31-001..003, AUTH-VULN-29-001 | Build orchestration pipeline for Summary/Conflict/Remediation tasks (prompt templates, tool calls, token budgets, caching). | Pipeline executes tasks deterministically; caches keyed by tuple+policy; integration tests cover tasks. |
-| AIAI-31-004A | DONE (2025-11-03) | Advisory AI Guild, Platform Guild | AIAI-31-004, AIAI-31-002 | Wire `AdvisoryPipelineOrchestrator` into WebService/Worker, expose API/queue contracts, emit metrics, and stand up cache stub. | API returns plan metadata; worker executes queue message; metrics recorded; doc updated. |
-> 2025-11-03: In-memory plan cache + task queue implemented, WebService exposes `/api/v1/advisory/plan` & `/api/v1/advisory/queue`, pipeline metrics wired, worker hosted service dequeues plans and logs processed runs; docs/sprint notes updated.
-| AIAI-31-004B | DONE (2025-11-03) | Advisory AI Guild, Security Guild | AIAI-31-004A, DOCS-AIAI-31-003, AUTH-AIAI-31-004 | Implement prompt assembler, guardrail plumbing, cache persistence, DSSE provenance; add golden outputs. | Deterministic outputs cached; guardrails enforced; tests cover prompt assembly + caching. |
-> 2025-11-03: Added deterministic prompt assembler, no-op guardrail pipeline hooks, DSSE-ready output persistence with provenance, updated metrics/DI wiring, and golden prompt tests.
+| AIAI-31-004A | DOING (2025-11-04) | Advisory AI Guild, Platform Guild | AIAI-31-004, AIAI-31-002 | Wire `AdvisoryPipelineOrchestrator` into WebService/Worker, expose API/queue contracts, emit metrics, and stand up cache stub. | API returns plan metadata; worker executes queue message; metrics recorded; doc updated. |
+| AIAI-31-004B | TODO | Advisory AI Guild, Security Guild | AIAI-31-004A, DOCS-AIAI-31-003, AUTH-AIAI-31-004 | Implement prompt assembler, guardrail plumbing, cache persistence, DSSE provenance; add golden outputs. | Deterministic outputs cached; guardrails enforced; tests cover prompt assembly + caching. |
 | AIAI-31-004C | TODO | Advisory AI Guild, CLI Guild, Docs Guild | AIAI-31-004B, CLI-AIAI-31-003 | Deliver CLI `stella advise run <task>` command, renderers, documentation updates, and CLI golden tests. | CLI command produces deterministic output; docs published; smoke run recorded. |
-| AIAI-31-005 | DOING (2025-11-03) | Advisory AI Guild, Security Guild | AIAI-31-004 | Implement guardrails (redaction, injection defense, output validation, citation enforcement) and fail-safe handling. | Guardrails block adversarial inputs; output validator enforces schemas; security tests pass. |
-| AIAI-31-006 | DOING (2025-11-03) | Advisory AI Guild | AIAI-31-004..005 | Expose REST API endpoints (`/advisory/ai/*`) with RBAC, rate limits, OpenAPI schemas, and batching support. | Endpoints deployed with schema validation; rate limits enforced; integration tests cover error codes. |
+| AIAI-31-005 | TODO | Advisory AI Guild, Security Guild | AIAI-31-004 | Implement guardrails (redaction, injection defense, output validation, citation enforcement) and fail-safe handling. | Guardrails block adversarial inputs; output validator enforces schemas; security tests pass. |
+| AIAI-31-006 | TODO | Advisory AI Guild | AIAI-31-004..005 | Expose REST API endpoints (`/advisory/ai/*`) with RBAC, rate limits, OpenAPI schemas, and batching support. | Endpoints deployed with schema validation; rate limits enforced; integration tests cover error codes. |
 | AIAI-31-007 | TODO | Advisory AI Guild, Observability Guild | AIAI-31-004..006 | Instrument metrics (`advisory_ai_latency`, `guardrail_blocks`, `validation_failures`, `citation_coverage`), logs, and traces; publish dashboards/alerts. | Telemetry live; dashboards approved; alerts configured. |
 | AIAI-31-008 | TODO | Advisory AI Guild, DevOps Guild | AIAI-31-006..007 | Package inference on-prem container, remote inference toggle, Helm/Compose manifests, scaling guidance, offline kit instructions. | Deployment docs merged; smoke deploy executed; offline kit updated; feature flags documented. |
 | AIAI-31-010 | DONE (2025-11-02) | Advisory AI Guild | CONCELIER-VULN-29-001, EXCITITOR-VULN-29-001 | Implement Concelier advisory raw document provider mapping CSAF/OSV payloads into structured chunks for retrieval. | Provider resolves content format, preserves metadata, and passes unit tests covering CSAF/OSV cases. |
@@ -19,10 +17,10 @@
 | AIAI-31-009 | TODO | Advisory AI Guild, QA Guild | AIAI-31-001..006 | Develop unit/golden/property/perf tests, injection harness, and regression suite; ensure determinism with seeded caches. | Test suite green; golden outputs stored; injection tests pass; perf targets documented. |
 
 > 2025-11-02: AIAI-31-002 – SBOM context domain models finalized with limiter guards; retriever tests now cover flag toggles and path dedupe. Service client integration still pending with SBOM guild.
-> 2025-11-03: AIAI-31-002 – HTTP SBOM context client wired with configurable headers/timeouts, DI registers fallback null client and typed retriever; tests cover request shaping, response mapping, and 404 handling.
-> 2025-11-03: Blocking follow-up tracked via SBOM-AIAI-31-003 – waiting on SBOM base URL/API key hand-off plus joint smoke test before enabling live retrieval in staging.
+> 2025-11-04: AIAI-31-002 – Introduced `SbomContextHttpClient`, DI helper (`AddSbomContext`), and HTTP-mapping tests; retriever wired to typed client with tenant header support and deterministic query construction.
 
 > 2025-11-02: AIAI-31-003 moved to DOING – starting deterministic tooling surface (version comparators & dependency analysis). Added semantic-version + EVR comparators and published toolset interface; awaiting downstream wiring.
+> 2025-11-04: AIAI-31-003 completed – toolset wired via DI/orchestrator, SBOM context client available, and unit coverage for compare/range/dependency analysis extended.
 
 > 2025-11-02: AIAI-31-004 started orchestration pipeline work – begin designing summary/conflict/remediation workflow (deterministic sequence + cache keys).