diff --git a/.gitea/workflows/risk-bundle-ci.yml b/.gitea/workflows/risk-bundle-ci.yml new file mode 100644 index 000000000..c3a4088e7 --- /dev/null +++ b/.gitea/workflows/risk-bundle-ci.yml @@ -0,0 +1,198 @@ +name: Risk Bundle CI + +on: + push: + branches: [ main ] + paths: + - 'src/ExportCenter/StellaOps.ExportCenter.RiskBundles/**' + - 'src/ExportCenter/StellaOps.ExportCenter/StellaOps.ExportCenter.Worker/**' + - 'ops/devops/risk-bundle/**' + - '.gitea/workflows/risk-bundle-ci.yml' + - 'docs/modules/export-center/operations/risk-bundle-*.md' + pull_request: + branches: [ main, develop ] + paths: + - 'src/ExportCenter/StellaOps.ExportCenter.RiskBundles/**' + - 'src/ExportCenter/StellaOps.ExportCenter/StellaOps.ExportCenter.Worker/**' + - 'ops/devops/risk-bundle/**' + - '.gitea/workflows/risk-bundle-ci.yml' + - 'docs/modules/export-center/operations/risk-bundle-*.md' + workflow_dispatch: + inputs: + include_osv: + description: 'Include OSV providers (larger bundle)' + type: boolean + default: false + publish_checksums: + description: 'Publish checksums to artifact store' + type: boolean + default: true + +jobs: + risk-bundle-build: + runs-on: ubuntu-22.04 + env: + DOTNET_VERSION: '10.0.100' + ARTIFACT_DIR: ${{ github.workspace }}/.artifacts + BUNDLE_OUTPUT: ${{ github.workspace }}/.artifacts/risk-bundle + steps: + - name: Checkout + uses: actions/checkout@v4 + with: + fetch-depth: 0 + + - name: Export OpenSSL 1.1 shim for Mongo2Go + run: scripts/enable-openssl11-shim.sh + + - name: Set up .NET SDK + uses: actions/setup-dotnet@v4 + with: + dotnet-version: ${{ env.DOTNET_VERSION }} + include-prerelease: true + + - name: Restore + run: dotnet restore src/ExportCenter/StellaOps.ExportCenter.RiskBundles/StellaOps.ExportCenter.RiskBundles.csproj + + - name: Build + run: dotnet build src/ExportCenter/StellaOps.ExportCenter.RiskBundles/StellaOps.ExportCenter.RiskBundles.csproj -c Release /p:ContinuousIntegrationBuild=true + + - name: Test RiskBundle unit tests + run: | + mkdir -p $ARTIFACT_DIR + dotnet test src/ExportCenter/StellaOps.ExportCenter/StellaOps.ExportCenter.Tests/StellaOps.ExportCenter.Tests.csproj \ + -c Release \ + --filter "FullyQualifiedName~RiskBundle" \ + --logger "trx;LogFileName=risk-bundle-tests.trx" \ + --results-directory $ARTIFACT_DIR + + - name: Build risk bundle (fixtures) + run: | + mkdir -p $BUNDLE_OUTPUT + ops/devops/risk-bundle/build-bundle.sh --output "$BUNDLE_OUTPUT" --fixtures-only + + - name: Verify bundle integrity + run: ops/devops/risk-bundle/verify-bundle.sh "$BUNDLE_OUTPUT/risk-bundle.tar.gz" + + - name: Generate checksums + run: | + cd $BUNDLE_OUTPUT + sha256sum risk-bundle.tar.gz > risk-bundle.tar.gz.sha256 + sha256sum manifest.json > manifest.json.sha256 + cat risk-bundle.tar.gz.sha256 manifest.json.sha256 > checksums.txt + echo "Bundle checksums:" + cat checksums.txt + + - name: Upload risk bundle artifacts + uses: actions/upload-artifact@v4 + with: + name: risk-bundle-artifacts + path: | + ${{ env.BUNDLE_OUTPUT }}/risk-bundle.tar.gz + ${{ env.BUNDLE_OUTPUT }}/risk-bundle.tar.gz.sig + ${{ env.BUNDLE_OUTPUT }}/manifest.json + ${{ env.BUNDLE_OUTPUT }}/checksums.txt + ${{ env.ARTIFACT_DIR }}/*.trx + + - name: Upload test results + uses: actions/upload-artifact@v4 + if: always() + with: + name: risk-bundle-test-results + path: ${{ env.ARTIFACT_DIR }}/*.trx + + risk-bundle-offline-kit: + runs-on: ubuntu-22.04 + needs: risk-bundle-build + env: + ARTIFACT_DIR: ${{ github.workspace }}/.artifacts + OFFLINE_KIT_DIR: ${{ github.workspace }}/.artifacts/offline-kit + steps: + - name: Checkout + uses: actions/checkout@v4 + + - name: Download risk bundle artifacts + uses: actions/download-artifact@v4 + with: + name: risk-bundle-artifacts + path: ${{ env.ARTIFACT_DIR }} + + - name: Package for offline kit + run: | + mkdir -p $OFFLINE_KIT_DIR/risk-bundles + cp $ARTIFACT_DIR/risk-bundle.tar.gz $OFFLINE_KIT_DIR/risk-bundles/ + cp $ARTIFACT_DIR/risk-bundle.tar.gz.sig $OFFLINE_KIT_DIR/risk-bundles/ 2>/dev/null || true + cp $ARTIFACT_DIR/manifest.json $OFFLINE_KIT_DIR/risk-bundles/ + cp $ARTIFACT_DIR/checksums.txt $OFFLINE_KIT_DIR/risk-bundles/ + + # Create offline kit manifest entry + cat > $OFFLINE_KIT_DIR/risk-bundles/kit-manifest.json < out/checksums/risk-bundle/latest.json <0 and Stratified has StratifyBy field, warns on potentially large exports), ResolveAsync (generates mock items, applies sampling with deterministic Random seeding via seed parameter, First/Last sampling, Stratified by field grouping), EstimateAsync (returns item count, estimated bytes, estimated processing time). `IExportPlanner.cs` interface with CreatePlanAsync, GetPlanAsync, ValidatePlanAsync, CancelPlanAsync. `ExportPlanner.cs` implementation with: ConcurrentDictionary in-memory plan store, CreatePlanAsync (loads profile via IExportProfileRepository, validates Active status, parses ScopeJson/FormatJson, validates scope, resolves scope to items, builds phases via BuildPhases, creates plan with 60-minute validity), GetPlanAsync, ValidatePlanAsync (checks expiration, re-validates scope), CancelPlanAsync (only Ready/Creating status). BuildPhases creates ordered phases: DataFetch→Transform (conditional on redaction/normalization/sorting)→WriteOutput→GenerateManifest→Sign (conditional on Mirror format). `IExportProfileRepository` interface with GetByIdAsync, GetActiveProfilesAsync, CreateAsync, UpdateAsync. `InMemoryExportProfileRepository` implementation with ConcurrentDictionary keyed by (TenantId, ProfileId). Changed ExportProfile from class to record to support `with` expressions in plan updates. Created tests: `ExportScopeResolverTests.cs` (21 test cases for scope resolution, validation, deterministic sampling, estimation), `ExportPlannerTests.cs` (12 test cases for plan creation, validation, cancellation, phase generation, correlation tracking). Core project builds successfully with 0 errors. | Implementer | +| 2025-12-07 | **EXPORT-SVC-35-001 DONE:** Bootstrapped exporter service with Postgres migrations for export data layer. Created `Configuration/ExportCenterOptions.cs` in Core with: `ExportCenterOptions` (DatabaseOptions, ObjectStoreOptions, TimelineOptions, SigningOptions, QuotaOptions), `DatabaseOptions` (ConnectionString, ApplyMigrationsAtStartup). Created domain models in `Domain/`: `ExportProfile.cs` (ProfileId, TenantId, Name, Description, Kind, Status, ScopeJson, FormatJson, SigningJson, Schedule, timestamps; enums ExportProfileKind AdHoc/Scheduled/EventDriven/Continuous, ExportProfileStatus Draft/Active/Paused/Archived), `ExportRun.cs` (RunId, ProfileId, TenantId, Status, Trigger, CorrelationId, InitiatedBy, item counts, TotalSizeBytes, ErrorJson; enums ExportRunStatus Queued→Cancelled, ExportRunTrigger Manual/Scheduled/Event/Api), `ExportInput.cs` (InputId, RunId, TenantId, Kind, Status, SourceRef, Name, ContentHash, SizeBytes, MetadataJson; enums ExportInputKind Sbom/Vex/Attestation/ScanReport/PolicyResult/Evidence/RiskBundle/Advisory, ExportInputStatus Pending→Skipped), `ExportDistribution.cs` (DistributionId, RunId, TenantId, Kind, Status, Target, ArtifactPath, ArtifactHash, SizeBytes, ContentType, MetadataJson, AttemptCount; enums ExportDistributionKind FileSystem/AmazonS3/Mirror/OfflineKit/Webhook, ExportDistributionStatus Pending→Cancelled). Created database infrastructure in Infrastructure `Db/`: `MigrationScript.cs` (version parsing, SHA256 checksum, line-ending normalization), `MigrationLoader.cs` (loads embedded SQL resources ordered by version), `ExportCenterDataSource.cs` (NpgsqlDataSource with tenant session config via `app.current_tenant`), `ExportCenterMigrationRunner.cs` (applies migrations with checksum validation), `ExportCenterDbServiceExtensions.cs` (DI registration, `ExportCenterMigrationHostedService` for startup migrations). Created `Db/Migrations/001_initial_schema.sql` with schemas export_center/export_center_app, `require_current_tenant()` function, tables (export_profiles, export_runs, export_inputs, export_distributions) with RLS policies, indexes (tenant_status, profile_created, correlation), FK constraints, `update_updated_at` trigger. Updated csproj to add Npgsql 8.0.3 and EmbeddedResource for SQL files. Added tests: `MigrationScriptTests.cs` (version parsing, SHA256 determinism, line-ending normalization), `MigrationLoaderTests.cs` (resource loading, ordering, validation), `ExportProfileTests.cs`/`ExportRunTests.cs`/`ExportInputTests.cs`/`ExportDistributionTests.cs` (domain model construction, enum value verification). Core and Infrastructure projects build successfully with 0 errors. | Implementer | +| 2025-12-07 | **EXPORT-RISK-70-001 DONE:** Integrated risk bundle builds into offline kit packaging with checksum verification. Added to `OfflineKitModels.cs`: `OfflineKitRiskBundleEntry` record (kind, exportId, bundleId, inputsHash, providers[], rootHash, artifact, checksum, createdAt), `OfflineKitRiskProviderInfo` record (providerId, source, snapshotDate, optional), `OfflineKitRiskBundleRequest` record. Added to `OfflineKitPackager.cs`: `RiskBundlesDir` constant ("risk-bundles"), `RiskBundleFileName` constant ("export-risk-bundle-v1.tgz"), `AddRiskBundle` method (writes bundle to risk-bundles/ directory with SHA256 checksum), `CreateRiskBundleEntry` method (creates manifest entry with provider info). Updated `OfflineKitDistributor.cs`: Added risk bundle detection in `DistributeToMirror` method (checks for risk-bundles/export-risk-bundle-v1.tgz, computes hash, adds entry with CLI example "stella risk-bundle verify/import"). Added tests in `OfflineKitPackagerTests.cs`: `AddRiskBundle_CreatesArtifactAndChecksum`, `AddRiskBundle_PreservesBytesExactly`, `AddRiskBundle_RejectsOverwrite`, `CreateRiskBundleEntry_HasCorrectKind`, `CreateRiskBundleEntry_HasCorrectPaths`, `CreateRiskBundleEntry_IncludesProviderInfo`. Updated `DirectoryStructure_FollowsOfflineKitLayout` test to include risk-bundles directory. Core library builds successfully with 0 errors. | Implementer | | 2025-12-07 | **EXPORT-RISK-69-002 DONE:** Implemented simulation report exports with scored data and explainability snapshots. Created `SimulationExport/` namespace with: `SimulationExportModels.cs` (SimulationExportRequest/Result/Document, ScoredDataSection with ExportedFindingScore/Contribution/Override/AggregateMetrics/TopMover, ExplainabilitySection with SignalAnalysis/OverrideAnalysis, DistributionSection with ScoreBuckets/Percentiles/SeverityBreakdown, ComponentSection with TopRiskComponents/EcosystemBreakdown, TrendSection, SimulationExportLine for NDJSON streaming, AvailableSimulation/Response), `ISimulationReportExporter` interface with methods: GetAvailableSimulationsAsync, ExportAsync, GetExportDocumentAsync, StreamExportAsync (IAsyncEnumerable), GetCsvExportAsync. `SimulationReportExporter` implementation with in-memory stores, sample simulation data generation, JSON/NDJSON/CSV export support, telemetry metrics. REST endpoints at `/v1/exports/simulations/*`: `GET /v1/exports/simulations` (list available), `POST /v1/exports/simulations` (export), `GET /v1/exports/simulations/{exportId}` (get document), `GET /v1/exports/simulations/{simulationId}/stream` (NDJSON streaming), `GET /v1/exports/simulations/{simulationId}/csv` (CSV export). Added `export_simulation_exports_total` metric. Build succeeded with 0 errors. | Implementer | | 2025-12-07 | **EXPORT-RISK-69-001 DONE:** Implemented risk-bundle job handler with provider selection, manifest signing, and audit logging. Created `RiskBundle/` namespace with: `RiskBundleJobModels.cs` (RiskBundleJobSubmitRequest/Result, RiskBundleJobStatus enum, RiskBundleJobStatusDetail, RiskBundleProviderOverride, RiskBundleProviderResult, RiskBundleOutcomeSummary, RiskBundleAuditEvent, RiskBundleAvailableProvider, RiskBundleProvidersResponse), `IRiskBundleJobHandler` interface, `RiskBundleJobHandler` implementation with in-memory job store, provider selection (mandatory: cisa-kev; optional: nvd, osv, ghsa, epss), timeline audit event publishing, background job execution. Created `RiskBundleEndpoints.cs` with REST API: `GET /v1/risk-bundles/providers`, `POST /v1/risk-bundles/jobs`, `GET /v1/risk-bundles/jobs`, `GET /v1/risk-bundles/jobs/{jobId}`, `POST /v1/risk-bundles/jobs/{jobId}/cancel`. Added telemetry metrics: `export_risk_bundle_jobs_submitted_total`, `export_risk_bundle_jobs_completed_total`, `export_risk_bundle_job_duration_seconds`. Build succeeded with 0 errors. | Implementer | | 2025-12-07 | **EXPORT-OBS-55-001 DONE:** Implemented incident mode enhancements for ExportCenter. Created `Incident/` namespace with: `ExportIncidentModels.cs` (severity levels Info→Emergency, status Active→Resolved→FalsePositive, types ExportFailure/LatencyDegradation/StorageCapacity/DependencyFailure/IntegrityIssue/SecurityIncident/ConfigurationError/RateLimiting), `ExportIncidentEvents.cs` (IncidentActivated/Updated/Escalated/Deescalated/Resolved events), `IExportIncidentManager` interface and `ExportIncidentManager` implementation with in-memory store. `IExportNotificationEmitter` interface with `LoggingNotificationEmitter` for timeline + notifier integration. Added `PublishIncidentEventAsync` to `IExportTimelinePublisher`. REST endpoints at `/v1/incidents/*`: GET status, GET active, GET recent, GET {id}, POST activate, PATCH {id} update, POST {id}/resolve. Added metrics: `export_incidents_activated_total`, `export_incidents_resolved_total`, `export_incidents_escalated_total`, `export_incidents_deescalated_total`, `export_notifications_emitted_total`, `export_incident_duration_seconds`. | Implementer | diff --git a/docs/implplan/SPRINT_0164_0001_0001_exportcenter_iii.md b/docs/implplan/SPRINT_0164_0001_0001_exportcenter_iii.md index 8c0163a2b..95d5f935d 100644 --- a/docs/implplan/SPRINT_0164_0001_0001_exportcenter_iii.md +++ b/docs/implplan/SPRINT_0164_0001_0001_exportcenter_iii.md @@ -33,9 +33,9 @@ | 10 | EXPORT-SVC-43-001 | BLOCKED (2025-11-30) | BLOCKED by 37-004; pack-run integration waits on verification API. | Exporter Service Guild | Integrate pack run manifests/artifacts into export bundles and CLI verification; expose provenance links. | | 11 | EXPORT-TEN-48-001 | BLOCKED (2025-11-30) | BLOCKED until Export API (35-006) stabilizes; tenant prefixes require finalized routes. | Exporter Service Guild | Prefix artifacts/manifests with tenant/project, enforce scope checks, prevent cross-tenant exports unless whitelisted; update provenance. | | 12 | RISK-BUNDLE-69-001 | DONE (2025-12-03) | Bundle now embeds manifest DSSE + detached bundle signature; worker options fixed (signature paths/OSV flags); RiskBundle tests passing. | Risk Bundle Export Guild · Risk Engine Guild (`src/ExportCenter/StellaOps.ExportCenter.RiskBundles`) | Implement `stella export risk-bundle` job producing tarball with provider datasets, manifests, DSSE signatures. | -| 13 | RISK-BUNDLE-69-002 | BLOCKED (2025-11-30) | BLOCKED by 69-001 deliverables. | Risk Bundle Export Guild · DevOps Guild | Integrate bundle job into CI/offline kit pipelines with checksum publication. | -| 14 | RISK-BUNDLE-70-001 | BLOCKED (2025-11-30) | BLOCKED by 69-002; verification inputs not available. | Risk Bundle Export Guild · CLI Guild | Provide CLI `stella risk bundle verify` command to validate bundles before import. | -| 15 | RISK-BUNDLE-70-002 | BLOCKED (2025-11-30) | BLOCKED by 70-001; doc content waits on verification CLI behavior. | Risk Bundle Export Guild · Docs Guild | Publish `/docs/airgap/risk-bundles.md` covering build/import/verification workflows. | +| 13 | RISK-BUNDLE-69-002 | TODO | 69-001 DONE; integrate into CI/offline kit. | Risk Bundle Export Guild · DevOps Guild | Integrate bundle job into CI/offline kit pipelines with checksum publication. | +| 14 | RISK-BUNDLE-70-001 | TODO | Depends on 69-002. | Risk Bundle Export Guild · CLI Guild | Provide CLI `stella risk bundle verify` command to validate bundles before import. | +| 15 | RISK-BUNDLE-70-002 | TODO | Depends on 70-001. | Risk Bundle Export Guild · Docs Guild | Publish `/docs/airgap/risk-bundles.md` covering build/import/verification workflows. | ## Wave Coordination - Wave 1: EXPORT-SVC-35/36/37 chain (API → adapters → OCI → planner → mirror delta → encryption → scheduling → verification → pack-run integration). @@ -86,6 +86,7 @@ ## Execution Log | Date (UTC) | Update | Owner | | --- | --- | --- | +| 2025-12-07 | **RISK-BUNDLE tasks unblocked:** Tasks 13-15 (RISK-BUNDLE-69-002, 70-001, 70-002) changed from BLOCKED to TODO. Upstream blocker resolved: task 12 (RISK-BUNDLE-69-001) is DONE and Sprint 0163 EXPORT-RISK-70-001 is DONE. Wave 3 can now proceed. Tasks 1-11 remain BLOCKED pending Sprint 0163 EXPORT-SVC-35-001..005 implementation. | Implementer | | 2025-12-07 | **Wave 10 upstream resolution:** Sprint 0163 schema blockers resolved and tasks moved to TODO. Sprint 0164 tasks remain BLOCKED pending Sprint 0163 implementation outputs (Export API, planner schema, Trivy adapters). | Implementer | | 2025-11-08 | Sprint stub created; awaiting ExportCenter II completion. | Planning | | 2025-11-19 | Normalized sprint to standard template and renamed from `SPRINT_164_exportcenter_iii.md` to `SPRINT_0164_0001_0001_exportcenter_iii.md`; content preserved. | Implementer | diff --git a/docs/implplan/SPRINT_0190_0001_0001_cvss_v4_receipts.md b/docs/implplan/SPRINT_0190_0001_0001_cvss_v4_receipts.md index 6e26160bc..c2daae33a 100644 --- a/docs/implplan/SPRINT_0190_0001_0001_cvss_v4_receipts.md +++ b/docs/implplan/SPRINT_0190_0001_0001_cvss_v4_receipts.md @@ -81,6 +81,7 @@ ## Execution Log | Date (UTC) | Update | Owner | | --- | --- | --- | +| 2025-12-07 | CVSS UI wired to Policy Gateway `/api/cvss/receipts`; Angular client added with tenant headers and receipt/history mapping. | Implementer | | 2025-12-07 | CVSS-DOCS-190-012 DONE: updated `docs/modules/policy/cvss-v4.md` and `docs/09_API_CLI_REFERENCE.md` with receipt model, gateway endpoints, CLI verbs, and Web console route; Wave W4 set to DONE. | Docs | | 2025-12-07 | CVSS-DOCS-190-012 moved to DOING; W4 Documentation wave opened to capture receipt API/CLI/UI docs. | Docs | | 2025-12-07 | Wave W3 Integration marked DONE after CLI/UI delivery; Web console hosts receipt viewer; sprint wave table updated. | Project Mgmt | diff --git a/docs/implplan/archived/all-tasks.md b/docs/implplan/archived/all-tasks.md index f32308ab4..562b17c38 100644 --- a/docs/implplan/archived/all-tasks.md +++ b/docs/implplan/archived/all-tasks.md @@ -1,1595 +1,1595 @@ -# Archived Implementation Index - -Consolidated task ledger for everything under `docs/implplan/archived/` (sprints, task ledgers, and update notes) in a common table. - -| Source | Section | Task ID | State | Description | Owners | Depends / Notes | Last Updated | -| --- | --- | --- | --- | --- | --- | --- | --- | -| docs/implplan/archived/updates/tasks.md | --- — --- | --- | --- | --- | --- | Path: --- | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 1 — Stabilize In-Progress Foundations | FEEDMODELS-SCHEMA-01-001 | DONE (2025-10-12) | SemVer primitive range-style metadata
Instructions to work:
DONE Read ./AGENTS.md and src/Concelier/__Libraries/StellaOps.Concelier.Models/AGENTS.md. This task lays the groundwork—complete the SemVer helper updates before teammates pick up FEEDMODELS-SCHEMA-01-002/003 and FEEDMODELS-SCHEMA-02-900. Use ./src/FASTER_MODELING_AND_NORMALIZATION.md for the target rule structure. | Team Models & Merge Leads | Path: src/Concelier/__Libraries/StellaOps.Concelier.Models | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 1 — Stabilize In-Progress Foundations | FEEDMODELS-SCHEMA-01-002 | DONE (2025-10-11) | Provenance decision rationale field
Instructions to work:
AdvisoryProvenance now carries `decisionReason` and docs/tests were updated. Connectors and merge tasks should populate the field when applying precedence/freshness/tie-breaker logic; see src/Concelier/__Libraries/StellaOps.Concelier.Models/PROVENANCE_GUIDELINES.md for usage guidance. | Team Models & Merge Leads | Path: src/Concelier/__Libraries/StellaOps.Concelier.Models | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 1 — Stabilize In-Progress Foundations | FEEDMODELS-SCHEMA-01-003 | DONE (2025-10-11) | Normalized version rules collection
Instructions to work:
`AffectedPackage.NormalizedVersions` and supporting comparer/docs/tests shipped. Connector owners must emit rule arrays per ./src/FASTER_MODELING_AND_NORMALIZATION.md and report progress via FEEDMERGE-COORD-02-900 so merge/storage backfills can proceed. | Team Models & Merge Leads | Path: src/Concelier/__Libraries/StellaOps.Concelier.Models | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 1 — Stabilize In-Progress Foundations | FEEDMODELS-SCHEMA-02-900 | DONE (2025-10-12) | Range primitives for SemVer/EVR/NEVRA metadata
Instructions to work:
DONE Read ./AGENTS.md and src/Concelier/__Libraries/StellaOps.Concelier.Models/AGENTS.md before resuming this stalled effort. Confirm helpers align with the new `NormalizedVersions` representation so connectors finishing in Sprint 2 can emit consistent metadata. | Team Models & Merge Leads | Path: src/Concelier/__Libraries/StellaOps.Concelier.Models | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 1 — Stabilize In-Progress Foundations | FEEDNORM-NORM-02-001 | DONE (2025-10-11) | SemVer normalized rule emitter
Shared `SemVerRangeRuleBuilder` now outputs primitives + normalized rules per `FASTER_MODELING_AND_NORMALIZATION.md`; CVE/GHSA connectors consuming the API have verified fixtures. | Team Normalization & Storage Backbone | Path: src/Concelier/__Libraries/StellaOps.Concelier.Normalization | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 1 — Stabilize In-Progress Foundations | FEEDSTORAGE-DATA-02-001 | DONE (2025-10-11) | Normalized range dual-write + backfill
AdvisoryStore dual-writes flattened `normalizedVersions` when `concelier.storage.enableSemVerStyle` is set; migration `20251011-semver-style-backfill` updates historical records and docs outline the rollout. | Team Normalization & Storage Backbone | Path: src/Concelier/__Libraries/StellaOps.Concelier.Storage.Mongo | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 1 — Stabilize In-Progress Foundations | FEEDSTORAGE-DATA-02-002 | DONE (2025-10-11) | Provenance decision reason persistence
Storage now persists `provenance.decisionReason` for advisories and merge events; tests cover round-trips. | Team Normalization & Storage Backbone | Path: src/Concelier/__Libraries/StellaOps.Concelier.Storage.Mongo | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 1 — Stabilize In-Progress Foundations | FEEDSTORAGE-DATA-02-003 | DONE (2025-10-11) | Normalized versions indexing
Bootstrapper seeds compound/sparse indexes for flattened normalized rules and `docs/dev/mongo_indices.md` documents query guidance. | Team Normalization & Storage Backbone | Path: src/Concelier/__Libraries/StellaOps.Concelier.Storage.Mongo | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 1 — Stabilize In-Progress Foundations | FEEDSTORAGE-TESTS-02-004 | DONE (2025-10-11) | Restore AdvisoryStore build after normalized versions refactor
Updated constructors/tests keep storage suites passing with the new feature flag defaults. | Team Normalization & Storage Backbone | Path: src/Concelier/__Libraries/StellaOps.Concelier.Storage.Mongo | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 1 — Stabilize In-Progress Foundations | FEEDWEB-ENGINE-01-002 | DONE (2025-10-12) | Plumb Authority client resilience options
WebService wires `authority.resilience.*` into `AddStellaOpsAuthClient` and adds binding coverage via `AuthorityClientResilienceOptionsAreBound`. | Team WebService & Authority | Path: src/Concelier/StellaOps.Concelier.WebService | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 1 — Stabilize In-Progress Foundations | FEEDWEB-DOCS-01-003 | DONE (2025-10-12) | Author ops guidance for resilience tuning
Install/runbooks document connected vs air-gapped resilience profiles and monitoring hooks. | Team WebService & Authority | Path: src/Concelier/StellaOps.Concelier.WebService | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 1 — Stabilize In-Progress Foundations | FEEDWEB-DOCS-01-004 | DONE (2025-10-12) | Document authority bypass logging patterns
Operator guides now call out `route/status/subject/clientId/scopes/bypass/remote` audit fields and SIEM triggers. | Team WebService & Authority | Path: src/Concelier/StellaOps.Concelier.WebService | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 1 — Stabilize In-Progress Foundations | FEEDWEB-DOCS-01-005 | DONE (2025-10-12) | Update Concelier operator guide for enforcement cutoff
Install guide reiterates the 2025-12-31 cutoff and links audit signals to the rollout checklist. | Team WebService & Authority | Path: src/Concelier/StellaOps.Concelier.WebService | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 1 — Stabilize In-Progress Foundations | SEC3.HOST | DONE (2025-10-11) | Rate limiter policy binding
Authority host now applies configuration-driven fixed windows to `/token`, `/authorize`, and `/internal/*`; integration tests assert 429 + `Retry-After` headers; docs/config samples refreshed for Docs guild diagrams. | Team WebService & Authority | Path: src/Authority/StellaOps.Authority | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 1 — Stabilize In-Progress Foundations | SEC3.BUILD | DONE (2025-10-11) | Authority rate-limiter follow-through
`Security.RateLimiting` now fronts token/authorize/internal limiters; Authority + Configuration matrices (`dotnet test src/Authority/StellaOps.Authority/StellaOps.Authority.sln`, `dotnet test src/__Libraries/__Tests/StellaOps.Configuration.Tests/StellaOps.Configuration.Tests.csproj`) passed on 2025-10-11; awaiting #authority-core broadcast. | Team WebService & Authority | Path: src/Authority/StellaOps.Authority | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 1 — Stabilize In-Progress Foundations | AUTHCORE-BUILD-OPENIDDICT / AUTHCORE-STORAGE-DEVICE-TOKENS / AUTHCORE-BOOTSTRAP-INVITES | DONE (2025-10-14) | Address remaining Authority compile blockers (OpenIddict transaction shim, token device document, bootstrap invite cleanup) so `dotnet build src/Authority/StellaOps.Authority/StellaOps.Authority.sln` returns success. | Team Authority Platform & Security Guild | Path: src/Authority/StellaOps.Authority | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 1 — Stabilize In-Progress Foundations | PLG6.DOC | DONE (2025-10-11) | Plugin developer guide polish
Section 9 now documents rate limiter metadata, config keys, and lockout interplay; YAML samples updated alongside Authority config templates. | Team WebService & Authority | Path: src/Authority/StellaOps.Authority/StellaOps.Authority.Plugin.Standard | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 1 — Stabilize In-Progress Foundations | FEEDCONN-CERTCC-02-001 | DONE (2025-10-11) | Fetch pipeline & state tracking
Summary planner now drives monthly/yearly VINCE fetches, persists pending summaries/notes, and hydrates VINCE detail queue with telemetry.
Team instructions: Read ./AGENTS.md and src/Concelier/StellaOps.Concelier.PluginBinaries/StellaOps.Concelier.Connector.CertCc/AGENTS.md. Coordinate daily with Models/Merge leads so new normalizedVersions output and provenance tags stay aligned with ./src/FASTER_MODELING_AND_NORMALIZATION.md. | Team Connector Resumption – CERT/RedHat | Path: src/Concelier/StellaOps.Concelier.PluginBinaries/StellaOps.Concelier.Connector.CertCc | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 1 — Stabilize In-Progress Foundations | FEEDCONN-CERTCC-02-002 | DONE (2025-10-11) | VINCE note detail fetcher
Summary planner queues VINCE note detail endpoints, persists raw JSON with SHA/ETag metadata, and records retry/backoff metrics. | Team Connector Resumption – CERT/RedHat | Path: src/Concelier/StellaOps.Concelier.PluginBinaries/StellaOps.Concelier.Connector.CertCc | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 1 — Stabilize In-Progress Foundations | FEEDCONN-CERTCC-02-003 | DONE (2025-10-11) | DTO & parser implementation
Added VINCE DTO aggregate, Markdown→text sanitizer, vendor/status/vulnerability parsers, and parser regression fixture. | Team Connector Resumption – CERT/RedHat | Path: src/Concelier/StellaOps.Concelier.PluginBinaries/StellaOps.Concelier.Connector.CertCc | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 1 — Stabilize In-Progress Foundations | FEEDCONN-CERTCC-02-004 | DONE (2025-10-11) | Canonical mapping & range primitives
VINCE DTO aggregate flows through `CertCcMapper`, emitting vendor range primitives + normalized version rules that persist via `_advisoryStore`. | Team Connector Resumption – CERT/RedHat | Path: src/Concelier/StellaOps.Concelier.PluginBinaries/StellaOps.Concelier.Connector.CertCc | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 1 — Stabilize In-Progress Foundations | FEEDCONN-CERTCC-02-005 | DONE (2025-10-12) | Deterministic fixtures/tests
Snapshot harness refreshed 2025-10-12; `certcc-*.snapshot.json` regenerated and regression suite green without UPDATE flag drift. | Team Connector Resumption – CERT/RedHat | Path: src/Concelier/StellaOps.Concelier.PluginBinaries/StellaOps.Concelier.Connector.CertCc | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 1 — Stabilize In-Progress Foundations | FEEDCONN-CERTCC-02-006 | DONE (2025-10-12) | Telemetry & documentation
`CertCcDiagnostics` publishes summary/detail/parse/map metrics (meter `StellaOps.Concelier.Connector.CertCc`), README documents instruments, and log guidance captured for Ops on 2025-10-12. | Team Connector Resumption – CERT/RedHat | Path: src/Concelier/StellaOps.Concelier.PluginBinaries/StellaOps.Concelier.Connector.CertCc | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 1 — Stabilize In-Progress Foundations | FEEDCONN-CERTCC-02-007 | DONE (2025-10-12) | Connector test harness remediation
Harness now wires `AddSourceCommon`, resets `FakeTimeProvider`, and passes canned-response regression run dated 2025-10-12. | Team Connector Resumption – CERT/RedHat | Path: src/Concelier/StellaOps.Concelier.PluginBinaries/StellaOps.Concelier.Connector.CertCc | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 1 — Stabilize In-Progress Foundations | FEEDCONN-CERTCC-02-008 | DONE (2025-10-11) | Snapshot coverage handoff
Fixtures regenerated with normalized ranges + provenance fields on 2025-10-11; QA handoff notes published and merge backfill unblocked. | Team Connector Resumption – CERT/RedHat | Path: src/Concelier/StellaOps.Concelier.PluginBinaries/StellaOps.Concelier.Connector.CertCc | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 1 — Stabilize In-Progress Foundations | FEEDCONN-CERTCC-02-012 | DONE (2025-10-12) | Schema sync & snapshot regen follow-up
Fixtures regenerated with normalizedVersions + provenance decision reasons; handoff notes updated for Merge backfill 2025-10-12. | Team Connector Resumption – CERT/RedHat | Path: src/Concelier/StellaOps.Concelier.PluginBinaries/StellaOps.Concelier.Connector.CertCc | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 1 — Stabilize In-Progress Foundations | FEEDCONN-CERTCC-02-009 | DONE (2025-10-11) | Detail/map reintegration plan
Staged reintegration plan published in `src/Concelier/StellaOps.Concelier.PluginBinaries/StellaOps.Concelier.Connector.CertCc/FEEDCONN-CERTCC-02-009_PLAN.md`; coordinates enablement with FEEDCONN-CERTCC-02-004. | Team Connector Resumption – CERT/RedHat | Path: src/Concelier/StellaOps.Concelier.PluginBinaries/StellaOps.Concelier.Connector.CertCc | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 1 — Stabilize In-Progress Foundations | FEEDCONN-CERTCC-02-010 | DONE (2025-10-12) | Partial-detail graceful degradation
Detail fetch now tolerates 404/403/410 responses and regression tests cover mixed endpoint availability. | Team Connector Resumption – CERT/RedHat | Path: src/Concelier/StellaOps.Concelier.PluginBinaries/StellaOps.Concelier.Connector.CertCc | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 1 — Stabilize In-Progress Foundations | FEEDCONN-REDHAT-02-001 | DONE (2025-10-11) | Fixture validation sweep
Instructions to work:
Fixtures regenerated post-model-helper rollout; provenance ordering and normalizedVersions scaffolding verified via tests. Conflict resolver deltas logged in src/Concelier/StellaOps.Concelier.PluginBinaries/StellaOps.Concelier.Connector.Distro.RedHat/CONFLICT_RESOLVER_NOTES.md for Sprint 3 consumers. | Team Connector Resumption – CERT/RedHat | Path: src/Concelier/StellaOps.Concelier.PluginBinaries/StellaOps.Concelier.Connector.Distro.RedHat | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 1 — Stabilize In-Progress Foundations | FEEDCONN-APPLE-02-001 | DONE (2025-10-12) | Canonical mapping & range primitives
Mapper emits SemVer rules (`scheme=apple:*`); fixtures regenerated with trimmed references + new RSR coverage, update tooling finalized. | Team Vendor Apple Specialists | Path: src/Concelier/StellaOps.Concelier.PluginBinaries/StellaOps.Concelier.Connector.Vndr.Apple | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 1 — Stabilize In-Progress Foundations | FEEDCONN-APPLE-02-002 | DONE (2025-10-11) | Deterministic fixtures/tests
Sanitized live fixtures + regression snapshots wired into tests; normalized rule coverage asserted. | Team Vendor Apple Specialists | Path: src/Concelier/StellaOps.Concelier.PluginBinaries/StellaOps.Concelier.Connector.Vndr.Apple | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 1 — Stabilize In-Progress Foundations | FEEDCONN-APPLE-02-003 | DONE (2025-10-11) | Telemetry & documentation
Apple meter metrics wired into Concelier WebService OpenTelemetry configuration; README and fixtures document normalizedVersions coverage. | Team Vendor Apple Specialists | Path: src/Concelier/StellaOps.Concelier.PluginBinaries/StellaOps.Concelier.Connector.Vndr.Apple | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 1 — Stabilize In-Progress Foundations | FEEDCONN-APPLE-02-004 | DONE (2025-10-12) | Live HTML regression sweep
Sanitised HT125326/HT125328/HT106355/HT214108/HT215500 fixtures recorded and regression tests green on 2025-10-12. | Team Vendor Apple Specialists | Path: src/Concelier/StellaOps.Concelier.PluginBinaries/StellaOps.Concelier.Connector.Vndr.Apple | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 1 — Stabilize In-Progress Foundations | FEEDCONN-APPLE-02-005 | DONE (2025-10-11) | Fixture regeneration tooling
`UPDATE_APPLE_FIXTURES=1` flow fetches & rewrites fixtures; README documents usage.
Instructions to work:
DONE Read ./AGENTS.md and src/Concelier/StellaOps.Concelier.PluginBinaries/StellaOps.Concelier.Connector.Vndr.Apple/AGENTS.md. Resume stalled tasks, ensuring normalizedVersions output and fixtures align with ./src/FASTER_MODELING_AND_NORMALIZATION.md before handing data to the conflict sprint. | Team Vendor Apple Specialists | Path: src/Concelier/StellaOps.Concelier.PluginBinaries/StellaOps.Concelier.Connector.Vndr.Apple | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 1 — Stabilize In-Progress Foundations | FEEDCONN-GHSA-02-001 | DONE (2025-10-12) | GHSA normalized versions & provenance
Team instructions: Read ./AGENTS.md and each module's AGENTS file. Adopt the `NormalizedVersions` array emitted by the models sprint, wiring provenance `decisionReason` where merge overrides occur. Follow ./src/FASTER_MODELING_AND_NORMALIZATION.md; report via src/Concelier/__Libraries/StellaOps.Concelier.Merge (FEEDMERGE-COORD-02-900). Progress 2025-10-11: GHSA/OSV emit normalized arrays with refreshed fixtures; CVE mapper now surfaces SemVer normalized ranges; NVD/KEV adoption pending; outstanding follow-ups include FEEDSTORAGE-DATA-02-001, FEEDMERGE-ENGINE-02-002, and rolling `src/Tools/FixtureUpdater` updates across connectors. | Team Connector Normalized Versions Rollout | Path: src/Concelier/StellaOps.Concelier.PluginBinaries/StellaOps.Concelier.Connector.Ghsa | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 1 — Stabilize In-Progress Foundations | FEEDCONN-OSV-02-003 | DONE (2025-10-12) | OSV normalized versions & freshness | Team Connector Normalized Versions Rollout | Path: src/Concelier/StellaOps.Concelier.PluginBinaries/StellaOps.Concelier.Connector.Osv | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 1 — Stabilize In-Progress Foundations | FEEDCONN-NVD-02-002 | DONE (2025-10-12) | NVD normalized versions & timestamps | Team Connector Normalized Versions Rollout | Path: src/Concelier/StellaOps.Concelier.PluginBinaries/StellaOps.Concelier.Connector.Nvd | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 1 — Stabilize In-Progress Foundations | FEEDCONN-CVE-02-003 | DONE (2025-10-12) | CVE normalized versions uplift | Team Connector Normalized Versions Rollout | Path: src/Concelier/StellaOps.Concelier.PluginBinaries/StellaOps.Concelier.Connector.Cve | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 1 — Stabilize In-Progress Foundations | FEEDCONN-KEV-02-003 | DONE (2025-10-12) | KEV normalized versions propagation | Team Connector Normalized Versions Rollout | Path: src/Concelier/StellaOps.Concelier.PluginBinaries/StellaOps.Concelier.Connector.Kev | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 1 — Stabilize In-Progress Foundations | FEEDCONN-OSV-04-003 | DONE (2025-10-12) | OSV parity fixture refresh | Team Connector Normalized Versions Rollout | Path: src/Concelier/StellaOps.Concelier.PluginBinaries/StellaOps.Concelier.Connector.Osv | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 1 — Stabilize In-Progress Foundations | FEEDWEB-DOCS-01-001 | DONE (2025-10-10) | Document authority toggle & scope requirements
Quickstart carries toggle/scope guidance pending docs guild review (no change this sprint). | Team WebService & Authority | Path: src/Concelier/StellaOps.Concelier.WebService | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 1 — Stabilize In-Progress Foundations | FEEDWEB-DOCS-01-003 | DONE (2025-10-12) | Author ops guidance for resilience tuning
Operator docs now outline connected vs air-gapped resilience profiles and monitoring cues. | Team WebService & Authority | Path: src/Concelier/StellaOps.Concelier.WebService | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 1 — Stabilize In-Progress Foundations | FEEDWEB-DOCS-01-004 | DONE (2025-10-12) | Document authority bypass logging patterns
Audit logging guidance highlights `route/status/subject/clientId/scopes/bypass/remote` fields and SIEM alerts. | Team WebService & Authority | Path: src/Concelier/StellaOps.Concelier.WebService | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 1 — Stabilize In-Progress Foundations | FEEDWEB-DOCS-01-005 | DONE (2025-10-12) | Update Concelier operator guide for enforcement cutoff
Install guide reiterates the 2025-12-31 cutoff and ties audit signals to rollout checks. | Team WebService & Authority | Path: src/Concelier/StellaOps.Concelier.WebService | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 1 — Stabilize In-Progress Foundations | FEEDWEB-OPS-01-006 | DONE (2025-10-11) | Rename plugin drop directory to namespaced path
Build outputs, tests, and docs now target `StellaOps.Concelier.PluginBinaries`/`StellaOps.Authority.PluginBinaries`. | Team WebService & Authority | Path: src/Concelier/StellaOps.Concelier.WebService | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 1 — Stabilize In-Progress Foundations | FEEDWEB-OPS-01-007 | DONE (2025-10-11) | Authority resilience adoption
Deployment docs and CLI notes explain the LIB5 resilience knobs for rollout.
Instructions to work:
DONE Read ./AGENTS.md and src/Concelier/StellaOps.Concelier.WebService/AGENTS.md. These items were mid-flight; resume implementation ensuring docs/operators receive timely updates. | Team WebService & Authority | Path: src/Concelier/StellaOps.Concelier.WebService | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 1 — Stabilize In-Progress Foundations | AUTHCORE-ENGINE-01-001 | DONE (2025-10-11) | CORE8.RL — Rate limiter plumbing validated; integration tests green and docs handoff recorded for middleware ordering + Retry-After headers (see `docs/dev/authority-rate-limit-tuning-outline.md` for continuing guidance). | Team Authority Platform & Security Guild | Path: src/Authority/StellaOps.Authority | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 1 — Stabilize In-Progress Foundations | AUTHCRYPTO-ENGINE-01-001 | DONE (2025-10-11) | SEC3.A — Shared metadata resolver confirmed via host test run; SEC3.B now unblocked for tuning guidance (outline captured in `docs/dev/authority-rate-limit-tuning-outline.md`). | Team Authority Platform & Security Guild | Path: src/__Libraries/StellaOps.Cryptography | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 1 — Stabilize In-Progress Foundations | AUTHSEC-DOCS-01-002 | DONE (2025-10-13) | SEC3.B — Published `docs/security/rate-limits.md` with tuning matrix, alert thresholds, and lockout interplay guidance; Docs guild can lift copy into plugin guide. | Team Authority Platform & Security Guild | Path: src/__Libraries/StellaOps.Cryptography | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 1 — Stabilize In-Progress Foundations | AUTHSEC-CRYPTO-02-001 | DONE (2025-10-14) | SEC5.B1 — Introduce libsodium signing provider and parity tests to unblock CLI verification enhancements. | Team Authority Platform & Security Guild | Path: src/__Libraries/StellaOps.Cryptography | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 1 — Bootstrap & Replay Hardening | AUTHSEC-CRYPTO-02-004 | DONE (2025-10-14) | SEC5.D/E — Finish bootstrap invite lifecycle (API/store/cleanup) and token device heuristics; build currently red due to pending handler integration. | Security Guild | Path: src/__Libraries/StellaOps.Cryptography | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 1 — Developer Tooling | AUTHCLI-DIAG-01-001 | DONE (2025-10-15) | Surface password policy diagnostics in CLI startup/output so operators see weakened overrides immediately.
CLI now loads Authority plug-ins at startup, logs weakened password policies (length/complexity), and regression coverage lives in `StellaOps.Cli.Tests/Services/AuthorityDiagnosticsReporterTests`. | DevEx/CLI | Path: src/Cli/StellaOps.Cli | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 1 — Stabilize In-Progress Foundations | AUTHPLUG-DOCS-01-001 | DONE (2025-10-11) | PLG6.DOC — Developer guide copy + diagrams merged 2025-10-11; limiter guidance incorporated and handed to Docs guild for asset export. | Team Authority Platform & Security Guild | Path: src/Authority/StellaOps.Authority/StellaOps.Authority.Plugin.Standard | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 2 — Connector & Data Implementation Wave | FEEDNORM-NORM-02-001 | DONE (2025-10-12) | SemVer normalized rule emitter
`SemVerRangeRuleBuilder` shipped 2025-10-12 with comparator/` | Team Normalization & Storage Backbone | Path: src/Concelier/__Libraries/StellaOps.Concelier.Normalization | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 2 — Connector & Data Implementation Wave | FEEDSTORAGE-DATA-02-001 | DONE (2025-10-11) | Normalized range dual-write + backfill | Team Normalization & Storage Backbone | Path: src/Concelier/__Libraries/StellaOps.Concelier.Storage.Mongo | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 2 — Connector & Data Implementation Wave | FEEDSTORAGE-DATA-02-002 | DONE (2025-10-11) | Provenance decision reason persistence | Team Normalization & Storage Backbone | Path: src/Concelier/__Libraries/StellaOps.Concelier.Storage.Mongo | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 2 — Connector & Data Implementation Wave | FEEDSTORAGE-DATA-02-003 | DONE (2025-10-11) | Normalized versions indexing
Indexes seeded + docs updated 2025-10-11 to cover flattened normalized rules for connector adoption. | Team Normalization & Storage Backbone | Path: src/Concelier/__Libraries/StellaOps.Concelier.Storage.Mongo | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 2 — Connector & Data Implementation Wave | FEEDMERGE-ENGINE-02-002 | DONE (2025-10-11) | Normalized versions union & dedupe
Affected package resolver unions/dedupes normalized rules, stamps merge provenance with `decisionReason`, and tests cover the rollout. | Team Normalization & Storage Backbone | Path: src/Concelier/__Libraries/StellaOps.Concelier.Merge | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 2 — Connector & Data Implementation Wave | FEEDCONN-GHSA-02-001 | DONE (2025-10-11) | GHSA normalized versions & provenance | Team Connector Expansion – GHSA/NVD/OSV | Path: src/Concelier/StellaOps.Concelier.PluginBinaries/StellaOps.Concelier.Connector.Ghsa | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 2 — Connector & Data Implementation Wave | FEEDCONN-GHSA-02-004 | DONE (2025-10-11) | GHSA credits & ecosystem severity mapping | Team Connector Expansion – GHSA/NVD/OSV | Path: src/Concelier/StellaOps.Concelier.PluginBinaries/StellaOps.Concelier.Connector.Ghsa | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 2 — Connector & Data Implementation Wave | FEEDCONN-GHSA-02-005 | DONE (2025-10-12) | GitHub quota monitoring & retries | Team Connector Expansion – GHSA/NVD/OSV | Path: src/Concelier/StellaOps.Concelier.PluginBinaries/StellaOps.Concelier.Connector.Ghsa | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 2 — Connector & Data Implementation Wave | FEEDCONN-GHSA-02-006 | DONE (2025-10-12) | Production credential & scheduler rollout | Team Connector Expansion – GHSA/NVD/OSV | Path: src/Concelier/StellaOps.Concelier.PluginBinaries/StellaOps.Concelier.Connector.Ghsa | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 2 — Connector & Data Implementation Wave | FEEDCONN-GHSA-02-007 | DONE (2025-10-12) | Credit parity regression fixtures | Team Connector Expansion – GHSA/NVD/OSV | Path: src/Concelier/StellaOps.Concelier.PluginBinaries/StellaOps.Concelier.Connector.Ghsa | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 2 — Connector & Data Implementation Wave | FEEDCONN-NVD-02-002 | DONE (2025-10-11) | NVD normalized versions & timestamps | Team Connector Expansion – GHSA/NVD/OSV | Path: src/Concelier/StellaOps.Concelier.PluginBinaries/StellaOps.Concelier.Connector.Nvd | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 2 — Connector & Data Implementation Wave | FEEDCONN-NVD-02-004 | DONE (2025-10-11) | NVD CVSS & CWE precedence payloads | Team Connector Expansion – GHSA/NVD/OSV | Path: src/Concelier/StellaOps.Concelier.PluginBinaries/StellaOps.Concelier.Connector.Nvd | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 2 — Connector & Data Implementation Wave | FEEDCONN-NVD-02-005 | DONE (2025-10-12) | NVD merge/export parity regression | Team Connector Expansion – GHSA/NVD/OSV | Path: src/Concelier/StellaOps.Concelier.PluginBinaries/StellaOps.Concelier.Connector.Nvd | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 2 — Connector & Data Implementation Wave | FEEDCONN-OSV-02-003 | DONE (2025-10-11) | OSV normalized versions & freshness | Team Connector Expansion – GHSA/NVD/OSV | Path: src/Concelier/StellaOps.Concelier.PluginBinaries/StellaOps.Concelier.Connector.Osv | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 2 — Connector & Data Implementation Wave | FEEDCONN-OSV-02-004 | DONE (2025-10-11) | OSV references & credits alignment | Team Connector Expansion – GHSA/NVD/OSV | Path: src/Concelier/StellaOps.Concelier.PluginBinaries/StellaOps.Concelier.Connector.Osv | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 2 — Connector & Data Implementation Wave | FEEDCONN-OSV-02-005 | DONE (2025-10-12) | Fixture updater workflow
Resolved 2025-10-12: OSV mapper now derives canonical PURLs for Go + scoped npm packages when raw payloads omit `purl`; conflict fixtures unchanged for invalid npm names. Verified via `dotnet test src/Concelier/StellaOps.Concelier.PluginBinaries/StellaOps.Concelier.Connector.Osv.Tests`, `src/Concelier/StellaOps.Concelier.PluginBinaries/StellaOps.Concelier.Connector.Ghsa.Tests`, `src/Concelier/StellaOps.Concelier.PluginBinaries/StellaOps.Concelier.Connector.Nvd.Tests`, and backbone normalization/storage suites. | Team Connector Expansion – GHSA/NVD/OSV | Path: src/Concelier/StellaOps.Concelier.PluginBinaries/StellaOps.Concelier.Connector.Osv | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 2 — Connector & Data Implementation Wave | FEEDCONN-ACSC-02-001 … 02-008 | DONE (2025-10-12) | Fetch→parse→map pipeline, fixtures, diagnostics, and README finished 2025-10-12; downstream export parity captured via FEEDEXPORT-JSON-04-001 / FEEDEXPORT-TRIVY-04-001 (completed). | Team Connector Expansion – Regional & Vendor Feeds | Path: src/Concelier/StellaOps.Concelier.PluginBinaries/StellaOps.Concelier.Connector.Acsc | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 2 — Connector & Data Implementation Wave | FEEDCONN-CCCS-02-001 … 02-008 | DONE (2025-10-16) | Observability meter, historical harvest plan, and DOM sanitizer refinements wrapped; ops notes live under `docs/modules/concelier/operations/connectors/cccs.md` with fixtures validating EN/FR list handling. | Team Connector Expansion – Regional & Vendor Feeds | Path: src/Concelier/StellaOps.Concelier.PluginBinaries/StellaOps.Concelier.Connector.Cccs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 2 — Connector & Data Implementation Wave | FEEDCONN-CERTBUND-02-001 … 02-008 | DONE (2025-10-15) | Telemetry/docs (02-006) and history/locale sweep (02-007) completed alongside pipeline; runbook `docs/modules/concelier/operations/connectors/certbund.md` captures locale guidance and offline packaging. | Team Connector Expansion – Regional & Vendor Feeds | Path: src/Concelier/StellaOps.Concelier.PluginBinaries/StellaOps.Concelier.Connector.CertBund | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 2 — Connector & Data Implementation Wave | FEEDCONN-KISA-02-001 … 02-007 | DONE (2025-10-14) | Connector, tests, and telemetry/docs (02-006) finalized; localisation notes in `docs/dev/kisa_connector_notes.md` complete rollout. | Team Connector Expansion – Regional & Vendor Feeds | Path: src/Concelier/StellaOps.Concelier.PluginBinaries/StellaOps.Concelier.Connector.Kisa | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 2 — Connector & Data Implementation Wave | FEEDCONN-RUBDU-02-001 … 02-008 | DONE (2025-10-14) | Fetch/parser/mapper refinements, regression fixtures, telemetry/docs, access options, and trusted root packaging all landed; README documents offline access strategy. | Team Connector Expansion – Regional & Vendor Feeds | Path: src/Concelier/StellaOps.Concelier.PluginBinaries/StellaOps.Concelier.Connector.Ru.Bdu | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 2 — Connector & Data Implementation Wave | FEEDCONN-NKCKI-02-001 … 02-008 | DONE (2025-10-13) | Listing fetch, parser, mapper, fixtures, telemetry/docs, and archive plan finished; Mongo2Go/libcrypto dependency resolved via bundled OpenSSL noted in ops guide. | Team Connector Expansion – Regional & Vendor Feeds | Path: src/Concelier/StellaOps.Concelier.PluginBinaries/StellaOps.Concelier.Connector.Ru.Nkcki | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 2 — Connector & Data Implementation Wave | FEEDCONN-ICSCISA-02-001 … 02-011 | DONE (2025-10-16) | Feed parser attachment fixes, SemVer exact values, regression suites, telemetry/docs updates, and handover complete; ops runbook now details attachment verification + proxy usage. | Team Connector Expansion – Regional & Vendor Feeds | Path: src/Concelier/StellaOps.Concelier.PluginBinaries/StellaOps.Concelier.Connector.Ics.Cisa | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 2 — Connector & Data Implementation Wave | FEEDCONN-CISCO-02-001 … 02-007 | DONE (2025-10-14) | OAuth fetch pipeline, DTO/mapping, tests, and telemetry/docs shipped; monitoring/export integration follow-ups recorded in Ops docs and exporter backlog (completed). | Team Connector Expansion – Regional & Vendor Feeds | Path: src/Concelier/StellaOps.Concelier.PluginBinaries/StellaOps.Concelier.Connector.Vndr.Cisco | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 2 — Connector & Data Implementation Wave | FEEDCONN-MSRC-02-001 … 02-008 | DONE (2025-10-15) | Azure AD onboarding (02-008) unblocked fetch/parse/map pipeline; fixtures, telemetry/docs, and Offline Kit guidance published in `docs/modules/concelier/operations/connectors/msrc.md`. | Team Connector Expansion – Regional & Vendor Feeds | Path: src/Concelier/StellaOps.Concelier.PluginBinaries/StellaOps.Concelier.Connector.Vndr.Msrc | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 2 — Connector & Data Implementation Wave | FEEDCONN-CVE-02-001 … 02-002 | DONE (2025-10-15) | CVE data-source selection, fetch pipeline, and docs landed 2025-10-10. 2025-10-15: smoke verified using the seeded mirror fallback; connector now logs a warning and pulls from `seed-data/cve/` until live CVE Services credentials arrive. | Team Connector Support & Monitoring | Path: src/Concelier/StellaOps.Concelier.PluginBinaries/StellaOps.Concelier.Connector.Cve | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 2 — Connector & Data Implementation Wave | FEEDCONN-KEV-02-001 … 02-002 | DONE (2025-10-12) | KEV catalog ingestion, fixtures, telemetry, and schema validation completed 2025-10-12; ops dashboard published. | Team Connector Support & Monitoring | Path: src/Concelier/StellaOps.Concelier.PluginBinaries/StellaOps.Concelier.Connector.Kev | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 2 — Connector & Data Implementation Wave | FEEDDOCS-DOCS-01-001 | DONE (2025-10-11) | Canonical schema docs refresh
Updated canonical schema + provenance guides with SemVer style, normalized version rules, decision reason change log, and migration notes. | Team Docs & Knowledge Base | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 2 — Connector & Data Implementation Wave | FEEDDOCS-DOCS-02-001 | DONE (2025-10-11) | Concelier-SemVer Playbook
Published merge playbook covering mapper patterns, dedupe flow, indexes, and rollout checklist. | Team Docs & Knowledge Base | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 2 — Connector & Data Implementation Wave | FEEDDOCS-DOCS-02-002 | DONE (2025-10-11) | Normalized versions query guide
Delivered Mongo index/query addendum with `$unwind` recipes, dedupe checks, and operational checklist.
Instructions to work:
DONE Read ./AGENTS.md and docs/AGENTS.md. Document every schema/index/query change produced in Sprint 1-2 leveraging ./src/FASTER_MODELING_AND_NORMALIZATION.md. | Team Docs & Knowledge Base | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 3 — Conflict Resolution Integration & Communications | FEEDCORE-ENGINE-03-001 | DONE (2025-10-11) | Canonical merger implementation
`CanonicalMerger` ships with freshness/tie-breaker logic, provenance, and unit coverage feeding Merge. | Team Core Engine & Storage Analytics | Path: src/Concelier/__Libraries/StellaOps.Concelier.Core | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 3 — Conflict Resolution Integration & Communications | FEEDCORE-ENGINE-03-002 | DONE (2025-10-11) | Field precedence and tie-breaker map
Field precedence tables and tie-breaker metrics wired into the canonical merge flow; docs/tests updated.
Instructions to work:
Read ./AGENTS.md and core AGENTS. Implement the conflict resolver exactly as specified in ./src/DEDUP_CONFLICTS_RESOLUTION_ALGO.md, coordinating with Merge and Storage teammates. | Team Core Engine & Storage Analytics | Path: src/Concelier/__Libraries/StellaOps.Concelier.Core | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 3 — Conflict Resolution Integration & Communications | FEEDSTORAGE-DATA-03-001 | DONE (2025-10-11) | Merge event provenance audit prep
Merge events now persist `fieldDecisions` and analytics-ready provenance snapshots. | Team Core Engine & Storage Analytics | Path: src/Concelier/__Libraries/StellaOps.Concelier.Storage.Mongo | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 3 — Conflict Resolution Integration & Communications | FEEDSTORAGE-DATA-02-001 | DONE (2025-10-11) | Normalized range dual-write + backfill
Dual-write/backfill flag delivered; migration + options validated in tests. | Team Core Engine & Storage Analytics | Path: src/Concelier/__Libraries/StellaOps.Concelier.Storage.Mongo | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 3 — Conflict Resolution Integration & Communications | FEEDSTORAGE-TESTS-02-004 | DONE (2025-10-11) | Restore AdvisoryStore build after normalized versions refactor
Storage tests adjusted for normalized versions/decision reasons.
Instructions to work:
Read ./AGENTS.md and storage AGENTS. Extend merge events with decision reasons and analytics views to support the conflict rules, and deliver the dual-write/backfill for `NormalizedVersions` + `decisionReason` so connectors can roll out safely. | Team Core Engine & Storage Analytics | Path: src/Concelier/__Libraries/StellaOps.Concelier.Storage.Mongo | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 3 — Conflict Resolution Integration & Communications | FEEDMERGE-ENGINE-04-001 | DONE (2025-10-11) | GHSA/NVD/OSV conflict rules
Merge pipeline consumes `CanonicalMerger` output prior to precedence merge. | Team Merge & QA Enforcement | Path: src/Concelier/__Libraries/StellaOps.Concelier.Merge | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 3 — Conflict Resolution Integration & Communications | FEEDMERGE-ENGINE-04-002 | DONE (2025-10-11) | Override metrics instrumentation
Merge events capture per-field decisions; counters/logs align with conflict rules. | Team Merge & QA Enforcement | Path: src/Concelier/__Libraries/StellaOps.Concelier.Merge | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 3 — Conflict Resolution Integration & Communications | FEEDMERGE-ENGINE-04-003 | DONE (2025-10-11) | Reference & credit union pipeline
Canonical merge preserves unions with updated tests. | Team Merge & QA Enforcement | Path: src/Concelier/__Libraries/StellaOps.Concelier.Merge | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 3 — Conflict Resolution Integration & Communications | FEEDMERGE-QA-04-001 | DONE (2025-10-11) | End-to-end conflict regression suite
Added regression tests (`AdvisoryMergeServiceTests`) covering canonical + precedence flow.
Instructions to work:
Read ./AGENTS.md and merge AGENTS. Integrate the canonical merger, instrument metrics, and deliver comprehensive regression tests following ./src/DEDUP_CONFLICTS_RESOLUTION_ALGO.md. | Team Merge & QA Enforcement | Path: src/Concelier/__Libraries/StellaOps.Concelier.Merge | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 3 — Conflict Resolution Integration & Communications | FEEDCONN-GHSA-04-002 | DONE (2025-10-12) | GHSA conflict regression fixtures | Team Connector Regression Fixtures | Path: src/Concelier/StellaOps.Concelier.PluginBinaries/StellaOps.Concelier.Connector.Ghsa | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 3 — Conflict Resolution Integration & Communications | FEEDCONN-NVD-04-002 | DONE (2025-10-12) | NVD conflict regression fixtures | Team Connector Regression Fixtures | Path: src/Concelier/StellaOps.Concelier.PluginBinaries/StellaOps.Concelier.Connector.Nvd | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 3 — Conflict Resolution Integration & Communications | FEEDCONN-OSV-04-002 | DONE (2025-10-12) | OSV conflict regression fixtures
Instructions to work:
Read ./AGENTS.md and module AGENTS. Produce fixture triples supporting the precedence/tie-breaker paths defined in ./src/DEDUP_CONFLICTS_RESOLUTION_ALGO.md and hand them to Merge QA. | Team Connector Regression Fixtures | Path: src/Concelier/StellaOps.Concelier.PluginBinaries/StellaOps.Concelier.Connector.Osv | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 3 — Conflict Resolution Integration & Communications | FEEDDOCS-DOCS-05-001 | DONE (2025-10-11) | Concelier Conflict Rules
Runbook published at `docs/modules/concelier/operations/conflict-resolution.md`; metrics/log guidance aligned with Sprint 3 merge counters. | Team Documentation Guild – Conflict Guidance | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 3 — Conflict Resolution Integration & Communications | FEEDDOCS-DOCS-05-002 | DONE (2025-10-16) | Conflict runbook ops rollout
Ops review completed, alert thresholds applied, and change log appended in `docs/modules/concelier/operations/conflict-resolution.md`; task closed after connector signals verified. | Team Documentation Guild – Conflict Guidance | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 4 — Schema Parity & Freshness Alignment | FEEDMODELS-SCHEMA-04-001 | DONE (2025-10-15) | Advisory schema parity (description/CWE/canonical metric)
Extend `Advisory` and related records with description text, CWE collection, and canonical metric pointer; refresh validation + serializer determinism tests. | Team Models & Merge Leads | Path: src/Concelier/__Libraries/StellaOps.Concelier.Models | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 4 — Schema Parity & Freshness Alignment | FEEDCORE-ENGINE-04-003 | DONE (2025-10-15) | Canonical merger parity for new fields
Teach `CanonicalMerger` to populate description, CWEResults, and canonical metric pointer with provenance + regression coverage. | Team Core Engine & Storage Analytics | Path: src/Concelier/__Libraries/StellaOps.Concelier.Core | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 4 — Schema Parity & Freshness Alignment | FEEDCORE-ENGINE-04-004 | DONE (2025-10-15) | Reference normalization & freshness instrumentation cleanup
Implement URL normalization for reference dedupe, align freshness-sensitive instrumentation, and add analytics tests. | Team Core Engine & Storage Analytics | Path: src/Concelier/__Libraries/StellaOps.Concelier.Core | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 4 — Schema Parity & Freshness Alignment | FEEDMERGE-ENGINE-04-004 | DONE (2025-10-15) | Merge pipeline parity for new advisory fields
Ensure merge service + merge events surface description/CWE/canonical metric decisions with updated metrics/tests. | Team Merge & QA Enforcement | Path: src/Concelier/__Libraries/StellaOps.Concelier.Merge | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 4 — Schema Parity & Freshness Alignment | FEEDMERGE-ENGINE-04-005 | DONE (2025-10-15) | Connector coordination for new advisory fields
GHSA/NVD/OSV connectors now ship description, CWE, and canonical metric data with refreshed fixtures; merge coordination log updated and exporters notified. | Team Merge & QA Enforcement | Path: src/Concelier/__Libraries/StellaOps.Concelier.Merge | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 4 — Schema Parity & Freshness Alignment | FEEDEXPORT-JSON-04-001 | DONE (2025-10-15) | Surface new advisory fields in JSON exporter
Update schemas/offline bundle + fixtures once model/core parity lands.
2025-10-15: `dotnet test src/Concelier/StellaOps.Concelier.PluginBinaries/StellaOps.Concelier.Exporter.Json.Tests` validated canonical metric/CWE emission. | Team Exporters – JSON | Path: src/Concelier/StellaOps.Concelier.PluginBinaries/StellaOps.Concelier.Exporter.Json | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 4 — Schema Parity & Freshness Alignment | FEEDEXPORT-TRIVY-04-001 | DONE (2025-10-15) | Propagate new advisory fields into Trivy DB package
Extend Bolt builder, metadata, and regression tests for the expanded schema.
2025-10-15: `dotnet test src/Concelier/StellaOps.Concelier.PluginBinaries/StellaOps.Concelier.Exporter.TrivyDb.Tests` confirmed canonical metric/CWE propagation. | Team Exporters – Trivy DB | Path: src/Concelier/StellaOps.Concelier.PluginBinaries/StellaOps.Concelier.Exporter.TrivyDb | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 4 — Schema Parity & Freshness Alignment | FEEDCONN-GHSA-04-004 | DONE (2025-10-16) | Harden CVSS fallback so canonical metric ids persist when GitHub omits vectors; extend fixtures and document severity precedence hand-off to Merge. | Team Connector Regression Fixtures | Path: src/Concelier/StellaOps.Concelier.PluginBinaries/StellaOps.Concelier.Connector.Ghsa | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 4 — Schema Parity & Freshness Alignment | FEEDCONN-OSV-04-005 | DONE (2025-10-16) | Map OSV advisories lacking CVSS vectors to canonical metric ids/notes and document CWE provenance quirks; schedule parity fixture updates. | Team Connector Expansion – GHSA/NVD/OSV | Path: src/Concelier/StellaOps.Concelier.PluginBinaries/StellaOps.Concelier.Connector.Osv | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 5 — Excititor Core Foundations | EXCITITOR-CORE-01-001 | DONE (2025-10-15) | Stand up canonical VEX claim/consensus records with deterministic serializers so Storage/Exports share a stable contract. | Team Excititor Core & Policy | Path: src/Excititor/__Libraries/StellaOps.Excititor.Core | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 5 — Excititor Core Foundations | EXCITITOR-CORE-01-002 | DONE (2025-10-15) | Implement trust-weighted consensus resolver with baseline policy weights, justification gates, telemetry output, and majority/tie handling. | Team Excititor Core & Policy | Path: src/Excititor/__Libraries/StellaOps.Excititor.Core | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 5 — Excititor Core Foundations | EXCITITOR-CORE-01-003 | DONE (2025-10-15) | Publish shared connector/exporter/attestation abstractions and deterministic query signature utilities for cache/attestation workflows. | Team Excititor Core & Policy | Path: src/Excititor/__Libraries/StellaOps.Excititor.Core | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 5 — Excititor Core Foundations | EXCITITOR-POLICY-01-001 | DONE (2025-10-15) | Established policy options & snapshot provider covering baseline weights/overrides. | Team Excititor Policy | Path: src/Excititor/__Libraries/StellaOps.Excititor.Policy | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 5 — Excititor Core Foundations | EXCITITOR-POLICY-01-002 | DONE (2025-10-15) | Policy evaluator now feeds consensus resolver with immutable snapshots. | Team Excititor Policy | Path: src/Excititor/__Libraries/StellaOps.Excititor.Policy | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 5 — Excititor Core Foundations | EXCITITOR-POLICY-01-003 | DONE (2025-10-16) | Author policy diagnostics, CLI/WebService surfacing, and documentation updates. | Team Excititor Policy | Path: src/Excititor/__Libraries/StellaOps.Excititor.Policy | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 5 — Excititor Core Foundations | EXCITITOR-POLICY-01-004 | DONE (2025-10-16) | Implement YAML/JSON schema validation and deterministic diagnostics for operator bundles. | Team Excititor Policy | Path: src/Excititor/__Libraries/StellaOps.Excititor.Policy | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 5 — Excititor Core Foundations | EXCITITOR-POLICY-01-005 | DONE (2025-10-16) | Add policy change tracking, snapshot digests, and telemetry/logging hooks. | Team Excititor Policy | Path: src/Excititor/__Libraries/StellaOps.Excititor.Policy | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 5 — Excititor Core Foundations | EXCITITOR-STORAGE-01-001 | DONE (2025-10-15) | Mongo mapping registry plus raw/export entities and DI extensions in place. | Team Excititor Storage | Path: src/Excititor/__Libraries/StellaOps.Excititor.Storage.Mongo | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 5 — Excititor Core Foundations | EXCITITOR-STORAGE-01-004 | DONE (2025-10-16) | Build provider/consensus/cache class maps and related collections. | Team Excititor Storage | Path: src/Excititor/__Libraries/StellaOps.Excititor.Storage.Mongo | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 5 — Excititor Core Foundations | EXCITITOR-EXPORT-01-001 | DONE (2025-10-15) | Export engine delivers cache lookup, manifest creation, and policy integration. | Team Excititor Export | Path: src/Excititor/__Libraries/StellaOps.Excititor.Export | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 5 — Excititor Core Foundations | EXCITITOR-EXPORT-01-004 | DONE (2025-10-17) | Connect export engine to attestation client and persist Rekor metadata. | Team Excititor Export | Path: src/Excititor/__Libraries/StellaOps.Excititor.Export | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 5 — Excititor Core Foundations | EXCITITOR-ATTEST-01-001 | DONE (2025-10-16) | Implement in-toto predicate + DSSE builder providing envelopes for export attestation. | Team Excititor Attestation | Path: src/Excititor/__Libraries/StellaOps.Excititor.Attestation | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 5 — Excititor Core Foundations | EXCITITOR-CONN-ABS-01-001 | DONE (2025-10-17) | Deliver shared connector context/base classes so provider plug-ins can be activated via WebService/Worker. | Team Excititor Connectors | Path: src/Excititor/__Libraries/StellaOps.Excititor.Connectors.Abstractions | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 5 — Excititor Core Foundations | EXCITITOR-WEB-01-001 | DONE (2025-10-17) | Scaffold minimal API host, DI, and `/excititor/status` endpoint integrating policy, storage, export, and attestation services. | Team Excititor WebService | Path: src/Excititor/StellaOps.Excititor.WebService | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 6 — Excititor Ingest & Formats | EXCITITOR-WORKER-01-001 | DONE (2025-10-17) | Create Worker host with provider scheduling and logging to drive recurring pulls/reconciliation. | Team Excititor Worker | Path: src/Excititor/StellaOps.Excititor.Worker | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 6 — Excititor Ingest & Formats | EXCITITOR-FMT-CSAF-01-001 | DONE (2025-10-17) | Implement CSAF normalizer foundation translating provider documents into `VexClaim` entries. | Team Excititor Formats | Path: src/Excititor/__Libraries/StellaOps.Excititor.Formats.CSAF | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 6 — Excititor Ingest & Formats | EXCITITOR-FMT-CYCLONE-01-001 | DONE (2025-10-17) | Implement CycloneDX VEX normalizer capturing `analysis` state and component references. | Team Excititor Formats | Path: src/Excititor/__Libraries/StellaOps.Excititor.Formats.CycloneDX | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 6 — Excititor Ingest & Formats | EXCITITOR-FMT-OPENVEX-01-001 | DONE (2025-10-17) | Implement OpenVEX normalizer to ingest attestations into canonical claims with provenance. | Team Excititor Formats | Path: src/Excititor/__Libraries/StellaOps.Excititor.Formats.OpenVEX | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 6 — Excititor Ingest & Formats | EXCITITOR-CONN-RH-01-001 | DONE (2025-10-17) | Ship Red Hat CSAF provider metadata discovery enabling incremental pulls. | Team Excititor Connectors – Red Hat | Path: src/Excititor/__Libraries/StellaOps.Excititor.Connectors.RedHat.CSAF | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 6 — Excititor Ingest & Formats | EXCITITOR-CONN-RH-01-002 | DONE (2025-10-17) | Fetch CSAF windows with ETag handling, resume tokens, quarantine on schema errors, and persist raw docs. | Team Excititor Connectors – Red Hat | Path: src/Excititor/__Libraries/StellaOps.Excititor.Connectors.RedHat.CSAF | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 6 — Excititor Ingest & Formats | EXCITITOR-CONN-RH-01-003 | DONE (2025-10-17) | Populate provider trust overrides (cosign issuer, identity regex) and provenance hints for policy evaluation/logging. | Team Excititor Connectors – Red Hat | Path: src/Excititor/__Libraries/StellaOps.Excititor.Connectors.RedHat.CSAF | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 6 — Excititor Ingest & Formats | EXCITITOR-CONN-RH-01-004 | DONE (2025-10-17) | Persist resume cursors (last updated timestamp/document hashes) in storage and reload during fetch to avoid duplicates. | Team Excititor Connectors – Red Hat | Path: src/Excititor/__Libraries/StellaOps.Excititor.Connectors.RedHat.CSAF | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 6 — Excititor Ingest & Formats | EXCITITOR-CONN-RH-01-005 | DONE (2025-10-17) | Register connector in Worker/WebService DI, add scheduled jobs, and document CLI triggers for Red Hat CSAF pulls. | Team Excititor Connectors – Red Hat | Path: src/Excititor/__Libraries/StellaOps.Excititor.Connectors.RedHat.CSAF | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 6 — Excititor Ingest & Formats | EXCITITOR-CONN-RH-01-006 | DONE (2025-10-17) | Add CSAF normalization parity fixtures ensuring RHSA-specific metadata is preserved. | Team Excititor Connectors – Red Hat | Path: src/Excititor/__Libraries/StellaOps.Excititor.Connectors.RedHat.CSAF | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 6 — Excititor Ingest & Formats | EXCITITOR-CONN-CISCO-01-001 | DONE (2025-10-17) | Implement Cisco CSAF endpoint discovery/auth to unlock paginated pulls. | Team Excititor Connectors – Cisco | Path: src/Excititor/__Libraries/StellaOps.Excititor.Connectors.Cisco.CSAF | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 6 — Excititor Ingest & Formats | EXCITITOR-CONN-CISCO-01-002 | DONE (2025-10-17) | Implement Cisco CSAF paginated fetch loop with dedupe and raw persistence support. | Team Excititor Connectors – Cisco | Path: src/Excititor/__Libraries/StellaOps.Excititor.Connectors.Cisco.CSAF | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 6 — Excititor Ingest & Formats | EXCITITOR-CONN-SUSE-01-001 | DONE (2025-10-17) | Build Rancher VEX Hub discovery/subscription path with offline snapshot support. | Team Excititor Connectors – SUSE | Path: src/Excititor/__Libraries/StellaOps.Excititor.Connectors.SUSE.RancherVEXHub | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 6 — Excititor Ingest & Formats | EXCITITOR-CONN-MS-01-001 | DONE (2025-10-17) | Deliver AAD onboarding/token cache for MSRC CSAF ingestion. | Team Excititor Connectors – MSRC | Path: src/Excititor/__Libraries/StellaOps.Excititor.Connectors.MSRC.CSAF | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 6 — Excititor Ingest & Formats | EXCITITOR-CONN-ORACLE-01-001 | DONE (2025-10-17) | Implement Oracle CSAF catalogue discovery with CPU calendar awareness. | Team Excititor Connectors – Oracle | Path: src/Excititor/__Libraries/StellaOps.Excititor.Connectors.Oracle.CSAF | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 6 — Excititor Ingest & Formats | EXCITITOR-CONN-UBUNTU-01-001 | DONE (2025-10-17) | Implement Ubuntu CSAF discovery and channel selection for USN ingestion. | Team Excititor Connectors – Ubuntu | Path: src/Excititor/__Libraries/StellaOps.Excititor.Connectors.Ubuntu.CSAF | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 6 — Excititor Ingest & Formats | EXCITITOR-CONN-OCI-01-001 | DONE (2025-10-18) | Wire OCI discovery/auth to fetch OpenVEX attestations for configured images. | Team Excititor Connectors – OCI | Path: src/Excititor/__Libraries/StellaOps.Excititor.Connectors.OCI.OpenVEX.Attest | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 6 — Excititor Ingest & Formats | EXCITITOR-CONN-OCI-01-002 | DONE (2025-10-18) | Attestation fetch & verify loop – download DSSE attestations, trigger verification, handle retries/backoff, persist raw statements. | Team Excititor Connectors – OCI | Path: src/Excititor/__Libraries/StellaOps.Excititor.Connectors.OCI.OpenVEX.Attest | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 6 — Excititor Ingest & Formats | EXCITITOR-CONN-OCI-01-003 | DONE (2025-10-18) | Provenance metadata & policy hooks – emit image, subject digest, issuer, and trust metadata for policy weighting/logging. | Team Excititor Connectors – OCI | Path: src/Excititor/__Libraries/StellaOps.Excititor.Connectors.OCI.OpenVEX.Attest | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 6 — Excititor Ingest & Formats | EXCITITOR-CLI-01-001 | DONE (2025-10-18) | Add `excititor` CLI verbs bridging to WebService with consistent auth and offline UX. | DevEx/CLI | Path: src/Cli/StellaOps.Cli | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 7 — Contextual Truth Foundations | EXCITITOR-CORE-02-001 | DONE (2025-10-19) | Context signal schema prep – extend consensus models with severity/KEV/EPSS fields and update canonical serializers. | Team Excititor Core & Policy | Path: src/Excititor/__Libraries/StellaOps.Excititor.Core | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 7 — Contextual Truth Foundations | EXCITITOR-POLICY-02-001 | DONE (2025-10-19) | Scoring coefficients & weight ceilings – add α/β options, weight boosts, and validation guidance. | Team Excititor Policy | Path: src/Excititor/__Libraries/StellaOps.Excititor.Policy | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 7 — Contextual Truth Foundations | EXCITITOR-ATTEST-01-002 | DONE (2025-10-16) | Rekor v2 client integration – ship transparency log client with retries and offline queue. | Team Excititor Attestation | Path: src/Excititor/__Libraries/StellaOps.Excititor.Attestation | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 9 — Scanner Core Foundations | SCANNER-CORE-09-501 | DONE (2025-10-18) | Define shared DTOs (ScanJob, ProgressEvent), error taxonomy, and deterministic ID/timestamp helpers aligning with `modules/scanner/architecture.md` §3–§4. | Team Scanner Core | Path: src/Scanner/__Libraries/StellaOps.Scanner.Core | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 9 — Scanner Core Foundations | SCANNER-CORE-09-502 | DONE (2025-10-18) | Observability helpers (correlation IDs, logging scopes, metric namespacing, deterministic hashes) consumed by WebService/Worker. | Team Scanner Core | Path: src/Scanner/__Libraries/StellaOps.Scanner.Core | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 9 — Scanner Core Foundations | SCANNER-CORE-09-503 | DONE (2025-10-18) | Security utilities: Authority client factory, OpTok caching, DPoP verifier, restart-time plug-in guardrails for scanner components. | Team Scanner Core | Path: src/Scanner/__Libraries/StellaOps.Scanner.Core | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 9 — Scanner Build-time | SP9-BLDX-09-001 | DONE (2025-10-19) | Buildx driver scaffold + handshake with Scanner.Emit (local CAS). | BuildX Guild | Path: src/Scanner/StellaOps.Scanner.Sbomer.BuildXPlugin | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 9 — Scanner Build-time | SP9-BLDX-09-002 | DONE (2025-10-19) | OCI annotations + provenance hand-off to Attestor. | BuildX Guild | Path: src/Scanner/StellaOps.Scanner.Sbomer.BuildXPlugin | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 9 — Scanner Build-time | SP9-BLDX-09-003 | DONE (2025-10-19) | CI demo: minimal SBOM push & backend report wiring. | BuildX Guild | Path: src/Scanner/StellaOps.Scanner.Sbomer.BuildXPlugin | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 9 — Scanner Build-time | SP9-BLDX-09-004 | DONE (2025-10-19) | Stabilize descriptor nonce derivation so repeated builds emit deterministic placeholders. | BuildX Guild | Path: src/Scanner/StellaOps.Scanner.Sbomer.BuildXPlugin | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 9 — Scanner Build-time | SP9-BLDX-09-005 | DONE (2025-10-19) | Integrate determinism guard into GitHub/Gitea workflows and archive proof artifacts. | BuildX Guild | Path: src/Scanner/StellaOps.Scanner.Sbomer.BuildXPlugin | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 9 — Scanner Core Foundations | SCANNER-WEB-09-101 | DONE (2025-10-18) | Minimal API host with Authority enforcement, health/ready endpoints, and restart-time plug-in loader per architecture §1, §4. | Team Scanner WebService | Path: src/Scanner/StellaOps.Scanner.WebService | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 9 — Scanner Core Foundations | SCANNER-WEB-09-102 | DONE (2025-10-18) | `/api/v1/scans` submission/status endpoints with deterministic IDs, validation, and cancellation support. | Team Scanner WebService | Path: src/Scanner/StellaOps.Scanner.WebService | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 9 — Scanner Core Foundations | SCANNER-WEB-09-104 | DONE (2025-10-19) | Configuration binding for Mongo, MinIO, queue, feature flags; startup diagnostics and fail-fast policy. | Team Scanner WebService | Path: src/Scanner/StellaOps.Scanner.WebService | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 9 — Scanner Core Foundations | SCANNER-WORKER-09-201 | DONE (2025-10-19) | Worker host bootstrap with Authority auth, hosted services, and graceful shutdown semantics. | Team Scanner Worker | Path: src/Scanner/StellaOps.Scanner.Worker | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 9 — Scanner Core Foundations | SCANNER-WORKER-09-202 | DONE (2025-10-19) | Lease/heartbeat loop with retry+jitter, poison-job quarantine, structured logging. | Team Scanner Worker | Path: src/Scanner/StellaOps.Scanner.Worker | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 9 — Scanner Core Foundations | SCANNER-WORKER-09-203 | DONE (2025-10-19) | Analyzer dispatch skeleton emitting deterministic stage progress and honoring cancellation tokens. | Team Scanner Worker | Path: src/Scanner/StellaOps.Scanner.Worker | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 9 — Scanner Core Foundations | SCANNER-WORKER-09-204 | DONE (2025-10-19) | Worker metrics (queue latency, stage duration, failure counts) with OpenTelemetry resource wiring. | Team Scanner Worker | Path: src/Scanner/StellaOps.Scanner.Worker | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 9 — Scanner Core Foundations | SCANNER-WORKER-09-205 | DONE (2025-10-19) | Harden heartbeat jitter so lease safety margin stays ≥3× and cover with regression tests + optional live queue smoke run. | Team Scanner Worker | Path: src/Scanner/StellaOps.Scanner.Worker | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 9 — Policy Foundations | POLICY-CORE-09-001 | DONE | Policy schema + binder + diagnostics. | Policy Guild | Path: src/Policy/__Libraries/StellaOps.Policy | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 9 — Policy Foundations | POLICY-CORE-09-002 | DONE | Policy snapshot store + revision digests. | Policy Guild | Path: src/Policy/__Libraries/StellaOps.Policy | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 9 — Policy Foundations | POLICY-CORE-09-003 | DONE | `/policy/preview` API (image digest → projected verdict diff). | Policy Guild | Path: src/Policy/__Libraries/StellaOps.Policy | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 9 — DevOps Foundations | DEVOPS-HELM-09-001 | DONE (2025-10-19) | Helm/Compose environment profiles (dev/staging/airgap) with deterministic digests. | DevOps Guild | Path: ops/devops | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 9 — Docs & Governance | DOCS-ADR-09-001 | DONE (2025-10-19) | Establish ADR process and template. | Docs Guild, DevEx | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 9 — Docs & Governance | DOCS-EVENTS-09-002 | DONE (2025-10-19) | Publish event schema catalog (`docs/events/`) for critical envelopes. | Docs Guild, Platform Events | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 9 — Scanner Core Foundations | SCANNER-STORAGE-09-301 | DONE (2025-10-19) | Mongo catalog schemas/indexes for images, layers, artifacts, jobs, lifecycle rules plus migrations. | Team Scanner Storage | Path: src/Scanner/__Libraries/StellaOps.Scanner.Storage | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 9 — Scanner Core Foundations | SCANNER-STORAGE-09-302 | DONE (2025-10-19) | MinIO layout, immutability policies, client abstraction, and configuration binding. | Team Scanner Storage | Path: src/Scanner/__Libraries/StellaOps.Scanner.Storage | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 9 — Scanner Core Foundations | SCANNER-STORAGE-09-303 | DONE (2025-10-19) | Repositories/services with dual-write feature flag, deterministic digests, TTL enforcement tests. | Team Scanner Storage | Path: src/Scanner/__Libraries/StellaOps.Scanner.Storage | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 9 — Scanner Core Foundations | SCANNER-QUEUE-09-401 | DONE (2025-10-19) | Queue abstraction + Redis Streams adapter with ack/claim APIs and idempotency tokens. | Team Scanner Queue | Path: src/Scanner/__Libraries/StellaOps.Scanner.Queue | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 9 — Scanner Core Foundations | SCANNER-QUEUE-09-402 | DONE (2025-10-19) | Pluggable backend support (Redis, NATS) with configuration binding, health probes, failover docs. | Team Scanner Queue | Path: src/Scanner/__Libraries/StellaOps.Scanner.Queue | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 9 — Scanner Core Foundations | SCANNER-QUEUE-09-403 | DONE (2025-10-19) | Retry + dead-letter strategy with structured logs/metrics for offline deployments. | Team Scanner Queue | Path: src/Scanner/__Libraries/StellaOps.Scanner.Queue | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 1 — Stabilize In-Progress Foundations | FEEDCONN-GHSA-02-001 | DONE (2025-10-12) | GHSA normalized versions & provenance
Team instructions: Read ./AGENTS.md and each module's AGENTS file. Adopt the `NormalizedVersions` array emitted by the models sprint, wiring provenance `decisionReason` where merge overrides occur. Follow ./src/FASTER_MODELING_AND_NORMALIZATION.md; report via src/Concelier/__Libraries/StellaOps.Concelier.Merge (FEEDMERGE-COORD-02-900). Progress 2025-10-11: GHSA/OSV emit normalized arrays with refreshed fixtures; CVE mapper now surfaces SemVer normalized ranges; NVD/KEV adoption pending; outstanding follow-ups include FEEDSTORAGE-DATA-02-001, FEEDMERGE-ENGINE-02-002, and rolling `src/Tools/FixtureUpdater` updates across connectors.
Progress 2025-10-20: Coordination matrix + rollout dashboard refreshed; upcoming deadlines tracked (Cccs/Cisco 2025-10-21, CertBund 2025-10-22, ICS-CISA 2025-10-23, KISA 2025-10-24) with escalation path documented in FEEDMERGE-COORD-02-900. | Team Connector Normalized Versions Rollout | Path: src/Concelier/StellaOps.Concelier.PluginBinaries/StellaOps.Concelier.Connector.Ghsa | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 1 — Stabilize In-Progress Foundations | FEEDWEB-OPS-01-006 | DONE (2025-10-19) | Rename plugin drop directory to namespaced path
Build outputs now point at `StellaOps.Concelier.PluginBinaries`/`StellaOps.Authority.PluginBinaries`; defaults/docs/tests updated to reflect the new layout. | Team WebService & Authority | Path: src/Concelier/StellaOps.Concelier.WebService | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 7 — Contextual Truth Foundations | EXCITITOR-STORAGE-02-001 | DONE (2025-10-19) | Statement events & scoring signals – immutable VEX statements store, consensus signal fields, and migration `20251019-consensus-signals-statements` with tests (`dotnet test src/Excititor/__Tests/StellaOps.Excititor.Core.Tests/StellaOps.Excititor.Core.Tests.csproj`, `dotnet test src/Excititor/__Tests/StellaOps.Excititor.Storage.Mongo.Tests/StellaOps.Excititor.Storage.Mongo.Tests.csproj`). | Team Excititor Storage | Path: src/Excititor/__Libraries/StellaOps.Excititor.Storage.Mongo | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 7 — Contextual Truth Foundations | FEEDCORE-ENGINE-07-001 | DONE (2025-10-19) | Advisory event log & asOf queries – surface immutable statements and replay capability. | Team Core Engine & Storage Analytics | Path: src/Concelier/__Libraries/StellaOps.Concelier.Core | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 7 — Contextual Truth Foundations | FEEDWEB-EVENTS-07-001 | DONE (2025-10-19) | Advisory event replay API – expose `/concelier/advisories/{key}/replay` with `asOf` filter, hex hashes, and conflict data. | Concelier WebService Guild | Path: src/Concelier/StellaOps.Concelier.WebService | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 7 — Contextual Truth Foundations | FEEDMERGE-ENGINE-07-001 | DONE (2025-10-20) | Conflict sets & explainers – persist conflict materialization and replay hashes for merge decisions. | BE-Merge | Path: src/Concelier/__Libraries/StellaOps.Concelier.Merge | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 8 — Mongo strengthening | FEEDSTORAGE-MONGO-08-001 | DONE (2025-10-19) | Causal-consistent Concelier storage sessions
Scoped session facilitator registered, repositories accept optional session handles, and replica-set failover tests verify read-your-write + monotonic reads. | Team Normalization & Storage Backbone | Path: src/Concelier/__Libraries/StellaOps.Concelier.Storage.Mongo | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 8 — Mongo strengthening | AUTHSTORAGE-MONGO-08-001 | DONE (2025-10-19) | Harden Authority Mongo usage
Scoped Mongo sessions with majority read/write concerns wired through stores and GraphQL/HTTP pipelines; replica-set election regression validated. | Authority Core & Storage Guild | Path: src/Authority/StellaOps.Authority | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 8 — Mongo strengthening | EXCITITOR-STORAGE-MONGO-08-001 | DONE (2025-10-19) | Causal consistency for Excititor repositories
Session-scoped repositories shipped with new Mongo records, orchestrators/workers now share scoped sessions, and replica-set failover coverage added via `dotnet test src/Excititor/__Tests/StellaOps.Excititor.Storage.Mongo.Tests/StellaOps.Excititor.Storage.Mongo.Tests.csproj`. | Team Excititor Storage | Path: src/Excititor/__Libraries/StellaOps.Excititor.Storage.Mongo | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 8 — Platform Maintenance | EXCITITOR-STORAGE-03-001 | DONE (2025-10-19) | Statement backfill tooling – shipped admin backfill endpoint, CLI hook (`stellaops excititor backfill-statements`), integration tests, and operator runbook (`docs/dev/EXCITITOR_STATEMENT_BACKFILL.md`). | Team Excititor Storage | Path: src/Excititor/__Libraries/StellaOps.Excititor.Storage.Mongo | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 8 — Mirror Distribution | CONCELIER-EXPORT-08-201 | DONE (2025-10-19) | Mirror bundle + domain manifest – produce signed JSON aggregates for `*.stella-ops.org` mirrors. | Concelier Export Guild | Path: src/Concelier/StellaOps.Concelier.PluginBinaries/StellaOps.Concelier.Exporter.Json | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 8 — Mirror Distribution | CONCELIER-EXPORT-08-202 | DONE (2025-10-19) | Mirror-ready Trivy DB bundles – mirror options emit per-domain manifests/metadata/db archives with deterministic digests for downstream sync. | Concelier Export Guild | Path: src/Concelier/StellaOps.Concelier.PluginBinaries/StellaOps.Concelier.Exporter.TrivyDb | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 8 — Mirror Distribution | CONCELIER-WEB-08-201 | DONE (2025-10-20) | Mirror distribution endpoints – expose domain-scoped index/download APIs with auth/quota. | Concelier WebService Guild | Path: src/Concelier/StellaOps.Concelier.WebService | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 8 — Mirror Distribution | DEVOPS-MIRROR-08-001 | DONE (2025-10-19) | Managed mirror deployments for `*.stella-ops.org` – Helm/Compose overlays, CDN, runbooks. | DevOps Guild | Path: ops/devops | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 8 — Plugin Infrastructure | PLUGIN-DI-08-003 | DONE (2025-10-20) | Refactor Authority identity-provider registry to resolve scoped plugin services on-demand.
Introduce factory pattern aligned with scoped lifetimes decided in coordination workshop. | Plugin Platform Guild, Authority Core | Path: src/__Libraries/StellaOps.Plugin | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 8 — Plugin Infrastructure | PLUGIN-DI-08-004 | DONE (2025-10-20) | Update Authority plugin loader to activate registrars with DI support and scoped service awareness.
Add two-phase initialization allowing scoped dependencies post-container build. | Plugin Platform Guild, Authority Core | Path: src/__Libraries/StellaOps.Plugin | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 8 — Plugin Infrastructure | PLUGIN-DI-08-005 | DONE (2025-10-20) | Provide scoped-safe bootstrap execution for Authority plugins.
Implement scope-per-run pattern for hosted bootstrap tasks and document migration guidance. | Plugin Platform Guild, Authority Core | Path: src/__Libraries/StellaOps.Plugin | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 10 — DevOps Security | DEVOPS-SEC-10-301 | DONE (2025-10-20) | Address NU1902/NU1903 advisories for `MongoDB.Driver` 2.12.0 and `SharpCompress` 0.23.0; Wave 0A prerequisites confirmed complete before remediation work. | DevOps Guild | Path: ops/devops | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 11 — Signing Chain Bring-up | AUTH-DPOP-11-001 | DONE (2025-10-20) | Implement DPoP proof validation + nonce handling for high-value audiences per architecture. | Authority Core & Security Guild | Path: src/Authority/StellaOps.Authority | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 15 — Notify Foundations | NOTIFY-WEB-15-103 | DONE (2025-10-19) | Delivery history & test-send endpoints. | Notify WebService Guild | Path: src/Notify/StellaOps.Notify.WebService | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 15 — Notify Foundations | NOTIFY-CONN-SLACK-15-502 | DONE (2025-10-20) | Slack health/test-send support. | Notify Connectors Guild | Path: src/Notify/__Libraries/StellaOps.Notify.Connectors.Slack | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 15 — Notify Foundations | NOTIFY-CONN-TEAMS-15-602 | DONE (2025-10-20) | Teams health/test-send support. | Notify Connectors Guild | Path: src/Notify/__Libraries/StellaOps.Notify.Connectors.Teams | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 15 — Notify Foundations | NOTIFY-CONN-TEAMS-15-604 | DONE (2025-10-20) | Teams health endpoint metadata alignment. | Notify Connectors Guild | Path: src/Notify/__Libraries/StellaOps.Notify.Connectors.Teams | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 15 — Notify Foundations | NOTIFY-CONN-SLACK-15-503 | DONE (2025-10-20) | Package Slack connector as restart-time plug-in (manifest + host registration). | Notify Connectors Guild | Path: src/Notify/__Libraries/StellaOps.Notify.Connectors.Slack | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 15 — Notify Foundations | NOTIFY-CONN-TEAMS-15-603 | DONE (2025-10-20) | Package Teams connector as restart-time plug-in (manifest + host registration). | Notify Connectors Guild | Path: src/Notify/__Libraries/StellaOps.Notify.Connectors.Teams | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 15 — Notify Foundations | NOTIFY-CONN-EMAIL-15-703 | DONE (2025-10-20) | Package Email connector as restart-time plug-in (manifest + host registration). | Notify Connectors Guild | Path: src/Notify/__Libraries/StellaOps.Notify.Connectors.Email | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 15 — Notify Foundations | SCANNER-EVENTS-15-201 | DONE (2025-10-20) | Emit `scanner.report.ready` + `scanner.scan.completed` events. | Scanner WebService Guild | Path: src/Scanner/StellaOps.Scanner.WebService | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 15 — Notify Foundations | NOTIFY-CONN-WEBHOOK-15-803 | DONE (2025-10-20) | Package Webhook connector as restart-time plug-in (manifest + host registration). | Notify Connectors Guild | Path: src/Notify/__Libraries/StellaOps.Notify.Connectors.Webhook | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 16 — Scheduler Intelligence | SCHED-MODELS-16-103 | DONE (2025-10-20) | Versioning/migration helpers for schedules/runs. | Scheduler Models Guild | Path: src/Scheduler/__Libraries/StellaOps.Scheduler.Models | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 16 — Scheduler Intelligence | SCHED-QUEUE-16-401 | DONE (2025-10-20) | Queue abstraction + Redis Streams adapter. | Scheduler Queue Guild | Path: src/Scheduler/__Libraries/StellaOps.Scheduler.Queue | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 16 — Scheduler Intelligence | SCHED-QUEUE-16-402 | DONE (2025-10-20) | NATS JetStream adapter with health probes. | Scheduler Queue Guild | Path: src/Scheduler/__Libraries/StellaOps.Scheduler.Queue | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 16 — Scheduler Intelligence | SCHED-IMPACT-16-300 | DONE (2025-10-20) | **STUB** ImpactIndex ingest/query using fixtures (to be removed by SP16 completion). | Scheduler ImpactIndex Guild | Path: src/Scheduler/__Libraries/StellaOps.Scheduler.ImpactIndex | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | --- — --- | --- | --- | --- | --- | Path: --- | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 7 — Contextual Truth Foundations | DOCS-CONCELIER-07-201 | DONE (2025-10-22) | Final editorial review and publish pass for Concelier authority toggle documentation (Quickstart + operator guide). | Docs Guild, Concelier WebService | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 7 — Contextual Truth Foundations | EXCITITOR-WEB-01-002 | DONE (2025-10-20) | Ingest & reconcile endpoints – scope-enforced `/excititor/init`, `/excititor/ingest/run`, `/excititor/ingest/resume`, `/excititor/reconcile`; regression via `dotnet test … --filter FullyQualifiedName~IngestEndpointsTests`. | Team Excititor WebService | Path: src/Excititor/StellaOps.Excititor.WebService | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 7 — Contextual Truth Foundations | EXCITITOR-WEB-01-004 | DONE (2025-10-20) | Resolve API & signed responses – expose `/excititor/resolve`, return signed consensus/score envelopes, document auth. | Team Excititor WebService | Path: src/Excititor/StellaOps.Excititor.WebService | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 7 — Contextual Truth Foundations | EXCITITOR-WORKER-01-004 | DONE (2025-10-21) | TTL refresh & stability damper – schedule re-resolve loops and guard against status flapping. | Team Excititor Worker | Path: src/Excititor/StellaOps.Excititor.Worker | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 7 — Contextual Truth Foundations | FEEDCORE-ENGINE-07-002 | DONE (2025-10-21) | Noise prior computation service – learn false-positive priors and expose deterministic summaries. | Team Core Engine & Data Science | Path: src/Concelier/__Libraries/StellaOps.Concelier.Core | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 7 — Contextual Truth Foundations | FEEDCORE-ENGINE-07-003 | DONE (2025-10-21) | Unknown state ledger & confidence seeding – persist unknown flags, seed confidence bands, expose query surface. | Team Core Engine & Storage Analytics | Path: src/Concelier/__Libraries/StellaOps.Concelier.Core | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 7 — Contextual Truth Foundations | EXCITITOR-WEB-01-005 | DONE (2025-10-19) | Mirror distribution endpoints – expose download APIs for downstream Excititor instances. | Team Excititor WebService | Path: src/Excititor/StellaOps.Excititor.WebService | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 7 — Contextual Truth Foundations | EXCITITOR-EXPORT-01-005 | DONE (2025-10-21) | Score & resolve envelope surfaces – include signed consensus/score artifacts in exports. | Team Excititor Export | Path: src/Excititor/__Libraries/StellaOps.Excititor.Export | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 7 — Contextual Truth Foundations | EXCITITOR-EXPORT-01-006 | DONE (2025-10-21) | Quiet provenance packaging – attach quieted-by statement IDs, signers, justification codes to exports and attestations. | Team Excititor Export | Path: src/Excititor/__Libraries/StellaOps.Excititor.Export | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 7 — Contextual Truth Foundations | EXCITITOR-EXPORT-01-007 | DONE (2025-10-21) | Mirror bundle + domain manifest – publish signed consensus bundles for mirrors. | Team Excititor Export | Path: src/Excititor/__Libraries/StellaOps.Excititor.Export | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 7 — Contextual Truth Foundations | EXCITITOR-CONN-STELLA-07-001 | DONE (2025-10-21) | Excititor mirror connector – ingest signed mirror bundles and map to VexClaims with resume handling. | Excititor Connectors – Stella | Path: src/Excititor/StellaOps.Excititor.Connectors.StellaOpsMirror | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 7 — Contextual Truth Foundations | FEEDSTORAGE-DATA-07-001 | DONE (2025-10-19) | Advisory statement & conflict collections – provision Mongo schema/indexes for event-sourced merge. | Team Normalization & Storage Backbone | Path: src/Concelier/__Libraries/StellaOps.Concelier.Storage.Mongo | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 7 — Contextual Truth Foundations | WEB1.TRIVY-SETTINGS-TESTS | DONE (2025-10-21) | Add headless UI test run (`ng test --watch=false`) and document prerequisites once Angular tooling is chained up. | UX Specialist, Angular Eng | Path: src/Web/StellaOps.Web | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 8 — Mirror Distribution | FEEDCONN-STELLA-08-001 | DONE (2025-10-20) | Concelier mirror connector – fetch mirror manifest, verify signatures, and hydrate canonical DTOs with resume support. | BE-Conn-Stella | Path: src/Concelier/__Libraries/StellaOps.Concelier.Connector.StellaOpsMirror | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 8 — Mirror Distribution | FEEDCONN-STELLA-08-002 | DONE (2025-10-20) | Map mirror payloads into canonical advisory DTOs with provenance referencing mirror domain + original source metadata. | BE-Conn-Stella | Path: src/Concelier/__Libraries/StellaOps.Concelier.Connector.StellaOpsMirror | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 8 — Mirror Distribution | FEEDCONN-STELLA-08-003 | DONE (2025-10-20) | Add incremental cursor + resume support (per-export fingerprint) and document configuration for downstream Concelier instances. | BE-Conn-Stella | Path: src/Concelier/__Libraries/StellaOps.Concelier.Connector.StellaOpsMirror | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 8 — Plugin Infrastructure | PLUGIN-DI-08-001 | DONE (2025-10-21) | Scoped service support in plugin bootstrap – added dynamic plugin tests ensuring `[ServiceBinding]` metadata flows through plugin hosts and remains idempotent. | Plugin Platform Guild | Path: src/__Libraries/StellaOps.Plugin | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 8 — Plugin Infrastructure | PLUGIN-DI-08-002.COORD | DONE (2025-10-20) | Authority scoped-service integration handshake
Workshop concluded 2025-10-20 15:00–16:05 UTC; decisions + follow-ups recorded in `docs/dev/authority-plugin-di-coordination.md`. | Plugin Platform Guild, Authority Core | Path: src/__Libraries/StellaOps.Plugin | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 8 — Plugin Infrastructure | PLUGIN-DI-08-002 | DONE (2025-10-20) | Authority plugin integration updates – scoped identity-provider services with registry handles; regression coverage via scoped registrar/unit tests. | Plugin Platform Guild, Authority Core | Path: src/__Libraries/StellaOps.Plugin | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 8 — Plugin Infrastructure | AUTH-PLUGIN-COORD-08-002 | DONE (2025-10-20) | Coordinate scoped-service adoption for Authority plug-in registrars
Workshop notes and follow-up backlog captured 2025-10-20 in `docs/dev/authority-plugin-di-coordination.md`. | Authority Core, Plugin Platform Guild | Path: src/Authority/StellaOps.Authority | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 9 — Scanner Core Foundations | SCANNER-WEB-09-103 | DONE (2025-10-19) | Progress streaming (SSE/JSONL) with correlation IDs and ISO-8601 UTC timestamps, documented in API reference. | Team Scanner WebService | Path: src/Scanner/StellaOps.Scanner.WebService | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 9 — Scanner Core Foundations | SCANNER-POLICY-09-105 | DONE (2025-10-19) | Policy snapshot loader + schema + OpenAPI (YAML ignore rules, VEX include/exclude, vendor precedence). | Team Scanner WebService | Path: src/Scanner/StellaOps.Scanner.WebService | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 9 — Scanner Core Foundations | SCANNER-POLICY-09-106 | DONE (2025-10-19) | `/reports` verdict assembly (Conselier+Excitor+Policy) + signed response envelope. | Team Scanner WebService | Path: src/Scanner/StellaOps.Scanner.WebService | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 9 — Scanner Core Foundations | SCANNER-POLICY-09-107 | DONE (2025-10-19) | Expose score inputs, config version, and quiet provenance in `/reports` JSON and signed payload. | Team Scanner WebService | Path: src/Scanner/StellaOps.Scanner.WebService | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 9 — DevOps Foundations | DEVOPS-SCANNER-09-204 | DONE (2025-10-21) | Surface `SCANNER__EVENTS__*` env config across Compose/Helm and document overrides. | DevOps Guild, Scanner WebService Guild | Path: ops/devops | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 9 — DevOps Foundations | DEVOPS-SCANNER-09-205 | DONE (2025-10-21) | Notify smoke job validates Redis stream + Notify deliveries after staging deploys. | DevOps Guild, Notify Guild | Path: ops/devops | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 9 — Policy Foundations | POLICY-CORE-09-004 | DONE (2025-10-19) | Versioned scoring config with schema validation, trust table, and golden fixtures. | Policy Guild | Path: src/Policy/__Libraries/StellaOps.Policy | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 9 — Policy Foundations | POLICY-CORE-09-005 | DONE (2025-10-19) | Scoring/quiet engine – compute score, enforce VEX-only quiet rules, emit inputs and provenance. | Policy Guild | Path: src/Policy/__Libraries/StellaOps.Policy | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 9 — Policy Foundations | POLICY-CORE-09-006 | DONE (2025-10-19) | Unknown state & confidence decay – deterministic bands surfaced in policy outputs. | Policy Guild | Path: src/Policy/__Libraries/StellaOps.Policy | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 9 — Docs & Governance | PLATFORM-EVENTS-09-401 | DONE (2025-10-21) | Embed canonical event samples into contract/integration tests and ensure CI validates payloads against published schemas. | Platform Events Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 10 — Benchmarks | BENCH-SCANNER-10-002 | DONE (2025-10-21) | Wire real language analyzers into bench harness & refresh baselines post-implementation. | Bench Guild, Language Analyzer Guild | Path: src/Bench/StellaOps.Bench | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 10 — Scanner Analyzers & SBOM | SCANNER-ANALYZERS-LANG-10-302 | DONE (2025-10-21) | Node analyzer handling workspaces/symlinks emitting `pkg:npm`. | Language Analyzer Guild | Path: src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 10 — Scanner Analyzers & SBOM | SCANNER-ANALYZERS-LANG-10-303 | DONE (2025-10-21) | Python analyzer reading `*.dist-info`, RECORD hashes, entry points. | Language Analyzer Guild | Path: src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 10 — Scanner Analyzers & SBOM | SCANNER-ANALYZERS-LANG-10-304 | DONE (2025-10-22) | Go analyzer leveraging buildinfo for `pkg:golang` components. | Language Analyzer Guild | Path: src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 10 — Scanner Analyzers & SBOM | SCANNER-ANALYZERS-LANG-10-304E | DONE (2025-10-22) | Plumb Go heuristic counter into Scanner metrics pipeline and alerting. | Language Analyzer Guild | Path: src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Go | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 10 — Scanner Analyzers & SBOM | SCANNER-ANALYZERS-LANG-10-305 | DONE (2025-10-22) | .NET analyzer parsing `*.deps.json`, assembly metadata, RID variants. | Language Analyzer Guild | Path: src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 10 — Scanner Analyzers & SBOM | SCANNER-ANALYZERS-LANG-10-306 | DONE (2025-10-22) | Rust analyzer detecting crates or falling back to `bin:{sha256}`. | Language Analyzer Guild | Path: src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 10 — Scanner Analyzers & SBOM | SCANNER-ANALYZERS-LANG-10-307 | DONE (2025-10-19) | Shared language evidence helpers + usage flag propagation. | Language Analyzer Guild | Path: src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 10 — Scanner Analyzers & SBOM | SCANNER-ANALYZERS-LANG-10-308 | DONE (2025-10-19) | Determinism + fixture harness for language analyzers. | Language Analyzer Guild | Path: src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 10 — Scanner Analyzers & SBOM | SCANNER-ANALYZERS-LANG-10-309 | DONE (2025-10-21) | Package language analyzers as restart-time plug-ins (manifest + host registration). | Language Analyzer Guild | Path: src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 10 — Scanner Analyzers & SBOM | SCANNER-EMIT-10-601 | DONE (2025-10-22) | Compose inventory SBOM (CycloneDX JSON/Protobuf) from layer fragments. | Emit Guild | Path: src/Scanner/__Libraries/StellaOps.Scanner.Emit | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 10 — Scanner Analyzers & SBOM | SCANNER-EMIT-10-602 | DONE (2025-10-22) | Compose usage SBOM leveraging EntryTrace to flag actual usage. | Emit Guild | Path: src/Scanner/__Libraries/StellaOps.Scanner.Emit | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 10 — Scanner Analyzers & SBOM | SCANNER-EMIT-10-603 | DONE (2025-10-22) | Generate BOM index sidecar (purl table + roaring bitmap + usage flag). | Emit Guild | Path: src/Scanner/__Libraries/StellaOps.Scanner.Emit | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 10 — Scanner Analyzers & SBOM | SCANNER-EMIT-10-604 | DONE (2025-10-22) | Package artifacts for export + attestation with deterministic manifests. | Emit Guild | Path: src/Scanner/__Libraries/StellaOps.Scanner.Emit | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 10 — Scanner Analyzers & SBOM | SCANNER-EMIT-10-605 | DONE (2025-10-22) | Emit BOM-Index sidecar schema/fixtures (CRITICAL PATH for SP16). | Emit Guild | Path: src/Scanner/__Libraries/StellaOps.Scanner.Emit | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 10 — Scanner Analyzers & SBOM | SCANNER-EMIT-10-606 | DONE (2025-10-22) | Usage view bit flags integrated with EntryTrace. | Emit Guild | Path: src/Scanner/__Libraries/StellaOps.Scanner.Emit | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 10 — Scanner Analyzers & SBOM | SCANNER-EMIT-10-607 | DONE (2025-10-22) | Embed scoring inputs, confidence band, and quiet provenance in CycloneDX/DSSE artifacts. | Emit Guild | Path: src/Scanner/__Libraries/StellaOps.Scanner.Emit | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 10 — Scanner Analyzers & SBOM | SCANNER-CACHE-10-101 | DONE (2025-10-19) | Implement layer cache store keyed by layer digest with metadata retention per architecture §3.3. | Scanner Cache Guild | Path: src/Scanner/__Libraries/StellaOps.Scanner.Cache | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 10 — Scanner Analyzers & SBOM | SCANNER-CACHE-10-102 | DONE (2025-10-19) | Build file CAS with dedupe, TTL enforcement, and offline import/export hooks. | Scanner Cache Guild | Path: src/Scanner/__Libraries/StellaOps.Scanner.Cache | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 10 — Scanner Analyzers & SBOM | SCANNER-CACHE-10-103 | DONE (2025-10-19) | Expose cache metrics/logging and configuration toggles for warm/cold thresholds. | Scanner Cache Guild | Path: src/Scanner/__Libraries/StellaOps.Scanner.Cache | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 10 — Scanner Analyzers & SBOM | SCANNER-CACHE-10-104 | DONE (2025-10-19) | Implement cache invalidation workflows (layer delete, TTL expiry, diff invalidation). | Scanner Cache Guild | Path: src/Scanner/__Libraries/StellaOps.Scanner.Cache | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 10 — Scanner Analyzers & SBOM | SCANNER-ANALYZERS-OS-10-201 | DONE (2025-10-19) | Alpine/apk analyzer emitting deterministic components with provenance. | OS Analyzer Guild | Path: src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.OS | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 10 — Scanner Analyzers & SBOM | SCANNER-ANALYZERS-OS-10-202 | DONE (2025-10-19) | Debian/dpkg analyzer mapping packages to purl identity with evidence. | OS Analyzer Guild | Path: src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.OS | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 10 — Scanner Analyzers & SBOM | SCANNER-ANALYZERS-OS-10-203 | DONE (2025-10-19) | RPM analyzer capturing EVR, file listings, provenance. | OS Analyzer Guild | Path: src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.OS | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 10 — Scanner Analyzers & SBOM | SCANNER-ANALYZERS-OS-10-204 | DONE (2025-10-19) | Shared OS evidence helpers for package identity + provenance. | OS Analyzer Guild | Path: src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.OS | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 10 — Scanner Analyzers & SBOM | SCANNER-ANALYZERS-OS-10-205 | DONE (2025-10-19) | Vendor metadata enrichment (source packages, license, CVE hints). | OS Analyzer Guild | Path: src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.OS | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 10 — Scanner Analyzers & SBOM | SCANNER-ANALYZERS-OS-10-206 | DONE (2025-10-19) | Determinism harness + fixtures for OS analyzers. | OS Analyzer Guild | Path: src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.OS | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 10 — Scanner Analyzers & SBOM | SCANNER-ANALYZERS-OS-10-207 | DONE (2025-10-19) | Package OS analyzers as restart-time plug-ins (manifest + host registration). | OS Analyzer Guild | Path: src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.OS | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 10 — Scanner Analyzers & SBOM | SCANNER-ANALYZERS-LANG-10-301 | DONE (2025-10-19) | Java analyzer emitting `pkg:maven` with provenance. | Language Analyzer Guild | Path: src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 10 — Scanner Analyzers & SBOM | SCANNER-ENTRYTRACE-10-401 | DONE (2025-10-19) | POSIX shell AST parser with deterministic output. | EntryTrace Guild | Path: src/Scanner/__Libraries/StellaOps.Scanner.EntryTrace | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 10 — Scanner Analyzers & SBOM | SCANNER-ENTRYTRACE-10-402 | DONE (2025-10-19) | Command resolution across layered rootfs with evidence attribution. | EntryTrace Guild | Path: src/Scanner/__Libraries/StellaOps.Scanner.EntryTrace | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 10 — Scanner Analyzers & SBOM | SCANNER-ENTRYTRACE-10-403 | DONE (2025-10-19) | Interpreter tracing for shell wrappers to Python/Node/Java launchers. | EntryTrace Guild | Path: src/Scanner/__Libraries/StellaOps.Scanner.EntryTrace | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 10 — Scanner Analyzers & SBOM | SCANNER-ENTRYTRACE-10-404 | DONE (2025-10-19) | Python entry analyzer (venv shebang, module invocation, usage flag). | EntryTrace Guild | Path: src/Scanner/__Libraries/StellaOps.Scanner.EntryTrace | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 10 — Scanner Analyzers & SBOM | SCANNER-ENTRYTRACE-10-405 | DONE (2025-10-19) | Node/Java launcher analyzer capturing script/jar targets. | EntryTrace Guild | Path: src/Scanner/__Libraries/StellaOps.Scanner.EntryTrace | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 10 — Scanner Analyzers & SBOM | SCANNER-ENTRYTRACE-10-406 | DONE (2025-10-19) | Explainability + diagnostics for unresolved constructs with metrics. | EntryTrace Guild | Path: src/Scanner/__Libraries/StellaOps.Scanner.EntryTrace | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 10 — Scanner Analyzers & SBOM | SCANNER-ENTRYTRACE-10-407 | DONE (2025-10-19) | Package EntryTrace analyzers as restart-time plug-ins (manifest + host registration). | EntryTrace Guild | Path: src/Scanner/__Libraries/StellaOps.Scanner.EntryTrace | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 10 — Scanner Analyzers & SBOM | SCANNER-DIFF-10-501 | DONE (2025-10-19) | Build component differ tracking add/remove/version changes with deterministic ordering. | Diff Guild | Path: src/Scanner/__Libraries/StellaOps.Scanner.Diff | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 10 — Scanner Analyzers & SBOM | SCANNER-DIFF-10-502 | DONE (2025-10-19) | Attribute diffs to introducing/removing layers including provenance evidence. | Diff Guild | Path: src/Scanner/__Libraries/StellaOps.Scanner.Diff | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 10 — Scanner Analyzers & SBOM | SCANNER-DIFF-10-503 | DONE (2025-10-19) | Produce JSON diff output for inventory vs usage views aligned with API contract. | Diff Guild | Path: src/Scanner/__Libraries/StellaOps.Scanner.Diff | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 10 — Samples | SAMPLES-10-001 | DONE (2025-10-20) | Sample images with SBOM/BOM-Index sidecars. | Samples Guild, Scanner Team | Path: samples | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 10 — DevOps Perf | DEVOPS-PERF-10-001 | DONE (2025-10-22) | Perf smoke job ensuring <5 s SBOM compose. | DevOps Guild | Path: ops/devops | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 10 — DevOps Perf | DEVOPS-PERF-10-002 | DONE (2025-10-23) | Publish analyzer bench metrics to Grafana/perf workbook and alarm on ≥20 % regressions. | DevOps Guild | Path: ops/devops | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 10 — Policy Samples | SAMPLES-13-004 | DONE (2025-10-23) | Add policy preview/report fixtures showing confidence bands and unknown-age tags. | Samples Guild, Policy Guild | Path: samples | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 10 — Policy Samples | WEB-POLICY-FIXTURES-10-001 | DONE (2025-10-23) | Wire policy preview/report doc fixtures into UI harness (test utility or Storybook substitute) with type bindings and validation guard so UI stays aligned with documented payloads. | UI Guild | Path: src/Web/StellaOps.Web | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 11 — Signing Chain Bring-up | SIGNER-API-11-101 | DONE (2025-10-21) | `/sign/dsse` pipeline with Authority auth, PoE introspection, release verification, DSSE signing. | Signer Guild | Path: src/Signer/StellaOps.Signer | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 11 — Signing Chain Bring-up | SIGNER-REF-11-102 | DONE (2025-10-21) | `/verify/referrers` endpoint with OCI lookup, caching, and policy enforcement. | Signer Guild | Path: src/Signer/StellaOps.Signer | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 11 — Signing Chain Bring-up | SIGNER-QUOTA-11-103 | DONE (2025-10-21) | Enforce plan quotas, concurrency/QPS limits, artifact size caps with metrics/audit logs. | Signer Guild | Path: src/Signer/StellaOps.Signer | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 11 — Signing Chain Bring-up | AUTH-MTLS-11-002 | DONE (2025-10-23) | Add OAuth mTLS client credential support with certificate-bound tokens and introspection updates. | Authority Core & Security Guild | Path: src/Authority/StellaOps.Authority | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 12 — Runtime Guardrails | SCANNER-RUNTIME-12-301 | DONE (2025-10-20) | `/runtime/events` ingestion endpoint with validation, batching, storage hooks. | Scanner WebService Guild | Path: src/Scanner/StellaOps.Scanner.WebService | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 13 — UX & CLI Experience | CLI-OFFLINE-13-006 | DONE (2025-10-21) | Implement offline kit pull/import/status commands with integrity checks. | DevEx/CLI | Path: src/Cli/StellaOps.Cli | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 13 — UX & CLI Experience | CLI-PLUGIN-13-007 | DONE (2025-10-22) | Package non-core CLI verbs as restart-time plug-ins (manifest + loader tests). | DevEx/CLI | Path: src/Cli/StellaOps.Cli | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 13 — UX & CLI Experience | WEB1.DEPS-13-001 | DONE (2025-10-21) | Stabilise Angular workspace dependencies for headless CI installs (`npm install`, Chromium handling, docs). | UX Specialist, Angular Eng, DevEx | Path: src/Web/StellaOps.Web | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 16 — Scheduler Intelligence | SCHED-QUEUE-16-403 | DONE (2025-10-20) | Dead-letter handling + metrics. | Scheduler Queue Guild | Path: src/Scheduler/__Libraries/StellaOps.Scheduler.Queue | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 18 — Launch Readiness | DEVOPS-OFFLINE-18-004 | DONE (2025-10-22) | Rebuild Offline Kit bundle with Go analyzer plug-in and refreshed manifest/signature set. | Offline Kit Guild, Scanner Guild | Path: ops/offline-kit | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | --- — --- | --- | --- | --- | --- | Path: --- | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 11 — Signing Chain Bring-up | ATTESTOR-API-11-201 | DONE (2025-10-19) | `/rekor/entries` submission pipeline with dedupe, proof acquisition, and persistence. | Attestor Guild | Path: src/Attestor/StellaOps.Attestor | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 11 — Signing Chain Bring-up | ATTESTOR-VERIFY-11-202 | DONE (2025-10-19) | `/rekor/verify` + retrieval endpoints validating signatures and Merkle proofs. | Attestor Guild | Path: src/Attestor/StellaOps.Attestor | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 11 — Signing Chain Bring-up | ATTESTOR-OBS-11-203 | DONE (2025-10-19) | Telemetry, alerting, mTLS hardening, and archive workflow for Attestor. | Attestor Guild | Path: src/Attestor/StellaOps.Attestor | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 11 — Storage Platform Hardening | SCANNER-STORAGE-11-401 | DONE (2025-10-23) | Migrate scanner object storage integration from MinIO to RustFS with data migration plan. | Scanner Storage Guild | Path: src/Scanner/__Libraries/StellaOps.Scanner.Storage | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 11 — UI Integration | UI-ATTEST-11-005 | DONE (2025-10-23) | Attestation visibility (Rekor id, status) on Scan Detail. | UI Guild | Path: src/UI/StellaOps.UI | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 12 — Runtime Guardrails | ZASTAVA-CORE-12-201 | DONE (2025-10-23) | Define runtime event/admission DTOs, hashing helpers, and versioning strategy. | Zastava Core Guild | Path: src/Zastava/__Libraries/StellaOps.Zastava.Core | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 12 — Runtime Guardrails | ZASTAVA-CORE-12-202 | DONE (2025-10-23) | Provide configuration/logging/metrics utilities shared by Observer/Webhook. | Zastava Core Guild | Path: src/Zastava/__Libraries/StellaOps.Zastava.Core | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 12 — Runtime Guardrails | ZASTAVA-CORE-12-203 | DONE (2025-10-23) | Authority client helpers, OpTok caching, and security guardrails for runtime services. | Zastava Core Guild | Path: src/Zastava/__Libraries/StellaOps.Zastava.Core | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 12 — Runtime Guardrails | ZASTAVA-OPS-12-204 | DONE (2025-10-23) | Operational runbooks, alert rules, and dashboard exports for runtime plane. | Zastava Core Guild | Path: src/Zastava/__Libraries/StellaOps.Zastava.Core | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 12 — Runtime Guardrails | ZASTAVA-OBS-12-001 | DONE (2025-10-24) | Container lifecycle watcher emitting deterministic runtime events with buffering. | Zastava Observer Guild | Path: src/Zastava/StellaOps.Zastava.Observer | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 12 — Runtime Guardrails | ZASTAVA-OBS-12-002 | DONE (2025-10-24) | Capture entrypoint traces + loaded libraries, hashing binaries and linking to baseline SBOM. | Zastava Observer Guild | Path: src/Zastava/StellaOps.Zastava.Observer | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 12 — Runtime Guardrails | ZASTAVA-OBS-12-003 | DONE (2025-10-24) | Posture checks for signatures/SBOM/attestation with offline caching. | Zastava Observer Guild | Path: src/Zastava/StellaOps.Zastava.Observer | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 12 — Runtime Guardrails | ZASTAVA-OBS-12-004 | DONE (2025-10-24) | Batch `/runtime/events` submissions with disk-backed buffer and rate limits. | Zastava Observer Guild | Path: src/Zastava/StellaOps.Zastava.Observer | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 12 — Runtime Guardrails | ZASTAVA-WEBHOOK-12-101 | DONE (2025-10-24) | Admission controller host with TLS bootstrap and Authority auth. | Zastava Webhook Guild | Path: src/Zastava/StellaOps.Zastava.Webhook | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 12 — Runtime Guardrails | ZASTAVA-WEBHOOK-12-102 | DONE (2025-10-24) | Query Scanner `/policy/runtime`, resolve digests, enforce verdicts. | Zastava Webhook Guild | Path: src/Zastava/StellaOps.Zastava.Webhook | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 12 — Runtime Guardrails | ZASTAVA-WEBHOOK-12-103 | DONE (2025-10-24) | Caching, fail-open/closed toggles, metrics/logging for admission decisions. | Zastava Webhook Guild | Path: src/Zastava/StellaOps.Zastava.Webhook | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 12 — Runtime Guardrails | ZASTAVA-WEBHOOK-12-104 | DONE (2025-10-24) | Wire `/admission` endpoint to runtime policy client and emit allow/deny envelopes. | Zastava Webhook Guild | Path: src/Zastava/StellaOps.Zastava.Webhook | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 12 — Runtime Guardrails | SCANNER-RUNTIME-12-302 | DONE (2025-10-24) | `/policy/runtime` endpoint joining SBOM baseline + policy verdict, returning admission guidance. | Scanner WebService Guild | Path: src/Scanner/StellaOps.Scanner.WebService | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 12 — Runtime Guardrails | SCANNER-RUNTIME-12-303 | DONE (2025-10-24) | Align `/policy/runtime` verdicts with canonical policy evaluation (Conselier/Excitor). | Scanner WebService Guild | Path: src/Scanner/StellaOps.Scanner.WebService | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 12 — Runtime Guardrails | SCANNER-RUNTIME-12-304 | DONE (2025-10-24) | Integrate attestation verification into runtime policy metadata. | Scanner WebService Guild | Path: src/Scanner/StellaOps.Scanner.WebService | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 12 — Runtime Guardrails | SCANNER-RUNTIME-12-305 | DONE (2025-10-24) | Deliver shared fixtures + e2e validation with Zastava/CLI teams. | Scanner WebService Guild | Path: src/Scanner/StellaOps.Scanner.WebService | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 13 — UX & CLI Experience | UI-AUTH-13-001 | DONE (2025-10-23) | Integrate Authority OIDC + DPoP flows with session management. | UI Guild | Path: src/UI/StellaOps.UI | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 13 — UX & CLI Experience | UI-NOTIFY-13-006 | DONE (2025-10-25) | Notify panel: channels/rules CRUD, deliveries view, test send. | UI Guild | Path: src/UI/StellaOps.UI | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 13 — Platform Reliability | DEVOPS-NUGET-13-001 | DONE (2025-10-25) | Wire up .NET 10 preview feeds/local mirrors so `dotnet restore` succeeds offline; document updated NuGet bootstrap. | DevOps Guild, Platform Leads | Path: ops/devops | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 15 — Notify Foundations | NOTIFY-QUEUE-15-401 | DONE (2025-10-23) | Bus abstraction + Redis Streams adapter with ordering/idempotency. | Notify Queue Guild | Path: src/Notify/__Libraries/StellaOps.Notify.Queue | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 15 — Notify Foundations | NOTIFY-QUEUE-15-402 | DONE (2025-10-23) | NATS JetStream adapter with health probes and failover. | Notify Queue Guild | Path: src/Notify/__Libraries/StellaOps.Notify.Queue | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 15 — Notify Foundations | NOTIFY-QUEUE-15-403 | DONE (2025-10-23) | Delivery queue with retry/dead-letter + metrics. | Notify Queue Guild | Path: src/Notify/__Libraries/StellaOps.Notify.Queue | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 15 — Notify Foundations | NOTIFY-WORKER-15-201 | DONE (2025-10-23) | Bus subscription + leasing loop with backoff. | Notify Worker Guild | Path: src/Notify/StellaOps.Notify.Worker | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 17 — Symbol Intelligence & Forensics | ZASTAVA-OBS-17-005 | DONE (2025-10-25) | Collect GNU build-id during runtime observation and attach it to emitted events. | Zastava Observer Guild | Path: src/Zastava/StellaOps.Zastava.Observer | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 17 — Symbol Intelligence & Forensics | SCANNER-RUNTIME-17-401 | DONE (2025-10-25) | Persist runtime build-id observations and expose them for debug-symbol correlation. | Scanner WebService Guild | Path: src/Scanner/StellaOps.Scanner.WebService | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | --- — --- | --- | --- | --- | --- | Path: --- | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 13 — Platform Reliability | DEVOPS-NUGET-13-002 | DONE (2025-10-26) | Ensure all solutions/projects prioritize `local-nuget` before public feeds and add restore-order validation. | DevOps Guild | Path: ops/devops | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 13 — Platform Reliability | DEVOPS-NUGET-13-003 | DONE (2025-10-26) | Upgrade `Microsoft.*` dependencies pinned to 8.* to their latest .NET 10 (or 9.x) releases and refresh guidance. | DevOps Guild, Platform Leads | Path: ops/devops | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 14 — Release & Offline Ops | DEVOPS-OPS-14-003 | DONE (2025-10-26) | Deployment/update/rollback automation and channel management documentation. | Deployment Guild | Path: ops/deployment | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 14 — Release & Offline Ops | DEVOPS-REL-14-001 | DONE (2025-10-26) | Deterministic build/release pipeline with SBOM/provenance, signing, and manifest generation. | DevOps Guild | Path: ops/devops | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 14 — Release & Offline Ops | DEVOPS-REL-14-004 | DONE (2025-10-26) | Extend release/offline smoke jobs to cover Python analyzer plug-ins (warm/cold, determinism, signing). | DevOps Guild, Scanner Guild | Path: ops/devops | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 14 — Release & Offline Ops | DEVOPS-LIC-14-004 | DONE (2025-10-26) | Registry token service tied to Authority, plan gating, revocation handling, monitoring. | Licensing Guild | Path: ops/licensing | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 14 — Release & Offline Ops | DEVOPS-OFFLINE-14-002 | DONE (2025-10-26) | Offline kit packaging workflow with integrity verification and documentation. | Offline Kit Guild | Path: ops/offline-kit | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 15 — Benchmarks | BENCH-NOTIFY-15-001 | DONE (2025-10-26) | Notify dispatch throughput bench with results CSV. | Bench Guild, Notify Team | Path: src/Bench/StellaOps.Bench | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 16 — Scheduler Intelligence | SCHED-MODELS-16-101 | DONE (2025-10-19) | Define Scheduler DTOs & validation. | Scheduler Models Guild | Path: src/Scheduler/__Libraries/StellaOps.Scheduler.Models | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 16 — Scheduler Intelligence | SCHED-MODELS-16-102 | DONE (2025-10-19) | Publish schema docs/sample payloads. | Scheduler Models Guild | Path: src/Scheduler/__Libraries/StellaOps.Scheduler.Models | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 16 — Scheduler Intelligence | SCHED-STORAGE-16-201 | DONE (2025-10-19) | Mongo schemas/indexes for Scheduler state. | Scheduler Storage Guild | Path: src/Scheduler/__Libraries/StellaOps.Scheduler.Storage.Mongo | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 16 — Scheduler Intelligence | SCHED-STORAGE-16-202 | DONE (2025-10-26) | Repositories with tenant scoping, TTL, causal consistency. | Scheduler Storage Guild | Path: src/Scheduler/__Libraries/StellaOps.Scheduler.Storage.Mongo | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 16 — Scheduler Intelligence | SCHED-STORAGE-16-203 | DONE (2025-10-26) | Audit/run stats materialization for UI. | Scheduler Storage Guild | Path: src/Scheduler/__Libraries/StellaOps.Scheduler.Storage.Mongo | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 16 — Scheduler Intelligence | SCHED-IMPACT-16-302 | DONE (2025-10-26) | Query APIs for ResolveByPurls/ResolveByVulns/ResolveAll. | Scheduler ImpactIndex Guild | Path: src/Scheduler/__Libraries/StellaOps.Scheduler.ImpactIndex | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 16 — Scheduler Intelligence | SCHED-IMPACT-16-301 | DONE (2025-10-26) | Ingest BOM-Index into roaring bitmap store. | Scheduler ImpactIndex Guild | Path: src/Scheduler/__Libraries/StellaOps.Scheduler.ImpactIndex | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 16 — Scheduler Intelligence | SCHED-WEB-16-102 | DONE (2025-10-26) | Schedules CRUD (cron validation, pause/resume, audit). | Scheduler WebService Guild | Path: src/Scheduler/StellaOps.Scheduler.WebService | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 16 — Scheduler Intelligence | SCHED-WEB-16-103 | DONE (2025-10-26) | Runs API (list/detail/cancel) + impact previews. | Scheduler WebService Guild | Path: src/Scheduler/StellaOps.Scheduler.WebService | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 16 — Scheduler Intelligence | SCHED-WEB-16-104 | DONE (2025-10-27) | Conselier/Excitor webhook handlers with security enforcement. | Scheduler WebService Guild | Path: src/Scheduler/StellaOps.Scheduler.WebService | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 17 — Symbol Intelligence & Forensics | DOCS-RUNTIME-17-004 | DONE (2025-10-26) | Document build-id workflows for SBOMs, runtime events, and debug-store usage. | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 17 — Symbol Intelligence & Forensics | DEVOPS-REL-17-002 | DONE (2025-10-26) | Ship stripped debug artifacts organised by build-id within release/offline kits. | DevOps Guild | Path: ops/devops | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 17 — Symbol Intelligence & Forensics | DEVOPS-OFFLINE-17-003 | DONE (2025-10-26) | Mirror release debug-store artefacts into Offline Kit packaging and document validation. | Offline Kit Guild, DevOps Guild | Path: ops/offline-kit | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 17 — Symbol Intelligence & Forensics | SCANNER-EMIT-17-701 | DONE (2025-10-26) | Record GNU build-id for ELF components and surface it in SBOM/diff outputs. | Emit Guild | Path: src/Scanner/__Libraries/StellaOps.Scanner.Emit | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 18 — Launch Readiness | DEVOPS-LAUNCH-18-001 | DONE (2025-10-26) | Production launch cutover rehearsal and runbook publication. | DevOps Guild | Path: ops/devops | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 18 — Launch Readiness | DEVOPS-OFFLINE-18-005 | DONE (2025-10-26) | Rebuild Offline Kit with Python analyzer artefacts and refreshed manifest/signature pair. | Offline Kit Guild, Scanner Guild | Path: ops/offline-kit | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 19 — Aggregation-Only Contract Enforcement | DOCS-AOC-19-001 | DONE (2025-10-26) | Publish aggregation-only contract reference documentation. | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 19 — Aggregation-Only Contract Enforcement | DOCS-AOC-19-002 | DONE (2025-10-26) | Update architecture overview with AOC boundary diagrams. | Docs Guild, Architecture Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 19 — Aggregation-Only Contract Enforcement | DOCS-AOC-19-003 | DONE (2025-10-26) | Refresh policy engine doc with raw ingestion constraints. | Docs Guild, Policy Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 19 — Aggregation-Only Contract Enforcement | DOCS-AOC-19-004 | DONE (2025-10-26) | Document console AOC dashboard and drill-down flow. | Docs Guild, UI Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 19 — Aggregation-Only Contract Enforcement | DOCS-AOC-19-005 | DONE (2025-10-26) | Document CLI AOC commands and exit codes. | Docs Guild, CLI Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 19 — Aggregation-Only Contract Enforcement | DOCS-AOC-19-006 | DONE (2025-10-26) | Document new AOC metrics, traces, and logs. | Docs Guild, Observability Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 19 — Aggregation-Only Contract Enforcement | DOCS-AOC-19-007 | DONE (2025-10-26) | Document new Authority scopes and tenancy enforcement. | Docs Guild, Authority Core | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 19 — Aggregation-Only Contract Enforcement | DOCS-AOC-19-008 | DONE (2025-10-26) | Update deployment guide with validator enablement and verify user guidance. | Docs Guild, DevOps Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 19 — Aggregation-Only Contract Enforcement | AUTH-AOC-19-001 | DONE (2025-10-26) | Introduce new ingestion/auth scopes across Authority. | Authority Core & Security Guild | Path: src/Authority/StellaOps.Authority | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 20 — Policy Engine v2 | DOCS-POLICY-20-001 | DONE (2025-10-26) | Publish `/docs/policy/overview.md` with compliance checklist. | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 20 — Policy Engine v2 | DOCS-POLICY-20-002 | DONE (2025-10-26) | Document DSL grammar + examples in `/docs/policy/dsl.md`. | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 20 — Policy Engine v2 | DOCS-POLICY-20-003 | DONE (2025-10-26) | Write `/docs/policy/lifecycle.md` covering workflow + roles. | Docs Guild, Authority Core | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 20 — Policy Engine v2 | DOCS-POLICY-20-004 | DONE (2025-10-26) | Document policy run modes + cursors in `/docs/policy/runs.md`. | Docs Guild, Scheduler Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 20 — Policy Engine v2 | DOCS-POLICY-20-005 | DONE (2025-10-26) | Produce `/docs/api/policy.md` with endpoint schemas + errors. | Docs Guild, Platform Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 20 — Policy Engine v2 | DOCS-POLICY-20-006 | DONE (2025-10-26) | Author `/docs/modules/cli/guides/policy.md` with commands, exit codes, JSON output. | Docs Guild, CLI Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 20 — Policy Engine v2 | DOCS-POLICY-20-007 | DONE (2025-10-26) | Create `/docs/ui/policy-editor.md` covering editor, simulation, approvals. | Docs Guild, UI Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 20 — Policy Engine v2 | DOCS-POLICY-20-008 | DONE (2025-10-26) | Publish `/docs/modules/policy/architecture.md` with sequence diagrams. | Docs Guild, Architecture Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 20 — Policy Engine v2 | DOCS-POLICY-20-009 | DONE (2025-10-26) | Document metrics/traces/logs in `/docs/observability/policy.md`. | Docs Guild, Observability Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 20 — Policy Engine v2 | DOCS-POLICY-20-010 | DONE (2025-10-26) | Publish `/docs/security/policy-governance.md` for scopes + approvals. | Docs Guild, Security Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 20 — Policy Engine v2 | DOCS-POLICY-20-011 | DONE (2025-10-26) | Add example policies under `/docs/examples/policies/` with commentary. | Docs Guild, Policy Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 20 — Policy Engine v2 | DOCS-POLICY-20-012 | DONE (2025-10-26) | Draft `/docs/faq/policy-faq.md` covering conflicts, determinism, pitfalls. | Docs Guild, Support Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 20 — Policy Engine v2 | DEVOPS-POLICY-20-001 | DONE (2025-10-26) | Add DSL lint + compile checks to CI pipelines. | DevOps Guild | Path: ops/devops | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 20 — Policy Engine v2 | DEVOPS-POLICY-20-003 | DONE (2025-10-26) | Add determinism CI job diffing repeated policy runs. | DevOps Guild, QA Guild | Path: ops/devops | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 20 — Policy Engine v2 | SAMPLES-POLICY-20-001 | DONE (2025-10-26) | Commit baseline/serverless/internal-only policy samples + fixtures. | Samples Guild, Policy Guild | Path: samples | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 20 — Policy Engine v2 | SAMPLES-POLICY-20-002 | DONE (2025-10-26) | Produce simulation diff fixtures for UI/CLI tests. | Samples Guild, UI Guild | Path: samples | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 20 — Policy Engine v2 | AUTH-POLICY-20-001 | DONE (2025-10-26) | Add new policy scopes (`policy:*`, `findings:read`, `effective:write`). | Authority Core & Security Guild | Path: src/Authority/StellaOps.Authority | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 20 — Policy Engine v2 | AUTH-POLICY-20-002 | DONE (2025-10-26) | Enforce Policy Engine service identity and scope checks at gateway. | Authority Core & Security Guild | Path: src/Authority/StellaOps.Authority | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 20 — Policy Engine v2 | AUTH-POLICY-20-003 | DONE (2025-10-26) | Update Authority docs/config samples for policy scopes + workflows. | Authority Core & Docs Guild | Path: src/Authority/StellaOps.Authority | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 20 — Policy Engine v2 | BENCH-POLICY-20-001 | DONE (2025-10-26) | Create policy evaluation benchmark suite + baseline metrics. | Bench Guild, Policy Guild | Path: src/Bench/StellaOps.Bench | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 20 — Policy Engine v2 | POLICY-ENGINE-20-000 | DONE (2025-10-26) | Spin up new Policy Engine service host with DI bootstrap and Authority wiring. | Policy Guild, Platform Guild | Path: src/Policy/StellaOps.Policy.Engine | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 20 — Policy Engine v2 | POLICY-ENGINE-20-001 | DONE (2025-10-26) | Deliver `stella-dsl@1` parser + IR compiler with diagnostics and checksums. | Policy Guild | Path: src/Policy/StellaOps.Policy.Engine | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 20 — Policy Engine v2 | SCHED-MODELS-20-001 | DONE (2025-10-26) | Define policy run/diff DTOs + validation helpers. | Scheduler Models Guild | Path: src/Scheduler/__Libraries/StellaOps.Scheduler.Models | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 21 — Graph Explorer v1 | AUTH-GRAPH-21-001 | DONE (2025-10-26) | Introduce graph scopes (`graph:*`) with configuration binding and defaults. | Authority Core Guild | Path: src/Authority/StellaOps.Authority | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 21 — Graph Explorer v1 | AUTH-GRAPH-21-002 | DONE (2025-10-26) | Enforce graph scopes/identities at gateway with tenant propagation. | Authority Core Guild | Path: src/Authority/StellaOps.Authority | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 21 — Graph Explorer v1 | AUTH-GRAPH-21-003 | DONE (2025-10-26) | Update security docs/config samples for graph access and least privilege. | Authority Core & Docs Guild | Path: src/Authority/StellaOps.Authority | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 21 — Graph Explorer v1 | SCHED-MODELS-21-001 | DONE (2025-10-26) | Define job DTOs for graph builds/overlay refresh (`GraphBuildJob`, `GraphOverlayJob`) with deterministic serialization and status enums; document in `src/Scheduler/__Libraries/StellaOps.Scheduler.Models/docs/SCHED-MODELS-21-001-GRAPH-JOBS.md`. | Scheduler Models Guild | Path: src/Scheduler/__Libraries/StellaOps.Scheduler.Models | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 21 — Graph Explorer v1 | SCHED-MODELS-21-002 | DONE (2025-10-26) | Publish schema docs/sample payloads for graph job lifecycle. | Scheduler Models Guild | Path: src/Scheduler/__Libraries/StellaOps.Scheduler.Models | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 22 — Link-Not-Merge v1 | BENCH-LNM-22-001 | DONE (2025-10-26) | Benchmark advisory observation ingest/correlation throughput. | Bench Guild | Path: src/Bench/StellaOps.Bench | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 22 — Link-Not-Merge v1 | BENCH-LNM-22-002 | DONE (2025-10-26) | Benchmark VEX ingest/correlation latency and event emission. | Bench Guild | Path: src/Bench/StellaOps.Bench | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 23 — StellaOps Console | DOCS-CONSOLE-23-001 | DONE (2025-10-26) | Publish `/docs/ui/console-overview.md` (IA, tenant model, filters, AOC alignment). | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 23 — StellaOps Console | DOCS-CONSOLE-23-002 | DONE (2025-10-26) | Author `/docs/ui/navigation.md` with route map, filters, keyboard shortcuts, deep links. | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 23 — StellaOps Console | DOCS-CONSOLE-23-003 | DONE (2025-10-26) | Document `/docs/ui/sbom-explorer.md` covering catalog, graph, overlays, exports. | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 23 — StellaOps Console | DOCS-CONSOLE-23-004 | DONE (2025-10-26) | Produce `/docs/ui/advisories-and-vex.md` detailing aggregation-not-merge UX. | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 23 — StellaOps Console | DOCS-CONSOLE-23-005 | DONE (2025-10-26) | Write `/docs/ui/findings.md` with filters, explain, exports, CLI parity notes. | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 23 — StellaOps Console | DOCS-CONSOLE-23-006 | DONE (2025-10-26) | Publish `/docs/ui/policies.md` (editor, simulation, approvals, RBAC). | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 23 — StellaOps Console | DOCS-CONSOLE-23-007 | DONE (2025-10-26) | Document `/docs/ui/runs.md` with SSE monitoring, diff, retries, evidence downloads. | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 23 — StellaOps Console | DOCS-CONSOLE-23-008 | DONE (2025-10-26) | Draft `/docs/ui/admin.md` covering tenants, roles, tokens, integrations, fresh-auth. | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 23 — StellaOps Console | DOCS-CONSOLE-23-009 | DONE (2025-10-27) | Publish `/docs/ui/downloads.md` aligning manifest with commands and offline flow. | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 23 — StellaOps Console | DOCS-CONSOLE-23-010 | DONE (2025-10-27) | Write `/docs/deploy/console.md` (Helm, ingress, TLS, env vars, health checks). | Docs Guild, Deployment Guild, Console Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 28 — Graph Explorer | SCHED-WEB-21-001 | DONE (2025-10-26) | Provide graph build/overlay job APIs; see `docs/SCHED-WEB-21-001-GRAPH-APIS.md`. | Scheduler WebService Guild | Path: src/Scheduler/StellaOps.Scheduler.WebService | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 28 — Graph Explorer | SCHED-WEB-21-002 | DONE (2025-10-26) | Provide overlay lag metrics endpoint/webhook; see `docs/SCHED-WEB-21-001-GRAPH-APIS.md`. | Scheduler WebService Guild | Path: src/Scheduler/StellaOps.Scheduler.WebService | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 28 — Graph Explorer | SCHED-WEB-21-003 | DONE (2025-10-26) | Replace header auth with Authority scopes using `StellaOpsScopes`; dev fallback only when `Scheduler:Authority:Enabled=false`. | Scheduler WebService Guild, Authority Core Guild | Path: src/Scheduler/StellaOps.Scheduler.WebService | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 50 — Observability & Forensics Phase 1 – Baseline Telemetry | DEVOPS-OBS-50-001 | DONE (2025-10-26) | Deploy default OpenTelemetry collector manifests with secure OTLP pipeline. | DevOps Guild | Path: ops/devops | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 50 — Observability & Forensics Phase 1 – Baseline Telemetry | DEVOPS-OBS-50-003 | DONE (2025-10-26) | Package telemetry stack configs for offline/air-gapped installs with signatures. | DevOps Guild | Path: ops/devops | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 16 — Scheduler Intelligence | SCHED-WEB-16-101 | DONE (2025-10-27) | Minimal API host with Authority enforcement. | Scheduler WebService Guild | Path: src/Scheduler/StellaOps.Scheduler.WebService | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 16 — Scheduler Intelligence | SCHED-WORKER-16-202 | DONE (2025-10-27) | ImpactIndex targeting and shard planning. | Scheduler Worker Guild | Path: src/Scheduler/__Libraries/StellaOps.Scheduler.Worker | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | --- — --- | --- | --- | --- | --- | Path: --- | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 16 — Scheduler Intelligence | SCHED-WORKER-16-203 | DONE (2025-10-27) | Runner execution invoking Scanner analysis/content refresh. | Scheduler Worker Guild | Path: src/Scheduler/__Libraries/StellaOps.Scheduler.Worker | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 16 — Scheduler Intelligence | SCHED-WORKER-16-204 | DONE (2025-10-27) | Emit rescan/report events for Notify/UI. | Scheduler Worker Guild | Path: src/Scheduler/__Libraries/StellaOps.Scheduler.Worker | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 16 — Scheduler Intelligence | SCHED-WORKER-16-205 | DONE (2025-10-27) | Metrics/telemetry for Scheduler planners/runners. | Scheduler Worker Guild | Path: src/Scheduler/__Libraries/StellaOps.Scheduler.Worker | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 19 — Aggregation-Only Contract Enforcement | AUTH-AOC-19-002 | DONE (2025-10-27) | Enforce tenant claim propagation and cross-tenant guardrails. | Authority Core & Security Guild | Path: src/Authority/StellaOps.Authority | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 19 — Aggregation-Only Contract Enforcement | AUTH-AOC-19-003 | DONE (2025-10-27) | Update Authority docs/config samples for new scopes. | Authority Core & Docs Guild | Path: src/Authority/StellaOps.Authority | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 19 — Aggregation-Only Contract Enforcement | CONCELIER-WEB-AOC-19-001 | DONE (2025-10-28) | Implement raw advisory ingestion endpoints with AOC guard and verifier. | Concelier WebService Guild | Path: src/Concelier/StellaOps.Concelier.WebService | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 19 — Aggregation-Only Contract Enforcement | EXCITITOR-WORKER-AOC-19-003 | DONE (2025-10-28) | Expand worker tests for deterministic batching and restart safety. | QA Guild | Path: src/Excititor/StellaOps.Excititor.Worker | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 20 — Policy Engine v2 | DEVOPS-POLICY-20-004 | DONE (2025-10-27) | Automate policy schema exports and change notifications for CLI consumers. | DevOps Guild, Scheduler Guild, CLI Guild | Path: ops/devops | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 20 — Policy Engine v2 | CLI-POLICY-20-002 | DONE (2025-10-27) | Implement `stella policy simulate` with diff outputs + exit codes. | DevEx/CLI Guild | Path: src/Cli/StellaOps.Cli | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 21 — Graph Explorer v1 | CARTO-GRAPH-21-010 | DONE (2025-10-27) | Replace hard-coded `graph:*` scope strings with shared constants once graph services integrate. | Cartographer Guild | Path: src/Cartographer/StellaOps.Cartographer | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 21 — Graph Explorer v1 | SCHED-WEB-21-002 | DONE (2025-10-26) | Expose overlay lag metrics and job completion hooks for Cartographer. | Scheduler WebService Guild | Path: src/Scheduler/StellaOps.Scheduler.WebService | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 23 — StellaOps Console | DOCS-CONSOLE-23-011 | DONE (2025-10-28) | Update `/docs/install/docker.md` to include console image, compose/Helm/offline examples. | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 23 — StellaOps Console | DOCS-CONSOLE-23-012 | DONE (2025-10-28) | Publish `/docs/security/console-security.md` covering OIDC, scopes, CSP, evidence handling. | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 23 — StellaOps Console | DOCS-CONSOLE-23-013 | DONE (2025-10-28) | Write `/docs/observability/ui-telemetry.md` cataloguing metrics/logs/dashboards/alerts. | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 23 — StellaOps Console | DOCS-CONSOLE-23-014 | DONE (2025-10-28) | Maintain `/docs/cli-vs-ui-parity.md` matrix with CI drift detection guidance. | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 23 — StellaOps Console | DOCS-CONSOLE-23-016 | DONE (2025-10-28) | Refresh `/docs/accessibility.md` with console keyboard flows, tokens, testing tools.
2025-10-28: Published guide covering keyboard matrix, screen-reader behaviour, colour tokens, testing workflow, offline guidance, and compliance checklist. | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 25 — Exceptions v1 | DOCS-EXC-25-004 | DONE (2025-10-27) | Document policy exception effects + simulation. | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 25 — Exceptions v1 | POLICY-ENGINE-70-001 | DONE (2025-10-27) | Add exception evaluation layer with specificity + effects. | Policy Guild | Path: src/Policy/StellaOps.Policy.Engine | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 25 — Exceptions v1 | POLICY-EXC-25-001 | DONE (2025-10-27) | Extend SPL schema to reference exception effects and routing. | Policy Guild | Path: src/Policy/__Libraries/StellaOps.Policy | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | --- — --- | --- | --- | --- | --- | Path: --- | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 16 — Scheduler Intelligence | SCHED-WORKER-16-201 | DOING (2025-10-27) | Planner loop (cron/event triggers, leases, fairness). | Scheduler Worker Guild | Path: src/Scheduler/__Libraries/StellaOps.Scheduler.Worker | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 17 — Symbol Intelligence & Forensics | DEVOPS-OFFLINE-17-004 | BLOCKED (2025-10-26) | Run mirror_debug_store.py once release artefacts exist and archive verification evidence with the Offline Kit. | Offline Kit Guild, DevOps Guild | Path: ops/offline-kit | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 17 — Symbol Intelligence & Forensics | DEVOPS-REL-17-004 | BLOCKED (2025-10-26) | Ensure release workflow publishes `out/release/debug` (build-id tree + manifest) and fails when symbols are missing. | DevOps Guild | Path: ops/devops | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 19 — Aggregation-Only Contract Enforcement | DEVOPS-AOC-19-001 | BLOCKED (2025-10-26) | Integrate AOC analyzer/guard enforcement into CI pipelines. | DevOps Guild, Platform Guild | Path: ops/devops | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 19 — Aggregation-Only Contract Enforcement | DEVOPS-AOC-19-002 | BLOCKED (2025-10-26) | Add CI stage running `stella aoc verify` against seeded snapshots. | DevOps Guild | Path: ops/devops | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 19 — Aggregation-Only Contract Enforcement | DEVOPS-AOC-19-003 | BLOCKED (2025-10-26) | Enforce guard coverage thresholds and export metrics to dashboards. | DevOps Guild, QA Guild | Path: ops/devops | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 19 — Aggregation-Only Contract Enforcement | CLI-AOC-19-001 | DOING (2025-10-27) | Implement `stella sources ingest --dry-run` command. | DevEx/CLI Guild | Path: src/Cli/StellaOps.Cli | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 19 — Aggregation-Only Contract Enforcement | CLI-AOC-19-002 | TODO | Implement `stella aoc verify` command with exit codes. | DevEx/CLI Guild | Path: src/Cli/StellaOps.Cli | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 19 — Aggregation-Only Contract Enforcement | CLI-AOC-19-003 | TODO | Update CLI reference and quickstart docs for new AOC commands. | Docs/CLI Guild | Path: src/Cli/StellaOps.Cli | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 19 — Aggregation-Only Contract Enforcement | CONCELIER-CORE-AOC-19-001 | TODO | Implement AOC repository guard rejecting forbidden fields. | Concelier Core Guild | Path: src/Concelier/__Libraries/StellaOps.Concelier.Core | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 19 — Aggregation-Only Contract Enforcement | CONCELIER-CORE-AOC-19-002 | TODO | Deliver deterministic linkset extraction for advisories. | Concelier Core Guild | Path: src/Concelier/__Libraries/StellaOps.Concelier.Core | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 19 — Aggregation-Only Contract Enforcement | CONCELIER-CORE-AOC-19-003 | TODO | Enforce idempotent append-only upsert with supersedes pointers. | Concelier Core Guild | Path: src/Concelier/__Libraries/StellaOps.Concelier.Core | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 19 — Aggregation-Only Contract Enforcement | CONCELIER-CORE-AOC-19-004 | DOING (2025-10-28) | Remove ingestion normalization; defer derived logic to Policy Engine. | Concelier Core Guild | Path: src/Concelier/__Libraries/StellaOps.Concelier.Core | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 19 — Aggregation-Only Contract Enforcement | CONCELIER-CORE-AOC-19-013 | TODO | Extend smoke coverage to validate tenant-scoped Authority tokens and cross-tenant rejection. | Concelier Core Guild | Path: src/Concelier/__Libraries/StellaOps.Concelier.Core | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 19 — Aggregation-Only Contract Enforcement | CONCELIER-STORE-AOC-19-001 | TODO | Add Mongo schema validator for `advisory_raw`. | Concelier Storage Guild | Path: src/Concelier/__Libraries/StellaOps.Concelier.Storage.Mongo | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 19 — Aggregation-Only Contract Enforcement | CONCELIER-STORE-AOC-19-002 | TODO | Create idempotency unique index backed by migration scripts. | Concelier Storage Guild | Path: src/Concelier/__Libraries/StellaOps.Concelier.Storage.Mongo | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 19 — Aggregation-Only Contract Enforcement | CONCELIER-STORE-AOC-19-003 | TODO | Deliver append-only migration/backfill plan with supersedes chaining. | Concelier Storage Guild | Path: src/Concelier/__Libraries/StellaOps.Concelier.Storage.Mongo | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 19 — Aggregation-Only Contract Enforcement | CONCELIER-STORE-AOC-19-004 | TODO | Document validator deployment steps for online/offline clusters. | Concelier Storage Guild, DevOps Guild | Path: src/Concelier/__Libraries/StellaOps.Concelier.Storage.Mongo | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 19 — Aggregation-Only Contract Enforcement | CONCELIER-WEB-AOC-19-002 | TODO | Emit AOC observability metrics, traces, and structured logs. | Concelier WebService Guild, Observability Guild | Path: src/Concelier/StellaOps.Concelier.WebService | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 19 — Aggregation-Only Contract Enforcement | CONCELIER-WEB-AOC-19-003 | TODO | Add schema/guard unit tests covering AOC error codes. | QA Guild | Path: src/Concelier/StellaOps.Concelier.WebService | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 19 — Aggregation-Only Contract Enforcement | CONCELIER-WEB-AOC-19-004 | TODO | Build integration suite validating deterministic ingest under load. | Concelier WebService Guild, QA Guild | Path: src/Concelier/StellaOps.Concelier.WebService | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 19 — Aggregation-Only Contract Enforcement | EXCITITOR-CORE-AOC-19-001 | TODO | Introduce VEX repository guard enforcing AOC invariants. | Excititor Core Guild | Path: src/Excititor/__Libraries/StellaOps.Excititor.Core | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 19 — Aggregation-Only Contract Enforcement | EXCITITOR-CORE-AOC-19-002 | TODO | Build deterministic VEX linkset extraction. | Excititor Core Guild | Path: src/Excititor/__Libraries/StellaOps.Excititor.Core | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 19 — Aggregation-Only Contract Enforcement | EXCITITOR-CORE-AOC-19-003 | TODO | Enforce append-only idempotent VEX raw upserts. | Excititor Core Guild | Path: src/Excititor/__Libraries/StellaOps.Excititor.Core | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 19 — Aggregation-Only Contract Enforcement | EXCITITOR-CORE-AOC-19-004 | TODO | Remove ingestion consensus logic; rely on Policy Engine. | Excititor Core Guild | Path: src/Excititor/__Libraries/StellaOps.Excititor.Core | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 19 — Aggregation-Only Contract Enforcement | EXCITITOR-CORE-AOC-19-013 | TODO | Update smoke suites to enforce tenant-scoped Authority tokens and cross-tenant VEX rejection. | Excititor Core Guild | Path: src/Excititor/__Libraries/StellaOps.Excititor.Core | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 19 — Aggregation-Only Contract Enforcement | EXCITITOR-STORE-AOC-19-001 | TODO | Add Mongo schema validator for `vex_raw`. | Excititor Storage Guild | Path: src/Excititor/__Libraries/StellaOps.Excititor.Storage.Mongo | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 19 — Aggregation-Only Contract Enforcement | EXCITITOR-STORE-AOC-19-002 | TODO | Create idempotency unique index for VEX raw documents. | Excititor Storage Guild | Path: src/Excititor/__Libraries/StellaOps.Excititor.Storage.Mongo | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 19 — Aggregation-Only Contract Enforcement | EXCITITOR-STORE-AOC-19-003 | TODO | Deliver append-only migration/backfill for VEX raw collections. | Excititor Storage Guild | Path: src/Excititor/__Libraries/StellaOps.Excititor.Storage.Mongo | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 19 — Aggregation-Only Contract Enforcement | EXCITITOR-STORE-AOC-19-004 | TODO | Document validator deployment for Excititor clusters/offline kit. | Excititor Storage Guild, DevOps Guild | Path: src/Excititor/__Libraries/StellaOps.Excititor.Storage.Mongo | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 19 — Aggregation-Only Contract Enforcement | EXCITITOR-WEB-AOC-19-001 | TODO | Implement raw VEX ingestion and AOC verifier endpoints. | Excititor WebService Guild | Path: src/Excititor/StellaOps.Excititor.WebService | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 19 — Aggregation-Only Contract Enforcement | EXCITITOR-WEB-AOC-19-002 | TODO | Emit AOC metrics/traces/logging for Excititor ingestion. | Excititor WebService Guild, Observability Guild | Path: src/Excititor/StellaOps.Excititor.WebService | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 19 — Aggregation-Only Contract Enforcement | EXCITITOR-WEB-AOC-19-003 | TODO | Add AOC guard test harness for VEX schemas. | QA Guild | Path: src/Excititor/StellaOps.Excititor.WebService | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 19 — Aggregation-Only Contract Enforcement | EXCITITOR-WEB-AOC-19-004 | TODO | Validate large VEX ingest runs and CLI verification parity. | Excititor WebService Guild, QA Guild | Path: src/Excititor/StellaOps.Excititor.WebService | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 41 — Surface Sharing Foundations | SURFACE-FS-01 | TODO | Author Surface.FS cache specification and cross-module contract. | Scanner Guild, Zastava Guild | Path: src/Scanner/__Libraries/StellaOps.Scanner.Surface.FS | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 41 — Surface Sharing Foundations | SURFACE-ENV-01 | TODO | Draft Surface.Env variable matrix for Scanner/Zastava deployments. | Scanner Guild, Ops Guild, Zastava Guild | Path: src/Scanner/__Libraries/StellaOps.Scanner.Surface.Env | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 41 — Surface Sharing Foundations | SURFACE-SECRETS-01 | TODO | Define Surface.Secrets schema and rotation guidance. | Scanner Guild, Security Guild, Zastava Guild | Path: src/Scanner/__Libraries/StellaOps.Scanner.Surface.Secrets | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 41 — Surface Sharing Foundations | SURFACE-VAL-01 | TODO | Design validator framework for shared Surface checks and extensibility. | Scanner Guild, Security Guild | Path: src/Scanner/__Libraries/StellaOps.Scanner.Surface.Validation | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 19 — Aggregation-Only Contract Enforcement | EXCITITOR-WORKER-AOC-19-001 | TODO | Rewire worker to persist raw VEX docs with guard enforcement. | Excititor Worker Guild | Path: src/Excititor/StellaOps.Excititor.Worker | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 19 — Aggregation-Only Contract Enforcement | EXCITITOR-WORKER-AOC-19-002 | TODO | Enforce signature/checksum verification prior to raw writes. | Excititor Worker Guild | Path: src/Excititor/StellaOps.Excititor.Worker | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 19 — Aggregation-Only Contract Enforcement | POLICY-AOC-19-001 | TODO | Add lint preventing ingestion modules from referencing Policy-only helpers. | Policy Guild | Path: src/Policy/__Libraries/StellaOps.Policy | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 19 — Aggregation-Only Contract Enforcement | POLICY-AOC-19-002 | TODO | Enforce Policy-only writes to `effective_finding_*` collections. | Policy Guild, Security Guild | Path: src/Policy/__Libraries/StellaOps.Policy | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 19 — Aggregation-Only Contract Enforcement | POLICY-AOC-19-003 | TODO | Update Policy readers to consume only raw document fields. | Policy Guild | Path: src/Policy/__Libraries/StellaOps.Policy | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 19 — Aggregation-Only Contract Enforcement | POLICY-AOC-19-004 | TODO | Add determinism tests for raw-driven policy recomputation. | Policy Guild, QA Guild | Path: src/Policy/__Libraries/StellaOps.Policy | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 19 — Aggregation-Only Contract Enforcement | UI-AOC-19-001 | TODO | Add Sources dashboard tiles surfacing AOC status and violations. | UI Guild | Path: src/UI/StellaOps.UI | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 19 — Aggregation-Only Contract Enforcement | UI-AOC-19-002 | TODO | Build violation drill-down view for offending documents. | UI Guild | Path: src/UI/StellaOps.UI | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 19 — Aggregation-Only Contract Enforcement | UI-AOC-19-003 | TODO | Wire "Verify last 24h" action and CLI parity messaging. | UI Guild | Path: src/UI/StellaOps.UI | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 19 — Aggregation-Only Contract Enforcement | WEB-AOC-19-001 | DOING (2025-10-26) | Provide shared AOC forbidden key set and guard middleware. | BE-Base Platform Guild | Path: src/Web/StellaOps.Web | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 19 — Aggregation-Only Contract Enforcement | WEB-AOC-19-002 | TODO | Ship provenance builder and signature helpers for ingestion services. | BE-Base Platform Guild | Path: src/Web/StellaOps.Web | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 19 — Aggregation-Only Contract Enforcement | WEB-AOC-19-003 | TODO | Author analyzer + shared test fixtures for guard compliance. | BE-Base Platform Guild, QA Guild | Path: src/Web/StellaOps.Web | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 20 — Policy Engine v2 | DEVOPS-POLICY-20-002 | BLOCKED (waiting on POLICY-ENGINE-20-006) | Run `stella policy simulate` CI stage against golden SBOMs. | DevOps Guild | Path: ops/devops | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 20 — Policy Engine v2 | BENCH-POLICY-20-002 | BLOCKED (waiting on SCHED-WORKER-20-302) | Add incremental run benchmark capturing delta SLA compliance. | Bench Guild, Scheduler Guild | Path: src/Bench/StellaOps.Bench | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 20 — Policy Engine v2 | CLI-POLICY-20-003 | TODO | Extend `stella findings` commands with policy filters and explain view. | DevEx/CLI Guild, Docs Guild | Path: src/Cli/StellaOps.Cli | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 20 — Policy Engine v2 | CONCELIER-POLICY-20-002 | TODO | Strengthen linkset builders with equivalence tables + range parsing. | Concelier Core Guild | Path: src/Concelier/__Libraries/StellaOps.Concelier.Core | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 20 — Policy Engine v2 | CONCELIER-POLICY-20-003 | TODO | Add advisory selection cursors + change-stream checkpoints for policy runs. | Concelier Storage Guild | Path: src/Concelier/__Libraries/StellaOps.Concelier.Storage.Mongo | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 20 — Policy Engine v2 | CONCELIER-POLICY-20-001 | TODO | Provide advisory selection endpoints for policy engine (batch PURL/ID). | Concelier WebService Guild | Path: src/Concelier/StellaOps.Concelier.WebService | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 20 — Policy Engine v2 | EXCITITOR-POLICY-20-002 | TODO | Enhance VEX linkset scope + version resolution for policy accuracy. | Excititor Core Guild | Path: src/Excititor/__Libraries/StellaOps.Excititor.Core | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 20 — Policy Engine v2 | EXCITITOR-POLICY-20-003 | TODO | Introduce VEX selection cursors + change-stream checkpoints. | Excititor Storage Guild | Path: src/Excititor/__Libraries/StellaOps.Excititor.Storage.Mongo | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 20 — Policy Engine v2 | EXCITITOR-POLICY-20-001 | TODO | Ship VEX selection APIs aligned with policy join requirements. | Excititor WebService Guild | Path: src/Excititor/StellaOps.Excititor.WebService | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 20 — Policy Engine v2 | POLICY-ENGINE-20-002 | BLOCKED (2025-10-26) | Implement deterministic rule evaluator with priority/first-match semantics. | Policy Guild | Path: src/Policy/StellaOps.Policy.Engine | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 20 — Policy Engine v2 | POLICY-ENGINE-20-003 | TODO | Build SBOM↔advisory↔VEX linkset joiners with deterministic batching. | Policy Guild, Concelier Core, Excititor Core | Path: src/Policy/StellaOps.Policy.Engine | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 20 — Policy Engine v2 | POLICY-ENGINE-20-004 | TODO | Materialize effective findings with append-only history and tenant scoping. | Policy Guild, Storage Guild | Path: src/Policy/StellaOps.Policy.Engine | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 20 — Policy Engine v2 | POLICY-ENGINE-20-005 | TODO | Enforce determinism guard banning wall-clock, RNG, and network usage. | Policy Guild, Security Guild | Path: src/Policy/StellaOps.Policy.Engine | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 20 — Policy Engine v2 | POLICY-ENGINE-20-006 | TODO | Implement incremental orchestrator reacting to change streams. | Policy Guild, Scheduler Guild | Path: src/Policy/StellaOps.Policy.Engine | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 20 — Policy Engine v2 | POLICY-ENGINE-20-007 | TODO | Emit policy metrics, traces, and sampled rule-hit logs. | Policy Guild, Observability Guild | Path: src/Policy/StellaOps.Policy.Engine | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 20 — Policy Engine v2 | POLICY-ENGINE-20-008 | TODO | Add unit/property/golden/perf suites verifying determinism + SLA. | Policy Guild, QA Guild | Path: src/Policy/StellaOps.Policy.Engine | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 20 — Policy Engine v2 | POLICY-ENGINE-20-009 | TODO | Define Mongo schemas/indexes + migrations for policies/runs/findings. | Policy Guild, Storage Guild | Path: src/Policy/StellaOps.Policy.Engine | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 20 — Policy Engine v2 | SCHED-MODELS-20-002 | TODO | Update schema docs with policy run lifecycle samples. | Scheduler Models Guild | Path: src/Scheduler/__Libraries/StellaOps.Scheduler.Models | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 20 — Policy Engine v2 | SCHED-WEB-20-001 | TODO | Expose policy run scheduling APIs with scope enforcement. | Scheduler WebService Guild | Path: src/Scheduler/StellaOps.Scheduler.WebService | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 20 — Policy Engine v2 | SCHED-WEB-20-002 | TODO | Provide simulation trigger endpoint returning diff metadata. | Scheduler WebService Guild | Path: src/Scheduler/StellaOps.Scheduler.WebService | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 20 — Policy Engine v2 | SCHED-WORKER-20-301 | TODO | Schedule policy runs via API with idempotent job tracking. | Scheduler Worker Guild | Path: src/Scheduler/__Libraries/StellaOps.Scheduler.Worker | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 20 — Policy Engine v2 | SCHED-WORKER-20-302 | TODO | Implement delta targeting leveraging change streams + policy metadata. | Scheduler Worker Guild | Path: src/Scheduler/__Libraries/StellaOps.Scheduler.Worker | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 20 — Policy Engine v2 | SCHED-WORKER-20-303 | TODO | Expose policy scheduling metrics/logs with policy/run identifiers. | Scheduler Worker Guild, Observability Guild | Path: src/Scheduler/__Libraries/StellaOps.Scheduler.Worker | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 20 — Policy Engine v2 | UI-POLICY-20-001 | TODO | Ship Monaco-based policy editor with inline diagnostics + checklists. | UI Guild | Path: src/UI/StellaOps.UI | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 20 — Policy Engine v2 | UI-POLICY-20-002 | TODO | Build simulation panel with deterministic diff rendering + virtualization. | UI Guild | Path: src/UI/StellaOps.UI | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 20 — Policy Engine v2 | UI-POLICY-20-003 | TODO | Implement submit/review/approve workflow with RBAC + audit trail. | UI Guild, Product Ops | Path: src/UI/StellaOps.UI | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 20 — Policy Engine v2 | UI-POLICY-20-004 | TODO | Add run dashboards (heatmap/VEX wins/suppressions) with export. | UI Guild, Observability Guild | Path: src/UI/StellaOps.UI | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 20 — Policy Engine v2 | WEB-POLICY-20-001 | TODO | Implement Policy CRUD/compile/run/simulate/findings/explain endpoints. | BE-Base Platform Guild | Path: src/Web/StellaOps.Web | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 20 — Policy Engine v2 | WEB-POLICY-20-002 | TODO | Add pagination, filters, deterministic ordering to policy listings. | BE-Base Platform Guild | Path: src/Web/StellaOps.Web | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 20 — Policy Engine v2 | WEB-POLICY-20-003 | TODO | Map engine errors to `ERR_POL_*` responses with contract tests. | BE-Base Platform Guild, QA Guild | Path: src/Web/StellaOps.Web | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 20 — Policy Engine v2 | WEB-POLICY-20-004 | TODO | Introduce rate limits/quotas + metrics for simulation endpoints. | Platform Reliability Guild | Path: src/Web/StellaOps.Web | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 21 — Graph Explorer v1 | BENCH-GRAPH-21-001 | BLOCKED (2025-10-27) | Graph viewport/path perf harness (50k/100k nodes) measuring Graph API/Indexer latency and cache hit rates. Executed within Sprint 28 Graph program. Upstream Graph API/indexer contracts (`GRAPH-API-28-003`, `GRAPH-INDEX-28-006`) still pending, so benchmarks cannot target stable endpoints yet. | Bench Guild, Graph Platform Guild | Path: src/Bench/StellaOps.Bench | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 21 — Graph Explorer v1 | BENCH-GRAPH-21-002 | BLOCKED (2025-10-27) | Headless UI load benchmark for graph canvas interactions (Playwright) tracking render FPS budgets. Executed within Sprint 28 Graph program. Depends on BENCH-GRAPH-21-001 and UI Graph Explorer (`UI-GRAPH-24-001`), both pending. | Bench Guild, UI Guild | Path: src/Bench/StellaOps.Bench | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 21 — Graph Explorer v1 | CONCELIER-GRAPH-21-001 | DONE (2025-11-18) | Enrich SBOM normalization with relationships, scopes, entrypoint annotations for Cartographer. Schema frozen 2025-11-17; fixtures + acceptance tests committed. | Concelier Core Guild | Path: src/Concelier/__Libraries/StellaOps.Concelier.Core | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 21 — Graph Explorer v1 | CONCELIER-GRAPH-21-002 | DONE (2025-11-22) | Publish SBOM change events with tenant metadata for graph builds. Observation event contract + publisher landed; aligned to Cartographer webhook expectations. | Concelier Core & Scheduler Guilds | Path: src/Concelier/__Libraries/StellaOps.Concelier.Core | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 21 — Graph Explorer v1 | EXCITITOR-GRAPH-21-001 | BLOCKED (2025-10-27) | Deliver batched VEX/advisory fetch helpers for inspector linkouts. Waiting on linkset enrichment (`EXCITITOR-POLICY-20-002`) and Cartographer inspector contract (`CARTO-GRAPH-21-005`). | Excititor Core Guild | Path: src/Excititor/__Libraries/StellaOps.Excititor.Core | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 21 — Graph Explorer v1 | EXCITITOR-GRAPH-21-002 | BLOCKED (2025-10-27) | Enrich overlay metadata with VEX justification summaries for graph overlays. Depends on `EXCITITOR-GRAPH-21-001` and Policy overlay schema (`POLICY-ENGINE-30-001`). | Excititor Core Guild | Path: src/Excititor/__Libraries/StellaOps.Excititor.Core | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 21 — Graph Explorer v1 | EXCITITOR-GRAPH-21-005 | BLOCKED (2025-10-27) | Create indexes/materialized views for VEX lookups by PURL/policy. Awaiting access pattern specs from `EXCITITOR-GRAPH-21-001`. | Excititor Storage Guild | Path: src/Excititor/__Libraries/StellaOps.Excititor.Storage.Mongo | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 21 — Graph Explorer v1 | SBOM-SERVICE-21-001 | DOING (2025-11-23) | Expose normalized SBOM projection API with relationships, scopes, entrypoints. Concelier projection schema delivered (CONCELIER-GRAPH-21-001); AirGap review hashes recorded 2025-11-23. | SBOM Service Guild | Path: src/SbomService/StellaOps.SbomService | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 21 — Graph Explorer v1 | SBOM-SERVICE-21-002 | BLOCKED (2025-10-27) | Emit SBOM version change events for Cartographer build queue. Depends on SBOM projection API (`SBOM-SERVICE-21-001`) and Scheduler contracts. | SBOM Service & Scheduler Guilds | Path: src/SbomService/StellaOps.SbomService | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 21 — Graph Explorer v1 | SBOM-SERVICE-21-003 | BLOCKED (2025-10-27) | Provide entrypoint management API with tenant overrides. Blocked by SBOM projection API contract. | SBOM Service Guild | Path: src/SbomService/StellaOps.SbomService | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 21 — Graph Explorer v1 | SBOM-SERVICE-21-004 | BLOCKED (2025-10-27) | Add metrics/traces/logs for SBOM projections. Requires projection pipeline from `SBOM-SERVICE-21-001`. | SBOM Service & Observability Guilds | Path: src/SbomService/StellaOps.SbomService | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 21 — Graph Explorer v1 | WEB-GRAPH-21-001 | BLOCKED (2025-10-27) | Add gateway routes for graph APIs with scope enforcement and streaming. Upstream Graph API (`GRAPH-API-28-003`) and Authority scope work (`AUTH-VULN-24-001`) pending. | BE-Base Platform Guild | Path: src/Web/StellaOps.Web | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 21 — Graph Explorer v1 | WEB-GRAPH-21-002 | BLOCKED (2025-10-27) | Implement bbox/zoom/path validation and pagination for graph endpoints. Depends on core proxy routes. | BE-Base Platform Guild | Path: src/Web/StellaOps.Web | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 21 — Graph Explorer v1 | WEB-GRAPH-21-003 | BLOCKED (2025-10-27) | Map graph errors to `ERR_Graph_*` and support export streaming. Requires `WEB-GRAPH-21-001`. | BE-Base Platform & QA Guilds | Path: src/Web/StellaOps.Web | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 21 — Graph Explorer v1 | WEB-GRAPH-21-004 | BLOCKED (2025-10-27) | Wire Policy Engine simulation overlays into graph responses. Waiting on Graph routes and Policy overlay schema (`POLICY-ENGINE-30-002`). | BE-Base & Policy Guilds | Path: src/Web/StellaOps.Web | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 22 — Link-Not-Merge v1 | DOCS-LNM-22-001 | BLOCKED (2025-10-27) | Publish advisories aggregation doc with observation/linkset philosophy. | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 22 — Link-Not-Merge v1 | DOCS-LNM-22-002 | BLOCKED (2025-10-27) | Publish VEX aggregation doc describing observation/linkset flow. | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 22 — Link-Not-Merge v1 | DOCS-LNM-22-005 | BLOCKED (2025-10-27) | Document UI evidence panel with conflict badges/AOC drill-down. | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 22 — Link-Not-Merge v1 | DEVOPS-LNM-22-001 | BLOCKED (2025-10-27) | Execute advisory observation/linkset migration/backfill and automation. | DevOps Guild | Path: ops/devops | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 22 — Link-Not-Merge v1 | DEVOPS-LNM-22-002 | BLOCKED (2025-10-27) | Run VEX observation/linkset migration/backfill with monitoring/runbook. | DevOps Guild | Path: ops/devops | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 22 — Link-Not-Merge v1 | SAMPLES-LNM-22-001 | BLOCKED (2025-10-27) | Add advisory observation/linkset fixtures with conflicts. | Samples Guild | Path: samples | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 22 — Link-Not-Merge v1 | SAMPLES-LNM-22-002 | BLOCKED (2025-10-27) | Add VEX observation/linkset fixtures with status disagreements. | Samples Guild | Path: samples | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 22 — Link-Not-Merge v1 | AUTH-AOC-22-001 | TODO | Roll out new advisory/vex ingest/read scopes. | Authority Core Guild | Path: src/Authority/StellaOps.Authority | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 22 — Link-Not-Merge v1 | CLI-LNM-22-001 | TODO | Implement advisory observation/linkset CLI commands with JSON/OSV export. | DevEx/CLI Guild | Path: src/Cli/StellaOps.Cli | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 22 — Link-Not-Merge v1 | CLI-LNM-22-002 | TODO | Implement VEX observation/linkset CLI commands. | DevEx/CLI Guild | Path: src/Cli/StellaOps.Cli | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 22 — Link-Not-Merge v1 | CONCELIER-LNM-21-001 | TODO | Define immutable advisory observation schema with AOC metadata. | Concelier Core Guild | Path: src/Concelier/__Libraries/StellaOps.Concelier.Core | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 22 — Link-Not-Merge v1 | CONCELIER-LNM-21-002 | TODO | Implement advisory linkset builder with correlation signals/conflicts. | Concelier Core Guild, Data Science Guild | Path: src/Concelier/__Libraries/StellaOps.Concelier.Core | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 22 — Link-Not-Merge v1 | MERGE-LNM-21-002 | TODO | Deprecate merge service and enforce observation-only pipeline. | BE-Merge | Path: src/Concelier/__Libraries/StellaOps.Concelier.Merge | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 22 — Link-Not-Merge v1 | CONCELIER-LNM-21-101 | TODO | Provision observations/linksets collections and indexes. | Concelier Storage Guild | Path: src/Concelier/__Libraries/StellaOps.Concelier.Storage.Mongo | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 22 — Link-Not-Merge v1 | CONCELIER-LNM-21-102 | TODO | Backfill legacy merged advisories into observations/linksets with rollback tooling. | Concelier Storage & DevOps Guilds | Path: src/Concelier/__Libraries/StellaOps.Concelier.Storage.Mongo | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 22 — Link-Not-Merge v1 | CONCELIER-LNM-21-201 | TODO | Ship advisory observation read APIs with pagination/RBAC. | Concelier WebService Guild | Path: src/Concelier/StellaOps.Concelier.WebService | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 22 — Link-Not-Merge v1 | CONCELIER-LNM-21-202 | TODO | Implement advisory linkset read/export/evidence endpoints mapped to `ERR_AGG_*`. | Concelier WebService Guild | Path: src/Concelier/StellaOps.Concelier.WebService | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 22 — Link-Not-Merge v1 | EXCITITOR-LNM-21-001 | TODO | Define immutable VEX observation model. | Excititor Core Guild | Path: src/Excititor/__Libraries/StellaOps.Excititor.Core | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 22 — Link-Not-Merge v1 | EXCITITOR-LNM-21-002 | TODO | Build VEX linkset correlator with confidence/conflict recording. | Excititor Core Guild | Path: src/Excititor/__Libraries/StellaOps.Excititor.Core | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 22 — Link-Not-Merge v1 | EXCITITOR-LNM-21-101 | TODO | Provision VEX observation/linkset collections and indexes. | Excititor Storage Guild | Path: src/Excititor/__Libraries/StellaOps.Excititor.Storage.Mongo | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 22 — Link-Not-Merge v1 | EXCITITOR-LNM-21-102 | TODO | Backfill legacy VEX data into observations/linksets with rollback scripts. | Excititor Storage & DevOps Guilds | Path: src/Excititor/__Libraries/StellaOps.Excititor.Storage.Mongo | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 22 — Link-Not-Merge v1 | EXCITITOR-LNM-21-201 | TODO | Expose VEX observation APIs with filters/pagination and RBAC. | Excititor WebService Guild | Path: src/Excititor/StellaOps.Excititor.WebService | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 22 — Link-Not-Merge v1 | EXCITITOR-LNM-21-202 | TODO | Implement VEX linkset endpoints + exports with evidence payloads. | Excititor WebService Guild | Path: src/Excititor/StellaOps.Excititor.WebService | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 22 — Link-Not-Merge v1 | POLICY-ENGINE-40-001 | TODO | Update severity selection to handle multiple source severities per linkset. | Policy Guild | Path: src/Policy/StellaOps.Policy.Engine | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 22 — Link-Not-Merge v1 | POLICY-ENGINE-40-002 | TODO | Integrate VEX linkset conflicts into effective findings/explain traces. | Policy Guild, Excititor Guild | Path: src/Policy/StellaOps.Policy.Engine | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 22 — Link-Not-Merge v1 | SCANNER-LNM-21-001 | TODO | Update report/runtime payloads to consume linksets and surface source evidence. | Scanner WebService Guild | Path: src/Scanner/StellaOps.Scanner.WebService | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 22 — Link-Not-Merge v1 | UI-LNM-22-001 | TODO | Deliver Evidence panel with policy banner and source observations. | UI Guild | Path: src/UI/StellaOps.UI | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 22 — Link-Not-Merge v1 | UI-LNM-22-003 | TODO | Add VEX evidence tab with conflict indicators and exports. | UI Guild | Path: src/UI/StellaOps.UI | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 22 — Link-Not-Merge v1 | WEB-LNM-21-001 | TODO | Surface advisory observation/linkset APIs through gateway with RBAC. | BE-Base Platform Guild | Path: src/Web/StellaOps.Web | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 22 — Link-Not-Merge v1 | WEB-LNM-21-002 | TODO | Expose VEX observation/linkset endpoints with export handling. | BE-Base Platform Guild | Path: src/Web/StellaOps.Web | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 23 — StellaOps Console | DOCS-CONSOLE-23-015 | TODO | Produce `/docs/architecture/console.md` describing packages, data flow, SSE design. | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 23 — StellaOps Console | DOCS-CONSOLE-23-017 | TODO | Create `/docs/examples/ui-tours.md` walkthroughs with annotated screenshots/GIFs. | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 23 — StellaOps Console | DOCS-CONSOLE-23-018 | TODO | Execute console security checklist and record Security Guild sign-off. | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 23 — StellaOps Console | DOWNLOADS-CONSOLE-23-001 | TODO | Maintain signed downloads manifest pipeline feeding Console + docs parity checks. | Deployment Guild | Path: ops/deployment | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 23 — StellaOps Console | DEVOPS-CONSOLE-23-001 | BLOCKED (2025-10-26) | Stand up console CI pipeline (pnpm cache, lint, tests, Playwright, Lighthouse, offline runners). | DevOps Guild | Path: ops/devops | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 23 — StellaOps Console | DEVOPS-CONSOLE-23-002 | TODO | Deliver `stella-console` container + Helm overlays with SBOM/provenance and offline packaging. | DevOps Guild | Path: ops/devops | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 23 — StellaOps Console | AUTH-CONSOLE-23-001 | TODO | Register Console OIDC client with PKCE, scopes, short-lived tokens, and offline defaults. | Authority Core & Security Guild | Path: src/Authority/StellaOps.Authority | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 23 — StellaOps Console | AUTH-CONSOLE-23-002 | TODO | Provide tenant catalog/user profile endpoints with audit logging and fresh-auth requirements. | Authority Core & Security Guild | Path: src/Authority/StellaOps.Authority | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 23 — StellaOps Console | AUTH-CONSOLE-23-003 | TODO | Update security docs/sample configs for Console flows, CSP, and session policies. | Authority Core & Docs Guild | Path: src/Authority/StellaOps.Authority | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 23 — StellaOps Console | CONCELIER-CONSOLE-23-001 | TODO | Surface `/console/advisories` aggregation views with per-source metadata and filters. | Concelier WebService Guild | Path: src/Concelier/StellaOps.Concelier.WebService | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 23 — StellaOps Console | CONCELIER-CONSOLE-23-002 | TODO | Provide advisory delta metrics API for dashboard + live status ticker. | Concelier WebService Guild | Path: src/Concelier/StellaOps.Concelier.WebService | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 23 — StellaOps Console | CONCELIER-CONSOLE-23-003 | TODO | Add search helpers for CVE/GHSA/PURL lookups returning evidence fragments. | Concelier WebService Guild | Path: src/Concelier/StellaOps.Concelier.WebService | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 23 — StellaOps Console | EXCITITOR-CONSOLE-23-001 | TODO | Expose `/console/vex` aggregation endpoints with precedence and provenance. | Excititor WebService Guild | Path: src/Excititor/StellaOps.Excititor.WebService | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 23 — StellaOps Console | EXCITITOR-CONSOLE-23-002 | TODO | Publish VEX override delta metrics feeding dashboard/status ticker. | Excititor WebService Guild | Path: src/Excititor/StellaOps.Excititor.WebService | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 23 — StellaOps Console | EXCITITOR-CONSOLE-23-003 | TODO | Implement VEX search helpers for global search and explain drill-downs. | Excititor WebService Guild | Path: src/Excititor/StellaOps.Excititor.WebService | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 23 — StellaOps Console | EXPORT-CONSOLE-23-001 | TODO | Implement evidence bundle/export generator with signed manifests and telemetry. | Policy Guild, Scheduler Guild | Path: src/Policy/StellaOps.Policy.Engine | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 23 — StellaOps Console | POLICY-CONSOLE-23-001 | TODO | Optimize findings/explain APIs for Console filters, aggregation hints, and provenance traces. | Policy Guild | Path: src/Policy/StellaOps.Policy.Engine | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 23 — StellaOps Console | POLICY-CONSOLE-23-002 | TODO | Expose simulation diff + approval state metadata for policy workspace scenarios. | Policy Guild, Product Ops | Path: src/Policy/StellaOps.Policy.Engine | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 23 — StellaOps Console | SBOM-CONSOLE-23-001 | TODO | Deliver Console SBOM catalog API with filters, evaluation metadata, and raw projections. | SBOM Service Guild | Path: src/SbomService/StellaOps.SbomService | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 23 — StellaOps Console | SBOM-CONSOLE-23-002 | TODO | Provide component lookup/neighborhood endpoints for global search and overlays. | SBOM Service Guild | Path: src/SbomService/StellaOps.SbomService | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 23 — StellaOps Console | SCHED-CONSOLE-23-001 | TODO | Extend runs API with SSE progress, queue lag summaries, RBAC actions, and history pagination. | Scheduler WebService Guild | Path: src/Scheduler/StellaOps.Scheduler.WebService | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 23 — StellaOps Console | SCHED-WORKER-CONSOLE-23-201 | TODO | Stream run progress events with heartbeat/dedupe for Console SSE consumers. | Scheduler Worker Guild | Path: src/Scheduler/__Libraries/StellaOps.Scheduler.Worker | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 23 — StellaOps Console | SCHED-WORKER-CONSOLE-23-202 | TODO | Coordinate evidence bundle job queueing, status tracking, cancellation, and retention. | Scheduler Worker Guild | Path: src/Scheduler/__Libraries/StellaOps.Scheduler.Worker | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 23 — StellaOps Console | WEB-CONSOLE-23-001 | TODO | Ship `/console/dashboard` + `/console/filters` aggregates with tenant scoping and deterministic totals. | BE-Base Platform Guild | Path: src/Web/StellaOps.Web | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 23 — StellaOps Console | WEB-CONSOLE-23-002 | TODO | Provide `/console/status` polling and `/console/runs/{id}/stream` SSE proxy with heartbeat/backoff. | BE-Base Platform Guild, Scheduler Guild | Path: src/Web/StellaOps.Web | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 23 — StellaOps Console | WEB-CONSOLE-23-003 | TODO | Expose `/console/exports` orchestration for evidence bundles, CSV/JSON streaming, manifest retrieval. | BE-Base Platform Guild, Policy Guild | Path: src/Web/StellaOps.Web | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 23 — StellaOps Console | WEB-CONSOLE-23-004 | TODO | Implement `/console/search` fan-out router for CVE/GHSA/PURL/SBOM lookups with caching and RBAC. | BE-Base Platform Guild | Path: src/Web/StellaOps.Web | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 23 — StellaOps Console | WEB-CONSOLE-23-005 | TODO | Serve `/console/downloads` manifest with signed image metadata and offline guidance. | BE-Base Platform Guild, DevOps Guild | Path: src/Web/StellaOps.Web | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 24 — Graph & Vuln Explorer v1 | AUTH-VULN-24-001 | TODO | Extend scopes (`vuln:view`/`vuln:investigate`/`vuln:operate`/`vuln:audit`) and signed permalinks. | Authority Core Guild | Path: src/Authority/StellaOps.Authority | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 24 — Graph & Vuln Explorer v1 | CONCELIER-GRAPH-24-001 | TODO | Surface raw advisory observations/linksets for overlay services (no derived aggregation in ingestion). | Concelier Core Guild | Path: src/Concelier/__Libraries/StellaOps.Concelier.Core | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 24 — Graph & Vuln Explorer v1 | EXCITITOR-GRAPH-24-001 | TODO | Surface raw VEX statements/linksets for overlay services (no suppression/precedence logic here). | Excititor Core Guild | Path: src/Excititor/__Libraries/StellaOps.Excititor.Core | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 24 — Graph & Vuln Explorer v1 | POLICY-ENGINE-60-001 | TODO | Maintain Redis effective decision maps for overlays. | Policy Guild | Path: src/Policy/StellaOps.Policy.Engine | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 24 — Graph & Vuln Explorer v1 | POLICY-ENGINE-60-002 | TODO | Provide simulation bridge for graph what-if APIs. | Policy Guild | Path: src/Policy/StellaOps.Policy.Engine | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 24 — Graph & Vuln Explorer v1 | UI-GRAPH-24-001 | TODO | Build Graph Explorer canvas with virtualization. | UI Guild | Path: src/UI/StellaOps.UI | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 24 — Graph & Vuln Explorer v1 | UI-GRAPH-24-002 | TODO | Implement overlays (Policy/Evidence/License/Exposure). | UI Guild | Path: src/UI/StellaOps.UI | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 25 — Exceptions v1 | DOCS-EXC-25-001 | TODO | Document exception governance concepts/workflow. | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 25 — Exceptions v1 | DOCS-EXC-25-002 | TODO | Document approvals routing / MFA requirements. | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 25 — Exceptions v1 | DOCS-EXC-25-003 | TODO | Publish API documentation for exceptions endpoints. | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 25 — Exceptions v1 | DOCS-EXC-25-005 | TODO | Document UI exception center + badges. | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 25 — Exceptions v1 | DOCS-EXC-25-006 | TODO | Update CLI docs for exception commands. | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 25 — Exceptions v1 | DOCS-EXC-25-007 | TODO | Write migration guide for governed exceptions. | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 25 — Exceptions v1 | AUTH-EXC-25-001 | TODO | Introduce exception scopes and routing matrix with MFA. | Authority Core Guild | Path: src/Authority/StellaOps.Authority | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 25 — Exceptions v1 | AUTH-EXC-25-002 | TODO | Update docs/config samples for exception governance. | Authority Core & Docs Guild | Path: src/Authority/StellaOps.Authority | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 25 — Exceptions v1 | CLI-EXC-25-001 | TODO | Implement CLI exception workflow commands. | DevEx/CLI Guild | Path: src/Cli/StellaOps.Cli | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 25 — Exceptions v1 | CLI-EXC-25-002 | TODO | Extend policy simulate with exception overrides. | DevEx/CLI Guild | Path: src/Cli/StellaOps.Cli | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 25 — Exceptions v1 | POLICY-ENGINE-70-002 | TODO | Create exception collections/bindings storage + repos. | Policy Guild | Path: src/Policy/StellaOps.Policy.Engine | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 25 — Exceptions v1 | POLICY-ENGINE-70-003 | TODO | Implement Redis exception cache + invalidation. | Policy Guild | Path: src/Policy/StellaOps.Policy.Engine | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 25 — Exceptions v1 | POLICY-ENGINE-70-004 | TODO | Add metrics/tracing/logging for exception application. | Policy Guild | Path: src/Policy/StellaOps.Policy.Engine | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 25 — Exceptions v1 | POLICY-ENGINE-70-005 | TODO | Hook workers/events for activation/expiry. | Policy Guild | Path: src/Policy/StellaOps.Policy.Engine | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 25 — Exceptions v1 | SCHED-WORKER-25-101 | TODO | Implement exception lifecycle worker for activation/expiry. | Scheduler Worker Guild | Path: src/Scheduler/__Libraries/StellaOps.Scheduler.Worker | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 25 — Exceptions v1 | SCHED-WORKER-25-102 | TODO | Add expiring notification job & metrics. | Scheduler Worker Guild | Path: src/Scheduler/__Libraries/StellaOps.Scheduler.Worker | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 25 — Exceptions v1 | UI-EXC-25-001 | TODO | Deliver Exception Center (list/kanban) with workflows. | UI Guild | Path: src/UI/StellaOps.UI | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 25 — Exceptions v1 | UI-EXC-25-002 | TODO | Build exception creation wizard with scope/timebox guardrails. | UI Guild | Path: src/UI/StellaOps.UI | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 25 — Exceptions v1 | UI-EXC-25-003 | TODO | Add inline exception drafting/proposing from explorers. | UI Guild | Path: src/UI/StellaOps.UI | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 25 — Exceptions v1 | UI-EXC-25-004 | TODO | Surface badges/countdowns/explain integration. | UI Guild | Path: src/UI/StellaOps.UI | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 25 — Exceptions v1 | WEB-EXC-25-001 | TODO | Ship exception CRUD + workflow API endpoints. | BE-Base Platform Guild | Path: src/Web/StellaOps.Web | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 25 — Exceptions v1 | WEB-EXC-25-002 | TODO | Extend policy endpoints to include exception metadata. | BE-Base Platform Guild | Path: src/Web/StellaOps.Web | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 25 — Exceptions v1 | WEB-EXC-25-003 | TODO | Emit exception events/notifications with rate limits. | BE-Base Platform Guild | Path: src/Web/StellaOps.Web | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 26 — Reachability v1 | DOCS-SIG-26-001 | TODO | Document reachability concepts and scoring. | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 26 — Reachability v1 | DOCS-SIG-26-002 | TODO | Document callgraph formats. | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 26 — Reachability v1 | DOCS-SIG-26-003 | TODO | Document runtime facts ingestion. | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 26 — Reachability v1 | DOCS-SIG-26-004 | TODO | Document policy weighting for signals. | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 26 — Reachability v1 | DOCS-SIG-26-005 | TODO | Document UI overlays/timelines. | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 26 — Reachability v1 | DOCS-SIG-26-006 | TODO | Document CLI reachability commands. | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 26 — Reachability v1 | DOCS-SIG-26-007 | TODO | Publish API docs for signals endpoints. | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 26 — Reachability v1 | DOCS-SIG-26-008 | TODO | Write migration guide for enabling reachability. | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 26 — Reachability v1 | DEVOPS-SIG-26-001 | TODO | Provision pipelines/deployments for Signals service. | DevOps Guild | Path: ops/devops | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 26 — Reachability v1 | DEVOPS-SIG-26-002 | TODO | Add dashboards/alerts for reachability metrics. | DevOps Guild | Path: ops/devops | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 26 — Reachability v1 | AUTH-SIG-26-001 | TODO | Add signals scopes/roles + AOC requirements. | Authority Core Guild | Path: src/Authority/StellaOps.Authority | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 26 — Reachability v1 | CLI-SIG-26-001 | TODO | Implement reachability CLI commands (upload/list/explain). | DevEx/CLI Guild | Path: src/Cli/StellaOps.Cli | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 26 — Reachability v1 | CLI-SIG-26-002 | TODO | Add reachability overrides to policy simulate. | DevEx/CLI Guild | Path: src/Cli/StellaOps.Cli | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 26 — Reachability v1 | CONCELIER-SIG-26-001 | TODO | Expose advisory symbol metadata for signals scoring. | Concelier Core Guild | Path: src/Concelier/__Libraries/StellaOps.Concelier.Core | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 26 — Reachability v1 | EXCITITOR-SIG-26-001 | TODO | Surface vendor exploitability hints to Signals. | Excititor Core Guild | Path: src/Excititor/__Libraries/StellaOps.Excititor.Core | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 26 — Reachability v1 | POLICY-ENGINE-80-001 | TODO | Integrate reachability inputs into policy evaluation and explainers. | Policy Guild | Path: src/Policy/StellaOps.Policy.Engine | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 26 — Reachability v1 | POLICY-ENGINE-80-002 | BLOCKED (2025-11-26) | Reachability input contract (80-001) not published; cannot join caches. | Policy Guild | Path: src/Policy/StellaOps.Policy.Engine | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 26 — Reachability v1 | POLICY-ENGINE-80-003 | BLOCKED (2025-11-26) | Blocked by 80-002 and missing reachability predicates contract. | Policy Guild | Path: src/Policy/StellaOps.Policy.Engine | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 26 — Reachability v1 | POLICY-ENGINE-80-004 | BLOCKED (2025-11-26) | Blocked by 80-003; metrics depend on reachability integration. | Policy Guild | Path: src/Policy/StellaOps.Policy.Engine | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 26 — Reachability v1 | POLICY-SPL-24-001 | DONE (2025-11-26) | Extended SPL schema with reachability/exploitability predicates. | Policy Guild | Path: src/Policy/__Libraries/StellaOps.Policy | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 26 — Reachability v1 | SCHED-WORKER-26-201 | TODO | Implement reachability joiner worker. | Scheduler Worker Guild | Path: src/Scheduler/__Libraries/StellaOps.Scheduler.Worker | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 26 — Reachability v1 | SCHED-WORKER-26-202 | TODO | Implement staleness monitor + notifications. | Scheduler Worker Guild | Path: src/Scheduler/__Libraries/StellaOps.Scheduler.Worker | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 26 — Reachability v1 | SIGNALS-24-001 | BLOCKED (2025-10-27) | Stand up Signals API skeleton with RBAC + health checks. Host scaffold ready, waiting on `AUTH-SIG-26-001` to finalize scope issuance and tenant enforcement. | Signals Guild, Authority Guild | Path: src/Signals/StellaOps.Signals | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 26 — Reachability v1 | SIGNALS-24-002 | BLOCKED (2025-10-27) | Implement callgraph ingestion/normalization pipeline. Waiting on SIGNALS-24-001 skeleton deployment. | Signals Guild | Path: src/Signals/StellaOps.Signals | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 26 — Reachability v1 | SIGNALS-24-003 | BLOCKED (2025-10-27) | Ingest runtime facts and persist context data with AOC provenance. Depends on SIGNALS-24-001 base host. | Signals Guild | Path: src/Signals/StellaOps.Signals | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 26 — Reachability v1 | SIGNALS-24-004 | BLOCKED (2025-10-27) | Deliver reachability scoring engine writing reachability facts. Blocked until ingestion pipelines unblock. | Signals Guild | Path: src/Signals/StellaOps.Signals | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 26 — Reachability v1 | SIGNALS-24-005 | BLOCKED (2025-10-27) | Implement caches + signals events. Downstream of SIGNALS-24-004. | Signals Guild | Path: src/Signals/StellaOps.Signals | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 26 — Reachability v1 | UI-SIG-26-001 | TODO | Add reachability columns/badges to Vulnerability Explorer. | UI Guild | Path: src/UI/StellaOps.UI | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 26 — Reachability v1 | UI-SIG-26-002 | TODO | Enhance Why drawer with call path/timeline. | UI Guild | Path: src/UI/StellaOps.UI | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 26 — Reachability v1 | UI-SIG-26-003 | TODO | Add reachability overlay/time slider to SBOM Graph. | UI Guild | Path: src/UI/StellaOps.UI | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 26 — Reachability v1 | UI-SIG-26-004 | TODO | Build Reachability Center + missing sensor view. | UI Guild | Path: src/UI/StellaOps.UI | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 26 — Reachability v1 | WEB-SIG-26-001 | TODO | Expose signals proxy endpoints with pagination and RBAC. | BE-Base Platform Guild | Path: src/Web/StellaOps.Web | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 26 — Reachability v1 | WEB-SIG-26-002 | TODO | Join reachability data into policy/vuln responses. | BE-Base Platform Guild | Path: src/Web/StellaOps.Web | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 26 — Reachability v1 | WEB-SIG-26-003 | TODO | Support reachability overrides in simulate APIs. | BE-Base Platform Guild | Path: src/Web/StellaOps.Web | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 27 — Policy Studio | DOCS-POLICY-27-001 | BLOCKED (2025-10-27) | Publish `/docs/policy/studio-overview.md` with lifecycle + roles. | Docs & Policy Guilds | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 27 — Policy Studio | DOCS-POLICY-27-002 | BLOCKED (2025-10-27) | Write `/docs/policy/authoring.md` with templates/snippets/lint rules. | Docs & Console Guilds | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 27 — Policy Studio | DOCS-POLICY-27-003 | BLOCKED (2025-10-27) | Document `/docs/policy/versioning-and-publishing.md`. | Docs & Policy Registry Guilds | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 27 — Policy Studio | DOCS-POLICY-27-004 | BLOCKED (2025-10-27) | Publish `/docs/policy/simulation.md` with quick vs batch guidance. | Docs & Scheduler Guilds | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 27 — Policy Studio | DOCS-POLICY-27-005 | BLOCKED (2025-10-27) | Author `/docs/policy/review-and-approval.md`. | Docs & Product Ops | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 27 — Policy Studio | DOCS-POLICY-27-006 | BLOCKED (2025-10-27) | Publish `/docs/policy/promotion.md` covering canary + rollback. | Docs & Policy Guilds | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 27 — Policy Studio | DOCS-POLICY-27-007 | BLOCKED (2025-10-27) | Update `/docs/policy/cli.md` with new commands + JSON schemas. | Docs & DevEx/CLI Guilds | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 27 — Policy Studio | DOCS-POLICY-27-008 | BLOCKED (2025-10-27) | Publish `/docs/policy/api.md` aligning with Registry OpenAPI. | Docs & Policy Registry Guilds | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 27 — Policy Studio | DOCS-POLICY-27-009 | BLOCKED (2025-10-27) | Create `/docs/security/policy-attestations.md`. | Docs & Security Guilds | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 27 — Policy Studio | DOCS-POLICY-27-010 | BLOCKED (2025-10-27) | Write `/docs/architecture/policy-registry.md`. | Docs & Architecture Guilds | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 27 — Policy Studio | DOCS-POLICY-27-011 | BLOCKED (2025-10-27) | Publish `/docs/observability/policy-telemetry.md`. | Docs & Observability Guilds | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 27 — Policy Studio | DOCS-POLICY-27-012 | BLOCKED (2025-10-27) | Write `/docs/runbooks/policy-incident.md`. | Docs & Ops Guilds | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 27 — Policy Studio | DOCS-POLICY-27-013 | BLOCKED (2025-10-27) | Update `/docs/examples/policy-templates.md`. | Docs & Policy Guilds | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 27 — Policy Studio | DOCS-POLICY-27-014 | BLOCKED (2025-10-27) | Refresh `/docs/aoc/aoc-guardrails.md` with Studio guardrails. | Docs & Policy Registry Guilds | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 27 — Policy Studio | DEPLOY-POLICY-27-001 | TODO | Create Helm/Compose overlays for Policy Registry + workers with signing config. | Deployment & Policy Registry Guilds | Path: ops/deployment | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 27 — Policy Studio | DEPLOY-POLICY-27-002 | TODO | Document policy rollout/rollback playbooks in runbook. | Deployment & Policy Guilds | Path: ops/deployment | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 27 — Policy Studio | DEVOPS-POLICY-27-001 | TODO | Add CI stage for policy lint/compile/test + secret scanning and artifacts. | DevOps Guild | Path: ops/devops | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 27 — Policy Studio | DEVOPS-POLICY-27-002 | TODO | Provide optional batch simulation CI job with drift gating + PR comment. | DevOps & Policy Registry Guilds | Path: ops/devops | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 27 — Policy Studio | DEVOPS-POLICY-27-003 | TODO | Manage signing keys + attestation verification in pipelines. | DevOps & Security Guilds | Path: ops/devops | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 27 — Policy Studio | DEVOPS-POLICY-27-004 | TODO | Build dashboards/alerts for compile latency, queue depth, approvals, promotions. | DevOps & Observability Guilds | Path: ops/devops | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 27 — Policy Studio | AUTH-POLICY-27-001 | TODO | Define Policy Studio roles/scopes for author/review/approve/operate/audit. | Authority Core Guild | Path: src/Authority/StellaOps.Authority | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 27 — Policy Studio | AUTH-POLICY-27-002 | TODO | Wire signing service + fresh-auth enforcement for publish/promote. | Authority Core & Security Guilds | Path: src/Authority/StellaOps.Authority | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 27 — Policy Studio | AUTH-POLICY-27-003 | TODO | Update authority configuration/docs for Policy Studio roles & signing. | Authority Core & Docs Guild | Path: src/Authority/StellaOps.Authority | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 27 — Policy Studio | CLI-POLICY-27-001 | TODO | Implement policy workspace CLI commands (init, lint, compile, test). | DevEx/CLI Guild | Path: src/Cli/StellaOps.Cli | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 27 — Policy Studio | CLI-POLICY-27-002 | TODO | Add version bump, submit, review/approve CLI workflow commands. | DevEx/CLI Guild | Path: src/Cli/StellaOps.Cli | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 27 — Policy Studio | CLI-POLICY-27-003 | TODO | Extend simulate command for quick/batch runs, manifests, CI reports. | DevEx/CLI Guild | Path: src/Cli/StellaOps.Cli | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 27 — Policy Studio | CLI-POLICY-27-004 | TODO | Implement publish/promote/rollback/sign CLI lifecycle commands. | DevEx/CLI Guild | Path: src/Cli/StellaOps.Cli | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 27 — Policy Studio | CLI-POLICY-27-005 | TODO | Update CLI docs/reference for Policy Studio commands and schemas. | DevEx/CLI & Docs Guilds | Path: src/Cli/StellaOps.Cli | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 27 — Policy Studio | POLICY-ENGINE-27-001 | TODO | Return rule coverage, symbol table, docs, hashes from compile endpoint. | Policy Guild | Path: src/Policy/StellaOps.Policy.Engine | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 27 — Policy Studio | POLICY-ENGINE-27-002 | TODO | Enhance simulate outputs with heatmap, explain traces, delta summaries. | Policy Guild | Path: src/Policy/StellaOps.Policy.Engine | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 27 — Policy Studio | POLICY-ENGINE-27-003 | TODO | Enforce complexity/time limits with diagnostics. | Policy Guild | Path: src/Policy/StellaOps.Policy.Engine | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 27 — Policy Studio | POLICY-ENGINE-27-004 | TODO | Update tests/fixtures for coverage, symbol table, explain, complexity. | Policy Guild | Path: src/Policy/StellaOps.Policy.Engine | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 27 — Policy Studio | REGISTRY-API-27-001 | TODO | Define Policy Registry OpenAPI spec for workspaces, versions, reviews, simulations, promotions, attestations. | Policy Registry Guild | Path: src/Policy/StellaOps.Policy.Registry | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 27 — Policy Studio | REGISTRY-API-27-002 | TODO | Implement workspace storage + CRUD with tenant retention policies. | Policy Registry Guild | Path: src/Policy/StellaOps.Policy.Registry | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 27 — Policy Studio | REGISTRY-API-27-003 | TODO | Integrate compile pipeline storing diagnostics, symbol tables, complexity metrics. | Policy Registry Guild | Path: src/Policy/StellaOps.Policy.Registry | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 27 — Policy Studio | REGISTRY-API-27-004 | TODO | Deliver quick simulation API with limits and deterministic outputs. | Policy Registry Guild | Path: src/Policy/StellaOps.Policy.Registry | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 27 — Policy Studio | REGISTRY-API-27-005 | TODO | Build batch simulation orchestration, reduction, and evidence bundle storage. | Policy Registry & Scheduler Guilds | Path: src/Policy/StellaOps.Policy.Registry | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 27 — Policy Studio | REGISTRY-API-27-006 | TODO | Implement review workflow with comments, required approvers, webhooks. | Policy Registry Guild | Path: src/Policy/StellaOps.Policy.Registry | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 27 — Policy Studio | REGISTRY-API-27-007 | TODO | Ship publish/sign pipeline with attestations, immutable versions. | Policy Registry & Security Guilds | Path: src/Policy/StellaOps.Policy.Registry | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 27 — Policy Studio | REGISTRY-API-27-008 | TODO | Implement promotion/canary bindings per tenant/environment with rollback. | Policy Registry Guild | Path: src/Policy/StellaOps.Policy.Registry | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 27 — Policy Studio | REGISTRY-API-27-009 | TODO | Instrument metrics/logs/traces for compile, simulation, approval latency. | Policy Registry & Observability Guilds | Path: src/Policy/StellaOps.Policy.Registry | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 27 — Policy Studio | REGISTRY-API-27-010 | TODO | Build unit/integration/load test suites and seeded fixtures. | Policy Registry & QA Guilds | Path: src/Policy/StellaOps.Policy.Registry | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 27 — Policy Studio | SCHED-CONSOLE-27-001 | TODO | Provide policy simulation orchestration endpoints with SSE + RBAC. | Scheduler WebService Guild | Path: src/Scheduler/StellaOps.Scheduler.WebService | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 27 — Policy Studio | SCHED-CONSOLE-27-002 | TODO | Emit policy simulation telemetry endpoints/metrics + webhooks. | Scheduler WebService & Observability Guilds | Path: src/Scheduler/StellaOps.Scheduler.WebService | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 27 — Policy Studio | SCHED-WORKER-27-301 | TODO | Implement batch simulation worker sharding SBOMs with retries/backoff. | Scheduler Worker Guild | Path: src/Scheduler/__Libraries/StellaOps.Scheduler.Worker | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 27 — Policy Studio | SCHED-WORKER-27-302 | TODO | Build reducer job aggregating shard outputs into manifests with checksums. | Scheduler Worker Guild | Path: src/Scheduler/__Libraries/StellaOps.Scheduler.Worker | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 27 — Policy Studio | SCHED-WORKER-27-303 | TODO | Enforce tenant isolation/attestation integration and secret scanning for jobs. | Scheduler Worker & Security Guilds | Path: src/Scheduler/__Libraries/StellaOps.Scheduler.Worker | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 27 — Policy Studio | WEB-POLICY-27-001 | TODO | Proxy Policy Registry APIs with tenant scoping, RBAC, evidence streaming. | BE-Base Platform Guild | Path: src/Web/StellaOps.Web | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 27 — Policy Studio | WEB-POLICY-27-002 | TODO | Implement review lifecycle routes with audit logs and webhooks. | BE-Base Platform Guild | Path: src/Web/StellaOps.Web | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 27 — Policy Studio | WEB-POLICY-27-003 | TODO | Expose quick/batch simulation endpoints with SSE progress + manifests. | BE-Base Platform & Scheduler Guilds | Path: src/Web/StellaOps.Web | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 27 — Policy Studio | WEB-POLICY-27-004 | TODO | Add publish/promote/rollback endpoints with canary + signing enforcement. | BE-Base Platform & Security Guilds | Path: src/Web/StellaOps.Web | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 27 — Policy Studio | WEB-POLICY-27-005 | TODO | Instrument Policy Studio metrics/logs for dashboards. | BE-Base Platform & Observability Guilds | Path: src/Web/StellaOps.Web | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 28 — Graph Explorer | DOCS-GRAPH-28-001 | TODO | Publish `/docs/sbom/graph-explorer-overview.md`. | Docs & SBOM Guilds | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 28 — Graph Explorer | DOCS-GRAPH-28-002 | TODO | Write `/docs/sbom/graph-using-the-console.md` with walkthrough + accessibility tips. | Docs & Console Guilds | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 28 — Graph Explorer | DOCS-GRAPH-28-003 | TODO | Document `/docs/sbom/graph-query-language.md` (JSON schema, cost rules). | Docs & Graph API Guilds | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 28 — Graph Explorer | DOCS-GRAPH-28-004 | TODO | Publish `/docs/sbom/graph-api.md` endpoints + streaming guidance. | Docs & Graph API Guilds | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 28 — Graph Explorer | DOCS-GRAPH-28-005 | TODO | Produce `/docs/sbom/graph-cli.md` command reference. | Docs & CLI Guilds | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 28 — Graph Explorer | DOCS-GRAPH-28-006 | TODO | Publish `/docs/policy/graph-overlays.md`. | Docs & Policy Guilds | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 28 — Graph Explorer | DOCS-GRAPH-28-007 | TODO | Document `/docs/vex/graph-integration.md`. | Docs & Excitor Guilds | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 28 — Graph Explorer | DOCS-GRAPH-28-008 | TODO | Document `/docs/advisories/graph-integration.md`. | Docs & Concelier Guilds | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 28 — Graph Explorer | DOCS-GRAPH-28-009 | TODO | Author `/docs/architecture/graph-services.md`. | Docs & Architecture Guilds | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 28 — Graph Explorer | DOCS-GRAPH-28-010 | TODO | Publish `/docs/observability/graph-telemetry.md`. | Docs & Observability Guilds | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 28 — Graph Explorer | DOCS-GRAPH-28-011 | TODO | Write `/docs/runbooks/graph-incidents.md`. | Docs & Ops Guilds | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 28 — Graph Explorer | DOCS-GRAPH-28-012 | TODO | Create `/docs/security/graph-rbac.md`. | Docs & Security Guilds | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 28 — Graph Explorer | DEPLOY-GRAPH-28-001 | TODO | Provide deployment/offline instructions for Graph Indexer/API, including cache seeds. | Deployment Guild | Path: ops/deployment | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 28 — Graph Explorer | DEVOPS-GRAPH-28-001 | TODO | Configure load/perf tests, query budget alerts, and CI smoke for graph APIs. | DevOps Guild | Path: ops/devops | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 28 — Graph Explorer | DEVOPS-GRAPH-28-002 | TODO | Implement caching/backpressure limits, rate limiting configs, and runaway query kill switches. | DevOps & Security Guilds | Path: ops/devops | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 28 — Graph Explorer | DEVOPS-GRAPH-28-003 | TODO | Build dashboards/alerts for tile latency, query denials, memory pressure. | DevOps & Observability Guilds | Path: ops/devops | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 28 — Graph Explorer | CLI-GRAPH-28-001 | TODO | Ship `stella sbom graph` subcommands (search, query, paths, diff, impacted, export) with JSON output + exit codes. | DevEx/CLI Guild | Path: src/Cli/StellaOps.Cli | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 28 — Graph Explorer | CLI-GRAPH-28-002 | TODO | Add saved query management + deep link helpers to CLI. | DevEx/CLI Guild | Path: src/Cli/StellaOps.Cli | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 28 — Graph Explorer | CLI-GRAPH-28-003 | TODO | Update CLI docs/examples for Graph Explorer commands. | DevEx/CLI Guild | Path: src/Cli/StellaOps.Cli | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 28 — Graph Explorer | CONCELIER-GRAPH-24-101 | TODO | Deliver advisory summary API feeding graph tooltips. | Concelier WebService Guild | Path: src/Concelier/StellaOps.Concelier.WebService | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 28 — Graph Explorer | CONCELIER-GRAPH-28-102 | TODO | Add batch fetch for advisory observations/linksets keyed by component sets to feed Graph overlay tooltips efficiently. | Concelier WebService Guild | Path: src/Concelier/StellaOps.Concelier.WebService | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 28 — Graph Explorer | WEB-LNM-21-001 | TODO | Provide advisory observation endpoints optimized for graph overlays. | Concelier WebService Guild | Path: src/Concelier/StellaOps.Concelier.WebService | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 28 — Graph Explorer | EXCITITOR-GRAPH-24-101 | TODO | Provide VEX summary API for Graph Explorer inspector overlays. | Excititor WebService Guild | Path: src/Excititor/StellaOps.Excititor.WebService | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 28 — Graph Explorer | GRAPH-API-28-001 | TODO | Publish Graph API OpenAPI + JSON schemas for queries/tiles. | Graph API Guild | Path: src/Graph/StellaOps.Graph.Api | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 28 — Graph Explorer | GRAPH-API-28-002 | TODO | Implement `/graph/search` with caching and RBAC. | Graph API Guild | Path: src/Graph/StellaOps.Graph.Api | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 28 — Graph Explorer | GRAPH-API-28-003 | TODO | Build query planner + streaming tile pipeline with budgets. | Graph API Guild | Path: src/Graph/StellaOps.Graph.Api | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 28 — Graph Explorer | GRAPH-API-28-004 | TODO | Deliver `/graph/paths` with depth limits and policy overlay support. | Graph API Guild | Path: src/Graph/StellaOps.Graph.Api | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 28 — Graph Explorer | GRAPH-API-28-005 | TODO | Implement `/graph/diff` streaming adds/removes/changes for SBOM snapshots. | Graph API Guild | Path: src/Graph/StellaOps.Graph.Api | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 28 — Graph Explorer | GRAPH-API-28-006 | TODO | Compose advisory/VEX/policy overlays with caching + explain sampling. | Graph API Guild | Path: src/Graph/StellaOps.Graph.Api | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 28 — Graph Explorer | GRAPH-API-28-007 | TODO | Provide export jobs (GraphML/CSV/NDJSON/PNG/SVG) with manifests. | Graph API Guild | Path: src/Graph/StellaOps.Graph.Api | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 28 — Graph Explorer | GRAPH-API-28-008 | TODO | Enforce RBAC scopes, tenant headers, audit logging, rate limits. | Graph API & Authority Guilds | Path: src/Graph/StellaOps.Graph.Api | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 28 — Graph Explorer | GRAPH-API-28-009 | TODO | Instrument metrics/logs/traces; publish dashboards. | Graph API & Observability Guilds | Path: src/Graph/StellaOps.Graph.Api | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 28 — Graph Explorer | GRAPH-API-28-010 | TODO | Build unit/integration/load tests with synthetic datasets. | Graph API & QA Guilds | Path: src/Graph/StellaOps.Graph.Api | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 28 — Graph Explorer | GRAPH-API-28-011 | TODO | Ship deployment/offline manifests + gateway integration docs. | Graph API & DevOps Guilds | Path: src/Graph/StellaOps.Graph.Api | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 28 — Graph Explorer | GRAPH-INDEX-28-001 | TODO | Define node/edge schemas, identity rules, and fixtures for graph ingestion. | Graph Indexer Guild | Path: src/Graph/StellaOps.Graph.Indexer | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 28 — Graph Explorer | GRAPH-INDEX-28-002 | TODO | Implement SBOM ingest consumer generating artifact/package/file nodes & edges. | Graph Indexer Guild | Path: src/Graph/StellaOps.Graph.Indexer | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 28 — Graph Explorer | GRAPH-INDEX-28-003 | TODO | Serve advisory overlay tiles from Conseiller linksets (no mutation of raw node/edge stores). | Graph Indexer Guild | Path: src/Graph/StellaOps.Graph.Indexer | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 28 — Graph Explorer | GRAPH-INDEX-28-004 | TODO | Integrate VEX statements for `vex_exempts` edges with precedence metadata. | Graph Indexer Guild | Path: src/Graph/StellaOps.Graph.Indexer | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 28 — Graph Explorer | GRAPH-INDEX-28-005 | TODO | Hydrate policy overlay nodes/edges referencing determinations + explains. | Graph Indexer & Policy Guilds | Path: src/Graph/StellaOps.Graph.Indexer | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 28 — Graph Explorer | GRAPH-INDEX-28-006 | TODO | Produce graph snapshots per SBOM with lineage for diff jobs. | Graph Indexer Guild | Path: src/Graph/StellaOps.Graph.Indexer | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 28 — Graph Explorer | GRAPH-INDEX-28-007 | TODO | Run clustering/centrality background jobs and persist cluster ids. | Graph Indexer & Observability Guilds | Path: src/Graph/StellaOps.Graph.Indexer | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 28 — Graph Explorer | GRAPH-INDEX-28-008 | TODO | Build incremental/backfill pipeline with change streams, retries, backlog metrics. | Graph Indexer Guild | Path: src/Graph/StellaOps.Graph.Indexer | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 28 — Graph Explorer | GRAPH-INDEX-28-009 | TODO | Extend tests/perf fixtures ensuring determinism on large graphs. | Graph Indexer & QA Guilds | Path: src/Graph/StellaOps.Graph.Indexer | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 28 — Graph Explorer | GRAPH-INDEX-28-010 | TODO | Provide deployment/offline artifacts and docs for Graph Indexer. | Graph Indexer & DevOps Guilds | Path: src/Graph/StellaOps.Graph.Indexer | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 28 — Graph Explorer | POLICY-ENGINE-30-001 | TODO | Finalize graph overlay contract + projection API. | Policy Guild | Path: src/Policy/StellaOps.Policy.Engine | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 28 — Graph Explorer | POLICY-ENGINE-30-002 | TODO | Implement simulation overlay bridge for Graph Explorer queries. | Policy Guild | Path: src/Policy/StellaOps.Policy.Engine | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 28 — Graph Explorer | POLICY-ENGINE-30-003 | TODO | Emit change events for effective findings supporting graph overlays. | Policy & Scheduler Guilds | Path: src/Policy/StellaOps.Policy.Engine | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 28 — Graph Explorer | SCHED-WEB-21-004 | DOING (2025-10-26) | Persist graph jobs + emit completion events/webhook. | Scheduler WebService Guild, Scheduler Storage Guild | Path: src/Scheduler/StellaOps.Scheduler.WebService | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 28 — Graph Explorer | SCHED-WORKER-21-201 | TODO | Run graph build worker for SBOM snapshots with retries/backoff. | Scheduler Worker Guild | Path: src/Scheduler/__Libraries/StellaOps.Scheduler.Worker | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 28 — Graph Explorer | SCHED-WORKER-21-202 | TODO | Execute overlay refresh worker subscribing to change events. | Scheduler Worker Guild | Path: src/Scheduler/__Libraries/StellaOps.Scheduler.Worker | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 28 — Graph Explorer | SCHED-WORKER-21-203 | TODO | Emit metrics/logs for graph build/overlay jobs. | Scheduler Worker & Observability Guilds | Path: src/Scheduler/__Libraries/StellaOps.Scheduler.Worker | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 28 — Graph Explorer | WEB-GRAPH-24-001 | TODO | Route `/graph/*` APIs through gateway with tenant scoping and RBAC. | BE-Base Platform Guild | Path: src/Web/StellaOps.Web | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 28 — Graph Explorer | WEB-GRAPH-24-002 | TODO | Maintain overlay proxy routes to dedicated services (Policy/Vuln API), ensuring caching + RBAC only. | BE-Base Platform Guild | Path: src/Web/StellaOps.Web | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 28 — Graph Explorer | WEB-GRAPH-24-004 | TODO | Add Graph Explorer telemetry endpoints and metrics aggregation. | BE-Base Platform & Observability Guilds | Path: src/Web/StellaOps.Web | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 29 — Vulnerability Explorer | DOCS-VULN-29-001 | TODO | Publish `/docs/vuln/explorer-overview.md`. | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 29 — Vulnerability Explorer | DOCS-VULN-29-002 | TODO | Write `/docs/vuln/explorer-using-console.md`. | Docs & Console Guilds | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 29 — Vulnerability Explorer | DOCS-VULN-29-003 | TODO | Author `/docs/vuln/explorer-api.md`. | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 29 — Vulnerability Explorer | DOCS-VULN-29-004 | TODO | Publish `/docs/vuln/explorer-cli.md`. | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 29 — Vulnerability Explorer | DOCS-VULN-29-005 | TODO | Document Findings Ledger (`/docs/vuln/findings-ledger.md`). | Docs & Ledger Guilds | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 29 — Vulnerability Explorer | DOCS-VULN-29-006 | TODO | Update `/docs/policy/vuln-determinations.md`. | Docs & Policy Guilds | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 29 — Vulnerability Explorer | DOCS-VULN-29-007 | TODO | Publish `/docs/vex/explorer-integration.md`. | Docs & Excititor Guilds | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 29 — Vulnerability Explorer | DOCS-VULN-29-008 | TODO | Publish `/docs/advisories/explorer-integration.md`. | Docs & Concelier Guilds | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 29 — Vulnerability Explorer | DOCS-VULN-29-009 | TODO | Publish `/docs/sbom/vuln-resolution.md`. | Docs & SBOM Guilds | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 29 — Vulnerability Explorer | DOCS-VULN-29-010 | TODO | Publish `/docs/observability/vuln-telemetry.md`. | Docs & Observability Guilds | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 29 — Vulnerability Explorer | DOCS-VULN-29-011 | TODO | Publish `/docs/security/vuln-rbac.md`. | Docs & Security Guilds | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 29 — Vulnerability Explorer | DOCS-VULN-29-012 | TODO | Publish `/docs/runbooks/vuln-ops.md`. | Docs & Ops Guilds | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 29 — Vulnerability Explorer | DOCS-VULN-29-013 | TODO | Update `/docs/install/containers.md` with Findings Ledger & Vuln Explorer API. | Docs & Deployment Guilds | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 29 — Vulnerability Explorer | DEPLOY-VULN-29-001 | TODO | Provide deployments for Findings Ledger/projector with migrations/backups. | Deployment & Findings Ledger Guilds | Path: ops/deployment | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 29 — Vulnerability Explorer | DEPLOY-VULN-29-002 | TODO | Package Vuln Explorer API deployments/health checks/offline kit notes. | Deployment & Vuln Explorer API Guilds | Path: ops/deployment | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 29 — Vulnerability Explorer | DEVOPS-VULN-29-001 | TODO | Set up CI/backups/anchoring monitoring for Findings Ledger. | DevOps & Findings Ledger Guilds | Path: ops/devops | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 29 — Vulnerability Explorer | DEVOPS-VULN-29-002 | TODO | Configure Vuln Explorer perf tests, budgets, dashboards, alerts. | DevOps & Vuln Explorer API Guilds | Path: ops/devops | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 29 — Vulnerability Explorer | DEVOPS-VULN-29-003 | TODO | Integrate Vuln Explorer telemetry pipeline with privacy safeguards + dashboards. | DevOps & Console Guilds | Path: ops/devops | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 29 — Vulnerability Explorer | AUTH-VULN-29-001 | TODO | Define Vuln Explorer RBAC/ABAC scopes and issuer metadata. | Authority Core & Security Guild | Path: src/Authority/StellaOps.Authority | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 29 — Vulnerability Explorer | AUTH-VULN-29-002 | TODO | Enforce CSRF, attachment signing, and audit logging referencing ledger hashes. | Authority Core & Security Guild | Path: src/Authority/StellaOps.Authority | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 29 — Vulnerability Explorer | AUTH-VULN-29-003 | TODO | Update docs/config samples for Vuln Explorer roles and security posture. | Authority Core & Docs Guild | Path: src/Authority/StellaOps.Authority | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 29 — Vulnerability Explorer | CLI-VULN-29-001 | TODO | Implement `stella vuln list` with grouping, filters, JSON/CSV output. | DevEx/CLI Guild | Path: src/Cli/StellaOps.Cli | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 29 — Vulnerability Explorer | CLI-VULN-29-002 | TODO | Implement `stella vuln show` with evidence/policy/path display. | DevEx/CLI Guild | Path: src/Cli/StellaOps.Cli | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 29 — Vulnerability Explorer | CLI-VULN-29-003 | TODO | Add workflow CLI commands (assign/comment/accept-risk/verify-fix/target-fix/reopen). | DevEx/CLI Guild | Path: src/Cli/StellaOps.Cli | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 29 — Vulnerability Explorer | CLI-VULN-29-004 | TODO | Implement `stella vuln simulate` producing diff summaries/Markdown. | DevEx/CLI Guild | Path: src/Cli/StellaOps.Cli | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 29 — Vulnerability Explorer | CLI-VULN-29-005 | TODO | Implement `stella vuln export` and bundle signature verification. | DevEx/CLI Guild | Path: src/Cli/StellaOps.Cli | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 29 — Vulnerability Explorer | CLI-VULN-29-006 | TODO | Update CLI docs/examples for Vulnerability Explorer commands. | DevEx/CLI & Docs Guilds | Path: src/Cli/StellaOps.Cli | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 29 — Vulnerability Explorer | CONCELIER-VULN-29-001 | TODO | Canonicalize (lossless) advisory identifiers, persist `links[]`, backfill, and expose raw payload snapshots (no merge/derived fields). | Concelier WebService Guild | Path: src/Concelier/StellaOps.Concelier.WebService | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 29 — Vulnerability Explorer | CONCELIER-VULN-29-002 | TODO | Provide advisory evidence retrieval endpoint for Vuln Explorer. | Concelier WebService Guild | Path: src/Concelier/StellaOps.Concelier.WebService | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 29 — Vulnerability Explorer | CONCELIER-VULN-29-004 | TODO | Add metrics/logs/events for advisory normalization supporting resolver. | Concelier WebService & Observability Guilds | Path: src/Concelier/StellaOps.Concelier.WebService | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 29 — Vulnerability Explorer | EXCITITOR-VULN-29-001 | TODO | Canonicalize (lossless) VEX keys and product scopes with backfill + links (no merge/suppression). | Excititor WebService Guild | Path: src/Excititor/StellaOps.Excititor.WebService | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 29 — Vulnerability Explorer | EXCITITOR-VULN-29-002 | TODO | Expose VEX evidence retrieval endpoint for Explorer evidence tabs. | Excititor WebService Guild | Path: src/Excititor/StellaOps.Excititor.WebService | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 29 — Vulnerability Explorer | EXCITITOR-VULN-29-004 | TODO | Instrument metrics/logs for VEX normalization and suppression events. | Excititor WebService & Observability Guilds | Path: src/Excititor/StellaOps.Excititor.WebService | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 29 — Vulnerability Explorer | LEDGER-29-001 | TODO | Design ledger & projection schemas, hashing strategy, and migrations for Findings Ledger. | Findings Ledger Guild | Path: src/Findings/StellaOps.Findings.Ledger | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 29 — Vulnerability Explorer | LEDGER-29-002 | TODO | Implement ledger write API with hash chaining and Merkle root anchoring job. | Findings Ledger Guild | Path: src/Findings/StellaOps.Findings.Ledger | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 29 — Vulnerability Explorer | LEDGER-29-003 | TODO | Build projector worker deriving `findings_projection` with idempotent replay. | Findings Ledger & Scheduler Guilds | Path: src/Findings/StellaOps.Findings.Ledger | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 29 — Vulnerability Explorer | LEDGER-29-004 | TODO | Integrate Policy Engine batch evaluation into projector with rationale caching. | Findings Ledger & Policy Guilds | Path: src/Findings/StellaOps.Findings.Ledger | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 29 — Vulnerability Explorer | LEDGER-29-005 | TODO | Implement workflow mutation endpoints producing ledger events (assign/comment/accept-risk/etc.). | Findings Ledger Guild | Path: src/Findings/StellaOps.Findings.Ledger | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 29 — Vulnerability Explorer | LEDGER-29-006 | TODO | Add attachment encryption, signed URLs, and CSRF protections for workflow endpoints. | Findings Ledger & Security Guilds | Path: src/Findings/StellaOps.Findings.Ledger | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 29 — Vulnerability Explorer | LEDGER-29-007 | TODO | Instrument ledger metrics/logs/alerts (write latency, projection lag, anchoring). | Findings Ledger & Observability Guilds | Path: src/Findings/StellaOps.Findings.Ledger | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 29 — Vulnerability Explorer | LEDGER-29-008 | TODO | Provide replay/determinism/load tests for ledger/projector pipelines. | Findings Ledger & QA Guilds | Path: src/Findings/StellaOps.Findings.Ledger | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 29 — Vulnerability Explorer | LEDGER-29-009 | TODO | Deliver deployment/offline artefacts, backup/restore, Merkle anchoring guidance. | Findings Ledger & DevOps Guilds | Path: src/Findings/StellaOps.Findings.Ledger | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 29 — Vulnerability Explorer | POLICY-ENGINE-29-001 | TODO | Implement policy batch evaluation endpoint returning determinations + rationale. | Policy Guild | Path: src/Policy/StellaOps.Policy.Engine | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 29 — Vulnerability Explorer | POLICY-ENGINE-29-002 | TODO | Provide simulation diff API for Vuln Explorer comparisons. | Policy Guild | Path: src/Policy/StellaOps.Policy.Engine | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 29 — Vulnerability Explorer | POLICY-ENGINE-29-003 | TODO | Include path/scope annotations in determinations for Explorer. | Policy Guild | Path: src/Policy/StellaOps.Policy.Engine | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 29 — Vulnerability Explorer | POLICY-ENGINE-29-004 | TODO | Add telemetry for batch evaluation + simulation jobs. | Policy Guild & Observability Guild | Path: src/Policy/StellaOps.Policy.Engine | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 29 — Vulnerability Explorer | SBOM-VULN-29-001 | TODO | Emit inventory evidence with scope/runtime/path/safe version hints; publish change events. | SBOM Service Guild | Path: src/SbomService/StellaOps.SbomService | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 29 — Vulnerability Explorer | SBOM-VULN-29-002 | TODO | Provide resolver feed for candidate generation with idempotent delivery. | SBOM Service & Findings Ledger Guilds | Path: src/SbomService/StellaOps.SbomService | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 29 — Vulnerability Explorer | SCHED-VULN-29-001 | TODO | Expose resolver job APIs + status monitoring for Vuln Explorer recomputation. | Scheduler WebService Guild | Path: src/Scheduler/StellaOps.Scheduler.WebService | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 29 — Vulnerability Explorer | SCHED-VULN-29-002 | TODO | Provide projector lag metrics endpoint + webhook notifications. | Scheduler WebService & Observability Guilds | Path: src/Scheduler/StellaOps.Scheduler.WebService | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 29 — Vulnerability Explorer | SCHED-WORKER-29-001 | TODO | Implement resolver worker applying ecosystem version semantics and path scope. | Scheduler Worker Guild | Path: src/Scheduler/__Libraries/StellaOps.Scheduler.Worker | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 29 — Vulnerability Explorer | SCHED-WORKER-29-002 | TODO | Implement evaluation worker invoking Policy Engine and updating ledger queues. | Scheduler Worker Guild | Path: src/Scheduler/__Libraries/StellaOps.Scheduler.Worker | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 29 — Vulnerability Explorer | SCHED-WORKER-29-003 | TODO | Add monitoring for resolver/evaluation backlog and SLA alerts. | Scheduler Worker & Observability Guilds | Path: src/Scheduler/__Libraries/StellaOps.Scheduler.Worker | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 29 — Vulnerability Explorer | VULN-API-29-001 | DONE (2025-11-25) | Publish Vuln Explorer OpenAPI + query schemas. | Vuln Explorer API Guild | Path: src/VulnExplorer/StellaOps.VulnExplorer.Api | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 29 — Vulnerability Explorer | VULN-API-29-002 | DONE (2025-11-25) | Implemented list/query endpoints with deterministic paging and tests. | Vuln Explorer API Guild | Path: src/VulnExplorer/StellaOps.VulnExplorer.Api | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 29 — Vulnerability Explorer | VULN-API-29-003 | DONE (2025-11-25) | Detail endpoint returns evidence, rationale, paths; integration tests in place. | Vuln Explorer API Guild | Path: src/VulnExplorer/StellaOps.VulnExplorer.Api | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 29 — Vulnerability Explorer | VULN-API-29-004 | TODO | Expose workflow APIs writing ledger events with validation + idempotency. | Vuln Explorer API & Findings Ledger Guilds | Path: src/VulnExplorer/StellaOps.VulnExplorer.Api | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 29 — Vulnerability Explorer | VULN-API-29-005 | TODO | Implement policy simulation endpoint producing diffs without side effects. | Vuln Explorer API & Policy Guilds | Path: src/VulnExplorer/StellaOps.VulnExplorer.Api | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 29 — Vulnerability Explorer | VULN-API-29-006 | TODO | Integrate Graph Explorer paths metadata and deep-link parameters. | Vuln Explorer API Guild | Path: src/VulnExplorer/StellaOps.VulnExplorer.Api | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 29 — Vulnerability Explorer | VULN-API-29-007 | TODO | Enforce RBAC/ABAC, CSRF, attachment security, and audit logging. | Vuln Explorer API & Security Guilds | Path: src/VulnExplorer/StellaOps.VulnExplorer.Api | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 29 — Vulnerability Explorer | VULN-API-29-008 | TODO | Provide evidence bundle export job with signing + manifests. | Vuln Explorer API Guild | Path: src/VulnExplorer/StellaOps.VulnExplorer.Api | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 29 — Vulnerability Explorer | VULN-API-29-009 | TODO | Instrument API telemetry (latency, workflow counts, exports). | Vuln Explorer API & Observability Guilds | Path: src/VulnExplorer/StellaOps.VulnExplorer.Api | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 29 — Vulnerability Explorer | VULN-API-29-010 | TODO | Deliver unit/integration/perf/determinism tests for Vuln Explorer API. | Vuln Explorer API & QA Guilds | Path: src/VulnExplorer/StellaOps.VulnExplorer.Api | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 29 — Vulnerability Explorer | VULN-API-29-011 | TODO | Ship deployment/offline manifests, health checks, scaling docs. | Vuln Explorer API & DevOps Guilds | Path: src/VulnExplorer/StellaOps.VulnExplorer.Api | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 29 — Vulnerability Explorer | WEB-VULN-29-001 | TODO | Route `/vuln/*` APIs with tenant RBAC, ABAC, anti-forgery enforcement. | BE-Base Platform Guild | Path: src/Web/StellaOps.Web | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 29 — Vulnerability Explorer | WEB-VULN-29-002 | TODO | Proxy workflow calls to Findings Ledger with correlation IDs + retries. | BE-Base Platform Guild | Path: src/Web/StellaOps.Web | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 29 — Vulnerability Explorer | WEB-VULN-29-003 | TODO | Expose simulation/export orchestration with SSE/progress + signed links. | BE-Base Platform Guild | Path: src/Web/StellaOps.Web | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 29 — Vulnerability Explorer | WEB-VULN-29-004 | TODO | Aggregate Vuln Explorer telemetry (latency, errors, exports). | BE-Base Platform & Observability Guilds | Path: src/Web/StellaOps.Web | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 30 — VEX Lens | DOCS-VEX-30-001 | TODO | Publish `/docs/vex/consensus-overview.md`. | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 30 — VEX Lens | DOCS-VEX-30-002 | TODO | Write `/docs/vex/consensus-algorithm.md`. | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 30 — VEX Lens | DOCS-VEX-30-003 | TODO | Document `/docs/vex/issuer-directory.md`. | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 30 — VEX Lens | DOCS-VEX-30-004 | TODO | Publish `/docs/vex/consensus-api.md`. | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 30 — VEX Lens | DOCS-VEX-30-005 | TODO | Create `/docs/vex/consensus-console.md`. | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 30 — VEX Lens | DOCS-VEX-30-006 | TODO | Add `/docs/policy/vex-trust-model.md`. | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 30 — VEX Lens | DOCS-VEX-30-007 | TODO | Author `/docs/sbom/vex-mapping.md`. | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 30 — VEX Lens | DOCS-VEX-30-008 | TODO | Publish `/docs/security/vex-signatures.md`. | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 30 — VEX Lens | DOCS-VEX-30-009 | TODO | Write `/docs/runbooks/vex-ops.md`. | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 30 — VEX Lens | VEXLENS-30-009, ISSUER-30-005 | TODO | Set up CI/perf/telemetry dashboards for VEX Lens and Issuer Directory. | DevOps Guild | Path: ops/devops | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 30 — VEX Lens | VEXLENS-30-007 | TODO | Implement `stella vex consensus` CLI commands with list/show/simulate/export. | DevEx/CLI Guild | Path: src/Cli/StellaOps.Cli | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 30 — VEX Lens | CONCELIER-VEXLENS-30-001 | TODO | Guarantee advisory key consistency and provide cross-links for consensus rationale (VEX Lens). | Concelier WebService Guild, VEX Lens Guild | Path: src/Concelier/StellaOps.Concelier.WebService | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 30 — VEX Lens | EXCITITOR-VULN-29-001 | TODO | Ensure VEX evidence includes issuer hints, signatures, product trees for Lens consumption. | Excititor WebService Guild | Path: src/Excititor/StellaOps.Excititor.WebService | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 30 — VEX Lens | ISSUER-30-001 | TODO | Implement issuer CRUD API with RBAC and audit logs. | Issuer Directory Guild | Path: src/IssuerDirectory/StellaOps.IssuerDirectory | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 30 — VEX Lens | ISSUER-30-002 | TODO | Implement key management endpoints with expiry enforcement. | Issuer Directory & Security Guilds | Path: src/IssuerDirectory/StellaOps.IssuerDirectory | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 30 — VEX Lens | ISSUER-30-003 | TODO | Provide trust weight override APIs with audit trails. | Issuer Directory & Policy Guilds | Path: src/IssuerDirectory/StellaOps.IssuerDirectory | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 30 — VEX Lens | ISSUER-30-004 | TODO | Integrate issuer data into signature verification clients. | Issuer Directory & VEX Lens Guilds | Path: src/IssuerDirectory/StellaOps.IssuerDirectory | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 30 — VEX Lens | ISSUER-30-005 | TODO | Instrument issuer change metrics/logs and dashboards. | Issuer Directory & Observability Guilds | Path: src/IssuerDirectory/StellaOps.IssuerDirectory | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 30 — VEX Lens | ISSUER-30-006 | TODO | Provide deployment/backup/offline docs for Issuer Directory. | Issuer Directory & DevOps Guilds | Path: src/IssuerDirectory/StellaOps.IssuerDirectory | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 30 — VEX Lens | POLICY-ENGINE-30-101 | TODO | Surface trust weighting configuration (issuer weights, modifiers, decay) for VEX Lens via Policy Studio/API. | Policy Guild | Path: src/Policy/StellaOps.Policy.Engine | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 30 — VEX Lens | VEXLENS-30-001 | TODO | Implement VEX normalization pipeline (CSAF, OpenVEX, CycloneDX) with deterministic outputs. | VEX Lens Guild | Path: src/VexLens/StellaOps.VexLens | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 30 — VEX Lens | VEXLENS-30-002 | TODO | Build product mapping library aligning CSAF product trees to purls/versions with scope scoring. | VEX Lens Guild | Path: src/VexLens/StellaOps.VexLens | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 30 — VEX Lens | VEXLENS-30-003 | TODO | Integrate signature verification using issuer keys; annotate evidence. | VEX Lens & Issuer Directory Guilds | Path: src/VexLens/StellaOps.VexLens | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 30 — VEX Lens | VEXLENS-30-004 | TODO | Implement trust weighting functions configurable via policy. | VEX Lens & Policy Guilds | Path: src/VexLens/StellaOps.VexLens | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 30 — VEX Lens | VEXLENS-30-005 | TODO | Implement consensus algorithm producing state, confidence, rationale, and quorum. | VEX Lens Guild | Path: src/VexLens/StellaOps.VexLens | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 30 — VEX Lens | VEXLENS-30-006 | TODO | Materialize consensus projections and change events. | VEX Lens & Findings Ledger Guilds | Path: src/VexLens/StellaOps.VexLens | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 30 — VEX Lens | VEXLENS-30-007 | TODO | Deliver query/detail/simulation/export APIs with budgets and OpenAPI docs. | VEX Lens Guild | Path: src/VexLens/StellaOps.VexLens | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 30 — VEX Lens | VEXLENS-30-008 | TODO | Integrate consensus signals with Policy Engine and Vuln Explorer. | VEX Lens & Policy Guilds | Path: src/VexLens/StellaOps.VexLens | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 30 — VEX Lens | VEXLENS-30-009 | TODO | Instrument metrics/logs/traces; publish dashboards/alerts. | VEX Lens & Observability Guilds | Path: src/VexLens/StellaOps.VexLens | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 30 — VEX Lens | VEXLENS-30-010 | TODO | Build unit/property/integration/load tests and determinism harness. | VEX Lens & QA Guilds | Path: src/VexLens/StellaOps.VexLens | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 30 — VEX Lens | VEXLENS-30-011 | TODO | Provide deployment manifests, scaling guides, offline seeds, runbooks. | VEX Lens & DevOps Guilds | Path: src/VexLens/StellaOps.VexLens | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 30 — VEX Lens | WEB-VEX-30-007 | TODO | Route `/vex/consensus` APIs via gateway with RBAC/ABAC, caching, and telemetry (proxy-only). | BE-Base Platform Guild, VEX Lens Guild | Path: src/Web/StellaOps.Web | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 31 — Advisory AI | DOCS-AIAI-31-001 | TODO | Publish Advisory AI overview doc. | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 31 — Advisory AI | DOCS-AIAI-31-002 | TODO | Publish architecture doc for Advisory AI. | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 31 — Advisory AI | DOCS-AIAI-31-003..009 | TODO | Complete API/Console/CLI/Policy/Security/SBOM/Runbook docs. | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 31 — Advisory AI | DEPLOY-AIAI-31-001 | TODO | Provide Advisory AI deployment/offline guidance. | Deployment Guild | Path: ops/deployment | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 31 — Advisory AI | DEVOPS-AIAI-31-001 | TODO | Provision CI/perf/telemetry for Advisory AI. | DevOps Guild | Path: ops/devops | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 31 — Advisory AI | AIAI-31-001 | TODO | Implement advisory/VEX retrievers with paragraph anchors and citations. | Advisory AI Guild | Path: src/AdvisoryAI/StellaOps.AdvisoryAI | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 31 — Advisory AI | AIAI-31-002 | TODO | Build SBOM context retriever and blast radius estimator. | Advisory AI Guild | Path: src/AdvisoryAI/StellaOps.AdvisoryAI | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 31 — Advisory AI | AIAI-31-003 | TODO | Deliver deterministic toolset (version checks, dependency analysis, policy lookup). | Advisory AI Guild | Path: src/AdvisoryAI/StellaOps.AdvisoryAI | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 31 — Advisory AI | AIAI-31-004 | TODO | Orchestrator with task templates, tool chaining, caching. | Advisory AI Guild | Path: src/AdvisoryAI/StellaOps.AdvisoryAI | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 31 — Advisory AI | AIAI-31-005 | TODO | Guardrails (redaction, injection defense, output validation). | Advisory AI & Security Guilds | Path: src/AdvisoryAI/StellaOps.AdvisoryAI | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 31 — Advisory AI | AIAI-31-006 | TODO | Expose REST/batch APIs with RBAC and OpenAPI. | Advisory AI Guild | Path: src/AdvisoryAI/StellaOps.AdvisoryAI | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 31 — Advisory AI | AIAI-31-007 | TODO | Instrument metrics/logs/traces and dashboards. | Advisory AI & Observability Guilds | Path: src/AdvisoryAI/StellaOps.AdvisoryAI | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 31 — Advisory AI | AIAI-31-008 | TODO | Package inference + deployment manifests/flags. | Advisory AI & DevOps Guilds | Path: src/AdvisoryAI/StellaOps.AdvisoryAI | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 31 — Advisory AI | AIAI-31-009 | TODO | Build golden/injection/perf tests ensuring determinism. | Advisory AI & QA Guilds | Path: src/AdvisoryAI/StellaOps.AdvisoryAI | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 31 — Advisory AI | AUTH-AIAI-31-001 | TODO | Define Advisory AI scopes and remote inference toggles. | Authority Core & Security Guild | Path: src/Authority/StellaOps.Authority | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 31 — Advisory AI | AUTH-AIAI-31-002 | TODO | Enforce prompt logging and consent/audit flows. | Authority Core & Security Guild | Path: src/Authority/StellaOps.Authority | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 31 — Advisory AI | CLI-AIAI-31-001 | TODO | Implement `stella advise *` CLI commands leveraging Advisory AI orchestration and policy scopes. | DevEx/CLI Guild | Path: src/Cli/StellaOps.Cli | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 31 — Advisory AI | CONCELIER-AIAI-31-001 | TODO | Expose advisory chunk API with paragraph anchors. | Concelier WebService Guild | Path: src/Concelier/StellaOps.Concelier.WebService | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 31 — Advisory AI | EXCITITOR-AIAI-31-001 | TODO | Provide VEX chunks with justifications and signatures. | Excititor WebService Guild | Path: src/Excititor/StellaOps.Excititor.WebService | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 31 — Advisory AI | POLICY-ENGINE-31-001 | TODO | Provide policy knobs for Advisory AI. | Policy Guild | Path: src/Policy/StellaOps.Policy.Engine | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 31 — Advisory AI | SBOM-AIAI-31-001 | TODO | Deliver SBOM path/timeline endpoints for Advisory AI. | SBOM Service Guild | Path: src/SbomService/StellaOps.SbomService | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 31 — Advisory AI | VEXLENS-AIAI-31-001 | TODO | Expose enriched rationale API for conflict explanations. | VEX Lens Guild | Path: src/VexLens/StellaOps.VexLens | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 31 — Advisory AI | VEXLENS-AIAI-31-002 | TODO | Provide batching/caching hooks for Advisory AI. | VEX Lens Guild | Path: src/VexLens/StellaOps.VexLens | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 31 — Advisory AI | WEB-AIAI-31-001 | TODO | Route `/advisory/ai/*` APIs with RBAC/telemetry. | BE-Base Platform Guild | Path: src/Web/StellaOps.Web | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 31 — Advisory AI | WEB-AIAI-31-002 | TODO | Provide batch orchestration and retry handling for Advisory AI. | BE-Base Platform Guild | Path: src/Web/StellaOps.Web | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 31 — Advisory AI | WEB-AIAI-31-003 | TODO | Emit Advisory AI gateway telemetry/audit logs. | BE-Base Platform Guild | Path: src/Web/StellaOps.Web | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 32 — Orchestrator Dashboard | DOCS-ORCH-32-001 | TODO | Author `/docs/orchestrator/overview.md` covering mission, roles, AOC alignment, and imposed rule reminder. | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 32 — Orchestrator Dashboard | DOCS-ORCH-32-002 | TODO | Author `/docs/orchestrator/architecture.md` detailing scheduler, DAGs, rate limits, and data model. | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 32 — Orchestrator Dashboard | DEVOPS-ORCH-32-001 | TODO | Provision staging Postgres/message-bus charts, CI smoke deploy, and baseline dashboards for queue depth and inflight jobs. | DevOps Guild | Path: ops/devops | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 32 — Orchestrator Dashboard | AUTH-ORCH-32-001 | TODO | Introduce `orch:read` scope and `Orch.Viewer` role with metadata, discovery docs, and offline defaults. | Authority Core & Security Guild | Path: src/Authority/StellaOps.Authority | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 32 — Orchestrator Dashboard | CONCELIER-ORCH-32-001 | TODO | Register Concelier sources with orchestrator, publish schedules/rate policies, and seed metadata. | Concelier Core Guild | Path: src/Concelier/__Libraries/StellaOps.Concelier.Core | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 32 — Orchestrator Dashboard | CONCELIER-ORCH-32-002 | TODO | Embed worker SDK into Concelier ingestion loops emitting progress, heartbeats, and artifact hashes. | Concelier Core Guild | Path: src/Concelier/__Libraries/StellaOps.Concelier.Core | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 32 — Orchestrator Dashboard | EXCITITOR-ORCH-32-001 | TODO | Adopt worker SDK in Excititor worker with job claim/heartbeat and artifact summary emission. | Excititor Worker Guild | Path: src/Excititor/StellaOps.Excititor.Worker | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 32 — Orchestrator Dashboard | WORKER-GO-32-001 | TODO | Bootstrap Go worker SDK (client config, job claim, acknowledgement flow) with integration tests. | Worker SDK Guild | Path: src/Orchestrator/StellaOps.Orchestrator.WorkerSdk.Go | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 32 — Orchestrator Dashboard | WORKER-GO-32-002 | TODO | Add heartbeat/progress helpers, structured logging, and default metrics exporters to Go SDK. | Worker SDK Guild | Path: src/Orchestrator/StellaOps.Orchestrator.WorkerSdk.Go | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 32 — Orchestrator Dashboard | WORKER-PY-32-001 | TODO | Bootstrap Python async SDK with job claim/config adapters and sample worker. | Worker SDK Guild | Path: src/Orchestrator/StellaOps.Orchestrator.WorkerSdk.Python | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 32 — Orchestrator Dashboard | WORKER-PY-32-002 | TODO | Implement heartbeat/progress helpers and logging/metrics instrumentation for Python workers. | Worker SDK Guild | Path: src/Orchestrator/StellaOps.Orchestrator.WorkerSdk.Python | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 32 — Orchestrator Dashboard | ORCH-SVC-32-001 | TODO | Bootstrap orchestrator service with Postgres schema/migrations for sources, runs, jobs, dag_edges, artifacts, quotas, schedules. | Orchestrator Service Guild | Path: src/Orchestrator/StellaOps.Orchestrator | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 32 — Orchestrator Dashboard | ORCH-SVC-32-002 | TODO | Implement scheduler DAG planner, dependency resolver, and job state machine for read-only tracking. | Orchestrator Service Guild | Path: src/Orchestrator/StellaOps.Orchestrator | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 32 — Orchestrator Dashboard | ORCH-SVC-32-003 | TODO | Expose read-only REST APIs (sources, runs, jobs, DAG) with OpenAPI + validation. | Orchestrator Service Guild | Path: src/Orchestrator/StellaOps.Orchestrator | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 32 — Orchestrator Dashboard | ORCH-SVC-32-004 | TODO | Ship WebSocket/SSE live update stream and metrics counters/histograms for job lifecycle. | Orchestrator Service Guild | Path: src/Orchestrator/StellaOps.Orchestrator | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 32 — Orchestrator Dashboard | ORCH-SVC-32-005 | TODO | Deliver worker claim/heartbeat/progress endpoints capturing artifact metadata and checksums. | Orchestrator Service Guild | Path: src/Orchestrator/StellaOps.Orchestrator | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 32 — Orchestrator Dashboard | POLICY-ENGINE-32-101 | TODO | Define orchestrator `policy_eval` job contract, idempotency keys, and enqueue hooks for change events. | Policy Guild | Path: src/Policy/StellaOps.Policy.Engine | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 32 — Orchestrator Dashboard | SBOM-ORCH-32-001 | TODO | Integrate orchestrator job IDs into SBOM ingest/index pipelines with artifact hashing and status updates. | SBOM Service Guild | Path: src/SbomService/StellaOps.SbomService | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 32 — Orchestrator Dashboard | WEB-ORCH-32-001 | TODO | Expose read-only orchestrator APIs via gateway with tenant scoping, caching headers, and rate limits. | BE-Base Platform Guild | Path: src/Web/StellaOps.Web | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 33 — Orchestrator Dashboard | DOCS-ORCH-33-001 | TODO | Author `/docs/orchestrator/api.md` with endpoints, WebSocket events, error codes, and imposed rule reminder. | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 33 — Orchestrator Dashboard | DOCS-ORCH-33-002 | TODO | Author `/docs/orchestrator/console.md` covering screens, accessibility, and live updates. | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 33 — Orchestrator Dashboard | DOCS-ORCH-33-003 | TODO | Author `/docs/orchestrator/cli.md` with command reference, examples, and exit codes. | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 33 — Governance & Rules | DEVOPS-RULES-33-001 | REVIEW (2025-10-30) | Contracts & Rules anchor (gateway proxy-only; Policy Engine overlays/simulations; AOC ingestion canonicalization; Graph Indexer + Graph API as sole platform). | DevOps Guild, Platform Leads | Path: ops/devops | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 33 — Orchestrator Dashboard | DEVOPS-ORCH-33-001 | TODO | Publish Grafana dashboards for rate-limit/backpressure/error clustering and configure alert rules with runbooks. | DevOps Guild | Path: ops/devops | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 33 — Orchestrator Dashboard | AUTH-ORCH-33-001 | TODO | Add `Orch.Operator` role, control action scopes, and enforce reason/ticket field capture. | Authority Core & Security Guild | Path: src/Authority/StellaOps.Authority | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 33 — Orchestrator Dashboard | CONCELIER-ORCH-33-001 | TODO | Wire orchestrator control hooks (pause, throttle, retry) into Concelier workers with safe checkpoints. | Concelier Core Guild | Path: src/Concelier/__Libraries/StellaOps.Concelier.Core | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 33 — Orchestrator Dashboard | EXCITITOR-ORCH-33-001 | TODO | Honor orchestrator throttles, classify VEX errors, and emit retry-safe checkpoints in Excititor worker. | Excititor Worker Guild | Path: src/Excititor/StellaOps.Excititor.Worker | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 33 — Orchestrator Dashboard | WORKER-GO-33-001 | TODO | Add artifact upload helpers (object store + checksum) and idempotency guard to Go SDK. | Worker SDK Guild | Path: src/Orchestrator/StellaOps.Orchestrator.WorkerSdk.Go | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 33 — Orchestrator Dashboard | WORKER-GO-33-002 | TODO | Implement error classification/retry helper and structured failure report in Go SDK. | Worker SDK Guild | Path: src/Orchestrator/StellaOps.Orchestrator.WorkerSdk.Go | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 33 — Orchestrator Dashboard | WORKER-PY-33-001 | TODO | Add artifact publish/idempotency features to Python SDK with object store integration. | Worker SDK Guild | Path: src/Orchestrator/StellaOps.Orchestrator.WorkerSdk.Python | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 33 — Orchestrator Dashboard | WORKER-PY-33-002 | TODO | Expose error classification/retry/backoff helpers in Python SDK with structured logging. | Worker SDK Guild | Path: src/Orchestrator/StellaOps.Orchestrator.WorkerSdk.Python | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 33 — Orchestrator Dashboard | ORCH-SVC-33-001 | TODO | Enable source/job control actions (test, pause/resume, retry/cancel/prioritize) with RBAC and audit hooks. | Orchestrator Service Guild | Path: src/Orchestrator/StellaOps.Orchestrator | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 33 — Orchestrator Dashboard | ORCH-SVC-33-002 | TODO | Implement adaptive token-bucket rate limiter and concurrency caps reacting to upstream 429/503 signals. | Orchestrator Service Guild | Path: src/Orchestrator/StellaOps.Orchestrator | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 33 — Orchestrator Dashboard | ORCH-SVC-33-003 | TODO | Add watermark/backfill manager with event-time windows, duplicate suppression, and preview API. | Orchestrator Service Guild | Path: src/Orchestrator/StellaOps.Orchestrator | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 33 — Orchestrator Dashboard | ORCH-SVC-33-004 | TODO | Deliver dead-letter storage, replay endpoints, and surfaced error classes with remediation hints. | Orchestrator Service Guild | Path: src/Orchestrator/StellaOps.Orchestrator | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 33 — Orchestrator Dashboard | POLICY-ENGINE-33-101 | TODO | Implement orchestrator-driven policy evaluation workers with heartbeats, SLO metrics, and rate limit awareness. | Policy Guild | Path: src/Policy/StellaOps.Policy.Engine | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 33 — Orchestrator Dashboard | SBOM-ORCH-33-001 | TODO | Report SBOM ingest backpressure metrics and support orchestrator pause/resume/backfill signals. | SBOM Service Guild | Path: src/SbomService/StellaOps.SbomService | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 33 — Orchestrator Dashboard | VEXLENS-ORCH-33-001 | TODO | Expose `consensus_compute` orchestrator job type and integrate VEX Lens worker for diff batches. | VEX Lens Guild | Path: src/VexLens/StellaOps.VexLens | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 33 — Orchestrator Dashboard | WEB-ORCH-33-001 | TODO | Add control endpoints (actions/backfill) and SSE bridging with permission checks and error mapping. | BE-Base Platform Guild | Path: src/Web/StellaOps.Web | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 34 — Orchestrator Dashboard | DOCS-ORCH-34-001 | TODO | Author `/docs/orchestrator/run-ledger.md` describing provenance export format and audits. | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 34 — Orchestrator Dashboard | DOCS-ORCH-34-002 | TODO | Author `/docs/security/secrets-handling.md` covering KMS refs, redaction, and operator hygiene. | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 34 — Orchestrator Dashboard | DOCS-ORCH-34-003 | TODO | Author `/docs/operations/orchestrator-runbook.md` (failures, backfill guide, circuit breakers). | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 34 — Orchestrator Dashboard | DOCS-ORCH-34-004 | TODO | Author `/docs/schemas/artifacts.md` detailing artifact kinds, schema versions, hashing, storage layout. | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 34 — Orchestrator Dashboard | DOCS-ORCH-34-005 | TODO | Author `/docs/slo/orchestrator-slo.md` defining SLOs, burn alerts, and measurement strategy. | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 34 — Orchestrator Dashboard | DEPLOY-ORCH-34-001 | TODO | Provide Helm/Compose manifests, scaling defaults, and offline kit instructions for orchestrator service. | Deployment Guild | Path: ops/deployment | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 34 — Orchestrator Dashboard | DEVOPS-ORCH-34-001 | TODO | Harden production dashboards/alerts, synthetic probes, and incident response playbooks for orchestrator. | DevOps Guild | Path: ops/devops | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 34 — Orchestrator Dashboard | DEVOPS-OFFLINE-34-006 | TODO | Bundle orchestrator service, worker SDK samples, and Postgres snapshot into Offline Kit with integrity checks. | Offline Kit Guild | Path: ops/offline-kit | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 34 — Orchestrator Dashboard | AUTH-ORCH-34-001 | TODO | Add `Orch.Admin` role for quotas/backfills, enforce audit reason requirements, update docs and offline defaults. | Authority Core & Security Guild | Path: src/Authority/StellaOps.Authority | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 34 — Orchestrator Dashboard | CLI-ORCH-34-001 | TODO | Implement backfill wizard and quota management commands with dry-run preview and guardrails. | DevEx/CLI Guild | Path: src/Cli/StellaOps.Cli | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 34 — Orchestrator Dashboard | CONCELIER-ORCH-34-001 | TODO | Implement orchestrator-driven backfills for advisory sources with idempotent artifact reuse and ledger linkage. | Concelier Core Guild | Path: src/Concelier/__Libraries/StellaOps.Concelier.Core | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 34 — Orchestrator Dashboard | EXCITITOR-ORCH-34-001 | TODO | Support orchestrator backfills and circuit breaker resets for Excititor sources with auditing. | Excititor Worker Guild | Path: src/Excititor/StellaOps.Excititor.Worker | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 34 — Orchestrator Dashboard | LEDGER-34-101 | TODO | Link orchestrator run ledger entries into Findings Ledger provenance export and audit queries. | Findings Ledger Guild | Path: src/Findings/StellaOps.Findings.Ledger | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 34 — Orchestrator Dashboard | WORKER-GO-34-001 | TODO | Add backfill range execution, watermark handshake, and artifact dedupe verification to Go SDK. | Worker SDK Guild | Path: src/Orchestrator/StellaOps.Orchestrator.WorkerSdk.Go | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 34 — Orchestrator Dashboard | WORKER-PY-34-001 | TODO | Add backfill support and deterministic artifact dedupe validation to Python SDK. | Worker SDK Guild | Path: src/Orchestrator/StellaOps.Orchestrator.WorkerSdk.Python | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 34 — Orchestrator Dashboard | ORCH-SVC-34-001 | TODO | Implement quota management APIs, SLO burn-rate computation, and alert budget tracking. | Orchestrator Service Guild | Path: src/Orchestrator/StellaOps.Orchestrator | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 34 — Orchestrator Dashboard | ORCH-SVC-34-002 | TODO | Build audit log and immutable run ledger export with signed manifest support. | Orchestrator Service Guild | Path: src/Orchestrator/StellaOps.Orchestrator | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 34 — Orchestrator Dashboard | ORCH-SVC-34-003 | TODO | Run perf/scale validation (10k jobs, dispatch <150 ms) and add autoscaling hooks. | Orchestrator Service Guild | Path: src/Orchestrator/StellaOps.Orchestrator | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 34 — Orchestrator Dashboard | ORCH-SVC-34-004 | TODO | Package orchestrator container, Helm overlays, offline bundle seeds, and provenance attestations. | Orchestrator Service Guild | Path: src/Orchestrator/StellaOps.Orchestrator | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 34 — Orchestrator Dashboard | POLICY-ENGINE-34-101 | TODO | Expose policy eval run ledger exports and SLO burn metrics to orchestrator. | Policy Guild | Path: src/Policy/StellaOps.Policy.Engine | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 34 — Orchestrator Dashboard | SBOM-ORCH-34-001 | TODO | Enable SBOM backfill and watermark reconciliation; emit coverage metrics and flood guard. | SBOM Service Guild | Path: src/SbomService/StellaOps.SbomService | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 34 — Orchestrator Dashboard | VEXLENS-ORCH-34-001 | TODO | Integrate consensus compute completion events with orchestrator ledger and provenance outputs. | VEX Lens Guild | Path: src/VexLens/StellaOps.VexLens | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 34 — Orchestrator Dashboard | WEB-ORCH-34-001 | TODO | Expose quotas/backfill/queue metrics endpoints, throttle toggles, and error clustering APIs. | BE-Base Platform Guild | Path: src/Web/StellaOps.Web | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 35 — EPDR Foundations | SCANNER-ANALYZERS-LANG-11-001 | TODO | Build entrypoint resolver (identity + environment profiles) and emit normalized entrypoint records. | Scanner EPDR Guild | Path: src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.DotNet | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 35 — EPDR Foundations | SCANNER-ANALYZERS-LANG-11-002 | TODO | Static IL/reflection/ALC heuristics producing dependency edges with reason codes and confidence. | Scanner EPDR Guild | Path: src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.DotNet | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 35 — EPDR Foundations | SCANNER-ANALYZERS-LANG-11-003 | TODO | Runtime loader/PInvoke signal ingestion merged with static/declared edges (confidence & explain). | Scanner EPDR Guild, Signals Guild | Path: src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.DotNet | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 35 — Export Center Phase 1 | DOCS-EXPORT-35-001 | TODO | Author `/docs/modules/export-center/overview.md` with purpose, profiles, security, and imposed rule reminder. | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 35 — Export Center Phase 1 | DOCS-EXPORT-35-002 | TODO | Author `/docs/modules/export-center/architecture.md` detailing service components, adapters, manifests, signing, and distribution. | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 35 — Export Center Phase 1 | DOCS-EXPORT-35-003 | TODO | Publish `/docs/modules/export-center/profiles.md` covering schemas, examples, and compatibility. | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 35 — Export Center Phase 1 | DEPLOY-EXPORT-35-001 | TODO | Package exporter service/worker containers, Helm overlays (download-only), and rollout guide. | Deployment Guild | Path: ops/deployment | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 35 — Export Center Phase 1 | DEVOPS-EXPORT-35-001 | TODO | Create exporter CI pipeline (lint/test/perf smoke), object storage fixtures, and initial Grafana dashboards. | DevOps Guild | Path: ops/devops | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 35 — Export Center Phase 1 | EXPORT-SVC-35-001 | TODO | Bootstrap exporter service, configuration, and migrations for export profiles/runs/inputs/distributions with tenant scopes. | Exporter Service Guild | Path: src/ExportCenter/StellaOps.ExportCenter | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 35 — Export Center Phase 1 | EXPORT-SVC-35-002 | TODO | Implement planner resolving filters to iterators and orchestrator job contract with deterministic sampling. | Exporter Service Guild | Path: src/ExportCenter/StellaOps.ExportCenter | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 35 — Export Center Phase 1 | EXPORT-SVC-35-003 | TODO | Deliver JSON adapters (raw/policy) with canonical normalization, redaction enforcement, and zstd writers. | Exporter Service Guild | Path: src/ExportCenter/StellaOps.ExportCenter | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 35 — Export Center Phase 1 | EXPORT-SVC-35-004 | TODO | Build mirror (full) adapter producing filesystem layout, manifests, and bundle assembly for download profile. | Exporter Service Guild | Path: src/ExportCenter/StellaOps.ExportCenter | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 35 — Export Center Phase 1 | EXPORT-SVC-35-005 | TODO | Implement manifest/provenance writer and KMS signing/attestation for export bundles. | Exporter Service Guild | Path: src/ExportCenter/StellaOps.ExportCenter | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 35 — Export Center Phase 1 | EXPORT-SVC-35-006 | TODO | Expose Export API (profiles, runs, download) with SSE updates, concurrency controls, and audit logging. | Exporter Service Guild | Path: src/ExportCenter/StellaOps.ExportCenter | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 35 — Export Center Phase 1 | LEDGER-EXPORT-35-001 | TODO | Provide paginated streaming endpoints for advisories, VEX, SBOMs, and findings filtered by scope selectors. | Findings Ledger Guild | Path: src/Findings/StellaOps.Findings.Ledger | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 35 — Export Center Phase 1 | ORCH-SVC-35-101 | TODO | Register export job type, quotas, and rate policies; surface export job telemetry for scheduler. | Orchestrator Service Guild | Path: src/Orchestrator/StellaOps.Orchestrator | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 35 — Export Center Phase 1 | POLICY-ENGINE-35-201 | TODO | Expose deterministic policy snapshot + evaluated findings endpoint aligned with Export Center requirements. | Policy Guild | Path: src/Policy/StellaOps.Policy.Engine | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 35 — Export Center Phase 1 | VEXLENS-EXPORT-35-001 | TODO | Publish consensus snapshot API delivering deterministic JSON for export consumption. | VEX Lens Guild | Path: src/VexLens/StellaOps.VexLens | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 35 — Export Center Phase 1 | WEB-EXPORT-35-001 | TODO | Route Export Center APIs through gateway with tenant scoping, viewer/operator scopes, and streaming downloads. | BE-Base Platform Guild | Path: src/Web/StellaOps.Web | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 36 — EPDR Observations | SCANNER-ANALYZERS-LANG-11-004 | TODO | Normalize EPDR output to Scanner observation writer (entrypoints + edges + env profiles). | Scanner EPDR Guild, SBOM Service Guild | Path: src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.DotNet | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 36 — EPDR Observations | SCANNER-ANALYZERS-LANG-11-005 | TODO | End-to-end fixtures/benchmarks covering publish modes, RIDs, trimming, NativeAOT with explain traces. | Scanner EPDR Guild, QA Guild | Path: src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.DotNet | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 36 — Export Center Phase 2 | DOCS-EXPORT-36-004 | TODO | Author `/docs/modules/export-center/api.md` with endpoint examples and imposed rule note. | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 36 — Export Center Phase 2 | DOCS-EXPORT-36-005 | TODO | Publish `/docs/modules/export-center/cli.md` covering commands, scripts, verification, and imposed rule reminder. | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 36 — Export Center Phase 2 | DOCS-EXPORT-36-006 | TODO | Write `/docs/modules/export-center/trivy-adapter.md` detailing mappings, compatibility, and test matrix. | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 36 — Export Center Phase 2 | DEPLOY-EXPORT-36-001 | TODO | Document registry credentials, OCI push workflows, and automation for export distributions. | Deployment Guild | Path: ops/deployment | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 36 — Export Center Phase 2 | DEVOPS-EXPORT-36-001 | TODO | Integrate Trivy compatibility validation, OCI push smoke tests, and metrics dashboards for export throughput. | DevOps Guild | Path: ops/devops | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 36 — Export Center Phase 2 | CLI-EXPORT-36-001 | TODO | Add `stella export distribute` (OCI/objstore), `run download --resume`, and status polling enhancements. | DevEx/CLI Guild | Path: src/Cli/StellaOps.Cli | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 36 — Export Center Phase 2 | EXPORT-SVC-36-001 | TODO | Implement Trivy DB adapter (core) with schema mapping, validation, and compatibility gating. | Exporter Service Guild | Path: src/ExportCenter/StellaOps.ExportCenter | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 36 — Export Center Phase 2 | EXPORT-SVC-36-002 | TODO | Add Trivy Java DB variant, shared manifest entries, and adapter regression tests. | Exporter Service Guild | Path: src/ExportCenter/StellaOps.ExportCenter | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 36 — Export Center Phase 2 | EXPORT-SVC-36-003 | TODO | Build OCI distribution engine for exports with descriptor annotations and registry auth handling. | Exporter Service Guild | Path: src/ExportCenter/StellaOps.ExportCenter | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 36 — Export Center Phase 2 | EXPORT-SVC-36-004 | TODO | Extend planner/run lifecycle for OCI/object storage distributions with retry + idempotency. | Exporter Service Guild | Path: src/ExportCenter/StellaOps.ExportCenter | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 36 — Export Center Phase 2 | ORCH-SVC-36-101 | TODO | Add distribution job follow-ups, retention metadata, and metrics for export runs. | Orchestrator Service Guild | Path: src/Orchestrator/StellaOps.Orchestrator | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 36 — Export Center Phase 2 | WEB-EXPORT-36-001 | TODO | Expose distribution endpoints (OCI/object storage) and manifest/provenance download proxies with RBAC. | BE-Base Platform Guild | Path: src/Web/StellaOps.Web | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 37 — Export Center Phase 3 | DOCS-EXPORT-37-001 | TODO | Publish `/docs/modules/export-center/mirror-bundles.md` detailing layouts, deltas, encryption, imposed rule reminder. | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 37 — Export Center Phase 3 | DOCS-EXPORT-37-002 | TODO | Publish `/docs/modules/export-center/provenance-and-signing.md` covering manifests, attestation, verification. | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 37 — Export Center Phase 3 | DOCS-EXPORT-37-003 | TODO | Publish `/docs/operations/export-runbook.md` for failures, tuning, capacity, with imposed rule note. | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 37 — Export Center Phase 3 | DOCS-EXPORT-37-004 | TODO | Publish `/docs/security/export-hardening.md` covering RBAC, isolation, encryption, and imposed rule. | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 37 — Export Center Phase 3 | DEVOPS-EXPORT-37-001 | TODO | Finalize dashboards/alerts for exports (failure, verify), retention jobs, and chaos testing harness. | DevOps Guild | Path: ops/devops | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 37 — Export Center Phase 3 | DEVOPS-OFFLINE-37-001 | TODO | Package Export Center mirror bundles + verification tooling into Offline Kit with manifest/signature updates. | Offline Kit Guild | Path: ops/offline-kit | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 37 — Export Center Phase 3 | AUTH-EXPORT-37-001 | TODO | Add `Export.Admin` scope enforcement for retention, encryption keys, and scheduling APIs. | Authority Core & Security Guild | Path: src/Authority/StellaOps.Authority | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 37 — Export Center Phase 3 | CLI-EXPORT-37-001 | TODO | Implement `stella export schedule`, `run verify`, and bundle verification tooling with signature/hash checks. | DevEx/CLI Guild | Path: src/Cli/StellaOps.Cli | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 37 — Export Center Phase 3 | EXPORT-SVC-37-001 | TODO | Implement mirror delta adapter, base export linkage, and content-addressed reuse. | Exporter Service Guild | Path: src/ExportCenter/StellaOps.ExportCenter | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 37 — Export Center Phase 3 | EXPORT-SVC-37-002 | TODO | Add bundle encryption, key wrapping with KMS, and verification tooling for encrypted exports. | Exporter Service Guild | Path: src/ExportCenter/StellaOps.ExportCenter | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 37 — Export Center Phase 3 | EXPORT-SVC-37-003 | TODO | Deliver scheduling/retention engine (cron/event triggers), audit trails, and retry idempotency enhancements. | Exporter Service Guild | Path: src/ExportCenter/StellaOps.ExportCenter | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 37 — Export Center Phase 3 | EXPORT-SVC-37-004 | TODO | Provide export verification API and CLI integration, including hash/signature validation endpoints. | Exporter Service Guild | Path: src/ExportCenter/StellaOps.ExportCenter | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 37 — Export Center Phase 3 | ORCH-SVC-37-101 | TODO | Enable scheduled export runs, retention pruning hooks, and failure alerting integration. | Orchestrator Service Guild | Path: src/Orchestrator/StellaOps.Orchestrator | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 37 — Export Center Phase 3 | WEB-EXPORT-37-001 | TODO | Surface scheduling, retention, and verification endpoints plus encryption parameter handling. | BE-Base Platform Guild | Path: src/Web/StellaOps.Web | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 37 — Native Analyzer Core | SCANNER-ANALYZERS-NATIVE-20-001 | TODO | Format detector & binary identity for ELF/PE/Mach-O (multi-slice) with stable entrypoint IDs. | Native Analyzer Guild | Path: src/Scanner/StellaOps.Scanner.Analyzers.Native | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 37 — Native Analyzer Core | SCANNER-ANALYZERS-NATIVE-20-002 | TODO | ELF dynamic parser emitting dtneeded edges, runpath metadata, symbol version needs. | Native Analyzer Guild | Path: src/Scanner/StellaOps.Scanner.Analyzers.Native | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 37 — Native Analyzer Core | SCANNER-ANALYZERS-NATIVE-20-003 | TODO | PE import + delay-load + SxS manifest parsing producing reason-coded edges. | Native Analyzer Guild | Path: src/Scanner/StellaOps.Scanner.Analyzers.Native | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 37 — Native Analyzer Core | SCANNER-ANALYZERS-NATIVE-20-004 | TODO | Mach-O load command parsing with @rpath expansion and slice handling. | Native Analyzer Guild | Path: src/Scanner/StellaOps.Scanner.Analyzers.Native | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 37 — Native Analyzer Core | SCANNER-ANALYZERS-NATIVE-20-005 | TODO | Cross-platform resolver engine modeling search order/explain traces for ELF/PE/Mach-O. | Native Analyzer Guild | Path: src/Scanner/StellaOps.Scanner.Analyzers.Native | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 37 — Native Analyzer Core | SCANNER-ANALYZERS-NATIVE-20-006 | TODO | Heuristic scanner for dlopen/LoadLibrary strings, plugin configs, ecosystem hints with confidence tags. | Native Analyzer Guild | Path: src/Scanner/StellaOps.Scanner.Analyzers.Native | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 38 — Native Observation Pipeline | SCANNER-ANALYZERS-NATIVE-20-007 | TODO | Serialize entrypoints/edges/env profiles to Scanner writer (AOC-compliant observations). | Native Analyzer Guild | Path: src/Scanner/StellaOps.Scanner.Analyzers.Native | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 38 — Native Observation Pipeline | SCANNER-ANALYZERS-NATIVE-20-008 | TODO | Fixture suite + determinism benchmarks for native analyzer across linux/windows/macos. | Native Analyzer Guild, QA Guild | Path: src/Scanner/StellaOps.Scanner.Analyzers.Native | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 38 — Native Observation Pipeline | SCANNER-ANALYZERS-NATIVE-20-009 | TODO | Optional runtime capture adapters (eBPF/ETW/dyld) producing runtime-load edges with redaction. | Native Analyzer Guild, Signals Guild | Path: src/Scanner/StellaOps.Scanner.Analyzers.Native | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 38 — Native Observation Pipeline | SCANNER-ANALYZERS-NATIVE-20-010 | TODO | Package native analyzer plug-in + Offline Kit updates and restart-time loading. | Native Analyzer Guild, DevOps Guild | Path: src/Scanner/StellaOps.Scanner.Analyzers.Native | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 38 — Notifications Studio Phase 1 | DOCS-NOTIFY-38-001 | TODO | Publish `/docs/notifications/overview.md` and `/docs/notifications/architecture.md` ending with imposed rule statement. | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 38 — Notifications Studio Phase 1 | DEPLOY-NOTIFY-38-001 | TODO | Package notifier API/worker Helm overlays (email/chat/webhook), secrets templates, rollout guide. | Deployment Guild | Path: ops/deployment | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 38 — Notifications Studio Phase 1 | DEVOPS-NOTIFY-38-001 | TODO | Stand up notifier CI pipelines, event bus fixtures, base dashboards for events/notifications latency. | DevOps Guild | Path: ops/devops | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 38 — Notifications Studio Phase 1 | CLI-NOTIFY-38-001 | TODO | Implement `stella notify` rule/template/incident commands (list/create/test/ack) with file-based inputs. | DevEx/CLI Guild | Path: src/Cli/StellaOps.Cli | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 38 — Notifications Studio Phase 1 | NOTIFY-SVC-38-001 | TODO | Bootstrap notifier service, migrations for notif tables, event ingestion, and rule engine foundation (policy violations + job failures). | Notifications Service Guild | Path: src/Notifier/StellaOps.Notifier | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 38 — Notifications Studio Phase 1 | NOTIFY-SVC-38-002 | TODO | Implement channel adapters (email, chat-webhook, generic webhook) with retry and audit logging. | Notifications Service Guild | Path: src/Notifier/StellaOps.Notifier | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 38 — Notifications Studio Phase 1 | NOTIFY-SVC-38-003 | TODO | Deliver template service (versioning, preview), rendering pipeline with redaction, and provenance links. | Notifications Service Guild | Path: src/Notifier/StellaOps.Notifier | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 38 — Notifications Studio Phase 1 | NOTIFY-SVC-38-004 | TODO | Expose initial API (rules CRUD, templates, incidents list, ack) and live feed WS stream. | Notifications Service Guild | Path: src/Notifier/StellaOps.Notifier | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 38 — Notifications Studio Phase 1 | ORCH-SVC-38-101 | TODO | Standardize event envelope publication (policy/export/job lifecycle) with idempotency keys for notifier ingestion. | Orchestrator Service Guild | Path: src/Orchestrator/StellaOps.Orchestrator | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 38 — Notifications Studio Phase 1 | POLICY-ENGINE-38-201 | TODO | Emit enriched violation events including rationale IDs via orchestrator bus. | Policy Guild | Path: src/Policy/StellaOps.Policy.Engine | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 38 — Notifications Studio Phase 1 | WEB-NOTIFY-38-001 | TODO | Route notifier APIs through gateway with tenant scoping and operator scopes. | BE-Base Platform Guild | Path: src/Web/StellaOps.Web | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 39 — Java Analyzer Core | SCANNER-ANALYZERS-JAVA-21-001 | TODO | Java input normalizer (jar/war/ear/fat/jmod/jimage) with MR overlay selection. | Java Analyzer Guild | Path: src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Java | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 39 — Java Analyzer Core | SCANNER-ANALYZERS-JAVA-21-002 | TODO | Module/classpath builder with duplicate & split-package detection. | Java Analyzer Guild | Path: src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Java | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 39 — Java Analyzer Core | SCANNER-ANALYZERS-JAVA-21-003 | TODO | SPI scanner & provider selection with warnings. | Java Analyzer Guild | Path: src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Java | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 39 — Java Analyzer Core | SCANNER-ANALYZERS-JAVA-21-004 | DONE | Reflection/TCCL heuristics emitting reason-coded edges. | Java Analyzer Guild | Path: src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Java | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 39 — Java Analyzer Core | SCANNER-ANALYZERS-JAVA-21-005 | TODO | Framework config extraction (Spring, Jakarta, MicroProfile, logging, Graal configs). | Java Analyzer Guild | Path: src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Java | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 39 — Java Analyzer Core | SCANNER-ANALYZERS-JAVA-21-006 | TODO | JNI/native hint detection for Java artifacts. | Java Analyzer Guild | Path: src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Java | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 39 — Java Analyzer Core | SCANNER-ANALYZERS-JAVA-21-007 | TODO | Manifest/signature metadata collector (main/start/agent classes, signers). | Java Analyzer Guild | Path: src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Java | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 39 — Notifications Studio Phase 2 | DOCS-NOTIFY-39-002 | TODO | Publish `/docs/notifications/rules.md`, `/templates.md`, `/digests.md` with imposed rule reminder. | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 39 — Notifications Studio Phase 2 | DEVOPS-NOTIFY-39-002 | TODO | Add throttling/quiet-hours dashboards, digest job monitoring, and storm breaker alerts. | DevOps Guild | Path: ops/devops | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 39 — Notifications Studio Phase 2 | CLI-NOTIFY-39-001 | TODO | Add simulation/digest CLI verbs and advanced filtering for incidents. | DevEx/CLI Guild | Path: src/Cli/StellaOps.Cli | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 39 — Notifications Studio Phase 2 | LEDGER-NOTIFY-39-001 | TODO | Optimize digest queries and provide API for notifier to fetch unresolved policy violations/SBOM deltas. | Findings Ledger Guild | Path: src/Findings/StellaOps.Findings.Ledger | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 39 — Notifications Studio Phase 2 | NOTIFY-SVC-39-001 | TODO | Implement correlation engine, throttling, quiet hours/maintenance evaluator, and incident state machine. | Notifications Service Guild | Path: src/Notifier/StellaOps.Notifier | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 39 — Notifications Studio Phase 2 | NOTIFY-SVC-39-002 | TODO | Add digests generator with Findings Ledger queries and distribution (email/chat). | Notifications Service Guild | Path: src/Notifier/StellaOps.Notifier | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 39 — Notifications Studio Phase 2 | NOTIFY-SVC-39-003 | TODO | Provide simulation engine and API for rule dry-run against historical events. | Notifications Service Guild | Path: src/Notifier/StellaOps.Notifier | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 39 — Notifications Studio Phase 2 | NOTIFY-SVC-39-004 | TODO | Integrate quiet hours calendars and default throttles with audit logging. | Notifications Service Guild | Path: src/Notifier/StellaOps.Notifier | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 39 — Notifications Studio Phase 2 | WEB-NOTIFY-39-001 | TODO | Surface digest scheduling, simulation, and throttle management endpoints via gateway. | BE-Base Platform Guild | Path: src/Web/StellaOps.Web | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 40 — Java Observation & Runtime | SCANNER-ANALYZERS-JAVA-21-008 | TODO | Observation writer producing entrypoints/components/edges with warnings. | Java Analyzer Guild | Path: src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Java | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 40 — Java Observation & Runtime | SCANNER-ANALYZERS-JAVA-21-009 | TODO | Fixture suite + determinism/perf benchmarks for Java analyzer. | Java Analyzer Guild, QA Guild | Path: src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Java | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 40 — Java Observation & Runtime | SCANNER-ANALYZERS-JAVA-21-010 | TODO | Optional runtime ingestion via agent/JFR producing runtime edges. | Java Analyzer Guild, Signals Guild | Path: src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Java | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 40 — Java Observation & Runtime | SCANNER-ANALYZERS-JAVA-21-011 | TODO | Package Java analyzer plug-in + Offline Kit/CLI updates. | Java Analyzer Guild, DevOps Guild | Path: src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Java | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 40 — Notifications Studio Phase 3 | DOCS-NOTIFY-40-001 | TODO | Publish `/docs/notifications/channels.md`, `/escalations.md`, `/api.md`, `/operations/notifier-runbook.md`, `/security/notifications-hardening.md` with imposed rule lines. | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 40 — Notifications Studio Phase 3 | DEPLOY-NOTIFY-40-001 | TODO | Package notifier escalations + localization deployment overlays, signed ack token rotation scripts, and rollback guidance. | Deployment Guild | Path: ops/deployment | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 40 — Notifications Studio Phase 3 | DEVOPS-NOTIFY-40-001 | TODO | Finalize notifier dashboards/alerts (escalation failures, ack latency), chaos testing harness, and channel health monitoring. | DevOps Guild | Path: ops/devops | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 40 — Notifications Studio Phase 3 | DEVOPS-OFFLINE-37-002 | CARRY (no scope change) | Carry from Sprint 37: Notifier offline packs (sample configs, template/digest packs, dry-run harness) with integrity checks. | Offline Kit Guild | Path: ops/offline-kit | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 40 — Notifications Studio Phase 3 | AUTH-NOTIFY-40-001 | TODO | Enforce ack token signing/rotation, webhook allowlists, and admin-only escalation settings. | Authority Core & Security Guild | Path: src/Authority/StellaOps.Authority | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 40 — Notifications Studio Phase 3 | CLI-NOTIFY-40-001 | TODO | Implement ack token redemption, escalation management, localization previews. | DevEx/CLI Guild | Path: src/Cli/StellaOps.Cli | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 40 — Notifications Studio Phase 3 | NOTIFY-SVC-40-001 | TODO | Implement escalations, on-call schedules, ack bridge, PagerDuty/OpsGenie adapters, and localization bundles. | Notifications Service Guild | Path: src/Notifier/StellaOps.Notifier | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 40 — Notifications Studio Phase 3 | NOTIFY-SVC-40-002 | TODO | Add CLI inbox/in-app feed channels and summary storm breaker notifications. | Notifications Service Guild | Path: src/Notifier/StellaOps.Notifier | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 40 — Notifications Studio Phase 3 | NOTIFY-SVC-40-003 | TODO | Harden security: signed ack links, webhook HMAC/IP allowlists, tenant isolation fuzzing, localization fallback. | Notifications Service Guild | Path: src/Notifier/StellaOps.Notifier | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 40 — Notifications Studio Phase 3 | NOTIFY-SVC-40-004 | TODO | Finalize observability (incident metrics, escalation latency) and chaos tests for channel outages. | Notifications Service Guild | Path: src/Notifier/StellaOps.Notifier | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 40 — Notifications Studio Phase 3 | WEB-NOTIFY-40-001 | TODO | Expose escalation, localization, channel health endpoints and verification of signed links. | BE-Base Platform Guild | Path: src/Web/StellaOps.Web | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 41 — CLI Parity & Task Packs Phase 1 | DOCS-CLI-41-001 | TODO | Publish `/docs/modules/cli/guides/overview.md`, `/cli/configuration.md`, `/cli/output-and-exit-codes.md` (with imposed rule). | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 41 — CLI Parity & Task Packs Phase 1 | DEPLOY-CLI-41-001 | TODO | Package CLI release artifacts (tarballs, completions, container image) with distribution docs. | Deployment Guild | Path: ops/deployment | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 41 — CLI Parity & Task Packs Phase 1 | DEVOPS-CLI-41-001 | TODO | Establish CLI build pipeline (multi-platform binaries, SBOM, checksums) and parity matrix CI enforcement. | DevOps Guild | Path: ops/devops | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 41 — CLI Parity & Task Packs Phase 1 | AUTH-PACKS-41-001 | TODO | Define CLI SSO scopes and Packs (`Packs.Read/Write/Run/Approve`) roles; update discovery/offline defaults. | Authority Core & Security Guild | Path: src/Authority/StellaOps.Authority | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 41 — CLI Parity & Task Packs Phase 1 | CLI-CORE-41-001 | TODO | Implement CLI config/auth foundation, global flags, output renderer, and error/exit code mapping. | DevEx/CLI Guild | Path: src/Cli/StellaOps.Cli | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 41 — CLI Parity & Task Packs Phase 1 | CLI-PARITY-41-001 | TODO | Deliver parity command groups (`policy`, `sbom`, `vuln`, `vex`, `advisory`, `export`, `orchestrator`) with JSON/table outputs and `--explain`. | DevEx/CLI Guild | Path: src/Cli/StellaOps.Cli | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 41 — CLI Parity & Task Packs Phase 1 | CLI-PARITY-41-002 | TODO | Implement `notify`, `aoc`, `auth` command groups, idempotency keys, completions, and parity matrix export. | DevEx/CLI Guild | Path: src/Cli/StellaOps.Cli | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 41 — CLI Parity & Task Packs Phase 1 | ORCH-SVC-41-101 | TODO | Register `pack-run` job type, integrate logs/artifacts, expose pack run metadata. | Orchestrator Service Guild | Path: src/Orchestrator/StellaOps.Orchestrator | 2025-10-19 | +# Archived Implementation Index + +Consolidated task ledger for everything under `docs/implplan/archived/` (sprints, task ledgers, and update notes) in a common table. + +| Source | Section | Task ID | State | Description | Owners | Depends / Notes | Last Updated | +| --- | --- | --- | --- | --- | --- | --- | --- | +| docs/implplan/archived/updates/tasks.md | --- — --- | --- | --- | --- | --- | Path: --- | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 1 — Stabilize In-Progress Foundations | FEEDMODELS-SCHEMA-01-001 | DONE (2025-10-12) | SemVer primitive range-style metadata
Instructions to work:
DONE Read ./AGENTS.md and src/Concelier/__Libraries/StellaOps.Concelier.Models/AGENTS.md. This task lays the groundwork—complete the SemVer helper updates before teammates pick up FEEDMODELS-SCHEMA-01-002/003 and FEEDMODELS-SCHEMA-02-900. Use ./src/FASTER_MODELING_AND_NORMALIZATION.md for the target rule structure. | Team Models & Merge Leads | Path: src/Concelier/__Libraries/StellaOps.Concelier.Models | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 1 — Stabilize In-Progress Foundations | FEEDMODELS-SCHEMA-01-002 | DONE (2025-10-11) | Provenance decision rationale field
Instructions to work:
AdvisoryProvenance now carries `decisionReason` and docs/tests were updated. Connectors and merge tasks should populate the field when applying precedence/freshness/tie-breaker logic; see src/Concelier/__Libraries/StellaOps.Concelier.Models/PROVENANCE_GUIDELINES.md for usage guidance. | Team Models & Merge Leads | Path: src/Concelier/__Libraries/StellaOps.Concelier.Models | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 1 — Stabilize In-Progress Foundations | FEEDMODELS-SCHEMA-01-003 | DONE (2025-10-11) | Normalized version rules collection
Instructions to work:
`AffectedPackage.NormalizedVersions` and supporting comparer/docs/tests shipped. Connector owners must emit rule arrays per ./src/FASTER_MODELING_AND_NORMALIZATION.md and report progress via FEEDMERGE-COORD-02-900 so merge/storage backfills can proceed. | Team Models & Merge Leads | Path: src/Concelier/__Libraries/StellaOps.Concelier.Models | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 1 — Stabilize In-Progress Foundations | FEEDMODELS-SCHEMA-02-900 | DONE (2025-10-12) | Range primitives for SemVer/EVR/NEVRA metadata
Instructions to work:
DONE Read ./AGENTS.md and src/Concelier/__Libraries/StellaOps.Concelier.Models/AGENTS.md before resuming this stalled effort. Confirm helpers align with the new `NormalizedVersions` representation so connectors finishing in Sprint 2 can emit consistent metadata. | Team Models & Merge Leads | Path: src/Concelier/__Libraries/StellaOps.Concelier.Models | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 1 — Stabilize In-Progress Foundations | FEEDNORM-NORM-02-001 | DONE (2025-10-11) | SemVer normalized rule emitter
Shared `SemVerRangeRuleBuilder` now outputs primitives + normalized rules per `FASTER_MODELING_AND_NORMALIZATION.md`; CVE/GHSA connectors consuming the API have verified fixtures. | Team Normalization & Storage Backbone | Path: src/Concelier/__Libraries/StellaOps.Concelier.Normalization | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 1 — Stabilize In-Progress Foundations | FEEDSTORAGE-DATA-02-001 | DONE (2025-10-11) | Normalized range dual-write + backfill
AdvisoryStore dual-writes flattened `normalizedVersions` when `concelier.storage.enableSemVerStyle` is set; migration `20251011-semver-style-backfill` updates historical records and docs outline the rollout. | Team Normalization & Storage Backbone | Path: src/Concelier/__Libraries/StellaOps.Concelier.Storage.Mongo | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 1 — Stabilize In-Progress Foundations | FEEDSTORAGE-DATA-02-002 | DONE (2025-10-11) | Provenance decision reason persistence
Storage now persists `provenance.decisionReason` for advisories and merge events; tests cover round-trips. | Team Normalization & Storage Backbone | Path: src/Concelier/__Libraries/StellaOps.Concelier.Storage.Mongo | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 1 — Stabilize In-Progress Foundations | FEEDSTORAGE-DATA-02-003 | DONE (2025-10-11) | Normalized versions indexing
Bootstrapper seeds compound/sparse indexes for flattened normalized rules and `docs/dev/mongo_indices.md` documents query guidance. | Team Normalization & Storage Backbone | Path: src/Concelier/__Libraries/StellaOps.Concelier.Storage.Mongo | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 1 — Stabilize In-Progress Foundations | FEEDSTORAGE-TESTS-02-004 | DONE (2025-10-11) | Restore AdvisoryStore build after normalized versions refactor
Updated constructors/tests keep storage suites passing with the new feature flag defaults. | Team Normalization & Storage Backbone | Path: src/Concelier/__Libraries/StellaOps.Concelier.Storage.Mongo | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 1 — Stabilize In-Progress Foundations | FEEDWEB-ENGINE-01-002 | DONE (2025-10-12) | Plumb Authority client resilience options
WebService wires `authority.resilience.*` into `AddStellaOpsAuthClient` and adds binding coverage via `AuthorityClientResilienceOptionsAreBound`. | Team WebService & Authority | Path: src/Concelier/StellaOps.Concelier.WebService | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 1 — Stabilize In-Progress Foundations | FEEDWEB-DOCS-01-003 | DONE (2025-10-12) | Author ops guidance for resilience tuning
Install/runbooks document connected vs air-gapped resilience profiles and monitoring hooks. | Team WebService & Authority | Path: src/Concelier/StellaOps.Concelier.WebService | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 1 — Stabilize In-Progress Foundations | FEEDWEB-DOCS-01-004 | DONE (2025-10-12) | Document authority bypass logging patterns
Operator guides now call out `route/status/subject/clientId/scopes/bypass/remote` audit fields and SIEM triggers. | Team WebService & Authority | Path: src/Concelier/StellaOps.Concelier.WebService | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 1 — Stabilize In-Progress Foundations | FEEDWEB-DOCS-01-005 | DONE (2025-10-12) | Update Concelier operator guide for enforcement cutoff
Install guide reiterates the 2025-12-31 cutoff and links audit signals to the rollout checklist. | Team WebService & Authority | Path: src/Concelier/StellaOps.Concelier.WebService | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 1 — Stabilize In-Progress Foundations | SEC3.HOST | DONE (2025-10-11) | Rate limiter policy binding
Authority host now applies configuration-driven fixed windows to `/token`, `/authorize`, and `/internal/*`; integration tests assert 429 + `Retry-After` headers; docs/config samples refreshed for Docs guild diagrams. | Team WebService & Authority | Path: src/Authority/StellaOps.Authority | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 1 — Stabilize In-Progress Foundations | SEC3.BUILD | DONE (2025-10-11) | Authority rate-limiter follow-through
`Security.RateLimiting` now fronts token/authorize/internal limiters; Authority + Configuration matrices (`dotnet test src/Authority/StellaOps.Authority/StellaOps.Authority.sln`, `dotnet test src/__Libraries/__Tests/StellaOps.Configuration.Tests/StellaOps.Configuration.Tests.csproj`) passed on 2025-10-11; awaiting #authority-core broadcast. | Team WebService & Authority | Path: src/Authority/StellaOps.Authority | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 1 — Stabilize In-Progress Foundations | AUTHCORE-BUILD-OPENIDDICT / AUTHCORE-STORAGE-DEVICE-TOKENS / AUTHCORE-BOOTSTRAP-INVITES | DONE (2025-10-14) | Address remaining Authority compile blockers (OpenIddict transaction shim, token device document, bootstrap invite cleanup) so `dotnet build src/Authority/StellaOps.Authority/StellaOps.Authority.sln` returns success. | Team Authority Platform & Security Guild | Path: src/Authority/StellaOps.Authority | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 1 — Stabilize In-Progress Foundations | PLG6.DOC | DONE (2025-10-11) | Plugin developer guide polish
Section 9 now documents rate limiter metadata, config keys, and lockout interplay; YAML samples updated alongside Authority config templates. | Team WebService & Authority | Path: src/Authority/StellaOps.Authority/StellaOps.Authority.Plugin.Standard | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 1 — Stabilize In-Progress Foundations | FEEDCONN-CERTCC-02-001 | DONE (2025-10-11) | Fetch pipeline & state tracking
Summary planner now drives monthly/yearly VINCE fetches, persists pending summaries/notes, and hydrates VINCE detail queue with telemetry.
Team instructions: Read ./AGENTS.md and src/Concelier/StellaOps.Concelier.PluginBinaries/StellaOps.Concelier.Connector.CertCc/AGENTS.md. Coordinate daily with Models/Merge leads so new normalizedVersions output and provenance tags stay aligned with ./src/FASTER_MODELING_AND_NORMALIZATION.md. | Team Connector Resumption – CERT/RedHat | Path: src/Concelier/StellaOps.Concelier.PluginBinaries/StellaOps.Concelier.Connector.CertCc | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 1 — Stabilize In-Progress Foundations | FEEDCONN-CERTCC-02-002 | DONE (2025-10-11) | VINCE note detail fetcher
Summary planner queues VINCE note detail endpoints, persists raw JSON with SHA/ETag metadata, and records retry/backoff metrics. | Team Connector Resumption – CERT/RedHat | Path: src/Concelier/StellaOps.Concelier.PluginBinaries/StellaOps.Concelier.Connector.CertCc | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 1 — Stabilize In-Progress Foundations | FEEDCONN-CERTCC-02-003 | DONE (2025-10-11) | DTO & parser implementation
Added VINCE DTO aggregate, Markdown→text sanitizer, vendor/status/vulnerability parsers, and parser regression fixture. | Team Connector Resumption – CERT/RedHat | Path: src/Concelier/StellaOps.Concelier.PluginBinaries/StellaOps.Concelier.Connector.CertCc | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 1 — Stabilize In-Progress Foundations | FEEDCONN-CERTCC-02-004 | DONE (2025-10-11) | Canonical mapping & range primitives
VINCE DTO aggregate flows through `CertCcMapper`, emitting vendor range primitives + normalized version rules that persist via `_advisoryStore`. | Team Connector Resumption – CERT/RedHat | Path: src/Concelier/StellaOps.Concelier.PluginBinaries/StellaOps.Concelier.Connector.CertCc | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 1 — Stabilize In-Progress Foundations | FEEDCONN-CERTCC-02-005 | DONE (2025-10-12) | Deterministic fixtures/tests
Snapshot harness refreshed 2025-10-12; `certcc-*.snapshot.json` regenerated and regression suite green without UPDATE flag drift. | Team Connector Resumption – CERT/RedHat | Path: src/Concelier/StellaOps.Concelier.PluginBinaries/StellaOps.Concelier.Connector.CertCc | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 1 — Stabilize In-Progress Foundations | FEEDCONN-CERTCC-02-006 | DONE (2025-10-12) | Telemetry & documentation
`CertCcDiagnostics` publishes summary/detail/parse/map metrics (meter `StellaOps.Concelier.Connector.CertCc`), README documents instruments, and log guidance captured for Ops on 2025-10-12. | Team Connector Resumption – CERT/RedHat | Path: src/Concelier/StellaOps.Concelier.PluginBinaries/StellaOps.Concelier.Connector.CertCc | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 1 — Stabilize In-Progress Foundations | FEEDCONN-CERTCC-02-007 | DONE (2025-10-12) | Connector test harness remediation
Harness now wires `AddSourceCommon`, resets `FakeTimeProvider`, and passes canned-response regression run dated 2025-10-12. | Team Connector Resumption – CERT/RedHat | Path: src/Concelier/StellaOps.Concelier.PluginBinaries/StellaOps.Concelier.Connector.CertCc | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 1 — Stabilize In-Progress Foundations | FEEDCONN-CERTCC-02-008 | DONE (2025-10-11) | Snapshot coverage handoff
Fixtures regenerated with normalized ranges + provenance fields on 2025-10-11; QA handoff notes published and merge backfill unblocked. | Team Connector Resumption – CERT/RedHat | Path: src/Concelier/StellaOps.Concelier.PluginBinaries/StellaOps.Concelier.Connector.CertCc | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 1 — Stabilize In-Progress Foundations | FEEDCONN-CERTCC-02-012 | DONE (2025-10-12) | Schema sync & snapshot regen follow-up
Fixtures regenerated with normalizedVersions + provenance decision reasons; handoff notes updated for Merge backfill 2025-10-12. | Team Connector Resumption – CERT/RedHat | Path: src/Concelier/StellaOps.Concelier.PluginBinaries/StellaOps.Concelier.Connector.CertCc | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 1 — Stabilize In-Progress Foundations | FEEDCONN-CERTCC-02-009 | DONE (2025-10-11) | Detail/map reintegration plan
Staged reintegration plan published in `src/Concelier/StellaOps.Concelier.PluginBinaries/StellaOps.Concelier.Connector.CertCc/FEEDCONN-CERTCC-02-009_PLAN.md`; coordinates enablement with FEEDCONN-CERTCC-02-004. | Team Connector Resumption – CERT/RedHat | Path: src/Concelier/StellaOps.Concelier.PluginBinaries/StellaOps.Concelier.Connector.CertCc | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 1 — Stabilize In-Progress Foundations | FEEDCONN-CERTCC-02-010 | DONE (2025-10-12) | Partial-detail graceful degradation
Detail fetch now tolerates 404/403/410 responses and regression tests cover mixed endpoint availability. | Team Connector Resumption – CERT/RedHat | Path: src/Concelier/StellaOps.Concelier.PluginBinaries/StellaOps.Concelier.Connector.CertCc | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 1 — Stabilize In-Progress Foundations | FEEDCONN-REDHAT-02-001 | DONE (2025-10-11) | Fixture validation sweep
Instructions to work:
Fixtures regenerated post-model-helper rollout; provenance ordering and normalizedVersions scaffolding verified via tests. Conflict resolver deltas logged in src/Concelier/StellaOps.Concelier.PluginBinaries/StellaOps.Concelier.Connector.Distro.RedHat/CONFLICT_RESOLVER_NOTES.md for Sprint 3 consumers. | Team Connector Resumption – CERT/RedHat | Path: src/Concelier/StellaOps.Concelier.PluginBinaries/StellaOps.Concelier.Connector.Distro.RedHat | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 1 — Stabilize In-Progress Foundations | FEEDCONN-APPLE-02-001 | DONE (2025-10-12) | Canonical mapping & range primitives
Mapper emits SemVer rules (`scheme=apple:*`); fixtures regenerated with trimmed references + new RSR coverage, update tooling finalized. | Team Vendor Apple Specialists | Path: src/Concelier/StellaOps.Concelier.PluginBinaries/StellaOps.Concelier.Connector.Vndr.Apple | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 1 — Stabilize In-Progress Foundations | FEEDCONN-APPLE-02-002 | DONE (2025-10-11) | Deterministic fixtures/tests
Sanitized live fixtures + regression snapshots wired into tests; normalized rule coverage asserted. | Team Vendor Apple Specialists | Path: src/Concelier/StellaOps.Concelier.PluginBinaries/StellaOps.Concelier.Connector.Vndr.Apple | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 1 — Stabilize In-Progress Foundations | FEEDCONN-APPLE-02-003 | DONE (2025-10-11) | Telemetry & documentation
Apple meter metrics wired into Concelier WebService OpenTelemetry configuration; README and fixtures document normalizedVersions coverage. | Team Vendor Apple Specialists | Path: src/Concelier/StellaOps.Concelier.PluginBinaries/StellaOps.Concelier.Connector.Vndr.Apple | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 1 — Stabilize In-Progress Foundations | FEEDCONN-APPLE-02-004 | DONE (2025-10-12) | Live HTML regression sweep
Sanitised HT125326/HT125328/HT106355/HT214108/HT215500 fixtures recorded and regression tests green on 2025-10-12. | Team Vendor Apple Specialists | Path: src/Concelier/StellaOps.Concelier.PluginBinaries/StellaOps.Concelier.Connector.Vndr.Apple | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 1 — Stabilize In-Progress Foundations | FEEDCONN-APPLE-02-005 | DONE (2025-10-11) | Fixture regeneration tooling
`UPDATE_APPLE_FIXTURES=1` flow fetches & rewrites fixtures; README documents usage.
Instructions to work:
DONE Read ./AGENTS.md and src/Concelier/StellaOps.Concelier.PluginBinaries/StellaOps.Concelier.Connector.Vndr.Apple/AGENTS.md. Resume stalled tasks, ensuring normalizedVersions output and fixtures align with ./src/FASTER_MODELING_AND_NORMALIZATION.md before handing data to the conflict sprint. | Team Vendor Apple Specialists | Path: src/Concelier/StellaOps.Concelier.PluginBinaries/StellaOps.Concelier.Connector.Vndr.Apple | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 1 — Stabilize In-Progress Foundations | FEEDCONN-GHSA-02-001 | DONE (2025-10-12) | GHSA normalized versions & provenance
Team instructions: Read ./AGENTS.md and each module's AGENTS file. Adopt the `NormalizedVersions` array emitted by the models sprint, wiring provenance `decisionReason` where merge overrides occur. Follow ./src/FASTER_MODELING_AND_NORMALIZATION.md; report via src/Concelier/__Libraries/StellaOps.Concelier.Merge (FEEDMERGE-COORD-02-900). Progress 2025-10-11: GHSA/OSV emit normalized arrays with refreshed fixtures; CVE mapper now surfaces SemVer normalized ranges; NVD/KEV adoption pending; outstanding follow-ups include FEEDSTORAGE-DATA-02-001, FEEDMERGE-ENGINE-02-002, and rolling `src/Tools/FixtureUpdater` updates across connectors. | Team Connector Normalized Versions Rollout | Path: src/Concelier/StellaOps.Concelier.PluginBinaries/StellaOps.Concelier.Connector.Ghsa | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 1 — Stabilize In-Progress Foundations | FEEDCONN-OSV-02-003 | DONE (2025-10-12) | OSV normalized versions & freshness | Team Connector Normalized Versions Rollout | Path: src/Concelier/StellaOps.Concelier.PluginBinaries/StellaOps.Concelier.Connector.Osv | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 1 — Stabilize In-Progress Foundations | FEEDCONN-NVD-02-002 | DONE (2025-10-12) | NVD normalized versions & timestamps | Team Connector Normalized Versions Rollout | Path: src/Concelier/StellaOps.Concelier.PluginBinaries/StellaOps.Concelier.Connector.Nvd | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 1 — Stabilize In-Progress Foundations | FEEDCONN-CVE-02-003 | DONE (2025-10-12) | CVE normalized versions uplift | Team Connector Normalized Versions Rollout | Path: src/Concelier/StellaOps.Concelier.PluginBinaries/StellaOps.Concelier.Connector.Cve | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 1 — Stabilize In-Progress Foundations | FEEDCONN-KEV-02-003 | DONE (2025-10-12) | KEV normalized versions propagation | Team Connector Normalized Versions Rollout | Path: src/Concelier/StellaOps.Concelier.PluginBinaries/StellaOps.Concelier.Connector.Kev | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 1 — Stabilize In-Progress Foundations | FEEDCONN-OSV-04-003 | DONE (2025-10-12) | OSV parity fixture refresh | Team Connector Normalized Versions Rollout | Path: src/Concelier/StellaOps.Concelier.PluginBinaries/StellaOps.Concelier.Connector.Osv | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 1 — Stabilize In-Progress Foundations | FEEDWEB-DOCS-01-001 | DONE (2025-10-10) | Document authority toggle & scope requirements
Quickstart carries toggle/scope guidance pending docs guild review (no change this sprint). | Team WebService & Authority | Path: src/Concelier/StellaOps.Concelier.WebService | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 1 — Stabilize In-Progress Foundations | FEEDWEB-DOCS-01-003 | DONE (2025-10-12) | Author ops guidance for resilience tuning
Operator docs now outline connected vs air-gapped resilience profiles and monitoring cues. | Team WebService & Authority | Path: src/Concelier/StellaOps.Concelier.WebService | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 1 — Stabilize In-Progress Foundations | FEEDWEB-DOCS-01-004 | DONE (2025-10-12) | Document authority bypass logging patterns
Audit logging guidance highlights `route/status/subject/clientId/scopes/bypass/remote` fields and SIEM alerts. | Team WebService & Authority | Path: src/Concelier/StellaOps.Concelier.WebService | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 1 — Stabilize In-Progress Foundations | FEEDWEB-DOCS-01-005 | DONE (2025-10-12) | Update Concelier operator guide for enforcement cutoff
Install guide reiterates the 2025-12-31 cutoff and ties audit signals to rollout checks. | Team WebService & Authority | Path: src/Concelier/StellaOps.Concelier.WebService | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 1 — Stabilize In-Progress Foundations | FEEDWEB-OPS-01-006 | DONE (2025-10-11) | Rename plugin drop directory to namespaced path
Build outputs, tests, and docs now target `StellaOps.Concelier.PluginBinaries`/`StellaOps.Authority.PluginBinaries`. | Team WebService & Authority | Path: src/Concelier/StellaOps.Concelier.WebService | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 1 — Stabilize In-Progress Foundations | FEEDWEB-OPS-01-007 | DONE (2025-10-11) | Authority resilience adoption
Deployment docs and CLI notes explain the LIB5 resilience knobs for rollout.
Instructions to work:
DONE Read ./AGENTS.md and src/Concelier/StellaOps.Concelier.WebService/AGENTS.md. These items were mid-flight; resume implementation ensuring docs/operators receive timely updates. | Team WebService & Authority | Path: src/Concelier/StellaOps.Concelier.WebService | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 1 — Stabilize In-Progress Foundations | AUTHCORE-ENGINE-01-001 | DONE (2025-10-11) | CORE8.RL — Rate limiter plumbing validated; integration tests green and docs handoff recorded for middleware ordering + Retry-After headers (see `docs/dev/authority-rate-limit-tuning-outline.md` for continuing guidance). | Team Authority Platform & Security Guild | Path: src/Authority/StellaOps.Authority | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 1 — Stabilize In-Progress Foundations | AUTHCRYPTO-ENGINE-01-001 | DONE (2025-10-11) | SEC3.A — Shared metadata resolver confirmed via host test run; SEC3.B now unblocked for tuning guidance (outline captured in `docs/dev/authority-rate-limit-tuning-outline.md`). | Team Authority Platform & Security Guild | Path: src/__Libraries/StellaOps.Cryptography | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 1 — Stabilize In-Progress Foundations | AUTHSEC-DOCS-01-002 | DONE (2025-10-13) | SEC3.B — Published `docs/security/rate-limits.md` with tuning matrix, alert thresholds, and lockout interplay guidance; Docs guild can lift copy into plugin guide. | Team Authority Platform & Security Guild | Path: src/__Libraries/StellaOps.Cryptography | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 1 — Stabilize In-Progress Foundations | AUTHSEC-CRYPTO-02-001 | DONE (2025-10-14) | SEC5.B1 — Introduce libsodium signing provider and parity tests to unblock CLI verification enhancements. | Team Authority Platform & Security Guild | Path: src/__Libraries/StellaOps.Cryptography | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 1 — Bootstrap & Replay Hardening | AUTHSEC-CRYPTO-02-004 | DONE (2025-10-14) | SEC5.D/E — Finish bootstrap invite lifecycle (API/store/cleanup) and token device heuristics; build currently red due to pending handler integration. | Security Guild | Path: src/__Libraries/StellaOps.Cryptography | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 1 — Developer Tooling | AUTHCLI-DIAG-01-001 | DONE (2025-10-15) | Surface password policy diagnostics in CLI startup/output so operators see weakened overrides immediately.
CLI now loads Authority plug-ins at startup, logs weakened password policies (length/complexity), and regression coverage lives in `StellaOps.Cli.Tests/Services/AuthorityDiagnosticsReporterTests`. | DevEx/CLI | Path: src/Cli/StellaOps.Cli | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 1 — Stabilize In-Progress Foundations | AUTHPLUG-DOCS-01-001 | DONE (2025-10-11) | PLG6.DOC — Developer guide copy + diagrams merged 2025-10-11; limiter guidance incorporated and handed to Docs guild for asset export. | Team Authority Platform & Security Guild | Path: src/Authority/StellaOps.Authority/StellaOps.Authority.Plugin.Standard | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 2 — Connector & Data Implementation Wave | FEEDNORM-NORM-02-001 | DONE (2025-10-12) | SemVer normalized rule emitter
`SemVerRangeRuleBuilder` shipped 2025-10-12 with comparator/` | Team Normalization & Storage Backbone | Path: src/Concelier/__Libraries/StellaOps.Concelier.Normalization | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 2 — Connector & Data Implementation Wave | FEEDSTORAGE-DATA-02-001 | DONE (2025-10-11) | Normalized range dual-write + backfill | Team Normalization & Storage Backbone | Path: src/Concelier/__Libraries/StellaOps.Concelier.Storage.Mongo | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 2 — Connector & Data Implementation Wave | FEEDSTORAGE-DATA-02-002 | DONE (2025-10-11) | Provenance decision reason persistence | Team Normalization & Storage Backbone | Path: src/Concelier/__Libraries/StellaOps.Concelier.Storage.Mongo | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 2 — Connector & Data Implementation Wave | FEEDSTORAGE-DATA-02-003 | DONE (2025-10-11) | Normalized versions indexing
Indexes seeded + docs updated 2025-10-11 to cover flattened normalized rules for connector adoption. | Team Normalization & Storage Backbone | Path: src/Concelier/__Libraries/StellaOps.Concelier.Storage.Mongo | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 2 — Connector & Data Implementation Wave | FEEDMERGE-ENGINE-02-002 | DONE (2025-10-11) | Normalized versions union & dedupe
Affected package resolver unions/dedupes normalized rules, stamps merge provenance with `decisionReason`, and tests cover the rollout. | Team Normalization & Storage Backbone | Path: src/Concelier/__Libraries/StellaOps.Concelier.Merge | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 2 — Connector & Data Implementation Wave | FEEDCONN-GHSA-02-001 | DONE (2025-10-11) | GHSA normalized versions & provenance | Team Connector Expansion – GHSA/NVD/OSV | Path: src/Concelier/StellaOps.Concelier.PluginBinaries/StellaOps.Concelier.Connector.Ghsa | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 2 — Connector & Data Implementation Wave | FEEDCONN-GHSA-02-004 | DONE (2025-10-11) | GHSA credits & ecosystem severity mapping | Team Connector Expansion – GHSA/NVD/OSV | Path: src/Concelier/StellaOps.Concelier.PluginBinaries/StellaOps.Concelier.Connector.Ghsa | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 2 — Connector & Data Implementation Wave | FEEDCONN-GHSA-02-005 | DONE (2025-10-12) | GitHub quota monitoring & retries | Team Connector Expansion – GHSA/NVD/OSV | Path: src/Concelier/StellaOps.Concelier.PluginBinaries/StellaOps.Concelier.Connector.Ghsa | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 2 — Connector & Data Implementation Wave | FEEDCONN-GHSA-02-006 | DONE (2025-10-12) | Production credential & scheduler rollout | Team Connector Expansion – GHSA/NVD/OSV | Path: src/Concelier/StellaOps.Concelier.PluginBinaries/StellaOps.Concelier.Connector.Ghsa | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 2 — Connector & Data Implementation Wave | FEEDCONN-GHSA-02-007 | DONE (2025-10-12) | Credit parity regression fixtures | Team Connector Expansion – GHSA/NVD/OSV | Path: src/Concelier/StellaOps.Concelier.PluginBinaries/StellaOps.Concelier.Connector.Ghsa | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 2 — Connector & Data Implementation Wave | FEEDCONN-NVD-02-002 | DONE (2025-10-11) | NVD normalized versions & timestamps | Team Connector Expansion – GHSA/NVD/OSV | Path: src/Concelier/StellaOps.Concelier.PluginBinaries/StellaOps.Concelier.Connector.Nvd | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 2 — Connector & Data Implementation Wave | FEEDCONN-NVD-02-004 | DONE (2025-10-11) | NVD CVSS & CWE precedence payloads | Team Connector Expansion – GHSA/NVD/OSV | Path: src/Concelier/StellaOps.Concelier.PluginBinaries/StellaOps.Concelier.Connector.Nvd | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 2 — Connector & Data Implementation Wave | FEEDCONN-NVD-02-005 | DONE (2025-10-12) | NVD merge/export parity regression | Team Connector Expansion – GHSA/NVD/OSV | Path: src/Concelier/StellaOps.Concelier.PluginBinaries/StellaOps.Concelier.Connector.Nvd | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 2 — Connector & Data Implementation Wave | FEEDCONN-OSV-02-003 | DONE (2025-10-11) | OSV normalized versions & freshness | Team Connector Expansion – GHSA/NVD/OSV | Path: src/Concelier/StellaOps.Concelier.PluginBinaries/StellaOps.Concelier.Connector.Osv | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 2 — Connector & Data Implementation Wave | FEEDCONN-OSV-02-004 | DONE (2025-10-11) | OSV references & credits alignment | Team Connector Expansion – GHSA/NVD/OSV | Path: src/Concelier/StellaOps.Concelier.PluginBinaries/StellaOps.Concelier.Connector.Osv | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 2 — Connector & Data Implementation Wave | FEEDCONN-OSV-02-005 | DONE (2025-10-12) | Fixture updater workflow
Resolved 2025-10-12: OSV mapper now derives canonical PURLs for Go + scoped npm packages when raw payloads omit `purl`; conflict fixtures unchanged for invalid npm names. Verified via `dotnet test src/Concelier/StellaOps.Concelier.PluginBinaries/StellaOps.Concelier.Connector.Osv.Tests`, `src/Concelier/StellaOps.Concelier.PluginBinaries/StellaOps.Concelier.Connector.Ghsa.Tests`, `src/Concelier/StellaOps.Concelier.PluginBinaries/StellaOps.Concelier.Connector.Nvd.Tests`, and backbone normalization/storage suites. | Team Connector Expansion – GHSA/NVD/OSV | Path: src/Concelier/StellaOps.Concelier.PluginBinaries/StellaOps.Concelier.Connector.Osv | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 2 — Connector & Data Implementation Wave | FEEDCONN-ACSC-02-001 … 02-008 | DONE (2025-10-12) | Fetch→parse→map pipeline, fixtures, diagnostics, and README finished 2025-10-12; downstream export parity captured via FEEDEXPORT-JSON-04-001 / FEEDEXPORT-TRIVY-04-001 (completed). | Team Connector Expansion – Regional & Vendor Feeds | Path: src/Concelier/StellaOps.Concelier.PluginBinaries/StellaOps.Concelier.Connector.Acsc | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 2 — Connector & Data Implementation Wave | FEEDCONN-CCCS-02-001 … 02-008 | DONE (2025-10-16) | Observability meter, historical harvest plan, and DOM sanitizer refinements wrapped; ops notes live under `docs/modules/concelier/operations/connectors/cccs.md` with fixtures validating EN/FR list handling. | Team Connector Expansion – Regional & Vendor Feeds | Path: src/Concelier/StellaOps.Concelier.PluginBinaries/StellaOps.Concelier.Connector.Cccs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 2 — Connector & Data Implementation Wave | FEEDCONN-CERTBUND-02-001 … 02-008 | DONE (2025-10-15) | Telemetry/docs (02-006) and history/locale sweep (02-007) completed alongside pipeline; runbook `docs/modules/concelier/operations/connectors/certbund.md` captures locale guidance and offline packaging. | Team Connector Expansion – Regional & Vendor Feeds | Path: src/Concelier/StellaOps.Concelier.PluginBinaries/StellaOps.Concelier.Connector.CertBund | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 2 — Connector & Data Implementation Wave | FEEDCONN-KISA-02-001 … 02-007 | DONE (2025-10-14) | Connector, tests, and telemetry/docs (02-006) finalized; localisation notes in `docs/dev/kisa_connector_notes.md` complete rollout. | Team Connector Expansion – Regional & Vendor Feeds | Path: src/Concelier/StellaOps.Concelier.PluginBinaries/StellaOps.Concelier.Connector.Kisa | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 2 — Connector & Data Implementation Wave | FEEDCONN-RUBDU-02-001 … 02-008 | DONE (2025-10-14) | Fetch/parser/mapper refinements, regression fixtures, telemetry/docs, access options, and trusted root packaging all landed; README documents offline access strategy. | Team Connector Expansion – Regional & Vendor Feeds | Path: src/Concelier/StellaOps.Concelier.PluginBinaries/StellaOps.Concelier.Connector.Ru.Bdu | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 2 — Connector & Data Implementation Wave | FEEDCONN-NKCKI-02-001 … 02-008 | DONE (2025-10-13) | Listing fetch, parser, mapper, fixtures, telemetry/docs, and archive plan finished; Mongo2Go/libcrypto dependency resolved via bundled OpenSSL noted in ops guide. | Team Connector Expansion – Regional & Vendor Feeds | Path: src/Concelier/StellaOps.Concelier.PluginBinaries/StellaOps.Concelier.Connector.Ru.Nkcki | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 2 — Connector & Data Implementation Wave | FEEDCONN-ICSCISA-02-001 … 02-011 | DONE (2025-10-16) | Feed parser attachment fixes, SemVer exact values, regression suites, telemetry/docs updates, and handover complete; ops runbook now details attachment verification + proxy usage. | Team Connector Expansion – Regional & Vendor Feeds | Path: src/Concelier/StellaOps.Concelier.PluginBinaries/StellaOps.Concelier.Connector.Ics.Cisa | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 2 — Connector & Data Implementation Wave | FEEDCONN-CISCO-02-001 … 02-007 | DONE (2025-10-14) | OAuth fetch pipeline, DTO/mapping, tests, and telemetry/docs shipped; monitoring/export integration follow-ups recorded in Ops docs and exporter backlog (completed). | Team Connector Expansion – Regional & Vendor Feeds | Path: src/Concelier/StellaOps.Concelier.PluginBinaries/StellaOps.Concelier.Connector.Vndr.Cisco | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 2 — Connector & Data Implementation Wave | FEEDCONN-MSRC-02-001 … 02-008 | DONE (2025-10-15) | Azure AD onboarding (02-008) unblocked fetch/parse/map pipeline; fixtures, telemetry/docs, and Offline Kit guidance published in `docs/modules/concelier/operations/connectors/msrc.md`. | Team Connector Expansion – Regional & Vendor Feeds | Path: src/Concelier/StellaOps.Concelier.PluginBinaries/StellaOps.Concelier.Connector.Vndr.Msrc | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 2 — Connector & Data Implementation Wave | FEEDCONN-CVE-02-001 … 02-002 | DONE (2025-10-15) | CVE data-source selection, fetch pipeline, and docs landed 2025-10-10. 2025-10-15: smoke verified using the seeded mirror fallback; connector now logs a warning and pulls from `seed-data/cve/` until live CVE Services credentials arrive. | Team Connector Support & Monitoring | Path: src/Concelier/StellaOps.Concelier.PluginBinaries/StellaOps.Concelier.Connector.Cve | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 2 — Connector & Data Implementation Wave | FEEDCONN-KEV-02-001 … 02-002 | DONE (2025-10-12) | KEV catalog ingestion, fixtures, telemetry, and schema validation completed 2025-10-12; ops dashboard published. | Team Connector Support & Monitoring | Path: src/Concelier/StellaOps.Concelier.PluginBinaries/StellaOps.Concelier.Connector.Kev | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 2 — Connector & Data Implementation Wave | FEEDDOCS-DOCS-01-001 | DONE (2025-10-11) | Canonical schema docs refresh
Updated canonical schema + provenance guides with SemVer style, normalized version rules, decision reason change log, and migration notes. | Team Docs & Knowledge Base | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 2 — Connector & Data Implementation Wave | FEEDDOCS-DOCS-02-001 | DONE (2025-10-11) | Concelier-SemVer Playbook
Published merge playbook covering mapper patterns, dedupe flow, indexes, and rollout checklist. | Team Docs & Knowledge Base | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 2 — Connector & Data Implementation Wave | FEEDDOCS-DOCS-02-002 | DONE (2025-10-11) | Normalized versions query guide
Delivered Mongo index/query addendum with `$unwind` recipes, dedupe checks, and operational checklist.
Instructions to work:
DONE Read ./AGENTS.md and docs/AGENTS.md. Document every schema/index/query change produced in Sprint 1-2 leveraging ./src/FASTER_MODELING_AND_NORMALIZATION.md. | Team Docs & Knowledge Base | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 3 — Conflict Resolution Integration & Communications | FEEDCORE-ENGINE-03-001 | DONE (2025-10-11) | Canonical merger implementation
`CanonicalMerger` ships with freshness/tie-breaker logic, provenance, and unit coverage feeding Merge. | Team Core Engine & Storage Analytics | Path: src/Concelier/__Libraries/StellaOps.Concelier.Core | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 3 — Conflict Resolution Integration & Communications | FEEDCORE-ENGINE-03-002 | DONE (2025-10-11) | Field precedence and tie-breaker map
Field precedence tables and tie-breaker metrics wired into the canonical merge flow; docs/tests updated.
Instructions to work:
Read ./AGENTS.md and core AGENTS. Implement the conflict resolver exactly as specified in ./src/DEDUP_CONFLICTS_RESOLUTION_ALGO.md, coordinating with Merge and Storage teammates. | Team Core Engine & Storage Analytics | Path: src/Concelier/__Libraries/StellaOps.Concelier.Core | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 3 — Conflict Resolution Integration & Communications | FEEDSTORAGE-DATA-03-001 | DONE (2025-10-11) | Merge event provenance audit prep
Merge events now persist `fieldDecisions` and analytics-ready provenance snapshots. | Team Core Engine & Storage Analytics | Path: src/Concelier/__Libraries/StellaOps.Concelier.Storage.Mongo | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 3 — Conflict Resolution Integration & Communications | FEEDSTORAGE-DATA-02-001 | DONE (2025-10-11) | Normalized range dual-write + backfill
Dual-write/backfill flag delivered; migration + options validated in tests. | Team Core Engine & Storage Analytics | Path: src/Concelier/__Libraries/StellaOps.Concelier.Storage.Mongo | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 3 — Conflict Resolution Integration & Communications | FEEDSTORAGE-TESTS-02-004 | DONE (2025-10-11) | Restore AdvisoryStore build after normalized versions refactor
Storage tests adjusted for normalized versions/decision reasons.
Instructions to work:
Read ./AGENTS.md and storage AGENTS. Extend merge events with decision reasons and analytics views to support the conflict rules, and deliver the dual-write/backfill for `NormalizedVersions` + `decisionReason` so connectors can roll out safely. | Team Core Engine & Storage Analytics | Path: src/Concelier/__Libraries/StellaOps.Concelier.Storage.Mongo | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 3 — Conflict Resolution Integration & Communications | FEEDMERGE-ENGINE-04-001 | DONE (2025-10-11) | GHSA/NVD/OSV conflict rules
Merge pipeline consumes `CanonicalMerger` output prior to precedence merge. | Team Merge & QA Enforcement | Path: src/Concelier/__Libraries/StellaOps.Concelier.Merge | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 3 — Conflict Resolution Integration & Communications | FEEDMERGE-ENGINE-04-002 | DONE (2025-10-11) | Override metrics instrumentation
Merge events capture per-field decisions; counters/logs align with conflict rules. | Team Merge & QA Enforcement | Path: src/Concelier/__Libraries/StellaOps.Concelier.Merge | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 3 — Conflict Resolution Integration & Communications | FEEDMERGE-ENGINE-04-003 | DONE (2025-10-11) | Reference & credit union pipeline
Canonical merge preserves unions with updated tests. | Team Merge & QA Enforcement | Path: src/Concelier/__Libraries/StellaOps.Concelier.Merge | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 3 — Conflict Resolution Integration & Communications | FEEDMERGE-QA-04-001 | DONE (2025-10-11) | End-to-end conflict regression suite
Added regression tests (`AdvisoryMergeServiceTests`) covering canonical + precedence flow.
Instructions to work:
Read ./AGENTS.md and merge AGENTS. Integrate the canonical merger, instrument metrics, and deliver comprehensive regression tests following ./src/DEDUP_CONFLICTS_RESOLUTION_ALGO.md. | Team Merge & QA Enforcement | Path: src/Concelier/__Libraries/StellaOps.Concelier.Merge | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 3 — Conflict Resolution Integration & Communications | FEEDCONN-GHSA-04-002 | DONE (2025-10-12) | GHSA conflict regression fixtures | Team Connector Regression Fixtures | Path: src/Concelier/StellaOps.Concelier.PluginBinaries/StellaOps.Concelier.Connector.Ghsa | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 3 — Conflict Resolution Integration & Communications | FEEDCONN-NVD-04-002 | DONE (2025-10-12) | NVD conflict regression fixtures | Team Connector Regression Fixtures | Path: src/Concelier/StellaOps.Concelier.PluginBinaries/StellaOps.Concelier.Connector.Nvd | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 3 — Conflict Resolution Integration & Communications | FEEDCONN-OSV-04-002 | DONE (2025-10-12) | OSV conflict regression fixtures
Instructions to work:
Read ./AGENTS.md and module AGENTS. Produce fixture triples supporting the precedence/tie-breaker paths defined in ./src/DEDUP_CONFLICTS_RESOLUTION_ALGO.md and hand them to Merge QA. | Team Connector Regression Fixtures | Path: src/Concelier/StellaOps.Concelier.PluginBinaries/StellaOps.Concelier.Connector.Osv | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 3 — Conflict Resolution Integration & Communications | FEEDDOCS-DOCS-05-001 | DONE (2025-10-11) | Concelier Conflict Rules
Runbook published at `docs/modules/concelier/operations/conflict-resolution.md`; metrics/log guidance aligned with Sprint 3 merge counters. | Team Documentation Guild – Conflict Guidance | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 3 — Conflict Resolution Integration & Communications | FEEDDOCS-DOCS-05-002 | DONE (2025-10-16) | Conflict runbook ops rollout
Ops review completed, alert thresholds applied, and change log appended in `docs/modules/concelier/operations/conflict-resolution.md`; task closed after connector signals verified. | Team Documentation Guild – Conflict Guidance | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 4 — Schema Parity & Freshness Alignment | FEEDMODELS-SCHEMA-04-001 | DONE (2025-10-15) | Advisory schema parity (description/CWE/canonical metric)
Extend `Advisory` and related records with description text, CWE collection, and canonical metric pointer; refresh validation + serializer determinism tests. | Team Models & Merge Leads | Path: src/Concelier/__Libraries/StellaOps.Concelier.Models | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 4 — Schema Parity & Freshness Alignment | FEEDCORE-ENGINE-04-003 | DONE (2025-10-15) | Canonical merger parity for new fields
Teach `CanonicalMerger` to populate description, CWEResults, and canonical metric pointer with provenance + regression coverage. | Team Core Engine & Storage Analytics | Path: src/Concelier/__Libraries/StellaOps.Concelier.Core | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 4 — Schema Parity & Freshness Alignment | FEEDCORE-ENGINE-04-004 | DONE (2025-10-15) | Reference normalization & freshness instrumentation cleanup
Implement URL normalization for reference dedupe, align freshness-sensitive instrumentation, and add analytics tests. | Team Core Engine & Storage Analytics | Path: src/Concelier/__Libraries/StellaOps.Concelier.Core | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 4 — Schema Parity & Freshness Alignment | FEEDMERGE-ENGINE-04-004 | DONE (2025-10-15) | Merge pipeline parity for new advisory fields
Ensure merge service + merge events surface description/CWE/canonical metric decisions with updated metrics/tests. | Team Merge & QA Enforcement | Path: src/Concelier/__Libraries/StellaOps.Concelier.Merge | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 4 — Schema Parity & Freshness Alignment | FEEDMERGE-ENGINE-04-005 | DONE (2025-10-15) | Connector coordination for new advisory fields
GHSA/NVD/OSV connectors now ship description, CWE, and canonical metric data with refreshed fixtures; merge coordination log updated and exporters notified. | Team Merge & QA Enforcement | Path: src/Concelier/__Libraries/StellaOps.Concelier.Merge | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 4 — Schema Parity & Freshness Alignment | FEEDEXPORT-JSON-04-001 | DONE (2025-10-15) | Surface new advisory fields in JSON exporter
Update schemas/offline bundle + fixtures once model/core parity lands.
2025-10-15: `dotnet test src/Concelier/StellaOps.Concelier.PluginBinaries/StellaOps.Concelier.Exporter.Json.Tests` validated canonical metric/CWE emission. | Team Exporters – JSON | Path: src/Concelier/StellaOps.Concelier.PluginBinaries/StellaOps.Concelier.Exporter.Json | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 4 — Schema Parity & Freshness Alignment | FEEDEXPORT-TRIVY-04-001 | DONE (2025-10-15) | Propagate new advisory fields into Trivy DB package
Extend Bolt builder, metadata, and regression tests for the expanded schema.
2025-10-15: `dotnet test src/Concelier/StellaOps.Concelier.PluginBinaries/StellaOps.Concelier.Exporter.TrivyDb.Tests` confirmed canonical metric/CWE propagation. | Team Exporters – Trivy DB | Path: src/Concelier/StellaOps.Concelier.PluginBinaries/StellaOps.Concelier.Exporter.TrivyDb | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 4 — Schema Parity & Freshness Alignment | FEEDCONN-GHSA-04-004 | DONE (2025-10-16) | Harden CVSS fallback so canonical metric ids persist when GitHub omits vectors; extend fixtures and document severity precedence hand-off to Merge. | Team Connector Regression Fixtures | Path: src/Concelier/StellaOps.Concelier.PluginBinaries/StellaOps.Concelier.Connector.Ghsa | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 4 — Schema Parity & Freshness Alignment | FEEDCONN-OSV-04-005 | DONE (2025-10-16) | Map OSV advisories lacking CVSS vectors to canonical metric ids/notes and document CWE provenance quirks; schedule parity fixture updates. | Team Connector Expansion – GHSA/NVD/OSV | Path: src/Concelier/StellaOps.Concelier.PluginBinaries/StellaOps.Concelier.Connector.Osv | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 5 — Excititor Core Foundations | EXCITITOR-CORE-01-001 | DONE (2025-10-15) | Stand up canonical VEX claim/consensus records with deterministic serializers so Storage/Exports share a stable contract. | Team Excititor Core & Policy | Path: src/Excititor/__Libraries/StellaOps.Excititor.Core | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 5 — Excititor Core Foundations | EXCITITOR-CORE-01-002 | DONE (2025-10-15) | Implement trust-weighted consensus resolver with baseline policy weights, justification gates, telemetry output, and majority/tie handling. | Team Excititor Core & Policy | Path: src/Excititor/__Libraries/StellaOps.Excititor.Core | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 5 — Excititor Core Foundations | EXCITITOR-CORE-01-003 | DONE (2025-10-15) | Publish shared connector/exporter/attestation abstractions and deterministic query signature utilities for cache/attestation workflows. | Team Excititor Core & Policy | Path: src/Excititor/__Libraries/StellaOps.Excititor.Core | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 5 — Excititor Core Foundations | EXCITITOR-POLICY-01-001 | DONE (2025-10-15) | Established policy options & snapshot provider covering baseline weights/overrides. | Team Excititor Policy | Path: src/Excititor/__Libraries/StellaOps.Excititor.Policy | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 5 — Excititor Core Foundations | EXCITITOR-POLICY-01-002 | DONE (2025-10-15) | Policy evaluator now feeds consensus resolver with immutable snapshots. | Team Excititor Policy | Path: src/Excititor/__Libraries/StellaOps.Excititor.Policy | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 5 — Excititor Core Foundations | EXCITITOR-POLICY-01-003 | DONE (2025-10-16) | Author policy diagnostics, CLI/WebService surfacing, and documentation updates. | Team Excititor Policy | Path: src/Excititor/__Libraries/StellaOps.Excititor.Policy | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 5 — Excititor Core Foundations | EXCITITOR-POLICY-01-004 | DONE (2025-10-16) | Implement YAML/JSON schema validation and deterministic diagnostics for operator bundles. | Team Excititor Policy | Path: src/Excititor/__Libraries/StellaOps.Excititor.Policy | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 5 — Excititor Core Foundations | EXCITITOR-POLICY-01-005 | DONE (2025-10-16) | Add policy change tracking, snapshot digests, and telemetry/logging hooks. | Team Excititor Policy | Path: src/Excititor/__Libraries/StellaOps.Excititor.Policy | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 5 — Excititor Core Foundations | EXCITITOR-STORAGE-01-001 | DONE (2025-10-15) | Mongo mapping registry plus raw/export entities and DI extensions in place. | Team Excititor Storage | Path: src/Excititor/__Libraries/StellaOps.Excititor.Storage.Mongo | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 5 — Excititor Core Foundations | EXCITITOR-STORAGE-01-004 | DONE (2025-10-16) | Build provider/consensus/cache class maps and related collections. | Team Excititor Storage | Path: src/Excititor/__Libraries/StellaOps.Excititor.Storage.Mongo | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 5 — Excititor Core Foundations | EXCITITOR-EXPORT-01-001 | DONE (2025-10-15) | Export engine delivers cache lookup, manifest creation, and policy integration. | Team Excititor Export | Path: src/Excititor/__Libraries/StellaOps.Excititor.Export | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 5 — Excititor Core Foundations | EXCITITOR-EXPORT-01-004 | DONE (2025-10-17) | Connect export engine to attestation client and persist Rekor metadata. | Team Excititor Export | Path: src/Excititor/__Libraries/StellaOps.Excititor.Export | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 5 — Excititor Core Foundations | EXCITITOR-ATTEST-01-001 | DONE (2025-10-16) | Implement in-toto predicate + DSSE builder providing envelopes for export attestation. | Team Excititor Attestation | Path: src/Excititor/__Libraries/StellaOps.Excititor.Attestation | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 5 — Excititor Core Foundations | EXCITITOR-CONN-ABS-01-001 | DONE (2025-10-17) | Deliver shared connector context/base classes so provider plug-ins can be activated via WebService/Worker. | Team Excititor Connectors | Path: src/Excititor/__Libraries/StellaOps.Excititor.Connectors.Abstractions | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 5 — Excititor Core Foundations | EXCITITOR-WEB-01-001 | DONE (2025-10-17) | Scaffold minimal API host, DI, and `/excititor/status` endpoint integrating policy, storage, export, and attestation services. | Team Excititor WebService | Path: src/Excititor/StellaOps.Excititor.WebService | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 6 — Excititor Ingest & Formats | EXCITITOR-WORKER-01-001 | DONE (2025-10-17) | Create Worker host with provider scheduling and logging to drive recurring pulls/reconciliation. | Team Excititor Worker | Path: src/Excititor/StellaOps.Excititor.Worker | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 6 — Excititor Ingest & Formats | EXCITITOR-FMT-CSAF-01-001 | DONE (2025-10-17) | Implement CSAF normalizer foundation translating provider documents into `VexClaim` entries. | Team Excititor Formats | Path: src/Excititor/__Libraries/StellaOps.Excititor.Formats.CSAF | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 6 — Excititor Ingest & Formats | EXCITITOR-FMT-CYCLONE-01-001 | DONE (2025-10-17) | Implement CycloneDX VEX normalizer capturing `analysis` state and component references. | Team Excititor Formats | Path: src/Excititor/__Libraries/StellaOps.Excititor.Formats.CycloneDX | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 6 — Excititor Ingest & Formats | EXCITITOR-FMT-OPENVEX-01-001 | DONE (2025-10-17) | Implement OpenVEX normalizer to ingest attestations into canonical claims with provenance. | Team Excititor Formats | Path: src/Excititor/__Libraries/StellaOps.Excititor.Formats.OpenVEX | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 6 — Excititor Ingest & Formats | EXCITITOR-CONN-RH-01-001 | DONE (2025-10-17) | Ship Red Hat CSAF provider metadata discovery enabling incremental pulls. | Team Excititor Connectors – Red Hat | Path: src/Excititor/__Libraries/StellaOps.Excititor.Connectors.RedHat.CSAF | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 6 — Excititor Ingest & Formats | EXCITITOR-CONN-RH-01-002 | DONE (2025-10-17) | Fetch CSAF windows with ETag handling, resume tokens, quarantine on schema errors, and persist raw docs. | Team Excititor Connectors – Red Hat | Path: src/Excititor/__Libraries/StellaOps.Excititor.Connectors.RedHat.CSAF | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 6 — Excititor Ingest & Formats | EXCITITOR-CONN-RH-01-003 | DONE (2025-10-17) | Populate provider trust overrides (cosign issuer, identity regex) and provenance hints for policy evaluation/logging. | Team Excititor Connectors – Red Hat | Path: src/Excititor/__Libraries/StellaOps.Excititor.Connectors.RedHat.CSAF | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 6 — Excititor Ingest & Formats | EXCITITOR-CONN-RH-01-004 | DONE (2025-10-17) | Persist resume cursors (last updated timestamp/document hashes) in storage and reload during fetch to avoid duplicates. | Team Excititor Connectors – Red Hat | Path: src/Excititor/__Libraries/StellaOps.Excititor.Connectors.RedHat.CSAF | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 6 — Excititor Ingest & Formats | EXCITITOR-CONN-RH-01-005 | DONE (2025-10-17) | Register connector in Worker/WebService DI, add scheduled jobs, and document CLI triggers for Red Hat CSAF pulls. | Team Excititor Connectors – Red Hat | Path: src/Excititor/__Libraries/StellaOps.Excititor.Connectors.RedHat.CSAF | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 6 — Excititor Ingest & Formats | EXCITITOR-CONN-RH-01-006 | DONE (2025-10-17) | Add CSAF normalization parity fixtures ensuring RHSA-specific metadata is preserved. | Team Excititor Connectors – Red Hat | Path: src/Excititor/__Libraries/StellaOps.Excititor.Connectors.RedHat.CSAF | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 6 — Excititor Ingest & Formats | EXCITITOR-CONN-CISCO-01-001 | DONE (2025-10-17) | Implement Cisco CSAF endpoint discovery/auth to unlock paginated pulls. | Team Excititor Connectors – Cisco | Path: src/Excititor/__Libraries/StellaOps.Excititor.Connectors.Cisco.CSAF | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 6 — Excititor Ingest & Formats | EXCITITOR-CONN-CISCO-01-002 | DONE (2025-10-17) | Implement Cisco CSAF paginated fetch loop with dedupe and raw persistence support. | Team Excititor Connectors – Cisco | Path: src/Excititor/__Libraries/StellaOps.Excititor.Connectors.Cisco.CSAF | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 6 — Excititor Ingest & Formats | EXCITITOR-CONN-SUSE-01-001 | DONE (2025-10-17) | Build Rancher VEX Hub discovery/subscription path with offline snapshot support. | Team Excititor Connectors – SUSE | Path: src/Excititor/__Libraries/StellaOps.Excititor.Connectors.SUSE.RancherVEXHub | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 6 — Excititor Ingest & Formats | EXCITITOR-CONN-MS-01-001 | DONE (2025-10-17) | Deliver AAD onboarding/token cache for MSRC CSAF ingestion. | Team Excititor Connectors – MSRC | Path: src/Excititor/__Libraries/StellaOps.Excititor.Connectors.MSRC.CSAF | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 6 — Excititor Ingest & Formats | EXCITITOR-CONN-ORACLE-01-001 | DONE (2025-10-17) | Implement Oracle CSAF catalogue discovery with CPU calendar awareness. | Team Excititor Connectors – Oracle | Path: src/Excititor/__Libraries/StellaOps.Excititor.Connectors.Oracle.CSAF | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 6 — Excititor Ingest & Formats | EXCITITOR-CONN-UBUNTU-01-001 | DONE (2025-10-17) | Implement Ubuntu CSAF discovery and channel selection for USN ingestion. | Team Excititor Connectors – Ubuntu | Path: src/Excititor/__Libraries/StellaOps.Excititor.Connectors.Ubuntu.CSAF | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 6 — Excititor Ingest & Formats | EXCITITOR-CONN-OCI-01-001 | DONE (2025-10-18) | Wire OCI discovery/auth to fetch OpenVEX attestations for configured images. | Team Excititor Connectors – OCI | Path: src/Excititor/__Libraries/StellaOps.Excititor.Connectors.OCI.OpenVEX.Attest | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 6 — Excititor Ingest & Formats | EXCITITOR-CONN-OCI-01-002 | DONE (2025-10-18) | Attestation fetch & verify loop – download DSSE attestations, trigger verification, handle retries/backoff, persist raw statements. | Team Excititor Connectors – OCI | Path: src/Excititor/__Libraries/StellaOps.Excititor.Connectors.OCI.OpenVEX.Attest | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 6 — Excititor Ingest & Formats | EXCITITOR-CONN-OCI-01-003 | DONE (2025-10-18) | Provenance metadata & policy hooks – emit image, subject digest, issuer, and trust metadata for policy weighting/logging. | Team Excititor Connectors – OCI | Path: src/Excititor/__Libraries/StellaOps.Excititor.Connectors.OCI.OpenVEX.Attest | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 6 — Excititor Ingest & Formats | EXCITITOR-CLI-01-001 | DONE (2025-10-18) | Add `excititor` CLI verbs bridging to WebService with consistent auth and offline UX. | DevEx/CLI | Path: src/Cli/StellaOps.Cli | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 7 — Contextual Truth Foundations | EXCITITOR-CORE-02-001 | DONE (2025-10-19) | Context signal schema prep – extend consensus models with severity/KEV/EPSS fields and update canonical serializers. | Team Excititor Core & Policy | Path: src/Excititor/__Libraries/StellaOps.Excititor.Core | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 7 — Contextual Truth Foundations | EXCITITOR-POLICY-02-001 | DONE (2025-10-19) | Scoring coefficients & weight ceilings – add α/β options, weight boosts, and validation guidance. | Team Excititor Policy | Path: src/Excititor/__Libraries/StellaOps.Excititor.Policy | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 7 — Contextual Truth Foundations | EXCITITOR-ATTEST-01-002 | DONE (2025-10-16) | Rekor v2 client integration – ship transparency log client with retries and offline queue. | Team Excititor Attestation | Path: src/Excititor/__Libraries/StellaOps.Excititor.Attestation | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 9 — Scanner Core Foundations | SCANNER-CORE-09-501 | DONE (2025-10-18) | Define shared DTOs (ScanJob, ProgressEvent), error taxonomy, and deterministic ID/timestamp helpers aligning with `modules/scanner/architecture.md` §3–§4. | Team Scanner Core | Path: src/Scanner/__Libraries/StellaOps.Scanner.Core | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 9 — Scanner Core Foundations | SCANNER-CORE-09-502 | DONE (2025-10-18) | Observability helpers (correlation IDs, logging scopes, metric namespacing, deterministic hashes) consumed by WebService/Worker. | Team Scanner Core | Path: src/Scanner/__Libraries/StellaOps.Scanner.Core | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 9 — Scanner Core Foundations | SCANNER-CORE-09-503 | DONE (2025-10-18) | Security utilities: Authority client factory, OpTok caching, DPoP verifier, restart-time plug-in guardrails for scanner components. | Team Scanner Core | Path: src/Scanner/__Libraries/StellaOps.Scanner.Core | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 9 — Scanner Build-time | SP9-BLDX-09-001 | DONE (2025-10-19) | Buildx driver scaffold + handshake with Scanner.Emit (local CAS). | BuildX Guild | Path: src/Scanner/StellaOps.Scanner.Sbomer.BuildXPlugin | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 9 — Scanner Build-time | SP9-BLDX-09-002 | DONE (2025-10-19) | OCI annotations + provenance hand-off to Attestor. | BuildX Guild | Path: src/Scanner/StellaOps.Scanner.Sbomer.BuildXPlugin | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 9 — Scanner Build-time | SP9-BLDX-09-003 | DONE (2025-10-19) | CI demo: minimal SBOM push & backend report wiring. | BuildX Guild | Path: src/Scanner/StellaOps.Scanner.Sbomer.BuildXPlugin | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 9 — Scanner Build-time | SP9-BLDX-09-004 | DONE (2025-10-19) | Stabilize descriptor nonce derivation so repeated builds emit deterministic placeholders. | BuildX Guild | Path: src/Scanner/StellaOps.Scanner.Sbomer.BuildXPlugin | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 9 — Scanner Build-time | SP9-BLDX-09-005 | DONE (2025-10-19) | Integrate determinism guard into GitHub/Gitea workflows and archive proof artifacts. | BuildX Guild | Path: src/Scanner/StellaOps.Scanner.Sbomer.BuildXPlugin | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 9 — Scanner Core Foundations | SCANNER-WEB-09-101 | DONE (2025-10-18) | Minimal API host with Authority enforcement, health/ready endpoints, and restart-time plug-in loader per architecture §1, §4. | Team Scanner WebService | Path: src/Scanner/StellaOps.Scanner.WebService | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 9 — Scanner Core Foundations | SCANNER-WEB-09-102 | DONE (2025-10-18) | `/api/v1/scans` submission/status endpoints with deterministic IDs, validation, and cancellation support. | Team Scanner WebService | Path: src/Scanner/StellaOps.Scanner.WebService | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 9 — Scanner Core Foundations | SCANNER-WEB-09-104 | DONE (2025-10-19) | Configuration binding for Mongo, MinIO, queue, feature flags; startup diagnostics and fail-fast policy. | Team Scanner WebService | Path: src/Scanner/StellaOps.Scanner.WebService | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 9 — Scanner Core Foundations | SCANNER-WORKER-09-201 | DONE (2025-10-19) | Worker host bootstrap with Authority auth, hosted services, and graceful shutdown semantics. | Team Scanner Worker | Path: src/Scanner/StellaOps.Scanner.Worker | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 9 — Scanner Core Foundations | SCANNER-WORKER-09-202 | DONE (2025-10-19) | Lease/heartbeat loop with retry+jitter, poison-job quarantine, structured logging. | Team Scanner Worker | Path: src/Scanner/StellaOps.Scanner.Worker | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 9 — Scanner Core Foundations | SCANNER-WORKER-09-203 | DONE (2025-10-19) | Analyzer dispatch skeleton emitting deterministic stage progress and honoring cancellation tokens. | Team Scanner Worker | Path: src/Scanner/StellaOps.Scanner.Worker | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 9 — Scanner Core Foundations | SCANNER-WORKER-09-204 | DONE (2025-10-19) | Worker metrics (queue latency, stage duration, failure counts) with OpenTelemetry resource wiring. | Team Scanner Worker | Path: src/Scanner/StellaOps.Scanner.Worker | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 9 — Scanner Core Foundations | SCANNER-WORKER-09-205 | DONE (2025-10-19) | Harden heartbeat jitter so lease safety margin stays ≥3× and cover with regression tests + optional live queue smoke run. | Team Scanner Worker | Path: src/Scanner/StellaOps.Scanner.Worker | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 9 — Policy Foundations | POLICY-CORE-09-001 | DONE | Policy schema + binder + diagnostics. | Policy Guild | Path: src/Policy/__Libraries/StellaOps.Policy | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 9 — Policy Foundations | POLICY-CORE-09-002 | DONE | Policy snapshot store + revision digests. | Policy Guild | Path: src/Policy/__Libraries/StellaOps.Policy | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 9 — Policy Foundations | POLICY-CORE-09-003 | DONE | `/policy/preview` API (image digest → projected verdict diff). | Policy Guild | Path: src/Policy/__Libraries/StellaOps.Policy | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 9 — DevOps Foundations | DEVOPS-HELM-09-001 | DONE (2025-10-19) | Helm/Compose environment profiles (dev/staging/airgap) with deterministic digests. | DevOps Guild | Path: ops/devops | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 9 — Docs & Governance | DOCS-ADR-09-001 | DONE (2025-10-19) | Establish ADR process and template. | Docs Guild, DevEx | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 9 — Docs & Governance | DOCS-EVENTS-09-002 | DONE (2025-10-19) | Publish event schema catalog (`docs/events/`) for critical envelopes. | Docs Guild, Platform Events | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 9 — Scanner Core Foundations | SCANNER-STORAGE-09-301 | DONE (2025-10-19) | Mongo catalog schemas/indexes for images, layers, artifacts, jobs, lifecycle rules plus migrations. | Team Scanner Storage | Path: src/Scanner/__Libraries/StellaOps.Scanner.Storage | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 9 — Scanner Core Foundations | SCANNER-STORAGE-09-302 | DONE (2025-10-19) | MinIO layout, immutability policies, client abstraction, and configuration binding. | Team Scanner Storage | Path: src/Scanner/__Libraries/StellaOps.Scanner.Storage | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 9 — Scanner Core Foundations | SCANNER-STORAGE-09-303 | DONE (2025-10-19) | Repositories/services with dual-write feature flag, deterministic digests, TTL enforcement tests. | Team Scanner Storage | Path: src/Scanner/__Libraries/StellaOps.Scanner.Storage | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 9 — Scanner Core Foundations | SCANNER-QUEUE-09-401 | DONE (2025-10-19) | Queue abstraction + Redis Streams adapter with ack/claim APIs and idempotency tokens. | Team Scanner Queue | Path: src/Scanner/__Libraries/StellaOps.Scanner.Queue | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 9 — Scanner Core Foundations | SCANNER-QUEUE-09-402 | DONE (2025-10-19) | Pluggable backend support (Redis, NATS) with configuration binding, health probes, failover docs. | Team Scanner Queue | Path: src/Scanner/__Libraries/StellaOps.Scanner.Queue | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 9 — Scanner Core Foundations | SCANNER-QUEUE-09-403 | DONE (2025-10-19) | Retry + dead-letter strategy with structured logs/metrics for offline deployments. | Team Scanner Queue | Path: src/Scanner/__Libraries/StellaOps.Scanner.Queue | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 1 — Stabilize In-Progress Foundations | FEEDCONN-GHSA-02-001 | DONE (2025-10-12) | GHSA normalized versions & provenance
Team instructions: Read ./AGENTS.md and each module's AGENTS file. Adopt the `NormalizedVersions` array emitted by the models sprint, wiring provenance `decisionReason` where merge overrides occur. Follow ./src/FASTER_MODELING_AND_NORMALIZATION.md; report via src/Concelier/__Libraries/StellaOps.Concelier.Merge (FEEDMERGE-COORD-02-900). Progress 2025-10-11: GHSA/OSV emit normalized arrays with refreshed fixtures; CVE mapper now surfaces SemVer normalized ranges; NVD/KEV adoption pending; outstanding follow-ups include FEEDSTORAGE-DATA-02-001, FEEDMERGE-ENGINE-02-002, and rolling `src/Tools/FixtureUpdater` updates across connectors.
Progress 2025-10-20: Coordination matrix + rollout dashboard refreshed; upcoming deadlines tracked (Cccs/Cisco 2025-10-21, CertBund 2025-10-22, ICS-CISA 2025-10-23, KISA 2025-10-24) with escalation path documented in FEEDMERGE-COORD-02-900. | Team Connector Normalized Versions Rollout | Path: src/Concelier/StellaOps.Concelier.PluginBinaries/StellaOps.Concelier.Connector.Ghsa | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 1 — Stabilize In-Progress Foundations | FEEDWEB-OPS-01-006 | DONE (2025-10-19) | Rename plugin drop directory to namespaced path
Build outputs now point at `StellaOps.Concelier.PluginBinaries`/`StellaOps.Authority.PluginBinaries`; defaults/docs/tests updated to reflect the new layout. | Team WebService & Authority | Path: src/Concelier/StellaOps.Concelier.WebService | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 7 — Contextual Truth Foundations | EXCITITOR-STORAGE-02-001 | DONE (2025-10-19) | Statement events & scoring signals – immutable VEX statements store, consensus signal fields, and migration `20251019-consensus-signals-statements` with tests (`dotnet test src/Excititor/__Tests/StellaOps.Excititor.Core.Tests/StellaOps.Excititor.Core.Tests.csproj`, `dotnet test src/Excititor/__Tests/StellaOps.Excititor.Storage.Mongo.Tests/StellaOps.Excititor.Storage.Mongo.Tests.csproj`). | Team Excititor Storage | Path: src/Excititor/__Libraries/StellaOps.Excititor.Storage.Mongo | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 7 — Contextual Truth Foundations | FEEDCORE-ENGINE-07-001 | DONE (2025-10-19) | Advisory event log & asOf queries – surface immutable statements and replay capability. | Team Core Engine & Storage Analytics | Path: src/Concelier/__Libraries/StellaOps.Concelier.Core | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 7 — Contextual Truth Foundations | FEEDWEB-EVENTS-07-001 | DONE (2025-10-19) | Advisory event replay API – expose `/concelier/advisories/{key}/replay` with `asOf` filter, hex hashes, and conflict data. | Concelier WebService Guild | Path: src/Concelier/StellaOps.Concelier.WebService | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 7 — Contextual Truth Foundations | FEEDMERGE-ENGINE-07-001 | DONE (2025-10-20) | Conflict sets & explainers – persist conflict materialization and replay hashes for merge decisions. | BE-Merge | Path: src/Concelier/__Libraries/StellaOps.Concelier.Merge | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 8 — Mongo strengthening | FEEDSTORAGE-MONGO-08-001 | DONE (2025-10-19) | Causal-consistent Concelier storage sessions
Scoped session facilitator registered, repositories accept optional session handles, and replica-set failover tests verify read-your-write + monotonic reads. | Team Normalization & Storage Backbone | Path: src/Concelier/__Libraries/StellaOps.Concelier.Storage.Mongo | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 8 — Mongo strengthening | AUTHSTORAGE-MONGO-08-001 | DONE (2025-10-19) | Harden Authority Mongo usage
Scoped Mongo sessions with majority read/write concerns wired through stores and GraphQL/HTTP pipelines; replica-set election regression validated. | Authority Core & Storage Guild | Path: src/Authority/StellaOps.Authority | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 8 — Mongo strengthening | EXCITITOR-STORAGE-MONGO-08-001 | DONE (2025-10-19) | Causal consistency for Excititor repositories
Session-scoped repositories shipped with new Mongo records, orchestrators/workers now share scoped sessions, and replica-set failover coverage added via `dotnet test src/Excititor/__Tests/StellaOps.Excititor.Storage.Mongo.Tests/StellaOps.Excititor.Storage.Mongo.Tests.csproj`. | Team Excititor Storage | Path: src/Excititor/__Libraries/StellaOps.Excititor.Storage.Mongo | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 8 — Platform Maintenance | EXCITITOR-STORAGE-03-001 | DONE (2025-10-19) | Statement backfill tooling – shipped admin backfill endpoint, CLI hook (`stellaops excititor backfill-statements`), integration tests, and operator runbook (`docs/dev/EXCITITOR_STATEMENT_BACKFILL.md`). | Team Excititor Storage | Path: src/Excititor/__Libraries/StellaOps.Excititor.Storage.Mongo | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 8 — Mirror Distribution | CONCELIER-EXPORT-08-201 | DONE (2025-10-19) | Mirror bundle + domain manifest – produce signed JSON aggregates for `*.stella-ops.org` mirrors. | Concelier Export Guild | Path: src/Concelier/StellaOps.Concelier.PluginBinaries/StellaOps.Concelier.Exporter.Json | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 8 — Mirror Distribution | CONCELIER-EXPORT-08-202 | DONE (2025-10-19) | Mirror-ready Trivy DB bundles – mirror options emit per-domain manifests/metadata/db archives with deterministic digests for downstream sync. | Concelier Export Guild | Path: src/Concelier/StellaOps.Concelier.PluginBinaries/StellaOps.Concelier.Exporter.TrivyDb | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 8 — Mirror Distribution | CONCELIER-WEB-08-201 | DONE (2025-10-20) | Mirror distribution endpoints – expose domain-scoped index/download APIs with auth/quota. | Concelier WebService Guild | Path: src/Concelier/StellaOps.Concelier.WebService | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 8 — Mirror Distribution | DEVOPS-MIRROR-08-001 | DONE (2025-10-19) | Managed mirror deployments for `*.stella-ops.org` – Helm/Compose overlays, CDN, runbooks. | DevOps Guild | Path: ops/devops | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 8 — Plugin Infrastructure | PLUGIN-DI-08-003 | DONE (2025-10-20) | Refactor Authority identity-provider registry to resolve scoped plugin services on-demand.
Introduce factory pattern aligned with scoped lifetimes decided in coordination workshop. | Plugin Platform Guild, Authority Core | Path: src/__Libraries/StellaOps.Plugin | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 8 — Plugin Infrastructure | PLUGIN-DI-08-004 | DONE (2025-10-20) | Update Authority plugin loader to activate registrars with DI support and scoped service awareness.
Add two-phase initialization allowing scoped dependencies post-container build. | Plugin Platform Guild, Authority Core | Path: src/__Libraries/StellaOps.Plugin | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 8 — Plugin Infrastructure | PLUGIN-DI-08-005 | DONE (2025-10-20) | Provide scoped-safe bootstrap execution for Authority plugins.
Implement scope-per-run pattern for hosted bootstrap tasks and document migration guidance. | Plugin Platform Guild, Authority Core | Path: src/__Libraries/StellaOps.Plugin | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 10 — DevOps Security | DEVOPS-SEC-10-301 | DONE (2025-10-20) | Address NU1902/NU1903 advisories for `MongoDB.Driver` 2.12.0 and `SharpCompress` 0.23.0; Wave 0A prerequisites confirmed complete before remediation work. | DevOps Guild | Path: ops/devops | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 11 — Signing Chain Bring-up | AUTH-DPOP-11-001 | DONE (2025-10-20) | Implement DPoP proof validation + nonce handling for high-value audiences per architecture. | Authority Core & Security Guild | Path: src/Authority/StellaOps.Authority | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 15 — Notify Foundations | NOTIFY-WEB-15-103 | DONE (2025-10-19) | Delivery history & test-send endpoints. | Notify WebService Guild | Path: src/Notify/StellaOps.Notify.WebService | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 15 — Notify Foundations | NOTIFY-CONN-SLACK-15-502 | DONE (2025-10-20) | Slack health/test-send support. | Notify Connectors Guild | Path: src/Notify/__Libraries/StellaOps.Notify.Connectors.Slack | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 15 — Notify Foundations | NOTIFY-CONN-TEAMS-15-602 | DONE (2025-10-20) | Teams health/test-send support. | Notify Connectors Guild | Path: src/Notify/__Libraries/StellaOps.Notify.Connectors.Teams | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 15 — Notify Foundations | NOTIFY-CONN-TEAMS-15-604 | DONE (2025-10-20) | Teams health endpoint metadata alignment. | Notify Connectors Guild | Path: src/Notify/__Libraries/StellaOps.Notify.Connectors.Teams | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 15 — Notify Foundations | NOTIFY-CONN-SLACK-15-503 | DONE (2025-10-20) | Package Slack connector as restart-time plug-in (manifest + host registration). | Notify Connectors Guild | Path: src/Notify/__Libraries/StellaOps.Notify.Connectors.Slack | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 15 — Notify Foundations | NOTIFY-CONN-TEAMS-15-603 | DONE (2025-10-20) | Package Teams connector as restart-time plug-in (manifest + host registration). | Notify Connectors Guild | Path: src/Notify/__Libraries/StellaOps.Notify.Connectors.Teams | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 15 — Notify Foundations | NOTIFY-CONN-EMAIL-15-703 | DONE (2025-10-20) | Package Email connector as restart-time plug-in (manifest + host registration). | Notify Connectors Guild | Path: src/Notify/__Libraries/StellaOps.Notify.Connectors.Email | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 15 — Notify Foundations | SCANNER-EVENTS-15-201 | DONE (2025-10-20) | Emit `scanner.report.ready` + `scanner.scan.completed` events. | Scanner WebService Guild | Path: src/Scanner/StellaOps.Scanner.WebService | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 15 — Notify Foundations | NOTIFY-CONN-WEBHOOK-15-803 | DONE (2025-10-20) | Package Webhook connector as restart-time plug-in (manifest + host registration). | Notify Connectors Guild | Path: src/Notify/__Libraries/StellaOps.Notify.Connectors.Webhook | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 16 — Scheduler Intelligence | SCHED-MODELS-16-103 | DONE (2025-10-20) | Versioning/migration helpers for schedules/runs. | Scheduler Models Guild | Path: src/Scheduler/__Libraries/StellaOps.Scheduler.Models | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 16 — Scheduler Intelligence | SCHED-QUEUE-16-401 | DONE (2025-10-20) | Queue abstraction + Redis Streams adapter. | Scheduler Queue Guild | Path: src/Scheduler/__Libraries/StellaOps.Scheduler.Queue | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 16 — Scheduler Intelligence | SCHED-QUEUE-16-402 | DONE (2025-10-20) | NATS JetStream adapter with health probes. | Scheduler Queue Guild | Path: src/Scheduler/__Libraries/StellaOps.Scheduler.Queue | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 16 — Scheduler Intelligence | SCHED-IMPACT-16-300 | DONE (2025-10-20) | **STUB** ImpactIndex ingest/query using fixtures (to be removed by SP16 completion). | Scheduler ImpactIndex Guild | Path: src/Scheduler/__Libraries/StellaOps.Scheduler.ImpactIndex | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | --- — --- | --- | --- | --- | --- | Path: --- | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 7 — Contextual Truth Foundations | DOCS-CONCELIER-07-201 | DONE (2025-10-22) | Final editorial review and publish pass for Concelier authority toggle documentation (Quickstart + operator guide). | Docs Guild, Concelier WebService | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 7 — Contextual Truth Foundations | EXCITITOR-WEB-01-002 | DONE (2025-10-20) | Ingest & reconcile endpoints – scope-enforced `/excititor/init`, `/excititor/ingest/run`, `/excititor/ingest/resume`, `/excititor/reconcile`; regression via `dotnet test … --filter FullyQualifiedName~IngestEndpointsTests`. | Team Excititor WebService | Path: src/Excititor/StellaOps.Excititor.WebService | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 7 — Contextual Truth Foundations | EXCITITOR-WEB-01-004 | DONE (2025-10-20) | Resolve API & signed responses – expose `/excititor/resolve`, return signed consensus/score envelopes, document auth. | Team Excititor WebService | Path: src/Excititor/StellaOps.Excititor.WebService | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 7 — Contextual Truth Foundations | EXCITITOR-WORKER-01-004 | DONE (2025-10-21) | TTL refresh & stability damper – schedule re-resolve loops and guard against status flapping. | Team Excititor Worker | Path: src/Excititor/StellaOps.Excititor.Worker | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 7 — Contextual Truth Foundations | FEEDCORE-ENGINE-07-002 | DONE (2025-10-21) | Noise prior computation service – learn false-positive priors and expose deterministic summaries. | Team Core Engine & Data Science | Path: src/Concelier/__Libraries/StellaOps.Concelier.Core | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 7 — Contextual Truth Foundations | FEEDCORE-ENGINE-07-003 | DONE (2025-10-21) | Unknown state ledger & confidence seeding – persist unknown flags, seed confidence bands, expose query surface. | Team Core Engine & Storage Analytics | Path: src/Concelier/__Libraries/StellaOps.Concelier.Core | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 7 — Contextual Truth Foundations | EXCITITOR-WEB-01-005 | DONE (2025-10-19) | Mirror distribution endpoints – expose download APIs for downstream Excititor instances. | Team Excititor WebService | Path: src/Excititor/StellaOps.Excititor.WebService | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 7 — Contextual Truth Foundations | EXCITITOR-EXPORT-01-005 | DONE (2025-10-21) | Score & resolve envelope surfaces – include signed consensus/score artifacts in exports. | Team Excititor Export | Path: src/Excititor/__Libraries/StellaOps.Excititor.Export | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 7 — Contextual Truth Foundations | EXCITITOR-EXPORT-01-006 | DONE (2025-10-21) | Quiet provenance packaging – attach quieted-by statement IDs, signers, justification codes to exports and attestations. | Team Excititor Export | Path: src/Excititor/__Libraries/StellaOps.Excititor.Export | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 7 — Contextual Truth Foundations | EXCITITOR-EXPORT-01-007 | DONE (2025-10-21) | Mirror bundle + domain manifest – publish signed consensus bundles for mirrors. | Team Excititor Export | Path: src/Excititor/__Libraries/StellaOps.Excititor.Export | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 7 — Contextual Truth Foundations | EXCITITOR-CONN-STELLA-07-001 | DONE (2025-10-21) | Excititor mirror connector – ingest signed mirror bundles and map to VexClaims with resume handling. | Excititor Connectors – Stella | Path: src/Excititor/StellaOps.Excititor.Connectors.StellaOpsMirror | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 7 — Contextual Truth Foundations | FEEDSTORAGE-DATA-07-001 | DONE (2025-10-19) | Advisory statement & conflict collections – provision Mongo schema/indexes for event-sourced merge. | Team Normalization & Storage Backbone | Path: src/Concelier/__Libraries/StellaOps.Concelier.Storage.Mongo | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 7 — Contextual Truth Foundations | WEB1.TRIVY-SETTINGS-TESTS | DONE (2025-10-21) | Add headless UI test run (`ng test --watch=false`) and document prerequisites once Angular tooling is chained up. | UX Specialist, Angular Eng | Path: src/Web/StellaOps.Web | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 8 — Mirror Distribution | FEEDCONN-STELLA-08-001 | DONE (2025-10-20) | Concelier mirror connector – fetch mirror manifest, verify signatures, and hydrate canonical DTOs with resume support. | BE-Conn-Stella | Path: src/Concelier/__Libraries/StellaOps.Concelier.Connector.StellaOpsMirror | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 8 — Mirror Distribution | FEEDCONN-STELLA-08-002 | DONE (2025-10-20) | Map mirror payloads into canonical advisory DTOs with provenance referencing mirror domain + original source metadata. | BE-Conn-Stella | Path: src/Concelier/__Libraries/StellaOps.Concelier.Connector.StellaOpsMirror | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 8 — Mirror Distribution | FEEDCONN-STELLA-08-003 | DONE (2025-10-20) | Add incremental cursor + resume support (per-export fingerprint) and document configuration for downstream Concelier instances. | BE-Conn-Stella | Path: src/Concelier/__Libraries/StellaOps.Concelier.Connector.StellaOpsMirror | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 8 — Plugin Infrastructure | PLUGIN-DI-08-001 | DONE (2025-10-21) | Scoped service support in plugin bootstrap – added dynamic plugin tests ensuring `[ServiceBinding]` metadata flows through plugin hosts and remains idempotent. | Plugin Platform Guild | Path: src/__Libraries/StellaOps.Plugin | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 8 — Plugin Infrastructure | PLUGIN-DI-08-002.COORD | DONE (2025-10-20) | Authority scoped-service integration handshake
Workshop concluded 2025-10-20 15:00–16:05 UTC; decisions + follow-ups recorded in `docs/dev/authority-plugin-di-coordination.md`. | Plugin Platform Guild, Authority Core | Path: src/__Libraries/StellaOps.Plugin | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 8 — Plugin Infrastructure | PLUGIN-DI-08-002 | DONE (2025-10-20) | Authority plugin integration updates – scoped identity-provider services with registry handles; regression coverage via scoped registrar/unit tests. | Plugin Platform Guild, Authority Core | Path: src/__Libraries/StellaOps.Plugin | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 8 — Plugin Infrastructure | AUTH-PLUGIN-COORD-08-002 | DONE (2025-10-20) | Coordinate scoped-service adoption for Authority plug-in registrars
Workshop notes and follow-up backlog captured 2025-10-20 in `docs/dev/authority-plugin-di-coordination.md`. | Authority Core, Plugin Platform Guild | Path: src/Authority/StellaOps.Authority | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 9 — Scanner Core Foundations | SCANNER-WEB-09-103 | DONE (2025-10-19) | Progress streaming (SSE/JSONL) with correlation IDs and ISO-8601 UTC timestamps, documented in API reference. | Team Scanner WebService | Path: src/Scanner/StellaOps.Scanner.WebService | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 9 — Scanner Core Foundations | SCANNER-POLICY-09-105 | DONE (2025-10-19) | Policy snapshot loader + schema + OpenAPI (YAML ignore rules, VEX include/exclude, vendor precedence). | Team Scanner WebService | Path: src/Scanner/StellaOps.Scanner.WebService | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 9 — Scanner Core Foundations | SCANNER-POLICY-09-106 | DONE (2025-10-19) | `/reports` verdict assembly (Conselier+Excitor+Policy) + signed response envelope. | Team Scanner WebService | Path: src/Scanner/StellaOps.Scanner.WebService | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 9 — Scanner Core Foundations | SCANNER-POLICY-09-107 | DONE (2025-10-19) | Expose score inputs, config version, and quiet provenance in `/reports` JSON and signed payload. | Team Scanner WebService | Path: src/Scanner/StellaOps.Scanner.WebService | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 9 — DevOps Foundations | DEVOPS-SCANNER-09-204 | DONE (2025-10-21) | Surface `SCANNER__EVENTS__*` env config across Compose/Helm and document overrides. | DevOps Guild, Scanner WebService Guild | Path: ops/devops | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 9 — DevOps Foundations | DEVOPS-SCANNER-09-205 | DONE (2025-10-21) | Notify smoke job validates Redis stream + Notify deliveries after staging deploys. | DevOps Guild, Notify Guild | Path: ops/devops | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 9 — Policy Foundations | POLICY-CORE-09-004 | DONE (2025-10-19) | Versioned scoring config with schema validation, trust table, and golden fixtures. | Policy Guild | Path: src/Policy/__Libraries/StellaOps.Policy | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 9 — Policy Foundations | POLICY-CORE-09-005 | DONE (2025-10-19) | Scoring/quiet engine – compute score, enforce VEX-only quiet rules, emit inputs and provenance. | Policy Guild | Path: src/Policy/__Libraries/StellaOps.Policy | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 9 — Policy Foundations | POLICY-CORE-09-006 | DONE (2025-10-19) | Unknown state & confidence decay – deterministic bands surfaced in policy outputs. | Policy Guild | Path: src/Policy/__Libraries/StellaOps.Policy | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 9 — Docs & Governance | PLATFORM-EVENTS-09-401 | DONE (2025-10-21) | Embed canonical event samples into contract/integration tests and ensure CI validates payloads against published schemas. | Platform Events Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 10 — Benchmarks | BENCH-SCANNER-10-002 | DONE (2025-10-21) | Wire real language analyzers into bench harness & refresh baselines post-implementation. | Bench Guild, Language Analyzer Guild | Path: src/Bench/StellaOps.Bench | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 10 — Scanner Analyzers & SBOM | SCANNER-ANALYZERS-LANG-10-302 | DONE (2025-10-21) | Node analyzer handling workspaces/symlinks emitting `pkg:npm`. | Language Analyzer Guild | Path: src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 10 — Scanner Analyzers & SBOM | SCANNER-ANALYZERS-LANG-10-303 | DONE (2025-10-21) | Python analyzer reading `*.dist-info`, RECORD hashes, entry points. | Language Analyzer Guild | Path: src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 10 — Scanner Analyzers & SBOM | SCANNER-ANALYZERS-LANG-10-304 | DONE (2025-10-22) | Go analyzer leveraging buildinfo for `pkg:golang` components. | Language Analyzer Guild | Path: src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 10 — Scanner Analyzers & SBOM | SCANNER-ANALYZERS-LANG-10-304E | DONE (2025-10-22) | Plumb Go heuristic counter into Scanner metrics pipeline and alerting. | Language Analyzer Guild | Path: src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Go | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 10 — Scanner Analyzers & SBOM | SCANNER-ANALYZERS-LANG-10-305 | DONE (2025-10-22) | .NET analyzer parsing `*.deps.json`, assembly metadata, RID variants. | Language Analyzer Guild | Path: src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 10 — Scanner Analyzers & SBOM | SCANNER-ANALYZERS-LANG-10-306 | DONE (2025-10-22) | Rust analyzer detecting crates or falling back to `bin:{sha256}`. | Language Analyzer Guild | Path: src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 10 — Scanner Analyzers & SBOM | SCANNER-ANALYZERS-LANG-10-307 | DONE (2025-10-19) | Shared language evidence helpers + usage flag propagation. | Language Analyzer Guild | Path: src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 10 — Scanner Analyzers & SBOM | SCANNER-ANALYZERS-LANG-10-308 | DONE (2025-10-19) | Determinism + fixture harness for language analyzers. | Language Analyzer Guild | Path: src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 10 — Scanner Analyzers & SBOM | SCANNER-ANALYZERS-LANG-10-309 | DONE (2025-10-21) | Package language analyzers as restart-time plug-ins (manifest + host registration). | Language Analyzer Guild | Path: src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 10 — Scanner Analyzers & SBOM | SCANNER-EMIT-10-601 | DONE (2025-10-22) | Compose inventory SBOM (CycloneDX JSON/Protobuf) from layer fragments. | Emit Guild | Path: src/Scanner/__Libraries/StellaOps.Scanner.Emit | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 10 — Scanner Analyzers & SBOM | SCANNER-EMIT-10-602 | DONE (2025-10-22) | Compose usage SBOM leveraging EntryTrace to flag actual usage. | Emit Guild | Path: src/Scanner/__Libraries/StellaOps.Scanner.Emit | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 10 — Scanner Analyzers & SBOM | SCANNER-EMIT-10-603 | DONE (2025-10-22) | Generate BOM index sidecar (purl table + roaring bitmap + usage flag). | Emit Guild | Path: src/Scanner/__Libraries/StellaOps.Scanner.Emit | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 10 — Scanner Analyzers & SBOM | SCANNER-EMIT-10-604 | DONE (2025-10-22) | Package artifacts for export + attestation with deterministic manifests. | Emit Guild | Path: src/Scanner/__Libraries/StellaOps.Scanner.Emit | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 10 — Scanner Analyzers & SBOM | SCANNER-EMIT-10-605 | DONE (2025-10-22) | Emit BOM-Index sidecar schema/fixtures (CRITICAL PATH for SP16). | Emit Guild | Path: src/Scanner/__Libraries/StellaOps.Scanner.Emit | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 10 — Scanner Analyzers & SBOM | SCANNER-EMIT-10-606 | DONE (2025-10-22) | Usage view bit flags integrated with EntryTrace. | Emit Guild | Path: src/Scanner/__Libraries/StellaOps.Scanner.Emit | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 10 — Scanner Analyzers & SBOM | SCANNER-EMIT-10-607 | DONE (2025-10-22) | Embed scoring inputs, confidence band, and quiet provenance in CycloneDX/DSSE artifacts. | Emit Guild | Path: src/Scanner/__Libraries/StellaOps.Scanner.Emit | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 10 — Scanner Analyzers & SBOM | SCANNER-CACHE-10-101 | DONE (2025-10-19) | Implement layer cache store keyed by layer digest with metadata retention per architecture §3.3. | Scanner Cache Guild | Path: src/Scanner/__Libraries/StellaOps.Scanner.Cache | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 10 — Scanner Analyzers & SBOM | SCANNER-CACHE-10-102 | DONE (2025-10-19) | Build file CAS with dedupe, TTL enforcement, and offline import/export hooks. | Scanner Cache Guild | Path: src/Scanner/__Libraries/StellaOps.Scanner.Cache | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 10 — Scanner Analyzers & SBOM | SCANNER-CACHE-10-103 | DONE (2025-10-19) | Expose cache metrics/logging and configuration toggles for warm/cold thresholds. | Scanner Cache Guild | Path: src/Scanner/__Libraries/StellaOps.Scanner.Cache | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 10 — Scanner Analyzers & SBOM | SCANNER-CACHE-10-104 | DONE (2025-10-19) | Implement cache invalidation workflows (layer delete, TTL expiry, diff invalidation). | Scanner Cache Guild | Path: src/Scanner/__Libraries/StellaOps.Scanner.Cache | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 10 — Scanner Analyzers & SBOM | SCANNER-ANALYZERS-OS-10-201 | DONE (2025-10-19) | Alpine/apk analyzer emitting deterministic components with provenance. | OS Analyzer Guild | Path: src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.OS | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 10 — Scanner Analyzers & SBOM | SCANNER-ANALYZERS-OS-10-202 | DONE (2025-10-19) | Debian/dpkg analyzer mapping packages to purl identity with evidence. | OS Analyzer Guild | Path: src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.OS | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 10 — Scanner Analyzers & SBOM | SCANNER-ANALYZERS-OS-10-203 | DONE (2025-10-19) | RPM analyzer capturing EVR, file listings, provenance. | OS Analyzer Guild | Path: src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.OS | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 10 — Scanner Analyzers & SBOM | SCANNER-ANALYZERS-OS-10-204 | DONE (2025-10-19) | Shared OS evidence helpers for package identity + provenance. | OS Analyzer Guild | Path: src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.OS | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 10 — Scanner Analyzers & SBOM | SCANNER-ANALYZERS-OS-10-205 | DONE (2025-10-19) | Vendor metadata enrichment (source packages, license, CVE hints). | OS Analyzer Guild | Path: src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.OS | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 10 — Scanner Analyzers & SBOM | SCANNER-ANALYZERS-OS-10-206 | DONE (2025-10-19) | Determinism harness + fixtures for OS analyzers. | OS Analyzer Guild | Path: src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.OS | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 10 — Scanner Analyzers & SBOM | SCANNER-ANALYZERS-OS-10-207 | DONE (2025-10-19) | Package OS analyzers as restart-time plug-ins (manifest + host registration). | OS Analyzer Guild | Path: src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.OS | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 10 — Scanner Analyzers & SBOM | SCANNER-ANALYZERS-LANG-10-301 | DONE (2025-10-19) | Java analyzer emitting `pkg:maven` with provenance. | Language Analyzer Guild | Path: src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 10 — Scanner Analyzers & SBOM | SCANNER-ENTRYTRACE-10-401 | DONE (2025-10-19) | POSIX shell AST parser with deterministic output. | EntryTrace Guild | Path: src/Scanner/__Libraries/StellaOps.Scanner.EntryTrace | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 10 — Scanner Analyzers & SBOM | SCANNER-ENTRYTRACE-10-402 | DONE (2025-10-19) | Command resolution across layered rootfs with evidence attribution. | EntryTrace Guild | Path: src/Scanner/__Libraries/StellaOps.Scanner.EntryTrace | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 10 — Scanner Analyzers & SBOM | SCANNER-ENTRYTRACE-10-403 | DONE (2025-10-19) | Interpreter tracing for shell wrappers to Python/Node/Java launchers. | EntryTrace Guild | Path: src/Scanner/__Libraries/StellaOps.Scanner.EntryTrace | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 10 — Scanner Analyzers & SBOM | SCANNER-ENTRYTRACE-10-404 | DONE (2025-10-19) | Python entry analyzer (venv shebang, module invocation, usage flag). | EntryTrace Guild | Path: src/Scanner/__Libraries/StellaOps.Scanner.EntryTrace | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 10 — Scanner Analyzers & SBOM | SCANNER-ENTRYTRACE-10-405 | DONE (2025-10-19) | Node/Java launcher analyzer capturing script/jar targets. | EntryTrace Guild | Path: src/Scanner/__Libraries/StellaOps.Scanner.EntryTrace | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 10 — Scanner Analyzers & SBOM | SCANNER-ENTRYTRACE-10-406 | DONE (2025-10-19) | Explainability + diagnostics for unresolved constructs with metrics. | EntryTrace Guild | Path: src/Scanner/__Libraries/StellaOps.Scanner.EntryTrace | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 10 — Scanner Analyzers & SBOM | SCANNER-ENTRYTRACE-10-407 | DONE (2025-10-19) | Package EntryTrace analyzers as restart-time plug-ins (manifest + host registration). | EntryTrace Guild | Path: src/Scanner/__Libraries/StellaOps.Scanner.EntryTrace | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 10 — Scanner Analyzers & SBOM | SCANNER-DIFF-10-501 | DONE (2025-10-19) | Build component differ tracking add/remove/version changes with deterministic ordering. | Diff Guild | Path: src/Scanner/__Libraries/StellaOps.Scanner.Diff | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 10 — Scanner Analyzers & SBOM | SCANNER-DIFF-10-502 | DONE (2025-10-19) | Attribute diffs to introducing/removing layers including provenance evidence. | Diff Guild | Path: src/Scanner/__Libraries/StellaOps.Scanner.Diff | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 10 — Scanner Analyzers & SBOM | SCANNER-DIFF-10-503 | DONE (2025-10-19) | Produce JSON diff output for inventory vs usage views aligned with API contract. | Diff Guild | Path: src/Scanner/__Libraries/StellaOps.Scanner.Diff | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 10 — Samples | SAMPLES-10-001 | DONE (2025-10-20) | Sample images with SBOM/BOM-Index sidecars. | Samples Guild, Scanner Team | Path: samples | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 10 — DevOps Perf | DEVOPS-PERF-10-001 | DONE (2025-10-22) | Perf smoke job ensuring <5 s SBOM compose. | DevOps Guild | Path: ops/devops | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 10 — DevOps Perf | DEVOPS-PERF-10-002 | DONE (2025-10-23) | Publish analyzer bench metrics to Grafana/perf workbook and alarm on ≥20 % regressions. | DevOps Guild | Path: ops/devops | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 10 — Policy Samples | SAMPLES-13-004 | DONE (2025-10-23) | Add policy preview/report fixtures showing confidence bands and unknown-age tags. | Samples Guild, Policy Guild | Path: samples | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 10 — Policy Samples | WEB-POLICY-FIXTURES-10-001 | DONE (2025-10-23) | Wire policy preview/report doc fixtures into UI harness (test utility or Storybook substitute) with type bindings and validation guard so UI stays aligned with documented payloads. | UI Guild | Path: src/Web/StellaOps.Web | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 11 — Signing Chain Bring-up | SIGNER-API-11-101 | DONE (2025-10-21) | `/sign/dsse` pipeline with Authority auth, PoE introspection, release verification, DSSE signing. | Signer Guild | Path: src/Signer/StellaOps.Signer | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 11 — Signing Chain Bring-up | SIGNER-REF-11-102 | DONE (2025-10-21) | `/verify/referrers` endpoint with OCI lookup, caching, and policy enforcement. | Signer Guild | Path: src/Signer/StellaOps.Signer | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 11 — Signing Chain Bring-up | SIGNER-QUOTA-11-103 | DONE (2025-10-21) | Enforce plan quotas, concurrency/QPS limits, artifact size caps with metrics/audit logs. | Signer Guild | Path: src/Signer/StellaOps.Signer | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 11 — Signing Chain Bring-up | AUTH-MTLS-11-002 | DONE (2025-10-23) | Add OAuth mTLS client credential support with certificate-bound tokens and introspection updates. | Authority Core & Security Guild | Path: src/Authority/StellaOps.Authority | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 12 — Runtime Guardrails | SCANNER-RUNTIME-12-301 | DONE (2025-10-20) | `/runtime/events` ingestion endpoint with validation, batching, storage hooks. | Scanner WebService Guild | Path: src/Scanner/StellaOps.Scanner.WebService | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 13 — UX & CLI Experience | CLI-OFFLINE-13-006 | DONE (2025-10-21) | Implement offline kit pull/import/status commands with integrity checks. | DevEx/CLI | Path: src/Cli/StellaOps.Cli | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 13 — UX & CLI Experience | CLI-PLUGIN-13-007 | DONE (2025-10-22) | Package non-core CLI verbs as restart-time plug-ins (manifest + loader tests). | DevEx/CLI | Path: src/Cli/StellaOps.Cli | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 13 — UX & CLI Experience | WEB1.DEPS-13-001 | DONE (2025-10-21) | Stabilise Angular workspace dependencies for headless CI installs (`npm install`, Chromium handling, docs). | UX Specialist, Angular Eng, DevEx | Path: src/Web/StellaOps.Web | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 16 — Scheduler Intelligence | SCHED-QUEUE-16-403 | DONE (2025-10-20) | Dead-letter handling + metrics. | Scheduler Queue Guild | Path: src/Scheduler/__Libraries/StellaOps.Scheduler.Queue | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 18 — Launch Readiness | DEVOPS-OFFLINE-18-004 | DONE (2025-10-22) | Rebuild Offline Kit bundle with Go analyzer plug-in and refreshed manifest/signature set. | Offline Kit Guild, Scanner Guild | Path: ops/offline-kit | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | --- — --- | --- | --- | --- | --- | Path: --- | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 11 — Signing Chain Bring-up | ATTESTOR-API-11-201 | DONE (2025-10-19) | `/rekor/entries` submission pipeline with dedupe, proof acquisition, and persistence. | Attestor Guild | Path: src/Attestor/StellaOps.Attestor | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 11 — Signing Chain Bring-up | ATTESTOR-VERIFY-11-202 | DONE (2025-10-19) | `/rekor/verify` + retrieval endpoints validating signatures and Merkle proofs. | Attestor Guild | Path: src/Attestor/StellaOps.Attestor | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 11 — Signing Chain Bring-up | ATTESTOR-OBS-11-203 | DONE (2025-10-19) | Telemetry, alerting, mTLS hardening, and archive workflow for Attestor. | Attestor Guild | Path: src/Attestor/StellaOps.Attestor | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 11 — Storage Platform Hardening | SCANNER-STORAGE-11-401 | DONE (2025-10-23) | Migrate scanner object storage integration from MinIO to RustFS with data migration plan. | Scanner Storage Guild | Path: src/Scanner/__Libraries/StellaOps.Scanner.Storage | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 11 — UI Integration | UI-ATTEST-11-005 | DONE (2025-10-23) | Attestation visibility (Rekor id, status) on Scan Detail. | UI Guild | Path: src/UI/StellaOps.UI | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 12 — Runtime Guardrails | ZASTAVA-CORE-12-201 | DONE (2025-10-23) | Define runtime event/admission DTOs, hashing helpers, and versioning strategy. | Zastava Core Guild | Path: src/Zastava/__Libraries/StellaOps.Zastava.Core | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 12 — Runtime Guardrails | ZASTAVA-CORE-12-202 | DONE (2025-10-23) | Provide configuration/logging/metrics utilities shared by Observer/Webhook. | Zastava Core Guild | Path: src/Zastava/__Libraries/StellaOps.Zastava.Core | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 12 — Runtime Guardrails | ZASTAVA-CORE-12-203 | DONE (2025-10-23) | Authority client helpers, OpTok caching, and security guardrails for runtime services. | Zastava Core Guild | Path: src/Zastava/__Libraries/StellaOps.Zastava.Core | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 12 — Runtime Guardrails | ZASTAVA-OPS-12-204 | DONE (2025-10-23) | Operational runbooks, alert rules, and dashboard exports for runtime plane. | Zastava Core Guild | Path: src/Zastava/__Libraries/StellaOps.Zastava.Core | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 12 — Runtime Guardrails | ZASTAVA-OBS-12-001 | DONE (2025-10-24) | Container lifecycle watcher emitting deterministic runtime events with buffering. | Zastava Observer Guild | Path: src/Zastava/StellaOps.Zastava.Observer | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 12 — Runtime Guardrails | ZASTAVA-OBS-12-002 | DONE (2025-10-24) | Capture entrypoint traces + loaded libraries, hashing binaries and linking to baseline SBOM. | Zastava Observer Guild | Path: src/Zastava/StellaOps.Zastava.Observer | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 12 — Runtime Guardrails | ZASTAVA-OBS-12-003 | DONE (2025-10-24) | Posture checks for signatures/SBOM/attestation with offline caching. | Zastava Observer Guild | Path: src/Zastava/StellaOps.Zastava.Observer | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 12 — Runtime Guardrails | ZASTAVA-OBS-12-004 | DONE (2025-10-24) | Batch `/runtime/events` submissions with disk-backed buffer and rate limits. | Zastava Observer Guild | Path: src/Zastava/StellaOps.Zastava.Observer | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 12 — Runtime Guardrails | ZASTAVA-WEBHOOK-12-101 | DONE (2025-10-24) | Admission controller host with TLS bootstrap and Authority auth. | Zastava Webhook Guild | Path: src/Zastava/StellaOps.Zastava.Webhook | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 12 — Runtime Guardrails | ZASTAVA-WEBHOOK-12-102 | DONE (2025-10-24) | Query Scanner `/policy/runtime`, resolve digests, enforce verdicts. | Zastava Webhook Guild | Path: src/Zastava/StellaOps.Zastava.Webhook | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 12 — Runtime Guardrails | ZASTAVA-WEBHOOK-12-103 | DONE (2025-10-24) | Caching, fail-open/closed toggles, metrics/logging for admission decisions. | Zastava Webhook Guild | Path: src/Zastava/StellaOps.Zastava.Webhook | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 12 — Runtime Guardrails | ZASTAVA-WEBHOOK-12-104 | DONE (2025-10-24) | Wire `/admission` endpoint to runtime policy client and emit allow/deny envelopes. | Zastava Webhook Guild | Path: src/Zastava/StellaOps.Zastava.Webhook | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 12 — Runtime Guardrails | SCANNER-RUNTIME-12-302 | DONE (2025-10-24) | `/policy/runtime` endpoint joining SBOM baseline + policy verdict, returning admission guidance. | Scanner WebService Guild | Path: src/Scanner/StellaOps.Scanner.WebService | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 12 — Runtime Guardrails | SCANNER-RUNTIME-12-303 | DONE (2025-10-24) | Align `/policy/runtime` verdicts with canonical policy evaluation (Conselier/Excitor). | Scanner WebService Guild | Path: src/Scanner/StellaOps.Scanner.WebService | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 12 — Runtime Guardrails | SCANNER-RUNTIME-12-304 | DONE (2025-10-24) | Integrate attestation verification into runtime policy metadata. | Scanner WebService Guild | Path: src/Scanner/StellaOps.Scanner.WebService | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 12 — Runtime Guardrails | SCANNER-RUNTIME-12-305 | DONE (2025-10-24) | Deliver shared fixtures + e2e validation with Zastava/CLI teams. | Scanner WebService Guild | Path: src/Scanner/StellaOps.Scanner.WebService | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 13 — UX & CLI Experience | UI-AUTH-13-001 | DONE (2025-10-23) | Integrate Authority OIDC + DPoP flows with session management. | UI Guild | Path: src/UI/StellaOps.UI | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 13 — UX & CLI Experience | UI-NOTIFY-13-006 | DONE (2025-10-25) | Notify panel: channels/rules CRUD, deliveries view, test send. | UI Guild | Path: src/UI/StellaOps.UI | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 13 — Platform Reliability | DEVOPS-NUGET-13-001 | DONE (2025-10-25) | Wire up .NET 10 preview feeds/local mirrors so `dotnet restore` succeeds offline; document updated NuGet bootstrap. | DevOps Guild, Platform Leads | Path: ops/devops | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 15 — Notify Foundations | NOTIFY-QUEUE-15-401 | DONE (2025-10-23) | Bus abstraction + Redis Streams adapter with ordering/idempotency. | Notify Queue Guild | Path: src/Notify/__Libraries/StellaOps.Notify.Queue | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 15 — Notify Foundations | NOTIFY-QUEUE-15-402 | DONE (2025-10-23) | NATS JetStream adapter with health probes and failover. | Notify Queue Guild | Path: src/Notify/__Libraries/StellaOps.Notify.Queue | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 15 — Notify Foundations | NOTIFY-QUEUE-15-403 | DONE (2025-10-23) | Delivery queue with retry/dead-letter + metrics. | Notify Queue Guild | Path: src/Notify/__Libraries/StellaOps.Notify.Queue | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 15 — Notify Foundations | NOTIFY-WORKER-15-201 | DONE (2025-10-23) | Bus subscription + leasing loop with backoff. | Notify Worker Guild | Path: src/Notify/StellaOps.Notify.Worker | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 17 — Symbol Intelligence & Forensics | ZASTAVA-OBS-17-005 | DONE (2025-10-25) | Collect GNU build-id during runtime observation and attach it to emitted events. | Zastava Observer Guild | Path: src/Zastava/StellaOps.Zastava.Observer | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 17 — Symbol Intelligence & Forensics | SCANNER-RUNTIME-17-401 | DONE (2025-10-25) | Persist runtime build-id observations and expose them for debug-symbol correlation. | Scanner WebService Guild | Path: src/Scanner/StellaOps.Scanner.WebService | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | --- — --- | --- | --- | --- | --- | Path: --- | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 13 — Platform Reliability | DEVOPS-NUGET-13-002 | DONE (2025-10-26) | Ensure all solutions/projects prioritize `local-nuget` before public feeds and add restore-order validation. | DevOps Guild | Path: ops/devops | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 13 — Platform Reliability | DEVOPS-NUGET-13-003 | DONE (2025-10-26) | Upgrade `Microsoft.*` dependencies pinned to 8.* to their latest .NET 10 (or 9.x) releases and refresh guidance. | DevOps Guild, Platform Leads | Path: ops/devops | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 14 — Release & Offline Ops | DEVOPS-OPS-14-003 | DONE (2025-10-26) | Deployment/update/rollback automation and channel management documentation. | Deployment Guild | Path: ops/deployment | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 14 — Release & Offline Ops | DEVOPS-REL-14-001 | DONE (2025-10-26) | Deterministic build/release pipeline with SBOM/provenance, signing, and manifest generation. | DevOps Guild | Path: ops/devops | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 14 — Release & Offline Ops | DEVOPS-REL-14-004 | DONE (2025-10-26) | Extend release/offline smoke jobs to cover Python analyzer plug-ins (warm/cold, determinism, signing). | DevOps Guild, Scanner Guild | Path: ops/devops | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 14 — Release & Offline Ops | DEVOPS-LIC-14-004 | DONE (2025-10-26) | Registry token service tied to Authority, plan gating, revocation handling, monitoring. | Licensing Guild | Path: ops/licensing | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 14 — Release & Offline Ops | DEVOPS-OFFLINE-14-002 | DONE (2025-10-26) | Offline kit packaging workflow with integrity verification and documentation. | Offline Kit Guild | Path: ops/offline-kit | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 15 — Benchmarks | BENCH-NOTIFY-15-001 | DONE (2025-10-26) | Notify dispatch throughput bench with results CSV. | Bench Guild, Notify Team | Path: src/Bench/StellaOps.Bench | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 16 — Scheduler Intelligence | SCHED-MODELS-16-101 | DONE (2025-10-19) | Define Scheduler DTOs & validation. | Scheduler Models Guild | Path: src/Scheduler/__Libraries/StellaOps.Scheduler.Models | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 16 — Scheduler Intelligence | SCHED-MODELS-16-102 | DONE (2025-10-19) | Publish schema docs/sample payloads. | Scheduler Models Guild | Path: src/Scheduler/__Libraries/StellaOps.Scheduler.Models | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 16 — Scheduler Intelligence | SCHED-STORAGE-16-201 | DONE (2025-10-19) | Mongo schemas/indexes for Scheduler state. | Scheduler Storage Guild | Path: src/Scheduler/__Libraries/StellaOps.Scheduler.Storage.Mongo | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 16 — Scheduler Intelligence | SCHED-STORAGE-16-202 | DONE (2025-10-26) | Repositories with tenant scoping, TTL, causal consistency. | Scheduler Storage Guild | Path: src/Scheduler/__Libraries/StellaOps.Scheduler.Storage.Mongo | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 16 — Scheduler Intelligence | SCHED-STORAGE-16-203 | DONE (2025-10-26) | Audit/run stats materialization for UI. | Scheduler Storage Guild | Path: src/Scheduler/__Libraries/StellaOps.Scheduler.Storage.Mongo | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 16 — Scheduler Intelligence | SCHED-IMPACT-16-302 | DONE (2025-10-26) | Query APIs for ResolveByPurls/ResolveByVulns/ResolveAll. | Scheduler ImpactIndex Guild | Path: src/Scheduler/__Libraries/StellaOps.Scheduler.ImpactIndex | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 16 — Scheduler Intelligence | SCHED-IMPACT-16-301 | DONE (2025-10-26) | Ingest BOM-Index into roaring bitmap store. | Scheduler ImpactIndex Guild | Path: src/Scheduler/__Libraries/StellaOps.Scheduler.ImpactIndex | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 16 — Scheduler Intelligence | SCHED-WEB-16-102 | DONE (2025-10-26) | Schedules CRUD (cron validation, pause/resume, audit). | Scheduler WebService Guild | Path: src/Scheduler/StellaOps.Scheduler.WebService | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 16 — Scheduler Intelligence | SCHED-WEB-16-103 | DONE (2025-10-26) | Runs API (list/detail/cancel) + impact previews. | Scheduler WebService Guild | Path: src/Scheduler/StellaOps.Scheduler.WebService | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 16 — Scheduler Intelligence | SCHED-WEB-16-104 | DONE (2025-10-27) | Conselier/Excitor webhook handlers with security enforcement. | Scheduler WebService Guild | Path: src/Scheduler/StellaOps.Scheduler.WebService | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 17 — Symbol Intelligence & Forensics | DOCS-RUNTIME-17-004 | DONE (2025-10-26) | Document build-id workflows for SBOMs, runtime events, and debug-store usage. | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 17 — Symbol Intelligence & Forensics | DEVOPS-REL-17-002 | DONE (2025-10-26) | Ship stripped debug artifacts organised by build-id within release/offline kits. | DevOps Guild | Path: ops/devops | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 17 — Symbol Intelligence & Forensics | DEVOPS-OFFLINE-17-003 | DONE (2025-10-26) | Mirror release debug-store artefacts into Offline Kit packaging and document validation. | Offline Kit Guild, DevOps Guild | Path: ops/offline-kit | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 17 — Symbol Intelligence & Forensics | SCANNER-EMIT-17-701 | DONE (2025-10-26) | Record GNU build-id for ELF components and surface it in SBOM/diff outputs. | Emit Guild | Path: src/Scanner/__Libraries/StellaOps.Scanner.Emit | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 18 — Launch Readiness | DEVOPS-LAUNCH-18-001 | DONE (2025-10-26) | Production launch cutover rehearsal and runbook publication. | DevOps Guild | Path: ops/devops | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 18 — Launch Readiness | DEVOPS-OFFLINE-18-005 | DONE (2025-10-26) | Rebuild Offline Kit with Python analyzer artefacts and refreshed manifest/signature pair. | Offline Kit Guild, Scanner Guild | Path: ops/offline-kit | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 19 — Aggregation-Only Contract Enforcement | DOCS-AOC-19-001 | DONE (2025-10-26) | Publish aggregation-only contract reference documentation. | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 19 — Aggregation-Only Contract Enforcement | DOCS-AOC-19-002 | DONE (2025-10-26) | Update architecture overview with AOC boundary diagrams. | Docs Guild, Architecture Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 19 — Aggregation-Only Contract Enforcement | DOCS-AOC-19-003 | DONE (2025-10-26) | Refresh policy engine doc with raw ingestion constraints. | Docs Guild, Policy Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 19 — Aggregation-Only Contract Enforcement | DOCS-AOC-19-004 | DONE (2025-10-26) | Document console AOC dashboard and drill-down flow. | Docs Guild, UI Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 19 — Aggregation-Only Contract Enforcement | DOCS-AOC-19-005 | DONE (2025-10-26) | Document CLI AOC commands and exit codes. | Docs Guild, CLI Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 19 — Aggregation-Only Contract Enforcement | DOCS-AOC-19-006 | DONE (2025-10-26) | Document new AOC metrics, traces, and logs. | Docs Guild, Observability Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 19 — Aggregation-Only Contract Enforcement | DOCS-AOC-19-007 | DONE (2025-10-26) | Document new Authority scopes and tenancy enforcement. | Docs Guild, Authority Core | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 19 — Aggregation-Only Contract Enforcement | DOCS-AOC-19-008 | DONE (2025-10-26) | Update deployment guide with validator enablement and verify user guidance. | Docs Guild, DevOps Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 19 — Aggregation-Only Contract Enforcement | AUTH-AOC-19-001 | DONE (2025-10-26) | Introduce new ingestion/auth scopes across Authority. | Authority Core & Security Guild | Path: src/Authority/StellaOps.Authority | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 20 — Policy Engine v2 | DOCS-POLICY-20-001 | DONE (2025-10-26) | Publish `/docs/policy/overview.md` with compliance checklist. | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 20 — Policy Engine v2 | DOCS-POLICY-20-002 | DONE (2025-10-26) | Document DSL grammar + examples in `/docs/policy/dsl.md`. | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 20 — Policy Engine v2 | DOCS-POLICY-20-003 | DONE (2025-10-26) | Write `/docs/policy/lifecycle.md` covering workflow + roles. | Docs Guild, Authority Core | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 20 — Policy Engine v2 | DOCS-POLICY-20-004 | DONE (2025-10-26) | Document policy run modes + cursors in `/docs/policy/runs.md`. | Docs Guild, Scheduler Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 20 — Policy Engine v2 | DOCS-POLICY-20-005 | DONE (2025-10-26) | Produce `/docs/api/policy.md` with endpoint schemas + errors. | Docs Guild, Platform Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 20 — Policy Engine v2 | DOCS-POLICY-20-006 | DONE (2025-10-26) | Author `/docs/modules/cli/guides/policy.md` with commands, exit codes, JSON output. | Docs Guild, CLI Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 20 — Policy Engine v2 | DOCS-POLICY-20-007 | DONE (2025-10-26) | Create `/docs/ui/policy-editor.md` covering editor, simulation, approvals. | Docs Guild, UI Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 20 — Policy Engine v2 | DOCS-POLICY-20-008 | DONE (2025-10-26) | Publish `/docs/modules/policy/architecture.md` with sequence diagrams. | Docs Guild, Architecture Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 20 — Policy Engine v2 | DOCS-POLICY-20-009 | DONE (2025-10-26) | Document metrics/traces/logs in `/docs/observability/policy.md`. | Docs Guild, Observability Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 20 — Policy Engine v2 | DOCS-POLICY-20-010 | DONE (2025-10-26) | Publish `/docs/security/policy-governance.md` for scopes + approvals. | Docs Guild, Security Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 20 — Policy Engine v2 | DOCS-POLICY-20-011 | DONE (2025-10-26) | Add example policies under `/docs/examples/policies/` with commentary. | Docs Guild, Policy Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 20 — Policy Engine v2 | DOCS-POLICY-20-012 | DONE (2025-10-26) | Draft `/docs/faq/policy-faq.md` covering conflicts, determinism, pitfalls. | Docs Guild, Support Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 20 — Policy Engine v2 | DEVOPS-POLICY-20-001 | DONE (2025-10-26) | Add DSL lint + compile checks to CI pipelines. | DevOps Guild | Path: ops/devops | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 20 — Policy Engine v2 | DEVOPS-POLICY-20-003 | DONE (2025-10-26) | Add determinism CI job diffing repeated policy runs. | DevOps Guild, QA Guild | Path: ops/devops | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 20 — Policy Engine v2 | SAMPLES-POLICY-20-001 | DONE (2025-10-26) | Commit baseline/serverless/internal-only policy samples + fixtures. | Samples Guild, Policy Guild | Path: samples | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 20 — Policy Engine v2 | SAMPLES-POLICY-20-002 | DONE (2025-10-26) | Produce simulation diff fixtures for UI/CLI tests. | Samples Guild, UI Guild | Path: samples | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 20 — Policy Engine v2 | AUTH-POLICY-20-001 | DONE (2025-10-26) | Add new policy scopes (`policy:*`, `findings:read`, `effective:write`). | Authority Core & Security Guild | Path: src/Authority/StellaOps.Authority | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 20 — Policy Engine v2 | AUTH-POLICY-20-002 | DONE (2025-10-26) | Enforce Policy Engine service identity and scope checks at gateway. | Authority Core & Security Guild | Path: src/Authority/StellaOps.Authority | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 20 — Policy Engine v2 | AUTH-POLICY-20-003 | DONE (2025-10-26) | Update Authority docs/config samples for policy scopes + workflows. | Authority Core & Docs Guild | Path: src/Authority/StellaOps.Authority | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 20 — Policy Engine v2 | BENCH-POLICY-20-001 | DONE (2025-10-26) | Create policy evaluation benchmark suite + baseline metrics. | Bench Guild, Policy Guild | Path: src/Bench/StellaOps.Bench | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 20 — Policy Engine v2 | POLICY-ENGINE-20-000 | DONE (2025-10-26) | Spin up new Policy Engine service host with DI bootstrap and Authority wiring. | Policy Guild, Platform Guild | Path: src/Policy/StellaOps.Policy.Engine | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 20 — Policy Engine v2 | POLICY-ENGINE-20-001 | DONE (2025-10-26) | Deliver `stella-dsl@1` parser + IR compiler with diagnostics and checksums. | Policy Guild | Path: src/Policy/StellaOps.Policy.Engine | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 20 — Policy Engine v2 | SCHED-MODELS-20-001 | DONE (2025-10-26) | Define policy run/diff DTOs + validation helpers. | Scheduler Models Guild | Path: src/Scheduler/__Libraries/StellaOps.Scheduler.Models | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 21 — Graph Explorer v1 | AUTH-GRAPH-21-001 | DONE (2025-10-26) | Introduce graph scopes (`graph:*`) with configuration binding and defaults. | Authority Core Guild | Path: src/Authority/StellaOps.Authority | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 21 — Graph Explorer v1 | AUTH-GRAPH-21-002 | DONE (2025-10-26) | Enforce graph scopes/identities at gateway with tenant propagation. | Authority Core Guild | Path: src/Authority/StellaOps.Authority | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 21 — Graph Explorer v1 | AUTH-GRAPH-21-003 | DONE (2025-10-26) | Update security docs/config samples for graph access and least privilege. | Authority Core & Docs Guild | Path: src/Authority/StellaOps.Authority | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 21 — Graph Explorer v1 | SCHED-MODELS-21-001 | DONE (2025-10-26) | Define job DTOs for graph builds/overlay refresh (`GraphBuildJob`, `GraphOverlayJob`) with deterministic serialization and status enums; document in `src/Scheduler/__Libraries/StellaOps.Scheduler.Models/docs/SCHED-MODELS-21-001-GRAPH-JOBS.md`. | Scheduler Models Guild | Path: src/Scheduler/__Libraries/StellaOps.Scheduler.Models | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 21 — Graph Explorer v1 | SCHED-MODELS-21-002 | DONE (2025-10-26) | Publish schema docs/sample payloads for graph job lifecycle. | Scheduler Models Guild | Path: src/Scheduler/__Libraries/StellaOps.Scheduler.Models | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 22 — Link-Not-Merge v1 | BENCH-LNM-22-001 | DONE (2025-10-26) | Benchmark advisory observation ingest/correlation throughput. | Bench Guild | Path: src/Bench/StellaOps.Bench | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 22 — Link-Not-Merge v1 | BENCH-LNM-22-002 | DONE (2025-10-26) | Benchmark VEX ingest/correlation latency and event emission. | Bench Guild | Path: src/Bench/StellaOps.Bench | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 23 — StellaOps Console | DOCS-CONSOLE-23-001 | DONE (2025-10-26) | Publish `/docs/ui/console-overview.md` (IA, tenant model, filters, AOC alignment). | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 23 — StellaOps Console | DOCS-CONSOLE-23-002 | DONE (2025-10-26) | Author `/docs/ui/navigation.md` with route map, filters, keyboard shortcuts, deep links. | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 23 — StellaOps Console | DOCS-CONSOLE-23-003 | DONE (2025-10-26) | Document `/docs/ui/sbom-explorer.md` covering catalog, graph, overlays, exports. | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 23 — StellaOps Console | DOCS-CONSOLE-23-004 | DONE (2025-10-26) | Produce `/docs/ui/advisories-and-vex.md` detailing aggregation-not-merge UX. | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 23 — StellaOps Console | DOCS-CONSOLE-23-005 | DONE (2025-10-26) | Write `/docs/ui/findings.md` with filters, explain, exports, CLI parity notes. | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 23 — StellaOps Console | DOCS-CONSOLE-23-006 | DONE (2025-10-26) | Publish `/docs/ui/policies.md` (editor, simulation, approvals, RBAC). | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 23 — StellaOps Console | DOCS-CONSOLE-23-007 | DONE (2025-10-26) | Document `/docs/ui/runs.md` with SSE monitoring, diff, retries, evidence downloads. | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 23 — StellaOps Console | DOCS-CONSOLE-23-008 | DONE (2025-10-26) | Draft `/docs/ui/admin.md` covering tenants, roles, tokens, integrations, fresh-auth. | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 23 — StellaOps Console | DOCS-CONSOLE-23-009 | DONE (2025-10-27) | Publish `/docs/ui/downloads.md` aligning manifest with commands and offline flow. | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 23 — StellaOps Console | DOCS-CONSOLE-23-010 | DONE (2025-10-27) | Write `/docs/deploy/console.md` (Helm, ingress, TLS, env vars, health checks). | Docs Guild, Deployment Guild, Console Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 28 — Graph Explorer | SCHED-WEB-21-001 | DONE (2025-10-26) | Provide graph build/overlay job APIs; see `docs/SCHED-WEB-21-001-GRAPH-APIS.md`. | Scheduler WebService Guild | Path: src/Scheduler/StellaOps.Scheduler.WebService | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 28 — Graph Explorer | SCHED-WEB-21-002 | DONE (2025-10-26) | Provide overlay lag metrics endpoint/webhook; see `docs/SCHED-WEB-21-001-GRAPH-APIS.md`. | Scheduler WebService Guild | Path: src/Scheduler/StellaOps.Scheduler.WebService | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 28 — Graph Explorer | SCHED-WEB-21-003 | DONE (2025-10-26) | Replace header auth with Authority scopes using `StellaOpsScopes`; dev fallback only when `Scheduler:Authority:Enabled=false`. | Scheduler WebService Guild, Authority Core Guild | Path: src/Scheduler/StellaOps.Scheduler.WebService | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 50 — Observability & Forensics Phase 1 – Baseline Telemetry | DEVOPS-OBS-50-001 | DONE (2025-10-26) | Deploy default OpenTelemetry collector manifests with secure OTLP pipeline. | DevOps Guild | Path: ops/devops | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 50 — Observability & Forensics Phase 1 – Baseline Telemetry | DEVOPS-OBS-50-003 | DONE (2025-10-26) | Package telemetry stack configs for offline/air-gapped installs with signatures. | DevOps Guild | Path: ops/devops | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 16 — Scheduler Intelligence | SCHED-WEB-16-101 | DONE (2025-10-27) | Minimal API host with Authority enforcement. | Scheduler WebService Guild | Path: src/Scheduler/StellaOps.Scheduler.WebService | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 16 — Scheduler Intelligence | SCHED-WORKER-16-202 | DONE (2025-10-27) | ImpactIndex targeting and shard planning. | Scheduler Worker Guild | Path: src/Scheduler/__Libraries/StellaOps.Scheduler.Worker | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | --- — --- | --- | --- | --- | --- | Path: --- | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 16 — Scheduler Intelligence | SCHED-WORKER-16-203 | DONE (2025-10-27) | Runner execution invoking Scanner analysis/content refresh. | Scheduler Worker Guild | Path: src/Scheduler/__Libraries/StellaOps.Scheduler.Worker | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 16 — Scheduler Intelligence | SCHED-WORKER-16-204 | DONE (2025-10-27) | Emit rescan/report events for Notify/UI. | Scheduler Worker Guild | Path: src/Scheduler/__Libraries/StellaOps.Scheduler.Worker | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 16 — Scheduler Intelligence | SCHED-WORKER-16-205 | DONE (2025-10-27) | Metrics/telemetry for Scheduler planners/runners. | Scheduler Worker Guild | Path: src/Scheduler/__Libraries/StellaOps.Scheduler.Worker | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 19 — Aggregation-Only Contract Enforcement | AUTH-AOC-19-002 | DONE (2025-10-27) | Enforce tenant claim propagation and cross-tenant guardrails. | Authority Core & Security Guild | Path: src/Authority/StellaOps.Authority | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 19 — Aggregation-Only Contract Enforcement | AUTH-AOC-19-003 | DONE (2025-10-27) | Update Authority docs/config samples for new scopes. | Authority Core & Docs Guild | Path: src/Authority/StellaOps.Authority | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 19 — Aggregation-Only Contract Enforcement | CONCELIER-WEB-AOC-19-001 | DONE (2025-10-28) | Implement raw advisory ingestion endpoints with AOC guard and verifier. | Concelier WebService Guild | Path: src/Concelier/StellaOps.Concelier.WebService | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 19 — Aggregation-Only Contract Enforcement | EXCITITOR-WORKER-AOC-19-003 | DONE (2025-10-28) | Expand worker tests for deterministic batching and restart safety. | QA Guild | Path: src/Excititor/StellaOps.Excititor.Worker | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 20 — Policy Engine v2 | DEVOPS-POLICY-20-004 | DONE (2025-10-27) | Automate policy schema exports and change notifications for CLI consumers. | DevOps Guild, Scheduler Guild, CLI Guild | Path: ops/devops | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 20 — Policy Engine v2 | CLI-POLICY-20-002 | DONE (2025-10-27) | Implement `stella policy simulate` with diff outputs + exit codes. | DevEx/CLI Guild | Path: src/Cli/StellaOps.Cli | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 21 — Graph Explorer v1 | CARTO-GRAPH-21-010 | DONE (2025-10-27) | Replace hard-coded `graph:*` scope strings with shared constants once graph services integrate. | Cartographer Guild | Path: src/Cartographer/StellaOps.Cartographer | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 21 — Graph Explorer v1 | SCHED-WEB-21-002 | DONE (2025-10-26) | Expose overlay lag metrics and job completion hooks for Cartographer. | Scheduler WebService Guild | Path: src/Scheduler/StellaOps.Scheduler.WebService | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 23 — StellaOps Console | DOCS-CONSOLE-23-011 | DONE (2025-10-28) | Update `/docs/install/docker.md` to include console image, compose/Helm/offline examples. | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 23 — StellaOps Console | DOCS-CONSOLE-23-012 | DONE (2025-10-28) | Publish `/docs/security/console-security.md` covering OIDC, scopes, CSP, evidence handling. | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 23 — StellaOps Console | DOCS-CONSOLE-23-013 | DONE (2025-10-28) | Write `/docs/observability/ui-telemetry.md` cataloguing metrics/logs/dashboards/alerts. | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 23 — StellaOps Console | DOCS-CONSOLE-23-014 | DONE (2025-10-28) | Maintain `/docs/cli-vs-ui-parity.md` matrix with CI drift detection guidance. | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 23 — StellaOps Console | DOCS-CONSOLE-23-016 | DONE (2025-10-28) | Refresh `/docs/accessibility.md` with console keyboard flows, tokens, testing tools.
2025-10-28: Published guide covering keyboard matrix, screen-reader behaviour, colour tokens, testing workflow, offline guidance, and compliance checklist. | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 25 — Exceptions v1 | DOCS-EXC-25-004 | DONE (2025-10-27) | Document policy exception effects + simulation. | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 25 — Exceptions v1 | POLICY-ENGINE-70-001 | DONE (2025-10-27) | Add exception evaluation layer with specificity + effects. | Policy Guild | Path: src/Policy/StellaOps.Policy.Engine | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 25 — Exceptions v1 | POLICY-EXC-25-001 | DONE (2025-10-27) | Extend SPL schema to reference exception effects and routing. | Policy Guild | Path: src/Policy/__Libraries/StellaOps.Policy | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | --- — --- | --- | --- | --- | --- | Path: --- | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 16 — Scheduler Intelligence | SCHED-WORKER-16-201 | DOING (2025-10-27) | Planner loop (cron/event triggers, leases, fairness). | Scheduler Worker Guild | Path: src/Scheduler/__Libraries/StellaOps.Scheduler.Worker | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 17 — Symbol Intelligence & Forensics | DEVOPS-OFFLINE-17-004 | BLOCKED (2025-10-26) | Run mirror_debug_store.py once release artefacts exist and archive verification evidence with the Offline Kit. | Offline Kit Guild, DevOps Guild | Path: ops/offline-kit | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 17 — Symbol Intelligence & Forensics | DEVOPS-REL-17-004 | BLOCKED (2025-10-26) | Ensure release workflow publishes `out/release/debug` (build-id tree + manifest) and fails when symbols are missing. | DevOps Guild | Path: ops/devops | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 19 — Aggregation-Only Contract Enforcement | DEVOPS-AOC-19-001 | BLOCKED (2025-10-26) | Integrate AOC analyzer/guard enforcement into CI pipelines. | DevOps Guild, Platform Guild | Path: ops/devops | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 19 — Aggregation-Only Contract Enforcement | DEVOPS-AOC-19-002 | BLOCKED (2025-10-26) | Add CI stage running `stella aoc verify` against seeded snapshots. | DevOps Guild | Path: ops/devops | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 19 — Aggregation-Only Contract Enforcement | DEVOPS-AOC-19-003 | BLOCKED (2025-10-26) | Enforce guard coverage thresholds and export metrics to dashboards. | DevOps Guild, QA Guild | Path: ops/devops | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 19 — Aggregation-Only Contract Enforcement | CLI-AOC-19-001 | DOING (2025-10-27) | Implement `stella sources ingest --dry-run` command. | DevEx/CLI Guild | Path: src/Cli/StellaOps.Cli | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 19 — Aggregation-Only Contract Enforcement | CLI-AOC-19-002 | TODO | Implement `stella aoc verify` command with exit codes. | DevEx/CLI Guild | Path: src/Cli/StellaOps.Cli | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 19 — Aggregation-Only Contract Enforcement | CLI-AOC-19-003 | TODO | Update CLI reference and quickstart docs for new AOC commands. | Docs/CLI Guild | Path: src/Cli/StellaOps.Cli | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 19 — Aggregation-Only Contract Enforcement | CONCELIER-CORE-AOC-19-001 | TODO | Implement AOC repository guard rejecting forbidden fields. | Concelier Core Guild | Path: src/Concelier/__Libraries/StellaOps.Concelier.Core | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 19 — Aggregation-Only Contract Enforcement | CONCELIER-CORE-AOC-19-002 | TODO | Deliver deterministic linkset extraction for advisories. | Concelier Core Guild | Path: src/Concelier/__Libraries/StellaOps.Concelier.Core | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 19 — Aggregation-Only Contract Enforcement | CONCELIER-CORE-AOC-19-003 | TODO | Enforce idempotent append-only upsert with supersedes pointers. | Concelier Core Guild | Path: src/Concelier/__Libraries/StellaOps.Concelier.Core | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 19 — Aggregation-Only Contract Enforcement | CONCELIER-CORE-AOC-19-004 | DOING (2025-10-28) | Remove ingestion normalization; defer derived logic to Policy Engine. | Concelier Core Guild | Path: src/Concelier/__Libraries/StellaOps.Concelier.Core | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 19 — Aggregation-Only Contract Enforcement | CONCELIER-CORE-AOC-19-013 | TODO | Extend smoke coverage to validate tenant-scoped Authority tokens and cross-tenant rejection. | Concelier Core Guild | Path: src/Concelier/__Libraries/StellaOps.Concelier.Core | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 19 — Aggregation-Only Contract Enforcement | CONCELIER-STORE-AOC-19-001 | TODO | Add Mongo schema validator for `advisory_raw`. | Concelier Storage Guild | Path: src/Concelier/__Libraries/StellaOps.Concelier.Storage.Mongo | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 19 — Aggregation-Only Contract Enforcement | CONCELIER-STORE-AOC-19-002 | TODO | Create idempotency unique index backed by migration scripts. | Concelier Storage Guild | Path: src/Concelier/__Libraries/StellaOps.Concelier.Storage.Mongo | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 19 — Aggregation-Only Contract Enforcement | CONCELIER-STORE-AOC-19-003 | TODO | Deliver append-only migration/backfill plan with supersedes chaining. | Concelier Storage Guild | Path: src/Concelier/__Libraries/StellaOps.Concelier.Storage.Mongo | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 19 — Aggregation-Only Contract Enforcement | CONCELIER-STORE-AOC-19-004 | TODO | Document validator deployment steps for online/offline clusters. | Concelier Storage Guild, DevOps Guild | Path: src/Concelier/__Libraries/StellaOps.Concelier.Storage.Mongo | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 19 — Aggregation-Only Contract Enforcement | CONCELIER-WEB-AOC-19-002 | TODO | Emit AOC observability metrics, traces, and structured logs. | Concelier WebService Guild, Observability Guild | Path: src/Concelier/StellaOps.Concelier.WebService | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 19 — Aggregation-Only Contract Enforcement | CONCELIER-WEB-AOC-19-003 | TODO | Add schema/guard unit tests covering AOC error codes. | QA Guild | Path: src/Concelier/StellaOps.Concelier.WebService | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 19 — Aggregation-Only Contract Enforcement | CONCELIER-WEB-AOC-19-004 | TODO | Build integration suite validating deterministic ingest under load. | Concelier WebService Guild, QA Guild | Path: src/Concelier/StellaOps.Concelier.WebService | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 19 — Aggregation-Only Contract Enforcement | EXCITITOR-CORE-AOC-19-001 | TODO | Introduce VEX repository guard enforcing AOC invariants. | Excititor Core Guild | Path: src/Excititor/__Libraries/StellaOps.Excititor.Core | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 19 — Aggregation-Only Contract Enforcement | EXCITITOR-CORE-AOC-19-002 | TODO | Build deterministic VEX linkset extraction. | Excititor Core Guild | Path: src/Excititor/__Libraries/StellaOps.Excititor.Core | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 19 — Aggregation-Only Contract Enforcement | EXCITITOR-CORE-AOC-19-003 | TODO | Enforce append-only idempotent VEX raw upserts. | Excititor Core Guild | Path: src/Excititor/__Libraries/StellaOps.Excititor.Core | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 19 — Aggregation-Only Contract Enforcement | EXCITITOR-CORE-AOC-19-004 | TODO | Remove ingestion consensus logic; rely on Policy Engine. | Excititor Core Guild | Path: src/Excititor/__Libraries/StellaOps.Excititor.Core | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 19 — Aggregation-Only Contract Enforcement | EXCITITOR-CORE-AOC-19-013 | TODO | Update smoke suites to enforce tenant-scoped Authority tokens and cross-tenant VEX rejection. | Excititor Core Guild | Path: src/Excititor/__Libraries/StellaOps.Excititor.Core | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 19 — Aggregation-Only Contract Enforcement | EXCITITOR-STORE-AOC-19-001 | TODO | Add Mongo schema validator for `vex_raw`. | Excititor Storage Guild | Path: src/Excititor/__Libraries/StellaOps.Excititor.Storage.Mongo | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 19 — Aggregation-Only Contract Enforcement | EXCITITOR-STORE-AOC-19-002 | TODO | Create idempotency unique index for VEX raw documents. | Excititor Storage Guild | Path: src/Excititor/__Libraries/StellaOps.Excititor.Storage.Mongo | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 19 — Aggregation-Only Contract Enforcement | EXCITITOR-STORE-AOC-19-003 | TODO | Deliver append-only migration/backfill for VEX raw collections. | Excititor Storage Guild | Path: src/Excititor/__Libraries/StellaOps.Excititor.Storage.Mongo | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 19 — Aggregation-Only Contract Enforcement | EXCITITOR-STORE-AOC-19-004 | TODO | Document validator deployment for Excititor clusters/offline kit. | Excititor Storage Guild, DevOps Guild | Path: src/Excititor/__Libraries/StellaOps.Excititor.Storage.Mongo | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 19 — Aggregation-Only Contract Enforcement | EXCITITOR-WEB-AOC-19-001 | TODO | Implement raw VEX ingestion and AOC verifier endpoints. | Excititor WebService Guild | Path: src/Excititor/StellaOps.Excititor.WebService | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 19 — Aggregation-Only Contract Enforcement | EXCITITOR-WEB-AOC-19-002 | TODO | Emit AOC metrics/traces/logging for Excititor ingestion. | Excititor WebService Guild, Observability Guild | Path: src/Excititor/StellaOps.Excititor.WebService | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 19 — Aggregation-Only Contract Enforcement | EXCITITOR-WEB-AOC-19-003 | TODO | Add AOC guard test harness for VEX schemas. | QA Guild | Path: src/Excititor/StellaOps.Excititor.WebService | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 19 — Aggregation-Only Contract Enforcement | EXCITITOR-WEB-AOC-19-004 | TODO | Validate large VEX ingest runs and CLI verification parity. | Excititor WebService Guild, QA Guild | Path: src/Excititor/StellaOps.Excititor.WebService | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 41 — Surface Sharing Foundations | SURFACE-FS-01 | TODO | Author Surface.FS cache specification and cross-module contract. | Scanner Guild, Zastava Guild | Path: src/Scanner/__Libraries/StellaOps.Scanner.Surface.FS | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 41 — Surface Sharing Foundations | SURFACE-ENV-01 | TODO | Draft Surface.Env variable matrix for Scanner/Zastava deployments. | Scanner Guild, Ops Guild, Zastava Guild | Path: src/Scanner/__Libraries/StellaOps.Scanner.Surface.Env | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 41 — Surface Sharing Foundations | SURFACE-SECRETS-01 | TODO | Define Surface.Secrets schema and rotation guidance. | Scanner Guild, Security Guild, Zastava Guild | Path: src/Scanner/__Libraries/StellaOps.Scanner.Surface.Secrets | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 41 — Surface Sharing Foundations | SURFACE-VAL-01 | TODO | Design validator framework for shared Surface checks and extensibility. | Scanner Guild, Security Guild | Path: src/Scanner/__Libraries/StellaOps.Scanner.Surface.Validation | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 19 — Aggregation-Only Contract Enforcement | EXCITITOR-WORKER-AOC-19-001 | TODO | Rewire worker to persist raw VEX docs with guard enforcement. | Excititor Worker Guild | Path: src/Excititor/StellaOps.Excititor.Worker | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 19 — Aggregation-Only Contract Enforcement | EXCITITOR-WORKER-AOC-19-002 | TODO | Enforce signature/checksum verification prior to raw writes. | Excititor Worker Guild | Path: src/Excititor/StellaOps.Excititor.Worker | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 19 — Aggregation-Only Contract Enforcement | POLICY-AOC-19-001 | TODO | Add lint preventing ingestion modules from referencing Policy-only helpers. | Policy Guild | Path: src/Policy/__Libraries/StellaOps.Policy | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 19 — Aggregation-Only Contract Enforcement | POLICY-AOC-19-002 | TODO | Enforce Policy-only writes to `effective_finding_*` collections. | Policy Guild, Security Guild | Path: src/Policy/__Libraries/StellaOps.Policy | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 19 — Aggregation-Only Contract Enforcement | POLICY-AOC-19-003 | TODO | Update Policy readers to consume only raw document fields. | Policy Guild | Path: src/Policy/__Libraries/StellaOps.Policy | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 19 — Aggregation-Only Contract Enforcement | POLICY-AOC-19-004 | TODO | Add determinism tests for raw-driven policy recomputation. | Policy Guild, QA Guild | Path: src/Policy/__Libraries/StellaOps.Policy | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 19 — Aggregation-Only Contract Enforcement | UI-AOC-19-001 | TODO | Add Sources dashboard tiles surfacing AOC status and violations. | UI Guild | Path: src/UI/StellaOps.UI | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 19 — Aggregation-Only Contract Enforcement | UI-AOC-19-002 | TODO | Build violation drill-down view for offending documents. | UI Guild | Path: src/UI/StellaOps.UI | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 19 — Aggregation-Only Contract Enforcement | UI-AOC-19-003 | TODO | Wire "Verify last 24h" action and CLI parity messaging. | UI Guild | Path: src/UI/StellaOps.UI | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 19 — Aggregation-Only Contract Enforcement | WEB-AOC-19-001 | DOING (2025-10-26) | Provide shared AOC forbidden key set and guard middleware. | BE-Base Platform Guild | Path: src/Web/StellaOps.Web | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 19 — Aggregation-Only Contract Enforcement | WEB-AOC-19-002 | TODO | Ship provenance builder and signature helpers for ingestion services. | BE-Base Platform Guild | Path: src/Web/StellaOps.Web | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 19 — Aggregation-Only Contract Enforcement | WEB-AOC-19-003 | TODO | Author analyzer + shared test fixtures for guard compliance. | BE-Base Platform Guild, QA Guild | Path: src/Web/StellaOps.Web | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 20 — Policy Engine v2 | DEVOPS-POLICY-20-002 | BLOCKED (waiting on POLICY-ENGINE-20-006) | Run `stella policy simulate` CI stage against golden SBOMs. | DevOps Guild | Path: ops/devops | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 20 — Policy Engine v2 | BENCH-POLICY-20-002 | BLOCKED (waiting on SCHED-WORKER-20-302) | Add incremental run benchmark capturing delta SLA compliance. | Bench Guild, Scheduler Guild | Path: src/Bench/StellaOps.Bench | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 20 — Policy Engine v2 | CLI-POLICY-20-003 | TODO | Extend `stella findings` commands with policy filters and explain view. | DevEx/CLI Guild, Docs Guild | Path: src/Cli/StellaOps.Cli | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 20 — Policy Engine v2 | CONCELIER-POLICY-20-002 | TODO | Strengthen linkset builders with equivalence tables + range parsing. | Concelier Core Guild | Path: src/Concelier/__Libraries/StellaOps.Concelier.Core | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 20 — Policy Engine v2 | CONCELIER-POLICY-20-003 | TODO | Add advisory selection cursors + change-stream checkpoints for policy runs. | Concelier Storage Guild | Path: src/Concelier/__Libraries/StellaOps.Concelier.Storage.Mongo | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 20 — Policy Engine v2 | CONCELIER-POLICY-20-001 | TODO | Provide advisory selection endpoints for policy engine (batch PURL/ID). | Concelier WebService Guild | Path: src/Concelier/StellaOps.Concelier.WebService | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 20 — Policy Engine v2 | EXCITITOR-POLICY-20-002 | TODO | Enhance VEX linkset scope + version resolution for policy accuracy. | Excititor Core Guild | Path: src/Excititor/__Libraries/StellaOps.Excititor.Core | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 20 — Policy Engine v2 | EXCITITOR-POLICY-20-003 | TODO | Introduce VEX selection cursors + change-stream checkpoints. | Excititor Storage Guild | Path: src/Excititor/__Libraries/StellaOps.Excititor.Storage.Mongo | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 20 — Policy Engine v2 | EXCITITOR-POLICY-20-001 | TODO | Ship VEX selection APIs aligned with policy join requirements. | Excititor WebService Guild | Path: src/Excititor/StellaOps.Excititor.WebService | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 20 — Policy Engine v2 | POLICY-ENGINE-20-002 | BLOCKED (2025-10-26) | Implement deterministic rule evaluator with priority/first-match semantics. | Policy Guild | Path: src/Policy/StellaOps.Policy.Engine | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 20 — Policy Engine v2 | POLICY-ENGINE-20-003 | TODO | Build SBOM↔advisory↔VEX linkset joiners with deterministic batching. | Policy Guild, Concelier Core, Excititor Core | Path: src/Policy/StellaOps.Policy.Engine | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 20 — Policy Engine v2 | POLICY-ENGINE-20-004 | TODO | Materialize effective findings with append-only history and tenant scoping. | Policy Guild, Storage Guild | Path: src/Policy/StellaOps.Policy.Engine | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 20 — Policy Engine v2 | POLICY-ENGINE-20-005 | TODO | Enforce determinism guard banning wall-clock, RNG, and network usage. | Policy Guild, Security Guild | Path: src/Policy/StellaOps.Policy.Engine | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 20 — Policy Engine v2 | POLICY-ENGINE-20-006 | TODO | Implement incremental orchestrator reacting to change streams. | Policy Guild, Scheduler Guild | Path: src/Policy/StellaOps.Policy.Engine | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 20 — Policy Engine v2 | POLICY-ENGINE-20-007 | TODO | Emit policy metrics, traces, and sampled rule-hit logs. | Policy Guild, Observability Guild | Path: src/Policy/StellaOps.Policy.Engine | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 20 — Policy Engine v2 | POLICY-ENGINE-20-008 | TODO | Add unit/property/golden/perf suites verifying determinism + SLA. | Policy Guild, QA Guild | Path: src/Policy/StellaOps.Policy.Engine | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 20 — Policy Engine v2 | POLICY-ENGINE-20-009 | TODO | Define Mongo schemas/indexes + migrations for policies/runs/findings. | Policy Guild, Storage Guild | Path: src/Policy/StellaOps.Policy.Engine | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 20 — Policy Engine v2 | SCHED-MODELS-20-002 | TODO | Update schema docs with policy run lifecycle samples. | Scheduler Models Guild | Path: src/Scheduler/__Libraries/StellaOps.Scheduler.Models | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 20 — Policy Engine v2 | SCHED-WEB-20-001 | TODO | Expose policy run scheduling APIs with scope enforcement. | Scheduler WebService Guild | Path: src/Scheduler/StellaOps.Scheduler.WebService | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 20 — Policy Engine v2 | SCHED-WEB-20-002 | TODO | Provide simulation trigger endpoint returning diff metadata. | Scheduler WebService Guild | Path: src/Scheduler/StellaOps.Scheduler.WebService | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 20 — Policy Engine v2 | SCHED-WORKER-20-301 | TODO | Schedule policy runs via API with idempotent job tracking. | Scheduler Worker Guild | Path: src/Scheduler/__Libraries/StellaOps.Scheduler.Worker | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 20 — Policy Engine v2 | SCHED-WORKER-20-302 | TODO | Implement delta targeting leveraging change streams + policy metadata. | Scheduler Worker Guild | Path: src/Scheduler/__Libraries/StellaOps.Scheduler.Worker | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 20 — Policy Engine v2 | SCHED-WORKER-20-303 | TODO | Expose policy scheduling metrics/logs with policy/run identifiers. | Scheduler Worker Guild, Observability Guild | Path: src/Scheduler/__Libraries/StellaOps.Scheduler.Worker | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 20 — Policy Engine v2 | UI-POLICY-20-001 | TODO | Ship Monaco-based policy editor with inline diagnostics + checklists. | UI Guild | Path: src/UI/StellaOps.UI | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 20 — Policy Engine v2 | UI-POLICY-20-002 | TODO | Build simulation panel with deterministic diff rendering + virtualization. | UI Guild | Path: src/UI/StellaOps.UI | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 20 — Policy Engine v2 | UI-POLICY-20-003 | TODO | Implement submit/review/approve workflow with RBAC + audit trail. | UI Guild, Product Ops | Path: src/UI/StellaOps.UI | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 20 — Policy Engine v2 | UI-POLICY-20-004 | TODO | Add run dashboards (heatmap/VEX wins/suppressions) with export. | UI Guild, Observability Guild | Path: src/UI/StellaOps.UI | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 20 — Policy Engine v2 | WEB-POLICY-20-001 | TODO | Implement Policy CRUD/compile/run/simulate/findings/explain endpoints. | BE-Base Platform Guild | Path: src/Web/StellaOps.Web | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 20 — Policy Engine v2 | WEB-POLICY-20-002 | TODO | Add pagination, filters, deterministic ordering to policy listings. | BE-Base Platform Guild | Path: src/Web/StellaOps.Web | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 20 — Policy Engine v2 | WEB-POLICY-20-003 | TODO | Map engine errors to `ERR_POL_*` responses with contract tests. | BE-Base Platform Guild, QA Guild | Path: src/Web/StellaOps.Web | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 20 — Policy Engine v2 | WEB-POLICY-20-004 | TODO | Introduce rate limits/quotas + metrics for simulation endpoints. | Platform Reliability Guild | Path: src/Web/StellaOps.Web | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 21 — Graph Explorer v1 | BENCH-GRAPH-21-001 | BLOCKED (2025-10-27) | Graph viewport/path perf harness (50k/100k nodes) measuring Graph API/Indexer latency and cache hit rates. Executed within Sprint 28 Graph program. Upstream Graph API/indexer contracts (`GRAPH-API-28-003`, `GRAPH-INDEX-28-006`) still pending, so benchmarks cannot target stable endpoints yet. | Bench Guild, Graph Platform Guild | Path: src/Bench/StellaOps.Bench | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 21 — Graph Explorer v1 | BENCH-GRAPH-21-002 | BLOCKED (2025-10-27) | Headless UI load benchmark for graph canvas interactions (Playwright) tracking render FPS budgets. Executed within Sprint 28 Graph program. Depends on BENCH-GRAPH-21-001 and UI Graph Explorer (`UI-GRAPH-24-001`), both pending. | Bench Guild, UI Guild | Path: src/Bench/StellaOps.Bench | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 21 — Graph Explorer v1 | CONCELIER-GRAPH-21-001 | DONE (2025-11-18) | Enrich SBOM normalization with relationships, scopes, entrypoint annotations for Cartographer. Schema frozen 2025-11-17; fixtures + acceptance tests committed. | Concelier Core Guild | Path: src/Concelier/__Libraries/StellaOps.Concelier.Core | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 21 — Graph Explorer v1 | CONCELIER-GRAPH-21-002 | DONE (2025-11-22) | Publish SBOM change events with tenant metadata for graph builds. Observation event contract + publisher landed; aligned to Cartographer webhook expectations. | Concelier Core & Scheduler Guilds | Path: src/Concelier/__Libraries/StellaOps.Concelier.Core | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 21 — Graph Explorer v1 | EXCITITOR-GRAPH-21-001 | BLOCKED (2025-10-27) | Deliver batched VEX/advisory fetch helpers for inspector linkouts. Waiting on linkset enrichment (`EXCITITOR-POLICY-20-002`) and Cartographer inspector contract (`CARTO-GRAPH-21-005`). | Excititor Core Guild | Path: src/Excititor/__Libraries/StellaOps.Excititor.Core | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 21 — Graph Explorer v1 | EXCITITOR-GRAPH-21-002 | BLOCKED (2025-10-27) | Enrich overlay metadata with VEX justification summaries for graph overlays. Depends on `EXCITITOR-GRAPH-21-001` and Policy overlay schema (`POLICY-ENGINE-30-001`). | Excititor Core Guild | Path: src/Excititor/__Libraries/StellaOps.Excititor.Core | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 21 — Graph Explorer v1 | EXCITITOR-GRAPH-21-005 | BLOCKED (2025-10-27) | Create indexes/materialized views for VEX lookups by PURL/policy. Awaiting access pattern specs from `EXCITITOR-GRAPH-21-001`. | Excititor Storage Guild | Path: src/Excititor/__Libraries/StellaOps.Excititor.Storage.Mongo | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 21 — Graph Explorer v1 | SBOM-SERVICE-21-001 | DOING (2025-11-23) | Expose normalized SBOM projection API with relationships, scopes, entrypoints. Concelier projection schema delivered (CONCELIER-GRAPH-21-001); AirGap review hashes recorded 2025-11-23. | SBOM Service Guild | Path: src/SbomService/StellaOps.SbomService | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 21 — Graph Explorer v1 | SBOM-SERVICE-21-002 | BLOCKED (2025-10-27) | Emit SBOM version change events for Cartographer build queue. Depends on SBOM projection API (`SBOM-SERVICE-21-001`) and Scheduler contracts. | SBOM Service & Scheduler Guilds | Path: src/SbomService/StellaOps.SbomService | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 21 — Graph Explorer v1 | SBOM-SERVICE-21-003 | BLOCKED (2025-10-27) | Provide entrypoint management API with tenant overrides. Blocked by SBOM projection API contract. | SBOM Service Guild | Path: src/SbomService/StellaOps.SbomService | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 21 — Graph Explorer v1 | SBOM-SERVICE-21-004 | BLOCKED (2025-10-27) | Add metrics/traces/logs for SBOM projections. Requires projection pipeline from `SBOM-SERVICE-21-001`. | SBOM Service & Observability Guilds | Path: src/SbomService/StellaOps.SbomService | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 21 — Graph Explorer v1 | WEB-GRAPH-21-001 | BLOCKED (2025-10-27) | Add gateway routes for graph APIs with scope enforcement and streaming. Upstream Graph API (`GRAPH-API-28-003`) and Authority scope work (`AUTH-VULN-24-001`) pending. | BE-Base Platform Guild | Path: src/Web/StellaOps.Web | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 21 — Graph Explorer v1 | WEB-GRAPH-21-002 | BLOCKED (2025-10-27) | Implement bbox/zoom/path validation and pagination for graph endpoints. Depends on core proxy routes. | BE-Base Platform Guild | Path: src/Web/StellaOps.Web | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 21 — Graph Explorer v1 | WEB-GRAPH-21-003 | BLOCKED (2025-10-27) | Map graph errors to `ERR_Graph_*` and support export streaming. Requires `WEB-GRAPH-21-001`. | BE-Base Platform & QA Guilds | Path: src/Web/StellaOps.Web | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 21 — Graph Explorer v1 | WEB-GRAPH-21-004 | BLOCKED (2025-10-27) | Wire Policy Engine simulation overlays into graph responses. Waiting on Graph routes and Policy overlay schema (`POLICY-ENGINE-30-002`). | BE-Base & Policy Guilds | Path: src/Web/StellaOps.Web | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 22 — Link-Not-Merge v1 | DOCS-LNM-22-001 | BLOCKED (2025-10-27) | Publish advisories aggregation doc with observation/linkset philosophy. | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 22 — Link-Not-Merge v1 | DOCS-LNM-22-002 | BLOCKED (2025-10-27) | Publish VEX aggregation doc describing observation/linkset flow. | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 22 — Link-Not-Merge v1 | DOCS-LNM-22-005 | BLOCKED (2025-10-27) | Document UI evidence panel with conflict badges/AOC drill-down. | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 22 — Link-Not-Merge v1 | DEVOPS-LNM-22-001 | BLOCKED (2025-10-27) | Execute advisory observation/linkset migration/backfill and automation. | DevOps Guild | Path: ops/devops | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 22 — Link-Not-Merge v1 | DEVOPS-LNM-22-002 | BLOCKED (2025-10-27) | Run VEX observation/linkset migration/backfill with monitoring/runbook. | DevOps Guild | Path: ops/devops | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 22 — Link-Not-Merge v1 | SAMPLES-LNM-22-001 | BLOCKED (2025-10-27) | Add advisory observation/linkset fixtures with conflicts. | Samples Guild | Path: samples | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 22 — Link-Not-Merge v1 | SAMPLES-LNM-22-002 | BLOCKED (2025-10-27) | Add VEX observation/linkset fixtures with status disagreements. | Samples Guild | Path: samples | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 22 — Link-Not-Merge v1 | AUTH-AOC-22-001 | TODO | Roll out new advisory/vex ingest/read scopes. | Authority Core Guild | Path: src/Authority/StellaOps.Authority | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 22 — Link-Not-Merge v1 | CLI-LNM-22-001 | TODO | Implement advisory observation/linkset CLI commands with JSON/OSV export. | DevEx/CLI Guild | Path: src/Cli/StellaOps.Cli | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 22 — Link-Not-Merge v1 | CLI-LNM-22-002 | TODO | Implement VEX observation/linkset CLI commands. | DevEx/CLI Guild | Path: src/Cli/StellaOps.Cli | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 22 — Link-Not-Merge v1 | CONCELIER-LNM-21-001 | TODO | Define immutable advisory observation schema with AOC metadata. | Concelier Core Guild | Path: src/Concelier/__Libraries/StellaOps.Concelier.Core | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 22 — Link-Not-Merge v1 | CONCELIER-LNM-21-002 | TODO | Implement advisory linkset builder with correlation signals/conflicts. | Concelier Core Guild, Data Science Guild | Path: src/Concelier/__Libraries/StellaOps.Concelier.Core | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 22 — Link-Not-Merge v1 | MERGE-LNM-21-002 | TODO | Deprecate merge service and enforce observation-only pipeline. | BE-Merge | Path: src/Concelier/__Libraries/StellaOps.Concelier.Merge | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 22 — Link-Not-Merge v1 | CONCELIER-LNM-21-101 | TODO | Provision observations/linksets collections and indexes. | Concelier Storage Guild | Path: src/Concelier/__Libraries/StellaOps.Concelier.Storage.Mongo | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 22 — Link-Not-Merge v1 | CONCELIER-LNM-21-102 | TODO | Backfill legacy merged advisories into observations/linksets with rollback tooling. | Concelier Storage & DevOps Guilds | Path: src/Concelier/__Libraries/StellaOps.Concelier.Storage.Mongo | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 22 — Link-Not-Merge v1 | CONCELIER-LNM-21-201 | TODO | Ship advisory observation read APIs with pagination/RBAC. | Concelier WebService Guild | Path: src/Concelier/StellaOps.Concelier.WebService | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 22 — Link-Not-Merge v1 | CONCELIER-LNM-21-202 | TODO | Implement advisory linkset read/export/evidence endpoints mapped to `ERR_AGG_*`. | Concelier WebService Guild | Path: src/Concelier/StellaOps.Concelier.WebService | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 22 — Link-Not-Merge v1 | EXCITITOR-LNM-21-001 | TODO | Define immutable VEX observation model. | Excititor Core Guild | Path: src/Excititor/__Libraries/StellaOps.Excititor.Core | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 22 — Link-Not-Merge v1 | EXCITITOR-LNM-21-002 | TODO | Build VEX linkset correlator with confidence/conflict recording. | Excititor Core Guild | Path: src/Excititor/__Libraries/StellaOps.Excititor.Core | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 22 — Link-Not-Merge v1 | EXCITITOR-LNM-21-101 | TODO | Provision VEX observation/linkset collections and indexes. | Excititor Storage Guild | Path: src/Excititor/__Libraries/StellaOps.Excititor.Storage.Mongo | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 22 — Link-Not-Merge v1 | EXCITITOR-LNM-21-102 | TODO | Backfill legacy VEX data into observations/linksets with rollback scripts. | Excititor Storage & DevOps Guilds | Path: src/Excititor/__Libraries/StellaOps.Excititor.Storage.Mongo | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 22 — Link-Not-Merge v1 | EXCITITOR-LNM-21-201 | TODO | Expose VEX observation APIs with filters/pagination and RBAC. | Excititor WebService Guild | Path: src/Excititor/StellaOps.Excititor.WebService | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 22 — Link-Not-Merge v1 | EXCITITOR-LNM-21-202 | TODO | Implement VEX linkset endpoints + exports with evidence payloads. | Excititor WebService Guild | Path: src/Excititor/StellaOps.Excititor.WebService | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 22 — Link-Not-Merge v1 | POLICY-ENGINE-40-001 | TODO | Update severity selection to handle multiple source severities per linkset. | Policy Guild | Path: src/Policy/StellaOps.Policy.Engine | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 22 — Link-Not-Merge v1 | POLICY-ENGINE-40-002 | TODO | Integrate VEX linkset conflicts into effective findings/explain traces. | Policy Guild, Excititor Guild | Path: src/Policy/StellaOps.Policy.Engine | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 22 — Link-Not-Merge v1 | SCANNER-LNM-21-001 | TODO | Update report/runtime payloads to consume linksets and surface source evidence. | Scanner WebService Guild | Path: src/Scanner/StellaOps.Scanner.WebService | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 22 — Link-Not-Merge v1 | UI-LNM-22-001 | TODO | Deliver Evidence panel with policy banner and source observations. | UI Guild | Path: src/UI/StellaOps.UI | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 22 — Link-Not-Merge v1 | UI-LNM-22-003 | TODO | Add VEX evidence tab with conflict indicators and exports. | UI Guild | Path: src/UI/StellaOps.UI | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 22 — Link-Not-Merge v1 | WEB-LNM-21-001 | TODO | Surface advisory observation/linkset APIs through gateway with RBAC. | BE-Base Platform Guild | Path: src/Web/StellaOps.Web | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 22 — Link-Not-Merge v1 | WEB-LNM-21-002 | TODO | Expose VEX observation/linkset endpoints with export handling. | BE-Base Platform Guild | Path: src/Web/StellaOps.Web | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 23 — StellaOps Console | DOCS-CONSOLE-23-015 | TODO | Produce `/docs/architecture/console.md` describing packages, data flow, SSE design. | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 23 — StellaOps Console | DOCS-CONSOLE-23-017 | TODO | Create `/docs/examples/ui-tours.md` walkthroughs with annotated screenshots/GIFs. | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 23 — StellaOps Console | DOCS-CONSOLE-23-018 | TODO | Execute console security checklist and record Security Guild sign-off. | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 23 — StellaOps Console | DOWNLOADS-CONSOLE-23-001 | TODO | Maintain signed downloads manifest pipeline feeding Console + docs parity checks. | Deployment Guild | Path: ops/deployment | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 23 — StellaOps Console | DEVOPS-CONSOLE-23-001 | BLOCKED (2025-10-26) | Stand up console CI pipeline (pnpm cache, lint, tests, Playwright, Lighthouse, offline runners). | DevOps Guild | Path: ops/devops | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 23 — StellaOps Console | DEVOPS-CONSOLE-23-002 | TODO | Deliver `stella-console` container + Helm overlays with SBOM/provenance and offline packaging. | DevOps Guild | Path: ops/devops | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 23 — StellaOps Console | AUTH-CONSOLE-23-001 | TODO | Register Console OIDC client with PKCE, scopes, short-lived tokens, and offline defaults. | Authority Core & Security Guild | Path: src/Authority/StellaOps.Authority | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 23 — StellaOps Console | AUTH-CONSOLE-23-002 | TODO | Provide tenant catalog/user profile endpoints with audit logging and fresh-auth requirements. | Authority Core & Security Guild | Path: src/Authority/StellaOps.Authority | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 23 — StellaOps Console | AUTH-CONSOLE-23-003 | TODO | Update security docs/sample configs for Console flows, CSP, and session policies. | Authority Core & Docs Guild | Path: src/Authority/StellaOps.Authority | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 23 — StellaOps Console | CONCELIER-CONSOLE-23-001 | TODO | Surface `/console/advisories` aggregation views with per-source metadata and filters. | Concelier WebService Guild | Path: src/Concelier/StellaOps.Concelier.WebService | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 23 — StellaOps Console | CONCELIER-CONSOLE-23-002 | TODO | Provide advisory delta metrics API for dashboard + live status ticker. | Concelier WebService Guild | Path: src/Concelier/StellaOps.Concelier.WebService | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 23 — StellaOps Console | CONCELIER-CONSOLE-23-003 | TODO | Add search helpers for CVE/GHSA/PURL lookups returning evidence fragments. | Concelier WebService Guild | Path: src/Concelier/StellaOps.Concelier.WebService | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 23 — StellaOps Console | EXCITITOR-CONSOLE-23-001 | TODO | Expose `/console/vex` aggregation endpoints with precedence and provenance. | Excititor WebService Guild | Path: src/Excititor/StellaOps.Excititor.WebService | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 23 — StellaOps Console | EXCITITOR-CONSOLE-23-002 | TODO | Publish VEX override delta metrics feeding dashboard/status ticker. | Excititor WebService Guild | Path: src/Excititor/StellaOps.Excititor.WebService | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 23 — StellaOps Console | EXCITITOR-CONSOLE-23-003 | TODO | Implement VEX search helpers for global search and explain drill-downs. | Excititor WebService Guild | Path: src/Excititor/StellaOps.Excititor.WebService | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 23 — StellaOps Console | EXPORT-CONSOLE-23-001 | TODO | Implement evidence bundle/export generator with signed manifests and telemetry. | Policy Guild, Scheduler Guild | Path: src/Policy/StellaOps.Policy.Engine | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 23 — StellaOps Console | POLICY-CONSOLE-23-001 | TODO | Optimize findings/explain APIs for Console filters, aggregation hints, and provenance traces. | Policy Guild | Path: src/Policy/StellaOps.Policy.Engine | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 23 — StellaOps Console | POLICY-CONSOLE-23-002 | TODO | Expose simulation diff + approval state metadata for policy workspace scenarios. | Policy Guild, Product Ops | Path: src/Policy/StellaOps.Policy.Engine | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 23 — StellaOps Console | SBOM-CONSOLE-23-001 | TODO | Deliver Console SBOM catalog API with filters, evaluation metadata, and raw projections. | SBOM Service Guild | Path: src/SbomService/StellaOps.SbomService | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 23 — StellaOps Console | SBOM-CONSOLE-23-002 | TODO | Provide component lookup/neighborhood endpoints for global search and overlays. | SBOM Service Guild | Path: src/SbomService/StellaOps.SbomService | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 23 — StellaOps Console | SCHED-CONSOLE-23-001 | TODO | Extend runs API with SSE progress, queue lag summaries, RBAC actions, and history pagination. | Scheduler WebService Guild | Path: src/Scheduler/StellaOps.Scheduler.WebService | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 23 — StellaOps Console | SCHED-WORKER-CONSOLE-23-201 | TODO | Stream run progress events with heartbeat/dedupe for Console SSE consumers. | Scheduler Worker Guild | Path: src/Scheduler/__Libraries/StellaOps.Scheduler.Worker | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 23 — StellaOps Console | SCHED-WORKER-CONSOLE-23-202 | TODO | Coordinate evidence bundle job queueing, status tracking, cancellation, and retention. | Scheduler Worker Guild | Path: src/Scheduler/__Libraries/StellaOps.Scheduler.Worker | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 23 — StellaOps Console | WEB-CONSOLE-23-001 | TODO | Ship `/console/dashboard` + `/console/filters` aggregates with tenant scoping and deterministic totals. | BE-Base Platform Guild | Path: src/Web/StellaOps.Web | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 23 — StellaOps Console | WEB-CONSOLE-23-002 | TODO | Provide `/console/status` polling and `/console/runs/{id}/stream` SSE proxy with heartbeat/backoff. | BE-Base Platform Guild, Scheduler Guild | Path: src/Web/StellaOps.Web | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 23 — StellaOps Console | WEB-CONSOLE-23-003 | TODO | Expose `/console/exports` orchestration for evidence bundles, CSV/JSON streaming, manifest retrieval. | BE-Base Platform Guild, Policy Guild | Path: src/Web/StellaOps.Web | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 23 — StellaOps Console | WEB-CONSOLE-23-004 | TODO | Implement `/console/search` fan-out router for CVE/GHSA/PURL/SBOM lookups with caching and RBAC. | BE-Base Platform Guild | Path: src/Web/StellaOps.Web | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 23 — StellaOps Console | WEB-CONSOLE-23-005 | TODO | Serve `/console/downloads` manifest with signed image metadata and offline guidance. | BE-Base Platform Guild, DevOps Guild | Path: src/Web/StellaOps.Web | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 24 — Graph & Vuln Explorer v1 | AUTH-VULN-24-001 | TODO | Extend scopes (`vuln:view`/`vuln:investigate`/`vuln:operate`/`vuln:audit`) and signed permalinks. | Authority Core Guild | Path: src/Authority/StellaOps.Authority | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 24 — Graph & Vuln Explorer v1 | CONCELIER-GRAPH-24-001 | TODO | Surface raw advisory observations/linksets for overlay services (no derived aggregation in ingestion). | Concelier Core Guild | Path: src/Concelier/__Libraries/StellaOps.Concelier.Core | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 24 — Graph & Vuln Explorer v1 | EXCITITOR-GRAPH-24-001 | TODO | Surface raw VEX statements/linksets for overlay services (no suppression/precedence logic here). | Excititor Core Guild | Path: src/Excititor/__Libraries/StellaOps.Excititor.Core | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 24 — Graph & Vuln Explorer v1 | POLICY-ENGINE-60-001 | TODO | Maintain Redis effective decision maps for overlays. | Policy Guild | Path: src/Policy/StellaOps.Policy.Engine | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 24 — Graph & Vuln Explorer v1 | POLICY-ENGINE-60-002 | TODO | Provide simulation bridge for graph what-if APIs. | Policy Guild | Path: src/Policy/StellaOps.Policy.Engine | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 24 — Graph & Vuln Explorer v1 | UI-GRAPH-24-001 | TODO | Build Graph Explorer canvas with virtualization. | UI Guild | Path: src/UI/StellaOps.UI | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 24 — Graph & Vuln Explorer v1 | UI-GRAPH-24-002 | TODO | Implement overlays (Policy/Evidence/License/Exposure). | UI Guild | Path: src/UI/StellaOps.UI | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 25 — Exceptions v1 | DOCS-EXC-25-001 | TODO | Document exception governance concepts/workflow. | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 25 — Exceptions v1 | DOCS-EXC-25-002 | TODO | Document approvals routing / MFA requirements. | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 25 — Exceptions v1 | DOCS-EXC-25-003 | TODO | Publish API documentation for exceptions endpoints. | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 25 — Exceptions v1 | DOCS-EXC-25-005 | TODO | Document UI exception center + badges. | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 25 — Exceptions v1 | DOCS-EXC-25-006 | TODO | Update CLI docs for exception commands. | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 25 — Exceptions v1 | DOCS-EXC-25-007 | TODO | Write migration guide for governed exceptions. | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 25 — Exceptions v1 | AUTH-EXC-25-001 | TODO | Introduce exception scopes and routing matrix with MFA. | Authority Core Guild | Path: src/Authority/StellaOps.Authority | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 25 — Exceptions v1 | AUTH-EXC-25-002 | TODO | Update docs/config samples for exception governance. | Authority Core & Docs Guild | Path: src/Authority/StellaOps.Authority | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 25 — Exceptions v1 | CLI-EXC-25-001 | TODO | Implement CLI exception workflow commands. | DevEx/CLI Guild | Path: src/Cli/StellaOps.Cli | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 25 — Exceptions v1 | CLI-EXC-25-002 | TODO | Extend policy simulate with exception overrides. | DevEx/CLI Guild | Path: src/Cli/StellaOps.Cli | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 25 — Exceptions v1 | POLICY-ENGINE-70-002 | TODO | Create exception collections/bindings storage + repos. | Policy Guild | Path: src/Policy/StellaOps.Policy.Engine | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 25 — Exceptions v1 | POLICY-ENGINE-70-003 | TODO | Implement Redis exception cache + invalidation. | Policy Guild | Path: src/Policy/StellaOps.Policy.Engine | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 25 — Exceptions v1 | POLICY-ENGINE-70-004 | TODO | Add metrics/tracing/logging for exception application. | Policy Guild | Path: src/Policy/StellaOps.Policy.Engine | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 25 — Exceptions v1 | POLICY-ENGINE-70-005 | TODO | Hook workers/events for activation/expiry. | Policy Guild | Path: src/Policy/StellaOps.Policy.Engine | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 25 — Exceptions v1 | SCHED-WORKER-25-101 | TODO | Implement exception lifecycle worker for activation/expiry. | Scheduler Worker Guild | Path: src/Scheduler/__Libraries/StellaOps.Scheduler.Worker | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 25 — Exceptions v1 | SCHED-WORKER-25-102 | TODO | Add expiring notification job & metrics. | Scheduler Worker Guild | Path: src/Scheduler/__Libraries/StellaOps.Scheduler.Worker | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 25 — Exceptions v1 | UI-EXC-25-001 | TODO | Deliver Exception Center (list/kanban) with workflows. | UI Guild | Path: src/UI/StellaOps.UI | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 25 — Exceptions v1 | UI-EXC-25-002 | TODO | Build exception creation wizard with scope/timebox guardrails. | UI Guild | Path: src/UI/StellaOps.UI | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 25 — Exceptions v1 | UI-EXC-25-003 | TODO | Add inline exception drafting/proposing from explorers. | UI Guild | Path: src/UI/StellaOps.UI | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 25 — Exceptions v1 | UI-EXC-25-004 | TODO | Surface badges/countdowns/explain integration. | UI Guild | Path: src/UI/StellaOps.UI | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 25 — Exceptions v1 | WEB-EXC-25-001 | TODO | Ship exception CRUD + workflow API endpoints. | BE-Base Platform Guild | Path: src/Web/StellaOps.Web | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 25 — Exceptions v1 | WEB-EXC-25-002 | TODO | Extend policy endpoints to include exception metadata. | BE-Base Platform Guild | Path: src/Web/StellaOps.Web | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 25 — Exceptions v1 | WEB-EXC-25-003 | TODO | Emit exception events/notifications with rate limits. | BE-Base Platform Guild | Path: src/Web/StellaOps.Web | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 26 — Reachability v1 | DOCS-SIG-26-001 | TODO | Document reachability concepts and scoring. | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 26 — Reachability v1 | DOCS-SIG-26-002 | TODO | Document callgraph formats. | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 26 — Reachability v1 | DOCS-SIG-26-003 | TODO | Document runtime facts ingestion. | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 26 — Reachability v1 | DOCS-SIG-26-004 | TODO | Document policy weighting for signals. | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 26 — Reachability v1 | DOCS-SIG-26-005 | TODO | Document UI overlays/timelines. | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 26 — Reachability v1 | DOCS-SIG-26-006 | TODO | Document CLI reachability commands. | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 26 — Reachability v1 | DOCS-SIG-26-007 | TODO | Publish API docs for signals endpoints. | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 26 — Reachability v1 | DOCS-SIG-26-008 | TODO | Write migration guide for enabling reachability. | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 26 — Reachability v1 | DEVOPS-SIG-26-001 | TODO | Provision pipelines/deployments for Signals service. | DevOps Guild | Path: ops/devops | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 26 — Reachability v1 | DEVOPS-SIG-26-002 | TODO | Add dashboards/alerts for reachability metrics. | DevOps Guild | Path: ops/devops | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 26 — Reachability v1 | AUTH-SIG-26-001 | TODO | Add signals scopes/roles + AOC requirements. | Authority Core Guild | Path: src/Authority/StellaOps.Authority | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 26 — Reachability v1 | CLI-SIG-26-001 | TODO | Implement reachability CLI commands (upload/list/explain). | DevEx/CLI Guild | Path: src/Cli/StellaOps.Cli | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 26 — Reachability v1 | CLI-SIG-26-002 | TODO | Add reachability overrides to policy simulate. | DevEx/CLI Guild | Path: src/Cli/StellaOps.Cli | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 26 — Reachability v1 | CONCELIER-SIG-26-001 | TODO | Expose advisory symbol metadata for signals scoring. | Concelier Core Guild | Path: src/Concelier/__Libraries/StellaOps.Concelier.Core | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 26 — Reachability v1 | EXCITITOR-SIG-26-001 | TODO | Surface vendor exploitability hints to Signals. | Excititor Core Guild | Path: src/Excititor/__Libraries/StellaOps.Excititor.Core | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 26 — Reachability v1 | POLICY-ENGINE-80-001 | TODO | Integrate reachability inputs into policy evaluation and explainers. | Policy Guild | Path: src/Policy/StellaOps.Policy.Engine | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 26 — Reachability v1 | POLICY-ENGINE-80-002 | BLOCKED (2025-11-26) | Reachability input contract (80-001) not published; cannot join caches. | Policy Guild | Path: src/Policy/StellaOps.Policy.Engine | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 26 — Reachability v1 | POLICY-ENGINE-80-003 | BLOCKED (2025-11-26) | Blocked by 80-002 and missing reachability predicates contract. | Policy Guild | Path: src/Policy/StellaOps.Policy.Engine | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 26 — Reachability v1 | POLICY-ENGINE-80-004 | BLOCKED (2025-11-26) | Blocked by 80-003; metrics depend on reachability integration. | Policy Guild | Path: src/Policy/StellaOps.Policy.Engine | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 26 — Reachability v1 | POLICY-SPL-24-001 | DONE (2025-11-26) | Extended SPL schema with reachability/exploitability predicates. | Policy Guild | Path: src/Policy/__Libraries/StellaOps.Policy | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 26 — Reachability v1 | SCHED-WORKER-26-201 | TODO | Implement reachability joiner worker. | Scheduler Worker Guild | Path: src/Scheduler/__Libraries/StellaOps.Scheduler.Worker | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 26 — Reachability v1 | SCHED-WORKER-26-202 | TODO | Implement staleness monitor + notifications. | Scheduler Worker Guild | Path: src/Scheduler/__Libraries/StellaOps.Scheduler.Worker | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 26 — Reachability v1 | SIGNALS-24-001 | BLOCKED (2025-10-27) | Stand up Signals API skeleton with RBAC + health checks. Host scaffold ready, waiting on `AUTH-SIG-26-001` to finalize scope issuance and tenant enforcement. | Signals Guild, Authority Guild | Path: src/Signals/StellaOps.Signals | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 26 — Reachability v1 | SIGNALS-24-002 | BLOCKED (2025-10-27) | Implement callgraph ingestion/normalization pipeline. Waiting on SIGNALS-24-001 skeleton deployment. | Signals Guild | Path: src/Signals/StellaOps.Signals | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 26 — Reachability v1 | SIGNALS-24-003 | BLOCKED (2025-10-27) | Ingest runtime facts and persist context data with AOC provenance. Depends on SIGNALS-24-001 base host. | Signals Guild | Path: src/Signals/StellaOps.Signals | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 26 — Reachability v1 | SIGNALS-24-004 | BLOCKED (2025-10-27) | Deliver reachability scoring engine writing reachability facts. Blocked until ingestion pipelines unblock. | Signals Guild | Path: src/Signals/StellaOps.Signals | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 26 — Reachability v1 | SIGNALS-24-005 | BLOCKED (2025-10-27) | Implement caches + signals events. Downstream of SIGNALS-24-004. | Signals Guild | Path: src/Signals/StellaOps.Signals | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 26 — Reachability v1 | UI-SIG-26-001 | TODO | Add reachability columns/badges to Vulnerability Explorer. | UI Guild | Path: src/UI/StellaOps.UI | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 26 — Reachability v1 | UI-SIG-26-002 | TODO | Enhance Why drawer with call path/timeline. | UI Guild | Path: src/UI/StellaOps.UI | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 26 — Reachability v1 | UI-SIG-26-003 | TODO | Add reachability overlay/time slider to SBOM Graph. | UI Guild | Path: src/UI/StellaOps.UI | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 26 — Reachability v1 | UI-SIG-26-004 | TODO | Build Reachability Center + missing sensor view. | UI Guild | Path: src/UI/StellaOps.UI | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 26 — Reachability v1 | WEB-SIG-26-001 | TODO | Expose signals proxy endpoints with pagination and RBAC. | BE-Base Platform Guild | Path: src/Web/StellaOps.Web | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 26 — Reachability v1 | WEB-SIG-26-002 | TODO | Join reachability data into policy/vuln responses. | BE-Base Platform Guild | Path: src/Web/StellaOps.Web | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 26 — Reachability v1 | WEB-SIG-26-003 | TODO | Support reachability overrides in simulate APIs. | BE-Base Platform Guild | Path: src/Web/StellaOps.Web | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 27 — Policy Studio | DOCS-POLICY-27-001 | BLOCKED (2025-10-27) | Publish `/docs/policy/studio-overview.md` with lifecycle + roles. | Docs & Policy Guilds | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 27 — Policy Studio | DOCS-POLICY-27-002 | BLOCKED (2025-10-27) | Write `/docs/policy/authoring.md` with templates/snippets/lint rules. | Docs & Console Guilds | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 27 — Policy Studio | DOCS-POLICY-27-003 | BLOCKED (2025-10-27) | Document `/docs/policy/versioning-and-publishing.md`. | Docs & Policy Registry Guilds | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 27 — Policy Studio | DOCS-POLICY-27-004 | BLOCKED (2025-10-27) | Publish `/docs/policy/simulation.md` with quick vs batch guidance. | Docs & Scheduler Guilds | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 27 — Policy Studio | DOCS-POLICY-27-005 | BLOCKED (2025-10-27) | Author `/docs/policy/review-and-approval.md`. | Docs & Product Ops | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 27 — Policy Studio | DOCS-POLICY-27-006 | BLOCKED (2025-10-27) | Publish `/docs/policy/promotion.md` covering canary + rollback. | Docs & Policy Guilds | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 27 — Policy Studio | DOCS-POLICY-27-007 | BLOCKED (2025-10-27) | Update `/docs/policy/cli.md` with new commands + JSON schemas. | Docs & DevEx/CLI Guilds | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 27 — Policy Studio | DOCS-POLICY-27-008 | BLOCKED (2025-10-27) | Publish `/docs/policy/api.md` aligning with Registry OpenAPI. | Docs & Policy Registry Guilds | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 27 — Policy Studio | DOCS-POLICY-27-009 | BLOCKED (2025-10-27) | Create `/docs/security/policy-attestations.md`. | Docs & Security Guilds | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 27 — Policy Studio | DOCS-POLICY-27-010 | BLOCKED (2025-10-27) | Write `/docs/architecture/policy-registry.md`. | Docs & Architecture Guilds | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 27 — Policy Studio | DOCS-POLICY-27-011 | BLOCKED (2025-10-27) | Publish `/docs/observability/policy-telemetry.md`. | Docs & Observability Guilds | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 27 — Policy Studio | DOCS-POLICY-27-012 | BLOCKED (2025-10-27) | Write `/docs/runbooks/policy-incident.md`. | Docs & Ops Guilds | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 27 — Policy Studio | DOCS-POLICY-27-013 | BLOCKED (2025-10-27) | Update `/docs/examples/policy-templates.md`. | Docs & Policy Guilds | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 27 — Policy Studio | DOCS-POLICY-27-014 | BLOCKED (2025-10-27) | Refresh `/docs/aoc/aoc-guardrails.md` with Studio guardrails. | Docs & Policy Registry Guilds | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 27 — Policy Studio | DEPLOY-POLICY-27-001 | TODO | Create Helm/Compose overlays for Policy Registry + workers with signing config. | Deployment & Policy Registry Guilds | Path: ops/deployment | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 27 — Policy Studio | DEPLOY-POLICY-27-002 | TODO | Document policy rollout/rollback playbooks in runbook. | Deployment & Policy Guilds | Path: ops/deployment | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 27 — Policy Studio | DEVOPS-POLICY-27-001 | TODO | Add CI stage for policy lint/compile/test + secret scanning and artifacts. | DevOps Guild | Path: ops/devops | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 27 — Policy Studio | DEVOPS-POLICY-27-002 | TODO | Provide optional batch simulation CI job with drift gating + PR comment. | DevOps & Policy Registry Guilds | Path: ops/devops | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 27 — Policy Studio | DEVOPS-POLICY-27-003 | TODO | Manage signing keys + attestation verification in pipelines. | DevOps & Security Guilds | Path: ops/devops | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 27 — Policy Studio | DEVOPS-POLICY-27-004 | TODO | Build dashboards/alerts for compile latency, queue depth, approvals, promotions. | DevOps & Observability Guilds | Path: ops/devops | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 27 — Policy Studio | AUTH-POLICY-27-001 | TODO | Define Policy Studio roles/scopes for author/review/approve/operate/audit. | Authority Core Guild | Path: src/Authority/StellaOps.Authority | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 27 — Policy Studio | AUTH-POLICY-27-002 | TODO | Wire signing service + fresh-auth enforcement for publish/promote. | Authority Core & Security Guilds | Path: src/Authority/StellaOps.Authority | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 27 — Policy Studio | AUTH-POLICY-27-003 | TODO | Update authority configuration/docs for Policy Studio roles & signing. | Authority Core & Docs Guild | Path: src/Authority/StellaOps.Authority | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 27 — Policy Studio | CLI-POLICY-27-001 | TODO | Implement policy workspace CLI commands (init, lint, compile, test). | DevEx/CLI Guild | Path: src/Cli/StellaOps.Cli | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 27 — Policy Studio | CLI-POLICY-27-002 | TODO | Add version bump, submit, review/approve CLI workflow commands. | DevEx/CLI Guild | Path: src/Cli/StellaOps.Cli | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 27 — Policy Studio | CLI-POLICY-27-003 | TODO | Extend simulate command for quick/batch runs, manifests, CI reports. | DevEx/CLI Guild | Path: src/Cli/StellaOps.Cli | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 27 — Policy Studio | CLI-POLICY-27-004 | TODO | Implement publish/promote/rollback/sign CLI lifecycle commands. | DevEx/CLI Guild | Path: src/Cli/StellaOps.Cli | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 27 — Policy Studio | CLI-POLICY-27-005 | TODO | Update CLI docs/reference for Policy Studio commands and schemas. | DevEx/CLI & Docs Guilds | Path: src/Cli/StellaOps.Cli | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 27 — Policy Studio | POLICY-ENGINE-27-001 | TODO | Return rule coverage, symbol table, docs, hashes from compile endpoint. | Policy Guild | Path: src/Policy/StellaOps.Policy.Engine | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 27 — Policy Studio | POLICY-ENGINE-27-002 | TODO | Enhance simulate outputs with heatmap, explain traces, delta summaries. | Policy Guild | Path: src/Policy/StellaOps.Policy.Engine | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 27 — Policy Studio | POLICY-ENGINE-27-003 | TODO | Enforce complexity/time limits with diagnostics. | Policy Guild | Path: src/Policy/StellaOps.Policy.Engine | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 27 — Policy Studio | POLICY-ENGINE-27-004 | TODO | Update tests/fixtures for coverage, symbol table, explain, complexity. | Policy Guild | Path: src/Policy/StellaOps.Policy.Engine | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 27 — Policy Studio | REGISTRY-API-27-001 | TODO | Define Policy Registry OpenAPI spec for workspaces, versions, reviews, simulations, promotions, attestations. | Policy Registry Guild | Path: src/Policy/StellaOps.Policy.Registry | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 27 — Policy Studio | REGISTRY-API-27-002 | TODO | Implement workspace storage + CRUD with tenant retention policies. | Policy Registry Guild | Path: src/Policy/StellaOps.Policy.Registry | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 27 — Policy Studio | REGISTRY-API-27-003 | TODO | Integrate compile pipeline storing diagnostics, symbol tables, complexity metrics. | Policy Registry Guild | Path: src/Policy/StellaOps.Policy.Registry | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 27 — Policy Studio | REGISTRY-API-27-004 | TODO | Deliver quick simulation API with limits and deterministic outputs. | Policy Registry Guild | Path: src/Policy/StellaOps.Policy.Registry | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 27 — Policy Studio | REGISTRY-API-27-005 | TODO | Build batch simulation orchestration, reduction, and evidence bundle storage. | Policy Registry & Scheduler Guilds | Path: src/Policy/StellaOps.Policy.Registry | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 27 — Policy Studio | REGISTRY-API-27-006 | TODO | Implement review workflow with comments, required approvers, webhooks. | Policy Registry Guild | Path: src/Policy/StellaOps.Policy.Registry | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 27 — Policy Studio | REGISTRY-API-27-007 | TODO | Ship publish/sign pipeline with attestations, immutable versions. | Policy Registry & Security Guilds | Path: src/Policy/StellaOps.Policy.Registry | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 27 — Policy Studio | REGISTRY-API-27-008 | TODO | Implement promotion/canary bindings per tenant/environment with rollback. | Policy Registry Guild | Path: src/Policy/StellaOps.Policy.Registry | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 27 — Policy Studio | REGISTRY-API-27-009 | TODO | Instrument metrics/logs/traces for compile, simulation, approval latency. | Policy Registry & Observability Guilds | Path: src/Policy/StellaOps.Policy.Registry | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 27 — Policy Studio | REGISTRY-API-27-010 | TODO | Build unit/integration/load test suites and seeded fixtures. | Policy Registry & QA Guilds | Path: src/Policy/StellaOps.Policy.Registry | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 27 — Policy Studio | SCHED-CONSOLE-27-001 | TODO | Provide policy simulation orchestration endpoints with SSE + RBAC. | Scheduler WebService Guild | Path: src/Scheduler/StellaOps.Scheduler.WebService | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 27 — Policy Studio | SCHED-CONSOLE-27-002 | TODO | Emit policy simulation telemetry endpoints/metrics + webhooks. | Scheduler WebService & Observability Guilds | Path: src/Scheduler/StellaOps.Scheduler.WebService | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 27 — Policy Studio | SCHED-WORKER-27-301 | TODO | Implement batch simulation worker sharding SBOMs with retries/backoff. | Scheduler Worker Guild | Path: src/Scheduler/__Libraries/StellaOps.Scheduler.Worker | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 27 — Policy Studio | SCHED-WORKER-27-302 | TODO | Build reducer job aggregating shard outputs into manifests with checksums. | Scheduler Worker Guild | Path: src/Scheduler/__Libraries/StellaOps.Scheduler.Worker | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 27 — Policy Studio | SCHED-WORKER-27-303 | TODO | Enforce tenant isolation/attestation integration and secret scanning for jobs. | Scheduler Worker & Security Guilds | Path: src/Scheduler/__Libraries/StellaOps.Scheduler.Worker | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 27 — Policy Studio | WEB-POLICY-27-001 | TODO | Proxy Policy Registry APIs with tenant scoping, RBAC, evidence streaming. | BE-Base Platform Guild | Path: src/Web/StellaOps.Web | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 27 — Policy Studio | WEB-POLICY-27-002 | TODO | Implement review lifecycle routes with audit logs and webhooks. | BE-Base Platform Guild | Path: src/Web/StellaOps.Web | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 27 — Policy Studio | WEB-POLICY-27-003 | TODO | Expose quick/batch simulation endpoints with SSE progress + manifests. | BE-Base Platform & Scheduler Guilds | Path: src/Web/StellaOps.Web | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 27 — Policy Studio | WEB-POLICY-27-004 | TODO | Add publish/promote/rollback endpoints with canary + signing enforcement. | BE-Base Platform & Security Guilds | Path: src/Web/StellaOps.Web | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 27 — Policy Studio | WEB-POLICY-27-005 | TODO | Instrument Policy Studio metrics/logs for dashboards. | BE-Base Platform & Observability Guilds | Path: src/Web/StellaOps.Web | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 28 — Graph Explorer | DOCS-GRAPH-28-001 | TODO | Publish `/docs/sbom/graph-explorer-overview.md`. | Docs & SBOM Guilds | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 28 — Graph Explorer | DOCS-GRAPH-28-002 | TODO | Write `/docs/sbom/graph-using-the-console.md` with walkthrough + accessibility tips. | Docs & Console Guilds | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 28 — Graph Explorer | DOCS-GRAPH-28-003 | TODO | Document `/docs/sbom/graph-query-language.md` (JSON schema, cost rules). | Docs & Graph API Guilds | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 28 — Graph Explorer | DOCS-GRAPH-28-004 | TODO | Publish `/docs/sbom/graph-api.md` endpoints + streaming guidance. | Docs & Graph API Guilds | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 28 — Graph Explorer | DOCS-GRAPH-28-005 | TODO | Produce `/docs/sbom/graph-cli.md` command reference. | Docs & CLI Guilds | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 28 — Graph Explorer | DOCS-GRAPH-28-006 | TODO | Publish `/docs/policy/graph-overlays.md`. | Docs & Policy Guilds | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 28 — Graph Explorer | DOCS-GRAPH-28-007 | TODO | Document `/docs/vex/graph-integration.md`. | Docs & Excitor Guilds | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 28 — Graph Explorer | DOCS-GRAPH-28-008 | TODO | Document `/docs/advisories/graph-integration.md`. | Docs & Concelier Guilds | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 28 — Graph Explorer | DOCS-GRAPH-28-009 | TODO | Author `/docs/architecture/graph-services.md`. | Docs & Architecture Guilds | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 28 — Graph Explorer | DOCS-GRAPH-28-010 | TODO | Publish `/docs/observability/graph-telemetry.md`. | Docs & Observability Guilds | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 28 — Graph Explorer | DOCS-GRAPH-28-011 | TODO | Write `/docs/runbooks/graph-incidents.md`. | Docs & Ops Guilds | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 28 — Graph Explorer | DOCS-GRAPH-28-012 | TODO | Create `/docs/security/graph-rbac.md`. | Docs & Security Guilds | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 28 — Graph Explorer | DEPLOY-GRAPH-28-001 | TODO | Provide deployment/offline instructions for Graph Indexer/API, including cache seeds. | Deployment Guild | Path: ops/deployment | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 28 — Graph Explorer | DEVOPS-GRAPH-28-001 | TODO | Configure load/perf tests, query budget alerts, and CI smoke for graph APIs. | DevOps Guild | Path: ops/devops | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 28 — Graph Explorer | DEVOPS-GRAPH-28-002 | TODO | Implement caching/backpressure limits, rate limiting configs, and runaway query kill switches. | DevOps & Security Guilds | Path: ops/devops | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 28 — Graph Explorer | DEVOPS-GRAPH-28-003 | TODO | Build dashboards/alerts for tile latency, query denials, memory pressure. | DevOps & Observability Guilds | Path: ops/devops | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 28 — Graph Explorer | CLI-GRAPH-28-001 | TODO | Ship `stella sbom graph` subcommands (search, query, paths, diff, impacted, export) with JSON output + exit codes. | DevEx/CLI Guild | Path: src/Cli/StellaOps.Cli | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 28 — Graph Explorer | CLI-GRAPH-28-002 | TODO | Add saved query management + deep link helpers to CLI. | DevEx/CLI Guild | Path: src/Cli/StellaOps.Cli | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 28 — Graph Explorer | CLI-GRAPH-28-003 | TODO | Update CLI docs/examples for Graph Explorer commands. | DevEx/CLI Guild | Path: src/Cli/StellaOps.Cli | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 28 — Graph Explorer | CONCELIER-GRAPH-24-101 | TODO | Deliver advisory summary API feeding graph tooltips. | Concelier WebService Guild | Path: src/Concelier/StellaOps.Concelier.WebService | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 28 — Graph Explorer | CONCELIER-GRAPH-28-102 | TODO | Add batch fetch for advisory observations/linksets keyed by component sets to feed Graph overlay tooltips efficiently. | Concelier WebService Guild | Path: src/Concelier/StellaOps.Concelier.WebService | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 28 — Graph Explorer | WEB-LNM-21-001 | TODO | Provide advisory observation endpoints optimized for graph overlays. | Concelier WebService Guild | Path: src/Concelier/StellaOps.Concelier.WebService | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 28 — Graph Explorer | EXCITITOR-GRAPH-24-101 | TODO | Provide VEX summary API for Graph Explorer inspector overlays. | Excititor WebService Guild | Path: src/Excititor/StellaOps.Excititor.WebService | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 28 — Graph Explorer | GRAPH-API-28-001 | TODO | Publish Graph API OpenAPI + JSON schemas for queries/tiles. | Graph API Guild | Path: src/Graph/StellaOps.Graph.Api | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 28 — Graph Explorer | GRAPH-API-28-002 | TODO | Implement `/graph/search` with caching and RBAC. | Graph API Guild | Path: src/Graph/StellaOps.Graph.Api | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 28 — Graph Explorer | GRAPH-API-28-003 | TODO | Build query planner + streaming tile pipeline with budgets. | Graph API Guild | Path: src/Graph/StellaOps.Graph.Api | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 28 — Graph Explorer | GRAPH-API-28-004 | TODO | Deliver `/graph/paths` with depth limits and policy overlay support. | Graph API Guild | Path: src/Graph/StellaOps.Graph.Api | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 28 — Graph Explorer | GRAPH-API-28-005 | TODO | Implement `/graph/diff` streaming adds/removes/changes for SBOM snapshots. | Graph API Guild | Path: src/Graph/StellaOps.Graph.Api | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 28 — Graph Explorer | GRAPH-API-28-006 | TODO | Compose advisory/VEX/policy overlays with caching + explain sampling. | Graph API Guild | Path: src/Graph/StellaOps.Graph.Api | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 28 — Graph Explorer | GRAPH-API-28-007 | TODO | Provide export jobs (GraphML/CSV/NDJSON/PNG/SVG) with manifests. | Graph API Guild | Path: src/Graph/StellaOps.Graph.Api | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 28 — Graph Explorer | GRAPH-API-28-008 | TODO | Enforce RBAC scopes, tenant headers, audit logging, rate limits. | Graph API & Authority Guilds | Path: src/Graph/StellaOps.Graph.Api | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 28 — Graph Explorer | GRAPH-API-28-009 | TODO | Instrument metrics/logs/traces; publish dashboards. | Graph API & Observability Guilds | Path: src/Graph/StellaOps.Graph.Api | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 28 — Graph Explorer | GRAPH-API-28-010 | TODO | Build unit/integration/load tests with synthetic datasets. | Graph API & QA Guilds | Path: src/Graph/StellaOps.Graph.Api | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 28 — Graph Explorer | GRAPH-API-28-011 | TODO | Ship deployment/offline manifests + gateway integration docs. | Graph API & DevOps Guilds | Path: src/Graph/StellaOps.Graph.Api | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 28 — Graph Explorer | GRAPH-INDEX-28-001 | TODO | Define node/edge schemas, identity rules, and fixtures for graph ingestion. | Graph Indexer Guild | Path: src/Graph/StellaOps.Graph.Indexer | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 28 — Graph Explorer | GRAPH-INDEX-28-002 | TODO | Implement SBOM ingest consumer generating artifact/package/file nodes & edges. | Graph Indexer Guild | Path: src/Graph/StellaOps.Graph.Indexer | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 28 — Graph Explorer | GRAPH-INDEX-28-003 | TODO | Serve advisory overlay tiles from Conseiller linksets (no mutation of raw node/edge stores). | Graph Indexer Guild | Path: src/Graph/StellaOps.Graph.Indexer | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 28 — Graph Explorer | GRAPH-INDEX-28-004 | TODO | Integrate VEX statements for `vex_exempts` edges with precedence metadata. | Graph Indexer Guild | Path: src/Graph/StellaOps.Graph.Indexer | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 28 — Graph Explorer | GRAPH-INDEX-28-005 | TODO | Hydrate policy overlay nodes/edges referencing determinations + explains. | Graph Indexer & Policy Guilds | Path: src/Graph/StellaOps.Graph.Indexer | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 28 — Graph Explorer | GRAPH-INDEX-28-006 | TODO | Produce graph snapshots per SBOM with lineage for diff jobs. | Graph Indexer Guild | Path: src/Graph/StellaOps.Graph.Indexer | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 28 — Graph Explorer | GRAPH-INDEX-28-007 | TODO | Run clustering/centrality background jobs and persist cluster ids. | Graph Indexer & Observability Guilds | Path: src/Graph/StellaOps.Graph.Indexer | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 28 — Graph Explorer | GRAPH-INDEX-28-008 | TODO | Build incremental/backfill pipeline with change streams, retries, backlog metrics. | Graph Indexer Guild | Path: src/Graph/StellaOps.Graph.Indexer | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 28 — Graph Explorer | GRAPH-INDEX-28-009 | TODO | Extend tests/perf fixtures ensuring determinism on large graphs. | Graph Indexer & QA Guilds | Path: src/Graph/StellaOps.Graph.Indexer | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 28 — Graph Explorer | GRAPH-INDEX-28-010 | TODO | Provide deployment/offline artifacts and docs for Graph Indexer. | Graph Indexer & DevOps Guilds | Path: src/Graph/StellaOps.Graph.Indexer | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 28 — Graph Explorer | POLICY-ENGINE-30-001 | TODO | Finalize graph overlay contract + projection API. | Policy Guild | Path: src/Policy/StellaOps.Policy.Engine | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 28 — Graph Explorer | POLICY-ENGINE-30-002 | TODO | Implement simulation overlay bridge for Graph Explorer queries. | Policy Guild | Path: src/Policy/StellaOps.Policy.Engine | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 28 — Graph Explorer | POLICY-ENGINE-30-003 | TODO | Emit change events for effective findings supporting graph overlays. | Policy & Scheduler Guilds | Path: src/Policy/StellaOps.Policy.Engine | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 28 — Graph Explorer | SCHED-WEB-21-004 | DOING (2025-10-26) | Persist graph jobs + emit completion events/webhook. | Scheduler WebService Guild, Scheduler Storage Guild | Path: src/Scheduler/StellaOps.Scheduler.WebService | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 28 — Graph Explorer | SCHED-WORKER-21-201 | TODO | Run graph build worker for SBOM snapshots with retries/backoff. | Scheduler Worker Guild | Path: src/Scheduler/__Libraries/StellaOps.Scheduler.Worker | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 28 — Graph Explorer | SCHED-WORKER-21-202 | TODO | Execute overlay refresh worker subscribing to change events. | Scheduler Worker Guild | Path: src/Scheduler/__Libraries/StellaOps.Scheduler.Worker | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 28 — Graph Explorer | SCHED-WORKER-21-203 | TODO | Emit metrics/logs for graph build/overlay jobs. | Scheduler Worker & Observability Guilds | Path: src/Scheduler/__Libraries/StellaOps.Scheduler.Worker | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 28 — Graph Explorer | WEB-GRAPH-24-001 | TODO | Route `/graph/*` APIs through gateway with tenant scoping and RBAC. | BE-Base Platform Guild | Path: src/Web/StellaOps.Web | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 28 — Graph Explorer | WEB-GRAPH-24-002 | TODO | Maintain overlay proxy routes to dedicated services (Policy/Vuln API), ensuring caching + RBAC only. | BE-Base Platform Guild | Path: src/Web/StellaOps.Web | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 28 — Graph Explorer | WEB-GRAPH-24-004 | TODO | Add Graph Explorer telemetry endpoints and metrics aggregation. | BE-Base Platform & Observability Guilds | Path: src/Web/StellaOps.Web | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 29 — Vulnerability Explorer | DOCS-VULN-29-001 | TODO | Publish `/docs/vuln/explorer-overview.md`. | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 29 — Vulnerability Explorer | DOCS-VULN-29-002 | TODO | Write `/docs/vuln/explorer-using-console.md`. | Docs & Console Guilds | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 29 — Vulnerability Explorer | DOCS-VULN-29-003 | TODO | Author `/docs/vuln/explorer-api.md`. | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 29 — Vulnerability Explorer | DOCS-VULN-29-004 | TODO | Publish `/docs/vuln/explorer-cli.md`. | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 29 — Vulnerability Explorer | DOCS-VULN-29-005 | TODO | Document Findings Ledger (`/docs/vuln/findings-ledger.md`). | Docs & Ledger Guilds | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 29 — Vulnerability Explorer | DOCS-VULN-29-006 | TODO | Update `/docs/policy/vuln-determinations.md`. | Docs & Policy Guilds | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 29 — Vulnerability Explorer | DOCS-VULN-29-007 | TODO | Publish `/docs/vex/explorer-integration.md`. | Docs & Excititor Guilds | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 29 — Vulnerability Explorer | DOCS-VULN-29-008 | TODO | Publish `/docs/advisories/explorer-integration.md`. | Docs & Concelier Guilds | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 29 — Vulnerability Explorer | DOCS-VULN-29-009 | TODO | Publish `/docs/sbom/vuln-resolution.md`. | Docs & SBOM Guilds | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 29 — Vulnerability Explorer | DOCS-VULN-29-010 | TODO | Publish `/docs/observability/vuln-telemetry.md`. | Docs & Observability Guilds | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 29 — Vulnerability Explorer | DOCS-VULN-29-011 | TODO | Publish `/docs/security/vuln-rbac.md`. | Docs & Security Guilds | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 29 — Vulnerability Explorer | DOCS-VULN-29-012 | TODO | Publish `/docs/runbooks/vuln-ops.md`. | Docs & Ops Guilds | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 29 — Vulnerability Explorer | DOCS-VULN-29-013 | TODO | Update `/docs/install/containers.md` with Findings Ledger & Vuln Explorer API. | Docs & Deployment Guilds | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 29 — Vulnerability Explorer | DEPLOY-VULN-29-001 | TODO | Provide deployments for Findings Ledger/projector with migrations/backups. | Deployment & Findings Ledger Guilds | Path: ops/deployment | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 29 — Vulnerability Explorer | DEPLOY-VULN-29-002 | TODO | Package Vuln Explorer API deployments/health checks/offline kit notes. | Deployment & Vuln Explorer API Guilds | Path: ops/deployment | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 29 — Vulnerability Explorer | DEVOPS-VULN-29-001 | TODO | Set up CI/backups/anchoring monitoring for Findings Ledger. | DevOps & Findings Ledger Guilds | Path: ops/devops | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 29 — Vulnerability Explorer | DEVOPS-VULN-29-002 | TODO | Configure Vuln Explorer perf tests, budgets, dashboards, alerts. | DevOps & Vuln Explorer API Guilds | Path: ops/devops | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 29 — Vulnerability Explorer | DEVOPS-VULN-29-003 | TODO | Integrate Vuln Explorer telemetry pipeline with privacy safeguards + dashboards. | DevOps & Console Guilds | Path: ops/devops | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 29 — Vulnerability Explorer | AUTH-VULN-29-001 | TODO | Define Vuln Explorer RBAC/ABAC scopes and issuer metadata. | Authority Core & Security Guild | Path: src/Authority/StellaOps.Authority | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 29 — Vulnerability Explorer | AUTH-VULN-29-002 | TODO | Enforce CSRF, attachment signing, and audit logging referencing ledger hashes. | Authority Core & Security Guild | Path: src/Authority/StellaOps.Authority | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 29 — Vulnerability Explorer | AUTH-VULN-29-003 | TODO | Update docs/config samples for Vuln Explorer roles and security posture. | Authority Core & Docs Guild | Path: src/Authority/StellaOps.Authority | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 29 — Vulnerability Explorer | CLI-VULN-29-001 | DONE (2025-12-06) | Implement `stella vuln list` with grouping, filters, JSON/CSV output. | DevEx/CLI Guild | Path: src/Cli/StellaOps.Cli | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 29 — Vulnerability Explorer | CLI-VULN-29-002 | DONE (2025-12-06) | Implement `stella vuln show` with evidence/policy/path display. | DevEx/CLI Guild | Path: src/Cli/StellaOps.Cli | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 29 — Vulnerability Explorer | CLI-VULN-29-003 | TODO | Add workflow CLI commands (assign/comment/accept-risk/verify-fix/target-fix/reopen). | DevEx/CLI Guild | Path: src/Cli/StellaOps.Cli | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 29 — Vulnerability Explorer | CLI-VULN-29-004 | TODO | Implement `stella vuln simulate` producing diff summaries/Markdown. | DevEx/CLI Guild | Path: src/Cli/StellaOps.Cli | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 29 — Vulnerability Explorer | CLI-VULN-29-005 | TODO | Implement `stella vuln export` and bundle signature verification. | DevEx/CLI Guild | Path: src/Cli/StellaOps.Cli | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 29 — Vulnerability Explorer | CLI-VULN-29-006 | TODO | Update CLI docs/examples for Vulnerability Explorer commands. | DevEx/CLI & Docs Guilds | Path: src/Cli/StellaOps.Cli | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 29 — Vulnerability Explorer | CONCELIER-VULN-29-001 | TODO | Canonicalize (lossless) advisory identifiers, persist `links[]`, backfill, and expose raw payload snapshots (no merge/derived fields). | Concelier WebService Guild | Path: src/Concelier/StellaOps.Concelier.WebService | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 29 — Vulnerability Explorer | CONCELIER-VULN-29-002 | TODO | Provide advisory evidence retrieval endpoint for Vuln Explorer. | Concelier WebService Guild | Path: src/Concelier/StellaOps.Concelier.WebService | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 29 — Vulnerability Explorer | CONCELIER-VULN-29-004 | TODO | Add metrics/logs/events for advisory normalization supporting resolver. | Concelier WebService & Observability Guilds | Path: src/Concelier/StellaOps.Concelier.WebService | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 29 — Vulnerability Explorer | EXCITITOR-VULN-29-001 | TODO | Canonicalize (lossless) VEX keys and product scopes with backfill + links (no merge/suppression). | Excititor WebService Guild | Path: src/Excititor/StellaOps.Excititor.WebService | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 29 — Vulnerability Explorer | EXCITITOR-VULN-29-002 | TODO | Expose VEX evidence retrieval endpoint for Explorer evidence tabs. | Excititor WebService Guild | Path: src/Excititor/StellaOps.Excititor.WebService | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 29 — Vulnerability Explorer | EXCITITOR-VULN-29-004 | TODO | Instrument metrics/logs for VEX normalization and suppression events. | Excititor WebService & Observability Guilds | Path: src/Excititor/StellaOps.Excititor.WebService | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 29 — Vulnerability Explorer | LEDGER-29-001 | TODO | Design ledger & projection schemas, hashing strategy, and migrations for Findings Ledger. | Findings Ledger Guild | Path: src/Findings/StellaOps.Findings.Ledger | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 29 — Vulnerability Explorer | LEDGER-29-002 | TODO | Implement ledger write API with hash chaining and Merkle root anchoring job. | Findings Ledger Guild | Path: src/Findings/StellaOps.Findings.Ledger | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 29 — Vulnerability Explorer | LEDGER-29-003 | TODO | Build projector worker deriving `findings_projection` with idempotent replay. | Findings Ledger & Scheduler Guilds | Path: src/Findings/StellaOps.Findings.Ledger | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 29 — Vulnerability Explorer | LEDGER-29-004 | TODO | Integrate Policy Engine batch evaluation into projector with rationale caching. | Findings Ledger & Policy Guilds | Path: src/Findings/StellaOps.Findings.Ledger | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 29 — Vulnerability Explorer | LEDGER-29-005 | TODO | Implement workflow mutation endpoints producing ledger events (assign/comment/accept-risk/etc.). | Findings Ledger Guild | Path: src/Findings/StellaOps.Findings.Ledger | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 29 — Vulnerability Explorer | LEDGER-29-006 | TODO | Add attachment encryption, signed URLs, and CSRF protections for workflow endpoints. | Findings Ledger & Security Guilds | Path: src/Findings/StellaOps.Findings.Ledger | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 29 — Vulnerability Explorer | LEDGER-29-007 | TODO | Instrument ledger metrics/logs/alerts (write latency, projection lag, anchoring). | Findings Ledger & Observability Guilds | Path: src/Findings/StellaOps.Findings.Ledger | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 29 — Vulnerability Explorer | LEDGER-29-008 | TODO | Provide replay/determinism/load tests for ledger/projector pipelines. | Findings Ledger & QA Guilds | Path: src/Findings/StellaOps.Findings.Ledger | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 29 — Vulnerability Explorer | LEDGER-29-009 | TODO | Deliver deployment/offline artefacts, backup/restore, Merkle anchoring guidance. | Findings Ledger & DevOps Guilds | Path: src/Findings/StellaOps.Findings.Ledger | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 29 — Vulnerability Explorer | POLICY-ENGINE-29-001 | TODO | Implement policy batch evaluation endpoint returning determinations + rationale. | Policy Guild | Path: src/Policy/StellaOps.Policy.Engine | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 29 — Vulnerability Explorer | POLICY-ENGINE-29-002 | TODO | Provide simulation diff API for Vuln Explorer comparisons. | Policy Guild | Path: src/Policy/StellaOps.Policy.Engine | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 29 — Vulnerability Explorer | POLICY-ENGINE-29-003 | TODO | Include path/scope annotations in determinations for Explorer. | Policy Guild | Path: src/Policy/StellaOps.Policy.Engine | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 29 — Vulnerability Explorer | POLICY-ENGINE-29-004 | TODO | Add telemetry for batch evaluation + simulation jobs. | Policy Guild & Observability Guild | Path: src/Policy/StellaOps.Policy.Engine | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 29 — Vulnerability Explorer | SBOM-VULN-29-001 | TODO | Emit inventory evidence with scope/runtime/path/safe version hints; publish change events. | SBOM Service Guild | Path: src/SbomService/StellaOps.SbomService | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 29 — Vulnerability Explorer | SBOM-VULN-29-002 | TODO | Provide resolver feed for candidate generation with idempotent delivery. | SBOM Service & Findings Ledger Guilds | Path: src/SbomService/StellaOps.SbomService | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 29 — Vulnerability Explorer | SCHED-VULN-29-001 | TODO | Expose resolver job APIs + status monitoring for Vuln Explorer recomputation. | Scheduler WebService Guild | Path: src/Scheduler/StellaOps.Scheduler.WebService | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 29 — Vulnerability Explorer | SCHED-VULN-29-002 | TODO | Provide projector lag metrics endpoint + webhook notifications. | Scheduler WebService & Observability Guilds | Path: src/Scheduler/StellaOps.Scheduler.WebService | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 29 — Vulnerability Explorer | SCHED-WORKER-29-001 | TODO | Implement resolver worker applying ecosystem version semantics and path scope. | Scheduler Worker Guild | Path: src/Scheduler/__Libraries/StellaOps.Scheduler.Worker | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 29 — Vulnerability Explorer | SCHED-WORKER-29-002 | TODO | Implement evaluation worker invoking Policy Engine and updating ledger queues. | Scheduler Worker Guild | Path: src/Scheduler/__Libraries/StellaOps.Scheduler.Worker | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 29 — Vulnerability Explorer | SCHED-WORKER-29-003 | TODO | Add monitoring for resolver/evaluation backlog and SLA alerts. | Scheduler Worker & Observability Guilds | Path: src/Scheduler/__Libraries/StellaOps.Scheduler.Worker | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 29 — Vulnerability Explorer | VULN-API-29-001 | DONE (2025-11-25) | Publish Vuln Explorer OpenAPI + query schemas. | Vuln Explorer API Guild | Path: src/VulnExplorer/StellaOps.VulnExplorer.Api | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 29 — Vulnerability Explorer | VULN-API-29-002 | DONE (2025-11-25) | Implemented list/query endpoints with deterministic paging and tests. | Vuln Explorer API Guild | Path: src/VulnExplorer/StellaOps.VulnExplorer.Api | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 29 — Vulnerability Explorer | VULN-API-29-003 | DONE (2025-11-25) | Detail endpoint returns evidence, rationale, paths; integration tests in place. | Vuln Explorer API Guild | Path: src/VulnExplorer/StellaOps.VulnExplorer.Api | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 29 — Vulnerability Explorer | VULN-API-29-004 | TODO | Expose workflow APIs writing ledger events with validation + idempotency. | Vuln Explorer API & Findings Ledger Guilds | Path: src/VulnExplorer/StellaOps.VulnExplorer.Api | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 29 — Vulnerability Explorer | VULN-API-29-005 | TODO | Implement policy simulation endpoint producing diffs without side effects. | Vuln Explorer API & Policy Guilds | Path: src/VulnExplorer/StellaOps.VulnExplorer.Api | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 29 — Vulnerability Explorer | VULN-API-29-006 | TODO | Integrate Graph Explorer paths metadata and deep-link parameters. | Vuln Explorer API Guild | Path: src/VulnExplorer/StellaOps.VulnExplorer.Api | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 29 — Vulnerability Explorer | VULN-API-29-007 | TODO | Enforce RBAC/ABAC, CSRF, attachment security, and audit logging. | Vuln Explorer API & Security Guilds | Path: src/VulnExplorer/StellaOps.VulnExplorer.Api | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 29 — Vulnerability Explorer | VULN-API-29-008 | TODO | Provide evidence bundle export job with signing + manifests. | Vuln Explorer API Guild | Path: src/VulnExplorer/StellaOps.VulnExplorer.Api | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 29 — Vulnerability Explorer | VULN-API-29-009 | TODO | Instrument API telemetry (latency, workflow counts, exports). | Vuln Explorer API & Observability Guilds | Path: src/VulnExplorer/StellaOps.VulnExplorer.Api | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 29 — Vulnerability Explorer | VULN-API-29-010 | TODO | Deliver unit/integration/perf/determinism tests for Vuln Explorer API. | Vuln Explorer API & QA Guilds | Path: src/VulnExplorer/StellaOps.VulnExplorer.Api | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 29 — Vulnerability Explorer | VULN-API-29-011 | TODO | Ship deployment/offline manifests, health checks, scaling docs. | Vuln Explorer API & DevOps Guilds | Path: src/VulnExplorer/StellaOps.VulnExplorer.Api | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 29 — Vulnerability Explorer | WEB-VULN-29-001 | TODO | Route `/vuln/*` APIs with tenant RBAC, ABAC, anti-forgery enforcement. | BE-Base Platform Guild | Path: src/Web/StellaOps.Web | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 29 — Vulnerability Explorer | WEB-VULN-29-002 | TODO | Proxy workflow calls to Findings Ledger with correlation IDs + retries. | BE-Base Platform Guild | Path: src/Web/StellaOps.Web | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 29 — Vulnerability Explorer | WEB-VULN-29-003 | TODO | Expose simulation/export orchestration with SSE/progress + signed links. | BE-Base Platform Guild | Path: src/Web/StellaOps.Web | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 29 — Vulnerability Explorer | WEB-VULN-29-004 | TODO | Aggregate Vuln Explorer telemetry (latency, errors, exports). | BE-Base Platform & Observability Guilds | Path: src/Web/StellaOps.Web | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 30 — VEX Lens | DOCS-VEX-30-001 | TODO | Publish `/docs/vex/consensus-overview.md`. | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 30 — VEX Lens | DOCS-VEX-30-002 | TODO | Write `/docs/vex/consensus-algorithm.md`. | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 30 — VEX Lens | DOCS-VEX-30-003 | TODO | Document `/docs/vex/issuer-directory.md`. | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 30 — VEX Lens | DOCS-VEX-30-004 | TODO | Publish `/docs/vex/consensus-api.md`. | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 30 — VEX Lens | DOCS-VEX-30-005 | TODO | Create `/docs/vex/consensus-console.md`. | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 30 — VEX Lens | DOCS-VEX-30-006 | TODO | Add `/docs/policy/vex-trust-model.md`. | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 30 — VEX Lens | DOCS-VEX-30-007 | TODO | Author `/docs/sbom/vex-mapping.md`. | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 30 — VEX Lens | DOCS-VEX-30-008 | TODO | Publish `/docs/security/vex-signatures.md`. | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 30 — VEX Lens | DOCS-VEX-30-009 | TODO | Write `/docs/runbooks/vex-ops.md`. | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 30 — VEX Lens | VEXLENS-30-009, ISSUER-30-005 | TODO | Set up CI/perf/telemetry dashboards for VEX Lens and Issuer Directory. | DevOps Guild | Path: ops/devops | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 30 — VEX Lens | VEXLENS-30-007 | TODO | Implement `stella vex consensus` CLI commands with list/show/simulate/export. | DevEx/CLI Guild | Path: src/Cli/StellaOps.Cli | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 30 — VEX Lens | CONCELIER-VEXLENS-30-001 | TODO | Guarantee advisory key consistency and provide cross-links for consensus rationale (VEX Lens). | Concelier WebService Guild, VEX Lens Guild | Path: src/Concelier/StellaOps.Concelier.WebService | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 30 — VEX Lens | EXCITITOR-VULN-29-001 | TODO | Ensure VEX evidence includes issuer hints, signatures, product trees for Lens consumption. | Excititor WebService Guild | Path: src/Excititor/StellaOps.Excititor.WebService | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 30 — VEX Lens | ISSUER-30-001 | TODO | Implement issuer CRUD API with RBAC and audit logs. | Issuer Directory Guild | Path: src/IssuerDirectory/StellaOps.IssuerDirectory | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 30 — VEX Lens | ISSUER-30-002 | TODO | Implement key management endpoints with expiry enforcement. | Issuer Directory & Security Guilds | Path: src/IssuerDirectory/StellaOps.IssuerDirectory | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 30 — VEX Lens | ISSUER-30-003 | TODO | Provide trust weight override APIs with audit trails. | Issuer Directory & Policy Guilds | Path: src/IssuerDirectory/StellaOps.IssuerDirectory | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 30 — VEX Lens | ISSUER-30-004 | TODO | Integrate issuer data into signature verification clients. | Issuer Directory & VEX Lens Guilds | Path: src/IssuerDirectory/StellaOps.IssuerDirectory | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 30 — VEX Lens | ISSUER-30-005 | TODO | Instrument issuer change metrics/logs and dashboards. | Issuer Directory & Observability Guilds | Path: src/IssuerDirectory/StellaOps.IssuerDirectory | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 30 — VEX Lens | ISSUER-30-006 | TODO | Provide deployment/backup/offline docs for Issuer Directory. | Issuer Directory & DevOps Guilds | Path: src/IssuerDirectory/StellaOps.IssuerDirectory | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 30 — VEX Lens | POLICY-ENGINE-30-101 | TODO | Surface trust weighting configuration (issuer weights, modifiers, decay) for VEX Lens via Policy Studio/API. | Policy Guild | Path: src/Policy/StellaOps.Policy.Engine | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 30 — VEX Lens | VEXLENS-30-001 | TODO | Implement VEX normalization pipeline (CSAF, OpenVEX, CycloneDX) with deterministic outputs. | VEX Lens Guild | Path: src/VexLens/StellaOps.VexLens | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 30 — VEX Lens | VEXLENS-30-002 | TODO | Build product mapping library aligning CSAF product trees to purls/versions with scope scoring. | VEX Lens Guild | Path: src/VexLens/StellaOps.VexLens | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 30 — VEX Lens | VEXLENS-30-003 | TODO | Integrate signature verification using issuer keys; annotate evidence. | VEX Lens & Issuer Directory Guilds | Path: src/VexLens/StellaOps.VexLens | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 30 — VEX Lens | VEXLENS-30-004 | TODO | Implement trust weighting functions configurable via policy. | VEX Lens & Policy Guilds | Path: src/VexLens/StellaOps.VexLens | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 30 — VEX Lens | VEXLENS-30-005 | TODO | Implement consensus algorithm producing state, confidence, rationale, and quorum. | VEX Lens Guild | Path: src/VexLens/StellaOps.VexLens | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 30 — VEX Lens | VEXLENS-30-006 | TODO | Materialize consensus projections and change events. | VEX Lens & Findings Ledger Guilds | Path: src/VexLens/StellaOps.VexLens | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 30 — VEX Lens | VEXLENS-30-007 | TODO | Deliver query/detail/simulation/export APIs with budgets and OpenAPI docs. | VEX Lens Guild | Path: src/VexLens/StellaOps.VexLens | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 30 — VEX Lens | VEXLENS-30-008 | TODO | Integrate consensus signals with Policy Engine and Vuln Explorer. | VEX Lens & Policy Guilds | Path: src/VexLens/StellaOps.VexLens | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 30 — VEX Lens | VEXLENS-30-009 | TODO | Instrument metrics/logs/traces; publish dashboards/alerts. | VEX Lens & Observability Guilds | Path: src/VexLens/StellaOps.VexLens | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 30 — VEX Lens | VEXLENS-30-010 | TODO | Build unit/property/integration/load tests and determinism harness. | VEX Lens & QA Guilds | Path: src/VexLens/StellaOps.VexLens | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 30 — VEX Lens | VEXLENS-30-011 | TODO | Provide deployment manifests, scaling guides, offline seeds, runbooks. | VEX Lens & DevOps Guilds | Path: src/VexLens/StellaOps.VexLens | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 30 — VEX Lens | WEB-VEX-30-007 | TODO | Route `/vex/consensus` APIs via gateway with RBAC/ABAC, caching, and telemetry (proxy-only). | BE-Base Platform Guild, VEX Lens Guild | Path: src/Web/StellaOps.Web | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 31 — Advisory AI | DOCS-AIAI-31-001 | TODO | Publish Advisory AI overview doc. | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 31 — Advisory AI | DOCS-AIAI-31-002 | TODO | Publish architecture doc for Advisory AI. | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 31 — Advisory AI | DOCS-AIAI-31-003..009 | TODO | Complete API/Console/CLI/Policy/Security/SBOM/Runbook docs. | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 31 — Advisory AI | DEPLOY-AIAI-31-001 | TODO | Provide Advisory AI deployment/offline guidance. | Deployment Guild | Path: ops/deployment | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 31 — Advisory AI | DEVOPS-AIAI-31-001 | TODO | Provision CI/perf/telemetry for Advisory AI. | DevOps Guild | Path: ops/devops | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 31 — Advisory AI | AIAI-31-001 | TODO | Implement advisory/VEX retrievers with paragraph anchors and citations. | Advisory AI Guild | Path: src/AdvisoryAI/StellaOps.AdvisoryAI | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 31 — Advisory AI | AIAI-31-002 | TODO | Build SBOM context retriever and blast radius estimator. | Advisory AI Guild | Path: src/AdvisoryAI/StellaOps.AdvisoryAI | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 31 — Advisory AI | AIAI-31-003 | TODO | Deliver deterministic toolset (version checks, dependency analysis, policy lookup). | Advisory AI Guild | Path: src/AdvisoryAI/StellaOps.AdvisoryAI | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 31 — Advisory AI | AIAI-31-004 | TODO | Orchestrator with task templates, tool chaining, caching. | Advisory AI Guild | Path: src/AdvisoryAI/StellaOps.AdvisoryAI | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 31 — Advisory AI | AIAI-31-005 | TODO | Guardrails (redaction, injection defense, output validation). | Advisory AI & Security Guilds | Path: src/AdvisoryAI/StellaOps.AdvisoryAI | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 31 — Advisory AI | AIAI-31-006 | TODO | Expose REST/batch APIs with RBAC and OpenAPI. | Advisory AI Guild | Path: src/AdvisoryAI/StellaOps.AdvisoryAI | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 31 — Advisory AI | AIAI-31-007 | TODO | Instrument metrics/logs/traces and dashboards. | Advisory AI & Observability Guilds | Path: src/AdvisoryAI/StellaOps.AdvisoryAI | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 31 — Advisory AI | AIAI-31-008 | TODO | Package inference + deployment manifests/flags. | Advisory AI & DevOps Guilds | Path: src/AdvisoryAI/StellaOps.AdvisoryAI | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 31 — Advisory AI | AIAI-31-009 | TODO | Build golden/injection/perf tests ensuring determinism. | Advisory AI & QA Guilds | Path: src/AdvisoryAI/StellaOps.AdvisoryAI | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 31 — Advisory AI | AUTH-AIAI-31-001 | TODO | Define Advisory AI scopes and remote inference toggles. | Authority Core & Security Guild | Path: src/Authority/StellaOps.Authority | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 31 — Advisory AI | AUTH-AIAI-31-002 | TODO | Enforce prompt logging and consent/audit flows. | Authority Core & Security Guild | Path: src/Authority/StellaOps.Authority | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 31 — Advisory AI | CLI-AIAI-31-001 | TODO | Implement `stella advise *` CLI commands leveraging Advisory AI orchestration and policy scopes. | DevEx/CLI Guild | Path: src/Cli/StellaOps.Cli | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 31 — Advisory AI | CONCELIER-AIAI-31-001 | TODO | Expose advisory chunk API with paragraph anchors. | Concelier WebService Guild | Path: src/Concelier/StellaOps.Concelier.WebService | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 31 — Advisory AI | EXCITITOR-AIAI-31-001 | TODO | Provide VEX chunks with justifications and signatures. | Excititor WebService Guild | Path: src/Excititor/StellaOps.Excititor.WebService | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 31 — Advisory AI | POLICY-ENGINE-31-001 | TODO | Provide policy knobs for Advisory AI. | Policy Guild | Path: src/Policy/StellaOps.Policy.Engine | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 31 — Advisory AI | SBOM-AIAI-31-001 | TODO | Deliver SBOM path/timeline endpoints for Advisory AI. | SBOM Service Guild | Path: src/SbomService/StellaOps.SbomService | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 31 — Advisory AI | VEXLENS-AIAI-31-001 | TODO | Expose enriched rationale API for conflict explanations. | VEX Lens Guild | Path: src/VexLens/StellaOps.VexLens | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 31 — Advisory AI | VEXLENS-AIAI-31-002 | TODO | Provide batching/caching hooks for Advisory AI. | VEX Lens Guild | Path: src/VexLens/StellaOps.VexLens | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 31 — Advisory AI | WEB-AIAI-31-001 | TODO | Route `/advisory/ai/*` APIs with RBAC/telemetry. | BE-Base Platform Guild | Path: src/Web/StellaOps.Web | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 31 — Advisory AI | WEB-AIAI-31-002 | TODO | Provide batch orchestration and retry handling for Advisory AI. | BE-Base Platform Guild | Path: src/Web/StellaOps.Web | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 31 — Advisory AI | WEB-AIAI-31-003 | TODO | Emit Advisory AI gateway telemetry/audit logs. | BE-Base Platform Guild | Path: src/Web/StellaOps.Web | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 32 — Orchestrator Dashboard | DOCS-ORCH-32-001 | TODO | Author `/docs/orchestrator/overview.md` covering mission, roles, AOC alignment, and imposed rule reminder. | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 32 — Orchestrator Dashboard | DOCS-ORCH-32-002 | TODO | Author `/docs/orchestrator/architecture.md` detailing scheduler, DAGs, rate limits, and data model. | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 32 — Orchestrator Dashboard | DEVOPS-ORCH-32-001 | TODO | Provision staging Postgres/message-bus charts, CI smoke deploy, and baseline dashboards for queue depth and inflight jobs. | DevOps Guild | Path: ops/devops | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 32 — Orchestrator Dashboard | AUTH-ORCH-32-001 | TODO | Introduce `orch:read` scope and `Orch.Viewer` role with metadata, discovery docs, and offline defaults. | Authority Core & Security Guild | Path: src/Authority/StellaOps.Authority | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 32 — Orchestrator Dashboard | CONCELIER-ORCH-32-001 | TODO | Register Concelier sources with orchestrator, publish schedules/rate policies, and seed metadata. | Concelier Core Guild | Path: src/Concelier/__Libraries/StellaOps.Concelier.Core | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 32 — Orchestrator Dashboard | CONCELIER-ORCH-32-002 | TODO | Embed worker SDK into Concelier ingestion loops emitting progress, heartbeats, and artifact hashes. | Concelier Core Guild | Path: src/Concelier/__Libraries/StellaOps.Concelier.Core | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 32 — Orchestrator Dashboard | EXCITITOR-ORCH-32-001 | TODO | Adopt worker SDK in Excititor worker with job claim/heartbeat and artifact summary emission. | Excititor Worker Guild | Path: src/Excititor/StellaOps.Excititor.Worker | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 32 — Orchestrator Dashboard | WORKER-GO-32-001 | TODO | Bootstrap Go worker SDK (client config, job claim, acknowledgement flow) with integration tests. | Worker SDK Guild | Path: src/Orchestrator/StellaOps.Orchestrator.WorkerSdk.Go | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 32 — Orchestrator Dashboard | WORKER-GO-32-002 | TODO | Add heartbeat/progress helpers, structured logging, and default metrics exporters to Go SDK. | Worker SDK Guild | Path: src/Orchestrator/StellaOps.Orchestrator.WorkerSdk.Go | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 32 — Orchestrator Dashboard | WORKER-PY-32-001 | TODO | Bootstrap Python async SDK with job claim/config adapters and sample worker. | Worker SDK Guild | Path: src/Orchestrator/StellaOps.Orchestrator.WorkerSdk.Python | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 32 — Orchestrator Dashboard | WORKER-PY-32-002 | TODO | Implement heartbeat/progress helpers and logging/metrics instrumentation for Python workers. | Worker SDK Guild | Path: src/Orchestrator/StellaOps.Orchestrator.WorkerSdk.Python | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 32 — Orchestrator Dashboard | ORCH-SVC-32-001 | TODO | Bootstrap orchestrator service with Postgres schema/migrations for sources, runs, jobs, dag_edges, artifacts, quotas, schedules. | Orchestrator Service Guild | Path: src/Orchestrator/StellaOps.Orchestrator | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 32 — Orchestrator Dashboard | ORCH-SVC-32-002 | TODO | Implement scheduler DAG planner, dependency resolver, and job state machine for read-only tracking. | Orchestrator Service Guild | Path: src/Orchestrator/StellaOps.Orchestrator | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 32 — Orchestrator Dashboard | ORCH-SVC-32-003 | TODO | Expose read-only REST APIs (sources, runs, jobs, DAG) with OpenAPI + validation. | Orchestrator Service Guild | Path: src/Orchestrator/StellaOps.Orchestrator | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 32 — Orchestrator Dashboard | ORCH-SVC-32-004 | TODO | Ship WebSocket/SSE live update stream and metrics counters/histograms for job lifecycle. | Orchestrator Service Guild | Path: src/Orchestrator/StellaOps.Orchestrator | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 32 — Orchestrator Dashboard | ORCH-SVC-32-005 | TODO | Deliver worker claim/heartbeat/progress endpoints capturing artifact metadata and checksums. | Orchestrator Service Guild | Path: src/Orchestrator/StellaOps.Orchestrator | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 32 — Orchestrator Dashboard | POLICY-ENGINE-32-101 | TODO | Define orchestrator `policy_eval` job contract, idempotency keys, and enqueue hooks for change events. | Policy Guild | Path: src/Policy/StellaOps.Policy.Engine | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 32 — Orchestrator Dashboard | SBOM-ORCH-32-001 | TODO | Integrate orchestrator job IDs into SBOM ingest/index pipelines with artifact hashing and status updates. | SBOM Service Guild | Path: src/SbomService/StellaOps.SbomService | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 32 — Orchestrator Dashboard | WEB-ORCH-32-001 | TODO | Expose read-only orchestrator APIs via gateway with tenant scoping, caching headers, and rate limits. | BE-Base Platform Guild | Path: src/Web/StellaOps.Web | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 33 — Orchestrator Dashboard | DOCS-ORCH-33-001 | TODO | Author `/docs/orchestrator/api.md` with endpoints, WebSocket events, error codes, and imposed rule reminder. | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 33 — Orchestrator Dashboard | DOCS-ORCH-33-002 | TODO | Author `/docs/orchestrator/console.md` covering screens, accessibility, and live updates. | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 33 — Orchestrator Dashboard | DOCS-ORCH-33-003 | TODO | Author `/docs/orchestrator/cli.md` with command reference, examples, and exit codes. | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 33 — Governance & Rules | DEVOPS-RULES-33-001 | REVIEW (2025-10-30) | Contracts & Rules anchor (gateway proxy-only; Policy Engine overlays/simulations; AOC ingestion canonicalization; Graph Indexer + Graph API as sole platform). | DevOps Guild, Platform Leads | Path: ops/devops | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 33 — Orchestrator Dashboard | DEVOPS-ORCH-33-001 | TODO | Publish Grafana dashboards for rate-limit/backpressure/error clustering and configure alert rules with runbooks. | DevOps Guild | Path: ops/devops | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 33 — Orchestrator Dashboard | AUTH-ORCH-33-001 | TODO | Add `Orch.Operator` role, control action scopes, and enforce reason/ticket field capture. | Authority Core & Security Guild | Path: src/Authority/StellaOps.Authority | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 33 — Orchestrator Dashboard | CONCELIER-ORCH-33-001 | TODO | Wire orchestrator control hooks (pause, throttle, retry) into Concelier workers with safe checkpoints. | Concelier Core Guild | Path: src/Concelier/__Libraries/StellaOps.Concelier.Core | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 33 — Orchestrator Dashboard | EXCITITOR-ORCH-33-001 | TODO | Honor orchestrator throttles, classify VEX errors, and emit retry-safe checkpoints in Excititor worker. | Excititor Worker Guild | Path: src/Excititor/StellaOps.Excititor.Worker | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 33 — Orchestrator Dashboard | WORKER-GO-33-001 | TODO | Add artifact upload helpers (object store + checksum) and idempotency guard to Go SDK. | Worker SDK Guild | Path: src/Orchestrator/StellaOps.Orchestrator.WorkerSdk.Go | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 33 — Orchestrator Dashboard | WORKER-GO-33-002 | TODO | Implement error classification/retry helper and structured failure report in Go SDK. | Worker SDK Guild | Path: src/Orchestrator/StellaOps.Orchestrator.WorkerSdk.Go | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 33 — Orchestrator Dashboard | WORKER-PY-33-001 | TODO | Add artifact publish/idempotency features to Python SDK with object store integration. | Worker SDK Guild | Path: src/Orchestrator/StellaOps.Orchestrator.WorkerSdk.Python | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 33 — Orchestrator Dashboard | WORKER-PY-33-002 | TODO | Expose error classification/retry/backoff helpers in Python SDK with structured logging. | Worker SDK Guild | Path: src/Orchestrator/StellaOps.Orchestrator.WorkerSdk.Python | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 33 — Orchestrator Dashboard | ORCH-SVC-33-001 | TODO | Enable source/job control actions (test, pause/resume, retry/cancel/prioritize) with RBAC and audit hooks. | Orchestrator Service Guild | Path: src/Orchestrator/StellaOps.Orchestrator | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 33 — Orchestrator Dashboard | ORCH-SVC-33-002 | TODO | Implement adaptive token-bucket rate limiter and concurrency caps reacting to upstream 429/503 signals. | Orchestrator Service Guild | Path: src/Orchestrator/StellaOps.Orchestrator | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 33 — Orchestrator Dashboard | ORCH-SVC-33-003 | TODO | Add watermark/backfill manager with event-time windows, duplicate suppression, and preview API. | Orchestrator Service Guild | Path: src/Orchestrator/StellaOps.Orchestrator | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 33 — Orchestrator Dashboard | ORCH-SVC-33-004 | TODO | Deliver dead-letter storage, replay endpoints, and surfaced error classes with remediation hints. | Orchestrator Service Guild | Path: src/Orchestrator/StellaOps.Orchestrator | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 33 — Orchestrator Dashboard | POLICY-ENGINE-33-101 | TODO | Implement orchestrator-driven policy evaluation workers with heartbeats, SLO metrics, and rate limit awareness. | Policy Guild | Path: src/Policy/StellaOps.Policy.Engine | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 33 — Orchestrator Dashboard | SBOM-ORCH-33-001 | TODO | Report SBOM ingest backpressure metrics and support orchestrator pause/resume/backfill signals. | SBOM Service Guild | Path: src/SbomService/StellaOps.SbomService | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 33 — Orchestrator Dashboard | VEXLENS-ORCH-33-001 | TODO | Expose `consensus_compute` orchestrator job type and integrate VEX Lens worker for diff batches. | VEX Lens Guild | Path: src/VexLens/StellaOps.VexLens | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 33 — Orchestrator Dashboard | WEB-ORCH-33-001 | TODO | Add control endpoints (actions/backfill) and SSE bridging with permission checks and error mapping. | BE-Base Platform Guild | Path: src/Web/StellaOps.Web | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 34 — Orchestrator Dashboard | DOCS-ORCH-34-001 | TODO | Author `/docs/orchestrator/run-ledger.md` describing provenance export format and audits. | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 34 — Orchestrator Dashboard | DOCS-ORCH-34-002 | TODO | Author `/docs/security/secrets-handling.md` covering KMS refs, redaction, and operator hygiene. | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 34 — Orchestrator Dashboard | DOCS-ORCH-34-003 | TODO | Author `/docs/operations/orchestrator-runbook.md` (failures, backfill guide, circuit breakers). | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 34 — Orchestrator Dashboard | DOCS-ORCH-34-004 | TODO | Author `/docs/schemas/artifacts.md` detailing artifact kinds, schema versions, hashing, storage layout. | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 34 — Orchestrator Dashboard | DOCS-ORCH-34-005 | TODO | Author `/docs/slo/orchestrator-slo.md` defining SLOs, burn alerts, and measurement strategy. | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 34 — Orchestrator Dashboard | DEPLOY-ORCH-34-001 | TODO | Provide Helm/Compose manifests, scaling defaults, and offline kit instructions for orchestrator service. | Deployment Guild | Path: ops/deployment | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 34 — Orchestrator Dashboard | DEVOPS-ORCH-34-001 | TODO | Harden production dashboards/alerts, synthetic probes, and incident response playbooks for orchestrator. | DevOps Guild | Path: ops/devops | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 34 — Orchestrator Dashboard | DEVOPS-OFFLINE-34-006 | TODO | Bundle orchestrator service, worker SDK samples, and Postgres snapshot into Offline Kit with integrity checks. | Offline Kit Guild | Path: ops/offline-kit | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 34 — Orchestrator Dashboard | AUTH-ORCH-34-001 | TODO | Add `Orch.Admin` role for quotas/backfills, enforce audit reason requirements, update docs and offline defaults. | Authority Core & Security Guild | Path: src/Authority/StellaOps.Authority | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 34 — Orchestrator Dashboard | CLI-ORCH-34-001 | TODO | Implement backfill wizard and quota management commands with dry-run preview and guardrails. | DevEx/CLI Guild | Path: src/Cli/StellaOps.Cli | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 34 — Orchestrator Dashboard | CONCELIER-ORCH-34-001 | TODO | Implement orchestrator-driven backfills for advisory sources with idempotent artifact reuse and ledger linkage. | Concelier Core Guild | Path: src/Concelier/__Libraries/StellaOps.Concelier.Core | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 34 — Orchestrator Dashboard | EXCITITOR-ORCH-34-001 | TODO | Support orchestrator backfills and circuit breaker resets for Excititor sources with auditing. | Excititor Worker Guild | Path: src/Excititor/StellaOps.Excititor.Worker | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 34 — Orchestrator Dashboard | LEDGER-34-101 | TODO | Link orchestrator run ledger entries into Findings Ledger provenance export and audit queries. | Findings Ledger Guild | Path: src/Findings/StellaOps.Findings.Ledger | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 34 — Orchestrator Dashboard | WORKER-GO-34-001 | TODO | Add backfill range execution, watermark handshake, and artifact dedupe verification to Go SDK. | Worker SDK Guild | Path: src/Orchestrator/StellaOps.Orchestrator.WorkerSdk.Go | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 34 — Orchestrator Dashboard | WORKER-PY-34-001 | TODO | Add backfill support and deterministic artifact dedupe validation to Python SDK. | Worker SDK Guild | Path: src/Orchestrator/StellaOps.Orchestrator.WorkerSdk.Python | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 34 — Orchestrator Dashboard | ORCH-SVC-34-001 | TODO | Implement quota management APIs, SLO burn-rate computation, and alert budget tracking. | Orchestrator Service Guild | Path: src/Orchestrator/StellaOps.Orchestrator | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 34 — Orchestrator Dashboard | ORCH-SVC-34-002 | TODO | Build audit log and immutable run ledger export with signed manifest support. | Orchestrator Service Guild | Path: src/Orchestrator/StellaOps.Orchestrator | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 34 — Orchestrator Dashboard | ORCH-SVC-34-003 | TODO | Run perf/scale validation (10k jobs, dispatch <150 ms) and add autoscaling hooks. | Orchestrator Service Guild | Path: src/Orchestrator/StellaOps.Orchestrator | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 34 — Orchestrator Dashboard | ORCH-SVC-34-004 | TODO | Package orchestrator container, Helm overlays, offline bundle seeds, and provenance attestations. | Orchestrator Service Guild | Path: src/Orchestrator/StellaOps.Orchestrator | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 34 — Orchestrator Dashboard | POLICY-ENGINE-34-101 | TODO | Expose policy eval run ledger exports and SLO burn metrics to orchestrator. | Policy Guild | Path: src/Policy/StellaOps.Policy.Engine | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 34 — Orchestrator Dashboard | SBOM-ORCH-34-001 | TODO | Enable SBOM backfill and watermark reconciliation; emit coverage metrics and flood guard. | SBOM Service Guild | Path: src/SbomService/StellaOps.SbomService | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 34 — Orchestrator Dashboard | VEXLENS-ORCH-34-001 | TODO | Integrate consensus compute completion events with orchestrator ledger and provenance outputs. | VEX Lens Guild | Path: src/VexLens/StellaOps.VexLens | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 34 — Orchestrator Dashboard | WEB-ORCH-34-001 | TODO | Expose quotas/backfill/queue metrics endpoints, throttle toggles, and error clustering APIs. | BE-Base Platform Guild | Path: src/Web/StellaOps.Web | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 35 — EPDR Foundations | SCANNER-ANALYZERS-LANG-11-001 | TODO | Build entrypoint resolver (identity + environment profiles) and emit normalized entrypoint records. | Scanner EPDR Guild | Path: src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.DotNet | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 35 — EPDR Foundations | SCANNER-ANALYZERS-LANG-11-002 | TODO | Static IL/reflection/ALC heuristics producing dependency edges with reason codes and confidence. | Scanner EPDR Guild | Path: src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.DotNet | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 35 — EPDR Foundations | SCANNER-ANALYZERS-LANG-11-003 | TODO | Runtime loader/PInvoke signal ingestion merged with static/declared edges (confidence & explain). | Scanner EPDR Guild, Signals Guild | Path: src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.DotNet | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 35 — Export Center Phase 1 | DOCS-EXPORT-35-001 | TODO | Author `/docs/modules/export-center/overview.md` with purpose, profiles, security, and imposed rule reminder. | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 35 — Export Center Phase 1 | DOCS-EXPORT-35-002 | TODO | Author `/docs/modules/export-center/architecture.md` detailing service components, adapters, manifests, signing, and distribution. | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 35 — Export Center Phase 1 | DOCS-EXPORT-35-003 | TODO | Publish `/docs/modules/export-center/profiles.md` covering schemas, examples, and compatibility. | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 35 — Export Center Phase 1 | DEPLOY-EXPORT-35-001 | TODO | Package exporter service/worker containers, Helm overlays (download-only), and rollout guide. | Deployment Guild | Path: ops/deployment | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 35 — Export Center Phase 1 | DEVOPS-EXPORT-35-001 | TODO | Create exporter CI pipeline (lint/test/perf smoke), object storage fixtures, and initial Grafana dashboards. | DevOps Guild | Path: ops/devops | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 35 — Export Center Phase 1 | EXPORT-SVC-35-001 | TODO | Bootstrap exporter service, configuration, and migrations for export profiles/runs/inputs/distributions with tenant scopes. | Exporter Service Guild | Path: src/ExportCenter/StellaOps.ExportCenter | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 35 — Export Center Phase 1 | EXPORT-SVC-35-002 | TODO | Implement planner resolving filters to iterators and orchestrator job contract with deterministic sampling. | Exporter Service Guild | Path: src/ExportCenter/StellaOps.ExportCenter | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 35 — Export Center Phase 1 | EXPORT-SVC-35-003 | TODO | Deliver JSON adapters (raw/policy) with canonical normalization, redaction enforcement, and zstd writers. | Exporter Service Guild | Path: src/ExportCenter/StellaOps.ExportCenter | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 35 — Export Center Phase 1 | EXPORT-SVC-35-004 | TODO | Build mirror (full) adapter producing filesystem layout, manifests, and bundle assembly for download profile. | Exporter Service Guild | Path: src/ExportCenter/StellaOps.ExportCenter | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 35 — Export Center Phase 1 | EXPORT-SVC-35-005 | TODO | Implement manifest/provenance writer and KMS signing/attestation for export bundles. | Exporter Service Guild | Path: src/ExportCenter/StellaOps.ExportCenter | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 35 — Export Center Phase 1 | EXPORT-SVC-35-006 | TODO | Expose Export API (profiles, runs, download) with SSE updates, concurrency controls, and audit logging. | Exporter Service Guild | Path: src/ExportCenter/StellaOps.ExportCenter | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 35 — Export Center Phase 1 | LEDGER-EXPORT-35-001 | TODO | Provide paginated streaming endpoints for advisories, VEX, SBOMs, and findings filtered by scope selectors. | Findings Ledger Guild | Path: src/Findings/StellaOps.Findings.Ledger | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 35 — Export Center Phase 1 | ORCH-SVC-35-101 | TODO | Register export job type, quotas, and rate policies; surface export job telemetry for scheduler. | Orchestrator Service Guild | Path: src/Orchestrator/StellaOps.Orchestrator | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 35 — Export Center Phase 1 | POLICY-ENGINE-35-201 | TODO | Expose deterministic policy snapshot + evaluated findings endpoint aligned with Export Center requirements. | Policy Guild | Path: src/Policy/StellaOps.Policy.Engine | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 35 — Export Center Phase 1 | VEXLENS-EXPORT-35-001 | TODO | Publish consensus snapshot API delivering deterministic JSON for export consumption. | VEX Lens Guild | Path: src/VexLens/StellaOps.VexLens | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 35 — Export Center Phase 1 | WEB-EXPORT-35-001 | TODO | Route Export Center APIs through gateway with tenant scoping, viewer/operator scopes, and streaming downloads. | BE-Base Platform Guild | Path: src/Web/StellaOps.Web | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 36 — EPDR Observations | SCANNER-ANALYZERS-LANG-11-004 | TODO | Normalize EPDR output to Scanner observation writer (entrypoints + edges + env profiles). | Scanner EPDR Guild, SBOM Service Guild | Path: src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.DotNet | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 36 — EPDR Observations | SCANNER-ANALYZERS-LANG-11-005 | TODO | End-to-end fixtures/benchmarks covering publish modes, RIDs, trimming, NativeAOT with explain traces. | Scanner EPDR Guild, QA Guild | Path: src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.DotNet | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 36 — Export Center Phase 2 | DOCS-EXPORT-36-004 | TODO | Author `/docs/modules/export-center/api.md` with endpoint examples and imposed rule note. | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 36 — Export Center Phase 2 | DOCS-EXPORT-36-005 | TODO | Publish `/docs/modules/export-center/cli.md` covering commands, scripts, verification, and imposed rule reminder. | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 36 — Export Center Phase 2 | DOCS-EXPORT-36-006 | TODO | Write `/docs/modules/export-center/trivy-adapter.md` detailing mappings, compatibility, and test matrix. | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 36 — Export Center Phase 2 | DEPLOY-EXPORT-36-001 | TODO | Document registry credentials, OCI push workflows, and automation for export distributions. | Deployment Guild | Path: ops/deployment | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 36 — Export Center Phase 2 | DEVOPS-EXPORT-36-001 | TODO | Integrate Trivy compatibility validation, OCI push smoke tests, and metrics dashboards for export throughput. | DevOps Guild | Path: ops/devops | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 36 — Export Center Phase 2 | CLI-EXPORT-36-001 | TODO | Add `stella export distribute` (OCI/objstore), `run download --resume`, and status polling enhancements. | DevEx/CLI Guild | Path: src/Cli/StellaOps.Cli | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 36 — Export Center Phase 2 | EXPORT-SVC-36-001 | TODO | Implement Trivy DB adapter (core) with schema mapping, validation, and compatibility gating. | Exporter Service Guild | Path: src/ExportCenter/StellaOps.ExportCenter | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 36 — Export Center Phase 2 | EXPORT-SVC-36-002 | TODO | Add Trivy Java DB variant, shared manifest entries, and adapter regression tests. | Exporter Service Guild | Path: src/ExportCenter/StellaOps.ExportCenter | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 36 — Export Center Phase 2 | EXPORT-SVC-36-003 | TODO | Build OCI distribution engine for exports with descriptor annotations and registry auth handling. | Exporter Service Guild | Path: src/ExportCenter/StellaOps.ExportCenter | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 36 — Export Center Phase 2 | EXPORT-SVC-36-004 | TODO | Extend planner/run lifecycle for OCI/object storage distributions with retry + idempotency. | Exporter Service Guild | Path: src/ExportCenter/StellaOps.ExportCenter | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 36 — Export Center Phase 2 | ORCH-SVC-36-101 | TODO | Add distribution job follow-ups, retention metadata, and metrics for export runs. | Orchestrator Service Guild | Path: src/Orchestrator/StellaOps.Orchestrator | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 36 — Export Center Phase 2 | WEB-EXPORT-36-001 | TODO | Expose distribution endpoints (OCI/object storage) and manifest/provenance download proxies with RBAC. | BE-Base Platform Guild | Path: src/Web/StellaOps.Web | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 37 — Export Center Phase 3 | DOCS-EXPORT-37-001 | TODO | Publish `/docs/modules/export-center/mirror-bundles.md` detailing layouts, deltas, encryption, imposed rule reminder. | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 37 — Export Center Phase 3 | DOCS-EXPORT-37-002 | TODO | Publish `/docs/modules/export-center/provenance-and-signing.md` covering manifests, attestation, verification. | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 37 — Export Center Phase 3 | DOCS-EXPORT-37-003 | TODO | Publish `/docs/operations/export-runbook.md` for failures, tuning, capacity, with imposed rule note. | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 37 — Export Center Phase 3 | DOCS-EXPORT-37-004 | TODO | Publish `/docs/security/export-hardening.md` covering RBAC, isolation, encryption, and imposed rule. | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 37 — Export Center Phase 3 | DEVOPS-EXPORT-37-001 | TODO | Finalize dashboards/alerts for exports (failure, verify), retention jobs, and chaos testing harness. | DevOps Guild | Path: ops/devops | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 37 — Export Center Phase 3 | DEVOPS-OFFLINE-37-001 | TODO | Package Export Center mirror bundles + verification tooling into Offline Kit with manifest/signature updates. | Offline Kit Guild | Path: ops/offline-kit | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 37 — Export Center Phase 3 | AUTH-EXPORT-37-001 | TODO | Add `Export.Admin` scope enforcement for retention, encryption keys, and scheduling APIs. | Authority Core & Security Guild | Path: src/Authority/StellaOps.Authority | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 37 — Export Center Phase 3 | CLI-EXPORT-37-001 | TODO | Implement `stella export schedule`, `run verify`, and bundle verification tooling with signature/hash checks. | DevEx/CLI Guild | Path: src/Cli/StellaOps.Cli | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 37 — Export Center Phase 3 | EXPORT-SVC-37-001 | TODO | Implement mirror delta adapter, base export linkage, and content-addressed reuse. | Exporter Service Guild | Path: src/ExportCenter/StellaOps.ExportCenter | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 37 — Export Center Phase 3 | EXPORT-SVC-37-002 | TODO | Add bundle encryption, key wrapping with KMS, and verification tooling for encrypted exports. | Exporter Service Guild | Path: src/ExportCenter/StellaOps.ExportCenter | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 37 — Export Center Phase 3 | EXPORT-SVC-37-003 | TODO | Deliver scheduling/retention engine (cron/event triggers), audit trails, and retry idempotency enhancements. | Exporter Service Guild | Path: src/ExportCenter/StellaOps.ExportCenter | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 37 — Export Center Phase 3 | EXPORT-SVC-37-004 | TODO | Provide export verification API and CLI integration, including hash/signature validation endpoints. | Exporter Service Guild | Path: src/ExportCenter/StellaOps.ExportCenter | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 37 — Export Center Phase 3 | ORCH-SVC-37-101 | TODO | Enable scheduled export runs, retention pruning hooks, and failure alerting integration. | Orchestrator Service Guild | Path: src/Orchestrator/StellaOps.Orchestrator | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 37 — Export Center Phase 3 | WEB-EXPORT-37-001 | TODO | Surface scheduling, retention, and verification endpoints plus encryption parameter handling. | BE-Base Platform Guild | Path: src/Web/StellaOps.Web | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 37 — Native Analyzer Core | SCANNER-ANALYZERS-NATIVE-20-001 | TODO | Format detector & binary identity for ELF/PE/Mach-O (multi-slice) with stable entrypoint IDs. | Native Analyzer Guild | Path: src/Scanner/StellaOps.Scanner.Analyzers.Native | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 37 — Native Analyzer Core | SCANNER-ANALYZERS-NATIVE-20-002 | TODO | ELF dynamic parser emitting dtneeded edges, runpath metadata, symbol version needs. | Native Analyzer Guild | Path: src/Scanner/StellaOps.Scanner.Analyzers.Native | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 37 — Native Analyzer Core | SCANNER-ANALYZERS-NATIVE-20-003 | TODO | PE import + delay-load + SxS manifest parsing producing reason-coded edges. | Native Analyzer Guild | Path: src/Scanner/StellaOps.Scanner.Analyzers.Native | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 37 — Native Analyzer Core | SCANNER-ANALYZERS-NATIVE-20-004 | TODO | Mach-O load command parsing with @rpath expansion and slice handling. | Native Analyzer Guild | Path: src/Scanner/StellaOps.Scanner.Analyzers.Native | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 37 — Native Analyzer Core | SCANNER-ANALYZERS-NATIVE-20-005 | TODO | Cross-platform resolver engine modeling search order/explain traces for ELF/PE/Mach-O. | Native Analyzer Guild | Path: src/Scanner/StellaOps.Scanner.Analyzers.Native | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 37 — Native Analyzer Core | SCANNER-ANALYZERS-NATIVE-20-006 | TODO | Heuristic scanner for dlopen/LoadLibrary strings, plugin configs, ecosystem hints with confidence tags. | Native Analyzer Guild | Path: src/Scanner/StellaOps.Scanner.Analyzers.Native | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 38 — Native Observation Pipeline | SCANNER-ANALYZERS-NATIVE-20-007 | TODO | Serialize entrypoints/edges/env profiles to Scanner writer (AOC-compliant observations). | Native Analyzer Guild | Path: src/Scanner/StellaOps.Scanner.Analyzers.Native | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 38 — Native Observation Pipeline | SCANNER-ANALYZERS-NATIVE-20-008 | TODO | Fixture suite + determinism benchmarks for native analyzer across linux/windows/macos. | Native Analyzer Guild, QA Guild | Path: src/Scanner/StellaOps.Scanner.Analyzers.Native | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 38 — Native Observation Pipeline | SCANNER-ANALYZERS-NATIVE-20-009 | TODO | Optional runtime capture adapters (eBPF/ETW/dyld) producing runtime-load edges with redaction. | Native Analyzer Guild, Signals Guild | Path: src/Scanner/StellaOps.Scanner.Analyzers.Native | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 38 — Native Observation Pipeline | SCANNER-ANALYZERS-NATIVE-20-010 | TODO | Package native analyzer plug-in + Offline Kit updates and restart-time loading. | Native Analyzer Guild, DevOps Guild | Path: src/Scanner/StellaOps.Scanner.Analyzers.Native | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 38 — Notifications Studio Phase 1 | DOCS-NOTIFY-38-001 | TODO | Publish `/docs/notifications/overview.md` and `/docs/notifications/architecture.md` ending with imposed rule statement. | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 38 — Notifications Studio Phase 1 | DEPLOY-NOTIFY-38-001 | TODO | Package notifier API/worker Helm overlays (email/chat/webhook), secrets templates, rollout guide. | Deployment Guild | Path: ops/deployment | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 38 — Notifications Studio Phase 1 | DEVOPS-NOTIFY-38-001 | TODO | Stand up notifier CI pipelines, event bus fixtures, base dashboards for events/notifications latency. | DevOps Guild | Path: ops/devops | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 38 — Notifications Studio Phase 1 | CLI-NOTIFY-38-001 | TODO | Implement `stella notify` rule/template/incident commands (list/create/test/ack) with file-based inputs. | DevEx/CLI Guild | Path: src/Cli/StellaOps.Cli | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 38 — Notifications Studio Phase 1 | NOTIFY-SVC-38-001 | TODO | Bootstrap notifier service, migrations for notif tables, event ingestion, and rule engine foundation (policy violations + job failures). | Notifications Service Guild | Path: src/Notifier/StellaOps.Notifier | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 38 — Notifications Studio Phase 1 | NOTIFY-SVC-38-002 | TODO | Implement channel adapters (email, chat-webhook, generic webhook) with retry and audit logging. | Notifications Service Guild | Path: src/Notifier/StellaOps.Notifier | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 38 — Notifications Studio Phase 1 | NOTIFY-SVC-38-003 | TODO | Deliver template service (versioning, preview), rendering pipeline with redaction, and provenance links. | Notifications Service Guild | Path: src/Notifier/StellaOps.Notifier | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 38 — Notifications Studio Phase 1 | NOTIFY-SVC-38-004 | TODO | Expose initial API (rules CRUD, templates, incidents list, ack) and live feed WS stream. | Notifications Service Guild | Path: src/Notifier/StellaOps.Notifier | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 38 — Notifications Studio Phase 1 | ORCH-SVC-38-101 | TODO | Standardize event envelope publication (policy/export/job lifecycle) with idempotency keys for notifier ingestion. | Orchestrator Service Guild | Path: src/Orchestrator/StellaOps.Orchestrator | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 38 — Notifications Studio Phase 1 | POLICY-ENGINE-38-201 | TODO | Emit enriched violation events including rationale IDs via orchestrator bus. | Policy Guild | Path: src/Policy/StellaOps.Policy.Engine | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 38 — Notifications Studio Phase 1 | WEB-NOTIFY-38-001 | TODO | Route notifier APIs through gateway with tenant scoping and operator scopes. | BE-Base Platform Guild | Path: src/Web/StellaOps.Web | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 39 — Java Analyzer Core | SCANNER-ANALYZERS-JAVA-21-001 | TODO | Java input normalizer (jar/war/ear/fat/jmod/jimage) with MR overlay selection. | Java Analyzer Guild | Path: src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Java | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 39 — Java Analyzer Core | SCANNER-ANALYZERS-JAVA-21-002 | TODO | Module/classpath builder with duplicate & split-package detection. | Java Analyzer Guild | Path: src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Java | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 39 — Java Analyzer Core | SCANNER-ANALYZERS-JAVA-21-003 | TODO | SPI scanner & provider selection with warnings. | Java Analyzer Guild | Path: src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Java | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 39 — Java Analyzer Core | SCANNER-ANALYZERS-JAVA-21-004 | DONE | Reflection/TCCL heuristics emitting reason-coded edges. | Java Analyzer Guild | Path: src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Java | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 39 — Java Analyzer Core | SCANNER-ANALYZERS-JAVA-21-005 | TODO | Framework config extraction (Spring, Jakarta, MicroProfile, logging, Graal configs). | Java Analyzer Guild | Path: src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Java | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 39 — Java Analyzer Core | SCANNER-ANALYZERS-JAVA-21-006 | TODO | JNI/native hint detection for Java artifacts. | Java Analyzer Guild | Path: src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Java | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 39 — Java Analyzer Core | SCANNER-ANALYZERS-JAVA-21-007 | TODO | Manifest/signature metadata collector (main/start/agent classes, signers). | Java Analyzer Guild | Path: src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Java | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 39 — Notifications Studio Phase 2 | DOCS-NOTIFY-39-002 | TODO | Publish `/docs/notifications/rules.md`, `/templates.md`, `/digests.md` with imposed rule reminder. | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 39 — Notifications Studio Phase 2 | DEVOPS-NOTIFY-39-002 | TODO | Add throttling/quiet-hours dashboards, digest job monitoring, and storm breaker alerts. | DevOps Guild | Path: ops/devops | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 39 — Notifications Studio Phase 2 | CLI-NOTIFY-39-001 | TODO | Add simulation/digest CLI verbs and advanced filtering for incidents. | DevEx/CLI Guild | Path: src/Cli/StellaOps.Cli | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 39 — Notifications Studio Phase 2 | LEDGER-NOTIFY-39-001 | TODO | Optimize digest queries and provide API for notifier to fetch unresolved policy violations/SBOM deltas. | Findings Ledger Guild | Path: src/Findings/StellaOps.Findings.Ledger | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 39 — Notifications Studio Phase 2 | NOTIFY-SVC-39-001 | TODO | Implement correlation engine, throttling, quiet hours/maintenance evaluator, and incident state machine. | Notifications Service Guild | Path: src/Notifier/StellaOps.Notifier | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 39 — Notifications Studio Phase 2 | NOTIFY-SVC-39-002 | TODO | Add digests generator with Findings Ledger queries and distribution (email/chat). | Notifications Service Guild | Path: src/Notifier/StellaOps.Notifier | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 39 — Notifications Studio Phase 2 | NOTIFY-SVC-39-003 | TODO | Provide simulation engine and API for rule dry-run against historical events. | Notifications Service Guild | Path: src/Notifier/StellaOps.Notifier | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 39 — Notifications Studio Phase 2 | NOTIFY-SVC-39-004 | TODO | Integrate quiet hours calendars and default throttles with audit logging. | Notifications Service Guild | Path: src/Notifier/StellaOps.Notifier | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 39 — Notifications Studio Phase 2 | WEB-NOTIFY-39-001 | TODO | Surface digest scheduling, simulation, and throttle management endpoints via gateway. | BE-Base Platform Guild | Path: src/Web/StellaOps.Web | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 40 — Java Observation & Runtime | SCANNER-ANALYZERS-JAVA-21-008 | TODO | Observation writer producing entrypoints/components/edges with warnings. | Java Analyzer Guild | Path: src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Java | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 40 — Java Observation & Runtime | SCANNER-ANALYZERS-JAVA-21-009 | TODO | Fixture suite + determinism/perf benchmarks for Java analyzer. | Java Analyzer Guild, QA Guild | Path: src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Java | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 40 — Java Observation & Runtime | SCANNER-ANALYZERS-JAVA-21-010 | TODO | Optional runtime ingestion via agent/JFR producing runtime edges. | Java Analyzer Guild, Signals Guild | Path: src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Java | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 40 — Java Observation & Runtime | SCANNER-ANALYZERS-JAVA-21-011 | TODO | Package Java analyzer plug-in + Offline Kit/CLI updates. | Java Analyzer Guild, DevOps Guild | Path: src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Java | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 40 — Notifications Studio Phase 3 | DOCS-NOTIFY-40-001 | TODO | Publish `/docs/notifications/channels.md`, `/escalations.md`, `/api.md`, `/operations/notifier-runbook.md`, `/security/notifications-hardening.md` with imposed rule lines. | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 40 — Notifications Studio Phase 3 | DEPLOY-NOTIFY-40-001 | TODO | Package notifier escalations + localization deployment overlays, signed ack token rotation scripts, and rollback guidance. | Deployment Guild | Path: ops/deployment | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 40 — Notifications Studio Phase 3 | DEVOPS-NOTIFY-40-001 | TODO | Finalize notifier dashboards/alerts (escalation failures, ack latency), chaos testing harness, and channel health monitoring. | DevOps Guild | Path: ops/devops | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 40 — Notifications Studio Phase 3 | DEVOPS-OFFLINE-37-002 | CARRY (no scope change) | Carry from Sprint 37: Notifier offline packs (sample configs, template/digest packs, dry-run harness) with integrity checks. | Offline Kit Guild | Path: ops/offline-kit | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 40 — Notifications Studio Phase 3 | AUTH-NOTIFY-40-001 | TODO | Enforce ack token signing/rotation, webhook allowlists, and admin-only escalation settings. | Authority Core & Security Guild | Path: src/Authority/StellaOps.Authority | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 40 — Notifications Studio Phase 3 | CLI-NOTIFY-40-001 | TODO | Implement ack token redemption, escalation management, localization previews. | DevEx/CLI Guild | Path: src/Cli/StellaOps.Cli | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 40 — Notifications Studio Phase 3 | NOTIFY-SVC-40-001 | TODO | Implement escalations, on-call schedules, ack bridge, PagerDuty/OpsGenie adapters, and localization bundles. | Notifications Service Guild | Path: src/Notifier/StellaOps.Notifier | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 40 — Notifications Studio Phase 3 | NOTIFY-SVC-40-002 | TODO | Add CLI inbox/in-app feed channels and summary storm breaker notifications. | Notifications Service Guild | Path: src/Notifier/StellaOps.Notifier | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 40 — Notifications Studio Phase 3 | NOTIFY-SVC-40-003 | TODO | Harden security: signed ack links, webhook HMAC/IP allowlists, tenant isolation fuzzing, localization fallback. | Notifications Service Guild | Path: src/Notifier/StellaOps.Notifier | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 40 — Notifications Studio Phase 3 | NOTIFY-SVC-40-004 | TODO | Finalize observability (incident metrics, escalation latency) and chaos tests for channel outages. | Notifications Service Guild | Path: src/Notifier/StellaOps.Notifier | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 40 — Notifications Studio Phase 3 | WEB-NOTIFY-40-001 | TODO | Expose escalation, localization, channel health endpoints and verification of signed links. | BE-Base Platform Guild | Path: src/Web/StellaOps.Web | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 41 — CLI Parity & Task Packs Phase 1 | DOCS-CLI-41-001 | TODO | Publish `/docs/modules/cli/guides/overview.md`, `/cli/configuration.md`, `/cli/output-and-exit-codes.md` (with imposed rule). | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 41 — CLI Parity & Task Packs Phase 1 | DEPLOY-CLI-41-001 | TODO | Package CLI release artifacts (tarballs, completions, container image) with distribution docs. | Deployment Guild | Path: ops/deployment | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 41 — CLI Parity & Task Packs Phase 1 | DEVOPS-CLI-41-001 | TODO | Establish CLI build pipeline (multi-platform binaries, SBOM, checksums) and parity matrix CI enforcement. | DevOps Guild | Path: ops/devops | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 41 — CLI Parity & Task Packs Phase 1 | AUTH-PACKS-41-001 | TODO | Define CLI SSO scopes and Packs (`Packs.Read/Write/Run/Approve`) roles; update discovery/offline defaults. | Authority Core & Security Guild | Path: src/Authority/StellaOps.Authority | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 41 — CLI Parity & Task Packs Phase 1 | CLI-CORE-41-001 | TODO | Implement CLI config/auth foundation, global flags, output renderer, and error/exit code mapping. | DevEx/CLI Guild | Path: src/Cli/StellaOps.Cli | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 41 — CLI Parity & Task Packs Phase 1 | CLI-PARITY-41-001 | TODO | Deliver parity command groups (`policy`, `sbom`, `vuln`, `vex`, `advisory`, `export`, `orchestrator`) with JSON/table outputs and `--explain`. | DevEx/CLI Guild | Path: src/Cli/StellaOps.Cli | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 41 — CLI Parity & Task Packs Phase 1 | CLI-PARITY-41-002 | TODO | Implement `notify`, `aoc`, `auth` command groups, idempotency keys, completions, and parity matrix export. | DevEx/CLI Guild | Path: src/Cli/StellaOps.Cli | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 41 — CLI Parity & Task Packs Phase 1 | ORCH-SVC-41-101 | TODO | Register `pack-run` job type, integrate logs/artifacts, expose pack run metadata. | Orchestrator Service Guild | Path: src/Orchestrator/StellaOps.Orchestrator | 2025-10-19 | | docs/implplan/archived/updates/tasks.md | Sprint 41 — CLI Parity & Task Packs Phase 1 | PACKS-REG-41-001 | DONE (2025-11-25) | Implement packs index API, signature verification, provenance storage, and RBAC. | Packs Registry Guild | Path: src/PacksRegistry/StellaOps.PacksRegistry | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 41 — CLI Parity & Task Packs Phase 1 | TASKRUN-41-001 | TODO | Bootstrap Task Runner service, migrations, run API, local executor, approvals pause, artifact capture. | Task Runner Guild | Path: src/TaskRunner/StellaOps.TaskRunner | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 42 — CLI Parity & Task Packs Phase 2 | DOCS-CLI-42-001 | TODO | Publish `/docs/modules/cli/guides/parity-matrix.md`, `/cli/commands/*.md`, `/docs/task-packs/spec.md` (imposed rule). | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 42 — CLI Parity & Task Packs Phase 2 | DEVOPS-CLI-42-001 | TODO | Add CLI golden output tests, parity diff automation, and pack run CI harness. | DevOps Guild | Path: ops/devops | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 42 — CLI Parity & Task Packs Phase 2 | CLI-PACKS-42-001 | TODO | Implement Task Pack CLI commands (`pack plan/run/push/pull/verify`) with plan/simulate engine and expression sandbox. | DevEx/CLI Guild | Path: src/Cli/StellaOps.Cli | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 42 — CLI Parity & Task Packs Phase 2 | CLI-PARITY-41-001..002 | TODO | Close parity gaps for Notifications, Policy Studio advanced features, SBOM graph, Vuln Explorer; parity matrix green. | DevEx/CLI Guild | Path: src/Cli/StellaOps.Cli | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 42 — CLI Parity & Task Packs Phase 2 | LEDGER-PACKS-42-001 | TODO | Expose snapshot/time-travel APIs for CLI offline mode and pack simulation. | Findings Ledger Guild | Path: src/Findings/StellaOps.Findings.Ledger | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 42 — CLI Parity & Task Packs Phase 2 | ORCH-SVC-42-101 | TODO | Stream pack run logs via SSE/WS, expose artifact manifests, enforce pack run quotas. | Orchestrator Service Guild | Path: src/Orchestrator/StellaOps.Orchestrator | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 41 — CLI Parity & Task Packs Phase 1 | TASKRUN-41-001 | TODO | Bootstrap Task Runner service, migrations, run API, local executor, approvals pause, artifact capture. | Task Runner Guild | Path: src/TaskRunner/StellaOps.TaskRunner | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 42 — CLI Parity & Task Packs Phase 2 | DOCS-CLI-42-001 | TODO | Publish `/docs/modules/cli/guides/parity-matrix.md`, `/cli/commands/*.md`, `/docs/task-packs/spec.md` (imposed rule). | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 42 — CLI Parity & Task Packs Phase 2 | DEVOPS-CLI-42-001 | TODO | Add CLI golden output tests, parity diff automation, and pack run CI harness. | DevOps Guild | Path: ops/devops | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 42 — CLI Parity & Task Packs Phase 2 | CLI-PACKS-42-001 | TODO | Implement Task Pack CLI commands (`pack plan/run/push/pull/verify`) with plan/simulate engine and expression sandbox. | DevEx/CLI Guild | Path: src/Cli/StellaOps.Cli | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 42 — CLI Parity & Task Packs Phase 2 | CLI-PARITY-41-001..002 | TODO | Close parity gaps for Notifications, Policy Studio advanced features, SBOM graph, Vuln Explorer; parity matrix green. | DevEx/CLI Guild | Path: src/Cli/StellaOps.Cli | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 42 — CLI Parity & Task Packs Phase 2 | LEDGER-PACKS-42-001 | TODO | Expose snapshot/time-travel APIs for CLI offline mode and pack simulation. | Findings Ledger Guild | Path: src/Findings/StellaOps.Findings.Ledger | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 42 — CLI Parity & Task Packs Phase 2 | ORCH-SVC-42-101 | TODO | Stream pack run logs via SSE/WS, expose artifact manifests, enforce pack run quotas. | Orchestrator Service Guild | Path: src/Orchestrator/StellaOps.Orchestrator | 2025-10-19 | | docs/implplan/archived/updates/tasks.md | Sprint 42 — CLI Parity & Task Packs Phase 2 | PACKS-REG-42-001 | DONE (2025-11-25) | Support pack version lifecycle, tenant allowlists, provenance export, signature rotation. | Packs Registry Guild | Path: src/PacksRegistry/StellaOps.PacksRegistry | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 42 — CLI Parity & Task Packs Phase 2 | POLICY-ENGINE-42-201 | TODO | Provide stable rationale IDs/APIs for CLI `--explain` and pack policy gates. | Policy Guild | Path: src/Policy/StellaOps.Policy.Engine | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 42 — CLI Parity & Task Packs Phase 2 | POLICY-ENGINE-42-201 | TODO | Provide stable rationale IDs/APIs for CLI `--explain` and pack policy gates. | Policy Guild | Path: src/Policy/StellaOps.Policy.Engine | 2025-10-19 | | docs/implplan/archived/updates/tasks.md | Sprint 42 — CLI Parity & Task Packs Phase 2 | TASKRUN-42-001 | BLOCKED (2025-11-25) | Add loops, conditionals, `maxParallel`, outputs, simulation mode, policy gates in Task Runner; awaiting control-flow/policy-gate addendum. | Task Runner Guild | Path: src/TaskRunner/StellaOps.TaskRunner | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 43 — CLI Parity & Task Packs Phase 3 | DOCS-PACKS-43-001 | TODO | Publish `/docs/task-packs/authoring-guide.md`, `/registry.md`, `/runbook.md`, `/security/pack-signing-and-rbac.md`, `/operations/cli-release-and-packaging.md` (imposed rule). | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 43 — CLI Parity & Task Packs Phase 3 | DEVOPS-CLI-43-001 | TODO | Finalize multi-platform release automation, SBOM signing, parity gate enforcement, pack run chaos tests. | DevOps Guild | Path: ops/devops | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 43 — CLI Parity & Task Packs Phase 3 | AUTH-PACKS-41-001 | TODO | Enforce pack signing policies, approval RBAC, CLI token scopes for CI headless runs. | Authority Core & Security Guild | Path: src/Authority/StellaOps.Authority | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 43 — CLI Parity & Task Packs Phase 3 | CLI-PACKS-42-001 | TODO | Deliver advanced pack features (approvals pause/resume, remote streaming, secret injection), localization, man pages. | DevEx/CLI Guild | Path: src/Cli/StellaOps.Cli | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 43 — CLI Parity & Task Packs Phase 3 | EXPORT-SVC-35-005, PACKS-REG-41-001 | TODO | Integrate pack run manifests into export bundles and CLI verify flows. | Exporter Service Guild | Path: src/ExportCenter/StellaOps.ExportCenter | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 43 — CLI Parity & Task Packs Phase 3 | PACKS-REG-42-001 | TODO | Enforce pack signing policies, audit trails, registry mirroring, Offline Kit support. | Packs Registry Guild | Path: src/PacksRegistry/StellaOps.PacksRegistry | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 43 — CLI Parity & Task Packs Phase 3 | DOCS-PACKS-43-001 | TODO | Publish `/docs/task-packs/authoring-guide.md`, `/registry.md`, `/runbook.md`, `/security/pack-signing-and-rbac.md`, `/operations/cli-release-and-packaging.md` (imposed rule). | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 43 — CLI Parity & Task Packs Phase 3 | DEVOPS-CLI-43-001 | TODO | Finalize multi-platform release automation, SBOM signing, parity gate enforcement, pack run chaos tests. | DevOps Guild | Path: ops/devops | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 43 — CLI Parity & Task Packs Phase 3 | AUTH-PACKS-41-001 | TODO | Enforce pack signing policies, approval RBAC, CLI token scopes for CI headless runs. | Authority Core & Security Guild | Path: src/Authority/StellaOps.Authority | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 43 — CLI Parity & Task Packs Phase 3 | CLI-PACKS-42-001 | TODO | Deliver advanced pack features (approvals pause/resume, remote streaming, secret injection), localization, man pages. | DevEx/CLI Guild | Path: src/Cli/StellaOps.Cli | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 43 — CLI Parity & Task Packs Phase 3 | EXPORT-SVC-35-005, PACKS-REG-41-001 | TODO | Integrate pack run manifests into export bundles and CLI verify flows. | Exporter Service Guild | Path: src/ExportCenter/StellaOps.ExportCenter | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 43 — CLI Parity & Task Packs Phase 3 | PACKS-REG-42-001 | TODO | Enforce pack signing policies, audit trails, registry mirroring, Offline Kit support. | Packs Registry Guild | Path: src/PacksRegistry/StellaOps.PacksRegistry | 2025-10-19 | | docs/implplan/archived/updates/tasks.md | Sprint 43 — CLI Parity & Task Packs Phase 3 | TASKRUN-42-001 | BLOCKED (2025-11-25) | Implement approvals workflow, notifications integration, remote artifact uploads, chaos resilience; blocked until TASKRUN-42-001 unblocks. | Task Runner Guild | Path: src/TaskRunner/StellaOps.TaskRunner | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 44 — Containerized Distribution Phase 1 | DOCS-INSTALL-44-001 | TODO | Publish install overview + Compose Quickstart docs (imposed rule). | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 44 — Containerized Distribution Phase 1 | COMPOSE-44-001 | TODO | Deliver Quickstart Compose stack with seed data and quickstart script. | Deployment Guild | Path: ops/deployment | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 44 — Containerized Distribution Phase 1 | COMPOSE-44-002 | TODO | Provide backup/reset scripts with guardrails and documentation. | Deployment Guild | Path: ops/deployment | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 44 — Containerized Distribution Phase 1 | COMPOSE-44-003 | TODO | Implement seed job and onboarding wizard toggle (`QUICKSTART_MODE`). | Deployment Guild | Path: ops/deployment | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 44 — Containerized Distribution Phase 1 | DEPLOY-COMPOSE-44-001 | TODO | Finalize Quickstart scripts and README. | Deployment Guild | Path: ops/deployment | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 44 — Containerized Distribution Phase 1 | DEVOPS-CONTAINERS-44-001 | TODO | Automate multi-arch builds with SBOM/signature pipeline. | DevOps Guild | Path: ops/devops | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 44 — Containerized Distribution Phase 1 | DOCKER-44-001 | TODO | Author multi-stage Dockerfiles with non-root users, read-only FS, and health scripts for all services. | DevOps Guild | Path: ops/devops | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 44 — Containerized Distribution Phase 1 | DOCKER-44-002 | TODO | Generate SBOMs and cosign attestations for each image; integrate signature verification in CI. | DevOps Guild | Path: ops/devops | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 44 — Containerized Distribution Phase 1 | DOCKER-44-003 | TODO | Ensure `/health/*`, `/version`, `/metrics`, and capability endpoints (`merge=false`) are exposed across services. | DevOps Guild | Path: ops/devops | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 44 — Containerized Distribution Phase 1 | WEB-CONTAINERS-44-001 | TODO | Expose config discovery and quickstart handling with health/version endpoints. | BE-Base Platform Guild | Path: src/Web/StellaOps.Web | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 45 — Containerized Distribution Phase 2 | DOCS-INSTALL-45-001 | TODO | Publish Helm production + configuration reference docs (imposed rule). | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 45 — Containerized Distribution Phase 2 | DEPLOY-HELM-45-001 | TODO | Publish Helm install guide and sample values. | Deployment Guild | Path: ops/deployment | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 45 — Containerized Distribution Phase 2 | HELM-45-001 | TODO | Scaffold Helm chart with component toggles and pinned digests. | Deployment Guild | Path: ops/deployment | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 45 — Containerized Distribution Phase 2 | HELM-45-002 | TODO | Add security features (TLS, NetworkPolicy, Secrets integration). | Deployment Guild | Path: ops/deployment | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 45 — Containerized Distribution Phase 2 | HELM-45-003 | TODO | Implement HPA, PDB, readiness gates, and observability hooks. | Deployment Guild | Path: ops/deployment | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 45 — Containerized Distribution Phase 2 | DEVOPS-CONTAINERS-45-001 | TODO | Add Compose/Helm smoke tests to CI. | DevOps Guild | Path: ops/devops | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 45 — Containerized Distribution Phase 2 | WEB-CONTAINERS-45-001 | TODO | Ensure readiness endpoints and config toggles support Helm deployments. | BE-Base Platform Guild | Path: src/Web/StellaOps.Web | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 46 — Containerized Distribution Phase 3 | DOCS-INSTALL-46-001 | TODO | Publish air-gap, supply chain, health/readiness, image catalog, console onboarding docs (imposed rule). | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 46 — Containerized Distribution Phase 3 | DEPLOY-AIRGAP-46-001 | TODO | Provide air-gap load script and docs. | Deployment Guild | Path: ops/deployment | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 46 — Containerized Distribution Phase 3 | DEVOPS-CONTAINERS-46-001 | TODO | Build signed air-gap bundle and verify in CI. | DevOps Guild | Path: ops/devops | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 46 — Containerized Distribution Phase 3 | OFFLINE-CONTAINERS-46-001 | TODO | Include air-gap bundle and instructions in Offline Kit. | Offline Kit Guild | Path: ops/offline-kit | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 46 — Containerized Distribution Phase 3 | WEB-CONTAINERS-46-001 | TODO | Harden offline mode and document fallback behavior. | BE-Base Platform Guild | Path: src/Web/StellaOps.Web | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 47 — Authority-Backed Scopes & Tenancy Phase 1 | DOCS-TEN-47-001 | TODO | Publish `/docs/security/tenancy-overview.md` and `/docs/security/scopes-and-roles.md` (imposed rule). | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 47 — Authority-Backed Scopes & Tenancy Phase 1 | DEVOPS-TEN-47-001 | TODO | Integrate JWKS caching, signature verification tests, and auth regression suite into CI. | DevOps Guild | Path: ops/devops | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 47 — Authority-Backed Scopes & Tenancy Phase 1 | AUTH-TEN-47-001 | TODO | Implement unified JWT/ODIC config, scope grammar, tenant/project claims, and JWKS caching in Authority. | Authority Core & Security Guild | Path: src/Authority/StellaOps.Authority | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 47 — Authority-Backed Scopes & Tenancy Phase 1 | CLI-TEN-47-001 | TODO | Ship `stella login`, `whoami`, `tenants list`, and tenant flag persistence with secure token storage. | DevEx/CLI Guild | Path: src/Cli/StellaOps.Cli | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 47 — Authority-Backed Scopes & Tenancy Phase 1 | WEB-TEN-47-001 | TODO | Add auth middleware (token verification, tenant activation, scope checks) and structured 403 responses. | BE-Base Platform Guild | Path: src/Web/StellaOps.Web | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 48 — Authority-Backed Scopes & Tenancy Phase 2 | DOCS-TEN-48-001 | TODO | Publish `/docs/operations/multi-tenancy.md`, `/docs/operations/rls-and-data-isolation.md`, `/docs/console/admin-tenants.md` (imposed rule). | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 48 — Authority-Backed Scopes & Tenancy Phase 2 | DEVOPS-TEN-48-001 | TODO | Write integration tests for RLS enforcement, tenant audit stream, and object store prefix checks. | DevOps Guild | Path: ops/devops | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 48 — Authority-Backed Scopes & Tenancy Phase 2 | CONCELIER-TEN-48-001 | TODO | Ensure advisory linkers operate per tenant with RLS, enforce aggregation-only capability endpoint. | Concelier Core Guild | Path: src/Concelier/__Libraries/StellaOps.Concelier.Core | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 48 — Authority-Backed Scopes & Tenancy Phase 2 | EXCITITOR-TEN-48-001 | TODO | Same as above for VEX linkers; enforce capability endpoint `merge=false`. | Excititor Core Guild | Path: src/Excititor/__Libraries/StellaOps.Excititor.Core | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 48 — Authority-Backed Scopes & Tenancy Phase 2 | EXPORT-TEN-48-001 | TODO | Add tenant prefixes to manifests/artifacts, enforce scope checks, and block cross-tenant exports by default. | Exporter Service Guild | Path: src/ExportCenter/StellaOps.ExportCenter | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 48 — Authority-Backed Scopes & Tenancy Phase 2 | LEDGER-TEN-48-001 | TODO | Partition findings by tenant/project, enable RLS, and update queries/events to include tenant context. | Findings Ledger Guild | Path: src/Findings/StellaOps.Findings.Ledger | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 48 — Authority-Backed Scopes & Tenancy Phase 2 | NOTIFY-TEN-48-001 | TODO | Tenant-scope notification rules, incidents, and outbound channels; update storage schemas. | Notifications Service Guild | Path: src/Notifier/StellaOps.Notifier | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 48 — Authority-Backed Scopes & Tenancy Phase 2 | ORCH-TEN-48-001 | TODO | Stamp jobs with tenant/project, set DB session context, and reject jobs without context. | Orchestrator Service Guild | Path: src/Orchestrator/StellaOps.Orchestrator | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 48 — Authority-Backed Scopes & Tenancy Phase 2 | POLICY-TEN-48-001 | TODO | Add `tenant_id`/`project_id` to policy data, enable Postgres RLS, and expose rationale IDs with tenant context. | Policy Guild | Path: src/Policy/StellaOps.Policy.Engine | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 48 — Authority-Backed Scopes & Tenancy Phase 2 | TASKRUN-TEN-48-001 | TODO | Propagate tenant/project to all steps, enforce object store prefix, and validate before execution. | Task Runner Guild | Path: src/TaskRunner/StellaOps.TaskRunner | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 48 — Authority-Backed Scopes & Tenancy Phase 2 | WEB-TEN-48-001 | TODO | Enforce tenant context through persistence (DB GUC, object store prefix), add request annotations, and emit audit events. | BE-Base Platform Guild | Path: src/Web/StellaOps.Web | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 49 — Authority-Backed Scopes & Tenancy Phase 3 | DOCS-TEN-49-001 | TODO | Publish `/docs/modules/cli/guides/authentication.md`, `/docs/api/authentication.md`, `/docs/policy/examples/abac-overlays.md`, `/docs/install/configuration-reference.md` updates (imposed rule). | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 49 — Authority-Backed Scopes & Tenancy Phase 3 | DEVOPS-TEN-49-001 | TODO | Implement audit log pipeline, monitor scope usage, chaos tests for JWKS outage, and tenant load/perf tests. | DevOps Guild | Path: ops/devops | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 49 — Authority-Backed Scopes & Tenancy Phase 3 | AUTH-TEN-49-001 | TODO | Implement service accounts, delegation tokens (`act` chain), per-tenant quotas, and audit log streaming. | Authority Core & Security Guild | Path: src/Authority/StellaOps.Authority | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 49 — Authority-Backed Scopes & Tenancy Phase 3 | CLI-TEN-49-001 | TODO | Add service account token minting, delegation, and `--impersonate` banner/controls. | DevEx/CLI Guild | Path: src/Cli/StellaOps.Cli | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 49 — Authority-Backed Scopes & Tenancy Phase 3 | WEB-TEN-49-001 | TODO | Integrate ABAC policy overlay (optional), expose audit API, and support service token minting endpoints. | BE-Base Platform Guild | Path: src/Web/StellaOps.Web | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 50 — Observability & Forensics Phase 1 – Baseline Telemetry | DOCS-INSTALL-50-001 | TODO | Add `/docs/install/telemetry-stack.md` for collector deployment and offline packaging. | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 50 — Observability & Forensics Phase 1 – Baseline Telemetry | DOCS-OBS-50-001 | BLOCKED (2025-10-26) | Author `/docs/observability/overview.md` with imposed rule banner and architecture context. | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 50 — Observability & Forensics Phase 1 – Baseline Telemetry | DOCS-OBS-50-002 | TODO | Document telemetry standards (fields, scrubbing, sampling) under `/docs/observability/telemetry-standards.md`. | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 50 — Observability & Forensics Phase 1 – Baseline Telemetry | DOCS-OBS-50-003 | TODO | Publish structured logging guide `/docs/observability/logging.md` with examples and imposed rule banner. | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 50 — Observability & Forensics Phase 1 – Baseline Telemetry | DOCS-OBS-50-004 | TODO | Publish tracing guide `/docs/observability/tracing.md` covering context propagation and sampling. | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 50 — Observability & Forensics Phase 1 – Baseline Telemetry | DOCS-SEC-OBS-50-001 | TODO | Update `/docs/security/redaction-and-privacy.md` for telemetry privacy controls. | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 50 — Observability & Forensics Phase 1 – Baseline Telemetry | DEVOPS-OBS-50-002 | DOING (2025-10-26) | Stand up multi-tenant metrics/logs/traces backends with retention and isolation. | DevOps Guild | Path: ops/devops | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 50 — Observability & Forensics Phase 1 – Baseline Telemetry | AUTH-OBS-50-001 | DOING (2025-11-01) | Introduce observability/timeline/evidence/attestation scopes and update discovery metadata. | Authority Core & Security Guild | Path: src/Authority/StellaOps.Authority | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 50 — Observability & Forensics Phase 1 – Baseline Telemetry | CLI-OBS-50-001 | TODO | Propagate trace headers from CLI commands and print correlation IDs. | DevEx/CLI Guild | Path: src/Cli/StellaOps.Cli | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 50 — Observability & Forensics Phase 1 – Baseline Telemetry | CONCELIER-OBS-50-001 | TODO | Replace ad-hoc logging with telemetry core across advisory ingestion/linking. | Concelier Core Guild | Path: src/Concelier/__Libraries/StellaOps.Concelier.Core | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 50 — Observability & Forensics Phase 1 – Baseline Telemetry | CONCELIER-WEB-OBS-50-001 | TODO | Adopt telemetry core in Concelier APIs and surface correlation IDs. | Concelier WebService Guild | Path: src/Concelier/StellaOps.Concelier.WebService | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 50 — Observability & Forensics Phase 1 – Baseline Telemetry | EXCITITOR-OBS-50-001 | TODO | Integrate telemetry core into VEX ingestion/linking with scope metadata. | Excititor Core Guild | Path: src/Excititor/__Libraries/StellaOps.Excititor.Core | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 50 — Observability & Forensics Phase 1 – Baseline Telemetry | EXCITITOR-WEB-OBS-50-001 | TODO | Add telemetry core to VEX APIs and emit trace headers. | Excititor WebService Guild | Path: src/Excititor/StellaOps.Excititor.WebService | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 50 — Observability & Forensics Phase 1 – Baseline Telemetry | EXPORT-OBS-50-001 | TODO | Enable telemetry core in export planner/workers capturing bundle metadata. | Exporter Service Guild | Path: src/ExportCenter/StellaOps.ExportCenter | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 50 — Observability & Forensics Phase 1 – Baseline Telemetry | LEDGER-OBS-50-001 | TODO | Wire telemetry core through ledger writer/projector for append/replay operations. | Findings Ledger Guild | Path: src/Findings/StellaOps.Findings.Ledger | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 50 — Observability & Forensics Phase 1 – Baseline Telemetry | ORCH-OBS-50-001 | TODO | Instrument orchestrator scheduler/control APIs with telemetry core spans/logs. | Orchestrator Service Guild | Path: src/Orchestrator/StellaOps.Orchestrator | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 50 — Observability & Forensics Phase 1 – Baseline Telemetry | POLICY-OBS-50-001 | BLOCKED (2025-11-26) | Telemetry/metrics contract not published for Policy Engine; awaiting observability spec. | Policy Guild | Path: src/Policy/StellaOps.Policy.Engine | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 50 — Observability & Forensics Phase 1 – Baseline Telemetry | TASKRUN-OBS-50-001 | TODO | Adopt telemetry core in Task Runner host and workers with scrubbed transcripts. | Task Runner Guild | Path: src/TaskRunner/StellaOps.TaskRunner | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 50 — Observability & Forensics Phase 1 – Baseline Telemetry | TELEMETRY-OBS-50-001 | TODO | Bootstrap telemetry core library with structured logging, OTLP exporters, and deterministic bootstrap. | Observability Guild | Path: src/Telemetry/StellaOps.Telemetry.Core | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 50 — Observability & Forensics Phase 1 – Baseline Telemetry | TELEMETRY-OBS-50-002 | TODO | Deliver context propagation middleware for HTTP/gRPC/jobs/CLI carrying trace + tenant metadata. | Observability Guild | Path: src/Telemetry/StellaOps.Telemetry.Core | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 50 — Observability & Forensics Phase 1 – Baseline Telemetry | WEB-OBS-50-001 | TODO | Integrate telemetry core into gateway and emit structured traces/logs for all routes. | BE-Base Platform Guild | Path: src/Web/StellaOps.Web | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 51 — Observability & Forensics Phase 2 – SLOs & Dashboards | DOCS-OBS-51-001 | TODO | Publish `/docs/observability/metrics-and-slos.md` with alert policies. | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 51 — Observability & Forensics Phase 2 – SLOs & Dashboards | DEVOPS-OBS-51-001 | TODO | Deploy SLO evaluator service, dashboards, and alert routing. | DevOps Guild | Path: ops/devops | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 51 — Observability & Forensics Phase 2 – SLOs & Dashboards | CLI-OBS-51-001 | TODO | Implement `stella obs top` streaming health metrics command. | DevEx/CLI Guild | Path: src/Cli/StellaOps.Cli | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 51 — Observability & Forensics Phase 2 – SLOs & Dashboards | CONCELIER-OBS-51-001 | TODO | Emit ingest latency metrics + SLO thresholds for advisories. | Concelier Core Guild | Path: src/Concelier/__Libraries/StellaOps.Concelier.Core | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 51 — Observability & Forensics Phase 2 – SLOs & Dashboards | EXCITITOR-OBS-51-001 | TODO | Provide VEX ingest metrics and SLO burn-rate automation. | Excititor Core Guild | Path: src/Excititor/__Libraries/StellaOps.Excititor.Core | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 51 — Observability & Forensics Phase 2 – SLOs & Dashboards | EXPORT-OBS-51-001 | TODO | Capture export planner/bundle latency metrics and SLOs. | Exporter Service Guild | Path: src/ExportCenter/StellaOps.ExportCenter | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 51 — Observability & Forensics Phase 2 – SLOs & Dashboards | LEDGER-OBS-51-001 | TODO | Add ledger/projector metrics dashboards and burn-rate policies. | Findings Ledger Guild | Path: src/Findings/StellaOps.Findings.Ledger | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 51 — Observability & Forensics Phase 2 – SLOs & Dashboards | NOTIFY-OBS-51-001 | TODO | Ingest SLO burn-rate webhooks and deliver observability alerts. | Notifications Service Guild | Path: src/Notifier/StellaOps.Notifier | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 51 — Observability & Forensics Phase 2 – SLOs & Dashboards | ORCH-OBS-51-001 | TODO | Publish orchestration metrics, SLOs, and burn-rate alerts. | Orchestrator Service Guild | Path: src/Orchestrator/StellaOps.Orchestrator | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 51 — Observability & Forensics Phase 2 – SLOs & Dashboards | POLICY-OBS-51-001 | BLOCKED (2025-11-26) | Blocked by OBS-50-001 telemetry contract. | Policy Guild | Path: src/Policy/StellaOps.Policy.Engine | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 51 — Observability & Forensics Phase 2 – SLOs & Dashboards | TASKRUN-OBS-51-001 | TODO | Emit task runner golden-signal metrics and SLO alerts. | Task Runner Guild | Path: src/TaskRunner/StellaOps.TaskRunner | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 51 — Observability & Forensics Phase 2 – SLOs & Dashboards | TELEMETRY-OBS-51-001 | TODO | Ship metrics helpers + exemplar guards for golden signals. | Observability Guild | Path: src/Telemetry/StellaOps.Telemetry.Core | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 51 — Observability & Forensics Phase 2 – SLOs & Dashboards | TELEMETRY-OBS-51-002 | TODO | Implement logging scrubbing and tenant debug override controls. | Security Guild | Path: src/Telemetry/StellaOps.Telemetry.Core | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 51 — Observability & Forensics Phase 2 – SLOs & Dashboards | WEB-OBS-51-001 | TODO | Expose `/obs/health` and `/obs/slo` aggregations for services. | BE-Base Platform Guild | Path: src/Web/StellaOps.Web | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 52 — Observability & Forensics Phase 3 – Timeline & Decision Logs | DOCS-CLI-OBS-52-001 | TODO | Document `stella obs` CLI commands and scripting patterns. | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 52 — Observability & Forensics Phase 3 – Timeline & Decision Logs | DOCS-CONSOLE-OBS-52-001 | TODO | Document Console observability hub and trace/log search workflows. | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 52 — Observability & Forensics Phase 3 – Timeline & Decision Logs | DOCS-CONSOLE-OBS-52-002 | TODO | Publish Console forensics/timeline guidance with imposed rule banner. | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 52 — Observability & Forensics Phase 3 – Timeline & Decision Logs | DEVOPS-OBS-52-001 | TODO | Configure streaming pipelines and schema validation for timeline events. | DevOps Guild | Path: ops/devops | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 52 — Observability & Forensics Phase 3 – Timeline & Decision Logs | CLI-OBS-52-001 | TODO | Add `stella obs trace` + log commands correlating timeline data. | DevEx/CLI Guild | Path: src/Cli/StellaOps.Cli | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 52 — Observability & Forensics Phase 3 – Timeline & Decision Logs | CONCELIER-OBS-52-001 | TODO | Emit advisory ingest/link timeline events with provenance metadata. | Concelier Core Guild | Path: src/Concelier/__Libraries/StellaOps.Concelier.Core | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 52 — Observability & Forensics Phase 3 – Timeline & Decision Logs | CONCELIER-WEB-OBS-52-001 | TODO (unblocked 2025-11-23) | Provide SSE bridge for advisory timeline events. | Concelier WebService Guild | Path: src/Concelier/StellaOps.Concelier.WebService | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 52 — Observability & Forensics Phase 3 – Timeline & Decision Logs | EXCITITOR-OBS-52-001 | TODO | Emit VEX ingest/link timeline events with justification info. | Excititor Core Guild | Path: src/Excititor/__Libraries/StellaOps.Excititor.Core | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 52 — Observability & Forensics Phase 3 – Timeline & Decision Logs | EXCITITOR-WEB-OBS-52-001 | TODO | Stream VEX timeline updates to clients with tenant filters. | Excititor WebService Guild | Path: src/Excititor/StellaOps.Excititor.WebService | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 52 — Observability & Forensics Phase 3 – Timeline & Decision Logs | EXPORT-OBS-52-001 | TODO | Publish export lifecycle events into timeline. | Exporter Service Guild | Path: src/ExportCenter/StellaOps.ExportCenter | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 52 — Observability & Forensics Phase 3 – Timeline & Decision Logs | LEDGER-OBS-52-001 | TODO | Record ledger append/projection events into timeline stream. | Findings Ledger Guild | Path: src/Findings/StellaOps.Findings.Ledger | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 52 — Observability & Forensics Phase 3 – Timeline & Decision Logs | ORCH-OBS-52-001 | TODO | Emit job lifecycle timeline events with tenant/project metadata. | Orchestrator Service Guild | Path: src/Orchestrator/StellaOps.Orchestrator | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 52 — Observability & Forensics Phase 3 – Timeline & Decision Logs | POLICY-OBS-52-001 | BLOCKED (2025-11-26) | Blocked by OBS-51-001 and missing timeline event spec. | Policy Guild | Path: src/Policy/StellaOps.Policy.Engine | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 52 — Observability & Forensics Phase 3 – Timeline & Decision Logs | TASKRUN-OBS-52-001 | TODO | Emit pack run timeline events and dedupe logic. | Task Runner Guild | Path: src/TaskRunner/StellaOps.TaskRunner | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 52 — Observability & Forensics Phase 3 – Timeline & Decision Logs | TIMELINE-OBS-52-001 | TODO | Bootstrap timeline indexer service and schema with RLS scaffolding. | Timeline Indexer Guild | Path: src/TimelineIndexer/StellaOps.TimelineIndexer | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 52 — Observability & Forensics Phase 3 – Timeline & Decision Logs | TIMELINE-OBS-52-002 | TODO | Implement event ingestion pipeline with ordering and dedupe. | Timeline Indexer Guild | Path: src/TimelineIndexer/StellaOps.TimelineIndexer | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 52 — Observability & Forensics Phase 3 – Timeline & Decision Logs | TIMELINE-OBS-52-003 | TODO | Expose timeline query APIs with tenant filters and pagination. | Timeline Indexer Guild | Path: src/TimelineIndexer/StellaOps.TimelineIndexer | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 52 — Observability & Forensics Phase 3 – Timeline & Decision Logs | TIMELINE-OBS-52-004 | TODO | Finalize RLS + scope enforcement and audit logging for timeline reads. | Security Guild | Path: src/TimelineIndexer/StellaOps.TimelineIndexer | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 52 — Observability & Forensics Phase 3 – Timeline & Decision Logs | WEB-OBS-52-001 | TODO | Provide trace/log proxy endpoints bridging to timeline + log store. | BE-Base Platform Guild | Path: src/Web/StellaOps.Web | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 53 — Observability & Forensics Phase 4 – Evidence Locker | DOCS-CLI-FORENSICS-53-001 | TODO | Document `stella forensic` CLI workflows with sample bundles. | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 53 — Observability & Forensics Phase 4 – Evidence Locker | DOCS-FORENSICS-53-001 | DONE (2025-11-26) | Publish `/docs/forensics/evidence-locker.md` covering bundles, WORM, legal holds. | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 53 — Observability & Forensics Phase 4 – Evidence Locker | DOCS-FORENSICS-53-003 | TODO | Publish `/docs/forensics/timeline.md` with schema and query examples. | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 53 — Observability & Forensics Phase 4 – Evidence Locker | DEVOPS-OBS-53-001 | TODO | Provision WORM-capable storage, legal hold automation, and backup/restore scripts for evidence locker. | DevOps Guild | Path: ops/devops | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 53 — Observability & Forensics Phase 4 – Evidence Locker | CLI-FORENSICS-53-001 | TODO | Ship `stella forensic snapshot` commands invoking evidence locker. | DevEx/CLI Guild | Path: src/Cli/StellaOps.Cli | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 53 — Observability & Forensics Phase 4 – Evidence Locker | CONCELIER-OBS-53-001 | TODO | Generate advisory evidence payloads (raw doc, linkset diff) for locker. | Concelier Core Guild | Path: src/Concelier/__Libraries/StellaOps.Concelier.Core | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 53 — Observability & Forensics Phase 4 – Evidence Locker | CONCELIER-WEB-OBS-53-001 | TODO | Add `/evidence/advisories/*` gateway endpoints consuming locker APIs. | Concelier WebService Guild | Path: src/Concelier/StellaOps.Concelier.WebService | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 53 — Observability & Forensics Phase 4 – Evidence Locker | EVID-OBS-53-001 | TODO | Bootstrap evidence locker service with schema, storage abstraction, and RLS. | Evidence Locker Guild | Path: src/EvidenceLocker/StellaOps.EvidenceLocker | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 53 — Observability & Forensics Phase 4 – Evidence Locker | EVID-OBS-53-002 | TODO | Implement bundle builders for evaluation, job, and export snapshots. | Evidence Locker Guild | Path: src/EvidenceLocker/StellaOps.EvidenceLocker | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 53 — Observability & Forensics Phase 4 – Evidence Locker | EVID-OBS-53-003 | TODO | Expose evidence APIs (create/get/verify/hold) with audit + quotas. | Evidence Locker Guild | Path: src/EvidenceLocker/StellaOps.EvidenceLocker | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 53 — Observability & Forensics Phase 4 – Evidence Locker | EXCITITOR-OBS-53-001 | TODO | Produce VEX evidence payloads and push to locker. | Excititor Core Guild | Path: src/Excititor/__Libraries/StellaOps.Excititor.Core | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 53 — Observability & Forensics Phase 4 – Evidence Locker | EXCITITOR-WEB-OBS-53-001 | TODO | Expose `/evidence/vex/*` endpoints retrieving locker bundles. | Excititor WebService Guild | Path: src/Excititor/StellaOps.Excititor.WebService | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 53 — Observability & Forensics Phase 4 – Evidence Locker | EXPORT-OBS-53-001 | TODO | Store export manifests + transcripts within evidence bundles. | Exporter Service Guild | Path: src/ExportCenter/StellaOps.ExportCenter | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 53 — Observability & Forensics Phase 4 – Evidence Locker | LEDGER-OBS-53-001 | TODO | Persist evidence bundle references alongside ledger entries and expose lookup API. | Findings Ledger Guild | Path: src/Findings/StellaOps.Findings.Ledger | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 53 — Observability & Forensics Phase 4 – Evidence Locker | ORCH-OBS-53-001 | TODO | Attach job capsules + manifests to evidence locker snapshots. | Orchestrator Service Guild | Path: src/Orchestrator/StellaOps.Orchestrator | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 53 — Observability & Forensics Phase 4 – Evidence Locker | POLICY-OBS-53-001 | BLOCKED (2025-11-26) | Evidence Locker bundle schema absent; depends on OBS-52-001. | Policy Guild | Path: src/Policy/StellaOps.Policy.Engine | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 53 — Observability & Forensics Phase 4 – Evidence Locker | TASKRUN-OBS-53-001 | TODO | Capture step transcripts and manifests into evidence bundles. | Task Runner Guild | Path: src/TaskRunner/StellaOps.TaskRunner | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 53 — Observability & Forensics Phase 4 – Evidence Locker | TIMELINE-OBS-53-001 | TODO | Link timeline events to evidence bundle digests and expose evidence lookup endpoint. | Timeline Indexer Guild | Path: src/TimelineIndexer/StellaOps.TimelineIndexer | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 54 — Observability & Forensics Phase 5 – Provenance & Verification | DOCS-FORENSICS-53-002 | TODO | Publish `/docs/forensics/provenance-attestation.md` covering signing + verification. | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 54 — Observability & Forensics Phase 5 – Provenance & Verification | DEVOPS-OBS-54-001 | TODO | Manage provenance signing infrastructure (KMS keys, timestamp authority) and CI verification. | DevOps Guild | Path: ops/devops | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 54 — Observability & Forensics Phase 5 – Provenance & Verification | CLI-FORENSICS-54-001 | TODO | Implement `stella forensic verify` command verifying bundles + signatures. | DevEx/CLI Guild | Path: src/Cli/StellaOps.Cli | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 54 — Observability & Forensics Phase 5 – Provenance & Verification | CLI-FORENSICS-54-002 | TODO | Add `stella forensic attest show` command with signer/timestamp details. | DevEx/CLI Guild | Path: src/Cli/StellaOps.Cli | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 54 — Observability & Forensics Phase 5 – Provenance & Verification | CONCELIER-OBS-54-001 | TODO | Sign advisory batches with DSSE attestations and expose verification. | Concelier Core Guild | Path: src/Concelier/__Libraries/StellaOps.Concelier.Core | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 54 — Observability & Forensics Phase 5 – Provenance & Verification | CONCELIER-WEB-OBS-54-001 | TODO | Add `/attestations/advisories/*` endpoints surfacing verification metadata. | Concelier WebService Guild | Path: src/Concelier/StellaOps.Concelier.WebService | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 54 — Observability & Forensics Phase 5 – Provenance & Verification | EVID-OBS-54-001 | TODO | Attach DSSE signing/timestamping to evidence bundles and emit timeline hooks. | Evidence Locker Guild | Path: src/EvidenceLocker/StellaOps.EvidenceLocker | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 54 — Observability & Forensics Phase 5 – Provenance & Verification | EVID-OBS-54-002 | TODO | Provide bundle packaging + offline verification fixtures. | Evidence Locker Guild | Path: src/EvidenceLocker/StellaOps.EvidenceLocker | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 54 — Observability & Forensics Phase 5 – Provenance & Verification | EXCITITOR-OBS-54-001 | TODO | Produce VEX batch attestations linking to timeline/ledger. | Excititor Core Guild | Path: src/Excititor/__Libraries/StellaOps.Excititor.Core | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 54 — Observability & Forensics Phase 5 – Provenance & Verification | EXCITITOR-WEB-OBS-54-001 | TODO | Expose `/attestations/vex/*` endpoints with verification summaries. | Excititor WebService Guild | Path: src/Excititor/StellaOps.Excititor.WebService | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 54 — Observability & Forensics Phase 5 – Provenance & Verification | EXPORT-OBS-54-001 | TODO | Produce export attestation manifests and CLI verification hooks. | Exporter Service Guild | Path: src/ExportCenter/StellaOps.ExportCenter | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 54 — Observability & Forensics Phase 5 – Provenance & Verification | ORCH-OBS-54-001 | TODO | Produce DSSE attestations for jobs and surface verification endpoint. | Orchestrator Service Guild | Path: src/Orchestrator/StellaOps.Orchestrator | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 54 — Observability & Forensics Phase 5 – Provenance & Verification | POLICY-OBS-54-001 | BLOCKED (2025-11-26) | Blocked by OBS-53-001; provenance/attestation contract missing. | Policy Guild | Path: src/Policy/StellaOps.Policy.Engine | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 54 — Observability & Forensics Phase 5 – Provenance & Verification | PROV-OBS-53-001 | TODO | Implement DSSE/SLSA models with deterministic serializer + test vectors. | Provenance Guild | Path: src/Provenance/StellaOps.Provenance.Attestation | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 54 — Observability & Forensics Phase 5 – Provenance & Verification | PROV-OBS-53-002 | TODO | Build signer abstraction (cosign/KMS/offline) with policy enforcement. | Provenance Guild | Path: src/Provenance/StellaOps.Provenance.Attestation | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 54 — Observability & Forensics Phase 5 – Provenance & Verification | PROV-OBS-54-001 | TODO | Deliver verification library validating DSSE signatures + Merkle roots. | Provenance Guild | Path: src/Provenance/StellaOps.Provenance.Attestation | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 54 — Observability & Forensics Phase 5 – Provenance & Verification | PROV-OBS-54-002 | TODO | Package provenance verification tool for CLI integration and offline use. | Provenance Guild, DevEx/CLI Guild | Path: src/Provenance/StellaOps.Provenance.Attestation | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 54 — Observability & Forensics Phase 5 – Provenance & Verification | TASKRUN-OBS-54-001 | TODO | Generate pack run attestations and link to timeline/evidence. | Task Runner Guild | Path: src/TaskRunner/StellaOps.TaskRunner | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 55 — Observability & Forensics Phase 6 – Incident Mode | DOCS-RUNBOOK-55-001 | TODO | Publish `/docs/runbooks/incidents.md` covering activation, escalation, and verification checklist. | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 55 — Observability & Forensics Phase 6 – Incident Mode | DEVOPS-OBS-55-001 | TODO | Automate incident mode activation via SLO alerts, retention override management, and reset job. | DevOps Guild | Path: ops/devops | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 55 — Observability & Forensics Phase 6 – Incident Mode | AUTH-OBS-55-001 | DOING (2025-11-01) | Enforce `obs:incident` scope with fresh-auth requirement and audit export for toggles. | Authority Core & Security Guild | Path: src/Authority/StellaOps.Authority | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 55 — Observability & Forensics Phase 6 – Incident Mode | CLI-OBS-55-001 | TODO | Ship `stella obs incident-mode` commands with safeguards and audit logging. | DevEx/CLI Guild | Path: src/Cli/StellaOps.Cli | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 55 — Observability & Forensics Phase 6 – Incident Mode | CONCELIER-OBS-55-001 | TODO | Increase sampling and raw payload retention under incident mode with redaction guards. | Concelier Core Guild | Path: src/Concelier/__Libraries/StellaOps.Concelier.Core | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 55 — Observability & Forensics Phase 6 – Incident Mode | CONCELIER-WEB-OBS-55-001 | TODO | Provide incident mode toggle endpoints and propagate to services. | Concelier WebService Guild | Path: src/Concelier/StellaOps.Concelier.WebService | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 55 — Observability & Forensics Phase 6 – Incident Mode | EVID-OBS-55-001 | TODO | Extend evidence retention + activation events for incident windows. | Evidence Locker Guild | Path: src/EvidenceLocker/StellaOps.EvidenceLocker | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 55 — Observability & Forensics Phase 6 – Incident Mode | EXCITITOR-OBS-55-001 | TODO | Enable incident sampling + retention overrides for VEX pipelines. | Excititor Core Guild | Path: src/Excititor/__Libraries/StellaOps.Excititor.Core | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 55 — Observability & Forensics Phase 6 – Incident Mode | EXCITITOR-WEB-OBS-55-001 | TODO | Add incident mode APIs for VEX services with audit + guardrails. | Excititor WebService Guild | Path: src/Excititor/StellaOps.Excititor.WebService | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 55 — Observability & Forensics Phase 6 – Incident Mode | EXPORT-OBS-55-001 | TODO | Increase export telemetry + debug retention during incident mode and emit events. | Exporter Service Guild | Path: src/ExportCenter/StellaOps.ExportCenter | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 55 — Observability & Forensics Phase 6 – Incident Mode | LEDGER-OBS-55-001 | TODO | Extend retention and diagnostics capture during incident mode. | Findings Ledger Guild | Path: src/Findings/StellaOps.Findings.Ledger | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 55 — Observability & Forensics Phase 6 – Incident Mode | NOTIFY-OBS-55-001 | TODO | Send incident mode start/stop notifications with quick links to evidence/timeline. | Notifications Service Guild | Path: src/Notifier/StellaOps.Notifier | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 55 — Observability & Forensics Phase 6 – Incident Mode | ORCH-OBS-55-001 | TODO | Increase telemetry + evidence capture during incident mode and emit activation events. | Orchestrator Service Guild | Path: src/Orchestrator/StellaOps.Orchestrator | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 55 — Observability & Forensics Phase 6 – Incident Mode | POLICY-OBS-55-001 | BLOCKED (2025-11-26) | Incident mode sampling spec not defined; depends on OBS-54-001. | Policy Guild | Path: src/Policy/StellaOps.Policy.Engine | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 55 — Observability & Forensics Phase 6 – Incident Mode | TASKRUN-OBS-55-001 | TODO | Capture extra debug data + notifications for incident mode runs. | Task Runner Guild | Path: src/TaskRunner/StellaOps.TaskRunner | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 55 — Observability & Forensics Phase 6 – Incident Mode | TELEMETRY-OBS-55-001 | TODO | Implement incident mode sampling toggle API with activation audit trail. | Observability Guild | Path: src/Telemetry/StellaOps.Telemetry.Core | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 55 — Observability & Forensics Phase 6 – Incident Mode | WEB-OBS-55-001 | TODO | Deliver `/obs/incident-mode` control endpoints with audit + retention previews. | BE-Base Platform Guild | Path: src/Web/StellaOps.Web | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 56 — Air-Gapped Mode Phase 1 – Sealing Foundations | DOCS-AIRGAP-56-001 | TODO | Publish `/docs/airgap/overview.md`. | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 56 — Air-Gapped Mode Phase 1 – Sealing Foundations | DOCS-AIRGAP-56-002 | TODO | Document sealing and egress controls. | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 56 — Air-Gapped Mode Phase 1 – Sealing Foundations | DOCS-AIRGAP-56-003 | TODO | Publish mirror bundles guide. | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 56 — Air-Gapped Mode Phase 1 – Sealing Foundations | DOCS-AIRGAP-56-004 | TODO | Publish bootstrap pack guide. | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 56 — Air-Gapped Mode Phase 1 – Sealing Foundations | DEVOPS-AIRGAP-56-001 | TODO | Publish deny-all egress policies and verification script for sealed environments. | DevOps Guild | Path: ops/devops | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 56 — Air-Gapped Mode Phase 1 – Sealing Foundations | DEVOPS-AIRGAP-56-002 | TODO | Provide bundle staging/import scripts for air-gapped object stores. | DevOps Guild | Path: ops/devops | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 56 — Air-Gapped Mode Phase 1 – Sealing Foundations | DEVOPS-AIRGAP-56-003 | TODO | Build Bootstrap Pack pipeline bundling images/charts with checksums. | DevOps Guild | Path: ops/devops | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 56 — Air-Gapped Mode Phase 1 – Sealing Foundations | AIRGAP-CTL-56-001 | TODO | Implement sealing state machine, persistence, and RBAC scopes for air-gapped status. | AirGap Controller Guild | Path: src/AirGap/StellaOps.AirGap.Controller | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 56 — Air-Gapped Mode Phase 1 – Sealing Foundations | AIRGAP-CTL-56-002 | TODO | Expose seal/status APIs with policy hash validation and staleness placeholders. | AirGap Controller Guild | Path: src/AirGap/StellaOps.AirGap.Controller | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 56 — Air-Gapped Mode Phase 1 – Sealing Foundations | AIRGAP-IMP-56-001 | TODO | Implement DSSE/TUF/Merkle verification helpers. | AirGap Importer Guild | Path: src/AirGap/StellaOps.AirGap.Importer | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 56 — Air-Gapped Mode Phase 1 – Sealing Foundations | AIRGAP-IMP-56-002 | TODO | Enforce root rotation policy for bundles. | AirGap Importer Guild | Path: src/AirGap/StellaOps.AirGap.Importer | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 56 — Air-Gapped Mode Phase 1 – Sealing Foundations | AIRGAP-POL-56-001 | TODO | Ship `EgressPolicy` facade with sealed/unsealed enforcement and remediation errors. | AirGap Policy Guild | Path: src/AirGap/StellaOps.AirGap.Policy | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 56 — Air-Gapped Mode Phase 1 – Sealing Foundations | AIRGAP-POL-56-002 | TODO | Deliver Roslyn analyzer blocking raw HTTP clients; wire into CI. | AirGap Policy Guild | Path: src/AirGap/StellaOps.AirGap.Policy | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 56 — Air-Gapped Mode Phase 1 – Sealing Foundations | CLI-AIRGAP-56-001 | TODO | Implement mirror create/verify and airgap verify commands. | DevEx/CLI Guild | Path: src/Cli/StellaOps.Cli | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 56 — Air-Gapped Mode Phase 1 – Sealing Foundations | CLI-OBS-50-001 | TODO | Ensure telemetry propagation for sealed logging. | DevEx/CLI Guild | Path: src/Cli/StellaOps.Cli | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 56 — Air-Gapped Mode Phase 1 – Sealing Foundations | CONCELIER-AIRGAP-56-001 | TODO | Add mirror ingestion adapters preserving source metadata. | Concelier Core Guild | Path: src/Concelier/__Libraries/StellaOps.Concelier.Core | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 56 — Air-Gapped Mode Phase 1 – Sealing Foundations | EXCITITOR-AIRGAP-56-001 | TODO | Add VEX mirror ingestion adapters. | Excititor Core Guild | Path: src/Excititor/__Libraries/StellaOps.Excititor.Core | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 56 — Air-Gapped Mode Phase 1 – Sealing Foundations | EXPORT-AIRGAP-56-001 | TODO | Extend export center to build mirror bundles. | Exporter Service Guild | Path: src/ExportCenter/StellaOps.ExportCenter | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 56 — Air-Gapped Mode Phase 1 – Sealing Foundations | MIRROR-CRT-56-001 | TODO | Build deterministic bundle assembler (advisories/vex/policy). | Mirror Creator Guild | Path: src/Mirror/StellaOps.Mirror.Creator | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 56 — Air-Gapped Mode Phase 1 – Sealing Foundations | ORCH-AIRGAP-56-001 | TODO | Validate jobs against sealed-mode restrictions. | Orchestrator Service Guild | Path: src/Orchestrator/StellaOps.Orchestrator | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 56 — Air-Gapped Mode Phase 1 – Sealing Foundations | POLICY-AIRGAP-56-001 | TODO | Accept policy packs from bundles with provenance tracking. | Policy Guild | Path: src/Policy/StellaOps.Policy.Engine | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 56 — Air-Gapped Mode Phase 1 – Sealing Foundations | TASKRUN-AIRGAP-56-001 | TODO | Enforce sealed-mode plan validation for network calls. | Task Runner Guild | Path: src/TaskRunner/StellaOps.TaskRunner | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 56 — Air-Gapped Mode Phase 1 – Sealing Foundations | TELEMETRY-OBS-56-001 | TODO | (Carry) Extend telemetry core with sealed-mode hooks before integration. | Observability Guild | Path: src/Telemetry/StellaOps.Telemetry.Core | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 56 — Air-Gapped Mode Phase 1 – Sealing Foundations | WEB-OBS-56-001 | TODO | Extend telemetry core usage for sealed-mode status surfaces (seal/unseal dashboards, drift signals). | BE-Base Platform Guild | Path: src/Web/StellaOps.Web | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 57 — Air-Gapped Mode Phase 2 – Mirror Bundles & Imports | DOCS-AIRGAP-57-001 | TODO | Publish staleness/time doc. | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 57 — Air-Gapped Mode Phase 2 – Mirror Bundles & Imports | DOCS-AIRGAP-57-002 | TODO | Publish console airgap doc. | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 57 — Air-Gapped Mode Phase 2 – Mirror Bundles & Imports | DOCS-AIRGAP-57-003 | TODO | Publish CLI airgap doc. | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 57 — Air-Gapped Mode Phase 2 – Mirror Bundles & Imports | DOCS-AIRGAP-57-004 | TODO | Publish airgap operations runbook. | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 57 — Air-Gapped Mode Phase 2 – Mirror Bundles & Imports | DEVOPS-AIRGAP-57-001 | TODO | Automate mirror bundle creation with approvals. | DevOps Guild | Path: ops/devops | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 57 — Air-Gapped Mode Phase 2 – Mirror Bundles & Imports | DEVOPS-AIRGAP-57-002 | TODO | Run sealed-mode CI suite enforcing zero egress. | DevOps Guild | Path: ops/devops | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 57 — Air-Gapped Mode Phase 2 – Mirror Bundles & Imports | AIRGAP-IMP-57-001 | TODO | Implement bundle catalog with RLS + migrations. | AirGap Importer Guild | Path: src/AirGap/StellaOps.AirGap.Importer | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 57 — Air-Gapped Mode Phase 2 – Mirror Bundles & Imports | AIRGAP-IMP-57-002 | TODO | Load artifacts into object store with checksum verification. | AirGap Importer Guild | Path: src/AirGap/StellaOps.AirGap.Importer | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 57 — Air-Gapped Mode Phase 2 – Mirror Bundles & Imports | AIRGAP-POL-57-001 | TODO | Adopt EgressPolicy in core services. | AirGap Policy Guild | Path: src/AirGap/StellaOps.AirGap.Policy | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 57 — Air-Gapped Mode Phase 2 – Mirror Bundles & Imports | AIRGAP-POL-57-002 | TODO | Enforce Task Runner job plan validation. | AirGap Policy Guild | Path: src/AirGap/StellaOps.AirGap.Policy | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 57 — Air-Gapped Mode Phase 2 – Mirror Bundles & Imports | AIRGAP-TIME-57-001 | TODO | Parse signed time tokens and expose normalized anchors. | AirGap Time Guild | Path: src/AirGap/StellaOps.AirGap.Time | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 57 — Air-Gapped Mode Phase 2 – Mirror Bundles & Imports | CLI-AIRGAP-57-001 | TODO | Complete airgap import CLI with diff preview. | DevEx/CLI Guild | Path: src/Cli/StellaOps.Cli | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 57 — Air-Gapped Mode Phase 2 – Mirror Bundles & Imports | CLI-AIRGAP-57-002 | TODO | Ship seal/status CLI commands. | DevEx/CLI Guild | Path: src/Cli/StellaOps.Cli | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 57 — Air-Gapped Mode Phase 2 – Mirror Bundles & Imports | EXPORT-AIRGAP-56-002 | TODO | Deliver bootstrap pack artifacts. | Exporter Service Guild | Path: src/ExportCenter/StellaOps.ExportCenter | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 57 — Air-Gapped Mode Phase 2 – Mirror Bundles & Imports | MIRROR-CRT-57-001 | TODO | Add OCI image support to mirror bundles. | Mirror Creator Guild | Path: src/Mirror/StellaOps.Mirror.Creator | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 57 — Air-Gapped Mode Phase 2 – Mirror Bundles & Imports | MIRROR-CRT-57-002 | TODO | Embed signed time anchors in bundles. | Mirror Creator Guild | Path: src/Mirror/StellaOps.Mirror.Creator | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 57 — Air-Gapped Mode Phase 2 – Mirror Bundles & Imports | NOTIFY-AIRGAP-56-001 | TODO | Lock notifications to enclave-safe channels. | Notifications Service Guild | Path: src/Notifier/StellaOps.Notifier | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 57 — Air-Gapped Mode Phase 2 – Mirror Bundles & Imports | ORCH-AIRGAP-56-002 | TODO | Integrate sealing status + staleness into scheduling. | Orchestrator Service Guild | Path: src/Orchestrator/StellaOps.Orchestrator | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 44 — Containerized Distribution Phase 1 | DOCS-INSTALL-44-001 | TODO | Publish install overview + Compose Quickstart docs (imposed rule). | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 44 — Containerized Distribution Phase 1 | COMPOSE-44-001 | TODO | Deliver Quickstart Compose stack with seed data and quickstart script. | Deployment Guild | Path: ops/deployment | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 44 — Containerized Distribution Phase 1 | COMPOSE-44-002 | TODO | Provide backup/reset scripts with guardrails and documentation. | Deployment Guild | Path: ops/deployment | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 44 — Containerized Distribution Phase 1 | COMPOSE-44-003 | TODO | Implement seed job and onboarding wizard toggle (`QUICKSTART_MODE`). | Deployment Guild | Path: ops/deployment | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 44 — Containerized Distribution Phase 1 | DEPLOY-COMPOSE-44-001 | TODO | Finalize Quickstart scripts and README. | Deployment Guild | Path: ops/deployment | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 44 — Containerized Distribution Phase 1 | DEVOPS-CONTAINERS-44-001 | TODO | Automate multi-arch builds with SBOM/signature pipeline. | DevOps Guild | Path: ops/devops | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 44 — Containerized Distribution Phase 1 | DOCKER-44-001 | TODO | Author multi-stage Dockerfiles with non-root users, read-only FS, and health scripts for all services. | DevOps Guild | Path: ops/devops | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 44 — Containerized Distribution Phase 1 | DOCKER-44-002 | TODO | Generate SBOMs and cosign attestations for each image; integrate signature verification in CI. | DevOps Guild | Path: ops/devops | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 44 — Containerized Distribution Phase 1 | DOCKER-44-003 | TODO | Ensure `/health/*`, `/version`, `/metrics`, and capability endpoints (`merge=false`) are exposed across services. | DevOps Guild | Path: ops/devops | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 44 — Containerized Distribution Phase 1 | WEB-CONTAINERS-44-001 | TODO | Expose config discovery and quickstart handling with health/version endpoints. | BE-Base Platform Guild | Path: src/Web/StellaOps.Web | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 45 — Containerized Distribution Phase 2 | DOCS-INSTALL-45-001 | TODO | Publish Helm production + configuration reference docs (imposed rule). | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 45 — Containerized Distribution Phase 2 | DEPLOY-HELM-45-001 | TODO | Publish Helm install guide and sample values. | Deployment Guild | Path: ops/deployment | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 45 — Containerized Distribution Phase 2 | HELM-45-001 | TODO | Scaffold Helm chart with component toggles and pinned digests. | Deployment Guild | Path: ops/deployment | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 45 — Containerized Distribution Phase 2 | HELM-45-002 | TODO | Add security features (TLS, NetworkPolicy, Secrets integration). | Deployment Guild | Path: ops/deployment | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 45 — Containerized Distribution Phase 2 | HELM-45-003 | TODO | Implement HPA, PDB, readiness gates, and observability hooks. | Deployment Guild | Path: ops/deployment | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 45 — Containerized Distribution Phase 2 | DEVOPS-CONTAINERS-45-001 | TODO | Add Compose/Helm smoke tests to CI. | DevOps Guild | Path: ops/devops | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 45 — Containerized Distribution Phase 2 | WEB-CONTAINERS-45-001 | TODO | Ensure readiness endpoints and config toggles support Helm deployments. | BE-Base Platform Guild | Path: src/Web/StellaOps.Web | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 46 — Containerized Distribution Phase 3 | DOCS-INSTALL-46-001 | TODO | Publish air-gap, supply chain, health/readiness, image catalog, console onboarding docs (imposed rule). | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 46 — Containerized Distribution Phase 3 | DEPLOY-AIRGAP-46-001 | TODO | Provide air-gap load script and docs. | Deployment Guild | Path: ops/deployment | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 46 — Containerized Distribution Phase 3 | DEVOPS-CONTAINERS-46-001 | TODO | Build signed air-gap bundle and verify in CI. | DevOps Guild | Path: ops/devops | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 46 — Containerized Distribution Phase 3 | OFFLINE-CONTAINERS-46-001 | TODO | Include air-gap bundle and instructions in Offline Kit. | Offline Kit Guild | Path: ops/offline-kit | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 46 — Containerized Distribution Phase 3 | WEB-CONTAINERS-46-001 | TODO | Harden offline mode and document fallback behavior. | BE-Base Platform Guild | Path: src/Web/StellaOps.Web | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 47 — Authority-Backed Scopes & Tenancy Phase 1 | DOCS-TEN-47-001 | TODO | Publish `/docs/security/tenancy-overview.md` and `/docs/security/scopes-and-roles.md` (imposed rule). | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 47 — Authority-Backed Scopes & Tenancy Phase 1 | DEVOPS-TEN-47-001 | TODO | Integrate JWKS caching, signature verification tests, and auth regression suite into CI. | DevOps Guild | Path: ops/devops | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 47 — Authority-Backed Scopes & Tenancy Phase 1 | AUTH-TEN-47-001 | TODO | Implement unified JWT/ODIC config, scope grammar, tenant/project claims, and JWKS caching in Authority. | Authority Core & Security Guild | Path: src/Authority/StellaOps.Authority | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 47 — Authority-Backed Scopes & Tenancy Phase 1 | CLI-TEN-47-001 | TODO | Ship `stella login`, `whoami`, `tenants list`, and tenant flag persistence with secure token storage. | DevEx/CLI Guild | Path: src/Cli/StellaOps.Cli | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 47 — Authority-Backed Scopes & Tenancy Phase 1 | WEB-TEN-47-001 | TODO | Add auth middleware (token verification, tenant activation, scope checks) and structured 403 responses. | BE-Base Platform Guild | Path: src/Web/StellaOps.Web | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 48 — Authority-Backed Scopes & Tenancy Phase 2 | DOCS-TEN-48-001 | TODO | Publish `/docs/operations/multi-tenancy.md`, `/docs/operations/rls-and-data-isolation.md`, `/docs/console/admin-tenants.md` (imposed rule). | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 48 — Authority-Backed Scopes & Tenancy Phase 2 | DEVOPS-TEN-48-001 | TODO | Write integration tests for RLS enforcement, tenant audit stream, and object store prefix checks. | DevOps Guild | Path: ops/devops | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 48 — Authority-Backed Scopes & Tenancy Phase 2 | CONCELIER-TEN-48-001 | TODO | Ensure advisory linkers operate per tenant with RLS, enforce aggregation-only capability endpoint. | Concelier Core Guild | Path: src/Concelier/__Libraries/StellaOps.Concelier.Core | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 48 — Authority-Backed Scopes & Tenancy Phase 2 | EXCITITOR-TEN-48-001 | TODO | Same as above for VEX linkers; enforce capability endpoint `merge=false`. | Excititor Core Guild | Path: src/Excititor/__Libraries/StellaOps.Excititor.Core | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 48 — Authority-Backed Scopes & Tenancy Phase 2 | EXPORT-TEN-48-001 | TODO | Add tenant prefixes to manifests/artifacts, enforce scope checks, and block cross-tenant exports by default. | Exporter Service Guild | Path: src/ExportCenter/StellaOps.ExportCenter | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 48 — Authority-Backed Scopes & Tenancy Phase 2 | LEDGER-TEN-48-001 | TODO | Partition findings by tenant/project, enable RLS, and update queries/events to include tenant context. | Findings Ledger Guild | Path: src/Findings/StellaOps.Findings.Ledger | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 48 — Authority-Backed Scopes & Tenancy Phase 2 | NOTIFY-TEN-48-001 | TODO | Tenant-scope notification rules, incidents, and outbound channels; update storage schemas. | Notifications Service Guild | Path: src/Notifier/StellaOps.Notifier | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 48 — Authority-Backed Scopes & Tenancy Phase 2 | ORCH-TEN-48-001 | TODO | Stamp jobs with tenant/project, set DB session context, and reject jobs without context. | Orchestrator Service Guild | Path: src/Orchestrator/StellaOps.Orchestrator | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 48 — Authority-Backed Scopes & Tenancy Phase 2 | POLICY-TEN-48-001 | TODO | Add `tenant_id`/`project_id` to policy data, enable Postgres RLS, and expose rationale IDs with tenant context. | Policy Guild | Path: src/Policy/StellaOps.Policy.Engine | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 48 — Authority-Backed Scopes & Tenancy Phase 2 | TASKRUN-TEN-48-001 | TODO | Propagate tenant/project to all steps, enforce object store prefix, and validate before execution. | Task Runner Guild | Path: src/TaskRunner/StellaOps.TaskRunner | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 48 — Authority-Backed Scopes & Tenancy Phase 2 | WEB-TEN-48-001 | TODO | Enforce tenant context through persistence (DB GUC, object store prefix), add request annotations, and emit audit events. | BE-Base Platform Guild | Path: src/Web/StellaOps.Web | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 49 — Authority-Backed Scopes & Tenancy Phase 3 | DOCS-TEN-49-001 | TODO | Publish `/docs/modules/cli/guides/authentication.md`, `/docs/api/authentication.md`, `/docs/policy/examples/abac-overlays.md`, `/docs/install/configuration-reference.md` updates (imposed rule). | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 49 — Authority-Backed Scopes & Tenancy Phase 3 | DEVOPS-TEN-49-001 | TODO | Implement audit log pipeline, monitor scope usage, chaos tests for JWKS outage, and tenant load/perf tests. | DevOps Guild | Path: ops/devops | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 49 — Authority-Backed Scopes & Tenancy Phase 3 | AUTH-TEN-49-001 | TODO | Implement service accounts, delegation tokens (`act` chain), per-tenant quotas, and audit log streaming. | Authority Core & Security Guild | Path: src/Authority/StellaOps.Authority | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 49 — Authority-Backed Scopes & Tenancy Phase 3 | CLI-TEN-49-001 | TODO | Add service account token minting, delegation, and `--impersonate` banner/controls. | DevEx/CLI Guild | Path: src/Cli/StellaOps.Cli | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 49 — Authority-Backed Scopes & Tenancy Phase 3 | WEB-TEN-49-001 | TODO | Integrate ABAC policy overlay (optional), expose audit API, and support service token minting endpoints. | BE-Base Platform Guild | Path: src/Web/StellaOps.Web | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 50 — Observability & Forensics Phase 1 – Baseline Telemetry | DOCS-INSTALL-50-001 | TODO | Add `/docs/install/telemetry-stack.md` for collector deployment and offline packaging. | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 50 — Observability & Forensics Phase 1 – Baseline Telemetry | DOCS-OBS-50-001 | BLOCKED (2025-10-26) | Author `/docs/observability/overview.md` with imposed rule banner and architecture context. | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 50 — Observability & Forensics Phase 1 – Baseline Telemetry | DOCS-OBS-50-002 | TODO | Document telemetry standards (fields, scrubbing, sampling) under `/docs/observability/telemetry-standards.md`. | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 50 — Observability & Forensics Phase 1 – Baseline Telemetry | DOCS-OBS-50-003 | TODO | Publish structured logging guide `/docs/observability/logging.md` with examples and imposed rule banner. | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 50 — Observability & Forensics Phase 1 – Baseline Telemetry | DOCS-OBS-50-004 | TODO | Publish tracing guide `/docs/observability/tracing.md` covering context propagation and sampling. | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 50 — Observability & Forensics Phase 1 – Baseline Telemetry | DOCS-SEC-OBS-50-001 | TODO | Update `/docs/security/redaction-and-privacy.md` for telemetry privacy controls. | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 50 — Observability & Forensics Phase 1 – Baseline Telemetry | DEVOPS-OBS-50-002 | DOING (2025-10-26) | Stand up multi-tenant metrics/logs/traces backends with retention and isolation. | DevOps Guild | Path: ops/devops | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 50 — Observability & Forensics Phase 1 – Baseline Telemetry | AUTH-OBS-50-001 | DOING (2025-11-01) | Introduce observability/timeline/evidence/attestation scopes and update discovery metadata. | Authority Core & Security Guild | Path: src/Authority/StellaOps.Authority | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 50 — Observability & Forensics Phase 1 – Baseline Telemetry | CLI-OBS-50-001 | TODO | Propagate trace headers from CLI commands and print correlation IDs. | DevEx/CLI Guild | Path: src/Cli/StellaOps.Cli | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 50 — Observability & Forensics Phase 1 – Baseline Telemetry | CONCELIER-OBS-50-001 | TODO | Replace ad-hoc logging with telemetry core across advisory ingestion/linking. | Concelier Core Guild | Path: src/Concelier/__Libraries/StellaOps.Concelier.Core | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 50 — Observability & Forensics Phase 1 – Baseline Telemetry | CONCELIER-WEB-OBS-50-001 | TODO | Adopt telemetry core in Concelier APIs and surface correlation IDs. | Concelier WebService Guild | Path: src/Concelier/StellaOps.Concelier.WebService | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 50 — Observability & Forensics Phase 1 – Baseline Telemetry | EXCITITOR-OBS-50-001 | TODO | Integrate telemetry core into VEX ingestion/linking with scope metadata. | Excititor Core Guild | Path: src/Excititor/__Libraries/StellaOps.Excititor.Core | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 50 — Observability & Forensics Phase 1 – Baseline Telemetry | EXCITITOR-WEB-OBS-50-001 | TODO | Add telemetry core to VEX APIs and emit trace headers. | Excititor WebService Guild | Path: src/Excititor/StellaOps.Excititor.WebService | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 50 — Observability & Forensics Phase 1 – Baseline Telemetry | EXPORT-OBS-50-001 | TODO | Enable telemetry core in export planner/workers capturing bundle metadata. | Exporter Service Guild | Path: src/ExportCenter/StellaOps.ExportCenter | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 50 — Observability & Forensics Phase 1 – Baseline Telemetry | LEDGER-OBS-50-001 | TODO | Wire telemetry core through ledger writer/projector for append/replay operations. | Findings Ledger Guild | Path: src/Findings/StellaOps.Findings.Ledger | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 50 — Observability & Forensics Phase 1 – Baseline Telemetry | ORCH-OBS-50-001 | TODO | Instrument orchestrator scheduler/control APIs with telemetry core spans/logs. | Orchestrator Service Guild | Path: src/Orchestrator/StellaOps.Orchestrator | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 50 — Observability & Forensics Phase 1 – Baseline Telemetry | POLICY-OBS-50-001 | BLOCKED (2025-11-26) | Telemetry/metrics contract not published for Policy Engine; awaiting observability spec. | Policy Guild | Path: src/Policy/StellaOps.Policy.Engine | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 50 — Observability & Forensics Phase 1 – Baseline Telemetry | TASKRUN-OBS-50-001 | TODO | Adopt telemetry core in Task Runner host and workers with scrubbed transcripts. | Task Runner Guild | Path: src/TaskRunner/StellaOps.TaskRunner | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 50 — Observability & Forensics Phase 1 – Baseline Telemetry | TELEMETRY-OBS-50-001 | TODO | Bootstrap telemetry core library with structured logging, OTLP exporters, and deterministic bootstrap. | Observability Guild | Path: src/Telemetry/StellaOps.Telemetry.Core | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 50 — Observability & Forensics Phase 1 – Baseline Telemetry | TELEMETRY-OBS-50-002 | TODO | Deliver context propagation middleware for HTTP/gRPC/jobs/CLI carrying trace + tenant metadata. | Observability Guild | Path: src/Telemetry/StellaOps.Telemetry.Core | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 50 — Observability & Forensics Phase 1 – Baseline Telemetry | WEB-OBS-50-001 | TODO | Integrate telemetry core into gateway and emit structured traces/logs for all routes. | BE-Base Platform Guild | Path: src/Web/StellaOps.Web | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 51 — Observability & Forensics Phase 2 – SLOs & Dashboards | DOCS-OBS-51-001 | TODO | Publish `/docs/observability/metrics-and-slos.md` with alert policies. | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 51 — Observability & Forensics Phase 2 – SLOs & Dashboards | DEVOPS-OBS-51-001 | TODO | Deploy SLO evaluator service, dashboards, and alert routing. | DevOps Guild | Path: ops/devops | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 51 — Observability & Forensics Phase 2 – SLOs & Dashboards | CLI-OBS-51-001 | TODO | Implement `stella obs top` streaming health metrics command. | DevEx/CLI Guild | Path: src/Cli/StellaOps.Cli | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 51 — Observability & Forensics Phase 2 – SLOs & Dashboards | CONCELIER-OBS-51-001 | TODO | Emit ingest latency metrics + SLO thresholds for advisories. | Concelier Core Guild | Path: src/Concelier/__Libraries/StellaOps.Concelier.Core | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 51 — Observability & Forensics Phase 2 – SLOs & Dashboards | EXCITITOR-OBS-51-001 | TODO | Provide VEX ingest metrics and SLO burn-rate automation. | Excititor Core Guild | Path: src/Excititor/__Libraries/StellaOps.Excititor.Core | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 51 — Observability & Forensics Phase 2 – SLOs & Dashboards | EXPORT-OBS-51-001 | TODO | Capture export planner/bundle latency metrics and SLOs. | Exporter Service Guild | Path: src/ExportCenter/StellaOps.ExportCenter | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 51 — Observability & Forensics Phase 2 – SLOs & Dashboards | LEDGER-OBS-51-001 | TODO | Add ledger/projector metrics dashboards and burn-rate policies. | Findings Ledger Guild | Path: src/Findings/StellaOps.Findings.Ledger | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 51 — Observability & Forensics Phase 2 – SLOs & Dashboards | NOTIFY-OBS-51-001 | TODO | Ingest SLO burn-rate webhooks and deliver observability alerts. | Notifications Service Guild | Path: src/Notifier/StellaOps.Notifier | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 51 — Observability & Forensics Phase 2 – SLOs & Dashboards | ORCH-OBS-51-001 | TODO | Publish orchestration metrics, SLOs, and burn-rate alerts. | Orchestrator Service Guild | Path: src/Orchestrator/StellaOps.Orchestrator | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 51 — Observability & Forensics Phase 2 – SLOs & Dashboards | POLICY-OBS-51-001 | BLOCKED (2025-11-26) | Blocked by OBS-50-001 telemetry contract. | Policy Guild | Path: src/Policy/StellaOps.Policy.Engine | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 51 — Observability & Forensics Phase 2 – SLOs & Dashboards | TASKRUN-OBS-51-001 | TODO | Emit task runner golden-signal metrics and SLO alerts. | Task Runner Guild | Path: src/TaskRunner/StellaOps.TaskRunner | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 51 — Observability & Forensics Phase 2 – SLOs & Dashboards | TELEMETRY-OBS-51-001 | TODO | Ship metrics helpers + exemplar guards for golden signals. | Observability Guild | Path: src/Telemetry/StellaOps.Telemetry.Core | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 51 — Observability & Forensics Phase 2 – SLOs & Dashboards | TELEMETRY-OBS-51-002 | TODO | Implement logging scrubbing and tenant debug override controls. | Security Guild | Path: src/Telemetry/StellaOps.Telemetry.Core | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 51 — Observability & Forensics Phase 2 – SLOs & Dashboards | WEB-OBS-51-001 | TODO | Expose `/obs/health` and `/obs/slo` aggregations for services. | BE-Base Platform Guild | Path: src/Web/StellaOps.Web | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 52 — Observability & Forensics Phase 3 – Timeline & Decision Logs | DOCS-CLI-OBS-52-001 | TODO | Document `stella obs` CLI commands and scripting patterns. | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 52 — Observability & Forensics Phase 3 – Timeline & Decision Logs | DOCS-CONSOLE-OBS-52-001 | TODO | Document Console observability hub and trace/log search workflows. | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 52 — Observability & Forensics Phase 3 – Timeline & Decision Logs | DOCS-CONSOLE-OBS-52-002 | TODO | Publish Console forensics/timeline guidance with imposed rule banner. | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 52 — Observability & Forensics Phase 3 – Timeline & Decision Logs | DEVOPS-OBS-52-001 | TODO | Configure streaming pipelines and schema validation for timeline events. | DevOps Guild | Path: ops/devops | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 52 — Observability & Forensics Phase 3 – Timeline & Decision Logs | CLI-OBS-52-001 | TODO | Add `stella obs trace` + log commands correlating timeline data. | DevEx/CLI Guild | Path: src/Cli/StellaOps.Cli | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 52 — Observability & Forensics Phase 3 – Timeline & Decision Logs | CONCELIER-OBS-52-001 | TODO | Emit advisory ingest/link timeline events with provenance metadata. | Concelier Core Guild | Path: src/Concelier/__Libraries/StellaOps.Concelier.Core | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 52 — Observability & Forensics Phase 3 – Timeline & Decision Logs | CONCELIER-WEB-OBS-52-001 | TODO (unblocked 2025-11-23) | Provide SSE bridge for advisory timeline events. | Concelier WebService Guild | Path: src/Concelier/StellaOps.Concelier.WebService | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 52 — Observability & Forensics Phase 3 – Timeline & Decision Logs | EXCITITOR-OBS-52-001 | TODO | Emit VEX ingest/link timeline events with justification info. | Excititor Core Guild | Path: src/Excititor/__Libraries/StellaOps.Excititor.Core | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 52 — Observability & Forensics Phase 3 – Timeline & Decision Logs | EXCITITOR-WEB-OBS-52-001 | TODO | Stream VEX timeline updates to clients with tenant filters. | Excititor WebService Guild | Path: src/Excititor/StellaOps.Excititor.WebService | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 52 — Observability & Forensics Phase 3 – Timeline & Decision Logs | EXPORT-OBS-52-001 | TODO | Publish export lifecycle events into timeline. | Exporter Service Guild | Path: src/ExportCenter/StellaOps.ExportCenter | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 52 — Observability & Forensics Phase 3 – Timeline & Decision Logs | LEDGER-OBS-52-001 | TODO | Record ledger append/projection events into timeline stream. | Findings Ledger Guild | Path: src/Findings/StellaOps.Findings.Ledger | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 52 — Observability & Forensics Phase 3 – Timeline & Decision Logs | ORCH-OBS-52-001 | TODO | Emit job lifecycle timeline events with tenant/project metadata. | Orchestrator Service Guild | Path: src/Orchestrator/StellaOps.Orchestrator | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 52 — Observability & Forensics Phase 3 – Timeline & Decision Logs | POLICY-OBS-52-001 | BLOCKED (2025-11-26) | Blocked by OBS-51-001 and missing timeline event spec. | Policy Guild | Path: src/Policy/StellaOps.Policy.Engine | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 52 — Observability & Forensics Phase 3 – Timeline & Decision Logs | TASKRUN-OBS-52-001 | TODO | Emit pack run timeline events and dedupe logic. | Task Runner Guild | Path: src/TaskRunner/StellaOps.TaskRunner | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 52 — Observability & Forensics Phase 3 – Timeline & Decision Logs | TIMELINE-OBS-52-001 | TODO | Bootstrap timeline indexer service and schema with RLS scaffolding. | Timeline Indexer Guild | Path: src/TimelineIndexer/StellaOps.TimelineIndexer | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 52 — Observability & Forensics Phase 3 – Timeline & Decision Logs | TIMELINE-OBS-52-002 | TODO | Implement event ingestion pipeline with ordering and dedupe. | Timeline Indexer Guild | Path: src/TimelineIndexer/StellaOps.TimelineIndexer | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 52 — Observability & Forensics Phase 3 – Timeline & Decision Logs | TIMELINE-OBS-52-003 | TODO | Expose timeline query APIs with tenant filters and pagination. | Timeline Indexer Guild | Path: src/TimelineIndexer/StellaOps.TimelineIndexer | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 52 — Observability & Forensics Phase 3 – Timeline & Decision Logs | TIMELINE-OBS-52-004 | TODO | Finalize RLS + scope enforcement and audit logging for timeline reads. | Security Guild | Path: src/TimelineIndexer/StellaOps.TimelineIndexer | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 52 — Observability & Forensics Phase 3 – Timeline & Decision Logs | WEB-OBS-52-001 | TODO | Provide trace/log proxy endpoints bridging to timeline + log store. | BE-Base Platform Guild | Path: src/Web/StellaOps.Web | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 53 — Observability & Forensics Phase 4 – Evidence Locker | DOCS-CLI-FORENSICS-53-001 | TODO | Document `stella forensic` CLI workflows with sample bundles. | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 53 — Observability & Forensics Phase 4 – Evidence Locker | DOCS-FORENSICS-53-001 | DONE (2025-11-26) | Publish `/docs/forensics/evidence-locker.md` covering bundles, WORM, legal holds. | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 53 — Observability & Forensics Phase 4 – Evidence Locker | DOCS-FORENSICS-53-003 | TODO | Publish `/docs/forensics/timeline.md` with schema and query examples. | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 53 — Observability & Forensics Phase 4 – Evidence Locker | DEVOPS-OBS-53-001 | TODO | Provision WORM-capable storage, legal hold automation, and backup/restore scripts for evidence locker. | DevOps Guild | Path: ops/devops | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 53 — Observability & Forensics Phase 4 – Evidence Locker | CLI-FORENSICS-53-001 | TODO | Ship `stella forensic snapshot` commands invoking evidence locker. | DevEx/CLI Guild | Path: src/Cli/StellaOps.Cli | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 53 — Observability & Forensics Phase 4 – Evidence Locker | CONCELIER-OBS-53-001 | TODO | Generate advisory evidence payloads (raw doc, linkset diff) for locker. | Concelier Core Guild | Path: src/Concelier/__Libraries/StellaOps.Concelier.Core | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 53 — Observability & Forensics Phase 4 – Evidence Locker | CONCELIER-WEB-OBS-53-001 | TODO | Add `/evidence/advisories/*` gateway endpoints consuming locker APIs. | Concelier WebService Guild | Path: src/Concelier/StellaOps.Concelier.WebService | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 53 — Observability & Forensics Phase 4 – Evidence Locker | EVID-OBS-53-001 | TODO | Bootstrap evidence locker service with schema, storage abstraction, and RLS. | Evidence Locker Guild | Path: src/EvidenceLocker/StellaOps.EvidenceLocker | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 53 — Observability & Forensics Phase 4 – Evidence Locker | EVID-OBS-53-002 | TODO | Implement bundle builders for evaluation, job, and export snapshots. | Evidence Locker Guild | Path: src/EvidenceLocker/StellaOps.EvidenceLocker | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 53 — Observability & Forensics Phase 4 – Evidence Locker | EVID-OBS-53-003 | TODO | Expose evidence APIs (create/get/verify/hold) with audit + quotas. | Evidence Locker Guild | Path: src/EvidenceLocker/StellaOps.EvidenceLocker | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 53 — Observability & Forensics Phase 4 – Evidence Locker | EXCITITOR-OBS-53-001 | TODO | Produce VEX evidence payloads and push to locker. | Excititor Core Guild | Path: src/Excititor/__Libraries/StellaOps.Excititor.Core | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 53 — Observability & Forensics Phase 4 – Evidence Locker | EXCITITOR-WEB-OBS-53-001 | TODO | Expose `/evidence/vex/*` endpoints retrieving locker bundles. | Excititor WebService Guild | Path: src/Excititor/StellaOps.Excititor.WebService | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 53 — Observability & Forensics Phase 4 – Evidence Locker | EXPORT-OBS-53-001 | TODO | Store export manifests + transcripts within evidence bundles. | Exporter Service Guild | Path: src/ExportCenter/StellaOps.ExportCenter | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 53 — Observability & Forensics Phase 4 – Evidence Locker | LEDGER-OBS-53-001 | TODO | Persist evidence bundle references alongside ledger entries and expose lookup API. | Findings Ledger Guild | Path: src/Findings/StellaOps.Findings.Ledger | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 53 — Observability & Forensics Phase 4 – Evidence Locker | ORCH-OBS-53-001 | TODO | Attach job capsules + manifests to evidence locker snapshots. | Orchestrator Service Guild | Path: src/Orchestrator/StellaOps.Orchestrator | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 53 — Observability & Forensics Phase 4 – Evidence Locker | POLICY-OBS-53-001 | BLOCKED (2025-11-26) | Evidence Locker bundle schema absent; depends on OBS-52-001. | Policy Guild | Path: src/Policy/StellaOps.Policy.Engine | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 53 — Observability & Forensics Phase 4 – Evidence Locker | TASKRUN-OBS-53-001 | TODO | Capture step transcripts and manifests into evidence bundles. | Task Runner Guild | Path: src/TaskRunner/StellaOps.TaskRunner | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 53 — Observability & Forensics Phase 4 – Evidence Locker | TIMELINE-OBS-53-001 | TODO | Link timeline events to evidence bundle digests and expose evidence lookup endpoint. | Timeline Indexer Guild | Path: src/TimelineIndexer/StellaOps.TimelineIndexer | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 54 — Observability & Forensics Phase 5 – Provenance & Verification | DOCS-FORENSICS-53-002 | TODO | Publish `/docs/forensics/provenance-attestation.md` covering signing + verification. | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 54 — Observability & Forensics Phase 5 – Provenance & Verification | DEVOPS-OBS-54-001 | TODO | Manage provenance signing infrastructure (KMS keys, timestamp authority) and CI verification. | DevOps Guild | Path: ops/devops | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 54 — Observability & Forensics Phase 5 – Provenance & Verification | CLI-FORENSICS-54-001 | TODO | Implement `stella forensic verify` command verifying bundles + signatures. | DevEx/CLI Guild | Path: src/Cli/StellaOps.Cli | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 54 — Observability & Forensics Phase 5 – Provenance & Verification | CLI-FORENSICS-54-002 | TODO | Add `stella forensic attest show` command with signer/timestamp details. | DevEx/CLI Guild | Path: src/Cli/StellaOps.Cli | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 54 — Observability & Forensics Phase 5 – Provenance & Verification | CONCELIER-OBS-54-001 | TODO | Sign advisory batches with DSSE attestations and expose verification. | Concelier Core Guild | Path: src/Concelier/__Libraries/StellaOps.Concelier.Core | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 54 — Observability & Forensics Phase 5 – Provenance & Verification | CONCELIER-WEB-OBS-54-001 | TODO | Add `/attestations/advisories/*` endpoints surfacing verification metadata. | Concelier WebService Guild | Path: src/Concelier/StellaOps.Concelier.WebService | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 54 — Observability & Forensics Phase 5 – Provenance & Verification | EVID-OBS-54-001 | TODO | Attach DSSE signing/timestamping to evidence bundles and emit timeline hooks. | Evidence Locker Guild | Path: src/EvidenceLocker/StellaOps.EvidenceLocker | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 54 — Observability & Forensics Phase 5 – Provenance & Verification | EVID-OBS-54-002 | TODO | Provide bundle packaging + offline verification fixtures. | Evidence Locker Guild | Path: src/EvidenceLocker/StellaOps.EvidenceLocker | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 54 — Observability & Forensics Phase 5 – Provenance & Verification | EXCITITOR-OBS-54-001 | TODO | Produce VEX batch attestations linking to timeline/ledger. | Excititor Core Guild | Path: src/Excititor/__Libraries/StellaOps.Excititor.Core | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 54 — Observability & Forensics Phase 5 – Provenance & Verification | EXCITITOR-WEB-OBS-54-001 | TODO | Expose `/attestations/vex/*` endpoints with verification summaries. | Excititor WebService Guild | Path: src/Excititor/StellaOps.Excititor.WebService | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 54 — Observability & Forensics Phase 5 – Provenance & Verification | EXPORT-OBS-54-001 | TODO | Produce export attestation manifests and CLI verification hooks. | Exporter Service Guild | Path: src/ExportCenter/StellaOps.ExportCenter | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 54 — Observability & Forensics Phase 5 – Provenance & Verification | ORCH-OBS-54-001 | TODO | Produce DSSE attestations for jobs and surface verification endpoint. | Orchestrator Service Guild | Path: src/Orchestrator/StellaOps.Orchestrator | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 54 — Observability & Forensics Phase 5 – Provenance & Verification | POLICY-OBS-54-001 | BLOCKED (2025-11-26) | Blocked by OBS-53-001; provenance/attestation contract missing. | Policy Guild | Path: src/Policy/StellaOps.Policy.Engine | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 54 — Observability & Forensics Phase 5 – Provenance & Verification | PROV-OBS-53-001 | TODO | Implement DSSE/SLSA models with deterministic serializer + test vectors. | Provenance Guild | Path: src/Provenance/StellaOps.Provenance.Attestation | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 54 — Observability & Forensics Phase 5 – Provenance & Verification | PROV-OBS-53-002 | TODO | Build signer abstraction (cosign/KMS/offline) with policy enforcement. | Provenance Guild | Path: src/Provenance/StellaOps.Provenance.Attestation | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 54 — Observability & Forensics Phase 5 – Provenance & Verification | PROV-OBS-54-001 | TODO | Deliver verification library validating DSSE signatures + Merkle roots. | Provenance Guild | Path: src/Provenance/StellaOps.Provenance.Attestation | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 54 — Observability & Forensics Phase 5 – Provenance & Verification | PROV-OBS-54-002 | TODO | Package provenance verification tool for CLI integration and offline use. | Provenance Guild, DevEx/CLI Guild | Path: src/Provenance/StellaOps.Provenance.Attestation | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 54 — Observability & Forensics Phase 5 – Provenance & Verification | TASKRUN-OBS-54-001 | TODO | Generate pack run attestations and link to timeline/evidence. | Task Runner Guild | Path: src/TaskRunner/StellaOps.TaskRunner | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 55 — Observability & Forensics Phase 6 – Incident Mode | DOCS-RUNBOOK-55-001 | TODO | Publish `/docs/runbooks/incidents.md` covering activation, escalation, and verification checklist. | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 55 — Observability & Forensics Phase 6 – Incident Mode | DEVOPS-OBS-55-001 | TODO | Automate incident mode activation via SLO alerts, retention override management, and reset job. | DevOps Guild | Path: ops/devops | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 55 — Observability & Forensics Phase 6 – Incident Mode | AUTH-OBS-55-001 | DOING (2025-11-01) | Enforce `obs:incident` scope with fresh-auth requirement and audit export for toggles. | Authority Core & Security Guild | Path: src/Authority/StellaOps.Authority | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 55 — Observability & Forensics Phase 6 – Incident Mode | CLI-OBS-55-001 | TODO | Ship `stella obs incident-mode` commands with safeguards and audit logging. | DevEx/CLI Guild | Path: src/Cli/StellaOps.Cli | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 55 — Observability & Forensics Phase 6 – Incident Mode | CONCELIER-OBS-55-001 | TODO | Increase sampling and raw payload retention under incident mode with redaction guards. | Concelier Core Guild | Path: src/Concelier/__Libraries/StellaOps.Concelier.Core | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 55 — Observability & Forensics Phase 6 – Incident Mode | CONCELIER-WEB-OBS-55-001 | TODO | Provide incident mode toggle endpoints and propagate to services. | Concelier WebService Guild | Path: src/Concelier/StellaOps.Concelier.WebService | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 55 — Observability & Forensics Phase 6 – Incident Mode | EVID-OBS-55-001 | TODO | Extend evidence retention + activation events for incident windows. | Evidence Locker Guild | Path: src/EvidenceLocker/StellaOps.EvidenceLocker | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 55 — Observability & Forensics Phase 6 – Incident Mode | EXCITITOR-OBS-55-001 | TODO | Enable incident sampling + retention overrides for VEX pipelines. | Excititor Core Guild | Path: src/Excititor/__Libraries/StellaOps.Excititor.Core | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 55 — Observability & Forensics Phase 6 – Incident Mode | EXCITITOR-WEB-OBS-55-001 | TODO | Add incident mode APIs for VEX services with audit + guardrails. | Excititor WebService Guild | Path: src/Excititor/StellaOps.Excititor.WebService | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 55 — Observability & Forensics Phase 6 – Incident Mode | EXPORT-OBS-55-001 | TODO | Increase export telemetry + debug retention during incident mode and emit events. | Exporter Service Guild | Path: src/ExportCenter/StellaOps.ExportCenter | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 55 — Observability & Forensics Phase 6 – Incident Mode | LEDGER-OBS-55-001 | TODO | Extend retention and diagnostics capture during incident mode. | Findings Ledger Guild | Path: src/Findings/StellaOps.Findings.Ledger | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 55 — Observability & Forensics Phase 6 – Incident Mode | NOTIFY-OBS-55-001 | TODO | Send incident mode start/stop notifications with quick links to evidence/timeline. | Notifications Service Guild | Path: src/Notifier/StellaOps.Notifier | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 55 — Observability & Forensics Phase 6 – Incident Mode | ORCH-OBS-55-001 | TODO | Increase telemetry + evidence capture during incident mode and emit activation events. | Orchestrator Service Guild | Path: src/Orchestrator/StellaOps.Orchestrator | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 55 — Observability & Forensics Phase 6 – Incident Mode | POLICY-OBS-55-001 | BLOCKED (2025-11-26) | Incident mode sampling spec not defined; depends on OBS-54-001. | Policy Guild | Path: src/Policy/StellaOps.Policy.Engine | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 55 — Observability & Forensics Phase 6 – Incident Mode | TASKRUN-OBS-55-001 | TODO | Capture extra debug data + notifications for incident mode runs. | Task Runner Guild | Path: src/TaskRunner/StellaOps.TaskRunner | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 55 — Observability & Forensics Phase 6 – Incident Mode | TELEMETRY-OBS-55-001 | TODO | Implement incident mode sampling toggle API with activation audit trail. | Observability Guild | Path: src/Telemetry/StellaOps.Telemetry.Core | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 55 — Observability & Forensics Phase 6 – Incident Mode | WEB-OBS-55-001 | TODO | Deliver `/obs/incident-mode` control endpoints with audit + retention previews. | BE-Base Platform Guild | Path: src/Web/StellaOps.Web | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 56 — Air-Gapped Mode Phase 1 – Sealing Foundations | DOCS-AIRGAP-56-001 | TODO | Publish `/docs/airgap/overview.md`. | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 56 — Air-Gapped Mode Phase 1 – Sealing Foundations | DOCS-AIRGAP-56-002 | TODO | Document sealing and egress controls. | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 56 — Air-Gapped Mode Phase 1 – Sealing Foundations | DOCS-AIRGAP-56-003 | TODO | Publish mirror bundles guide. | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 56 — Air-Gapped Mode Phase 1 – Sealing Foundations | DOCS-AIRGAP-56-004 | TODO | Publish bootstrap pack guide. | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 56 — Air-Gapped Mode Phase 1 – Sealing Foundations | DEVOPS-AIRGAP-56-001 | TODO | Publish deny-all egress policies and verification script for sealed environments. | DevOps Guild | Path: ops/devops | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 56 — Air-Gapped Mode Phase 1 – Sealing Foundations | DEVOPS-AIRGAP-56-002 | TODO | Provide bundle staging/import scripts for air-gapped object stores. | DevOps Guild | Path: ops/devops | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 56 — Air-Gapped Mode Phase 1 – Sealing Foundations | DEVOPS-AIRGAP-56-003 | TODO | Build Bootstrap Pack pipeline bundling images/charts with checksums. | DevOps Guild | Path: ops/devops | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 56 — Air-Gapped Mode Phase 1 – Sealing Foundations | AIRGAP-CTL-56-001 | TODO | Implement sealing state machine, persistence, and RBAC scopes for air-gapped status. | AirGap Controller Guild | Path: src/AirGap/StellaOps.AirGap.Controller | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 56 — Air-Gapped Mode Phase 1 – Sealing Foundations | AIRGAP-CTL-56-002 | TODO | Expose seal/status APIs with policy hash validation and staleness placeholders. | AirGap Controller Guild | Path: src/AirGap/StellaOps.AirGap.Controller | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 56 — Air-Gapped Mode Phase 1 – Sealing Foundations | AIRGAP-IMP-56-001 | TODO | Implement DSSE/TUF/Merkle verification helpers. | AirGap Importer Guild | Path: src/AirGap/StellaOps.AirGap.Importer | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 56 — Air-Gapped Mode Phase 1 – Sealing Foundations | AIRGAP-IMP-56-002 | TODO | Enforce root rotation policy for bundles. | AirGap Importer Guild | Path: src/AirGap/StellaOps.AirGap.Importer | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 56 — Air-Gapped Mode Phase 1 – Sealing Foundations | AIRGAP-POL-56-001 | TODO | Ship `EgressPolicy` facade with sealed/unsealed enforcement and remediation errors. | AirGap Policy Guild | Path: src/AirGap/StellaOps.AirGap.Policy | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 56 — Air-Gapped Mode Phase 1 – Sealing Foundations | AIRGAP-POL-56-002 | TODO | Deliver Roslyn analyzer blocking raw HTTP clients; wire into CI. | AirGap Policy Guild | Path: src/AirGap/StellaOps.AirGap.Policy | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 56 — Air-Gapped Mode Phase 1 – Sealing Foundations | CLI-AIRGAP-56-001 | TODO | Implement mirror create/verify and airgap verify commands. | DevEx/CLI Guild | Path: src/Cli/StellaOps.Cli | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 56 — Air-Gapped Mode Phase 1 – Sealing Foundations | CLI-OBS-50-001 | TODO | Ensure telemetry propagation for sealed logging. | DevEx/CLI Guild | Path: src/Cli/StellaOps.Cli | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 56 — Air-Gapped Mode Phase 1 – Sealing Foundations | CONCELIER-AIRGAP-56-001 | TODO | Add mirror ingestion adapters preserving source metadata. | Concelier Core Guild | Path: src/Concelier/__Libraries/StellaOps.Concelier.Core | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 56 — Air-Gapped Mode Phase 1 – Sealing Foundations | EXCITITOR-AIRGAP-56-001 | TODO | Add VEX mirror ingestion adapters. | Excititor Core Guild | Path: src/Excititor/__Libraries/StellaOps.Excititor.Core | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 56 — Air-Gapped Mode Phase 1 – Sealing Foundations | EXPORT-AIRGAP-56-001 | TODO | Extend export center to build mirror bundles. | Exporter Service Guild | Path: src/ExportCenter/StellaOps.ExportCenter | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 56 — Air-Gapped Mode Phase 1 – Sealing Foundations | MIRROR-CRT-56-001 | TODO | Build deterministic bundle assembler (advisories/vex/policy). | Mirror Creator Guild | Path: src/Mirror/StellaOps.Mirror.Creator | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 56 — Air-Gapped Mode Phase 1 – Sealing Foundations | ORCH-AIRGAP-56-001 | TODO | Validate jobs against sealed-mode restrictions. | Orchestrator Service Guild | Path: src/Orchestrator/StellaOps.Orchestrator | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 56 — Air-Gapped Mode Phase 1 – Sealing Foundations | POLICY-AIRGAP-56-001 | TODO | Accept policy packs from bundles with provenance tracking. | Policy Guild | Path: src/Policy/StellaOps.Policy.Engine | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 56 — Air-Gapped Mode Phase 1 – Sealing Foundations | TASKRUN-AIRGAP-56-001 | TODO | Enforce sealed-mode plan validation for network calls. | Task Runner Guild | Path: src/TaskRunner/StellaOps.TaskRunner | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 56 — Air-Gapped Mode Phase 1 – Sealing Foundations | TELEMETRY-OBS-56-001 | TODO | (Carry) Extend telemetry core with sealed-mode hooks before integration. | Observability Guild | Path: src/Telemetry/StellaOps.Telemetry.Core | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 56 — Air-Gapped Mode Phase 1 – Sealing Foundations | WEB-OBS-56-001 | TODO | Extend telemetry core usage for sealed-mode status surfaces (seal/unseal dashboards, drift signals). | BE-Base Platform Guild | Path: src/Web/StellaOps.Web | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 57 — Air-Gapped Mode Phase 2 – Mirror Bundles & Imports | DOCS-AIRGAP-57-001 | TODO | Publish staleness/time doc. | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 57 — Air-Gapped Mode Phase 2 – Mirror Bundles & Imports | DOCS-AIRGAP-57-002 | TODO | Publish console airgap doc. | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 57 — Air-Gapped Mode Phase 2 – Mirror Bundles & Imports | DOCS-AIRGAP-57-003 | TODO | Publish CLI airgap doc. | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 57 — Air-Gapped Mode Phase 2 – Mirror Bundles & Imports | DOCS-AIRGAP-57-004 | TODO | Publish airgap operations runbook. | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 57 — Air-Gapped Mode Phase 2 – Mirror Bundles & Imports | DEVOPS-AIRGAP-57-001 | TODO | Automate mirror bundle creation with approvals. | DevOps Guild | Path: ops/devops | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 57 — Air-Gapped Mode Phase 2 – Mirror Bundles & Imports | DEVOPS-AIRGAP-57-002 | TODO | Run sealed-mode CI suite enforcing zero egress. | DevOps Guild | Path: ops/devops | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 57 — Air-Gapped Mode Phase 2 – Mirror Bundles & Imports | AIRGAP-IMP-57-001 | TODO | Implement bundle catalog with RLS + migrations. | AirGap Importer Guild | Path: src/AirGap/StellaOps.AirGap.Importer | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 57 — Air-Gapped Mode Phase 2 – Mirror Bundles & Imports | AIRGAP-IMP-57-002 | TODO | Load artifacts into object store with checksum verification. | AirGap Importer Guild | Path: src/AirGap/StellaOps.AirGap.Importer | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 57 — Air-Gapped Mode Phase 2 – Mirror Bundles & Imports | AIRGAP-POL-57-001 | TODO | Adopt EgressPolicy in core services. | AirGap Policy Guild | Path: src/AirGap/StellaOps.AirGap.Policy | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 57 — Air-Gapped Mode Phase 2 – Mirror Bundles & Imports | AIRGAP-POL-57-002 | TODO | Enforce Task Runner job plan validation. | AirGap Policy Guild | Path: src/AirGap/StellaOps.AirGap.Policy | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 57 — Air-Gapped Mode Phase 2 – Mirror Bundles & Imports | AIRGAP-TIME-57-001 | TODO | Parse signed time tokens and expose normalized anchors. | AirGap Time Guild | Path: src/AirGap/StellaOps.AirGap.Time | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 57 — Air-Gapped Mode Phase 2 – Mirror Bundles & Imports | CLI-AIRGAP-57-001 | TODO | Complete airgap import CLI with diff preview. | DevEx/CLI Guild | Path: src/Cli/StellaOps.Cli | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 57 — Air-Gapped Mode Phase 2 – Mirror Bundles & Imports | CLI-AIRGAP-57-002 | TODO | Ship seal/status CLI commands. | DevEx/CLI Guild | Path: src/Cli/StellaOps.Cli | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 57 — Air-Gapped Mode Phase 2 – Mirror Bundles & Imports | EXPORT-AIRGAP-56-002 | TODO | Deliver bootstrap pack artifacts. | Exporter Service Guild | Path: src/ExportCenter/StellaOps.ExportCenter | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 57 — Air-Gapped Mode Phase 2 – Mirror Bundles & Imports | MIRROR-CRT-57-001 | TODO | Add OCI image support to mirror bundles. | Mirror Creator Guild | Path: src/Mirror/StellaOps.Mirror.Creator | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 57 — Air-Gapped Mode Phase 2 – Mirror Bundles & Imports | MIRROR-CRT-57-002 | TODO | Embed signed time anchors in bundles. | Mirror Creator Guild | Path: src/Mirror/StellaOps.Mirror.Creator | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 57 — Air-Gapped Mode Phase 2 – Mirror Bundles & Imports | NOTIFY-AIRGAP-56-001 | TODO | Lock notifications to enclave-safe channels. | Notifications Service Guild | Path: src/Notifier/StellaOps.Notifier | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 57 — Air-Gapped Mode Phase 2 – Mirror Bundles & Imports | ORCH-AIRGAP-56-002 | TODO | Integrate sealing status + staleness into scheduling. | Orchestrator Service Guild | Path: src/Orchestrator/StellaOps.Orchestrator | 2025-10-19 | | docs/implplan/archived/updates/tasks.md | Sprint 57 — Air-Gapped Mode Phase 2 – Mirror Bundles & Imports | TASKRUN-AIRGAP-56-002 | DONE (2025-12-03) | Provide bundle ingestion helper steps. | Task Runner Guild | Path: src/TaskRunner/StellaOps.TaskRunner | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 58 — Air-Gapped Mode Phase 3 – Staleness & Enforcement | DOCS-AIRGAP-58-001 | TODO | Publish degradation matrix doc. | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 58 — Air-Gapped Mode Phase 3 – Staleness & Enforcement | DOCS-AIRGAP-58-002 | TODO | Update trust & signing doc for DSSE/TUF roots. | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 58 — Air-Gapped Mode Phase 3 – Staleness & Enforcement | DOCS-AIRGAP-58-003 | TODO | Publish developer airgap contracts doc. | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 58 — Air-Gapped Mode Phase 3 – Staleness & Enforcement | DOCS-AIRGAP-58-004 | TODO | Document portable evidence workflows. | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 58 — Air-Gapped Mode Phase 3 – Staleness & Enforcement | AIRGAP-CTL-58-001 | TODO | Persist time anchor data and expose drift metrics. | AirGap Controller Guild | Path: src/AirGap/StellaOps.AirGap.Controller | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 58 — Air-Gapped Mode Phase 3 – Staleness & Enforcement | AIRGAP-POL-58-001 | TODO | Disable remote observability exporters in sealed mode. | AirGap Policy Guild | Path: src/AirGap/StellaOps.AirGap.Policy | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 58 — Air-Gapped Mode Phase 3 – Staleness & Enforcement | AIRGAP-POL-58-002 | TODO | Add CLI sealed-mode guard. | AirGap Policy Guild | Path: src/AirGap/StellaOps.AirGap.Policy | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 58 — Air-Gapped Mode Phase 3 – Staleness & Enforcement | AIRGAP-TIME-58-001 | TODO | Compute drift/staleness metrics and surface via controller status. | AirGap Time Guild | Path: src/AirGap/StellaOps.AirGap.Time | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 58 — Air-Gapped Mode Phase 3 – Staleness & Enforcement | AIRGAP-TIME-58-002 | TODO | Emit notifications/events for staleness budgets. | AirGap Time Guild | Path: src/AirGap/StellaOps.AirGap.Time | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 58 — Air-Gapped Mode Phase 3 – Staleness & Enforcement | CLI-AIRGAP-58-001 | TODO | Ship portable evidence export helper. | DevEx/CLI Guild | Path: src/Cli/StellaOps.Cli | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 58 — Air-Gapped Mode Phase 3 – Staleness & Enforcement | CONCELIER-AIRGAP-57-002 | TODO | Annotate advisories with staleness metadata. | Concelier Core Guild | Path: src/Concelier/__Libraries/StellaOps.Concelier.Core | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 58 — Air-Gapped Mode Phase 3 – Staleness & Enforcement | EXCITITOR-AIRGAP-57-002 | TODO | Annotate VEX statements with staleness metadata. | Excititor Core Guild | Path: src/Excititor/__Libraries/StellaOps.Excititor.Core | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 58 — Air-Gapped Mode Phase 3 – Staleness & Enforcement | EXPORT-AIRGAP-57-001 | TODO | Add portable evidence export integration. | Exporter Service Guild | Path: src/ExportCenter/StellaOps.ExportCenter | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 58 — Air-Gapped Mode Phase 3 – Staleness & Enforcement | NOTIFY-AIRGAP-57-001 | TODO | Notify on drift/staleness thresholds. | Notifications Service Guild | Path: src/Notifier/StellaOps.Notifier | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 58 — Air-Gapped Mode Phase 3 – Staleness & Enforcement | ORCH-AIRGAP-58-001 | TODO | Link import/export jobs to timeline/evidence. | Orchestrator Service Guild | Path: src/Orchestrator/StellaOps.Orchestrator | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 58 — Air-Gapped Mode Phase 3 – Staleness & Enforcement | POLICY-AIRGAP-57-002 | TODO | Show degradation fallback info in explain traces. | Policy Guild | Path: src/Policy/StellaOps.Policy.Engine | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 58 — Air-Gapped Mode Phase 3 – Staleness & Enforcement | TASKRUN-AIRGAP-58-001 | TODO | Capture import job evidence transcripts. | Task Runner Guild | Path: src/TaskRunner/StellaOps.TaskRunner | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 59 — Air-Gapped Mode Phase 4 – Deterministic Jobs & Enforcement | CONCELIER-WEB-AIRGAP-57-001 | TODO | Map sealed-mode violations to standard errors. | Concelier WebService Guild | Path: src/Concelier/StellaOps.Concelier.WebService | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 59 — Air-Gapped Mode Phase 4 – Deterministic Jobs & Enforcement | EXCITITOR-WEB-AIRGAP-57-001 | TODO | Map sealed-mode violations to standard errors. | Excititor WebService Guild | Path: src/Excititor/StellaOps.Excititor.WebService | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 59 — Air-Gapped Mode Phase 4 – Deterministic Jobs & Enforcement | EXPORT-AIRGAP-58-001 | TODO | Emit notifications/timeline for bundle readiness. | Exporter Service Guild | Path: src/ExportCenter/StellaOps.ExportCenter | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 59 — Air-Gapped Mode Phase 4 – Deterministic Jobs & Enforcement | LEDGER-AIRGAP-56-002 | TODO | Enforce staleness thresholds for findings exports. | Findings Ledger Guild | Path: src/Findings/StellaOps.Findings.Ledger | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 59 — Air-Gapped Mode Phase 4 – Deterministic Jobs & Enforcement | NOTIFY-AIRGAP-58-001 | TODO | Notify on portable evidence exports. | Notifications Service Guild | Path: src/Notifier/StellaOps.Notifier | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 59 — Air-Gapped Mode Phase 4 – Deterministic Jobs & Enforcement | ORCH-AIRGAP-57-001 | TODO | Automate mirror bundle job scheduling with audit provenance. | Orchestrator Service Guild | Path: src/Orchestrator/StellaOps.Orchestrator | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 59 — Air-Gapped Mode Phase 4 – Deterministic Jobs & Enforcement | POLICY-AIRGAP-57-001 | TODO | Enforce sealed-mode guardrails inside evaluation engine. | Policy Guild | Path: src/Policy/StellaOps.Policy.Engine | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 59 — Air-Gapped Mode Phase 4 – Deterministic Jobs & Enforcement | TASKRUN-AIRGAP-57-001 | TODO | Block execution when seal state mismatched; emit timeline events. | Task Runner Guild | Path: src/TaskRunner/StellaOps.TaskRunner | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 60 — Air-Gapped Mode Phase 5 – Evidence Portability & UX | DOCS-AIRGAP-58-004 | TODO | Document portable evidence workflows. | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 60 — Air-Gapped Mode Phase 5 – Evidence Portability & UX | CLI-AIRGAP-58-001 | TODO | Finalize portable evidence CLI workflow with verification. | DevEx/CLI Guild | Path: src/Cli/StellaOps.Cli | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 60 — Air-Gapped Mode Phase 5 – Evidence Portability & UX | CONCELIER-WEB-AIRGAP-58-001 | TODO | Emit timeline events for bundle imports. | Concelier WebService Guild | Path: src/Concelier/StellaOps.Concelier.WebService | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 60 — Air-Gapped Mode Phase 5 – Evidence Portability & UX | EVID-OBS-60-001 | TODO | Deliver portable evidence export flow for sealed environments with checksum manifest and offline verification script. | Evidence Locker Guild | Path: src/EvidenceLocker/StellaOps.EvidenceLocker | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 60 — Air-Gapped Mode Phase 5 – Evidence Portability & UX | EXCITITOR-WEB-AIRGAP-58-001 | TODO | Emit timeline events for VEX bundle imports. | Excititor WebService Guild | Path: src/Excititor/StellaOps.Excititor.WebService | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 60 — Air-Gapped Mode Phase 5 – Evidence Portability & UX | LEDGER-AIRGAP-57-001 | TODO | Link findings to portable evidence bundles. | Findings Ledger Guild | Path: src/Findings/StellaOps.Findings.Ledger | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 60 — Air-Gapped Mode Phase 5 – Evidence Portability & UX | NOTIFY-AIRGAP-58-001 | TODO | (Carry) Portable evidence notifications. | Notifications Service Guild | Path: src/Notifier/StellaOps.Notifier | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 60 — Air-Gapped Mode Phase 5 – Evidence Portability & UX | POLICY-AIRGAP-58-001 | TODO | Notify on stale policy packs and guide remediation. | Policy Guild | Path: src/Policy/StellaOps.Policy.Engine | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 61 — SDKs & OpenAPI Phase 1 – Contract Foundations | DOCS-OAS-61-001 | TODO | Publish `/docs/api/overview.md`. | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 61 — SDKs & OpenAPI Phase 1 – Contract Foundations | DOCS-OAS-61-002 | TODO | Publish `/docs/api/conventions.md`. | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 61 — SDKs & OpenAPI Phase 1 – Contract Foundations | DOCS-OAS-61-003 | TODO | Publish `/docs/api/versioning.md`. | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 61 — SDKs & OpenAPI Phase 1 – Contract Foundations | DEVOPS-OAS-61-001 | TODO | Add OAS lint/validation/diff stages to CI. | DevOps Guild | Path: ops/devops | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 61 — SDKs & OpenAPI Phase 1 – Contract Foundations | APIGOV-61-001 | TODO | Configure lint rules and CI enforcement. | API Governance Guild | Path: src/Api/StellaOps.Api.Governance | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 61 — SDKs & OpenAPI Phase 1 – Contract Foundations | APIGOV-61-002 | TODO | Enforce example coverage in CI. | API Governance Guild | Path: src/Api/StellaOps.Api.Governance | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 61 — SDKs & OpenAPI Phase 1 – Contract Foundations | OAS-61-001 | TODO | Scaffold per-service OpenAPI skeletons with shared components. | API Contracts Guild | Path: src/Api/StellaOps.Api.OpenApi | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 61 — SDKs & OpenAPI Phase 1 – Contract Foundations | OAS-61-002 | TODO | Build aggregate composer and integrate into CI. | API Contracts Guild | Path: src/Api/StellaOps.Api.OpenApi | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 61 — SDKs & OpenAPI Phase 1 – Contract Foundations | AUTH-OAS-61-001 | TODO | Document Authority authentication APIs in OAS. | Authority Core & Security Guild | Path: src/Authority/StellaOps.Authority | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 61 — SDKs & OpenAPI Phase 1 – Contract Foundations | AUTH-OAS-61-002 | TODO | Provide Authority discovery endpoint. | Authority Core & Security Guild | Path: src/Authority/StellaOps.Authority | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 61 — SDKs & OpenAPI Phase 1 – Contract Foundations | CONCELIER-OAS-61-001 | TODO | Update advisory OAS coverage. | Concelier Core Guild | Path: src/Concelier/__Libraries/StellaOps.Concelier.Core | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 61 — SDKs & OpenAPI Phase 1 – Contract Foundations | CONCELIER-OAS-61-002 | TODO | Populate advisory examples. | Concelier Core Guild | Path: src/Concelier/__Libraries/StellaOps.Concelier.Core | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 61 — SDKs & OpenAPI Phase 1 – Contract Foundations | CONCELIER-WEB-OAS-61-001 | TODO | Implement Concelier discovery endpoint. | Concelier WebService Guild | Path: src/Concelier/StellaOps.Concelier.WebService | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 61 — SDKs & OpenAPI Phase 1 – Contract Foundations | CONCELIER-WEB-OAS-61-002 | TODO | Standardize error envelope. | Concelier WebService Guild | Path: src/Concelier/StellaOps.Concelier.WebService | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 61 — SDKs & OpenAPI Phase 1 – Contract Foundations | EXCITITOR-OAS-61-001 | TODO | Update VEX OAS coverage. | Excititor Core Guild | Path: src/Excititor/__Libraries/StellaOps.Excititor.Core | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 61 — SDKs & OpenAPI Phase 1 – Contract Foundations | EXCITITOR-OAS-61-002 | TODO | Provide VEX examples. | Excititor Core Guild | Path: src/Excititor/__Libraries/StellaOps.Excititor.Core | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 61 — SDKs & OpenAPI Phase 1 – Contract Foundations | EXCITITOR-WEB-OAS-61-001 | TODO | Implement discovery endpoint. | Excititor WebService Guild | Path: src/Excititor/StellaOps.Excititor.WebService | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 61 — SDKs & OpenAPI Phase 1 – Contract Foundations | EXCITITOR-WEB-OAS-61-002 | TODO | Migrate errors to standard envelope. | Excititor WebService Guild | Path: src/Excititor/StellaOps.Excititor.WebService | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 61 — SDKs & OpenAPI Phase 1 – Contract Foundations | EXPORT-OAS-61-001 | TODO | Update Exporter spec coverage. | Exporter Service Guild | Path: src/ExportCenter/StellaOps.ExportCenter | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 61 — SDKs & OpenAPI Phase 1 – Contract Foundations | EXPORT-OAS-61-002 | TODO | Implement Exporter discovery endpoint. | Exporter Service Guild | Path: src/ExportCenter/StellaOps.ExportCenter | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 61 — SDKs & OpenAPI Phase 1 – Contract Foundations | LEDGER-OAS-61-001 | TODO | Expand Findings Ledger spec coverage. | Findings Ledger Guild | Path: src/Findings/StellaOps.Findings.Ledger | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 61 — SDKs & OpenAPI Phase 1 – Contract Foundations | LEDGER-OAS-61-002 | TODO | Provide ledger discovery endpoint. | Findings Ledger Guild | Path: src/Findings/StellaOps.Findings.Ledger | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 61 — SDKs & OpenAPI Phase 1 – Contract Foundations | NOTIFY-OAS-61-001 | TODO | Update notifier spec coverage. | Notifications Service Guild | Path: src/Notifier/StellaOps.Notifier | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 61 — SDKs & OpenAPI Phase 1 – Contract Foundations | NOTIFY-OAS-61-002 | TODO | Implement notifier discovery endpoint. | Notifications Service Guild | Path: src/Notifier/StellaOps.Notifier | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 61 — SDKs & OpenAPI Phase 1 – Contract Foundations | ORCH-OAS-61-001 | TODO | Extend Orchestrator spec coverage. | Orchestrator Service Guild | Path: src/Orchestrator/StellaOps.Orchestrator | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 61 — SDKs & OpenAPI Phase 1 – Contract Foundations | ORCH-OAS-61-002 | TODO | Provide orchestrator discovery endpoint. | Orchestrator Service Guild | Path: src/Orchestrator/StellaOps.Orchestrator | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 61 — SDKs & OpenAPI Phase 1 – Contract Foundations | TASKRUN-OAS-61-001 | TODO | Document Task Runner APIs in OAS. | Task Runner Guild | Path: src/TaskRunner/StellaOps.TaskRunner | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 61 — SDKs & OpenAPI Phase 1 – Contract Foundations | TASKRUN-OAS-61-002 | TODO | Expose Task Runner discovery endpoint. | Task Runner Guild | Path: src/TaskRunner/StellaOps.TaskRunner | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 61 — SDKs & OpenAPI Phase 1 – Contract Foundations | WEB-OAS-61-001 | TODO | Implement gateway discovery endpoint. | BE-Base Platform Guild | Path: src/Web/StellaOps.Web | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 61 — SDKs & OpenAPI Phase 1 – Contract Foundations | WEB-OAS-61-002 | TODO | Standardize error envelope across gateway. | BE-Base Platform Guild | Path: src/Web/StellaOps.Web | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 62 — SDKs & OpenAPI Phase 2 – Examples & Portal | DOCS-CONTRIB-62-001 | TODO | Publish API contracts contributing guide. | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 62 — SDKs & OpenAPI Phase 2 – Examples & Portal | DOCS-DEVPORT-62-001 | TODO | Document dev portal publishing. | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 62 — SDKs & OpenAPI Phase 2 – Examples & Portal | DOCS-OAS-62-001 | TODO | Deploy `/docs/api/reference/` generated site. | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 62 — SDKs & OpenAPI Phase 2 – Examples & Portal | DOCS-SDK-62-001 | TODO | Publish SDK overview + language guides. | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 62 — SDKs & OpenAPI Phase 2 – Examples & Portal | DOCS-SEC-62-001 | TODO | Update auth scopes documentation. | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 62 — SDKs & OpenAPI Phase 2 – Examples & Portal | DOCS-TEST-62-001 | TODO | Publish contract testing doc. | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 62 — SDKs & OpenAPI Phase 2 – Examples & Portal | APIGOV-62-001 | TODO | Implement compatibility diff tool. | API Governance Guild | Path: src/Api/StellaOps.Api.Governance | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 62 — SDKs & OpenAPI Phase 2 – Examples & Portal | OAS-62-001 | TODO | Populate examples for top endpoints. | API Contracts Guild | Path: src/Api/StellaOps.Api.OpenApi | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 62 — SDKs & OpenAPI Phase 2 – Examples & Portal | AUTH-OAS-62-001 | TODO | Provide SDK auth helpers/tests. | Authority Core & Security Guild | Path: src/Authority/StellaOps.Authority | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 62 — SDKs & OpenAPI Phase 2 – Examples & Portal | CLI-SDK-62-001 | TODO | Migrate CLI to official SDK. | DevEx/CLI Guild | Path: src/Cli/StellaOps.Cli | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 62 — SDKs & OpenAPI Phase 2 – Examples & Portal | CLI-SDK-62-002 | TODO | Update CLI error handling for new envelope. | DevEx/CLI Guild | Path: src/Cli/StellaOps.Cli | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 62 — SDKs & OpenAPI Phase 2 – Examples & Portal | CONCELIER-OAS-62-001 | TODO | Add SDK smoke tests for advisory APIs. | Concelier Core Guild | Path: src/Concelier/__Libraries/StellaOps.Concelier.Core | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 62 — SDKs & OpenAPI Phase 2 – Examples & Portal | CONCELIER-WEB-OAS-62-001 | TODO | Add advisory API examples. | Concelier WebService Guild | Path: src/Concelier/StellaOps.Concelier.WebService | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 62 — SDKs & OpenAPI Phase 2 – Examples & Portal | DEVPORT-62-001 | TODO | Build static generator with nav/search. | Developer Portal Guild | Path: src/DevPortal/StellaOps.DevPortal.Site | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 62 — SDKs & OpenAPI Phase 2 – Examples & Portal | DEVPORT-62-002 | TODO | Add schema viewer, examples, version selector. | Developer Portal Guild | Path: src/DevPortal/StellaOps.DevPortal.Site | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 62 — SDKs & OpenAPI Phase 2 – Examples & Portal | EXCITITOR-OAS-62-001 | TODO | Add SDK tests for VEX APIs. | Excititor Core Guild | Path: src/Excititor/__Libraries/StellaOps.Excititor.Core | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 62 — SDKs & OpenAPI Phase 2 – Examples & Portal | EXCITITOR-WEB-OAS-62-001 | TODO | Provide VEX API examples. | Excititor WebService Guild | Path: src/Excititor/StellaOps.Excititor.WebService | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 62 — SDKs & OpenAPI Phase 2 – Examples & Portal | EXPORT-OAS-62-001 | TODO | Ensure SDK streaming helpers for exports. | Exporter Service Guild | Path: src/ExportCenter/StellaOps.ExportCenter | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 62 — SDKs & OpenAPI Phase 2 – Examples & Portal | LEDGER-OAS-62-001 | TODO | Provide SDK tests for ledger APIs. | Findings Ledger Guild | Path: src/Findings/StellaOps.Findings.Ledger | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 62 — SDKs & OpenAPI Phase 2 – Examples & Portal | NOTIFY-OAS-62-001 | TODO | Provide SDK examples for notifier APIs. | Notifications Service Guild | Path: src/Notifier/StellaOps.Notifier | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 62 — SDKs & OpenAPI Phase 2 – Examples & Portal | SDKGEN-62-001 | TODO | Establish generator framework. | SDK Generator Guild | Path: src/Sdk/StellaOps.Sdk.Generator | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 62 — SDKs & OpenAPI Phase 2 – Examples & Portal | SDKGEN-62-002 | TODO | Implement shared post-processing helpers. | SDK Generator Guild | Path: src/Sdk/StellaOps.Sdk.Generator | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 62 — SDKs & OpenAPI Phase 2 – Examples & Portal | TASKRUN-OAS-62-001 | TODO | Provide SDK examples for pack runs. | Task Runner Guild | Path: src/TaskRunner/StellaOps.TaskRunner | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 62 — SDKs & OpenAPI Phase 2 – Examples & Portal | WEB-OAS-62-001 | TODO | Align pagination/idempotency behaviors. | BE-Base Platform Guild | Path: src/Web/StellaOps.Web | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 62 — SDKs & OpenAPI Phase 2 – Examples & Portal | CONTR-62-001 | TODO | Generate mock server fixtures. | Contract Testing Guild | Path: test/contract | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 62 — SDKs & OpenAPI Phase 2 – Examples & Portal | CONTR-62-002 | TODO | Integrate mock server into CI. | Contract Testing Guild | Path: test/contract | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 63 — SDKs & OpenAPI Phase 3 – SDK Alpha & Try-It | DOCS-TEST-62-001 | TODO | (Carry) ensure contract testing doc final. | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 63 — SDKs & OpenAPI Phase 3 – SDK Alpha & Try-It | APIGOV-63-001 | TODO | Integrate compatibility diff gating. | API Governance Guild | Path: src/Api/StellaOps.Api.Governance | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 63 — SDKs & OpenAPI Phase 3 – SDK Alpha & Try-It | OAS-63-001 | TODO | Compatibility diff support. | API Contracts Guild | Path: src/Api/StellaOps.Api.OpenApi | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 63 — SDKs & OpenAPI Phase 3 – SDK Alpha & Try-It | OAS-63-002 | TODO | Define discovery schema metadata. | API Contracts Guild | Path: src/Api/StellaOps.Api.OpenApi | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 63 — SDKs & OpenAPI Phase 3 – SDK Alpha & Try-It | CLI-SDK-63-001 | TODO | Add CLI spec download command. | DevEx/CLI Guild | Path: src/Cli/StellaOps.Cli | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 63 — SDKs & OpenAPI Phase 3 – SDK Alpha & Try-It | DEVPORT-63-001 | TODO | Add Try-It console. | Developer Portal Guild | Path: src/DevPortal/StellaOps.DevPortal.Site | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 63 — SDKs & OpenAPI Phase 3 – SDK Alpha & Try-It | DEVPORT-63-002 | TODO | Embed SDK snippets/quick starts. | Developer Portal Guild | Path: src/DevPortal/StellaOps.DevPortal.Site | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 63 — SDKs & OpenAPI Phase 3 – SDK Alpha & Try-It | SDKGEN-63-001 | TODO | Release TypeScript SDK alpha. | SDK Generator Guild | Path: src/Sdk/StellaOps.Sdk.Generator | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 63 — SDKs & OpenAPI Phase 3 – SDK Alpha & Try-It | SDKGEN-63-002 | TODO | Release Python SDK alpha. | SDK Generator Guild | Path: src/Sdk/StellaOps.Sdk.Generator | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 63 — SDKs & OpenAPI Phase 3 – SDK Alpha & Try-It | SDKGEN-63-003 | TODO | Release Go SDK alpha. | SDK Generator Guild | Path: src/Sdk/StellaOps.Sdk.Generator | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 63 — SDKs & OpenAPI Phase 3 – SDK Alpha & Try-It | SDKGEN-63-004 | TODO | Release Java SDK alpha. | SDK Generator Guild | Path: src/Sdk/StellaOps.Sdk.Generator | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 63 — SDKs & OpenAPI Phase 3 – SDK Alpha & Try-It | SDKREL-63-001 | TODO | Configure SDK release pipelines. | SDK Release Guild | Path: src/Sdk/StellaOps.Sdk.Release | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 63 — SDKs & OpenAPI Phase 3 – SDK Alpha & Try-It | SDKREL-63-002 | TODO | Automate changelogs from OAS diffs. | SDK Release Guild | Path: src/Sdk/StellaOps.Sdk.Release | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 63 — SDKs & OpenAPI Phase 3 – SDK Alpha & Try-It | CONTR-63-001 | TODO | Build replay harness for drift detection. | Contract Testing Guild | Path: test/contract | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 63 — SDKs & OpenAPI Phase 3 – SDK Alpha & Try-It | CONTR-63-002 | TODO | Emit contract testing metrics. | Contract Testing Guild | Path: test/contract | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 64 — SDKs & OpenAPI Phase 4 – Harden & Offline Bundles | DOCS-AIRGAP-DEVPORT-64-001 | TODO | Document devportal offline usage. | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 64 — SDKs & OpenAPI Phase 4 – Harden & Offline Bundles | DEVOPS-DEVPORT-63-001 | TODO | Automate developer portal pipeline. | DevOps Guild | Path: ops/devops | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 64 — SDKs & OpenAPI Phase 4 – Harden & Offline Bundles | DEVOPS-DEVPORT-64-001 | TODO | Schedule offline bundle builds. | DevOps Guild | Path: ops/devops | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 64 — SDKs & OpenAPI Phase 4 – Harden & Offline Bundles | DEVPORT-64-001 | TODO | Offline portal build. | Developer Portal Guild | Path: src/DevPortal/StellaOps.DevPortal.Site | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 64 — SDKs & OpenAPI Phase 4 – Harden & Offline Bundles | DEVPORT-64-002 | TODO | Add accessibility/performance checks. | Developer Portal Guild | Path: src/DevPortal/StellaOps.DevPortal.Site | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 64 — SDKs & OpenAPI Phase 4 – Harden & Offline Bundles | DVOFF-64-001 | TODO | Implement devportal offline export job. | DevPortal Offline Guild | Path: src/ExportCenter/StellaOps.ExportCenter.DevPortalOffline | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 64 — SDKs & OpenAPI Phase 4 – Harden & Offline Bundles | DVOFF-64-002 | TODO | Provide verification CLI. | DevPortal Offline Guild | Path: src/ExportCenter/StellaOps.ExportCenter.DevPortalOffline | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 64 — SDKs & OpenAPI Phase 4 – Harden & Offline Bundles | SDKGEN-64-001 | TODO | Migrate CLI to SDK. | SDK Generator Guild | Path: src/Sdk/StellaOps.Sdk.Generator | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 64 — SDKs & OpenAPI Phase 4 – Harden & Offline Bundles | SDKGEN-64-002 | TODO | Integrate SDKs into Console. | SDK Generator Guild | Path: src/Sdk/StellaOps.Sdk.Generator | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 64 — SDKs & OpenAPI Phase 4 – Harden & Offline Bundles | SDKREL-64-001 | TODO | Hook SDK releases to Notifications. | SDK Release Guild | Path: src/Sdk/StellaOps.Sdk.Release | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 64 — SDKs & OpenAPI Phase 4 – Harden & Offline Bundles | SDKREL-64-002 | TODO | Produce devportal offline bundle. | SDK Release Guild | Path: src/Sdk/StellaOps.Sdk.Release | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 65 — SDKs & OpenAPI Phase 5 – Deprecation & Notifications | DOCS-AIRGAP-DEVPORT-64-001 | TODO | (Carry) ensure offline doc published; update as necessary. | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 65 — SDKs & OpenAPI Phase 5 – Deprecation & Notifications | APIGOV-63-001 | TODO | (Carry) compatibility gating monitoring. | API Governance Guild | Path: src/Api/StellaOps.Api.Governance | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 65 — SDKs & OpenAPI Phase 5 – Deprecation & Notifications | AUTH-OAS-63-001 | DONE (2025-11-01) | Deprecation headers for auth endpoints. | Authority Core & Security Guild | Path: src/Authority/StellaOps.Authority | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 65 — SDKs & OpenAPI Phase 5 – Deprecation & Notifications | CLI-SDK-64-001 | TODO | SDK update awareness command. | DevEx/CLI Guild | Path: src/Cli/StellaOps.Cli | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 65 — SDKs & OpenAPI Phase 5 – Deprecation & Notifications | CONCELIER-OAS-63-001 | TODO | Deprecation metadata for Concelier APIs. | Concelier Core Guild | Path: src/Concelier/__Libraries/StellaOps.Concelier.Core | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 65 — SDKs & OpenAPI Phase 5 – Deprecation & Notifications | EXCITITOR-OAS-63-001 | TODO | Deprecation metadata for VEX APIs. | Excititor Core Guild | Path: src/Excititor/__Libraries/StellaOps.Excititor.Core | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 65 — SDKs & OpenAPI Phase 5 – Deprecation & Notifications | EXPORT-OAS-63-001 | TODO | Deprecation headers for exporter APIs. | Exporter Service Guild | Path: src/ExportCenter/StellaOps.ExportCenter | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 65 — SDKs & OpenAPI Phase 5 – Deprecation & Notifications | LEDGER-OAS-63-001 | TODO | Deprecation headers for ledger APIs. | Findings Ledger Guild | Path: src/Findings/StellaOps.Findings.Ledger | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 65 — SDKs & OpenAPI Phase 5 – Deprecation & Notifications | NOTIFY-OAS-63-001 | TODO | Emit deprecation notifications. | Notifications Service Guild | Path: src/Notifier/StellaOps.Notifier | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 65 — SDKs & OpenAPI Phase 5 – Deprecation & Notifications | ORCH-OAS-63-001 | TODO | Add orchestrator deprecation headers. | Orchestrator Service Guild | Path: src/Orchestrator/StellaOps.Orchestrator | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 65 — SDKs & OpenAPI Phase 5 – Deprecation & Notifications | SDKREL-64-001 | TODO | Production rollout of notifications feed. | SDK Release Guild | Path: src/Sdk/StellaOps.Sdk.Release | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 65 — SDKs & OpenAPI Phase 5 – Deprecation & Notifications | TASKRUN-OAS-63-001 | TODO | Add Task Runner deprecation headers. | Task Runner Guild | Path: src/TaskRunner/StellaOps.TaskRunner | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 65 — SDKs & OpenAPI Phase 5 – Deprecation & Notifications | WEB-OAS-63-001 | TODO | Implement deprecation headers in gateway. | BE-Base Platform Guild | Path: src/Web/StellaOps.Web | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 66 — Risk Profiles Phase 1 – Foundations | DOCS-RISK-66-001 | TODO | Publish `/docs/risk/overview.md`. | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 66 — Risk Profiles Phase 1 – Foundations | DOCS-RISK-66-002 | TODO | Publish `/docs/risk/profiles.md`. | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 66 — Risk Profiles Phase 1 – Foundations | DOCS-RISK-66-003 | TODO | Publish `/docs/risk/factors.md`. | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 66 — Risk Profiles Phase 1 – Foundations | DOCS-RISK-66-004 | TODO | Publish `/docs/risk/formulas.md`. | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 66 — Risk Profiles Phase 1 – Foundations | CLI-RISK-66-001 | TODO | Implement CLI profile management commands. | DevEx/CLI Guild | Path: src/Cli/StellaOps.Cli | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 66 — Risk Profiles Phase 1 – Foundations | CLI-RISK-66-002 | TODO | Implement CLI simulation command. | DevEx/CLI Guild | Path: src/Cli/StellaOps.Cli | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 66 — Risk Profiles Phase 1 – Foundations | CONCELIER-RISK-66-001 | TODO | Expose CVSS/KEV provider data. | Concelier Core Guild | Path: src/Concelier/__Libraries/StellaOps.Concelier.Core | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 66 — Risk Profiles Phase 1 – Foundations | CONCELIER-RISK-66-002 | TODO | Provide fix availability signals. | Concelier Core Guild | Path: src/Concelier/__Libraries/StellaOps.Concelier.Core | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 66 — Risk Profiles Phase 1 – Foundations | EXCITITOR-RISK-66-001 | TODO | Supply VEX gating data to risk engine. | Excititor Core Guild | Path: src/Excititor/__Libraries/StellaOps.Excititor.Core | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 66 — Risk Profiles Phase 1 – Foundations | EXCITITOR-RISK-66-002 | TODO | Provide reachability inputs. | Excititor Core Guild | Path: src/Excititor/__Libraries/StellaOps.Excititor.Core | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 66 — Risk Profiles Phase 1 – Foundations | LEDGER-RISK-66-001 | TODO | Add risk scoring columns/indexes. | Findings Ledger Guild | Path: src/Findings/StellaOps.Findings.Ledger | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 66 — Risk Profiles Phase 1 – Foundations | LEDGER-RISK-66-002 | TODO | Implement deterministic scoring upserts. | Findings Ledger Guild | Path: src/Findings/StellaOps.Findings.Ledger | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 66 — Risk Profiles Phase 1 – Foundations | NOTIFY-RISK-66-001 | TODO | Create risk severity alert templates. | Notifications Service Guild | Path: src/Notifier/StellaOps.Notifier | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 66 — Risk Profiles Phase 1 – Foundations | POLICY-RISK-66-003 | BLOCKED (2025-11-26) | Reachability inputs (80-001) and engine config contract not defined; cannot integrate. | Policy Guild | Path: src/Policy/StellaOps.Policy.Engine | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 66 — Risk Profiles Phase 1 – Foundations | POLICY-RISK-66-001 | DONE (2025-11-22) | Deliver RiskProfile schema + validators. | Risk Profile Schema Guild | Path: src/Policy/StellaOps.Policy.RiskProfile | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 66 — Risk Profiles Phase 1 – Foundations | POLICY-RISK-66-002 | DONE (2025-11-26) | Deterministic inheritance/merge + hashing delivered. | Risk Profile Schema Guild | Path: src/Policy/StellaOps.Policy.RiskProfile | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 66 — Risk Profiles Phase 1 – Foundations | POLICY-RISK-66-004 | BLOCKED (2025-11-26) | Blocked by 66-003; Policy libraries need config shape. | Policy Guild | Path: src/Policy/__Libraries/StellaOps.Policy | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 66 — Risk Profiles Phase 1 – Foundations | RISK-ENGINE-66-001 | DONE (2025-11-25) | Deterministic risk queue/worker/registry scaffolded. | Risk Engine Guild | Path: src/RiskEngine/StellaOps.RiskEngine | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 66 — Risk Profiles Phase 1 – Foundations | RISK-ENGINE-66-002 | DONE (2025-11-25) | Transforms/clamping/gating implemented. | Risk Engine Guild | Path: src/RiskEngine/StellaOps.RiskEngine | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 66 — Risk Profiles Phase 1 – Foundations | WEB-RISK-66-001 | TODO | Expose risk API routing in gateway. | BE-Base Platform Guild | Path: src/Web/StellaOps.Web | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 66 — Risk Profiles Phase 1 – Foundations | WEB-RISK-66-002 | TODO | Handle explainability downloads. | BE-Base Platform Guild | Path: src/Web/StellaOps.Web | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 67 — Risk Profiles Phase 2 – Providers & Lifecycle | DOCS-RISK-67-001 | TODO | Publish explainability doc. | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 67 — Risk Profiles Phase 2 – Providers & Lifecycle | DOCS-RISK-67-002 | TODO | Publish risk API doc. | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 67 — Risk Profiles Phase 2 – Providers & Lifecycle | DOCS-RISK-67-003 | TODO | Publish console risk UI doc. | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 67 — Risk Profiles Phase 2 – Providers & Lifecycle | DOCS-RISK-67-004 | TODO | Publish CLI risk doc. | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 67 — Risk Profiles Phase 2 – Providers & Lifecycle | CLI-RISK-67-001 | TODO | Provide risk results query command. | DevEx/CLI Guild | Path: src/Cli/StellaOps.Cli | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 67 — Risk Profiles Phase 2 – Providers & Lifecycle | CONCELIER-RISK-67-001 | TODO | Add source consensus metrics. | Concelier Core Guild | Path: src/Concelier/__Libraries/StellaOps.Concelier.Core | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 67 — Risk Profiles Phase 2 – Providers & Lifecycle | EXCITITOR-RISK-67-001 | TODO | Add VEX explainability metadata. | Excititor Core Guild | Path: src/Excititor/__Libraries/StellaOps.Excititor.Core | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 67 — Risk Profiles Phase 2 – Providers & Lifecycle | NOTIFY-RISK-67-001 | TODO | Notify on profile publish/deprecate. | Notifications Service Guild | Path: src/Notifier/StellaOps.Notifier | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 67 — Risk Profiles Phase 2 – Providers & Lifecycle | NOTIFY-RISK-68-001 | TODO | (Prep) risk routing settings seeds. | Notifications Service Guild | Path: src/Notifier/StellaOps.Notifier | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 67 — Risk Profiles Phase 2 – Providers & Lifecycle | POLICY-RISK-67-001 | BLOCKED (2025-11-26) | Depends on 66-003/66-004; reachability/config missing. | Policy Guild | Path: src/Policy/StellaOps.Policy.Engine | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 67 — Risk Profiles Phase 2 – Providers & Lifecycle | POLICY-RISK-67-002 | BLOCKED (2025-11-26) | Risk profile lifecycle contract/schema not published. | Policy Guild | Path: src/Policy/StellaOps.Policy.Engine | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 67 — Risk Profiles Phase 2 – Providers & Lifecycle | POLICY-RISK-67-001 | BLOCKED (2025-11-26) | Depends on 66-003/66-004; reachability/config missing. | Risk Profile Schema Guild | Path: src/Policy/StellaOps.Policy.RiskProfile | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 67 — Risk Profiles Phase 2 – Providers & Lifecycle | POLICY-RISK-67-002 | BLOCKED (2025-11-26) | Risk profile lifecycle contract/schema not published. | Risk Profile Schema Guild | Path: src/Policy/StellaOps.Policy.RiskProfile | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 67 — Risk Profiles Phase 2 – Providers & Lifecycle | POLICY-RISK-67-003 | BLOCKED (2025-11-26) | Blocked by 67-002 contract + simulation inputs. | Policy Guild | Path: src/Policy/__Libraries/StellaOps.Policy | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 67 — Risk Profiles Phase 2 – Providers & Lifecycle | RISK-ENGINE-67-001 | DONE (2025-11-25) | Integrated CVSS/KEV providers. | Risk Engine Guild | Path: src/RiskEngine/StellaOps.RiskEngine | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 67 — Risk Profiles Phase 2 – Providers & Lifecycle | RISK-ENGINE-67-002 | DONE (2025-11-25) | Added VEX gate provider. | Risk Engine Guild | Path: src/RiskEngine/StellaOps.RiskEngine | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 67 — Risk Profiles Phase 2 – Providers & Lifecycle | RISK-ENGINE-67-003 | DONE (2025-11-25) | Fix availability/criticality/exposure providers added. | Risk Engine Guild | Path: src/RiskEngine/StellaOps.RiskEngine | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 67 — Risk Profiles Phase 2 – Providers & Lifecycle | WEB-RISK-67-001 | TODO | Provide risk status endpoint. | BE-Base Platform Guild | Path: src/Web/StellaOps.Web | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 68 — Risk Profiles Phase 3 – APIs & Ledger | DOCS-RISK-68-001 | TODO | Publish risk bundle doc. | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 68 — Risk Profiles Phase 3 – APIs & Ledger | DOCS-RISK-68-002 | TODO | Update AOC invariants doc. | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 68 — Risk Profiles Phase 3 – APIs & Ledger | CLI-RISK-68-001 | TODO | Add risk bundle verification command. | DevEx/CLI Guild | Path: src/Cli/StellaOps.Cli | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 68 — Risk Profiles Phase 3 – APIs & Ledger | LEDGER-RISK-67-001 | TODO | Provide scored findings query API. | Findings Ledger Guild | Path: src/Findings/StellaOps.Findings.Ledger | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 68 — Risk Profiles Phase 3 – APIs & Ledger | LEDGER-RISK-68-001 | TODO | Enable scored findings export. | Findings Ledger Guild | Path: src/Findings/StellaOps.Findings.Ledger | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 68 — Risk Profiles Phase 3 – APIs & Ledger | NOTIFY-RISK-68-001 | TODO | Configure risk notification routing UI/logic. | Notifications Service Guild | Path: src/Notifier/StellaOps.Notifier | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 68 — Risk Profiles Phase 3 – APIs & Ledger | POLICY-RISK-68-001 | BLOCKED (2025-11-26) | Simulation API blocked by 67-003 outputs and Policy Studio contract. | Policy Guild | Path: src/Policy/StellaOps.Policy.Engine | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 68 — Risk Profiles Phase 3 – APIs & Ledger | POLICY-RISK-68-002 | BLOCKED (2025-11-26) | Blocked until overrides/export signing rules are agreed. | Policy Guild | Path: src/Policy/__Libraries/StellaOps.Policy | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 68 — Risk Profiles Phase 3 – APIs & Ledger | RISK-ENGINE-68-001 | DONE (2025-11-25) | Persist scoring results & explanations. | Risk Engine Guild | Path: src/RiskEngine/StellaOps.RiskEngine | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 68 — Risk Profiles Phase 3 – APIs & Ledger | RISK-ENGINE-68-002 | DONE (2025-11-25) | Expose jobs/results/explanations APIs. | Risk Engine Guild | Path: src/RiskEngine/StellaOps.RiskEngine | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 68 — Risk Profiles Phase 3 – APIs & Ledger | WEB-RISK-68-001 | TODO | Emit severity transition events via gateway. | BE-Base Platform Guild | Path: src/Web/StellaOps.Web | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 69 — Risk Profiles Phase 4 – Simulation & Reporting | DOCS-RISK-67-001..004 | TODO | (Carry) ensure docs updated from simulation release. | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 69 — Risk Profiles Phase 4 – Simulation & Reporting | RISK-BUNDLE-69-001 | TODO | Build risk bundle. | Risk Bundle Export Guild | Path: src/ExportCenter/StellaOps.ExportCenter.RiskBundles | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 69 — Risk Profiles Phase 4 – Simulation & Reporting | RISK-BUNDLE-69-002 | TODO | Integrate bundle into pipelines. | Risk Bundle Export Guild | Path: src/ExportCenter/StellaOps.ExportCenter.RiskBundles | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 69 — Risk Profiles Phase 4 – Simulation & Reporting | EXPORT-RISK-69-002 | TODO | Enable simulation report exports. | Exporter Service Guild | Path: src/ExportCenter/StellaOps.ExportCenter | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 69 — Risk Profiles Phase 4 – Simulation & Reporting | NOTIFY-RISK-66-001 | TODO | (Completion) finalize severity alert templates. | Notifications Service Guild | Path: src/Notifier/StellaOps.Notifier | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 69 — Risk Profiles Phase 4 – Simulation & Reporting | RISK-ENGINE-69-001 | TODO | Implement simulation mode. | Risk Engine Guild | Path: src/RiskEngine/StellaOps.RiskEngine | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 69 — Risk Profiles Phase 4 – Simulation & Reporting | RISK-ENGINE-69-002 | TODO | Add telemetry/metrics dashboards. | Risk Engine Guild | Path: src/RiskEngine/StellaOps.RiskEngine | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 70 — Risk Profiles Phase 5 – Air-Gap & Advanced Factors | DOCS-RISK-68-001 | TODO | (Carry) finalize risk bundle doc after verification CLI. | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 70 — Risk Profiles Phase 5 – Air-Gap & Advanced Factors | RISK-BUNDLE-70-001 | TODO | Provide bundle verification CLI. | Risk Bundle Export Guild | Path: src/ExportCenter/StellaOps.ExportCenter.RiskBundles | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 70 — Risk Profiles Phase 5 – Air-Gap & Advanced Factors | RISK-BUNDLE-70-002 | TODO | Publish documentation. | Risk Bundle Export Guild | Path: src/ExportCenter/StellaOps.ExportCenter.RiskBundles | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 70 — Risk Profiles Phase 5 – Air-Gap & Advanced Factors | EXPORT-RISK-70-001 | TODO | Integrate risk bundle into offline kit. | Exporter Service Guild | Path: src/ExportCenter/StellaOps.ExportCenter | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 70 — Risk Profiles Phase 5 – Air-Gap & Advanced Factors | NOTIFY-RISK-68-001 | TODO | Finalize risk alert routing UI. | Notifications Service Guild | Path: src/Notifier/StellaOps.Notifier | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 70 — Risk Profiles Phase 5 – Air-Gap & Advanced Factors | RISK-ENGINE-70-001 | TODO | Support offline provider bundles. | Risk Engine Guild | Path: src/RiskEngine/StellaOps.RiskEngine | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 70 — Risk Profiles Phase 5 – Air-Gap & Advanced Factors | RISK-ENGINE-70-002 | TODO | Integrate runtime/reachability providers. | Risk Engine Guild | Path: src/RiskEngine/StellaOps.RiskEngine | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 71 — Risk Profiles Phase 6 – Quality & Performance | DOCS-RISK-67-001..68-002 | TODO | Final editorial pass on risk documentation set. | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 71 — Risk Profiles Phase 6 – Quality & Performance | CLI-RISK-66-001..68-001 | TODO | Harden CLI commands with integration tests and error handling. | DevEx/CLI Guild | Path: src/Cli/StellaOps.Cli | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 71 — Risk Profiles Phase 6 – Quality & Performance | LEDGER-RISK-69-001 | TODO | Finalize dashboards and alerts for scoring latency. | Findings Ledger Guild | Path: src/Findings/StellaOps.Findings.Ledger | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 71 — Risk Profiles Phase 6 – Quality & Performance | NOTIFY-RISK-68-001 | TODO | Tune routing/quiet hour dedupe for risk alerts. | Notifications Service Guild | Path: src/Notifier/StellaOps.Notifier | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 71 — Risk Profiles Phase 6 – Quality & Performance | RISK-ENGINE-69-002 | TODO | Optimize performance, cache, and incremental scoring; validate SLOs. | Risk Engine Guild | Path: src/RiskEngine/StellaOps.RiskEngine | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 72 — Attestor Console Phase 1 – Foundations | DEVOPS-ATTEST-73-001 | TODO | (Prep) align CI secrets for Attestor service. | DevOps Guild | Path: ops/devops | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 72 — Attestor Console Phase 1 – Foundations | ATTEST-ENVELOPE-72-001 | TODO | Implement DSSE canonicalization and hashing helpers. | Envelope Guild | Path: src/Attestor/StellaOps.Attestor.Envelope | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 72 — Attestor Console Phase 1 – Foundations | ATTEST-ENVELOPE-72-002 | TODO | Support compact/expanded output and detached payloads. | Envelope Guild | Path: src/Attestor/StellaOps.Attestor.Envelope | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 72 — Attestor Console Phase 1 – Foundations | ATTEST-TYPES-72-001 | DONE | Draft schemas for all attestation payload types. | Attestation Payloads Guild | Path: src/Attestor/StellaOps.Attestor.Types | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 72 — Attestor Console Phase 1 – Foundations | ATTEST-TYPES-72-002 | DONE | Generate models/validators from schemas. | Attestation Payloads Guild | Path: src/Attestor/StellaOps.Attestor.Types | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 72 — Attestor Console Phase 1 – Foundations | ATTESTOR-72-001 | TODO | Scaffold attestor service skeleton. | Attestor Service Guild | Path: src/Attestor/StellaOps.Attestor | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 72 — Attestor Console Phase 1 – Foundations | ATTESTOR-72-002 | TODO | Implement attestation store + storage integration. | Attestor Service Guild | Path: src/Attestor/StellaOps.Attestor | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 72 — Attestor Console Phase 1 – Foundations | KMS-72-001 | DONE | Implement KMS interface + file driver. | KMS Guild | Path: src/__Libraries/StellaOps.Cryptography.Kms | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 73 — Attestor CLI Phase 2 – Signing & Policies | CLI-ATTEST-73-001 | TODO | Implement `stella attest sign` (payload selection, subject digest, key reference, output format) using official SDK transport. | CLI Attestor Guild | Path: src/Cli/StellaOps.Cli | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 73 — Attestor CLI Phase 2 – Signing & Policies | CLI-ATTEST-73-002 | TODO | Implement `stella attest verify` with policy selection, explainability output, and JSON/table formatting. | CLI Attestor Guild | Path: src/Cli/StellaOps.Cli | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 73 — Attestor Console Phase 2 – Signing & Policies | DOCS-ATTEST-73-001 | TODO | Publish attestor overview. | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 73 — Attestor Console Phase 2 – Signing & Policies | DOCS-ATTEST-73-002 | DONE | Publish payload docs. | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 73 — Attestor Console Phase 2 – Signing & Policies | DOCS-ATTEST-73-003 | TODO | Publish policies doc. | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 73 — Attestor Console Phase 2 – Signing & Policies | DOCS-ATTEST-73-004 | TODO | Publish workflows doc. | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 73 — Attestor Console Phase 2 – Signing & Policies | ATTEST-ENVELOPE-73-001 | TODO | Add signing/verification helpers with KMS integration. | Envelope Guild | Path: src/Attestor/StellaOps.Attestor.Envelope | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 73 — Attestor Console Phase 2 – Signing & Policies | ATTEST-TYPES-73-001 | DONE | Create golden payload fixtures. | Attestation Payloads Guild | Path: src/Attestor/StellaOps.Attestor.Types | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 73 — Attestor Console Phase 2 – Signing & Policies | ATTESTOR-73-001 | DOING | Ship signing endpoint. | Attestor Service Guild | Path: src/Attestor/StellaOps.Attestor | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 73 — Attestor Console Phase 2 – Signing & Policies | ATTESTOR-73-002 | TODO | Ship verification pipeline and reports. | Attestor Service Guild | Path: src/Attestor/StellaOps.Attestor | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 73 — Attestor Console Phase 2 – Signing & Policies | ATTESTOR-73-003 | TODO | Implement list/fetch APIs. | Attestor Service Guild | Path: src/Attestor/StellaOps.Attestor | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 73 — Attestor Console Phase 2 – Signing & Policies | KMS-72-002 | DONE (2025-10-30) | CLI support for key import/export. | KMS Guild | Path: src/__Libraries/StellaOps.Cryptography.Kms | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 73 — Attestor Console Phase 2 – Signing & Policies | POLICY-ATTEST-73-001 | TODO | Implement VerificationPolicy lifecycle. | Policy Guild | Path: src/Policy/StellaOps.Policy.Engine | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 73 — Attestor Console Phase 2 – Signing & Policies | POLICY-ATTEST-73-002 | TODO | Surface policies in Policy Studio. | Policy Guild | Path: src/Policy/StellaOps.Policy.Engine | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 74 — Attestor CLI Phase 3 – Transparency & Chain of Custody | CLI-ATTEST-74-001 | TODO | Implement `stella attest list` with filters (subject, type, issuer, scope) and pagination. | CLI Attestor Guild | Path: src/Cli/StellaOps.Cli | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 74 — Attestor CLI Phase 3 – Transparency & Chain of Custody | CLI-ATTEST-74-002 | TODO | Implement `stella attest fetch` to download envelopes and payloads to disk. | CLI Attestor Guild | Path: src/Cli/StellaOps.Cli | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 74 — Attestor Console Phase 3 – Transparency & Chain of Custody | DOCS-ATTEST-74-001 | TODO | Publish keys & issuers doc. | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 74 — Attestor Console Phase 3 – Transparency & Chain of Custody | DOCS-ATTEST-74-002 | TODO | Publish transparency doc. | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 74 — Attestor Console Phase 3 – Transparency & Chain of Custody | DOCS-ATTEST-74-003 | TODO | Publish console attestor UI doc. | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 74 — Attestor Console Phase 3 – Transparency & Chain of Custody | DOCS-ATTEST-74-004 | TODO | Publish CLI attest doc. | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 74 — Attestor Console Phase 3 – Transparency & Chain of Custody | DEVOPS-ATTEST-74-001 | TODO | Deploy transparency witness infra. | DevOps Guild | Path: ops/devops | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 74 — Attestor Console Phase 3 – Transparency & Chain of Custody | ATTEST-ENVELOPE-73-002 | TODO | Run fuzz tests for envelope handling. | Envelope Guild | Path: src/Attestor/StellaOps.Attestor.Envelope | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 74 — Attestor Console Phase 3 – Transparency & Chain of Custody | ATTEST-VERIFY-74-001 | TODO | Add telemetry for verification pipeline. | Verification Guild | Path: src/Attestor/StellaOps.Attestor.Verify | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 74 — Attestor Console Phase 3 – Transparency & Chain of Custody | ATTEST-VERIFY-74-002 | TODO | Document verification explainability. | Verification Guild | Path: src/Attestor/StellaOps.Attestor.Verify | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 74 — Attestor Console Phase 3 – Transparency & Chain of Custody | ATTESTOR-74-001 | DOING | Integrate transparency witness client. | Attestor Service Guild | Path: src/Attestor/StellaOps.Attestor | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 74 — Attestor Console Phase 3 – Transparency & Chain of Custody | ATTESTOR-74-002 | TODO | Implement bulk verification worker. | Attestor Service Guild | Path: src/Attestor/StellaOps.Attestor | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 74 — Attestor Console Phase 3 – Transparency & Chain of Custody | EXPORT-ATTEST-74-001 | TODO | Build attestation bundle export job. | Attestation Bundle Guild | Path: src/ExportCenter/StellaOps.ExportCenter.AttestationBundles | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 74 — Attestor Console Phase 3 – Transparency & Chain of Custody | NOTIFY-ATTEST-74-001 | TODO | Add verification/key notifications. | Notifications Service Guild | Path: src/Notifier/StellaOps.Notifier | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 74 — Attestor Console Phase 3 – Transparency & Chain of Custody | NOTIFY-ATTEST-74-002 | TODO | Notify key rotation/revocation. | Notifications Service Guild | Path: src/Notifier/StellaOps.Notifier | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 75 — Attestor CLI Phase 4 – Air Gap & Bulk | CLI-ATTEST-75-002 | TODO | Add support for building/verifying attestation bundles in CLI. | CLI Attestor Guild, Export Guild | Path: src/Cli/StellaOps.Cli | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 75 — Attestor Console Phase 4 – Air Gap & Bulk | DOCS-ATTEST-75-001 | TODO | Publish attestor airgap doc. | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 75 — Attestor Console Phase 4 – Air Gap & Bulk | DOCS-ATTEST-75-002 | TODO | Update AOC invariants for attestations. | Docs Guild | Path: docs | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 75 — Attestor Console Phase 4 – Air Gap & Bulk | DEVOPS-ATTEST-74-002 | TODO | Integrate bundle builds into release/offline pipelines. | DevOps Guild | Path: ops/devops | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 75 — Attestor Console Phase 4 – Air Gap & Bulk | DEVOPS-ATTEST-75-001 | TODO | Dashboards/alerts for attestor metrics. | DevOps Guild | Path: ops/devops | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 75 — Attestor Console Phase 4 – Air Gap & Bulk | ATTESTOR-75-001 | TODO | Support attestation bundle export/import for air gap. | Attestor Service Guild | Path: src/Attestor/StellaOps.Attestor | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 75 — Attestor Console Phase 4 – Air Gap & Bulk | ATTESTOR-75-002 | DONE | Harden APIs (rate limits, fuzz tests, threat model actions). | Attestor Service Guild | Path: src/Attestor/StellaOps.Attestor | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 75 — Attestor Console Phase 4 – Air Gap & Bulk | EXPORT-ATTEST-75-001 | TODO | CLI bundle verify/import. | Attestation Bundle Guild | Path: src/ExportCenter/StellaOps.ExportCenter.AttestationBundles | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 75 — Attestor Console Phase 4 – Air Gap & Bulk | EXPORT-ATTEST-75-002 | TODO | Document attestor airgap workflow. | Attestation Bundle Guild | Path: src/ExportCenter/StellaOps.ExportCenter.AttestationBundles | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 120 — [Policy & Reasoning] 120.A) AirGap | AIRGAP-POL-56-001 | DONE | Implement `StellaOps.AirGap.Policy` package exposing `EgressPolicy` facade with sealed/unsealed branches and remediation-friendly errors. | AirGap Policy Guild | Path: src/AirGap/StellaOps.AirGap.Policy | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 120 — [Policy & Reasoning] 120.A) AirGap | AIRGAP-POL-56-002 | DONE | Create Roslyn analyzer/code fix warning on raw `HttpClient` usage outside approved wrappers; add CI integration. Dependencies: AIRGAP-POL-56-001. | AirGap Policy Guild, DevEx Guild | Path: src/AirGap/StellaOps.AirGap.Policy | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 120 — [Policy & Reasoning] 120.A) AirGap | AIRGAP-POL-57-001 | DONE (2025-11-03) | Update core web services (Web, Exporter, Policy, Findings, Authority) to use `EgressPolicy`; ensure configuration wiring for sealed mode. Dependencies: AIRGAP-POL-56-002. | AirGap Policy Guild, BE-Base Platform Guild | Path: src/AirGap/StellaOps.AirGap.Policy | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 120 — [Policy & Reasoning] 120.A) AirGap | AIRGAP-POL-57-002 | DONE (2025-11-03) | Implement Task Runner job plan validator rejecting network steps unless marked internal allow-list.
2025-11-03: Worker wiring pulls `IEgressPolicy`, filesystem dispatcher enforces sealed-mode egress, dispatcher test + grant normalization landed, package versions aligned to rc.2.
Next: ensure other dispatchers/executors reuse the injected policy before enabling sealed-mode runs in worker service. Dependencies: AIRGAP-POL-57-001. | AirGap Policy Guild, Task Runner Guild | Path: src/AirGap/StellaOps.AirGap.Policy | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 120 — [Policy & Reasoning] 120.A) AirGap | AIRGAP-POL-58-001 | DONE (2025-11-03) | Ensure Observability exporters only target local endpoints in sealed mode; disable remote sinks with warning.
2025-11-03: Introduced `StellaOps.Telemetry.Core` with OTLP exporter guard; Registry Token Service consumes new telemetry bootstrap; sealed-mode now skips non-loopback collectors and logs remediation guidance; docs refreshed for telemetry/air-gap playbooks. Dependencies: AIRGAP-POL-57-002. | AirGap Policy Guild, Observability Guild | Path: src/AirGap/StellaOps.AirGap.Policy | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 120 — [Policy & Reasoning] 120.A) AirGap | AIRGAP-POL-58-002 | DONE (2025-11-03) | Add CLI sealed-mode guard that refuses commands needing egress and surfaces remediation.
2025-11-03: CLI now wires HTTP clients through `StellaOps.AirGap.Policy`, returns `AIRGAP_EGRESS_BLOCKED` with remediation when sealed, and docs updated. Dependencies: AIRGAP-POL-58-001. | AirGap Policy Guild, CLI Guild | Path: src/AirGap/StellaOps.AirGap.Policy | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 120 — [Policy & Reasoning] 120.B) Findings.I | LEDGER-29-001 | DONE (2025-11-03) | Design ledger & projection schemas (tables/indexes), canonical JSON format, hashing strategy, and migrations. Publish schema doc + fixtures.
2025-11-03: Initial migration, canonical fixtures, and schema doc alignment delivered (LEDGER-29-001). | Findings Ledger Guild | Path: src/Findings/StellaOps.Findings.Ledger | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 120 — [Policy & Reasoning] 120.B) Findings.I | LEDGER-29-002 | DONE (2025-11-03) | Implement ledger write API (`POST /vuln/ledger/events`) with validation, idempotency, hash chaining, and Merkle root computation job.
2025-11-03: Web service + domain scaffolding landed with canonical hashing helpers, in-memory repository, Merkle scheduler stub, request/response contracts, and unit tests covering hashing & conflict flows. Dependencies: LEDGER-29-001. | Findings Ledger Guild | Path: src/Findings/StellaOps.Findings.Ledger | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 120 — [Policy & Reasoning] 120.B) Findings.I | LEDGER-29-003 | DONE (2025-11-03) | Build projector worker that derives `findings_projection` rows from ledger events + policy determinations; ensure idempotent replay keyed by `(tenant,finding_id,policy_version)`.
2025-11-03: Postgres projection services landed with replay checkpoints, fixtures, and unit coverage (LEDGER-29-003). Dependencies: LEDGER-29-002. | Findings Ledger Guild, Scheduler Guild | Path: src/Findings/StellaOps.Findings.Ledger | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 120 — [Policy & Reasoning] 120.B) Findings.I | LEDGER-29-004 | DONE (2025-11-04) | Integrate Policy Engine batch evaluation (baseline + simulate) with projector; cache rationale references.
2025-11-04: Ledger service now calls `/api/policy/eval/batch` with resilient HttpClient, shared cache, and inline fallback; documentation/config samples updated; ledger tests executed (`dotnet test src/Findings/__Tests/StellaOps.Findings.Ledger.Tests/StellaOps.Findings.Ledger.Tests.csproj --no-restore`). Dependencies: LEDGER-29-003. | Findings Ledger Guild, Policy Guild | Path: src/Findings/StellaOps.Findings.Ledger | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 120 — [Policy & Reasoning] 120.B) Findings.I | LEDGER-29-005 | DONE | Implement workflow mutation handlers (assign, comment, accept-risk, target-fix, verify-fix, reopen) producing ledger events with validation and attachments metadata. Dependencies: LEDGER-29-004. | Findings Ledger Guild | Path: src/Findings/StellaOps.Findings.Ledger | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 120 — [Policy & Reasoning] 120.B) Findings.I | LEDGER-29-006 | DONE | Integrate attachment encryption (KMS envelope), signed URL issuance, CSRF protection hooks for Console. Dependencies: LEDGER-29-005. | Findings Ledger Guild, Security Guild | Path: src/Findings/StellaOps.Findings.Ledger | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 120 — [Policy & Reasoning] 120.C) Policy.II | POLICY-ENGINE-27-003 | DONE | Implement complexity/time limit enforcement with compiler scoring, configurable thresholds, and structured diagnostics (`ERR_POL_COMPLEXITY`). Dependencies: POLICY-ENGINE-27-002. | Policy Guild, Security Guild | Path: src/Policy/StellaOps.Policy.Engine | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 120 — [Policy & Reasoning] 120.C) Policy.II | POLICY-ENGINE-27-004 | DONE | Update golden/property tests to cover new coverage metrics, symbol tables, explain traces, and complexity limits; provide fixtures for Registry/Console integration. Dependencies: POLICY-ENGINE-27-003. | Policy Guild, QA Guild | Path: src/Policy/StellaOps.Policy.Engine | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 130 — Scanner & Surface / Scanner.I | `SCANNER-ANALYZERS-LANG-10-308R` | DONE (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Rust) | Determinism fixtures + performance benchmarks; compare against competitor heuristic coverage. | DONE | Path: src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Rust | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 130 — Scanner & Surface / Scanner.I | `SCANNER-ANALYZERS-LANG-10-309R` | DONE (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Rust) | Package plug-in manifest + Offline Kit documentation; ensure Worker integration. Dependencies: SCANNER-ANALYZERS-LANG-10-308R. | DONE | Path: src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Rust | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 130 — Scanner & Surface / Scanner.I | `ENTRYTRACE-SURFACE-01` | DONE (2025-11-02) | Run Surface.Validation prereq checks and resolve cached entry fragments via Surface.FS to avoid duplicate parsing. | EntryTrace Guild | Path: src/Scanner/__Libraries/StellaOps.Scanner.EntryTrace | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 130 — Scanner & Surface / Scanner.I | `ENTRYTRACE-SURFACE-02` | DONE (2025-11-02) | Replace direct env/secret access with Surface.Secrets provider when tracing runtime configs. Dependencies: ENTRYTRACE-SURFACE-01. | EntryTrace Guild | Path: src/Scanner/__Libraries/StellaOps.Scanner.EntryTrace | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 130 — Scanner & Surface / Scanner.I | `SCANNER-ENTRYTRACE-18-509` | DONE (2025-11-02) | Add regression coverage for EntryTrace surfaces (result store, WebService endpoint, CLI renderer) and NDJSON hashing. | EntryTrace Guild, QA Guild | Path: src/Scanner/__Libraries/StellaOps.Scanner.EntryTrace | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 130 — Scanner & Surface / Scanner.I | `SCANNER-ENTRYTRACE-18-507` | DONE (2025-11-02) | Expand candidate discovery beyond ENTRYPOINT/CMD by scanning Docker history metadata and default service directories (`/etc/services/**`, `/s6/**`, `/etc/supervisor/*.conf`, `/usr/local/bin/*-entrypoint`) when explicit commands are absent. Dependencies: SCANNER-ENTRYTRACE-18-509. | EntryTrace Guild | Path: src/Scanner/__Libraries/StellaOps.Scanner.EntryTrace | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 130 — Scanner & Surface / Scanner.I | `SCANNER-ENTRYTRACE-18-508` | DONE (2025-11-02) | Extend wrapper catalogue to collapse language/package launchers (`bundle`, `bundle exec`, `docker-php-entrypoint`, `npm`, `yarn node`, `pipenv`, `poetry run`) and vendor init scripts before terminal classification. Dependencies: SCANNER-ENTRYTRACE-18-507. | EntryTrace Guild | Path: src/Scanner/__Libraries/StellaOps.Scanner.EntryTrace | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 130 — Scanner & Surface / Scanner.I | `LANG-SURFACE-01` | DONE (2025-11-03) | Invoke Surface.Validation checks (env/cache/secrets) before analyzer execution to ensure consistent prerequisites.
2025-11-03: CompositeScanAnalyzerDispatcher now enforces Surface.Validation prior to language analyzers and propagates actionable failure diagnostics. | Language Analyzer Guild | Path: src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 130 — Scanner & Surface / Scanner.I | `LANG-SURFACE-02` | DONE (2025-11-03) | Consume Surface.FS APIs for layer/source caching (instead of bespoke caches) to improve determinism. Dependencies: LANG-SURFACE-01.
2025-11-03: Language analyzer runs fingerprint the workspace and persist results via Surface.FS cache helper for deterministic reuse. | Language Analyzer Guild | Path: src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 130 — Scanner & Surface / Scanner.I | `LANG-SURFACE-03` | DONE (2025-11-03) | Replace direct secret/env reads with Surface.Secrets references when fetching package feeds or registry creds. Dependencies: LANG-SURFACE-02.
2025-11-03: LanguageAnalyzerContext exposes Surface.Secrets-backed helper for registry/feed credentials with unit coverage. | Language Analyzer Guild | Path: src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 130 — Scanner & Surface / Scanner.VII | `SCANNER-EVENTS-16-302` | DONE (2025-11-06) | Extend orchestrator event links (report/policy/attestation) once endpoints are finalised across gateway + console. Dependencies: SCANNER-EVENTS-16-301.
2025-11-06 22:55Z: Dispatcher honours configurable console/API segments; docs and samples refreshed; added regression test for custom segments. `dotnet test` previously blocked by legacy Surface cache ctor signature (tracked under Surface task).
2025-11-06 23:30Z: Report DSSE fixtures re-synced; Surface cache ctor drift repaired; `dotnet test src/Scanner/__Tests/StellaOps.Scanner.WebService.Tests --no-build` now green end-to-end. | Scanner WebService Guild | Path: src/Scanner/StellaOps.Scanner.WebService | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 130 — Scanner & Surface / Scanner.VII | `SCANNER-SECRETS-01` | DONE (2025-11-06) | Adopt `StellaOps.Scanner.Surface.Secrets` for registry/CAS credentials during scan execution.
2025-11-02: Surface.Secrets provider wired for CAS token retrieval; integration tests added.
2025-11-06: Replaced registry credential plumbing with shared provider + rotation-aware metrics; introduced registry secret stage and analysis keys.
2025-11-06 23:40Z: Installed .NET 10 RC2 runtime, parser/stage unit suites green (`dotnet test` Surface.Secrets + Worker focused filter). | Scanner Worker Guild, Security Guild | Path: src/Scanner/StellaOps.Scanner.Worker | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 130 — Scanner & Surface / Scanner.VII | `SCANNER-SECRETS-02` | DONE (2025-11-06) | Replace ad-hoc secret wiring with Surface.Secrets for report/export operations (registry and CAS tokens). Dependencies: SCANNER-SECRETS-01.
2025-11-02: WebService export path now resolves registry credentials via Surface.Secrets stub; CI pipeline hook in progress.
2025-11-06: Picking up Surface.Secrets provider usage across report/export flows and removing legacy secret file readers.
2025-11-06 21:40Z: WebService options now consume `cas-access` secrets via configurator; storage mirrors updated; targeted tests passing.
2025-11-06 23:58Z: Registry + attestation secrets sourced via Surface.Secrets (options extended, configurator + tests updated); Surface.Secrets & configurator test suites executed on .NET 10 RC2 runtime. | Scanner WebService Guild, Security Guild | Path: src/Scanner/StellaOps.Scanner.WebService | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 130 — Scanner & Surface / Scanner.VII | `SCANNER-SURFACE-01` | DONE (2025-11-06) | Persist Surface.FS manifests after analyzer stages, including layer CAS metadata and EntryTrace fragments.
2025-11-02: Worker pipeline emitting draft Surface.FS manifests for sample scans; determinism checks running.
2025-11-06: Continuing with manifest writer abstraction + telemetry wiring for Surface.FS persistence.
2025-11-06 18:45Z: Resumed work; targeting manifest writer abstraction, CAS persistence hooks, and telemetry/test coverage updates.
2025-11-06 20:20Z: Published Surface worker Grafana dashboard + updated design doc; WebService pointer integration test now covers manifest/payload artefacts. | Scanner Worker Guild | Path: src/Scanner/StellaOps.Scanner.Worker | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 130 — Scanner & Surface / Scanner.VII | `SCANNER-SURFACE-02` | DONE (2025-11-05) | Publish Surface.FS pointers (CAS URIs, manifests) via scan/report APIs and update attestation metadata. Dependencies: SCANNER-SURFACE-01.
2025-11-05: Surface pointer projection wired through WebService endpoints, orchestrator samples & DSSE fixtures refreshed with `surface` manifest block, and regression suite (platform events, report sample, ready check) updated. | Scanner WebService Guild | Path: src/Scanner/StellaOps.Scanner.WebService | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 130 — Scanner & Surface / Scanner.VII | `SCANNER-SURFACE-03` | DONE (2025-11-07) | Push layer manifests and entry fragments into Surface.FS during build-time SBOM generation. Dependencies: SCANNER-SURFACE-02.
2025-11-06: Starting BuildX manifest upload implementation with Surface.FS client abstraction and integration tests.
2025-11-07 15:30Z: Resumed BuildX plugin Surface wiring; analyzing Surface.FS models, CAS flow, and upcoming tests before coding.
2025-11-07 22:10Z: Added Surface manifest writer + CLI flags to the BuildX plug-in, persisted artefacts into CAS, regenerated docs/fixtures, and shipped new tests covering the writer + descriptor flow. | BuildX Plugin Guild | Path: src/Scanner/StellaOps.Scanner.Sbomer.BuildXPlugin | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 320 — Docs Modules Export Center | CENTER-DOCS-0001 | DONE (2025-11-05) | Validate that `docs/modules/export-center/README.md` matches the latest release notes, including devportal offline profile, DSSE manifest signatures, and supporting specs. | Docs Guild | Path: docs/modules/export-center/TASKS.md | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 327 — Docs Modules Scanner | SCANNER-DOCS-0001 | DONE (2025-11-05) | Validate that `docs/modules/scanner/README.md` is current with platform-event coverage (`scanner.report.ready@1`, `scanner.scan.completed@1`). | Docs Guild | Path: docs/modules/scanner/TASKS.md | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 327 — Docs Modules Scanner | SCANNER-DOCS-0002 | DONE (2025-11-02) | Keep scanner benchmark comparisons (Trivy/Grype/Snyk) and deep-dive matrices up to date with cited sources. | Docs Guild | Path: docs/modules/scanner/TASKS.md | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 327 — Docs Modules Scanner | DOCS-SCANNER-BENCH-62-001 | DONE (2025-11-02) | Maintain the scanner comparison doc for Trivy/Grype/Snyk with refreshed deep dives and ecosystem matrices. | Docs Guild, Scanner Guild | Path: docs/benchmarks/scanner | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 327 — Docs Modules Scanner | DOCS-SCANNER-BENCH-62-007 | DONE (2025-11-05) | Publish secret leak detection documentation (rules, policy templates) once implementation lands. | Docs Guild, Security Guild | Path: docs/benchmarks/scanner | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 327 — Docs Modules Scanner | DOCS-SCANNER-BENCH-62-010 | DONE (2025-11-02) | Document PHP analyzer parity gaps with technique tables and policy hooks. | Docs Guild, PHP Analyzer Guild | Path: docs/benchmarks/scanner | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 327 — Docs Modules Scanner | DOCS-SCANNER-BENCH-62-011 | DONE (2025-11-02) | Capture Deno runtime gap analysis versus competitors, including detection/merge strategy tables. | Docs Guild, Language Analyzer Guild | Path: docs/benchmarks/scanner | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 327 — Docs Modules Scanner | DOCS-SCANNER-BENCH-62-012 | DONE (2025-11-02) | Add Dart ecosystem comparisons and task linkage in `scanning-gaps-stella-misses-from-competitors.md`. | Docs Guild, Language Analyzer Guild | Path: docs/benchmarks/scanner | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 327 — Docs Modules Scanner | DOCS-SCANNER-BENCH-62-013 | DONE (2025-11-02) | Expand Swift coverage analysis with implementation techniques and policy considerations. | Docs Guild, Swift Analyzer Guild | Path: docs/benchmarks/scanner | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 327 — Docs Modules Scanner | DOCS-SCANNER-BENCH-62-014 | DONE (2025-11-02) | Detail Kubernetes/VM target coverage gaps and linkage with Zastava/Runtime docs. | Docs Guild, Runtime Guild | Path: docs/benchmarks/scanner | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 327 — Docs Modules Scanner | DOCS-SCANNER-BENCH-62-015 | DONE (2025-11-02) | Document DSSE/Rekor operator enablement guidance drawn from competitor comparisons. | Docs Guild, Export Center Guild | Path: docs/benchmarks/scanner | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 112 — Concelier.I | CONCELIER-CRYPTO-90-001 | DONE (2025-11-08) | Route WebService hashing through `ICryptoHash` so sovereign deployments (e.g., RootPack_RU) can select CryptoPro/PKCS#11 providers; discovery, chunk builders, and seed processors updated accordingly. | Concelier WebService Guild, Security Guild | Path: src/Concelier/StellaOps.Concelier.WebService | 2025-10-19 | -| docs/implplan/archived/updates/tasks.md | Sprint 158 — TaskRunner.II | TASKRUN-43-001 | DONE (2025-11-06) | Implement approvals workflow (resume after approval), notifications integration, remote artifact uploads, chaos resilience, secret injection, and audit logging for TaskRunner. | Task Runner Guild | Path: src/TaskRunner/StellaOps.TaskRunner | 2025-10-19 | -| docs/implplan/archived/updates/SPRINT_100_identity_signing.md | Sprint 100 Identity Signing | AUTH-AIRGAP-57-001 | DONE (2025-11-08) | | Authority Core & Security Guild, DevOps Guild (src/Authority/StellaOps.Authority) | Enforce sealed-mode CI gating by refusing token issuance when declared sealed install lacks sealing confirmation. (Deps: AUTH-AIRGAP-56-001, DEVOPS-AIRGAP-57-002.) | | -| docs/implplan/archived/updates/SPRINT_100_identity_signing.md | Sprint 100 Identity Signing | AUTH-PACKS-43-001 | DONE (2025-11-09) | | Authority Core & Security Guild (src/Authority/StellaOps.Authority) | Enforce pack signing policies, approval RBAC checks, CLI CI token scopes, and audit logging for approvals. (Deps: AUTH-PACKS-41-001, TASKRUN-42-001, ORCH-SVC-42-101.) | | -| docs/implplan/archived/updates/SPRINT_110_ingestion_evidence_2025-11-13.md | Sprint 110 Ingestion Evidence 2025-11-13 | DOCS-AIAI-31-004 | DOING | | | | | -| docs/implplan/archived/updates/SPRINT_110_ingestion_evidence_2025-11-13.md | Sprint 110 Ingestion Evidence 2025-11-13 | AIAI-31-009 | DONE (2025-11-12) | | | | | -| docs/implplan/archived/updates/SPRINT_110_ingestion_evidence_2025-11-13.md | Sprint 110 Ingestion Evidence 2025-11-13 | AIAI-31-008 | TODO | | | | | -| docs/implplan/archived/updates/SPRINT_110_ingestion_evidence_2025-11-13.md | Sprint 110 Ingestion Evidence 2025-11-13 | SBOM-AIAI-31-003 | BLOCKED | | | | | -| docs/implplan/archived/updates/SPRINT_110_ingestion_evidence_2025-11-13.md | Sprint 110 Ingestion Evidence 2025-11-13 | DOCS-AIAI-31-005/006/008/009 | BLOCKED | | | | | -| docs/implplan/archived/updates/SPRINT_130_scanner_surface.md | Sprint 130 Scanner Surface | `SCANNER-ANALYZERS-DENO-26-001` | DONE | Build the deterministic input normalizer + VFS merger for `deno.json(c)`, import maps, lockfiles, vendor trees, `$DENO_DIR`, and OCI layers so analyzers have a canonical file view. | Deno Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Deno) | — | | -| docs/implplan/archived/updates/SPRINT_130_scanner_surface.md | Sprint 130 Scanner Surface | `SCANNER-ANALYZERS-DENO-26-002` | DONE | Implement the module graph resolver covering static/dynamic imports, npm bridge, cache lookups, built-ins, WASM/JSON assertions, and annotate edges with their resolution provenance. | Deno Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Deno) | SCANNER-ANALYZERS-DENO-26-001 | | -| docs/implplan/archived/updates/SPRINT_130_scanner_surface.md | Sprint 130 Scanner Surface | `SCANNER-ANALYZERS-DENO-26-003` | DONE | Ship the npm/node compatibility adapter that maps `npm:` specifiers, evaluates `exports` conditionals, and logs builtin usage for policy overlays. | Deno Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Deno) | SCANNER-ANALYZERS-DENO-26-002 | | -| docs/implplan/archived/updates/SPRINT_130_scanner_surface.md | Sprint 130 Scanner Surface | `SCANNER-ANALYZERS-DENO-26-004` | DONE | Add the permission/capability analyzer covering FS/net/env/process/crypto/FFI/workers plus dynamic-import + literal fetch heuristics with reason codes. | Deno Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Deno) | SCANNER-ANALYZERS-DENO-26-003 | | -| docs/implplan/archived/updates/SPRINT_130_scanner_surface.md | Sprint 130 Scanner Surface | `SCANNER-ANALYZERS-DENO-26-005` | DONE | Build bundle/binary inspectors for eszip and `deno compile` executables to recover graphs, configs, embedded resources, and snapshots. | Deno Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Deno) | SCANNER-ANALYZERS-DENO-26-004 | | -| docs/implplan/archived/updates/SPRINT_130_scanner_surface.md | Sprint 130 Scanner Surface | `SCANNER-ANALYZERS-DENO-26-006` | DONE | Implement the OCI/container adapter that stitches per-layer Deno caches, vendor trees, and compiled binaries back into provenance-aware analyzer inputs. | Deno Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Deno) | SCANNER-ANALYZERS-DENO-26-005 | | -| docs/implplan/archived/updates/SPRINT_130_scanner_surface.md | Sprint 130 Scanner Surface | `SCANNER-ANALYZERS-DENO-26-007` | DONE | Produce AOC-compliant observation writers (entrypoints, modules, capability edges, workers, warnings, binaries) with deterministic reason codes. | Deno Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Deno) | SCANNER-ANALYZERS-DENO-26-006 | | -| docs/implplan/archived/updates/SPRINT_130_scanner_surface.md | Sprint 130 Scanner Surface | `SCANNER-ANALYZERS-DENO-26-008` | DONE | Finalize fixture + benchmark suite (vendor/npm/FFI/worker/dynamic import/bundle/cache/container cases) validating analyzer determinism and performance. | Deno Analyzer Guild, QA Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Deno) | SCANNER-ANALYZERS-DENO-26-007 | | -| docs/implplan/archived/updates/SPRINT_137_scanner_gap_design.md | Sprint 137 Scanner Gap Design | `SCANNER-ENG-0002` | DONE (2025-11-09) | Design the Node.js lockfile collector + CLI validator per `docs/benchmarks/scanner/scanning-gaps-stella-misses-from-competitors.md`, capturing Surface + policy requirements before implementation. | Scanner Guild, CLI Guild (docs/modules/scanner) | — | | -| docs/implplan/archived/updates/SPRINT_137_scanner_gap_design.md | Sprint 137 Scanner Gap Design | `SCANNER-ENG-0003` | DONE (2025-11-09) | Design Python lockfile + editable-install parity checks with policy predicates and CLI workflow coverage as outlined in the gap analysis. | Python Analyzer Guild, CLI Guild (docs/modules/scanner) | — | | -| docs/implplan/archived/updates/SPRINT_137_scanner_gap_design.md | Sprint 137 Scanner Gap Design | `SCANNER-ENG-0004` | DONE (2025-11-09) | Design Java lockfile ingestion/validation (Gradle/SBT collectors, CLI verb, policy hooks) to close comparison gaps. | Java Analyzer Guild, CLI Guild (docs/modules/scanner) | — | | -| docs/implplan/archived/updates/SPRINT_137_scanner_gap_design.md | Sprint 137 Scanner Gap Design | `SCANNER-ENG-0005` | DONE (2025-11-09) | Enhance Go stripped-binary fallback inference design, including inferred module metadata + policy integration, per the gap analysis. | Go Analyzer Guild (docs/modules/scanner) | — | | -| docs/implplan/archived/updates/SPRINT_137_scanner_gap_design.md | Sprint 137 Scanner Gap Design | `SCANNER-ENG-0006` | DONE (2025-11-09) | Expand Rust fingerprint coverage design (enriched fingerprint catalogue + policy controls) per the comparison matrix. | Rust Analyzer Guild (docs/modules/scanner) | — | | -| docs/implplan/archived/updates/SPRINT_137_scanner_gap_design.md | Sprint 137 Scanner Gap Design | `SCANNER-ENG-0007` | DONE (2025-11-09) | Design the deterministic secret leak detection pipeline covering rule packaging, Policy Engine integration, and CLI workflow. | Scanner Guild, Policy Guild (docs/modules/scanner) | — | | -| docs/implplan/archived/updates/2025-10-18-docs-guild.md | Update note | Docs Guild Update — 2025-10-18 | INFO | **Subject:** ADR process + events schema validation shipped | | | 2025-10-18 | -| docs/implplan/archived/updates/2025-10-19-docs-guild.md | Update note | Docs Guild Update — 2025-10-19 | INFO | **Subject:** Event envelope reference & canonical samples | | | 2025-10-19 | -| docs/implplan/archived/updates/2025-10-19-platform-events.md | Update note | Platform Events Update — 2025-10-19 | INFO | **Subject:** Canonical event samples enforced across tests & CI | | | 2025-10-19 | -| docs/implplan/archived/updates/2025-10-19-scanner-policy.md | Update note | 2025-10-19 – Scanner ↔ Policy Sync | INFO | - Scanner WebService now emits `scanner.report.ready` and `scanner.scan.completed` via Redis Streams when `scanner.events.enabled=true`; DSSE envelopes are embedded verbatim to keep Notify/UI consumers in sync. | | | 2025-10-19 | -| docs/implplan/archived/updates/2025-10-19-scheduler-storage.md | Update note | Scheduler Storage Update — 2025-10-19 | INFO | **Subject:** Mongo bootstrap + canonical fixtures | | | 2025-10-19 | -| docs/implplan/archived/updates/2025-10-20-authority-identity-registry.md | Update note | 2025-10-20 — Authority Identity Provider Registry & DPoP nonce updates | INFO | - Authority host now resolves identity providers through the new metadata/handle pattern introduced in `StellaOps.Authority.Plugins.Abstractions`. Runtime handlers (`ValidateClientCredentialsHandler`, `ValidatePasswordGrantHandler`, `ValidateAccessTokenHandler`, bootstrap endpoints) acquire providers with `IAuthorityIdentityProviderRegistry.AcquireAsync` and rely on metadata (`AuthorityIdentityProviderMetadata`) for capability checks. | | | 2025-10-20 | -| docs/implplan/archived/updates/2025-10-20-scanner-events.md | Update note | 2025-10-20 – Scanner Platform Events Hardening | INFO | - Scanner WebService now wires a reusable `IRedisConnectionFactory`, simplifying redis transport testing and reuse for future adapters. | | | 2025-10-20 | -| docs/implplan/archived/updates/2025-10-22-docs-guild.md | Update note | Docs Guild Update — 2025-10-22 | INFO | **Subject:** Concelier Authority toggle rollout polish | | | 2025-10-22 | -| docs/implplan/archived/updates/2025-10-26-authority-graph-scopes.md | Update note | 2025-10-26 — Authority graph scopes documentation refresh | INFO | - Documented least-privilege guidance for the new `graph:*` scopes in `docs/11_AUTHORITY.md` (scope mapping, tenant propagation, and DPoP expectations). | | | 2025-10-26 | -| docs/implplan/archived/updates/2025-10-26-scheduler-graph-jobs.md | Update note | 2025-10-26 — Scheduler Graph Job DTOs ready for integration | INFO | SCHED-MODELS-21-001 delivered the new `GraphBuildJob`/`GraphOverlayJob` contracts and SCHED-MODELS-21-002 publishes the accompanying documentation + samples for downstream teams. | | | 2025-10-26 | -| docs/implplan/archived/updates/2025-10-27-console-security-signoff.md | Update note | Console Security Checklist Sign-off — 2025-10-27 | INFO | - Security Guild completed the console security compliance checklist from [`docs/security/console-security.md`](../security/console-security.md) against the Sprint 23 build. | | | 2025-10-27 | -| docs/implplan/archived/updates/2025-10-27-orch-operator-scope.md | Update note | 2025-10-27 — Orchestrator operator scope & audit metadata | INFO | - Introduced the `orch:operate` scope and `Orch.Operator` role in Authority to unlock Orchestrator control actions while keeping read-only access under `Orch.Viewer`. | | | 2025-10-27 | -| docs/implplan/archived/updates/2025-10-27-policy-scope-migration.md | Update note | 2025-10-27 — Policy scope migration guidance | INFO | - Updated Authority defaults (`etc/authority.yaml`) to register a `policy-cli` client using the fine-grained scope set introduced by AUTH-POLICY-23-001 (`policy:read`, `policy:author`, `policy:review`, `policy:simulate`, `findings:read`). | | | 2025-10-27 | -| docs/implplan/archived/updates/2025-10-27-task-packs-docs.md | Update note | Docs Guild Update — Task Pack Docs (2025-10-27) | INFO | - Added Task Pack core documentation set: | | | 2025-10-27 | -| docs/implplan/archived/updates/2025-10-28-docs-guild.md | Update note | Docs Guild Update — 2025-10-28 | INFO | - Published `docs/security/console-security.md` covering console OIDC/DPoP flow, scope map, fresh-auth sequence, CSP defaults, evidence handling, and monitoring checklist. | | | 2025-10-28 | -| docs/implplan/archived/updates/2025-10-29-export-center-provenance.md | Update note | 2025-10-29 – Export Center provenance/signing doc | INFO | - Authored `docs/modules/export-center/provenance-and-signing.md`, covering manifest/provenance artefacts, cosign/SLSA signing pipeline, verification workflows (CLI/CI/offline), and compliance checklist. | | | 2025-10-29 | -| docs/implplan/archived/updates/2025-10-29-notify-docs.md | Update note | 2025-10-29 – Notifications Studio docs sync prep | INFO | - Published Notifications Studio overview (`notifications/overview.md`) and architecture dossier (`notifications/architecture.md`), complementing the rules/templates/digests deep dives landed earlier in Sprint 39. | | | 2025-10-29 | -| docs/implplan/archived/updates/2025-10-29-scheduler-policy-doc-refresh.md | Update note | 2025-10-29 — Scheduler/Policy Guild Doc Refresh | INFO | - Extended `SCHED-MODELS-20-001` with environment metadata guidance, lifecycle semantics, and diff payload breakdown for Policy Engine runs. | | | 2025-10-29 | -| docs/implplan/archived/updates/2025-10-30-devops-governance.md | Update note | 30 Oct 2025 — Governance rules anchor consolidated | INFO | **What changed** | | | 2025-10-30 | -| docs/implplan/archived/updates/2025-10-31-console-security-refresh.md | Update note | 2025-10-31 — Console Security Docs Refresh | INFO | - Documented the new Authority `/console` endpoints (`/tenants`, `/profile`, `/token/introspect`) including tenant header enforcement, DPoP requirements, and five-minute fresh-auth behaviour. | | | 2025-10-31 | -| docs/implplan/archived/updates/2025-10-cleanup.md | Update note | Backlog Cleanup — 26 October 2025 | INFO | This note captures the Sprint backlog hygiene pass applied on 26 October 2025. The goal was to eliminate legacy tasks that violated the aggregation-only contract (AOC), duplicated scope, or conflicted with the current module ownership map. | | | | -| docs/implplan/archived/updates/2025-11-01-orch-admin-scope.md | Update note | 2025-11-01 · Authority adds Orch.Admin quota controls | INFO | **What changed** | | | 2025-11-01 | -| docs/implplan/archived/updates/2025-11-02-pack-scope-profiles.md | Update note | 2025-11-02 · Pack scope catalogue & CLI profiles | INFO | **What changed** | | | 2025-11-02 | -| docs/implplan/archived/updates/2025-11-03-authority-plugin-ldap-review.md | Update note | Authority Plugin LDAP Review — 2025-11-03 | INFO | - Auth Guild core (Authority Host Crew) | | | 2025-11-03 | -| docs/implplan/archived/updates/2025-11-03-vuln-explorer-access-controls.md | Update note | 2025-11-03 – Vuln Explorer access controls refresh | INFO | - Expanded `docs/11_AUTHORITY.md` with attachment signing tokens, ledger verification workflow, and a Vuln Explorer security checklist. | | | 2025-11-03 | -| docs/implplan/archived/updates/2025-11-05-excitor-consensus-beta.md | Update note | 2025-11-05 – Excitor consensus API beta | INFO | **Subject:** Excitor consensus export/API preview ships \ | | | 2025-11-05 | -| docs/implplan/archived/updates/2025-11-07-concelier-advisory-chunks.md | Update note | 2025-11-07 – Concelier advisory chunks API | INFO | **Subject:** Paragraph-anchored advisory chunks land for Advisory AI | | | 2025-11-07 | -| docs/implplan/archived/updates/2025-11-09-authority-ldap-plugin.md | Update note | 2025-11-09 — Authority LDAP Plug-in Readiness (PLG7.IMPL-005) | INFO | - Added a dedicated LDAP quick-reference section to the Authority plug-in developer guide covering mutual TLS requirements, DN→role regex mappings, Mongo-backed claim caching, and the client-provisioning audit mirror. | | | 2025-11-09 | -| docs/implplan/archived/updates/2025-11-12-notify-attestation-templates.md | Update note | 2025-11-12 – Notifications Attestation Template Suite | INFO | - Introduced the canonical `tmpl-attest-*` template family covering verification failures, expiring attestations, key rotations, and transparency anomalies. | | | 2025-11-12 | +| docs/implplan/archived/updates/tasks.md | Sprint 58 — Air-Gapped Mode Phase 3 – Staleness & Enforcement | DOCS-AIRGAP-58-001 | TODO | Publish degradation matrix doc. | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 58 — Air-Gapped Mode Phase 3 – Staleness & Enforcement | DOCS-AIRGAP-58-002 | TODO | Update trust & signing doc for DSSE/TUF roots. | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 58 — Air-Gapped Mode Phase 3 – Staleness & Enforcement | DOCS-AIRGAP-58-003 | TODO | Publish developer airgap contracts doc. | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 58 — Air-Gapped Mode Phase 3 – Staleness & Enforcement | DOCS-AIRGAP-58-004 | TODO | Document portable evidence workflows. | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 58 — Air-Gapped Mode Phase 3 – Staleness & Enforcement | AIRGAP-CTL-58-001 | TODO | Persist time anchor data and expose drift metrics. | AirGap Controller Guild | Path: src/AirGap/StellaOps.AirGap.Controller | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 58 — Air-Gapped Mode Phase 3 – Staleness & Enforcement | AIRGAP-POL-58-001 | TODO | Disable remote observability exporters in sealed mode. | AirGap Policy Guild | Path: src/AirGap/StellaOps.AirGap.Policy | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 58 — Air-Gapped Mode Phase 3 – Staleness & Enforcement | AIRGAP-POL-58-002 | TODO | Add CLI sealed-mode guard. | AirGap Policy Guild | Path: src/AirGap/StellaOps.AirGap.Policy | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 58 — Air-Gapped Mode Phase 3 – Staleness & Enforcement | AIRGAP-TIME-58-001 | TODO | Compute drift/staleness metrics and surface via controller status. | AirGap Time Guild | Path: src/AirGap/StellaOps.AirGap.Time | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 58 — Air-Gapped Mode Phase 3 – Staleness & Enforcement | AIRGAP-TIME-58-002 | TODO | Emit notifications/events for staleness budgets. | AirGap Time Guild | Path: src/AirGap/StellaOps.AirGap.Time | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 58 — Air-Gapped Mode Phase 3 – Staleness & Enforcement | CLI-AIRGAP-58-001 | TODO | Ship portable evidence export helper. | DevEx/CLI Guild | Path: src/Cli/StellaOps.Cli | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 58 — Air-Gapped Mode Phase 3 – Staleness & Enforcement | CONCELIER-AIRGAP-57-002 | TODO | Annotate advisories with staleness metadata. | Concelier Core Guild | Path: src/Concelier/__Libraries/StellaOps.Concelier.Core | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 58 — Air-Gapped Mode Phase 3 – Staleness & Enforcement | EXCITITOR-AIRGAP-57-002 | TODO | Annotate VEX statements with staleness metadata. | Excititor Core Guild | Path: src/Excititor/__Libraries/StellaOps.Excititor.Core | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 58 — Air-Gapped Mode Phase 3 – Staleness & Enforcement | EXPORT-AIRGAP-57-001 | TODO | Add portable evidence export integration. | Exporter Service Guild | Path: src/ExportCenter/StellaOps.ExportCenter | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 58 — Air-Gapped Mode Phase 3 – Staleness & Enforcement | NOTIFY-AIRGAP-57-001 | TODO | Notify on drift/staleness thresholds. | Notifications Service Guild | Path: src/Notifier/StellaOps.Notifier | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 58 — Air-Gapped Mode Phase 3 – Staleness & Enforcement | ORCH-AIRGAP-58-001 | TODO | Link import/export jobs to timeline/evidence. | Orchestrator Service Guild | Path: src/Orchestrator/StellaOps.Orchestrator | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 58 — Air-Gapped Mode Phase 3 – Staleness & Enforcement | POLICY-AIRGAP-57-002 | TODO | Show degradation fallback info in explain traces. | Policy Guild | Path: src/Policy/StellaOps.Policy.Engine | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 58 — Air-Gapped Mode Phase 3 – Staleness & Enforcement | TASKRUN-AIRGAP-58-001 | TODO | Capture import job evidence transcripts. | Task Runner Guild | Path: src/TaskRunner/StellaOps.TaskRunner | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 59 — Air-Gapped Mode Phase 4 – Deterministic Jobs & Enforcement | CONCELIER-WEB-AIRGAP-57-001 | TODO | Map sealed-mode violations to standard errors. | Concelier WebService Guild | Path: src/Concelier/StellaOps.Concelier.WebService | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 59 — Air-Gapped Mode Phase 4 – Deterministic Jobs & Enforcement | EXCITITOR-WEB-AIRGAP-57-001 | TODO | Map sealed-mode violations to standard errors. | Excititor WebService Guild | Path: src/Excititor/StellaOps.Excititor.WebService | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 59 — Air-Gapped Mode Phase 4 – Deterministic Jobs & Enforcement | EXPORT-AIRGAP-58-001 | TODO | Emit notifications/timeline for bundle readiness. | Exporter Service Guild | Path: src/ExportCenter/StellaOps.ExportCenter | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 59 — Air-Gapped Mode Phase 4 – Deterministic Jobs & Enforcement | LEDGER-AIRGAP-56-002 | TODO | Enforce staleness thresholds for findings exports. | Findings Ledger Guild | Path: src/Findings/StellaOps.Findings.Ledger | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 59 — Air-Gapped Mode Phase 4 – Deterministic Jobs & Enforcement | NOTIFY-AIRGAP-58-001 | TODO | Notify on portable evidence exports. | Notifications Service Guild | Path: src/Notifier/StellaOps.Notifier | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 59 — Air-Gapped Mode Phase 4 – Deterministic Jobs & Enforcement | ORCH-AIRGAP-57-001 | TODO | Automate mirror bundle job scheduling with audit provenance. | Orchestrator Service Guild | Path: src/Orchestrator/StellaOps.Orchestrator | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 59 — Air-Gapped Mode Phase 4 – Deterministic Jobs & Enforcement | POLICY-AIRGAP-57-001 | TODO | Enforce sealed-mode guardrails inside evaluation engine. | Policy Guild | Path: src/Policy/StellaOps.Policy.Engine | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 59 — Air-Gapped Mode Phase 4 – Deterministic Jobs & Enforcement | TASKRUN-AIRGAP-57-001 | TODO | Block execution when seal state mismatched; emit timeline events. | Task Runner Guild | Path: src/TaskRunner/StellaOps.TaskRunner | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 60 — Air-Gapped Mode Phase 5 – Evidence Portability & UX | DOCS-AIRGAP-58-004 | TODO | Document portable evidence workflows. | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 60 — Air-Gapped Mode Phase 5 – Evidence Portability & UX | CLI-AIRGAP-58-001 | TODO | Finalize portable evidence CLI workflow with verification. | DevEx/CLI Guild | Path: src/Cli/StellaOps.Cli | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 60 — Air-Gapped Mode Phase 5 – Evidence Portability & UX | CONCELIER-WEB-AIRGAP-58-001 | TODO | Emit timeline events for bundle imports. | Concelier WebService Guild | Path: src/Concelier/StellaOps.Concelier.WebService | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 60 — Air-Gapped Mode Phase 5 – Evidence Portability & UX | EVID-OBS-60-001 | TODO | Deliver portable evidence export flow for sealed environments with checksum manifest and offline verification script. | Evidence Locker Guild | Path: src/EvidenceLocker/StellaOps.EvidenceLocker | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 60 — Air-Gapped Mode Phase 5 – Evidence Portability & UX | EXCITITOR-WEB-AIRGAP-58-001 | TODO | Emit timeline events for VEX bundle imports. | Excititor WebService Guild | Path: src/Excititor/StellaOps.Excititor.WebService | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 60 — Air-Gapped Mode Phase 5 – Evidence Portability & UX | LEDGER-AIRGAP-57-001 | TODO | Link findings to portable evidence bundles. | Findings Ledger Guild | Path: src/Findings/StellaOps.Findings.Ledger | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 60 — Air-Gapped Mode Phase 5 – Evidence Portability & UX | NOTIFY-AIRGAP-58-001 | TODO | (Carry) Portable evidence notifications. | Notifications Service Guild | Path: src/Notifier/StellaOps.Notifier | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 60 — Air-Gapped Mode Phase 5 – Evidence Portability & UX | POLICY-AIRGAP-58-001 | TODO | Notify on stale policy packs and guide remediation. | Policy Guild | Path: src/Policy/StellaOps.Policy.Engine | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 61 — SDKs & OpenAPI Phase 1 – Contract Foundations | DOCS-OAS-61-001 | TODO | Publish `/docs/api/overview.md`. | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 61 — SDKs & OpenAPI Phase 1 – Contract Foundations | DOCS-OAS-61-002 | TODO | Publish `/docs/api/conventions.md`. | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 61 — SDKs & OpenAPI Phase 1 – Contract Foundations | DOCS-OAS-61-003 | TODO | Publish `/docs/api/versioning.md`. | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 61 — SDKs & OpenAPI Phase 1 – Contract Foundations | DEVOPS-OAS-61-001 | TODO | Add OAS lint/validation/diff stages to CI. | DevOps Guild | Path: ops/devops | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 61 — SDKs & OpenAPI Phase 1 – Contract Foundations | APIGOV-61-001 | TODO | Configure lint rules and CI enforcement. | API Governance Guild | Path: src/Api/StellaOps.Api.Governance | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 61 — SDKs & OpenAPI Phase 1 – Contract Foundations | APIGOV-61-002 | TODO | Enforce example coverage in CI. | API Governance Guild | Path: src/Api/StellaOps.Api.Governance | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 61 — SDKs & OpenAPI Phase 1 – Contract Foundations | OAS-61-001 | TODO | Scaffold per-service OpenAPI skeletons with shared components. | API Contracts Guild | Path: src/Api/StellaOps.Api.OpenApi | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 61 — SDKs & OpenAPI Phase 1 – Contract Foundations | OAS-61-002 | TODO | Build aggregate composer and integrate into CI. | API Contracts Guild | Path: src/Api/StellaOps.Api.OpenApi | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 61 — SDKs & OpenAPI Phase 1 – Contract Foundations | AUTH-OAS-61-001 | TODO | Document Authority authentication APIs in OAS. | Authority Core & Security Guild | Path: src/Authority/StellaOps.Authority | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 61 — SDKs & OpenAPI Phase 1 – Contract Foundations | AUTH-OAS-61-002 | TODO | Provide Authority discovery endpoint. | Authority Core & Security Guild | Path: src/Authority/StellaOps.Authority | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 61 — SDKs & OpenAPI Phase 1 – Contract Foundations | CONCELIER-OAS-61-001 | TODO | Update advisory OAS coverage. | Concelier Core Guild | Path: src/Concelier/__Libraries/StellaOps.Concelier.Core | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 61 — SDKs & OpenAPI Phase 1 – Contract Foundations | CONCELIER-OAS-61-002 | TODO | Populate advisory examples. | Concelier Core Guild | Path: src/Concelier/__Libraries/StellaOps.Concelier.Core | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 61 — SDKs & OpenAPI Phase 1 – Contract Foundations | CONCELIER-WEB-OAS-61-001 | TODO | Implement Concelier discovery endpoint. | Concelier WebService Guild | Path: src/Concelier/StellaOps.Concelier.WebService | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 61 — SDKs & OpenAPI Phase 1 – Contract Foundations | CONCELIER-WEB-OAS-61-002 | TODO | Standardize error envelope. | Concelier WebService Guild | Path: src/Concelier/StellaOps.Concelier.WebService | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 61 — SDKs & OpenAPI Phase 1 – Contract Foundations | EXCITITOR-OAS-61-001 | TODO | Update VEX OAS coverage. | Excititor Core Guild | Path: src/Excititor/__Libraries/StellaOps.Excititor.Core | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 61 — SDKs & OpenAPI Phase 1 – Contract Foundations | EXCITITOR-OAS-61-002 | TODO | Provide VEX examples. | Excititor Core Guild | Path: src/Excititor/__Libraries/StellaOps.Excititor.Core | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 61 — SDKs & OpenAPI Phase 1 – Contract Foundations | EXCITITOR-WEB-OAS-61-001 | TODO | Implement discovery endpoint. | Excititor WebService Guild | Path: src/Excititor/StellaOps.Excititor.WebService | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 61 — SDKs & OpenAPI Phase 1 – Contract Foundations | EXCITITOR-WEB-OAS-61-002 | TODO | Migrate errors to standard envelope. | Excititor WebService Guild | Path: src/Excititor/StellaOps.Excititor.WebService | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 61 — SDKs & OpenAPI Phase 1 – Contract Foundations | EXPORT-OAS-61-001 | TODO | Update Exporter spec coverage. | Exporter Service Guild | Path: src/ExportCenter/StellaOps.ExportCenter | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 61 — SDKs & OpenAPI Phase 1 – Contract Foundations | EXPORT-OAS-61-002 | TODO | Implement Exporter discovery endpoint. | Exporter Service Guild | Path: src/ExportCenter/StellaOps.ExportCenter | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 61 — SDKs & OpenAPI Phase 1 – Contract Foundations | LEDGER-OAS-61-001 | TODO | Expand Findings Ledger spec coverage. | Findings Ledger Guild | Path: src/Findings/StellaOps.Findings.Ledger | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 61 — SDKs & OpenAPI Phase 1 – Contract Foundations | LEDGER-OAS-61-002 | TODO | Provide ledger discovery endpoint. | Findings Ledger Guild | Path: src/Findings/StellaOps.Findings.Ledger | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 61 — SDKs & OpenAPI Phase 1 – Contract Foundations | NOTIFY-OAS-61-001 | TODO | Update notifier spec coverage. | Notifications Service Guild | Path: src/Notifier/StellaOps.Notifier | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 61 — SDKs & OpenAPI Phase 1 – Contract Foundations | NOTIFY-OAS-61-002 | TODO | Implement notifier discovery endpoint. | Notifications Service Guild | Path: src/Notifier/StellaOps.Notifier | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 61 — SDKs & OpenAPI Phase 1 – Contract Foundations | ORCH-OAS-61-001 | TODO | Extend Orchestrator spec coverage. | Orchestrator Service Guild | Path: src/Orchestrator/StellaOps.Orchestrator | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 61 — SDKs & OpenAPI Phase 1 – Contract Foundations | ORCH-OAS-61-002 | TODO | Provide orchestrator discovery endpoint. | Orchestrator Service Guild | Path: src/Orchestrator/StellaOps.Orchestrator | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 61 — SDKs & OpenAPI Phase 1 – Contract Foundations | TASKRUN-OAS-61-001 | TODO | Document Task Runner APIs in OAS. | Task Runner Guild | Path: src/TaskRunner/StellaOps.TaskRunner | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 61 — SDKs & OpenAPI Phase 1 – Contract Foundations | TASKRUN-OAS-61-002 | TODO | Expose Task Runner discovery endpoint. | Task Runner Guild | Path: src/TaskRunner/StellaOps.TaskRunner | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 61 — SDKs & OpenAPI Phase 1 – Contract Foundations | WEB-OAS-61-001 | TODO | Implement gateway discovery endpoint. | BE-Base Platform Guild | Path: src/Web/StellaOps.Web | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 61 — SDKs & OpenAPI Phase 1 – Contract Foundations | WEB-OAS-61-002 | TODO | Standardize error envelope across gateway. | BE-Base Platform Guild | Path: src/Web/StellaOps.Web | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 62 — SDKs & OpenAPI Phase 2 – Examples & Portal | DOCS-CONTRIB-62-001 | TODO | Publish API contracts contributing guide. | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 62 — SDKs & OpenAPI Phase 2 – Examples & Portal | DOCS-DEVPORT-62-001 | TODO | Document dev portal publishing. | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 62 — SDKs & OpenAPI Phase 2 – Examples & Portal | DOCS-OAS-62-001 | TODO | Deploy `/docs/api/reference/` generated site. | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 62 — SDKs & OpenAPI Phase 2 – Examples & Portal | DOCS-SDK-62-001 | TODO | Publish SDK overview + language guides. | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 62 — SDKs & OpenAPI Phase 2 – Examples & Portal | DOCS-SEC-62-001 | TODO | Update auth scopes documentation. | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 62 — SDKs & OpenAPI Phase 2 – Examples & Portal | DOCS-TEST-62-001 | TODO | Publish contract testing doc. | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 62 — SDKs & OpenAPI Phase 2 – Examples & Portal | APIGOV-62-001 | TODO | Implement compatibility diff tool. | API Governance Guild | Path: src/Api/StellaOps.Api.Governance | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 62 — SDKs & OpenAPI Phase 2 – Examples & Portal | OAS-62-001 | TODO | Populate examples for top endpoints. | API Contracts Guild | Path: src/Api/StellaOps.Api.OpenApi | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 62 — SDKs & OpenAPI Phase 2 – Examples & Portal | AUTH-OAS-62-001 | TODO | Provide SDK auth helpers/tests. | Authority Core & Security Guild | Path: src/Authority/StellaOps.Authority | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 62 — SDKs & OpenAPI Phase 2 – Examples & Portal | CLI-SDK-62-001 | TODO | Migrate CLI to official SDK. | DevEx/CLI Guild | Path: src/Cli/StellaOps.Cli | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 62 — SDKs & OpenAPI Phase 2 – Examples & Portal | CLI-SDK-62-002 | TODO | Update CLI error handling for new envelope. | DevEx/CLI Guild | Path: src/Cli/StellaOps.Cli | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 62 — SDKs & OpenAPI Phase 2 – Examples & Portal | CONCELIER-OAS-62-001 | TODO | Add SDK smoke tests for advisory APIs. | Concelier Core Guild | Path: src/Concelier/__Libraries/StellaOps.Concelier.Core | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 62 — SDKs & OpenAPI Phase 2 – Examples & Portal | CONCELIER-WEB-OAS-62-001 | TODO | Add advisory API examples. | Concelier WebService Guild | Path: src/Concelier/StellaOps.Concelier.WebService | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 62 — SDKs & OpenAPI Phase 2 – Examples & Portal | DEVPORT-62-001 | TODO | Build static generator with nav/search. | Developer Portal Guild | Path: src/DevPortal/StellaOps.DevPortal.Site | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 62 — SDKs & OpenAPI Phase 2 – Examples & Portal | DEVPORT-62-002 | TODO | Add schema viewer, examples, version selector. | Developer Portal Guild | Path: src/DevPortal/StellaOps.DevPortal.Site | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 62 — SDKs & OpenAPI Phase 2 – Examples & Portal | EXCITITOR-OAS-62-001 | TODO | Add SDK tests for VEX APIs. | Excititor Core Guild | Path: src/Excititor/__Libraries/StellaOps.Excititor.Core | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 62 — SDKs & OpenAPI Phase 2 – Examples & Portal | EXCITITOR-WEB-OAS-62-001 | TODO | Provide VEX API examples. | Excititor WebService Guild | Path: src/Excititor/StellaOps.Excititor.WebService | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 62 — SDKs & OpenAPI Phase 2 – Examples & Portal | EXPORT-OAS-62-001 | TODO | Ensure SDK streaming helpers for exports. | Exporter Service Guild | Path: src/ExportCenter/StellaOps.ExportCenter | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 62 — SDKs & OpenAPI Phase 2 – Examples & Portal | LEDGER-OAS-62-001 | TODO | Provide SDK tests for ledger APIs. | Findings Ledger Guild | Path: src/Findings/StellaOps.Findings.Ledger | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 62 — SDKs & OpenAPI Phase 2 – Examples & Portal | NOTIFY-OAS-62-001 | TODO | Provide SDK examples for notifier APIs. | Notifications Service Guild | Path: src/Notifier/StellaOps.Notifier | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 62 — SDKs & OpenAPI Phase 2 – Examples & Portal | SDKGEN-62-001 | TODO | Establish generator framework. | SDK Generator Guild | Path: src/Sdk/StellaOps.Sdk.Generator | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 62 — SDKs & OpenAPI Phase 2 – Examples & Portal | SDKGEN-62-002 | TODO | Implement shared post-processing helpers. | SDK Generator Guild | Path: src/Sdk/StellaOps.Sdk.Generator | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 62 — SDKs & OpenAPI Phase 2 – Examples & Portal | TASKRUN-OAS-62-001 | TODO | Provide SDK examples for pack runs. | Task Runner Guild | Path: src/TaskRunner/StellaOps.TaskRunner | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 62 — SDKs & OpenAPI Phase 2 – Examples & Portal | WEB-OAS-62-001 | TODO | Align pagination/idempotency behaviors. | BE-Base Platform Guild | Path: src/Web/StellaOps.Web | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 62 — SDKs & OpenAPI Phase 2 – Examples & Portal | CONTR-62-001 | TODO | Generate mock server fixtures. | Contract Testing Guild | Path: test/contract | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 62 — SDKs & OpenAPI Phase 2 – Examples & Portal | CONTR-62-002 | TODO | Integrate mock server into CI. | Contract Testing Guild | Path: test/contract | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 63 — SDKs & OpenAPI Phase 3 – SDK Alpha & Try-It | DOCS-TEST-62-001 | TODO | (Carry) ensure contract testing doc final. | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 63 — SDKs & OpenAPI Phase 3 – SDK Alpha & Try-It | APIGOV-63-001 | TODO | Integrate compatibility diff gating. | API Governance Guild | Path: src/Api/StellaOps.Api.Governance | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 63 — SDKs & OpenAPI Phase 3 – SDK Alpha & Try-It | OAS-63-001 | TODO | Compatibility diff support. | API Contracts Guild | Path: src/Api/StellaOps.Api.OpenApi | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 63 — SDKs & OpenAPI Phase 3 – SDK Alpha & Try-It | OAS-63-002 | TODO | Define discovery schema metadata. | API Contracts Guild | Path: src/Api/StellaOps.Api.OpenApi | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 63 — SDKs & OpenAPI Phase 3 – SDK Alpha & Try-It | CLI-SDK-63-001 | TODO | Add CLI spec download command. | DevEx/CLI Guild | Path: src/Cli/StellaOps.Cli | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 63 — SDKs & OpenAPI Phase 3 – SDK Alpha & Try-It | DEVPORT-63-001 | TODO | Add Try-It console. | Developer Portal Guild | Path: src/DevPortal/StellaOps.DevPortal.Site | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 63 — SDKs & OpenAPI Phase 3 – SDK Alpha & Try-It | DEVPORT-63-002 | TODO | Embed SDK snippets/quick starts. | Developer Portal Guild | Path: src/DevPortal/StellaOps.DevPortal.Site | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 63 — SDKs & OpenAPI Phase 3 – SDK Alpha & Try-It | SDKGEN-63-001 | TODO | Release TypeScript SDK alpha. | SDK Generator Guild | Path: src/Sdk/StellaOps.Sdk.Generator | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 63 — SDKs & OpenAPI Phase 3 – SDK Alpha & Try-It | SDKGEN-63-002 | TODO | Release Python SDK alpha. | SDK Generator Guild | Path: src/Sdk/StellaOps.Sdk.Generator | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 63 — SDKs & OpenAPI Phase 3 – SDK Alpha & Try-It | SDKGEN-63-003 | TODO | Release Go SDK alpha. | SDK Generator Guild | Path: src/Sdk/StellaOps.Sdk.Generator | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 63 — SDKs & OpenAPI Phase 3 – SDK Alpha & Try-It | SDKGEN-63-004 | TODO | Release Java SDK alpha. | SDK Generator Guild | Path: src/Sdk/StellaOps.Sdk.Generator | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 63 — SDKs & OpenAPI Phase 3 – SDK Alpha & Try-It | SDKREL-63-001 | TODO | Configure SDK release pipelines. | SDK Release Guild | Path: src/Sdk/StellaOps.Sdk.Release | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 63 — SDKs & OpenAPI Phase 3 – SDK Alpha & Try-It | SDKREL-63-002 | TODO | Automate changelogs from OAS diffs. | SDK Release Guild | Path: src/Sdk/StellaOps.Sdk.Release | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 63 — SDKs & OpenAPI Phase 3 – SDK Alpha & Try-It | CONTR-63-001 | TODO | Build replay harness for drift detection. | Contract Testing Guild | Path: test/contract | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 63 — SDKs & OpenAPI Phase 3 – SDK Alpha & Try-It | CONTR-63-002 | TODO | Emit contract testing metrics. | Contract Testing Guild | Path: test/contract | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 64 — SDKs & OpenAPI Phase 4 – Harden & Offline Bundles | DOCS-AIRGAP-DEVPORT-64-001 | TODO | Document devportal offline usage. | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 64 — SDKs & OpenAPI Phase 4 – Harden & Offline Bundles | DEVOPS-DEVPORT-63-001 | TODO | Automate developer portal pipeline. | DevOps Guild | Path: ops/devops | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 64 — SDKs & OpenAPI Phase 4 – Harden & Offline Bundles | DEVOPS-DEVPORT-64-001 | TODO | Schedule offline bundle builds. | DevOps Guild | Path: ops/devops | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 64 — SDKs & OpenAPI Phase 4 – Harden & Offline Bundles | DEVPORT-64-001 | TODO | Offline portal build. | Developer Portal Guild | Path: src/DevPortal/StellaOps.DevPortal.Site | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 64 — SDKs & OpenAPI Phase 4 – Harden & Offline Bundles | DEVPORT-64-002 | TODO | Add accessibility/performance checks. | Developer Portal Guild | Path: src/DevPortal/StellaOps.DevPortal.Site | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 64 — SDKs & OpenAPI Phase 4 – Harden & Offline Bundles | DVOFF-64-001 | TODO | Implement devportal offline export job. | DevPortal Offline Guild | Path: src/ExportCenter/StellaOps.ExportCenter.DevPortalOffline | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 64 — SDKs & OpenAPI Phase 4 – Harden & Offline Bundles | DVOFF-64-002 | TODO | Provide verification CLI. | DevPortal Offline Guild | Path: src/ExportCenter/StellaOps.ExportCenter.DevPortalOffline | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 64 — SDKs & OpenAPI Phase 4 – Harden & Offline Bundles | SDKGEN-64-001 | TODO | Migrate CLI to SDK. | SDK Generator Guild | Path: src/Sdk/StellaOps.Sdk.Generator | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 64 — SDKs & OpenAPI Phase 4 – Harden & Offline Bundles | SDKGEN-64-002 | TODO | Integrate SDKs into Console. | SDK Generator Guild | Path: src/Sdk/StellaOps.Sdk.Generator | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 64 — SDKs & OpenAPI Phase 4 – Harden & Offline Bundles | SDKREL-64-001 | TODO | Hook SDK releases to Notifications. | SDK Release Guild | Path: src/Sdk/StellaOps.Sdk.Release | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 64 — SDKs & OpenAPI Phase 4 – Harden & Offline Bundles | SDKREL-64-002 | TODO | Produce devportal offline bundle. | SDK Release Guild | Path: src/Sdk/StellaOps.Sdk.Release | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 65 — SDKs & OpenAPI Phase 5 – Deprecation & Notifications | DOCS-AIRGAP-DEVPORT-64-001 | TODO | (Carry) ensure offline doc published; update as necessary. | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 65 — SDKs & OpenAPI Phase 5 – Deprecation & Notifications | APIGOV-63-001 | TODO | (Carry) compatibility gating monitoring. | API Governance Guild | Path: src/Api/StellaOps.Api.Governance | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 65 — SDKs & OpenAPI Phase 5 – Deprecation & Notifications | AUTH-OAS-63-001 | DONE (2025-11-01) | Deprecation headers for auth endpoints. | Authority Core & Security Guild | Path: src/Authority/StellaOps.Authority | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 65 — SDKs & OpenAPI Phase 5 – Deprecation & Notifications | CLI-SDK-64-001 | TODO | SDK update awareness command. | DevEx/CLI Guild | Path: src/Cli/StellaOps.Cli | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 65 — SDKs & OpenAPI Phase 5 – Deprecation & Notifications | CONCELIER-OAS-63-001 | TODO | Deprecation metadata for Concelier APIs. | Concelier Core Guild | Path: src/Concelier/__Libraries/StellaOps.Concelier.Core | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 65 — SDKs & OpenAPI Phase 5 – Deprecation & Notifications | EXCITITOR-OAS-63-001 | TODO | Deprecation metadata for VEX APIs. | Excititor Core Guild | Path: src/Excititor/__Libraries/StellaOps.Excititor.Core | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 65 — SDKs & OpenAPI Phase 5 – Deprecation & Notifications | EXPORT-OAS-63-001 | TODO | Deprecation headers for exporter APIs. | Exporter Service Guild | Path: src/ExportCenter/StellaOps.ExportCenter | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 65 — SDKs & OpenAPI Phase 5 – Deprecation & Notifications | LEDGER-OAS-63-001 | TODO | Deprecation headers for ledger APIs. | Findings Ledger Guild | Path: src/Findings/StellaOps.Findings.Ledger | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 65 — SDKs & OpenAPI Phase 5 – Deprecation & Notifications | NOTIFY-OAS-63-001 | TODO | Emit deprecation notifications. | Notifications Service Guild | Path: src/Notifier/StellaOps.Notifier | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 65 — SDKs & OpenAPI Phase 5 – Deprecation & Notifications | ORCH-OAS-63-001 | TODO | Add orchestrator deprecation headers. | Orchestrator Service Guild | Path: src/Orchestrator/StellaOps.Orchestrator | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 65 — SDKs & OpenAPI Phase 5 – Deprecation & Notifications | SDKREL-64-001 | TODO | Production rollout of notifications feed. | SDK Release Guild | Path: src/Sdk/StellaOps.Sdk.Release | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 65 — SDKs & OpenAPI Phase 5 – Deprecation & Notifications | TASKRUN-OAS-63-001 | TODO | Add Task Runner deprecation headers. | Task Runner Guild | Path: src/TaskRunner/StellaOps.TaskRunner | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 65 — SDKs & OpenAPI Phase 5 – Deprecation & Notifications | WEB-OAS-63-001 | TODO | Implement deprecation headers in gateway. | BE-Base Platform Guild | Path: src/Web/StellaOps.Web | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 66 — Risk Profiles Phase 1 – Foundations | DOCS-RISK-66-001 | TODO | Publish `/docs/risk/overview.md`. | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 66 — Risk Profiles Phase 1 – Foundations | DOCS-RISK-66-002 | TODO | Publish `/docs/risk/profiles.md`. | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 66 — Risk Profiles Phase 1 – Foundations | DOCS-RISK-66-003 | TODO | Publish `/docs/risk/factors.md`. | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 66 — Risk Profiles Phase 1 – Foundations | DOCS-RISK-66-004 | TODO | Publish `/docs/risk/formulas.md`. | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 66 — Risk Profiles Phase 1 – Foundations | CLI-RISK-66-001 | TODO | Implement CLI profile management commands. | DevEx/CLI Guild | Path: src/Cli/StellaOps.Cli | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 66 — Risk Profiles Phase 1 – Foundations | CLI-RISK-66-002 | TODO | Implement CLI simulation command. | DevEx/CLI Guild | Path: src/Cli/StellaOps.Cli | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 66 — Risk Profiles Phase 1 – Foundations | CONCELIER-RISK-66-001 | TODO | Expose CVSS/KEV provider data. | Concelier Core Guild | Path: src/Concelier/__Libraries/StellaOps.Concelier.Core | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 66 — Risk Profiles Phase 1 – Foundations | CONCELIER-RISK-66-002 | TODO | Provide fix availability signals. | Concelier Core Guild | Path: src/Concelier/__Libraries/StellaOps.Concelier.Core | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 66 — Risk Profiles Phase 1 – Foundations | EXCITITOR-RISK-66-001 | TODO | Supply VEX gating data to risk engine. | Excititor Core Guild | Path: src/Excititor/__Libraries/StellaOps.Excititor.Core | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 66 — Risk Profiles Phase 1 – Foundations | EXCITITOR-RISK-66-002 | TODO | Provide reachability inputs. | Excititor Core Guild | Path: src/Excititor/__Libraries/StellaOps.Excititor.Core | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 66 — Risk Profiles Phase 1 – Foundations | LEDGER-RISK-66-001 | TODO | Add risk scoring columns/indexes. | Findings Ledger Guild | Path: src/Findings/StellaOps.Findings.Ledger | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 66 — Risk Profiles Phase 1 – Foundations | LEDGER-RISK-66-002 | TODO | Implement deterministic scoring upserts. | Findings Ledger Guild | Path: src/Findings/StellaOps.Findings.Ledger | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 66 — Risk Profiles Phase 1 – Foundations | NOTIFY-RISK-66-001 | TODO | Create risk severity alert templates. | Notifications Service Guild | Path: src/Notifier/StellaOps.Notifier | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 66 — Risk Profiles Phase 1 – Foundations | POLICY-RISK-66-003 | BLOCKED (2025-11-26) | Reachability inputs (80-001) and engine config contract not defined; cannot integrate. | Policy Guild | Path: src/Policy/StellaOps.Policy.Engine | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 66 — Risk Profiles Phase 1 – Foundations | POLICY-RISK-66-001 | DONE (2025-11-22) | Deliver RiskProfile schema + validators. | Risk Profile Schema Guild | Path: src/Policy/StellaOps.Policy.RiskProfile | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 66 — Risk Profiles Phase 1 – Foundations | POLICY-RISK-66-002 | DONE (2025-11-26) | Deterministic inheritance/merge + hashing delivered. | Risk Profile Schema Guild | Path: src/Policy/StellaOps.Policy.RiskProfile | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 66 — Risk Profiles Phase 1 – Foundations | POLICY-RISK-66-004 | BLOCKED (2025-11-26) | Blocked by 66-003; Policy libraries need config shape. | Policy Guild | Path: src/Policy/__Libraries/StellaOps.Policy | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 66 — Risk Profiles Phase 1 – Foundations | RISK-ENGINE-66-001 | DONE (2025-11-25) | Deterministic risk queue/worker/registry scaffolded. | Risk Engine Guild | Path: src/RiskEngine/StellaOps.RiskEngine | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 66 — Risk Profiles Phase 1 – Foundations | RISK-ENGINE-66-002 | DONE (2025-11-25) | Transforms/clamping/gating implemented. | Risk Engine Guild | Path: src/RiskEngine/StellaOps.RiskEngine | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 66 — Risk Profiles Phase 1 – Foundations | WEB-RISK-66-001 | TODO | Expose risk API routing in gateway. | BE-Base Platform Guild | Path: src/Web/StellaOps.Web | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 66 — Risk Profiles Phase 1 – Foundations | WEB-RISK-66-002 | TODO | Handle explainability downloads. | BE-Base Platform Guild | Path: src/Web/StellaOps.Web | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 67 — Risk Profiles Phase 2 – Providers & Lifecycle | DOCS-RISK-67-001 | TODO | Publish explainability doc. | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 67 — Risk Profiles Phase 2 – Providers & Lifecycle | DOCS-RISK-67-002 | TODO | Publish risk API doc. | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 67 — Risk Profiles Phase 2 – Providers & Lifecycle | DOCS-RISK-67-003 | TODO | Publish console risk UI doc. | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 67 — Risk Profiles Phase 2 – Providers & Lifecycle | DOCS-RISK-67-004 | TODO | Publish CLI risk doc. | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 67 — Risk Profiles Phase 2 – Providers & Lifecycle | CLI-RISK-67-001 | TODO | Provide risk results query command. | DevEx/CLI Guild | Path: src/Cli/StellaOps.Cli | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 67 — Risk Profiles Phase 2 – Providers & Lifecycle | CONCELIER-RISK-67-001 | TODO | Add source consensus metrics. | Concelier Core Guild | Path: src/Concelier/__Libraries/StellaOps.Concelier.Core | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 67 — Risk Profiles Phase 2 – Providers & Lifecycle | EXCITITOR-RISK-67-001 | TODO | Add VEX explainability metadata. | Excititor Core Guild | Path: src/Excititor/__Libraries/StellaOps.Excititor.Core | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 67 — Risk Profiles Phase 2 – Providers & Lifecycle | NOTIFY-RISK-67-001 | TODO | Notify on profile publish/deprecate. | Notifications Service Guild | Path: src/Notifier/StellaOps.Notifier | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 67 — Risk Profiles Phase 2 – Providers & Lifecycle | NOTIFY-RISK-68-001 | TODO | (Prep) risk routing settings seeds. | Notifications Service Guild | Path: src/Notifier/StellaOps.Notifier | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 67 — Risk Profiles Phase 2 – Providers & Lifecycle | POLICY-RISK-67-001 | BLOCKED (2025-11-26) | Depends on 66-003/66-004; reachability/config missing. | Policy Guild | Path: src/Policy/StellaOps.Policy.Engine | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 67 — Risk Profiles Phase 2 – Providers & Lifecycle | POLICY-RISK-67-002 | BLOCKED (2025-11-26) | Risk profile lifecycle contract/schema not published. | Policy Guild | Path: src/Policy/StellaOps.Policy.Engine | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 67 — Risk Profiles Phase 2 – Providers & Lifecycle | POLICY-RISK-67-001 | BLOCKED (2025-11-26) | Depends on 66-003/66-004; reachability/config missing. | Risk Profile Schema Guild | Path: src/Policy/StellaOps.Policy.RiskProfile | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 67 — Risk Profiles Phase 2 – Providers & Lifecycle | POLICY-RISK-67-002 | BLOCKED (2025-11-26) | Risk profile lifecycle contract/schema not published. | Risk Profile Schema Guild | Path: src/Policy/StellaOps.Policy.RiskProfile | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 67 — Risk Profiles Phase 2 – Providers & Lifecycle | POLICY-RISK-67-003 | BLOCKED (2025-11-26) | Blocked by 67-002 contract + simulation inputs. | Policy Guild | Path: src/Policy/__Libraries/StellaOps.Policy | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 67 — Risk Profiles Phase 2 – Providers & Lifecycle | RISK-ENGINE-67-001 | DONE (2025-11-25) | Integrated CVSS/KEV providers. | Risk Engine Guild | Path: src/RiskEngine/StellaOps.RiskEngine | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 67 — Risk Profiles Phase 2 – Providers & Lifecycle | RISK-ENGINE-67-002 | DONE (2025-11-25) | Added VEX gate provider. | Risk Engine Guild | Path: src/RiskEngine/StellaOps.RiskEngine | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 67 — Risk Profiles Phase 2 – Providers & Lifecycle | RISK-ENGINE-67-003 | DONE (2025-11-25) | Fix availability/criticality/exposure providers added. | Risk Engine Guild | Path: src/RiskEngine/StellaOps.RiskEngine | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 67 — Risk Profiles Phase 2 – Providers & Lifecycle | WEB-RISK-67-001 | TODO | Provide risk status endpoint. | BE-Base Platform Guild | Path: src/Web/StellaOps.Web | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 68 — Risk Profiles Phase 3 – APIs & Ledger | DOCS-RISK-68-001 | TODO | Publish risk bundle doc. | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 68 — Risk Profiles Phase 3 – APIs & Ledger | DOCS-RISK-68-002 | TODO | Update AOC invariants doc. | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 68 — Risk Profiles Phase 3 – APIs & Ledger | CLI-RISK-68-001 | TODO | Add risk bundle verification command. | DevEx/CLI Guild | Path: src/Cli/StellaOps.Cli | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 68 — Risk Profiles Phase 3 – APIs & Ledger | LEDGER-RISK-67-001 | TODO | Provide scored findings query API. | Findings Ledger Guild | Path: src/Findings/StellaOps.Findings.Ledger | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 68 — Risk Profiles Phase 3 – APIs & Ledger | LEDGER-RISK-68-001 | TODO | Enable scored findings export. | Findings Ledger Guild | Path: src/Findings/StellaOps.Findings.Ledger | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 68 — Risk Profiles Phase 3 – APIs & Ledger | NOTIFY-RISK-68-001 | TODO | Configure risk notification routing UI/logic. | Notifications Service Guild | Path: src/Notifier/StellaOps.Notifier | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 68 — Risk Profiles Phase 3 – APIs & Ledger | POLICY-RISK-68-001 | BLOCKED (2025-11-26) | Simulation API blocked by 67-003 outputs and Policy Studio contract. | Policy Guild | Path: src/Policy/StellaOps.Policy.Engine | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 68 — Risk Profiles Phase 3 – APIs & Ledger | POLICY-RISK-68-002 | BLOCKED (2025-11-26) | Blocked until overrides/export signing rules are agreed. | Policy Guild | Path: src/Policy/__Libraries/StellaOps.Policy | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 68 — Risk Profiles Phase 3 – APIs & Ledger | RISK-ENGINE-68-001 | DONE (2025-11-25) | Persist scoring results & explanations. | Risk Engine Guild | Path: src/RiskEngine/StellaOps.RiskEngine | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 68 — Risk Profiles Phase 3 – APIs & Ledger | RISK-ENGINE-68-002 | DONE (2025-11-25) | Expose jobs/results/explanations APIs. | Risk Engine Guild | Path: src/RiskEngine/StellaOps.RiskEngine | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 68 — Risk Profiles Phase 3 – APIs & Ledger | WEB-RISK-68-001 | TODO | Emit severity transition events via gateway. | BE-Base Platform Guild | Path: src/Web/StellaOps.Web | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 69 — Risk Profiles Phase 4 – Simulation & Reporting | DOCS-RISK-67-001..004 | TODO | (Carry) ensure docs updated from simulation release. | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 69 — Risk Profiles Phase 4 – Simulation & Reporting | RISK-BUNDLE-69-001 | TODO | Build risk bundle. | Risk Bundle Export Guild | Path: src/ExportCenter/StellaOps.ExportCenter.RiskBundles | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 69 — Risk Profiles Phase 4 – Simulation & Reporting | RISK-BUNDLE-69-002 | TODO | Integrate bundle into pipelines. | Risk Bundle Export Guild | Path: src/ExportCenter/StellaOps.ExportCenter.RiskBundles | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 69 — Risk Profiles Phase 4 – Simulation & Reporting | EXPORT-RISK-69-002 | TODO | Enable simulation report exports. | Exporter Service Guild | Path: src/ExportCenter/StellaOps.ExportCenter | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 69 — Risk Profiles Phase 4 – Simulation & Reporting | NOTIFY-RISK-66-001 | TODO | (Completion) finalize severity alert templates. | Notifications Service Guild | Path: src/Notifier/StellaOps.Notifier | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 69 — Risk Profiles Phase 4 – Simulation & Reporting | RISK-ENGINE-69-001 | TODO | Implement simulation mode. | Risk Engine Guild | Path: src/RiskEngine/StellaOps.RiskEngine | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 69 — Risk Profiles Phase 4 – Simulation & Reporting | RISK-ENGINE-69-002 | TODO | Add telemetry/metrics dashboards. | Risk Engine Guild | Path: src/RiskEngine/StellaOps.RiskEngine | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 70 — Risk Profiles Phase 5 – Air-Gap & Advanced Factors | DOCS-RISK-68-001 | TODO | (Carry) finalize risk bundle doc after verification CLI. | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 70 — Risk Profiles Phase 5 – Air-Gap & Advanced Factors | RISK-BUNDLE-70-001 | TODO | Provide bundle verification CLI. | Risk Bundle Export Guild | Path: src/ExportCenter/StellaOps.ExportCenter.RiskBundles | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 70 — Risk Profiles Phase 5 – Air-Gap & Advanced Factors | RISK-BUNDLE-70-002 | TODO | Publish documentation. | Risk Bundle Export Guild | Path: src/ExportCenter/StellaOps.ExportCenter.RiskBundles | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 70 — Risk Profiles Phase 5 – Air-Gap & Advanced Factors | EXPORT-RISK-70-001 | TODO | Integrate risk bundle into offline kit. | Exporter Service Guild | Path: src/ExportCenter/StellaOps.ExportCenter | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 70 — Risk Profiles Phase 5 – Air-Gap & Advanced Factors | NOTIFY-RISK-68-001 | TODO | Finalize risk alert routing UI. | Notifications Service Guild | Path: src/Notifier/StellaOps.Notifier | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 70 — Risk Profiles Phase 5 – Air-Gap & Advanced Factors | RISK-ENGINE-70-001 | TODO | Support offline provider bundles. | Risk Engine Guild | Path: src/RiskEngine/StellaOps.RiskEngine | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 70 — Risk Profiles Phase 5 – Air-Gap & Advanced Factors | RISK-ENGINE-70-002 | TODO | Integrate runtime/reachability providers. | Risk Engine Guild | Path: src/RiskEngine/StellaOps.RiskEngine | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 71 — Risk Profiles Phase 6 – Quality & Performance | DOCS-RISK-67-001..68-002 | TODO | Final editorial pass on risk documentation set. | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 71 — Risk Profiles Phase 6 – Quality & Performance | CLI-RISK-66-001..68-001 | TODO | Harden CLI commands with integration tests and error handling. | DevEx/CLI Guild | Path: src/Cli/StellaOps.Cli | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 71 — Risk Profiles Phase 6 – Quality & Performance | LEDGER-RISK-69-001 | TODO | Finalize dashboards and alerts for scoring latency. | Findings Ledger Guild | Path: src/Findings/StellaOps.Findings.Ledger | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 71 — Risk Profiles Phase 6 – Quality & Performance | NOTIFY-RISK-68-001 | TODO | Tune routing/quiet hour dedupe for risk alerts. | Notifications Service Guild | Path: src/Notifier/StellaOps.Notifier | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 71 — Risk Profiles Phase 6 – Quality & Performance | RISK-ENGINE-69-002 | TODO | Optimize performance, cache, and incremental scoring; validate SLOs. | Risk Engine Guild | Path: src/RiskEngine/StellaOps.RiskEngine | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 72 — Attestor Console Phase 1 – Foundations | DEVOPS-ATTEST-73-001 | TODO | (Prep) align CI secrets for Attestor service. | DevOps Guild | Path: ops/devops | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 72 — Attestor Console Phase 1 – Foundations | ATTEST-ENVELOPE-72-001 | TODO | Implement DSSE canonicalization and hashing helpers. | Envelope Guild | Path: src/Attestor/StellaOps.Attestor.Envelope | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 72 — Attestor Console Phase 1 – Foundations | ATTEST-ENVELOPE-72-002 | TODO | Support compact/expanded output and detached payloads. | Envelope Guild | Path: src/Attestor/StellaOps.Attestor.Envelope | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 72 — Attestor Console Phase 1 – Foundations | ATTEST-TYPES-72-001 | DONE | Draft schemas for all attestation payload types. | Attestation Payloads Guild | Path: src/Attestor/StellaOps.Attestor.Types | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 72 — Attestor Console Phase 1 – Foundations | ATTEST-TYPES-72-002 | DONE | Generate models/validators from schemas. | Attestation Payloads Guild | Path: src/Attestor/StellaOps.Attestor.Types | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 72 — Attestor Console Phase 1 – Foundations | ATTESTOR-72-001 | TODO | Scaffold attestor service skeleton. | Attestor Service Guild | Path: src/Attestor/StellaOps.Attestor | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 72 — Attestor Console Phase 1 – Foundations | ATTESTOR-72-002 | TODO | Implement attestation store + storage integration. | Attestor Service Guild | Path: src/Attestor/StellaOps.Attestor | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 72 — Attestor Console Phase 1 – Foundations | KMS-72-001 | DONE | Implement KMS interface + file driver. | KMS Guild | Path: src/__Libraries/StellaOps.Cryptography.Kms | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 73 — Attestor CLI Phase 2 – Signing & Policies | CLI-ATTEST-73-001 | TODO | Implement `stella attest sign` (payload selection, subject digest, key reference, output format) using official SDK transport. | CLI Attestor Guild | Path: src/Cli/StellaOps.Cli | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 73 — Attestor CLI Phase 2 – Signing & Policies | CLI-ATTEST-73-002 | TODO | Implement `stella attest verify` with policy selection, explainability output, and JSON/table formatting. | CLI Attestor Guild | Path: src/Cli/StellaOps.Cli | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 73 — Attestor Console Phase 2 – Signing & Policies | DOCS-ATTEST-73-001 | TODO | Publish attestor overview. | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 73 — Attestor Console Phase 2 – Signing & Policies | DOCS-ATTEST-73-002 | DONE | Publish payload docs. | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 73 — Attestor Console Phase 2 – Signing & Policies | DOCS-ATTEST-73-003 | TODO | Publish policies doc. | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 73 — Attestor Console Phase 2 – Signing & Policies | DOCS-ATTEST-73-004 | TODO | Publish workflows doc. | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 73 — Attestor Console Phase 2 – Signing & Policies | ATTEST-ENVELOPE-73-001 | TODO | Add signing/verification helpers with KMS integration. | Envelope Guild | Path: src/Attestor/StellaOps.Attestor.Envelope | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 73 — Attestor Console Phase 2 – Signing & Policies | ATTEST-TYPES-73-001 | DONE | Create golden payload fixtures. | Attestation Payloads Guild | Path: src/Attestor/StellaOps.Attestor.Types | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 73 — Attestor Console Phase 2 – Signing & Policies | ATTESTOR-73-001 | DOING | Ship signing endpoint. | Attestor Service Guild | Path: src/Attestor/StellaOps.Attestor | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 73 — Attestor Console Phase 2 – Signing & Policies | ATTESTOR-73-002 | TODO | Ship verification pipeline and reports. | Attestor Service Guild | Path: src/Attestor/StellaOps.Attestor | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 73 — Attestor Console Phase 2 – Signing & Policies | ATTESTOR-73-003 | TODO | Implement list/fetch APIs. | Attestor Service Guild | Path: src/Attestor/StellaOps.Attestor | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 73 — Attestor Console Phase 2 – Signing & Policies | KMS-72-002 | DONE (2025-10-30) | CLI support for key import/export. | KMS Guild | Path: src/__Libraries/StellaOps.Cryptography.Kms | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 73 — Attestor Console Phase 2 – Signing & Policies | POLICY-ATTEST-73-001 | TODO | Implement VerificationPolicy lifecycle. | Policy Guild | Path: src/Policy/StellaOps.Policy.Engine | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 73 — Attestor Console Phase 2 – Signing & Policies | POLICY-ATTEST-73-002 | TODO | Surface policies in Policy Studio. | Policy Guild | Path: src/Policy/StellaOps.Policy.Engine | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 74 — Attestor CLI Phase 3 – Transparency & Chain of Custody | CLI-ATTEST-74-001 | TODO | Implement `stella attest list` with filters (subject, type, issuer, scope) and pagination. | CLI Attestor Guild | Path: src/Cli/StellaOps.Cli | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 74 — Attestor CLI Phase 3 – Transparency & Chain of Custody | CLI-ATTEST-74-002 | TODO | Implement `stella attest fetch` to download envelopes and payloads to disk. | CLI Attestor Guild | Path: src/Cli/StellaOps.Cli | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 74 — Attestor Console Phase 3 – Transparency & Chain of Custody | DOCS-ATTEST-74-001 | TODO | Publish keys & issuers doc. | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 74 — Attestor Console Phase 3 – Transparency & Chain of Custody | DOCS-ATTEST-74-002 | TODO | Publish transparency doc. | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 74 — Attestor Console Phase 3 – Transparency & Chain of Custody | DOCS-ATTEST-74-003 | TODO | Publish console attestor UI doc. | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 74 — Attestor Console Phase 3 – Transparency & Chain of Custody | DOCS-ATTEST-74-004 | TODO | Publish CLI attest doc. | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 74 — Attestor Console Phase 3 – Transparency & Chain of Custody | DEVOPS-ATTEST-74-001 | TODO | Deploy transparency witness infra. | DevOps Guild | Path: ops/devops | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 74 — Attestor Console Phase 3 – Transparency & Chain of Custody | ATTEST-ENVELOPE-73-002 | TODO | Run fuzz tests for envelope handling. | Envelope Guild | Path: src/Attestor/StellaOps.Attestor.Envelope | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 74 — Attestor Console Phase 3 – Transparency & Chain of Custody | ATTEST-VERIFY-74-001 | TODO | Add telemetry for verification pipeline. | Verification Guild | Path: src/Attestor/StellaOps.Attestor.Verify | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 74 — Attestor Console Phase 3 – Transparency & Chain of Custody | ATTEST-VERIFY-74-002 | TODO | Document verification explainability. | Verification Guild | Path: src/Attestor/StellaOps.Attestor.Verify | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 74 — Attestor Console Phase 3 – Transparency & Chain of Custody | ATTESTOR-74-001 | DOING | Integrate transparency witness client. | Attestor Service Guild | Path: src/Attestor/StellaOps.Attestor | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 74 — Attestor Console Phase 3 – Transparency & Chain of Custody | ATTESTOR-74-002 | TODO | Implement bulk verification worker. | Attestor Service Guild | Path: src/Attestor/StellaOps.Attestor | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 74 — Attestor Console Phase 3 – Transparency & Chain of Custody | EXPORT-ATTEST-74-001 | TODO | Build attestation bundle export job. | Attestation Bundle Guild | Path: src/ExportCenter/StellaOps.ExportCenter.AttestationBundles | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 74 — Attestor Console Phase 3 – Transparency & Chain of Custody | NOTIFY-ATTEST-74-001 | TODO | Add verification/key notifications. | Notifications Service Guild | Path: src/Notifier/StellaOps.Notifier | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 74 — Attestor Console Phase 3 – Transparency & Chain of Custody | NOTIFY-ATTEST-74-002 | TODO | Notify key rotation/revocation. | Notifications Service Guild | Path: src/Notifier/StellaOps.Notifier | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 75 — Attestor CLI Phase 4 – Air Gap & Bulk | CLI-ATTEST-75-002 | TODO | Add support for building/verifying attestation bundles in CLI. | CLI Attestor Guild, Export Guild | Path: src/Cli/StellaOps.Cli | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 75 — Attestor Console Phase 4 – Air Gap & Bulk | DOCS-ATTEST-75-001 | TODO | Publish attestor airgap doc. | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 75 — Attestor Console Phase 4 – Air Gap & Bulk | DOCS-ATTEST-75-002 | TODO | Update AOC invariants for attestations. | Docs Guild | Path: docs | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 75 — Attestor Console Phase 4 – Air Gap & Bulk | DEVOPS-ATTEST-74-002 | TODO | Integrate bundle builds into release/offline pipelines. | DevOps Guild | Path: ops/devops | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 75 — Attestor Console Phase 4 – Air Gap & Bulk | DEVOPS-ATTEST-75-001 | TODO | Dashboards/alerts for attestor metrics. | DevOps Guild | Path: ops/devops | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 75 — Attestor Console Phase 4 – Air Gap & Bulk | ATTESTOR-75-001 | TODO | Support attestation bundle export/import for air gap. | Attestor Service Guild | Path: src/Attestor/StellaOps.Attestor | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 75 — Attestor Console Phase 4 – Air Gap & Bulk | ATTESTOR-75-002 | DONE | Harden APIs (rate limits, fuzz tests, threat model actions). | Attestor Service Guild | Path: src/Attestor/StellaOps.Attestor | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 75 — Attestor Console Phase 4 – Air Gap & Bulk | EXPORT-ATTEST-75-001 | TODO | CLI bundle verify/import. | Attestation Bundle Guild | Path: src/ExportCenter/StellaOps.ExportCenter.AttestationBundles | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 75 — Attestor Console Phase 4 – Air Gap & Bulk | EXPORT-ATTEST-75-002 | TODO | Document attestor airgap workflow. | Attestation Bundle Guild | Path: src/ExportCenter/StellaOps.ExportCenter.AttestationBundles | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 120 — [Policy & Reasoning] 120.A) AirGap | AIRGAP-POL-56-001 | DONE | Implement `StellaOps.AirGap.Policy` package exposing `EgressPolicy` facade with sealed/unsealed branches and remediation-friendly errors. | AirGap Policy Guild | Path: src/AirGap/StellaOps.AirGap.Policy | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 120 — [Policy & Reasoning] 120.A) AirGap | AIRGAP-POL-56-002 | DONE | Create Roslyn analyzer/code fix warning on raw `HttpClient` usage outside approved wrappers; add CI integration. Dependencies: AIRGAP-POL-56-001. | AirGap Policy Guild, DevEx Guild | Path: src/AirGap/StellaOps.AirGap.Policy | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 120 — [Policy & Reasoning] 120.A) AirGap | AIRGAP-POL-57-001 | DONE (2025-11-03) | Update core web services (Web, Exporter, Policy, Findings, Authority) to use `EgressPolicy`; ensure configuration wiring for sealed mode. Dependencies: AIRGAP-POL-56-002. | AirGap Policy Guild, BE-Base Platform Guild | Path: src/AirGap/StellaOps.AirGap.Policy | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 120 — [Policy & Reasoning] 120.A) AirGap | AIRGAP-POL-57-002 | DONE (2025-11-03) | Implement Task Runner job plan validator rejecting network steps unless marked internal allow-list.
2025-11-03: Worker wiring pulls `IEgressPolicy`, filesystem dispatcher enforces sealed-mode egress, dispatcher test + grant normalization landed, package versions aligned to rc.2.
Next: ensure other dispatchers/executors reuse the injected policy before enabling sealed-mode runs in worker service. Dependencies: AIRGAP-POL-57-001. | AirGap Policy Guild, Task Runner Guild | Path: src/AirGap/StellaOps.AirGap.Policy | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 120 — [Policy & Reasoning] 120.A) AirGap | AIRGAP-POL-58-001 | DONE (2025-11-03) | Ensure Observability exporters only target local endpoints in sealed mode; disable remote sinks with warning.
2025-11-03: Introduced `StellaOps.Telemetry.Core` with OTLP exporter guard; Registry Token Service consumes new telemetry bootstrap; sealed-mode now skips non-loopback collectors and logs remediation guidance; docs refreshed for telemetry/air-gap playbooks. Dependencies: AIRGAP-POL-57-002. | AirGap Policy Guild, Observability Guild | Path: src/AirGap/StellaOps.AirGap.Policy | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 120 — [Policy & Reasoning] 120.A) AirGap | AIRGAP-POL-58-002 | DONE (2025-11-03) | Add CLI sealed-mode guard that refuses commands needing egress and surfaces remediation.
2025-11-03: CLI now wires HTTP clients through `StellaOps.AirGap.Policy`, returns `AIRGAP_EGRESS_BLOCKED` with remediation when sealed, and docs updated. Dependencies: AIRGAP-POL-58-001. | AirGap Policy Guild, CLI Guild | Path: src/AirGap/StellaOps.AirGap.Policy | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 120 — [Policy & Reasoning] 120.B) Findings.I | LEDGER-29-001 | DONE (2025-11-03) | Design ledger & projection schemas (tables/indexes), canonical JSON format, hashing strategy, and migrations. Publish schema doc + fixtures.
2025-11-03: Initial migration, canonical fixtures, and schema doc alignment delivered (LEDGER-29-001). | Findings Ledger Guild | Path: src/Findings/StellaOps.Findings.Ledger | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 120 — [Policy & Reasoning] 120.B) Findings.I | LEDGER-29-002 | DONE (2025-11-03) | Implement ledger write API (`POST /vuln/ledger/events`) with validation, idempotency, hash chaining, and Merkle root computation job.
2025-11-03: Web service + domain scaffolding landed with canonical hashing helpers, in-memory repository, Merkle scheduler stub, request/response contracts, and unit tests covering hashing & conflict flows. Dependencies: LEDGER-29-001. | Findings Ledger Guild | Path: src/Findings/StellaOps.Findings.Ledger | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 120 — [Policy & Reasoning] 120.B) Findings.I | LEDGER-29-003 | DONE (2025-11-03) | Build projector worker that derives `findings_projection` rows from ledger events + policy determinations; ensure idempotent replay keyed by `(tenant,finding_id,policy_version)`.
2025-11-03: Postgres projection services landed with replay checkpoints, fixtures, and unit coverage (LEDGER-29-003). Dependencies: LEDGER-29-002. | Findings Ledger Guild, Scheduler Guild | Path: src/Findings/StellaOps.Findings.Ledger | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 120 — [Policy & Reasoning] 120.B) Findings.I | LEDGER-29-004 | DONE (2025-11-04) | Integrate Policy Engine batch evaluation (baseline + simulate) with projector; cache rationale references.
2025-11-04: Ledger service now calls `/api/policy/eval/batch` with resilient HttpClient, shared cache, and inline fallback; documentation/config samples updated; ledger tests executed (`dotnet test src/Findings/__Tests/StellaOps.Findings.Ledger.Tests/StellaOps.Findings.Ledger.Tests.csproj --no-restore`). Dependencies: LEDGER-29-003. | Findings Ledger Guild, Policy Guild | Path: src/Findings/StellaOps.Findings.Ledger | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 120 — [Policy & Reasoning] 120.B) Findings.I | LEDGER-29-005 | DONE | Implement workflow mutation handlers (assign, comment, accept-risk, target-fix, verify-fix, reopen) producing ledger events with validation and attachments metadata. Dependencies: LEDGER-29-004. | Findings Ledger Guild | Path: src/Findings/StellaOps.Findings.Ledger | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 120 — [Policy & Reasoning] 120.B) Findings.I | LEDGER-29-006 | DONE | Integrate attachment encryption (KMS envelope), signed URL issuance, CSRF protection hooks for Console. Dependencies: LEDGER-29-005. | Findings Ledger Guild, Security Guild | Path: src/Findings/StellaOps.Findings.Ledger | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 120 — [Policy & Reasoning] 120.C) Policy.II | POLICY-ENGINE-27-003 | DONE | Implement complexity/time limit enforcement with compiler scoring, configurable thresholds, and structured diagnostics (`ERR_POL_COMPLEXITY`). Dependencies: POLICY-ENGINE-27-002. | Policy Guild, Security Guild | Path: src/Policy/StellaOps.Policy.Engine | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 120 — [Policy & Reasoning] 120.C) Policy.II | POLICY-ENGINE-27-004 | DONE | Update golden/property tests to cover new coverage metrics, symbol tables, explain traces, and complexity limits; provide fixtures for Registry/Console integration. Dependencies: POLICY-ENGINE-27-003. | Policy Guild, QA Guild | Path: src/Policy/StellaOps.Policy.Engine | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 130 — Scanner & Surface / Scanner.I | `SCANNER-ANALYZERS-LANG-10-308R` | DONE (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Rust) | Determinism fixtures + performance benchmarks; compare against competitor heuristic coverage. | DONE | Path: src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Rust | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 130 — Scanner & Surface / Scanner.I | `SCANNER-ANALYZERS-LANG-10-309R` | DONE (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Rust) | Package plug-in manifest + Offline Kit documentation; ensure Worker integration. Dependencies: SCANNER-ANALYZERS-LANG-10-308R. | DONE | Path: src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Rust | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 130 — Scanner & Surface / Scanner.I | `ENTRYTRACE-SURFACE-01` | DONE (2025-11-02) | Run Surface.Validation prereq checks and resolve cached entry fragments via Surface.FS to avoid duplicate parsing. | EntryTrace Guild | Path: src/Scanner/__Libraries/StellaOps.Scanner.EntryTrace | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 130 — Scanner & Surface / Scanner.I | `ENTRYTRACE-SURFACE-02` | DONE (2025-11-02) | Replace direct env/secret access with Surface.Secrets provider when tracing runtime configs. Dependencies: ENTRYTRACE-SURFACE-01. | EntryTrace Guild | Path: src/Scanner/__Libraries/StellaOps.Scanner.EntryTrace | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 130 — Scanner & Surface / Scanner.I | `SCANNER-ENTRYTRACE-18-509` | DONE (2025-11-02) | Add regression coverage for EntryTrace surfaces (result store, WebService endpoint, CLI renderer) and NDJSON hashing. | EntryTrace Guild, QA Guild | Path: src/Scanner/__Libraries/StellaOps.Scanner.EntryTrace | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 130 — Scanner & Surface / Scanner.I | `SCANNER-ENTRYTRACE-18-507` | DONE (2025-11-02) | Expand candidate discovery beyond ENTRYPOINT/CMD by scanning Docker history metadata and default service directories (`/etc/services/**`, `/s6/**`, `/etc/supervisor/*.conf`, `/usr/local/bin/*-entrypoint`) when explicit commands are absent. Dependencies: SCANNER-ENTRYTRACE-18-509. | EntryTrace Guild | Path: src/Scanner/__Libraries/StellaOps.Scanner.EntryTrace | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 130 — Scanner & Surface / Scanner.I | `SCANNER-ENTRYTRACE-18-508` | DONE (2025-11-02) | Extend wrapper catalogue to collapse language/package launchers (`bundle`, `bundle exec`, `docker-php-entrypoint`, `npm`, `yarn node`, `pipenv`, `poetry run`) and vendor init scripts before terminal classification. Dependencies: SCANNER-ENTRYTRACE-18-507. | EntryTrace Guild | Path: src/Scanner/__Libraries/StellaOps.Scanner.EntryTrace | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 130 — Scanner & Surface / Scanner.I | `LANG-SURFACE-01` | DONE (2025-11-03) | Invoke Surface.Validation checks (env/cache/secrets) before analyzer execution to ensure consistent prerequisites.
2025-11-03: CompositeScanAnalyzerDispatcher now enforces Surface.Validation prior to language analyzers and propagates actionable failure diagnostics. | Language Analyzer Guild | Path: src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 130 — Scanner & Surface / Scanner.I | `LANG-SURFACE-02` | DONE (2025-11-03) | Consume Surface.FS APIs for layer/source caching (instead of bespoke caches) to improve determinism. Dependencies: LANG-SURFACE-01.
2025-11-03: Language analyzer runs fingerprint the workspace and persist results via Surface.FS cache helper for deterministic reuse. | Language Analyzer Guild | Path: src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 130 — Scanner & Surface / Scanner.I | `LANG-SURFACE-03` | DONE (2025-11-03) | Replace direct secret/env reads with Surface.Secrets references when fetching package feeds or registry creds. Dependencies: LANG-SURFACE-02.
2025-11-03: LanguageAnalyzerContext exposes Surface.Secrets-backed helper for registry/feed credentials with unit coverage. | Language Analyzer Guild | Path: src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 130 — Scanner & Surface / Scanner.VII | `SCANNER-EVENTS-16-302` | DONE (2025-11-06) | Extend orchestrator event links (report/policy/attestation) once endpoints are finalised across gateway + console. Dependencies: SCANNER-EVENTS-16-301.
2025-11-06 22:55Z: Dispatcher honours configurable console/API segments; docs and samples refreshed; added regression test for custom segments. `dotnet test` previously blocked by legacy Surface cache ctor signature (tracked under Surface task).
2025-11-06 23:30Z: Report DSSE fixtures re-synced; Surface cache ctor drift repaired; `dotnet test src/Scanner/__Tests/StellaOps.Scanner.WebService.Tests --no-build` now green end-to-end. | Scanner WebService Guild | Path: src/Scanner/StellaOps.Scanner.WebService | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 130 — Scanner & Surface / Scanner.VII | `SCANNER-SECRETS-01` | DONE (2025-11-06) | Adopt `StellaOps.Scanner.Surface.Secrets` for registry/CAS credentials during scan execution.
2025-11-02: Surface.Secrets provider wired for CAS token retrieval; integration tests added.
2025-11-06: Replaced registry credential plumbing with shared provider + rotation-aware metrics; introduced registry secret stage and analysis keys.
2025-11-06 23:40Z: Installed .NET 10 RC2 runtime, parser/stage unit suites green (`dotnet test` Surface.Secrets + Worker focused filter). | Scanner Worker Guild, Security Guild | Path: src/Scanner/StellaOps.Scanner.Worker | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 130 — Scanner & Surface / Scanner.VII | `SCANNER-SECRETS-02` | DONE (2025-11-06) | Replace ad-hoc secret wiring with Surface.Secrets for report/export operations (registry and CAS tokens). Dependencies: SCANNER-SECRETS-01.
2025-11-02: WebService export path now resolves registry credentials via Surface.Secrets stub; CI pipeline hook in progress.
2025-11-06: Picking up Surface.Secrets provider usage across report/export flows and removing legacy secret file readers.
2025-11-06 21:40Z: WebService options now consume `cas-access` secrets via configurator; storage mirrors updated; targeted tests passing.
2025-11-06 23:58Z: Registry + attestation secrets sourced via Surface.Secrets (options extended, configurator + tests updated); Surface.Secrets & configurator test suites executed on .NET 10 RC2 runtime. | Scanner WebService Guild, Security Guild | Path: src/Scanner/StellaOps.Scanner.WebService | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 130 — Scanner & Surface / Scanner.VII | `SCANNER-SURFACE-01` | DONE (2025-11-06) | Persist Surface.FS manifests after analyzer stages, including layer CAS metadata and EntryTrace fragments.
2025-11-02: Worker pipeline emitting draft Surface.FS manifests for sample scans; determinism checks running.
2025-11-06: Continuing with manifest writer abstraction + telemetry wiring for Surface.FS persistence.
2025-11-06 18:45Z: Resumed work; targeting manifest writer abstraction, CAS persistence hooks, and telemetry/test coverage updates.
2025-11-06 20:20Z: Published Surface worker Grafana dashboard + updated design doc; WebService pointer integration test now covers manifest/payload artefacts. | Scanner Worker Guild | Path: src/Scanner/StellaOps.Scanner.Worker | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 130 — Scanner & Surface / Scanner.VII | `SCANNER-SURFACE-02` | DONE (2025-11-05) | Publish Surface.FS pointers (CAS URIs, manifests) via scan/report APIs and update attestation metadata. Dependencies: SCANNER-SURFACE-01.
2025-11-05: Surface pointer projection wired through WebService endpoints, orchestrator samples & DSSE fixtures refreshed with `surface` manifest block, and regression suite (platform events, report sample, ready check) updated. | Scanner WebService Guild | Path: src/Scanner/StellaOps.Scanner.WebService | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 130 — Scanner & Surface / Scanner.VII | `SCANNER-SURFACE-03` | DONE (2025-11-07) | Push layer manifests and entry fragments into Surface.FS during build-time SBOM generation. Dependencies: SCANNER-SURFACE-02.
2025-11-06: Starting BuildX manifest upload implementation with Surface.FS client abstraction and integration tests.
2025-11-07 15:30Z: Resumed BuildX plugin Surface wiring; analyzing Surface.FS models, CAS flow, and upcoming tests before coding.
2025-11-07 22:10Z: Added Surface manifest writer + CLI flags to the BuildX plug-in, persisted artefacts into CAS, regenerated docs/fixtures, and shipped new tests covering the writer + descriptor flow. | BuildX Plugin Guild | Path: src/Scanner/StellaOps.Scanner.Sbomer.BuildXPlugin | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 320 — Docs Modules Export Center | CENTER-DOCS-0001 | DONE (2025-11-05) | Validate that `docs/modules/export-center/README.md` matches the latest release notes, including devportal offline profile, DSSE manifest signatures, and supporting specs. | Docs Guild | Path: docs/modules/export-center/TASKS.md | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 327 — Docs Modules Scanner | SCANNER-DOCS-0001 | DONE (2025-11-05) | Validate that `docs/modules/scanner/README.md` is current with platform-event coverage (`scanner.report.ready@1`, `scanner.scan.completed@1`). | Docs Guild | Path: docs/modules/scanner/TASKS.md | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 327 — Docs Modules Scanner | SCANNER-DOCS-0002 | DONE (2025-11-02) | Keep scanner benchmark comparisons (Trivy/Grype/Snyk) and deep-dive matrices up to date with cited sources. | Docs Guild | Path: docs/modules/scanner/TASKS.md | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 327 — Docs Modules Scanner | DOCS-SCANNER-BENCH-62-001 | DONE (2025-11-02) | Maintain the scanner comparison doc for Trivy/Grype/Snyk with refreshed deep dives and ecosystem matrices. | Docs Guild, Scanner Guild | Path: docs/benchmarks/scanner | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 327 — Docs Modules Scanner | DOCS-SCANNER-BENCH-62-007 | DONE (2025-11-05) | Publish secret leak detection documentation (rules, policy templates) once implementation lands. | Docs Guild, Security Guild | Path: docs/benchmarks/scanner | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 327 — Docs Modules Scanner | DOCS-SCANNER-BENCH-62-010 | DONE (2025-11-02) | Document PHP analyzer parity gaps with technique tables and policy hooks. | Docs Guild, PHP Analyzer Guild | Path: docs/benchmarks/scanner | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 327 — Docs Modules Scanner | DOCS-SCANNER-BENCH-62-011 | DONE (2025-11-02) | Capture Deno runtime gap analysis versus competitors, including detection/merge strategy tables. | Docs Guild, Language Analyzer Guild | Path: docs/benchmarks/scanner | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 327 — Docs Modules Scanner | DOCS-SCANNER-BENCH-62-012 | DONE (2025-11-02) | Add Dart ecosystem comparisons and task linkage in `scanning-gaps-stella-misses-from-competitors.md`. | Docs Guild, Language Analyzer Guild | Path: docs/benchmarks/scanner | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 327 — Docs Modules Scanner | DOCS-SCANNER-BENCH-62-013 | DONE (2025-11-02) | Expand Swift coverage analysis with implementation techniques and policy considerations. | Docs Guild, Swift Analyzer Guild | Path: docs/benchmarks/scanner | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 327 — Docs Modules Scanner | DOCS-SCANNER-BENCH-62-014 | DONE (2025-11-02) | Detail Kubernetes/VM target coverage gaps and linkage with Zastava/Runtime docs. | Docs Guild, Runtime Guild | Path: docs/benchmarks/scanner | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 327 — Docs Modules Scanner | DOCS-SCANNER-BENCH-62-015 | DONE (2025-11-02) | Document DSSE/Rekor operator enablement guidance drawn from competitor comparisons. | Docs Guild, Export Center Guild | Path: docs/benchmarks/scanner | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 112 — Concelier.I | CONCELIER-CRYPTO-90-001 | DONE (2025-11-08) | Route WebService hashing through `ICryptoHash` so sovereign deployments (e.g., RootPack_RU) can select CryptoPro/PKCS#11 providers; discovery, chunk builders, and seed processors updated accordingly. | Concelier WebService Guild, Security Guild | Path: src/Concelier/StellaOps.Concelier.WebService | 2025-10-19 | +| docs/implplan/archived/updates/tasks.md | Sprint 158 — TaskRunner.II | TASKRUN-43-001 | DONE (2025-11-06) | Implement approvals workflow (resume after approval), notifications integration, remote artifact uploads, chaos resilience, secret injection, and audit logging for TaskRunner. | Task Runner Guild | Path: src/TaskRunner/StellaOps.TaskRunner | 2025-10-19 | +| docs/implplan/archived/updates/SPRINT_100_identity_signing.md | Sprint 100 Identity Signing | AUTH-AIRGAP-57-001 | DONE (2025-11-08) | | Authority Core & Security Guild, DevOps Guild (src/Authority/StellaOps.Authority) | Enforce sealed-mode CI gating by refusing token issuance when declared sealed install lacks sealing confirmation. (Deps: AUTH-AIRGAP-56-001, DEVOPS-AIRGAP-57-002.) | | +| docs/implplan/archived/updates/SPRINT_100_identity_signing.md | Sprint 100 Identity Signing | AUTH-PACKS-43-001 | DONE (2025-11-09) | | Authority Core & Security Guild (src/Authority/StellaOps.Authority) | Enforce pack signing policies, approval RBAC checks, CLI CI token scopes, and audit logging for approvals. (Deps: AUTH-PACKS-41-001, TASKRUN-42-001, ORCH-SVC-42-101.) | | +| docs/implplan/archived/updates/SPRINT_110_ingestion_evidence_2025-11-13.md | Sprint 110 Ingestion Evidence 2025-11-13 | DOCS-AIAI-31-004 | DOING | | | | | +| docs/implplan/archived/updates/SPRINT_110_ingestion_evidence_2025-11-13.md | Sprint 110 Ingestion Evidence 2025-11-13 | AIAI-31-009 | DONE (2025-11-12) | | | | | +| docs/implplan/archived/updates/SPRINT_110_ingestion_evidence_2025-11-13.md | Sprint 110 Ingestion Evidence 2025-11-13 | AIAI-31-008 | TODO | | | | | +| docs/implplan/archived/updates/SPRINT_110_ingestion_evidence_2025-11-13.md | Sprint 110 Ingestion Evidence 2025-11-13 | SBOM-AIAI-31-003 | BLOCKED | | | | | +| docs/implplan/archived/updates/SPRINT_110_ingestion_evidence_2025-11-13.md | Sprint 110 Ingestion Evidence 2025-11-13 | DOCS-AIAI-31-005/006/008/009 | BLOCKED | | | | | +| docs/implplan/archived/updates/SPRINT_130_scanner_surface.md | Sprint 130 Scanner Surface | `SCANNER-ANALYZERS-DENO-26-001` | DONE | Build the deterministic input normalizer + VFS merger for `deno.json(c)`, import maps, lockfiles, vendor trees, `$DENO_DIR`, and OCI layers so analyzers have a canonical file view. | Deno Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Deno) | — | | +| docs/implplan/archived/updates/SPRINT_130_scanner_surface.md | Sprint 130 Scanner Surface | `SCANNER-ANALYZERS-DENO-26-002` | DONE | Implement the module graph resolver covering static/dynamic imports, npm bridge, cache lookups, built-ins, WASM/JSON assertions, and annotate edges with their resolution provenance. | Deno Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Deno) | SCANNER-ANALYZERS-DENO-26-001 | | +| docs/implplan/archived/updates/SPRINT_130_scanner_surface.md | Sprint 130 Scanner Surface | `SCANNER-ANALYZERS-DENO-26-003` | DONE | Ship the npm/node compatibility adapter that maps `npm:` specifiers, evaluates `exports` conditionals, and logs builtin usage for policy overlays. | Deno Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Deno) | SCANNER-ANALYZERS-DENO-26-002 | | +| docs/implplan/archived/updates/SPRINT_130_scanner_surface.md | Sprint 130 Scanner Surface | `SCANNER-ANALYZERS-DENO-26-004` | DONE | Add the permission/capability analyzer covering FS/net/env/process/crypto/FFI/workers plus dynamic-import + literal fetch heuristics with reason codes. | Deno Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Deno) | SCANNER-ANALYZERS-DENO-26-003 | | +| docs/implplan/archived/updates/SPRINT_130_scanner_surface.md | Sprint 130 Scanner Surface | `SCANNER-ANALYZERS-DENO-26-005` | DONE | Build bundle/binary inspectors for eszip and `deno compile` executables to recover graphs, configs, embedded resources, and snapshots. | Deno Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Deno) | SCANNER-ANALYZERS-DENO-26-004 | | +| docs/implplan/archived/updates/SPRINT_130_scanner_surface.md | Sprint 130 Scanner Surface | `SCANNER-ANALYZERS-DENO-26-006` | DONE | Implement the OCI/container adapter that stitches per-layer Deno caches, vendor trees, and compiled binaries back into provenance-aware analyzer inputs. | Deno Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Deno) | SCANNER-ANALYZERS-DENO-26-005 | | +| docs/implplan/archived/updates/SPRINT_130_scanner_surface.md | Sprint 130 Scanner Surface | `SCANNER-ANALYZERS-DENO-26-007` | DONE | Produce AOC-compliant observation writers (entrypoints, modules, capability edges, workers, warnings, binaries) with deterministic reason codes. | Deno Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Deno) | SCANNER-ANALYZERS-DENO-26-006 | | +| docs/implplan/archived/updates/SPRINT_130_scanner_surface.md | Sprint 130 Scanner Surface | `SCANNER-ANALYZERS-DENO-26-008` | DONE | Finalize fixture + benchmark suite (vendor/npm/FFI/worker/dynamic import/bundle/cache/container cases) validating analyzer determinism and performance. | Deno Analyzer Guild, QA Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Deno) | SCANNER-ANALYZERS-DENO-26-007 | | +| docs/implplan/archived/updates/SPRINT_137_scanner_gap_design.md | Sprint 137 Scanner Gap Design | `SCANNER-ENG-0002` | DONE (2025-11-09) | Design the Node.js lockfile collector + CLI validator per `docs/benchmarks/scanner/scanning-gaps-stella-misses-from-competitors.md`, capturing Surface + policy requirements before implementation. | Scanner Guild, CLI Guild (docs/modules/scanner) | — | | +| docs/implplan/archived/updates/SPRINT_137_scanner_gap_design.md | Sprint 137 Scanner Gap Design | `SCANNER-ENG-0003` | DONE (2025-11-09) | Design Python lockfile + editable-install parity checks with policy predicates and CLI workflow coverage as outlined in the gap analysis. | Python Analyzer Guild, CLI Guild (docs/modules/scanner) | — | | +| docs/implplan/archived/updates/SPRINT_137_scanner_gap_design.md | Sprint 137 Scanner Gap Design | `SCANNER-ENG-0004` | DONE (2025-11-09) | Design Java lockfile ingestion/validation (Gradle/SBT collectors, CLI verb, policy hooks) to close comparison gaps. | Java Analyzer Guild, CLI Guild (docs/modules/scanner) | — | | +| docs/implplan/archived/updates/SPRINT_137_scanner_gap_design.md | Sprint 137 Scanner Gap Design | `SCANNER-ENG-0005` | DONE (2025-11-09) | Enhance Go stripped-binary fallback inference design, including inferred module metadata + policy integration, per the gap analysis. | Go Analyzer Guild (docs/modules/scanner) | — | | +| docs/implplan/archived/updates/SPRINT_137_scanner_gap_design.md | Sprint 137 Scanner Gap Design | `SCANNER-ENG-0006` | DONE (2025-11-09) | Expand Rust fingerprint coverage design (enriched fingerprint catalogue + policy controls) per the comparison matrix. | Rust Analyzer Guild (docs/modules/scanner) | — | | +| docs/implplan/archived/updates/SPRINT_137_scanner_gap_design.md | Sprint 137 Scanner Gap Design | `SCANNER-ENG-0007` | DONE (2025-11-09) | Design the deterministic secret leak detection pipeline covering rule packaging, Policy Engine integration, and CLI workflow. | Scanner Guild, Policy Guild (docs/modules/scanner) | — | | +| docs/implplan/archived/updates/2025-10-18-docs-guild.md | Update note | Docs Guild Update — 2025-10-18 | INFO | **Subject:** ADR process + events schema validation shipped | | | 2025-10-18 | +| docs/implplan/archived/updates/2025-10-19-docs-guild.md | Update note | Docs Guild Update — 2025-10-19 | INFO | **Subject:** Event envelope reference & canonical samples | | | 2025-10-19 | +| docs/implplan/archived/updates/2025-10-19-platform-events.md | Update note | Platform Events Update — 2025-10-19 | INFO | **Subject:** Canonical event samples enforced across tests & CI | | | 2025-10-19 | +| docs/implplan/archived/updates/2025-10-19-scanner-policy.md | Update note | 2025-10-19 – Scanner ↔ Policy Sync | INFO | - Scanner WebService now emits `scanner.report.ready` and `scanner.scan.completed` via Redis Streams when `scanner.events.enabled=true`; DSSE envelopes are embedded verbatim to keep Notify/UI consumers in sync. | | | 2025-10-19 | +| docs/implplan/archived/updates/2025-10-19-scheduler-storage.md | Update note | Scheduler Storage Update — 2025-10-19 | INFO | **Subject:** Mongo bootstrap + canonical fixtures | | | 2025-10-19 | +| docs/implplan/archived/updates/2025-10-20-authority-identity-registry.md | Update note | 2025-10-20 — Authority Identity Provider Registry & DPoP nonce updates | INFO | - Authority host now resolves identity providers through the new metadata/handle pattern introduced in `StellaOps.Authority.Plugins.Abstractions`. Runtime handlers (`ValidateClientCredentialsHandler`, `ValidatePasswordGrantHandler`, `ValidateAccessTokenHandler`, bootstrap endpoints) acquire providers with `IAuthorityIdentityProviderRegistry.AcquireAsync` and rely on metadata (`AuthorityIdentityProviderMetadata`) for capability checks. | | | 2025-10-20 | +| docs/implplan/archived/updates/2025-10-20-scanner-events.md | Update note | 2025-10-20 – Scanner Platform Events Hardening | INFO | - Scanner WebService now wires a reusable `IRedisConnectionFactory`, simplifying redis transport testing and reuse for future adapters. | | | 2025-10-20 | +| docs/implplan/archived/updates/2025-10-22-docs-guild.md | Update note | Docs Guild Update — 2025-10-22 | INFO | **Subject:** Concelier Authority toggle rollout polish | | | 2025-10-22 | +| docs/implplan/archived/updates/2025-10-26-authority-graph-scopes.md | Update note | 2025-10-26 — Authority graph scopes documentation refresh | INFO | - Documented least-privilege guidance for the new `graph:*` scopes in `docs/11_AUTHORITY.md` (scope mapping, tenant propagation, and DPoP expectations). | | | 2025-10-26 | +| docs/implplan/archived/updates/2025-10-26-scheduler-graph-jobs.md | Update note | 2025-10-26 — Scheduler Graph Job DTOs ready for integration | INFO | SCHED-MODELS-21-001 delivered the new `GraphBuildJob`/`GraphOverlayJob` contracts and SCHED-MODELS-21-002 publishes the accompanying documentation + samples for downstream teams. | | | 2025-10-26 | +| docs/implplan/archived/updates/2025-10-27-console-security-signoff.md | Update note | Console Security Checklist Sign-off — 2025-10-27 | INFO | - Security Guild completed the console security compliance checklist from [`docs/security/console-security.md`](../security/console-security.md) against the Sprint 23 build. | | | 2025-10-27 | +| docs/implplan/archived/updates/2025-10-27-orch-operator-scope.md | Update note | 2025-10-27 — Orchestrator operator scope & audit metadata | INFO | - Introduced the `orch:operate` scope and `Orch.Operator` role in Authority to unlock Orchestrator control actions while keeping read-only access under `Orch.Viewer`. | | | 2025-10-27 | +| docs/implplan/archived/updates/2025-10-27-policy-scope-migration.md | Update note | 2025-10-27 — Policy scope migration guidance | INFO | - Updated Authority defaults (`etc/authority.yaml`) to register a `policy-cli` client using the fine-grained scope set introduced by AUTH-POLICY-23-001 (`policy:read`, `policy:author`, `policy:review`, `policy:simulate`, `findings:read`). | | | 2025-10-27 | +| docs/implplan/archived/updates/2025-10-27-task-packs-docs.md | Update note | Docs Guild Update — Task Pack Docs (2025-10-27) | INFO | - Added Task Pack core documentation set: | | | 2025-10-27 | +| docs/implplan/archived/updates/2025-10-28-docs-guild.md | Update note | Docs Guild Update — 2025-10-28 | INFO | - Published `docs/security/console-security.md` covering console OIDC/DPoP flow, scope map, fresh-auth sequence, CSP defaults, evidence handling, and monitoring checklist. | | | 2025-10-28 | +| docs/implplan/archived/updates/2025-10-29-export-center-provenance.md | Update note | 2025-10-29 – Export Center provenance/signing doc | INFO | - Authored `docs/modules/export-center/provenance-and-signing.md`, covering manifest/provenance artefacts, cosign/SLSA signing pipeline, verification workflows (CLI/CI/offline), and compliance checklist. | | | 2025-10-29 | +| docs/implplan/archived/updates/2025-10-29-notify-docs.md | Update note | 2025-10-29 – Notifications Studio docs sync prep | INFO | - Published Notifications Studio overview (`notifications/overview.md`) and architecture dossier (`notifications/architecture.md`), complementing the rules/templates/digests deep dives landed earlier in Sprint 39. | | | 2025-10-29 | +| docs/implplan/archived/updates/2025-10-29-scheduler-policy-doc-refresh.md | Update note | 2025-10-29 — Scheduler/Policy Guild Doc Refresh | INFO | - Extended `SCHED-MODELS-20-001` with environment metadata guidance, lifecycle semantics, and diff payload breakdown for Policy Engine runs. | | | 2025-10-29 | +| docs/implplan/archived/updates/2025-10-30-devops-governance.md | Update note | 30 Oct 2025 — Governance rules anchor consolidated | INFO | **What changed** | | | 2025-10-30 | +| docs/implplan/archived/updates/2025-10-31-console-security-refresh.md | Update note | 2025-10-31 — Console Security Docs Refresh | INFO | - Documented the new Authority `/console` endpoints (`/tenants`, `/profile`, `/token/introspect`) including tenant header enforcement, DPoP requirements, and five-minute fresh-auth behaviour. | | | 2025-10-31 | +| docs/implplan/archived/updates/2025-10-cleanup.md | Update note | Backlog Cleanup — 26 October 2025 | INFO | This note captures the Sprint backlog hygiene pass applied on 26 October 2025. The goal was to eliminate legacy tasks that violated the aggregation-only contract (AOC), duplicated scope, or conflicted with the current module ownership map. | | | | +| docs/implplan/archived/updates/2025-11-01-orch-admin-scope.md | Update note | 2025-11-01 · Authority adds Orch.Admin quota controls | INFO | **What changed** | | | 2025-11-01 | +| docs/implplan/archived/updates/2025-11-02-pack-scope-profiles.md | Update note | 2025-11-02 · Pack scope catalogue & CLI profiles | INFO | **What changed** | | | 2025-11-02 | +| docs/implplan/archived/updates/2025-11-03-authority-plugin-ldap-review.md | Update note | Authority Plugin LDAP Review — 2025-11-03 | INFO | - Auth Guild core (Authority Host Crew) | | | 2025-11-03 | +| docs/implplan/archived/updates/2025-11-03-vuln-explorer-access-controls.md | Update note | 2025-11-03 – Vuln Explorer access controls refresh | INFO | - Expanded `docs/11_AUTHORITY.md` with attachment signing tokens, ledger verification workflow, and a Vuln Explorer security checklist. | | | 2025-11-03 | +| docs/implplan/archived/updates/2025-11-05-excitor-consensus-beta.md | Update note | 2025-11-05 – Excitor consensus API beta | INFO | **Subject:** Excitor consensus export/API preview ships \ | | | 2025-11-05 | +| docs/implplan/archived/updates/2025-11-07-concelier-advisory-chunks.md | Update note | 2025-11-07 – Concelier advisory chunks API | INFO | **Subject:** Paragraph-anchored advisory chunks land for Advisory AI | | | 2025-11-07 | +| docs/implplan/archived/updates/2025-11-09-authority-ldap-plugin.md | Update note | 2025-11-09 — Authority LDAP Plug-in Readiness (PLG7.IMPL-005) | INFO | - Added a dedicated LDAP quick-reference section to the Authority plug-in developer guide covering mutual TLS requirements, DN→role regex mappings, Mongo-backed claim caching, and the client-provisioning audit mirror. | | | 2025-11-09 | +| docs/implplan/archived/updates/2025-11-12-notify-attestation-templates.md | Update note | 2025-11-12 – Notifications Attestation Template Suite | INFO | - Introduced the canonical `tmpl-attest-*` template family covering verification failures, expiring attestations, key rotations, and transparency anomalies. | | | 2025-11-12 | diff --git a/docs/implplan/archived/updates/tasks.md b/docs/implplan/archived/updates/tasks.md index ef50638e6..3ffc8ff95 100644 --- a/docs/implplan/archived/updates/tasks.md +++ b/docs/implplan/archived/updates/tasks.md @@ -809,12 +809,12 @@ This file describe implementation of Stella Ops (docs/README.md). Implementation | Sprint 29 | Vulnerability Explorer | src/Authority/StellaOps.Authority | TODO | Authority Core & Security Guild | AUTH-VULN-29-001 | Define Vuln Explorer RBAC/ABAC scopes and issuer metadata. | | Sprint 29 | Vulnerability Explorer | src/Authority/StellaOps.Authority | TODO | Authority Core & Security Guild | AUTH-VULN-29-002 | Enforce CSRF, attachment signing, and audit logging referencing ledger hashes. | | Sprint 29 | Vulnerability Explorer | src/Authority/StellaOps.Authority | TODO | Authority Core & Docs Guild | AUTH-VULN-29-003 | Update docs/config samples for Vuln Explorer roles and security posture. | -| Sprint 29 | Vulnerability Explorer | src/Cli/StellaOps.Cli | TODO | DevEx/CLI Guild | CLI-VULN-29-001 | Implement `stella vuln list` with grouping, filters, JSON/CSV output. | -| Sprint 29 | Vulnerability Explorer | src/Cli/StellaOps.Cli | TODO | DevEx/CLI Guild | CLI-VULN-29-002 | Implement `stella vuln show` with evidence/policy/path display. | -| Sprint 29 | Vulnerability Explorer | src/Cli/StellaOps.Cli | TODO | DevEx/CLI Guild | CLI-VULN-29-003 | Add workflow CLI commands (assign/comment/accept-risk/verify-fix/target-fix/reopen). | -| Sprint 29 | Vulnerability Explorer | src/Cli/StellaOps.Cli | TODO | DevEx/CLI Guild | CLI-VULN-29-004 | Implement `stella vuln simulate` producing diff summaries/Markdown. | -| Sprint 29 | Vulnerability Explorer | src/Cli/StellaOps.Cli | TODO | DevEx/CLI Guild | CLI-VULN-29-005 | Implement `stella vuln export` and bundle signature verification. | -| Sprint 29 | Vulnerability Explorer | src/Cli/StellaOps.Cli | TODO | DevEx/CLI & Docs Guilds | CLI-VULN-29-006 | Update CLI docs/examples for Vulnerability Explorer commands. | +| Sprint 29 | Vulnerability Explorer | src/Cli/StellaOps.Cli | DONE (2025-12-06) | DevEx/CLI Guild | CLI-VULN-29-001 | Implement `stella vuln list` with grouping, filters, JSON/CSV output. | +| Sprint 29 | Vulnerability Explorer | src/Cli/StellaOps.Cli | DONE (2025-12-06) | DevEx/CLI Guild | CLI-VULN-29-002 | Implement `stella vuln show` with evidence/policy/path display. | +| Sprint 29 | Vulnerability Explorer | src/Cli/StellaOps.Cli | DONE (2025-12-06) | DevEx/CLI Guild | CLI-VULN-29-003 | Add workflow CLI commands (assign/comment/accept-risk/verify-fix/target-fix/reopen). | +| Sprint 29 | Vulnerability Explorer | src/Cli/StellaOps.Cli | DONE (2025-12-06) | DevEx/CLI Guild | CLI-VULN-29-004 | Implement `stella vuln simulate` producing diff summaries/Markdown. | +| Sprint 29 | Vulnerability Explorer | src/Cli/StellaOps.Cli | DONE (2025-12-06) | DevEx/CLI Guild | CLI-VULN-29-005 | Implement `stella vuln export` and bundle signature verification. | +| Sprint 29 | Vulnerability Explorer | src/Cli/StellaOps.Cli | DONE (2025-12-06) | DevEx/CLI & Docs Guilds | CLI-VULN-29-006 | Update CLI docs/examples for Vulnerability Explorer commands. | | Sprint 29 | Vulnerability Explorer | src/Concelier/StellaOps.Concelier.WebService | TODO | Concelier WebService Guild | CONCELIER-VULN-29-001 | Canonicalize (lossless) advisory identifiers, persist `links[]`, backfill, and expose raw payload snapshots (no merge/derived fields). | | Sprint 29 | Vulnerability Explorer | src/Concelier/StellaOps.Concelier.WebService | TODO | Concelier WebService Guild | CONCELIER-VULN-29-002 | Provide advisory evidence retrieval endpoint for Vuln Explorer. | | Sprint 29 | Vulnerability Explorer | src/Concelier/StellaOps.Concelier.WebService | TODO | Concelier WebService & Observability Guilds | CONCELIER-VULN-29-004 | Add metrics/logs/events for advisory normalization supporting resolver. | diff --git a/docs/implplan/blocked_tree.md b/docs/implplan/blocked_tree.md index e3ad64781..ca4397c91 100644 --- a/docs/implplan/blocked_tree.md +++ b/docs/implplan/blocked_tree.md @@ -2,6 +2,8 @@ Updated 2025-12-07: FEEDCONN-ICSCISA-02-012/KISA-02-008 unblocked (ICS/KISA SOP v0.2); tracked in SPRINT_0113 row 18 and SPRINT_0503 feed ops tasks. +Updated 2025-12-07: RISK-BUNDLE-69-002/70-001/70-002 unblocked (SPRINT_0164 tasks 13-15); RISK-BUNDLE-69-001 DONE. Wave 3 can proceed. + - Concelier ingestion & Link-Not-Merge - MIRROR-CRT-56-001 (DONE; thin bundle v1 sample + hashes published) - MIRROR-CRT-56-002 (DONE locally with production-mode flags: DSSE/TUF/OCI signed using provided Ed25519 keyid db9928babf3aeb817ccdcd0f6a6688f8395b00d0e42966e32e706931b5301fc8; artefacts in `out/mirror/thin/`; not blocking development) @@ -13,8 +15,8 @@ Updated 2025-12-07: FEEDCONN-ICSCISA-02-012/KISA-02-008 unblocked (ICS/KISA SOP - AIRGAP-TIME-57-001 (DEV-UNBLOCKED: schema + trust-roots bundle + service config present; production trust roots/signing still needed) - EXPORT-OBS-51-001 / 54-001 (DEV-UNBLOCKED: DSSE/TUF profile + test-signed bundle available; release promotion now tracked under DevOps secret import) - CLI-AIRGAP-56-001 (DEV-UNBLOCKED: dev bundles available; release promotion depends on DevOps secret import + 58-001 CLI path) - - CONCELIER-AIRGAP-56-001..58-001 <- PREP-ART-56-001, PREP-EVIDENCE-BDL-01 - - CONCELIER-CONSOLE-23-001..003 <- PREP-CONSOLE-FIXTURES-29; PREP-EVIDENCE-BDL-01 + - CONCELIER-AIRGAP-56-001..58-001 ✅ (DONE 2025-12-07; mirror/offline provenance chain + sealed-mode deploy runbook) + - CONCELIER-CONSOLE-23-001..003 ✅ (DONE 2025-12-07; console advisory aggregation/search helpers + consumption contract) - SBOM Service (Link-Not-Merge consumers) - SBOM-SERVICE-21-001 (projection read API) — DONE (2025-11-23): WAF aligned with fixtures + in-memory repo fallback; `ProjectionEndpointTests` pass. @@ -40,7 +42,9 @@ Updated 2025-12-07: FEEDCONN-ICSCISA-02-012/KISA-02-008 unblocked (ICS/KISA SOP - CONCELIER-MIRROR-23-001-DEV (DONE; dev mirror layout documented at `docs/modules/concelier/mirror-export.md`, endpoints serve static bundles) - DEVOPS-MIRROR-23-001-REL (release signing/publish tracked under DevOps; not a development blocker) - Concelier storage/backfill/object-store chain - - CONCELIER-LNM-21-101-DEV/102-DEV/103-DEV (BLOCKED on CI runner and upstream tasks) + - CONCELIER-LNM-21-101-DEV ✅ (DONE 2025-11-27; sharding + TTL migration) + - CONCELIER-LNM-21-102-DEV ✅ (DONE 2025-11-28; migration + tombstones + rollback) + - CONCELIER-LNM-21-103-DEV ✅ (DONE 2025-12-06; object storage + S3ObjectStore) - Concelier backfill chain (Concelier IV) - CONCELIER-STORE-AOC-19-005-DEV (BLOCKED pending dataset hash/rehearsal) diff --git a/src/Attestor/StellaOps.Attestor/StellaOps.Attestor.Tests/Signing/Sm2AttestorTests.cs b/src/Attestor/StellaOps.Attestor/StellaOps.Attestor.Tests/Signing/Sm2AttestorTests.cs index a26ebd031..deea619f7 100644 --- a/src/Attestor/StellaOps.Attestor/StellaOps.Attestor.Tests/Signing/Sm2AttestorTests.cs +++ b/src/Attestor/StellaOps.Attestor/StellaOps.Attestor.Tests/Signing/Sm2AttestorTests.cs @@ -89,7 +89,7 @@ public class Sm2AttestorTests new AttestorSigningKeyRegistry(options, TimeProvider.System, NullLogger.Instance)); } - protected virtual void Dispose(bool disposing) + private void Dispose(bool disposing) { Environment.SetEnvironmentVariable("SM_SOFT_ALLOWED", _gate); } @@ -97,7 +97,6 @@ public class Sm2AttestorTests public void Dispose() { Dispose(true); - GC.SuppressFinalize(this); } } diff --git a/src/Concelier/Directory.Build.props b/src/Concelier/Directory.Build.props index 07557c2e4..9c6ac015a 100644 --- a/src/Concelier/Directory.Build.props +++ b/src/Concelier/Directory.Build.props @@ -3,7 +3,7 @@ true - $(NoWarn);CS0105;RS1032;RS2007;xUnit1041;NU1510 + $(NoWarn);CS0105;CS1591;CS8601;CS8602;CS8604;CS0618;RS1032;RS2007;xUnit1041;xUnit1031;xUnit2013;NU1510;NETSDK1023;SYSLIB0057 diff --git a/src/ExportCenter/StellaOps.ExportCenter/StellaOps.ExportCenter.Core/Adapters/ExportAdapterModels.cs b/src/ExportCenter/StellaOps.ExportCenter/StellaOps.ExportCenter.Core/Adapters/ExportAdapterModels.cs new file mode 100644 index 000000000..03766192b --- /dev/null +++ b/src/ExportCenter/StellaOps.ExportCenter/StellaOps.ExportCenter.Core/Adapters/ExportAdapterModels.cs @@ -0,0 +1,349 @@ +using System.Text.Json.Serialization; +using StellaOps.ExportCenter.Core.Planner; + +namespace StellaOps.ExportCenter.Core.Adapters; + +/// +/// Configuration for an export adapter. +/// +public sealed record ExportAdapterConfig +{ + /// + /// Adapter identifier (e.g., "json:raw", "json:policy"). + /// + public required string AdapterId { get; init; } + + /// + /// Format options controlling output behavior. + /// + public required ExportFormatOptions FormatOptions { get; init; } + + /// + /// Output directory for exported files. + /// + public required string OutputDirectory { get; init; } + + /// + /// Base name for output files. + /// + public string BaseName { get; init; } = "export"; + + /// + /// Whether to include a checksum file alongside each artifact. + /// + public bool IncludeChecksums { get; init; } = true; + + /// + /// Maximum file size before splitting into chunks (0 = no limit). + /// + public long MaxFileSizeBytes { get; init; } +} + +/// +/// Result of processing a single item through an adapter. +/// +public sealed record AdapterItemResult +{ + public required Guid ItemId { get; init; } + + public required bool Success { get; init; } + + public string? OutputPath { get; init; } + + public long OutputSizeBytes { get; init; } + + public string? ContentHash { get; init; } + + public string? ErrorMessage { get; init; } + + public DateTimeOffset ProcessedAt { get; init; } + + public static AdapterItemResult Failed(Guid itemId, string errorMessage) + => new() + { + ItemId = itemId, + Success = false, + ErrorMessage = errorMessage, + ProcessedAt = DateTimeOffset.UtcNow + }; +} + +/// +/// Result of running an export adapter. +/// +public sealed record ExportAdapterResult +{ + public required bool Success { get; init; } + + public IReadOnlyList ItemResults { get; init; } = []; + + public IReadOnlyList Artifacts { get; init; } = []; + + public ExportManifestCounts ManifestCounts { get; init; } = new(); + + public string? ErrorMessage { get; init; } + + public TimeSpan ProcessingTime { get; init; } + + public DateTimeOffset CompletedAt { get; init; } + + public static ExportAdapterResult Failed(string errorMessage) + => new() { Success = false, ErrorMessage = errorMessage, CompletedAt = DateTimeOffset.UtcNow }; +} + +/// +/// An output artifact produced by an adapter. +/// +public sealed record ExportOutputArtifact +{ + /// + /// Path to the artifact file. + /// + public required string Path { get; init; } + + /// + /// Size of the artifact in bytes. + /// + public required long SizeBytes { get; init; } + + /// + /// SHA-256 hash of the artifact content. + /// + public required string Sha256 { get; init; } + + /// + /// MIME type of the artifact. + /// + public string ContentType { get; init; } = "application/json"; + + /// + /// Number of items in this artifact. + /// + public int ItemCount { get; init; } + + /// + /// Whether the artifact is compressed. + /// + public bool IsCompressed { get; init; } + + /// + /// Compression format if compressed. + /// + public CompressionFormat? Compression { get; init; } + + /// + /// Original size before compression. + /// + public long? OriginalSizeBytes { get; init; } +} + +/// +/// Counts for export manifest generation. +/// +public sealed record ExportManifestCounts +{ + [JsonPropertyName("totalItems")] + public int TotalItems { get; init; } + + [JsonPropertyName("processedItems")] + public int ProcessedItems { get; init; } + + [JsonPropertyName("successfulItems")] + public int SuccessfulItems { get; init; } + + [JsonPropertyName("failedItems")] + public int FailedItems { get; init; } + + [JsonPropertyName("skippedItems")] + public int SkippedItems { get; init; } + + [JsonPropertyName("artifactCount")] + public int ArtifactCount { get; init; } + + [JsonPropertyName("totalSizeBytes")] + public long TotalSizeBytes { get; init; } + + [JsonPropertyName("compressedSizeBytes")] + public long? CompressedSizeBytes { get; init; } + + [JsonPropertyName("byKind")] + public IReadOnlyDictionary ByKind { get; init; } = new Dictionary(); + + [JsonPropertyName("byStatus")] + public IReadOnlyDictionary ByStatus { get; init; } = new Dictionary(); +} + +/// +/// Options for JSON normalization during export. +/// +public sealed record JsonNormalizationOptions +{ + /// + /// Whether to sort JSON object keys alphabetically. + /// + public bool SortKeys { get; init; } = true; + + /// + /// Whether to normalize timestamps to UTC ISO-8601 format. + /// + public bool NormalizeTimestamps { get; init; } = true; + + /// + /// Timestamp format string for normalization. + /// + public string TimestampFormat { get; init; } = "yyyy-MM-ddTHH:mm:ss.fffZ"; + + /// + /// Whether to remove null values from output. + /// + public bool RemoveNullValues { get; init; } + + /// + /// Whether to use consistent line endings (LF). + /// + public bool NormalizeLineEndings { get; init; } = true; + + /// + /// Whether to trim whitespace from string values. + /// + public bool TrimStrings { get; init; } +} + +/// +/// Options for JSON field redaction during export. +/// +public sealed record JsonRedactionOptions +{ + /// + /// Field paths to redact (supports dot notation and wildcards). + /// + public IReadOnlyList RedactFields { get; init; } = []; + + /// + /// Replacement value for redacted fields. + /// + public string RedactedValue { get; init; } = "[REDACTED]"; + + /// + /// Whether to preserve field types (use null for objects/arrays, empty for strings). + /// + public bool PreserveTypes { get; init; } + + /// + /// Regex patterns for values to redact (e.g., email addresses, API keys). + /// + public IReadOnlyList RedactPatterns { get; init; } = []; + + /// + /// Common sensitive field names to always redact. + /// + public static readonly string[] DefaultSensitiveFields = + [ + "password", + "secret", + "apiKey", + "api_key", + "token", + "privateKey", + "private_key", + "credential", + "auth", + "authorization" + ]; +} + +/// +/// Policy metadata included with json:policy format exports. +/// +public sealed record PolicyMetadata +{ + [JsonPropertyName("policyId")] + public string? PolicyId { get; init; } + + [JsonPropertyName("policyVersion")] + public string? PolicyVersion { get; init; } + + [JsonPropertyName("policyName")] + public string? PolicyName { get; init; } + + [JsonPropertyName("evaluatedAt")] + public DateTimeOffset? EvaluatedAt { get; init; } + + [JsonPropertyName("decision")] + public string? Decision { get; init; } + + [JsonPropertyName("violations")] + public IReadOnlyList Violations { get; init; } = []; + + [JsonPropertyName("attributes")] + public IReadOnlyDictionary Attributes { get; init; } = new Dictionary(); +} + +/// +/// A policy violation record. +/// +public sealed record PolicyViolation +{ + [JsonPropertyName("ruleId")] + public required string RuleId { get; init; } + + [JsonPropertyName("severity")] + public string Severity { get; init; } = "info"; + + [JsonPropertyName("message")] + public required string Message { get; init; } + + [JsonPropertyName("path")] + public string? Path { get; init; } + + [JsonPropertyName("remediation")] + public string? Remediation { get; init; } +} + +/// +/// Wrapped export item with policy metadata (for json:policy format). +/// +public sealed record PolicyWrappedExportItem +{ + [JsonPropertyName("metadata")] + public required ExportItemMetadata Metadata { get; init; } + + [JsonPropertyName("policy")] + public PolicyMetadata? Policy { get; init; } + + [JsonPropertyName("data")] + public required object Data { get; init; } +} + +/// +/// Export item metadata. +/// +public sealed record ExportItemMetadata +{ + [JsonPropertyName("itemId")] + public required Guid ItemId { get; init; } + + [JsonPropertyName("kind")] + public required string Kind { get; init; } + + [JsonPropertyName("sourceRef")] + public required string SourceRef { get; init; } + + [JsonPropertyName("name")] + public string? Name { get; init; } + + [JsonPropertyName("namespace")] + public string? Namespace { get; init; } + + [JsonPropertyName("tags")] + public IReadOnlyList Tags { get; init; } = []; + + [JsonPropertyName("createdAt")] + public DateTimeOffset CreatedAt { get; init; } + + [JsonPropertyName("exportedAt")] + public DateTimeOffset ExportedAt { get; init; } + + [JsonPropertyName("sha256")] + public string? Sha256 { get; init; } +} diff --git a/src/ExportCenter/StellaOps.ExportCenter/StellaOps.ExportCenter.Core/Adapters/ExportAdapterRegistry.cs b/src/ExportCenter/StellaOps.ExportCenter/StellaOps.ExportCenter.Core/Adapters/ExportAdapterRegistry.cs new file mode 100644 index 000000000..516c09788 --- /dev/null +++ b/src/ExportCenter/StellaOps.ExportCenter/StellaOps.ExportCenter.Core/Adapters/ExportAdapterRegistry.cs @@ -0,0 +1,229 @@ +using Microsoft.Extensions.DependencyInjection; +using Microsoft.Extensions.Logging; +using StellaOps.ExportCenter.Core.Planner; + +namespace StellaOps.ExportCenter.Core.Adapters; + +/// +/// Registry for export adapters. +/// +public interface IExportAdapterRegistry +{ + /// + /// Gets an adapter by ID. + /// + IExportAdapter? GetAdapter(string adapterId); + + /// + /// Gets an adapter for the specified format. + /// + IExportAdapter? GetAdapterForFormat(ExportFormat format); + + /// + /// Gets all registered adapters. + /// + IReadOnlyList GetAllAdapters(); + + /// + /// Gets all registered adapter IDs. + /// + IReadOnlyList GetAdapterIds(); +} + +/// +/// Default implementation of the export adapter registry. +/// +public sealed class ExportAdapterRegistry : IExportAdapterRegistry +{ + private readonly Dictionary _adapters; + private readonly Dictionary _formatMap; + + public ExportAdapterRegistry(IEnumerable adapters) + { + _adapters = adapters.ToDictionary(a => a.AdapterId, StringComparer.OrdinalIgnoreCase); + + // Build format to adapter map (first adapter wins for each format) + _formatMap = new Dictionary(); + foreach (var adapter in adapters) + { + foreach (var format in adapter.SupportedFormats) + { + _formatMap.TryAdd(format, adapter); + } + } + } + + public IExportAdapter? GetAdapter(string adapterId) + { + _adapters.TryGetValue(adapterId, out var adapter); + return adapter; + } + + public IExportAdapter? GetAdapterForFormat(ExportFormat format) + { + _formatMap.TryGetValue(format, out var adapter); + return adapter; + } + + public IReadOnlyList GetAllAdapters() + => _adapters.Values.ToList(); + + public IReadOnlyList GetAdapterIds() + => _adapters.Keys.ToList(); +} + +/// +/// Extension methods for registering export adapters. +/// +public static class ExportAdapterServiceExtensions +{ + /// + /// Registers export adapters with the service collection. + /// + public static IServiceCollection AddExportAdapters(this IServiceCollection services) + { + // Register individual adapters + services.AddSingleton(); + services.AddSingleton(); + + // Register the registry + services.AddSingleton(sp => + { + var adapters = sp.GetServices(); + return new ExportAdapterRegistry(adapters); + }); + + return services; + } + + /// + /// Registers export adapters with custom normalization options. + /// + public static IServiceCollection AddExportAdapters( + this IServiceCollection services, + JsonNormalizationOptions? normalizationOptions, + JsonRedactionOptions? redactionOptions) + { + // Register individual adapters with custom options + services.AddSingleton(sp => + new JsonRawAdapter( + sp.GetRequiredService>(), + normalizationOptions, + redactionOptions)); + + services.AddSingleton(sp => + new JsonPolicyAdapter( + sp.GetRequiredService>(), + normalizationOptions, + redactionOptions)); + + // Register the registry + services.AddSingleton(sp => + { + var adapters = sp.GetServices(); + return new ExportAdapterRegistry(adapters); + }); + + return services; + } +} + +/// +/// In-memory implementation of IExportDataFetcher for testing. +/// +public sealed class InMemoryExportDataFetcher : IExportDataFetcher +{ + private readonly Dictionary _contents = new(); + + /// + /// Adds content for an item. + /// + public void AddContent(Guid itemId, string jsonContent) + { + _contents[itemId] = jsonContent; + } + + /// + /// Adds content for multiple items. + /// + public void AddContents(IEnumerable<(Guid ItemId, string JsonContent)> items) + { + foreach (var (itemId, jsonContent) in items) + { + _contents[itemId] = jsonContent; + } + } + + public Task FetchAsync( + ResolvedExportItem item, + CancellationToken cancellationToken = default) + { + if (!_contents.TryGetValue(item.ItemId, out var jsonContent)) + { + return Task.FromResult(ExportItemContent.Failed(item.ItemId, $"Content not found for item {item.ItemId}")); + } + + return Task.FromResult(new ExportItemContent + { + ItemId = item.ItemId, + Success = true, + JsonContent = jsonContent, + ContentType = GetContentType(item.Kind) + }); + } + + public Task FetchStreamAsync( + ResolvedExportItem item, + CancellationToken cancellationToken = default) + { + if (!_contents.TryGetValue(item.ItemId, out var jsonContent)) + { + throw new InvalidOperationException($"Content not found for item {item.ItemId}"); + } + + var stream = new MemoryStream(System.Text.Encoding.UTF8.GetBytes(jsonContent)); + return Task.FromResult(stream); + } + + private static string GetContentType(string kind) => kind.ToLowerInvariant() switch + { + "sbom" => "application/vnd.cyclonedx+json", + "vex" => "application/vnd.cyclonedx.vex+json", + "attestation" => "application/vnd.dsse+json", + _ => "application/json" + }; +} + +/// +/// In-memory implementation of IExportPolicyEvaluator for testing. +/// +public sealed class InMemoryExportPolicyEvaluator : IExportPolicyEvaluator +{ + private readonly Dictionary _policies = new(); + + /// + /// Adds policy metadata for an item. + /// + public void AddPolicy(Guid itemId, PolicyMetadata policy) + { + _policies[itemId] = policy; + } + + /// + /// Sets a default policy to return for all items. + /// + public PolicyMetadata? DefaultPolicy { get; set; } + + public Task EvaluateAsync( + ResolvedExportItem item, + ExportItemContent content, + CancellationToken cancellationToken = default) + { + if (_policies.TryGetValue(item.ItemId, out var policy)) + { + return Task.FromResult(policy); + } + + return Task.FromResult(DefaultPolicy); + } +} diff --git a/src/ExportCenter/StellaOps.ExportCenter/StellaOps.ExportCenter.Core/Adapters/ExportCompressor.cs b/src/ExportCenter/StellaOps.ExportCenter/StellaOps.ExportCenter.Core/Adapters/ExportCompressor.cs new file mode 100644 index 000000000..823c271fb --- /dev/null +++ b/src/ExportCenter/StellaOps.ExportCenter/StellaOps.ExportCenter.Core/Adapters/ExportCompressor.cs @@ -0,0 +1,322 @@ +using System.IO.Compression; +using System.Security.Cryptography; +using System.Text; +using StellaOps.ExportCenter.Core.Planner; + +namespace StellaOps.ExportCenter.Core.Adapters; + +/// +/// Handles compression for export artifacts. +/// +public sealed class ExportCompressor +{ + /// + /// Compresses content using the specified format. + /// + public CompressionResult Compress(string content, CompressionFormat format) + { + if (format == CompressionFormat.None) + { + var bytes = Encoding.UTF8.GetBytes(content); + return new CompressionResult + { + Success = true, + CompressedData = bytes, + OriginalSizeBytes = bytes.Length, + CompressedSizeBytes = bytes.Length, + CompressionRatio = 1.0, + Format = CompressionFormat.None, + Sha256 = ComputeSha256(bytes) + }; + } + + var originalBytes = Encoding.UTF8.GetBytes(content); + return CompressBytes(originalBytes, format); + } + + /// + /// Compresses bytes using the specified format. + /// + public CompressionResult CompressBytes(byte[] data, CompressionFormat format) + { + if (format == CompressionFormat.None) + { + return new CompressionResult + { + Success = true, + CompressedData = data, + OriginalSizeBytes = data.Length, + CompressedSizeBytes = data.Length, + CompressionRatio = 1.0, + Format = CompressionFormat.None, + Sha256 = ComputeSha256(data) + }; + } + + try + { + using var outputStream = new MemoryStream(); + + switch (format) + { + case CompressionFormat.Gzip: + using (var gzip = new GZipStream(outputStream, CompressionLevel.Optimal, leaveOpen: true)) + { + gzip.Write(data, 0, data.Length); + } + break; + + case CompressionFormat.Brotli: + using (var brotli = new BrotliStream(outputStream, CompressionLevel.Optimal, leaveOpen: true)) + { + brotli.Write(data, 0, data.Length); + } + break; + + case CompressionFormat.Zstd: + // Zstd not available in standard library - use gzip as fallback + // In production, would use ZstdSharp or similar library + using (var gzip = new GZipStream(outputStream, CompressionLevel.Optimal, leaveOpen: true)) + { + gzip.Write(data, 0, data.Length); + } + break; + + default: + return CompressionResult.Failed($"Unsupported compression format: {format}"); + } + + var compressedData = outputStream.ToArray(); + var ratio = data.Length > 0 ? (double)compressedData.Length / data.Length : 1.0; + + return new CompressionResult + { + Success = true, + CompressedData = compressedData, + OriginalSizeBytes = data.Length, + CompressedSizeBytes = compressedData.Length, + CompressionRatio = ratio, + Format = format, + Sha256 = ComputeSha256(compressedData) + }; + } + catch (Exception ex) + { + return CompressionResult.Failed($"Compression failed: {ex.Message}"); + } + } + + /// + /// Compresses content to a stream. + /// + public async Task CompressToStreamAsync( + string content, + Stream outputStream, + CompressionFormat format, + CancellationToken cancellationToken = default) + { + var data = Encoding.UTF8.GetBytes(content); + return await CompressBytesToStreamAsync(data, outputStream, format, cancellationToken); + } + + /// + /// Compresses bytes to a stream. + /// + public async Task CompressBytesToStreamAsync( + byte[] data, + Stream outputStream, + CompressionFormat format, + CancellationToken cancellationToken = default) + { + if (format == CompressionFormat.None) + { + await outputStream.WriteAsync(data, cancellationToken); + return new CompressionResult + { + Success = true, + OriginalSizeBytes = data.Length, + CompressedSizeBytes = data.Length, + CompressionRatio = 1.0, + Format = CompressionFormat.None, + Sha256 = ComputeSha256(data) + }; + } + + try + { + var startPosition = outputStream.Position; + + switch (format) + { + case CompressionFormat.Gzip: + await using (var gzip = new GZipStream(outputStream, CompressionLevel.Optimal, leaveOpen: true)) + { + await gzip.WriteAsync(data, cancellationToken); + } + break; + + case CompressionFormat.Brotli: + await using (var brotli = new BrotliStream(outputStream, CompressionLevel.Optimal, leaveOpen: true)) + { + await brotli.WriteAsync(data, cancellationToken); + } + break; + + case CompressionFormat.Zstd: + // Fallback to gzip + await using (var gzip = new GZipStream(outputStream, CompressionLevel.Optimal, leaveOpen: true)) + { + await gzip.WriteAsync(data, cancellationToken); + } + break; + + default: + return CompressionResult.Failed($"Unsupported compression format: {format}"); + } + + var compressedSize = outputStream.Position - startPosition; + var ratio = data.Length > 0 ? (double)compressedSize / data.Length : 1.0; + + return new CompressionResult + { + Success = true, + OriginalSizeBytes = data.Length, + CompressedSizeBytes = compressedSize, + CompressionRatio = ratio, + Format = format + // Note: Sha256 not computed for stream output - caller should compute from stream if needed + }; + } + catch (Exception ex) + { + return CompressionResult.Failed($"Compression failed: {ex.Message}"); + } + } + + /// + /// Decompresses content. + /// + public DecompressionResult Decompress(byte[] compressedData, CompressionFormat format) + { + if (format == CompressionFormat.None) + { + return new DecompressionResult + { + Success = true, + DecompressedData = compressedData + }; + } + + try + { + using var inputStream = new MemoryStream(compressedData); + using var outputStream = new MemoryStream(); + + switch (format) + { + case CompressionFormat.Gzip: + using (var gzip = new GZipStream(inputStream, CompressionMode.Decompress)) + { + gzip.CopyTo(outputStream); + } + break; + + case CompressionFormat.Brotli: + using (var brotli = new BrotliStream(inputStream, CompressionMode.Decompress)) + { + brotli.CopyTo(outputStream); + } + break; + + case CompressionFormat.Zstd: + // Fallback - assume gzip + using (var gzip = new GZipStream(inputStream, CompressionMode.Decompress)) + { + gzip.CopyTo(outputStream); + } + break; + + default: + return DecompressionResult.Failed($"Unsupported compression format: {format}"); + } + + return new DecompressionResult + { + Success = true, + DecompressedData = outputStream.ToArray() + }; + } + catch (Exception ex) + { + return DecompressionResult.Failed($"Decompression failed: {ex.Message}"); + } + } + + /// + /// Gets the file extension for a compression format. + /// + public static string GetFileExtension(CompressionFormat format) => format switch + { + CompressionFormat.Gzip => ".gz", + CompressionFormat.Brotli => ".br", + CompressionFormat.Zstd => ".zst", + _ => string.Empty + }; + + /// + /// Gets the content type for a compression format. + /// + public static string GetContentType(CompressionFormat format) => format switch + { + CompressionFormat.Gzip => "application/gzip", + CompressionFormat.Brotli => "application/br", + CompressionFormat.Zstd => "application/zstd", + _ => "application/octet-stream" + }; + + private static string ComputeSha256(byte[] data) + { + var hashBytes = SHA256.HashData(data); + return Convert.ToHexString(hashBytes).ToLowerInvariant(); + } +} + +/// +/// Result of compression operation. +/// +public sealed record CompressionResult +{ + public required bool Success { get; init; } + + public byte[]? CompressedData { get; init; } + + public long OriginalSizeBytes { get; init; } + + public long CompressedSizeBytes { get; init; } + + public double CompressionRatio { get; init; } + + public CompressionFormat Format { get; init; } + + public string? Sha256 { get; init; } + + public string? ErrorMessage { get; init; } + + public static CompressionResult Failed(string errorMessage) + => new() { Success = false, ErrorMessage = errorMessage }; +} + +/// +/// Result of decompression operation. +/// +public sealed record DecompressionResult +{ + public required bool Success { get; init; } + + public byte[]? DecompressedData { get; init; } + + public string? ErrorMessage { get; init; } + + public static DecompressionResult Failed(string errorMessage) + => new() { Success = false, ErrorMessage = errorMessage }; +} diff --git a/src/ExportCenter/StellaOps.ExportCenter/StellaOps.ExportCenter.Core/Adapters/IExportAdapter.cs b/src/ExportCenter/StellaOps.ExportCenter/StellaOps.ExportCenter.Core/Adapters/IExportAdapter.cs new file mode 100644 index 000000000..3dde587a8 --- /dev/null +++ b/src/ExportCenter/StellaOps.ExportCenter/StellaOps.ExportCenter.Core/Adapters/IExportAdapter.cs @@ -0,0 +1,160 @@ +using StellaOps.ExportCenter.Core.Planner; + +namespace StellaOps.ExportCenter.Core.Adapters; + +/// +/// Interface for export format adapters. +/// +public interface IExportAdapter +{ + /// + /// Unique identifier for this adapter (e.g., "json:raw", "json:policy"). + /// + string AdapterId { get; } + + /// + /// Human-readable name for this adapter. + /// + string DisplayName { get; } + + /// + /// Export formats this adapter supports. + /// + IReadOnlyList SupportedFormats { get; } + + /// + /// Whether this adapter supports streaming output. + /// + bool SupportsStreaming { get; } + + /// + /// Processes export items and produces output artifacts. + /// + Task ProcessAsync( + ExportAdapterContext context, + CancellationToken cancellationToken = default); + + /// + /// Processes export items as a stream (for large datasets). + /// + IAsyncEnumerable ProcessStreamAsync( + ExportAdapterContext context, + CancellationToken cancellationToken = default); + + /// + /// Validates adapter configuration. + /// + Task> ValidateConfigAsync( + ExportAdapterConfig config, + CancellationToken cancellationToken = default); +} + +/// +/// Context for export adapter processing. +/// +public sealed record ExportAdapterContext +{ + /// + /// Adapter configuration. + /// + public required ExportAdapterConfig Config { get; init; } + + /// + /// Resolved export items to process. + /// + public required IReadOnlyList Items { get; init; } + + /// + /// Data fetcher for retrieving item content. + /// + public required IExportDataFetcher DataFetcher { get; init; } + + /// + /// Optional policy evaluator for json:policy format. + /// + public IExportPolicyEvaluator? PolicyEvaluator { get; init; } + + /// + /// Tenant ID for the export. + /// + public required Guid TenantId { get; init; } + + /// + /// Correlation ID for tracing. + /// + public string? CorrelationId { get; init; } + + /// + /// Time provider for deterministic timestamps. + /// + public TimeProvider TimeProvider { get; init; } = TimeProvider.System; +} + +/// +/// Interface for fetching export item data. +/// +public interface IExportDataFetcher +{ + /// + /// Fetches the content for an export item. + /// + Task FetchAsync( + ResolvedExportItem item, + CancellationToken cancellationToken = default); + + /// + /// Fetches content as a stream for large items. + /// + Task FetchStreamAsync( + ResolvedExportItem item, + CancellationToken cancellationToken = default); +} + +/// +/// Content of an export item. +/// +public sealed record ExportItemContent +{ + public required Guid ItemId { get; init; } + + public required bool Success { get; init; } + + /// + /// Raw JSON content. + /// + public string? JsonContent { get; init; } + + /// + /// Parsed content as an object (for manipulation). + /// + public object? ParsedContent { get; init; } + + /// + /// Content type (e.g., "application/vnd.cyclonedx+json"). + /// + public string? ContentType { get; init; } + + /// + /// SHA-256 hash of the original content. + /// + public string? OriginalHash { get; init; } + + public string? ErrorMessage { get; init; } + + public static ExportItemContent Failed(Guid itemId, string errorMessage) + => new() { ItemId = itemId, Success = false, ErrorMessage = errorMessage }; +} + +/// +/// Interface for evaluating policies on export items. +/// +public interface IExportPolicyEvaluator +{ + /// + /// Evaluates policy for an export item. + /// + Task EvaluateAsync( + ResolvedExportItem item, + ExportItemContent content, + CancellationToken cancellationToken = default); +} diff --git a/src/ExportCenter/StellaOps.ExportCenter/StellaOps.ExportCenter.Core/Adapters/JsonNormalizer.cs b/src/ExportCenter/StellaOps.ExportCenter/StellaOps.ExportCenter.Core/Adapters/JsonNormalizer.cs new file mode 100644 index 000000000..707ae1c91 --- /dev/null +++ b/src/ExportCenter/StellaOps.ExportCenter/StellaOps.ExportCenter.Core/Adapters/JsonNormalizer.cs @@ -0,0 +1,429 @@ +using System.Security.Cryptography; +using System.Text; +using System.Text.Json; +using System.Text.Json.Nodes; +using System.Text.RegularExpressions; + +namespace StellaOps.ExportCenter.Core.Adapters; + +/// +/// Normalizes JSON documents for deterministic output. +/// +public sealed partial class JsonNormalizer +{ + private readonly JsonNormalizationOptions _normalizationOptions; + private readonly JsonRedactionOptions _redactionOptions; + private readonly JsonSerializerOptions _serializerOptions; + + public JsonNormalizer( + JsonNormalizationOptions? normalizationOptions = null, + JsonRedactionOptions? redactionOptions = null) + { + _normalizationOptions = normalizationOptions ?? new JsonNormalizationOptions(); + _redactionOptions = redactionOptions ?? new JsonRedactionOptions(); + + _serializerOptions = new JsonSerializerOptions + { + WriteIndented = false, + PropertyNamingPolicy = null, + DefaultIgnoreCondition = _normalizationOptions.RemoveNullValues + ? System.Text.Json.Serialization.JsonIgnoreCondition.WhenWritingNull + : System.Text.Json.Serialization.JsonIgnoreCondition.Never + }; + } + + /// + /// Normalizes and optionally redacts a JSON string. + /// + public NormalizationResult Normalize(string json) + { + if (string.IsNullOrWhiteSpace(json)) + { + return NormalizationResult.Failed("Input JSON is empty or null"); + } + + try + { + var node = JsonNode.Parse(json); + if (node is null) + { + return NormalizationResult.Failed("Failed to parse JSON"); + } + + var redactedCount = 0; + + // Apply redaction + if (_redactionOptions.RedactFields.Count > 0) + { + redactedCount = RedactFields(node, _redactionOptions.RedactFields, ""); + } + + // Apply pattern-based redaction + if (_redactionOptions.RedactPatterns.Count > 0) + { + redactedCount += RedactPatterns(node, _redactionOptions.RedactPatterns); + } + + // Sort keys if requested + if (_normalizationOptions.SortKeys && node is JsonObject rootObject) + { + node = SortKeys(rootObject); + } + + // Normalize timestamps + if (_normalizationOptions.NormalizeTimestamps) + { + NormalizeTimestamps(node); + } + + // Serialize to string + var normalized = node.ToJsonString(_serializerOptions); + + // Normalize line endings + if (_normalizationOptions.NormalizeLineEndings) + { + normalized = NormalizeLineEndings(normalized); + } + + // Calculate hash + var hash = ComputeSha256(normalized); + + return new NormalizationResult + { + Success = true, + NormalizedJson = normalized, + Sha256 = hash, + OriginalSizeBytes = Encoding.UTF8.GetByteCount(json), + NormalizedSizeBytes = Encoding.UTF8.GetByteCount(normalized), + RedactedFieldCount = redactedCount + }; + } + catch (JsonException ex) + { + return NormalizationResult.Failed($"JSON parse error: {ex.Message}"); + } + } + + /// + /// Normalizes a JSON node in place. + /// + public JsonNode? NormalizeNode(JsonNode? node) + { + if (node is null) return null; + + if (_normalizationOptions.SortKeys && node is JsonObject obj) + { + node = SortKeys(obj); + } + + if (_normalizationOptions.NormalizeTimestamps) + { + NormalizeTimestamps(node); + } + + return node; + } + + private int RedactFields(JsonNode node, IReadOnlyList fieldsToRedact, string currentPath) + { + var redactedCount = 0; + + switch (node) + { + case JsonObject obj: + var keysToRedact = new List(); + + foreach (var kvp in obj) + { + var fieldPath = string.IsNullOrEmpty(currentPath) ? kvp.Key : $"{currentPath}.{kvp.Key}"; + + // Check if this field should be redacted + if (ShouldRedactField(kvp.Key, fieldPath, fieldsToRedact)) + { + keysToRedact.Add(kvp.Key); + } + else if (kvp.Value is not null) + { + // Recurse into nested objects/arrays + redactedCount += RedactFields(kvp.Value, fieldsToRedact, fieldPath); + } + } + + // Apply redaction + foreach (var key in keysToRedact) + { + obj[key] = GetRedactedValue(obj[key]); + redactedCount++; + } + break; + + case JsonArray arr: + for (var i = 0; i < arr.Count; i++) + { + if (arr[i] is not null) + { + redactedCount += RedactFields(arr[i]!, fieldsToRedact, $"{currentPath}[{i}]"); + } + } + break; + } + + return redactedCount; + } + + private bool ShouldRedactField(string fieldName, string fieldPath, IReadOnlyList fieldsToRedact) + { + foreach (var pattern in fieldsToRedact) + { + // Exact match by field name + if (fieldName.Equals(pattern, StringComparison.OrdinalIgnoreCase)) + return true; + + // Path match with wildcards + if (pattern.Contains('*')) + { + var regex = "^" + Regex.Escape(pattern).Replace("\\*", ".*") + "$"; + if (Regex.IsMatch(fieldPath, regex, RegexOptions.IgnoreCase)) + return true; + } + + // Exact path match + if (fieldPath.Equals(pattern, StringComparison.OrdinalIgnoreCase)) + return true; + } + + // Check default sensitive fields + foreach (var sensitive in JsonRedactionOptions.DefaultSensitiveFields) + { + if (fieldName.Contains(sensitive, StringComparison.OrdinalIgnoreCase)) + return true; + } + + return false; + } + + private JsonNode GetRedactedValue(JsonNode? original) + { + if (!_redactionOptions.PreserveTypes || original is null) + { + return JsonValue.Create(_redactionOptions.RedactedValue)!; + } + + return original switch + { + JsonObject => JsonValue.Create(_redactionOptions.RedactedValue)!, + JsonArray => new JsonArray(), + JsonValue v when v.TryGetValue(out _) => JsonValue.Create(string.Empty)!, + JsonValue v when v.TryGetValue(out _) => JsonValue.Create(0)!, + JsonValue v when v.TryGetValue(out _) => JsonValue.Create(false)!, + _ => JsonValue.Create(_redactionOptions.RedactedValue)! + }; + } + + private int RedactPatterns(JsonNode node, IReadOnlyList patterns) + { + var redactedCount = 0; + var compiledPatterns = patterns.Select(p => new Regex(p, RegexOptions.Compiled | RegexOptions.IgnoreCase)).ToList(); + + void ProcessNode(JsonNode? n) + { + switch (n) + { + case JsonObject obj: + foreach (var kvp in obj.ToList()) + { + if (kvp.Value is JsonValue jv && jv.TryGetValue(out var str)) + { + foreach (var regex in compiledPatterns) + { + if (regex.IsMatch(str)) + { + obj[kvp.Key] = JsonValue.Create(_redactionOptions.RedactedValue); + redactedCount++; + break; + } + } + } + else if (kvp.Value is not null) + { + ProcessNode(kvp.Value); + } + } + break; + + case JsonArray arr: + for (var i = 0; i < arr.Count; i++) + { + if (arr[i] is JsonValue jv && jv.TryGetValue(out var str)) + { + foreach (var regex in compiledPatterns) + { + if (regex.IsMatch(str)) + { + arr[i] = JsonValue.Create(_redactionOptions.RedactedValue); + redactedCount++; + break; + } + } + } + else if (arr[i] is not null) + { + ProcessNode(arr[i]); + } + } + break; + } + } + + ProcessNode(node); + return redactedCount; + } + + private static JsonObject SortKeys(JsonObject obj) + { + var sorted = new JsonObject(); + + foreach (var kvp in obj.OrderBy(x => x.Key, StringComparer.Ordinal)) + { + var value = kvp.Value; + + // Remove from original and add to sorted (JsonNode can only have one parent) + obj.Remove(kvp.Key); + + if (value is JsonObject childObj) + { + sorted[kvp.Key] = SortKeys(childObj); + } + else if (value is JsonArray arr) + { + sorted[kvp.Key] = SortKeysInArray(arr); + } + else + { + sorted[kvp.Key] = value; + } + } + + return sorted; + } + + private static JsonArray SortKeysInArray(JsonArray arr) + { + var newArray = new JsonArray(); + + foreach (var item in arr.ToList()) + { + arr.Remove(item); + + if (item is JsonObject obj) + { + newArray.Add(SortKeys(obj)); + } + else if (item is JsonArray childArr) + { + newArray.Add(SortKeysInArray(childArr)); + } + else + { + newArray.Add(item); + } + } + + return newArray; + } + + private void NormalizeTimestamps(JsonNode? node) + { + switch (node) + { + case JsonObject obj: + foreach (var kvp in obj.ToList()) + { + if (kvp.Value is JsonValue jv && jv.TryGetValue(out var str)) + { + if (TryParseTimestamp(str, out var dt)) + { + obj[kvp.Key] = JsonValue.Create( + dt.ToUniversalTime().ToString(_normalizationOptions.TimestampFormat)); + } + } + else if (kvp.Value is not null) + { + NormalizeTimestamps(kvp.Value); + } + } + break; + + case JsonArray arr: + for (var i = 0; i < arr.Count; i++) + { + if (arr[i] is JsonValue jv && jv.TryGetValue(out var str)) + { + if (TryParseTimestamp(str, out var dt)) + { + arr[i] = JsonValue.Create( + dt.ToUniversalTime().ToString(_normalizationOptions.TimestampFormat)); + } + } + else if (arr[i] is not null) + { + NormalizeTimestamps(arr[i]); + } + } + break; + } + } + + private static bool TryParseTimestamp(string value, out DateTimeOffset result) + { + // Check if the string looks like a timestamp + if (value.Length >= 10 && value.Length <= 40) + { + // Try ISO 8601 formats + if (DateTimeOffset.TryParse(value, null, + System.Globalization.DateTimeStyles.RoundtripKind, out result)) + { + // Additional validation - must have date separators + return value.Contains('-') || value.Contains('/'); + } + } + + result = default; + return false; + } + + private static string NormalizeLineEndings(string text) + { + return text.Replace("\r\n", "\n").Replace("\r", "\n"); + } + + private static string ComputeSha256(string content) + { + var bytes = Encoding.UTF8.GetBytes(content); + var hashBytes = SHA256.HashData(bytes); + return Convert.ToHexString(hashBytes).ToLowerInvariant(); + } +} + +/// +/// Result of JSON normalization. +/// +public sealed record NormalizationResult +{ + public required bool Success { get; init; } + + public string? NormalizedJson { get; init; } + + public string? Sha256 { get; init; } + + public long OriginalSizeBytes { get; init; } + + public long NormalizedSizeBytes { get; init; } + + public int RedactedFieldCount { get; init; } + + public string? ErrorMessage { get; init; } + + public static NormalizationResult Failed(string errorMessage) + => new() { Success = false, ErrorMessage = errorMessage }; +} diff --git a/src/ExportCenter/StellaOps.ExportCenter/StellaOps.ExportCenter.Core/Adapters/JsonPolicyAdapter.cs b/src/ExportCenter/StellaOps.ExportCenter/StellaOps.ExportCenter.Core/Adapters/JsonPolicyAdapter.cs new file mode 100644 index 000000000..ea8489712 --- /dev/null +++ b/src/ExportCenter/StellaOps.ExportCenter/StellaOps.ExportCenter.Core/Adapters/JsonPolicyAdapter.cs @@ -0,0 +1,452 @@ +using System.Diagnostics; +using System.Runtime.CompilerServices; +using System.Security.Cryptography; +using System.Text; +using System.Text.Json; +using System.Text.Json.Nodes; +using Microsoft.Extensions.Logging; +using StellaOps.ExportCenter.Core.Planner; + +namespace StellaOps.ExportCenter.Core.Adapters; + +/// +/// JSON Policy adapter (json:policy) - exports items wrapped with policy metadata. +/// +public sealed class JsonPolicyAdapter : IExportAdapter +{ + public const string Id = "json:policy"; + + private readonly ILogger _logger; + private readonly JsonNormalizer _normalizer; + private readonly ExportCompressor _compressor; + private readonly JsonSerializerOptions _serializerOptions; + + public string AdapterId => Id; + public string DisplayName => "JSON with Policy"; + public IReadOnlyList SupportedFormats { get; } = [ExportFormat.JsonPolicy, ExportFormat.Ndjson]; + public bool SupportsStreaming => true; + + public JsonPolicyAdapter(ILogger logger) + { + _logger = logger; + _normalizer = new JsonNormalizer(); + _compressor = new ExportCompressor(); + _serializerOptions = new JsonSerializerOptions + { + PropertyNamingPolicy = JsonNamingPolicy.CamelCase, + DefaultIgnoreCondition = System.Text.Json.Serialization.JsonIgnoreCondition.WhenWritingNull + }; + } + + public JsonPolicyAdapter( + ILogger logger, + JsonNormalizationOptions? normalizationOptions, + JsonRedactionOptions? redactionOptions) + { + _logger = logger; + _normalizer = new JsonNormalizer(normalizationOptions, redactionOptions); + _compressor = new ExportCompressor(); + _serializerOptions = new JsonSerializerOptions + { + PropertyNamingPolicy = JsonNamingPolicy.CamelCase, + DefaultIgnoreCondition = System.Text.Json.Serialization.JsonIgnoreCondition.WhenWritingNull + }; + } + + public async Task ProcessAsync( + ExportAdapterContext context, + CancellationToken cancellationToken = default) + { + var stopwatch = Stopwatch.StartNew(); + var itemResults = new List(); + var artifacts = new List(); + var countsBuilder = new ManifestCountsBuilder(); + + try + { + Directory.CreateDirectory(context.Config.OutputDirectory); + + var format = context.Config.FormatOptions.Format; + + if (format == ExportFormat.Ndjson) + { + var ndjsonResult = await ProcessAsNdjsonAsync(context, cancellationToken); + if (ndjsonResult.Success) + { + artifacts.Add(ndjsonResult.Artifact!); + itemResults.AddRange(ndjsonResult.ItemResults); + } + else + { + return ExportAdapterResult.Failed(ndjsonResult.ErrorMessage ?? "NDJSON export failed"); + } + } + else + { + foreach (var item in context.Items) + { + cancellationToken.ThrowIfCancellationRequested(); + + var result = await ProcessSingleItemAsync(context, item, cancellationToken); + itemResults.Add(result); + + if (result.Success && result.OutputPath is not null) + { + artifacts.Add(new ExportOutputArtifact + { + Path = result.OutputPath, + SizeBytes = result.OutputSizeBytes, + Sha256 = result.ContentHash ?? string.Empty, + ContentType = "application/json", + ItemCount = 1, + IsCompressed = context.Config.FormatOptions.Compression != CompressionFormat.None, + Compression = context.Config.FormatOptions.Compression + }); + } + + countsBuilder.AddItem(item.Kind, result.Success); + } + } + + stopwatch.Stop(); + + var counts = countsBuilder.Build(artifacts); + + if (_logger.IsEnabled(LogLevel.Information)) + { + _logger.LogInformation( + "JSON policy export completed: {SuccessCount}/{TotalCount} items, {ArtifactCount} artifacts in {ElapsedMs}ms", + counts.SuccessfulItems, counts.TotalItems, counts.ArtifactCount, stopwatch.ElapsedMilliseconds); + } + + return new ExportAdapterResult + { + Success = true, + ItemResults = itemResults, + Artifacts = artifacts, + ManifestCounts = counts, + ProcessingTime = stopwatch.Elapsed, + CompletedAt = context.TimeProvider.GetUtcNow() + }; + } + catch (OperationCanceledException) + { + return ExportAdapterResult.Failed("Export cancelled"); + } + catch (Exception ex) + { + _logger.LogError(ex, "JSON policy export failed"); + return ExportAdapterResult.Failed($"Export failed: {ex.Message}"); + } + } + + public async IAsyncEnumerable ProcessStreamAsync( + ExportAdapterContext context, + [EnumeratorCancellation] CancellationToken cancellationToken = default) + { + Directory.CreateDirectory(context.Config.OutputDirectory); + + foreach (var item in context.Items) + { + cancellationToken.ThrowIfCancellationRequested(); + + var result = await ProcessSingleItemAsync(context, item, cancellationToken); + yield return result; + } + } + + public Task> ValidateConfigAsync( + ExportAdapterConfig config, + CancellationToken cancellationToken = default) + { + var errors = new List(); + + if (string.IsNullOrWhiteSpace(config.OutputDirectory)) + { + errors.Add("Output directory is required"); + } + + if (!SupportedFormats.Contains(config.FormatOptions.Format)) + { + errors.Add($"Format {config.FormatOptions.Format} is not supported by this adapter"); + } + + return Task.FromResult>(errors); + } + + private async Task ProcessSingleItemAsync( + ExportAdapterContext context, + ResolvedExportItem item, + CancellationToken cancellationToken) + { + try + { + // Fetch content + var content = await context.DataFetcher.FetchAsync(item, cancellationToken); + if (!content.Success) + { + return AdapterItemResult.Failed(item.ItemId, content.ErrorMessage ?? "Failed to fetch content"); + } + + if (string.IsNullOrEmpty(content.JsonContent)) + { + return AdapterItemResult.Failed(item.ItemId, "Item content is empty"); + } + + // Normalize the data content + var normalized = _normalizer.Normalize(content.JsonContent); + if (!normalized.Success) + { + return AdapterItemResult.Failed(item.ItemId, normalized.ErrorMessage ?? "Normalization failed"); + } + + // Get policy metadata if evaluator is available + PolicyMetadata? policyMetadata = null; + if (context.PolicyEvaluator is not null) + { + policyMetadata = await context.PolicyEvaluator.EvaluateAsync(item, content, cancellationToken); + } + + // Build the wrapped document + var now = context.TimeProvider.GetUtcNow(); + var wrappedDocument = BuildWrappedDocument(item, normalized.NormalizedJson!, normalized.Sha256!, policyMetadata, now); + + // Serialize to JSON + var outputJson = context.Config.FormatOptions.PrettyPrint + ? JsonSerializer.Serialize(wrappedDocument, new JsonSerializerOptions(_serializerOptions) { WriteIndented = true }) + : JsonSerializer.Serialize(wrappedDocument, _serializerOptions); + + // Compress if requested + var outputBytes = Encoding.UTF8.GetBytes(outputJson); + var compression = context.Config.FormatOptions.Compression; + + if (compression != CompressionFormat.None) + { + var compressed = _compressor.CompressBytes(outputBytes, compression); + if (!compressed.Success) + { + return AdapterItemResult.Failed(item.ItemId, compressed.ErrorMessage ?? "Compression failed"); + } + outputBytes = compressed.CompressedData!; + } + + // Write to file + var fileName = BuildFileName(item, context.Config); + var outputPath = Path.Combine(context.Config.OutputDirectory, fileName); + + await File.WriteAllBytesAsync(outputPath, outputBytes, cancellationToken); + + // Write checksum file if requested + var hash = ComputeSha256(outputBytes); + if (context.Config.IncludeChecksums) + { + var checksumPath = outputPath + ".sha256"; + await File.WriteAllTextAsync(checksumPath, $"{hash} {fileName}\n", cancellationToken); + } + + return new AdapterItemResult + { + ItemId = item.ItemId, + Success = true, + OutputPath = outputPath, + OutputSizeBytes = outputBytes.Length, + ContentHash = hash, + ProcessedAt = now + }; + } + catch (Exception ex) + { + _logger.LogWarning(ex, "Failed to process item {ItemId}", item.ItemId); + return AdapterItemResult.Failed(item.ItemId, ex.Message); + } + } + + private PolicyWrappedExportItem BuildWrappedDocument( + ResolvedExportItem item, + string normalizedJson, + string contentHash, + PolicyMetadata? policyMetadata, + DateTimeOffset exportedAt) + { + // Parse the normalized JSON as an object + var dataNode = JsonNode.Parse(normalizedJson); + + return new PolicyWrappedExportItem + { + Metadata = new ExportItemMetadata + { + ItemId = item.ItemId, + Kind = item.Kind, + SourceRef = item.SourceRef, + Name = item.Name, + Namespace = item.Namespace, + Tags = item.Tags, + CreatedAt = item.CreatedAt, + ExportedAt = exportedAt, + Sha256 = contentHash + }, + Policy = policyMetadata, + Data = dataNode! + }; + } + + private async Task ProcessAsNdjsonAsync( + ExportAdapterContext context, + CancellationToken cancellationToken) + { + var itemResults = new List(); + var lines = new List(); + var now = context.TimeProvider.GetUtcNow(); + + foreach (var item in context.Items) + { + cancellationToken.ThrowIfCancellationRequested(); + + try + { + var content = await context.DataFetcher.FetchAsync(item, cancellationToken); + if (!content.Success) + { + itemResults.Add(AdapterItemResult.Failed(item.ItemId, content.ErrorMessage ?? "Failed to fetch")); + continue; + } + + if (string.IsNullOrEmpty(content.JsonContent)) + { + itemResults.Add(AdapterItemResult.Failed(item.ItemId, "Empty content")); + continue; + } + + var normalized = _normalizer.Normalize(content.JsonContent); + if (!normalized.Success) + { + itemResults.Add(AdapterItemResult.Failed(item.ItemId, normalized.ErrorMessage ?? "Normalization failed")); + continue; + } + + // Get policy metadata + PolicyMetadata? policyMetadata = null; + if (context.PolicyEvaluator is not null) + { + policyMetadata = await context.PolicyEvaluator.EvaluateAsync(item, content, cancellationToken); + } + + // Build wrapped document + var wrappedDocument = BuildWrappedDocument(item, normalized.NormalizedJson!, normalized.Sha256!, policyMetadata, now); + + // Serialize to single line + var lineJson = JsonSerializer.Serialize(wrappedDocument, _serializerOptions); + lines.Add(lineJson); + + itemResults.Add(new AdapterItemResult + { + ItemId = item.ItemId, + Success = true, + ContentHash = normalized.Sha256, + ProcessedAt = now + }); + } + catch (Exception ex) + { + itemResults.Add(AdapterItemResult.Failed(item.ItemId, ex.Message)); + } + } + + if (lines.Count == 0) + { + return NdjsonPolicyExportResult.Failed("No items processed successfully"); + } + + // Write NDJSON file + var ndjsonContent = string.Join("\n", lines) + "\n"; + var outputBytes = Encoding.UTF8.GetBytes(ndjsonContent); + var compression = context.Config.FormatOptions.Compression; + long originalSize = outputBytes.Length; + + if (compression != CompressionFormat.None) + { + var compressed = _compressor.CompressBytes(outputBytes, compression); + if (!compressed.Success) + { + return NdjsonPolicyExportResult.Failed(compressed.ErrorMessage ?? "Compression failed"); + } + outputBytes = compressed.CompressedData!; + } + + var fileName = $"{context.Config.BaseName}-policy.ndjson{ExportCompressor.GetFileExtension(compression)}"; + var outputPath = Path.Combine(context.Config.OutputDirectory, fileName); + + await File.WriteAllBytesAsync(outputPath, outputBytes, cancellationToken); + + var hash = ComputeSha256(outputBytes); + if (context.Config.IncludeChecksums) + { + var checksumPath = outputPath + ".sha256"; + await File.WriteAllTextAsync(checksumPath, $"{hash} {fileName}\n", cancellationToken); + } + + return new NdjsonPolicyExportResult + { + Success = true, + ItemResults = itemResults, + Artifact = new ExportOutputArtifact + { + Path = outputPath, + SizeBytes = outputBytes.Length, + Sha256 = hash, + ContentType = "application/x-ndjson", + ItemCount = lines.Count, + IsCompressed = compression != CompressionFormat.None, + Compression = compression, + OriginalSizeBytes = originalSize + } + }; + } + + private static string BuildFileName(ResolvedExportItem item, ExportAdapterConfig config) + { + var baseName = !string.IsNullOrEmpty(item.Name) + ? SanitizeFileName(item.Name) + : item.ItemId.ToString("N")[..8]; + + var extension = ".policy.json" + ExportCompressor.GetFileExtension(config.FormatOptions.Compression); + + return $"{item.Kind}-{baseName}{extension}"; + } + + private static string SanitizeFileName(string name) + { + var invalid = Path.GetInvalidFileNameChars(); + var sanitized = new StringBuilder(name.Length); + + foreach (var c in name) + { + sanitized.Append(invalid.Contains(c) ? '_' : c); + } + + var result = sanitized.ToString(); + if (result.Length > 64) + { + result = result[..64]; + } + + return result.ToLowerInvariant(); + } + + private static string ComputeSha256(byte[] data) + { + var hashBytes = SHA256.HashData(data); + return Convert.ToHexString(hashBytes).ToLowerInvariant(); + } + + private sealed record NdjsonPolicyExportResult + { + public required bool Success { get; init; } + public IReadOnlyList ItemResults { get; init; } = []; + public ExportOutputArtifact? Artifact { get; init; } + public string? ErrorMessage { get; init; } + + public static NdjsonPolicyExportResult Failed(string errorMessage) + => new() { Success = false, ErrorMessage = errorMessage }; + } +} diff --git a/src/ExportCenter/StellaOps.ExportCenter/StellaOps.ExportCenter.Core/Adapters/JsonRawAdapter.cs b/src/ExportCenter/StellaOps.ExportCenter/StellaOps.ExportCenter.Core/Adapters/JsonRawAdapter.cs new file mode 100644 index 000000000..b45f6fc42 --- /dev/null +++ b/src/ExportCenter/StellaOps.ExportCenter/StellaOps.ExportCenter.Core/Adapters/JsonRawAdapter.cs @@ -0,0 +1,461 @@ +using System.Diagnostics; +using System.Runtime.CompilerServices; +using System.Security.Cryptography; +using System.Text; +using System.Text.Json; +using Microsoft.Extensions.Logging; +using StellaOps.ExportCenter.Core.Planner; + +namespace StellaOps.ExportCenter.Core.Adapters; + +/// +/// JSON Raw adapter (json:raw) - exports items as raw JSON documents. +/// +public sealed class JsonRawAdapter : IExportAdapter +{ + public const string Id = "json:raw"; + + private readonly ILogger _logger; + private readonly JsonNormalizer _normalizer; + private readonly ExportCompressor _compressor; + + public string AdapterId => Id; + public string DisplayName => "JSON Raw"; + public IReadOnlyList SupportedFormats { get; } = [ExportFormat.JsonRaw, ExportFormat.Ndjson]; + public bool SupportsStreaming => true; + + public JsonRawAdapter(ILogger logger) + { + _logger = logger; + _normalizer = new JsonNormalizer(); + _compressor = new ExportCompressor(); + } + + public JsonRawAdapter( + ILogger logger, + JsonNormalizationOptions? normalizationOptions, + JsonRedactionOptions? redactionOptions) + { + _logger = logger; + _normalizer = new JsonNormalizer(normalizationOptions, redactionOptions); + _compressor = new ExportCompressor(); + } + + public async Task ProcessAsync( + ExportAdapterContext context, + CancellationToken cancellationToken = default) + { + var stopwatch = Stopwatch.StartNew(); + var itemResults = new List(); + var artifacts = new List(); + var countsBuilder = new ManifestCountsBuilder(); + + try + { + // Ensure output directory exists + Directory.CreateDirectory(context.Config.OutputDirectory); + + var format = context.Config.FormatOptions.Format; + + if (format == ExportFormat.Ndjson) + { + // Process all items into a single NDJSON file + var ndjsonResult = await ProcessAsNdjsonAsync(context, cancellationToken); + if (ndjsonResult.Success) + { + artifacts.Add(ndjsonResult.Artifact!); + itemResults.AddRange(ndjsonResult.ItemResults); + } + else + { + return ExportAdapterResult.Failed(ndjsonResult.ErrorMessage ?? "NDJSON export failed"); + } + } + else + { + // Process each item as individual JSON file + foreach (var item in context.Items) + { + cancellationToken.ThrowIfCancellationRequested(); + + var result = await ProcessSingleItemAsync(context, item, cancellationToken); + itemResults.Add(result); + + if (result.Success && result.OutputPath is not null) + { + artifacts.Add(new ExportOutputArtifact + { + Path = result.OutputPath, + SizeBytes = result.OutputSizeBytes, + Sha256 = result.ContentHash ?? string.Empty, + ContentType = "application/json", + ItemCount = 1, + IsCompressed = context.Config.FormatOptions.Compression != CompressionFormat.None, + Compression = context.Config.FormatOptions.Compression, + OriginalSizeBytes = result.OutputSizeBytes + }); + } + + countsBuilder.AddItem(item.Kind, result.Success); + } + } + + stopwatch.Stop(); + + // Build manifest counts + var counts = countsBuilder.Build(artifacts); + + if (_logger.IsEnabled(LogLevel.Information)) + { + _logger.LogInformation( + "JSON raw export completed: {SuccessCount}/{TotalCount} items, {ArtifactCount} artifacts, {TotalBytes} bytes in {ElapsedMs}ms", + counts.SuccessfulItems, counts.TotalItems, counts.ArtifactCount, counts.TotalSizeBytes, stopwatch.ElapsedMilliseconds); + } + + return new ExportAdapterResult + { + Success = true, + ItemResults = itemResults, + Artifacts = artifacts, + ManifestCounts = counts, + ProcessingTime = stopwatch.Elapsed, + CompletedAt = context.TimeProvider.GetUtcNow() + }; + } + catch (OperationCanceledException) + { + return ExportAdapterResult.Failed("Export cancelled"); + } + catch (Exception ex) + { + _logger.LogError(ex, "JSON raw export failed"); + return ExportAdapterResult.Failed($"Export failed: {ex.Message}"); + } + } + + public async IAsyncEnumerable ProcessStreamAsync( + ExportAdapterContext context, + [EnumeratorCancellation] CancellationToken cancellationToken = default) + { + Directory.CreateDirectory(context.Config.OutputDirectory); + + foreach (var item in context.Items) + { + cancellationToken.ThrowIfCancellationRequested(); + + var result = await ProcessSingleItemAsync(context, item, cancellationToken); + yield return result; + } + } + + public Task> ValidateConfigAsync( + ExportAdapterConfig config, + CancellationToken cancellationToken = default) + { + var errors = new List(); + + if (string.IsNullOrWhiteSpace(config.OutputDirectory)) + { + errors.Add("Output directory is required"); + } + + if (!SupportedFormats.Contains(config.FormatOptions.Format)) + { + errors.Add($"Format {config.FormatOptions.Format} is not supported by this adapter"); + } + + return Task.FromResult>(errors); + } + + private async Task ProcessSingleItemAsync( + ExportAdapterContext context, + ResolvedExportItem item, + CancellationToken cancellationToken) + { + try + { + // Fetch content + var content = await context.DataFetcher.FetchAsync(item, cancellationToken); + if (!content.Success) + { + return AdapterItemResult.Failed(item.ItemId, content.ErrorMessage ?? "Failed to fetch content"); + } + + if (string.IsNullOrEmpty(content.JsonContent)) + { + return AdapterItemResult.Failed(item.ItemId, "Item content is empty"); + } + + // Normalize JSON + var normalized = _normalizer.Normalize(content.JsonContent); + if (!normalized.Success) + { + return AdapterItemResult.Failed(item.ItemId, normalized.ErrorMessage ?? "Normalization failed"); + } + + // Apply pretty print if requested + var outputJson = normalized.NormalizedJson!; + if (context.Config.FormatOptions.PrettyPrint) + { + outputJson = PrettyPrint(outputJson); + } + + // Compress if requested + var outputBytes = Encoding.UTF8.GetBytes(outputJson); + var compression = context.Config.FormatOptions.Compression; + + if (compression != CompressionFormat.None) + { + var compressed = _compressor.CompressBytes(outputBytes, compression); + if (!compressed.Success) + { + return AdapterItemResult.Failed(item.ItemId, compressed.ErrorMessage ?? "Compression failed"); + } + outputBytes = compressed.CompressedData!; + } + + // Write to file + var fileName = BuildFileName(item, context.Config); + var outputPath = Path.Combine(context.Config.OutputDirectory, fileName); + + await File.WriteAllBytesAsync(outputPath, outputBytes, cancellationToken); + + // Write checksum file if requested + var hash = ComputeSha256(outputBytes); + if (context.Config.IncludeChecksums) + { + var checksumPath = outputPath + ".sha256"; + await File.WriteAllTextAsync(checksumPath, $"{hash} {fileName}\n", cancellationToken); + } + + return new AdapterItemResult + { + ItemId = item.ItemId, + Success = true, + OutputPath = outputPath, + OutputSizeBytes = outputBytes.Length, + ContentHash = hash, + ProcessedAt = context.TimeProvider.GetUtcNow() + }; + } + catch (Exception ex) + { + _logger.LogWarning(ex, "Failed to process item {ItemId}", item.ItemId); + return AdapterItemResult.Failed(item.ItemId, ex.Message); + } + } + + private async Task ProcessAsNdjsonAsync( + ExportAdapterContext context, + CancellationToken cancellationToken) + { + var itemResults = new List(); + var lines = new List(); + + foreach (var item in context.Items) + { + cancellationToken.ThrowIfCancellationRequested(); + + try + { + var content = await context.DataFetcher.FetchAsync(item, cancellationToken); + if (!content.Success) + { + itemResults.Add(AdapterItemResult.Failed(item.ItemId, content.ErrorMessage ?? "Failed to fetch")); + continue; + } + + if (string.IsNullOrEmpty(content.JsonContent)) + { + itemResults.Add(AdapterItemResult.Failed(item.ItemId, "Empty content")); + continue; + } + + var normalized = _normalizer.Normalize(content.JsonContent); + if (!normalized.Success) + { + itemResults.Add(AdapterItemResult.Failed(item.ItemId, normalized.ErrorMessage ?? "Normalization failed")); + continue; + } + + // Ensure single line for NDJSON + var singleLine = normalized.NormalizedJson!.Replace("\n", " ").Replace("\r", ""); + lines.Add(singleLine); + + itemResults.Add(new AdapterItemResult + { + ItemId = item.ItemId, + Success = true, + ContentHash = normalized.Sha256, + ProcessedAt = context.TimeProvider.GetUtcNow() + }); + } + catch (Exception ex) + { + itemResults.Add(AdapterItemResult.Failed(item.ItemId, ex.Message)); + } + } + + if (lines.Count == 0) + { + return NdjsonExportResult.Failed("No items processed successfully"); + } + + // Write NDJSON file + var ndjsonContent = string.Join("\n", lines) + "\n"; + var outputBytes = Encoding.UTF8.GetBytes(ndjsonContent); + var compression = context.Config.FormatOptions.Compression; + long originalSize = outputBytes.Length; + + if (compression != CompressionFormat.None) + { + var compressed = _compressor.CompressBytes(outputBytes, compression); + if (!compressed.Success) + { + return NdjsonExportResult.Failed(compressed.ErrorMessage ?? "Compression failed"); + } + outputBytes = compressed.CompressedData!; + } + + var fileName = $"{context.Config.BaseName}.ndjson{ExportCompressor.GetFileExtension(compression)}"; + var outputPath = Path.Combine(context.Config.OutputDirectory, fileName); + + await File.WriteAllBytesAsync(outputPath, outputBytes, cancellationToken); + + var hash = ComputeSha256(outputBytes); + if (context.Config.IncludeChecksums) + { + var checksumPath = outputPath + ".sha256"; + await File.WriteAllTextAsync(checksumPath, $"{hash} {fileName}\n", cancellationToken); + } + + return new NdjsonExportResult + { + Success = true, + ItemResults = itemResults, + Artifact = new ExportOutputArtifact + { + Path = outputPath, + SizeBytes = outputBytes.Length, + Sha256 = hash, + ContentType = "application/x-ndjson", + ItemCount = lines.Count, + IsCompressed = compression != CompressionFormat.None, + Compression = compression, + OriginalSizeBytes = originalSize + } + }; + } + + private static string BuildFileName(ResolvedExportItem item, ExportAdapterConfig config) + { + var baseName = !string.IsNullOrEmpty(item.Name) + ? SanitizeFileName(item.Name) + : item.ItemId.ToString("N")[..8]; + + var extension = ".json" + ExportCompressor.GetFileExtension(config.FormatOptions.Compression); + + return $"{item.Kind}-{baseName}{extension}"; + } + + private static string SanitizeFileName(string name) + { + var invalid = Path.GetInvalidFileNameChars(); + var sanitized = new StringBuilder(name.Length); + + foreach (var c in name) + { + sanitized.Append(invalid.Contains(c) ? '_' : c); + } + + // Limit length + var result = sanitized.ToString(); + if (result.Length > 64) + { + result = result[..64]; + } + + return result.ToLowerInvariant(); + } + + private static string PrettyPrint(string json) + { + using var doc = JsonDocument.Parse(json); + return JsonSerializer.Serialize(doc, new JsonSerializerOptions { WriteIndented = true }); + } + + private static string ComputeSha256(byte[] data) + { + var hashBytes = SHA256.HashData(data); + return Convert.ToHexString(hashBytes).ToLowerInvariant(); + } + + private sealed record NdjsonExportResult + { + public required bool Success { get; init; } + public IReadOnlyList ItemResults { get; init; } = []; + public ExportOutputArtifact? Artifact { get; init; } + public string? ErrorMessage { get; init; } + + public static NdjsonExportResult Failed(string errorMessage) + => new() { Success = false, ErrorMessage = errorMessage }; + } +} + +/// +/// Builder for manifest counts. +/// +internal sealed class ManifestCountsBuilder +{ + private int _totalItems; + private int _successfulItems; + private int _failedItems; + private readonly Dictionary _byKind = new(); + private readonly Dictionary _byStatus = new(); + + public void AddItem(string kind, bool success) + { + _totalItems++; + + if (success) + { + _successfulItems++; + IncrementDict(_byStatus, "success"); + } + else + { + _failedItems++; + IncrementDict(_byStatus, "failed"); + } + + IncrementDict(_byKind, kind); + } + + public ExportManifestCounts Build(IReadOnlyList artifacts) + { + var totalSize = artifacts.Sum(a => a.SizeBytes); + var compressedSize = artifacts.Where(a => a.IsCompressed).Sum(a => a.SizeBytes); + var originalSize = artifacts.Where(a => a.IsCompressed && a.OriginalSizeBytes.HasValue) + .Sum(a => a.OriginalSizeBytes!.Value); + + return new ExportManifestCounts + { + TotalItems = _totalItems, + ProcessedItems = _totalItems, + SuccessfulItems = _successfulItems, + FailedItems = _failedItems, + SkippedItems = 0, + ArtifactCount = artifacts.Count, + TotalSizeBytes = totalSize, + CompressedSizeBytes = compressedSize > 0 ? compressedSize : null, + ByKind = _byKind, + ByStatus = _byStatus + }; + } + + private static void IncrementDict(Dictionary dict, string key) + { + dict.TryGetValue(key, out var current); + dict[key] = current + 1; + } +} diff --git a/src/ExportCenter/StellaOps.ExportCenter/StellaOps.ExportCenter.Core/Configuration/ExportCenterOptions.cs b/src/ExportCenter/StellaOps.ExportCenter/StellaOps.ExportCenter.Core/Configuration/ExportCenterOptions.cs new file mode 100644 index 000000000..be3bca7b7 --- /dev/null +++ b/src/ExportCenter/StellaOps.ExportCenter/StellaOps.ExportCenter.Core/Configuration/ExportCenterOptions.cs @@ -0,0 +1,114 @@ +using System.ComponentModel.DataAnnotations; + +namespace StellaOps.ExportCenter.Core.Configuration; + +/// +/// Root configuration options for the Export Center service. +/// +public sealed class ExportCenterOptions +{ + public const string SectionName = "ExportCenter"; + + [Required] + public required DatabaseOptions Database { get; init; } + + public ObjectStoreOptions? ObjectStore { get; init; } + + public TimelineOptions? Timeline { get; init; } + + public SigningOptions Signing { get; init; } = new(); + + public QuotaOptions Quotas { get; init; } = new(); +} + +/// +/// Database connection options for Export Center. +/// +public sealed class DatabaseOptions +{ + [Required] + public required string ConnectionString { get; init; } + + /// + /// Enables automatic execution of SQL migrations at startup. + /// + public bool ApplyMigrationsAtStartup { get; init; } = true; +} + +/// +/// Object storage options for export artifacts. +/// +public sealed class ObjectStoreOptions +{ + [Required] + public required ObjectStoreKind Kind { get; init; } + + /// + /// Base path for file system storage. + /// + public string? RootPath { get; init; } + + /// + /// S3 bucket name for cloud storage. + /// + public string? BucketName { get; init; } + + /// + /// AWS region for S3 storage. + /// + public string? Region { get; init; } +} + +/// +/// Supported object store backends. +/// +public enum ObjectStoreKind +{ + FileSystem = 1, + AmazonS3 = 2 +} + +/// +/// Timeline integration options. +/// +public sealed class TimelineOptions +{ + public bool Enabled { get; init; } + + [Url] + public string? Endpoint { get; init; } + + [Range(1, 300)] + public int RequestTimeoutSeconds { get; init; } = 15; + + public string Source { get; init; } = "stellaops.export-center"; +} + +/// +/// Signing options for export manifests. +/// +public sealed class SigningOptions +{ + public bool Enabled { get; init; } = true; + + public string Algorithm { get; init; } = "ES256"; + + public string KeyId { get; init; } = string.Empty; + + public string? Provider { get; init; } +} + +/// +/// Quota limits for export operations. +/// +public sealed class QuotaOptions +{ + [Range(1, 1000)] + public int MaxConcurrentExports { get; init; } = 10; + + [Range(1, long.MaxValue)] + public long MaxExportSizeBytes { get; init; } = 1L * 1024 * 1024 * 1024; + + [Range(1, 3650)] + public int DefaultRetentionDays { get; init; } = 90; +} diff --git a/src/ExportCenter/StellaOps.ExportCenter/StellaOps.ExportCenter.Core/Domain/ExportDistribution.cs b/src/ExportCenter/StellaOps.ExportCenter/StellaOps.ExportCenter.Core/Domain/ExportDistribution.cs new file mode 100644 index 000000000..a84b70e83 --- /dev/null +++ b/src/ExportCenter/StellaOps.ExportCenter/StellaOps.ExportCenter.Core/Domain/ExportDistribution.cs @@ -0,0 +1,130 @@ +namespace StellaOps.ExportCenter.Core.Domain; + +/// +/// Represents a distribution target for export artifacts. +/// +public sealed class ExportDistribution +{ + public required Guid DistributionId { get; init; } + + public required Guid RunId { get; init; } + + public required Guid TenantId { get; init; } + + public required ExportDistributionKind Kind { get; init; } + + public required ExportDistributionStatus Status { get; init; } + + /// + /// Target location (path, URL, bucket). + /// + public required string Target { get; init; } + + /// + /// Artifact path relative to distribution root. + /// + public required string ArtifactPath { get; init; } + + /// + /// SHA256 hash of the distributed artifact. + /// + public string? ArtifactHash { get; init; } + + /// + /// Size of the artifact in bytes. + /// + public long SizeBytes { get; init; } + + /// + /// Content type of the artifact. + /// + public string? ContentType { get; init; } + + /// + /// JSON-encoded distribution metadata (e.g., S3 ETag, version). + /// + public string? MetadataJson { get; init; } + + /// + /// JSON-encoded error details if distribution failed. + /// + public string? ErrorJson { get; init; } + + /// + /// Number of distribution attempts. + /// + public int AttemptCount { get; init; } + + public DateTimeOffset CreatedAt { get; init; } + + public DateTimeOffset? DistributedAt { get; init; } + + public DateTimeOffset? VerifiedAt { get; init; } +} + +/// +/// Kind of distribution target. +/// +public enum ExportDistributionKind +{ + /// + /// Local file system distribution. + /// + FileSystem = 1, + + /// + /// Amazon S3 distribution. + /// + AmazonS3 = 2, + + /// + /// Mirror server distribution. + /// + Mirror = 3, + + /// + /// Air-gap offline kit distribution. + /// + OfflineKit = 4, + + /// + /// Webhook notification (metadata only). + /// + Webhook = 5 +} + +/// +/// Status of an export distribution. +/// +public enum ExportDistributionStatus +{ + /// + /// Distribution is pending. + /// + Pending = 1, + + /// + /// Distribution is in progress. + /// + Distributing = 2, + + /// + /// Distribution completed successfully. + /// + Distributed = 3, + + /// + /// Distribution verified at target. + /// + Verified = 4, + + /// + /// Distribution failed. + /// + Failed = 5, + + /// + /// Distribution cancelled. + /// + Cancelled = 6 +} diff --git a/src/ExportCenter/StellaOps.ExportCenter/StellaOps.ExportCenter.Core/Domain/ExportInput.cs b/src/ExportCenter/StellaOps.ExportCenter/StellaOps.ExportCenter.Core/Domain/ExportInput.cs new file mode 100644 index 000000000..042d47e33 --- /dev/null +++ b/src/ExportCenter/StellaOps.ExportCenter/StellaOps.ExportCenter.Core/Domain/ExportInput.cs @@ -0,0 +1,128 @@ +namespace StellaOps.ExportCenter.Core.Domain; + +/// +/// Represents an input item to be included in an export run. +/// +public sealed class ExportInput +{ + public required Guid InputId { get; init; } + + public required Guid RunId { get; init; } + + public required Guid TenantId { get; init; } + + public required ExportInputKind Kind { get; init; } + + public required ExportInputStatus Status { get; init; } + + /// + /// Reference identifier for the source item (e.g., SBOM ID, scan ID). + /// + public required string SourceRef { get; init; } + + /// + /// Human-readable name for the input. + /// + public string? Name { get; init; } + + /// + /// SHA256 hash of the input content. + /// + public string? ContentHash { get; init; } + + /// + /// Size of the input in bytes. + /// + public long SizeBytes { get; init; } + + /// + /// JSON-encoded metadata about the input. + /// + public string? MetadataJson { get; init; } + + /// + /// JSON-encoded error details if processing failed. + /// + public string? ErrorJson { get; init; } + + public DateTimeOffset CreatedAt { get; init; } + + public DateTimeOffset? ProcessedAt { get; init; } +} + +/// +/// Kind of export input. +/// +public enum ExportInputKind +{ + /// + /// SBOM document (CycloneDX or SPDX). + /// + Sbom = 1, + + /// + /// VEX document. + /// + Vex = 2, + + /// + /// Attestation bundle. + /// + Attestation = 3, + + /// + /// Scan report. + /// + ScanReport = 4, + + /// + /// Policy evaluation result. + /// + PolicyResult = 5, + + /// + /// Evidence bundle. + /// + Evidence = 6, + + /// + /// Risk assessment bundle. + /// + RiskBundle = 7, + + /// + /// Advisory data. + /// + Advisory = 8 +} + +/// +/// Status of an export input. +/// +public enum ExportInputStatus +{ + /// + /// Input is pending processing. + /// + Pending = 1, + + /// + /// Input is being processed. + /// + Processing = 2, + + /// + /// Input was processed successfully. + /// + Processed = 3, + + /// + /// Input processing failed. + /// + Failed = 4, + + /// + /// Input was skipped (filtered out). + /// + Skipped = 5 +} diff --git a/src/ExportCenter/StellaOps.ExportCenter/StellaOps.ExportCenter.Core/Domain/ExportProfile.cs b/src/ExportCenter/StellaOps.ExportCenter/StellaOps.ExportCenter.Core/Domain/ExportProfile.cs new file mode 100644 index 000000000..434eb74de --- /dev/null +++ b/src/ExportCenter/StellaOps.ExportCenter/StellaOps.ExportCenter.Core/Domain/ExportProfile.cs @@ -0,0 +1,97 @@ +namespace StellaOps.ExportCenter.Core.Domain; + +/// +/// Represents an export profile defining the scope and configuration of exports. +/// +public sealed record ExportProfile +{ + public required Guid ProfileId { get; init; } + + public required Guid TenantId { get; init; } + + public required string Name { get; init; } + + public string? Description { get; init; } + + public required ExportProfileKind Kind { get; init; } + + public required ExportProfileStatus Status { get; init; } + + /// + /// JSON-encoded scope configuration specifying what to export. + /// + public string? ScopeJson { get; init; } + + /// + /// JSON-encoded format configuration (output formats, compression, etc.). + /// + public string? FormatJson { get; init; } + + /// + /// JSON-encoded signing configuration. + /// + public string? SigningJson { get; init; } + + /// + /// Cron expression for scheduled exports. + /// + public string? Schedule { get; init; } + + public DateTimeOffset CreatedAt { get; init; } + + public DateTimeOffset UpdatedAt { get; init; } + + public DateTimeOffset? ArchivedAt { get; init; } +} + +/// +/// Kind of export profile. +/// +public enum ExportProfileKind +{ + /// + /// Ad-hoc export triggered manually. + /// + AdHoc = 1, + + /// + /// Scheduled export running on a cron schedule. + /// + Scheduled = 2, + + /// + /// Event-driven export triggered by webhooks or events. + /// + EventDriven = 3, + + /// + /// Continuous export for near-real-time mirror updates. + /// + Continuous = 4 +} + +/// +/// Status of an export profile. +/// +public enum ExportProfileStatus +{ + /// + /// Profile is being set up. + /// + Draft = 1, + + /// + /// Profile is active and can run exports. + /// + Active = 2, + + /// + /// Profile is paused and will not run scheduled exports. + /// + Paused = 3, + + /// + /// Profile is archived and read-only. + /// + Archived = 4 +} diff --git a/src/ExportCenter/StellaOps.ExportCenter/StellaOps.ExportCenter.Core/Domain/ExportRun.cs b/src/ExportCenter/StellaOps.ExportCenter/StellaOps.ExportCenter.Core/Domain/ExportRun.cs new file mode 100644 index 000000000..e23630e1e --- /dev/null +++ b/src/ExportCenter/StellaOps.ExportCenter/StellaOps.ExportCenter.Core/Domain/ExportRun.cs @@ -0,0 +1,128 @@ +namespace StellaOps.ExportCenter.Core.Domain; + +/// +/// Represents a single execution of an export profile. +/// +public sealed class ExportRun +{ + public required Guid RunId { get; init; } + + public required Guid ProfileId { get; init; } + + public required Guid TenantId { get; init; } + + public required ExportRunStatus Status { get; init; } + + /// + /// Trigger source (manual, scheduled, event, api). + /// + public required ExportRunTrigger Trigger { get; init; } + + /// + /// Optional correlation ID for tracing. + /// + public string? CorrelationId { get; init; } + + /// + /// User or service that initiated the export. + /// + public string? InitiatedBy { get; init; } + + /// + /// Total number of items to export. + /// + public int TotalItems { get; init; } + + /// + /// Number of items exported so far. + /// + public int ProcessedItems { get; init; } + + /// + /// Number of items that failed to export. + /// + public int FailedItems { get; init; } + + /// + /// Total size of exported artifacts in bytes. + /// + public long TotalSizeBytes { get; init; } + + /// + /// JSON-encoded error details if the run failed. + /// + public string? ErrorJson { get; init; } + + public DateTimeOffset CreatedAt { get; init; } + + public DateTimeOffset? StartedAt { get; init; } + + public DateTimeOffset? CompletedAt { get; init; } + + /// + /// Timestamp when artifacts expire. + /// + public DateTimeOffset? ExpiresAt { get; init; } +} + +/// +/// Status of an export run. +/// +public enum ExportRunStatus +{ + /// + /// Run is queued waiting to start. + /// + Queued = 1, + + /// + /// Run is actively processing. + /// + Running = 2, + + /// + /// Run completed successfully. + /// + Completed = 3, + + /// + /// Run completed with some failures. + /// + PartiallyCompleted = 4, + + /// + /// Run failed. + /// + Failed = 5, + + /// + /// Run was cancelled. + /// + Cancelled = 6 +} + +/// +/// Trigger source for an export run. +/// +public enum ExportRunTrigger +{ + /// + /// Manually triggered by a user. + /// + Manual = 1, + + /// + /// Triggered by a cron schedule. + /// + Scheduled = 2, + + /// + /// Triggered by an external event. + /// + Event = 3, + + /// + /// Triggered via API. + /// + Api = 4 +} diff --git a/src/ExportCenter/StellaOps.ExportCenter/StellaOps.ExportCenter.Core/Planner/ExportPlanModels.cs b/src/ExportCenter/StellaOps.ExportCenter/StellaOps.ExportCenter.Core/Planner/ExportPlanModels.cs new file mode 100644 index 000000000..1cee686c7 --- /dev/null +++ b/src/ExportCenter/StellaOps.ExportCenter/StellaOps.ExportCenter.Core/Planner/ExportPlanModels.cs @@ -0,0 +1,278 @@ +using System.Text.Json.Serialization; + +namespace StellaOps.ExportCenter.Core.Planner; + +/// +/// Request to create an export plan. +/// +public sealed record ExportPlanRequest +{ + public required Guid ProfileId { get; init; } + + public required Guid TenantId { get; init; } + + public ExportScope? ScopeOverride { get; init; } + + public ExportFormatOptions? FormatOverride { get; init; } + + public string? CorrelationId { get; init; } + + public string? InitiatedBy { get; init; } + + public bool DryRun { get; init; } +} + +/// +/// Output format configuration for exports. +/// +public sealed record ExportFormatOptions +{ + [JsonPropertyName("format")] + public ExportFormat Format { get; init; } = ExportFormat.JsonRaw; + + [JsonPropertyName("compression")] + public CompressionFormat Compression { get; init; } = CompressionFormat.None; + + [JsonPropertyName("includeMetadata")] + public bool IncludeMetadata { get; init; } = true; + + [JsonPropertyName("prettyPrint")] + public bool PrettyPrint { get; init; } + + [JsonPropertyName("redactFields")] + public IReadOnlyList RedactFields { get; init; } = []; + + [JsonPropertyName("normalizeTimestamps")] + public bool NormalizeTimestamps { get; init; } = true; + + [JsonPropertyName("sortKeys")] + public bool SortKeys { get; init; } = true; +} + +/// +/// Supported export formats. +/// +public enum ExportFormat +{ + /// + /// Raw JSON (one object per file). + /// + JsonRaw = 1, + + /// + /// JSON with policy metadata included. + /// + JsonPolicy = 2, + + /// + /// Newline-delimited JSON (streaming format). + /// + Ndjson = 3, + + /// + /// CSV format. + /// + Csv = 4, + + /// + /// Full mirror layout with indexes. + /// + Mirror = 5 +} + +/// +/// Compression formats for export artifacts. +/// +public enum CompressionFormat +{ + None = 0, + Gzip = 1, + Zstd = 2, + Brotli = 3 +} + +/// +/// A planned export operation ready for execution. +/// +public sealed record ExportPlan +{ + public required Guid PlanId { get; init; } + + public required Guid ProfileId { get; init; } + + public required Guid TenantId { get; init; } + + public required ExportPlanStatus Status { get; init; } + + public required ExportScope ResolvedScope { get; init; } + + public required ExportFormatOptions Format { get; init; } + + public IReadOnlyList Phases { get; init; } = []; + + public int TotalItems { get; init; } + + public long EstimatedSizeBytes { get; init; } + + public TimeSpan EstimatedDuration { get; init; } + + public string? CorrelationId { get; init; } + + public string? InitiatedBy { get; init; } + + public DateTimeOffset CreatedAt { get; init; } + + public DateTimeOffset? ValidUntil { get; init; } + + public IReadOnlyList Warnings { get; init; } = []; + + public IReadOnlyList ValidationErrors { get; init; } = []; +} + +/// +/// Status of an export plan. +/// +public enum ExportPlanStatus +{ + /// + /// Plan is being created. + /// + Creating = 1, + + /// + /// Plan is ready for execution. + /// + Ready = 2, + + /// + /// Plan has validation errors. + /// + Invalid = 3, + + /// + /// Plan has been executed. + /// + Executed = 4, + + /// + /// Plan has expired. + /// + Expired = 5, + + /// + /// Plan was cancelled. + /// + Cancelled = 6 +} + +/// +/// A phase in the export execution plan. +/// +public sealed record ExportPlanPhase +{ + public required int Order { get; init; } + + public required string Name { get; init; } + + public required ExportPhaseKind Kind { get; init; } + + public int ItemCount { get; init; } + + public long EstimatedSizeBytes { get; init; } + + public TimeSpan EstimatedDuration { get; init; } + + public IReadOnlyList Dependencies { get; init; } = []; + + public IReadOnlyDictionary Parameters { get; init; } = new Dictionary(); +} + +/// +/// Kinds of export phases. +/// +public enum ExportPhaseKind +{ + /// + /// Resolve scope and collect items. + /// + ScopeResolution = 1, + + /// + /// Fetch and transform data. + /// + DataFetch = 2, + + /// + /// Apply normalization/redaction. + /// + Transform = 3, + + /// + /// Write output files. + /// + WriteOutput = 4, + + /// + /// Generate checksums and manifest. + /// + GenerateManifest = 5, + + /// + /// Sign artifacts. + /// + Sign = 6, + + /// + /// Distribute to targets. + /// + Distribute = 7, + + /// + /// Verify distribution. + /// + Verify = 8 +} + +/// +/// Validation error in an export plan. +/// +public sealed record ExportValidationError +{ + public required string Code { get; init; } + + public required string Message { get; init; } + + public string? Field { get; init; } + + public ExportValidationSeverity Severity { get; init; } = ExportValidationSeverity.Error; +} + +/// +/// Severity of a validation error. +/// +public enum ExportValidationSeverity +{ + Warning = 1, + Error = 2, + Critical = 3 +} + +/// +/// Result of creating an export plan. +/// +public sealed record ExportPlanResult +{ + public required bool Success { get; init; } + + public ExportPlan? Plan { get; init; } + + public string? ErrorMessage { get; init; } + + public IReadOnlyList ValidationErrors { get; init; } = []; + + public static ExportPlanResult Failed(string errorMessage) + => new() { Success = false, ErrorMessage = errorMessage }; + + public static ExportPlanResult Invalid(IReadOnlyList errors) + => new() { Success = false, ValidationErrors = errors }; +} diff --git a/src/ExportCenter/StellaOps.ExportCenter/StellaOps.ExportCenter.Core/Planner/ExportPlanner.cs b/src/ExportCenter/StellaOps.ExportCenter/StellaOps.ExportCenter.Core/Planner/ExportPlanner.cs new file mode 100644 index 000000000..62398d38c --- /dev/null +++ b/src/ExportCenter/StellaOps.ExportCenter/StellaOps.ExportCenter.Core/Planner/ExportPlanner.cs @@ -0,0 +1,364 @@ +using System.Collections.Concurrent; +using System.Text.Json; +using Microsoft.Extensions.Logging; +using StellaOps.ExportCenter.Core.Domain; + +namespace StellaOps.ExportCenter.Core.Planner; + +/// +/// Default implementation of export planner. +/// +public sealed class ExportPlanner : IExportPlanner +{ + private const int DefaultPlanValidityMinutes = 60; + private const double BytesPerSecondEstimate = 10 * 1024 * 1024; // 10 MB/s + + private readonly IExportScopeResolver _scopeResolver; + private readonly IExportProfileRepository _profileRepository; + private readonly ILogger _logger; + private readonly TimeProvider _timeProvider; + + // In-memory plan store (in production, use database) + private readonly ConcurrentDictionary _plans = new(); + + public ExportPlanner( + IExportScopeResolver scopeResolver, + IExportProfileRepository profileRepository, + ILogger logger, + TimeProvider? timeProvider = null) + { + _scopeResolver = scopeResolver; + _profileRepository = profileRepository; + _logger = logger; + _timeProvider = timeProvider ?? TimeProvider.System; + } + + public async Task CreatePlanAsync( + ExportPlanRequest request, + CancellationToken cancellationToken = default) + { + try + { + // Load profile + var profile = await _profileRepository.GetByIdAsync(request.ProfileId, request.TenantId, cancellationToken); + if (profile is null) + { + return ExportPlanResult.Failed($"Profile not found: {request.ProfileId}"); + } + + if (profile.Status != ExportProfileStatus.Active) + { + return ExportPlanResult.Failed($"Profile is not active: {profile.Status}"); + } + + // Parse scope from profile or use override + var scope = request.ScopeOverride ?? ParseScope(profile.ScopeJson); + var format = request.FormatOverride ?? ParseFormat(profile.FormatJson); + + // Validate scope + var scopeErrors = await _scopeResolver.ValidateAsync(scope, cancellationToken); + var validationErrors = scopeErrors.Where(e => e.Severity >= ExportValidationSeverity.Error).ToList(); + if (validationErrors.Count > 0) + { + return ExportPlanResult.Invalid(validationErrors); + } + + // Resolve scope to items + var scopeResult = await _scopeResolver.ResolveAsync(request.TenantId, scope, cancellationToken); + if (!scopeResult.Success) + { + return ExportPlanResult.Failed(scopeResult.ErrorMessage ?? "Scope resolution failed"); + } + + // Build phases + var phases = BuildPhases(scopeResult, format); + + // Calculate estimates + var estimatedDuration = TimeSpan.FromSeconds(scopeResult.EstimatedTotalSizeBytes / BytesPerSecondEstimate); + var now = _timeProvider.GetUtcNow(); + + // Create plan + var plan = new ExportPlan + { + PlanId = Guid.NewGuid(), + ProfileId = request.ProfileId, + TenantId = request.TenantId, + Status = ExportPlanStatus.Ready, + ResolvedScope = scope, + Format = format, + Phases = phases, + TotalItems = scopeResult.SampledItems, + EstimatedSizeBytes = scopeResult.EstimatedTotalSizeBytes, + EstimatedDuration = estimatedDuration, + CorrelationId = request.CorrelationId, + InitiatedBy = request.InitiatedBy, + CreatedAt = now, + ValidUntil = now.AddMinutes(DefaultPlanValidityMinutes), + Warnings = scopeResult.Warnings, + ValidationErrors = scopeErrors.Where(e => e.Severity == ExportValidationSeverity.Warning).ToList() + }; + + // Store plan (unless dry run) + if (!request.DryRun) + { + _plans[plan.PlanId] = plan; + } + + if (_logger.IsEnabled(LogLevel.Information)) + { + _logger.LogInformation( + "Created export plan {PlanId} for profile {ProfileId}: {ItemCount} items, {EstimatedSize} bytes", + plan.PlanId, plan.ProfileId, plan.TotalItems, plan.EstimatedSizeBytes); + } + + return new ExportPlanResult { Success = true, Plan = plan }; + } + catch (Exception ex) + { + _logger.LogError(ex, "Failed to create export plan for profile {ProfileId}", request.ProfileId); + return ExportPlanResult.Failed($"Failed to create plan: {ex.Message}"); + } + } + + public Task GetPlanAsync(Guid planId, CancellationToken cancellationToken = default) + { + _plans.TryGetValue(planId, out var plan); + return Task.FromResult(plan); + } + + public async Task ValidatePlanAsync(Guid planId, CancellationToken cancellationToken = default) + { + if (!_plans.TryGetValue(planId, out var plan)) + { + return ExportPlanResult.Failed($"Plan not found: {planId}"); + } + + var now = _timeProvider.GetUtcNow(); + + // Check expiration + if (plan.ValidUntil.HasValue && now > plan.ValidUntil) + { + // Update status to expired + var expiredPlan = plan with { Status = ExportPlanStatus.Expired }; + _plans[planId] = expiredPlan; + return ExportPlanResult.Failed("Plan has expired"); + } + + // Check status + if (plan.Status != ExportPlanStatus.Ready) + { + return ExportPlanResult.Failed($"Plan is not ready for execution: {plan.Status}"); + } + + // Re-validate scope + var scopeErrors = await _scopeResolver.ValidateAsync(plan.ResolvedScope, cancellationToken); + if (scopeErrors.Any(e => e.Severity >= ExportValidationSeverity.Error)) + { + return ExportPlanResult.Invalid(scopeErrors); + } + + return new ExportPlanResult { Success = true, Plan = plan }; + } + + public Task CancelPlanAsync(Guid planId, CancellationToken cancellationToken = default) + { + if (!_plans.TryGetValue(planId, out var plan)) + { + return Task.FromResult(false); + } + + if (plan.Status is not (ExportPlanStatus.Ready or ExportPlanStatus.Creating)) + { + return Task.FromResult(false); + } + + var cancelledPlan = plan with { Status = ExportPlanStatus.Cancelled }; + _plans[planId] = cancelledPlan; + + if (_logger.IsEnabled(LogLevel.Information)) + { + _logger.LogInformation("Cancelled export plan {PlanId}", planId); + } + + return Task.FromResult(true); + } + + private static ExportScope ParseScope(string? scopeJson) + { + if (string.IsNullOrWhiteSpace(scopeJson)) + { + return new ExportScope(); + } + + try + { + return JsonSerializer.Deserialize(scopeJson) ?? new ExportScope(); + } + catch + { + return new ExportScope(); + } + } + + private static ExportFormatOptions ParseFormat(string? formatJson) + { + if (string.IsNullOrWhiteSpace(formatJson)) + { + return new ExportFormatOptions(); + } + + try + { + return JsonSerializer.Deserialize(formatJson) ?? new ExportFormatOptions(); + } + catch + { + return new ExportFormatOptions(); + } + } + + private static List BuildPhases(ScopeResolutionResult scopeResult, ExportFormatOptions format) + { + var phases = new List(); + var order = 1; + + // Phase 1: Data Fetch + phases.Add(new ExportPlanPhase + { + Order = order++, + Name = "Fetch Data", + Kind = ExportPhaseKind.DataFetch, + ItemCount = scopeResult.SampledItems, + EstimatedSizeBytes = scopeResult.EstimatedTotalSizeBytes, + EstimatedDuration = TimeSpan.FromMilliseconds(scopeResult.SampledItems * 50), + Parameters = new Dictionary + { + ["parallelism"] = "4" + } + }); + + // Phase 2: Transform (if needed) + if (format.RedactFields.Count > 0 || format.NormalizeTimestamps || format.SortKeys) + { + phases.Add(new ExportPlanPhase + { + Order = order++, + Name = "Transform Data", + Kind = ExportPhaseKind.Transform, + ItemCount = scopeResult.SampledItems, + EstimatedDuration = TimeSpan.FromMilliseconds(scopeResult.SampledItems * 10), + Dependencies = ["Fetch Data"], + Parameters = new Dictionary + { + ["redactFields"] = string.Join(",", format.RedactFields), + ["normalizeTimestamps"] = format.NormalizeTimestamps.ToString(), + ["sortKeys"] = format.SortKeys.ToString() + } + }); + } + + // Phase 3: Write Output + phases.Add(new ExportPlanPhase + { + Order = order++, + Name = "Write Output", + Kind = ExportPhaseKind.WriteOutput, + ItemCount = scopeResult.SampledItems, + EstimatedSizeBytes = scopeResult.EstimatedTotalSizeBytes, + EstimatedDuration = TimeSpan.FromSeconds(scopeResult.EstimatedTotalSizeBytes / (10 * 1024 * 1024.0)), + Dependencies = phases.Count > 1 ? ["Transform Data"] : ["Fetch Data"], + Parameters = new Dictionary + { + ["format"] = format.Format.ToString(), + ["compression"] = format.Compression.ToString() + } + }); + + // Phase 4: Generate Manifest + phases.Add(new ExportPlanPhase + { + Order = order++, + Name = "Generate Manifest", + Kind = ExportPhaseKind.GenerateManifest, + EstimatedDuration = TimeSpan.FromSeconds(1), + Dependencies = ["Write Output"] + }); + + // Phase 5: Sign (if format is mirror or requires attestation) + if (format.Format == ExportFormat.Mirror) + { + phases.Add(new ExportPlanPhase + { + Order = order++, + Name = "Sign Artifacts", + Kind = ExportPhaseKind.Sign, + EstimatedDuration = TimeSpan.FromSeconds(2), + Dependencies = ["Generate Manifest"] + }); + } + + return phases; + } +} + +/// +/// Repository interface for export profiles. +/// +public interface IExportProfileRepository +{ + Task GetByIdAsync(Guid profileId, Guid tenantId, CancellationToken cancellationToken = default); + + Task> GetActiveProfilesAsync(Guid tenantId, CancellationToken cancellationToken = default); + + Task CreateAsync(ExportProfile profile, CancellationToken cancellationToken = default); + + Task UpdateAsync(ExportProfile profile, CancellationToken cancellationToken = default); +} + +/// +/// In-memory implementation of export profile repository for development/testing. +/// +public sealed class InMemoryExportProfileRepository : IExportProfileRepository +{ + private readonly ConcurrentDictionary<(Guid TenantId, Guid ProfileId), ExportProfile> _profiles = new(); + private readonly TimeProvider _timeProvider; + + public InMemoryExportProfileRepository(TimeProvider? timeProvider = null) + { + _timeProvider = timeProvider ?? TimeProvider.System; + } + + public Task GetByIdAsync(Guid profileId, Guid tenantId, CancellationToken cancellationToken = default) + { + _profiles.TryGetValue((tenantId, profileId), out var profile); + return Task.FromResult(profile); + } + + public Task> GetActiveProfilesAsync(Guid tenantId, CancellationToken cancellationToken = default) + { + var profiles = _profiles.Values + .Where(p => p.TenantId == tenantId && p.Status == ExportProfileStatus.Active) + .ToList(); + return Task.FromResult>(profiles); + } + + public Task CreateAsync(ExportProfile profile, CancellationToken cancellationToken = default) + { + var now = _timeProvider.GetUtcNow(); + var newProfile = profile with + { + ProfileId = profile.ProfileId == Guid.Empty ? Guid.NewGuid() : profile.ProfileId, + CreatedAt = now, + UpdatedAt = now + }; + _profiles[(newProfile.TenantId, newProfile.ProfileId)] = newProfile; + return Task.FromResult(newProfile); + } + + public Task UpdateAsync(ExportProfile profile, CancellationToken cancellationToken = default) + { + var updatedProfile = profile with { UpdatedAt = _timeProvider.GetUtcNow() }; + _profiles[(profile.TenantId, profile.ProfileId)] = updatedProfile; + return Task.FromResult(updatedProfile); + } +} diff --git a/src/ExportCenter/StellaOps.ExportCenter/StellaOps.ExportCenter.Core/Planner/ExportScopeModels.cs b/src/ExportCenter/StellaOps.ExportCenter/StellaOps.ExportCenter.Core/Planner/ExportScopeModels.cs new file mode 100644 index 000000000..2021c0b8a --- /dev/null +++ b/src/ExportCenter/StellaOps.ExportCenter/StellaOps.ExportCenter.Core/Planner/ExportScopeModels.cs @@ -0,0 +1,223 @@ +using System.Text.Json.Serialization; + +namespace StellaOps.ExportCenter.Core.Planner; + +/// +/// Defines the scope of items to include in an export. +/// +public sealed record ExportScope +{ + /// + /// Target kind filter (e.g., "sbom", "vex", "attestation"). + /// + [JsonPropertyName("targetKinds")] + public IReadOnlyList TargetKinds { get; init; } = []; + + /// + /// Specific source references to include. + /// + [JsonPropertyName("sourceRefs")] + public IReadOnlyList SourceRefs { get; init; } = []; + + /// + /// Tag-based filter (items must have all specified tags). + /// + [JsonPropertyName("tags")] + public IReadOnlyList Tags { get; init; } = []; + + /// + /// Namespace/project filter. + /// + [JsonPropertyName("namespaces")] + public IReadOnlyList Namespaces { get; init; } = []; + + /// + /// Date range filter (items created/modified within range). + /// + [JsonPropertyName("dateRange")] + public DateRangeFilter? DateRange { get; init; } + + /// + /// Maximum number of items to include. + /// + [JsonPropertyName("maxItems")] + public int? MaxItems { get; init; } + + /// + /// Sampling configuration for large datasets. + /// + [JsonPropertyName("sampling")] + public SamplingConfig? Sampling { get; init; } + + /// + /// Include items from these specific runs. + /// + [JsonPropertyName("runIds")] + public IReadOnlyList RunIds { get; init; } = []; + + /// + /// Exclude items matching these patterns. + /// + [JsonPropertyName("excludePatterns")] + public IReadOnlyList ExcludePatterns { get; init; } = []; +} + +/// +/// Date range filter for export scope. +/// +public sealed record DateRangeFilter +{ + [JsonPropertyName("from")] + public DateTimeOffset? From { get; init; } + + [JsonPropertyName("to")] + public DateTimeOffset? To { get; init; } + + [JsonPropertyName("field")] + public DateRangeField Field { get; init; } = DateRangeField.CreatedAt; +} + +/// +/// Which date field to filter on. +/// +public enum DateRangeField +{ + CreatedAt = 1, + ModifiedAt = 2, + ProcessedAt = 3 +} + +/// +/// Sampling configuration for deterministic subset selection. +/// +public sealed record SamplingConfig +{ + /// + /// Sampling strategy. + /// + [JsonPropertyName("strategy")] + public SamplingStrategy Strategy { get; init; } = SamplingStrategy.None; + + /// + /// Sample size (absolute count or percentage based on strategy). + /// + [JsonPropertyName("size")] + public int Size { get; init; } + + /// + /// Seed for deterministic random sampling. + /// + [JsonPropertyName("seed")] + public int? Seed { get; init; } + + /// + /// Field to use for stratified sampling. + /// + [JsonPropertyName("stratifyBy")] + public string? StratifyBy { get; init; } +} + +/// +/// Sampling strategies for large datasets. +/// +public enum SamplingStrategy +{ + /// + /// No sampling - include all matching items. + /// + None = 0, + + /// + /// Deterministic random sampling using seed. + /// + Random = 1, + + /// + /// Take first N items (ordered by creation date). + /// + First = 2, + + /// + /// Take last N items (ordered by creation date). + /// + Last = 3, + + /// + /// Stratified sampling by a field (e.g., severity, ecosystem). + /// + Stratified = 4, + + /// + /// Systematic sampling (every Nth item). + /// + Systematic = 5 +} + +/// +/// A resolved export item ready for processing. +/// +public sealed record ResolvedExportItem +{ + public required Guid ItemId { get; init; } + + public required string Kind { get; init; } + + public required string SourceRef { get; init; } + + public string? Name { get; init; } + + public string? Namespace { get; init; } + + public IReadOnlyList Tags { get; init; } = []; + + public DateTimeOffset CreatedAt { get; init; } + + public DateTimeOffset? ModifiedAt { get; init; } + + public long EstimatedSizeBytes { get; init; } + + public IReadOnlyDictionary Metadata { get; init; } = new Dictionary(); +} + +/// +/// Result of scope resolution. +/// +public sealed record ScopeResolutionResult +{ + public required bool Success { get; init; } + + public IReadOnlyList Items { get; init; } = []; + + public int TotalMatchingItems { get; init; } + + public int SampledItems { get; init; } + + public long EstimatedTotalSizeBytes { get; init; } + + public IReadOnlyList Warnings { get; init; } = []; + + public string? ErrorMessage { get; init; } + + public SamplingMetadata? SamplingMetadata { get; init; } + + public static ScopeResolutionResult Failed(string errorMessage) + => new() { Success = false, ErrorMessage = errorMessage }; +} + +/// +/// Metadata about sampling applied during scope resolution. +/// +public sealed record SamplingMetadata +{ + public SamplingStrategy Strategy { get; init; } + + public int Seed { get; init; } + + public int OriginalCount { get; init; } + + public int SampledCount { get; init; } + + public string? StratifyField { get; init; } + + public IReadOnlyDictionary? StrataDistribution { get; init; } +} diff --git a/src/ExportCenter/StellaOps.ExportCenter/StellaOps.ExportCenter.Core/Planner/ExportScopeResolver.cs b/src/ExportCenter/StellaOps.ExportCenter/StellaOps.ExportCenter.Core/Planner/ExportScopeResolver.cs new file mode 100644 index 000000000..eb2b601ea --- /dev/null +++ b/src/ExportCenter/StellaOps.ExportCenter/StellaOps.ExportCenter.Core/Planner/ExportScopeResolver.cs @@ -0,0 +1,385 @@ +using System.Text.RegularExpressions; +using Microsoft.Extensions.Logging; + +namespace StellaOps.ExportCenter.Core.Planner; + +/// +/// Default implementation of export scope resolver. +/// +public sealed class ExportScopeResolver : IExportScopeResolver +{ + private static readonly string[] ValidTargetKinds = ["sbom", "vex", "attestation", "scan-report", "policy-result", "evidence", "risk-bundle", "advisory"]; + private const int DefaultMaxItems = 10000; + private const long EstimatedBytesPerItem = 50 * 1024; // 50KB average + + private readonly ILogger _logger; + private readonly TimeProvider _timeProvider; + + public ExportScopeResolver(ILogger logger, TimeProvider? timeProvider = null) + { + _logger = logger; + _timeProvider = timeProvider ?? TimeProvider.System; + } + + public Task ResolveAsync( + Guid tenantId, + ExportScope scope, + CancellationToken cancellationToken = default) + { + cancellationToken.ThrowIfCancellationRequested(); + + // Validate scope first + var validationErrors = ValidateScopeInternal(scope); + if (validationErrors.Count > 0 && validationErrors.Any(e => e.Severity >= ExportValidationSeverity.Error)) + { + return Task.FromResult(ScopeResolutionResult.Failed( + $"Scope validation failed: {validationErrors.First(e => e.Severity >= ExportValidationSeverity.Error).Message}")); + } + + // Generate mock items based on scope (in real impl, this would query the database) + var items = GenerateResolvedItems(tenantId, scope); + + // Apply sampling if configured + var (sampledItems, samplingMetadata) = ApplySampling(items, scope.Sampling); + + // Apply max items limit + var maxItems = scope.MaxItems ?? DefaultMaxItems; + var finalItems = sampledItems.Take(maxItems).ToList(); + + var result = new ScopeResolutionResult + { + Success = true, + Items = finalItems, + TotalMatchingItems = items.Count, + SampledItems = finalItems.Count, + EstimatedTotalSizeBytes = finalItems.Sum(i => i.EstimatedSizeBytes), + Warnings = validationErrors.Where(e => e.Severity == ExportValidationSeverity.Warning).Select(e => e.Message).ToList(), + SamplingMetadata = samplingMetadata + }; + + if (_logger.IsEnabled(LogLevel.Debug)) + { + _logger.LogDebug( + "Resolved scope for tenant {TenantId}: {TotalItems} total, {SampledItems} after sampling", + tenantId, result.TotalMatchingItems, result.SampledItems); + } + + return Task.FromResult(result); + } + + public Task> ValidateAsync( + ExportScope scope, + CancellationToken cancellationToken = default) + { + return Task.FromResult>(ValidateScopeInternal(scope)); + } + + public Task EstimateAsync( + Guid tenantId, + ExportScope scope, + CancellationToken cancellationToken = default) + { + // Calculate estimates based on scope filters + var estimatedCount = 100; // Base estimate + + if (scope.SourceRefs.Count > 0) + { + estimatedCount = scope.SourceRefs.Count; + } + else if (scope.TargetKinds.Count > 0) + { + estimatedCount = scope.TargetKinds.Count * 50; + } + + if (scope.MaxItems.HasValue) + { + estimatedCount = Math.Min(estimatedCount, scope.MaxItems.Value); + } + + if (scope.Sampling?.Strategy != SamplingStrategy.None && scope.Sampling?.Size > 0) + { + estimatedCount = Math.Min(estimatedCount, scope.Sampling.Size); + } + + var countByKind = new Dictionary(); + foreach (var kind in scope.TargetKinds.DefaultIfEmpty("sbom")) + { + countByKind[kind] = estimatedCount / Math.Max(1, scope.TargetKinds.Count); + } + + return Task.FromResult(new ScopeEstimate + { + EstimatedItemCount = estimatedCount, + EstimatedSizeBytes = estimatedCount * EstimatedBytesPerItem, + EstimatedProcessingTime = TimeSpan.FromMilliseconds(estimatedCount * 10), + CountByKind = countByKind + }); + } + + private static List ValidateScopeInternal(ExportScope scope) + { + var errors = new List(); + + // Validate target kinds + foreach (var kind in scope.TargetKinds) + { + if (!ValidTargetKinds.Contains(kind, StringComparer.OrdinalIgnoreCase)) + { + errors.Add(new ExportValidationError + { + Code = "INVALID_TARGET_KIND", + Message = $"Invalid target kind: {kind}. Valid kinds are: {string.Join(", ", ValidTargetKinds)}", + Field = "targetKinds", + Severity = ExportValidationSeverity.Error + }); + } + } + + // Validate date range + if (scope.DateRange is not null) + { + if (scope.DateRange.From.HasValue && scope.DateRange.To.HasValue && + scope.DateRange.From > scope.DateRange.To) + { + errors.Add(new ExportValidationError + { + Code = "INVALID_DATE_RANGE", + Message = "Date range 'from' must be before 'to'", + Field = "dateRange", + Severity = ExportValidationSeverity.Error + }); + } + } + + // Validate sampling + if (scope.Sampling is not null) + { + if (scope.Sampling.Strategy != SamplingStrategy.None && scope.Sampling.Size <= 0) + { + errors.Add(new ExportValidationError + { + Code = "INVALID_SAMPLE_SIZE", + Message = "Sample size must be greater than 0 when sampling is enabled", + Field = "sampling.size", + Severity = ExportValidationSeverity.Error + }); + } + + if (scope.Sampling.Strategy == SamplingStrategy.Stratified && + string.IsNullOrWhiteSpace(scope.Sampling.StratifyBy)) + { + errors.Add(new ExportValidationError + { + Code = "MISSING_STRATIFY_FIELD", + Message = "StratifyBy field is required for stratified sampling", + Field = "sampling.stratifyBy", + Severity = ExportValidationSeverity.Error + }); + } + } + + // Validate exclude patterns + foreach (var pattern in scope.ExcludePatterns) + { + try + { + _ = new Regex(pattern); + } + catch (ArgumentException) + { + errors.Add(new ExportValidationError + { + Code = "INVALID_EXCLUDE_PATTERN", + Message = $"Invalid regex pattern: {pattern}", + Field = "excludePatterns", + Severity = ExportValidationSeverity.Error + }); + } + } + + // Warn about large exports + if (!scope.MaxItems.HasValue && scope.Sampling?.Strategy == SamplingStrategy.None) + { + errors.Add(new ExportValidationError + { + Code = "POTENTIALLY_LARGE_EXPORT", + Message = "No maxItems or sampling configured; export may be large", + Field = null, + Severity = ExportValidationSeverity.Warning + }); + } + + return errors; + } + + private List GenerateResolvedItems(Guid tenantId, ExportScope scope) + { + var items = new List(); + var now = _timeProvider.GetUtcNow(); + + // Generate items based on source refs if specified + if (scope.SourceRefs.Count > 0) + { + foreach (var sourceRef in scope.SourceRefs) + { + var kind = scope.TargetKinds.FirstOrDefault() ?? "sbom"; + items.Add(CreateResolvedItem(sourceRef, kind, now)); + } + } + else + { + // Generate sample items for each target kind + var kindsToGenerate = scope.TargetKinds.Count > 0 ? scope.TargetKinds : ["sbom"]; + var itemsPerKind = 50; + + foreach (var kind in kindsToGenerate) + { + for (var i = 0; i < itemsPerKind; i++) + { + var sourceRef = $"{kind}-{tenantId:N}-{i:D4}"; + items.Add(CreateResolvedItem(sourceRef, kind, now.AddHours(-i))); + } + } + } + + // Apply date range filter + if (scope.DateRange is not null) + { + items = items.Where(item => + { + var dateToCheck = scope.DateRange.Field switch + { + DateRangeField.ModifiedAt => item.ModifiedAt ?? item.CreatedAt, + DateRangeField.ProcessedAt => item.CreatedAt, // Use CreatedAt as proxy + _ => item.CreatedAt + }; + + return (!scope.DateRange.From.HasValue || dateToCheck >= scope.DateRange.From.Value) && + (!scope.DateRange.To.HasValue || dateToCheck <= scope.DateRange.To.Value); + }).ToList(); + } + + // Apply namespace filter + if (scope.Namespaces.Count > 0) + { + items = items.Where(item => + item.Namespace is not null && + scope.Namespaces.Contains(item.Namespace, StringComparer.OrdinalIgnoreCase)).ToList(); + } + + // Apply tag filter + if (scope.Tags.Count > 0) + { + items = items.Where(item => + scope.Tags.All(tag => item.Tags.Contains(tag, StringComparer.OrdinalIgnoreCase))).ToList(); + } + + // Apply exclude patterns + if (scope.ExcludePatterns.Count > 0) + { + var excludeRegexes = scope.ExcludePatterns.Select(p => new Regex(p, RegexOptions.IgnoreCase)).ToList(); + items = items.Where(item => + !excludeRegexes.Any(r => r.IsMatch(item.SourceRef) || (item.Name is not null && r.IsMatch(item.Name)))).ToList(); + } + + return items; + } + + private ResolvedExportItem CreateResolvedItem(string sourceRef, string kind, DateTimeOffset createdAt) + { + return new ResolvedExportItem + { + ItemId = Guid.NewGuid(), + Kind = kind, + SourceRef = sourceRef, + Name = $"{kind}-{sourceRef}", + Namespace = "default", + Tags = kind == "sbom" ? ["container", "linux"] : [kind], + CreatedAt = createdAt, + ModifiedAt = createdAt.AddMinutes(5), + EstimatedSizeBytes = EstimatedBytesPerItem, + Metadata = new Dictionary + { + ["generator"] = "stellaops", + ["version"] = "1.0.0" + } + }; + } + + private static (List Items, SamplingMetadata? Metadata) ApplySampling( + List items, + SamplingConfig? sampling) + { + if (sampling is null || sampling.Strategy == SamplingStrategy.None) + { + return (items, null); + } + + var seed = sampling.Seed ?? Environment.TickCount; + var size = Math.Min(sampling.Size, items.Count); + + List sampled; + Dictionary? strataDistribution = null; + + switch (sampling.Strategy) + { + case SamplingStrategy.Random: + var random = new Random(seed); + sampled = items.OrderBy(_ => random.Next()).Take(size).ToList(); + break; + + case SamplingStrategy.First: + sampled = items.OrderBy(i => i.CreatedAt).Take(size).ToList(); + break; + + case SamplingStrategy.Last: + sampled = items.OrderByDescending(i => i.CreatedAt).Take(size).ToList(); + break; + + case SamplingStrategy.Stratified: + var field = sampling.StratifyBy ?? "kind"; + var grouped = items.GroupBy(i => GetFieldValue(i, field)).ToList(); + var perStratum = size / grouped.Count; + sampled = []; + strataDistribution = new Dictionary(); + + foreach (var group in grouped) + { + var stratumItems = group.Take(perStratum).ToList(); + sampled.AddRange(stratumItems); + strataDistribution[group.Key] = stratumItems.Count; + } + break; + + case SamplingStrategy.Systematic: + var interval = Math.Max(1, items.Count / size); + sampled = items.Where((_, index) => index % interval == 0).Take(size).ToList(); + break; + + default: + return (items, null); + } + + var metadata = new SamplingMetadata + { + Strategy = sampling.Strategy, + Seed = seed, + OriginalCount = items.Count, + SampledCount = sampled.Count, + StratifyField = sampling.StratifyBy, + StrataDistribution = strataDistribution + }; + + return (sampled, metadata); + } + + private static string GetFieldValue(ResolvedExportItem item, string field) + { + return field.ToLowerInvariant() switch + { + "kind" => item.Kind, + "namespace" => item.Namespace ?? "unknown", + _ => item.Metadata.TryGetValue(field, out var value) ? value : "unknown" + }; + } +} diff --git a/src/ExportCenter/StellaOps.ExportCenter/StellaOps.ExportCenter.Core/Planner/IExportPlanner.cs b/src/ExportCenter/StellaOps.ExportCenter/StellaOps.ExportCenter.Core/Planner/IExportPlanner.cs new file mode 100644 index 000000000..efdf68c37 --- /dev/null +++ b/src/ExportCenter/StellaOps.ExportCenter/StellaOps.ExportCenter.Core/Planner/IExportPlanner.cs @@ -0,0 +1,35 @@ +namespace StellaOps.ExportCenter.Core.Planner; + +/// +/// Plans export operations based on profile configuration. +/// +public interface IExportPlanner +{ + /// + /// Creates an export plan from a profile. + /// + Task CreatePlanAsync( + ExportPlanRequest request, + CancellationToken cancellationToken = default); + + /// + /// Gets an existing plan by ID. + /// + Task GetPlanAsync( + Guid planId, + CancellationToken cancellationToken = default); + + /// + /// Validates a plan is still valid for execution. + /// + Task ValidatePlanAsync( + Guid planId, + CancellationToken cancellationToken = default); + + /// + /// Cancels a pending plan. + /// + Task CancelPlanAsync( + Guid planId, + CancellationToken cancellationToken = default); +} diff --git a/src/ExportCenter/StellaOps.ExportCenter/StellaOps.ExportCenter.Core/Planner/IExportScopeResolver.cs b/src/ExportCenter/StellaOps.ExportCenter/StellaOps.ExportCenter.Core/Planner/IExportScopeResolver.cs new file mode 100644 index 000000000..4565226b8 --- /dev/null +++ b/src/ExportCenter/StellaOps.ExportCenter/StellaOps.ExportCenter.Core/Planner/IExportScopeResolver.cs @@ -0,0 +1,44 @@ +namespace StellaOps.ExportCenter.Core.Planner; + +/// +/// Resolves export scope to concrete items. +/// +public interface IExportScopeResolver +{ + /// + /// Resolves a scope definition to concrete items. + /// + Task ResolveAsync( + Guid tenantId, + ExportScope scope, + CancellationToken cancellationToken = default); + + /// + /// Validates a scope definition without resolving. + /// + Task> ValidateAsync( + ExportScope scope, + CancellationToken cancellationToken = default); + + /// + /// Estimates the size and count of items matching a scope. + /// + Task EstimateAsync( + Guid tenantId, + ExportScope scope, + CancellationToken cancellationToken = default); +} + +/// +/// Estimate of items matching a scope. +/// +public sealed record ScopeEstimate +{ + public int EstimatedItemCount { get; init; } + + public long EstimatedSizeBytes { get; init; } + + public TimeSpan EstimatedProcessingTime { get; init; } + + public IReadOnlyDictionary CountByKind { get; init; } = new Dictionary(); +} diff --git a/src/ExportCenter/StellaOps.ExportCenter/StellaOps.ExportCenter.Infrastructure/Db/ExportCenterDataSource.cs b/src/ExportCenter/StellaOps.ExportCenter/StellaOps.ExportCenter.Infrastructure/Db/ExportCenterDataSource.cs new file mode 100644 index 000000000..c9ef9bc87 --- /dev/null +++ b/src/ExportCenter/StellaOps.ExportCenter/StellaOps.ExportCenter.Infrastructure/Db/ExportCenterDataSource.cs @@ -0,0 +1,73 @@ +using Microsoft.Extensions.Logging; +using Npgsql; +using StellaOps.ExportCenter.Core.Configuration; + +namespace StellaOps.ExportCenter.Infrastructure.Db; + +/// +/// Manages Npgsql data source for Export Center with tenant isolation. +/// +public sealed class ExportCenterDataSource : IAsyncDisposable +{ + private readonly NpgsqlDataSource _dataSource; + private readonly ILogger _logger; + + public ExportCenterDataSource( + DatabaseOptions databaseOptions, + ILogger logger) + { + ArgumentNullException.ThrowIfNull(databaseOptions); + ArgumentException.ThrowIfNullOrWhiteSpace(databaseOptions.ConnectionString); + + _logger = logger; + _dataSource = CreateDataSource(databaseOptions.ConnectionString); + } + + public async ValueTask DisposeAsync() + { + await _dataSource.DisposeAsync(); + } + + public Task OpenConnectionAsync(CancellationToken cancellationToken) + => OpenConnectionAsync(null, cancellationToken); + + public async Task OpenConnectionAsync(Guid? tenantId, CancellationToken cancellationToken) + { + var connection = await _dataSource.OpenConnectionAsync(cancellationToken); + await ConfigureSessionAsync(connection, tenantId, cancellationToken); + return connection; + } + + private static NpgsqlDataSource CreateDataSource(string connectionString) + { + var builder = new NpgsqlDataSourceBuilder(connectionString); + builder.EnableDynamicJson(); + return builder.Build(); + } + + private async Task ConfigureSessionAsync(NpgsqlConnection connection, Guid? tenantId, CancellationToken cancellationToken) + { + try + { + await using var command = new NpgsqlCommand("SET TIME ZONE 'UTC';", connection); + await command.ExecuteNonQueryAsync(cancellationToken); + + if (tenantId.HasValue) + { + await using var tenantCommand = new NpgsqlCommand("SELECT set_config('app.current_tenant', @tenant, false);", connection); + tenantCommand.Parameters.AddWithValue("tenant", tenantId.Value.ToString("D")); + await tenantCommand.ExecuteNonQueryAsync(cancellationToken); + } + } + catch (Exception ex) + { + if (_logger.IsEnabled(LogLevel.Error)) + { + _logger.LogError(ex, "Failed to configure Export Center session state."); + } + + await connection.DisposeAsync(); + throw; + } + } +} diff --git a/src/ExportCenter/StellaOps.ExportCenter/StellaOps.ExportCenter.Infrastructure/Db/ExportCenterDbServiceExtensions.cs b/src/ExportCenter/StellaOps.ExportCenter/StellaOps.ExportCenter.Infrastructure/Db/ExportCenterDbServiceExtensions.cs new file mode 100644 index 000000000..85764dbfe --- /dev/null +++ b/src/ExportCenter/StellaOps.ExportCenter/StellaOps.ExportCenter.Infrastructure/Db/ExportCenterDbServiceExtensions.cs @@ -0,0 +1,90 @@ +using Microsoft.Extensions.DependencyInjection; +using Microsoft.Extensions.Hosting; +using Microsoft.Extensions.Logging; +using Microsoft.Extensions.Options; +using StellaOps.ExportCenter.Core.Configuration; + +namespace StellaOps.ExportCenter.Infrastructure.Db; + +/// +/// Extension methods for registering Export Center database services. +/// +public static class ExportCenterDbServiceExtensions +{ + /// + /// Adds Export Center database services to the service collection. + /// + public static IServiceCollection AddExportCenterDatabase( + this IServiceCollection services, + Action? configureOptions = null) + { + if (configureOptions is not null) + { + services.Configure(configureOptions); + } + + services.AddSingleton(sp => + { + var options = sp.GetRequiredService>().Value.Database; + var logger = sp.GetRequiredService>(); + return new ExportCenterDataSource(options, logger); + }); + + services.AddSingleton(); + + return services; + } + + /// + /// Adds the startup migration hosted service. + /// + public static IServiceCollection AddExportCenterMigrations(this IServiceCollection services) + { + services.AddHostedService(); + return services; + } +} + +/// +/// Hosted service that runs database migrations at startup. +/// +internal sealed class ExportCenterMigrationHostedService( + IExportCenterMigrationRunner migrationRunner, + IOptions options, + ILogger logger) : IHostedService +{ + public async Task StartAsync(CancellationToken cancellationToken) + { + if (!options.Value.Database.ApplyMigrationsAtStartup) + { + if (logger.IsEnabled(LogLevel.Information)) + { + logger.LogInformation("Export Center database migrations disabled by configuration."); + } + + return; + } + + try + { + if (logger.IsEnabled(LogLevel.Information)) + { + logger.LogInformation("Applying Export Center database migrations..."); + } + + await migrationRunner.ApplyAsync(cancellationToken); + + if (logger.IsEnabled(LogLevel.Information)) + { + logger.LogInformation("Export Center database migrations completed successfully."); + } + } + catch (Exception ex) + { + logger.LogCritical(ex, "Failed to apply Export Center database migrations."); + throw; + } + } + + public Task StopAsync(CancellationToken cancellationToken) => Task.CompletedTask; +} diff --git a/src/ExportCenter/StellaOps.ExportCenter/StellaOps.ExportCenter.Infrastructure/Db/ExportCenterMigrationRunner.cs b/src/ExportCenter/StellaOps.ExportCenter/StellaOps.ExportCenter.Infrastructure/Db/ExportCenterMigrationRunner.cs new file mode 100644 index 000000000..26bd45198 --- /dev/null +++ b/src/ExportCenter/StellaOps.ExportCenter/StellaOps.ExportCenter.Infrastructure/Db/ExportCenterMigrationRunner.cs @@ -0,0 +1,139 @@ +using Microsoft.Extensions.Logging; +using Npgsql; + +namespace StellaOps.ExportCenter.Infrastructure.Db; + +/// +/// Interface for running Export Center database migrations. +/// +public interface IExportCenterMigrationRunner +{ + Task ApplyAsync(CancellationToken cancellationToken); +} + +/// +/// Applies SQL migrations for Export Center with checksum validation. +/// +internal sealed class ExportCenterMigrationRunner( + ExportCenterDataSource dataSource, + ILogger logger) : IExportCenterMigrationRunner +{ + private const string VersionTableSql = """ + CREATE TABLE IF NOT EXISTS export_center.export_schema_version + ( + version integer PRIMARY KEY, + script_name text NOT NULL, + script_checksum text NOT NULL, + applied_at_utc timestamptz NOT NULL DEFAULT (NOW() AT TIME ZONE 'UTC') + ); + """; + + public async Task ApplyAsync(CancellationToken cancellationToken) + { + var scripts = MigrationLoader.LoadAll(); + + if (scripts.Count == 0) + { + if (logger.IsEnabled(LogLevel.Debug)) + { + logger.LogDebug("No migrations discovered for Export Center."); + } + + return; + } + + await using var connection = await dataSource.OpenConnectionAsync(cancellationToken); + await using var transaction = await connection.BeginTransactionAsync(cancellationToken); + + // Ensure schema exists first + await EnsureSchemaAsync(connection, transaction, cancellationToken); + await EnsureVersionTableAsync(connection, transaction, cancellationToken); + var appliedScripts = await LoadAppliedScriptsAsync(connection, transaction, cancellationToken); + + foreach (var script in scripts) + { + if (appliedScripts.TryGetValue(script.Version, out var existingChecksum)) + { + if (!string.Equals(existingChecksum, script.Sha256, StringComparison.Ordinal)) + { + throw new InvalidOperationException( + $"Checksum mismatch for migration {script.Name}. Expected {existingChecksum}, computed {script.Sha256}."); + } + + continue; + } + + if (logger.IsEnabled(LogLevel.Information)) + { + logger.LogInformation("Applying Export Center migration {Version}: {Name}", script.Version, script.Name); + } + + await ExecuteScriptAsync(connection, transaction, script.Sql, cancellationToken); + await RecordAppliedScriptAsync(connection, transaction, script, cancellationToken); + } + + await transaction.CommitAsync(cancellationToken); + } + + private static async Task EnsureSchemaAsync(NpgsqlConnection connection, NpgsqlTransaction transaction, CancellationToken cancellationToken) + { + const string schemaSql = """ + CREATE SCHEMA IF NOT EXISTS export_center; + CREATE SCHEMA IF NOT EXISTS export_center_app; + """; + + await using var command = new NpgsqlCommand(schemaSql, connection, transaction); + await command.ExecuteNonQueryAsync(cancellationToken); + } + + private static async Task EnsureVersionTableAsync(NpgsqlConnection connection, NpgsqlTransaction transaction, CancellationToken cancellationToken) + { + await using var command = new NpgsqlCommand(VersionTableSql, connection, transaction); + await command.ExecuteNonQueryAsync(cancellationToken); + } + + private static async Task> LoadAppliedScriptsAsync(NpgsqlConnection connection, NpgsqlTransaction transaction, CancellationToken cancellationToken) + { + const string sql = """ + SELECT version, script_checksum + FROM export_center.export_schema_version + ORDER BY version; + """; + + await using var command = new NpgsqlCommand(sql, connection, transaction); + await using var reader = await command.ExecuteReaderAsync(cancellationToken); + var dictionary = new Dictionary(); + + while (await reader.ReadAsync(cancellationToken)) + { + var version = reader.GetInt32(0); + var checksum = reader.GetString(1); + dictionary[version] = checksum; + } + + return dictionary; + } + + private static async Task ExecuteScriptAsync(NpgsqlConnection connection, NpgsqlTransaction transaction, string sql, CancellationToken cancellationToken) + { + await using var command = new NpgsqlCommand(sql, connection, transaction) + { + CommandTimeout = 0 + }; + await command.ExecuteNonQueryAsync(cancellationToken); + } + + private static async Task RecordAppliedScriptAsync(NpgsqlConnection connection, NpgsqlTransaction transaction, MigrationScript script, CancellationToken cancellationToken) + { + const string insertSql = """ + INSERT INTO export_center.export_schema_version(version, script_name, script_checksum) + VALUES (@version, @name, @checksum); + """; + + await using var command = new NpgsqlCommand(insertSql, connection, transaction); + command.Parameters.AddWithValue("version", script.Version); + command.Parameters.AddWithValue("name", script.Name); + command.Parameters.AddWithValue("checksum", script.Sha256); + await command.ExecuteNonQueryAsync(cancellationToken); + } +} diff --git a/src/ExportCenter/StellaOps.ExportCenter/StellaOps.ExportCenter.Infrastructure/Db/MigrationLoader.cs b/src/ExportCenter/StellaOps.ExportCenter/StellaOps.ExportCenter.Infrastructure/Db/MigrationLoader.cs new file mode 100644 index 000000000..3fc9b9816 --- /dev/null +++ b/src/ExportCenter/StellaOps.ExportCenter/StellaOps.ExportCenter.Infrastructure/Db/MigrationLoader.cs @@ -0,0 +1,42 @@ +using System.Reflection; + +namespace StellaOps.ExportCenter.Infrastructure.Db; + +/// +/// Loads SQL migration scripts from embedded resources. +/// +internal static class MigrationLoader +{ + private static readonly Assembly Assembly = typeof(MigrationLoader).Assembly; + + public static IReadOnlyList LoadAll() + { + var scripts = new List(); + + foreach (var resourceName in Assembly.GetManifestResourceNames()) + { + if (!resourceName.Contains(".Db.Migrations.", StringComparison.OrdinalIgnoreCase)) + { + continue; + } + + using var stream = Assembly.GetManifestResourceStream(resourceName); + if (stream is null) + { + continue; + } + + using var reader = new StreamReader(stream); + var sql = reader.ReadToEnd(); + + if (MigrationScript.TryCreate(resourceName, sql, out var script)) + { + scripts.Add(script); + } + } + + return scripts + .OrderBy(script => script.Version) + .ToArray(); + } +} diff --git a/src/ExportCenter/StellaOps.ExportCenter/StellaOps.ExportCenter.Infrastructure/Db/MigrationScript.cs b/src/ExportCenter/StellaOps.ExportCenter/StellaOps.ExportCenter.Infrastructure/Db/MigrationScript.cs new file mode 100644 index 000000000..a20e6b133 --- /dev/null +++ b/src/ExportCenter/StellaOps.ExportCenter/StellaOps.ExportCenter.Infrastructure/Db/MigrationScript.cs @@ -0,0 +1,59 @@ +using System.Diagnostics.CodeAnalysis; +using System.Security.Cryptography; +using System.Text; +using System.Text.RegularExpressions; + +namespace StellaOps.ExportCenter.Infrastructure.Db; + +/// +/// Represents a SQL migration script with version tracking. +/// +internal sealed partial class MigrationScript +{ + private static readonly Regex VersionRegex = GetVersionRegex(); + + private MigrationScript(int version, string name, string sql) + { + Version = version; + Name = name; + Sql = sql; + Sha256 = ComputeSha256(sql); + } + + public int Version { get; } + + public string Name { get; } + + public string Sql { get; } + + public string Sha256 { get; } + + public static bool TryCreate(string resourceName, string sql, [NotNullWhen(true)] out MigrationScript? script) + { + var fileName = resourceName.Split('.').Last(); + var match = VersionRegex.Match(fileName); + + if (!match.Success || !int.TryParse(match.Groups["version"].Value, out var version)) + { + script = null; + return false; + } + + script = new MigrationScript(version, fileName, sql); + return true; + } + + private static string ComputeSha256(string sql) + { + var normalized = NormalizeLineEndings(sql); + var bytes = Encoding.UTF8.GetBytes(normalized); + var hash = SHA256.HashData(bytes); + return Convert.ToHexString(hash).ToLowerInvariant(); + } + + private static string NormalizeLineEndings(string value) + => value.Replace("\r\n", "\n", StringComparison.Ordinal); + + [GeneratedRegex(@"^(?\d{3,})[_-]", RegexOptions.Compiled)] + private static partial Regex GetVersionRegex(); +} diff --git a/src/ExportCenter/StellaOps.ExportCenter/StellaOps.ExportCenter.Infrastructure/Db/Migrations/001_initial_schema.sql b/src/ExportCenter/StellaOps.ExportCenter/StellaOps.ExportCenter.Infrastructure/Db/Migrations/001_initial_schema.sql new file mode 100644 index 000000000..881a706ab --- /dev/null +++ b/src/ExportCenter/StellaOps.ExportCenter/StellaOps.ExportCenter.Infrastructure/Db/Migrations/001_initial_schema.sql @@ -0,0 +1,180 @@ +-- 001_initial_schema.sql +-- Establishes core schema, RLS policies, and tables for Export Center. + +CREATE SCHEMA IF NOT EXISTS export_center; +CREATE SCHEMA IF NOT EXISTS export_center_app; + +-- Tenant isolation function +CREATE OR REPLACE FUNCTION export_center_app.require_current_tenant() +RETURNS uuid +LANGUAGE plpgsql +AS $$ +DECLARE + tenant_text text; +BEGIN + tenant_text := current_setting('app.current_tenant', true); + IF tenant_text IS NULL OR length(tenant_text) = 0 THEN + RAISE EXCEPTION 'app.current_tenant is not set for the current session'; + END IF; + RETURN tenant_text::uuid; +END; +$$; + +-- Export Profiles: defines scope and configuration for exports +CREATE TABLE IF NOT EXISTS export_center.export_profiles +( + profile_id uuid PRIMARY KEY, + tenant_id uuid NOT NULL, + name text NOT NULL CHECK (length(name) BETWEEN 1 AND 256), + description text, + kind smallint NOT NULL CHECK (kind BETWEEN 1 AND 4), + status smallint NOT NULL CHECK (status BETWEEN 1 AND 4), + scope_json jsonb, + format_json jsonb, + signing_json jsonb, + schedule text, + created_at timestamptz NOT NULL DEFAULT (NOW() AT TIME ZONE 'UTC'), + updated_at timestamptz NOT NULL DEFAULT (NOW() AT TIME ZONE 'UTC'), + archived_at timestamptz +); + +CREATE INDEX IF NOT EXISTS ix_export_profiles_tenant_status + ON export_center.export_profiles (tenant_id, status); + +CREATE UNIQUE INDEX IF NOT EXISTS uq_export_profiles_tenant_name + ON export_center.export_profiles (tenant_id, name) WHERE archived_at IS NULL; + +ALTER TABLE export_center.export_profiles + ENABLE ROW LEVEL SECURITY; + +CREATE POLICY IF NOT EXISTS export_profiles_isolation + ON export_center.export_profiles + USING (tenant_id = export_center_app.require_current_tenant()) + WITH CHECK (tenant_id = export_center_app.require_current_tenant()); + +-- Export Runs: tracks individual export executions +CREATE TABLE IF NOT EXISTS export_center.export_runs +( + run_id uuid PRIMARY KEY, + profile_id uuid NOT NULL, + tenant_id uuid NOT NULL, + status smallint NOT NULL CHECK (status BETWEEN 1 AND 6), + trigger smallint NOT NULL CHECK (trigger BETWEEN 1 AND 4), + correlation_id text, + initiated_by text, + total_items integer NOT NULL DEFAULT 0 CHECK (total_items >= 0), + processed_items integer NOT NULL DEFAULT 0 CHECK (processed_items >= 0), + failed_items integer NOT NULL DEFAULT 0 CHECK (failed_items >= 0), + total_size_bytes bigint NOT NULL DEFAULT 0 CHECK (total_size_bytes >= 0), + error_json jsonb, + created_at timestamptz NOT NULL DEFAULT (NOW() AT TIME ZONE 'UTC'), + started_at timestamptz, + completed_at timestamptz, + expires_at timestamptz, + CONSTRAINT fk_runs_profile FOREIGN KEY (profile_id) REFERENCES export_center.export_profiles (profile_id) +); + +CREATE INDEX IF NOT EXISTS ix_export_runs_tenant_status + ON export_center.export_runs (tenant_id, status); + +CREATE INDEX IF NOT EXISTS ix_export_runs_profile_created + ON export_center.export_runs (profile_id, created_at DESC); + +CREATE INDEX IF NOT EXISTS ix_export_runs_correlation + ON export_center.export_runs (correlation_id) WHERE correlation_id IS NOT NULL; + +ALTER TABLE export_center.export_runs + ENABLE ROW LEVEL SECURITY; + +CREATE POLICY IF NOT EXISTS export_runs_isolation + ON export_center.export_runs + USING (tenant_id = export_center_app.require_current_tenant()) + WITH CHECK (tenant_id = export_center_app.require_current_tenant()); + +-- Export Inputs: tracks items included in each export run +CREATE TABLE IF NOT EXISTS export_center.export_inputs +( + input_id uuid PRIMARY KEY, + run_id uuid NOT NULL, + tenant_id uuid NOT NULL, + kind smallint NOT NULL CHECK (kind BETWEEN 1 AND 8), + status smallint NOT NULL CHECK (status BETWEEN 1 AND 5), + source_ref text NOT NULL CHECK (length(source_ref) BETWEEN 1 AND 512), + name text, + content_hash text CHECK (content_hash IS NULL OR content_hash ~ '^[0-9a-f]{64}$'), + size_bytes bigint NOT NULL DEFAULT 0 CHECK (size_bytes >= 0), + metadata_json jsonb, + error_json jsonb, + created_at timestamptz NOT NULL DEFAULT (NOW() AT TIME ZONE 'UTC'), + processed_at timestamptz, + CONSTRAINT fk_inputs_run FOREIGN KEY (run_id) REFERENCES export_center.export_runs (run_id) ON DELETE CASCADE +); + +CREATE INDEX IF NOT EXISTS ix_export_inputs_run_status + ON export_center.export_inputs (run_id, status); + +CREATE INDEX IF NOT EXISTS ix_export_inputs_tenant_kind + ON export_center.export_inputs (tenant_id, kind); + +CREATE INDEX IF NOT EXISTS ix_export_inputs_source_ref + ON export_center.export_inputs (tenant_id, source_ref); + +ALTER TABLE export_center.export_inputs + ENABLE ROW LEVEL SECURITY; + +CREATE POLICY IF NOT EXISTS export_inputs_isolation + ON export_center.export_inputs + USING (tenant_id = export_center_app.require_current_tenant()) + WITH CHECK (tenant_id = export_center_app.require_current_tenant()); + +-- Export Distributions: tracks artifact distribution to targets +CREATE TABLE IF NOT EXISTS export_center.export_distributions +( + distribution_id uuid PRIMARY KEY, + run_id uuid NOT NULL, + tenant_id uuid NOT NULL, + kind smallint NOT NULL CHECK (kind BETWEEN 1 AND 5), + status smallint NOT NULL CHECK (status BETWEEN 1 AND 6), + target text NOT NULL CHECK (length(target) BETWEEN 1 AND 1024), + artifact_path text NOT NULL CHECK (length(artifact_path) BETWEEN 1 AND 1024), + artifact_hash text CHECK (artifact_hash IS NULL OR artifact_hash ~ '^[0-9a-f]{64}$'), + size_bytes bigint NOT NULL DEFAULT 0 CHECK (size_bytes >= 0), + content_type text, + metadata_json jsonb, + error_json jsonb, + attempt_count integer NOT NULL DEFAULT 0 CHECK (attempt_count >= 0), + created_at timestamptz NOT NULL DEFAULT (NOW() AT TIME ZONE 'UTC'), + distributed_at timestamptz, + verified_at timestamptz, + CONSTRAINT fk_distributions_run FOREIGN KEY (run_id) REFERENCES export_center.export_runs (run_id) ON DELETE CASCADE +); + +CREATE INDEX IF NOT EXISTS ix_export_distributions_run_status + ON export_center.export_distributions (run_id, status); + +CREATE INDEX IF NOT EXISTS ix_export_distributions_tenant_kind + ON export_center.export_distributions (tenant_id, kind); + +ALTER TABLE export_center.export_distributions + ENABLE ROW LEVEL SECURITY; + +CREATE POLICY IF NOT EXISTS export_distributions_isolation + ON export_center.export_distributions + USING (tenant_id = export_center_app.require_current_tenant()) + WITH CHECK (tenant_id = export_center_app.require_current_tenant()); + +-- Trigger function to update timestamps +CREATE OR REPLACE FUNCTION export_center_app.update_updated_at() +RETURNS TRIGGER +LANGUAGE plpgsql +AS $$ +BEGIN + NEW.updated_at := NOW() AT TIME ZONE 'UTC'; + RETURN NEW; +END; +$$; + +CREATE TRIGGER trg_export_profiles_updated_at + BEFORE UPDATE ON export_center.export_profiles + FOR EACH ROW + EXECUTE FUNCTION export_center_app.update_updated_at(); diff --git a/src/ExportCenter/StellaOps.ExportCenter/StellaOps.ExportCenter.Infrastructure/StellaOps.ExportCenter.Infrastructure.csproj b/src/ExportCenter/StellaOps.ExportCenter/StellaOps.ExportCenter.Infrastructure/StellaOps.ExportCenter.Infrastructure.csproj index 69409d62f..773654031 100644 --- a/src/ExportCenter/StellaOps.ExportCenter/StellaOps.ExportCenter.Infrastructure/StellaOps.ExportCenter.Infrastructure.csproj +++ b/src/ExportCenter/StellaOps.ExportCenter/StellaOps.ExportCenter.Infrastructure/StellaOps.ExportCenter.Infrastructure.csproj @@ -15,7 +15,14 @@ + + + + + + + diff --git a/src/ExportCenter/StellaOps.ExportCenter/StellaOps.ExportCenter.Tests/Adapters/JsonNormalizerTests.cs b/src/ExportCenter/StellaOps.ExportCenter/StellaOps.ExportCenter.Tests/Adapters/JsonNormalizerTests.cs new file mode 100644 index 000000000..2158bf078 --- /dev/null +++ b/src/ExportCenter/StellaOps.ExportCenter/StellaOps.ExportCenter.Tests/Adapters/JsonNormalizerTests.cs @@ -0,0 +1,249 @@ +using StellaOps.ExportCenter.Core.Adapters; +using Xunit; + +namespace StellaOps.ExportCenter.Tests.Adapters; + +public sealed class JsonNormalizerTests +{ + [Fact] + public void Normalize_SortsKeys() + { + var json = """{"zebra":"z","alpha":"a","beta":"b"}"""; + var normalizer = new JsonNormalizer(new JsonNormalizationOptions { SortKeys = true }); + + var result = normalizer.Normalize(json); + + Assert.True(result.Success); + Assert.StartsWith("""{"alpha":""", result.NormalizedJson); + Assert.Contains(""""beta":""", result.NormalizedJson); + Assert.EndsWith(""""zebra":"z"}""", result.NormalizedJson); + } + + [Fact] + public void Normalize_SortsNestedKeys() + { + var json = """{"outer":{"zebra":"z","alpha":"a"}}"""; + var normalizer = new JsonNormalizer(new JsonNormalizationOptions { SortKeys = true }); + + var result = normalizer.Normalize(json); + + Assert.True(result.Success); + Assert.Contains("""{"alpha":"a","zebra":"z"}""", result.NormalizedJson); + } + + [Fact] + public void Normalize_PreservesArrayOrder() + { + var json = """{"items":["z","a","b"]}"""; + var normalizer = new JsonNormalizer(new JsonNormalizationOptions { SortKeys = true }); + + var result = normalizer.Normalize(json); + + Assert.True(result.Success); + Assert.Contains("""["z","a","b"]""", result.NormalizedJson); + } + + [Fact] + public void Normalize_RedactsFieldByName() + { + var json = """{"name":"public","password":"secret123"}"""; + var normalizer = new JsonNormalizer( + redactionOptions: new JsonRedactionOptions { RedactFields = ["password"] }); + + var result = normalizer.Normalize(json); + + Assert.True(result.Success); + Assert.Contains("[REDACTED]", result.NormalizedJson); + Assert.DoesNotContain("secret123", result.NormalizedJson); + Assert.Equal(1, result.RedactedFieldCount); + } + + [Fact] + public void Normalize_RedactsNestedField() + { + var json = """{"user":{"name":"john","credentials":{"apiKey":"abc123"}}}"""; + var normalizer = new JsonNormalizer( + redactionOptions: new JsonRedactionOptions { RedactFields = ["apiKey"] }); + + var result = normalizer.Normalize(json); + + Assert.True(result.Success); + Assert.DoesNotContain("abc123", result.NormalizedJson); + } + + [Fact] + public void Normalize_RedactsDefaultSensitiveFields() + { + var json = """{"name":"test","secretKey":"hidden","normalField":"visible"}"""; + var normalizer = new JsonNormalizer( + redactionOptions: new JsonRedactionOptions()); + + var result = normalizer.Normalize(json); + + Assert.True(result.Success); + Assert.DoesNotContain("hidden", result.NormalizedJson); + Assert.Contains("visible", result.NormalizedJson); + } + + [Fact] + public void Normalize_RedactsFieldByPath() + { + var json = """{"data":{"sensitive":"value"},"other":"keep"}"""; + var normalizer = new JsonNormalizer( + redactionOptions: new JsonRedactionOptions { RedactFields = ["data.sensitive"] }); + + var result = normalizer.Normalize(json); + + Assert.True(result.Success); + Assert.Contains("[REDACTED]", result.NormalizedJson); + Assert.Contains("keep", result.NormalizedJson); + } + + [Fact] + public void Normalize_NormalizesTimestamps() + { + var json = """{"created":"2024-01-15T10:30:00+02:00"}"""; + var normalizer = new JsonNormalizer( + new JsonNormalizationOptions { NormalizeTimestamps = true }); + + var result = normalizer.Normalize(json); + + Assert.True(result.Success); + // Should be normalized to UTC + Assert.Contains("2024-01-15T08:30:00.000Z", result.NormalizedJson); + } + + [Fact] + public void Normalize_PreservesNonTimestampStrings() + { + var json = """{"name":"2024-not-a-date","value":"hello"}"""; + var normalizer = new JsonNormalizer( + new JsonNormalizationOptions { NormalizeTimestamps = true }); + + var result = normalizer.Normalize(json); + + Assert.True(result.Success); + Assert.Contains("2024-not-a-date", result.NormalizedJson); + Assert.Contains("hello", result.NormalizedJson); + } + + [Fact] + public void Normalize_ComputesDeterministicHash() + { + var json = """{"b":"2","a":"1"}"""; + var normalizer = new JsonNormalizer(new JsonNormalizationOptions { SortKeys = true }); + + var result1 = normalizer.Normalize(json); + var result2 = normalizer.Normalize(json); + + Assert.True(result1.Success); + Assert.True(result2.Success); + Assert.NotNull(result1.Sha256); + Assert.Equal(result1.Sha256, result2.Sha256); + } + + [Fact] + public void Normalize_DifferentInputsSameSorted_SameHash() + { + var json1 = """{"b":"2","a":"1"}"""; + var json2 = """{"a":"1","b":"2"}"""; + var normalizer = new JsonNormalizer(new JsonNormalizationOptions { SortKeys = true }); + + var result1 = normalizer.Normalize(json1); + var result2 = normalizer.Normalize(json2); + + Assert.True(result1.Success); + Assert.True(result2.Success); + Assert.Equal(result1.Sha256, result2.Sha256); + Assert.Equal(result1.NormalizedJson, result2.NormalizedJson); + } + + [Fact] + public void Normalize_InvalidJson_ReturnsFailed() + { + var json = """{"invalid":}"""; + var normalizer = new JsonNormalizer(); + + var result = normalizer.Normalize(json); + + Assert.False(result.Success); + Assert.NotNull(result.ErrorMessage); + } + + [Fact] + public void Normalize_EmptyInput_ReturnsFailed() + { + var normalizer = new JsonNormalizer(); + + var result = normalizer.Normalize(""); + + Assert.False(result.Success); + } + + [Fact] + public void Normalize_NullInput_ReturnsFailed() + { + var normalizer = new JsonNormalizer(); + + var result = normalizer.Normalize(null!); + + Assert.False(result.Success); + } + + [Fact] + public void Normalize_TracksOriginalAndNormalizedSize() + { + var json = """{ "a" : "1" , "b" : "2" }"""; + var normalizer = new JsonNormalizer(new JsonNormalizationOptions { SortKeys = true }); + + var result = normalizer.Normalize(json); + + Assert.True(result.Success); + Assert.True(result.OriginalSizeBytes > 0); + Assert.True(result.NormalizedSizeBytes > 0); + // Normalized should be smaller (no extra whitespace) + Assert.True(result.NormalizedSizeBytes <= result.OriginalSizeBytes); + } + + [Fact] + public void Normalize_WithCustomRedactedValue() + { + var json = """{"password":"secret"}"""; + var normalizer = new JsonNormalizer( + redactionOptions: new JsonRedactionOptions + { + RedactFields = ["password"], + RedactedValue = "***" + }); + + var result = normalizer.Normalize(json); + + Assert.True(result.Success); + Assert.Contains("***", result.NormalizedJson); + } + + [Fact] + public void Normalize_ArrayOfObjects_SortsEachObject() + { + var json = """[{"z":"1","a":"2"},{"z":"3","a":"4"}]"""; + var normalizer = new JsonNormalizer(new JsonNormalizationOptions { SortKeys = true }); + + var result = normalizer.Normalize(json); + + Assert.True(result.Success); + Assert.Equal("""[{"a":"2","z":"1"},{"a":"4","z":"3"}]""", result.NormalizedJson); + } + + [Fact] + public void Normalize_NormalizesLineEndings() + { + var json = "{\r\n\"a\":\"1\"\r\n}"; + var normalizer = new JsonNormalizer( + new JsonNormalizationOptions { NormalizeLineEndings = true }); + + var result = normalizer.Normalize(json); + + Assert.True(result.Success); + Assert.DoesNotContain("\r", result.NormalizedJson); + } +} diff --git a/src/ExportCenter/StellaOps.ExportCenter/StellaOps.ExportCenter.Tests/Db/MigrationLoaderTests.cs b/src/ExportCenter/StellaOps.ExportCenter/StellaOps.ExportCenter.Tests/Db/MigrationLoaderTests.cs new file mode 100644 index 000000000..8b2834bba --- /dev/null +++ b/src/ExportCenter/StellaOps.ExportCenter/StellaOps.ExportCenter.Tests/Db/MigrationLoaderTests.cs @@ -0,0 +1,94 @@ +using System.Reflection; +using Xunit; + +namespace StellaOps.ExportCenter.Tests.Db; + +public sealed class MigrationLoaderTests +{ + [Fact] + public void LoadAll_ReturnsNonEmptyList() + { + var scripts = LoadAllMigrations(); + + Assert.NotNull(scripts); + Assert.NotEmpty(scripts); + } + + [Fact] + public void LoadAll_ScriptsAreOrderedByVersion() + { + var scripts = LoadAllMigrations(); + + var versions = scripts.Select(s => (int)((dynamic)s).Version).ToList(); + var sortedVersions = versions.OrderBy(v => v).ToList(); + + Assert.Equal(sortedVersions, versions); + } + + [Fact] + public void LoadAll_AllScriptsHaveNonEmptySql() + { + var scripts = LoadAllMigrations(); + + foreach (var script in scripts) + { + var sql = (string)((dynamic)script).Sql; + Assert.False(string.IsNullOrWhiteSpace(sql)); + } + } + + [Fact] + public void LoadAll_AllScriptsHaveValidSha256() + { + var scripts = LoadAllMigrations(); + + foreach (var script in scripts) + { + var sha256 = (string)((dynamic)script).Sha256; + Assert.Matches("^[0-9a-f]{64}$", sha256); + } + } + + [Fact] + public void LoadAll_FirstMigrationIsInitialSchema() + { + var scripts = LoadAllMigrations(); + + Assert.NotEmpty(scripts); + var first = scripts.First(); + var name = (string)((dynamic)first).Name; + + Assert.Contains("initial_schema", name, StringComparison.OrdinalIgnoreCase); + } + + [Fact] + public void LoadAll_VersionsAreUnique() + { + var scripts = LoadAllMigrations(); + + var versions = scripts.Select(s => (int)((dynamic)s).Version).ToList(); + var distinctVersions = versions.Distinct().ToList(); + + Assert.Equal(distinctVersions.Count, versions.Count); + } + + // Helper to access internal MigrationLoader via reflection + private static IReadOnlyList LoadAllMigrations() + { + var assembly = typeof(Infrastructure.Db.ExportCenterDataSource).Assembly; + var loaderType = assembly.GetType("StellaOps.ExportCenter.Infrastructure.Db.MigrationLoader"); + + if (loaderType is null) + { + return Array.Empty(); + } + + var method = loaderType.GetMethod("LoadAll", BindingFlags.Public | BindingFlags.Static); + if (method is null) + { + return Array.Empty(); + } + + return (IReadOnlyList)method.Invoke(null, null)!; + } +} diff --git a/src/ExportCenter/StellaOps.ExportCenter/StellaOps.ExportCenter.Tests/Db/MigrationScriptTests.cs b/src/ExportCenter/StellaOps.ExportCenter/StellaOps.ExportCenter.Tests/Db/MigrationScriptTests.cs new file mode 100644 index 000000000..2fc84d84a --- /dev/null +++ b/src/ExportCenter/StellaOps.ExportCenter/StellaOps.ExportCenter.Tests/Db/MigrationScriptTests.cs @@ -0,0 +1,154 @@ +using System.Reflection; +using Xunit; + +namespace StellaOps.ExportCenter.Tests.Db; + +public sealed class MigrationScriptTests +{ + [Fact] + public void TryCreate_ValidResourceName_ReturnsTrueWithScript() + { + var resourceName = "StellaOps.ExportCenter.Infrastructure.Db.Migrations.001_initial_schema.sql"; + var sql = "CREATE TABLE test (id int);"; + + var result = TryCreateMigrationScript(resourceName, sql, out var script); + + Assert.True(result); + Assert.NotNull(script); + Assert.Equal(1, script.Version); + Assert.Equal("001_initial_schema.sql", script.Name); + Assert.Equal(sql, script.Sql); + Assert.NotEmpty(script.Sha256); + } + + [Fact] + public void TryCreate_ThreeDigitVersion_ParsesCorrectly() + { + var resourceName = "Test.Db.Migrations.123_migration.sql"; + var sql = "SELECT 1;"; + + var result = TryCreateMigrationScript(resourceName, sql, out var script); + + Assert.True(result); + Assert.NotNull(script); + Assert.Equal(123, script.Version); + } + + [Fact] + public void TryCreate_FourDigitVersion_ParsesCorrectly() + { + var resourceName = "Test.Db.Migrations.1000_big_migration.sql"; + var sql = "SELECT 1;"; + + var result = TryCreateMigrationScript(resourceName, sql, out var script); + + Assert.True(result); + Assert.NotNull(script); + Assert.Equal(1000, script.Version); + } + + [Fact] + public void TryCreate_InvalidResourceName_ReturnsFalse() + { + var resourceName = "Test.Db.Migrations.invalid.sql"; + var sql = "SELECT 1;"; + + var result = TryCreateMigrationScript(resourceName, sql, out var script); + + Assert.False(result); + Assert.Null(script); + } + + [Fact] + public void TryCreate_NoVersionPrefix_ReturnsFalse() + { + var resourceName = "Test.Db.Migrations.no_version.sql"; + var sql = "SELECT 1;"; + + var result = TryCreateMigrationScript(resourceName, sql, out var script); + + Assert.False(result); + Assert.Null(script); + } + + [Fact] + public void Sha256_IsDeterministic() + { + var resourceName = "Test.Db.Migrations.001_test.sql"; + var sql = "CREATE TABLE test (id int);"; + + _ = TryCreateMigrationScript(resourceName, sql, out var script1); + _ = TryCreateMigrationScript(resourceName, sql, out var script2); + + Assert.NotNull(script1); + Assert.NotNull(script2); + Assert.Equal(script1.Sha256, script2.Sha256); + } + + [Fact] + public void Sha256_NormalizesLineEndings() + { + var resourceName = "Test.Db.Migrations.001_test.sql"; + var sqlUnix = "CREATE TABLE test\n(id int);"; + var sqlWindows = "CREATE TABLE test\r\n(id int);"; + + _ = TryCreateMigrationScript(resourceName, sqlUnix, out var scriptUnix); + _ = TryCreateMigrationScript(resourceName, sqlWindows, out var scriptWindows); + + Assert.NotNull(scriptUnix); + Assert.NotNull(scriptWindows); + Assert.Equal(scriptUnix.Sha256, scriptWindows.Sha256); + } + + [Fact] + public void Sha256_DifferentContentProducesDifferentHash() + { + var resourceName = "Test.Db.Migrations.001_test.sql"; + var sql1 = "CREATE TABLE test1 (id int);"; + var sql2 = "CREATE TABLE test2 (id int);"; + + _ = TryCreateMigrationScript(resourceName, sql1, out var script1); + _ = TryCreateMigrationScript(resourceName, sql2, out var script2); + + Assert.NotNull(script1); + Assert.NotNull(script2); + Assert.NotEqual(script1.Sha256, script2.Sha256); + } + + [Fact] + public void Sha256_IsValidHexFormat() + { + var resourceName = "Test.Db.Migrations.001_test.sql"; + var sql = "SELECT 1;"; + + _ = TryCreateMigrationScript(resourceName, sql, out var script); + + Assert.NotNull(script); + Assert.Matches("^[0-9a-f]{64}$", script.Sha256); + } + + // Helper to access internal MigrationScript via reflection + private static bool TryCreateMigrationScript(string resourceName, string sql, out dynamic? script) + { + var assembly = typeof(Infrastructure.Db.ExportCenterDataSource).Assembly; + var scriptType = assembly.GetType("StellaOps.ExportCenter.Infrastructure.Db.MigrationScript"); + + if (scriptType is null) + { + script = null; + return false; + } + + var method = scriptType.GetMethod("TryCreate", BindingFlags.Public | BindingFlags.Static); + if (method is null) + { + script = null; + return false; + } + + var parameters = new object?[] { resourceName, sql, null }; + var result = (bool)method.Invoke(null, parameters)!; + script = parameters[2]; + return result; + } +} diff --git a/src/ExportCenter/StellaOps.ExportCenter/StellaOps.ExportCenter.Tests/Domain/ExportProfileTests.cs b/src/ExportCenter/StellaOps.ExportCenter/StellaOps.ExportCenter.Tests/Domain/ExportProfileTests.cs new file mode 100644 index 000000000..516ac5459 --- /dev/null +++ b/src/ExportCenter/StellaOps.ExportCenter/StellaOps.ExportCenter.Tests/Domain/ExportProfileTests.cs @@ -0,0 +1,175 @@ +using StellaOps.ExportCenter.Core.Domain; +using Xunit; + +namespace StellaOps.ExportCenter.Tests.Domain; + +public sealed class ExportProfileTests +{ + [Fact] + public void ExportProfile_CanBeCreated() + { + var profile = new ExportProfile + { + ProfileId = Guid.NewGuid(), + TenantId = Guid.NewGuid(), + Name = "Test Profile", + Kind = ExportProfileKind.AdHoc, + Status = ExportProfileStatus.Active, + CreatedAt = DateTimeOffset.UtcNow, + UpdatedAt = DateTimeOffset.UtcNow + }; + + Assert.NotEqual(Guid.Empty, profile.ProfileId); + Assert.Equal("Test Profile", profile.Name); + Assert.Equal(ExportProfileKind.AdHoc, profile.Kind); + Assert.Equal(ExportProfileStatus.Active, profile.Status); + } + + [Fact] + public void ExportProfileKind_HasExpectedValues() + { + Assert.Equal(1, (int)ExportProfileKind.AdHoc); + Assert.Equal(2, (int)ExportProfileKind.Scheduled); + Assert.Equal(3, (int)ExportProfileKind.EventDriven); + Assert.Equal(4, (int)ExportProfileKind.Continuous); + } + + [Fact] + public void ExportProfileStatus_HasExpectedValues() + { + Assert.Equal(1, (int)ExportProfileStatus.Draft); + Assert.Equal(2, (int)ExportProfileStatus.Active); + Assert.Equal(3, (int)ExportProfileStatus.Paused); + Assert.Equal(4, (int)ExportProfileStatus.Archived); + } +} + +public sealed class ExportRunTests +{ + [Fact] + public void ExportRun_CanBeCreated() + { + var run = new ExportRun + { + RunId = Guid.NewGuid(), + ProfileId = Guid.NewGuid(), + TenantId = Guid.NewGuid(), + Status = ExportRunStatus.Running, + Trigger = ExportRunTrigger.Manual, + CreatedAt = DateTimeOffset.UtcNow + }; + + Assert.NotEqual(Guid.Empty, run.RunId); + Assert.Equal(ExportRunStatus.Running, run.Status); + Assert.Equal(ExportRunTrigger.Manual, run.Trigger); + } + + [Fact] + public void ExportRunStatus_HasExpectedValues() + { + Assert.Equal(1, (int)ExportRunStatus.Queued); + Assert.Equal(2, (int)ExportRunStatus.Running); + Assert.Equal(3, (int)ExportRunStatus.Completed); + Assert.Equal(4, (int)ExportRunStatus.PartiallyCompleted); + Assert.Equal(5, (int)ExportRunStatus.Failed); + Assert.Equal(6, (int)ExportRunStatus.Cancelled); + } + + [Fact] + public void ExportRunTrigger_HasExpectedValues() + { + Assert.Equal(1, (int)ExportRunTrigger.Manual); + Assert.Equal(2, (int)ExportRunTrigger.Scheduled); + Assert.Equal(3, (int)ExportRunTrigger.Event); + Assert.Equal(4, (int)ExportRunTrigger.Api); + } +} + +public sealed class ExportInputTests +{ + [Fact] + public void ExportInput_CanBeCreated() + { + var input = new ExportInput + { + InputId = Guid.NewGuid(), + RunId = Guid.NewGuid(), + TenantId = Guid.NewGuid(), + Kind = ExportInputKind.Sbom, + Status = ExportInputStatus.Pending, + SourceRef = "sbom-123", + CreatedAt = DateTimeOffset.UtcNow + }; + + Assert.NotEqual(Guid.Empty, input.InputId); + Assert.Equal(ExportInputKind.Sbom, input.Kind); + Assert.Equal("sbom-123", input.SourceRef); + } + + [Fact] + public void ExportInputKind_HasExpectedValues() + { + Assert.Equal(1, (int)ExportInputKind.Sbom); + Assert.Equal(2, (int)ExportInputKind.Vex); + Assert.Equal(3, (int)ExportInputKind.Attestation); + Assert.Equal(4, (int)ExportInputKind.ScanReport); + Assert.Equal(5, (int)ExportInputKind.PolicyResult); + Assert.Equal(6, (int)ExportInputKind.Evidence); + Assert.Equal(7, (int)ExportInputKind.RiskBundle); + Assert.Equal(8, (int)ExportInputKind.Advisory); + } + + [Fact] + public void ExportInputStatus_HasExpectedValues() + { + Assert.Equal(1, (int)ExportInputStatus.Pending); + Assert.Equal(2, (int)ExportInputStatus.Processing); + Assert.Equal(3, (int)ExportInputStatus.Processed); + Assert.Equal(4, (int)ExportInputStatus.Failed); + Assert.Equal(5, (int)ExportInputStatus.Skipped); + } +} + +public sealed class ExportDistributionTests +{ + [Fact] + public void ExportDistribution_CanBeCreated() + { + var distribution = new ExportDistribution + { + DistributionId = Guid.NewGuid(), + RunId = Guid.NewGuid(), + TenantId = Guid.NewGuid(), + Kind = ExportDistributionKind.FileSystem, + Status = ExportDistributionStatus.Pending, + Target = "/exports/output", + ArtifactPath = "manifest.json", + CreatedAt = DateTimeOffset.UtcNow + }; + + Assert.NotEqual(Guid.Empty, distribution.DistributionId); + Assert.Equal(ExportDistributionKind.FileSystem, distribution.Kind); + Assert.Equal("/exports/output", distribution.Target); + } + + [Fact] + public void ExportDistributionKind_HasExpectedValues() + { + Assert.Equal(1, (int)ExportDistributionKind.FileSystem); + Assert.Equal(2, (int)ExportDistributionKind.AmazonS3); + Assert.Equal(3, (int)ExportDistributionKind.Mirror); + Assert.Equal(4, (int)ExportDistributionKind.OfflineKit); + Assert.Equal(5, (int)ExportDistributionKind.Webhook); + } + + [Fact] + public void ExportDistributionStatus_HasExpectedValues() + { + Assert.Equal(1, (int)ExportDistributionStatus.Pending); + Assert.Equal(2, (int)ExportDistributionStatus.Distributing); + Assert.Equal(3, (int)ExportDistributionStatus.Distributed); + Assert.Equal(4, (int)ExportDistributionStatus.Verified); + Assert.Equal(5, (int)ExportDistributionStatus.Failed); + Assert.Equal(6, (int)ExportDistributionStatus.Cancelled); + } +} diff --git a/src/ExportCenter/StellaOps.ExportCenter/StellaOps.ExportCenter.Tests/Planner/ExportPlannerTests.cs b/src/ExportCenter/StellaOps.ExportCenter/StellaOps.ExportCenter.Tests/Planner/ExportPlannerTests.cs new file mode 100644 index 000000000..1439f0186 --- /dev/null +++ b/src/ExportCenter/StellaOps.ExportCenter/StellaOps.ExportCenter.Tests/Planner/ExportPlannerTests.cs @@ -0,0 +1,269 @@ +using Microsoft.Extensions.Logging.Abstractions; +using StellaOps.ExportCenter.Core.Domain; +using StellaOps.ExportCenter.Core.Planner; +using Xunit; + +namespace StellaOps.ExportCenter.Tests.Planner; + +public sealed class ExportPlannerTests +{ + private readonly ExportPlanner _planner; + private readonly InMemoryExportProfileRepository _profileRepository; + + public ExportPlannerTests() + { + var scopeResolver = new ExportScopeResolver(NullLogger.Instance); + _profileRepository = new InMemoryExportProfileRepository(); + _planner = new ExportPlanner( + scopeResolver, + _profileRepository, + NullLogger.Instance); + } + + [Fact] + public async Task CreatePlanAsync_ValidProfile_ReturnsPlan() + { + var tenantId = Guid.NewGuid(); + var profile = await CreateTestProfile(tenantId); + + var request = new ExportPlanRequest + { + ProfileId = profile.ProfileId, + TenantId = tenantId + }; + + var result = await _planner.CreatePlanAsync(request); + + Assert.True(result.Success); + Assert.NotNull(result.Plan); + Assert.Equal(profile.ProfileId, result.Plan.ProfileId); + Assert.Equal(ExportPlanStatus.Ready, result.Plan.Status); + } + + [Fact] + public async Task CreatePlanAsync_NonExistentProfile_ReturnsError() + { + var request = new ExportPlanRequest + { + ProfileId = Guid.NewGuid(), + TenantId = Guid.NewGuid() + }; + + var result = await _planner.CreatePlanAsync(request); + + Assert.False(result.Success); + Assert.Contains("not found", result.ErrorMessage, StringComparison.OrdinalIgnoreCase); + } + + [Fact] + public async Task CreatePlanAsync_InactiveProfile_ReturnsError() + { + var tenantId = Guid.NewGuid(); + var profile = await _profileRepository.CreateAsync(new ExportProfile + { + ProfileId = Guid.NewGuid(), + TenantId = tenantId, + Name = "Paused Profile", + Kind = ExportProfileKind.AdHoc, + Status = ExportProfileStatus.Paused + }); + + var request = new ExportPlanRequest + { + ProfileId = profile.ProfileId, + TenantId = tenantId + }; + + var result = await _planner.CreatePlanAsync(request); + + Assert.False(result.Success); + Assert.Contains("not active", result.ErrorMessage, StringComparison.OrdinalIgnoreCase); + } + + [Fact] + public async Task CreatePlanAsync_WithScopeOverride_UsesScopeOverride() + { + var tenantId = Guid.NewGuid(); + var profile = await CreateTestProfile(tenantId); + + var request = new ExportPlanRequest + { + ProfileId = profile.ProfileId, + TenantId = tenantId, + ScopeOverride = new ExportScope + { + MaxItems = 5, + TargetKinds = ["vex"] + } + }; + + var result = await _planner.CreatePlanAsync(request); + + Assert.True(result.Success); + Assert.NotNull(result.Plan); + Assert.Equal(5, result.Plan.ResolvedScope.MaxItems); + } + + [Fact] + public async Task CreatePlanAsync_DryRun_DoesNotStorePlan() + { + var tenantId = Guid.NewGuid(); + var profile = await CreateTestProfile(tenantId); + + var request = new ExportPlanRequest + { + ProfileId = profile.ProfileId, + TenantId = tenantId, + DryRun = true + }; + + var result = await _planner.CreatePlanAsync(request); + + Assert.True(result.Success); + Assert.NotNull(result.Plan); + + // Verify plan was not stored + var storedPlan = await _planner.GetPlanAsync(result.Plan.PlanId); + Assert.Null(storedPlan); + } + + [Fact] + public async Task GetPlanAsync_ExistingPlan_ReturnsPlan() + { + var tenantId = Guid.NewGuid(); + var profile = await CreateTestProfile(tenantId); + + var createResult = await _planner.CreatePlanAsync(new ExportPlanRequest + { + ProfileId = profile.ProfileId, + TenantId = tenantId + }); + + var plan = await _planner.GetPlanAsync(createResult.Plan!.PlanId); + + Assert.NotNull(plan); + Assert.Equal(createResult.Plan.PlanId, plan.PlanId); + } + + [Fact] + public async Task GetPlanAsync_NonExistentPlan_ReturnsNull() + { + var plan = await _planner.GetPlanAsync(Guid.NewGuid()); + + Assert.Null(plan); + } + + [Fact] + public async Task ValidatePlanAsync_ValidPlan_ReturnsSuccess() + { + var tenantId = Guid.NewGuid(); + var profile = await CreateTestProfile(tenantId); + + var createResult = await _planner.CreatePlanAsync(new ExportPlanRequest + { + ProfileId = profile.ProfileId, + TenantId = tenantId + }); + + var validateResult = await _planner.ValidatePlanAsync(createResult.Plan!.PlanId); + + Assert.True(validateResult.Success); + } + + [Fact] + public async Task ValidatePlanAsync_NonExistentPlan_ReturnsError() + { + var result = await _planner.ValidatePlanAsync(Guid.NewGuid()); + + Assert.False(result.Success); + Assert.Contains("not found", result.ErrorMessage, StringComparison.OrdinalIgnoreCase); + } + + [Fact] + public async Task CancelPlanAsync_ReadyPlan_CancelsPlan() + { + var tenantId = Guid.NewGuid(); + var profile = await CreateTestProfile(tenantId); + + var createResult = await _planner.CreatePlanAsync(new ExportPlanRequest + { + ProfileId = profile.ProfileId, + TenantId = tenantId + }); + + var cancelled = await _planner.CancelPlanAsync(createResult.Plan!.PlanId); + + Assert.True(cancelled); + + var plan = await _planner.GetPlanAsync(createResult.Plan.PlanId); + Assert.NotNull(plan); + Assert.Equal(ExportPlanStatus.Cancelled, plan.Status); + } + + [Fact] + public async Task CancelPlanAsync_NonExistentPlan_ReturnsFalse() + { + var cancelled = await _planner.CancelPlanAsync(Guid.NewGuid()); + + Assert.False(cancelled); + } + + [Fact] + public async Task CreatePlanAsync_GeneratesPhases() + { + var tenantId = Guid.NewGuid(); + var profile = await CreateTestProfile(tenantId); + + var result = await _planner.CreatePlanAsync(new ExportPlanRequest + { + ProfileId = profile.ProfileId, + TenantId = tenantId + }); + + Assert.True(result.Success); + Assert.NotNull(result.Plan); + Assert.NotEmpty(result.Plan.Phases); + + // Verify phase ordering + var orders = result.Plan.Phases.Select(p => p.Order).ToList(); + Assert.Equal(orders.OrderBy(o => o).ToList(), orders); + + // Verify required phases exist + Assert.Contains(result.Plan.Phases, p => p.Kind == ExportPhaseKind.DataFetch); + Assert.Contains(result.Plan.Phases, p => p.Kind == ExportPhaseKind.WriteOutput); + Assert.Contains(result.Plan.Phases, p => p.Kind == ExportPhaseKind.GenerateManifest); + } + + [Fact] + public async Task CreatePlanAsync_WithCorrelationId_IncludesInPlan() + { + var tenantId = Guid.NewGuid(); + var profile = await CreateTestProfile(tenantId); + var correlationId = "test-correlation-123"; + + var result = await _planner.CreatePlanAsync(new ExportPlanRequest + { + ProfileId = profile.ProfileId, + TenantId = tenantId, + CorrelationId = correlationId, + InitiatedBy = "test-user" + }); + + Assert.True(result.Success); + Assert.Equal(correlationId, result.Plan!.CorrelationId); + Assert.Equal("test-user", result.Plan.InitiatedBy); + } + + private async Task CreateTestProfile(Guid tenantId) + { + return await _profileRepository.CreateAsync(new ExportProfile + { + ProfileId = Guid.NewGuid(), + TenantId = tenantId, + Name = "Test Profile", + Kind = ExportProfileKind.AdHoc, + Status = ExportProfileStatus.Active, + ScopeJson = """{"targetKinds":["sbom"],"maxItems":100}""" + }); + } +} diff --git a/src/ExportCenter/StellaOps.ExportCenter/StellaOps.ExportCenter.Tests/Planner/ExportScopeResolverTests.cs b/src/ExportCenter/StellaOps.ExportCenter/StellaOps.ExportCenter.Tests/Planner/ExportScopeResolverTests.cs new file mode 100644 index 000000000..6eab8f425 --- /dev/null +++ b/src/ExportCenter/StellaOps.ExportCenter/StellaOps.ExportCenter.Tests/Planner/ExportScopeResolverTests.cs @@ -0,0 +1,221 @@ +using Microsoft.Extensions.Logging.Abstractions; +using StellaOps.ExportCenter.Core.Planner; +using Xunit; + +namespace StellaOps.ExportCenter.Tests.Planner; + +public sealed class ExportScopeResolverTests +{ + private readonly ExportScopeResolver _resolver; + + public ExportScopeResolverTests() + { + _resolver = new ExportScopeResolver(NullLogger.Instance); + } + + [Fact] + public async Task ResolveAsync_EmptyScope_ReturnsDefaultItems() + { + var tenantId = Guid.NewGuid(); + var scope = new ExportScope(); + + var result = await _resolver.ResolveAsync(tenantId, scope); + + Assert.True(result.Success); + Assert.NotEmpty(result.Items); + } + + [Fact] + public async Task ResolveAsync_WithSourceRefs_ReturnsMatchingItems() + { + var tenantId = Guid.NewGuid(); + var scope = new ExportScope + { + SourceRefs = ["ref-001", "ref-002", "ref-003"] + }; + + var result = await _resolver.ResolveAsync(tenantId, scope); + + Assert.True(result.Success); + Assert.Equal(3, result.Items.Count); + } + + [Fact] + public async Task ResolveAsync_WithTargetKinds_FiltersCorrectly() + { + var tenantId = Guid.NewGuid(); + var scope = new ExportScope + { + TargetKinds = ["sbom", "vex"] + }; + + var result = await _resolver.ResolveAsync(tenantId, scope); + + Assert.True(result.Success); + Assert.All(result.Items, item => + Assert.Contains(item.Kind, new[] { "sbom", "vex" })); + } + + [Fact] + public async Task ResolveAsync_WithMaxItems_LimitsResults() + { + var tenantId = Guid.NewGuid(); + var scope = new ExportScope + { + MaxItems = 5 + }; + + var result = await _resolver.ResolveAsync(tenantId, scope); + + Assert.True(result.Success); + Assert.True(result.Items.Count <= 5); + } + + [Fact] + public async Task ResolveAsync_WithRandomSampling_AppliesSampling() + { + var tenantId = Guid.NewGuid(); + var scope = new ExportScope + { + Sampling = new SamplingConfig + { + Strategy = SamplingStrategy.Random, + Size = 10, + Seed = 42 + } + }; + + var result = await _resolver.ResolveAsync(tenantId, scope); + + Assert.True(result.Success); + Assert.NotNull(result.SamplingMetadata); + Assert.Equal(SamplingStrategy.Random, result.SamplingMetadata.Strategy); + Assert.Equal(42, result.SamplingMetadata.Seed); + } + + [Fact] + public async Task ResolveAsync_DeterministicSampling_ProducesSameResults() + { + var tenantId = Guid.NewGuid(); + var scope = new ExportScope + { + Sampling = new SamplingConfig + { + Strategy = SamplingStrategy.Random, + Size = 5, + Seed = 123 + } + }; + + var result1 = await _resolver.ResolveAsync(tenantId, scope); + var result2 = await _resolver.ResolveAsync(tenantId, scope); + + Assert.Equal(result1.Items.Count, result2.Items.Count); + // Items should be in same order due to deterministic seeding + for (var i = 0; i < result1.Items.Count; i++) + { + Assert.Equal(result1.Items[i].SourceRef, result2.Items[i].SourceRef); + } + } + + [Fact] + public async Task ValidateAsync_InvalidTargetKind_ReturnsError() + { + var scope = new ExportScope + { + TargetKinds = ["invalid-kind"] + }; + + var errors = await _resolver.ValidateAsync(scope); + + Assert.NotEmpty(errors); + Assert.Contains(errors, e => e.Code == "INVALID_TARGET_KIND"); + } + + [Fact] + public async Task ValidateAsync_InvalidDateRange_ReturnsError() + { + var scope = new ExportScope + { + DateRange = new DateRangeFilter + { + From = DateTimeOffset.UtcNow.AddDays(1), + To = DateTimeOffset.UtcNow.AddDays(-1) + } + }; + + var errors = await _resolver.ValidateAsync(scope); + + Assert.NotEmpty(errors); + Assert.Contains(errors, e => e.Code == "INVALID_DATE_RANGE"); + } + + [Fact] + public async Task ValidateAsync_SamplingWithoutSize_ReturnsError() + { + var scope = new ExportScope + { + Sampling = new SamplingConfig + { + Strategy = SamplingStrategy.Random, + Size = 0 + } + }; + + var errors = await _resolver.ValidateAsync(scope); + + Assert.NotEmpty(errors); + Assert.Contains(errors, e => e.Code == "INVALID_SAMPLE_SIZE"); + } + + [Fact] + public async Task ValidateAsync_StratifiedWithoutField_ReturnsError() + { + var scope = new ExportScope + { + Sampling = new SamplingConfig + { + Strategy = SamplingStrategy.Stratified, + Size = 10, + StratifyBy = null + } + }; + + var errors = await _resolver.ValidateAsync(scope); + + Assert.NotEmpty(errors); + Assert.Contains(errors, e => e.Code == "MISSING_STRATIFY_FIELD"); + } + + [Fact] + public async Task ValidateAsync_NoLimits_ReturnsWarning() + { + var scope = new ExportScope + { + TargetKinds = ["sbom"] + }; + + var errors = await _resolver.ValidateAsync(scope); + + Assert.Contains(errors, e => + e.Code == "POTENTIALLY_LARGE_EXPORT" && + e.Severity == ExportValidationSeverity.Warning); + } + + [Fact] + public async Task EstimateAsync_ReturnsReasonableEstimates() + { + var tenantId = Guid.NewGuid(); + var scope = new ExportScope + { + SourceRefs = ["ref-001", "ref-002", "ref-003"], + TargetKinds = ["sbom"] + }; + + var estimate = await _resolver.EstimateAsync(tenantId, scope); + + Assert.True(estimate.EstimatedItemCount > 0); + Assert.True(estimate.EstimatedSizeBytes > 0); + Assert.True(estimate.EstimatedProcessingTime > TimeSpan.Zero); + } +} diff --git a/src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node/Internal/NodePnpDataLoader.cs b/src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node/Internal/NodePnpDataLoader.cs index 145a56a3e..3760a1a81 100644 --- a/src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node/Internal/NodePnpDataLoader.cs +++ b/src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node/Internal/NodePnpDataLoader.cs @@ -179,7 +179,8 @@ internal static class NodePnpDataLoader // If location points to a zip, try to read package/package.json inside the archive if (packageLocation.Contains(".zip", StringComparison.OrdinalIgnoreCase)) { - var zipPath = Path.Combine(rootPath, packageLocation[..packageLocation.IndexOf(".zip", StringComparison.OrdinalIgnoreCase) + 4]); + var zipIndex = packageLocation.IndexOf(".zip", StringComparison.OrdinalIgnoreCase); + var zipPath = Path.Combine(rootPath, packageLocation[..(zipIndex + 4)]); if (File.Exists(zipPath)) { try diff --git a/src/Scanner/__Tests/StellaOps.Scanner.Analyzers.OS.Tests/Rpm/RpmDatabaseReaderTests.cs b/src/Scanner/__Tests/StellaOps.Scanner.Analyzers.OS.Tests/Rpm/RpmDatabaseReaderTests.cs index 8e2621a54..54c32ca3e 100644 --- a/src/Scanner/__Tests/StellaOps.Scanner.Analyzers.OS.Tests/Rpm/RpmDatabaseReaderTests.cs +++ b/src/Scanner/__Tests/StellaOps.Scanner.Analyzers.OS.Tests/Rpm/RpmDatabaseReaderTests.cs @@ -70,10 +70,8 @@ public sealed class RpmDatabaseReaderTests // Magic BinaryPrimitives.WriteUInt32BigEndian(header.AsSpan(0), 0x8eade8ab); - // Version/reserved bytes (version=1) - header[4] = 1; - header[5] = 0; - BinaryPrimitives.WriteUInt16BigEndian(header.AsSpan(6), 0); + // Reserved/version bytes set to zero for parser compatibility + BinaryPrimitives.WriteUInt32BigEndian(header.AsSpan(4), 0); // Index count (3) and store size BinaryPrimitives.WriteInt32BigEndian(header.AsSpan(8), 3); @@ -117,4 +115,3 @@ public sealed class RpmDatabaseReaderTests return result; } } - diff --git a/src/Web/StellaOps.Web/src/app/app.config.ts b/src/Web/StellaOps.Web/src/app/app.config.ts index 0792a0f30..57986c8ca 100644 --- a/src/Web/StellaOps.Web/src/app/app.config.ts +++ b/src/Web/StellaOps.Web/src/app/app.config.ts @@ -1,8 +1,8 @@ -import { HTTP_INTERCEPTORS, provideHttpClient, withInterceptorsFromDi } from '@angular/common/http'; +import { HTTP_INTERCEPTORS, provideHttpClient, withInterceptorsFromDi } from '@angular/common/http'; import { APP_INITIALIZER, ApplicationConfig } from '@angular/core'; -import { provideRouter } from '@angular/router'; - -import { routes } from './app.routes'; +import { provideRouter } from '@angular/router'; + +import { routes } from './app.routes'; import { CONCELIER_EXPORTER_API_BASE_URL } from './core/api/concelier-exporter.client'; import { AUTHORITY_CONSOLE_API, @@ -29,47 +29,48 @@ import { AuthSessionStore } from './core/auth/auth-session.store'; import { OperatorMetadataInterceptor } from './core/orchestrator/operator-metadata.interceptor'; import { MockNotifyApiService } from './testing/mock-notify-api.service'; import { seedAuthSession, type StubAuthSession } from './testing'; +import { CVSS_API_BASE_URL } from './core/api/cvss.client'; -export const appConfig: ApplicationConfig = { - providers: [ - provideRouter(routes), - provideHttpClient(withInterceptorsFromDi()), - { - provide: APP_INITIALIZER, - multi: true, - useFactory: (configService: AppConfigService) => () => - configService.load(), - deps: [AppConfigService], - }, - { - provide: HTTP_INTERCEPTORS, - useClass: AuthHttpInterceptor, - multi: true, - }, - { - provide: HTTP_INTERCEPTORS, - useClass: OperatorMetadataInterceptor, - multi: true, - }, - { - provide: CONCELIER_EXPORTER_API_BASE_URL, - useValue: '/api/v1/concelier/exporters/trivy-db', - }, - { - provide: AUTHORITY_CONSOLE_API_BASE_URL, - deps: [AppConfigService], - useFactory: (config: AppConfigService) => { - const authorityBase = config.config.apiBaseUrls.authority; - try { - return new URL('/console', authorityBase).toString(); - } catch { - const normalized = authorityBase.endsWith('/') - ? authorityBase.slice(0, -1) - : authorityBase; - return `${normalized}/console`; - } - }, - }, +export const appConfig: ApplicationConfig = { + providers: [ + provideRouter(routes), + provideHttpClient(withInterceptorsFromDi()), + { + provide: APP_INITIALIZER, + multi: true, + useFactory: (configService: AppConfigService) => () => + configService.load(), + deps: [AppConfigService], + }, + { + provide: HTTP_INTERCEPTORS, + useClass: AuthHttpInterceptor, + multi: true, + }, + { + provide: HTTP_INTERCEPTORS, + useClass: OperatorMetadataInterceptor, + multi: true, + }, + { + provide: CONCELIER_EXPORTER_API_BASE_URL, + useValue: '/api/v1/concelier/exporters/trivy-db', + }, + { + provide: AUTHORITY_CONSOLE_API_BASE_URL, + deps: [AppConfigService], + useFactory: (config: AppConfigService) => { + const authorityBase = config.config.apiBaseUrls.authority; + try { + return new URL('/console', authorityBase).toString(); + } catch { + const normalized = authorityBase.endsWith('/') + ? authorityBase.slice(0, -1) + : authorityBase; + return `${normalized}/console`; + } + }, + }, AuthorityConsoleApiHttpClient, { provide: AUTHORITY_CONSOLE_API, @@ -105,6 +106,19 @@ export const appConfig: ApplicationConfig = { } }, }, + { + provide: CVSS_API_BASE_URL, + deps: [AppConfigService], + useFactory: (config: AppConfigService) => { + const policyBase = config.config.apiBaseUrls.policy; + try { + return new URL('/api/cvss', policyBase).toString(); + } catch { + const normalized = policyBase.endsWith('/') ? policyBase.slice(0, -1) : policyBase; + return `${normalized}/api/cvss`; + } + }, + }, RiskHttpClient, MockRiskApi, { @@ -166,10 +180,10 @@ export const appConfig: ApplicationConfig = { provide: NOTIFY_TENANT_ID, useValue: 'tenant-dev', }, - MockNotifyApiService, - { - provide: NOTIFY_API, - useExisting: MockNotifyApiService, - }, - ], -}; + MockNotifyApiService, + { + provide: NOTIFY_API, + useExisting: MockNotifyApiService, + }, + ], +}; diff --git a/src/Web/StellaOps.Web/src/app/core/api/cvss.client.spec.ts b/src/Web/StellaOps.Web/src/app/core/api/cvss.client.spec.ts new file mode 100644 index 000000000..7f4254b9f --- /dev/null +++ b/src/Web/StellaOps.Web/src/app/core/api/cvss.client.spec.ts @@ -0,0 +1,87 @@ +import { HttpClientTestingModule, HttpTestingController } from '@angular/common/http/testing'; +import { TestBed } from '@angular/core/testing'; + +import { AuthSessionStore } from '../auth/auth-session.store'; +import { CvssClient, CVSS_API_BASE_URL } from './cvss.client'; +import { CvssReceipt, CvssReceiptDto } from './cvss.models'; + +class FakeAuthSessionStore { + getActiveTenantId(): string | null { + return 'tenant-123'; + } +} + +describe('CvssClient', () => { + let httpMock: HttpTestingController; + let client: CvssClient; + + beforeEach(() => { + TestBed.configureTestingModule({ + imports: [HttpClientTestingModule], + providers: [ + CvssClient, + { provide: CVSS_API_BASE_URL, useValue: '/api/cvss' }, + { provide: AuthSessionStore, useClass: FakeAuthSessionStore }, + ], + }); + + httpMock = TestBed.inject(HttpTestingController); + client = TestBed.inject(CvssClient); + }); + + afterEach(() => { + httpMock.verify(); + }); + + it('adds tenant headers and maps receipt response', () => { + const dto: CvssReceiptDto = { + receiptId: 'rcpt-1', + vulnerabilityId: 'CVE-2025-0001', + createdAt: '2025-12-07T12:00:00Z', + createdBy: 'tester@example.com', + vectorString: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H', + severity: 'Critical', + scores: { + baseScore: 9.0, + threatScore: 9.0, + environmentalScore: 9.1, + fullScore: 9.1, + effectiveScore: 9.1, + effectiveScoreType: 'Environmental', + }, + policyRef: { policyId: 'default', version: '1.0.0', hash: 'sha256:abc' }, + evidence: [ + { + uri: 'cas://evidence/1', + description: 'Vendor advisory evidence', + source: 'vendor', + collectedAt: '2025-12-07T10:00:00Z', + }, + ], + history: [ + { + historyId: 'hist-1', + reason: 'Initial scoring', + actor: 'tester@example.com', + createdAt: '2025-12-07T12:00:00Z', + }, + ], + }; + + let receipt: CvssReceipt | undefined; + + client.getReceipt(dto.receiptId).subscribe((result) => (receipt = result)); + + const req = httpMock.expectOne('/api/cvss/receipts/rcpt-1'); + expect(req.request.method).toBe('GET'); + expect(req.request.headers.get('X-Stella-Tenant')).toBe('tenant-123'); + expect(req.request.headers.has('X-Stella-Trace-Id')).toBeTrue(); + req.flush(dto); + + expect(receipt?.score.overall).toBe(9.1); + expect(receipt?.score.effectiveType).toBe('Environmental'); + expect(receipt?.policy.policyId).toBe('default'); + expect(receipt?.evidence[0].uri).toBe('cas://evidence/1'); + expect(receipt?.history[0].reason).toBe('Initial scoring'); + }); +}); diff --git a/src/Web/StellaOps.Web/src/app/core/api/cvss.client.ts b/src/Web/StellaOps.Web/src/app/core/api/cvss.client.ts index b48a3699b..5dc4e8bcc 100644 --- a/src/Web/StellaOps.Web/src/app/core/api/cvss.client.ts +++ b/src/Web/StellaOps.Web/src/app/core/api/cvss.client.ts @@ -1,58 +1,117 @@ -import { Injectable } from '@angular/core'; -import { Observable, of } from 'rxjs'; +import { HttpClient, HttpHeaders } from '@angular/common/http'; +import { Inject, Injectable, InjectionToken } from '@angular/core'; +import { Observable, map } from 'rxjs'; -import { CvssReceipt } from './cvss.models'; +import { AuthSessionStore } from '../auth/auth-session.store'; +import { + CvssEvidenceDto, + CvssHistoryDto, + CvssHistoryEntry, + CvssReceipt, + CvssReceiptDto, + CvssScoresDto, + CvssEvidenceItem, +} from './cvss.models'; +import { generateTraceId } from './trace.util'; + +export const CVSS_API_BASE_URL = new InjectionToken('CVSS_API_BASE_URL'); -/** - * Placeholder CVSS client until Policy Gateway endpoint is wired. - * Emits deterministic sample data for UI development and tests. - */ @Injectable({ providedIn: 'root', }) export class CvssClient { + constructor( + private readonly http: HttpClient, + private readonly authSession: AuthSessionStore, + @Inject(CVSS_API_BASE_URL) private readonly baseUrl: string + ) {} + getReceipt(receiptId: string): Observable { - const sample: CvssReceipt = { - receiptId, - vulnerabilityId: 'CVE-2025-1234', - createdAt: '2025-12-05T12:00:00Z', - createdBy: 'analyst@example.org', + const tenant = this.resolveTenant(); + const headers = this.buildHeaders(tenant); + const url = `${this.baseUrl}/receipts/${encodeURIComponent(receiptId)}`; + + return this.http + .get(url, { headers }) + .pipe(map((dto) => this.toView(dto))); + } + + private toView(dto: CvssReceiptDto): CvssReceipt { + const scores: CvssScoresDto = dto.scores ?? ({} as CvssScoresDto); + const policyRef = dto.policyRef; + + const overall = + scores.effectiveScore ?? + scores.fullScore ?? + scores.environmentalScore ?? + scores.threatScore ?? + scores.baseScore; + + return { + receiptId: dto.receiptId, + vulnerabilityId: dto.vulnerabilityId, + createdAt: dto.createdAt, + createdBy: dto.createdBy, score: { - base: 7.6, - threat: 7.6, - environmental: 8.1, - overall: 8.1, - vector: - 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H', - severity: 'High', + base: scores.baseScore, + threat: scores.threatScore ?? scores.baseScore, + environmental: scores.environmentalScore ?? scores.threatScore ?? scores.baseScore, + full: scores.fullScore ?? scores.environmentalScore ?? scores.threatScore ?? scores.baseScore, + overall: overall ?? 0, + effectiveType: scores.effectiveScoreType, + vector: dto.vectorString, + severity: dto.severity, }, policy: { - policyId: 'policy-bundle-main', - policyHash: 'sha256:deadbeefcafec0ffee1234', - version: '1.0.0', + policyId: policyRef?.policyId ?? 'unknown', + policyHash: policyRef?.hash, + version: policyRef?.version, + activatedAt: policyRef?.activatedAt, }, - evidence: [ - { - id: 'ev-001', - description: 'Upstream advisory references vulnerable TLS parser', - source: 'NVD', - }, - { - id: 'ev-002', - description: 'Vendor bulletin confirms threat active in region', - source: 'Vendor', - }, - ], - history: [ - { - version: 1, - changedAt: '2025-12-05T12:00:00Z', - changedBy: 'analyst@example.org', - reason: 'Initial scoring', - }, - ], + evidence: (dto.evidence ?? []).map((item, idx) => this.mapEvidence(item, idx)), + history: (dto.history ?? []).map((entry, idx) => this.mapHistory(entry, idx, dto)), }; + } - return of(sample); + private mapEvidence(item: CvssEvidenceDto, index: number): CvssEvidenceItem { + const id = item.uri ?? item.dsseRef ?? `evidence-${index + 1}`; + return { + id, + description: item.description ?? item.type ?? item.uri ?? 'Evidence item', + source: item.source, + uri: item.uri, + dsseRef: item.dsseRef, + collectedAt: item.collectedAt, + retentionClass: item.retentionClass, + isAuthoritative: item.isAuthoritative, + verifiedAt: item.verifiedAt, + isRedacted: item.isRedacted, + }; + } + + private mapHistory(entry: CvssHistoryDto, index: number, dto: CvssReceiptDto): CvssHistoryEntry { + return { + id: entry.historyId ?? `history-${index + 1}`, + changedAt: entry.createdAt ?? dto.modifiedAt ?? dto.createdAt, + changedBy: entry.actor ?? dto.modifiedBy ?? dto.createdBy, + reason: entry.reason, + field: entry.field, + previousValue: entry.previousValue, + newValue: entry.newValue, + referenceUri: entry.referenceUri, + }; + } + + private buildHeaders(tenantId: string): HttpHeaders { + let headers = new HttpHeaders({ 'X-Stella-Tenant': tenantId, 'X-Stella-Trace-Id': generateTraceId() }); + return headers; + } + + private resolveTenant(): string { + const tenant = this.authSession.getActiveTenantId(); + if (!tenant) { + throw new Error('CvssClient requires an active tenant identifier.'); + } + return tenant; } } diff --git a/src/Web/StellaOps.Web/src/app/core/api/cvss.models.ts b/src/Web/StellaOps.Web/src/app/core/api/cvss.models.ts index cb6461828..d974fb895 100644 --- a/src/Web/StellaOps.Web/src/app/core/api/cvss.models.ts +++ b/src/Web/StellaOps.Web/src/app/core/api/cvss.models.ts @@ -1,29 +1,112 @@ +export interface CvssScoresDto { + readonly baseScore: number; + readonly threatScore?: number; + readonly environmentalScore?: number; + readonly fullScore?: number; + readonly effectiveScore: number; + readonly effectiveScoreType: string; +} + +export interface CvssPolicyRefDto { + readonly policyId: string; + readonly version: string; + readonly hash: string; + readonly activatedAt?: string; +} + +export interface CvssEvidenceDto { + readonly type?: string; + readonly uri?: string; + readonly description?: string; + readonly source?: string; + readonly collectedAt?: string; + readonly dsseRef?: string; + readonly isAuthoritative?: boolean; + readonly isRedacted?: boolean; + readonly verifiedAt?: string; + readonly retentionClass?: string; +} + +export interface CvssHistoryDto { + readonly historyId: string; + readonly field?: string; + readonly previousValue?: string; + readonly newValue?: string; + readonly reason?: string; + readonly referenceUri?: string; + readonly actor?: string; + readonly createdAt?: string; +} + +export interface CvssReceiptDto { + readonly receiptId: string; + readonly schemaVersion?: string; + readonly format?: string; + readonly vulnerabilityId: string; + readonly tenantId?: string; + readonly createdAt: string; + readonly createdBy: string; + readonly modifiedAt?: string; + readonly modifiedBy?: string; + readonly cvssVersion?: string; + readonly baseMetrics?: unknown; + readonly threatMetrics?: unknown; + readonly environmentalMetrics?: unknown; + readonly supplementalMetrics?: unknown; + readonly scores: CvssScoresDto; + readonly vectorString: string; + readonly severity: string; + readonly policyRef: CvssPolicyRefDto; + readonly evidence?: readonly CvssEvidenceDto[]; + readonly exportHash?: string; + readonly attestationRefs?: readonly string[]; + readonly inputHash?: string; + readonly history?: readonly CvssHistoryDto[]; + readonly amendsReceiptId?: string; + readonly supersedesReceiptId?: string; + readonly isActive?: boolean; +} + export interface CvssScoreBreakdown { - readonly base: number; - readonly threat: number; - readonly environmental: number; + readonly base?: number; + readonly threat?: number; + readonly environmental?: number; + readonly full?: number; readonly overall: number; + readonly effectiveType?: string; readonly vector: string; readonly severity: string; } export interface CvssPolicySummary { readonly policyId: string; - readonly policyHash: string; + readonly policyHash?: string; readonly version?: string; + readonly activatedAt?: string; } export interface CvssEvidenceItem { readonly id: string; - readonly description: string; - readonly source: string; + readonly description?: string; + readonly source?: string; + readonly uri?: string; + readonly dsseRef?: string; + readonly collectedAt?: string; + readonly retentionClass?: string; + readonly isAuthoritative?: boolean; + readonly verifiedAt?: string; + readonly isRedacted?: boolean; } export interface CvssHistoryEntry { - readonly version: number; + readonly id: string; readonly changedAt: string; readonly changedBy: string; readonly reason?: string; + readonly field?: string; + readonly previousValue?: string; + readonly newValue?: string; + readonly referenceUri?: string; } export interface CvssReceipt { diff --git a/src/Web/StellaOps.Web/src/app/features/cvss/cvss-receipt.component.html b/src/Web/StellaOps.Web/src/app/features/cvss/cvss-receipt.component.html index 4aa6af9f8..4678f7fe3 100644 --- a/src/Web/StellaOps.Web/src/app/features/cvss/cvss-receipt.component.html +++ b/src/Web/StellaOps.Web/src/app/features/cvss/cvss-receipt.component.html @@ -7,14 +7,17 @@ #{{ receipt.receiptId }}

- Created {{ receipt.createdAt }} by {{ receipt.createdBy }} · Policy + Created {{ receipt.createdAt }} by {{ receipt.createdBy }} - Policy {{ receipt.policy.policyId }} ({{ receipt.policy.version ?? 'v1' }})

{{ receipt.score.overall | number : '1.1-1' }} - {{ receipt.score.severity }} + + {{ receipt.score.severity }} + ({{ receipt.score.effectiveType ?? 'Effective' }}) +

{{ receipt.score.vector }}

@@ -47,19 +50,19 @@

Base Metrics

-

Base score: {{ receipt.score.base | number : '1.1-1' }}

+

Base score: {{ receipt.score.base ?? 'n/a' }}

Vector: {{ receipt.score.vector }}

Threat Metrics

-

Threat-adjusted score: {{ receipt.score.threat | number : '1.1-1' }}

+

Threat-adjusted score: {{ receipt.score.threat ?? 'n/a' }}

Vector: {{ receipt.score.vector }}

Environmental Metrics

-

Environmental score: {{ receipt.score.environmental | number : '1.1-1' }}

+

Environmental score: {{ receipt.score.environmental ?? 'n/a' }}

Vector: {{ receipt.score.vector }}

@@ -69,7 +72,8 @@

  • {{ item.id }}

    {{ item.description }}

    -

    Source: {{ item.source }}

    +

    Source: {{ item.source ?? 'unknown' }}

    +

    {{ item.uri }}

    • @@ -78,16 +82,17 @@

    Policy

    Policy ID: {{ receipt.policy.policyId }}

    Version: {{ receipt.policy.version ?? 'v1' }}

    -

    Hash: {{ receipt.policy.policyHash }}

    +

    Hash: {{ receipt.policy.policyHash ?? 'n/a' }}

    History

      -
    • +

    • - v{{ entry.version }} · {{ entry.changedAt }} by {{ entry.changedBy }} - — {{ entry.reason }} + {{ entry.changedAt }} by {{ entry.changedBy }} + - {{ entry.reason }} + ({{ entry.field }} -> {{ entry.newValue ?? 'updated' }})

    diff --git a/src/Web/StellaOps.Web/src/app/features/cvss/cvss-receipt.component.spec.ts b/src/Web/StellaOps.Web/src/app/features/cvss/cvss-receipt.component.spec.ts index 28824f55a..eae7b8699 100644 --- a/src/Web/StellaOps.Web/src/app/features/cvss/cvss-receipt.component.spec.ts +++ b/src/Web/StellaOps.Web/src/app/features/cvss/cvss-receipt.component.spec.ts @@ -18,7 +18,9 @@ describe(CvssReceiptComponent.name, () => { base: 7.6, threat: 7.6, environmental: 8.1, + full: 8.1, overall: 8.1, + effectiveType: 'Environmental', vector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H', severity: 'High', }, @@ -28,7 +30,14 @@ describe(CvssReceiptComponent.name, () => { version: '1.0.0', }, evidence: [], - history: [], + history: [ + { + id: 'history-1', + changedAt: '2025-12-05T12:00:00Z', + changedBy: 'analyst@example.org', + reason: 'Initial scoring', + }, + ], }; beforeEach(async () => { diff --git a/src/Web/StellaOps.Web/src/app/features/cvss/cvss-receipt.component.ts b/src/Web/StellaOps.Web/src/app/features/cvss/cvss-receipt.component.ts index 84082117a..0ca73b71a 100644 --- a/src/Web/StellaOps.Web/src/app/features/cvss/cvss-receipt.component.ts +++ b/src/Web/StellaOps.Web/src/app/features/cvss/cvss-receipt.component.ts @@ -29,7 +29,7 @@ export class CvssReceiptComponent implements OnInit { ); } - trackById(_: number, item: { id?: string }): string | undefined { - return item.id; + trackById(index: number, item: { id?: string }): string { + return item.id ?? `${index}`; } }