feat: Add UI benchmark driver and scenarios for graph interactions

- Introduced `ui_bench_driver.mjs` to read scenarios and fixture manifest, generating a deterministic run plan.
- Created `ui_bench_plan.md` outlining the purpose, scope, and next steps for the benchmark.
- Added `ui_bench_scenarios.json` containing various scenarios for graph UI interactions.
- Implemented tests for CLI commands, ensuring bundle verification and telemetry defaults.
- Developed schemas for orchestrator components, including replay manifests and event envelopes.
- Added mock API for risk management, including listing and statistics functionalities.
- Implemented models for risk profiles and query options to support the new API.

src/Cli/__Tests/StellaOps.Cli.Tests/Commands/ScannerDownloadVerifyTests.cs

@@ -0,0 +1,60 @@
+using System;
+using System.IO;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.Extensions.Logging.Abstractions;
+using StellaOps.Cli.Commands;
+using Xunit;
+
+namespace StellaOps.Cli.Tests.Commands;
+
+public sealed class ScannerDownloadVerifyTests
+{
+    [Fact]
+    public async Task VerifyBundleAsync_Succeeds_WhenHashMatches()
+    {
+        var tmp = Path.Combine(Path.GetTempPath(), $"stellaops-cli-{Guid.NewGuid():N}");
+        Directory.CreateDirectory(tmp);
+        var bundle = Path.Combine(tmp, "scanner.tgz");
+        await File.WriteAllTextAsync(bundle, "hello");
+
+        var hash = Convert.ToHexString(System.Security.Cryptography.SHA256.HashData(File.ReadAllBytes(bundle))).ToLowerInvariant();
+        await File.WriteAllTextAsync(bundle + ".sha256", hash);
+
+        await CommandHandlersTestShim.VerifyBundlePublicAsync(bundle, NullLogger.Instance, CancellationToken.None);
+    }
+
+    [Fact]
+    public async Task VerifyBundleAsync_Throws_WhenHashMismatch()
+    {
+        var tmp = Path.Combine(Path.GetTempPath(), $"stellaops-cli-{Guid.NewGuid():N}");
+        Directory.CreateDirectory(tmp);
+        var bundle = Path.Combine(tmp, "scanner.tgz");
+        await File.WriteAllTextAsync(bundle, "hello");
+        await File.WriteAllTextAsync(bundle + ".sha256", "deadbeef");
+
+        await Assert.ThrowsAsync<InvalidOperationException>(() =>
+            CommandHandlersTestShim.VerifyBundlePublicAsync(bundle, NullLogger.Instance, CancellationToken.None));
+    }
+
+    [Fact]
+    public async Task VerifyBundleAsync_Throws_WhenChecksumMissing()
+    {
+        var tmp = Path.Combine(Path.GetTempPath(), $"stellaops-cli-{Guid.NewGuid():N}");
+        Directory.CreateDirectory(tmp);
+        var bundle = Path.Combine(tmp, "scanner.tgz");
+        await File.WriteAllTextAsync(bundle, "hello");
+
+        await Assert.ThrowsAsync<InvalidOperationException>(() =>
+            CommandHandlersTestShim.VerifyBundlePublicAsync(bundle, NullLogger.Instance, CancellationToken.None));
+    }
+}
+
+internal static class CommandHandlersTestShim
+{
+    public static Task VerifyBundlePublicAsync(string path, ILogger logger, CancellationToken token)
+        => typeof(CommandHandlers)
+            .GetMethod(\"VerifyBundleAsync\", System.Reflection.BindingFlags.NonPublic | System.Reflection.BindingFlags.Static)!
+            .Invoke(null, new object[] { path, logger, token }) as Task
+            ?? Task.CompletedTask;
+}

src/Cli/__Tests/StellaOps.Cli.Tests/Configuration/TelemetryDefaultsTests.cs

@@ -0,0 +1,35 @@
+using System.IO;
+using System.Threading.Tasks;
+using StellaOps.Cli.Configuration;
+using Xunit;
+
+namespace StellaOps.Cli.Tests.Configuration;
+
+public sealed class TelemetryDefaultsTests
+{
+    [Fact]
+    public async Task NewStore_DefaultsTelemetryToOff()
+    {
+        var tempDir = Path.Combine(Path.GetTempPath(), $"stellaops-cli-telemetry-{Path.GetRandomFileName()}");
+        Directory.CreateDirectory(tempDir);
+
+        var manager = new CliProfileManager(tempDir);
+        var store = await manager.GetStoreAsync();
+
+        Assert.False(store.TelemetryEnabled);
+    }
+
+    [Fact]
+    public async Task SetTelemetryEnabled_PersistsValue()
+    {
+        var tempDir = Path.Combine(Path.GetTempPath(), $"stellaops-cli-telemetry-{Path.GetRandomFileName()}");
+        Directory.CreateDirectory(tempDir);
+
+        var manager = new CliProfileManager(tempDir);
+
+        await manager.SetTelemetryEnabledAsync(true);
+        var store = await manager.GetStoreAsync();
+
+        Assert.True(store.TelemetryEnabled);
+    }
+}

src/Cli/__Tests/StellaOps.Cli.Tests/Contracts/CliSpecTests.cs

@@ -0,0 +1,41 @@
+using System.IO;
+using System.Linq;
+using System.Threading.Tasks;
+using Xunit;
+
+namespace StellaOps.Cli.Tests.Contracts;
+
+public sealed class CliSpecTests
+{
+    private static readonly string SpecPath = Path.Combine("docs", "modules", "cli", "contracts", "cli-spec-v1.yaml");
+
+    [Fact]
+    public async Task Spec_Exists_And_Has_PrivacyDefaults()
+    {
+        Assert.True(File.Exists(SpecPath), $"Spec file missing: {SpecPath}");
+
+        var text = await File.ReadAllTextAsync(SpecPath);
+
+        Assert.Contains("defaultEnabled: false", text);
+        Assert.Contains("checksumRequired: true", text);
+        Assert.Contains("cosignVerifyDefault: true", text);
+    }
+
+    [Fact]
+    public async Task Spec_Has_Pinned_Buildx_Digest()
+    {
+        var text = await File.ReadAllLinesAsync(SpecPath);
+        var digestLine = text.FirstOrDefault(l => l.TrimStart().StartsWith("imageDigest:"));
+
+        Assert.False(string.IsNullOrWhiteSpace(digestLine));
+        Assert.DoesNotContain("TO-BE-PINNED", digestLine);
+    }
+
+    [Fact]
+    public async Task Spec_Declares_Install_ExitCodes()
+    {
+        var text = await File.ReadAllTextAsync(SpecPath);
+        Assert.Contains("21: checksum-file-missing", text);
+        Assert.Contains("22: checksum-mismatch", text);
+    }
+}