Add SBOM, symbols, traces, and VEX files for CVE-2022-21661 SQLi case

- Created CycloneDX and SPDX SBOM files for both reachable and unreachable images. - Added symbols.json detailing function entry and sink points in the WordPress code. - Included runtime traces for function calls in both reachable and unreachable scenarios. - Developed OpenVEX files indicating vulnerability status and justification for both cases. - Updated README for evaluator harness to guide integration with scanner output.
2025-11-08 20:53:45 +02:00
parent 515975edc5
commit 536f6249a6
837 changed files with 37279 additions and 14675 deletions
--- a/src/Concelier/StellaOps.Concelier.WebService/Diagnostics/IngestionMetrics.cs
+++ b/src/Concelier/StellaOps.Concelier.WebService/Diagnostics/IngestionMetrics.cs
@@ -1,22 +1,36 @@
-using System.Diagnostics.Metrics;
-
-namespace StellaOps.Concelier.WebService.Diagnostics;
-
-internal static class IngestionMetrics
-{
-    internal const string MeterName = "StellaOps.Concelier.WebService.Ingestion";
-
-    private static readonly Meter Meter = new(MeterName);
-
-    internal static readonly Counter<long> WriteCounter = Meter.CreateCounter<long>(
-        "ingestion_write_total",
-        description: "Counts raw advisory ingestion attempts, segmented by tenant, source, and result.");
-
-    internal static readonly Counter<long> ViolationCounter = Meter.CreateCounter<long>(
-        "aoc_violation_total",
-        description: "Counts Aggregation-Only Contract violations detected during ingestion.");
-
-    internal static readonly Counter<long> VerificationCounter = Meter.CreateCounter<long>(
-        "verify_runs_total",
-        description: "Counts AOC verification runs initiated via the API.");
-}
+using System.Collections.Generic;
+using System.Diagnostics.Metrics;
+
+namespace StellaOps.Concelier.WebService.Diagnostics;
+
+internal static class IngestionMetrics
+{
+    internal const string MeterName = "StellaOps.Concelier.WebService.Ingestion";
+
+    private static readonly Meter Meter = new(MeterName);
+
+    internal static readonly Counter<long> IngestionWriteCounter = Meter.CreateCounter<long>(
+        "ingestion_write_total",
+        unit: "count",
+        description: "Number of advisory ingestion attempts processed by the web service.");
+
+    internal static readonly Counter<long> VerificationCounter = Meter.CreateCounter<long>(
+        "verify_runs_total",
+        unit: "count",
+        description: "Number of AOC verification requests processed by the web service.");
+
+    internal static KeyValuePair<string, object?>[] BuildWriteTags(string tenant, string source, string result) =>
+        new[]
+        {
+            new KeyValuePair<string, object?>("tenant", tenant),
+            new KeyValuePair<string, object?>("source", source),
+            new KeyValuePair<string, object?>("result", result),
+        };
+
+    internal static KeyValuePair<string, object?>[] BuildVerifyTags(string tenant, string result) =>
+        new[]
+        {
+            new KeyValuePair<string, object?>("tenant", tenant),
+            new KeyValuePair<string, object?>("result", result),
+        };
+}
--- a/src/Concelier/StellaOps.Concelier.WebService/Extensions/AdvisoryRawRequestMapper.cs
+++ b/src/Concelier/StellaOps.Concelier.WebService/Extensions/AdvisoryRawRequestMapper.cs
@@ -1,9 +1,10 @@
-using System.Collections.Immutable;
-using System.Text.Json;
-using StellaOps.Concelier.RawModels;
-using StellaOps.Concelier.WebService.Contracts;
-
-namespace StellaOps.Concelier.WebService.Extensions;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Text.Json;
+using StellaOps.Concelier.RawModels;
+using StellaOps.Concelier.WebService.Contracts;
+
+namespace StellaOps.Concelier.WebService.Extensions;

 internal static class AdvisoryRawRequestMapper
 {
@@ -14,13 +15,13 @@ internal static class AdvisoryRawRequestMapper
        ArgumentNullException.ThrowIfNull(timeProvider);

        var sourceRequest = request.Source ?? throw new ArgumentException("source section is required.", nameof(request));
-        var upstreamRequest = request.Upstream ?? throw new ArgumentException("upstream section is required.", nameof(request));
-        var contentRequest = request.Content ?? throw new ArgumentException("content section is required.", nameof(request));
-        var identifiersRequest = request.Identifiers ?? throw new ArgumentException("identifiers section is required.", nameof(request));
-
-        var source = new RawSourceMetadata(
-            sourceRequest.Vendor,
-            sourceRequest.Connector,
+        var upstreamRequest = request.Upstream ?? throw new ArgumentException("upstream section is required.", nameof(request));
+        var contentRequest = request.Content ?? throw new ArgumentException("content section is required.", nameof(request));
+        var identifiersRequest = request.Identifiers ?? throw new ArgumentException("identifiers section is required.", nameof(request));
+
+        var source = new RawSourceMetadata(
+            sourceRequest.Vendor,
+            sourceRequest.Connector,
            sourceRequest.Version,
            string.IsNullOrWhiteSpace(sourceRequest.Stream) ? null : sourceRequest.Stream);

@@ -33,22 +34,21 @@ internal static class AdvisoryRawRequestMapper
            string.IsNullOrWhiteSpace(signatureRequest.Certificate) ? null : signatureRequest.Certificate,
            string.IsNullOrWhiteSpace(signatureRequest.Digest) ? null : signatureRequest.Digest);

-        var retrievedAt = upstreamRequest.RetrievedAt ?? timeProvider.GetUtcNow();
-
-        var upstream = new RawUpstreamMetadata(
-            upstreamRequest.UpstreamId,
-            string.IsNullOrWhiteSpace(upstreamRequest.DocumentVersion) ? null : upstreamRequest.DocumentVersion,
-            retrievedAt,
-            upstreamRequest.ContentHash,
-            signature,
-            NormalizeDictionary(upstreamRequest.Provenance));
-
-        var rawContent = NormalizeRawContent(contentRequest.Raw);
-        var content = new RawContent(
-            contentRequest.Format,
-            string.IsNullOrWhiteSpace(contentRequest.SpecVersion) ? null : contentRequest.SpecVersion,
-            rawContent,
-            string.IsNullOrWhiteSpace(contentRequest.Encoding) ? null : contentRequest.Encoding);
+        var retrievedAt = upstreamRequest.RetrievedAt ?? timeProvider.GetUtcNow();
+        var upstream = new RawUpstreamMetadata(
+            upstreamRequest.UpstreamId,
+            string.IsNullOrWhiteSpace(upstreamRequest.DocumentVersion) ? null : upstreamRequest.DocumentVersion,
+            retrievedAt,
+            upstreamRequest.ContentHash,
+            signature,
+            NormalizeDictionary(upstreamRequest.Provenance));
+
+        var rawContent = NormalizeRawContent(contentRequest.Raw);
+        var content = new RawContent(
+            contentRequest.Format,
+            string.IsNullOrWhiteSpace(contentRequest.SpecVersion) ? null : contentRequest.SpecVersion,
+            rawContent,
+            string.IsNullOrWhiteSpace(contentRequest.Encoding) ? null : contentRequest.Encoding);

        var aliases = NormalizeStrings(identifiersRequest.Aliases);
        if (aliases.IsDefault)
@@ -56,11 +56,15 @@ internal static class AdvisoryRawRequestMapper
            aliases = ImmutableArray<string>.Empty;
        }

-        var identifiers = new RawIdentifiers(
-            aliases,
-            identifiersRequest.Primary);
-
-        var linksetRequest = request.Linkset;
+        var identifiers = new RawIdentifiers(
+            aliases,
+            identifiersRequest.Primary);
+        var advisoryKey = NormalizeAdvisoryKey(
+            identifiersRequest.Primary,
+            aliases,
+            upstreamRequest.UpstreamId);
+
+        var linksetRequest = request.Linkset;
        var linkset = new RawLinkset
        {
            Aliases = NormalizeStrings(linksetRequest?.Aliases),
@@ -71,6 +75,8 @@ internal static class AdvisoryRawRequestMapper
            Notes = NormalizeDictionary(linksetRequest?.Notes)
        };

+        var links = BuildLinks(advisoryKey, aliases, upstreamRequest.UpstreamId);
+
        return new AdvisoryRawDocument(
            tenant.Trim().ToLowerInvariant(),
            source,
@@ -78,8 +84,8 @@ internal static class AdvisoryRawRequestMapper
            content,
            identifiers,
            linkset,
-            AdvisoryKey: string.Empty,
-            Links: ImmutableArray<RawLink>.Empty);
+            AdvisoryKey: advisoryKey,
+            Links: links);
    }

    internal static ImmutableArray<string> NormalizeStrings(IEnumerable<string>? values)
@@ -124,11 +130,11 @@ internal static class AdvisoryRawRequestMapper
        return builder.ToImmutable();
    }

-    private static ImmutableArray<RawReference> NormalizeReferences(IEnumerable<AdvisoryLinksetReferenceRequest>? references)
-    {
-        if (references is null)
-        {
-            return ImmutableArray<RawReference>.Empty;
+    private static ImmutableArray<RawReference> NormalizeReferences(IEnumerable<AdvisoryLinksetReferenceRequest>? references)
+    {
+        if (references is null)
+        {
+            return ImmutableArray<RawReference>.Empty;
        }

        var builder = ImmutableArray.CreateBuilder<RawReference>();
@@ -150,10 +156,59 @@ internal static class AdvisoryRawRequestMapper
        return builder.Count == 0 ? ImmutableArray<RawReference>.Empty : builder.ToImmutable();
    }

-    private static JsonElement NormalizeRawContent(JsonElement element)
-    {
-        var json = element.ValueKind == JsonValueKind.Undefined ? "{}" : element.GetRawText();
-        using var document = JsonDocument.Parse(string.IsNullOrWhiteSpace(json) ? "{}" : json);
-        return document.RootElement.Clone();
-    }
-}
+    private static JsonElement NormalizeRawContent(JsonElement element)
+    {
+        var json = element.ValueKind == JsonValueKind.Undefined ? "{}" : element.GetRawText();
+        using var document = JsonDocument.Parse(string.IsNullOrWhiteSpace(json) ? "{}" : json);
+        return document.RootElement.Clone();
+    }
+
+    private static string NormalizeAdvisoryKey(string? primaryId, ImmutableArray<string> aliases, string upstreamId)
+    {
+        if (!string.IsNullOrWhiteSpace(primaryId))
+        {
+            return primaryId.Trim();
+        }
+
+        foreach (var alias in aliases)
+        {
+            if (!string.IsNullOrWhiteSpace(alias))
+            {
+                return alias.Trim();
+            }
+        }
+
+        return string.IsNullOrWhiteSpace(upstreamId) ? string.Empty : upstreamId.Trim();
+    }
+
+    private static ImmutableArray<RawLink> BuildLinks(string advisoryKey, ImmutableArray<string> aliases, string upstreamId)
+    {
+        var builder = ImmutableArray.CreateBuilder<RawLink>();
+        var seen = new HashSet<string>(StringComparer.OrdinalIgnoreCase);
+
+        void AddLink(string scheme, string? value)
+        {
+            if (string.IsNullOrWhiteSpace(value))
+            {
+                return;
+            }
+
+            var normalized = value.Trim();
+            var key = $"{scheme}:{normalized}";
+            if (seen.Add(key))
+            {
+                builder.Add(new RawLink(scheme, normalized));
+            }
+        }
+
+        AddLink("PRIMARY", advisoryKey);
+        foreach (var alias in aliases)
+        {
+            AddLink("ALIAS", alias);
+        }
+
+        AddLink("UPSTREAM", upstreamId);
+
+        return builder.Count == 0 ? ImmutableArray<RawLink>.Empty : builder.ToImmutable();
+    }
+}
--- a/src/Concelier/StellaOps.Concelier.WebService/Extensions/TelemetryExtensions.cs
+++ b/src/Concelier/StellaOps.Concelier.WebService/Extensions/TelemetryExtensions.cs
@@ -10,10 +10,11 @@ using OpenTelemetry.Trace;
 using Serilog;
 using Serilog.Core;
 using Serilog.Events;
-using StellaOps.Concelier.Core.Jobs;
-using StellaOps.Concelier.Connector.Common.Telemetry;
-using StellaOps.Concelier.WebService.Diagnostics;
-using StellaOps.Concelier.WebService.Options;
+using StellaOps.Concelier.Core.Jobs;
+using StellaOps.Concelier.Connector.Common.Telemetry;
+using StellaOps.Concelier.WebService.Diagnostics;
+using StellaOps.Concelier.WebService.Options;
+using StellaOps.Ingestion.Telemetry;

 namespace StellaOps.Concelier.WebService.Extensions;

@@ -65,13 +66,14 @@ public static class TelemetryExtensions

        if (telemetry.EnableTracing)
        {
-            openTelemetry.WithTracing(tracing =>
-            {
-                tracing
-                    .AddSource(JobDiagnostics.ActivitySourceName)
-                    .AddSource(SourceDiagnostics.ActivitySourceName)
-                    .AddAspNetCoreInstrumentation()
-                    .AddHttpClientInstrumentation();
+            openTelemetry.WithTracing(tracing =>
+            {
+                tracing
+                    .AddSource(JobDiagnostics.ActivitySourceName)
+                    .AddSource(SourceDiagnostics.ActivitySourceName)
+                    .AddSource(IngestionTelemetry.ActivitySourceName)
+                    .AddAspNetCoreInstrumentation()
+                    .AddHttpClientInstrumentation();

                ConfigureExporters(telemetry, tracing);
            });
@@ -84,7 +86,7 @@ public static class TelemetryExtensions
                metrics
                    .AddMeter(JobDiagnostics.MeterName)
                    .AddMeter(SourceDiagnostics.MeterName)
-                    .AddMeter(IngestionMetrics.MeterName)
+                    .AddMeter(IngestionTelemetry.MeterName)
                    .AddMeter("StellaOps.Concelier.Connector.CertBund")
                    .AddMeter("StellaOps.Concelier.Connector.Nvd")
                    .AddMeter("StellaOps.Concelier.Connector.Vndr.Chromium")
--- a/src/Concelier/StellaOps.Concelier.WebService/Options/ConcelierOptions.cs
+++ b/src/Concelier/StellaOps.Concelier.WebService/Options/ConcelierOptions.cs
@@ -1,6 +1,7 @@
 using System;
 using System.Collections.Generic;
 using System.Text.Json.Serialization;
+using StellaOps.Configuration;

 namespace StellaOps.Concelier.WebService.Options;

@@ -19,6 +20,8 @@ public sealed class ConcelierOptions
    public FeaturesOptions Features { get; set; } = new();

    public AdvisoryChunkOptions AdvisoryChunks { get; set; } = new();
+
+    public StellaOpsCryptoOptions Crypto { get; } = new();

    public sealed class StorageOptions
    {
--- a/src/Concelier/StellaOps.Concelier.WebService/Program.cs
+++ b/src/Concelier/StellaOps.Concelier.WebService/Program.cs
@@ -82,6 +82,8 @@ builder.Services.AddOptions<ConcelierOptions>()
    })
    .ValidateOnStart();

+builder.Services.AddStellaOpsCrypto(concelierOptions.Crypto);
+
 builder.ConfigureConcelierTelemetry(concelierOptions);

 builder.Services.TryAddSingleton<TimeProvider>(_ => TimeProvider.System);
@@ -387,6 +389,14 @@ var advisoryIngestEndpoint = app.MapPost("/ingest/advisory", async (
        return authorizationError;
    }

+    using var ingestScope = logger.BeginScope(new Dictionary<string, object?>(StringComparer.Ordinal)
+    {
+        ["tenant"] = tenant,
+        ["source.vendor"] = ingestRequest.Source.Vendor,
+        ["upstream.upstreamId"] = ingestRequest.Upstream.UpstreamId,
+        ["contentHash"] = ingestRequest.Upstream.ContentHash ?? "(null)"
+    });
+
    AdvisoryRawDocument document;
    try
    {
@@ -423,12 +433,12 @@ var advisoryIngestEndpoint = app.MapPost("/ingest/advisory", async (
            context.Response.Headers.Location = $"/advisories/raw/{Uri.EscapeDataString(result.Record.Id)}";
        }

-        IngestionMetrics.WriteCounter.Add(1, new[]
-        {
-            new KeyValuePair<string, object?>("tenant", tenant),
-            new KeyValuePair<string, object?>("source", result.Record.Document.Source.Vendor),
-            new KeyValuePair<string, object?>("result", result.Inserted ? "inserted" : "duplicate")
-        });
+        IngestionMetrics.IngestionWriteCounter.Add(
+            1,
+            IngestionMetrics.BuildWriteTags(
+                tenant,
+                ingestRequest.Source.Vendor ?? "(unknown)",
+                result.Inserted ? "inserted" : "duplicate"));

        return JsonResult(response, statusCode);
    }
@@ -443,12 +453,12 @@ var advisoryIngestEndpoint = app.MapPost("/ingest/advisory", async (
            string.IsNullOrWhiteSpace(document.Upstream.ContentHash) ? "(empty)" : document.Upstream.ContentHash,
            string.Join(',', guardException.Violations.Select(static violation => violation.ErrorCode)));

-        IngestionMetrics.ViolationCounter.Add(1, new[]
-        {
-            new KeyValuePair<string, object?>("tenant", tenant),
-            new KeyValuePair<string, object?>("source", document.Source.Vendor),
-            new KeyValuePair<string, object?>("code", guardException.PrimaryErrorCode)
-        });
+        IngestionMetrics.IngestionWriteCounter.Add(
+            1,
+            IngestionMetrics.BuildWriteTags(
+                tenant,
+                ingestRequest.Source.Vendor ?? "(unknown)",
+                "rejected"));

        return MapAocGuardException(context, guardException);
    }
@@ -467,25 +477,8 @@ advisoryIngestEndpoint.RequireAocGuard<AdvisoryIngestRequest>(request =>
        return Array.Empty<object?>();
    }

-    var linkset = request.Linkset ?? new AdvisoryLinksetRequest(
-        Array.Empty<string>(),
-        Array.Empty<string>(),
-        Array.Empty<string>(),
-        Array.Empty<AdvisoryLinksetReferenceRequest>(),
-        Array.Empty<string>(),
-        new Dictionary<string, string>(StringComparer.Ordinal));
-
-    var payload = new
-    {
-        tenant = "guard-tenant",
-        source = request.Source,
-        upstream = request.Upstream,
-        content = request.Content,
-        identifiers = request.Identifiers,
-        linkset
-    };
-
-    return new object?[] { payload };
+    var guardDocument = AdvisoryRawRequestMapper.Map(request, "guard-tenant", TimeProvider.System);
+    return new object?[] { guardDocument };
 }, guardOptions: advisoryIngestGuardOptions);

 if (authorityConfigured)
@@ -796,11 +789,9 @@ var aocVerifyEndpoint = app.MapPost("/aoc/verify", async (
    var verificationOutcome = response.Truncated
        ? "truncated"
        : (violationResponses.Length == 0 ? "ok" : "violations");
-    IngestionMetrics.VerificationCounter.Add(1, new[]
-    {
-        new KeyValuePair<string, object?>("tenant", tenant),
-        new KeyValuePair<string, object?>("result", verificationOutcome)
-    });
+    IngestionMetrics.VerificationCounter.Add(
+        1,
+        IngestionMetrics.BuildVerifyTags(tenant, verificationOutcome));

    return JsonResult(response);
 });
--- a/src/Concelier/StellaOps.Concelier.WebService/Services/OpenApiDiscoveryDocumentProvider.cs
+++ b/src/Concelier/StellaOps.Concelier.WebService/Services/OpenApiDiscoveryDocumentProvider.cs
@@ -1,7 +1,6 @@
 using System.Collections.Concurrent;
 using System.Collections.Generic;
 using System.Globalization;
-using System.Security.Cryptography;
 using System.Text;
 using System.Text.Json;
 using System.Text.Json.Nodes;
@@ -10,6 +9,7 @@ using System.Linq;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Routing;
 using Microsoft.AspNetCore.Routing.Patterns;
+using StellaOps.Cryptography;

 namespace StellaOps.Concelier.WebService.Services;

@@ -28,14 +28,18 @@ internal sealed class OpenApiDiscoveryDocumentProvider
    ];

    private readonly EndpointDataSource _endpointDataSource;
+    private readonly ICryptoHash _hash;
    private readonly object _syncRoot = new();

    private string? _cachedDocumentJson;
    private string? _cachedEtag;

-    public OpenApiDiscoveryDocumentProvider(EndpointDataSource endpointDataSource)
+    public OpenApiDiscoveryDocumentProvider(
+        EndpointDataSource endpointDataSource,
+        ICryptoHash hash)
    {
-        _endpointDataSource = endpointDataSource;
+        _endpointDataSource = endpointDataSource ?? throw new ArgumentNullException(nameof(endpointDataSource));
+        _hash = hash ?? throw new ArgumentNullException(nameof(hash));
    }

    public (string Payload, string ETag) GetDocument()
@@ -58,7 +62,7 @@ internal sealed class OpenApiDiscoveryDocumentProvider
                });

            var bytes = Encoding.UTF8.GetBytes(json);
-            var hash = Convert.ToHexString(SHA256.HashData(bytes)).ToLowerInvariant();
+            var hash = _hash.ComputeHashHex(bytes);
            var computedEtag = $"\"{hash}\"";

            _cachedDocumentJson = json;
--- a/src/Concelier/StellaOps.Concelier.WebService/StellaOps.Concelier.WebService.csproj
+++ b/src/Concelier/StellaOps.Concelier.WebService/StellaOps.Concelier.WebService.csproj
@@ -30,6 +30,8 @@
    <ProjectReference Include="../../__Libraries/StellaOps.Plugin/StellaOps.Plugin.csproj" />
    <ProjectReference Include="../../__Libraries/StellaOps.DependencyInjection/StellaOps.DependencyInjection.csproj" />
    <ProjectReference Include="../../__Libraries/StellaOps.Configuration/StellaOps.Configuration.csproj" />
+    <ProjectReference Include="../../__Libraries/StellaOps.Cryptography/StellaOps.Cryptography.csproj" />
+    <ProjectReference Include="../../__Libraries/StellaOps.Ingestion.Telemetry/StellaOps.Ingestion.Telemetry.csproj" />
    <ProjectReference Include="../../Authority/StellaOps.Authority/StellaOps.Auth.Abstractions/StellaOps.Auth.Abstractions.csproj" />
    <ProjectReference Include="../../Authority/StellaOps.Authority/StellaOps.Auth.Client/StellaOps.Auth.Client.csproj" />
    <ProjectReference Include="../../Authority/StellaOps.Authority/StellaOps.Auth.ServerIntegration/StellaOps.Auth.ServerIntegration.csproj" />
--- a/src/Concelier/StellaOps.Concelier.WebService/TASKS.md
+++ b/src/Concelier/StellaOps.Concelier.WebService/TASKS.md
@@ -1,94 +1,98 @@
-# TASKS — Epic 1: Aggregation-Only Contract
-> **AOC Reminder:** service links and exposes raw data only—no precedence, severity, or hint computation inside Concelier APIs.
-| ID | Status | Owner(s) | Depends on | Notes |
-|---|---|---|---|---|
-> Docs alignment (2025-10-26): Endpoint expectations + scope requirements detailed in `docs/ingestion/aggregation-only-contract.md` and `docs/security/authority-scopes.md`.
-> 2025-10-28: Added coverage for pagination, tenancy enforcement, and ingestion/verification metrics; verified guard handling paths end-to-end.
-| CONCELIER-WEB-AOC-19-002 `AOC observability` | TODO | Concelier WebService Guild, Observability Guild | CONCELIER-WEB-AOC-19-001 | Emit `ingestion_write_total`, `aoc_violation_total`, latency histograms, and tracing spans (`ingest.fetch/transform/write`, `aoc.guard`). Wire structured logging to include tenant, source vendor, upstream id, and content hash. |
-> Docs alignment (2025-10-26): Metrics/traces/log schema in `docs/observability/observability.md`.
-| CONCELIER-WEB-AOC-19-003 `Schema/guard unit tests` | TODO | QA Guild | CONCELIER-WEB-AOC-19-001 | Add unit tests covering schema validation failures, forbidden field rejections (`ERR_AOC_001/002/006/007`), idempotent upserts, and supersedes chains using deterministic fixtures. |
-> Docs alignment (2025-10-26): Guard rules + error codes documented in AOC reference §5 and CLI guide.
-| CONCELIER-WEB-AOC-19-004 `End-to-end ingest verification` | TODO | Concelier WebService Guild, QA Guild | CONCELIER-WEB-AOC-19-003, CONCELIER-CORE-AOC-19-002 | Create integration tests ingesting large advisory batches (cold/warm) validating linkset enrichment, metrics emission, and reproducible outputs. Capture load-test scripts + doc notes for Offline Kit dry runs. |
-> Docs alignment (2025-10-26): Offline verification workflow referenced in `docs/deploy/containers.md` §5.
-
-## Policy Engine v2
-
-| ID | Status | Owner(s) | Depends on | Notes |
-|----|--------|----------|------------|-------|
-| CONCELIER-POLICY-20-001 `Policy selection endpoints` | TODO | Concelier WebService Guild | WEB-POLICY-20-001, CONCELIER-CORE-AOC-19-004 | Add batch advisory lookup APIs (`/policy/select/advisories`, `/policy/select/vex`) optimized for PURL/ID lists with pagination, tenant scoping, and explain metadata. |
-
-## StellaOps Console (Sprint 23)
-
-| ID | Status | Owner(s) | Depends on | Notes |
+# TASKS — Epic 1: Aggregation-Only Contract
+> **AOC Reminder:** service links and exposes raw data only—no precedence, severity, or hint computation inside Concelier APIs.
+| ID | Status | Owner(s) | Depends on | Notes |
+|---|---|---|---|---|
+> Docs alignment (2025-10-26): Endpoint expectations + scope requirements detailed in `docs/ingestion/aggregation-only-contract.md` and `docs/security/authority-scopes.md`.
+> 2025-10-28: Added coverage for pagination, tenancy enforcement, and ingestion/verification metrics; verified guard handling paths end-to-end.
+| CONCELIER-WEB-AOC-19-002 `AOC observability` | DONE (2025-11-07) | Concelier WebService Guild, Observability Guild | CONCELIER-WEB-AOC-19-001 | Emit `ingestion_write_total`, `aoc_violation_total`, latency histograms, and tracing spans (`ingest.fetch/transform/write`, `aoc.guard`). Wire structured logging to include tenant, source vendor, upstream id, and content hash. |
+> Docs alignment (2025-10-26): Metrics/traces/log schema in `docs/observability/observability.md`.
+| CONCELIER-WEB-AOC-19-003 `Schema/guard unit tests` | TODO | QA Guild | CONCELIER-WEB-AOC-19-001 | Add unit tests covering schema validation failures, forbidden field rejections (`ERR_AOC_001/002/006/007`), idempotent upserts, and supersedes chains using deterministic fixtures. |
+> Docs alignment (2025-10-26): Guard rules + error codes documented in AOC reference §5 and CLI guide.
+| CONCELIER-WEB-AOC-19-004 `End-to-end ingest verification` | TODO | Concelier WebService Guild, QA Guild | CONCELIER-WEB-AOC-19-003, CONCELIER-CORE-AOC-19-002 | Create integration tests ingesting large advisory batches (cold/warm) validating linkset enrichment, metrics emission, and reproducible outputs. Capture load-test scripts + doc notes for Offline Kit dry runs. |
+> Docs alignment (2025-10-26): Offline verification workflow referenced in `docs/deploy/containers.md` §5.
+| CONCELIER-WEB-AOC-19-005 `Chunk evidence regression` | TODO (2025-11-08) | Concelier WebService Guild, QA Guild | CONCELIER-WEB-AOC-19-002 | Fix `/advisories/{key}/chunks` seeded fixtures so AdvisoryChunksEndpoint tests stop returning 404/not-found when raw documents are pre-populated; ensure Mongo migrations no longer emit “Unable to locate advisory_raw documents” during test boot. |
+| CONCELIER-WEB-AOC-19-006 `Allowlist ingest auth parity` | TODO (2025-11-08) | Concelier WebService Guild | CONCELIER-WEB-AOC-19-002 | Align WebService auth defaults with the test tokens so the allowlisted tenant can create an advisory before forbidden tenants are rejected in `AdvisoryIngestEndpoint_RejectsTenantOutsideAllowlist`. |
+| CONCELIER-WEB-AOC-19-007 `AOC verify violation codes` | TODO (2025-11-08) | Concelier WebService Guild, QA Guild | CONCELIER-WEB-AOC-19-002 | Update AOC verify logic/fixtures so guard failures produce the expected `ERR_AOC_001` payload (current regression returns `ERR_AOC_004`) while keeping the mapper/guard parity exercised by the new tests. |
+| CONCELIER-CRYPTO-90-001 `Crypto provider adoption` | DOING (2025-11-08) | Concelier WebService Guild, Security Guild | SEC-CRYPTO-90-003, SEC-CRYPTO-90-004 | Route hashing/signing in OpenAPI discovery, Mirror connectors, and RU advisory adapters through `ICryptoProviderRegistry` so RootPack_RU uses CryptoPro/PKCS#11 keys. Reference `docs/security/crypto-routing-audit-2025-11-07.md`. |
+
+## Policy Engine v2
+
+| ID | Status | Owner(s) | Depends on | Notes |
+|----|--------|----------|------------|-------|
+| CONCELIER-POLICY-20-001 `Policy selection endpoints` | TODO | Concelier WebService Guild | WEB-POLICY-20-001, CONCELIER-CORE-AOC-19-004 | Add batch advisory lookup APIs (`/policy/select/advisories`, `/policy/select/vex`) optimized for PURL/ID lists with pagination, tenant scoping, and explain metadata. |
+
+## StellaOps Console (Sprint 23)
+
+| ID | Status | Owner(s) | Depends on | Notes |
 |----|--------|----------|------------|-------|
 | CONCELIER-CONSOLE-23-001 `Advisory aggregation views` | TODO | Concelier WebService Guild, BE-Base Platform Guild | CONCELIER-LNM-21-201, CONCELIER-LNM-21-202 | Expose `/console/advisories` endpoints returning aggregation groups (per linkset) with source chips, provider-reported severity columns (no local consensus), and provenance metadata for Console list + dashboard cards. Support filters by source, ecosystem, published/modified window, tenant enforcement. |
-| CONCELIER-CONSOLE-23-002 `Dashboard deltas API` | TODO | Concelier WebService Guild | CONCELIER-CONSOLE-23-001, CONCELIER-LNM-21-203 | Provide aggregated advisory delta counts (new, modified, conflicting) for Console dashboard + live status ticker; emit structured events for queue lag metrics. Ensure deterministic counts across repeated queries. |
-| CONCELIER-CONSOLE-23-003 `Search fan-out helpers` | TODO | Concelier WebService Guild | CONCELIER-CONSOLE-23-001 | Deliver fast lookup endpoints for CVE/GHSA/purl search (linksets, observations) returning evidence fragments for Console global search; implement caching + scope guards. |
-
-## Graph Explorer v1
-
-| ID | Status | Owner(s) | Depends on | Notes |
-|----|--------|----------|------------|-------|
-
-## Link-Not-Merge v1
-
-| ID | Status | Owner(s) | Depends on | Notes |
-|----|--------|----------|------------|-------|
-| CONCELIER-LNM-21-201 `Observation APIs` | TODO | Concelier WebService Guild, BE-Base Platform Guild | CONCELIER-LNM-21-001 | Add REST endpoints for advisory observations (`GET /advisories/observations`) with filters (alias, purl, source), pagination, and tenancy enforcement. |
-| CONCELIER-LNM-21-202 `Linkset APIs` | TODO | Concelier WebService Guild | CONCELIER-LNM-21-002, CONCELIER-LNM-21-003 | Implement linkset read/export endpoints (`/advisories/linksets/{id}`, `/advisories/by-purl/{purl}`, `/advisories/linksets/{id}/export`, `/evidence`) with correlation/conflict payloads and `ERR_AGG_*` mapping. |
-| CONCELIER-LNM-21-203 `Ingest events` | TODO | Concelier WebService Guild, Platform Events Guild | CONCELIER-LNM-21-005 | Publish NATS/Redis events for new observations/linksets and ensure idempotent consumer contracts; document event schemas. |
-
-## Graph & Vuln Explorer v1
-
-| ID | Status | Owner(s) | Depends on | Notes |
-|----|--------|----------|------------|-------|
-| CONCELIER-GRAPH-24-101 `Advisory summary API` | TODO | Concelier WebService Guild | CONCELIER-GRAPH-24-001 | Expose `/advisories/summary` returning raw linkset/observation metadata for overlay services; no derived severity or fix hints. |
-| CONCELIER-GRAPH-28-102 `Evidence batch API` | TODO | Concelier WebService Guild | CONCELIER-LNM-21-201 | Add batch fetch for advisory observations/linksets keyed by component sets to feed Graph overlay tooltips efficiently. |
-
-## VEX Lens (Sprint 30)
-
-| ID | Status | Owner(s) | Depends on | Notes |
-|----|--------|----------|------------|-------|
-| CONCELIER-VEXLENS-30-001 `Advisory rationale bridges` | TODO | Concelier WebService Guild, VEX Lens Guild | CONCELIER-VULN-29-001, VEXLENS-30-005 | Guarantee advisory key consistency and cross-links for consensus rationale; Label: VEX-Lens. |
-
-## Vulnerability Explorer (Sprint 29)
-
-| ID | Status | Owner(s) | Depends on | Notes |
-|----|--------|----------|------------|-------|
+| CONCELIER-CONSOLE-23-002 `Dashboard deltas API` | TODO | Concelier WebService Guild | CONCELIER-CONSOLE-23-001, CONCELIER-LNM-21-203 | Provide aggregated advisory delta counts (new, modified, conflicting) for Console dashboard + live status ticker; emit structured events for queue lag metrics. Ensure deterministic counts across repeated queries. |
+| CONCELIER-CONSOLE-23-003 `Search fan-out helpers` | TODO | Concelier WebService Guild | CONCELIER-CONSOLE-23-001 | Deliver fast lookup endpoints for CVE/GHSA/purl search (linksets, observations) returning evidence fragments for Console global search; implement caching + scope guards. |
+
+## Graph Explorer v1
+
+| ID | Status | Owner(s) | Depends on | Notes |
+|----|--------|----------|------------|-------|
+
+## Link-Not-Merge v1
+
+| ID | Status | Owner(s) | Depends on | Notes |
+|----|--------|----------|------------|-------|
+| CONCELIER-LNM-21-201 `Observation APIs` | TODO | Concelier WebService Guild, BE-Base Platform Guild | CONCELIER-LNM-21-001 | Add REST endpoints for advisory observations (`GET /advisories/observations`) with filters (alias, purl, source), pagination, and tenancy enforcement. |
+| CONCELIER-LNM-21-202 `Linkset APIs` | TODO | Concelier WebService Guild | CONCELIER-LNM-21-002, CONCELIER-LNM-21-003 | Implement linkset read/export endpoints (`/advisories/linksets/{id}`, `/advisories/by-purl/{purl}`, `/advisories/linksets/{id}/export`, `/evidence`) with correlation/conflict payloads and `ERR_AGG_*` mapping. |
+| CONCELIER-LNM-21-203 `Ingest events` | TODO | Concelier WebService Guild, Platform Events Guild | CONCELIER-LNM-21-005 | Publish NATS/Redis events for new observations/linksets and ensure idempotent consumer contracts; document event schemas. |
+
+## Graph & Vuln Explorer v1
+
+| ID | Status | Owner(s) | Depends on | Notes |
+|----|--------|----------|------------|-------|
+| CONCELIER-GRAPH-24-101 `Advisory summary API` | TODO | Concelier WebService Guild | CONCELIER-GRAPH-24-001 | Expose `/advisories/summary` returning raw linkset/observation metadata for overlay services; no derived severity or fix hints. |
+| CONCELIER-GRAPH-28-102 `Evidence batch API` | TODO | Concelier WebService Guild | CONCELIER-LNM-21-201 | Add batch fetch for advisory observations/linksets keyed by component sets to feed Graph overlay tooltips efficiently. |
+
+## VEX Lens (Sprint 30)
+
+| ID | Status | Owner(s) | Depends on | Notes |
+|----|--------|----------|------------|-------|
+| CONCELIER-VEXLENS-30-001 `Advisory rationale bridges` | TODO | Concelier WebService Guild, VEX Lens Guild | CONCELIER-VULN-29-001, VEXLENS-30-005 | Guarantee advisory key consistency and cross-links for consensus rationale; Label: VEX-Lens. |
+
+## Vulnerability Explorer (Sprint 29)
+
+| ID | Status | Owner(s) | Depends on | Notes |
+|----|--------|----------|------------|-------|
 | CONCELIER-VULN-29-001 `Advisory key canonicalization` | DONE (2025-11-07) | Concelier WebService Guild, Data Integrity Guild | CONCELIER-LNM-21-001 | Canonicalize (lossless) advisory identifiers (CVE/GHSA/vendor) into `advisory_key`, persist `links[]`, expose raw payload snapshots for Explorer evidence tabs; AOC-compliant: no merge, no derived fields, no suppression. Include migration/backfill scripts. |
 | CONCELIER-VULN-29-002 `Evidence retrieval API` | DOING (2025-11-07) | Concelier WebService Guild | CONCELIER-VULN-29-001, VULN-API-29-003 | Provide `/vuln/evidence/advisories/{advisory_key}` returning raw advisory docs with provenance, filtering by tenant and source. |
 | CONCELIER-VULN-29-004 `Observability enhancements` | TODO | Concelier WebService Guild, Observability Guild | CONCELIER-VULN-29-001 | Instrument metrics/logs for observation + linkset pipelines (identifier collisions, withdrawn flags) and emit events consumed by Vuln Explorer resolver. |
-
-## Advisory AI (Sprint 31)
-
-| ID | Status | Owner(s) | Depends on | Notes |
-|----|--------|----------|------------|-------|
+
+## Advisory AI (Sprint 31)
+
+| ID | Status | Owner(s) | Depends on | Notes |
+|----|--------|----------|------------|-------|
 | CONCELIER-AIAI-31-001 `Paragraph anchors` | DONE | Concelier WebService Guild | CONCELIER-VULN-29-001 | Expose advisory chunk API returning paragraph anchors, section metadata, and token-safe text for Advisory AI retrieval. See docs/updates/2025-11-07-concelier-advisory-chunks.md. |
 | CONCELIER-AIAI-31-002 `Structured fields` | TODO | Concelier WebService Guild | CONCELIER-AIAI-31-001 | Ensure observation APIs expose upstream workaround/fix/CVSS fields with provenance; add caching for summary queries. |
-| CONCELIER-AIAI-31-003 `Advisory AI telemetry` | TODO | Concelier WebService Guild, Observability Guild | CONCELIER-AIAI-31-001 | Emit metrics/logs for chunk requests, cache hits, and guardrail blocks triggered by advisory payloads. |
-
-## Observability & Forensics (Epic 15)
-| ID | Status | Owner(s) | Depends on | Notes |
-|----|--------|----------|------------|-------|
-| CONCELIER-WEB-OBS-50-001 `Telemetry adoption` | TODO | Concelier WebService Guild | TELEMETRY-OBS-50-001, CONCELIER-OBS-50-001 | Adopt telemetry core in web service host, ensure ingest + read endpoints emit trace/log fields (`tenant_id`, `route`, `decision_effect`), and add correlation IDs to responses. |
-| CONCELIER-WEB-OBS-51-001 `Observability APIs` | TODO | Concelier WebService Guild | CONCELIER-WEB-OBS-50-001, WEB-OBS-51-001 | Surface ingest health metrics, queue depth, and SLO status via `/obs/concelier/health` endpoint for Console widgets, with caching and tenant partitioning. |
-| CONCELIER-WEB-OBS-52-001 `Timeline streaming` | TODO | Concelier WebService Guild | CONCELIER-WEB-OBS-50-001, TIMELINE-OBS-52-003 | Provide SSE stream `/obs/concelier/timeline` bridging to Timeline Indexer with paging tokens, guardrails, and audit logging. |
-| CONCELIER-WEB-OBS-53-001 `Evidence locker integration` | TODO | Concelier WebService Guild, Evidence Locker Guild | CONCELIER-OBS-53-001, EVID-OBS-53-003 | Add `/evidence/advisories/*` routes invoking evidence locker snapshots, verifying tenant scopes (`evidence:read`), and returning signed manifest metadata. |
-| CONCELIER-WEB-OBS-54-001 `Attestation exposure` | TODO | Concelier WebService Guild | CONCELIER-OBS-54-001, PROV-OBS-54-001 | Provide `/attestations/advisories/*` read APIs surfacing DSSE status, verification summary, and provenance chain for Console/CLI. |
-| CONCELIER-WEB-OBS-55-001 `Incident mode toggles` | TODO | Concelier WebService Guild, DevOps Guild | CONCELIER-OBS-55-001, WEB-OBS-55-001 | Implement incident mode toggle endpoints, propagate to orchestrator/locker, and document cooldown/backoff semantics. |
-
-## Air-Gapped Mode (Epic 16)
-| ID | Status | Owner(s) | Depends on | Notes |
-|----|--------|----------|------------|-------|
-| CONCELIER-WEB-AIRGAP-56-001 `Mirror import APIs` | TODO | Concelier WebService Guild | AIRGAP-IMP-58-001, CONCELIER-AIRGAP-56-001 | Extend ingestion endpoints to register mirror bundle sources, expose bundle catalog queries, and block external feed URLs in sealed mode. |
-| CONCELIER-WEB-AIRGAP-56-002 `Airgap status surfaces` | TODO | Concelier WebService Guild | CONCELIER-AIRGAP-57-002, AIRGAP-CTL-56-002 | Add staleness metadata and bundle provenance to advisory APIs (`/advisories/observations`, `/advisories/linksets`). |
-| CONCELIER-WEB-AIRGAP-57-001 `Error remediation` | TODO | Concelier WebService Guild, AirGap Policy Guild | AIRGAP-POL-56-001 | Map sealed-mode violations to `AIRGAP_EGRESS_BLOCKED` responses with user guidance. |
-| CONCELIER-WEB-AIRGAP-58-001 `Import timeline emission` | TODO | Concelier WebService Guild, AirGap Importer Guild | CONCELIER-WEB-AIRGAP-56-001, TIMELINE-OBS-53-001 | Emit timeline events for bundle ingestion operations with bundle ID, scope, and actor metadata. |
-
-## SDKs & OpenAPI (Epic 17)
-| ID | Status | Owner(s) | Depends on | Notes |
-|----|--------|----------|------------|-------|
+| CONCELIER-AIAI-31-003 `Advisory AI telemetry` | TODO | Concelier WebService Guild, Observability Guild | CONCELIER-AIAI-31-001 | Emit metrics/logs for chunk requests, cache hits, and guardrail blocks triggered by advisory payloads. |
+
+## Observability & Forensics (Epic 15)
+| ID | Status | Owner(s) | Depends on | Notes |
+|----|--------|----------|------------|-------|
+| CONCELIER-WEB-OBS-50-001 `Telemetry adoption` | DONE (2025-11-07) | Concelier WebService Guild | TELEMETRY-OBS-50-001, CONCELIER-OBS-50-001 | Adopt telemetry core in web service host, ensure ingest + read endpoints emit trace/log fields (`tenant_id`, `route`, `decision_effect`), and add correlation IDs to responses. |
+| CONCELIER-WEB-OBS-51-001 `Observability APIs` | TODO | Concelier WebService Guild | CONCELIER-WEB-OBS-50-001, WEB-OBS-51-001 | Surface ingest health metrics, queue depth, and SLO status via `/obs/concelier/health` endpoint for Console widgets, with caching and tenant partitioning. |
+| CONCELIER-WEB-OBS-52-001 `Timeline streaming` | TODO | Concelier WebService Guild | CONCELIER-WEB-OBS-50-001, TIMELINE-OBS-52-003 | Provide SSE stream `/obs/concelier/timeline` bridging to Timeline Indexer with paging tokens, guardrails, and audit logging. |
+| CONCELIER-WEB-OBS-53-001 `Evidence locker integration` | TODO | Concelier WebService Guild, Evidence Locker Guild | CONCELIER-OBS-53-001, EVID-OBS-53-003 | Add `/evidence/advisories/*` routes invoking evidence locker snapshots, verifying tenant scopes (`evidence:read`), and returning signed manifest metadata. |
+| CONCELIER-WEB-OBS-54-001 `Attestation exposure` | TODO | Concelier WebService Guild | CONCELIER-OBS-54-001, PROV-OBS-54-001 | Provide `/attestations/advisories/*` read APIs surfacing DSSE status, verification summary, and provenance chain for Console/CLI. |
+| CONCELIER-WEB-OBS-55-001 `Incident mode toggles` | TODO | Concelier WebService Guild, DevOps Guild | CONCELIER-OBS-55-001, WEB-OBS-55-001 | Implement incident mode toggle endpoints, propagate to orchestrator/locker, and document cooldown/backoff semantics. |
+
+## Air-Gapped Mode (Epic 16)
+| ID | Status | Owner(s) | Depends on | Notes |
+|----|--------|----------|------------|-------|
+| CONCELIER-WEB-AIRGAP-56-001 `Mirror import APIs` | TODO | Concelier WebService Guild | AIRGAP-IMP-58-001, CONCELIER-AIRGAP-56-001 | Extend ingestion endpoints to register mirror bundle sources, expose bundle catalog queries, and block external feed URLs in sealed mode. |
+| CONCELIER-WEB-AIRGAP-56-002 `Airgap status surfaces` | TODO | Concelier WebService Guild | CONCELIER-AIRGAP-57-002, AIRGAP-CTL-56-002 | Add staleness metadata and bundle provenance to advisory APIs (`/advisories/observations`, `/advisories/linksets`). |
+| CONCELIER-WEB-AIRGAP-57-001 `Error remediation` | TODO | Concelier WebService Guild, AirGap Policy Guild | AIRGAP-POL-56-001 | Map sealed-mode violations to `AIRGAP_EGRESS_BLOCKED` responses with user guidance. |
+| CONCELIER-WEB-AIRGAP-58-001 `Import timeline emission` | TODO | Concelier WebService Guild, AirGap Importer Guild | CONCELIER-WEB-AIRGAP-56-001, TIMELINE-OBS-53-001 | Emit timeline events for bundle ingestion operations with bundle ID, scope, and actor metadata. |
+
+## SDKs & OpenAPI (Epic 17)
+| ID | Status | Owner(s) | Depends on | Notes |
+|----|--------|----------|------------|-------|
 | CONCELIER-WEB-OAS-61-001 `/.well-known/openapi` | DONE (2025-11-02) | Concelier WebService Guild | OAS-61-001 | Implement discovery endpoint emitting Concelier spec with version metadata and ETag. |
-| CONCELIER-WEB-OAS-61-002 `Error envelope migration` | TODO | Concelier WebService Guild | APIGOV-61-001 | Ensure all API responses use standardized error envelope; update controllers/tests. |
-| CONCELIER-WEB-OAS-62-001 `Examples expansion` | TODO | Concelier WebService Guild | CONCELIER-OAS-61-002 | Add curated examples for advisory observations/linksets/conflicts; integrate into dev portal. |
-| CONCELIER-WEB-OAS-63-001 `Deprecation headers` | TODO | Concelier WebService Guild, API Governance Guild | APIGOV-63-001 | Add Sunset/Deprecation headers for retiring endpoints and update documentation/notifications. |
+| CONCELIER-WEB-OAS-61-002 `Error envelope migration` | TODO | Concelier WebService Guild | APIGOV-61-001 | Ensure all API responses use standardized error envelope; update controllers/tests. |
+| CONCELIER-WEB-OAS-62-001 `Examples expansion` | TODO | Concelier WebService Guild | CONCELIER-OAS-61-002 | Add curated examples for advisory observations/linksets/conflicts; integrate into dev portal. |
+| CONCELIER-WEB-OAS-63-001 `Deprecation headers` | TODO | Concelier WebService Guild, API Governance Guild | APIGOV-63-001 | Add Sunset/Deprecation headers for retiring endpoints and update documentation/notifications. |