up

src/AdvisoryAI/StellaOps.AdvisoryAI/Orchestration/AdvisoryPipelineOrchestrator.cs

@@ -4,52 +4,52 @@ using System.Globalization;
 using System.Linq;
 using System.Security.Cryptography;
 using System.Text;
-using Microsoft.Extensions.Logging;
+using Microsoft.Extensions.Logging;
 using Microsoft.Extensions.Options;
 using StellaOps.AdvisoryAI.Abstractions;
 using StellaOps.AdvisoryAI.Context;
 using StellaOps.AdvisoryAI.Documents;
 using StellaOps.AdvisoryAI.Tools;
-
-namespace StellaOps.AdvisoryAI.Orchestration;
-
-internal sealed class AdvisoryPipelineOrchestrator : IAdvisoryPipelineOrchestrator
-{
-    private readonly IAdvisoryStructuredRetriever _structuredRetriever;
-    private readonly IAdvisoryVectorRetriever _vectorRetriever;
-    private readonly ISbomContextRetriever _sbomContextRetriever;
-    private readonly IDeterministicToolset _toolset;
-    private readonly AdvisoryPipelineOptions _options;
-    private readonly ILogger<AdvisoryPipelineOrchestrator>? _logger;
-
-    public AdvisoryPipelineOrchestrator(
-        IAdvisoryStructuredRetriever structuredRetriever,
-        IAdvisoryVectorRetriever vectorRetriever,
-        ISbomContextRetriever sbomContextRetriever,
-        IDeterministicToolset toolset,
-        IOptions<AdvisoryPipelineOptions> options,
-        ILogger<AdvisoryPipelineOrchestrator>? logger = null)
-    {
-        _structuredRetriever = structuredRetriever ?? throw new ArgumentNullException(nameof(structuredRetriever));
-        _vectorRetriever = vectorRetriever ?? throw new ArgumentNullException(nameof(vectorRetriever));
-        _sbomContextRetriever = sbomContextRetriever ?? throw new ArgumentNullException(nameof(sbomContextRetriever));
-        _toolset = toolset ?? throw new ArgumentNullException(nameof(toolset));
-        _options = options?.Value ?? throw new ArgumentNullException(nameof(options));
-        _options.ApplyDefaults();
-        _logger = logger;
-    }
-
-    public async Task<AdvisoryTaskPlan> CreatePlanAsync(AdvisoryTaskRequest request, CancellationToken cancellationToken)
-    {
-        ArgumentNullException.ThrowIfNull(request);
-
-        var config = _options.GetConfiguration(request.TaskType);
-
-        var structuredRequest = new AdvisoryRetrievalRequest(
-            request.AdvisoryKey,
-            request.PreferredSections,
-            config.StructuredMaxChunks);
-
+
+namespace StellaOps.AdvisoryAI.Orchestration;
+
+internal sealed class AdvisoryPipelineOrchestrator : IAdvisoryPipelineOrchestrator
+{
+    private readonly IAdvisoryStructuredRetriever _structuredRetriever;
+    private readonly IAdvisoryVectorRetriever _vectorRetriever;
+    private readonly ISbomContextRetriever _sbomContextRetriever;
+    private readonly IDeterministicToolset _toolset;
+    private readonly AdvisoryPipelineOptions _options;
+    private readonly ILogger<AdvisoryPipelineOrchestrator>? _logger;
+
+    public AdvisoryPipelineOrchestrator(
+        IAdvisoryStructuredRetriever structuredRetriever,
+        IAdvisoryVectorRetriever vectorRetriever,
+        ISbomContextRetriever sbomContextRetriever,
+        IDeterministicToolset toolset,
+        IOptions<AdvisoryPipelineOptions> options,
+        ILogger<AdvisoryPipelineOrchestrator>? logger = null)
+    {
+        _structuredRetriever = structuredRetriever ?? throw new ArgumentNullException(nameof(structuredRetriever));
+        _vectorRetriever = vectorRetriever ?? throw new ArgumentNullException(nameof(vectorRetriever));
+        _sbomContextRetriever = sbomContextRetriever ?? throw new ArgumentNullException(nameof(sbomContextRetriever));
+        _toolset = toolset ?? throw new ArgumentNullException(nameof(toolset));
+        _options = options?.Value ?? throw new ArgumentNullException(nameof(options));
+        _options.ApplyDefaults();
+        _logger = logger;
+    }
+
+    public async Task<AdvisoryTaskPlan> CreatePlanAsync(AdvisoryTaskRequest request, CancellationToken cancellationToken)
+    {
+        ArgumentNullException.ThrowIfNull(request);
+
+        var config = _options.GetConfiguration(request.TaskType);
+
+        var structuredRequest = new AdvisoryRetrievalRequest(
+            request.AdvisoryKey,
+            request.PreferredSections,
+            config.StructuredMaxChunks);
+
         var structured = await _structuredRetriever
             .RetrieveAsync(structuredRequest, cancellationToken)
             .ConfigureAwait(false);
@@ -57,10 +57,10 @@ internal sealed class AdvisoryPipelineOrchestrator : IAdvisoryPipelineOrchestrat
         var structuredChunks = NormalizeStructuredChunks(structured);
         var vectorResults = await RetrieveVectorMatchesAsync(request, structuredRequest, config, cancellationToken).ConfigureAwait(false);
         var (sbomContext, dependencyAnalysis) = await RetrieveSbomContextAsync(request, config, cancellationToken).ConfigureAwait(false);
-
-        var metadata = BuildMetadata(request, structured, vectorResults, sbomContext, dependencyAnalysis);
-        var cacheKey = ComputeCacheKey(request, structured, vectorResults, sbomContext, dependencyAnalysis);
-
+
+        var metadata = BuildMetadata(request, structured, vectorResults, sbomContext, dependencyAnalysis);
+        var cacheKey = ComputeCacheKey(request, structured, vectorResults, sbomContext, dependencyAnalysis);
+
         var plan = new AdvisoryTaskPlan(
             request,
             cacheKey,
@@ -69,27 +69,27 @@ internal sealed class AdvisoryPipelineOrchestrator : IAdvisoryPipelineOrchestrat
             vectorResults,
             sbomContext,
             dependencyAnalysis,
-            config.Budget,
-            metadata);
-
-        return plan;
-    }
-
-    private async Task<ImmutableArray<AdvisoryVectorResult>> RetrieveVectorMatchesAsync(
-        AdvisoryTaskRequest request,
-        AdvisoryRetrievalRequest structuredRequest,
-        AdvisoryTaskConfiguration configuration,
-        CancellationToken cancellationToken)
-    {
-        if (configuration.VectorQueries.Count == 0)
-        {
-            return ImmutableArray<AdvisoryVectorResult>.Empty;
-        }
-
-        var builder = ImmutableArray.CreateBuilder<AdvisoryVectorResult>(configuration.VectorQueries.Count);
-        foreach (var query in configuration.GetVectorQueries())
-        {
-            var vectorRequest = new VectorRetrievalRequest(structuredRequest, query, configuration.VectorTopK);
+            config.Budget,
+            metadata);
+
+        return plan;
+    }
+
+    private async Task<ImmutableArray<AdvisoryVectorResult>> RetrieveVectorMatchesAsync(
+        AdvisoryTaskRequest request,
+        AdvisoryRetrievalRequest structuredRequest,
+        AdvisoryTaskConfiguration configuration,
+        CancellationToken cancellationToken)
+    {
+        if (configuration.VectorQueries.Count == 0)
+        {
+            return ImmutableArray<AdvisoryVectorResult>.Empty;
+        }
+
+        var builder = ImmutableArray.CreateBuilder<AdvisoryVectorResult>(configuration.VectorQueries.Count);
+        foreach (var query in configuration.GetVectorQueries())
+        {
+            var vectorRequest = new VectorRetrievalRequest(structuredRequest, query, configuration.VectorTopK);
             var matches = await _vectorRetriever
                 .SearchAsync(vectorRequest, cancellationToken)
                 .ConfigureAwait(false);
@@ -102,27 +102,27 @@ internal sealed class AdvisoryPipelineOrchestrator : IAdvisoryPipelineOrchestrat
             builder.Add(new AdvisoryVectorResult(query, orderedMatches));
         }
 
-        return builder.MoveToImmutable();
-    }
-
-    private async Task<(SbomContextResult? Context, DependencyAnalysisResult? Analysis)> RetrieveSbomContextAsync(
-        AdvisoryTaskRequest request,
-        AdvisoryTaskConfiguration configuration,
-        CancellationToken cancellationToken)
-    {
-        if (string.IsNullOrEmpty(request.ArtifactId))
-        {
-            return (null, null);
-        }
-
-        var sbomRequest = new SbomContextRequest(
-            artifactId: request.ArtifactId!,
-            purl: request.ArtifactPurl,
-            maxTimelineEntries: configuration.SbomMaxTimelineEntries,
-            maxDependencyPaths: configuration.SbomMaxDependencyPaths,
-            includeEnvironmentFlags: configuration.IncludeEnvironmentFlags,
-            includeBlastRadius: configuration.IncludeBlastRadius);
-
+        return builder.MoveToImmutable();
+    }
+
+    private async Task<(SbomContextResult? Context, DependencyAnalysisResult? Analysis)> RetrieveSbomContextAsync(
+        AdvisoryTaskRequest request,
+        AdvisoryTaskConfiguration configuration,
+        CancellationToken cancellationToken)
+    {
+        if (string.IsNullOrEmpty(request.ArtifactId))
+        {
+            return (null, null);
+        }
+
+        var sbomRequest = new SbomContextRequest(
+            artifactId: request.ArtifactId!,
+            purl: request.ArtifactPurl,
+            maxTimelineEntries: configuration.SbomMaxTimelineEntries,
+            maxDependencyPaths: configuration.SbomMaxDependencyPaths,
+            includeEnvironmentFlags: configuration.IncludeEnvironmentFlags,
+            includeBlastRadius: configuration.IncludeBlastRadius);
+
         var context = await _sbomContextRetriever
             .RetrieveAsync(sbomRequest, cancellationToken)
             .ConfigureAwait(false);
@@ -135,73 +135,73 @@ internal sealed class AdvisoryPipelineOrchestrator : IAdvisoryPipelineOrchestrat
     private static ImmutableDictionary<string, string> BuildMetadata(
         AdvisoryTaskRequest request,
         AdvisoryRetrievalResult structured,
-        ImmutableArray<AdvisoryVectorResult> vectors,
-        SbomContextResult? sbom,
-        DependencyAnalysisResult? dependency)
-    {
-        var builder = ImmutableDictionary.CreateBuilder<string, string>(StringComparer.Ordinal);
-        builder["task_type"] = request.TaskType.ToString();
-        builder["advisory_key"] = request.AdvisoryKey;
-        builder["profile"] = request.Profile;
+        ImmutableArray<AdvisoryVectorResult> vectors,
+        SbomContextResult? sbom,
+        DependencyAnalysisResult? dependency)
+    {
+        var builder = ImmutableDictionary.CreateBuilder<string, string>(StringComparer.Ordinal);
+        builder["task_type"] = request.TaskType.ToString();
+        builder["advisory_key"] = request.AdvisoryKey;
+        builder["profile"] = request.Profile;
         builder["structured_chunk_count"] = structured.Chunks.Count().ToString(CultureInfo.InvariantCulture);
-        builder["vector_query_count"] = vectors.Length.ToString(CultureInfo.InvariantCulture);
-        builder["vector_match_count"] = vectors.Sum(result => result.Matches.Length).ToString(CultureInfo.InvariantCulture);
-        builder["includes_sbom"] = (sbom is not null).ToString();
-        builder["dependency_node_count"] = (dependency?.Nodes.Length ?? 0).ToString(CultureInfo.InvariantCulture);
-        builder["force_refresh"] = request.ForceRefresh.ToString();
-
-        if (!string.IsNullOrEmpty(request.PolicyVersion))
-        {
-            builder["policy_version"] = request.PolicyVersion!;
-        }
-
-        if (sbom is not null)
-        {
+        builder["vector_query_count"] = vectors.Length.ToString(CultureInfo.InvariantCulture);
+        builder["vector_match_count"] = vectors.Sum(result => result.Matches.Length).ToString(CultureInfo.InvariantCulture);
+        builder["includes_sbom"] = (sbom is not null).ToString();
+        builder["dependency_node_count"] = (dependency?.Nodes.Length ?? 0).ToString(CultureInfo.InvariantCulture);
+        builder["force_refresh"] = request.ForceRefresh.ToString();
+
+        if (!string.IsNullOrEmpty(request.PolicyVersion))
+        {
+            builder["policy_version"] = request.PolicyVersion!;
+        }
+
+        if (sbom is not null)
+        {
             builder["sbom_version_count"] = sbom.VersionTimeline.Length.ToString(CultureInfo.InvariantCulture);
             builder["sbom_dependency_path_count"] = sbom.DependencyPaths.Length.ToString(CultureInfo.InvariantCulture);
-
-            if (!sbom.EnvironmentFlags.IsEmpty)
-            {
-                foreach (var flag in sbom.EnvironmentFlags.OrderBy(pair => pair.Key, StringComparer.Ordinal))
-                {
-                    builder[$"sbom_env_{flag.Key}"] = flag.Value;
-                }
-            }
-
-            if (sbom.BlastRadius is not null)
-            {
-                builder["sbom_blast_impacted_assets"] = sbom.BlastRadius.ImpactedAssets.ToString(CultureInfo.InvariantCulture);
-                builder["sbom_blast_impacted_workloads"] = sbom.BlastRadius.ImpactedWorkloads.ToString(CultureInfo.InvariantCulture);
-                builder["sbom_blast_impacted_namespaces"] = sbom.BlastRadius.ImpactedNamespaces.ToString(CultureInfo.InvariantCulture);
-                if (sbom.BlastRadius.ImpactedPercentage is not null)
-                {
-                    builder["sbom_blast_impacted_percentage"] = sbom.BlastRadius.ImpactedPercentage.Value.ToString("G", CultureInfo.InvariantCulture);
-                }
-
-                if (!sbom.BlastRadius.Metadata.IsEmpty)
-                {
-                    foreach (var kvp in sbom.BlastRadius.Metadata.OrderBy(pair => pair.Key, StringComparer.Ordinal))
-                    {
-                        builder[$"sbom_blast_meta_{kvp.Key}"] = kvp.Value;
-                    }
-                }
-            }
-
-            if (!sbom.Metadata.IsEmpty)
-            {
-                foreach (var kvp in sbom.Metadata.OrderBy(pair => pair.Key, StringComparer.Ordinal))
-                {
-                    builder[$"sbom_meta_{kvp.Key}"] = kvp.Value;
-                }
-            }
-        }
-
-        if (dependency is not null)
-        {
-            foreach (var kvp in dependency.Metadata.OrderBy(pair => pair.Key, StringComparer.Ordinal))
-            {
-                builder[$"dependency_{kvp.Key}"] = kvp.Value;
-            }
+
+            if (!sbom.EnvironmentFlags.IsEmpty)
+            {
+                foreach (var flag in sbom.EnvironmentFlags.OrderBy(pair => pair.Key, StringComparer.Ordinal))
+                {
+                    builder[$"sbom_env_{flag.Key}"] = flag.Value;
+                }
+            }
+
+            if (sbom.BlastRadius is not null)
+            {
+                builder["sbom_blast_impacted_assets"] = sbom.BlastRadius.ImpactedAssets.ToString(CultureInfo.InvariantCulture);
+                builder["sbom_blast_impacted_workloads"] = sbom.BlastRadius.ImpactedWorkloads.ToString(CultureInfo.InvariantCulture);
+                builder["sbom_blast_impacted_namespaces"] = sbom.BlastRadius.ImpactedNamespaces.ToString(CultureInfo.InvariantCulture);
+                if (sbom.BlastRadius.ImpactedPercentage is not null)
+                {
+                    builder["sbom_blast_impacted_percentage"] = sbom.BlastRadius.ImpactedPercentage.Value.ToString("G", CultureInfo.InvariantCulture);
+                }
+
+                if (!sbom.BlastRadius.Metadata.IsEmpty)
+                {
+                    foreach (var kvp in sbom.BlastRadius.Metadata.OrderBy(pair => pair.Key, StringComparer.Ordinal))
+                    {
+                        builder[$"sbom_blast_meta_{kvp.Key}"] = kvp.Value;
+                    }
+                }
+            }
+
+            if (!sbom.Metadata.IsEmpty)
+            {
+                foreach (var kvp in sbom.Metadata.OrderBy(pair => pair.Key, StringComparer.Ordinal))
+                {
+                    builder[$"sbom_meta_{kvp.Key}"] = kvp.Value;
+                }
+            }
+        }
+
+        if (dependency is not null)
+        {
+            foreach (var kvp in dependency.Metadata.OrderBy(pair => pair.Key, StringComparer.Ordinal))
+            {
+                builder[$"dependency_{kvp.Key}"] = kvp.Value;
+            }
         }
 
         return builder.ToImmutable();
@@ -249,177 +249,177 @@ internal sealed class AdvisoryPipelineOrchestrator : IAdvisoryPipelineOrchestrat
     }
 
     private static string ComputeCacheKey(
-        AdvisoryTaskRequest request,
-        AdvisoryRetrievalResult structured,
-        ImmutableArray<AdvisoryVectorResult> vectors,
-        SbomContextResult? sbom,
-        DependencyAnalysisResult? dependency)
-    {
-        var builder = new StringBuilder();
-        builder.Append(request.TaskType)
-               .Append('|').Append(request.AdvisoryKey)
-               .Append('|').Append(request.ArtifactId ?? string.Empty)
-               .Append('|').Append(request.PolicyVersion ?? string.Empty)
-               .Append('|').Append(request.Profile);
-
-        if (request.PreferredSections is not null)
-        {
-            foreach (var section in request.PreferredSections.OrderBy(s => s, StringComparer.OrdinalIgnoreCase))
-            {
-                builder.Append('|').Append(section);
-            }
-        }
-
-        foreach (var chunkId in structured.Chunks
-                     .Select(chunk => chunk.ChunkId)
-                     .OrderBy(id => id, StringComparer.Ordinal))
-        {
-            builder.Append("|chunk:").Append(chunkId);
-        }
-
-        foreach (var vector in vectors)
-        {
-            builder.Append("|query:").Append(vector.Query);
-            foreach (var match in vector.Matches
-                         .OrderBy(m => m.ChunkId, StringComparer.Ordinal)
-                         .ThenBy(m => m.Score))
-            {
-                builder.Append("|match:")
-                       .Append(match.ChunkId)
-                       .Append('@')
-                       .Append(match.Score.ToString("G", CultureInfo.InvariantCulture));
-            }
-        }
-
-        if (sbom is not null)
-        {
+        AdvisoryTaskRequest request,
+        AdvisoryRetrievalResult structured,
+        ImmutableArray<AdvisoryVectorResult> vectors,
+        SbomContextResult? sbom,
+        DependencyAnalysisResult? dependency)
+    {
+        var builder = new StringBuilder();
+        builder.Append(request.TaskType)
+               .Append('|').Append(request.AdvisoryKey)
+               .Append('|').Append(request.ArtifactId ?? string.Empty)
+               .Append('|').Append(request.PolicyVersion ?? string.Empty)
+               .Append('|').Append(request.Profile);
+
+        if (request.PreferredSections is not null)
+        {
+            foreach (var section in request.PreferredSections.OrderBy(s => s, StringComparer.OrdinalIgnoreCase))
+            {
+                builder.Append('|').Append(section);
+            }
+        }
+
+        foreach (var chunkId in structured.Chunks
+                     .Select(chunk => chunk.ChunkId)
+                     .OrderBy(id => id, StringComparer.Ordinal))
+        {
+            builder.Append("|chunk:").Append(chunkId);
+        }
+
+        foreach (var vector in vectors)
+        {
+            builder.Append("|query:").Append(vector.Query);
+            foreach (var match in vector.Matches
+                         .OrderBy(m => m.ChunkId, StringComparer.Ordinal)
+                         .ThenBy(m => m.Score))
+            {
+                builder.Append("|match:")
+                       .Append(match.ChunkId)
+                       .Append('@')
+                       .Append(match.Score.ToString("G", CultureInfo.InvariantCulture));
+            }
+        }
+
+        if (sbom is not null)
+        {
             builder.Append("|sbom:timeline=").Append(sbom.VersionTimeline.Length);
             builder.Append("|sbom:paths=").Append(sbom.DependencyPaths.Length);
-            foreach (var entry in sbom.VersionTimeline
-                         .OrderBy(e => e.Version, StringComparer.Ordinal)
-                         .ThenBy(e => e.FirstObserved.ToUnixTimeMilliseconds())
-                         .ThenBy(e => e.LastObserved?.ToUnixTimeMilliseconds() ?? long.MinValue)
-                         .ThenBy(e => e.Status, StringComparer.Ordinal)
-                         .ThenBy(e => e.Source, StringComparer.Ordinal))
-            {
-                builder.Append("|timeline:")
-                       .Append(entry.Version)
-                       .Append('@')
-                       .Append(entry.FirstObserved.ToUnixTimeMilliseconds())
-                       .Append('@')
-                       .Append(entry.LastObserved?.ToUnixTimeMilliseconds() ?? -1)
-                       .Append('@')
-                       .Append(entry.Status)
-                       .Append('@')
-                       .Append(entry.Source);
-            }
-
-            foreach (var path in sbom.DependencyPaths
-                         .OrderBy(path => path.IsRuntime)
-                         .ThenBy(path => string.Join(">", path.Nodes.Select(node => node.Identifier)), StringComparer.Ordinal))
-            {
-                builder.Append("|path:")
-                       .Append(path.IsRuntime ? 'R' : 'D');
-
-                foreach (var node in path.Nodes)
-                {
-                    builder.Append(":")
-                           .Append(node.Identifier)
-                           .Append('@')
-                           .Append(node.Version ?? string.Empty);
-                }
-
-                if (!string.IsNullOrWhiteSpace(path.Source))
-                {
-                    builder.Append("|pathsrc:").Append(path.Source);
-                }
-
-                if (!path.Metadata.IsEmpty)
-                {
-                    foreach (var kvp in path.Metadata.OrderBy(pair => pair.Key, StringComparer.Ordinal))
-                    {
-                        builder.Append("|pathmeta:")
-                               .Append(kvp.Key)
-                               .Append('=')
-                               .Append(kvp.Value);
-                    }
-                }
-            }
-
-            if (!sbom.EnvironmentFlags.IsEmpty)
-            {
-                foreach (var flag in sbom.EnvironmentFlags.OrderBy(pair => pair.Key, StringComparer.Ordinal))
-                {
-                    builder.Append("|env:")
-                           .Append(flag.Key)
-                           .Append('=')
-                           .Append(flag.Value);
-                }
-            }
-
-            if (sbom.BlastRadius is not null)
-            {
-                builder.Append("|blast:")
-                       .Append(sbom.BlastRadius.ImpactedAssets)
-                       .Append(',')
-                       .Append(sbom.BlastRadius.ImpactedWorkloads)
-                       .Append(',')
-                       .Append(sbom.BlastRadius.ImpactedNamespaces)
-                       .Append(',')
-                       .Append(sbom.BlastRadius.ImpactedPercentage?.ToString("G", CultureInfo.InvariantCulture) ?? string.Empty);
-
-                if (!sbom.BlastRadius.Metadata.IsEmpty)
-                {
-                    foreach (var kvp in sbom.BlastRadius.Metadata.OrderBy(pair => pair.Key, StringComparer.Ordinal))
-                    {
-                        builder.Append("|blastmeta:")
-                               .Append(kvp.Key)
-                               .Append('=')
-                               .Append(kvp.Value);
-                    }
-                }
-            }
-
-            if (!sbom.Metadata.IsEmpty)
-            {
-                foreach (var kvp in sbom.Metadata.OrderBy(pair => pair.Key, StringComparer.Ordinal))
-                {
-                    builder.Append("|sbommeta:")
-                           .Append(kvp.Key)
-                           .Append('=')
-                           .Append(kvp.Value);
-                }
-            }
-        }
-
-        if (dependency is not null)
-        {
-            foreach (var node in dependency.Nodes
-                         .OrderBy(n => n.Identifier, StringComparer.Ordinal))
-            {
-                builder.Append("|dep:")
-                       .Append(node.Identifier)
-                       .Append(':')
-                       .Append(node.RuntimeOccurrences)
-                       .Append(':')
-                       .Append(node.DevelopmentOccurrences)
-                       .Append(':')
-                       .Append(string.Join(',', node.Versions));
-            }
-
-            if (!dependency.Metadata.IsEmpty)
-            {
-                foreach (var kvp in dependency.Metadata.OrderBy(pair => pair.Key, StringComparer.Ordinal))
-                {
-                    builder.Append("|depmeta:")
-                           .Append(kvp.Key)
-                           .Append('=')
-                           .Append(kvp.Value);
-                }
-            }
-        }
-
-        var hash = SHA256.HashData(Encoding.UTF8.GetBytes(builder.ToString()));
-        return Convert.ToHexString(hash);
-    }
-}
+            foreach (var entry in sbom.VersionTimeline
+                         .OrderBy(e => e.Version, StringComparer.Ordinal)
+                         .ThenBy(e => e.FirstObserved.ToUnixTimeMilliseconds())
+                         .ThenBy(e => e.LastObserved?.ToUnixTimeMilliseconds() ?? long.MinValue)
+                         .ThenBy(e => e.Status, StringComparer.Ordinal)
+                         .ThenBy(e => e.Source, StringComparer.Ordinal))
+            {
+                builder.Append("|timeline:")
+                       .Append(entry.Version)
+                       .Append('@')
+                       .Append(entry.FirstObserved.ToUnixTimeMilliseconds())
+                       .Append('@')
+                       .Append(entry.LastObserved?.ToUnixTimeMilliseconds() ?? -1)
+                       .Append('@')
+                       .Append(entry.Status)
+                       .Append('@')
+                       .Append(entry.Source);
+            }
+
+            foreach (var path in sbom.DependencyPaths
+                         .OrderBy(path => path.IsRuntime)
+                         .ThenBy(path => string.Join(">", path.Nodes.Select(node => node.Identifier)), StringComparer.Ordinal))
+            {
+                builder.Append("|path:")
+                       .Append(path.IsRuntime ? 'R' : 'D');
+
+                foreach (var node in path.Nodes)
+                {
+                    builder.Append(":")
+                           .Append(node.Identifier)
+                           .Append('@')
+                           .Append(node.Version ?? string.Empty);
+                }
+
+                if (!string.IsNullOrWhiteSpace(path.Source))
+                {
+                    builder.Append("|pathsrc:").Append(path.Source);
+                }
+
+                if (!path.Metadata.IsEmpty)
+                {
+                    foreach (var kvp in path.Metadata.OrderBy(pair => pair.Key, StringComparer.Ordinal))
+                    {
+                        builder.Append("|pathmeta:")
+                               .Append(kvp.Key)
+                               .Append('=')
+                               .Append(kvp.Value);
+                    }
+                }
+            }
+
+            if (!sbom.EnvironmentFlags.IsEmpty)
+            {
+                foreach (var flag in sbom.EnvironmentFlags.OrderBy(pair => pair.Key, StringComparer.Ordinal))
+                {
+                    builder.Append("|env:")
+                           .Append(flag.Key)
+                           .Append('=')
+                           .Append(flag.Value);
+                }
+            }
+
+            if (sbom.BlastRadius is not null)
+            {
+                builder.Append("|blast:")
+                       .Append(sbom.BlastRadius.ImpactedAssets)
+                       .Append(',')
+                       .Append(sbom.BlastRadius.ImpactedWorkloads)
+                       .Append(',')
+                       .Append(sbom.BlastRadius.ImpactedNamespaces)
+                       .Append(',')
+                       .Append(sbom.BlastRadius.ImpactedPercentage?.ToString("G", CultureInfo.InvariantCulture) ?? string.Empty);
+
+                if (!sbom.BlastRadius.Metadata.IsEmpty)
+                {
+                    foreach (var kvp in sbom.BlastRadius.Metadata.OrderBy(pair => pair.Key, StringComparer.Ordinal))
+                    {
+                        builder.Append("|blastmeta:")
+                               .Append(kvp.Key)
+                               .Append('=')
+                               .Append(kvp.Value);
+                    }
+                }
+            }
+
+            if (!sbom.Metadata.IsEmpty)
+            {
+                foreach (var kvp in sbom.Metadata.OrderBy(pair => pair.Key, StringComparer.Ordinal))
+                {
+                    builder.Append("|sbommeta:")
+                           .Append(kvp.Key)
+                           .Append('=')
+                           .Append(kvp.Value);
+                }
+            }
+        }
+
+        if (dependency is not null)
+        {
+            foreach (var node in dependency.Nodes
+                         .OrderBy(n => n.Identifier, StringComparer.Ordinal))
+            {
+                builder.Append("|dep:")
+                       .Append(node.Identifier)
+                       .Append(':')
+                       .Append(node.RuntimeOccurrences)
+                       .Append(':')
+                       .Append(node.DevelopmentOccurrences)
+                       .Append(':')
+                       .Append(string.Join(',', node.Versions));
+            }
+
+            if (!dependency.Metadata.IsEmpty)
+            {
+                foreach (var kvp in dependency.Metadata.OrderBy(pair => pair.Key, StringComparer.Ordinal))
+                {
+                    builder.Append("|depmeta:")
+                           .Append(kvp.Key)
+                           .Append('=')
+                           .Append(kvp.Value);
+                }
+            }
+        }
+
+        var hash = SHA256.HashData(Encoding.UTF8.GetBytes(builder.ToString()));
+        return Convert.ToHexString(hash);
+    }
+}

src/AdvisoryAI/StellaOps.AdvisoryAI/Orchestration/AdvisoryTaskPlan.cs

@@ -1,70 +1,70 @@
-using System.Collections.Immutable;
+using System.Collections.Immutable;
 using StellaOps.AdvisoryAI.Abstractions;
 using StellaOps.AdvisoryAI.Context;
 using StellaOps.AdvisoryAI.Documents;
 using StellaOps.AdvisoryAI.Tools;
-
-namespace StellaOps.AdvisoryAI.Orchestration;
-
-public sealed class AdvisoryTaskPlan
-{
-    public AdvisoryTaskPlan(
-        AdvisoryTaskRequest request,
-        string cacheKey,
-        string promptTemplate,
-        ImmutableArray<AdvisoryChunk> structuredChunks,
-        ImmutableArray<AdvisoryVectorResult> vectorResults,
-        SbomContextResult? sbomContext,
-        DependencyAnalysisResult? dependencyAnalysis,
+
+namespace StellaOps.AdvisoryAI.Orchestration;
+
+public sealed class AdvisoryTaskPlan
+{
+    public AdvisoryTaskPlan(
+        AdvisoryTaskRequest request,
+        string cacheKey,
+        string promptTemplate,
+        ImmutableArray<AdvisoryChunk> structuredChunks,
+        ImmutableArray<AdvisoryVectorResult> vectorResults,
+        SbomContextResult? sbomContext,
+        DependencyAnalysisResult? dependencyAnalysis,
         AdvisoryTaskBudget budget,
         ImmutableDictionary<string, string> metadata)
-    {
-        Request = request ?? throw new ArgumentNullException(nameof(request));
-        CacheKey = cacheKey ?? throw new ArgumentNullException(nameof(cacheKey));
-        PromptTemplate = promptTemplate ?? throw new ArgumentNullException(nameof(promptTemplate));
-        StructuredChunks = structuredChunks;
-        VectorResults = vectorResults;
-        SbomContext = sbomContext;
-        DependencyAnalysis = dependencyAnalysis;
-        Budget = budget ?? throw new ArgumentNullException(nameof(budget));
-        Metadata = metadata ?? throw new ArgumentNullException(nameof(metadata));
-    }
-
-    public AdvisoryTaskRequest Request { get; }
-
-    public string CacheKey { get; }
-
-    public string PromptTemplate { get; }
-
-    public ImmutableArray<AdvisoryChunk> StructuredChunks { get; }
-
-    public ImmutableArray<AdvisoryVectorResult> VectorResults { get; }
-
-    public SbomContextResult? SbomContext { get; }
-
-    public DependencyAnalysisResult? DependencyAnalysis { get; }
-
-    public AdvisoryTaskBudget Budget { get; }
-
+    {
+        Request = request ?? throw new ArgumentNullException(nameof(request));
+        CacheKey = cacheKey ?? throw new ArgumentNullException(nameof(cacheKey));
+        PromptTemplate = promptTemplate ?? throw new ArgumentNullException(nameof(promptTemplate));
+        StructuredChunks = structuredChunks;
+        VectorResults = vectorResults;
+        SbomContext = sbomContext;
+        DependencyAnalysis = dependencyAnalysis;
+        Budget = budget ?? throw new ArgumentNullException(nameof(budget));
+        Metadata = metadata ?? throw new ArgumentNullException(nameof(metadata));
+    }
+
+    public AdvisoryTaskRequest Request { get; }
+
+    public string CacheKey { get; }
+
+    public string PromptTemplate { get; }
+
+    public ImmutableArray<AdvisoryChunk> StructuredChunks { get; }
+
+    public ImmutableArray<AdvisoryVectorResult> VectorResults { get; }
+
+    public SbomContextResult? SbomContext { get; }
+
+    public DependencyAnalysisResult? DependencyAnalysis { get; }
+
+    public AdvisoryTaskBudget Budget { get; }
+
     public ImmutableDictionary<string, string> Metadata { get; }
-}
-
-public sealed class AdvisoryVectorResult
-{
-    public AdvisoryVectorResult(string query, ImmutableArray<VectorRetrievalMatch> matches)
-    {
-        Query = string.IsNullOrWhiteSpace(query) ? throw new ArgumentException(nameof(query)) : query;
-        Matches = matches;
-    }
-
-    public string Query { get; }
-
-    public ImmutableArray<VectorRetrievalMatch> Matches { get; }
-}
-
-public sealed class AdvisoryTaskBudget
-{
-    public int PromptTokens { get; init; } = 2048;
-
-    public int CompletionTokens { get; init; } = 512;
-}
+}
+
+public sealed class AdvisoryVectorResult
+{
+    public AdvisoryVectorResult(string query, ImmutableArray<VectorRetrievalMatch> matches)
+    {
+        Query = string.IsNullOrWhiteSpace(query) ? throw new ArgumentException(nameof(query)) : query;
+        Matches = matches;
+    }
+
+    public string Query { get; }
+
+    public ImmutableArray<VectorRetrievalMatch> Matches { get; }
+}
+
+public sealed class AdvisoryTaskBudget
+{
+    public int PromptTokens { get; init; } = 2048;
+
+    public int CompletionTokens { get; init; } = 512;
+}