up

src/Attestor/StellaOps.Attestor/StellaOps.Attestor.Core/Audit/AttestorAuditRecord.cs

@@ -1,42 +1,42 @@
-using System;
-using System.Collections.Generic;
-
-namespace StellaOps.Attestor.Core.Audit;
-
-public sealed class AttestorAuditRecord
-{
-    public string Action { get; init; } = string.Empty;
-
-    public string Result { get; init; } = string.Empty;
-
-    public string? RekorUuid { get; init; }
-
-    public long? Index { get; init; }
-
-    public string ArtifactSha256 { get; init; } = string.Empty;
-
-    public string BundleSha256 { get; init; } = string.Empty;
-
-    public string Backend { get; init; } = string.Empty;
-
-    public long LatencyMs { get; init; }
-
-    public DateTimeOffset Timestamp { get; init; } = DateTimeOffset.UtcNow;
-
-    public CallerDescriptor Caller { get; init; } = new();
-
-    public IDictionary<string, string> Metadata { get; init; } = new Dictionary<string, string>();
-
-    public sealed class CallerDescriptor
-    {
-        public string? Subject { get; init; }
-
-        public string? Audience { get; init; }
-
-        public string? ClientId { get; init; }
-
-        public string? MtlsThumbprint { get; init; }
-
-        public string? Tenant { get; init; }
-    }
-}
+using System;
+using System.Collections.Generic;
+
+namespace StellaOps.Attestor.Core.Audit;
+
+public sealed class AttestorAuditRecord
+{
+    public string Action { get; init; } = string.Empty;
+
+    public string Result { get; init; } = string.Empty;
+
+    public string? RekorUuid { get; init; }
+
+    public long? Index { get; init; }
+
+    public string ArtifactSha256 { get; init; } = string.Empty;
+
+    public string BundleSha256 { get; init; } = string.Empty;
+
+    public string Backend { get; init; } = string.Empty;
+
+    public long LatencyMs { get; init; }
+
+    public DateTimeOffset Timestamp { get; init; } = DateTimeOffset.UtcNow;
+
+    public CallerDescriptor Caller { get; init; } = new();
+
+    public IDictionary<string, string> Metadata { get; init; } = new Dictionary<string, string>();
+
+    public sealed class CallerDescriptor
+    {
+        public string? Subject { get; init; }
+
+        public string? Audience { get; init; }
+
+        public string? ClientId { get; init; }
+
+        public string? MtlsThumbprint { get; init; }
+
+        public string? Tenant { get; init; }
+    }
+}

src/Attestor/StellaOps.Attestor/StellaOps.Attestor.Core/Rekor/IRekorClient.cs

@@ -1,18 +1,18 @@
-using System.Threading;
-using System.Threading.Tasks;
-using StellaOps.Attestor.Core.Submission;
-
-namespace StellaOps.Attestor.Core.Rekor;
-
-public interface IRekorClient
-{
-    Task<RekorSubmissionResponse> SubmitAsync(
-        AttestorSubmissionRequest request,
-        RekorBackend backend,
-        CancellationToken cancellationToken = default);
-
-    Task<RekorProofResponse?> GetProofAsync(
-        string rekorUuid,
-        RekorBackend backend,
-        CancellationToken cancellationToken = default);
-}
+using System.Threading;
+using System.Threading.Tasks;
+using StellaOps.Attestor.Core.Submission;
+
+namespace StellaOps.Attestor.Core.Rekor;
+
+public interface IRekorClient
+{
+    Task<RekorSubmissionResponse> SubmitAsync(
+        AttestorSubmissionRequest request,
+        RekorBackend backend,
+        CancellationToken cancellationToken = default);
+
+    Task<RekorProofResponse?> GetProofAsync(
+        string rekorUuid,
+        RekorBackend backend,
+        CancellationToken cancellationToken = default);
+}

src/Attestor/StellaOps.Attestor/StellaOps.Attestor.Core/Rekor/RekorBackend.cs

@@ -1,16 +1,16 @@
-using System;
-
-namespace StellaOps.Attestor.Core.Rekor;
-
-public sealed class RekorBackend
-{
-    public required string Name { get; init; }
-
-    public required Uri Url { get; init; }
-
-    public TimeSpan ProofTimeout { get; init; } = TimeSpan.FromSeconds(15);
-
-    public TimeSpan PollInterval { get; init; } = TimeSpan.FromMilliseconds(250);
-
-    public int MaxAttempts { get; init; } = 60;
-}
+using System;
+
+namespace StellaOps.Attestor.Core.Rekor;
+
+public sealed class RekorBackend
+{
+    public required string Name { get; init; }
+
+    public required Uri Url { get; init; }
+
+    public TimeSpan ProofTimeout { get; init; } = TimeSpan.FromSeconds(15);
+
+    public TimeSpan PollInterval { get; init; } = TimeSpan.FromMilliseconds(250);
+
+    public int MaxAttempts { get; init; } = 60;
+}

src/Attestor/StellaOps.Attestor/StellaOps.Attestor.Core/Rekor/RekorProofResponse.cs

@@ -1,38 +1,38 @@
-using System;
-using System.Collections.Generic;
-using System.Text.Json.Serialization;
-
-namespace StellaOps.Attestor.Core.Rekor;
-
-public sealed class RekorProofResponse
-{
-    [JsonPropertyName("checkpoint")]
-    public RekorCheckpoint? Checkpoint { get; set; }
-
-    [JsonPropertyName("inclusion")]
-    public RekorInclusionProof? Inclusion { get; set; }
-
-    public sealed class RekorCheckpoint
-    {
-        [JsonPropertyName("origin")]
-        public string? Origin { get; set; }
-
-        [JsonPropertyName("size")]
-        public long Size { get; set; }
-
-        [JsonPropertyName("rootHash")]
-        public string? RootHash { get; set; }
-
-        [JsonPropertyName("timestamp")]
-        public DateTimeOffset? Timestamp { get; set; }
-    }
-
-    public sealed class RekorInclusionProof
-    {
-        [JsonPropertyName("leafHash")]
-        public string? LeafHash { get; set; }
-
-        [JsonPropertyName("path")]
-        public IReadOnlyList<string> Path { get; set; } = Array.Empty<string>();
-    }
-}
+using System;
+using System.Collections.Generic;
+using System.Text.Json.Serialization;
+
+namespace StellaOps.Attestor.Core.Rekor;
+
+public sealed class RekorProofResponse
+{
+    [JsonPropertyName("checkpoint")]
+    public RekorCheckpoint? Checkpoint { get; set; }
+
+    [JsonPropertyName("inclusion")]
+    public RekorInclusionProof? Inclusion { get; set; }
+
+    public sealed class RekorCheckpoint
+    {
+        [JsonPropertyName("origin")]
+        public string? Origin { get; set; }
+
+        [JsonPropertyName("size")]
+        public long Size { get; set; }
+
+        [JsonPropertyName("rootHash")]
+        public string? RootHash { get; set; }
+
+        [JsonPropertyName("timestamp")]
+        public DateTimeOffset? Timestamp { get; set; }
+    }
+
+    public sealed class RekorInclusionProof
+    {
+        [JsonPropertyName("leafHash")]
+        public string? LeafHash { get; set; }
+
+        [JsonPropertyName("path")]
+        public IReadOnlyList<string> Path { get; set; } = Array.Empty<string>();
+    }
+}

src/Attestor/StellaOps.Attestor/StellaOps.Attestor.Core/Rekor/RekorSubmissionResponse.cs

@@ -1,21 +1,21 @@
-using System.Text.Json.Serialization;
-
-namespace StellaOps.Attestor.Core.Rekor;
-
-public sealed class RekorSubmissionResponse
-{
-    [JsonPropertyName("uuid")]
-    public string Uuid { get; set; } = string.Empty;
-
-    [JsonPropertyName("index")]
-    public long? Index { get; set; }
-
-    [JsonPropertyName("logURL")]
-    public string? LogUrl { get; set; }
-
-    [JsonPropertyName("status")]
-    public string Status { get; set; } = "included";
-
-    [JsonPropertyName("proof")]
-    public RekorProofResponse? Proof { get; set; }
-}
+using System.Text.Json.Serialization;
+
+namespace StellaOps.Attestor.Core.Rekor;
+
+public sealed class RekorSubmissionResponse
+{
+    [JsonPropertyName("uuid")]
+    public string Uuid { get; set; } = string.Empty;
+
+    [JsonPropertyName("index")]
+    public long? Index { get; set; }
+
+    [JsonPropertyName("logURL")]
+    public string? LogUrl { get; set; }
+
+    [JsonPropertyName("status")]
+    public string Status { get; set; } = "included";
+
+    [JsonPropertyName("proof")]
+    public RekorProofResponse? Proof { get; set; }
+}

src/Attestor/StellaOps.Attestor/StellaOps.Attestor.Core/Storage/AttestorArchiveBundle.cs

@@ -1,19 +1,19 @@
-using System;
-using System.Collections.Generic;
-
-namespace StellaOps.Attestor.Core.Storage;
-
-public sealed class AttestorArchiveBundle
-{
-    public string RekorUuid { get; init; } = string.Empty;
-
-    public string ArtifactSha256 { get; init; } = string.Empty;
-
-    public string BundleSha256 { get; init; } = string.Empty;
-
-    public byte[] CanonicalBundleJson { get; init; } = Array.Empty<byte>();
-
-    public byte[] ProofJson { get; init; } = Array.Empty<byte>();
-
-    public IReadOnlyDictionary<string, string> Metadata { get; init; } = new Dictionary<string, string>();
-}
+using System;
+using System.Collections.Generic;
+
+namespace StellaOps.Attestor.Core.Storage;
+
+public sealed class AttestorArchiveBundle
+{
+    public string RekorUuid { get; init; } = string.Empty;
+
+    public string ArtifactSha256 { get; init; } = string.Empty;
+
+    public string BundleSha256 { get; init; } = string.Empty;
+
+    public byte[] CanonicalBundleJson { get; init; } = Array.Empty<byte>();
+
+    public byte[] ProofJson { get; init; } = Array.Empty<byte>();
+
+    public IReadOnlyDictionary<string, string> Metadata { get; init; } = new Dictionary<string, string>();
+}

src/Attestor/StellaOps.Attestor/StellaOps.Attestor.Core/Storage/IAttestorArchiveStore.cs

@@ -1,8 +1,8 @@
-using System.Threading;
-using System.Threading.Tasks;
-
-namespace StellaOps.Attestor.Core.Storage;
-
+using System.Threading;
+using System.Threading.Tasks;
+
+namespace StellaOps.Attestor.Core.Storage;
+
 public interface IAttestorArchiveStore
 {
     Task ArchiveBundleAsync(AttestorArchiveBundle bundle, CancellationToken cancellationToken = default);

src/Attestor/StellaOps.Attestor/StellaOps.Attestor.Core/Storage/IAttestorAuditSink.cs

@@ -1,10 +1,10 @@
-using StellaOps.Attestor.Core.Audit;
-using System.Threading;
-using System.Threading.Tasks;
-
-namespace StellaOps.Attestor.Core.Storage;
-
-public interface IAttestorAuditSink
-{
-    Task WriteAsync(AttestorAuditRecord record, CancellationToken cancellationToken = default);
-}
+using StellaOps.Attestor.Core.Audit;
+using System.Threading;
+using System.Threading.Tasks;
+
+namespace StellaOps.Attestor.Core.Storage;
+
+public interface IAttestorAuditSink
+{
+    Task WriteAsync(AttestorAuditRecord record, CancellationToken cancellationToken = default);
+}

src/Attestor/StellaOps.Attestor/StellaOps.Attestor.Core/Storage/IAttestorDedupeStore.cs

@@ -1,12 +1,12 @@
-using System;
-using System.Threading;
-using System.Threading.Tasks;
-
-namespace StellaOps.Attestor.Core.Storage;
-
-public interface IAttestorDedupeStore
-{
-    Task<string?> TryGetExistingAsync(string bundleSha256, CancellationToken cancellationToken = default);
-
-    Task SetAsync(string bundleSha256, string rekorUuid, TimeSpan ttl, CancellationToken cancellationToken = default);
-}
+using System;
+using System.Threading;
+using System.Threading.Tasks;
+
+namespace StellaOps.Attestor.Core.Storage;
+
+public interface IAttestorDedupeStore
+{
+    Task<string?> TryGetExistingAsync(string bundleSha256, CancellationToken cancellationToken = default);
+
+    Task SetAsync(string bundleSha256, string rekorUuid, TimeSpan ttl, CancellationToken cancellationToken = default);
+}

src/Attestor/StellaOps.Attestor/StellaOps.Attestor.Core/Storage/IAttestorEntryRepository.cs

@@ -1,13 +1,13 @@
-using System.Collections.Generic;
-using System.Threading;
-using System.Threading.Tasks;
-
-namespace StellaOps.Attestor.Core.Storage;
-
-public interface IAttestorEntryRepository
-{
-    Task<AttestorEntry?> GetByBundleShaAsync(string bundleSha256, CancellationToken cancellationToken = default);
-
+using System.Collections.Generic;
+using System.Threading;
+using System.Threading.Tasks;
+
+namespace StellaOps.Attestor.Core.Storage;
+
+public interface IAttestorEntryRepository
+{
+    Task<AttestorEntry?> GetByBundleShaAsync(string bundleSha256, CancellationToken cancellationToken = default);
+
     Task<AttestorEntry?> GetByUuidAsync(string rekorUuid, CancellationToken cancellationToken = default);
 
     Task<IReadOnlyList<AttestorEntry>> GetByArtifactShaAsync(string artifactSha256, CancellationToken cancellationToken = default);

src/Attestor/StellaOps.Attestor/StellaOps.Attestor.Core/Submission/AttestorSubmissionRequest.cs

@@ -1,79 +1,79 @@
-using System.Collections.Generic;
-using System.Text.Json.Serialization;
-
-namespace StellaOps.Attestor.Core.Submission;
-
-/// <summary>
-/// Incoming submission payload for <c>/api/v1/rekor/entries</c>.
-/// </summary>
-public sealed class AttestorSubmissionRequest
-{
-    [JsonPropertyName("bundle")]
-    public SubmissionBundle Bundle { get; set; } = new();
-
-    [JsonPropertyName("meta")]
-    public SubmissionMeta Meta { get; set; } = new();
-
-    public sealed class SubmissionBundle
-    {
-        [JsonPropertyName("dsse")]
-        public DsseEnvelope Dsse { get; set; } = new();
-
-        [JsonPropertyName("certificateChain")]
-        public IList<string> CertificateChain { get; set; } = new List<string>();
-
-        [JsonPropertyName("mode")]
-        public string Mode { get; set; } = "keyless";
-    }
-
-    public sealed class DsseEnvelope
-    {
-        [JsonPropertyName("payloadType")]
-        public string PayloadType { get; set; } = string.Empty;
-
-        [JsonPropertyName("payload")]
-        public string PayloadBase64 { get; set; } = string.Empty;
-
-        [JsonPropertyName("signatures")]
-        public IList<DsseSignature> Signatures { get; set; } = new List<DsseSignature>();
-    }
-
-    public sealed class DsseSignature
-    {
-        [JsonPropertyName("keyid")]
-        public string? KeyId { get; set; }
-
-        [JsonPropertyName("sig")]
-        public string Signature { get; set; } = string.Empty;
-    }
-
-    public sealed class SubmissionMeta
-    {
-        [JsonPropertyName("artifact")]
-        public ArtifactInfo Artifact { get; set; } = new();
-
-        [JsonPropertyName("bundleSha256")]
-        public string BundleSha256 { get; set; } = string.Empty;
-
-        [JsonPropertyName("logPreference")]
-        public string LogPreference { get; set; } = "primary";
-
-        [JsonPropertyName("archive")]
-        public bool Archive { get; set; } = true;
-    }
-
-    public sealed class ArtifactInfo
-    {
-        [JsonPropertyName("sha256")]
-        public string Sha256 { get; set; } = string.Empty;
-
-        [JsonPropertyName("kind")]
-        public string Kind { get; set; } = string.Empty;
-
-        [JsonPropertyName("imageDigest")]
-        public string? ImageDigest { get; set; }
-
-        [JsonPropertyName("subjectUri")]
-        public string? SubjectUri { get; set; }
-    }
-}
+using System.Collections.Generic;
+using System.Text.Json.Serialization;
+
+namespace StellaOps.Attestor.Core.Submission;
+
+/// <summary>
+/// Incoming submission payload for <c>/api/v1/rekor/entries</c>.
+/// </summary>
+public sealed class AttestorSubmissionRequest
+{
+    [JsonPropertyName("bundle")]
+    public SubmissionBundle Bundle { get; set; } = new();
+
+    [JsonPropertyName("meta")]
+    public SubmissionMeta Meta { get; set; } = new();
+
+    public sealed class SubmissionBundle
+    {
+        [JsonPropertyName("dsse")]
+        public DsseEnvelope Dsse { get; set; } = new();
+
+        [JsonPropertyName("certificateChain")]
+        public IList<string> CertificateChain { get; set; } = new List<string>();
+
+        [JsonPropertyName("mode")]
+        public string Mode { get; set; } = "keyless";
+    }
+
+    public sealed class DsseEnvelope
+    {
+        [JsonPropertyName("payloadType")]
+        public string PayloadType { get; set; } = string.Empty;
+
+        [JsonPropertyName("payload")]
+        public string PayloadBase64 { get; set; } = string.Empty;
+
+        [JsonPropertyName("signatures")]
+        public IList<DsseSignature> Signatures { get; set; } = new List<DsseSignature>();
+    }
+
+    public sealed class DsseSignature
+    {
+        [JsonPropertyName("keyid")]
+        public string? KeyId { get; set; }
+
+        [JsonPropertyName("sig")]
+        public string Signature { get; set; } = string.Empty;
+    }
+
+    public sealed class SubmissionMeta
+    {
+        [JsonPropertyName("artifact")]
+        public ArtifactInfo Artifact { get; set; } = new();
+
+        [JsonPropertyName("bundleSha256")]
+        public string BundleSha256 { get; set; } = string.Empty;
+
+        [JsonPropertyName("logPreference")]
+        public string LogPreference { get; set; } = "primary";
+
+        [JsonPropertyName("archive")]
+        public bool Archive { get; set; } = true;
+    }
+
+    public sealed class ArtifactInfo
+    {
+        [JsonPropertyName("sha256")]
+        public string Sha256 { get; set; } = string.Empty;
+
+        [JsonPropertyName("kind")]
+        public string Kind { get; set; } = string.Empty;
+
+        [JsonPropertyName("imageDigest")]
+        public string? ImageDigest { get; set; }
+
+        [JsonPropertyName("subjectUri")]
+        public string? SubjectUri { get; set; }
+    }
+}

src/Attestor/StellaOps.Attestor/StellaOps.Attestor.Core/Submission/AttestorSubmissionValidationResult.cs

@@ -1,11 +1,11 @@
-namespace StellaOps.Attestor.Core.Submission;
-
-public sealed class AttestorSubmissionValidationResult
-{
-    public AttestorSubmissionValidationResult(byte[] canonicalBundle)
-    {
-        CanonicalBundle = canonicalBundle;
-    }
-
-    public byte[] CanonicalBundle { get; }
-}
+namespace StellaOps.Attestor.Core.Submission;
+
+public sealed class AttestorSubmissionValidationResult
+{
+    public AttestorSubmissionValidationResult(byte[] canonicalBundle)
+    {
+        CanonicalBundle = canonicalBundle;
+    }
+
+    public byte[] CanonicalBundle { get; }
+}

src/Attestor/StellaOps.Attestor/StellaOps.Attestor.Core/Submission/AttestorSubmissionValidator.cs

@@ -1,17 +1,17 @@
-using System;
-using System.Buffers.Text;
-using System.Security.Cryptography;
-using System.Text;
-using System.Threading;
-using System.Threading.Tasks;
-
-namespace StellaOps.Attestor.Core.Submission;
-
-public sealed class AttestorSubmissionValidator
-{
-    private static readonly string[] AllowedKinds = ["sbom", "report", "vex-export"];
-
-    private readonly IDsseCanonicalizer _canonicalizer;
+using System;
+using System.Buffers.Text;
+using System.Security.Cryptography;
+using System.Text;
+using System.Threading;
+using System.Threading.Tasks;
+
+namespace StellaOps.Attestor.Core.Submission;
+
+public sealed class AttestorSubmissionValidator
+{
+    private static readonly string[] AllowedKinds = ["sbom", "report", "vex-export"];
+
+    private readonly IDsseCanonicalizer _canonicalizer;
     private readonly HashSet<string> _allowedModes;
     private readonly AttestorSubmissionConstraints _constraints;
 
@@ -30,23 +30,23 @@ public sealed class AttestorSubmissionValidator
     public async Task<AttestorSubmissionValidationResult> ValidateAsync(AttestorSubmissionRequest request, CancellationToken cancellationToken = default)
     {
         ArgumentNullException.ThrowIfNull(request);
-
-        if (request.Bundle is null)
-        {
-            throw new AttestorValidationException("bundle_missing", "Submission bundle payload is required.");
-        }
-
-        if (request.Bundle.Dsse is null)
-        {
-            throw new AttestorValidationException("dsse_missing", "DSSE envelope is required.");
-        }
-
-        if (string.IsNullOrWhiteSpace(request.Bundle.Dsse.PayloadType))
-        {
-            throw new AttestorValidationException("payload_type_missing", "DSSE payloadType is required.");
-        }
-
-        if (string.IsNullOrWhiteSpace(request.Bundle.Dsse.PayloadBase64))
+
+        if (request.Bundle is null)
+        {
+            throw new AttestorValidationException("bundle_missing", "Submission bundle payload is required.");
+        }
+
+        if (request.Bundle.Dsse is null)
+        {
+            throw new AttestorValidationException("dsse_missing", "DSSE envelope is required.");
+        }
+
+        if (string.IsNullOrWhiteSpace(request.Bundle.Dsse.PayloadType))
+        {
+            throw new AttestorValidationException("payload_type_missing", "DSSE payloadType is required.");
+        }
+
+        if (string.IsNullOrWhiteSpace(request.Bundle.Dsse.PayloadBase64))
         {
             throw new AttestorValidationException("payload_missing", "DSSE payload must be provided.");
         }
@@ -66,36 +66,36 @@ public sealed class AttestorSubmissionValidator
             throw new AttestorValidationException("mode_not_allowed", $"Submission mode '{request.Bundle.Mode}' is not permitted.");
         }
 
-        if (request.Meta is null)
-        {
-            throw new AttestorValidationException("meta_missing", "Submission metadata is required.");
-        }
-
-        if (request.Meta.Artifact is null)
-        {
-            throw new AttestorValidationException("artifact_missing", "Artifact metadata is required.");
-        }
-
-        if (string.IsNullOrWhiteSpace(request.Meta.Artifact.Sha256))
-        {
-            throw new AttestorValidationException("artifact_sha_missing", "Artifact sha256 is required.");
-        }
-
-        if (!IsHex(request.Meta.Artifact.Sha256, expectedLength: 64))
-        {
-            throw new AttestorValidationException("artifact_sha_invalid", "Artifact sha256 must be a 64-character hex string.");
-        }
-
-        if (string.IsNullOrWhiteSpace(request.Meta.BundleSha256))
-        {
-            throw new AttestorValidationException("bundle_sha_missing", "bundleSha256 is required.");
-        }
-
-        if (!IsHex(request.Meta.BundleSha256, expectedLength: 64))
-        {
-            throw new AttestorValidationException("bundle_sha_invalid", "bundleSha256 must be a 64-character hex string.");
-        }
-
+        if (request.Meta is null)
+        {
+            throw new AttestorValidationException("meta_missing", "Submission metadata is required.");
+        }
+
+        if (request.Meta.Artifact is null)
+        {
+            throw new AttestorValidationException("artifact_missing", "Artifact metadata is required.");
+        }
+
+        if (string.IsNullOrWhiteSpace(request.Meta.Artifact.Sha256))
+        {
+            throw new AttestorValidationException("artifact_sha_missing", "Artifact sha256 is required.");
+        }
+
+        if (!IsHex(request.Meta.Artifact.Sha256, expectedLength: 64))
+        {
+            throw new AttestorValidationException("artifact_sha_invalid", "Artifact sha256 must be a 64-character hex string.");
+        }
+
+        if (string.IsNullOrWhiteSpace(request.Meta.BundleSha256))
+        {
+            throw new AttestorValidationException("bundle_sha_missing", "bundleSha256 is required.");
+        }
+
+        if (!IsHex(request.Meta.BundleSha256, expectedLength: 64))
+        {
+            throw new AttestorValidationException("bundle_sha_invalid", "bundleSha256 must be a 64-character hex string.");
+        }
+
         if (Array.IndexOf(AllowedKinds, request.Meta.Artifact.Kind) < 0)
         {
             throw new AttestorValidationException("artifact_kind_invalid", $"Artifact kind '{request.Meta.Artifact.Kind}' is not supported.");
@@ -121,77 +121,77 @@ public sealed class AttestorSubmissionValidator
         if (!SHA256.TryHashData(canonical, hash, out _))
         {
             throw new AttestorValidationException("bundle_sha_failure", "Failed to compute canonical bundle hash.");
-        }
-
-        var hashHex = Convert.ToHexString(hash).ToLowerInvariant();
-        if (!string.Equals(hashHex, request.Meta.BundleSha256, StringComparison.OrdinalIgnoreCase))
-        {
-            throw new AttestorValidationException("bundle_sha_mismatch", "bundleSha256 does not match canonical DSSE hash.");
-        }
-
-        if (!string.Equals(request.Meta.LogPreference, "primary", StringComparison.OrdinalIgnoreCase)
-            && !string.Equals(request.Meta.LogPreference, "mirror", StringComparison.OrdinalIgnoreCase)
-            && !string.Equals(request.Meta.LogPreference, "both", StringComparison.OrdinalIgnoreCase))
-        {
-            throw new AttestorValidationException("log_preference_invalid", "logPreference must be 'primary', 'mirror', or 'both'.");
-        }
-
-        return new AttestorSubmissionValidationResult(canonical);
-    }
-
-    private static bool IsHex(string value, int expectedLength)
-    {
-        if (value.Length != expectedLength)
-        {
-            return false;
-        }
-
-        foreach (var ch in value)
-        {
-            var isHex = ch is >= '0' and <= '9' or >= 'a' and <= 'f' or >= 'A' and <= 'F';
-            if (!isHex)
-            {
-                return false;
-            }
-        }
-
-        return true;
-    }
-
-    private static bool Base64UrlDecode(string value, out byte[] bytes)
-    {
-        try
-        {
-            bytes = Convert.FromBase64String(Normalise(value));
-            return true;
-        }
-        catch (FormatException)
-        {
-            bytes = Array.Empty<byte>();
-            return false;
-        }
-    }
-
-    private static string Normalise(string value)
-    {
-        if (value.Contains('-') || value.Contains('_'))
-        {
-            Span<char> buffer = value.ToCharArray();
-            for (var i = 0; i < buffer.Length; i++)
-            {
-                buffer[i] = buffer[i] switch
-                {
-                    '-' => '+',
-                    '_' => '/',
-                    _ => buffer[i]
-                };
-            }
-
-            var padding = 4 - (buffer.Length % 4);
-            return padding == 4 ? new string(buffer) : new string(buffer) + new string('=', padding);
-        }
-
-        return value;
+        }
+
+        var hashHex = Convert.ToHexString(hash).ToLowerInvariant();
+        if (!string.Equals(hashHex, request.Meta.BundleSha256, StringComparison.OrdinalIgnoreCase))
+        {
+            throw new AttestorValidationException("bundle_sha_mismatch", "bundleSha256 does not match canonical DSSE hash.");
+        }
+
+        if (!string.Equals(request.Meta.LogPreference, "primary", StringComparison.OrdinalIgnoreCase)
+            && !string.Equals(request.Meta.LogPreference, "mirror", StringComparison.OrdinalIgnoreCase)
+            && !string.Equals(request.Meta.LogPreference, "both", StringComparison.OrdinalIgnoreCase))
+        {
+            throw new AttestorValidationException("log_preference_invalid", "logPreference must be 'primary', 'mirror', or 'both'.");
+        }
+
+        return new AttestorSubmissionValidationResult(canonical);
+    }
+
+    private static bool IsHex(string value, int expectedLength)
+    {
+        if (value.Length != expectedLength)
+        {
+            return false;
+        }
+
+        foreach (var ch in value)
+        {
+            var isHex = ch is >= '0' and <= '9' or >= 'a' and <= 'f' or >= 'A' and <= 'F';
+            if (!isHex)
+            {
+                return false;
+            }
+        }
+
+        return true;
+    }
+
+    private static bool Base64UrlDecode(string value, out byte[] bytes)
+    {
+        try
+        {
+            bytes = Convert.FromBase64String(Normalise(value));
+            return true;
+        }
+        catch (FormatException)
+        {
+            bytes = Array.Empty<byte>();
+            return false;
+        }
+    }
+
+    private static string Normalise(string value)
+    {
+        if (value.Contains('-') || value.Contains('_'))
+        {
+            Span<char> buffer = value.ToCharArray();
+            for (var i = 0; i < buffer.Length; i++)
+            {
+                buffer[i] = buffer[i] switch
+                {
+                    '-' => '+',
+                    '_' => '/',
+                    _ => buffer[i]
+                };
+            }
+
+            var padding = 4 - (buffer.Length % 4);
+            return padding == 4 ? new string(buffer) : new string(buffer) + new string('=', padding);
+        }
+
+        return value;
     }
 }
 

src/Attestor/StellaOps.Attestor/StellaOps.Attestor.Core/Submission/AttestorValidationException.cs

@@ -1,14 +1,14 @@
-using System;
-
-namespace StellaOps.Attestor.Core.Submission;
-
-public sealed class AttestorValidationException : Exception
-{
-    public AttestorValidationException(string code, string message)
-        : base(message)
-    {
-        Code = code;
-    }
-
-    public string Code { get; }
-}
+using System;
+
+namespace StellaOps.Attestor.Core.Submission;
+
+public sealed class AttestorValidationException : Exception
+{
+    public AttestorValidationException(string code, string message)
+        : base(message)
+    {
+        Code = code;
+    }
+
+    public string Code { get; }
+}

src/Attestor/StellaOps.Attestor/StellaOps.Attestor.Core/Submission/IAttestorSubmissionService.cs

@@ -1,12 +1,12 @@
-using System.Threading;
-using System.Threading.Tasks;
-
-namespace StellaOps.Attestor.Core.Submission;
-
-public interface IAttestorSubmissionService
-{
-    Task<AttestorSubmissionResult> SubmitAsync(
-        AttestorSubmissionRequest request,
-        SubmissionContext context,
-        CancellationToken cancellationToken = default);
-}
+using System.Threading;
+using System.Threading.Tasks;
+
+namespace StellaOps.Attestor.Core.Submission;
+
+public interface IAttestorSubmissionService
+{
+    Task<AttestorSubmissionResult> SubmitAsync(
+        AttestorSubmissionRequest request,
+        SubmissionContext context,
+        CancellationToken cancellationToken = default);
+}

src/Attestor/StellaOps.Attestor/StellaOps.Attestor.Core/Submission/IDsseCanonicalizer.cs

@@ -1,9 +1,9 @@
-using System.Threading;
-using System.Threading.Tasks;
-
-namespace StellaOps.Attestor.Core.Submission;
-
-public interface IDsseCanonicalizer
-{
-    Task<byte[]> CanonicalizeAsync(AttestorSubmissionRequest request, CancellationToken cancellationToken = default);
-}
+using System.Threading;
+using System.Threading.Tasks;
+
+namespace StellaOps.Attestor.Core.Submission;
+
+public interface IDsseCanonicalizer
+{
+    Task<byte[]> CanonicalizeAsync(AttestorSubmissionRequest request, CancellationToken cancellationToken = default);
+}

src/Attestor/StellaOps.Attestor/StellaOps.Attestor.Core/Submission/SubmissionContext.cs

@@ -1,21 +1,21 @@
-using System.Security.Cryptography.X509Certificates;
-
-namespace StellaOps.Attestor.Core.Submission;
-
-/// <summary>
-/// Ambient information about the caller used for policy and audit decisions.
-/// </summary>
-public sealed class SubmissionContext
-{
-    public required string CallerSubject { get; init; }
-
-    public required string CallerAudience { get; init; }
-
-    public required string? CallerClientId { get; init; }
-
-    public required string? CallerTenant { get; init; }
-
-    public X509Certificate2? ClientCertificate { get; init; }
-
-    public string? MtlsThumbprint { get; init; }
-}
+using System.Security.Cryptography.X509Certificates;
+
+namespace StellaOps.Attestor.Core.Submission;
+
+/// <summary>
+/// Ambient information about the caller used for policy and audit decisions.
+/// </summary>
+public sealed class SubmissionContext
+{
+    public required string CallerSubject { get; init; }
+
+    public required string CallerAudience { get; init; }
+
+    public required string? CallerClientId { get; init; }
+
+    public required string? CallerTenant { get; init; }
+
+    public X509Certificate2? ClientCertificate { get; init; }
+
+    public string? MtlsThumbprint { get; init; }
+}

src/Attestor/StellaOps.Attestor/StellaOps.Attestor.Core/Verification/AttestorVerificationException.cs

@@ -1,14 +1,14 @@
-using System;
-
-namespace StellaOps.Attestor.Core.Verification;
-
-public sealed class AttestorVerificationException : Exception
-{
-    public AttestorVerificationException(string code, string message)
-        : base(message)
-    {
-        Code = code;
-    }
-
-    public string Code { get; }
-}
+using System;
+
+namespace StellaOps.Attestor.Core.Verification;
+
+public sealed class AttestorVerificationException : Exception
+{
+    public AttestorVerificationException(string code, string message)
+        : base(message)
+    {
+        Code = code;
+    }
+
+    public string Code { get; }
+}

src/Attestor/StellaOps.Attestor/StellaOps.Attestor.Core/Verification/AttestorVerificationRequest.cs

@@ -1,10 +1,10 @@
-namespace StellaOps.Attestor.Core.Verification;
-
-/// <summary>
-/// Payload accepted by the verification service.
-/// </summary>
-public sealed class AttestorVerificationRequest
-{
+namespace StellaOps.Attestor.Core.Verification;
+
+/// <summary>
+/// Payload accepted by the verification service.
+/// </summary>
+public sealed class AttestorVerificationRequest
+{
     public string? Uuid { get; set; }
 
     public Submission.AttestorSubmissionRequest.SubmissionBundle? Bundle { get; set; }

src/Attestor/StellaOps.Attestor/StellaOps.Attestor.Core/Verification/AttestorVerificationResult.cs

@@ -1,16 +1,16 @@
-using System;
-using System.Collections.Generic;
-
-namespace StellaOps.Attestor.Core.Verification;
-
-public sealed class AttestorVerificationResult
-{
-    public bool Ok { get; init; }
-
-    public string? Uuid { get; init; }
-
-    public long? Index { get; init; }
-
+using System;
+using System.Collections.Generic;
+
+namespace StellaOps.Attestor.Core.Verification;
+
+public sealed class AttestorVerificationResult
+{
+    public bool Ok { get; init; }
+
+    public string? Uuid { get; init; }
+
+    public long? Index { get; init; }
+
     public string? LogUrl { get; init; }
 
     public DateTimeOffset CheckedAt { get; init; } = DateTimeOffset.UtcNow;

src/Attestor/StellaOps.Attestor/StellaOps.Attestor.Core/Verification/IAttestorVerificationService.cs

@@ -1,12 +1,12 @@
-using System.Threading;
-using System.Threading.Tasks;
-using StellaOps.Attestor.Core.Storage;
-
-namespace StellaOps.Attestor.Core.Verification;
-
-public interface IAttestorVerificationService
-{
-    Task<AttestorVerificationResult> VerifyAsync(AttestorVerificationRequest request, CancellationToken cancellationToken = default);
-
-    Task<AttestorEntry?> GetEntryAsync(string rekorUuid, bool refreshProof, CancellationToken cancellationToken = default);
-}
+using System.Threading;
+using System.Threading.Tasks;
+using StellaOps.Attestor.Core.Storage;
+
+namespace StellaOps.Attestor.Core.Verification;
+
+public interface IAttestorVerificationService
+{
+    Task<AttestorVerificationResult> VerifyAsync(AttestorVerificationRequest request, CancellationToken cancellationToken = default);
+
+    Task<AttestorEntry?> GetEntryAsync(string rekorUuid, bool refreshProof, CancellationToken cancellationToken = default);
+}

src/Attestor/StellaOps.Attestor/StellaOps.Attestor.Infrastructure/Properties/AssemblyInfo.cs

@@ -1,3 +1,3 @@
-using System.Runtime.CompilerServices;
-
-[assembly: InternalsVisibleTo("StellaOps.Attestor.Tests")]
+using System.Runtime.CompilerServices;
+
+[assembly: InternalsVisibleTo("StellaOps.Attestor.Tests")]

src/Attestor/StellaOps.Attestor/StellaOps.Attestor.Infrastructure/Rekor/HttpRekorClient.cs

@@ -1,157 +1,157 @@
-using System;
-using System.Collections.Generic;
-using System.Linq;
-using System.Net;
-using System.Net.Http;
-using System.Net.Http.Json;
-using System.Text.Json;
-using System.Threading;
-using System.Threading.Tasks;
-using Microsoft.Extensions.Logging;
-using StellaOps.Attestor.Core.Rekor;
-using StellaOps.Attestor.Core.Submission;
-
-namespace StellaOps.Attestor.Infrastructure.Rekor;
-
-internal sealed class HttpRekorClient : IRekorClient
-{
-    private static readonly JsonSerializerOptions SerializerOptions = new(JsonSerializerDefaults.Web);
-
-    private readonly HttpClient _httpClient;
-    private readonly ILogger<HttpRekorClient> _logger;
-
-    public HttpRekorClient(HttpClient httpClient, ILogger<HttpRekorClient> logger)
-    {
-        _httpClient = httpClient;
-        _logger = logger;
-    }
-
-    public async Task<RekorSubmissionResponse> SubmitAsync(AttestorSubmissionRequest request, RekorBackend backend, CancellationToken cancellationToken = default)
-    {
-        var submissionUri = BuildUri(backend.Url, "api/v2/log/entries");
-
-        using var httpRequest = new HttpRequestMessage(HttpMethod.Post, submissionUri)
-        {
-            Content = JsonContent.Create(BuildSubmissionPayload(request), options: SerializerOptions)
-        };
-
-        using var response = await _httpClient.SendAsync(httpRequest, cancellationToken).ConfigureAwait(false);
-
-        if (response.StatusCode == HttpStatusCode.Conflict)
-        {
-            var message = await response.Content.ReadAsStringAsync(cancellationToken).ConfigureAwait(false);
-            throw new InvalidOperationException($"Rekor reported a conflict: {message}");
-        }
-
-        response.EnsureSuccessStatusCode();
-
-        await using var stream = await response.Content.ReadAsStreamAsync(cancellationToken).ConfigureAwait(false);
-        using var document = await JsonDocument.ParseAsync(stream, cancellationToken: cancellationToken).ConfigureAwait(false);
-
-        var root = document.RootElement;
-
-        long? index = null;
-        if (root.TryGetProperty("index", out var indexElement) && indexElement.TryGetInt64(out var indexValue))
-        {
-            index = indexValue;
-        }
-
-        return new RekorSubmissionResponse
-        {
-            Uuid = root.TryGetProperty("uuid", out var uuidElement) ? uuidElement.GetString() ?? string.Empty : string.Empty,
-            Index = index,
-            LogUrl = root.TryGetProperty("logURL", out var urlElement) ? urlElement.GetString() ?? backend.Url.ToString() : backend.Url.ToString(),
-            Status = root.TryGetProperty("status", out var statusElement) ? statusElement.GetString() ?? "included" : "included",
-            Proof = TryParseProof(root.TryGetProperty("proof", out var proofElement) ? proofElement : default)
-        };
-    }
-
-    public async Task<RekorProofResponse?> GetProofAsync(string rekorUuid, RekorBackend backend, CancellationToken cancellationToken = default)
-    {
-        var proofUri = BuildUri(backend.Url, $"api/v2/log/entries/{rekorUuid}/proof");
-
-        using var request = new HttpRequestMessage(HttpMethod.Get, proofUri);
-        using var response = await _httpClient.SendAsync(request, cancellationToken).ConfigureAwait(false);
-
-        if (response.StatusCode == HttpStatusCode.NotFound)
-        {
-            _logger.LogDebug("Rekor proof for {Uuid} not found", rekorUuid);
-            return null;
-        }
-
-        response.EnsureSuccessStatusCode();
-
-        await using var stream = await response.Content.ReadAsStreamAsync(cancellationToken).ConfigureAwait(false);
-        using var document = await JsonDocument.ParseAsync(stream, cancellationToken: cancellationToken).ConfigureAwait(false);
-
-        return TryParseProof(document.RootElement);
-    }
-
-    private static object BuildSubmissionPayload(AttestorSubmissionRequest request)
-    {
-        var signatures = new List<object>();
-        foreach (var sig in request.Bundle.Dsse.Signatures)
-        {
-            signatures.Add(new { keyid = sig.KeyId, sig = sig.Signature });
-        }
-
-        return new
-        {
-            entries = new[]
-            {
-                new
-                {
-                    dsseEnvelope = new
-                    {
-                        payload = request.Bundle.Dsse.PayloadBase64,
-                        payloadType = request.Bundle.Dsse.PayloadType,
-                        signatures
-                    }
-                }
-            }
-        };
-    }
-
-    private static RekorProofResponse? TryParseProof(JsonElement proofElement)
-    {
-        if (proofElement.ValueKind == JsonValueKind.Undefined || proofElement.ValueKind == JsonValueKind.Null)
-        {
-            return null;
-        }
-
-        var checkpointElement = proofElement.TryGetProperty("checkpoint", out var cp) ? cp : default;
-        var inclusionElement = proofElement.TryGetProperty("inclusion", out var inc) ? inc : default;
-
-        return new RekorProofResponse
-        {
-            Checkpoint = checkpointElement.ValueKind == JsonValueKind.Object
-                ? new RekorProofResponse.RekorCheckpoint
-                {
-                    Origin = checkpointElement.TryGetProperty("origin", out var origin) ? origin.GetString() : null,
-                    Size = checkpointElement.TryGetProperty("size", out var size) && size.TryGetInt64(out var sizeValue) ? sizeValue : 0,
-                    RootHash = checkpointElement.TryGetProperty("rootHash", out var rootHash) ? rootHash.GetString() : null,
-                    Timestamp = checkpointElement.TryGetProperty("timestamp", out var ts) && ts.ValueKind == JsonValueKind.String && DateTimeOffset.TryParse(ts.GetString(), out var dto) ? dto : null
-                }
-                : null,
-            Inclusion = inclusionElement.ValueKind == JsonValueKind.Object
-                ? new RekorProofResponse.RekorInclusionProof
-                {
-                    LeafHash = inclusionElement.TryGetProperty("leafHash", out var leaf) ? leaf.GetString() : null,
-                    Path = inclusionElement.TryGetProperty("path", out var pathElement) && pathElement.ValueKind == JsonValueKind.Array
-                        ? pathElement.EnumerateArray().Select(p => p.GetString() ?? string.Empty).ToArray()
-                        : Array.Empty<string>()
-                }
-                : null
-        };
-    }
-
-    private static Uri BuildUri(Uri baseUri, string relative)
-    {
-        if (!relative.StartsWith("/", StringComparison.Ordinal))
-        {
-            relative = "/" + relative;
-        }
-
-        return new Uri(baseUri, relative);
-    }
-}
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Net;
+using System.Net.Http;
+using System.Net.Http.Json;
+using System.Text.Json;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.Extensions.Logging;
+using StellaOps.Attestor.Core.Rekor;
+using StellaOps.Attestor.Core.Submission;
+
+namespace StellaOps.Attestor.Infrastructure.Rekor;
+
+internal sealed class HttpRekorClient : IRekorClient
+{
+    private static readonly JsonSerializerOptions SerializerOptions = new(JsonSerializerDefaults.Web);
+
+    private readonly HttpClient _httpClient;
+    private readonly ILogger<HttpRekorClient> _logger;
+
+    public HttpRekorClient(HttpClient httpClient, ILogger<HttpRekorClient> logger)
+    {
+        _httpClient = httpClient;
+        _logger = logger;
+    }
+
+    public async Task<RekorSubmissionResponse> SubmitAsync(AttestorSubmissionRequest request, RekorBackend backend, CancellationToken cancellationToken = default)
+    {
+        var submissionUri = BuildUri(backend.Url, "api/v2/log/entries");
+
+        using var httpRequest = new HttpRequestMessage(HttpMethod.Post, submissionUri)
+        {
+            Content = JsonContent.Create(BuildSubmissionPayload(request), options: SerializerOptions)
+        };
+
+        using var response = await _httpClient.SendAsync(httpRequest, cancellationToken).ConfigureAwait(false);
+
+        if (response.StatusCode == HttpStatusCode.Conflict)
+        {
+            var message = await response.Content.ReadAsStringAsync(cancellationToken).ConfigureAwait(false);
+            throw new InvalidOperationException($"Rekor reported a conflict: {message}");
+        }
+
+        response.EnsureSuccessStatusCode();
+
+        await using var stream = await response.Content.ReadAsStreamAsync(cancellationToken).ConfigureAwait(false);
+        using var document = await JsonDocument.ParseAsync(stream, cancellationToken: cancellationToken).ConfigureAwait(false);
+
+        var root = document.RootElement;
+
+        long? index = null;
+        if (root.TryGetProperty("index", out var indexElement) && indexElement.TryGetInt64(out var indexValue))
+        {
+            index = indexValue;
+        }
+
+        return new RekorSubmissionResponse
+        {
+            Uuid = root.TryGetProperty("uuid", out var uuidElement) ? uuidElement.GetString() ?? string.Empty : string.Empty,
+            Index = index,
+            LogUrl = root.TryGetProperty("logURL", out var urlElement) ? urlElement.GetString() ?? backend.Url.ToString() : backend.Url.ToString(),
+            Status = root.TryGetProperty("status", out var statusElement) ? statusElement.GetString() ?? "included" : "included",
+            Proof = TryParseProof(root.TryGetProperty("proof", out var proofElement) ? proofElement : default)
+        };
+    }
+
+    public async Task<RekorProofResponse?> GetProofAsync(string rekorUuid, RekorBackend backend, CancellationToken cancellationToken = default)
+    {
+        var proofUri = BuildUri(backend.Url, $"api/v2/log/entries/{rekorUuid}/proof");
+
+        using var request = new HttpRequestMessage(HttpMethod.Get, proofUri);
+        using var response = await _httpClient.SendAsync(request, cancellationToken).ConfigureAwait(false);
+
+        if (response.StatusCode == HttpStatusCode.NotFound)
+        {
+            _logger.LogDebug("Rekor proof for {Uuid} not found", rekorUuid);
+            return null;
+        }
+
+        response.EnsureSuccessStatusCode();
+
+        await using var stream = await response.Content.ReadAsStreamAsync(cancellationToken).ConfigureAwait(false);
+        using var document = await JsonDocument.ParseAsync(stream, cancellationToken: cancellationToken).ConfigureAwait(false);
+
+        return TryParseProof(document.RootElement);
+    }
+
+    private static object BuildSubmissionPayload(AttestorSubmissionRequest request)
+    {
+        var signatures = new List<object>();
+        foreach (var sig in request.Bundle.Dsse.Signatures)
+        {
+            signatures.Add(new { keyid = sig.KeyId, sig = sig.Signature });
+        }
+
+        return new
+        {
+            entries = new[]
+            {
+                new
+                {
+                    dsseEnvelope = new
+                    {
+                        payload = request.Bundle.Dsse.PayloadBase64,
+                        payloadType = request.Bundle.Dsse.PayloadType,
+                        signatures
+                    }
+                }
+            }
+        };
+    }
+
+    private static RekorProofResponse? TryParseProof(JsonElement proofElement)
+    {
+        if (proofElement.ValueKind == JsonValueKind.Undefined || proofElement.ValueKind == JsonValueKind.Null)
+        {
+            return null;
+        }
+
+        var checkpointElement = proofElement.TryGetProperty("checkpoint", out var cp) ? cp : default;
+        var inclusionElement = proofElement.TryGetProperty("inclusion", out var inc) ? inc : default;
+
+        return new RekorProofResponse
+        {
+            Checkpoint = checkpointElement.ValueKind == JsonValueKind.Object
+                ? new RekorProofResponse.RekorCheckpoint
+                {
+                    Origin = checkpointElement.TryGetProperty("origin", out var origin) ? origin.GetString() : null,
+                    Size = checkpointElement.TryGetProperty("size", out var size) && size.TryGetInt64(out var sizeValue) ? sizeValue : 0,
+                    RootHash = checkpointElement.TryGetProperty("rootHash", out var rootHash) ? rootHash.GetString() : null,
+                    Timestamp = checkpointElement.TryGetProperty("timestamp", out var ts) && ts.ValueKind == JsonValueKind.String && DateTimeOffset.TryParse(ts.GetString(), out var dto) ? dto : null
+                }
+                : null,
+            Inclusion = inclusionElement.ValueKind == JsonValueKind.Object
+                ? new RekorProofResponse.RekorInclusionProof
+                {
+                    LeafHash = inclusionElement.TryGetProperty("leafHash", out var leaf) ? leaf.GetString() : null,
+                    Path = inclusionElement.TryGetProperty("path", out var pathElement) && pathElement.ValueKind == JsonValueKind.Array
+                        ? pathElement.EnumerateArray().Select(p => p.GetString() ?? string.Empty).ToArray()
+                        : Array.Empty<string>()
+                }
+                : null
+        };
+    }
+
+    private static Uri BuildUri(Uri baseUri, string relative)
+    {
+        if (!relative.StartsWith("/", StringComparison.Ordinal))
+        {
+            relative = "/" + relative;
+        }
+
+        return new Uri(baseUri, relative);
+    }
+}

src/Attestor/StellaOps.Attestor/StellaOps.Attestor.Infrastructure/Rekor/StubRekorClient.cs

@@ -1,71 +1,71 @@
-using System;
-using System.Threading;
-using System.Threading.Tasks;
-using Microsoft.Extensions.Logging;
-using StellaOps.Attestor.Core.Rekor;
-using StellaOps.Attestor.Core.Submission;
-
-namespace StellaOps.Attestor.Infrastructure.Rekor;
-
-internal sealed class StubRekorClient : IRekorClient
-{
-    private readonly ILogger<StubRekorClient> _logger;
-
-    public StubRekorClient(ILogger<StubRekorClient> logger)
-    {
-        _logger = logger;
-    }
-
-    public Task<RekorSubmissionResponse> SubmitAsync(AttestorSubmissionRequest request, RekorBackend backend, CancellationToken cancellationToken = default)
-    {
-        var uuid = Guid.NewGuid().ToString();
-        _logger.LogInformation("Stub Rekor submission for bundle {BundleSha} -> {Uuid}", request.Meta.BundleSha256, uuid);
-
-        var proof = new RekorProofResponse
-        {
-            Checkpoint = new RekorProofResponse.RekorCheckpoint
-            {
-                Origin = backend.Url.Host,
-                Size = 1,
-                RootHash = request.Meta.BundleSha256,
-                Timestamp = DateTimeOffset.UtcNow
-            },
-            Inclusion = new RekorProofResponse.RekorInclusionProof
-            {
-                LeafHash = request.Meta.BundleSha256,
-                Path = Array.Empty<string>()
-            }
-        };
-
-        var response = new RekorSubmissionResponse
-        {
-            Uuid = uuid,
-            Index = Random.Shared.NextInt64(1, long.MaxValue),
-            LogUrl = new Uri(backend.Url, $"/api/v2/log/entries/{uuid}").ToString(),
-            Status = "included",
-            Proof = proof
-        };
-
-        return Task.FromResult(response);
-    }
-
-    public Task<RekorProofResponse?> GetProofAsync(string rekorUuid, RekorBackend backend, CancellationToken cancellationToken = default)
-    {
-        _logger.LogInformation("Stub Rekor proof fetch for {Uuid}", rekorUuid);
-        return Task.FromResult<RekorProofResponse?>(new RekorProofResponse
-        {
-            Checkpoint = new RekorProofResponse.RekorCheckpoint
-            {
-                Origin = backend.Url.Host,
-                Size = 1,
-                RootHash = string.Empty,
-                Timestamp = DateTimeOffset.UtcNow
-            },
-            Inclusion = new RekorProofResponse.RekorInclusionProof
-            {
-                LeafHash = string.Empty,
-                Path = Array.Empty<string>()
-            }
-        });
-    }
-}
+using System;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.Extensions.Logging;
+using StellaOps.Attestor.Core.Rekor;
+using StellaOps.Attestor.Core.Submission;
+
+namespace StellaOps.Attestor.Infrastructure.Rekor;
+
+internal sealed class StubRekorClient : IRekorClient
+{
+    private readonly ILogger<StubRekorClient> _logger;
+
+    public StubRekorClient(ILogger<StubRekorClient> logger)
+    {
+        _logger = logger;
+    }
+
+    public Task<RekorSubmissionResponse> SubmitAsync(AttestorSubmissionRequest request, RekorBackend backend, CancellationToken cancellationToken = default)
+    {
+        var uuid = Guid.NewGuid().ToString();
+        _logger.LogInformation("Stub Rekor submission for bundle {BundleSha} -> {Uuid}", request.Meta.BundleSha256, uuid);
+
+        var proof = new RekorProofResponse
+        {
+            Checkpoint = new RekorProofResponse.RekorCheckpoint
+            {
+                Origin = backend.Url.Host,
+                Size = 1,
+                RootHash = request.Meta.BundleSha256,
+                Timestamp = DateTimeOffset.UtcNow
+            },
+            Inclusion = new RekorProofResponse.RekorInclusionProof
+            {
+                LeafHash = request.Meta.BundleSha256,
+                Path = Array.Empty<string>()
+            }
+        };
+
+        var response = new RekorSubmissionResponse
+        {
+            Uuid = uuid,
+            Index = Random.Shared.NextInt64(1, long.MaxValue),
+            LogUrl = new Uri(backend.Url, $"/api/v2/log/entries/{uuid}").ToString(),
+            Status = "included",
+            Proof = proof
+        };
+
+        return Task.FromResult(response);
+    }
+
+    public Task<RekorProofResponse?> GetProofAsync(string rekorUuid, RekorBackend backend, CancellationToken cancellationToken = default)
+    {
+        _logger.LogInformation("Stub Rekor proof fetch for {Uuid}", rekorUuid);
+        return Task.FromResult<RekorProofResponse?>(new RekorProofResponse
+        {
+            Checkpoint = new RekorProofResponse.RekorCheckpoint
+            {
+                Origin = backend.Url.Host,
+                Size = 1,
+                RootHash = string.Empty,
+                Timestamp = DateTimeOffset.UtcNow
+            },
+            Inclusion = new RekorProofResponse.RekorInclusionProof
+            {
+                LeafHash = string.Empty,
+                Path = Array.Empty<string>()
+            }
+        });
+    }
+}

src/Attestor/StellaOps.Attestor/StellaOps.Attestor.Infrastructure/Storage/InMemoryAttestorDedupeStore.cs

@@ -1,33 +1,33 @@
-using System;
-using System.Collections.Concurrent;
-using System.Threading;
-using System.Threading.Tasks;
-using StellaOps.Attestor.Core.Storage;
-
-namespace StellaOps.Attestor.Infrastructure.Storage;
-
-internal sealed class InMemoryAttestorDedupeStore : IAttestorDedupeStore
-{
-    private readonly ConcurrentDictionary<string, (string Uuid, DateTimeOffset ExpiresAt)> _store = new();
-
-    public Task<string?> TryGetExistingAsync(string bundleSha256, CancellationToken cancellationToken = default)
-    {
-        if (_store.TryGetValue(bundleSha256, out var entry))
-        {
-            if (entry.ExpiresAt > DateTimeOffset.UtcNow)
-            {
-                return Task.FromResult<string?>(entry.Uuid);
-            }
-
-            _store.TryRemove(bundleSha256, out _);
-        }
-
-        return Task.FromResult<string?>(null);
-    }
-
-    public Task SetAsync(string bundleSha256, string rekorUuid, TimeSpan ttl, CancellationToken cancellationToken = default)
-    {
-        _store[bundleSha256] = (rekorUuid, DateTimeOffset.UtcNow.Add(ttl));
-        return Task.CompletedTask;
-    }
-}
+using System;
+using System.Collections.Concurrent;
+using System.Threading;
+using System.Threading.Tasks;
+using StellaOps.Attestor.Core.Storage;
+
+namespace StellaOps.Attestor.Infrastructure.Storage;
+
+internal sealed class InMemoryAttestorDedupeStore : IAttestorDedupeStore
+{
+    private readonly ConcurrentDictionary<string, (string Uuid, DateTimeOffset ExpiresAt)> _store = new();
+
+    public Task<string?> TryGetExistingAsync(string bundleSha256, CancellationToken cancellationToken = default)
+    {
+        if (_store.TryGetValue(bundleSha256, out var entry))
+        {
+            if (entry.ExpiresAt > DateTimeOffset.UtcNow)
+            {
+                return Task.FromResult<string?>(entry.Uuid);
+            }
+
+            _store.TryRemove(bundleSha256, out _);
+        }
+
+        return Task.FromResult<string?>(null);
+    }
+
+    public Task SetAsync(string bundleSha256, string rekorUuid, TimeSpan ttl, CancellationToken cancellationToken = default)
+    {
+        _store[bundleSha256] = (rekorUuid, DateTimeOffset.UtcNow.Add(ttl));
+        return Task.CompletedTask;
+    }
+}

src/Attestor/StellaOps.Attestor/StellaOps.Attestor.Infrastructure/Storage/NullAttestorArchiveStore.cs

@@ -1,19 +1,19 @@
-using System.Threading;
-using System.Threading.Tasks;
-using Microsoft.Extensions.Logging;
-using StellaOps.Attestor.Core.Storage;
-
-namespace StellaOps.Attestor.Infrastructure.Storage;
-
-internal sealed class NullAttestorArchiveStore : IAttestorArchiveStore
-{
-    private readonly ILogger<NullAttestorArchiveStore> _logger;
-
-    public NullAttestorArchiveStore(ILogger<NullAttestorArchiveStore> logger)
-    {
-        _logger = logger;
-    }
-
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.Extensions.Logging;
+using StellaOps.Attestor.Core.Storage;
+
+namespace StellaOps.Attestor.Infrastructure.Storage;
+
+internal sealed class NullAttestorArchiveStore : IAttestorArchiveStore
+{
+    private readonly ILogger<NullAttestorArchiveStore> _logger;
+
+    public NullAttestorArchiveStore(ILogger<NullAttestorArchiveStore> logger)
+    {
+        _logger = logger;
+    }
+
     public Task ArchiveBundleAsync(AttestorArchiveBundle bundle, CancellationToken cancellationToken = default)
     {
         _logger.LogDebug("Archive disabled; skipping bundle {BundleSha}", bundle.BundleSha256);

src/Attestor/StellaOps.Attestor/StellaOps.Attestor.Infrastructure/Storage/RedisAttestorDedupeStore.cs

@@ -1,34 +1,34 @@
-using System;
-using System.Threading;
-using System.Threading.Tasks;
-using Microsoft.Extensions.Options;
-using StackExchange.Redis;
-using StellaOps.Attestor.Core.Options;
-using StellaOps.Attestor.Core.Storage;
-
-namespace StellaOps.Attestor.Infrastructure.Storage;
-
-internal sealed class RedisAttestorDedupeStore : IAttestorDedupeStore
-{
-    private readonly IDatabase _database;
-    private readonly string _prefix;
-
-    public RedisAttestorDedupeStore(IConnectionMultiplexer multiplexer, IOptions<AttestorOptions> options)
-    {
-        _database = multiplexer.GetDatabase();
-        _prefix = options.Value.Redis.DedupePrefix ?? "attestor:dedupe:";
-    }
-
-    public async Task<string?> TryGetExistingAsync(string bundleSha256, CancellationToken cancellationToken = default)
-    {
-        var value = await _database.StringGetAsync(BuildKey(bundleSha256)).ConfigureAwait(false);
-        return value.HasValue ? value.ToString() : null;
-    }
-
-    public Task SetAsync(string bundleSha256, string rekorUuid, TimeSpan ttl, CancellationToken cancellationToken = default)
-    {
-        return _database.StringSetAsync(BuildKey(bundleSha256), rekorUuid, ttl);
-    }
-
-    private RedisKey BuildKey(string bundleSha256) => new RedisKey(_prefix + bundleSha256);
-}
+using System;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.Extensions.Options;
+using StackExchange.Redis;
+using StellaOps.Attestor.Core.Options;
+using StellaOps.Attestor.Core.Storage;
+
+namespace StellaOps.Attestor.Infrastructure.Storage;
+
+internal sealed class RedisAttestorDedupeStore : IAttestorDedupeStore
+{
+    private readonly IDatabase _database;
+    private readonly string _prefix;
+
+    public RedisAttestorDedupeStore(IConnectionMultiplexer multiplexer, IOptions<AttestorOptions> options)
+    {
+        _database = multiplexer.GetDatabase();
+        _prefix = options.Value.Redis.DedupePrefix ?? "attestor:dedupe:";
+    }
+
+    public async Task<string?> TryGetExistingAsync(string bundleSha256, CancellationToken cancellationToken = default)
+    {
+        var value = await _database.StringGetAsync(BuildKey(bundleSha256)).ConfigureAwait(false);
+        return value.HasValue ? value.ToString() : null;
+    }
+
+    public Task SetAsync(string bundleSha256, string rekorUuid, TimeSpan ttl, CancellationToken cancellationToken = default)
+    {
+        return _database.StringSetAsync(BuildKey(bundleSha256), rekorUuid, ttl);
+    }
+
+    private RedisKey BuildKey(string bundleSha256) => new RedisKey(_prefix + bundleSha256);
+}

src/Attestor/StellaOps.Attestor/StellaOps.Attestor.Infrastructure/Submission/DefaultDsseCanonicalizer.cs

@@ -1,49 +1,49 @@
-using System.Text.Json;
-using System.Text.Json.Nodes;
-using System.Threading;
-using System.Threading.Tasks;
-using StellaOps.Attestor.Core.Submission;
-
-namespace StellaOps.Attestor.Infrastructure.Submission;
-
-public sealed class DefaultDsseCanonicalizer : IDsseCanonicalizer
-{
-    private static readonly JsonSerializerOptions SerializerOptions = new(JsonSerializerDefaults.Web)
-    {
-        WriteIndented = false,
-        PropertyNamingPolicy = JsonNamingPolicy.CamelCase
-    };
-
-    public Task<byte[]> CanonicalizeAsync(AttestorSubmissionRequest request, CancellationToken cancellationToken = default)
-    {
-        var node = new JsonObject
-        {
-            ["payloadType"] = request.Bundle.Dsse.PayloadType,
-            ["payload"] = request.Bundle.Dsse.PayloadBase64,
-            ["signatures"] = CreateSignaturesArray(request)
-        };
-
-        var json = node.ToJsonString(SerializerOptions);
-        return Task.FromResult(JsonSerializer.SerializeToUtf8Bytes(JsonNode.Parse(json)!, SerializerOptions));
-    }
-
-    private static JsonArray CreateSignaturesArray(AttestorSubmissionRequest request)
-    {
-        var array = new JsonArray();
-        foreach (var signature in request.Bundle.Dsse.Signatures)
-        {
-            var obj = new JsonObject
-            {
-                ["sig"] = signature.Signature
-            };
-            if (!string.IsNullOrWhiteSpace(signature.KeyId))
-            {
-                obj["keyid"] = signature.KeyId;
-            }
-
-            array.Add(obj);
-        }
-
-        return array;
-    }
-}
+using System.Text.Json;
+using System.Text.Json.Nodes;
+using System.Threading;
+using System.Threading.Tasks;
+using StellaOps.Attestor.Core.Submission;
+
+namespace StellaOps.Attestor.Infrastructure.Submission;
+
+public sealed class DefaultDsseCanonicalizer : IDsseCanonicalizer
+{
+    private static readonly JsonSerializerOptions SerializerOptions = new(JsonSerializerDefaults.Web)
+    {
+        WriteIndented = false,
+        PropertyNamingPolicy = JsonNamingPolicy.CamelCase
+    };
+
+    public Task<byte[]> CanonicalizeAsync(AttestorSubmissionRequest request, CancellationToken cancellationToken = default)
+    {
+        var node = new JsonObject
+        {
+            ["payloadType"] = request.Bundle.Dsse.PayloadType,
+            ["payload"] = request.Bundle.Dsse.PayloadBase64,
+            ["signatures"] = CreateSignaturesArray(request)
+        };
+
+        var json = node.ToJsonString(SerializerOptions);
+        return Task.FromResult(JsonSerializer.SerializeToUtf8Bytes(JsonNode.Parse(json)!, SerializerOptions));
+    }
+
+    private static JsonArray CreateSignaturesArray(AttestorSubmissionRequest request)
+    {
+        var array = new JsonArray();
+        foreach (var signature in request.Bundle.Dsse.Signatures)
+        {
+            var obj = new JsonObject
+            {
+                ["sig"] = signature.Signature
+            };
+            if (!string.IsNullOrWhiteSpace(signature.KeyId))
+            {
+                obj["keyid"] = signature.KeyId;
+            }
+
+            array.Add(obj);
+        }
+
+        return array;
+    }
+}

src/Attestor/StellaOps.Attestor/StellaOps.Attestor.Tests/AttestorSubmissionServiceTests.cs

@@ -15,37 +15,37 @@ using StellaOps.Attestor.Infrastructure.Rekor;
 using StellaOps.Attestor.Infrastructure.Storage;
 using StellaOps.Attestor.Infrastructure.Submission;
 using StellaOps.Attestor.Tests.Support;
-using Xunit;
-
-namespace StellaOps.Attestor.Tests;
-
-public sealed class AttestorSubmissionServiceTests
-{
-    [Fact]
-    public async Task SubmitAsync_ReturnsDeterministicUuid_OnDuplicateBundle()
-    {
-        var options = Options.Create(new AttestorOptions
-        {
-            Redis = new AttestorOptions.RedisOptions
-            {
-                Url = string.Empty
-            },
-            Rekor = new AttestorOptions.RekorOptions
-            {
-                Primary = new AttestorOptions.RekorBackendOptions
-                {
-                    Url = "https://rekor.stellaops.test",
-                    ProofTimeoutMs = 1000,
-                    PollIntervalMs = 50,
-                    MaxAttempts = 2
-                }
-            }
-        });
-
-        var canonicalizer = new DefaultDsseCanonicalizer();
-        var validator = new AttestorSubmissionValidator(canonicalizer);
-        var repository = new InMemoryAttestorEntryRepository();
-        var dedupeStore = new InMemoryAttestorDedupeStore();
+using Xunit;
+
+namespace StellaOps.Attestor.Tests;
+
+public sealed class AttestorSubmissionServiceTests
+{
+    [Fact]
+    public async Task SubmitAsync_ReturnsDeterministicUuid_OnDuplicateBundle()
+    {
+        var options = Options.Create(new AttestorOptions
+        {
+            Redis = new AttestorOptions.RedisOptions
+            {
+                Url = string.Empty
+            },
+            Rekor = new AttestorOptions.RekorOptions
+            {
+                Primary = new AttestorOptions.RekorBackendOptions
+                {
+                    Url = "https://rekor.stellaops.test",
+                    ProofTimeoutMs = 1000,
+                    PollIntervalMs = 50,
+                    MaxAttempts = 2
+                }
+            }
+        });
+
+        var canonicalizer = new DefaultDsseCanonicalizer();
+        var validator = new AttestorSubmissionValidator(canonicalizer);
+        var repository = new InMemoryAttestorEntryRepository();
+        var dedupeStore = new InMemoryAttestorDedupeStore();
         var rekorClient = new StubRekorClient(new NullLogger<StubRekorClient>());
         var archiveStore = new NullAttestorArchiveStore(new NullLogger<NullAttestorArchiveStore>());
         var auditSink = new InMemoryAttestorAuditSink();
@@ -66,21 +66,21 @@ public sealed class AttestorSubmissionServiceTests
             logger,
             TimeProvider.System,
             metrics);
-
-        var request = CreateValidRequest(canonicalizer);
-        var context = new SubmissionContext
-        {
-            CallerSubject = "urn:stellaops:signer",
-            CallerAudience = "attestor",
-            CallerClientId = "signer-service",
-            CallerTenant = "default",
-            ClientCertificate = null,
-            MtlsThumbprint = "00"
-        };
-
-        var first = await service.SubmitAsync(request, context);
-        var second = await service.SubmitAsync(request, context);
-
+
+        var request = CreateValidRequest(canonicalizer);
+        var context = new SubmissionContext
+        {
+            CallerSubject = "urn:stellaops:signer",
+            CallerAudience = "attestor",
+            CallerClientId = "signer-service",
+            CallerTenant = "default",
+            ClientCertificate = null,
+            MtlsThumbprint = "00"
+        };
+
+        var first = await service.SubmitAsync(request, context);
+        var second = await service.SubmitAsync(request, context);
+
         Assert.NotNull(first.Uuid);
         Assert.Equal(first.Uuid, second.Uuid);
 
@@ -89,43 +89,43 @@ public sealed class AttestorSubmissionServiceTests
         Assert.Equal(first.Uuid, stored!.RekorUuid);
         Assert.Single(verificationCache.InvalidatedSubjects);
         Assert.Equal(request.Meta.Artifact.Sha256, verificationCache.InvalidatedSubjects[0]);
-    }
-
-    [Fact]
-    public async Task Validator_ThrowsWhenModeNotAllowed()
-    {
-        var canonicalizer = new DefaultDsseCanonicalizer();
-        var validator = new AttestorSubmissionValidator(canonicalizer, new[] { "kms" });
-
-        var request = CreateValidRequest(canonicalizer);
-        request.Bundle.Mode = "keyless";
-
-        await Assert.ThrowsAsync<AttestorValidationException>(() => validator.ValidateAsync(request));
-    }
-
-    [Fact]
-    public async Task SubmitAsync_Throws_WhenMirrorDisabledButRequested()
-    {
-        var options = Options.Create(new AttestorOptions
-        {
-            Redis = new AttestorOptions.RedisOptions { Url = string.Empty },
-            Rekor = new AttestorOptions.RekorOptions
-            {
-                Primary = new AttestorOptions.RekorBackendOptions
-                {
-                    Url = "https://rekor.primary.test",
-                    ProofTimeoutMs = 1000,
-                    PollIntervalMs = 50,
-                    MaxAttempts = 2
-                }
-            }
-        });
-
-        var canonicalizer = new DefaultDsseCanonicalizer();
-        var validator = new AttestorSubmissionValidator(canonicalizer);
-        var repository = new InMemoryAttestorEntryRepository();
-        var dedupeStore = new InMemoryAttestorDedupeStore();
-        var rekorClient = new StubRekorClient(new NullLogger<StubRekorClient>());
+    }
+
+    [Fact]
+    public async Task Validator_ThrowsWhenModeNotAllowed()
+    {
+        var canonicalizer = new DefaultDsseCanonicalizer();
+        var validator = new AttestorSubmissionValidator(canonicalizer, new[] { "kms" });
+
+        var request = CreateValidRequest(canonicalizer);
+        request.Bundle.Mode = "keyless";
+
+        await Assert.ThrowsAsync<AttestorValidationException>(() => validator.ValidateAsync(request));
+    }
+
+    [Fact]
+    public async Task SubmitAsync_Throws_WhenMirrorDisabledButRequested()
+    {
+        var options = Options.Create(new AttestorOptions
+        {
+            Redis = new AttestorOptions.RedisOptions { Url = string.Empty },
+            Rekor = new AttestorOptions.RekorOptions
+            {
+                Primary = new AttestorOptions.RekorBackendOptions
+                {
+                    Url = "https://rekor.primary.test",
+                    ProofTimeoutMs = 1000,
+                    PollIntervalMs = 50,
+                    MaxAttempts = 2
+                }
+            }
+        });
+
+        var canonicalizer = new DefaultDsseCanonicalizer();
+        var validator = new AttestorSubmissionValidator(canonicalizer);
+        var repository = new InMemoryAttestorEntryRepository();
+        var dedupeStore = new InMemoryAttestorDedupeStore();
+        var rekorClient = new StubRekorClient(new NullLogger<StubRekorClient>());
         var archiveStore = new NullAttestorArchiveStore(new NullLogger<NullAttestorArchiveStore>());
         var auditSink = new InMemoryAttestorAuditSink();
         var witnessClient = new TestTransparencyWitnessClient();
@@ -145,53 +145,53 @@ public sealed class AttestorSubmissionServiceTests
             logger,
             TimeProvider.System,
             metrics);
-
-        var request = CreateValidRequest(canonicalizer);
-        request.Meta.LogPreference = "mirror";
-
-        var context = new SubmissionContext
-        {
-            CallerSubject = "urn:stellaops:signer",
-            CallerAudience = "attestor",
-            CallerClientId = "signer-service",
-            CallerTenant = "default"
-        };
-
-        var ex = await Assert.ThrowsAsync<AttestorValidationException>(() => service.SubmitAsync(request, context));
-        Assert.Equal("mirror_disabled", ex.Code);
-    }
-
-    [Fact]
-    public async Task SubmitAsync_ReturnsMirrorMetadata_WhenPreferenceBoth()
-    {
-        var options = Options.Create(new AttestorOptions
-        {
-            Redis = new AttestorOptions.RedisOptions { Url = string.Empty },
-            Rekor = new AttestorOptions.RekorOptions
-            {
-                Primary = new AttestorOptions.RekorBackendOptions
-                {
-                    Url = "https://rekor.primary.test",
-                    ProofTimeoutMs = 1000,
-                    PollIntervalMs = 50,
-                    MaxAttempts = 2
-                },
-                Mirror = new AttestorOptions.RekorMirrorOptions
-                {
-                    Enabled = true,
-                    Url = "https://rekor.mirror.test",
-                    ProofTimeoutMs = 1000,
-                    PollIntervalMs = 50,
-                    MaxAttempts = 2
-                }
-            }
-        });
-
-        var canonicalizer = new DefaultDsseCanonicalizer();
-        var validator = new AttestorSubmissionValidator(canonicalizer);
-        var repository = new InMemoryAttestorEntryRepository();
-        var dedupeStore = new InMemoryAttestorDedupeStore();
-        var rekorClient = new StubRekorClient(new NullLogger<StubRekorClient>());
+
+        var request = CreateValidRequest(canonicalizer);
+        request.Meta.LogPreference = "mirror";
+
+        var context = new SubmissionContext
+        {
+            CallerSubject = "urn:stellaops:signer",
+            CallerAudience = "attestor",
+            CallerClientId = "signer-service",
+            CallerTenant = "default"
+        };
+
+        var ex = await Assert.ThrowsAsync<AttestorValidationException>(() => service.SubmitAsync(request, context));
+        Assert.Equal("mirror_disabled", ex.Code);
+    }
+
+    [Fact]
+    public async Task SubmitAsync_ReturnsMirrorMetadata_WhenPreferenceBoth()
+    {
+        var options = Options.Create(new AttestorOptions
+        {
+            Redis = new AttestorOptions.RedisOptions { Url = string.Empty },
+            Rekor = new AttestorOptions.RekorOptions
+            {
+                Primary = new AttestorOptions.RekorBackendOptions
+                {
+                    Url = "https://rekor.primary.test",
+                    ProofTimeoutMs = 1000,
+                    PollIntervalMs = 50,
+                    MaxAttempts = 2
+                },
+                Mirror = new AttestorOptions.RekorMirrorOptions
+                {
+                    Enabled = true,
+                    Url = "https://rekor.mirror.test",
+                    ProofTimeoutMs = 1000,
+                    PollIntervalMs = 50,
+                    MaxAttempts = 2
+                }
+            }
+        });
+
+        var canonicalizer = new DefaultDsseCanonicalizer();
+        var validator = new AttestorSubmissionValidator(canonicalizer);
+        var repository = new InMemoryAttestorEntryRepository();
+        var dedupeStore = new InMemoryAttestorDedupeStore();
+        var rekorClient = new StubRekorClient(new NullLogger<StubRekorClient>());
         var archiveStore = new NullAttestorArchiveStore(new NullLogger<NullAttestorArchiveStore>());
         var auditSink = new InMemoryAttestorAuditSink();
         var witnessClient = new TestTransparencyWitnessClient();
@@ -211,56 +211,56 @@ public sealed class AttestorSubmissionServiceTests
             logger,
             TimeProvider.System,
             metrics);
-
-        var request = CreateValidRequest(canonicalizer);
-        request.Meta.LogPreference = "both";
-
-        var context = new SubmissionContext
-        {
-            CallerSubject = "urn:stellaops:signer",
-            CallerAudience = "attestor",
-            CallerClientId = "signer-service",
-            CallerTenant = "default"
-        };
-
-        var result = await service.SubmitAsync(request, context);
-
-        Assert.NotNull(result.Mirror);
-        Assert.False(string.IsNullOrEmpty(result.Mirror!.Uuid));
-        Assert.Equal("included", result.Mirror.Status);
-    }
-
-    [Fact]
-    public async Task SubmitAsync_UsesMirrorAsCanonical_WhenPreferenceMirror()
-    {
-        var options = Options.Create(new AttestorOptions
-        {
-            Redis = new AttestorOptions.RedisOptions { Url = string.Empty },
-            Rekor = new AttestorOptions.RekorOptions
-            {
-                Primary = new AttestorOptions.RekorBackendOptions
-                {
-                    Url = "https://rekor.primary.test",
-                    ProofTimeoutMs = 1000,
-                    PollIntervalMs = 50,
-                    MaxAttempts = 2
-                },
-                Mirror = new AttestorOptions.RekorMirrorOptions
-                {
-                    Enabled = true,
-                    Url = "https://rekor.mirror.test",
-                    ProofTimeoutMs = 1000,
-                    PollIntervalMs = 50,
-                    MaxAttempts = 2
-                }
-            }
-        });
-
-        var canonicalizer = new DefaultDsseCanonicalizer();
-        var validator = new AttestorSubmissionValidator(canonicalizer);
-        var repository = new InMemoryAttestorEntryRepository();
-        var dedupeStore = new InMemoryAttestorDedupeStore();
-        var rekorClient = new StubRekorClient(new NullLogger<StubRekorClient>());
+
+        var request = CreateValidRequest(canonicalizer);
+        request.Meta.LogPreference = "both";
+
+        var context = new SubmissionContext
+        {
+            CallerSubject = "urn:stellaops:signer",
+            CallerAudience = "attestor",
+            CallerClientId = "signer-service",
+            CallerTenant = "default"
+        };
+
+        var result = await service.SubmitAsync(request, context);
+
+        Assert.NotNull(result.Mirror);
+        Assert.False(string.IsNullOrEmpty(result.Mirror!.Uuid));
+        Assert.Equal("included", result.Mirror.Status);
+    }
+
+    [Fact]
+    public async Task SubmitAsync_UsesMirrorAsCanonical_WhenPreferenceMirror()
+    {
+        var options = Options.Create(new AttestorOptions
+        {
+            Redis = new AttestorOptions.RedisOptions { Url = string.Empty },
+            Rekor = new AttestorOptions.RekorOptions
+            {
+                Primary = new AttestorOptions.RekorBackendOptions
+                {
+                    Url = "https://rekor.primary.test",
+                    ProofTimeoutMs = 1000,
+                    PollIntervalMs = 50,
+                    MaxAttempts = 2
+                },
+                Mirror = new AttestorOptions.RekorMirrorOptions
+                {
+                    Enabled = true,
+                    Url = "https://rekor.mirror.test",
+                    ProofTimeoutMs = 1000,
+                    PollIntervalMs = 50,
+                    MaxAttempts = 2
+                }
+            }
+        });
+
+        var canonicalizer = new DefaultDsseCanonicalizer();
+        var validator = new AttestorSubmissionValidator(canonicalizer);
+        var repository = new InMemoryAttestorEntryRepository();
+        var dedupeStore = new InMemoryAttestorDedupeStore();
+        var rekorClient = new StubRekorClient(new NullLogger<StubRekorClient>());
         var archiveStore = new NullAttestorArchiveStore(new NullLogger<NullAttestorArchiveStore>());
         var auditSink = new InMemoryAttestorAuditSink();
         var witnessClient = new TestTransparencyWitnessClient();
@@ -280,24 +280,24 @@ public sealed class AttestorSubmissionServiceTests
             logger,
             TimeProvider.System,
             metrics);
-
-        var request = CreateValidRequest(canonicalizer);
-        request.Meta.LogPreference = "mirror";
-
-        var context = new SubmissionContext
-        {
-            CallerSubject = "urn:stellaops:signer",
-            CallerAudience = "attestor",
-            CallerClientId = "signer-service",
-            CallerTenant = "default"
-        };
-
-        var result = await service.SubmitAsync(request, context);
-
-        Assert.NotNull(result.Uuid);
-        var stored = await repository.GetByBundleShaAsync(request.Meta.BundleSha256);
-        Assert.NotNull(stored);
-        Assert.Equal("mirror", stored!.Log.Backend);
+
+        var request = CreateValidRequest(canonicalizer);
+        request.Meta.LogPreference = "mirror";
+
+        var context = new SubmissionContext
+        {
+            CallerSubject = "urn:stellaops:signer",
+            CallerAudience = "attestor",
+            CallerClientId = "signer-service",
+            CallerTenant = "default"
+        };
+
+        var result = await service.SubmitAsync(request, context);
+
+        Assert.NotNull(result.Uuid);
+        var stored = await repository.GetByBundleShaAsync(request.Meta.BundleSha256);
+        Assert.NotNull(stored);
+        Assert.Equal("mirror", stored!.Log.Backend);
         Assert.Null(result.Mirror);
     }
 
@@ -323,36 +323,36 @@ public sealed class AttestorSubmissionServiceTests
         var request = new AttestorSubmissionRequest
         {
             Bundle = new AttestorSubmissionRequest.SubmissionBundle
-            {
-                Mode = "keyless",
-                Dsse = new AttestorSubmissionRequest.DsseEnvelope
-                {
-                    PayloadType = "application/vnd.in-toto+json",
-                    PayloadBase64 = Convert.ToBase64String(System.Text.Encoding.UTF8.GetBytes("{}")),
-                    Signatures =
-                    {
-                        new AttestorSubmissionRequest.DsseSignature
-                        {
-                            KeyId = "test",
-                            Signature = Convert.ToBase64String(RandomNumberGenerator.GetBytes(32))
-                        }
-                    }
-                }
-            },
-            Meta = new AttestorSubmissionRequest.SubmissionMeta
-            {
-                Artifact = new AttestorSubmissionRequest.ArtifactInfo
-                {
-                    Sha256 = new string('a', 64),
-                    Kind = "sbom"
-                },
-                LogPreference = "primary",
-                Archive = false
-            }
-        };
-
-        var canonical = canonicalizer.CanonicalizeAsync(request).GetAwaiter().GetResult();
-        request.Meta.BundleSha256 = Convert.ToHexString(SHA256.HashData(canonical)).ToLowerInvariant();
-        return request;
-    }
-}
+            {
+                Mode = "keyless",
+                Dsse = new AttestorSubmissionRequest.DsseEnvelope
+                {
+                    PayloadType = "application/vnd.in-toto+json",
+                    PayloadBase64 = Convert.ToBase64String(System.Text.Encoding.UTF8.GetBytes("{}")),
+                    Signatures =
+                    {
+                        new AttestorSubmissionRequest.DsseSignature
+                        {
+                            KeyId = "test",
+                            Signature = Convert.ToBase64String(RandomNumberGenerator.GetBytes(32))
+                        }
+                    }
+                }
+            },
+            Meta = new AttestorSubmissionRequest.SubmissionMeta
+            {
+                Artifact = new AttestorSubmissionRequest.ArtifactInfo
+                {
+                    Sha256 = new string('a', 64),
+                    Kind = "sbom"
+                },
+                LogPreference = "primary",
+                Archive = false
+            }
+        };
+
+        var canonical = canonicalizer.CanonicalizeAsync(request).GetAwaiter().GetResult();
+        request.Meta.BundleSha256 = Convert.ToHexString(SHA256.HashData(canonical)).ToLowerInvariant();
+        return request;
+    }
+}

src/Attestor/StellaOps.Attestor/StellaOps.Attestor.Tests/HttpRekorClientTests.cs

@@ -1,149 +1,149 @@
-using System;
-using System.Net;
-using System.Net.Http;
-using System.Text;
-using System.Text.Json;
-using System.Threading;
-using System.Threading.Tasks;
-using Microsoft.Extensions.Logging.Abstractions;
-using StellaOps.Attestor.Core.Rekor;
-using StellaOps.Attestor.Core.Submission;
-using StellaOps.Attestor.Infrastructure.Rekor;
-using Xunit;
-
-namespace StellaOps.Attestor.Tests;
-
-public sealed class HttpRekorClientTests
-{
-    [Fact]
-    public async Task SubmitAsync_ParsesResponse()
-    {
-        var payload = new
-        {
-            uuid = "123",
-            index = 42,
-            logURL = "https://rekor.example/api/v2/log/entries/123",
-            status = "included",
-            proof = new
-            {
-                checkpoint = new { origin = "rekor", size = 10, rootHash = "abc", timestamp = "2025-10-19T00:00:00Z" },
-                inclusion = new { leafHash = "leaf", path = new[] { "p1", "p2" } }
-            }
-        };
-
-        var client = CreateClient(HttpStatusCode.Created, payload);
-        var rekorClient = new HttpRekorClient(client, NullLogger<HttpRekorClient>.Instance);
-
-        var request = new AttestorSubmissionRequest
-        {
-            Bundle = new AttestorSubmissionRequest.SubmissionBundle
-            {
-                Dsse = new AttestorSubmissionRequest.DsseEnvelope
-                {
-                    PayloadType = "application/json",
-                    PayloadBase64 = Convert.ToBase64String(Encoding.UTF8.GetBytes("{}")),
-                    Signatures = { new AttestorSubmissionRequest.DsseSignature { Signature = "sig" } }
-                }
-            }
-        };
-
-        var backend = new RekorBackend
-        {
-            Name = "primary",
-            Url = new Uri("https://rekor.example/"),
-            ProofTimeout = TimeSpan.FromSeconds(1),
-            PollInterval = TimeSpan.FromMilliseconds(100),
-            MaxAttempts = 1
-        };
-
-        var response = await rekorClient.SubmitAsync(request, backend);
-
-        Assert.Equal("123", response.Uuid);
-        Assert.Equal(42, response.Index);
-        Assert.Equal("included", response.Status);
-        Assert.NotNull(response.Proof);
-        Assert.Equal("leaf", response.Proof!.Inclusion!.LeafHash);
-    }
-
-    [Fact]
-    public async Task SubmitAsync_ThrowsOnConflict()
-    {
-        var client = CreateClient(HttpStatusCode.Conflict, new { error = "duplicate" });
-        var rekorClient = new HttpRekorClient(client, NullLogger<HttpRekorClient>.Instance);
-
-        var request = new AttestorSubmissionRequest
-        {
-            Bundle = new AttestorSubmissionRequest.SubmissionBundle
-            {
-                Dsse = new AttestorSubmissionRequest.DsseEnvelope
-                {
-                    PayloadType = "application/json",
-                    PayloadBase64 = Convert.ToBase64String(Encoding.UTF8.GetBytes("{}")),
-                    Signatures = { new AttestorSubmissionRequest.DsseSignature { Signature = "sig" } }
-                }
-            }
-        };
-
-        var backend = new RekorBackend
-        {
-            Name = "primary",
-            Url = new Uri("https://rekor.example/"),
-            ProofTimeout = TimeSpan.FromSeconds(1),
-            PollInterval = TimeSpan.FromMilliseconds(100),
-            MaxAttempts = 1
-        };
-
-        await Assert.ThrowsAsync<InvalidOperationException>(() => rekorClient.SubmitAsync(request, backend));
-    }
-
-    [Fact]
-    public async Task GetProofAsync_ReturnsNullOnNotFound()
-    {
-        var client = CreateClient(HttpStatusCode.NotFound, new { });
-        var rekorClient = new HttpRekorClient(client, NullLogger<HttpRekorClient>.Instance);
-
-        var backend = new RekorBackend
-        {
-            Name = "primary",
-            Url = new Uri("https://rekor.example/"),
-            ProofTimeout = TimeSpan.FromSeconds(1),
-            PollInterval = TimeSpan.FromMilliseconds(100),
-            MaxAttempts = 1
-        };
-
-        var proof = await rekorClient.GetProofAsync("abc", backend);
-        Assert.Null(proof);
-    }
-
-    private static HttpClient CreateClient(HttpStatusCode statusCode, object payload)
-    {
-        var handler = new StubHandler(statusCode, payload);
-        return new HttpClient(handler)
-        {
-            BaseAddress = new Uri("https://rekor.example/")
-        };
-    }
-
-    private sealed class StubHandler : HttpMessageHandler
-    {
-        private readonly HttpStatusCode _statusCode;
-        private readonly object _payload;
-
-        public StubHandler(HttpStatusCode statusCode, object payload)
-        {
-            _statusCode = statusCode;
-            _payload = payload;
-        }
-
-        protected override Task<HttpResponseMessage> SendAsync(HttpRequestMessage request, CancellationToken cancellationToken)
-        {
-            var json = JsonSerializer.Serialize(_payload);
-            var response = new HttpResponseMessage(_statusCode)
-            {
-                Content = new StringContent(json, Encoding.UTF8, "application/json")
-            };
-
-            return Task.FromResult(response);
-        }
-    }
-}
+using System;
+using System.Net;
+using System.Net.Http;
+using System.Text;
+using System.Text.Json;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.Extensions.Logging.Abstractions;
+using StellaOps.Attestor.Core.Rekor;
+using StellaOps.Attestor.Core.Submission;
+using StellaOps.Attestor.Infrastructure.Rekor;
+using Xunit;
+
+namespace StellaOps.Attestor.Tests;
+
+public sealed class HttpRekorClientTests
+{
+    [Fact]
+    public async Task SubmitAsync_ParsesResponse()
+    {
+        var payload = new
+        {
+            uuid = "123",
+            index = 42,
+            logURL = "https://rekor.example/api/v2/log/entries/123",
+            status = "included",
+            proof = new
+            {
+                checkpoint = new { origin = "rekor", size = 10, rootHash = "abc", timestamp = "2025-10-19T00:00:00Z" },
+                inclusion = new { leafHash = "leaf", path = new[] { "p1", "p2" } }
+            }
+        };
+
+        var client = CreateClient(HttpStatusCode.Created, payload);
+        var rekorClient = new HttpRekorClient(client, NullLogger<HttpRekorClient>.Instance);
+
+        var request = new AttestorSubmissionRequest
+        {
+            Bundle = new AttestorSubmissionRequest.SubmissionBundle
+            {
+                Dsse = new AttestorSubmissionRequest.DsseEnvelope
+                {
+                    PayloadType = "application/json",
+                    PayloadBase64 = Convert.ToBase64String(Encoding.UTF8.GetBytes("{}")),
+                    Signatures = { new AttestorSubmissionRequest.DsseSignature { Signature = "sig" } }
+                }
+            }
+        };
+
+        var backend = new RekorBackend
+        {
+            Name = "primary",
+            Url = new Uri("https://rekor.example/"),
+            ProofTimeout = TimeSpan.FromSeconds(1),
+            PollInterval = TimeSpan.FromMilliseconds(100),
+            MaxAttempts = 1
+        };
+
+        var response = await rekorClient.SubmitAsync(request, backend);
+
+        Assert.Equal("123", response.Uuid);
+        Assert.Equal(42, response.Index);
+        Assert.Equal("included", response.Status);
+        Assert.NotNull(response.Proof);
+        Assert.Equal("leaf", response.Proof!.Inclusion!.LeafHash);
+    }
+
+    [Fact]
+    public async Task SubmitAsync_ThrowsOnConflict()
+    {
+        var client = CreateClient(HttpStatusCode.Conflict, new { error = "duplicate" });
+        var rekorClient = new HttpRekorClient(client, NullLogger<HttpRekorClient>.Instance);
+
+        var request = new AttestorSubmissionRequest
+        {
+            Bundle = new AttestorSubmissionRequest.SubmissionBundle
+            {
+                Dsse = new AttestorSubmissionRequest.DsseEnvelope
+                {
+                    PayloadType = "application/json",
+                    PayloadBase64 = Convert.ToBase64String(Encoding.UTF8.GetBytes("{}")),
+                    Signatures = { new AttestorSubmissionRequest.DsseSignature { Signature = "sig" } }
+                }
+            }
+        };
+
+        var backend = new RekorBackend
+        {
+            Name = "primary",
+            Url = new Uri("https://rekor.example/"),
+            ProofTimeout = TimeSpan.FromSeconds(1),
+            PollInterval = TimeSpan.FromMilliseconds(100),
+            MaxAttempts = 1
+        };
+
+        await Assert.ThrowsAsync<InvalidOperationException>(() => rekorClient.SubmitAsync(request, backend));
+    }
+
+    [Fact]
+    public async Task GetProofAsync_ReturnsNullOnNotFound()
+    {
+        var client = CreateClient(HttpStatusCode.NotFound, new { });
+        var rekorClient = new HttpRekorClient(client, NullLogger<HttpRekorClient>.Instance);
+
+        var backend = new RekorBackend
+        {
+            Name = "primary",
+            Url = new Uri("https://rekor.example/"),
+            ProofTimeout = TimeSpan.FromSeconds(1),
+            PollInterval = TimeSpan.FromMilliseconds(100),
+            MaxAttempts = 1
+        };
+
+        var proof = await rekorClient.GetProofAsync("abc", backend);
+        Assert.Null(proof);
+    }
+
+    private static HttpClient CreateClient(HttpStatusCode statusCode, object payload)
+    {
+        var handler = new StubHandler(statusCode, payload);
+        return new HttpClient(handler)
+        {
+            BaseAddress = new Uri("https://rekor.example/")
+        };
+    }
+
+    private sealed class StubHandler : HttpMessageHandler
+    {
+        private readonly HttpStatusCode _statusCode;
+        private readonly object _payload;
+
+        public StubHandler(HttpStatusCode statusCode, object payload)
+        {
+            _statusCode = statusCode;
+            _payload = payload;
+        }
+
+        protected override Task<HttpResponseMessage> SendAsync(HttpRequestMessage request, CancellationToken cancellationToken)
+        {
+            var json = JsonSerializer.Serialize(_payload);
+            var response = new HttpResponseMessage(_statusCode)
+            {
+                Content = new StringContent(json, Encoding.UTF8, "application/json")
+            };
+
+            return Task.FromResult(response);
+        }
+    }
+}