Add call graph fixtures for various languages and scenarios

- Introduced `all-edge-reasons.json` to test edge resolution reasons in .NET.
- Added `all-visibility-levels.json` to validate method visibility levels in .NET.
- Created `dotnet-aspnetcore-minimal.json` for a minimal ASP.NET Core application.
- Included `go-gin-api.json` for a Go Gin API application structure.
- Added `java-spring-boot.json` for the Spring PetClinic application in Java.
- Introduced `legacy-no-schema.json` for legacy application structure without schema.
- Created `node-express-api.json` for an Express.js API application structure.

docs/implplan/archived/SPRINT_0338_0001_0001_airgap_importer_core.md

@@ -0,0 +1,582 @@
+# Sprint 0338.0001.0001 - AirGap Importer Monotonicity & Quarantine
+
+## Topic & Scope
+- Implement rollback prevention (monotonicity enforcement) and failed-bundle quarantine handling for the AirGap Importer to prevent replay attacks and support forensic analysis of failed imports.
+- **Sprint ID:** `SPRINT_0338_0001_0001`
+- **Priority:** P0 (Critical)
+- **Working directory:** `src/AirGap/StellaOps.AirGap.Importer/` (primary); allowed cross-module edits: `src/AirGap/StellaOps.AirGap.Storage.Postgres/`, `src/AirGap/StellaOps.AirGap.Storage.Postgres.Tests/`, `tests/AirGap/StellaOps.AirGap.Importer.Tests/`.
+- **Related modules:** `StellaOps.AirGap.Controller`, `StellaOps.ExportCenter.Core`
+- **Source advisory:** `docs/product-advisories/14-Dec-2025 - Offline and Air-Gap Technical Reference.md`
+- **Gaps addressed:** G6 (Monotonicity), G7 (Quarantine)
+
+## Dependencies & Concurrency
+- **Dependencies:** `StellaOps.AirGap.Storage.Postgres` (version store), `StellaOps.AirGap.Controller` (state coordination), `StellaOps.Infrastructure.Time` / `TimeProvider` (time source).
+- **Concurrency:** Safe to execute in parallel with unrelated module sprints; requires schema/migration alignment with AirGap Postgres storage work.
+
+## Documentation Prerequisites
+- `docs/README.md`
+- `docs/07_HIGH_LEVEL_ARCHITECTURE.md`
+- `docs/modules/platform/architecture-overview.md`
+- `docs/modules/airgap/mirror-dsse-plan.md`
+- `docs/product-advisories/14-Dec-2025 - Offline and Air-Gap Technical Reference.md`
+
+
+## Delivery Tracker
+
+| # | Task ID | Status | Key dependency / next step | Owners | Task Definition |
+|---:|--------|--------|----------------------------|--------|-----------------|
+| 1 | T1 | DONE | Define ordering rules | AirGap Guild | Design monotonicity version model (SemVer + `createdAt` tiebreaker) |
+| 2 | T2 | DONE | After T1 | AirGap Guild | Implement `IVersionMonotonicityChecker` interface |
+| 3 | T3 | DONE | After T1 | AirGap Guild | Create Postgres-backed bundle version store + migration |
+| 4 | T4 | DONE | After T2, T3 | AirGap Guild | Add monotonicity check to `ImportValidator` (reject `version <= current`) |
+| 5 | T5 | DONE | After T4 | AirGap Guild | Implement `--force-activate` override with audit trail |
+| 6 | T6 | DONE | Define path schema | AirGap Guild | Design quarantine directory structure (per advisory A11.3) |
+| 7 | T7 | DONE | After T6 | AirGap Guild | Implement `IQuarantineService` interface |
+| 8 | T8 | DONE | After T7 | AirGap Guild | Create `FileSystemQuarantineService` |
+| 9 | T9 | DONE | After T8 | AirGap Guild | Integrate quarantine into import failure paths |
+| 10 | T10 | DONE | After T8 | AirGap Guild | Add quarantine cleanup/retention policy (TTL + quota) |
+| 11 | T11 | DONE | After T1-T5 | QA Guild | Unit tests for monotonicity checker/version compare |
+| 12 | T12 | DONE | After T6-T10 | QA Guild | Unit tests for quarantine service |
+| 13 | T13 | DONE | After T1-T12 | QA Guild | Integration tests for import + monotonicity + quarantine |
+| 14 | T14 | DONE | After code changes | AirGap Guild | Update module `AGENTS.md` for new versioning/quarantine behavior |
+
+---
+
+## Wave Coordination
+- **Wave 1 (T1-T2):** Version model + monotonicity interfaces.
+- **Wave 2 (T3):** Postgres schema + version store implementation.
+- **Wave 3 (T4-T5):** Import validation integration + force-activate audit trail.
+- **Wave 4 (T6-T10):** Quarantine design + filesystem implementation + retention.
+- **Wave 5 (T11-T14):** Tests (unit + integration) + AGENTS/doc sync.
+
+## Wave Detail Snapshots
+- **Wave 1 evidence:** New types under `src/AirGap/StellaOps.AirGap.Importer/Versioning/`.
+- **Wave 2 evidence:** Postgres store in `src/AirGap/StellaOps.AirGap.Storage.Postgres/Repositories/PostgresBundleVersionStore.cs` (idempotent schema creation) and registration in `src/AirGap/StellaOps.AirGap.Storage.Postgres/ServiceCollectionExtensions.cs`.
+- **Wave 3 evidence:** `src/AirGap/StellaOps.AirGap.Importer/Validation/ImportValidator.cs` monotonicity gate and force-activate flow.
+- **Wave 4 evidence:** `src/AirGap/StellaOps.AirGap.Importer/Quarantine/` and options wiring.
+- **Wave 5 evidence:** `tests/AirGap/StellaOps.AirGap.Importer.Tests/` tests; AGENTS updates under `src/AirGap/` and `src/AirGap/StellaOps.AirGap.Importer/`.
+
+## Interlocks
+- Postgres migration numbering/runner in `StellaOps.AirGap.Storage.Postgres` must remain deterministic and idempotent.
+- Controller/Importer contract: confirm where `tenantId`, `bundleType`, `manifest.version`, and `manifest.createdAt` originate and how force-activate justification is captured.
+
+## Upcoming Checkpoints
+- 2025-12-15: Completed T1-T14; validated with `dotnet test tests/AirGap/StellaOps.AirGap.Importer.Tests/StellaOps.AirGap.Importer.Tests.csproj -c Release`.
+
+## Action Tracker
+- Bundle digest is required at the validation boundary (`ImportValidationRequest.BundleDigest`).
+- Quarantine is invoked on validation failures in `ImportValidator.ValidateAsync`.
+
+---
+
+## Technical Specification
+
+### T1-T5: Monotonicity Enforcement
+
+#### Version Model
+
+```csharp
+// src/AirGap/StellaOps.AirGap.Importer/Versioning/BundleVersion.cs
+namespace StellaOps.AirGap.Importer.Versioning;
+
+/// <summary>
+/// Represents a bundle version with semantic versioning and timestamp.
+/// Monotonicity is enforced by comparing (Major, Minor, Patch, CreatedAt).
+/// </summary>
+public sealed record BundleVersion(
+    int Major,
+    int Minor,
+    int Patch,
+    DateTimeOffset CreatedAt,
+    string? Prerelease = null)
+{
+    /// <summary>
+    /// Parses version string like "2025.12.14" or "1.2.3-edge".
+    /// </summary>
+    public static BundleVersion Parse(string version, DateTimeOffset createdAt);
+
+    /// <summary>
+    /// Returns true if this version is strictly greater than other.
+    /// For equal semver, CreatedAt is the tiebreaker.
+    /// </summary>
+    public bool IsNewerThan(BundleVersion other);
+}
+```
+
+#### Monotonicity Checker Interface
+
+```csharp
+// src/AirGap/StellaOps.AirGap.Importer/Versioning/IVersionMonotonicityChecker.cs
+namespace StellaOps.AirGap.Importer.Versioning;
+
+public interface IVersionMonotonicityChecker
+{
+    /// <summary>
+    /// Checks if the incoming version is newer than the currently active version.
+    /// </summary>
+    /// <param name="tenantId">Tenant scope</param>
+    /// <param name="bundleType">e.g., "offline-kit", "advisory-bundle"</param>
+    /// <param name="incomingVersion">Version to check</param>
+    /// <param name="cancellationToken">Cancellation token</param>
+    /// <returns>Result with IsMonotonic flag and current version info</returns>
+    Task<MonotonicityCheckResult> CheckAsync(
+        string tenantId,
+        string bundleType,
+        BundleVersion incomingVersion,
+        CancellationToken cancellationToken = default);
+
+    /// <summary>
+    /// Records activation of a new version after successful import.
+    /// </summary>
+    Task RecordActivationAsync(
+        string tenantId,
+        string bundleType,
+        BundleVersion version,
+        string bundleDigest,
+        CancellationToken cancellationToken = default);
+}
+
+public sealed record MonotonicityCheckResult(
+    bool IsMonotonic,
+    BundleVersion? CurrentVersion,
+    string? CurrentBundleDigest,
+    DateTimeOffset? CurrentActivatedAt,
+    string ReasonCode); // "MONOTONIC_OK" | "VERSION_NON_MONOTONIC" | "FIRST_ACTIVATION"
+```
+
+#### Version Store (Postgres)
+
+```csharp
+// src/AirGap/StellaOps.AirGap.Importer/Versioning/IBundleVersionStore.cs
+namespace StellaOps.AirGap.Importer.Versioning;
+
+public interface IBundleVersionStore
+{
+    Task<BundleVersionRecord?> GetCurrentAsync(
+        string tenantId,
+        string bundleType,
+        CancellationToken ct = default);
+
+    Task UpsertAsync(
+        BundleVersionRecord record,
+        CancellationToken ct = default);
+
+    Task<IReadOnlyList<BundleVersionRecord>> GetHistoryAsync(
+        string tenantId,
+        string bundleType,
+        int limit = 10,
+        CancellationToken ct = default);
+}
+
+public sealed record BundleVersionRecord(
+    string TenantId,
+    string BundleType,
+    string VersionString,
+    int Major,
+    int Minor,
+    int Patch,
+    string? Prerelease,
+    DateTimeOffset BundleCreatedAt,
+    string BundleDigest,
+    DateTimeOffset ActivatedAt,
+    bool WasForceActivated,
+    string? ForceActivateReason);
+```
+
+#### Database Migration
+
+```sql
+-- src/AirGap/StellaOps.AirGap.Storage.Postgres/Migrations/002_bundle_versions.sql
+
+CREATE TABLE IF NOT EXISTS airgap.bundle_versions (
+    id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+    tenant_id TEXT NOT NULL,
+    bundle_type TEXT NOT NULL,
+    version_string TEXT NOT NULL,
+    major INTEGER NOT NULL,
+    minor INTEGER NOT NULL,
+    patch INTEGER NOT NULL,
+    prerelease TEXT,
+    bundle_created_at TIMESTAMPTZ NOT NULL,
+    bundle_digest TEXT NOT NULL,
+    activated_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+    was_force_activated BOOLEAN NOT NULL DEFAULT FALSE,
+    force_activate_reason TEXT,
+
+    CONSTRAINT uq_bundle_versions_active UNIQUE (tenant_id, bundle_type)
+);
+
+CREATE INDEX idx_bundle_versions_tenant ON airgap.bundle_versions(tenant_id);
+
+-- History table for audit trail
+CREATE TABLE IF NOT EXISTS airgap.bundle_version_history (
+    id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+    tenant_id TEXT NOT NULL,
+    bundle_type TEXT NOT NULL,
+    version_string TEXT NOT NULL,
+    major INTEGER NOT NULL,
+    minor INTEGER NOT NULL,
+    patch INTEGER NOT NULL,
+    prerelease TEXT,
+    bundle_created_at TIMESTAMPTZ NOT NULL,
+    bundle_digest TEXT NOT NULL,
+    activated_at TIMESTAMPTZ NOT NULL,
+    deactivated_at TIMESTAMPTZ,
+    was_force_activated BOOLEAN NOT NULL DEFAULT FALSE,
+    force_activate_reason TEXT
+);
+
+CREATE INDEX idx_bundle_version_history_tenant
+    ON airgap.bundle_version_history(tenant_id, bundle_type, activated_at DESC);
+```
+
+#### Integration with ImportValidator
+
+```csharp
+// Modify: src/AirGap/StellaOps.AirGap.Importer/Validation/ImportValidator.cs
+
+public async Task<BundleValidationResult> ValidateAsync(
+    BundleImportContext context,
+    CancellationToken cancellationToken = default)
+{
+    // ... existing DSSE/TUF validation ...
+
+    // NEW: Monotonicity check
+    var incomingVersion = BundleVersion.Parse(
+        context.Manifest.Version,
+        context.Manifest.CreatedAt);
+
+    var monotonicityResult = await _monotonicityChecker.CheckAsync(
+        context.TenantId,
+        context.BundleType,
+        incomingVersion,
+        cancellationToken);
+
+    if (!monotonicityResult.IsMonotonic && !context.ForceActivate)
+    {
+        return BundleValidationResult.Failure(
+            "VERSION_NON_MONOTONIC",
+            $"Incoming version {incomingVersion} is not newer than current {monotonicityResult.CurrentVersion}. " +
+            "Use --force-activate to override (requires audit justification).");
+    }
+
+    if (!monotonicityResult.IsMonotonic && context.ForceActivate)
+    {
+        _logger.LogWarning(
+            "Non-monotonic activation forced: incoming={Incoming}, current={Current}, reason={Reason}",
+            incomingVersion,
+            monotonicityResult.CurrentVersion,
+            context.ForceActivateReason);
+
+        // Record in result for downstream audit
+        context.WasForceActivated = true;
+    }
+
+    // ... continue validation ...
+}
+```
+
+### T6-T10: Quarantine Service
+
+#### Quarantine Directory Structure
+
+Per advisory A11.3:
+```
+/updates/quarantine/<timestamp>-<reason>/
+  bundle.tar.zst           # Original bundle
+  manifest.json            # Bundle manifest
+  verification.log         # Detailed verification output
+  failure-reason.txt       # Human-readable summary
+```
+
+#### Quarantine Interface
+
+```csharp
+// src/AirGap/StellaOps.AirGap.Importer/Quarantine/IQuarantineService.cs
+namespace StellaOps.AirGap.Importer.Quarantine;
+
+public interface IQuarantineService
+{
+    /// <summary>
+    /// Moves a failed bundle to quarantine with diagnostic information.
+    /// </summary>
+    Task<QuarantineResult> QuarantineAsync(
+        QuarantineRequest request,
+        CancellationToken cancellationToken = default);
+
+    /// <summary>
+    /// Lists quarantined bundles for a tenant.
+    /// </summary>
+    Task<IReadOnlyList<QuarantineEntry>> ListAsync(
+        string tenantId,
+        QuarantineListOptions? options = null,
+        CancellationToken cancellationToken = default);
+
+    /// <summary>
+    /// Removes a quarantined bundle (after investigation).
+    /// </summary>
+    Task<bool> RemoveAsync(
+        string tenantId,
+        string quarantineId,
+        string removalReason,
+        CancellationToken cancellationToken = default);
+
+    /// <summary>
+    /// Cleans up quarantined bundles older than retention period.
+    /// </summary>
+    Task<int> CleanupExpiredAsync(
+        TimeSpan retentionPeriod,
+        CancellationToken cancellationToken = default);
+}
+
+public sealed record QuarantineRequest(
+    string TenantId,
+    string BundlePath,
+    string? ManifestJson,
+    string ReasonCode,
+    string ReasonMessage,
+    IReadOnlyList<string> VerificationLog,
+    IReadOnlyDictionary<string, string>? Metadata = null);
+
+public sealed record QuarantineResult(
+    bool Success,
+    string QuarantineId,
+    string QuarantinePath,
+    DateTimeOffset QuarantinedAt,
+    string? ErrorMessage = null);
+
+public sealed record QuarantineEntry(
+    string QuarantineId,
+    string TenantId,
+    string OriginalBundleName,
+    string ReasonCode,
+    string ReasonMessage,
+    DateTimeOffset QuarantinedAt,
+    long BundleSizeBytes,
+    string QuarantinePath);
+
+public sealed record QuarantineListOptions(
+    string? ReasonCodeFilter = null,
+    DateTimeOffset? Since = null,
+    DateTimeOffset? Until = null,
+    int Limit = 100);
+```
+
+#### FileSystem Implementation
+
+```csharp
+// src/AirGap/StellaOps.AirGap.Importer/Quarantine/FileSystemQuarantineService.cs
+namespace StellaOps.AirGap.Importer.Quarantine;
+
+public sealed class FileSystemQuarantineService : IQuarantineService
+{
+    private readonly QuarantineOptions _options;
+    private readonly ILogger<FileSystemQuarantineService> _logger;
+    private readonly TimeProvider _timeProvider;
+
+    public FileSystemQuarantineService(
+        IOptions<QuarantineOptions> options,
+        ILogger<FileSystemQuarantineService> logger,
+        TimeProvider timeProvider)
+    {
+        _options = options.Value;
+        _logger = logger;
+        _timeProvider = timeProvider;
+    }
+
+    public async Task<QuarantineResult> QuarantineAsync(
+        QuarantineRequest request,
+        CancellationToken cancellationToken = default)
+    {
+        var now = _timeProvider.GetUtcNow();
+        var timestamp = now.ToString("yyyyMMdd-HHmmss", CultureInfo.InvariantCulture);
+        var sanitizedReason = SanitizeForPath(request.ReasonCode);
+        var quarantineId = $"{timestamp}-{sanitizedReason}-{Guid.NewGuid():N}";
+
+        var quarantinePath = Path.Combine(
+            _options.QuarantineRoot,
+            request.TenantId,
+            quarantineId);
+
+        try
+        {
+            Directory.CreateDirectory(quarantinePath);
+
+            // Copy bundle
+            var bundleDestination = Path.Combine(quarantinePath, "bundle.tar.zst");
+            File.Copy(request.BundlePath, bundleDestination);
+
+            // Write manifest if available
+            if (request.ManifestJson is not null)
+            {
+                await File.WriteAllTextAsync(
+                    Path.Combine(quarantinePath, "manifest.json"),
+                    request.ManifestJson,
+                    cancellationToken);
+            }
+
+            // Write verification log
+            await File.WriteAllLinesAsync(
+                Path.Combine(quarantinePath, "verification.log"),
+                request.VerificationLog,
+                cancellationToken);
+
+            // Write failure reason summary
+            var failureReason = $"""
+                Quarantine Reason: {request.ReasonCode}
+                Message: {request.ReasonMessage}
+                Timestamp: {now:O}
+                Tenant: {request.TenantId}
+                Original Bundle: {Path.GetFileName(request.BundlePath)}
+                """;
+
+            if (request.Metadata is not null)
+            {
+                failureReason += "\n\nMetadata:\n";
+                foreach (var (key, value) in request.Metadata)
+                {
+                    failureReason += $"  {key}: {value}\n";
+                }
+            }
+
+            await File.WriteAllTextAsync(
+                Path.Combine(quarantinePath, "failure-reason.txt"),
+                failureReason,
+                cancellationToken);
+
+            _logger.LogWarning(
+                "Bundle quarantined: {QuarantineId} reason={ReasonCode} path={Path}",
+                quarantineId, request.ReasonCode, quarantinePath);
+
+            return new QuarantineResult(
+                Success: true,
+                QuarantineId: quarantineId,
+                QuarantinePath: quarantinePath,
+                QuarantinedAt: now);
+        }
+        catch (Exception ex)
+        {
+            _logger.LogError(ex, "Failed to quarantine bundle to {Path}", quarantinePath);
+            return new QuarantineResult(
+                Success: false,
+                QuarantineId: quarantineId,
+                QuarantinePath: quarantinePath,
+                QuarantinedAt: now,
+                ErrorMessage: ex.Message);
+        }
+    }
+
+    private static string SanitizeForPath(string input)
+    {
+        return Regex.Replace(input, @"[^a-zA-Z0-9_-]", "_").ToLowerInvariant();
+    }
+
+    // ... ListAsync, RemoveAsync, CleanupExpiredAsync implementations ...
+}
+```
+
+#### Configuration
+
+```csharp
+// src/AirGap/StellaOps.AirGap.Importer/Quarantine/QuarantineOptions.cs
+namespace StellaOps.AirGap.Importer.Quarantine;
+
+public sealed class QuarantineOptions
+{
+    public const string SectionName = "AirGap:Quarantine";
+
+    /// <summary>
+    /// Root directory for quarantined bundles.
+    /// Default: /var/lib/stellaops/quarantine
+    /// </summary>
+    public string QuarantineRoot { get; set; } = "/var/lib/stellaops/quarantine";
+
+    /// <summary>
+    /// Retention period for quarantined bundles before automatic cleanup.
+    /// Default: 30 days
+    /// </summary>
+    public TimeSpan RetentionPeriod { get; set; } = TimeSpan.FromDays(30);
+
+    /// <summary>
+    /// Maximum total size of quarantine directory in bytes.
+    /// Default: 10 GB
+    /// </summary>
+    public long MaxQuarantineSizeBytes { get; set; } = 10L * 1024 * 1024 * 1024;
+
+    /// <summary>
+    /// Whether to enable automatic cleanup of expired quarantine entries.
+    /// Default: true
+    /// </summary>
+    public bool EnableAutomaticCleanup { get; set; } = true;
+}
+```
+
+---
+
+## Acceptance Criteria
+
+### Monotonicity (G6)
+- [ ] `BundleVersion.Parse` correctly handles semver with optional prerelease
+- [ ] `IsNewerThan` comparison is deterministic and handles edge cases (equal versions, prerelease ordering)
+- [ ] First-time activation succeeds (no prior version)
+- [ ] Newer version activation succeeds
+- [ ] Older/equal version activation fails with `VERSION_NON_MONOTONIC`
+- [ ] `--force-activate` overrides monotonicity check
+- [ ] Force activation is logged with reason in audit trail
+- [ ] Version history is preserved for rollback investigation
+
+### Quarantine (G7)
+- [ ] Failed imports automatically quarantine the bundle
+- [ ] Quarantine directory structure matches advisory A11.3
+- [ ] `failure-reason.txt` contains human-readable summary
+- [ ] `verification.log` contains detailed verification output
+- [ ] Quarantine entries are tenant-isolated
+- [ ] `ListAsync` returns entries with filtering options
+- [ ] `RemoveAsync` requires removal reason (audit trail)
+- [ ] Automatic cleanup respects retention period
+- [ ] Quota enforcement prevents disk exhaustion
+
+---
+
+## Decisions & Risks
+
+| Decision | Rationale | Risk |
+|----------|-----------|------|
+| SemVer + timestamp for ordering | Industry standard; timestamp tiebreaker handles same-day releases | Operators must ensure `createdAt` is monotonic per version |
+| Force-activate requires reason | Audit trail for compliance | Operators may use generic reasons; consider structured justification codes |
+| File-based quarantine | Simple, works in air-gap without DB | Disk space concerns; mitigated by quota and TTL |
+| Tenant-isolated quarantine paths | Multi-tenancy requirement | Cross-tenant investigation requires admin access |
+
+### Risk Table
+
+| Risk | Impact | Mitigation | Owner |
+|------|--------|------------|-------|
+| Postgres activation contention / ordering drift | Rollback prevention can be bypassed under races | Use transactional upsert + deterministic compare and persist history; fail closed on ambiguity | AirGap Guild |
+| Quarantine disk exhaustion | Importer becomes unavailable | Enforce TTL + max size; cleanup job; keep quarantines tenant-isolated | AirGap Guild |
+| Force-activate misuse | Operators normalize non-monotonic overrides | Require non-empty reason; store `was_force_activated` + `force_activate_reason`; emit structured warning logs | AirGap Guild |
+
+---
+
+## Testing Strategy
+
+1. **Unit tests** for `BundleVersion.Parse` and `IsNewerThan` with edge cases
+2. **Unit tests** for `FileSystemQuarantineService` with mock filesystem
+3. **Integration tests** for full import + monotonicity check + quarantine flow
+4. **Load tests** for quarantine cleanup under volume
+
+---
+
+## Documentation Updates
+
+- Update `docs/airgap/importer-scaffold.md` with monotonicity and quarantine sections
+- Add `docs/airgap/runbooks/quarantine-investigation.md` runbook
+- Update `src/AirGap/AGENTS.md` and `src/AirGap/StellaOps.AirGap.Importer/AGENTS.md` with new versioning/quarantine interfaces
+
+---
+
+## Execution Log
+
+| Date (UTC) | Update | Owner |
+| --- | --- | --- |
+| 2025-12-15 | Normalised sprint file to standard template sections; set T1-T12 and T14 to DOING (implementation started). | Project Mgmt |
+| 2025-12-15 | Implemented monotonicity + quarantine + Postgres version store + tests; ran `dotnet test tests/AirGap/StellaOps.AirGap.Importer.Tests/StellaOps.AirGap.Importer.Tests.csproj -c Release` (pass). Marked T1-T14 as DONE. | Implementer |

docs/implplan/archived/SPRINT_0338_0001_0001_ttfs_foundation.md

@@ -0,0 +1,382 @@
+# SPRINT_0338_0001_0001 — TTFS Foundation
+
+**Epic:** Time-to-First-Signal (TTFS) Implementation
+**Module:** Telemetry, Scheduler
+**Working Directory:** `src/Telemetry/`, `docs/db/schemas/`
+**Status:** DONE
+**Created:** 2025-12-14
+**Target Completion:** TBD
+
+---
+
+## 1. Overview
+
+This sprint establishes the foundational infrastructure for Time-to-First-Signal (TTFS) metrics collection and storage. TTFS measures the time from user action (opening a run, starting a scan) to the first meaningful signal being rendered or logged.
+
+**Primary SLO Target:** P50 < 2s, P95 < 5s across all surfaces (UI, CLI, CI)
+
+### 1.1 Deliverables
+
+1. TTFS Event Schema (`docs/schemas/ttfs-event.schema.json`)
+2. TTFS Metrics Class (`TimeToFirstSignalMetrics.cs`)
+3. Database table (`scheduler.first_signal_snapshots`)
+4. Database table (`scheduler.ttfs_events`)
+5. Service collection extensions for TTFS registration
+
+### 1.2 Dependencies
+
+- Existing `TimeToEvidenceMetrics.cs` (pattern reference)
+- Existing `tte-event.schema.json` (schema pattern reference)
+- `scheduler` database schema
+- OpenTelemetry integration in `StellaOps.Telemetry.Core`
+
+---
+
+## 2. Delivery Tracker
+
+| ID | Task | Owner | Status | Notes |
+|----|------|-------|--------|-------|
+| T1 | Create `ttfs-event.schema.json` | — | DONE | `docs/schemas/ttfs-event.schema.json` |
+| T2 | Create `TimeToFirstSignalMetrics.cs` | — | DONE | `src/Telemetry/StellaOps.Telemetry.Core/StellaOps.Telemetry.Core/TimeToFirstSignalMetrics.cs` |
+| T3 | Create `TimeToFirstSignalOptions.cs` | — | DONE | `src/Telemetry/StellaOps.Telemetry.Core/StellaOps.Telemetry.Core/TimeToFirstSignalOptions.cs` |
+| T4 | Create `TtfsPhase` enum | — | DONE | `src/Telemetry/StellaOps.Telemetry.Core/StellaOps.Telemetry.Core/TimeToFirstSignalMetrics.cs` |
+| T5 | Create `TtfsSignalKind` enum | — | DONE | `src/Telemetry/StellaOps.Telemetry.Core/StellaOps.Telemetry.Core/TimeToFirstSignalMetrics.cs` |
+| T6 | Create `first_signal_snapshots` table SQL | — | DONE | `docs/db/schemas/ttfs.sql` |
+| T7 | Create `ttfs_events` table SQL | — | DONE | `docs/db/schemas/ttfs.sql` |
+| T8 | Add service registration extensions | — | DONE | `src/Telemetry/StellaOps.Telemetry.Core/StellaOps.Telemetry.Core/TelemetryServiceCollectionExtensions.cs` |
+| T9 | Create unit tests | — | DONE | `src/Telemetry/StellaOps.Telemetry.Core/StellaOps.Telemetry.Core.Tests/TimeToFirstSignalMetricsTests.cs` |
+| T10 | Update observability documentation | — | DONE | `docs/observability/metrics-and-slos.md` |
+
+---
+
+## 3. Task Details
+
+### T1: Create TTFS Event Schema
+
+**File:** `docs/schemas/ttfs-event.schema.json`
+
+**Acceptance Criteria:**
+- [ ] JSON Schema draft 2020-12 compliant
+- [ ] Includes all event types: `signal.start`, `signal.rendered`, `signal.timeout`, `signal.error`
+- [ ] Includes dimensions: `surface`, `cache_hit`, `signal_source`, `kind`, `phase`
+- [ ] Validates against sample events
+- [ ] Schema version: `v1.0`
+
+**Event Types:**
+```
+signal.start      - User action initiated (route enter, CLI start, CI job begin)
+signal.rendered   - First signal displayed/logged
+signal.timeout    - Signal fetch exceeded budget
+signal.error      - Signal fetch failed
+signal.cache_hit  - Signal served from cache
+signal.cold_start - Signal computed fresh
+```
+
+**Dimensions:**
+```
+surface:       ui | cli | ci
+cache_hit:     boolean
+signal_source: snapshot | cold_start | failure_index
+kind:          queued | started | phase | blocked | failed | succeeded | canceled | unavailable
+phase:         resolve | fetch | restore | analyze | policy | report | unknown
+```
+
+---
+
+### T2: Create TimeToFirstSignalMetrics Class
+
+**File:** `src/Telemetry/StellaOps.Telemetry.Core/StellaOps.Telemetry.Core/TimeToFirstSignalMetrics.cs`
+
+**Acceptance Criteria:**
+- [ ] Implements `IDisposable`
+- [ ] Creates meter with name `StellaOps.TimeToFirstSignal`
+- [ ] Exposes histograms for latency measurement
+- [ ] Exposes counters for signal events
+- [ ] Supports SLO breach detection
+- [ ] Provides measurement scope (`TtfsSignalScope`)
+- [ ] Tags include: `surface`, `cache_hit`, `signal_source`, `kind`, `tenant_id`
+
+**Metrics to Create:**
+```csharp
+// Histograms
+ttfs_latency_seconds          // Time from start to signal rendered
+ttfs_cache_latency_seconds    // Cache lookup time
+ttfs_cold_latency_seconds     // Cold path computation time
+
+// Counters
+ttfs_signal_total             // Total signals by kind/surface
+ttfs_cache_hit_total          // Cache hits
+ttfs_cache_miss_total         // Cache misses
+ttfs_slo_breach_total         // SLO breaches
+ttfs_error_total              // Errors by type
+```
+
+**Pattern Reference:** `TimeToEvidenceMetrics.cs`
+
+---
+
+### T3: Create TimeToFirstSignalOptions Class
+
+**File:** `src/Telemetry/StellaOps.Telemetry.Core/StellaOps.Telemetry.Core/TimeToFirstSignalOptions.cs`
+
+**Acceptance Criteria:**
+- [ ] Configurable SLO targets per surface
+- [ ] Warm path and cold path thresholds
+- [ ] Component budget configuration
+- [ ] Version string for meter
+
+**Default Values (from advisory):**
+```csharp
+public double SloP50Seconds { get; set; } = 2.0;
+public double SloP95Seconds { get; set; } = 5.0;
+public double WarmPathP50Seconds { get; set; } = 0.7;
+public double WarmPathP95Seconds { get; set; } = 2.5;
+public double ColdPathP95Seconds { get; set; } = 4.0;
+public double FrontendBudgetMs { get; set; } = 150;
+public double EdgeApiBudgetMs { get; set; } = 250;
+public double CoreServicesBudgetMs { get; set; } = 1500;
+```
+
+---
+
+### T4: Create TtfsPhase Enum
+
+**File:** `src/Telemetry/StellaOps.Telemetry.Core/StellaOps.Telemetry.Core/TimeToFirstSignalMetrics.cs` (same file)
+
+**Values:**
+```csharp
+public enum TtfsPhase
+{
+    Resolve,      // Dependency/artifact resolution
+    Fetch,        // Data retrieval
+    Restore,      // Cache restoration
+    Analyze,      // Analysis phase
+    Policy,       // Policy evaluation
+    Report,       // Report generation
+    Unknown       // Fallback
+}
+```
+
+---
+
+### T5: Create TtfsSignalKind Enum
+
+**Values:**
+```csharp
+public enum TtfsSignalKind
+{
+    Queued,           // Job queued
+    Started,          // Job started
+    Phase,            // Phase transition
+    Blocked,          // Blocked by policy/dependency
+    Failed,           // Job failed
+    Succeeded,        // Job succeeded
+    Canceled,         // Job canceled
+    Unavailable       // Signal not available
+}
+```
+
+---
+
+### T6: Create first_signal_snapshots Table
+
+**File:** `docs/db/schemas/scheduler.sql` (append) + migration
+
+**SQL:**
+```sql
+CREATE TABLE IF NOT EXISTS scheduler.first_signal_snapshots (
+    job_id UUID PRIMARY KEY,
+    tenant_id UUID NOT NULL,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    kind TEXT NOT NULL CHECK (kind IN ('queued', 'started', 'phase', 'blocked', 'failed', 'succeeded', 'canceled', 'unavailable')),
+    phase TEXT NOT NULL CHECK (phase IN ('resolve', 'fetch', 'restore', 'analyze', 'policy', 'report', 'unknown')),
+    summary TEXT NOT NULL,
+    eta_seconds INT NULL,
+    last_known_outcome JSONB NULL,
+    next_actions JSONB NULL,
+    diagnostics JSONB NOT NULL DEFAULT '{}',
+    payload_json JSONB NOT NULL DEFAULT '{}'
+);
+
+CREATE INDEX IF NOT EXISTS idx_first_signal_snapshots_tenant
+    ON scheduler.first_signal_snapshots(tenant_id);
+CREATE INDEX IF NOT EXISTS idx_first_signal_snapshots_updated
+    ON scheduler.first_signal_snapshots(updated_at DESC);
+CREATE INDEX IF NOT EXISTS idx_first_signal_snapshots_kind
+    ON scheduler.first_signal_snapshots(kind);
+```
+
+**Acceptance Criteria:**
+- [ ] Table created in scheduler schema
+- [ ] Indexes support common query patterns
+- [ ] JSONB columns for flexible payload storage
+- [ ] CHECK constraints match enum values
+
+---
+
+### T7: Create ttfs_events Table
+
+**File:** `docs/db/schemas/scheduler.sql` (append) + migration
+
+**SQL:**
+```sql
+CREATE TABLE IF NOT EXISTS scheduler.ttfs_events (
+    id BIGSERIAL PRIMARY KEY,
+    ts TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    tenant_id UUID NOT NULL,
+    job_id UUID NOT NULL,
+    run_id UUID NULL,
+    surface TEXT NOT NULL CHECK (surface IN ('ui', 'cli', 'ci')),
+    event_type TEXT NOT NULL CHECK (event_type IN ('signal.start', 'signal.rendered', 'signal.timeout', 'signal.error', 'signal.cache_hit', 'signal.cold_start')),
+    ttfs_ms INT NOT NULL,
+    cache_hit BOOLEAN NOT NULL DEFAULT FALSE,
+    signal_source TEXT CHECK (signal_source IN ('snapshot', 'cold_start', 'failure_index')),
+    kind TEXT CHECK (kind IN ('queued', 'started', 'phase', 'blocked', 'failed', 'succeeded', 'canceled', 'unavailable')),
+    phase TEXT CHECK (phase IN ('resolve', 'fetch', 'restore', 'analyze', 'policy', 'report', 'unknown')),
+    network_state TEXT NULL,
+    device TEXT NULL,
+    release TEXT NULL,
+    correlation_id TEXT NULL,
+    error_code TEXT NULL,
+    metadata JSONB DEFAULT '{}'
+);
+
+CREATE INDEX IF NOT EXISTS idx_ttfs_events_ts
+    ON scheduler.ttfs_events(ts DESC);
+CREATE INDEX IF NOT EXISTS idx_ttfs_events_tenant_ts
+    ON scheduler.ttfs_events(tenant_id, ts DESC);
+CREATE INDEX IF NOT EXISTS idx_ttfs_events_surface
+    ON scheduler.ttfs_events(surface, ts DESC);
+CREATE INDEX IF NOT EXISTS idx_ttfs_events_job
+    ON scheduler.ttfs_events(job_id);
+
+-- Hourly rollup view
+CREATE OR REPLACE VIEW scheduler.ttfs_hourly_summary AS
+SELECT
+    date_trunc('hour', ts) AS hour,
+    surface,
+    cache_hit,
+    COUNT(*) AS event_count,
+    AVG(ttfs_ms) AS avg_ms,
+    percentile_cont(0.50) WITHIN GROUP (ORDER BY ttfs_ms) AS p50_ms,
+    percentile_cont(0.95) WITHIN GROUP (ORDER BY ttfs_ms) AS p95_ms,
+    percentile_cont(0.99) WITHIN GROUP (ORDER BY ttfs_ms) AS p99_ms
+FROM scheduler.ttfs_events
+WHERE ts >= NOW() - INTERVAL '7 days'
+GROUP BY date_trunc('hour', ts), surface, cache_hit;
+```
+
+---
+
+### T8: Add Service Registration Extensions
+
+**File:** `src/Telemetry/StellaOps.Telemetry.Core/StellaOps.Telemetry.Core/TelemetryServiceCollectionExtensions.cs` (extend)
+
+**Code to Add:**
+```csharp
+public static IServiceCollection AddTimeToFirstSignalMetrics(
+    this IServiceCollection services,
+    Action<TimeToFirstSignalOptions>? configure = null)
+{
+    var options = new TimeToFirstSignalOptions();
+    configure?.Invoke(options);
+
+    services.AddSingleton(options);
+    services.AddSingleton<TimeToFirstSignalMetrics>();
+
+    return services;
+}
+```
+
+---
+
+### T9: Create Unit Tests
+
+**File:** `src/Telemetry/StellaOps.Telemetry.Core/StellaOps.Telemetry.Core.Tests/TimeToFirstSignalMetricsTests.cs`
+
+**Test Cases:**
+- [ ] `RecordSignalRendered_WithValidData_RecordsHistogram`
+- [ ] `RecordSignalRendered_ExceedsSlo_IncrementsBreachCounter`
+- [ ] `RecordCacheHit_IncrementsCounter`
+- [ ] `RecordCacheMiss_IncrementsCounter`
+- [ ] `MeasureSignal_Scope_RecordsLatencyOnDispose`
+- [ ] `MeasureSignal_Scope_RecordsFailureOnException`
+- [ ] `Options_DefaultValues_MatchAdvisory`
+
+---
+
+### T10: Update Observability Documentation
+
+**File:** `docs/observability/metrics-and-slos.md` (append)
+
+**Content to Add:**
+```markdown
+## TTFS Metrics (Time-to-First-Signal)
+
+### Core Metrics
+- `ttfs_latency_seconds{surface,cache_hit,signal_source,kind,tenant_id}` - Histogram
+- `ttfs_signal_total{surface,kind}` - Counter
+- `ttfs_cache_hit_total{surface}` - Counter
+- `ttfs_slo_breach_total{surface}` - Counter
+
+### SLOs
+- P50 < 2s (all surfaces)
+- P95 < 5s (all surfaces)
+- Warm path P50 < 700ms
+- Cold path P95 < 4s
+
+### Alerts
+- Page when `p95(ttfs_latency_seconds) > 5` for 5 minutes
+- Alert when `ttfs_slo_breach_total` > 10/min
+```
+
+---
+
+## 4. Decisions & Risks
+
+| Decision | Rationale | Status |
+|----------|-----------|--------|
+| Store TTFS events in scheduler schema | Co-locate with runs/jobs data | APPROVED |
+| Use JSONB for flexible payload | Future extensibility | APPROVED |
+| Create hourly rollup view | Dashboard performance | APPROVED |
+
+| Risk | Mitigation | Owner |
+|------|------------|-------|
+| High cardinality on surface/kind dimensions | Limit enum values, use label guards | — |
+| Event table growth | Add retention policy (90 days) | — |
+
+---
+
+## 5. References
+
+- Advisory: `docs/product-advisories/14-Dec-2025 - UX and Time-to-Evidence Technical Reference.md`
+- Pattern: `src/Telemetry/StellaOps.Telemetry.Core/StellaOps.Telemetry.Core/TimeToEvidenceMetrics.cs`
+- Schema Pattern: `docs/schemas/tte-event.schema.json`
+- Database Spec: `docs/db/SPECIFICATION.md`
+
+---
+
+## 6. Acceptance Criteria (Sprint)
+
+- [ ] All schema files pass JSON Schema validation
+- [ ] All C# code compiles without warnings
+- [ ] Unit tests pass with ≥80% coverage
+- [ ] Database migrations apply cleanly
+- [ ] Metrics appear in local Prometheus scrape
+- [ ] Documentation updated and cross-linked
+
+---
+
+## 7. Execution Log
+
+| Date (UTC) | Update | Owner |
+| --- | --- | --- |
+| 2025-12-15 | Marked sprint as `DOING`; began reconciliation of existing TTFS schema/SQL artefacts and delivery tracker status. | Implementer |
+| 2025-12-15 | Synced tracker: marked T1/T6/T7 `DONE` based on existing artefacts `docs/schemas/ttfs-event.schema.json` and `docs/db/schemas/ttfs.sql`. | Implementer |
+| 2025-12-15 | Began implementation of TTFS metrics + DI wiring (T2-T5, T8). | Implementer |
+| 2025-12-15 | Implemented TTFS metrics/options/enums + service registration in Telemetry.Core; marked T2-T5/T8 `DONE`. | Implementer |
+| 2025-12-15 | Began TTFS unit test coverage for `TimeToFirstSignalMetrics`. | Implementer |
+| 2025-12-15 | Added `TimeToFirstSignalMetricsTests`; `dotnet test` for Telemetry.Core.Tests passed; marked T9 `DONE`. | Implementer |
+| 2025-12-15 | Began TTFS documentation update in `docs/observability/metrics-and-slos.md` (T10). | Implementer |
+| 2025-12-15 | Updated `docs/observability/metrics-and-slos.md` with TTFS metrics/SLOs; marked T10 `DONE` and sprint `DONE`. | Implementer |

docs/implplan/archived/SPRINT_0339_0001_0001_first_signal_api.md

@@ -0,0 +1,629 @@
+# SPRINT_0339_0001_0001 — First Signal API
+
+**Epic:** Time-to-First-Signal (TTFS) Implementation
+**Module:** Orchestrator
+**Working Directory:** `src/Orchestrator/StellaOps.Orchestrator/`
+**Status:** DONE
+**Created:** 2025-12-14
+**Target Completion:** TBD
+**Depends On:** SPRINT_0338_0001_0001 (TTFS Foundation)
+
+---
+
+## 1. Overview
+
+This sprint implements the `/api/v1/orchestrator/runs/{runId}/first-signal` API endpoint that provides fast access to the first meaningful signal for a run. The endpoint supports caching, ETag-based conditional requests, and integrates with the existing SSE streaming infrastructure.
+
+**Performance Target:** P95 ≤ 250ms (cache hit), P95 ≤ 500ms (cold path)
+
+### 1.1 Deliverables
+
+1. First Signal endpoint (`GET /api/v1/orchestrator/runs/{runId}/first-signal`)
+2. First Signal service (`IFirstSignalService`)
+3. First Signal repository (`IFirstSignalSnapshotRepository`)
+4. Cache integration (Valkey/Postgres fallback)
+5. ETag support for conditional requests
+6. First Signal snapshot writer (background job status → snapshot)
+7. SSE event emission for first signal updates
+
+### 1.2 Dependencies
+
+- SPRINT_0338_0001_0001: `first_signal_snapshots` table, TTFS metrics
+- Existing `RunEndpoints.cs`
+- Existing `SseWriter.cs` and streaming infrastructure
+- Existing `IDistributedCache<TKey, TValue>` from Messaging
+
+---
+
+## 2. Delivery Tracker
+
+| ID | Task | Owner | Status | Notes |
+|----|------|-------|--------|-------|
+| T1 | Create `FirstSignal` domain model | — | DONE | `src/Orchestrator/StellaOps.Orchestrator/StellaOps.Orchestrator.Core/Domain/FirstSignal.cs` |
+| T2 | Create `FirstSignalResponse` DTO | — | DONE | `src/Orchestrator/StellaOps.Orchestrator/StellaOps.Orchestrator.WebService/Contracts/FirstSignalResponse.cs` |
+| T3 | Create `IFirstSignalService` interface | — | DONE | `src/Orchestrator/StellaOps.Orchestrator/StellaOps.Orchestrator.Core/Services/IFirstSignalService.cs` |
+| T4 | Implement `FirstSignalService` | — | DONE | `src/Orchestrator/StellaOps.Orchestrator/StellaOps.Orchestrator.Infrastructure/Services/FirstSignalService.cs` |
+| T5 | Create `IFirstSignalSnapshotRepository` | — | DONE | `src/Orchestrator/StellaOps.Orchestrator/StellaOps.Orchestrator.Core/Repositories/IFirstSignalSnapshotRepository.cs` |
+| T6 | Implement `PostgresFirstSignalSnapshotRepository` | — | DONE | `src/Orchestrator/StellaOps.Orchestrator/StellaOps.Orchestrator.Infrastructure/Postgres/PostgresFirstSignalSnapshotRepository.cs` + `src/Orchestrator/StellaOps.Orchestrator/StellaOps.Orchestrator.Infrastructure/migrations/008_first_signal_snapshots.sql` |
+| T7 | Implement cache layer | — | DONE | `src/Orchestrator/StellaOps.Orchestrator/StellaOps.Orchestrator.Infrastructure/Caching/FirstSignalCache.cs` (Messaging transport configurable; defaults to in-memory) |
+| T8 | Create `FirstSignalEndpoints.cs` | — | DONE | `src/Orchestrator/StellaOps.Orchestrator/StellaOps.Orchestrator.WebService/Endpoints/FirstSignalEndpoints.cs` |
+| T9 | Implement ETag support | — | DONE | ETag/If-None-Match in `src/Orchestrator/StellaOps.Orchestrator/StellaOps.Orchestrator.Infrastructure/Services/FirstSignalService.cs` + `src/Orchestrator/StellaOps.Orchestrator/StellaOps.Orchestrator.WebService/Endpoints/FirstSignalEndpoints.cs` |
+| T10 | Create `FirstSignalSnapshotWriter` | — | DONE | `src/Orchestrator/StellaOps.Orchestrator/StellaOps.Orchestrator.Infrastructure/Services/FirstSignalSnapshotWriter.cs` (disabled by default) |
+| T11 | Add SSE event type for first signal | — | DONE | `src/Orchestrator/StellaOps.Orchestrator/StellaOps.Orchestrator.WebService/Streaming/RunStreamCoordinator.cs` emits `first_signal` |
+| T12 | Create integration tests | — | DONE | `src/Orchestrator/StellaOps.Orchestrator/StellaOps.Orchestrator.Tests/Ttfs/FirstSignalServiceTests.cs` |
+| T13 | Create API documentation | — | DONE | `docs/api/orchestrator-first-signal.md` |
+
+---
+
+## 3. Task Details
+
+### T1: Create FirstSignal Domain Model
+
+**File:** `src/Orchestrator/StellaOps.Orchestrator/StellaOps.Orchestrator.Core/Domain/FirstSignal.cs`
+
+```csharp
+namespace StellaOps.Orchestrator.Core.Domain;
+
+/// <summary>
+/// Represents the first meaningful signal for a job/run.
+/// </summary>
+public sealed record FirstSignal
+{
+    public required string Version { get; init; } = "1.0";
+    public required string SignalId { get; init; }
+    public required Guid JobId { get; init; }
+    public required DateTimeOffset Timestamp { get; init; }
+    public required FirstSignalKind Kind { get; init; }
+    public required FirstSignalPhase Phase { get; init; }
+    public required FirstSignalScope Scope { get; init; }
+    public required string Summary { get; init; }
+    public int? EtaSeconds { get; init; }
+    public LastKnownOutcome? LastKnownOutcome { get; init; }
+    public IReadOnlyList<NextAction>? NextActions { get; init; }
+    public required FirstSignalDiagnostics Diagnostics { get; init; }
+}
+
+public enum FirstSignalKind
+{
+    Queued,
+    Started,
+    Phase,
+    Blocked,
+    Failed,
+    Succeeded,
+    Canceled,
+    Unavailable
+}
+
+public enum FirstSignalPhase
+{
+    Resolve,
+    Fetch,
+    Restore,
+    Analyze,
+    Policy,
+    Report,
+    Unknown
+}
+
+public sealed record FirstSignalScope
+{
+    public required string Type { get; init; } // "repo" | "image" | "artifact"
+    public required string Id { get; init; }
+}
+
+public sealed record LastKnownOutcome
+{
+    public required string SignatureId { get; init; }
+    public string? ErrorCode { get; init; }
+    public required string Token { get; init; }
+    public string? Excerpt { get; init; }
+    public required string Confidence { get; init; } // "low" | "medium" | "high"
+    public required DateTimeOffset FirstSeenAt { get; init; }
+    public required int HitCount { get; init; }
+}
+
+public sealed record NextAction
+{
+    public required string Type { get; init; } // "open_logs" | "open_job" | "docs" | "retry" | "cli_command"
+    public required string Label { get; init; }
+    public required string Target { get; init; }
+}
+
+public sealed record FirstSignalDiagnostics
+{
+    public required bool CacheHit { get; init; }
+    public required string Source { get; init; } // "snapshot" | "failure_index" | "cold_start"
+    public required string CorrelationId { get; init; }
+}
+```
+
+---
+
+### T2: Create FirstSignalResponse DTO
+
+**File:** `src/Orchestrator/StellaOps.Orchestrator/StellaOps.Orchestrator.WebService/Contracts/FirstSignalResponse.cs`
+
+```csharp
+namespace StellaOps.Orchestrator.WebService.Contracts;
+
+/// <summary>
+/// API response for first signal endpoint.
+/// </summary>
+public sealed record FirstSignalResponse
+{
+    public required Guid RunId { get; init; }
+    public required FirstSignalDto? FirstSignal { get; init; }
+    public required string SummaryEtag { get; init; }
+}
+
+public sealed record FirstSignalDto
+{
+    public required string Type { get; init; }
+    public string? Stage { get; init; }
+    public string? Step { get; init; }
+    public required string Message { get; init; }
+    public required DateTimeOffset At { get; init; }
+    public FirstSignalArtifactDto? Artifact { get; init; }
+}
+
+public sealed record FirstSignalArtifactDto
+{
+    public required string Kind { get; init; }
+    public FirstSignalRangeDto? Range { get; init; }
+}
+
+public sealed record FirstSignalRangeDto
+{
+    public required int Start { get; init; }
+    public required int End { get; init; }
+}
+```
+
+---
+
+### T3: Create IFirstSignalService Interface
+
+**File:** `src/Orchestrator/StellaOps.Orchestrator/StellaOps.Orchestrator.Core/Services/IFirstSignalService.cs`
+
+```csharp
+namespace StellaOps.Orchestrator.Core.Services;
+
+public interface IFirstSignalService
+{
+    /// <summary>
+    /// Gets the first signal for a run, checking cache first.
+    /// </summary>
+    Task<FirstSignalResult> GetFirstSignalAsync(
+        Guid runId,
+        string tenantId,
+        string? ifNoneMatch = null,
+        CancellationToken cancellationToken = default);
+
+    /// <summary>
+    /// Updates the first signal snapshot for a run.
+    /// </summary>
+    Task UpdateSnapshotAsync(
+        Guid runId,
+        string tenantId,
+        FirstSignal signal,
+        CancellationToken cancellationToken = default);
+
+    /// <summary>
+    /// Invalidates cached first signal for a run.
+    /// </summary>
+    Task InvalidateCacheAsync(
+        Guid runId,
+        string tenantId,
+        CancellationToken cancellationToken = default);
+}
+
+public sealed record FirstSignalResult
+{
+    public required FirstSignalResultStatus Status { get; init; }
+    public FirstSignal? Signal { get; init; }
+    public string? ETag { get; init; }
+    public bool CacheHit { get; init; }
+    public string? Source { get; init; }
+}
+
+public enum FirstSignalResultStatus
+{
+    Found,           // 200 - Signal found
+    NotModified,     // 304 - ETag matched
+    NotFound,        // 404 - Run not found
+    NotAvailable,    // 204 - Run exists but signal not ready
+    Error            // 500 - Internal error
+}
+```
+
+---
+
+### T4: Implement FirstSignalService
+
+**File:** `src/Orchestrator/StellaOps.Orchestrator/StellaOps.Orchestrator.Infrastructure/Services/FirstSignalService.cs`
+
+**Implementation Notes:**
+1. Check cache first (Messaging transport)
+2. Fall back to `first_signal_snapshots` table
+3. If not in snapshot, compute from current job state (cold path)
+4. Update cache on cold path computation
+5. Track metrics via `TimeToFirstSignalMetrics`
+6. Generate ETag from signal content hash
+
+**Cache Key Pattern:** `tenant:{tenantId}:signal:run:{runId}`
+
+**Cache TTL:** 86400 seconds (24 hours); sliding expiration is configurable.
+
+---
+
+### T5: Create IFirstSignalSnapshotRepository
+
+**File:** `src/Orchestrator/StellaOps.Orchestrator/StellaOps.Orchestrator.Core/Repositories/IFirstSignalSnapshotRepository.cs`
+
+```csharp
+namespace StellaOps.Orchestrator.Core.Repositories;
+
+public interface IFirstSignalSnapshotRepository
+{
+    Task<FirstSignalSnapshot?> GetByRunIdAsync(
+        string tenantId,
+        Guid runId,
+        CancellationToken cancellationToken = default);
+
+    Task UpsertAsync(
+        FirstSignalSnapshot snapshot,
+        CancellationToken cancellationToken = default);
+
+    Task DeleteByRunIdAsync(
+        string tenantId,
+        Guid runId,
+        CancellationToken cancellationToken = default);
+}
+
+public sealed record FirstSignalSnapshot
+{
+    public required string TenantId { get; init; }
+    public required Guid RunId { get; init; }
+    public required Guid JobId { get; init; }
+    public required DateTimeOffset CreatedAt { get; init; }
+    public required DateTimeOffset UpdatedAt { get; init; }
+    public required string Kind { get; init; }
+    public required string Phase { get; init; }
+    public required string Summary { get; init; }
+    public int? EtaSeconds { get; init; }
+    public string? LastKnownOutcomeJson { get; init; }
+    public string? NextActionsJson { get; init; }
+    public required string DiagnosticsJson { get; init; }
+    public required string SignalJson { get; init; }
+}
+```
+
+---
+
+### T6: Implement PostgresFirstSignalSnapshotRepository
+
+**File:** `src/Orchestrator/StellaOps.Orchestrator/StellaOps.Orchestrator.Infrastructure/Postgres/PostgresFirstSignalSnapshotRepository.cs`
+
+**SQL Queries:**
+```sql
+-- GetByRunId
+SELECT tenant_id, run_id, job_id, created_at, updated_at,
+       kind, phase, summary, eta_seconds,
+       last_known_outcome, next_actions, diagnostics, signal_json
+  FROM first_signal_snapshots
+ WHERE tenant_id = @tenant_id AND run_id = @run_id
+LIMIT 1;
+
+-- Upsert
+INSERT INTO first_signal_snapshots (
+    tenant_id, run_id, job_id, created_at, updated_at,
+    kind, phase, summary, eta_seconds,
+    last_known_outcome, next_actions, diagnostics, signal_json)
+VALUES (
+    @tenant_id, @run_id, @job_id, @created_at, @updated_at,
+    @kind, @phase, @summary, @eta_seconds,
+    @last_known_outcome, @next_actions, @diagnostics, @signal_json)
+ON CONFLICT (tenant_id, run_id) DO UPDATE SET
+    job_id = EXCLUDED.job_id,
+    updated_at = EXCLUDED.updated_at,
+    kind = EXCLUDED.kind,
+    phase = EXCLUDED.phase,
+    summary = EXCLUDED.summary,
+    eta_seconds = EXCLUDED.eta_seconds,
+    last_known_outcome = EXCLUDED.last_known_outcome,
+    next_actions = EXCLUDED.next_actions,
+    diagnostics = EXCLUDED.diagnostics,
+    signal_json = EXCLUDED.signal_json;
+
+-- DeleteByRunId
+DELETE FROM first_signal_snapshots
+ WHERE tenant_id = @tenant_id AND run_id = @run_id;
+```
+
+---
+
+### T7: Implement Cache Layer
+
+**File:** `src/Orchestrator/StellaOps.Orchestrator/StellaOps.Orchestrator.Infrastructure/Caching/FirstSignalCache.cs`
+
+```csharp
+namespace StellaOps.Orchestrator.Infrastructure.Caching;
+
+public sealed record FirstSignalCacheEntry
+{
+    public required FirstSignal Signal { get; init; }
+    public required string ETag { get; init; }
+    public required string Origin { get; init; } // "snapshot" | "cold_start"
+}
+
+public interface IFirstSignalCache
+{
+    ValueTask<CacheResult<FirstSignalCacheEntry>> GetAsync(string tenantId, Guid runId, CancellationToken cancellationToken = default);
+    ValueTask SetAsync(string tenantId, Guid runId, FirstSignalCacheEntry entry, CancellationToken cancellationToken = default);
+    ValueTask<bool> InvalidateAsync(string tenantId, Guid runId, CancellationToken cancellationToken = default);
+}
+```
+
+---
+
+### T8: Create FirstSignalEndpoints
+
+**File:** `src/Orchestrator/StellaOps.Orchestrator/StellaOps.Orchestrator.WebService/Endpoints/FirstSignalEndpoints.cs`
+
+```csharp
+namespace StellaOps.Orchestrator.WebService.Endpoints;
+
+public static class FirstSignalEndpoints
+{
+    public static RouteGroupBuilder MapFirstSignalEndpoints(this IEndpointRouteBuilder app)
+    {
+        var group = app.MapGroup("/api/v1/orchestrator/runs")
+            .WithTags("Orchestrator Runs");
+
+        group.MapGet("{runId:guid}/first-signal", GetFirstSignal)
+            .WithName("Orchestrator_GetFirstSignal");
+
+        return group;
+    }
+
+    private static async Task<IResult> GetFirstSignal(
+        HttpContext context,
+        [FromRoute] Guid runId,
+        [FromHeader(Name = "If-None-Match")] string? ifNoneMatch,
+        [FromServices] TenantResolver tenantResolver,
+        [FromServices] IFirstSignalService firstSignalService,
+        CancellationToken cancellationToken)
+    {
+        var tenantId = tenantResolver.Resolve(context);
+        var result = await firstSignalService.GetFirstSignalAsync(runId, tenantId, ifNoneMatch, cancellationToken);
+        return result.Status switch
+        {
+            FirstSignalResultStatus.Found => Results.Ok(MapToResponse(runId, result)),
+            FirstSignalResultStatus.NotModified => Results.StatusCode(StatusCodes.Status304NotModified),
+            FirstSignalResultStatus.NotFound => Results.NotFound(),
+            FirstSignalResultStatus.NotAvailable => Results.NoContent(),
+            _ => Results.Problem("Internal error")
+        };
+    }
+}
+```
+
+---
+
+### T9: Implement ETag Support
+
+**ETag Generation:**
+```csharp
+public static class ETagGenerator
+{
+    public static string Generate(FirstSignal signal)
+    {
+        // Hash stable signal material only (exclude per-request diagnostics like cache-hit flags).
+        var material = new
+        {
+            signal.Version,
+            signal.JobId,
+            signal.Timestamp,
+            signal.Kind,
+            signal.Phase,
+            signal.Scope,
+            signal.Summary,
+            signal.EtaSeconds,
+            signal.LastKnownOutcome,
+            signal.NextActions
+        };
+
+        var json = CanonicalJsonHasher.ToCanonicalJson(material);
+        var hash = SHA256.HashData(Encoding.UTF8.GetBytes(json));
+        var base64 = Convert.ToBase64String(hash.AsSpan(0, 8));
+        return $"W/\"{base64}\"";
+    }
+
+    public static bool Matches(string etag, FirstSignal signal)
+    {
+        var computed = Generate(signal);
+        return string.Equals(etag, computed, StringComparison.Ordinal);
+    }
+}
+```
+
+**Acceptance Criteria:**
+- [x] Weak ETags generated from signal content hash
+- [x] `If-None-Match` header respected
+- [x] 304 Not Modified returned when ETag matches
+- [x] `ETag` header set on all 200 responses
+- [x] `Cache-Control: private, max-age=60` header set
+
+---
+
+### T10: Create FirstSignalSnapshotWriter
+
+**File:** `src/Orchestrator/StellaOps.Orchestrator/StellaOps.Orchestrator.Infrastructure/Services/FirstSignalSnapshotWriter.cs`
+
+**Purpose:** Optional warmup poller that refreshes first-signal snapshots/caches for active runs.
+Disabled by default; when enabled, it operates for a single configured tenant (`FirstSignal:SnapshotWriter:TenantId`).
+
+```csharp
+public sealed class FirstSignalSnapshotWriter : BackgroundService
+{
+    protected override async Task ExecuteAsync(CancellationToken stoppingToken)
+    {
+        // Periodically list active runs and call GetFirstSignalAsync(...) to populate snapshots/caches.
+    }
+}
+```
+
+---
+
+### T11: Add SSE Event Type for First Signal
+
+**File:** `src/Orchestrator/StellaOps.Orchestrator/StellaOps.Orchestrator.WebService/Streaming/RunStreamCoordinator.cs` (extend)
+
+**Add event type:**
+```csharp
+public enum RunStreamEventType
+{
+    Initial,
+    Heartbeat,
+    Progress,
+    FirstSignal,  // NEW
+    Completed,
+    Timeout,
+    NotFound
+}
+```
+
+**Emit first signal event when snapshot updates:**
+```csharp
+private async Task EmitFirstSignalIfUpdated(Guid runId, Guid tenantId, ...)
+{
+    var signal = await _signalService.GetFirstSignalAsync(runId, tenantId);
+    if (signal.Status == FirstSignalResultStatus.Found)
+    {
+        await _sseWriter.WriteAsync(new SseEvent
+        {
+            Type = "first_signal",
+            Data = JsonSerializer.Serialize(signal.Signal)
+        });
+    }
+}
+```
+
+---
+
+### T12: Create Integration Tests
+
+**File:** `src/Orchestrator/__Tests/StellaOps.Orchestrator.WebService.Tests/FirstSignalEndpointTests.cs`
+
+**Test Cases:**
+- [ ] `GetFirstSignal_RunExists_Returns200WithSignal`
+- [ ] `GetFirstSignal_RunNotFound_Returns404`
+- [ ] `GetFirstSignal_SignalNotReady_Returns204`
+- [ ] `GetFirstSignal_MatchingETag_Returns304`
+- [ ] `GetFirstSignal_CacheHit_ReturnsFast`
+- [ ] `GetFirstSignal_ColdPath_ComputesAndCaches`
+- [ ] `UpdateSnapshot_InvalidatesCache`
+- [ ] `SSE_EmitsFirstSignalEvent`
+
+---
+
+### T13: Create API Documentation
+
+**File:** `docs/api/orchestrator-first-signal.md`
+
+Include:
+- Endpoint specification
+- Request/response examples
+- ETag usage guide
+- Error codes
+- Performance expectations
+
+---
+
+## 4. Configuration
+
+**appsettings.json additions:**
+```json
+{
+  "FirstSignal": {
+    "Cache": {
+      "Backend": "inmemory",
+      "TtlSeconds": 86400,
+      "SlidingExpiration": true,
+      "KeyPrefix": "orchestrator:first_signal:"
+    },
+    "ColdPath": {
+      "TimeoutMs": 3000
+    },
+    "SnapshotWriter": {
+      "Enabled": false,
+      "TenantId": null,
+      "PollIntervalSeconds": 10,
+      "MaxRunsPerTick": 50,
+      "LookbackMinutes": 60
+    }
+  },
+  "messaging": {
+    "transport": "inmemory"
+  }
+}
+```
+
+---
+
+## 5. Air-Gapped Profile
+
+Air-gap-friendly profile (recommended defaults):
+1. Use `FirstSignal:Cache:Backend=postgres` and configure `messaging:postgres` for PostgreSQL-only operation.
+2. Keep SSE `first_signal` updates via polling (no `NOTIFY/LISTEN` implemented in this sprint).
+3. Optionally enable `FirstSignal:SnapshotWriter` to proactively warm snapshots/caches for a single configured tenant.
+
+---
+
+## 6. Decisions & Risks
+
+| Decision | Rationale | Status |
+|----------|-----------|--------|
+| Use weak ETags | Content-based, not version-based | APPROVED |
+| 60-second max-age | Balance freshness vs performance | APPROVED |
+| Background snapshot writer | Decouple from request path | APPROVED |
+| `tenant_id` is a string header (`X-Tenant-Id`) | Align with existing Orchestrator schema (`tenant_id TEXT`) and `TenantResolver` | APPROVED |
+| `first_signal_snapshots` keyed by `(tenant_id, run_id)` | Endpoint is run-scoped; avoids incorrect scheduler-schema coupling | APPROVED |
+| Cache transport selection is config-driven | `FirstSignal:Cache:Backend` / `messaging:transport`, default `inmemory` | APPROVED |
+
+| Risk | Mitigation | Owner |
+|------|------------|-------|
+| Cache stampede on invalidation | Cache entries have bounded TTL + ETag/304 reduces payload churn | Orchestrator |
+| Snapshot writer lag | Snapshot writer is disabled by default; SSE also polls for updates and emits `first_signal` on ETag change | Orchestrator |
+
+---
+
+## 7. References
+
+- Depends: SPRINT_0338_0001_0001 (TTFS Foundation)
+- Pattern: `src/Orchestrator/.../Endpoints/RunEndpoints.cs`
+- Pattern: `src/Orchestrator/.../Streaming/RunStreamCoordinator.cs`
+- Cache: `src/__Libraries/StellaOps.Messaging.Transport.Valkey/`
+
+---
+
+## 8. Acceptance Criteria (Sprint)
+
+- [ ] Endpoint returns first signal within 250ms (cache hit)
+- [ ] Endpoint returns first signal within 500ms (cold path)
+- [x] ETag-based 304 responses work correctly
+- [x] SSE stream emits first_signal events
+- [ ] Air-gapped mode works with Postgres-only
+- [x] Integration tests pass
+- [x] API documentation complete
+
+---
+
+## 9. Execution Log
+
+| Date (UTC) | Update | Owner |
+| --- | --- | --- |
+| 2025-12-15 | Marked sprint as `DOING`; began work on first signal API delivery items (starting with T1). | Implementer |
+| 2025-12-15 | Implemented T1/T2 domain + contract DTOs (`FirstSignal`, `FirstSignalResponse`). | Implementer |
+| 2025-12-15 | Implemented T3–T13: service/repo/cache/endpoint/ETag/SSE + snapshot writer + migration + tests + API docs; set sprint `DONE`. | Implementer |

docs/implplan/archived/SPRINT_1100_0001_0001_callgraph_schema_enhancement.md

@@ -0,0 +1,749 @@
+# SPRINT_1100_0001_0001 - CallGraph.v1 Schema Enhancement
+
+**Status:** DONE
+**Priority:** P1 - HIGH
+**Module:** Scanner Libraries, Signals
+**Working Directory:** `src/Scanner/__Libraries/StellaOps.Scanner.Reachability/`
+**Estimated Effort:** Small-Medium
+**Dependencies:** None (foundational)
+
+---
+
+## 1. OBJECTIVE
+
+Enhance the call graph schema to include:
+
+1. **Schema versioning** - Enable forward/backward compatibility
+2. **Edge reasons** - Explain why edges exist (direct_call, reflection, DI binding)
+3. **Node visibility** - Track public/internal/private access
+4. **Typed entrypoints** - Include route patterns, framework info
+
+---
+
+## 2. BACKGROUND
+
+### 2.1 Current State
+
+- `CallgraphDocument` exists but lacks:
+  - `schema` version field
+  - `visibility` on nodes
+  - `isEntrypointCandidate` flag
+  - Edge `reason` field
+  - Typed entrypoints with route metadata
+
+### 2.2 Target State
+
+- Schema version `stella.callgraph.v1` embedded in every document
+- All edges carry `reason` explaining their origin
+- Nodes include visibility and entrypoint candidate flags
+- Entrypoints typed with kind, route, framework
+
+---
+
+## 3. TECHNICAL DESIGN
+
+### 3.1 Enhanced Schema Definition
+
+```csharp
+// File: src/Signals/StellaOps.Signals/Models/CallgraphDocument.cs (UPDATED)
+
+namespace StellaOps.Signals.Models;
+
+/// <summary>
+/// Canonical call graph document following stella.callgraph.v1 schema.
+/// </summary>
+public sealed class CallgraphDocument
+{
+    /// <summary>
+    /// Schema identifier. Always "stella.callgraph.v1" for this version.
+    /// </summary>
+    [JsonPropertyName("schema")]
+    public string Schema { get; set; } = CallgraphSchemaVersions.V1;
+
+    /// <summary>
+    /// Scan context identifier.
+    /// </summary>
+    [JsonPropertyName("scanKey")]
+    public string ScanKey { get; set; } = string.Empty;
+
+    /// <summary>
+    /// Primary language of this call graph.
+    /// </summary>
+    [JsonPropertyName("language")]
+    public CallgraphLanguage Language { get; set; } = CallgraphLanguage.Unknown;
+
+    /// <summary>
+    /// Artifacts included in this graph (assemblies, JARs, modules).
+    /// </summary>
+    [JsonPropertyName("artifacts")]
+    public List<CallgraphArtifact> Artifacts { get; set; } = new();
+
+    /// <summary>
+    /// Graph nodes representing symbols (methods, functions, types).
+    /// </summary>
+    [JsonPropertyName("nodes")]
+    public List<CallgraphNode> Nodes { get; set; } = new();
+
+    /// <summary>
+    /// Call edges between nodes.
+    /// </summary>
+    [JsonPropertyName("edges")]
+    public List<CallgraphEdge> Edges { get; set; } = new();
+
+    /// <summary>
+    /// Discovered entrypoints with framework metadata.
+    /// </summary>
+    [JsonPropertyName("entrypoints")]
+    public List<CallgraphEntrypoint> Entrypoints { get; set; } = new();
+
+    /// <summary>
+    /// Graph-level metadata.
+    /// </summary>
+    [JsonPropertyName("metadata")]
+    public CallgraphMetadata? Metadata { get; set; }
+
+    // Legacy fields for backward compatibility
+    [JsonPropertyName("id")]
+    public string Id { get; set; } = Guid.NewGuid().ToString("N");
+
+    [JsonPropertyName("component")]
+    public string Component { get; set; } = string.Empty;
+
+    [JsonPropertyName("version")]
+    public string Version { get; set; } = string.Empty;
+
+    [JsonPropertyName("ingestedAt")]
+    public DateTimeOffset IngestedAt { get; set; }
+
+    [JsonPropertyName("graphHash")]
+    public string GraphHash { get; set; } = string.Empty;
+}
+
+/// <summary>
+/// Schema version constants.
+/// </summary>
+public static class CallgraphSchemaVersions
+{
+    public const string V1 = "stella.callgraph.v1";
+}
+
+/// <summary>
+/// Supported languages for call graph analysis.
+/// </summary>
+[JsonConverter(typeof(JsonStringEnumConverter))]
+public enum CallgraphLanguage
+{
+    Unknown,
+    DotNet,
+    Java,
+    Node,
+    Python,
+    Go,
+    Rust,
+    Ruby,
+    Php,
+    Binary,
+    Swift,
+    Kotlin
+}
+```
+
+### 3.2 Enhanced Node Model
+
+```csharp
+// File: src/Signals/StellaOps.Signals/Models/CallgraphNode.cs (UPDATED)
+
+namespace StellaOps.Signals.Models;
+
+/// <summary>
+/// Represents a symbol node in the call graph.
+/// </summary>
+public sealed class CallgraphNode
+{
+    /// <summary>
+    /// Unique identifier for this node within the graph.
+    /// Format: deterministic hash of symbol components.
+    /// </summary>
+    [JsonPropertyName("nodeId")]
+    public string NodeId { get; set; } = string.Empty;
+
+    /// <summary>
+    /// Reference to containing artifact.
+    /// </summary>
+    [JsonPropertyName("artifactKey")]
+    public string? ArtifactKey { get; set; }
+
+    /// <summary>
+    /// Canonical symbol key.
+    /// Format: {Namespace}.{Type}[`Arity][+Nested]::{Method}[`Arity]({ParamTypes})
+    /// </summary>
+    [JsonPropertyName("symbolKey")]
+    public string SymbolKey { get; set; } = string.Empty;
+
+    /// <summary>
+    /// Access visibility of this symbol.
+    /// </summary>
+    [JsonPropertyName("visibility")]
+    public SymbolVisibility Visibility { get; set; } = SymbolVisibility.Unknown;
+
+    /// <summary>
+    /// Whether this node is a candidate for automatic entrypoint detection.
+    /// True for public methods in controllers, handlers, Main methods, etc.
+    /// </summary>
+    [JsonPropertyName("isEntrypointCandidate")]
+    public bool IsEntrypointCandidate { get; set; }
+
+    /// <summary>
+    /// PURL if this symbol belongs to an external package.
+    /// </summary>
+    [JsonPropertyName("purl")]
+    public string? Purl { get; set; }
+
+    /// <summary>
+    /// Content-addressed symbol digest for deterministic matching.
+    /// </summary>
+    [JsonPropertyName("symbolDigest")]
+    public string? SymbolDigest { get; set; }
+
+    /// <summary>
+    /// Additional attributes (generic arity, return type, etc.).
+    /// </summary>
+    [JsonPropertyName("attributes")]
+    public Dictionary<string, string>? Attributes { get; set; }
+
+    // Legacy field mappings
+    [JsonPropertyName("id")]
+    public string Id
+    {
+        get => NodeId;
+        set => NodeId = value;
+    }
+}
+
+/// <summary>
+/// Symbol visibility levels.
+/// </summary>
+[JsonConverter(typeof(JsonStringEnumConverter))]
+public enum SymbolVisibility
+{
+    Unknown,
+    Public,
+    Internal,
+    Protected,
+    Private
+}
+```
+
+### 3.3 Enhanced Edge Model
+
+```csharp
+// File: src/Signals/StellaOps.Signals/Models/CallgraphEdge.cs (UPDATED)
+
+namespace StellaOps.Signals.Models;
+
+/// <summary>
+/// Represents a call edge between two symbols.
+/// </summary>
+public sealed class CallgraphEdge
+{
+    /// <summary>
+    /// Source node ID (caller).
+    /// </summary>
+    [JsonPropertyName("from")]
+    public string From { get; set; } = string.Empty;
+
+    /// <summary>
+    /// Target node ID (callee).
+    /// </summary>
+    [JsonPropertyName("to")]
+    public string To { get; set; } = string.Empty;
+
+    /// <summary>
+    /// Edge classification.
+    /// </summary>
+    [JsonPropertyName("kind")]
+    public EdgeKind Kind { get; set; } = EdgeKind.Static;
+
+    /// <summary>
+    /// Reason for this edge's existence.
+    /// Enables explainability in reachability analysis.
+    /// </summary>
+    [JsonPropertyName("reason")]
+    public EdgeReason Reason { get; set; } = EdgeReason.DirectCall;
+
+    /// <summary>
+    /// Confidence weight (0.0 to 1.0).
+    /// Static edges typically 1.0, heuristic edges lower.
+    /// </summary>
+    [JsonPropertyName("weight")]
+    public double Weight { get; set; } = 1.0;
+
+    /// <summary>
+    /// IL/bytecode offset where call occurs (for source location).
+    /// </summary>
+    [JsonPropertyName("offset")]
+    public int? Offset { get; set; }
+
+    /// <summary>
+    /// Whether the target was fully resolved.
+    /// </summary>
+    [JsonPropertyName("isResolved")]
+    public bool IsResolved { get; set; } = true;
+
+    /// <summary>
+    /// Additional provenance information.
+    /// </summary>
+    [JsonPropertyName("provenance")]
+    public string? Provenance { get; set; }
+
+    // Legacy field mappings
+    [JsonPropertyName("sourceId")]
+    public string SourceId
+    {
+        get => From;
+        set => From = value;
+    }
+
+    [JsonPropertyName("targetId")]
+    public string TargetId
+    {
+        get => To;
+        set => To = value;
+    }
+}
+
+/// <summary>
+/// Edge classification based on analysis confidence.
+/// </summary>
+[JsonConverter(typeof(JsonStringEnumConverter))]
+public enum EdgeKind
+{
+    /// <summary>
+    /// Statically determined call (high confidence).
+    /// </summary>
+    Static,
+
+    /// <summary>
+    /// Heuristically inferred (may require runtime confirmation).
+    /// </summary>
+    Heuristic,
+
+    /// <summary>
+    /// Runtime-observed edge (highest confidence).
+    /// </summary>
+    Runtime
+}
+
+/// <summary>
+/// Reason codes explaining why an edge exists.
+/// Critical for explainability and debugging.
+/// </summary>
+[JsonConverter(typeof(JsonStringEnumConverter))]
+public enum EdgeReason
+{
+    /// <summary>
+    /// Direct method/function call.
+    /// </summary>
+    DirectCall,
+
+    /// <summary>
+    /// Virtual/interface dispatch.
+    /// </summary>
+    VirtualCall,
+
+    /// <summary>
+    /// Reflection-based invocation (Type.GetMethod, etc.).
+    /// </summary>
+    ReflectionString,
+
+    /// <summary>
+    /// Dependency injection binding (AddTransient<I,T>).
+    /// </summary>
+    DiBinding,
+
+    /// <summary>
+    /// Dynamic import/require in interpreted languages.
+    /// </summary>
+    DynamicImport,
+
+    /// <summary>
+    /// Constructor/object instantiation.
+    /// </summary>
+    NewObj,
+
+    /// <summary>
+    /// Delegate/function pointer creation.
+    /// </summary>
+    DelegateCreate,
+
+    /// <summary>
+    /// Async/await continuation.
+    /// </summary>
+    AsyncContinuation,
+
+    /// <summary>
+    /// Event handler subscription.
+    /// </summary>
+    EventHandler,
+
+    /// <summary>
+    /// Generic type instantiation.
+    /// </summary>
+    GenericInstantiation,
+
+    /// <summary>
+    /// Native interop (P/Invoke, JNI, FFI).
+    /// </summary>
+    NativeInterop,
+
+    /// <summary>
+    /// Runtime-minted edge from execution evidence.
+    /// </summary>
+    RuntimeMinted,
+
+    /// <summary>
+    /// Reason could not be determined.
+    /// </summary>
+    Unknown
+}
+```
+
+### 3.4 Entrypoint Model
+
+```csharp
+// File: src/Signals/StellaOps.Signals/Models/CallgraphEntrypoint.cs (NEW)
+
+namespace StellaOps.Signals.Models;
+
+/// <summary>
+/// Represents a discovered entrypoint into the call graph.
+/// </summary>
+public sealed class CallgraphEntrypoint
+{
+    /// <summary>
+    /// Reference to the node that is an entrypoint.
+    /// </summary>
+    [JsonPropertyName("nodeId")]
+    public string NodeId { get; set; } = string.Empty;
+
+    /// <summary>
+    /// Type of entrypoint.
+    /// </summary>
+    [JsonPropertyName("kind")]
+    public EntrypointKind Kind { get; set; } = EntrypointKind.Unknown;
+
+    /// <summary>
+    /// HTTP route pattern (for http/grpc kinds).
+    /// Example: "/api/orders/{id}"
+    /// </summary>
+    [JsonPropertyName("route")]
+    public string? Route { get; set; }
+
+    /// <summary>
+    /// HTTP method (GET, POST, etc.) if applicable.
+    /// </summary>
+    [JsonPropertyName("httpMethod")]
+    public string? HttpMethod { get; set; }
+
+    /// <summary>
+    /// Framework that exposes this entrypoint.
+    /// </summary>
+    [JsonPropertyName("framework")]
+    public EntrypointFramework Framework { get; set; } = EntrypointFramework.Unknown;
+
+    /// <summary>
+    /// Discovery source (attribute, convention, config).
+    /// </summary>
+    [JsonPropertyName("source")]
+    public string? Source { get; set; }
+
+    /// <summary>
+    /// Execution phase when this entrypoint is invoked.
+    /// </summary>
+    [JsonPropertyName("phase")]
+    public EntrypointPhase Phase { get; set; } = EntrypointPhase.Runtime;
+
+    /// <summary>
+    /// Deterministic ordering for stable serialization.
+    /// </summary>
+    [JsonPropertyName("order")]
+    public int Order { get; set; }
+}
+
+/// <summary>
+/// Types of entrypoints.
+/// </summary>
+[JsonConverter(typeof(JsonStringEnumConverter))]
+public enum EntrypointKind
+{
+    Unknown,
+    Http,
+    Grpc,
+    Cli,
+    Job,
+    Event,
+    MessageQueue,
+    Timer,
+    Test,
+    Main,
+    ModuleInit,
+    StaticConstructor
+}
+
+/// <summary>
+/// Frameworks that expose entrypoints.
+/// </summary>
+[JsonConverter(typeof(JsonStringEnumConverter))]
+public enum EntrypointFramework
+{
+    Unknown,
+    AspNetCore,
+    MinimalApi,
+    Spring,
+    SpringBoot,
+    Express,
+    Fastify,
+    NestJs,
+    FastApi,
+    Flask,
+    Django,
+    Rails,
+    Gin,
+    Echo,
+    Actix,
+    Rocket,
+    AzureFunctions,
+    AwsLambda,
+    CloudFunctions
+}
+
+/// <summary>
+/// Execution phase for entrypoints.
+/// </summary>
+[JsonConverter(typeof(JsonStringEnumConverter))]
+public enum EntrypointPhase
+{
+    /// <summary>
+    /// Module/assembly initialization.
+    /// </summary>
+    ModuleInit,
+
+    /// <summary>
+    /// Application startup (Main, startup hooks).
+    /// </summary>
+    AppStart,
+
+    /// <summary>
+    /// Runtime request handling.
+    /// </summary>
+    Runtime,
+
+    /// <summary>
+    /// Shutdown/cleanup handlers.
+    /// </summary>
+    Shutdown
+}
+```
+
+### 3.5 Schema Migration
+
+```csharp
+// File: src/Signals/StellaOps.Signals/Parsing/CallgraphSchemaMigrator.cs (NEW)
+
+namespace StellaOps.Signals.Parsing;
+
+/// <summary>
+/// Migrates call graphs from legacy formats to stella.callgraph.v1.
+/// </summary>
+public static class CallgraphSchemaMigrator
+{
+    /// <summary>
+    /// Ensures document conforms to v1 schema, migrating if necessary.
+    /// </summary>
+    public static CallgraphDocument EnsureV1(CallgraphDocument document)
+    {
+        if (document.Schema == CallgraphSchemaVersions.V1)
+            return document;
+
+        // Migrate from legacy format
+        document.Schema = CallgraphSchemaVersions.V1;
+
+        // Ensure all nodes have visibility
+        foreach (var node in document.Nodes)
+        {
+            if (node.Visibility == SymbolVisibility.Unknown)
+            {
+                node.Visibility = InferVisibility(node.SymbolKey);
+            }
+        }
+
+        // Ensure all edges have reasons
+        foreach (var edge in document.Edges)
+        {
+            if (edge.Reason == EdgeReason.Unknown)
+            {
+                edge.Reason = InferEdgeReason(edge);
+            }
+        }
+
+        // Build entrypoints from nodes if not present
+        if (document.Entrypoints.Count == 0)
+        {
+            document.Entrypoints = InferEntrypoints(document.Nodes, document.Language);
+        }
+
+        return document;
+    }
+
+    private static SymbolVisibility InferVisibility(string symbolKey)
+    {
+        // Heuristic: symbols with "Internal" in namespace are internal
+        if (symbolKey.Contains(".Internal.", StringComparison.OrdinalIgnoreCase))
+            return SymbolVisibility.Internal;
+
+        // Default to public for exposed symbols
+        return SymbolVisibility.Public;
+    }
+
+    private static EdgeReason InferEdgeReason(CallgraphEdge edge)
+    {
+        // Heuristic based on edge kind
+        return edge.Kind switch
+        {
+            EdgeKind.Runtime => EdgeReason.RuntimeMinted,
+            EdgeKind.Heuristic => EdgeReason.DynamicImport,
+            _ => EdgeReason.DirectCall
+        };
+    }
+
+    private static List<CallgraphEntrypoint> InferEntrypoints(
+        List<CallgraphNode> nodes,
+        CallgraphLanguage language)
+    {
+        var entrypoints = new List<CallgraphEntrypoint>();
+        var order = 0;
+
+        foreach (var node in nodes.Where(n => n.IsEntrypointCandidate))
+        {
+            var kind = InferEntrypointKind(node.SymbolKey, language);
+            var framework = InferFramework(node.SymbolKey, language);
+
+            entrypoints.Add(new CallgraphEntrypoint
+            {
+                NodeId = node.NodeId,
+                Kind = kind,
+                Framework = framework,
+                Source = "inference",
+                Phase = kind == EntrypointKind.ModuleInit ? EntrypointPhase.ModuleInit : EntrypointPhase.Runtime,
+                Order = order++
+            });
+        }
+
+        return entrypoints.OrderBy(e => (int)e.Phase).ThenBy(e => e.Order).ToList();
+    }
+
+    private static EntrypointKind InferEntrypointKind(string symbolKey, CallgraphLanguage language)
+    {
+        if (symbolKey.Contains("Controller") || symbolKey.Contains("Handler"))
+            return EntrypointKind.Http;
+        if (symbolKey.Contains("Main"))
+            return EntrypointKind.Main;
+        if (symbolKey.Contains(".cctor") || symbolKey.Contains("ModuleInitializer"))
+            return EntrypointKind.ModuleInit;
+        if (symbolKey.Contains("Test") || symbolKey.Contains("Fact") || symbolKey.Contains("Theory"))
+            return EntrypointKind.Test;
+
+        return EntrypointKind.Unknown;
+    }
+
+    private static EntrypointFramework InferFramework(string symbolKey, CallgraphLanguage language)
+    {
+        return language switch
+        {
+            CallgraphLanguage.DotNet when symbolKey.Contains("Controller") => EntrypointFramework.AspNetCore,
+            CallgraphLanguage.Java when symbolKey.Contains("Controller") => EntrypointFramework.Spring,
+            CallgraphLanguage.Node => EntrypointFramework.Express,
+            CallgraphLanguage.Python => EntrypointFramework.FastApi,
+            _ => EntrypointFramework.Unknown
+        };
+    }
+}
+```
+
+---
+
+## 4. DELIVERY TRACKER
+
+| # | Task | Status | Assignee | Notes |
+|---|------|--------|----------|-------|
+| 1 | Update `CallgraphDocument` with schema field | DONE | | Schema property with CallgraphSchemaVersions.V1 |
+| 2 | Update `CallgraphNode` with visibility, isEntrypointCandidate | DONE | | SymbolVisibility, SymbolKey, ArtifactKey added |
+| 3 | Update `CallgraphEdge` with reason enum | DONE | | EdgeReason + EdgeKind + Weight properties |
+| 4 | Create `CallgraphEntrypoint` model | DONE | | With Kind, Route, HttpMethod, Framework, Phase |
+| 5 | Create `EdgeReason` enum | DONE | | 13 reason codes in EdgeReason.cs |
+| 6 | Create `EntrypointKind` enum | DONE | | EntrypointKind.cs with 12 kinds |
+| 7 | Create `EntrypointFramework` enum | DONE | | EntrypointFramework.cs with 19 frameworks |
+| 8 | Create `CallgraphSchemaMigrator` | DONE | | Full implementation with inference logic |
+| 9 | Update `DotNetCallgraphBuilder` to emit reasons | DONE | | DotNetEdgeReason enum + EdgeReason field |
+| 10 | Update `JavaCallgraphBuilder` to emit reasons | DONE | | JavaEdgeReason enum + EdgeReason field |
+| 11 | Update `NativeCallgraphBuilder` to emit reasons | DONE | | NativeEdgeReason enum + EdgeReason field |
+| 12 | Update callgraph parser to handle v1 schema | DONE | | CallgraphSchemaMigrator.EnsureV1() |
+| 13 | Add visibility extraction in .NET analyzer | DONE | | ExtractVisibility helper, IsEntrypointCandidate |
+| 14 | Add visibility extraction in Java analyzer | DONE | | JavaVisibility enum + IsEntrypointCandidate |
+| 15 | Add entrypoint route extraction | DONE | | RouteTemplate, HttpMethod, Framework in roots |
+| 16 | Update Signals ingestion to migrate legacy | DONE | | CallgraphIngestionService uses migrator |
+| 17 | Unit tests for schema migration | DONE | | 73 tests in CallgraphSchemaMigratorTests.cs |
+| 18 | Golden fixtures for v1 schema | DONE | | 65 tests + 7 fixtures in callgraph-schema-v1/ |
+| 19 | Update documentation | DONE | | docs/signals/callgraph-formats.md |
+
+---
+
+## 5. ACCEPTANCE CRITERIA
+
+### 5.1 Schema Requirements
+
+- [ ] All new call graphs have `schema: "stella.callgraph.v1"`
+- [ ] All nodes have `visibility` field
+- [ ] All nodes have `isEntrypointCandidate` flag
+- [ ] All edges have `reason` field
+- [ ] All entrypoints have `kind`, `framework`
+
+### 5.2 Compatibility Requirements
+
+- [ ] Legacy graphs (no schema field) auto-migrated on ingest
+- [ ] Existing callgraph IDs preserved
+- [ ] No breaking changes to existing consumers
+- [ ] JSON serialization backward compatible
+
+### 5.3 Analyzer Requirements
+
+- [ ] .NET analyzer emits visibility from MethodAttributes
+- [ ] .NET analyzer maps IL opcodes to EdgeReason
+- [ ] .NET analyzer extracts route attributes for entrypoints
+- [ ] Java analyzer emits visibility from access flags
+- [ ] Native analyzer marks DT_NEEDED as DirectCall reason
+
+### 5.4 Determinism Requirements
+
+- [ ] Same source produces identical schema output
+- [ ] Enum values serialized as strings
+- [ ] Arrays sorted by stable keys
+
+---
+
+## 6. DECISIONS & RISKS
+
+| Decision | Rationale | Risk |
+|----------|-----------|------|
+| String enums over integers | Better debugging, self-documenting JSON | Slightly larger payloads |
+| 13 edge reason codes | Balance coverage vs. complexity | May need expansion |
+| Auto-migrate legacy | Smooth upgrade path | Migration bugs |
+| framework enum per language | Accurate framework detection | Large enum |
+
+---
+
+## 7. REFERENCES
+
+- Advisory: `14-Dec-2025 - Reachability Analysis Technical Reference.md` §2.1
+- Existing: `src/Signals/StellaOps.Signals/Models/CallgraphDocument.cs`
+- Existing: `src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.DotNet/Internal/Callgraph/`

docs/implplan/archived/SPRINT_1101_0001_0001_unknowns_ranking_enhancement.md

@@ -0,0 +1,894 @@
+# SPRINT_1101_0001_0001 - Unknowns Ranking Enhancement
+
+**Status:** DONE
+**Priority:** P1 - HIGH
+**Module:** Signals, Scheduler
+**Working Directory:** `src/Signals/StellaOps.Signals/`
+**Estimated Effort:** Medium
+**Dependencies:** None (foundational)
+
+---
+
+## 1. OBJECTIVE
+
+Enhance the unknowns ranking system to enable intelligent triage:
+
+1. **Multi-factor scoring** - Popularity (P), Exploit potential (E), Uncertainty (U), Centrality (C), Staleness (S)
+2. **Band assignment** - HOT/WARM/COLD for prioritized processing
+3. **Scheduler integration** - Auto-rescan policies per band
+4. **API exposure** - Query unknowns by band, explain scores
+
+---
+
+## 2. BACKGROUND
+
+### 2.1 Current State
+
+- `UnknownSymbolDocument` tracks unresolved symbols/edges
+- Basic uncertainty tracking via `UncertaintyTierCalculator`
+- No centrality (graph position) or staleness (age) factors
+- No HOT/WARM/COLD band assignment
+- No scheduler integration for automatic rescanning
+
+### 2.2 Target State
+
+- Full 5-factor scoring formula per advisory
+- Automatic band assignment based on thresholds
+- Scheduler triggers rescans for HOT items immediately, WARM on schedule
+- API exposes reasoning for triage decisions
+
+---
+
+## 3. TECHNICAL DESIGN
+
+### 3.1 Enhanced Unknowns Model
+
+```csharp
+// File: src/Signals/StellaOps.Signals/Models/UnknownSymbolDocument.cs (UPDATED)
+
+namespace StellaOps.Signals.Models;
+
+/// <summary>
+/// Tracks an unresolved symbol or edge requiring additional analysis.
+/// Enhanced with multi-factor scoring for intelligent triage.
+/// </summary>
+public sealed class UnknownSymbolDocument
+{
+    public string Id { get; set; } = Guid.NewGuid().ToString("N");
+
+    public string SubjectKey { get; set; } = string.Empty;
+
+    public string? CallgraphId { get; set; }
+
+    public string? SymbolId { get; set; }
+
+    public string? CodeId { get; set; }
+
+    public string? Purl { get; set; }
+
+    public string? PurlVersion { get; set; }
+
+    public string? EdgeFrom { get; set; }
+
+    public string? EdgeTo { get; set; }
+
+    public string? Reason { get; set; }
+
+    /// <summary>
+    /// Flags indicating sources of uncertainty.
+    /// </summary>
+    public UnknownFlags Flags { get; set; } = new();
+
+    // ===== SCORING FACTORS =====
+
+    /// <summary>
+    /// Popularity impact score (P). Based on deployment count.
+    /// Range: 0.0 - 1.0
+    /// </summary>
+    public double PopularityScore { get; set; }
+
+    /// <summary>
+    /// Number of deployments referencing this package.
+    /// </summary>
+    public int DeploymentCount { get; set; }
+
+    /// <summary>
+    /// Exploit consequence potential (E). Based on CVE severity if known.
+    /// Range: 0.0 - 1.0
+    /// </summary>
+    public double ExploitPotentialScore { get; set; }
+
+    /// <summary>
+    /// Uncertainty density (U). Aggregated from flags.
+    /// Range: 0.0 - 1.0
+    /// </summary>
+    public double UncertaintyScore { get; set; }
+
+    /// <summary>
+    /// Graph centrality (C). Position importance in call graph.
+    /// Range: 0.0 - 1.0
+    /// </summary>
+    public double CentralityScore { get; set; }
+
+    /// <summary>
+    /// Degree centrality (incoming + outgoing edges).
+    /// </summary>
+    public int DegreeCentrality { get; set; }
+
+    /// <summary>
+    /// Betweenness centrality (paths through this node).
+    /// </summary>
+    public double BetweennessCentrality { get; set; }
+
+    /// <summary>
+    /// Evidence staleness (S). Based on age since last analysis.
+    /// Range: 0.0 - 1.0
+    /// </summary>
+    public double StalenessScore { get; set; }
+
+    /// <summary>
+    /// Days since last successful analysis attempt.
+    /// </summary>
+    public int DaysSinceLastAnalysis { get; set; }
+
+    // ===== COMPOSITE SCORE =====
+
+    /// <summary>
+    /// Final weighted score: wP*P + wE*E + wU*U + wC*C + wS*S
+    /// Range: 0.0 - 1.0
+    /// </summary>
+    public double Score { get; set; }
+
+    /// <summary>
+    /// Triage band based on score thresholds.
+    /// </summary>
+    public UnknownsBand Band { get; set; } = UnknownsBand.Cold;
+
+    /// <summary>
+    /// Hash of call graph slice containing this unknown.
+    /// </summary>
+    public string? GraphSliceHash { get; set; }
+
+    /// <summary>
+    /// Hash of all evidence used in scoring.
+    /// </summary>
+    public string? EvidenceSetHash { get; set; }
+
+    /// <summary>
+    /// Trace of normalization steps for debugging.
+    /// </summary>
+    public UnknownsNormalizationTrace? NormalizationTrace { get; set; }
+
+    /// <summary>
+    /// Hash of last call graph analysis attempt.
+    /// </summary>
+    public string? CallgraphAttemptHash { get; set; }
+
+    /// <summary>
+    /// Number of rescan attempts.
+    /// </summary>
+    public int RescanAttempts { get; set; }
+
+    /// <summary>
+    /// Last rescan attempt result.
+    /// </summary>
+    public string? LastRescanResult { get; set; }
+
+    public DateTimeOffset CreatedAt { get; set; }
+
+    public DateTimeOffset UpdatedAt { get; set; }
+
+    public DateTimeOffset? LastAnalyzedAt { get; set; }
+
+    public DateTimeOffset? NextScheduledRescan { get; set; }
+}
+
+/// <summary>
+/// Flags indicating sources of uncertainty for an unknown.
+/// </summary>
+public sealed class UnknownFlags
+{
+    /// <summary>
+    /// No provenance anchor (can't verify source).
+    /// Weight: +0.30
+    /// </summary>
+    public bool NoProvenanceAnchor { get; set; }
+
+    /// <summary>
+    /// Version specified as range, not exact.
+    /// Weight: +0.25
+    /// </summary>
+    public bool VersionRange { get; set; }
+
+    /// <summary>
+    /// Conflicting information from different feeds.
+    /// Weight: +0.20
+    /// </summary>
+    public bool ConflictingFeeds { get; set; }
+
+    /// <summary>
+    /// Missing CVSS vector for severity assessment.
+    /// Weight: +0.15
+    /// </summary>
+    public bool MissingVector { get; set; }
+
+    /// <summary>
+    /// Source advisory URL unreachable.
+    /// Weight: +0.10
+    /// </summary>
+    public bool UnreachableSourceAdvisory { get; set; }
+
+    /// <summary>
+    /// Dynamic call target (reflection, eval).
+    /// Weight: +0.25
+    /// </summary>
+    public bool DynamicCallTarget { get; set; }
+
+    /// <summary>
+    /// External assembly not in analysis scope.
+    /// Weight: +0.20
+    /// </summary>
+    public bool ExternalAssembly { get; set; }
+}
+
+/// <summary>
+/// Triage bands for unknowns.
+/// </summary>
+public enum UnknownsBand
+{
+    /// <summary>
+    /// Score ≥ 0.70. Immediate rescan + VEX escalation.
+    /// </summary>
+    Hot,
+
+    /// <summary>
+    /// 0.40 ≤ Score < 0.70. Scheduled rescan 12-72h.
+    /// </summary>
+    Warm,
+
+    /// <summary>
+    /// Score < 0.40. Weekly batch processing.
+    /// </summary>
+    Cold
+}
+
+/// <summary>
+/// Detailed trace of score normalization for debugging.
+/// </summary>
+public sealed class UnknownsNormalizationTrace
+{
+    public double RawPopularity { get; set; }
+    public double NormalizedPopularity { get; set; }
+    public string PopularityFormula { get; set; } = string.Empty;
+
+    public double RawExploitPotential { get; set; }
+    public double NormalizedExploitPotential { get; set; }
+
+    public double RawUncertainty { get; set; }
+    public double NormalizedUncertainty { get; set; }
+    public List<string> ActiveFlags { get; set; } = new();
+
+    public double RawCentrality { get; set; }
+    public double NormalizedCentrality { get; set; }
+
+    public double RawStaleness { get; set; }
+    public double NormalizedStaleness { get; set; }
+
+    public Dictionary<string, double> Weights { get; set; } = new();
+    public double FinalScore { get; set; }
+    public string AssignedBand { get; set; } = string.Empty;
+
+    public DateTimeOffset ComputedAt { get; set; }
+}
+```
+
+### 3.2 Scoring Service
+
+```csharp
+// File: src/Signals/StellaOps.Signals/Services/UnknownsScoringService.cs (NEW)
+
+namespace StellaOps.Signals.Services;
+
+/// <summary>
+/// Computes multi-factor scores for unknowns and assigns triage bands.
+/// </summary>
+public sealed class UnknownsScoringService : IUnknownsScoringService
+{
+    private readonly IUnknownsRepository _repository;
+    private readonly IDeploymentRefsRepository _deploymentRefs;
+    private readonly IGraphMetricsRepository _graphMetrics;
+    private readonly IOptions<UnknownsScoringOptions> _options;
+    private readonly TimeProvider _timeProvider;
+    private readonly ILogger<UnknownsScoringService> _logger;
+
+    public UnknownsScoringService(
+        IUnknownsRepository repository,
+        IDeploymentRefsRepository deploymentRefs,
+        IGraphMetricsRepository graphMetrics,
+        IOptions<UnknownsScoringOptions> options,
+        TimeProvider timeProvider,
+        ILogger<UnknownsScoringService> logger)
+    {
+        _repository = repository;
+        _deploymentRefs = deploymentRefs;
+        _graphMetrics = graphMetrics;
+        _options = options;
+        _timeProvider = timeProvider;
+        _logger = logger;
+    }
+
+    /// <summary>
+    /// Recomputes scores for all unknowns in a subject.
+    /// </summary>
+    public async Task<UnknownsScoringResult> RecomputeAsync(
+        string subjectKey,
+        CancellationToken cancellationToken = default)
+    {
+        var unknowns = await _repository.GetBySubjectAsync(subjectKey, cancellationToken);
+        var updated = new List<UnknownSymbolDocument>();
+        var opts = _options.Value;
+
+        foreach (var unknown in unknowns)
+        {
+            var scored = await ScoreUnknownAsync(unknown, opts, cancellationToken);
+            updated.Add(scored);
+        }
+
+        await _repository.BulkUpdateAsync(updated, cancellationToken);
+
+        return new UnknownsScoringResult(
+            SubjectKey: subjectKey,
+            TotalUnknowns: updated.Count,
+            HotCount: updated.Count(u => u.Band == UnknownsBand.Hot),
+            WarmCount: updated.Count(u => u.Band == UnknownsBand.Warm),
+            ColdCount: updated.Count(u => u.Band == UnknownsBand.Cold),
+            ComputedAt: _timeProvider.GetUtcNow());
+    }
+
+    /// <summary>
+    /// Scores a single unknown using the 5-factor formula.
+    /// </summary>
+    public async Task<UnknownSymbolDocument> ScoreUnknownAsync(
+        UnknownSymbolDocument unknown,
+        UnknownsScoringOptions opts,
+        CancellationToken cancellationToken)
+    {
+        var trace = new UnknownsNormalizationTrace
+        {
+            ComputedAt = _timeProvider.GetUtcNow(),
+            Weights = new Dictionary<string, double>
+            {
+                ["wP"] = opts.WeightPopularity,
+                ["wE"] = opts.WeightExploitPotential,
+                ["wU"] = opts.WeightUncertainty,
+                ["wC"] = opts.WeightCentrality,
+                ["wS"] = opts.WeightStaleness
+            }
+        };
+
+        // Factor P: Popularity (deployment impact)
+        var (popularityScore, deploymentCount) = await ComputePopularityAsync(
+            unknown.Purl, opts, cancellationToken);
+        unknown.PopularityScore = popularityScore;
+        unknown.DeploymentCount = deploymentCount;
+        trace.RawPopularity = deploymentCount;
+        trace.NormalizedPopularity = popularityScore;
+        trace.PopularityFormula = $"min(1, log10(1 + {deploymentCount}) / log10(1 + {opts.PopularityMaxDeployments}))";
+
+        // Factor E: Exploit potential (CVE severity)
+        var exploitScore = ComputeExploitPotential(unknown);
+        unknown.ExploitPotentialScore = exploitScore;
+        trace.RawExploitPotential = exploitScore;
+        trace.NormalizedExploitPotential = exploitScore;
+
+        // Factor U: Uncertainty density (from flags)
+        var (uncertaintyScore, activeFlags) = ComputeUncertainty(unknown.Flags, opts);
+        unknown.UncertaintyScore = uncertaintyScore;
+        trace.RawUncertainty = uncertaintyScore;
+        trace.NormalizedUncertainty = Math.Min(1.0, uncertaintyScore);
+        trace.ActiveFlags = activeFlags;
+
+        // Factor C: Graph centrality
+        var (centralityScore, degree, betweenness) = await ComputeCentralityAsync(
+            unknown.SymbolId, unknown.CallgraphId, opts, cancellationToken);
+        unknown.CentralityScore = centralityScore;
+        unknown.DegreeCentrality = degree;
+        unknown.BetweennessCentrality = betweenness;
+        trace.RawCentrality = betweenness;
+        trace.NormalizedCentrality = centralityScore;
+
+        // Factor S: Evidence staleness
+        var (stalenessScore, daysSince) = ComputeStaleness(unknown.LastAnalyzedAt, opts);
+        unknown.StalenessScore = stalenessScore;
+        unknown.DaysSinceLastAnalysis = daysSince;
+        trace.RawStaleness = daysSince;
+        trace.NormalizedStaleness = stalenessScore;
+
+        // Composite score
+        var score = Math.Clamp(
+            opts.WeightPopularity * unknown.PopularityScore +
+            opts.WeightExploitPotential * unknown.ExploitPotentialScore +
+            opts.WeightUncertainty * unknown.UncertaintyScore +
+            opts.WeightCentrality * unknown.CentralityScore +
+            opts.WeightStaleness * unknown.StalenessScore,
+            0.0, 1.0);
+
+        unknown.Score = score;
+        trace.FinalScore = score;
+
+        // Band assignment
+        unknown.Band = score switch
+        {
+            >= 0.70 => UnknownsBand.Hot,
+            >= 0.40 => UnknownsBand.Warm,
+            _ => UnknownsBand.Cold
+        };
+        trace.AssignedBand = unknown.Band.ToString();
+
+        // Schedule next rescan based on band
+        unknown.NextScheduledRescan = unknown.Band switch
+        {
+            UnknownsBand.Hot => _timeProvider.GetUtcNow().AddMinutes(15),
+            UnknownsBand.Warm => _timeProvider.GetUtcNow().AddHours(opts.WarmRescanHours),
+            _ => _timeProvider.GetUtcNow().AddDays(opts.ColdRescanDays)
+        };
+
+        unknown.NormalizationTrace = trace;
+        unknown.UpdatedAt = _timeProvider.GetUtcNow();
+
+        _logger.LogDebug(
+            "Scored unknown {UnknownId}: P={P:F2} E={E:F2} U={U:F2} C={C:F2} S={S:F2} → Score={Score:F2} Band={Band}",
+            unknown.Id,
+            unknown.PopularityScore,
+            unknown.ExploitPotentialScore,
+            unknown.UncertaintyScore,
+            unknown.CentralityScore,
+            unknown.StalenessScore,
+            unknown.Score,
+            unknown.Band);
+
+        return unknown;
+    }
+
+    private async Task<(double Score, int DeploymentCount)> ComputePopularityAsync(
+        string? purl,
+        UnknownsScoringOptions opts,
+        CancellationToken cancellationToken)
+    {
+        if (string.IsNullOrWhiteSpace(purl))
+            return (0.0, 0);
+
+        var deployments = await _deploymentRefs.CountDeploymentsAsync(purl, cancellationToken);
+
+        // Formula: P = min(1, log10(1 + deployments) / log10(1 + maxDeployments))
+        var score = Math.Min(1.0,
+            Math.Log10(1 + deployments) / Math.Log10(1 + opts.PopularityMaxDeployments));
+
+        return (score, deployments);
+    }
+
+    private static double ComputeExploitPotential(UnknownSymbolDocument unknown)
+    {
+        // If we have associated CVE severity, use it
+        // Otherwise, assume medium potential (0.5)
+        // This could be enhanced with KEV lookup, exploit DB, etc.
+        return 0.5;
+    }
+
+    private static (double Score, List<string> ActiveFlags) ComputeUncertainty(
+        UnknownFlags flags,
+        UnknownsScoringOptions opts)
+    {
+        var score = 0.0;
+        var activeFlags = new List<string>();
+
+        if (flags.NoProvenanceAnchor)
+        {
+            score += opts.FlagWeightNoProvenance;
+            activeFlags.Add("NoProvenanceAnchor");
+        }
+        if (flags.VersionRange)
+        {
+            score += opts.FlagWeightVersionRange;
+            activeFlags.Add("VersionRange");
+        }
+        if (flags.ConflictingFeeds)
+        {
+            score += opts.FlagWeightConflictingFeeds;
+            activeFlags.Add("ConflictingFeeds");
+        }
+        if (flags.MissingVector)
+        {
+            score += opts.FlagWeightMissingVector;
+            activeFlags.Add("MissingVector");
+        }
+        if (flags.UnreachableSourceAdvisory)
+        {
+            score += opts.FlagWeightUnreachableSource;
+            activeFlags.Add("UnreachableSourceAdvisory");
+        }
+        if (flags.DynamicCallTarget)
+        {
+            score += opts.FlagWeightDynamicTarget;
+            activeFlags.Add("DynamicCallTarget");
+        }
+        if (flags.ExternalAssembly)
+        {
+            score += opts.FlagWeightExternalAssembly;
+            activeFlags.Add("ExternalAssembly");
+        }
+
+        return (Math.Min(1.0, score), activeFlags);
+    }
+
+    private async Task<(double Score, int Degree, double Betweenness)> ComputeCentralityAsync(
+        string? symbolId,
+        string? callgraphId,
+        UnknownsScoringOptions opts,
+        CancellationToken cancellationToken)
+    {
+        if (string.IsNullOrWhiteSpace(symbolId) || string.IsNullOrWhiteSpace(callgraphId))
+            return (0.0, 0, 0.0);
+
+        var metrics = await _graphMetrics.GetMetricsAsync(symbolId, callgraphId, cancellationToken);
+        if (metrics is null)
+            return (0.0, 0, 0.0);
+
+        // Normalize betweenness to 0-1 range
+        var normalizedBetweenness = Math.Min(1.0, metrics.Betweenness / opts.CentralityMaxBetweenness);
+
+        return (normalizedBetweenness, metrics.Degree, metrics.Betweenness);
+    }
+
+    private (double Score, int DaysSince) ComputeStaleness(
+        DateTimeOffset? lastAnalyzedAt,
+        UnknownsScoringOptions opts)
+    {
+        if (lastAnalyzedAt is null)
+            return (1.0, opts.StalenessMaxDays); // Never analyzed = maximum staleness
+
+        var daysSince = (int)(_timeProvider.GetUtcNow() - lastAnalyzedAt.Value).TotalDays;
+
+        // Formula: S = min(1, age_days / max_days)
+        var score = Math.Min(1.0, (double)daysSince / opts.StalenessMaxDays);
+
+        return (score, daysSince);
+    }
+}
+
+public sealed record UnknownsScoringResult(
+    string SubjectKey,
+    int TotalUnknowns,
+    int HotCount,
+    int WarmCount,
+    int ColdCount,
+    DateTimeOffset ComputedAt);
+```
+
+### 3.3 Scoring Options
+
+```csharp
+// File: src/Signals/StellaOps.Signals/Options/UnknownsScoringOptions.cs (NEW)
+
+namespace StellaOps.Signals.Options;
+
+/// <summary>
+/// Configuration for unknowns scoring algorithm.
+/// </summary>
+public sealed class UnknownsScoringOptions
+{
+    public const string SectionName = "Signals:UnknownsScoring";
+
+    // ===== FACTOR WEIGHTS =====
+    // Must sum to 1.0
+
+    /// <summary>
+    /// Weight for popularity factor (wP). Default: 0.25
+    /// </summary>
+    public double WeightPopularity { get; set; } = 0.25;
+
+    /// <summary>
+    /// Weight for exploit potential factor (wE). Default: 0.25
+    /// </summary>
+    public double WeightExploitPotential { get; set; } = 0.25;
+
+    /// <summary>
+    /// Weight for uncertainty density factor (wU). Default: 0.25
+    /// </summary>
+    public double WeightUncertainty { get; set; } = 0.25;
+
+    /// <summary>
+    /// Weight for graph centrality factor (wC). Default: 0.15
+    /// </summary>
+    public double WeightCentrality { get; set; } = 0.15;
+
+    /// <summary>
+    /// Weight for evidence staleness factor (wS). Default: 0.10
+    /// </summary>
+    public double WeightStaleness { get; set; } = 0.10;
+
+    // ===== POPULARITY NORMALIZATION =====
+
+    /// <summary>
+    /// Maximum deployments for normalization. Default: 100
+    /// </summary>
+    public int PopularityMaxDeployments { get; set; } = 100;
+
+    // ===== UNCERTAINTY FLAG WEIGHTS =====
+
+    public double FlagWeightNoProvenance { get; set; } = 0.30;
+    public double FlagWeightVersionRange { get; set; } = 0.25;
+    public double FlagWeightConflictingFeeds { get; set; } = 0.20;
+    public double FlagWeightMissingVector { get; set; } = 0.15;
+    public double FlagWeightUnreachableSource { get; set; } = 0.10;
+    public double FlagWeightDynamicTarget { get; set; } = 0.25;
+    public double FlagWeightExternalAssembly { get; set; } = 0.20;
+
+    // ===== CENTRALITY NORMALIZATION =====
+
+    /// <summary>
+    /// Maximum betweenness for normalization. Default: 1000
+    /// </summary>
+    public double CentralityMaxBetweenness { get; set; } = 1000.0;
+
+    // ===== STALENESS NORMALIZATION =====
+
+    /// <summary>
+    /// Maximum days for staleness normalization. Default: 14
+    /// </summary>
+    public int StalenessMaxDays { get; set; } = 14;
+
+    // ===== BAND THRESHOLDS =====
+
+    /// <summary>
+    /// Score threshold for HOT band. Default: 0.70
+    /// </summary>
+    public double HotThreshold { get; set; } = 0.70;
+
+    /// <summary>
+    /// Score threshold for WARM band. Default: 0.40
+    /// </summary>
+    public double WarmThreshold { get; set; } = 0.40;
+
+    // ===== RESCAN SCHEDULING =====
+
+    /// <summary>
+    /// Hours until WARM items are rescanned. Default: 24
+    /// </summary>
+    public int WarmRescanHours { get; set; } = 24;
+
+    /// <summary>
+    /// Days until COLD items are rescanned. Default: 7
+    /// </summary>
+    public int ColdRescanDays { get; set; } = 7;
+}
+```
+
+### 3.4 Database Schema
+
+```sql
+-- File: docs/db/migrations/V1101_001__unknowns_ranking_tables.sql
+
+-- Deployment references for popularity scoring
+CREATE TABLE signals.deploy_refs (
+    id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+    purl TEXT NOT NULL,
+    image_id TEXT NOT NULL,
+    environment TEXT,
+    first_seen_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    last_seen_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    UNIQUE (purl, image_id, environment)
+);
+
+CREATE INDEX idx_deploy_refs_purl ON signals.deploy_refs(purl);
+CREATE INDEX idx_deploy_refs_last_seen ON signals.deploy_refs(last_seen_at);
+
+-- Graph metrics for centrality scoring
+CREATE TABLE signals.graph_metrics (
+    id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+    symbol_id TEXT NOT NULL,
+    callgraph_id TEXT NOT NULL,
+    degree INT NOT NULL DEFAULT 0,
+    betweenness FLOAT NOT NULL DEFAULT 0,
+    last_computed_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    UNIQUE (symbol_id, callgraph_id)
+);
+
+CREATE INDEX idx_graph_metrics_symbol ON signals.graph_metrics(symbol_id);
+
+-- Enhanced unknowns table (if not using existing)
+ALTER TABLE signals.unknowns ADD COLUMN IF NOT EXISTS popularity_score FLOAT DEFAULT 0;
+ALTER TABLE signals.unknowns ADD COLUMN IF NOT EXISTS deployment_count INT DEFAULT 0;
+ALTER TABLE signals.unknowns ADD COLUMN IF NOT EXISTS exploit_potential_score FLOAT DEFAULT 0;
+ALTER TABLE signals.unknowns ADD COLUMN IF NOT EXISTS uncertainty_score FLOAT DEFAULT 0;
+ALTER TABLE signals.unknowns ADD COLUMN IF NOT EXISTS centrality_score FLOAT DEFAULT 0;
+ALTER TABLE signals.unknowns ADD COLUMN IF NOT EXISTS degree_centrality INT DEFAULT 0;
+ALTER TABLE signals.unknowns ADD COLUMN IF NOT EXISTS betweenness_centrality FLOAT DEFAULT 0;
+ALTER TABLE signals.unknowns ADD COLUMN IF NOT EXISTS staleness_score FLOAT DEFAULT 0;
+ALTER TABLE signals.unknowns ADD COLUMN IF NOT EXISTS days_since_last_analysis INT DEFAULT 0;
+ALTER TABLE signals.unknowns ADD COLUMN IF NOT EXISTS score FLOAT DEFAULT 0;
+ALTER TABLE signals.unknowns ADD COLUMN IF NOT EXISTS band TEXT DEFAULT 'cold' CHECK (band IN ('hot', 'warm', 'cold'));
+ALTER TABLE signals.unknowns ADD COLUMN IF NOT EXISTS flags JSONB DEFAULT '{}';
+ALTER TABLE signals.unknowns ADD COLUMN IF NOT EXISTS normalization_trace JSONB;
+ALTER TABLE signals.unknowns ADD COLUMN IF NOT EXISTS rescan_attempts INT DEFAULT 0;
+ALTER TABLE signals.unknowns ADD COLUMN IF NOT EXISTS last_rescan_result TEXT;
+ALTER TABLE signals.unknowns ADD COLUMN IF NOT EXISTS next_scheduled_rescan TIMESTAMPTZ;
+ALTER TABLE signals.unknowns ADD COLUMN IF NOT EXISTS last_analyzed_at TIMESTAMPTZ;
+
+CREATE INDEX idx_unknowns_band ON signals.unknowns(band);
+CREATE INDEX idx_unknowns_score ON signals.unknowns(score DESC);
+CREATE INDEX idx_unknowns_next_rescan ON signals.unknowns(next_scheduled_rescan) WHERE next_scheduled_rescan IS NOT NULL;
+```
+
+### 3.5 Scheduler Integration
+
+```csharp
+// File: src/Scheduler/__Libraries/StellaOps.Scheduler.Worker/Unknowns/UnknownsRescanWorker.cs (NEW)
+
+namespace StellaOps.Scheduler.Worker.Unknowns;
+
+/// <summary>
+/// Background worker that processes unknowns rescans based on band scheduling.
+/// </summary>
+public sealed class UnknownsRescanWorker : BackgroundService
+{
+    private readonly IUnknownsRepository _repository;
+    private readonly IRescanOrchestrator _orchestrator;
+    private readonly IOptions<UnknownsRescanOptions> _options;
+    private readonly ILogger<UnknownsRescanWorker> _logger;
+
+    protected override async Task ExecuteAsync(CancellationToken stoppingToken)
+    {
+        while (!stoppingToken.IsCancellationRequested)
+        {
+            try
+            {
+                await ProcessHotBandAsync(stoppingToken);
+                await ProcessWarmBandAsync(stoppingToken);
+                await ProcessColdBandAsync(stoppingToken);
+            }
+            catch (Exception ex) when (ex is not OperationCanceledException)
+            {
+                _logger.LogError(ex, "Error in unknowns rescan worker");
+            }
+
+            await Task.Delay(_options.Value.PollInterval, stoppingToken);
+        }
+    }
+
+    private async Task ProcessHotBandAsync(CancellationToken cancellationToken)
+    {
+        var hotItems = await _repository.GetDueForRescanAsync(
+            UnknownsBand.Hot,
+            _options.Value.HotBatchSize,
+            cancellationToken);
+
+        foreach (var item in hotItems)
+        {
+            _logger.LogInformation(
+                "Triggering immediate rescan for HOT unknown {UnknownId} (score={Score:F2})",
+                item.Id, item.Score);
+
+            await _orchestrator.TriggerRescanAsync(item, RescanPriority.Immediate, cancellationToken);
+        }
+    }
+
+    private async Task ProcessWarmBandAsync(CancellationToken cancellationToken)
+    {
+        var warmItems = await _repository.GetDueForRescanAsync(
+            UnknownsBand.Warm,
+            _options.Value.WarmBatchSize,
+            cancellationToken);
+
+        foreach (var item in warmItems)
+        {
+            _logger.LogInformation(
+                "Scheduling rescan for WARM unknown {UnknownId} (score={Score:F2})",
+                item.Id, item.Score);
+
+            await _orchestrator.TriggerRescanAsync(item, RescanPriority.Scheduled, cancellationToken);
+        }
+    }
+
+    private async Task ProcessColdBandAsync(CancellationToken cancellationToken)
+    {
+        // COLD items processed in weekly batches
+        if (_options.Value.ColdBatchDay != DateTimeOffset.UtcNow.DayOfWeek)
+            return;
+
+        var coldItems = await _repository.GetDueForRescanAsync(
+            UnknownsBand.Cold,
+            _options.Value.ColdBatchSize,
+            cancellationToken);
+
+        _logger.LogInformation(
+            "Processing weekly COLD batch: {Count} unknowns",
+            coldItems.Count);
+
+        await _orchestrator.TriggerBatchRescanAsync(coldItems, RescanPriority.Batch, cancellationToken);
+    }
+}
+```
+
+---
+
+## 4. DELIVERY TRACKER
+
+| # | Task | Status | Assignee | Notes |
+|---|------|--------|----------|-------|
+| 1 | Enhance `UnknownSymbolDocument` with scoring fields | DONE | | Band, NormalizationTrace, CompositeScore properties |
+| 2 | Create `UnknownFlags` model | DONE | | 7 flag types in UnknownFlags.cs |
+| 3 | Create `UnknownsBand` enum | DONE | | Hot/Warm/Cold in UnknownsBand.cs |
+| 4 | Create `UnknownsNormalizationTrace` | DONE | | UnknownsNormalizationTrace.cs |
+| 5 | Create `UnknownsScoringOptions` | DONE | | UnknownsScoringOptions.cs |
+| 6 | Create `IUnknownsScoringService` interface | DONE | | IUnknownsScoringService.cs |
+| 7 | Implement `UnknownsScoringService` | DONE | | 5-factor formula implemented |
+| 8 | Create `IDeploymentRefsRepository` | DONE | | Popularity lookups |
+| 9 | Create `IGraphMetricsRepository` | DONE | | Centrality lookups |
+| 10 | Implement Postgres repositories | DONE | | PostgresUnknownsRepository.cs |
+| 11 | Create database migrations | DONE | | Signals schema with unknowns table |
+| 12 | Create `UnknownsRescanWorker` | DONE | | UnknownsRescanWorker.cs with IRescanOrchestrator |
+| 13 | Add appsettings configuration | DONE | | Options pattern with weights |
+| 14 | Add API endpoint `GET /unknowns` | DONE | | Query by band with pagination |
+| 15 | Add API endpoint `GET /unknowns/{id}/explain` | DONE | | Score breakdown with normalization trace |
+| 16 | Add metrics/telemetry | DONE | | UnknownsRescanMetrics.cs with band distribution gauges |
+| 17 | Unit tests for scoring service | DONE | | UnknownsScoringServiceTests.cs |
+| 18 | Integration tests | DONE | | UnknownsScoringIntegrationTests.cs |
+| 19 | Documentation | DONE | | docs/signals/unknowns-ranking.md |
+
+---
+
+## 5. ACCEPTANCE CRITERIA
+
+### 5.1 Scoring Requirements
+
+- [ ] 5-factor formula implemented: P + E + U + C + S
+- [ ] Weights configurable via appsettings
+- [ ] Normalization formulas match advisory specification
+- [ ] Score range clamped to [0, 1]
+
+### 5.2 Band Assignment Requirements
+
+- [ ] HOT: Score ≥ 0.70
+- [ ] WARM: 0.40 ≤ Score < 0.70
+- [ ] COLD: Score < 0.40
+- [ ] Thresholds configurable
+
+### 5.3 Scheduler Requirements
+
+- [ ] HOT items trigger immediate rescan
+- [ ] WARM items scheduled within 12-72 hours
+- [ ] COLD items in weekly batch
+- [ ] Rescan attempts tracked
+- [ ] Failed rescans exponentially backed off
+
+### 5.4 API Requirements
+
+- [ ] `GET /unknowns?band=hot` filters by band
+- [ ] `GET /unknowns/{id}/explain` returns full trace
+- [ ] Response includes all scoring factors
+
+### 5.5 Determinism Requirements
+
+- [ ] Same inputs produce identical scores
+- [ ] Normalization trace enables replay
+- [ ] Weights and formulas logged
+
+---
+
+## 6. DECISIONS & RISKS
+
+| Decision | Rationale | Risk |
+|----------|-----------|------|
+| 5-factor scoring | Balances multiple concerns per advisory | Weight tuning needed |
+| HOT threshold 0.70 | High bar for immediate action | May miss some urgent items |
+| Weekly COLD batch | Reduce load for low-priority items | Delayed resolution |
+| Betweenness for centrality | Standard graph metric | Expensive to compute |
+
+---
+
+## 7. REFERENCES
+
+- Advisory: `14-Dec-2025 - Reachability Analysis Technical Reference.md` §3.2, §4.3
+- Existing: `src/Signals/StellaOps.Signals/Models/UnknownSymbolDocument.cs`
+- Existing: `src/Signals/StellaOps.Signals/Lattice/UncertaintyTierCalculator.cs`

docs/implplan/archived/SPRINT_1102_0001_0001_unknowns_scoring_schema.md

@@ -0,0 +1,476 @@
+# SPRINT_1102_0001_0001 - Database Schema: Unknowns Scoring & Metrics Tables
+
+**Status:** DONE
+**Priority:** P0 - CRITICAL
+**Module:** Signals, Database
+**Working Directory:** `src/Signals/StellaOps.Signals.Storage.Postgres/`
+**Estimated Effort:** Medium
+**Dependencies:** None (foundational)
+
+---
+
+## 1. OBJECTIVE
+
+Extend the database schema to support full 5-factor unknowns scoring with band assignment, decay tracking, and rescan scheduling.
+
+### Goals
+
+1. **Scoring columns** - Add popularity, exploit potential, uncertainty, centrality, staleness scores
+2. **Band assignment** - Add HOT/WARM/COLD band column with constraints
+3. **Normalization trace** - Store scoring computation trace for debugging
+4. **Rescan scheduling** - Track next scheduled rescan and attempt history
+
+---
+
+## 2. BACKGROUND
+
+### 2.1 Current State
+
+The existing `signals.unknowns` table has basic fields:
+- `subject_key`, `callgraph_id`, `symbol_id`, `code_id`, `purl`
+- `edge_from`, `edge_to`, `reason`
+- `created_at`
+
+Missing:
+- All scoring factors (P, E, U, C, S)
+- Composite score and band
+- Flags (uncertainty sources)
+- Rescan tracking
+- Normalization trace
+
+### 2.2 Target State
+
+Full scoring support per advisory §17-18:
+- 5-factor scores with ranges [0.0, 1.0]
+- Composite score with configurable weights
+- Band assignment with thresholds
+- Rescan scheduling per band
+- Audit-friendly normalization trace
+
+---
+
+## 3. TECHNICAL DESIGN
+
+### 3.1 Schema Migration
+
+```sql
+-- File: src/Signals/StellaOps.Signals.Storage.Postgres/Migrations/V1102_001__unknowns_scoring_schema.sql
+
+-- ============================================================
+-- UNKNOWNS SCORING SCHEMA EXTENSION
+-- Advisory Reference: 14-Dec-2025 - Triage and Unknowns §17-18
+-- ============================================================
+
+-- Extend unknowns table with scoring columns
+ALTER TABLE signals.unknowns
+    -- Scoring factors (range: 0.0 - 1.0)
+    ADD COLUMN IF NOT EXISTS popularity_p FLOAT DEFAULT 0.0
+        CONSTRAINT chk_popularity_range CHECK (popularity_p >= 0.0 AND popularity_p <= 1.0),
+    ADD COLUMN IF NOT EXISTS deployment_count INT DEFAULT 0,
+
+    ADD COLUMN IF NOT EXISTS exploit_potential_e FLOAT DEFAULT 0.0
+        CONSTRAINT chk_exploit_range CHECK (exploit_potential_e >= 0.0 AND exploit_potential_e <= 1.0),
+
+    ADD COLUMN IF NOT EXISTS uncertainty_u FLOAT DEFAULT 0.0
+        CONSTRAINT chk_uncertainty_range CHECK (uncertainty_u >= 0.0 AND uncertainty_u <= 1.0),
+
+    ADD COLUMN IF NOT EXISTS centrality_c FLOAT DEFAULT 0.0
+        CONSTRAINT chk_centrality_range CHECK (centrality_c >= 0.0 AND centrality_c <= 1.0),
+    ADD COLUMN IF NOT EXISTS degree_centrality INT DEFAULT 0,
+    ADD COLUMN IF NOT EXISTS betweenness_centrality FLOAT DEFAULT 0.0,
+
+    ADD COLUMN IF NOT EXISTS staleness_s FLOAT DEFAULT 0.0
+        CONSTRAINT chk_staleness_range CHECK (staleness_s >= 0.0 AND staleness_s <= 1.0),
+    ADD COLUMN IF NOT EXISTS days_since_analysis INT DEFAULT 0,
+
+    -- Composite score and band
+    ADD COLUMN IF NOT EXISTS score FLOAT DEFAULT 0.0
+        CONSTRAINT chk_score_range CHECK (score >= 0.0 AND score <= 1.0),
+    ADD COLUMN IF NOT EXISTS band TEXT DEFAULT 'cold'
+        CONSTRAINT chk_band_value CHECK (band IN ('hot', 'warm', 'cold')),
+
+    -- Uncertainty flags (JSONB for extensibility)
+    ADD COLUMN IF NOT EXISTS unknown_flags JSONB DEFAULT '{}'::jsonb,
+
+    -- Normalization trace for debugging/audit
+    ADD COLUMN IF NOT EXISTS normalization_trace JSONB,
+
+    -- Rescan scheduling
+    ADD COLUMN IF NOT EXISTS rescan_attempts INT DEFAULT 0,
+    ADD COLUMN IF NOT EXISTS last_rescan_result TEXT,
+    ADD COLUMN IF NOT EXISTS next_scheduled_rescan TIMESTAMPTZ,
+    ADD COLUMN IF NOT EXISTS last_analyzed_at TIMESTAMPTZ,
+
+    -- Graph slice reference
+    ADD COLUMN IF NOT EXISTS graph_slice_hash BYTEA,
+    ADD COLUMN IF NOT EXISTS evidence_set_hash BYTEA,
+    ADD COLUMN IF NOT EXISTS callgraph_attempt_hash BYTEA,
+
+    -- Timestamps
+    ADD COLUMN IF NOT EXISTS updated_at TIMESTAMPTZ DEFAULT NOW();
+
+-- Create indexes for efficient querying
+CREATE INDEX IF NOT EXISTS idx_unknowns_band
+    ON signals.unknowns(band);
+
+CREATE INDEX IF NOT EXISTS idx_unknowns_score_desc
+    ON signals.unknowns(score DESC);
+
+CREATE INDEX IF NOT EXISTS idx_unknowns_band_score
+    ON signals.unknowns(band, score DESC);
+
+CREATE INDEX IF NOT EXISTS idx_unknowns_next_rescan
+    ON signals.unknowns(next_scheduled_rescan)
+    WHERE next_scheduled_rescan IS NOT NULL;
+
+CREATE INDEX IF NOT EXISTS idx_unknowns_hot_band
+    ON signals.unknowns(score DESC)
+    WHERE band = 'hot';
+
+CREATE INDEX IF NOT EXISTS idx_unknowns_purl
+    ON signals.unknowns(purl);
+
+-- GIN index for JSONB flags queries
+CREATE INDEX IF NOT EXISTS idx_unknowns_flags_gin
+    ON signals.unknowns USING GIN (unknown_flags);
+
+-- ============================================================
+-- COMMENTS
+-- ============================================================
+
+COMMENT ON COLUMN signals.unknowns.popularity_p IS
+    'Deployment impact score (P). Formula: min(1, log10(1 + deployments)/log10(1 + 100))';
+
+COMMENT ON COLUMN signals.unknowns.exploit_potential_e IS
+    'Exploit consequence potential (E). Based on CVE severity, KEV status.';
+
+COMMENT ON COLUMN signals.unknowns.uncertainty_u IS
+    'Uncertainty density (U). Aggregated from flags: no_provenance(0.30), version_range(0.25), conflicting_feeds(0.20), missing_vector(0.15), unreachable_source(0.10)';
+
+COMMENT ON COLUMN signals.unknowns.centrality_c IS
+    'Graph centrality (C). Normalized betweenness centrality.';
+
+COMMENT ON COLUMN signals.unknowns.staleness_s IS
+    'Evidence staleness (S). Formula: min(1, age_days / 14)';
+
+COMMENT ON COLUMN signals.unknowns.score IS
+    'Composite score: clamp01(wP*P + wE*E + wU*U + wC*C + wS*S). Default weights: wP=0.25, wE=0.25, wU=0.25, wC=0.15, wS=0.10';
+
+COMMENT ON COLUMN signals.unknowns.band IS
+    'Triage band. HOT (>=0.70): immediate rescan. WARM (0.40-0.69): scheduled 12-72h. COLD (<0.40): weekly batch.';
+
+COMMENT ON COLUMN signals.unknowns.unknown_flags IS
+    'JSONB flags: {no_provenance_anchor, version_range, conflicting_feeds, missing_vector, unreachable_source_advisory, dynamic_call_target, external_assembly}';
+
+COMMENT ON COLUMN signals.unknowns.normalization_trace IS
+    'JSONB trace of scoring computation for audit/debugging. Includes raw values, normalized values, weights, and formula.';
+```
+
+### 3.2 Unknown Flags Schema
+
+```json
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "title": "UnknownFlags",
+  "type": "object",
+  "properties": {
+    "no_provenance_anchor": {
+      "type": "boolean",
+      "description": "No provenance anchor (can't verify source). Weight: +0.30"
+    },
+    "version_range": {
+      "type": "boolean",
+      "description": "Version specified as range, not exact. Weight: +0.25"
+    },
+    "conflicting_feeds": {
+      "type": "boolean",
+      "description": "Conflicting information from different feeds. Weight: +0.20"
+    },
+    "missing_vector": {
+      "type": "boolean",
+      "description": "Missing CVSS vector for severity assessment. Weight: +0.15"
+    },
+    "unreachable_source_advisory": {
+      "type": "boolean",
+      "description": "Source advisory URL unreachable. Weight: +0.10"
+    },
+    "dynamic_call_target": {
+      "type": "boolean",
+      "description": "Dynamic call target (reflection, eval). Weight: +0.25"
+    },
+    "external_assembly": {
+      "type": "boolean",
+      "description": "External assembly not in analysis scope. Weight: +0.20"
+    }
+  }
+}
+```
+
+### 3.3 Normalization Trace Schema
+
+```json
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "title": "NormalizationTrace",
+  "type": "object",
+  "required": ["computed_at", "final_score", "assigned_band"],
+  "properties": {
+    "raw_popularity": { "type": "number" },
+    "normalized_popularity": { "type": "number" },
+    "popularity_formula": { "type": "string" },
+
+    "raw_exploit_potential": { "type": "number" },
+    "normalized_exploit_potential": { "type": "number" },
+
+    "raw_uncertainty": { "type": "number" },
+    "normalized_uncertainty": { "type": "number" },
+    "active_flags": { "type": "array", "items": { "type": "string" } },
+
+    "raw_centrality": { "type": "number" },
+    "normalized_centrality": { "type": "number" },
+
+    "raw_staleness": { "type": "number" },
+    "normalized_staleness": { "type": "number" },
+
+    "weights": {
+      "type": "object",
+      "properties": {
+        "wP": { "type": "number" },
+        "wE": { "type": "number" },
+        "wU": { "type": "number" },
+        "wC": { "type": "number" },
+        "wS": { "type": "number" }
+      }
+    },
+
+    "final_score": { "type": "number" },
+    "assigned_band": { "type": "string", "enum": ["hot", "warm", "cold"] },
+    "computed_at": { "type": "string", "format": "date-time" }
+  }
+}
+```
+
+### 3.4 Entity Class Updates
+
+```csharp
+// File: src/Signals/StellaOps.Signals.Storage.Postgres/Entities/UnknownEntity.cs
+
+namespace StellaOps.Signals.Storage.Postgres.Entities;
+
+/// <summary>
+/// Database entity for unknowns with full scoring support.
+/// </summary>
+public sealed class UnknownEntity
+{
+    public Guid Id { get; set; }
+
+    public string SubjectKey { get; set; } = string.Empty;
+    public string? CallgraphId { get; set; }
+    public string? SymbolId { get; set; }
+    public string? CodeId { get; set; }
+    public string? Purl { get; set; }
+    public string? PurlVersion { get; set; }
+    public string? EdgeFrom { get; set; }
+    public string? EdgeTo { get; set; }
+    public string? Reason { get; set; }
+
+    // ===== SCORING FACTORS =====
+
+    /// <summary>Popularity score P (0.0 - 1.0)</summary>
+    public double PopularityP { get; set; }
+
+    /// <summary>Number of deployments</summary>
+    public int DeploymentCount { get; set; }
+
+    /// <summary>Exploit potential score E (0.0 - 1.0)</summary>
+    public double ExploitPotentialE { get; set; }
+
+    /// <summary>Uncertainty density score U (0.0 - 1.0)</summary>
+    public double UncertaintyU { get; set; }
+
+    /// <summary>Graph centrality score C (0.0 - 1.0)</summary>
+    public double CentralityC { get; set; }
+
+    /// <summary>Degree centrality (in + out edges)</summary>
+    public int DegreeCentrality { get; set; }
+
+    /// <summary>Betweenness centrality (raw)</summary>
+    public double BetweennessCentrality { get; set; }
+
+    /// <summary>Staleness score S (0.0 - 1.0)</summary>
+    public double StalenessS { get; set; }
+
+    /// <summary>Days since last analysis</summary>
+    public int DaysSinceAnalysis { get; set; }
+
+    // ===== COMPOSITE =====
+
+    /// <summary>Final weighted score (0.0 - 1.0)</summary>
+    public double Score { get; set; }
+
+    /// <summary>Triage band: hot, warm, cold</summary>
+    public string Band { get; set; } = "cold";
+
+    // ===== FLAGS & TRACE =====
+
+    /// <summary>Uncertainty flags (JSONB)</summary>
+    public string? UnknownFlags { get; set; }
+
+    /// <summary>Scoring computation trace (JSONB)</summary>
+    public string? NormalizationTrace { get; set; }
+
+    // ===== RESCAN SCHEDULING =====
+
+    public int RescanAttempts { get; set; }
+    public string? LastRescanResult { get; set; }
+    public DateTimeOffset? NextScheduledRescan { get; set; }
+    public DateTimeOffset? LastAnalyzedAt { get; set; }
+
+    // ===== HASHES =====
+
+    public byte[]? GraphSliceHash { get; set; }
+    public byte[]? EvidenceSetHash { get; set; }
+    public byte[]? CallgraphAttemptHash { get; set; }
+
+    // ===== TIMESTAMPS =====
+
+    public DateTimeOffset CreatedAt { get; set; }
+    public DateTimeOffset UpdatedAt { get; set; }
+}
+```
+
+### 3.5 EF Core Configuration
+
+```csharp
+// File: src/Signals/StellaOps.Signals.Storage.Postgres/Configurations/UnknownEntityConfiguration.cs
+
+namespace StellaOps.Signals.Storage.Postgres.Configurations;
+
+public sealed class UnknownEntityConfiguration : IEntityTypeConfiguration<UnknownEntity>
+{
+    public void Configure(EntityTypeBuilder<UnknownEntity> builder)
+    {
+        builder.ToTable("unknowns", "signals");
+
+        builder.HasKey(e => e.Id);
+
+        builder.Property(e => e.SubjectKey).HasColumnName("subject_key");
+        builder.Property(e => e.CallgraphId).HasColumnName("callgraph_id");
+        builder.Property(e => e.SymbolId).HasColumnName("symbol_id");
+        builder.Property(e => e.CodeId).HasColumnName("code_id");
+        builder.Property(e => e.Purl).HasColumnName("purl");
+        builder.Property(e => e.PurlVersion).HasColumnName("purl_version");
+        builder.Property(e => e.EdgeFrom).HasColumnName("edge_from");
+        builder.Property(e => e.EdgeTo).HasColumnName("edge_to");
+        builder.Property(e => e.Reason).HasColumnName("reason");
+
+        // Scoring factors
+        builder.Property(e => e.PopularityP).HasColumnName("popularity_p");
+        builder.Property(e => e.DeploymentCount).HasColumnName("deployment_count");
+        builder.Property(e => e.ExploitPotentialE).HasColumnName("exploit_potential_e");
+        builder.Property(e => e.UncertaintyU).HasColumnName("uncertainty_u");
+        builder.Property(e => e.CentralityC).HasColumnName("centrality_c");
+        builder.Property(e => e.DegreeCentrality).HasColumnName("degree_centrality");
+        builder.Property(e => e.BetweennessCentrality).HasColumnName("betweenness_centrality");
+        builder.Property(e => e.StalenessS).HasColumnName("staleness_s");
+        builder.Property(e => e.DaysSinceAnalysis).HasColumnName("days_since_analysis");
+
+        // Composite
+        builder.Property(e => e.Score).HasColumnName("score");
+        builder.Property(e => e.Band).HasColumnName("band");
+
+        // JSONB columns
+        builder.Property(e => e.UnknownFlags)
+            .HasColumnName("unknown_flags")
+            .HasColumnType("jsonb");
+        builder.Property(e => e.NormalizationTrace)
+            .HasColumnName("normalization_trace")
+            .HasColumnType("jsonb");
+
+        // Rescan scheduling
+        builder.Property(e => e.RescanAttempts).HasColumnName("rescan_attempts");
+        builder.Property(e => e.LastRescanResult).HasColumnName("last_rescan_result");
+        builder.Property(e => e.NextScheduledRescan).HasColumnName("next_scheduled_rescan");
+        builder.Property(e => e.LastAnalyzedAt).HasColumnName("last_analyzed_at");
+
+        // Hashes
+        builder.Property(e => e.GraphSliceHash).HasColumnName("graph_slice_hash");
+        builder.Property(e => e.EvidenceSetHash).HasColumnName("evidence_set_hash");
+        builder.Property(e => e.CallgraphAttemptHash).HasColumnName("callgraph_attempt_hash");
+
+        // Timestamps
+        builder.Property(e => e.CreatedAt).HasColumnName("created_at");
+        builder.Property(e => e.UpdatedAt).HasColumnName("updated_at");
+
+        // Indexes (matching SQL)
+        builder.HasIndex(e => e.Band).HasDatabaseName("idx_unknowns_band");
+        builder.HasIndex(e => e.Score).HasDatabaseName("idx_unknowns_score_desc")
+            .IsDescending();
+        builder.HasIndex(e => new { e.Band, e.Score }).HasDatabaseName("idx_unknowns_band_score");
+        builder.HasIndex(e => e.Purl).HasDatabaseName("idx_unknowns_purl");
+    }
+}
+```
+
+---
+
+## 4. DELIVERY TRACKER
+
+| # | Task | Status | Assignee | Notes |
+|---|------|--------|----------|-------|
+| 1 | Create migration file `V1102_001` | DONE | | Per §3.1 |
+| 2 | Add scoring columns to unknowns table | DONE | | 5 factors + composite in EnsureTableAsync |
+| 3 | Add band column with CHECK constraint | DONE | | hot/warm/cold |
+| 4 | Add JSONB columns (flags, trace) | DONE | | |
+| 5 | Add rescan scheduling columns | DONE | | |
+| 6 | Create indexes for efficient queries | DONE | | 9 indexes created |
+| 7 | Update `UnknownEntity` class | DONE | | Model already existed in UnknownSymbolDocument |
+| 8 | Update EF Core configuration | N/A | | Using raw SQL with Npgsql, not EF Core |
+| 9 | Create JSON schemas for flags/trace | DONE | | Per §3.2, §3.3 - documented in migration |
+| 10 | Write migration tests | DONE | | 4 tests passing |
+| 11 | Document schema in `docs/db/` | DEFER | | Deferred to documentation sprint |
+
+---
+
+## 5. ACCEPTANCE CRITERIA
+
+### 5.1 Schema Requirements
+
+- [x] All scoring columns present with correct types
+- [x] Range constraints enforce [0.0, 1.0] bounds
+- [x] Band constraint enforces 'hot', 'warm', 'cold' only
+- [x] JSONB columns accept valid JSON
+- [x] Indexes created and functional
+
+### 5.2 Migration Requirements
+
+- [x] Migration is idempotent (re-runnable) - using IF NOT EXISTS
+- [x] Migration supports rollback - via EnsureTableAsync recreation
+- [x] Existing data preserved during upgrade - additive columns only
+- [x] Default values applied correctly
+
+### 5.3 Code Requirements
+
+- [x] Entity class maps all columns (UnknownSymbolDocument)
+- [x] Repository uses raw SQL with Npgsql (not EF Core)
+- [x] Repository can query by band (GetDueForRescanAsync)
+- [x] Repository can query by score descending (GetBySubjectAsync)
+
+---
+
+## 6. DECISIONS & RISKS
+
+| Decision | Rationale | Risk |
+|----------|-----------|------|
+| JSONB for flags | Extensible, queryable with GIN | Larger storage |
+| JSONB for trace | Audit debugging flexibility | Larger storage |
+| Range CHECK constraints | Enforce invariants at DB level | None |
+| Partial indexes | Optimize hot band queries | Index maintenance |
+
+---
+
+## 7. REFERENCES
+
+- Advisory: `14-Dec-2025 - Triage and Unknowns Technical Reference.md` §17, §18
+- Existing: `src/Signals/StellaOps.Signals.Storage.Postgres/`
+- Existing: `docs/db/SPECIFICATION.md`

docs/implplan/archived/SPRINT_1103_0001_0001_replay_token_library.md

@@ -0,0 +1,505 @@
+# SPRINT_1103_0001_0001 - Replay Token Library
+
+**Status:** DONE
+**Priority:** P0 - CRITICAL
+**Module:** Core Libraries, Attestor
+**Working Directory:** `src/__Libraries/StellaOps.Audit.ReplayToken/`
+**Estimated Effort:** Medium
+**Dependencies:** None (foundational)
+
+---
+
+## 1. OBJECTIVE
+
+Implement a library for generating deterministic replay tokens that enable complete reproducibility of triage decisions and scoring computations.
+
+### Goals
+
+1. **Deterministic hash generation** - Same inputs always produce same token
+2. **Content-addressable** - Token uniquely identifies the input set
+3. **Audit-ready** - Token can be used to replay/verify decisions
+4. **Extensible** - Support different input types (feeds, rules, policies)
+
+---
+
+## 2. BACKGROUND
+
+### 2.1 Current State
+
+No dedicated replay token infrastructure exists. Decisions are recorded but not reproducible.
+
+### 2.2 Target State
+
+Per advisory §8.1:
+```
+replay_token = hash(feed_manifests + rules + lattice_policy + inputs)
+```
+
+Replay tokens enable:
+- One-click reproduce (CLI snippet pinned to exact versions)
+- Evidence hash-set content addressing
+- Audit trail integrity verification
+
+---
+
+## 3. TECHNICAL DESIGN
+
+### 3.1 Core Interface
+
+```csharp
+// File: src/__Libraries/StellaOps.Audit.ReplayToken/IReplayTokenGenerator.cs
+
+namespace StellaOps.Audit.ReplayToken;
+
+/// <summary>
+/// Generates deterministic replay tokens for audit and reproducibility.
+/// </summary>
+public interface IReplayTokenGenerator
+{
+    /// <summary>
+    /// Generates a replay token from the given inputs.
+    /// </summary>
+    /// <param name="request">The inputs to hash.</param>
+    /// <returns>A deterministic replay token.</returns>
+    ReplayToken Generate(ReplayTokenRequest request);
+
+    /// <summary>
+    /// Verifies that inputs match a previously generated token.
+    /// </summary>
+    bool Verify(ReplayToken token, ReplayTokenRequest request);
+}
+```
+
+### 3.2 Request Model
+
+```csharp
+// File: src/__Libraries/StellaOps.Audit.ReplayToken/ReplayTokenRequest.cs
+
+namespace StellaOps.Audit.ReplayToken;
+
+/// <summary>
+/// Inputs for replay token generation.
+/// </summary>
+public sealed class ReplayTokenRequest
+{
+    /// <summary>
+    /// Feed manifest hashes (advisory sources).
+    /// </summary>
+    public IReadOnlyList<string> FeedManifests { get; init; } = Array.Empty<string>();
+
+    /// <summary>
+    /// Rule set version identifier.
+    /// </summary>
+    public string? RulesVersion { get; init; }
+
+    /// <summary>
+    /// Rule set content hash.
+    /// </summary>
+    public string? RulesHash { get; init; }
+
+    /// <summary>
+    /// Lattice policy version identifier.
+    /// </summary>
+    public string? LatticePolicyVersion { get; init; }
+
+    /// <summary>
+    /// Lattice policy content hash.
+    /// </summary>
+    public string? LatticePolicyHash { get; init; }
+
+    /// <summary>
+    /// Input artifact hashes (SBOMs, images, etc.).
+    /// </summary>
+    public IReadOnlyList<string> InputHashes { get; init; } = Array.Empty<string>();
+
+    /// <summary>
+    /// Scoring configuration version.
+    /// </summary>
+    public string? ScoringConfigVersion { get; init; }
+
+    /// <summary>
+    /// Evidence artifact hashes.
+    /// </summary>
+    public IReadOnlyList<string> EvidenceHashes { get; init; } = Array.Empty<string>();
+
+    /// <summary>
+    /// Additional context for extensibility.
+    /// </summary>
+    public IReadOnlyDictionary<string, string> AdditionalContext { get; init; }
+        = new Dictionary<string, string>();
+}
+```
+
+### 3.3 Token Model
+
+```csharp
+// File: src/__Libraries/StellaOps.Audit.ReplayToken/ReplayToken.cs
+
+namespace StellaOps.Audit.ReplayToken;
+
+/// <summary>
+/// A deterministic, content-addressable replay token.
+/// </summary>
+public sealed class ReplayToken
+{
+    /// <summary>
+    /// The token value (SHA-256 hash in hex).
+    /// </summary>
+    public string Value { get; }
+
+    /// <summary>
+    /// Algorithm used for hashing.
+    /// </summary>
+    public string Algorithm { get; } = "SHA-256";
+
+    /// <summary>
+    /// Timestamp when token was generated (UTC ISO-8601).
+    /// </summary>
+    public DateTimeOffset GeneratedAt { get; }
+
+    /// <summary>
+    /// Version of the token generation algorithm.
+    /// </summary>
+    public string Version { get; } = "1.0";
+
+    /// <summary>
+    /// Canonical representation for storage.
+    /// </summary>
+    public string Canonical => $"replay:v{Version}:{Algorithm}:{Value}";
+
+    public ReplayToken(string value, DateTimeOffset generatedAt)
+    {
+        Value = value ?? throw new ArgumentNullException(nameof(value));
+        GeneratedAt = generatedAt;
+    }
+
+    /// <summary>
+    /// Parse a canonical token string.
+    /// </summary>
+    public static ReplayToken Parse(string canonical)
+    {
+        if (string.IsNullOrWhiteSpace(canonical))
+            throw new ArgumentException("Token cannot be empty", nameof(canonical));
+
+        var parts = canonical.Split(':');
+        if (parts.Length != 4 || parts[0] != "replay")
+            throw new FormatException($"Invalid replay token format: {canonical}");
+
+        return new ReplayToken(parts[3], DateTimeOffset.MinValue);
+    }
+
+    public override string ToString() => Canonical;
+
+    public override bool Equals(object? obj) =>
+        obj is ReplayToken other && Value == other.Value;
+
+    public override int GetHashCode() => Value.GetHashCode();
+}
+```
+
+### 3.4 Generator Implementation
+
+```csharp
+// File: src/__Libraries/StellaOps.Audit.ReplayToken/Sha256ReplayTokenGenerator.cs
+
+using System.Security.Cryptography;
+using System.Text;
+using System.Text.Json;
+
+namespace StellaOps.Audit.ReplayToken;
+
+/// <summary>
+/// Generates replay tokens using SHA-256 hashing with deterministic canonicalization.
+/// </summary>
+public sealed class Sha256ReplayTokenGenerator : IReplayTokenGenerator
+{
+    private readonly TimeProvider _timeProvider;
+    private readonly JsonSerializerOptions _jsonOptions;
+
+    public Sha256ReplayTokenGenerator(TimeProvider timeProvider)
+    {
+        _timeProvider = timeProvider;
+        _jsonOptions = new JsonSerializerOptions
+        {
+            PropertyNamingPolicy = JsonNamingPolicy.CamelCase,
+            WriteIndented = false,
+            // Deterministic: sorted keys
+            DefaultIgnoreCondition = JsonIgnoreCondition.WhenWritingNull
+        };
+    }
+
+    public ReplayToken Generate(ReplayTokenRequest request)
+    {
+        ArgumentNullException.ThrowIfNull(request);
+
+        // Canonicalize inputs for deterministic hashing
+        var canonical = Canonicalize(request);
+
+        // Hash the canonical representation
+        var hash = ComputeHash(canonical);
+
+        return new ReplayToken(hash, _timeProvider.GetUtcNow());
+    }
+
+    public bool Verify(ReplayToken token, ReplayTokenRequest request)
+    {
+        var computed = Generate(request);
+        return token.Value == computed.Value;
+    }
+
+    /// <summary>
+    /// Produces deterministic canonical representation of inputs.
+    /// </summary>
+    private string Canonicalize(ReplayTokenRequest request)
+    {
+        // Create canonical structure with sorted arrays and stable ordering
+        var canonical = new CanonicalReplayInput
+        {
+            Version = "1.0",
+            FeedManifests = request.FeedManifests.OrderBy(x => x).ToList(),
+            RulesVersion = request.RulesVersion,
+            RulesHash = request.RulesHash,
+            LatticePolicyVersion = request.LatticePolicyVersion,
+            LatticePolicyHash = request.LatticePolicyHash,
+            InputHashes = request.InputHashes.OrderBy(x => x).ToList(),
+            ScoringConfigVersion = request.ScoringConfigVersion,
+            EvidenceHashes = request.EvidenceHashes.OrderBy(x => x).ToList(),
+            AdditionalContext = request.AdditionalContext
+                .OrderBy(kvp => kvp.Key)
+                .ToDictionary(kvp => kvp.Key, kvp => kvp.Value)
+        };
+
+        return JsonSerializer.Serialize(canonical, _jsonOptions);
+    }
+
+    private static string ComputeHash(string input)
+    {
+        var bytes = Encoding.UTF8.GetBytes(input);
+        var hash = SHA256.HashData(bytes);
+        return Convert.ToHexString(hash).ToLowerInvariant();
+    }
+
+    private sealed class CanonicalReplayInput
+    {
+        public required string Version { get; init; }
+        public required List<string> FeedManifests { get; init; }
+        public string? RulesVersion { get; init; }
+        public string? RulesHash { get; init; }
+        public string? LatticePolicyVersion { get; init; }
+        public string? LatticePolicyHash { get; init; }
+        public required List<string> InputHashes { get; init; }
+        public string? ScoringConfigVersion { get; init; }
+        public required List<string> EvidenceHashes { get; init; }
+        public required Dictionary<string, string> AdditionalContext { get; init; }
+    }
+}
+```
+
+### 3.5 Decision Token Extension
+
+```csharp
+// File: src/__Libraries/StellaOps.Audit.ReplayToken/DecisionReplayToken.cs
+
+namespace StellaOps.Audit.ReplayToken;
+
+/// <summary>
+/// Extension for decision-specific replay tokens.
+/// </summary>
+public static class DecisionReplayTokenExtensions
+{
+    /// <summary>
+    /// Generates a replay token for a triage decision.
+    /// </summary>
+    public static ReplayToken GenerateForDecision(
+        this IReplayTokenGenerator generator,
+        string alertId,
+        string actorId,
+        string decisionStatus,
+        IEnumerable<string> evidenceHashes,
+        string? policyContext,
+        string? rulesVersion)
+    {
+        var request = new ReplayTokenRequest
+        {
+            InputHashes = new[] { alertId },
+            EvidenceHashes = evidenceHashes.ToList(),
+            RulesVersion = rulesVersion,
+            AdditionalContext = new Dictionary<string, string>
+            {
+                ["actor_id"] = actorId,
+                ["decision_status"] = decisionStatus,
+                ["policy_context"] = policyContext ?? string.Empty
+            }
+        };
+
+        return generator.Generate(request);
+    }
+
+    /// <summary>
+    /// Generates a replay token for unknowns scoring.
+    /// </summary>
+    public static ReplayToken GenerateForScoring(
+        this IReplayTokenGenerator generator,
+        string subjectKey,
+        IEnumerable<string> feedManifests,
+        string scoringConfigVersion,
+        IEnumerable<string> inputHashes)
+    {
+        var request = new ReplayTokenRequest
+        {
+            FeedManifests = feedManifests.ToList(),
+            ScoringConfigVersion = scoringConfigVersion,
+            InputHashes = inputHashes.ToList(),
+            AdditionalContext = new Dictionary<string, string>
+            {
+                ["subject_key"] = subjectKey
+            }
+        };
+
+        return generator.Generate(request);
+    }
+}
+```
+
+### 3.6 CLI Reproduce Snippet Generator
+
+```csharp
+// File: src/__Libraries/StellaOps.Audit.ReplayToken/ReplayCliSnippetGenerator.cs
+
+namespace StellaOps.Audit.ReplayToken;
+
+/// <summary>
+/// Generates CLI snippets for one-click reproduce functionality.
+/// </summary>
+public sealed class ReplayCliSnippetGenerator
+{
+    /// <summary>
+    /// Generates a CLI command to reproduce a decision.
+    /// </summary>
+    public string GenerateDecisionReplay(
+        ReplayToken token,
+        string alertId,
+        string? feedManifestUri = null,
+        string? policyVersion = null)
+    {
+        var parts = new List<string>
+        {
+            "stellaops",
+            "replay",
+            "decision",
+            $"--token {token.Value}",
+            $"--alert-id {alertId}"
+        };
+
+        if (!string.IsNullOrEmpty(feedManifestUri))
+            parts.Add($"--feed-manifest {feedManifestUri}");
+
+        if (!string.IsNullOrEmpty(policyVersion))
+            parts.Add($"--policy-version {policyVersion}");
+
+        return string.Join(" \\\n  ", parts);
+    }
+
+    /// <summary>
+    /// Generates a CLI command to reproduce unknowns scoring.
+    /// </summary>
+    public string GenerateScoringReplay(
+        ReplayToken token,
+        string subjectKey,
+        string? configVersion = null)
+    {
+        var parts = new List<string>
+        {
+            "stellaops",
+            "replay",
+            "scoring",
+            $"--token {token.Value}",
+            $"--subject {subjectKey}"
+        };
+
+        if (!string.IsNullOrEmpty(configVersion))
+            parts.Add($"--config-version {configVersion}");
+
+        return string.Join(" \\\n  ", parts);
+    }
+}
+```
+
+### 3.7 Service Registration
+
+```csharp
+// File: src/__Libraries/StellaOps.Audit.ReplayToken/ServiceCollectionExtensions.cs
+
+namespace StellaOps.Audit.ReplayToken;
+
+public static class ServiceCollectionExtensions
+{
+    public static IServiceCollection AddReplayTokenServices(
+        this IServiceCollection services)
+    {
+        services.AddSingleton<IReplayTokenGenerator, Sha256ReplayTokenGenerator>();
+        services.AddSingleton<ReplayCliSnippetGenerator>();
+
+        return services;
+    }
+}
+```
+
+---
+
+## 4. DELIVERY TRACKER
+
+| # | Task | Status | Assignee | Notes |
+|---|------|--------|----------|-------|
+| 1 | Create project `StellaOps.Audit.ReplayToken` | DONE | | New library |
+| 2 | Implement `IReplayTokenGenerator` interface | DONE | | Per §3.1 |
+| 3 | Implement `ReplayTokenRequest` model | DONE | | Per §3.2 |
+| 4 | Implement `ReplayToken` model | DONE | | Per §3.3 |
+| 5 | Implement `Sha256ReplayTokenGenerator` | DONE | | Per §3.4 |
+| 6 | Implement decision token extensions | DONE | | Per §3.5 |
+| 7 | Implement CLI snippet generator | DONE | | Per §3.6 |
+| 8 | Add service registration | DONE | | Per §3.7 |
+| 9 | Write unit tests for determinism | DONE | | Verify same inputs → same output |
+| 10 | Write unit tests for verification | DONE | | |
+| 11 | Document API in README | DONE | | |
+
+---
+
+## 5. ACCEPTANCE CRITERIA
+
+### 5.1 Determinism Requirements
+
+- [x] Same inputs always produce same token
+- [x] Array ordering doesn't affect output (sorted internally)
+- [x] Null handling is consistent
+- [x] Token format is stable across versions
+
+### 5.2 Verification Requirements
+
+- [x] `Verify()` returns true for matching inputs
+- [x] `Verify()` returns false for different inputs
+- [x] Token parsing handles valid and invalid formats
+
+### 5.3 CLI Requirements
+
+- [x] Generated CLI snippet is valid bash
+- [x] Snippet includes all necessary parameters
+- [x] Snippet uses proper escaping
+
+---
+
+## 6. DECISIONS & RISKS
+
+| Decision | Rationale | Risk |
+|----------|-----------|------|
+| SHA-256 algorithm | Standard, collision-resistant | None |
+| JSON canonicalization | Simple, debuggable | Larger than binary |
+| Sorted arrays | Deterministic | Slight overhead |
+| Version field | Future-proof | None |
+
+---
+
+## 7. REFERENCES
+
+- Advisory: `14-Dec-2025 - Triage and Unknowns Technical Reference.md` §8.1, §8.2, §8.3
+- Pattern: Content-addressable storage (Git, IPFS)

docs/implplan/archived/SPRINT_1104_0001_0001_evidence_bundle_envelope.md

@@ -0,0 +1,751 @@
+# SPRINT_1104_0001_0001 - Evidence Bundle Envelope Schema
+
+**Status:** DONE
+**Priority:** P0 - CRITICAL
+**Module:** Attestor, Core Libraries
+**Working Directory:** `src/__Libraries/StellaOps.Evidence.Bundle/`
+**Estimated Effort:** Medium
+**Dependencies:** Attestor.Types (DSSE)
+
+---
+
+## 1. OBJECTIVE
+
+Define and implement the evidence bundle envelope schema that wraps evidence artifacts with cryptographic signatures and metadata for offline verification.
+
+### Goals
+
+1. **Minimal evidence bundle** - Reachability, call-stack, provenance, VEX status, diff
+2. **DSSE signing** - Envelope signed for tamper-proof verification
+3. **Content-addressable** - Each artifact has hash reference
+4. **Offline-ready** - All evidence resolvable without network
+
+---
+
+## 2. BACKGROUND
+
+### 2.1 Current State
+
+Evidence artifacts exist but are not wrapped in a unified envelope:
+- Reachability proofs in `ReachabilityEvidenceChain`
+- Call stacks in `CodeAnchor`, `CallPath`
+- Provenance in `StellaOps.Provenance`
+- VEX in `VexStatement`, `VexDecisionDocument`
+
+Missing: Unified bundle with signature and metadata.
+
+### 2.2 Target State
+
+Per advisory §2 (Minimal Evidence Bundle per Finding):
+1. Reachability proof (function-level path or package-level import chain)
+2. Call-stack snippet (5-10 frames around sink/source)
+3. Provenance (attestation/DSSE + build ancestry)
+4. VEX/CSAF status (affected/not-affected/under-investigation + reason)
+5. Diff (SBOM or VEX delta since last scan)
+6. Graph revision + receipt (`graphRevisionId` + signed verdict receipt)
+
+---
+
+## 3. TECHNICAL DESIGN
+
+### 3.1 Evidence Bundle Schema
+
+```csharp
+// File: src/__Libraries/StellaOps.Evidence.Bundle/EvidenceBundle.cs
+
+namespace StellaOps.Evidence.Bundle;
+
+/// <summary>
+/// A complete evidence bundle for a single finding/alert.
+/// Contains all evidence required for triage decision.
+/// </summary>
+public sealed class EvidenceBundle
+{
+    /// <summary>
+    /// Unique identifier for this bundle.
+    /// </summary>
+    public string BundleId { get; init; } = Guid.NewGuid().ToString("N");
+
+    /// <summary>
+    /// Version of the bundle schema.
+    /// </summary>
+    public string SchemaVersion { get; init; } = "1.0";
+
+    /// <summary>
+    /// Alert/finding this evidence relates to.
+    /// </summary>
+    public required string AlertId { get; init; }
+
+    /// <summary>
+    /// Artifact identifier (image digest, commit hash).
+    /// </summary>
+    public required string ArtifactId { get; init; }
+
+    /// <summary>
+    /// Reachability evidence.
+    /// </summary>
+    public ReachabilityEvidence? Reachability { get; init; }
+
+    /// <summary>
+    /// Call stack evidence.
+    /// </summary>
+    public CallStackEvidence? CallStack { get; init; }
+
+    /// <summary>
+    /// Provenance evidence.
+    /// </summary>
+    public ProvenanceEvidence? Provenance { get; init; }
+
+    /// <summary>
+    /// VEX status evidence.
+    /// </summary>
+    public VexStatusEvidence? VexStatus { get; init; }
+
+    /// <summary>
+    /// Diff evidence (SBOM/VEX delta).
+    /// </summary>
+    public DiffEvidence? Diff { get; init; }
+
+    /// <summary>
+    /// Graph revision and verdict receipt.
+    /// </summary>
+    public GraphRevisionEvidence? GraphRevision { get; init; }
+
+    /// <summary>
+    /// Content hashes of all evidence artifacts.
+    /// </summary>
+    public required EvidenceHashSet Hashes { get; init; }
+
+    /// <summary>
+    /// Timestamp when bundle was created (UTC).
+    /// </summary>
+    public required DateTimeOffset CreatedAt { get; init; }
+
+    /// <summary>
+    /// Compute evidence completeness score (0-4).
+    /// </summary>
+    public int ComputeCompletenessScore()
+    {
+        var score = 0;
+        if (Reachability?.Status == EvidenceStatus.Available) score++;
+        if (CallStack?.Status == EvidenceStatus.Available) score++;
+        if (Provenance?.Status == EvidenceStatus.Available) score++;
+        if (VexStatus?.Status == EvidenceStatus.Available) score++;
+        return score;
+    }
+}
+```
+
+### 3.2 Evidence Status Enum
+
+```csharp
+// File: src/__Libraries/StellaOps.Evidence.Bundle/EvidenceStatus.cs
+
+namespace StellaOps.Evidence.Bundle;
+
+/// <summary>
+/// Status of an evidence artifact.
+/// </summary>
+public enum EvidenceStatus
+{
+    /// <summary>
+    /// Evidence is available and complete.
+    /// </summary>
+    Available,
+
+    /// <summary>
+    /// Evidence is currently being loaded/computed.
+    /// </summary>
+    Loading,
+
+    /// <summary>
+    /// Evidence is not available (missing inputs).
+    /// </summary>
+    Unavailable,
+
+    /// <summary>
+    /// Error occurred while fetching evidence.
+    /// </summary>
+    Error,
+
+    /// <summary>
+    /// Evidence pending enrichment (offline mode).
+    /// </summary>
+    PendingEnrichment
+}
+```
+
+### 3.3 Reachability Evidence
+
+```csharp
+// File: src/__Libraries/StellaOps.Evidence.Bundle/ReachabilityEvidence.cs
+
+namespace StellaOps.Evidence.Bundle;
+
+/// <summary>
+/// Reachability proof evidence.
+/// </summary>
+public sealed class ReachabilityEvidence
+{
+    /// <summary>
+    /// Status of this evidence.
+    /// </summary>
+    public required EvidenceStatus Status { get; init; }
+
+    /// <summary>
+    /// Content hash of the proof artifact.
+    /// </summary>
+    public string? Hash { get; init; }
+
+    /// <summary>
+    /// Type of reachability proof.
+    /// </summary>
+    public ReachabilityProofType ProofType { get; init; }
+
+    /// <summary>
+    /// Function-level path (if available).
+    /// </summary>
+    public IReadOnlyList<FunctionPathNode>? FunctionPath { get; init; }
+
+    /// <summary>
+    /// Package-level import chain (if function-level not available).
+    /// </summary>
+    public IReadOnlyList<PackageImportNode>? ImportChain { get; init; }
+
+    /// <summary>
+    /// Reachability state from lattice.
+    /// </summary>
+    public string? LatticeState { get; init; }
+
+    /// <summary>
+    /// Confidence tier (0-7).
+    /// </summary>
+    public int? ConfidenceTier { get; init; }
+
+    /// <summary>
+    /// Reason if unavailable.
+    /// </summary>
+    public string? UnavailableReason { get; init; }
+}
+
+public enum ReachabilityProofType
+{
+    FunctionLevel,
+    PackageLevel,
+    ImportChain,
+    Heuristic,
+    Unknown
+}
+
+public sealed class FunctionPathNode
+{
+    public required string FunctionName { get; init; }
+    public required string FilePath { get; init; }
+    public required int Line { get; init; }
+    public int? Column { get; init; }
+    public string? ModuleName { get; init; }
+}
+
+public sealed class PackageImportNode
+{
+    public required string PackageName { get; init; }
+    public string? Version { get; init; }
+    public string? ImportedBy { get; init; }
+    public string? ImportPath { get; init; }
+}
+```
+
+### 3.4 Call Stack Evidence
+
+```csharp
+// File: src/__Libraries/StellaOps.Evidence.Bundle/CallStackEvidence.cs
+
+namespace StellaOps.Evidence.Bundle;
+
+/// <summary>
+/// Call stack snippet evidence.
+/// </summary>
+public sealed class CallStackEvidence
+{
+    /// <summary>
+    /// Status of this evidence.
+    /// </summary>
+    public required EvidenceStatus Status { get; init; }
+
+    /// <summary>
+    /// Content hash of the call stack artifact.
+    /// </summary>
+    public string? Hash { get; init; }
+
+    /// <summary>
+    /// Stack frames (5-10 around sink/source).
+    /// </summary>
+    public IReadOnlyList<StackFrame>? Frames { get; init; }
+
+    /// <summary>
+    /// Index of the sink frame (if applicable).
+    /// </summary>
+    public int? SinkFrameIndex { get; init; }
+
+    /// <summary>
+    /// Index of the source frame (if applicable).
+    /// </summary>
+    public int? SourceFrameIndex { get; init; }
+
+    /// <summary>
+    /// Reason if unavailable.
+    /// </summary>
+    public string? UnavailableReason { get; init; }
+}
+
+public sealed class StackFrame
+{
+    public required string FunctionName { get; init; }
+    public required string FilePath { get; init; }
+    public required int Line { get; init; }
+    public int? Column { get; init; }
+    public string? SourceSnippet { get; init; }
+    public bool IsSink { get; init; }
+    public bool IsSource { get; init; }
+}
+```
+
+### 3.5 Provenance Evidence
+
+```csharp
+// File: src/__Libraries/StellaOps.Evidence.Bundle/ProvenanceEvidence.cs
+
+namespace StellaOps.Evidence.Bundle;
+
+/// <summary>
+/// Provenance attestation evidence.
+/// </summary>
+public sealed class ProvenanceEvidence
+{
+    /// <summary>
+    /// Status of this evidence.
+    /// </summary>
+    public required EvidenceStatus Status { get; init; }
+
+    /// <summary>
+    /// Content hash of the provenance artifact.
+    /// </summary>
+    public string? Hash { get; init; }
+
+    /// <summary>
+    /// DSSE envelope (if available).
+    /// </summary>
+    public DsseEnvelope? DsseEnvelope { get; init; }
+
+    /// <summary>
+    /// Build ancestry chain.
+    /// </summary>
+    public BuildAncestry? Ancestry { get; init; }
+
+    /// <summary>
+    /// Rekor entry reference (if anchored).
+    /// </summary>
+    public RekorReference? RekorEntry { get; init; }
+
+    /// <summary>
+    /// Verification status.
+    /// </summary>
+    public string? VerificationStatus { get; init; }
+
+    /// <summary>
+    /// Reason if unavailable.
+    /// </summary>
+    public string? UnavailableReason { get; init; }
+}
+
+public sealed class DsseEnvelope
+{
+    public required string PayloadType { get; init; }
+    public required string Payload { get; init; }
+    public required IReadOnlyList<DsseSignature> Signatures { get; init; }
+}
+
+public sealed class DsseSignature
+{
+    public required string KeyId { get; init; }
+    public required string Sig { get; init; }
+}
+
+public sealed class BuildAncestry
+{
+    public string? ImageDigest { get; init; }
+    public string? LayerDigest { get; init; }
+    public string? ArtifactDigest { get; init; }
+    public string? CommitHash { get; init; }
+    public string? BuildId { get; init; }
+    public DateTimeOffset? BuildTime { get; init; }
+}
+
+public sealed class RekorReference
+{
+    public required string LogId { get; init; }
+    public required long LogIndex { get; init; }
+    public string? Uuid { get; init; }
+    public DateTimeOffset? IntegratedTime { get; init; }
+}
+```
+
+### 3.6 VEX Status Evidence
+
+```csharp
+// File: src/__Libraries/StellaOps.Evidence.Bundle/VexStatusEvidence.cs
+
+namespace StellaOps.Evidence.Bundle;
+
+/// <summary>
+/// VEX/CSAF status evidence.
+/// </summary>
+public sealed class VexStatusEvidence
+{
+    /// <summary>
+    /// Status of this evidence.
+    /// </summary>
+    public required EvidenceStatus Status { get; init; }
+
+    /// <summary>
+    /// Content hash of the VEX artifact.
+    /// </summary>
+    public string? Hash { get; init; }
+
+    /// <summary>
+    /// Current VEX statement.
+    /// </summary>
+    public VexStatement? Current { get; init; }
+
+    /// <summary>
+    /// Historical VEX statements.
+    /// </summary>
+    public IReadOnlyList<VexStatement>? History { get; init; }
+
+    /// <summary>
+    /// Reason if unavailable.
+    /// </summary>
+    public string? UnavailableReason { get; init; }
+}
+
+public sealed class VexStatement
+{
+    /// <summary>
+    /// VEX status: affected, not_affected, under_investigation, fixed.
+    /// </summary>
+    public required string VexStatus { get; init; }
+
+    /// <summary>
+    /// Justification for the status.
+    /// </summary>
+    public string? Justification { get; init; }
+
+    /// <summary>
+    /// Impact statement.
+    /// </summary>
+    public string? ImpactStatement { get; init; }
+
+    /// <summary>
+    /// Action statement.
+    /// </summary>
+    public string? ActionStatement { get; init; }
+
+    /// <summary>
+    /// When this statement was created.
+    /// </summary>
+    public DateTimeOffset? Timestamp { get; init; }
+
+    /// <summary>
+    /// Source of the statement.
+    /// </summary>
+    public string? Source { get; init; }
+}
+```
+
+### 3.7 Evidence Hash Set
+
+```csharp
+// File: src/__Libraries/StellaOps.Evidence.Bundle/EvidenceHashSet.cs
+
+namespace StellaOps.Evidence.Bundle;
+
+/// <summary>
+/// Content-addressed hash set for all evidence artifacts.
+/// </summary>
+public sealed class EvidenceHashSet
+{
+    /// <summary>
+    /// Hash algorithm used.
+    /// </summary>
+    public string Algorithm { get; init; } = "SHA-256";
+
+    /// <summary>
+    /// All artifact hashes in deterministic order.
+    /// </summary>
+    public required IReadOnlyList<string> Hashes { get; init; }
+
+    /// <summary>
+    /// Combined hash of all hashes (Merkle root style).
+    /// </summary>
+    public required string CombinedHash { get; init; }
+
+    /// <summary>
+    /// Individual artifact hashes with labels.
+    /// </summary>
+    public IReadOnlyDictionary<string, string>? LabeledHashes { get; init; }
+
+    /// <summary>
+    /// Compute combined hash from individual hashes.
+    /// </summary>
+    public static EvidenceHashSet Compute(IDictionary<string, string> labeledHashes)
+    {
+        var sorted = labeledHashes.OrderBy(kvp => kvp.Key).ToList();
+        var combined = string.Join(":", sorted.Select(kvp => kvp.Value));
+        var hash = ComputeSha256(combined);
+
+        return new EvidenceHashSet
+        {
+            Hashes = sorted.Select(kvp => kvp.Value).ToList(),
+            CombinedHash = hash,
+            LabeledHashes = sorted.ToDictionary(kvp => kvp.Key, kvp => kvp.Value)
+        };
+    }
+
+    private static string ComputeSha256(string input)
+    {
+        var bytes = System.Text.Encoding.UTF8.GetBytes(input);
+        var hash = System.Security.Cryptography.SHA256.HashData(bytes);
+        return Convert.ToHexString(hash).ToLowerInvariant();
+    }
+}
+```
+
+### 3.8 Evidence Bundle DSSE Predicate
+
+```csharp
+// File: src/__Libraries/StellaOps.Evidence.Bundle/EvidenceBundlePredicate.cs
+
+namespace StellaOps.Evidence.Bundle;
+
+/// <summary>
+/// DSSE predicate for signed evidence bundles.
+/// Predicate type: stellaops.dev/predicates/evidence-bundle@v1
+/// </summary>
+public sealed class EvidenceBundlePredicate
+{
+    public const string PredicateType = "stellaops.dev/predicates/evidence-bundle@v1";
+
+    /// <summary>
+    /// Bundle identifier.
+    /// </summary>
+    public required string BundleId { get; init; }
+
+    /// <summary>
+    /// Alert/finding identifier.
+    /// </summary>
+    public required string AlertId { get; init; }
+
+    /// <summary>
+    /// Artifact identifier.
+    /// </summary>
+    public required string ArtifactId { get; init; }
+
+    /// <summary>
+    /// Evidence completeness score (0-4).
+    /// </summary>
+    public required int CompletenessScore { get; init; }
+
+    /// <summary>
+    /// Hash set of all evidence.
+    /// </summary>
+    public required EvidenceHashSet Hashes { get; init; }
+
+    /// <summary>
+    /// Individual evidence status summary.
+    /// </summary>
+    public required EvidenceStatusSummary StatusSummary { get; init; }
+
+    /// <summary>
+    /// When bundle was created.
+    /// </summary>
+    public required DateTimeOffset CreatedAt { get; init; }
+
+    /// <summary>
+    /// Schema version.
+    /// </summary>
+    public string SchemaVersion { get; init; } = "1.0";
+}
+
+public sealed class EvidenceStatusSummary
+{
+    public required EvidenceStatus Reachability { get; init; }
+    public required EvidenceStatus CallStack { get; init; }
+    public required EvidenceStatus Provenance { get; init; }
+    public required EvidenceStatus VexStatus { get; init; }
+}
+```
+
+### 3.9 Bundle Builder
+
+```csharp
+// File: src/__Libraries/StellaOps.Evidence.Bundle/EvidenceBundleBuilder.cs
+
+namespace StellaOps.Evidence.Bundle;
+
+/// <summary>
+/// Builder for constructing evidence bundles.
+/// </summary>
+public sealed class EvidenceBundleBuilder
+{
+    private readonly TimeProvider _timeProvider;
+    private string? _alertId;
+    private string? _artifactId;
+    private ReachabilityEvidence? _reachability;
+    private CallStackEvidence? _callStack;
+    private ProvenanceEvidence? _provenance;
+    private VexStatusEvidence? _vexStatus;
+    private DiffEvidence? _diff;
+    private GraphRevisionEvidence? _graphRevision;
+
+    public EvidenceBundleBuilder(TimeProvider timeProvider)
+    {
+        _timeProvider = timeProvider;
+    }
+
+    public EvidenceBundleBuilder WithAlertId(string alertId)
+    {
+        _alertId = alertId;
+        return this;
+    }
+
+    public EvidenceBundleBuilder WithArtifactId(string artifactId)
+    {
+        _artifactId = artifactId;
+        return this;
+    }
+
+    public EvidenceBundleBuilder WithReachability(ReachabilityEvidence evidence)
+    {
+        _reachability = evidence;
+        return this;
+    }
+
+    public EvidenceBundleBuilder WithCallStack(CallStackEvidence evidence)
+    {
+        _callStack = evidence;
+        return this;
+    }
+
+    public EvidenceBundleBuilder WithProvenance(ProvenanceEvidence evidence)
+    {
+        _provenance = evidence;
+        return this;
+    }
+
+    public EvidenceBundleBuilder WithVexStatus(VexStatusEvidence evidence)
+    {
+        _vexStatus = evidence;
+        return this;
+    }
+
+    public EvidenceBundleBuilder WithDiff(DiffEvidence evidence)
+    {
+        _diff = evidence;
+        return this;
+    }
+
+    public EvidenceBundleBuilder WithGraphRevision(GraphRevisionEvidence evidence)
+    {
+        _graphRevision = evidence;
+        return this;
+    }
+
+    public EvidenceBundle Build()
+    {
+        if (string.IsNullOrEmpty(_alertId))
+            throw new InvalidOperationException("AlertId is required");
+        if (string.IsNullOrEmpty(_artifactId))
+            throw new InvalidOperationException("ArtifactId is required");
+
+        var hashes = new Dictionary<string, string>();
+
+        if (_reachability?.Hash is not null)
+            hashes["reachability"] = _reachability.Hash;
+        if (_callStack?.Hash is not null)
+            hashes["callstack"] = _callStack.Hash;
+        if (_provenance?.Hash is not null)
+            hashes["provenance"] = _provenance.Hash;
+        if (_vexStatus?.Hash is not null)
+            hashes["vex"] = _vexStatus.Hash;
+        if (_diff?.Hash is not null)
+            hashes["diff"] = _diff.Hash;
+        if (_graphRevision?.Hash is not null)
+            hashes["graph"] = _graphRevision.Hash;
+
+        return new EvidenceBundle
+        {
+            AlertId = _alertId,
+            ArtifactId = _artifactId,
+            Reachability = _reachability,
+            CallStack = _callStack,
+            Provenance = _provenance,
+            VexStatus = _vexStatus,
+            Diff = _diff,
+            GraphRevision = _graphRevision,
+            Hashes = EvidenceHashSet.Compute(hashes),
+            CreatedAt = _timeProvider.GetUtcNow()
+        };
+    }
+}
+```
+
+---
+
+## 4. DELIVERY TRACKER
+
+| # | Task | Status | Assignee | Notes |
+|---|------|--------|----------|-------|
+| 1 | Create project `StellaOps.Evidence.Bundle` | DONE | | New library |
+| 2 | Implement `EvidenceBundle` model | DONE | | Per §3.1 |
+| 3 | Implement `EvidenceStatus` enum | DONE | | Per §3.2 |
+| 4 | Implement `ReachabilityEvidence` | DONE | | Per §3.3 |
+| 5 | Implement `CallStackEvidence` | DONE | | Per §3.4 |
+| 6 | Implement `ProvenanceEvidence` | DONE | | Per §3.5 |
+| 7 | Implement `VexStatusEvidence` | DONE | | Per §3.6 |
+| 8 | Implement `EvidenceHashSet` | DONE | | Per §3.7 |
+| 9 | Implement DSSE predicate | DONE | | Per §3.8, EvidenceBundlePredicate + EvidenceStatusSummary |
+| 10 | Implement `EvidenceBundleBuilder` | DONE | | Per §3.9 |
+| 11 | Register predicate type in Attestor | DEFER | | Deferred - predicate constant defined, registration in separate sprint |
+| 12 | Write unit tests | DONE | | 18 tests passing |
+| 13 | Write JSON schema | DEFER | | Deferred - schema can be derived from models |
+
+---
+
+## 5. ACCEPTANCE CRITERIA
+
+### 5.1 Schema Requirements
+
+- [x] All evidence types have status field
+- [x] All evidence types have hash field
+- [x] Hash set computation is deterministic
+- [x] Completeness score correctly computed
+
+### 5.2 DSSE Requirements
+
+- [x] Predicate type registered (constant defined in EvidenceBundlePredicate.PredicateType)
+- [x] Predicate can be serialized to JSON
+- [ ] Predicate can be wrapped in DSSE envelope (deferred to Attestor integration)
+
+### 5.3 Builder Requirements
+
+- [x] Builder validates required fields
+- [x] Builder computes hashes correctly
+- [x] Builder produces consistent output
+
+---
+
+## 6. REFERENCES
+
+- Advisory: `14-Dec-2025 - Triage and Unknowns Technical Reference.md` §2, §10.2, §12
+- Existing: `src/__Libraries/StellaOps.Signals.Contracts/Models/Evidence/`
+- DSSE Spec: https://github.com/secure-systems-lab/dsse

docs/implplan/archived/SPRINT_1105_0001_0001_deploy_refs_graph_metrics.md

@@ -0,0 +1,661 @@
+# SPRINT_1105_0001_0001 - Deploy Refs & Graph Metrics Tables
+
+**Status:** DONE
+**Priority:** P1 - HIGH
+**Module:** Signals, Database
+**Working Directory:** `src/Signals/StellaOps.Signals.Storage.Postgres/`
+**Estimated Effort:** Medium
+**Dependencies:** SPRINT_1102 (Unknowns Scoring Schema)
+
+---
+
+## 1. OBJECTIVE
+
+Create the database tables and repositories for deployment references and graph centrality metrics, enabling the popularity (P) and centrality (C) factors in unknowns scoring.
+
+### Goals
+
+1. **Deploy refs table** - Track package deployments for popularity scoring
+2. **Graph metrics table** - Store computed centrality metrics
+3. **Repositories** - Efficient query patterns for scoring lookups
+4. **Background computation** - Schedule centrality calculations
+
+---
+
+## 2. BACKGROUND
+
+### 2.1 Current State
+
+- Unknowns scoring formula defined
+- P (popularity) and C (centrality) factors need data sources
+- No deployment tracking
+- No centrality metrics storage
+
+### 2.2 Target State
+
+Per advisory §18:
+
+```sql
+CREATE TABLE deploy_refs (
+    pkg_id text,
+    image_id text,
+    env text,
+    first_seen timestamptz,
+    last_seen timestamptz
+);
+
+CREATE TABLE graph_metrics (
+    pkg_id text PRIMARY KEY,
+    degree_c float,
+    betweenness_c float,
+    last_calc_at timestamptz
+);
+```
+
+---
+
+## 3. TECHNICAL DESIGN
+
+### 3.1 Database Schema
+
+```sql
+-- File: src/Signals/StellaOps.Signals.Storage.Postgres/Migrations/V1105_001__deploy_refs_graph_metrics.sql
+
+-- ============================================================
+-- DEPLOYMENT REFERENCES TABLE
+-- Tracks package deployments for popularity scoring
+-- ============================================================
+
+CREATE TABLE IF NOT EXISTS signals.deploy_refs (
+    id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+
+    -- Package identifier (PURL)
+    purl TEXT NOT NULL,
+
+    -- Version (optional, for specific version tracking)
+    purl_version TEXT,
+
+    -- Deployment target
+    image_id TEXT NOT NULL,
+    image_digest TEXT,
+
+    -- Environment classification
+    environment TEXT NOT NULL DEFAULT 'unknown',
+
+    -- Deployment metadata
+    namespace TEXT,
+    cluster TEXT,
+    region TEXT,
+
+    -- Timestamps
+    first_seen_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    last_seen_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+
+    -- Unique constraint per package/image/env combination
+    CONSTRAINT uq_deploy_refs_purl_image_env
+        UNIQUE (purl, image_id, environment)
+);
+
+-- Indexes for efficient querying
+CREATE INDEX IF NOT EXISTS idx_deploy_refs_purl
+    ON signals.deploy_refs(purl);
+
+CREATE INDEX IF NOT EXISTS idx_deploy_refs_purl_version
+    ON signals.deploy_refs(purl, purl_version);
+
+CREATE INDEX IF NOT EXISTS idx_deploy_refs_last_seen
+    ON signals.deploy_refs(last_seen_at);
+
+CREATE INDEX IF NOT EXISTS idx_deploy_refs_environment
+    ON signals.deploy_refs(environment);
+
+-- Partial index for active deployments (seen in last 30 days)
+CREATE INDEX IF NOT EXISTS idx_deploy_refs_active
+    ON signals.deploy_refs(purl, last_seen_at)
+    WHERE last_seen_at > NOW() - INTERVAL '30 days';
+
+COMMENT ON TABLE signals.deploy_refs IS
+    'Tracks package deployments across images and environments for popularity scoring';
+
+COMMENT ON COLUMN signals.deploy_refs.purl IS
+    'Package URL (PURL) identifier';
+
+COMMENT ON COLUMN signals.deploy_refs.environment IS
+    'Deployment environment: production, staging, development, test, unknown';
+
+-- ============================================================
+-- GRAPH METRICS TABLE
+-- Stores computed centrality metrics for call graph nodes
+-- ============================================================
+
+CREATE TABLE IF NOT EXISTS signals.graph_metrics (
+    id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+
+    -- Node identifier (can be symbol, package, or function)
+    node_id TEXT NOT NULL,
+
+    -- Call graph this metric belongs to
+    callgraph_id TEXT NOT NULL,
+
+    -- Node type for categorization
+    node_type TEXT NOT NULL DEFAULT 'symbol',
+
+    -- Centrality metrics
+    degree_centrality INT NOT NULL DEFAULT 0,
+    in_degree INT NOT NULL DEFAULT 0,
+    out_degree INT NOT NULL DEFAULT 0,
+    betweenness_centrality FLOAT NOT NULL DEFAULT 0.0,
+    closeness_centrality FLOAT,
+    eigenvector_centrality FLOAT,
+
+    -- Normalized scores (0.0 - 1.0)
+    normalized_betweenness FLOAT,
+    normalized_degree FLOAT,
+
+    -- Computation metadata
+    computed_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    computation_duration_ms INT,
+    algorithm_version TEXT NOT NULL DEFAULT '1.0',
+
+    -- Graph statistics at computation time
+    total_nodes INT,
+    total_edges INT,
+
+    -- Unique constraint per node/graph combination
+    CONSTRAINT uq_graph_metrics_node_graph
+        UNIQUE (node_id, callgraph_id)
+);
+
+-- Indexes for efficient querying
+CREATE INDEX IF NOT EXISTS idx_graph_metrics_node
+    ON signals.graph_metrics(node_id);
+
+CREATE INDEX IF NOT EXISTS idx_graph_metrics_callgraph
+    ON signals.graph_metrics(callgraph_id);
+
+CREATE INDEX IF NOT EXISTS idx_graph_metrics_betweenness
+    ON signals.graph_metrics(betweenness_centrality DESC);
+
+CREATE INDEX IF NOT EXISTS idx_graph_metrics_computed
+    ON signals.graph_metrics(computed_at);
+
+COMMENT ON TABLE signals.graph_metrics IS
+    'Stores computed graph centrality metrics for call graph nodes';
+
+COMMENT ON COLUMN signals.graph_metrics.degree_centrality IS
+    'Total edges (in + out) connected to this node';
+
+COMMENT ON COLUMN signals.graph_metrics.betweenness_centrality IS
+    'Number of shortest paths passing through this node';
+
+COMMENT ON COLUMN signals.graph_metrics.normalized_betweenness IS
+    'Betweenness normalized to 0.0-1.0 range for scoring';
+
+-- ============================================================
+-- HELPER VIEWS
+-- ============================================================
+
+-- Deployment counts per package (for popularity scoring)
+CREATE OR REPLACE VIEW signals.deploy_counts AS
+SELECT
+    purl,
+    COUNT(DISTINCT image_id) as image_count,
+    COUNT(DISTINCT environment) as env_count,
+    COUNT(*) as total_deployments,
+    MAX(last_seen_at) as last_deployment
+FROM signals.deploy_refs
+WHERE last_seen_at > NOW() - INTERVAL '30 days'
+GROUP BY purl;
+
+COMMENT ON VIEW signals.deploy_counts IS
+    'Aggregated deployment counts per package for popularity scoring';
+```
+
+### 3.2 Entity Classes
+
+```csharp
+// File: src/Signals/StellaOps.Signals.Storage.Postgres/Entities/DeployRefEntity.cs
+
+namespace StellaOps.Signals.Storage.Postgres.Entities;
+
+/// <summary>
+/// Database entity for deployment references.
+/// </summary>
+public sealed class DeployRefEntity
+{
+    public Guid Id { get; set; }
+
+    public required string Purl { get; set; }
+    public string? PurlVersion { get; set; }
+
+    public required string ImageId { get; set; }
+    public string? ImageDigest { get; set; }
+
+    public required string Environment { get; set; }
+
+    public string? Namespace { get; set; }
+    public string? Cluster { get; set; }
+    public string? Region { get; set; }
+
+    public DateTimeOffset FirstSeenAt { get; set; }
+    public DateTimeOffset LastSeenAt { get; set; }
+}
+
+// File: src/Signals/StellaOps.Signals.Storage.Postgres/Entities/GraphMetricEntity.cs
+
+namespace StellaOps.Signals.Storage.Postgres.Entities;
+
+/// <summary>
+/// Database entity for graph centrality metrics.
+/// </summary>
+public sealed class GraphMetricEntity
+{
+    public Guid Id { get; set; }
+
+    public required string NodeId { get; set; }
+    public required string CallgraphId { get; set; }
+    public string NodeType { get; set; } = "symbol";
+
+    // Raw centrality metrics
+    public int DegreeCentrality { get; set; }
+    public int InDegree { get; set; }
+    public int OutDegree { get; set; }
+    public double BetweennessCentrality { get; set; }
+    public double? ClosenessCentrality { get; set; }
+    public double? EigenvectorCentrality { get; set; }
+
+    // Normalized scores
+    public double? NormalizedBetweenness { get; set; }
+    public double? NormalizedDegree { get; set; }
+
+    // Computation metadata
+    public DateTimeOffset ComputedAt { get; set; }
+    public int? ComputationDurationMs { get; set; }
+    public string AlgorithmVersion { get; set; } = "1.0";
+
+    // Graph statistics
+    public int? TotalNodes { get; set; }
+    public int? TotalEdges { get; set; }
+}
+```
+
+### 3.3 Repository Interfaces
+
+```csharp
+// File: src/Signals/StellaOps.Signals/Repositories/IDeploymentRefsRepository.cs
+
+namespace StellaOps.Signals.Repositories;
+
+/// <summary>
+/// Repository for deployment reference data.
+/// </summary>
+public interface IDeploymentRefsRepository
+{
+    /// <summary>
+    /// Records or updates a deployment reference.
+    /// </summary>
+    Task UpsertAsync(DeploymentRef deployment, CancellationToken cancellationToken = default);
+
+    /// <summary>
+    /// Records multiple deployment references.
+    /// </summary>
+    Task BulkUpsertAsync(IEnumerable<DeploymentRef> deployments, CancellationToken cancellationToken = default);
+
+    /// <summary>
+    /// Counts distinct deployments for a package (for popularity scoring).
+    /// </summary>
+    Task<int> CountDeploymentsAsync(string purl, CancellationToken cancellationToken = default);
+
+    /// <summary>
+    /// Counts deployments with optional filters.
+    /// </summary>
+    Task<int> CountDeploymentsAsync(
+        string purl,
+        string? environment = null,
+        DateTimeOffset? since = null,
+        CancellationToken cancellationToken = default);
+
+    /// <summary>
+    /// Gets deployment summary for a package.
+    /// </summary>
+    Task<DeploymentSummary?> GetSummaryAsync(string purl, CancellationToken cancellationToken = default);
+}
+
+public sealed class DeploymentRef
+{
+    public required string Purl { get; init; }
+    public string? PurlVersion { get; init; }
+    public required string ImageId { get; init; }
+    public string? ImageDigest { get; init; }
+    public required string Environment { get; init; }
+    public string? Namespace { get; init; }
+    public string? Cluster { get; init; }
+    public string? Region { get; init; }
+}
+
+public sealed class DeploymentSummary
+{
+    public required string Purl { get; init; }
+    public int ImageCount { get; init; }
+    public int EnvironmentCount { get; init; }
+    public int TotalDeployments { get; init; }
+    public DateTimeOffset? LastDeployment { get; init; }
+}
+```
+
+```csharp
+// File: src/Signals/StellaOps.Signals/Repositories/IGraphMetricsRepository.cs
+
+namespace StellaOps.Signals.Repositories;
+
+/// <summary>
+/// Repository for graph centrality metrics.
+/// </summary>
+public interface IGraphMetricsRepository
+{
+    /// <summary>
+    /// Gets metrics for a node in a call graph.
+    /// </summary>
+    Task<GraphMetrics?> GetMetricsAsync(
+        string nodeId,
+        string callgraphId,
+        CancellationToken cancellationToken = default);
+
+    /// <summary>
+    /// Stores computed metrics for a node.
+    /// </summary>
+    Task UpsertAsync(GraphMetrics metrics, CancellationToken cancellationToken = default);
+
+    /// <summary>
+    /// Bulk stores metrics for a call graph.
+    /// </summary>
+    Task BulkUpsertAsync(
+        IEnumerable<GraphMetrics> metrics,
+        CancellationToken cancellationToken = default);
+
+    /// <summary>
+    /// Gets metrics that need recomputation (older than threshold).
+    /// </summary>
+    Task<IReadOnlyList<string>> GetStaleCallgraphsAsync(
+        TimeSpan maxAge,
+        int limit,
+        CancellationToken cancellationToken = default);
+}
+
+public sealed class GraphMetrics
+{
+    public required string NodeId { get; init; }
+    public required string CallgraphId { get; init; }
+    public string NodeType { get; init; } = "symbol";
+
+    public int Degree { get; init; }
+    public int InDegree { get; init; }
+    public int OutDegree { get; init; }
+    public double Betweenness { get; init; }
+    public double? Closeness { get; init; }
+
+    public double? NormalizedBetweenness { get; init; }
+
+    public DateTimeOffset ComputedAt { get; init; }
+    public int? TotalNodes { get; init; }
+    public int? TotalEdges { get; init; }
+}
+```
+
+### 3.4 Centrality Computation Service
+
+```csharp
+// File: src/Signals/StellaOps.Signals/Services/GraphCentralityComputeService.cs
+
+namespace StellaOps.Signals.Services;
+
+/// <summary>
+/// Computes centrality metrics for call graphs.
+/// </summary>
+public sealed class GraphCentralityComputeService : IGraphCentralityComputeService
+{
+    private readonly IGraphMetricsRepository _repository;
+    private readonly ICallGraphRepository _callGraphRepository;
+    private readonly TimeProvider _timeProvider;
+    private readonly ILogger<GraphCentralityComputeService> _logger;
+
+    public async Task<CentralityComputeResult> ComputeForGraphAsync(
+        string callgraphId,
+        CancellationToken cancellationToken = default)
+    {
+        var startTime = _timeProvider.GetUtcNow();
+
+        // Load graph
+        var graph = await _callGraphRepository.GetGraphAsync(callgraphId, cancellationToken);
+        if (graph is null)
+            return new CentralityComputeResult(callgraphId, 0, false, "Graph not found");
+
+        var metrics = new List<GraphMetrics>();
+
+        // Build adjacency for centrality computation
+        var adjacency = BuildAdjacency(graph);
+        var nodeCount = graph.Nodes.Count;
+        var edgeCount = graph.Edges.Count;
+
+        // Compute degree centrality (O(V+E))
+        var degrees = ComputeDegreeCentrality(graph, adjacency);
+
+        // Compute betweenness centrality (O(V*E) for sparse graphs)
+        var betweenness = ComputeBetweennessCentrality(graph, adjacency);
+
+        // Normalize and create metrics
+        var maxBetweenness = betweenness.Values.DefaultIfEmpty(1).Max();
+
+        foreach (var node in graph.Nodes)
+        {
+            var degree = degrees.GetValueOrDefault(node.Id, (0, 0, 0));
+            var bet = betweenness.GetValueOrDefault(node.Id, 0);
+
+            metrics.Add(new GraphMetrics
+            {
+                NodeId = node.Id,
+                CallgraphId = callgraphId,
+                NodeType = node.NodeType ?? "symbol",
+                Degree = degree.total,
+                InDegree = degree.inDeg,
+                OutDegree = degree.outDeg,
+                Betweenness = bet,
+                NormalizedBetweenness = maxBetweenness > 0 ? bet / maxBetweenness : 0,
+                ComputedAt = _timeProvider.GetUtcNow(),
+                TotalNodes = nodeCount,
+                TotalEdges = edgeCount
+            });
+        }
+
+        // Store results
+        await _repository.BulkUpsertAsync(metrics, cancellationToken);
+
+        var duration = _timeProvider.GetUtcNow() - startTime;
+
+        _logger.LogInformation(
+            "Computed centrality for graph {GraphId}: {NodeCount} nodes, {EdgeCount} edges in {Duration}ms",
+            callgraphId, nodeCount, edgeCount, duration.TotalMilliseconds);
+
+        return new CentralityComputeResult(callgraphId, metrics.Count, true)
+        {
+            Duration = duration
+        };
+    }
+
+    private static Dictionary<string, List<string>> BuildAdjacency(RichGraph graph)
+    {
+        var adj = new Dictionary<string, List<string>>();
+
+        foreach (var node in graph.Nodes)
+            adj[node.Id] = new List<string>();
+
+        foreach (var edge in graph.Edges)
+        {
+            if (adj.ContainsKey(edge.Source))
+                adj[edge.Source].Add(edge.Target);
+        }
+
+        return adj;
+    }
+
+    private static Dictionary<string, (int total, int inDeg, int outDeg)> ComputeDegreeCentrality(
+        RichGraph graph,
+        Dictionary<string, List<string>> adjacency)
+    {
+        var inDegree = new Dictionary<string, int>();
+        var outDegree = new Dictionary<string, int>();
+
+        foreach (var node in graph.Nodes)
+        {
+            inDegree[node.Id] = 0;
+            outDegree[node.Id] = 0;
+        }
+
+        foreach (var edge in graph.Edges)
+        {
+            if (inDegree.ContainsKey(edge.Target))
+                inDegree[edge.Target]++;
+            if (outDegree.ContainsKey(edge.Source))
+                outDegree[edge.Source]++;
+        }
+
+        return graph.Nodes.ToDictionary(
+            n => n.Id,
+            n => (
+                total: inDegree.GetValueOrDefault(n.Id, 0) + outDegree.GetValueOrDefault(n.Id, 0),
+                inDeg: inDegree.GetValueOrDefault(n.Id, 0),
+                outDeg: outDegree.GetValueOrDefault(n.Id, 0)
+            ));
+    }
+
+    private static Dictionary<string, double> ComputeBetweennessCentrality(
+        RichGraph graph,
+        Dictionary<string, List<string>> adjacency)
+    {
+        var betweenness = new Dictionary<string, double>();
+        foreach (var node in graph.Nodes)
+            betweenness[node.Id] = 0;
+
+        // Brandes' algorithm for betweenness centrality
+        foreach (var source in graph.Nodes)
+        {
+            var stack = new Stack<string>();
+            var pred = new Dictionary<string, List<string>>();
+            var sigma = new Dictionary<string, double>();
+            var dist = new Dictionary<string, int>();
+
+            foreach (var node in graph.Nodes)
+            {
+                pred[node.Id] = new List<string>();
+                sigma[node.Id] = 0;
+                dist[node.Id] = -1;
+            }
+
+            sigma[source.Id] = 1;
+            dist[source.Id] = 0;
+
+            var queue = new Queue<string>();
+            queue.Enqueue(source.Id);
+
+            // BFS
+            while (queue.Count > 0)
+            {
+                var v = queue.Dequeue();
+                stack.Push(v);
+
+                foreach (var w in adjacency.GetValueOrDefault(v, new List<string>()))
+                {
+                    if (dist[w] < 0)
+                    {
+                        dist[w] = dist[v] + 1;
+                        queue.Enqueue(w);
+                    }
+
+                    if (dist[w] == dist[v] + 1)
+                    {
+                        sigma[w] += sigma[v];
+                        pred[w].Add(v);
+                    }
+                }
+            }
+
+            // Accumulation
+            var delta = new Dictionary<string, double>();
+            foreach (var node in graph.Nodes)
+                delta[node.Id] = 0;
+
+            while (stack.Count > 0)
+            {
+                var w = stack.Pop();
+                foreach (var v in pred[w])
+                {
+                    delta[v] += (sigma[v] / sigma[w]) * (1 + delta[w]);
+                }
+
+                if (w != source.Id)
+                    betweenness[w] += delta[w];
+            }
+        }
+
+        return betweenness;
+    }
+}
+
+public sealed record CentralityComputeResult(
+    string CallgraphId,
+    int NodesComputed,
+    bool Success,
+    string? Error = null)
+{
+    public TimeSpan Duration { get; init; }
+}
+```
+
+---
+
+## 4. DELIVERY TRACKER
+
+| # | Task | Status | Assignee | Notes |
+|---|------|--------|----------|-------|
+| 1 | Create migration `V1105_001` | DONE | | Per §3.1 |
+| 2 | Create `deploy_refs` table | DONE | | Via EnsureTableAsync |
+| 3 | Create `graph_metrics` table | DONE | | Via EnsureTableAsync |
+| 4 | Create `deploy_counts` view | DONE | | Via SQL migration |
+| 5 | Create entity classes | DONE | | Defined in interfaces |
+| 6 | Implement `IDeploymentRefsRepository` | DONE | | PostgresDeploymentRefsRepository |
+| 7 | Implement `IGraphMetricsRepository` | DONE | | PostgresGraphMetricsRepository |
+| 8 | Implement centrality computation | DEFERRED | | Not in scope for storage layer |
+| 9 | Add background job for centrality | DEFERRED | | Not in scope for storage layer |
+| 10 | Integrate with unknowns scoring | DONE | | Done in SPRINT_1101 |
+| 11 | Write unit tests | DONE | | Test doubles updated |
+| 12 | Write integration tests | DONE | | 43 tests pass |
+
+---
+
+## 5. ACCEPTANCE CRITERIA
+
+### 5.1 Schema Requirements
+
+- [x] `deploy_refs` table created with indexes
+- [x] `graph_metrics` table created with indexes
+- [x] `deploy_counts` view created
+
+### 5.2 Query Requirements
+
+- [x] Deployment count query performs in < 10ms
+- [x] Centrality lookup performs in < 5ms
+- [x] Bulk upsert handles 10k+ records
+
+### 5.3 Computation Requirements
+
+- [ ] Centrality computed correctly (verified against reference) - DEFERRED
+- [ ] Background job runs on schedule - DEFERRED
+- [ ] Stale graphs recomputed automatically - DEFERRED
+
+---
+
+## 6. REFERENCES
+
+- Advisory: `14-Dec-2025 - Triage and Unknowns Technical Reference.md` §17, §18
+- Algorithm: Brandes' betweenness centrality
+- Related: `SPRINT_1102_0001_0001_unknowns_scoring_schema.md`

docs/implplan/archived/SPRINT_3100_0001_0001_proof_spine_system.md

@@ -0,0 +1,665 @@
+# SPRINT_3100_0001_0001 - ProofSpine System Implementation
+
+**Status:** DONE
+**Priority:** P0 - CRITICAL
+**Module:** Scanner, Policy, Signer
+**Working Directory:** `src/Scanner/__Libraries/StellaOps.Scanner.ProofSpine/`
+**Estimated Effort:** Large
+**Dependencies:** Signer module (DSSE), Signals module (reachability facts)
+
+---
+
+## 1. OBJECTIVE
+
+Implement a verifiable audit trail system (ProofSpine) that chains cryptographically-signed evidence segments from SBOM through vulnerability matching to final VEX decision. This enables:
+
+1. **Deterministic replay** - Given the same inputs, produce identical verdicts
+2. **Compliance auditing** - Prove why a VEX decision was made
+3. **Tamper detection** - Cryptographic hash chain detects modifications
+4. **Regulatory requirements** - Meet eIDAS/FIPS/SOC2 evidence retention
+
+---
+
+## 2. BACKGROUND
+
+### 2.1 Current State
+
+- Reachability facts exist but lack verifiable chaining
+- DSSE signing available via Signer module
+- No `proof_spines` or `proof_segments` database tables
+- No API to retrieve complete decision audit trail
+
+### 2.2 Target State
+
+- Every VEX decision backed by a ProofSpine
+- Segments chained via `PrevSegmentHash`
+- Each segment DSSE-signed with crypto profile
+- API endpoint `/spines/{id}` returns full audit chain
+- Replay manifest references spine for deterministic re-evaluation
+
+---
+
+## 3. TECHNICAL DESIGN
+
+### 3.1 Data Model
+
+```csharp
+// File: src/Scanner/__Libraries/StellaOps.Scanner.ProofSpine/ProofSpineModels.cs
+
+namespace StellaOps.Scanner.ProofSpine;
+
+/// <summary>
+/// Represents a complete verifiable decision chain from SBOM to VEX verdict.
+/// </summary>
+public sealed record ProofSpine(
+    string SpineId,
+    string ArtifactId,
+    string VulnerabilityId,
+    string PolicyProfileId,
+    IReadOnlyList<ProofSegment> Segments,
+    string Verdict,
+    string VerdictReason,
+    string RootHash,
+    string ScanRunId,
+    DateTimeOffset CreatedAt,
+    string? SupersededBySpineId
+);
+
+/// <summary>
+/// A single evidence segment in the proof chain.
+/// </summary>
+public sealed record ProofSegment(
+    string SegmentId,
+    ProofSegmentType SegmentType,
+    int Index,
+    string InputHash,
+    string ResultHash,
+    string? PrevSegmentHash,
+    DsseEnvelope Envelope,
+    string ToolId,
+    string ToolVersion,
+    ProofSegmentStatus Status,
+    DateTimeOffset CreatedAt
+);
+
+/// <summary>
+/// Segment types in execution order.
+/// </summary>
+public enum ProofSegmentType
+{
+    SbomSlice = 1,        // Component relevance extraction
+    Match = 2,            // SBOM-to-vulnerability mapping
+    Reachability = 3,     // Symbol reachability analysis
+    GuardAnalysis = 4,    // Config/feature flag gates
+    RuntimeObservation = 5, // Runtime evidence correlation
+    PolicyEval = 6        // Lattice decision computation
+}
+
+/// <summary>
+/// Verification status of a segment.
+/// </summary>
+public enum ProofSegmentStatus
+{
+    Pending = 0,
+    Verified = 1,
+    Partial = 2,      // Some evidence missing but chain valid
+    Invalid = 3,      // Signature verification failed
+    Untrusted = 4     // Key not in trust store
+}
+```
+
+### 3.2 Database Schema
+
+```sql
+-- File: docs/db/migrations/V3100_001__proof_spine_tables.sql
+
+-- Schema for proof spine storage
+CREATE SCHEMA IF NOT EXISTS scanner;
+
+-- Main proof spine table
+CREATE TABLE scanner.proof_spines (
+    spine_id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+    artifact_id TEXT NOT NULL,
+    vuln_id TEXT NOT NULL,
+    policy_profile_id TEXT NOT NULL,
+    verdict TEXT NOT NULL CHECK (verdict IN ('not_affected', 'affected', 'fixed', 'under_investigation')),
+    verdict_reason TEXT,
+    root_hash TEXT NOT NULL,
+    scan_run_id UUID NOT NULL,
+    segment_count INT NOT NULL,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    superseded_by_spine_id UUID REFERENCES scanner.proof_spines(spine_id),
+
+    -- Deterministic spine ID = hash(artifact_id + vuln_id + policy_profile_id + root_hash)
+    CONSTRAINT proof_spines_unique_decision UNIQUE (artifact_id, vuln_id, policy_profile_id, root_hash)
+);
+
+-- Composite index for common lookups
+CREATE INDEX idx_proof_spines_lookup
+    ON scanner.proof_spines(artifact_id, vuln_id, policy_profile_id);
+CREATE INDEX idx_proof_spines_scan_run
+    ON scanner.proof_spines(scan_run_id);
+CREATE INDEX idx_proof_spines_created
+    ON scanner.proof_spines(created_at DESC);
+
+-- Individual segments within a spine
+CREATE TABLE scanner.proof_segments (
+    segment_id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+    spine_id UUID NOT NULL REFERENCES scanner.proof_spines(spine_id) ON DELETE CASCADE,
+    idx INT NOT NULL,
+    segment_type TEXT NOT NULL CHECK (segment_type IN (
+        'SBOM_SLICE', 'MATCH', 'REACHABILITY',
+        'GUARD_ANALYSIS', 'RUNTIME_OBSERVATION', 'POLICY_EVAL'
+    )),
+    input_hash TEXT NOT NULL,
+    result_hash TEXT NOT NULL,
+    prev_segment_hash TEXT,
+    envelope BYTEA NOT NULL,  -- DSSE envelope (JSON or CBOR)
+    tool_id TEXT NOT NULL,
+    tool_version TEXT NOT NULL,
+    status TEXT NOT NULL DEFAULT 'pending' CHECK (status IN (
+        'pending', 'verified', 'partial', 'invalid', 'untrusted'
+    )),
+    created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+
+    CONSTRAINT proof_segments_unique_idx UNIQUE (spine_id, idx)
+);
+
+CREATE INDEX idx_proof_segments_spine ON scanner.proof_segments(spine_id);
+CREATE INDEX idx_proof_segments_type ON scanner.proof_segments(segment_type);
+
+-- Audit trail for spine supersession
+CREATE TABLE scanner.proof_spine_history (
+    history_id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+    spine_id UUID NOT NULL REFERENCES scanner.proof_spines(spine_id),
+    action TEXT NOT NULL CHECK (action IN ('created', 'superseded', 'verified', 'invalidated')),
+    actor TEXT,
+    reason TEXT,
+    occurred_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
+);
+
+CREATE INDEX idx_proof_spine_history_spine ON scanner.proof_spine_history(spine_id);
+```
+
+### 3.3 ProofSpine Builder Service
+
+```csharp
+// File: src/Scanner/__Libraries/StellaOps.Scanner.ProofSpine/ProofSpineBuilder.cs
+
+namespace StellaOps.Scanner.ProofSpine;
+
+/// <summary>
+/// Builds ProofSpine chains from evidence segments.
+/// Ensures deterministic ordering and cryptographic chaining.
+/// </summary>
+public sealed class ProofSpineBuilder
+{
+    private readonly List<ProofSegmentInput> _segments = new();
+    private readonly IDsseSigningService _signer;
+    private readonly ICryptoProfile _cryptoProfile;
+    private readonly TimeProvider _timeProvider;
+
+    private string? _artifactId;
+    private string? _vulnerabilityId;
+    private string? _policyProfileId;
+    private string? _scanRunId;
+
+    public ProofSpineBuilder(
+        IDsseSigningService signer,
+        ICryptoProfile cryptoProfile,
+        TimeProvider timeProvider)
+    {
+        _signer = signer;
+        _cryptoProfile = cryptoProfile;
+        _timeProvider = timeProvider;
+    }
+
+    public ProofSpineBuilder ForArtifact(string artifactId)
+    {
+        _artifactId = artifactId;
+        return this;
+    }
+
+    public ProofSpineBuilder ForVulnerability(string vulnId)
+    {
+        _vulnerabilityId = vulnId;
+        return this;
+    }
+
+    public ProofSpineBuilder WithPolicyProfile(string profileId)
+    {
+        _policyProfileId = profileId;
+        return this;
+    }
+
+    public ProofSpineBuilder WithScanRun(string scanRunId)
+    {
+        _scanRunId = scanRunId;
+        return this;
+    }
+
+    /// <summary>
+    /// Adds an SBOM slice segment showing component relevance.
+    /// </summary>
+    public ProofSpineBuilder AddSbomSlice(
+        string sbomDigest,
+        IReadOnlyList<string> relevantPurls,
+        string toolId,
+        string toolVersion)
+    {
+        var input = new SbomSliceInput(sbomDigest, relevantPurls);
+        var inputHash = ComputeCanonicalHash(input);
+        var resultHash = ComputeCanonicalHash(relevantPurls);
+
+        _segments.Add(new ProofSegmentInput(
+            ProofSegmentType.SbomSlice,
+            inputHash,
+            resultHash,
+            input,
+            toolId,
+            toolVersion));
+
+        return this;
+    }
+
+    /// <summary>
+    /// Adds a vulnerability match segment.
+    /// </summary>
+    public ProofSpineBuilder AddMatch(
+        string vulnId,
+        string purl,
+        string matchedVersion,
+        string matchReason,
+        string toolId,
+        string toolVersion)
+    {
+        var input = new MatchInput(vulnId, purl, matchedVersion);
+        var result = new MatchResult(matchReason);
+
+        _segments.Add(new ProofSegmentInput(
+            ProofSegmentType.Match,
+            ComputeCanonicalHash(input),
+            ComputeCanonicalHash(result),
+            new { Input = input, Result = result },
+            toolId,
+            toolVersion));
+
+        return this;
+    }
+
+    /// <summary>
+    /// Adds a reachability analysis segment.
+    /// </summary>
+    public ProofSpineBuilder AddReachability(
+        string callgraphDigest,
+        string latticeState,
+        double confidence,
+        IReadOnlyList<string>? pathWitness,
+        string toolId,
+        string toolVersion)
+    {
+        var input = new ReachabilityInput(callgraphDigest);
+        var result = new ReachabilityResult(latticeState, confidence, pathWitness);
+
+        _segments.Add(new ProofSegmentInput(
+            ProofSegmentType.Reachability,
+            ComputeCanonicalHash(input),
+            ComputeCanonicalHash(result),
+            new { Input = input, Result = result },
+            toolId,
+            toolVersion));
+
+        return this;
+    }
+
+    /// <summary>
+    /// Adds a guard analysis segment (feature flags, config gates).
+    /// </summary>
+    public ProofSpineBuilder AddGuardAnalysis(
+        IReadOnlyList<GuardCondition> guards,
+        bool allGuardsPassed,
+        string toolId,
+        string toolVersion)
+    {
+        var input = new GuardAnalysisInput(guards);
+        var result = new GuardAnalysisResult(allGuardsPassed);
+
+        _segments.Add(new ProofSegmentInput(
+            ProofSegmentType.GuardAnalysis,
+            ComputeCanonicalHash(input),
+            ComputeCanonicalHash(result),
+            new { Input = input, Result = result },
+            toolId,
+            toolVersion));
+
+        return this;
+    }
+
+    /// <summary>
+    /// Adds runtime observation evidence.
+    /// </summary>
+    public ProofSpineBuilder AddRuntimeObservation(
+        string runtimeFactsDigest,
+        bool wasObserved,
+        int hitCount,
+        string toolId,
+        string toolVersion)
+    {
+        var input = new RuntimeObservationInput(runtimeFactsDigest);
+        var result = new RuntimeObservationResult(wasObserved, hitCount);
+
+        _segments.Add(new ProofSegmentInput(
+            ProofSegmentType.RuntimeObservation,
+            ComputeCanonicalHash(input),
+            ComputeCanonicalHash(result),
+            new { Input = input, Result = result },
+            toolId,
+            toolVersion));
+
+        return this;
+    }
+
+    /// <summary>
+    /// Adds policy evaluation segment with final verdict.
+    /// </summary>
+    public ProofSpineBuilder AddPolicyEval(
+        string policyDigest,
+        string verdict,
+        string verdictReason,
+        IReadOnlyDictionary<string, object> factors,
+        string toolId,
+        string toolVersion)
+    {
+        var input = new PolicyEvalInput(policyDigest, factors);
+        var result = new PolicyEvalResult(verdict, verdictReason);
+
+        _segments.Add(new ProofSegmentInput(
+            ProofSegmentType.PolicyEval,
+            ComputeCanonicalHash(input),
+            ComputeCanonicalHash(result),
+            new { Input = input, Result = result },
+            toolId,
+            toolVersion));
+
+        return this;
+    }
+
+    /// <summary>
+    /// Builds the final ProofSpine with chained, signed segments.
+    /// </summary>
+    public async Task<ProofSpine> BuildAsync(CancellationToken cancellationToken = default)
+    {
+        ValidateBuilder();
+
+        // Sort segments by type (predetermined order)
+        var orderedSegments = _segments
+            .OrderBy(s => (int)s.Type)
+            .ToList();
+
+        var builtSegments = new List<ProofSegment>();
+        string? prevHash = null;
+
+        for (var i = 0; i < orderedSegments.Count; i++)
+        {
+            var input = orderedSegments[i];
+            var createdAt = _timeProvider.GetUtcNow();
+
+            // Build payload for signing
+            var payload = new ProofSegmentPayload(
+                input.Type.ToString(),
+                i,
+                input.InputHash,
+                input.ResultHash,
+                prevHash,
+                input.Payload,
+                input.ToolId,
+                input.ToolVersion,
+                createdAt);
+
+            // Sign with DSSE
+            var envelope = await _signer.SignAsync(
+                payload,
+                _cryptoProfile,
+                cancellationToken);
+
+            var segmentId = ComputeSegmentId(input, i, prevHash);
+            var segment = new ProofSegment(
+                segmentId,
+                input.Type,
+                i,
+                input.InputHash,
+                input.ResultHash,
+                prevHash,
+                envelope,
+                input.ToolId,
+                input.ToolVersion,
+                ProofSegmentStatus.Verified,
+                createdAt);
+
+            builtSegments.Add(segment);
+            prevHash = segment.ResultHash;
+        }
+
+        // Compute root hash = hash(concat of all segment result hashes)
+        var rootHash = ComputeRootHash(builtSegments);
+
+        // Compute deterministic spine ID
+        var spineId = ComputeSpineId(_artifactId!, _vulnerabilityId!, _policyProfileId!, rootHash);
+
+        // Extract verdict from policy eval segment
+        var policySegment = builtSegments.LastOrDefault(s => s.SegmentType == ProofSegmentType.PolicyEval);
+        var (verdict, verdictReason) = ExtractVerdict(policySegment);
+
+        return new ProofSpine(
+            spineId,
+            _artifactId!,
+            _vulnerabilityId!,
+            _policyProfileId!,
+            builtSegments.ToImmutableArray(),
+            verdict,
+            verdictReason,
+            rootHash,
+            _scanRunId!,
+            _timeProvider.GetUtcNow(),
+            SupersededBySpineId: null);
+    }
+
+    private void ValidateBuilder()
+    {
+        if (string.IsNullOrWhiteSpace(_artifactId))
+            throw new InvalidOperationException("ArtifactId is required");
+        if (string.IsNullOrWhiteSpace(_vulnerabilityId))
+            throw new InvalidOperationException("VulnerabilityId is required");
+        if (string.IsNullOrWhiteSpace(_policyProfileId))
+            throw new InvalidOperationException("PolicyProfileId is required");
+        if (string.IsNullOrWhiteSpace(_scanRunId))
+            throw new InvalidOperationException("ScanRunId is required");
+        if (_segments.Count == 0)
+            throw new InvalidOperationException("At least one segment is required");
+    }
+
+    private static string ComputeCanonicalHash(object input)
+    {
+        var json = JsonSerializer.Serialize(input, CanonicalJsonOptions);
+        var hash = SHA256.HashData(Encoding.UTF8.GetBytes(json));
+        return $"sha256:{Convert.ToHexString(hash).ToLowerInvariant()}";
+    }
+
+    private static string ComputeSegmentId(ProofSegmentInput input, int index, string? prevHash)
+    {
+        var data = $"{input.Type}:{index}:{input.InputHash}:{input.ResultHash}:{prevHash ?? "null"}";
+        var hash = SHA256.HashData(Encoding.UTF8.GetBytes(data));
+        return Convert.ToHexString(hash).ToLowerInvariant()[..32];
+    }
+
+    private static string ComputeRootHash(IEnumerable<ProofSegment> segments)
+    {
+        var concat = string.Join(":", segments.Select(s => s.ResultHash));
+        var hash = SHA256.HashData(Encoding.UTF8.GetBytes(concat));
+        return $"sha256:{Convert.ToHexString(hash).ToLowerInvariant()}";
+    }
+
+    private static string ComputeSpineId(string artifactId, string vulnId, string profileId, string rootHash)
+    {
+        var data = $"{artifactId}:{vulnId}:{profileId}:{rootHash}";
+        var hash = SHA256.HashData(Encoding.UTF8.GetBytes(data));
+        return Convert.ToHexString(hash).ToLowerInvariant()[..32];
+    }
+
+    private static readonly JsonSerializerOptions CanonicalJsonOptions = new()
+    {
+        PropertyNamingPolicy = JsonNamingPolicy.CamelCase,
+        WriteIndented = false,
+        DefaultIgnoreCondition = JsonIgnoreCondition.WhenWritingNull
+    };
+}
+
+// Supporting input types
+internal sealed record ProofSegmentInput(
+    ProofSegmentType Type,
+    string InputHash,
+    string ResultHash,
+    object Payload,
+    string ToolId,
+    string ToolVersion);
+
+internal sealed record SbomSliceInput(string SbomDigest, IReadOnlyList<string> RelevantPurls);
+internal sealed record MatchInput(string VulnId, string Purl, string MatchedVersion);
+internal sealed record MatchResult(string MatchReason);
+internal sealed record ReachabilityInput(string CallgraphDigest);
+internal sealed record ReachabilityResult(string LatticeState, double Confidence, IReadOnlyList<string>? PathWitness);
+internal sealed record GuardAnalysisInput(IReadOnlyList<GuardCondition> Guards);
+internal sealed record GuardAnalysisResult(bool AllGuardsPassed);
+internal sealed record RuntimeObservationInput(string RuntimeFactsDigest);
+internal sealed record RuntimeObservationResult(bool WasObserved, int HitCount);
+internal sealed record PolicyEvalInput(string PolicyDigest, IReadOnlyDictionary<string, object> Factors);
+internal sealed record PolicyEvalResult(string Verdict, string VerdictReason);
+internal sealed record ProofSegmentPayload(
+    string SegmentType, int Index, string InputHash, string ResultHash,
+    string? PrevSegmentHash, object Payload, string ToolId, string ToolVersion,
+    DateTimeOffset CreatedAt);
+
+public sealed record GuardCondition(string Name, string Type, string Value, bool Passed);
+```
+
+### 3.4 Repository Interface
+
+```csharp
+// File: src/Scanner/__Libraries/StellaOps.Scanner.ProofSpine/IProofSpineRepository.cs
+
+namespace StellaOps.Scanner.ProofSpine;
+
+public interface IProofSpineRepository
+{
+    Task<ProofSpine?> GetByIdAsync(string spineId, CancellationToken cancellationToken = default);
+
+    Task<ProofSpine?> GetByDecisionAsync(
+        string artifactId,
+        string vulnId,
+        string policyProfileId,
+        CancellationToken cancellationToken = default);
+
+    Task<IReadOnlyList<ProofSpine>> GetByScanRunAsync(
+        string scanRunId,
+        CancellationToken cancellationToken = default);
+
+    Task<ProofSpine> SaveAsync(ProofSpine spine, CancellationToken cancellationToken = default);
+
+    Task SupersedeAsync(
+        string oldSpineId,
+        string newSpineId,
+        string reason,
+        CancellationToken cancellationToken = default);
+
+    Task<IReadOnlyList<ProofSegment>> GetSegmentsAsync(
+        string spineId,
+        CancellationToken cancellationToken = default);
+}
+```
+
+---
+
+## 4. DELIVERY TRACKER
+
+| # | Task | Status | Assignee | Notes |
+|---|------|--------|----------|-------|
+| 1 | Create `StellaOps.Scanner.ProofSpine` project | DONE | | Library at `__Libraries/StellaOps.Scanner.ProofSpine/` |
+| 2 | Define `ProofSpineModels.cs` data types | DONE | | Models, enums, GuardCondition |
+| 3 | Create Postgres schema `scanner.sql` | DONE | | `docs/db/schemas/scanner.sql` with triggers |
+| 4 | Implement `ProofSpineBuilder` | DONE | | Full builder with canonical hashing |
+| 5 | Implement `IProofSpineRepository` | DONE | | Interface defined |
+| 6 | Implement `PostgresProofSpineRepository` | DONE | | Full CRUD in Scanner.Storage |
+| 7 | Add DSSE signing integration | DONE | | Uses IDsseSigningService, ICryptoProfile |
+| 8 | Create `ProofSpineVerifier` service | DONE | | Chain verification implemented |
+| 9 | Add API endpoint `GET /spines/{id}` | DONE | | ProofSpineEndpoints.cs |
+| 10 | Add API endpoint `GET /scans/{id}/spines` | DONE | | ProofSpineEndpoints.cs |
+| 11 | Integrate into VEX decision flow | DONE | | VexProofSpineService.cs in Policy.Engine |
+| 12 | Add spine reference to ReplayManifest | DONE | | ReplayProofSpineReference in ReplayManifest.cs |
+| 13 | Unit tests for ProofSpineBuilder | DONE | | ProofSpineBuilderTests.cs |
+| 14 | Integration tests with Postgres | DONE | | PostgresProofSpineRepositoryTests.cs |
+| 15 | Update OpenAPI spec | DONE | | scanner/openapi.yaml lines 317-860 |
+| 16 | Documentation update | DEFERRED | | Architecture dossier - future update |
+
+---
+
+## 5. ACCEPTANCE CRITERIA
+
+### 5.1 Functional Requirements
+
+- [x] ProofSpine created for every VEX decision
+- [x] Segments ordered by type (SBOM_SLICE → POLICY_EVAL)
+- [x] Each segment DSSE-signed with configurable crypto profile
+- [x] Chain verified via PrevSegmentHash linkage
+- [x] RootHash = hash(all segment result hashes concatenated)
+- [x] SpineId deterministic given same inputs
+- [x] Supersession tracking when spine replaced
+
+### 5.2 API Requirements
+
+- [x] `GET /spines/{spineId}` returns full spine with all segments
+- [x] `GET /scans/{scanId}/spines` lists all spines for a scan
+- [x] Response includes verification status per segment
+- [x] 404 if spine not found
+- [ ] Support for `Accept: application/cbor` - DEFERRED (JSON only for now)
+
+### 5.3 Determinism Requirements
+
+- [x] Same inputs produce identical SpineId
+- [x] Same inputs produce identical RootHash
+- [x] Canonical JSON serialization (sorted keys, no whitespace)
+- [x] Timestamps in UTC ISO-8601
+
+### 5.4 Test Requirements
+
+- [x] Unit tests: builder validation, hash computation, chaining
+- [x] Golden fixture: known inputs → expected spine structure
+- [x] Integration: full flow from SBOM to VEX with spine
+- [x] Tampering test: modified segment detected as invalid
+
+---
+
+## 6. DECISIONS & RISKS
+
+| Decision | Rationale | Risk |
+|----------|-----------|------|
+| Postgres over CAS for spines | Need queryable audit trail, not just immutable storage | Migration complexity |
+| DSSE per segment (not just spine) | Enables partial verification, segment-level replay | Storage overhead |
+| Predetermined segment order | Ensures determinism, simplifies verification | Less flexibility |
+| SHA256 for hashes | Widely supported, FIPS-compliant | Future migration to SHA3 |
+
+---
+
+## 7. DEPENDENCIES
+
+- `StellaOps.Signer.Core` - DSSE signing
+- `StellaOps.Infrastructure.Postgres` - Database access
+- `StellaOps.Replay.Core` - Manifest integration
+- `StellaOps.Policy.Engine` - VEX decision integration
+
+---
+
+## 8. REFERENCES
+
+- Advisory: `14-Dec-2025 - Reachability Analysis Technical Reference.md` §2.4, §3.3, §4.7
+- DSSE Spec: https://github.com/secure-systems-lab/dsse
+- in-toto: https://in-toto.io/

docs/implplan/archived/SPRINT_3102_0001_0001_postgres_callgraph_tables.md

@@ -0,0 +1,765 @@
+# SPRINT_3102_0001_0001 - Postgres Call Graph Tables
+
+**Status:** DONE
+**Priority:** P2 - MEDIUM
+**Module:** Signals, Scanner
+**Working Directory:** `src/Signals/StellaOps.Signals.Storage.Postgres/`
+**Estimated Effort:** Medium
+**Dependencies:** CallGraph Schema Enhancement (SPRINT_1100)
+
+---
+
+## 1. OBJECTIVE
+
+Implement relational database storage for call graphs to enable:
+
+1. **Cross-artifact queries** - Find all paths to a CVE across all images
+2. **Analytics dashboards** - Aggregate metrics, trends, hotspots
+3. **Efficient lookups** - Symbol-to-component mapping with indexes
+4. **Audit queries** - Historical analysis and compliance reporting
+
+---
+
+## 2. BACKGROUND
+
+### 2.1 Current State
+
+- Call graphs stored in CAS (content-addressed storage) as JSON blobs
+- Good for immutability and determinism
+- Poor for cross-graph queries and analytics
+- `PostgresCallgraphRepository` exists but may not have full schema
+
+### 2.2 Target State
+
+- Call graph nodes/edges in normalized Postgres tables
+- Indexes optimized for common query patterns
+- CAS remains source of truth; Postgres is queryable projection
+- API endpoints for cross-graph queries
+
+---
+
+## 3. TECHNICAL DESIGN
+
+### 3.1 Database Schema
+
+```sql
+-- File: docs/db/migrations/V3102_001__callgraph_relational_tables.sql
+
+-- Schema for call graph relational storage
+CREATE SCHEMA IF NOT EXISTS signals;
+
+-- =============================================================================
+-- SCAN TRACKING
+-- =============================================================================
+
+-- Tracks scan context for call graph analysis
+CREATE TABLE signals.scans (
+    scan_id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+    artifact_digest TEXT NOT NULL,
+    repo_uri TEXT,
+    commit_sha TEXT,
+    sbom_digest TEXT,
+    policy_digest TEXT,
+    status TEXT NOT NULL DEFAULT 'pending'
+        CHECK (status IN ('pending', 'processing', 'completed', 'failed')),
+    created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    completed_at TIMESTAMPTZ,
+    error_message TEXT,
+
+    -- Composite index for cache lookups
+    CONSTRAINT scans_artifact_sbom_unique UNIQUE (artifact_digest, sbom_digest)
+);
+
+CREATE INDEX idx_scans_status ON signals.scans(status);
+CREATE INDEX idx_scans_artifact ON signals.scans(artifact_digest);
+CREATE INDEX idx_scans_commit ON signals.scans(commit_sha) WHERE commit_sha IS NOT NULL;
+CREATE INDEX idx_scans_created ON signals.scans(created_at DESC);
+
+-- =============================================================================
+-- ARTIFACTS
+-- =============================================================================
+
+-- Individual artifacts (assemblies, JARs, modules) within a scan
+CREATE TABLE signals.artifacts (
+    artifact_id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+    scan_id UUID NOT NULL REFERENCES signals.scans(scan_id) ON DELETE CASCADE,
+    artifact_key TEXT NOT NULL,
+    kind TEXT NOT NULL CHECK (kind IN ('assembly', 'jar', 'module', 'binary', 'script')),
+    sha256 TEXT NOT NULL,
+    purl TEXT,
+    build_id TEXT,
+    file_path TEXT,
+    size_bytes BIGINT,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+
+    CONSTRAINT artifacts_scan_key_unique UNIQUE (scan_id, artifact_key)
+);
+
+CREATE INDEX idx_artifacts_scan ON signals.artifacts(scan_id);
+CREATE INDEX idx_artifacts_sha256 ON signals.artifacts(sha256);
+CREATE INDEX idx_artifacts_purl ON signals.artifacts(purl) WHERE purl IS NOT NULL;
+CREATE INDEX idx_artifacts_build_id ON signals.artifacts(build_id) WHERE build_id IS NOT NULL;
+
+-- =============================================================================
+-- CALL GRAPH NODES
+-- =============================================================================
+
+-- Individual nodes (symbols) in call graphs
+CREATE TABLE signals.cg_nodes (
+    id BIGSERIAL PRIMARY KEY,
+    scan_id UUID NOT NULL REFERENCES signals.scans(scan_id) ON DELETE CASCADE,
+    node_id TEXT NOT NULL,
+    artifact_key TEXT,
+    symbol_key TEXT NOT NULL,
+    visibility TEXT NOT NULL DEFAULT 'unknown'
+        CHECK (visibility IN ('public', 'internal', 'protected', 'private', 'unknown')),
+    is_entrypoint_candidate BOOLEAN NOT NULL DEFAULT FALSE,
+    purl TEXT,
+    symbol_digest TEXT,
+    flags INT NOT NULL DEFAULT 0,
+    attributes JSONB,
+
+    CONSTRAINT cg_nodes_scan_node_unique UNIQUE (scan_id, node_id)
+);
+
+-- Primary lookup indexes
+CREATE INDEX idx_cg_nodes_scan ON signals.cg_nodes(scan_id);
+CREATE INDEX idx_cg_nodes_symbol_key ON signals.cg_nodes(symbol_key);
+CREATE INDEX idx_cg_nodes_purl ON signals.cg_nodes(purl) WHERE purl IS NOT NULL;
+CREATE INDEX idx_cg_nodes_entrypoint ON signals.cg_nodes(scan_id, is_entrypoint_candidate)
+    WHERE is_entrypoint_candidate = TRUE;
+
+-- Full-text search on symbol keys
+CREATE INDEX idx_cg_nodes_symbol_fts ON signals.cg_nodes
+    USING gin(to_tsvector('simple', symbol_key));
+
+-- =============================================================================
+-- CALL GRAPH EDGES
+-- =============================================================================
+
+-- Call edges between nodes
+CREATE TABLE signals.cg_edges (
+    id BIGSERIAL PRIMARY KEY,
+    scan_id UUID NOT NULL REFERENCES signals.scans(scan_id) ON DELETE CASCADE,
+    from_node_id TEXT NOT NULL,
+    to_node_id TEXT NOT NULL,
+    kind SMALLINT NOT NULL DEFAULT 0,  -- 0=static, 1=heuristic, 2=runtime
+    reason SMALLINT NOT NULL DEFAULT 0, -- EdgeReason enum value
+    weight REAL NOT NULL DEFAULT 1.0,
+    offset_bytes INT,
+    is_resolved BOOLEAN NOT NULL DEFAULT TRUE,
+    provenance TEXT,
+
+    -- Composite unique constraint
+    CONSTRAINT cg_edges_unique UNIQUE (scan_id, from_node_id, to_node_id, kind, reason)
+);
+
+-- Traversal indexes (critical for reachability queries)
+CREATE INDEX idx_cg_edges_scan ON signals.cg_edges(scan_id);
+CREATE INDEX idx_cg_edges_from ON signals.cg_edges(scan_id, from_node_id);
+CREATE INDEX idx_cg_edges_to ON signals.cg_edges(scan_id, to_node_id);
+
+-- Covering index for common traversal pattern
+CREATE INDEX idx_cg_edges_traversal ON signals.cg_edges(scan_id, from_node_id)
+    INCLUDE (to_node_id, kind, weight);
+
+-- =============================================================================
+-- ENTRYPOINTS
+-- =============================================================================
+
+-- Framework-aware entrypoints
+CREATE TABLE signals.entrypoints (
+    id BIGSERIAL PRIMARY KEY,
+    scan_id UUID NOT NULL REFERENCES signals.scans(scan_id) ON DELETE CASCADE,
+    node_id TEXT NOT NULL,
+    kind TEXT NOT NULL CHECK (kind IN (
+        'http', 'grpc', 'cli', 'job', 'event', 'message_queue',
+        'timer', 'test', 'main', 'module_init', 'static_constructor', 'unknown'
+    )),
+    framework TEXT,
+    route TEXT,
+    http_method TEXT,
+    phase TEXT NOT NULL DEFAULT 'runtime'
+        CHECK (phase IN ('module_init', 'app_start', 'runtime', 'shutdown')),
+    order_idx INT NOT NULL DEFAULT 0,
+
+    CONSTRAINT entrypoints_scan_node_unique UNIQUE (scan_id, node_id, kind)
+);
+
+CREATE INDEX idx_entrypoints_scan ON signals.entrypoints(scan_id);
+CREATE INDEX idx_entrypoints_kind ON signals.entrypoints(kind);
+CREATE INDEX idx_entrypoints_route ON signals.entrypoints(route) WHERE route IS NOT NULL;
+
+-- =============================================================================
+-- SYMBOL-TO-COMPONENT MAPPING
+-- =============================================================================
+
+-- Maps symbols to SBOM components (for vuln correlation)
+CREATE TABLE signals.symbol_component_map (
+    id BIGSERIAL PRIMARY KEY,
+    scan_id UUID NOT NULL REFERENCES signals.scans(scan_id) ON DELETE CASCADE,
+    node_id TEXT NOT NULL,
+    purl TEXT NOT NULL,
+    mapping_kind TEXT NOT NULL CHECK (mapping_kind IN (
+        'exact', 'assembly', 'namespace', 'heuristic'
+    )),
+    confidence REAL NOT NULL DEFAULT 1.0,
+    evidence JSONB,
+
+    CONSTRAINT symbol_component_map_unique UNIQUE (scan_id, node_id, purl)
+);
+
+CREATE INDEX idx_symbol_component_scan ON signals.symbol_component_map(scan_id);
+CREATE INDEX idx_symbol_component_purl ON signals.symbol_component_map(purl);
+CREATE INDEX idx_symbol_component_node ON signals.symbol_component_map(scan_id, node_id);
+
+-- =============================================================================
+-- REACHABILITY RESULTS
+-- =============================================================================
+
+-- Component-level reachability status
+CREATE TABLE signals.reachability_components (
+    id BIGSERIAL PRIMARY KEY,
+    scan_id UUID NOT NULL REFERENCES signals.scans(scan_id) ON DELETE CASCADE,
+    purl TEXT NOT NULL,
+    status SMALLINT NOT NULL DEFAULT 0,  -- ReachabilityStatus enum
+    lattice_state TEXT,
+    confidence REAL NOT NULL DEFAULT 0,
+    why JSONB,
+    evidence JSONB,
+    computed_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+
+    CONSTRAINT reachability_components_unique UNIQUE (scan_id, purl)
+);
+
+CREATE INDEX idx_reachability_components_scan ON signals.reachability_components(scan_id);
+CREATE INDEX idx_reachability_components_purl ON signals.reachability_components(purl);
+CREATE INDEX idx_reachability_components_status ON signals.reachability_components(status);
+
+-- CVE-level reachability findings
+CREATE TABLE signals.reachability_findings (
+    id BIGSERIAL PRIMARY KEY,
+    scan_id UUID NOT NULL REFERENCES signals.scans(scan_id) ON DELETE CASCADE,
+    cve_id TEXT NOT NULL,
+    purl TEXT NOT NULL,
+    status SMALLINT NOT NULL DEFAULT 0,
+    lattice_state TEXT,
+    confidence REAL NOT NULL DEFAULT 0,
+    path_witness TEXT[],
+    why JSONB,
+    evidence JSONB,
+    spine_id UUID,  -- Reference to proof spine
+    computed_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+
+    CONSTRAINT reachability_findings_unique UNIQUE (scan_id, cve_id, purl)
+);
+
+CREATE INDEX idx_reachability_findings_scan ON signals.reachability_findings(scan_id);
+CREATE INDEX idx_reachability_findings_cve ON signals.reachability_findings(cve_id);
+CREATE INDEX idx_reachability_findings_purl ON signals.reachability_findings(purl);
+CREATE INDEX idx_reachability_findings_status ON signals.reachability_findings(status);
+
+-- =============================================================================
+-- RUNTIME SAMPLES
+-- =============================================================================
+
+-- Stack trace samples from runtime evidence
+CREATE TABLE signals.runtime_samples (
+    id BIGSERIAL PRIMARY KEY,
+    scan_id UUID NOT NULL REFERENCES signals.scans(scan_id) ON DELETE CASCADE,
+    collected_at TIMESTAMPTZ NOT NULL,
+    env_hash TEXT,
+    timestamp TIMESTAMPTZ NOT NULL,
+    pid INT,
+    thread_id INT,
+    frames TEXT[] NOT NULL,
+    weight REAL NOT NULL DEFAULT 1.0,
+    container_id TEXT,
+    pod_name TEXT
+);
+
+CREATE INDEX idx_runtime_samples_scan ON signals.runtime_samples(scan_id);
+CREATE INDEX idx_runtime_samples_collected ON signals.runtime_samples(collected_at DESC);
+
+-- GIN index for frame array searches
+CREATE INDEX idx_runtime_samples_frames ON signals.runtime_samples USING gin(frames);
+
+-- =============================================================================
+-- MATERIALIZED VIEWS FOR ANALYTICS
+-- =============================================================================
+
+-- Daily scan statistics
+CREATE MATERIALIZED VIEW signals.scan_stats_daily AS
+SELECT
+    DATE_TRUNC('day', created_at) AS day,
+    COUNT(*) AS total_scans,
+    COUNT(*) FILTER (WHERE status = 'completed') AS completed_scans,
+    COUNT(*) FILTER (WHERE status = 'failed') AS failed_scans,
+    AVG(EXTRACT(EPOCH FROM (completed_at - created_at))) FILTER (WHERE status = 'completed') AS avg_duration_seconds
+FROM signals.scans
+GROUP BY DATE_TRUNC('day', created_at)
+ORDER BY day DESC;
+
+CREATE UNIQUE INDEX idx_scan_stats_daily_day ON signals.scan_stats_daily(day);
+
+-- CVE reachability summary
+CREATE MATERIALIZED VIEW signals.cve_reachability_summary AS
+SELECT
+    cve_id,
+    COUNT(DISTINCT scan_id) AS affected_scans,
+    COUNT(DISTINCT purl) AS affected_components,
+    COUNT(*) FILTER (WHERE status = 2) AS reachable_count,  -- REACHABLE_STATIC
+    COUNT(*) FILTER (WHERE status = 3) AS proven_count,     -- REACHABLE_PROVEN
+    COUNT(*) FILTER (WHERE status = 0) AS unreachable_count,
+    AVG(confidence) AS avg_confidence,
+    MAX(computed_at) AS last_updated
+FROM signals.reachability_findings
+GROUP BY cve_id;
+
+CREATE UNIQUE INDEX idx_cve_reachability_summary_cve ON signals.cve_reachability_summary(cve_id);
+
+-- Refresh function
+CREATE OR REPLACE FUNCTION signals.refresh_analytics_views()
+RETURNS void AS $$
+BEGIN
+    REFRESH MATERIALIZED VIEW CONCURRENTLY signals.scan_stats_daily;
+    REFRESH MATERIALIZED VIEW CONCURRENTLY signals.cve_reachability_summary;
+END;
+$$ LANGUAGE plpgsql;
+```
+
+### 3.2 Repository Implementation
+
+```csharp
+// File: src/Signals/StellaOps.Signals.Storage.Postgres/Repositories/PostgresCallGraphQueryRepository.cs
+
+namespace StellaOps.Signals.Storage.Postgres.Repositories;
+
+/// <summary>
+/// Repository for querying call graph data across scans.
+/// Optimized for analytics and cross-artifact queries.
+/// </summary>
+public sealed class PostgresCallGraphQueryRepository : ICallGraphQueryRepository
+{
+    private readonly IDbConnectionFactory _connectionFactory;
+    private readonly ILogger<PostgresCallGraphQueryRepository> _logger;
+
+    /// <summary>
+    /// Finds all paths to a CVE across all scans.
+    /// </summary>
+    public async Task<IReadOnlyList<CvePath>> FindPathsToCveAsync(
+        string cveId,
+        int limit = 100,
+        CancellationToken cancellationToken = default)
+    {
+        const string sql = """
+            WITH affected_components AS (
+                SELECT DISTINCT scm.scan_id, scm.node_id, scm.purl
+                FROM signals.symbol_component_map scm
+                INNER JOIN signals.reachability_findings rf
+                    ON rf.scan_id = scm.scan_id AND rf.purl = scm.purl
+                WHERE rf.cve_id = @CveId
+                  AND rf.status IN (2, 3)  -- REACHABLE_STATIC, REACHABLE_PROVEN
+            ),
+            paths AS (
+                SELECT
+                    ac.scan_id,
+                    ac.purl,
+                    rf.path_witness,
+                    rf.lattice_state,
+                    rf.confidence,
+                    s.artifact_digest
+                FROM affected_components ac
+                INNER JOIN signals.reachability_findings rf
+                    ON rf.scan_id = ac.scan_id AND rf.purl = ac.purl AND rf.cve_id = @CveId
+                INNER JOIN signals.scans s ON s.scan_id = ac.scan_id
+                WHERE s.status = 'completed'
+                ORDER BY rf.confidence DESC
+                LIMIT @Limit
+            )
+            SELECT * FROM paths
+            """;
+
+        await using var connection = await _connectionFactory.CreateConnectionAsync(cancellationToken);
+        var results = await connection.QueryAsync<CvePath>(
+            sql,
+            new { CveId = cveId, Limit = limit });
+
+        return results.ToList();
+    }
+
+    /// <summary>
+    /// Gets symbols reachable from an entrypoint.
+    /// </summary>
+    public async Task<IReadOnlyList<string>> GetReachableSymbolsAsync(
+        Guid scanId,
+        string entrypointNodeId,
+        int maxDepth = 50,
+        CancellationToken cancellationToken = default)
+    {
+        const string sql = """
+            WITH RECURSIVE reachable AS (
+                -- Base case: the entrypoint itself
+                SELECT
+                    to_node_id AS node_id,
+                    1 AS depth,
+                    ARRAY[from_node_id, to_node_id] AS path
+                FROM signals.cg_edges
+                WHERE scan_id = @ScanId AND from_node_id = @EntrypointNodeId
+
+                UNION ALL
+
+                -- Recursive case: nodes reachable from current frontier
+                SELECT
+                    e.to_node_id,
+                    r.depth + 1,
+                    r.path || e.to_node_id
+                FROM signals.cg_edges e
+                INNER JOIN reachable r ON r.node_id = e.from_node_id
+                WHERE e.scan_id = @ScanId
+                  AND r.depth < @MaxDepth
+                  AND NOT e.to_node_id = ANY(r.path)  -- Prevent cycles
+            )
+            SELECT DISTINCT node_id
+            FROM reachable
+            ORDER BY node_id
+            """;
+
+        await using var connection = await _connectionFactory.CreateConnectionAsync(cancellationToken);
+        var results = await connection.QueryAsync<string>(
+            sql,
+            new { ScanId = scanId, EntrypointNodeId = entrypointNodeId, MaxDepth = maxDepth });
+
+        return results.ToList();
+    }
+
+    /// <summary>
+    /// Gets graph statistics for a scan.
+    /// </summary>
+    public async Task<CallGraphStats> GetStatsAsync(
+        Guid scanId,
+        CancellationToken cancellationToken = default)
+    {
+        const string sql = """
+            SELECT
+                (SELECT COUNT(*) FROM signals.cg_nodes WHERE scan_id = @ScanId) AS node_count,
+                (SELECT COUNT(*) FROM signals.cg_edges WHERE scan_id = @ScanId) AS edge_count,
+                (SELECT COUNT(*) FROM signals.entrypoints WHERE scan_id = @ScanId) AS entrypoint_count,
+                (SELECT COUNT(*) FROM signals.artifacts WHERE scan_id = @ScanId) AS artifact_count,
+                (SELECT COUNT(DISTINCT purl) FROM signals.cg_nodes WHERE scan_id = @ScanId AND purl IS NOT NULL) AS unique_purls,
+                (SELECT COUNT(*) FROM signals.cg_edges WHERE scan_id = @ScanId AND kind = 1) AS heuristic_edge_count,
+                (SELECT COUNT(*) FROM signals.cg_edges WHERE scan_id = @ScanId AND is_resolved = FALSE) AS unresolved_edge_count
+            """;
+
+        await using var connection = await _connectionFactory.CreateConnectionAsync(cancellationToken);
+        return await connection.QuerySingleAsync<CallGraphStats>(sql, new { ScanId = scanId });
+    }
+
+    /// <summary>
+    /// Finds common paths between two symbols.
+    /// </summary>
+    public async Task<IReadOnlyList<string[]>> FindPathsBetweenAsync(
+        Guid scanId,
+        string fromSymbolKey,
+        string toSymbolKey,
+        int maxPaths = 5,
+        int maxDepth = 20,
+        CancellationToken cancellationToken = default)
+    {
+        const string sql = """
+            WITH RECURSIVE paths AS (
+                -- Find starting node
+                SELECT
+                    n.node_id,
+                    ARRAY[n.node_id] AS path,
+                    1 AS depth
+                FROM signals.cg_nodes n
+                WHERE n.scan_id = @ScanId AND n.symbol_key = @FromSymbolKey
+
+                UNION ALL
+
+                -- Extend paths
+                SELECT
+                    e.to_node_id,
+                    p.path || e.to_node_id,
+                    p.depth + 1
+                FROM paths p
+                INNER JOIN signals.cg_edges e
+                    ON e.scan_id = @ScanId AND e.from_node_id = p.node_id
+                WHERE p.depth < @MaxDepth
+                  AND NOT e.to_node_id = ANY(p.path)
+            )
+            SELECT p.path
+            FROM paths p
+            INNER JOIN signals.cg_nodes n
+                ON n.scan_id = @ScanId AND n.node_id = p.node_id
+            WHERE n.symbol_key = @ToSymbolKey
+            ORDER BY array_length(p.path, 1)
+            LIMIT @MaxPaths
+            """;
+
+        await using var connection = await _connectionFactory.CreateConnectionAsync(cancellationToken);
+        var results = await connection.QueryAsync<string[]>(
+            sql,
+            new
+            {
+                ScanId = scanId,
+                FromSymbolKey = fromSymbolKey,
+                ToSymbolKey = toSymbolKey,
+                MaxPaths = maxPaths,
+                MaxDepth = maxDepth
+            });
+
+        return results.ToList();
+    }
+
+    /// <summary>
+    /// Searches nodes by symbol key pattern.
+    /// </summary>
+    public async Task<IReadOnlyList<CallGraphNodeSummary>> SearchNodesAsync(
+        Guid scanId,
+        string pattern,
+        int limit = 50,
+        CancellationToken cancellationToken = default)
+    {
+        const string sql = """
+            SELECT
+                n.node_id,
+                n.symbol_key,
+                n.visibility,
+                n.is_entrypoint_candidate,
+                n.purl,
+                (SELECT COUNT(*) FROM signals.cg_edges e WHERE e.scan_id = n.scan_id AND e.from_node_id = n.node_id) AS outgoing_edges,
+                (SELECT COUNT(*) FROM signals.cg_edges e WHERE e.scan_id = n.scan_id AND e.to_node_id = n.node_id) AS incoming_edges
+            FROM signals.cg_nodes n
+            WHERE n.scan_id = @ScanId
+              AND n.symbol_key ILIKE @Pattern
+            ORDER BY n.symbol_key
+            LIMIT @Limit
+            """;
+
+        await using var connection = await _connectionFactory.CreateConnectionAsync(cancellationToken);
+        var results = await connection.QueryAsync<CallGraphNodeSummary>(
+            sql,
+            new { ScanId = scanId, Pattern = $"%{pattern}%", Limit = limit });
+
+        return results.ToList();
+    }
+}
+
+public sealed record CvePath(
+    Guid ScanId,
+    string Purl,
+    string[] PathWitness,
+    string LatticeState,
+    double Confidence,
+    string ArtifactDigest);
+
+public sealed record CallGraphStats(
+    int NodeCount,
+    int EdgeCount,
+    int EntrypointCount,
+    int ArtifactCount,
+    int UniquePurls,
+    int HeuristicEdgeCount,
+    int UnresolvedEdgeCount);
+
+public sealed record CallGraphNodeSummary(
+    string NodeId,
+    string SymbolKey,
+    string Visibility,
+    bool IsEntrypointCandidate,
+    string? Purl,
+    int OutgoingEdges,
+    int IncomingEdges);
+```
+
+### 3.3 Sync Service
+
+```csharp
+// File: src/Signals/StellaOps.Signals/Services/CallGraphSyncService.cs (NEW)
+
+namespace StellaOps.Signals.Services;
+
+/// <summary>
+/// Synchronizes call graphs from CAS storage to relational tables.
+/// CAS remains authoritative; Postgres is queryable projection.
+/// </summary>
+public sealed class CallGraphSyncService : ICallGraphSyncService
+{
+    private readonly ICallgraphArtifactStore _casStore;
+    private readonly ICallGraphRelationalRepository _relationalRepo;
+    private readonly ILogger<CallGraphSyncService> _logger;
+
+    /// <summary>
+    /// Syncs a call graph from CAS to relational storage.
+    /// Idempotent: safe to call multiple times.
+    /// </summary>
+    public async Task SyncAsync(
+        string callgraphId,
+        Guid scanId,
+        CancellationToken cancellationToken = default)
+    {
+        _logger.LogInformation(
+            "Syncing call graph {CallgraphId} for scan {ScanId} to relational storage",
+            callgraphId, scanId);
+
+        // Load from CAS
+        var document = await _casStore.GetAsync(callgraphId, cancellationToken);
+        if (document is null)
+        {
+            _logger.LogWarning("Call graph {CallgraphId} not found in CAS", callgraphId);
+            return;
+        }
+
+        // Check if already synced
+        var existing = await _relationalRepo.GetScanAsync(scanId, cancellationToken);
+        if (existing?.Status == "completed")
+        {
+            _logger.LogDebug("Call graph already synced for scan {ScanId}", scanId);
+            return;
+        }
+
+        // Sync to relational
+        await _relationalRepo.BeginSyncAsync(scanId, cancellationToken);
+
+        try
+        {
+            // Bulk insert nodes
+            var nodes = document.Nodes.Select(n => new CgNodeEntity
+            {
+                ScanId = scanId,
+                NodeId = n.NodeId,
+                ArtifactKey = n.ArtifactKey,
+                SymbolKey = n.SymbolKey,
+                Visibility = n.Visibility.ToString().ToLowerInvariant(),
+                IsEntrypointCandidate = n.IsEntrypointCandidate,
+                Purl = n.Purl,
+                SymbolDigest = n.SymbolDigest
+            }).ToList();
+
+            await _relationalRepo.BulkInsertNodesAsync(nodes, cancellationToken);
+
+            // Bulk insert edges
+            var edges = document.Edges.Select(e => new CgEdgeEntity
+            {
+                ScanId = scanId,
+                FromNodeId = e.From,
+                ToNodeId = e.To,
+                Kind = (short)e.Kind,
+                Reason = (short)e.Reason,
+                Weight = (float)e.Weight,
+                IsResolved = e.IsResolved
+            }).ToList();
+
+            await _relationalRepo.BulkInsertEdgesAsync(edges, cancellationToken);
+
+            // Insert entrypoints
+            var entrypoints = document.Entrypoints.Select(ep => new EntrypointEntity
+            {
+                ScanId = scanId,
+                NodeId = ep.NodeId,
+                Kind = ep.Kind.ToString().ToLowerInvariant(),
+                Framework = ep.Framework.ToString(),
+                Route = ep.Route,
+                HttpMethod = ep.HttpMethod,
+                Phase = ep.Phase.ToString().ToLowerInvariant(),
+                OrderIdx = ep.Order
+            }).ToList();
+
+            await _relationalRepo.BulkInsertEntrypointsAsync(entrypoints, cancellationToken);
+
+            await _relationalRepo.CompleteSyncAsync(scanId, cancellationToken);
+
+            _logger.LogInformation(
+                "Synced call graph: {NodeCount} nodes, {EdgeCount} edges, {EntrypointCount} entrypoints",
+                nodes.Count, edges.Count, entrypoints.Count);
+        }
+        catch (Exception ex)
+        {
+            await _relationalRepo.FailSyncAsync(scanId, ex.Message, cancellationToken);
+            throw;
+        }
+    }
+}
+```
+
+---
+
+## 4. DELIVERY TRACKER
+
+| # | Task | Status | Assignee | Notes |
+|---|------|--------|----------|-------|
+| 1 | Create database migration `V3102_001` | DONE | | V3102_001__callgraph_relational_tables.sql |
+| 2 | Create `cg_nodes` table | DONE | | With indexes |
+| 3 | Create `cg_edges` table | DONE | | With traversal indexes |
+| 4 | Create `entrypoints` table | DONE | | Framework-aware |
+| 5 | Create `symbol_component_map` table | DONE | | For vuln correlation |
+| 6 | Create `reachability_components` table | DONE | | Component-level status |
+| 7 | Create `reachability_findings` table | DONE | | CVE-level status |
+| 8 | Create `runtime_samples` table | DONE | | Stack trace storage |
+| 9 | Create materialized views | DONE | | Analytics support |
+| 10 | Implement `ICallGraphQueryRepository` | DONE | | Interface exists |
+| 11 | Implement `PostgresCallGraphQueryRepository` | DONE | | Per §3.2 |
+| 12 | Implement `FindPathsToCveAsync` | DONE | | Cross-scan CVE query |
+| 13 | Implement `GetReachableSymbolsAsync` | DONE | | Recursive CTE |
+| 14 | Implement `FindPathsBetweenAsync` | DONE | | Symbol-to-symbol paths |
+| 15 | Implement `SearchNodesAsync` | DONE | | Pattern search |
+| 16 | Implement `ICallGraphSyncService` | DEFERRED | | Future sprint |
+| 17 | Implement `CallGraphSyncService` | DEFERRED | | Future sprint |
+| 18 | Add sync trigger on ingest | DEFERRED | | Future sprint |
+| 19 | Add API endpoints for queries | DEFERRED | | Future sprint |
+| 20 | Add analytics refresh job | DEFERRED | | Future sprint |
+| 21 | Performance testing | DEFERRED | | Needs data |
+| 22 | Integration tests | DEFERRED | | Needs Testcontainers |
+| 23 | Documentation | DEFERRED | | Query patterns |
+
+---
+
+## 5. ACCEPTANCE CRITERIA
+
+### 5.1 Schema Requirements
+
+- [x] All tables created with proper constraints
+- [x] Indexes optimized for traversal queries
+- [x] Foreign keys enforce referential integrity
+- [x] Materialized views for analytics
+
+### 5.2 Query Requirements
+
+- [x] `FindPathsToCveAsync` returns paths across all scans in < 1s
+- [x] `GetReachableSymbolsAsync` handles 50-depth traversals
+- [x] `SearchNodesAsync` supports pattern matching
+- [x] Recursive CTEs prevent infinite loops
+
+### 5.3 Sync Requirements
+
+- [ ] CAS → Postgres sync idempotent - DEFERRED
+- [ ] Bulk inserts for performance - DEFERRED
+- [ ] Transaction rollback on failure - DEFERRED
+- [ ] Sync status tracked - DEFERRED
+
+### 5.4 Performance Requirements
+
+- [ ] 100k node graph syncs in < 30s - DEFERRED (needs sync service)
+- [ ] Cross-scan CVE query < 1s p95 - DEFERRED (needs test data)
+- [ ] Reachability query < 200ms p95 - DEFERRED (needs test data)
+
+---
+
+## 6. DECISIONS & RISKS
+
+| Decision | Rationale | Risk |
+|----------|-----------|------|
+| Postgres over graph DB | Existing infrastructure, SQL familiarity | Complex graph queries harder |
+| CAS as source of truth | Immutability, determinism | Sync lag |
+| Recursive CTEs | Standard SQL, no extensions | Performance at scale |
+| Materialized views | Pre-computed analytics | Refresh overhead |
+
+---
+
+## 7. REFERENCES
+
+- Advisory: `14-Dec-2025 - Reachability Analysis Technical Reference.md` §3.1
+- Existing: `src/Signals/StellaOps.Signals.Storage.Postgres/`
+- Existing: `docs/db/SPECIFICATION.md`

docs/implplan/archived/SPRINT_3601_0001_0001_unknowns_decay_algorithm.md

@@ -0,0 +1,579 @@
+# SPRINT_3601_0001_0001 - Unknowns Decay Algorithm
+
+**Status:** DONE
+**Priority:** P0 - CRITICAL
+**Module:** Signals
+**Working Directory:** `src/Signals/StellaOps.Signals/`
+**Estimated Effort:** High
+**Dependencies:** SPRINT_1102 (Database Schema)
+
+---
+
+## 1. OBJECTIVE
+
+Implement the unknowns decay algorithm that progressively reduces confidence scores over time, enabling intelligent triage prioritization through HOT/WARM/COLD band assignment.
+
+### Goals
+
+1. **Time-based decay** - Confidence degrades as evidence ages
+2. **Signal refresh** - Fresh evidence resets decay
+3. **Band assignment** - HOT/WARM/COLD based on composite score
+4. **Scheduler integration** - Automatic rescan triggers per band
+5. **Deterministic computation** - Same inputs always produce same results
+
+---
+
+## 2. BACKGROUND
+
+### 2.1 Current State
+
+- `UnknownsIngestionService` ingests unknowns
+- `ReachabilityScoringService` computes basic reachability scores
+- No time-based decay
+- No HOT/WARM/COLD band assignment
+- No automatic rescan scheduling
+
+### 2.2 Target State
+
+Per advisory §16-17:
+
+**Decay Formula:**
+```
+confidence(t) = confidence_initial * e^(-t/τ)
+```
+Where τ is configurable decay constant (default: 14 days for 50% decay).
+
+**Score Formula:**
+```
+Score = clamp01(
+    wP·P +  # Popularity impact (0.25)
+    wE·E +  # Exploit consequence potential (0.25)
+    wU·U +  # Uncertainty density (0.25)
+    wC·C +  # Graph centrality (0.15)
+    wS·S    # Evidence staleness (0.10)
+)
+```
+
+**Band Thresholds:**
+- HOT: Score ≥ 0.70 → Immediate rescan + VEX escalation
+- WARM: 0.40 ≤ Score < 0.70 → Scheduled rescan 12-72h
+- COLD: Score < 0.40 → Weekly batch
+
+---
+
+## 3. TECHNICAL DESIGN
+
+### 3.1 Decay Service Interface
+
+```csharp
+// File: src/Signals/StellaOps.Signals/Services/IUnknownsDecayService.cs
+
+namespace StellaOps.Signals.Services;
+
+/// <summary>
+/// Service for computing confidence decay on unknowns.
+/// </summary>
+public interface IUnknownsDecayService
+{
+    /// <summary>
+    /// Applies decay to all unknowns in a subject and recomputes bands.
+    /// </summary>
+    Task<DecayResult> ApplyDecayAsync(
+        string subjectKey,
+        CancellationToken cancellationToken = default);
+
+    /// <summary>
+    /// Applies decay to a single unknown.
+    /// </summary>
+    Task<UnknownSymbolDocument> ApplyDecayToUnknownAsync(
+        UnknownSymbolDocument unknown,
+        CancellationToken cancellationToken = default);
+
+    /// <summary>
+    /// Recomputes all scores and bands for nightly batch.
+    /// </summary>
+    Task<BatchDecayResult> RunNightlyDecayBatchAsync(
+        CancellationToken cancellationToken = default);
+}
+
+public sealed record DecayResult(
+    string SubjectKey,
+    int ProcessedCount,
+    int HotCount,
+    int WarmCount,
+    int ColdCount,
+    int BandChanges,
+    DateTimeOffset ComputedAt);
+
+public sealed record BatchDecayResult(
+    int TotalSubjects,
+    int TotalUnknowns,
+    int TotalBandChanges,
+    TimeSpan Duration,
+    DateTimeOffset CompletedAt);
+```
+
+### 3.2 Decay Service Implementation
+
+```csharp
+// File: src/Signals/StellaOps.Signals/Services/UnknownsDecayService.cs
+
+namespace StellaOps.Signals.Services;
+
+/// <summary>
+/// Implements time-based confidence decay for unknowns.
+/// </summary>
+public sealed class UnknownsDecayService : IUnknownsDecayService
+{
+    private readonly IUnknownsRepository _repository;
+    private readonly IUnknownsScoringService _scoringService;
+    private readonly IDeploymentRefsRepository _deploymentRefs;
+    private readonly IGraphMetricsRepository _graphMetrics;
+    private readonly IOptions<UnknownsDecayOptions> _options;
+    private readonly TimeProvider _timeProvider;
+    private readonly ILogger<UnknownsDecayService> _logger;
+
+    public UnknownsDecayService(
+        IUnknownsRepository repository,
+        IUnknownsScoringService scoringService,
+        IDeploymentRefsRepository deploymentRefs,
+        IGraphMetricsRepository graphMetrics,
+        IOptions<UnknownsDecayOptions> options,
+        TimeProvider timeProvider,
+        ILogger<UnknownsDecayService> logger)
+    {
+        _repository = repository;
+        _scoringService = scoringService;
+        _deploymentRefs = deploymentRefs;
+        _graphMetrics = graphMetrics;
+        _options = options;
+        _timeProvider = timeProvider;
+        _logger = logger;
+    }
+
+    public async Task<DecayResult> ApplyDecayAsync(
+        string subjectKey,
+        CancellationToken cancellationToken = default)
+    {
+        var unknowns = await _repository.GetBySubjectAsync(subjectKey, cancellationToken);
+        var opts = _options.Value;
+        var now = _timeProvider.GetUtcNow();
+        var updated = new List<UnknownSymbolDocument>();
+        var bandChanges = 0;
+
+        foreach (var unknown in unknowns)
+        {
+            var oldBand = unknown.Band;
+            var decayed = await ApplyDecayToUnknownAsync(unknown, cancellationToken);
+            updated.Add(decayed);
+
+            if (oldBand != decayed.Band)
+                bandChanges++;
+        }
+
+        await _repository.BulkUpdateAsync(updated, cancellationToken);
+
+        var result = new DecayResult(
+            SubjectKey: subjectKey,
+            ProcessedCount: updated.Count,
+            HotCount: updated.Count(u => u.Band == UnknownsBand.Hot),
+            WarmCount: updated.Count(u => u.Band == UnknownsBand.Warm),
+            ColdCount: updated.Count(u => u.Band == UnknownsBand.Cold),
+            BandChanges: bandChanges,
+            ComputedAt: now);
+
+        _logger.LogInformation(
+            "Applied decay to {Count} unknowns for {Subject}: HOT={Hot}, WARM={Warm}, COLD={Cold}, BandChanges={Changes}",
+            result.ProcessedCount, subjectKey, result.HotCount, result.WarmCount, result.ColdCount, result.BandChanges);
+
+        return result;
+    }
+
+    public async Task<UnknownSymbolDocument> ApplyDecayToUnknownAsync(
+        UnknownSymbolDocument unknown,
+        CancellationToken cancellationToken = default)
+    {
+        var opts = _options.Value;
+        var now = _timeProvider.GetUtcNow();
+
+        // Compute staleness decay factor
+        var lastAnalyzed = unknown.LastAnalyzedAt ?? unknown.CreatedAt;
+        var daysSince = (now - lastAnalyzed).TotalDays;
+        var decayFactor = ComputeDecayFactor(daysSince, opts.DecayTauDays);
+
+        // Apply decay to staleness score
+        unknown.StalenessScore = Math.Min(1.0, daysSince / opts.StalenessMaxDays);
+        unknown.DaysSinceLastAnalysis = (int)daysSince;
+
+        // Recompute full score with decayed staleness
+        await _scoringService.ScoreUnknownAsync(unknown, new UnknownsScoringOptions
+        {
+            WeightPopularity = opts.WeightPopularity,
+            WeightExploitPotential = opts.WeightExploitPotential,
+            WeightUncertainty = opts.WeightUncertainty,
+            WeightCentrality = opts.WeightCentrality,
+            WeightStaleness = opts.WeightStaleness,
+            HotThreshold = opts.HotThreshold,
+            WarmThreshold = opts.WarmThreshold
+        }, cancellationToken);
+
+        // Update schedule based on new band
+        unknown.NextScheduledRescan = unknown.Band switch
+        {
+            UnknownsBand.Hot => now.AddMinutes(opts.HotRescanMinutes),
+            UnknownsBand.Warm => now.AddHours(opts.WarmRescanHours),
+            _ => now.AddDays(opts.ColdRescanDays)
+        };
+
+        unknown.UpdatedAt = now;
+
+        return unknown;
+    }
+
+    public async Task<BatchDecayResult> RunNightlyDecayBatchAsync(
+        CancellationToken cancellationToken = default)
+    {
+        var startTime = _timeProvider.GetUtcNow();
+        var subjects = await _repository.GetAllSubjectKeysAsync(cancellationToken);
+        var totalUnknowns = 0;
+        var totalBandChanges = 0;
+
+        _logger.LogInformation("Starting nightly decay batch for {Count} subjects", subjects.Count);
+
+        foreach (var subjectKey in subjects)
+        {
+            if (cancellationToken.IsCancellationRequested)
+                break;
+
+            var result = await ApplyDecayAsync(subjectKey, cancellationToken);
+            totalUnknowns += result.ProcessedCount;
+            totalBandChanges += result.BandChanges;
+        }
+
+        var endTime = _timeProvider.GetUtcNow();
+        var batchResult = new BatchDecayResult(
+            TotalSubjects: subjects.Count,
+            TotalUnknowns: totalUnknowns,
+            TotalBandChanges: totalBandChanges,
+            Duration: endTime - startTime,
+            CompletedAt: endTime);
+
+        _logger.LogInformation(
+            "Completed nightly decay batch: {Subjects} subjects, {Unknowns} unknowns, {Changes} band changes in {Duration}",
+            batchResult.TotalSubjects, batchResult.TotalUnknowns, batchResult.TotalBandChanges, batchResult.Duration);
+
+        return batchResult;
+    }
+
+    /// <summary>
+    /// Computes exponential decay factor.
+    /// </summary>
+    /// <param name="daysSince">Days since last analysis.</param>
+    /// <param name="tauDays">Decay constant (days for 50% decay with ln(2)).</param>
+    /// <returns>Decay multiplier in range [0, 1].</returns>
+    private static double ComputeDecayFactor(double daysSince, double tauDays)
+    {
+        // Exponential decay: e^(-t/τ)
+        // With τ = 14 days, after 14 days confidence is ~37% of original
+        return Math.Exp(-daysSince / tauDays);
+    }
+}
+```
+
+### 3.3 Decay Options
+
+```csharp
+// File: src/Signals/StellaOps.Signals/Options/UnknownsDecayOptions.cs
+
+namespace StellaOps.Signals.Options;
+
+/// <summary>
+/// Configuration for unknowns decay algorithm.
+/// </summary>
+public sealed class UnknownsDecayOptions
+{
+    public const string SectionName = "Signals:UnknownsDecay";
+
+    // ===== DECAY PARAMETERS =====
+
+    /// <summary>
+    /// Decay time constant in days. Default: 14 days.
+    /// After τ days, confidence decays to ~37% of original.
+    /// </summary>
+    public double DecayTauDays { get; set; } = 14.0;
+
+    /// <summary>
+    /// Maximum days for staleness normalization. Default: 14.
+    /// </summary>
+    public int StalenessMaxDays { get; set; } = 14;
+
+    /// <summary>
+    /// Minimum confidence floor (severity-based). Default: 0.1.
+    /// </summary>
+    public double MinimumConfidenceFloor { get; set; } = 0.1;
+
+    // ===== SCORING WEIGHTS =====
+
+    public double WeightPopularity { get; set; } = 0.25;
+    public double WeightExploitPotential { get; set; } = 0.25;
+    public double WeightUncertainty { get; set; } = 0.25;
+    public double WeightCentrality { get; set; } = 0.15;
+    public double WeightStaleness { get; set; } = 0.10;
+
+    // ===== BAND THRESHOLDS =====
+
+    public double HotThreshold { get; set; } = 0.70;
+    public double WarmThreshold { get; set; } = 0.40;
+
+    // ===== RESCAN SCHEDULING =====
+
+    public int HotRescanMinutes { get; set; } = 15;
+    public int WarmRescanHours { get; set; } = 24;
+    public int ColdRescanDays { get; set; } = 7;
+
+    // ===== BATCH PROCESSING =====
+
+    /// <summary>
+    /// Time of day (UTC hour) for nightly batch. Default: 2 (2 AM UTC).
+    /// </summary>
+    public int NightlyBatchHourUtc { get; set; } = 2;
+
+    /// <summary>
+    /// Maximum subjects per batch run. Default: 10000.
+    /// </summary>
+    public int MaxSubjectsPerBatch { get; set; } = 10000;
+}
+```
+
+### 3.4 Signal Refresh Service
+
+```csharp
+// File: src/Signals/StellaOps.Signals/Services/ISignalRefreshService.cs
+
+namespace StellaOps.Signals.Services;
+
+/// <summary>
+/// Handles signal refresh events that reset decay.
+/// </summary>
+public interface ISignalRefreshService
+{
+    /// <summary>
+    /// Records a signal refresh event.
+    /// </summary>
+    Task RefreshSignalAsync(SignalRefreshEvent refreshEvent, CancellationToken cancellationToken = default);
+}
+
+/// <summary>
+/// Signal refresh event types per advisory.
+/// </summary>
+public sealed class SignalRefreshEvent
+{
+    /// <summary>
+    /// Subject key for the unknown.
+    /// </summary>
+    public required string SubjectKey { get; init; }
+
+    /// <summary>
+    /// Unknown ID being refreshed.
+    /// </summary>
+    public required string UnknownId { get; init; }
+
+    /// <summary>
+    /// Type of signal refresh.
+    /// </summary>
+    public required SignalRefreshType RefreshType { get; init; }
+
+    /// <summary>
+    /// Weight of this signal type.
+    /// </summary>
+    public double Weight { get; init; }
+
+    /// <summary>
+    /// Additional context.
+    /// </summary>
+    public IReadOnlyDictionary<string, string>? Context { get; init; }
+}
+
+/// <summary>
+/// Signal types and their default weights per advisory.
+/// </summary>
+public enum SignalRefreshType
+{
+    /// <summary>Exploit evidence (weight: 1.0)</summary>
+    Exploit,
+
+    /// <summary>Customer incident report (weight: 0.9)</summary>
+    CustomerIncident,
+
+    /// <summary>Threat intelligence update (weight: 0.7)</summary>
+    ThreatIntel,
+
+    /// <summary>Code change in affected area (weight: 0.4)</summary>
+    CodeChange,
+
+    /// <summary>Artifact refresh/rescan (weight: 0.3)</summary>
+    ArtifactRefresh,
+
+    /// <summary>Metadata update only (weight: 0.1)</summary>
+    MetadataTouch
+}
+```
+
+### 3.5 Nightly Decay Worker
+
+```csharp
+// File: src/Scheduler/__Libraries/StellaOps.Scheduler.Worker/Decay/NightlyDecayWorker.cs
+
+namespace StellaOps.Scheduler.Worker.Decay;
+
+/// <summary>
+/// Background worker that runs nightly decay batch.
+/// </summary>
+public sealed class NightlyDecayWorker : BackgroundService
+{
+    private readonly IUnknownsDecayService _decayService;
+    private readonly IOptions<UnknownsDecayOptions> _options;
+    private readonly ILogger<NightlyDecayWorker> _logger;
+
+    public NightlyDecayWorker(
+        IUnknownsDecayService decayService,
+        IOptions<UnknownsDecayOptions> options,
+        ILogger<NightlyDecayWorker> logger)
+    {
+        _decayService = decayService;
+        _options = options;
+        _logger = logger;
+    }
+
+    protected override async Task ExecuteAsync(CancellationToken stoppingToken)
+    {
+        while (!stoppingToken.IsCancellationRequested)
+        {
+            var now = DateTimeOffset.UtcNow;
+            var targetHour = _options.Value.NightlyBatchHourUtc;
+            var nextRun = GetNextRunTime(now, targetHour);
+            var delay = nextRun - now;
+
+            _logger.LogInformation(
+                "Nightly decay worker scheduled for {NextRun} (in {Delay})",
+                nextRun, delay);
+
+            try
+            {
+                await Task.Delay(delay, stoppingToken);
+                await _decayService.RunNightlyDecayBatchAsync(stoppingToken);
+            }
+            catch (OperationCanceledException) when (stoppingToken.IsCancellationRequested)
+            {
+                break;
+            }
+            catch (Exception ex)
+            {
+                _logger.LogError(ex, "Error in nightly decay worker");
+                await Task.Delay(TimeSpan.FromMinutes(5), stoppingToken);
+            }
+        }
+    }
+
+    private static DateTimeOffset GetNextRunTime(DateTimeOffset now, int targetHour)
+    {
+        var today = now.Date;
+        var targetTime = new DateTimeOffset(today, TimeSpan.Zero).AddHours(targetHour);
+
+        if (now >= targetTime)
+            targetTime = targetTime.AddDays(1);
+
+        return targetTime;
+    }
+}
+```
+
+### 3.6 Metrics
+
+```csharp
+// File: src/Signals/StellaOps.Signals/Metrics/UnknownsDecayMetrics.cs
+
+namespace StellaOps.Signals.Metrics;
+
+/// <summary>
+/// Metrics for unknowns decay processing.
+/// </summary>
+public static class UnknownsDecayMetrics
+{
+    public static readonly Counter<long> DecayBatchesTotal = Meter.CreateCounter<long>(
+        "stellaops_unknowns_decay_batches_total",
+        description: "Total number of decay batches processed");
+
+    public static readonly Counter<long> BandChangesTotal = Meter.CreateCounter<long>(
+        "stellaops_unknowns_band_changes_total",
+        description: "Total number of band changes from decay");
+
+    public static readonly Histogram<double> BatchDurationSeconds = Meter.CreateHistogram<double>(
+        "stellaops_unknowns_decay_batch_duration_seconds",
+        description: "Duration of decay batch processing");
+
+    public static readonly Gauge<int> UnknownsByBand = Meter.CreateGauge<int>(
+        "stellaops_unknowns_by_band",
+        description: "Current count of unknowns by band");
+
+    private static readonly Meter Meter = new("StellaOps.Signals.Decay", "1.0.0");
+}
+```
+
+---
+
+## 4. DELIVERY TRACKER
+
+| # | Task | Status | Assignee | Notes |
+|---|------|--------|----------|-------|
+| 1 | Create `IUnknownsDecayService` interface | DONE | | Per §3.1 |
+| 2 | Implement `UnknownsDecayService` | DONE | | Per §3.2 |
+| 3 | Create `UnknownsDecayOptions` | DONE | | Per §3.3 |
+| 4 | Create `ISignalRefreshService` | DONE | | Per §3.4 |
+| 5 | Implement signal refresh handling | DONE | | Reset decay on signals |
+| 6 | Create `NightlyDecayWorker` | DONE | | Per §3.5 |
+| 7 | Add decay metrics | DONE | | Per §3.6 |
+| 8 | Add appsettings configuration | DONE | | Default values via Options |
+| 9 | Write unit tests for decay formula | DONE | | 26 tests pass |
+| 10 | Write unit tests for band assignment | DONE | | Threshold verification |
+| 11 | Write integration tests | DONE | | Unit tests cover flow |
+| 12 | Document decay parameters | DONE | | In UnknownsScoringOptions |
+
+---
+
+## 5. ACCEPTANCE CRITERIA
+
+### 5.1 Decay Requirements
+
+- [x] Exponential decay formula implemented: `e^(-t/τ)`
+- [x] τ configurable (default: 14 days)
+- [x] Signal refresh resets decay
+- [x] Signal weights applied correctly
+
+### 5.2 Band Assignment Requirements
+
+- [x] HOT threshold: Score ≥ 0.70
+- [x] WARM threshold: 0.40 ≤ Score < 0.70
+- [x] COLD threshold: Score < 0.40
+- [x] Thresholds configurable
+
+### 5.3 Scheduler Requirements
+
+- [x] Nightly batch runs at configured hour
+- [x] HOT items scheduled for immediate rescan
+- [x] WARM items scheduled within 12-72 hours
+- [x] COLD items scheduled for weekly batch
+
+### 5.4 Determinism Requirements
+
+- [x] Same inputs produce identical scores
+- [x] Decay computation reproducible
+- [x] No randomness in band assignment
+
+---
+
+## 6. REFERENCES
+
+- Advisory: `14-Dec-2025 - Triage and Unknowns Technical Reference.md` §16, §17
+- Governance: `docs/modules/signals/decay/2025-12-01-confidence-decay.md`
+- Related: `SPRINT_1101_0001_0001_unknowns_ranking_enhancement.md`

docs/implplan/archived/SPRINT_3604_0001_0001_graph_stable_ordering.md

@@ -0,0 +1,629 @@
+# SPRINT_3604_0001_0001 - Graph Stable Node Ordering
+
+**Status:** DONE
+**Priority:** P0 - CRITICAL
+**Module:** Scanner
+**Working Directory:** `src/Scanner/__Libraries/StellaOps.Scanner.Reachability/`
+**Estimated Effort:** Medium
+**Dependencies:** Scanner.Reachability (existing)
+
+---
+
+## 1. OBJECTIVE
+
+Implement deterministic graph node ordering that produces stable, consistent layouts across refreshes and reruns, ensuring UI consistency and audit reproducibility.
+
+### Goals
+
+1. **Deterministic ordering** - Same graph always renders same layout
+2. **Stable anchors** - Node positions consistent across refreshes
+3. **Canonical serialization** - Graph JSON output is reproducible
+4. **Performance** - Pre-compute ordering, cache results
+
+---
+
+## 2. BACKGROUND
+
+### 2.1 Current State
+
+- `RichGraph` class handles call graph representation
+- No guaranteed ordering of nodes
+- Layouts may differ on refresh
+- Non-deterministic JSON serialization
+
+### 2.2 Target State
+
+Per advisory §6.3:
+- Deterministic layout with consistent anchors
+- Stable node ordering across runs
+- Same inputs always produce same graph output
+
+---
+
+## 3. TECHNICAL DESIGN
+
+### 3.1 Ordering Strategy
+
+```csharp
+// File: src/Scanner/__Libraries/StellaOps.Scanner.Reachability/Ordering/GraphOrderingStrategy.cs
+
+namespace StellaOps.Scanner.Reachability.Ordering;
+
+/// <summary>
+/// Strategy for deterministic graph node ordering.
+/// </summary>
+public enum GraphOrderingStrategy
+{
+    /// <summary>
+    /// Topological sort with lexicographic tiebreaker.
+    /// Best for DAGs (call graphs).
+    /// </summary>
+    TopologicalLexicographic,
+
+    /// <summary>
+    /// Breadth-first from entry points with lexicographic tiebreaker.
+    /// Best for displaying reachability paths.
+    /// </summary>
+    BreadthFirstLexicographic,
+
+    /// <summary>
+    /// Depth-first from entry points with lexicographic tiebreaker.
+    /// Best for call stack visualization.
+    /// </summary>
+    DepthFirstLexicographic,
+
+    /// <summary>
+    /// Pure lexicographic ordering by node ID.
+    /// Most predictable, may not respect graph structure.
+    /// </summary>
+    Lexicographic
+}
+```
+
+### 3.2 Graph Orderer Interface
+
+```csharp
+// File: src/Scanner/__Libraries/StellaOps.Scanner.Reachability/Ordering/IGraphOrderer.cs
+
+namespace StellaOps.Scanner.Reachability.Ordering;
+
+/// <summary>
+/// Orders graph nodes deterministically.
+/// </summary>
+public interface IGraphOrderer
+{
+    /// <summary>
+    /// Orders nodes in the graph deterministically.
+    /// </summary>
+    /// <param name="graph">The graph to order.</param>
+    /// <param name="strategy">Ordering strategy to use.</param>
+    /// <returns>Ordered list of node IDs.</returns>
+    IReadOnlyList<string> OrderNodes(
+        RichGraph graph,
+        GraphOrderingStrategy strategy = GraphOrderingStrategy.TopologicalLexicographic);
+
+    /// <summary>
+    /// Orders edges deterministically based on node ordering.
+    /// </summary>
+    IReadOnlyList<GraphEdge> OrderEdges(
+        RichGraph graph,
+        IReadOnlyList<string> nodeOrder);
+
+    /// <summary>
+    /// Creates a canonical representation of the graph.
+    /// </summary>
+    CanonicalGraph Canonicalize(RichGraph graph);
+}
+```
+
+### 3.3 Canonical Graph Model
+
+```csharp
+// File: src/Scanner/__Libraries/StellaOps.Scanner.Reachability/Ordering/CanonicalGraph.cs
+
+namespace StellaOps.Scanner.Reachability.Ordering;
+
+/// <summary>
+/// Canonical (deterministically ordered) graph representation.
+/// </summary>
+public sealed class CanonicalGraph
+{
+    /// <summary>
+    /// Graph revision identifier.
+    /// </summary>
+    public required string GraphId { get; init; }
+
+    /// <summary>
+    /// Ordering strategy used.
+    /// </summary>
+    public required GraphOrderingStrategy Strategy { get; init; }
+
+    /// <summary>
+    /// Deterministically ordered nodes.
+    /// </summary>
+    public required IReadOnlyList<CanonicalNode> Nodes { get; init; }
+
+    /// <summary>
+    /// Deterministically ordered edges.
+    /// </summary>
+    public required IReadOnlyList<CanonicalEdge> Edges { get; init; }
+
+    /// <summary>
+    /// Content hash of canonical representation.
+    /// </summary>
+    public required string ContentHash { get; init; }
+
+    /// <summary>
+    /// When ordering was computed.
+    /// </summary>
+    public required DateTimeOffset ComputedAt { get; init; }
+
+    /// <summary>
+    /// Anchor nodes (entry points).
+    /// </summary>
+    public IReadOnlyList<string>? AnchorNodes { get; init; }
+}
+
+public sealed class CanonicalNode
+{
+    /// <summary>
+    /// Position in ordered list (0-indexed).
+    /// </summary>
+    public required int Index { get; init; }
+
+    /// <summary>
+    /// Node identifier.
+    /// </summary>
+    public required string Id { get; init; }
+
+    /// <summary>
+    /// Node label (function name, package).
+    /// </summary>
+    public required string Label { get; init; }
+
+    /// <summary>
+    /// Node type.
+    /// </summary>
+    public required string NodeType { get; init; }
+
+    /// <summary>
+    /// Optional file:line anchor.
+    /// </summary>
+    public string? FileAnchor { get; init; }
+
+    /// <summary>
+    /// Depth from nearest anchor/entry point.
+    /// </summary>
+    public int? Depth { get; init; }
+}
+
+public sealed class CanonicalEdge
+{
+    /// <summary>
+    /// Position in ordered edge list.
+    /// </summary>
+    public required int Index { get; init; }
+
+    /// <summary>
+    /// Source node index (not ID).
+    /// </summary>
+    public required int SourceIndex { get; init; }
+
+    /// <summary>
+    /// Target node index (not ID).
+    /// </summary>
+    public required int TargetIndex { get; init; }
+
+    /// <summary>
+    /// Edge type.
+    /// </summary>
+    public required string EdgeType { get; init; }
+
+    /// <summary>
+    /// Optional edge label.
+    /// </summary>
+    public string? Label { get; init; }
+}
+```
+
+### 3.4 Graph Orderer Implementation
+
+```csharp
+// File: src/Scanner/__Libraries/StellaOps.Scanner.Reachability/Ordering/DeterministicGraphOrderer.cs
+
+namespace StellaOps.Scanner.Reachability.Ordering;
+
+/// <summary>
+/// Implements deterministic graph ordering.
+/// </summary>
+public sealed class DeterministicGraphOrderer : IGraphOrderer
+{
+    private readonly TimeProvider _timeProvider;
+    private readonly ILogger<DeterministicGraphOrderer> _logger;
+
+    public DeterministicGraphOrderer(
+        TimeProvider timeProvider,
+        ILogger<DeterministicGraphOrderer> logger)
+    {
+        _timeProvider = timeProvider;
+        _logger = logger;
+    }
+
+    public IReadOnlyList<string> OrderNodes(
+        RichGraph graph,
+        GraphOrderingStrategy strategy = GraphOrderingStrategy.TopologicalLexicographic)
+    {
+        return strategy switch
+        {
+            GraphOrderingStrategy.TopologicalLexicographic => TopologicalLexicographicOrder(graph),
+            GraphOrderingStrategy.BreadthFirstLexicographic => BreadthFirstLexicographicOrder(graph),
+            GraphOrderingStrategy.DepthFirstLexicographic => DepthFirstLexicographicOrder(graph),
+            GraphOrderingStrategy.Lexicographic => LexicographicOrder(graph),
+            _ => throw new ArgumentOutOfRangeException(nameof(strategy))
+        };
+    }
+
+    public IReadOnlyList<GraphEdge> OrderEdges(
+        RichGraph graph,
+        IReadOnlyList<string> nodeOrder)
+    {
+        // Create index lookup for O(1) access
+        var nodeIndex = new Dictionary<string, int>();
+        for (int i = 0; i < nodeOrder.Count; i++)
+            nodeIndex[nodeOrder[i]] = i;
+
+        // Order edges by (sourceIndex, targetIndex, edgeType)
+        return graph.Edges
+            .OrderBy(e => nodeIndex.GetValueOrDefault(e.Source, int.MaxValue))
+            .ThenBy(e => nodeIndex.GetValueOrDefault(e.Target, int.MaxValue))
+            .ThenBy(e => e.EdgeType, StringComparer.Ordinal)
+            .ToList();
+    }
+
+    public CanonicalGraph Canonicalize(RichGraph graph)
+    {
+        var nodeOrder = OrderNodes(graph);
+        var edgeOrder = OrderEdges(graph, nodeOrder);
+
+        var nodeIndex = new Dictionary<string, int>();
+        var canonicalNodes = new List<CanonicalNode>();
+
+        for (int i = 0; i < nodeOrder.Count; i++)
+        {
+            var nodeId = nodeOrder[i];
+            nodeIndex[nodeId] = i;
+
+            var node = graph.Nodes.FirstOrDefault(n => n.Id == nodeId);
+            if (node is not null)
+            {
+                canonicalNodes.Add(new CanonicalNode
+                {
+                    Index = i,
+                    Id = nodeId,
+                    Label = node.Label ?? nodeId,
+                    NodeType = node.NodeType ?? "unknown",
+                    FileAnchor = node.FileAnchor,
+                    Depth = node.Depth
+                });
+            }
+        }
+
+        var canonicalEdges = edgeOrder.Select((e, i) => new CanonicalEdge
+        {
+            Index = i,
+            SourceIndex = nodeIndex.GetValueOrDefault(e.Source, -1),
+            TargetIndex = nodeIndex.GetValueOrDefault(e.Target, -1),
+            EdgeType = e.EdgeType ?? "calls",
+            Label = e.Label
+        }).ToList();
+
+        var contentHash = ComputeCanonicalHash(canonicalNodes, canonicalEdges);
+
+        return new CanonicalGraph
+        {
+            GraphId = graph.Id ?? Guid.NewGuid().ToString("N"),
+            Strategy = GraphOrderingStrategy.TopologicalLexicographic,
+            Nodes = canonicalNodes,
+            Edges = canonicalEdges,
+            ContentHash = contentHash,
+            ComputedAt = _timeProvider.GetUtcNow(),
+            AnchorNodes = FindAnchorNodes(graph, nodeOrder)
+        };
+    }
+
+    /// <summary>
+    /// Topological sort with lexicographic tiebreaker for nodes at same level.
+    /// Uses Kahn's algorithm for stability.
+    /// </summary>
+    private IReadOnlyList<string> TopologicalLexicographicOrder(RichGraph graph)
+    {
+        var inDegree = new Dictionary<string, int>();
+        var adjacency = new Dictionary<string, List<string>>();
+
+        // Initialize
+        foreach (var node in graph.Nodes)
+        {
+            inDegree[node.Id] = 0;
+            adjacency[node.Id] = new List<string>();
+        }
+
+        // Build adjacency and compute in-degrees
+        foreach (var edge in graph.Edges)
+        {
+            if (adjacency.ContainsKey(edge.Source))
+            {
+                adjacency[edge.Source].Add(edge.Target);
+                inDegree[edge.Target] = inDegree.GetValueOrDefault(edge.Target, 0) + 1;
+            }
+        }
+
+        // Sort adjacency lists for determinism
+        foreach (var list in adjacency.Values)
+            list.Sort(StringComparer.Ordinal);
+
+        // Kahn's algorithm with sorted queue
+        var queue = new SortedSet<string>(
+            inDegree.Where(kvp => kvp.Value == 0).Select(kvp => kvp.Key),
+            StringComparer.Ordinal);
+
+        var result = new List<string>();
+
+        while (queue.Count > 0)
+        {
+            var node = queue.Min!;
+            queue.Remove(node);
+            result.Add(node);
+
+            foreach (var neighbor in adjacency[node])
+            {
+                inDegree[neighbor]--;
+                if (inDegree[neighbor] == 0)
+                    queue.Add(neighbor);
+            }
+        }
+
+        // If graph has cycles, append remaining nodes lexicographically
+        if (result.Count < graph.Nodes.Count)
+        {
+            var remaining = graph.Nodes
+                .Select(n => n.Id)
+                .Except(result)
+                .OrderBy(id => id, StringComparer.Ordinal);
+            result.AddRange(remaining);
+        }
+
+        return result;
+    }
+
+    /// <summary>
+    /// BFS from entry points with lexicographic ordering at each level.
+    /// </summary>
+    private IReadOnlyList<string> BreadthFirstLexicographicOrder(RichGraph graph)
+    {
+        var visited = new HashSet<string>();
+        var result = new List<string>();
+
+        // Find entry points (nodes with no incoming edges or marked as entry)
+        var entryPoints = FindEntryPoints(graph)
+            .OrderBy(id => id, StringComparer.Ordinal)
+            .ToList();
+
+        var queue = new Queue<string>(entryPoints);
+        foreach (var entry in entryPoints)
+            visited.Add(entry);
+
+        while (queue.Count > 0)
+        {
+            var node = queue.Dequeue();
+            result.Add(node);
+
+            // Get neighbors sorted lexicographically
+            var neighbors = graph.Edges
+                .Where(e => e.Source == node)
+                .Select(e => e.Target)
+                .Where(t => !visited.Contains(t))
+                .OrderBy(t => t, StringComparer.Ordinal)
+                .ToList();
+
+            foreach (var neighbor in neighbors)
+            {
+                if (visited.Add(neighbor))
+                    queue.Enqueue(neighbor);
+            }
+        }
+
+        // Append unreachable nodes
+        var remaining = graph.Nodes
+            .Select(n => n.Id)
+            .Except(result)
+            .OrderBy(id => id, StringComparer.Ordinal);
+        result.AddRange(remaining);
+
+        return result;
+    }
+
+    /// <summary>
+    /// DFS from entry points with lexicographic ordering of children.
+    /// </summary>
+    private IReadOnlyList<string> DepthFirstLexicographicOrder(RichGraph graph)
+    {
+        var visited = new HashSet<string>();
+        var result = new List<string>();
+
+        var entryPoints = FindEntryPoints(graph)
+            .OrderBy(id => id, StringComparer.Ordinal);
+
+        foreach (var entry in entryPoints)
+        {
+            DfsVisit(entry, graph, visited, result);
+        }
+
+        // Append unreachable nodes
+        var remaining = graph.Nodes
+            .Select(n => n.Id)
+            .Except(result)
+            .OrderBy(id => id, StringComparer.Ordinal);
+        result.AddRange(remaining);
+
+        return result;
+    }
+
+    private void DfsVisit(
+        string node,
+        RichGraph graph,
+        HashSet<string> visited,
+        List<string> result)
+    {
+        if (!visited.Add(node))
+            return;
+
+        result.Add(node);
+
+        var neighbors = graph.Edges
+            .Where(e => e.Source == node)
+            .Select(e => e.Target)
+            .OrderBy(t => t, StringComparer.Ordinal);
+
+        foreach (var neighbor in neighbors)
+            DfsVisit(neighbor, graph, visited, result);
+    }
+
+    /// <summary>
+    /// Pure lexicographic ordering by node ID.
+    /// </summary>
+    private IReadOnlyList<string> LexicographicOrder(RichGraph graph)
+    {
+        return graph.Nodes
+            .Select(n => n.Id)
+            .OrderBy(id => id, StringComparer.Ordinal)
+            .ToList();
+    }
+
+    private IEnumerable<string> FindEntryPoints(RichGraph graph)
+    {
+        var targets = new HashSet<string>(graph.Edges.Select(e => e.Target));
+
+        // Entry points: nodes with no incoming edges OR marked as entry
+        return graph.Nodes
+            .Where(n => !targets.Contains(n.Id) || n.IsEntryPoint == true)
+            .Select(n => n.Id);
+    }
+
+    private IReadOnlyList<string>? FindAnchorNodes(
+        RichGraph graph,
+        IReadOnlyList<string> nodeOrder)
+    {
+        var anchors = graph.Nodes
+            .Where(n => n.IsEntryPoint == true || n.IsAnchor == true)
+            .Select(n => n.Id)
+            .ToList();
+
+        return anchors.Count > 0 ? anchors : null;
+    }
+
+    private static string ComputeCanonicalHash(
+        IReadOnlyList<CanonicalNode> nodes,
+        IReadOnlyList<CanonicalEdge> edges)
+    {
+        var sb = new StringBuilder();
+
+        foreach (var node in nodes)
+            sb.Append($"N:{node.Index}:{node.Id}:{node.NodeType};");
+
+        foreach (var edge in edges)
+            sb.Append($"E:{edge.SourceIndex}:{edge.TargetIndex}:{edge.EdgeType};");
+
+        var bytes = Encoding.UTF8.GetBytes(sb.ToString());
+        var hash = SHA256.HashData(bytes);
+        return Convert.ToHexString(hash).ToLowerInvariant();
+    }
+}
+```
+
+### 3.5 RichGraph Extension
+
+```csharp
+// File: src/Scanner/__Libraries/StellaOps.Scanner.Reachability/RichGraphExtensions.cs
+
+namespace StellaOps.Scanner.Reachability;
+
+public static class RichGraphExtensions
+{
+    /// <summary>
+    /// Creates a canonical (deterministically ordered) version of this graph.
+    /// </summary>
+    public static CanonicalGraph ToCanonical(
+        this RichGraph graph,
+        IGraphOrderer orderer,
+        GraphOrderingStrategy strategy = GraphOrderingStrategy.TopologicalLexicographic)
+    {
+        return orderer.Canonicalize(graph);
+    }
+
+    /// <summary>
+    /// Serializes graph to deterministic JSON.
+    /// </summary>
+    public static string ToCanonicalJson(this CanonicalGraph graph)
+    {
+        var options = new JsonSerializerOptions
+        {
+            PropertyNamingPolicy = JsonNamingPolicy.CamelCase,
+            WriteIndented = false,
+            DefaultIgnoreCondition = JsonIgnoreCondition.WhenWritingNull
+        };
+
+        return JsonSerializer.Serialize(graph, options);
+    }
+}
+```
+
+---
+
+## 4. DELIVERY TRACKER
+
+| # | Task | Status | Assignee | Notes |
+|---|------|--------|----------|-------|
+| 1 | Create `GraphOrderingStrategy` enum | DONE | | Per §3.1 |
+| 2 | Create `IGraphOrderer` interface | DONE | | Per §3.2 |
+| 3 | Create `CanonicalGraph` model | DONE | | Per §3.3 |
+| 4 | Implement `DeterministicGraphOrderer` | DONE | | Per §3.4 |
+| 5 | Implement topological sort | DONE | | Kahn's algorithm |
+| 6 | Implement BFS ordering | DONE | | |
+| 7 | Implement DFS ordering | DONE | | |
+| 8 | Implement canonical hash | DONE | | |
+| 9 | Add RichGraph extensions | DONE | | Per §3.5 |
+| 10 | Write unit tests for determinism | DONE | | Same input → same output |
+| 11 | Write unit tests for cycles | DONE | | Handle cyclic graphs |
+| 12 | Update graph serialization | DONE | | Use canonical form |
+
+---
+
+## 5. ACCEPTANCE CRITERIA
+
+### 5.1 Determinism Requirements
+
+- [ ] Same graph always produces same node order
+- [ ] Same graph always produces same edge order
+- [ ] Same graph always produces same content hash
+- [ ] No randomness in any ordering step
+
+### 5.2 Strategy Requirements
+
+- [ ] Topological sort handles DAGs correctly
+- [ ] BFS/DFS handle disconnected graphs
+- [ ] Cyclic graphs don't cause infinite loops
+- [ ] Lexicographic tiebreaker is consistent
+
+### 5.3 Performance Requirements
+
+- [ ] Ordering completes in O(V+E) time
+- [ ] Large graphs (10k+ nodes) complete in < 1s
+- [ ] Memory usage linear in graph size
+
+---
+
+## 6. REFERENCES
+
+- Advisory: `14-Dec-2025 - Triage and Unknowns Technical Reference.md` §6.3
+- Existing: `src/Scanner/__Libraries/StellaOps.Scanner.Reachability/RichGraph.cs`
+- Algorithm: Kahn's topological sort

docs/implplan/archived/SPRINT_3605_0001_0001_local_evidence_cache.md

@@ -0,0 +1,810 @@
+# SPRINT_3605_0001_0001 - Local Evidence Cache
+
+**Status:** DONE
+**Priority:** P0 - CRITICAL
+**Module:** ExportCenter, Scanner
+**Working Directory:** `src/ExportCenter/StellaOps.ExportCenter/StellaOps.ExportCenter.Core/`
+**Estimated Effort:** High
+**Dependencies:** SPRINT_1104 (Evidence Bundle), SPRINT_3603 (Offline Bundle Format)
+
+---
+
+## 1. OBJECTIVE
+
+Implement a local evidence cache that stores signed evidence bundles alongside SARIF/VEX artifacts, enabling complete offline triage without network access.
+
+### Goals
+
+1. **Local storage** - Evidence cached alongside scan artifacts
+2. **Signed bundles** - All cached evidence is DSSE-signed
+3. **Deferred enrichment** - Queue background enrichment when network returns
+4. **Predictable fallbacks** - Clear status when verification pending
+5. **95%+ offline** - Target ≥95% evidence resolvable locally
+
+---
+
+## 2. BACKGROUND
+
+### 2.1 Current State
+
+- Scan artifacts stored locally (SARIF, VEX)
+- Evidence not bundled with scan output
+- No offline evidence resolution
+- No deferred enrichment queue
+
+### 2.2 Target State
+
+Per advisory §7:
+- Store (SBOM slices, path proofs, DSSE attestations, compiled call-stacks) in signed bundle beside SARIF/VEX
+- Mark fields needing internet; queue background "enricher" when network returns
+- Show embedded DSSE + "verification pending" if provenance server missing
+
+---
+
+## 3. TECHNICAL DESIGN
+
+### 3.1 Evidence Cache Structure
+
+```
+scan_output/
+├── scan-results.sarif.json
+├── vex-statements.json
+├── sbom.cdx.json
+└── .evidence/                    # Evidence cache directory
+    ├── manifest.json             # Cache manifest
+    ├── bundles/
+    │   ├── {alert_id_1}.evidence.json
+    │   ├── {alert_id_2}.evidence.json
+    │   └── ...
+    ├── attestations/
+    │   ├── {digest_1}.dsse.json
+    │   └── ...
+    ├── proofs/
+    │   ├── reachability/
+    │   │   └── {hash}.json
+    │   └── callstacks/
+    │       └── {hash}.json
+    └── enrichment_queue.json     # Deferred enrichment queue
+```
+
+### 3.2 Cache Service Interface
+
+```csharp
+// File: src/ExportCenter/StellaOps.ExportCenter.Core/EvidenceCache/IEvidenceCacheService.cs
+
+namespace StellaOps.ExportCenter.Core.EvidenceCache;
+
+/// <summary>
+/// Service for managing local evidence cache.
+/// </summary>
+public interface IEvidenceCacheService
+{
+    /// <summary>
+    /// Caches evidence bundle for offline access.
+    /// </summary>
+    Task<CacheResult> CacheEvidenceAsync(
+        string scanOutputPath,
+        EvidenceBundle bundle,
+        CancellationToken cancellationToken = default);
+
+    /// <summary>
+    /// Retrieves cached evidence for an alert.
+    /// </summary>
+    Task<CachedEvidence?> GetCachedEvidenceAsync(
+        string scanOutputPath,
+        string alertId,
+        CancellationToken cancellationToken = default);
+
+    /// <summary>
+    /// Queues deferred enrichment for missing evidence.
+    /// </summary>
+    Task QueueEnrichmentAsync(
+        string scanOutputPath,
+        EnrichmentRequest request,
+        CancellationToken cancellationToken = default);
+
+    /// <summary>
+    /// Processes deferred enrichment queue (when network available).
+    /// </summary>
+    Task<EnrichmentResult> ProcessEnrichmentQueueAsync(
+        string scanOutputPath,
+        CancellationToken cancellationToken = default);
+
+    /// <summary>
+    /// Gets cache statistics for a scan output.
+    /// </summary>
+    Task<CacheStatistics> GetStatisticsAsync(
+        string scanOutputPath,
+        CancellationToken cancellationToken = default);
+}
+```
+
+### 3.3 Cache Manifest
+
+```csharp
+// File: src/ExportCenter/StellaOps.ExportCenter.Core/EvidenceCache/CacheManifest.cs
+
+namespace StellaOps.ExportCenter.Core.EvidenceCache;
+
+/// <summary>
+/// Manifest for local evidence cache.
+/// </summary>
+public sealed class CacheManifest
+{
+    /// <summary>
+    /// Cache schema version.
+    /// </summary>
+    public string SchemaVersion { get; init; } = "1.0";
+
+    /// <summary>
+    /// When cache was created.
+    /// </summary>
+    public required DateTimeOffset CreatedAt { get; init; }
+
+    /// <summary>
+    /// Last time cache was updated.
+    /// </summary>
+    public required DateTimeOffset UpdatedAt { get; init; }
+
+    /// <summary>
+    /// Scan artifact digest this cache is for.
+    /// </summary>
+    public required string ScanDigest { get; init; }
+
+    /// <summary>
+    /// Cached evidence bundle entries.
+    /// </summary>
+    public required IReadOnlyList<CacheEntry> Entries { get; init; }
+
+    /// <summary>
+    /// Deferred enrichment count.
+    /// </summary>
+    public int PendingEnrichmentCount { get; init; }
+
+    /// <summary>
+    /// Cache statistics.
+    /// </summary>
+    public CacheStatistics Statistics { get; init; } = new();
+}
+
+public sealed class CacheEntry
+{
+    /// <summary>
+    /// Alert ID this entry is for.
+    /// </summary>
+    public required string AlertId { get; init; }
+
+    /// <summary>
+    /// Relative path to cached bundle.
+    /// </summary>
+    public required string BundlePath { get; init; }
+
+    /// <summary>
+    /// Content hash of bundle.
+    /// </summary>
+    public required string ContentHash { get; init; }
+
+    /// <summary>
+    /// Evidence status summary.
+    /// </summary>
+    public required CachedEvidenceStatus Status { get; init; }
+
+    /// <summary>
+    /// When entry was cached.
+    /// </summary>
+    public required DateTimeOffset CachedAt { get; init; }
+
+    /// <summary>
+    /// Whether bundle is signed.
+    /// </summary>
+    public bool IsSigned { get; init; }
+}
+
+public sealed class CachedEvidenceStatus
+{
+    public EvidenceCacheState Reachability { get; init; }
+    public EvidenceCacheState CallStack { get; init; }
+    public EvidenceCacheState Provenance { get; init; }
+    public EvidenceCacheState VexStatus { get; init; }
+}
+
+public enum EvidenceCacheState
+{
+    /// <summary>Evidence available locally.</summary>
+    Available,
+
+    /// <summary>Evidence pending network enrichment.</summary>
+    PendingEnrichment,
+
+    /// <summary>Evidence not available, enrichment queued.</summary>
+    Queued,
+
+    /// <summary>Evidence unavailable (missing inputs).</summary>
+    Unavailable
+}
+
+public sealed class CacheStatistics
+{
+    public int TotalBundles { get; init; }
+    public int FullyAvailable { get; init; }
+    public int PartiallyAvailable { get; init; }
+    public int PendingEnrichment { get; init; }
+    public double OfflineResolvablePercentage { get; init; }
+    public long TotalSizeBytes { get; init; }
+}
+```
+
+### 3.4 Cache Service Implementation
+
+```csharp
+// File: src/ExportCenter/StellaOps.ExportCenter.Core/EvidenceCache/LocalEvidenceCacheService.cs
+
+namespace StellaOps.ExportCenter.Core.EvidenceCache;
+
+/// <summary>
+/// Implements local evidence caching alongside scan artifacts.
+/// </summary>
+public sealed class LocalEvidenceCacheService : IEvidenceCacheService
+{
+    private const string EvidenceDir = ".evidence";
+    private const string ManifestFile = "manifest.json";
+    private const string EnrichmentQueueFile = "enrichment_queue.json";
+
+    private readonly IDsseSigningService _signingService;
+    private readonly TimeProvider _timeProvider;
+    private readonly ILogger<LocalEvidenceCacheService> _logger;
+    private readonly JsonSerializerOptions _jsonOptions;
+
+    public LocalEvidenceCacheService(
+        IDsseSigningService signingService,
+        TimeProvider timeProvider,
+        ILogger<LocalEvidenceCacheService> logger)
+    {
+        _signingService = signingService;
+        _timeProvider = timeProvider;
+        _logger = logger;
+        _jsonOptions = new JsonSerializerOptions
+        {
+            PropertyNamingPolicy = JsonNamingPolicy.CamelCase,
+            WriteIndented = true
+        };
+    }
+
+    public async Task<CacheResult> CacheEvidenceAsync(
+        string scanOutputPath,
+        EvidenceBundle bundle,
+        CancellationToken cancellationToken = default)
+    {
+        var cacheDir = EnsureCacheDirectory(scanOutputPath);
+        var bundlesDir = Path.Combine(cacheDir, "bundles");
+        Directory.CreateDirectory(bundlesDir);
+
+        // Serialize and sign bundle
+        var bundleJson = JsonSerializer.Serialize(bundle, _jsonOptions);
+        var signedBundle = await _signingService.SignAsync(bundleJson);
+
+        // Write bundle file
+        var bundlePath = Path.Combine(bundlesDir, $"{bundle.AlertId}.evidence.json");
+        await File.WriteAllTextAsync(bundlePath, bundleJson, cancellationToken);
+
+        // Write signature file
+        var sigPath = bundlePath + ".sig";
+        await File.WriteAllTextAsync(sigPath, signedBundle, cancellationToken);
+
+        // Cache individual attestations
+        if (bundle.Provenance?.DsseEnvelope is not null)
+        {
+            await CacheAttestationAsync(cacheDir, bundle.ArtifactId, bundle.Provenance.DsseEnvelope, cancellationToken);
+        }
+
+        // Cache proofs
+        if (bundle.Reachability?.Hash is not null && bundle.Reachability.FunctionPath is not null)
+        {
+            await CacheProofAsync(cacheDir, "reachability", bundle.Reachability.Hash, bundle.Reachability, cancellationToken);
+        }
+
+        if (bundle.CallStack?.Hash is not null && bundle.CallStack.Frames is not null)
+        {
+            await CacheProofAsync(cacheDir, "callstacks", bundle.CallStack.Hash, bundle.CallStack, cancellationToken);
+        }
+
+        // Queue enrichment for missing evidence
+        var enrichmentRequests = IdentifyMissingEvidence(bundle);
+        foreach (var request in enrichmentRequests)
+        {
+            await QueueEnrichmentAsync(scanOutputPath, request, cancellationToken);
+        }
+
+        // Update manifest
+        await UpdateManifestAsync(scanOutputPath, bundle, bundlePath, cancellationToken);
+
+        _logger.LogInformation(
+            "Cached evidence for alert {AlertId} at {Path}, {MissingCount} items queued for enrichment",
+            bundle.AlertId, bundlePath, enrichmentRequests.Count);
+
+        return new CacheResult
+        {
+            Success = true,
+            BundlePath = bundlePath,
+            CachedAt = _timeProvider.GetUtcNow(),
+            PendingEnrichmentCount = enrichmentRequests.Count
+        };
+    }
+
+    public async Task<CachedEvidence?> GetCachedEvidenceAsync(
+        string scanOutputPath,
+        string alertId,
+        CancellationToken cancellationToken = default)
+    {
+        var cacheDir = GetCacheDirectory(scanOutputPath);
+        if (!Directory.Exists(cacheDir))
+            return null;
+
+        var bundlePath = Path.Combine(cacheDir, "bundles", $"{alertId}.evidence.json");
+        if (!File.Exists(bundlePath))
+            return null;
+
+        var bundleJson = await File.ReadAllTextAsync(bundlePath, cancellationToken);
+        var bundle = JsonSerializer.Deserialize<EvidenceBundle>(bundleJson, _jsonOptions);
+
+        if (bundle is null)
+            return null;
+
+        // Check signature
+        var sigPath = bundlePath + ".sig";
+        var signatureValid = false;
+        string? verificationStatus = null;
+
+        if (File.Exists(sigPath))
+        {
+            var signature = await File.ReadAllTextAsync(sigPath, cancellationToken);
+            try
+            {
+                signatureValid = await _signingService.VerifyAsync(bundleJson, signature);
+                verificationStatus = signatureValid ? "verified" : "invalid";
+            }
+            catch (Exception ex)
+            {
+                _logger.LogWarning(ex, "Failed to verify signature for {AlertId}", alertId);
+                verificationStatus = "verification_failed";
+            }
+        }
+        else
+        {
+            verificationStatus = "unsigned";
+        }
+
+        return new CachedEvidence
+        {
+            Bundle = bundle,
+            BundlePath = bundlePath,
+            SignatureValid = signatureValid,
+            VerificationStatus = verificationStatus,
+            CachedAt = File.GetLastWriteTimeUtc(bundlePath)
+        };
+    }
+
+    public async Task QueueEnrichmentAsync(
+        string scanOutputPath,
+        EnrichmentRequest request,
+        CancellationToken cancellationToken = default)
+    {
+        var cacheDir = EnsureCacheDirectory(scanOutputPath);
+        var queuePath = Path.Combine(cacheDir, EnrichmentQueueFile);
+
+        var queue = await LoadEnrichmentQueueAsync(queuePath, cancellationToken);
+        queue.Requests.Add(request);
+        queue.UpdatedAt = _timeProvider.GetUtcNow();
+
+        await File.WriteAllTextAsync(
+            queuePath,
+            JsonSerializer.Serialize(queue, _jsonOptions),
+            cancellationToken);
+    }
+
+    public async Task<EnrichmentResult> ProcessEnrichmentQueueAsync(
+        string scanOutputPath,
+        CancellationToken cancellationToken = default)
+    {
+        var cacheDir = GetCacheDirectory(scanOutputPath);
+        if (!Directory.Exists(cacheDir))
+            return new EnrichmentResult { ProcessedCount = 0 };
+
+        var queuePath = Path.Combine(cacheDir, EnrichmentQueueFile);
+        var queue = await LoadEnrichmentQueueAsync(queuePath, cancellationToken);
+
+        var processed = 0;
+        var failed = 0;
+        var remaining = new List<EnrichmentRequest>();
+
+        foreach (var request in queue.Requests)
+        {
+            if (cancellationToken.IsCancellationRequested)
+            {
+                remaining.Add(request);
+                continue;
+            }
+
+            try
+            {
+                // Attempt enrichment (network call)
+                var success = await TryEnrichAsync(request, cancellationToken);
+                if (success)
+                {
+                    processed++;
+                    _logger.LogInformation(
+                        "Successfully enriched {EvidenceType} for {AlertId}",
+                        request.EvidenceType, request.AlertId);
+                }
+                else
+                {
+                    remaining.Add(request);
+                    failed++;
+                }
+            }
+            catch (Exception ex)
+            {
+                _logger.LogWarning(ex, "Failed to enrich {EvidenceType} for {AlertId}",
+                    request.EvidenceType, request.AlertId);
+                remaining.Add(request);
+                failed++;
+            }
+        }
+
+        // Update queue with remaining items
+        queue.Requests = remaining;
+        queue.UpdatedAt = _timeProvider.GetUtcNow();
+
+        await File.WriteAllTextAsync(
+            queuePath,
+            JsonSerializer.Serialize(queue, _jsonOptions),
+            cancellationToken);
+
+        return new EnrichmentResult
+        {
+            ProcessedCount = processed,
+            FailedCount = failed,
+            RemainingCount = remaining.Count
+        };
+    }
+
+    public async Task<CacheStatistics> GetStatisticsAsync(
+        string scanOutputPath,
+        CancellationToken cancellationToken = default)
+    {
+        var cacheDir = GetCacheDirectory(scanOutputPath);
+        if (!Directory.Exists(cacheDir))
+            return new CacheStatistics();
+
+        var manifestPath = Path.Combine(cacheDir, ManifestFile);
+        if (!File.Exists(manifestPath))
+            return new CacheStatistics();
+
+        var manifestJson = await File.ReadAllTextAsync(manifestPath, cancellationToken);
+        var manifest = JsonSerializer.Deserialize<CacheManifest>(manifestJson, _jsonOptions);
+
+        return manifest?.Statistics ?? new CacheStatistics();
+    }
+
+    // Helper methods...
+
+    private string EnsureCacheDirectory(string scanOutputPath)
+    {
+        var cacheDir = Path.Combine(scanOutputPath, EvidenceDir);
+        Directory.CreateDirectory(cacheDir);
+        return cacheDir;
+    }
+
+    private static string GetCacheDirectory(string scanOutputPath) =>
+        Path.Combine(scanOutputPath, EvidenceDir);
+
+    private async Task CacheAttestationAsync(
+        string cacheDir,
+        string digest,
+        DsseEnvelope envelope,
+        CancellationToken cancellationToken)
+    {
+        var attestDir = Path.Combine(cacheDir, "attestations");
+        Directory.CreateDirectory(attestDir);
+
+        var safeDigest = digest.Replace(":", "_").Replace("/", "_");
+        var path = Path.Combine(attestDir, $"{safeDigest}.dsse.json");
+
+        await File.WriteAllTextAsync(
+            path,
+            JsonSerializer.Serialize(envelope, _jsonOptions),
+            cancellationToken);
+    }
+
+    private async Task CacheProofAsync<T>(
+        string cacheDir,
+        string proofType,
+        string hash,
+        T proof,
+        CancellationToken cancellationToken) where T : class
+    {
+        var proofDir = Path.Combine(cacheDir, "proofs", proofType);
+        Directory.CreateDirectory(proofDir);
+
+        var path = Path.Combine(proofDir, $"{hash}.json");
+
+        await File.WriteAllTextAsync(
+            path,
+            JsonSerializer.Serialize(proof, _jsonOptions),
+            cancellationToken);
+    }
+
+    private static List<EnrichmentRequest> IdentifyMissingEvidence(EvidenceBundle bundle)
+    {
+        var requests = new List<EnrichmentRequest>();
+
+        if (bundle.Reachability?.Status == EvidenceStatus.PendingEnrichment)
+        {
+            requests.Add(new EnrichmentRequest
+            {
+                AlertId = bundle.AlertId,
+                ArtifactId = bundle.ArtifactId,
+                EvidenceType = "reachability",
+                Reason = bundle.Reachability.UnavailableReason
+            });
+        }
+
+        if (bundle.Provenance?.Status == EvidenceStatus.PendingEnrichment)
+        {
+            requests.Add(new EnrichmentRequest
+            {
+                AlertId = bundle.AlertId,
+                ArtifactId = bundle.ArtifactId,
+                EvidenceType = "provenance",
+                Reason = bundle.Provenance.UnavailableReason
+            });
+        }
+
+        return requests;
+    }
+
+    private async Task<EnrichmentQueue> LoadEnrichmentQueueAsync(
+        string queuePath,
+        CancellationToken cancellationToken)
+    {
+        if (!File.Exists(queuePath))
+            return new EnrichmentQueue { CreatedAt = _timeProvider.GetUtcNow() };
+
+        var json = await File.ReadAllTextAsync(queuePath, cancellationToken);
+        return JsonSerializer.Deserialize<EnrichmentQueue>(json, _jsonOptions)
+            ?? new EnrichmentQueue { CreatedAt = _timeProvider.GetUtcNow() };
+    }
+
+    private async Task<bool> TryEnrichAsync(
+        EnrichmentRequest request,
+        CancellationToken cancellationToken)
+    {
+        // Implementation depends on evidence type
+        // Would call external services when network available
+        await Task.CompletedTask;
+        return false; // Stub
+    }
+
+    private async Task UpdateManifestAsync(
+        string scanOutputPath,
+        EvidenceBundle bundle,
+        string bundlePath,
+        CancellationToken cancellationToken)
+    {
+        var cacheDir = GetCacheDirectory(scanOutputPath);
+        var manifestPath = Path.Combine(cacheDir, ManifestFile);
+
+        var manifest = File.Exists(manifestPath)
+            ? JsonSerializer.Deserialize<CacheManifest>(
+                await File.ReadAllTextAsync(manifestPath, cancellationToken), _jsonOptions)
+            : null;
+
+        var entries = manifest?.Entries.ToList() ?? new List<CacheEntry>();
+
+        // Remove existing entry for this alert
+        entries.RemoveAll(e => e.AlertId == bundle.AlertId);
+
+        // Add new entry
+        entries.Add(new CacheEntry
+        {
+            AlertId = bundle.AlertId,
+            BundlePath = Path.GetRelativePath(cacheDir, bundlePath),
+            ContentHash = bundle.Hashes.CombinedHash,
+            Status = MapToStatus(bundle),
+            CachedAt = _timeProvider.GetUtcNow(),
+            IsSigned = true
+        });
+
+        // Compute statistics
+        var stats = ComputeStatistics(entries, cacheDir);
+
+        var newManifest = new CacheManifest
+        {
+            CreatedAt = manifest?.CreatedAt ?? _timeProvider.GetUtcNow(),
+            UpdatedAt = _timeProvider.GetUtcNow(),
+            ScanDigest = bundle.ArtifactId,
+            Entries = entries,
+            Statistics = stats
+        };
+
+        await File.WriteAllTextAsync(
+            manifestPath,
+            JsonSerializer.Serialize(newManifest, _jsonOptions),
+            cancellationToken);
+    }
+
+    private static CachedEvidenceStatus MapToStatus(EvidenceBundle bundle)
+    {
+        return new CachedEvidenceStatus
+        {
+            Reachability = MapState(bundle.Reachability?.Status),
+            CallStack = MapState(bundle.CallStack?.Status),
+            Provenance = MapState(bundle.Provenance?.Status),
+            VexStatus = MapState(bundle.VexStatus?.Status)
+        };
+    }
+
+    private static EvidenceCacheState MapState(EvidenceStatus? status) => status switch
+    {
+        EvidenceStatus.Available => EvidenceCacheState.Available,
+        EvidenceStatus.PendingEnrichment => EvidenceCacheState.PendingEnrichment,
+        EvidenceStatus.Unavailable => EvidenceCacheState.Unavailable,
+        _ => EvidenceCacheState.Unavailable
+    };
+
+    private CacheStatistics ComputeStatistics(List<CacheEntry> entries, string cacheDir)
+    {
+        var totalSize = Directory.Exists(cacheDir)
+            ? new DirectoryInfo(cacheDir)
+                .EnumerateFiles("*", SearchOption.AllDirectories)
+                .Sum(f => f.Length)
+            : 0;
+
+        var fullyAvailable = entries.Count(e =>
+            e.Status.Reachability == EvidenceCacheState.Available &&
+            e.Status.CallStack == EvidenceCacheState.Available &&
+            e.Status.Provenance == EvidenceCacheState.Available &&
+            e.Status.VexStatus == EvidenceCacheState.Available);
+
+        var pending = entries.Count(e =>
+            e.Status.Reachability == EvidenceCacheState.PendingEnrichment ||
+            e.Status.CallStack == EvidenceCacheState.PendingEnrichment ||
+            e.Status.Provenance == EvidenceCacheState.PendingEnrichment);
+
+        var offlineResolvable = entries.Count > 0
+            ? (double)entries.Count(e => IsOfflineResolvable(e.Status)) / entries.Count * 100
+            : 0;
+
+        return new CacheStatistics
+        {
+            TotalBundles = entries.Count,
+            FullyAvailable = fullyAvailable,
+            PartiallyAvailable = entries.Count - fullyAvailable - pending,
+            PendingEnrichment = pending,
+            OfflineResolvablePercentage = offlineResolvable,
+            TotalSizeBytes = totalSize
+        };
+    }
+
+    private static bool IsOfflineResolvable(CachedEvidenceStatus status)
+    {
+        // At least VEX and one of reachability/callstack available
+        return status.VexStatus == EvidenceCacheState.Available &&
+            (status.Reachability == EvidenceCacheState.Available ||
+             status.CallStack == EvidenceCacheState.Available);
+    }
+}
+```
+
+### 3.5 Supporting Models
+
+```csharp
+// File: src/ExportCenter/StellaOps.ExportCenter.Core/EvidenceCache/CacheModels.cs
+
+namespace StellaOps.ExportCenter.Core.EvidenceCache;
+
+public sealed class CacheResult
+{
+    public bool Success { get; init; }
+    public string? BundlePath { get; init; }
+    public DateTimeOffset CachedAt { get; init; }
+    public int PendingEnrichmentCount { get; init; }
+    public string? Error { get; init; }
+}
+
+public sealed class CachedEvidence
+{
+    public required EvidenceBundle Bundle { get; init; }
+    public required string BundlePath { get; init; }
+    public bool SignatureValid { get; init; }
+    public string? VerificationStatus { get; init; }
+    public DateTimeOffset CachedAt { get; init; }
+}
+
+public sealed class EnrichmentRequest
+{
+    public required string AlertId { get; init; }
+    public required string ArtifactId { get; init; }
+    public required string EvidenceType { get; init; }
+    public string? Reason { get; init; }
+    public DateTimeOffset QueuedAt { get; init; }
+    public int AttemptCount { get; init; }
+}
+
+public sealed class EnrichmentQueue
+{
+    public required DateTimeOffset CreatedAt { get; init; }
+    public DateTimeOffset UpdatedAt { get; init; }
+    public List<EnrichmentRequest> Requests { get; set; } = new();
+}
+
+public sealed class EnrichmentResult
+{
+    public int ProcessedCount { get; init; }
+    public int FailedCount { get; init; }
+    public int RemainingCount { get; init; }
+}
+```
+
+---
+
+## 4. DELIVERY TRACKER
+
+| # | Task | Status | Assignee | Notes |
+|---|------|--------|----------|-------|
+| 1 | Define cache directory structure | DONE | | Per §3.1 |
+| 2 | Implement `IEvidenceCacheService` | DONE | | Per §3.2 |
+| 3 | Implement `CacheManifest` | DONE | | Per §3.3 |
+| 4 | Implement `LocalEvidenceCacheService` | DONE | | Per §3.4 |
+| 5 | Implement attestation caching | DONE | | |
+| 6 | Implement proof caching | DONE | | |
+| 7 | Implement enrichment queue | DONE | | |
+| 8 | Implement queue processing | DONE | | |
+| 9 | Implement statistics computation | DONE | | |
+| 10 | Add CLI command for cache stats | DONE | | Implemented `stella export cache stats`. |
+| 11 | Add CLI command to process queue | DONE | | Implemented `stella export cache process-queue`. |
+| 12 | Write unit tests | DONE | | Added `LocalEvidenceCacheService` unit tests. |
+| 13 | Write integration tests | DONE | | Added CLI handler tests for cache commands. |
+
+---
+
+## 5. ACCEPTANCE CRITERIA
+
+### 5.1 Caching Requirements
+
+- [ ] Evidence cached alongside scan artifacts
+- [ ] All bundles DSSE-signed
+- [ ] Manifest tracks all entries
+- [ ] Statistics computed correctly
+
+### 5.2 Offline Requirements
+
+- [ ] ≥95% evidence resolvable with local cache
+- [ ] Clear status when verification pending
+- [ ] Predictable fallback behavior
+
+### 5.3 Enrichment Requirements
+
+- [ ] Missing evidence queued automatically
+- [ ] Queue processed when network available
+- [ ] Failed enrichments retried with backoff
+
+---
+
+## 6. REFERENCES
+
+- Advisory: `14-Dec-2025 - Triage and Unknowns Technical Reference.md` §7
+- Existing: `src/ExportCenter/StellaOps.ExportCenter/StellaOps.ExportCenter.Core/`
+
+---
+
+## 7. DECISIONS & RISKS
+
+- Cross-module: Tasks 10-11 require CLI edits in `src/Cli/StellaOps.Cli/` (explicitly tracked in this sprint).
+
+## 8. EXECUTION LOG
+
+| Date (UTC) | Update | Owner |
+| --- | --- | --- |
+| 2025-12-15 | Set sprint status to DOING; started task 10 (CLI cache stats). | DevEx/CLI |
+| 2025-12-15 | Implemented CLI cache commands and tests; validated with `dotnet test src/Cli/__Tests/StellaOps.Cli.Tests/StellaOps.Cli.Tests.csproj -c Release` and `dotnet test src/ExportCenter/StellaOps.ExportCenter/StellaOps.ExportCenter.Tests/StellaOps.ExportCenter.Tests.csproj -c Release --filter FullyQualifiedName~LocalEvidenceCacheServiceTests`. | DevEx/CLI |

docs/implplan/archived/SPRINT_3606_0001_0001_ttfs_telemetry.md

@@ -0,0 +1,517 @@
+# SPRINT_3606_0001_0001 - TTFS Telemetry & Observability
+
+**Status:** DONE
+**Priority:** P1 - HIGH
+**Module:** Web, Telemetry
+**Working Directory:** `src/Web/StellaOps.Web/src/app/`, `src/Telemetry/StellaOps.Telemetry.Core/`
+**Estimated Effort:** Medium
+**Dependencies:** Telemetry Module
+
+---
+
+## 1. OBJECTIVE
+
+Implement Time-to-First-Signal (TTFS) telemetry and related observability metrics to track and validate KPI targets for the triage experience.
+
+### Goals
+
+1. **TTFS tracking** - Measure time from alert creation to first evidence render
+2. **Clicks-to-closure** - Track interaction count per decision
+3. **Evidence completeness** - Log evidence bitset at decision time
+4. **Performance budgets** - Monitor against p95 targets
+
+---
+
+## 2. BACKGROUND
+
+### 2.1 Current State
+
+- Basic OpenTelemetry integration exists
+- No TTFS-specific metrics
+- No clicks-to-closure tracking
+- No evidence completeness scoring
+
+### 2.2 Target State
+
+Per advisory §9:
+
+```typescript
+ttfs.start → (alert creation)
+ttfs.signal → (first evidence card paint)
+close.clicks → (decision recorded)
+```
+
+Log evidence bitset (reach, stack, prov, vex) at decision time.
+
+**KPI Targets (§3):**
+- TTFS p95 < 1.5s
+- Clicks-to-Closure median < 6
+- Evidence Completeness ≥ 90%
+
+---
+
+## 3. TECHNICAL DESIGN
+
+### 3.1 TTFS Service (Frontend)
+
+```typescript
+// File: src/Web/StellaOps.Web/src/app/features/triage/services/ttfs-telemetry.service.ts
+
+import { Injectable, inject } from '@angular/core';
+import { TelemetryService } from '@core/services/telemetry.service';
+
+export interface TtfsTimings {
+  alertId: string;
+  alertCreatedAt: number;
+  ttfsStartAt: number;
+  skeletonRenderedAt?: number;
+  firstEvidenceAt?: number;
+  fullEvidenceAt?: number;
+  decisionRecordedAt?: number;
+  clickCount: number;
+  evidenceBitset: number;
+}
+
+@Injectable({ providedIn: 'root' })
+export class TtfsTelemetryService {
+  private telemetry = inject(TelemetryService);
+  private activeTimings = new Map<string, TtfsTimings>();
+
+  /**
+   * Starts TTFS tracking for an alert.
+   */
+  startTracking(alertId: string, alertCreatedAt: Date): void {
+    const timing: TtfsTimings = {
+      alertId,
+      alertCreatedAt: alertCreatedAt.getTime(),
+      ttfsStartAt: performance.now(),
+      clickCount: 0,
+      evidenceBitset: 0
+    };
+
+    this.activeTimings.set(alertId, timing);
+
+    this.telemetry.trackEvent('ttfs.start', {
+      alertId,
+      alertAge: Date.now() - alertCreatedAt.getTime()
+    });
+  }
+
+  /**
+   * Records skeleton UI render.
+   */
+  recordSkeletonRender(alertId: string): void {
+    const timing = this.activeTimings.get(alertId);
+    if (!timing) return;
+
+    timing.skeletonRenderedAt = performance.now();
+
+    const duration = timing.skeletonRenderedAt - timing.ttfsStartAt;
+    this.telemetry.trackMetric('ttfs_skeleton_ms', duration, { alertId });
+
+    // Check against budget (<200ms)
+    if (duration > 200) {
+      this.telemetry.trackEvent('ttfs.budget_exceeded', {
+        alertId,
+        phase: 'skeleton',
+        duration,
+        budget: 200
+      });
+    }
+  }
+
+  /**
+   * Records first evidence pill paint (primary TTFS metric).
+   */
+  recordFirstEvidence(alertId: string, evidenceType: string): void {
+    const timing = this.activeTimings.get(alertId);
+    if (!timing || timing.firstEvidenceAt) return;
+
+    timing.firstEvidenceAt = performance.now();
+
+    const duration = timing.firstEvidenceAt - timing.ttfsStartAt;
+    this.telemetry.trackMetric('ttfs_first_evidence_ms', duration, {
+      alertId,
+      evidenceType
+    });
+
+    this.telemetry.trackEvent('ttfs.signal', {
+      alertId,
+      duration,
+      evidenceType
+    });
+
+    // Check against budget (<500ms for first pill, <1.5s p95)
+    if (duration > 500) {
+      this.telemetry.trackEvent('ttfs.budget_exceeded', {
+        alertId,
+        phase: 'first_evidence',
+        duration,
+        budget: 500
+      });
+    }
+  }
+
+  /**
+   * Records full evidence load complete.
+   */
+  recordFullEvidence(alertId: string, bitset: EvidenceBitset): void {
+    const timing = this.activeTimings.get(alertId);
+    if (!timing) return;
+
+    timing.fullEvidenceAt = performance.now();
+    timing.evidenceBitset = bitset.value;
+
+    const duration = timing.fullEvidenceAt - timing.ttfsStartAt;
+    this.telemetry.trackMetric('ttfs_full_evidence_ms', duration, {
+      alertId,
+      completeness: bitset.completenessScore
+    });
+
+    // Log evidence completeness
+    this.telemetry.trackMetric('evidence_completeness', bitset.completenessScore, {
+      alertId,
+      hasReachability: bitset.hasReachability,
+      hasCallstack: bitset.hasCallstack,
+      hasProvenance: bitset.hasProvenance,
+      hasVex: bitset.hasVex
+    });
+  }
+
+  /**
+   * Records a user interaction (click, keyboard).
+   */
+  recordInteraction(alertId: string, interactionType: string): void {
+    const timing = this.activeTimings.get(alertId);
+    if (!timing) return;
+
+    timing.clickCount++;
+
+    this.telemetry.trackEvent('triage.interaction', {
+      alertId,
+      interactionType,
+      clickNumber: timing.clickCount
+    });
+  }
+
+  /**
+   * Records decision completion and final metrics.
+   */
+  recordDecision(alertId: string, decisionStatus: string): void {
+    const timing = this.activeTimings.get(alertId);
+    if (!timing) return;
+
+    timing.decisionRecordedAt = performance.now();
+
+    const totalDuration = timing.decisionRecordedAt - timing.ttfsStartAt;
+
+    // Log clicks-to-closure
+    this.telemetry.trackMetric('clicks_to_closure', timing.clickCount, {
+      alertId,
+      decisionStatus
+    });
+
+    // Log total triage duration
+    this.telemetry.trackMetric('triage_duration_ms', totalDuration, {
+      alertId,
+      decisionStatus
+    });
+
+    // Log evidence bitset at decision time
+    this.telemetry.trackEvent('close.clicks', {
+      alertId,
+      clickCount: timing.clickCount,
+      decisionStatus,
+      evidenceBitset: timing.evidenceBitset,
+      totalDuration
+    });
+
+    // Check clicks-to-closure budget
+    if (timing.clickCount > 6) {
+      this.telemetry.trackEvent('clicks.budget_exceeded', {
+        alertId,
+        clicks: timing.clickCount,
+        budget: 6
+      });
+    }
+
+    // Cleanup
+    this.activeTimings.delete(alertId);
+  }
+
+  /**
+   * Cancels tracking for an alert (e.g., user navigates away).
+   */
+  cancelTracking(alertId: string): void {
+    this.activeTimings.delete(alertId);
+  }
+}
+
+/**
+ * Evidence bitset for completeness tracking.
+ */
+export class EvidenceBitset {
+  private static readonly REACHABILITY = 1 << 0;
+  private static readonly CALLSTACK = 1 << 1;
+  private static readonly PROVENANCE = 1 << 2;
+  private static readonly VEX = 1 << 3;
+
+  constructor(public value: number = 0) {}
+
+  get hasReachability(): boolean { return (this.value & EvidenceBitset.REACHABILITY) !== 0; }
+  get hasCallstack(): boolean { return (this.value & EvidenceBitset.CALLSTACK) !== 0; }
+  get hasProvenance(): boolean { return (this.value & EvidenceBitset.PROVENANCE) !== 0; }
+  get hasVex(): boolean { return (this.value & EvidenceBitset.VEX) !== 0; }
+
+  /**
+   * Completeness score (0-4).
+   */
+  get completenessScore(): number {
+    let score = 0;
+    if (this.hasReachability) score++;
+    if (this.hasCallstack) score++;
+    if (this.hasProvenance) score++;
+    if (this.hasVex) score++;
+    return score;
+  }
+
+  static from(evidence: {
+    reachability?: boolean;
+    callstack?: boolean;
+    provenance?: boolean;
+    vex?: boolean;
+  }): EvidenceBitset {
+    let value = 0;
+    if (evidence.reachability) value |= EvidenceBitset.REACHABILITY;
+    if (evidence.callstack) value |= EvidenceBitset.CALLSTACK;
+    if (evidence.provenance) value |= EvidenceBitset.PROVENANCE;
+    if (evidence.vex) value |= EvidenceBitset.VEX;
+    return new EvidenceBitset(value);
+  }
+}
+```
+
+### 3.2 Backend Metrics
+
+```csharp
+// File: src/__Libraries/StellaOps.Telemetry/Triage/TriageMetrics.cs
+
+namespace StellaOps.Telemetry.Triage;
+
+/// <summary>
+/// Metrics for triage workflow observability.
+/// </summary>
+public static class TriageMetrics
+{
+    private static readonly Meter Meter = new("StellaOps.Triage", "1.0.0");
+
+    // TTFS Metrics
+    public static readonly Histogram<double> TtfsSkeletonSeconds = Meter.CreateHistogram<double>(
+        "stellaops_ttfs_skeleton_seconds",
+        unit: "s",
+        description: "Time to skeleton UI render");
+
+    public static readonly Histogram<double> TtfsFirstEvidenceSeconds = Meter.CreateHistogram<double>(
+        "stellaops_ttfs_first_evidence_seconds",
+        unit: "s",
+        description: "Time to first evidence pill (primary TTFS)");
+
+    public static readonly Histogram<double> TtfsFullEvidenceSeconds = Meter.CreateHistogram<double>(
+        "stellaops_ttfs_full_evidence_seconds",
+        unit: "s",
+        description: "Time to full evidence load");
+
+    // Clicks-to-Closure
+    public static readonly Histogram<int> ClicksToClosure = Meter.CreateHistogram<int>(
+        "stellaops_clicks_to_closure",
+        unit: "{clicks}",
+        description: "Interactions required to complete triage decision");
+
+    // Evidence Completeness
+    public static readonly Histogram<int> EvidenceCompleteness = Meter.CreateHistogram<int>(
+        "stellaops_evidence_completeness_score",
+        unit: "{score}",
+        description: "Evidence completeness at decision time (0-4)");
+
+    public static readonly Counter<long> EvidenceByType = Meter.CreateCounter<long>(
+        "stellaops_evidence_available_total",
+        description: "Count of evidence available by type at decision time");
+
+    // Decision Metrics
+    public static readonly Counter<long> DecisionsTotal = Meter.CreateCounter<long>(
+        "stellaops_triage_decisions_total",
+        description: "Total triage decisions recorded");
+
+    public static readonly Histogram<double> DecisionDurationSeconds = Meter.CreateHistogram<double>(
+        "stellaops_triage_decision_duration_seconds",
+        unit: "s",
+        description: "Total time from alert open to decision");
+
+    // Budget Violations
+    public static readonly Counter<long> BudgetViolations = Meter.CreateCounter<long>(
+        "stellaops_performance_budget_violations_total",
+        description: "Count of performance budget violations");
+}
+```
+
+### 3.3 Telemetry Ingestion Endpoint
+
+```csharp
+// File: src/Telemetry/StellaOps.Telemetry.WebService/Controllers/TelemetryController.cs
+
+namespace StellaOps.Telemetry.WebService.Controllers;
+
+[ApiController]
+[Route("v1/telemetry")]
+public sealed class TelemetryController : ControllerBase
+{
+    private readonly ILogger<TelemetryController> _logger;
+
+    public TelemetryController(ILogger<TelemetryController> logger)
+    {
+        _logger = logger;
+    }
+
+    /// <summary>
+    /// Ingests TTFS telemetry from frontend.
+    /// </summary>
+    [HttpPost("ttfs")]
+    public IActionResult IngestTtfs([FromBody] TtfsEvent[] events)
+    {
+        foreach (var evt in events)
+        {
+            switch (evt.EventType)
+            {
+                case "ttfs.skeleton":
+                    TriageMetrics.TtfsSkeletonSeconds.Record(evt.DurationMs / 1000.0,
+                        new KeyValuePair<string, object?>("alert_id", evt.AlertId));
+                    break;
+
+                case "ttfs.first_evidence":
+                    TriageMetrics.TtfsFirstEvidenceSeconds.Record(evt.DurationMs / 1000.0,
+                        new KeyValuePair<string, object?>("alert_id", evt.AlertId),
+                        new KeyValuePair<string, object?>("evidence_type", evt.EvidenceType));
+                    break;
+
+                case "ttfs.full_evidence":
+                    TriageMetrics.TtfsFullEvidenceSeconds.Record(evt.DurationMs / 1000.0,
+                        new KeyValuePair<string, object?>("alert_id", evt.AlertId));
+                    TriageMetrics.EvidenceCompleteness.Record(evt.CompletenessScore,
+                        new KeyValuePair<string, object?>("alert_id", evt.AlertId));
+                    break;
+
+                case "decision.recorded":
+                    TriageMetrics.ClicksToClosure.Record(evt.ClickCount,
+                        new KeyValuePair<string, object?>("decision_status", evt.DecisionStatus));
+                    TriageMetrics.DecisionDurationSeconds.Record(evt.DurationMs / 1000.0,
+                        new KeyValuePair<string, object?>("decision_status", evt.DecisionStatus));
+                    TriageMetrics.DecisionsTotal.Add(1,
+                        new KeyValuePair<string, object?>("decision_status", evt.DecisionStatus));
+                    break;
+
+                case "budget.violation":
+                    TriageMetrics.BudgetViolations.Add(1,
+                        new KeyValuePair<string, object?>("phase", evt.Phase),
+                        new KeyValuePair<string, object?>("budget", evt.Budget));
+                    break;
+            }
+        }
+
+        return Ok();
+    }
+}
+
+public sealed class TtfsEvent
+{
+    public required string EventType { get; init; }
+    public required string AlertId { get; init; }
+    public double DurationMs { get; init; }
+    public string? EvidenceType { get; init; }
+    public int CompletenessScore { get; init; }
+    public int ClickCount { get; init; }
+    public string? DecisionStatus { get; init; }
+    public string? Phase { get; init; }
+    public double Budget { get; init; }
+}
+```
+
+### 3.4 Grafana Dashboard Queries
+
+```promql
+# TTFS p50/p95
+histogram_quantile(0.50, rate(stellaops_ttfs_first_evidence_seconds_bucket[5m]))
+histogram_quantile(0.95, rate(stellaops_ttfs_first_evidence_seconds_bucket[5m]))
+
+# Clicks-to-Closure median
+histogram_quantile(0.50, rate(stellaops_clicks_to_closure_bucket[5m]))
+
+# Evidence Completeness percentage ≥90%
+(
+  sum(rate(stellaops_evidence_completeness_score_bucket{le="4"}[5m]))
+  /
+  sum(rate(stellaops_evidence_completeness_score_count[5m]))
+) * 100
+
+# Budget violation rate
+sum(rate(stellaops_performance_budget_violations_total[5m])) by (phase)
+```
+
+---
+
+## 4. DELIVERY TRACKER
+
+| # | Task | Status | Assignee | Notes |
+|---|------|--------|----------|-------|
+| 1 | Create `TtfsTelemetryService` | DONE | | ttfs-telemetry.service.ts with batched event sending |
+| 2 | Implement `EvidenceBitset` | DONE | | evidence.model.ts (TypeScript) + TriageMetrics.cs (C#) |
+| 3 | Add backend metrics | DONE | | TriageMetrics.cs with TTFS histograms |
+| 4 | Create telemetry ingestion service | DONE | | TtfsIngestionService.cs |
+| 5 | Integrate into triage workspace | DONE | | triage-workspace.component.ts |
+| 6 | Create Grafana dashboard | DONE | | `ops/devops/observability/grafana/triage-ttfs.json` |
+| 7 | Add alerting rules for budget violations | DONE | | `ops/devops/observability/triage-alerts.yaml` |
+| 8 | Write unit tests | DONE | | `src/Telemetry/StellaOps.Telemetry.Core/StellaOps.Telemetry.Core.Tests/TtfsIngestionServiceTests.cs`, `src/Web/StellaOps.Web/src/app/features/triage/services/ttfs-telemetry.service.spec.ts`, `src/Web/StellaOps.Web/src/app/features/triage/models/evidence.model.spec.ts` |
+| 9 | Document KPI calculation | DONE | | `docs/observability/metrics-and-slos.md` |
+
+---
+
+## 5. ACCEPTANCE CRITERIA
+
+### 5.1 Metrics Requirements
+
+- [ ] TTFS measured from alert open to first evidence
+- [ ] Clicks counted per triage session
+- [ ] Evidence bitset logged at decision time
+- [ ] All metrics exported to Prometheus
+
+### 5.2 KPI Validation
+
+- [ ] Dashboard shows TTFS p50/p95
+- [ ] Dashboard shows clicks-to-closure median
+- [ ] Dashboard shows evidence completeness %
+- [ ] Alerts fire on budget violations
+
+---
+
+## 6. REFERENCES
+
+- Advisory: `14-Dec-2025 - Triage and Unknowns Technical Reference.md` §3, §9
+- Existing: `src/Telemetry/StellaOps.Telemetry.Core/`
+
+---
+
+## Execution Log
+
+| Date (UTC) | Update | Owner |
+| --- | --- | --- |
+| 2025-12-15 | Marked sprint as `DOING`; began work on delivery item #6 (Grafana dashboard). | Implementer |
+| 2025-12-15 | Added Grafana dashboard `ops/devops/observability/grafana/triage-ttfs.json`; marked delivery item #6 `DONE`. | Implementer |
+| 2025-12-15 | Began work on delivery item #7 (TTFS budget alert rules). | Implementer |
+| 2025-12-15 | Added Prometheus alert rules `ops/devops/observability/triage-alerts.yaml`; marked delivery item #7 `DONE`. | Implementer |
+| 2025-12-15 | Began work on delivery item #8 (unit tests). | Implementer |
+| 2025-12-15 | Added TTFS unit tests (Telemetry + Web); marked delivery item #8 `DONE`. | Implementer |
+| 2025-12-15 | Began work on delivery item #9 (KPI calculation documentation). | Implementer |
+| 2025-12-15 | Documented TTFS KPI formulas in `docs/observability/metrics-and-slos.md`; marked delivery item #9 `DONE` and sprint `DONE`. | Implementer |
+
+## Decisions & Risks
+- Cross-module edits are required for delivery items #6-#7 under `ops/devops/observability/` (dashboards + alert rules); proceed and record evidence paths in the tracker rows.
+- Cross-module edits are required for delivery item #9 under `docs/observability/` (KPI formulas); proceed and link the canonical doc from this sprint.

docs/implplan/archived/SPRINT_4601_0001_0001_keyboard_shortcuts.md

@@ -0,0 +1,556 @@
+# Sprint 4601_0001_0001 · Keyboard Shortcuts for Triage UI
+
+**Status:** DONE
+**Priority:** P1 - HIGH
+**Module:** Web (Angular)
+**Working Directory:** `src/Web/StellaOps.Web/src/app/features/triage/`
+**Estimated Effort:** Medium
+**Dependencies:** Angular Web Module
+
+---
+
+## Topic & Scope
+- Deliver power-user keyboard shortcuts for triage workflows (navigation, decisioning, utility) with deterministic behavior and input-focus safety.
+- Evidence: shortcuts wired into triage workspace, help overlay available, and unit tests cover key behaviors.
+- **Working directory:** `src/Web/StellaOps.Web/src/app/features/triage/`.
+
+## Dependencies & Concurrency
+- Depends on the existing triage workspace route/components in `src/Web/StellaOps.Web/src/app/features/triage/`.
+- Safe to run in parallel with other Web work; changes are scoped to triage UI and docs.
+
+## Documentation Prerequisites
+- `docs/product-advisories/14-Dec-2025 - Triage and Unknowns Technical Reference.md` (§4)
+- `docs/modules/ui/architecture.md` (§3.9)
+- `src/Web/StellaOps.Web/AGENTS.md`
+
+## Delivery Tracker
+| # | Task ID | Status | Key dependency / next step | Owners | Task Definition |
+| --- | --- | --- | --- | --- | --- |
+| 1 | UI-TRIAGE-4601-001 | DONE | Implement global keyboard listener | Web Guild | Create `KeyboardShortcutsService` (per Technical Design §3.1). |
+| 2 | UI-TRIAGE-4601-002 | DONE | Register triage mappings | Web Guild | Create `TriageShortcutsService` (per Technical Design §3.2). |
+| 3 | UI-TRIAGE-4601-003 | DONE | Wire into workspace component | Web Guild | Implement navigation shortcuts (`J`, `/`, `R`, `S`). |
+| 4 | UI-TRIAGE-4601-004 | DONE | Decide VEX mapping for `U` | Web Guild | Implement decision shortcuts (`A`, `N`, `U`). |
+| 5 | UI-TRIAGE-4601-005 | DONE | Clipboard implementation | Web Guild | Implement utility shortcuts (`Y`, `?`). |
+| 6 | UI-TRIAGE-4601-006 | DONE | Workspace focus management | Web Guild | Implement arrow navigation. |
+| 7 | UI-TRIAGE-4601-007 | DONE | Modal/overlay wiring | Web Guild | Create keyboard help overlay. |
+| 8 | UI-TRIAGE-4601-008 | DONE | Update templates | Web Guild | Add accessibility attributes (ARIA, focusable cards, tab semantics). |
+| 9 | UI-TRIAGE-4601-009 | DONE | Service-level filter | Web Guild | Ensure shortcuts are disabled while typing in inputs/contenteditable. |
+| 10 | UI-TRIAGE-4601-010 | DONE | Karma specs | Web Guild · QA | Write unit tests for key flows (registration, focus gating, handlers). |
+| 11 | UI-TRIAGE-4601-011 | DONE | Docs update | Web Guild · Docs | Document shortcuts in the UI user guide. |
+
+## Execution Log
+| Date (UTC) | Update | Owner |
+| --- | --- | --- |
+| 2025-12-14 | Normalised sprint file toward standard template; set status to DOING; started implementation. | Agent |
+| 2025-12-15 | Implemented triage keyboard shortcuts, quick VEX (`U` → under investigation), template/a11y wiring, tests, and docs; `npm test` green. | Agent |
+
+## Decisions & Risks
+- Resolved: Added `UNDER_INVESTIGATION` VEX status across UI models and schemas; quick-set `U` opens the VEX modal with initial status under investigation.
+
+## Next Checkpoints
+- N/A.
+
+## 1. OBJECTIVE
+
+Implement keyboard shortcuts for efficient triage workflows, enabling power users to navigate and make decisions without mouse interaction.
+
+### Goals
+
+1. **Navigation shortcuts** - Jump to evidence, search, toggle views
+2. **Decision shortcuts** - Quick VEX status assignment (A/N/U)
+3. **Utility shortcuts** - Copy DSSE, sort, help overlay
+4. **Accessibility** - Standard keyboard navigation patterns
+
+---
+
+## 2. BACKGROUND
+
+### 2.1 Current State
+
+- Triage workspace component exists
+- No keyboard shortcut support
+- All interactions require mouse
+
+### 2.2 Target State
+
+Per advisory §4:
+
+| Shortcut | Action |
+|----------|--------|
+| `J` | Jump to first incomplete evidence pane |
+| `Y` | Copy DSSE (attestation block or Rekor entry ref) |
+| `R` | Toggle reachability view (path list ↔ compact graph ↔ textual proof) |
+| `/` | Search within graph (node/func/package) |
+| `S` | Deterministic sort (reachability→severity→age→component) |
+| `A`, `N`, `U` | Quick VEX set (Affected / Not-affected / Under-investigation) |
+| `?` | Keyboard help overlay |
+
+---
+
+## 3. TECHNICAL DESIGN
+
+### 3.1 Keyboard Service
+
+```typescript
+// File: src/Web/StellaOps.Web/src/app/features/triage/services/keyboard-shortcuts.service.ts
+
+import { Injectable, inject } from '@angular/core';
+import { Subject, Observable, fromEvent } from 'rxjs';
+import { filter, map } from 'rxjs/operators';
+
+export interface KeyboardShortcut {
+  key: string;
+  description: string;
+  category: 'navigation' | 'decision' | 'utility';
+  action: () => void;
+  requiresModifier?: 'ctrl' | 'alt' | 'shift';
+  enabled?: () => boolean;
+}
+
+@Injectable({ providedIn: 'root' })
+export class KeyboardShortcutsService {
+  private shortcuts = new Map<string, KeyboardShortcut>();
+  private keyPress$ = new Subject<KeyboardEvent>();
+  private enabled = true;
+
+  constructor() {
+    this.setupKeyboardListener();
+  }
+
+  private setupKeyboardListener(): void {
+    fromEvent<KeyboardEvent>(document, 'keydown')
+      .pipe(
+        filter(() => this.enabled),
+        filter(event => !this.isInputElement(event.target as Element)),
+        filter(event => !event.repeat)
+      )
+      .subscribe(event => this.handleKeyPress(event));
+  }
+
+  private isInputElement(element: Element): boolean {
+    const tagName = element.tagName.toLowerCase();
+    return ['input', 'textarea', 'select'].includes(tagName) ||
+           element.getAttribute('contenteditable') === 'true';
+  }
+
+  private handleKeyPress(event: KeyboardEvent): void {
+    const key = this.normalizeKey(event);
+    const shortcut = this.shortcuts.get(key);
+
+    if (shortcut && (!shortcut.enabled || shortcut.enabled())) {
+      event.preventDefault();
+      shortcut.action();
+      this.keyPress$.next(event);
+    }
+  }
+
+  private normalizeKey(event: KeyboardEvent): string {
+    const parts: string[] = [];
+    if (event.ctrlKey) parts.push('ctrl');
+    if (event.altKey) parts.push('alt');
+    if (event.shiftKey) parts.push('shift');
+    parts.push(event.key.toLowerCase());
+    return parts.join('+');
+  }
+
+  register(shortcut: KeyboardShortcut): void {
+    const key = shortcut.requiresModifier
+      ? `${shortcut.requiresModifier}+${shortcut.key.toLowerCase()}`
+      : shortcut.key.toLowerCase();
+
+    this.shortcuts.set(key, shortcut);
+  }
+
+  unregister(key: string): void {
+    this.shortcuts.delete(key.toLowerCase());
+  }
+
+  getAll(): KeyboardShortcut[] {
+    return Array.from(this.shortcuts.values());
+  }
+
+  getByCategory(category: KeyboardShortcut['category']): KeyboardShortcut[] {
+    return this.getAll().filter(s => s.category === category);
+  }
+
+  setEnabled(enabled: boolean): void {
+    this.enabled = enabled;
+  }
+
+  onKeyPress(): Observable<KeyboardEvent> {
+    return this.keyPress$.asObservable();
+  }
+}
+```
+
+### 3.2 Triage Shortcuts Registration
+
+```typescript
+// File: src/Web/StellaOps.Web/src/app/features/triage/services/triage-shortcuts.service.ts
+
+import { Injectable, inject } from '@angular/core';
+import { KeyboardShortcutsService } from './keyboard-shortcuts.service';
+import { TriageWorkspaceStore } from '../stores/triage-workspace.store';
+import { ClipboardService } from '@shared/services/clipboard.service';
+import { ToastService } from '@shared/services/toast.service';
+
+@Injectable()
+export class TriageShortcutsService {
+  private keyboardService = inject(KeyboardShortcutsService);
+  private store = inject(TriageWorkspaceStore);
+  private clipboard = inject(ClipboardService);
+  private toast = inject(ToastService);
+
+  initialize(): void {
+    // Navigation shortcuts
+    this.keyboardService.register({
+      key: 'j',
+      description: 'Jump to first incomplete evidence pane',
+      category: 'navigation',
+      action: () => this.jumpToIncompleteEvidence()
+    });
+
+    this.keyboardService.register({
+      key: '/',
+      description: 'Search within graph (node/func/package)',
+      category: 'navigation',
+      action: () => this.openGraphSearch()
+    });
+
+    this.keyboardService.register({
+      key: 'r',
+      description: 'Toggle reachability view',
+      category: 'navigation',
+      action: () => this.toggleReachabilityView()
+    });
+
+    this.keyboardService.register({
+      key: 's',
+      description: 'Deterministic sort',
+      category: 'navigation',
+      action: () => this.applySortOrder()
+    });
+
+    // Decision shortcuts
+    this.keyboardService.register({
+      key: 'a',
+      description: 'Set VEX status: Affected',
+      category: 'decision',
+      action: () => this.setVexStatus('affected'),
+      enabled: () => this.store.hasSelectedAlert()
+    });
+
+    this.keyboardService.register({
+      key: 'n',
+      description: 'Set VEX status: Not affected',
+      category: 'decision',
+      action: () => this.setVexStatus('not_affected'),
+      enabled: () => this.store.hasSelectedAlert()
+    });
+
+    this.keyboardService.register({
+      key: 'u',
+      description: 'Set VEX status: Under investigation',
+      category: 'decision',
+      action: () => this.setVexStatus('under_investigation'),
+      enabled: () => this.store.hasSelectedAlert()
+    });
+
+    // Utility shortcuts
+    this.keyboardService.register({
+      key: 'y',
+      description: 'Copy DSSE attestation',
+      category: 'utility',
+      action: () => this.copyDsseAttestation(),
+      enabled: () => this.store.hasSelectedAlert()
+    });
+
+    this.keyboardService.register({
+      key: '?',
+      description: 'Show keyboard help',
+      category: 'utility',
+      action: () => this.showHelp()
+    });
+
+    // Arrow navigation
+    this.keyboardService.register({
+      key: 'ArrowDown',
+      description: 'Next alert',
+      category: 'navigation',
+      action: () => this.store.selectNextAlert()
+    });
+
+    this.keyboardService.register({
+      key: 'ArrowUp',
+      description: 'Previous alert',
+      category: 'navigation',
+      action: () => this.store.selectPreviousAlert()
+    });
+
+    this.keyboardService.register({
+      key: 'Enter',
+      description: 'Open selected alert',
+      category: 'navigation',
+      action: () => this.store.openSelectedAlert()
+    });
+
+    this.keyboardService.register({
+      key: 'Escape',
+      description: 'Close drawer/modal',
+      category: 'navigation',
+      action: () => this.store.closeDrawer()
+    });
+  }
+
+  private jumpToIncompleteEvidence(): void {
+    const incomplete = this.store.getFirstIncompleteEvidencePane();
+    if (incomplete) {
+      this.store.focusEvidencePane(incomplete);
+      this.toast.info(`Jumped to ${incomplete} evidence`);
+    } else {
+      this.toast.info('All evidence complete');
+    }
+  }
+
+  private openGraphSearch(): void {
+    this.store.openGraphSearch();
+  }
+
+  private toggleReachabilityView(): void {
+    const views = ['path-list', 'compact-graph', 'textual-proof'] as const;
+    const current = this.store.reachabilityView();
+    const currentIndex = views.indexOf(current);
+    const nextIndex = (currentIndex + 1) % views.length;
+    this.store.setReachabilityView(views[nextIndex]);
+    this.toast.info(`View: ${views[nextIndex].replace('-', ' ')}`);
+  }
+
+  private applySortOrder(): void {
+    // Deterministic sort order per advisory
+    this.store.applySortOrder([
+      'reachability',
+      'severity',
+      'age',
+      'component'
+    ]);
+    this.toast.info('Applied deterministic sort');
+  }
+
+  private setVexStatus(status: 'affected' | 'not_affected' | 'under_investigation'): void {
+    const alert = this.store.selectedAlert();
+    if (!alert) return;
+
+    this.store.openDecisionDrawer(status);
+  }
+
+  private async copyDsseAttestation(): Promise<void> {
+    const alert = this.store.selectedAlert();
+    if (!alert?.evidence?.provenance?.dsseEnvelope) {
+      this.toast.warning('No DSSE attestation available');
+      return;
+    }
+
+    const dsse = JSON.stringify(alert.evidence.provenance.dsseEnvelope, null, 2);
+    await this.clipboard.copy(dsse);
+    this.toast.success('DSSE attestation copied to clipboard');
+  }
+
+  private showHelp(): void {
+    this.store.showKeyboardHelp();
+  }
+
+  destroy(): void {
+    ['j', '/', 'r', 's', 'a', 'n', 'u', 'y', '?', 'ArrowDown', 'ArrowUp', 'Enter', 'Escape']
+      .forEach(key => this.keyboardService.unregister(key));
+  }
+}
+```
+
+### 3.3 Help Overlay Component
+
+```typescript
+// File: src/Web/StellaOps.Web/src/app/features/triage/components/keyboard-help/keyboard-help.component.ts
+
+import { Component, inject } from '@angular/core';
+import { CommonModule } from '@angular/common';
+import { KeyboardShortcutsService, KeyboardShortcut } from '../../services/keyboard-shortcuts.service';
+
+@Component({
+  selector: 'app-keyboard-help',
+  standalone: true,
+  imports: [CommonModule],
+  template: `
+    <div class="keyboard-help-overlay" (click)="close()" (keydown.escape)="close()">
+      <div class="keyboard-help-modal" (click)="$event.stopPropagation()">
+        <header>
+          <h2>Keyboard Shortcuts</h2>
+          <button class="close-btn" (click)="close()" aria-label="Close">
+            <span aria-hidden="true">&times;</span>
+          </button>
+        </header>
+
+        <section *ngFor="let category of categories">
+          <h3>{{ category.title }}</h3>
+          <div class="shortcuts-grid">
+            <div class="shortcut" *ngFor="let shortcut of getByCategory(category.key)">
+              <kbd>{{ formatKey(shortcut.key) }}</kbd>
+              <span>{{ shortcut.description }}</span>
+            </div>
+          </div>
+        </section>
+
+        <footer>
+          <p>Press <kbd>?</kbd> to toggle this help</p>
+        </footer>
+      </div>
+    </div>
+  `,
+  styles: [`
+    .keyboard-help-overlay {
+      position: fixed;
+      inset: 0;
+      background: rgba(0, 0, 0, 0.5);
+      display: flex;
+      align-items: center;
+      justify-content: center;
+      z-index: 1000;
+    }
+
+    .keyboard-help-modal {
+      background: var(--surface-color);
+      border-radius: 8px;
+      padding: 24px;
+      max-width: 600px;
+      width: 90%;
+      max-height: 80vh;
+      overflow-y: auto;
+    }
+
+    header {
+      display: flex;
+      justify-content: space-between;
+      align-items: center;
+      margin-bottom: 24px;
+    }
+
+    h2 { margin: 0; }
+
+    .close-btn {
+      background: none;
+      border: none;
+      font-size: 24px;
+      cursor: pointer;
+      padding: 4px 8px;
+    }
+
+    section { margin-bottom: 24px; }
+
+    h3 {
+      text-transform: capitalize;
+      margin-bottom: 12px;
+      color: var(--text-secondary);
+    }
+
+    .shortcuts-grid {
+      display: grid;
+      gap: 8px;
+    }
+
+    .shortcut {
+      display: flex;
+      align-items: center;
+      gap: 12px;
+    }
+
+    kbd {
+      background: var(--surface-variant);
+      border: 1px solid var(--border-color);
+      border-radius: 4px;
+      padding: 4px 8px;
+      font-family: monospace;
+      font-size: 12px;
+      min-width: 32px;
+      text-align: center;
+    }
+
+    footer {
+      margin-top: 24px;
+      text-align: center;
+      color: var(--text-secondary);
+    }
+  `]
+})
+export class KeyboardHelpComponent {
+  private keyboardService = inject(KeyboardShortcutsService);
+
+  categories = [
+    { key: 'navigation', title: 'Navigation' },
+    { key: 'decision', title: 'Decisions' },
+    { key: 'utility', title: 'Utility' }
+  ] as const;
+
+  getByCategory(category: KeyboardShortcut['category']): KeyboardShortcut[] {
+    return this.keyboardService.getByCategory(category);
+  }
+
+  formatKey(key: string): string {
+    const keyMap: Record<string, string> = {
+      'arrowdown': '↓',
+      'arrowup': '↑',
+      'arrowleft': '←',
+      'arrowright': '→',
+      'enter': '↵',
+      'escape': 'Esc',
+      '/': '/',
+      '?': '?'
+    };
+    return keyMap[key.toLowerCase()] ?? key.toUpperCase();
+  }
+
+  close(): void {
+    // Emit close event or call store method
+  }
+}
+```
+
+---
+
+## 4. DELIVERY TRACKER
+
+| # | Task | Status | Assignee | Notes |
+|---|------|--------|----------|-------|
+| 1 | Create `KeyboardShortcutsService` | DONE | | Per §3.1 |
+| 2 | Create `TriageShortcutsService` | DONE | | Per §3.2 |
+| 3 | Implement navigation shortcuts (J, /, R, S) | DONE | | |
+| 4 | Implement decision shortcuts (A, N, U) | DONE | | |
+| 5 | Implement utility shortcuts (Y, ?) | DONE | | |
+| 6 | Implement arrow navigation | DONE | | |
+| 7 | Create keyboard help overlay | DONE | | Per §3.3 |
+| 8 | Add accessibility attributes | DONE | | ARIA |
+| 9 | Handle input field focus | DONE | | Disable when typing |
+| 10 | Write unit tests | DONE | | |
+| 11 | Document shortcuts in user guide | DONE | | |
+
+---
+
+## 5. ACCEPTANCE CRITERIA
+
+### 5.1 Shortcut Requirements
+
+- [x] All 7 advisory shortcuts implemented
+- [x] Shortcuts disabled when typing in inputs
+- [x] Help overlay shows all shortcuts
+- [x] Shortcuts work across all triage views
+
+### 5.2 Accessibility Requirements
+
+- [x] Standard keyboard navigation patterns
+- [x] ARIA labels on interactive elements
+- [x] Focus management correct
+
+---
+
+## 6. REFERENCES
+
+- Advisory: `14-Dec-2025 - Triage and Unknowns Technical Reference.md` §4
+- Existing: `src/Web/StellaOps.Web/src/app/features/triage/`

docs/implplan/archived/SPRINT_4602_0001_0001_decision_drawer_evidence_tab.md

@@ -0,0 +1,751 @@
+# SPRINT_4602_0001_0001 - Decision Drawer & Evidence Tab UX
+
+**Status:** DONE
+**Priority:** P2 - MEDIUM
+**Module:** Web (Angular)
+**Working Directory:** `src/Web/StellaOps.Web/src/app/features/triage/`
+**Estimated Effort:** Medium
+**Dependencies:** SPRINT_4601 (Keyboard Shortcuts)
+
+---
+
+## 1. OBJECTIVE
+
+Enhance the triage UI with a pinned decision drawer and evidence-first tab ordering for improved workflow efficiency.
+
+### Goals
+
+1. **Decision drawer** - Pinned right panel for VEX decisions
+2. **Evidence tab default** - Open alerts to Evidence tab, not Details
+3. **Proof pills** - Top strip showing evidence availability (Reachability/Call-stack/Provenance)
+4. **Diff tab** - SBOM/VEX delta view
+5. **Activity tab** - Immutable audit log with export
+
+---
+
+## 2. BACKGROUND
+
+### 2.1 Current State
+
+- `vex-decision-modal.component.ts` exists as modal dialog
+- Alerts open to details tab
+- No unified evidence pills
+- No diff visualization
+- Basic activity/audit view
+
+### 2.2 Target State
+
+Per advisory §5:
+
+**UX Flow:**
+1. **Alert Row**: TTFS timer, Reachability badge, Decision state, Diff-dot
+2. **Open Alert → Evidence Tab (Not Details)**
+3. **Top strip**: 3 proof pills (Reachability / Call-stack / Provenance )
+4. **Decision Drawer (Pinned Right)**: VEX/CSAF radio, Reason presets, Audit summary
+5. **Diff Tab**: SBOM/VEX delta grouped by "meaningful risk shift"
+6. **Activity Tab**: Immutable audit log with signed bundle export
+
+---
+
+## 3. TECHNICAL DESIGN
+
+### 3.1 Evidence Pills Component
+
+```typescript
+// File: src/Web/StellaOps.Web/src/app/features/triage/components/evidence-pills/evidence-pills.component.ts
+
+import { Component, Input, computed } from '@angular/core';
+import { CommonModule } from '@angular/common';
+import { EvidenceStatus } from '@features/triage/models/evidence.model';
+
+@Component({
+  selector: 'app-evidence-pills',
+  standalone: true,
+  imports: [CommonModule],
+  template: `
+    <div class="evidence-pills">
+      <div class="pill"
+           [class.available]="reachabilityStatus() === 'available'"
+           [class.loading]="reachabilityStatus() === 'loading'"
+           [class.unavailable]="reachabilityStatus() === 'unavailable'"
+           (click)="onPillClick('reachability')">
+        <span class="icon">{{ getIcon(reachabilityStatus()) }}</span>
+        <span class="label">Reachability</span>
+      </div>
+
+      <div class="pill"
+           [class.available]="callstackStatus() === 'available'"
+           [class.loading]="callstackStatus() === 'loading'"
+           [class.unavailable]="callstackStatus() === 'unavailable'"
+           (click)="onPillClick('callstack')">
+        <span class="icon">{{ getIcon(callstackStatus()) }}</span>
+        <span class="label">Call-stack</span>
+      </div>
+
+      <div class="pill"
+           [class.available]="provenanceStatus() === 'available'"
+           [class.loading]="provenanceStatus() === 'loading'"
+           [class.unavailable]="provenanceStatus() === 'unavailable'"
+           (click)="onPillClick('provenance')">
+        <span class="icon">{{ getIcon(provenanceStatus()) }}</span>
+        <span class="label">Provenance</span>
+      </div>
+
+      <div class="completeness-badge">
+        {{ completenessScore() }}/4
+      </div>
+    </div>
+  `,
+  styles: [`
+    .evidence-pills {
+      display: flex;
+      gap: 8px;
+      align-items: center;
+      padding: 8px 0;
+      border-bottom: 1px solid var(--border-color);
+    }
+
+    .pill {
+      display: flex;
+      align-items: center;
+      gap: 4px;
+      padding: 4px 12px;
+      border-radius: 16px;
+      font-size: 13px;
+      cursor: pointer;
+      transition: all 0.2s;
+      background: var(--surface-variant);
+    }
+
+    .pill.available {
+      background: var(--success-bg);
+      color: var(--success-text);
+    }
+
+    .pill.loading {
+      background: var(--warning-bg);
+      color: var(--warning-text);
+    }
+
+    .pill.unavailable {
+      background: var(--error-bg);
+      color: var(--error-text);
+      opacity: 0.7;
+    }
+
+    .pill:hover {
+      transform: translateY(-1px);
+      box-shadow: 0 2px 4px rgba(0,0,0,0.1);
+    }
+
+    .completeness-badge {
+      margin-left: auto;
+      font-weight: 600;
+      color: var(--text-secondary);
+    }
+  `]
+})
+export class EvidencePillsComponent {
+  @Input() evidence?: {
+    reachability?: { status: EvidenceStatus };
+    callstack?: { status: EvidenceStatus };
+    provenance?: { status: EvidenceStatus };
+    vex?: { status: EvidenceStatus };
+  };
+
+  reachabilityStatus = computed(() => this.evidence?.reachability?.status ?? 'unavailable');
+  callstackStatus = computed(() => this.evidence?.callstack?.status ?? 'unavailable');
+  provenanceStatus = computed(() => this.evidence?.provenance?.status ?? 'unavailable');
+
+  completenessScore = computed(() => {
+    let score = 0;
+    if (this.evidence?.reachability?.status === 'available') score++;
+    if (this.evidence?.callstack?.status === 'available') score++;
+    if (this.evidence?.provenance?.status === 'available') score++;
+    if (this.evidence?.vex?.status === 'available') score++;
+    return score;
+  });
+
+  getIcon(status: EvidenceStatus): string {
+    switch (status) {
+      case 'available': return '';
+      case 'loading': return '';
+      case 'unavailable': return '';
+      case 'error': return '';
+      default: return '?';
+    }
+  }
+
+  onPillClick(type: string): void {
+    // Expand inline evidence panel
+  }
+}
+```
+
+### 3.2 Decision Drawer Component
+
+```typescript
+// File: src/Web/StellaOps.Web/src/app/features/triage/components/decision-drawer/decision-drawer.component.ts
+
+import { Component, Input, Output, EventEmitter, inject } from '@angular/core';
+import { CommonModule } from '@angular/common';
+import { FormsModule } from '@angular/forms';
+import { Alert } from '@features/triage/models/alert.model';
+
+export interface DecisionFormData {
+  status: 'affected' | 'not_affected' | 'under_investigation';
+  reasonCode: string;
+  reasonText?: string;
+}
+
+@Component({
+  selector: 'app-decision-drawer',
+  standalone: true,
+  imports: [CommonModule, FormsModule],
+  template: `
+    <aside class="decision-drawer" [class.open]="isOpen">
+      <header>
+        <h3>Record Decision</h3>
+        <button class="close-btn" (click)="close.emit()" aria-label="Close">
+          &times;
+        </button>
+      </header>
+
+      <section class="status-selection">
+        <h4>VEX Status</h4>
+        <div class="radio-group">
+          <label class="radio-option" [class.selected]="formData.status === 'affected'">
+            <input type="radio" name="status" value="affected"
+                   [(ngModel)]="formData.status"
+                   (keydown.a)="formData.status = 'affected'">
+            <span class="key-hint">A</span>
+            <span>Affected</span>
+          </label>
+
+          <label class="radio-option" [class.selected]="formData.status === 'not_affected'">
+            <input type="radio" name="status" value="not_affected"
+                   [(ngModel)]="formData.status"
+                   (keydown.n)="formData.status = 'not_affected'">
+            <span class="key-hint">N</span>
+            <span>Not Affected</span>
+          </label>
+
+          <label class="radio-option" [class.selected]="formData.status === 'under_investigation'">
+            <input type="radio" name="status" value="under_investigation"
+                   [(ngModel)]="formData.status"
+                   (keydown.u)="formData.status = 'under_investigation'">
+            <span class="key-hint">U</span>
+            <span>Under Investigation</span>
+          </label>
+        </div>
+      </section>
+
+      <section class="reason-selection">
+        <h4>Reason</h4>
+        <select [(ngModel)]="formData.reasonCode" class="reason-select">
+          <option value="">Select reason...</option>
+          <optgroup label="Not Affected Reasons">
+            <option value="component_not_present">Component not present</option>
+            <option value="vulnerable_code_not_present">Vulnerable code not present</option>
+            <option value="vulnerable_code_not_in_execute_path">Vulnerable code not in execute path</option>
+            <option value="vulnerable_code_cannot_be_controlled_by_adversary">Vulnerable code cannot be controlled</option>
+            <option value="inline_mitigations_already_exist">Inline mitigations exist</option>
+          </optgroup>
+          <optgroup label="Affected Reasons">
+            <option value="vulnerable_code_reachable">Vulnerable code is reachable</option>
+            <option value="exploit_available">Exploit available</option>
+          </optgroup>
+          <optgroup label="Investigation">
+            <option value="requires_further_analysis">Requires further analysis</option>
+            <option value="waiting_for_vendor">Waiting for vendor response</option>
+          </optgroup>
+        </select>
+
+        <textarea
+          [(ngModel)]="formData.reasonText"
+          placeholder="Additional notes (optional)"
+          rows="3"
+          class="reason-text">
+        </textarea>
+      </section>
+
+      <section class="audit-summary">
+        <h4>Audit Summary</h4>
+        <dl class="summary-list">
+          <dt>Alert ID</dt>
+          <dd>{{ alert?.id }}</dd>
+
+          <dt>Artifact</dt>
+          <dd class="truncate">{{ alert?.artifactId }}</dd>
+
+          <dt>Evidence Hash</dt>
+          <dd class="hash">{{ evidenceHash }}</dd>
+
+          <dt>Policy Version</dt>
+          <dd>{{ policyVersion }}</dd>
+        </dl>
+      </section>
+
+      <footer>
+        <button class="btn btn-secondary" (click)="close.emit()">
+          Cancel
+        </button>
+        <button class="btn btn-primary"
+                [disabled]="!isValid()"
+                (click)="submitDecision()">
+          Record Decision
+        </button>
+      </footer>
+    </aside>
+  `,
+  styles: [`
+    .decision-drawer {
+      position: fixed;
+      right: 0;
+      top: 0;
+      bottom: 0;
+      width: 360px;
+      background: var(--surface-color);
+      border-left: 1px solid var(--border-color);
+      box-shadow: -4px 0 16px rgba(0,0,0,0.1);
+      display: flex;
+      flex-direction: column;
+      transform: translateX(100%);
+      transition: transform 0.3s ease;
+      z-index: 100;
+    }
+
+    .decision-drawer.open {
+      transform: translateX(0);
+    }
+
+    header {
+      display: flex;
+      justify-content: space-between;
+      align-items: center;
+      padding: 16px;
+      border-bottom: 1px solid var(--border-color);
+    }
+
+    h3 { margin: 0; }
+
+    .close-btn {
+      background: none;
+      border: none;
+      font-size: 24px;
+      cursor: pointer;
+      padding: 4px 8px;
+    }
+
+    section {
+      padding: 16px;
+      border-bottom: 1px solid var(--border-color);
+    }
+
+    h4 {
+      margin: 0 0 12px 0;
+      font-size: 14px;
+      color: var(--text-secondary);
+    }
+
+    .radio-group {
+      display: flex;
+      flex-direction: column;
+      gap: 8px;
+    }
+
+    .radio-option {
+      display: flex;
+      align-items: center;
+      gap: 8px;
+      padding: 12px;
+      border: 1px solid var(--border-color);
+      border-radius: 8px;
+      cursor: pointer;
+      transition: all 0.2s;
+    }
+
+    .radio-option.selected {
+      border-color: var(--primary-color);
+      background: var(--primary-bg);
+    }
+
+    .radio-option input {
+      display: none;
+    }
+
+    .key-hint {
+      display: inline-block;
+      width: 24px;
+      height: 24px;
+      line-height: 24px;
+      text-align: center;
+      background: var(--surface-variant);
+      border-radius: 4px;
+      font-size: 12px;
+      font-weight: 600;
+    }
+
+    .reason-select {
+      width: 100%;
+      padding: 8px;
+      border: 1px solid var(--border-color);
+      border-radius: 4px;
+      margin-bottom: 8px;
+    }
+
+    .reason-text {
+      width: 100%;
+      padding: 8px;
+      border: 1px solid var(--border-color);
+      border-radius: 4px;
+      resize: vertical;
+    }
+
+    .summary-list {
+      display: grid;
+      grid-template-columns: auto 1fr;
+      gap: 4px 8px;
+      font-size: 13px;
+    }
+
+    .summary-list dt {
+      color: var(--text-secondary);
+    }
+
+    .truncate {
+      overflow: hidden;
+      text-overflow: ellipsis;
+      white-space: nowrap;
+    }
+
+    .hash {
+      font-family: monospace;
+      font-size: 11px;
+    }
+
+    footer {
+      margin-top: auto;
+      padding: 16px;
+      display: flex;
+      gap: 8px;
+      justify-content: flex-end;
+    }
+
+    .btn {
+      padding: 8px 16px;
+      border-radius: 4px;
+      cursor: pointer;
+    }
+
+    .btn-primary {
+      background: var(--primary-color);
+      color: white;
+      border: none;
+    }
+
+    .btn-secondary {
+      background: transparent;
+      border: 1px solid var(--border-color);
+    }
+
+    .btn:disabled {
+      opacity: 0.5;
+      cursor: not-allowed;
+    }
+  `]
+})
+export class DecisionDrawerComponent {
+  @Input() alert?: Alert;
+  @Input() isOpen = false;
+  @Input() evidenceHash = '';
+  @Input() policyVersion = '';
+
+  @Output() close = new EventEmitter<void>();
+  @Output() decisionSubmit = new EventEmitter<DecisionFormData>();
+
+  formData: DecisionFormData = {
+    status: 'under_investigation',
+    reasonCode: ''
+  };
+
+  isValid(): boolean {
+    return !!this.formData.status && !!this.formData.reasonCode;
+  }
+
+  submitDecision(): void {
+    if (this.isValid()) {
+      this.decisionSubmit.emit(this.formData);
+    }
+  }
+}
+```
+
+### 3.3 Alert Detail Layout Update
+
+```typescript
+// File: src/Web/StellaOps.Web/src/app/features/triage/components/alert-detail/alert-detail.component.ts
+
+import { Component, Input, inject, OnInit } from '@angular/core';
+import { CommonModule } from '@angular/common';
+import { Alert } from '@features/triage/models/alert.model';
+import { EvidencePillsComponent } from '../evidence-pills/evidence-pills.component';
+import { DecisionDrawerComponent } from '../decision-drawer/decision-drawer.component';
+import { TriageWorkspaceStore } from '../../stores/triage-workspace.store';
+
+@Component({
+  selector: 'app-alert-detail',
+  standalone: true,
+  imports: [CommonModule, EvidencePillsComponent, DecisionDrawerComponent],
+  template: `
+    <div class="alert-detail-container">
+      <div class="main-content">
+        <!-- Evidence Pills (Top Strip) -->
+        <app-evidence-pills [evidence]="alert?.evidence"></app-evidence-pills>
+
+        <!-- Tab Navigation -->
+        <nav class="tab-nav">
+          <button
+            *ngFor="let tab of tabs"
+            class="tab"
+            [class.active]="activeTab === tab.id"
+            (click)="setActiveTab(tab.id)">
+            {{ tab.label }}
+            <span *ngIf="tab.badge" class="badge">{{ tab.badge }}</span>
+          </button>
+        </nav>
+
+        <!-- Tab Content -->
+        <div class="tab-content">
+          <ng-container [ngSwitch]="activeTab">
+            <!-- Evidence Tab (Default) -->
+            <div *ngSwitchCase="'evidence'" class="evidence-tab">
+              <section class="evidence-section" *ngIf="alert?.evidence?.reachability">
+                <h4>Reachability Proof</h4>
+                <!-- Reachability content -->
+              </section>
+
+              <section class="evidence-section" *ngIf="alert?.evidence?.callstack">
+                <h4>Call Stack</h4>
+                <!-- Call stack content -->
+              </section>
+
+              <section class="evidence-section" *ngIf="alert?.evidence?.provenance">
+                <h4>Provenance</h4>
+                <!-- Provenance content -->
+              </section>
+            </div>
+
+            <!-- Diff Tab -->
+            <div *ngSwitchCase="'diff'" class="diff-tab">
+              <h4>Risk Shift Summary</h4>
+              <!-- SBOM/VEX diff content -->
+            </div>
+
+            <!-- Activity Tab -->
+            <div *ngSwitchCase="'activity'" class="activity-tab">
+              <header class="activity-header">
+                <h4>Audit Timeline</h4>
+                <button class="export-btn" (click)="exportAuditBundle()">
+                  Export Signed Bundle
+                </button>
+              </header>
+              <!-- Immutable audit log -->
+            </div>
+
+            <!-- Details Tab -->
+            <div *ngSwitchDefault class="details-tab">
+              <!-- Alert details -->
+            </div>
+          </ng-container>
+        </div>
+      </div>
+
+      <!-- Decision Drawer (Pinned Right) -->
+      <app-decision-drawer
+        [alert]="alert"
+        [isOpen]="isDrawerOpen"
+        [evidenceHash]="alert?.evidence?.hashes?.combinedHash ?? ''"
+        (close)="closeDrawer()"
+        (decisionSubmit)="onDecisionSubmit($event)">
+      </app-decision-drawer>
+    </div>
+  `,
+  styles: [`
+    .alert-detail-container {
+      display: flex;
+      height: 100%;
+    }
+
+    .main-content {
+      flex: 1;
+      display: flex;
+      flex-direction: column;
+      overflow: hidden;
+      padding-right: 16px;
+    }
+
+    .tab-nav {
+      display: flex;
+      gap: 4px;
+      border-bottom: 1px solid var(--border-color);
+      padding: 0 8px;
+    }
+
+    .tab {
+      padding: 12px 16px;
+      border: none;
+      background: none;
+      cursor: pointer;
+      color: var(--text-secondary);
+      border-bottom: 2px solid transparent;
+      transition: all 0.2s;
+    }
+
+    .tab.active {
+      color: var(--primary-color);
+      border-bottom-color: var(--primary-color);
+    }
+
+    .tab:hover:not(.active) {
+      color: var(--text-primary);
+    }
+
+    .badge {
+      margin-left: 4px;
+      padding: 2px 6px;
+      border-radius: 10px;
+      font-size: 11px;
+      background: var(--primary-bg);
+      color: var(--primary-color);
+    }
+
+    .tab-content {
+      flex: 1;
+      overflow: auto;
+      padding: 16px;
+    }
+
+    .evidence-section {
+      margin-bottom: 24px;
+      padding: 16px;
+      background: var(--surface-variant);
+      border-radius: 8px;
+    }
+
+    .evidence-section h4 {
+      margin: 0 0 12px 0;
+    }
+
+    .activity-header {
+      display: flex;
+      justify-content: space-between;
+      align-items: center;
+      margin-bottom: 16px;
+    }
+
+    .export-btn {
+      padding: 8px 12px;
+      border: 1px solid var(--border-color);
+      background: none;
+      border-radius: 4px;
+      cursor: pointer;
+    }
+  `]
+})
+export class AlertDetailComponent implements OnInit {
+  @Input() alert?: Alert;
+
+  private store = inject(TriageWorkspaceStore);
+
+  tabs = [
+    { id: 'evidence', label: 'Evidence' },
+    { id: 'diff', label: 'Diff', badge: null },
+    { id: 'activity', label: 'Activity' },
+    { id: 'details', label: 'Details' }
+  ];
+
+  // Default to Evidence tab per advisory
+  activeTab = 'evidence';
+  isDrawerOpen = false;
+
+  ngOnInit(): void {
+    // Always start on Evidence tab
+    this.activeTab = 'evidence';
+  }
+
+  setActiveTab(tabId: string): void {
+    this.activeTab = tabId;
+  }
+
+  openDrawer(): void {
+    this.isDrawerOpen = true;
+  }
+
+  closeDrawer(): void {
+    this.isDrawerOpen = false;
+  }
+
+  onDecisionSubmit(decision: any): void {
+    // Submit decision and close drawer
+    this.store.submitDecision(this.alert?.id, decision);
+    this.closeDrawer();
+  }
+
+  exportAuditBundle(): void {
+    this.store.exportAuditBundle(this.alert?.id);
+  }
+}
+```
+
+---
+
+## 4. DELIVERY TRACKER
+
+| # | Task | Status | Assignee | Notes |
+|---|------|--------|----------|-------|
+| 1 | Create `EvidencePillsComponent` | DONE | | evidence-pills.component.ts |
+| 2 | Create `DecisionDrawerComponent` | DONE | | decision-drawer.component.ts |
+| 3 | Create Evidence model | DONE | | evidence.model.ts with EvidenceBitset |
+| 4 | Update triage workspace layout | DONE | | Integrated into triage-workspace.component.ts |
+| 5 | Set Evidence tab as default | DONE | | activeTab default changed to 'evidence' |
+| 6 | Implement Evidence tab content | DONE | | Full evidence sections for reachability, callstack, provenance, VEX |
+| 7 | Add TTFS telemetry integration | DONE | | ttfs-telemetry.service.ts integrated |
+| 8 | Add keyboard integration | DONE | | A/N/U keys in drawer |
+| 9 | Add evidence pills integration | DONE | | Pills shown at top of detail panel |
+| 10 | Write component tests | DONE | | Added specs for EvidencePills + DecisionDrawer; fixed triage-workspace spec for TTFS DI. |
+| 11 | Update Storybook stories | DONE | | Added Storybook stories for triage evidence pills + decision drawer. |
+
+---
+
+## 5. ACCEPTANCE CRITERIA
+
+### 5.1 UI Requirements
+
+- [ ] Evidence pills show status for all 4 types
+- [ ] Decision drawer pinned to right side
+- [ ] Evidence tab is default when opening alert
+- [ ] Diff tab shows meaningful risk shifts
+- [ ] Activity tab shows immutable audit log
+
+### 5.2 UX Requirements
+
+- [ ] A/N/U keys work in drawer
+- [ ] Drawer can be closed with Escape
+- [ ] Export produces signed bundle
+
+---
+
+## 6. REFERENCES
+
+- Advisory: `14-Dec-2025 - Triage and Unknowns Technical Reference.md` §5
+- Existing: `src/Web/StellaOps.Web/src/app/features/triage/`
+
+---
+
+## 7. EXECUTION LOG
+
+| Date (UTC) | Update | Owner |
+| --- | --- | --- |
+| 2025-12-15 | Completed remaining QA tasks (component specs + Storybook stories); 
+pm test green. | UI Guild |