Implement ledger metrics for observability and add tests for Ruby packages endpoints

- Added `LedgerMetrics` class to record write latency and total events for ledger operations.
- Created comprehensive tests for Ruby packages endpoints, covering scenarios for missing inventory, successful retrieval, and identifier handling.
- Introduced `TestSurfaceSecretsScope` for managing environment variables during tests.
- Developed `ProvenanceMongoExtensions` for attaching DSSE provenance and trust information to event documents.
- Implemented `EventProvenanceWriter` and `EventWriter` classes for managing event provenance in MongoDB.
- Established MongoDB indexes for efficient querying of events based on provenance and trust.
- Added models and JSON parsing logic for DSSE provenance and trust information.

src/Concelier/__Libraries/StellaOps.Concelier.Core/Events/AdvisoryDsseMetadataResolver.cs

@@ -0,0 +1,76 @@
+using System;
+using System.Text.Json;
+using StellaOps.Concelier.Models;
+using StellaOps.Provenance.Mongo;
+
+namespace StellaOps.Concelier.Core.Events;
+
+public static class AdvisoryDsseMetadataResolver
+{
+    private static readonly string[] CandidateKinds =
+    {
+        "dsse",
+        "dsse-metadata",
+        "attestation",
+        "attestation-dsse"
+    };
+
+    public static bool TryResolve(Advisory advisory, out DsseProvenance? dsse, out TrustInfo? trust)
+    {
+        dsse = null;
+        trust = null;
+
+        if (advisory is null || advisory.Provenance.IsDefaultOrEmpty || advisory.Provenance.Length == 0)
+        {
+            return false;
+        }
+
+        foreach (var entry in advisory.Provenance)
+        {
+            if (!IsCandidateKind(entry.Kind) || string.IsNullOrWhiteSpace(entry.Value))
+            {
+                continue;
+            }
+
+            try
+            {
+                using var document = JsonDocument.Parse(entry.Value);
+                (dsse, trust) = ProvenanceJsonParser.Parse(document.RootElement);
+                if (dsse is not null && trust is not null)
+                {
+                    return true;
+                }
+            }
+            catch (JsonException)
+            {
+                // Ignore malformed payloads; other provenance entries may contain valid DSSE metadata.
+            }
+            catch (InvalidOperationException)
+            {
+                // Same as above – fall through to remaining provenance entries.
+            }
+        }
+
+        dsse = null;
+        trust = null;
+        return false;
+    }
+
+    private static bool IsCandidateKind(string? kind)
+    {
+        if (string.IsNullOrWhiteSpace(kind))
+        {
+            return false;
+        }
+
+        foreach (var candidate in CandidateKinds)
+        {
+            if (string.Equals(candidate, kind, StringComparison.OrdinalIgnoreCase))
+            {
+                return true;
+            }
+        }
+
+        return false;
+    }
+}

src/Concelier/__Libraries/StellaOps.Concelier.Core/Events/AdvisoryEventContracts.cs

@@ -1,30 +1,35 @@
 using System;
 using System.Collections.Immutable;
-using System.Text.Json;
-using StellaOps.Concelier.Models;
+using System.Text.Json;
+using StellaOps.Concelier.Models;
+using StellaOps.Provenance.Mongo;
 
 namespace StellaOps.Concelier.Core.Events;
 
 /// <summary>
 /// Input payload for appending a canonical advisory statement to the event log.
 /// </summary>
-public sealed record AdvisoryStatementInput(
-    string VulnerabilityKey,
-    Advisory Advisory,
-    DateTimeOffset AsOf,
-    IReadOnlyCollection<Guid> InputDocumentIds,
-    Guid? StatementId = null,
-    string? AdvisoryKey = null);
+public sealed record AdvisoryStatementInput(
+    string VulnerabilityKey,
+    Advisory Advisory,
+    DateTimeOffset AsOf,
+    IReadOnlyCollection<Guid> InputDocumentIds,
+    Guid? StatementId = null,
+    string? AdvisoryKey = null,
+    DsseProvenance? Provenance = null,
+    TrustInfo? Trust = null);
 
 /// <summary>
 /// Input payload for appending an advisory conflict entry aligned with an advisory statement snapshot.
 /// </summary>
-public sealed record AdvisoryConflictInput(
-    string VulnerabilityKey,
-    JsonDocument Details,
-    DateTimeOffset AsOf,
-    IReadOnlyCollection<Guid> StatementIds,
-    Guid? ConflictId = null);
+public sealed record AdvisoryConflictInput(
+    string VulnerabilityKey,
+    JsonDocument Details,
+    DateTimeOffset AsOf,
+    IReadOnlyCollection<Guid> StatementIds,
+    Guid? ConflictId = null,
+    DsseProvenance? Provenance = null,
+    TrustInfo? Trust = null);
 
 /// <summary>
 /// Append request encapsulating statement and conflict batches sharing a single persistence window.
@@ -70,24 +75,28 @@ public sealed record AdvisoryConflictSnapshot(
 /// <summary>
 /// Persistence-facing representation of an advisory statement used by repositories.
 /// </summary>
-public sealed record AdvisoryStatementEntry(
-    Guid StatementId,
-    string VulnerabilityKey,
-    string AdvisoryKey,
-    string CanonicalJson,
-    ImmutableArray<byte> StatementHash,
-    DateTimeOffset AsOf,
-    DateTimeOffset RecordedAt,
-    ImmutableArray<Guid> InputDocumentIds);
+public sealed record AdvisoryStatementEntry(
+    Guid StatementId,
+    string VulnerabilityKey,
+    string AdvisoryKey,
+    string CanonicalJson,
+    ImmutableArray<byte> StatementHash,
+    DateTimeOffset AsOf,
+    DateTimeOffset RecordedAt,
+    ImmutableArray<Guid> InputDocumentIds,
+    DsseProvenance? Provenance = null,
+    TrustInfo? Trust = null);
 
 /// <summary>
 /// Persistence-facing representation of an advisory conflict used by repositories.
 /// </summary>
-public sealed record AdvisoryConflictEntry(
-    Guid ConflictId,
-    string VulnerabilityKey,
-    string CanonicalJson,
-    ImmutableArray<byte> ConflictHash,
-    DateTimeOffset AsOf,
-    DateTimeOffset RecordedAt,
-    ImmutableArray<Guid> StatementIds);
+public sealed record AdvisoryConflictEntry(
+    Guid ConflictId,
+    string VulnerabilityKey,
+    string CanonicalJson,
+    ImmutableArray<byte> ConflictHash,
+    DateTimeOffset AsOf,
+    DateTimeOffset RecordedAt,
+    ImmutableArray<Guid> StatementIds,
+    DsseProvenance? Provenance = null,
+    TrustInfo? Trust = null);

src/Concelier/__Libraries/StellaOps.Concelier.Core/Events/AdvisoryEventLog.cs

@@ -6,10 +6,11 @@ using System.Linq;
 using System.Security.Cryptography;
 using System.Text;
 using System.Text.Encodings.Web;
-using System.Text.Json;
-using System.Threading;
-using System.Threading.Tasks;
-using StellaOps.Concelier.Models;
+using System.Text.Json;
+using System.Threading;
+using System.Threading.Tasks;
+using StellaOps.Concelier.Models;
+using StellaOps.Provenance.Mongo;
 
 namespace StellaOps.Concelier.Core.Events;
 
@@ -78,14 +79,26 @@ public sealed class AdvisoryEventLog : IAdvisoryEventLog
             .Select(ToStatementSnapshot)
             .ToImmutableArray();
 
-        var conflictSnapshots = conflicts
-            .OrderByDescending(static entry => entry.AsOf)
-            .ThenByDescending(static entry => entry.RecordedAt)
-            .Select(ToConflictSnapshot)
-            .ToImmutableArray();
-
-        return new AdvisoryReplay(normalizedKey, asOf, statementSnapshots, conflictSnapshots);
-    }
+        var conflictSnapshots = conflicts
+            .OrderByDescending(static entry => entry.AsOf)
+            .ThenByDescending(static entry => entry.RecordedAt)
+            .Select(ToConflictSnapshot)
+            .ToImmutableArray();
+
+        return new AdvisoryReplay(normalizedKey, asOf, statementSnapshots, conflictSnapshots);
+    }
+
+    public ValueTask AttachStatementProvenanceAsync(
+        Guid statementId,
+        DsseProvenance provenance,
+        TrustInfo trust,
+        CancellationToken cancellationToken)
+    {
+        ArgumentNullException.ThrowIfNull(provenance);
+        ArgumentNullException.ThrowIfNull(trust);
+
+        return _repository.AttachStatementProvenanceAsync(statementId, provenance, trust, cancellationToken);
+    }
 
     private static AdvisoryStatementSnapshot ToStatementSnapshot(AdvisoryStatementEntry entry)
     {
@@ -134,10 +147,10 @@ public sealed class AdvisoryEventLog : IAdvisoryEventLog
             ArgumentNullException.ThrowIfNull(statement.Advisory);
 
             var vulnerabilityKey = NormalizeKey(statement.VulnerabilityKey, nameof(statement.VulnerabilityKey));
-            var advisory = CanonicalJsonSerializer.Normalize(statement.Advisory);
-            var advisoryKey = string.IsNullOrWhiteSpace(statement.AdvisoryKey)
-                ? advisory.AdvisoryKey
-                : statement.AdvisoryKey.Trim();
+            var advisory = CanonicalJsonSerializer.Normalize(statement.Advisory);
+            var advisoryKey = string.IsNullOrWhiteSpace(statement.AdvisoryKey)
+                ? advisory.AdvisoryKey
+                : statement.AdvisoryKey.Trim();
 
             if (string.IsNullOrWhiteSpace(advisoryKey))
             {
@@ -149,30 +162,33 @@ public sealed class AdvisoryEventLog : IAdvisoryEventLog
                 throw new ArgumentException("Advisory key in payload must match provided advisory key.", nameof(statement));
             }
 
-            var canonicalJson = CanonicalJsonSerializer.Serialize(advisory);
-            var hashBytes = ComputeHash(canonicalJson);
-            var asOf = statement.AsOf.ToUniversalTime();
-            var inputDocuments = statement.InputDocumentIds?.Count > 0
-                ? statement.InputDocumentIds
-                    .Where(static id => id != Guid.Empty)
-                    .Distinct()
-                    .OrderBy(static id => id)
-                    .ToImmutableArray()
-                : ImmutableArray<Guid>.Empty;
-
-            entries.Add(new AdvisoryStatementEntry(
-                statement.StatementId ?? Guid.NewGuid(),
-                vulnerabilityKey,
-                advisoryKey,
-                canonicalJson,
-                hashBytes,
-                asOf,
-                recordedAt,
-                inputDocuments));
-        }
-
-        return entries;
-    }
+            var canonicalJson = CanonicalJsonSerializer.Serialize(advisory);
+            var hashBytes = ComputeHash(canonicalJson);
+            var asOf = statement.AsOf.ToUniversalTime();
+            var inputDocuments = statement.InputDocumentIds?.Count > 0
+                ? statement.InputDocumentIds
+                    .Where(static id => id != Guid.Empty)
+                    .Distinct()
+                    .OrderBy(static id => id)
+                    .ToImmutableArray()
+                : ImmutableArray<Guid>.Empty;
+            var (provenance, trust) = ResolveStatementMetadata(advisory, statement.Provenance, statement.Trust);
+
+            entries.Add(new AdvisoryStatementEntry(
+                statement.StatementId ?? Guid.NewGuid(),
+                vulnerabilityKey,
+                advisoryKey,
+                canonicalJson,
+                hashBytes,
+                asOf,
+                recordedAt,
+                inputDocuments,
+                provenance,
+                trust));
+        }
+
+        return entries;
+    }
 
     private static IReadOnlyCollection<AdvisoryConflictEntry> BuildConflictEntries(
         IReadOnlyCollection<AdvisoryConflictInput> conflicts,
@@ -202,23 +218,44 @@ public sealed class AdvisoryEventLog : IAdvisoryEventLog
                     .ToImmutableArray()
                 : ImmutableArray<Guid>.Empty;
 
-            entries.Add(new AdvisoryConflictEntry(
-                conflict.ConflictId ?? Guid.NewGuid(),
-                vulnerabilityKey,
-                canonicalJson,
-                hashBytes,
-                asOf,
-                recordedAt,
-                statementIds));
+            entries.Add(new AdvisoryConflictEntry(
+                conflict.ConflictId ?? Guid.NewGuid(),
+                vulnerabilityKey,
+                canonicalJson,
+                hashBytes,
+                asOf,
+                recordedAt,
+                statementIds,
+                conflict.Provenance,
+                conflict.Trust));
         }
 
-        return entries;
-    }
-
-    private static string NormalizeKey(string value, string parameterName)
-    {
-        if (string.IsNullOrWhiteSpace(value))
-        {
+        return entries;
+    }
+
+    private static (DsseProvenance?, TrustInfo?) ResolveStatementMetadata(
+        Advisory advisory,
+        DsseProvenance? suppliedProvenance,
+        TrustInfo? suppliedTrust)
+    {
+        if (suppliedProvenance is not null && suppliedTrust is not null)
+        {
+            return (suppliedProvenance, suppliedTrust);
+        }
+
+        if (AdvisoryDsseMetadataResolver.TryResolve(advisory, out var resolvedProvenance, out var resolvedTrust))
+        {
+            suppliedProvenance ??= resolvedProvenance;
+            suppliedTrust ??= resolvedTrust;
+        }
+
+        return (suppliedProvenance, suppliedTrust);
+    }
+
+    private static string NormalizeKey(string value, string parameterName)
+    {
+        if (string.IsNullOrWhiteSpace(value))
+        {
             throw new ArgumentException("Value must be provided.", parameterName);
         }
 

src/Concelier/__Libraries/StellaOps.Concelier.Core/Events/IAdvisoryEventLog.cs

@@ -1,15 +1,22 @@
 using System;
 using System.Threading;
-using System.Threading.Tasks;
+using System.Threading.Tasks;
+using StellaOps.Provenance.Mongo;
 
 namespace StellaOps.Concelier.Core.Events;
 
 /// <summary>
 /// High-level API for recording and replaying advisory statements with deterministic as-of queries.
 /// </summary>
-public interface IAdvisoryEventLog
-{
-    ValueTask AppendAsync(AdvisoryEventAppendRequest request, CancellationToken cancellationToken);
-
-    ValueTask<AdvisoryReplay> ReplayAsync(string vulnerabilityKey, DateTimeOffset? asOf, CancellationToken cancellationToken);
-}
+public interface IAdvisoryEventLog
+{
+    ValueTask AppendAsync(AdvisoryEventAppendRequest request, CancellationToken cancellationToken);
+
+    ValueTask<AdvisoryReplay> ReplayAsync(string vulnerabilityKey, DateTimeOffset? asOf, CancellationToken cancellationToken);
+
+    ValueTask AttachStatementProvenanceAsync(
+        Guid statementId,
+        DsseProvenance provenance,
+        TrustInfo trust,
+        CancellationToken cancellationToken);
+}

src/Concelier/__Libraries/StellaOps.Concelier.Core/Events/IAdvisoryEventRepository.cs

@@ -2,7 +2,8 @@ using System;
 using System.Collections.Generic;
 using System.Collections.Immutable;
 using System.Threading;
-using System.Threading.Tasks;
+using System.Threading.Tasks;
+using StellaOps.Provenance.Mongo;
 
 namespace StellaOps.Concelier.Core.Events;
 
@@ -19,13 +20,19 @@ public interface IAdvisoryEventRepository
         IReadOnlyCollection<AdvisoryConflictEntry> conflicts,
         CancellationToken cancellationToken);
 
-    ValueTask<IReadOnlyList<AdvisoryStatementEntry>> GetStatementsAsync(
-        string vulnerabilityKey,
-        DateTimeOffset? asOf,
-        CancellationToken cancellationToken);
-
-    ValueTask<IReadOnlyList<AdvisoryConflictEntry>> GetConflictsAsync(
-        string vulnerabilityKey,
-        DateTimeOffset? asOf,
-        CancellationToken cancellationToken);
-}
+    ValueTask<IReadOnlyList<AdvisoryStatementEntry>> GetStatementsAsync(
+        string vulnerabilityKey,
+        DateTimeOffset? asOf,
+        CancellationToken cancellationToken);
+
+    ValueTask<IReadOnlyList<AdvisoryConflictEntry>> GetConflictsAsync(
+        string vulnerabilityKey,
+        DateTimeOffset? asOf,
+        CancellationToken cancellationToken);
+
+    ValueTask AttachStatementProvenanceAsync(
+        Guid statementId,
+        DsseProvenance provenance,
+        TrustInfo trust,
+        CancellationToken cancellationToken);
+}

src/Concelier/__Libraries/StellaOps.Concelier.Core/StellaOps.Concelier.Core.csproj

@@ -19,6 +19,7 @@
     <ProjectReference Include="..\StellaOps.Concelier.RawModels\StellaOps.Concelier.RawModels.csproj" />
     <ProjectReference Include="..\StellaOps.Concelier.Normalization\StellaOps.Concelier.Normalization.csproj" />
     <ProjectReference Include="..\..\..\__Libraries\StellaOps.Ingestion.Telemetry\StellaOps.Ingestion.Telemetry.csproj" />
+    <ProjectReference Include="..\..\..\__Libraries\StellaOps.Provenance.Mongo\StellaOps.Provenance.Mongo.csproj" />
     <ProjectReference Include="../../../__Libraries/StellaOps.Plugin/StellaOps.Plugin.csproj" />
     <ProjectReference Include="../../../Aoc/__Libraries/StellaOps.Aoc/StellaOps.Aoc.csproj" />
   </ItemGroup>

src/Concelier/__Libraries/StellaOps.Concelier.Merge/Services/AdvisoryMergeService.cs

@@ -6,13 +6,14 @@ using System.Linq;
 using System.Threading;
 using System.Threading.Tasks;
 using Microsoft.Extensions.Logging;
-using StellaOps.Concelier.Core;
-using StellaOps.Concelier.Core.Events;
-using StellaOps.Concelier.Models;
-using StellaOps.Concelier.Storage.Mongo.Advisories;
-using StellaOps.Concelier.Storage.Mongo.Aliases;
-using StellaOps.Concelier.Storage.Mongo.MergeEvents;
-using System.Text.Json;
+using StellaOps.Concelier.Core;
+using StellaOps.Concelier.Core.Events;
+using StellaOps.Concelier.Models;
+using StellaOps.Concelier.Storage.Mongo.Advisories;
+using StellaOps.Concelier.Storage.Mongo.Aliases;
+using StellaOps.Concelier.Storage.Mongo.MergeEvents;
+using System.Text.Json;
+using StellaOps.Provenance.Mongo;
 
 namespace StellaOps.Concelier.Merge.Services;
 
@@ -139,39 +140,45 @@ public sealed class AdvisoryMergeService
         return new AdvisoryMergeResult(seedAdvisoryKey, canonicalKey, component, inputs, before, merged, conflictSummaries);
     }
 
-    private async Task<IReadOnlyList<MergeConflictSummary>> AppendEventLogAsync(
-        string vulnerabilityKey,
-        IReadOnlyList<Advisory> inputs,
-        Advisory merged,
-        IReadOnlyList<MergeConflictDetail> conflicts,
-        CancellationToken cancellationToken)
+    private async Task<IReadOnlyList<MergeConflictSummary>> AppendEventLogAsync(
+        string vulnerabilityKey,
+        IReadOnlyList<Advisory> inputs,
+        Advisory merged,
+        IReadOnlyList<MergeConflictDetail> conflicts,
+        CancellationToken cancellationToken)
     {
         var recordedAt = _timeProvider.GetUtcNow();
         var statements = new List<AdvisoryStatementInput>(inputs.Count + 1);
         var statementIds = new Dictionary<Advisory, Guid>(ReferenceEqualityComparer.Instance);
 
-        foreach (var advisory in inputs)
-        {
-            var statementId = Guid.NewGuid();
-            statementIds[advisory] = statementId;
-            statements.Add(new AdvisoryStatementInput(
-                vulnerabilityKey,
-                advisory,
-                DetermineAsOf(advisory, recordedAt),
-                InputDocumentIds: Array.Empty<Guid>(),
-                StatementId: statementId,
-                AdvisoryKey: advisory.AdvisoryKey));
-        }
-
-        var canonicalStatementId = Guid.NewGuid();
-        statementIds[merged] = canonicalStatementId;
-        statements.Add(new AdvisoryStatementInput(
-            vulnerabilityKey,
-            merged,
-            recordedAt,
-            InputDocumentIds: Array.Empty<Guid>(),
-            StatementId: canonicalStatementId,
-            AdvisoryKey: merged.AdvisoryKey));
+        foreach (var advisory in inputs)
+        {
+            var statementId = Guid.NewGuid();
+            statementIds[advisory] = statementId;
+            var (provenance, trust) = ResolveDsseMetadata(advisory);
+            statements.Add(new AdvisoryStatementInput(
+                vulnerabilityKey,
+                advisory,
+                DetermineAsOf(advisory, recordedAt),
+                InputDocumentIds: Array.Empty<Guid>(),
+                StatementId: statementId,
+                AdvisoryKey: advisory.AdvisoryKey,
+                Provenance: provenance,
+                Trust: trust));
+        }
+
+        var canonicalStatementId = Guid.NewGuid();
+        statementIds[merged] = canonicalStatementId;
+        var (canonicalProvenance, canonicalTrust) = ResolveDsseMetadata(merged);
+        statements.Add(new AdvisoryStatementInput(
+            vulnerabilityKey,
+            merged,
+            recordedAt,
+            InputDocumentIds: Array.Empty<Guid>(),
+            StatementId: canonicalStatementId,
+            AdvisoryKey: merged.AdvisoryKey,
+            Provenance: canonicalProvenance,
+            Trust: canonicalTrust));
 
         var conflictMaterialization = BuildConflictInputs(conflicts, vulnerabilityKey, statementIds, canonicalStatementId, recordedAt);
         var conflictInputs = conflictMaterialization.Inputs;
@@ -198,15 +205,22 @@ public sealed class AdvisoryMergeService
             }
         }
 
-        return conflictSummaries.Count == 0
-            ? Array.Empty<MergeConflictSummary>()
-            : conflictSummaries.ToArray();
-    }
-
-    private static DateTimeOffset DetermineAsOf(Advisory advisory, DateTimeOffset fallback)
-    {
-        return (advisory.Modified ?? advisory.Published ?? fallback).ToUniversalTime();
-    }
+        return conflictSummaries.Count == 0
+            ? Array.Empty<MergeConflictSummary>()
+            : conflictSummaries.ToArray();
+    }
+
+    private static (DsseProvenance?, TrustInfo?) ResolveDsseMetadata(Advisory advisory)
+    {
+        return AdvisoryDsseMetadataResolver.TryResolve(advisory, out var dsse, out var trust)
+            ? (dsse, trust)
+            : (null, null);
+    }
+
+    private static DateTimeOffset DetermineAsOf(Advisory advisory, DateTimeOffset fallback)
+    {
+        return (advisory.Modified ?? advisory.Published ?? fallback).ToUniversalTime();
+    }
 
     private static ConflictMaterialization BuildConflictInputs(
         IReadOnlyList<MergeConflictDetail> conflicts,

src/Concelier/__Libraries/StellaOps.Concelier.Storage.Mongo/Conflicts/AdvisoryConflictDocument.cs

@@ -27,31 +27,43 @@ public sealed class AdvisoryConflictDocument
     [BsonElement("statementIds")]
     public List<string> StatementIds { get; set; } = new();
 
-    [BsonElement("details")]
-    public BsonDocument Details { get; set; } = new();
+    [BsonElement("details")]
+    public BsonDocument Details { get; set; } = new();
+
+    [BsonElement("provenance")]
+    [BsonIgnoreIfNull]
+    public BsonDocument? Provenance { get; set; }
+
+    [BsonElement("trust")]
+    [BsonIgnoreIfNull]
+    public BsonDocument? Trust { get; set; }
 }
 
 internal static class AdvisoryConflictDocumentExtensions
 {
     public static AdvisoryConflictDocument FromRecord(AdvisoryConflictRecord record)
-        => new()
-        {
-            Id = record.Id.ToString(),
-            VulnerabilityKey = record.VulnerabilityKey,
-            ConflictHash = record.ConflictHash,
-            AsOf = record.AsOf.UtcDateTime,
-            RecordedAt = record.RecordedAt.UtcDateTime,
-            StatementIds = record.StatementIds.Select(static id => id.ToString()).ToList(),
-            Details = (BsonDocument)record.Details.DeepClone(),
-        };
-
-    public static AdvisoryConflictRecord ToRecord(this AdvisoryConflictDocument document)
-        => new(
-            Guid.Parse(document.Id),
-            document.VulnerabilityKey,
-            document.ConflictHash,
-            DateTime.SpecifyKind(document.AsOf, DateTimeKind.Utc),
-            DateTime.SpecifyKind(document.RecordedAt, DateTimeKind.Utc),
-            document.StatementIds.Select(static value => Guid.Parse(value)).ToList(),
-            (BsonDocument)document.Details.DeepClone());
+        => new()
+        {
+            Id = record.Id.ToString(),
+            VulnerabilityKey = record.VulnerabilityKey,
+            ConflictHash = record.ConflictHash,
+            AsOf = record.AsOf.UtcDateTime,
+            RecordedAt = record.RecordedAt.UtcDateTime,
+            StatementIds = record.StatementIds.Select(static id => id.ToString()).ToList(),
+            Details = (BsonDocument)record.Details.DeepClone(),
+            Provenance = record.Provenance is null ? null : (BsonDocument)record.Provenance.DeepClone(),
+            Trust = record.Trust is null ? null : (BsonDocument)record.Trust.DeepClone(),
+        };
+
+    public static AdvisoryConflictRecord ToRecord(this AdvisoryConflictDocument document)
+        => new(
+            Guid.Parse(document.Id),
+            document.VulnerabilityKey,
+            document.ConflictHash,
+            DateTime.SpecifyKind(document.AsOf, DateTimeKind.Utc),
+            DateTime.SpecifyKind(document.RecordedAt, DateTimeKind.Utc),
+            document.StatementIds.Select(static value => Guid.Parse(value)).ToList(),
+            (BsonDocument)document.Details.DeepClone(),
+            document.Provenance is null ? null : (BsonDocument)document.Provenance.DeepClone(),
+            document.Trust is null ? null : (BsonDocument)document.Trust.DeepClone());
 }

src/Concelier/__Libraries/StellaOps.Concelier.Storage.Mongo/Conflicts/AdvisoryConflictRecord.cs

@@ -4,11 +4,13 @@ using MongoDB.Bson;
 
 namespace StellaOps.Concelier.Storage.Mongo.Conflicts;
 
-public sealed record AdvisoryConflictRecord(
-    Guid Id,
-    string VulnerabilityKey,
-    byte[] ConflictHash,
-    DateTimeOffset AsOf,
-    DateTimeOffset RecordedAt,
-    IReadOnlyList<Guid> StatementIds,
-    BsonDocument Details);
+public sealed record AdvisoryConflictRecord(
+    Guid Id,
+    string VulnerabilityKey,
+    byte[] ConflictHash,
+    DateTimeOffset AsOf,
+    DateTimeOffset RecordedAt,
+    IReadOnlyList<Guid> StatementIds,
+    BsonDocument Details,
+    BsonDocument? Provenance = null,
+    BsonDocument? Trust = null);

src/Concelier/__Libraries/StellaOps.Concelier.Storage.Mongo/Events/MongoAdvisoryEventRepository.cs

@@ -1,224 +1,425 @@
-using System;
-using System.Collections.Generic;
-using System.Collections.Immutable;
-using System.IO;
-using System.Linq;
-using System.Text;
-using System.Text.Encodings.Web;
-using System.Text.Json;
-using System.Threading;
-using System.Threading.Tasks;
-using MongoDB.Bson;
-using StellaOps.Concelier.Core.Events;
-using StellaOps.Concelier.Models;
-using StellaOps.Concelier.Storage.Mongo.Conflicts;
-using StellaOps.Concelier.Storage.Mongo.Statements;
-
-namespace StellaOps.Concelier.Storage.Mongo.Events;
-
-public sealed class MongoAdvisoryEventRepository : IAdvisoryEventRepository
-{
-    private readonly IAdvisoryStatementStore _statementStore;
-    private readonly IAdvisoryConflictStore _conflictStore;
-
-    public MongoAdvisoryEventRepository(
-        IAdvisoryStatementStore statementStore,
-        IAdvisoryConflictStore conflictStore)
-    {
-        _statementStore = statementStore ?? throw new ArgumentNullException(nameof(statementStore));
-        _conflictStore = conflictStore ?? throw new ArgumentNullException(nameof(conflictStore));
-    }
-
-    public async ValueTask InsertStatementsAsync(
-        IReadOnlyCollection<AdvisoryStatementEntry> statements,
-        CancellationToken cancellationToken)
-    {
-        if (statements is null)
-        {
-            throw new ArgumentNullException(nameof(statements));
-        }
-
-        if (statements.Count == 0)
-        {
-            return;
-        }
-
-        var records = statements
-            .Select(static entry =>
-            {
-                var payload = BsonDocument.Parse(entry.CanonicalJson);
-                return new AdvisoryStatementRecord(
-                    entry.StatementId,
-                    entry.VulnerabilityKey,
-                    entry.AdvisoryKey,
-                    entry.StatementHash.ToArray(),
-                    entry.AsOf,
-                    entry.RecordedAt,
-                    payload,
-                    entry.InputDocumentIds.ToArray());
-            })
-            .ToList();
-
-        await _statementStore.InsertAsync(records, cancellationToken).ConfigureAwait(false);
-    }
-
-    public async ValueTask InsertConflictsAsync(
-        IReadOnlyCollection<AdvisoryConflictEntry> conflicts,
-        CancellationToken cancellationToken)
-    {
-        if (conflicts is null)
-        {
-            throw new ArgumentNullException(nameof(conflicts));
-        }
-
-        if (conflicts.Count == 0)
-        {
-            return;
-        }
-
-        var records = conflicts
-            .Select(static entry =>
-            {
-                var payload = BsonDocument.Parse(entry.CanonicalJson);
-                return new AdvisoryConflictRecord(
-                    entry.ConflictId,
-                    entry.VulnerabilityKey,
-                    entry.ConflictHash.ToArray(),
-                    entry.AsOf,
-                    entry.RecordedAt,
-                    entry.StatementIds.ToArray(),
-                    payload);
-            })
-            .ToList();
-
-        await _conflictStore.InsertAsync(records, cancellationToken).ConfigureAwait(false);
-    }
-
-    public async ValueTask<IReadOnlyList<AdvisoryStatementEntry>> GetStatementsAsync(
-        string vulnerabilityKey,
-        DateTimeOffset? asOf,
-        CancellationToken cancellationToken)
-    {
-        var records = await _statementStore
-            .GetStatementsAsync(vulnerabilityKey, asOf, cancellationToken)
-            .ConfigureAwait(false);
-
-        if (records.Count == 0)
-        {
-            return Array.Empty<AdvisoryStatementEntry>();
-        }
-
-        var entries = records
-            .Select(static record =>
-            {
-                var advisory = CanonicalJsonSerializer.Deserialize<Advisory>(record.Payload.ToJson());
-                var canonicalJson = CanonicalJsonSerializer.Serialize(advisory);
-
-                return new AdvisoryStatementEntry(
-                    record.Id,
-                    record.VulnerabilityKey,
-                    record.AdvisoryKey,
-                    canonicalJson,
-                    record.StatementHash.ToImmutableArray(),
-                    record.AsOf,
-                    record.RecordedAt,
-                    record.InputDocumentIds.ToImmutableArray());
-            })
-            .ToList();
-
-        return entries;
-    }
-
-    public async ValueTask<IReadOnlyList<AdvisoryConflictEntry>> GetConflictsAsync(
-        string vulnerabilityKey,
-        DateTimeOffset? asOf,
-        CancellationToken cancellationToken)
-    {
-        var records = await _conflictStore
-            .GetConflictsAsync(vulnerabilityKey, asOf, cancellationToken)
-            .ConfigureAwait(false);
-
-        if (records.Count == 0)
-        {
-            return Array.Empty<AdvisoryConflictEntry>();
-        }
-
-        var entries = records
-            .Select(static record =>
-            {
-                var canonicalJson = Canonicalize(record.Details);
-                return new AdvisoryConflictEntry(
-                    record.Id,
-                    record.VulnerabilityKey,
-                    canonicalJson,
-                    record.ConflictHash.ToImmutableArray(),
-                    record.AsOf,
-                    record.RecordedAt,
-                    record.StatementIds.ToImmutableArray());
-            })
-            .ToList();
-
-        return entries;
-    }
-    private static readonly JsonWriterOptions CanonicalWriterOptions = new()
-    {
-        Encoder = JavaScriptEncoder.UnsafeRelaxedJsonEscaping,
-        Indented = false,
-        SkipValidation = false,
-    };
-
-    private static string Canonicalize(BsonDocument document)
-    {
-        using var json = JsonDocument.Parse(document.ToJson());
-        using var stream = new MemoryStream();
-        using (var writer = new Utf8JsonWriter(stream, CanonicalWriterOptions))
-        {
-            WriteCanonical(json.RootElement, writer);
-        }
-
-        return Encoding.UTF8.GetString(stream.ToArray());
-    }
-
-    private static void WriteCanonical(JsonElement element, Utf8JsonWriter writer)
-    {
-        switch (element.ValueKind)
-        {
-            case JsonValueKind.Object:
-                writer.WriteStartObject();
-                foreach (var property in element.EnumerateObject().OrderBy(static p => p.Name, StringComparer.Ordinal))
-                {
-                    writer.WritePropertyName(property.Name);
-                    WriteCanonical(property.Value, writer);
-                }
-                writer.WriteEndObject();
-                break;
-            case JsonValueKind.Array:
-                writer.WriteStartArray();
-                foreach (var item in element.EnumerateArray())
-                {
-                    WriteCanonical(item, writer);
-                }
-                writer.WriteEndArray();
-                break;
-            case JsonValueKind.String:
-                writer.WriteStringValue(element.GetString());
-                break;
-            case JsonValueKind.Number:
-                writer.WriteRawValue(element.GetRawText());
-                break;
-            case JsonValueKind.True:
-                writer.WriteBooleanValue(true);
-                break;
-            case JsonValueKind.False:
-                writer.WriteBooleanValue(false);
-                break;
-            case JsonValueKind.Null:
-                writer.WriteNullValue();
-                break;
-            default:
-                writer.WriteRawValue(element.GetRawText());
-                break;
-        }
-    }
-
-}
+using System;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.IO;
+using System.Linq;
+using System.Text;
+using System.Text.Encodings.Web;
+using System.Text.Json;
+using System.Threading;
+using System.Threading.Tasks;
+using MongoDB.Bson;
+using StellaOps.Concelier.Core.Events;
+using StellaOps.Concelier.Models;
+using StellaOps.Concelier.Storage.Mongo.Conflicts;
+using StellaOps.Concelier.Storage.Mongo.Statements;
+using StellaOps.Provenance.Mongo;
+
+namespace StellaOps.Concelier.Storage.Mongo.Events;
+
+public sealed class MongoAdvisoryEventRepository : IAdvisoryEventRepository
+{
+    private readonly IAdvisoryStatementStore _statementStore;
+    private readonly IAdvisoryConflictStore _conflictStore;
+
+    public MongoAdvisoryEventRepository(
+        IAdvisoryStatementStore statementStore,
+        IAdvisoryConflictStore conflictStore)
+    {
+        _statementStore = statementStore ?? throw new ArgumentNullException(nameof(statementStore));
+        _conflictStore = conflictStore ?? throw new ArgumentNullException(nameof(conflictStore));
+    }
+
+    public async ValueTask InsertStatementsAsync(
+        IReadOnlyCollection<AdvisoryStatementEntry> statements,
+        CancellationToken cancellationToken)
+    {
+        if (statements is null)
+        {
+            throw new ArgumentNullException(nameof(statements));
+        }
+
+        if (statements.Count == 0)
+        {
+            return;
+        }
+
+        var records = statements
+            .Select(static entry =>
+            {
+                var payload = BsonDocument.Parse(entry.CanonicalJson);
+                var (provenanceDoc, trustDoc) = BuildMetadata(entry.Provenance, entry.Trust);
+
+                return new AdvisoryStatementRecord(
+                    entry.StatementId,
+                    entry.VulnerabilityKey,
+                    entry.AdvisoryKey,
+                    entry.StatementHash.ToArray(),
+                    entry.AsOf,
+                    entry.RecordedAt,
+                    payload,
+                    entry.InputDocumentIds.ToArray(),
+                    provenanceDoc,
+                    trustDoc);
+            })
+            .ToList();
+
+        await _statementStore.InsertAsync(records, cancellationToken).ConfigureAwait(false);
+    }
+
+    public async ValueTask InsertConflictsAsync(
+        IReadOnlyCollection<AdvisoryConflictEntry> conflicts,
+        CancellationToken cancellationToken)
+    {
+        if (conflicts is null)
+        {
+            throw new ArgumentNullException(nameof(conflicts));
+        }
+
+        if (conflicts.Count == 0)
+        {
+            return;
+        }
+
+        var records = conflicts
+            .Select(static entry =>
+            {
+                var payload = BsonDocument.Parse(entry.CanonicalJson);
+                var (provenanceDoc, trustDoc) = BuildMetadata(entry.Provenance, entry.Trust);
+
+                return new AdvisoryConflictRecord(
+                    entry.ConflictId,
+                    entry.VulnerabilityKey,
+                    entry.ConflictHash.ToArray(),
+                    entry.AsOf,
+                    entry.RecordedAt,
+                    entry.StatementIds.ToArray(),
+                    payload,
+                    provenanceDoc,
+                    trustDoc);
+            })
+            .ToList();
+
+        await _conflictStore.InsertAsync(records, cancellationToken).ConfigureAwait(false);
+    }
+
+    public async ValueTask<IReadOnlyList<AdvisoryStatementEntry>> GetStatementsAsync(
+        string vulnerabilityKey,
+        DateTimeOffset? asOf,
+        CancellationToken cancellationToken)
+    {
+        var records = await _statementStore
+            .GetStatementsAsync(vulnerabilityKey, asOf, cancellationToken)
+            .ConfigureAwait(false);
+
+        if (records.Count == 0)
+        {
+            return Array.Empty<AdvisoryStatementEntry>();
+        }
+
+        var entries = records
+            .Select(static record =>
+            {
+                var advisory = CanonicalJsonSerializer.Deserialize<Advisory>(record.Payload.ToJson());
+                var canonicalJson = CanonicalJsonSerializer.Serialize(advisory);
+                var (provenance, trust) = ParseMetadata(record.Provenance, record.Trust);
+
+                return new AdvisoryStatementEntry(
+                    record.Id,
+                    record.VulnerabilityKey,
+                    record.AdvisoryKey,
+                    canonicalJson,
+                    record.StatementHash.ToImmutableArray(),
+                    record.AsOf,
+                    record.RecordedAt,
+                    record.InputDocumentIds.ToImmutableArray(),
+                    provenance,
+                    trust);
+            })
+            .ToList();
+
+        return entries;
+    }
+
+    public async ValueTask<IReadOnlyList<AdvisoryConflictEntry>> GetConflictsAsync(
+        string vulnerabilityKey,
+        DateTimeOffset? asOf,
+        CancellationToken cancellationToken)
+    {
+        var records = await _conflictStore
+            .GetConflictsAsync(vulnerabilityKey, asOf, cancellationToken)
+            .ConfigureAwait(false);
+
+        if (records.Count == 0)
+        {
+            return Array.Empty<AdvisoryConflictEntry>();
+        }
+
+        var entries = records
+            .Select(static record =>
+            {
+                var canonicalJson = Canonicalize(record.Details);
+                var (provenance, trust) = ParseMetadata(record.Provenance, record.Trust);
+                return new AdvisoryConflictEntry(
+                    record.Id,
+                    record.VulnerabilityKey,
+                    canonicalJson,
+                    record.ConflictHash.ToImmutableArray(),
+                    record.AsOf,
+                    record.RecordedAt,
+                    record.StatementIds.ToImmutableArray(),
+                    provenance,
+                    trust);
+            })
+            .ToList();
+
+        return entries;
+    }
+
+    public async ValueTask AttachStatementProvenanceAsync(
+        Guid statementId,
+        DsseProvenance dsse,
+        TrustInfo trust,
+        CancellationToken cancellationToken)
+    {
+        ArgumentNullException.ThrowIfNull(dsse);
+        ArgumentNullException.ThrowIfNull(trust);
+
+        var (provenanceDoc, trustDoc) = BuildMetadata(dsse, trust);
+
+        if (provenanceDoc is null || trustDoc is null)
+        {
+            throw new InvalidOperationException("Failed to build provenance documents.");
+        }
+
+        await _statementStore
+            .UpdateProvenanceAsync(statementId, provenanceDoc, trustDoc, cancellationToken)
+            .ConfigureAwait(false);
+    }
+    private static readonly JsonWriterOptions CanonicalWriterOptions = new()
+    {
+        Encoder = JavaScriptEncoder.UnsafeRelaxedJsonEscaping,
+        Indented = false,
+        SkipValidation = false,
+    };
+
+    private static string Canonicalize(BsonDocument document)
+    {
+        using var json = JsonDocument.Parse(document.ToJson());
+        using var stream = new MemoryStream();
+        using (var writer = new Utf8JsonWriter(stream, CanonicalWriterOptions))
+        {
+            WriteCanonical(json.RootElement, writer);
+        }
+
+        return Encoding.UTF8.GetString(stream.ToArray());
+    }
+
+    private static (BsonDocument? Provenance, BsonDocument? Trust) BuildMetadata(DsseProvenance? provenance, TrustInfo? trust)
+    {
+        if (provenance is null || trust is null)
+        {
+            return (null, null);
+        }
+
+        var metadata = new BsonDocument();
+        metadata.AttachDsseProvenance(provenance, trust);
+
+        var provenanceDoc = metadata.TryGetValue("provenance", out var provenanceValue)
+            ? (BsonDocument)provenanceValue.DeepClone()
+            : null;
+
+        var trustDoc = metadata.TryGetValue("trust", out var trustValue)
+            ? (BsonDocument)trustValue.DeepClone()
+            : null;
+
+        return (provenanceDoc, trustDoc);
+    }
+
+    private static (DsseProvenance?, TrustInfo?) ParseMetadata(BsonDocument? provenanceDoc, BsonDocument? trustDoc)
+    {
+        DsseProvenance? dsse = null;
+        if (provenanceDoc is not null &&
+            provenanceDoc.TryGetValue("dsse", out var dsseValue) &&
+            dsseValue is BsonDocument dsseBody)
+        {
+            if (TryGetString(dsseBody, "envelopeDigest", out var envelopeDigest) &&
+                TryGetString(dsseBody, "payloadType", out var payloadType) &&
+                dsseBody.TryGetValue("key", out var keyValue) &&
+                keyValue is BsonDocument keyDoc &&
+                TryGetString(keyDoc, "keyId", out var keyId))
+            {
+                var keyInfo = new DsseKeyInfo
+                {
+                    KeyId = keyId,
+                    Issuer = GetOptionalString(keyDoc, "issuer"),
+                    Algo = GetOptionalString(keyDoc, "algo"),
+                };
+
+                dsse = new DsseProvenance
+                {
+                    EnvelopeDigest = envelopeDigest,
+                    PayloadType = payloadType,
+                    Key = keyInfo,
+                    Rekor = ParseRekor(dsseBody),
+                    Chain = ParseChain(dsseBody)
+                };
+            }
+        }
+
+        TrustInfo? trust = null;
+        if (trustDoc is not null)
+        {
+            trust = new TrustInfo
+            {
+                Verified = trustDoc.TryGetValue("verified", out var verifiedValue) && verifiedValue.ToBoolean(),
+                Verifier = GetOptionalString(trustDoc, "verifier"),
+                Witnesses = trustDoc.TryGetValue("witnesses", out var witnessValue) && witnessValue.IsInt32 ? witnessValue.AsInt32 : (int?)null,
+                PolicyScore = trustDoc.TryGetValue("policyScore", out var scoreValue) && scoreValue.IsNumeric ? scoreValue.AsDouble : (double?)null
+            };
+        }
+
+        return (dsse, trust);
+    }
+
+    private static DsseRekorInfo? ParseRekor(BsonDocument dsseBody)
+    {
+        if (!dsseBody.TryGetValue("rekor", out var rekorValue) || !rekorValue.IsBsonDocument)
+        {
+            return null;
+        }
+
+        var rekorDoc = rekorValue.AsBsonDocument;
+        if (!TryGetInt64(rekorDoc, "logIndex", out var logIndex))
+        {
+            return null;
+        }
+
+        return new DsseRekorInfo
+        {
+            LogIndex = logIndex,
+            Uuid = GetOptionalString(rekorDoc, "uuid") ?? string.Empty,
+            IntegratedTime = TryGetInt64(rekorDoc, "integratedTime", out var integratedTime) ? integratedTime : null,
+            MirrorSeq = TryGetInt64(rekorDoc, "mirrorSeq", out var mirrorSeq) ? mirrorSeq : null
+        };
+    }
+
+    private static IReadOnlyCollection<DsseChainLink>? ParseChain(BsonDocument dsseBody)
+    {
+        if (!dsseBody.TryGetValue("chain", out var chainValue) || !chainValue.IsBsonArray)
+        {
+            return null;
+        }
+
+        var links = new List<DsseChainLink>();
+        foreach (var element in chainValue.AsBsonArray)
+        {
+            if (!element.IsBsonDocument)
+            {
+                continue;
+            }
+
+            var linkDoc = element.AsBsonDocument;
+            if (!TryGetString(linkDoc, "type", out var type) ||
+                !TryGetString(linkDoc, "id", out var id) ||
+                !TryGetString(linkDoc, "digest", out var digest))
+            {
+                continue;
+            }
+
+            links.Add(new DsseChainLink
+            {
+                Type = type,
+                Id = id,
+                Digest = digest
+            });
+        }
+
+        return links.Count == 0 ? null : links;
+    }
+
+    private static bool TryGetString(BsonDocument document, string name, out string value)
+    {
+        if (document.TryGetValue(name, out var bsonValue) && bsonValue.IsString)
+        {
+            value = bsonValue.AsString;
+            return true;
+        }
+
+        value = string.Empty;
+        return false;
+    }
+
+    private static string? GetOptionalString(BsonDocument document, string name)
+        => document.TryGetValue(name, out var bsonValue) && bsonValue.IsString ? bsonValue.AsString : null;
+
+    private static bool TryGetInt64(BsonDocument document, string name, out long value)
+    {
+        if (document.TryGetValue(name, out var bsonValue))
+        {
+            if (bsonValue.IsInt64)
+            {
+                value = bsonValue.AsInt64;
+                return true;
+            }
+
+            if (bsonValue.IsInt32)
+            {
+                value = bsonValue.AsInt32;
+                return true;
+            }
+
+            if (bsonValue.IsString && long.TryParse(bsonValue.AsString, out var parsed))
+            {
+                value = parsed;
+                return true;
+            }
+        }
+
+        value = 0;
+        return false;
+    }
+
+    private static void WriteCanonical(JsonElement element, Utf8JsonWriter writer)
+    {
+        switch (element.ValueKind)
+        {
+            case JsonValueKind.Object:
+                writer.WriteStartObject();
+                foreach (var property in element.EnumerateObject().OrderBy(static p => p.Name, StringComparer.Ordinal))
+                {
+                    writer.WritePropertyName(property.Name);
+                    WriteCanonical(property.Value, writer);
+                }
+                writer.WriteEndObject();
+                break;
+            case JsonValueKind.Array:
+                writer.WriteStartArray();
+                foreach (var item in element.EnumerateArray())
+                {
+                    WriteCanonical(item, writer);
+                }
+                writer.WriteEndArray();
+                break;
+            case JsonValueKind.String:
+                writer.WriteStringValue(element.GetString());
+                break;
+            case JsonValueKind.Number:
+                writer.WriteRawValue(element.GetRawText());
+                break;
+            case JsonValueKind.True:
+                writer.WriteBooleanValue(true);
+                break;
+            case JsonValueKind.False:
+                writer.WriteBooleanValue(false);
+                break;
+            case JsonValueKind.Null:
+                writer.WriteNullValue();
+                break;
+            default:
+                writer.WriteRawValue(element.GetRawText());
+                break;
+        }
+    }
+
+}

src/Concelier/__Libraries/StellaOps.Concelier.Storage.Mongo/Statements/AdvisoryStatementDocument.cs

@@ -28,7 +28,15 @@ public sealed class AdvisoryStatementDocument
     public DateTime RecordedAt { get; set; }
 
     [BsonElement("payload")]
-    public BsonDocument Payload { get; set; } = new();
+    public BsonDocument Payload { get; set; } = new();
+
+    [BsonElement("provenance")]
+    [BsonIgnoreIfNull]
+    public BsonDocument? Provenance { get; set; }
+
+    [BsonElement("trust")]
+    [BsonIgnoreIfNull]
+    public BsonDocument? Trust { get; set; }
 
     [BsonElement("inputDocuments")]
     public List<string> InputDocuments { get; set; } = new();
@@ -37,26 +45,30 @@ public sealed class AdvisoryStatementDocument
 internal static class AdvisoryStatementDocumentExtensions
 {
     public static AdvisoryStatementDocument FromRecord(AdvisoryStatementRecord record)
-        => new()
-        {
-            Id = record.Id.ToString(),
-            VulnerabilityKey = record.VulnerabilityKey,
-            AdvisoryKey = record.AdvisoryKey,
-            StatementHash = record.StatementHash,
-            AsOf = record.AsOf.UtcDateTime,
-            RecordedAt = record.RecordedAt.UtcDateTime,
-            Payload = (BsonDocument)record.Payload.DeepClone(),
-            InputDocuments = record.InputDocumentIds.Select(static id => id.ToString()).ToList(),
-        };
+        => new()
+        {
+            Id = record.Id.ToString(),
+            VulnerabilityKey = record.VulnerabilityKey,
+            AdvisoryKey = record.AdvisoryKey,
+            StatementHash = record.StatementHash,
+            AsOf = record.AsOf.UtcDateTime,
+            RecordedAt = record.RecordedAt.UtcDateTime,
+            Payload = (BsonDocument)record.Payload.DeepClone(),
+            Provenance = record.Provenance is null ? null : (BsonDocument)record.Provenance.DeepClone(),
+            Trust = record.Trust is null ? null : (BsonDocument)record.Trust.DeepClone(),
+            InputDocuments = record.InputDocumentIds.Select(static id => id.ToString()).ToList(),
+        };
 
     public static AdvisoryStatementRecord ToRecord(this AdvisoryStatementDocument document)
-        => new(
-            Guid.Parse(document.Id),
-            document.VulnerabilityKey,
-            document.AdvisoryKey,
-            document.StatementHash,
-            DateTime.SpecifyKind(document.AsOf, DateTimeKind.Utc),
-            DateTime.SpecifyKind(document.RecordedAt, DateTimeKind.Utc),
-            (BsonDocument)document.Payload.DeepClone(),
-            document.InputDocuments.Select(static value => Guid.Parse(value)).ToList());
+        => new(
+            Guid.Parse(document.Id),
+            document.VulnerabilityKey,
+            document.AdvisoryKey,
+            document.StatementHash,
+            DateTime.SpecifyKind(document.AsOf, DateTimeKind.Utc),
+            DateTime.SpecifyKind(document.RecordedAt, DateTimeKind.Utc),
+            (BsonDocument)document.Payload.DeepClone(),
+            document.InputDocuments.Select(static value => Guid.Parse(value)).ToList(),
+            document.Provenance is null ? null : (BsonDocument)document.Provenance.DeepClone(),
+            document.Trust is null ? null : (BsonDocument)document.Trust.DeepClone());
 }

src/Concelier/__Libraries/StellaOps.Concelier.Storage.Mongo/Statements/AdvisoryStatementRecord.cs

@@ -4,12 +4,14 @@ using MongoDB.Bson;
 
 namespace StellaOps.Concelier.Storage.Mongo.Statements;
 
-public sealed record AdvisoryStatementRecord(
-    Guid Id,
-    string VulnerabilityKey,
-    string AdvisoryKey,
-    byte[] StatementHash,
-    DateTimeOffset AsOf,
-    DateTimeOffset RecordedAt,
-    BsonDocument Payload,
-    IReadOnlyList<Guid> InputDocumentIds);
+public sealed record AdvisoryStatementRecord(
+    Guid Id,
+    string VulnerabilityKey,
+    string AdvisoryKey,
+    byte[] StatementHash,
+    DateTimeOffset AsOf,
+    DateTimeOffset RecordedAt,
+    BsonDocument Payload,
+    IReadOnlyList<Guid> InputDocumentIds,
+    BsonDocument? Provenance = null,
+    BsonDocument? Trust = null);

src/Concelier/__Libraries/StellaOps.Concelier.Storage.Mongo/Statements/AdvisoryStatementStore.cs

@@ -3,23 +3,31 @@ using System.Collections.Generic;
 using System.Linq;
 using System.Threading;
 using System.Threading.Tasks;
-using MongoDB.Driver;
+using MongoDB.Bson;
+using MongoDB.Driver;
 
 namespace StellaOps.Concelier.Storage.Mongo.Statements;
 
-public interface IAdvisoryStatementStore
-{
-    ValueTask InsertAsync(
-        IReadOnlyCollection<AdvisoryStatementRecord> statements,
-        CancellationToken cancellationToken,
-        IClientSessionHandle? session = null);
-
-    ValueTask<IReadOnlyList<AdvisoryStatementRecord>> GetStatementsAsync(
-        string vulnerabilityKey,
-        DateTimeOffset? asOf,
-        CancellationToken cancellationToken,
-        IClientSessionHandle? session = null);
-}
+public interface IAdvisoryStatementStore
+{
+    ValueTask InsertAsync(
+        IReadOnlyCollection<AdvisoryStatementRecord> statements,
+        CancellationToken cancellationToken,
+        IClientSessionHandle? session = null);
+
+    ValueTask<IReadOnlyList<AdvisoryStatementRecord>> GetStatementsAsync(
+        string vulnerabilityKey,
+        DateTimeOffset? asOf,
+        CancellationToken cancellationToken,
+        IClientSessionHandle? session = null);
+
+    ValueTask UpdateProvenanceAsync(
+        Guid statementId,
+        BsonDocument provenance,
+        BsonDocument trust,
+        CancellationToken cancellationToken,
+        IClientSessionHandle? session = null);
+}
 
 public sealed class AdvisoryStatementStore : IAdvisoryStatementStore
 {
@@ -63,13 +71,13 @@ public sealed class AdvisoryStatementStore : IAdvisoryStatementStore
         }
     }
 
-    public async ValueTask<IReadOnlyList<AdvisoryStatementRecord>> GetStatementsAsync(
-        string vulnerabilityKey,
-        DateTimeOffset? asOf,
-        CancellationToken cancellationToken,
-        IClientSessionHandle? session = null)
-    {
-        ArgumentException.ThrowIfNullOrWhiteSpace(vulnerabilityKey);
+    public async ValueTask<IReadOnlyList<AdvisoryStatementRecord>> GetStatementsAsync(
+        string vulnerabilityKey,
+        DateTimeOffset? asOf,
+        CancellationToken cancellationToken,
+        IClientSessionHandle? session = null)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(vulnerabilityKey);
 
         var filter = Builders<AdvisoryStatementDocument>.Filter.Eq(document => document.VulnerabilityKey, vulnerabilityKey);
 
@@ -88,6 +96,31 @@ public sealed class AdvisoryStatementStore : IAdvisoryStatementStore
             .ToListAsync(cancellationToken)
             .ConfigureAwait(false);
 
-        return documents.Select(static document => document.ToRecord()).ToList();
-    }
-}
+        return documents.Select(static document => document.ToRecord()).ToList();
+    }
+
+    public async ValueTask UpdateProvenanceAsync(
+        Guid statementId,
+        BsonDocument provenance,
+        BsonDocument trust,
+        CancellationToken cancellationToken,
+        IClientSessionHandle? session = null)
+    {
+        ArgumentNullException.ThrowIfNull(provenance);
+        ArgumentNullException.ThrowIfNull(trust);
+
+        var filter = Builders<AdvisoryStatementDocument>.Filter.Eq(document => document.Id, statementId.ToString());
+        var update = Builders<AdvisoryStatementDocument>.Update
+            .Set(document => document.Provenance, provenance)
+            .Set(document => document.Trust, trust);
+
+        var result = session is null
+            ? await _collection.UpdateOneAsync(filter, update, cancellationToken: cancellationToken).ConfigureAwait(false)
+            : await _collection.UpdateOneAsync(session, filter, update, cancellationToken: cancellationToken).ConfigureAwait(false);
+
+        if (result.MatchedCount == 0)
+        {
+            throw new InvalidOperationException($"Statement {statementId} not found.");
+        }
+    }
+}

src/Concelier/__Libraries/StellaOps.Concelier.Storage.Mongo/StellaOps.Concelier.Storage.Mongo.csproj

@@ -15,5 +15,6 @@
     <ProjectReference Include="..\StellaOps.Concelier.Core\StellaOps.Concelier.Core.csproj" />
     <ProjectReference Include="..\StellaOps.Concelier.Models\StellaOps.Concelier.Models.csproj" />
     <ProjectReference Include="..\..\..\__Libraries\StellaOps.Ingestion.Telemetry\StellaOps.Ingestion.Telemetry.csproj" />
+    <ProjectReference Include="..\..\..\__Libraries\StellaOps.Provenance.Mongo\StellaOps.Provenance.Mongo.csproj" />
   </ItemGroup>
 </Project>