Implement ledger metrics for observability and add tests for Ruby packages endpoints

- Added `LedgerMetrics` class to record write latency and total events for ledger operations.
- Created comprehensive tests for Ruby packages endpoints, covering scenarios for missing inventory, successful retrieval, and identifier handling.
- Introduced `TestSurfaceSecretsScope` for managing environment variables during tests.
- Developed `ProvenanceMongoExtensions` for attaching DSSE provenance and trust information to event documents.
- Implemented `EventProvenanceWriter` and `EventWriter` classes for managing event provenance in MongoDB.
- Established MongoDB indexes for efficient querying of events based on provenance and trust.
- Added models and JSON parsing logic for DSSE provenance and trust information.

src/Concelier/__Tests/StellaOps.Concelier.Core.Tests/Events/AdvisoryEventLogTests.cs

@@ -4,21 +4,22 @@ using System.Collections.Immutable;
 using System.Linq;
 using System.Text.Json;
 using System.Threading;
-using System.Threading.Tasks;
-using StellaOps.Concelier.Core.Events;
-using StellaOps.Concelier.Models;
-using Xunit;
+using System.Threading.Tasks;
+using StellaOps.Concelier.Core.Events;
+using StellaOps.Concelier.Models;
+using StellaOps.Provenance.Mongo;
+using Xunit;
 
 namespace StellaOps.Concelier.Core.Tests.Events;
 
 public sealed class AdvisoryEventLogTests
 {
     [Fact]
-    public async Task AppendAsync_PersistsCanonicalStatementEntries()
-    {
-        var repository = new FakeRepository();
-        var timeProvider = new FixedTimeProvider(DateTimeOffset.UtcNow);
-        var log = new AdvisoryEventLog(repository, timeProvider);
+    public async Task AppendAsync_PersistsCanonicalStatementEntries()
+    {
+        var repository = new FakeRepository();
+        var timeProvider = new FixedTimeProvider(DateTimeOffset.UtcNow);
+        var log = new AdvisoryEventLog(repository, timeProvider);
 
         var advisory = new Advisory(
             "adv-1",
@@ -48,9 +49,54 @@ public sealed class AdvisoryEventLogTests
         Assert.Equal("cve-2025-0001", entry.VulnerabilityKey);
         Assert.Equal("adv-1", entry.AdvisoryKey);
         Assert.Equal(DateTimeOffset.Parse("2025-10-03T00:00:00Z"), entry.AsOf);
-        Assert.Contains("\"advisoryKey\":\"adv-1\"", entry.CanonicalJson);
-        Assert.NotEqual(ImmutableArray<byte>.Empty, entry.StatementHash);
-    }
+        Assert.Contains("\"advisoryKey\":\"adv-1\"", entry.CanonicalJson);
+        Assert.NotEqual(ImmutableArray<byte>.Empty, entry.StatementHash);
+    }
+
+    [Fact]
+    public async Task AppendAsync_AttachesDsseMetadataFromAdvisoryProvenance()
+    {
+        var repository = new FakeRepository();
+        var timeProvider = new FixedTimeProvider(DateTimeOffset.Parse("2025-11-11T00:00:00Z"));
+        var log = new AdvisoryEventLog(repository, timeProvider);
+
+        var dsseMetadata = new AdvisoryProvenance(
+            source: "attestor",
+            kind: "dsse",
+            value: BuildDsseMetadataJson(),
+            recordedAt: DateTimeOffset.Parse("2025-11-10T00:00:00Z"));
+
+        var advisory = new Advisory(
+            "adv-2",
+            "DSSE-backed",
+            summary: null,
+            language: "en",
+            published: DateTimeOffset.Parse("2025-11-09T00:00:00Z"),
+            modified: DateTimeOffset.Parse("2025-11-10T00:00:00Z"),
+            severity: "medium",
+            exploitKnown: false,
+            aliases: new[] { "CVE-2025-7777" },
+            references: Array.Empty<AdvisoryReference>(),
+            affectedPackages: Array.Empty<AffectedPackage>(),
+            cvssMetrics: Array.Empty<CvssMetric>(),
+            provenance: new[] { dsseMetadata });
+
+        var statementInput = new AdvisoryStatementInput(
+            VulnerabilityKey: "CVE-2025-7777",
+            Advisory: advisory,
+            AsOf: DateTimeOffset.Parse("2025-11-10T12:00:00Z"),
+            InputDocumentIds: Array.Empty<Guid>());
+
+        await log.AppendAsync(new AdvisoryEventAppendRequest(new[] { statementInput }), CancellationToken.None);
+
+        var entry = Assert.Single(repository.InsertedStatements);
+        Assert.NotNull(entry.Provenance);
+        Assert.NotNull(entry.Trust);
+        Assert.Equal("sha256:feedface", entry.Provenance!.EnvelopeDigest);
+        Assert.Equal(1337, entry.Provenance.Rekor!.LogIndex);
+        Assert.True(entry.Trust!.Verified);
+        Assert.Equal("Authority@stella", entry.Trust.Verifier);
+    }
 
     [Fact]
     public async Task AppendAsync_PersistsConflictsWithCanonicalizedJson()
@@ -190,8 +236,8 @@ public sealed class AdvisoryEventLogTests
         Assert.Equal("{\"reason\":\"conflict\"}", replay.Conflicts[0].CanonicalJson);
     }
 
-    private sealed class FakeRepository : IAdvisoryEventRepository
-    {
+    private sealed class FakeRepository : IAdvisoryEventRepository
+    {
         public List<AdvisoryStatementEntry> InsertedStatements { get; } = new();
 
         public List<AdvisoryConflictEntry> InsertedConflicts { get; } = new();
@@ -217,21 +263,61 @@ public sealed class AdvisoryEventLogTests
                 string.Equals(entry.VulnerabilityKey, vulnerabilityKey, StringComparison.Ordinal) &&
                 (!asOf.HasValue || entry.AsOf <= asOf.Value)).ToList());
 
-        public ValueTask<IReadOnlyList<AdvisoryConflictEntry>> GetConflictsAsync(string vulnerabilityKey, DateTimeOffset? asOf, CancellationToken cancellationToken)
-            => ValueTask.FromResult<IReadOnlyList<AdvisoryConflictEntry>>(StoredConflicts.Where(entry =>
-                string.Equals(entry.VulnerabilityKey, vulnerabilityKey, StringComparison.Ordinal) &&
-                (!asOf.HasValue || entry.AsOf <= asOf.Value)).ToList());
-    }
-
-    private sealed class FixedTimeProvider : TimeProvider
-    {
+        public ValueTask<IReadOnlyList<AdvisoryConflictEntry>> GetConflictsAsync(string vulnerabilityKey, DateTimeOffset? asOf, CancellationToken cancellationToken)
+            => ValueTask.FromResult<IReadOnlyList<AdvisoryConflictEntry>>(StoredConflicts.Where(entry =>
+                string.Equals(entry.VulnerabilityKey, vulnerabilityKey, StringComparison.Ordinal) &&
+                (!asOf.HasValue || entry.AsOf <= asOf.Value)).ToList());
+
+        public ValueTask AttachStatementProvenanceAsync(
+            Guid statementId,
+            DsseProvenance provenance,
+            TrustInfo trust,
+            CancellationToken cancellationToken)
+            => ValueTask.CompletedTask;
+    }
+
+    private sealed class FixedTimeProvider : TimeProvider
+    {
         private readonly DateTimeOffset _now;
 
         public FixedTimeProvider(DateTimeOffset now)
         {
             _now = now.ToUniversalTime();
-        }
-
-        public override DateTimeOffset GetUtcNow() => _now;
-    }
-}
+        }
+
+        public override DateTimeOffset GetUtcNow() => _now;
+    }
+
+    private static string BuildDsseMetadataJson()
+    {
+        var payload = new
+        {
+            dsse = new
+            {
+                envelopeDigest = "sha256:feedface",
+                payloadType = "application/vnd.in-toto+json",
+                key = new
+                {
+                    keyId = "cosign:SHA256-PKIX:fixture",
+                    issuer = "Authority@stella",
+                    algo = "Ed25519"
+                },
+                rekor = new
+                {
+                    logIndex = 1337,
+                    uuid = "11111111-2222-3333-4444-555555555555",
+                    integratedTime = 1731081600
+                }
+            },
+            trust = new
+            {
+                verified = true,
+                verifier = "Authority@stella",
+                witnesses = 1,
+                policyScore = 1.0
+            }
+        };
+
+        return JsonSerializer.Serialize(payload, new JsonSerializerOptions(JsonSerializerDefaults.Web));
+    }
+}

src/Concelier/__Tests/StellaOps.Concelier.Core.Tests/Noise/NoisePriorServiceTests.cs

@@ -3,11 +3,12 @@ using System.Collections.Generic;
 using System.Collections.Immutable;
 using System.Linq;
 using System.Threading;
-using System.Threading.Tasks;
-using StellaOps.Concelier.Core.Events;
-using StellaOps.Concelier.Core.Noise;
-using StellaOps.Concelier.Models;
-using Xunit;
+using System.Threading.Tasks;
+using StellaOps.Concelier.Core.Events;
+using StellaOps.Concelier.Core.Noise;
+using StellaOps.Concelier.Models;
+using StellaOps.Provenance.Mongo;
+using Xunit;
 
 namespace StellaOps.Concelier.Core.Tests.Noise;
 
@@ -249,12 +250,19 @@ public sealed class NoisePriorServiceTests
             _replay = replay;
         }
 
-        public ValueTask AppendAsync(AdvisoryEventAppendRequest request, CancellationToken cancellationToken)
-            => throw new NotSupportedException("Append operations are not required for tests.");
-
-        public ValueTask<AdvisoryReplay> ReplayAsync(string vulnerabilityKey, DateTimeOffset? asOf, CancellationToken cancellationToken)
-            => ValueTask.FromResult(_replay);
-    }
+        public ValueTask AppendAsync(AdvisoryEventAppendRequest request, CancellationToken cancellationToken)
+            => throw new NotSupportedException("Append operations are not required for tests.");
+
+        public ValueTask<AdvisoryReplay> ReplayAsync(string vulnerabilityKey, DateTimeOffset? asOf, CancellationToken cancellationToken)
+            => ValueTask.FromResult(_replay);
+
+        public ValueTask AttachStatementProvenanceAsync(
+            Guid statementId,
+            DsseProvenance provenance,
+            TrustInfo trust,
+            CancellationToken cancellationToken)
+            => ValueTask.CompletedTask;
+    }
 
     private sealed class FakeNoisePriorRepository : INoisePriorRepository
     {

src/Concelier/__Tests/StellaOps.Concelier.Storage.Mongo.Tests/MongoAdvisoryEventRepositoryTests.cs

@@ -1,110 +1,223 @@
-using System;
-using System.Collections.Immutable;
-using System.Linq;
+using System;
+using System.Collections.Immutable;
+using System.Linq;
 using System.Text;
-using System.Collections.Generic;
-using System.Threading;
-using System.Threading.Tasks;
-using MongoDB.Driver;
-using StellaOps.Concelier.Core.Events;
-using StellaOps.Concelier.Models;
-using StellaOps.Concelier.Storage.Mongo.Conflicts;
-using StellaOps.Concelier.Storage.Mongo.Events;
+using System.Collections.Generic;
+using System.Threading;
+using System.Threading.Tasks;
+using MongoDB.Bson;
+using MongoDB.Driver;
+using StellaOps.Concelier.Core.Events;
+using StellaOps.Concelier.Models;
+using StellaOps.Concelier.Storage.Mongo.Conflicts;
+using StellaOps.Concelier.Storage.Mongo.Events;
 using StellaOps.Concelier.Storage.Mongo.Statements;
+using StellaOps.Concelier.Storage.Mongo;
 using StellaOps.Concelier.Testing;
 using StellaOps.Cryptography;
+using StellaOps.Provenance.Mongo;
 using Xunit;
-
-namespace StellaOps.Concelier.Storage.Mongo.Tests;
-
-[Collection("mongo-fixture")]
+
+namespace StellaOps.Concelier.Storage.Mongo.Tests;
+
+[Collection("mongo-fixture")]
 public sealed class MongoAdvisoryEventRepositoryTests
 {
     private readonly IMongoDatabase _database;
     private readonly MongoAdvisoryEventRepository _repository;
     private static readonly ICryptoHash Hash = CryptoHashFactory.CreateDefault();
-
-    public MongoAdvisoryEventRepositoryTests(MongoIntegrationFixture fixture)
-    {
-        _database = fixture.Database ?? throw new ArgumentNullException(nameof(fixture.Database));
-        var statementStore = new AdvisoryStatementStore(_database);
-        var conflictStore = new AdvisoryConflictStore(_database);
-        _repository = new MongoAdvisoryEventRepository(statementStore, conflictStore);
-    }
-
-    [Fact]
-    public async Task InsertAndFetchStatements_RoundTripsCanonicalPayload()
-    {
-        var advisory = CreateSampleAdvisory("CVE-2025-7777", "Sample advisory");
-        var canonicalJson = CanonicalJsonSerializer.Serialize(advisory);
+
+    public MongoAdvisoryEventRepositoryTests(MongoIntegrationFixture fixture)
+    {
+        _database = fixture.Database ?? throw new ArgumentNullException(nameof(fixture.Database));
+        var statementStore = new AdvisoryStatementStore(_database);
+        var conflictStore = new AdvisoryConflictStore(_database);
+        _repository = new MongoAdvisoryEventRepository(statementStore, conflictStore);
+    }
+
+    [Fact]
+    public async Task InsertAndFetchStatements_RoundTripsCanonicalPayload()
+    {
+        var advisory = CreateSampleAdvisory("CVE-2025-7777", "Sample advisory");
+        var canonicalJson = CanonicalJsonSerializer.Serialize(advisory);
         var digest = Hash.ComputeHash(Encoding.UTF8.GetBytes(canonicalJson), HashAlgorithms.Sha256);
         var hash = ImmutableArray.Create(digest);
-
-        var entry = new AdvisoryStatementEntry(
-            Guid.NewGuid(),
-            "CVE-2025-7777",
-            "CVE-2025-7777",
-            canonicalJson,
-            hash,
-            DateTimeOffset.Parse("2025-10-19T14:00:00Z"),
-            DateTimeOffset.Parse("2025-10-19T14:05:00Z"),
-            ImmutableArray<Guid>.Empty);
-
-        await _repository.InsertStatementsAsync(new[] { entry }, CancellationToken.None);
-
-        var results = await _repository.GetStatementsAsync("CVE-2025-7777", null, CancellationToken.None);
-
-        var snapshot = Assert.Single(results);
-        Assert.Equal(entry.StatementId, snapshot.StatementId);
-        Assert.Equal(entry.CanonicalJson, snapshot.CanonicalJson);
-        Assert.True(entry.StatementHash.SequenceEqual(snapshot.StatementHash));
-    }
-
-    [Fact]
-    public async Task InsertAndFetchConflicts_PreservesDetails()
-    {
-        var detailJson = CanonicalJsonSerializer.Serialize(new ConflictPayload("severity", "mismatch"));
+
+        var entry = new AdvisoryStatementEntry(
+            Guid.NewGuid(),
+            "CVE-2025-7777",
+            "CVE-2025-7777",
+            canonicalJson,
+            hash,
+            DateTimeOffset.Parse("2025-10-19T14:00:00Z"),
+            DateTimeOffset.Parse("2025-10-19T14:05:00Z"),
+            ImmutableArray<Guid>.Empty);
+
+        await _repository.InsertStatementsAsync(new[] { entry }, CancellationToken.None);
+
+        var results = await _repository.GetStatementsAsync("CVE-2025-7777", null, CancellationToken.None);
+
+        var snapshot = Assert.Single(results);
+        Assert.Equal(entry.StatementId, snapshot.StatementId);
+        Assert.Equal(entry.CanonicalJson, snapshot.CanonicalJson);
+        Assert.True(entry.StatementHash.SequenceEqual(snapshot.StatementHash));
+    }
+
+    [Fact]
+    public async Task InsertAndFetchConflicts_PreservesDetails()
+    {
+        var detailJson = CanonicalJsonSerializer.Serialize(new ConflictPayload("severity", "mismatch"));
         var digest = Hash.ComputeHash(Encoding.UTF8.GetBytes(detailJson), HashAlgorithms.Sha256);
         var hash = ImmutableArray.Create(digest);
-        var statementIds = ImmutableArray.Create(Guid.NewGuid(), Guid.NewGuid());
-
-        var entry = new AdvisoryConflictEntry(
-            Guid.NewGuid(),
-            "CVE-2025-4242",
-            detailJson,
-            hash,
-            DateTimeOffset.Parse("2025-10-19T15:00:00Z"),
-            DateTimeOffset.Parse("2025-10-19T15:05:00Z"),
-            statementIds);
-
-        await _repository.InsertConflictsAsync(new[] { entry }, CancellationToken.None);
-
-        var results = await _repository.GetConflictsAsync("CVE-2025-4242", null, CancellationToken.None);
-
-        var conflict = Assert.Single(results);
-        Assert.Equal(entry.CanonicalJson, conflict.CanonicalJson);
-        Assert.True(entry.StatementIds.SequenceEqual(conflict.StatementIds));
-        Assert.True(entry.ConflictHash.SequenceEqual(conflict.ConflictHash));
-    }
-
-    private static Advisory CreateSampleAdvisory(string key, string summary)
-    {
-        var provenance = new AdvisoryProvenance("nvd", "document", key, DateTimeOffset.Parse("2025-10-18T00:00:00Z"), new[] { ProvenanceFieldMasks.Advisory });
-        return new Advisory(
-            key,
-            key,
-            summary,
-            "en",
-            DateTimeOffset.Parse("2025-10-17T00:00:00Z"),
-            DateTimeOffset.Parse("2025-10-18T00:00:00Z"),
-            "medium",
-            exploitKnown: false,
-            aliases: new[] { key },
-            references: Array.Empty<AdvisoryReference>(),
-            affectedPackages: Array.Empty<AffectedPackage>(),
-            cvssMetrics: Array.Empty<CvssMetric>(),
-            provenance: new[] { provenance });
-    }
-
-    private sealed record ConflictPayload(string Type, string Reason);
-}
+        var statementIds = ImmutableArray.Create(Guid.NewGuid(), Guid.NewGuid());
+
+        var entry = new AdvisoryConflictEntry(
+            Guid.NewGuid(),
+            "CVE-2025-4242",
+            detailJson,
+            hash,
+            DateTimeOffset.Parse("2025-10-19T15:00:00Z"),
+            DateTimeOffset.Parse("2025-10-19T15:05:00Z"),
+            statementIds);
+
+        await _repository.InsertConflictsAsync(new[] { entry }, CancellationToken.None);
+
+        var results = await _repository.GetConflictsAsync("CVE-2025-4242", null, CancellationToken.None);
+
+        var conflict = Assert.Single(results);
+        Assert.Equal(entry.CanonicalJson, conflict.CanonicalJson);
+        Assert.True(entry.StatementIds.SequenceEqual(conflict.StatementIds));
+        Assert.True(entry.ConflictHash.SequenceEqual(conflict.ConflictHash));
+    }
+
+
+    [Fact]
+    public async Task InsertStatementsAsync_PersistsProvenanceMetadata()
+    {
+        var advisory = CreateSampleAdvisory("CVE-2025-8888", "Metadata coverage");
+        var canonicalJson = CanonicalJsonSerializer.Serialize(advisory);
+        var digest = Hash.ComputeHash(Encoding.UTF8.GetBytes(canonicalJson), HashAlgorithms.Sha256);
+        var hash = ImmutableArray.Create(digest);
+        var (dsse, trust) = CreateSampleDsseMetadata();
+
+        var entry = new AdvisoryStatementEntry(
+            Guid.NewGuid(),
+            "CVE-2025-8888",
+            "CVE-2025-8888",
+            canonicalJson,
+            hash,
+            DateTimeOffset.Parse("2025-10-20T10:00:00Z"),
+            DateTimeOffset.Parse("2025-10-20T10:05:00Z"),
+            ImmutableArray<Guid>.Empty,
+            dsse,
+            trust);
+
+        await _repository.InsertStatementsAsync(new[] { entry }, CancellationToken.None);
+
+        var statements = _database.GetCollection<BsonDocument>(MongoStorageDefaults.Collections.AdvisoryStatements);
+        var stored = await statements
+            .Find(Builders<BsonDocument>.Filter.Eq("_id", entry.StatementId.ToString()))
+            .FirstOrDefaultAsync();
+
+        Assert.NotNull(stored);
+        var provenance = stored!["provenance"].AsBsonDocument["dsse"].AsBsonDocument;
+        Assert.Equal(dsse.EnvelopeDigest, provenance["envelopeDigest"].AsString);
+        Assert.Equal(dsse.Key.KeyId, provenance["key"].AsBsonDocument["keyId"].AsString);
+
+        var trustDoc = stored["trust"].AsBsonDocument;
+        Assert.Equal(trust.Verifier, trustDoc["verifier"].AsString);
+        Assert.Equal(trust.Witnesses, trustDoc["witnesses"].AsInt32);
+
+        var roundTrip = await _repository.GetStatementsAsync("CVE-2025-8888", null, CancellationToken.None);
+        var hydrated = Assert.Single(roundTrip);
+        Assert.NotNull(hydrated.Provenance);
+        Assert.NotNull(hydrated.Trust);
+        Assert.Equal(dsse.EnvelopeDigest, hydrated.Provenance!.EnvelopeDigest);
+        Assert.Equal(trust.Verifier, hydrated.Trust!.Verifier);
+    }
+
+    private static Advisory CreateSampleAdvisory(string key, string summary)
+    {
+        var provenance = new AdvisoryProvenance("nvd", "document", key, DateTimeOffset.Parse("2025-10-18T00:00:00Z"), new[] { ProvenanceFieldMasks.Advisory });
+        return new Advisory(
+            key,
+            key,
+            summary,
+            "en",
+            DateTimeOffset.Parse("2025-10-17T00:00:00Z"),
+            DateTimeOffset.Parse("2025-10-18T00:00:00Z"),
+            "medium",
+            exploitKnown: false,
+            aliases: new[] { key },
+            references: Array.Empty<AdvisoryReference>(),
+            affectedPackages: Array.Empty<AffectedPackage>(),
+            cvssMetrics: Array.Empty<CvssMetric>(),
+            provenance: new[] { provenance });
+    }
+
+
+
+    [Fact]
+    public async Task AttachStatementProvenanceAsync_BackfillsExistingRecord()
+    {
+        var advisory = CreateSampleAdvisory("CVE-2025-9999", "Backfill metadata");
+        var canonicalJson = CanonicalJsonSerializer.Serialize(advisory);
+        var digest = Hash.ComputeHash(Encoding.UTF8.GetBytes(canonicalJson), HashAlgorithms.Sha256);
+        var hash = ImmutableArray.Create(digest);
+
+        var entry = new AdvisoryStatementEntry(
+            Guid.NewGuid(),
+            "CVE-2025-9999",
+            "CVE-2025-9999",
+            canonicalJson,
+            hash,
+            DateTimeOffset.Parse("2025-10-21T10:00:00Z"),
+            DateTimeOffset.Parse("2025-10-21T10:05:00Z"),
+            ImmutableArray<Guid>.Empty);
+
+        await _repository.InsertStatementsAsync(new[] { entry }, CancellationToken.None);
+
+        var (dsse, trust) = CreateSampleDsseMetadata();
+        await _repository.AttachStatementProvenanceAsync(entry.StatementId, dsse, trust, CancellationToken.None);
+
+        var statements = await _repository.GetStatementsAsync("CVE-2025-9999", null, CancellationToken.None);
+        var updated = Assert.Single(statements);
+        Assert.NotNull(updated.Provenance);
+        Assert.NotNull(updated.Trust);
+        Assert.Equal(dsse.EnvelopeDigest, updated.Provenance!.EnvelopeDigest);
+        Assert.Equal(trust.Verifier, updated.Trust!.Verifier);
+    }
+
+    private static (DsseProvenance Provenance, TrustInfo Trust) CreateSampleDsseMetadata()
+    {
+        var provenance = new DsseProvenance
+        {
+            EnvelopeDigest = "sha256:deadbeef",
+            PayloadType = "application/vnd.in-toto+json",
+            Key = new DsseKeyInfo
+            {
+                KeyId = "cosign:SHA256-PKIX:TEST",
+                Issuer = "fulcio",
+                Algo = "ECDSA"
+            },
+            Rekor = new DsseRekorInfo
+            {
+                LogIndex = 42,
+                Uuid = Guid.Parse("2d4d5f7c-1111-4a01-b9cb-aa42022a0a8c").ToString(),
+                IntegratedTime = 1_700_000_000
+            }
+        };
+
+        var trust = new TrustInfo
+        {
+            Verified = true,
+            Verifier = "Authority@stella",
+            Witnesses = 2,
+            PolicyScore = 0.9
+        };
+
+        return (provenance, trust);
+    }
+
+    private sealed record ConflictPayload(string Type, string Reason);
+}

src/Concelier/__Tests/StellaOps.Concelier.WebService.Tests/AdvisoryAiTelemetryTests.cs

@@ -1,7 +1,6 @@
 using System;
 using System.Collections.Generic;
 using System.Diagnostics.Metrics;
-using FluentAssertions;
 using Microsoft.Extensions.Logging.Abstractions;
 using StellaOps.Concelier.WebService.Services;
 using StellaOps.Concelier.WebService.Diagnostics;
@@ -12,7 +11,7 @@ namespace StellaOps.Concelier.WebService.Tests;
 public sealed class AdvisoryAiTelemetryTests : IDisposable
 {
     private readonly MeterListener _listener;
-    private readonly List<Measurement<long>> _guardrailMeasurements = new();
+    private readonly List<(long Value, KeyValuePair<string, object?>[] Tags)> _guardrailMeasurements = new();
 
     public AdvisoryAiTelemetryTests()
     {
@@ -31,7 +30,7 @@ public sealed class AdvisoryAiTelemetryTests : IDisposable
             if (instrument.Meter.Name == AdvisoryAiMetrics.MeterName &&
                 instrument.Name == "advisory_ai_guardrail_blocks_total")
             {
-                _guardrailMeasurements.Add(new Measurement<long>(measurement, tags, state));
+                _guardrailMeasurements.Add((measurement, tags.ToArray()));
             }
         });
         _listener.Start();
@@ -58,10 +57,20 @@ public sealed class AdvisoryAiTelemetryTests : IDisposable
             Duration: TimeSpan.FromMilliseconds(5),
             GuardrailCounts: guardrailCounts));
 
-        _guardrailMeasurements.Should().ContainSingle();
-        var measurement = _guardrailMeasurements[0];
-        measurement.Value.Should().Be(2);
-        measurement.Tags.Should().Contain(tag => tag.Key == "cache" && (string?)tag.Value == "hit");
+        var measurement = Assert.Single(_guardrailMeasurements);
+        Assert.Equal(2, measurement.Value);
+
+        var cacheHitTagFound = false;
+        foreach (var tag in measurement.Tags)
+        {
+            if (tag.Key == "cache" && (string?)tag.Value == "hit")
+            {
+                cacheHitTagFound = true;
+                break;
+            }
+        }
+
+        Assert.True(cacheHitTagFound, "guardrail measurement should be tagged with cache hit outcome.");
     }
 
     public void Dispose()

src/Concelier/__Tests/StellaOps.Concelier.WebService.Tests/WebServiceEndpointsTests.cs

@@ -31,6 +31,7 @@ using StellaOps.Concelier.Core.Jobs;
 using StellaOps.Concelier.Models;
 using StellaOps.Concelier.Merge.Services;
 using StellaOps.Concelier.Storage.Mongo;
+using StellaOps.Concelier.Storage.Mongo.Advisories;
 using StellaOps.Concelier.Storage.Mongo.Observations;
 using StellaOps.Concelier.Core.Raw;
 using StellaOps.Concelier.WebService.Jobs;
@@ -265,42 +266,46 @@ public sealed class WebServiceEndpointsTests : IAsyncLifetime
             CreateAdvisoryRawDocument("tenant-a", "nvd", "tenant-a:chunk:newest", newerHash, newestRaw.DeepClone().AsBsonDocument),
             CreateAdvisoryRawDocument("tenant-a", "nvd", "tenant-a:chunk:older", olderHash, olderRaw.DeepClone().AsBsonDocument));
 
+        await SeedCanonicalAdvisoriesAsync(
+            CreateStructuredAdvisory("CVE-2025-0001", "GHSA-2025-0001", "tenant-a:chunk:newest", newerCreatedAt));
+
         using var client = _factory.CreateClient();
-        var response = await client.GetAsync("/advisories/cve-2025-0001/chunks?tenant=tenant-a&section=summary&format=csaf");
+        var response = await client.GetAsync("/advisories/cve-2025-0001/chunks?tenant=tenant-a&section=workaround");
         response.EnsureSuccessStatusCode();
 
         var payload = await response.Content.ReadAsStringAsync();
         using var document = JsonDocument.Parse(payload);
         var root = document.RootElement;
 
-        Assert.Equal("cve-2025-0001", root.GetProperty("advisoryKey").GetString());
+        Assert.Equal("CVE-2025-0001", root.GetProperty("advisoryKey").GetString());
         Assert.Equal(1, root.GetProperty("total").GetInt32());
         Assert.False(root.GetProperty("truncated").GetBoolean());
 
-        var chunk = Assert.Single(root.GetProperty("chunks").EnumerateArray());
-        Assert.Equal("summary", chunk.GetProperty("section").GetString());
-        Assert.Equal("summary.intro", chunk.GetProperty("paragraphId").GetString());
-        var text = chunk.GetProperty("text").GetString();
-        Assert.False(string.IsNullOrWhiteSpace(text));
-        Assert.Contains("deterministic summary paragraph", text, StringComparison.OrdinalIgnoreCase);
+        var entry = Assert.Single(root.GetProperty("entries").EnumerateArray());
+        Assert.Equal("workaround", entry.GetProperty("type").GetString());
+        Assert.Equal("tenant-a:chunk:newest", entry.GetProperty("documentId").GetString());
+        Assert.Equal("/references/0", entry.GetProperty("fieldPath").GetString());
+        Assert.False(string.IsNullOrWhiteSpace(entry.GetProperty("chunkId").GetString()));
 
-        var metadata = chunk.GetProperty("metadata");
-        Assert.Equal("summary.intro", metadata.GetProperty("path").GetString());
-        Assert.Equal("csaf", metadata.GetProperty("format").GetString());
+        var content = entry.GetProperty("content");
+        Assert.Equal("Vendor guidance", content.GetProperty("title").GetString());
+        Assert.Equal("Apply configuration change immediately.", content.GetProperty("description").GetString());
+        Assert.Equal("https://vendor.example/workaround", content.GetProperty("url").GetString());
 
-        var sources = root.GetProperty("sources").EnumerateArray().ToArray();
-        Assert.Equal(2, sources.Length);
-        Assert.Equal("tenant-a:chunk:newest", sources[0].GetProperty("observationId").GetString());
-        Assert.Equal("tenant-a:chunk:older", sources[1].GetProperty("observationId").GetString());
-        Assert.All(
-            sources,
-            source => Assert.True(string.Equals("csaf", source.GetProperty("format").GetString(), StringComparison.OrdinalIgnoreCase)));
+        var provenance = entry.GetProperty("provenance");
+        Assert.Equal("nvd", provenance.GetProperty("source").GetString());
+        Assert.Equal("workaround", provenance.GetProperty("kind").GetString());
+        Assert.Equal("tenant-a:chunk:newest", provenance.GetProperty("value").GetString());
+        Assert.Contains(
+            "/references/0",
+            provenance.GetProperty("fieldMask").EnumerateArray().Select(element => element.GetString()));
     }
 
     [Fact]
     public async Task AdvisoryChunksEndpoint_ReturnsNotFoundWhenAdvisoryMissing()
     {
         await SeedObservationDocumentsAsync(BuildSampleObservationDocuments());
+        await SeedCanonicalAdvisoriesAsync();
 
         using var client = _factory.CreateClient();
         var response = await client.GetAsync("/advisories/cve-2099-9999/chunks?tenant=tenant-a");
@@ -526,6 +531,12 @@ public sealed class WebServiceEndpointsTests : IAsyncLifetime
     public async Task AdvisoryChunksEndpoint_EmitsRequestAndCacheMetrics()
     {
         await SeedObservationDocumentsAsync(BuildSampleObservationDocuments());
+        await SeedCanonicalAdvisoriesAsync(
+            CreateStructuredAdvisory(
+                "CVE-2025-0001",
+                "GHSA-2025-0001",
+                "tenant-a:nvd:alpha:1",
+                new DateTimeOffset(2025, 1, 5, 0, 0, 0, TimeSpan.Zero)));
 
         using var client = _factory.CreateClient();
 
@@ -588,6 +599,12 @@ public sealed class WebServiceEndpointsTests : IAsyncLifetime
             raw);
 
         await SeedObservationDocumentsAsync(new[] { document });
+        await SeedCanonicalAdvisoriesAsync(
+            CreateStructuredAdvisory(
+                "CVE-2025-GUARD",
+                "GHSA-2025-GUARD",
+                "tenant-a:chunk:1",
+                new DateTimeOffset(2025, 2, 1, 0, 0, 0, TimeSpan.Zero)));
 
         using var client = _factory.CreateClient();
 
@@ -1936,6 +1953,111 @@ public sealed class WebServiceEndpointsTests : IAsyncLifetime
         }
     }
 
+    [Fact]
+    public async Task StatementProvenanceEndpointAttachesMetadata()
+    {
+        var tenant = "tenant-provenance";
+        var vulnerabilityKey = "CVE-2025-9200";
+        var statementId = Guid.NewGuid();
+        var recordedAt = DateTimeOffset.Parse("2025-03-01T00:00:00Z", CultureInfo.InvariantCulture);
+
+        using (var scope = _factory.Services.CreateScope())
+        {
+            var eventLog = scope.ServiceProvider.GetRequiredService<IAdvisoryEventLog>();
+            var advisory = new Advisory(
+                advisoryKey: vulnerabilityKey,
+                title: "Provenance seed",
+                summary: "Ready for DSSE metadata",
+                language: "en",
+                published: recordedAt.AddDays(-1),
+                modified: recordedAt,
+                severity: "high",
+                exploitKnown: false,
+                aliases: new[] { vulnerabilityKey },
+                references: Array.Empty<AdvisoryReference>(),
+                affectedPackages: Array.Empty<AffectedPackage>(),
+                cvssMetrics: Array.Empty<CvssMetric>(),
+                provenance: Array.Empty<AdvisoryProvenance>());
+
+            var statementInput = new AdvisoryStatementInput(
+                vulnerabilityKey,
+                advisory,
+                recordedAt,
+                InputDocumentIds: Array.Empty<Guid>(),
+                StatementId: statementId,
+                AdvisoryKey: advisory.AdvisoryKey);
+
+            await eventLog.AppendAsync(new AdvisoryEventAppendRequest(new[] { statementInput }), CancellationToken.None);
+        }
+
+        try
+        {
+            using var client = _factory.CreateClient();
+            client.DefaultRequestHeaders.Add("X-Stella-Tenant", tenant);
+
+            var response = await client.PostAsync(
+                $"/events/statements/{statementId}/provenance?tenant={tenant}",
+                new StringContent(BuildProvenancePayload(), Encoding.UTF8, "application/json"));
+
+            Assert.Equal(HttpStatusCode.Accepted, response.StatusCode);
+
+            using var validationScope = _factory.Services.CreateScope();
+            var database = validationScope.ServiceProvider.GetRequiredService<IMongoDatabase>();
+            var statements = database.GetCollection<BsonDocument>(MongoStorageDefaults.Collections.AdvisoryStatements);
+
+            var stored = await statements
+                .Find(Builders<BsonDocument>.Filter.Eq("_id", statementId.ToString()))
+                .FirstOrDefaultAsync();
+
+            Assert.NotNull(stored);
+            var dsse = stored!["provenance"].AsBsonDocument["dsse"].AsBsonDocument;
+            Assert.Equal("sha256:feedface", dsse["envelopeDigest"].AsString);
+            var trustDoc = stored["trust"].AsBsonDocument;
+            Assert.True(trustDoc["verified"].AsBoolean);
+            Assert.Equal("Authority@stella", trustDoc["verifier"].AsString);
+        }
+        finally
+        {
+            using var cleanupScope = _factory.Services.CreateScope();
+            var database = cleanupScope.ServiceProvider.GetRequiredService<IMongoDatabase>();
+            var statements = database.GetCollection<BsonDocument>(MongoStorageDefaults.Collections.AdvisoryStatements);
+            await statements.DeleteOneAsync(Builders<BsonDocument>.Filter.Eq("_id", statementId.ToString()));
+        }
+    }
+
+    private static string BuildProvenancePayload()
+    {
+        var payload = new
+        {
+            dsse = new
+            {
+                envelopeDigest = "sha256:feedface",
+                payloadType = "application/vnd.in-toto+json",
+                key = new
+                {
+                    keyId = "cosign:SHA256-PKIX:fixture",
+                    issuer = "Authority@stella",
+                    algo = "Ed25519"
+                },
+                rekor = new
+                {
+                    logIndex = 1337,
+                    uuid = "11111111-2222-3333-4444-555555555555",
+                    integratedTime = 1731081600
+                }
+            },
+            trust = new
+            {
+                verified = true,
+                verifier = "Authority@stella",
+                witnesses = 1,
+                policyScore = 1.0
+            }
+        };
+
+        return JsonSerializer.Serialize(payload, new JsonSerializerOptions(JsonSerializerDefaults.Web));
+    }
+
     private sealed class TempDirectory : IDisposable
     {
         public string Path { get; }
@@ -1978,6 +2100,121 @@ public sealed class WebServiceEndpointsTests : IAsyncLifetime
 
     private sealed record ProblemDocument(string? Type, string? Title, int? Status, string? Detail, string? Instance);
 
+    private async Task SeedCanonicalAdvisoriesAsync(params Advisory[] advisories)
+    {
+        using var scope = _factory.Services.CreateScope();
+        var database = scope.ServiceProvider.GetRequiredService<IMongoDatabase>();
+
+        await DropCollectionIfExistsAsync(database, MongoStorageDefaults.Collections.Advisory);
+        await DropCollectionIfExistsAsync(database, MongoStorageDefaults.Collections.Alias);
+
+        if (advisories.Length == 0)
+        {
+            return;
+        }
+
+        var store = scope.ServiceProvider.GetRequiredService<IAdvisoryStore>();
+        foreach (var advisory in advisories)
+        {
+            await store.UpsertAsync(advisory, CancellationToken.None);
+        }
+    }
+
+    private static async Task DropCollectionIfExistsAsync(IMongoDatabase database, string collectionName)
+    {
+        try
+        {
+            await database.DropCollectionAsync(collectionName);
+        }
+        catch (MongoCommandException ex) when (ex.CodeName == "NamespaceNotFound" || ex.Message.Contains("ns not found", StringComparison.OrdinalIgnoreCase))
+        {
+        }
+    }
+
+    private static Advisory CreateStructuredAdvisory(
+        string advisoryKey,
+        string alias,
+        string observationId,
+        DateTimeOffset recordedAt)
+    {
+        const string WorkaroundTitle = "Vendor guidance";
+        const string WorkaroundSummary = "Apply configuration change immediately.";
+        const string WorkaroundUrl = "https://vendor.example/workaround";
+
+        var reference = new AdvisoryReference(
+            WorkaroundUrl,
+            kind: "workaround",
+            sourceTag: WorkaroundTitle,
+            summary: WorkaroundSummary,
+            new AdvisoryProvenance(
+                "nvd",
+                "workaround",
+                observationId,
+                recordedAt,
+                new[] { "/references/0" }));
+
+        var affectedRange = new AffectedVersionRange(
+            rangeKind: "semver",
+            introducedVersion: "1.0.0",
+            fixedVersion: "1.1.0",
+            lastAffectedVersion: null,
+            rangeExpression: ">=1.0.0,<1.1.0",
+            new AdvisoryProvenance(
+                "nvd",
+                "affected",
+                observationId,
+                recordedAt,
+                new[] { "/affectedPackages/0/versionRanges/0" }));
+
+        var affectedPackage = new AffectedPackage(
+            type: AffectedPackageTypes.SemVer,
+            identifier: "pkg:npm/demo",
+            versionRanges: new[] { affectedRange },
+            statuses: Array.Empty<AffectedPackageStatus>(),
+            provenance: new[]
+            {
+                new AdvisoryProvenance(
+                    "nvd",
+                    "affected",
+                    observationId,
+                    recordedAt,
+                    new[] { "/affectedPackages/0" })
+            },
+            normalizedVersions: Array.Empty<NormalizedVersionRule>());
+
+        var cvss = new CvssMetric(
+            "3.1",
+            "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
+            9.8,
+            "critical",
+            new AdvisoryProvenance(
+                "nvd",
+                "cvss",
+                observationId,
+                recordedAt,
+                new[] { "/cvssMetrics/0" }));
+
+        var advisory = new Advisory(
+            advisoryKey,
+            title: "Fixture advisory",
+            summary: "Structured payload fixture",
+            language: "en",
+            published: recordedAt,
+            modified: recordedAt,
+            severity: "critical",
+            exploitKnown: false,
+            aliases: string.IsNullOrWhiteSpace(alias) ? new[] { advisoryKey } : new[] { advisoryKey, alias },
+            references: new[] { reference },
+            affectedPackages: new[] { affectedPackage },
+            cvssMetrics: new[] { cvss },
+            provenance: new[]
+            {
+                new AdvisoryProvenance("nvd", "advisory", observationId, recordedAt)
+            });
+
+        return advisory;
+    }
+
     private async Task SeedAdvisoryRawDocumentsAsync(params BsonDocument[] documents)
     {
         var client = new MongoClient(_runner.ConnectionString);