feat: Add guild charters and task boards for various components

- Introduced guild charters for Scanner Deno, PHP, Ruby, Native, WebService, Java, Surface.Env, Surface.FS, Surface.Secrets, Surface.Validation, UI, Zastava Observer, Zastava Webhook, Zastava Core, and Plugin Platform.
- Each charter outlines the mission, scope, required reading, and working agreements for the respective guilds.
- Created task boards for Surface.Env, Surface.FS, Surface.Secrets, Surface.Validation, and Zastava components to track progress and dependencies.
- Ensured all documents emphasize determinism, offline readiness, security, and integration with shared Surface libraries.

src/Zastava/StellaOps.Zastava.Observer/AGENTS.md

@@ -0,0 +1,29 @@
+# Zastava Observer Guild Charter
+
+## Mission
+Implement the node-level observer that monitors running workloads, detects drift, enforces posture policies, and emits runtime evidence. The service must integrate with Surface libraries, operate in offline/air-gapped environments, and respect tenancy/security constraints.
+
+## Scope
+- Observer DaemonSet host under `StellaOps.Zastava.Observer` (process inventory, drift detection, event emission).
+- Integration with Scanner Surface.FS/Env/Secrets/Validation.
+- Runtime event pipelines feeding Scanner, Policy, Scheduler, and Notify.
+- Telemetry/logging ensuring observability and audit trails.
+
+## Required Reading
+- `docs/modules/zastava/architecture.md`
+- `docs/modules/scanner/design/surface-fs.md`
+- `docs/modules/scanner/design/surface-env.md`
+- `docs/modules/scanner/design/surface-secrets.md`
+- `docs/modules/scanner/design/surface-validation.md`
+- `docs/modules/scanner/architecture.md` (runtime posture sections)
+- `docs/modules/airgap/airgap-mode.md`
+- Any runtime-specific design notes referenced in `TASKS.md`.
+
+## Working Agreement
+1. **Status updates**: mark tasks `DOING`/`DONE` in both `docs/implplan/SPRINTS.md` and local `TASKS.md` when starting/finishing work.
+2. **Surface compliance**: rely on Surface libraries for cache/env/secret handling; run validators before collecting evidence.
+3. **Deterministic evidence**: normalise timestamps, hashes, and paths; ensure outputs remain stable for replay/audit.
+4. **Security**: enforce Authority scopes (OpToks, mTLS/DPoP), redaction of sensitive fields, and namespace isolation.
+5. **Offline readiness**: avoid external network calls; provide clear errors for missing bundles/secrets.
+6. **Testing**: maintain unit/integration/e2e tests for drift detection, event emission, and failure scenarios; support offline test runs.
+7. **Documentation**: update Zastava operations docs when behaviour changes; coordinate with DevOps on deployment manifests.

src/Zastava/StellaOps.Zastava.Observer/TASKS.md

@@ -2,5 +2,8 @@
 
 | ID | Status | Owner(s) | Depends on | Description | Exit Criteria |
 |----|--------|----------|------------|-------------|---------------|
+| ZASTAVA-SURFACE-01 | TODO | Zastava Observer Guild | SURFACE-FS-02 | Integrate Surface.FS client for runtime drift detection (lookup cached layer hashes/entry traces). | Observer validates runtime vs cache; integration tests cover drift + cache-miss cases. |
+| ZASTAVA-ENV-01 | TODO | Zastava Observer Guild | SURFACE-ENV-02 | Adopt Surface.Env helpers for cache endpoints, secret refs, and feature toggles. | Observer configuration centralised; misconfiguration warnings logged; docs updated. |
+| ZASTAVA-SECRETS-01 | TODO | Zastava Observer Guild, Security Guild | SURFACE-SECRETS-02 | Retrieve CAS/attestation access via Surface.Secrets instead of inline secret stores. | Secrets resolved through shared provider; rotation/resilience tests pass. |
 
 > 2025-10-24: Observer unit tests pending; `dotnet restore` requires offline copies of `Google.Protobuf`, `Grpc.Net.Client`, `Grpc.Tools` in `local-nuget` before execution can be verified.

src/Zastava/StellaOps.Zastava.Webhook/AGENTS.md

@@ -0,0 +1,30 @@
+# Zastava Webhook Guild Charter
+
+## Mission
+Operate the Kubernetes admission webhook enforcing image/SBOM/attestation policies using data from Scanner, Policy Engine, and Surface caches. The webhook must provide deterministic verdicts, integrate with Surface libraries, and remain offline/air-gap compatible.
+
+## Scope
+- Admission controller code under `StellaOps.Zastava.Webhook`.
+- Request validation, response generation, and audit logging.
+- Integration with Surface.FS/Env/Secrets/Validation and Authority scopes.
+- Helm/Compose configuration samples and compatibility with sealed environments.
+
+## Required Reading
+- `docs/modules/zastava/architecture.md`
+- `docs/modules/scanner/design/surface-fs.md`
+- `docs/modules/scanner/design/surface-env.md`
+- `docs/modules/scanner/design/surface-secrets.md`
+- `docs/modules/scanner/design/surface-validation.md`
+- `docs/modules/scanner/architecture.md` (runtime posture/admission sections)
+- `docs/modules/policy/architecture.md`
+- `docs/modules/airgap/airgap-mode.md`
+- `docs/modules/devops/runbooks/zastava-deployment.md`
+
+## Working Agreement
+1. **Task state**: update `docs/implplan/SPRINTS.md` and local `TASKS.md` to `DOING`/`DONE` as you start or complete work.
+2. **Surface usage**: fetch cache manifests via Surface.FS, configuration via Surface.Env, secrets via Surface.Secrets; run validators before enforcing policies.
+3. **Deterministic verdicts**: avoid non-deterministic data in admission responses; include explain traces referencing evidence IDs.
+4. **Security**: enforce mTLS, Authority OpTok scopes, and tenant context; audit all allow/deny decisions.
+5. **Offline posture**: operate without external egress; surface actionable errors when cache/attestation data is missing.
+6. **Testing**: maintain unit/e2e tests (Kubernetes admission harness) covering pass/fail paths, error handling, and performance budgets.
+7. **Documentation**: update deployment guides, operator runbooks, and onboarding docs when webhook behaviour or configuration changes.

src/Zastava/StellaOps.Zastava.Webhook/TASKS.md

@@ -2,5 +2,8 @@
 
 | ID | Status | Owner(s) | Depends on | Description | Exit Criteria |
 |----|--------|----------|------------|-------------|---------------|
+| ZASTAVA-SURFACE-02 | TODO | Zastava Webhook Guild | SURFACE-FS-02, ZASTAVA-SURFACE-01 | Enforce Surface.FS availability during admission (deny when cache missing/stale) and embed pointer checks in webhook response. | Admission tests cover cache present/missing paths; policy docs updated; metrics emitted. |
+| ZASTAVA-ENV-02 | TODO | Zastava Webhook Guild | SURFACE-ENV-02 | Switch to Surface.Env helpers for webhook configuration (cache endpoint, secret refs, feature toggles). | Webhook uses helper; helm/compose manifests updated; integration tests cover env overrides. |
+| ZASTAVA-SECRETS-02 | TODO | Zastava Webhook Guild, Security Guild | SURFACE-SECRETS-02 | Retrieve attestation verification secrets via Surface.Secrets. | Shared secret provider integrated; rotation/e2e tests pass; secrets no longer read directly from env. |
 
 > Status update · 2025-10-19: Confirmed no prerequisites for ZASTAVA-WEBHOOK-12-101/102/103; tasks moved to DOING for kickoff. Implementation plan covering TLS bootstrap, backend contract, caching/metrics recorded in `IMPLEMENTATION_PLAN.md`.

src/Zastava/__Libraries/StellaOps.Zastava.Core/AGENTS.md

@@ -0,0 +1,28 @@
+# Zastava Core Guild Charter
+
+## Mission
+Maintain shared domain models, policy evaluation helpers, and event contracts used by Zastava Observer, Webhook, CLI, and downstream services. Core components must remain deterministic, tenant-aware, and compatible with offline deployments.
+
+## Scope
+- Shared models and services under `StellaOps.Zastava.Core` (events, posture verdicts, configuration primitives).
+- Serialization utilities, validation logic, and integration contracts for runtime posture data.
+- Backward-compatible evolution of event schemas and public APIs.
+- Supporting tests and fixtures consumed by Observer/Webhook/CLI.
+
+## Required Reading
+- `docs/modules/zastava/architecture.md`
+- `docs/modules/scanner/architecture.md`
+- `docs/modules/scanner/design/surface-fs.md`
+- `docs/modules/scanner/design/surface-env.md`
+- `docs/modules/scanner/design/surface-secrets.md`
+- `docs/modules/scanner/design/surface-validation.md`
+- `docs/modules/policy/architecture.md`
+- `docs/modules/devops/runbooks/zastava-deployment.md`
+
+## Working Agreement
+1. **Status alignment**: mark tasks `DOING`/`DONE` in both `docs/implplan/SPRINTS.md` and local `TASKS.md` at start/finish.
+2. **Compatibility**: version event schemas/models; provide migration notes and ensure Observer/Webhook consumers stay in lock-step.
+3. **Determinism**: avoid wall-clock or random values in shared models; normalise timestamps; maintain canonical ordering.
+4. **Security & tenancy**: include tenant identifiers and audit fields where required; document contract changes for other guilds.
+5. **Testing**: keep unit/integration tests covering schema contracts, serialization, and validation; coordinate with downstream components when fixtures change.
+6. **Documentation**: update Zastava architecture docs or add design notes when shared contracts evolve; notify Docs/DevOps for release notes and deployment guidance.