From 6c1177a6ceab81b77b16ec01a6c859b9e3c12f6a Mon Sep 17 00:00:00 2001 From: StellaOps Bot Date: Sat, 6 Dec 2025 00:47:29 +0200 Subject: [PATCH] Enhance risk API documentation and error handling - Updated API documentation for risk endpoints to include optional caching headers and error catalog references. - Added a new error catalog JSON file to standardize error responses. - Improved explainability documentation with sample outputs for console and CLI. - Added SHA256 checksums for new sample files related to explainability. - Refined AocGuard tests to utilize a helper method for generating test JSON, improving readability and maintainability. - Updated runbook references to ensure consistency in sprint documentation. - Introduced stub implementations for MongoDB storage interfaces and options, laying groundwork for future development. - Disabled analytics in Angular CLI configuration for privacy considerations. --- ...PRINT_0308_0001_0008_docs_tasks_md_viii.md | 8 +- docs/implplan/tasks-all.md | 2540 ++++++++--------- docs/risk/api.md | 8 +- docs/risk/explainability.md | 4 +- docs/risk/samples/api/SHA256SUMS | 1 + docs/risk/samples/api/error-catalog.json | 13 + docs/risk/samples/explain/SHA256SUMS | 2 + docs/risk/samples/explain/cli-explain.txt | 12 + docs/risk/samples/explain/console-frame.json | 19 + docs/runbooks/replay_ops.md | 4 +- scripts/commit-prep-artifacts.sh | 2 +- .../Documents/DocumentRecord.cs | 11 + .../IDocumentStore.cs | 8 + .../ISourceStateRepository.cs | 8 + .../MongoStorageOptions.cs | 10 + .../StellaOps.Concelier.Storage.Mongo.csproj | 12 + .../Aoc/AdvisorySchemaValidatorTests.cs | 49 +- .../StellaOps.Concelier.Core.Tests.csproj | 8 +- src/Web/StellaOps.Web/angular.json | 3 + 19 files changed, 1403 insertions(+), 1319 deletions(-) create mode 100644 docs/risk/samples/api/error-catalog.json create mode 100644 docs/risk/samples/explain/cli-explain.txt create mode 100644 docs/risk/samples/explain/console-frame.json create mode 100644 src/Concelier/__Libraries/StellaOps.Concelier.Storage.Mongo/Documents/DocumentRecord.cs create mode 100644 src/Concelier/__Libraries/StellaOps.Concelier.Storage.Mongo/IDocumentStore.cs create mode 100644 src/Concelier/__Libraries/StellaOps.Concelier.Storage.Mongo/ISourceStateRepository.cs create mode 100644 src/Concelier/__Libraries/StellaOps.Concelier.Storage.Mongo/MongoStorageOptions.cs create mode 100644 src/Concelier/__Libraries/StellaOps.Concelier.Storage.Mongo/StellaOps.Concelier.Storage.Mongo.csproj diff --git a/docs/implplan/SPRINT_0308_0001_0008_docs_tasks_md_viii.md b/docs/implplan/SPRINT_0308_0001_0008_docs_tasks_md_viii.md index d304615c9..aa65f6ddd 100644 --- a/docs/implplan/SPRINT_0308_0001_0008_docs_tasks_md_viii.md +++ b/docs/implplan/SPRINT_0308_0001_0008_docs_tasks_md_viii.md @@ -36,8 +36,8 @@ | 11 | DOCS-RISK-66-002 | DONE (2025-12-05) | Profile schema + sample fixture added. | Docs Guild · Policy Guild | Author `/docs/risk/profiles.md` (authoring, versioning, scope). | | 12 | DOCS-RISK-66-003 | DONE (2025-12-05) | Factor catalog + normalized fixture added. | Docs Guild · Risk Engine Guild | Publish `/docs/risk/factors.md` (signals, transforms, reducers, TTLs). | | 13 | DOCS-RISK-66-004 | DONE (2025-12-05) | Formula/gating doc + explain fixture added. | Docs Guild · Risk Engine Guild | Create `/docs/risk/formulas.md` (math, normalization, gating, severity). | -| 14 | DOCS-RISK-67-001 | TODO | Depends on 66-004; need engine metrics/screenshots. | Docs Guild · Risk Engine Guild | Publish `/docs/risk/explainability.md` (artifact schema, UI screenshots). | -| 15 | DOCS-RISK-67-002 | TODO | Depends on 67-001; needs API publishing workflow. | Docs Guild · API Guild | Produce `/docs/risk/api.md` with endpoint reference/examples. | +| 14 | DOCS-RISK-67-001 | DONE (2025-12-05) | Explainability doc published with CLI/console fixtures and hashes. | Docs Guild · Risk Engine Guild | Publish `/docs/risk/explainability.md` (artifact schema, UI screenshots). | +| 15 | DOCS-RISK-67-002 | DONE (2025-12-05) | API doc published with samples, error catalog, ETag guidance. | Docs Guild · API Guild | Produce `/docs/risk/api.md` with endpoint reference/examples. | ## Wave Coordination - Single wave for Md.VIII; no per-wave snapshots required. Revisit if tasks split across guild weeks. @@ -74,6 +74,7 @@ | Add per-folder READMEs in `docs/risk/samples/*` for intake rules | Docs Guild | 2025-12-05 | DONE (2025-12-05) | | Add intake log template for risk samples | Docs Guild | 2025-12-05 | DONE (2025-12-05) | | Daily signal check (registry schema + PLLG0104 payloads) and log outcome | Docs Guild | 2025-12-13 | DOING (2025-12-05) | +| Capture console/CLI telemetry frames for explainability visuals | Console Guild | 2025-12-15 | OPEN | ## Decisions & Risks ### Decisions @@ -84,7 +85,7 @@ | Risk | Impact | Mitigation | | --- | --- | --- | | DOCS-POLICY-27 chain blocked by missing promotion/registry inputs | Entire policy documentation ladder stalls; pushes Md.IX hand-off | Track in BLOCKED_DEPENDENCY_TREE; weekly check-ins with Policy/Registry Guilds; stage scaffolds while waiting. | -| Risk documentation chain lacks telemetry captures | Console/CLI visuals still missing for 67-001/002 | Collect UI traces; until then, rely on frozen JSON fixtures and keep docs text-only. | +| Risk documentation chain lacks real telemetry captures | Console/CLI visuals still pending; current fixtures are synthetic | Collect UI traces; until then, rely on frozen JSON fixtures and keep docs text-only. | ## Execution Log | Date (UTC) | Update | Owner | @@ -108,6 +109,7 @@ | 2025-12-05 | Scheduled next signal check for 2025-12-06 15:00 UTC to minimize lag when inputs arrive. | Docs Guild | | 2025-12-05 | Enriched risk overview/profiles/factors/formulas outlines with legacy content, determinism rules, and expected schemas; flipped related action tracker items to DONE. | Docs Guild | | 2025-12-05 | Consumed `CONTRACT-RISK-SCORING-002`, populated risk overview/profiles/factors/formulas with contract fields/gates, added deterministic fixtures and SHA manifests, and marked DOCS-RISK-66-001..004 DONE. | Docs Guild | +| 2025-12-05 | Published explainability/API docs with CLI + console fixtures and error catalog; marked DOCS-RISK-67-001/002 DONE; added telemetry capture follow-up in Action Tracker. | Docs Guild | | 2025-12-06 | Signal check 15:00 UTC: still no registry schema alignment or PLLG0104 payloads; keep 27-008 and 66-001/002 pending; next check 2025-12-07 15:00 UTC. | Docs Guild | | 2025-12-07 | Signal check 15:00 UTC: no updates; keep 27-008 and 66-001/002 pending; next check 2025-12-08 15:00 UTC. | Docs Guild | | 2025-12-08 | Signal check 15:00 UTC: no updates; keep 27-008 and 66-001/002 pending; next check 2025-12-09 15:00 UTC. | Docs Guild | diff --git a/docs/implplan/tasks-all.md b/docs/implplan/tasks-all.md index 9cbbfbfd8..7803130ce 100644 --- a/docs/implplan/tasks-all.md +++ b/docs/implplan/tasks-all.md @@ -16,13 +16,13 @@ | SURFACE-FS-02 | DONE (2025-11-24) | 2025-11-24 | SPRINT_0136_0001_0001_scanner_surface | Scanner Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.FS) | src/Scanner/__Libraries/StellaOps.Scanner.Surface.FS | FileSurfaceManifestStore/Reader/Writer, path builder, cache options per `surface-fs.md`. | SURFACE-FS-01 | SCSS0101 | | SCANNER-ANALYZERS-LANG-10-309 | DONE (2025-10-21) | 2025-10-21 | SPRINT_0131_0001_0001_scanner_surface | Language Analyzer Guild | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang | Packaged language analyzers as restart-time plug-ins (manifest + host registration); artefacts in Offline Kit bundle. | — | SCSA0101 | | SCANNER-ANALYZERS-PHP-27-001 | BLOCKED (2025-11-24) | 2025-11-24 | SPRINT_0131_0001_0001_scanner_surface | PHP Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php) | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php | Waiting on PHP analyzer bootstrap spec/fixtures (composer/VFS schema, offline kit target). | — | SCSA0101 | -| SCANNER-ENTRYTRACE-18-508 | BLOCKED (2025-11-25) | 2025-11-25 | SPRINT_136_scanner_surface | EntryTrace Guild | | Depends on 18-503/504/505/506 outputs; awaiting upstream EntryTrace baseline. | — | SCSS0101 | +| SCANNER-ENTRYTRACE-18-508 | BLOCKED (2025-11-25) | 2025-11-25 | SPRINT_0136_0000_0001_scanner_surface | EntryTrace Guild | | Depends on 18-503/504/505/506 outputs; awaiting upstream EntryTrace baseline. | — | SCSS0101 | | SCANNER-SECRETS-02 | DONE (2025-11-23) | 2025-11-23 | SPRINT_0136_0001_0001_scanner_surface | Secrets Analyzer Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.Secrets) | src/Scanner/__Libraries/StellaOps.Scanner.Surface.Secrets | Provider chain implemented (primary + fallback) with DI wiring; tests added (`StellaOps.Scanner.Surface.Secrets.Tests`). | SURFACE-SECRETS-01 | SCSS0101 | -| SCANNER-SURFACE-01 | BLOCKED (2025-11-25) | 2025-11-25 | SPRINT_136_scanner_surface | Scanner Guild | | Task definition/contract missing; needs scope before implementation. | — | SCSS0101 | +| SCANNER-SURFACE-01 | BLOCKED (2025-11-25) | 2025-11-25 | SPRINT_0136_0000_0001_scanner_surface | Scanner Guild | | Task definition/contract missing; needs scope before implementation. | — | SCSS0101 | | SCANNER-ANALYZERS-PHP-27-001 | BLOCKED (2025-11-24) | 2025-11-24 | SPRINT_0131_0001_0001_scanner_surface | PHP Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php) | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php | Waiting on PHP analyzer bootstrap spec/fixtures (composer/VFS schema, offline kit target). | — | SCSA0101 | -| SCANNER-ENTRYTRACE-18-508 | BLOCKED (2025-11-25) | 2025-11-25 | SPRINT_136_scanner_surface | EntryTrace Guild | | Depends on 18-503/504/505/506 outputs; awaiting upstream EntryTrace baseline. | — | SCSS0101 | +| SCANNER-ENTRYTRACE-18-508 | BLOCKED (2025-11-25) | 2025-11-25 | SPRINT_0136_0000_0001_scanner_surface | EntryTrace Guild | | Depends on 18-503/504/505/506 outputs; awaiting upstream EntryTrace baseline. | — | SCSS0101 | | SCANNER-SECRETS-02 | DONE (2025-11-23) | 2025-11-23 | SPRINT_0136_0001_0001_scanner_surface | Secrets Analyzer Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.Secrets) | src/Scanner/__Libraries/StellaOps.Scanner.Surface.Secrets | Provider chain implemented (primary + fallback) with DI wiring; tests added (`StellaOps.Scanner.Surface.Secrets.Tests`). | SURFACE-SECRETS-01 | SCSS0101 | -| SCANNER-SURFACE-01 | BLOCKED (2025-11-25) | | SPRINT_136_scanner_surface | Scanner Guild | | — | — | SCSS0101 | +| SCANNER-SURFACE-01 | BLOCKED (2025-11-25) | | SPRINT_0136_0000_0001_scanner_surface | Scanner Guild | | — | — | SCSS0101 | | CARTO-GRAPH-21-002 | DONE | 2025-11-17 | SPRINT_113_concelier_ii | Cartographer Guild | src/Cartographer/Contracts | ATLN0101 approvals | Task #1 schema freeze | CAGR0101 | | POLICY-ENGINE-27-004 | DONE (2025-10-19) | 2025-10-19 | SPRINT_0120_0000_0001_policy_reasoning | Policy Guild (src/Policy/StellaOps.Policy.Engine) | src/Policy/StellaOps.Policy.Engine | Update golden/property tests to cover coverage metadata, symbol tables, explain traces, and complexity limits; fixtures for Registry/Console integration. Completed in Sprint 120 (archived tasks). | POLICY-ENGINE-27-003 | PLPE0102 | | --JOB-ORCHESTRATOR-DOCS-0001 | DONE (2025-11-19) | 2025-11-19 | SPRINT_0323_0001_0001_docs_modules_orchestrator | Docs Guild (docs/modules/orchestrator) | docs/modules/orchestrator | ORGR0102 outline; mapped to ORCH-DOCS-0001 README/diagram refresh. | — | DOOR0101 | @@ -59,13 +59,13 @@ | 45-001 | BLOCKED | 2025-11-25 | SPRINT_0502_0001_0001_ops_deployment_ii | Deployment Guild (ops/deployment) | ops/deployment | 44-003 | 44-003 | DVDO0103 | | 45-002 | BLOCKED | 2025-11-25 | SPRINT_0502_0001_0001_ops_deployment_ii | Deployment Guild · Security Guild (ops/deployment) | ops/deployment | 45-001 | 45-001 | DVDO0103 | | 45-003 | BLOCKED | 2025-11-25 | SPRINT_0502_0001_0001_ops_deployment_ii | Deployment Guild · Observability Guild (ops/deployment) | ops/deployment | 45-002 | 45-002 | DVDO0103 | -| 50-002 | DONE (2025-11-27) | | SPRINT_170_notifications_telemetry | Telemetry Core Guild | src/Telemetry/StellaOps.Telemetry.Core | SGSI0101 feed availability | SGSI0101 feed availability | TLTY0101 | -| 51-002 | BLOCKED | 2025-11-25 | SPRINT_170_notifications_telemetry | Telemetry Core Guild · Observability Guild · Security Guild | src/Telemetry/StellaOps.Telemetry.Core | OBS-50 baselines | Waiting on OBS-50 baselines and ORCH-OBS-50-001 schemas | TLTY0101 | +| 50-002 | DONE (2025-11-27) | | SPRINT_0170_0000_0001_notifications_telemetry | Telemetry Core Guild | src/Telemetry/StellaOps.Telemetry.Core | SGSI0101 feed availability | SGSI0101 feed availability | TLTY0101 | +| 51-002 | BLOCKED | 2025-11-25 | SPRINT_0170_0000_0001_notifications_telemetry | Telemetry Core Guild · Observability Guild · Security Guild | src/Telemetry/StellaOps.Telemetry.Core | OBS-50 baselines | Waiting on OBS-50 baselines and ORCH-OBS-50-001 schemas | TLTY0101 | | 54-001 | BLOCKED | 2025-11-25 | SPRINT_0503_0001_0001_ops_devops_i | Exporter Guild · AirGap Time Guild · CLI Guild | | Await PGMI0101 staffing confirmation | Staffing not assigned (PROGRAM-STAFF-1001) | AGCO0101 | -| 56-001 | BLOCKED | 2025-11-25 | SPRINT_170_notifications_telemetry | Telemetry Core Guild · Observability Guild | src/Telemetry/StellaOps.Telemetry.Core | SGSI0101 provenance | Blocked: SGSI0101 provenance feed/contract pending | TLTY0101 | +| 56-001 | BLOCKED | 2025-11-25 | SPRINT_0170_0000_0001_notifications_telemetry | Telemetry Core Guild · Observability Guild | src/Telemetry/StellaOps.Telemetry.Core | SGSI0101 provenance | Blocked: SGSI0101 provenance feed/contract pending | TLTY0101 | | 58 series | BLOCKED | 2025-11-25 | SPRINT_0120_0000_0001_policy_reasoning | Findings Ledger Guild · AirGap Guilds · Evidence Locker Guild | src/Findings/StellaOps.Findings.Ledger | Placeholder for LEDGER-AIRGAP-56/57/58 chain | Blocked on LEDGER-AIRGAP-56-002 staleness spec and AirGap time anchors | PLLG0102 | -| 61-001 | DONE | 2025-11-18 | SPRINT_511_api | API Governance Guild | src/Api/StellaOps.Api.Governance | Spectral config + CI lint job | — | APIG0101 | -| 61-002 | DONE | 2025-11-18 | SPRINT_511_api | API Governance Guild | src/Api/StellaOps.Api.Governance | Example coverage checker | 61-001 | APIG0101 | +| 61-001 | DONE | 2025-11-18 | SPRINT_0511_0000_0001_api | API Governance Guild | src/Api/StellaOps.Api.Governance | Spectral config + CI lint job | — | APIG0101 | +| 61-002 | DONE | 2025-11-18 | SPRINT_0511_0000_0001_api | API Governance Guild | src/Api/StellaOps.Api.Governance | Example coverage checker | 61-001 | APIG0101 | | 62-001 | BLOCKED | 2025-11-25 | SPRINT_206_devportal | DevPortal Guild | src/DevPortal/StellaOps.DevPortal.Site | APIG0101 outputs | Waiting on APIG0101 outputs / API baseline | DEVL0101 | | 62-002 | BLOCKED | 2025-11-25 | SPRINT_206_devportal | DevPortal Guild | src/DevPortal/StellaOps.DevPortal.Site | 62-001 | Blocked: 62-001 not delivered | DEVL0101 | | 63-001 | BLOCKED | 2025-11-25 | SPRINT_206_devportal | DevPortal Guild · Platform Guild | src/DevPortal/StellaOps.DevPortal.Site | 62-002 | Blocked: 62-002 outstanding | DEVL0101 | @@ -91,7 +91,7 @@ | AIRGAP-56 | DONE (2025-11-24) | 2025-11-24 | SPRINT_110_ingestion_evidence | Excititor Guild · AirGap Guilds | docs/modules/airgap/airgap-mode.md | Air-gap ingest parity delivered against frozen LNM schema. | CONCELIER-GRAPH-21-001; CONCELIER-GRAPH-21-002; ATTEST-PLAN-2001 | AGCO0101 | | AIRGAP-56-001 | DONE (2025-11-24) | 2025-11-24 | SPRINT_110_ingestion_evidence | Exporter Guild · AirGap Time Guild · CLI Guild | docs/modules/airgap/airgap-mode.md | Mirror import helpers and bundle catalog wired for sealed mode. | PROGRAM-STAFF-1001 | AGCO0101 | | AIRGAP-56-001..58-001 | DONE (2025-11-24) | 2025-11-24 | SPRINT_110_ingestion_evidence | Concelier Core · AirGap Guilds | docs/modules/airgap/airgap-mode.md | Deterministic bundle + manifest/entry-trace and sealed-mode deploy runbook shipped. | CONCELIER-GRAPH-21-001; CONCELIER-GRAPH-21-002; ELOCKER-CONTRACT-2001 | AGCO0101 | -| AIRGAP-56-002 | DONE | | SPRINT_170_notifications_telemetry | Notifications Service Guild · DevOps Guild | src/Notify/StellaOps.Notify | | | NOTY0101 | +| AIRGAP-56-002 | DONE | | SPRINT_0170_0000_0001_notifications_telemetry | Notifications Service Guild · DevOps Guild | src/Notify/StellaOps.Notify | | | NOTY0101 | | AIRGAP-56-003 | DONE | 2025-11-23 | SPRINT_0301_0001_0001_docs_md_i | Docs Guild · Exporter Guild | docs/modules/airgap | DOCS-AIRGAP-56-002 | DOCS-AIRGAP-56-002 | AIDG0101 | | AIRGAP-56-004 | DONE | 2025-11-23 | SPRINT_0301_0001_0001_docs_md_i | Docs Guild · Deployment Guild | docs/modules/airgap | AIRGAP-56-003 | DOCS-AIRGAP-56-003 | AIDG0101 | | AIRGAP-57 | DONE (2025-11-24) | 2025-11-24 | SPRINT_110_ingestion_evidence | Excititor Guild · AirGap Guilds | docs/modules/airgap/airgap-mode.md | Air-gap bundle timeline/hooks completed. | CONCELIER-GRAPH-21-001; CONCELIER-GRAPH-21-002; ATTEST-PLAN-2001 | AGCO0101 | @@ -140,72 +140,72 @@ | ANALYZERS-JAVA-21-011 | TODO | | SPRINT_131_scanner_surface | Java Analyzer Guild · DevOps Guild | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Java | Requires SCANNER-ANALYZERS-JAVA-21-010 + DevOps packaging | SCANNER-ANALYZERS-JAVA-21-010 | SCSA0301 | | ANALYZERS-LANG-11-001 | BLOCKED | 2025-11-17 | SPRINT_131_scanner_surface | StellaOps.Scanner EPDR Guild · Language Analyzer Guild | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.DotNet | Requires SCANNER-ANALYZERS-LANG-10-309 artifact; local dotnet tests hanging, needs clean runner/CI diagnostics | SCANNER-ANALYZERS-LANG-10-309 | SCSA0103 | | AGENTS-SCANNER-00-001 | DONE | 2025-11-17 | SPRINT_0132_scanner_surface | Project Management Guild · Scanner Guild | src/Scanner | Create or update module-level AGENTS.md covering roles, required docs, allowed shared directories, determinism/testing rules | — | SCSS-GOV-0001 | -| ANALYZERS-LANG-11-002 | TODO | | SPRINT_132_scanner_surface | StellaOps.Scanner EPDR Guild | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.DotNet | Depends on #1 for shared metadata | SCANNER-ANALYZERS-LANG-11-001 | SCSA0103 | -| ANALYZERS-LANG-11-003 | TODO | | SPRINT_132_scanner_surface | StellaOps.Scanner EPDR Guild · Signals Guild | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.DotNet | Needs #2 plus Signals schema for entry-trace | SCANNER-ANALYZERS-LANG-11-002 | SCSA0103 | -| ANALYZERS-LANG-11-004 | TODO | | SPRINT_132_scanner_surface | StellaOps.Scanner EPDR Guild · SBOM Service Guild | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.DotNet | Requires #3 and SBOM service hooks | SCANNER-ANALYZERS-LANG-11-003 | SCSA0103 | -| ANALYZERS-LANG-11-005 | TODO | | SPRINT_132_scanner_surface | StellaOps.Scanner EPDR Guild · QA Guild | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.DotNet | Depends on #4 for QA fixtures | SCANNER-ANALYZERS-LANG-11-004 | SCSA0103 | -| ANALYZERS-NATIVE-20-001 | TODO | | SPRINT_132_scanner_surface | Native Analyzer Guild | src/Scanner/StellaOps.Scanner.Analyzers.Native | Bootstrap native analyzer helpers | Bootstrap native analyzer helpers | SCSA0401 | -| ANALYZERS-NATIVE-20-002 | TODO | | SPRINT_132_scanner_surface | Native Analyzer Guild | src/Scanner/StellaOps.Scanner.Analyzers.Native | Depends on #1 | SCANNER-ANALYZERS-NATIVE-20-001 | SCSA0401 | -| ANALYZERS-NATIVE-20-003 | TODO | | SPRINT_132_scanner_surface | Native Analyzer Guild | src/Scanner/StellaOps.Scanner.Analyzers.Native | Depends on #2 | SCANNER-ANALYZERS-NATIVE-20-002 | SCSA0401 | -| ANALYZERS-NATIVE-20-004 | TODO | | SPRINT_132_scanner_surface | Native Analyzer Guild | src/Scanner/StellaOps.Scanner.Analyzers.Native | Depends on #3 | SCANNER-ANALYZERS-NATIVE-20-003 | SCSA0401 | -| ANALYZERS-NATIVE-20-005 | TODO | | SPRINT_132_scanner_surface | Native Analyzer Guild | src/Scanner/StellaOps.Scanner.Analyzers.Native | Depends on #4 | SCANNER-ANALYZERS-NATIVE-20-004 | SCSA0401 | -| ANALYZERS-NATIVE-20-006 | TODO | | SPRINT_132_scanner_surface | Native Analyzer Guild | src/Scanner/StellaOps.Scanner.Analyzers.Native | Depends on #5 | SCANNER-ANALYZERS-NATIVE-20-005 | SCSA0401 | -| ANALYZERS-NATIVE-20-007 | TODO | | SPRINT_132_scanner_surface | Native Analyzer Guild | src/Scanner/StellaOps.Scanner.Analyzers.Native | Depends on #6 | SCANNER-ANALYZERS-NATIVE-20-006 | SCSA0401 | -| ANALYZERS-NATIVE-20-008 | TODO | | SPRINT_132_scanner_surface | Native Analyzer Guild | src/Scanner/StellaOps.Scanner.Analyzers.Native | Depends on #7 | SCANNER-ANALYZERS-NATIVE-20-007 | SCSA0401 | -| ANALYZERS-NATIVE-20-009 | TODO | | SPRINT_132_scanner_surface | Native Analyzer Guild | src/Scanner/StellaOps.Scanner.Analyzers.Native | Depends on #8 | SCANNER-ANALYZERS-NATIVE-20-008 | SCSA0401 | -| ANALYZERS-NATIVE-20-010 | TODO | | SPRINT_132_scanner_surface | Native Analyzer Guild | src/Scanner/StellaOps.Scanner.Analyzers.Native | Depends on #9 | SCANNER-ANALYZERS-NATIVE-20-009 | SCSA0401 | -| ANALYZERS-NODE-22-001 | TODO | | SPRINT_132_scanner_surface | Node Analyzer Guild | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node | Bootstrap Node analyzer helper | Bootstrap Node analyzer helper | SCSA0501 | -| ANALYZERS-NODE-22-002 | TODO | | SPRINT_132_scanner_surface | Node Analyzer Guild | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node | Depends on #1 | SCANNER-ANALYZERS-NODE-22-001 | SCSA0501 | -| ANALYZERS-NODE-22-003 | TODO | | SPRINT_132_scanner_surface | Node Analyzer Guild | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node | Depends on #2 | SCANNER-ANALYZERS-NODE-22-002 | SCSA0501 | -| ANALYZERS-NODE-22-004 | TODO | | SPRINT_132_scanner_surface | Node Analyzer Guild | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node | Depends on #3 | SCANNER-ANALYZERS-NODE-22-003 | SCSA0501 | -| ANALYZERS-NODE-22-005 | TODO | | SPRINT_132_scanner_surface | Node Analyzer Guild | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node | Depends on #4 | SCANNER-ANALYZERS-NODE-22-004 | SCSA0501 | -| ANALYZERS-NODE-22-006 | TODO | | SPRINT_133_scanner_surface | Node Analyzer Guild | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node | Depends on #5 | SCANNER-ANALYZERS-NODE-22-005 | SCSA0501 | -| ANALYZERS-NODE-22-007 | TODO | | SPRINT_133_scanner_surface | Node Analyzer Guild | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node | Depends on #6 | SCANNER-ANALYZERS-NODE-22-006 | SCSA0501 | -| ANALYZERS-NODE-22-008 | TODO | | SPRINT_133_scanner_surface | Node Analyzer Guild | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node | Depends on #7 | SCANNER-ANALYZERS-NODE-22-007 | SCSA0501 | -| ANALYZERS-NODE-22-009 | TODO | | SPRINT_133_scanner_surface | Node Analyzer Guild · QA Guild | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node | Depends on #8 | SCANNER-ANALYZERS-NODE-22-008 | SCSA0501 | -| ANALYZERS-NODE-22-010 | TODO | | SPRINT_133_scanner_surface | Node Analyzer Guild · Signals Guild | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node | Depends on #9 | SCANNER-ANALYZERS-NODE-22-009 | SCSA0501 | -| ANALYZERS-NODE-22-011 | TODO | | SPRINT_133_scanner_surface | Node Analyzer Guild · DevOps Guild | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node | Depends on ANALYZERS-NODE-22-010 + DevOps packaging | SCANNER-ANALYZERS-NODE-22-010 | SCSA0502 | -| ANALYZERS-NODE-22-012 | TODO | | SPRINT_133_scanner_surface | Node Analyzer Guild | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node | Needs #1 regression fixtures | SCANNER-ANALYZERS-NODE-22-011 | SCSA0502 | -| ANALYZERS-PHP-27-001 | TODO | | SPRINT_133_scanner_surface | PHP Analyzer Guild | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php | Analyzer helper bootstrap | Analyzer helper bootstrap | SCSA0601 | -| ANALYZERS-PHP-27-002 | TODO | | SPRINT_133_scanner_surface | PHP Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php) | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php | SCANNER-ANALYZERS-PHP-27-001 | SCANNER-ANALYZERS-PHP-27-001 | SCSA0101 | -| ANALYZERS-PHP-27-003 | TODO | | SPRINT_133_scanner_surface | PHP Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php) | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php | SCANNER-ANALYZERS-PHP-27-002 | SCANNER-ANALYZERS-PHP-27-002 | SCSA0101 | -| ANALYZERS-PHP-27-004 | TODO | | SPRINT_133_scanner_surface | PHP Analyzer Guild | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php | Depends on SCANNER-ANALYZERS-PHP-27-003 | SCANNER-ANALYZERS-PHP-27-003 | SCSA0601 | -| ANALYZERS-PHP-27-005 | TODO | | SPRINT_133_scanner_surface | PHP Analyzer Guild | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php | Depends on #2 | SCANNER-ANALYZERS-PHP-27-004 | SCSA0601 | -| ANALYZERS-PHP-27-006 | TODO | | SPRINT_133_scanner_surface | PHP Analyzer Guild | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php | Depends on #3 | SCANNER-ANALYZERS-PHP-27-005 | SCSA0601 | -| ANALYZERS-PHP-27-007 | TODO | | SPRINT_133_scanner_surface | PHP Analyzer Guild | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php | Depends on #4 | SCANNER-ANALYZERS-PHP-27-006 | SCSA0601 | -| ANALYZERS-PHP-27-008 | TODO | | SPRINT_134_scanner_surface | PHP Analyzer Guild | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php | Depends on #1 + CLI feedback | SCANNER-ANALYZERS-PHP-27-002 | SCSA0601 | -| ANALYZERS-PHP-27-009 | TODO | | SPRINT_134_scanner_surface | PHP Analyzer Guild · QA Guild | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php | Depends on #5 | SCANNER-ANALYZERS-PHP-27-007 | SCSA0601 | -| ANALYZERS-PHP-27-010 | TODO | | SPRINT_134_scanner_surface | PHP Analyzer Guild · Signals Guild | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php | Depends on #7 | SCANNER-ANALYZERS-PHP-27-009 | SCSA0601 | -| ANALYZERS-PHP-27-011 | TODO | | SPRINT_134_scanner_surface | PHP Analyzer Guild, DevOps Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php) | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php | | SCANNER-ANALYZERS-PHP-27-010 | SCSA0602 | -| ANALYZERS-PHP-27-012 | TODO | | SPRINT_134_scanner_surface | PHP Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php) | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php | | SCANNER-ANALYZERS-PHP-27-011 | SCSA0602 | -| ANALYZERS-PYTHON-23-001 | TODO | | SPRINT_134_scanner_surface | Python Analyzer Guild | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python | Analyzer helper bootstrap | Analyzer helper bootstrap | SCSA0701 | -| ANALYZERS-PYTHON-23-002 | TODO | | SPRINT_134_scanner_surface | Python Analyzer Guild | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python | Depends on #1 | SCANNER-ANALYZERS-PYTHON-23-001 | SCSA0701 | -| ANALYZERS-PYTHON-23-003 | TODO | | SPRINT_134_scanner_surface | Python Analyzer Guild | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python | Depends on #2 | SCANNER-ANALYZERS-PYTHON-23-002 | SCSA0701 | -| ANALYZERS-PYTHON-23-004 | TODO | | SPRINT_134_scanner_surface | Python Analyzer Guild | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python | Depends on #3 | SCANNER-ANALYZERS-PYTHON-23-003 | SCSA0701 | -| ANALYZERS-PYTHON-23-005 | TODO | | SPRINT_134_scanner_surface | Python Analyzer Guild | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python | Depends on #4 | SCANNER-ANALYZERS-PYTHON-23-004 | SCSA0701 | -| ANALYZERS-PYTHON-23-006 | TODO | | SPRINT_134_scanner_surface | Python Analyzer Guild | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python | Depends on #5 | SCANNER-ANALYZERS-PYTHON-23-005 | SCSA0701 | -| ANALYZERS-PYTHON-23-007 | TODO | | SPRINT_134_scanner_surface | Python Analyzer Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python | SCANNER-ANALYZERS-PYTHON-23-006 | SCANNER-ANALYZERS-PYTHON-23-006 | SCSA0101 | -| ANALYZERS-PYTHON-23-008 | TODO | | SPRINT_134_scanner_surface | Python Analyzer Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python | SCANNER-ANALYZERS-PYTHON-23-007 | SCANNER-ANALYZERS-PYTHON-23-007 | SCSA0101 | -| ANALYZERS-PYTHON-23-009 | TODO | | SPRINT_134_scanner_surface | Python Analyzer Guild, QA Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python | SCANNER-ANALYZERS-PYTHON-23-008 | SCANNER-ANALYZERS-PYTHON-23-008 | SCSA0101 | -| ANALYZERS-PYTHON-23-010 | TODO | | SPRINT_134_scanner_surface | Python Analyzer Guild, Signals Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python | SCANNER-ANALYZERS-PYTHON-23-009 | SCANNER-ANALYZERS-PYTHON-23-009 | SCSA0102 | -| ANALYZERS-PYTHON-23-011 | TODO | | SPRINT_134_scanner_surface | Python Analyzer Guild, DevOps Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python | SCANNER-ANALYZERS-PYTHON-23-010 | SCANNER-ANALYZERS-PYTHON-23-010 | SCSA0102 | -| ANALYZERS-PYTHON-23-012 | TODO | | SPRINT_135_scanner_surface | Python Analyzer Guild | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python | Needs ANALYZERS-PYTHON-23-011 evidence | SCANNER-ANALYZERS-PYTHON-23-011 | SCSA0702 | -| ANALYZERS-RUBY-28-001 | TODO | | SPRINT_135_scanner_surface | Ruby Analyzer Guild | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby | Bootstrap helper | Bootstrap helper | SCSA0801 | -| ANALYZERS-RUBY-28-002 | TODO | | SPRINT_135_scanner_surface | Ruby Analyzer Guild | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby | Depends on #1 | SCANNER-ANALYZERS-RUBY-28-001 | SCSA0801 | -| ANALYZERS-RUBY-28-003 | TODO | | SPRINT_135_scanner_surface | Ruby Analyzer Guild | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby | Depends on #2 | SCANNER-ANALYZERS-RUBY-28-002 | SCSA0801 | -| ANALYZERS-RUBY-28-004 | TODO | | SPRINT_135_scanner_surface | Ruby Analyzer Guild | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby | Depends on #3 | SCANNER-ANALYZERS-RUBY-28-003 | SCSA0801 | -| ANALYZERS-RUBY-28-005 | TODO | | SPRINT_135_scanner_surface | Ruby Analyzer Guild | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby | Depends on #4 | SCANNER-ANALYZERS-RUBY-28-004 | SCSA0801 | -| ANALYZERS-RUBY-28-006 | TODO | | SPRINT_135_scanner_surface | Ruby Analyzer Guild | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby | Depends on #5 | SCANNER-ANALYZERS-RUBY-28-005 | SCSA0801 | -| ANALYZERS-RUBY-28-007 | TODO | | SPRINT_135_scanner_surface | Ruby Analyzer Guild | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby | Depends on #6 | SCANNER-ANALYZERS-RUBY-28-006 | SCSA0801 | -| ANALYZERS-RUBY-28-008 | TODO | | SPRINT_135_scanner_surface | Ruby Analyzer Guild | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby | Depends on #7 | SCANNER-ANALYZERS-RUBY-28-007 | SCSA0801 | -| ANALYZERS-RUBY-28-009 | TODO | | SPRINT_135_scanner_surface | Ruby Analyzer Guild · QA Guild | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby | Depends on #8 | SCANNER-ANALYZERS-RUBY-28-008 | SCSA0801 | -| ANALYZERS-RUBY-28-010 | TODO | | SPRINT_135_scanner_surface | Ruby Analyzer Guild · Signals Guild | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby | Depends on #9 | SCANNER-ANALYZERS-RUBY-28-009 | SCSA0801 | -| ANALYZERS-RUBY-28-011 | TODO | | SPRINT_135_scanner_surface | Ruby Analyzer Guild · DevOps Guild | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby | Depends on ANALYZERS-RUBY-28-010 | SCANNER-ANALYZERS-RUBY-28-010 | SCSA0802 | -| ANALYZERS-RUBY-28-012 | TODO | | SPRINT_135_scanner_surface | Ruby Analyzer Guild | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby | Needs #1 fixtures | SCANNER-ANALYZERS-RUBY-28-011 | SCSA0802 | -| AOC-19-001 | TODO | | SPRINT_123_policy_reasoning | Policy Guild | src/Policy/__Libraries/StellaOps.Policy | Review Link-Not-Merge schema | Review Link-Not-Merge schema | PLAO0101 | -| AOC-19-002 | TODO | | SPRINT_123_policy_reasoning | Policy Guild | src/Policy/__Libraries/StellaOps.Policy | Depends on #1 | POLICY-AOC-19-001 | PLAO0101 | -| AOC-19-003 | TODO | | SPRINT_123_policy_reasoning | Policy Guild | src/Policy/__Libraries/StellaOps.Policy | Depends on #2 | POLICY-AOC-19-002 | PLAO0101 | -| AOC-19-004 | TODO | | SPRINT_123_policy_reasoning | Policy Guild | src/Policy/__Libraries/StellaOps.Policy | Depends on #3 | POLICY-AOC-19-003 | PLAO0101 | +| ANALYZERS-LANG-11-002 | TODO | | SPRINT_0132_0000_0001_scanner_surface | StellaOps.Scanner EPDR Guild | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.DotNet | Depends on #1 for shared metadata | SCANNER-ANALYZERS-LANG-11-001 | SCSA0103 | +| ANALYZERS-LANG-11-003 | TODO | | SPRINT_0132_0000_0001_scanner_surface | StellaOps.Scanner EPDR Guild · Signals Guild | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.DotNet | Needs #2 plus Signals schema for entry-trace | SCANNER-ANALYZERS-LANG-11-002 | SCSA0103 | +| ANALYZERS-LANG-11-004 | TODO | | SPRINT_0132_0000_0001_scanner_surface | StellaOps.Scanner EPDR Guild · SBOM Service Guild | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.DotNet | Requires #3 and SBOM service hooks | SCANNER-ANALYZERS-LANG-11-003 | SCSA0103 | +| ANALYZERS-LANG-11-005 | TODO | | SPRINT_0132_0000_0001_scanner_surface | StellaOps.Scanner EPDR Guild · QA Guild | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.DotNet | Depends on #4 for QA fixtures | SCANNER-ANALYZERS-LANG-11-004 | SCSA0103 | +| ANALYZERS-NATIVE-20-001 | TODO | | SPRINT_0132_0000_0001_scanner_surface | Native Analyzer Guild | src/Scanner/StellaOps.Scanner.Analyzers.Native | Bootstrap native analyzer helpers | Bootstrap native analyzer helpers | SCSA0401 | +| ANALYZERS-NATIVE-20-002 | TODO | | SPRINT_0132_0000_0001_scanner_surface | Native Analyzer Guild | src/Scanner/StellaOps.Scanner.Analyzers.Native | Depends on #1 | SCANNER-ANALYZERS-NATIVE-20-001 | SCSA0401 | +| ANALYZERS-NATIVE-20-003 | TODO | | SPRINT_0132_0000_0001_scanner_surface | Native Analyzer Guild | src/Scanner/StellaOps.Scanner.Analyzers.Native | Depends on #2 | SCANNER-ANALYZERS-NATIVE-20-002 | SCSA0401 | +| ANALYZERS-NATIVE-20-004 | TODO | | SPRINT_0132_0000_0001_scanner_surface | Native Analyzer Guild | src/Scanner/StellaOps.Scanner.Analyzers.Native | Depends on #3 | SCANNER-ANALYZERS-NATIVE-20-003 | SCSA0401 | +| ANALYZERS-NATIVE-20-005 | TODO | | SPRINT_0132_0000_0001_scanner_surface | Native Analyzer Guild | src/Scanner/StellaOps.Scanner.Analyzers.Native | Depends on #4 | SCANNER-ANALYZERS-NATIVE-20-004 | SCSA0401 | +| ANALYZERS-NATIVE-20-006 | TODO | | SPRINT_0132_0000_0001_scanner_surface | Native Analyzer Guild | src/Scanner/StellaOps.Scanner.Analyzers.Native | Depends on #5 | SCANNER-ANALYZERS-NATIVE-20-005 | SCSA0401 | +| ANALYZERS-NATIVE-20-007 | TODO | | SPRINT_0132_0000_0001_scanner_surface | Native Analyzer Guild | src/Scanner/StellaOps.Scanner.Analyzers.Native | Depends on #6 | SCANNER-ANALYZERS-NATIVE-20-006 | SCSA0401 | +| ANALYZERS-NATIVE-20-008 | TODO | | SPRINT_0132_0000_0001_scanner_surface | Native Analyzer Guild | src/Scanner/StellaOps.Scanner.Analyzers.Native | Depends on #7 | SCANNER-ANALYZERS-NATIVE-20-007 | SCSA0401 | +| ANALYZERS-NATIVE-20-009 | TODO | | SPRINT_0132_0000_0001_scanner_surface | Native Analyzer Guild | src/Scanner/StellaOps.Scanner.Analyzers.Native | Depends on #8 | SCANNER-ANALYZERS-NATIVE-20-008 | SCSA0401 | +| ANALYZERS-NATIVE-20-010 | TODO | | SPRINT_0132_0000_0001_scanner_surface | Native Analyzer Guild | src/Scanner/StellaOps.Scanner.Analyzers.Native | Depends on #9 | SCANNER-ANALYZERS-NATIVE-20-009 | SCSA0401 | +| ANALYZERS-NODE-22-001 | TODO | | SPRINT_0132_0000_0001_scanner_surface | Node Analyzer Guild | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node | Bootstrap Node analyzer helper | Bootstrap Node analyzer helper | SCSA0501 | +| ANALYZERS-NODE-22-002 | TODO | | SPRINT_0132_0000_0001_scanner_surface | Node Analyzer Guild | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node | Depends on #1 | SCANNER-ANALYZERS-NODE-22-001 | SCSA0501 | +| ANALYZERS-NODE-22-003 | TODO | | SPRINT_0132_0000_0001_scanner_surface | Node Analyzer Guild | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node | Depends on #2 | SCANNER-ANALYZERS-NODE-22-002 | SCSA0501 | +| ANALYZERS-NODE-22-004 | TODO | | SPRINT_0132_0000_0001_scanner_surface | Node Analyzer Guild | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node | Depends on #3 | SCANNER-ANALYZERS-NODE-22-003 | SCSA0501 | +| ANALYZERS-NODE-22-005 | TODO | | SPRINT_0132_0000_0001_scanner_surface | Node Analyzer Guild | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node | Depends on #4 | SCANNER-ANALYZERS-NODE-22-004 | SCSA0501 | +| ANALYZERS-NODE-22-006 | TODO | | SPRINT_0133_0000_0001_scanner_surface | Node Analyzer Guild | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node | Depends on #5 | SCANNER-ANALYZERS-NODE-22-005 | SCSA0501 | +| ANALYZERS-NODE-22-007 | TODO | | SPRINT_0133_0000_0001_scanner_surface | Node Analyzer Guild | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node | Depends on #6 | SCANNER-ANALYZERS-NODE-22-006 | SCSA0501 | +| ANALYZERS-NODE-22-008 | TODO | | SPRINT_0133_0000_0001_scanner_surface | Node Analyzer Guild | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node | Depends on #7 | SCANNER-ANALYZERS-NODE-22-007 | SCSA0501 | +| ANALYZERS-NODE-22-009 | TODO | | SPRINT_0133_0000_0001_scanner_surface | Node Analyzer Guild · QA Guild | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node | Depends on #8 | SCANNER-ANALYZERS-NODE-22-008 | SCSA0501 | +| ANALYZERS-NODE-22-010 | TODO | | SPRINT_0133_0000_0001_scanner_surface | Node Analyzer Guild · Signals Guild | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node | Depends on #9 | SCANNER-ANALYZERS-NODE-22-009 | SCSA0501 | +| ANALYZERS-NODE-22-011 | TODO | | SPRINT_0133_0000_0001_scanner_surface | Node Analyzer Guild · DevOps Guild | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node | Depends on ANALYZERS-NODE-22-010 + DevOps packaging | SCANNER-ANALYZERS-NODE-22-010 | SCSA0502 | +| ANALYZERS-NODE-22-012 | TODO | | SPRINT_0133_0000_0001_scanner_surface | Node Analyzer Guild | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node | Needs #1 regression fixtures | SCANNER-ANALYZERS-NODE-22-011 | SCSA0502 | +| ANALYZERS-PHP-27-001 | TODO | | SPRINT_0133_0000_0001_scanner_surface | PHP Analyzer Guild | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php | Analyzer helper bootstrap | Analyzer helper bootstrap | SCSA0601 | +| ANALYZERS-PHP-27-002 | TODO | | SPRINT_0133_0000_0001_scanner_surface | PHP Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php) | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php | SCANNER-ANALYZERS-PHP-27-001 | SCANNER-ANALYZERS-PHP-27-001 | SCSA0101 | +| ANALYZERS-PHP-27-003 | TODO | | SPRINT_0133_0000_0001_scanner_surface | PHP Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php) | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php | SCANNER-ANALYZERS-PHP-27-002 | SCANNER-ANALYZERS-PHP-27-002 | SCSA0101 | +| ANALYZERS-PHP-27-004 | TODO | | SPRINT_0133_0000_0001_scanner_surface | PHP Analyzer Guild | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php | Depends on SCANNER-ANALYZERS-PHP-27-003 | SCANNER-ANALYZERS-PHP-27-003 | SCSA0601 | +| ANALYZERS-PHP-27-005 | TODO | | SPRINT_0133_0000_0001_scanner_surface | PHP Analyzer Guild | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php | Depends on #2 | SCANNER-ANALYZERS-PHP-27-004 | SCSA0601 | +| ANALYZERS-PHP-27-006 | TODO | | SPRINT_0133_0000_0001_scanner_surface | PHP Analyzer Guild | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php | Depends on #3 | SCANNER-ANALYZERS-PHP-27-005 | SCSA0601 | +| ANALYZERS-PHP-27-007 | TODO | | SPRINT_0133_0000_0001_scanner_surface | PHP Analyzer Guild | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php | Depends on #4 | SCANNER-ANALYZERS-PHP-27-006 | SCSA0601 | +| ANALYZERS-PHP-27-008 | TODO | | SPRINT_0134_0000_0001_scanner_surface | PHP Analyzer Guild | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php | Depends on #1 + CLI feedback | SCANNER-ANALYZERS-PHP-27-002 | SCSA0601 | +| ANALYZERS-PHP-27-009 | TODO | | SPRINT_0134_0000_0001_scanner_surface | PHP Analyzer Guild · QA Guild | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php | Depends on #5 | SCANNER-ANALYZERS-PHP-27-007 | SCSA0601 | +| ANALYZERS-PHP-27-010 | TODO | | SPRINT_0134_0000_0001_scanner_surface | PHP Analyzer Guild · Signals Guild | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php | Depends on #7 | SCANNER-ANALYZERS-PHP-27-009 | SCSA0601 | +| ANALYZERS-PHP-27-011 | TODO | | SPRINT_0134_0000_0001_scanner_surface | PHP Analyzer Guild, DevOps Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php) | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php | | SCANNER-ANALYZERS-PHP-27-010 | SCSA0602 | +| ANALYZERS-PHP-27-012 | TODO | | SPRINT_0134_0000_0001_scanner_surface | PHP Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php) | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php | | SCANNER-ANALYZERS-PHP-27-011 | SCSA0602 | +| ANALYZERS-PYTHON-23-001 | TODO | | SPRINT_0134_0000_0001_scanner_surface | Python Analyzer Guild | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python | Analyzer helper bootstrap | Analyzer helper bootstrap | SCSA0701 | +| ANALYZERS-PYTHON-23-002 | TODO | | SPRINT_0134_0000_0001_scanner_surface | Python Analyzer Guild | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python | Depends on #1 | SCANNER-ANALYZERS-PYTHON-23-001 | SCSA0701 | +| ANALYZERS-PYTHON-23-003 | TODO | | SPRINT_0134_0000_0001_scanner_surface | Python Analyzer Guild | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python | Depends on #2 | SCANNER-ANALYZERS-PYTHON-23-002 | SCSA0701 | +| ANALYZERS-PYTHON-23-004 | TODO | | SPRINT_0134_0000_0001_scanner_surface | Python Analyzer Guild | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python | Depends on #3 | SCANNER-ANALYZERS-PYTHON-23-003 | SCSA0701 | +| ANALYZERS-PYTHON-23-005 | TODO | | SPRINT_0134_0000_0001_scanner_surface | Python Analyzer Guild | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python | Depends on #4 | SCANNER-ANALYZERS-PYTHON-23-004 | SCSA0701 | +| ANALYZERS-PYTHON-23-006 | TODO | | SPRINT_0134_0000_0001_scanner_surface | Python Analyzer Guild | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python | Depends on #5 | SCANNER-ANALYZERS-PYTHON-23-005 | SCSA0701 | +| ANALYZERS-PYTHON-23-007 | TODO | | SPRINT_0134_0000_0001_scanner_surface | Python Analyzer Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python | SCANNER-ANALYZERS-PYTHON-23-006 | SCANNER-ANALYZERS-PYTHON-23-006 | SCSA0101 | +| ANALYZERS-PYTHON-23-008 | TODO | | SPRINT_0134_0000_0001_scanner_surface | Python Analyzer Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python | SCANNER-ANALYZERS-PYTHON-23-007 | SCANNER-ANALYZERS-PYTHON-23-007 | SCSA0101 | +| ANALYZERS-PYTHON-23-009 | TODO | | SPRINT_0134_0000_0001_scanner_surface | Python Analyzer Guild, QA Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python | SCANNER-ANALYZERS-PYTHON-23-008 | SCANNER-ANALYZERS-PYTHON-23-008 | SCSA0101 | +| ANALYZERS-PYTHON-23-010 | TODO | | SPRINT_0134_0000_0001_scanner_surface | Python Analyzer Guild, Signals Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python | SCANNER-ANALYZERS-PYTHON-23-009 | SCANNER-ANALYZERS-PYTHON-23-009 | SCSA0102 | +| ANALYZERS-PYTHON-23-011 | TODO | | SPRINT_0134_0000_0001_scanner_surface | Python Analyzer Guild, DevOps Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python | SCANNER-ANALYZERS-PYTHON-23-010 | SCANNER-ANALYZERS-PYTHON-23-010 | SCSA0102 | +| ANALYZERS-PYTHON-23-012 | TODO | | SPRINT_0135_0000_0001_scanner_surface | Python Analyzer Guild | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python | Needs ANALYZERS-PYTHON-23-011 evidence | SCANNER-ANALYZERS-PYTHON-23-011 | SCSA0702 | +| ANALYZERS-RUBY-28-001 | TODO | | SPRINT_0135_0000_0001_scanner_surface | Ruby Analyzer Guild | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby | Bootstrap helper | Bootstrap helper | SCSA0801 | +| ANALYZERS-RUBY-28-002 | TODO | | SPRINT_0135_0000_0001_scanner_surface | Ruby Analyzer Guild | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby | Depends on #1 | SCANNER-ANALYZERS-RUBY-28-001 | SCSA0801 | +| ANALYZERS-RUBY-28-003 | TODO | | SPRINT_0135_0000_0001_scanner_surface | Ruby Analyzer Guild | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby | Depends on #2 | SCANNER-ANALYZERS-RUBY-28-002 | SCSA0801 | +| ANALYZERS-RUBY-28-004 | TODO | | SPRINT_0135_0000_0001_scanner_surface | Ruby Analyzer Guild | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby | Depends on #3 | SCANNER-ANALYZERS-RUBY-28-003 | SCSA0801 | +| ANALYZERS-RUBY-28-005 | TODO | | SPRINT_0135_0000_0001_scanner_surface | Ruby Analyzer Guild | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby | Depends on #4 | SCANNER-ANALYZERS-RUBY-28-004 | SCSA0801 | +| ANALYZERS-RUBY-28-006 | TODO | | SPRINT_0135_0000_0001_scanner_surface | Ruby Analyzer Guild | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby | Depends on #5 | SCANNER-ANALYZERS-RUBY-28-005 | SCSA0801 | +| ANALYZERS-RUBY-28-007 | TODO | | SPRINT_0135_0000_0001_scanner_surface | Ruby Analyzer Guild | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby | Depends on #6 | SCANNER-ANALYZERS-RUBY-28-006 | SCSA0801 | +| ANALYZERS-RUBY-28-008 | TODO | | SPRINT_0135_0000_0001_scanner_surface | Ruby Analyzer Guild | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby | Depends on #7 | SCANNER-ANALYZERS-RUBY-28-007 | SCSA0801 | +| ANALYZERS-RUBY-28-009 | TODO | | SPRINT_0135_0000_0001_scanner_surface | Ruby Analyzer Guild · QA Guild | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby | Depends on #8 | SCANNER-ANALYZERS-RUBY-28-008 | SCSA0801 | +| ANALYZERS-RUBY-28-010 | TODO | | SPRINT_0135_0000_0001_scanner_surface | Ruby Analyzer Guild · Signals Guild | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby | Depends on #9 | SCANNER-ANALYZERS-RUBY-28-009 | SCSA0801 | +| ANALYZERS-RUBY-28-011 | TODO | | SPRINT_0135_0000_0001_scanner_surface | Ruby Analyzer Guild · DevOps Guild | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby | Depends on ANALYZERS-RUBY-28-010 | SCANNER-ANALYZERS-RUBY-28-010 | SCSA0802 | +| ANALYZERS-RUBY-28-012 | TODO | | SPRINT_0135_0000_0001_scanner_surface | Ruby Analyzer Guild | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby | Needs #1 fixtures | SCANNER-ANALYZERS-RUBY-28-011 | SCSA0802 | +| AOC-19-001 | TODO | | SPRINT_0123_0000_0001_policy_reasoning | Policy Guild | src/Policy/__Libraries/StellaOps.Policy | Review Link-Not-Merge schema | Review Link-Not-Merge schema | PLAO0101 | +| AOC-19-002 | TODO | | SPRINT_0123_0000_0001_policy_reasoning | Policy Guild | src/Policy/__Libraries/StellaOps.Policy | Depends on #1 | POLICY-AOC-19-001 | PLAO0101 | +| AOC-19-003 | TODO | | SPRINT_0123_0000_0001_policy_reasoning | Policy Guild | src/Policy/__Libraries/StellaOps.Policy | Depends on #2 | POLICY-AOC-19-002 | PLAO0101 | +| AOC-19-004 | TODO | | SPRINT_0123_0000_0001_policy_reasoning | Policy Guild | src/Policy/__Libraries/StellaOps.Policy | Depends on #3 | POLICY-AOC-19-003 | PLAO0101 | | AOC-19-101 | TODO | 2025-10-28 | SPRINT_0503_0001_0001_ops_devops_i | DevOps Guild | ops/devops | Needs helper definitions from PLAO0101 | Needs helper definitions from PLAO0101 | DVAO0101 | | API-27-001 | TODO | | SPRINT_0129_0001_0001_policy_reasoning | Policy Registry Guild | src/Policy/StellaOps.Policy.Registry | Governance decision (APIG0101) | Governance decision (APIG0101) | PLAR0101 | | API-27-002 | TODO | | SPRINT_0129_0001_0001_policy_reasoning | Policy Registry Guild | src/Policy/StellaOps.Policy.Registry | Depends on #1 | REGISTRY-API-27-001 | PLAR0101 | @@ -239,23 +239,23 @@ | API-29-009 | TODO | | SPRINT_0129_0001_0001_policy_reasoning | Vuln Explorer API Guild | src/VulnExplorer/StellaOps.VulnExplorer.Api | Depends on #8 | VULN-API-29-008 | VUAP0101 | | API-29-010 | TODO | | SPRINT_0129_0001_0001_policy_reasoning | Vuln Explorer API Guild | src/VulnExplorer/StellaOps.VulnExplorer.Api | Depends on #9 | VULN-API-29-009 | VUAP0101 | | API-29-011 | TODO | | SPRINT_0129_0001_0001_policy_reasoning | Vuln Explorer API Guild · CLI Guild | src/VulnExplorer/StellaOps.VulnExplorer.Api | Requires API-29-010 artifacts | VULN-API-29-010 | VUAP0102 | -| APIGOV-61-001 | DONE | 2025-11-18 | SPRINT_511_api | API Governance Guild | src/Api/StellaOps.Api.Governance | Configure spectral/linters with Stella rules; add CI job failing on violations. | 61-001 | APIG0101 | -| APIGOV-61-002 | TODO | | SPRINT_511_api | API Governance Guild | src/Api/StellaOps.Api.Governance | Implement example coverage checker ensuring every operation has at least one request/response example. Dependencies: APIGOV-61-001. | APIGOV-61-001 | APIG0101 | -| APIGOV-62-001 | TODO | | SPRINT_511_api | API Governance Guild | src/Api/StellaOps.Api.Governance | Build compatibility diff tool producing additive/breaking reports comparing prior release. Dependencies: APIGOV-61-002. | APIGOV-61-002 | APIG0101 | -| APIGOV-62-002 | TODO | | SPRINT_511_api | API Governance Guild · DevOps Guild | src/Api/StellaOps.Api.Governance | Automate changelog generation and publish signed artifacts to `src/Sdk/StellaOps.Sdk.Release` pipeline. Dependencies: APIGOV-62-001. | APIGOV-62-001 | APIG0101 | -| APIGOV-63-001 | TODO | | SPRINT_511_api | API Governance Guild · Notifications Guild | src/Api/StellaOps.Api.Governance | Integrate deprecation metadata into Notification Studio templates for API sunset events. Dependencies: APIGOV-62-002. | APIGOV-62-002 | APIG0101 | +| APIGOV-61-001 | DONE | 2025-11-18 | SPRINT_0511_0000_0001_api | API Governance Guild | src/Api/StellaOps.Api.Governance | Configure spectral/linters with Stella rules; add CI job failing on violations. | 61-001 | APIG0101 | +| APIGOV-61-002 | TODO | | SPRINT_0511_0000_0001_api | API Governance Guild | src/Api/StellaOps.Api.Governance | Implement example coverage checker ensuring every operation has at least one request/response example. Dependencies: APIGOV-61-001. | APIGOV-61-001 | APIG0101 | +| APIGOV-62-001 | TODO | | SPRINT_0511_0000_0001_api | API Governance Guild | src/Api/StellaOps.Api.Governance | Build compatibility diff tool producing additive/breaking reports comparing prior release. Dependencies: APIGOV-61-002. | APIGOV-61-002 | APIG0101 | +| APIGOV-62-002 | TODO | | SPRINT_0511_0000_0001_api | API Governance Guild · DevOps Guild | src/Api/StellaOps.Api.Governance | Automate changelog generation and publish signed artifacts to `src/Sdk/StellaOps.Sdk.Release` pipeline. Dependencies: APIGOV-62-001. | APIGOV-62-001 | APIG0101 | +| APIGOV-63-001 | TODO | | SPRINT_0511_0000_0001_api | API Governance Guild · Notifications Guild | src/Api/StellaOps.Api.Governance | Integrate deprecation metadata into Notification Studio templates for API sunset events. Dependencies: APIGOV-62-002. | APIGOV-62-002 | APIG0101 | | ATTEST-01-003 | DONE (2025-11-23) | 2025-11-23 | SPRINT_110_ingestion_evidence | Excititor Guild · Evidence Locker Guild | src/Attestor/StellaOps.Attestor | Excititor attestation payloads shipped on frozen bundle v1. | EXCITITOR-AIAI-31-002; ELOCKER-CONTRACT-2001 | ATEL0102 | | ATTEST-73-001 | DONE (2025-11-25) | 2025-11-25 | SPRINT_110_ingestion_evidence | Concelier Core · Evidence Locker Guild | src/Attestor/StellaOps.Attestor | Attestation claims builder verified; TRX archived. | CONCELIER-AIAI-31-002; ELOCKER-CONTRACT-2001 | ATEL0102 | | ATTEST-73-002 | DONE (2025-11-25) | 2025-11-25 | SPRINT_110_ingestion_evidence | Concelier Core · Evidence Locker Guild | src/Attestor/StellaOps.Attestor | Internal verify endpoint validated; TRX archived. | CONCELIER-AIAI-31-002; ELOCKER-CONTRACT-2001 | ATEL0102 | | ATTEST-73-003 | TODO | | SPRINT_302_docs_tasks_md_ii | Docs Guild · Policy Guild | docs/modules/attestor | Wait for ATEL0102 evidence | Wait for ATEL0102 evidence | DOAT0102 | | ATTEST-73-004 | TODO | | SPRINT_302_docs_tasks_md_ii | Docs Guild · Attestor Service Guild | docs/modules/attestor | Depends on #1 | Depends on #1 | DOAT0102 | -| ATTEST-74-001 | DOING | | SPRINT_170_notifications_telemetry | Notifications Service Guild · Attestor Service Guild | src/Notify/StellaOps.Notify | Needs DSSE schema sign-off | Needs DSSE schema sign-off | NOTY0102 | -| ATTEST-74-002 | DOING | | SPRINT_170_notifications_telemetry | Notifications Service Guild | src/Notify/StellaOps.Notify | Depends on #1 | Depends on #1 | NOTY0102 | +| ATTEST-74-001 | DOING | | SPRINT_0170_0000_0001_notifications_telemetry | Notifications Service Guild · Attestor Service Guild | src/Notify/StellaOps.Notify | Needs DSSE schema sign-off | Needs DSSE schema sign-off | NOTY0102 | +| ATTEST-74-002 | DOING | | SPRINT_0170_0000_0001_notifications_telemetry | Notifications Service Guild | src/Notify/StellaOps.Notify | Depends on #1 | Depends on #1 | NOTY0102 | | ATTEST-74-003 | TODO | | SPRINT_302_docs_tasks_md_ii | Docs Guild · Attestor Console Guild | docs/modules/attestor | Depends on NOTY0102 | Depends on NOTY0102 | DOAT0102 | | ATTEST-74-004 | TODO | | SPRINT_302_docs_tasks_md_ii | Docs Guild · CLI Attestor Guild | docs/modules/attestor | Depends on NOTY0102 | Depends on NOTY0102 | DOAT0102 | | ATTEST-75-001 | TODO | | SPRINT_160_export_evidence | Docs Guild · Export Attestation Guild | docs/modules/attestor | Needs Export bundle schema (ECOB0101) | Needs Export bundle schema (ECOB0101) | DOAT0102 | | ATTEST-75-002 | TODO | | SPRINT_160_export_evidence | Docs Guild · Security Guild | docs/modules/attestor | Depends on #5 | Depends on #5 | DOAT0102 | -| ATTEST-REPLAY-187-003 | TODO | | SPRINT_187_evidence_locker_cli_integration | Attestor Guild (src/Attestor/StellaOps.Attestor) | `src/Attestor/StellaOps.Attestor`, `docs/modules/attestor/architecture.md` | Wire Attestor/Rekor anchoring for replay manifests and capture verification APIs; extend `docs/modules/attestor/architecture.md` with a replay ledger flow referencing `docs/replay/DETERMINISTIC_REPLAY.md` Section 9. | Align replay payload schema with RPRC0101 | ATRE0101 | +| ATTEST-REPLAY-187-003 | TODO | | SPRINT_0187_0000_0001_evidence_locker_cli_integration | Attestor Guild (src/Attestor/StellaOps.Attestor) | `src/Attestor/StellaOps.Attestor`, `docs/modules/attestor/architecture.md` | Wire Attestor/Rekor anchoring for replay manifests and capture verification APIs; extend `docs/modules/attestor/architecture.md` with a replay ledger flow referencing `docs/replay/DETERMINISTIC_REPLAY.md` Section 9. | Align replay payload schema with RPRC0101 | ATRE0101 | | ATTESTOR-DOCS-0001 | DONE | 2025-11-05 | SPRINT_313_docs_modules_attestor | Docs Guild | docs/modules/attestor | Validate that `docs/modules/attestor/README.md` matches the latest release notes and attestation samples. | | DOAT0102 | | ATTESTOR-ENG-0001 | TODO | | SPRINT_313_docs_modules_attestor | Module Team | docs/modules/attestor | Cross-check implementation plan milestones against `/docs/implplan/SPRINT_*.md` and update module readiness checkpoints. | Depends on #1-6 | DOAT0102 | | ATTESTOR-OPS-0001 | TODO | | SPRINT_313_docs_modules_attestor | Ops Guild | docs/modules/attestor | Review runbooks/observability assets after the next sprint demo and capture findings inline with sprint notes. | Depends on #1-6 | DOAT0102 | @@ -265,7 +265,7 @@ | AUTH-MTLS-11-002 | DONE (2025-11-08) | 2025-11-08 | SPRINT_100_identity_signing | Authority Core & Security Guild (src/Authority/StellaOps.Authority) | src/Authority/StellaOps.Authority | Refresh grants now enforce the original client certificate, tokens persist `x5t#S256`/hex metadata via shared helper, and docs/JWKS guidance call out the mTLS binding expectations. | AUTH-DPOP-11-001 | AUIN0101 | | AUTH-PACKS-43-001 | DONE (2025-11-09) | 2025-11-09 | SPRINT_100_identity_signing | Authority Core & Security Guild (src/Authority/StellaOps.Authority) | src/Authority/StellaOps.Authority | Enforce pack signing policies, approval RBAC checks, CLI CI token scopes, and audit logging for approvals. | AUTH-PACKS-41-001; TASKRUN-42-001; ORCH-SVC-42-101 | AUIN0101 | | AUTH-REACH-401-005 | DONE (2025-11-27) | 2025-11-27 | SPRINT_0401_0001_0001_reachability_evidence_chain | Authority & Signer Guilds | `src/Authority/StellaOps.Authority`, `src/Signer/StellaOps.Signer` | Predicate types exist (stella.ops/vexDecision@v1 etc.); IAuthorityDsseStatementSigner created with ICryptoProviderRegistry; Rekor via existing IRekorClient. | Coordinate with replay reachability owners | AUIN0101 | -| AUTH-VERIFY-186-007 | TODO | | SPRINT_186_record_deterministic_execution | Authority Guild · Provenance Guild | `src/Authority/StellaOps.Authority`, `src/Provenance/StellaOps.Provenance.Attestation` | Expose an Authority-side verification helper/service that validates DSSE signatures and Rekor proofs for promotion attestations using trusted checkpoints, enabling offline audit flows. | Await PROB0101 provenance harness | AUIN0101 | +| AUTH-VERIFY-186-007 | TODO | | SPRINT_0186_0000_0001_record_deterministic_execution | Authority Guild · Provenance Guild | `src/Authority/StellaOps.Authority`, `src/Provenance/StellaOps.Provenance.Attestation` | Expose an Authority-side verification helper/service that validates DSSE signatures and Rekor proofs for promotion attestations using trusted checkpoints, enabling offline audit flows. | Await PROB0101 provenance harness | AUIN0101 | | AUTHORITY-DOCS-0001 | TODO | | SPRINT_314_docs_modules_authority | Docs Guild (docs/modules/authority) | docs/modules/authority | See ./AGENTS.md | Wait for AUIN0101 sign-off | DOAU0101 | | AUTHORITY-ENG-0001 | TODO | | SPRINT_314_docs_modules_authority | Module Team (docs/modules/authority) | docs/modules/authority | Update status via ./AGENTS.md workflow | Depends on #1 | DOAU0101 | | AUTHORITY-OPS-0001 | TODO | | SPRINT_314_docs_modules_authority | Ops Guild (docs/modules/authority) | docs/modules/authority | Sync outcomes back to ../.. | Depends on #1 | DOAU0101 | @@ -280,10 +280,10 @@ | BENCH-SIG-26-001 | TODO | | SPRINT_512_bench | Bench Guild · Signals Guild | src/Bench/StellaOps.Bench | Develop benchmark for reachability scoring pipeline (facts/sec, latency, memory) using synthetic callgraphs/runtime batches. | Needs SGSI0101 runtime feed | RBBN0102 | | BENCH-SIG-26-002 | TODO | | SPRINT_512_bench | Bench Guild · Policy Guild | src/Bench/StellaOps.Bench | Measure policy evaluation overhead with reachability cache hot/cold; ensure ≤8 ms p95 added latency. Dependencies: BENCH-SIG-26-001. | Depends on #6 | RBBN0102 | | BUNDLE-401-014 | TODO | | SPRINT_0401_0001_0001_reachability_evidence_chain | Symbols Guild | `src/Symbols/StellaOps.Symbols.Bundle` | Needs RBRE0101 provenance payload | Needs RBRE0101 provenance payload | RBSY0101 | -| BUNDLE-69-001 | TODO | | SPRINT_164_exportcenter_iii | Risk Bundle Export Guild · Risk Engine Guild | src/ExportCenter/StellaOps.ExportCenter.RiskBundles | Align with ATEL0102 DSSE outputs | Align with ATEL0102 DSSE outputs | RBRB0101 | -| BUNDLE-69-002 | TODO | | SPRINT_164_exportcenter_iii | Risk Bundle Export Guild · DevOps Guild | src/ExportCenter/StellaOps.ExportCenter.RiskBundles | Depends on #1 | Depends on #1 | RBRB0101 | -| BUNDLE-70-001 | TODO | | SPRINT_164_exportcenter_iii | Risk Bundle Export Guild · CLI Guild | src/ExportCenter/StellaOps.ExportCenter.RiskBundles | Needs CLI export contract from CLCI0104 | Needs CLI export contract from CLCI0104 | RBRB0101 | -| BUNDLE-70-002 | TODO | | SPRINT_164_exportcenter_iii | Risk Bundle Export Guild · Docs Guild | src/ExportCenter/StellaOps.ExportCenter.RiskBundles | Depends on #3 | Depends on #3 | RBRB0101 | +| BUNDLE-69-001 | TODO | | SPRINT_0164_0000_0003_exportcenter_iii | Risk Bundle Export Guild · Risk Engine Guild | src/ExportCenter/StellaOps.ExportCenter.RiskBundles | Align with ATEL0102 DSSE outputs | Align with ATEL0102 DSSE outputs | RBRB0101 | +| BUNDLE-69-002 | TODO | | SPRINT_0164_0000_0003_exportcenter_iii | Risk Bundle Export Guild · DevOps Guild | src/ExportCenter/StellaOps.ExportCenter.RiskBundles | Depends on #1 | Depends on #1 | RBRB0101 | +| BUNDLE-70-001 | TODO | | SPRINT_0164_0000_0003_exportcenter_iii | Risk Bundle Export Guild · CLI Guild | src/ExportCenter/StellaOps.ExportCenter.RiskBundles | Needs CLI export contract from CLCI0104 | Needs CLI export contract from CLCI0104 | RBRB0101 | +| BUNDLE-70-002 | TODO | | SPRINT_0164_0000_0003_exportcenter_iii | Risk Bundle Export Guild · Docs Guild | src/ExportCenter/StellaOps.ExportCenter.RiskBundles | Depends on #3 | Depends on #3 | RBRB0101 | | CAS-401-001 | TODO | | SPRINT_0401_0001_0001_reachability_evidence_chain | Scanner Worker Guild | `src/Scanner/StellaOps.Scanner.Worker` | Wait for RBRE0101 DSSE hashes | Wait for RBRE0101 DSSE hashes | CASC0101 | | CCCS-02-009 | TODO | | SPRINT_117_concelier_vi | Concelier Connector Guild – CCCS | src/Concelier/__Libraries/StellaOps.Concelier.Connector.Cccs | Implement restart-safe watermark + schema tests. | Confirm CCCS ingest watermark | CCFD0101 | | CENTER-ENG-0001 | TODO | | SPRINT_320_docs_modules_export_center | Module Team · Export Center Guild | docs/modules/export-center | Wait for RBRB0101 bundle sample | Wait for RBRB0101 bundle sample | DOEC0101 | @@ -313,10 +313,10 @@ | CLI-ATTEST-74-002 | BLOCKED | 2025-11-25 | SPRINT_0201_0001_0001_cli_i | CLI Attestor Guild (src/Cli/StellaOps.Cli) | src/Cli/StellaOps.Cli | Implement `stella attest fetch` to download envelopes and payloads to disk. Dependencies: CLI-ATTEST-74-001. | Blocked: upstream CLI-ATTEST-74-001 | CLCI0102 | | CLI-ATTEST-75-001 | TODO | | SPRINT_0201_0001_0001_cli_i | CLI Attestor Guild, KMS Guild (src/Cli/StellaOps.Cli) | src/Cli/StellaOps.Cli | Implement `stella attest key create. Dependencies: CLI-ATTEST-74-002. | — | CLCI0102 | | CLI-ATTEST-75-002 | TODO | | SPRINT_0201_0001_0001_cli_i | CLI Attestor Guild | src/Cli/StellaOps.Cli | Add support for building/verifying attestation bundles in CLI. Dependencies: CLI-ATTEST-75-001. | Wait for ATEL0102 outputs | CLCI0109 | -| CLI-CORE-41-001 | TODO | | SPRINT_202_cli_ii | DevEx/CLI Guild (src/Cli/StellaOps.Cli) | src/Cli/StellaOps.Cli | Implement CLI core features: config precedence, profiles/contexts, auth flows, output renderer (json/yaml/table), error mapping, global flags, telemetry opt-in. | — | CLCI0103 | +| CLI-CORE-41-001 | TODO | | SPRINT_0202_0000_0002_cli_ii | DevEx/CLI Guild (src/Cli/StellaOps.Cli) | src/Cli/StellaOps.Cli | Implement CLI core features: config precedence, profiles/contexts, auth flows, output renderer (json/yaml/table), error mapping, global flags, telemetry opt-in. | — | CLCI0103 | | CLI-DET-01 | DONE (2025-11-23) | 2025-11-23 | SPRINT_0301_0001_0001_docs_md_i | Docs Guild · DevEx/CLI Guild | | CLI-SBOM-60-001; CLI-SBOM-60-002 | CLI-SBOM-60-001; CLI-SBOM-60-002 | CLCI0103 | | CLI-DETER-70-003 | DONE | 2025-11-28 | SPRINT_0202_0001_0001_cli_ii | DevEx/CLI Guild, Scanner Guild (src/Cli/StellaOps.Cli) | src/Cli/StellaOps.Cli | Provide `stella detscore run` that executes the determinism harness locally (fixed clock, seeded RNG, canonical hashes) and writes `determinism.json`, supporting CI/non-zero threshold exit codes (`docs/modules/scanner/determinism-score.md`). | — | CLCI0103 | -| CLI-DETER-70-004 | TODO | | SPRINT_203_cli_iii | DevEx/CLI Guild (src/Cli/StellaOps.Cli) | src/Cli/StellaOps.Cli | Add `stella detscore report` to summarise published `determinism.json` files (overall score, per-image matrix) and integrate with release notes/air-gap kits (`docs/modules/scanner/determinism-score.md`). Dependencies: CLI-DETER-70-003. | — | CLCI0103 | +| CLI-DETER-70-004 | TODO | | SPRINT_0203_0000_0003_cli_iii | DevEx/CLI Guild (src/Cli/StellaOps.Cli) | src/Cli/StellaOps.Cli | Add `stella detscore report` to summarise published `determinism.json` files (overall score, per-image matrix) and integrate with release notes/air-gap kits (`docs/modules/scanner/determinism-score.md`). Dependencies: CLI-DETER-70-003. | — | CLCI0103 | | CLI-DOCS-0001 | TODO | | SPRINT_316_docs_modules_cli | Docs Guild (docs/modules/cli) | docs/modules/cli | See ./AGENTS.md | — | CLCI0103 | | CLI-EDITOR-401-004 | TODO | | SPRINT_0401_0001_0001_reachability_evidence_chain | CLI Guild (`src/Cli/StellaOps.Cli`, `docs/policy/lifecycle.md`) | `src/Cli/StellaOps.Cli`, `docs/policy/lifecycle.md` | Enhance `stella policy` CLI verbs (edit/lint/simulate) to edit Git-backed `.dsl` files, run local coverage tests, and commit SemVer metadata. | — | CLCI0103 | | CLI-ENG-0001 | TODO | | SPRINT_316_docs_modules_cli | Module Team (docs/modules/cli) | docs/modules/cli | Update status via ./AGENTS.md workflow | — | CLCI0103 | @@ -334,55 +334,55 @@ | CLI-NOTIFY-39-001 | BLOCKED | 2025-10-29 | SPRINT_0202_0001_0001_cli_ii | DevEx/CLI Guild (src/Cli/StellaOps.Cli) | src/Cli/StellaOps.Cli | Add simulation (`stella notify simulate`) and digest commands with diff output and schedule triggering, including dry-run mode. Dependencies: CLI-NOTIFY-38-001. | CLCI0103 | CLCI0104 | | CLI-NOTIFY-40-001 | BLOCKED | 2025-11-30 | SPRINT_0202_0001_0001_cli_ii | DevEx/CLI Guild (src/Cli/StellaOps.Cli) | src/Cli/StellaOps.Cli | Provide ack token redemption workflow, escalation management, localization previews, and channel health checks. Dependencies: CLI-NOTIFY-39-001. | — | CLCI0104 | | CLI-OBS-50-001 | DONE | 2025-11-28 | SPRINT_0202_0001_0001_cli_ii | DevEx/CLI Guild (src/Cli/StellaOps.Cli) | src/Cli/StellaOps.Cli | Ensure CLI HTTP client propagates `traceparent` headers for all commands, prints correlation IDs on failure, and records trace IDs in verbose logs (scrubbed). | — | CLCI0104 | -| CLI-OBS-51-001 | TODO | | SPRINT_203_cli_iii | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Implement `stella obs top` command streaming service health metrics, SLO status, and burn-rate alerts with TUI view and JSON output. Dependencies: CLI-OBS-50-001. | — | CLCI0105 | -| CLI-OBS-52-001 | TODO | | SPRINT_203_cli_iii | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Add `stella obs trace ` and `stella obs logs --from/--to` commands that correlate timeline events, logs, and evidence links with pagination + guardrails. Dependencies: CLI-OBS-51-001. | — | CLCI0105 | -| CLI-OBS-55-001 | TODO | | SPRINT_203_cli_iii | DevEx/CLI Guild · DevOps Guild | src/Cli/StellaOps.Cli | Add `stella obs incident-mode enable. Dependencies: CLI-OBS-52-001. | — | CLCI0105 | +| CLI-OBS-51-001 | TODO | | SPRINT_0203_0000_0003_cli_iii | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Implement `stella obs top` command streaming service health metrics, SLO status, and burn-rate alerts with TUI view and JSON output. Dependencies: CLI-OBS-50-001. | — | CLCI0105 | +| CLI-OBS-52-001 | TODO | | SPRINT_0203_0000_0003_cli_iii | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Add `stella obs trace ` and `stella obs logs --from/--to` commands that correlate timeline events, logs, and evidence links with pagination + guardrails. Dependencies: CLI-OBS-51-001. | — | CLCI0105 | +| CLI-OBS-55-001 | TODO | | SPRINT_0203_0000_0003_cli_iii | DevEx/CLI Guild · DevOps Guild | src/Cli/StellaOps.Cli | Add `stella obs incident-mode enable. Dependencies: CLI-OBS-52-001. | — | CLCI0105 | | CLI-OPS-0001 | TODO | | SPRINT_316_docs_modules_cli | Ops Guild (docs/modules/cli) | docs/modules/cli | Sync outcomes back to ../.. | — | CLCI0105 | -| CLI-ORCH-32-001 | TODO | | SPRINT_203_cli_iii | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Implement `stella orch sources | ORGR0101 hand-off | CLCI0105 | -| CLI-ORCH-33-001 | TODO | | SPRINT_203_cli_iii | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Add action verbs (`sources test. Dependencies: CLI-ORCH-32-001. | ORGR0101 hand-off | CLCI0105 | -| CLI-ORCH-34-001 | TODO | | SPRINT_203_cli_iii | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Provide backfill wizard (`--from/--to --dry-run`), quota management (`quotas get. Dependencies: CLI-ORCH-33-001. | ORGR0102 API review | CLCI0105 | -| CLI-PACKS-42-001 | TODO | | SPRINT_203_cli_iii | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Implement Task Pack commands (`pack plan/run/push/pull/verify`) with schema validation, expression sandbox, plan/simulate engine, remote execution. | — | CLCI0105 | -| CLI-PACKS-43-001 | TODO | | SPRINT_203_cli_iii | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Deliver advanced pack features (approvals pause/resume, secret injection, localization, man pages, offline cache). Dependencies: CLI-PACKS-42-001. | Offline kit schema sign-off | CLCI0105 | +| CLI-ORCH-32-001 | TODO | | SPRINT_0203_0000_0003_cli_iii | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Implement `stella orch sources | ORGR0101 hand-off | CLCI0105 | +| CLI-ORCH-33-001 | TODO | | SPRINT_0203_0000_0003_cli_iii | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Add action verbs (`sources test. Dependencies: CLI-ORCH-32-001. | ORGR0101 hand-off | CLCI0105 | +| CLI-ORCH-34-001 | TODO | | SPRINT_0203_0000_0003_cli_iii | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Provide backfill wizard (`--from/--to --dry-run`), quota management (`quotas get. Dependencies: CLI-ORCH-33-001. | ORGR0102 API review | CLCI0105 | +| CLI-PACKS-42-001 | TODO | | SPRINT_0203_0000_0003_cli_iii | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Implement Task Pack commands (`pack plan/run/push/pull/verify`) with schema validation, expression sandbox, plan/simulate engine, remote execution. | — | CLCI0105 | +| CLI-PACKS-43-001 | TODO | | SPRINT_0203_0000_0003_cli_iii | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Deliver advanced pack features (approvals pause/resume, secret injection, localization, man pages, offline cache). Dependencies: CLI-PACKS-42-001. | Offline kit schema sign-off | CLCI0105 | | CLI-PACKS-43-002 | TODO | | SPRINT_0508_0001_0001_ops_offline_kit | Offline Kit Guild · Packs Registry Guild | ops/offline-kit | Bundle Task Pack samples, registry mirror seeds, Task Runner configs, and CLI binaries with checksums into Offline Kit. | CLI-PACKS-43-001 | CLCI0105 | -| CLI-PARITY-41-001 | TODO | | SPRINT_203_cli_iii | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Deliver parity command groups (`policy`, `sbom`, `vuln`, `vex`, `advisory`, `export`, `orchestrator`) with `--explain`, deterministic outputs, and parity matrix entries. | — | CLCI0106 | -| CLI-PARITY-41-002 | TODO | | SPRINT_203_cli_iii | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Implement `notify`, `aoc`, `auth` command groups, idempotency keys, shell completions, config docs, and parity matrix export tooling. Dependencies: CLI-PARITY-41-001. | — | CLCI0106 | -| CLI-POLICY-20-001 | TODO | | SPRINT_203_cli_iii | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Add `stella policy new | PLPE0101 completion | CLCI0106 | -| CLI-POLICY-23-004 | TODO | | SPRINT_203_cli_iii | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Add `stella policy lint` command validating SPL files with compiler diagnostics; support JSON output. Dependencies: CLI-POLICY-20-001. | PLPE0102 readiness | CLCI0106 | -| CLI-POLICY-23-006 | TODO | | SPRINT_203_cli_iii | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Provide `stella policy history` and `stella policy explain` commands to pull run history and explanation trees. Dependencies: CLI-POLICY-23-005. | — | CLCI0106 | -| CLI-POLICY-27-001 | TODO | | SPRINT_203_cli_iii | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Implement policy workspace commands (`stella policy init`, `edit`, `lint`, `compile`, `test`) with template selection, local cache, JSON output, and deterministic temp directories. Dependencies: CLI-POLICY-23-006. | Ledger API exposure | CLCI0106 | -| CLI-POLICY-27-002 | TODO | | SPRINT_204_cli_iv | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Add submission/review workflow commands (`stella policy version bump`, `submit`, `review comment`, `approve`, `reject`) supporting reviewer assignment, changelog capture, and exit codes. Dependencies: CLI-POLICY-27-001. | CLI-POLICY-27-001 | CLCI0106 | -| CLI-POLICY-27-003 | TODO | | SPRINT_204_cli_iv | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Implement `stella policy simulate` enhancements (quick vs batch, SBOM selectors, heatmap summary, manifest download) with `--json` and Markdown report output for CI. Dependencies: CLI-POLICY-27-002. | CLI-POLICY-27-002 | CLCI0106 | -| CLI-POLICY-27-004 | TODO | | SPRINT_204_cli_iv | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Add lifecycle commands for publish/promote/rollback/sign (`stella policy publish --sign`, `promote --env`, `rollback`) with attestation verification and canary arguments. Dependencies: CLI-POLICY-27-003. | CLI-POLICY-27-003 | CLCI0106 | -| CLI-POLICY-27-005 | TODO | | SPRINT_204_cli_iv | DevEx/CLI Guild · Docs Guild | src/Cli/StellaOps.Cli | Update CLI reference and samples for Policy Studio including JSON schemas, exit codes, and CI snippets. Dependencies: CLI-POLICY-27-004. | CLI-POLICY-27-004 | CLCI0106 | -| CLI-POLICY-27-006 | TODO | | SPRINT_204_cli_iv | CLI Guild · Policy Guild | src/Cli/StellaOps.Cli | Update CLI policy profiles/help text to request the new Policy Studio scope family, surface ProblemDetails guidance for `invalid_scope`, and adjust regression tests for scope failures. Dependencies: CLI-POLICY-27-005. | Depends on #2 | CLCI0109 | -| CLI-PROMO-70-001 | TODO | | SPRINT_202_cli_ii | DevEx/CLI Guild · Provenance Guild | src/Cli/StellaOps.Cli | Add `stella promotion assemble` command that resolves image digests, hashes SBOM/VEX artifacts, fetches Rekor proofs from Attestor, and emits the `stella.ops/promotion@v1` JSON payload (see `docs/release/promotion-attestations.md`). | Mirror attestation inputs | CLCI0108 | -| CLI-PROMO-70-002 | TODO | | SPRINT_203_cli_iii | CLI Guild · Marketing Guild | src/Cli/StellaOps.Cli | Implement `stella promotion attest` / `promotion verify` commands that sign the promotion payload via Signer, retrieve DSSE bundles from Attestor, and perform offline verification against trusted checkpoints (`docs/release/promotion-attestations.md`). Dependencies: CLI-PROMO-70-001. | Needs revised DSSE plan | CLCI0109 | +| CLI-PARITY-41-001 | TODO | | SPRINT_0203_0000_0003_cli_iii | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Deliver parity command groups (`policy`, `sbom`, `vuln`, `vex`, `advisory`, `export`, `orchestrator`) with `--explain`, deterministic outputs, and parity matrix entries. | — | CLCI0106 | +| CLI-PARITY-41-002 | TODO | | SPRINT_0203_0000_0003_cli_iii | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Implement `notify`, `aoc`, `auth` command groups, idempotency keys, shell completions, config docs, and parity matrix export tooling. Dependencies: CLI-PARITY-41-001. | — | CLCI0106 | +| CLI-POLICY-20-001 | TODO | | SPRINT_0203_0000_0003_cli_iii | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Add `stella policy new | PLPE0101 completion | CLCI0106 | +| CLI-POLICY-23-004 | TODO | | SPRINT_0203_0000_0003_cli_iii | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Add `stella policy lint` command validating SPL files with compiler diagnostics; support JSON output. Dependencies: CLI-POLICY-20-001. | PLPE0102 readiness | CLCI0106 | +| CLI-POLICY-23-006 | TODO | | SPRINT_0203_0000_0003_cli_iii | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Provide `stella policy history` and `stella policy explain` commands to pull run history and explanation trees. Dependencies: CLI-POLICY-23-005. | — | CLCI0106 | +| CLI-POLICY-27-001 | TODO | | SPRINT_0203_0000_0003_cli_iii | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Implement policy workspace commands (`stella policy init`, `edit`, `lint`, `compile`, `test`) with template selection, local cache, JSON output, and deterministic temp directories. Dependencies: CLI-POLICY-23-006. | Ledger API exposure | CLCI0106 | +| CLI-POLICY-27-002 | TODO | | SPRINT_0204_0000_0004_cli_iv | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Add submission/review workflow commands (`stella policy version bump`, `submit`, `review comment`, `approve`, `reject`) supporting reviewer assignment, changelog capture, and exit codes. Dependencies: CLI-POLICY-27-001. | CLI-POLICY-27-001 | CLCI0106 | +| CLI-POLICY-27-003 | TODO | | SPRINT_0204_0000_0004_cli_iv | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Implement `stella policy simulate` enhancements (quick vs batch, SBOM selectors, heatmap summary, manifest download) with `--json` and Markdown report output for CI. Dependencies: CLI-POLICY-27-002. | CLI-POLICY-27-002 | CLCI0106 | +| CLI-POLICY-27-004 | TODO | | SPRINT_0204_0000_0004_cli_iv | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Add lifecycle commands for publish/promote/rollback/sign (`stella policy publish --sign`, `promote --env`, `rollback`) with attestation verification and canary arguments. Dependencies: CLI-POLICY-27-003. | CLI-POLICY-27-003 | CLCI0106 | +| CLI-POLICY-27-005 | TODO | | SPRINT_0204_0000_0004_cli_iv | DevEx/CLI Guild · Docs Guild | src/Cli/StellaOps.Cli | Update CLI reference and samples for Policy Studio including JSON schemas, exit codes, and CI snippets. Dependencies: CLI-POLICY-27-004. | CLI-POLICY-27-004 | CLCI0106 | +| CLI-POLICY-27-006 | TODO | | SPRINT_0204_0000_0004_cli_iv | CLI Guild · Policy Guild | src/Cli/StellaOps.Cli | Update CLI policy profiles/help text to request the new Policy Studio scope family, surface ProblemDetails guidance for `invalid_scope`, and adjust regression tests for scope failures. Dependencies: CLI-POLICY-27-005. | Depends on #2 | CLCI0109 | +| CLI-PROMO-70-001 | TODO | | SPRINT_0202_0000_0002_cli_ii | DevEx/CLI Guild · Provenance Guild | src/Cli/StellaOps.Cli | Add `stella promotion assemble` command that resolves image digests, hashes SBOM/VEX artifacts, fetches Rekor proofs from Attestor, and emits the `stella.ops/promotion@v1` JSON payload (see `docs/release/promotion-attestations.md`). | Mirror attestation inputs | CLCI0108 | +| CLI-PROMO-70-002 | TODO | | SPRINT_0203_0000_0003_cli_iii | CLI Guild · Marketing Guild | src/Cli/StellaOps.Cli | Implement `stella promotion attest` / `promotion verify` commands that sign the promotion payload via Signer, retrieve DSSE bundles from Attestor, and perform offline verification against trusted checkpoints (`docs/release/promotion-attestations.md`). Dependencies: CLI-PROMO-70-001. | Needs revised DSSE plan | CLCI0109 | | CLI-REPLAY-187-002 | TODO | | SPRINT_160_export_evidence | CLI Guild · Replay Guild | `src/Cli/StellaOps.Cli` | CLI Guild · `docs/modules/cli/architecture.md` | Requires RBRE0101 recorder schema | CLCI0109 | -| CLI-RISK-66-001 | TODO | | SPRINT_204_cli_iv | DevEx/CLI Guild · Policy Guild | src/Cli/StellaOps.Cli | Implement `stella risk profile list | Ledger scores ready | CLCI0108 | -| CLI-RISK-66-002 | TODO | | SPRINT_204_cli_iv | DevEx/CLI Guild · Risk Engine Guild | src/Cli/StellaOps.Cli | Ship `stella risk simulate` supporting SBOM/asset inputs, diff mode, and export to JSON/CSV. Dependencies: CLI-RISK-66-001. | CLI-RISK-66-001 | CLCI0108 | -| CLI-RISK-67-001 | TODO | | SPRINT_204_cli_iv | DevEx/CLI Guild · Findings Ledger Guild | src/Cli/StellaOps.Cli | Provide `stella risk results` with filtering, severity thresholds, explainability fetch. Dependencies: CLI-RISK-66-002. | CLI-RISK-66-002 | CLCI0108 | -| CLI-RISK-68-001 | TODO | | SPRINT_204_cli_iv | DevEx/CLI Guild · Export Guild | src/Cli/StellaOps.Cli | Add `stella risk bundle verify` and integrate with offline risk bundles. Dependencies: CLI-RISK-67-001. | CLI-RISK-67-001 | CLCI0108 | -| CLI-SBOM-60-001 | TODO | | SPRINT_203_cli_iii | CLI Guild · Scanner Guild | src/Cli/StellaOps.Cli | Ship `stella sbomer layer`/`compose` verbs that capture per-layer fragments, run canonicalization, verify fragment DSSE, and emit `_composition.json` + Merkle diagnostics (ref `docs/modules/scanner/deterministic-sbom-compose.md`). Dependencies: CLI-PARITY-41-001, SCANNER-SURFACE-04. | Wait for CASC0101 manifest | CLSB0101 | -| CLI-SBOM-60-002 | TODO | | SPRINT_203_cli_iii | CLI Guild | src/Cli/StellaOps.Cli | Add `stella sbomer drift --explain` + `verify` commands that rerun composition locally, highlight which arrays/keys broke determinism, and integrate with Offline Kit bundles. Dependencies: CLI-SBOM-60-001. | Depends on #1 | CLSB0101 | -| CLI-SDK-62-001 | TODO | | SPRINT_204_cli_iv | CLI Guild · SDK Guild | src/Cli/StellaOps.Cli | Replace bespoke HTTP clients with official SDK (TS/Go) for all CLI commands; ensure modular transport for air-gapped mode. | Align with SDK generator sprint | CLSB0101 | -| CLI-SDK-62-002 | TODO | | SPRINT_204_cli_iv | CLI Guild | src/Cli/StellaOps.Cli | Update CLI error handling to surface standardized API error envelope with `error.code` and `trace_id`. Dependencies: CLI-SDK-62-001. | Depends on #3 | CLSB0101 | -| CLI-SDK-63-001 | TODO | | SPRINT_204_cli_iv | CLI Guild | src/Cli/StellaOps.Cli | Expose `stella api spec download` command retrieving aggregate OAS and verifying checksum/ETag. Dependencies: CLI-SDK-62-002. | Needs CAS graph (CASC0101) | CLSB0101 | -| CLI-SDK-64-001 | TODO | | SPRINT_204_cli_iv | CLI Guild | src/Cli/StellaOps.Cli | Add CLI subcommand `stella sdk update` to fetch latest SDK manifests/changelogs; integrate with Notifications for deprecations. Dependencies: CLI-SDK-63-001. | Depends on #5 | CLSB0101 | -| CLI-SIG-26-001 | TODO | | SPRINT_204_cli_iv | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Implement `stella reachability upload-callgraph` and `stella reachability list/explain` commands with streaming upload, pagination, and exit codes. | ATEL0101 signing plan | CLCI0108 | -| CLI-SIG-26-002 | TODO | | SPRINT_204_cli_iv | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Extend `stella policy simulate` with reachability override flags (`--reachability-state`, `--reachability-score`). Dependencies: CLI-SIG-26-001. | CLI-SIG-26-001 | CLCI0108 | -| CLI-TEN-47-001 | TODO | | SPRINT_205_cli_v | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Implement `stella login`, `whoami`, `tenants list`, persistent profiles, secure token storage, and `--tenant` override with validation. | — | CLCI0108 | -| CLI-TEN-49-001 | TODO | | SPRINT_205_cli_v | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Add service account token minting, delegation (`stella token delegate`), impersonation banner, and audit-friendly logging. Dependencies: CLI-TEN-47-001. | CLI-TEN-47-001 | CLCI0108 | -| CLI-VEX-30-001 | TODO | | SPRINT_205_cli_v | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Implement `stella vex consensus list` with filters, paging, policy selection, `--json/--csv`. | PLVL0102 completion | CLCI0107 | -| CLI-VEX-30-002 | TODO | | SPRINT_205_cli_v | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Implement `stella vex consensus show` displaying quorum, evidence, rationale, signature status. Dependencies: CLI-VEX-30-001. | CLI-VEX-30-001 | CLCI0107 | -| CLI-VEX-30-003 | TODO | | SPRINT_205_cli_v | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Implement `stella vex simulate` for trust/threshold overrides with JSON diff output. Dependencies: CLI-VEX-30-002. | CLI-VEX-30-002 | CLCI0107 | -| CLI-VEX-30-004 | TODO | | SPRINT_205_cli_v | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Implement `stella vex export` for consensus NDJSON bundles with signature verification helper. Dependencies: CLI-VEX-30-003. | CLI-VEX-30-003 | CLCI0107 | +| CLI-RISK-66-001 | TODO | | SPRINT_0204_0000_0004_cli_iv | DevEx/CLI Guild · Policy Guild | src/Cli/StellaOps.Cli | Implement `stella risk profile list | Ledger scores ready | CLCI0108 | +| CLI-RISK-66-002 | TODO | | SPRINT_0204_0000_0004_cli_iv | DevEx/CLI Guild · Risk Engine Guild | src/Cli/StellaOps.Cli | Ship `stella risk simulate` supporting SBOM/asset inputs, diff mode, and export to JSON/CSV. Dependencies: CLI-RISK-66-001. | CLI-RISK-66-001 | CLCI0108 | +| CLI-RISK-67-001 | TODO | | SPRINT_0204_0000_0004_cli_iv | DevEx/CLI Guild · Findings Ledger Guild | src/Cli/StellaOps.Cli | Provide `stella risk results` with filtering, severity thresholds, explainability fetch. Dependencies: CLI-RISK-66-002. | CLI-RISK-66-002 | CLCI0108 | +| CLI-RISK-68-001 | TODO | | SPRINT_0204_0000_0004_cli_iv | DevEx/CLI Guild · Export Guild | src/Cli/StellaOps.Cli | Add `stella risk bundle verify` and integrate with offline risk bundles. Dependencies: CLI-RISK-67-001. | CLI-RISK-67-001 | CLCI0108 | +| CLI-SBOM-60-001 | TODO | | SPRINT_0203_0000_0003_cli_iii | CLI Guild · Scanner Guild | src/Cli/StellaOps.Cli | Ship `stella sbomer layer`/`compose` verbs that capture per-layer fragments, run canonicalization, verify fragment DSSE, and emit `_composition.json` + Merkle diagnostics (ref `docs/modules/scanner/deterministic-sbom-compose.md`). Dependencies: CLI-PARITY-41-001, SCANNER-SURFACE-04. | Wait for CASC0101 manifest | CLSB0101 | +| CLI-SBOM-60-002 | TODO | | SPRINT_0203_0000_0003_cli_iii | CLI Guild | src/Cli/StellaOps.Cli | Add `stella sbomer drift --explain` + `verify` commands that rerun composition locally, highlight which arrays/keys broke determinism, and integrate with Offline Kit bundles. Dependencies: CLI-SBOM-60-001. | Depends on #1 | CLSB0101 | +| CLI-SDK-62-001 | TODO | | SPRINT_0204_0000_0004_cli_iv | CLI Guild · SDK Guild | src/Cli/StellaOps.Cli | Replace bespoke HTTP clients with official SDK (TS/Go) for all CLI commands; ensure modular transport for air-gapped mode. | Align with SDK generator sprint | CLSB0101 | +| CLI-SDK-62-002 | TODO | | SPRINT_0204_0000_0004_cli_iv | CLI Guild | src/Cli/StellaOps.Cli | Update CLI error handling to surface standardized API error envelope with `error.code` and `trace_id`. Dependencies: CLI-SDK-62-001. | Depends on #3 | CLSB0101 | +| CLI-SDK-63-001 | TODO | | SPRINT_0204_0000_0004_cli_iv | CLI Guild | src/Cli/StellaOps.Cli | Expose `stella api spec download` command retrieving aggregate OAS and verifying checksum/ETag. Dependencies: CLI-SDK-62-002. | Needs CAS graph (CASC0101) | CLSB0101 | +| CLI-SDK-64-001 | TODO | | SPRINT_0204_0000_0004_cli_iv | CLI Guild | src/Cli/StellaOps.Cli | Add CLI subcommand `stella sdk update` to fetch latest SDK manifests/changelogs; integrate with Notifications for deprecations. Dependencies: CLI-SDK-63-001. | Depends on #5 | CLSB0101 | +| CLI-SIG-26-001 | TODO | | SPRINT_0204_0000_0004_cli_iv | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Implement `stella reachability upload-callgraph` and `stella reachability list/explain` commands with streaming upload, pagination, and exit codes. | ATEL0101 signing plan | CLCI0108 | +| CLI-SIG-26-002 | TODO | | SPRINT_0204_0000_0004_cli_iv | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Extend `stella policy simulate` with reachability override flags (`--reachability-state`, `--reachability-score`). Dependencies: CLI-SIG-26-001. | CLI-SIG-26-001 | CLCI0108 | +| CLI-TEN-47-001 | TODO | | SPRINT_0205_0000_0005_cli_v | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Implement `stella login`, `whoami`, `tenants list`, persistent profiles, secure token storage, and `--tenant` override with validation. | — | CLCI0108 | +| CLI-TEN-49-001 | TODO | | SPRINT_0205_0000_0005_cli_v | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Add service account token minting, delegation (`stella token delegate`), impersonation banner, and audit-friendly logging. Dependencies: CLI-TEN-47-001. | CLI-TEN-47-001 | CLCI0108 | +| CLI-VEX-30-001 | TODO | | SPRINT_0205_0000_0005_cli_v | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Implement `stella vex consensus list` with filters, paging, policy selection, `--json/--csv`. | PLVL0102 completion | CLCI0107 | +| CLI-VEX-30-002 | TODO | | SPRINT_0205_0000_0005_cli_v | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Implement `stella vex consensus show` displaying quorum, evidence, rationale, signature status. Dependencies: CLI-VEX-30-001. | CLI-VEX-30-001 | CLCI0107 | +| CLI-VEX-30-003 | TODO | | SPRINT_0205_0000_0005_cli_v | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Implement `stella vex simulate` for trust/threshold overrides with JSON diff output. Dependencies: CLI-VEX-30-002. | CLI-VEX-30-002 | CLCI0107 | +| CLI-VEX-30-004 | TODO | | SPRINT_0205_0000_0005_cli_v | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Implement `stella vex export` for consensus NDJSON bundles with signature verification helper. Dependencies: CLI-VEX-30-003. | CLI-VEX-30-003 | CLCI0107 | | CLI-VEX-401-011 | TODO | | SPRINT_0401_0001_0001_reachability_evidence_chain | CLI Guild | `src/Cli/StellaOps.Cli`, `docs/modules/cli/architecture.md`, `docs/benchmarks/vex-evidence-playbook.md` | Add `stella decision export | Reachability API exposure | CLCI0107 | -| CLI-VULN-29-001 | TODO | | SPRINT_205_cli_v | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Implement `stella vuln list` with grouping, paging, filters, `--json/--csv`, and policy selection. | — | CLCI0107 | -| CLI-VULN-29-002 | TODO | | SPRINT_205_cli_v | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Implement `stella vuln show` displaying evidence, policy rationale, paths, ledger summary; support `--json` for automation. Dependencies: CLI-VULN-29-001. | CLI-VULN-29-001 | CLCI0107 | -| CLI-VULN-29-003 | TODO | | SPRINT_205_cli_v | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Add workflow commands (`assign`, `comment`, `accept-risk`, `verify-fix`, `target-fix`, `reopen`) with filter selection (`--filter`) and idempotent retries. Dependencies: CLI-VULN-29-002. | CLI-VULN-29-002 | CLCI0107 | -| CLI-VULN-29-004 | TODO | | SPRINT_205_cli_v | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Implement `stella vuln simulate` producing delta summaries and optional Markdown report for CI. Dependencies: CLI-VULN-29-003. | CLI-VULN-29-003 | CLCI0107 | -| CLI-VULN-29-005 | TODO | | SPRINT_205_cli_v | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Add `stella vuln export` and `stella vuln bundle verify` commands to trigger/download evidence bundles and verify signatures. Dependencies: CLI-VULN-29-004. | CLI-VULN-29-004 | CLCI0107 | -| CLI-VULN-29-006 | TODO | | SPRINT_205_cli_v | DevEx/CLI Guild · Docs Guild | src/Cli/StellaOps.Cli | Update CLI docs/examples for Vulnerability Explorer with compliance checklist and CI snippets. Dependencies: CLI-VULN-29-005. | CLI-VULN-29-005 | CLCI0108 | +| CLI-VULN-29-001 | TODO | | SPRINT_0205_0000_0005_cli_v | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Implement `stella vuln list` with grouping, paging, filters, `--json/--csv`, and policy selection. | — | CLCI0107 | +| CLI-VULN-29-002 | TODO | | SPRINT_0205_0000_0005_cli_v | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Implement `stella vuln show` displaying evidence, policy rationale, paths, ledger summary; support `--json` for automation. Dependencies: CLI-VULN-29-001. | CLI-VULN-29-001 | CLCI0107 | +| CLI-VULN-29-003 | TODO | | SPRINT_0205_0000_0005_cli_v | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Add workflow commands (`assign`, `comment`, `accept-risk`, `verify-fix`, `target-fix`, `reopen`) with filter selection (`--filter`) and idempotent retries. Dependencies: CLI-VULN-29-002. | CLI-VULN-29-002 | CLCI0107 | +| CLI-VULN-29-004 | TODO | | SPRINT_0205_0000_0005_cli_v | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Implement `stella vuln simulate` producing delta summaries and optional Markdown report for CI. Dependencies: CLI-VULN-29-003. | CLI-VULN-29-003 | CLCI0107 | +| CLI-VULN-29-005 | TODO | | SPRINT_0205_0000_0005_cli_v | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Add `stella vuln export` and `stella vuln bundle verify` commands to trigger/download evidence bundles and verify signatures. Dependencies: CLI-VULN-29-004. | CLI-VULN-29-004 | CLCI0107 | +| CLI-VULN-29-006 | TODO | | SPRINT_0205_0000_0005_cli_v | DevEx/CLI Guild · Docs Guild | src/Cli/StellaOps.Cli | Update CLI docs/examples for Vulnerability Explorer with compliance checklist and CI snippets. Dependencies: CLI-VULN-29-005. | CLI-VULN-29-005 | CLCI0108 | | CLIENT-401-012 | TODO | | SPRINT_0401_0001_0001_reachability_evidence_chain | Symbols Guild | `src/Symbols/StellaOps.Symbols.Client`, `src/Scanner/StellaOps.Scanner.Symbolizer` | Align with symbolizer regression fixtures | Align with symbolizer regression fixtures | RBSY0101 | | COMPOSE-44-001 | BLOCKED | 2025-11-25 | SPRINT_0501_0001_0001_ops_deployment_i | Deployment Guild · DevEx Guild | ops/deployment | Author `docker-compose.yml`, `.env.example`, and `quickstart.sh` with all core services + dependencies (postgres, redis, object-store, queue, otel). | Waiting on consolidated service list/version pins from upstream module releases | DVCP0101 | | COMPOSE-44-002 | TODO | | SPRINT_0501_0001_0001_ops_deployment_i | Deployment Guild | ops/deployment | Implement `backup.sh` and `reset.sh` scripts with safety prompts and documentation. Dependencies: COMPOSE-44-001. | Depends on #1 | DVCP0101 | @@ -464,9 +464,9 @@ | CONCELIER-WEB-OBS-53-001 | TODO | | SPRINT_117_concelier_vi | Concelier WebService Guild · Evidence Locker Guild | src/Concelier/StellaOps.Concelier.WebService | Add `/evidence/advisories/*` routes that proxy evidence locker snapshots, verify `evidence:read` scopes, and return signed manifest metadata—no shortcut paths into raw storage. Depends on CONCELIER-WEB-OBS-52-001. | Blocked on Evidence Locker DSSE feed (002_ATEL0101) | CNOB0102 | | CONCELIER-WEB-OBS-54-001 | TODO | | SPRINT_117_concelier_vi | Concelier WebService Guild | src/Concelier/StellaOps.Concelier.WebService | Provide `/attestations/advisories/*` endpoints surfacing DSSE status, verification summary, and provenance chain so CLI/Console can audit trust without hitting databases. Depends on CONCELIER-WEB-OBS-53-001. | Depends on Link-Not-Merge schema (005_ATLN0101) | CNOB0102 | | CONCELIER-WEB-OBS-55-001 | TODO | | SPRINT_117_concelier_vi | Concelier WebService Guild · DevOps Guild | src/Concelier/StellaOps.Concelier.WebService | Implement incident-mode APIs that coordinate ingest, locker, and orchestrator, capturing activation events + cooldown semantics but leaving evidence untouched. Depends on CONCELIER-WEB-OBS-54-001. | Needs #4 to finalize labels | CNOB0102 | -| CONN-SUSE-01-003 | Team Excititor Connectors – SUSE | | SPRINT_120_excititor_ii | Connector Guild (SUSE) | src/Excititor/__Libraries/StellaOps.Excititor.Connectors.SUSE.RancherVEXHub | EXCITITOR-CONN-SUSE-01-002; EXCITITOR-POLICY-01-001 | EXCITITOR-CONN-SUSE-01-002; EXCITITOR-POLICY-01-001 | EXCN0102 | +| CONN-SUSE-01-003 | Team Excititor Connectors – SUSE | | SPRINT_0120_0000_0002_excititor_ii | Connector Guild (SUSE) | src/Excititor/__Libraries/StellaOps.Excititor.Connectors.SUSE.RancherVEXHub | EXCITITOR-CONN-SUSE-01-002; EXCITITOR-POLICY-01-001 | EXCITITOR-CONN-SUSE-01-002; EXCITITOR-POLICY-01-001 | EXCN0102 | | CONN-TRUST-01-001 | DONE (2025-11-22) | 2025-11-22 | SPRINT_110_ingestion_evidence | Excititor + AirGap Guilds | | Connnector trust + air-gap ingest delivered against frozen schema. | CONCELIER-GRAPH-21-001; CONCELIER-GRAPH-21-002; ATTEST-PLAN-2001 | EXCN0102 | -| CONN-UBUNTU-01-003 | Team Excititor Connectors – Ubuntu | | SPRINT_120_excititor_ii | Connector Guild (Ubuntu) | src/Excititor/__Libraries/StellaOps.Excititor.Connectors.Ubuntu.CSAF | EXCITITOR-CONN-UBUNTU-01-002; EXCITITOR-POLICY-01-001 | EXCITITOR-CONN-UBUNTU-01-002; EXCITITOR-POLICY-01-001 | EXCN0102 | +| CONN-UBUNTU-01-003 | Team Excititor Connectors – Ubuntu | | SPRINT_0120_0000_0002_excititor_ii | Connector Guild (Ubuntu) | src/Excititor/__Libraries/StellaOps.Excititor.Connectors.Ubuntu.CSAF | EXCITITOR-CONN-UBUNTU-01-002; EXCITITOR-POLICY-01-001 | EXCITITOR-CONN-UBUNTU-01-002; EXCITITOR-POLICY-01-001 | EXCN0102 | | CONSENSUS-LENS-DOCS-0001 | TODO | | SPRINT_332_docs_modules_vex_lens | Docs Guild | docs/modules/vex-lens | Wait for CCSL0101 panel demo | Wait for CCSL0101 panel demo | CCDL0101 | | CONSENSUS-LENS-DOCS-0002 | TODO | 2025-11-05 | SPRINT_332_docs_modules_vex_lens | Docs Guild | docs/modules/vex-lens | Depends on #1 | Depends on #1 | CCDL0101 | | CONSENSUS-LENS-ENG-0001 | TODO | | SPRINT_332_docs_modules_vex_lens | Module Team | docs/modules/vex-lens | Needs CCWO0101 schema | Needs CCWO0101 schema | CCDL0101 | @@ -485,15 +485,15 @@ | CONTAINERS-45-001 | DONE | 2025-11-19 | SPRINT_0212_0001_0001_web_i | BE-Base Platform Guild | src/Web/StellaOps.Web | Depends on #1 | Depends on #1 | COWB0101 | | CONTAINERS-46-001 | DONE | 2025-11-19 | SPRINT_0212_0001_0001_web_i | BE-Base Platform Guild | src/Web/StellaOps.Web | Needs RBRE0101 hashes | Needs RBRE0101 hashes | COWB0101 | | CONTRIB-62-001 | TODO | | SPRINT_303_docs_tasks_md_iii | Docs Guild · API Governance Guild | docs/api | Wait for CCWO0101 spec finalization | Wait for CCWO0101 spec finalization | APID0101 | -| CORE-185-001 | TODO | | SPRINT_185_shared_replay_primitives | Platform Guild | `src/__Libraries/StellaOps.Replay.Core` | Wait for SGSI0101 feed | Wait for SGSI0101 feed | RLRC0101 | -| CORE-185-002 | TODO | | SPRINT_185_shared_replay_primitives | Platform Guild | src/__Libraries/StellaOps.Replay.Core | Depends on #1 | Depends on #1 | RLRC0101 | -| CORE-185-003 | TODO | | SPRINT_185_shared_replay_primitives | Platform Data Guild | src/__Libraries/StellaOps.Replay.Core | Depends on #2 | Depends on #2 | RLRC0101 | -| CORE-186-004 | TODO | | SPRINT_186_record_deterministic_execution | Signing Guild | `src/Signer/StellaOps.Signer`, `src/__Libraries/StellaOps.Cryptography` | Wait for RLRC0101 schema | Wait for RLRC0101 schema | SIGR0101 | -| CORE-186-005 | TODO | | SPRINT_186_record_deterministic_execution | Signing Guild | `src/Signer/StellaOps.Signer.Core` | Depends on #1 | Depends on #1 | SIGR0101 | -| CORE-41-001 | TODO | | SPRINT_202_cli_ii | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Wait for CASC0101 manifest | Wait for CASC0101 manifest | CLCI0110 | -| CORE-AOC-19-002 | TODO | | SPRINT_120_excititor_ii | Excititor Core Guild | src/Excititor/__Libraries/StellaOps.Excititor.Core | Wait for ATLN schema freeze | Wait for ATLN schema freeze | EXAC0101 | -| CORE-AOC-19-003 | TODO | | SPRINT_120_excititor_ii | Excititor Core Guild | src/Excititor/__Libraries/StellaOps.Excititor.Core | Depends on #1 | Depends on #1 | EXAC0101 | -| CORE-AOC-19-004 | TODO | | SPRINT_120_excititor_ii | Excititor Core Guild | src/Excititor/__Libraries/StellaOps.Excititor.Core | Depends on #2 | Depends on #2 | EXAC0101 | +| CORE-185-001 | TODO | | SPRINT_0185_0000_0001_shared_replay_primitives | Platform Guild | `src/__Libraries/StellaOps.Replay.Core` | Wait for SGSI0101 feed | Wait for SGSI0101 feed | RLRC0101 | +| CORE-185-002 | TODO | | SPRINT_0185_0000_0001_shared_replay_primitives | Platform Guild | src/__Libraries/StellaOps.Replay.Core | Depends on #1 | Depends on #1 | RLRC0101 | +| CORE-185-003 | TODO | | SPRINT_0185_0000_0001_shared_replay_primitives | Platform Data Guild | src/__Libraries/StellaOps.Replay.Core | Depends on #2 | Depends on #2 | RLRC0101 | +| CORE-186-004 | TODO | | SPRINT_0186_0000_0001_record_deterministic_execution | Signing Guild | `src/Signer/StellaOps.Signer`, `src/__Libraries/StellaOps.Cryptography` | Wait for RLRC0101 schema | Wait for RLRC0101 schema | SIGR0101 | +| CORE-186-005 | TODO | | SPRINT_0186_0000_0001_record_deterministic_execution | Signing Guild | `src/Signer/StellaOps.Signer.Core` | Depends on #1 | Depends on #1 | SIGR0101 | +| CORE-41-001 | TODO | | SPRINT_0202_0000_0002_cli_ii | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Wait for CASC0101 manifest | Wait for CASC0101 manifest | CLCI0110 | +| CORE-AOC-19-002 | TODO | | SPRINT_0120_0000_0002_excititor_ii | Excititor Core Guild | src/Excititor/__Libraries/StellaOps.Excititor.Core | Wait for ATLN schema freeze | Wait for ATLN schema freeze | EXAC0101 | +| CORE-AOC-19-003 | TODO | | SPRINT_0120_0000_0002_excititor_ii | Excititor Core Guild | src/Excititor/__Libraries/StellaOps.Excititor.Core | Depends on #1 | Depends on #1 | EXAC0101 | +| CORE-AOC-19-004 | TODO | | SPRINT_0120_0000_0002_excititor_ii | Excititor Core Guild | src/Excititor/__Libraries/StellaOps.Excititor.Core | Depends on #2 | Depends on #2 | EXAC0101 | | CORE-AOC-19-013 | TODO | | SPRINT_112_concelier_i | Concelier Core Guild + Excititor | src/Concelier/__Libraries/StellaOps.Concelier.Core | Needs CCAN0101 DSSE output | Needs CCAN0101 DSSE output | EXAC0101 | | CRT-56-001 | TODO | | SPRINT_0506_0001_0001_ops_devops_iv | Mirror Creator Guild | | Wait for PGMI0101 owner | Wait for PGMI0101 owner | MRCR0101 | | CRT-56-002 | TODO | | SPRINT_0506_0001_0001_ops_devops_iv | Mirror Creator · Security Guilds | | Depends on #1 | MIRROR-CRT-56-001; PROV-OBS-53-001 | MRCR0101 | @@ -544,12 +544,12 @@ | DEPLOY-VEX-30-002 | TODO | | SPRINT_0502_0001_0001_ops_deployment_ii | Deployment Guild | ops/deployment | Package Issuer Directory deployment manifests, backups, and security hardening guidance. Dependencies: DEPLOY-VEX-30-001. | Depends on #5 | DVPL0101 | | DEPLOY-VULN-29-001 | TODO | | SPRINT_0502_0001_0001_ops_deployment_ii | Deployment + Vuln Guild | ops/deployment | Produce Helm/Compose overlays for Findings Ledger + projector, including DB migrations, Merkle anchor jobs, and scaling guidance. | Needs CCWO0101 | DVPL0101 | | DEPLOY-VULN-29-002 | TODO | | SPRINT_0502_0001_0001_ops_deployment_ii | Deployment Guild | ops/deployment | Package `stella-vuln-explorer-api` deployment manifests, health checks, autoscaling policies, and offline kit instructions with signed images. Dependencies: DEPLOY-VULN-29-001. | Depends on #7 | DVPL0101 | -| DETER-186-008 | TODO | | SPRINT_186_record_deterministic_execution | Scanner Guild | `src/Scanner/StellaOps.Scanner.WebService`, `src/Scanner/StellaOps.Scanner.Worker` | Wait for RLRC0101 fixture | Wait for RLRC0101 fixture | SCDT0101 | -| DETER-186-009 | TODO | | SPRINT_186_record_deterministic_execution | Scanner Guild · QA Guild | `src/Scanner/StellaOps.Scanner.Replay`, `src/Scanner/__Tests` | Depends on #1 | Depends on #1 | SCDT0101 | -| DETER-186-010 | TODO | | SPRINT_186_record_deterministic_execution | Scanner Guild · Export Center Guild | `src/Scanner/StellaOps.Scanner.WebService`, `docs/modules/scanner/operations/release.md` | Depends on #2 | Depends on #2 | SCDT0101 | +| DETER-186-008 | TODO | | SPRINT_0186_0000_0001_record_deterministic_execution | Scanner Guild | `src/Scanner/StellaOps.Scanner.WebService`, `src/Scanner/StellaOps.Scanner.Worker` | Wait for RLRC0101 fixture | Wait for RLRC0101 fixture | SCDT0101 | +| DETER-186-009 | TODO | | SPRINT_0186_0000_0001_record_deterministic_execution | Scanner Guild · QA Guild | `src/Scanner/StellaOps.Scanner.Replay`, `src/Scanner/__Tests` | Depends on #1 | Depends on #1 | SCDT0101 | +| DETER-186-010 | TODO | | SPRINT_0186_0000_0001_record_deterministic_execution | Scanner Guild · Export Center Guild | `src/Scanner/StellaOps.Scanner.WebService`, `docs/modules/scanner/operations/release.md` | Depends on #2 | Depends on #2 | SCDT0101 | | DETER-70-002 | TODO | | SPRINT_0304_0001_0004_docs_tasks_md_iv | Docs Guild · Scanner Guild | | Needs CASC0101 manifest | Needs CASC0101 manifest | SCDT0101 | -| DETER-70-003 | TODO | | SPRINT_202_cli_ii | DevEx/CLI Guild · Scanner Guild | src/Cli/StellaOps.Cli | Depends on #4 | Depends on #4 | SCDT0101 | -| DETER-70-004 | TODO | | SPRINT_203_cli_iii | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Depends on #5 | Depends on #5 | SCDT0101 | +| DETER-70-003 | TODO | | SPRINT_0202_0000_0002_cli_ii | DevEx/CLI Guild · Scanner Guild | src/Cli/StellaOps.Cli | Depends on #4 | Depends on #4 | SCDT0101 | +| DETER-70-004 | TODO | | SPRINT_0203_0000_0003_cli_iii | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Depends on #5 | Depends on #5 | SCDT0101 | | DEVOPS-AIAI-31-001 | TODO | | SPRINT_0503_0001_0001_ops_devops_i | DevOps Guild, Advisory AI Guild (ops/devops) | ops/devops | Stand up CI pipelines, inference monitoring, privacy logging review, and perf dashboards for Advisory AI (summaries/conflicts/remediation). | — | DVDO0101 | | DEVOPS-SPANSINK-31-003 | TODO | | SPRINT_0503_0001_0001_ops_devops_i | DevOps Guild · Observability Guild (ops/devops) | ops/devops | Deploy span sink/Signals pipeline for Excititor evidence APIs (31-003) and publish dashboards; unblock traces for `/v1/vex/observations/**`. | — | DVDO0101 | | DEVOPS-AIRGAP-56-001 | TODO | | SPRINT_0503_0001_0001_ops_devops_i | DevOps Guild (ops/devops) | ops/devops | Ship deny-all egress policies for Kubernetes (NetworkPolicy/eBPF) and docker-compose firewall rules; provide verification script for sealed mode. | — | DVDO0101 | @@ -632,7 +632,7 @@ | DEVPORT-64-001 | TODO | | SPRINT_206_devportal | DevPortal Guild | src/DevPortal/StellaOps.DevPortal.Site | Provide offline build target bundling HTML, specs, SDK archives; ensure no external assets. Dependencies: DEVPORT-63-002. | 64-001 | DEVL0101 | | DEVPORT-64-002 | TODO | | SPRINT_206_devportal | Developer Portal Guild (src/DevPortal/StellaOps.DevPortal.Site) | src/DevPortal/StellaOps.DevPortal.Site | Add automated accessibility tests, link checker, and performance budgets. Dependencies: DEVPORT-64-001. | | DEVL0102 | | DOC-008 | TODO | | SPRINT_0401_0001_0001_reachability_evidence_chain | Docs Guild · Reachability Guild | `docs/reachability/function-level-evidence.md`, `docs/09_API_CLI_REFERENCE.md`, `docs/api/policy.md` | Wait for replay evidence from 100_RBBN0101 | Wait for replay evidence from 100_RBBN0101 | DORC0101 | -| DOC-70-001 | DONE | | SPRINT_170_notifications_telemetry | Docs Guild · Notifications Guild | docs | Gather notification doc references | Validate existing notifications doc and migrate notes | DOCP0101 | +| DOC-70-001 | DONE | | SPRINT_0170_0000_0001_notifications_telemetry | Docs Guild · Notifications Guild | docs | Gather notification doc references | Validate existing notifications doc and migrate notes | DOCP0101 | | DOCKER-44-001 | TODO | | SPRINT_0507_0001_0001_ops_devops_v | DevOps Guild · Service Owners | ops/devops | Author multi-stage Dockerfiles for all core services (API, Console, Orchestrator, Task Runner, Conseiller, Excitor, Policy, Notify, Export, AI) with non-root users, read-only file systems, and health scripts. | Wait for DVPL0101 compose merge | DVDO0111 | | DOCKER-44-002 | TODO | | SPRINT_0507_0001_0001_ops_devops_v | DevOps Guild | ops/devops | Generate SBOMs and cosign attestations for each image and integrate verification into CI. Dependencies: DOCKER-44-001. | Depends on #1 | DVDO0111 | | DOCKER-44-003 | TODO | | SPRINT_0507_0001_0001_ops_devops_v | DevOps Guild | ops/devops | Implement `/health/liveness`, `/health/readiness`, `/version`, `/metrics`, and ensure capability endpoint returns `merge=false` for Conseiller/Excitor. Dependencies: DOCKER-44-002. | Requires SBOM+scan workflow from 137_SCDT0101 | DVDO0111 | @@ -756,9 +756,9 @@ | DOCS-POLICY-DET-01 | DONE (2025-11-23) | 2025-11-23 | SPRINT_0301_0001_0001_docs_md_i | Docs Guild · Policy Guild | docs/policy/runs.md | Extend `docs/modules/policy/architecture.md` with determinism gate semantics and provenance references. | Depends on deterministic harness (137_SCDT0101) | DOPL0103 | | DOCS-PROMO-70-001 | DONE (2025-11-26) | 2025-11-26 | SPRINT_0304_0001_0004_docs_tasks_md_iv | Docs Guild · Provenance Guild | docs/release/promotion-attestations.md | Publish `/docs/release/promotion-attestations.md` describing the promotion workflow (CLI commands, Signer/Attestor integration, offline verification) and update `/docs/forensics/provenance-attestation.md` with the new predicate. Dependencies: PROV-OBS-53-003, CLI-PROMO-70-002. | — | DOPV0101 | | DOCS-REACH-201-006 | TODO | | SPRINT_400_runtime_facts_static_callgraph_union | Docs Guild · Runtime Evidence Guild | docs/reachability | Author the reachability doc set (`docs/signals/reachability.md`, `callgraph-formats.md`, `runtime-facts.md`, CLI/UI appendices) plus update Zastava + Replay guides with the new evidence and operators’ workflow. | Needs RBRE0101 provenance hook summary | DORC0101 | -| DOCS-REPLAY-185-003 | TODO | | SPRINT_185_shared_replay_primitives | Docs Guild · Platform Data Guild | docs/replay | Author `docs/data/replay_schema.md` detailing `replay_runs`, `replay_bundles`, `replay_subjects` collections, index guidance, and offline sync strategy aligned with Replay CAS. | Need RPRC0101 API freeze | DORR0101 | -| DOCS-REPLAY-185-004 | TODO | | SPRINT_185_shared_replay_primitives | Docs Guild | docs/replay | Expand `docs/replay/DEVS_GUIDE_REPLAY.md` with integration guidance for consuming services (Scanner, Evidence Locker, CLI) and add checklist derived from `docs/replay/DETERMINISTIC_REPLAY.md` Section 11. | Depends on #1 | DORR0101 | -| DOCS-REPLAY-186-004 | DONE (2025-11-26) | 2025-11-26 | SPRINT_186_record_deterministic_execution | Docs Guild · Runtime Evidence Guild | docs/replay/TEST_STRATEGY.md | Author `docs/replay/TEST_STRATEGY.md` (golden replay, feed drift, tool upgrade) and link it from both replay docs and Scanner architecture pages. | — | DORR0101 | +| DOCS-REPLAY-185-003 | TODO | | SPRINT_0185_0000_0001_shared_replay_primitives | Docs Guild · Platform Data Guild | docs/replay | Author `docs/data/replay_schema.md` detailing `replay_runs`, `replay_bundles`, `replay_subjects` collections, index guidance, and offline sync strategy aligned with Replay CAS. | Need RPRC0101 API freeze | DORR0101 | +| DOCS-REPLAY-185-004 | TODO | | SPRINT_0185_0000_0001_shared_replay_primitives | Docs Guild | docs/replay | Expand `docs/replay/DEVS_GUIDE_REPLAY.md` with integration guidance for consuming services (Scanner, Evidence Locker, CLI) and add checklist derived from `docs/replay/DETERMINISTIC_REPLAY.md` Section 11. | Depends on #1 | DORR0101 | +| DOCS-REPLAY-186-004 | DONE (2025-11-26) | 2025-11-26 | SPRINT_0186_0000_0001_record_deterministic_execution | Docs Guild · Runtime Evidence Guild | docs/replay/TEST_STRATEGY.md | Author `docs/replay/TEST_STRATEGY.md` (golden replay, feed drift, tool upgrade) and link it from both replay docs and Scanner architecture pages. | — | DORR0101 | | DOCS-RISK-66-001 | TODO | | SPRINT_0308_0001_0008_docs_tasks_md_viii | Docs Guild · Risk Profile Schema Guild | docs/risk | Publish `/docs/risk/overview.md` covering concepts and glossary. | Need schema approvals from PLLG0104 | DORS0101 | | DOCS-RISK-66-002 | TODO | | SPRINT_0308_0001_0008_docs_tasks_md_viii | Docs Guild · Policy Guild | docs/risk | Author `/docs/risk/profiles.md` (authoring, versioning, scope). Dependencies: DOCS-RISK-66-001. | Depends on #1 | DORS0101 | | DOCS-RISK-66-003 | TODO | | SPRINT_0308_0001_0008_docs_tasks_md_viii | Docs Guild · Risk Engine Guild | docs/risk | Publish `/docs/risk/factors.md` cataloging signals, transforms, reducers, TTLs. Dependencies: DOCS-RISK-66-002. | Requires engine contract from Risk Engine Guild | DORS0101 | @@ -827,7 +827,7 @@ | DSSE-LIB-401-020 | DONE (2025-11-27) | 2025-11-27 | SPRINT_0401_0001_0001_reachability_evidence_chain | Attestor Guild · Platform Guild | `src/Attestor/StellaOps.Attestation`, `src/Attestor/StellaOps.Attestor.Envelope` | DsseEnvelopeExtensions added with conversion utilities; Envelope types exposed as transitive dependencies; consumers reference only StellaOps.Attestation. | Need attestor library API freeze | DOAL0101 | | DVOFF-64-002 | TODO | | SPRINT_160_export_evidence | DevPortal Offline Guild | docs/modules/export-center/devportal-offline.md | DevPortal Offline + AirGap Controller Guilds | Needs exporter DSSE schema from 002_ATEL0101 | DEVL0102 | | EDITOR-401-004 | TODO | | SPRINT_0401_0001_0001_reachability_evidence_chain | Docs Guild · CLI Guild | `src/Cli/StellaOps.Cli`, `docs/policy/lifecycle.md` | Gather CLI/editor alignment notes | Gather CLI/editor alignment notes | DOCL0103 | -| EMIT-15-001 | TODO | | SPRINT_136_scanner_surface | Docs Guild · Scanner Emit Guild | src/Scanner/__Libraries/StellaOps.Scanner.Emit | Need EntryTrace emit notes from SCANNER-SURFACE-04 | SCANNER-SURFACE-04 | DOEM0101 | +| EMIT-15-001 | TODO | | SPRINT_0136_0000_0001_scanner_surface | Docs Guild · Scanner Emit Guild | src/Scanner/__Libraries/StellaOps.Scanner.Emit | Need EntryTrace emit notes from SCANNER-SURFACE-04 | SCANNER-SURFACE-04 | DOEM0101 | | ENG-0001 | DONE | 2025-11-07 | SPRINT_333_docs_modules_excititor | Docs Guild · Analyzer Guild | docs/modules/excitor | Summarize excititor integration | Summarize excititor integration | DOEN0101 | | ENG-0002 | DONE | 2025-11-09 | SPRINT_137_scanner_gap_design | Docs Guild · Analyzer Guild | docs/modules/scanner | Link to analyzer doc commits | Link to analyzer doc commits | DOEN0101 | | ENG-0003 | DONE | 2025-11-09 | SPRINT_137_scanner_gap_design | Docs Guild · Analyzer Guild | docs/modules/scanner | Link to Python analyzer doc | Link to Python analyzer doc | DOEN0101 | @@ -847,14 +847,14 @@ | ENG-0017 | DONE | 2025-11-09 | SPRINT_0138_0000_0001_scanner_ruby_parity | Docs Guild · Analyzer Guild | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby | Analyzer doc evidence | SCANNER-ENG-0016 | DOEN0102 | | ENG-0018 | DONE | 2025-11-09 | SPRINT_0138_0000_0001_scanner_ruby_parity | Docs Guild · Analyzer Guild | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby | Analyzer doc evidence | SCANNER-ENG-0017 | DOEN0102 | | ENG-0019 | DONE | 2025-11-13 | SPRINT_0138_0000_0001_scanner_ruby_parity | Docs Guild · Analyzer Guild | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby | Analyzer doc evidence | SCANNER-ENG-0016..0018 | DOEN0102 | -| ENG-0020 | TODO | | SPRINT_136_scanner_surface | Docs Guild · Scanner Guild | docs/modules/scanner | Need surface doc context | Need surface doc context | DOEN0103 | -| ENG-0021 | TODO | | SPRINT_136_scanner_surface | Docs Guild · Scanner Guild | docs/modules/scanner | Same as #1 | Same as #1 | DOEN0103 | -| ENG-0022 | TODO | | SPRINT_136_scanner_surface | Docs Guild · Scanner Guild | docs/modules/scanner | Policy integration reference | Policy integration reference | DOEN0103 | -| ENG-0023 | TODO | | SPRINT_136_scanner_surface | Docs Guild · Scanner Guild | docs/modules/scanner | Offline kit/policy integration | Offline kit/policy integration | DOEN0103 | -| ENG-0024 | TODO | | SPRINT_136_scanner_surface | Docs Guild · Scanner Guild | docs/modules/scanner | Surface doc refresh | Surface doc refresh | DOEN0103 | -| ENG-0025 | TODO | | SPRINT_136_scanner_surface | Docs Guild · Scanner Guild | docs/modules/scanner | Surface doc refresh | Surface doc refresh | DOEN0103 | -| ENG-0026 | TODO | | SPRINT_136_scanner_surface | Docs Guild · Scanner Guild | docs/modules/scanner | Surface doc refresh | Surface doc refresh | DOEN0103 | -| ENG-0027 | TODO | | SPRINT_136_scanner_surface | Docs Guild · Scanner Guild | docs/modules/scanner | Policy/offline integration doc | Policy/offline integration doc | DOEN0103 | +| ENG-0020 | TODO | | SPRINT_0136_0000_0001_scanner_surface | Docs Guild · Scanner Guild | docs/modules/scanner | Need surface doc context | Need surface doc context | DOEN0103 | +| ENG-0021 | TODO | | SPRINT_0136_0000_0001_scanner_surface | Docs Guild · Scanner Guild | docs/modules/scanner | Same as #1 | Same as #1 | DOEN0103 | +| ENG-0022 | TODO | | SPRINT_0136_0000_0001_scanner_surface | Docs Guild · Scanner Guild | docs/modules/scanner | Policy integration reference | Policy integration reference | DOEN0103 | +| ENG-0023 | TODO | | SPRINT_0136_0000_0001_scanner_surface | Docs Guild · Scanner Guild | docs/modules/scanner | Offline kit/policy integration | Offline kit/policy integration | DOEN0103 | +| ENG-0024 | TODO | | SPRINT_0136_0000_0001_scanner_surface | Docs Guild · Scanner Guild | docs/modules/scanner | Surface doc refresh | Surface doc refresh | DOEN0103 | +| ENG-0025 | TODO | | SPRINT_0136_0000_0001_scanner_surface | Docs Guild · Scanner Guild | docs/modules/scanner | Surface doc refresh | Surface doc refresh | DOEN0103 | +| ENG-0026 | TODO | | SPRINT_0136_0000_0001_scanner_surface | Docs Guild · Scanner Guild | docs/modules/scanner | Surface doc refresh | Surface doc refresh | DOEN0103 | +| ENG-0027 | TODO | | SPRINT_0136_0000_0001_scanner_surface | Docs Guild · Scanner Guild | docs/modules/scanner | Policy/offline integration doc | Policy/offline integration doc | DOEN0103 | | ENGINE-20-002 | BLOCKED | 2025-10-26 | SPRINT_124_policy_reasoning | Docs Guild · Policy Guild | src/Policy/StellaOps.Policy.Engine | Need ADR references | Need ADR references | DOPE0101 | | ENGINE-20-003 | TODO | | SPRINT_124_policy_reasoning | Docs Guild · Policy Guild · Concelier & Excititor Guilds | src/Policy/StellaOps.Policy.Engine | Depends on #1 | POLICY-ENGINE-20-002 | DOPE0101 | | ENGINE-20-004 | TODO | | SPRINT_124_policy_reasoning | Docs Guild · Storage Guild | src/Policy/StellaOps.Policy.Engine | Needs storage notes | POLICY-ENGINE-20-003 | DOPE0101 | @@ -867,32 +867,32 @@ | ENGINE-27-002 | TODO | | SPRINT_124_policy_reasoning | Policy + Observability Guilds / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | POLICY-ENGINE-27-001 | POLICY-ENGINE-27-001 | DOPE0103 | | ENGINE-29-001 | TODO | | SPRINT_124_policy_reasoning | Policy Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | POLICY-ENGINE-27-004 | POLICY-ENGINE-27-004 | DOPE0103 | | ENGINE-29-002 | TODO | | SPRINT_124_policy_reasoning | Policy + Findings Ledger Guilds / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | POLICY-ENGINE-29-001 | POLICY-ENGINE-29-001 | DOPE0103 | -| ENGINE-29-003 | TODO | | SPRINT_125_policy_reasoning | Policy + SBOM Service Guilds / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | POLICY-ENGINE-29-002 | POLICY-ENGINE-29-002 | DOPE0103 | -| ENGINE-29-004 | TODO | | SPRINT_125_policy_reasoning | Policy + Observability Guilds / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | POLICY-ENGINE-29-003 | POLICY-ENGINE-29-003 | DOPE0103 | -| ENGINE-30-001 | TODO | | SPRINT_125_policy_reasoning | Policy + Cartographer Guilds / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | POLICY-ENGINE-29-004 | POLICY-ENGINE-29-004 | DOPE0103 | -| ENGINE-30-002 | TODO | | SPRINT_125_policy_reasoning | Policy + Cartographer Guilds / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | POLICY-ENGINE-30-001 | POLICY-ENGINE-30-001 | DOPE0103 | -| ENGINE-30-003 | TODO | | SPRINT_125_policy_reasoning | Policy + Scheduler Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | POLICY-ENGINE-30-002 | POLICY-ENGINE-30-002 | DOPE0103 | -| ENGINE-30-101 | TODO | | SPRINT_125_policy_reasoning | Policy Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | POLICY-ENGINE-30-003 | POLICY-ENGINE-30-003 | DOPE0103 | -| ENGINE-31-001 | TODO | | SPRINT_125_policy_reasoning | Policy Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | POLICY-ENGINE-30-101 | POLICY-ENGINE-30-101 | DOPE0104 | -| ENGINE-31-002 | TODO | | SPRINT_125_policy_reasoning | Policy Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | POLICY-ENGINE-31-001 | POLICY-ENGINE-31-001 | DOPE0104 | -| ENGINE-32-101 | TODO | | SPRINT_125_policy_reasoning | Policy Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | POLICY-ENGINE-31-002 | POLICY-ENGINE-31-002 | DOPE0104 | -| ENGINE-33-101 | TODO | | SPRINT_125_policy_reasoning | Policy Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | POLICY-ENGINE-32-101 | POLICY-ENGINE-32-101 | DOPE0104 | -| ENGINE-34-101 | TODO | | SPRINT_125_policy_reasoning | Policy Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | POLICY-ENGINE-33-101 | POLICY-ENGINE-33-101 | DOPE0104 | -| ENGINE-35-201 | TODO | | SPRINT_125_policy_reasoning | Policy Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | POLICY-ENGINE-34-101 | POLICY-ENGINE-34-101 | DOPE0104 | -| ENGINE-38-201 | TODO | | SPRINT_125_policy_reasoning | Policy Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | POLICY-ENGINE-35-201 | POLICY-ENGINE-35-201 | DOPE0104 | -| ENGINE-40-001 | TODO | | SPRINT_125_policy_reasoning | Policy + Concelier Guilds / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | POLICY-ENGINE-38-201 | POLICY-ENGINE-38-201 | DOPE0104 | -| ENGINE-40-002 | TODO | | SPRINT_125_policy_reasoning | Policy + Excititor Guilds / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | POLICY-ENGINE-40-001 | POLICY-ENGINE-40-001 | DOPE0104 | -| ENGINE-40-003 | TODO | | SPRINT_126_policy_reasoning | Policy + Web Scanner Guilds / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | POLICY-ENGINE-40-002 | POLICY-ENGINE-40-002 | DOPE0104 | +| ENGINE-29-003 | TODO | | SPRINT_0125_0000_0001_policy_reasoning | Policy + SBOM Service Guilds / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | POLICY-ENGINE-29-002 | POLICY-ENGINE-29-002 | DOPE0103 | +| ENGINE-29-004 | TODO | | SPRINT_0125_0000_0001_policy_reasoning | Policy + Observability Guilds / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | POLICY-ENGINE-29-003 | POLICY-ENGINE-29-003 | DOPE0103 | +| ENGINE-30-001 | TODO | | SPRINT_0125_0000_0001_policy_reasoning | Policy + Cartographer Guilds / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | POLICY-ENGINE-29-004 | POLICY-ENGINE-29-004 | DOPE0103 | +| ENGINE-30-002 | TODO | | SPRINT_0125_0000_0001_policy_reasoning | Policy + Cartographer Guilds / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | POLICY-ENGINE-30-001 | POLICY-ENGINE-30-001 | DOPE0103 | +| ENGINE-30-003 | TODO | | SPRINT_0125_0000_0001_policy_reasoning | Policy + Scheduler Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | POLICY-ENGINE-30-002 | POLICY-ENGINE-30-002 | DOPE0103 | +| ENGINE-30-101 | TODO | | SPRINT_0125_0000_0001_policy_reasoning | Policy Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | POLICY-ENGINE-30-003 | POLICY-ENGINE-30-003 | DOPE0103 | +| ENGINE-31-001 | TODO | | SPRINT_0125_0000_0001_policy_reasoning | Policy Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | POLICY-ENGINE-30-101 | POLICY-ENGINE-30-101 | DOPE0104 | +| ENGINE-31-002 | TODO | | SPRINT_0125_0000_0001_policy_reasoning | Policy Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | POLICY-ENGINE-31-001 | POLICY-ENGINE-31-001 | DOPE0104 | +| ENGINE-32-101 | TODO | | SPRINT_0125_0000_0001_policy_reasoning | Policy Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | POLICY-ENGINE-31-002 | POLICY-ENGINE-31-002 | DOPE0104 | +| ENGINE-33-101 | TODO | | SPRINT_0125_0000_0001_policy_reasoning | Policy Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | POLICY-ENGINE-32-101 | POLICY-ENGINE-32-101 | DOPE0104 | +| ENGINE-34-101 | TODO | | SPRINT_0125_0000_0001_policy_reasoning | Policy Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | POLICY-ENGINE-33-101 | POLICY-ENGINE-33-101 | DOPE0104 | +| ENGINE-35-201 | TODO | | SPRINT_0125_0000_0001_policy_reasoning | Policy Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | POLICY-ENGINE-34-101 | POLICY-ENGINE-34-101 | DOPE0104 | +| ENGINE-38-201 | TODO | | SPRINT_0125_0000_0001_policy_reasoning | Policy Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | POLICY-ENGINE-35-201 | POLICY-ENGINE-35-201 | DOPE0104 | +| ENGINE-40-001 | TODO | | SPRINT_0125_0000_0001_policy_reasoning | Policy + Concelier Guilds / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | POLICY-ENGINE-38-201 | POLICY-ENGINE-38-201 | DOPE0104 | +| ENGINE-40-002 | TODO | | SPRINT_0125_0000_0001_policy_reasoning | Policy + Excititor Guilds / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | POLICY-ENGINE-40-001 | POLICY-ENGINE-40-001 | DOPE0104 | +| ENGINE-40-003 | TODO | | SPRINT_0126_0000_0001_policy_reasoning | Policy + Web Scanner Guilds / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | POLICY-ENGINE-40-002 | POLICY-ENGINE-40-002 | DOPE0104 | | ENGINE-401-003 | TODO | | SPRINT_0401_0001_0001_reachability_evidence_chain | Policy Guild (`src/Policy/StellaOps.Policy.Engine`, `docs/modules/policy/architecture.md`) | `src/Policy/StellaOps.Policy.Engine`, `docs/modules/policy/architecture.md` | Reachability/forensics appendix referencing DORC0101. | — | DOPE0105 | -| ENGINE-50-001 | TODO | | SPRINT_126_policy_reasoning | Policy + Platform Security / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | POLICY-ENGINE-40-003 | POLICY-ENGINE-40-003 | DOPE0105 | -| ENGINE-50-002 | TODO | | SPRINT_126_policy_reasoning | Policy + Runtime Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | POLICY-ENGINE-50-001 | POLICY-ENGINE-50-001 | DOPE0105 | -| ENGINE-50-003 | TODO | | SPRINT_126_policy_reasoning | Policy + Observability Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | POLICY-ENGINE-50-002 | POLICY-ENGINE-50-002 | DOPE0105 | -| ENGINE-50-004 | TODO | | SPRINT_126_policy_reasoning | Policy + Platform Events Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | POLICY-ENGINE-50-003 | POLICY-ENGINE-50-003 | DOPE0105 | -| ENGINE-50-005 | TODO | | SPRINT_126_policy_reasoning | Policy + Storage Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | POLICY-ENGINE-50-004 | POLICY-ENGINE-50-004 | DOPE0105 | -| ENGINE-50-006 | TODO | | SPRINT_126_policy_reasoning | Policy + QA Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | POLICY-ENGINE-50-005 | POLICY-ENGINE-50-005 | DOPE0105 | -| ENGINE-50-007 | TODO | | SPRINT_126_policy_reasoning | Policy + Scheduler Worker Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | POLICY-ENGINE-50-006 | POLICY-ENGINE-50-006 | DOPE0105 | -| ENGINE-60-001 | TODO | | SPRINT_126_policy_reasoning | Policy + SBOM Service Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | POLICY-ENGINE-50-007 | POLICY-ENGINE-50-007 | DOPE0105 | -| ENGINE-60-002 | TODO | | SPRINT_126_policy_reasoning | Policy + BE-Base Platform Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | POLICY-ENGINE-60-001 | POLICY-ENGINE-60-001 | DOPE0105 | +| ENGINE-50-001 | TODO | | SPRINT_0126_0000_0001_policy_reasoning | Policy + Platform Security / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | POLICY-ENGINE-40-003 | POLICY-ENGINE-40-003 | DOPE0105 | +| ENGINE-50-002 | TODO | | SPRINT_0126_0000_0001_policy_reasoning | Policy + Runtime Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | POLICY-ENGINE-50-001 | POLICY-ENGINE-50-001 | DOPE0105 | +| ENGINE-50-003 | TODO | | SPRINT_0126_0000_0001_policy_reasoning | Policy + Observability Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | POLICY-ENGINE-50-002 | POLICY-ENGINE-50-002 | DOPE0105 | +| ENGINE-50-004 | TODO | | SPRINT_0126_0000_0001_policy_reasoning | Policy + Platform Events Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | POLICY-ENGINE-50-003 | POLICY-ENGINE-50-003 | DOPE0105 | +| ENGINE-50-005 | TODO | | SPRINT_0126_0000_0001_policy_reasoning | Policy + Storage Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | POLICY-ENGINE-50-004 | POLICY-ENGINE-50-004 | DOPE0105 | +| ENGINE-50-006 | TODO | | SPRINT_0126_0000_0001_policy_reasoning | Policy + QA Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | POLICY-ENGINE-50-005 | POLICY-ENGINE-50-005 | DOPE0105 | +| ENGINE-50-007 | TODO | | SPRINT_0126_0000_0001_policy_reasoning | Policy + Scheduler Worker Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | POLICY-ENGINE-50-006 | POLICY-ENGINE-50-006 | DOPE0105 | +| ENGINE-60-001 | TODO | | SPRINT_0126_0000_0001_policy_reasoning | Policy + SBOM Service Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | POLICY-ENGINE-50-007 | POLICY-ENGINE-50-007 | DOPE0105 | +| ENGINE-60-002 | TODO | | SPRINT_0126_0000_0001_policy_reasoning | Policy + BE-Base Platform Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | POLICY-ENGINE-60-001 | POLICY-ENGINE-60-001 | DOPE0105 | | ENGINE-66-001 | DONE | 2025-11-25 | SPRINT_0129_0001_0001_policy_reasoning | Risk Engine Guild / src/RiskEngine/StellaOps.RiskEngine | src/RiskEngine/StellaOps.RiskEngine | Baseline collections + indexes doc. | — | DORG0101 | | ENGINE-66-002 | DONE | 2025-11-25 | SPRINT_0129_0001_0001_policy_reasoning | Risk Engine Guild / src/RiskEngine/StellaOps.RiskEngine | src/RiskEngine/StellaOps.RiskEngine | RISK-ENGINE-66-001 | RISK-ENGINE-66-001 | DORG0101 | | ENGINE-67-001 | DONE | 2025-11-25 | SPRINT_0129_0001_0001_policy_reasoning | Risk + Concelier Guilds / src/RiskEngine/StellaOps.RiskEngine | src/RiskEngine/StellaOps.RiskEngine | RISK-ENGINE-66-002 | RISK-ENGINE-66-002 | DORG0101 | @@ -903,38 +903,38 @@ | ENGINE-69-001 | TODO | | SPRINT_0129_0001_0001_policy_reasoning | Risk + Policy Studio Guild / src/RiskEngine/StellaOps.RiskEngine | src/RiskEngine/StellaOps.RiskEngine | RISK-ENGINE-68-002 | RISK-ENGINE-68-002 | DORG0101 | | ENGINE-69-002 | TODO | | SPRINT_0129_0001_0001_policy_reasoning | Risk + Observability Guild / src/RiskEngine/StellaOps.RiskEngine | src/RiskEngine/StellaOps.RiskEngine | RISK-ENGINE-69-001 | RISK-ENGINE-69-001 | DORG0101 | | ENGINE-70-001 | TODO | | SPRINT_0129_0001_0001_policy_reasoning | Risk + Export Guild / src/RiskEngine/StellaOps.RiskEngine | src/RiskEngine/StellaOps.RiskEngine | RISK-ENGINE-69-002 | RISK-ENGINE-69-002 | DORG0101 | -| ENGINE-70-002 | TODO | | SPRINT_126_policy_reasoning | Policy + Storage Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | POLICY-ENGINE-60-002 | POLICY-ENGINE-60-002 | DOPE0106 | -| ENGINE-70-003 | TODO | | SPRINT_126_policy_reasoning | Policy + Runtime Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | POLICY-ENGINE-70-002 | POLICY-ENGINE-70-002 | DOPE0106 | -| ENGINE-70-004 | TODO | | SPRINT_126_policy_reasoning | Policy + Observability Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | POLICY-ENGINE-70-003 | POLICY-ENGINE-70-003 | DOPE0106 | -| ENGINE-70-005 | TODO | | SPRINT_126_policy_reasoning | Policy + Scheduler Worker Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | POLICY-ENGINE-70-004 | POLICY-ENGINE-70-004 | DOPE0106 | -| ENGINE-80-001 | TODO | | SPRINT_126_policy_reasoning | Policy + Signals Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | POLICY-ENGINE-70-005 | POLICY-ENGINE-70-005 | DOPE0106 | -| ENGINE-80-002 | TODO | | SPRINT_127_policy_reasoning | Policy + Storage Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | POLICY-ENGINE-80-001 | POLICY-ENGINE-80-001 | DOPE0106 | +| ENGINE-70-002 | TODO | | SPRINT_0126_0000_0001_policy_reasoning | Policy + Storage Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | POLICY-ENGINE-60-002 | POLICY-ENGINE-60-002 | DOPE0106 | +| ENGINE-70-003 | TODO | | SPRINT_0126_0000_0001_policy_reasoning | Policy + Runtime Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | POLICY-ENGINE-70-002 | POLICY-ENGINE-70-002 | DOPE0106 | +| ENGINE-70-004 | TODO | | SPRINT_0126_0000_0001_policy_reasoning | Policy + Observability Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | POLICY-ENGINE-70-003 | POLICY-ENGINE-70-003 | DOPE0106 | +| ENGINE-70-005 | TODO | | SPRINT_0126_0000_0001_policy_reasoning | Policy + Scheduler Worker Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | POLICY-ENGINE-70-004 | POLICY-ENGINE-70-004 | DOPE0106 | +| ENGINE-80-001 | TODO | | SPRINT_0126_0000_0001_policy_reasoning | Policy + Signals Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | POLICY-ENGINE-70-005 | POLICY-ENGINE-70-005 | DOPE0106 | +| ENGINE-80-002 | TODO | | SPRINT_0127_0000_0001_policy_reasoning | Policy + Storage Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | POLICY-ENGINE-80-001 | POLICY-ENGINE-80-001 | DOPE0106 | | ENGINE-80-003 | BLOCKED (2025-11-26) | | SPRINT_0127_0001_0001_policy_reasoning | Policy + Policy Editor Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | POLICY-ENGINE-80-002 | POLICY-ENGINE-80-002 | DOPE0106 | -| ENGINE-80-004 | TODO | | SPRINT_127_policy_reasoning | Policy + Observability Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | POLICY-ENGINE-80-003 | POLICY-ENGINE-80-003 | DOPE0106 | +| ENGINE-80-004 | TODO | | SPRINT_0127_0000_0001_policy_reasoning | Policy + Observability Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | POLICY-ENGINE-80-003 | POLICY-ENGINE-80-003 | DOPE0106 | | ENGINE-DOCS-0001 | TODO | | SPRINT_0325_0001_0001_docs_modules_policy | Docs Guild (docs/modules/policy) | docs/modules/policy | Refresh module overview + governance ladder. | — | DOPE0107 | | ENGINE-ENG-0001 | TODO | | SPRINT_0325_0001_0001_docs_modules_policy | Module Team (docs/modules/policy) | docs/modules/policy | Capture engineering guidelines + acceptance tests. | — | DOPE0107 | | ENGINE-OPS-0001 | TODO | | SPRINT_0325_0001_0001_docs_modules_policy | Ops Guild (docs/modules/policy) | docs/modules/policy | Operations runbook (deploy/rollback) pointer. | — | DOPE0107 | -| ENTROPY-186-011 | TODO | | SPRINT_186_record_deterministic_execution | Scanner Guild · Provenance Guild | `src/Scanner/StellaOps.Scanner.Worker`, `src/Scanner/__Libraries` | SCANNER-ENTRYTRACE-18-508 | SCANNER-ENTRYTRACE-18-508 | SCDE0101 | -| ENTROPY-186-012 | TODO | | SPRINT_186_record_deterministic_execution | Scanner Guild · Provenance Guild | `src/Scanner/StellaOps.Scanner.WebService`, `docs/replay/DETERMINISTIC_REPLAY.md` | ENTROPY-186-011 | ENTROPY-186-011 | SCDE0102 | +| ENTROPY-186-011 | TODO | | SPRINT_0186_0000_0001_record_deterministic_execution | Scanner Guild · Provenance Guild | `src/Scanner/StellaOps.Scanner.Worker`, `src/Scanner/__Libraries` | SCANNER-ENTRYTRACE-18-508 | SCANNER-ENTRYTRACE-18-508 | SCDE0101 | +| ENTROPY-186-012 | TODO | | SPRINT_0186_0000_0001_record_deterministic_execution | Scanner Guild · Provenance Guild | `src/Scanner/StellaOps.Scanner.WebService`, `docs/replay/DETERMINISTIC_REPLAY.md` | ENTROPY-186-011 | ENTROPY-186-011 | SCDE0102 | | ENTROPY-40-001 | TODO | | SPRINT_0209_0001_0001_ui_i | UI Guild | src/UI/StellaOps.UI | ENTROPY-186-011 | ENTROPY-186-011 | UIDO0101 | | ENTROPY-40-002 | TODO | | SPRINT_0209_0001_0001_ui_i | UI Guild Policy Guild | src/UI/StellaOps.UI | ENTROPY-40-001 & ENTROPY-186-012 | ENTROPY-40-001 | UIDO0101 | | ENTROPY-70-004 | TODO | | SPRINT_0304_0001_0004_docs_tasks_md_iv | Docs Guild · Scanner Guild | docs/modules/scanner/determinism.md | ENTROPY-186-011/012 | ENTROPY-186-011/012 | DOSC0102 | -| ENTRYTRACE-18-502 | TODO | | SPRINT_135_scanner_surface | EntryTrace Guild · Scanner Surface Guild | src/Scanner/__Libraries/StellaOps.Scanner.EntryTrace | SCANNER-ENTRYTRACE-18-508 | SCANNER-ENTRYTRACE-18-508 | SCET0101 | -| ENTRYTRACE-18-503 | TODO | | SPRINT_135_scanner_surface | EntryTrace Guild · Scanner Surface Guild | src/Scanner/__Libraries/StellaOps.Scanner.EntryTrace | ENTRYTRACE-18-502 | ENTRYTRACE-18-502 | SCET0101 | -| ENTRYTRACE-18-504 | TODO | | SPRINT_136_scanner_surface | EntryTrace Guild (src/Scanner/__Libraries/StellaOps.Scanner.EntryTrace) | src/Scanner/__Libraries/StellaOps.Scanner.EntryTrace | SCANNER-ENTRYTRACE-18-503 | SCANNER-ENTRYTRACE-18-503 | SCSS0102 | -| ENTRYTRACE-18-505 | TODO | | SPRINT_136_scanner_surface | EntryTrace Guild (src/Scanner/__Libraries/StellaOps.Scanner.EntryTrace) | src/Scanner/__Libraries/StellaOps.Scanner.EntryTrace | SCANNER-ENTRYTRACE-18-504 | SCANNER-ENTRYTRACE-18-504 | SCSS0102 | -| ENTRYTRACE-18-506 | TODO | | SPRINT_136_scanner_surface | EntryTrace Guild · Scanner WebService Guild | src/Scanner/__Libraries/StellaOps.Scanner.EntryTrace | ENTRYTRACE-18-505 | ENTRYTRACE-18-505 | SCET0101 | -| ENV-01 | DONE | 2025-11-13 | SPRINT_136_scanner_surface | Scanner Guild, Zastava Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.Env) | src/Scanner/__Libraries/StellaOps.Scanner.Surface.Env | | | SCEN0101 | -| ENV-02 | DOING (2025-11-02) | 2025-11-02 | SPRINT_136_scanner_surface | Scanner Guild · Zastava Guild | src/Scanner/__Libraries/StellaOps.Scanner.Surface.Env | SURFACE-ENV-01 | SURFACE-ENV-01 | SCEN0101 | -| ENV-03 | TODO | | SPRINT_136_scanner_surface | BuildX Plugin Guild | src/Scanner/StellaOps.Scanner.Sbomer.BuildXPlugin | SCANNER-ENV-02 | SCANNER-ENV-02 | SCBX0101 | -| ENV-04 | TODO | | SPRINT_136_scanner_surface | Zastava Guild · Scanner Env Guild | src/Scanner/__Libraries/StellaOps.Scanner.Surface.Env | SURFACE-ENV-02 | SURFACE-ENV-02 | SCEN0101 | -| ENV-05 | TODO | | SPRINT_136_scanner_surface | Ops Guild · Scanner Env Guild | src/Scanner/__Libraries/StellaOps.Scanner.Surface.Env | SURFACE-ENV-03 & SURFACE-ENV-04 | SURFACE-ENV-03; SURFACE-ENV-04 | SCEN0101 | -| EVENTS-16-301 | BLOCKED (2025-10-26) | 2025-10-26 | SPRINT_136_scanner_surface | Scanner WebService Guild (`src/Scanner/StellaOps.Scanner.WebService`) | src/Scanner/StellaOps.Scanner.WebService | SCDE0102 landing | SCDE0102 landing | SCEV0101 | +| ENTRYTRACE-18-502 | TODO | | SPRINT_0135_0000_0001_scanner_surface | EntryTrace Guild · Scanner Surface Guild | src/Scanner/__Libraries/StellaOps.Scanner.EntryTrace | SCANNER-ENTRYTRACE-18-508 | SCANNER-ENTRYTRACE-18-508 | SCET0101 | +| ENTRYTRACE-18-503 | TODO | | SPRINT_0135_0000_0001_scanner_surface | EntryTrace Guild · Scanner Surface Guild | src/Scanner/__Libraries/StellaOps.Scanner.EntryTrace | ENTRYTRACE-18-502 | ENTRYTRACE-18-502 | SCET0101 | +| ENTRYTRACE-18-504 | TODO | | SPRINT_0136_0000_0001_scanner_surface | EntryTrace Guild (src/Scanner/__Libraries/StellaOps.Scanner.EntryTrace) | src/Scanner/__Libraries/StellaOps.Scanner.EntryTrace | SCANNER-ENTRYTRACE-18-503 | SCANNER-ENTRYTRACE-18-503 | SCSS0102 | +| ENTRYTRACE-18-505 | TODO | | SPRINT_0136_0000_0001_scanner_surface | EntryTrace Guild (src/Scanner/__Libraries/StellaOps.Scanner.EntryTrace) | src/Scanner/__Libraries/StellaOps.Scanner.EntryTrace | SCANNER-ENTRYTRACE-18-504 | SCANNER-ENTRYTRACE-18-504 | SCSS0102 | +| ENTRYTRACE-18-506 | TODO | | SPRINT_0136_0000_0001_scanner_surface | EntryTrace Guild · Scanner WebService Guild | src/Scanner/__Libraries/StellaOps.Scanner.EntryTrace | ENTRYTRACE-18-505 | ENTRYTRACE-18-505 | SCET0101 | +| ENV-01 | DONE | 2025-11-13 | SPRINT_0136_0000_0001_scanner_surface | Scanner Guild, Zastava Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.Env) | src/Scanner/__Libraries/StellaOps.Scanner.Surface.Env | | | SCEN0101 | +| ENV-02 | DOING (2025-11-02) | 2025-11-02 | SPRINT_0136_0000_0001_scanner_surface | Scanner Guild · Zastava Guild | src/Scanner/__Libraries/StellaOps.Scanner.Surface.Env | SURFACE-ENV-01 | SURFACE-ENV-01 | SCEN0101 | +| ENV-03 | TODO | | SPRINT_0136_0000_0001_scanner_surface | BuildX Plugin Guild | src/Scanner/StellaOps.Scanner.Sbomer.BuildXPlugin | SCANNER-ENV-02 | SCANNER-ENV-02 | SCBX0101 | +| ENV-04 | TODO | | SPRINT_0136_0000_0001_scanner_surface | Zastava Guild · Scanner Env Guild | src/Scanner/__Libraries/StellaOps.Scanner.Surface.Env | SURFACE-ENV-02 | SURFACE-ENV-02 | SCEN0101 | +| ENV-05 | TODO | | SPRINT_0136_0000_0001_scanner_surface | Ops Guild · Scanner Env Guild | src/Scanner/__Libraries/StellaOps.Scanner.Surface.Env | SURFACE-ENV-03 & SURFACE-ENV-04 | SURFACE-ENV-03; SURFACE-ENV-04 | SCEN0101 | +| EVENTS-16-301 | BLOCKED (2025-10-26) | 2025-10-26 | SPRINT_0136_0000_0001_scanner_surface | Scanner WebService Guild (`src/Scanner/StellaOps.Scanner.WebService`) | src/Scanner/StellaOps.Scanner.WebService | SCDE0102 landing | SCDE0102 landing | SCEV0101 | | EVID-CRYPTO-90-001 | TODO | | SPRINT_160_export_evidence | Evidence Locker + Security Guilds (`src/EvidenceLocker/StellaOps.EvidenceLocker`) | src/EvidenceLocker/StellaOps.EvidenceLocker | Evidence Locker + Security Guilds · `ICryptoProviderRegistry` integration | ATEL0101 contracts | EVEC0101 | | EVID-OBS-54-002 | TODO | | SPRINT_161_evidencelocker | Evidence Locker Guild (`src/EvidenceLocker/StellaOps.EvidenceLocker`) | `src/EvidenceLocker/StellaOps.EvidenceLocker` | Finalize deterministic bundle packaging + DSSE layout per `docs/modules/evidence-locker/bundle-packaging.md`, ensuring parity with portable/incident modes. | EVID-CRYPTO-90-001 | EVEC0101 | | EVID-REPLAY-187-001 | TODO | | SPRINT_160_export_evidence | Evidence Locker Guild · docs/modules/evidence-locker/architecture.md | docs/modules/evidence-locker/architecture.md | Evidence Locker Guild · docs/modules/evidence-locker/architecture.md | EVID-CRYPTO-90-001 | EVEC0101 | -| EXC-25-001 | TODO | | SPRINT_202_cli_ii | DevEx/CLI Guild (`src/Cli/StellaOps.Cli`) | src/Cli/StellaOps.Cli | DOOR0102 APIs | DOOR0102 APIs | CLEX0101 | -| EXC-25-002 | TODO | | SPRINT_202_cli_ii | DevEx/CLI Guild (`src/Cli/StellaOps.Cli`) | src/Cli/StellaOps.Cli | EXC-25-001 | EXC-25-001 | CLEX0101 | +| EXC-25-001 | TODO | | SPRINT_0202_0000_0002_cli_ii | DevEx/CLI Guild (`src/Cli/StellaOps.Cli`) | src/Cli/StellaOps.Cli | DOOR0102 APIs | DOOR0102 APIs | CLEX0101 | +| EXC-25-002 | TODO | | SPRINT_0202_0000_0002_cli_ii | DevEx/CLI Guild (`src/Cli/StellaOps.Cli`) | src/Cli/StellaOps.Cli | EXC-25-001 | EXC-25-001 | CLEX0101 | | EXC-25-003 | TODO | | SPRINT_0209_0001_0001_ui_i | UI Guild (`src/UI/StellaOps.UI`) | src/UI/StellaOps.UI | DOOR0102 APIs | DOOR0102 APIs | UIEX0101 | | EXC-25-004 | TODO | | SPRINT_0209_0001_0001_ui_i | UI Guild (`src/UI/StellaOps.UI`) | src/UI/StellaOps.UI | EXC-25-003 | EXC-25-003 | UIEX0101 | | EXC-25-005 | TODO | | SPRINT_0209_0001_0001_ui_i | UI + Accessibility Guilds (`src/UI/StellaOps.UI`) | src/UI/StellaOps.UI | EXC-25-003 | EXC-25-003 | UIEX0101 | @@ -942,52 +942,52 @@ | EXC-25-007 | TODO | | SPRINT_0304_0001_0004_docs_tasks_md_iv | Docs Guild · DevOps Guild | docs/modules/excititor | UIEX0101 console outputs | UIEX0101 console outputs | DOEX0101 | | EXCITITOR-ATTEST-73-001 | DONE | 2025-11-17 | SPRINT_0119_0001_0001_excititor_i | Excititor Guild | src/Excititor/__Libraries/StellaOps.Excititor.Core | Attestation payloads emitted with supplier identity, justification summary, and scope metadata for trust chaining. | EXCITITOR-ATTEST-01-003 | EXAT0101 | | EXCITITOR-ATTEST-73-002 | DONE | 2025-11-17 | SPRINT_0119_0001_0001_excititor_i | Excititor Guild | src/Excititor/__Libraries/StellaOps.Excititor.Core | APIs link attestation IDs back to observation/linkset/product tuples for provenance citations without derived verdicts. | EXCITITOR-ATTEST-73-001 | EXAT0101 | -| EXCITITOR-CONN-SUSE-01-003 | TODO | | SPRINT_120_excititor_ii | Excititor Guild (SUSE connector) | src/Excititor/__Libraries/StellaOps.Excititor.Connectors.SUSE.RancherVEXHub | DONE (2025-11-09) – Emit provider trust configuration (signer fingerprints, trust tier notes) into the raw provenance envelope so downstream VEX Lens/Policy components can weigh issuers. Connector must not apply weighting or consensus inside ingestion. | EXCITITOR-CONN-SUSE-01-002; EXCITITOR-POLICY-01-001 | EXCN0101 | +| EXCITITOR-CONN-SUSE-01-003 | TODO | | SPRINT_0120_0000_0002_excititor_ii | Excititor Guild (SUSE connector) | src/Excititor/__Libraries/StellaOps.Excititor.Connectors.SUSE.RancherVEXHub | DONE (2025-11-09) – Emit provider trust configuration (signer fingerprints, trust tier notes) into the raw provenance envelope so downstream VEX Lens/Policy components can weigh issuers. Connector must not apply weighting or consensus inside ingestion. | EXCITITOR-CONN-SUSE-01-002; EXCITITOR-POLICY-01-001 | EXCN0101 | | EXCITITOR-CONN-TRUST-01-001 | DONE | 2025-11-20 | SPRINT_0119_0001_0001_excititor_i | Excititor Guild · AirGap Guilds | src/Excititor/__Libraries/StellaOps.Excititor.Connectors* | Signer metadata loader/enricher wired for MSRC/Oracle/Ubuntu/OpenVEX connectors; env `STELLAOPS_CONNECTOR_SIGNER_METADATA_PATH`; docs + sample hash shipped. | CONCELIER-GRAPH-21-001; CONCELIER-GRAPH-21-002; ATTEST-PLAN-2001 | EXCN0101 | -| EXCITITOR-CONN-UBUNTU-01-003 | TODO | | SPRINT_120_excititor_ii | Excititor Guild (Ubuntu connector) | src/Excititor/__Libraries/StellaOps.Excititor.Connectors.Ubuntu.CSAF | DONE (2025-11-09) – Emit Ubuntu signing metadata (GPG fingerprints, issuer trust tier) inside raw provenance artifacts so downstream Policy/VEX Lens consumers can weigh issuers. Connector must remain aggregation-only with no inline weighting. | EXCITITOR-CONN-UBUNTU-01-002 | EXCN0101 | -| EXCITITOR-CONSOLE-23-001 | DONE (2025-11-23) | | SPRINT_120_excititor_ii | Excititor Guild · Docs Guild | src/Excititor/StellaOps.Excititor.WebService | Expose `/console/vex` endpoints returning grouped VEX statements per advisory/component with status chips, justification metadata, precedence trace pointers, and tenant-scoped filters for Console explorer. Dependencies: EXCITITOR-LNM-21-201, EXCITITOR-LNM-21-202. | DOCN0101 | EXCO0101 | -| EXCITITOR-CONSOLE-23-002 | DONE (2025-11-23) | | SPRINT_120_excititor_ii | Excititor Guild | src/Excititor/StellaOps.Excititor.WebService | Provide aggregated counts for VEX overrides (new, not_affected, revoked) powering Console dashboard + live status ticker; emit metrics for policy explain integration. Dependencies: EXCITITOR-CONSOLE-23-001, EXCITITOR-LNM-21-203. | EXCITITOR-CONSOLE-23-001 | EXCO0101 | -| EXCITITOR-CONSOLE-23-003 | DONE (2025-11-23) | | SPRINT_120_excititor_ii | Excititor Guild | src/Excititor/StellaOps.Excititor.WebService | Deliver rapid lookup endpoints of VEX by advisory/component for Console global search; ensure response includes provenance and precedence context; include caching and RBAC. Dependencies: EXCITITOR-CONSOLE-23-001. | EXCITITOR-CONSOLE-23-001 | EXCO0101 | -| EXCITITOR-CORE-AOC-19-002 | TODO | | SPRINT_120_excititor_ii | Excititor Core Guild | src/Excititor/__Libraries/StellaOps.Excititor.Core | Implement deterministic extraction of advisory IDs, component PURLs, and references into `linkset`, capturing reconciled-from metadata for traceability. | Link-Not-Merge schema | EXCA0101 | -| EXCITITOR-CORE-AOC-19-003 | TODO | | SPRINT_120_excititor_ii | Excititor Core Guild | src/Excititor/__Libraries/StellaOps.Excititor.Core | Enforce `(vendor, upstreamId, contentHash, tenant)` uniqueness, generate supersedes chains, and ensure append-only versioning of raw VEX documents. Dependencies: EXCITITOR-CORE-AOC-19-002. | EXCITITOR-CORE-AOC-19-002 | EXCA0101 | -| EXCITITOR-CORE-AOC-19-004 | TODO | | SPRINT_120_excititor_ii | Excititor Core Guild | src/Excititor/__Libraries/StellaOps.Excititor.Core | Excise consensus/merge/severity logic from Excititor ingestion paths, updating exports/tests to rely on Policy Engine materializations instead. Dependencies: EXCITITOR-CORE-AOC-19-003. | EXCITITOR-CORE-AOC-19-003 | EXCA0101 | -| EXCITITOR-CORE-AOC-19-013 | TODO | | SPRINT_120_excititor_ii | Excititor Core Guild | src/Excititor/__Libraries/StellaOps.Excititor.Core | Update Excititor smoke/e2e suites to seed tenant-aware Authority clients and ensure cross-tenant VEX ingestion is rejected. Dependencies: EXCITITOR-CORE-AOC-19-004. | EXCITITOR-CORE-AOC-19-004 | EXCA0101 | -| EXCITITOR-CRYPTO-90-001 | TODO | | SPRINT_124_excititor_vi | WebService + Security Guilds | src/Excititor/StellaOps.Excititor.WebService | Replace ad-hoc hashing/signing in connectors/exporters/OpenAPI discovery with `ICryptoProviderRegistry` implementations approved by security so evidence verification stays deterministic across crypto profiles. | ATEL0101 | EXWS0101 | +| EXCITITOR-CONN-UBUNTU-01-003 | TODO | | SPRINT_0120_0000_0002_excititor_ii | Excititor Guild (Ubuntu connector) | src/Excititor/__Libraries/StellaOps.Excititor.Connectors.Ubuntu.CSAF | DONE (2025-11-09) – Emit Ubuntu signing metadata (GPG fingerprints, issuer trust tier) inside raw provenance artifacts so downstream Policy/VEX Lens consumers can weigh issuers. Connector must remain aggregation-only with no inline weighting. | EXCITITOR-CONN-UBUNTU-01-002 | EXCN0101 | +| EXCITITOR-CONSOLE-23-001 | DONE (2025-11-23) | | SPRINT_0120_0000_0002_excititor_ii | Excititor Guild · Docs Guild | src/Excititor/StellaOps.Excititor.WebService | Expose `/console/vex` endpoints returning grouped VEX statements per advisory/component with status chips, justification metadata, precedence trace pointers, and tenant-scoped filters for Console explorer. Dependencies: EXCITITOR-LNM-21-201, EXCITITOR-LNM-21-202. | DOCN0101 | EXCO0101 | +| EXCITITOR-CONSOLE-23-002 | DONE (2025-11-23) | | SPRINT_0120_0000_0002_excititor_ii | Excititor Guild | src/Excititor/StellaOps.Excititor.WebService | Provide aggregated counts for VEX overrides (new, not_affected, revoked) powering Console dashboard + live status ticker; emit metrics for policy explain integration. Dependencies: EXCITITOR-CONSOLE-23-001, EXCITITOR-LNM-21-203. | EXCITITOR-CONSOLE-23-001 | EXCO0101 | +| EXCITITOR-CONSOLE-23-003 | DONE (2025-11-23) | | SPRINT_0120_0000_0002_excititor_ii | Excititor Guild | src/Excititor/StellaOps.Excititor.WebService | Deliver rapid lookup endpoints of VEX by advisory/component for Console global search; ensure response includes provenance and precedence context; include caching and RBAC. Dependencies: EXCITITOR-CONSOLE-23-001. | EXCITITOR-CONSOLE-23-001 | EXCO0101 | +| EXCITITOR-CORE-AOC-19-002 | TODO | | SPRINT_0120_0000_0002_excititor_ii | Excititor Core Guild | src/Excititor/__Libraries/StellaOps.Excititor.Core | Implement deterministic extraction of advisory IDs, component PURLs, and references into `linkset`, capturing reconciled-from metadata for traceability. | Link-Not-Merge schema | EXCA0101 | +| EXCITITOR-CORE-AOC-19-003 | TODO | | SPRINT_0120_0000_0002_excititor_ii | Excititor Core Guild | src/Excititor/__Libraries/StellaOps.Excititor.Core | Enforce `(vendor, upstreamId, contentHash, tenant)` uniqueness, generate supersedes chains, and ensure append-only versioning of raw VEX documents. Dependencies: EXCITITOR-CORE-AOC-19-002. | EXCITITOR-CORE-AOC-19-002 | EXCA0101 | +| EXCITITOR-CORE-AOC-19-004 | TODO | | SPRINT_0120_0000_0002_excititor_ii | Excititor Core Guild | src/Excititor/__Libraries/StellaOps.Excititor.Core | Excise consensus/merge/severity logic from Excititor ingestion paths, updating exports/tests to rely on Policy Engine materializations instead. Dependencies: EXCITITOR-CORE-AOC-19-003. | EXCITITOR-CORE-AOC-19-003 | EXCA0101 | +| EXCITITOR-CORE-AOC-19-013 | TODO | | SPRINT_0120_0000_0002_excititor_ii | Excititor Core Guild | src/Excititor/__Libraries/StellaOps.Excititor.Core | Update Excititor smoke/e2e suites to seed tenant-aware Authority clients and ensure cross-tenant VEX ingestion is rejected. Dependencies: EXCITITOR-CORE-AOC-19-004. | EXCITITOR-CORE-AOC-19-004 | EXCA0101 | +| EXCITITOR-CRYPTO-90-001 | TODO | | SPRINT_0124_0000_0006_excititor_vi | WebService + Security Guilds | src/Excititor/StellaOps.Excititor.WebService | Replace ad-hoc hashing/signing in connectors/exporters/OpenAPI discovery with `ICryptoProviderRegistry` implementations approved by security so evidence verification stays deterministic across crypto profiles. | ATEL0101 | EXWS0101 | | EXCITITOR-DOCS-0001 | DOING (2025-10-29) | 2025-10-29 | SPRINT_333_docs_modules_excititor | Docs Guild | docs/modules/excititor | See ./AGENTS.md | — | DOEX0102 | | EXCITITOR-ENG-0001 | TODO | | SPRINT_333_docs_modules_excititor | Module Team · Docs Guild | docs/modules/excititor | Update status via ./AGENTS.md workflow | DOEX0101 evidence | DOEX0102 | -| EXCITITOR-GRAPH-21-001 | TODO | 2025-10-27 | SPRINT_120_excititor_ii | Excititor Guild | src/Excititor/__Libraries/StellaOps.Excititor.Core | Provide batched VEX/advisory reference fetches keyed by graph node PURLs so UI inspector can display raw documents and justification metadata. | Link-Not-Merge schema | EXGR0101 | -| EXCITITOR-GRAPH-21-002 | TODO | 2025-10-27 | SPRINT_120_excititor_ii | Excititor Guild | src/Excititor/__Libraries/StellaOps.Excititor.Core | Ensure overlay metadata includes VEX justification summaries and document versions for Cartographer overlays; update fixtures/tests. Dependencies: EXCITITOR-GRAPH-21-001. | EXCITITOR-GRAPH-21-001 | EXGR0101 | -| EXCITITOR-GRAPH-21-005 | TODO | 2025-10-27 | SPRINT_120_excititor_ii | Excititor Guild | src/Excititor/__Libraries/StellaOps.Excititor.Storage.Mongo | Add indexes/materialized views for VEX lookups by PURL/policy to support Cartographer inspector performance; document migrations. Dependencies: EXCITITOR-GRAPH-21-002. | EXCITITOR-GRAPH-21-002 | EXGR0101 | -| EXCITITOR-GRAPH-24-101 | DONE (2025-11-25) | | SPRINT_120_excititor_ii | Excititor Guild | src/Excititor/StellaOps.Excititor.WebService | Provide endpoints delivering VEX status summaries per component/asset for Vuln Explorer integration. Dependencies: EXCITITOR-GRAPH-21-005. | EXCITITOR-GRAPH-21-002 | EXGR0101 | -| EXCITITOR-GRAPH-24-102 | DONE (2025-11-25) | | SPRINT_120_excititor_ii | Excititor Guild | src/Excititor/StellaOps.Excititor.WebService | Add batch VEX observation retrieval optimized for Graph overlays/tooltips. Dependencies: EXCITITOR-GRAPH-24-101. | EXCITITOR-GRAPH-24-101 | EXGR0101 | -| EXCITITOR-LNM-21-001 | TODO | | SPRINT_121_excititor_iii | Excititor Core Guild | src/Excititor/__Libraries/StellaOps.Excititor.Storage.Mongo | Stand up `vex_observations` and `vex_linksets` collections with shard keys, tenant guards, and migrations that retire any residual merge-era data without mutating raw content. | Link-Not-Merge schema | EXLN0101 | -| EXCITITOR-LNM-21-002 | TODO | | SPRINT_121_excititor_iii | Excititor Core Guild | src/Excititor/__Libraries/StellaOps.Excititor.Core | Capture disagreement metadata (status + justification deltas) directly inside linksets with confidence scores so downstream consumers can highlight conflicts without Excititor choosing winners. Depends on EXCITITOR-LNM-21-001. | EXCITITOR-LNM-21-001 | EXLN0101 | -| EXCITITOR-LNM-21-003 | TODO | | SPRINT_121_excititor_iii | Excititor Core + Platform Events Guild | src/Excititor/__Libraries/StellaOps.Excititor.Core | Emit `vex.linkset.updated` events and describe payload shape (observation ids, confidence, conflict summary) so Policy/Lens/UI can subscribe while Excititor stays aggregation-only. Depends on EXCITITOR-LNM-21-002. | EXCITITOR-LNM-21-002 | EXLN0101 | -| EXCITITOR-LNM-21-201 | DONE (2025-11-25) | | SPRINT_121_excititor_iii | Excititor WebService Guild | src/Excititor/StellaOps.Excititor.WebService | Ship `/vex/observations` read endpoints with filters for advisory/product/issuer, strict RBAC, and deterministic pagination (no derived verdict fields). Depends on EXCITITOR-LNM-21-003. | EXCITITOR-LNM-21-001 | EXLN0101 | -| EXCITITOR-LNM-21-202 | DONE (2025-11-25) | | SPRINT_121_excititor_iii | Excititor WebService Guild | src/Excititor/StellaOps.Excititor.WebService | Provide `/vex/linksets` + export endpoints that surface alias mappings, conflict markers, and provenance proofs exactly as stored; errors must map to `ERR_AGG_*`. Depends on EXCITITOR-LNM-21-201. | EXCITITOR-LNM-21-201 | EXLN0101 | -| EXCITITOR-LNM-21-203 | DONE (2025-11-23) | | SPRINT_121_excititor_iii | Excititor WebService Guild | src/Excititor/StellaOps.Excititor.WebService | Update OpenAPI, SDK smoke tests, and documentation to cover the new observation/linkset endpoints with realistic examples Advisory AI/Lens teams can rely on. Depends on EXCITITOR-LNM-21-202. | EXCITITOR-LNM-21-202 | EXLN0101 | -| EXCITITOR-OBS-51-001 | DONE (2025-11-23) | | SPRINT_121_excititor_iii | Excititor Core Guild · DevOps Guild | src/Excititor/__Libraries/StellaOps.Excititor.Core | Publish ingest latency, scope resolution success, conflict rate, and signature verification metrics plus SLO burn alerts so we can prove Excititor meets the AOC “evidence freshness” mission. | Wait for 046_TLTY0101 span schema | EXOB0101 | +| EXCITITOR-GRAPH-21-001 | TODO | 2025-10-27 | SPRINT_0120_0000_0002_excititor_ii | Excititor Guild | src/Excititor/__Libraries/StellaOps.Excititor.Core | Provide batched VEX/advisory reference fetches keyed by graph node PURLs so UI inspector can display raw documents and justification metadata. | Link-Not-Merge schema | EXGR0101 | +| EXCITITOR-GRAPH-21-002 | TODO | 2025-10-27 | SPRINT_0120_0000_0002_excititor_ii | Excititor Guild | src/Excititor/__Libraries/StellaOps.Excititor.Core | Ensure overlay metadata includes VEX justification summaries and document versions for Cartographer overlays; update fixtures/tests. Dependencies: EXCITITOR-GRAPH-21-001. | EXCITITOR-GRAPH-21-001 | EXGR0101 | +| EXCITITOR-GRAPH-21-005 | TODO | 2025-10-27 | SPRINT_0120_0000_0002_excititor_ii | Excititor Guild | src/Excititor/__Libraries/StellaOps.Excititor.Storage.Mongo | Add indexes/materialized views for VEX lookups by PURL/policy to support Cartographer inspector performance; document migrations. Dependencies: EXCITITOR-GRAPH-21-002. | EXCITITOR-GRAPH-21-002 | EXGR0101 | +| EXCITITOR-GRAPH-24-101 | DONE (2025-11-25) | | SPRINT_0120_0000_0002_excititor_ii | Excititor Guild | src/Excititor/StellaOps.Excititor.WebService | Provide endpoints delivering VEX status summaries per component/asset for Vuln Explorer integration. Dependencies: EXCITITOR-GRAPH-21-005. | EXCITITOR-GRAPH-21-002 | EXGR0101 | +| EXCITITOR-GRAPH-24-102 | DONE (2025-11-25) | | SPRINT_0120_0000_0002_excititor_ii | Excititor Guild | src/Excititor/StellaOps.Excititor.WebService | Add batch VEX observation retrieval optimized for Graph overlays/tooltips. Dependencies: EXCITITOR-GRAPH-24-101. | EXCITITOR-GRAPH-24-101 | EXGR0101 | +| EXCITITOR-LNM-21-001 | TODO | | SPRINT_0121_0000_0003_excititor_iii | Excititor Core Guild | src/Excititor/__Libraries/StellaOps.Excititor.Storage.Mongo | Stand up `vex_observations` and `vex_linksets` collections with shard keys, tenant guards, and migrations that retire any residual merge-era data without mutating raw content. | Link-Not-Merge schema | EXLN0101 | +| EXCITITOR-LNM-21-002 | TODO | | SPRINT_0121_0000_0003_excititor_iii | Excititor Core Guild | src/Excititor/__Libraries/StellaOps.Excititor.Core | Capture disagreement metadata (status + justification deltas) directly inside linksets with confidence scores so downstream consumers can highlight conflicts without Excititor choosing winners. Depends on EXCITITOR-LNM-21-001. | EXCITITOR-LNM-21-001 | EXLN0101 | +| EXCITITOR-LNM-21-003 | TODO | | SPRINT_0121_0000_0003_excititor_iii | Excititor Core + Platform Events Guild | src/Excititor/__Libraries/StellaOps.Excititor.Core | Emit `vex.linkset.updated` events and describe payload shape (observation ids, confidence, conflict summary) so Policy/Lens/UI can subscribe while Excititor stays aggregation-only. Depends on EXCITITOR-LNM-21-002. | EXCITITOR-LNM-21-002 | EXLN0101 | +| EXCITITOR-LNM-21-201 | DONE (2025-11-25) | | SPRINT_0121_0000_0003_excititor_iii | Excititor WebService Guild | src/Excititor/StellaOps.Excititor.WebService | Ship `/vex/observations` read endpoints with filters for advisory/product/issuer, strict RBAC, and deterministic pagination (no derived verdict fields). Depends on EXCITITOR-LNM-21-003. | EXCITITOR-LNM-21-001 | EXLN0101 | +| EXCITITOR-LNM-21-202 | DONE (2025-11-25) | | SPRINT_0121_0000_0003_excititor_iii | Excititor WebService Guild | src/Excititor/StellaOps.Excititor.WebService | Provide `/vex/linksets` + export endpoints that surface alias mappings, conflict markers, and provenance proofs exactly as stored; errors must map to `ERR_AGG_*`. Depends on EXCITITOR-LNM-21-201. | EXCITITOR-LNM-21-201 | EXLN0101 | +| EXCITITOR-LNM-21-203 | DONE (2025-11-23) | | SPRINT_0121_0000_0003_excititor_iii | Excititor WebService Guild | src/Excititor/StellaOps.Excititor.WebService | Update OpenAPI, SDK smoke tests, and documentation to cover the new observation/linkset endpoints with realistic examples Advisory AI/Lens teams can rely on. Depends on EXCITITOR-LNM-21-202. | EXCITITOR-LNM-21-202 | EXLN0101 | +| EXCITITOR-OBS-51-001 | DONE (2025-11-23) | | SPRINT_0121_0000_0003_excititor_iii | Excititor Core Guild · DevOps Guild | src/Excititor/__Libraries/StellaOps.Excititor.Core | Publish ingest latency, scope resolution success, conflict rate, and signature verification metrics plus SLO burn alerts so we can prove Excititor meets the AOC “evidence freshness” mission. | Wait for 046_TLTY0101 span schema | EXOB0101 | | EXCITITOR-OBS-52-001 | DONE (2025-11-24) | | SPRINT_0119_0001_0006_excititor_vi | Excititor Core Guild | src/Excititor/__Libraries/StellaOps.Excititor.Core | Emit `timeline_event` entries for every ingest/linkset change with trace IDs, justification summaries, and evidence hashes so downstream systems can replay the raw facts chronologically. Depends on EXCITITOR-OBS-51-001. | Needs #1 merged for correlation IDs | EXOB0101 | -| EXCITITOR-OBS-53-001 | TODO | | SPRINT_122_excititor_iv | Excititor Core Guild · Evidence Locker Guild | src/Excititor/__Libraries/StellaOps.Excititor.Core | Build locker payloads (raw doc, normalization diff, provenance) and Merkle manifests so sealed-mode sites can audit evidence without Excititor reinterpreting it. Depends on EXCITITOR-OBS-52-001. | Blocked on Evidence Locker DSSE hooks (002_ATEL0101) | EXOB0101 | -| EXCITITOR-OBS-54-001 | TODO | | SPRINT_122_excititor_iv | Excititor Core Guild · Provenance Guild | src/Excititor/__Libraries/StellaOps.Excititor.Core | Attach DSSE attestations to every evidence batch, verify chains via Provenance tooling, and surface attestation IDs on timeline events. Depends on EXCITITOR-OBS-53-001. | Requires provenance schema from 005_ATLN0101 | EXOB0101 | +| EXCITITOR-OBS-53-001 | TODO | | SPRINT_0122_0000_0004_excititor_iv | Excititor Core Guild · Evidence Locker Guild | src/Excititor/__Libraries/StellaOps.Excititor.Core | Build locker payloads (raw doc, normalization diff, provenance) and Merkle manifests so sealed-mode sites can audit evidence without Excititor reinterpreting it. Depends on EXCITITOR-OBS-52-001. | Blocked on Evidence Locker DSSE hooks (002_ATEL0101) | EXOB0101 | +| EXCITITOR-OBS-54-001 | TODO | | SPRINT_0122_0000_0004_excititor_iv | Excititor Core Guild · Provenance Guild | src/Excititor/__Libraries/StellaOps.Excititor.Core | Attach DSSE attestations to every evidence batch, verify chains via Provenance tooling, and surface attestation IDs on timeline events. Depends on EXCITITOR-OBS-53-001. | Requires provenance schema from 005_ATLN0101 | EXOB0101 | | EXCITITOR-OPS-0001 | TODO | | SPRINT_333_docs_modules_excititor | Ops Guild · Docs Guild | docs/modules/excititor | Sync outcomes back to ../.. | DOEX0101 runbooks | DOEX0102 | -| EXCITITOR-ORCH-32-001 | TODO | | SPRINT_122_excititor_iv | Excititor Worker Guild (`src/Excititor/StellaOps.Excititor.Worker`) | src/Excititor/StellaOps.Excititor.Worker | Adopt the orchestrator worker SDK for Excititor jobs, emitting heartbeats/progress/artifact hashes so ingestion remains deterministic and restartable without reprocessing evidence. | DOOR0102 APIs | EXWS0101 | -| EXCITITOR-ORCH-33-001 | TODO | | SPRINT_122_excititor_iv | Excititor Worker Guild (`src/Excititor/StellaOps.Excititor.Worker`) | src/Excititor/StellaOps.Excititor.Worker | Honor orchestrator pause/throttle/retry commands, persist checkpoints, and classify error outputs to keep ingestion safe under outages. Depends on EXCITITOR-ORCH-32-001. | EXCITITOR-ORCH-32-001 | EXWS0101 | -| EXCITITOR-POLICY-20-001 | TODO | | SPRINT_122_excititor_iv | WebService Guild | src/Excititor/StellaOps.Excititor.WebService | Provide VEX lookup APIs (PURL/advisory batching, scope filters, tenant enforcement) that Policy Engine uses to join evidence without Excititor performing any verdict logic. Depends on EXCITITOR-AOC-20-004. | DOLN0101 | EXWS0101 | -| EXCITITOR-POLICY-20-002 | TODO | | SPRINT_122_excititor_iv | Excititor Core Guild (src/Excititor/__Libraries/StellaOps.Excititor.Core) | src/Excititor/__Libraries/StellaOps.Excititor.Core | Enhance linksets with scope resolution + version range metadata so Policy/Reachability can reason about applicability while Excititor continues to report only raw context. Depends on EXCITITOR-POLICY-20-001. | | EXWK0101 | -| EXCITITOR-RISK-66-001 | TODO | | SPRINT_122_excititor_iv | Excititor Core Guild · Risk Engine Guild (`src/Excititor/__Libraries/StellaOps.Excititor.Core`) | src/Excititor/__Libraries/StellaOps.Excititor.Core | Publish risk-engine ready feeds (status, justification, provenance) with zero derived severity so gating services can reference Excititor as a source of truth. Depends on EXCITITOR-POLICY-20-002. | CONCELIER-GRAPH-21-001/002 | EXRS0101 | +| EXCITITOR-ORCH-32-001 | TODO | | SPRINT_0122_0000_0004_excititor_iv | Excititor Worker Guild (`src/Excititor/StellaOps.Excititor.Worker`) | src/Excititor/StellaOps.Excititor.Worker | Adopt the orchestrator worker SDK for Excititor jobs, emitting heartbeats/progress/artifact hashes so ingestion remains deterministic and restartable without reprocessing evidence. | DOOR0102 APIs | EXWS0101 | +| EXCITITOR-ORCH-33-001 | TODO | | SPRINT_0122_0000_0004_excititor_iv | Excititor Worker Guild (`src/Excititor/StellaOps.Excititor.Worker`) | src/Excititor/StellaOps.Excititor.Worker | Honor orchestrator pause/throttle/retry commands, persist checkpoints, and classify error outputs to keep ingestion safe under outages. Depends on EXCITITOR-ORCH-32-001. | EXCITITOR-ORCH-32-001 | EXWS0101 | +| EXCITITOR-POLICY-20-001 | TODO | | SPRINT_0122_0000_0004_excititor_iv | WebService Guild | src/Excititor/StellaOps.Excititor.WebService | Provide VEX lookup APIs (PURL/advisory batching, scope filters, tenant enforcement) that Policy Engine uses to join evidence without Excititor performing any verdict logic. Depends on EXCITITOR-AOC-20-004. | DOLN0101 | EXWS0101 | +| EXCITITOR-POLICY-20-002 | TODO | | SPRINT_0122_0000_0004_excititor_iv | Excititor Core Guild (src/Excititor/__Libraries/StellaOps.Excititor.Core) | src/Excititor/__Libraries/StellaOps.Excititor.Core | Enhance linksets with scope resolution + version range metadata so Policy/Reachability can reason about applicability while Excititor continues to report only raw context. Depends on EXCITITOR-POLICY-20-001. | | EXWK0101 | +| EXCITITOR-RISK-66-001 | TODO | | SPRINT_0122_0000_0004_excititor_iv | Excititor Core Guild · Risk Engine Guild (`src/Excititor/__Libraries/StellaOps.Excititor.Core`) | src/Excititor/__Libraries/StellaOps.Excititor.Core | Publish risk-engine ready feeds (status, justification, provenance) with zero derived severity so gating services can reference Excititor as a source of truth. Depends on EXCITITOR-POLICY-20-002. | CONCELIER-GRAPH-21-001/002 | EXRS0101 | | EXCITITOR-STORE-AOC-19-001 | DONE (2025-11-25) | | SPRINT_0119_0001_0005_excititor_v | Storage Guild (`src/Excititor/__Libraries/StellaOps.Excititor.Storage.Mongo`) | src/Excititor/__Libraries/StellaOps.Excititor.Storage.Mongo | Ship Mongo JSON Schema + validator tooling (including Offline Kit instructions) so operators can prove Excititor stores only immutable evidence. | Link-Not-Merge schema | EXSM0101 | | EXCITITOR-STORE-AOC-19-002 | DONE (2025-11-25) | | SPRINT_0119_0001_0005_excititor_v | Storage + DevOps Guilds (`src/Excititor/__Libraries/StellaOps.Excititor.Storage.Mongo`) | src/Excititor/__Libraries/StellaOps.Excititor.Storage.Mongo | Create unique indexes, run migrations/backfills, and document rollback steps for the new schema validator. Depends on EXCITITOR-STORE-AOC-19-001. | EXCITITOR-STORE-AOC-19-001 | EXSM0101 | | EXCITITOR-VEXLENS-30-001 | BLOCKED (2025-11-25) | Await VEX Lens field list / examples | SPRINT_0119_0001_0005_excititor_v | Excititor WebService Guild · VEX Lens Guild | src/Excititor/StellaOps.Excititor.WebService | Ensure every observation exported to VEX Lens carries issuer hints, signature blobs, product tree snippets, and staleness metadata so the lens can compute consensus without calling back into Excititor. | — | PLVL0103 | | EXCITITOR-VULN-29-001 | BLOCKED (2025-11-23) | Waiting on advisory_key canonicalization spec | SPRINT_0119_0001_0005_excititor_v | Excititor WebService Guild (`src/Excititor/StellaOps.Excititor.WebService`) | src/Excititor/StellaOps.Excititor.WebService | Canonicalize advisory/product keys (map to `advisory_key`, capture scope metadata) while preserving original identifiers in `links[]`; run backfill + regression tests. | EXWS0101 | EXVN0101 | | EXCITITOR-VULN-29-002 | BLOCKED (2025-11-23) | Blocked on EXCITITOR-VULN-29-001 | SPRINT_0119_0001_0005_excititor_v | Excititor WebService Guild | src/Excititor/StellaOps.Excititor.WebService | Provide `/vuln/evidence/vex/{advisory_key}` returning tenant-scoped raw statements, provenance, and attestation references for Vuln Explorer evidence tabs. Depends on EXCITITOR-VULN-29-001. | EXCITITOR-VULN-29-001 | EXVN0101 | | EXCITITOR-VULN-29-004 | BLOCKED (2025-11-23) | Blocked on EXCITITOR-VULN-29-002 | SPRINT_0119_0001_0005_excititor_v | Excititor WebService + Observability Guilds | src/Excititor/StellaOps.Excititor.WebService | Add metrics/logs for normalization errors, suppression scopes, withdrawn statements, and feed them to Vuln Explorer + Advisory AI dashboards. Depends on EXCITITOR-VULN-29-002. | EXCITITOR-VULN-29-001 | EXVN0101 | -| EXCITITOR-WEB-AIRGAP-58-001 | TODO | | SPRINT_124_excititor_vi | WebService Guild · AirGap Guilds | src/Excititor/StellaOps.Excititor.WebService | Emit timeline events + audit logs for mirror bundle imports (bundle ID, scope, actor) and map sealed-mode violations to actionable remediation guidance. | EXAG0101 | EXWS0101 | -| EXCITITOR-WEB-OAS-61-001 | TODO | | SPRINT_124_excititor_vi | WebService Guild | src/Excititor/StellaOps.Excititor.WebService | Implement `/.well-known/openapi` with spec version metadata plus standard error envelopes, then update controller/unit tests accordingly. | DOOR0102 | EXWS0101 | -| EXCITITOR-WEB-OAS-62-001 | TODO | | SPRINT_124_excititor_vi | WebService Guild · API Governance | src/Excititor/StellaOps.Excititor.WebService | Publish curated examples for the new evidence/attestation/timeline endpoints, emit deprecation headers for legacy routes, and align SDK docs. Depends on EXCITITOR-WEB-OAS-61-001. | EXCITITOR-WEB-OAS-61-001 | EXWS0101 | -| EXCITITOR-WEB-OBS-52-001 | TODO | | SPRINT_124_excititor_vi | Excititor WebService Guild | src/Excititor/StellaOps.Excititor.WebService | Provide SSE/WebSocket bridges for VEX timeline events with tenant filters, pagination anchors, and guardrails so downstream consoles can monitor raw evidence changes in real time. Depends on EXCITITOR-OBS-52-001. | Wait for 046_TLTY0101 span schema | EXOB0102 | -| EXCITITOR-WEB-OBS-53-001 | TODO | | SPRINT_124_excititor_vi | Excititor WebService Guild · Evidence Locker Guild | src/Excititor/StellaOps.Excititor.WebService | Expose `/evidence/vex/*` endpoints that fetch locker bundles, enforce scopes, and surface verification metadata without synthesizing verdicts. Depends on EXCITITOR-WEB-OBS-52-001. | Requires Evidence Locker DSSE API (002_ATEL0101) | EXOB0102 | -| EXCITITOR-WEB-OBS-54-001 | TODO | | SPRINT_124_excititor_vi | Excititor WebService Guild | src/Excititor/StellaOps.Excititor.WebService | Add `/attestations/vex/*` endpoints returning DSSE verification state, builder identity, and chain-of-custody links so consumers never need direct datastore access. Depends on EXCITITOR-WEB-OBS-53-001. | Dependent on provenance schema (005_ATLN0101) | EXOB0102 | +| EXCITITOR-WEB-AIRGAP-58-001 | TODO | | SPRINT_0124_0000_0006_excititor_vi | WebService Guild · AirGap Guilds | src/Excititor/StellaOps.Excititor.WebService | Emit timeline events + audit logs for mirror bundle imports (bundle ID, scope, actor) and map sealed-mode violations to actionable remediation guidance. | EXAG0101 | EXWS0101 | +| EXCITITOR-WEB-OAS-61-001 | TODO | | SPRINT_0124_0000_0006_excititor_vi | WebService Guild | src/Excititor/StellaOps.Excititor.WebService | Implement `/.well-known/openapi` with spec version metadata plus standard error envelopes, then update controller/unit tests accordingly. | DOOR0102 | EXWS0101 | +| EXCITITOR-WEB-OAS-62-001 | TODO | | SPRINT_0124_0000_0006_excititor_vi | WebService Guild · API Governance | src/Excititor/StellaOps.Excititor.WebService | Publish curated examples for the new evidence/attestation/timeline endpoints, emit deprecation headers for legacy routes, and align SDK docs. Depends on EXCITITOR-WEB-OAS-61-001. | EXCITITOR-WEB-OAS-61-001 | EXWS0101 | +| EXCITITOR-WEB-OBS-52-001 | TODO | | SPRINT_0124_0000_0006_excititor_vi | Excititor WebService Guild | src/Excititor/StellaOps.Excititor.WebService | Provide SSE/WebSocket bridges for VEX timeline events with tenant filters, pagination anchors, and guardrails so downstream consoles can monitor raw evidence changes in real time. Depends on EXCITITOR-OBS-52-001. | Wait for 046_TLTY0101 span schema | EXOB0102 | +| EXCITITOR-WEB-OBS-53-001 | TODO | | SPRINT_0124_0000_0006_excititor_vi | Excititor WebService Guild · Evidence Locker Guild | src/Excititor/StellaOps.Excititor.WebService | Expose `/evidence/vex/*` endpoints that fetch locker bundles, enforce scopes, and surface verification metadata without synthesizing verdicts. Depends on EXCITITOR-WEB-OBS-52-001. | Requires Evidence Locker DSSE API (002_ATEL0101) | EXOB0102 | +| EXCITITOR-WEB-OBS-54-001 | TODO | | SPRINT_0124_0000_0006_excititor_vi | Excititor WebService Guild | src/Excititor/StellaOps.Excititor.WebService | Add `/attestations/vex/*` endpoints returning DSSE verification state, builder identity, and chain-of-custody links so consumers never need direct datastore access. Depends on EXCITITOR-WEB-OBS-53-001. | Dependent on provenance schema (005_ATLN0101) | EXOB0102 | | EXCITOR-DOCS-0001 | DONE | 2025-11-07 | SPRINT_333_docs_modules_excititor | Docs Guild (docs/modules/excitor) | docs/modules/excitor | Validate that `docs/modules/excitor/README.md` matches the latest release notes and consensus beta notes. | | DOXR0101 | | EXCITOR-ENG-0001 | DONE | 2025-11-07 | SPRINT_333_docs_modules_excititor | Module Team (docs/modules/excitor) | docs/modules/excitor | Ensure the implementation plan sprint alignment table stays current with `SPRINT_200` updates. | | DOXR0101 | | EXCITOR-OPS-0001 | DONE | 2025-11-07 | SPRINT_333_docs_modules_excititor | Ops Guild (docs/modules/excitor) | docs/modules/excitor | Review runbooks/observability assets, adding the checklist captured in `docs/modules/excitor/mirrors.md`. | | DOXR0101 | @@ -995,8 +995,8 @@ | EXPLORER-ENG-0001 | TODO | | SPRINT_334_docs_modules_vuln_explorer | Explorer Module Team | docs/modules/vuln-explorer | DOVL0102 | DOVL0102 | DOXR0101 | | EXPLORER-OPS-0001 | TODO | | SPRINT_334_docs_modules_vuln_explorer | Ops Guild | docs/modules/vuln-explorer | Explorer Ops runbooks | Explorer Ops runbooks | DOXR0101 | | EXPORT-35-001 | TODO | | SPRINT_0121_0001_0001_policy_reasoning | Findings Ledger Guild (`src/Findings/StellaOps.Findings.Ledger`) | src/Findings/StellaOps.Findings.Ledger | PLLG010x ADRs | PLLG010x ADRs | EVFL0101 | -| EXPORT-36-001 | TODO | | SPRINT_202_cli_ii | DevEx/CLI Guild (`src/Cli/StellaOps.Cli`) | src/Cli/StellaOps.Cli | Export API spec | Export API spec | EVCL0101 | -| EXPORT-37-001 | TODO | | SPRINT_202_cli_ii | DevEx/CLI Guild (`src/Cli/StellaOps.Cli`) | src/Cli/StellaOps.Cli | EXPORT-36-001 | EXPORT-36-001 | EVCL0101 | +| EXPORT-36-001 | TODO | | SPRINT_0202_0000_0002_cli_ii | DevEx/CLI Guild (`src/Cli/StellaOps.Cli`) | src/Cli/StellaOps.Cli | Export API spec | Export API spec | EVCL0101 | +| EXPORT-37-001 | TODO | | SPRINT_0202_0000_0002_cli_ii | DevEx/CLI Guild (`src/Cli/StellaOps.Cli`) | src/Cli/StellaOps.Cli | EXPORT-36-001 | EXPORT-36-001 | EVCL0101 | | EXPORT-37-004 | TODO | | SPRINT_0304_0001_0004_docs_tasks_md_iv | Docs Guild | | DOCN0101 | DOCN0101 | EVDO0101 | | EXPORT-37-005 | TODO | | SPRINT_0304_0001_0004_docs_tasks_md_iv | Docs + Export Guilds | | EXPORT-37-004 | EXPORT-37-004 | EVDO0101 | | EXPORT-37-101 | TODO | | SPRINT_0304_0001_0004_docs_tasks_md_iv | Docs Guild | | EVCL0101 | EVCL0101 | EVDO0101 | @@ -1009,7 +1009,7 @@ | EXPORT-ATTEST-74-002 | TODO | | SPRINT_160_export_evidence | ExportCenter + Attestation Guilds | | EXPORT-ATTEST-74-001 | EXPORT-ATTEST-74-001 | EVAH0101 | | EXPORT-ATTEST-75-001 | TODO | | SPRINT_160_export_evidence | ExportCenter + CLI Guilds | | Attestation Bundle + CLI + Exporter Guilds | EXPORT-ATTEST-74-001 | EVAH0101 | | EXPORT-ATTEST-75-002 | TODO | | SPRINT_160_export_evidence | ExportCenter + CLI Guilds | | EXPORT-ATTEST-75-001 | EXPORT-ATTEST-75-001 | EVAH0101 | -| EXPORT-CONSOLE-23-001 | TODO | | SPRINT_123_policy_reasoning | Policy Guild, Scheduler Guild, Observability Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Build evidence bundle/export generator producing signed manifests, CSV/JSON replay endpoints, and trace attachments; integrate with scheduler jobs and expose progress telemetry | | EVOA0101 | +| EXPORT-CONSOLE-23-001 | TODO | | SPRINT_0123_0000_0001_policy_reasoning | Policy Guild, Scheduler Guild, Observability Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Build evidence bundle/export generator producing signed manifests, CSV/JSON replay endpoints, and trace attachments; integrate with scheduler jobs and expose progress telemetry | | EVOA0101 | | EXPORT-CRYPTO-90-001 | TODO | | SPRINT_160_export_evidence | ExportCenter + Security Guilds (`src/ExportCenter/StellaOps.ExportCenter`) | src/ExportCenter/StellaOps.ExportCenter | Exporter Service + Security Guilds | Security review | EVOA0101 | | EXPORT-OAS-61 | TODO | | SPRINT_160_export_evidence | ExportCenter + API Governance | | Exporter Service + API Governance + SDK Guilds | OAS spec finalization | EVOA0101 | | EXPORT-OAS-61-001 | TODO | | SPRINT_162_exportcenter_i | ExportCenter + API Contracts Guild | src/ExportCenter/StellaOps.ExportCenter | Update Exporter OAS covering profiles, runs, downloads, devportal exports with standard error envelope and examples. | EXPORT-OAS-61 | EVOA0101 | @@ -1033,32 +1033,32 @@ | EXPORT-SVC-35-003 | TODO | | SPRINT_163_exportcenter_ii | ExportCenter Guild | src/ExportCenter/StellaOps.ExportCenter | Deliver JSON adapters (`json:raw`, `json:policy`) with canonical normalization, redaction allowlists, compression, and manifest counts. Dependencies: EXPORT-SVC-35-002. | EXPORT-SVC-35-001 | ESVC0101 | | EXPORT-SVC-35-004 | TODO | | SPRINT_163_exportcenter_ii | ExportCenter Guild | src/ExportCenter/StellaOps.ExportCenter | Build mirror (full) adapter producing filesystem layout, indexes, manifests, and README with download-only distribution. Dependencies: EXPORT-SVC-35-003. | EXPORT-SVC-35-002 | ESVC0101 | | EXPORT-SVC-35-005 | TODO | | SPRINT_163_exportcenter_ii | ExportCenter Guild | src/ExportCenter/StellaOps.ExportCenter | Implement manifest/provenance writer and KMS signing/attestation (detached + embedded) for bundle outputs. Dependencies: EXPORT-SVC-35-004. | EXPORT-SVC-35-003 | ESVC0101 | -| EXPORT-SVC-35-006 | TODO | | SPRINT_164_exportcenter_iii | ExportCenter Guild | src/ExportCenter/StellaOps.ExportCenter | Expose Export API (profiles, runs, download, SSE updates) with audit logging, concurrency controls, and viewer/operator RBAC integration. Dependencies: EXPORT-SVC-35-005. | EXPORT-SVC-35-004 | ESVC0101 | -| EXPORT-SVC-36-001 | TODO | | SPRINT_164_exportcenter_iii | ExportCenter Guild | src/ExportCenter/StellaOps.ExportCenter | Implement Trivy DB adapter (core) with schema mappings, version flag gating, and validation harness. Dependencies: EXPORT-SVC-35-006. | ESVC0101 outputs | ESVC0102 | -| EXPORT-SVC-36-002 | TODO | | SPRINT_164_exportcenter_iii | ExportCenter Guild | src/ExportCenter/StellaOps.ExportCenter | Add Trivy Java DB variant with shared manifest entries and adapter regression tests. Dependencies: EXPORT-SVC-36-001. | EXPORT-SVC-36-001 | ESVC0102 | -| EXPORT-SVC-36-003 | TODO | | SPRINT_164_exportcenter_iii | ExportCenter Guild | src/ExportCenter/StellaOps.ExportCenter | Build OCI distribution engine (manifests, descriptors, annotations) with registry auth support and retries. Dependencies: EXPORT-SVC-36-002. | EXPORT-SVC-36-001 | ESVC0102 | -| EXPORT-SVC-36-004 | TODO | | SPRINT_164_exportcenter_iii | ExportCenter Guild | src/ExportCenter/StellaOps.ExportCenter | Extend planner/run lifecycle for distribution targets (OCI/object storage) with idempotent metadata updates and retention timestamps. Dependencies: EXPORT-SVC-36-003. | EXPORT-SVC-36-002 | ESVC0102 | -| EXPORT-SVC-37-001 | TODO | | SPRINT_164_exportcenter_iii | ExportCenter Guild | src/ExportCenter/StellaOps.ExportCenter | Implement mirror delta adapter with base manifest comparison, change set generation, and content-addressed reuse. Dependencies: EXPORT-SVC-36-004. | EXPORT-SVC-35-006 | ESVC0102 | -| EXPORT-SVC-37-002 | TODO | | SPRINT_164_exportcenter_iii | ExportCenter Guild | src/ExportCenter/StellaOps.ExportCenter | Add bundle encryption (age/AES-GCM), key wrapping via KMS, and verification tooling for encrypted outputs. Dependencies: EXPORT-SVC-37-001. | EXPORT-SVC-37-001 | ESVC0102 | -| EXPORT-SVC-37-003 | TODO | | SPRINT_164_exportcenter_iii | ExportCenter Guild | src/ExportCenter/StellaOps.ExportCenter | Implement export scheduling (cron/event), retention pruning, retry idempotency, and failure classification. Dependencies: EXPORT-SVC-37-002. | EXPORT-SVC-37-002 | ESVC0103 | -| EXPORT-SVC-37-004 | TODO | | SPRINT_164_exportcenter_iii | ExportCenter Guild | src/ExportCenter/StellaOps.ExportCenter | Provide verification API to stream manifests/hashes, compute hash+signature checks, and return attest status for CLI/UI. Dependencies: EXPORT-SVC-37-003. | EXPORT-SVC-37-003 | ESVC0103 | -| EXPORT-SVC-43-001 | TODO | | SPRINT_164_exportcenter_iii | ExportCenter Guild | src/ExportCenter/StellaOps.ExportCenter | Integrate pack run manifests/artifacts into export bundles and CLI verification flows; expose provenance links. Dependencies: EXPORT-SVC-37-004. | EXPORT-SVC-37-004 | ESVC0103 | -| EXPORT-TEN-48-001 | TODO | | SPRINT_164_exportcenter_iii | ExportCenter + Tenancy Guild | src/ExportCenter/StellaOps.ExportCenter | Prefix artifacts/manifests with tenant/project, enforce scope checks, and prevent cross-tenant exports unless explicitly whitelisted; update provenance. | EXPORT-SVC-37-004 | ESVC0103 | +| EXPORT-SVC-35-006 | TODO | | SPRINT_0164_0000_0003_exportcenter_iii | ExportCenter Guild | src/ExportCenter/StellaOps.ExportCenter | Expose Export API (profiles, runs, download, SSE updates) with audit logging, concurrency controls, and viewer/operator RBAC integration. Dependencies: EXPORT-SVC-35-005. | EXPORT-SVC-35-004 | ESVC0101 | +| EXPORT-SVC-36-001 | TODO | | SPRINT_0164_0000_0003_exportcenter_iii | ExportCenter Guild | src/ExportCenter/StellaOps.ExportCenter | Implement Trivy DB adapter (core) with schema mappings, version flag gating, and validation harness. Dependencies: EXPORT-SVC-35-006. | ESVC0101 outputs | ESVC0102 | +| EXPORT-SVC-36-002 | TODO | | SPRINT_0164_0000_0003_exportcenter_iii | ExportCenter Guild | src/ExportCenter/StellaOps.ExportCenter | Add Trivy Java DB variant with shared manifest entries and adapter regression tests. Dependencies: EXPORT-SVC-36-001. | EXPORT-SVC-36-001 | ESVC0102 | +| EXPORT-SVC-36-003 | TODO | | SPRINT_0164_0000_0003_exportcenter_iii | ExportCenter Guild | src/ExportCenter/StellaOps.ExportCenter | Build OCI distribution engine (manifests, descriptors, annotations) with registry auth support and retries. Dependencies: EXPORT-SVC-36-002. | EXPORT-SVC-36-001 | ESVC0102 | +| EXPORT-SVC-36-004 | TODO | | SPRINT_0164_0000_0003_exportcenter_iii | ExportCenter Guild | src/ExportCenter/StellaOps.ExportCenter | Extend planner/run lifecycle for distribution targets (OCI/object storage) with idempotent metadata updates and retention timestamps. Dependencies: EXPORT-SVC-36-003. | EXPORT-SVC-36-002 | ESVC0102 | +| EXPORT-SVC-37-001 | TODO | | SPRINT_0164_0000_0003_exportcenter_iii | ExportCenter Guild | src/ExportCenter/StellaOps.ExportCenter | Implement mirror delta adapter with base manifest comparison, change set generation, and content-addressed reuse. Dependencies: EXPORT-SVC-36-004. | EXPORT-SVC-35-006 | ESVC0102 | +| EXPORT-SVC-37-002 | TODO | | SPRINT_0164_0000_0003_exportcenter_iii | ExportCenter Guild | src/ExportCenter/StellaOps.ExportCenter | Add bundle encryption (age/AES-GCM), key wrapping via KMS, and verification tooling for encrypted outputs. Dependencies: EXPORT-SVC-37-001. | EXPORT-SVC-37-001 | ESVC0102 | +| EXPORT-SVC-37-003 | TODO | | SPRINT_0164_0000_0003_exportcenter_iii | ExportCenter Guild | src/ExportCenter/StellaOps.ExportCenter | Implement export scheduling (cron/event), retention pruning, retry idempotency, and failure classification. Dependencies: EXPORT-SVC-37-002. | EXPORT-SVC-37-002 | ESVC0103 | +| EXPORT-SVC-37-004 | TODO | | SPRINT_0164_0000_0003_exportcenter_iii | ExportCenter Guild | src/ExportCenter/StellaOps.ExportCenter | Provide verification API to stream manifests/hashes, compute hash+signature checks, and return attest status for CLI/UI. Dependencies: EXPORT-SVC-37-003. | EXPORT-SVC-37-003 | ESVC0103 | +| EXPORT-SVC-43-001 | TODO | | SPRINT_0164_0000_0003_exportcenter_iii | ExportCenter Guild | src/ExportCenter/StellaOps.ExportCenter | Integrate pack run manifests/artifacts into export bundles and CLI verification flows; expose provenance links. Dependencies: EXPORT-SVC-37-004. | EXPORT-SVC-37-004 | ESVC0103 | +| EXPORT-TEN-48-001 | TODO | | SPRINT_0164_0000_0003_exportcenter_iii | ExportCenter + Tenancy Guild | src/ExportCenter/StellaOps.ExportCenter | Prefix artifacts/manifests with tenant/project, enforce scope checks, and prevent cross-tenant exports unless explicitly whitelisted; update provenance. | EXPORT-SVC-37-004 | ESVC0103 | | FEEDCONN-CCCS-02-009 | TODO | | SPRINT_117_concelier_vi | Concelier Connector Guild – CCCS (src/Concelier/__Libraries/StellaOps.Concelier.Connector.Cccs) | src/Concelier/__Libraries/StellaOps.Concelier.Connector.Cccs | Emit CCCS version ranges into `advisory_observations.affected.versions[]` with provenance anchors (`cccs:{serial}:{index}`) and normalized comparison keys per the Link-Not-Merge schema/doc recipes. Depends on CONCELIER-LNM-21-001. | — | FEFC0101 | | FEEDCONN-CERTBUND-02-010 | TODO | | SPRINT_117_concelier_vi | Concelier Connector Guild – CertBund (src/Concelier/__Libraries/StellaOps.Concelier.Connector.CertBund) | src/Concelier/__Libraries/StellaOps.Concelier.Connector.CertBund | Translate CERT-Bund `product.Versions` phrases into normalized ranges + provenance identifiers (`certbund:{advisoryId}:{vendor}`) while retaining localisation notes; update mapper/tests for Link-Not-Merge. Depends on CONCELIER-LNM-21-001. | — | FEFC0101 | | FEEDCONN-CISCO-02-009 | DOING | 2025-11-08 | SPRINT_117_concelier_vi | Concelier Connector Guild – Cisco (src/Concelier/__Libraries/StellaOps.Concelier.Connector.Vndr.Cisco) | src/Concelier/__Libraries/StellaOps.Concelier.Connector.Vndr.Cisco | Emit Cisco SemVer ranges into the new observation schema with provenance IDs (`cisco:{productId}`) and deterministic comparison keys; refresh fixtures to remove merge counters. Depends on CONCELIER-LNM-21-001. | — | FEFC0101 | | FEEDCONN-ICSCISA-02-012 | BLOCKED | | SPRINT_0503_0001_0001_ops_devops_i | Concelier Feed Owners | | Overdue provenance refreshes require schedule from feed owners. | FEED-REMEDIATION-1001 | FEFC0101 | | FEEDCONN-KISA-02-008 | BLOCKED | | SPRINT_0503_0001_0001_ops_devops_i | Concelier Feed Owners | | FEED-REMEDIATION-1001 | FEED-REMEDIATION-1001 | FEFC0101 | -| FORENSICS-53-001 | TODO | | SPRINT_202_cli_ii | Forensics Guild | src/Cli/StellaOps.Cli | Replay data set | Replay data set | FONS0101 | +| FORENSICS-53-001 | TODO | | SPRINT_0202_0000_0002_cli_ii | Forensics Guild | src/Cli/StellaOps.Cli | Replay data set | Replay data set | FONS0101 | | FORENSICS-53-002 | TODO | | SPRINT_0304_0001_0004_docs_tasks_md_iv | Forensics Guild | | FORENSICS-53-001 | FORENSICS-53-001 | FONS0101 | | FORENSICS-53-003 | TODO | | SPRINT_0304_0001_0004_docs_tasks_md_iv | Forensics Guild | | FORENSICS-53-001 | FORENSICS-53-001 | FONS0101 | -| FORENSICS-54-001 | TODO | | SPRINT_202_cli_ii | Forensics Guild | src/Cli/StellaOps.Cli | FORENSICS-53 outputs | FORENSICS-53 outputs | FONS0101 | -| FORENSICS-54-002 | TODO | | SPRINT_202_cli_ii | Forensics Guild | src/Cli/StellaOps.Cli | FORENSICS-54-001 | FORENSICS-54-001 | FONS0101 | -| FS-03 | TODO | | SPRINT_136_scanner_surface | Scanner Guild | src/Scanner/__Libraries/StellaOps.Scanner.Surface.FS | SURFACE-FS-02 | SURFACE-FS-02 | SFFS0101 | -| FS-04 | TODO | | SPRINT_136_scanner_surface | Scanner Guild | src/Scanner/__Libraries/StellaOps.Scanner.Surface.FS | FS-03 | SURFACE-FS-02 | SFFS0101 | -| FS-05 | TODO | | SPRINT_136_scanner_surface | Scanner Guild · Scheduler Guild | src/Scanner/__Libraries/StellaOps.Scanner.Surface.FS | SURFACE-FS-03 | SURFACE-FS-03 | SFFS0101 | -| FS-06 | TODO | | SPRINT_136_scanner_surface | Docs Guild | src/Scanner/__Libraries/StellaOps.Scanner.Surface.FS | SURFACE-FS-02 | SURFACE-FS-02 | SFFS0101 | -| FS-07 | TODO | | SPRINT_136_scanner_surface | Scanner Guild | src/Scanner/__Libraries/StellaOps.Scanner.Surface.FS | SCANNER-SURFACE-04 | SCANNER-SURFACE-04 | SFFS0101 | +| FORENSICS-54-001 | TODO | | SPRINT_0202_0000_0002_cli_ii | Forensics Guild | src/Cli/StellaOps.Cli | FORENSICS-53 outputs | FORENSICS-53 outputs | FONS0101 | +| FORENSICS-54-002 | TODO | | SPRINT_0202_0000_0002_cli_ii | Forensics Guild | src/Cli/StellaOps.Cli | FORENSICS-54-001 | FORENSICS-54-001 | FONS0101 | +| FS-03 | TODO | | SPRINT_0136_0000_0001_scanner_surface | Scanner Guild | src/Scanner/__Libraries/StellaOps.Scanner.Surface.FS | SURFACE-FS-02 | SURFACE-FS-02 | SFFS0101 | +| FS-04 | TODO | | SPRINT_0136_0000_0001_scanner_surface | Scanner Guild | src/Scanner/__Libraries/StellaOps.Scanner.Surface.FS | FS-03 | SURFACE-FS-02 | SFFS0101 | +| FS-05 | TODO | | SPRINT_0136_0000_0001_scanner_surface | Scanner Guild · Scheduler Guild | src/Scanner/__Libraries/StellaOps.Scanner.Surface.FS | SURFACE-FS-03 | SURFACE-FS-03 | SFFS0101 | +| FS-06 | TODO | | SPRINT_0136_0000_0001_scanner_surface | Docs Guild | src/Scanner/__Libraries/StellaOps.Scanner.Surface.FS | SURFACE-FS-02 | SURFACE-FS-02 | SFFS0101 | +| FS-07 | TODO | | SPRINT_0136_0000_0001_scanner_surface | Scanner Guild | src/Scanner/__Libraries/StellaOps.Scanner.Surface.FS | SCANNER-SURFACE-04 | SCANNER-SURFACE-04 | SFFS0101 | | GAP-DOC-008 | TODO | | SPRINT_0401_0001_0001_reachability_evidence_chain | Docs Guild | `docs/reachability/function-level-evidence.md`, `docs/09_API_CLI_REFERENCE.md`, `docs/api/policy.md` | Publish the cross-module function-level evidence guide, update API/CLI references with the new `code_id` fields, and add OpenVEX/replay samples under `samples/reachability/**`. | DOAG0101 outputs | GAPG0101 | | GAP-POL-005 | TODO | | SPRINT_0401_0001_0001_reachability_evidence_chain | Policy Guild · Docs Guild | `src/Policy/StellaOps.Policy.Engine`, `docs/modules/policy/architecture.md`, `docs/reachability/function-level-evidence.md` | Ingest reachability facts into Policy Engine, expose `reachability.state/confidence` in SPL/API, enforce auto-suppress (<0.30) rules, and generate OpenVEX evidence blocks referencing graph hashes + runtime facts with policy thresholds. | GAP-DOC-008 | GAPG0101 | | GAP-REP-004 | TODO | | SPRINT_0401_0001_0001_reachability_evidence_chain | Docs Guild | `src/__Libraries/StellaOps.Replay.Core`, `docs/replay/DETERMINISTIC_REPLAY.md` | Enforce BLAKE3 hashing + CAS registration for graphs/traces before manifest writes, upgrade replay manifest v2 with analyzer versions/policy thresholds, and add deterministic tests. | GAP-DOC-008 | GAPG0101 | @@ -1072,11 +1072,11 @@ | GO-33-001 | DONE | | SPRINT_0153_0001_0003_orchestrator_iii | Worker SDK Guild | src/Orchestrator/StellaOps.Orchestrator.WorkerSdk.Go | GO-32-002 | GO-32-002 | GOSD0101 | | GO-33-002 | DONE | | SPRINT_0153_0001_0003_orchestrator_iii | Worker SDK Guild | src/Orchestrator/StellaOps.Orchestrator.WorkerSdk.Go | GO-33-001 | GO-33-001 | GOSD0101 | | GO-34-001 | DONE | | SPRINT_0153_0001_0003_orchestrator_iii | Worker SDK Guild | src/Orchestrator/StellaOps.Orchestrator.WorkerSdk.Go | GO-33-002 | GO-33-002 | GOSD0101 | -| GRAPH-21-001 | TODO | | SPRINT_136_scanner_surface | Scanner WebService Guild | src/Scanner/StellaOps.Scanner.WebService | Link-Not-Merge schema | Link-Not-Merge schema | GRSC0101 | +| GRAPH-21-001 | TODO | | SPRINT_0136_0000_0001_scanner_surface | Scanner WebService Guild | src/Scanner/StellaOps.Scanner.WebService | Link-Not-Merge schema | Link-Not-Merge schema | GRSC0101 | | GRAPH-21-002 | BLOCKED (2025-10-27) | 2025-10-27 | SPRINT_113_concelier_ii | Concelier Core Guild · Scanner Guild | src/Concelier/__Libraries/StellaOps.Concelier.Core | GRAPH-21-001 | GRAPH-21-001 | GRSC0101 | | GRAPH-21-003 | TODO | 2025-10-27 | SPRINT_0213_0001_0002_web_ii | Scanner WebService Guild | src/Web/StellaOps.Web | GRAPH-21-001 | GRAPH-21-001 | GRSC0101 | | GRAPH-21-004 | TODO | 2025-10-27 | SPRINT_0213_0001_0002_web_ii | Scanner WebService Guild | src/Web/StellaOps.Web | GRAPH-21-002 | GRAPH-21-002 | GRSC0101 | -| GRAPH-21-005 | BLOCKED (2025-10-27) | 2025-10-27 | SPRINT_120_excititor_ii | Excititor Storage Guild | src/Excititor/__Libraries/StellaOps.Excititor.Storage.Mongo | GRAPH-21-002 | GRAPH-21-002 | GRSC0101 | +| GRAPH-21-005 | BLOCKED (2025-10-27) | 2025-10-27 | SPRINT_0120_0000_0002_excititor_ii | Excititor Storage Guild | src/Excititor/__Libraries/StellaOps.Excititor.Storage.Mongo | GRAPH-21-002 | GRAPH-21-002 | GRSC0101 | | GRAPH-24-001 | TODO | | SPRINT_0209_0001_0001_ui_i | UI Guild (`src/UI/StellaOps.UI`) | src/UI/StellaOps.UI | GRSC0101 outputs | GRSC0101 outputs | GRUI0101 | | GRAPH-24-002 | TODO | | SPRINT_0209_0001_0001_ui_i | UI Guild | src/UI/StellaOps.UI | GRAPH-24-001 | GRAPH-24-001 | GRUI0101 | | GRAPH-24-003 | TODO | | SPRINT_0209_0001_0001_ui_i | UI Guild | src/UI/StellaOps.UI | GRAPH-24-001 | GRAPH-24-001 | GRUI0101 | @@ -1085,7 +1085,7 @@ | GRAPH-24-006 | TODO | | SPRINT_0209_0001_0001_ui_i | UI Guild | src/UI/StellaOps.UI | GRAPH-24-004 | GRAPH-24-004 | GRUI0101 | | GRAPH-24-007 | TODO | | SPRINT_0304_0001_0004_docs_tasks_md_iv | UI Guild | | GRAPH-24-005 | GRAPH-24-005 | GRUI0101 | | GRAPH-24-101 | TODO | | SPRINT_113_concelier_ii | UI Guild | src/Concelier/StellaOps.Concelier.WebService | GRAPH-24-001 | GRAPH-24-001 | GRUI0101 | -| GRAPH-24-102 | TODO | | SPRINT_120_excititor_ii | UI Guild | src/Excititor/StellaOps.Excititor.WebService | GRAPH-24-101 | GRAPH-24-101 | GRUI0101 | +| GRAPH-24-102 | TODO | | SPRINT_0120_0000_0002_excititor_ii | UI Guild | src/Excititor/StellaOps.Excititor.WebService | GRAPH-24-101 | GRAPH-24-101 | GRUI0101 | | GRAPH-28-102 | TODO | | SPRINT_113_concelier_ii | Concelier WebService Guild (src/Concelier/StellaOps.Concelier.WebService) | src/Concelier/StellaOps.Concelier.WebService | | | GRAPI0101 | | GRAPH-API-28-001 | DONE (2025-11-24) | 2025-11-24 | SPRINT_0207_0001_0001_graph | Graph API Guild (src/Graph/StellaOps.Graph.Api) | src/Graph/StellaOps.Graph.Api | Define OpenAPI + JSON schema for graph search/query/paths/diff/export endpoints, including cost metadata and streaming tile schema. | — | ORGR0101 | | GRAPH-API-28-002 | DONE (2025-11-25) | 2025-11-25 | SPRINT_0207_0001_0001_graph | Graph API Guild (src/Graph/StellaOps.Graph.Api) | src/Graph/StellaOps.Graph.Api | Implement `/graph/search` with multi-type index lookup, prefix/exact match, RBAC enforcement, and result ranking + caching. Dependencies: GRAPH-API-28-001. | — | ORGR0101 | @@ -1184,8 +1184,8 @@ | LNM-21-201 | TODO | | SPRINT_113_concelier_ii | CLI Guild | src/Concelier/StellaOps.Concelier.WebService | Bundle validation enhancements. | LNMC0101 outputs | LNMC0101 | | LNM-21-202 | TODO | | SPRINT_113_concelier_ii | CLI Guild | src/Concelier/StellaOps.Concelier.WebService | Policy linking improvements. | LNM-21-201 | LNMC0101 | | LNM-21-203 | TODO | | SPRINT_113_concelier_ii | CLI Guild | src/Concelier/StellaOps.Concelier.WebService | Export reporting. | LNM-21-202 | LNMC0101 | -| LNM-22-001 | TODO | | SPRINT_202_cli_ii | CLI Guild | src/Cli/StellaOps.Cli | CLI/UI shared components. | DOLN0101 | LNMC0101 | -| LNM-22-002 | TODO | | SPRINT_202_cli_ii | CLI Guild | src/Cli/StellaOps.Cli | Additional filters. | LNM-22-001 | LNMC0101 | +| LNM-22-001 | TODO | | SPRINT_0202_0000_0002_cli_ii | CLI Guild | src/Cli/StellaOps.Cli | CLI/UI shared components. | DOLN0101 | LNMC0101 | +| LNM-22-002 | TODO | | SPRINT_0202_0000_0002_cli_ii | CLI Guild | src/Cli/StellaOps.Cli | Additional filters. | LNM-22-001 | LNMC0101 | | LNM-22-003 | TODO | | SPRINT_0210_0001_0002_ui_ii | UI Guild (`src/UI/StellaOps.UI`) | src/UI/StellaOps.UI | UI ingestion view. | LNM-22-001 | LNMC0101 | | LNM-22-004 | TODO | | SPRINT_0210_0001_0002_ui_ii | UI Guild | src/UI/StellaOps.UI | UI remediation workflow. | LNM-22-003 | IMPT0101 | | LNM-22-005 | BLOCKED (2025-10-27) | 2025-10-27 | SPRINT_0305_0001_0005_docs_tasks_md_v | Docs + UI Guild | | Docs update for UI flows. | DOCS-LNM-22-004 | IMPT0101 | @@ -1201,14 +1201,14 @@ | NATIVE-401-015 | TODO | | SPRINT_0401_0001_0001_reachability_evidence_chain | Scanner Worker Guild | `src/Scanner/__Libraries/StellaOps.Scanner.Symbols.Native`, `src/Scanner/__Libraries/StellaOps.Scanner.CallGraph.Native` | Bootstrap Symbols.Native + CallGraph.Native scaffolding and coverage fixtures. | Needs replay requirements from DORR0101 | SCNA0101 | | NOTIFY-38-001 | TODO | | SPRINT_0214_0001_0001_web_iii | BE-Base Platform Guild | src/Web/StellaOps.Web | Route approval/rule APIs through Web gateway with tenant scopes. | Wait for NOTY0103 approval payload schema | NOWB0101 | | NOTIFY-39-001 | TODO | | SPRINT_0214_0001_0001_web_iii | BE-Base Platform Guild | src/Web/StellaOps.Web | Surface digest/simulation/quiet-hour controls in Web tier. | Needs correlation outputs from NOTY0105 | NOWB0101 | -| NOTIFY-40-001 | TODO | | SPRINT_202_cli_ii | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Implement escalations + ack workflows, localization previews, and channel health checks. | NOTIFY-39-001 | NOWC0101 | -| NOTIFY-AIRGAP-56-002 | DONE | | SPRINT_170_notifications_telemetry | Notifications Service Guild · DevOps Guild | src/Notify/StellaOps.Notify | Ship AirGap-ready notifier bundles (Helm overlays, secrets templates, rollout guide). | MIRROR-CRT-56-001 | NOIA0101 | -| NOTIFY-ATTEST-74-001 | DOING | | SPRINT_170_notifications_telemetry | Notifications Service Guild · Attestor Service Guild | src/Notify/StellaOps.Notify | Create attestor-driven notification templates + schema docs; publish in `/docs/notifications/templates.md`. | ATEL0101 | NOIA0101 | -| NOTIFY-ATTEST-74-002 | DOING | | SPRINT_170_notifications_telemetry | Notifications Service Guild | src/Notify/StellaOps.Notify | Wire attestor DSSE payload ingestion + Task Runner callbacks for attestation verdicts. | NOTIFY-ATTEST-74-001 | NOIA0101 | -| NOTIFY-DOC-70-001 | DONE | | SPRINT_170_notifications_telemetry | Notifications Service Guild · DevOps Guild | docs/modules/notify | Keep as reference for documentation/offline-kit parity. | NOTIFY-AIRGAP-56-002 | DONO0102 | +| NOTIFY-40-001 | TODO | | SPRINT_0202_0000_0002_cli_ii | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Implement escalations + ack workflows, localization previews, and channel health checks. | NOTIFY-39-001 | NOWC0101 | +| NOTIFY-AIRGAP-56-002 | DONE | | SPRINT_0170_0000_0001_notifications_telemetry | Notifications Service Guild · DevOps Guild | src/Notify/StellaOps.Notify | Ship AirGap-ready notifier bundles (Helm overlays, secrets templates, rollout guide). | MIRROR-CRT-56-001 | NOIA0101 | +| NOTIFY-ATTEST-74-001 | DOING | | SPRINT_0170_0000_0001_notifications_telemetry | Notifications Service Guild · Attestor Service Guild | src/Notify/StellaOps.Notify | Create attestor-driven notification templates + schema docs; publish in `/docs/notifications/templates.md`. | ATEL0101 | NOIA0101 | +| NOTIFY-ATTEST-74-002 | DOING | | SPRINT_0170_0000_0001_notifications_telemetry | Notifications Service Guild | src/Notify/StellaOps.Notify | Wire attestor DSSE payload ingestion + Task Runner callbacks for attestation verdicts. | NOTIFY-ATTEST-74-001 | NOIA0101 | +| NOTIFY-DOC-70-001 | DONE | | SPRINT_0170_0000_0001_notifications_telemetry | Notifications Service Guild · DevOps Guild | docs/modules/notify | Keep as reference for documentation/offline-kit parity. | NOTIFY-AIRGAP-56-002 | DONO0102 | | NOTIFY-DOCS-0001 | DONE | 2025-11-05 | SPRINT_0322_0001_0001_docs_modules_notify | Docs Guild | docs/modules/notify | Validate module README reflects Notifications Studio pivot and latest release notes. | NOTIFY-DOC-70-001 | DONO0102 | | NOTIFY-DOCS-0002 | TODO | 2025-11-05 | SPRINT_0322_0001_0001_docs_modules_notify | Docs Guild | docs/modules/notify | Pending NOTIFY-SVC-39-001..004 to document correlation/digests/simulation/quiet hours. | NOTIFY-SVC-39-004 | DONO0102 | -| NOTIFY-ENG-0001 | TODO | | SPRINT_0322_0001_0001_docs_modules_notify | Module Team | docs/modules/notify | Keep implementation milestones aligned with `/docs/implplan/SPRINT_171_notifier_i.md` onward. | NOTY0103 | DONO0102 | +| NOTIFY-ENG-0001 | TODO | | SPRINT_0322_0001_0001_docs_modules_notify | Module Team | docs/modules/notify | Keep implementation milestones aligned with `/docs/implplan/SPRINT_0171_0000_0001_notifier_i.md` onward. | NOTY0103 | DONO0102 | | NOTIFY-OAS-61-001 | DONE (2025-11-17) | | SPRINT_0171_0001_0001_notifier_i | Notifications Service Guild · API Governance Guild | docs/api/notifications | Update OpenAPI doc set (rule/incident endpoints) with new schemas + changelog. | NOTY0103 | NOOA0101 | | NOTIFY-OAS-61-002 | DONE (2025-11-17) | | SPRINT_0171_0001_0001_notifier_i | Notifications Service Guild · SDK Guild | docs/api/notifications | Provide SDK usage examples for rule CRUD, incident ack, and quiet hours; ensure SDK smoke tests. | NOTIFY-OAS-61-001 | NOOA0101 | | NOTIFY-OAS-62-001 | DONE (2025-11-17) | | SPRINT_0171_0001_0001_notifier_i | Notifications Service Guild · Developer Portal Guild | docs/api/notifications | Publish `/docs/api/reference/notifications` auto-generated site; integrate with portal nav. | NOTIFY-OAS-61-002 | NOOA0101 | @@ -1219,37 +1219,37 @@ | NOTIFY-RISK-66-001 | BLOCKED (2025-11-22) | | SPRINT_0171_0001_0001_notifier_i | Notifications Service Guild · Risk Engine Guild · Policy Guild | src/Notifier/StellaOps.Notifier | Policy/Risk metadata export (POLICY-RISK-40-002) not yet delivered. | POLICY-RISK-40-002 | NORR0101 | | NOTIFY-RISK-67-001 | BLOCKED (2025-11-22) | | SPRINT_0171_0001_0001_notifier_i | Notifications Service Guild · Policy Guild | src/Notifier/StellaOps.Notifier | Depends on NOTIFY-RISK-66-001. | NOTIFY-RISK-66-001 | NORR0101 | | NOTIFY-RISK-68-001 | BLOCKED (2025-11-22) | | SPRINT_0171_0001_0001_notifier_i | Notifications Service Guild · Risk Engine Guild · Policy Guild | src/Notifier/StellaOps.Notifier | Depends on NOTIFY-RISK-67-001. | NOTIFY-RISK-67-001 | NORR0101 | -| NOTIFY-SVC-37-001 | TODO | | SPRINT_172_notifier_ii | Notifications Service Guild | src/Notifier/StellaOps.Notifier | Define pack approval & policy notification contract, including OpenAPI schema, event payloads, resume token mechanics, and security guidance. | Align payload schema with PGMI0101 + ATEL0101 decisions | NOTY0103 | -| NOTIFY-SVC-37-002 | TODO | | SPRINT_172_notifier_ii | Notifications Service Guild | src/Notifier/StellaOps.Notifier | Implement secure ingestion endpoint, Mongo persistence (`pack_approvals`), idempotent writes, and audit trail for approval events. Dependencies: NOTIFY-SVC-37-001. | NOTIFY-SVC-37-001 | NOTY0103 | -| NOTIFY-SVC-37-003 | TODO | | SPRINT_172_notifier_ii | Notifications Service Guild | src/Notifier/StellaOps.Notifier | Deliver approval/policy templates, routing predicates, and channel dispatch (email/chat/webhook) with deterministic ordering plus ack gating. | NOTIFY-SVC-37-002 | NOTY0103 | -| NOTIFY-SVC-37-004 | TODO | | SPRINT_172_notifier_ii | Notifications Service Guild | src/Notifier/StellaOps.Notifier | Provide acknowledgement API, Task Runner callback client, metrics for outstanding approvals, and SLA escalations. | NOTIFY-SVC-37-003 | NOTY0103 | -| NOTIFY-SVC-38-002 | TODO | | SPRINT_172_notifier_ii | Notifications Service Guild | src/Notifier/StellaOps.Notifier | Implement channel adapters (email, chat webhook, generic webhook) with retry policies, health checks, and audit logging. | NOTIFY-SVC-37-004 | NOTY0104 | -| NOTIFY-SVC-38-003 | TODO | | SPRINT_172_notifier_ii | Notifications Service Guild | src/Notifier/StellaOps.Notifier | Deliver template service (versioned templates, localization scaffolding) and renderer with redaction allowlists, Markdown/HTML/JSON outputs, and provenance links. | NOTIFY-SVC-38-002 | NOTY0104 | -| NOTIFY-SVC-38-004 | TODO | | SPRINT_172_notifier_ii | Notifications Service Guild | src/Notifier/StellaOps.Notifier | Expose REST + WS APIs (rules CRUD, templates preview, incidents list, ack) with audit logging, RBAC checks, and live feed stream. | NOTIFY-SVC-38-003 | NOTY0104 | -| NOTIFY-SVC-39-001 | TODO | | SPRINT_172_notifier_ii | Notifications Service Guild | src/Notifier/StellaOps.Notifier | Implement correlation engine with pluggable key expressions/windows, throttler (token buckets), quiet hours/maintenance evaluator, and incident lifecycle. | NOTIFY-SVC-38-004 | NOTY0105 | -| NOTIFY-SVC-39-002 | TODO | | SPRINT_172_notifier_ii | Notifications Service Guild | src/Notifier/StellaOps.Notifier | Build digest generator (queries, formatting) with schedule runner and distribution manifests. | NOTIFY-SVC-39-001 | NOTY0105 | -| NOTIFY-SVC-39-003 | TODO | | SPRINT_172_notifier_ii | Notifications Service Guild | src/Notifier/StellaOps.Notifier | Provide simulation engine/API to dry-run rules against historical events, returning correlation explanations. | NOTIFY-SVC-39-002 | NOTY0105 | -| NOTIFY-SVC-39-004 | TODO | | SPRINT_172_notifier_ii | Notifications Service Guild | src/Notifier/StellaOps.Notifier | Integrate quiet hour calendars and throttles with audit logging plus operator overrides. | NOTIFY-SVC-39-003 | NOTY0105 | -| NOTIFY-SVC-40-001 | TODO | | SPRINT_172_notifier_ii | Notifications Service Guild | src/Notifier/StellaOps.Notifier | Implement escalations + on-call schedules, ack bridge, PagerDuty/OpsGenie adapters, and CLI/in-app inbox channels. Dependencies: NOTIFY-SVC-39-004. | NOTIFY-SVC-39-004 | NOTY0106 | -| NOTIFY-SVC-40-002 | TODO | | SPRINT_172_notifier_ii | Notifications Service Guild | src/Notifier/StellaOps.Notifier | Add summary storm breaker notifications, localization bundles, and localization fallback handling. | NOTIFY-SVC-40-001 | NOTY0106 | -| NOTIFY-SVC-40-003 | TODO | | SPRINT_172_notifier_ii | Notifications Service Guild | src/Notifier/StellaOps.Notifier | Harden security: signed ack links (KMS), webhook HMAC/IP allowlists, tenant isolation fuzz tests, HTML sanitization. | NOTIFY-SVC-40-002 | NOTY0106 | -| NOTIFY-SVC-40-004 | TODO | | SPRINT_172_notifier_ii | Notifications Service Guild | src/Notifier/StellaOps.Notifier | Finalize observability (metrics/traces for escalations, latency), dead-letter handling, chaos tests for channel outages, and retention policies. | NOTIFY-SVC-40-003 | NOTY0106 | -| NOTIFY-TEN-48-001 | TODO | | SPRINT_173_notifier_iii | Notifications Service Guild | src/Notifier/StellaOps.Notifier | Tenant-scope rules/templates/incidents, RLS on storage, tenant-prefixed channels, and inclusion of tenant context in notifications. | NOTIFY-SVC-40-004 | NOTY0107 | +| NOTIFY-SVC-37-001 | TODO | | SPRINT_0172_0000_0002_notifier_ii | Notifications Service Guild | src/Notifier/StellaOps.Notifier | Define pack approval & policy notification contract, including OpenAPI schema, event payloads, resume token mechanics, and security guidance. | Align payload schema with PGMI0101 + ATEL0101 decisions | NOTY0103 | +| NOTIFY-SVC-37-002 | TODO | | SPRINT_0172_0000_0002_notifier_ii | Notifications Service Guild | src/Notifier/StellaOps.Notifier | Implement secure ingestion endpoint, Mongo persistence (`pack_approvals`), idempotent writes, and audit trail for approval events. Dependencies: NOTIFY-SVC-37-001. | NOTIFY-SVC-37-001 | NOTY0103 | +| NOTIFY-SVC-37-003 | TODO | | SPRINT_0172_0000_0002_notifier_ii | Notifications Service Guild | src/Notifier/StellaOps.Notifier | Deliver approval/policy templates, routing predicates, and channel dispatch (email/chat/webhook) with deterministic ordering plus ack gating. | NOTIFY-SVC-37-002 | NOTY0103 | +| NOTIFY-SVC-37-004 | TODO | | SPRINT_0172_0000_0002_notifier_ii | Notifications Service Guild | src/Notifier/StellaOps.Notifier | Provide acknowledgement API, Task Runner callback client, metrics for outstanding approvals, and SLA escalations. | NOTIFY-SVC-37-003 | NOTY0103 | +| NOTIFY-SVC-38-002 | TODO | | SPRINT_0172_0000_0002_notifier_ii | Notifications Service Guild | src/Notifier/StellaOps.Notifier | Implement channel adapters (email, chat webhook, generic webhook) with retry policies, health checks, and audit logging. | NOTIFY-SVC-37-004 | NOTY0104 | +| NOTIFY-SVC-38-003 | TODO | | SPRINT_0172_0000_0002_notifier_ii | Notifications Service Guild | src/Notifier/StellaOps.Notifier | Deliver template service (versioned templates, localization scaffolding) and renderer with redaction allowlists, Markdown/HTML/JSON outputs, and provenance links. | NOTIFY-SVC-38-002 | NOTY0104 | +| NOTIFY-SVC-38-004 | TODO | | SPRINT_0172_0000_0002_notifier_ii | Notifications Service Guild | src/Notifier/StellaOps.Notifier | Expose REST + WS APIs (rules CRUD, templates preview, incidents list, ack) with audit logging, RBAC checks, and live feed stream. | NOTIFY-SVC-38-003 | NOTY0104 | +| NOTIFY-SVC-39-001 | TODO | | SPRINT_0172_0000_0002_notifier_ii | Notifications Service Guild | src/Notifier/StellaOps.Notifier | Implement correlation engine with pluggable key expressions/windows, throttler (token buckets), quiet hours/maintenance evaluator, and incident lifecycle. | NOTIFY-SVC-38-004 | NOTY0105 | +| NOTIFY-SVC-39-002 | TODO | | SPRINT_0172_0000_0002_notifier_ii | Notifications Service Guild | src/Notifier/StellaOps.Notifier | Build digest generator (queries, formatting) with schedule runner and distribution manifests. | NOTIFY-SVC-39-001 | NOTY0105 | +| NOTIFY-SVC-39-003 | TODO | | SPRINT_0172_0000_0002_notifier_ii | Notifications Service Guild | src/Notifier/StellaOps.Notifier | Provide simulation engine/API to dry-run rules against historical events, returning correlation explanations. | NOTIFY-SVC-39-002 | NOTY0105 | +| NOTIFY-SVC-39-004 | TODO | | SPRINT_0172_0000_0002_notifier_ii | Notifications Service Guild | src/Notifier/StellaOps.Notifier | Integrate quiet hour calendars and throttles with audit logging plus operator overrides. | NOTIFY-SVC-39-003 | NOTY0105 | +| NOTIFY-SVC-40-001 | TODO | | SPRINT_0172_0000_0002_notifier_ii | Notifications Service Guild | src/Notifier/StellaOps.Notifier | Implement escalations + on-call schedules, ack bridge, PagerDuty/OpsGenie adapters, and CLI/in-app inbox channels. Dependencies: NOTIFY-SVC-39-004. | NOTIFY-SVC-39-004 | NOTY0106 | +| NOTIFY-SVC-40-002 | TODO | | SPRINT_0172_0000_0002_notifier_ii | Notifications Service Guild | src/Notifier/StellaOps.Notifier | Add summary storm breaker notifications, localization bundles, and localization fallback handling. | NOTIFY-SVC-40-001 | NOTY0106 | +| NOTIFY-SVC-40-003 | TODO | | SPRINT_0172_0000_0002_notifier_ii | Notifications Service Guild | src/Notifier/StellaOps.Notifier | Harden security: signed ack links (KMS), webhook HMAC/IP allowlists, tenant isolation fuzz tests, HTML sanitization. | NOTIFY-SVC-40-002 | NOTY0106 | +| NOTIFY-SVC-40-004 | TODO | | SPRINT_0172_0000_0002_notifier_ii | Notifications Service Guild | src/Notifier/StellaOps.Notifier | Finalize observability (metrics/traces for escalations, latency), dead-letter handling, chaos tests for channel outages, and retention policies. | NOTIFY-SVC-40-003 | NOTY0106 | +| NOTIFY-TEN-48-001 | TODO | | SPRINT_0173_0000_0003_notifier_iii | Notifications Service Guild | src/Notifier/StellaOps.Notifier | Tenant-scope rules/templates/incidents, RLS on storage, tenant-prefixed channels, and inclusion of tenant context in notifications. | NOTIFY-SVC-40-004 | NOTY0107 | | OAS-61 | TODO | | SPRINT_160_export_evidence | Exporter Service + API Governance + SDK Guilds | docs/api/oas | Define platform-wide OpenAPI governance + release checklist. | PGMI0101 | DOOA0103 | -| OAS-61-001 | DOING | | SPRINT_170_notifications_telemetry | API Governance Guild | docs/api/oas | Draft spec updates + changelog text. | OAS-61 | DOOA0103 | +| OAS-61-001 | DOING | | SPRINT_0170_0000_0001_notifications_telemetry | API Governance Guild | docs/api/oas | Draft spec updates + changelog text. | OAS-61 | DOOA0103 | | OAS-61-002 | TODO | | SPRINT_114_concelier_iii | Concelier Core Guild | src/Concelier/__Libraries/StellaOps.Concelier.Core | Align Link-Not-Merge endpoints with new pagination/idempotency rules. | OAS-61 | COAS0101 | | OAS-61-003 | TODO | | SPRINT_0305_0001_0005_docs_tasks_md_v | Docs Guild · API Governance Guild | docs/api/oas | Publish `/docs/api/versioning.md` describing SemVer, deprecation headers, migration playbooks. | OAS-61 | DOOA0103 | | OAS-62 | TODO | | SPRINT_160_export_evidence | Exporter + API Gov + SDK Guilds | docs/api/oas | Document SDK/gen pipeline + offline bundle expectations. | OAS-61 | DOOA0103 | | OAS-62-001 | TODO | | SPRINT_114_concelier_iii | Concelier Core Guild · SDK Generator Guild | src/Concelier/__Libraries/StellaOps.Concelier.Core | Generate `/docs/api/reference/` data + integrate with SDK scaffolding. | OAS-61-002 | COAS0101 | -| OAS-62-002 | TODO | | SPRINT_511_api | API Contracts Guild | src/Api/StellaOps.Api.OpenApi | Add lint rules enforcing pagination, idempotency headers, naming conventions, and example coverage. | OAS-62-001 | AOAS0101 | +| OAS-62-002 | TODO | | SPRINT_0511_0000_0001_api | API Contracts Guild | src/Api/StellaOps.Api.OpenApi | Add lint rules enforcing pagination, idempotency headers, naming conventions, and example coverage. | OAS-62-001 | AOAS0101 | | OAS-63 | TODO | | SPRINT_160_export_evidence | Exporter + API Gov + SDK Guilds | docs/api/oas | Define discovery endpoint strategy + lifecycle docs. | OAS-62 | DOOA0103 | | OAS-63-001 | TODO | | SPRINT_114_concelier_iii | Concelier Core Guild · API Governance Guild | src/Concelier/__Libraries/StellaOps.Concelier.Core | Add `.well-known/openapi` metadata/discovery hints. | OAS-62-001 | COAS0101 | -| OBS-50-001 | DOING | | SPRINT_170_notifications_telemetry | Telemetry Core Guild | src/Telemetry/StellaOps.Telemetry.Core | Implement structured logging, trace propagation, and scrub policies for core services. | TLTY0101 | TLTY0102 | -| OBS-50-002 | DOING | | SPRINT_170_notifications_telemetry | Telemetry Core Guild | src/Telemetry/StellaOps.Telemetry.Core | Roll out Helm/collector bundles plus validation tests and DSSE artefacts for telemetry exporters. | OBS-50-001 | TLTY0102 | +| OBS-50-001 | DOING | | SPRINT_0170_0000_0001_notifications_telemetry | Telemetry Core Guild | src/Telemetry/StellaOps.Telemetry.Core | Implement structured logging, trace propagation, and scrub policies for core services. | TLTY0101 | TLTY0102 | +| OBS-50-002 | DOING | | SPRINT_0170_0000_0001_notifications_telemetry | Telemetry Core Guild | src/Telemetry/StellaOps.Telemetry.Core | Roll out Helm/collector bundles plus validation tests and DSSE artefacts for telemetry exporters. | OBS-50-001 | TLTY0102 | | OBS-50-003 | TODO | | SPRINT_0306_0001_0006_docs_tasks_md_vi | Docs Guild · Observability Guild | docs/observability | Publish `/docs/observability/collector-deploy.md` with telemetry baseline + offline flows. | OBS-50-001 | DOOB0102 | | OBS-50-004 | TODO | | SPRINT_0306_0001_0006_docs_tasks_md_vi | Docs Guild · Observability Guild | docs/observability | Document scrub policy/SOPs (`/docs/observability/scrub-policy.md`). | OBS-50-003 | DOOB0102 | | OBS-51-001 | TODO | | SPRINT_0503_0001_0001_ops_devops_i | Exporter Guild · AirGap Time Guild · CLI Guild | ops/devops/telemetry | Build shared SLO bus (queue depth, time-anchor drift) feeding exporter/CLI dashboards. | PROGRAM-STAFF-1001 | OBAG0101 | -| OBS-51-002 | TODO | | SPRINT_170_notifications_telemetry | Telemetry Core Guild · Observability Guild | ops/devops/telemetry | Run shadow-mode evaluators + roll metrics into collectors + alert webhooks. | OBS-51-001 | OBAG0101 | +| OBS-51-002 | TODO | | SPRINT_0170_0000_0001_notifications_telemetry | Telemetry Core Guild · Observability Guild | ops/devops/telemetry | Run shadow-mode evaluators + roll metrics into collectors + alert webhooks. | OBS-51-001 | OBAG0101 | | OBS-52-001 | TODO | | SPRINT_114_concelier_iii | Concelier Core Guild | src/Concelier/__Libraries/StellaOps.Concelier.Core | Emit ingest latency, queue depth, and AOC violation metrics with burn-rate alerts. | ATLN0101 | CNOB0103 | | OBS-52-002 | TODO | | SPRINT_160_export_evidence | Timeline Indexer Guild | src/Timeline/StellaOps.TimelineIndexer | Configure streaming pipeline (retention/backpressure) for timeline events. | OBS-52-001 | TLIX0101 | | OBS-52-003 | TODO | | SPRINT_160_export_evidence | Timeline Indexer Guild | src/Timeline/StellaOps.TimelineIndexer | Add CI validation + schema enforcement for timeline events. | OBS-52-002 | TLIX0101 | @@ -1260,7 +1260,7 @@ | OBS-54-001 | TODO | | SPRINT_114_concelier_iii | Concelier Core Guild · Provenance Guild | src/Concelier/__Libraries/StellaOps.Concelier.Core | Needs shared exporter from 1039_EXPORT-OBS-54-001 | Needs shared exporter from 1039_EXPORT-OBS-54-001 | CNOB0101 | | OBS-54-002 | TODO | | SPRINT_161_evidencelocker | Evidence Locker Guild | src/EvidenceLocker/StellaOps.EvidenceLocker | Instrument Evidence Locker ingest/publish flows with metrics/logs + alerts. | OBS-53-002 | ELOC0102 | | OBS-55-001 | TODO | | SPRINT_114_concelier_iii | Concelier Core & DevOps Guild | src/Concelier/__Libraries/StellaOps.Concelier.Core | Refresh ops automation/runbooks referencing new observability signals. | OBS-52-001 | CNOB0103 | -| OBS-56-001 | TODO | | SPRINT_174_telemetry | Telemetry Core Guild | src/Telemetry/StellaOps.Telemetry.Core | Generate signed air-gap telemetry bundles + validation tests. | OBS-50-002 | TLTY0103 | +| OBS-56-001 | TODO | | SPRINT_0174_0000_0001_telemetry | Telemetry Core Guild | src/Telemetry/StellaOps.Telemetry.Core | Generate signed air-gap telemetry bundles + validation tests. | OBS-50-002 | TLTY0103 | | OFFLINE-17-004 | BLOCKED | 2025-10-26 | SPRINT_0508_0001_0001_ops_offline_kit | Offline Kit Guild · DevOps Guild | ops/offline-kit | Repackage release-17 bundle with DSSE receipts + verification logs. | PROGRAM-STAFF-1001 | OFFK0101 | | OFFLINE-34-006 | TODO | | SPRINT_0508_0001_0001_ops_offline_kit | Offline Kit + Orchestrator Guild | ops/offline-kit | Add orchestrator automation + docs to Offline Kit release 34. | ATMI0102 | OFFK0101 | | OFFLINE-37-001 | TODO | | SPRINT_0508_0001_0001_ops_offline_kit | Offline Kit + Exporter Guild | ops/offline-kit | Ship export evidence bundle + checksum manifests for release 37. | EXPORT-MIRROR-ORCH-1501 | OFFK0101 | @@ -1298,21 +1298,21 @@ | ORCH-OBS-55-001 | BLOCKED (2025-11-19) | 2025-11-19 | SPRINT_0151_0001_0001_orchestrator_i | Orchestrator Service Guild · DevOps Guild | src/Orchestrator/StellaOps.Orchestrator | Implement incident mode hooks (sampling overrides, extended retention, additional debug spans) and automatic activation on SLO burn-rate breach; emit activation/deactivation events to timeline + Notifier. | PREP-ORCH-OBS-55-001-DEPENDS-ON-54-001-INCIDE | OROB0101 | | ORCH-SVC-32-001 | DONE (2025-11-28) | 2025-11-28 | SPRINT_0151_0001_0001_orchestrator_i | Orchestrator Service Guild | src/Orchestrator/StellaOps.Orchestrator | Bootstrap service project/config and Postgres schema/migrations for `sources`, `runs`, `jobs`, `dag_edges`, `artifacts`, `quotas`, `schedules`. | — | ORSC0101 | | ORCH-GAPS-151-016 | DOING (2025-12-01) | 2025-12-01 | SPRINT_0151_0001_0001_orchestrator_i | Orchestrator Service Guild | src/Orchestrator/StellaOps.Orchestrator | Close OR1–OR10 gaps from `31-Nov-2025 FINDINGS.md`: signed schemas + hashes, replay inputs.lock, heartbeat/lease governance, DAG validation, quotas/breakers, security bindings, ordered/backpressured fan-out, audit-bundle schema/verify script, SLO alerts, TaskRunner integrity (artifact/log hashing + DSSE linkage). | Schema/catalog refresh | | -| ORCH-SVC-32-002 | TODO | | SPRINT_152_orchestrator_ii | Orchestrator Service Guild | src/Orchestrator/StellaOps.Orchestrator | Implement scheduler DAG planner + job state machine. | ORCH-SVC-32-001 | ORSC0101 | -| ORCH-SVC-32-003 | TODO | | SPRINT_152_orchestrator_ii | Orchestrator Service Guild | src/Orchestrator/StellaOps.Orchestrator | Expose REST APIs (sources/runs/jobs) w/ validation + tenant scope. | ORCH-SVC-32-002 | ORSC0101 | -| ORCH-SVC-32-004 | TODO | | SPRINT_152_orchestrator_ii | Orchestrator Service Guild | src/Orchestrator/StellaOps.Orchestrator | Implement SSE/WS streams + metrics/health probes. | ORCH-SVC-32-003 | ORSC0101 | -| ORCH-SVC-32-005 | TODO | | SPRINT_152_orchestrator_ii | Orchestrator Service Guild | src/Orchestrator/StellaOps.Orchestrator | Deliver worker claim/heartbeat/progress endpoints w/ idempotency. | ORCH-SVC-32-004 | ORSC0101 | -| ORCH-SVC-33-001 | TODO | | SPRINT_152_orchestrator_ii | Orchestrator Service Guild | src/Orchestrator/StellaOps.Orchestrator | Enable `sources test` pipeline + scaffolding. | ORCH-SVC-32-005 | ORSC0102 | -| ORCH-SVC-33-002 | TODO | | SPRINT_152_orchestrator_ii | Orchestrator Service Guild | src/Orchestrator/StellaOps.Orchestrator | Implement adaptive rate limiter/concurrency caps/backpressure. | ORCH-SVC-33-001 | ORSC0102 | -| ORCH-SVC-33-003 | TODO | | SPRINT_152_orchestrator_ii | Orchestrator Service Guild | src/Orchestrator/StellaOps.Orchestrator | Add watermark/backfill manager + preview endpoint. | ORCH-SVC-33-002 | ORSC0102 | -| ORCH-SVC-33-004 | TODO | | SPRINT_152_orchestrator_ii | Orchestrator Service Guild | src/Orchestrator/StellaOps.Orchestrator | Deliver dead-letter store + replay APIs + error classifications. | ORCH-SVC-33-003 | ORSC0102 | -| ORCH-SVC-34-001 | TODO | | SPRINT_152_orchestrator_ii | Orchestrator Service Guild | src/Orchestrator/StellaOps.Orchestrator | Implement quota management APIs + SLO burn-rate tracking. | ORCH-SVC-33-004 | ORSC0102 | -| ORCH-SVC-34-002 | TODO | | SPRINT_152_orchestrator_ii | Orchestrator Service Guild | src/Orchestrator/StellaOps.Orchestrator | Build audit log + immutable run ledger export with signed manifests. | ORCH-SVC-34-001 | ORSC0103 | -| ORCH-SVC-34-003 | TODO | | SPRINT_152_orchestrator_ii | Orchestrator Service Guild | src/Orchestrator/StellaOps.Orchestrator | Execute perf/scale validation + autoscaling hooks. | ORCH-SVC-34-002 | ORSC0103 | -| ORCH-SVC-34-004 | TODO | | SPRINT_152_orchestrator_ii | Orchestrator Service Guild | src/Orchestrator/StellaOps.Orchestrator | Package orchestrator container, Helm overlays, offline bundle seeds, attestations. | ORCH-SVC-34-003 | ORSC0103 | -| ORCH-SVC-35-101 | TODO | | SPRINT_152_orchestrator_ii | Orchestrator Service Guild | src/Orchestrator/StellaOps.Orchestrator | Register `export` job type with quotas, telemetry, and worker contract hooks. | ORCH-SVC-34-004 | ORSC0103 | -| ORCH-SVC-36-101 | TODO | | SPRINT_152_orchestrator_ii | Orchestrator Service Guild | src/Orchestrator/StellaOps.Orchestrator | Capture export job distribution metadata + retention timestamps for dashboards + SSE payloads. | ORCH-SVC-35-101 | ORSC0104 | -| ORCH-SVC-37-101 | TODO | | SPRINT_152_orchestrator_ii | Orchestrator Service Guild | src/Orchestrator/StellaOps.Orchestrator | Enable scheduled export runs, retention pruning, failure alerting for export jobs. | ORCH-SVC-36-101 | ORSC0104 | +| ORCH-SVC-32-002 | TODO | | SPRINT_0152_0000_0002_orchestrator_ii | Orchestrator Service Guild | src/Orchestrator/StellaOps.Orchestrator | Implement scheduler DAG planner + job state machine. | ORCH-SVC-32-001 | ORSC0101 | +| ORCH-SVC-32-003 | TODO | | SPRINT_0152_0000_0002_orchestrator_ii | Orchestrator Service Guild | src/Orchestrator/StellaOps.Orchestrator | Expose REST APIs (sources/runs/jobs) w/ validation + tenant scope. | ORCH-SVC-32-002 | ORSC0101 | +| ORCH-SVC-32-004 | TODO | | SPRINT_0152_0000_0002_orchestrator_ii | Orchestrator Service Guild | src/Orchestrator/StellaOps.Orchestrator | Implement SSE/WS streams + metrics/health probes. | ORCH-SVC-32-003 | ORSC0101 | +| ORCH-SVC-32-005 | TODO | | SPRINT_0152_0000_0002_orchestrator_ii | Orchestrator Service Guild | src/Orchestrator/StellaOps.Orchestrator | Deliver worker claim/heartbeat/progress endpoints w/ idempotency. | ORCH-SVC-32-004 | ORSC0101 | +| ORCH-SVC-33-001 | TODO | | SPRINT_0152_0000_0002_orchestrator_ii | Orchestrator Service Guild | src/Orchestrator/StellaOps.Orchestrator | Enable `sources test` pipeline + scaffolding. | ORCH-SVC-32-005 | ORSC0102 | +| ORCH-SVC-33-002 | TODO | | SPRINT_0152_0000_0002_orchestrator_ii | Orchestrator Service Guild | src/Orchestrator/StellaOps.Orchestrator | Implement adaptive rate limiter/concurrency caps/backpressure. | ORCH-SVC-33-001 | ORSC0102 | +| ORCH-SVC-33-003 | TODO | | SPRINT_0152_0000_0002_orchestrator_ii | Orchestrator Service Guild | src/Orchestrator/StellaOps.Orchestrator | Add watermark/backfill manager + preview endpoint. | ORCH-SVC-33-002 | ORSC0102 | +| ORCH-SVC-33-004 | TODO | | SPRINT_0152_0000_0002_orchestrator_ii | Orchestrator Service Guild | src/Orchestrator/StellaOps.Orchestrator | Deliver dead-letter store + replay APIs + error classifications. | ORCH-SVC-33-003 | ORSC0102 | +| ORCH-SVC-34-001 | TODO | | SPRINT_0152_0000_0002_orchestrator_ii | Orchestrator Service Guild | src/Orchestrator/StellaOps.Orchestrator | Implement quota management APIs + SLO burn-rate tracking. | ORCH-SVC-33-004 | ORSC0102 | +| ORCH-SVC-34-002 | TODO | | SPRINT_0152_0000_0002_orchestrator_ii | Orchestrator Service Guild | src/Orchestrator/StellaOps.Orchestrator | Build audit log + immutable run ledger export with signed manifests. | ORCH-SVC-34-001 | ORSC0103 | +| ORCH-SVC-34-003 | TODO | | SPRINT_0152_0000_0002_orchestrator_ii | Orchestrator Service Guild | src/Orchestrator/StellaOps.Orchestrator | Execute perf/scale validation + autoscaling hooks. | ORCH-SVC-34-002 | ORSC0103 | +| ORCH-SVC-34-004 | TODO | | SPRINT_0152_0000_0002_orchestrator_ii | Orchestrator Service Guild | src/Orchestrator/StellaOps.Orchestrator | Package orchestrator container, Helm overlays, offline bundle seeds, attestations. | ORCH-SVC-34-003 | ORSC0103 | +| ORCH-SVC-35-101 | TODO | | SPRINT_0152_0000_0002_orchestrator_ii | Orchestrator Service Guild | src/Orchestrator/StellaOps.Orchestrator | Register `export` job type with quotas, telemetry, and worker contract hooks. | ORCH-SVC-34-004 | ORSC0103 | +| ORCH-SVC-36-101 | TODO | | SPRINT_0152_0000_0002_orchestrator_ii | Orchestrator Service Guild | src/Orchestrator/StellaOps.Orchestrator | Capture export job distribution metadata + retention timestamps for dashboards + SSE payloads. | ORCH-SVC-35-101 | ORSC0104 | +| ORCH-SVC-37-101 | TODO | | SPRINT_0152_0000_0002_orchestrator_ii | Orchestrator Service Guild | src/Orchestrator/StellaOps.Orchestrator | Enable scheduled export runs, retention pruning, failure alerting for export jobs. | ORCH-SVC-36-101 | ORSC0104 | | ORCH-SVC-38-101 | DOING | | SPRINT_0153_0001_0003_orchestrator_iii | Orchestrator Service Guild | src/Orchestrator/StellaOps.Orchestrator | Standardize event envelope, publish failure events to notifier bus with provenance metadata. | ORCH-SVC-37-101 | ORSC0104 | | ORCH-SVC-41-101 | TODO | | SPRINT_0153_0001_0003_orchestrator_iii | Orchestrator Service Guild | src/Orchestrator/StellaOps.Orchestrator | Register `pack-run` job type, persist metadata, wire Task Runner API. | ORCH-SVC-38-101 | ORSC0104 | | ORCH-SVC-42-101 | TODO | | SPRINT_0153_0001_0003_orchestrator_iii | Orchestrator Service Guild | src/Orchestrator/StellaOps.Orchestrator | Stream pack run logs via SSE, enforce quotas, emit notifier events. | ORCH-SVC-41-101 | ORSC0104 | @@ -1325,8 +1325,8 @@ | PACKS-REG-41-001 | DONE (2025-11-25) | 2025-11-25 | SPRINT_0154_0001_0001_packsregistry | Packs Registry Guild | src/PacksRegistry/StellaOps.PacksRegistry | Implement registry API/storage, version lifecycle, provenance export. | ORCH-SVC-42-101 | PKRG0101 | | PACKS-REG-42-001 | DONE (2025-11-25) | 2025-11-25 | SPRINT_0154_0001_0001_packsregistry | Packs Registry Guild | src/PacksRegistry/StellaOps.PacksRegistry | Add tenant allowlists, signature rotation, audit logs, Offline Kit seed support. | PACKS-REG-41-001 | PKRG0101 | | PACKS-REG-43-001 | DONE (2025-11-25) | 2025-11-25 | SPRINT_0154_0001_0001_packsregistry | Packs Registry Guild | src/PacksRegistry/StellaOps.PacksRegistry | Implement mirroring, pack signing policies, compliance dashboards, Export Center integration. | PACKS-REG-42-001 | PKRG0101 | -| PARITY-41-001 | TODO | | SPRINT_203_cli_iii | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Ensure CLI HTTP client propagates `traceparent` headers for all commands, prints correlation IDs on failure, and records trace IDs in verbose logs. | NOWB0101 | CLPR0101 | -| PARITY-41-002 | TODO | | SPRINT_203_cli_iii | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Add parity tests ensuring CLI outputs match notifier/web error formats and capture verification docs. | PARITY-41-001 | CLPR0101 | +| PARITY-41-001 | TODO | | SPRINT_0203_0000_0003_cli_iii | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Ensure CLI HTTP client propagates `traceparent` headers for all commands, prints correlation IDs on failure, and records trace IDs in verbose logs. | NOWB0101 | CLPR0101 | +| PARITY-41-002 | TODO | | SPRINT_0203_0000_0003_cli_iii | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Add parity tests ensuring CLI outputs match notifier/web error formats and capture verification docs. | PARITY-41-001 | CLPR0101 | | PLATFORM-DOCS-0001 | TODO | | SPRINT_324_docs_modules_platform | Docs Guild | docs/modules/platform | Refresh architecture/gov doc per new sprint planning rules. | execution-waves.md | DOPF0101 | | PLATFORM-ENG-0001 | TODO | | SPRINT_324_docs_modules_platform | Module Team | docs/modules/platform | Update engineering status + AGENTS workflow references. | PLATFORM-DOCS-0001 | DOPF0101 | | PLATFORM-OPS-0001 | TODO | | SPRINT_324_docs_modules_platform | Ops Guild | docs/modules/platform | Sync ops runbooks/outcomes with new platform charter. | PLATFORM-DOCS-0001 | DOPF0101 | @@ -1347,19 +1347,19 @@ | POLICY-23-001 | TODO | | SPRINT_115_concelier_iv | Concelier Core Guild (src/Concelier/__Libraries/StellaOps.Concelier.Core) | src/Concelier/__Libraries/StellaOps.Concelier.Core | Add secondary indexes/materialized views (alias, severity, confidence) for fast policy lookups. | POLICY-20-003 | CCPR0102 | | POLICY-23-002 | TODO | | SPRINT_115_concelier_iv | Concelier Core Guild, Platform Events Guild (src/Concelier/__Libraries/StellaOps.Concelier.Core) | src/Concelier/__Libraries/StellaOps.Concelier.Core | Ensure `advisory.linkset.updated` events carry idempotent IDs/confidence summaries/tenant metadata for replay. | POLICY-23-001 | CCPR0102 | | POLICY-23-003 | TODO | | SPRINT_0210_0001_0002_ui_ii | UI Guild (src/UI/StellaOps.UI) | src/UI/StellaOps.UI | | | | -| POLICY-23-004 | TODO | | SPRINT_203_cli_iii | DevEx/CLI Guild (src/Cli/StellaOps.Cli) | src/Cli/StellaOps.Cli | | | | +| POLICY-23-004 | TODO | | SPRINT_0203_0000_0003_cli_iii | DevEx/CLI Guild (src/Cli/StellaOps.Cli) | src/Cli/StellaOps.Cli | | | | | POLICY-23-005 | TODO | | SPRINT_0210_0001_0002_ui_ii | UI Guild (src/UI/StellaOps.UI) | src/UI/StellaOps.UI | | | | -| POLICY-23-006 | TODO | | SPRINT_203_cli_iii | DevEx/CLI Guild (src/Cli/StellaOps.Cli) | src/Cli/StellaOps.Cli | | | | +| POLICY-23-006 | TODO | | SPRINT_0203_0000_0003_cli_iii | DevEx/CLI Guild (src/Cli/StellaOps.Cli) | src/Cli/StellaOps.Cli | | | | | POLICY-23-007 | TODO | | SPRINT_0307_0001_0007_docs_tasks_md_vii | Docs Guild, DevEx/CLI Guild (docs) | | | | | | POLICY-23-008 | TODO | | SPRINT_0307_0001_0007_docs_tasks_md_vii | Docs Guild, Architecture Guild (docs) | | | | | | POLICY-23-009 | TODO | | SPRINT_0307_0001_0007_docs_tasks_md_vii | Docs Guild, DevOps Guild (docs) | | | | | | POLICY-23-010 | TODO | | SPRINT_0307_0001_0007_docs_tasks_md_vii | Docs Guild, UI Guild (docs) | | | | | -| POLICY-27-001 | TODO | | SPRINT_203_cli_iii | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Implement policy workspace commands (`stella policy init/edit/lint/compile/test`) with template selection, local cache, JSON output, deterministic temp dirs. | CLI-POLICY-23-006 | CLPS0101 | -| POLICY-27-002 | TODO | | SPRINT_204_cli_iv | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Add submission/review workflow commands (`version bump`, `submit`, `review comment`, `approve`, `reject`) with reviewer assignment + changelog capture. | POLICY-27-001 | CLPS0101 | -| POLICY-27-003 | TODO | | SPRINT_204_cli_iv | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Implement `stella policy simulate` enhancements (quick/batch, SBOM selectors, heatmap summaries, JSON/Markdown outputs). | POLICY-27-002 | CLPS0102 | -| POLICY-27-004 | TODO | | SPRINT_204_cli_iv | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Add publish/promote/rollback/sign commands with attestation checks and canary args. | POLICY-27-003 | CLPS0102 | -| POLICY-27-005 | TODO | | SPRINT_204_cli_iv | DevEx/CLI Guild · Docs Guild | src/Cli/StellaOps.Cli | Update CLI docs/samples for Policy Studio (JSON schemas, exit codes, CI snippets). | POLICY-27-004 | CLPS0102 | -| POLICY-27-006 | TODO | | SPRINT_204_cli_iv | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Update CLI policy scopes/help text to request new Policy Studio scopes and adjust regression tests. | POLICY-27-005 | CLPS0102 | +| POLICY-27-001 | TODO | | SPRINT_0203_0000_0003_cli_iii | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Implement policy workspace commands (`stella policy init/edit/lint/compile/test`) with template selection, local cache, JSON output, deterministic temp dirs. | CLI-POLICY-23-006 | CLPS0101 | +| POLICY-27-002 | TODO | | SPRINT_0204_0000_0004_cli_iv | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Add submission/review workflow commands (`version bump`, `submit`, `review comment`, `approve`, `reject`) with reviewer assignment + changelog capture. | POLICY-27-001 | CLPS0101 | +| POLICY-27-003 | TODO | | SPRINT_0204_0000_0004_cli_iv | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Implement `stella policy simulate` enhancements (quick/batch, SBOM selectors, heatmap summaries, JSON/Markdown outputs). | POLICY-27-002 | CLPS0102 | +| POLICY-27-004 | TODO | | SPRINT_0204_0000_0004_cli_iv | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Add publish/promote/rollback/sign commands with attestation checks and canary args. | POLICY-27-003 | CLPS0102 | +| POLICY-27-005 | TODO | | SPRINT_0204_0000_0004_cli_iv | DevEx/CLI Guild · Docs Guild | src/Cli/StellaOps.Cli | Update CLI docs/samples for Policy Studio (JSON schemas, exit codes, CI snippets). | POLICY-27-004 | CLPS0102 | +| POLICY-27-006 | TODO | | SPRINT_0204_0000_0004_cli_iv | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Update CLI policy scopes/help text to request new Policy Studio scopes and adjust regression tests. | POLICY-27-005 | CLPS0102 | | POLICY-27-007 | BLOCKED | 2025-10-27 | SPRINT_0308_0001_0008_docs_tasks_md_viii | Docs Guild, DevEx/CLI Guild (docs) | | | | | | POLICY-27-008 | BLOCKED | 2025-10-27 | SPRINT_0308_0001_0008_docs_tasks_md_viii | Docs Guild, Policy Registry Guild (docs) | | | | | | POLICY-27-009 | BLOCKED | 2025-10-27 | SPRINT_0308_0001_0008_docs_tasks_md_viii | Docs Guild, Security Guild (docs) | | | | | @@ -1369,20 +1369,20 @@ | POLICY-27-013 | BLOCKED | 2025-10-27 | SPRINT_0308_0001_0008_docs_tasks_md_viii | Docs Guild, Policy Guild (docs) | | | | | | POLICY-27-014 | BLOCKED | 2025-10-27 | SPRINT_0308_0001_0008_docs_tasks_md_viii | Docs Guild, Policy Registry Guild (docs) | | | | | | POLICY-401-026 | TODO | | SPRINT_0401_0001_0001_reachability_evidence_chain | Policy Guild · Concelier Guild (`docs/policy/dsl.md`, `docs/uncertainty/README.md`) | `docs/policy/dsl.md`, `docs/uncertainty/README.md` | | | | -| POLICY-AIRGAP-56-001 | TODO | | SPRINT_123_policy_reasoning | Policy Guild | src/Policy/StellaOps.Policy.Engine | Support policy pack imports from mirror bundles, track `bundle_id` metadata, deterministic caching. | OFFK0101 | POAI0101 | -| POLICY-AIRGAP-56-002 | TODO | | SPRINT_123_policy_reasoning | Policy Guild · Policy Studio Guild | src/Policy/StellaOps.Policy.Engine | Export policy sub-bundles with version metadata + checksums. | POLICY-AIRGAP-56-001 | POAI0101 | -| POLICY-AIRGAP-57-001 | TODO | | SPRINT_123_policy_reasoning | Policy Guild · Export Center Guild | src/Policy.StellaOps.Policy.Engine | Mirror policy pack changes into Offline Kit, produce DSSE receipts. | POLICY-AIRGAP-56-002 | POAI0101 | -| POLICY-AIRGAP-57-002 | TODO | | SPRINT_123_policy_reasoning | Policy Guild · Notifications Guild | src/Policy/StellaOps.Policy.Engine | Emit notifier events for mirror/export lifecycle. | POLICY-AIRGAP-57-001 | POAI0101 | -| POLICY-AIRGAP-58-001 | TODO | | SPRINT_123_policy_reasoning | Policy Guild · Platform Ops | docs/policy/airgap.md | Document sealed-mode policy deploy checklist + automation. | POLICY-AIRGAP-57-002 | POAI0101 | -| POLICY-AOC-19-001 | TODO | | SPRINT_123_policy_reasoning | Policy Guild / src/Policy/__Libraries/StellaOps.Policy | src/Policy/__Libraries/StellaOps.Policy | Add Roslyn/CI lint preventing ingestion projects from referencing Policy merge/severity helpers; block forbidden writes at compile time | | | -| POLICY-AOC-19-002 | TODO | | SPRINT_123_policy_reasoning | Policy Guild, Platform Security / src/Policy/__Libraries/StellaOps.Policy | src/Policy/__Libraries/StellaOps.Policy | Enforce `effective_finding_*` write gate ensuring only Policy Engine identity can create/update materializations | POLICY-AOC-19-001 | | -| POLICY-AOC-19-003 | TODO | | SPRINT_123_policy_reasoning | Policy Guild / src/Policy/__Libraries/StellaOps.Policy | src/Policy/__Libraries/StellaOps.Policy | Update readers/processors to consume only `content.raw`, `identifiers`, and `linkset`. Remove dependencies on legacy normalized fields and refresh fixtures | POLICY-AOC-19-002 | | -| POLICY-AOC-19-004 | TODO | | SPRINT_123_policy_reasoning | Policy Guild, QA Guild / src/Policy/__Libraries/StellaOps.Policy | src/Policy/__Libraries/StellaOps.Policy | Add regression tests ensuring policy derived outputs remain deterministic when ingesting revised raw docs | POLICY-AOC-19-003 | | -| POLICY-ATTEST-73-001 | TODO | | SPRINT_123_policy_reasoning | Policy Guild, Attestor Service Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Introduce VerificationPolicy object: schema, persistence, versioning, and lifecycle | | | -| POLICY-ATTEST-73-002 | TODO | | SPRINT_123_policy_reasoning | Policy Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Provide Policy Studio editor with validation, dry-run simulation, and version diff | POLICY-ATTEST-73-001 | | -| POLICY-ATTEST-74-001 | TODO | | SPRINT_123_policy_reasoning | Policy Guild, Attestor Service Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Integrate verification policies into attestor verification pipeline with caching and waiver support | POLICY-ATTEST-73-002 | | -| POLICY-ATTEST-74-002 | TODO | | SPRINT_123_policy_reasoning | Policy Guild, Console Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Surface policy evaluations in Console verification reports with rule explanations | POLICY-ATTEST-74-001 | | -| POLICY-CONSOLE-23-001 | TODO | | SPRINT_123_policy_reasoning | Policy Guild, BE-Base Platform Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Optimize findings/explain APIs for Console: cursor-based pagination at scale, global filter parameters (severity bands, policy version, time window), rule trace summarization, and aggregation hints for dashboard cards. Ensure deterministic ordering and expose provenance refs | | | +| POLICY-AIRGAP-56-001 | TODO | | SPRINT_0123_0000_0001_policy_reasoning | Policy Guild | src/Policy/StellaOps.Policy.Engine | Support policy pack imports from mirror bundles, track `bundle_id` metadata, deterministic caching. | OFFK0101 | POAI0101 | +| POLICY-AIRGAP-56-002 | TODO | | SPRINT_0123_0000_0001_policy_reasoning | Policy Guild · Policy Studio Guild | src/Policy/StellaOps.Policy.Engine | Export policy sub-bundles with version metadata + checksums. | POLICY-AIRGAP-56-001 | POAI0101 | +| POLICY-AIRGAP-57-001 | TODO | | SPRINT_0123_0000_0001_policy_reasoning | Policy Guild · Export Center Guild | src/Policy.StellaOps.Policy.Engine | Mirror policy pack changes into Offline Kit, produce DSSE receipts. | POLICY-AIRGAP-56-002 | POAI0101 | +| POLICY-AIRGAP-57-002 | TODO | | SPRINT_0123_0000_0001_policy_reasoning | Policy Guild · Notifications Guild | src/Policy/StellaOps.Policy.Engine | Emit notifier events for mirror/export lifecycle. | POLICY-AIRGAP-57-001 | POAI0101 | +| POLICY-AIRGAP-58-001 | TODO | | SPRINT_0123_0000_0001_policy_reasoning | Policy Guild · Platform Ops | docs/policy/airgap.md | Document sealed-mode policy deploy checklist + automation. | POLICY-AIRGAP-57-002 | POAI0101 | +| POLICY-AOC-19-001 | TODO | | SPRINT_0123_0000_0001_policy_reasoning | Policy Guild / src/Policy/__Libraries/StellaOps.Policy | src/Policy/__Libraries/StellaOps.Policy | Add Roslyn/CI lint preventing ingestion projects from referencing Policy merge/severity helpers; block forbidden writes at compile time | | | +| POLICY-AOC-19-002 | TODO | | SPRINT_0123_0000_0001_policy_reasoning | Policy Guild, Platform Security / src/Policy/__Libraries/StellaOps.Policy | src/Policy/__Libraries/StellaOps.Policy | Enforce `effective_finding_*` write gate ensuring only Policy Engine identity can create/update materializations | POLICY-AOC-19-001 | | +| POLICY-AOC-19-003 | TODO | | SPRINT_0123_0000_0001_policy_reasoning | Policy Guild / src/Policy/__Libraries/StellaOps.Policy | src/Policy/__Libraries/StellaOps.Policy | Update readers/processors to consume only `content.raw`, `identifiers`, and `linkset`. Remove dependencies on legacy normalized fields and refresh fixtures | POLICY-AOC-19-002 | | +| POLICY-AOC-19-004 | TODO | | SPRINT_0123_0000_0001_policy_reasoning | Policy Guild, QA Guild / src/Policy/__Libraries/StellaOps.Policy | src/Policy/__Libraries/StellaOps.Policy | Add regression tests ensuring policy derived outputs remain deterministic when ingesting revised raw docs | POLICY-AOC-19-003 | | +| POLICY-ATTEST-73-001 | TODO | | SPRINT_0123_0000_0001_policy_reasoning | Policy Guild, Attestor Service Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Introduce VerificationPolicy object: schema, persistence, versioning, and lifecycle | | | +| POLICY-ATTEST-73-002 | TODO | | SPRINT_0123_0000_0001_policy_reasoning | Policy Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Provide Policy Studio editor with validation, dry-run simulation, and version diff | POLICY-ATTEST-73-001 | | +| POLICY-ATTEST-74-001 | TODO | | SPRINT_0123_0000_0001_policy_reasoning | Policy Guild, Attestor Service Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Integrate verification policies into attestor verification pipeline with caching and waiver support | POLICY-ATTEST-73-002 | | +| POLICY-ATTEST-74-002 | TODO | | SPRINT_0123_0000_0001_policy_reasoning | Policy Guild, Console Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Surface policy evaluations in Console verification reports with rule explanations | POLICY-ATTEST-74-001 | | +| POLICY-CONSOLE-23-001 | TODO | | SPRINT_0123_0000_0001_policy_reasoning | Policy Guild, BE-Base Platform Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Optimize findings/explain APIs for Console: cursor-based pagination at scale, global filter parameters (severity bands, policy version, time window), rule trace summarization, and aggregation hints for dashboard cards. Ensure deterministic ordering and expose provenance refs | | | | POLICY-CONSOLE-23-002 | TODO | | SPRINT_124_policy_reasoning | Policy Guild, Product Ops / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Produce simulation diff metadata | POLICY-CONSOLE-23-001 | | | POLICY-DET-01 | TODO | | SPRINT_0209_0001_0001_ui_i | UI Guild, Policy Guild (src/UI/StellaOps.UI) | src/UI/StellaOps.UI | | | | | POLICY-ENGINE-20-002 | BLOCKED | 2025-10-26 | SPRINT_124_policy_reasoning | Policy Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Build deterministic evaluator honoring lexical/priority order, first-match semantics, and safe value types (no wall-clock/network access) | PGMI0101 | PLPE0101 | @@ -1397,74 +1397,74 @@ | POLICY-ENGINE-27-002 | TODO | | SPRINT_124_policy_reasoning | Policy Guild, Observability Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Enhance simulate endpoints to emit rule firing counts, heatmap aggregates, sampled explain traces with deterministic ordering, and delta summaries for quick/batch sims | POLICY-ENGINE-27-001 | PLPE0101 | | POLICY-ENGINE-29-001 | TODO | | SPRINT_124_policy_reasoning | Policy Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Implement batch evaluation endpoint | POLICY-ENGINE-27-004 | PLPE0102 | | POLICY-ENGINE-29-002 | TODO | | SPRINT_124_policy_reasoning | Policy Guild, Findings Ledger Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Provide streaming simulation API comparing two policy versions, returning per-finding deltas without writes; align determinism with Vuln Explorer simulation | POLICY-ENGINE-29-001 | PLPE0102 | -| POLICY-ENGINE-29-003 | TODO | | SPRINT_125_policy_reasoning | Policy Guild, SBOM Service Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Surface path/scope awareness in determinations | POLICY-ENGINE-29-002 | PLPE0102 | -| POLICY-ENGINE-29-004 | TODO | | SPRINT_125_policy_reasoning | Policy Guild, Observability Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Add metrics/logs for batch evaluation | POLICY-ENGINE-29-003 | PLPE0102 | -| POLICY-ENGINE-30-001 | TODO | | SPRINT_125_policy_reasoning | Policy Guild, Cartographer Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Define overlay contract for graph nodes/edges | POLICY-ENGINE-29-004 | PLPE0102 | -| POLICY-ENGINE-30-002 | TODO | | SPRINT_125_policy_reasoning | Policy Guild, Cartographer Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Implement simulation bridge returning on-the-fly overlays for Cartographer/Graph Explorer when invoking Policy Engine simulate; ensure no writes and deterministic outputs | POLICY-ENGINE-30-001 | PLPE0102 | -| POLICY-ENGINE-30-003 | TODO | | SPRINT_125_policy_reasoning | Policy Guild, Scheduler Guild, Cartographer Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Emit change events | POLICY-ENGINE-30-002 | PLPE0102 | -| POLICY-ENGINE-30-101 | TODO | | SPRINT_125_policy_reasoning | Policy Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Surface trust weighting configuration | POLICY-ENGINE-30-003 | PLPE0102 | -| POLICY-ENGINE-31-001 | TODO | | SPRINT_125_policy_reasoning | Policy Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Expose policy knobs for Advisory AI | POLICY-ENGINE-30-101 | PLPE0102 | -| POLICY-ENGINE-31-002 | TODO | | SPRINT_125_policy_reasoning | Policy Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Provide batch endpoint delivering policy context | POLICY-ENGINE-31-001 | PLPE0103 | -| POLICY-ENGINE-32-101 | TODO | | SPRINT_125_policy_reasoning | Policy Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Define orchestrator `policy_eval` job schema, idempotency keys, and enqueue hooks triggered by advisory/VEX/SBOM events | POLICY-ENGINE-31-002 | PLPE0103 | -| POLICY-ENGINE-33-101 | TODO | | SPRINT_125_policy_reasoning | Policy Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Implement orchestrator-driven policy evaluation workers using SDK heartbeats, respecting throttles, and emitting SLO metrics | POLICY-ENGINE-32-101 | PLPE0103 | -| POLICY-ENGINE-34-101 | TODO | | SPRINT_125_policy_reasoning | Policy Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Publish policy run ledger exports + SLO burn-rate metrics to orchestrator; ensure provenance chain links to Findings Ledger | POLICY-ENGINE-33-101 | PLPE0103 | -| POLICY-ENGINE-35-201 | TODO | | SPRINT_125_policy_reasoning | Policy Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Expose deterministic policy snapshot API and evaluated findings stream keyed by policy version for exporter consumption | POLICY-ENGINE-34-101 | PLPE0103 | -| POLICY-ENGINE-38-201 | TODO | | SPRINT_125_policy_reasoning | Policy Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Emit enriched policy violation events | POLICY-ENGINE-35-201 | PLPE0103 | -| POLICY-ENGINE-40-001 | TODO | | SPRINT_125_policy_reasoning | Policy Guild, Concelier Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Update severity/status evaluation pipelines to consume multiple source severities per linkset, supporting selection strategies | POLICY-ENGINE-38-201 | PLPE0103 | -| POLICY-ENGINE-40-002 | TODO | | SPRINT_125_policy_reasoning | Policy Guild, Excititor Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Accept VEX linkset conflicts and provide rationale references in effective findings; ensure explain traces cite observation IDs | POLICY-ENGINE-40-001 | PLPE0103 | -| POLICY-ENGINE-40-003 | TODO | | SPRINT_126_policy_reasoning | Policy Guild, Web Scanner Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Provide API/SDK utilities for consumers | POLICY-ENGINE-40-002 | PLPE0103 | +| POLICY-ENGINE-29-003 | TODO | | SPRINT_0125_0000_0001_policy_reasoning | Policy Guild, SBOM Service Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Surface path/scope awareness in determinations | POLICY-ENGINE-29-002 | PLPE0102 | +| POLICY-ENGINE-29-004 | TODO | | SPRINT_0125_0000_0001_policy_reasoning | Policy Guild, Observability Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Add metrics/logs for batch evaluation | POLICY-ENGINE-29-003 | PLPE0102 | +| POLICY-ENGINE-30-001 | TODO | | SPRINT_0125_0000_0001_policy_reasoning | Policy Guild, Cartographer Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Define overlay contract for graph nodes/edges | POLICY-ENGINE-29-004 | PLPE0102 | +| POLICY-ENGINE-30-002 | TODO | | SPRINT_0125_0000_0001_policy_reasoning | Policy Guild, Cartographer Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Implement simulation bridge returning on-the-fly overlays for Cartographer/Graph Explorer when invoking Policy Engine simulate; ensure no writes and deterministic outputs | POLICY-ENGINE-30-001 | PLPE0102 | +| POLICY-ENGINE-30-003 | TODO | | SPRINT_0125_0000_0001_policy_reasoning | Policy Guild, Scheduler Guild, Cartographer Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Emit change events | POLICY-ENGINE-30-002 | PLPE0102 | +| POLICY-ENGINE-30-101 | TODO | | SPRINT_0125_0000_0001_policy_reasoning | Policy Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Surface trust weighting configuration | POLICY-ENGINE-30-003 | PLPE0102 | +| POLICY-ENGINE-31-001 | TODO | | SPRINT_0125_0000_0001_policy_reasoning | Policy Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Expose policy knobs for Advisory AI | POLICY-ENGINE-30-101 | PLPE0102 | +| POLICY-ENGINE-31-002 | TODO | | SPRINT_0125_0000_0001_policy_reasoning | Policy Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Provide batch endpoint delivering policy context | POLICY-ENGINE-31-001 | PLPE0103 | +| POLICY-ENGINE-32-101 | TODO | | SPRINT_0125_0000_0001_policy_reasoning | Policy Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Define orchestrator `policy_eval` job schema, idempotency keys, and enqueue hooks triggered by advisory/VEX/SBOM events | POLICY-ENGINE-31-002 | PLPE0103 | +| POLICY-ENGINE-33-101 | TODO | | SPRINT_0125_0000_0001_policy_reasoning | Policy Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Implement orchestrator-driven policy evaluation workers using SDK heartbeats, respecting throttles, and emitting SLO metrics | POLICY-ENGINE-32-101 | PLPE0103 | +| POLICY-ENGINE-34-101 | TODO | | SPRINT_0125_0000_0001_policy_reasoning | Policy Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Publish policy run ledger exports + SLO burn-rate metrics to orchestrator; ensure provenance chain links to Findings Ledger | POLICY-ENGINE-33-101 | PLPE0103 | +| POLICY-ENGINE-35-201 | TODO | | SPRINT_0125_0000_0001_policy_reasoning | Policy Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Expose deterministic policy snapshot API and evaluated findings stream keyed by policy version for exporter consumption | POLICY-ENGINE-34-101 | PLPE0103 | +| POLICY-ENGINE-38-201 | TODO | | SPRINT_0125_0000_0001_policy_reasoning | Policy Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Emit enriched policy violation events | POLICY-ENGINE-35-201 | PLPE0103 | +| POLICY-ENGINE-40-001 | TODO | | SPRINT_0125_0000_0001_policy_reasoning | Policy Guild, Concelier Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Update severity/status evaluation pipelines to consume multiple source severities per linkset, supporting selection strategies | POLICY-ENGINE-38-201 | PLPE0103 | +| POLICY-ENGINE-40-002 | TODO | | SPRINT_0125_0000_0001_policy_reasoning | Policy Guild, Excititor Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Accept VEX linkset conflicts and provide rationale references in effective findings; ensure explain traces cite observation IDs | POLICY-ENGINE-40-001 | PLPE0103 | +| POLICY-ENGINE-40-003 | TODO | | SPRINT_0126_0000_0001_policy_reasoning | Policy Guild, Web Scanner Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Provide API/SDK utilities for consumers | POLICY-ENGINE-40-002 | PLPE0103 | | POLICY-ENGINE-401-003 | TODO | | SPRINT_0401_0001_0001_reachability_evidence_chain | Policy Guild (`src/Policy/StellaOps.Policy.Engine`, `docs/modules/policy/architecture.md`) | `src/Policy/StellaOps.Policy.Engine`, `docs/modules/policy/architecture.md` | Replace in-service DSL compilation with the shared library, support both legacy `stella-dsl@1` packs and the new inline syntax, and keep determinism hashes stable. | — | PLPE0103 | -| POLICY-ENGINE-50-001 | TODO | | SPRINT_126_policy_reasoning | Policy Guild, Platform Security / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Implement SPL compiler: validate YAML, canonicalize, produce signed bundle, store artifact in object storage, write `policy_revisions` with AOC metadata | POLICY-ENGINE-40-003 | PLPE0104 | -| POLICY-ENGINE-50-002 | TODO | | SPRINT_126_policy_reasoning | Policy Guild, Runtime Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Build runtime evaluator executing compiled plans over advisory/vex linksets + SBOM asset metadata with deterministic caching | POLICY-ENGINE-50-001 | PLPE0104 | -| POLICY-ENGINE-50-003 | TODO | | SPRINT_126_policy_reasoning | Policy Guild, Observability Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Implement evaluation/compilation metrics, tracing, and structured logs | POLICY-ENGINE-50-002 | PLPE0104 | -| POLICY-ENGINE-50-004 | TODO | | SPRINT_126_policy_reasoning | Policy Guild, Platform Events Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Build event pipeline: subscribe to linkset/SBOM updates, schedule re-eval jobs, emit `policy.effective.updated` events with diff metadata | POLICY-ENGINE-50-003 | PLPE0104 | -| POLICY-ENGINE-50-005 | TODO | | SPRINT_126_policy_reasoning | Policy Guild, Storage Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Design and implement `policy_packs`, `policy_revisions`, `policy_runs`, `policy_artifacts` collections with indexes, TTL, and tenant scoping | POLICY-ENGINE-50-004 | PLPE0104 | -| POLICY-ENGINE-50-006 | TODO | | SPRINT_126_policy_reasoning | Policy Guild, QA Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Implement explainer persistence + retrieval APIs linking decisions to explanation tree and AOC chain | POLICY-ENGINE-50-005 | PLPE0104 | -| POLICY-ENGINE-50-007 | TODO | | SPRINT_126_policy_reasoning | Policy Guild, Scheduler Worker Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Provide evaluation worker host/DI wiring and job orchestration hooks for batch re-evaluations after policy activation | POLICY-ENGINE-50-006 | PLPE0104 | -| POLICY-ENGINE-60-001 | TODO | | SPRINT_126_policy_reasoning | Policy Guild, SBOM Service Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Maintain Redis effective decision maps per asset/snapshot for Graph overlays; implement versioning and eviction strategy | POLICY-ENGINE-50-007 | PLPE0104 | -| POLICY-ENGINE-60-002 | TODO | | SPRINT_126_policy_reasoning | Policy Guild, BE-Base Platform Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Expose simulation bridge for Graph What-if APIs, supporting hypothetical SBOM diffs and draft policies without persisting results | POLICY-ENGINE-60-001 | PLPE0104 | -| POLICY-ENGINE-70-002 | TODO | | SPRINT_126_policy_reasoning | Policy Guild, Storage Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Design and create Mongo collections | POLICY-ENGINE-60-002 | PLPE0104 | -| POLICY-ENGINE-70-003 | TODO | | SPRINT_126_policy_reasoning | Policy Guild, Runtime Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Build Redis exception decision cache | POLICY-ENGINE-70-002 | | -| POLICY-ENGINE-70-004 | TODO | | SPRINT_126_policy_reasoning | Policy Guild, Observability Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Extend metrics/tracing/logging for exception application | POLICY-ENGINE-70-003 | | -| POLICY-ENGINE-70-005 | TODO | | SPRINT_126_policy_reasoning | Policy Guild, Scheduler Worker Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Provide APIs/workers hook for exception activation/expiry | POLICY-ENGINE-70-004 | | -| POLICY-ENGINE-80-001 | TODO | | SPRINT_126_policy_reasoning | Policy Guild, Signals Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Integrate reachability/exploitability inputs into evaluation pipeline | POLICY-ENGINE-70-005 | | +| POLICY-ENGINE-50-001 | TODO | | SPRINT_0126_0000_0001_policy_reasoning | Policy Guild, Platform Security / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Implement SPL compiler: validate YAML, canonicalize, produce signed bundle, store artifact in object storage, write `policy_revisions` with AOC metadata | POLICY-ENGINE-40-003 | PLPE0104 | +| POLICY-ENGINE-50-002 | TODO | | SPRINT_0126_0000_0001_policy_reasoning | Policy Guild, Runtime Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Build runtime evaluator executing compiled plans over advisory/vex linksets + SBOM asset metadata with deterministic caching | POLICY-ENGINE-50-001 | PLPE0104 | +| POLICY-ENGINE-50-003 | TODO | | SPRINT_0126_0000_0001_policy_reasoning | Policy Guild, Observability Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Implement evaluation/compilation metrics, tracing, and structured logs | POLICY-ENGINE-50-002 | PLPE0104 | +| POLICY-ENGINE-50-004 | TODO | | SPRINT_0126_0000_0001_policy_reasoning | Policy Guild, Platform Events Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Build event pipeline: subscribe to linkset/SBOM updates, schedule re-eval jobs, emit `policy.effective.updated` events with diff metadata | POLICY-ENGINE-50-003 | PLPE0104 | +| POLICY-ENGINE-50-005 | TODO | | SPRINT_0126_0000_0001_policy_reasoning | Policy Guild, Storage Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Design and implement `policy_packs`, `policy_revisions`, `policy_runs`, `policy_artifacts` collections with indexes, TTL, and tenant scoping | POLICY-ENGINE-50-004 | PLPE0104 | +| POLICY-ENGINE-50-006 | TODO | | SPRINT_0126_0000_0001_policy_reasoning | Policy Guild, QA Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Implement explainer persistence + retrieval APIs linking decisions to explanation tree and AOC chain | POLICY-ENGINE-50-005 | PLPE0104 | +| POLICY-ENGINE-50-007 | TODO | | SPRINT_0126_0000_0001_policy_reasoning | Policy Guild, Scheduler Worker Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Provide evaluation worker host/DI wiring and job orchestration hooks for batch re-evaluations after policy activation | POLICY-ENGINE-50-006 | PLPE0104 | +| POLICY-ENGINE-60-001 | TODO | | SPRINT_0126_0000_0001_policy_reasoning | Policy Guild, SBOM Service Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Maintain Redis effective decision maps per asset/snapshot for Graph overlays; implement versioning and eviction strategy | POLICY-ENGINE-50-007 | PLPE0104 | +| POLICY-ENGINE-60-002 | TODO | | SPRINT_0126_0000_0001_policy_reasoning | Policy Guild, BE-Base Platform Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Expose simulation bridge for Graph What-if APIs, supporting hypothetical SBOM diffs and draft policies without persisting results | POLICY-ENGINE-60-001 | PLPE0104 | +| POLICY-ENGINE-70-002 | TODO | | SPRINT_0126_0000_0001_policy_reasoning | Policy Guild, Storage Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Design and create Mongo collections | POLICY-ENGINE-60-002 | PLPE0104 | +| POLICY-ENGINE-70-003 | TODO | | SPRINT_0126_0000_0001_policy_reasoning | Policy Guild, Runtime Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Build Redis exception decision cache | POLICY-ENGINE-70-002 | | +| POLICY-ENGINE-70-004 | TODO | | SPRINT_0126_0000_0001_policy_reasoning | Policy Guild, Observability Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Extend metrics/tracing/logging for exception application | POLICY-ENGINE-70-003 | | +| POLICY-ENGINE-70-005 | TODO | | SPRINT_0126_0000_0001_policy_reasoning | Policy Guild, Scheduler Worker Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Provide APIs/workers hook for exception activation/expiry | POLICY-ENGINE-70-004 | | +| POLICY-ENGINE-80-001 | TODO | | SPRINT_0126_0000_0001_policy_reasoning | Policy Guild, Signals Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Integrate reachability/exploitability inputs into evaluation pipeline | POLICY-ENGINE-70-005 | | | POLICY-ENGINE-80-002 | BLOCKED (2025-11-26) | | SPRINT_0127_0001_0001_policy_reasoning | Policy Guild, Storage Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Create joining layer to read `reachability_facts` efficiently | POLICY-ENGINE-80-001 | Waiting on reachability input contract (80-001). | | POLICY-ENGINE-80-003 | BLOCKED (2025-11-26) | | SPRINT_0127_0001_0001_policy_reasoning | Policy Guild, Policy Editor Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Extend SPL predicates/actions to reference reachability state/score/confidence; update compiler validation | POLICY-ENGINE-80-002 | Blocked by reachability inputs/80-002. | -| POLICY-ENGINE-80-004 | TODO | | SPRINT_127_policy_reasoning | Policy Guild, Observability Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Emit metrics | POLICY-ENGINE-80-003 | | +| POLICY-ENGINE-80-004 | TODO | | SPRINT_0127_0000_0001_policy_reasoning | Policy Guild, Observability Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Emit metrics | POLICY-ENGINE-80-003 | | | POLICY-LIB-401-001 | DONE (2025-11-27) | | SPRINT_0401_0001_0001_reachability_evidence_chain | Policy Guild (`src/Policy/StellaOps.PolicyDsl`, `docs/policy/dsl.md`) | `src/Policy/StellaOps.PolicyDsl`, `docs/policy/dsl.md` | Extract the policy DSL parser/compiler into `StellaOps.PolicyDsl`, add the lightweight syntax (default action + inline rules), and expose `PolicyEngineFactory`/`SignalContext` APIs for reuse. | | Created StellaOps.PolicyDsl library with PolicyEngineFactory, SignalContext, tokenizer, parser, compiler, and IR serialization. | | POLICY-LIB-401-002 | DONE (2025-11-27) | | SPRINT_0401_0001_0001_reachability_evidence_chain | Policy Guild, CLI Guild (`tests/Policy/StellaOps.PolicyDsl.Tests`, `policy/default.dsl`, `docs/policy/lifecycle.md`) | `tests/Policy/StellaOps.PolicyDsl.Tests`, `policy/default.dsl`, `docs/policy/lifecycle.md` | Ship unit-test harness + sample `policy/default.dsl` (table-driven cases) and wire `stella policy lint/simulate` to the shared library. | | Created test harness with 25 unit tests, sample DSL files (minimal.dsl, default.dsl), and wired stella policy lint command to PolicyDsl library. | -| POLICY-OBS-50-001 | TODO | | SPRINT_127_policy_reasoning | Policy Guild · Observability Guild | src/Policy/StellaOps.Policy.Engine | Integrate telemetry core into policy API + worker hosts, ensuring spans/logs cover compile/evaluate flows with `tenant_id`, `policy_version`, `decision_effect`, and trace IDs | Wait for telemetry schema drop (046_TLTY0101) | PLOB0101 | -| POLICY-OBS-51-001 | TODO | | SPRINT_127_policy_reasoning | Policy Guild · DevOps Guild | src/Policy/StellaOps.Policy.Engine | Emit golden-signal metrics | POLICY-OBS-50-001 | PLOB0101 | -| POLICY-OBS-52-001 | TODO | | SPRINT_127_policy_reasoning | Policy Guild | src/Policy/StellaOps.Policy.Engine | Emit timeline events `policy.evaluate.started`, `policy.evaluate.completed`, `policy.decision.recorded` with trace IDs, input digests, and rule summary. Provide contract tests and retry semantics | POLICY-OBS-51-001 | PLOB0101 | -| POLICY-OBS-53-001 | TODO | | SPRINT_127_policy_reasoning | Policy Guild · Evidence Locker Guild | src/Policy/StellaOps.Policy.Engine | Produce evaluation evidence bundles | POLICY-OBS-52-001 | PLOB0101 | -| POLICY-OBS-54-001 | TODO | | SPRINT_127_policy_reasoning | Policy Guild · Provenance Guild | src/Policy/StellaOps.Policy.Engine | Generate DSSE attestations for evaluation outputs, expose `/evaluations/{id}/attestation`, and link attestation IDs in timeline + console. Provide verification harness | POLICY-OBS-53-001 | PLOB0101 | -| POLICY-OBS-55-001 | TODO | | SPRINT_127_policy_reasoning | Policy Guild · DevOps Guild | src/Policy/StellaOps.Policy.Engine | Implement incident mode sampling overrides | POLICY-OBS-54-001 | PLOB0101 | +| POLICY-OBS-50-001 | TODO | | SPRINT_0127_0000_0001_policy_reasoning | Policy Guild · Observability Guild | src/Policy/StellaOps.Policy.Engine | Integrate telemetry core into policy API + worker hosts, ensuring spans/logs cover compile/evaluate flows with `tenant_id`, `policy_version`, `decision_effect`, and trace IDs | Wait for telemetry schema drop (046_TLTY0101) | PLOB0101 | +| POLICY-OBS-51-001 | TODO | | SPRINT_0127_0000_0001_policy_reasoning | Policy Guild · DevOps Guild | src/Policy/StellaOps.Policy.Engine | Emit golden-signal metrics | POLICY-OBS-50-001 | PLOB0101 | +| POLICY-OBS-52-001 | TODO | | SPRINT_0127_0000_0001_policy_reasoning | Policy Guild | src/Policy/StellaOps.Policy.Engine | Emit timeline events `policy.evaluate.started`, `policy.evaluate.completed`, `policy.decision.recorded` with trace IDs, input digests, and rule summary. Provide contract tests and retry semantics | POLICY-OBS-51-001 | PLOB0101 | +| POLICY-OBS-53-001 | TODO | | SPRINT_0127_0000_0001_policy_reasoning | Policy Guild · Evidence Locker Guild | src/Policy/StellaOps.Policy.Engine | Produce evaluation evidence bundles | POLICY-OBS-52-001 | PLOB0101 | +| POLICY-OBS-54-001 | TODO | | SPRINT_0127_0000_0001_policy_reasoning | Policy Guild · Provenance Guild | src/Policy/StellaOps.Policy.Engine | Generate DSSE attestations for evaluation outputs, expose `/evaluations/{id}/attestation`, and link attestation IDs in timeline + console. Provide verification harness | POLICY-OBS-53-001 | PLOB0101 | +| POLICY-OBS-55-001 | TODO | | SPRINT_0127_0000_0001_policy_reasoning | Policy Guild · DevOps Guild | src/Policy/StellaOps.Policy.Engine | Implement incident mode sampling overrides | POLICY-OBS-54-001 | PLOB0101 | | POLICY-READINESS-0001 | TODO | | SPRINT_0325_0001_0001_docs_modules_policy | Policy Guild (docs/modules/policy) | docs/modules/policy | Capture policy module readiness checklist aligned with current sprint goals. | | | | POLICY-READINESS-0002 | TODO | | SPRINT_0325_0001_0001_docs_modules_policy | Policy Guild (docs/modules/policy) | docs/modules/policy | Track outstanding prerequisites/risk items for policy releases and mirror into sprint updates. | | | -| POLICY-RISK-66-001 | DONE | 2025-11-22 | SPRINT_127_policy_reasoning | Risk Profile Schema Guild / src/Policy/StellaOps.Policy.RiskProfile | src/Policy/StellaOps.Policy.RiskProfile | Develop initial JSON Schema for RiskProfile (signals, transforms, weights, severity, overrides) with validator stubs | | | +| POLICY-RISK-66-001 | DONE | 2025-11-22 | SPRINT_0127_0000_0001_policy_reasoning | Risk Profile Schema Guild / src/Policy/StellaOps.Policy.RiskProfile | src/Policy/StellaOps.Policy.RiskProfile | Develop initial JSON Schema for RiskProfile (signals, transforms, weights, severity, overrides) with validator stubs | | | | POLICY-RISK-66-002 | DONE (2025-11-26) | | SPRINT_0127_0001_0001_policy_reasoning | Risk Profile Schema Guild / src/Policy/StellaOps.Policy.RiskProfile | src/Policy/StellaOps.Policy.RiskProfile | Implement inheritance/merge logic with conflict detection and deterministic content hashing | POLICY-RISK-66-001 | Canonicalizer/merge + digest, tests added. | | POLICY-RISK-66-003 | BLOCKED (2025-11-26) | | SPRINT_0127_0001_0001_policy_reasoning | Policy Guild, Risk Profile Schema Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Integrate RiskProfile schema into Policy Engine configuration, ensuring validation and default profile deployment | POLICY-RISK-66-002 | Waiting on reachability input contract (80-001) and engine config shape. | -| POLICY-RISK-66-004 | TODO | | SPRINT_127_policy_reasoning | Policy Guild, Risk Profile Schema Guild / src/Policy/__Libraries/StellaOps.Policy | src/Policy/__Libraries/StellaOps.Policy | Extend Policy libraries to load/save RiskProfile documents, compute content hashes, and surface validation diagnostics | POLICY-RISK-66-003 | | -| POLICY-RISK-67-001 | TODO | | SPRINT_127_policy_reasoning | Policy Guild, Risk Engine Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Trigger scoring jobs on new/updated findings via Policy Engine orchestration hooks | POLICY-RISK-66-004 | | +| POLICY-RISK-66-004 | TODO | | SPRINT_0127_0000_0001_policy_reasoning | Policy Guild, Risk Profile Schema Guild / src/Policy/__Libraries/StellaOps.Policy | src/Policy/__Libraries/StellaOps.Policy | Extend Policy libraries to load/save RiskProfile documents, compute content hashes, and surface validation diagnostics | POLICY-RISK-66-003 | | +| POLICY-RISK-67-001 | TODO | | SPRINT_0127_0000_0001_policy_reasoning | Policy Guild, Risk Engine Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Trigger scoring jobs on new/updated findings via Policy Engine orchestration hooks | POLICY-RISK-66-004 | | | POLICY-RISK-67-002 | BLOCKED (2025-11-26) | | SPRINT_0128_0001_0001_policy_reasoning | Policy Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Implement profile lifecycle APIs | POLICY-RISK-67-001 | Waiting on risk profile contract + schema draft. | | POLICY-RISK-67-003 | BLOCKED (2025-11-26) | | SPRINT_0128_0001_0001_policy_reasoning | Policy Guild, Risk Engine Guild / src/Policy/__Libraries/StellaOps.Policy | src/Policy/__Libraries/StellaOps.Policy | Provide policy-layer APIs to trigger risk simulations and return distributions/contribution breakdowns | POLICY-RISK-67-002 | Blocked by missing risk profile schema + lifecycle API contract. | -| POLICY-RISK-68-001 | TODO | | SPRINT_128_policy_reasoning | Policy Guild, Policy Studio Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Provide simulation API bridging Policy Studio with risk engine; returns distributions and top movers | POLICY-RISK-67-003 | | -| POLICY-RISK-68-002 | TODO | | SPRINT_128_policy_reasoning | Risk Profile Schema Guild / src/Policy/StellaOps.Policy.RiskProfile | src/Policy/StellaOps.Policy.RiskProfile | Add override/adjustment support with audit metadata and validation for conflicting rules | POLICY-RISK-68-001 | | -| POLICY-RISK-69-001 | TODO | | SPRINT_128_policy_reasoning | Policy Guild, Notifications Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Emit events/notifications on profile publish, deprecate, and severity threshold changes | POLICY-RISK-68-002 | | -| POLICY-RISK-70-001 | TODO | | SPRINT_128_policy_reasoning | Policy Guild, Export Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Support exporting/importing profiles with signatures for air-gapped bundles | POLICY-RISK-69-001 | | -| POLICY-RISK-90-001 | TODO | | SPRINT_126_policy_reasoning | Policy Guild, Scanner Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Ingest entropy penalty inputs from Scanner (`entropy.report.json`, `layer_summary.json`), extend trust algebra with configurable weights/caps, and expose explanations/metrics for opaque ratio penalties (`docs/modules/scanner/entropy.md`). | | | -| POLICY-SPL-23-001 | TODO | | SPRINT_128_policy_reasoning | Policy Guild, Language Infrastructure Guild / src/Policy/__Libraries/StellaOps.Policy | src/Policy/__Libraries/StellaOps.Policy | Define SPL v1 YAML + JSON Schema, including advisory rules, VEX precedence, severity mapping, exceptions, and layering metadata. Publish schema resources and validation fixtures | | | -| POLICY-SPL-23-002 | TODO | | SPRINT_128_policy_reasoning | Policy Guild / src/Policy/__Libraries/StellaOps.Policy | src/Policy/__Libraries/StellaOps.Policy | Implement canonicalizer that normalizes policy packs | POLICY-SPL-23-001 | | +| POLICY-RISK-68-001 | TODO | | SPRINT_0128_0000_0001_policy_reasoning | Policy Guild, Policy Studio Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Provide simulation API bridging Policy Studio with risk engine; returns distributions and top movers | POLICY-RISK-67-003 | | +| POLICY-RISK-68-002 | TODO | | SPRINT_0128_0000_0001_policy_reasoning | Risk Profile Schema Guild / src/Policy/StellaOps.Policy.RiskProfile | src/Policy/StellaOps.Policy.RiskProfile | Add override/adjustment support with audit metadata and validation for conflicting rules | POLICY-RISK-68-001 | | +| POLICY-RISK-69-001 | TODO | | SPRINT_0128_0000_0001_policy_reasoning | Policy Guild, Notifications Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Emit events/notifications on profile publish, deprecate, and severity threshold changes | POLICY-RISK-68-002 | | +| POLICY-RISK-70-001 | TODO | | SPRINT_0128_0000_0001_policy_reasoning | Policy Guild, Export Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Support exporting/importing profiles with signatures for air-gapped bundles | POLICY-RISK-69-001 | | +| POLICY-RISK-90-001 | TODO | | SPRINT_0126_0000_0001_policy_reasoning | Policy Guild, Scanner Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Ingest entropy penalty inputs from Scanner (`entropy.report.json`, `layer_summary.json`), extend trust algebra with configurable weights/caps, and expose explanations/metrics for opaque ratio penalties (`docs/modules/scanner/entropy.md`). | | | +| POLICY-SPL-23-001 | TODO | | SPRINT_0128_0000_0001_policy_reasoning | Policy Guild, Language Infrastructure Guild / src/Policy/__Libraries/StellaOps.Policy | src/Policy/__Libraries/StellaOps.Policy | Define SPL v1 YAML + JSON Schema, including advisory rules, VEX precedence, severity mapping, exceptions, and layering metadata. Publish schema resources and validation fixtures | | | +| POLICY-SPL-23-002 | TODO | | SPRINT_0128_0000_0001_policy_reasoning | Policy Guild / src/Policy/__Libraries/StellaOps.Policy | src/Policy/__Libraries/StellaOps.Policy | Implement canonicalizer that normalizes policy packs | POLICY-SPL-23-001 | | | POLICY-SPL-23-003 | DONE (2025-11-26) | | SPRINT_0128_0001_0001_policy_reasoning | Policy Guild / src/Policy/__Libraries/StellaOps.Policy | src/Policy/__Libraries/StellaOps.Policy | Build policy layering/override engine | POLICY-SPL-23-002 | `SplLayeringEngine` + tests landed. | | POLICY-SPL-23-004 | DONE (2025-11-26) | | SPRINT_0128_0001_0001_policy_reasoning | Policy Guild, Audit Guild / src/Policy/__Libraries/StellaOps.Policy | src/Policy/__Libraries/StellaOps.Policy | Design explanation tree model | POLICY-SPL-23-003 | Explanation tree emitted from evaluation; persistence follow-up. | | POLICY-SPL-23-005 | DONE (2025-11-26) | | SPRINT_0128_0001_0001_policy_reasoning | Policy Guild, DevEx Guild / src/Policy/__Libraries/StellaOps.Policy | src/Policy/__Libraries/StellaOps.Policy | Create migration tool to snapshot existing behavior into baseline SPL packs | POLICY-SPL-23-004 | `SplMigrationTool` emits canonical SPL JSON from PolicyDocument. | -| POLICY-SPL-24-001 | DONE (2025-11-26) | 2025-11-26 | SPRINT_128_policy_reasoning | Policy Guild, Signals Guild / src/Policy/__Libraries/StellaOps.Policy | src/Policy/__Libraries/StellaOps.Policy | Extend SPL schema to expose reachability/exploitability predicates and weighting functions; update documentation and fixtures | POLICY-SPL-23-005 | | +| POLICY-SPL-24-001 | DONE (2025-11-26) | 2025-11-26 | SPRINT_0128_0000_0001_policy_reasoning | Policy Guild, Signals Guild / src/Policy/__Libraries/StellaOps.Policy | src/Policy/__Libraries/StellaOps.Policy | Extend SPL schema to expose reachability/exploitability predicates and weighting functions; update documentation and fixtures | POLICY-SPL-23-005 | | | POLICY-TEN-48-001 | TODO | | SPRINT_0129_0001_0001_policy_reasoning | Policy Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Add `tenant_id`/`project_id` columns, enable RLS, update evaluators to require tenant context, and emit rationale IDs including tenant metadata | | | | POLICY-VEX-401-006 | TODO | | SPRINT_0401_0001_0001_reachability_evidence_chain | Policy Guild (`src/Policy/StellaOps.Policy.Engine`, `src/Policy/__Libraries/StellaOps.Policy`) | `src/Policy/StellaOps.Policy.Engine`, `src/Policy/__Libraries/StellaOps.Policy` | Policy Engine consumes reachability facts, applies the deterministic score/label buckets (≥0.80 reachable, 0.30–0.79 conditional, <0.30 unreachable), emits OpenVEX with call-path proofs, and updates SPL schema with `reachability.state/confidence` predicates and suppression gates. | | | | POLICY-VEX-401-010 | TODO | | SPRINT_0401_0001_0001_reachability_evidence_chain | Policy Guild (`src/Policy/StellaOps.Policy.Engine/Vex`, `docs/modules/policy/architecture.md`, `docs/benchmarks/vex-evidence-playbook.md`) | `src/Policy/StellaOps.Policy.Engine/Vex`, `docs/modules/policy/architecture.md`, `docs/benchmarks/vex-evidence-playbook.md` | Implement `VexDecisionEmitter` to serialize per-finding OpenVEX, attach evidence hashes, request DSSE signatures, capture Rekor metadata, and publish artifacts following the bench playbook. | | | | PROBE-401-010 | TODO | | SPRINT_0401_0001_0001_reachability_evidence_chain | Runtime Signals Guild (`src/Signals/StellaOps.Signals.Runtime`, `ops/probes`) | `src/Signals/StellaOps.Signals.Runtime`, `ops/probes` | | | | -| PROMO-70-001 | TODO | | SPRINT_202_cli_ii | DevEx/CLI Guild, Provenance Guild (src/Cli/StellaOps.Cli) | src/Cli/StellaOps.Cli | | | | -| PROMO-70-002 | TODO | | SPRINT_203_cli_iii | DevEx/CLI Guild, Provenance Guild (src/Cli/StellaOps.Cli) | src/Cli/StellaOps.Cli | | | | +| PROMO-70-001 | TODO | | SPRINT_0202_0000_0002_cli_ii | DevEx/CLI Guild, Provenance Guild (src/Cli/StellaOps.Cli) | src/Cli/StellaOps.Cli | | | | +| PROMO-70-002 | TODO | | SPRINT_0203_0000_0003_cli_iii | DevEx/CLI Guild, Provenance Guild (src/Cli/StellaOps.Cli) | src/Cli/StellaOps.Cli | | | | | PROV-BACKFILL-401-029 | DONE | 2025-11-27 | SPRINT_0401_0001_0001_reachability_evidence_chain | Platform Guild | `docs/provenance/inline-dsse.md`, `scripts/publish_attestation_with_provenance.sh` | Backfill historical Mongo events with DSSE/Rekor metadata by resolving known attestations per subject digest (wiring ingestion helpers + endpoint tests in progress). | Depends on #1 | RBRE0101 | | PROV-INDEX-401-030 | DONE | 2025-11-27 | SPRINT_0401_0001_0001_reachability_evidence_chain | Platform + Ops Guilds | `docs/provenance/inline-dsse.md`, `ops/mongo/indices/events_provenance_indices.js` | Deploy provenance indexes (`events_by_subject_kind_provenance`, etc.) and expose compliance/replay queries. | Depends on #3 | RBRE0101 | | PROV-INLINE-401-028 | DONE | | SPRINT_0401_0001_0001_reachability_evidence_chain | Authority Guild · Feedser Guild (`docs/provenance/inline-dsse.md`, `src/__Libraries/StellaOps.Provenance.Mongo`) | `docs/provenance/inline-dsse.md`, `src/__Libraries/StellaOps.Provenance.Mongo` | Extend Authority/Feedser event writers to attach inline DSSE + Rekor references on every SBOM/VEX/scan event using `StellaOps.Provenance.Mongo`. | | | @@ -1510,39 +1510,39 @@ | REGISTRY-API-27-010 | TODO | | SPRINT_0129_0001_0001_policy_reasoning | Policy Registry Guild, QA Guild / src/Policy/StellaOps.Policy.Registry | src/Policy/StellaOps.Policy.Registry | Build unit/integration/load test suites for compile/sim/review/publish/promote flows; provide seeded fixtures for CI | REGISTRY-API-27-009 | | | REL-17-004 | BLOCKED | 2025-10-26 | SPRINT_0506_0001_0001_ops_devops_iv | DevOps Guild (ops/devops) | ops/devops | | | | | REP-004 | TODO | | SPRINT_0401_0001_0001_reachability_evidence_chain | BE-Base Platform Guild (`src/__Libraries/StellaOps.Replay.Core`, `docs/replay/DETERMINISTIC_REPLAY.md`) | `src/__Libraries/StellaOps.Replay.Core`, `docs/replay/DETERMINISTIC_REPLAY.md` | | | | -| REPLAY-185-003 | TODO | | SPRINT_185_shared_replay_primitives | Docs Guild, Platform Data Guild (docs) | | | | | -| REPLAY-185-004 | TODO | | SPRINT_185_shared_replay_primitives | Docs Guild (docs) | | | | | -| REPLAY-186-001 | TODO | | SPRINT_186_record_deterministic_execution | Scanner Guild (`src/Scanner/StellaOps.Scanner.WebService`, `docs/modules/scanner/architecture.md`) | `src/Scanner/StellaOps.Scanner.WebService`, `docs/modules/scanner/architecture.md` | | | | -| REPLAY-186-002 | TODO | | SPRINT_186_record_deterministic_execution | Scanner Guild (`src/Scanner/StellaOps.Scanner.Worker`, `docs/modules/scanner/deterministic-execution.md`) | `src/Scanner/StellaOps.Scanner.Worker`, `docs/modules/scanner/deterministic-execution.md` | | | | -| REPLAY-186-003 | TODO | | SPRINT_186_record_deterministic_execution | Signing Guild (`src/Signer/StellaOps.Signer`, `src/Authority/StellaOps.Authority`) | `src/Signer/StellaOps.Signer`, `src/Authority/StellaOps.Authority` | | | | -| REPLAY-186-004 | TODO | | SPRINT_186_record_deterministic_execution | Docs Guild (`docs`) | | | | | +| REPLAY-185-003 | TODO | | SPRINT_0185_0000_0001_shared_replay_primitives | Docs Guild, Platform Data Guild (docs) | | | | | +| REPLAY-185-004 | TODO | | SPRINT_0185_0000_0001_shared_replay_primitives | Docs Guild (docs) | | | | | +| REPLAY-186-001 | TODO | | SPRINT_0186_0000_0001_record_deterministic_execution | Scanner Guild (`src/Scanner/StellaOps.Scanner.WebService`, `docs/modules/scanner/architecture.md`) | `src/Scanner/StellaOps.Scanner.WebService`, `docs/modules/scanner/architecture.md` | | | | +| REPLAY-186-002 | TODO | | SPRINT_0186_0000_0001_record_deterministic_execution | Scanner Guild (`src/Scanner/StellaOps.Scanner.Worker`, `docs/modules/scanner/deterministic-execution.md`) | `src/Scanner/StellaOps.Scanner.Worker`, `docs/modules/scanner/deterministic-execution.md` | | | | +| REPLAY-186-003 | TODO | | SPRINT_0186_0000_0001_record_deterministic_execution | Signing Guild (`src/Signer/StellaOps.Signer`, `src/Authority/StellaOps.Authority`) | `src/Signer/StellaOps.Signer`, `src/Authority/StellaOps.Authority` | | | | +| REPLAY-186-004 | TODO | | SPRINT_0186_0000_0001_record_deterministic_execution | Docs Guild (`docs`) | | | | | | REPLAY-187-001 | TODO | | SPRINT_160_export_evidence | Evidence Locker Guild · docs/modules/evidence-locker/architecture.md | docs/modules/evidence-locker/architecture.md | | | | | REPLAY-187-002 | TODO | | SPRINT_160_export_evidence | CLI Guild · `docs/modules/cli/architecture.md` | docs/modules/cli/architecture.md | | | | -| REPLAY-187-003 | TODO | | SPRINT_187_evidence_locker_cli_integration | Attestor Guild (`src/Attestor/StellaOps.Attestor`, `docs/modules/attestor/architecture.md`) | `src/Attestor/StellaOps.Attestor`, `docs/modules/attestor/architecture.md` | | | | +| REPLAY-187-003 | TODO | | SPRINT_0187_0000_0001_evidence_locker_cli_integration | Attestor Guild (`src/Attestor/StellaOps.Attestor`, `docs/modules/attestor/architecture.md`) | `src/Attestor/StellaOps.Attestor`, `docs/modules/attestor/architecture.md` | | | | | REPLAY-187-004 | TODO | | SPRINT_160_export_evidence | Docs/Ops Guild · `/docs/runbooks/replay_ops.md` | docs/runbooks/replay_ops.md | | | | | REPLAY-401-004 | TODO | | SPRINT_0401_0001_0001_reachability_evidence_chain | BE-Base Platform Guild (`src/__Libraries/StellaOps.Replay.Core`) | `src/__Libraries/StellaOps.Replay.Core` | Bump replay manifest to v2 (feeds, analyzers, policies), have `ReachabilityReplayWriter` enforce CAS registration + hash sorting, and add deterministic tests to `tests/reachability/StellaOps.Reachability.FixtureTests`. | | | -| REPLAY-CORE-185-001 | TODO | | SPRINT_185_shared_replay_primitives | Platform Guild | `src/__Libraries/StellaOps.Replay.Core` | Scaffold `StellaOps.Replay.Core` with manifest schema types, canonical JSON rules, Merkle utilities, and DSSE payload builders; add `AGENTS.md`/`TASKS.md` for the new library; cross-reference `docs/replay/DETERMINISTIC_REPLAY.md` section 3 when updating the library charter. | Mirrors #1 | RLRC0101 | -| REPLAY-CORE-185-002 | TODO | | SPRINT_185_shared_replay_primitives | Platform Guild | src/__Libraries/StellaOps.Replay.Core | Implement deterministic bundle writer (tar.zst, CAS naming) and hashing abstractions, updating `docs/modules/platform/architecture-overview.md` with a “Replay CAS” subsection that documents layout/retention expectations. | Mirrors #2 | RLRC0101 | -| REPLAY-CORE-185-003 | TODO | | SPRINT_185_shared_replay_primitives | Platform Data Guild | src/__Libraries/StellaOps.Replay.Core | Define Mongo collections (`replay_runs`, `replay_bundles`, `replay_subjects`) and indices, then author `docs/data/replay_schema.md` detailing schema fields, constraints, and offline sync strategy. | Mirrors #3 | RLRC0101 | +| REPLAY-CORE-185-001 | TODO | | SPRINT_0185_0000_0001_shared_replay_primitives | Platform Guild | `src/__Libraries/StellaOps.Replay.Core` | Scaffold `StellaOps.Replay.Core` with manifest schema types, canonical JSON rules, Merkle utilities, and DSSE payload builders; add `AGENTS.md`/`TASKS.md` for the new library; cross-reference `docs/replay/DETERMINISTIC_REPLAY.md` section 3 when updating the library charter. | Mirrors #1 | RLRC0101 | +| REPLAY-CORE-185-002 | TODO | | SPRINT_0185_0000_0001_shared_replay_primitives | Platform Guild | src/__Libraries/StellaOps.Replay.Core | Implement deterministic bundle writer (tar.zst, CAS naming) and hashing abstractions, updating `docs/modules/platform/architecture-overview.md` with a “Replay CAS” subsection that documents layout/retention expectations. | Mirrors #2 | RLRC0101 | +| REPLAY-CORE-185-003 | TODO | | SPRINT_0185_0000_0001_shared_replay_primitives | Platform Data Guild | src/__Libraries/StellaOps.Replay.Core | Define Mongo collections (`replay_runs`, `replay_bundles`, `replay_subjects`) and indices, then author `docs/data/replay_schema.md` detailing schema fields, constraints, and offline sync strategy. | Mirrors #3 | RLRC0101 | | REPLAY-REACH-201-005 | DOING | 2025-11-08 | SPRINT_400_runtime_facts_static_callgraph_union | BE-Base Platform Guild (`src/__Libraries/StellaOps.Replay.Core`) | `src/__Libraries/StellaOps.Replay.Core` | Update `StellaOps.Replay.Core` manifest schema + bundle writer so replay packs capture reachability graphs, runtime traces, analyzer versions, and evidence hashes; document new CAS namespace. | | | | RISK-66-001 | TODO | | SPRINT_115_concelier_iv | Concelier Core Guild, Risk Engine Guild (src/Concelier/__Libraries/StellaOps.Concelier.Core) | src/Concelier/__Libraries/StellaOps.Concelier.Core | | | | | RISK-66-002 | TODO | | SPRINT_115_concelier_iv | Concelier Core Guild (src/Concelier/__Libraries/StellaOps.Concelier.Core) | src/Concelier/__Libraries/StellaOps.Concelier.Core | | | | -| RISK-66-003 | TODO | | SPRINT_127_policy_reasoning | Policy Guild, Risk Profile Schema Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | | POLICY-RISK-66-002 | | -| RISK-66-004 | TODO | | SPRINT_127_policy_reasoning | Policy Guild, Risk Profile Schema Guild / src/Policy/__Libraries/StellaOps.Policy | src/Policy/__Libraries/StellaOps.Policy | | POLICY-RISK-66-003 | | +| RISK-66-003 | TODO | | SPRINT_0127_0000_0001_policy_reasoning | Policy Guild, Risk Profile Schema Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | | POLICY-RISK-66-002 | | +| RISK-66-004 | TODO | | SPRINT_0127_0000_0001_policy_reasoning | Policy Guild, Risk Profile Schema Guild / src/Policy/__Libraries/StellaOps.Policy | src/Policy/__Libraries/StellaOps.Policy | | POLICY-RISK-66-003 | | | RISK-67-001 | TODO | | SPRINT_115_concelier_iv | Concelier Core Guild (src/Concelier/__Libraries/StellaOps.Concelier.Core) | src/Concelier/__Libraries/StellaOps.Concelier.Core | | | | -| RISK-67-002 | TODO | | SPRINT_128_policy_reasoning | Policy Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | | POLICY-RISK-67-001 | | +| RISK-67-002 | TODO | | SPRINT_0128_0000_0001_policy_reasoning | Policy Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | | POLICY-RISK-67-001 | | | RISK-67-003 | BLOCKED (2025-11-26) | | SPRINT_0128_0001_0001_policy_reasoning | Policy Guild, Risk Engine Guild / src/Policy/__Libraries/StellaOps.Policy | src/Policy/__Libraries/StellaOps.Policy | | POLICY-RISK-67-002 | Blocked by missing risk profile schema + lifecycle API contract. | | RISK-67-004 | TODO | | SPRINT_0309_0001_0009_docs_tasks_md_ix | Docs Guild, CLI Guild (docs) | | | | | | RISK-68-001 | TODO | | SPRINT_115_concelier_iv | Concelier Core Guild, Policy Studio Guild (src/Concelier/__Libraries/StellaOps.Concelier.Core) | src/Concelier/__Libraries/StellaOps.Concelier.Core | | | | -| RISK-68-002 | TODO | | SPRINT_128_policy_reasoning | Risk Profile Schema Guild / src/Policy/StellaOps.Policy.RiskProfile | src/Policy/StellaOps.Policy.RiskProfile | | POLICY-RISK-68-001 | | +| RISK-68-002 | TODO | | SPRINT_0128_0000_0001_policy_reasoning | Risk Profile Schema Guild / src/Policy/StellaOps.Policy.RiskProfile | src/Policy/StellaOps.Policy.RiskProfile | | POLICY-RISK-68-001 | | | RISK-69-001 | TODO | | SPRINT_115_concelier_iv | Concelier Core Guild, Notifications Guild (src/Concelier/__Libraries/StellaOps.Concelier.Core) | src/Concelier/__Libraries/StellaOps.Concelier.Core | | | | | RISK-69-002 | TODO | | SPRINT_163_exportcenter_ii | Exporter Service Guild, Risk Engine Guild (src/ExportCenter/StellaOps.ExportCenter) | src/ExportCenter/StellaOps.ExportCenter | | | | -| RISK-70-001 | TODO | | SPRINT_128_policy_reasoning | Policy Guild, Export Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | | POLICY-RISK-69-001 | | -| RISK-90-001 | TODO | | SPRINT_126_policy_reasoning | Policy Guild, Scanner Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | | | | -| RISK-BUNDLE-69-001 | TODO | | SPRINT_164_exportcenter_iii | Risk Bundle Export Guild, Risk Engine Guild (src/ExportCenter/StellaOps.ExportCenter.RiskBundles) | src/ExportCenter/StellaOps.ExportCenter.RiskBundles | Implement `stella export risk-bundle` job producing tarball with provider datasets, manifests, and DSSE signatures. | | | -| RISK-BUNDLE-69-002 | TODO | | SPRINT_164_exportcenter_iii | Risk Bundle Export Guild, DevOps Guild (src/ExportCenter/StellaOps.ExportCenter.RiskBundles) | src/ExportCenter/StellaOps.ExportCenter.RiskBundles | Integrate bundle job into CI/offline kit pipelines with checksum publication. Dependencies: RISK-BUNDLE-69-001. | | | -| RISK-BUNDLE-70-001 | TODO | | SPRINT_164_exportcenter_iii | Risk Bundle Export Guild, CLI Guild (src/ExportCenter/StellaOps.ExportCenter.RiskBundles) | src/ExportCenter/StellaOps.ExportCenter.RiskBundles | Provide CLI `stella risk bundle verify` command to validate bundles before import. Dependencies: RISK-BUNDLE-69-002. | | | -| RISK-BUNDLE-70-002 | TODO | | SPRINT_164_exportcenter_iii | Risk Bundle Export Guild, Docs Guild (src/ExportCenter/StellaOps.ExportCenter.RiskBundles) | src/ExportCenter/StellaOps.ExportCenter.RiskBundles | Publish `/docs/airgap/risk-bundles.md` detailing build/import/verification workflows. Dependencies: RISK-BUNDLE-70-001. | | | +| RISK-70-001 | TODO | | SPRINT_0128_0000_0001_policy_reasoning | Policy Guild, Export Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | | POLICY-RISK-69-001 | | +| RISK-90-001 | TODO | | SPRINT_0126_0000_0001_policy_reasoning | Policy Guild, Scanner Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | | | | +| RISK-BUNDLE-69-001 | TODO | | SPRINT_0164_0000_0003_exportcenter_iii | Risk Bundle Export Guild, Risk Engine Guild (src/ExportCenter/StellaOps.ExportCenter.RiskBundles) | src/ExportCenter/StellaOps.ExportCenter.RiskBundles | Implement `stella export risk-bundle` job producing tarball with provider datasets, manifests, and DSSE signatures. | | | +| RISK-BUNDLE-69-002 | TODO | | SPRINT_0164_0000_0003_exportcenter_iii | Risk Bundle Export Guild, DevOps Guild (src/ExportCenter/StellaOps.ExportCenter.RiskBundles) | src/ExportCenter/StellaOps.ExportCenter.RiskBundles | Integrate bundle job into CI/offline kit pipelines with checksum publication. Dependencies: RISK-BUNDLE-69-001. | | | +| RISK-BUNDLE-70-001 | TODO | | SPRINT_0164_0000_0003_exportcenter_iii | Risk Bundle Export Guild, CLI Guild (src/ExportCenter/StellaOps.ExportCenter.RiskBundles) | src/ExportCenter/StellaOps.ExportCenter.RiskBundles | Provide CLI `stella risk bundle verify` command to validate bundles before import. Dependencies: RISK-BUNDLE-69-002. | | | +| RISK-BUNDLE-70-002 | TODO | | SPRINT_0164_0000_0003_exportcenter_iii | Risk Bundle Export Guild, Docs Guild (src/ExportCenter/StellaOps.ExportCenter.RiskBundles) | src/ExportCenter/StellaOps.ExportCenter.RiskBundles | Publish `/docs/airgap/risk-bundles.md` detailing build/import/verification workflows. Dependencies: RISK-BUNDLE-70-001. | | | | RISK-ENGINE-66-001 | DONE (2025-11-25) | 2025-11-25 | SPRINT_0129_0001_0001_policy_reasoning | Risk Engine Guild / src/RiskEngine/StellaOps.RiskEngine | src/RiskEngine/StellaOps.RiskEngine | Scaffold scoring service (job queue, worker loop, provider registry) with deterministic execution harness | | | | RISK-ENGINE-66-002 | DONE | 2025-11-25 | SPRINT_0129_0001_0001_policy_reasoning | Risk Engine Guild / src/RiskEngine/StellaOps.RiskEngine | src/RiskEngine/StellaOps.RiskEngine | Implement default transforms | RISK-ENGINE-66-001 | | | RISK-ENGINE-67-001 | DONE | 2025-11-25 | SPRINT_0129_0001_0001_policy_reasoning | Risk Engine Guild, Concelier Guild / src/RiskEngine/StellaOps.RiskEngine | src/RiskEngine/StellaOps.RiskEngine | Integrate CVSS and KEV providers pulling data from Conseiller; implement reducers | RISK-ENGINE-66-002 | | @@ -1564,8 +1564,8 @@ | SAMPLES-GRAPH-24-004 | DONE (2025-12-02) | | SPRINT_509_samples | Samples Guild, UI Guild (samples) | | Create vulnerability explorer JSON/CSV fixtures capturing conflicting evidence and policy outputs for UI/CLI automated tests. Dependencies: SAMPLES-GRAPH-24-003 (delivered at samples/graph/graph-40k). | | | | SAMPLES-LNM-22-001 | BLOCKED | 2025-10-27 | SPRINT_509_samples | Samples Guild, Concelier Guild (samples) | | Create advisory observation/linkset fixtures (NVD, GHSA, OSV disagreements) for API/CLI/UI tests with documented conflicts. Waiting on finalized schema/linkset outputs. | | | | SAMPLES-LNM-22-002 | BLOCKED | 2025-10-27 | SPRINT_509_samples | Samples Guild, Excititor Guild (samples) | | Produce VEX observation/linkset fixtures demonstrating status conflicts and path relevance; include raw blobs. Pending Excititor observation/linkset implementation. Dependencies: SAMPLES-LNM-22-001. | | | -| SBOM-60-001 | TODO | | SPRINT_203_cli_iii | DevEx/CLI Guild (src/Cli/StellaOps.Cli) | src/Cli/StellaOps.Cli | | | | -| SBOM-60-002 | TODO | | SPRINT_203_cli_iii | DevEx/CLI Guild (src/Cli/StellaOps.Cli) | src/Cli/StellaOps.Cli | | | | +| SBOM-60-001 | TODO | | SPRINT_0203_0000_0003_cli_iii | DevEx/CLI Guild (src/Cli/StellaOps.Cli) | src/Cli/StellaOps.Cli | | | | +| SBOM-60-002 | TODO | | SPRINT_0203_0000_0003_cli_iii | DevEx/CLI Guild (src/Cli/StellaOps.Cli) | src/Cli/StellaOps.Cli | | | | | SBOM-AIAI-31-001 | TODO | | SPRINT_0140_0001_0001_runtime_signals | — | | Advisory AI path/timeline endpoints specced; awaiting projection schema finalization. | — | DOAI0101 | | SBOM-AIAI-31-002 | TODO | | SPRINT_0140_0001_0001_runtime_signals | | | Metrics/dashboards tied to 31-001; blocked on the same schema availability. | | | | SBOM-AIAI-31-003 | BLOCKED | 2025-11-18 | SPRINT_0111_0001_0001_advisoryai | SBOM Service Guild · Advisory AI Guild (src/SbomService/StellaOps.SbomService) | src/SbomService/StellaOps.SbomService | Publish the Advisory AI hand-off kit for `/v1/sbom/context`, share base URL/API key + tenant header contract, and run a joint end-to-end retrieval smoke test with Advisory AI. | SBOM-AIAI-31-001 projection kit/fixtures | ADAI0101 | @@ -1585,15 +1585,15 @@ | SBOM-VULN-29-002 | TODO | | SPRINT_0140_0001_0001_runtime_signals | | | Resolver feed requires 29-001 event payloads. | | | | SCAN-001 | TODO | | SPRINT_400_runtime_facts_static_callgraph_union | Scanner Worker Guild (`src/Scanner/StellaOps.Scanner.Worker`, `docs/modules/scanner/architecture.md`, `docs/reachability/function-level-evidence.md`) | `src/Scanner/StellaOps.Scanner.Worker`, `docs/modules/scanner/architecture.md`, `docs/reachability/function-level-evidence.md` | | | | | SCAN-90-004 | TODO | | SPRINT_0505_0001_0001_ops_devops_iii | DevOps Guild, Scanner Guild (ops/devops) | ops/devops | | | | -| SCAN-DETER-186-008 | DONE (2025-11-26) | | SPRINT_186_record_deterministic_execution | Scanner Guild · Provenance Guild | `src/Scanner/StellaOps.Scanner.WebService`, `src/Scanner/StellaOps.Scanner.Worker` | Add deterministic execution switches to Scanner (fixed clock, RNG seed, concurrency cap, feed/policy snapshot pins, log filtering) available via CLI/env/config so repeated runs stay hermetic. | ENTROPY-186-012 & SCANNER-ENV-02 | SCDE0102 | -| SCAN-DETER-186-009 | DONE (2025-11-27) | | SPRINT_186_record_deterministic_execution | Scanner Guild, QA Guild (`src/Scanner/StellaOps.Scanner.Replay`, `src/Scanner/__Tests`) | `src/Scanner/StellaOps.Scanner.Replay`, `src/Scanner/__Tests` | Build a determinism harness that replays N scans per image, canonicalises SBOM/VEX/findings/log outputs, and records per-run hash matrices (see `docs/modules/scanner/determinism-score.md`). | | | -| SCAN-DETER-186-010 | DONE (2025-11-27) | | SPRINT_186_record_deterministic_execution | Scanner Guild, Export Center Guild (`src/Scanner/StellaOps.Scanner.WebService`, `docs/modules/scanner/operations/release.md`) | `src/Scanner/StellaOps.Scanner.WebService`, `docs/modules/scanner/operations/release.md` | Emit and publish `determinism.json` (scores, artifact hashes, non-identical diffs) alongside each scanner release via CAS/object storage APIs (documented in `docs/modules/scanner/determinism-score.md`). | | | -| SCAN-ENTROPY-186-011 | DONE (2025-11-26) | | SPRINT_186_record_deterministic_execution | Scanner Guild (`src/Scanner/StellaOps.Scanner.Worker`, `src/Scanner/__Libraries`) | `src/Scanner/StellaOps.Scanner.Worker`, `src/Scanner/__Libraries` | Implement entropy analysis for ELF/PE/Mach-O executables and large opaque blobs (sliding-window metrics, section heuristics), flagging high-entropy regions and recording offsets/hints (see `docs/modules/scanner/entropy.md`). | | | -| SCAN-ENTROPY-186-012 | DONE (2025-11-26) | | SPRINT_186_record_deterministic_execution | Scanner Guild, Provenance Guild (`src/Scanner/StellaOps.Scanner.WebService`, `docs/replay/DETERMINISTIC_REPLAY.md`) | `src/Scanner/StellaOps.Scanner.WebService`, `docs/replay/DETERMINISTIC_REPLAY.md` | Generate `entropy.report.json` and image-level penalties, attach evidence to scan manifests/attestations, and expose opaque ratios for downstream policy engines (`docs/modules/scanner/entropy.md`). | | | +| SCAN-DETER-186-008 | DONE (2025-11-26) | | SPRINT_0186_0000_0001_record_deterministic_execution | Scanner Guild · Provenance Guild | `src/Scanner/StellaOps.Scanner.WebService`, `src/Scanner/StellaOps.Scanner.Worker` | Add deterministic execution switches to Scanner (fixed clock, RNG seed, concurrency cap, feed/policy snapshot pins, log filtering) available via CLI/env/config so repeated runs stay hermetic. | ENTROPY-186-012 & SCANNER-ENV-02 | SCDE0102 | +| SCAN-DETER-186-009 | DONE (2025-11-27) | | SPRINT_0186_0000_0001_record_deterministic_execution | Scanner Guild, QA Guild (`src/Scanner/StellaOps.Scanner.Replay`, `src/Scanner/__Tests`) | `src/Scanner/StellaOps.Scanner.Replay`, `src/Scanner/__Tests` | Build a determinism harness that replays N scans per image, canonicalises SBOM/VEX/findings/log outputs, and records per-run hash matrices (see `docs/modules/scanner/determinism-score.md`). | | | +| SCAN-DETER-186-010 | DONE (2025-11-27) | | SPRINT_0186_0000_0001_record_deterministic_execution | Scanner Guild, Export Center Guild (`src/Scanner/StellaOps.Scanner.WebService`, `docs/modules/scanner/operations/release.md`) | `src/Scanner/StellaOps.Scanner.WebService`, `docs/modules/scanner/operations/release.md` | Emit and publish `determinism.json` (scores, artifact hashes, non-identical diffs) alongside each scanner release via CAS/object storage APIs (documented in `docs/modules/scanner/determinism-score.md`). | | | +| SCAN-ENTROPY-186-011 | DONE (2025-11-26) | | SPRINT_0186_0000_0001_record_deterministic_execution | Scanner Guild (`src/Scanner/StellaOps.Scanner.Worker`, `src/Scanner/__Libraries`) | `src/Scanner/StellaOps.Scanner.Worker`, `src/Scanner/__Libraries` | Implement entropy analysis for ELF/PE/Mach-O executables and large opaque blobs (sliding-window metrics, section heuristics), flagging high-entropy regions and recording offsets/hints (see `docs/modules/scanner/entropy.md`). | | | +| SCAN-ENTROPY-186-012 | DONE (2025-11-26) | | SPRINT_0186_0000_0001_record_deterministic_execution | Scanner Guild, Provenance Guild (`src/Scanner/StellaOps.Scanner.WebService`, `docs/replay/DETERMINISTIC_REPLAY.md`) | `src/Scanner/StellaOps.Scanner.WebService`, `docs/replay/DETERMINISTIC_REPLAY.md` | Generate `entropy.report.json` and image-level penalties, attach evidence to scan manifests/attestations, and expose opaque ratios for downstream policy engines (`docs/modules/scanner/entropy.md`). | | | | SCAN-REACH-201-002 | DOING | 2025-11-08 | SPRINT_400_runtime_facts_static_callgraph_union | Scanner Worker Guild (`src/Scanner/StellaOps.Scanner.Worker`) | `src/Scanner/StellaOps.Scanner.Worker` | Ship language-aware static lifters (JVM, .NET/Roslyn+IL, Go SSA, Node/Deno TS AST, Rust MIR, Swift SIL, shell/binary analyzers) in Scanner Worker; emit canonical SymbolIDs, CAS-stored graphs, and attach reachability tags to SBOM components. | | | | SCAN-REACH-401-009 | TODO | | SPRINT_0401_0001_0001_reachability_evidence_chain | Scanner Worker Guild (`src/Scanner/StellaOps.Scanner.Worker`, `src/Scanner/__Libraries`) | `src/Scanner/StellaOps.Scanner.Worker`, `src/Scanner/__Libraries` | Ship .NET/JVM symbolizers and call-graph generators (roots, edges, framework adapters), merge results into component-level reachability manifests, and back them with golden fixtures. | | | -| SCAN-REPLAY-186-001 | DONE (2025-11-26) | | SPRINT_186_record_deterministic_execution | Scanner Guild (`src/Scanner/StellaOps.Scanner.WebService`, `docs/modules/scanner/architecture.md`) | `src/Scanner/StellaOps.Scanner.WebService`, `docs/modules/scanner/architecture.md` | Implement `record` mode in `StellaOps.Scanner.WebService` (manifest assembly, policy/feed/tool hash capture, CAS uploads) and document the workflow in `docs/modules/scanner/architecture.md` with references to `docs/replay/DETERMINISTIC_REPLAY.md` Section 6. | | | -| SCAN-REPLAY-186-002 | DOING (2025-11-27) | | SPRINT_186_record_deterministic_execution | Scanner Guild (`src/Scanner/StellaOps.Scanner.Worker`, `docs/modules/scanner/deterministic-execution.md`) | `src/Scanner/StellaOps.Scanner.Worker`, `docs/modules/scanner/deterministic-execution.md` | Update `StellaOps.Scanner.Worker` analyzers to consume sealed input bundles, enforce deterministic ordering, and contribute Merkle metadata; extend `docs/modules/scanner/deterministic-execution.md` (new) summarising invariants drawn from `docs/replay/DETERMINISTIC_REPLAY.md` Section 4. | | | +| SCAN-REPLAY-186-001 | DONE (2025-11-26) | | SPRINT_0186_0000_0001_record_deterministic_execution | Scanner Guild (`src/Scanner/StellaOps.Scanner.WebService`, `docs/modules/scanner/architecture.md`) | `src/Scanner/StellaOps.Scanner.WebService`, `docs/modules/scanner/architecture.md` | Implement `record` mode in `StellaOps.Scanner.WebService` (manifest assembly, policy/feed/tool hash capture, CAS uploads) and document the workflow in `docs/modules/scanner/architecture.md` with references to `docs/replay/DETERMINISTIC_REPLAY.md` Section 6. | | | +| SCAN-REPLAY-186-002 | DOING (2025-11-27) | | SPRINT_0186_0000_0001_record_deterministic_execution | Scanner Guild (`src/Scanner/StellaOps.Scanner.Worker`, `docs/modules/scanner/deterministic-execution.md`) | `src/Scanner/StellaOps.Scanner.Worker`, `docs/modules/scanner/deterministic-execution.md` | Update `StellaOps.Scanner.Worker` analyzers to consume sealed input bundles, enforce deterministic ordering, and contribute Merkle metadata; extend `docs/modules/scanner/deterministic-execution.md` (new) summarising invariants drawn from `docs/replay/DETERMINISTIC_REPLAY.md` Section 4. | | | | SCANNER-ANALYZERS-DENO-26-001 | DONE | | SPRINT_130_scanner_surface | Deno Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Deno) | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Deno | Build the deterministic input normalizer + VFS merger for `deno.json(c)`, import maps, lockfiles, vendor trees, `$DENO_DIR`, and OCI layers so analyzers have a canonical file view. | | | | SCANNER-ANALYZERS-DENO-26-002 | DONE | | SPRINT_130_scanner_surface | Deno Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Deno) | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Deno | Implement the module graph resolver covering static/dynamic imports, npm bridge, cache lookups, built-ins, WASM/JSON assertions, and annotate edges with their resolution provenance. | SCANNER-ANALYZERS-DENO-26-001 | | | SCANNER-ANALYZERS-DENO-26-003 | DONE | | SPRINT_130_scanner_surface | Deno Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Deno) | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Deno | Ship the npm/node compatibility adapter that maps `npm:` specifiers, evaluates `exports` conditionals, and logs builtin usage for policy overlays. | SCANNER-ANALYZERS-DENO-26-002 | | @@ -1613,68 +1613,68 @@ | SCANNER-ANALYZERS-JAVA-21-010 | TODO | | SPRINT_131_scanner_surface | Java Analyzer Guild, Signals Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Java) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Java | Optional runtime ingestion: Java agent + JFR reader capturing class load, ServiceLoader, and System.load events with path scrubbing. Emit append-only runtime edges `runtime-class`/`runtime-spi`/`runtime-load`. | SCANNER-ANALYZERS-JAVA-21-009 | | | SCANNER-ANALYZERS-JAVA-21-011 | TODO | | SPRINT_131_scanner_surface | Java Analyzer Guild, DevOps Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Java) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Java | Package analyzer as restart-time plug-in (manifest/DI), update Offline Kit docs, add CLI/worker hooks for Java inspection commands. | SCANNER-ANALYZERS-JAVA-21-010 | | | SCANNER-ANALYZERS-LANG-11-001 | TODO | | SPRINT_131_scanner_surface | StellaOps.Scanner EPDR Guild, Language Analyzer Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.DotNet) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.DotNet | Build entrypoint resolver that maps project/publish artifacts to entrypoint identities (assembly name, MVID, TFM, RID) and environment profiles (publish mode, host kind, probing paths). Output normalized `entrypoints[]` records with deterministic IDs. | SCANNER-ANALYZERS-LANG-10-309 | | -| SCANNER-ANALYZERS-LANG-11-002 | TODO | | SPRINT_132_scanner_surface | StellaOps.Scanner EPDR Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.DotNet) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.DotNet | Implement static analyzer (IL + reflection heuristics) capturing AssemblyRef, ModuleRef/PInvoke, DynamicDependency, reflection literals, DI patterns, and custom AssemblyLoadContext probing hints. Emit dependency edges with reason codes and confidence. | SCANNER-ANALYZERS-LANG-11-001 | | -| SCANNER-ANALYZERS-LANG-11-003 | TODO | | SPRINT_132_scanner_surface | StellaOps.Scanner EPDR Guild, Signals Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.DotNet) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.DotNet | Ingest optional runtime evidence (AssemblyLoad, Resolving, P/Invoke) via event listener harness; merge runtime edges with static/declared ones and attach reason codes/confidence. | SCANNER-ANALYZERS-LANG-11-002 | | -| SCANNER-ANALYZERS-LANG-11-004 | TODO | | SPRINT_132_scanner_surface | StellaOps.Scanner EPDR Guild, SBOM Service Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.DotNet) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.DotNet | Produce normalized observation export to Scanner writer: entrypoints + dependency edges + environment profiles (AOC compliant). Wire to SBOM service entrypoint tagging. | SCANNER-ANALYZERS-LANG-11-003 | | -| SCANNER-ANALYZERS-LANG-11-005 | TODO | | SPRINT_132_scanner_surface | StellaOps.Scanner EPDR Guild, QA Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.DotNet) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.DotNet | Add comprehensive fixtures/benchmarks covering framework-dependent, self-contained, single-file, trimmed, NativeAOT, multi-RID scenarios; include explain traces and perf benchmarks vs previous analyzer. | SCANNER-ANALYZERS-LANG-11-004 | | -| SCANNER-ANALYZERS-NATIVE-20-001 | TODO | | SPRINT_132_scanner_surface | Native Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Native) | src/Scanner/StellaOps.Scanner.Analyzers.Native | Implement format detector and binary identity model supporting ELF, PE/COFF, and Mach-O (including fat slices). Capture arch, OS, build-id/UUID, interpreter metadata. | | | -| SCANNER-ANALYZERS-NATIVE-20-002 | TODO | | SPRINT_132_scanner_surface | Native Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Native) | src/Scanner/StellaOps.Scanner.Analyzers.Native | Parse ELF dynamic sections: `DT_NEEDED`, `DT_RPATH`, `DT_RUNPATH`, symbol versions, interpreter, and note build-id. Emit declared dependency records with reason `elf-dtneeded` and attach version needs. | SCANNER-ANALYZERS-NATIVE-20-001 | | -| SCANNER-ANALYZERS-NATIVE-20-003 | TODO | | SPRINT_132_scanner_surface | Native Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Native) | src/Scanner/StellaOps.Scanner.Analyzers.Native | Parse PE imports, delay-load tables, manifests/SxS metadata, and subsystem flags. Emit edges with reasons `pe-import` and `pe-delayimport`, plus SxS policy metadata. | SCANNER-ANALYZERS-NATIVE-20-002 | | -| SCANNER-ANALYZERS-NATIVE-20-004 | TODO | | SPRINT_132_scanner_surface | Native Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Native) | src/Scanner/StellaOps.Scanner.Analyzers.Native | Parse Mach-O load commands (`LC_LOAD_DYLIB`, `LC_REEXPORT_DYLIB`, `LC_RPATH`, `LC_UUID`, fat headers). Handle `@rpath/@loader_path` placeholders and slice separation. | SCANNER-ANALYZERS-NATIVE-20-003 | | -| SCANNER-ANALYZERS-NATIVE-20-005 | TODO | | SPRINT_132_scanner_surface | Native Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Native) | src/Scanner/StellaOps.Scanner.Analyzers.Native | Implement resolver engine modeling loader search order for ELF (rpath/runpath/cache/default), PE (SafeDll search + SxS), and Mach-O (`@rpath` expansion). Works against virtual image roots, producing explain traces. | SCANNER-ANALYZERS-NATIVE-20-004 | | -| SCANNER-ANALYZERS-NATIVE-20-006 | TODO | | SPRINT_132_scanner_surface | Native Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Native) | src/Scanner/StellaOps.Scanner.Analyzers.Native | Build heuristic scanner for `dlopen`/`LoadLibrary` strings, plugin ecosystem configs, and Go/Rust static hints. Emit edges with `reason_code` (`string-dlopen`, `config-plugin`, `ecosystem-heuristic`) and confidence levels. | SCANNER-ANALYZERS-NATIVE-20-005 | | -| SCANNER-ANALYZERS-NATIVE-20-007 | TODO | | SPRINT_132_scanner_surface | Native Analyzer Guild, SBOM Service Guild (src/Scanner/StellaOps.Scanner.Analyzers.Native) | src/Scanner/StellaOps.Scanner.Analyzers.Native | Serialize AOC-compliant observations: entrypoints + dependency edges + environment profiles (search paths, interpreter, loader metadata). Integrate with Scanner writer API. | SCANNER-ANALYZERS-NATIVE-20-006 | | -| SCANNER-ANALYZERS-NATIVE-20-008 | TODO | | SPRINT_132_scanner_surface | Native Analyzer Guild, QA Guild (src/Scanner/StellaOps.Scanner.Analyzers.Native) | src/Scanner/StellaOps.Scanner.Analyzers.Native | Author cross-platform fixtures (ELF dynamic/static, PE delay-load/SxS, Mach-O @rpath, plugin configs) and determinism benchmarks (<25 ms / binary, <250 MB). | SCANNER-ANALYZERS-NATIVE-20-007 | | -| SCANNER-ANALYZERS-NATIVE-20-009 | TODO | | SPRINT_132_scanner_surface | Native Analyzer Guild, Signals Guild (src/Scanner/StellaOps.Scanner.Analyzers.Native) | src/Scanner/StellaOps.Scanner.Analyzers.Native | Provide optional runtime capture adapters (Linux eBPF `dlopen`, Windows ETW ImageLoad, macOS dyld interpose) writing append-only runtime evidence. Include redaction/sandbox guidance. | SCANNER-ANALYZERS-NATIVE-20-008 | | -| SCANNER-ANALYZERS-NATIVE-20-010 | TODO | | SPRINT_132_scanner_surface | Native Analyzer Guild, DevOps Guild (src/Scanner/StellaOps.Scanner.Analyzers.Native) | src/Scanner/StellaOps.Scanner.Analyzers.Native | Package native analyzer as restart-time plug-in with manifest/DI registration; update Offline Kit bundle + documentation. | SCANNER-ANALYZERS-NATIVE-20-009 | | -| SCANNER-ANALYZERS-NODE-22-001 | TODO | | SPRINT_132_scanner_surface | Node Analyzer Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node | Build input normalizer + VFS for Node projects: dirs, tgz, container layers, pnpm store, Yarn PnP zips; detect Node version targets (`.nvmrc`, `.node-version`, Dockerfile) and workspace roots deterministically. | | | -| SCANNER-ANALYZERS-NODE-22-002 | TODO | | SPRINT_132_scanner_surface | Node Analyzer Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node | Implement entrypoint discovery (bin/main/module/exports/imports, workers, electron, shebang scripts) and condition set builder per entrypoint. | SCANNER-ANALYZERS-NODE-22-001 | | -| SCANNER-ANALYZERS-NODE-22-003 | TODO | | SPRINT_132_scanner_surface | Node Analyzer Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node | Parse JS/TS sources for static `import`, `require`, `import()` and string concat cases; flag dynamic patterns with confidence levels; support source map de-bundling. | SCANNER-ANALYZERS-NODE-22-002 | | -| SCANNER-ANALYZERS-NODE-22-004 | TODO | | SPRINT_132_scanner_surface | Node Analyzer Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node | Implement Node resolver engine for CJS + ESM (core modules, exports/imports maps, conditions, extension priorities, self-references) parameterised by node_version. | SCANNER-ANALYZERS-NODE-22-003 | | -| SCANNER-ANALYZERS-NODE-22-005 | TODO | | SPRINT_132_scanner_surface | Node Analyzer Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node | Add package manager adapters: Yarn PnP (.pnp.data/.pnp.cjs), pnpm virtual store, npm/Yarn classic hoists; operate entirely in virtual FS. | SCANNER-ANALYZERS-NODE-22-004 | | -| SCANNER-ANALYZERS-NODE-22-006 | TODO | | SPRINT_133_scanner_surface | Node Analyzer Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node | Detect bundles + source maps, reconstruct module specifiers, and correlate to original paths; support dual CJS/ESM graphs with conditions. | SCANNER-ANALYZERS-NODE-22-005 | | -| SCANNER-ANALYZERS-NODE-22-007 | TODO | | SPRINT_133_scanner_surface | Node Analyzer Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node | Scan for native addons (.node), WASM modules, and core capability signals (child_process, vm, worker_threads); emit hint edges and native metadata. | SCANNER-ANALYZERS-NODE-22-006 | | -| SCANNER-ANALYZERS-NODE-22-008 | TODO | | SPRINT_133_scanner_surface | Node Analyzer Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node | Produce AOC-compliant observations: entrypoints, components (pkg/native/wasm), edges (esm-import, cjs-require, exports, json, native-addon, wasm, worker) with reason codes/confidence and resolver traces. | SCANNER-ANALYZERS-NODE-22-007 | | -| SCANNER-ANALYZERS-NODE-22-009 | TODO | | SPRINT_133_scanner_surface | Node Analyzer Guild, QA Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node | Author fixture suite + performance benchmarks (npm, pnpm, PnP, bundle, electron, worker) with golden outputs and latency budgets. | SCANNER-ANALYZERS-NODE-22-008 | | -| SCANNER-ANALYZERS-NODE-22-010 | TODO | | SPRINT_133_scanner_surface | Node Analyzer Guild, Signals Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node | Implement optional runtime evidence hooks (ESM loader, CJS require hook) with path scrubbing and loader ID hashing; emit runtime-* edges. | SCANNER-ANALYZERS-NODE-22-009 | | -| SCANNER-ANALYZERS-NODE-22-011 | TODO | | SPRINT_133_scanner_surface | Node Analyzer Guild, DevOps Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node | Package updated analyzer as restart-time plug-in, expose Scanner CLI (`stella node *`) commands, refresh Offline Kit documentation. | SCANNER-ANALYZERS-NODE-22-010 | | -| SCANNER-ANALYZERS-NODE-22-012 | TODO | | SPRINT_133_scanner_surface | Node Analyzer Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node | Integrate container filesystem adapter (OCI layers, Dockerfile hints) and record NODE_OPTIONS/env warnings. | SCANNER-ANALYZERS-NODE-22-011 | | -| SCANNER-ANALYZERS-PHP-27-001 | TODO | | SPRINT_133_scanner_surface | PHP Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php) | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php | Build input normalizer & VFS for PHP projects: merge source trees, composer manifests, vendor/, php.ini/conf.d, `.htaccess`, FPM configs, container layers. Detect framework/CMS fingerprints deterministically. | — | SCSA0101 | -| SCANNER-ANALYZERS-PHP-27-002 | TODO | | SPRINT_133_scanner_surface | PHP Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php) | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php | Composer/Autoload analyzer: parse composer.json/lock/installed.json, generate package nodes, autoload edges (psr-4/0/classmap/files), bin entrypoints, composer plugins. | SCANNER-ANALYZERS-PHP-27-001 | | -| SCANNER-ANALYZERS-PHP-27-003 | TODO | | SPRINT_133_scanner_surface | PHP Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php) | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php | Include/require graph builder: resolve static includes, capture dynamic include patterns, bootstrap chains, merge with autoload edges. | SCANNER-ANALYZERS-PHP-27-002 | | -| SCANNER-ANALYZERS-PHP-27-004 | TODO | | SPRINT_133_scanner_surface | PHP Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php) | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php | Runtime capability scanner: detect exec/fs/net/env/serialization/crypto/database usage, stream wrappers, uploads; record evidence snippets. | SCANNER-ANALYZERS-PHP-27-003 | | -| SCANNER-ANALYZERS-PHP-27-005 | TODO | | SPRINT_133_scanner_surface | PHP Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php) | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php | PHAR/Archive inspector: parse phar manifests/stubs, hash files, detect embedded vendor trees and phar:// usage. | SCANNER-ANALYZERS-PHP-27-004 | | -| SCANNER-ANALYZERS-PHP-27-006 | TODO | | SPRINT_133_scanner_surface | PHP Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php) | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php | Framework/CMS surface mapper: extract routes, controllers, middleware, CLI/cron entrypoints for Laravel/Symfony/Slim/WordPress/Drupal/Magento. | SCANNER-ANALYZERS-PHP-27-005 | | -| SCANNER-ANALYZERS-PHP-27-007 | TODO | | SPRINT_133_scanner_surface | PHP Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php) | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php | Container & extension detector: parse php.ini/conf.d, map extensions to .so/.dll, collect web server/FPM settings, upload limits, disable_functions. | SCANNER-ANALYZERS-PHP-27-006 | | -| SCANNER-ANALYZERS-PHP-27-008 | TODO | | SPRINT_134_scanner_surface | PHP Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php) | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php | Produce AOC-compliant observations: entrypoints, packages, extensions, modules, edges (require/autoload), capabilities, routes, configs. | SCANNER-ANALYZERS-PHP-27-002 | | -| SCANNER-ANALYZERS-PHP-27-009 | TODO | | SPRINT_134_scanner_surface | PHP Analyzer Guild, QA Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php) | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php | Fixture suite + performance benchmarks (Laravel, Symfony, WordPress, legacy, PHAR, container) with golden outputs. | SCANNER-ANALYZERS-PHP-27-007 | | -| SCANNER-ANALYZERS-PHP-27-010 | TODO | | SPRINT_134_scanner_surface | PHP Analyzer Guild, Signals Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php) | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php | Optional runtime evidence hooks (if provided) to ingest audit logs or opcode cache stats with path hashing. | SCANNER-ANALYZERS-PHP-27-009 | | -| SCANNER-ANALYZERS-PHP-27-011 | TODO | | SPRINT_134_scanner_surface | PHP Analyzer Guild, DevOps Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php) | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php | Package analyzer plug-in, add CLI (`stella php inspect`), refresh Offline Kit documentation. | SCANNER-ANALYZERS-PHP-27-010 | | -| SCANNER-ANALYZERS-PHP-27-012 | TODO | | SPRINT_134_scanner_surface | PHP Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php) | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php | Policy signal emitter: extension requirements/presence, dangerous constructs counters, stream wrapper usage, capability summaries. | SCANNER-ANALYZERS-PHP-27-011 | | -| SCANNER-ANALYZERS-PYTHON-23-001 | TODO | | SPRINT_134_scanner_surface | Python Analyzer Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python | Build input normalizer & virtual filesystem for wheels, sdists, editable installs, zipapps, site-packages trees, and container roots. Detect Python version targets (`pyproject.toml`, `runtime.txt`, Dockerfile) + virtualenv layout deterministically. | | | -| SCANNER-ANALYZERS-PYTHON-23-002 | TODO | | SPRINT_134_scanner_surface | Python Analyzer Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python | Entrypoint discovery: module `__main__`, console_scripts entry points, `scripts`, zipapp main, `manage.py`/gunicorn/celery patterns. Capture invocation context (module vs package, argv wrappers). | SCANNER-ANALYZERS-PYTHON-23-001 | | -| SCANNER-ANALYZERS-PYTHON-23-003 | TODO | | SPRINT_134_scanner_surface | Python Analyzer Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python | Static import graph builder using AST and bytecode fallback. Support `import`, `from ... import`, relative imports, `importlib.import_module`, `__import__` with literal args, `pkgutil.extend_path`. | SCANNER-ANALYZERS-PYTHON-23-002 | | -| SCANNER-ANALYZERS-PYTHON-23-004 | TODO | | SPRINT_134_scanner_surface | Python Analyzer Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python | Python resolver engine (importlib semantics) handling namespace packages (PEP 420), package discovery order, `.pth` files, `sys.path` composition, zipimport, and site-packages precedence across virtualenv/container roots. | SCANNER-ANALYZERS-PYTHON-23-003 | | -| SCANNER-ANALYZERS-PYTHON-23-005 | TODO | | SPRINT_134_scanner_surface | Python Analyzer Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python | Packaging adapters: pip editable (`.egg-link`), Poetry/Flit layout, Conda prefix, `.dist-info/RECORD` cross-check, container layer overlays. | SCANNER-ANALYZERS-PYTHON-23-004 | | -| SCANNER-ANALYZERS-PYTHON-23-006 | TODO | | SPRINT_134_scanner_surface | Python Analyzer Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python | Detect native extensions (`*.so`, `*.pyd`), CFFI modules, ctypes loaders, embedded WASM, and runtime capability signals (subprocess, multiprocessing, ctypes, eval). | SCANNER-ANALYZERS-PYTHON-23-005 | | -| SCANNER-ANALYZERS-PYTHON-23-007 | TODO | | SPRINT_134_scanner_surface | Python Analyzer Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python | Framework/config heuristics: Django, Flask, FastAPI, Celery, AWS Lambda handlers, Gunicorn, Click/Typer CLIs, logging configs, pyproject optional dependencies. Tagged as hints only. | SCANNER-ANALYZERS-PYTHON-23-006 | | -| SCANNER-ANALYZERS-PYTHON-23-008 | TODO | | SPRINT_134_scanner_surface | Python Analyzer Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python | Produce AOC-compliant observations: entrypoints, components (modules/packages/native), edges (import, namespace, dynamic-hint, native-extension) with reason codes/confidence and resolver traces. | SCANNER-ANALYZERS-PYTHON-23-007 | | -| SCANNER-ANALYZERS-PYTHON-23-009 | TODO | | SPRINT_134_scanner_surface | Python Analyzer Guild, QA Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python | Fixture suite + perf benchmarks covering virtualenv, namespace packages, zipapp, editable installs, containers, lambda handler. | SCANNER-ANALYZERS-PYTHON-23-008 | | -| SCANNER-ANALYZERS-PYTHON-23-010 | TODO | | SPRINT_134_scanner_surface | Python Analyzer Guild, Signals Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python | Optional runtime evidence: import hook capturing module load events with path scrubbing, optional bytecode instrumentation for `importlib` hooks, multiprocessing tracer. | SCANNER-ANALYZERS-PYTHON-23-009 | | -| SCANNER-ANALYZERS-PYTHON-23-011 | TODO | | SPRINT_134_scanner_surface | Python Analyzer Guild, DevOps Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python | Package analyzer plug-in, add CLI commands (`stella python inspect`), refresh Offline Kit documentation. | SCANNER-ANALYZERS-PYTHON-23-010 | | -| SCANNER-ANALYZERS-PYTHON-23-012 | TODO | | SPRINT_135_scanner_surface | Python Analyzer Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python | Container/zipapp adapter enhancements: parse OCI layers for Python runtime, detect `PYTHONPATH`/`PYTHONHOME` env, record warnings for sitecustomize/startup hooks. | SCANNER-ANALYZERS-PYTHON-23-011 | | -| SCANNER-ANALYZERS-RUBY-28-001 | TODO | | SPRINT_135_scanner_surface | Ruby Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby) | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby | Build input normalizer & VFS for Ruby projects: merge source trees, Gemfile/Gemfile.lock, vendor/bundle, .gem archives, `.bundle/config`, Rack configs, containers. Detect framework/job fingerprints deterministically. | | | -| SCANNER-ANALYZERS-RUBY-28-002 | TODO | | SPRINT_135_scanner_surface | Ruby Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby) | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby | Gem & Bundler analyzer: parse Gemfile/Gemfile.lock, vendor specs, .gem archives, produce package nodes (PURLs), dependency edges, bin scripts, Bundler group metadata. | SCANNER-ANALYZERS-RUBY-28-001 | | -| SCANNER-ANALYZERS-RUBY-28-003 | TODO | | SPRINT_135_scanner_surface | Ruby Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby) | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby | Require/autoload graph builder: resolve static/dynamic require, require_relative, load; infer Zeitwerk autoload paths and Rack boot chain. | SCANNER-ANALYZERS-RUBY-28-002 | | -| SCANNER-ANALYZERS-RUBY-28-004 | TODO | | SPRINT_135_scanner_surface | Ruby Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby) | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby | Framework surface mapper: extract routes/controllers/middleware for Rails/Rack/Sinatra/Grape/Hanami; inventory jobs/schedulers (Sidekiq, Resque, ActiveJob, whenever, clockwork). | SCANNER-ANALYZERS-RUBY-28-003 | | -| SCANNER-ANALYZERS-RUBY-28-005 | TODO | | SPRINT_135_scanner_surface | Ruby Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby) | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby | Capability analyzer: detect os-exec, filesystem, network, serialization, crypto, DB usage, TLS posture, dynamic eval; record evidence snippets with file/line. | SCANNER-ANALYZERS-RUBY-28-004 | | -| SCANNER-ANALYZERS-RUBY-28-006 | TODO | | SPRINT_135_scanner_surface | Ruby Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby) | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby | Rake task & scheduler analyzer: parse Rakefiles/lib/tasks, capture task names/prereqs/shell commands; parse Sidekiq/whenever/clockwork configs into schedules. | SCANNER-ANALYZERS-RUBY-28-005 | | -| SCANNER-ANALYZERS-RUBY-28-007 | TODO | | SPRINT_135_scanner_surface | Ruby Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby) | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby | Container/runtime scanner: detect Ruby version, installed gems, native extensions, web server configs in OCI layers. | SCANNER-ANALYZERS-RUBY-28-006 | | -| SCANNER-ANALYZERS-RUBY-28-008 | TODO | | SPRINT_135_scanner_surface | Ruby Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby) | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby | Produce AOC-compliant observations: entrypoints, packages, modules, edges (require/autoload), routes, jobs, tasks, capabilities, configs, warnings. | SCANNER-ANALYZERS-RUBY-28-007 | | -| SCANNER-ANALYZERS-RUBY-28-009 | TODO | | SPRINT_135_scanner_surface | Ruby Analyzer Guild, QA Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby) | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby | Fixture suite + performance benchmarks (Rails, Rack, Sinatra, Sidekiq, legacy, .gem, container) with golden outputs. | SCANNER-ANALYZERS-RUBY-28-008 | | -| SCANNER-ANALYZERS-RUBY-28-010 | TODO | | SPRINT_135_scanner_surface | Ruby Analyzer Guild, Signals Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby) | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby | Optional runtime evidence integration (if provided logs/metrics) with path hashing, without altering static precedence. | SCANNER-ANALYZERS-RUBY-28-009 | | -| SCANNER-ANALYZERS-RUBY-28-011 | TODO | | SPRINT_135_scanner_surface | Ruby Analyzer Guild, DevOps Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby) | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby | Package analyzer plug-in, add CLI (`stella ruby inspect`), refresh Offline Kit documentation. | SCANNER-ANALYZERS-RUBY-28-010 | | -| SCANNER-ANALYZERS-RUBY-28-012 | TODO | | SPRINT_135_scanner_surface | Ruby Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby) | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby | Policy signal emitter: rubygems drift, native extension flags, dangerous constructs counts, TLS verify posture, dynamic require eval warnings. | SCANNER-ANALYZERS-RUBY-28-011 | | +| SCANNER-ANALYZERS-LANG-11-002 | TODO | | SPRINT_0132_0000_0001_scanner_surface | StellaOps.Scanner EPDR Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.DotNet) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.DotNet | Implement static analyzer (IL + reflection heuristics) capturing AssemblyRef, ModuleRef/PInvoke, DynamicDependency, reflection literals, DI patterns, and custom AssemblyLoadContext probing hints. Emit dependency edges with reason codes and confidence. | SCANNER-ANALYZERS-LANG-11-001 | | +| SCANNER-ANALYZERS-LANG-11-003 | TODO | | SPRINT_0132_0000_0001_scanner_surface | StellaOps.Scanner EPDR Guild, Signals Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.DotNet) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.DotNet | Ingest optional runtime evidence (AssemblyLoad, Resolving, P/Invoke) via event listener harness; merge runtime edges with static/declared ones and attach reason codes/confidence. | SCANNER-ANALYZERS-LANG-11-002 | | +| SCANNER-ANALYZERS-LANG-11-004 | TODO | | SPRINT_0132_0000_0001_scanner_surface | StellaOps.Scanner EPDR Guild, SBOM Service Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.DotNet) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.DotNet | Produce normalized observation export to Scanner writer: entrypoints + dependency edges + environment profiles (AOC compliant). Wire to SBOM service entrypoint tagging. | SCANNER-ANALYZERS-LANG-11-003 | | +| SCANNER-ANALYZERS-LANG-11-005 | TODO | | SPRINT_0132_0000_0001_scanner_surface | StellaOps.Scanner EPDR Guild, QA Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.DotNet) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.DotNet | Add comprehensive fixtures/benchmarks covering framework-dependent, self-contained, single-file, trimmed, NativeAOT, multi-RID scenarios; include explain traces and perf benchmarks vs previous analyzer. | SCANNER-ANALYZERS-LANG-11-004 | | +| SCANNER-ANALYZERS-NATIVE-20-001 | TODO | | SPRINT_0132_0000_0001_scanner_surface | Native Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Native) | src/Scanner/StellaOps.Scanner.Analyzers.Native | Implement format detector and binary identity model supporting ELF, PE/COFF, and Mach-O (including fat slices). Capture arch, OS, build-id/UUID, interpreter metadata. | | | +| SCANNER-ANALYZERS-NATIVE-20-002 | TODO | | SPRINT_0132_0000_0001_scanner_surface | Native Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Native) | src/Scanner/StellaOps.Scanner.Analyzers.Native | Parse ELF dynamic sections: `DT_NEEDED`, `DT_RPATH`, `DT_RUNPATH`, symbol versions, interpreter, and note build-id. Emit declared dependency records with reason `elf-dtneeded` and attach version needs. | SCANNER-ANALYZERS-NATIVE-20-001 | | +| SCANNER-ANALYZERS-NATIVE-20-003 | TODO | | SPRINT_0132_0000_0001_scanner_surface | Native Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Native) | src/Scanner/StellaOps.Scanner.Analyzers.Native | Parse PE imports, delay-load tables, manifests/SxS metadata, and subsystem flags. Emit edges with reasons `pe-import` and `pe-delayimport`, plus SxS policy metadata. | SCANNER-ANALYZERS-NATIVE-20-002 | | +| SCANNER-ANALYZERS-NATIVE-20-004 | TODO | | SPRINT_0132_0000_0001_scanner_surface | Native Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Native) | src/Scanner/StellaOps.Scanner.Analyzers.Native | Parse Mach-O load commands (`LC_LOAD_DYLIB`, `LC_REEXPORT_DYLIB`, `LC_RPATH`, `LC_UUID`, fat headers). Handle `@rpath/@loader_path` placeholders and slice separation. | SCANNER-ANALYZERS-NATIVE-20-003 | | +| SCANNER-ANALYZERS-NATIVE-20-005 | TODO | | SPRINT_0132_0000_0001_scanner_surface | Native Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Native) | src/Scanner/StellaOps.Scanner.Analyzers.Native | Implement resolver engine modeling loader search order for ELF (rpath/runpath/cache/default), PE (SafeDll search + SxS), and Mach-O (`@rpath` expansion). Works against virtual image roots, producing explain traces. | SCANNER-ANALYZERS-NATIVE-20-004 | | +| SCANNER-ANALYZERS-NATIVE-20-006 | TODO | | SPRINT_0132_0000_0001_scanner_surface | Native Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Native) | src/Scanner/StellaOps.Scanner.Analyzers.Native | Build heuristic scanner for `dlopen`/`LoadLibrary` strings, plugin ecosystem configs, and Go/Rust static hints. Emit edges with `reason_code` (`string-dlopen`, `config-plugin`, `ecosystem-heuristic`) and confidence levels. | SCANNER-ANALYZERS-NATIVE-20-005 | | +| SCANNER-ANALYZERS-NATIVE-20-007 | TODO | | SPRINT_0132_0000_0001_scanner_surface | Native Analyzer Guild, SBOM Service Guild (src/Scanner/StellaOps.Scanner.Analyzers.Native) | src/Scanner/StellaOps.Scanner.Analyzers.Native | Serialize AOC-compliant observations: entrypoints + dependency edges + environment profiles (search paths, interpreter, loader metadata). Integrate with Scanner writer API. | SCANNER-ANALYZERS-NATIVE-20-006 | | +| SCANNER-ANALYZERS-NATIVE-20-008 | TODO | | SPRINT_0132_0000_0001_scanner_surface | Native Analyzer Guild, QA Guild (src/Scanner/StellaOps.Scanner.Analyzers.Native) | src/Scanner/StellaOps.Scanner.Analyzers.Native | Author cross-platform fixtures (ELF dynamic/static, PE delay-load/SxS, Mach-O @rpath, plugin configs) and determinism benchmarks (<25 ms / binary, <250 MB). | SCANNER-ANALYZERS-NATIVE-20-007 | | +| SCANNER-ANALYZERS-NATIVE-20-009 | TODO | | SPRINT_0132_0000_0001_scanner_surface | Native Analyzer Guild, Signals Guild (src/Scanner/StellaOps.Scanner.Analyzers.Native) | src/Scanner/StellaOps.Scanner.Analyzers.Native | Provide optional runtime capture adapters (Linux eBPF `dlopen`, Windows ETW ImageLoad, macOS dyld interpose) writing append-only runtime evidence. Include redaction/sandbox guidance. | SCANNER-ANALYZERS-NATIVE-20-008 | | +| SCANNER-ANALYZERS-NATIVE-20-010 | TODO | | SPRINT_0132_0000_0001_scanner_surface | Native Analyzer Guild, DevOps Guild (src/Scanner/StellaOps.Scanner.Analyzers.Native) | src/Scanner/StellaOps.Scanner.Analyzers.Native | Package native analyzer as restart-time plug-in with manifest/DI registration; update Offline Kit bundle + documentation. | SCANNER-ANALYZERS-NATIVE-20-009 | | +| SCANNER-ANALYZERS-NODE-22-001 | TODO | | SPRINT_0132_0000_0001_scanner_surface | Node Analyzer Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node | Build input normalizer + VFS for Node projects: dirs, tgz, container layers, pnpm store, Yarn PnP zips; detect Node version targets (`.nvmrc`, `.node-version`, Dockerfile) and workspace roots deterministically. | | | +| SCANNER-ANALYZERS-NODE-22-002 | TODO | | SPRINT_0132_0000_0001_scanner_surface | Node Analyzer Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node | Implement entrypoint discovery (bin/main/module/exports/imports, workers, electron, shebang scripts) and condition set builder per entrypoint. | SCANNER-ANALYZERS-NODE-22-001 | | +| SCANNER-ANALYZERS-NODE-22-003 | TODO | | SPRINT_0132_0000_0001_scanner_surface | Node Analyzer Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node | Parse JS/TS sources for static `import`, `require`, `import()` and string concat cases; flag dynamic patterns with confidence levels; support source map de-bundling. | SCANNER-ANALYZERS-NODE-22-002 | | +| SCANNER-ANALYZERS-NODE-22-004 | TODO | | SPRINT_0132_0000_0001_scanner_surface | Node Analyzer Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node | Implement Node resolver engine for CJS + ESM (core modules, exports/imports maps, conditions, extension priorities, self-references) parameterised by node_version. | SCANNER-ANALYZERS-NODE-22-003 | | +| SCANNER-ANALYZERS-NODE-22-005 | TODO | | SPRINT_0132_0000_0001_scanner_surface | Node Analyzer Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node | Add package manager adapters: Yarn PnP (.pnp.data/.pnp.cjs), pnpm virtual store, npm/Yarn classic hoists; operate entirely in virtual FS. | SCANNER-ANALYZERS-NODE-22-004 | | +| SCANNER-ANALYZERS-NODE-22-006 | TODO | | SPRINT_0133_0000_0001_scanner_surface | Node Analyzer Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node | Detect bundles + source maps, reconstruct module specifiers, and correlate to original paths; support dual CJS/ESM graphs with conditions. | SCANNER-ANALYZERS-NODE-22-005 | | +| SCANNER-ANALYZERS-NODE-22-007 | TODO | | SPRINT_0133_0000_0001_scanner_surface | Node Analyzer Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node | Scan for native addons (.node), WASM modules, and core capability signals (child_process, vm, worker_threads); emit hint edges and native metadata. | SCANNER-ANALYZERS-NODE-22-006 | | +| SCANNER-ANALYZERS-NODE-22-008 | TODO | | SPRINT_0133_0000_0001_scanner_surface | Node Analyzer Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node | Produce AOC-compliant observations: entrypoints, components (pkg/native/wasm), edges (esm-import, cjs-require, exports, json, native-addon, wasm, worker) with reason codes/confidence and resolver traces. | SCANNER-ANALYZERS-NODE-22-007 | | +| SCANNER-ANALYZERS-NODE-22-009 | TODO | | SPRINT_0133_0000_0001_scanner_surface | Node Analyzer Guild, QA Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node | Author fixture suite + performance benchmarks (npm, pnpm, PnP, bundle, electron, worker) with golden outputs and latency budgets. | SCANNER-ANALYZERS-NODE-22-008 | | +| SCANNER-ANALYZERS-NODE-22-010 | TODO | | SPRINT_0133_0000_0001_scanner_surface | Node Analyzer Guild, Signals Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node | Implement optional runtime evidence hooks (ESM loader, CJS require hook) with path scrubbing and loader ID hashing; emit runtime-* edges. | SCANNER-ANALYZERS-NODE-22-009 | | +| SCANNER-ANALYZERS-NODE-22-011 | TODO | | SPRINT_0133_0000_0001_scanner_surface | Node Analyzer Guild, DevOps Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node | Package updated analyzer as restart-time plug-in, expose Scanner CLI (`stella node *`) commands, refresh Offline Kit documentation. | SCANNER-ANALYZERS-NODE-22-010 | | +| SCANNER-ANALYZERS-NODE-22-012 | TODO | | SPRINT_0133_0000_0001_scanner_surface | Node Analyzer Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node | Integrate container filesystem adapter (OCI layers, Dockerfile hints) and record NODE_OPTIONS/env warnings. | SCANNER-ANALYZERS-NODE-22-011 | | +| SCANNER-ANALYZERS-PHP-27-001 | TODO | | SPRINT_0133_0000_0001_scanner_surface | PHP Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php) | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php | Build input normalizer & VFS for PHP projects: merge source trees, composer manifests, vendor/, php.ini/conf.d, `.htaccess`, FPM configs, container layers. Detect framework/CMS fingerprints deterministically. | — | SCSA0101 | +| SCANNER-ANALYZERS-PHP-27-002 | TODO | | SPRINT_0133_0000_0001_scanner_surface | PHP Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php) | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php | Composer/Autoload analyzer: parse composer.json/lock/installed.json, generate package nodes, autoload edges (psr-4/0/classmap/files), bin entrypoints, composer plugins. | SCANNER-ANALYZERS-PHP-27-001 | | +| SCANNER-ANALYZERS-PHP-27-003 | TODO | | SPRINT_0133_0000_0001_scanner_surface | PHP Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php) | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php | Include/require graph builder: resolve static includes, capture dynamic include patterns, bootstrap chains, merge with autoload edges. | SCANNER-ANALYZERS-PHP-27-002 | | +| SCANNER-ANALYZERS-PHP-27-004 | TODO | | SPRINT_0133_0000_0001_scanner_surface | PHP Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php) | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php | Runtime capability scanner: detect exec/fs/net/env/serialization/crypto/database usage, stream wrappers, uploads; record evidence snippets. | SCANNER-ANALYZERS-PHP-27-003 | | +| SCANNER-ANALYZERS-PHP-27-005 | TODO | | SPRINT_0133_0000_0001_scanner_surface | PHP Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php) | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php | PHAR/Archive inspector: parse phar manifests/stubs, hash files, detect embedded vendor trees and phar:// usage. | SCANNER-ANALYZERS-PHP-27-004 | | +| SCANNER-ANALYZERS-PHP-27-006 | TODO | | SPRINT_0133_0000_0001_scanner_surface | PHP Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php) | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php | Framework/CMS surface mapper: extract routes, controllers, middleware, CLI/cron entrypoints for Laravel/Symfony/Slim/WordPress/Drupal/Magento. | SCANNER-ANALYZERS-PHP-27-005 | | +| SCANNER-ANALYZERS-PHP-27-007 | TODO | | SPRINT_0133_0000_0001_scanner_surface | PHP Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php) | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php | Container & extension detector: parse php.ini/conf.d, map extensions to .so/.dll, collect web server/FPM settings, upload limits, disable_functions. | SCANNER-ANALYZERS-PHP-27-006 | | +| SCANNER-ANALYZERS-PHP-27-008 | TODO | | SPRINT_0134_0000_0001_scanner_surface | PHP Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php) | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php | Produce AOC-compliant observations: entrypoints, packages, extensions, modules, edges (require/autoload), capabilities, routes, configs. | SCANNER-ANALYZERS-PHP-27-002 | | +| SCANNER-ANALYZERS-PHP-27-009 | TODO | | SPRINT_0134_0000_0001_scanner_surface | PHP Analyzer Guild, QA Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php) | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php | Fixture suite + performance benchmarks (Laravel, Symfony, WordPress, legacy, PHAR, container) with golden outputs. | SCANNER-ANALYZERS-PHP-27-007 | | +| SCANNER-ANALYZERS-PHP-27-010 | TODO | | SPRINT_0134_0000_0001_scanner_surface | PHP Analyzer Guild, Signals Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php) | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php | Optional runtime evidence hooks (if provided) to ingest audit logs or opcode cache stats with path hashing. | SCANNER-ANALYZERS-PHP-27-009 | | +| SCANNER-ANALYZERS-PHP-27-011 | TODO | | SPRINT_0134_0000_0001_scanner_surface | PHP Analyzer Guild, DevOps Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php) | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php | Package analyzer plug-in, add CLI (`stella php inspect`), refresh Offline Kit documentation. | SCANNER-ANALYZERS-PHP-27-010 | | +| SCANNER-ANALYZERS-PHP-27-012 | TODO | | SPRINT_0134_0000_0001_scanner_surface | PHP Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php) | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php | Policy signal emitter: extension requirements/presence, dangerous constructs counters, stream wrapper usage, capability summaries. | SCANNER-ANALYZERS-PHP-27-011 | | +| SCANNER-ANALYZERS-PYTHON-23-001 | TODO | | SPRINT_0134_0000_0001_scanner_surface | Python Analyzer Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python | Build input normalizer & virtual filesystem for wheels, sdists, editable installs, zipapps, site-packages trees, and container roots. Detect Python version targets (`pyproject.toml`, `runtime.txt`, Dockerfile) + virtualenv layout deterministically. | | | +| SCANNER-ANALYZERS-PYTHON-23-002 | TODO | | SPRINT_0134_0000_0001_scanner_surface | Python Analyzer Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python | Entrypoint discovery: module `__main__`, console_scripts entry points, `scripts`, zipapp main, `manage.py`/gunicorn/celery patterns. Capture invocation context (module vs package, argv wrappers). | SCANNER-ANALYZERS-PYTHON-23-001 | | +| SCANNER-ANALYZERS-PYTHON-23-003 | TODO | | SPRINT_0134_0000_0001_scanner_surface | Python Analyzer Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python | Static import graph builder using AST and bytecode fallback. Support `import`, `from ... import`, relative imports, `importlib.import_module`, `__import__` with literal args, `pkgutil.extend_path`. | SCANNER-ANALYZERS-PYTHON-23-002 | | +| SCANNER-ANALYZERS-PYTHON-23-004 | TODO | | SPRINT_0134_0000_0001_scanner_surface | Python Analyzer Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python | Python resolver engine (importlib semantics) handling namespace packages (PEP 420), package discovery order, `.pth` files, `sys.path` composition, zipimport, and site-packages precedence across virtualenv/container roots. | SCANNER-ANALYZERS-PYTHON-23-003 | | +| SCANNER-ANALYZERS-PYTHON-23-005 | TODO | | SPRINT_0134_0000_0001_scanner_surface | Python Analyzer Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python | Packaging adapters: pip editable (`.egg-link`), Poetry/Flit layout, Conda prefix, `.dist-info/RECORD` cross-check, container layer overlays. | SCANNER-ANALYZERS-PYTHON-23-004 | | +| SCANNER-ANALYZERS-PYTHON-23-006 | TODO | | SPRINT_0134_0000_0001_scanner_surface | Python Analyzer Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python | Detect native extensions (`*.so`, `*.pyd`), CFFI modules, ctypes loaders, embedded WASM, and runtime capability signals (subprocess, multiprocessing, ctypes, eval). | SCANNER-ANALYZERS-PYTHON-23-005 | | +| SCANNER-ANALYZERS-PYTHON-23-007 | TODO | | SPRINT_0134_0000_0001_scanner_surface | Python Analyzer Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python | Framework/config heuristics: Django, Flask, FastAPI, Celery, AWS Lambda handlers, Gunicorn, Click/Typer CLIs, logging configs, pyproject optional dependencies. Tagged as hints only. | SCANNER-ANALYZERS-PYTHON-23-006 | | +| SCANNER-ANALYZERS-PYTHON-23-008 | TODO | | SPRINT_0134_0000_0001_scanner_surface | Python Analyzer Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python | Produce AOC-compliant observations: entrypoints, components (modules/packages/native), edges (import, namespace, dynamic-hint, native-extension) with reason codes/confidence and resolver traces. | SCANNER-ANALYZERS-PYTHON-23-007 | | +| SCANNER-ANALYZERS-PYTHON-23-009 | TODO | | SPRINT_0134_0000_0001_scanner_surface | Python Analyzer Guild, QA Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python | Fixture suite + perf benchmarks covering virtualenv, namespace packages, zipapp, editable installs, containers, lambda handler. | SCANNER-ANALYZERS-PYTHON-23-008 | | +| SCANNER-ANALYZERS-PYTHON-23-010 | TODO | | SPRINT_0134_0000_0001_scanner_surface | Python Analyzer Guild, Signals Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python | Optional runtime evidence: import hook capturing module load events with path scrubbing, optional bytecode instrumentation for `importlib` hooks, multiprocessing tracer. | SCANNER-ANALYZERS-PYTHON-23-009 | | +| SCANNER-ANALYZERS-PYTHON-23-011 | TODO | | SPRINT_0134_0000_0001_scanner_surface | Python Analyzer Guild, DevOps Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python | Package analyzer plug-in, add CLI commands (`stella python inspect`), refresh Offline Kit documentation. | SCANNER-ANALYZERS-PYTHON-23-010 | | +| SCANNER-ANALYZERS-PYTHON-23-012 | TODO | | SPRINT_0135_0000_0001_scanner_surface | Python Analyzer Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python | Container/zipapp adapter enhancements: parse OCI layers for Python runtime, detect `PYTHONPATH`/`PYTHONHOME` env, record warnings for sitecustomize/startup hooks. | SCANNER-ANALYZERS-PYTHON-23-011 | | +| SCANNER-ANALYZERS-RUBY-28-001 | TODO | | SPRINT_0135_0000_0001_scanner_surface | Ruby Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby) | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby | Build input normalizer & VFS for Ruby projects: merge source trees, Gemfile/Gemfile.lock, vendor/bundle, .gem archives, `.bundle/config`, Rack configs, containers. Detect framework/job fingerprints deterministically. | | | +| SCANNER-ANALYZERS-RUBY-28-002 | TODO | | SPRINT_0135_0000_0001_scanner_surface | Ruby Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby) | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby | Gem & Bundler analyzer: parse Gemfile/Gemfile.lock, vendor specs, .gem archives, produce package nodes (PURLs), dependency edges, bin scripts, Bundler group metadata. | SCANNER-ANALYZERS-RUBY-28-001 | | +| SCANNER-ANALYZERS-RUBY-28-003 | TODO | | SPRINT_0135_0000_0001_scanner_surface | Ruby Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby) | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby | Require/autoload graph builder: resolve static/dynamic require, require_relative, load; infer Zeitwerk autoload paths and Rack boot chain. | SCANNER-ANALYZERS-RUBY-28-002 | | +| SCANNER-ANALYZERS-RUBY-28-004 | TODO | | SPRINT_0135_0000_0001_scanner_surface | Ruby Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby) | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby | Framework surface mapper: extract routes/controllers/middleware for Rails/Rack/Sinatra/Grape/Hanami; inventory jobs/schedulers (Sidekiq, Resque, ActiveJob, whenever, clockwork). | SCANNER-ANALYZERS-RUBY-28-003 | | +| SCANNER-ANALYZERS-RUBY-28-005 | TODO | | SPRINT_0135_0000_0001_scanner_surface | Ruby Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby) | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby | Capability analyzer: detect os-exec, filesystem, network, serialization, crypto, DB usage, TLS posture, dynamic eval; record evidence snippets with file/line. | SCANNER-ANALYZERS-RUBY-28-004 | | +| SCANNER-ANALYZERS-RUBY-28-006 | TODO | | SPRINT_0135_0000_0001_scanner_surface | Ruby Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby) | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby | Rake task & scheduler analyzer: parse Rakefiles/lib/tasks, capture task names/prereqs/shell commands; parse Sidekiq/whenever/clockwork configs into schedules. | SCANNER-ANALYZERS-RUBY-28-005 | | +| SCANNER-ANALYZERS-RUBY-28-007 | TODO | | SPRINT_0135_0000_0001_scanner_surface | Ruby Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby) | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby | Container/runtime scanner: detect Ruby version, installed gems, native extensions, web server configs in OCI layers. | SCANNER-ANALYZERS-RUBY-28-006 | | +| SCANNER-ANALYZERS-RUBY-28-008 | TODO | | SPRINT_0135_0000_0001_scanner_surface | Ruby Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby) | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby | Produce AOC-compliant observations: entrypoints, packages, modules, edges (require/autoload), routes, jobs, tasks, capabilities, configs, warnings. | SCANNER-ANALYZERS-RUBY-28-007 | | +| SCANNER-ANALYZERS-RUBY-28-009 | TODO | | SPRINT_0135_0000_0001_scanner_surface | Ruby Analyzer Guild, QA Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby) | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby | Fixture suite + performance benchmarks (Rails, Rack, Sinatra, Sidekiq, legacy, .gem, container) with golden outputs. | SCANNER-ANALYZERS-RUBY-28-008 | | +| SCANNER-ANALYZERS-RUBY-28-010 | TODO | | SPRINT_0135_0000_0001_scanner_surface | Ruby Analyzer Guild, Signals Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby) | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby | Optional runtime evidence integration (if provided logs/metrics) with path hashing, without altering static precedence. | SCANNER-ANALYZERS-RUBY-28-009 | | +| SCANNER-ANALYZERS-RUBY-28-011 | TODO | | SPRINT_0135_0000_0001_scanner_surface | Ruby Analyzer Guild, DevOps Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby) | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby | Package analyzer plug-in, add CLI (`stella ruby inspect`), refresh Offline Kit documentation. | SCANNER-ANALYZERS-RUBY-28-010 | | +| SCANNER-ANALYZERS-RUBY-28-012 | TODO | | SPRINT_0135_0000_0001_scanner_surface | Ruby Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby) | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby | Policy signal emitter: rubygems drift, native extension flags, dangerous constructs counts, TLS verify posture, dynamic require eval warnings. | SCANNER-ANALYZERS-RUBY-28-011 | | | SCANNER-BENCH-62-002 | DOING | | SPRINT_0310_0001_0010_docs_tasks_md_x | Docs Guild, Product Guild (docs) | | | | | | SCANNER-BENCH-62-003 | DOING | | SPRINT_0310_0001_0010_docs_tasks_md_x | Docs Guild, Product Guild (docs) | | | | | | SCANNER-BENCH-62-004 | DOING | | SPRINT_0310_0001_0010_docs_tasks_md_x | Docs Guild, Java Analyzer Guild (docs) | | | | | @@ -1685,7 +1685,7 @@ | SCANNER-CLI-0001 | DONE | 2025-11-10 | SPRINT_0138_0000_0001_scanner_ruby_parity | CLI Guild, Ruby Analyzer Guild (src/Cli/StellaOps.Cli) | src/Cli/StellaOps.Cli | Coordinate CLI UX/help text for new Ruby verbs and update CLI docs/golden outputs. | SCANNER-ENG-0019 | | | SCANNER-DET-01 | DONE (2025-12-03) | 2025-12-03 | SPRINT_0301_0001_0001_docs_md_i | Docs Guild · Scanner Guild | | Deterministic compose fixtures landed; docs published. | | | SCANNER-DOCS-0003 | TODO | | SPRINT_327_docs_modules_scanner | Docs Guild, Product Guild (docs/modules/scanner) | docs/modules/scanner | Gather Windows/macOS analyzer demand signals and record findings in `docs/benchmarks/scanner/windows-macos-demand.md` for marketing + product readiness. | | | -| SCANNER-EMIT-15-001 | TODO | | SPRINT_136_scanner_surface | Scanner Emit Guild (src/Scanner/__Libraries/StellaOps.Scanner.Emit) | src/Scanner/__Libraries/StellaOps.Scanner.Emit | Enforce canonical JSON (`stella.contentHash`, Merkle root metadata, zero timestamps) for fragments and composed CycloneDX inventory/usage BOMs. Documented in `docs/modules/scanner/deterministic-sbom-compose.md` §2.2. | SCANNER-SURFACE-04 | | +| SCANNER-EMIT-15-001 | TODO | | SPRINT_0136_0000_0001_scanner_surface | Scanner Emit Guild (src/Scanner/__Libraries/StellaOps.Scanner.Emit) | src/Scanner/__Libraries/StellaOps.Scanner.Emit | Enforce canonical JSON (`stella.contentHash`, Merkle root metadata, zero timestamps) for fragments and composed CycloneDX inventory/usage BOMs. Documented in `docs/modules/scanner/deterministic-sbom-compose.md` §2.2. | SCANNER-SURFACE-04 | | | SCANNER-ENG-0001 | TODO | | SPRINT_327_docs_modules_scanner | Module Team (docs/modules/scanner) | docs/modules/scanner | Cross-check implementation plan milestones against `/docs/implplan/SPRINT_*.md` and update module readiness checkpoints. | | | | SCANNER-ENG-0002 | DONE | 2025-11-09 | SPRINT_137_scanner_gap_design | Scanner Guild, CLI Guild (docs/modules/scanner) | docs/modules/scanner | Design the Node.js lockfile collector + CLI validator per `docs/benchmarks/scanner/scanning-gaps-stella-misses-from-competitors.md`, capturing Surface + policy requirements before implementation. | | | | SCANNER-ENG-0003 | DONE | 2025-11-09 | SPRINT_137_scanner_gap_design | Python Analyzer Guild, CLI Guild (docs/modules/scanner) | docs/modules/scanner | Design Python lockfile + editable-install parity checks with policy predicates and CLI workflow coverage as outlined in the gap analysis. | | | @@ -1705,36 +1705,36 @@ | SCANNER-ENG-0017 | DONE | 2025-11-09 | SPRINT_0138_0000_0001_scanner_ruby_parity | Ruby Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby) | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby | Build the runtime require/autoload graph builder with tree-sitter Ruby per design §4.4 and integrate EntryTrace hints. | SCANNER-ENG-0016 | | | SCANNER-ENG-0018 | DONE | 2025-11-09 | SPRINT_0138_0000_0001_scanner_ruby_parity | Ruby Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby) | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby | Emit Ruby capability + framework surface signals as defined in design §4.5 with policy predicate hooks. | SCANNER-ENG-0017 | | | SCANNER-ENG-0019 | DONE | 2025-11-13 | SPRINT_0138_0000_0001_scanner_ruby_parity | Ruby Analyzer Guild, CLI Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby) | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby | Ruby CLI verbs now resolve inventories by scan ID, digest, or image reference; Scanner.WebService fallbacks + CLI client encoding ensure `--image` works for both digests and tagged references, and tests cover the new lookup flow. | SCANNER-ENG-0016..0018 | | -| SCANNER-ENG-0020 | TODO | | SPRINT_136_scanner_surface | Scanner Guild (docs/modules/scanner) | docs/modules/scanner | Implement Homebrew collector & fragment mapper per `design/macos-analyzer.md` §3.1. | | | -| SCANNER-ENG-0021 | TODO | | SPRINT_136_scanner_surface | Scanner Guild (docs/modules/scanner) | docs/modules/scanner | Implement pkgutil receipt collector per `design/macos-analyzer.md` §3.2. | | | -| SCANNER-ENG-0022 | TODO | | SPRINT_136_scanner_surface | Scanner Guild, Policy Guild (docs/modules/scanner) | docs/modules/scanner | Implement macOS bundle inspector & capability overlays per `design/macos-analyzer.md` §3.3. | | | -| SCANNER-ENG-0023 | TODO | | SPRINT_136_scanner_surface | Scanner Guild, Offline Kit Guild, Policy Guild (docs/modules/scanner) | docs/modules/scanner | Deliver macOS policy/offline integration per `design/macos-analyzer.md` §5–6. | | | -| SCANNER-ENG-0024 | TODO | | SPRINT_136_scanner_surface | Scanner Guild (docs/modules/scanner) | docs/modules/scanner | Implement Windows MSI collector per `design/windows-analyzer.md` §3.1. | | | -| SCANNER-ENG-0025 | TODO | | SPRINT_136_scanner_surface | Scanner Guild (docs/modules/scanner) | docs/modules/scanner | Implement WinSxS manifest collector per `design/windows-analyzer.md` §3.2. | | | -| SCANNER-ENG-0026 | TODO | | SPRINT_136_scanner_surface | Scanner Guild (docs/modules/scanner) | docs/modules/scanner | Implement Windows Chocolatey & registry collectors per `design/windows-analyzer.md` §3.3–3.4. | | | -| SCANNER-ENG-0027 | TODO | | SPRINT_136_scanner_surface | Scanner Guild, Policy Guild, Offline Kit Guild (docs/modules/scanner) | docs/modules/scanner | Deliver Windows policy/offline integration per `design/windows-analyzer.md` §5–6. | | | -| SCANNER-ENTRYTRACE-18-502 | TODO | | SPRINT_135_scanner_surface | EntryTrace Guild (src/Scanner/__Libraries/StellaOps.Scanner.EntryTrace) | src/Scanner/__Libraries/StellaOps.Scanner.EntryTrace | Expand chain walker with init shim/user-switch/supervisor recognition plus env/workdir accumulation and guarded edges. | SCANNER-ENTRYTRACE-18-508 | | -| SCANNER-ENTRYTRACE-18-503 | TODO | | SPRINT_135_scanner_surface | EntryTrace Guild (src/Scanner/__Libraries/StellaOps.Scanner.EntryTrace) | src/Scanner/__Libraries/StellaOps.Scanner.EntryTrace | Introduce target classifier + EntryPlan handoff with confidence scoring for ELF/Java/.NET/Node/Python and user/workdir context. | SCANNER-ENTRYTRACE-18-502 | | -| SCANNER-ENTRYTRACE-18-504 | TODO | | SPRINT_136_scanner_surface | EntryTrace Guild (src/Scanner/__Libraries/StellaOps.Scanner.EntryTrace) | src/Scanner/__Libraries/StellaOps.Scanner.EntryTrace | Emit EntryTrace AOC NDJSON (`entrytrace.entry/node/edge/target/warning/capability`) and wire CLI/service streaming outputs. | SCANNER-ENTRYTRACE-18-503 | | -| SCANNER-ENTRYTRACE-18-505 | TODO | | SPRINT_136_scanner_surface | EntryTrace Guild (src/Scanner/__Libraries/StellaOps.Scanner.EntryTrace) | src/Scanner/__Libraries/StellaOps.Scanner.EntryTrace | Implement process-tree replay (ProcGraph) to reconcile `/proc` exec chains with static EntryTrace results, collapsing wrappers and emitting agreement/conflict diagnostics. | SCANNER-ENTRYTRACE-18-504 | | -| SCANNER-ENTRYTRACE-18-506 | TODO | | SPRINT_136_scanner_surface | EntryTrace Guild, Scanner WebService Guild (src/Scanner/__Libraries/StellaOps.Scanner.EntryTrace) | src/Scanner/__Libraries/StellaOps.Scanner.EntryTrace | Surface EntryTrace graph + confidence via Scanner.WebService and CLI, including target summary in scan reports and policy payloads. | SCANNER-ENTRYTRACE-18-505 | SCSS0102 | -| SCANNER-ENV-01 | TODO (2025-11-06) | 2025-11-06 | SPRINT_136_scanner_surface | Scanner Worker Guild | src/Scanner/StellaOps.Scanner.Worker | Replace ad-hoc environment reads with `StellaOps.Scanner.Surface.Env` helpers for cache roots and CAS endpoints. | — | SCDE0101 | -| SCANNER-ENV-02 | TODO (2025-11-06) | 2025-11-06 | SPRINT_136_scanner_surface | Scanner WebService Guild · Ops Guild | src/Scanner/StellaOps.Scanner.WebService | Wire Surface.Env helpers into WebService hosting (cache roots, feature flags) and document configuration. | SCANNER-ENV-01 | SCDE0102 | -| SCANNER-ENV-03 | TODO | | SPRINT_136_scanner_surface | BuildX Plugin Guild | src/Scanner/StellaOps.Scanner.Sbomer.BuildXPlugin | Adopt Surface.Env helpers for plugin configuration (cache roots, CAS endpoints, feature toggles). | SCANNER-ENV-02 | SCBX0101 | -| SCANNER-EVENTS-16-301 | BLOCKED (2025-10-26) | 2025-10-26 | SPRINT_136_scanner_surface | Scanner WebService Guild (`src/Scanner/StellaOps.Scanner.WebService`) | src/Scanner/StellaOps.Scanner.WebService | Emit orchestrator-compatible envelopes (`scanner.event.*`) and update integration tests to verify Notifier ingestion (no Redis queue coupling). | EVENTS-16-301 | SCEV0101 | -| SCANNER-GRAPH-21-001 | TODO | | SPRINT_136_scanner_surface | Scanner WebService Guild, Cartographer Guild (src/Scanner/StellaOps.Scanner.WebService) | src/Scanner/StellaOps.Scanner.WebService | Provide webhook/REST endpoint for Cartographer to request policy overlays and runtime evidence for graph nodes, ensuring determinism and tenant scoping. | | | +| SCANNER-ENG-0020 | TODO | | SPRINT_0136_0000_0001_scanner_surface | Scanner Guild (docs/modules/scanner) | docs/modules/scanner | Implement Homebrew collector & fragment mapper per `design/macos-analyzer.md` §3.1. | | | +| SCANNER-ENG-0021 | TODO | | SPRINT_0136_0000_0001_scanner_surface | Scanner Guild (docs/modules/scanner) | docs/modules/scanner | Implement pkgutil receipt collector per `design/macos-analyzer.md` §3.2. | | | +| SCANNER-ENG-0022 | TODO | | SPRINT_0136_0000_0001_scanner_surface | Scanner Guild, Policy Guild (docs/modules/scanner) | docs/modules/scanner | Implement macOS bundle inspector & capability overlays per `design/macos-analyzer.md` §3.3. | | | +| SCANNER-ENG-0023 | TODO | | SPRINT_0136_0000_0001_scanner_surface | Scanner Guild, Offline Kit Guild, Policy Guild (docs/modules/scanner) | docs/modules/scanner | Deliver macOS policy/offline integration per `design/macos-analyzer.md` §5–6. | | | +| SCANNER-ENG-0024 | TODO | | SPRINT_0136_0000_0001_scanner_surface | Scanner Guild (docs/modules/scanner) | docs/modules/scanner | Implement Windows MSI collector per `design/windows-analyzer.md` §3.1. | | | +| SCANNER-ENG-0025 | TODO | | SPRINT_0136_0000_0001_scanner_surface | Scanner Guild (docs/modules/scanner) | docs/modules/scanner | Implement WinSxS manifest collector per `design/windows-analyzer.md` §3.2. | | | +| SCANNER-ENG-0026 | TODO | | SPRINT_0136_0000_0001_scanner_surface | Scanner Guild (docs/modules/scanner) | docs/modules/scanner | Implement Windows Chocolatey & registry collectors per `design/windows-analyzer.md` §3.3–3.4. | | | +| SCANNER-ENG-0027 | TODO | | SPRINT_0136_0000_0001_scanner_surface | Scanner Guild, Policy Guild, Offline Kit Guild (docs/modules/scanner) | docs/modules/scanner | Deliver Windows policy/offline integration per `design/windows-analyzer.md` §5–6. | | | +| SCANNER-ENTRYTRACE-18-502 | TODO | | SPRINT_0135_0000_0001_scanner_surface | EntryTrace Guild (src/Scanner/__Libraries/StellaOps.Scanner.EntryTrace) | src/Scanner/__Libraries/StellaOps.Scanner.EntryTrace | Expand chain walker with init shim/user-switch/supervisor recognition plus env/workdir accumulation and guarded edges. | SCANNER-ENTRYTRACE-18-508 | | +| SCANNER-ENTRYTRACE-18-503 | TODO | | SPRINT_0135_0000_0001_scanner_surface | EntryTrace Guild (src/Scanner/__Libraries/StellaOps.Scanner.EntryTrace) | src/Scanner/__Libraries/StellaOps.Scanner.EntryTrace | Introduce target classifier + EntryPlan handoff with confidence scoring for ELF/Java/.NET/Node/Python and user/workdir context. | SCANNER-ENTRYTRACE-18-502 | | +| SCANNER-ENTRYTRACE-18-504 | TODO | | SPRINT_0136_0000_0001_scanner_surface | EntryTrace Guild (src/Scanner/__Libraries/StellaOps.Scanner.EntryTrace) | src/Scanner/__Libraries/StellaOps.Scanner.EntryTrace | Emit EntryTrace AOC NDJSON (`entrytrace.entry/node/edge/target/warning/capability`) and wire CLI/service streaming outputs. | SCANNER-ENTRYTRACE-18-503 | | +| SCANNER-ENTRYTRACE-18-505 | TODO | | SPRINT_0136_0000_0001_scanner_surface | EntryTrace Guild (src/Scanner/__Libraries/StellaOps.Scanner.EntryTrace) | src/Scanner/__Libraries/StellaOps.Scanner.EntryTrace | Implement process-tree replay (ProcGraph) to reconcile `/proc` exec chains with static EntryTrace results, collapsing wrappers and emitting agreement/conflict diagnostics. | SCANNER-ENTRYTRACE-18-504 | | +| SCANNER-ENTRYTRACE-18-506 | TODO | | SPRINT_0136_0000_0001_scanner_surface | EntryTrace Guild, Scanner WebService Guild (src/Scanner/__Libraries/StellaOps.Scanner.EntryTrace) | src/Scanner/__Libraries/StellaOps.Scanner.EntryTrace | Surface EntryTrace graph + confidence via Scanner.WebService and CLI, including target summary in scan reports and policy payloads. | SCANNER-ENTRYTRACE-18-505 | SCSS0102 | +| SCANNER-ENV-01 | TODO (2025-11-06) | 2025-11-06 | SPRINT_0136_0000_0001_scanner_surface | Scanner Worker Guild | src/Scanner/StellaOps.Scanner.Worker | Replace ad-hoc environment reads with `StellaOps.Scanner.Surface.Env` helpers for cache roots and CAS endpoints. | — | SCDE0101 | +| SCANNER-ENV-02 | TODO (2025-11-06) | 2025-11-06 | SPRINT_0136_0000_0001_scanner_surface | Scanner WebService Guild · Ops Guild | src/Scanner/StellaOps.Scanner.WebService | Wire Surface.Env helpers into WebService hosting (cache roots, feature flags) and document configuration. | SCANNER-ENV-01 | SCDE0102 | +| SCANNER-ENV-03 | TODO | | SPRINT_0136_0000_0001_scanner_surface | BuildX Plugin Guild | src/Scanner/StellaOps.Scanner.Sbomer.BuildXPlugin | Adopt Surface.Env helpers for plugin configuration (cache roots, CAS endpoints, feature toggles). | SCANNER-ENV-02 | SCBX0101 | +| SCANNER-EVENTS-16-301 | BLOCKED (2025-10-26) | 2025-10-26 | SPRINT_0136_0000_0001_scanner_surface | Scanner WebService Guild (`src/Scanner/StellaOps.Scanner.WebService`) | src/Scanner/StellaOps.Scanner.WebService | Emit orchestrator-compatible envelopes (`scanner.event.*`) and update integration tests to verify Notifier ingestion (no Redis queue coupling). | EVENTS-16-301 | SCEV0101 | +| SCANNER-GRAPH-21-001 | TODO | | SPRINT_0136_0000_0001_scanner_surface | Scanner WebService Guild, Cartographer Guild (src/Scanner/StellaOps.Scanner.WebService) | src/Scanner/StellaOps.Scanner.WebService | Provide webhook/REST endpoint for Cartographer to request policy overlays and runtime evidence for graph nodes, ensuring determinism and tenant scoping. | | | | SCANNER-LIC-0001 | DONE | 2025-11-10 | SPRINT_0138_0000_0001_scanner_ruby_parity | Scanner Guild, Legal Guild (docs/modules/scanner) | docs/modules/scanner | Tree-sitter licensing captured, `NOTICE.md` updated, and Offline Kit now mirrors `third-party-licenses/` with ruby artifacts. | SCANNER-ENG-0016 | | -| SCANNER-LNM-21-001 | TODO | | SPRINT_136_scanner_surface | Scanner WebService Guild, Policy Guild (src/Scanner/StellaOps.Scanner.WebService) | src/Scanner/StellaOps.Scanner.WebService | Update `/reports` and `/policy/runtime` payloads to consume advisory/vex linksets, exposing source severity arrays and conflict summaries alongside effective verdicts. | | | -| SCANNER-LNM-21-002 | TODO | | SPRINT_136_scanner_surface | Scanner WebService Guild, UI Guild (src/Scanner/StellaOps.Scanner.WebService) | src/Scanner/StellaOps.Scanner.WebService | Add evidence endpoint for Console to fetch linkset summaries with policy overlay for a component/SBOM, including AOC references. | SCANNER-LNM-21-001 | | +| SCANNER-LNM-21-001 | TODO | | SPRINT_0136_0000_0001_scanner_surface | Scanner WebService Guild, Policy Guild (src/Scanner/StellaOps.Scanner.WebService) | src/Scanner/StellaOps.Scanner.WebService | Update `/reports` and `/policy/runtime` payloads to consume advisory/vex linksets, exposing source severity arrays and conflict summaries alongside effective verdicts. | | | +| SCANNER-LNM-21-002 | TODO | | SPRINT_0136_0000_0001_scanner_surface | Scanner WebService Guild, UI Guild (src/Scanner/StellaOps.Scanner.WebService) | src/Scanner/StellaOps.Scanner.WebService | Add evidence endpoint for Console to fetch linkset summaries with policy overlay for a component/SBOM, including AOC references. | SCANNER-LNM-21-001 | | | SCANNER-NATIVE-401-015 | TODO | | SPRINT_0401_0001_0001_reachability_evidence_chain | Scanner Worker Guild | `src/Scanner/__Libraries/StellaOps.Scanner.Symbols.Native`, `src/Scanner/__Libraries/StellaOps.Scanner.CallGraph.Native` | Stand up `StellaOps.Scanner.Symbols.Native` + `StellaOps.Scanner.CallGraph.Native` (ELF/PE readers, demanglers, probabilistic carving) and publish `FuncNode`/`CallEdge` CAS bundles consumed by reachability graphs. | Requires CAS schema approval from GAPG0101 | SCNA0101 | | SCANNER-OPS-0001 | TODO | | SPRINT_327_docs_modules_scanner | Ops Guild (docs/modules/scanner) | docs/modules/scanner | Review scanner runbooks/observability assets after the next sprint demo and capture findings inline with sprint notes. | | | | SCANNER-POLICY-0001 | DONE | 2025-11-10 | SPRINT_0138_0000_0001_scanner_ruby_parity | Policy Guild, Ruby Analyzer Guild (docs/modules/scanner) | docs/modules/scanner | Ruby predicates shipped: Policy Engine exposes `sbom.any_component` + `ruby.*`, tests updated, DSL/offline-kit docs refreshed. | SCANNER-ENG-0018 | | -| SCANNER-SECRETS-03 | TODO | | SPRINT_136_scanner_surface | BuildX Plugin Guild, Security Guild (src/Scanner/StellaOps.Scanner.Sbomer.BuildXPlugin) | src/Scanner/StellaOps.Scanner.Sbomer.BuildXPlugin | Use Surface.Secrets to retrieve registry credentials when interacting with CAS/referrers. | SCANNER-SECRETS-02 | | -| SCANNER-SORT-02 | TODO | | SPRINT_136_scanner_surface | Scanner Core Guild (src/Scanner/__Libraries/StellaOps.Scanner.Core) | src/Scanner/__Libraries/StellaOps.Scanner.Core | Sort layer fragments by digest and components by `identity.purl`/`identity.key` before composition; add determinism regression tests. | SCANNER-EMIT-15-001 | | -| SCANNER-SURFACE-04 | TODO | | SPRINT_136_scanner_surface | Scanner Worker Guild (src/Scanner/StellaOps.Scanner.Worker) | src/Scanner/StellaOps.Scanner.Worker | DSSE-sign every `layer.fragments` payload, emit `_composition.json`, and persist DSSE envelopes so offline kits can replay deterministically (see `docs/modules/scanner/deterministic-sbom-compose.md` §2.1). | SCANNER-SURFACE-01; SURFACE-FS-03 | | +| SCANNER-SECRETS-03 | TODO | | SPRINT_0136_0000_0001_scanner_surface | BuildX Plugin Guild, Security Guild (src/Scanner/StellaOps.Scanner.Sbomer.BuildXPlugin) | src/Scanner/StellaOps.Scanner.Sbomer.BuildXPlugin | Use Surface.Secrets to retrieve registry credentials when interacting with CAS/referrers. | SCANNER-SECRETS-02 | | +| SCANNER-SORT-02 | TODO | | SPRINT_0136_0000_0001_scanner_surface | Scanner Core Guild (src/Scanner/__Libraries/StellaOps.Scanner.Core) | src/Scanner/__Libraries/StellaOps.Scanner.Core | Sort layer fragments by digest and components by `identity.purl`/`identity.key` before composition; add determinism regression tests. | SCANNER-EMIT-15-001 | | +| SCANNER-SURFACE-04 | TODO | | SPRINT_0136_0000_0001_scanner_surface | Scanner Worker Guild (src/Scanner/StellaOps.Scanner.Worker) | src/Scanner/StellaOps.Scanner.Worker | DSSE-sign every `layer.fragments` payload, emit `_composition.json`, and persist DSSE envelopes so offline kits can replay deterministically (see `docs/modules/scanner/deterministic-sbom-compose.md` §2.1). | SCANNER-SURFACE-01; SURFACE-FS-03 | | | SCHED-IMPACT-16-303 | DONE | | SPRINT_0155_0001_0001_scheduler_i | Scheduler ImpactIndex Guild (src/Scheduler/__Libraries/StellaOps.Scheduler.ImpactIndex) | src/Scheduler/__Libraries/StellaOps.Scheduler.ImpactIndex | Snapshot/compaction + invalidation for removed images; persistence to RocksDB/Redis per architecture. | | | | SCHED-SURFACE-01 | TODO | | SPRINT_0155_0001_0001_scheduler_i | Scheduler Worker Guild (src/Scheduler/__Libraries/StellaOps.Scheduler.Worker) | src/Scheduler/__Libraries/StellaOps.Scheduler.Worker | Evaluate Surface.FS pointers when planning delta scans to avoid redundant work and prioritise drift-triggered assets. | | | -| SCHED-SURFACE-02 | TODO | | SPRINT_136_scanner_surface | Scheduler Worker Guild (src/Scheduler/__Libraries/StellaOps.Scheduler.Worker) | src/Scheduler/__Libraries/StellaOps.Scheduler.Worker | Integrate Scheduler worker prefetch using Surface manifest reader and persist manifest pointers with rerun plans. | SURFACE-FS-02; SCHED-SURFACE-01 | | +| SCHED-SURFACE-02 | TODO | | SPRINT_0136_0000_0001_scanner_surface | Scheduler Worker Guild (src/Scheduler/__Libraries/StellaOps.Scheduler.Worker) | src/Scheduler/__Libraries/StellaOps.Scheduler.Worker | Integrate Scheduler worker prefetch using Surface manifest reader and persist manifest pointers with rerun plans. | SURFACE-FS-02; SCHED-SURFACE-01 | | | SCHED-VULN-29-001 | DONE | | SPRINT_0155_0001_0001_scheduler_i | Scheduler WebService Guild, Findings Ledger Guild (src/Scheduler/StellaOps.Scheduler.WebService) | src/Scheduler/StellaOps.Scheduler.WebService | Expose resolver job APIs (`POST /vuln/resolver/jobs`, `GET /vuln/resolver/jobs/{id}`) to trigger candidate recomputation per artifact/policy change with RBAC and rate limits. | | | | SCHED-VULN-29-002 | TODO | | SPRINT_0155_0001_0001_scheduler_i | Scheduler WebService Guild, Observability Guild (src/Scheduler/StellaOps.Scheduler.WebService) | src/Scheduler/StellaOps.Scheduler.WebService | Provide projector lag metrics endpoint and webhook notifications for backlog breaches consumed by DevOps dashboards. Dependencies: SCHED-VULN-29-001. | | | | SCHED-WEB-20-002 | TODO | | SPRINT_0155_0001_0001_scheduler_i | Scheduler WebService Guild (src/Scheduler/StellaOps.Scheduler.WebService) | src/Scheduler/StellaOps.Scheduler.WebService | Provide simulation trigger endpoint returning diff preview metadata and job state for UI/CLI consumption. | | | @@ -1759,10 +1759,10 @@ | SCHEMA-401-024 | TODO | | SPRINT_0401_0001_0001_reachability_evidence_chain | Signals Guild (`src/Signals/StellaOps.Signals`, `docs/uncertainty/README.md`) | `src/Signals/StellaOps.Signals`, `docs/uncertainty/README.md` | | | | | SCORER-401-025 | TODO | | SPRINT_0401_0001_0001_reachability_evidence_chain | Signals Guild (`src/Signals/StellaOps.Signals.Application`, `docs/uncertainty/README.md`) | `src/Signals/StellaOps.Signals.Application`, `docs/uncertainty/README.md` | | | | | SCORING-401-003 | TODO | | SPRINT_0401_0001_0001_reachability_evidence_chain | Signals Guild (`src/Signals/StellaOps.Signals`) | `src/Signals/StellaOps.Signals` | | | | -| SDK-62-001 | TODO | | SPRINT_204_cli_iv | DevEx/CLI Guild, SDK Generator Guild (src/Cli/StellaOps.Cli) | src/Cli/StellaOps.Cli | | | | -| SDK-62-002 | TODO | | SPRINT_204_cli_iv | DevEx/CLI Guild (src/Cli/StellaOps.Cli) | src/Cli/StellaOps.Cli | | | | -| SDK-63-001 | TODO | | SPRINT_204_cli_iv | DevEx/CLI Guild, API Governance Guild (src/Cli/StellaOps.Cli) | src/Cli/StellaOps.Cli | | | | -| SDK-64-001 | TODO | | SPRINT_204_cli_iv | DevEx/CLI Guild, SDK Release Guild (src/Cli/StellaOps.Cli) | src/Cli/StellaOps.Cli | | | | +| SDK-62-001 | TODO | | SPRINT_0204_0000_0004_cli_iv | DevEx/CLI Guild, SDK Generator Guild (src/Cli/StellaOps.Cli) | src/Cli/StellaOps.Cli | | | | +| SDK-62-002 | TODO | | SPRINT_0204_0000_0004_cli_iv | DevEx/CLI Guild (src/Cli/StellaOps.Cli) | src/Cli/StellaOps.Cli | | | | +| SDK-63-001 | TODO | | SPRINT_0204_0000_0004_cli_iv | DevEx/CLI Guild, API Governance Guild (src/Cli/StellaOps.Cli) | src/Cli/StellaOps.Cli | | | | +| SDK-64-001 | TODO | | SPRINT_0204_0000_0004_cli_iv | DevEx/CLI Guild, SDK Release Guild (src/Cli/StellaOps.Cli) | src/Cli/StellaOps.Cli | | | | | SDKGEN-62-001 | TODO | | SPRINT_0208_0001_0001_sdk | SDK Generator Guild | src/Sdk/StellaOps.Sdk.Generator | Choose/pin generator toolchain, set up language template pipeline, and enforce reproducible builds. | DEVL0101 portal contracts | SDKG0101 | | SDKGEN-62-002 | TODO | | SPRINT_0208_0001_0001_sdk | SDK Generator Guild | src/Sdk/StellaOps.Sdk.Generator | Implement shared post-processing (auth helpers, retries, pagination utilities, telemetry hooks) applied to all languages. Dependencies: SDKGEN-62-001. | SDKGEN-62-001 | SDKG0101 | | SDKGEN-63-001 | BLOCKED (2025-11-26) | 2025-11-26 | SPRINT_0208_0001_0001_sdk | SDK Generator Guild | src/Sdk/StellaOps.Sdk.Generator | Ship TypeScript SDK alpha with ESM/CJS builds, typed errors, paginator, streaming helpers. Dependencies: SDKGEN-62-002. | 63-004 | SDKG0101 | @@ -1801,12 +1801,12 @@ | SEC2 | DONE | 2025-11-09 | SPRINT_100_identity_signing | Security Guild, Storage Guild (src/Authority/StellaOps.Authority/StellaOps.Authority.Plugin.Standard) | src/Authority/StellaOps.Authority/StellaOps.Authority.Plugin.Standard | | | | | SEC3 | DONE | 2025-11-09 | SPRINT_100_identity_signing | Security Guild, BE-Auth Plugin (src/Authority/StellaOps.Authority/StellaOps.Authority.Plugin.Standard) | src/Authority/StellaOps.Authority/StellaOps.Authority.Plugin.Standard | | | | | SEC5 | DONE | 2025-11-09 | SPRINT_100_identity_signing | Security Guild (src/Authority/StellaOps.Authority/StellaOps.Authority.Plugin.Standard) | src/Authority/StellaOps.Authority/StellaOps.Authority.Plugin.Standard | | | | -| SECRETS-01 | DOING | 2025-11-02 | SPRINT_136_scanner_surface | Scanner Guild, Security Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.Secrets) | src/Scanner/__Libraries/StellaOps.Scanner.Surface.Secrets | | | | -| SECRETS-02 | DOING | 2025-11-02 | SPRINT_136_scanner_surface | Scanner Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.Secrets) | src/Scanner/__Libraries/StellaOps.Scanner.Surface.Secrets | | SURFACE-SECRETS-01 | | -| SECRETS-03 | TODO | | SPRINT_136_scanner_surface | BuildX Plugin Guild · Security Guild | src/Scanner/StellaOps.Scanner.Sbomer.BuildXPlugin | SCANNER-SECRETS-02 | SCANNER-SECRETS-02 | SCBX0101 | -| SECRETS-04 | TODO | | SPRINT_136_scanner_surface | Scanner Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.Secrets) | src/Scanner/__Libraries/StellaOps.Scanner.Surface.Secrets | | SURFACE-SECRETS-02 | | -| SECRETS-05 | TODO | | SPRINT_136_scanner_surface | Zastava Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.Secrets) | src/Scanner/__Libraries/StellaOps.Scanner.Surface.Secrets | | SURFACE-SECRETS-02 | | -| SECRETS-06 | TODO | | SPRINT_136_scanner_surface | Ops Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.Secrets) | src/Scanner/__Libraries/StellaOps.Scanner.Surface.Secrets | | SURFACE-SECRETS-03 | | +| SECRETS-01 | DOING | 2025-11-02 | SPRINT_0136_0000_0001_scanner_surface | Scanner Guild, Security Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.Secrets) | src/Scanner/__Libraries/StellaOps.Scanner.Surface.Secrets | | | | +| SECRETS-02 | DOING | 2025-11-02 | SPRINT_0136_0000_0001_scanner_surface | Scanner Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.Secrets) | src/Scanner/__Libraries/StellaOps.Scanner.Surface.Secrets | | SURFACE-SECRETS-01 | | +| SECRETS-03 | TODO | | SPRINT_0136_0000_0001_scanner_surface | BuildX Plugin Guild · Security Guild | src/Scanner/StellaOps.Scanner.Sbomer.BuildXPlugin | SCANNER-SECRETS-02 | SCANNER-SECRETS-02 | SCBX0101 | +| SECRETS-04 | TODO | | SPRINT_0136_0000_0001_scanner_surface | Scanner Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.Secrets) | src/Scanner/__Libraries/StellaOps.Scanner.Surface.Secrets | | SURFACE-SECRETS-02 | | +| SECRETS-05 | TODO | | SPRINT_0136_0000_0001_scanner_surface | Zastava Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.Secrets) | src/Scanner/__Libraries/StellaOps.Scanner.Surface.Secrets | | SURFACE-SECRETS-02 | | +| SECRETS-06 | TODO | | SPRINT_0136_0000_0001_scanner_surface | Ops Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.Secrets) | src/Scanner/__Libraries/StellaOps.Scanner.Surface.Secrets | | SURFACE-SECRETS-03 | | | SERVER-401-011 | TODO | | SPRINT_0401_0001_0001_reachability_evidence_chain | Symbols Guild (`src/Symbols/StellaOps.Symbols.Server`) | `src/Symbols/StellaOps.Symbols.Server` | | | | | SERVICE-21-001 | BLOCKED | | SPRINT_0140_0001_0001_runtime_signals | | | | | | | SERVICE-21-002 | BLOCKED | | SPRINT_0140_0001_0001_runtime_signals | | | | | | @@ -1819,7 +1819,7 @@ | SERVICE-OPS-0001 | TODO | | SPRINT_0326_0001_0001_docs_modules_registry | Ops Guild (docs/modules/registry) | docs/modules/registry | | | | | SIG-003 | TODO | | SPRINT_0401_0001_0001_reachability_evidence_chain | Signals Guild (`src/Signals/StellaOps.Signals`, `docs/reachability/function-level-evidence.md`) | `src/Signals/StellaOps.Signals`, `docs/reachability/function-level-evidence.md` | | | | | SIG-26-001 | TODO | | SPRINT_115_concelier_iv | Concelier Core Guild, Signals Guild (src/Concelier/__Libraries/StellaOps.Concelier.Core) | src/Concelier/__Libraries/StellaOps.Concelier.Core | | | | -| SIG-26-002 | TODO | | SPRINT_204_cli_iv | DevEx/CLI Guild (src/Cli/StellaOps.Cli) | src/Cli/StellaOps.Cli | | | | +| SIG-26-002 | TODO | | SPRINT_0204_0000_0004_cli_iv | DevEx/CLI Guild (src/Cli/StellaOps.Cli) | src/Cli/StellaOps.Cli | | | | | SIG-26-003 | TODO | | SPRINT_0211_0001_0003_ui_iii | UI Guild (src/UI/StellaOps.UI) | src/UI/StellaOps.UI | | | | | SIG-26-004 | TODO | | SPRINT_0211_0001_0003_ui_iii | UI Guild (src/UI/StellaOps.UI) | src/UI/StellaOps.UI | | | | | SIG-26-005 | TODO | | SPRINT_0309_0001_0009_docs_tasks_md_ix | Docs Guild, UI Guild (docs) | | | | | @@ -1827,10 +1827,10 @@ | SIG-26-007 | TODO | | SPRINT_0309_0001_0009_docs_tasks_md_ix | Docs Guild, BE-Base Platform Guild (docs) | | | | | | SIG-26-008 | DOING | | SPRINT_0310_0001_0010_docs_tasks_md_x | Docs Guild, DevOps Guild (docs) | | | | | | SIG-STORE-401-016 | TODO | | SPRINT_0401_0001_0001_reachability_evidence_chain | Signals Guild · BE-Base Platform Guild (`src/Signals/StellaOps.Signals`, `src/__Libraries/StellaOps.Replay.Core`) | `src/Signals/StellaOps.Signals`, `src/__Libraries/StellaOps.Replay.Core` | Introduce shared reachability store collections (`func_nodes`, `call_edges`, `cve_func_hits`), indexes, and repository APIs so Scanner/Signals/Policy can reuse canonical function data. | | | -| SIGN-CORE-186-004 | DONE | 2025-11-26 | SPRINT_186_record_deterministic_execution | Signing Guild | `src/Signer/StellaOps.Signer`, `src/__Libraries/StellaOps.Cryptography` | Replace the HMAC demo implementation in `StellaOps.Signer` with StellaOps.Cryptography providers (keyless + KMS), including provider selection, key material loading, and cosign-compatible DSSE signature output. | Mirrors #1 | SIGR0101 | -| SIGN-CORE-186-005 | DONE | 2025-11-26 | SPRINT_186_record_deterministic_execution | Signing Guild | `src/Signer/StellaOps.Signer.Core` | Refactor `SignerStatementBuilder` to support StellaOps predicate types (e.g., `stella.ops/promotion@v1`) and delegate payload canonicalisation to the Provenance library once available. | Mirrors #2 | SIGR0101 | -| SIGN-REPLAY-186-003 | TODO | | SPRINT_186_record_deterministic_execution | Signing Guild (`src/Signer/StellaOps.Signer`, `src/Authority/StellaOps.Authority`) | `src/Signer/StellaOps.Signer`, `src/Authority/StellaOps.Authority` | Extend Signer/Authority DSSE flows to cover replay manifest/bundle payload types with multi-profile support; refresh `docs/modules/signer/architecture.md` and `docs/modules/authority/architecture.md` to capture the new signing/verification path referencing `docs/replay/DETERMINISTIC_REPLAY.md` Section 5. | | | -| SIGN-TEST-186-006 | DONE | 2025-11-26 | SPRINT_186_record_deterministic_execution | Signing Guild, QA Guild (`src/Signer/StellaOps.Signer.Tests`) | `src/Signer/StellaOps.Signer.Tests` | Upgrade signer integration tests to run against the real crypto abstraction and fixture predicates (promotion, SBOM, replay), replacing stub tokens/digests with deterministic test data. | | | +| SIGN-CORE-186-004 | DONE | 2025-11-26 | SPRINT_0186_0000_0001_record_deterministic_execution | Signing Guild | `src/Signer/StellaOps.Signer`, `src/__Libraries/StellaOps.Cryptography` | Replace the HMAC demo implementation in `StellaOps.Signer` with StellaOps.Cryptography providers (keyless + KMS), including provider selection, key material loading, and cosign-compatible DSSE signature output. | Mirrors #1 | SIGR0101 | +| SIGN-CORE-186-005 | DONE | 2025-11-26 | SPRINT_0186_0000_0001_record_deterministic_execution | Signing Guild | `src/Signer/StellaOps.Signer.Core` | Refactor `SignerStatementBuilder` to support StellaOps predicate types (e.g., `stella.ops/promotion@v1`) and delegate payload canonicalisation to the Provenance library once available. | Mirrors #2 | SIGR0101 | +| SIGN-REPLAY-186-003 | TODO | | SPRINT_0186_0000_0001_record_deterministic_execution | Signing Guild (`src/Signer/StellaOps.Signer`, `src/Authority/StellaOps.Authority`) | `src/Signer/StellaOps.Signer`, `src/Authority/StellaOps.Authority` | Extend Signer/Authority DSSE flows to cover replay manifest/bundle payload types with multi-profile support; refresh `docs/modules/signer/architecture.md` and `docs/modules/authority/architecture.md` to capture the new signing/verification path referencing `docs/replay/DETERMINISTIC_REPLAY.md` Section 5. | | | +| SIGN-TEST-186-006 | DONE | 2025-11-26 | SPRINT_0186_0000_0001_record_deterministic_execution | Signing Guild, QA Guild (`src/Signer/StellaOps.Signer.Tests`) | `src/Signer/StellaOps.Signer.Tests` | Upgrade signer integration tests to run against the real crypto abstraction and fixture predicates (promotion, SBOM, replay), replacing stub tokens/digests with deterministic test data. | | | | SIGN-VEX-401-018 | DONE | 2025-11-26 | SPRINT_0401_0001_0001_reachability_evidence_chain | Signing Guild (`src/Signer/StellaOps.Signer`, `docs/modules/signer/architecture.md`) | `src/Signer/StellaOps.Signer`, `docs/modules/signer/architecture.md` | Extend Signer predicate catalog with `stella.ops/vexDecision@v1`, enforce payload policy, and plumb DSSE/Rekor integration for policy decisions. | | | | SIGNALS-24-001 | DONE | 2025-11-09 | SPRINT_0140_0001_0001_runtime_signals | | | Host skeleton, RBAC, sealed-mode readiness, `/signals/facts/{subject}` retrieval, and readiness probes merged; serves as base for downstream ingestion. | | | | SIGNALS-24-002 | DOING | 2025-11-07 | SPRINT_0140_0001_0001_runtime_signals | | | Callgraph ingestion + retrieval APIs are live, but CAS promotion and signed manifest publication remain; cannot close until reachability jobs can trust stored graphs. | | | @@ -1844,88 +1844,88 @@ | SIGNER-DOCS-0001 | DONE | 2025-11-05 | SPRINT_0329_0001_0001_docs_modules_signer | Docs Guild (docs/modules/signer) | docs/modules/signer | Validate that `docs/modules/signer/README.md` captures the latest DSSE/fulcio updates. | | | | SIGNER-ENG-0001 | DONE | 2025-11-26 | SPRINT_0329_0001_0001_docs_modules_signer | Module Team (docs/modules/signer) | docs/modules/signer | Keep module milestones aligned with signer sprints under `/docs/implplan`. Updated README with Sprint 0186/0401 completed tasks (SIGN-CORE-186-004/005, SIGN-TEST-186-006, SIGN-VEX-401-018). | | | | SIGNER-OPS-0001 | TODO | | SPRINT_0329_0001_0001_docs_modules_signer | Ops Guild (docs/modules/signer) | docs/modules/signer | Review signer runbooks/observability assets after next sprint demo. | | | -| SORT-02 | TODO | | SPRINT_136_scanner_surface | Scanner Core Guild (src/Scanner/__Libraries/StellaOps.Scanner.Core) | src/Scanner/__Libraries/StellaOps.Scanner.Core | | SCANNER-EMIT-15-001 | | +| SORT-02 | TODO | | SPRINT_0136_0000_0001_scanner_surface | Scanner Core Guild (src/Scanner/__Libraries/StellaOps.Scanner.Core) | src/Scanner/__Libraries/StellaOps.Scanner.Core | | SCANNER-EMIT-15-001 | | | ORCH-DOCS-0001 | DONE | | SPRINT_0323_0001_0001_docs_modules_orchestrator | Docs Guild (docs/modules/orchestrator) | docs/modules/orchestrator | Refresh orchestrator README + diagrams to reflect job leasing changes and reference the task runner bridge. | | | | ORCH-ENG-0001 | DONE | | SPRINT_0323_0001_0001_docs_modules_orchestrator | Module Team (docs/modules/orchestrator) | docs/modules/orchestrator | Sync into ../.. | | | | ORCH-OPS-0001 | DONE | | SPRINT_0323_0001_0001_docs_modules_orchestrator | Ops Guild (docs/modules/orchestrator) | docs/modules/orchestrator | Document outputs in ./README.md | | | -| SPL-23-001 | TODO | | SPRINT_128_policy_reasoning | Policy Guild, Language Infrastructure Guild / src/Policy/__Libraries/StellaOps.Policy | src/Policy/__Libraries/StellaOps.Policy | | | | -| SPL-23-002 | TODO | | SPRINT_128_policy_reasoning | Policy Guild / src/Policy/__Libraries/StellaOps.Policy | src/Policy/__Libraries/StellaOps.Policy | | POLICY-SPL-23-001 | | -| SPL-23-003 | TODO | | SPRINT_128_policy_reasoning | Policy Guild / src/Policy/__Libraries/StellaOps.Policy | src/Policy/__Libraries/StellaOps.Policy | | POLICY-SPL-23-002 | | +| SPL-23-001 | TODO | | SPRINT_0128_0000_0001_policy_reasoning | Policy Guild, Language Infrastructure Guild / src/Policy/__Libraries/StellaOps.Policy | src/Policy/__Libraries/StellaOps.Policy | | | | +| SPL-23-002 | TODO | | SPRINT_0128_0000_0001_policy_reasoning | Policy Guild / src/Policy/__Libraries/StellaOps.Policy | src/Policy/__Libraries/StellaOps.Policy | | POLICY-SPL-23-001 | | +| SPL-23-003 | TODO | | SPRINT_0128_0000_0001_policy_reasoning | Policy Guild / src/Policy/__Libraries/StellaOps.Policy | src/Policy/__Libraries/StellaOps.Policy | | POLICY-SPL-23-002 | | | SPL-23-004 | DONE (2025-11-26) | | SPRINT_0128_0001_0001_policy_reasoning | Policy Guild, Audit Guild / src/Policy/__Libraries/StellaOps.Policy | src/Policy/__Libraries/StellaOps.Policy | | POLICY-SPL-23-003 | Explanation tree emitted from evaluation; persistence follow-up. | | SPL-23-005 | TODO | | SPRINT_0128_0001_0001_policy_reasoning | Policy Guild, DevEx Guild / src/Policy/__Libraries/StellaOps.Policy | src/Policy/__Libraries/StellaOps.Policy | | POLICY-SPL-23-004 | | -| SPL-24-001 | DONE (2025-11-26) | 2025-11-26 | SPRINT_128_policy_reasoning | Policy Guild, Signals Guild / src/Policy/__Libraries/StellaOps.Policy | src/Policy/__Libraries/StellaOps.Policy | | POLICY-SPL-23-005 | | +| SPL-24-001 | DONE (2025-11-26) | 2025-11-26 | SPRINT_0128_0000_0001_policy_reasoning | Policy Guild, Signals Guild / src/Policy/__Libraries/StellaOps.Policy | src/Policy/__Libraries/StellaOps.Policy | | POLICY-SPL-23-005 | | | STORE-401-016 | TODO | | SPRINT_0401_0001_0001_reachability_evidence_chain | Signals Guild · BE-Base Platform Guild (`src/Signals/StellaOps.Signals`, `src/__Libraries/StellaOps.Replay.Core`) | `src/Signals/StellaOps.Signals`, `src/__Libraries/StellaOps.Replay.Core` | | | | | STORE-AOC-19-001 | DONE (2025-11-25) | | SPRINT_0119_0001_0005_excititor_v | Excititor Storage Guild (src/Excititor/__Libraries/StellaOps.Excititor.Storage.Mongo) | src/Excititor/__Libraries/StellaOps.Excititor.Storage.Mongo | | | | | STORE-AOC-19-002 | DONE (2025-11-25) | | SPRINT_0119_0001_0005_excititor_v | Excititor Storage Guild, DevOps Guild (src/Excititor/__Libraries/StellaOps.Excititor.Storage.Mongo) | src/Excititor/__Libraries/StellaOps.Excititor.Storage.Mongo | | | | | STORE-AOC-19-005 | TODO | 2025-11-04 | SPRINT_115_concelier_iv | Concelier Storage Guild, DevOps Guild (src/Concelier/__Libraries/StellaOps.Concelier.Storage.Mongo) | src/Concelier/__Libraries/StellaOps.Concelier.Storage.Mongo | | | | | SURFACE-01 | TODO | | SPRINT_0140_0001_0001_runtime_signals | | | | | | -| SURFACE-02 | TODO | | SPRINT_136_scanner_surface | Scheduler Worker Guild (src/Scheduler/__Libraries/StellaOps.Scheduler.Worker) | src/Scheduler/__Libraries/StellaOps.Scheduler.Worker | | SURFACE-FS-02; SCHED-SURFACE-01 | | -| SURFACE-04 | TODO | | SPRINT_136_scanner_surface | Scanner Worker Guild (src/Scanner/StellaOps.Scanner.Worker) | src/Scanner/StellaOps.Scanner.Worker | | SCANNER-SURFACE-01; SURFACE-FS-03 | | -| SURFACE-ENV-01 | DONE | 2025-11-13 | SPRINT_136_scanner_surface | Scanner Guild, Zastava Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.Env) | src/Scanner/__Libraries/StellaOps.Scanner.Surface.Env | Draft `surface-env.md` enumerating environment variables, defaults, and air-gap behaviour for Surface consumers. | — | SCSS0101 | -| SURFACE-ENV-02 | DOING | 2025-11-02 | SPRINT_136_scanner_surface | Scanner Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.Env) | src/Scanner/__Libraries/StellaOps.Scanner.Surface.Env | Implement strongly-typed env accessors with validation and deterministic logging inside `StellaOps.Scanner.Surface.Env`. | SURFACE-ENV-01 | SCSS0101 | -| SURFACE-ENV-03 | TODO | | SPRINT_136_scanner_surface | Scanner Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.Env) | src/Scanner/__Libraries/StellaOps.Scanner.Surface.Env | Adopt the env helper across Scanner Worker/WebService/BuildX plug-ins. | SURFACE-ENV-02 | | -| SURFACE-ENV-04 | TODO | | SPRINT_136_scanner_surface | Zastava Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.Env) | src/Scanner/__Libraries/StellaOps.Scanner.Surface.Env | Wire env helper into Zastava Observer/Webhook containers. | SURFACE-ENV-02 | | -| SURFACE-ENV-05 | TODO | | SPRINT_136_scanner_surface | Ops Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.Env) | src/Scanner/__Libraries/StellaOps.Scanner.Surface.Env | Update Helm/Compose/offline kit templates with new env knobs and documentation. | SURFACE-ENV-03; SURFACE-ENV-04 | | -| SURFACE-FS-03 | TODO | | SPRINT_136_scanner_surface | Scanner Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.FS) | src/Scanner/__Libraries/StellaOps.Scanner.Surface.FS | Integrate Surface.FS writer into Scanner Worker analyzer pipeline to persist layer + entry-trace fragments. | SURFACE-FS-02 | | -| SURFACE-FS-04 | TODO | | SPRINT_136_scanner_surface | Zastava Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.FS) | src/Scanner/__Libraries/StellaOps.Scanner.Surface.FS | Integrate Surface.FS reader into Zastava Observer runtime drift loop. | SURFACE-FS-02 | | -| SURFACE-FS-05 | TODO | | SPRINT_136_scanner_surface | Scanner Guild, Scheduler Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.FS) | src/Scanner/__Libraries/StellaOps.Scanner.Surface.FS | Expose Surface.FS pointers via Scanner WebService reports and coordinate rescan planning with Scheduler. | SURFACE-FS-03 | | -| SURFACE-FS-06 | TODO | | SPRINT_136_scanner_surface | Docs Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.FS) | src/Scanner/__Libraries/StellaOps.Scanner.Surface.FS | Update scanner-engine guide and offline kit docs with Surface.FS workflow. | SURFACE-FS-02 | | -| SURFACE-FS-07 | DONE | 2025-12-04 | SPRINT_136_scanner_surface | Scanner Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.FS) | src/Scanner/__Libraries/StellaOps.Scanner.Surface.FS | Extend Surface.FS manifest schema with `composition.recipe`, fragment attestation metadata, and verification helpers per deterministic SBOM spec. | SCANNER-SURFACE-04 | | -| SURFACE-SECRETS-01 | DOING | 2025-11-02 | SPRINT_136_scanner_surface | Scanner Guild, Security Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.Secrets) | src/Scanner/__Libraries/StellaOps.Scanner.Surface.Secrets | Produce `surface-secrets.md` defining secret reference schema, storage backends, scopes, and rotation rules. | | | -| SURFACE-SECRETS-02 | DOING | 2025-11-02 | SPRINT_136_scanner_surface | Scanner Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.Secrets) | src/Scanner/__Libraries/StellaOps.Scanner.Surface.Secrets | Implement `StellaOps.Scanner.Surface.Secrets` core provider interfaces, secret models, and in-memory test backend. | SURFACE-SECRETS-01 | | -| SURFACE-SECRETS-03 | TODO | | SPRINT_136_scanner_surface | Scanner Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.Secrets) | src/Scanner/__Libraries/StellaOps.Scanner.Surface.Secrets | Add Kubernetes/File/Offline backends with deterministic caching and audit hooks. | SURFACE-SECRETS-02 | SCSS0101 | -| SURFACE-SECRETS-04 | TODO | | SPRINT_136_scanner_surface | Scanner Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.Secrets) | src/Scanner/__Libraries/StellaOps.Scanner.Surface.Secrets | Integrate Surface.Secrets into Scanner Worker/WebService/BuildX for registry + CAS creds. | SURFACE-SECRETS-02 | | -| SURFACE-SECRETS-05 | TODO | | SPRINT_136_scanner_surface | Zastava Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.Secrets) | src/Scanner/__Libraries/StellaOps.Scanner.Surface.Secrets | Invoke Surface.Secrets from Zastava Observer/Webhook for CAS & attestation secrets. | SURFACE-SECRETS-02 | | -| SURFACE-SECRETS-06 | TODO | | SPRINT_136_scanner_surface | Ops Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.Secrets) | src/Scanner/__Libraries/StellaOps.Scanner.Surface.Secrets | Update deployment manifests/offline kit bundles to provision secret references instead of raw values. | SURFACE-SECRETS-03 | | -| SURFACE-VAL-01 | DOING | 2025-11-01 | SPRINT_136_scanner_surface | Scanner Guild, Security Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.Validation) | src/Scanner/__Libraries/StellaOps.Scanner.Surface.Validation | Define the Surface validation framework (`surface-validation.md`) covering env/cache/secret checks and extension hooks. | SURFACE-FS-01; SURFACE-ENV-01 | SCSS0102 | -| SURFACE-VAL-02 | TODO | | SPRINT_136_scanner_surface | Scanner Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.Validation) | src/Scanner/__Libraries/StellaOps.Scanner.Surface.Validation | Implement base validation library with check registry and default validators for env/cached manifests/secret refs. | SURFACE-VAL-01; SURFACE-ENV-02; SURFACE-FS-02 | SCSS0102 | -| SURFACE-VAL-03 | TODO | | SPRINT_136_scanner_surface | Scanner Guild, Analyzer Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.Validation) | src/Scanner/__Libraries/StellaOps.Scanner.Surface.Validation | Integrate validation pipeline into Scanner analyzers so checks run before processing. | SURFACE-VAL-02 | SCSS0102 | -| SURFACE-VAL-04 | TODO | | SPRINT_136_scanner_surface | Scanner Guild, Zastava Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.Validation) | src/Scanner/__Libraries/StellaOps.Scanner.Surface.Validation | Expose validation helpers to Zastava and other runtime consumers for preflight checks. | SURFACE-VAL-02 | SCSS0102 | -| SURFACE-VAL-05 | TODO | | SPRINT_136_scanner_surface | Docs Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.Validation) | src/Scanner/__Libraries/StellaOps.Scanner.Surface.Validation | Document validation extensibility, registration, and customization in scanner-engine guides. | SURFACE-VAL-02 | SCSS0102 | -| SVC-32-002 | TODO | | SPRINT_152_orchestrator_ii | Orchestrator Service Guild (src/Orchestrator/StellaOps.Orchestrator) | src/Orchestrator/StellaOps.Orchestrator | | | | -| SVC-32-003 | TODO | | SPRINT_152_orchestrator_ii | Orchestrator Service Guild (src/Orchestrator/StellaOps.Orchestrator) | src/Orchestrator/StellaOps.Orchestrator | | | | -| SVC-32-004 | TODO | | SPRINT_152_orchestrator_ii | Orchestrator Service Guild (src/Orchestrator/StellaOps.Orchestrator) | src/Orchestrator/StellaOps.Orchestrator | | | | -| SVC-32-005 | TODO | | SPRINT_152_orchestrator_ii | Orchestrator Service Guild (src/Orchestrator/StellaOps.Orchestrator) | src/Orchestrator/StellaOps.Orchestrator | | | | -| SVC-33-001 | TODO | | SPRINT_152_orchestrator_ii | Orchestrator Service Guild (src/Orchestrator/StellaOps.Orchestrator) | src/Orchestrator/StellaOps.Orchestrator | | | | -| SVC-33-002 | TODO | | SPRINT_152_orchestrator_ii | Orchestrator Service Guild (src/Orchestrator/StellaOps.Orchestrator) | src/Orchestrator/StellaOps.Orchestrator | | | | -| SVC-33-003 | TODO | | SPRINT_152_orchestrator_ii | Orchestrator Service Guild (src/Orchestrator/StellaOps.Orchestrator) | src/Orchestrator/StellaOps.Orchestrator | | | | -| SVC-33-004 | TODO | | SPRINT_152_orchestrator_ii | Orchestrator Service Guild (src/Orchestrator/StellaOps.Orchestrator) | src/Orchestrator/StellaOps.Orchestrator | | | | -| SVC-34-001 | TODO | | SPRINT_152_orchestrator_ii | Orchestrator Service Guild (src/Orchestrator/StellaOps.Orchestrator) | src/Orchestrator/StellaOps.Orchestrator | | | | -| SVC-34-002 | TODO | | SPRINT_152_orchestrator_ii | Orchestrator Service Guild (src/Orchestrator/StellaOps.Orchestrator) | src/Orchestrator/StellaOps.Orchestrator | | | | -| SVC-34-003 | TODO | | SPRINT_152_orchestrator_ii | Orchestrator Service Guild (src/Orchestrator/StellaOps.Orchestrator) | src/Orchestrator/StellaOps.Orchestrator | | | | -| SVC-34-004 | TODO | | SPRINT_152_orchestrator_ii | Orchestrator Service Guild (src/Orchestrator/StellaOps.Orchestrator) | src/Orchestrator/StellaOps.Orchestrator | | | | +| SURFACE-02 | TODO | | SPRINT_0136_0000_0001_scanner_surface | Scheduler Worker Guild (src/Scheduler/__Libraries/StellaOps.Scheduler.Worker) | src/Scheduler/__Libraries/StellaOps.Scheduler.Worker | | SURFACE-FS-02; SCHED-SURFACE-01 | | +| SURFACE-04 | TODO | | SPRINT_0136_0000_0001_scanner_surface | Scanner Worker Guild (src/Scanner/StellaOps.Scanner.Worker) | src/Scanner/StellaOps.Scanner.Worker | | SCANNER-SURFACE-01; SURFACE-FS-03 | | +| SURFACE-ENV-01 | DONE | 2025-11-13 | SPRINT_0136_0000_0001_scanner_surface | Scanner Guild, Zastava Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.Env) | src/Scanner/__Libraries/StellaOps.Scanner.Surface.Env | Draft `surface-env.md` enumerating environment variables, defaults, and air-gap behaviour for Surface consumers. | — | SCSS0101 | +| SURFACE-ENV-02 | DOING | 2025-11-02 | SPRINT_0136_0000_0001_scanner_surface | Scanner Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.Env) | src/Scanner/__Libraries/StellaOps.Scanner.Surface.Env | Implement strongly-typed env accessors with validation and deterministic logging inside `StellaOps.Scanner.Surface.Env`. | SURFACE-ENV-01 | SCSS0101 | +| SURFACE-ENV-03 | TODO | | SPRINT_0136_0000_0001_scanner_surface | Scanner Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.Env) | src/Scanner/__Libraries/StellaOps.Scanner.Surface.Env | Adopt the env helper across Scanner Worker/WebService/BuildX plug-ins. | SURFACE-ENV-02 | | +| SURFACE-ENV-04 | TODO | | SPRINT_0136_0000_0001_scanner_surface | Zastava Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.Env) | src/Scanner/__Libraries/StellaOps.Scanner.Surface.Env | Wire env helper into Zastava Observer/Webhook containers. | SURFACE-ENV-02 | | +| SURFACE-ENV-05 | TODO | | SPRINT_0136_0000_0001_scanner_surface | Ops Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.Env) | src/Scanner/__Libraries/StellaOps.Scanner.Surface.Env | Update Helm/Compose/offline kit templates with new env knobs and documentation. | SURFACE-ENV-03; SURFACE-ENV-04 | | +| SURFACE-FS-03 | TODO | | SPRINT_0136_0000_0001_scanner_surface | Scanner Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.FS) | src/Scanner/__Libraries/StellaOps.Scanner.Surface.FS | Integrate Surface.FS writer into Scanner Worker analyzer pipeline to persist layer + entry-trace fragments. | SURFACE-FS-02 | | +| SURFACE-FS-04 | TODO | | SPRINT_0136_0000_0001_scanner_surface | Zastava Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.FS) | src/Scanner/__Libraries/StellaOps.Scanner.Surface.FS | Integrate Surface.FS reader into Zastava Observer runtime drift loop. | SURFACE-FS-02 | | +| SURFACE-FS-05 | TODO | | SPRINT_0136_0000_0001_scanner_surface | Scanner Guild, Scheduler Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.FS) | src/Scanner/__Libraries/StellaOps.Scanner.Surface.FS | Expose Surface.FS pointers via Scanner WebService reports and coordinate rescan planning with Scheduler. | SURFACE-FS-03 | | +| SURFACE-FS-06 | TODO | | SPRINT_0136_0000_0001_scanner_surface | Docs Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.FS) | src/Scanner/__Libraries/StellaOps.Scanner.Surface.FS | Update scanner-engine guide and offline kit docs with Surface.FS workflow. | SURFACE-FS-02 | | +| SURFACE-FS-07 | DONE | 2025-12-04 | SPRINT_0136_0000_0001_scanner_surface | Scanner Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.FS) | src/Scanner/__Libraries/StellaOps.Scanner.Surface.FS | Extend Surface.FS manifest schema with `composition.recipe`, fragment attestation metadata, and verification helpers per deterministic SBOM spec. | SCANNER-SURFACE-04 | | +| SURFACE-SECRETS-01 | DOING | 2025-11-02 | SPRINT_0136_0000_0001_scanner_surface | Scanner Guild, Security Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.Secrets) | src/Scanner/__Libraries/StellaOps.Scanner.Surface.Secrets | Produce `surface-secrets.md` defining secret reference schema, storage backends, scopes, and rotation rules. | | | +| SURFACE-SECRETS-02 | DOING | 2025-11-02 | SPRINT_0136_0000_0001_scanner_surface | Scanner Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.Secrets) | src/Scanner/__Libraries/StellaOps.Scanner.Surface.Secrets | Implement `StellaOps.Scanner.Surface.Secrets` core provider interfaces, secret models, and in-memory test backend. | SURFACE-SECRETS-01 | | +| SURFACE-SECRETS-03 | TODO | | SPRINT_0136_0000_0001_scanner_surface | Scanner Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.Secrets) | src/Scanner/__Libraries/StellaOps.Scanner.Surface.Secrets | Add Kubernetes/File/Offline backends with deterministic caching and audit hooks. | SURFACE-SECRETS-02 | SCSS0101 | +| SURFACE-SECRETS-04 | TODO | | SPRINT_0136_0000_0001_scanner_surface | Scanner Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.Secrets) | src/Scanner/__Libraries/StellaOps.Scanner.Surface.Secrets | Integrate Surface.Secrets into Scanner Worker/WebService/BuildX for registry + CAS creds. | SURFACE-SECRETS-02 | | +| SURFACE-SECRETS-05 | TODO | | SPRINT_0136_0000_0001_scanner_surface | Zastava Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.Secrets) | src/Scanner/__Libraries/StellaOps.Scanner.Surface.Secrets | Invoke Surface.Secrets from Zastava Observer/Webhook for CAS & attestation secrets. | SURFACE-SECRETS-02 | | +| SURFACE-SECRETS-06 | TODO | | SPRINT_0136_0000_0001_scanner_surface | Ops Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.Secrets) | src/Scanner/__Libraries/StellaOps.Scanner.Surface.Secrets | Update deployment manifests/offline kit bundles to provision secret references instead of raw values. | SURFACE-SECRETS-03 | | +| SURFACE-VAL-01 | DOING | 2025-11-01 | SPRINT_0136_0000_0001_scanner_surface | Scanner Guild, Security Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.Validation) | src/Scanner/__Libraries/StellaOps.Scanner.Surface.Validation | Define the Surface validation framework (`surface-validation.md`) covering env/cache/secret checks and extension hooks. | SURFACE-FS-01; SURFACE-ENV-01 | SCSS0102 | +| SURFACE-VAL-02 | TODO | | SPRINT_0136_0000_0001_scanner_surface | Scanner Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.Validation) | src/Scanner/__Libraries/StellaOps.Scanner.Surface.Validation | Implement base validation library with check registry and default validators for env/cached manifests/secret refs. | SURFACE-VAL-01; SURFACE-ENV-02; SURFACE-FS-02 | SCSS0102 | +| SURFACE-VAL-03 | TODO | | SPRINT_0136_0000_0001_scanner_surface | Scanner Guild, Analyzer Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.Validation) | src/Scanner/__Libraries/StellaOps.Scanner.Surface.Validation | Integrate validation pipeline into Scanner analyzers so checks run before processing. | SURFACE-VAL-02 | SCSS0102 | +| SURFACE-VAL-04 | TODO | | SPRINT_0136_0000_0001_scanner_surface | Scanner Guild, Zastava Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.Validation) | src/Scanner/__Libraries/StellaOps.Scanner.Surface.Validation | Expose validation helpers to Zastava and other runtime consumers for preflight checks. | SURFACE-VAL-02 | SCSS0102 | +| SURFACE-VAL-05 | TODO | | SPRINT_0136_0000_0001_scanner_surface | Docs Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.Validation) | src/Scanner/__Libraries/StellaOps.Scanner.Surface.Validation | Document validation extensibility, registration, and customization in scanner-engine guides. | SURFACE-VAL-02 | SCSS0102 | +| SVC-32-002 | TODO | | SPRINT_0152_0000_0002_orchestrator_ii | Orchestrator Service Guild (src/Orchestrator/StellaOps.Orchestrator) | src/Orchestrator/StellaOps.Orchestrator | | | | +| SVC-32-003 | TODO | | SPRINT_0152_0000_0002_orchestrator_ii | Orchestrator Service Guild (src/Orchestrator/StellaOps.Orchestrator) | src/Orchestrator/StellaOps.Orchestrator | | | | +| SVC-32-004 | TODO | | SPRINT_0152_0000_0002_orchestrator_ii | Orchestrator Service Guild (src/Orchestrator/StellaOps.Orchestrator) | src/Orchestrator/StellaOps.Orchestrator | | | | +| SVC-32-005 | TODO | | SPRINT_0152_0000_0002_orchestrator_ii | Orchestrator Service Guild (src/Orchestrator/StellaOps.Orchestrator) | src/Orchestrator/StellaOps.Orchestrator | | | | +| SVC-33-001 | TODO | | SPRINT_0152_0000_0002_orchestrator_ii | Orchestrator Service Guild (src/Orchestrator/StellaOps.Orchestrator) | src/Orchestrator/StellaOps.Orchestrator | | | | +| SVC-33-002 | TODO | | SPRINT_0152_0000_0002_orchestrator_ii | Orchestrator Service Guild (src/Orchestrator/StellaOps.Orchestrator) | src/Orchestrator/StellaOps.Orchestrator | | | | +| SVC-33-003 | TODO | | SPRINT_0152_0000_0002_orchestrator_ii | Orchestrator Service Guild (src/Orchestrator/StellaOps.Orchestrator) | src/Orchestrator/StellaOps.Orchestrator | | | | +| SVC-33-004 | TODO | | SPRINT_0152_0000_0002_orchestrator_ii | Orchestrator Service Guild (src/Orchestrator/StellaOps.Orchestrator) | src/Orchestrator/StellaOps.Orchestrator | | | | +| SVC-34-001 | TODO | | SPRINT_0152_0000_0002_orchestrator_ii | Orchestrator Service Guild (src/Orchestrator/StellaOps.Orchestrator) | src/Orchestrator/StellaOps.Orchestrator | | | | +| SVC-34-002 | TODO | | SPRINT_0152_0000_0002_orchestrator_ii | Orchestrator Service Guild (src/Orchestrator/StellaOps.Orchestrator) | src/Orchestrator/StellaOps.Orchestrator | | | | +| SVC-34-003 | TODO | | SPRINT_0152_0000_0002_orchestrator_ii | Orchestrator Service Guild (src/Orchestrator/StellaOps.Orchestrator) | src/Orchestrator/StellaOps.Orchestrator | | | | +| SVC-34-004 | TODO | | SPRINT_0152_0000_0002_orchestrator_ii | Orchestrator Service Guild (src/Orchestrator/StellaOps.Orchestrator) | src/Orchestrator/StellaOps.Orchestrator | | | | | SVC-35-001 | BLOCKED | 2025-10-29 | SPRINT_163_exportcenter_ii | Exporter Service Guild (src/ExportCenter/StellaOps.ExportCenter) | src/ExportCenter/StellaOps.ExportCenter | | | | | SVC-35-002 | TODO | | SPRINT_163_exportcenter_ii | Exporter Service Guild (src/ExportCenter/StellaOps.ExportCenter) | src/ExportCenter/StellaOps.ExportCenter | | | | | SVC-35-003 | TODO | | SPRINT_163_exportcenter_ii | Exporter Service Guild (src/ExportCenter/StellaOps.ExportCenter) | src/ExportCenter/StellaOps.ExportCenter | | | | | SVC-35-004 | TODO | | SPRINT_163_exportcenter_ii | Exporter Service Guild (src/ExportCenter/StellaOps.ExportCenter) | src/ExportCenter/StellaOps.ExportCenter | | | | | SVC-35-005 | TODO | | SPRINT_163_exportcenter_ii | Exporter Service Guild (src/ExportCenter/StellaOps.ExportCenter) | src/ExportCenter/StellaOps.ExportCenter | | | | -| SVC-35-006 | TODO | | SPRINT_164_exportcenter_iii | Exporter Service Guild (src/ExportCenter/StellaOps.ExportCenter) | src/ExportCenter/StellaOps.ExportCenter | | | | -| SVC-35-101 | TODO | | SPRINT_152_orchestrator_ii | Orchestrator Service Guild (src/Orchestrator/StellaOps.Orchestrator) | src/Orchestrator/StellaOps.Orchestrator | | | | -| SVC-36-001 | TODO | | SPRINT_164_exportcenter_iii | Exporter Service Guild (src/ExportCenter/StellaOps.ExportCenter) | src/ExportCenter/StellaOps.ExportCenter | | | | -| SVC-36-002 | TODO | | SPRINT_164_exportcenter_iii | Exporter Service Guild (src/ExportCenter/StellaOps.ExportCenter) | src/ExportCenter/StellaOps.ExportCenter | | | | -| SVC-36-003 | TODO | | SPRINT_164_exportcenter_iii | Exporter Service Guild (src/ExportCenter/StellaOps.ExportCenter) | src/ExportCenter/StellaOps.ExportCenter | | | | -| SVC-36-004 | TODO | | SPRINT_164_exportcenter_iii | Exporter Service Guild (src/ExportCenter/StellaOps.ExportCenter) | src/ExportCenter/StellaOps.ExportCenter | | | | -| SVC-36-101 | TODO | | SPRINT_152_orchestrator_ii | Orchestrator Service Guild (src/Orchestrator/StellaOps.Orchestrator) | src/Orchestrator/StellaOps.Orchestrator | | | | -| SVC-37-001 | TODO | | SPRINT_164_exportcenter_iii | Exporter Service Guild (src/ExportCenter/StellaOps.ExportCenter) | src/ExportCenter/StellaOps.ExportCenter | | | | -| SVC-37-002 | TODO | | SPRINT_164_exportcenter_iii | Exporter Service Guild (src/ExportCenter/StellaOps.ExportCenter) | src/ExportCenter/StellaOps.ExportCenter | | | | -| SVC-37-003 | TODO | | SPRINT_164_exportcenter_iii | Exporter Service Guild (src/ExportCenter/StellaOps.ExportCenter) | src/ExportCenter/StellaOps.ExportCenter | | | | -| SVC-37-004 | TODO | | SPRINT_164_exportcenter_iii | Exporter Service Guild (src/ExportCenter/StellaOps.ExportCenter) | src/ExportCenter/StellaOps.ExportCenter | | | | -| SVC-37-101 | TODO | | SPRINT_152_orchestrator_ii | Orchestrator Service Guild (src/Orchestrator/StellaOps.Orchestrator) | src/Orchestrator/StellaOps.Orchestrator | | | | -| SVC-38-002 | TODO | | SPRINT_172_notifier_ii | Notifications Service Guild (src/Notifier/StellaOps.Notifier) | src/Notifier/StellaOps.Notifier | | | | -| SVC-38-003 | TODO | | SPRINT_172_notifier_ii | Notifications Service Guild (src/Notifier/StellaOps.Notifier) | src/Notifier/StellaOps.Notifier | | | | -| SVC-38-004 | TODO | | SPRINT_172_notifier_ii | Notifications Service Guild (src/Notifier/StellaOps.Notifier) | src/Notifier/StellaOps.Notifier | | | | +| SVC-35-006 | TODO | | SPRINT_0164_0000_0003_exportcenter_iii | Exporter Service Guild (src/ExportCenter/StellaOps.ExportCenter) | src/ExportCenter/StellaOps.ExportCenter | | | | +| SVC-35-101 | TODO | | SPRINT_0152_0000_0002_orchestrator_ii | Orchestrator Service Guild (src/Orchestrator/StellaOps.Orchestrator) | src/Orchestrator/StellaOps.Orchestrator | | | | +| SVC-36-001 | TODO | | SPRINT_0164_0000_0003_exportcenter_iii | Exporter Service Guild (src/ExportCenter/StellaOps.ExportCenter) | src/ExportCenter/StellaOps.ExportCenter | | | | +| SVC-36-002 | TODO | | SPRINT_0164_0000_0003_exportcenter_iii | Exporter Service Guild (src/ExportCenter/StellaOps.ExportCenter) | src/ExportCenter/StellaOps.ExportCenter | | | | +| SVC-36-003 | TODO | | SPRINT_0164_0000_0003_exportcenter_iii | Exporter Service Guild (src/ExportCenter/StellaOps.ExportCenter) | src/ExportCenter/StellaOps.ExportCenter | | | | +| SVC-36-004 | TODO | | SPRINT_0164_0000_0003_exportcenter_iii | Exporter Service Guild (src/ExportCenter/StellaOps.ExportCenter) | src/ExportCenter/StellaOps.ExportCenter | | | | +| SVC-36-101 | TODO | | SPRINT_0152_0000_0002_orchestrator_ii | Orchestrator Service Guild (src/Orchestrator/StellaOps.Orchestrator) | src/Orchestrator/StellaOps.Orchestrator | | | | +| SVC-37-001 | TODO | | SPRINT_0164_0000_0003_exportcenter_iii | Exporter Service Guild (src/ExportCenter/StellaOps.ExportCenter) | src/ExportCenter/StellaOps.ExportCenter | | | | +| SVC-37-002 | TODO | | SPRINT_0164_0000_0003_exportcenter_iii | Exporter Service Guild (src/ExportCenter/StellaOps.ExportCenter) | src/ExportCenter/StellaOps.ExportCenter | | | | +| SVC-37-003 | TODO | | SPRINT_0164_0000_0003_exportcenter_iii | Exporter Service Guild (src/ExportCenter/StellaOps.ExportCenter) | src/ExportCenter/StellaOps.ExportCenter | | | | +| SVC-37-004 | TODO | | SPRINT_0164_0000_0003_exportcenter_iii | Exporter Service Guild (src/ExportCenter/StellaOps.ExportCenter) | src/ExportCenter/StellaOps.ExportCenter | | | | +| SVC-37-101 | TODO | | SPRINT_0152_0000_0002_orchestrator_ii | Orchestrator Service Guild (src/Orchestrator/StellaOps.Orchestrator) | src/Orchestrator/StellaOps.Orchestrator | | | | +| SVC-38-002 | TODO | | SPRINT_0172_0000_0002_notifier_ii | Notifications Service Guild (src/Notifier/StellaOps.Notifier) | src/Notifier/StellaOps.Notifier | | | | +| SVC-38-003 | TODO | | SPRINT_0172_0000_0002_notifier_ii | Notifications Service Guild (src/Notifier/StellaOps.Notifier) | src/Notifier/StellaOps.Notifier | | | | +| SVC-38-004 | TODO | | SPRINT_0172_0000_0002_notifier_ii | Notifications Service Guild (src/Notifier/StellaOps.Notifier) | src/Notifier/StellaOps.Notifier | | | | | SVC-38-101 | TODO | | SPRINT_0153_0001_0003_orchestrator_iii | Orchestrator Service Guild (src/Orchestrator/StellaOps.Orchestrator) | src/Orchestrator/StellaOps.Orchestrator | | | | -| SVC-39-001 | TODO | | SPRINT_172_notifier_ii | Notifications Service Guild (src/Notifier/StellaOps.Notifier) | src/Notifier/StellaOps.Notifier | | | | -| SVC-39-002 | TODO | | SPRINT_172_notifier_ii | Notifications Service Guild (src/Notifier/StellaOps.Notifier) | src/Notifier/StellaOps.Notifier | | | | -| SVC-39-003 | TODO | | SPRINT_172_notifier_ii | Notifications Service Guild (src/Notifier/StellaOps.Notifier) | src/Notifier/StellaOps.Notifier | | | | -| SVC-39-004 | TODO | | SPRINT_172_notifier_ii | Notifications Service Guild (src/Notifier/StellaOps.Notifier) | src/Notifier/StellaOps.Notifier | | | | -| SVC-40-001 | TODO | | SPRINT_172_notifier_ii | Notifications Service Guild (src/Notifier/StellaOps.Notifier) | src/Notifier/StellaOps.Notifier | | | | -| SVC-40-002 | TODO | | SPRINT_172_notifier_ii | Notifications Service Guild (src/Notifier/StellaOps.Notifier) | src/Notifier/StellaOps.Notifier | | | | -| SVC-40-003 | TODO | | SPRINT_172_notifier_ii | Notifications Service Guild (src/Notifier/StellaOps.Notifier) | src/Notifier/StellaOps.Notifier | | | | -| SVC-40-004 | TODO | | SPRINT_172_notifier_ii | Notifications Service Guild (src/Notifier/StellaOps.Notifier) | src/Notifier/StellaOps.Notifier | | | | +| SVC-39-001 | TODO | | SPRINT_0172_0000_0002_notifier_ii | Notifications Service Guild (src/Notifier/StellaOps.Notifier) | src/Notifier/StellaOps.Notifier | | | | +| SVC-39-002 | TODO | | SPRINT_0172_0000_0002_notifier_ii | Notifications Service Guild (src/Notifier/StellaOps.Notifier) | src/Notifier/StellaOps.Notifier | | | | +| SVC-39-003 | TODO | | SPRINT_0172_0000_0002_notifier_ii | Notifications Service Guild (src/Notifier/StellaOps.Notifier) | src/Notifier/StellaOps.Notifier | | | | +| SVC-39-004 | TODO | | SPRINT_0172_0000_0002_notifier_ii | Notifications Service Guild (src/Notifier/StellaOps.Notifier) | src/Notifier/StellaOps.Notifier | | | | +| SVC-40-001 | TODO | | SPRINT_0172_0000_0002_notifier_ii | Notifications Service Guild (src/Notifier/StellaOps.Notifier) | src/Notifier/StellaOps.Notifier | | | | +| SVC-40-002 | TODO | | SPRINT_0172_0000_0002_notifier_ii | Notifications Service Guild (src/Notifier/StellaOps.Notifier) | src/Notifier/StellaOps.Notifier | | | | +| SVC-40-003 | TODO | | SPRINT_0172_0000_0002_notifier_ii | Notifications Service Guild (src/Notifier/StellaOps.Notifier) | src/Notifier/StellaOps.Notifier | | | | +| SVC-40-004 | TODO | | SPRINT_0172_0000_0002_notifier_ii | Notifications Service Guild (src/Notifier/StellaOps.Notifier) | src/Notifier/StellaOps.Notifier | | | | | SVC-41-101 | TODO | | SPRINT_0153_0001_0003_orchestrator_iii | Orchestrator Service Guild (src/Orchestrator/StellaOps.Orchestrator) | src/Orchestrator/StellaOps.Orchestrator | | | | | SVC-42-101 | TODO | | SPRINT_0153_0001_0003_orchestrator_iii | Orchestrator Service Guild (src/Orchestrator/StellaOps.Orchestrator) | src/Orchestrator/StellaOps.Orchestrator | | | | -| SVC-43-001 | TODO | | SPRINT_164_exportcenter_iii | Exporter Service Guild (src/ExportCenter/StellaOps.ExportCenter) | src/ExportCenter/StellaOps.ExportCenter | | | | +| SVC-43-001 | TODO | | SPRINT_0164_0000_0003_exportcenter_iii | Exporter Service Guild (src/ExportCenter/StellaOps.ExportCenter) | src/ExportCenter/StellaOps.ExportCenter | | | | | SYM-007 | TODO | | SPRINT_0401_0001_0001_reachability_evidence_chain | Scanner Worker Guild & Docs Guild (`src/Scanner/StellaOps.Scanner.Models`, `docs/modules/scanner/architecture.md`, `docs/reachability/function-level-evidence.md`) | `src/Scanner/StellaOps.Scanner.Models`, `docs/modules/scanner/architecture.md`, `docs/reachability/function-level-evidence.md` | | | | | SYMS-70-003 | TODO | | SPRINT_0304_0001_0004_docs_tasks_md_iv | Docs Guild, Symbols Guild (docs) | | | | | | SYMS-90-005 | TODO | | SPRINT_0505_0001_0001_ops_devops_iii | DevOps Guild, Symbols Guild (ops/devops) | ops/devops | | | | @@ -1953,17 +1953,17 @@ | TELEMETRY-DOCS-0001 | TODO | | SPRINT_330_docs_modules_telemetry | Docs Guild | docs/modules/telemetry | Validate that telemetry module docs reflect the new storage stack and isolation rules. | Ops checklist from DVDO0103 | DOTL0101 | | TELEMETRY-DOCS-0001 | TODO | | SPRINT_330_docs_modules_telemetry | Docs Guild | docs/modules/telemetry | Validate that telemetry module docs reflect the new storage stack and isolation rules. | Ops checklist from DVDO0103 | DOTL0101 | | TELEMETRY-ENG-0001 | TODO | | SPRINT_330_docs_modules_telemetry | Module Team | docs/modules/telemetry | Ensure milestones stay in sync with telemetry sprints in `docs/implplan`. | TLTY0101 API review | DOTL0101 | -| TELEMETRY-OBS-50-001 | DOING | | SPRINT_170_notifications_telemetry | Telemetry Core Guild | src/Telemetry/StellaOps.Telemetry.Core | Core bootstrap coding active (50-001); propagation adapters (50-002) queued pending package publication. | 50-002 dashboards | TLTY0101 | -| TELEMETRY-OBS-50-002 | DOING | | SPRINT_170_notifications_telemetry | Telemetry Core Guild | src/Telemetry/StellaOps.Telemetry.Core | OBS-50-001 rollout | OBS-50-001 rollout | TLTY0101 | -| TELEMETRY-OBS-51-001 | TODO | | SPRINT_170_notifications_telemetry | Telemetry Core Guild | src/Telemetry/StellaOps.Telemetry.Core | Roslyn analyzer + scrub policy review pending Security Guild approval. | 51-002 scope review | TLTY0101 | -| TELEMETRY-OBS-51-002 | TODO | | SPRINT_170_notifications_telemetry | Telemetry Core Guild | src/Telemetry/StellaOps.Telemetry.Core | OBS-51-001 shadow mode | OBS-51-001 shadow mode | TLTY0101 | -| TELEMETRY-OBS-55-001 | TODO | | SPRINT_170_notifications_telemetry | Telemetry Core Guild · Observability Guild | src/Telemetry/StellaOps.Telemetry.Core | Requires CLI toggle contract (CLI-OBS-12-001) and Notify incident payload spec (NOTIFY-OBS-55-001). | 56-001 event schema | TLTY0101 | -| TELEMETRY-OBS-56-001 | TODO | | SPRINT_174_telemetry | Telemetry Core Guild | src/Telemetry/StellaOps.Telemetry.Core | Add sealed-mode telemetry helpers (drift metrics, seal/unseal spans, offline exporters) and ensure hosts can disable external exporters when sealed. Dependencies: TELEMETRY-OBS-55-001. | OBS-55-001 output | TLTY0101 | +| TELEMETRY-OBS-50-001 | DOING | | SPRINT_0170_0000_0001_notifications_telemetry | Telemetry Core Guild | src/Telemetry/StellaOps.Telemetry.Core | Core bootstrap coding active (50-001); propagation adapters (50-002) queued pending package publication. | 50-002 dashboards | TLTY0101 | +| TELEMETRY-OBS-50-002 | DOING | | SPRINT_0170_0000_0001_notifications_telemetry | Telemetry Core Guild | src/Telemetry/StellaOps.Telemetry.Core | OBS-50-001 rollout | OBS-50-001 rollout | TLTY0101 | +| TELEMETRY-OBS-51-001 | TODO | | SPRINT_0170_0000_0001_notifications_telemetry | Telemetry Core Guild | src/Telemetry/StellaOps.Telemetry.Core | Roslyn analyzer + scrub policy review pending Security Guild approval. | 51-002 scope review | TLTY0101 | +| TELEMETRY-OBS-51-002 | TODO | | SPRINT_0170_0000_0001_notifications_telemetry | Telemetry Core Guild | src/Telemetry/StellaOps.Telemetry.Core | OBS-51-001 shadow mode | OBS-51-001 shadow mode | TLTY0101 | +| TELEMETRY-OBS-55-001 | TODO | | SPRINT_0170_0000_0001_notifications_telemetry | Telemetry Core Guild · Observability Guild | src/Telemetry/StellaOps.Telemetry.Core | Requires CLI toggle contract (CLI-OBS-12-001) and Notify incident payload spec (NOTIFY-OBS-55-001). | 56-001 event schema | TLTY0101 | +| TELEMETRY-OBS-56-001 | TODO | | SPRINT_0174_0000_0001_telemetry | Telemetry Core Guild | src/Telemetry/StellaOps.Telemetry.Core | Add sealed-mode telemetry helpers (drift metrics, seal/unseal spans, offline exporters) and ensure hosts can disable external exporters when sealed. Dependencies: TELEMETRY-OBS-55-001. | OBS-55-001 output | TLTY0101 | | TELEMETRY-OPS-0001 | TODO | | SPRINT_330_docs_modules_telemetry | Ops Guild | docs/modules/telemetry | Review telemetry runbooks/observability dashboards post-demo. | DVDO0103 deployment notes | DOTL0101 | -| TEN-47-001 | TODO | | SPRINT_205_cli_v | DevEx/CLI Guild (src/Cli/StellaOps.Cli) | src/Cli/StellaOps.Cli | | | | +| TEN-47-001 | TODO | | SPRINT_0205_0000_0005_cli_v | DevEx/CLI Guild (src/Cli/StellaOps.Cli) | src/Cli/StellaOps.Cli | | | | | TEN-48-001 | TODO | | SPRINT_115_concelier_iv | Concelier Core Guild (src/Concelier/__Libraries/StellaOps.Concelier.Core) | src/Concelier/__Libraries/StellaOps.Concelier.Core | | | | -| TEN-49-001 | TODO | | SPRINT_205_cli_v | DevEx/CLI Guild (src/Cli/StellaOps.Cli) | src/Cli/StellaOps.Cli | | | | -| TEST-186-006 | TODO | | SPRINT_186_record_deterministic_execution | Signing Guild, QA Guild (`src/Signer/StellaOps.Signer.Tests`) | `src/Signer/StellaOps.Signer.Tests` | | | | +| TEN-49-001 | TODO | | SPRINT_0205_0000_0005_cli_v | DevEx/CLI Guild (src/Cli/StellaOps.Cli) | src/Cli/StellaOps.Cli | | | | +| TEST-186-006 | TODO | | SPRINT_0186_0000_0001_record_deterministic_execution | Signing Guild, QA Guild (`src/Signer/StellaOps.Signer.Tests`) | `src/Signer/StellaOps.Signer.Tests` | | | | | TEST-62-001 | DOING | | SPRINT_0310_0001_0010_docs_tasks_md_x | Docs Guild, Contract Testing Guild (docs) | | | | | | TIME-57-001 | TODO | | SPRINT_0503_0001_0001_ops_devops_i | Exporter Guild · AirGap Time Guild · CLI Guild | | | PROGRAM-STAFF-1001 | | | TIME-57-002 | TODO | | SPRINT_510_airgap | Exporter Guild · AirGap Time Guild · CLI Guild | src/AirGap/StellaOps.AirGap.Time | PROGRAM-STAFF-1001 | PROGRAM-STAFF-1001 | AGTM0101 | @@ -2022,17 +2022,17 @@ | UNCERTAINTY-SCHEMA-401-024 | TODO | | SPRINT_0401_0001_0001_reachability_evidence_chain | Signals Guild (`src/Signals/StellaOps.Signals`, `docs/uncertainty/README.md`) | `src/Signals/StellaOps.Signals`, `docs/uncertainty/README.md` | Extend Signals findings with `uncertainty.states[]`, entropy fields, and `riskScore`; emit `FindingUncertaintyUpdated` events and persist evidence per docs. | | | | UNCERTAINTY-SCORER-401-025 | TODO | | SPRINT_0401_0001_0001_reachability_evidence_chain | Signals Guild (`src/Signals/StellaOps.Signals.Application`, `docs/uncertainty/README.md`) | `src/Signals/StellaOps.Signals.Application`, `docs/uncertainty/README.md` | Implement the entropy-aware risk scorer (`riskScore = base × reach × trust × (1 + entropyBoost)`) and wire it into finding writes. | | | | UNCERTAINTY-UI-401-027 | TODO | | SPRINT_0401_0001_0001_reachability_evidence_chain | UI Guild · CLI Guild (`src/UI/StellaOps.UI`, `src/Cli/StellaOps.Cli`, `docs/uncertainty/README.md`) | `src/UI/StellaOps.UI`, `src/Cli/StellaOps.Cli`, `docs/uncertainty/README.md` | Surface uncertainty chips/tooltips in the Console (React UI) + CLI output (risk score + entropy states). | | | -| VAL-01 | DOING | 2025-11-01 | SPRINT_136_scanner_surface | Scanner Guild, Security Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.Validation) | src/Scanner/__Libraries/StellaOps.Scanner.Surface.Validation | | SURFACE-FS-01; SURFACE-ENV-01 | | -| VAL-02 | TODO | | SPRINT_136_scanner_surface | Scanner Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.Validation) | src/Scanner/__Libraries/StellaOps.Scanner.Surface.Validation | | SURFACE-VAL-01; SURFACE-ENV-02; SURFACE-FS-02 | | -| VAL-03 | TODO | | SPRINT_136_scanner_surface | Scanner Guild, Analyzer Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.Validation) | src/Scanner/__Libraries/StellaOps.Scanner.Surface.Validation | | SURFACE-VAL-02 | | -| VAL-04 | TODO | | SPRINT_136_scanner_surface | Scanner Guild, Zastava Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.Validation) | src/Scanner/__Libraries/StellaOps.Scanner.Surface.Validation | | SURFACE-VAL-02 | | -| VAL-05 | TODO | | SPRINT_136_scanner_surface | Docs Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.Validation) | src/Scanner/__Libraries/StellaOps.Scanner.Surface.Validation | | SURFACE-VAL-02 | | -| VERIFY-186-007 | TODO | | SPRINT_186_record_deterministic_execution | Authority Guild, Provenance Guild (`src/Authority/StellaOps.Authority`, `src/Provenance/StellaOps.Provenance.Attestation`) | `src/Authority/StellaOps.Authority`, `src/Provenance/StellaOps.Provenance.Attestation` | | | | +| VAL-01 | DOING | 2025-11-01 | SPRINT_0136_0000_0001_scanner_surface | Scanner Guild, Security Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.Validation) | src/Scanner/__Libraries/StellaOps.Scanner.Surface.Validation | | SURFACE-FS-01; SURFACE-ENV-01 | | +| VAL-02 | TODO | | SPRINT_0136_0000_0001_scanner_surface | Scanner Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.Validation) | src/Scanner/__Libraries/StellaOps.Scanner.Surface.Validation | | SURFACE-VAL-01; SURFACE-ENV-02; SURFACE-FS-02 | | +| VAL-03 | TODO | | SPRINT_0136_0000_0001_scanner_surface | Scanner Guild, Analyzer Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.Validation) | src/Scanner/__Libraries/StellaOps.Scanner.Surface.Validation | | SURFACE-VAL-02 | | +| VAL-04 | TODO | | SPRINT_0136_0000_0001_scanner_surface | Scanner Guild, Zastava Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.Validation) | src/Scanner/__Libraries/StellaOps.Scanner.Surface.Validation | | SURFACE-VAL-02 | | +| VAL-05 | TODO | | SPRINT_0136_0000_0001_scanner_surface | Docs Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.Validation) | src/Scanner/__Libraries/StellaOps.Scanner.Surface.Validation | | SURFACE-VAL-02 | | +| VERIFY-186-007 | TODO | | SPRINT_0186_0000_0001_record_deterministic_execution | Authority Guild, Provenance Guild (`src/Authority/StellaOps.Authority`, `src/Provenance/StellaOps.Provenance.Attestation`) | `src/Authority/StellaOps.Authority`, `src/Provenance/StellaOps.Provenance.Attestation` | | | | | VEX-006 | TODO | | SPRINT_0401_0001_0001_reachability_evidence_chain | Policy, Excititor, UI, CLI & Notify Guilds (`docs/modules/excititor/architecture.md`, `src/Cli/StellaOps.Cli`, `src/UI/StellaOps.UI`, `docs/09_API_CLI_REFERENCE.md`) | `docs/modules/excititor/architecture.md`, `src/Cli/StellaOps.Cli`, `src/UI/StellaOps.UI`, `docs/09_API_CLI_REFERENCE.md` | | | | | VEX-30-001 | BLOCKED | 2025-11-19 | SPRINT_0212_0001_0001_web_i | Console Guild, BE-Base Platform Guild (src/Web/StellaOps.Web) | src/Web/StellaOps.Web | | | | -| VEX-30-002 | TODO | | SPRINT_205_cli_v | DevEx/CLI Guild (src/Cli/StellaOps.Cli) | src/Cli/StellaOps.Cli | | | | -| VEX-30-003 | TODO | | SPRINT_205_cli_v | DevEx/CLI Guild (src/Cli/StellaOps.Cli) | src/Cli/StellaOps.Cli | | | | -| VEX-30-004 | TODO | | SPRINT_205_cli_v | DevEx/CLI Guild (src/Cli/StellaOps.Cli) | src/Cli/StellaOps.Cli | | | | +| VEX-30-002 | TODO | | SPRINT_0205_0000_0005_cli_v | DevEx/CLI Guild (src/Cli/StellaOps.Cli) | src/Cli/StellaOps.Cli | | | | +| VEX-30-003 | TODO | | SPRINT_0205_0000_0005_cli_v | DevEx/CLI Guild (src/Cli/StellaOps.Cli) | src/Cli/StellaOps.Cli | | | | +| VEX-30-004 | TODO | | SPRINT_0205_0000_0005_cli_v | DevEx/CLI Guild (src/Cli/StellaOps.Cli) | src/Cli/StellaOps.Cli | | | | | VEX-30-005 | DOING | | SPRINT_0310_0001_0010_docs_tasks_md_x | Docs Guild, Console Guild (docs) | | | | | | VEX-30-006 | DOING | | SPRINT_0310_0001_0010_docs_tasks_md_x | Docs Guild, Policy Guild (docs) | | | | DOVX0101 | | VEX-30-007 | BLOCKED | | SPRINT_216_web_v | BE-Base Platform Guild, VEX Lens Guild (src/Web/StellaOps.Web) | src/Web/StellaOps.Web | | | DOVX0101 | @@ -2066,11 +2066,11 @@ | VEXLENS-ORCH-33-001 | TODO | | SPRINT_0129_0001_0001_policy_reasoning | VEX Lens Guild | src/VexLens/StellaOps.VexLens | Register `consensus_compute` job type with orchestrator, integrate worker SDK, and expose job planning hooks for consensus batches | — | PLVL0103 | | VEXLENS-ORCH-34-001 | TODO | | SPRINT_0129_0001_0001_policy_reasoning | VEX Lens Guild | src/VexLens/StellaOps.VexLens | Emit consensus completion events into orchestrator run ledger and provenance chain, including confidence metadata | VEXLENS-ORCH-33-001 | PLVL0103 | | VULN-29-001 | BLOCKED | 2025-11-19 | SPRINT_0212_0001_0001_web_i | Console Guild, BE-Base Platform Guild (src/Web/StellaOps.Web) | src/Web/StellaOps.Web | | | | -| VULN-29-002 | TODO | | SPRINT_123_excititor_v | Excititor WebService Guild (src/Excititor/StellaOps.Excititor.WebService) | src/Excititor/StellaOps.Excititor.WebService | | | | -| VULN-29-003 | TODO | | SPRINT_205_cli_v | DevEx/CLI Guild (src/Cli/StellaOps.Cli) | src/Cli/StellaOps.Cli | | | | +| VULN-29-002 | TODO | | SPRINT_0123_0000_0005_excititor_v | Excititor WebService Guild (src/Excititor/StellaOps.Excititor.WebService) | src/Excititor/StellaOps.Excititor.WebService | | | | +| VULN-29-003 | TODO | | SPRINT_0205_0000_0005_cli_v | DevEx/CLI Guild (src/Cli/StellaOps.Cli) | src/Cli/StellaOps.Cli | | | | | VULN-29-004 | TODO | | SPRINT_116_concelier_v | Concelier WebService Guild, Observability Guild (src/Concelier/StellaOps.Concelier.WebService) | src/Concelier/StellaOps.Concelier.WebService | | | | -| VULN-29-005 | TODO | | SPRINT_205_cli_v | DevEx/CLI Guild (src/Cli/StellaOps.Cli) | src/Cli/StellaOps.Cli | | | | -| VULN-29-006 | TODO | | SPRINT_205_cli_v | DevEx/CLI Guild, Docs Guild (src/Cli/StellaOps.Cli) | src/Cli/StellaOps.Cli | | | | +| VULN-29-005 | TODO | | SPRINT_0205_0000_0005_cli_v | DevEx/CLI Guild (src/Cli/StellaOps.Cli) | src/Cli/StellaOps.Cli | | | | +| VULN-29-006 | TODO | | SPRINT_0205_0000_0005_cli_v | DevEx/CLI Guild, Docs Guild (src/Cli/StellaOps.Cli) | src/Cli/StellaOps.Cli | | | | | VULN-29-007 | TODO | | SPRINT_0311_0001_0001_docs_tasks_md_xi | Docs Guild, Excititor Guild (docs) | | | | | | VULN-29-008 | TODO | | SPRINT_0311_0001_0001_docs_tasks_md_xi | Docs Guild, Concelier Guild (docs) | | | | | | VULN-29-009 | TODO | | SPRINT_0311_0001_0001_docs_tasks_md_xi | Docs Guild, SBOM Service Guild (docs) | | | | | @@ -2135,7 +2135,7 @@ | WEB-NOTIFY-38-001 | TODO | | SPRINT_0214_0001_0001_web_iii | BE-Base Platform Guild | src/Web/StellaOps.Web | Route notifier APIs (`/notifications/*`) and WS feed through gateway with tenant scoping, viewer/operator scope enforcement, and SSE/WebSocket bridging. | Depends on #1 for signed ack spec | NOWB0101 | | WEB-NOTIFY-39-001 | TODO | | SPRINT_0214_0001_0001_web_iii | BE-Base Platform Guild | src/Web/StellaOps.Web | Surface digest scheduling, quiet-hour/throttle management, and simulation APIs; ensure rate limits and audit logging. Dependencies: WEB-NOTIFY-38-001. | WEB-NOTIFY-38-001 | NOWB0101 | | WEB-NOTIFY-40-001 | TODO | | SPRINT_0214_0001_0001_web_iii | BE-Base Platform Guild (src/Web/StellaOps.Web) | src/Web/StellaOps.Web | Expose escalation, localization, channel health, and ack verification endpoints with admin scope enforcement and signed token validation. Dependencies: WEB-NOTIFY-39-001. | | | -| WEB-OAS-61-001 | TODO | | SPRINT_124_excititor_vi | Excititor WebService Guild (src/Excititor/StellaOps.Excititor.WebService) | src/Excititor/StellaOps.Excititor.WebService | | | | +| WEB-OAS-61-001 | TODO | | SPRINT_0124_0000_0006_excititor_vi | Excititor WebService Guild (src/Excititor/StellaOps.Excititor.WebService) | src/Excititor/StellaOps.Excititor.WebService | | | | | WEB-OAS-61-002 | TODO | | SPRINT_116_concelier_v | Concelier WebService Guild (src/Concelier/StellaOps.Concelier.WebService) | src/Concelier/StellaOps.Concelier.WebService | | | | | WEB-OAS-62-001 | TODO | | SPRINT_116_concelier_v | Concelier WebService Guild (src/Concelier/StellaOps.Concelier.WebService) | src/Concelier/StellaOps.Concelier.WebService | | | | | WEB-OAS-63-001 | TODO | | SPRINT_116_concelier_v | Concelier WebService Guild, API Governance Guild (src/Concelier/StellaOps.Concelier.WebService) | src/Concelier/StellaOps.Concelier.WebService | | | | @@ -2147,21 +2147,21 @@ | WEB-OBS-55-001 | TODO | | SPRINT_117_concelier_vi | Concelier WebService Guild · DevOps Guild | src/Concelier/StellaOps.Concelier.WebService | Wait for DevOps alert profiles (045_DVDO0103) | Wait for DevOps alert profiles (045_DVDO0103) | CNOB0102 | | WEB-OBS-56-001 | TODO | | SPRINT_0214_0001_0001_web_iii | BE-Base Platform Guild, AirGap Guild (src/Web/StellaOps.Web) | src/Web/StellaOps.Web | Extend telemetry core integration to expose sealed/unsealed status APIs, drift metrics, and Console widgets without leaking sealed-mode secrets. Dependencies: WEB-OBS-55-001. | | | | WEB-ORCH-32-001 | TODO | | SPRINT_0214_0001_0001_web_iii | BE-Base Platform Guild (src/Web/StellaOps.Web) | src/Web/StellaOps.Web | Expose `/orchestrator/sources | | | -| WEB-ORCH-33-001 | TODO | | SPRINT_215_web_iv | BE-Base Platform Guild (src/Web/StellaOps.Web) | src/Web/StellaOps.Web | Add POST action routes (`pause. Dependencies: WEB-ORCH-32-001. | | | -| WEB-ORCH-34-001 | TODO | | SPRINT_215_web_iv | BE-Base Platform Guild (src/Web/StellaOps.Web) | src/Web/StellaOps.Web | Surface quotas/backfill APIs, queue/backpressure metrics, and error clustering routes with admin scope enforcement and audit logging. Dependencies: WEB-ORCH-33-001. | | | -| WEB-POLICY-20-001 | TODO | | SPRINT_215_web_iv | BE-Base Platform Guild, Policy Guild (src/Web/StellaOps.Web) | src/Web/StellaOps.Web | Implement Policy CRUD/compile/run/simulate/findings/explain endpoints with OpenAPI, tenant scoping, and service identity enforcement. | | | -| WEB-POLICY-20-002 | TODO | | SPRINT_215_web_iv | BE-Base Platform Guild (src/Web/StellaOps.Web) | src/Web/StellaOps.Web | Add pagination, filtering, sorting, and tenant guards to listings for policies, runs, and findings; include deterministic ordering and query diagnostics. Dependencies: WEB-POLICY-20-001. | | | -| WEB-POLICY-20-003 | TODO | | SPRINT_215_web_iv | BE-Base Platform Guild, QA Guild (src/Web/StellaOps.Web) | src/Web/StellaOps.Web | Map engine errors to `ERR_POL_*` responses with consistent payloads and contract tests; expose correlation IDs in headers. Dependencies: WEB-POLICY-20-002. | | | -| WEB-POLICY-20-004 | TODO | | SPRINT_215_web_iv | Platform Reliability Guild (src/Web/StellaOps.Web) | src/Web/StellaOps.Web | Introduce adaptive rate limiting + quotas for simulation endpoints, expose metrics, and document retry headers. Dependencies: WEB-POLICY-20-003. | | | -| WEB-POLICY-23-001 | BLOCKED | 2025-10-29 | SPRINT_215_web_iv | BE-Base Platform Guild, Policy Guild (src/Web/StellaOps.Web) | src/Web/StellaOps.Web | Implement API endpoints for creating/listing/fetching policy packs and revisions (`/policy/packs`, `/policy/packs/{id}/revisions`) with pagination, RBAC, and AOC metadata exposure. (Tracked via Sprint 18.5 gateway tasks.). Dependencies: WEB-POLICY-20-004. | | | -| WEB-POLICY-23-002 | BLOCKED | 2025-10-29 | SPRINT_215_web_iv | BE-Base Platform Guild (src/Web/StellaOps.Web) | src/Web/StellaOps.Web | Add activation endpoint with scope windows, conflict checks, and optional 2-person approval integration; emit events on success. (Tracked via Sprint 18.5 gateway tasks.). Dependencies: WEB-POLICY-23-001. | | | -| WEB-POLICY-23-003 | TODO | | SPRINT_215_web_iv | BE-Base Platform Guild (src/Web/StellaOps.Web) | src/Web/StellaOps.Web | Provide `/policy/simulate` and `/policy/evaluate` endpoints with streaming responses, rate limiting, and error mapping. Dependencies: WEB-POLICY-23-002. | | | -| WEB-POLICY-23-004 | TODO | | SPRINT_215_web_iv | BE-Base Platform Guild (src/Web/StellaOps.Web) | src/Web/StellaOps.Web | Expose explain history endpoints (`/policy/runs`, `/policy/runs/{id}`) including decision tree, sources consulted, and AOC chain. Dependencies: WEB-POLICY-23-003. | | | -| WEB-POLICY-27-001 | TODO | | SPRINT_215_web_iv | BE-Base Platform Guild | src/Web/StellaOps.Web | Surface Policy Registry APIs (`/policy/workspaces`, `/policy/versions`, `/policy/reviews`, `/policy/registry`) through gateway with tenant scoping, RBAC, and request validation; ensure streaming downloads for evidence bundles. Dependencies: WEB-POLICY-23-004. | Needs registry schema | | -| WEB-POLICY-27-002 | TODO | | SPRINT_215_web_iv | BE-Base Platform Guild | src/Web/StellaOps.Web | Implement review lifecycle endpoints (open, comment, approve/reject) with audit headers, comment pagination, and webhook fan-out. Dependencies: WEB-POLICY-27-001. | Depends on 27-001 | | -| WEB-POLICY-27-003 | TODO | | SPRINT_215_web_iv | Platform Reliability Guild | src/Web/StellaOps.Web | Expose quick/batch simulation endpoints with SSE progress (`/policy/simulations/{runId}/stream`), cursor-based result pagination, and manifest download routes. Dependencies: WEB-POLICY-27-002. | Needs 27-002 | | -| WEB-POLICY-27-004 | TODO | | SPRINT_215_web_iv | BE/Security Guild | src/Web/StellaOps.Web | Add publish/sign/promote/rollback endpoints with idempotent request IDs, canary parameters, and environment bindings; enforce scope checks and emit structured events. Dependencies: WEB-POLICY-27-003. | Depends on 27-003 | | -| WEB-POLICY-27-005 | TODO | | SPRINT_215_web_iv | BE/Observability Guild | src/Web/StellaOps.Web | Instrument metrics/logs for compile latency, simulation queue depth, approval latency, promotion actions; expose aggregated dashboards and correlation IDs for Console. Dependencies: WEB-POLICY-27-004. | Needs 27-004 metrics | | +| WEB-ORCH-33-001 | TODO | | SPRINT_0215_0000_0004_web_iv | BE-Base Platform Guild (src/Web/StellaOps.Web) | src/Web/StellaOps.Web | Add POST action routes (`pause. Dependencies: WEB-ORCH-32-001. | | | +| WEB-ORCH-34-001 | TODO | | SPRINT_0215_0000_0004_web_iv | BE-Base Platform Guild (src/Web/StellaOps.Web) | src/Web/StellaOps.Web | Surface quotas/backfill APIs, queue/backpressure metrics, and error clustering routes with admin scope enforcement and audit logging. Dependencies: WEB-ORCH-33-001. | | | +| WEB-POLICY-20-001 | TODO | | SPRINT_0215_0000_0004_web_iv | BE-Base Platform Guild, Policy Guild (src/Web/StellaOps.Web) | src/Web/StellaOps.Web | Implement Policy CRUD/compile/run/simulate/findings/explain endpoints with OpenAPI, tenant scoping, and service identity enforcement. | | | +| WEB-POLICY-20-002 | TODO | | SPRINT_0215_0000_0004_web_iv | BE-Base Platform Guild (src/Web/StellaOps.Web) | src/Web/StellaOps.Web | Add pagination, filtering, sorting, and tenant guards to listings for policies, runs, and findings; include deterministic ordering and query diagnostics. Dependencies: WEB-POLICY-20-001. | | | +| WEB-POLICY-20-003 | TODO | | SPRINT_0215_0000_0004_web_iv | BE-Base Platform Guild, QA Guild (src/Web/StellaOps.Web) | src/Web/StellaOps.Web | Map engine errors to `ERR_POL_*` responses with consistent payloads and contract tests; expose correlation IDs in headers. Dependencies: WEB-POLICY-20-002. | | | +| WEB-POLICY-20-004 | TODO | | SPRINT_0215_0000_0004_web_iv | Platform Reliability Guild (src/Web/StellaOps.Web) | src/Web/StellaOps.Web | Introduce adaptive rate limiting + quotas for simulation endpoints, expose metrics, and document retry headers. Dependencies: WEB-POLICY-20-003. | | | +| WEB-POLICY-23-001 | BLOCKED | 2025-10-29 | SPRINT_0215_0000_0004_web_iv | BE-Base Platform Guild, Policy Guild (src/Web/StellaOps.Web) | src/Web/StellaOps.Web | Implement API endpoints for creating/listing/fetching policy packs and revisions (`/policy/packs`, `/policy/packs/{id}/revisions`) with pagination, RBAC, and AOC metadata exposure. (Tracked via Sprint 18.5 gateway tasks.). Dependencies: WEB-POLICY-20-004. | | | +| WEB-POLICY-23-002 | BLOCKED | 2025-10-29 | SPRINT_0215_0000_0004_web_iv | BE-Base Platform Guild (src/Web/StellaOps.Web) | src/Web/StellaOps.Web | Add activation endpoint with scope windows, conflict checks, and optional 2-person approval integration; emit events on success. (Tracked via Sprint 18.5 gateway tasks.). Dependencies: WEB-POLICY-23-001. | | | +| WEB-POLICY-23-003 | TODO | | SPRINT_0215_0000_0004_web_iv | BE-Base Platform Guild (src/Web/StellaOps.Web) | src/Web/StellaOps.Web | Provide `/policy/simulate` and `/policy/evaluate` endpoints with streaming responses, rate limiting, and error mapping. Dependencies: WEB-POLICY-23-002. | | | +| WEB-POLICY-23-004 | TODO | | SPRINT_0215_0000_0004_web_iv | BE-Base Platform Guild (src/Web/StellaOps.Web) | src/Web/StellaOps.Web | Expose explain history endpoints (`/policy/runs`, `/policy/runs/{id}`) including decision tree, sources consulted, and AOC chain. Dependencies: WEB-POLICY-23-003. | | | +| WEB-POLICY-27-001 | TODO | | SPRINT_0215_0000_0004_web_iv | BE-Base Platform Guild | src/Web/StellaOps.Web | Surface Policy Registry APIs (`/policy/workspaces`, `/policy/versions`, `/policy/reviews`, `/policy/registry`) through gateway with tenant scoping, RBAC, and request validation; ensure streaming downloads for evidence bundles. Dependencies: WEB-POLICY-23-004. | Needs registry schema | | +| WEB-POLICY-27-002 | TODO | | SPRINT_0215_0000_0004_web_iv | BE-Base Platform Guild | src/Web/StellaOps.Web | Implement review lifecycle endpoints (open, comment, approve/reject) with audit headers, comment pagination, and webhook fan-out. Dependencies: WEB-POLICY-27-001. | Depends on 27-001 | | +| WEB-POLICY-27-003 | TODO | | SPRINT_0215_0000_0004_web_iv | Platform Reliability Guild | src/Web/StellaOps.Web | Expose quick/batch simulation endpoints with SSE progress (`/policy/simulations/{runId}/stream`), cursor-based result pagination, and manifest download routes. Dependencies: WEB-POLICY-27-002. | Needs 27-002 | | +| WEB-POLICY-27-004 | TODO | | SPRINT_0215_0000_0004_web_iv | BE/Security Guild | src/Web/StellaOps.Web | Add publish/sign/promote/rollback endpoints with idempotent request IDs, canary parameters, and environment bindings; enforce scope checks and emit structured events. Dependencies: WEB-POLICY-27-003. | Depends on 27-003 | | +| WEB-POLICY-27-005 | TODO | | SPRINT_0215_0000_0004_web_iv | BE/Observability Guild | src/Web/StellaOps.Web | Instrument metrics/logs for compile latency, simulation queue depth, approval latency, promotion actions; expose aggregated dashboards and correlation IDs for Console. Dependencies: WEB-POLICY-27-004. | Needs 27-004 metrics | | | WEB-RISK-66-001 | BLOCKED (2025-12-03) | | SPRINT_216_web_v | BE-Base Platform Guild, Policy Guild (src/Web/StellaOps.Web) | src/Web/StellaOps.Web | Expose risk profile/results endpoints through gateway with tenant scoping, pagination, and rate limiting. Blocked: npm ci hangs; cannot run Angular tests; awaiting stable install env/gateway endpoints. | | | | WEB-RISK-66-002 | TODO | | SPRINT_216_web_v | BE-Base Platform Guild, Risk Engine Guild (src/Web/StellaOps.Web) | src/Web/StellaOps.Web | Add signed URL handling for explanation blobs and enforce scope checks. Dependencies: WEB-RISK-66-001. | | | | WEB-RISK-67-001 | TODO | | SPRINT_216_web_v | BE-Base Platform Guild (src/Web/StellaOps.Web) | src/Web/StellaOps.Web | Provide aggregated risk stats (`/risk/status`) for Console dashboards (counts per severity, last computation). Dependencies: WEB-RISK-66-002. | | | @@ -2212,7 +2212,7 @@ | ZASTAVA-SECRETS-01 | TODO | | SPRINT_0140_0001_0001_runtime_signals | | | Surface.Secrets wiring for Observer pending published cache endpoints. | | | | ZASTAVA-SECRETS-02 | TODO | | SPRINT_0140_0001_0001_runtime_signals | | | Webhook secret retrieval cascades from SECRETS-01 work. | | | | ZASTAVA-SURFACE-01 | TODO | | SPRINT_0140_0001_0001_runtime_signals | | | Surface.FS client integration blocked on Scanner layer metadata; tests ready once packages mirror offline dependencies. | | | -| ZASTAVA-SURFACE-02 | TODO | | SPRINT_136_scanner_surface | Zastava Observer Guild (src/Zastava/StellaOps.Zastava.Observer) | src/Zastava/StellaOps.Zastava.Observer | Use Surface manifest reader helpers to resolve `cas://` pointers and enrich drift diagnostics with manifest provenance. | SURFACE-FS-02; ZASTAVA-SURFACE-01 | | +| ZASTAVA-SURFACE-02 | TODO | | SPRINT_0136_0000_0001_scanner_surface | Zastava Observer Guild (src/Zastava/StellaOps.Zastava.Observer) | src/Zastava/StellaOps.Zastava.Observer | Use Surface manifest reader helpers to resolve `cas://` pointers and enrich drift diagnostics with manifest provenance. | SURFACE-FS-02; ZASTAVA-SURFACE-01 | | | guard unit tests` | TODO | | SPRINT_116_concelier_v | QA Guild (src/Concelier/StellaOps.Concelier.WebService) | src/Concelier/StellaOps.Concelier.WebService | Add unit tests for schema validators, forbidden-field guards (`ERR_AOC_001/2/6/7`), and supersedes chains to keep ingestion append-only. Depends on CONCELIER-WEB-AOC-19-002. | | | | store wiring` | TODO | | SPRINT_113_concelier_ii | Concelier Storage Guild (src/Concelier/__Libraries/StellaOps.Concelier.Storage.Mongo) | src/Concelier/__Libraries/StellaOps.Concelier.Storage.Mongo | Move large raw payloads to object storage with deterministic pointers, update bootstrapper/offline kit seeds, and guarantee provenance metadata remains intact. Depends on CONCELIER-LNM-21-102. | | NOTY0105 | | Task ID | Status | Status Date | Sprint | Owners | Directory | Task Description | Dependencies | New Sprint Name | @@ -2228,17 +2228,17 @@ | AIAI-31-007 | DONE | 2025-11-06 | SPRINT_0111_0001_0001_advisoryai | Advisory AI Guild | src/AdvisoryAI/StellaOps.AdvisoryAI | — | — | ADAI0101 | | LEDGER-29-006 | TODO | | SPRINT_0120_0000_0001_policy_reasoning | Findings Ledger Guild | | — | — | PLLG0101 | | CARTO-GRAPH-21-002 | DONE | 2025-11-17 | SPRINT_113_concelier_ii | Cartographer Guild | src/Cartographer/Contracts | ATLN0101 approvals | Task #1 schema freeze | CAGR0101 | -| SURFACE-FS-01 | TODO | | SPRINT_136_scanner_surface | Scanner Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.FS) | src/Scanner/__Libraries/StellaOps.Scanner.Surface.FS | — | — | SCSS0101 | -| SURFACE-FS-02 | TODO | | SPRINT_136_scanner_surface | Scanner Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.FS) | src/Scanner/__Libraries/StellaOps.Scanner.Surface.FS | — | — | SCSS0101 | +| SURFACE-FS-01 | TODO | | SPRINT_0136_0000_0001_scanner_surface | Scanner Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.FS) | src/Scanner/__Libraries/StellaOps.Scanner.Surface.FS | — | — | SCSS0101 | +| SURFACE-FS-02 | TODO | | SPRINT_0136_0000_0001_scanner_surface | Scanner Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.FS) | src/Scanner/__Libraries/StellaOps.Scanner.Surface.FS | — | — | SCSS0101 | | SCANNER-ANALYZERS-LANG-10-309 | TODO | | SPRINT_131_scanner_surface | Language Analyzer Guild | | — | — | SCSA0101 | | SCANNER-ANALYZERS-PHP-27-001 | TODO | | SPRINT_131_scanner_surface | PHP Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php) | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php | — | — | SCSA0101 | -| SCANNER-ENTRYTRACE-18-508 | TODO | | SPRINT_136_scanner_surface | EntryTrace Guild | | — | — | SCSS0101 | +| SCANNER-ENTRYTRACE-18-508 | TODO | | SPRINT_0136_0000_0001_scanner_surface | EntryTrace Guild | | — | — | SCSS0101 | | SCANNER-SECRETS-02 | DONE (2025-11-23) | 2025-11-23 | SPRINT_0136_0001_0001_scanner_surface | Secrets Analyzer Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.Secrets) | src/Scanner/__Libraries/StellaOps.Scanner.Surface.Secrets | Provider chain implemented (primary + fallback) with DI wiring; tests added (`StellaOps.Scanner.Surface.Secrets.Tests`). | SURFACE-SECRETS-01 | SCSS0101 | -| SCANNER-SURFACE-01 | BLOCKED (2025-11-25) | | SPRINT_136_scanner_surface | Scanner Guild | | — | — | SCSS0101 | +| SCANNER-SURFACE-01 | BLOCKED (2025-11-25) | | SPRINT_0136_0000_0001_scanner_surface | Scanner Guild | | — | — | SCSS0101 | | SCANNER-ANALYZERS-PHP-27-001 | TODO | | SPRINT_131_scanner_surface | PHP Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php) | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php | — | — | SCSA0101 | -| SCANNER-ENTRYTRACE-18-508 | TODO | | SPRINT_136_scanner_surface | EntryTrace Guild | | — | — | SCSS0101 | +| SCANNER-ENTRYTRACE-18-508 | TODO | | SPRINT_0136_0000_0001_scanner_surface | EntryTrace Guild | | — | — | SCSS0101 | | SCANNER-SECRETS-02 | DONE (2025-11-23) | 2025-11-23 | SPRINT_0136_0001_0001_scanner_surface | Secrets Analyzer Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.Secrets) | src/Scanner/__Libraries/StellaOps.Scanner.Surface.Secrets | Provider chain implemented (primary + fallback) with DI wiring; tests added (`StellaOps.Scanner.Surface.Secrets.Tests`). | SURFACE-SECRETS-01 | SCSS0101 | -| SCANNER-SURFACE-01 | BLOCKED (2025-11-25) | | SPRINT_136_scanner_surface | Scanner Guild | | — | — | SCSS0101 | +| SCANNER-SURFACE-01 | BLOCKED (2025-11-25) | | SPRINT_0136_0000_0001_scanner_surface | Scanner Guild | | — | — | SCSS0101 | | CARTO-GRAPH-21-002 | DONE | 2025-11-17 | SPRINT_113_concelier_ii | Cartographer Guild | src/Cartographer/Contracts | ATLN0101 approvals | Task #1 schema freeze | CAGR0101 | | POLICY-ENGINE-27-004 | TODO | | SPRINT_124_policy_reasoning | Policy Guild | | — | — | PLPE0102 | | --JOB-ORCHESTRATOR-DOCS-0001 | TODO | | SPRINT_0323_0001_0001_docs_modules_orchestrator | Docs Guild (docs/modules/orchestrator) | docs/modules/orchestrator | ORGR0102 outline | | DOOR0101 | @@ -2274,13 +2274,13 @@ | 45-001 | BLOCKED | 2025-11-25 | SPRINT_0502_0001_0001_ops_deployment_ii | Deployment Guild (ops/deployment) | ops/deployment | 44-003 | 44-003 | DVDO0103 | | 45-002 | BLOCKED | 2025-11-25 | SPRINT_0502_0001_0001_ops_deployment_ii | Deployment Guild · Security Guild (ops/deployment) | ops/deployment | 45-001 | 45-001 | DVDO0103 | | 45-003 | BLOCKED | 2025-11-25 | SPRINT_0502_0001_0001_ops_deployment_ii | Deployment Guild · Observability Guild (ops/deployment) | ops/deployment | 45-002 | 45-002 | DVDO0103 | -| 50-002 | DOING | | SPRINT_170_notifications_telemetry | Telemetry Core Guild | src/Telemetry/StellaOps.Telemetry.Core | SGSI0101 feed availability | SGSI0101 feed availability | TLTY0101 | -| 51-002 | BLOCKED | 2025-11-25 | SPRINT_170_notifications_telemetry | Telemetry Core Guild · Observability Guild · Security Guild | src/Telemetry/StellaOps.Telemetry.Core | OBS-50 baselines | Waiting on OBS-50 baselines and ORCH-OBS-50-001 schemas | TLTY0101 | +| 50-002 | DOING | | SPRINT_0170_0000_0001_notifications_telemetry | Telemetry Core Guild | src/Telemetry/StellaOps.Telemetry.Core | SGSI0101 feed availability | SGSI0101 feed availability | TLTY0101 | +| 51-002 | BLOCKED | 2025-11-25 | SPRINT_0170_0000_0001_notifications_telemetry | Telemetry Core Guild · Observability Guild · Security Guild | src/Telemetry/StellaOps.Telemetry.Core | OBS-50 baselines | Waiting on OBS-50 baselines and ORCH-OBS-50-001 schemas | TLTY0101 | | 54-001 | BLOCKED | 2025-11-25 | SPRINT_0503_0001_0001_ops_devops_i | Exporter Guild · AirGap Time Guild · CLI Guild | | Await PGMI0101 staffing confirmation | Staffing not assigned (PROGRAM-STAFF-1001) | AGCO0101 | -| 56-001 | BLOCKED | 2025-11-25 | SPRINT_170_notifications_telemetry | Telemetry Core Guild · Observability Guild | src/Telemetry/StellaOps.Telemetry.Core | SGSI0101 provenance | Blocked: SGSI0101 provenance feed/contract pending | TLTY0101 | +| 56-001 | BLOCKED | 2025-11-25 | SPRINT_0170_0000_0001_notifications_telemetry | Telemetry Core Guild · Observability Guild | src/Telemetry/StellaOps.Telemetry.Core | SGSI0101 provenance | Blocked: SGSI0101 provenance feed/contract pending | TLTY0101 | | 58 series | TODO | | SPRINT_0120_0000_0001_policy_reasoning | Findings Ledger Guild · AirGap Guilds · Evidence Locker Guild | src/Findings/StellaOps.Findings.Ledger | | | PLLG0102 | -| 61-001 | TODO | | SPRINT_511_api | API Governance Guild | src/Api/StellaOps.Api.Governance | — | — | APIG0101 | -| 61-002 | TODO | | SPRINT_511_api | API Governance Guild | src/Api/StellaOps.Api.Governance | 61-001 | 61-001 | APIG0101 | +| 61-001 | TODO | | SPRINT_0511_0000_0001_api | API Governance Guild | src/Api/StellaOps.Api.Governance | — | — | APIG0101 | +| 61-002 | TODO | | SPRINT_0511_0000_0001_api | API Governance Guild | src/Api/StellaOps.Api.Governance | 61-001 | 61-001 | APIG0101 | | 62-001 | BLOCKED | 2025-11-25 | SPRINT_206_devportal | DevPortal Guild | src/DevPortal/StellaOps.DevPortal.Site | APIG0101 outputs | Waiting on APIG0101 outputs / API baseline | DEVL0101 | | 62-002 | BLOCKED | 2025-11-25 | SPRINT_206_devportal | DevPortal Guild | src/DevPortal/StellaOps.DevPortal.Site | 62-001 | Blocked: 62-001 not delivered | DEVL0101 | | 63-001 | BLOCKED | 2025-11-25 | SPRINT_206_devportal | DevPortal Guild · Platform Guild | src/DevPortal/StellaOps.DevPortal.Site | 62-002 | Blocked: 62-002 outstanding | DEVL0101 | @@ -2306,7 +2306,7 @@ | AIRGAP-56 | DONE (2025-11-24) | 2025-11-24 | SPRINT_110_ingestion_evidence | Excititor Guild · AirGap Guilds | docs/modules/airgap/airgap-mode.md | Air-gap ingest parity delivered against frozen LNM schema. | CONCELIER-GRAPH-21-001; CONCELIER-GRAPH-21-002; ATTEST-PLAN-2001 | AGCO0101 | | AIRGAP-56-001 | DONE (2025-11-24) | 2025-11-24 | SPRINT_110_ingestion_evidence | Exporter Guild · AirGap Time Guild · CLI Guild | docs/modules/airgap/airgap-mode.md | Mirror import helpers and bundle catalog wired for sealed mode. | PROGRAM-STAFF-1001 | AGCO0101 | | AIRGAP-56-001..58-001 | DONE (2025-11-24) | 2025-11-24 | SPRINT_110_ingestion_evidence | Concelier Core · AirGap Guilds | docs/modules/airgap/airgap-mode.md | Deterministic bundle + manifest/entry-trace and sealed-mode deploy runbook shipped. | CONCELIER-GRAPH-21-001; CONCELIER-GRAPH-21-002; ELOCKER-CONTRACT-2001 | AGCO0101 | -| AIRGAP-56-002 | DONE | | SPRINT_170_notifications_telemetry | Notifications Service Guild · DevOps Guild | src/Notify/StellaOps.Notify | | | NOTY0101 | +| AIRGAP-56-002 | DONE | | SPRINT_0170_0000_0001_notifications_telemetry | Notifications Service Guild · DevOps Guild | src/Notify/StellaOps.Notify | | | NOTY0101 | | AIRGAP-56-003 | TODO | | SPRINT_0301_0001_0001_docs_md_i | Docs Guild · Exporter Guild | docs/modules/airgap | DOCS-AIRGAP-56-002 | DOCS-AIRGAP-56-002 | AIDG0101 | | AIRGAP-56-004 | TODO | | SPRINT_0301_0001_0001_docs_md_i | Docs Guild · Deployment Guild | docs/modules/airgap | AIRGAP-56-003 | DOCS-AIRGAP-56-003 | AIDG0101 | | AIRGAP-57 | DONE (2025-11-24) | 2025-11-24 | SPRINT_110_ingestion_evidence | Excititor Guild · AirGap Guilds | docs/modules/airgap/airgap-mode.md | Air-gap bundle timeline/hooks completed. | CONCELIER-GRAPH-21-001; CONCELIER-GRAPH-21-002; ATTEST-PLAN-2001 | AGCO0101 | @@ -2354,72 +2354,72 @@ | ANALYZERS-JAVA-21-010 | TODO | | SPRINT_131_scanner_surface | Java Analyzer Guild, Signals Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Java) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Java | SCANNER-ANALYZERS-JAVA-21-009 | SCANNER-ANALYZERS-JAVA-21-009 | SCSA0101 | | ANALYZERS-JAVA-21-011 | TODO | | SPRINT_131_scanner_surface | Java Analyzer Guild · DevOps Guild | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Java | Requires SCANNER-ANALYZERS-JAVA-21-010 + DevOps packaging | SCANNER-ANALYZERS-JAVA-21-010 | SCSA0301 | | ANALYZERS-LANG-11-001 | TODO | | SPRINT_131_scanner_surface | StellaOps.Scanner EPDR Guild · Language Analyzer Guild | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.DotNet | Requires SCANNER-ANALYZERS-LANG-10-309 artifact | SCANNER-ANALYZERS-LANG-10-309 | SCSA0103 | -| ANALYZERS-LANG-11-002 | TODO | | SPRINT_132_scanner_surface | StellaOps.Scanner EPDR Guild | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.DotNet | Depends on #1 for shared metadata | SCANNER-ANALYZERS-LANG-11-001 | SCSA0103 | -| ANALYZERS-LANG-11-003 | TODO | | SPRINT_132_scanner_surface | StellaOps.Scanner EPDR Guild · Signals Guild | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.DotNet | Needs #2 plus Signals schema for entry-trace | SCANNER-ANALYZERS-LANG-11-002 | SCSA0103 | -| ANALYZERS-LANG-11-004 | TODO | | SPRINT_132_scanner_surface | StellaOps.Scanner EPDR Guild · SBOM Service Guild | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.DotNet | Requires #3 and SBOM service hooks | SCANNER-ANALYZERS-LANG-11-003 | SCSA0103 | -| ANALYZERS-LANG-11-005 | TODO | | SPRINT_132_scanner_surface | StellaOps.Scanner EPDR Guild · QA Guild | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.DotNet | Depends on #4 for QA fixtures | SCANNER-ANALYZERS-LANG-11-004 | SCSA0103 | -| ANALYZERS-NATIVE-20-001 | TODO | | SPRINT_132_scanner_surface | Native Analyzer Guild | src/Scanner/StellaOps.Scanner.Analyzers.Native | Bootstrap native analyzer helpers | Bootstrap native analyzer helpers | SCSA0401 | -| ANALYZERS-NATIVE-20-002 | TODO | | SPRINT_132_scanner_surface | Native Analyzer Guild | src/Scanner/StellaOps.Scanner.Analyzers.Native | Depends on #1 | SCANNER-ANALYZERS-NATIVE-20-001 | SCSA0401 | -| ANALYZERS-NATIVE-20-003 | TODO | | SPRINT_132_scanner_surface | Native Analyzer Guild | src/Scanner/StellaOps.Scanner.Analyzers.Native | Depends on #2 | SCANNER-ANALYZERS-NATIVE-20-002 | SCSA0401 | -| ANALYZERS-NATIVE-20-004 | TODO | | SPRINT_132_scanner_surface | Native Analyzer Guild | src/Scanner/StellaOps.Scanner.Analyzers.Native | Depends on #3 | SCANNER-ANALYZERS-NATIVE-20-003 | SCSA0401 | -| ANALYZERS-NATIVE-20-005 | TODO | | SPRINT_132_scanner_surface | Native Analyzer Guild | src/Scanner/StellaOps.Scanner.Analyzers.Native | Depends on #4 | SCANNER-ANALYZERS-NATIVE-20-004 | SCSA0401 | -| ANALYZERS-NATIVE-20-006 | TODO | | SPRINT_132_scanner_surface | Native Analyzer Guild | src/Scanner/StellaOps.Scanner.Analyzers.Native | Depends on #5 | SCANNER-ANALYZERS-NATIVE-20-005 | SCSA0401 | -| ANALYZERS-NATIVE-20-007 | TODO | | SPRINT_132_scanner_surface | Native Analyzer Guild | src/Scanner/StellaOps.Scanner.Analyzers.Native | Depends on #6 | SCANNER-ANALYZERS-NATIVE-20-006 | SCSA0401 | -| ANALYZERS-NATIVE-20-008 | TODO | | SPRINT_132_scanner_surface | Native Analyzer Guild | src/Scanner/StellaOps.Scanner.Analyzers.Native | Depends on #7 | SCANNER-ANALYZERS-NATIVE-20-007 | SCSA0401 | -| ANALYZERS-NATIVE-20-009 | TODO | | SPRINT_132_scanner_surface | Native Analyzer Guild | src/Scanner/StellaOps.Scanner.Analyzers.Native | Depends on #8 | SCANNER-ANALYZERS-NATIVE-20-008 | SCSA0401 | -| ANALYZERS-NATIVE-20-010 | TODO | | SPRINT_132_scanner_surface | Native Analyzer Guild | src/Scanner/StellaOps.Scanner.Analyzers.Native | Depends on #9 | SCANNER-ANALYZERS-NATIVE-20-009 | SCSA0401 | -| ANALYZERS-NODE-22-001 | TODO | | SPRINT_132_scanner_surface | Node Analyzer Guild | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node | Bootstrap Node analyzer helper | Bootstrap Node analyzer helper | SCSA0501 | -| ANALYZERS-NODE-22-002 | TODO | | SPRINT_132_scanner_surface | Node Analyzer Guild | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node | Depends on #1 | SCANNER-ANALYZERS-NODE-22-001 | SCSA0501 | -| ANALYZERS-NODE-22-003 | TODO | | SPRINT_132_scanner_surface | Node Analyzer Guild | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node | Depends on #2 | SCANNER-ANALYZERS-NODE-22-002 | SCSA0501 | -| ANALYZERS-NODE-22-004 | TODO | | SPRINT_132_scanner_surface | Node Analyzer Guild | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node | Depends on #3 | SCANNER-ANALYZERS-NODE-22-003 | SCSA0501 | -| ANALYZERS-NODE-22-005 | TODO | | SPRINT_132_scanner_surface | Node Analyzer Guild | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node | Depends on #4 | SCANNER-ANALYZERS-NODE-22-004 | SCSA0501 | -| ANALYZERS-NODE-22-006 | TODO | | SPRINT_133_scanner_surface | Node Analyzer Guild | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node | Depends on #5 | SCANNER-ANALYZERS-NODE-22-005 | SCSA0501 | -| ANALYZERS-NODE-22-007 | TODO | | SPRINT_133_scanner_surface | Node Analyzer Guild | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node | Depends on #6 | SCANNER-ANALYZERS-NODE-22-006 | SCSA0501 | -| ANALYZERS-NODE-22-008 | TODO | | SPRINT_133_scanner_surface | Node Analyzer Guild | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node | Depends on #7 | SCANNER-ANALYZERS-NODE-22-007 | SCSA0501 | -| ANALYZERS-NODE-22-009 | TODO | | SPRINT_133_scanner_surface | Node Analyzer Guild · QA Guild | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node | Depends on #8 | SCANNER-ANALYZERS-NODE-22-008 | SCSA0501 | -| ANALYZERS-NODE-22-010 | TODO | | SPRINT_133_scanner_surface | Node Analyzer Guild · Signals Guild | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node | Depends on #9 | SCANNER-ANALYZERS-NODE-22-009 | SCSA0501 | -| ANALYZERS-NODE-22-011 | TODO | | SPRINT_133_scanner_surface | Node Analyzer Guild · DevOps Guild | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node | Depends on ANALYZERS-NODE-22-010 + DevOps packaging | SCANNER-ANALYZERS-NODE-22-010 | SCSA0502 | -| ANALYZERS-NODE-22-012 | TODO | | SPRINT_133_scanner_surface | Node Analyzer Guild | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node | Needs #1 regression fixtures | SCANNER-ANALYZERS-NODE-22-011 | SCSA0502 | -| ANALYZERS-PHP-27-001 | TODO | | SPRINT_133_scanner_surface | PHP Analyzer Guild | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php | Analyzer helper bootstrap | Analyzer helper bootstrap | SCSA0601 | -| ANALYZERS-PHP-27-002 | TODO | | SPRINT_133_scanner_surface | PHP Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php) | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php | SCANNER-ANALYZERS-PHP-27-001 | SCANNER-ANALYZERS-PHP-27-001 | SCSA0101 | -| ANALYZERS-PHP-27-003 | TODO | | SPRINT_133_scanner_surface | PHP Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php) | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php | SCANNER-ANALYZERS-PHP-27-002 | SCANNER-ANALYZERS-PHP-27-002 | SCSA0101 | -| ANALYZERS-PHP-27-004 | TODO | | SPRINT_133_scanner_surface | PHP Analyzer Guild | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php | Depends on SCANNER-ANALYZERS-PHP-27-003 | SCANNER-ANALYZERS-PHP-27-003 | SCSA0601 | -| ANALYZERS-PHP-27-005 | TODO | | SPRINT_133_scanner_surface | PHP Analyzer Guild | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php | Depends on #2 | SCANNER-ANALYZERS-PHP-27-004 | SCSA0601 | -| ANALYZERS-PHP-27-006 | TODO | | SPRINT_133_scanner_surface | PHP Analyzer Guild | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php | Depends on #3 | SCANNER-ANALYZERS-PHP-27-005 | SCSA0601 | -| ANALYZERS-PHP-27-007 | TODO | | SPRINT_133_scanner_surface | PHP Analyzer Guild | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php | Depends on #4 | SCANNER-ANALYZERS-PHP-27-006 | SCSA0601 | -| ANALYZERS-PHP-27-008 | TODO | | SPRINT_134_scanner_surface | PHP Analyzer Guild | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php | Depends on #1 + CLI feedback | SCANNER-ANALYZERS-PHP-27-002 | SCSA0601 | -| ANALYZERS-PHP-27-009 | TODO | | SPRINT_134_scanner_surface | PHP Analyzer Guild · QA Guild | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php | Depends on #5 | SCANNER-ANALYZERS-PHP-27-007 | SCSA0601 | -| ANALYZERS-PHP-27-010 | TODO | | SPRINT_134_scanner_surface | PHP Analyzer Guild · Signals Guild | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php | Depends on #7 | SCANNER-ANALYZERS-PHP-27-009 | SCSA0601 | -| ANALYZERS-PHP-27-011 | TODO | | SPRINT_134_scanner_surface | PHP Analyzer Guild, DevOps Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php) | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php | | SCANNER-ANALYZERS-PHP-27-010 | SCSA0602 | -| ANALYZERS-PHP-27-012 | TODO | | SPRINT_134_scanner_surface | PHP Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php) | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php | | SCANNER-ANALYZERS-PHP-27-011 | SCSA0602 | -| ANALYZERS-PYTHON-23-001 | TODO | | SPRINT_134_scanner_surface | Python Analyzer Guild | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python | Analyzer helper bootstrap | Analyzer helper bootstrap | SCSA0701 | -| ANALYZERS-PYTHON-23-002 | TODO | | SPRINT_134_scanner_surface | Python Analyzer Guild | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python | Depends on #1 | SCANNER-ANALYZERS-PYTHON-23-001 | SCSA0701 | -| ANALYZERS-PYTHON-23-003 | TODO | | SPRINT_134_scanner_surface | Python Analyzer Guild | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python | Depends on #2 | SCANNER-ANALYZERS-PYTHON-23-002 | SCSA0701 | -| ANALYZERS-PYTHON-23-004 | TODO | | SPRINT_134_scanner_surface | Python Analyzer Guild | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python | Depends on #3 | SCANNER-ANALYZERS-PYTHON-23-003 | SCSA0701 | -| ANALYZERS-PYTHON-23-005 | TODO | | SPRINT_134_scanner_surface | Python Analyzer Guild | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python | Depends on #4 | SCANNER-ANALYZERS-PYTHON-23-004 | SCSA0701 | -| ANALYZERS-PYTHON-23-006 | TODO | | SPRINT_134_scanner_surface | Python Analyzer Guild | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python | Depends on #5 | SCANNER-ANALYZERS-PYTHON-23-005 | SCSA0701 | -| ANALYZERS-PYTHON-23-007 | TODO | | SPRINT_134_scanner_surface | Python Analyzer Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python | SCANNER-ANALYZERS-PYTHON-23-006 | SCANNER-ANALYZERS-PYTHON-23-006 | SCSA0101 | -| ANALYZERS-PYTHON-23-008 | TODO | | SPRINT_134_scanner_surface | Python Analyzer Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python | SCANNER-ANALYZERS-PYTHON-23-007 | SCANNER-ANALYZERS-PYTHON-23-007 | SCSA0101 | -| ANALYZERS-PYTHON-23-009 | TODO | | SPRINT_134_scanner_surface | Python Analyzer Guild, QA Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python | SCANNER-ANALYZERS-PYTHON-23-008 | SCANNER-ANALYZERS-PYTHON-23-008 | SCSA0101 | -| ANALYZERS-PYTHON-23-010 | TODO | | SPRINT_134_scanner_surface | Python Analyzer Guild, Signals Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python | SCANNER-ANALYZERS-PYTHON-23-009 | SCANNER-ANALYZERS-PYTHON-23-009 | SCSA0102 | -| ANALYZERS-PYTHON-23-011 | TODO | | SPRINT_134_scanner_surface | Python Analyzer Guild, DevOps Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python | SCANNER-ANALYZERS-PYTHON-23-010 | SCANNER-ANALYZERS-PYTHON-23-010 | SCSA0102 | -| ANALYZERS-PYTHON-23-012 | TODO | | SPRINT_135_scanner_surface | Python Analyzer Guild | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python | Needs ANALYZERS-PYTHON-23-011 evidence | SCANNER-ANALYZERS-PYTHON-23-011 | SCSA0702 | -| ANALYZERS-RUBY-28-001 | TODO | | SPRINT_135_scanner_surface | Ruby Analyzer Guild | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby | Bootstrap helper | Bootstrap helper | SCSA0801 | -| ANALYZERS-RUBY-28-002 | TODO | | SPRINT_135_scanner_surface | Ruby Analyzer Guild | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby | Depends on #1 | SCANNER-ANALYZERS-RUBY-28-001 | SCSA0801 | -| ANALYZERS-RUBY-28-003 | TODO | | SPRINT_135_scanner_surface | Ruby Analyzer Guild | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby | Depends on #2 | SCANNER-ANALYZERS-RUBY-28-002 | SCSA0801 | -| ANALYZERS-RUBY-28-004 | TODO | | SPRINT_135_scanner_surface | Ruby Analyzer Guild | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby | Depends on #3 | SCANNER-ANALYZERS-RUBY-28-003 | SCSA0801 | -| ANALYZERS-RUBY-28-005 | TODO | | SPRINT_135_scanner_surface | Ruby Analyzer Guild | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby | Depends on #4 | SCANNER-ANALYZERS-RUBY-28-004 | SCSA0801 | -| ANALYZERS-RUBY-28-006 | TODO | | SPRINT_135_scanner_surface | Ruby Analyzer Guild | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby | Depends on #5 | SCANNER-ANALYZERS-RUBY-28-005 | SCSA0801 | -| ANALYZERS-RUBY-28-007 | TODO | | SPRINT_135_scanner_surface | Ruby Analyzer Guild | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby | Depends on #6 | SCANNER-ANALYZERS-RUBY-28-006 | SCSA0801 | -| ANALYZERS-RUBY-28-008 | TODO | | SPRINT_135_scanner_surface | Ruby Analyzer Guild | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby | Depends on #7 | SCANNER-ANALYZERS-RUBY-28-007 | SCSA0801 | -| ANALYZERS-RUBY-28-009 | TODO | | SPRINT_135_scanner_surface | Ruby Analyzer Guild · QA Guild | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby | Depends on #8 | SCANNER-ANALYZERS-RUBY-28-008 | SCSA0801 | -| ANALYZERS-RUBY-28-010 | TODO | | SPRINT_135_scanner_surface | Ruby Analyzer Guild · Signals Guild | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby | Depends on #9 | SCANNER-ANALYZERS-RUBY-28-009 | SCSA0801 | -| ANALYZERS-RUBY-28-011 | TODO | | SPRINT_135_scanner_surface | Ruby Analyzer Guild · DevOps Guild | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby | Depends on ANALYZERS-RUBY-28-010 | SCANNER-ANALYZERS-RUBY-28-010 | SCSA0802 | -| ANALYZERS-RUBY-28-012 | TODO | | SPRINT_135_scanner_surface | Ruby Analyzer Guild | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby | Needs #1 fixtures | SCANNER-ANALYZERS-RUBY-28-011 | SCSA0802 | -| AOC-19-001 | TODO | | SPRINT_123_policy_reasoning | Policy Guild | src/Policy/__Libraries/StellaOps.Policy | Review Link-Not-Merge schema | Review Link-Not-Merge schema | PLAO0101 | -| AOC-19-002 | TODO | | SPRINT_123_policy_reasoning | Policy Guild | src/Policy/__Libraries/StellaOps.Policy | Depends on #1 | POLICY-AOC-19-001 | PLAO0101 | -| AOC-19-003 | TODO | | SPRINT_123_policy_reasoning | Policy Guild | src/Policy/__Libraries/StellaOps.Policy | Depends on #2 | POLICY-AOC-19-002 | PLAO0101 | -| AOC-19-004 | TODO | | SPRINT_123_policy_reasoning | Policy Guild | src/Policy/__Libraries/StellaOps.Policy | Depends on #3 | POLICY-AOC-19-003 | PLAO0101 | +| ANALYZERS-LANG-11-002 | TODO | | SPRINT_0132_0000_0001_scanner_surface | StellaOps.Scanner EPDR Guild | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.DotNet | Depends on #1 for shared metadata | SCANNER-ANALYZERS-LANG-11-001 | SCSA0103 | +| ANALYZERS-LANG-11-003 | TODO | | SPRINT_0132_0000_0001_scanner_surface | StellaOps.Scanner EPDR Guild · Signals Guild | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.DotNet | Needs #2 plus Signals schema for entry-trace | SCANNER-ANALYZERS-LANG-11-002 | SCSA0103 | +| ANALYZERS-LANG-11-004 | TODO | | SPRINT_0132_0000_0001_scanner_surface | StellaOps.Scanner EPDR Guild · SBOM Service Guild | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.DotNet | Requires #3 and SBOM service hooks | SCANNER-ANALYZERS-LANG-11-003 | SCSA0103 | +| ANALYZERS-LANG-11-005 | TODO | | SPRINT_0132_0000_0001_scanner_surface | StellaOps.Scanner EPDR Guild · QA Guild | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.DotNet | Depends on #4 for QA fixtures | SCANNER-ANALYZERS-LANG-11-004 | SCSA0103 | +| ANALYZERS-NATIVE-20-001 | TODO | | SPRINT_0132_0000_0001_scanner_surface | Native Analyzer Guild | src/Scanner/StellaOps.Scanner.Analyzers.Native | Bootstrap native analyzer helpers | Bootstrap native analyzer helpers | SCSA0401 | +| ANALYZERS-NATIVE-20-002 | TODO | | SPRINT_0132_0000_0001_scanner_surface | Native Analyzer Guild | src/Scanner/StellaOps.Scanner.Analyzers.Native | Depends on #1 | SCANNER-ANALYZERS-NATIVE-20-001 | SCSA0401 | +| ANALYZERS-NATIVE-20-003 | TODO | | SPRINT_0132_0000_0001_scanner_surface | Native Analyzer Guild | src/Scanner/StellaOps.Scanner.Analyzers.Native | Depends on #2 | SCANNER-ANALYZERS-NATIVE-20-002 | SCSA0401 | +| ANALYZERS-NATIVE-20-004 | TODO | | SPRINT_0132_0000_0001_scanner_surface | Native Analyzer Guild | src/Scanner/StellaOps.Scanner.Analyzers.Native | Depends on #3 | SCANNER-ANALYZERS-NATIVE-20-003 | SCSA0401 | +| ANALYZERS-NATIVE-20-005 | TODO | | SPRINT_0132_0000_0001_scanner_surface | Native Analyzer Guild | src/Scanner/StellaOps.Scanner.Analyzers.Native | Depends on #4 | SCANNER-ANALYZERS-NATIVE-20-004 | SCSA0401 | +| ANALYZERS-NATIVE-20-006 | TODO | | SPRINT_0132_0000_0001_scanner_surface | Native Analyzer Guild | src/Scanner/StellaOps.Scanner.Analyzers.Native | Depends on #5 | SCANNER-ANALYZERS-NATIVE-20-005 | SCSA0401 | +| ANALYZERS-NATIVE-20-007 | TODO | | SPRINT_0132_0000_0001_scanner_surface | Native Analyzer Guild | src/Scanner/StellaOps.Scanner.Analyzers.Native | Depends on #6 | SCANNER-ANALYZERS-NATIVE-20-006 | SCSA0401 | +| ANALYZERS-NATIVE-20-008 | TODO | | SPRINT_0132_0000_0001_scanner_surface | Native Analyzer Guild | src/Scanner/StellaOps.Scanner.Analyzers.Native | Depends on #7 | SCANNER-ANALYZERS-NATIVE-20-007 | SCSA0401 | +| ANALYZERS-NATIVE-20-009 | TODO | | SPRINT_0132_0000_0001_scanner_surface | Native Analyzer Guild | src/Scanner/StellaOps.Scanner.Analyzers.Native | Depends on #8 | SCANNER-ANALYZERS-NATIVE-20-008 | SCSA0401 | +| ANALYZERS-NATIVE-20-010 | TODO | | SPRINT_0132_0000_0001_scanner_surface | Native Analyzer Guild | src/Scanner/StellaOps.Scanner.Analyzers.Native | Depends on #9 | SCANNER-ANALYZERS-NATIVE-20-009 | SCSA0401 | +| ANALYZERS-NODE-22-001 | TODO | | SPRINT_0132_0000_0001_scanner_surface | Node Analyzer Guild | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node | Bootstrap Node analyzer helper | Bootstrap Node analyzer helper | SCSA0501 | +| ANALYZERS-NODE-22-002 | TODO | | SPRINT_0132_0000_0001_scanner_surface | Node Analyzer Guild | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node | Depends on #1 | SCANNER-ANALYZERS-NODE-22-001 | SCSA0501 | +| ANALYZERS-NODE-22-003 | TODO | | SPRINT_0132_0000_0001_scanner_surface | Node Analyzer Guild | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node | Depends on #2 | SCANNER-ANALYZERS-NODE-22-002 | SCSA0501 | +| ANALYZERS-NODE-22-004 | TODO | | SPRINT_0132_0000_0001_scanner_surface | Node Analyzer Guild | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node | Depends on #3 | SCANNER-ANALYZERS-NODE-22-003 | SCSA0501 | +| ANALYZERS-NODE-22-005 | TODO | | SPRINT_0132_0000_0001_scanner_surface | Node Analyzer Guild | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node | Depends on #4 | SCANNER-ANALYZERS-NODE-22-004 | SCSA0501 | +| ANALYZERS-NODE-22-006 | TODO | | SPRINT_0133_0000_0001_scanner_surface | Node Analyzer Guild | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node | Depends on #5 | SCANNER-ANALYZERS-NODE-22-005 | SCSA0501 | +| ANALYZERS-NODE-22-007 | TODO | | SPRINT_0133_0000_0001_scanner_surface | Node Analyzer Guild | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node | Depends on #6 | SCANNER-ANALYZERS-NODE-22-006 | SCSA0501 | +| ANALYZERS-NODE-22-008 | TODO | | SPRINT_0133_0000_0001_scanner_surface | Node Analyzer Guild | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node | Depends on #7 | SCANNER-ANALYZERS-NODE-22-007 | SCSA0501 | +| ANALYZERS-NODE-22-009 | TODO | | SPRINT_0133_0000_0001_scanner_surface | Node Analyzer Guild · QA Guild | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node | Depends on #8 | SCANNER-ANALYZERS-NODE-22-008 | SCSA0501 | +| ANALYZERS-NODE-22-010 | TODO | | SPRINT_0133_0000_0001_scanner_surface | Node Analyzer Guild · Signals Guild | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node | Depends on #9 | SCANNER-ANALYZERS-NODE-22-009 | SCSA0501 | +| ANALYZERS-NODE-22-011 | TODO | | SPRINT_0133_0000_0001_scanner_surface | Node Analyzer Guild · DevOps Guild | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node | Depends on ANALYZERS-NODE-22-010 + DevOps packaging | SCANNER-ANALYZERS-NODE-22-010 | SCSA0502 | +| ANALYZERS-NODE-22-012 | TODO | | SPRINT_0133_0000_0001_scanner_surface | Node Analyzer Guild | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node | Needs #1 regression fixtures | SCANNER-ANALYZERS-NODE-22-011 | SCSA0502 | +| ANALYZERS-PHP-27-001 | TODO | | SPRINT_0133_0000_0001_scanner_surface | PHP Analyzer Guild | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php | Analyzer helper bootstrap | Analyzer helper bootstrap | SCSA0601 | +| ANALYZERS-PHP-27-002 | TODO | | SPRINT_0133_0000_0001_scanner_surface | PHP Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php) | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php | SCANNER-ANALYZERS-PHP-27-001 | SCANNER-ANALYZERS-PHP-27-001 | SCSA0101 | +| ANALYZERS-PHP-27-003 | TODO | | SPRINT_0133_0000_0001_scanner_surface | PHP Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php) | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php | SCANNER-ANALYZERS-PHP-27-002 | SCANNER-ANALYZERS-PHP-27-002 | SCSA0101 | +| ANALYZERS-PHP-27-004 | TODO | | SPRINT_0133_0000_0001_scanner_surface | PHP Analyzer Guild | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php | Depends on SCANNER-ANALYZERS-PHP-27-003 | SCANNER-ANALYZERS-PHP-27-003 | SCSA0601 | +| ANALYZERS-PHP-27-005 | TODO | | SPRINT_0133_0000_0001_scanner_surface | PHP Analyzer Guild | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php | Depends on #2 | SCANNER-ANALYZERS-PHP-27-004 | SCSA0601 | +| ANALYZERS-PHP-27-006 | TODO | | SPRINT_0133_0000_0001_scanner_surface | PHP Analyzer Guild | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php | Depends on #3 | SCANNER-ANALYZERS-PHP-27-005 | SCSA0601 | +| ANALYZERS-PHP-27-007 | TODO | | SPRINT_0133_0000_0001_scanner_surface | PHP Analyzer Guild | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php | Depends on #4 | SCANNER-ANALYZERS-PHP-27-006 | SCSA0601 | +| ANALYZERS-PHP-27-008 | TODO | | SPRINT_0134_0000_0001_scanner_surface | PHP Analyzer Guild | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php | Depends on #1 + CLI feedback | SCANNER-ANALYZERS-PHP-27-002 | SCSA0601 | +| ANALYZERS-PHP-27-009 | TODO | | SPRINT_0134_0000_0001_scanner_surface | PHP Analyzer Guild · QA Guild | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php | Depends on #5 | SCANNER-ANALYZERS-PHP-27-007 | SCSA0601 | +| ANALYZERS-PHP-27-010 | TODO | | SPRINT_0134_0000_0001_scanner_surface | PHP Analyzer Guild · Signals Guild | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php | Depends on #7 | SCANNER-ANALYZERS-PHP-27-009 | SCSA0601 | +| ANALYZERS-PHP-27-011 | TODO | | SPRINT_0134_0000_0001_scanner_surface | PHP Analyzer Guild, DevOps Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php) | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php | | SCANNER-ANALYZERS-PHP-27-010 | SCSA0602 | +| ANALYZERS-PHP-27-012 | TODO | | SPRINT_0134_0000_0001_scanner_surface | PHP Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php) | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php | | SCANNER-ANALYZERS-PHP-27-011 | SCSA0602 | +| ANALYZERS-PYTHON-23-001 | TODO | | SPRINT_0134_0000_0001_scanner_surface | Python Analyzer Guild | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python | Analyzer helper bootstrap | Analyzer helper bootstrap | SCSA0701 | +| ANALYZERS-PYTHON-23-002 | TODO | | SPRINT_0134_0000_0001_scanner_surface | Python Analyzer Guild | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python | Depends on #1 | SCANNER-ANALYZERS-PYTHON-23-001 | SCSA0701 | +| ANALYZERS-PYTHON-23-003 | TODO | | SPRINT_0134_0000_0001_scanner_surface | Python Analyzer Guild | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python | Depends on #2 | SCANNER-ANALYZERS-PYTHON-23-002 | SCSA0701 | +| ANALYZERS-PYTHON-23-004 | TODO | | SPRINT_0134_0000_0001_scanner_surface | Python Analyzer Guild | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python | Depends on #3 | SCANNER-ANALYZERS-PYTHON-23-003 | SCSA0701 | +| ANALYZERS-PYTHON-23-005 | TODO | | SPRINT_0134_0000_0001_scanner_surface | Python Analyzer Guild | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python | Depends on #4 | SCANNER-ANALYZERS-PYTHON-23-004 | SCSA0701 | +| ANALYZERS-PYTHON-23-006 | TODO | | SPRINT_0134_0000_0001_scanner_surface | Python Analyzer Guild | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python | Depends on #5 | SCANNER-ANALYZERS-PYTHON-23-005 | SCSA0701 | +| ANALYZERS-PYTHON-23-007 | TODO | | SPRINT_0134_0000_0001_scanner_surface | Python Analyzer Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python | SCANNER-ANALYZERS-PYTHON-23-006 | SCANNER-ANALYZERS-PYTHON-23-006 | SCSA0101 | +| ANALYZERS-PYTHON-23-008 | TODO | | SPRINT_0134_0000_0001_scanner_surface | Python Analyzer Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python | SCANNER-ANALYZERS-PYTHON-23-007 | SCANNER-ANALYZERS-PYTHON-23-007 | SCSA0101 | +| ANALYZERS-PYTHON-23-009 | TODO | | SPRINT_0134_0000_0001_scanner_surface | Python Analyzer Guild, QA Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python | SCANNER-ANALYZERS-PYTHON-23-008 | SCANNER-ANALYZERS-PYTHON-23-008 | SCSA0101 | +| ANALYZERS-PYTHON-23-010 | TODO | | SPRINT_0134_0000_0001_scanner_surface | Python Analyzer Guild, Signals Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python | SCANNER-ANALYZERS-PYTHON-23-009 | SCANNER-ANALYZERS-PYTHON-23-009 | SCSA0102 | +| ANALYZERS-PYTHON-23-011 | TODO | | SPRINT_0134_0000_0001_scanner_surface | Python Analyzer Guild, DevOps Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python | SCANNER-ANALYZERS-PYTHON-23-010 | SCANNER-ANALYZERS-PYTHON-23-010 | SCSA0102 | +| ANALYZERS-PYTHON-23-012 | TODO | | SPRINT_0135_0000_0001_scanner_surface | Python Analyzer Guild | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python | Needs ANALYZERS-PYTHON-23-011 evidence | SCANNER-ANALYZERS-PYTHON-23-011 | SCSA0702 | +| ANALYZERS-RUBY-28-001 | TODO | | SPRINT_0135_0000_0001_scanner_surface | Ruby Analyzer Guild | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby | Bootstrap helper | Bootstrap helper | SCSA0801 | +| ANALYZERS-RUBY-28-002 | TODO | | SPRINT_0135_0000_0001_scanner_surface | Ruby Analyzer Guild | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby | Depends on #1 | SCANNER-ANALYZERS-RUBY-28-001 | SCSA0801 | +| ANALYZERS-RUBY-28-003 | TODO | | SPRINT_0135_0000_0001_scanner_surface | Ruby Analyzer Guild | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby | Depends on #2 | SCANNER-ANALYZERS-RUBY-28-002 | SCSA0801 | +| ANALYZERS-RUBY-28-004 | TODO | | SPRINT_0135_0000_0001_scanner_surface | Ruby Analyzer Guild | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby | Depends on #3 | SCANNER-ANALYZERS-RUBY-28-003 | SCSA0801 | +| ANALYZERS-RUBY-28-005 | TODO | | SPRINT_0135_0000_0001_scanner_surface | Ruby Analyzer Guild | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby | Depends on #4 | SCANNER-ANALYZERS-RUBY-28-004 | SCSA0801 | +| ANALYZERS-RUBY-28-006 | TODO | | SPRINT_0135_0000_0001_scanner_surface | Ruby Analyzer Guild | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby | Depends on #5 | SCANNER-ANALYZERS-RUBY-28-005 | SCSA0801 | +| ANALYZERS-RUBY-28-007 | TODO | | SPRINT_0135_0000_0001_scanner_surface | Ruby Analyzer Guild | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby | Depends on #6 | SCANNER-ANALYZERS-RUBY-28-006 | SCSA0801 | +| ANALYZERS-RUBY-28-008 | TODO | | SPRINT_0135_0000_0001_scanner_surface | Ruby Analyzer Guild | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby | Depends on #7 | SCANNER-ANALYZERS-RUBY-28-007 | SCSA0801 | +| ANALYZERS-RUBY-28-009 | TODO | | SPRINT_0135_0000_0001_scanner_surface | Ruby Analyzer Guild · QA Guild | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby | Depends on #8 | SCANNER-ANALYZERS-RUBY-28-008 | SCSA0801 | +| ANALYZERS-RUBY-28-010 | TODO | | SPRINT_0135_0000_0001_scanner_surface | Ruby Analyzer Guild · Signals Guild | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby | Depends on #9 | SCANNER-ANALYZERS-RUBY-28-009 | SCSA0801 | +| ANALYZERS-RUBY-28-011 | TODO | | SPRINT_0135_0000_0001_scanner_surface | Ruby Analyzer Guild · DevOps Guild | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby | Depends on ANALYZERS-RUBY-28-010 | SCANNER-ANALYZERS-RUBY-28-010 | SCSA0802 | +| ANALYZERS-RUBY-28-012 | TODO | | SPRINT_0135_0000_0001_scanner_surface | Ruby Analyzer Guild | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby | Needs #1 fixtures | SCANNER-ANALYZERS-RUBY-28-011 | SCSA0802 | +| AOC-19-001 | TODO | | SPRINT_0123_0000_0001_policy_reasoning | Policy Guild | src/Policy/__Libraries/StellaOps.Policy | Review Link-Not-Merge schema | Review Link-Not-Merge schema | PLAO0101 | +| AOC-19-002 | TODO | | SPRINT_0123_0000_0001_policy_reasoning | Policy Guild | src/Policy/__Libraries/StellaOps.Policy | Depends on #1 | POLICY-AOC-19-001 | PLAO0101 | +| AOC-19-003 | TODO | | SPRINT_0123_0000_0001_policy_reasoning | Policy Guild | src/Policy/__Libraries/StellaOps.Policy | Depends on #2 | POLICY-AOC-19-002 | PLAO0101 | +| AOC-19-004 | TODO | | SPRINT_0123_0000_0001_policy_reasoning | Policy Guild | src/Policy/__Libraries/StellaOps.Policy | Depends on #3 | POLICY-AOC-19-003 | PLAO0101 | | AOC-19-101 | TODO | 2025-10-28 | SPRINT_0503_0001_0001_ops_devops_i | DevOps Guild | ops/devops | Needs helper definitions from PLAO0101 | Needs helper definitions from PLAO0101 | DVAO0101 | | API-27-001 | TODO | | SPRINT_0129_0001_0001_policy_reasoning | Policy Registry Guild | src/Policy/StellaOps.Policy.Registry | Governance decision (APIG0101) | Governance decision (APIG0101) | PLAR0101 | | API-27-002 | TODO | | SPRINT_0129_0001_0001_policy_reasoning | Policy Registry Guild | src/Policy/StellaOps.Policy.Registry | Depends on #1 | REGISTRY-API-27-001 | PLAR0101 | @@ -2453,23 +2453,23 @@ | API-29-009 | TODO | | SPRINT_0129_0001_0001_policy_reasoning | Vuln Explorer API Guild | src/VulnExplorer/StellaOps.VulnExplorer.Api | Depends on #8 | VULN-API-29-008 | VUAP0101 | | API-29-010 | TODO | | SPRINT_0129_0001_0001_policy_reasoning | Vuln Explorer API Guild | src/VulnExplorer/StellaOps.VulnExplorer.Api | Depends on #9 | VULN-API-29-009 | VUAP0101 | | API-29-011 | TODO | | SPRINT_0129_0001_0001_policy_reasoning | Vuln Explorer API Guild · CLI Guild | src/VulnExplorer/StellaOps.VulnExplorer.Api | Requires API-29-010 artifacts | VULN-API-29-010 | VUAP0102 | -| APIGOV-61-001 | TODO | | SPRINT_511_api | API Governance Guild | src/Api/StellaOps.Api.Governance | Configure spectral/linters with Stella rules; add CI job failing on violations. | 61-001 | APIG0101 | -| APIGOV-61-002 | TODO | | SPRINT_511_api | API Governance Guild | src/Api/StellaOps.Api.Governance | Implement example coverage checker ensuring every operation has at least one request/response example. Dependencies: APIGOV-61-001. | APIGOV-61-001 | APIG0101 | -| APIGOV-62-001 | TODO | | SPRINT_511_api | API Governance Guild | src/Api/StellaOps.Api.Governance | Build compatibility diff tool producing additive/breaking reports comparing prior release. Dependencies: APIGOV-61-002. | APIGOV-61-002 | APIG0101 | -| APIGOV-62-002 | TODO | | SPRINT_511_api | API Governance Guild · DevOps Guild | src/Api/StellaOps.Api.Governance | Automate changelog generation and publish signed artifacts to `src/Sdk/StellaOps.Sdk.Release` pipeline. Dependencies: APIGOV-62-001. | APIGOV-62-001 | APIG0101 | -| APIGOV-63-001 | TODO | | SPRINT_511_api | API Governance Guild · Notifications Guild | src/Api/StellaOps.Api.Governance | Integrate deprecation metadata into Notification Studio templates for API sunset events. Dependencies: APIGOV-62-002. | APIGOV-62-002 | APIG0101 | +| APIGOV-61-001 | TODO | | SPRINT_0511_0000_0001_api | API Governance Guild | src/Api/StellaOps.Api.Governance | Configure spectral/linters with Stella rules; add CI job failing on violations. | 61-001 | APIG0101 | +| APIGOV-61-002 | TODO | | SPRINT_0511_0000_0001_api | API Governance Guild | src/Api/StellaOps.Api.Governance | Implement example coverage checker ensuring every operation has at least one request/response example. Dependencies: APIGOV-61-001. | APIGOV-61-001 | APIG0101 | +| APIGOV-62-001 | TODO | | SPRINT_0511_0000_0001_api | API Governance Guild | src/Api/StellaOps.Api.Governance | Build compatibility diff tool producing additive/breaking reports comparing prior release. Dependencies: APIGOV-61-002. | APIGOV-61-002 | APIG0101 | +| APIGOV-62-002 | TODO | | SPRINT_0511_0000_0001_api | API Governance Guild · DevOps Guild | src/Api/StellaOps.Api.Governance | Automate changelog generation and publish signed artifacts to `src/Sdk/StellaOps.Sdk.Release` pipeline. Dependencies: APIGOV-62-001. | APIGOV-62-001 | APIG0101 | +| APIGOV-63-001 | TODO | | SPRINT_0511_0000_0001_api | API Governance Guild · Notifications Guild | src/Api/StellaOps.Api.Governance | Integrate deprecation metadata into Notification Studio templates for API sunset events. Dependencies: APIGOV-62-002. | APIGOV-62-002 | APIG0101 | | ATTEST-01-003 | DONE (2025-11-23) | 2025-11-23 | SPRINT_110_ingestion_evidence | Excititor Guild · Evidence Locker Guild | src/Attestor/StellaOps.Attestor | Excititor attestation payloads shipped on frozen bundle v1. | EXCITITOR-AIAI-31-002; ELOCKER-CONTRACT-2001 | ATEL0102 | | ATTEST-73-001 | DONE (2025-11-25) | 2025-11-25 | SPRINT_110_ingestion_evidence | Concelier Core · Evidence Locker Guild | src/Attestor/StellaOps.Attestor | Attestation claims builder verified; TRX archived. | CONCELIER-AIAI-31-002; ELOCKER-CONTRACT-2001 | ATEL0102 | | ATTEST-73-002 | DONE (2025-11-25) | 2025-11-25 | SPRINT_110_ingestion_evidence | Concelier Core · Evidence Locker Guild | src/Attestor/StellaOps.Attestor | Internal verify endpoint validated; TRX archived. | CONCELIER-AIAI-31-002; ELOCKER-CONTRACT-2001 | ATEL0102 | | ATTEST-73-003 | TODO | | SPRINT_302_docs_tasks_md_ii | Docs Guild · Policy Guild | docs/modules/attestor | Wait for ATEL0102 evidence | Wait for ATEL0102 evidence | DOAT0102 | | ATTEST-73-004 | TODO | | SPRINT_302_docs_tasks_md_ii | Docs Guild · Attestor Service Guild | docs/modules/attestor | Depends on #1 | Depends on #1 | DOAT0102 | -| ATTEST-74-001 | DOING | | SPRINT_170_notifications_telemetry | Notifications Service Guild · Attestor Service Guild | src/Notify/StellaOps.Notify | Needs DSSE schema sign-off | Needs DSSE schema sign-off | NOTY0102 | -| ATTEST-74-002 | DOING | | SPRINT_170_notifications_telemetry | Notifications Service Guild | src/Notify/StellaOps.Notify | Depends on #1 | Depends on #1 | NOTY0102 | +| ATTEST-74-001 | DOING | | SPRINT_0170_0000_0001_notifications_telemetry | Notifications Service Guild · Attestor Service Guild | src/Notify/StellaOps.Notify | Needs DSSE schema sign-off | Needs DSSE schema sign-off | NOTY0102 | +| ATTEST-74-002 | DOING | | SPRINT_0170_0000_0001_notifications_telemetry | Notifications Service Guild | src/Notify/StellaOps.Notify | Depends on #1 | Depends on #1 | NOTY0102 | | ATTEST-74-003 | TODO | | SPRINT_302_docs_tasks_md_ii | Docs Guild · Attestor Console Guild | docs/modules/attestor | Depends on NOTY0102 | Depends on NOTY0102 | DOAT0102 | | ATTEST-74-004 | TODO | | SPRINT_302_docs_tasks_md_ii | Docs Guild · CLI Attestor Guild | docs/modules/attestor | Depends on NOTY0102 | Depends on NOTY0102 | DOAT0102 | | ATTEST-75-001 | TODO | | SPRINT_160_export_evidence | Docs Guild · Export Attestation Guild | docs/modules/attestor | Needs Export bundle schema (ECOB0101) | Needs Export bundle schema (ECOB0101) | DOAT0102 | | ATTEST-75-002 | TODO | | SPRINT_160_export_evidence | Docs Guild · Security Guild | docs/modules/attestor | Depends on #5 | Depends on #5 | DOAT0102 | -| ATTEST-REPLAY-187-003 | TODO | | SPRINT_187_evidence_locker_cli_integration | Attestor Guild (src/Attestor/StellaOps.Attestor) | `src/Attestor/StellaOps.Attestor`, `docs/modules/attestor/architecture.md` | Wire Attestor/Rekor anchoring for replay manifests and capture verification APIs; extend `docs/modules/attestor/architecture.md` with a replay ledger flow referencing `docs/replay/DETERMINISTIC_REPLAY.md` Section 9. | Align replay payload schema with RPRC0101 | ATRE0101 | +| ATTEST-REPLAY-187-003 | TODO | | SPRINT_0187_0000_0001_evidence_locker_cli_integration | Attestor Guild (src/Attestor/StellaOps.Attestor) | `src/Attestor/StellaOps.Attestor`, `docs/modules/attestor/architecture.md` | Wire Attestor/Rekor anchoring for replay manifests and capture verification APIs; extend `docs/modules/attestor/architecture.md` with a replay ledger flow referencing `docs/replay/DETERMINISTIC_REPLAY.md` Section 9. | Align replay payload schema with RPRC0101 | ATRE0101 | | ATTESTOR-DOCS-0001 | DONE | 2025-11-05 | SPRINT_313_docs_modules_attestor | Docs Guild | docs/modules/attestor | Validate that `docs/modules/attestor/README.md` matches the latest release notes and attestation samples. | | DOAT0102 | | ATTESTOR-ENG-0001 | TODO | | SPRINT_313_docs_modules_attestor | Module Team | docs/modules/attestor | Cross-check implementation plan milestones against `/docs/implplan/SPRINT_*.md` and update module readiness checkpoints. | Depends on #1-6 | DOAT0102 | | ATTESTOR-OPS-0001 | TODO | | SPRINT_313_docs_modules_attestor | Ops Guild | docs/modules/attestor | Review runbooks/observability assets after the next sprint demo and capture findings inline with sprint notes. | Depends on #1-6 | DOAT0102 | @@ -2479,7 +2479,7 @@ | AUTH-MTLS-11-002 | DONE (2025-11-08) | 2025-11-08 | SPRINT_100_identity_signing | Authority Core & Security Guild (src/Authority/StellaOps.Authority) | src/Authority/StellaOps.Authority | Refresh grants now enforce the original client certificate, tokens persist `x5t#S256`/hex metadata via shared helper, and docs/JWKS guidance call out the mTLS binding expectations. | AUTH-DPOP-11-001 | AUIN0101 | | AUTH-PACKS-43-001 | DONE (2025-11-09) | 2025-11-09 | SPRINT_100_identity_signing | Authority Core & Security Guild (src/Authority/StellaOps.Authority) | src/Authority/StellaOps.Authority | Enforce pack signing policies, approval RBAC checks, CLI CI token scopes, and audit logging for approvals. | AUTH-PACKS-41-001; TASKRUN-42-001; ORCH-SVC-42-101 | AUIN0101 | | AUTH-REACH-401-005 | DONE (2025-11-27) | 2025-11-27 | SPRINT_0401_0001_0001_reachability_evidence_chain | Authority & Signer Guilds | `src/Authority/StellaOps.Authority`, `src/Signer/StellaOps.Signer` | Predicate types exist (stella.ops/vexDecision@v1 etc.); IAuthorityDsseStatementSigner created with ICryptoProviderRegistry; Rekor via existing IRekorClient. | Coordinate with replay reachability owners | AUIN0101 | -| AUTH-VERIFY-186-007 | TODO | | SPRINT_186_record_deterministic_execution | Authority Guild · Provenance Guild | `src/Authority/StellaOps.Authority`, `src/Provenance/StellaOps.Provenance.Attestation` | Expose an Authority-side verification helper/service that validates DSSE signatures and Rekor proofs for promotion attestations using trusted checkpoints, enabling offline audit flows. | Await PROB0101 provenance harness | AUIN0101 | +| AUTH-VERIFY-186-007 | TODO | | SPRINT_0186_0000_0001_record_deterministic_execution | Authority Guild · Provenance Guild | `src/Authority/StellaOps.Authority`, `src/Provenance/StellaOps.Provenance.Attestation` | Expose an Authority-side verification helper/service that validates DSSE signatures and Rekor proofs for promotion attestations using trusted checkpoints, enabling offline audit flows. | Await PROB0101 provenance harness | AUIN0101 | | AUTHORITY-DOCS-0001 | TODO | | SPRINT_314_docs_modules_authority | Docs Guild (docs/modules/authority) | docs/modules/authority | See ./AGENTS.md | Wait for AUIN0101 sign-off | DOAU0101 | | AUTHORITY-ENG-0001 | TODO | | SPRINT_314_docs_modules_authority | Module Team (docs/modules/authority) | docs/modules/authority | Update status via ./AGENTS.md workflow | Depends on #1 | DOAU0101 | | AUTHORITY-OPS-0001 | TODO | | SPRINT_314_docs_modules_authority | Ops Guild (docs/modules/authority) | docs/modules/authority | Sync outcomes back to ../.. | Depends on #1 | DOAU0101 | @@ -2494,10 +2494,10 @@ | BENCH-SIG-26-001 | TODO | | SPRINT_512_bench | Bench Guild · Signals Guild | src/Bench/StellaOps.Bench | Develop benchmark for reachability scoring pipeline (facts/sec, latency, memory) using synthetic callgraphs/runtime batches. | Needs SGSI0101 runtime feed | RBBN0102 | | BENCH-SIG-26-002 | TODO | | SPRINT_512_bench | Bench Guild · Policy Guild | src/Bench/StellaOps.Bench | Measure policy evaluation overhead with reachability cache hot/cold; ensure ≤8 ms p95 added latency. Dependencies: BENCH-SIG-26-001. | Depends on #6 | RBBN0102 | | BUNDLE-401-014 | TODO | | SPRINT_0401_0001_0001_reachability_evidence_chain | Symbols Guild | `src/Symbols/StellaOps.Symbols.Bundle` | Needs RBRE0101 provenance payload | Needs RBRE0101 provenance payload | RBSY0101 | -| BUNDLE-69-001 | TODO | | SPRINT_164_exportcenter_iii | Risk Bundle Export Guild · Risk Engine Guild | src/ExportCenter/StellaOps.ExportCenter.RiskBundles | Align with ATEL0102 DSSE outputs | Align with ATEL0102 DSSE outputs | RBRB0101 | -| BUNDLE-69-002 | TODO | | SPRINT_164_exportcenter_iii | Risk Bundle Export Guild · DevOps Guild | src/ExportCenter/StellaOps.ExportCenter.RiskBundles | Depends on #1 | Depends on #1 | RBRB0101 | -| BUNDLE-70-001 | TODO | | SPRINT_164_exportcenter_iii | Risk Bundle Export Guild · CLI Guild | src/ExportCenter/StellaOps.ExportCenter.RiskBundles | Needs CLI export contract from CLCI0104 | Needs CLI export contract from CLCI0104 | RBRB0101 | -| BUNDLE-70-002 | TODO | | SPRINT_164_exportcenter_iii | Risk Bundle Export Guild · Docs Guild | src/ExportCenter/StellaOps.ExportCenter.RiskBundles | Depends on #3 | Depends on #3 | RBRB0101 | +| BUNDLE-69-001 | TODO | | SPRINT_0164_0000_0003_exportcenter_iii | Risk Bundle Export Guild · Risk Engine Guild | src/ExportCenter/StellaOps.ExportCenter.RiskBundles | Align with ATEL0102 DSSE outputs | Align with ATEL0102 DSSE outputs | RBRB0101 | +| BUNDLE-69-002 | TODO | | SPRINT_0164_0000_0003_exportcenter_iii | Risk Bundle Export Guild · DevOps Guild | src/ExportCenter/StellaOps.ExportCenter.RiskBundles | Depends on #1 | Depends on #1 | RBRB0101 | +| BUNDLE-70-001 | TODO | | SPRINT_0164_0000_0003_exportcenter_iii | Risk Bundle Export Guild · CLI Guild | src/ExportCenter/StellaOps.ExportCenter.RiskBundles | Needs CLI export contract from CLCI0104 | Needs CLI export contract from CLCI0104 | RBRB0101 | +| BUNDLE-70-002 | TODO | | SPRINT_0164_0000_0003_exportcenter_iii | Risk Bundle Export Guild · Docs Guild | src/ExportCenter/StellaOps.ExportCenter.RiskBundles | Depends on #3 | Depends on #3 | RBRB0101 | | CAS-401-001 | TODO | | SPRINT_0401_0001_0001_reachability_evidence_chain | Scanner Worker Guild | `src/Scanner/StellaOps.Scanner.Worker` | Wait for RBRE0101 DSSE hashes | Wait for RBRE0101 DSSE hashes | CASC0101 | | CCCS-02-009 | TODO | | SPRINT_117_concelier_vi | Concelier Connector Guild – CCCS | src/Concelier/__Libraries/StellaOps.Concelier.Connector.Cccs | Implement restart-safe watermark + schema tests. | Confirm CCCS ingest watermark | CCFD0101 | | CENTER-ENG-0001 | TODO | | SPRINT_320_docs_modules_export_center | Module Team · Export Center Guild | docs/modules/export-center | Wait for RBRB0101 bundle sample | Wait for RBRB0101 bundle sample | DOEC0101 | @@ -2526,10 +2526,10 @@ | CLI-ATTEST-74-002 | TODO | | SPRINT_0201_0001_0001_cli_i | CLI Attestor Guild (src/Cli/StellaOps.Cli) | src/Cli/StellaOps.Cli | Implement `stella attest fetch` to download envelopes and payloads to disk. Dependencies: CLI-ATTEST-74-001. | — | CLCI0102 | | CLI-ATTEST-75-001 | TODO | | SPRINT_0201_0001_0001_cli_i | CLI Attestor Guild, KMS Guild (src/Cli/StellaOps.Cli) | src/Cli/StellaOps.Cli | Implement `stella attest key create. Dependencies: CLI-ATTEST-74-002. | — | CLCI0102 | | CLI-ATTEST-75-002 | TODO | | SPRINT_0201_0001_0001_cli_i | CLI Attestor Guild | src/Cli/StellaOps.Cli | Add support for building/verifying attestation bundles in CLI. Dependencies: CLI-ATTEST-75-001. | Wait for ATEL0102 outputs | CLCI0109 | -| CLI-CORE-41-001 | TODO | | SPRINT_202_cli_ii | DevEx/CLI Guild (src/Cli/StellaOps.Cli) | src/Cli/StellaOps.Cli | Implement CLI core features: config precedence, profiles/contexts, auth flows, output renderer (json/yaml/table), error mapping, global flags, telemetry opt-in. | — | CLCI0103 | +| CLI-CORE-41-001 | TODO | | SPRINT_0202_0000_0002_cli_ii | DevEx/CLI Guild (src/Cli/StellaOps.Cli) | src/Cli/StellaOps.Cli | Implement CLI core features: config precedence, profiles/contexts, auth flows, output renderer (json/yaml/table), error mapping, global flags, telemetry opt-in. | — | CLCI0103 | | CLI-DET-01 | DONE (2025-11-23) | 2025-11-23 | SPRINT_0301_0001_0001_docs_md_i | Docs Guild · DevEx/CLI Guild | | CLI-SBOM-60-001; CLI-SBOM-60-002 | CLI-SBOM-60-001; CLI-SBOM-60-002 | CLCI0103 | -| CLI-DETER-70-003 | TODO | | SPRINT_202_cli_ii | DevEx/CLI Guild, Scanner Guild (src/Cli/StellaOps.Cli) | src/Cli/StellaOps.Cli | Provide `stella detscore run` that executes the determinism harness locally (fixed clock, seeded RNG, canonical hashes) and writes `determinism.json`, supporting CI/non-zero threshold exit codes (`docs/modules/scanner/determinism-score.md`). | — | CLCI0103 | -| CLI-DETER-70-004 | TODO | | SPRINT_203_cli_iii | DevEx/CLI Guild (src/Cli/StellaOps.Cli) | src/Cli/StellaOps.Cli | Add `stella detscore report` to summarise published `determinism.json` files (overall score, per-image matrix) and integrate with release notes/air-gap kits (`docs/modules/scanner/determinism-score.md`). Dependencies: CLI-DETER-70-003. | — | CLCI0103 | +| CLI-DETER-70-003 | TODO | | SPRINT_0202_0000_0002_cli_ii | DevEx/CLI Guild, Scanner Guild (src/Cli/StellaOps.Cli) | src/Cli/StellaOps.Cli | Provide `stella detscore run` that executes the determinism harness locally (fixed clock, seeded RNG, canonical hashes) and writes `determinism.json`, supporting CI/non-zero threshold exit codes (`docs/modules/scanner/determinism-score.md`). | — | CLCI0103 | +| CLI-DETER-70-004 | TODO | | SPRINT_0203_0000_0003_cli_iii | DevEx/CLI Guild (src/Cli/StellaOps.Cli) | src/Cli/StellaOps.Cli | Add `stella detscore report` to summarise published `determinism.json` files (overall score, per-image matrix) and integrate with release notes/air-gap kits (`docs/modules/scanner/determinism-score.md`). Dependencies: CLI-DETER-70-003. | — | CLCI0103 | | CLI-DOCS-0001 | TODO | | SPRINT_316_docs_modules_cli | Docs Guild (docs/modules/cli) | docs/modules/cli | See ./AGENTS.md | — | CLCI0103 | | CLI-EDITOR-401-004 | TODO | | SPRINT_0401_0001_0001_reachability_evidence_chain | CLI Guild (`src/Cli/StellaOps.Cli`, `docs/policy/lifecycle.md`) | `src/Cli/StellaOps.Cli`, `docs/policy/lifecycle.md` | Enhance `stella policy` CLI verbs (edit/lint/simulate) to edit Git-backed `.dsl` files, run local coverage tests, and commit SemVer metadata. | — | CLCI0103 | | CLI-ENG-0001 | TODO | | SPRINT_316_docs_modules_cli | Module Team (docs/modules/cli) | docs/modules/cli | Update status via ./AGENTS.md workflow | — | CLCI0103 | @@ -2548,55 +2548,55 @@ | CLI-NOTIFY-39-001 | BLOCKED | 2025-10-29 | SPRINT_0202_0001_0001_cli_ii | DevEx/CLI Guild (src/Cli/StellaOps.Cli) | src/Cli/StellaOps.Cli | Add simulation (`stella notify simulate`) and digest commands with diff output and schedule triggering, including dry-run mode. Dependencies: CLI-NOTIFY-38-001. | CLCI0103 | CLCI0104 | | CLI-NOTIFY-40-001 | BLOCKED | 2025-11-30 | SPRINT_0202_0001_0001_cli_ii | DevEx/CLI Guild (src/Cli/StellaOps.Cli) | src/Cli/StellaOps.Cli | Provide ack token redemption workflow, escalation management, localization previews, and channel health checks. Dependencies: CLI-NOTIFY-39-001. | — | CLCI0104 | | CLI-OBS-50-001 | DONE | 2025-11-28 | SPRINT_0202_0001_0001_cli_ii | DevEx/CLI Guild (src/Cli/StellaOps.Cli) | src/Cli/StellaOps.Cli | Ensure CLI HTTP client propagates `traceparent` headers for all commands, prints correlation IDs on failure, and records trace IDs in verbose logs (scrubbed). | — | CLCI0104 | -| CLI-OBS-51-001 | TODO | | SPRINT_203_cli_iii | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Implement `stella obs top` command streaming service health metrics, SLO status, and burn-rate alerts with TUI view and JSON output. Dependencies: CLI-OBS-50-001. | — | CLCI0105 | -| CLI-OBS-52-001 | TODO | | SPRINT_203_cli_iii | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Add `stella obs trace ` and `stella obs logs --from/--to` commands that correlate timeline events, logs, and evidence links with pagination + guardrails. Dependencies: CLI-OBS-51-001. | — | CLCI0105 | -| CLI-OBS-55-001 | TODO | | SPRINT_203_cli_iii | DevEx/CLI Guild · DevOps Guild | src/Cli/StellaOps.Cli | Add `stella obs incident-mode enable. Dependencies: CLI-OBS-52-001. | — | CLCI0105 | +| CLI-OBS-51-001 | TODO | | SPRINT_0203_0000_0003_cli_iii | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Implement `stella obs top` command streaming service health metrics, SLO status, and burn-rate alerts with TUI view and JSON output. Dependencies: CLI-OBS-50-001. | — | CLCI0105 | +| CLI-OBS-52-001 | TODO | | SPRINT_0203_0000_0003_cli_iii | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Add `stella obs trace ` and `stella obs logs --from/--to` commands that correlate timeline events, logs, and evidence links with pagination + guardrails. Dependencies: CLI-OBS-51-001. | — | CLCI0105 | +| CLI-OBS-55-001 | TODO | | SPRINT_0203_0000_0003_cli_iii | DevEx/CLI Guild · DevOps Guild | src/Cli/StellaOps.Cli | Add `stella obs incident-mode enable. Dependencies: CLI-OBS-52-001. | — | CLCI0105 | | CLI-OPS-0001 | TODO | | SPRINT_316_docs_modules_cli | Ops Guild (docs/modules/cli) | docs/modules/cli | Sync outcomes back to ../.. | — | CLCI0105 | -| CLI-ORCH-32-001 | TODO | | SPRINT_203_cli_iii | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Implement `stella orch sources | ORGR0101 hand-off | CLCI0105 | -| CLI-ORCH-33-001 | TODO | | SPRINT_203_cli_iii | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Add action verbs (`sources test. Dependencies: CLI-ORCH-32-001. | ORGR0101 hand-off | CLCI0105 | -| CLI-ORCH-34-001 | TODO | | SPRINT_203_cli_iii | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Provide backfill wizard (`--from/--to --dry-run`), quota management (`quotas get. Dependencies: CLI-ORCH-33-001. | ORGR0102 API review | CLCI0105 | -| CLI-PACKS-42-001 | TODO | | SPRINT_203_cli_iii | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Implement Task Pack commands (`pack plan/run/push/pull/verify`) with schema validation, expression sandbox, plan/simulate engine, remote execution. | — | CLCI0105 | -| CLI-PACKS-43-001 | TODO | | SPRINT_203_cli_iii | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Deliver advanced pack features (approvals pause/resume, secret injection, localization, man pages, offline cache). Dependencies: CLI-PACKS-42-001. | Offline kit schema sign-off | CLCI0105 | +| CLI-ORCH-32-001 | TODO | | SPRINT_0203_0000_0003_cli_iii | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Implement `stella orch sources | ORGR0101 hand-off | CLCI0105 | +| CLI-ORCH-33-001 | TODO | | SPRINT_0203_0000_0003_cli_iii | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Add action verbs (`sources test. Dependencies: CLI-ORCH-32-001. | ORGR0101 hand-off | CLCI0105 | +| CLI-ORCH-34-001 | TODO | | SPRINT_0203_0000_0003_cli_iii | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Provide backfill wizard (`--from/--to --dry-run`), quota management (`quotas get. Dependencies: CLI-ORCH-33-001. | ORGR0102 API review | CLCI0105 | +| CLI-PACKS-42-001 | TODO | | SPRINT_0203_0000_0003_cli_iii | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Implement Task Pack commands (`pack plan/run/push/pull/verify`) with schema validation, expression sandbox, plan/simulate engine, remote execution. | — | CLCI0105 | +| CLI-PACKS-43-001 | TODO | | SPRINT_0203_0000_0003_cli_iii | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Deliver advanced pack features (approvals pause/resume, secret injection, localization, man pages, offline cache). Dependencies: CLI-PACKS-42-001. | Offline kit schema sign-off | CLCI0105 | | CLI-PACKS-43-002 | TODO | | SPRINT_0508_0001_0001_ops_offline_kit | Offline Kit Guild · Packs Registry Guild | ops/offline-kit | Bundle Task Pack samples, registry mirror seeds, Task Runner configs, and CLI binaries with checksums into Offline Kit. | CLI-PACKS-43-001 | CLCI0105 | -| CLI-PARITY-41-001 | TODO | | SPRINT_203_cli_iii | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Deliver parity command groups (`policy`, `sbom`, `vuln`, `vex`, `advisory`, `export`, `orchestrator`) with `--explain`, deterministic outputs, and parity matrix entries. | — | CLCI0106 | -| CLI-PARITY-41-002 | TODO | | SPRINT_203_cli_iii | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Implement `notify`, `aoc`, `auth` command groups, idempotency keys, shell completions, config docs, and parity matrix export tooling. Dependencies: CLI-PARITY-41-001. | — | CLCI0106 | -| CLI-POLICY-20-001 | TODO | | SPRINT_203_cli_iii | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Add `stella policy new | PLPE0101 completion | CLCI0106 | -| CLI-POLICY-23-004 | TODO | | SPRINT_203_cli_iii | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Add `stella policy lint` command validating SPL files with compiler diagnostics; support JSON output. Dependencies: CLI-POLICY-20-001. | PLPE0102 readiness | CLCI0106 | -| CLI-POLICY-23-006 | TODO | | SPRINT_203_cli_iii | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Provide `stella policy history` and `stella policy explain` commands to pull run history and explanation trees. Dependencies: CLI-POLICY-23-005. | — | CLCI0106 | -| CLI-POLICY-27-001 | TODO | | SPRINT_203_cli_iii | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Implement policy workspace commands (`stella policy init`, `edit`, `lint`, `compile`, `test`) with template selection, local cache, JSON output, and deterministic temp directories. Dependencies: CLI-POLICY-23-006. | Ledger API exposure | CLCI0106 | -| CLI-POLICY-27-002 | TODO | | SPRINT_204_cli_iv | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Add submission/review workflow commands (`stella policy version bump`, `submit`, `review comment`, `approve`, `reject`) supporting reviewer assignment, changelog capture, and exit codes. Dependencies: CLI-POLICY-27-001. | CLI-POLICY-27-001 | CLCI0106 | -| CLI-POLICY-27-003 | TODO | | SPRINT_204_cli_iv | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Implement `stella policy simulate` enhancements (quick vs batch, SBOM selectors, heatmap summary, manifest download) with `--json` and Markdown report output for CI. Dependencies: CLI-POLICY-27-002. | CLI-POLICY-27-002 | CLCI0106 | -| CLI-POLICY-27-004 | TODO | | SPRINT_204_cli_iv | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Add lifecycle commands for publish/promote/rollback/sign (`stella policy publish --sign`, `promote --env`, `rollback`) with attestation verification and canary arguments. Dependencies: CLI-POLICY-27-003. | CLI-POLICY-27-003 | CLCI0106 | -| CLI-POLICY-27-005 | TODO | | SPRINT_204_cli_iv | DevEx/CLI Guild · Docs Guild | src/Cli/StellaOps.Cli | Update CLI reference and samples for Policy Studio including JSON schemas, exit codes, and CI snippets. Dependencies: CLI-POLICY-27-004. | CLI-POLICY-27-004 | CLCI0106 | -| CLI-POLICY-27-006 | TODO | | SPRINT_204_cli_iv | CLI Guild · Policy Guild | src/Cli/StellaOps.Cli | Update CLI policy profiles/help text to request the new Policy Studio scope family, surface ProblemDetails guidance for `invalid_scope`, and adjust regression tests for scope failures. Dependencies: CLI-POLICY-27-005. | Depends on #2 | CLCI0109 | -| CLI-PROMO-70-001 | TODO | | SPRINT_202_cli_ii | DevEx/CLI Guild · Provenance Guild | src/Cli/StellaOps.Cli | Add `stella promotion assemble` command that resolves image digests, hashes SBOM/VEX artifacts, fetches Rekor proofs from Attestor, and emits the `stella.ops/promotion@v1` JSON payload (see `docs/release/promotion-attestations.md`). | Mirror attestation inputs | CLCI0108 | -| CLI-PROMO-70-002 | TODO | | SPRINT_203_cli_iii | CLI Guild · Marketing Guild | src/Cli/StellaOps.Cli | Implement `stella promotion attest` / `promotion verify` commands that sign the promotion payload via Signer, retrieve DSSE bundles from Attestor, and perform offline verification against trusted checkpoints (`docs/release/promotion-attestations.md`). Dependencies: CLI-PROMO-70-001. | Needs revised DSSE plan | CLCI0109 | +| CLI-PARITY-41-001 | TODO | | SPRINT_0203_0000_0003_cli_iii | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Deliver parity command groups (`policy`, `sbom`, `vuln`, `vex`, `advisory`, `export`, `orchestrator`) with `--explain`, deterministic outputs, and parity matrix entries. | — | CLCI0106 | +| CLI-PARITY-41-002 | TODO | | SPRINT_0203_0000_0003_cli_iii | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Implement `notify`, `aoc`, `auth` command groups, idempotency keys, shell completions, config docs, and parity matrix export tooling. Dependencies: CLI-PARITY-41-001. | — | CLCI0106 | +| CLI-POLICY-20-001 | TODO | | SPRINT_0203_0000_0003_cli_iii | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Add `stella policy new | PLPE0101 completion | CLCI0106 | +| CLI-POLICY-23-004 | TODO | | SPRINT_0203_0000_0003_cli_iii | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Add `stella policy lint` command validating SPL files with compiler diagnostics; support JSON output. Dependencies: CLI-POLICY-20-001. | PLPE0102 readiness | CLCI0106 | +| CLI-POLICY-23-006 | TODO | | SPRINT_0203_0000_0003_cli_iii | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Provide `stella policy history` and `stella policy explain` commands to pull run history and explanation trees. Dependencies: CLI-POLICY-23-005. | — | CLCI0106 | +| CLI-POLICY-27-001 | TODO | | SPRINT_0203_0000_0003_cli_iii | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Implement policy workspace commands (`stella policy init`, `edit`, `lint`, `compile`, `test`) with template selection, local cache, JSON output, and deterministic temp directories. Dependencies: CLI-POLICY-23-006. | Ledger API exposure | CLCI0106 | +| CLI-POLICY-27-002 | TODO | | SPRINT_0204_0000_0004_cli_iv | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Add submission/review workflow commands (`stella policy version bump`, `submit`, `review comment`, `approve`, `reject`) supporting reviewer assignment, changelog capture, and exit codes. Dependencies: CLI-POLICY-27-001. | CLI-POLICY-27-001 | CLCI0106 | +| CLI-POLICY-27-003 | TODO | | SPRINT_0204_0000_0004_cli_iv | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Implement `stella policy simulate` enhancements (quick vs batch, SBOM selectors, heatmap summary, manifest download) with `--json` and Markdown report output for CI. Dependencies: CLI-POLICY-27-002. | CLI-POLICY-27-002 | CLCI0106 | +| CLI-POLICY-27-004 | TODO | | SPRINT_0204_0000_0004_cli_iv | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Add lifecycle commands for publish/promote/rollback/sign (`stella policy publish --sign`, `promote --env`, `rollback`) with attestation verification and canary arguments. Dependencies: CLI-POLICY-27-003. | CLI-POLICY-27-003 | CLCI0106 | +| CLI-POLICY-27-005 | TODO | | SPRINT_0204_0000_0004_cli_iv | DevEx/CLI Guild · Docs Guild | src/Cli/StellaOps.Cli | Update CLI reference and samples for Policy Studio including JSON schemas, exit codes, and CI snippets. Dependencies: CLI-POLICY-27-004. | CLI-POLICY-27-004 | CLCI0106 | +| CLI-POLICY-27-006 | TODO | | SPRINT_0204_0000_0004_cli_iv | CLI Guild · Policy Guild | src/Cli/StellaOps.Cli | Update CLI policy profiles/help text to request the new Policy Studio scope family, surface ProblemDetails guidance for `invalid_scope`, and adjust regression tests for scope failures. Dependencies: CLI-POLICY-27-005. | Depends on #2 | CLCI0109 | +| CLI-PROMO-70-001 | TODO | | SPRINT_0202_0000_0002_cli_ii | DevEx/CLI Guild · Provenance Guild | src/Cli/StellaOps.Cli | Add `stella promotion assemble` command that resolves image digests, hashes SBOM/VEX artifacts, fetches Rekor proofs from Attestor, and emits the `stella.ops/promotion@v1` JSON payload (see `docs/release/promotion-attestations.md`). | Mirror attestation inputs | CLCI0108 | +| CLI-PROMO-70-002 | TODO | | SPRINT_0203_0000_0003_cli_iii | CLI Guild · Marketing Guild | src/Cli/StellaOps.Cli | Implement `stella promotion attest` / `promotion verify` commands that sign the promotion payload via Signer, retrieve DSSE bundles from Attestor, and perform offline verification against trusted checkpoints (`docs/release/promotion-attestations.md`). Dependencies: CLI-PROMO-70-001. | Needs revised DSSE plan | CLCI0109 | | CLI-REPLAY-187-002 | TODO | | SPRINT_160_export_evidence | CLI Guild · Replay Guild | `src/Cli/StellaOps.Cli` | CLI Guild · `docs/modules/cli/architecture.md` | Requires RBRE0101 recorder schema | CLCI0109 | -| CLI-RISK-66-001 | TODO | | SPRINT_204_cli_iv | DevEx/CLI Guild · Policy Guild | src/Cli/StellaOps.Cli | Implement `stella risk profile list | Ledger scores ready | CLCI0108 | -| CLI-RISK-66-002 | TODO | | SPRINT_204_cli_iv | DevEx/CLI Guild · Risk Engine Guild | src/Cli/StellaOps.Cli | Ship `stella risk simulate` supporting SBOM/asset inputs, diff mode, and export to JSON/CSV. Dependencies: CLI-RISK-66-001. | CLI-RISK-66-001 | CLCI0108 | -| CLI-RISK-67-001 | TODO | | SPRINT_204_cli_iv | DevEx/CLI Guild · Findings Ledger Guild | src/Cli/StellaOps.Cli | Provide `stella risk results` with filtering, severity thresholds, explainability fetch. Dependencies: CLI-RISK-66-002. | CLI-RISK-66-002 | CLCI0108 | -| CLI-RISK-68-001 | TODO | | SPRINT_204_cli_iv | DevEx/CLI Guild · Export Guild | src/Cli/StellaOps.Cli | Add `stella risk bundle verify` and integrate with offline risk bundles. Dependencies: CLI-RISK-67-001. | CLI-RISK-67-001 | CLCI0108 | -| CLI-SBOM-60-001 | TODO | | SPRINT_203_cli_iii | CLI Guild · Scanner Guild | src/Cli/StellaOps.Cli | Ship `stella sbomer layer`/`compose` verbs that capture per-layer fragments, run canonicalization, verify fragment DSSE, and emit `_composition.json` + Merkle diagnostics (ref `docs/modules/scanner/deterministic-sbom-compose.md`). Dependencies: CLI-PARITY-41-001, SCANNER-SURFACE-04. | Wait for CASC0101 manifest | CLSB0101 | -| CLI-SBOM-60-002 | TODO | | SPRINT_203_cli_iii | CLI Guild | src/Cli/StellaOps.Cli | Add `stella sbomer drift --explain` + `verify` commands that rerun composition locally, highlight which arrays/keys broke determinism, and integrate with Offline Kit bundles. Dependencies: CLI-SBOM-60-001. | Depends on #1 | CLSB0101 | -| CLI-SDK-62-001 | TODO | | SPRINT_204_cli_iv | CLI Guild · SDK Guild | src/Cli/StellaOps.Cli | Replace bespoke HTTP clients with official SDK (TS/Go) for all CLI commands; ensure modular transport for air-gapped mode. | Align with SDK generator sprint | CLSB0101 | -| CLI-SDK-62-002 | TODO | | SPRINT_204_cli_iv | CLI Guild | src/Cli/StellaOps.Cli | Update CLI error handling to surface standardized API error envelope with `error.code` and `trace_id`. Dependencies: CLI-SDK-62-001. | Depends on #3 | CLSB0101 | -| CLI-SDK-63-001 | TODO | | SPRINT_204_cli_iv | CLI Guild | src/Cli/StellaOps.Cli | Expose `stella api spec download` command retrieving aggregate OAS and verifying checksum/ETag. Dependencies: CLI-SDK-62-002. | Needs CAS graph (CASC0101) | CLSB0101 | -| CLI-SDK-64-001 | TODO | | SPRINT_204_cli_iv | CLI Guild | src/Cli/StellaOps.Cli | Add CLI subcommand `stella sdk update` to fetch latest SDK manifests/changelogs; integrate with Notifications for deprecations. Dependencies: CLI-SDK-63-001. | Depends on #5 | CLSB0101 | -| CLI-SIG-26-001 | TODO | | SPRINT_204_cli_iv | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Implement `stella reachability upload-callgraph` and `stella reachability list/explain` commands with streaming upload, pagination, and exit codes. | ATEL0101 signing plan | CLCI0108 | -| CLI-SIG-26-002 | TODO | | SPRINT_204_cli_iv | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Extend `stella policy simulate` with reachability override flags (`--reachability-state`, `--reachability-score`). Dependencies: CLI-SIG-26-001. | CLI-SIG-26-001 | CLCI0108 | -| CLI-TEN-47-001 | TODO | | SPRINT_205_cli_v | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Implement `stella login`, `whoami`, `tenants list`, persistent profiles, secure token storage, and `--tenant` override with validation. | — | CLCI0108 | -| CLI-TEN-49-001 | TODO | | SPRINT_205_cli_v | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Add service account token minting, delegation (`stella token delegate`), impersonation banner, and audit-friendly logging. Dependencies: CLI-TEN-47-001. | CLI-TEN-47-001 | CLCI0108 | -| CLI-VEX-30-001 | TODO | | SPRINT_205_cli_v | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Implement `stella vex consensus list` with filters, paging, policy selection, `--json/--csv`. | PLVL0102 completion | CLCI0107 | -| CLI-VEX-30-002 | TODO | | SPRINT_205_cli_v | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Implement `stella vex consensus show` displaying quorum, evidence, rationale, signature status. Dependencies: CLI-VEX-30-001. | CLI-VEX-30-001 | CLCI0107 | -| CLI-VEX-30-003 | TODO | | SPRINT_205_cli_v | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Implement `stella vex simulate` for trust/threshold overrides with JSON diff output. Dependencies: CLI-VEX-30-002. | CLI-VEX-30-002 | CLCI0107 | -| CLI-VEX-30-004 | TODO | | SPRINT_205_cli_v | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Implement `stella vex export` for consensus NDJSON bundles with signature verification helper. Dependencies: CLI-VEX-30-003. | CLI-VEX-30-003 | CLCI0107 | +| CLI-RISK-66-001 | TODO | | SPRINT_0204_0000_0004_cli_iv | DevEx/CLI Guild · Policy Guild | src/Cli/StellaOps.Cli | Implement `stella risk profile list | Ledger scores ready | CLCI0108 | +| CLI-RISK-66-002 | TODO | | SPRINT_0204_0000_0004_cli_iv | DevEx/CLI Guild · Risk Engine Guild | src/Cli/StellaOps.Cli | Ship `stella risk simulate` supporting SBOM/asset inputs, diff mode, and export to JSON/CSV. Dependencies: CLI-RISK-66-001. | CLI-RISK-66-001 | CLCI0108 | +| CLI-RISK-67-001 | TODO | | SPRINT_0204_0000_0004_cli_iv | DevEx/CLI Guild · Findings Ledger Guild | src/Cli/StellaOps.Cli | Provide `stella risk results` with filtering, severity thresholds, explainability fetch. Dependencies: CLI-RISK-66-002. | CLI-RISK-66-002 | CLCI0108 | +| CLI-RISK-68-001 | TODO | | SPRINT_0204_0000_0004_cli_iv | DevEx/CLI Guild · Export Guild | src/Cli/StellaOps.Cli | Add `stella risk bundle verify` and integrate with offline risk bundles. Dependencies: CLI-RISK-67-001. | CLI-RISK-67-001 | CLCI0108 | +| CLI-SBOM-60-001 | TODO | | SPRINT_0203_0000_0003_cli_iii | CLI Guild · Scanner Guild | src/Cli/StellaOps.Cli | Ship `stella sbomer layer`/`compose` verbs that capture per-layer fragments, run canonicalization, verify fragment DSSE, and emit `_composition.json` + Merkle diagnostics (ref `docs/modules/scanner/deterministic-sbom-compose.md`). Dependencies: CLI-PARITY-41-001, SCANNER-SURFACE-04. | Wait for CASC0101 manifest | CLSB0101 | +| CLI-SBOM-60-002 | TODO | | SPRINT_0203_0000_0003_cli_iii | CLI Guild | src/Cli/StellaOps.Cli | Add `stella sbomer drift --explain` + `verify` commands that rerun composition locally, highlight which arrays/keys broke determinism, and integrate with Offline Kit bundles. Dependencies: CLI-SBOM-60-001. | Depends on #1 | CLSB0101 | +| CLI-SDK-62-001 | TODO | | SPRINT_0204_0000_0004_cli_iv | CLI Guild · SDK Guild | src/Cli/StellaOps.Cli | Replace bespoke HTTP clients with official SDK (TS/Go) for all CLI commands; ensure modular transport for air-gapped mode. | Align with SDK generator sprint | CLSB0101 | +| CLI-SDK-62-002 | TODO | | SPRINT_0204_0000_0004_cli_iv | CLI Guild | src/Cli/StellaOps.Cli | Update CLI error handling to surface standardized API error envelope with `error.code` and `trace_id`. Dependencies: CLI-SDK-62-001. | Depends on #3 | CLSB0101 | +| CLI-SDK-63-001 | TODO | | SPRINT_0204_0000_0004_cli_iv | CLI Guild | src/Cli/StellaOps.Cli | Expose `stella api spec download` command retrieving aggregate OAS and verifying checksum/ETag. Dependencies: CLI-SDK-62-002. | Needs CAS graph (CASC0101) | CLSB0101 | +| CLI-SDK-64-001 | TODO | | SPRINT_0204_0000_0004_cli_iv | CLI Guild | src/Cli/StellaOps.Cli | Add CLI subcommand `stella sdk update` to fetch latest SDK manifests/changelogs; integrate with Notifications for deprecations. Dependencies: CLI-SDK-63-001. | Depends on #5 | CLSB0101 | +| CLI-SIG-26-001 | TODO | | SPRINT_0204_0000_0004_cli_iv | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Implement `stella reachability upload-callgraph` and `stella reachability list/explain` commands with streaming upload, pagination, and exit codes. | ATEL0101 signing plan | CLCI0108 | +| CLI-SIG-26-002 | TODO | | SPRINT_0204_0000_0004_cli_iv | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Extend `stella policy simulate` with reachability override flags (`--reachability-state`, `--reachability-score`). Dependencies: CLI-SIG-26-001. | CLI-SIG-26-001 | CLCI0108 | +| CLI-TEN-47-001 | TODO | | SPRINT_0205_0000_0005_cli_v | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Implement `stella login`, `whoami`, `tenants list`, persistent profiles, secure token storage, and `--tenant` override with validation. | — | CLCI0108 | +| CLI-TEN-49-001 | TODO | | SPRINT_0205_0000_0005_cli_v | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Add service account token minting, delegation (`stella token delegate`), impersonation banner, and audit-friendly logging. Dependencies: CLI-TEN-47-001. | CLI-TEN-47-001 | CLCI0108 | +| CLI-VEX-30-001 | TODO | | SPRINT_0205_0000_0005_cli_v | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Implement `stella vex consensus list` with filters, paging, policy selection, `--json/--csv`. | PLVL0102 completion | CLCI0107 | +| CLI-VEX-30-002 | TODO | | SPRINT_0205_0000_0005_cli_v | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Implement `stella vex consensus show` displaying quorum, evidence, rationale, signature status. Dependencies: CLI-VEX-30-001. | CLI-VEX-30-001 | CLCI0107 | +| CLI-VEX-30-003 | TODO | | SPRINT_0205_0000_0005_cli_v | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Implement `stella vex simulate` for trust/threshold overrides with JSON diff output. Dependencies: CLI-VEX-30-002. | CLI-VEX-30-002 | CLCI0107 | +| CLI-VEX-30-004 | TODO | | SPRINT_0205_0000_0005_cli_v | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Implement `stella vex export` for consensus NDJSON bundles with signature verification helper. Dependencies: CLI-VEX-30-003. | CLI-VEX-30-003 | CLCI0107 | | CLI-VEX-401-011 | TODO | | SPRINT_0401_0001_0001_reachability_evidence_chain | CLI Guild | `src/Cli/StellaOps.Cli`, `docs/modules/cli/architecture.md`, `docs/benchmarks/vex-evidence-playbook.md` | Add `stella decision export | Reachability API exposure | CLCI0107 | -| CLI-VULN-29-001 | TODO | | SPRINT_205_cli_v | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Implement `stella vuln list` with grouping, paging, filters, `--json/--csv`, and policy selection. | — | CLCI0107 | -| CLI-VULN-29-002 | TODO | | SPRINT_205_cli_v | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Implement `stella vuln show` displaying evidence, policy rationale, paths, ledger summary; support `--json` for automation. Dependencies: CLI-VULN-29-001. | CLI-VULN-29-001 | CLCI0107 | -| CLI-VULN-29-003 | TODO | | SPRINT_205_cli_v | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Add workflow commands (`assign`, `comment`, `accept-risk`, `verify-fix`, `target-fix`, `reopen`) with filter selection (`--filter`) and idempotent retries. Dependencies: CLI-VULN-29-002. | CLI-VULN-29-002 | CLCI0107 | -| CLI-VULN-29-004 | TODO | | SPRINT_205_cli_v | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Implement `stella vuln simulate` producing delta summaries and optional Markdown report for CI. Dependencies: CLI-VULN-29-003. | CLI-VULN-29-003 | CLCI0107 | -| CLI-VULN-29-005 | TODO | | SPRINT_205_cli_v | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Add `stella vuln export` and `stella vuln bundle verify` commands to trigger/download evidence bundles and verify signatures. Dependencies: CLI-VULN-29-004. | CLI-VULN-29-004 | CLCI0107 | -| CLI-VULN-29-006 | TODO | | SPRINT_205_cli_v | DevEx/CLI Guild · Docs Guild | src/Cli/StellaOps.Cli | Update CLI docs/examples for Vulnerability Explorer with compliance checklist and CI snippets. Dependencies: CLI-VULN-29-005. | CLI-VULN-29-005 | CLCI0108 | +| CLI-VULN-29-001 | TODO | | SPRINT_0205_0000_0005_cli_v | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Implement `stella vuln list` with grouping, paging, filters, `--json/--csv`, and policy selection. | — | CLCI0107 | +| CLI-VULN-29-002 | TODO | | SPRINT_0205_0000_0005_cli_v | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Implement `stella vuln show` displaying evidence, policy rationale, paths, ledger summary; support `--json` for automation. Dependencies: CLI-VULN-29-001. | CLI-VULN-29-001 | CLCI0107 | +| CLI-VULN-29-003 | TODO | | SPRINT_0205_0000_0005_cli_v | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Add workflow commands (`assign`, `comment`, `accept-risk`, `verify-fix`, `target-fix`, `reopen`) with filter selection (`--filter`) and idempotent retries. Dependencies: CLI-VULN-29-002. | CLI-VULN-29-002 | CLCI0107 | +| CLI-VULN-29-004 | TODO | | SPRINT_0205_0000_0005_cli_v | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Implement `stella vuln simulate` producing delta summaries and optional Markdown report for CI. Dependencies: CLI-VULN-29-003. | CLI-VULN-29-003 | CLCI0107 | +| CLI-VULN-29-005 | TODO | | SPRINT_0205_0000_0005_cli_v | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Add `stella vuln export` and `stella vuln bundle verify` commands to trigger/download evidence bundles and verify signatures. Dependencies: CLI-VULN-29-004. | CLI-VULN-29-004 | CLCI0107 | +| CLI-VULN-29-006 | TODO | | SPRINT_0205_0000_0005_cli_v | DevEx/CLI Guild · Docs Guild | src/Cli/StellaOps.Cli | Update CLI docs/examples for Vulnerability Explorer with compliance checklist and CI snippets. Dependencies: CLI-VULN-29-005. | CLI-VULN-29-005 | CLCI0108 | | CLIENT-401-012 | TODO | | SPRINT_0401_0001_0001_reachability_evidence_chain | Symbols Guild | `src/Symbols/StellaOps.Symbols.Client`, `src/Scanner/StellaOps.Scanner.Symbolizer` | Align with symbolizer regression fixtures | Align with symbolizer regression fixtures | RBSY0101 | | COMPOSE-44-001 | BLOCKED | 2025-11-25 | SPRINT_0501_0001_0001_ops_deployment_i | Deployment Guild · DevEx Guild | ops/deployment | Author `docker-compose.yml`, `.env.example`, and `quickstart.sh` with all core services + dependencies (postgres, redis, object-store, queue, otel). | Waiting on consolidated service list/version pins from upstream module releases | DVCP0101 | | COMPOSE-44-002 | TODO | | SPRINT_0501_0001_0001_ops_deployment_i | Deployment Guild | ops/deployment | Implement `backup.sh` and `reset.sh` scripts with safety prompts and documentation. Dependencies: COMPOSE-44-001. | Depends on #1 | DVCP0101 | @@ -2678,9 +2678,9 @@ | CONCELIER-WEB-OBS-53-001 | TODO | | SPRINT_117_concelier_vi | Concelier WebService Guild · Evidence Locker Guild | src/Concelier/StellaOps.Concelier.WebService | Add `/evidence/advisories/*` routes that proxy evidence locker snapshots, verify `evidence:read` scopes, and return signed manifest metadata—no shortcut paths into raw storage. Depends on CONCELIER-WEB-OBS-52-001. | Blocked on Evidence Locker DSSE feed (002_ATEL0101) | CNOB0102 | | CONCELIER-WEB-OBS-54-001 | TODO | | SPRINT_117_concelier_vi | Concelier WebService Guild | src/Concelier/StellaOps.Concelier.WebService | Provide `/attestations/advisories/*` endpoints surfacing DSSE status, verification summary, and provenance chain so CLI/Console can audit trust without hitting databases. Depends on CONCELIER-WEB-OBS-53-001. | Depends on Link-Not-Merge schema (005_ATLN0101) | CNOB0102 | | CONCELIER-WEB-OBS-55-001 | TODO | | SPRINT_117_concelier_vi | Concelier WebService Guild · DevOps Guild | src/Concelier/StellaOps.Concelier.WebService | Implement incident-mode APIs that coordinate ingest, locker, and orchestrator, capturing activation events + cooldown semantics but leaving evidence untouched. Depends on CONCELIER-WEB-OBS-54-001. | Needs #4 to finalize labels | CNOB0102 | -| CONN-SUSE-01-003 | Team Excititor Connectors – SUSE | | SPRINT_120_excititor_ii | Connector Guild (SUSE) | src/Excititor/__Libraries/StellaOps.Excititor.Connectors.SUSE.RancherVEXHub | EXCITITOR-CONN-SUSE-01-002; EXCITITOR-POLICY-01-001 | EXCITITOR-CONN-SUSE-01-002; EXCITITOR-POLICY-01-001 | EXCN0102 | +| CONN-SUSE-01-003 | Team Excititor Connectors – SUSE | | SPRINT_0120_0000_0002_excititor_ii | Connector Guild (SUSE) | src/Excititor/__Libraries/StellaOps.Excititor.Connectors.SUSE.RancherVEXHub | EXCITITOR-CONN-SUSE-01-002; EXCITITOR-POLICY-01-001 | EXCITITOR-CONN-SUSE-01-002; EXCITITOR-POLICY-01-001 | EXCN0102 | | CONN-TRUST-01-001 | DONE (2025-11-22) | 2025-11-22 | SPRINT_110_ingestion_evidence | Excititor + AirGap Guilds | | Connector trust + air-gap ingest delivered against frozen schema. | CONCELIER-GRAPH-21-001; CONCELIER-GRAPH-21-002; ATTEST-PLAN-2001 | EXCN0102 | -| CONN-UBUNTU-01-003 | Team Excititor Connectors – Ubuntu | | SPRINT_120_excititor_ii | Connector Guild (Ubuntu) | src/Excititor/__Libraries/StellaOps.Excititor.Connectors.Ubuntu.CSAF | EXCITITOR-CONN-UBUNTU-01-002; EXCITITOR-POLICY-01-001 | EXCITITOR-CONN-UBUNTU-01-002; EXCITITOR-POLICY-01-001 | EXCN0102 | +| CONN-UBUNTU-01-003 | Team Excititor Connectors – Ubuntu | | SPRINT_0120_0000_0002_excititor_ii | Connector Guild (Ubuntu) | src/Excititor/__Libraries/StellaOps.Excititor.Connectors.Ubuntu.CSAF | EXCITITOR-CONN-UBUNTU-01-002; EXCITITOR-POLICY-01-001 | EXCITITOR-CONN-UBUNTU-01-002; EXCITITOR-POLICY-01-001 | EXCN0102 | | CONSENSUS-LENS-DOCS-0001 | TODO | | SPRINT_332_docs_modules_vex_lens | Docs Guild | docs/modules/vex-lens | Wait for CCSL0101 panel demo | Wait for CCSL0101 panel demo | CCDL0101 | | CONSENSUS-LENS-DOCS-0002 | TODO | 2025-11-05 | SPRINT_332_docs_modules_vex_lens | Docs Guild | docs/modules/vex-lens | Depends on #1 | Depends on #1 | CCDL0101 | | CONSENSUS-LENS-ENG-0001 | TODO | | SPRINT_332_docs_modules_vex_lens | Module Team | docs/modules/vex-lens | Needs CCWO0101 schema | Needs CCWO0101 schema | CCDL0101 | @@ -2699,15 +2699,15 @@ | CONTAINERS-45-001 | DONE | 2025-11-19 | SPRINT_0212_0001_0001_web_i | BE-Base Platform Guild | src/Web/StellaOps.Web | Depends on #1 | Depends on #1 | COWB0101 | | CONTAINERS-46-001 | DONE | 2025-11-19 | SPRINT_0212_0001_0001_web_i | BE-Base Platform Guild | src/Web/StellaOps.Web | Needs RBRE0101 hashes | Needs RBRE0101 hashes | COWB0101 | | CONTRIB-62-001 | TODO | | SPRINT_303_docs_tasks_md_iii | Docs Guild · API Governance Guild | docs/api | Wait for CCWO0101 spec finalization | Wait for CCWO0101 spec finalization | APID0101 | -| CORE-185-001 | TODO | | SPRINT_185_shared_replay_primitives | Platform Guild | `src/__Libraries/StellaOps.Replay.Core` | Wait for SGSI0101 feed | Wait for SGSI0101 feed | RLRC0101 | -| CORE-185-002 | TODO | | SPRINT_185_shared_replay_primitives | Platform Guild | src/__Libraries/StellaOps.Replay.Core | Depends on #1 | Depends on #1 | RLRC0101 | -| CORE-185-003 | TODO | | SPRINT_185_shared_replay_primitives | Platform Data Guild | src/__Libraries/StellaOps.Replay.Core | Depends on #2 | Depends on #2 | RLRC0101 | -| CORE-186-004 | TODO | | SPRINT_186_record_deterministic_execution | Signing Guild | `src/Signer/StellaOps.Signer`, `src/__Libraries/StellaOps.Cryptography` | Wait for RLRC0101 schema | Wait for RLRC0101 schema | SIGR0101 | -| CORE-186-005 | TODO | | SPRINT_186_record_deterministic_execution | Signing Guild | `src/Signer/StellaOps.Signer.Core` | Depends on #1 | Depends on #1 | SIGR0101 | -| CORE-41-001 | TODO | | SPRINT_202_cli_ii | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Wait for CASC0101 manifest | Wait for CASC0101 manifest | CLCI0110 | -| CORE-AOC-19-002 | TODO | | SPRINT_120_excititor_ii | Excititor Core Guild | src/Excititor/__Libraries/StellaOps.Excititor.Core | Wait for ATLN schema freeze | Wait for ATLN schema freeze | EXAC0101 | -| CORE-AOC-19-003 | TODO | | SPRINT_120_excititor_ii | Excititor Core Guild | src/Excititor/__Libraries/StellaOps.Excititor.Core | Depends on #1 | Depends on #1 | EXAC0101 | -| CORE-AOC-19-004 | TODO | | SPRINT_120_excititor_ii | Excititor Core Guild | src/Excititor/__Libraries/StellaOps.Excititor.Core | Depends on #2 | Depends on #2 | EXAC0101 | +| CORE-185-001 | TODO | | SPRINT_0185_0000_0001_shared_replay_primitives | Platform Guild | `src/__Libraries/StellaOps.Replay.Core` | Wait for SGSI0101 feed | Wait for SGSI0101 feed | RLRC0101 | +| CORE-185-002 | TODO | | SPRINT_0185_0000_0001_shared_replay_primitives | Platform Guild | src/__Libraries/StellaOps.Replay.Core | Depends on #1 | Depends on #1 | RLRC0101 | +| CORE-185-003 | TODO | | SPRINT_0185_0000_0001_shared_replay_primitives | Platform Data Guild | src/__Libraries/StellaOps.Replay.Core | Depends on #2 | Depends on #2 | RLRC0101 | +| CORE-186-004 | TODO | | SPRINT_0186_0000_0001_record_deterministic_execution | Signing Guild | `src/Signer/StellaOps.Signer`, `src/__Libraries/StellaOps.Cryptography` | Wait for RLRC0101 schema | Wait for RLRC0101 schema | SIGR0101 | +| CORE-186-005 | TODO | | SPRINT_0186_0000_0001_record_deterministic_execution | Signing Guild | `src/Signer/StellaOps.Signer.Core` | Depends on #1 | Depends on #1 | SIGR0101 | +| CORE-41-001 | TODO | | SPRINT_0202_0000_0002_cli_ii | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Wait for CASC0101 manifest | Wait for CASC0101 manifest | CLCI0110 | +| CORE-AOC-19-002 | TODO | | SPRINT_0120_0000_0002_excititor_ii | Excititor Core Guild | src/Excititor/__Libraries/StellaOps.Excititor.Core | Wait for ATLN schema freeze | Wait for ATLN schema freeze | EXAC0101 | +| CORE-AOC-19-003 | TODO | | SPRINT_0120_0000_0002_excititor_ii | Excititor Core Guild | src/Excititor/__Libraries/StellaOps.Excititor.Core | Depends on #1 | Depends on #1 | EXAC0101 | +| CORE-AOC-19-004 | TODO | | SPRINT_0120_0000_0002_excititor_ii | Excititor Core Guild | src/Excititor/__Libraries/StellaOps.Excititor.Core | Depends on #2 | Depends on #2 | EXAC0101 | | CORE-AOC-19-013 | TODO | | SPRINT_112_concelier_i | Concelier Core Guild + Excititor | src/Concelier/__Libraries/StellaOps.Concelier.Core | Needs CCAN0101 DSSE output | Needs CCAN0101 DSSE output | EXAC0101 | | CRT-56-001 | TODO | | SPRINT_0506_0001_0001_ops_devops_iv | Mirror Creator Guild | | Wait for PGMI0101 owner | Wait for PGMI0101 owner | MRCR0101 | | CRT-56-002 | TODO | | SPRINT_0506_0001_0001_ops_devops_iv | Mirror Creator · Security Guilds | | Depends on #1 | MIRROR-CRT-56-001; PROV-OBS-53-001 | MRCR0101 | @@ -2758,12 +2758,12 @@ | DEPLOY-VEX-30-002 | TODO | | SPRINT_0502_0001_0001_ops_deployment_ii | Deployment Guild | ops/deployment | Package Issuer Directory deployment manifests, backups, and security hardening guidance. Dependencies: DEPLOY-VEX-30-001. | Depends on #5 | DVPL0101 | | DEPLOY-VULN-29-001 | TODO | | SPRINT_0502_0001_0001_ops_deployment_ii | Deployment + Vuln Guild | ops/deployment | Produce Helm/Compose overlays for Findings Ledger + projector, including DB migrations, Merkle anchor jobs, and scaling guidance. | Needs CCWO0101 | DVPL0101 | | DEPLOY-VULN-29-002 | TODO | | SPRINT_0502_0001_0001_ops_deployment_ii | Deployment Guild | ops/deployment | Package `stella-vuln-explorer-api` deployment manifests, health checks, autoscaling policies, and offline kit instructions with signed images. Dependencies: DEPLOY-VULN-29-001. | Depends on #7 | DVPL0101 | -| DETER-186-008 | TODO | | SPRINT_186_record_deterministic_execution | Scanner Guild | `src/Scanner/StellaOps.Scanner.WebService`, `src/Scanner/StellaOps.Scanner.Worker` | Wait for RLRC0101 fixture | Wait for RLRC0101 fixture | SCDT0101 | -| DETER-186-009 | TODO | | SPRINT_186_record_deterministic_execution | Scanner Guild · QA Guild | `src/Scanner/StellaOps.Scanner.Replay`, `src/Scanner/__Tests` | Depends on #1 | Depends on #1 | SCDT0101 | -| DETER-186-010 | TODO | | SPRINT_186_record_deterministic_execution | Scanner Guild · Export Center Guild | `src/Scanner/StellaOps.Scanner.WebService`, `docs/modules/scanner/operations/release.md` | Depends on #2 | Depends on #2 | SCDT0101 | +| DETER-186-008 | TODO | | SPRINT_0186_0000_0001_record_deterministic_execution | Scanner Guild | `src/Scanner/StellaOps.Scanner.WebService`, `src/Scanner/StellaOps.Scanner.Worker` | Wait for RLRC0101 fixture | Wait for RLRC0101 fixture | SCDT0101 | +| DETER-186-009 | TODO | | SPRINT_0186_0000_0001_record_deterministic_execution | Scanner Guild · QA Guild | `src/Scanner/StellaOps.Scanner.Replay`, `src/Scanner/__Tests` | Depends on #1 | Depends on #1 | SCDT0101 | +| DETER-186-010 | TODO | | SPRINT_0186_0000_0001_record_deterministic_execution | Scanner Guild · Export Center Guild | `src/Scanner/StellaOps.Scanner.WebService`, `docs/modules/scanner/operations/release.md` | Depends on #2 | Depends on #2 | SCDT0101 | | DETER-70-002 | TODO | | SPRINT_0304_0001_0004_docs_tasks_md_iv | Docs Guild · Scanner Guild | | Needs CASC0101 manifest | Needs CASC0101 manifest | SCDT0101 | -| DETER-70-003 | TODO | | SPRINT_202_cli_ii | DevEx/CLI Guild · Scanner Guild | src/Cli/StellaOps.Cli | Depends on #4 | Depends on #4 | SCDT0101 | -| DETER-70-004 | TODO | | SPRINT_203_cli_iii | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Depends on #5 | Depends on #5 | SCDT0101 | +| DETER-70-003 | TODO | | SPRINT_0202_0000_0002_cli_ii | DevEx/CLI Guild · Scanner Guild | src/Cli/StellaOps.Cli | Depends on #4 | Depends on #4 | SCDT0101 | +| DETER-70-004 | TODO | | SPRINT_0203_0000_0003_cli_iii | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Depends on #5 | Depends on #5 | SCDT0101 | | DEVOPS-AIAI-31-001 | TODO | | SPRINT_0503_0001_0001_ops_devops_i | DevOps Guild, Advisory AI Guild (ops/devops) | ops/devops | Stand up CI pipelines, inference monitoring, privacy logging review, and perf dashboards for Advisory AI (summaries/conflicts/remediation). | — | DVDO0101 | | DEVOPS-AIRGAP-56-001 | TODO | | SPRINT_0503_0001_0001_ops_devops_i | DevOps Guild (ops/devops) | ops/devops | Ship deny-all egress policies for Kubernetes (NetworkPolicy/eBPF) and docker-compose firewall rules; provide verification script for sealed mode. | — | DVDO0101 | | DEVOPS-AIRGAP-56-002 | TODO | | SPRINT_0503_0001_0001_ops_devops_i | DevOps Guild, AirGap Importer Guild (ops/devops) | ops/devops | Provide import tooling for bundle staging: checksum validation, offline object-store loader scripts, removable media guidance. Dependencies: DEVOPS-AIRGAP-56-001. | — | DVDO0101 | @@ -2845,7 +2845,7 @@ | DEVPORT-64-001 | TODO | | SPRINT_206_devportal | DevPortal Guild | src/DevPortal/StellaOps.DevPortal.Site | Provide offline build target bundling HTML, specs, SDK archives; ensure no external assets. Dependencies: DEVPORT-63-002. | 64-001 | DEVL0101 | | DEVPORT-64-002 | TODO | | SPRINT_206_devportal | Developer Portal Guild (src/DevPortal/StellaOps.DevPortal.Site) | src/DevPortal/StellaOps.DevPortal.Site | Add automated accessibility tests, link checker, and performance budgets. Dependencies: DEVPORT-64-001. | | DEVL0102 | | DOC-008 | TODO | | SPRINT_0401_0001_0001_reachability_evidence_chain | Docs Guild · Reachability Guild | `docs/reachability/function-level-evidence.md`, `docs/09_API_CLI_REFERENCE.md`, `docs/api/policy.md` | Wait for replay evidence from 100_RBBN0101 | Wait for replay evidence from 100_RBBN0101 | DORC0101 | -| DOC-70-001 | DONE | | SPRINT_170_notifications_telemetry | Docs Guild · Notifications Guild | docs | Gather notification doc references | Validate existing notifications doc and migrate notes | DOCP0101 | +| DOC-70-001 | DONE | | SPRINT_0170_0000_0001_notifications_telemetry | Docs Guild · Notifications Guild | docs | Gather notification doc references | Validate existing notifications doc and migrate notes | DOCP0101 | | DOCKER-44-001 | TODO | | SPRINT_0507_0001_0001_ops_devops_v | DevOps Guild · Service Owners | ops/devops | Author multi-stage Dockerfiles for all core services (API, Console, Orchestrator, Task Runner, Conseiller, Excitor, Policy, Notify, Export, AI) with non-root users, read-only file systems, and health scripts. | Wait for DVPL0101 compose merge | DVDO0111 | | DOCKER-44-002 | TODO | | SPRINT_0507_0001_0001_ops_devops_v | DevOps Guild | ops/devops | Generate SBOMs and cosign attestations for each image and integrate verification into CI. Dependencies: DOCKER-44-001. | Depends on #1 | DVDO0111 | | DOCKER-44-003 | TODO | | SPRINT_0507_0001_0001_ops_devops_v | DevOps Guild | ops/devops | Implement `/health/liveness`, `/health/readiness`, `/version`, `/metrics`, and ensure capability endpoint returns `merge=false` for Conseiller/Excitor. Dependencies: DOCKER-44-002. | Requires SBOM+scan workflow from 137_SCDT0101 | DVDO0111 | @@ -2973,9 +2973,9 @@ | DOCS-POLICY-DET-01 | DONE (2025-11-23) | 2025-11-23 | SPRINT_0301_0001_0001_docs_md_i | Docs Guild · Policy Guild | docs/policy/runs.md | Extend `docs/modules/policy/architecture.md` with determinism gate semantics and provenance references. | Depends on deterministic harness (137_SCDT0101) | DOPL0103 | | DOCS-PROMO-70-001 | DONE (2025-11-26) | 2025-11-26 | SPRINT_0304_0001_0004_docs_tasks_md_iv | Docs Guild · Provenance Guild | docs/release/promotion-attestations.md | Publish `/docs/release/promotion-attestations.md` describing the promotion workflow (CLI commands, Signer/Attestor integration, offline verification) and update `/docs/forensics/provenance-attestation.md` with the new predicate. Dependencies: PROV-OBS-53-003, CLI-PROMO-70-002. | — | DOPV0101 | | DOCS-REACH-201-006 | TODO | | SPRINT_400_runtime_facts_static_callgraph_union | Docs Guild · Runtime Evidence Guild | docs/reachability | Author the reachability doc set (`docs/signals/reachability.md`, `callgraph-formats.md`, `runtime-facts.md`, CLI/UI appendices) plus update Zastava + Replay guides with the new evidence and operators’ workflow. | Needs RBRE0101 provenance hook summary | DORC0101 | -| DOCS-REPLAY-185-003 | TODO | | SPRINT_185_shared_replay_primitives | Docs Guild · Platform Data Guild | docs/replay | Author `docs/data/replay_schema.md` detailing `replay_runs`, `replay_bundles`, `replay_subjects` collections, index guidance, and offline sync strategy aligned with Replay CAS. | Need RPRC0101 API freeze | DORR0101 | -| DOCS-REPLAY-185-004 | TODO | | SPRINT_185_shared_replay_primitives | Docs Guild | docs/replay | Expand `docs/replay/DEVS_GUIDE_REPLAY.md` with integration guidance for consuming services (Scanner, Evidence Locker, CLI) and add checklist derived from `docs/replay/DETERMINISTIC_REPLAY.md` Section 11. | Depends on #1 | DORR0101 | -| DOCS-REPLAY-186-004 | TODO | | SPRINT_186_record_deterministic_execution | Docs Guild · Runtime Evidence Guild | docs/replay | Author `docs/replay/TEST_STRATEGY.md` (golden replay, feed drift, tool upgrade) and link it from both replay docs and Scanner architecture pages. | Requires deterministic evidence from RBRE0101 | DORR0101 | +| DOCS-REPLAY-185-003 | TODO | | SPRINT_0185_0000_0001_shared_replay_primitives | Docs Guild · Platform Data Guild | docs/replay | Author `docs/data/replay_schema.md` detailing `replay_runs`, `replay_bundles`, `replay_subjects` collections, index guidance, and offline sync strategy aligned with Replay CAS. | Need RPRC0101 API freeze | DORR0101 | +| DOCS-REPLAY-185-004 | TODO | | SPRINT_0185_0000_0001_shared_replay_primitives | Docs Guild | docs/replay | Expand `docs/replay/DEVS_GUIDE_REPLAY.md` with integration guidance for consuming services (Scanner, Evidence Locker, CLI) and add checklist derived from `docs/replay/DETERMINISTIC_REPLAY.md` Section 11. | Depends on #1 | DORR0101 | +| DOCS-REPLAY-186-004 | TODO | | SPRINT_0186_0000_0001_record_deterministic_execution | Docs Guild · Runtime Evidence Guild | docs/replay | Author `docs/replay/TEST_STRATEGY.md` (golden replay, feed drift, tool upgrade) and link it from both replay docs and Scanner architecture pages. | Requires deterministic evidence from RBRE0101 | DORR0101 | | DOCS-RISK-66-001 | TODO | | SPRINT_0308_0001_0008_docs_tasks_md_viii | Docs Guild · Risk Profile Schema Guild | docs/risk | Publish `/docs/risk/overview.md` covering concepts and glossary. | Need schema approvals from PLLG0104 | DORS0101 | | DOCS-RISK-66-002 | TODO | | SPRINT_0308_0001_0008_docs_tasks_md_viii | Docs Guild · Policy Guild | docs/risk | Author `/docs/risk/profiles.md` (authoring, versioning, scope). Dependencies: DOCS-RISK-66-001. | Depends on #1 | DORS0101 | | DOCS-RISK-66-003 | TODO | | SPRINT_0308_0001_0008_docs_tasks_md_viii | Docs Guild · Risk Engine Guild | docs/risk | Publish `/docs/risk/factors.md` cataloging signals, transforms, reducers, TTLs. Dependencies: DOCS-RISK-66-002. | Requires engine contract from Risk Engine Guild | DORS0101 | @@ -3044,7 +3044,7 @@ | DSSE-LIB-401-020 | DONE (2025-11-27) | 2025-11-27 | SPRINT_0401_0001_0001_reachability_evidence_chain | Attestor Guild · Platform Guild | `src/Attestor/StellaOps.Attestation`, `src/Attestor/StellaOps.Attestor.Envelope` | DsseEnvelopeExtensions added with conversion utilities; Envelope types exposed as transitive dependencies; consumers reference only StellaOps.Attestation. | Need attestor library API freeze | DOAL0101 | | DVOFF-64-002 | TODO | | SPRINT_160_export_evidence | DevPortal Offline Guild | docs/modules/export-center/devportal-offline.md | DevPortal Offline + AirGap Controller Guilds | Needs exporter DSSE schema from 002_ATEL0101 | DEVL0102 | | EDITOR-401-004 | TODO | | SPRINT_0401_0001_0001_reachability_evidence_chain | Docs Guild · CLI Guild | `src/Cli/StellaOps.Cli`, `docs/policy/lifecycle.md` | Gather CLI/editor alignment notes | Gather CLI/editor alignment notes | DOCL0103 | -| EMIT-15-001 | TODO | | SPRINT_136_scanner_surface | Docs Guild · Scanner Emit Guild | src/Scanner/__Libraries/StellaOps.Scanner.Emit | Need EntryTrace emit notes from SCANNER-SURFACE-04 | SCANNER-SURFACE-04 | DOEM0101 | +| EMIT-15-001 | TODO | | SPRINT_0136_0000_0001_scanner_surface | Docs Guild · Scanner Emit Guild | src/Scanner/__Libraries/StellaOps.Scanner.Emit | Need EntryTrace emit notes from SCANNER-SURFACE-04 | SCANNER-SURFACE-04 | DOEM0101 | | ENG-0001 | DONE | 2025-11-07 | SPRINT_333_docs_modules_excititor | Docs Guild · Analyzer Guild | docs/modules/excitor | Summarize excititor integration | Summarize excititor integration | DOEN0101 | | ENG-0002 | DONE | 2025-11-09 | SPRINT_137_scanner_gap_design | Docs Guild · Analyzer Guild | docs/modules/scanner | Link to analyzer doc commits | Link to analyzer doc commits | DOEN0101 | | ENG-0003 | DONE | 2025-11-09 | SPRINT_137_scanner_gap_design | Docs Guild · Analyzer Guild | docs/modules/scanner | Link to Python analyzer doc | Link to Python analyzer doc | DOEN0101 | @@ -3064,14 +3064,14 @@ | ENG-0017 | DONE | 2025-11-09 | SPRINT_0138_0000_0001_scanner_ruby_parity | Docs Guild · Analyzer Guild | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby | Analyzer doc evidence | SCANNER-ENG-0016 | DOEN0102 | | ENG-0018 | DONE | 2025-11-09 | SPRINT_0138_0000_0001_scanner_ruby_parity | Docs Guild · Analyzer Guild | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby | Analyzer doc evidence | SCANNER-ENG-0017 | DOEN0102 | | ENG-0019 | DONE | 2025-11-13 | SPRINT_0138_0000_0001_scanner_ruby_parity | Docs Guild · Analyzer Guild | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby | Analyzer doc evidence | SCANNER-ENG-0016..0018 | DOEN0102 | -| ENG-0020 | TODO | | SPRINT_136_scanner_surface | Docs Guild · Scanner Guild | docs/modules/scanner | Need surface doc context | Need surface doc context | DOEN0103 | -| ENG-0021 | TODO | | SPRINT_136_scanner_surface | Docs Guild · Scanner Guild | docs/modules/scanner | Same as #1 | Same as #1 | DOEN0103 | -| ENG-0022 | TODO | | SPRINT_136_scanner_surface | Docs Guild · Scanner Guild | docs/modules/scanner | Policy integration reference | Policy integration reference | DOEN0103 | -| ENG-0023 | TODO | | SPRINT_136_scanner_surface | Docs Guild · Scanner Guild | docs/modules/scanner | Offline kit/policy integration | Offline kit/policy integration | DOEN0103 | -| ENG-0024 | TODO | | SPRINT_136_scanner_surface | Docs Guild · Scanner Guild | docs/modules/scanner | Surface doc refresh | Surface doc refresh | DOEN0103 | -| ENG-0025 | TODO | | SPRINT_136_scanner_surface | Docs Guild · Scanner Guild | docs/modules/scanner | Surface doc refresh | Surface doc refresh | DOEN0103 | -| ENG-0026 | TODO | | SPRINT_136_scanner_surface | Docs Guild · Scanner Guild | docs/modules/scanner | Surface doc refresh | Surface doc refresh | DOEN0103 | -| ENG-0027 | TODO | | SPRINT_136_scanner_surface | Docs Guild · Scanner Guild | docs/modules/scanner | Policy/offline integration doc | Policy/offline integration doc | DOEN0103 | +| ENG-0020 | TODO | | SPRINT_0136_0000_0001_scanner_surface | Docs Guild · Scanner Guild | docs/modules/scanner | Need surface doc context | Need surface doc context | DOEN0103 | +| ENG-0021 | TODO | | SPRINT_0136_0000_0001_scanner_surface | Docs Guild · Scanner Guild | docs/modules/scanner | Same as #1 | Same as #1 | DOEN0103 | +| ENG-0022 | TODO | | SPRINT_0136_0000_0001_scanner_surface | Docs Guild · Scanner Guild | docs/modules/scanner | Policy integration reference | Policy integration reference | DOEN0103 | +| ENG-0023 | TODO | | SPRINT_0136_0000_0001_scanner_surface | Docs Guild · Scanner Guild | docs/modules/scanner | Offline kit/policy integration | Offline kit/policy integration | DOEN0103 | +| ENG-0024 | TODO | | SPRINT_0136_0000_0001_scanner_surface | Docs Guild · Scanner Guild | docs/modules/scanner | Surface doc refresh | Surface doc refresh | DOEN0103 | +| ENG-0025 | TODO | | SPRINT_0136_0000_0001_scanner_surface | Docs Guild · Scanner Guild | docs/modules/scanner | Surface doc refresh | Surface doc refresh | DOEN0103 | +| ENG-0026 | TODO | | SPRINT_0136_0000_0001_scanner_surface | Docs Guild · Scanner Guild | docs/modules/scanner | Surface doc refresh | Surface doc refresh | DOEN0103 | +| ENG-0027 | TODO | | SPRINT_0136_0000_0001_scanner_surface | Docs Guild · Scanner Guild | docs/modules/scanner | Policy/offline integration doc | Policy/offline integration doc | DOEN0103 | | ENGINE-20-002 | BLOCKED | 2025-10-26 | SPRINT_124_policy_reasoning | Docs Guild · Policy Guild | src/Policy/StellaOps.Policy.Engine | Need ADR references | Need ADR references | DOPE0101 | | ENGINE-20-003 | TODO | | SPRINT_124_policy_reasoning | Docs Guild · Policy Guild · Concelier & Excititor Guilds | src/Policy/StellaOps.Policy.Engine | Depends on #1 | POLICY-ENGINE-20-002 | DOPE0101 | | ENGINE-20-004 | TODO | | SPRINT_124_policy_reasoning | Docs Guild · Storage Guild | src/Policy/StellaOps.Policy.Engine | Needs storage notes | POLICY-ENGINE-20-003 | DOPE0101 | @@ -3084,32 +3084,32 @@ | ENGINE-27-002 | TODO | | SPRINT_124_policy_reasoning | Policy + Observability Guilds / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | POLICY-ENGINE-27-001 | POLICY-ENGINE-27-001 | DOPE0103 | | ENGINE-29-001 | TODO | | SPRINT_124_policy_reasoning | Policy Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | POLICY-ENGINE-27-004 | POLICY-ENGINE-27-004 | DOPE0103 | | ENGINE-29-002 | TODO | | SPRINT_124_policy_reasoning | Policy + Findings Ledger Guilds / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | POLICY-ENGINE-29-001 | POLICY-ENGINE-29-001 | DOPE0103 | -| ENGINE-29-003 | TODO | | SPRINT_125_policy_reasoning | Policy + SBOM Service Guilds / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | POLICY-ENGINE-29-002 | POLICY-ENGINE-29-002 | DOPE0103 | -| ENGINE-29-004 | TODO | | SPRINT_125_policy_reasoning | Policy + Observability Guilds / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | POLICY-ENGINE-29-003 | POLICY-ENGINE-29-003 | DOPE0103 | -| ENGINE-30-001 | TODO | | SPRINT_125_policy_reasoning | Policy + Cartographer Guilds / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | POLICY-ENGINE-29-004 | POLICY-ENGINE-29-004 | DOPE0103 | -| ENGINE-30-002 | TODO | | SPRINT_125_policy_reasoning | Policy + Cartographer Guilds / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | POLICY-ENGINE-30-001 | POLICY-ENGINE-30-001 | DOPE0103 | -| ENGINE-30-003 | TODO | | SPRINT_125_policy_reasoning | Policy + Scheduler Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | POLICY-ENGINE-30-002 | POLICY-ENGINE-30-002 | DOPE0103 | -| ENGINE-30-101 | TODO | | SPRINT_125_policy_reasoning | Policy Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | POLICY-ENGINE-30-003 | POLICY-ENGINE-30-003 | DOPE0103 | -| ENGINE-31-001 | TODO | | SPRINT_125_policy_reasoning | Policy Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | POLICY-ENGINE-30-101 | POLICY-ENGINE-30-101 | DOPE0104 | -| ENGINE-31-002 | TODO | | SPRINT_125_policy_reasoning | Policy Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | POLICY-ENGINE-31-001 | POLICY-ENGINE-31-001 | DOPE0104 | -| ENGINE-32-101 | TODO | | SPRINT_125_policy_reasoning | Policy Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | POLICY-ENGINE-31-002 | POLICY-ENGINE-31-002 | DOPE0104 | -| ENGINE-33-101 | TODO | | SPRINT_125_policy_reasoning | Policy Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | POLICY-ENGINE-32-101 | POLICY-ENGINE-32-101 | DOPE0104 | -| ENGINE-34-101 | TODO | | SPRINT_125_policy_reasoning | Policy Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | POLICY-ENGINE-33-101 | POLICY-ENGINE-33-101 | DOPE0104 | -| ENGINE-35-201 | TODO | | SPRINT_125_policy_reasoning | Policy Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | POLICY-ENGINE-34-101 | POLICY-ENGINE-34-101 | DOPE0104 | -| ENGINE-38-201 | TODO | | SPRINT_125_policy_reasoning | Policy Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | POLICY-ENGINE-35-201 | POLICY-ENGINE-35-201 | DOPE0104 | -| ENGINE-40-001 | TODO | | SPRINT_125_policy_reasoning | Policy + Concelier Guilds / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | POLICY-ENGINE-38-201 | POLICY-ENGINE-38-201 | DOPE0104 | -| ENGINE-40-002 | TODO | | SPRINT_125_policy_reasoning | Policy + Excititor Guilds / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | POLICY-ENGINE-40-001 | POLICY-ENGINE-40-001 | DOPE0104 | -| ENGINE-40-003 | TODO | | SPRINT_126_policy_reasoning | Policy + Web Scanner Guilds / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | POLICY-ENGINE-40-002 | POLICY-ENGINE-40-002 | DOPE0104 | +| ENGINE-29-003 | TODO | | SPRINT_0125_0000_0001_policy_reasoning | Policy + SBOM Service Guilds / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | POLICY-ENGINE-29-002 | POLICY-ENGINE-29-002 | DOPE0103 | +| ENGINE-29-004 | TODO | | SPRINT_0125_0000_0001_policy_reasoning | Policy + Observability Guilds / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | POLICY-ENGINE-29-003 | POLICY-ENGINE-29-003 | DOPE0103 | +| ENGINE-30-001 | TODO | | SPRINT_0125_0000_0001_policy_reasoning | Policy + Cartographer Guilds / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | POLICY-ENGINE-29-004 | POLICY-ENGINE-29-004 | DOPE0103 | +| ENGINE-30-002 | TODO | | SPRINT_0125_0000_0001_policy_reasoning | Policy + Cartographer Guilds / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | POLICY-ENGINE-30-001 | POLICY-ENGINE-30-001 | DOPE0103 | +| ENGINE-30-003 | TODO | | SPRINT_0125_0000_0001_policy_reasoning | Policy + Scheduler Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | POLICY-ENGINE-30-002 | POLICY-ENGINE-30-002 | DOPE0103 | +| ENGINE-30-101 | TODO | | SPRINT_0125_0000_0001_policy_reasoning | Policy Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | POLICY-ENGINE-30-003 | POLICY-ENGINE-30-003 | DOPE0103 | +| ENGINE-31-001 | TODO | | SPRINT_0125_0000_0001_policy_reasoning | Policy Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | POLICY-ENGINE-30-101 | POLICY-ENGINE-30-101 | DOPE0104 | +| ENGINE-31-002 | TODO | | SPRINT_0125_0000_0001_policy_reasoning | Policy Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | POLICY-ENGINE-31-001 | POLICY-ENGINE-31-001 | DOPE0104 | +| ENGINE-32-101 | TODO | | SPRINT_0125_0000_0001_policy_reasoning | Policy Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | POLICY-ENGINE-31-002 | POLICY-ENGINE-31-002 | DOPE0104 | +| ENGINE-33-101 | TODO | | SPRINT_0125_0000_0001_policy_reasoning | Policy Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | POLICY-ENGINE-32-101 | POLICY-ENGINE-32-101 | DOPE0104 | +| ENGINE-34-101 | TODO | | SPRINT_0125_0000_0001_policy_reasoning | Policy Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | POLICY-ENGINE-33-101 | POLICY-ENGINE-33-101 | DOPE0104 | +| ENGINE-35-201 | TODO | | SPRINT_0125_0000_0001_policy_reasoning | Policy Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | POLICY-ENGINE-34-101 | POLICY-ENGINE-34-101 | DOPE0104 | +| ENGINE-38-201 | TODO | | SPRINT_0125_0000_0001_policy_reasoning | Policy Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | POLICY-ENGINE-35-201 | POLICY-ENGINE-35-201 | DOPE0104 | +| ENGINE-40-001 | TODO | | SPRINT_0125_0000_0001_policy_reasoning | Policy + Concelier Guilds / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | POLICY-ENGINE-38-201 | POLICY-ENGINE-38-201 | DOPE0104 | +| ENGINE-40-002 | TODO | | SPRINT_0125_0000_0001_policy_reasoning | Policy + Excititor Guilds / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | POLICY-ENGINE-40-001 | POLICY-ENGINE-40-001 | DOPE0104 | +| ENGINE-40-003 | TODO | | SPRINT_0126_0000_0001_policy_reasoning | Policy + Web Scanner Guilds / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | POLICY-ENGINE-40-002 | POLICY-ENGINE-40-002 | DOPE0104 | | ENGINE-401-003 | TODO | | SPRINT_0401_0001_0001_reachability_evidence_chain | Policy Guild (`src/Policy/StellaOps.Policy.Engine`, `docs/modules/policy/architecture.md`) | `src/Policy/StellaOps.Policy.Engine`, `docs/modules/policy/architecture.md` | Reachability/forensics appendix referencing DORC0101. | — | DOPE0105 | -| ENGINE-50-001 | TODO | | SPRINT_126_policy_reasoning | Policy + Platform Security / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | POLICY-ENGINE-40-003 | POLICY-ENGINE-40-003 | DOPE0105 | -| ENGINE-50-002 | TODO | | SPRINT_126_policy_reasoning | Policy + Runtime Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | POLICY-ENGINE-50-001 | POLICY-ENGINE-50-001 | DOPE0105 | -| ENGINE-50-003 | TODO | | SPRINT_126_policy_reasoning | Policy + Observability Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | POLICY-ENGINE-50-002 | POLICY-ENGINE-50-002 | DOPE0105 | -| ENGINE-50-004 | TODO | | SPRINT_126_policy_reasoning | Policy + Platform Events Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | POLICY-ENGINE-50-003 | POLICY-ENGINE-50-003 | DOPE0105 | -| ENGINE-50-005 | TODO | | SPRINT_126_policy_reasoning | Policy + Storage Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | POLICY-ENGINE-50-004 | POLICY-ENGINE-50-004 | DOPE0105 | -| ENGINE-50-006 | TODO | | SPRINT_126_policy_reasoning | Policy + QA Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | POLICY-ENGINE-50-005 | POLICY-ENGINE-50-005 | DOPE0105 | -| ENGINE-50-007 | TODO | | SPRINT_126_policy_reasoning | Policy + Scheduler Worker Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | POLICY-ENGINE-50-006 | POLICY-ENGINE-50-006 | DOPE0105 | -| ENGINE-60-001 | TODO | | SPRINT_126_policy_reasoning | Policy + SBOM Service Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | POLICY-ENGINE-50-007 | POLICY-ENGINE-50-007 | DOPE0105 | -| ENGINE-60-002 | TODO | | SPRINT_126_policy_reasoning | Policy + BE-Base Platform Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | POLICY-ENGINE-60-001 | POLICY-ENGINE-60-001 | DOPE0105 | +| ENGINE-50-001 | TODO | | SPRINT_0126_0000_0001_policy_reasoning | Policy + Platform Security / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | POLICY-ENGINE-40-003 | POLICY-ENGINE-40-003 | DOPE0105 | +| ENGINE-50-002 | TODO | | SPRINT_0126_0000_0001_policy_reasoning | Policy + Runtime Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | POLICY-ENGINE-50-001 | POLICY-ENGINE-50-001 | DOPE0105 | +| ENGINE-50-003 | TODO | | SPRINT_0126_0000_0001_policy_reasoning | Policy + Observability Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | POLICY-ENGINE-50-002 | POLICY-ENGINE-50-002 | DOPE0105 | +| ENGINE-50-004 | TODO | | SPRINT_0126_0000_0001_policy_reasoning | Policy + Platform Events Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | POLICY-ENGINE-50-003 | POLICY-ENGINE-50-003 | DOPE0105 | +| ENGINE-50-005 | TODO | | SPRINT_0126_0000_0001_policy_reasoning | Policy + Storage Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | POLICY-ENGINE-50-004 | POLICY-ENGINE-50-004 | DOPE0105 | +| ENGINE-50-006 | TODO | | SPRINT_0126_0000_0001_policy_reasoning | Policy + QA Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | POLICY-ENGINE-50-005 | POLICY-ENGINE-50-005 | DOPE0105 | +| ENGINE-50-007 | TODO | | SPRINT_0126_0000_0001_policy_reasoning | Policy + Scheduler Worker Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | POLICY-ENGINE-50-006 | POLICY-ENGINE-50-006 | DOPE0105 | +| ENGINE-60-001 | TODO | | SPRINT_0126_0000_0001_policy_reasoning | Policy + SBOM Service Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | POLICY-ENGINE-50-007 | POLICY-ENGINE-50-007 | DOPE0105 | +| ENGINE-60-002 | TODO | | SPRINT_0126_0000_0001_policy_reasoning | Policy + BE-Base Platform Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | POLICY-ENGINE-60-001 | POLICY-ENGINE-60-001 | DOPE0105 | | ENGINE-66-001 | DONE | 2025-11-25 | SPRINT_0129_0001_0001_policy_reasoning | Risk Engine Guild / src/RiskEngine/StellaOps.RiskEngine | src/RiskEngine/StellaOps.RiskEngine | Baseline collections + indexes doc. | — | DORG0101 | | ENGINE-66-002 | TODO | | SPRINT_0129_0001_0001_policy_reasoning | Risk Engine Guild / src/RiskEngine/StellaOps.RiskEngine | src/RiskEngine/StellaOps.RiskEngine | RISK-ENGINE-66-001 | RISK-ENGINE-66-001 | DORG0101 | | ENGINE-67-001 | DONE | 2025-11-25 | SPRINT_0129_0001_0001_policy_reasoning | Risk + Concelier Guilds / src/RiskEngine/StellaOps.RiskEngine | src/RiskEngine/StellaOps.RiskEngine | RISK-ENGINE-66-002 | RISK-ENGINE-66-002 | DORG0101 | @@ -3120,36 +3120,36 @@ | ENGINE-69-001 | TODO | | SPRINT_0129_0001_0001_policy_reasoning | Risk + Policy Studio Guild / src/RiskEngine/StellaOps.RiskEngine | src/RiskEngine/StellaOps.RiskEngine | RISK-ENGINE-68-002 | RISK-ENGINE-68-002 | DORG0101 | | ENGINE-69-002 | TODO | | SPRINT_0129_0001_0001_policy_reasoning | Risk + Observability Guild / src/RiskEngine/StellaOps.RiskEngine | src/RiskEngine/StellaOps.RiskEngine | RISK-ENGINE-69-001 | RISK-ENGINE-69-001 | DORG0101 | | ENGINE-70-001 | TODO | | SPRINT_0129_0001_0001_policy_reasoning | Risk + Export Guild / src/RiskEngine/StellaOps.RiskEngine | src/RiskEngine/StellaOps.RiskEngine | RISK-ENGINE-69-002 | RISK-ENGINE-69-002 | DORG0101 | -| ENGINE-70-002 | TODO | | SPRINT_126_policy_reasoning | Policy + Storage Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | POLICY-ENGINE-60-002 | POLICY-ENGINE-60-002 | DOPE0106 | -| ENGINE-70-003 | TODO | | SPRINT_126_policy_reasoning | Policy + Runtime Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | POLICY-ENGINE-70-002 | POLICY-ENGINE-70-002 | DOPE0106 | -| ENGINE-70-004 | TODO | | SPRINT_126_policy_reasoning | Policy + Observability Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | POLICY-ENGINE-70-003 | POLICY-ENGINE-70-003 | DOPE0106 | -| ENGINE-70-005 | TODO | | SPRINT_126_policy_reasoning | Policy + Scheduler Worker Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | POLICY-ENGINE-70-004 | POLICY-ENGINE-70-004 | DOPE0106 | -| ENGINE-80-001 | TODO | | SPRINT_126_policy_reasoning | Policy + Signals Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | POLICY-ENGINE-70-005 | POLICY-ENGINE-70-005 | DOPE0106 | -| ENGINE-80-002 | TODO | | SPRINT_127_policy_reasoning | Policy + Storage Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | POLICY-ENGINE-80-001 | POLICY-ENGINE-80-001 | DOPE0106 | -| ENGINE-80-003 | TODO | | SPRINT_127_policy_reasoning | Policy + Policy Editor Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | POLICY-ENGINE-80-002 | POLICY-ENGINE-80-002 | DOPE0106 | -| ENGINE-80-004 | TODO | | SPRINT_127_policy_reasoning | Policy + Observability Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | POLICY-ENGINE-80-003 | POLICY-ENGINE-80-003 | DOPE0106 | +| ENGINE-70-002 | TODO | | SPRINT_0126_0000_0001_policy_reasoning | Policy + Storage Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | POLICY-ENGINE-60-002 | POLICY-ENGINE-60-002 | DOPE0106 | +| ENGINE-70-003 | TODO | | SPRINT_0126_0000_0001_policy_reasoning | Policy + Runtime Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | POLICY-ENGINE-70-002 | POLICY-ENGINE-70-002 | DOPE0106 | +| ENGINE-70-004 | TODO | | SPRINT_0126_0000_0001_policy_reasoning | Policy + Observability Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | POLICY-ENGINE-70-003 | POLICY-ENGINE-70-003 | DOPE0106 | +| ENGINE-70-005 | TODO | | SPRINT_0126_0000_0001_policy_reasoning | Policy + Scheduler Worker Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | POLICY-ENGINE-70-004 | POLICY-ENGINE-70-004 | DOPE0106 | +| ENGINE-80-001 | TODO | | SPRINT_0126_0000_0001_policy_reasoning | Policy + Signals Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | POLICY-ENGINE-70-005 | POLICY-ENGINE-70-005 | DOPE0106 | +| ENGINE-80-002 | TODO | | SPRINT_0127_0000_0001_policy_reasoning | Policy + Storage Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | POLICY-ENGINE-80-001 | POLICY-ENGINE-80-001 | DOPE0106 | +| ENGINE-80-003 | TODO | | SPRINT_0127_0000_0001_policy_reasoning | Policy + Policy Editor Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | POLICY-ENGINE-80-002 | POLICY-ENGINE-80-002 | DOPE0106 | +| ENGINE-80-004 | TODO | | SPRINT_0127_0000_0001_policy_reasoning | Policy + Observability Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | POLICY-ENGINE-80-003 | POLICY-ENGINE-80-003 | DOPE0106 | | ENGINE-DOCS-0001 | TODO | | SPRINT_0325_0001_0001_docs_modules_policy | Docs Guild (docs/modules/policy) | docs/modules/policy | Refresh module overview + governance ladder. | — | DOPE0107 | | ENGINE-ENG-0001 | TODO | | SPRINT_0325_0001_0001_docs_modules_policy | Module Team (docs/modules/policy) | docs/modules/policy | Capture engineering guidelines + acceptance tests. | — | DOPE0107 | | ENGINE-OPS-0001 | TODO | | SPRINT_0325_0001_0001_docs_modules_policy | Ops Guild (docs/modules/policy) | docs/modules/policy | Operations runbook (deploy/rollback) pointer. | — | DOPE0107 | -| ENTROPY-186-011 | TODO | | SPRINT_186_record_deterministic_execution | Scanner Guild · Provenance Guild | `src/Scanner/StellaOps.Scanner.Worker`, `src/Scanner/__Libraries` | SCANNER-ENTRYTRACE-18-508 | SCANNER-ENTRYTRACE-18-508 | SCDE0101 | -| ENTROPY-186-012 | TODO | | SPRINT_186_record_deterministic_execution | Scanner Guild · Provenance Guild | `src/Scanner/StellaOps.Scanner.WebService`, `docs/replay/DETERMINISTIC_REPLAY.md` | ENTROPY-186-011 | ENTROPY-186-011 | SCDE0102 | +| ENTROPY-186-011 | TODO | | SPRINT_0186_0000_0001_record_deterministic_execution | Scanner Guild · Provenance Guild | `src/Scanner/StellaOps.Scanner.Worker`, `src/Scanner/__Libraries` | SCANNER-ENTRYTRACE-18-508 | SCANNER-ENTRYTRACE-18-508 | SCDE0101 | +| ENTROPY-186-012 | TODO | | SPRINT_0186_0000_0001_record_deterministic_execution | Scanner Guild · Provenance Guild | `src/Scanner/StellaOps.Scanner.WebService`, `docs/replay/DETERMINISTIC_REPLAY.md` | ENTROPY-186-011 | ENTROPY-186-011 | SCDE0102 | | ENTROPY-70-004 | TODO | | SPRINT_0304_0001_0004_docs_tasks_md_iv | Docs Guild · Scanner Guild | docs/modules/scanner/determinism.md | ENTROPY-186-011/012 | ENTROPY-186-011/012 | DOSC0102 | -| ENTRYTRACE-18-502 | TODO | | SPRINT_135_scanner_surface | EntryTrace Guild · Scanner Surface Guild | src/Scanner/__Libraries/StellaOps.Scanner.EntryTrace | SCANNER-ENTRYTRACE-18-508 | SCANNER-ENTRYTRACE-18-508 | SCET0101 | -| ENTRYTRACE-18-503 | TODO | | SPRINT_135_scanner_surface | EntryTrace Guild · Scanner Surface Guild | src/Scanner/__Libraries/StellaOps.Scanner.EntryTrace | ENTRYTRACE-18-502 | ENTRYTRACE-18-502 | SCET0101 | -| ENTRYTRACE-18-504 | TODO | | SPRINT_136_scanner_surface | EntryTrace Guild (src/Scanner/__Libraries/StellaOps.Scanner.EntryTrace) | src/Scanner/__Libraries/StellaOps.Scanner.EntryTrace | SCANNER-ENTRYTRACE-18-503 | SCANNER-ENTRYTRACE-18-503 | SCSS0102 | -| ENTRYTRACE-18-505 | TODO | | SPRINT_136_scanner_surface | EntryTrace Guild (src/Scanner/__Libraries/StellaOps.Scanner.EntryTrace) | src/Scanner/__Libraries/StellaOps.Scanner.EntryTrace | SCANNER-ENTRYTRACE-18-504 | SCANNER-ENTRYTRACE-18-504 | SCSS0102 | -| ENTRYTRACE-18-506 | TODO | | SPRINT_136_scanner_surface | EntryTrace Guild · Scanner WebService Guild | src/Scanner/__Libraries/StellaOps.Scanner.EntryTrace | ENTRYTRACE-18-505 | ENTRYTRACE-18-505 | SCET0101 | -| ENV-01 | DONE | 2025-11-13 | SPRINT_136_scanner_surface | Scanner Guild, Zastava Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.Env) | src/Scanner/__Libraries/StellaOps.Scanner.Surface.Env | | | SCEN0101 | -| ENV-02 | DOING (2025-11-02) | 2025-11-02 | SPRINT_136_scanner_surface | Scanner Guild · Zastava Guild | src/Scanner/__Libraries/StellaOps.Scanner.Surface.Env | SURFACE-ENV-01 | SURFACE-ENV-01 | SCEN0101 | -| ENV-03 | TODO | | SPRINT_136_scanner_surface | BuildX Plugin Guild | src/Scanner/StellaOps.Scanner.Sbomer.BuildXPlugin | SCANNER-ENV-02 | SCANNER-ENV-02 | SCBX0101 | -| ENV-04 | TODO | | SPRINT_136_scanner_surface | Zastava Guild · Scanner Env Guild | src/Scanner/__Libraries/StellaOps.Scanner.Surface.Env | SURFACE-ENV-02 | SURFACE-ENV-02 | SCEN0101 | -| ENV-05 | TODO | | SPRINT_136_scanner_surface | Ops Guild · Scanner Env Guild | src/Scanner/__Libraries/StellaOps.Scanner.Surface.Env | SURFACE-ENV-03 & SURFACE-ENV-04 | SURFACE-ENV-03; SURFACE-ENV-04 | SCEN0101 | -| EVENTS-16-301 | BLOCKED (2025-10-26) | 2025-10-26 | SPRINT_136_scanner_surface | Scanner WebService Guild (`src/Scanner/StellaOps.Scanner.WebService`) | src/Scanner/StellaOps.Scanner.WebService | SCDE0102 landing | SCDE0102 landing | SCEV0101 | +| ENTRYTRACE-18-502 | TODO | | SPRINT_0135_0000_0001_scanner_surface | EntryTrace Guild · Scanner Surface Guild | src/Scanner/__Libraries/StellaOps.Scanner.EntryTrace | SCANNER-ENTRYTRACE-18-508 | SCANNER-ENTRYTRACE-18-508 | SCET0101 | +| ENTRYTRACE-18-503 | TODO | | SPRINT_0135_0000_0001_scanner_surface | EntryTrace Guild · Scanner Surface Guild | src/Scanner/__Libraries/StellaOps.Scanner.EntryTrace | ENTRYTRACE-18-502 | ENTRYTRACE-18-502 | SCET0101 | +| ENTRYTRACE-18-504 | TODO | | SPRINT_0136_0000_0001_scanner_surface | EntryTrace Guild (src/Scanner/__Libraries/StellaOps.Scanner.EntryTrace) | src/Scanner/__Libraries/StellaOps.Scanner.EntryTrace | SCANNER-ENTRYTRACE-18-503 | SCANNER-ENTRYTRACE-18-503 | SCSS0102 | +| ENTRYTRACE-18-505 | TODO | | SPRINT_0136_0000_0001_scanner_surface | EntryTrace Guild (src/Scanner/__Libraries/StellaOps.Scanner.EntryTrace) | src/Scanner/__Libraries/StellaOps.Scanner.EntryTrace | SCANNER-ENTRYTRACE-18-504 | SCANNER-ENTRYTRACE-18-504 | SCSS0102 | +| ENTRYTRACE-18-506 | TODO | | SPRINT_0136_0000_0001_scanner_surface | EntryTrace Guild · Scanner WebService Guild | src/Scanner/__Libraries/StellaOps.Scanner.EntryTrace | ENTRYTRACE-18-505 | ENTRYTRACE-18-505 | SCET0101 | +| ENV-01 | DONE | 2025-11-13 | SPRINT_0136_0000_0001_scanner_surface | Scanner Guild, Zastava Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.Env) | src/Scanner/__Libraries/StellaOps.Scanner.Surface.Env | | | SCEN0101 | +| ENV-02 | DOING (2025-11-02) | 2025-11-02 | SPRINT_0136_0000_0001_scanner_surface | Scanner Guild · Zastava Guild | src/Scanner/__Libraries/StellaOps.Scanner.Surface.Env | SURFACE-ENV-01 | SURFACE-ENV-01 | SCEN0101 | +| ENV-03 | TODO | | SPRINT_0136_0000_0001_scanner_surface | BuildX Plugin Guild | src/Scanner/StellaOps.Scanner.Sbomer.BuildXPlugin | SCANNER-ENV-02 | SCANNER-ENV-02 | SCBX0101 | +| ENV-04 | TODO | | SPRINT_0136_0000_0001_scanner_surface | Zastava Guild · Scanner Env Guild | src/Scanner/__Libraries/StellaOps.Scanner.Surface.Env | SURFACE-ENV-02 | SURFACE-ENV-02 | SCEN0101 | +| ENV-05 | TODO | | SPRINT_0136_0000_0001_scanner_surface | Ops Guild · Scanner Env Guild | src/Scanner/__Libraries/StellaOps.Scanner.Surface.Env | SURFACE-ENV-03 & SURFACE-ENV-04 | SURFACE-ENV-03; SURFACE-ENV-04 | SCEN0101 | +| EVENTS-16-301 | BLOCKED (2025-10-26) | 2025-10-26 | SPRINT_0136_0000_0001_scanner_surface | Scanner WebService Guild (`src/Scanner/StellaOps.Scanner.WebService`) | src/Scanner/StellaOps.Scanner.WebService | SCDE0102 landing | SCDE0102 landing | SCEV0101 | | EVID-CRYPTO-90-001 | TODO | | SPRINT_160_export_evidence | Evidence Locker + Security Guilds (`src/EvidenceLocker/StellaOps.EvidenceLocker`) | src/EvidenceLocker/StellaOps.EvidenceLocker | Evidence Locker + Security Guilds · `ICryptoProviderRegistry` integration | ATEL0101 contracts | EVEC0101 | | EVID-OBS-54-002 | TODO | | SPRINT_161_evidencelocker | Evidence Locker Guild (`src/EvidenceLocker/StellaOps.EvidenceLocker`) | `src/EvidenceLocker/StellaOps.EvidenceLocker` | Finalize deterministic bundle packaging + DSSE layout per `docs/modules/evidence-locker/bundle-packaging.md`, ensuring parity with portable/incident modes. | EVID-CRYPTO-90-001 | EVEC0101 | | EVID-REPLAY-187-001 | TODO | | SPRINT_160_export_evidence | Evidence Locker Guild · docs/modules/evidence-locker/architecture.md | docs/modules/evidence-locker/architecture.md | Evidence Locker Guild · docs/modules/evidence-locker/architecture.md | EVID-CRYPTO-90-001 | EVEC0101 | -| EXC-25-001 | TODO | | SPRINT_202_cli_ii | DevEx/CLI Guild (`src/Cli/StellaOps.Cli`) | src/Cli/StellaOps.Cli | DOOR0102 APIs | DOOR0102 APIs | CLEX0101 | -| EXC-25-002 | TODO | | SPRINT_202_cli_ii | DevEx/CLI Guild (`src/Cli/StellaOps.Cli`) | src/Cli/StellaOps.Cli | EXC-25-001 | EXC-25-001 | CLEX0101 | +| EXC-25-001 | TODO | | SPRINT_0202_0000_0002_cli_ii | DevEx/CLI Guild (`src/Cli/StellaOps.Cli`) | src/Cli/StellaOps.Cli | DOOR0102 APIs | DOOR0102 APIs | CLEX0101 | +| EXC-25-002 | TODO | | SPRINT_0202_0000_0002_cli_ii | DevEx/CLI Guild (`src/Cli/StellaOps.Cli`) | src/Cli/StellaOps.Cli | EXC-25-001 | EXC-25-001 | CLEX0101 | | EXC-25-006 | TODO | | SPRINT_303_docs_tasks_md_iii | Docs Guild · DevEx Guild | docs/modules/excititor | CLEX0101 CLI updates | CLEX0101 CLI updates | DOEX0101 | | EXC-25-007 | TODO | | SPRINT_0304_0001_0004_docs_tasks_md_iv | Docs Guild · DevOps Guild | docs/modules/excititor | UIEX0101 console outputs | UIEX0101 console outputs | DOEX0101 | | EXCITITOR-AIAI-31-001 | DONE | 2025-11-12 | SPRINT_0119_0001_0001_excititor_i | Excititor Web/Core Guilds | src/Excititor/StellaOps.Excititor.WebService | Normalised VEX justification projections shipped. | | EXWK0101 | @@ -3165,52 +3165,52 @@ | EXCITITOR-ATTEST-01-003 | DONE | 2025-11-17 | SPRINT_0119_0001_0001_excititor_i | Excititor Guild | src/Excititor/__Libraries/StellaOps.Excititor.Core | Attestation verifier harness + diagnostics prove DSSE bundle verification without consensus logic. | EXCITITOR-AIAI-31-002; ELOCKER-CONTRACT-2001 | EXAT0101 | | EXCITITOR-ATTEST-73-001 | DONE | 2025-11-17 | SPRINT_0119_0001_0001_excititor_i | Excititor Guild | src/Excititor/__Libraries/StellaOps.Excititor.Core | Attestation payloads emitted with supplier identity, justification summary, and scope metadata for trust chaining. | EXCITITOR-ATTEST-01-003 | EXAT0101 | | EXCITITOR-ATTEST-73-002 | DONE | 2025-11-17 | SPRINT_0119_0001_0001_excititor_i | Excititor Guild | src/Excititor/__Libraries/StellaOps.Excititor.Core | APIs link attestation IDs back to observation/linkset/product tuples for provenance citations without derived verdicts. | EXCITITOR-ATTEST-73-001 | EXAT0101 | -| EXCITITOR-CONN-SUSE-01-003 | TODO | | SPRINT_120_excititor_ii | Excititor Guild (SUSE connector) | src/Excititor/__Libraries/StellaOps.Excititor.Connectors.SUSE.RancherVEXHub | DONE (2025-11-09) – Emit provider trust configuration (signer fingerprints, trust tier notes) into the raw provenance envelope so downstream VEX Lens/Policy components can weigh issuers. Connector must not apply weighting or consensus inside ingestion. | EXCITITOR-CONN-SUSE-01-002; EXCITITOR-POLICY-01-001 | EXCN0101 | +| EXCITITOR-CONN-SUSE-01-003 | TODO | | SPRINT_0120_0000_0002_excititor_ii | Excititor Guild (SUSE connector) | src/Excititor/__Libraries/StellaOps.Excititor.Connectors.SUSE.RancherVEXHub | DONE (2025-11-09) – Emit provider trust configuration (signer fingerprints, trust tier notes) into the raw provenance envelope so downstream VEX Lens/Policy components can weigh issuers. Connector must not apply weighting or consensus inside ingestion. | EXCITITOR-CONN-SUSE-01-002; EXCITITOR-POLICY-01-001 | EXCN0101 | | EXCITITOR-CONN-TRUST-01-001 | DONE | 2025-11-20 | SPRINT_0119_0001_0001_excititor_i | Excititor Guild · AirGap Guilds | src/Excititor/__Libraries/StellaOps.Excititor.Connectors* | Signer metadata loader/enricher wired for MSRC/Oracle/Ubuntu/OpenVEX connectors; env `STELLAOPS_CONNECTOR_SIGNER_METADATA_PATH`; docs + sample hash shipped. | CONCELIER-GRAPH-21-001; CONCELIER-GRAPH-21-002; ATTEST-PLAN-2001 | EXCN0101 | -| EXCITITOR-CONN-UBUNTU-01-003 | TODO | | SPRINT_120_excititor_ii | Excititor Guild (Ubuntu connector) | src/Excititor/__Libraries/StellaOps.Excititor.Connectors.Ubuntu.CSAF | DONE (2025-11-09) – Emit Ubuntu signing metadata (GPG fingerprints, issuer trust tier) inside raw provenance artifacts so downstream Policy/VEX Lens consumers can weigh issuers. Connector must remain aggregation-only with no inline weighting. | EXCITITOR-CONN-UBUNTU-01-002 | EXCN0101 | -| EXCITITOR-CONSOLE-23-001 | DONE (2025-11-23) | | SPRINT_120_excititor_ii | Excititor Guild · Docs Guild | src/Excititor/StellaOps.Excititor.WebService | Expose `/console/vex` endpoints returning grouped VEX statements per advisory/component with status chips, justification metadata, precedence trace pointers, and tenant-scoped filters for Console explorer. Dependencies: EXCITITOR-LNM-21-201, EXCITITOR-LNM-21-202. | DOCN0101 | EXCO0101 | -| EXCITITOR-CONSOLE-23-002 | DONE (2025-11-23) | | SPRINT_120_excititor_ii | Excititor Guild | src/Excititor/StellaOps.Excititor.WebService | Provide aggregated counts for VEX overrides (new, not_affected, revoked) powering Console dashboard + live status ticker; emit metrics for policy explain integration. Dependencies: EXCITITOR-CONSOLE-23-001, EXCITITOR-LNM-21-203. | EXCITITOR-CONSOLE-23-001 | EXCO0101 | -| EXCITITOR-CONSOLE-23-003 | DONE (2025-11-23) | | SPRINT_120_excititor_ii | Excititor Guild | src/Excititor/StellaOps.Excititor.WebService | Deliver rapid lookup endpoints of VEX by advisory/component for Console global search; ensure response includes provenance and precedence context; include caching and RBAC. Dependencies: EXCITITOR-CONSOLE-23-001. | EXCITITOR-CONSOLE-23-001 | EXCO0101 | -| EXCITITOR-CORE-AOC-19-002 | TODO | | SPRINT_120_excititor_ii | Excititor Core Guild | src/Excititor/__Libraries/StellaOps.Excititor.Core | Implement deterministic extraction of advisory IDs, component PURLs, and references into `linkset`, capturing reconciled-from metadata for traceability. | Link-Not-Merge schema | EXCA0101 | -| EXCITITOR-CORE-AOC-19-003 | TODO | | SPRINT_120_excititor_ii | Excititor Core Guild | src/Excititor/__Libraries/StellaOps.Excititor.Core | Enforce `(vendor, upstreamId, contentHash, tenant)` uniqueness, generate supersedes chains, and ensure append-only versioning of raw VEX documents. Dependencies: EXCITITOR-CORE-AOC-19-002. | EXCITITOR-CORE-AOC-19-002 | EXCA0101 | -| EXCITITOR-CORE-AOC-19-004 | TODO | | SPRINT_120_excititor_ii | Excititor Core Guild | src/Excititor/__Libraries/StellaOps.Excititor.Core | Excise consensus/merge/severity logic from Excititor ingestion paths, updating exports/tests to rely on Policy Engine materializations instead. Dependencies: EXCITITOR-CORE-AOC-19-003. | EXCITITOR-CORE-AOC-19-003 | EXCA0101 | -| EXCITITOR-CORE-AOC-19-013 | TODO | | SPRINT_120_excititor_ii | Excititor Core Guild | src/Excititor/__Libraries/StellaOps.Excititor.Core | Update Excititor smoke/e2e suites to seed tenant-aware Authority clients and ensure cross-tenant VEX ingestion is rejected. Dependencies: EXCITITOR-CORE-AOC-19-004. | EXCITITOR-CORE-AOC-19-004 | EXCA0101 | -| EXCITITOR-CRYPTO-90-001 | TODO | | SPRINT_124_excititor_vi | WebService + Security Guilds | src/Excititor/StellaOps.Excititor.WebService | Replace ad-hoc hashing/signing in connectors/exporters/OpenAPI discovery with `ICryptoProviderRegistry` implementations approved by security so evidence verification stays deterministic across crypto profiles. | ATEL0101 | EXWS0101 | +| EXCITITOR-CONN-UBUNTU-01-003 | TODO | | SPRINT_0120_0000_0002_excititor_ii | Excititor Guild (Ubuntu connector) | src/Excititor/__Libraries/StellaOps.Excititor.Connectors.Ubuntu.CSAF | DONE (2025-11-09) – Emit Ubuntu signing metadata (GPG fingerprints, issuer trust tier) inside raw provenance artifacts so downstream Policy/VEX Lens consumers can weigh issuers. Connector must remain aggregation-only with no inline weighting. | EXCITITOR-CONN-UBUNTU-01-002 | EXCN0101 | +| EXCITITOR-CONSOLE-23-001 | DONE (2025-11-23) | | SPRINT_0120_0000_0002_excititor_ii | Excititor Guild · Docs Guild | src/Excititor/StellaOps.Excititor.WebService | Expose `/console/vex` endpoints returning grouped VEX statements per advisory/component with status chips, justification metadata, precedence trace pointers, and tenant-scoped filters for Console explorer. Dependencies: EXCITITOR-LNM-21-201, EXCITITOR-LNM-21-202. | DOCN0101 | EXCO0101 | +| EXCITITOR-CONSOLE-23-002 | DONE (2025-11-23) | | SPRINT_0120_0000_0002_excititor_ii | Excititor Guild | src/Excititor/StellaOps.Excititor.WebService | Provide aggregated counts for VEX overrides (new, not_affected, revoked) powering Console dashboard + live status ticker; emit metrics for policy explain integration. Dependencies: EXCITITOR-CONSOLE-23-001, EXCITITOR-LNM-21-203. | EXCITITOR-CONSOLE-23-001 | EXCO0101 | +| EXCITITOR-CONSOLE-23-003 | DONE (2025-11-23) | | SPRINT_0120_0000_0002_excititor_ii | Excititor Guild | src/Excititor/StellaOps.Excititor.WebService | Deliver rapid lookup endpoints of VEX by advisory/component for Console global search; ensure response includes provenance and precedence context; include caching and RBAC. Dependencies: EXCITITOR-CONSOLE-23-001. | EXCITITOR-CONSOLE-23-001 | EXCO0101 | +| EXCITITOR-CORE-AOC-19-002 | TODO | | SPRINT_0120_0000_0002_excititor_ii | Excititor Core Guild | src/Excititor/__Libraries/StellaOps.Excititor.Core | Implement deterministic extraction of advisory IDs, component PURLs, and references into `linkset`, capturing reconciled-from metadata for traceability. | Link-Not-Merge schema | EXCA0101 | +| EXCITITOR-CORE-AOC-19-003 | TODO | | SPRINT_0120_0000_0002_excititor_ii | Excititor Core Guild | src/Excititor/__Libraries/StellaOps.Excititor.Core | Enforce `(vendor, upstreamId, contentHash, tenant)` uniqueness, generate supersedes chains, and ensure append-only versioning of raw VEX documents. Dependencies: EXCITITOR-CORE-AOC-19-002. | EXCITITOR-CORE-AOC-19-002 | EXCA0101 | +| EXCITITOR-CORE-AOC-19-004 | TODO | | SPRINT_0120_0000_0002_excititor_ii | Excititor Core Guild | src/Excititor/__Libraries/StellaOps.Excititor.Core | Excise consensus/merge/severity logic from Excititor ingestion paths, updating exports/tests to rely on Policy Engine materializations instead. Dependencies: EXCITITOR-CORE-AOC-19-003. | EXCITITOR-CORE-AOC-19-003 | EXCA0101 | +| EXCITITOR-CORE-AOC-19-013 | TODO | | SPRINT_0120_0000_0002_excititor_ii | Excititor Core Guild | src/Excititor/__Libraries/StellaOps.Excititor.Core | Update Excititor smoke/e2e suites to seed tenant-aware Authority clients and ensure cross-tenant VEX ingestion is rejected. Dependencies: EXCITITOR-CORE-AOC-19-004. | EXCITITOR-CORE-AOC-19-004 | EXCA0101 | +| EXCITITOR-CRYPTO-90-001 | TODO | | SPRINT_0124_0000_0006_excititor_vi | WebService + Security Guilds | src/Excititor/StellaOps.Excititor.WebService | Replace ad-hoc hashing/signing in connectors/exporters/OpenAPI discovery with `ICryptoProviderRegistry` implementations approved by security so evidence verification stays deterministic across crypto profiles. | ATEL0101 | EXWS0101 | | EXCITITOR-DOCS-0001 | DOING (2025-10-29) | 2025-10-29 | SPRINT_333_docs_modules_excititor | Docs Guild | docs/modules/excititor | See ./AGENTS.md | — | DOEX0102 | | EXCITITOR-ENG-0001 | TODO | | SPRINT_333_docs_modules_excititor | Module Team · Docs Guild | docs/modules/excititor | Update status via ./AGENTS.md workflow | DOEX0101 evidence | DOEX0102 | -| EXCITITOR-GRAPH-21-001 | TODO | 2025-10-27 | SPRINT_120_excititor_ii | Excititor Guild | src/Excititor/__Libraries/StellaOps.Excititor.Core | Provide batched VEX/advisory reference fetches keyed by graph node PURLs so UI inspector can display raw documents and justification metadata. | Link-Not-Merge schema | EXGR0101 | -| EXCITITOR-GRAPH-21-002 | TODO | 2025-10-27 | SPRINT_120_excititor_ii | Excititor Guild | src/Excititor/__Libraries/StellaOps.Excititor.Core | Ensure overlay metadata includes VEX justification summaries and document versions for Cartographer overlays; update fixtures/tests. Dependencies: EXCITITOR-GRAPH-21-001. | EXCITITOR-GRAPH-21-001 | EXGR0101 | -| EXCITITOR-GRAPH-21-005 | TODO | 2025-10-27 | SPRINT_120_excititor_ii | Excititor Guild | src/Excititor/__Libraries/StellaOps.Excititor.Storage.Mongo | Add indexes/materialized views for VEX lookups by PURL/policy to support Cartographer inspector performance; document migrations. Dependencies: EXCITITOR-GRAPH-21-002. | EXCITITOR-GRAPH-21-002 | EXGR0101 | -| EXCITITOR-GRAPH-24-101 | DONE (2025-11-25) | | SPRINT_120_excititor_ii | Excititor Guild | src/Excititor/StellaOps.Excititor.WebService | Provide endpoints delivering VEX status summaries per component/asset for Vuln Explorer integration. Dependencies: EXCITITOR-GRAPH-21-005. | EXCITITOR-GRAPH-21-002 | EXGR0101 | -| EXCITITOR-GRAPH-24-102 | DONE (2025-11-25) | | SPRINT_120_excititor_ii | Excititor Guild | src/Excititor/StellaOps.Excititor.WebService | Add batch VEX observation retrieval optimized for Graph overlays/tooltips. Dependencies: EXCITITOR-GRAPH-24-101. | EXCITITOR-GRAPH-24-101 | EXGR0101 | -| EXCITITOR-LNM-21-001 | TODO | | SPRINT_121_excititor_iii | Excititor Core Guild | src/Excititor/__Libraries/StellaOps.Excititor.Storage.Mongo | Stand up `vex_observations` and `vex_linksets` collections with shard keys, tenant guards, and migrations that retire any residual merge-era data without mutating raw content. | Link-Not-Merge schema | EXLN0101 | -| EXCITITOR-LNM-21-002 | TODO | | SPRINT_121_excititor_iii | Excititor Core Guild | src/Excititor/__Libraries/StellaOps.Excititor.Core | Capture disagreement metadata (status + justification deltas) directly inside linksets with confidence scores so downstream consumers can highlight conflicts without Excititor choosing winners. Depends on EXCITITOR-LNM-21-001. | EXCITITOR-LNM-21-001 | EXLN0101 | -| EXCITITOR-LNM-21-003 | TODO | | SPRINT_121_excititor_iii | Excititor Core + Platform Events Guild | src/Excititor/__Libraries/StellaOps.Excititor.Core | Emit `vex.linkset.updated` events and describe payload shape (observation ids, confidence, conflict summary) so Policy/Lens/UI can subscribe while Excititor stays aggregation-only. Depends on EXCITITOR-LNM-21-002. | EXCITITOR-LNM-21-002 | EXLN0101 | -| EXCITITOR-LNM-21-201 | DONE (2025-11-25) | | SPRINT_121_excititor_iii | Excititor WebService Guild | src/Excititor/StellaOps.Excititor.WebService | Ship `/vex/observations` read endpoints with filters for advisory/product/issuer, strict RBAC, and deterministic pagination (no derived verdict fields). Depends on EXCITITOR-LNM-21-003. | EXCITITOR-LNM-21-001 | EXLN0101 | -| EXCITITOR-LNM-21-202 | DONE (2025-11-25) | | SPRINT_121_excititor_iii | Excititor WebService Guild | src/Excititor/StellaOps.Excititor.WebService | Provide `/vex/linksets` + export endpoints that surface alias mappings, conflict markers, and provenance proofs exactly as stored; errors must map to `ERR_AGG_*`. Depends on EXCITITOR-LNM-21-201. | EXCITITOR-LNM-21-201 | EXLN0101 | -| EXCITITOR-LNM-21-203 | TODO | | SPRINT_121_excititor_iii | Excititor WebService Guild | src/Excititor/StellaOps.Excititor.WebService | Update OpenAPI, SDK smoke tests, and documentation to cover the new observation/linkset endpoints with realistic examples Advisory AI/Lens teams can rely on. Depends on EXCITITOR-LNM-21-202. | EXCITITOR-LNM-21-202 | EXLN0101 | -| EXCITITOR-OBS-51-001 | TODO | | SPRINT_121_excititor_iii | Excititor Core Guild · DevOps Guild | src/Excititor/__Libraries/StellaOps.Excititor.Core | Publish ingest latency, scope resolution success, conflict rate, and signature verification metrics plus SLO burn alerts so we can prove Excititor meets the AOC “evidence freshness” mission. | Wait for 046_TLTY0101 span schema | EXOB0101 | -| EXCITITOR-OBS-52-001 | TODO | | SPRINT_122_excititor_iv | Excititor Core Guild | src/Excititor/__Libraries/StellaOps.Excititor.Core | Emit `timeline_event` entries for every ingest/linkset change with trace IDs, justification summaries, and evidence hashes so downstream systems can replay the raw facts chronologically. Depends on EXCITITOR-OBS-51-001. | Needs #1 merged for correlation IDs | EXOB0101 | -| EXCITITOR-OBS-53-001 | TODO | | SPRINT_122_excititor_iv | Excititor Core Guild · Evidence Locker Guild | src/Excititor/__Libraries/StellaOps.Excititor.Core | Build locker payloads (raw doc, normalization diff, provenance) and Merkle manifests so sealed-mode sites can audit evidence without Excititor reinterpreting it. Depends on EXCITITOR-OBS-52-001. | Blocked on Evidence Locker DSSE hooks (002_ATEL0101) | EXOB0101 | -| EXCITITOR-OBS-54-001 | TODO | | SPRINT_122_excititor_iv | Excititor Core Guild · Provenance Guild | src/Excititor/__Libraries/StellaOps.Excititor.Core | Attach DSSE attestations to every evidence batch, verify chains via Provenance tooling, and surface attestation IDs on timeline events. Depends on EXCITITOR-OBS-53-001. | Requires provenance schema from 005_ATLN0101 | EXOB0101 | +| EXCITITOR-GRAPH-21-001 | TODO | 2025-10-27 | SPRINT_0120_0000_0002_excititor_ii | Excititor Guild | src/Excititor/__Libraries/StellaOps.Excititor.Core | Provide batched VEX/advisory reference fetches keyed by graph node PURLs so UI inspector can display raw documents and justification metadata. | Link-Not-Merge schema | EXGR0101 | +| EXCITITOR-GRAPH-21-002 | TODO | 2025-10-27 | SPRINT_0120_0000_0002_excititor_ii | Excititor Guild | src/Excititor/__Libraries/StellaOps.Excititor.Core | Ensure overlay metadata includes VEX justification summaries and document versions for Cartographer overlays; update fixtures/tests. Dependencies: EXCITITOR-GRAPH-21-001. | EXCITITOR-GRAPH-21-001 | EXGR0101 | +| EXCITITOR-GRAPH-21-005 | TODO | 2025-10-27 | SPRINT_0120_0000_0002_excititor_ii | Excititor Guild | src/Excititor/__Libraries/StellaOps.Excititor.Storage.Mongo | Add indexes/materialized views for VEX lookups by PURL/policy to support Cartographer inspector performance; document migrations. Dependencies: EXCITITOR-GRAPH-21-002. | EXCITITOR-GRAPH-21-002 | EXGR0101 | +| EXCITITOR-GRAPH-24-101 | DONE (2025-11-25) | | SPRINT_0120_0000_0002_excititor_ii | Excititor Guild | src/Excititor/StellaOps.Excititor.WebService | Provide endpoints delivering VEX status summaries per component/asset for Vuln Explorer integration. Dependencies: EXCITITOR-GRAPH-21-005. | EXCITITOR-GRAPH-21-002 | EXGR0101 | +| EXCITITOR-GRAPH-24-102 | DONE (2025-11-25) | | SPRINT_0120_0000_0002_excititor_ii | Excititor Guild | src/Excititor/StellaOps.Excititor.WebService | Add batch VEX observation retrieval optimized for Graph overlays/tooltips. Dependencies: EXCITITOR-GRAPH-24-101. | EXCITITOR-GRAPH-24-101 | EXGR0101 | +| EXCITITOR-LNM-21-001 | TODO | | SPRINT_0121_0000_0003_excititor_iii | Excititor Core Guild | src/Excititor/__Libraries/StellaOps.Excititor.Storage.Mongo | Stand up `vex_observations` and `vex_linksets` collections with shard keys, tenant guards, and migrations that retire any residual merge-era data without mutating raw content. | Link-Not-Merge schema | EXLN0101 | +| EXCITITOR-LNM-21-002 | TODO | | SPRINT_0121_0000_0003_excititor_iii | Excititor Core Guild | src/Excititor/__Libraries/StellaOps.Excititor.Core | Capture disagreement metadata (status + justification deltas) directly inside linksets with confidence scores so downstream consumers can highlight conflicts without Excititor choosing winners. Depends on EXCITITOR-LNM-21-001. | EXCITITOR-LNM-21-001 | EXLN0101 | +| EXCITITOR-LNM-21-003 | TODO | | SPRINT_0121_0000_0003_excititor_iii | Excititor Core + Platform Events Guild | src/Excititor/__Libraries/StellaOps.Excititor.Core | Emit `vex.linkset.updated` events and describe payload shape (observation ids, confidence, conflict summary) so Policy/Lens/UI can subscribe while Excititor stays aggregation-only. Depends on EXCITITOR-LNM-21-002. | EXCITITOR-LNM-21-002 | EXLN0101 | +| EXCITITOR-LNM-21-201 | DONE (2025-11-25) | | SPRINT_0121_0000_0003_excititor_iii | Excititor WebService Guild | src/Excititor/StellaOps.Excititor.WebService | Ship `/vex/observations` read endpoints with filters for advisory/product/issuer, strict RBAC, and deterministic pagination (no derived verdict fields). Depends on EXCITITOR-LNM-21-003. | EXCITITOR-LNM-21-001 | EXLN0101 | +| EXCITITOR-LNM-21-202 | DONE (2025-11-25) | | SPRINT_0121_0000_0003_excititor_iii | Excititor WebService Guild | src/Excititor/StellaOps.Excititor.WebService | Provide `/vex/linksets` + export endpoints that surface alias mappings, conflict markers, and provenance proofs exactly as stored; errors must map to `ERR_AGG_*`. Depends on EXCITITOR-LNM-21-201. | EXCITITOR-LNM-21-201 | EXLN0101 | +| EXCITITOR-LNM-21-203 | TODO | | SPRINT_0121_0000_0003_excititor_iii | Excititor WebService Guild | src/Excititor/StellaOps.Excititor.WebService | Update OpenAPI, SDK smoke tests, and documentation to cover the new observation/linkset endpoints with realistic examples Advisory AI/Lens teams can rely on. Depends on EXCITITOR-LNM-21-202. | EXCITITOR-LNM-21-202 | EXLN0101 | +| EXCITITOR-OBS-51-001 | TODO | | SPRINT_0121_0000_0003_excititor_iii | Excititor Core Guild · DevOps Guild | src/Excititor/__Libraries/StellaOps.Excititor.Core | Publish ingest latency, scope resolution success, conflict rate, and signature verification metrics plus SLO burn alerts so we can prove Excititor meets the AOC “evidence freshness” mission. | Wait for 046_TLTY0101 span schema | EXOB0101 | +| EXCITITOR-OBS-52-001 | TODO | | SPRINT_0122_0000_0004_excititor_iv | Excititor Core Guild | src/Excititor/__Libraries/StellaOps.Excititor.Core | Emit `timeline_event` entries for every ingest/linkset change with trace IDs, justification summaries, and evidence hashes so downstream systems can replay the raw facts chronologically. Depends on EXCITITOR-OBS-51-001. | Needs #1 merged for correlation IDs | EXOB0101 | +| EXCITITOR-OBS-53-001 | TODO | | SPRINT_0122_0000_0004_excititor_iv | Excititor Core Guild · Evidence Locker Guild | src/Excititor/__Libraries/StellaOps.Excititor.Core | Build locker payloads (raw doc, normalization diff, provenance) and Merkle manifests so sealed-mode sites can audit evidence without Excititor reinterpreting it. Depends on EXCITITOR-OBS-52-001. | Blocked on Evidence Locker DSSE hooks (002_ATEL0101) | EXOB0101 | +| EXCITITOR-OBS-54-001 | TODO | | SPRINT_0122_0000_0004_excititor_iv | Excititor Core Guild · Provenance Guild | src/Excititor/__Libraries/StellaOps.Excititor.Core | Attach DSSE attestations to every evidence batch, verify chains via Provenance tooling, and surface attestation IDs on timeline events. Depends on EXCITITOR-OBS-53-001. | Requires provenance schema from 005_ATLN0101 | EXOB0101 | | EXCITITOR-OPS-0001 | TODO | | SPRINT_333_docs_modules_excititor | Ops Guild · Docs Guild | docs/modules/excititor | Sync outcomes back to ../.. | DOEX0101 runbooks | DOEX0102 | -| EXCITITOR-ORCH-32-001 | TODO | | SPRINT_122_excititor_iv | Excititor Worker Guild (`src/Excititor/StellaOps.Excititor.Worker`) | src/Excititor/StellaOps.Excititor.Worker | Adopt the orchestrator worker SDK for Excititor jobs, emitting heartbeats/progress/artifact hashes so ingestion remains deterministic and restartable without reprocessing evidence. | DOOR0102 APIs | EXWS0101 | -| EXCITITOR-ORCH-33-001 | TODO | | SPRINT_122_excititor_iv | Excititor Worker Guild (`src/Excititor/StellaOps.Excititor.Worker`) | src/Excititor/StellaOps.Excititor.Worker | Honor orchestrator pause/throttle/retry commands, persist checkpoints, and classify error outputs to keep ingestion safe under outages. Depends on EXCITITOR-ORCH-32-001. | EXCITITOR-ORCH-32-001 | EXWS0101 | -| EXCITITOR-POLICY-20-001 | TODO | | SPRINT_122_excititor_iv | WebService Guild | src/Excititor/StellaOps.Excititor.WebService | Provide VEX lookup APIs (PURL/advisory batching, scope filters, tenant enforcement) that Policy Engine uses to join evidence without Excititor performing any verdict logic. Depends on EXCITITOR-AOC-20-004. | DOLN0101 | EXWS0101 | -| EXCITITOR-POLICY-20-002 | TODO | | SPRINT_122_excititor_iv | Excititor Core Guild (src/Excititor/__Libraries/StellaOps.Excititor.Core) | src/Excititor/__Libraries/StellaOps.Excititor.Core | Enhance linksets with scope resolution + version range metadata so Policy/Reachability can reason about applicability while Excititor continues to report only raw context. Depends on EXCITITOR-POLICY-20-001. | | EXWK0101 | -| EXCITITOR-RISK-66-001 | TODO | | SPRINT_122_excititor_iv | Excititor Core Guild · Risk Engine Guild (`src/Excititor/__Libraries/StellaOps.Excititor.Core`) | src/Excititor/__Libraries/StellaOps.Excititor.Core | Publish risk-engine ready feeds (status, justification, provenance) with zero derived severity so gating services can reference Excititor as a source of truth. Depends on EXCITITOR-POLICY-20-002. | CONCELIER-GRAPH-21-001/002 | EXRS0101 | -| EXCITITOR-STORE-AOC-19-001 | TODO | | SPRINT_123_excititor_v | Storage Guild (`src/Excititor/__Libraries/StellaOps.Excititor.Storage.Mongo`) | src/Excititor/__Libraries/StellaOps.Excititor.Storage.Mongo | Ship Mongo JSON Schema + validator tooling (including Offline Kit instructions) so operators can prove Excititor stores only immutable evidence. | Link-Not-Merge schema | EXSM0101 | -| EXCITITOR-STORE-AOC-19-002 | TODO | | SPRINT_123_excititor_v | Storage + DevOps Guilds (`src/Excititor/__Libraries/StellaOps.Excititor.Storage.Mongo`) | src/Excititor/__Libraries/StellaOps.Excititor.Storage.Mongo | Create unique indexes, run migrations/backfills, and document rollback steps for the new schema validator. Depends on EXCITITOR-STORE-AOC-19-001. | STORE-AOC-19-001 | EXSM0101 | -| EXCITITOR-VEXLENS-30-001 | TODO | | SPRINT_123_excititor_v | Excititor WebService Guild · VEX Lens Guild | src/Excititor/StellaOps.Excititor.WebService | Ensure every observation exported to VEX Lens carries issuer hints, signature blobs, product tree snippets, and staleness metadata so the lens can compute consensus without calling back into Excititor. | — | PLVL0103 | -| EXCITITOR-VULN-29-001 | TODO | | SPRINT_123_excititor_v | Excititor WebService Guild (`src/Excititor/StellaOps.Excititor.WebService`) | src/Excititor/StellaOps.Excititor.WebService | Canonicalize advisory/product keys (map to `advisory_key`, capture scope metadata) while preserving original identifiers in `links[]`; run backfill + regression tests. | EXWS0101 | EXVN0101 | -| EXCITITOR-VULN-29-002 | TODO | | SPRINT_123_excititor_v | Excititor WebService Guild | src/Excititor/StellaOps.Excititor.WebService | Provide `/vuln/evidence/vex/{advisory_key}` returning tenant-scoped raw statements, provenance, and attestation references for Vuln Explorer evidence tabs. Depends on EXCITITOR-VULN-29-001. | EXCITITOR-VULN-29-001 | EXVN0101 | -| EXCITITOR-VULN-29-004 | TODO | | SPRINT_123_excititor_v | Excititor WebService + Observability Guilds | src/Excititor/StellaOps.Excititor.WebService | Add metrics/logs for normalization errors, suppression scopes, withdrawn statements, and feed them to Vuln Explorer + Advisory AI dashboards. Depends on EXCITITOR-VULN-29-002. | EXCITITOR-VULN-29-001 | EXVN0101 | -| EXCITITOR-WEB-AIRGAP-58-001 | TODO | | SPRINT_124_excititor_vi | WebService Guild · AirGap Guilds | src/Excititor/StellaOps.Excititor.WebService | Emit timeline events + audit logs for mirror bundle imports (bundle ID, scope, actor) and map sealed-mode violations to actionable remediation guidance. | EXAG0101 | EXWS0101 | -| EXCITITOR-WEB-OAS-61-001 | TODO | | SPRINT_124_excititor_vi | WebService Guild | src/Excititor/StellaOps.Excititor.WebService | Implement `/.well-known/openapi` with spec version metadata plus standard error envelopes, then update controller/unit tests accordingly. | DOOR0102 | EXWS0101 | -| EXCITITOR-WEB-OAS-62-001 | TODO | | SPRINT_124_excititor_vi | WebService Guild · API Governance | src/Excititor/StellaOps.Excititor.WebService | Publish curated examples for the new evidence/attestation/timeline endpoints, emit deprecation headers for legacy routes, and align SDK docs. Depends on EXCITITOR-WEB-OAS-61-001. | EXCITITOR-WEB-OAS-61-001 | EXWS0101 | -| EXCITITOR-WEB-OBS-52-001 | TODO | | SPRINT_124_excititor_vi | Excititor WebService Guild | src/Excititor/StellaOps.Excititor.WebService | Provide SSE/WebSocket bridges for VEX timeline events with tenant filters, pagination anchors, and guardrails so downstream consoles can monitor raw evidence changes in real time. Depends on EXCITITOR-OBS-52-001. | Wait for 046_TLTY0101 span schema | EXOB0102 | -| EXCITITOR-WEB-OBS-53-001 | TODO | | SPRINT_124_excititor_vi | Excititor WebService Guild · Evidence Locker Guild | src/Excititor/StellaOps.Excititor.WebService | Expose `/evidence/vex/*` endpoints that fetch locker bundles, enforce scopes, and surface verification metadata without synthesizing verdicts. Depends on EXCITITOR-WEB-OBS-52-001. | Requires Evidence Locker DSSE API (002_ATEL0101) | EXOB0102 | -| EXCITITOR-WEB-OBS-54-001 | TODO | | SPRINT_124_excititor_vi | Excititor WebService Guild | src/Excititor/StellaOps.Excititor.WebService | Add `/attestations/vex/*` endpoints returning DSSE verification state, builder identity, and chain-of-custody links so consumers never need direct datastore access. Depends on EXCITITOR-WEB-OBS-53-001. | Dependent on provenance schema (005_ATLN0101) | EXOB0102 | +| EXCITITOR-ORCH-32-001 | TODO | | SPRINT_0122_0000_0004_excititor_iv | Excititor Worker Guild (`src/Excititor/StellaOps.Excititor.Worker`) | src/Excititor/StellaOps.Excititor.Worker | Adopt the orchestrator worker SDK for Excititor jobs, emitting heartbeats/progress/artifact hashes so ingestion remains deterministic and restartable without reprocessing evidence. | DOOR0102 APIs | EXWS0101 | +| EXCITITOR-ORCH-33-001 | TODO | | SPRINT_0122_0000_0004_excititor_iv | Excititor Worker Guild (`src/Excititor/StellaOps.Excititor.Worker`) | src/Excititor/StellaOps.Excititor.Worker | Honor orchestrator pause/throttle/retry commands, persist checkpoints, and classify error outputs to keep ingestion safe under outages. Depends on EXCITITOR-ORCH-32-001. | EXCITITOR-ORCH-32-001 | EXWS0101 | +| EXCITITOR-POLICY-20-001 | TODO | | SPRINT_0122_0000_0004_excititor_iv | WebService Guild | src/Excititor/StellaOps.Excititor.WebService | Provide VEX lookup APIs (PURL/advisory batching, scope filters, tenant enforcement) that Policy Engine uses to join evidence without Excititor performing any verdict logic. Depends on EXCITITOR-AOC-20-004. | DOLN0101 | EXWS0101 | +| EXCITITOR-POLICY-20-002 | TODO | | SPRINT_0122_0000_0004_excititor_iv | Excititor Core Guild (src/Excititor/__Libraries/StellaOps.Excititor.Core) | src/Excititor/__Libraries/StellaOps.Excititor.Core | Enhance linksets with scope resolution + version range metadata so Policy/Reachability can reason about applicability while Excititor continues to report only raw context. Depends on EXCITITOR-POLICY-20-001. | | EXWK0101 | +| EXCITITOR-RISK-66-001 | TODO | | SPRINT_0122_0000_0004_excititor_iv | Excititor Core Guild · Risk Engine Guild (`src/Excititor/__Libraries/StellaOps.Excititor.Core`) | src/Excititor/__Libraries/StellaOps.Excititor.Core | Publish risk-engine ready feeds (status, justification, provenance) with zero derived severity so gating services can reference Excititor as a source of truth. Depends on EXCITITOR-POLICY-20-002. | CONCELIER-GRAPH-21-001/002 | EXRS0101 | +| EXCITITOR-STORE-AOC-19-001 | TODO | | SPRINT_0123_0000_0005_excititor_v | Storage Guild (`src/Excititor/__Libraries/StellaOps.Excititor.Storage.Mongo`) | src/Excititor/__Libraries/StellaOps.Excititor.Storage.Mongo | Ship Mongo JSON Schema + validator tooling (including Offline Kit instructions) so operators can prove Excititor stores only immutable evidence. | Link-Not-Merge schema | EXSM0101 | +| EXCITITOR-STORE-AOC-19-002 | TODO | | SPRINT_0123_0000_0005_excititor_v | Storage + DevOps Guilds (`src/Excititor/__Libraries/StellaOps.Excititor.Storage.Mongo`) | src/Excititor/__Libraries/StellaOps.Excititor.Storage.Mongo | Create unique indexes, run migrations/backfills, and document rollback steps for the new schema validator. Depends on EXCITITOR-STORE-AOC-19-001. | STORE-AOC-19-001 | EXSM0101 | +| EXCITITOR-VEXLENS-30-001 | TODO | | SPRINT_0123_0000_0005_excititor_v | Excititor WebService Guild · VEX Lens Guild | src/Excititor/StellaOps.Excititor.WebService | Ensure every observation exported to VEX Lens carries issuer hints, signature blobs, product tree snippets, and staleness metadata so the lens can compute consensus without calling back into Excititor. | — | PLVL0103 | +| EXCITITOR-VULN-29-001 | TODO | | SPRINT_0123_0000_0005_excititor_v | Excititor WebService Guild (`src/Excititor/StellaOps.Excititor.WebService`) | src/Excititor/StellaOps.Excititor.WebService | Canonicalize advisory/product keys (map to `advisory_key`, capture scope metadata) while preserving original identifiers in `links[]`; run backfill + regression tests. | EXWS0101 | EXVN0101 | +| EXCITITOR-VULN-29-002 | TODO | | SPRINT_0123_0000_0005_excititor_v | Excititor WebService Guild | src/Excititor/StellaOps.Excititor.WebService | Provide `/vuln/evidence/vex/{advisory_key}` returning tenant-scoped raw statements, provenance, and attestation references for Vuln Explorer evidence tabs. Depends on EXCITITOR-VULN-29-001. | EXCITITOR-VULN-29-001 | EXVN0101 | +| EXCITITOR-VULN-29-004 | TODO | | SPRINT_0123_0000_0005_excititor_v | Excititor WebService + Observability Guilds | src/Excititor/StellaOps.Excititor.WebService | Add metrics/logs for normalization errors, suppression scopes, withdrawn statements, and feed them to Vuln Explorer + Advisory AI dashboards. Depends on EXCITITOR-VULN-29-002. | EXCITITOR-VULN-29-001 | EXVN0101 | +| EXCITITOR-WEB-AIRGAP-58-001 | TODO | | SPRINT_0124_0000_0006_excititor_vi | WebService Guild · AirGap Guilds | src/Excititor/StellaOps.Excititor.WebService | Emit timeline events + audit logs for mirror bundle imports (bundle ID, scope, actor) and map sealed-mode violations to actionable remediation guidance. | EXAG0101 | EXWS0101 | +| EXCITITOR-WEB-OAS-61-001 | TODO | | SPRINT_0124_0000_0006_excititor_vi | WebService Guild | src/Excititor/StellaOps.Excititor.WebService | Implement `/.well-known/openapi` with spec version metadata plus standard error envelopes, then update controller/unit tests accordingly. | DOOR0102 | EXWS0101 | +| EXCITITOR-WEB-OAS-62-001 | TODO | | SPRINT_0124_0000_0006_excititor_vi | WebService Guild · API Governance | src/Excititor/StellaOps.Excititor.WebService | Publish curated examples for the new evidence/attestation/timeline endpoints, emit deprecation headers for legacy routes, and align SDK docs. Depends on EXCITITOR-WEB-OAS-61-001. | EXCITITOR-WEB-OAS-61-001 | EXWS0101 | +| EXCITITOR-WEB-OBS-52-001 | TODO | | SPRINT_0124_0000_0006_excititor_vi | Excititor WebService Guild | src/Excititor/StellaOps.Excititor.WebService | Provide SSE/WebSocket bridges for VEX timeline events with tenant filters, pagination anchors, and guardrails so downstream consoles can monitor raw evidence changes in real time. Depends on EXCITITOR-OBS-52-001. | Wait for 046_TLTY0101 span schema | EXOB0102 | +| EXCITITOR-WEB-OBS-53-001 | TODO | | SPRINT_0124_0000_0006_excititor_vi | Excititor WebService Guild · Evidence Locker Guild | src/Excititor/StellaOps.Excititor.WebService | Expose `/evidence/vex/*` endpoints that fetch locker bundles, enforce scopes, and surface verification metadata without synthesizing verdicts. Depends on EXCITITOR-WEB-OBS-52-001. | Requires Evidence Locker DSSE API (002_ATEL0101) | EXOB0102 | +| EXCITITOR-WEB-OBS-54-001 | TODO | | SPRINT_0124_0000_0006_excititor_vi | Excititor WebService Guild | src/Excititor/StellaOps.Excititor.WebService | Add `/attestations/vex/*` endpoints returning DSSE verification state, builder identity, and chain-of-custody links so consumers never need direct datastore access. Depends on EXCITITOR-WEB-OBS-53-001. | Dependent on provenance schema (005_ATLN0101) | EXOB0102 | | EXCITOR-DOCS-0001 | DONE | 2025-11-07 | SPRINT_333_docs_modules_excititor | Docs Guild (docs/modules/excitor) | docs/modules/excitor | Validate that `docs/modules/excitor/README.md` matches the latest release notes and consensus beta notes. | | DOXR0101 | | EXCITOR-ENG-0001 | DONE | 2025-11-07 | SPRINT_333_docs_modules_excititor | Module Team (docs/modules/excitor) | docs/modules/excitor | Ensure the implementation plan sprint alignment table stays current with `SPRINT_200` updates. | | DOXR0101 | | EXCITOR-OPS-0001 | DONE | 2025-11-07 | SPRINT_333_docs_modules_excititor | Ops Guild (docs/modules/excitor) | docs/modules/excitor | Review runbooks/observability assets, adding the checklist captured in `docs/modules/excitor/mirrors.md`. | | DOXR0101 | @@ -3218,8 +3218,8 @@ | EXPLORER-ENG-0001 | TODO | | SPRINT_334_docs_modules_vuln_explorer | Explorer Module Team | docs/modules/vuln-explorer | DOVL0102 | DOVL0102 | DOXR0101 | | EXPLORER-OPS-0001 | TODO | | SPRINT_334_docs_modules_vuln_explorer | Ops Guild | docs/modules/vuln-explorer | Explorer Ops runbooks | Explorer Ops runbooks | DOXR0101 | | EXPORT-35-001 | TODO | | SPRINT_0121_0001_0001_policy_reasoning | Findings Ledger Guild (`src/Findings/StellaOps.Findings.Ledger`) | src/Findings/StellaOps.Findings.Ledger | PLLG010x ADRs | PLLG010x ADRs | EVFL0101 | -| EXPORT-36-001 | TODO | | SPRINT_202_cli_ii | DevEx/CLI Guild (`src/Cli/StellaOps.Cli`) | src/Cli/StellaOps.Cli | Export API spec | Export API spec | EVCL0101 | -| EXPORT-37-001 | TODO | | SPRINT_202_cli_ii | DevEx/CLI Guild (`src/Cli/StellaOps.Cli`) | src/Cli/StellaOps.Cli | EXPORT-36-001 | EXPORT-36-001 | EVCL0101 | +| EXPORT-36-001 | TODO | | SPRINT_0202_0000_0002_cli_ii | DevEx/CLI Guild (`src/Cli/StellaOps.Cli`) | src/Cli/StellaOps.Cli | Export API spec | Export API spec | EVCL0101 | +| EXPORT-37-001 | TODO | | SPRINT_0202_0000_0002_cli_ii | DevEx/CLI Guild (`src/Cli/StellaOps.Cli`) | src/Cli/StellaOps.Cli | EXPORT-36-001 | EXPORT-36-001 | EVCL0101 | | EXPORT-37-004 | TODO | | SPRINT_0304_0001_0004_docs_tasks_md_iv | Docs Guild | | DOCN0101 | DOCN0101 | EVDO0101 | | EXPORT-37-005 | TODO | | SPRINT_0304_0001_0004_docs_tasks_md_iv | Docs + Export Guilds | | EXPORT-37-004 | EXPORT-37-004 | EVDO0101 | | EXPORT-37-101 | TODO | | SPRINT_0304_0001_0004_docs_tasks_md_iv | Docs Guild | | EVCL0101 | EVCL0101 | EVDO0101 | @@ -3232,7 +3232,7 @@ | EXPORT-ATTEST-74-002 | TODO | | SPRINT_160_export_evidence | ExportCenter + Attestation Guilds | | EXPORT-ATTEST-74-001 | EXPORT-ATTEST-74-001 | EVAH0101 | | EXPORT-ATTEST-75-001 | TODO | | SPRINT_160_export_evidence | ExportCenter + CLI Guilds | | Attestation Bundle + CLI + Exporter Guilds | EXPORT-ATTEST-74-001 | EVAH0101 | | EXPORT-ATTEST-75-002 | TODO | | SPRINT_160_export_evidence | ExportCenter + CLI Guilds | | EXPORT-ATTEST-75-001 | EXPORT-ATTEST-75-001 | EVAH0101 | -| EXPORT-CONSOLE-23-001 | TODO | | SPRINT_123_policy_reasoning | Policy Guild, Scheduler Guild, Observability Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Build evidence bundle/export generator producing signed manifests, CSV/JSON replay endpoints, and trace attachments; integrate with scheduler jobs and expose progress telemetry | | EVOA0101 | +| EXPORT-CONSOLE-23-001 | TODO | | SPRINT_0123_0000_0001_policy_reasoning | Policy Guild, Scheduler Guild, Observability Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Build evidence bundle/export generator producing signed manifests, CSV/JSON replay endpoints, and trace attachments; integrate with scheduler jobs and expose progress telemetry | | EVOA0101 | | EXPORT-CRYPTO-90-001 | TODO | | SPRINT_160_export_evidence | ExportCenter + Security Guilds (`src/ExportCenter/StellaOps.ExportCenter`) | src/ExportCenter/StellaOps.ExportCenter | Exporter Service + Security Guilds | Security review | EVOA0101 | | EXPORT-OAS-61 | TODO | | SPRINT_160_export_evidence | ExportCenter + API Governance | | Exporter Service + API Governance + SDK Guilds | OAS spec finalization | EVOA0101 | | EXPORT-OAS-61-001 | TODO | | SPRINT_162_exportcenter_i | ExportCenter + API Contracts Guild | src/ExportCenter/StellaOps.ExportCenter | Update Exporter OAS covering profiles, runs, downloads, devportal exports with standard error envelope and examples. | EXPORT-OAS-61 | EVOA0101 | @@ -3256,32 +3256,32 @@ | EXPORT-SVC-35-003 | TODO | | SPRINT_163_exportcenter_ii | ExportCenter Guild | src/ExportCenter/StellaOps.ExportCenter | Deliver JSON adapters (`json:raw`, `json:policy`) with canonical normalization, redaction allowlists, compression, and manifest counts. Dependencies: EXPORT-SVC-35-002. | EXPORT-SVC-35-001 | ESVC0101 | | EXPORT-SVC-35-004 | TODO | | SPRINT_163_exportcenter_ii | ExportCenter Guild | src/ExportCenter/StellaOps.ExportCenter | Build mirror (full) adapter producing filesystem layout, indexes, manifests, and README with download-only distribution. Dependencies: EXPORT-SVC-35-003. | EXPORT-SVC-35-002 | ESVC0101 | | EXPORT-SVC-35-005 | TODO | | SPRINT_163_exportcenter_ii | ExportCenter Guild | src/ExportCenter/StellaOps.ExportCenter | Implement manifest/provenance writer and KMS signing/attestation (detached + embedded) for bundle outputs. Dependencies: EXPORT-SVC-35-004. | EXPORT-SVC-35-003 | ESVC0101 | -| EXPORT-SVC-35-006 | TODO | | SPRINT_164_exportcenter_iii | ExportCenter Guild | src/ExportCenter/StellaOps.ExportCenter | Expose Export API (profiles, runs, download, SSE updates) with audit logging, concurrency controls, and viewer/operator RBAC integration. Dependencies: EXPORT-SVC-35-005. | EXPORT-SVC-35-004 | ESVC0101 | -| EXPORT-SVC-36-001 | TODO | | SPRINT_164_exportcenter_iii | ExportCenter Guild | src/ExportCenter/StellaOps.ExportCenter | Implement Trivy DB adapter (core) with schema mappings, version flag gating, and validation harness. Dependencies: EXPORT-SVC-35-006. | ESVC0101 outputs | ESVC0102 | -| EXPORT-SVC-36-002 | TODO | | SPRINT_164_exportcenter_iii | ExportCenter Guild | src/ExportCenter/StellaOps.ExportCenter | Add Trivy Java DB variant with shared manifest entries and adapter regression tests. Dependencies: EXPORT-SVC-36-001. | EXPORT-SVC-36-001 | ESVC0102 | -| EXPORT-SVC-36-003 | TODO | | SPRINT_164_exportcenter_iii | ExportCenter Guild | src/ExportCenter/StellaOps.ExportCenter | Build OCI distribution engine (manifests, descriptors, annotations) with registry auth support and retries. Dependencies: EXPORT-SVC-36-002. | EXPORT-SVC-36-001 | ESVC0102 | -| EXPORT-SVC-36-004 | TODO | | SPRINT_164_exportcenter_iii | ExportCenter Guild | src/ExportCenter/StellaOps.ExportCenter | Extend planner/run lifecycle for distribution targets (OCI/object storage) with idempotent metadata updates and retention timestamps. Dependencies: EXPORT-SVC-36-003. | EXPORT-SVC-36-002 | ESVC0102 | -| EXPORT-SVC-37-001 | TODO | | SPRINT_164_exportcenter_iii | ExportCenter Guild | src/ExportCenter/StellaOps.ExportCenter | Implement mirror delta adapter with base manifest comparison, change set generation, and content-addressed reuse. Dependencies: EXPORT-SVC-36-004. | EXPORT-SVC-35-006 | ESVC0102 | -| EXPORT-SVC-37-002 | TODO | | SPRINT_164_exportcenter_iii | ExportCenter Guild | src/ExportCenter/StellaOps.ExportCenter | Add bundle encryption (age/AES-GCM), key wrapping via KMS, and verification tooling for encrypted outputs. Dependencies: EXPORT-SVC-37-001. | EXPORT-SVC-37-001 | ESVC0102 | -| EXPORT-SVC-37-003 | TODO | | SPRINT_164_exportcenter_iii | ExportCenter Guild | src/ExportCenter/StellaOps.ExportCenter | Implement export scheduling (cron/event), retention pruning, retry idempotency, and failure classification. Dependencies: EXPORT-SVC-37-002. | EXPORT-SVC-37-002 | ESVC0103 | -| EXPORT-SVC-37-004 | TODO | | SPRINT_164_exportcenter_iii | ExportCenter Guild | src/ExportCenter/StellaOps.ExportCenter | Provide verification API to stream manifests/hashes, compute hash+signature checks, and return attest status for CLI/UI. Dependencies: EXPORT-SVC-37-003. | EXPORT-SVC-37-003 | ESVC0103 | -| EXPORT-SVC-43-001 | TODO | | SPRINT_164_exportcenter_iii | ExportCenter Guild | src/ExportCenter/StellaOps.ExportCenter | Integrate pack run manifests/artifacts into export bundles and CLI verification flows; expose provenance links. Dependencies: EXPORT-SVC-37-004. | EXPORT-SVC-37-004 | ESVC0103 | -| EXPORT-TEN-48-001 | TODO | | SPRINT_164_exportcenter_iii | ExportCenter + Tenancy Guild | src/ExportCenter/StellaOps.ExportCenter | Prefix artifacts/manifests with tenant/project, enforce scope checks, and prevent cross-tenant exports unless explicitly whitelisted; update provenance. | EXPORT-SVC-37-004 | ESVC0103 | +| EXPORT-SVC-35-006 | TODO | | SPRINT_0164_0000_0003_exportcenter_iii | ExportCenter Guild | src/ExportCenter/StellaOps.ExportCenter | Expose Export API (profiles, runs, download, SSE updates) with audit logging, concurrency controls, and viewer/operator RBAC integration. Dependencies: EXPORT-SVC-35-005. | EXPORT-SVC-35-004 | ESVC0101 | +| EXPORT-SVC-36-001 | TODO | | SPRINT_0164_0000_0003_exportcenter_iii | ExportCenter Guild | src/ExportCenter/StellaOps.ExportCenter | Implement Trivy DB adapter (core) with schema mappings, version flag gating, and validation harness. Dependencies: EXPORT-SVC-35-006. | ESVC0101 outputs | ESVC0102 | +| EXPORT-SVC-36-002 | TODO | | SPRINT_0164_0000_0003_exportcenter_iii | ExportCenter Guild | src/ExportCenter/StellaOps.ExportCenter | Add Trivy Java DB variant with shared manifest entries and adapter regression tests. Dependencies: EXPORT-SVC-36-001. | EXPORT-SVC-36-001 | ESVC0102 | +| EXPORT-SVC-36-003 | TODO | | SPRINT_0164_0000_0003_exportcenter_iii | ExportCenter Guild | src/ExportCenter/StellaOps.ExportCenter | Build OCI distribution engine (manifests, descriptors, annotations) with registry auth support and retries. Dependencies: EXPORT-SVC-36-002. | EXPORT-SVC-36-001 | ESVC0102 | +| EXPORT-SVC-36-004 | TODO | | SPRINT_0164_0000_0003_exportcenter_iii | ExportCenter Guild | src/ExportCenter/StellaOps.ExportCenter | Extend planner/run lifecycle for distribution targets (OCI/object storage) with idempotent metadata updates and retention timestamps. Dependencies: EXPORT-SVC-36-003. | EXPORT-SVC-36-002 | ESVC0102 | +| EXPORT-SVC-37-001 | TODO | | SPRINT_0164_0000_0003_exportcenter_iii | ExportCenter Guild | src/ExportCenter/StellaOps.ExportCenter | Implement mirror delta adapter with base manifest comparison, change set generation, and content-addressed reuse. Dependencies: EXPORT-SVC-36-004. | EXPORT-SVC-35-006 | ESVC0102 | +| EXPORT-SVC-37-002 | TODO | | SPRINT_0164_0000_0003_exportcenter_iii | ExportCenter Guild | src/ExportCenter/StellaOps.ExportCenter | Add bundle encryption (age/AES-GCM), key wrapping via KMS, and verification tooling for encrypted outputs. Dependencies: EXPORT-SVC-37-001. | EXPORT-SVC-37-001 | ESVC0102 | +| EXPORT-SVC-37-003 | TODO | | SPRINT_0164_0000_0003_exportcenter_iii | ExportCenter Guild | src/ExportCenter/StellaOps.ExportCenter | Implement export scheduling (cron/event), retention pruning, retry idempotency, and failure classification. Dependencies: EXPORT-SVC-37-002. | EXPORT-SVC-37-002 | ESVC0103 | +| EXPORT-SVC-37-004 | TODO | | SPRINT_0164_0000_0003_exportcenter_iii | ExportCenter Guild | src/ExportCenter/StellaOps.ExportCenter | Provide verification API to stream manifests/hashes, compute hash+signature checks, and return attest status for CLI/UI. Dependencies: EXPORT-SVC-37-003. | EXPORT-SVC-37-003 | ESVC0103 | +| EXPORT-SVC-43-001 | TODO | | SPRINT_0164_0000_0003_exportcenter_iii | ExportCenter Guild | src/ExportCenter/StellaOps.ExportCenter | Integrate pack run manifests/artifacts into export bundles and CLI verification flows; expose provenance links. Dependencies: EXPORT-SVC-37-004. | EXPORT-SVC-37-004 | ESVC0103 | +| EXPORT-TEN-48-001 | TODO | | SPRINT_0164_0000_0003_exportcenter_iii | ExportCenter + Tenancy Guild | src/ExportCenter/StellaOps.ExportCenter | Prefix artifacts/manifests with tenant/project, enforce scope checks, and prevent cross-tenant exports unless explicitly whitelisted; update provenance. | EXPORT-SVC-37-004 | ESVC0103 | | FEEDCONN-CCCS-02-009 | TODO | | SPRINT_117_concelier_vi | Concelier Connector Guild – CCCS (src/Concelier/__Libraries/StellaOps.Concelier.Connector.Cccs) | src/Concelier/__Libraries/StellaOps.Concelier.Connector.Cccs | Emit CCCS version ranges into `advisory_observations.affected.versions[]` with provenance anchors (`cccs:{serial}:{index}`) and normalized comparison keys per the Link-Not-Merge schema/doc recipes. Depends on CONCELIER-LNM-21-001. | — | FEFC0101 | | FEEDCONN-CERTBUND-02-010 | TODO | | SPRINT_117_concelier_vi | Concelier Connector Guild – CertBund (src/Concelier/__Libraries/StellaOps.Concelier.Connector.CertBund) | src/Concelier/__Libraries/StellaOps.Concelier.Connector.CertBund | Translate CERT-Bund `product.Versions` phrases into normalized ranges + provenance identifiers (`certbund:{advisoryId}:{vendor}`) while retaining localisation notes; update mapper/tests for Link-Not-Merge. Depends on CONCELIER-LNM-21-001. | — | FEFC0101 | | FEEDCONN-CISCO-02-009 | DOING | 2025-11-08 | SPRINT_117_concelier_vi | Concelier Connector Guild – Cisco (src/Concelier/__Libraries/StellaOps.Concelier.Connector.Vndr.Cisco) | src/Concelier/__Libraries/StellaOps.Concelier.Connector.Vndr.Cisco | Emit Cisco SemVer ranges into the new observation schema with provenance IDs (`cisco:{productId}`) and deterministic comparison keys; refresh fixtures to remove merge counters. Depends on CONCELIER-LNM-21-001. | — | FEFC0101 | | FEEDCONN-ICSCISA-02-012 | BLOCKED | | SPRINT_0503_0001_0001_ops_devops_i | Concelier Feed Owners | | Overdue provenance refreshes require schedule from feed owners. | FEED-REMEDIATION-1001 | FEFC0101 | | FEEDCONN-KISA-02-008 | BLOCKED | | SPRINT_0503_0001_0001_ops_devops_i | Concelier Feed Owners | | FEED-REMEDIATION-1001 | FEED-REMEDIATION-1001 | FEFC0101 | -| FORENSICS-53-001 | TODO | | SPRINT_202_cli_ii | Forensics Guild | src/Cli/StellaOps.Cli | Replay data set | Replay data set | FONS0101 | +| FORENSICS-53-001 | TODO | | SPRINT_0202_0000_0002_cli_ii | Forensics Guild | src/Cli/StellaOps.Cli | Replay data set | Replay data set | FONS0101 | | FORENSICS-53-002 | TODO | | SPRINT_0304_0001_0004_docs_tasks_md_iv | Forensics Guild | | FORENSICS-53-001 | FORENSICS-53-001 | FONS0101 | | FORENSICS-53-003 | TODO | | SPRINT_0304_0001_0004_docs_tasks_md_iv | Forensics Guild | | FORENSICS-53-001 | FORENSICS-53-001 | FONS0101 | -| FORENSICS-54-001 | TODO | | SPRINT_202_cli_ii | Forensics Guild | src/Cli/StellaOps.Cli | FORENSICS-53 outputs | FORENSICS-53 outputs | FONS0101 | -| FORENSICS-54-002 | TODO | | SPRINT_202_cli_ii | Forensics Guild | src/Cli/StellaOps.Cli | FORENSICS-54-001 | FORENSICS-54-001 | FONS0101 | -| FS-03 | TODO | | SPRINT_136_scanner_surface | Scanner Guild | src/Scanner/__Libraries/StellaOps.Scanner.Surface.FS | SURFACE-FS-02 | SURFACE-FS-02 | SFFS0101 | -| FS-04 | TODO | | SPRINT_136_scanner_surface | Scanner Guild | src/Scanner/__Libraries/StellaOps.Scanner.Surface.FS | FS-03 | SURFACE-FS-02 | SFFS0101 | -| FS-05 | TODO | | SPRINT_136_scanner_surface | Scanner Guild · Scheduler Guild | src/Scanner/__Libraries/StellaOps.Scanner.Surface.FS | SURFACE-FS-03 | SURFACE-FS-03 | SFFS0101 | -| FS-06 | TODO | | SPRINT_136_scanner_surface | Docs Guild | src/Scanner/__Libraries/StellaOps.Scanner.Surface.FS | SURFACE-FS-02 | SURFACE-FS-02 | SFFS0101 | -| FS-07 | TODO | | SPRINT_136_scanner_surface | Scanner Guild | src/Scanner/__Libraries/StellaOps.Scanner.Surface.FS | SCANNER-SURFACE-04 | SCANNER-SURFACE-04 | SFFS0101 | +| FORENSICS-54-001 | TODO | | SPRINT_0202_0000_0002_cli_ii | Forensics Guild | src/Cli/StellaOps.Cli | FORENSICS-53 outputs | FORENSICS-53 outputs | FONS0101 | +| FORENSICS-54-002 | TODO | | SPRINT_0202_0000_0002_cli_ii | Forensics Guild | src/Cli/StellaOps.Cli | FORENSICS-54-001 | FORENSICS-54-001 | FONS0101 | +| FS-03 | TODO | | SPRINT_0136_0000_0001_scanner_surface | Scanner Guild | src/Scanner/__Libraries/StellaOps.Scanner.Surface.FS | SURFACE-FS-02 | SURFACE-FS-02 | SFFS0101 | +| FS-04 | TODO | | SPRINT_0136_0000_0001_scanner_surface | Scanner Guild | src/Scanner/__Libraries/StellaOps.Scanner.Surface.FS | FS-03 | SURFACE-FS-02 | SFFS0101 | +| FS-05 | TODO | | SPRINT_0136_0000_0001_scanner_surface | Scanner Guild · Scheduler Guild | src/Scanner/__Libraries/StellaOps.Scanner.Surface.FS | SURFACE-FS-03 | SURFACE-FS-03 | SFFS0101 | +| FS-06 | TODO | | SPRINT_0136_0000_0001_scanner_surface | Docs Guild | src/Scanner/__Libraries/StellaOps.Scanner.Surface.FS | SURFACE-FS-02 | SURFACE-FS-02 | SFFS0101 | +| FS-07 | TODO | | SPRINT_0136_0000_0001_scanner_surface | Scanner Guild | src/Scanner/__Libraries/StellaOps.Scanner.Surface.FS | SCANNER-SURFACE-04 | SCANNER-SURFACE-04 | SFFS0101 | | GAP-DOC-008 | TODO | | SPRINT_0401_0001_0001_reachability_evidence_chain | Docs Guild | `docs/reachability/function-level-evidence.md`, `docs/09_API_CLI_REFERENCE.md`, `docs/api/policy.md` | Publish the cross-module function-level evidence guide, update API/CLI references with the new `code_id` fields, and add OpenVEX/replay samples under `samples/reachability/**`. | DOAG0101 outputs | GAPG0101 | | GAP-POL-005 | TODO | | SPRINT_0401_0001_0001_reachability_evidence_chain | Policy Guild · Docs Guild | `src/Policy/StellaOps.Policy.Engine`, `docs/modules/policy/architecture.md`, `docs/reachability/function-level-evidence.md` | Ingest reachability facts into Policy Engine, expose `reachability.state/confidence` in SPL/API, enforce auto-suppress (<0.30) rules, and generate OpenVEX evidence blocks referencing graph hashes + runtime facts with policy thresholds. | GAP-DOC-008 | GAPG0101 | | GAP-REP-004 | TODO | | SPRINT_0401_0001_0001_reachability_evidence_chain | Docs Guild | `src/__Libraries/StellaOps.Replay.Core`, `docs/replay/DETERMINISTIC_REPLAY.md` | Enforce BLAKE3 hashing + CAS registration for graphs/traces before manifest writes, upgrade replay manifest v2 with analyzer versions/policy thresholds, and add deterministic tests. | GAP-DOC-008 | GAPG0101 | @@ -3295,15 +3295,15 @@ | GO-33-001 | DONE | | SPRINT_0153_0001_0003_orchestrator_iii | Worker SDK Guild | src/Orchestrator/StellaOps.Orchestrator.WorkerSdk.Go | GO-32-002 | GO-32-002 | GOSD0101 | | GO-33-002 | DONE | | SPRINT_0153_0001_0003_orchestrator_iii | Worker SDK Guild | src/Orchestrator/StellaOps.Orchestrator.WorkerSdk.Go | GO-33-001 | GO-33-001 | GOSD0101 | | GO-34-001 | DONE | | SPRINT_0153_0001_0003_orchestrator_iii | Worker SDK Guild | src/Orchestrator/StellaOps.Orchestrator.WorkerSdk.Go | GO-33-002 | GO-33-002 | GOSD0101 | -| GRAPH-21-001 | TODO | | SPRINT_136_scanner_surface | Scanner WebService Guild | src/Scanner/StellaOps.Scanner.WebService | Link-Not-Merge schema | Link-Not-Merge schema | GRSC0101 | +| GRAPH-21-001 | TODO | | SPRINT_0136_0000_0001_scanner_surface | Scanner WebService Guild | src/Scanner/StellaOps.Scanner.WebService | Link-Not-Merge schema | Link-Not-Merge schema | GRSC0101 | | GRAPH-21-002 | BLOCKED (2025-10-27) | 2025-10-27 | SPRINT_113_concelier_ii | Concelier Core Guild · Scanner Guild | src/Concelier/__Libraries/StellaOps.Concelier.Core | GRAPH-21-001 | GRAPH-21-001 | GRSC0101 | | GRAPH-21-003 | TODO | 2025-10-27 | SPRINT_0213_0001_0002_web_ii | Scanner WebService Guild | src/Web/StellaOps.Web | GRAPH-21-001 | GRAPH-21-001 | GRSC0101 | | GRAPH-21-004 | TODO | 2025-10-27 | SPRINT_0213_0001_0002_web_ii | Scanner WebService Guild | src/Web/StellaOps.Web | GRAPH-21-002 | GRAPH-21-002 | GRSC0101 | -| GRAPH-21-005 | BLOCKED (2025-10-27) | 2025-10-27 | SPRINT_120_excititor_ii | Excititor Storage Guild | src/Excititor/__Libraries/StellaOps.Excititor.Storage.Mongo | GRAPH-21-002 | GRAPH-21-002 | GRSC0101 | +| GRAPH-21-005 | BLOCKED (2025-10-27) | 2025-10-27 | SPRINT_0120_0000_0002_excititor_ii | Excititor Storage Guild | src/Excititor/__Libraries/StellaOps.Excititor.Storage.Mongo | GRAPH-21-002 | GRAPH-21-002 | GRSC0101 | | GRAPH-24-005 | TODO | | SPRINT_0304_0001_0004_docs_tasks_md_iv | UI Guild | | GRAPH-24-003 | GRAPH-24-003 | GRUI0101 | | GRAPH-24-007 | TODO | | SPRINT_0304_0001_0004_docs_tasks_md_iv | UI Guild | | GRAPH-24-005 | GRAPH-24-005 | GRUI0101 | | GRAPH-24-101 | TODO | | SPRINT_113_concelier_ii | UI Guild | src/Concelier/StellaOps.Concelier.WebService | GRAPH-24-001 | GRAPH-24-001 | GRUI0101 | -| GRAPH-24-102 | TODO | | SPRINT_120_excititor_ii | UI Guild | src/Excititor/StellaOps.Excititor.WebService | GRAPH-24-101 | GRAPH-24-101 | GRUI0101 | +| GRAPH-24-102 | TODO | | SPRINT_0120_0000_0002_excititor_ii | UI Guild | src/Excititor/StellaOps.Excititor.WebService | GRAPH-24-101 | GRAPH-24-101 | GRUI0101 | | GRAPH-28-102 | TODO | | SPRINT_113_concelier_ii | Concelier WebService Guild (src/Concelier/StellaOps.Concelier.WebService) | src/Concelier/StellaOps.Concelier.WebService | | | GRAPI0101 | | GRAPH-API-28-001 | DONE (2025-11-24) | 2025-11-24 | SPRINT_0207_0001_0001_graph | Graph API Guild (src/Graph/StellaOps.Graph.Api) | src/Graph/StellaOps.Graph.Api | Define OpenAPI + JSON schema for graph search/query/paths/diff/export endpoints, including cost metadata and streaming tile schema. | — | ORGR0101 | | GRAPH-API-28-002 | DONE (2025-11-25) | 2025-11-25 | SPRINT_0207_0001_0001_graph | Graph API Guild (src/Graph/StellaOps.Graph.Api) | src/Graph/StellaOps.Graph.Api | Implement `/graph/search` with multi-type index lookup, prefix/exact match, RBAC enforcement, and result ranking + caching. Dependencies: GRAPH-API-28-001. | — | ORGR0101 | @@ -3402,8 +3402,8 @@ | LNM-21-201 | TODO | | SPRINT_113_concelier_ii | CLI Guild | src/Concelier/StellaOps.Concelier.WebService | Bundle validation enhancements. | LNMC0101 outputs | LNMC0101 | | LNM-21-202 | TODO | | SPRINT_113_concelier_ii | CLI Guild | src/Concelier/StellaOps.Concelier.WebService | Policy linking improvements. | LNM-21-201 | LNMC0101 | | LNM-21-203 | TODO | | SPRINT_113_concelier_ii | CLI Guild | src/Concelier/StellaOps.Concelier.WebService | Export reporting. | LNM-21-202 | LNMC0101 | -| LNM-22-001 | TODO | | SPRINT_202_cli_ii | CLI Guild | src/Cli/StellaOps.Cli | CLI/UI shared components. | DOLN0101 | LNMC0101 | -| LNM-22-002 | TODO | | SPRINT_202_cli_ii | CLI Guild | src/Cli/StellaOps.Cli | Additional filters. | LNM-22-001 | LNMC0101 | +| LNM-22-001 | TODO | | SPRINT_0202_0000_0002_cli_ii | CLI Guild | src/Cli/StellaOps.Cli | CLI/UI shared components. | DOLN0101 | LNMC0101 | +| LNM-22-002 | TODO | | SPRINT_0202_0000_0002_cli_ii | CLI Guild | src/Cli/StellaOps.Cli | Additional filters. | LNM-22-001 | LNMC0101 | | LNM-22-003 | TODO | | SPRINT_0210_0001_0002_ui_ii | UI Guild (`src/UI/StellaOps.UI`) | src/UI/StellaOps.UI | UI ingestion view. | LNM-22-001 | LNMC0101 | | LNM-22-004 | TODO | | SPRINT_0210_0001_0002_ui_ii | UI Guild | src/UI/StellaOps.UI | UI remediation workflow. | LNM-22-003 | IMPT0101 | | LNM-22-005 | BLOCKED (2025-10-27) | 2025-10-27 | SPRINT_0305_0001_0005_docs_tasks_md_v | Docs + UI Guild | | Docs update for UI flows. | DOCS-LNM-22-004 | IMPT0101 | @@ -3419,14 +3419,14 @@ | NATIVE-401-015 | TODO | | SPRINT_0401_0001_0001_reachability_evidence_chain | Scanner Worker Guild | `src/Scanner/__Libraries/StellaOps.Scanner.Symbols.Native`, `src/Scanner/__Libraries/StellaOps.Scanner.CallGraph.Native` | Bootstrap Symbols.Native + CallGraph.Native scaffolding and coverage fixtures. | Needs replay requirements from DORR0101 | SCNA0101 | | NOTIFY-38-001 | TODO | | SPRINT_0214_0001_0001_web_iii | BE-Base Platform Guild | src/Web/StellaOps.Web | Route approval/rule APIs through Web gateway with tenant scopes. | Wait for NOTY0103 approval payload schema | NOWB0101 | | NOTIFY-39-001 | TODO | | SPRINT_0214_0001_0001_web_iii | BE-Base Platform Guild | src/Web/StellaOps.Web | Surface digest/simulation/quiet-hour controls in Web tier. | Needs correlation outputs from NOTY0105 | NOWB0101 | -| NOTIFY-40-001 | TODO | | SPRINT_202_cli_ii | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Implement escalations + ack workflows, localization previews, and channel health checks. | NOTIFY-39-001 | NOWC0101 | -| NOTIFY-AIRGAP-56-002 | DONE | | SPRINT_170_notifications_telemetry | Notifications Service Guild · DevOps Guild | src/Notify/StellaOps.Notify | Ship AirGap-ready notifier bundles (Helm overlays, secrets templates, rollout guide). | MIRROR-CRT-56-001 | NOIA0101 | -| NOTIFY-ATTEST-74-001 | DOING | | SPRINT_170_notifications_telemetry | Notifications Service Guild · Attestor Service Guild | src/Notify/StellaOps.Notify | Create attestor-driven notification templates + schema docs; publish in `/docs/notifications/templates.md`. | ATEL0101 | NOIA0101 | -| NOTIFY-ATTEST-74-002 | DOING | | SPRINT_170_notifications_telemetry | Notifications Service Guild | src/Notify/StellaOps.Notify | Wire attestor DSSE payload ingestion + Task Runner callbacks for attestation verdicts. | NOTIFY-ATTEST-74-001 | NOIA0101 | -| NOTIFY-DOC-70-001 | DONE | | SPRINT_170_notifications_telemetry | Notifications Service Guild · DevOps Guild | docs/modules/notify | Keep as reference for documentation/offline-kit parity. | NOTIFY-AIRGAP-56-002 | DONO0102 | +| NOTIFY-40-001 | TODO | | SPRINT_0202_0000_0002_cli_ii | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Implement escalations + ack workflows, localization previews, and channel health checks. | NOTIFY-39-001 | NOWC0101 | +| NOTIFY-AIRGAP-56-002 | DONE | | SPRINT_0170_0000_0001_notifications_telemetry | Notifications Service Guild · DevOps Guild | src/Notify/StellaOps.Notify | Ship AirGap-ready notifier bundles (Helm overlays, secrets templates, rollout guide). | MIRROR-CRT-56-001 | NOIA0101 | +| NOTIFY-ATTEST-74-001 | DOING | | SPRINT_0170_0000_0001_notifications_telemetry | Notifications Service Guild · Attestor Service Guild | src/Notify/StellaOps.Notify | Create attestor-driven notification templates + schema docs; publish in `/docs/notifications/templates.md`. | ATEL0101 | NOIA0101 | +| NOTIFY-ATTEST-74-002 | DOING | | SPRINT_0170_0000_0001_notifications_telemetry | Notifications Service Guild | src/Notify/StellaOps.Notify | Wire attestor DSSE payload ingestion + Task Runner callbacks for attestation verdicts. | NOTIFY-ATTEST-74-001 | NOIA0101 | +| NOTIFY-DOC-70-001 | DONE | | SPRINT_0170_0000_0001_notifications_telemetry | Notifications Service Guild · DevOps Guild | docs/modules/notify | Keep as reference for documentation/offline-kit parity. | NOTIFY-AIRGAP-56-002 | DONO0102 | | NOTIFY-DOCS-0001 | DONE | 2025-11-05 | SPRINT_0322_0001_0001_docs_modules_notify | Docs Guild | docs/modules/notify | Validate module README reflects Notifications Studio pivot and latest release notes. | NOTIFY-DOC-70-001 | DONO0102 | | NOTIFY-DOCS-0002 | TODO | 2025-11-05 | SPRINT_0322_0001_0001_docs_modules_notify | Docs Guild | docs/modules/notify | Pending NOTIFY-SVC-39-001..004 to document correlation/digests/simulation/quiet hours. | NOTIFY-SVC-39-004 | DONO0102 | -| NOTIFY-ENG-0001 | TODO | | SPRINT_0322_0001_0001_docs_modules_notify | Module Team | docs/modules/notify | Keep implementation milestones aligned with `/docs/implplan/SPRINT_171_notifier_i.md` onward. | NOTY0103 | DONO0102 | +| NOTIFY-ENG-0001 | TODO | | SPRINT_0322_0001_0001_docs_modules_notify | Module Team | docs/modules/notify | Keep implementation milestones aligned with `/docs/implplan/SPRINT_0171_0000_0001_notifier_i.md` onward. | NOTY0103 | DONO0102 | | NOTIFY-OAS-61-001 | DONE (2025-11-17) | | SPRINT_0171_0001_0001_notifier_i | Notifications Service Guild · API Governance Guild | docs/api/notifications | Update OpenAPI doc set (rule/incident endpoints) with new schemas + changelog. | NOTY0103 | NOOA0101 | | NOTIFY-OAS-61-002 | DONE (2025-11-17) | | SPRINT_0171_0001_0001_notifier_i | Notifications Service Guild · SDK Guild | docs/api/notifications | Provide SDK usage examples for rule CRUD, incident ack, and quiet hours; ensure SDK smoke tests. | NOTIFY-OAS-61-001 | NOOA0101 | | NOTIFY-OAS-62-001 | DONE (2025-11-17) | | SPRINT_0171_0001_0001_notifier_i | Notifications Service Guild · Developer Portal Guild | docs/api/notifications | Publish `/docs/api/reference/notifications` auto-generated site; integrate with portal nav. | NOTIFY-OAS-61-002 | NOOA0101 | @@ -3437,37 +3437,37 @@ | NOTIFY-RISK-66-001 | TODO | | SPRINT_0171_0001_0001_notifier_i | Notifications Service Guild · Risk Engine Guild · Policy Guild | src/Notifier/StellaOps.Notifier | Policy/Risk metadata export required before implementation. | POLICY-RISK-40-002 | NORR0101 | | NOTIFY-RISK-67-001 | TODO | | SPRINT_0171_0001_0001_notifier_i | Notifications Service Guild · Policy Guild | src/Notifier/StellaOps.Notifier | Notify stakeholders when risk profiles are published, deprecated, or thresholds change. | NOTIFY-RISK-66-001 | NORR0101 | | NOTIFY-RISK-68-001 | TODO | | SPRINT_0171_0001_0001_notifier_i | Notifications Service Guild · Risk Engine Guild · Policy Guild | src/Notifier/StellaOps.Notifier | Broadcast severity transitions with trace metadata and attach policy references. | NOTIFY-RISK-67-001 | NORR0101 | -| NOTIFY-SVC-37-001 | TODO | | SPRINT_172_notifier_ii | Notifications Service Guild | src/Notifier/StellaOps.Notifier | Define pack approval & policy notification contract, including OpenAPI schema, event payloads, resume token mechanics, and security guidance. | Align payload schema with PGMI0101 + ATEL0101 decisions | NOTY0103 | -| NOTIFY-SVC-37-002 | TODO | | SPRINT_172_notifier_ii | Notifications Service Guild | src/Notifier/StellaOps.Notifier | Implement secure ingestion endpoint, Mongo persistence (`pack_approvals`), idempotent writes, and audit trail for approval events. Dependencies: NOTIFY-SVC-37-001. | NOTIFY-SVC-37-001 | NOTY0103 | -| NOTIFY-SVC-37-003 | TODO | | SPRINT_172_notifier_ii | Notifications Service Guild | src/Notifier/StellaOps.Notifier | Deliver approval/policy templates, routing predicates, and channel dispatch (email/chat/webhook) with deterministic ordering plus ack gating. | NOTIFY-SVC-37-002 | NOTY0103 | -| NOTIFY-SVC-37-004 | TODO | | SPRINT_172_notifier_ii | Notifications Service Guild | src/Notifier/StellaOps.Notifier | Provide acknowledgement API, Task Runner callback client, metrics for outstanding approvals, and SLA escalations. | NOTIFY-SVC-37-003 | NOTY0103 | -| NOTIFY-SVC-38-002 | TODO | | SPRINT_172_notifier_ii | Notifications Service Guild | src/Notifier/StellaOps.Notifier | Implement channel adapters (email, chat webhook, generic webhook) with retry policies, health checks, and audit logging. | NOTIFY-SVC-37-004 | NOTY0104 | -| NOTIFY-SVC-38-003 | TODO | | SPRINT_172_notifier_ii | Notifications Service Guild | src/Notifier/StellaOps.Notifier | Deliver template service (versioned templates, localization scaffolding) and renderer with redaction allowlists, Markdown/HTML/JSON outputs, and provenance links. | NOTIFY-SVC-38-002 | NOTY0104 | -| NOTIFY-SVC-38-004 | TODO | | SPRINT_172_notifier_ii | Notifications Service Guild | src/Notifier/StellaOps.Notifier | Expose REST + WS APIs (rules CRUD, templates preview, incidents list, ack) with audit logging, RBAC checks, and live feed stream. | NOTIFY-SVC-38-003 | NOTY0104 | -| NOTIFY-SVC-39-001 | TODO | | SPRINT_172_notifier_ii | Notifications Service Guild | src/Notifier/StellaOps.Notifier | Implement correlation engine with pluggable key expressions/windows, throttler (token buckets), quiet hours/maintenance evaluator, and incident lifecycle. | NOTIFY-SVC-38-004 | NOTY0105 | -| NOTIFY-SVC-39-002 | TODO | | SPRINT_172_notifier_ii | Notifications Service Guild | src/Notifier/StellaOps.Notifier | Build digest generator (queries, formatting) with schedule runner and distribution manifests. | NOTIFY-SVC-39-001 | NOTY0105 | -| NOTIFY-SVC-39-003 | TODO | | SPRINT_172_notifier_ii | Notifications Service Guild | src/Notifier/StellaOps.Notifier | Provide simulation engine/API to dry-run rules against historical events, returning correlation explanations. | NOTIFY-SVC-39-002 | NOTY0105 | -| NOTIFY-SVC-39-004 | TODO | | SPRINT_172_notifier_ii | Notifications Service Guild | src/Notifier/StellaOps.Notifier | Integrate quiet hour calendars and throttles with audit logging plus operator overrides. | NOTIFY-SVC-39-003 | NOTY0105 | -| NOTIFY-SVC-40-001 | TODO | | SPRINT_172_notifier_ii | Notifications Service Guild | src/Notifier/StellaOps.Notifier | Implement escalations + on-call schedules, ack bridge, PagerDuty/OpsGenie adapters, and CLI/in-app inbox channels. Dependencies: NOTIFY-SVC-39-004. | NOTIFY-SVC-39-004 | NOTY0106 | -| NOTIFY-SVC-40-002 | TODO | | SPRINT_172_notifier_ii | Notifications Service Guild | src/Notifier/StellaOps.Notifier | Add summary storm breaker notifications, localization bundles, and localization fallback handling. | NOTIFY-SVC-40-001 | NOTY0106 | -| NOTIFY-SVC-40-003 | TODO | | SPRINT_172_notifier_ii | Notifications Service Guild | src/Notifier/StellaOps.Notifier | Harden security: signed ack links (KMS), webhook HMAC/IP allowlists, tenant isolation fuzz tests, HTML sanitization. | NOTIFY-SVC-40-002 | NOTY0106 | -| NOTIFY-SVC-40-004 | TODO | | SPRINT_172_notifier_ii | Notifications Service Guild | src/Notifier/StellaOps.Notifier | Finalize observability (metrics/traces for escalations, latency), dead-letter handling, chaos tests for channel outages, and retention policies. | NOTIFY-SVC-40-003 | NOTY0106 | -| NOTIFY-TEN-48-001 | TODO | | SPRINT_173_notifier_iii | Notifications Service Guild | src/Notifier/StellaOps.Notifier | Tenant-scope rules/templates/incidents, RLS on storage, tenant-prefixed channels, and inclusion of tenant context in notifications. | NOTIFY-SVC-40-004 | NOTY0107 | +| NOTIFY-SVC-37-001 | TODO | | SPRINT_0172_0000_0002_notifier_ii | Notifications Service Guild | src/Notifier/StellaOps.Notifier | Define pack approval & policy notification contract, including OpenAPI schema, event payloads, resume token mechanics, and security guidance. | Align payload schema with PGMI0101 + ATEL0101 decisions | NOTY0103 | +| NOTIFY-SVC-37-002 | TODO | | SPRINT_0172_0000_0002_notifier_ii | Notifications Service Guild | src/Notifier/StellaOps.Notifier | Implement secure ingestion endpoint, Mongo persistence (`pack_approvals`), idempotent writes, and audit trail for approval events. Dependencies: NOTIFY-SVC-37-001. | NOTIFY-SVC-37-001 | NOTY0103 | +| NOTIFY-SVC-37-003 | TODO | | SPRINT_0172_0000_0002_notifier_ii | Notifications Service Guild | src/Notifier/StellaOps.Notifier | Deliver approval/policy templates, routing predicates, and channel dispatch (email/chat/webhook) with deterministic ordering plus ack gating. | NOTIFY-SVC-37-002 | NOTY0103 | +| NOTIFY-SVC-37-004 | TODO | | SPRINT_0172_0000_0002_notifier_ii | Notifications Service Guild | src/Notifier/StellaOps.Notifier | Provide acknowledgement API, Task Runner callback client, metrics for outstanding approvals, and SLA escalations. | NOTIFY-SVC-37-003 | NOTY0103 | +| NOTIFY-SVC-38-002 | TODO | | SPRINT_0172_0000_0002_notifier_ii | Notifications Service Guild | src/Notifier/StellaOps.Notifier | Implement channel adapters (email, chat webhook, generic webhook) with retry policies, health checks, and audit logging. | NOTIFY-SVC-37-004 | NOTY0104 | +| NOTIFY-SVC-38-003 | TODO | | SPRINT_0172_0000_0002_notifier_ii | Notifications Service Guild | src/Notifier/StellaOps.Notifier | Deliver template service (versioned templates, localization scaffolding) and renderer with redaction allowlists, Markdown/HTML/JSON outputs, and provenance links. | NOTIFY-SVC-38-002 | NOTY0104 | +| NOTIFY-SVC-38-004 | TODO | | SPRINT_0172_0000_0002_notifier_ii | Notifications Service Guild | src/Notifier/StellaOps.Notifier | Expose REST + WS APIs (rules CRUD, templates preview, incidents list, ack) with audit logging, RBAC checks, and live feed stream. | NOTIFY-SVC-38-003 | NOTY0104 | +| NOTIFY-SVC-39-001 | TODO | | SPRINT_0172_0000_0002_notifier_ii | Notifications Service Guild | src/Notifier/StellaOps.Notifier | Implement correlation engine with pluggable key expressions/windows, throttler (token buckets), quiet hours/maintenance evaluator, and incident lifecycle. | NOTIFY-SVC-38-004 | NOTY0105 | +| NOTIFY-SVC-39-002 | TODO | | SPRINT_0172_0000_0002_notifier_ii | Notifications Service Guild | src/Notifier/StellaOps.Notifier | Build digest generator (queries, formatting) with schedule runner and distribution manifests. | NOTIFY-SVC-39-001 | NOTY0105 | +| NOTIFY-SVC-39-003 | TODO | | SPRINT_0172_0000_0002_notifier_ii | Notifications Service Guild | src/Notifier/StellaOps.Notifier | Provide simulation engine/API to dry-run rules against historical events, returning correlation explanations. | NOTIFY-SVC-39-002 | NOTY0105 | +| NOTIFY-SVC-39-004 | TODO | | SPRINT_0172_0000_0002_notifier_ii | Notifications Service Guild | src/Notifier/StellaOps.Notifier | Integrate quiet hour calendars and throttles with audit logging plus operator overrides. | NOTIFY-SVC-39-003 | NOTY0105 | +| NOTIFY-SVC-40-001 | TODO | | SPRINT_0172_0000_0002_notifier_ii | Notifications Service Guild | src/Notifier/StellaOps.Notifier | Implement escalations + on-call schedules, ack bridge, PagerDuty/OpsGenie adapters, and CLI/in-app inbox channels. Dependencies: NOTIFY-SVC-39-004. | NOTIFY-SVC-39-004 | NOTY0106 | +| NOTIFY-SVC-40-002 | TODO | | SPRINT_0172_0000_0002_notifier_ii | Notifications Service Guild | src/Notifier/StellaOps.Notifier | Add summary storm breaker notifications, localization bundles, and localization fallback handling. | NOTIFY-SVC-40-001 | NOTY0106 | +| NOTIFY-SVC-40-003 | TODO | | SPRINT_0172_0000_0002_notifier_ii | Notifications Service Guild | src/Notifier/StellaOps.Notifier | Harden security: signed ack links (KMS), webhook HMAC/IP allowlists, tenant isolation fuzz tests, HTML sanitization. | NOTIFY-SVC-40-002 | NOTY0106 | +| NOTIFY-SVC-40-004 | TODO | | SPRINT_0172_0000_0002_notifier_ii | Notifications Service Guild | src/Notifier/StellaOps.Notifier | Finalize observability (metrics/traces for escalations, latency), dead-letter handling, chaos tests for channel outages, and retention policies. | NOTIFY-SVC-40-003 | NOTY0106 | +| NOTIFY-TEN-48-001 | TODO | | SPRINT_0173_0000_0003_notifier_iii | Notifications Service Guild | src/Notifier/StellaOps.Notifier | Tenant-scope rules/templates/incidents, RLS on storage, tenant-prefixed channels, and inclusion of tenant context in notifications. | NOTIFY-SVC-40-004 | NOTY0107 | | OAS-61 | TODO | | SPRINT_160_export_evidence | Exporter Service + API Governance + SDK Guilds | docs/api/oas | Define platform-wide OpenAPI governance + release checklist. | PGMI0101 | DOOA0103 | -| OAS-61-001 | DOING | | SPRINT_170_notifications_telemetry | API Governance Guild | docs/api/oas | Draft spec updates + changelog text. | OAS-61 | DOOA0103 | +| OAS-61-001 | DOING | | SPRINT_0170_0000_0001_notifications_telemetry | API Governance Guild | docs/api/oas | Draft spec updates + changelog text. | OAS-61 | DOOA0103 | | OAS-61-002 | TODO | | SPRINT_114_concelier_iii | Concelier Core Guild | src/Concelier/__Libraries/StellaOps.Concelier.Core | Align Link-Not-Merge endpoints with new pagination/idempotency rules. | OAS-61 | COAS0101 | | OAS-61-003 | TODO | | SPRINT_0305_0001_0005_docs_tasks_md_v | Docs Guild · API Governance Guild | docs/api/oas | Publish `/docs/api/versioning.md` describing SemVer, deprecation headers, migration playbooks. | OAS-61 | DOOA0103 | | OAS-62 | TODO | | SPRINT_160_export_evidence | Exporter + API Gov + SDK Guilds | docs/api/oas | Document SDK/gen pipeline + offline bundle expectations. | OAS-61 | DOOA0103 | | OAS-62-001 | TODO | | SPRINT_114_concelier_iii | Concelier Core Guild · SDK Generator Guild | src/Concelier/__Libraries/StellaOps.Concelier.Core | Generate `/docs/api/reference/` data + integrate with SDK scaffolding. | OAS-61-002 | COAS0101 | -| OAS-62-002 | TODO | | SPRINT_511_api | API Contracts Guild | src/Api/StellaOps.Api.OpenApi | Add lint rules enforcing pagination, idempotency headers, naming conventions, and example coverage. | OAS-62-001 | AOAS0101 | +| OAS-62-002 | TODO | | SPRINT_0511_0000_0001_api | API Contracts Guild | src/Api/StellaOps.Api.OpenApi | Add lint rules enforcing pagination, idempotency headers, naming conventions, and example coverage. | OAS-62-001 | AOAS0101 | | OAS-63 | TODO | | SPRINT_160_export_evidence | Exporter + API Gov + SDK Guilds | docs/api/oas | Define discovery endpoint strategy + lifecycle docs. | OAS-62 | DOOA0103 | | OAS-63-001 | TODO | | SPRINT_114_concelier_iii | Concelier Core Guild · API Governance Guild | src/Concelier/__Libraries/StellaOps.Concelier.Core | Implement `.well-known/openapi` metadata + discovery hints. | Requires 62-001 outputs | | -| OBS-50-001 | DOING | | SPRINT_170_notifications_telemetry | Telemetry Core Guild | | Implement structured logging + trace propagation defaults across services. | Align scrub rules with Security guild | | -| OBS-50-002 | DOING | | SPRINT_170_notifications_telemetry | Telemetry Core Guild | | Roll out collectors/helm overlays + regression tests for exporters. | Needs 50-001 baseline in main | | +| OBS-50-001 | DOING | | SPRINT_0170_0000_0001_notifications_telemetry | Telemetry Core Guild | | Implement structured logging + trace propagation defaults across services. | Align scrub rules with Security guild | | +| OBS-50-002 | DOING | | SPRINT_0170_0000_0001_notifications_telemetry | Telemetry Core Guild | | Roll out collectors/helm overlays + regression tests for exporters. | Needs 50-001 baseline in main | | | OBS-50-003 | TODO | | SPRINT_0306_0001_0006_docs_tasks_md_vi | Docs Guild · Observability Guild | | Update collector deployment + metrics catalog docs. | Needs scrubber decisions from TLTY0102 | | | OBS-50-004 | TODO | | SPRINT_0306_0001_0006_docs_tasks_md_vi | Docs Guild · Observability Guild | | Add SOP for telemetry scrub policies + troubleshooting. | Requires 50-003 outline | | | OBS-51-001 | TODO | | SPRINT_0503_0001_0001_ops_devops_i | Exporter Guild · AirGap Time Guild · CLI Guild | | Build SLO bus + queue depth metrics feeding CLI/exporter dashboards. | PROGRAM-STAFF-1001 | | -| OBS-51-002 | TODO | | SPRINT_170_notifications_telemetry | Telemetry Core Guild · Observability Guild | | Enable shadow-mode evaluators + roll into main collectors. | Depends on 51-001 shadow mode | | +| OBS-51-002 | TODO | | SPRINT_0170_0000_0001_notifications_telemetry | Telemetry Core Guild · Observability Guild | | Enable shadow-mode evaluators + roll into main collectors. | Depends on 51-001 shadow mode | | | OBS-52-001 | TODO | | SPRINT_114_concelier_iii | Concelier Core Guild | src/Concelier/__Libraries/StellaOps.Concelier.Core | Emit ingest latency/queue/AOC metrics with burn-rate alerts. | Needs ATLN0101 schema | | | OBS-52-002 | TODO | | SPRINT_160_export_evidence | Timeline Indexer Guild | | Configure streaming pipeline (retention/partitioning/backpressure). | Needs Concelier metrics | | | OBS-52-003 | TODO | | SPRINT_160_export_evidence | Timeline Indexer Guild | | Add CI validation + schema enforcement for timeline events. | Depends on 52-002 | | @@ -3478,7 +3478,7 @@ | OBS-54-001 | TODO | | SPRINT_114_concelier_iii | Concelier Core Guild · Provenance Guild | src/Concelier/__Libraries/StellaOps.Concelier.Core | Needs shared exporter from 1039_EXPORT-OBS-54-001 | Needs shared exporter from 1039_EXPORT-OBS-54-001 | CNOB0101 | | OBS-54-002 | TODO | | SPRINT_161_evidencelocker | Evidence Locker Guild | `src/EvidenceLocker/StellaOps.EvidenceLocker` | Add metrics/logs/alerts for Evidence Locker flows. | Needs provenance metrics | | | OBS-55-001 | TODO | | SPRINT_114_concelier_iii | Concelier Core & DevOps Guild | src/Concelier/__Libraries/StellaOps.Concelier.Core | Refresh ops automation/runbooks referencing new metrics. | Depends on 52-001 outputs | | -| OBS-56-001 | TODO | | SPRINT_174_telemetry | Telemetry Core Guild | src/Telemetry/StellaOps.Telemetry.Core | Produce air-gap collector bundle + signed configs/tests. | Needs telemetry baseline from TLTY0102 | | +| OBS-56-001 | TODO | | SPRINT_0174_0000_0001_telemetry | Telemetry Core Guild | src/Telemetry/StellaOps.Telemetry.Core | Produce air-gap collector bundle + signed configs/tests. | Needs telemetry baseline from TLTY0102 | | | OFFLINE-17-004 | BLOCKED | 2025-10-26 | SPRINT_0508_0001_0001_ops_offline_kit | Offline Kit Guild · DevOps Guild | ops/offline-kit | Repackage release-17 bundle with new DSSE receipts + verification logs. | Needs PROGRAM-STAFF-1001 approvals | | | OFFLINE-34-006 | TODO | | SPRINT_0508_0001_0001_ops_offline_kit | Offline Kit + Orchestrator Guild | ops/offline-kit | Add orchestrator automation bundle + docs to kit. | Requires mirror time anchors | | | OFFLINE-37-001 | TODO | | SPRINT_0508_0001_0001_ops_offline_kit | Offline Kit + Exporter Guild | ops/offline-kit | Ship export evidence bundle + checksum manifests. | Depends on Export Center artefacts | | @@ -3500,21 +3500,21 @@ | ORCH-34-003 | TODO | | SPRINT_0306_0001_0006_docs_tasks_md_vi | Docs Guild (docs) | | — | — | ORGR0102 | | ORCH-34-004 | TODO | | SPRINT_0306_0001_0006_docs_tasks_md_vi | Docs Guild (docs) | | — | — | ORGR0102 | | ORCH-34-005 | TODO | | SPRINT_0306_0001_0006_docs_tasks_md_vi | Docs Guild (docs) | | — | — | ORGR0102 | -| ORCH-SVC-32-002 | TODO | | SPRINT_152_orchestrator_ii | Orchestrator Service Guild | src/Orchestrator/StellaOps.Orchestrator | Implement scheduler DAG planner + dependency resolver, job state machine, and critical-path metadata without yet issuing control actions. Dependencies: ORCH-SVC-32-001. | Needs 32-001 DB | | -| ORCH-SVC-32-003 | TODO | | SPRINT_152_orchestrator_ii | Orchestrator Service Guild | src/Orchestrator/StellaOps.Orchestrator | Expose read-only REST APIs (sources, runs, jobs, DAG) with OpenAPI, validation, pagination, and tenant scoping. Dependencies: ORCH-SVC-32-002. | Depends on 32-002 | | -| ORCH-SVC-32-004 | TODO | | SPRINT_152_orchestrator_ii | Orchestrator Service Guild | src/Orchestrator/StellaOps.Orchestrator | Implement WebSocket/SSE stream for job/run updates, emit structured metrics counters/histograms, and add health probes. Dependencies: ORCH-SVC-32-003. | Needs 32-003 | | -| ORCH-SVC-32-005 | TODO | | SPRINT_152_orchestrator_ii | Orchestrator Service Guild | src/Orchestrator/StellaOps.Orchestrator | Deliver worker claim/heartbeat/progress endpoints capturing artifact metadata/checksums and enforcing idempotency keys. Dependencies: ORCH-SVC-32-004. | Needs 32-004 | | -| ORCH-SVC-33-001 | TODO | | SPRINT_152_orchestrator_ii | Orchestrator Service Guild | src/Orchestrator/StellaOps.Orchestrator | Enable `sources test. Dependencies: ORCH-SVC-32-005. | Needs ORSC0101 worker contract | | -| ORCH-SVC-33-002 | TODO | | SPRINT_152_orchestrator_ii | Orchestrator Service Guild | src/Orchestrator/StellaOps.Orchestrator | Implement per-source/tenant adaptive token-bucket rate limiter, concurrency caps, and backpressure signals reacting to upstream 429/503. Dependencies: ORCH-SVC-33-001. | Depends on 33-001 | | -| ORCH-SVC-33-003 | TODO | | SPRINT_152_orchestrator_ii | Orchestrator Service Guild | src/Orchestrator/StellaOps.Orchestrator | Add watermark/backfill manager with event-time windows, duplicate suppression, dry-run preview endpoint, and safety validations. Dependencies: ORCH-SVC-33-002. | Needs 33-002 | | -| ORCH-SVC-33-004 | TODO | | SPRINT_152_orchestrator_ii | Orchestrator Service Guild | src/Orchestrator/StellaOps.Orchestrator | Deliver dead-letter store, replay endpoints, and error classification surfaces with remediation hints + notification hooks. Dependencies: ORCH-SVC-33-003. | Depends on 33-003 | | -| ORCH-SVC-34-001 | TODO | | SPRINT_152_orchestrator_ii | Orchestrator Service Guild | src/Orchestrator/StellaOps.Orchestrator | Implement quota management APIs, per-tenant SLO burn-rate computation, and alert budget tracking surfaced via metrics. Dependencies: ORCH-SVC-33-004. | Requires 33-004 | | -| ORCH-SVC-34-002 | TODO | | SPRINT_152_orchestrator_ii | Orchestrator Service Guild | src/Orchestrator/StellaOps.Orchestrator | Build audit log + immutable run ledger export with signed manifest support, including provenance chain to artifacts. Dependencies: ORCH-SVC-34-001. | Needs ORCH-SVC-34-001 | | -| ORCH-SVC-34-003 | TODO | | SPRINT_152_orchestrator_ii | Orchestrator Service Guild | src/Orchestrator/StellaOps.Orchestrator | Execute perf/scale validation (≥10k pending jobs, dispatch P95 <150 ms) and add autoscaling hooks with health probes. Dependencies: ORCH-SVC-34-002. | Depends on 34-002 | | -| ORCH-SVC-34-004 | TODO | | SPRINT_152_orchestrator_ii | Orchestrator Service Guild | src/Orchestrator/StellaOps.Orchestrator | Package orchestrator container, Helm overlays, offline bundle seeds, provenance attestations, and compliance checklist for GA. Dependencies: ORCH-SVC-34-003. | Needs 34-003 | | -| ORCH-SVC-35-101 | TODO | | SPRINT_152_orchestrator_ii | Orchestrator Service Guild | src/Orchestrator/StellaOps.Orchestrator | Register `export` job type with quotas/rate policies, expose telemetry, and ensure exporter workers heartbeat via orchestrator contracts. Dependencies: ORCH-SVC-34-004. | Depends on 34-004 | | -| ORCH-SVC-36-101 | TODO | | SPRINT_152_orchestrator_ii | Orchestrator Service Guild | src/Orchestrator/StellaOps.Orchestrator | Capture distribution metadata and retention timestamps for export jobs, updating dashboards and SSE payloads. Dependencies: ORCH-SVC-35-101. | Needs 35-101 job type registered | | -| ORCH-SVC-37-101 | TODO | | SPRINT_152_orchestrator_ii | Orchestrator Service Guild | src/Orchestrator/StellaOps.Orchestrator | Enable scheduled export runs, retention pruning hooks, and failure alerting tied to export job class. Dependencies: ORCH-SVC-36-101. | Depends on 36-101 | | +| ORCH-SVC-32-002 | TODO | | SPRINT_0152_0000_0002_orchestrator_ii | Orchestrator Service Guild | src/Orchestrator/StellaOps.Orchestrator | Implement scheduler DAG planner + dependency resolver, job state machine, and critical-path metadata without yet issuing control actions. Dependencies: ORCH-SVC-32-001. | Needs 32-001 DB | | +| ORCH-SVC-32-003 | TODO | | SPRINT_0152_0000_0002_orchestrator_ii | Orchestrator Service Guild | src/Orchestrator/StellaOps.Orchestrator | Expose read-only REST APIs (sources, runs, jobs, DAG) with OpenAPI, validation, pagination, and tenant scoping. Dependencies: ORCH-SVC-32-002. | Depends on 32-002 | | +| ORCH-SVC-32-004 | TODO | | SPRINT_0152_0000_0002_orchestrator_ii | Orchestrator Service Guild | src/Orchestrator/StellaOps.Orchestrator | Implement WebSocket/SSE stream for job/run updates, emit structured metrics counters/histograms, and add health probes. Dependencies: ORCH-SVC-32-003. | Needs 32-003 | | +| ORCH-SVC-32-005 | TODO | | SPRINT_0152_0000_0002_orchestrator_ii | Orchestrator Service Guild | src/Orchestrator/StellaOps.Orchestrator | Deliver worker claim/heartbeat/progress endpoints capturing artifact metadata/checksums and enforcing idempotency keys. Dependencies: ORCH-SVC-32-004. | Needs 32-004 | | +| ORCH-SVC-33-001 | TODO | | SPRINT_0152_0000_0002_orchestrator_ii | Orchestrator Service Guild | src/Orchestrator/StellaOps.Orchestrator | Enable `sources test. Dependencies: ORCH-SVC-32-005. | Needs ORSC0101 worker contract | | +| ORCH-SVC-33-002 | TODO | | SPRINT_0152_0000_0002_orchestrator_ii | Orchestrator Service Guild | src/Orchestrator/StellaOps.Orchestrator | Implement per-source/tenant adaptive token-bucket rate limiter, concurrency caps, and backpressure signals reacting to upstream 429/503. Dependencies: ORCH-SVC-33-001. | Depends on 33-001 | | +| ORCH-SVC-33-003 | TODO | | SPRINT_0152_0000_0002_orchestrator_ii | Orchestrator Service Guild | src/Orchestrator/StellaOps.Orchestrator | Add watermark/backfill manager with event-time windows, duplicate suppression, dry-run preview endpoint, and safety validations. Dependencies: ORCH-SVC-33-002. | Needs 33-002 | | +| ORCH-SVC-33-004 | TODO | | SPRINT_0152_0000_0002_orchestrator_ii | Orchestrator Service Guild | src/Orchestrator/StellaOps.Orchestrator | Deliver dead-letter store, replay endpoints, and error classification surfaces with remediation hints + notification hooks. Dependencies: ORCH-SVC-33-003. | Depends on 33-003 | | +| ORCH-SVC-34-001 | TODO | | SPRINT_0152_0000_0002_orchestrator_ii | Orchestrator Service Guild | src/Orchestrator/StellaOps.Orchestrator | Implement quota management APIs, per-tenant SLO burn-rate computation, and alert budget tracking surfaced via metrics. Dependencies: ORCH-SVC-33-004. | Requires 33-004 | | +| ORCH-SVC-34-002 | TODO | | SPRINT_0152_0000_0002_orchestrator_ii | Orchestrator Service Guild | src/Orchestrator/StellaOps.Orchestrator | Build audit log + immutable run ledger export with signed manifest support, including provenance chain to artifacts. Dependencies: ORCH-SVC-34-001. | Needs ORCH-SVC-34-001 | | +| ORCH-SVC-34-003 | TODO | | SPRINT_0152_0000_0002_orchestrator_ii | Orchestrator Service Guild | src/Orchestrator/StellaOps.Orchestrator | Execute perf/scale validation (≥10k pending jobs, dispatch P95 <150 ms) and add autoscaling hooks with health probes. Dependencies: ORCH-SVC-34-002. | Depends on 34-002 | | +| ORCH-SVC-34-004 | TODO | | SPRINT_0152_0000_0002_orchestrator_ii | Orchestrator Service Guild | src/Orchestrator/StellaOps.Orchestrator | Package orchestrator container, Helm overlays, offline bundle seeds, provenance attestations, and compliance checklist for GA. Dependencies: ORCH-SVC-34-003. | Needs 34-003 | | +| ORCH-SVC-35-101 | TODO | | SPRINT_0152_0000_0002_orchestrator_ii | Orchestrator Service Guild | src/Orchestrator/StellaOps.Orchestrator | Register `export` job type with quotas/rate policies, expose telemetry, and ensure exporter workers heartbeat via orchestrator contracts. Dependencies: ORCH-SVC-34-004. | Depends on 34-004 | | +| ORCH-SVC-36-101 | TODO | | SPRINT_0152_0000_0002_orchestrator_ii | Orchestrator Service Guild | src/Orchestrator/StellaOps.Orchestrator | Capture distribution metadata and retention timestamps for export jobs, updating dashboards and SSE payloads. Dependencies: ORCH-SVC-35-101. | Needs 35-101 job type registered | | +| ORCH-SVC-37-101 | TODO | | SPRINT_0152_0000_0002_orchestrator_ii | Orchestrator Service Guild | src/Orchestrator/StellaOps.Orchestrator | Enable scheduled export runs, retention pruning hooks, and failure alerting tied to export job class. Dependencies: ORCH-SVC-36-101. | Depends on 36-101 | | | ORCH-SVC-38-101 | DOING | | SPRINT_0153_0001_0003_orchestrator_iii | Orchestrator Service Guild | src/Orchestrator/StellaOps.Orchestrator | Standardize event envelope (policy/export/job lifecycle) with idempotency keys, ensure export/job failure events published to notifier bus with provenance metadata. Dependencies: ORCH-SVC-37-101. | Needs 37-101 | | | ORCH-SVC-41-101 | TODO | | SPRINT_0153_0001_0003_orchestrator_iii | Orchestrator Service Guild | src/Orchestrator/StellaOps.Orchestrator | Register `pack-run` job type, persist run metadata, integrate logs/artifacts collection, and expose API for Task Runner scheduling. Dependencies: ORCH-SVC-38-101. | Depends on 38-101 | | | ORCH-SVC-42-101 | TODO | | SPRINT_0153_0001_0003_orchestrator_iii | Orchestrator Service Guild | src/Orchestrator/StellaOps.Orchestrator | Stream pack run logs via SSE/WS, add manifest endpoints, enforce quotas, and emit pack run events to Notifications Studio. Dependencies: ORCH-SVC-41-101. | Needs 41-101 | | @@ -3527,8 +3527,8 @@ | PACKS-REG-41-001 | DONE (2025-11-25) | 2025-11-25 | SPRINT_0154_0001_0001_packsregistry | Packs Registry Guild | src/PacksRegistry/StellaOps.PacksRegistry | Implement registry service, migrations for `packs_index`, `parity_matrix`, provenance docs; support pack upload/list/get, signature verification, RBAC enforcement, and provenance manifest storage. | Needs ORSC0104 event feeds | | | PACKS-REG-42-001 | DONE (2025-11-25) | 2025-11-25 | SPRINT_0154_0001_0001_packsregistry | Packs Registry Guild | src/PacksRegistry/StellaOps.PacksRegistry | Add version lifecycle (promote/deprecate), tenant allowlists, provenance export, signature rotation, audit logs, and Offline Kit seed support. Dependencies: PACKS-REG-41-001. | Depends on 41-001 | | | PACKS-REG-43-001 | DONE (2025-11-25) | 2025-11-25 | SPRINT_0154_0001_0001_packsregistry | Packs Registry Guild | src/PacksRegistry/StellaOps.PacksRegistry | Implement registry mirroring, pack signing policies, attestation integration, and compliance dashboards; integrate with Export Center. Dependencies: PACKS-REG-42-001. | Needs 42-001 | | -| PARITY-41-001 | TODO | | SPRINT_203_cli_iii | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Propagate `traceparent`/correlation IDs across CLI commands and verbose output. | Needs NOWB0101 gateway trace headers | | -| PARITY-41-002 | TODO | | SPRINT_203_cli_iii | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Add parity tests + docs ensuring CLI error output matches web/notify formats. | Depends on 41-001 | | +| PARITY-41-001 | TODO | | SPRINT_0203_0000_0003_cli_iii | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Propagate `traceparent`/correlation IDs across CLI commands and verbose output. | Needs NOWB0101 gateway trace headers | | +| PARITY-41-002 | TODO | | SPRINT_0203_0000_0003_cli_iii | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Add parity tests + docs ensuring CLI error output matches web/notify formats. | Depends on 41-001 | | | PLATFORM-DOCS-0001 | TODO | | SPRINT_324_docs_modules_platform | Docs Guild | docs/modules/platform | See ./AGENTS.md | Needs updated wave list | | | PLATFORM-ENG-0001 | TODO | | SPRINT_324_docs_modules_platform | Module Team | docs/modules/platform | Update status via ./AGENTS.md workflow | Depends on 0001 | | | PLATFORM-OPS-0001 | TODO | | SPRINT_324_docs_modules_platform | Ops Guild | docs/modules/platform | Sync outcomes back to ../.. | Requires ops checklist inputs | | @@ -3549,19 +3549,19 @@ | POLICY-23-001 | TODO | | SPRINT_115_concelier_iv | Concelier Core Guild (src/Concelier/__Libraries/StellaOps.Concelier.Core) | src/Concelier/__Libraries/StellaOps.Concelier.Core | | | | | POLICY-23-002 | TODO | | SPRINT_115_concelier_iv | Concelier Core Guild, Platform Events Guild (src/Concelier/__Libraries/StellaOps.Concelier.Core) | src/Concelier/__Libraries/StellaOps.Concelier.Core | | | | | POLICY-23-003 | TODO | | SPRINT_0210_0001_0002_ui_ii | UI Guild (src/UI/StellaOps.UI) | src/UI/StellaOps.UI | | | | -| POLICY-23-004 | TODO | | SPRINT_203_cli_iii | DevEx/CLI Guild (src/Cli/StellaOps.Cli) | src/Cli/StellaOps.Cli | | | | +| POLICY-23-004 | TODO | | SPRINT_0203_0000_0003_cli_iii | DevEx/CLI Guild (src/Cli/StellaOps.Cli) | src/Cli/StellaOps.Cli | | | | | POLICY-23-005 | TODO | | SPRINT_0210_0001_0002_ui_ii | UI Guild (src/UI/StellaOps.UI) | src/UI/StellaOps.UI | | | | -| POLICY-23-006 | TODO | | SPRINT_203_cli_iii | DevEx/CLI Guild (src/Cli/StellaOps.Cli) | src/Cli/StellaOps.Cli | | | | +| POLICY-23-006 | TODO | | SPRINT_0203_0000_0003_cli_iii | DevEx/CLI Guild (src/Cli/StellaOps.Cli) | src/Cli/StellaOps.Cli | | | | | POLICY-23-007 | TODO | | SPRINT_0307_0001_0007_docs_tasks_md_vii | Docs Guild, DevEx/CLI Guild (docs) | | | | | | POLICY-23-008 | TODO | | SPRINT_0307_0001_0007_docs_tasks_md_vii | Docs Guild, Architecture Guild (docs) | | | | | | POLICY-23-009 | TODO | | SPRINT_0307_0001_0007_docs_tasks_md_vii | Docs Guild, DevOps Guild (docs) | | | | | | POLICY-23-010 | TODO | | SPRINT_0307_0001_0007_docs_tasks_md_vii | Docs Guild, UI Guild (docs) | | | | | -| POLICY-27-001 | TODO | | SPRINT_203_cli_iii | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Implement workspace commands (`init`, `edit`, `lint`, `compile`, `test`) with deterministic caches + JSON output. | Needs CLI pack templates from CLCI0106 | | -| POLICY-27-002 | TODO | | SPRINT_204_cli_iv | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Add submission/review workflow commands (`version bump`, `submit`, `comment`, `approve/reject`). | Depends on Policy Registry endpoints | | -| POLICY-27-003 | TODO | | SPRINT_204_cli_iv | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Implement `stella policy simulate` enhancements (quick/batch, SBOM selectors, heatmap diff, JSON/Markdown outputs). | Waiting on CLPS0101 submission scaffolding | | -| POLICY-27-004 | TODO | | SPRINT_204_cli_iv | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Add lifecycle commands for publish/promote/rollback/sign with attestation checks. | Depends on 27-003 | | -| POLICY-27-005 | TODO | | SPRINT_204_cli_iv | DevEx/CLI Guild · Docs Guild | src/Cli/StellaOps.Cli | Update CLI refs/samples (JSON schemas, exit codes, CI snippets). | Requires 27-004 output | | -| POLICY-27-006 | TODO | | SPRINT_204_cli_iv | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Update policy scopes/help text to request new Policy Studio scope family and adjust regression tests. | Needs 27-005 docs | | +| POLICY-27-001 | TODO | | SPRINT_0203_0000_0003_cli_iii | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Implement workspace commands (`init`, `edit`, `lint`, `compile`, `test`) with deterministic caches + JSON output. | Needs CLI pack templates from CLCI0106 | | +| POLICY-27-002 | TODO | | SPRINT_0204_0000_0004_cli_iv | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Add submission/review workflow commands (`version bump`, `submit`, `comment`, `approve/reject`). | Depends on Policy Registry endpoints | | +| POLICY-27-003 | TODO | | SPRINT_0204_0000_0004_cli_iv | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Implement `stella policy simulate` enhancements (quick/batch, SBOM selectors, heatmap diff, JSON/Markdown outputs). | Waiting on CLPS0101 submission scaffolding | | +| POLICY-27-004 | TODO | | SPRINT_0204_0000_0004_cli_iv | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Add lifecycle commands for publish/promote/rollback/sign with attestation checks. | Depends on 27-003 | | +| POLICY-27-005 | TODO | | SPRINT_0204_0000_0004_cli_iv | DevEx/CLI Guild · Docs Guild | src/Cli/StellaOps.Cli | Update CLI refs/samples (JSON schemas, exit codes, CI snippets). | Requires 27-004 output | | +| POLICY-27-006 | TODO | | SPRINT_0204_0000_0004_cli_iv | DevEx/CLI Guild | src/Cli/StellaOps.Cli | Update policy scopes/help text to request new Policy Studio scope family and adjust regression tests. | Needs 27-005 docs | | | POLICY-27-007 | BLOCKED | 2025-10-27 | SPRINT_0308_0001_0008_docs_tasks_md_viii | Docs Guild, DevEx/CLI Guild (docs) | | | | | | POLICY-27-008 | BLOCKED | 2025-10-27 | SPRINT_0308_0001_0008_docs_tasks_md_viii | Docs Guild, Policy Registry Guild (docs) | | | | | | POLICY-27-009 | BLOCKED | 2025-10-27 | SPRINT_0308_0001_0008_docs_tasks_md_viii | Docs Guild, Security Guild (docs) | | | | | @@ -3571,20 +3571,20 @@ | POLICY-27-013 | BLOCKED | 2025-10-27 | SPRINT_0308_0001_0008_docs_tasks_md_viii | Docs Guild, Policy Guild (docs) | | | | | | POLICY-27-014 | BLOCKED | 2025-10-27 | SPRINT_0308_0001_0008_docs_tasks_md_viii | Docs Guild, Policy Registry Guild (docs) | | | | | | POLICY-401-026 | TODO | | SPRINT_0401_0001_0001_reachability_evidence_chain | Policy Guild · Concelier Guild (`docs/policy/dsl.md`, `docs/uncertainty/README.md`) | `docs/policy/dsl.md`, `docs/uncertainty/README.md` | | | | -| POLICY-AIRGAP-56-001 | TODO | | SPRINT_123_policy_reasoning | Policy Guild | src/Policy/StellaOps.Policy.Engine | Support policy pack imports from Mirror Bundles, track `bundle_id` metadata, and ensure deterministic caching | Needs OFFK0101 bundle schema | | -| POLICY-AIRGAP-56-002 | TODO | | SPRINT_123_policy_reasoning | Policy Guild · Policy Studio Guild | src/Policy/StellaOps.Policy.Engine | Export policy sub-bundles | POLICY-AIRGAP-56-001 | | -| POLICY-AIRGAP-57-001 | TODO | | SPRINT_123_policy_reasoning | Policy Guild · Export Center Guild | src/Policy/StellaOps.Policy.Engine | Enforce sealed-mode guardrails in evaluation | POLICY-AIRGAP-56-002 | | -| POLICY-AIRGAP-57-002 | TODO | | SPRINT_123_policy_reasoning | Policy Guild · Notifications Guild | src/Policy/StellaOps.Policy.Engine | Annotate rule explanations with staleness information and fallback data | POLICY-AIRGAP-57-001 | | -| POLICY-AIRGAP-58-001 | TODO | | SPRINT_123_policy_reasoning | Policy Guild · Platform Ops | src/Policy/StellaOps.Policy.Engine | Emit notifications when policy packs near staleness thresholds or missing required bundles | POLICY-AIRGAP-57-002 | | -| POLICY-AOC-19-001 | TODO | | SPRINT_123_policy_reasoning | Policy Guild / src/Policy/__Libraries/StellaOps.Policy | src/Policy/__Libraries/StellaOps.Policy | Add Roslyn/CI lint preventing ingestion projects from referencing Policy merge/severity helpers; block forbidden writes at compile time | | | -| POLICY-AOC-19-002 | TODO | | SPRINT_123_policy_reasoning | Policy Guild, Platform Security / src/Policy/__Libraries/StellaOps.Policy | src/Policy/__Libraries/StellaOps.Policy | Enforce `effective_finding_*` write gate ensuring only Policy Engine identity can create/update materializations | POLICY-AOC-19-001 | | -| POLICY-AOC-19-003 | TODO | | SPRINT_123_policy_reasoning | Policy Guild / src/Policy/__Libraries/StellaOps.Policy | src/Policy/__Libraries/StellaOps.Policy | Update readers/processors to consume only `content.raw`, `identifiers`, and `linkset`. Remove dependencies on legacy normalized fields and refresh fixtures | POLICY-AOC-19-002 | | -| POLICY-AOC-19-004 | TODO | | SPRINT_123_policy_reasoning | Policy Guild, QA Guild / src/Policy/__Libraries/StellaOps.Policy | src/Policy/__Libraries/StellaOps.Policy | Add regression tests ensuring policy derived outputs remain deterministic when ingesting revised raw docs | POLICY-AOC-19-003 | | -| POLICY-ATTEST-73-001 | TODO | | SPRINT_123_policy_reasoning | Policy Guild, Attestor Service Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Introduce VerificationPolicy object: schema, persistence, versioning, and lifecycle | | | -| POLICY-ATTEST-73-002 | TODO | | SPRINT_123_policy_reasoning | Policy Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Provide Policy Studio editor with validation, dry-run simulation, and version diff | POLICY-ATTEST-73-001 | | -| POLICY-ATTEST-74-001 | TODO | | SPRINT_123_policy_reasoning | Policy Guild, Attestor Service Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Integrate verification policies into attestor verification pipeline with caching and waiver support | POLICY-ATTEST-73-002 | | -| POLICY-ATTEST-74-002 | TODO | | SPRINT_123_policy_reasoning | Policy Guild, Console Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Surface policy evaluations in Console verification reports with rule explanations | POLICY-ATTEST-74-001 | | -| POLICY-CONSOLE-23-001 | TODO | | SPRINT_123_policy_reasoning | Policy Guild, BE-Base Platform Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Optimize findings/explain APIs for Console: cursor-based pagination at scale, global filter parameters (severity bands, policy version, time window), rule trace summarization, and aggregation hints for dashboard cards. Ensure deterministic ordering and expose provenance refs | | | +| POLICY-AIRGAP-56-001 | TODO | | SPRINT_0123_0000_0001_policy_reasoning | Policy Guild | src/Policy/StellaOps.Policy.Engine | Support policy pack imports from Mirror Bundles, track `bundle_id` metadata, and ensure deterministic caching | Needs OFFK0101 bundle schema | | +| POLICY-AIRGAP-56-002 | TODO | | SPRINT_0123_0000_0001_policy_reasoning | Policy Guild · Policy Studio Guild | src/Policy/StellaOps.Policy.Engine | Export policy sub-bundles | POLICY-AIRGAP-56-001 | | +| POLICY-AIRGAP-57-001 | TODO | | SPRINT_0123_0000_0001_policy_reasoning | Policy Guild · Export Center Guild | src/Policy/StellaOps.Policy.Engine | Enforce sealed-mode guardrails in evaluation | POLICY-AIRGAP-56-002 | | +| POLICY-AIRGAP-57-002 | TODO | | SPRINT_0123_0000_0001_policy_reasoning | Policy Guild · Notifications Guild | src/Policy/StellaOps.Policy.Engine | Annotate rule explanations with staleness information and fallback data | POLICY-AIRGAP-57-001 | | +| POLICY-AIRGAP-58-001 | TODO | | SPRINT_0123_0000_0001_policy_reasoning | Policy Guild · Platform Ops | src/Policy/StellaOps.Policy.Engine | Emit notifications when policy packs near staleness thresholds or missing required bundles | POLICY-AIRGAP-57-002 | | +| POLICY-AOC-19-001 | TODO | | SPRINT_0123_0000_0001_policy_reasoning | Policy Guild / src/Policy/__Libraries/StellaOps.Policy | src/Policy/__Libraries/StellaOps.Policy | Add Roslyn/CI lint preventing ingestion projects from referencing Policy merge/severity helpers; block forbidden writes at compile time | | | +| POLICY-AOC-19-002 | TODO | | SPRINT_0123_0000_0001_policy_reasoning | Policy Guild, Platform Security / src/Policy/__Libraries/StellaOps.Policy | src/Policy/__Libraries/StellaOps.Policy | Enforce `effective_finding_*` write gate ensuring only Policy Engine identity can create/update materializations | POLICY-AOC-19-001 | | +| POLICY-AOC-19-003 | TODO | | SPRINT_0123_0000_0001_policy_reasoning | Policy Guild / src/Policy/__Libraries/StellaOps.Policy | src/Policy/__Libraries/StellaOps.Policy | Update readers/processors to consume only `content.raw`, `identifiers`, and `linkset`. Remove dependencies on legacy normalized fields and refresh fixtures | POLICY-AOC-19-002 | | +| POLICY-AOC-19-004 | TODO | | SPRINT_0123_0000_0001_policy_reasoning | Policy Guild, QA Guild / src/Policy/__Libraries/StellaOps.Policy | src/Policy/__Libraries/StellaOps.Policy | Add regression tests ensuring policy derived outputs remain deterministic when ingesting revised raw docs | POLICY-AOC-19-003 | | +| POLICY-ATTEST-73-001 | TODO | | SPRINT_0123_0000_0001_policy_reasoning | Policy Guild, Attestor Service Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Introduce VerificationPolicy object: schema, persistence, versioning, and lifecycle | | | +| POLICY-ATTEST-73-002 | TODO | | SPRINT_0123_0000_0001_policy_reasoning | Policy Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Provide Policy Studio editor with validation, dry-run simulation, and version diff | POLICY-ATTEST-73-001 | | +| POLICY-ATTEST-74-001 | TODO | | SPRINT_0123_0000_0001_policy_reasoning | Policy Guild, Attestor Service Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Integrate verification policies into attestor verification pipeline with caching and waiver support | POLICY-ATTEST-73-002 | | +| POLICY-ATTEST-74-002 | TODO | | SPRINT_0123_0000_0001_policy_reasoning | Policy Guild, Console Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Surface policy evaluations in Console verification reports with rule explanations | POLICY-ATTEST-74-001 | | +| POLICY-CONSOLE-23-001 | TODO | | SPRINT_0123_0000_0001_policy_reasoning | Policy Guild, BE-Base Platform Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Optimize findings/explain APIs for Console: cursor-based pagination at scale, global filter parameters (severity bands, policy version, time window), rule trace summarization, and aggregation hints for dashboard cards. Ensure deterministic ordering and expose provenance refs | | | | POLICY-CONSOLE-23-002 | TODO | | SPRINT_124_policy_reasoning | Policy Guild, Product Ops / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Produce simulation diff metadata | POLICY-CONSOLE-23-001 | | | POLICY-ENGINE-20-002 | BLOCKED | 2025-10-26 | SPRINT_124_policy_reasoning | Policy Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Build deterministic evaluator honoring lexical/priority order, first-match semantics, and safe value types (no wall-clock/network access) | PGMI0101 | PLPE0101 | | POLICY-ENGINE-20-003 | TODO | | SPRINT_124_policy_reasoning | Policy Guild, Concelier Core Guild, Excititor Core Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Implement selection joiners resolving SBOM↔advisory↔VEX tuples using linksets and PURL equivalence tables, with deterministic batching | POLICY-ENGINE-20-002 | PLPE0101 | @@ -3598,74 +3598,74 @@ | POLICY-ENGINE-27-002 | TODO | | SPRINT_124_policy_reasoning | Policy Guild, Observability Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Enhance simulate endpoints to emit rule firing counts, heatmap aggregates, sampled explain traces with deterministic ordering, and delta summaries for quick/batch sims | POLICY-ENGINE-27-001 | PLPE0101 | | POLICY-ENGINE-29-001 | TODO | | SPRINT_124_policy_reasoning | Policy Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Implement batch evaluation endpoint | POLICY-ENGINE-27-004 | PLPE0102 | | POLICY-ENGINE-29-002 | TODO | | SPRINT_124_policy_reasoning | Policy Guild, Findings Ledger Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Provide streaming simulation API comparing two policy versions, returning per-finding deltas without writes; align determinism with Vuln Explorer simulation | POLICY-ENGINE-29-001 | PLPE0102 | -| POLICY-ENGINE-29-003 | TODO | | SPRINT_125_policy_reasoning | Policy Guild, SBOM Service Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Surface path/scope awareness in determinations | POLICY-ENGINE-29-002 | PLPE0102 | -| POLICY-ENGINE-29-004 | TODO | | SPRINT_125_policy_reasoning | Policy Guild, Observability Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Add metrics/logs for batch evaluation | POLICY-ENGINE-29-003 | PLPE0102 | -| POLICY-ENGINE-30-001 | TODO | | SPRINT_125_policy_reasoning | Policy Guild, Cartographer Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Define overlay contract for graph nodes/edges | POLICY-ENGINE-29-004 | PLPE0102 | -| POLICY-ENGINE-30-002 | TODO | | SPRINT_125_policy_reasoning | Policy Guild, Cartographer Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Implement simulation bridge returning on-the-fly overlays for Cartographer/Graph Explorer when invoking Policy Engine simulate; ensure no writes and deterministic outputs | POLICY-ENGINE-30-001 | PLPE0102 | -| POLICY-ENGINE-30-003 | TODO | | SPRINT_125_policy_reasoning | Policy Guild, Scheduler Guild, Cartographer Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Emit change events | POLICY-ENGINE-30-002 | PLPE0102 | -| POLICY-ENGINE-30-101 | TODO | | SPRINT_125_policy_reasoning | Policy Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Surface trust weighting configuration | POLICY-ENGINE-30-003 | PLPE0102 | -| POLICY-ENGINE-31-001 | TODO | | SPRINT_125_policy_reasoning | Policy Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Expose policy knobs for Advisory AI | POLICY-ENGINE-30-101 | PLPE0102 | -| POLICY-ENGINE-31-002 | TODO | | SPRINT_125_policy_reasoning | Policy Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Provide batch endpoint delivering policy context | POLICY-ENGINE-31-001 | PLPE0103 | -| POLICY-ENGINE-32-101 | TODO | | SPRINT_125_policy_reasoning | Policy Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Define orchestrator `policy_eval` job schema, idempotency keys, and enqueue hooks triggered by advisory/VEX/SBOM events | POLICY-ENGINE-31-002 | PLPE0103 | -| POLICY-ENGINE-33-101 | TODO | | SPRINT_125_policy_reasoning | Policy Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Implement orchestrator-driven policy evaluation workers using SDK heartbeats, respecting throttles, and emitting SLO metrics | POLICY-ENGINE-32-101 | PLPE0103 | -| POLICY-ENGINE-34-101 | TODO | | SPRINT_125_policy_reasoning | Policy Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Publish policy run ledger exports + SLO burn-rate metrics to orchestrator; ensure provenance chain links to Findings Ledger | POLICY-ENGINE-33-101 | PLPE0103 | -| POLICY-ENGINE-35-201 | TODO | | SPRINT_125_policy_reasoning | Policy Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Expose deterministic policy snapshot API and evaluated findings stream keyed by policy version for exporter consumption | POLICY-ENGINE-34-101 | PLPE0103 | -| POLICY-ENGINE-38-201 | TODO | | SPRINT_125_policy_reasoning | Policy Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Emit enriched policy violation events | POLICY-ENGINE-35-201 | PLPE0103 | -| POLICY-ENGINE-40-001 | TODO | | SPRINT_125_policy_reasoning | Policy Guild, Concelier Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Update severity/status evaluation pipelines to consume multiple source severities per linkset, supporting selection strategies | POLICY-ENGINE-38-201 | PLPE0103 | -| POLICY-ENGINE-40-002 | TODO | | SPRINT_125_policy_reasoning | Policy Guild, Excititor Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Accept VEX linkset conflicts and provide rationale references in effective findings; ensure explain traces cite observation IDs | POLICY-ENGINE-40-001 | PLPE0103 | -| POLICY-ENGINE-40-003 | TODO | | SPRINT_126_policy_reasoning | Policy Guild, Web Scanner Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Provide API/SDK utilities for consumers | POLICY-ENGINE-40-002 | PLPE0103 | +| POLICY-ENGINE-29-003 | TODO | | SPRINT_0125_0000_0001_policy_reasoning | Policy Guild, SBOM Service Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Surface path/scope awareness in determinations | POLICY-ENGINE-29-002 | PLPE0102 | +| POLICY-ENGINE-29-004 | TODO | | SPRINT_0125_0000_0001_policy_reasoning | Policy Guild, Observability Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Add metrics/logs for batch evaluation | POLICY-ENGINE-29-003 | PLPE0102 | +| POLICY-ENGINE-30-001 | TODO | | SPRINT_0125_0000_0001_policy_reasoning | Policy Guild, Cartographer Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Define overlay contract for graph nodes/edges | POLICY-ENGINE-29-004 | PLPE0102 | +| POLICY-ENGINE-30-002 | TODO | | SPRINT_0125_0000_0001_policy_reasoning | Policy Guild, Cartographer Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Implement simulation bridge returning on-the-fly overlays for Cartographer/Graph Explorer when invoking Policy Engine simulate; ensure no writes and deterministic outputs | POLICY-ENGINE-30-001 | PLPE0102 | +| POLICY-ENGINE-30-003 | TODO | | SPRINT_0125_0000_0001_policy_reasoning | Policy Guild, Scheduler Guild, Cartographer Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Emit change events | POLICY-ENGINE-30-002 | PLPE0102 | +| POLICY-ENGINE-30-101 | TODO | | SPRINT_0125_0000_0001_policy_reasoning | Policy Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Surface trust weighting configuration | POLICY-ENGINE-30-003 | PLPE0102 | +| POLICY-ENGINE-31-001 | TODO | | SPRINT_0125_0000_0001_policy_reasoning | Policy Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Expose policy knobs for Advisory AI | POLICY-ENGINE-30-101 | PLPE0102 | +| POLICY-ENGINE-31-002 | TODO | | SPRINT_0125_0000_0001_policy_reasoning | Policy Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Provide batch endpoint delivering policy context | POLICY-ENGINE-31-001 | PLPE0103 | +| POLICY-ENGINE-32-101 | TODO | | SPRINT_0125_0000_0001_policy_reasoning | Policy Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Define orchestrator `policy_eval` job schema, idempotency keys, and enqueue hooks triggered by advisory/VEX/SBOM events | POLICY-ENGINE-31-002 | PLPE0103 | +| POLICY-ENGINE-33-101 | TODO | | SPRINT_0125_0000_0001_policy_reasoning | Policy Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Implement orchestrator-driven policy evaluation workers using SDK heartbeats, respecting throttles, and emitting SLO metrics | POLICY-ENGINE-32-101 | PLPE0103 | +| POLICY-ENGINE-34-101 | TODO | | SPRINT_0125_0000_0001_policy_reasoning | Policy Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Publish policy run ledger exports + SLO burn-rate metrics to orchestrator; ensure provenance chain links to Findings Ledger | POLICY-ENGINE-33-101 | PLPE0103 | +| POLICY-ENGINE-35-201 | TODO | | SPRINT_0125_0000_0001_policy_reasoning | Policy Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Expose deterministic policy snapshot API and evaluated findings stream keyed by policy version for exporter consumption | POLICY-ENGINE-34-101 | PLPE0103 | +| POLICY-ENGINE-38-201 | TODO | | SPRINT_0125_0000_0001_policy_reasoning | Policy Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Emit enriched policy violation events | POLICY-ENGINE-35-201 | PLPE0103 | +| POLICY-ENGINE-40-001 | TODO | | SPRINT_0125_0000_0001_policy_reasoning | Policy Guild, Concelier Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Update severity/status evaluation pipelines to consume multiple source severities per linkset, supporting selection strategies | POLICY-ENGINE-38-201 | PLPE0103 | +| POLICY-ENGINE-40-002 | TODO | | SPRINT_0125_0000_0001_policy_reasoning | Policy Guild, Excititor Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Accept VEX linkset conflicts and provide rationale references in effective findings; ensure explain traces cite observation IDs | POLICY-ENGINE-40-001 | PLPE0103 | +| POLICY-ENGINE-40-003 | TODO | | SPRINT_0126_0000_0001_policy_reasoning | Policy Guild, Web Scanner Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Provide API/SDK utilities for consumers | POLICY-ENGINE-40-002 | PLPE0103 | | POLICY-ENGINE-401-003 | TODO | | SPRINT_0401_0001_0001_reachability_evidence_chain | Policy Guild (`src/Policy/StellaOps.Policy.Engine`, `docs/modules/policy/architecture.md`) | `src/Policy/StellaOps.Policy.Engine`, `docs/modules/policy/architecture.md` | Replace in-service DSL compilation with the shared library, support both legacy `stella-dsl@1` packs and the new inline syntax, and keep determinism hashes stable. | — | PLPE0103 | -| POLICY-ENGINE-50-001 | TODO | | SPRINT_126_policy_reasoning | Policy Guild, Platform Security / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Implement SPL compiler: validate YAML, canonicalize, produce signed bundle, store artifact in object storage, write `policy_revisions` with AOC metadata | POLICY-ENGINE-40-003 | PLPE0104 | -| POLICY-ENGINE-50-002 | TODO | | SPRINT_126_policy_reasoning | Policy Guild, Runtime Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Build runtime evaluator executing compiled plans over advisory/vex linksets + SBOM asset metadata with deterministic caching | POLICY-ENGINE-50-001 | PLPE0104 | -| POLICY-ENGINE-50-003 | TODO | | SPRINT_126_policy_reasoning | Policy Guild, Observability Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Implement evaluation/compilation metrics, tracing, and structured logs | POLICY-ENGINE-50-002 | PLPE0104 | -| POLICY-ENGINE-50-004 | TODO | | SPRINT_126_policy_reasoning | Policy Guild, Platform Events Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Build event pipeline: subscribe to linkset/SBOM updates, schedule re-eval jobs, emit `policy.effective.updated` events with diff metadata | POLICY-ENGINE-50-003 | PLPE0104 | -| POLICY-ENGINE-50-005 | TODO | | SPRINT_126_policy_reasoning | Policy Guild, Storage Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Design and implement `policy_packs`, `policy_revisions`, `policy_runs`, `policy_artifacts` collections with indexes, TTL, and tenant scoping | POLICY-ENGINE-50-004 | PLPE0104 | -| POLICY-ENGINE-50-006 | TODO | | SPRINT_126_policy_reasoning | Policy Guild, QA Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Implement explainer persistence + retrieval APIs linking decisions to explanation tree and AOC chain | POLICY-ENGINE-50-005 | PLPE0104 | -| POLICY-ENGINE-50-007 | TODO | | SPRINT_126_policy_reasoning | Policy Guild, Scheduler Worker Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Provide evaluation worker host/DI wiring and job orchestration hooks for batch re-evaluations after policy activation | POLICY-ENGINE-50-006 | PLPE0104 | -| POLICY-ENGINE-60-001 | TODO | | SPRINT_126_policy_reasoning | Policy Guild, SBOM Service Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Maintain Redis effective decision maps per asset/snapshot for Graph overlays; implement versioning and eviction strategy | POLICY-ENGINE-50-007 | PLPE0104 | -| POLICY-ENGINE-60-002 | TODO | | SPRINT_126_policy_reasoning | Policy Guild, BE-Base Platform Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Expose simulation bridge for Graph What-if APIs, supporting hypothetical SBOM diffs and draft policies without persisting results | POLICY-ENGINE-60-001 | PLPE0104 | -| POLICY-ENGINE-70-002 | TODO | | SPRINT_126_policy_reasoning | Policy Guild, Storage Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Design and create Mongo collections | POLICY-ENGINE-60-002 | PLPE0104 | -| POLICY-ENGINE-70-003 | TODO | | SPRINT_126_policy_reasoning | Policy Guild, Runtime Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Build Redis exception decision cache | POLICY-ENGINE-70-002 | | -| POLICY-ENGINE-70-004 | TODO | | SPRINT_126_policy_reasoning | Policy Guild, Observability Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Extend metrics/tracing/logging for exception application | POLICY-ENGINE-70-003 | | -| POLICY-ENGINE-70-005 | TODO | | SPRINT_126_policy_reasoning | Policy Guild, Scheduler Worker Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Provide APIs/workers hook for exception activation/expiry | POLICY-ENGINE-70-004 | | -| POLICY-ENGINE-80-001 | TODO | | SPRINT_126_policy_reasoning | Policy Guild, Signals Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Integrate reachability/exploitability inputs into evaluation pipeline | POLICY-ENGINE-70-005 | | -| POLICY-ENGINE-80-002 | TODO | | SPRINT_127_policy_reasoning | Policy Guild, Storage Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Create joining layer to read `reachability_facts` efficiently | POLICY-ENGINE-80-001 | | -| POLICY-ENGINE-80-003 | TODO | | SPRINT_127_policy_reasoning | Policy Guild, Policy Editor Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Extend SPL predicates/actions to reference reachability state/score/confidence; update compiler validation | POLICY-ENGINE-80-002 | | -| POLICY-ENGINE-80-004 | TODO | | SPRINT_127_policy_reasoning | Policy Guild, Observability Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Emit metrics | POLICY-ENGINE-80-003 | | +| POLICY-ENGINE-50-001 | TODO | | SPRINT_0126_0000_0001_policy_reasoning | Policy Guild, Platform Security / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Implement SPL compiler: validate YAML, canonicalize, produce signed bundle, store artifact in object storage, write `policy_revisions` with AOC metadata | POLICY-ENGINE-40-003 | PLPE0104 | +| POLICY-ENGINE-50-002 | TODO | | SPRINT_0126_0000_0001_policy_reasoning | Policy Guild, Runtime Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Build runtime evaluator executing compiled plans over advisory/vex linksets + SBOM asset metadata with deterministic caching | POLICY-ENGINE-50-001 | PLPE0104 | +| POLICY-ENGINE-50-003 | TODO | | SPRINT_0126_0000_0001_policy_reasoning | Policy Guild, Observability Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Implement evaluation/compilation metrics, tracing, and structured logs | POLICY-ENGINE-50-002 | PLPE0104 | +| POLICY-ENGINE-50-004 | TODO | | SPRINT_0126_0000_0001_policy_reasoning | Policy Guild, Platform Events Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Build event pipeline: subscribe to linkset/SBOM updates, schedule re-eval jobs, emit `policy.effective.updated` events with diff metadata | POLICY-ENGINE-50-003 | PLPE0104 | +| POLICY-ENGINE-50-005 | TODO | | SPRINT_0126_0000_0001_policy_reasoning | Policy Guild, Storage Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Design and implement `policy_packs`, `policy_revisions`, `policy_runs`, `policy_artifacts` collections with indexes, TTL, and tenant scoping | POLICY-ENGINE-50-004 | PLPE0104 | +| POLICY-ENGINE-50-006 | TODO | | SPRINT_0126_0000_0001_policy_reasoning | Policy Guild, QA Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Implement explainer persistence + retrieval APIs linking decisions to explanation tree and AOC chain | POLICY-ENGINE-50-005 | PLPE0104 | +| POLICY-ENGINE-50-007 | TODO | | SPRINT_0126_0000_0001_policy_reasoning | Policy Guild, Scheduler Worker Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Provide evaluation worker host/DI wiring and job orchestration hooks for batch re-evaluations after policy activation | POLICY-ENGINE-50-006 | PLPE0104 | +| POLICY-ENGINE-60-001 | TODO | | SPRINT_0126_0000_0001_policy_reasoning | Policy Guild, SBOM Service Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Maintain Redis effective decision maps per asset/snapshot for Graph overlays; implement versioning and eviction strategy | POLICY-ENGINE-50-007 | PLPE0104 | +| POLICY-ENGINE-60-002 | TODO | | SPRINT_0126_0000_0001_policy_reasoning | Policy Guild, BE-Base Platform Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Expose simulation bridge for Graph What-if APIs, supporting hypothetical SBOM diffs and draft policies without persisting results | POLICY-ENGINE-60-001 | PLPE0104 | +| POLICY-ENGINE-70-002 | TODO | | SPRINT_0126_0000_0001_policy_reasoning | Policy Guild, Storage Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Design and create Mongo collections | POLICY-ENGINE-60-002 | PLPE0104 | +| POLICY-ENGINE-70-003 | TODO | | SPRINT_0126_0000_0001_policy_reasoning | Policy Guild, Runtime Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Build Redis exception decision cache | POLICY-ENGINE-70-002 | | +| POLICY-ENGINE-70-004 | TODO | | SPRINT_0126_0000_0001_policy_reasoning | Policy Guild, Observability Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Extend metrics/tracing/logging for exception application | POLICY-ENGINE-70-003 | | +| POLICY-ENGINE-70-005 | TODO | | SPRINT_0126_0000_0001_policy_reasoning | Policy Guild, Scheduler Worker Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Provide APIs/workers hook for exception activation/expiry | POLICY-ENGINE-70-004 | | +| POLICY-ENGINE-80-001 | TODO | | SPRINT_0126_0000_0001_policy_reasoning | Policy Guild, Signals Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Integrate reachability/exploitability inputs into evaluation pipeline | POLICY-ENGINE-70-005 | | +| POLICY-ENGINE-80-002 | TODO | | SPRINT_0127_0000_0001_policy_reasoning | Policy Guild, Storage Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Create joining layer to read `reachability_facts` efficiently | POLICY-ENGINE-80-001 | | +| POLICY-ENGINE-80-003 | TODO | | SPRINT_0127_0000_0001_policy_reasoning | Policy Guild, Policy Editor Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Extend SPL predicates/actions to reference reachability state/score/confidence; update compiler validation | POLICY-ENGINE-80-002 | | +| POLICY-ENGINE-80-004 | TODO | | SPRINT_0127_0000_0001_policy_reasoning | Policy Guild, Observability Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Emit metrics | POLICY-ENGINE-80-003 | | | POLICY-LIB-401-001 | DONE (2025-11-27) | | SPRINT_0401_0001_0001_reachability_evidence_chain | Policy Guild (`src/Policy/StellaOps.PolicyDsl`, `docs/policy/dsl.md`) | `src/Policy/StellaOps.PolicyDsl`, `docs/policy/dsl.md` | Extract the policy DSL parser/compiler into `StellaOps.PolicyDsl`, add the lightweight syntax (default action + inline rules), and expose `PolicyEngineFactory`/`SignalContext` APIs for reuse. | | Created StellaOps.PolicyDsl library with PolicyEngineFactory, SignalContext, tokenizer, parser, compiler, and IR serialization. | | POLICY-LIB-401-002 | DONE (2025-11-27) | | SPRINT_0401_0001_0001_reachability_evidence_chain | Policy Guild, CLI Guild (`tests/Policy/StellaOps.PolicyDsl.Tests`, `policy/default.dsl`, `docs/policy/lifecycle.md`) | `tests/Policy/StellaOps.PolicyDsl.Tests`, `policy/default.dsl`, `docs/policy/lifecycle.md` | Ship unit-test harness + sample `policy/default.dsl` (table-driven cases) and wire `stella policy lint/simulate` to the shared library. | | Created test harness with 25 unit tests, sample DSL files (minimal.dsl, default.dsl), and wired stella policy lint command to PolicyDsl library. | -| POLICY-OBS-50-001 | TODO | | SPRINT_127_policy_reasoning | Policy Guild · Observability Guild | src/Policy/StellaOps.Policy.Engine | Integrate telemetry core into policy API + worker hosts, ensuring spans/logs cover compile/evaluate flows with `tenant_id`, `policy_version`, `decision_effect`, and trace IDs | Wait for telemetry schema drop (046_TLTY0101) | PLOB0101 | -| POLICY-OBS-51-001 | TODO | | SPRINT_127_policy_reasoning | Policy Guild · DevOps Guild | src/Policy/StellaOps.Policy.Engine | Emit golden-signal metrics | POLICY-OBS-50-001 | PLOB0101 | -| POLICY-OBS-52-001 | TODO | | SPRINT_127_policy_reasoning | Policy Guild | src/Policy/StellaOps.Policy.Engine | Emit timeline events `policy.evaluate.started`, `policy.evaluate.completed`, `policy.decision.recorded` with trace IDs, input digests, and rule summary. Provide contract tests and retry semantics | POLICY-OBS-51-001 | PLOB0101 | -| POLICY-OBS-53-001 | TODO | | SPRINT_127_policy_reasoning | Policy Guild · Evidence Locker Guild | src/Policy/StellaOps.Policy.Engine | Produce evaluation evidence bundles | POLICY-OBS-52-001 | PLOB0101 | -| POLICY-OBS-54-001 | TODO | | SPRINT_127_policy_reasoning | Policy Guild · Provenance Guild | src/Policy/StellaOps.Policy.Engine | Generate DSSE attestations for evaluation outputs, expose `/evaluations/{id}/attestation`, and link attestation IDs in timeline + console. Provide verification harness | POLICY-OBS-53-001 | PLOB0101 | -| POLICY-OBS-55-001 | TODO | | SPRINT_127_policy_reasoning | Policy Guild · DevOps Guild | src/Policy/StellaOps.Policy.Engine | Implement incident mode sampling overrides | POLICY-OBS-54-001 | PLOB0101 | +| POLICY-OBS-50-001 | TODO | | SPRINT_0127_0000_0001_policy_reasoning | Policy Guild · Observability Guild | src/Policy/StellaOps.Policy.Engine | Integrate telemetry core into policy API + worker hosts, ensuring spans/logs cover compile/evaluate flows with `tenant_id`, `policy_version`, `decision_effect`, and trace IDs | Wait for telemetry schema drop (046_TLTY0101) | PLOB0101 | +| POLICY-OBS-51-001 | TODO | | SPRINT_0127_0000_0001_policy_reasoning | Policy Guild · DevOps Guild | src/Policy/StellaOps.Policy.Engine | Emit golden-signal metrics | POLICY-OBS-50-001 | PLOB0101 | +| POLICY-OBS-52-001 | TODO | | SPRINT_0127_0000_0001_policy_reasoning | Policy Guild | src/Policy/StellaOps.Policy.Engine | Emit timeline events `policy.evaluate.started`, `policy.evaluate.completed`, `policy.decision.recorded` with trace IDs, input digests, and rule summary. Provide contract tests and retry semantics | POLICY-OBS-51-001 | PLOB0101 | +| POLICY-OBS-53-001 | TODO | | SPRINT_0127_0000_0001_policy_reasoning | Policy Guild · Evidence Locker Guild | src/Policy/StellaOps.Policy.Engine | Produce evaluation evidence bundles | POLICY-OBS-52-001 | PLOB0101 | +| POLICY-OBS-54-001 | TODO | | SPRINT_0127_0000_0001_policy_reasoning | Policy Guild · Provenance Guild | src/Policy/StellaOps.Policy.Engine | Generate DSSE attestations for evaluation outputs, expose `/evaluations/{id}/attestation`, and link attestation IDs in timeline + console. Provide verification harness | POLICY-OBS-53-001 | PLOB0101 | +| POLICY-OBS-55-001 | TODO | | SPRINT_0127_0000_0001_policy_reasoning | Policy Guild · DevOps Guild | src/Policy/StellaOps.Policy.Engine | Implement incident mode sampling overrides | POLICY-OBS-54-001 | PLOB0101 | | POLICY-READINESS-0001 | TODO | | SPRINT_0325_0001_0001_docs_modules_policy | Policy Guild (docs/modules/policy) | docs/modules/policy | Capture policy module readiness checklist aligned with current sprint goals. | | | | POLICY-READINESS-0002 | TODO | | SPRINT_0325_0001_0001_docs_modules_policy | Policy Guild (docs/modules/policy) | docs/modules/policy | Track outstanding prerequisites/risk items for policy releases and mirror into sprint updates. | | | -| POLICY-RISK-66-001 | DONE | 2025-11-22 | SPRINT_127_policy_reasoning | Risk Profile Schema Guild / src/Policy/StellaOps.Policy.RiskProfile | src/Policy/StellaOps.Policy.RiskProfile | Develop initial JSON Schema for RiskProfile (signals, transforms, weights, severity, overrides) with validator stubs | | | +| POLICY-RISK-66-001 | DONE | 2025-11-22 | SPRINT_0127_0000_0001_policy_reasoning | Risk Profile Schema Guild / src/Policy/StellaOps.Policy.RiskProfile | src/Policy/StellaOps.Policy.RiskProfile | Develop initial JSON Schema for RiskProfile (signals, transforms, weights, severity, overrides) with validator stubs | | | | POLICY-RISK-66-002 | DONE (2025-11-26) | | SPRINT_0127_0001_0001_policy_reasoning | Risk Profile Schema Guild / src/Policy/StellaOps.Policy.RiskProfile | src/Policy/StellaOps.Policy.RiskProfile | Implement inheritance/merge logic with conflict detection and deterministic content hashing | POLICY-RISK-66-001 | Canonicalizer/merge + digest, tests added. | -| POLICY-RISK-66-003 | TODO | | SPRINT_127_policy_reasoning | Policy Guild, Risk Profile Schema Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Integrate RiskProfile schema into Policy Engine configuration, ensuring validation and default profile deployment | POLICY-RISK-66-002 | | -| POLICY-RISK-66-004 | TODO | | SPRINT_127_policy_reasoning | Policy Guild, Risk Profile Schema Guild / src/Policy/__Libraries/StellaOps.Policy | src/Policy/__Libraries/StellaOps.Policy | Extend Policy libraries to load/save RiskProfile documents, compute content hashes, and surface validation diagnostics | POLICY-RISK-66-003 | | -| POLICY-RISK-67-001 | TODO | | SPRINT_127_policy_reasoning | Policy Guild, Risk Engine Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Trigger scoring jobs on new/updated findings via Policy Engine orchestration hooks | POLICY-RISK-66-004 | | +| POLICY-RISK-66-003 | TODO | | SPRINT_0127_0000_0001_policy_reasoning | Policy Guild, Risk Profile Schema Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Integrate RiskProfile schema into Policy Engine configuration, ensuring validation and default profile deployment | POLICY-RISK-66-002 | | +| POLICY-RISK-66-004 | TODO | | SPRINT_0127_0000_0001_policy_reasoning | Policy Guild, Risk Profile Schema Guild / src/Policy/__Libraries/StellaOps.Policy | src/Policy/__Libraries/StellaOps.Policy | Extend Policy libraries to load/save RiskProfile documents, compute content hashes, and surface validation diagnostics | POLICY-RISK-66-003 | | +| POLICY-RISK-67-001 | TODO | | SPRINT_0127_0000_0001_policy_reasoning | Policy Guild, Risk Engine Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Trigger scoring jobs on new/updated findings via Policy Engine orchestration hooks | POLICY-RISK-66-004 | | | POLICY-RISK-67-002 | BLOCKED (2025-11-26) | | SPRINT_0128_0001_0001_policy_reasoning | Policy Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Implement profile lifecycle APIs | POLICY-RISK-67-001 | Waiting on risk profile contract + schema draft. | | POLICY-RISK-67-003 | BLOCKED (2025-11-26) | | SPRINT_0128_0001_0001_policy_reasoning | Policy Guild, Risk Engine Guild / src/Policy/__Libraries/StellaOps.Policy | src/Policy/__Libraries/StellaOps.Policy | Provide policy-layer APIs to trigger risk simulations and return distributions/contribution breakdowns | POLICY-RISK-67-002 | Blocked by missing risk profile schema + lifecycle API contract. | -| POLICY-RISK-68-001 | TODO | | SPRINT_128_policy_reasoning | Policy Guild, Policy Studio Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Provide simulation API bridging Policy Studio with risk engine; returns distributions and top movers | POLICY-RISK-67-003 | | -| POLICY-RISK-68-002 | TODO | | SPRINT_128_policy_reasoning | Risk Profile Schema Guild / src/Policy/StellaOps.Policy.RiskProfile | src/Policy/StellaOps.Policy.RiskProfile | Add override/adjustment support with audit metadata and validation for conflicting rules | POLICY-RISK-68-001 | | -| POLICY-RISK-69-001 | TODO | | SPRINT_128_policy_reasoning | Policy Guild, Notifications Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Emit events/notifications on profile publish, deprecate, and severity threshold changes | POLICY-RISK-68-002 | | -| POLICY-RISK-70-001 | TODO | | SPRINT_128_policy_reasoning | Policy Guild, Export Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Support exporting/importing profiles with signatures for air-gapped bundles | POLICY-RISK-69-001 | | -| POLICY-RISK-90-001 | TODO | | SPRINT_126_policy_reasoning | Policy Guild, Scanner Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Ingest entropy penalty inputs from Scanner (`entropy.report.json`, `layer_summary.json`), extend trust algebra with configurable weights/caps, and expose explanations/metrics for opaque ratio penalties (`docs/modules/scanner/entropy.md`). | | | -| POLICY-SPL-23-001 | TODO | | SPRINT_128_policy_reasoning | Policy Guild, Language Infrastructure Guild / src/Policy/__Libraries/StellaOps.Policy | src/Policy/__Libraries/StellaOps.Policy | Define SPL v1 YAML + JSON Schema, including advisory rules, VEX precedence, severity mapping, exceptions, and layering metadata. Publish schema resources and validation fixtures | | | -| POLICY-SPL-23-002 | TODO | | SPRINT_128_policy_reasoning | Policy Guild / src/Policy/__Libraries/StellaOps.Policy | src/Policy/__Libraries/StellaOps.Policy | Implement canonicalizer that normalizes policy packs | POLICY-SPL-23-001 | | +| POLICY-RISK-68-001 | TODO | | SPRINT_0128_0000_0001_policy_reasoning | Policy Guild, Policy Studio Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Provide simulation API bridging Policy Studio with risk engine; returns distributions and top movers | POLICY-RISK-67-003 | | +| POLICY-RISK-68-002 | TODO | | SPRINT_0128_0000_0001_policy_reasoning | Risk Profile Schema Guild / src/Policy/StellaOps.Policy.RiskProfile | src/Policy/StellaOps.Policy.RiskProfile | Add override/adjustment support with audit metadata and validation for conflicting rules | POLICY-RISK-68-001 | | +| POLICY-RISK-69-001 | TODO | | SPRINT_0128_0000_0001_policy_reasoning | Policy Guild, Notifications Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Emit events/notifications on profile publish, deprecate, and severity threshold changes | POLICY-RISK-68-002 | | +| POLICY-RISK-70-001 | TODO | | SPRINT_0128_0000_0001_policy_reasoning | Policy Guild, Export Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Support exporting/importing profiles with signatures for air-gapped bundles | POLICY-RISK-69-001 | | +| POLICY-RISK-90-001 | TODO | | SPRINT_0126_0000_0001_policy_reasoning | Policy Guild, Scanner Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Ingest entropy penalty inputs from Scanner (`entropy.report.json`, `layer_summary.json`), extend trust algebra with configurable weights/caps, and expose explanations/metrics for opaque ratio penalties (`docs/modules/scanner/entropy.md`). | | | +| POLICY-SPL-23-001 | TODO | | SPRINT_0128_0000_0001_policy_reasoning | Policy Guild, Language Infrastructure Guild / src/Policy/__Libraries/StellaOps.Policy | src/Policy/__Libraries/StellaOps.Policy | Define SPL v1 YAML + JSON Schema, including advisory rules, VEX precedence, severity mapping, exceptions, and layering metadata. Publish schema resources and validation fixtures | | | +| POLICY-SPL-23-002 | TODO | | SPRINT_0128_0000_0001_policy_reasoning | Policy Guild / src/Policy/__Libraries/StellaOps.Policy | src/Policy/__Libraries/StellaOps.Policy | Implement canonicalizer that normalizes policy packs | POLICY-SPL-23-001 | | | POLICY-SPL-23-003 | DONE (2025-11-26) | | SPRINT_0128_0001_0001_policy_reasoning | Policy Guild / src/Policy/__Libraries/StellaOps.Policy | src/Policy/__Libraries/StellaOps.Policy | Build policy layering/override engine | POLICY-SPL-23-002 | `SplLayeringEngine` + tests landed. | -| POLICY-SPL-23-004 | TODO | | SPRINT_128_policy_reasoning | Policy Guild, Audit Guild / src/Policy/__Libraries/StellaOps.Policy | src/Policy/__Libraries/StellaOps.Policy | Design explanation tree model | POLICY-SPL-23-003 | | -| POLICY-SPL-23-005 | TODO | | SPRINT_128_policy_reasoning | Policy Guild, DevEx Guild / src/Policy/__Libraries/StellaOps.Policy | src/Policy/__Libraries/StellaOps.Policy | Create migration tool to snapshot existing behavior into baseline SPL packs | POLICY-SPL-23-004 | | -| POLICY-SPL-24-001 | DONE (2025-11-26) | 2025-11-26 | SPRINT_128_policy_reasoning | Policy Guild, Signals Guild / src/Policy/__Libraries/StellaOps.Policy | src/Policy/__Libraries/StellaOps.Policy | Extend SPL schema to expose reachability/exploitability predicates and weighting functions; update documentation and fixtures | POLICY-SPL-23-005 | | +| POLICY-SPL-23-004 | TODO | | SPRINT_0128_0000_0001_policy_reasoning | Policy Guild, Audit Guild / src/Policy/__Libraries/StellaOps.Policy | src/Policy/__Libraries/StellaOps.Policy | Design explanation tree model | POLICY-SPL-23-003 | | +| POLICY-SPL-23-005 | TODO | | SPRINT_0128_0000_0001_policy_reasoning | Policy Guild, DevEx Guild / src/Policy/__Libraries/StellaOps.Policy | src/Policy/__Libraries/StellaOps.Policy | Create migration tool to snapshot existing behavior into baseline SPL packs | POLICY-SPL-23-004 | | +| POLICY-SPL-24-001 | DONE (2025-11-26) | 2025-11-26 | SPRINT_0128_0000_0001_policy_reasoning | Policy Guild, Signals Guild / src/Policy/__Libraries/StellaOps.Policy | src/Policy/__Libraries/StellaOps.Policy | Extend SPL schema to expose reachability/exploitability predicates and weighting functions; update documentation and fixtures | POLICY-SPL-23-005 | | | POLICY-TEN-48-001 | TODO | | SPRINT_0129_0001_0001_policy_reasoning | Policy Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | Add `tenant_id`/`project_id` columns, enable RLS, update evaluators to require tenant context, and emit rationale IDs including tenant metadata | | | | POLICY-VEX-401-006 | TODO | | SPRINT_0401_0001_0001_reachability_evidence_chain | Policy Guild (`src/Policy/StellaOps.Policy.Engine`, `src/Policy/__Libraries/StellaOps.Policy`) | `src/Policy/StellaOps.Policy.Engine`, `src/Policy/__Libraries/StellaOps.Policy` | Policy Engine consumes reachability facts, applies the deterministic score/label buckets (≥0.80 reachable, 0.30–0.79 conditional, <0.30 unreachable), emits OpenVEX with call-path proofs, and updates SPL schema with `reachability.state/confidence` predicates and suppression gates. | | | | POLICY-VEX-401-010 | TODO | | SPRINT_0401_0001_0001_reachability_evidence_chain | Policy Guild (`src/Policy/StellaOps.Policy.Engine/Vex`, `docs/modules/policy/architecture.md`, `docs/benchmarks/vex-evidence-playbook.md`) | `src/Policy/StellaOps.Policy.Engine/Vex`, `docs/modules/policy/architecture.md`, `docs/benchmarks/vex-evidence-playbook.md` | Implement `VexDecisionEmitter` to serialize per-finding OpenVEX, attach evidence hashes, request DSSE signatures, capture Rekor metadata, and publish artifacts following the bench playbook. | | | | PROBE-401-010 | TODO | | SPRINT_0401_0001_0001_reachability_evidence_chain | Runtime Signals Guild (`src/Signals/StellaOps.Signals.Runtime`, `ops/probes`) | `src/Signals/StellaOps.Signals.Runtime`, `ops/probes` | | | | -| PROMO-70-001 | TODO | | SPRINT_202_cli_ii | DevEx/CLI Guild, Provenance Guild (src/Cli/StellaOps.Cli) | src/Cli/StellaOps.Cli | | | | -| PROMO-70-002 | TODO | | SPRINT_203_cli_iii | DevEx/CLI Guild, Provenance Guild (src/Cli/StellaOps.Cli) | src/Cli/StellaOps.Cli | | | | +| PROMO-70-001 | TODO | | SPRINT_0202_0000_0002_cli_ii | DevEx/CLI Guild, Provenance Guild (src/Cli/StellaOps.Cli) | src/Cli/StellaOps.Cli | | | | +| PROMO-70-002 | TODO | | SPRINT_0203_0000_0003_cli_iii | DevEx/CLI Guild, Provenance Guild (src/Cli/StellaOps.Cli) | src/Cli/StellaOps.Cli | | | | | PROV-BACKFILL-401-029 | DONE | 2025-11-27 | SPRINT_0401_0001_0001_reachability_evidence_chain | Platform Guild | `docs/provenance/inline-dsse.md`, `scripts/publish_attestation_with_provenance.sh` | Backfill historical Mongo events with DSSE/Rekor metadata by resolving known attestations per subject digest (wiring ingestion helpers + endpoint tests in progress). | Depends on #1 | RBRE0101 | | PROV-INDEX-401-030 | DONE | 2025-11-27 | SPRINT_0401_0001_0001_reachability_evidence_chain | Platform + Ops Guilds | `docs/provenance/inline-dsse.md`, `ops/mongo/indices/events_provenance_indices.js` | Deploy provenance indexes (`events_by_subject_kind_provenance`, etc.) and expose compliance/replay queries. | Depends on #3 | RBRE0101 | | PROV-INLINE-401-028 | DONE | | SPRINT_0401_0001_0001_reachability_evidence_chain | Authority Guild · Feedser Guild (`docs/provenance/inline-dsse.md`, `src/__Libraries/StellaOps.Provenance.Mongo`) | `docs/provenance/inline-dsse.md`, `src/__Libraries/StellaOps.Provenance.Mongo` | Extend Authority/Feedser event writers to attach inline DSSE + Rekor references on every SBOM/VEX/scan event using `StellaOps.Provenance.Mongo`. | | | @@ -3711,39 +3711,39 @@ | REGISTRY-API-27-010 | TODO | | SPRINT_0129_0001_0001_policy_reasoning | Policy Registry Guild, QA Guild / src/Policy/StellaOps.Policy.Registry | src/Policy/StellaOps.Policy.Registry | Build unit/integration/load test suites for compile/sim/review/publish/promote flows; provide seeded fixtures for CI | REGISTRY-API-27-009 | | | REL-17-004 | BLOCKED | 2025-10-26 | SPRINT_0506_0001_0001_ops_devops_iv | DevOps Guild (ops/devops) | ops/devops | | | | | REP-004 | TODO | | SPRINT_0401_0001_0001_reachability_evidence_chain | BE-Base Platform Guild (`src/__Libraries/StellaOps.Replay.Core`, `docs/replay/DETERMINISTIC_REPLAY.md`) | `src/__Libraries/StellaOps.Replay.Core`, `docs/replay/DETERMINISTIC_REPLAY.md` | | | | -| REPLAY-185-003 | TODO | | SPRINT_185_shared_replay_primitives | Docs Guild, Platform Data Guild (docs) | | | | | -| REPLAY-185-004 | TODO | | SPRINT_185_shared_replay_primitives | Docs Guild (docs) | | | | | -| REPLAY-186-001 | TODO | | SPRINT_186_record_deterministic_execution | Scanner Guild (`src/Scanner/StellaOps.Scanner.WebService`, `docs/modules/scanner/architecture.md`) | `src/Scanner/StellaOps.Scanner.WebService`, `docs/modules/scanner/architecture.md` | | | | -| REPLAY-186-002 | TODO | | SPRINT_186_record_deterministic_execution | Scanner Guild (`src/Scanner/StellaOps.Scanner.Worker`, `docs/modules/scanner/deterministic-execution.md`) | `src/Scanner/StellaOps.Scanner.Worker`, `docs/modules/scanner/deterministic-execution.md` | | | | -| REPLAY-186-003 | TODO | | SPRINT_186_record_deterministic_execution | Signing Guild (`src/Signer/StellaOps.Signer`, `src/Authority/StellaOps.Authority`) | `src/Signer/StellaOps.Signer`, `src/Authority/StellaOps.Authority` | | | | -| REPLAY-186-004 | TODO | | SPRINT_186_record_deterministic_execution | Docs Guild (`docs`) | | | | | +| REPLAY-185-003 | TODO | | SPRINT_0185_0000_0001_shared_replay_primitives | Docs Guild, Platform Data Guild (docs) | | | | | +| REPLAY-185-004 | TODO | | SPRINT_0185_0000_0001_shared_replay_primitives | Docs Guild (docs) | | | | | +| REPLAY-186-001 | TODO | | SPRINT_0186_0000_0001_record_deterministic_execution | Scanner Guild (`src/Scanner/StellaOps.Scanner.WebService`, `docs/modules/scanner/architecture.md`) | `src/Scanner/StellaOps.Scanner.WebService`, `docs/modules/scanner/architecture.md` | | | | +| REPLAY-186-002 | TODO | | SPRINT_0186_0000_0001_record_deterministic_execution | Scanner Guild (`src/Scanner/StellaOps.Scanner.Worker`, `docs/modules/scanner/deterministic-execution.md`) | `src/Scanner/StellaOps.Scanner.Worker`, `docs/modules/scanner/deterministic-execution.md` | | | | +| REPLAY-186-003 | TODO | | SPRINT_0186_0000_0001_record_deterministic_execution | Signing Guild (`src/Signer/StellaOps.Signer`, `src/Authority/StellaOps.Authority`) | `src/Signer/StellaOps.Signer`, `src/Authority/StellaOps.Authority` | | | | +| REPLAY-186-004 | TODO | | SPRINT_0186_0000_0001_record_deterministic_execution | Docs Guild (`docs`) | | | | | | REPLAY-187-001 | TODO | | SPRINT_160_export_evidence | Evidence Locker Guild · docs/modules/evidence-locker/architecture.md | docs/modules/evidence-locker/architecture.md | | | | | REPLAY-187-002 | TODO | | SPRINT_160_export_evidence | CLI Guild · `docs/modules/cli/architecture.md` | docs/modules/cli/architecture.md | | | | -| REPLAY-187-003 | TODO | | SPRINT_187_evidence_locker_cli_integration | Attestor Guild (`src/Attestor/StellaOps.Attestor`, `docs/modules/attestor/architecture.md`) | `src/Attestor/StellaOps.Attestor`, `docs/modules/attestor/architecture.md` | | | | +| REPLAY-187-003 | TODO | | SPRINT_0187_0000_0001_evidence_locker_cli_integration | Attestor Guild (`src/Attestor/StellaOps.Attestor`, `docs/modules/attestor/architecture.md`) | `src/Attestor/StellaOps.Attestor`, `docs/modules/attestor/architecture.md` | | | | | REPLAY-187-004 | TODO | | SPRINT_160_export_evidence | Docs/Ops Guild · `/docs/runbooks/replay_ops.md` | docs/runbooks/replay_ops.md | | | | | REPLAY-401-004 | TODO | | SPRINT_0401_0001_0001_reachability_evidence_chain | BE-Base Platform Guild (`src/__Libraries/StellaOps.Replay.Core`) | `src/__Libraries/StellaOps.Replay.Core` | Bump replay manifest to v2 (feeds, analyzers, policies), have `ReachabilityReplayWriter` enforce CAS registration + hash sorting, and add deterministic tests to `tests/reachability/StellaOps.Reachability.FixtureTests`. | | | -| REPLAY-CORE-185-001 | TODO | | SPRINT_185_shared_replay_primitives | Platform Guild | `src/__Libraries/StellaOps.Replay.Core` | Scaffold `StellaOps.Replay.Core` with manifest schema types, canonical JSON rules, Merkle utilities, and DSSE payload builders; add `AGENTS.md`/`TASKS.md` for the new library; cross-reference `docs/replay/DETERMINISTIC_REPLAY.md` section 3 when updating the library charter. | Mirrors #1 | RLRC0101 | -| REPLAY-CORE-185-002 | TODO | | SPRINT_185_shared_replay_primitives | Platform Guild | src/__Libraries/StellaOps.Replay.Core | Implement deterministic bundle writer (tar.zst, CAS naming) and hashing abstractions, updating `docs/modules/platform/architecture-overview.md` with a “Replay CAS” subsection that documents layout/retention expectations. | Mirrors #2 | RLRC0101 | -| REPLAY-CORE-185-003 | TODO | | SPRINT_185_shared_replay_primitives | Platform Data Guild | src/__Libraries/StellaOps.Replay.Core | Define Mongo collections (`replay_runs`, `replay_bundles`, `replay_subjects`) and indices, then author `docs/data/replay_schema.md` detailing schema fields, constraints, and offline sync strategy. | Mirrors #3 | RLRC0101 | +| REPLAY-CORE-185-001 | TODO | | SPRINT_0185_0000_0001_shared_replay_primitives | Platform Guild | `src/__Libraries/StellaOps.Replay.Core` | Scaffold `StellaOps.Replay.Core` with manifest schema types, canonical JSON rules, Merkle utilities, and DSSE payload builders; add `AGENTS.md`/`TASKS.md` for the new library; cross-reference `docs/replay/DETERMINISTIC_REPLAY.md` section 3 when updating the library charter. | Mirrors #1 | RLRC0101 | +| REPLAY-CORE-185-002 | TODO | | SPRINT_0185_0000_0001_shared_replay_primitives | Platform Guild | src/__Libraries/StellaOps.Replay.Core | Implement deterministic bundle writer (tar.zst, CAS naming) and hashing abstractions, updating `docs/modules/platform/architecture-overview.md` with a “Replay CAS” subsection that documents layout/retention expectations. | Mirrors #2 | RLRC0101 | +| REPLAY-CORE-185-003 | TODO | | SPRINT_0185_0000_0001_shared_replay_primitives | Platform Data Guild | src/__Libraries/StellaOps.Replay.Core | Define Mongo collections (`replay_runs`, `replay_bundles`, `replay_subjects`) and indices, then author `docs/data/replay_schema.md` detailing schema fields, constraints, and offline sync strategy. | Mirrors #3 | RLRC0101 | | REPLAY-REACH-201-005 | DOING | 2025-11-08 | SPRINT_400_runtime_facts_static_callgraph_union | BE-Base Platform Guild (`src/__Libraries/StellaOps.Replay.Core`) | `src/__Libraries/StellaOps.Replay.Core` | Update `StellaOps.Replay.Core` manifest schema + bundle writer so replay packs capture reachability graphs, runtime traces, analyzer versions, and evidence hashes; document new CAS namespace. | | | | RISK-66-001 | TODO | | SPRINT_115_concelier_iv | Concelier Core Guild, Risk Engine Guild (src/Concelier/__Libraries/StellaOps.Concelier.Core) | src/Concelier/__Libraries/StellaOps.Concelier.Core | | | | | RISK-66-002 | TODO | | SPRINT_115_concelier_iv | Concelier Core Guild (src/Concelier/__Libraries/StellaOps.Concelier.Core) | src/Concelier/__Libraries/StellaOps.Concelier.Core | | | | -| RISK-66-003 | TODO | | SPRINT_127_policy_reasoning | Policy Guild, Risk Profile Schema Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | | POLICY-RISK-66-002 | | -| RISK-66-004 | TODO | | SPRINT_127_policy_reasoning | Policy Guild, Risk Profile Schema Guild / src/Policy/__Libraries/StellaOps.Policy | src/Policy/__Libraries/StellaOps.Policy | | POLICY-RISK-66-003 | | +| RISK-66-003 | TODO | | SPRINT_0127_0000_0001_policy_reasoning | Policy Guild, Risk Profile Schema Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | | POLICY-RISK-66-002 | | +| RISK-66-004 | TODO | | SPRINT_0127_0000_0001_policy_reasoning | Policy Guild, Risk Profile Schema Guild / src/Policy/__Libraries/StellaOps.Policy | src/Policy/__Libraries/StellaOps.Policy | | POLICY-RISK-66-003 | | | RISK-67-001 | TODO | | SPRINT_115_concelier_iv | Concelier Core Guild (src/Concelier/__Libraries/StellaOps.Concelier.Core) | src/Concelier/__Libraries/StellaOps.Concelier.Core | | | | -| RISK-67-002 | TODO | | SPRINT_128_policy_reasoning | Policy Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | | POLICY-RISK-67-001 | | +| RISK-67-002 | TODO | | SPRINT_0128_0000_0001_policy_reasoning | Policy Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | | POLICY-RISK-67-001 | | | RISK-67-003 | BLOCKED (2025-11-26) | | SPRINT_0128_0001_0001_policy_reasoning | Policy Guild, Risk Engine Guild / src/Policy/__Libraries/StellaOps.Policy | src/Policy/__Libraries/StellaOps.Policy | | POLICY-RISK-67-002 | Blocked by missing risk profile schema + lifecycle API contract. | | RISK-67-004 | TODO | | SPRINT_0309_0001_0009_docs_tasks_md_ix | Docs Guild, CLI Guild (docs) | | | | | | RISK-68-001 | TODO | | SPRINT_115_concelier_iv | Concelier Core Guild, Policy Studio Guild (src/Concelier/__Libraries/StellaOps.Concelier.Core) | src/Concelier/__Libraries/StellaOps.Concelier.Core | | | | -| RISK-68-002 | TODO | | SPRINT_128_policy_reasoning | Risk Profile Schema Guild / src/Policy/StellaOps.Policy.RiskProfile | src/Policy/StellaOps.Policy.RiskProfile | | POLICY-RISK-68-001 | | +| RISK-68-002 | TODO | | SPRINT_0128_0000_0001_policy_reasoning | Risk Profile Schema Guild / src/Policy/StellaOps.Policy.RiskProfile | src/Policy/StellaOps.Policy.RiskProfile | | POLICY-RISK-68-001 | | | RISK-69-001 | TODO | | SPRINT_115_concelier_iv | Concelier Core Guild, Notifications Guild (src/Concelier/__Libraries/StellaOps.Concelier.Core) | src/Concelier/__Libraries/StellaOps.Concelier.Core | | | | | RISK-69-002 | TODO | | SPRINT_163_exportcenter_ii | Exporter Service Guild, Risk Engine Guild (src/ExportCenter/StellaOps.ExportCenter) | src/ExportCenter/StellaOps.ExportCenter | | | | -| RISK-70-001 | TODO | | SPRINT_128_policy_reasoning | Policy Guild, Export Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | | POLICY-RISK-69-001 | | -| RISK-90-001 | TODO | | SPRINT_126_policy_reasoning | Policy Guild, Scanner Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | | | | -| RISK-BUNDLE-69-001 | TODO | | SPRINT_164_exportcenter_iii | Risk Bundle Export Guild, Risk Engine Guild (src/ExportCenter/StellaOps.ExportCenter.RiskBundles) | src/ExportCenter/StellaOps.ExportCenter.RiskBundles | Implement `stella export risk-bundle` job producing tarball with provider datasets, manifests, and DSSE signatures. | | | -| RISK-BUNDLE-69-002 | TODO | | SPRINT_164_exportcenter_iii | Risk Bundle Export Guild, DevOps Guild (src/ExportCenter/StellaOps.ExportCenter.RiskBundles) | src/ExportCenter/StellaOps.ExportCenter.RiskBundles | Integrate bundle job into CI/offline kit pipelines with checksum publication. Dependencies: RISK-BUNDLE-69-001. | | | -| RISK-BUNDLE-70-001 | TODO | | SPRINT_164_exportcenter_iii | Risk Bundle Export Guild, CLI Guild (src/ExportCenter/StellaOps.ExportCenter.RiskBundles) | src/ExportCenter/StellaOps.ExportCenter.RiskBundles | Provide CLI `stella risk bundle verify` command to validate bundles before import. Dependencies: RISK-BUNDLE-69-002. | | | -| RISK-BUNDLE-70-002 | TODO | | SPRINT_164_exportcenter_iii | Risk Bundle Export Guild, Docs Guild (src/ExportCenter/StellaOps.ExportCenter.RiskBundles) | src/ExportCenter/StellaOps.ExportCenter.RiskBundles | Publish `/docs/airgap/risk-bundles.md` detailing build/import/verification workflows. Dependencies: RISK-BUNDLE-70-001. | | | +| RISK-70-001 | TODO | | SPRINT_0128_0000_0001_policy_reasoning | Policy Guild, Export Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | | POLICY-RISK-69-001 | | +| RISK-90-001 | TODO | | SPRINT_0126_0000_0001_policy_reasoning | Policy Guild, Scanner Guild / src/Policy/StellaOps.Policy.Engine | src/Policy/StellaOps.Policy.Engine | | | | +| RISK-BUNDLE-69-001 | TODO | | SPRINT_0164_0000_0003_exportcenter_iii | Risk Bundle Export Guild, Risk Engine Guild (src/ExportCenter/StellaOps.ExportCenter.RiskBundles) | src/ExportCenter/StellaOps.ExportCenter.RiskBundles | Implement `stella export risk-bundle` job producing tarball with provider datasets, manifests, and DSSE signatures. | | | +| RISK-BUNDLE-69-002 | TODO | | SPRINT_0164_0000_0003_exportcenter_iii | Risk Bundle Export Guild, DevOps Guild (src/ExportCenter/StellaOps.ExportCenter.RiskBundles) | src/ExportCenter/StellaOps.ExportCenter.RiskBundles | Integrate bundle job into CI/offline kit pipelines with checksum publication. Dependencies: RISK-BUNDLE-69-001. | | | +| RISK-BUNDLE-70-001 | TODO | | SPRINT_0164_0000_0003_exportcenter_iii | Risk Bundle Export Guild, CLI Guild (src/ExportCenter/StellaOps.ExportCenter.RiskBundles) | src/ExportCenter/StellaOps.ExportCenter.RiskBundles | Provide CLI `stella risk bundle verify` command to validate bundles before import. Dependencies: RISK-BUNDLE-69-002. | | | +| RISK-BUNDLE-70-002 | TODO | | SPRINT_0164_0000_0003_exportcenter_iii | Risk Bundle Export Guild, Docs Guild (src/ExportCenter/StellaOps.ExportCenter.RiskBundles) | src/ExportCenter/StellaOps.ExportCenter.RiskBundles | Publish `/docs/airgap/risk-bundles.md` detailing build/import/verification workflows. Dependencies: RISK-BUNDLE-70-001. | | | | RISK-ENGINE-66-001 | DONE (2025-11-25) | 2025-11-25 | SPRINT_0129_0001_0001_policy_reasoning | Risk Engine Guild / src/RiskEngine/StellaOps.RiskEngine | src/RiskEngine/StellaOps.RiskEngine | Scaffold scoring service (job queue, worker loop, provider registry) with deterministic execution harness | | | | RISK-ENGINE-66-002 | DONE | 2025-11-25 | SPRINT_0129_0001_0001_policy_reasoning | Risk Engine Guild / src/RiskEngine/StellaOps.RiskEngine | src/RiskEngine/StellaOps.RiskEngine | Implement default transforms | RISK-ENGINE-66-001 | | | RISK-ENGINE-67-001 | DONE | 2025-11-25 | SPRINT_0129_0001_0001_policy_reasoning | Risk Engine Guild, Concelier Guild / src/RiskEngine/StellaOps.RiskEngine | src/RiskEngine/StellaOps.RiskEngine | Integrate CVSS and KEV providers pulling data from Conseiller; implement reducers | RISK-ENGINE-66-002 | | @@ -3765,8 +3765,8 @@ | SAMPLES-GRAPH-24-004 | DONE (2025-12-02) | | SPRINT_509_samples | Samples Guild, UI Guild (samples) | | Create vulnerability explorer JSON/CSV fixtures capturing conflicting evidence and policy outputs for UI/CLI automated tests. Dependencies: SAMPLES-GRAPH-24-003 (delivered at samples/graph/graph-40k). | | | | SAMPLES-LNM-22-001 | BLOCKED | 2025-10-27 | SPRINT_509_samples | Samples Guild, Concelier Guild (samples) | | Create advisory observation/linkset fixtures (NVD, GHSA, OSV disagreements) for API/CLI/UI tests with documented conflicts. Waiting on finalized schema/linkset outputs. | | | | SAMPLES-LNM-22-002 | BLOCKED | 2025-10-27 | SPRINT_509_samples | Samples Guild, Excititor Guild (samples) | | Produce VEX observation/linkset fixtures demonstrating status conflicts and path relevance; include raw blobs. Pending Excititor observation/linkset implementation. Dependencies: SAMPLES-LNM-22-001. | | | -| SBOM-60-001 | TODO | | SPRINT_203_cli_iii | DevEx/CLI Guild (src/Cli/StellaOps.Cli) | src/Cli/StellaOps.Cli | | | | -| SBOM-60-002 | TODO | | SPRINT_203_cli_iii | DevEx/CLI Guild (src/Cli/StellaOps.Cli) | src/Cli/StellaOps.Cli | | | | +| SBOM-60-001 | TODO | | SPRINT_0203_0000_0003_cli_iii | DevEx/CLI Guild (src/Cli/StellaOps.Cli) | src/Cli/StellaOps.Cli | | | | +| SBOM-60-002 | TODO | | SPRINT_0203_0000_0003_cli_iii | DevEx/CLI Guild (src/Cli/StellaOps.Cli) | src/Cli/StellaOps.Cli | | | | | SBOM-AIAI-31-001 | TODO | | SPRINT_0140_0001_0001_runtime_signals | — | | Advisory AI path/timeline endpoints specced; awaiting projection schema finalization. | — | DOAI0101 | | SBOM-AIAI-31-002 | TODO | | SPRINT_0140_0001_0001_runtime_signals | | | Metrics/dashboards tied to 31-001; blocked on the same schema availability. | | | | SBOM-AIAI-31-003 | BLOCKED | 2025-11-18 | SPRINT_0111_0001_0001_advisoryai | SBOM Service Guild · Advisory AI Guild (src/SbomService/StellaOps.SbomService) | src/SbomService/StellaOps.SbomService | Publish the Advisory AI hand-off kit for `/v1/sbom/context`, share base URL/API key + tenant header contract, and run a joint end-to-end retrieval smoke test with Advisory AI. | SBOM-AIAI-31-001 projection kit/fixtures | ADAI0101 | @@ -3785,15 +3785,15 @@ | SBOM-VULN-29-002 | TODO | | SPRINT_0140_0001_0001_runtime_signals | | | Resolver feed requires 29-001 event payloads. | | | | SCAN-001 | TODO | | SPRINT_400_runtime_facts_static_callgraph_union | Scanner Worker Guild (`src/Scanner/StellaOps.Scanner.Worker`, `docs/modules/scanner/architecture.md`, `docs/reachability/function-level-evidence.md`) | `src/Scanner/StellaOps.Scanner.Worker`, `docs/modules/scanner/architecture.md`, `docs/reachability/function-level-evidence.md` | | | | | SCAN-90-004 | TODO | | SPRINT_0505_0001_0001_ops_devops_iii | DevOps Guild, Scanner Guild (ops/devops) | ops/devops | | | | -| SCAN-DETER-186-008 | DONE (2025-11-26) | | SPRINT_186_record_deterministic_execution | Scanner Guild · Provenance Guild | `src/Scanner/StellaOps.Scanner.WebService`, `src/Scanner/StellaOps.Scanner.Worker` | Add deterministic execution switches to Scanner (fixed clock, RNG seed, concurrency cap, feed/policy snapshot pins, log filtering) available via CLI/env/config so repeated runs stay hermetic. | ENTROPY-186-012 & SCANNER-ENV-02 | SCDE0102 | -| SCAN-DETER-186-009 | TODO | | SPRINT_186_record_deterministic_execution | Scanner Guild, QA Guild (`src/Scanner/StellaOps.Scanner.Replay`, `src/Scanner/__Tests`) | `src/Scanner/StellaOps.Scanner.Replay`, `src/Scanner/__Tests` | Build a determinism harness that replays N scans per image, canonicalises SBOM/VEX/findings/log outputs, and records per-run hash matrices (see `docs/modules/scanner/determinism-score.md`). | | | -| SCAN-DETER-186-010 | TODO | | SPRINT_186_record_deterministic_execution | Scanner Guild, Export Center Guild (`src/Scanner/StellaOps.Scanner.WebService`, `docs/modules/scanner/operations/release.md`) | `src/Scanner/StellaOps.Scanner.WebService`, `docs/modules/scanner/operations/release.md` | Emit and publish `determinism.json` (scores, artifact hashes, non-identical diffs) alongside each scanner release via CAS/object storage APIs (documented in `docs/modules/scanner/determinism-score.md`). | | | -| SCAN-ENTROPY-186-011 | DONE (2025-11-26) | | SPRINT_186_record_deterministic_execution | Scanner Guild (`src/Scanner/StellaOps.Scanner.Worker`, `src/Scanner/__Libraries`) | `src/Scanner/StellaOps.Scanner.Worker`, `src/Scanner/__Libraries` | Implement entropy analysis for ELF/PE/Mach-O executables and large opaque blobs (sliding-window metrics, section heuristics), flagging high-entropy regions and recording offsets/hints (see `docs/modules/scanner/entropy.md`). | | | -| SCAN-ENTROPY-186-012 | DONE (2025-11-26) | | SPRINT_186_record_deterministic_execution | Scanner Guild, Provenance Guild (`src/Scanner/StellaOps.Scanner.WebService`, `docs/replay/DETERMINISTIC_REPLAY.md`) | `src/Scanner/StellaOps.Scanner.WebService`, `docs/replay/DETERMINISTIC_REPLAY.md` | Generate `entropy.report.json` and image-level penalties, attach evidence to scan manifests/attestations, and expose opaque ratios for downstream policy engines (`docs/modules/scanner/entropy.md`). | | | +| SCAN-DETER-186-008 | DONE (2025-11-26) | | SPRINT_0186_0000_0001_record_deterministic_execution | Scanner Guild · Provenance Guild | `src/Scanner/StellaOps.Scanner.WebService`, `src/Scanner/StellaOps.Scanner.Worker` | Add deterministic execution switches to Scanner (fixed clock, RNG seed, concurrency cap, feed/policy snapshot pins, log filtering) available via CLI/env/config so repeated runs stay hermetic. | ENTROPY-186-012 & SCANNER-ENV-02 | SCDE0102 | +| SCAN-DETER-186-009 | TODO | | SPRINT_0186_0000_0001_record_deterministic_execution | Scanner Guild, QA Guild (`src/Scanner/StellaOps.Scanner.Replay`, `src/Scanner/__Tests`) | `src/Scanner/StellaOps.Scanner.Replay`, `src/Scanner/__Tests` | Build a determinism harness that replays N scans per image, canonicalises SBOM/VEX/findings/log outputs, and records per-run hash matrices (see `docs/modules/scanner/determinism-score.md`). | | | +| SCAN-DETER-186-010 | TODO | | SPRINT_0186_0000_0001_record_deterministic_execution | Scanner Guild, Export Center Guild (`src/Scanner/StellaOps.Scanner.WebService`, `docs/modules/scanner/operations/release.md`) | `src/Scanner/StellaOps.Scanner.WebService`, `docs/modules/scanner/operations/release.md` | Emit and publish `determinism.json` (scores, artifact hashes, non-identical diffs) alongside each scanner release via CAS/object storage APIs (documented in `docs/modules/scanner/determinism-score.md`). | | | +| SCAN-ENTROPY-186-011 | DONE (2025-11-26) | | SPRINT_0186_0000_0001_record_deterministic_execution | Scanner Guild (`src/Scanner/StellaOps.Scanner.Worker`, `src/Scanner/__Libraries`) | `src/Scanner/StellaOps.Scanner.Worker`, `src/Scanner/__Libraries` | Implement entropy analysis for ELF/PE/Mach-O executables and large opaque blobs (sliding-window metrics, section heuristics), flagging high-entropy regions and recording offsets/hints (see `docs/modules/scanner/entropy.md`). | | | +| SCAN-ENTROPY-186-012 | DONE (2025-11-26) | | SPRINT_0186_0000_0001_record_deterministic_execution | Scanner Guild, Provenance Guild (`src/Scanner/StellaOps.Scanner.WebService`, `docs/replay/DETERMINISTIC_REPLAY.md`) | `src/Scanner/StellaOps.Scanner.WebService`, `docs/replay/DETERMINISTIC_REPLAY.md` | Generate `entropy.report.json` and image-level penalties, attach evidence to scan manifests/attestations, and expose opaque ratios for downstream policy engines (`docs/modules/scanner/entropy.md`). | | | | SCAN-REACH-201-002 | DOING | 2025-11-08 | SPRINT_400_runtime_facts_static_callgraph_union | Scanner Worker Guild (`src/Scanner/StellaOps.Scanner.Worker`) | `src/Scanner/StellaOps.Scanner.Worker` | Ship language-aware static lifters (JVM, .NET/Roslyn+IL, Go SSA, Node/Deno TS AST, Rust MIR, Swift SIL, shell/binary analyzers) in Scanner Worker; emit canonical SymbolIDs, CAS-stored graphs, and attach reachability tags to SBOM components. | | | | SCAN-REACH-401-009 | TODO | | SPRINT_0401_0001_0001_reachability_evidence_chain | Scanner Worker Guild (`src/Scanner/StellaOps.Scanner.Worker`, `src/Scanner/__Libraries`) | `src/Scanner/StellaOps.Scanner.Worker`, `src/Scanner/__Libraries` | Ship .NET/JVM symbolizers and call-graph generators (roots, edges, framework adapters), merge results into component-level reachability manifests, and back them with golden fixtures. | | | -| SCAN-REPLAY-186-001 | DONE (2025-11-26) | | SPRINT_186_record_deterministic_execution | Scanner Guild (`src/Scanner/StellaOps.Scanner.WebService`, `docs/modules/scanner/architecture.md`) | `src/Scanner/StellaOps.Scanner.WebService`, `docs/modules/scanner/architecture.md` | Implement `record` mode in `StellaOps.Scanner.WebService` (manifest assembly, policy/feed/tool hash capture, CAS uploads) and document the workflow in `docs/modules/scanner/architecture.md` with references to `docs/replay/DETERMINISTIC_REPLAY.md` Section 6. | | | -| SCAN-REPLAY-186-002 | TODO | | SPRINT_186_record_deterministic_execution | Scanner Guild (`src/Scanner/StellaOps.Scanner.Worker`, `docs/modules/scanner/deterministic-execution.md`) | `src/Scanner/StellaOps.Scanner.Worker`, `docs/modules/scanner/deterministic-execution.md` | Update `StellaOps.Scanner.Worker` analyzers to consume sealed input bundles, enforce deterministic ordering, and contribute Merkle metadata; extend `docs/modules/scanner/deterministic-execution.md` (new) summarising invariants drawn from `docs/replay/DETERMINISTIC_REPLAY.md` Section 4. | | | +| SCAN-REPLAY-186-001 | DONE (2025-11-26) | | SPRINT_0186_0000_0001_record_deterministic_execution | Scanner Guild (`src/Scanner/StellaOps.Scanner.WebService`, `docs/modules/scanner/architecture.md`) | `src/Scanner/StellaOps.Scanner.WebService`, `docs/modules/scanner/architecture.md` | Implement `record` mode in `StellaOps.Scanner.WebService` (manifest assembly, policy/feed/tool hash capture, CAS uploads) and document the workflow in `docs/modules/scanner/architecture.md` with references to `docs/replay/DETERMINISTIC_REPLAY.md` Section 6. | | | +| SCAN-REPLAY-186-002 | TODO | | SPRINT_0186_0000_0001_record_deterministic_execution | Scanner Guild (`src/Scanner/StellaOps.Scanner.Worker`, `docs/modules/scanner/deterministic-execution.md`) | `src/Scanner/StellaOps.Scanner.Worker`, `docs/modules/scanner/deterministic-execution.md` | Update `StellaOps.Scanner.Worker` analyzers to consume sealed input bundles, enforce deterministic ordering, and contribute Merkle metadata; extend `docs/modules/scanner/deterministic-execution.md` (new) summarising invariants drawn from `docs/replay/DETERMINISTIC_REPLAY.md` Section 4. | | | | SCANNER-ANALYZERS-DENO-26-001 | DONE | | SPRINT_130_scanner_surface | Deno Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Deno) | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Deno | Build the deterministic input normalizer + VFS merger for `deno.json(c)`, import maps, lockfiles, vendor trees, `$DENO_DIR`, and OCI layers so analyzers have a canonical file view. | | | | SCANNER-ANALYZERS-DENO-26-002 | DONE | | SPRINT_130_scanner_surface | Deno Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Deno) | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Deno | Implement the module graph resolver covering static/dynamic imports, npm bridge, cache lookups, built-ins, WASM/JSON assertions, and annotate edges with their resolution provenance. | SCANNER-ANALYZERS-DENO-26-001 | | | SCANNER-ANALYZERS-DENO-26-003 | DONE | | SPRINT_130_scanner_surface | Deno Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Deno) | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Deno | Ship the npm/node compatibility adapter that maps `npm:` specifiers, evaluates `exports` conditionals, and logs builtin usage for policy overlays. | SCANNER-ANALYZERS-DENO-26-002 | | @@ -3813,68 +3813,68 @@ | SCANNER-ANALYZERS-JAVA-21-010 | TODO | | SPRINT_131_scanner_surface | Java Analyzer Guild, Signals Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Java) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Java | Optional runtime ingestion: Java agent + JFR reader capturing class load, ServiceLoader, and System.load events with path scrubbing. Emit append-only runtime edges `runtime-class`/`runtime-spi`/`runtime-load`. | SCANNER-ANALYZERS-JAVA-21-009 | | | SCANNER-ANALYZERS-JAVA-21-011 | TODO | | SPRINT_131_scanner_surface | Java Analyzer Guild, DevOps Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Java) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Java | Package analyzer as restart-time plug-in (manifest/DI), update Offline Kit docs, add CLI/worker hooks for Java inspection commands. | SCANNER-ANALYZERS-JAVA-21-010 | | | SCANNER-ANALYZERS-LANG-11-001 | TODO | | SPRINT_131_scanner_surface | StellaOps.Scanner EPDR Guild, Language Analyzer Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.DotNet) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.DotNet | Build entrypoint resolver that maps project/publish artifacts to entrypoint identities (assembly name, MVID, TFM, RID) and environment profiles (publish mode, host kind, probing paths). Output normalized `entrypoints[]` records with deterministic IDs. | SCANNER-ANALYZERS-LANG-10-309 | | -| SCANNER-ANALYZERS-LANG-11-002 | TODO | | SPRINT_132_scanner_surface | StellaOps.Scanner EPDR Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.DotNet) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.DotNet | Implement static analyzer (IL + reflection heuristics) capturing AssemblyRef, ModuleRef/PInvoke, DynamicDependency, reflection literals, DI patterns, and custom AssemblyLoadContext probing hints. Emit dependency edges with reason codes and confidence. | SCANNER-ANALYZERS-LANG-11-001 | | -| SCANNER-ANALYZERS-LANG-11-003 | TODO | | SPRINT_132_scanner_surface | StellaOps.Scanner EPDR Guild, Signals Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.DotNet) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.DotNet | Ingest optional runtime evidence (AssemblyLoad, Resolving, P/Invoke) via event listener harness; merge runtime edges with static/declared ones and attach reason codes/confidence. | SCANNER-ANALYZERS-LANG-11-002 | | -| SCANNER-ANALYZERS-LANG-11-004 | TODO | | SPRINT_132_scanner_surface | StellaOps.Scanner EPDR Guild, SBOM Service Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.DotNet) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.DotNet | Produce normalized observation export to Scanner writer: entrypoints + dependency edges + environment profiles (AOC compliant). Wire to SBOM service entrypoint tagging. | SCANNER-ANALYZERS-LANG-11-003 | | -| SCANNER-ANALYZERS-LANG-11-005 | TODO | | SPRINT_132_scanner_surface | StellaOps.Scanner EPDR Guild, QA Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.DotNet) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.DotNet | Add comprehensive fixtures/benchmarks covering framework-dependent, self-contained, single-file, trimmed, NativeAOT, multi-RID scenarios; include explain traces and perf benchmarks vs previous analyzer. | SCANNER-ANALYZERS-LANG-11-004 | | -| SCANNER-ANALYZERS-NATIVE-20-001 | TODO | | SPRINT_132_scanner_surface | Native Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Native) | src/Scanner/StellaOps.Scanner.Analyzers.Native | Implement format detector and binary identity model supporting ELF, PE/COFF, and Mach-O (including fat slices). Capture arch, OS, build-id/UUID, interpreter metadata. | | | -| SCANNER-ANALYZERS-NATIVE-20-002 | TODO | | SPRINT_132_scanner_surface | Native Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Native) | src/Scanner/StellaOps.Scanner.Analyzers.Native | Parse ELF dynamic sections: `DT_NEEDED`, `DT_RPATH`, `DT_RUNPATH`, symbol versions, interpreter, and note build-id. Emit declared dependency records with reason `elf-dtneeded` and attach version needs. | SCANNER-ANALYZERS-NATIVE-20-001 | | -| SCANNER-ANALYZERS-NATIVE-20-003 | TODO | | SPRINT_132_scanner_surface | Native Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Native) | src/Scanner/StellaOps.Scanner.Analyzers.Native | Parse PE imports, delay-load tables, manifests/SxS metadata, and subsystem flags. Emit edges with reasons `pe-import` and `pe-delayimport`, plus SxS policy metadata. | SCANNER-ANALYZERS-NATIVE-20-002 | | -| SCANNER-ANALYZERS-NATIVE-20-004 | TODO | | SPRINT_132_scanner_surface | Native Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Native) | src/Scanner/StellaOps.Scanner.Analyzers.Native | Parse Mach-O load commands (`LC_LOAD_DYLIB`, `LC_REEXPORT_DYLIB`, `LC_RPATH`, `LC_UUID`, fat headers). Handle `@rpath/@loader_path` placeholders and slice separation. | SCANNER-ANALYZERS-NATIVE-20-003 | | -| SCANNER-ANALYZERS-NATIVE-20-005 | TODO | | SPRINT_132_scanner_surface | Native Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Native) | src/Scanner/StellaOps.Scanner.Analyzers.Native | Implement resolver engine modeling loader search order for ELF (rpath/runpath/cache/default), PE (SafeDll search + SxS), and Mach-O (`@rpath` expansion). Works against virtual image roots, producing explain traces. | SCANNER-ANALYZERS-NATIVE-20-004 | | -| SCANNER-ANALYZERS-NATIVE-20-006 | TODO | | SPRINT_132_scanner_surface | Native Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Native) | src/Scanner/StellaOps.Scanner.Analyzers.Native | Build heuristic scanner for `dlopen`/`LoadLibrary` strings, plugin ecosystem configs, and Go/Rust static hints. Emit edges with `reason_code` (`string-dlopen`, `config-plugin`, `ecosystem-heuristic`) and confidence levels. | SCANNER-ANALYZERS-NATIVE-20-005 | | -| SCANNER-ANALYZERS-NATIVE-20-007 | TODO | | SPRINT_132_scanner_surface | Native Analyzer Guild, SBOM Service Guild (src/Scanner/StellaOps.Scanner.Analyzers.Native) | src/Scanner/StellaOps.Scanner.Analyzers.Native | Serialize AOC-compliant observations: entrypoints + dependency edges + environment profiles (search paths, interpreter, loader metadata). Integrate with Scanner writer API. | SCANNER-ANALYZERS-NATIVE-20-006 | | -| SCANNER-ANALYZERS-NATIVE-20-008 | TODO | | SPRINT_132_scanner_surface | Native Analyzer Guild, QA Guild (src/Scanner/StellaOps.Scanner.Analyzers.Native) | src/Scanner/StellaOps.Scanner.Analyzers.Native | Author cross-platform fixtures (ELF dynamic/static, PE delay-load/SxS, Mach-O @rpath, plugin configs) and determinism benchmarks (<25 ms / binary, <250 MB). | SCANNER-ANALYZERS-NATIVE-20-007 | | -| SCANNER-ANALYZERS-NATIVE-20-009 | TODO | | SPRINT_132_scanner_surface | Native Analyzer Guild, Signals Guild (src/Scanner/StellaOps.Scanner.Analyzers.Native) | src/Scanner/StellaOps.Scanner.Analyzers.Native | Provide optional runtime capture adapters (Linux eBPF `dlopen`, Windows ETW ImageLoad, macOS dyld interpose) writing append-only runtime evidence. Include redaction/sandbox guidance. | SCANNER-ANALYZERS-NATIVE-20-008 | | -| SCANNER-ANALYZERS-NATIVE-20-010 | TODO | | SPRINT_132_scanner_surface | Native Analyzer Guild, DevOps Guild (src/Scanner/StellaOps.Scanner.Analyzers.Native) | src/Scanner/StellaOps.Scanner.Analyzers.Native | Package native analyzer as restart-time plug-in with manifest/DI registration; update Offline Kit bundle + documentation. | SCANNER-ANALYZERS-NATIVE-20-009 | | -| SCANNER-ANALYZERS-NODE-22-001 | TODO | | SPRINT_132_scanner_surface | Node Analyzer Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node | Build input normalizer + VFS for Node projects: dirs, tgz, container layers, pnpm store, Yarn PnP zips; detect Node version targets (`.nvmrc`, `.node-version`, Dockerfile) and workspace roots deterministically. | | | -| SCANNER-ANALYZERS-NODE-22-002 | TODO | | SPRINT_132_scanner_surface | Node Analyzer Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node | Implement entrypoint discovery (bin/main/module/exports/imports, workers, electron, shebang scripts) and condition set builder per entrypoint. | SCANNER-ANALYZERS-NODE-22-001 | | -| SCANNER-ANALYZERS-NODE-22-003 | TODO | | SPRINT_132_scanner_surface | Node Analyzer Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node | Parse JS/TS sources for static `import`, `require`, `import()` and string concat cases; flag dynamic patterns with confidence levels; support source map de-bundling. | SCANNER-ANALYZERS-NODE-22-002 | | -| SCANNER-ANALYZERS-NODE-22-004 | TODO | | SPRINT_132_scanner_surface | Node Analyzer Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node | Implement Node resolver engine for CJS + ESM (core modules, exports/imports maps, conditions, extension priorities, self-references) parameterised by node_version. | SCANNER-ANALYZERS-NODE-22-003 | | -| SCANNER-ANALYZERS-NODE-22-005 | TODO | | SPRINT_132_scanner_surface | Node Analyzer Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node | Add package manager adapters: Yarn PnP (.pnp.data/.pnp.cjs), pnpm virtual store, npm/Yarn classic hoists; operate entirely in virtual FS. | SCANNER-ANALYZERS-NODE-22-004 | | -| SCANNER-ANALYZERS-NODE-22-006 | TODO | | SPRINT_133_scanner_surface | Node Analyzer Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node | Detect bundles + source maps, reconstruct module specifiers, and correlate to original paths; support dual CJS/ESM graphs with conditions. | SCANNER-ANALYZERS-NODE-22-005 | | -| SCANNER-ANALYZERS-NODE-22-007 | TODO | | SPRINT_133_scanner_surface | Node Analyzer Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node | Scan for native addons (.node), WASM modules, and core capability signals (child_process, vm, worker_threads); emit hint edges and native metadata. | SCANNER-ANALYZERS-NODE-22-006 | | -| SCANNER-ANALYZERS-NODE-22-008 | TODO | | SPRINT_133_scanner_surface | Node Analyzer Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node | Produce AOC-compliant observations: entrypoints, components (pkg/native/wasm), edges (esm-import, cjs-require, exports, json, native-addon, wasm, worker) with reason codes/confidence and resolver traces. | SCANNER-ANALYZERS-NODE-22-007 | | -| SCANNER-ANALYZERS-NODE-22-009 | TODO | | SPRINT_133_scanner_surface | Node Analyzer Guild, QA Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node | Author fixture suite + performance benchmarks (npm, pnpm, PnP, bundle, electron, worker) with golden outputs and latency budgets. | SCANNER-ANALYZERS-NODE-22-008 | | -| SCANNER-ANALYZERS-NODE-22-010 | TODO | | SPRINT_133_scanner_surface | Node Analyzer Guild, Signals Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node | Implement optional runtime evidence hooks (ESM loader, CJS require hook) with path scrubbing and loader ID hashing; emit runtime-* edges. | SCANNER-ANALYZERS-NODE-22-009 | | -| SCANNER-ANALYZERS-NODE-22-011 | TODO | | SPRINT_133_scanner_surface | Node Analyzer Guild, DevOps Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node | Package updated analyzer as restart-time plug-in, expose Scanner CLI (`stella node *`) commands, refresh Offline Kit documentation. | SCANNER-ANALYZERS-NODE-22-010 | | -| SCANNER-ANALYZERS-NODE-22-012 | TODO | | SPRINT_133_scanner_surface | Node Analyzer Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node | Integrate container filesystem adapter (OCI layers, Dockerfile hints) and record NODE_OPTIONS/env warnings. | SCANNER-ANALYZERS-NODE-22-011 | | -| SCANNER-ANALYZERS-PHP-27-001 | TODO | | SPRINT_133_scanner_surface | PHP Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php) | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php | Build input normalizer & VFS for PHP projects: merge source trees, composer manifests, vendor/, php.ini/conf.d, `.htaccess`, FPM configs, container layers. Detect framework/CMS fingerprints deterministically. | — | SCSA0101 | -| SCANNER-ANALYZERS-PHP-27-002 | TODO | | SPRINT_133_scanner_surface | PHP Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php) | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php | Composer/Autoload analyzer: parse composer.json/lock/installed.json, generate package nodes, autoload edges (psr-4/0/classmap/files), bin entrypoints, composer plugins. | SCANNER-ANALYZERS-PHP-27-001 | | -| SCANNER-ANALYZERS-PHP-27-003 | TODO | | SPRINT_133_scanner_surface | PHP Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php) | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php | Include/require graph builder: resolve static includes, capture dynamic include patterns, bootstrap chains, merge with autoload edges. | SCANNER-ANALYZERS-PHP-27-002 | | -| SCANNER-ANALYZERS-PHP-27-004 | TODO | | SPRINT_133_scanner_surface | PHP Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php) | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php | Runtime capability scanner: detect exec/fs/net/env/serialization/crypto/database usage, stream wrappers, uploads; record evidence snippets. | SCANNER-ANALYZERS-PHP-27-003 | | -| SCANNER-ANALYZERS-PHP-27-005 | TODO | | SPRINT_133_scanner_surface | PHP Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php) | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php | PHAR/Archive inspector: parse phar manifests/stubs, hash files, detect embedded vendor trees and phar:// usage. | SCANNER-ANALYZERS-PHP-27-004 | | -| SCANNER-ANALYZERS-PHP-27-006 | TODO | | SPRINT_133_scanner_surface | PHP Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php) | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php | Framework/CMS surface mapper: extract routes, controllers, middleware, CLI/cron entrypoints for Laravel/Symfony/Slim/WordPress/Drupal/Magento. | SCANNER-ANALYZERS-PHP-27-005 | | -| SCANNER-ANALYZERS-PHP-27-007 | TODO | | SPRINT_133_scanner_surface | PHP Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php) | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php | Container & extension detector: parse php.ini/conf.d, map extensions to .so/.dll, collect web server/FPM settings, upload limits, disable_functions. | SCANNER-ANALYZERS-PHP-27-006 | | -| SCANNER-ANALYZERS-PHP-27-008 | TODO | | SPRINT_134_scanner_surface | PHP Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php) | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php | Produce AOC-compliant observations: entrypoints, packages, extensions, modules, edges (require/autoload), capabilities, routes, configs. | SCANNER-ANALYZERS-PHP-27-002 | | -| SCANNER-ANALYZERS-PHP-27-009 | TODO | | SPRINT_134_scanner_surface | PHP Analyzer Guild, QA Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php) | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php | Fixture suite + performance benchmarks (Laravel, Symfony, WordPress, legacy, PHAR, container) with golden outputs. | SCANNER-ANALYZERS-PHP-27-007 | | -| SCANNER-ANALYZERS-PHP-27-010 | TODO | | SPRINT_134_scanner_surface | PHP Analyzer Guild, Signals Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php) | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php | Optional runtime evidence hooks (if provided) to ingest audit logs or opcode cache stats with path hashing. | SCANNER-ANALYZERS-PHP-27-009 | | -| SCANNER-ANALYZERS-PHP-27-011 | TODO | | SPRINT_134_scanner_surface | PHP Analyzer Guild, DevOps Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php) | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php | Package analyzer plug-in, add CLI (`stella php inspect`), refresh Offline Kit documentation. | SCANNER-ANALYZERS-PHP-27-010 | | -| SCANNER-ANALYZERS-PHP-27-012 | TODO | | SPRINT_134_scanner_surface | PHP Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php) | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php | Policy signal emitter: extension requirements/presence, dangerous constructs counters, stream wrapper usage, capability summaries. | SCANNER-ANALYZERS-PHP-27-011 | | -| SCANNER-ANALYZERS-PYTHON-23-001 | TODO | | SPRINT_134_scanner_surface | Python Analyzer Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python | Build input normalizer & virtual filesystem for wheels, sdists, editable installs, zipapps, site-packages trees, and container roots. Detect Python version targets (`pyproject.toml`, `runtime.txt`, Dockerfile) + virtualenv layout deterministically. | | | -| SCANNER-ANALYZERS-PYTHON-23-002 | TODO | | SPRINT_134_scanner_surface | Python Analyzer Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python | Entrypoint discovery: module `__main__`, console_scripts entry points, `scripts`, zipapp main, `manage.py`/gunicorn/celery patterns. Capture invocation context (module vs package, argv wrappers). | SCANNER-ANALYZERS-PYTHON-23-001 | | -| SCANNER-ANALYZERS-PYTHON-23-003 | TODO | | SPRINT_134_scanner_surface | Python Analyzer Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python | Static import graph builder using AST and bytecode fallback. Support `import`, `from ... import`, relative imports, `importlib.import_module`, `__import__` with literal args, `pkgutil.extend_path`. | SCANNER-ANALYZERS-PYTHON-23-002 | | -| SCANNER-ANALYZERS-PYTHON-23-004 | TODO | | SPRINT_134_scanner_surface | Python Analyzer Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python | Python resolver engine (importlib semantics) handling namespace packages (PEP 420), package discovery order, `.pth` files, `sys.path` composition, zipimport, and site-packages precedence across virtualenv/container roots. | SCANNER-ANALYZERS-PYTHON-23-003 | | -| SCANNER-ANALYZERS-PYTHON-23-005 | TODO | | SPRINT_134_scanner_surface | Python Analyzer Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python | Packaging adapters: pip editable (`.egg-link`), Poetry/Flit layout, Conda prefix, `.dist-info/RECORD` cross-check, container layer overlays. | SCANNER-ANALYZERS-PYTHON-23-004 | | -| SCANNER-ANALYZERS-PYTHON-23-006 | TODO | | SPRINT_134_scanner_surface | Python Analyzer Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python | Detect native extensions (`*.so`, `*.pyd`), CFFI modules, ctypes loaders, embedded WASM, and runtime capability signals (subprocess, multiprocessing, ctypes, eval). | SCANNER-ANALYZERS-PYTHON-23-005 | | -| SCANNER-ANALYZERS-PYTHON-23-007 | TODO | | SPRINT_134_scanner_surface | Python Analyzer Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python | Framework/config heuristics: Django, Flask, FastAPI, Celery, AWS Lambda handlers, Gunicorn, Click/Typer CLIs, logging configs, pyproject optional dependencies. Tagged as hints only. | SCANNER-ANALYZERS-PYTHON-23-006 | | -| SCANNER-ANALYZERS-PYTHON-23-008 | TODO | | SPRINT_134_scanner_surface | Python Analyzer Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python | Produce AOC-compliant observations: entrypoints, components (modules/packages/native), edges (import, namespace, dynamic-hint, native-extension) with reason codes/confidence and resolver traces. | SCANNER-ANALYZERS-PYTHON-23-007 | | -| SCANNER-ANALYZERS-PYTHON-23-009 | TODO | | SPRINT_134_scanner_surface | Python Analyzer Guild, QA Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python | Fixture suite + perf benchmarks covering virtualenv, namespace packages, zipapp, editable installs, containers, lambda handler. | SCANNER-ANALYZERS-PYTHON-23-008 | | -| SCANNER-ANALYZERS-PYTHON-23-010 | TODO | | SPRINT_134_scanner_surface | Python Analyzer Guild, Signals Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python | Optional runtime evidence: import hook capturing module load events with path scrubbing, optional bytecode instrumentation for `importlib` hooks, multiprocessing tracer. | SCANNER-ANALYZERS-PYTHON-23-009 | | -| SCANNER-ANALYZERS-PYTHON-23-011 | TODO | | SPRINT_134_scanner_surface | Python Analyzer Guild, DevOps Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python | Package analyzer plug-in, add CLI commands (`stella python inspect`), refresh Offline Kit documentation. | SCANNER-ANALYZERS-PYTHON-23-010 | | -| SCANNER-ANALYZERS-PYTHON-23-012 | TODO | | SPRINT_135_scanner_surface | Python Analyzer Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python | Container/zipapp adapter enhancements: parse OCI layers for Python runtime, detect `PYTHONPATH`/`PYTHONHOME` env, record warnings for sitecustomize/startup hooks. | SCANNER-ANALYZERS-PYTHON-23-011 | | -| SCANNER-ANALYZERS-RUBY-28-001 | TODO | | SPRINT_135_scanner_surface | Ruby Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby) | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby | Build input normalizer & VFS for Ruby projects: merge source trees, Gemfile/Gemfile.lock, vendor/bundle, .gem archives, `.bundle/config`, Rack configs, containers. Detect framework/job fingerprints deterministically. | | | -| SCANNER-ANALYZERS-RUBY-28-002 | TODO | | SPRINT_135_scanner_surface | Ruby Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby) | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby | Gem & Bundler analyzer: parse Gemfile/Gemfile.lock, vendor specs, .gem archives, produce package nodes (PURLs), dependency edges, bin scripts, Bundler group metadata. | SCANNER-ANALYZERS-RUBY-28-001 | | -| SCANNER-ANALYZERS-RUBY-28-003 | TODO | | SPRINT_135_scanner_surface | Ruby Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby) | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby | Require/autoload graph builder: resolve static/dynamic require, require_relative, load; infer Zeitwerk autoload paths and Rack boot chain. | SCANNER-ANALYZERS-RUBY-28-002 | | -| SCANNER-ANALYZERS-RUBY-28-004 | TODO | | SPRINT_135_scanner_surface | Ruby Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby) | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby | Framework surface mapper: extract routes/controllers/middleware for Rails/Rack/Sinatra/Grape/Hanami; inventory jobs/schedulers (Sidekiq, Resque, ActiveJob, whenever, clockwork). | SCANNER-ANALYZERS-RUBY-28-003 | | -| SCANNER-ANALYZERS-RUBY-28-005 | TODO | | SPRINT_135_scanner_surface | Ruby Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby) | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby | Capability analyzer: detect os-exec, filesystem, network, serialization, crypto, DB usage, TLS posture, dynamic eval; record evidence snippets with file/line. | SCANNER-ANALYZERS-RUBY-28-004 | | -| SCANNER-ANALYZERS-RUBY-28-006 | TODO | | SPRINT_135_scanner_surface | Ruby Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby) | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby | Rake task & scheduler analyzer: parse Rakefiles/lib/tasks, capture task names/prereqs/shell commands; parse Sidekiq/whenever/clockwork configs into schedules. | SCANNER-ANALYZERS-RUBY-28-005 | | -| SCANNER-ANALYZERS-RUBY-28-007 | TODO | | SPRINT_135_scanner_surface | Ruby Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby) | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby | Container/runtime scanner: detect Ruby version, installed gems, native extensions, web server configs in OCI layers. | SCANNER-ANALYZERS-RUBY-28-006 | | -| SCANNER-ANALYZERS-RUBY-28-008 | TODO | | SPRINT_135_scanner_surface | Ruby Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby) | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby | Produce AOC-compliant observations: entrypoints, packages, modules, edges (require/autoload), routes, jobs, tasks, capabilities, configs, warnings. | SCANNER-ANALYZERS-RUBY-28-007 | | -| SCANNER-ANALYZERS-RUBY-28-009 | TODO | | SPRINT_135_scanner_surface | Ruby Analyzer Guild, QA Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby) | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby | Fixture suite + performance benchmarks (Rails, Rack, Sinatra, Sidekiq, legacy, .gem, container) with golden outputs. | SCANNER-ANALYZERS-RUBY-28-008 | | -| SCANNER-ANALYZERS-RUBY-28-010 | TODO | | SPRINT_135_scanner_surface | Ruby Analyzer Guild, Signals Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby) | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby | Optional runtime evidence integration (if provided logs/metrics) with path hashing, without altering static precedence. | SCANNER-ANALYZERS-RUBY-28-009 | | -| SCANNER-ANALYZERS-RUBY-28-011 | TODO | | SPRINT_135_scanner_surface | Ruby Analyzer Guild, DevOps Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby) | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby | Package analyzer plug-in, add CLI (`stella ruby inspect`), refresh Offline Kit documentation. | SCANNER-ANALYZERS-RUBY-28-010 | | -| SCANNER-ANALYZERS-RUBY-28-012 | TODO | | SPRINT_135_scanner_surface | Ruby Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby) | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby | Policy signal emitter: rubygems drift, native extension flags, dangerous constructs counts, TLS verify posture, dynamic require eval warnings. | SCANNER-ANALYZERS-RUBY-28-011 | | +| SCANNER-ANALYZERS-LANG-11-002 | TODO | | SPRINT_0132_0000_0001_scanner_surface | StellaOps.Scanner EPDR Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.DotNet) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.DotNet | Implement static analyzer (IL + reflection heuristics) capturing AssemblyRef, ModuleRef/PInvoke, DynamicDependency, reflection literals, DI patterns, and custom AssemblyLoadContext probing hints. Emit dependency edges with reason codes and confidence. | SCANNER-ANALYZERS-LANG-11-001 | | +| SCANNER-ANALYZERS-LANG-11-003 | TODO | | SPRINT_0132_0000_0001_scanner_surface | StellaOps.Scanner EPDR Guild, Signals Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.DotNet) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.DotNet | Ingest optional runtime evidence (AssemblyLoad, Resolving, P/Invoke) via event listener harness; merge runtime edges with static/declared ones and attach reason codes/confidence. | SCANNER-ANALYZERS-LANG-11-002 | | +| SCANNER-ANALYZERS-LANG-11-004 | TODO | | SPRINT_0132_0000_0001_scanner_surface | StellaOps.Scanner EPDR Guild, SBOM Service Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.DotNet) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.DotNet | Produce normalized observation export to Scanner writer: entrypoints + dependency edges + environment profiles (AOC compliant). Wire to SBOM service entrypoint tagging. | SCANNER-ANALYZERS-LANG-11-003 | | +| SCANNER-ANALYZERS-LANG-11-005 | TODO | | SPRINT_0132_0000_0001_scanner_surface | StellaOps.Scanner EPDR Guild, QA Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.DotNet) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.DotNet | Add comprehensive fixtures/benchmarks covering framework-dependent, self-contained, single-file, trimmed, NativeAOT, multi-RID scenarios; include explain traces and perf benchmarks vs previous analyzer. | SCANNER-ANALYZERS-LANG-11-004 | | +| SCANNER-ANALYZERS-NATIVE-20-001 | TODO | | SPRINT_0132_0000_0001_scanner_surface | Native Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Native) | src/Scanner/StellaOps.Scanner.Analyzers.Native | Implement format detector and binary identity model supporting ELF, PE/COFF, and Mach-O (including fat slices). Capture arch, OS, build-id/UUID, interpreter metadata. | | | +| SCANNER-ANALYZERS-NATIVE-20-002 | TODO | | SPRINT_0132_0000_0001_scanner_surface | Native Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Native) | src/Scanner/StellaOps.Scanner.Analyzers.Native | Parse ELF dynamic sections: `DT_NEEDED`, `DT_RPATH`, `DT_RUNPATH`, symbol versions, interpreter, and note build-id. Emit declared dependency records with reason `elf-dtneeded` and attach version needs. | SCANNER-ANALYZERS-NATIVE-20-001 | | +| SCANNER-ANALYZERS-NATIVE-20-003 | TODO | | SPRINT_0132_0000_0001_scanner_surface | Native Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Native) | src/Scanner/StellaOps.Scanner.Analyzers.Native | Parse PE imports, delay-load tables, manifests/SxS metadata, and subsystem flags. Emit edges with reasons `pe-import` and `pe-delayimport`, plus SxS policy metadata. | SCANNER-ANALYZERS-NATIVE-20-002 | | +| SCANNER-ANALYZERS-NATIVE-20-004 | TODO | | SPRINT_0132_0000_0001_scanner_surface | Native Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Native) | src/Scanner/StellaOps.Scanner.Analyzers.Native | Parse Mach-O load commands (`LC_LOAD_DYLIB`, `LC_REEXPORT_DYLIB`, `LC_RPATH`, `LC_UUID`, fat headers). Handle `@rpath/@loader_path` placeholders and slice separation. | SCANNER-ANALYZERS-NATIVE-20-003 | | +| SCANNER-ANALYZERS-NATIVE-20-005 | TODO | | SPRINT_0132_0000_0001_scanner_surface | Native Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Native) | src/Scanner/StellaOps.Scanner.Analyzers.Native | Implement resolver engine modeling loader search order for ELF (rpath/runpath/cache/default), PE (SafeDll search + SxS), and Mach-O (`@rpath` expansion). Works against virtual image roots, producing explain traces. | SCANNER-ANALYZERS-NATIVE-20-004 | | +| SCANNER-ANALYZERS-NATIVE-20-006 | TODO | | SPRINT_0132_0000_0001_scanner_surface | Native Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Native) | src/Scanner/StellaOps.Scanner.Analyzers.Native | Build heuristic scanner for `dlopen`/`LoadLibrary` strings, plugin ecosystem configs, and Go/Rust static hints. Emit edges with `reason_code` (`string-dlopen`, `config-plugin`, `ecosystem-heuristic`) and confidence levels. | SCANNER-ANALYZERS-NATIVE-20-005 | | +| SCANNER-ANALYZERS-NATIVE-20-007 | TODO | | SPRINT_0132_0000_0001_scanner_surface | Native Analyzer Guild, SBOM Service Guild (src/Scanner/StellaOps.Scanner.Analyzers.Native) | src/Scanner/StellaOps.Scanner.Analyzers.Native | Serialize AOC-compliant observations: entrypoints + dependency edges + environment profiles (search paths, interpreter, loader metadata). Integrate with Scanner writer API. | SCANNER-ANALYZERS-NATIVE-20-006 | | +| SCANNER-ANALYZERS-NATIVE-20-008 | TODO | | SPRINT_0132_0000_0001_scanner_surface | Native Analyzer Guild, QA Guild (src/Scanner/StellaOps.Scanner.Analyzers.Native) | src/Scanner/StellaOps.Scanner.Analyzers.Native | Author cross-platform fixtures (ELF dynamic/static, PE delay-load/SxS, Mach-O @rpath, plugin configs) and determinism benchmarks (<25 ms / binary, <250 MB). | SCANNER-ANALYZERS-NATIVE-20-007 | | +| SCANNER-ANALYZERS-NATIVE-20-009 | TODO | | SPRINT_0132_0000_0001_scanner_surface | Native Analyzer Guild, Signals Guild (src/Scanner/StellaOps.Scanner.Analyzers.Native) | src/Scanner/StellaOps.Scanner.Analyzers.Native | Provide optional runtime capture adapters (Linux eBPF `dlopen`, Windows ETW ImageLoad, macOS dyld interpose) writing append-only runtime evidence. Include redaction/sandbox guidance. | SCANNER-ANALYZERS-NATIVE-20-008 | | +| SCANNER-ANALYZERS-NATIVE-20-010 | TODO | | SPRINT_0132_0000_0001_scanner_surface | Native Analyzer Guild, DevOps Guild (src/Scanner/StellaOps.Scanner.Analyzers.Native) | src/Scanner/StellaOps.Scanner.Analyzers.Native | Package native analyzer as restart-time plug-in with manifest/DI registration; update Offline Kit bundle + documentation. | SCANNER-ANALYZERS-NATIVE-20-009 | | +| SCANNER-ANALYZERS-NODE-22-001 | TODO | | SPRINT_0132_0000_0001_scanner_surface | Node Analyzer Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node | Build input normalizer + VFS for Node projects: dirs, tgz, container layers, pnpm store, Yarn PnP zips; detect Node version targets (`.nvmrc`, `.node-version`, Dockerfile) and workspace roots deterministically. | | | +| SCANNER-ANALYZERS-NODE-22-002 | TODO | | SPRINT_0132_0000_0001_scanner_surface | Node Analyzer Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node | Implement entrypoint discovery (bin/main/module/exports/imports, workers, electron, shebang scripts) and condition set builder per entrypoint. | SCANNER-ANALYZERS-NODE-22-001 | | +| SCANNER-ANALYZERS-NODE-22-003 | TODO | | SPRINT_0132_0000_0001_scanner_surface | Node Analyzer Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node | Parse JS/TS sources for static `import`, `require`, `import()` and string concat cases; flag dynamic patterns with confidence levels; support source map de-bundling. | SCANNER-ANALYZERS-NODE-22-002 | | +| SCANNER-ANALYZERS-NODE-22-004 | TODO | | SPRINT_0132_0000_0001_scanner_surface | Node Analyzer Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node | Implement Node resolver engine for CJS + ESM (core modules, exports/imports maps, conditions, extension priorities, self-references) parameterised by node_version. | SCANNER-ANALYZERS-NODE-22-003 | | +| SCANNER-ANALYZERS-NODE-22-005 | TODO | | SPRINT_0132_0000_0001_scanner_surface | Node Analyzer Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node | Add package manager adapters: Yarn PnP (.pnp.data/.pnp.cjs), pnpm virtual store, npm/Yarn classic hoists; operate entirely in virtual FS. | SCANNER-ANALYZERS-NODE-22-004 | | +| SCANNER-ANALYZERS-NODE-22-006 | TODO | | SPRINT_0133_0000_0001_scanner_surface | Node Analyzer Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node | Detect bundles + source maps, reconstruct module specifiers, and correlate to original paths; support dual CJS/ESM graphs with conditions. | SCANNER-ANALYZERS-NODE-22-005 | | +| SCANNER-ANALYZERS-NODE-22-007 | TODO | | SPRINT_0133_0000_0001_scanner_surface | Node Analyzer Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node | Scan for native addons (.node), WASM modules, and core capability signals (child_process, vm, worker_threads); emit hint edges and native metadata. | SCANNER-ANALYZERS-NODE-22-006 | | +| SCANNER-ANALYZERS-NODE-22-008 | TODO | | SPRINT_0133_0000_0001_scanner_surface | Node Analyzer Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node | Produce AOC-compliant observations: entrypoints, components (pkg/native/wasm), edges (esm-import, cjs-require, exports, json, native-addon, wasm, worker) with reason codes/confidence and resolver traces. | SCANNER-ANALYZERS-NODE-22-007 | | +| SCANNER-ANALYZERS-NODE-22-009 | TODO | | SPRINT_0133_0000_0001_scanner_surface | Node Analyzer Guild, QA Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node | Author fixture suite + performance benchmarks (npm, pnpm, PnP, bundle, electron, worker) with golden outputs and latency budgets. | SCANNER-ANALYZERS-NODE-22-008 | | +| SCANNER-ANALYZERS-NODE-22-010 | TODO | | SPRINT_0133_0000_0001_scanner_surface | Node Analyzer Guild, Signals Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node | Implement optional runtime evidence hooks (ESM loader, CJS require hook) with path scrubbing and loader ID hashing; emit runtime-* edges. | SCANNER-ANALYZERS-NODE-22-009 | | +| SCANNER-ANALYZERS-NODE-22-011 | TODO | | SPRINT_0133_0000_0001_scanner_surface | Node Analyzer Guild, DevOps Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node | Package updated analyzer as restart-time plug-in, expose Scanner CLI (`stella node *`) commands, refresh Offline Kit documentation. | SCANNER-ANALYZERS-NODE-22-010 | | +| SCANNER-ANALYZERS-NODE-22-012 | TODO | | SPRINT_0133_0000_0001_scanner_surface | Node Analyzer Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node | Integrate container filesystem adapter (OCI layers, Dockerfile hints) and record NODE_OPTIONS/env warnings. | SCANNER-ANALYZERS-NODE-22-011 | | +| SCANNER-ANALYZERS-PHP-27-001 | TODO | | SPRINT_0133_0000_0001_scanner_surface | PHP Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php) | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php | Build input normalizer & VFS for PHP projects: merge source trees, composer manifests, vendor/, php.ini/conf.d, `.htaccess`, FPM configs, container layers. Detect framework/CMS fingerprints deterministically. | — | SCSA0101 | +| SCANNER-ANALYZERS-PHP-27-002 | TODO | | SPRINT_0133_0000_0001_scanner_surface | PHP Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php) | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php | Composer/Autoload analyzer: parse composer.json/lock/installed.json, generate package nodes, autoload edges (psr-4/0/classmap/files), bin entrypoints, composer plugins. | SCANNER-ANALYZERS-PHP-27-001 | | +| SCANNER-ANALYZERS-PHP-27-003 | TODO | | SPRINT_0133_0000_0001_scanner_surface | PHP Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php) | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php | Include/require graph builder: resolve static includes, capture dynamic include patterns, bootstrap chains, merge with autoload edges. | SCANNER-ANALYZERS-PHP-27-002 | | +| SCANNER-ANALYZERS-PHP-27-004 | TODO | | SPRINT_0133_0000_0001_scanner_surface | PHP Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php) | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php | Runtime capability scanner: detect exec/fs/net/env/serialization/crypto/database usage, stream wrappers, uploads; record evidence snippets. | SCANNER-ANALYZERS-PHP-27-003 | | +| SCANNER-ANALYZERS-PHP-27-005 | TODO | | SPRINT_0133_0000_0001_scanner_surface | PHP Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php) | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php | PHAR/Archive inspector: parse phar manifests/stubs, hash files, detect embedded vendor trees and phar:// usage. | SCANNER-ANALYZERS-PHP-27-004 | | +| SCANNER-ANALYZERS-PHP-27-006 | TODO | | SPRINT_0133_0000_0001_scanner_surface | PHP Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php) | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php | Framework/CMS surface mapper: extract routes, controllers, middleware, CLI/cron entrypoints for Laravel/Symfony/Slim/WordPress/Drupal/Magento. | SCANNER-ANALYZERS-PHP-27-005 | | +| SCANNER-ANALYZERS-PHP-27-007 | TODO | | SPRINT_0133_0000_0001_scanner_surface | PHP Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php) | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php | Container & extension detector: parse php.ini/conf.d, map extensions to .so/.dll, collect web server/FPM settings, upload limits, disable_functions. | SCANNER-ANALYZERS-PHP-27-006 | | +| SCANNER-ANALYZERS-PHP-27-008 | TODO | | SPRINT_0134_0000_0001_scanner_surface | PHP Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php) | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php | Produce AOC-compliant observations: entrypoints, packages, extensions, modules, edges (require/autoload), capabilities, routes, configs. | SCANNER-ANALYZERS-PHP-27-002 | | +| SCANNER-ANALYZERS-PHP-27-009 | TODO | | SPRINT_0134_0000_0001_scanner_surface | PHP Analyzer Guild, QA Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php) | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php | Fixture suite + performance benchmarks (Laravel, Symfony, WordPress, legacy, PHAR, container) with golden outputs. | SCANNER-ANALYZERS-PHP-27-007 | | +| SCANNER-ANALYZERS-PHP-27-010 | TODO | | SPRINT_0134_0000_0001_scanner_surface | PHP Analyzer Guild, Signals Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php) | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php | Optional runtime evidence hooks (if provided) to ingest audit logs or opcode cache stats with path hashing. | SCANNER-ANALYZERS-PHP-27-009 | | +| SCANNER-ANALYZERS-PHP-27-011 | TODO | | SPRINT_0134_0000_0001_scanner_surface | PHP Analyzer Guild, DevOps Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php) | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php | Package analyzer plug-in, add CLI (`stella php inspect`), refresh Offline Kit documentation. | SCANNER-ANALYZERS-PHP-27-010 | | +| SCANNER-ANALYZERS-PHP-27-012 | TODO | | SPRINT_0134_0000_0001_scanner_surface | PHP Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php) | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Php | Policy signal emitter: extension requirements/presence, dangerous constructs counters, stream wrapper usage, capability summaries. | SCANNER-ANALYZERS-PHP-27-011 | | +| SCANNER-ANALYZERS-PYTHON-23-001 | TODO | | SPRINT_0134_0000_0001_scanner_surface | Python Analyzer Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python | Build input normalizer & virtual filesystem for wheels, sdists, editable installs, zipapps, site-packages trees, and container roots. Detect Python version targets (`pyproject.toml`, `runtime.txt`, Dockerfile) + virtualenv layout deterministically. | | | +| SCANNER-ANALYZERS-PYTHON-23-002 | TODO | | SPRINT_0134_0000_0001_scanner_surface | Python Analyzer Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python | Entrypoint discovery: module `__main__`, console_scripts entry points, `scripts`, zipapp main, `manage.py`/gunicorn/celery patterns. Capture invocation context (module vs package, argv wrappers). | SCANNER-ANALYZERS-PYTHON-23-001 | | +| SCANNER-ANALYZERS-PYTHON-23-003 | TODO | | SPRINT_0134_0000_0001_scanner_surface | Python Analyzer Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python | Static import graph builder using AST and bytecode fallback. Support `import`, `from ... import`, relative imports, `importlib.import_module`, `__import__` with literal args, `pkgutil.extend_path`. | SCANNER-ANALYZERS-PYTHON-23-002 | | +| SCANNER-ANALYZERS-PYTHON-23-004 | TODO | | SPRINT_0134_0000_0001_scanner_surface | Python Analyzer Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python | Python resolver engine (importlib semantics) handling namespace packages (PEP 420), package discovery order, `.pth` files, `sys.path` composition, zipimport, and site-packages precedence across virtualenv/container roots. | SCANNER-ANALYZERS-PYTHON-23-003 | | +| SCANNER-ANALYZERS-PYTHON-23-005 | TODO | | SPRINT_0134_0000_0001_scanner_surface | Python Analyzer Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python | Packaging adapters: pip editable (`.egg-link`), Poetry/Flit layout, Conda prefix, `.dist-info/RECORD` cross-check, container layer overlays. | SCANNER-ANALYZERS-PYTHON-23-004 | | +| SCANNER-ANALYZERS-PYTHON-23-006 | TODO | | SPRINT_0134_0000_0001_scanner_surface | Python Analyzer Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python | Detect native extensions (`*.so`, `*.pyd`), CFFI modules, ctypes loaders, embedded WASM, and runtime capability signals (subprocess, multiprocessing, ctypes, eval). | SCANNER-ANALYZERS-PYTHON-23-005 | | +| SCANNER-ANALYZERS-PYTHON-23-007 | TODO | | SPRINT_0134_0000_0001_scanner_surface | Python Analyzer Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python | Framework/config heuristics: Django, Flask, FastAPI, Celery, AWS Lambda handlers, Gunicorn, Click/Typer CLIs, logging configs, pyproject optional dependencies. Tagged as hints only. | SCANNER-ANALYZERS-PYTHON-23-006 | | +| SCANNER-ANALYZERS-PYTHON-23-008 | TODO | | SPRINT_0134_0000_0001_scanner_surface | Python Analyzer Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python | Produce AOC-compliant observations: entrypoints, components (modules/packages/native), edges (import, namespace, dynamic-hint, native-extension) with reason codes/confidence and resolver traces. | SCANNER-ANALYZERS-PYTHON-23-007 | | +| SCANNER-ANALYZERS-PYTHON-23-009 | TODO | | SPRINT_0134_0000_0001_scanner_surface | Python Analyzer Guild, QA Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python | Fixture suite + perf benchmarks covering virtualenv, namespace packages, zipapp, editable installs, containers, lambda handler. | SCANNER-ANALYZERS-PYTHON-23-008 | | +| SCANNER-ANALYZERS-PYTHON-23-010 | TODO | | SPRINT_0134_0000_0001_scanner_surface | Python Analyzer Guild, Signals Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python | Optional runtime evidence: import hook capturing module load events with path scrubbing, optional bytecode instrumentation for `importlib` hooks, multiprocessing tracer. | SCANNER-ANALYZERS-PYTHON-23-009 | | +| SCANNER-ANALYZERS-PYTHON-23-011 | TODO | | SPRINT_0134_0000_0001_scanner_surface | Python Analyzer Guild, DevOps Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python | Package analyzer plug-in, add CLI commands (`stella python inspect`), refresh Offline Kit documentation. | SCANNER-ANALYZERS-PYTHON-23-010 | | +| SCANNER-ANALYZERS-PYTHON-23-012 | TODO | | SPRINT_0135_0000_0001_scanner_surface | Python Analyzer Guild (src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python) | src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Python | Container/zipapp adapter enhancements: parse OCI layers for Python runtime, detect `PYTHONPATH`/`PYTHONHOME` env, record warnings for sitecustomize/startup hooks. | SCANNER-ANALYZERS-PYTHON-23-011 | | +| SCANNER-ANALYZERS-RUBY-28-001 | TODO | | SPRINT_0135_0000_0001_scanner_surface | Ruby Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby) | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby | Build input normalizer & VFS for Ruby projects: merge source trees, Gemfile/Gemfile.lock, vendor/bundle, .gem archives, `.bundle/config`, Rack configs, containers. Detect framework/job fingerprints deterministically. | | | +| SCANNER-ANALYZERS-RUBY-28-002 | TODO | | SPRINT_0135_0000_0001_scanner_surface | Ruby Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby) | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby | Gem & Bundler analyzer: parse Gemfile/Gemfile.lock, vendor specs, .gem archives, produce package nodes (PURLs), dependency edges, bin scripts, Bundler group metadata. | SCANNER-ANALYZERS-RUBY-28-001 | | +| SCANNER-ANALYZERS-RUBY-28-003 | TODO | | SPRINT_0135_0000_0001_scanner_surface | Ruby Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby) | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby | Require/autoload graph builder: resolve static/dynamic require, require_relative, load; infer Zeitwerk autoload paths and Rack boot chain. | SCANNER-ANALYZERS-RUBY-28-002 | | +| SCANNER-ANALYZERS-RUBY-28-004 | TODO | | SPRINT_0135_0000_0001_scanner_surface | Ruby Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby) | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby | Framework surface mapper: extract routes/controllers/middleware for Rails/Rack/Sinatra/Grape/Hanami; inventory jobs/schedulers (Sidekiq, Resque, ActiveJob, whenever, clockwork). | SCANNER-ANALYZERS-RUBY-28-003 | | +| SCANNER-ANALYZERS-RUBY-28-005 | TODO | | SPRINT_0135_0000_0001_scanner_surface | Ruby Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby) | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby | Capability analyzer: detect os-exec, filesystem, network, serialization, crypto, DB usage, TLS posture, dynamic eval; record evidence snippets with file/line. | SCANNER-ANALYZERS-RUBY-28-004 | | +| SCANNER-ANALYZERS-RUBY-28-006 | TODO | | SPRINT_0135_0000_0001_scanner_surface | Ruby Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby) | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby | Rake task & scheduler analyzer: parse Rakefiles/lib/tasks, capture task names/prereqs/shell commands; parse Sidekiq/whenever/clockwork configs into schedules. | SCANNER-ANALYZERS-RUBY-28-005 | | +| SCANNER-ANALYZERS-RUBY-28-007 | TODO | | SPRINT_0135_0000_0001_scanner_surface | Ruby Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby) | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby | Container/runtime scanner: detect Ruby version, installed gems, native extensions, web server configs in OCI layers. | SCANNER-ANALYZERS-RUBY-28-006 | | +| SCANNER-ANALYZERS-RUBY-28-008 | TODO | | SPRINT_0135_0000_0001_scanner_surface | Ruby Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby) | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby | Produce AOC-compliant observations: entrypoints, packages, modules, edges (require/autoload), routes, jobs, tasks, capabilities, configs, warnings. | SCANNER-ANALYZERS-RUBY-28-007 | | +| SCANNER-ANALYZERS-RUBY-28-009 | TODO | | SPRINT_0135_0000_0001_scanner_surface | Ruby Analyzer Guild, QA Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby) | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby | Fixture suite + performance benchmarks (Rails, Rack, Sinatra, Sidekiq, legacy, .gem, container) with golden outputs. | SCANNER-ANALYZERS-RUBY-28-008 | | +| SCANNER-ANALYZERS-RUBY-28-010 | TODO | | SPRINT_0135_0000_0001_scanner_surface | Ruby Analyzer Guild, Signals Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby) | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby | Optional runtime evidence integration (if provided logs/metrics) with path hashing, without altering static precedence. | SCANNER-ANALYZERS-RUBY-28-009 | | +| SCANNER-ANALYZERS-RUBY-28-011 | TODO | | SPRINT_0135_0000_0001_scanner_surface | Ruby Analyzer Guild, DevOps Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby) | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby | Package analyzer plug-in, add CLI (`stella ruby inspect`), refresh Offline Kit documentation. | SCANNER-ANALYZERS-RUBY-28-010 | | +| SCANNER-ANALYZERS-RUBY-28-012 | TODO | | SPRINT_0135_0000_0001_scanner_surface | Ruby Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby) | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby | Policy signal emitter: rubygems drift, native extension flags, dangerous constructs counts, TLS verify posture, dynamic require eval warnings. | SCANNER-ANALYZERS-RUBY-28-011 | | | SCANNER-BENCH-62-002 | DOING | | SPRINT_0310_0001_0010_docs_tasks_md_x | Docs Guild, Product Guild (docs) | | | | | | SCANNER-BENCH-62-003 | DOING | | SPRINT_0310_0001_0010_docs_tasks_md_x | Docs Guild, Product Guild (docs) | | | | | | SCANNER-BENCH-62-004 | DOING | | SPRINT_0310_0001_0010_docs_tasks_md_x | Docs Guild, Java Analyzer Guild (docs) | | | | | @@ -3885,7 +3885,7 @@ | SCANNER-CLI-0001 | DONE | 2025-11-10 | SPRINT_0138_0000_0001_scanner_ruby_parity | CLI Guild, Ruby Analyzer Guild (src/Cli/StellaOps.Cli) | src/Cli/StellaOps.Cli | Coordinate CLI UX/help text for new Ruby verbs and update CLI docs/golden outputs. | SCANNER-ENG-0019 | | | SCANNER-DET-01 | DONE (2025-12-03) | 2025-12-03 | SPRINT_0301_0001_0001_docs_md_i | Docs Guild · Scanner Guild | | Deterministic compose fixtures landed; docs published. | | | SCANNER-DOCS-0003 | TODO | | SPRINT_327_docs_modules_scanner | Docs Guild, Product Guild (docs/modules/scanner) | docs/modules/scanner | Gather Windows/macOS analyzer demand signals and record findings in `docs/benchmarks/scanner/windows-macos-demand.md` for marketing + product readiness. | | | -| SCANNER-EMIT-15-001 | TODO | | SPRINT_136_scanner_surface | Scanner Emit Guild (src/Scanner/__Libraries/StellaOps.Scanner.Emit) | src/Scanner/__Libraries/StellaOps.Scanner.Emit | Enforce canonical JSON (`stella.contentHash`, Merkle root metadata, zero timestamps) for fragments and composed CycloneDX inventory/usage BOMs. Documented in `docs/modules/scanner/deterministic-sbom-compose.md` §2.2. | SCANNER-SURFACE-04 | | +| SCANNER-EMIT-15-001 | TODO | | SPRINT_0136_0000_0001_scanner_surface | Scanner Emit Guild (src/Scanner/__Libraries/StellaOps.Scanner.Emit) | src/Scanner/__Libraries/StellaOps.Scanner.Emit | Enforce canonical JSON (`stella.contentHash`, Merkle root metadata, zero timestamps) for fragments and composed CycloneDX inventory/usage BOMs. Documented in `docs/modules/scanner/deterministic-sbom-compose.md` §2.2. | SCANNER-SURFACE-04 | | | SCANNER-ENG-0001 | TODO | | SPRINT_327_docs_modules_scanner | Module Team (docs/modules/scanner) | docs/modules/scanner | Cross-check implementation plan milestones against `/docs/implplan/SPRINT_*.md` and update module readiness checkpoints. | | | | SCANNER-ENG-0002 | DONE | 2025-11-09 | SPRINT_137_scanner_gap_design | Scanner Guild, CLI Guild (docs/modules/scanner) | docs/modules/scanner | Design the Node.js lockfile collector + CLI validator per `docs/benchmarks/scanner/scanning-gaps-stella-misses-from-competitors.md`, capturing Surface + policy requirements before implementation. | | | | SCANNER-ENG-0003 | DONE | 2025-11-09 | SPRINT_137_scanner_gap_design | Python Analyzer Guild, CLI Guild (docs/modules/scanner) | docs/modules/scanner | Design Python lockfile + editable-install parity checks with policy predicates and CLI workflow coverage as outlined in the gap analysis. | | | @@ -3905,36 +3905,36 @@ | SCANNER-ENG-0017 | DONE | 2025-11-09 | SPRINT_0138_0000_0001_scanner_ruby_parity | Ruby Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby) | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby | Build the runtime require/autoload graph builder with tree-sitter Ruby per design §4.4 and integrate EntryTrace hints. | SCANNER-ENG-0016 | | | SCANNER-ENG-0018 | DONE | 2025-11-09 | SPRINT_0138_0000_0001_scanner_ruby_parity | Ruby Analyzer Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby) | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby | Emit Ruby capability + framework surface signals as defined in design §4.5 with policy predicate hooks. | SCANNER-ENG-0017 | | | SCANNER-ENG-0019 | DONE | 2025-11-13 | SPRINT_0138_0000_0001_scanner_ruby_parity | Ruby Analyzer Guild, CLI Guild (src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby) | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Ruby | Ruby CLI verbs now resolve inventories by scan ID, digest, or image reference; Scanner.WebService fallbacks + CLI client encoding ensure `--image` works for both digests and tagged references, and tests cover the new lookup flow. | SCANNER-ENG-0016..0018 | | -| SCANNER-ENG-0020 | TODO | | SPRINT_136_scanner_surface | Scanner Guild (docs/modules/scanner) | docs/modules/scanner | Implement Homebrew collector & fragment mapper per `design/macos-analyzer.md` §3.1. | | | -| SCANNER-ENG-0021 | TODO | | SPRINT_136_scanner_surface | Scanner Guild (docs/modules/scanner) | docs/modules/scanner | Implement pkgutil receipt collector per `design/macos-analyzer.md` §3.2. | | | -| SCANNER-ENG-0022 | TODO | | SPRINT_136_scanner_surface | Scanner Guild, Policy Guild (docs/modules/scanner) | docs/modules/scanner | Implement macOS bundle inspector & capability overlays per `design/macos-analyzer.md` §3.3. | | | -| SCANNER-ENG-0023 | TODO | | SPRINT_136_scanner_surface | Scanner Guild, Offline Kit Guild, Policy Guild (docs/modules/scanner) | docs/modules/scanner | Deliver macOS policy/offline integration per `design/macos-analyzer.md` §5–6. | | | -| SCANNER-ENG-0024 | TODO | | SPRINT_136_scanner_surface | Scanner Guild (docs/modules/scanner) | docs/modules/scanner | Implement Windows MSI collector per `design/windows-analyzer.md` §3.1. | | | -| SCANNER-ENG-0025 | TODO | | SPRINT_136_scanner_surface | Scanner Guild (docs/modules/scanner) | docs/modules/scanner | Implement WinSxS manifest collector per `design/windows-analyzer.md` §3.2. | | | -| SCANNER-ENG-0026 | TODO | | SPRINT_136_scanner_surface | Scanner Guild (docs/modules/scanner) | docs/modules/scanner | Implement Windows Chocolatey & registry collectors per `design/windows-analyzer.md` §3.3–3.4. | | | -| SCANNER-ENG-0027 | TODO | | SPRINT_136_scanner_surface | Scanner Guild, Policy Guild, Offline Kit Guild (docs/modules/scanner) | docs/modules/scanner | Deliver Windows policy/offline integration per `design/windows-analyzer.md` §5–6. | | | -| SCANNER-ENTRYTRACE-18-502 | TODO | | SPRINT_135_scanner_surface | EntryTrace Guild (src/Scanner/__Libraries/StellaOps.Scanner.EntryTrace) | src/Scanner/__Libraries/StellaOps.Scanner.EntryTrace | Expand chain walker with init shim/user-switch/supervisor recognition plus env/workdir accumulation and guarded edges. | SCANNER-ENTRYTRACE-18-508 | | -| SCANNER-ENTRYTRACE-18-503 | TODO | | SPRINT_135_scanner_surface | EntryTrace Guild (src/Scanner/__Libraries/StellaOps.Scanner.EntryTrace) | src/Scanner/__Libraries/StellaOps.Scanner.EntryTrace | Introduce target classifier + EntryPlan handoff with confidence scoring for ELF/Java/.NET/Node/Python and user/workdir context. | SCANNER-ENTRYTRACE-18-502 | | -| SCANNER-ENTRYTRACE-18-504 | TODO | | SPRINT_136_scanner_surface | EntryTrace Guild (src/Scanner/__Libraries/StellaOps.Scanner.EntryTrace) | src/Scanner/__Libraries/StellaOps.Scanner.EntryTrace | Emit EntryTrace AOC NDJSON (`entrytrace.entry/node/edge/target/warning/capability`) and wire CLI/service streaming outputs. | SCANNER-ENTRYTRACE-18-503 | | -| SCANNER-ENTRYTRACE-18-505 | TODO | | SPRINT_136_scanner_surface | EntryTrace Guild (src/Scanner/__Libraries/StellaOps.Scanner.EntryTrace) | src/Scanner/__Libraries/StellaOps.Scanner.EntryTrace | Implement process-tree replay (ProcGraph) to reconcile `/proc` exec chains with static EntryTrace results, collapsing wrappers and emitting agreement/conflict diagnostics. | SCANNER-ENTRYTRACE-18-504 | | -| SCANNER-ENTRYTRACE-18-506 | TODO | | SPRINT_136_scanner_surface | EntryTrace Guild, Scanner WebService Guild (src/Scanner/__Libraries/StellaOps.Scanner.EntryTrace) | src/Scanner/__Libraries/StellaOps.Scanner.EntryTrace | Surface EntryTrace graph + confidence via Scanner.WebService and CLI, including target summary in scan reports and policy payloads. | SCANNER-ENTRYTRACE-18-505 | SCSS0102 | -| SCANNER-ENV-01 | TODO (2025-11-06) | 2025-11-06 | SPRINT_136_scanner_surface | Scanner Worker Guild | src/Scanner/StellaOps.Scanner.Worker | Replace ad-hoc environment reads with `StellaOps.Scanner.Surface.Env` helpers for cache roots and CAS endpoints. | — | SCDE0101 | -| SCANNER-ENV-02 | TODO (2025-11-06) | 2025-11-06 | SPRINT_136_scanner_surface | Scanner WebService Guild · Ops Guild | src/Scanner/StellaOps.Scanner.WebService | Wire Surface.Env helpers into WebService hosting (cache roots, feature flags) and document configuration. | SCANNER-ENV-01 | SCDE0102 | -| SCANNER-ENV-03 | TODO | | SPRINT_136_scanner_surface | BuildX Plugin Guild | src/Scanner/StellaOps.Scanner.Sbomer.BuildXPlugin | Adopt Surface.Env helpers for plugin configuration (cache roots, CAS endpoints, feature toggles). | SCANNER-ENV-02 | SCBX0101 | -| SCANNER-EVENTS-16-301 | BLOCKED (2025-10-26) | 2025-10-26 | SPRINT_136_scanner_surface | Scanner WebService Guild (`src/Scanner/StellaOps.Scanner.WebService`) | src/Scanner/StellaOps.Scanner.WebService | Emit orchestrator-compatible envelopes (`scanner.event.*`) and update integration tests to verify Notifier ingestion (no Redis queue coupling). | EVENTS-16-301 | SCEV0101 | -| SCANNER-GRAPH-21-001 | TODO | | SPRINT_136_scanner_surface | Scanner WebService Guild, Cartographer Guild (src/Scanner/StellaOps.Scanner.WebService) | src/Scanner/StellaOps.Scanner.WebService | Provide webhook/REST endpoint for Cartographer to request policy overlays and runtime evidence for graph nodes, ensuring determinism and tenant scoping. | | | +| SCANNER-ENG-0020 | TODO | | SPRINT_0136_0000_0001_scanner_surface | Scanner Guild (docs/modules/scanner) | docs/modules/scanner | Implement Homebrew collector & fragment mapper per `design/macos-analyzer.md` §3.1. | | | +| SCANNER-ENG-0021 | TODO | | SPRINT_0136_0000_0001_scanner_surface | Scanner Guild (docs/modules/scanner) | docs/modules/scanner | Implement pkgutil receipt collector per `design/macos-analyzer.md` §3.2. | | | +| SCANNER-ENG-0022 | TODO | | SPRINT_0136_0000_0001_scanner_surface | Scanner Guild, Policy Guild (docs/modules/scanner) | docs/modules/scanner | Implement macOS bundle inspector & capability overlays per `design/macos-analyzer.md` §3.3. | | | +| SCANNER-ENG-0023 | TODO | | SPRINT_0136_0000_0001_scanner_surface | Scanner Guild, Offline Kit Guild, Policy Guild (docs/modules/scanner) | docs/modules/scanner | Deliver macOS policy/offline integration per `design/macos-analyzer.md` §5–6. | | | +| SCANNER-ENG-0024 | TODO | | SPRINT_0136_0000_0001_scanner_surface | Scanner Guild (docs/modules/scanner) | docs/modules/scanner | Implement Windows MSI collector per `design/windows-analyzer.md` §3.1. | | | +| SCANNER-ENG-0025 | TODO | | SPRINT_0136_0000_0001_scanner_surface | Scanner Guild (docs/modules/scanner) | docs/modules/scanner | Implement WinSxS manifest collector per `design/windows-analyzer.md` §3.2. | | | +| SCANNER-ENG-0026 | TODO | | SPRINT_0136_0000_0001_scanner_surface | Scanner Guild (docs/modules/scanner) | docs/modules/scanner | Implement Windows Chocolatey & registry collectors per `design/windows-analyzer.md` §3.3–3.4. | | | +| SCANNER-ENG-0027 | TODO | | SPRINT_0136_0000_0001_scanner_surface | Scanner Guild, Policy Guild, Offline Kit Guild (docs/modules/scanner) | docs/modules/scanner | Deliver Windows policy/offline integration per `design/windows-analyzer.md` §5–6. | | | +| SCANNER-ENTRYTRACE-18-502 | TODO | | SPRINT_0135_0000_0001_scanner_surface | EntryTrace Guild (src/Scanner/__Libraries/StellaOps.Scanner.EntryTrace) | src/Scanner/__Libraries/StellaOps.Scanner.EntryTrace | Expand chain walker with init shim/user-switch/supervisor recognition plus env/workdir accumulation and guarded edges. | SCANNER-ENTRYTRACE-18-508 | | +| SCANNER-ENTRYTRACE-18-503 | TODO | | SPRINT_0135_0000_0001_scanner_surface | EntryTrace Guild (src/Scanner/__Libraries/StellaOps.Scanner.EntryTrace) | src/Scanner/__Libraries/StellaOps.Scanner.EntryTrace | Introduce target classifier + EntryPlan handoff with confidence scoring for ELF/Java/.NET/Node/Python and user/workdir context. | SCANNER-ENTRYTRACE-18-502 | | +| SCANNER-ENTRYTRACE-18-504 | TODO | | SPRINT_0136_0000_0001_scanner_surface | EntryTrace Guild (src/Scanner/__Libraries/StellaOps.Scanner.EntryTrace) | src/Scanner/__Libraries/StellaOps.Scanner.EntryTrace | Emit EntryTrace AOC NDJSON (`entrytrace.entry/node/edge/target/warning/capability`) and wire CLI/service streaming outputs. | SCANNER-ENTRYTRACE-18-503 | | +| SCANNER-ENTRYTRACE-18-505 | TODO | | SPRINT_0136_0000_0001_scanner_surface | EntryTrace Guild (src/Scanner/__Libraries/StellaOps.Scanner.EntryTrace) | src/Scanner/__Libraries/StellaOps.Scanner.EntryTrace | Implement process-tree replay (ProcGraph) to reconcile `/proc` exec chains with static EntryTrace results, collapsing wrappers and emitting agreement/conflict diagnostics. | SCANNER-ENTRYTRACE-18-504 | | +| SCANNER-ENTRYTRACE-18-506 | TODO | | SPRINT_0136_0000_0001_scanner_surface | EntryTrace Guild, Scanner WebService Guild (src/Scanner/__Libraries/StellaOps.Scanner.EntryTrace) | src/Scanner/__Libraries/StellaOps.Scanner.EntryTrace | Surface EntryTrace graph + confidence via Scanner.WebService and CLI, including target summary in scan reports and policy payloads. | SCANNER-ENTRYTRACE-18-505 | SCSS0102 | +| SCANNER-ENV-01 | TODO (2025-11-06) | 2025-11-06 | SPRINT_0136_0000_0001_scanner_surface | Scanner Worker Guild | src/Scanner/StellaOps.Scanner.Worker | Replace ad-hoc environment reads with `StellaOps.Scanner.Surface.Env` helpers for cache roots and CAS endpoints. | — | SCDE0101 | +| SCANNER-ENV-02 | TODO (2025-11-06) | 2025-11-06 | SPRINT_0136_0000_0001_scanner_surface | Scanner WebService Guild · Ops Guild | src/Scanner/StellaOps.Scanner.WebService | Wire Surface.Env helpers into WebService hosting (cache roots, feature flags) and document configuration. | SCANNER-ENV-01 | SCDE0102 | +| SCANNER-ENV-03 | TODO | | SPRINT_0136_0000_0001_scanner_surface | BuildX Plugin Guild | src/Scanner/StellaOps.Scanner.Sbomer.BuildXPlugin | Adopt Surface.Env helpers for plugin configuration (cache roots, CAS endpoints, feature toggles). | SCANNER-ENV-02 | SCBX0101 | +| SCANNER-EVENTS-16-301 | BLOCKED (2025-10-26) | 2025-10-26 | SPRINT_0136_0000_0001_scanner_surface | Scanner WebService Guild (`src/Scanner/StellaOps.Scanner.WebService`) | src/Scanner/StellaOps.Scanner.WebService | Emit orchestrator-compatible envelopes (`scanner.event.*`) and update integration tests to verify Notifier ingestion (no Redis queue coupling). | EVENTS-16-301 | SCEV0101 | +| SCANNER-GRAPH-21-001 | TODO | | SPRINT_0136_0000_0001_scanner_surface | Scanner WebService Guild, Cartographer Guild (src/Scanner/StellaOps.Scanner.WebService) | src/Scanner/StellaOps.Scanner.WebService | Provide webhook/REST endpoint for Cartographer to request policy overlays and runtime evidence for graph nodes, ensuring determinism and tenant scoping. | | | | SCANNER-LIC-0001 | DONE | 2025-11-10 | SPRINT_0138_0000_0001_scanner_ruby_parity | Scanner Guild, Legal Guild (docs/modules/scanner) | docs/modules/scanner | Tree-sitter licensing captured, `NOTICE.md` updated, and Offline Kit now mirrors `third-party-licenses/` with ruby artifacts. | SCANNER-ENG-0016 | | -| SCANNER-LNM-21-001 | TODO | | SPRINT_136_scanner_surface | Scanner WebService Guild, Policy Guild (src/Scanner/StellaOps.Scanner.WebService) | src/Scanner/StellaOps.Scanner.WebService | Update `/reports` and `/policy/runtime` payloads to consume advisory/vex linksets, exposing source severity arrays and conflict summaries alongside effective verdicts. | | | -| SCANNER-LNM-21-002 | TODO | | SPRINT_136_scanner_surface | Scanner WebService Guild, UI Guild (src/Scanner/StellaOps.Scanner.WebService) | src/Scanner/StellaOps.Scanner.WebService | Add evidence endpoint for Console to fetch linkset summaries with policy overlay for a component/SBOM, including AOC references. | SCANNER-LNM-21-001 | | +| SCANNER-LNM-21-001 | TODO | | SPRINT_0136_0000_0001_scanner_surface | Scanner WebService Guild, Policy Guild (src/Scanner/StellaOps.Scanner.WebService) | src/Scanner/StellaOps.Scanner.WebService | Update `/reports` and `/policy/runtime` payloads to consume advisory/vex linksets, exposing source severity arrays and conflict summaries alongside effective verdicts. | | | +| SCANNER-LNM-21-002 | TODO | | SPRINT_0136_0000_0001_scanner_surface | Scanner WebService Guild, UI Guild (src/Scanner/StellaOps.Scanner.WebService) | src/Scanner/StellaOps.Scanner.WebService | Add evidence endpoint for Console to fetch linkset summaries with policy overlay for a component/SBOM, including AOC references. | SCANNER-LNM-21-001 | | | SCANNER-NATIVE-401-015 | TODO | | SPRINT_0401_0001_0001_reachability_evidence_chain | Scanner Worker Guild | `src/Scanner/__Libraries/StellaOps.Scanner.Symbols.Native`, `src/Scanner/__Libraries/StellaOps.Scanner.CallGraph.Native` | Stand up `StellaOps.Scanner.Symbols.Native` + `StellaOps.Scanner.CallGraph.Native` (ELF/PE readers, demanglers, probabilistic carving) and publish `FuncNode`/`CallEdge` CAS bundles consumed by reachability graphs. | Requires CAS schema approval from GAPG0101 | SCNA0101 | | SCANNER-OPS-0001 | TODO | | SPRINT_327_docs_modules_scanner | Ops Guild (docs/modules/scanner) | docs/modules/scanner | Review scanner runbooks/observability assets after the next sprint demo and capture findings inline with sprint notes. | | | | SCANNER-POLICY-0001 | DONE | 2025-11-10 | SPRINT_0138_0000_0001_scanner_ruby_parity | Policy Guild, Ruby Analyzer Guild (docs/modules/scanner) | docs/modules/scanner | Ruby predicates shipped: Policy Engine exposes `sbom.any_component` + `ruby.*`, tests updated, DSL/offline-kit docs refreshed. | SCANNER-ENG-0018 | | -| SCANNER-SECRETS-03 | TODO | | SPRINT_136_scanner_surface | BuildX Plugin Guild, Security Guild (src/Scanner/StellaOps.Scanner.Sbomer.BuildXPlugin) | src/Scanner/StellaOps.Scanner.Sbomer.BuildXPlugin | Use Surface.Secrets to retrieve registry credentials when interacting with CAS/referrers. | SCANNER-SECRETS-02 | | -| SCANNER-SORT-02 | TODO | | SPRINT_136_scanner_surface | Scanner Core Guild (src/Scanner/__Libraries/StellaOps.Scanner.Core) | src/Scanner/__Libraries/StellaOps.Scanner.Core | Sort layer fragments by digest and components by `identity.purl`/`identity.key` before composition; add determinism regression tests. | SCANNER-EMIT-15-001 | | -| SCANNER-SURFACE-04 | TODO | | SPRINT_136_scanner_surface | Scanner Worker Guild (src/Scanner/StellaOps.Scanner.Worker) | src/Scanner/StellaOps.Scanner.Worker | DSSE-sign every `layer.fragments` payload, emit `_composition.json`, and persist DSSE envelopes so offline kits can replay deterministically (see `docs/modules/scanner/deterministic-sbom-compose.md` §2.1). | SCANNER-SURFACE-01; SURFACE-FS-03 | | +| SCANNER-SECRETS-03 | TODO | | SPRINT_0136_0000_0001_scanner_surface | BuildX Plugin Guild, Security Guild (src/Scanner/StellaOps.Scanner.Sbomer.BuildXPlugin) | src/Scanner/StellaOps.Scanner.Sbomer.BuildXPlugin | Use Surface.Secrets to retrieve registry credentials when interacting with CAS/referrers. | SCANNER-SECRETS-02 | | +| SCANNER-SORT-02 | TODO | | SPRINT_0136_0000_0001_scanner_surface | Scanner Core Guild (src/Scanner/__Libraries/StellaOps.Scanner.Core) | src/Scanner/__Libraries/StellaOps.Scanner.Core | Sort layer fragments by digest and components by `identity.purl`/`identity.key` before composition; add determinism regression tests. | SCANNER-EMIT-15-001 | | +| SCANNER-SURFACE-04 | TODO | | SPRINT_0136_0000_0001_scanner_surface | Scanner Worker Guild (src/Scanner/StellaOps.Scanner.Worker) | src/Scanner/StellaOps.Scanner.Worker | DSSE-sign every `layer.fragments` payload, emit `_composition.json`, and persist DSSE envelopes so offline kits can replay deterministically (see `docs/modules/scanner/deterministic-sbom-compose.md` §2.1). | SCANNER-SURFACE-01; SURFACE-FS-03 | | | SCHED-IMPACT-16-303 | DONE | | SPRINT_0155_0001_0001_scheduler_i | Scheduler ImpactIndex Guild (src/Scheduler/__Libraries/StellaOps.Scheduler.ImpactIndex) | src/Scheduler/__Libraries/StellaOps.Scheduler.ImpactIndex | Snapshot/compaction + invalidation for removed images; persistence to RocksDB/Redis per architecture. | | | | SCHED-SURFACE-01 | TODO | | SPRINT_0155_0001_0001_scheduler_i | Scheduler Worker Guild (src/Scheduler/__Libraries/StellaOps.Scheduler.Worker) | src/Scheduler/__Libraries/StellaOps.Scheduler.Worker | Evaluate Surface.FS pointers when planning delta scans to avoid redundant work and prioritise drift-triggered assets. | | | -| SCHED-SURFACE-02 | TODO | | SPRINT_136_scanner_surface | Scheduler Worker Guild (src/Scheduler/__Libraries/StellaOps.Scheduler.Worker) | src/Scheduler/__Libraries/StellaOps.Scheduler.Worker | Integrate Scheduler worker prefetch using Surface manifest reader and persist manifest pointers with rerun plans. | SURFACE-FS-02; SCHED-SURFACE-01 | | +| SCHED-SURFACE-02 | TODO | | SPRINT_0136_0000_0001_scanner_surface | Scheduler Worker Guild (src/Scheduler/__Libraries/StellaOps.Scheduler.Worker) | src/Scheduler/__Libraries/StellaOps.Scheduler.Worker | Integrate Scheduler worker prefetch using Surface manifest reader and persist manifest pointers with rerun plans. | SURFACE-FS-02; SCHED-SURFACE-01 | | | SCHED-VULN-29-001 | DONE | | SPRINT_0155_0001_0001_scheduler_i | Scheduler WebService Guild, Findings Ledger Guild (src/Scheduler/StellaOps.Scheduler.WebService) | src/Scheduler/StellaOps.Scheduler.WebService | Expose resolver job APIs (`POST /vuln/resolver/jobs`, `GET /vuln/resolver/jobs/{id}`) to trigger candidate recomputation per artifact/policy change with RBAC and rate limits. | | | | SCHED-VULN-29-002 | TODO | | SPRINT_0155_0001_0001_scheduler_i | Scheduler WebService Guild, Observability Guild (src/Scheduler/StellaOps.Scheduler.WebService) | src/Scheduler/StellaOps.Scheduler.WebService | Provide projector lag metrics endpoint and webhook notifications for backlog breaches consumed by DevOps dashboards. Dependencies: SCHED-VULN-29-001. | | | | SCHED-WEB-20-002 | TODO | | SPRINT_0155_0001_0001_scheduler_i | Scheduler WebService Guild (src/Scheduler/StellaOps.Scheduler.WebService) | src/Scheduler/StellaOps.Scheduler.WebService | Provide simulation trigger endpoint returning diff preview metadata and job state for UI/CLI consumption. | | | @@ -3959,10 +3959,10 @@ | SCHEMA-401-024 | TODO | | SPRINT_0401_0001_0001_reachability_evidence_chain | Signals Guild (`src/Signals/StellaOps.Signals`, `docs/uncertainty/README.md`) | `src/Signals/StellaOps.Signals`, `docs/uncertainty/README.md` | | | | | SCORER-401-025 | TODO | | SPRINT_0401_0001_0001_reachability_evidence_chain | Signals Guild (`src/Signals/StellaOps.Signals.Application`, `docs/uncertainty/README.md`) | `src/Signals/StellaOps.Signals.Application`, `docs/uncertainty/README.md` | | | | | SCORING-401-003 | TODO | | SPRINT_0401_0001_0001_reachability_evidence_chain | Signals Guild (`src/Signals/StellaOps.Signals`) | `src/Signals/StellaOps.Signals` | | | | -| SDK-62-001 | TODO | | SPRINT_204_cli_iv | DevEx/CLI Guild, SDK Generator Guild (src/Cli/StellaOps.Cli) | src/Cli/StellaOps.Cli | | | | -| SDK-62-002 | TODO | | SPRINT_204_cli_iv | DevEx/CLI Guild (src/Cli/StellaOps.Cli) | src/Cli/StellaOps.Cli | | | | -| SDK-63-001 | TODO | | SPRINT_204_cli_iv | DevEx/CLI Guild, API Governance Guild (src/Cli/StellaOps.Cli) | src/Cli/StellaOps.Cli | | | | -| SDK-64-001 | TODO | | SPRINT_204_cli_iv | DevEx/CLI Guild, SDK Release Guild (src/Cli/StellaOps.Cli) | src/Cli/StellaOps.Cli | | | | +| SDK-62-001 | TODO | | SPRINT_0204_0000_0004_cli_iv | DevEx/CLI Guild, SDK Generator Guild (src/Cli/StellaOps.Cli) | src/Cli/StellaOps.Cli | | | | +| SDK-62-002 | TODO | | SPRINT_0204_0000_0004_cli_iv | DevEx/CLI Guild (src/Cli/StellaOps.Cli) | src/Cli/StellaOps.Cli | | | | +| SDK-63-001 | TODO | | SPRINT_0204_0000_0004_cli_iv | DevEx/CLI Guild, API Governance Guild (src/Cli/StellaOps.Cli) | src/Cli/StellaOps.Cli | | | | +| SDK-64-001 | TODO | | SPRINT_0204_0000_0004_cli_iv | DevEx/CLI Guild, SDK Release Guild (src/Cli/StellaOps.Cli) | src/Cli/StellaOps.Cli | | | | | SDKGEN-62-001 | TODO | | SPRINT_0208_0001_0001_sdk | SDK Generator Guild | src/Sdk/StellaOps.Sdk.Generator | Choose/pin generator toolchain, set up language template pipeline, and enforce reproducible builds. | DEVL0101 portal contracts | SDKG0101 | | SDKGEN-62-002 | TODO | | SPRINT_0208_0001_0001_sdk | SDK Generator Guild | src/Sdk/StellaOps.Sdk.Generator | Implement shared post-processing (auth helpers, retries, pagination utilities, telemetry hooks) applied to all languages. Dependencies: SDKGEN-62-001. | SDKGEN-62-001 | SDKG0101 | | SDKGEN-63-001 | TODO | | SPRINT_0208_0001_0001_sdk | SDK Generator Guild | src/Sdk/StellaOps.Sdk.Generator | Ship TypeScript SDK alpha with ESM/CJS builds, typed errors, paginator, streaming helpers. Dependencies: SDKGEN-62-002. | 63-004 | SDKG0101 | @@ -4001,12 +4001,12 @@ | SEC2 | DONE | 2025-11-09 | SPRINT_100_identity_signing | Security Guild, Storage Guild (src/Authority/StellaOps.Authority/StellaOps.Authority.Plugin.Standard) | src/Authority/StellaOps.Authority/StellaOps.Authority.Plugin.Standard | | | | | SEC3 | DONE | 2025-11-09 | SPRINT_100_identity_signing | Security Guild, BE-Auth Plugin (src/Authority/StellaOps.Authority/StellaOps.Authority.Plugin.Standard) | src/Authority/StellaOps.Authority/StellaOps.Authority.Plugin.Standard | | | | | SEC5 | DONE | 2025-11-09 | SPRINT_100_identity_signing | Security Guild (src/Authority/StellaOps.Authority/StellaOps.Authority.Plugin.Standard) | src/Authority/StellaOps.Authority/StellaOps.Authority.Plugin.Standard | | | | -| SECRETS-01 | DOING | 2025-11-02 | SPRINT_136_scanner_surface | Scanner Guild, Security Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.Secrets) | src/Scanner/__Libraries/StellaOps.Scanner.Surface.Secrets | | | | -| SECRETS-02 | DOING | 2025-11-02 | SPRINT_136_scanner_surface | Scanner Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.Secrets) | src/Scanner/__Libraries/StellaOps.Scanner.Surface.Secrets | | SURFACE-SECRETS-01 | | -| SECRETS-03 | TODO | | SPRINT_136_scanner_surface | BuildX Plugin Guild · Security Guild | src/Scanner/StellaOps.Scanner.Sbomer.BuildXPlugin | SCANNER-SECRETS-02 | SCANNER-SECRETS-02 | SCBX0101 | -| SECRETS-04 | TODO | | SPRINT_136_scanner_surface | Scanner Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.Secrets) | src/Scanner/__Libraries/StellaOps.Scanner.Surface.Secrets | | SURFACE-SECRETS-02 | | -| SECRETS-05 | TODO | | SPRINT_136_scanner_surface | Zastava Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.Secrets) | src/Scanner/__Libraries/StellaOps.Scanner.Surface.Secrets | | SURFACE-SECRETS-02 | | -| SECRETS-06 | TODO | | SPRINT_136_scanner_surface | Ops Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.Secrets) | src/Scanner/__Libraries/StellaOps.Scanner.Surface.Secrets | | SURFACE-SECRETS-03 | | +| SECRETS-01 | DOING | 2025-11-02 | SPRINT_0136_0000_0001_scanner_surface | Scanner Guild, Security Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.Secrets) | src/Scanner/__Libraries/StellaOps.Scanner.Surface.Secrets | | | | +| SECRETS-02 | DOING | 2025-11-02 | SPRINT_0136_0000_0001_scanner_surface | Scanner Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.Secrets) | src/Scanner/__Libraries/StellaOps.Scanner.Surface.Secrets | | SURFACE-SECRETS-01 | | +| SECRETS-03 | TODO | | SPRINT_0136_0000_0001_scanner_surface | BuildX Plugin Guild · Security Guild | src/Scanner/StellaOps.Scanner.Sbomer.BuildXPlugin | SCANNER-SECRETS-02 | SCANNER-SECRETS-02 | SCBX0101 | +| SECRETS-04 | TODO | | SPRINT_0136_0000_0001_scanner_surface | Scanner Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.Secrets) | src/Scanner/__Libraries/StellaOps.Scanner.Surface.Secrets | | SURFACE-SECRETS-02 | | +| SECRETS-05 | TODO | | SPRINT_0136_0000_0001_scanner_surface | Zastava Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.Secrets) | src/Scanner/__Libraries/StellaOps.Scanner.Surface.Secrets | | SURFACE-SECRETS-02 | | +| SECRETS-06 | TODO | | SPRINT_0136_0000_0001_scanner_surface | Ops Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.Secrets) | src/Scanner/__Libraries/StellaOps.Scanner.Surface.Secrets | | SURFACE-SECRETS-03 | | | SERVER-401-011 | TODO | | SPRINT_0401_0001_0001_reachability_evidence_chain | Symbols Guild (`src/Symbols/StellaOps.Symbols.Server`) | `src/Symbols/StellaOps.Symbols.Server` | | | | | SERVICE-21-001 | BLOCKED | | SPRINT_0140_0001_0001_runtime_signals | | | | | | | SERVICE-21-002 | BLOCKED | | SPRINT_0140_0001_0001_runtime_signals | | | | | | @@ -4019,7 +4019,7 @@ | SERVICE-OPS-0001 | TODO | | SPRINT_0326_0001_0001_docs_modules_registry | Ops Guild (docs/modules/registry) | docs/modules/registry | | | | | SIG-003 | TODO | | SPRINT_0401_0001_0001_reachability_evidence_chain | Signals Guild (`src/Signals/StellaOps.Signals`, `docs/reachability/function-level-evidence.md`) | `src/Signals/StellaOps.Signals`, `docs/reachability/function-level-evidence.md` | | | | | SIG-26-001 | TODO | | SPRINT_115_concelier_iv | Concelier Core Guild, Signals Guild (src/Concelier/__Libraries/StellaOps.Concelier.Core) | src/Concelier/__Libraries/StellaOps.Concelier.Core | | | | -| SIG-26-002 | TODO | | SPRINT_204_cli_iv | DevEx/CLI Guild (src/Cli/StellaOps.Cli) | src/Cli/StellaOps.Cli | | | | +| SIG-26-002 | TODO | | SPRINT_0204_0000_0004_cli_iv | DevEx/CLI Guild (src/Cli/StellaOps.Cli) | src/Cli/StellaOps.Cli | | | | | SIG-26-003 | TODO | | SPRINT_0211_0001_0003_ui_iii | UI Guild (src/UI/StellaOps.UI) | src/UI/StellaOps.UI | | | | | SIG-26-004 | TODO | | SPRINT_0211_0001_0003_ui_iii | UI Guild (src/UI/StellaOps.UI) | src/UI/StellaOps.UI | | | | | SIG-26-005 | TODO | | SPRINT_0309_0001_0009_docs_tasks_md_ix | Docs Guild, UI Guild (docs) | | | | | @@ -4027,10 +4027,10 @@ | SIG-26-007 | TODO | | SPRINT_0309_0001_0009_docs_tasks_md_ix | Docs Guild, BE-Base Platform Guild (docs) | | | | | | SIG-26-008 | DOING | | SPRINT_0310_0001_0010_docs_tasks_md_x | Docs Guild, DevOps Guild (docs) | | | | | | SIG-STORE-401-016 | TODO | | SPRINT_0401_0001_0001_reachability_evidence_chain | Signals Guild · BE-Base Platform Guild (`src/Signals/StellaOps.Signals`, `src/__Libraries/StellaOps.Replay.Core`) | `src/Signals/StellaOps.Signals`, `src/__Libraries/StellaOps.Replay.Core` | Introduce shared reachability store collections (`func_nodes`, `call_edges`, `cve_func_hits`), indexes, and repository APIs so Scanner/Signals/Policy can reuse canonical function data. | | | -| SIGN-CORE-186-004 | DONE | 2025-11-26 | SPRINT_186_record_deterministic_execution | Signing Guild | `src/Signer/StellaOps.Signer`, `src/__Libraries/StellaOps.Cryptography` | Replace the HMAC demo implementation in `StellaOps.Signer` with StellaOps.Cryptography providers (keyless + KMS), including provider selection, key material loading, and cosign-compatible DSSE signature output. | Mirrors #1 | SIGR0101 | -| SIGN-CORE-186-005 | DONE | 2025-11-26 | SPRINT_186_record_deterministic_execution | Signing Guild | `src/Signer/StellaOps.Signer.Core` | Refactor `SignerStatementBuilder` to support StellaOps predicate types (e.g., `stella.ops/promotion@v1`) and delegate payload canonicalisation to the Provenance library once available. | Mirrors #2 | SIGR0101 | -| SIGN-REPLAY-186-003 | TODO | | SPRINT_186_record_deterministic_execution | Signing Guild (`src/Signer/StellaOps.Signer`, `src/Authority/StellaOps.Authority`) | `src/Signer/StellaOps.Signer`, `src/Authority/StellaOps.Authority` | Extend Signer/Authority DSSE flows to cover replay manifest/bundle payload types with multi-profile support; refresh `docs/modules/signer/architecture.md` and `docs/modules/authority/architecture.md` to capture the new signing/verification path referencing `docs/replay/DETERMINISTIC_REPLAY.md` Section 5. | | | -| SIGN-TEST-186-006 | DONE | 2025-11-26 | SPRINT_186_record_deterministic_execution | Signing Guild, QA Guild (`src/Signer/StellaOps.Signer.Tests`) | `src/Signer/StellaOps.Signer.Tests` | Upgrade signer integration tests to run against the real crypto abstraction and fixture predicates (promotion, SBOM, replay), replacing stub tokens/digests with deterministic test data. | | | +| SIGN-CORE-186-004 | DONE | 2025-11-26 | SPRINT_0186_0000_0001_record_deterministic_execution | Signing Guild | `src/Signer/StellaOps.Signer`, `src/__Libraries/StellaOps.Cryptography` | Replace the HMAC demo implementation in `StellaOps.Signer` with StellaOps.Cryptography providers (keyless + KMS), including provider selection, key material loading, and cosign-compatible DSSE signature output. | Mirrors #1 | SIGR0101 | +| SIGN-CORE-186-005 | DONE | 2025-11-26 | SPRINT_0186_0000_0001_record_deterministic_execution | Signing Guild | `src/Signer/StellaOps.Signer.Core` | Refactor `SignerStatementBuilder` to support StellaOps predicate types (e.g., `stella.ops/promotion@v1`) and delegate payload canonicalisation to the Provenance library once available. | Mirrors #2 | SIGR0101 | +| SIGN-REPLAY-186-003 | TODO | | SPRINT_0186_0000_0001_record_deterministic_execution | Signing Guild (`src/Signer/StellaOps.Signer`, `src/Authority/StellaOps.Authority`) | `src/Signer/StellaOps.Signer`, `src/Authority/StellaOps.Authority` | Extend Signer/Authority DSSE flows to cover replay manifest/bundle payload types with multi-profile support; refresh `docs/modules/signer/architecture.md` and `docs/modules/authority/architecture.md` to capture the new signing/verification path referencing `docs/replay/DETERMINISTIC_REPLAY.md` Section 5. | | | +| SIGN-TEST-186-006 | DONE | 2025-11-26 | SPRINT_0186_0000_0001_record_deterministic_execution | Signing Guild, QA Guild (`src/Signer/StellaOps.Signer.Tests`) | `src/Signer/StellaOps.Signer.Tests` | Upgrade signer integration tests to run against the real crypto abstraction and fixture predicates (promotion, SBOM, replay), replacing stub tokens/digests with deterministic test data. | | | | SIGN-VEX-401-018 | DONE | 2025-11-26 | SPRINT_0401_0001_0001_reachability_evidence_chain | Signing Guild (`src/Signer/StellaOps.Signer`, `docs/modules/signer/architecture.md`) | `src/Signer/StellaOps.Signer`, `docs/modules/signer/architecture.md` | Extend Signer predicate catalog with `stella.ops/vexDecision@v1`, enforce payload policy, and plumb DSSE/Rekor integration for policy decisions. | | | | SIGNALS-24-001 | DONE | 2025-11-09 | SPRINT_0140_0001_0001_runtime_signals | | | Host skeleton, RBAC, sealed-mode readiness, `/signals/facts/{subject}` retrieval, and readiness probes merged; serves as base for downstream ingestion. | | | | SIGNALS-24-002 | DOING | 2025-11-07 | SPRINT_0140_0001_0001_runtime_signals | | | Callgraph ingestion + retrieval APIs are live, but CAS promotion and signed manifest publication remain; cannot close until reachability jobs can trust stored graphs. | | | @@ -4044,88 +4044,88 @@ | SIGNER-DOCS-0001 | DONE | 2025-11-05 | SPRINT_0329_0001_0001_docs_modules_signer | Docs Guild (docs/modules/signer) | docs/modules/signer | Validate that `docs/modules/signer/README.md` captures the latest DSSE/fulcio updates. | | | | SIGNER-ENG-0001 | DONE | 2025-11-26 | SPRINT_0329_0001_0001_docs_modules_signer | Module Team (docs/modules/signer) | docs/modules/signer | Keep module milestones aligned with signer sprints under `/docs/implplan`. Updated README with Sprint 0186/0401 completed tasks (SIGN-CORE-186-004/005, SIGN-TEST-186-006, SIGN-VEX-401-018). | | | | SIGNER-OPS-0001 | TODO | | SPRINT_0329_0001_0001_docs_modules_signer | Ops Guild (docs/modules/signer) | docs/modules/signer | Review signer runbooks/observability assets after next sprint demo. | | | -| SORT-02 | TODO | | SPRINT_136_scanner_surface | Scanner Core Guild (src/Scanner/__Libraries/StellaOps.Scanner.Core) | src/Scanner/__Libraries/StellaOps.Scanner.Core | | SCANNER-EMIT-15-001 | | +| SORT-02 | TODO | | SPRINT_0136_0000_0001_scanner_surface | Scanner Core Guild (src/Scanner/__Libraries/StellaOps.Scanner.Core) | src/Scanner/__Libraries/StellaOps.Scanner.Core | | SCANNER-EMIT-15-001 | | | ORCH-DOCS-0001 | DONE | | SPRINT_0323_0001_0001_docs_modules_orchestrator | Docs Guild (docs/modules/orchestrator) | docs/modules/orchestrator | Refresh orchestrator README + diagrams to reflect job leasing changes and reference the task runner bridge. | | | | ORCH-ENG-0001 | DONE | | SPRINT_0323_0001_0001_docs_modules_orchestrator | Module Team (docs/modules/orchestrator) | docs/modules/orchestrator | Sync into ../.. | | | | ORCH-OPS-0001 | DONE | | SPRINT_0323_0001_0001_docs_modules_orchestrator | Ops Guild (docs/modules/orchestrator) | docs/modules/orchestrator | Document outputs in ./README.md | | | -| SPL-23-001 | TODO | | SPRINT_128_policy_reasoning | Policy Guild, Language Infrastructure Guild / src/Policy/__Libraries/StellaOps.Policy | src/Policy/__Libraries/StellaOps.Policy | | | | -| SPL-23-002 | TODO | | SPRINT_128_policy_reasoning | Policy Guild / src/Policy/__Libraries/StellaOps.Policy | src/Policy/__Libraries/StellaOps.Policy | | POLICY-SPL-23-001 | | -| SPL-23-003 | TODO | | SPRINT_128_policy_reasoning | Policy Guild / src/Policy/__Libraries/StellaOps.Policy | src/Policy/__Libraries/StellaOps.Policy | | POLICY-SPL-23-002 | | -| SPL-23-004 | TODO | | SPRINT_128_policy_reasoning | Policy Guild, Audit Guild / src/Policy/__Libraries/StellaOps.Policy | src/Policy/__Libraries/StellaOps.Policy | | POLICY-SPL-23-003 | | -| SPL-23-005 | TODO | | SPRINT_128_policy_reasoning | Policy Guild, DevEx Guild / src/Policy/__Libraries/StellaOps.Policy | src/Policy/__Libraries/StellaOps.Policy | | POLICY-SPL-23-004 | | -| SPL-24-001 | DONE (2025-11-26) | 2025-11-26 | SPRINT_128_policy_reasoning | Policy Guild, Signals Guild / src/Policy/__Libraries/StellaOps.Policy | src/Policy/__Libraries/StellaOps.Policy | | POLICY-SPL-23-005 | | +| SPL-23-001 | TODO | | SPRINT_0128_0000_0001_policy_reasoning | Policy Guild, Language Infrastructure Guild / src/Policy/__Libraries/StellaOps.Policy | src/Policy/__Libraries/StellaOps.Policy | | | | +| SPL-23-002 | TODO | | SPRINT_0128_0000_0001_policy_reasoning | Policy Guild / src/Policy/__Libraries/StellaOps.Policy | src/Policy/__Libraries/StellaOps.Policy | | POLICY-SPL-23-001 | | +| SPL-23-003 | TODO | | SPRINT_0128_0000_0001_policy_reasoning | Policy Guild / src/Policy/__Libraries/StellaOps.Policy | src/Policy/__Libraries/StellaOps.Policy | | POLICY-SPL-23-002 | | +| SPL-23-004 | TODO | | SPRINT_0128_0000_0001_policy_reasoning | Policy Guild, Audit Guild / src/Policy/__Libraries/StellaOps.Policy | src/Policy/__Libraries/StellaOps.Policy | | POLICY-SPL-23-003 | | +| SPL-23-005 | TODO | | SPRINT_0128_0000_0001_policy_reasoning | Policy Guild, DevEx Guild / src/Policy/__Libraries/StellaOps.Policy | src/Policy/__Libraries/StellaOps.Policy | | POLICY-SPL-23-004 | | +| SPL-24-001 | DONE (2025-11-26) | 2025-11-26 | SPRINT_0128_0000_0001_policy_reasoning | Policy Guild, Signals Guild / src/Policy/__Libraries/StellaOps.Policy | src/Policy/__Libraries/StellaOps.Policy | | POLICY-SPL-23-005 | | | STORE-401-016 | TODO | | SPRINT_0401_0001_0001_reachability_evidence_chain | Signals Guild · BE-Base Platform Guild (`src/Signals/StellaOps.Signals`, `src/__Libraries/StellaOps.Replay.Core`) | `src/Signals/StellaOps.Signals`, `src/__Libraries/StellaOps.Replay.Core` | | | | -| STORE-AOC-19-001 | TODO | | SPRINT_123_excititor_v | Excititor Storage Guild (src/Excititor/__Libraries/StellaOps.Excititor.Storage.Mongo) | src/Excititor/__Libraries/StellaOps.Excititor.Storage.Mongo | | | | -| STORE-AOC-19-002 | TODO | | SPRINT_123_excititor_v | Excititor Storage Guild, DevOps Guild (src/Excititor/__Libraries/StellaOps.Excititor.Storage.Mongo) | src/Excititor/__Libraries/StellaOps.Excititor.Storage.Mongo | | | | +| STORE-AOC-19-001 | TODO | | SPRINT_0123_0000_0005_excititor_v | Excititor Storage Guild (src/Excititor/__Libraries/StellaOps.Excititor.Storage.Mongo) | src/Excititor/__Libraries/StellaOps.Excititor.Storage.Mongo | | | | +| STORE-AOC-19-002 | TODO | | SPRINT_0123_0000_0005_excititor_v | Excititor Storage Guild, DevOps Guild (src/Excititor/__Libraries/StellaOps.Excititor.Storage.Mongo) | src/Excititor/__Libraries/StellaOps.Excititor.Storage.Mongo | | | | | STORE-AOC-19-005 | TODO | 2025-11-04 | SPRINT_115_concelier_iv | Concelier Storage Guild, DevOps Guild (src/Concelier/__Libraries/StellaOps.Concelier.Storage.Mongo) | src/Concelier/__Libraries/StellaOps.Concelier.Storage.Mongo | | | | | SURFACE-01 | TODO | | SPRINT_0140_0001_0001_runtime_signals | | | | | | -| SURFACE-02 | TODO | | SPRINT_136_scanner_surface | Scheduler Worker Guild (src/Scheduler/__Libraries/StellaOps.Scheduler.Worker) | src/Scheduler/__Libraries/StellaOps.Scheduler.Worker | | SURFACE-FS-02; SCHED-SURFACE-01 | | -| SURFACE-04 | TODO | | SPRINT_136_scanner_surface | Scanner Worker Guild (src/Scanner/StellaOps.Scanner.Worker) | src/Scanner/StellaOps.Scanner.Worker | | SCANNER-SURFACE-01; SURFACE-FS-03 | | -| SURFACE-ENV-01 | DONE | 2025-11-13 | SPRINT_136_scanner_surface | Scanner Guild, Zastava Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.Env) | src/Scanner/__Libraries/StellaOps.Scanner.Surface.Env | Draft `surface-env.md` enumerating environment variables, defaults, and air-gap behaviour for Surface consumers. | — | SCSS0101 | -| SURFACE-ENV-02 | DOING | 2025-11-02 | SPRINT_136_scanner_surface | Scanner Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.Env) | src/Scanner/__Libraries/StellaOps.Scanner.Surface.Env | Implement strongly-typed env accessors with validation and deterministic logging inside `StellaOps.Scanner.Surface.Env`. | SURFACE-ENV-01 | SCSS0101 | -| SURFACE-ENV-03 | TODO | | SPRINT_136_scanner_surface | Scanner Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.Env) | src/Scanner/__Libraries/StellaOps.Scanner.Surface.Env | Adopt the env helper across Scanner Worker/WebService/BuildX plug-ins. | SURFACE-ENV-02 | | -| SURFACE-ENV-04 | TODO | | SPRINT_136_scanner_surface | Zastava Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.Env) | src/Scanner/__Libraries/StellaOps.Scanner.Surface.Env | Wire env helper into Zastava Observer/Webhook containers. | SURFACE-ENV-02 | | -| SURFACE-ENV-05 | TODO | | SPRINT_136_scanner_surface | Ops Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.Env) | src/Scanner/__Libraries/StellaOps.Scanner.Surface.Env | Update Helm/Compose/offline kit templates with new env knobs and documentation. | SURFACE-ENV-03; SURFACE-ENV-04 | | -| SURFACE-FS-03 | TODO | | SPRINT_136_scanner_surface | Scanner Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.FS) | src/Scanner/__Libraries/StellaOps.Scanner.Surface.FS | Integrate Surface.FS writer into Scanner Worker analyzer pipeline to persist layer + entry-trace fragments. | SURFACE-FS-02 | | -| SURFACE-FS-04 | TODO | | SPRINT_136_scanner_surface | Zastava Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.FS) | src/Scanner/__Libraries/StellaOps.Scanner.Surface.FS | Integrate Surface.FS reader into Zastava Observer runtime drift loop. | SURFACE-FS-02 | | -| SURFACE-FS-05 | TODO | | SPRINT_136_scanner_surface | Scanner Guild, Scheduler Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.FS) | src/Scanner/__Libraries/StellaOps.Scanner.Surface.FS | Expose Surface.FS pointers via Scanner WebService reports and coordinate rescan planning with Scheduler. | SURFACE-FS-03 | | -| SURFACE-FS-06 | TODO | | SPRINT_136_scanner_surface | Docs Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.FS) | src/Scanner/__Libraries/StellaOps.Scanner.Surface.FS | Update scanner-engine guide and offline kit docs with Surface.FS workflow. | SURFACE-FS-02 | | -| SURFACE-FS-07 | DONE | 2025-12-04 | SPRINT_136_scanner_surface | Scanner Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.FS) | src/Scanner/__Libraries/StellaOps.Scanner.Surface.FS | Extend Surface.FS manifest schema with `composition.recipe`, fragment attestation metadata, and verification helpers per deterministic SBOM spec. | SCANNER-SURFACE-04 | | -| SURFACE-SECRETS-01 | DOING | 2025-11-02 | SPRINT_136_scanner_surface | Scanner Guild, Security Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.Secrets) | src/Scanner/__Libraries/StellaOps.Scanner.Surface.Secrets | Produce `surface-secrets.md` defining secret reference schema, storage backends, scopes, and rotation rules. | | | -| SURFACE-SECRETS-02 | DOING | 2025-11-02 | SPRINT_136_scanner_surface | Scanner Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.Secrets) | src/Scanner/__Libraries/StellaOps.Scanner.Surface.Secrets | Implement `StellaOps.Scanner.Surface.Secrets` core provider interfaces, secret models, and in-memory test backend. | SURFACE-SECRETS-01 | | -| SURFACE-SECRETS-03 | TODO | | SPRINT_136_scanner_surface | Scanner Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.Secrets) | src/Scanner/__Libraries/StellaOps.Scanner.Surface.Secrets | Add Kubernetes/File/Offline backends with deterministic caching and audit hooks. | SURFACE-SECRETS-02 | SCSS0101 | -| SURFACE-SECRETS-04 | TODO | | SPRINT_136_scanner_surface | Scanner Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.Secrets) | src/Scanner/__Libraries/StellaOps.Scanner.Surface.Secrets | Integrate Surface.Secrets into Scanner Worker/WebService/BuildX for registry + CAS creds. | SURFACE-SECRETS-02 | | -| SURFACE-SECRETS-05 | TODO | | SPRINT_136_scanner_surface | Zastava Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.Secrets) | src/Scanner/__Libraries/StellaOps.Scanner.Surface.Secrets | Invoke Surface.Secrets from Zastava Observer/Webhook for CAS & attestation secrets. | SURFACE-SECRETS-02 | | -| SURFACE-SECRETS-06 | TODO | | SPRINT_136_scanner_surface | Ops Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.Secrets) | src/Scanner/__Libraries/StellaOps.Scanner.Surface.Secrets | Update deployment manifests/offline kit bundles to provision secret references instead of raw values. | SURFACE-SECRETS-03 | | -| SURFACE-VAL-01 | DOING | 2025-11-01 | SPRINT_136_scanner_surface | Scanner Guild, Security Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.Validation) | src/Scanner/__Libraries/StellaOps.Scanner.Surface.Validation | Define the Surface validation framework (`surface-validation.md`) covering env/cache/secret checks and extension hooks. | SURFACE-FS-01; SURFACE-ENV-01 | SCSS0102 | -| SURFACE-VAL-02 | TODO | | SPRINT_136_scanner_surface | Scanner Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.Validation) | src/Scanner/__Libraries/StellaOps.Scanner.Surface.Validation | Implement base validation library with check registry and default validators for env/cached manifests/secret refs. | SURFACE-VAL-01; SURFACE-ENV-02; SURFACE-FS-02 | SCSS0102 | -| SURFACE-VAL-03 | TODO | | SPRINT_136_scanner_surface | Scanner Guild, Analyzer Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.Validation) | src/Scanner/__Libraries/StellaOps.Scanner.Surface.Validation | Integrate validation pipeline into Scanner analyzers so checks run before processing. | SURFACE-VAL-02 | SCSS0102 | -| SURFACE-VAL-04 | TODO | | SPRINT_136_scanner_surface | Scanner Guild, Zastava Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.Validation) | src/Scanner/__Libraries/StellaOps.Scanner.Surface.Validation | Expose validation helpers to Zastava and other runtime consumers for preflight checks. | SURFACE-VAL-02 | SCSS0102 | -| SURFACE-VAL-05 | TODO | | SPRINT_136_scanner_surface | Docs Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.Validation) | src/Scanner/__Libraries/StellaOps.Scanner.Surface.Validation | Document validation extensibility, registration, and customization in scanner-engine guides. | SURFACE-VAL-02 | SCSS0102 | -| SVC-32-002 | TODO | | SPRINT_152_orchestrator_ii | Orchestrator Service Guild (src/Orchestrator/StellaOps.Orchestrator) | src/Orchestrator/StellaOps.Orchestrator | | | | -| SVC-32-003 | TODO | | SPRINT_152_orchestrator_ii | Orchestrator Service Guild (src/Orchestrator/StellaOps.Orchestrator) | src/Orchestrator/StellaOps.Orchestrator | | | | -| SVC-32-004 | TODO | | SPRINT_152_orchestrator_ii | Orchestrator Service Guild (src/Orchestrator/StellaOps.Orchestrator) | src/Orchestrator/StellaOps.Orchestrator | | | | -| SVC-32-005 | TODO | | SPRINT_152_orchestrator_ii | Orchestrator Service Guild (src/Orchestrator/StellaOps.Orchestrator) | src/Orchestrator/StellaOps.Orchestrator | | | | -| SVC-33-001 | TODO | | SPRINT_152_orchestrator_ii | Orchestrator Service Guild (src/Orchestrator/StellaOps.Orchestrator) | src/Orchestrator/StellaOps.Orchestrator | | | | -| SVC-33-002 | TODO | | SPRINT_152_orchestrator_ii | Orchestrator Service Guild (src/Orchestrator/StellaOps.Orchestrator) | src/Orchestrator/StellaOps.Orchestrator | | | | -| SVC-33-003 | TODO | | SPRINT_152_orchestrator_ii | Orchestrator Service Guild (src/Orchestrator/StellaOps.Orchestrator) | src/Orchestrator/StellaOps.Orchestrator | | | | -| SVC-33-004 | TODO | | SPRINT_152_orchestrator_ii | Orchestrator Service Guild (src/Orchestrator/StellaOps.Orchestrator) | src/Orchestrator/StellaOps.Orchestrator | | | | -| SVC-34-001 | TODO | | SPRINT_152_orchestrator_ii | Orchestrator Service Guild (src/Orchestrator/StellaOps.Orchestrator) | src/Orchestrator/StellaOps.Orchestrator | | | | -| SVC-34-002 | TODO | | SPRINT_152_orchestrator_ii | Orchestrator Service Guild (src/Orchestrator/StellaOps.Orchestrator) | src/Orchestrator/StellaOps.Orchestrator | | | | -| SVC-34-003 | TODO | | SPRINT_152_orchestrator_ii | Orchestrator Service Guild (src/Orchestrator/StellaOps.Orchestrator) | src/Orchestrator/StellaOps.Orchestrator | | | | -| SVC-34-004 | TODO | | SPRINT_152_orchestrator_ii | Orchestrator Service Guild (src/Orchestrator/StellaOps.Orchestrator) | src/Orchestrator/StellaOps.Orchestrator | | | | +| SURFACE-02 | TODO | | SPRINT_0136_0000_0001_scanner_surface | Scheduler Worker Guild (src/Scheduler/__Libraries/StellaOps.Scheduler.Worker) | src/Scheduler/__Libraries/StellaOps.Scheduler.Worker | | SURFACE-FS-02; SCHED-SURFACE-01 | | +| SURFACE-04 | TODO | | SPRINT_0136_0000_0001_scanner_surface | Scanner Worker Guild (src/Scanner/StellaOps.Scanner.Worker) | src/Scanner/StellaOps.Scanner.Worker | | SCANNER-SURFACE-01; SURFACE-FS-03 | | +| SURFACE-ENV-01 | DONE | 2025-11-13 | SPRINT_0136_0000_0001_scanner_surface | Scanner Guild, Zastava Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.Env) | src/Scanner/__Libraries/StellaOps.Scanner.Surface.Env | Draft `surface-env.md` enumerating environment variables, defaults, and air-gap behaviour for Surface consumers. | — | SCSS0101 | +| SURFACE-ENV-02 | DOING | 2025-11-02 | SPRINT_0136_0000_0001_scanner_surface | Scanner Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.Env) | src/Scanner/__Libraries/StellaOps.Scanner.Surface.Env | Implement strongly-typed env accessors with validation and deterministic logging inside `StellaOps.Scanner.Surface.Env`. | SURFACE-ENV-01 | SCSS0101 | +| SURFACE-ENV-03 | TODO | | SPRINT_0136_0000_0001_scanner_surface | Scanner Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.Env) | src/Scanner/__Libraries/StellaOps.Scanner.Surface.Env | Adopt the env helper across Scanner Worker/WebService/BuildX plug-ins. | SURFACE-ENV-02 | | +| SURFACE-ENV-04 | TODO | | SPRINT_0136_0000_0001_scanner_surface | Zastava Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.Env) | src/Scanner/__Libraries/StellaOps.Scanner.Surface.Env | Wire env helper into Zastava Observer/Webhook containers. | SURFACE-ENV-02 | | +| SURFACE-ENV-05 | TODO | | SPRINT_0136_0000_0001_scanner_surface | Ops Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.Env) | src/Scanner/__Libraries/StellaOps.Scanner.Surface.Env | Update Helm/Compose/offline kit templates with new env knobs and documentation. | SURFACE-ENV-03; SURFACE-ENV-04 | | +| SURFACE-FS-03 | TODO | | SPRINT_0136_0000_0001_scanner_surface | Scanner Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.FS) | src/Scanner/__Libraries/StellaOps.Scanner.Surface.FS | Integrate Surface.FS writer into Scanner Worker analyzer pipeline to persist layer + entry-trace fragments. | SURFACE-FS-02 | | +| SURFACE-FS-04 | TODO | | SPRINT_0136_0000_0001_scanner_surface | Zastava Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.FS) | src/Scanner/__Libraries/StellaOps.Scanner.Surface.FS | Integrate Surface.FS reader into Zastava Observer runtime drift loop. | SURFACE-FS-02 | | +| SURFACE-FS-05 | TODO | | SPRINT_0136_0000_0001_scanner_surface | Scanner Guild, Scheduler Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.FS) | src/Scanner/__Libraries/StellaOps.Scanner.Surface.FS | Expose Surface.FS pointers via Scanner WebService reports and coordinate rescan planning with Scheduler. | SURFACE-FS-03 | | +| SURFACE-FS-06 | TODO | | SPRINT_0136_0000_0001_scanner_surface | Docs Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.FS) | src/Scanner/__Libraries/StellaOps.Scanner.Surface.FS | Update scanner-engine guide and offline kit docs with Surface.FS workflow. | SURFACE-FS-02 | | +| SURFACE-FS-07 | DONE | 2025-12-04 | SPRINT_0136_0000_0001_scanner_surface | Scanner Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.FS) | src/Scanner/__Libraries/StellaOps.Scanner.Surface.FS | Extend Surface.FS manifest schema with `composition.recipe`, fragment attestation metadata, and verification helpers per deterministic SBOM spec. | SCANNER-SURFACE-04 | | +| SURFACE-SECRETS-01 | DOING | 2025-11-02 | SPRINT_0136_0000_0001_scanner_surface | Scanner Guild, Security Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.Secrets) | src/Scanner/__Libraries/StellaOps.Scanner.Surface.Secrets | Produce `surface-secrets.md` defining secret reference schema, storage backends, scopes, and rotation rules. | | | +| SURFACE-SECRETS-02 | DOING | 2025-11-02 | SPRINT_0136_0000_0001_scanner_surface | Scanner Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.Secrets) | src/Scanner/__Libraries/StellaOps.Scanner.Surface.Secrets | Implement `StellaOps.Scanner.Surface.Secrets` core provider interfaces, secret models, and in-memory test backend. | SURFACE-SECRETS-01 | | +| SURFACE-SECRETS-03 | TODO | | SPRINT_0136_0000_0001_scanner_surface | Scanner Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.Secrets) | src/Scanner/__Libraries/StellaOps.Scanner.Surface.Secrets | Add Kubernetes/File/Offline backends with deterministic caching and audit hooks. | SURFACE-SECRETS-02 | SCSS0101 | +| SURFACE-SECRETS-04 | TODO | | SPRINT_0136_0000_0001_scanner_surface | Scanner Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.Secrets) | src/Scanner/__Libraries/StellaOps.Scanner.Surface.Secrets | Integrate Surface.Secrets into Scanner Worker/WebService/BuildX for registry + CAS creds. | SURFACE-SECRETS-02 | | +| SURFACE-SECRETS-05 | TODO | | SPRINT_0136_0000_0001_scanner_surface | Zastava Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.Secrets) | src/Scanner/__Libraries/StellaOps.Scanner.Surface.Secrets | Invoke Surface.Secrets from Zastava Observer/Webhook for CAS & attestation secrets. | SURFACE-SECRETS-02 | | +| SURFACE-SECRETS-06 | TODO | | SPRINT_0136_0000_0001_scanner_surface | Ops Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.Secrets) | src/Scanner/__Libraries/StellaOps.Scanner.Surface.Secrets | Update deployment manifests/offline kit bundles to provision secret references instead of raw values. | SURFACE-SECRETS-03 | | +| SURFACE-VAL-01 | DOING | 2025-11-01 | SPRINT_0136_0000_0001_scanner_surface | Scanner Guild, Security Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.Validation) | src/Scanner/__Libraries/StellaOps.Scanner.Surface.Validation | Define the Surface validation framework (`surface-validation.md`) covering env/cache/secret checks and extension hooks. | SURFACE-FS-01; SURFACE-ENV-01 | SCSS0102 | +| SURFACE-VAL-02 | TODO | | SPRINT_0136_0000_0001_scanner_surface | Scanner Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.Validation) | src/Scanner/__Libraries/StellaOps.Scanner.Surface.Validation | Implement base validation library with check registry and default validators for env/cached manifests/secret refs. | SURFACE-VAL-01; SURFACE-ENV-02; SURFACE-FS-02 | SCSS0102 | +| SURFACE-VAL-03 | TODO | | SPRINT_0136_0000_0001_scanner_surface | Scanner Guild, Analyzer Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.Validation) | src/Scanner/__Libraries/StellaOps.Scanner.Surface.Validation | Integrate validation pipeline into Scanner analyzers so checks run before processing. | SURFACE-VAL-02 | SCSS0102 | +| SURFACE-VAL-04 | TODO | | SPRINT_0136_0000_0001_scanner_surface | Scanner Guild, Zastava Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.Validation) | src/Scanner/__Libraries/StellaOps.Scanner.Surface.Validation | Expose validation helpers to Zastava and other runtime consumers for preflight checks. | SURFACE-VAL-02 | SCSS0102 | +| SURFACE-VAL-05 | TODO | | SPRINT_0136_0000_0001_scanner_surface | Docs Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.Validation) | src/Scanner/__Libraries/StellaOps.Scanner.Surface.Validation | Document validation extensibility, registration, and customization in scanner-engine guides. | SURFACE-VAL-02 | SCSS0102 | +| SVC-32-002 | TODO | | SPRINT_0152_0000_0002_orchestrator_ii | Orchestrator Service Guild (src/Orchestrator/StellaOps.Orchestrator) | src/Orchestrator/StellaOps.Orchestrator | | | | +| SVC-32-003 | TODO | | SPRINT_0152_0000_0002_orchestrator_ii | Orchestrator Service Guild (src/Orchestrator/StellaOps.Orchestrator) | src/Orchestrator/StellaOps.Orchestrator | | | | +| SVC-32-004 | TODO | | SPRINT_0152_0000_0002_orchestrator_ii | Orchestrator Service Guild (src/Orchestrator/StellaOps.Orchestrator) | src/Orchestrator/StellaOps.Orchestrator | | | | +| SVC-32-005 | TODO | | SPRINT_0152_0000_0002_orchestrator_ii | Orchestrator Service Guild (src/Orchestrator/StellaOps.Orchestrator) | src/Orchestrator/StellaOps.Orchestrator | | | | +| SVC-33-001 | TODO | | SPRINT_0152_0000_0002_orchestrator_ii | Orchestrator Service Guild (src/Orchestrator/StellaOps.Orchestrator) | src/Orchestrator/StellaOps.Orchestrator | | | | +| SVC-33-002 | TODO | | SPRINT_0152_0000_0002_orchestrator_ii | Orchestrator Service Guild (src/Orchestrator/StellaOps.Orchestrator) | src/Orchestrator/StellaOps.Orchestrator | | | | +| SVC-33-003 | TODO | | SPRINT_0152_0000_0002_orchestrator_ii | Orchestrator Service Guild (src/Orchestrator/StellaOps.Orchestrator) | src/Orchestrator/StellaOps.Orchestrator | | | | +| SVC-33-004 | TODO | | SPRINT_0152_0000_0002_orchestrator_ii | Orchestrator Service Guild (src/Orchestrator/StellaOps.Orchestrator) | src/Orchestrator/StellaOps.Orchestrator | | | | +| SVC-34-001 | TODO | | SPRINT_0152_0000_0002_orchestrator_ii | Orchestrator Service Guild (src/Orchestrator/StellaOps.Orchestrator) | src/Orchestrator/StellaOps.Orchestrator | | | | +| SVC-34-002 | TODO | | SPRINT_0152_0000_0002_orchestrator_ii | Orchestrator Service Guild (src/Orchestrator/StellaOps.Orchestrator) | src/Orchestrator/StellaOps.Orchestrator | | | | +| SVC-34-003 | TODO | | SPRINT_0152_0000_0002_orchestrator_ii | Orchestrator Service Guild (src/Orchestrator/StellaOps.Orchestrator) | src/Orchestrator/StellaOps.Orchestrator | | | | +| SVC-34-004 | TODO | | SPRINT_0152_0000_0002_orchestrator_ii | Orchestrator Service Guild (src/Orchestrator/StellaOps.Orchestrator) | src/Orchestrator/StellaOps.Orchestrator | | | | | SVC-35-001 | BLOCKED | 2025-10-29 | SPRINT_163_exportcenter_ii | Exporter Service Guild (src/ExportCenter/StellaOps.ExportCenter) | src/ExportCenter/StellaOps.ExportCenter | | | | | SVC-35-002 | TODO | | SPRINT_163_exportcenter_ii | Exporter Service Guild (src/ExportCenter/StellaOps.ExportCenter) | src/ExportCenter/StellaOps.ExportCenter | | | | | SVC-35-003 | TODO | | SPRINT_163_exportcenter_ii | Exporter Service Guild (src/ExportCenter/StellaOps.ExportCenter) | src/ExportCenter/StellaOps.ExportCenter | | | | | SVC-35-004 | TODO | | SPRINT_163_exportcenter_ii | Exporter Service Guild (src/ExportCenter/StellaOps.ExportCenter) | src/ExportCenter/StellaOps.ExportCenter | | | | | SVC-35-005 | TODO | | SPRINT_163_exportcenter_ii | Exporter Service Guild (src/ExportCenter/StellaOps.ExportCenter) | src/ExportCenter/StellaOps.ExportCenter | | | | -| SVC-35-006 | TODO | | SPRINT_164_exportcenter_iii | Exporter Service Guild (src/ExportCenter/StellaOps.ExportCenter) | src/ExportCenter/StellaOps.ExportCenter | | | | -| SVC-35-101 | TODO | | SPRINT_152_orchestrator_ii | Orchestrator Service Guild (src/Orchestrator/StellaOps.Orchestrator) | src/Orchestrator/StellaOps.Orchestrator | | | | -| SVC-36-001 | TODO | | SPRINT_164_exportcenter_iii | Exporter Service Guild (src/ExportCenter/StellaOps.ExportCenter) | src/ExportCenter/StellaOps.ExportCenter | | | | -| SVC-36-002 | TODO | | SPRINT_164_exportcenter_iii | Exporter Service Guild (src/ExportCenter/StellaOps.ExportCenter) | src/ExportCenter/StellaOps.ExportCenter | | | | -| SVC-36-003 | TODO | | SPRINT_164_exportcenter_iii | Exporter Service Guild (src/ExportCenter/StellaOps.ExportCenter) | src/ExportCenter/StellaOps.ExportCenter | | | | -| SVC-36-004 | TODO | | SPRINT_164_exportcenter_iii | Exporter Service Guild (src/ExportCenter/StellaOps.ExportCenter) | src/ExportCenter/StellaOps.ExportCenter | | | | -| SVC-36-101 | TODO | | SPRINT_152_orchestrator_ii | Orchestrator Service Guild (src/Orchestrator/StellaOps.Orchestrator) | src/Orchestrator/StellaOps.Orchestrator | | | | -| SVC-37-001 | TODO | | SPRINT_164_exportcenter_iii | Exporter Service Guild (src/ExportCenter/StellaOps.ExportCenter) | src/ExportCenter/StellaOps.ExportCenter | | | | -| SVC-37-002 | TODO | | SPRINT_164_exportcenter_iii | Exporter Service Guild (src/ExportCenter/StellaOps.ExportCenter) | src/ExportCenter/StellaOps.ExportCenter | | | | -| SVC-37-003 | TODO | | SPRINT_164_exportcenter_iii | Exporter Service Guild (src/ExportCenter/StellaOps.ExportCenter) | src/ExportCenter/StellaOps.ExportCenter | | | | -| SVC-37-004 | TODO | | SPRINT_164_exportcenter_iii | Exporter Service Guild (src/ExportCenter/StellaOps.ExportCenter) | src/ExportCenter/StellaOps.ExportCenter | | | | -| SVC-37-101 | TODO | | SPRINT_152_orchestrator_ii | Orchestrator Service Guild (src/Orchestrator/StellaOps.Orchestrator) | src/Orchestrator/StellaOps.Orchestrator | | | | -| SVC-38-002 | TODO | | SPRINT_172_notifier_ii | Notifications Service Guild (src/Notifier/StellaOps.Notifier) | src/Notifier/StellaOps.Notifier | | | | -| SVC-38-003 | TODO | | SPRINT_172_notifier_ii | Notifications Service Guild (src/Notifier/StellaOps.Notifier) | src/Notifier/StellaOps.Notifier | | | | -| SVC-38-004 | TODO | | SPRINT_172_notifier_ii | Notifications Service Guild (src/Notifier/StellaOps.Notifier) | src/Notifier/StellaOps.Notifier | | | | +| SVC-35-006 | TODO | | SPRINT_0164_0000_0003_exportcenter_iii | Exporter Service Guild (src/ExportCenter/StellaOps.ExportCenter) | src/ExportCenter/StellaOps.ExportCenter | | | | +| SVC-35-101 | TODO | | SPRINT_0152_0000_0002_orchestrator_ii | Orchestrator Service Guild (src/Orchestrator/StellaOps.Orchestrator) | src/Orchestrator/StellaOps.Orchestrator | | | | +| SVC-36-001 | TODO | | SPRINT_0164_0000_0003_exportcenter_iii | Exporter Service Guild (src/ExportCenter/StellaOps.ExportCenter) | src/ExportCenter/StellaOps.ExportCenter | | | | +| SVC-36-002 | TODO | | SPRINT_0164_0000_0003_exportcenter_iii | Exporter Service Guild (src/ExportCenter/StellaOps.ExportCenter) | src/ExportCenter/StellaOps.ExportCenter | | | | +| SVC-36-003 | TODO | | SPRINT_0164_0000_0003_exportcenter_iii | Exporter Service Guild (src/ExportCenter/StellaOps.ExportCenter) | src/ExportCenter/StellaOps.ExportCenter | | | | +| SVC-36-004 | TODO | | SPRINT_0164_0000_0003_exportcenter_iii | Exporter Service Guild (src/ExportCenter/StellaOps.ExportCenter) | src/ExportCenter/StellaOps.ExportCenter | | | | +| SVC-36-101 | TODO | | SPRINT_0152_0000_0002_orchestrator_ii | Orchestrator Service Guild (src/Orchestrator/StellaOps.Orchestrator) | src/Orchestrator/StellaOps.Orchestrator | | | | +| SVC-37-001 | TODO | | SPRINT_0164_0000_0003_exportcenter_iii | Exporter Service Guild (src/ExportCenter/StellaOps.ExportCenter) | src/ExportCenter/StellaOps.ExportCenter | | | | +| SVC-37-002 | TODO | | SPRINT_0164_0000_0003_exportcenter_iii | Exporter Service Guild (src/ExportCenter/StellaOps.ExportCenter) | src/ExportCenter/StellaOps.ExportCenter | | | | +| SVC-37-003 | TODO | | SPRINT_0164_0000_0003_exportcenter_iii | Exporter Service Guild (src/ExportCenter/StellaOps.ExportCenter) | src/ExportCenter/StellaOps.ExportCenter | | | | +| SVC-37-004 | TODO | | SPRINT_0164_0000_0003_exportcenter_iii | Exporter Service Guild (src/ExportCenter/StellaOps.ExportCenter) | src/ExportCenter/StellaOps.ExportCenter | | | | +| SVC-37-101 | TODO | | SPRINT_0152_0000_0002_orchestrator_ii | Orchestrator Service Guild (src/Orchestrator/StellaOps.Orchestrator) | src/Orchestrator/StellaOps.Orchestrator | | | | +| SVC-38-002 | TODO | | SPRINT_0172_0000_0002_notifier_ii | Notifications Service Guild (src/Notifier/StellaOps.Notifier) | src/Notifier/StellaOps.Notifier | | | | +| SVC-38-003 | TODO | | SPRINT_0172_0000_0002_notifier_ii | Notifications Service Guild (src/Notifier/StellaOps.Notifier) | src/Notifier/StellaOps.Notifier | | | | +| SVC-38-004 | TODO | | SPRINT_0172_0000_0002_notifier_ii | Notifications Service Guild (src/Notifier/StellaOps.Notifier) | src/Notifier/StellaOps.Notifier | | | | | SVC-38-101 | TODO | | SPRINT_0153_0001_0003_orchestrator_iii | Orchestrator Service Guild (src/Orchestrator/StellaOps.Orchestrator) | src/Orchestrator/StellaOps.Orchestrator | | | | -| SVC-39-001 | TODO | | SPRINT_172_notifier_ii | Notifications Service Guild (src/Notifier/StellaOps.Notifier) | src/Notifier/StellaOps.Notifier | | | | -| SVC-39-002 | TODO | | SPRINT_172_notifier_ii | Notifications Service Guild (src/Notifier/StellaOps.Notifier) | src/Notifier/StellaOps.Notifier | | | | -| SVC-39-003 | TODO | | SPRINT_172_notifier_ii | Notifications Service Guild (src/Notifier/StellaOps.Notifier) | src/Notifier/StellaOps.Notifier | | | | -| SVC-39-004 | TODO | | SPRINT_172_notifier_ii | Notifications Service Guild (src/Notifier/StellaOps.Notifier) | src/Notifier/StellaOps.Notifier | | | | -| SVC-40-001 | TODO | | SPRINT_172_notifier_ii | Notifications Service Guild (src/Notifier/StellaOps.Notifier) | src/Notifier/StellaOps.Notifier | | | | -| SVC-40-002 | TODO | | SPRINT_172_notifier_ii | Notifications Service Guild (src/Notifier/StellaOps.Notifier) | src/Notifier/StellaOps.Notifier | | | | -| SVC-40-003 | TODO | | SPRINT_172_notifier_ii | Notifications Service Guild (src/Notifier/StellaOps.Notifier) | src/Notifier/StellaOps.Notifier | | | | -| SVC-40-004 | TODO | | SPRINT_172_notifier_ii | Notifications Service Guild (src/Notifier/StellaOps.Notifier) | src/Notifier/StellaOps.Notifier | | | | +| SVC-39-001 | TODO | | SPRINT_0172_0000_0002_notifier_ii | Notifications Service Guild (src/Notifier/StellaOps.Notifier) | src/Notifier/StellaOps.Notifier | | | | +| SVC-39-002 | TODO | | SPRINT_0172_0000_0002_notifier_ii | Notifications Service Guild (src/Notifier/StellaOps.Notifier) | src/Notifier/StellaOps.Notifier | | | | +| SVC-39-003 | TODO | | SPRINT_0172_0000_0002_notifier_ii | Notifications Service Guild (src/Notifier/StellaOps.Notifier) | src/Notifier/StellaOps.Notifier | | | | +| SVC-39-004 | TODO | | SPRINT_0172_0000_0002_notifier_ii | Notifications Service Guild (src/Notifier/StellaOps.Notifier) | src/Notifier/StellaOps.Notifier | | | | +| SVC-40-001 | TODO | | SPRINT_0172_0000_0002_notifier_ii | Notifications Service Guild (src/Notifier/StellaOps.Notifier) | src/Notifier/StellaOps.Notifier | | | | +| SVC-40-002 | TODO | | SPRINT_0172_0000_0002_notifier_ii | Notifications Service Guild (src/Notifier/StellaOps.Notifier) | src/Notifier/StellaOps.Notifier | | | | +| SVC-40-003 | TODO | | SPRINT_0172_0000_0002_notifier_ii | Notifications Service Guild (src/Notifier/StellaOps.Notifier) | src/Notifier/StellaOps.Notifier | | | | +| SVC-40-004 | TODO | | SPRINT_0172_0000_0002_notifier_ii | Notifications Service Guild (src/Notifier/StellaOps.Notifier) | src/Notifier/StellaOps.Notifier | | | | | SVC-41-101 | TODO | | SPRINT_0153_0001_0003_orchestrator_iii | Orchestrator Service Guild (src/Orchestrator/StellaOps.Orchestrator) | src/Orchestrator/StellaOps.Orchestrator | | | | | SVC-42-101 | TODO | | SPRINT_0153_0001_0003_orchestrator_iii | Orchestrator Service Guild (src/Orchestrator/StellaOps.Orchestrator) | src/Orchestrator/StellaOps.Orchestrator | | | | -| SVC-43-001 | TODO | | SPRINT_164_exportcenter_iii | Exporter Service Guild (src/ExportCenter/StellaOps.ExportCenter) | src/ExportCenter/StellaOps.ExportCenter | | | | +| SVC-43-001 | TODO | | SPRINT_0164_0000_0003_exportcenter_iii | Exporter Service Guild (src/ExportCenter/StellaOps.ExportCenter) | src/ExportCenter/StellaOps.ExportCenter | | | | | SYM-007 | TODO | | SPRINT_0401_0001_0001_reachability_evidence_chain | Scanner Worker Guild & Docs Guild (`src/Scanner/StellaOps.Scanner.Models`, `docs/modules/scanner/architecture.md`, `docs/reachability/function-level-evidence.md`) | `src/Scanner/StellaOps.Scanner.Models`, `docs/modules/scanner/architecture.md`, `docs/reachability/function-level-evidence.md` | | | | | SYMS-70-003 | TODO | | SPRINT_0304_0001_0004_docs_tasks_md_iv | Docs Guild, Symbols Guild (docs) | | | | | | SYMS-90-005 | TODO | | SPRINT_0505_0001_0001_ops_devops_iii | DevOps Guild, Symbols Guild (ops/devops) | ops/devops | | | | @@ -4150,17 +4150,17 @@ | TELEMETRY-DOCS-0001 | TODO | | SPRINT_330_docs_modules_telemetry | Docs Guild | docs/modules/telemetry | Validate that telemetry module docs reflect the new storage stack and isolation rules. | Ops checklist from DVDO0103 | DOTL0101 | | TELEMETRY-DOCS-0001 | TODO | | SPRINT_330_docs_modules_telemetry | Docs Guild | docs/modules/telemetry | Validate that telemetry module docs reflect the new storage stack and isolation rules. | Ops checklist from DVDO0103 | DOTL0101 | | TELEMETRY-ENG-0001 | TODO | | SPRINT_330_docs_modules_telemetry | Module Team | docs/modules/telemetry | Ensure milestones stay in sync with telemetry sprints in `docs/implplan`. | TLTY0101 API review | DOTL0101 | -| TELEMETRY-OBS-50-001 | DOING | | SPRINT_170_notifications_telemetry | Telemetry Core Guild | src/Telemetry/StellaOps.Telemetry.Core | Core bootstrap coding active (50-001); propagation adapters (50-002) queued pending package publication. | 50-002 dashboards | TLTY0101 | -| TELEMETRY-OBS-50-002 | DOING | | SPRINT_170_notifications_telemetry | Telemetry Core Guild | src/Telemetry/StellaOps.Telemetry.Core | OBS-50-001 rollout | OBS-50-001 rollout | TLTY0101 | -| TELEMETRY-OBS-51-001 | TODO | | SPRINT_170_notifications_telemetry | Telemetry Core Guild | src/Telemetry/StellaOps.Telemetry.Core | Roslyn analyzer + scrub policy review pending Security Guild approval. | 51-002 scope review | TLTY0101 | -| TELEMETRY-OBS-51-002 | TODO | | SPRINT_170_notifications_telemetry | Telemetry Core Guild | src/Telemetry/StellaOps.Telemetry.Core | OBS-51-001 shadow mode | OBS-51-001 shadow mode | TLTY0101 | -| TELEMETRY-OBS-55-001 | TODO | | SPRINT_170_notifications_telemetry | Telemetry Core Guild · Observability Guild | src/Telemetry/StellaOps.Telemetry.Core | Requires CLI toggle contract (CLI-OBS-12-001) and Notify incident payload spec (NOTIFY-OBS-55-001). | 56-001 event schema | TLTY0101 | -| TELEMETRY-OBS-56-001 | TODO | | SPRINT_174_telemetry | Telemetry Core Guild | src/Telemetry/StellaOps.Telemetry.Core | Add sealed-mode telemetry helpers (drift metrics, seal/unseal spans, offline exporters) and ensure hosts can disable external exporters when sealed. Dependencies: TELEMETRY-OBS-55-001. | OBS-55-001 output | TLTY0101 | +| TELEMETRY-OBS-50-001 | DOING | | SPRINT_0170_0000_0001_notifications_telemetry | Telemetry Core Guild | src/Telemetry/StellaOps.Telemetry.Core | Core bootstrap coding active (50-001); propagation adapters (50-002) queued pending package publication. | 50-002 dashboards | TLTY0101 | +| TELEMETRY-OBS-50-002 | DOING | | SPRINT_0170_0000_0001_notifications_telemetry | Telemetry Core Guild | src/Telemetry/StellaOps.Telemetry.Core | OBS-50-001 rollout | OBS-50-001 rollout | TLTY0101 | +| TELEMETRY-OBS-51-001 | TODO | | SPRINT_0170_0000_0001_notifications_telemetry | Telemetry Core Guild | src/Telemetry/StellaOps.Telemetry.Core | Roslyn analyzer + scrub policy review pending Security Guild approval. | 51-002 scope review | TLTY0101 | +| TELEMETRY-OBS-51-002 | TODO | | SPRINT_0170_0000_0001_notifications_telemetry | Telemetry Core Guild | src/Telemetry/StellaOps.Telemetry.Core | OBS-51-001 shadow mode | OBS-51-001 shadow mode | TLTY0101 | +| TELEMETRY-OBS-55-001 | TODO | | SPRINT_0170_0000_0001_notifications_telemetry | Telemetry Core Guild · Observability Guild | src/Telemetry/StellaOps.Telemetry.Core | Requires CLI toggle contract (CLI-OBS-12-001) and Notify incident payload spec (NOTIFY-OBS-55-001). | 56-001 event schema | TLTY0101 | +| TELEMETRY-OBS-56-001 | TODO | | SPRINT_0174_0000_0001_telemetry | Telemetry Core Guild | src/Telemetry/StellaOps.Telemetry.Core | Add sealed-mode telemetry helpers (drift metrics, seal/unseal spans, offline exporters) and ensure hosts can disable external exporters when sealed. Dependencies: TELEMETRY-OBS-55-001. | OBS-55-001 output | TLTY0101 | | TELEMETRY-OPS-0001 | TODO | | SPRINT_330_docs_modules_telemetry | Ops Guild | docs/modules/telemetry | Review telemetry runbooks/observability dashboards post-demo. | DVDO0103 deployment notes | DOTL0101 | -| TEN-47-001 | TODO | | SPRINT_205_cli_v | DevEx/CLI Guild (src/Cli/StellaOps.Cli) | src/Cli/StellaOps.Cli | | | | +| TEN-47-001 | TODO | | SPRINT_0205_0000_0005_cli_v | DevEx/CLI Guild (src/Cli/StellaOps.Cli) | src/Cli/StellaOps.Cli | | | | | TEN-48-001 | TODO | | SPRINT_115_concelier_iv | Concelier Core Guild (src/Concelier/__Libraries/StellaOps.Concelier.Core) | src/Concelier/__Libraries/StellaOps.Concelier.Core | | | | -| TEN-49-001 | TODO | | SPRINT_205_cli_v | DevEx/CLI Guild (src/Cli/StellaOps.Cli) | src/Cli/StellaOps.Cli | | | | -| TEST-186-006 | TODO | | SPRINT_186_record_deterministic_execution | Signing Guild, QA Guild (`src/Signer/StellaOps.Signer.Tests`) | `src/Signer/StellaOps.Signer.Tests` | | | | +| TEN-49-001 | TODO | | SPRINT_0205_0000_0005_cli_v | DevEx/CLI Guild (src/Cli/StellaOps.Cli) | src/Cli/StellaOps.Cli | | | | +| TEST-186-006 | TODO | | SPRINT_0186_0000_0001_record_deterministic_execution | Signing Guild, QA Guild (`src/Signer/StellaOps.Signer.Tests`) | `src/Signer/StellaOps.Signer.Tests` | | | | | TEST-62-001 | DOING | | SPRINT_0310_0001_0010_docs_tasks_md_x | Docs Guild, Contract Testing Guild (docs) | | | | | | TIME-57-001 | TODO | | SPRINT_0503_0001_0001_ops_devops_i | Exporter Guild · AirGap Time Guild · CLI Guild | | | PROGRAM-STAFF-1001 | | | TIME-57-002 | TODO | | SPRINT_510_airgap | Exporter Guild · AirGap Time Guild · CLI Guild | src/AirGap/StellaOps.AirGap.Time | PROGRAM-STAFF-1001 | PROGRAM-STAFF-1001 | AGTM0101 | @@ -4200,17 +4200,17 @@ | UNCERTAINTY-SCHEMA-401-024 | TODO | | SPRINT_0401_0001_0001_reachability_evidence_chain | Signals Guild (`src/Signals/StellaOps.Signals`, `docs/uncertainty/README.md`) | `src/Signals/StellaOps.Signals`, `docs/uncertainty/README.md` | Extend Signals findings with `uncertainty.states[]`, entropy fields, and `riskScore`; emit `FindingUncertaintyUpdated` events and persist evidence per docs. | | | | UNCERTAINTY-SCORER-401-025 | TODO | | SPRINT_0401_0001_0001_reachability_evidence_chain | Signals Guild (`src/Signals/StellaOps.Signals.Application`, `docs/uncertainty/README.md`) | `src/Signals/StellaOps.Signals.Application`, `docs/uncertainty/README.md` | Implement the entropy-aware risk scorer (`riskScore = base × reach × trust × (1 + entropyBoost)`) and wire it into finding writes. | | | | UNCERTAINTY-UI-401-027 | TODO | | SPRINT_0401_0001_0001_reachability_evidence_chain | UI Guild · CLI Guild (`src/UI/StellaOps.UI`, `src/Cli/StellaOps.Cli`, `docs/uncertainty/README.md`) | `src/UI/StellaOps.UI`, `src/Cli/StellaOps.Cli`, `docs/uncertainty/README.md` | Surface uncertainty chips/tooltips in the Console (React UI) + CLI output (risk score + entropy states). | | | -| VAL-01 | DOING | 2025-11-01 | SPRINT_136_scanner_surface | Scanner Guild, Security Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.Validation) | src/Scanner/__Libraries/StellaOps.Scanner.Surface.Validation | | SURFACE-FS-01; SURFACE-ENV-01 | | -| VAL-02 | TODO | | SPRINT_136_scanner_surface | Scanner Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.Validation) | src/Scanner/__Libraries/StellaOps.Scanner.Surface.Validation | | SURFACE-VAL-01; SURFACE-ENV-02; SURFACE-FS-02 | | -| VAL-03 | TODO | | SPRINT_136_scanner_surface | Scanner Guild, Analyzer Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.Validation) | src/Scanner/__Libraries/StellaOps.Scanner.Surface.Validation | | SURFACE-VAL-02 | | -| VAL-04 | TODO | | SPRINT_136_scanner_surface | Scanner Guild, Zastava Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.Validation) | src/Scanner/__Libraries/StellaOps.Scanner.Surface.Validation | | SURFACE-VAL-02 | | -| VAL-05 | TODO | | SPRINT_136_scanner_surface | Docs Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.Validation) | src/Scanner/__Libraries/StellaOps.Scanner.Surface.Validation | | SURFACE-VAL-02 | | -| VERIFY-186-007 | TODO | | SPRINT_186_record_deterministic_execution | Authority Guild, Provenance Guild (`src/Authority/StellaOps.Authority`, `src/Provenance/StellaOps.Provenance.Attestation`) | `src/Authority/StellaOps.Authority`, `src/Provenance/StellaOps.Provenance.Attestation` | | | | +| VAL-01 | DOING | 2025-11-01 | SPRINT_0136_0000_0001_scanner_surface | Scanner Guild, Security Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.Validation) | src/Scanner/__Libraries/StellaOps.Scanner.Surface.Validation | | SURFACE-FS-01; SURFACE-ENV-01 | | +| VAL-02 | TODO | | SPRINT_0136_0000_0001_scanner_surface | Scanner Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.Validation) | src/Scanner/__Libraries/StellaOps.Scanner.Surface.Validation | | SURFACE-VAL-01; SURFACE-ENV-02; SURFACE-FS-02 | | +| VAL-03 | TODO | | SPRINT_0136_0000_0001_scanner_surface | Scanner Guild, Analyzer Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.Validation) | src/Scanner/__Libraries/StellaOps.Scanner.Surface.Validation | | SURFACE-VAL-02 | | +| VAL-04 | TODO | | SPRINT_0136_0000_0001_scanner_surface | Scanner Guild, Zastava Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.Validation) | src/Scanner/__Libraries/StellaOps.Scanner.Surface.Validation | | SURFACE-VAL-02 | | +| VAL-05 | TODO | | SPRINT_0136_0000_0001_scanner_surface | Docs Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.Validation) | src/Scanner/__Libraries/StellaOps.Scanner.Surface.Validation | | SURFACE-VAL-02 | | +| VERIFY-186-007 | TODO | | SPRINT_0186_0000_0001_record_deterministic_execution | Authority Guild, Provenance Guild (`src/Authority/StellaOps.Authority`, `src/Provenance/StellaOps.Provenance.Attestation`) | `src/Authority/StellaOps.Authority`, `src/Provenance/StellaOps.Provenance.Attestation` | | | | | VEX-006 | TODO | | SPRINT_0401_0001_0001_reachability_evidence_chain | Policy, Excititor, UI, CLI & Notify Guilds (`docs/modules/excititor/architecture.md`, `src/Cli/StellaOps.Cli`, `src/UI/StellaOps.UI`, `docs/09_API_CLI_REFERENCE.md`) | `docs/modules/excititor/architecture.md`, `src/Cli/StellaOps.Cli`, `src/UI/StellaOps.UI`, `docs/09_API_CLI_REFERENCE.md` | | | | | VEX-30-001 | BLOCKED | 2025-11-19 | SPRINT_0212_0001_0001_web_i | Console Guild, BE-Base Platform Guild (src/Web/StellaOps.Web) | src/Web/StellaOps.Web | | | | -| VEX-30-002 | TODO | | SPRINT_205_cli_v | DevEx/CLI Guild (src/Cli/StellaOps.Cli) | src/Cli/StellaOps.Cli | | | | -| VEX-30-003 | TODO | | SPRINT_205_cli_v | DevEx/CLI Guild (src/Cli/StellaOps.Cli) | src/Cli/StellaOps.Cli | | | | -| VEX-30-004 | TODO | | SPRINT_205_cli_v | DevEx/CLI Guild (src/Cli/StellaOps.Cli) | src/Cli/StellaOps.Cli | | | | +| VEX-30-002 | TODO | | SPRINT_0205_0000_0005_cli_v | DevEx/CLI Guild (src/Cli/StellaOps.Cli) | src/Cli/StellaOps.Cli | | | | +| VEX-30-003 | TODO | | SPRINT_0205_0000_0005_cli_v | DevEx/CLI Guild (src/Cli/StellaOps.Cli) | src/Cli/StellaOps.Cli | | | | +| VEX-30-004 | TODO | | SPRINT_0205_0000_0005_cli_v | DevEx/CLI Guild (src/Cli/StellaOps.Cli) | src/Cli/StellaOps.Cli | | | | | VEX-30-005 | DOING | | SPRINT_0310_0001_0010_docs_tasks_md_x | Docs Guild, Console Guild (docs) | | | | | | VEX-30-006 | DOING | | SPRINT_0310_0001_0010_docs_tasks_md_x | Docs Guild, Policy Guild (docs) | | | | DOVX0101 | | VEX-30-007 | BLOCKED | | SPRINT_216_web_v | BE-Base Platform Guild, VEX Lens Guild (src/Web/StellaOps.Web) | src/Web/StellaOps.Web | | | DOVX0101 | @@ -4244,11 +4244,11 @@ | VEXLENS-ORCH-33-001 | TODO | | SPRINT_0129_0001_0001_policy_reasoning | VEX Lens Guild | src/VexLens/StellaOps.VexLens | Register `consensus_compute` job type with orchestrator, integrate worker SDK, and expose job planning hooks for consensus batches | — | PLVL0103 | | VEXLENS-ORCH-34-001 | TODO | | SPRINT_0129_0001_0001_policy_reasoning | VEX Lens Guild | src/VexLens/StellaOps.VexLens | Emit consensus completion events into orchestrator run ledger and provenance chain, including confidence metadata | VEXLENS-ORCH-33-001 | PLVL0103 | | VULN-29-001 | BLOCKED | 2025-11-19 | SPRINT_0212_0001_0001_web_i | Console Guild, BE-Base Platform Guild (src/Web/StellaOps.Web) | src/Web/StellaOps.Web | | | | -| VULN-29-002 | TODO | | SPRINT_123_excititor_v | Excititor WebService Guild (src/Excititor/StellaOps.Excititor.WebService) | src/Excititor/StellaOps.Excititor.WebService | | | | -| VULN-29-003 | TODO | | SPRINT_205_cli_v | DevEx/CLI Guild (src/Cli/StellaOps.Cli) | src/Cli/StellaOps.Cli | | | | +| VULN-29-002 | TODO | | SPRINT_0123_0000_0005_excititor_v | Excititor WebService Guild (src/Excititor/StellaOps.Excititor.WebService) | src/Excititor/StellaOps.Excititor.WebService | | | | +| VULN-29-003 | TODO | | SPRINT_0205_0000_0005_cli_v | DevEx/CLI Guild (src/Cli/StellaOps.Cli) | src/Cli/StellaOps.Cli | | | | | VULN-29-004 | TODO | | SPRINT_116_concelier_v | Concelier WebService Guild, Observability Guild (src/Concelier/StellaOps.Concelier.WebService) | src/Concelier/StellaOps.Concelier.WebService | | | | -| VULN-29-005 | TODO | | SPRINT_205_cli_v | DevEx/CLI Guild (src/Cli/StellaOps.Cli) | src/Cli/StellaOps.Cli | | | | -| VULN-29-006 | TODO | | SPRINT_205_cli_v | DevEx/CLI Guild, Docs Guild (src/Cli/StellaOps.Cli) | src/Cli/StellaOps.Cli | | | | +| VULN-29-005 | TODO | | SPRINT_0205_0000_0005_cli_v | DevEx/CLI Guild (src/Cli/StellaOps.Cli) | src/Cli/StellaOps.Cli | | | | +| VULN-29-006 | TODO | | SPRINT_0205_0000_0005_cli_v | DevEx/CLI Guild, Docs Guild (src/Cli/StellaOps.Cli) | src/Cli/StellaOps.Cli | | | | | VULN-29-007 | TODO | | SPRINT_0311_0001_0001_docs_tasks_md_xi | Docs Guild, Excititor Guild (docs) | | | | | | VULN-29-008 | TODO | | SPRINT_0311_0001_0001_docs_tasks_md_xi | Docs Guild, Concelier Guild (docs) | | | | | | VULN-29-009 | TODO | | SPRINT_0311_0001_0001_docs_tasks_md_xi | Docs Guild, SBOM Service Guild (docs) | | | | | @@ -4312,7 +4312,7 @@ | WEB-NOTIFY-38-001 | TODO | | SPRINT_0214_0001_0001_web_iii | BE-Base Platform Guild | src/Web/StellaOps.Web | Route notifier APIs (`/notifications/*`) and WS feed through gateway with tenant scoping, viewer/operator scope enforcement, and SSE/WebSocket bridging. | Depends on #1 for signed ack spec | NOWB0101 | | WEB-NOTIFY-39-001 | TODO | | SPRINT_0214_0001_0001_web_iii | BE-Base Platform Guild | src/Web/StellaOps.Web | Surface digest scheduling, quiet-hour/throttle management, and simulation APIs; ensure rate limits and audit logging. Dependencies: WEB-NOTIFY-38-001. | WEB-NOTIFY-38-001 | NOWB0101 | | WEB-NOTIFY-40-001 | TODO | | SPRINT_0214_0001_0001_web_iii | BE-Base Platform Guild (src/Web/StellaOps.Web) | src/Web/StellaOps.Web | Expose escalation, localization, channel health, and ack verification endpoints with admin scope enforcement and signed token validation. Dependencies: WEB-NOTIFY-39-001. | | | -| WEB-OAS-61-001 | TODO | | SPRINT_124_excititor_vi | Excititor WebService Guild (src/Excititor/StellaOps.Excititor.WebService) | src/Excititor/StellaOps.Excititor.WebService | | | | +| WEB-OAS-61-001 | TODO | | SPRINT_0124_0000_0006_excititor_vi | Excititor WebService Guild (src/Excititor/StellaOps.Excititor.WebService) | src/Excititor/StellaOps.Excititor.WebService | | | | | WEB-OAS-61-002 | TODO | | SPRINT_116_concelier_v | Concelier WebService Guild (src/Concelier/StellaOps.Concelier.WebService) | src/Concelier/StellaOps.Concelier.WebService | | | | | WEB-OAS-62-001 | TODO | | SPRINT_116_concelier_v | Concelier WebService Guild (src/Concelier/StellaOps.Concelier.WebService) | src/Concelier/StellaOps.Concelier.WebService | | | | | WEB-OAS-63-001 | TODO | | SPRINT_116_concelier_v | Concelier WebService Guild, API Governance Guild (src/Concelier/StellaOps.Concelier.WebService) | src/Concelier/StellaOps.Concelier.WebService | | | | @@ -4324,21 +4324,21 @@ | WEB-OBS-55-001 | TODO | | SPRINT_117_concelier_vi | Concelier WebService Guild · DevOps Guild | src/Concelier/StellaOps.Concelier.WebService | Wait for DevOps alert profiles (045_DVDO0103) | Wait for DevOps alert profiles (045_DVDO0103) | CNOB0102 | | WEB-OBS-56-001 | TODO | | SPRINT_0214_0001_0001_web_iii | BE-Base Platform Guild, AirGap Guild (src/Web/StellaOps.Web) | src/Web/StellaOps.Web | Extend telemetry core integration to expose sealed/unsealed status APIs, drift metrics, and Console widgets without leaking sealed-mode secrets. Dependencies: WEB-OBS-55-001. | | | | WEB-ORCH-32-001 | TODO | | SPRINT_0214_0001_0001_web_iii | BE-Base Platform Guild (src/Web/StellaOps.Web) | src/Web/StellaOps.Web | Expose `/orchestrator/sources | | | -| WEB-ORCH-33-001 | TODO | | SPRINT_215_web_iv | BE-Base Platform Guild (src/Web/StellaOps.Web) | src/Web/StellaOps.Web | Add POST action routes (`pause. Dependencies: WEB-ORCH-32-001. | | | -| WEB-ORCH-34-001 | TODO | | SPRINT_215_web_iv | BE-Base Platform Guild (src/Web/StellaOps.Web) | src/Web/StellaOps.Web | Surface quotas/backfill APIs, queue/backpressure metrics, and error clustering routes with admin scope enforcement and audit logging. Dependencies: WEB-ORCH-33-001. | | | -| WEB-POLICY-20-001 | TODO | | SPRINT_215_web_iv | BE-Base Platform Guild, Policy Guild (src/Web/StellaOps.Web) | src/Web/StellaOps.Web | Implement Policy CRUD/compile/run/simulate/findings/explain endpoints with OpenAPI, tenant scoping, and service identity enforcement. | | | -| WEB-POLICY-20-002 | TODO | | SPRINT_215_web_iv | BE-Base Platform Guild (src/Web/StellaOps.Web) | src/Web/StellaOps.Web | Add pagination, filtering, sorting, and tenant guards to listings for policies, runs, and findings; include deterministic ordering and query diagnostics. Dependencies: WEB-POLICY-20-001. | | | -| WEB-POLICY-20-003 | TODO | | SPRINT_215_web_iv | BE-Base Platform Guild, QA Guild (src/Web/StellaOps.Web) | src/Web/StellaOps.Web | Map engine errors to `ERR_POL_*` responses with consistent payloads and contract tests; expose correlation IDs in headers. Dependencies: WEB-POLICY-20-002. | | | -| WEB-POLICY-20-004 | TODO | | SPRINT_215_web_iv | Platform Reliability Guild (src/Web/StellaOps.Web) | src/Web/StellaOps.Web | Introduce adaptive rate limiting + quotas for simulation endpoints, expose metrics, and document retry headers. Dependencies: WEB-POLICY-20-003. | | | -| WEB-POLICY-23-001 | BLOCKED | 2025-10-29 | SPRINT_215_web_iv | BE-Base Platform Guild, Policy Guild (src/Web/StellaOps.Web) | src/Web/StellaOps.Web | Implement API endpoints for creating/listing/fetching policy packs and revisions (`/policy/packs`, `/policy/packs/{id}/revisions`) with pagination, RBAC, and AOC metadata exposure. (Tracked via Sprint 18.5 gateway tasks.). Dependencies: WEB-POLICY-20-004. | | | -| WEB-POLICY-23-002 | BLOCKED | 2025-10-29 | SPRINT_215_web_iv | BE-Base Platform Guild (src/Web/StellaOps.Web) | src/Web/StellaOps.Web | Add activation endpoint with scope windows, conflict checks, and optional 2-person approval integration; emit events on success. (Tracked via Sprint 18.5 gateway tasks.). Dependencies: WEB-POLICY-23-001. | | | -| WEB-POLICY-23-003 | TODO | | SPRINT_215_web_iv | BE-Base Platform Guild (src/Web/StellaOps.Web) | src/Web/StellaOps.Web | Provide `/policy/simulate` and `/policy/evaluate` endpoints with streaming responses, rate limiting, and error mapping. Dependencies: WEB-POLICY-23-002. | | | -| WEB-POLICY-23-004 | TODO | | SPRINT_215_web_iv | BE-Base Platform Guild (src/Web/StellaOps.Web) | src/Web/StellaOps.Web | Expose explain history endpoints (`/policy/runs`, `/policy/runs/{id}`) including decision tree, sources consulted, and AOC chain. Dependencies: WEB-POLICY-23-003. | | | -| WEB-POLICY-27-001 | TODO | | SPRINT_215_web_iv | BE-Base Platform Guild | src/Web/StellaOps.Web | Surface Policy Registry APIs (`/policy/workspaces`, `/policy/versions`, `/policy/reviews`, `/policy/registry`) with tenant scoping, RBAC, validation. | WEB-POLICY-23-004 | WEPO0101 | -| WEB-POLICY-27-002 | TODO | | SPRINT_215_web_iv | BE-Base Platform Guild | src/Web/StellaOps.Web | Implement review lifecycle endpoints (open/comment/approve/reject) with audit headers + webhooks. | WEB-POLICY-27-001 | WEPO0101 | -| WEB-POLICY-27-003 | TODO | | SPRINT_215_web_iv | Platform Reliability Guild | src/Web/StellaOps.Web | Provide quick/batch simulation endpoints with SSE progress + result pagination. | WEB-POLICY-27-002 | WEPO0101 | -| WEB-POLICY-27-004 | TODO | | SPRINT_215_web_iv | BE/Security Guild | src/Web/StellaOps.Web | Add publish/sign/promote/rollback endpoints w/ idempotent request IDs, canary params, scope enforcement, events. | WEB-POLICY-27-003 | WEPO0101 | -| WEB-POLICY-27-005 | TODO | | SPRINT_215_web_iv | BE/Observability Guild | src/Web/StellaOps.Web | Instrument metrics/logs for compile latency, simulation queue, approval latency, promotion actions. | WEB-POLICY-27-004 | WEPO0101 | +| WEB-ORCH-33-001 | TODO | | SPRINT_0215_0000_0004_web_iv | BE-Base Platform Guild (src/Web/StellaOps.Web) | src/Web/StellaOps.Web | Add POST action routes (`pause. Dependencies: WEB-ORCH-32-001. | | | +| WEB-ORCH-34-001 | TODO | | SPRINT_0215_0000_0004_web_iv | BE-Base Platform Guild (src/Web/StellaOps.Web) | src/Web/StellaOps.Web | Surface quotas/backfill APIs, queue/backpressure metrics, and error clustering routes with admin scope enforcement and audit logging. Dependencies: WEB-ORCH-33-001. | | | +| WEB-POLICY-20-001 | TODO | | SPRINT_0215_0000_0004_web_iv | BE-Base Platform Guild, Policy Guild (src/Web/StellaOps.Web) | src/Web/StellaOps.Web | Implement Policy CRUD/compile/run/simulate/findings/explain endpoints with OpenAPI, tenant scoping, and service identity enforcement. | | | +| WEB-POLICY-20-002 | TODO | | SPRINT_0215_0000_0004_web_iv | BE-Base Platform Guild (src/Web/StellaOps.Web) | src/Web/StellaOps.Web | Add pagination, filtering, sorting, and tenant guards to listings for policies, runs, and findings; include deterministic ordering and query diagnostics. Dependencies: WEB-POLICY-20-001. | | | +| WEB-POLICY-20-003 | TODO | | SPRINT_0215_0000_0004_web_iv | BE-Base Platform Guild, QA Guild (src/Web/StellaOps.Web) | src/Web/StellaOps.Web | Map engine errors to `ERR_POL_*` responses with consistent payloads and contract tests; expose correlation IDs in headers. Dependencies: WEB-POLICY-20-002. | | | +| WEB-POLICY-20-004 | TODO | | SPRINT_0215_0000_0004_web_iv | Platform Reliability Guild (src/Web/StellaOps.Web) | src/Web/StellaOps.Web | Introduce adaptive rate limiting + quotas for simulation endpoints, expose metrics, and document retry headers. Dependencies: WEB-POLICY-20-003. | | | +| WEB-POLICY-23-001 | BLOCKED | 2025-10-29 | SPRINT_0215_0000_0004_web_iv | BE-Base Platform Guild, Policy Guild (src/Web/StellaOps.Web) | src/Web/StellaOps.Web | Implement API endpoints for creating/listing/fetching policy packs and revisions (`/policy/packs`, `/policy/packs/{id}/revisions`) with pagination, RBAC, and AOC metadata exposure. (Tracked via Sprint 18.5 gateway tasks.). Dependencies: WEB-POLICY-20-004. | | | +| WEB-POLICY-23-002 | BLOCKED | 2025-10-29 | SPRINT_0215_0000_0004_web_iv | BE-Base Platform Guild (src/Web/StellaOps.Web) | src/Web/StellaOps.Web | Add activation endpoint with scope windows, conflict checks, and optional 2-person approval integration; emit events on success. (Tracked via Sprint 18.5 gateway tasks.). Dependencies: WEB-POLICY-23-001. | | | +| WEB-POLICY-23-003 | TODO | | SPRINT_0215_0000_0004_web_iv | BE-Base Platform Guild (src/Web/StellaOps.Web) | src/Web/StellaOps.Web | Provide `/policy/simulate` and `/policy/evaluate` endpoints with streaming responses, rate limiting, and error mapping. Dependencies: WEB-POLICY-23-002. | | | +| WEB-POLICY-23-004 | TODO | | SPRINT_0215_0000_0004_web_iv | BE-Base Platform Guild (src/Web/StellaOps.Web) | src/Web/StellaOps.Web | Expose explain history endpoints (`/policy/runs`, `/policy/runs/{id}`) including decision tree, sources consulted, and AOC chain. Dependencies: WEB-POLICY-23-003. | | | +| WEB-POLICY-27-001 | TODO | | SPRINT_0215_0000_0004_web_iv | BE-Base Platform Guild | src/Web/StellaOps.Web | Surface Policy Registry APIs (`/policy/workspaces`, `/policy/versions`, `/policy/reviews`, `/policy/registry`) with tenant scoping, RBAC, validation. | WEB-POLICY-23-004 | WEPO0101 | +| WEB-POLICY-27-002 | TODO | | SPRINT_0215_0000_0004_web_iv | BE-Base Platform Guild | src/Web/StellaOps.Web | Implement review lifecycle endpoints (open/comment/approve/reject) with audit headers + webhooks. | WEB-POLICY-27-001 | WEPO0101 | +| WEB-POLICY-27-003 | TODO | | SPRINT_0215_0000_0004_web_iv | Platform Reliability Guild | src/Web/StellaOps.Web | Provide quick/batch simulation endpoints with SSE progress + result pagination. | WEB-POLICY-27-002 | WEPO0101 | +| WEB-POLICY-27-004 | TODO | | SPRINT_0215_0000_0004_web_iv | BE/Security Guild | src/Web/StellaOps.Web | Add publish/sign/promote/rollback endpoints w/ idempotent request IDs, canary params, scope enforcement, events. | WEB-POLICY-27-003 | WEPO0101 | +| WEB-POLICY-27-005 | TODO | | SPRINT_0215_0000_0004_web_iv | BE/Observability Guild | src/Web/StellaOps.Web | Instrument metrics/logs for compile latency, simulation queue, approval latency, promotion actions. | WEB-POLICY-27-004 | WEPO0101 | | WEB-RISK-66-001 | TODO | | SPRINT_216_web_v | BE-Base Platform Guild, Policy Guild (src/Web/StellaOps.Web) | src/Web/StellaOps.Web | Expose risk profile/results endpoints through gateway with tenant scoping, pagination, and rate limiting. | | | | WEB-RISK-66-002 | TODO | | SPRINT_216_web_v | BE-Base Platform Guild, Risk Engine Guild (src/Web/StellaOps.Web) | src/Web/StellaOps.Web | Add signed URL handling for explanation blobs and enforce scope checks. Dependencies: WEB-RISK-66-001. | | | | WEB-RISK-67-001 | TODO | | SPRINT_216_web_v | BE-Base Platform Guild (src/Web/StellaOps.Web) | src/Web/StellaOps.Web | Provide aggregated risk stats (`/risk/status`) for Console dashboards (counts per severity, last computation). Dependencies: WEB-RISK-66-002. | | | @@ -4389,7 +4389,7 @@ | ZASTAVA-SECRETS-01 | TODO | | SPRINT_0140_0001_0001_runtime_signals | | | Surface.Secrets wiring for Observer pending published cache endpoints. | | | | ZASTAVA-SECRETS-02 | TODO | | SPRINT_0140_0001_0001_runtime_signals | | | Webhook secret retrieval cascades from SECRETS-01 work. | | | | ZASTAVA-SURFACE-01 | TODO | | SPRINT_0140_0001_0001_runtime_signals | | | Surface.FS client integration blocked on Scanner layer metadata; tests ready once packages mirror offline dependencies. | | | -| ZASTAVA-SURFACE-02 | TODO | | SPRINT_136_scanner_surface | Zastava Observer Guild (src/Zastava/StellaOps.Zastava.Observer) | src/Zastava/StellaOps.Zastava.Observer | Use Surface manifest reader helpers to resolve `cas://` pointers and enrich drift diagnostics with manifest provenance. | SURFACE-FS-02; ZASTAVA-SURFACE-01 | | +| ZASTAVA-SURFACE-02 | TODO | | SPRINT_0136_0000_0001_scanner_surface | Zastava Observer Guild (src/Zastava/StellaOps.Zastava.Observer) | src/Zastava/StellaOps.Zastava.Observer | Use Surface manifest reader helpers to resolve `cas://` pointers and enrich drift diagnostics with manifest provenance. | SURFACE-FS-02; ZASTAVA-SURFACE-01 | | | guard unit tests` | TODO | | SPRINT_116_concelier_v | QA Guild (src/Concelier/StellaOps.Concelier.WebService) | src/Concelier/StellaOps.Concelier.WebService | Add unit tests for schema validators, forbidden-field guards (`ERR_AOC_001/2/6/7`), and supersedes chains to keep ingestion append-only. Depends on CONCELIER-WEB-AOC-19-002. | | | | store wiring` | TODO | | SPRINT_113_concelier_ii | Concelier Storage Guild (src/Concelier/__Libraries/StellaOps.Concelier.Storage.Mongo) | src/Concelier/__Libraries/StellaOps.Concelier.Storage.Mongo | Move large raw payloads to object storage with deterministic pointers, update bootstrapper/offline kit seeds, and guarantee provenance metadata remains intact. Depends on CONCELIER-LNM-21-102. | | NOTY0105 | | DOCS-OBS-50-003 | DONE (2025-11-25) | | SPRINT_0306_0001_0006_docs_tasks_md_vi | Docs Guild, Observability Guild (docs) | docs/observability | Create `/docs/observability/logging.md` covering structured log schema, dos/don'ts, tenant isolation, and copyable examples. Dependencies: DOCS-OBS-50-002. | Waiting on observability ADR from 066_PLOB0101 | DOOB0101 | diff --git a/docs/risk/api.md b/docs/risk/api.md index 1bca672e9..f3b91aafb 100644 --- a/docs/risk/api.md +++ b/docs/risk/api.md @@ -13,8 +13,8 @@ ## Endpoints (v1) - `POST /api/v1/risk/jobs` — submit scoring job (body: job request); returns `202` with `job_id` and `status` (`queued`). Sample: `risk-api-samples.json#submit_job_request`. - `GET /api/v1/risk/jobs/{job_id}` — job status + results array (sample: `get_job_status`). -- `GET /api/v1/risk/explain/{job_id}` — explainability payload (sample references `../explain/explain-trace.json`). -- `GET /api/v1/risk/profiles` — list profiles (tenant-filtered); include `profile_hash`, `version`, `etag`. +- `GET /api/v1/risk/explain/{job_id}` — explainability payload (sample references `../explain/explain-trace.json`). Optional `If-None-Match` for caching. +- `GET /api/v1/risk/profiles` — list profiles (tenant-filtered); includes `profile_hash`, `version`, `etag` (see error-catalog headers). - `POST /api/v1/risk/profiles` — create/update profile with DSSE/attestation metadata; returns `201` with `etag`. - `POST /api/v1/risk/simulations` — dry-run scoring with fixtures; returns explain + contributions without persisting results. - `GET /api/v1/risk/export/{job_id}` — export bundle (JSON + CSV + manifest) for auditors. @@ -25,8 +25,8 @@ - Imposed rule reminder must be present in responses where tenant-bound resources are returned. ## Error Model -- Envelope: `code`, `message`, `correlation_id`, `severity`, `remediation`. -- Rate-limit headers: `Retry-After`, `X-RateLimit-Remaining` (document values in SDKs). +- Envelope: `code`, `message`, `correlation_id`, `severity`, `remediation`; sample catalog in `docs/risk/samples/api/error-catalog.json`. +- Rate-limit headers: `Retry-After`, `X-RateLimit-Remaining`; caching headers include `ETag` for explain/results/profile GETs. ## Determinism & Offline Posture - Samples: `docs/risk/samples/api/risk-api-samples.json` (hashes in `SHA256SUMS`); explain sample reused via relative reference. diff --git a/docs/risk/explainability.md b/docs/risk/explainability.md index 572ad8b58..34ee5484c 100644 --- a/docs/risk/explainability.md +++ b/docs/risk/explainability.md @@ -16,8 +16,8 @@ - UI/CLI expectations: deterministic ordering (factor type → source → timestamp), highlight top contributors, show attestation status for each factor. ## UI/CLI Views -- Console: table of factors sorted by contribution, severity badge, gate badges (e.g., KEV+reachability), link to provenance hashes. -- CLI `stella risk explain job-001`: render table using fixture `explain-trace.json`; include `--json` option that emits the same payload. +- Console: frame sample in `docs/risk/samples/explain/console-frame.json` shows top contributors, gate badges, and provenance hashes. +- CLI `stella risk explain job-001`: deterministic text fixture in `docs/risk/samples/explain/cli-explain.txt`; `--json` mirrors `explain-trace.json`. - Export Center: embed explain payload + SHA256 manifest; CSV export keeps deterministic ordering. ## Determinism & Offline Posture diff --git a/docs/risk/samples/api/SHA256SUMS b/docs/risk/samples/api/SHA256SUMS index 688d04b8f..062fec3ab 100644 --- a/docs/risk/samples/api/SHA256SUMS +++ b/docs/risk/samples/api/SHA256SUMS @@ -1,2 +1,3 @@ 9408221415b389f6dad1c235de160e88721555b406ab0e2bdbfa3119c6696a4d README.md +00f8dc4e466eb95c06545e6336d7b0866b53ac430335b7fd1b7889da13529b93 error-catalog.json 96926cd81dfb6ff02d62d1fde5d7b2b7b5b3950e50eb651e51b8ae3042ac9506 risk-api-samples.json diff --git a/docs/risk/samples/api/error-catalog.json b/docs/risk/samples/api/error-catalog.json new file mode 100644 index 000000000..31617b23a --- /dev/null +++ b/docs/risk/samples/api/error-catalog.json @@ -0,0 +1,13 @@ +{ + "errors": [ + {"code": "risk.job.not_found", "message": "Risk job not found", "http_status": 404, "remediation": "Verify job_id"}, + {"code": "risk.profile.invalid_signature", "message": "Profile DSSE signature failed", "http_status": 400, "remediation": "Re-sign profile and retry"}, + {"code": "risk.job.rate_limited", "message": "Rate limit exceeded", "http_status": 429, "remediation": "Retry after backoff", "retry_after": 5}, + {"code": "risk.tenant.scope_denied", "message": "Tenant scope not authorized", "http_status": 403, "remediation": "Provide required scope header"} + ], + "headers": { + "etag": "\"risk-api-sample-etag\"", + "x-ratelimit-remaining": 99, + "retry-after": 5 + } +} diff --git a/docs/risk/samples/explain/SHA256SUMS b/docs/risk/samples/explain/SHA256SUMS index 13cbe4831..99bbe1881 100644 --- a/docs/risk/samples/explain/SHA256SUMS +++ b/docs/risk/samples/explain/SHA256SUMS @@ -1,2 +1,4 @@ 30a64dcc9fb41d06774a9c125456c212a29915a083cd1d2170f16f343bd0764f README.md +4bba11375e9f06942e988dd6cd30e7005fe3b040009b3fffca4e6d36a1875ab3 cli-explain.txt +22c87e16d5a5cd89f60660eeb07b319989c38f2aa0243da88a312bee1841dda6 console-frame.json 1d2e56eebf0a266f80519f073e1db532c4a4f2d7fa604ea5c05d4e208719cc7c explain-trace.json diff --git a/docs/risk/samples/explain/cli-explain.txt b/docs/risk/samples/explain/cli-explain.txt new file mode 100644 index 000000000..33c66a762 --- /dev/null +++ b/docs/risk/samples/explain/cli-explain.txt @@ -0,0 +1,12 @@ +stella risk explain job-001 --tenant tenant-default --json false +Finding: finding-123 +Profile: default-profile v1.0.0 (hash sha256:profilehash) +Score: 0.85 (high) +Gates: kev_and_reachability +Contributions: +- cvss 0.40 (raw 7.5, source nvd, provenance sha256:cvsshash) +- kev 0.30 (raw true, source cisa, provenance sha256:kevhash) +- reachability 0.30 (raw 0.9, source scanner, provenance sha256:reachhash) +Overrides: kev-boost (Known Exploited Vulnerability) +Provenance: job sha256:jobhash | fixtures [sha256:cvsshash, sha256:kevhash, sha256:reachhash] +Timestamp: 2025-12-05T00:00:02Z diff --git a/docs/risk/samples/explain/console-frame.json b/docs/risk/samples/explain/console-frame.json new file mode 100644 index 000000000..85acd1bbd --- /dev/null +++ b/docs/risk/samples/explain/console-frame.json @@ -0,0 +1,19 @@ +{ + "frame_id": "console-explain-001", + "captured_at": "2025-12-05T00:05:00Z", + "finding_id": "finding-123", + "profile_id": "default-profile", + "score": 0.85, + "severity": "high", + "gates": ["kev_and_reachability"], + "top_contributors": [ + {"factor": "cvss", "contribution": 0.4, "raw": 7.5, "provenance": "sha256:cvsshash"}, + {"factor": "kev", "contribution": 0.3, "raw": true, "provenance": "sha256:kevhash"}, + {"factor": "reachability", "contribution": 0.3, "raw": 0.9, "provenance": "sha256:reachhash"} + ], + "provenance": {"job_hash": "sha256:jobhash"}, + "charts": { + "donut": {"high": 1}, + "stacked": [0.4, 0.3, 0.3] + } +} diff --git a/docs/runbooks/replay_ops.md b/docs/runbooks/replay_ops.md index 41691a3dc..02c01a054 100644 --- a/docs/runbooks/replay_ops.md +++ b/docs/runbooks/replay_ops.md @@ -3,7 +3,7 @@ > **Audience:** Ops Guild · Evidence Locker Guild · Scanner Guild · Authority/Signer · Attestor > **Prereqs:** `docs/replay/DETERMINISTIC_REPLAY.md`, `docs/replay/DEVS_GUIDE_REPLAY.md`, `docs/replay/TEST_STRATEGY.md`, `docs/modules/platform/architecture-overview.md` §5 -This runbook governs day-to-day replay operations, retention, and incident handling across online and air-gapped environments. Keep it in sync with the tasks in `docs/implplan/SPRINT_187_evidence_locker_cli_integration.md`. +This runbook governs day-to-day replay operations, retention, and incident handling across online and air-gapped environments. Keep it in sync with the tasks in `docs/implplan/SPRINT_0187_0000_0001_evidence_locker_cli_integration.md`. --- @@ -88,7 +88,7 @@ This runbook governs day-to-day replay operations, retention, and incident handl - `docs/modules/platform/architecture-overview.md` §5 - `docs/modules/evidence-locker/architecture.md` - `docs/modules/telemetry/architecture.md` -- `docs/implplan/SPRINT_187_evidence_locker_cli_integration.md` +- `docs/implplan/SPRINT_0187_0000_0001_evidence_locker_cli_integration.md` --- diff --git a/scripts/commit-prep-artifacts.sh b/scripts/commit-prep-artifacts.sh index 18a8f4b71..48e30e482 100644 --- a/scripts/commit-prep-artifacts.sh +++ b/scripts/commit-prep-artifacts.sh @@ -16,7 +16,7 @@ git add \ docs/modules/scanner/prep/2025-11-21-scanner-records-prep.md \ docs/samples/prep/2025-11-20-lnm-22-001-prep.md \ docs/implplan/SPRINT_0123_0001_0001_policy_reasoning.md \ - docs/implplan/SPRINT_123_policy_reasoning.md \ + docs/implplan/SPRINT_0123_0000_0001_policy_reasoning.md \ docs/implplan/SPRINT_0125_0001_0001_policy_reasoning.md \ docs/implplan/SPRINT_0131_0001_0001_scanner_surface.md diff --git a/src/Concelier/__Libraries/StellaOps.Concelier.Storage.Mongo/Documents/DocumentRecord.cs b/src/Concelier/__Libraries/StellaOps.Concelier.Storage.Mongo/Documents/DocumentRecord.cs new file mode 100644 index 000000000..80b67fd3c --- /dev/null +++ b/src/Concelier/__Libraries/StellaOps.Concelier.Storage.Mongo/Documents/DocumentRecord.cs @@ -0,0 +1,11 @@ +namespace StellaOps.Concelier.Storage.Mongo.Documents; + +/// +/// Stub record for document storage. (Placeholder for full implementation) +/// +public sealed record DocumentRecord +{ + public string Id { get; init; } = string.Empty; + public string TenantId { get; init; } = string.Empty; + public string Source { get; init; } = string.Empty; +} diff --git a/src/Concelier/__Libraries/StellaOps.Concelier.Storage.Mongo/IDocumentStore.cs b/src/Concelier/__Libraries/StellaOps.Concelier.Storage.Mongo/IDocumentStore.cs new file mode 100644 index 000000000..2cea97f19 --- /dev/null +++ b/src/Concelier/__Libraries/StellaOps.Concelier.Storage.Mongo/IDocumentStore.cs @@ -0,0 +1,8 @@ +namespace StellaOps.Concelier.Storage.Mongo; + +/// +/// Stub interface for document storage. (Placeholder for full implementation) +/// +public interface IDocumentStore +{ +} diff --git a/src/Concelier/__Libraries/StellaOps.Concelier.Storage.Mongo/ISourceStateRepository.cs b/src/Concelier/__Libraries/StellaOps.Concelier.Storage.Mongo/ISourceStateRepository.cs new file mode 100644 index 000000000..e00d2ce1f --- /dev/null +++ b/src/Concelier/__Libraries/StellaOps.Concelier.Storage.Mongo/ISourceStateRepository.cs @@ -0,0 +1,8 @@ +namespace StellaOps.Concelier.Storage.Mongo; + +/// +/// Stub interface for source state repository. (Placeholder for full implementation) +/// +public interface ISourceStateRepository +{ +} diff --git a/src/Concelier/__Libraries/StellaOps.Concelier.Storage.Mongo/MongoStorageOptions.cs b/src/Concelier/__Libraries/StellaOps.Concelier.Storage.Mongo/MongoStorageOptions.cs new file mode 100644 index 000000000..c7247a8de --- /dev/null +++ b/src/Concelier/__Libraries/StellaOps.Concelier.Storage.Mongo/MongoStorageOptions.cs @@ -0,0 +1,10 @@ +namespace StellaOps.Concelier.Storage.Mongo; + +/// +/// Stub options for MongoDB storage. (Placeholder for full implementation) +/// +public sealed class MongoStorageOptions +{ + public string ConnectionString { get; set; } = string.Empty; + public string DatabaseName { get; set; } = string.Empty; +} diff --git a/src/Concelier/__Libraries/StellaOps.Concelier.Storage.Mongo/StellaOps.Concelier.Storage.Mongo.csproj b/src/Concelier/__Libraries/StellaOps.Concelier.Storage.Mongo/StellaOps.Concelier.Storage.Mongo.csproj new file mode 100644 index 000000000..a998a671f --- /dev/null +++ b/src/Concelier/__Libraries/StellaOps.Concelier.Storage.Mongo/StellaOps.Concelier.Storage.Mongo.csproj @@ -0,0 +1,12 @@ + + + net10.0 + preview + enable + enable + + + + + + diff --git a/src/Concelier/__Tests/StellaOps.Concelier.Core.Tests/Aoc/AdvisorySchemaValidatorTests.cs b/src/Concelier/__Tests/StellaOps.Concelier.Core.Tests/Aoc/AdvisorySchemaValidatorTests.cs index fe1f984e1..45833acab 100644 --- a/src/Concelier/__Tests/StellaOps.Concelier.Core.Tests/Aoc/AdvisorySchemaValidatorTests.cs +++ b/src/Concelier/__Tests/StellaOps.Concelier.Core.Tests/Aoc/AdvisorySchemaValidatorTests.cs @@ -243,23 +243,7 @@ public sealed class AdvisorySchemaValidatorTests public void AocGuard_DetectsAllForbiddenFields(string forbiddenField) { var guard = new AocWriteGuard(); - var json = $$""" - { - "tenant": "test", - "{{forbiddenField}}": "forbidden_value", - "source": {"vendor": "test", "connector": "test", "version": "1.0"}, - "upstream": { - "upstream_id": "CVE-2024-0001", - "content_hash": "sha256:abc", - "retrieved_at": "2024-01-01T00:00:00Z", - "signature": {"present": false}, - "provenance": {} - }, - "content": {"format": "OSV", "raw": {}}, - "identifiers": {"aliases": [], "primary": "CVE-2024-0001"}, - "linkset": {} - } - """; + var json = GetTestJsonWithField(forbiddenField, "forbidden_value"); using var jsonDoc = JsonDocument.Parse(json); var result = guard.Validate(jsonDoc.RootElement, GuardOptions); @@ -277,10 +261,25 @@ public sealed class AdvisorySchemaValidatorTests public void AocGuard_DetectsAllDerivedFields(string derivedField) { var guard = new AocWriteGuard(); - var json = $$""" + var json = GetTestJsonWithField(derivedField, "derived_value"); + using var jsonDoc = JsonDocument.Parse(json); + + var result = guard.Validate(jsonDoc.RootElement, GuardOptions); + + Assert.False(result.IsValid); + // Derived fields (effective_*) trigger both ForbiddenField and DerivedFindingDetected + // if they're in the forbidden list, otherwise just DerivedFindingDetected + Assert.Contains(result.Violations, v => + v.Code == AocViolationCode.DerivedFindingDetected && + v.ErrorCode == "ERR_AOC_006"); + } + + private static string GetTestJsonWithField(string fieldName, string fieldValue) + { + return """ { "tenant": "test", - "{{derivedField}}": "derived_value", + "FIELD_NAME_PLACEHOLDER": "FIELD_VALUE_PLACEHOLDER", "source": {"vendor": "test", "connector": "test", "version": "1.0"}, "upstream": { "upstream_id": "CVE-2024-0001", @@ -293,16 +292,6 @@ public sealed class AdvisorySchemaValidatorTests "identifiers": {"aliases": [], "primary": "CVE-2024-0001"}, "linkset": {} } - """; - using var jsonDoc = JsonDocument.Parse(json); - - var result = guard.Validate(jsonDoc.RootElement, GuardOptions); - - Assert.False(result.IsValid); - // Derived fields (effective_*) trigger both ForbiddenField and DerivedFindingDetected - // if they're in the forbidden list, otherwise just DerivedFindingDetected - Assert.Contains(result.Violations, v => - v.Code == AocViolationCode.DerivedFindingDetected && - v.ErrorCode == "ERR_AOC_006"); + """.Replace("FIELD_NAME_PLACEHOLDER", fieldName).Replace("FIELD_VALUE_PLACEHOLDER", fieldValue); } } diff --git a/src/Concelier/__Tests/StellaOps.Concelier.Core.Tests/StellaOps.Concelier.Core.Tests.csproj b/src/Concelier/__Tests/StellaOps.Concelier.Core.Tests/StellaOps.Concelier.Core.Tests.csproj index d0506591b..c4e7fa5ea 100644 --- a/src/Concelier/__Tests/StellaOps.Concelier.Core.Tests/StellaOps.Concelier.Core.Tests.csproj +++ b/src/Concelier/__Tests/StellaOps.Concelier.Core.Tests/StellaOps.Concelier.Core.Tests.csproj @@ -6,8 +6,6 @@ enable enable false - - false @@ -15,11 +13,7 @@ - - - - - + diff --git a/src/Web/StellaOps.Web/angular.json b/src/Web/StellaOps.Web/angular.json index 909c70450..1de230589 100644 --- a/src/Web/StellaOps.Web/angular.json +++ b/src/Web/StellaOps.Web/angular.json @@ -126,5 +126,8 @@ } } } + }, + "cli": { + "analytics": false } }