up

docs/reachability/hybrid-attestation.md

@@ -84,7 +84,93 @@ Stella Ops provides **true hybrid reachability** by combining:
 
 **Evidence linking:** Each edge in the graph or bundle includes `evidenceRefs` pointing to the underlying proof artifacts (static analysis artifacts, runtime traces), enabling **evidence-linked VEX decisions**.
 
-## 8. Open decisions (tracked in Sprint 0401 tasks 53–56)
-- Rekor publish defaults per deployment tier (regulated vs standard).
-- CLI UX for selective bundle verification.
-- Bench coverage for edge-bundle verification time/size.
+## 8. Decisions (Frozen 2025-12-13)
+
+### 8.1 DSSE/Rekor Budget by Deployment Tier
+
+| Tier | Graph DSSE | Edge-Bundle DSSE | Rekor Publish | Max Bundles/Graph |
+|------|------------|------------------|---------------|-------------------|
+| **Regulated** (SOC2, FedRAMP, PCI) | Required | Required for runtime/contested | Required | 10 |
+| **Standard** | Required | Optional (criteria-based) | Graph only | 5 |
+| **Air-gapped** | Required | Optional | Offline checkpoint | 5 |
+| **Dev/Test** | Optional | Optional | Disabled | Unlimited |
+
+**Budget enforcement:**
+- Graph DSSE: Always submit digest to Rekor (or offline checkpoint for air-gapped)
+- Edge-bundle DSSE: Submit to Rekor only when `bundle_reason` is `disputed`, `runtime-hit`, or `security-critical`
+- Cap enforced by `reachability.edgeBundles.maxRekorPublishes` config (per tier defaults above)
+
+### 8.2 Signing Layout and CAS Paths
+
+```
+cas://reachability/
+  graphs/
+    {blake3}/                  # richgraph-v1 body (JSON)
+    {blake3}.dsse              # Graph DSSE envelope
+    {blake3}.rekor             # Rekor inclusion proof (optional)
+  edges/
+    {graph_hash}/
+      {bundle_id}.json         # Edge bundle body
+      {bundle_id}.dsse         # Edge bundle DSSE envelope
+      {bundle_id}.rekor        # Rekor inclusion proof (if published)
+  revisions/
+    {revision_id}/             # Revision manifest + lineage
+```
+
+**Signing workflow:**
+1. Canonicalize richgraph-v1 JSON (sorted keys, arrays by deterministic key)
+2. Compute BLAKE3-256 hash -> `graph_hash`
+3. Create DSSE envelope with `stella.ops/graph@v1` predicate
+4. Submit digest to Rekor (online) or cache checkpoint (offline)
+5. Store graph body + envelope + proof in CAS
+
+### 8.3 CLI UX for Selective Bundle Verification
+
+```bash
+# Verify graph DSSE only (default)
+stella graph verify --hash blake3:a1b2c3d4...
+
+# Verify graph + all edge bundles
+stella graph verify --hash blake3:a1b2c3d4... --include-bundles
+
+# Verify specific edge bundle
+stella graph verify --hash blake3:a1b2c3d4... --bundle bundle:001
+
+# Offline verification with local CAS
+stella graph verify --hash blake3:a1b2c3d4... --cas-root ./offline-cas/
+
+# Verify Rekor inclusion
+stella graph verify --hash blake3:a1b2c3d4... --rekor-proof
+
+# Output formats
+stella graph verify --hash blake3:a1b2c3d4... --format json|table|summary
+```
+
+### 8.4 Golden Fixture Plan
+
+**Fixture location:** `tests/Reachability/Hybrid/`
+
+**Required fixtures:**
+| Fixture | Description | Expected Verification Time |
+|---------|-------------|---------------------------|
+| `graph-only.golden.json` | Minimal richgraph-v1 with DSSE | < 100ms |
+| `graph-with-runtime.golden.json` | Graph + 1 runtime edge bundle | < 200ms |
+| `graph-with-contested.golden.json` | Graph + 1 contested/revoked edge bundle | < 200ms |
+| `large-graph.golden.json` | 10K nodes, 50K edges, 5 bundles | < 2s |
+| `offline-bundle.golden.tgz` | Complete offline replay pack | < 5s |
+
+**CI integration:**
+- `.gitea/workflows/hybrid-attestation.yml` runs verification fixtures
+- Size gate: Graph body < 10MB, individual bundle < 1MB
+- Time gate: Full verification < 5s for standard tier
+
+### 8.5 Implementation Status
+
+| Component | Status | Notes |
+|-----------|--------|-------|
+| Graph DSSE predicate | Done | `stella.ops/graph@v1` in PredicateTypes.cs |
+| Edge-bundle DSSE predicate | Planned | `stella.ops/edgeBundle@v1` |
+| CAS layout | Done | Per section 8.2 |
+| CLI verify command | Planned | Per section 8.3 |
+| Golden fixtures | Planned | Per section 8.4 |
+| Rekor integration | Done | Via Attestor module |