Resolve merge conflicts by accepting deletions

deploy/compose/README.md

@@ -0,0 +1,459 @@
+# Stella Ops Docker Compose Profiles
+
+Consolidated Docker Compose configuration for the StellaOps platform. All profiles use immutable image digests from `deploy/releases/*.yaml` and are validated via `docker compose config` in CI.
+
+## Quick Reference
+
+| I want to... | Command |
+|--------------|---------|
+| Run the full platform | `docker compose -f docker-compose.stella-ops.yml up -d` |
+| Add observability | `docker compose -f docker-compose.stella-ops.yml -f docker-compose.telemetry.yml up -d` |
+| Run CI/testing infrastructure | `docker compose -f docker-compose.testing.yml --profile ci up -d` |
+| Deploy with China compliance | See [China Compliance](#china-compliance-sm2sm3sm4) |
+| Deploy with Russia compliance | See [Russia Compliance](#russia-compliance-gost) |
+| Deploy with EU compliance | See [EU Compliance](#eu-compliance-eidas) |
+
+---
+
+## File Structure
+
+### Core Stack Files
+
+| File | Purpose |
+|------|---------|
+| `docker-compose.stella-ops.yml` | **Main stack**: PostgreSQL 18.1, Valkey 9.0.1, RustFS, Rekor v2, all StellaOps services |
+| `docker-compose.telemetry.yml` | **Observability**: OpenTelemetry collector, Prometheus, Tempo, Loki |
+| `docker-compose.testing.yml` | **CI/Testing**: Test databases, mock services, Gitea for integration tests |
+| `docker-compose.dev.yml` | **Minimal dev infrastructure**: PostgreSQL, Valkey, RustFS only |
+
+### Specialized Infrastructure
+
+| File | Purpose |
+|------|---------|
+| `docker-compose.bsim.yml` | **BSim analysis**: PostgreSQL for Ghidra binary similarity corpus |
+| `docker-compose.corpus.yml` | **Function corpus**: PostgreSQL for function behavior database |
+| `docker-compose.sealed-ci.yml` | **Air-gapped CI**: Sealed testing environment with authority, signer, attestor |
+| `docker-compose.telemetry-offline.yml` | **Offline observability**: Air-gapped Loki, Promtail, OTEL collector, Tempo, Prometheus |
+
+### Regional Compliance Overlays
+
+| File | Purpose | Jurisdiction |
+|------|---------|--------------|
+| `docker-compose.compliance-china.yml` | SM2/SM3/SM4 ShangMi crypto configuration | China (OSCCA) |
+| `docker-compose.compliance-russia.yml` | GOST R 34.10-2012 crypto configuration | Russia (FSB) |
+| `docker-compose.compliance-eu.yml` | eIDAS qualified trust services configuration | EU |
+
+### Crypto Provider Overlays
+
+| File | Purpose | Use Case |
+|------|---------|----------|
+| `docker-compose.crypto-sim.yml` | Universal crypto simulation | Testing without licensed crypto |
+| `docker-compose.cryptopro.yml` | CryptoPro CSP (real GOST) | Production Russia deployments |
+| `docker-compose.sm-remote.yml` | SM Remote service (real SM2) | Production China deployments |
+
+### Additional Overlays
+
+| File | Purpose | Use Case |
+|------|---------|----------|
+| `docker-compose.gpu.yaml` | NVIDIA GPU acceleration | Advisory AI inference with GPU |
+| `docker-compose.cas.yaml` | Content Addressable Storage | Dedicated CAS with retention policies |
+| `docker-compose.tile-proxy.yml` | Rekor tile caching proxy | Air-gapped Sigstore deployments |
+
+### Supporting Files
+
+| Path | Purpose |
+|------|---------|
+| `env/*.env.example` | Environment variable templates per profile |
+| `scripts/backup.sh` | Create deterministic volume snapshots |
+| `scripts/reset.sh` | Stop stack and remove volumes (with confirmation) |
+
+---
+
+## Usage Patterns
+
+### Basic Development
+
+```bash
+# Copy environment template
+cp env/stellaops.env.example .env
+
+# Validate configuration
+docker compose -f docker-compose.stella-ops.yml config
+
+# Start the platform
+docker compose -f docker-compose.stella-ops.yml up -d
+
+# View logs
+docker compose -f docker-compose.stella-ops.yml logs -f scanner-web
+```
+
+### With Observability
+
+```bash
+# Generate TLS certificates for telemetry
+./ops/devops/telemetry/generate_dev_tls.sh
+
+# Start platform with telemetry
+docker compose -f docker-compose.stella-ops.yml \
+  -f docker-compose.telemetry.yml up -d
+```
+
+### CI/Testing Infrastructure
+
+```bash
+# Start CI infrastructure only (different ports to avoid conflicts)
+docker compose -f docker-compose.testing.yml --profile ci up -d
+
+# Start mock services for integration testing
+docker compose -f docker-compose.testing.yml --profile mock up -d
+
+# Start Gitea for SCM integration tests
+docker compose -f docker-compose.testing.yml --profile gitea up -d
+
+# Start everything
+docker compose -f docker-compose.testing.yml --profile all up -d
+```
+
+**Test Infrastructure Ports:**
+| Service | Port | Purpose |
+|---------|------|---------|
+| postgres-test | 5433 | PostgreSQL 18 for tests |
+| valkey-test | 6380 | Valkey for cache/queue tests |
+| rustfs-test | 8180 | S3-compatible storage |
+| mock-registry | 5001 | Container registry mock |
+| gitea | 3000 | Git hosting for SCM tests |
+
+---
+
+## Regional Compliance Deployments
+
+### China Compliance (SM2/SM3/SM4)
+
+**For Testing (simulation):**
+```bash
+docker compose -f docker-compose.stella-ops.yml \
+  -f docker-compose.compliance-china.yml \
+  -f docker-compose.crypto-sim.yml up -d
+```
+
+**For Production (real SM crypto):**
+```bash
+docker compose -f docker-compose.stella-ops.yml \
+  -f docker-compose.compliance-china.yml \
+  -f docker-compose.sm-remote.yml up -d
+```
+
+**With OSCCA-certified HSM:**
+```bash
+# Set HSM connection details in environment
+export SM_REMOTE_HSM_URL="https://sm-hsm.example.com:8900"
+export SM_REMOTE_HSM_API_KEY="your-api-key"
+
+docker compose -f docker-compose.stella-ops.yml \
+  -f docker-compose.compliance-china.yml \
+  -f docker-compose.sm-remote.yml up -d
+```
+
+**Algorithms:**
+- SM2: Public key cryptography (GM/T 0003-2012)
+- SM3: Hash function, 256-bit (GM/T 0004-2012)
+- SM4: Block cipher, 128-bit (GM/T 0002-2012)
+
+---
+
+### Russia Compliance (GOST)
+
+**For Testing (simulation):**
+```bash
+docker compose -f docker-compose.stella-ops.yml \
+  -f docker-compose.compliance-russia.yml \
+  -f docker-compose.crypto-sim.yml up -d
+```
+
+**For Production (CryptoPro CSP):**
+```bash
+# CryptoPro requires EULA acceptance
+CRYPTOPRO_ACCEPT_EULA=1 docker compose -f docker-compose.stella-ops.yml \
+  -f docker-compose.compliance-russia.yml \
+  -f docker-compose.cryptopro.yml up -d
+```
+
+**Requirements for CryptoPro:**
+- CryptoPro CSP license files in `opt/cryptopro/downloads/`
+- `CRYPTOPRO_ACCEPT_EULA=1` environment variable
+- Valid CryptoPro container images
+
+**Algorithms:**
+- GOST R 34.10-2012: Digital signature (256/512-bit)
+- GOST R 34.11-2012: Hash function (Streebog, 256/512-bit)
+- GOST R 34.12-2015: Block cipher (Kuznyechik, Magma)
+
+---
+
+### EU Compliance (eIDAS)
+
+**For Testing (simulation):**
+```bash
+docker compose -f docker-compose.stella-ops.yml \
+  -f docker-compose.compliance-eu.yml \
+  -f docker-compose.crypto-sim.yml up -d
+```
+
+**For Production:**
+EU eIDAS deployments typically integrate with external Qualified Trust Service Providers (QTSPs) rather than hosting crypto locally. Configure your QTSP integration in the application settings.
+
+```bash
+docker compose -f docker-compose.stella-ops.yml \
+  -f docker-compose.compliance-eu.yml up -d
+```
+
+**Standards:**
+- ETSI TS 119 312 compliant algorithms
+- Qualified electronic signatures
+- QTSP integration for qualified trust services
+
+---
+
+## Crypto Simulation Details
+
+The `docker-compose.crypto-sim.yml` overlay provides a unified simulation service for all sovereign crypto profiles:
+
+| Algorithm ID | Simulation | Use Case |
+|--------------|------------|----------|
+| `SM2`, `sm.sim` | HMAC-SHA256 | China testing |
+| `GOST12-256`, `GOST12-512` | HMAC-SHA256 | Russia testing |
+| `ru.magma.sim`, `ru.kuznyechik.sim` | HMAC-SHA256 | Russia testing |
+| `DILITHIUM3`, `FALCON512`, `pq.sim` | HMAC-SHA256 | Post-quantum testing |
+| `fips.sim`, `eidas.sim`, `kcmvp.sim` | ECDSA P-256 | FIPS/EU/Korea testing |
+
+**Important:** Simulation is for testing only. Uses deterministic HMAC or static ECDSA keys—not suitable for production or compliance certification.
+
+---
+
+## Configuration Reference
+
+### Infrastructure Services
+
+| Service | Default Port | Purpose |
+|---------|--------------|---------|
+| PostgreSQL | 5432 | Primary database |
+| Valkey | 6379 | Cache, queues, events |
+| RustFS | 8080 | S3-compatible artifact storage |
+| Rekor v2 | (internal) | Sigstore transparency log |
+
+### Application Services
+
+| Service | Default Port | Purpose |
+|---------|--------------|---------|
+| Authority | 8440 | OAuth2/OIDC identity provider |
+| Signer | 8441 | Cryptographic signing |
+| Attestor | 8442 | SLSA attestation |
+| Scanner Web | 8444 | SBOM/vulnerability scanning API |
+| Concelier | 8445 | Advisory aggregation |
+| Notify Web | 8446 | Notification service |
+| Issuer Directory | 8447 | CSAF publisher registry |
+| Advisory AI Web | 8448 | AI-powered advisory analysis |
+| Web UI | 8443 | Angular frontend |
+
+### Environment Variables
+
+Key variables (see `env/*.env.example` for complete list):
+
+```bash
+# Database
+POSTGRES_USER=stellaops
+POSTGRES_PASSWORD=<secret>
+POSTGRES_DB=stellaops_platform
+
+# Authority
+AUTHORITY_ISSUER=https://authority.example.com
+
+# Scanner
+SCANNER_EVENTS_ENABLED=false
+SCANNER_OFFLINEKIT_ENABLED=false
+
+# Crypto (for compliance overlays)
+STELLAOPS_CRYPTO_PROFILE=default  # or: china, russia, eu
+STELLAOPS_CRYPTO_ENABLE_SIM=0     # set to 1 for simulation
+
+# CryptoPro (Russia only)
+CRYPTOPRO_ACCEPT_EULA=0  # must be 1 to use CryptoPro
+
+# SM Remote (China only)
+SM_SOFT_ALLOWED=1  # software-only SM2
+SM_REMOTE_HSM_URL= # optional: OSCCA-certified HSM
+```
+
+---
+
+## Networking
+
+All profiles use a shared `stellaops` Docker network. Production deployments can attach a `frontdoor` network for reverse proxy integration:
+
+```bash
+# Create external network for load balancer
+docker network create stellaops_frontdoor
+
+# Set in environment
+export FRONTDOOR_NETWORK=stellaops_frontdoor
+```
+
+Only externally-reachable services (Authority, Signer, Attestor, Concelier, Scanner Web, Notify Web, UI) attach to the frontdoor network. Infrastructure services (PostgreSQL, Valkey, RustFS) remain on the private network.
+
+---
+
+## Sigstore Tools
+
+Enable Sigstore CLI tools (rekor-cli, cosign) with the `sigstore` profile:
+
+```bash
+docker compose -f docker-compose.stella-ops.yml --profile sigstore up -d
+```
+
+---
+
+## GPU Support for Advisory AI
+
+GPU is disabled by default. To enable NVIDIA GPU inference:
+
+```bash
+docker compose -f docker-compose.stella-ops.yml \
+  -f docker-compose.gpu.yaml up -d
+```
+
+**Requirements:**
+- NVIDIA GPU with CUDA support
+- nvidia-container-toolkit installed
+- Docker configured with nvidia runtime
+
+---
+
+## Content Addressable Storage (CAS)
+
+The CAS overlay provides dedicated RustFS instances with retention policies for different artifact types:
+
+```bash
+# Standalone CAS infrastructure
+docker compose -f docker-compose.cas.yaml up -d
+
+# Combined with main stack
+docker compose -f docker-compose.stella-ops.yml \
+  -f docker-compose.cas.yaml up -d
+```
+
+**CAS Services:**
+| Service | Port | Purpose |
+|---------|------|---------|
+| rustfs-cas | 8180 | Runtime facts, signals, replay artifacts |
+| rustfs-evidence | 8181 | Merkle roots, hash chains, evidence bundles (immutable) |
+| rustfs-attestation | 8182 | DSSE envelopes, in-toto attestations (immutable) |
+
+**Retention Policies (configurable via `env/cas.env.example`):**
+- Vulnerability DB: 7 days
+- SBOM artifacts: 365 days
+- Scan results: 90 days
+- Evidence bundles: Indefinite (immutable)
+- Attestations: Indefinite (immutable)
+
+---
+
+## Tile Proxy (Air-Gapped Sigstore)
+
+For air-gapped deployments, the tile-proxy caches Rekor transparency log tiles locally from public Sigstore:
+
+```bash
+docker compose -f docker-compose.stella-ops.yml \
+  -f docker-compose.tile-proxy.yml up -d
+```
+
+**Tile Proxy vs Rekor v2:**
+- Use `--profile sigstore` when running your own Rekor transparency log locally
+- Use `docker-compose.tile-proxy.yml` when caching tiles from public Sigstore (rekor.sigstore.dev)
+
+**Configuration:**
+| Variable | Default | Purpose |
+|----------|---------|---------|
+| `REKOR_SERVER_URL` | `https://rekor.sigstore.dev` | Upstream Rekor to proxy |
+| `TILE_PROXY_SYNC_ENABLED` | `true` | Enable periodic tile sync |
+| `TILE_PROXY_SYNC_SCHEDULE` | `0 */6 * * *` | Sync every 6 hours |
+| `TILE_PROXY_CACHE_MAX_SIZE_GB` | `10` | Local cache size limit |
+
+The proxy syncs tiles on schedule and serves them to internal services for offline verification.
+
+---
+
+## Maintenance
+
+### Backup
+
+```bash
+./scripts/backup.sh  # Creates timestamped tar.gz of volumes
+```
+
+### Reset
+
+```bash
+./scripts/reset.sh  # Stops stack, removes volumes (requires confirmation)
+```
+
+### Validate Configuration
+
+```bash
+docker compose -f docker-compose.stella-ops.yml config
+```
+
+### Update to New Release
+
+1. Import new manifest to `deploy/releases/`
+2. Update image digests in compose files
+3. Run `docker compose config` to validate
+4. Run `deploy/tools/validate-profiles.sh` for audit
+
+---
+
+## Troubleshooting
+
+### Port Conflicts
+
+Override ports in your `.env` file:
+```bash
+POSTGRES_PORT=5433
+VALKEY_PORT=6380
+SCANNER_WEB_PORT=8544
+```
+
+### Service Dependencies
+
+Services declare `depends_on` with health checks. If a service fails to start, check its dependencies:
+```bash
+docker compose -f docker-compose.stella-ops.yml ps
+docker compose -f docker-compose.stella-ops.yml logs postgres
+docker compose -f docker-compose.stella-ops.yml logs valkey
+```
+
+### Crypto Provider Issues
+
+For crypto simulation issues:
+```bash
+# Check sim-crypto service
+docker compose logs sim-crypto
+curl http://localhost:18090/keys
+```
+
+For CryptoPro issues:
+```bash
+# Verify EULA acceptance
+echo $CRYPTOPRO_ACCEPT_EULA  # must be 1
+
+# Check CryptoPro service
+docker compose logs cryptopro-csp
+```
+
+---
+
+## Related Documentation
+
+- [Deployment Upgrade Runbook](../../docs/operations/devops/runbooks/deployment-upgrade.md)
+- [Local CI Guide](../../docs/technical/testing/LOCAL_CI_GUIDE.md)
+- [Crypto Profile Configuration](../../docs/security/crypto-profile-configuration.md)
+- [Regional Deployments](../../docs/operations/regional-deployments.md)

deploy/compose/docker-compose.bsim.yml

@@ -0,0 +1,73 @@
+# =============================================================================
+# BSIM - BINARY SIMILARITY ANALYSIS
+# =============================================================================
+# BSim PostgreSQL Database and Ghidra Headless Services for binary analysis.
+#
+# Usage:
+#   docker compose -f docker-compose.bsim.yml up -d
+#
+# Environment:
+#   BSIM_DB_PASSWORD - PostgreSQL password for BSim database
+# =============================================================================
+
+services:
+  bsim-postgres:
+    image: postgres:18.1-alpine
+    container_name: stellaops-bsim-db
+    environment:
+      POSTGRES_DB: bsim_corpus
+      POSTGRES_USER: bsim_user
+      POSTGRES_PASSWORD: ${BSIM_DB_PASSWORD:-stellaops_bsim_dev}
+      POSTGRES_INITDB_ARGS: "-E UTF8 --locale=C"
+    volumes:
+      - bsim-data:/var/lib/postgresql/data
+      - ../docker/ghidra/scripts/init-bsim.sql:/docker-entrypoint-initdb.d/10-init-bsim.sql:ro
+    ports:
+      - "${BSIM_DB_PORT:-5433}:5432"
+    networks:
+      - stellaops-bsim
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U bsim_user -d bsim_corpus"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+    restart: unless-stopped
+
+  ghidra-headless:
+    build:
+      context: ../docker/ghidra
+      dockerfile: Dockerfile.headless
+    image: stellaops/ghidra-headless:11.2
+    container_name: stellaops-ghidra
+    depends_on:
+      bsim-postgres:
+        condition: service_healthy
+    environment:
+      BSIM_DB_URL: "postgresql://bsim-postgres:5432/bsim_corpus"
+      BSIM_DB_USER: bsim_user
+      BSIM_DB_PASSWORD: ${BSIM_DB_PASSWORD:-stellaops_bsim_dev}
+      JAVA_HOME: /opt/java/openjdk
+      MAXMEM: 4G
+    volumes:
+      - ghidra-projects:/projects
+      - ghidra-scripts:/scripts
+      - ghidra-output:/output
+    networks:
+      - stellaops-bsim
+    deploy:
+      resources:
+        limits:
+          cpus: '4'
+          memory: 8G
+    entrypoint: ["tail", "-f", "/dev/null"]
+    restart: unless-stopped
+
+volumes:
+  bsim-data:
+  ghidra-projects:
+  ghidra-scripts:
+  ghidra-output:
+
+networks:
+  stellaops-bsim:
+    driver: bridge

deploy/compose/docker-compose.cas.yaml

@@ -0,0 +1,212 @@
+# Content Addressable Storage (CAS) Infrastructure
+# Uses RustFS for S3-compatible immutable object storage
+# Aligned with best-in-class vulnerability scanner retention policies
+#
+# Usage (standalone):
+#   docker compose -f docker-compose.cas.yaml up -d
+#
+# Usage (with main stack):
+#   docker compose -f docker-compose.stella-ops.yml -f docker-compose.cas.yaml up -d
+
+x-release-labels: &release-labels
+  com.stellaops.release.version: "2025.10.0-edge"
+  com.stellaops.release.channel: "edge"
+  com.stellaops.profile: "cas"
+
+x-cas-config: &cas-config
+  # Retention policies (aligned with Trivy/Grype/Anchore Enterprise)
+  # - vulnerability-db: 7 days (matches Trivy default)
+  # - sbom-artifacts: 365 days (audit compliance)
+  # - scan-results: 90 days (SOC2/ISO27001 typical)
+  # - evidence-bundles: indefinite (immutable, content-addressed)
+  # - attestations: indefinite (in-toto/DSSE signed)
+  CAS__RETENTION__VULNERABILITY_DB_DAYS: "7"
+  CAS__RETENTION__SBOM_ARTIFACTS_DAYS: "365"
+  CAS__RETENTION__SCAN_RESULTS_DAYS: "90"
+  CAS__RETENTION__EVIDENCE_BUNDLES_DAYS: "0"      # 0 = indefinite
+  CAS__RETENTION__ATTESTATIONS_DAYS: "0"          # 0 = indefinite
+  CAS__RETENTION__TEMP_ARTIFACTS_DAYS: "1"
+
+networks:
+  cas:
+    driver: bridge
+
+volumes:
+  rustfs-cas-data:
+    driver: local
+    driver_opts:
+      type: none
+      o: bind
+      device: ${CAS_DATA_PATH:-/var/lib/stellaops/cas}
+  rustfs-evidence-data:
+    driver: local
+    driver_opts:
+      type: none
+      o: bind
+      device: ${CAS_EVIDENCE_PATH:-/var/lib/stellaops/evidence}
+  rustfs-attestation-data:
+    driver: local
+    driver_opts:
+      type: none
+      o: bind
+      device: ${CAS_ATTESTATION_PATH:-/var/lib/stellaops/attestations}
+
+services:
+  # Primary CAS storage - runtime facts, signals, replay artifacts
+  rustfs-cas:
+    image: registry.stella-ops.org/stellaops/rustfs:2025.09.2
+    command: ["serve", "--listen", "0.0.0.0:8080", "--root", "/data"]
+    restart: unless-stopped
+    environment:
+      RUSTFS__LOG__LEVEL: "${RUSTFS_LOG_LEVEL:-info}"
+      RUSTFS__STORAGE__PATH: /data
+      RUSTFS__STORAGE__DEDUP: "true"
+      RUSTFS__STORAGE__COMPRESSION: "${RUSTFS_COMPRESSION:-zstd}"
+      RUSTFS__STORAGE__COMPRESSION_LEVEL: "${RUSTFS_COMPRESSION_LEVEL:-3}"
+      # Bucket lifecycle (retention enforcement)
+      RUSTFS__LIFECYCLE__ENABLED: "true"
+      RUSTFS__LIFECYCLE__SCAN_INTERVAL_HOURS: "24"
+      RUSTFS__LIFECYCLE__DEFAULT_RETENTION_DAYS: "90"
+      # Access control
+      RUSTFS__AUTH__ENABLED: "${RUSTFS_AUTH_ENABLED:-true}"
+      RUSTFS__AUTH__API_KEY: "${RUSTFS_CAS_API_KEY:-cas-api-key-change-me}"
+      RUSTFS__AUTH__READONLY_KEY: "${RUSTFS_CAS_READONLY_KEY:-cas-readonly-key-change-me}"
+      # Service account configuration
+      RUSTFS__ACCOUNTS__SCANNER__KEY: "${RUSTFS_SCANNER_KEY:-scanner-svc-key}"
+      RUSTFS__ACCOUNTS__SCANNER__BUCKETS: "scanner-artifacts,surface-cache,runtime-facts"
+      RUSTFS__ACCOUNTS__SCANNER__PERMISSIONS: "read,write"
+      RUSTFS__ACCOUNTS__SIGNALS__KEY: "${RUSTFS_SIGNALS_KEY:-signals-svc-key}"
+      RUSTFS__ACCOUNTS__SIGNALS__BUCKETS: "runtime-facts,signals-data,provenance-feed"
+      RUSTFS__ACCOUNTS__SIGNALS__PERMISSIONS: "read,write"
+      RUSTFS__ACCOUNTS__REPLAY__KEY: "${RUSTFS_REPLAY_KEY:-replay-svc-key}"
+      RUSTFS__ACCOUNTS__REPLAY__BUCKETS: "replay-bundles,inputs-lock"
+      RUSTFS__ACCOUNTS__REPLAY__PERMISSIONS: "read,write"
+      RUSTFS__ACCOUNTS__READONLY__KEY: "${RUSTFS_READONLY_KEY:-readonly-svc-key}"
+      RUSTFS__ACCOUNTS__READONLY__BUCKETS: "*"
+      RUSTFS__ACCOUNTS__READONLY__PERMISSIONS: "read"
+      <<: *cas-config
+    volumes:
+      - rustfs-cas-data:/data
+    ports:
+      - "${RUSTFS_CAS_PORT:-8180}:8080"
+    networks:
+      - cas
+    labels: *release-labels
+    healthcheck:
+      test: ["CMD", "curl", "-f", "http://localhost:8080/health"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 10s
+
+  # Evidence storage - Merkle roots, hash chains, evidence bundles (immutable)
+  rustfs-evidence:
+    image: registry.stella-ops.org/stellaops/rustfs:2025.09.2
+    command: ["serve", "--listen", "0.0.0.0:8080", "--root", "/data", "--immutable"]
+    restart: unless-stopped
+    environment:
+      RUSTFS__LOG__LEVEL: "${RUSTFS_LOG_LEVEL:-info}"
+      RUSTFS__STORAGE__PATH: /data
+      RUSTFS__STORAGE__DEDUP: "true"
+      RUSTFS__STORAGE__COMPRESSION: "${RUSTFS_COMPRESSION:-zstd}"
+      RUSTFS__STORAGE__IMMUTABLE: "true"  # Write-once, never delete
+      # Access control
+      RUSTFS__AUTH__ENABLED: "true"
+      RUSTFS__AUTH__API_KEY: "${RUSTFS_EVIDENCE_API_KEY:-evidence-api-key-change-me}"
+      RUSTFS__AUTH__READONLY_KEY: "${RUSTFS_EVIDENCE_READONLY_KEY:-evidence-readonly-key-change-me}"
+      # Service accounts
+      RUSTFS__ACCOUNTS__LEDGER__KEY: "${RUSTFS_LEDGER_KEY:-ledger-svc-key}"
+      RUSTFS__ACCOUNTS__LEDGER__BUCKETS: "evidence-bundles,merkle-roots,hash-chains"
+      RUSTFS__ACCOUNTS__LEDGER__PERMISSIONS: "read,write"
+      RUSTFS__ACCOUNTS__EXPORTER__KEY: "${RUSTFS_EXPORTER_KEY:-exporter-svc-key}"
+      RUSTFS__ACCOUNTS__EXPORTER__BUCKETS: "evidence-bundles"
+      RUSTFS__ACCOUNTS__EXPORTER__PERMISSIONS: "read"
+    volumes:
+      - rustfs-evidence-data:/data
+    ports:
+      - "${RUSTFS_EVIDENCE_PORT:-8181}:8080"
+    networks:
+      - cas
+    labels: *release-labels
+    healthcheck:
+      test: ["CMD", "curl", "-f", "http://localhost:8080/health"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 10s
+
+  # Attestation storage - DSSE envelopes, in-toto attestations (immutable)
+  rustfs-attestation:
+    image: registry.stella-ops.org/stellaops/rustfs:2025.09.2
+    command: ["serve", "--listen", "0.0.0.0:8080", "--root", "/data", "--immutable"]
+    restart: unless-stopped
+    environment:
+      RUSTFS__LOG__LEVEL: "${RUSTFS_LOG_LEVEL:-info}"
+      RUSTFS__STORAGE__PATH: /data
+      RUSTFS__STORAGE__DEDUP: "true"
+      RUSTFS__STORAGE__COMPRESSION: "${RUSTFS_COMPRESSION:-zstd}"
+      RUSTFS__STORAGE__IMMUTABLE: "true"  # Write-once, never delete
+      # Access control
+      RUSTFS__AUTH__ENABLED: "true"
+      RUSTFS__AUTH__API_KEY: "${RUSTFS_ATTESTATION_API_KEY:-attestation-api-key-change-me}"
+      RUSTFS__AUTH__READONLY_KEY: "${RUSTFS_ATTESTATION_READONLY_KEY:-attestation-readonly-key-change-me}"
+      # Service accounts
+      RUSTFS__ACCOUNTS__ATTESTOR__KEY: "${RUSTFS_ATTESTOR_KEY:-attestor-svc-key}"
+      RUSTFS__ACCOUNTS__ATTESTOR__BUCKETS: "attestations,dsse-envelopes,rekor-receipts"
+      RUSTFS__ACCOUNTS__ATTESTOR__PERMISSIONS: "read,write"
+      RUSTFS__ACCOUNTS__VERIFIER__KEY: "${RUSTFS_VERIFIER_KEY:-verifier-svc-key}"
+      RUSTFS__ACCOUNTS__VERIFIER__BUCKETS: "attestations,dsse-envelopes,rekor-receipts"
+      RUSTFS__ACCOUNTS__VERIFIER__PERMISSIONS: "read"
+    volumes:
+      - rustfs-attestation-data:/data
+    ports:
+      - "${RUSTFS_ATTESTATION_PORT:-8182}:8080"
+    networks:
+      - cas
+    labels: *release-labels
+    healthcheck:
+      test: ["CMD", "curl", "-f", "http://localhost:8080/health"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 10s
+
+  rekor-cli:
+    image: ghcr.io/sigstore/rekor-cli:v1.4.3
+    entrypoint: ["rekor-cli"]
+    command: ["version"]
+    profiles: ["sigstore"]
+    networks:
+      - cas
+    labels: *release-labels
+
+  cosign:
+    image: ghcr.io/sigstore/cosign:v3.0.4
+    entrypoint: ["cosign"]
+    command: ["version"]
+    profiles: ["sigstore"]
+    networks:
+      - cas
+    labels: *release-labels
+
+  # Lifecycle manager - enforces retention policies
+  cas-lifecycle:
+    image: registry.stella-ops.org/stellaops/cas-lifecycle:2025.10.0-edge
+    restart: unless-stopped
+    depends_on:
+      rustfs-cas:
+        condition: service_healthy
+    environment:
+      LIFECYCLE__CAS__ENDPOINT: "http://rustfs-cas:8080"
+      LIFECYCLE__CAS__API_KEY: "${RUSTFS_CAS_API_KEY:-cas-api-key-change-me}"
+      LIFECYCLE__SCHEDULE__CRON: "${LIFECYCLE_CRON:-0 3 * * *}"  # 3 AM daily
+      LIFECYCLE__POLICIES__VULNERABILITY_DB: "7d"
+      LIFECYCLE__POLICIES__SBOM_ARTIFACTS: "365d"
+      LIFECYCLE__POLICIES__SCAN_RESULTS: "90d"
+      LIFECYCLE__POLICIES__TEMP_ARTIFACTS: "1d"
+      LIFECYCLE__TELEMETRY__ENABLED: "${LIFECYCLE_TELEMETRY:-true}"
+      LIFECYCLE__TELEMETRY__OTLP_ENDPOINT: "${OTLP_ENDPOINT:-}"
+    networks:
+      - cas
+    labels: *release-labels
+

deploy/compose/docker-compose.compliance-china.yml

@@ -0,0 +1,197 @@
+# =============================================================================
+# STELLA OPS - COMPLIANCE OVERLAY: CHINA
+# =============================================================================
+# SM2/SM3/SM4 ShangMi (Commercial Cipher) crypto overlay.
+# This file extends docker-compose.stella-ops.yml with China-specific crypto.
+#
+# Usage:
+#   docker compose -f devops/compose/docker-compose.stella-ops.yml \
+#     -f devops/compose/docker-compose.compliance-china.yml up -d
+#
+# Cryptography:
+# - SM2: Elliptic curve cryptography (signature, key exchange)
+# - SM3: Hash function (256-bit digest)
+# - SM4: Block cipher (128-bit)
+#
+# =============================================================================
+
+x-crypto-env: &crypto-env
+  STELLAOPS_CRYPTO_PROFILE: "china"
+  STELLAOPS_CRYPTO_CONFIG_PATH: "/app/etc/appsettings.crypto.yaml"
+  STELLAOPS_CRYPTO_MANIFEST_PATH: "/app/etc/crypto-plugins-manifest.json"
+
+x-crypto-volumes: &crypto-volumes
+  - ../../etc/appsettings.crypto.china.yaml:/app/etc/appsettings.crypto.yaml:ro
+  - ../../etc/crypto-plugins-manifest.json:/app/etc/crypto-plugins-manifest.json:ro
+
+services:
+  # ---------------------------------------------------------------------------
+  # Authority - China crypto overlay
+  # ---------------------------------------------------------------------------
+  authority:
+    image: registry.stella-ops.org/stellaops/authority:china
+    environment:
+      <<: *crypto-env
+    volumes:
+      - ../../etc/authority:/app/etc/authority:ro
+      - ../../etc/certificates/trust-roots:/etc/ssl/certs/stellaops:ro
+      - ../../etc/appsettings.crypto.china.yaml:/app/etc/appsettings.crypto.yaml:ro
+      - ../../etc/crypto-plugins-manifest.json:/app/etc/crypto-plugins-manifest.json:ro
+    labels:
+      com.stellaops.crypto.profile: "china"
+
+  # ---------------------------------------------------------------------------
+  # Signer - China crypto overlay
+  # ---------------------------------------------------------------------------
+  signer:
+    image: registry.stella-ops.org/stellaops/signer:china
+    environment:
+      <<: *crypto-env
+    volumes:
+      - ../../etc/appsettings.crypto.china.yaml:/app/etc/appsettings.crypto.yaml:ro
+      - ../../etc/crypto-plugins-manifest.json:/app/etc/crypto-plugins-manifest.json:ro
+    labels:
+      com.stellaops.crypto.profile: "china"
+
+  # ---------------------------------------------------------------------------
+  # Attestor - China crypto overlay
+  # ---------------------------------------------------------------------------
+  attestor:
+    image: registry.stella-ops.org/stellaops/attestor:china
+    environment:
+      <<: *crypto-env
+    volumes:
+      - ../../etc/appsettings.crypto.china.yaml:/app/etc/appsettings.crypto.yaml:ro
+      - ../../etc/crypto-plugins-manifest.json:/app/etc/crypto-plugins-manifest.json:ro
+    labels:
+      com.stellaops.crypto.profile: "china"
+
+  # ---------------------------------------------------------------------------
+  # Concelier - China crypto overlay
+  # ---------------------------------------------------------------------------
+  concelier:
+    image: registry.stella-ops.org/stellaops/concelier:china
+    environment:
+      <<: *crypto-env
+    volumes:
+      - concelier-jobs:/var/lib/concelier/jobs
+      - ../../etc/appsettings.crypto.china.yaml:/app/etc/appsettings.crypto.yaml:ro
+      - ../../etc/crypto-plugins-manifest.json:/app/etc/crypto-plugins-manifest.json:ro
+    labels:
+      com.stellaops.crypto.profile: "china"
+
+  # ---------------------------------------------------------------------------
+  # Scanner Web - China crypto overlay
+  # ---------------------------------------------------------------------------
+  scanner-web:
+    image: registry.stella-ops.org/stellaops/scanner-web:china
+    environment:
+      <<: *crypto-env
+    volumes:
+      - ../../etc/scanner:/app/etc/scanner:ro
+      - ../../etc/certificates/trust-roots:/etc/ssl/certs/stellaops:ro
+      - scanner-surface-cache:/var/lib/stellaops/surface
+      - ${SURFACE_SECRETS_HOST_PATH:-./offline/surface-secrets}:${SCANNER_SURFACE_SECRETS_ROOT:-/etc/stellaops/secrets}:ro
+      - ${SCANNER_OFFLINEKIT_TRUSTROOTS_HOST_PATH:-./offline/trust-roots}:${SCANNER_OFFLINEKIT_TRUSTROOTDIRECTORY:-/etc/stellaops/trust-roots}:ro
+      - ${SCANNER_OFFLINEKIT_REKOR_SNAPSHOT_HOST_PATH:-./offline/rekor-snapshot}:${SCANNER_OFFLINEKIT_REKORSNAPSHOTDIRECTORY:-/var/lib/stellaops/rekor-snapshot}:ro
+      - ../../etc/appsettings.crypto.china.yaml:/app/etc/appsettings.crypto.yaml:ro
+      - ../../etc/crypto-plugins-manifest.json:/app/etc/crypto-plugins-manifest.json:ro
+    labels:
+      com.stellaops.crypto.profile: "china"
+
+  # ---------------------------------------------------------------------------
+  # Scanner Worker - China crypto overlay
+  # ---------------------------------------------------------------------------
+  scanner-worker:
+    image: registry.stella-ops.org/stellaops/scanner-worker:china
+    environment:
+      <<: *crypto-env
+    volumes:
+      - scanner-surface-cache:/var/lib/stellaops/surface
+      - ${SURFACE_SECRETS_HOST_PATH:-./offline/surface-secrets}:${SCANNER_SURFACE_SECRETS_ROOT:-/etc/stellaops/secrets}:ro
+      - ../../etc/appsettings.crypto.china.yaml:/app/etc/appsettings.crypto.yaml:ro
+      - ../../etc/crypto-plugins-manifest.json:/app/etc/crypto-plugins-manifest.json:ro
+    labels:
+      com.stellaops.crypto.profile: "china"
+
+  # ---------------------------------------------------------------------------
+  # Scheduler Worker - China crypto overlay
+  # ---------------------------------------------------------------------------
+  scheduler-worker:
+    image: registry.stella-ops.org/stellaops/scheduler-worker:china
+    environment:
+      <<: *crypto-env
+    volumes:
+      - ../../etc/appsettings.crypto.china.yaml:/app/etc/appsettings.crypto.yaml:ro
+      - ../../etc/crypto-plugins-manifest.json:/app/etc/crypto-plugins-manifest.json:ro
+    labels:
+      com.stellaops.crypto.profile: "china"
+
+  # ---------------------------------------------------------------------------
+  # Notify Web - China crypto overlay
+  # ---------------------------------------------------------------------------
+  notify-web:
+    image: registry.stella-ops.org/stellaops/notify-web:china
+    environment:
+      <<: *crypto-env
+    volumes:
+      - ../../etc/notify:/app/etc/notify:ro
+      - ../../etc/appsettings.crypto.china.yaml:/app/etc/appsettings.crypto.yaml:ro
+      - ../../etc/crypto-plugins-manifest.json:/app/etc/crypto-plugins-manifest.json:ro
+    labels:
+      com.stellaops.crypto.profile: "china"
+
+  # ---------------------------------------------------------------------------
+  # Excititor - China crypto overlay
+  # ---------------------------------------------------------------------------
+  excititor:
+    image: registry.stella-ops.org/stellaops/excititor:china
+    environment:
+      <<: *crypto-env
+    volumes:
+      - ../../etc/appsettings.crypto.china.yaml:/app/etc/appsettings.crypto.yaml:ro
+      - ../../etc/crypto-plugins-manifest.json:/app/etc/crypto-plugins-manifest.json:ro
+    labels:
+      com.stellaops.crypto.profile: "china"
+
+  # ---------------------------------------------------------------------------
+  # Advisory AI Web - China crypto overlay
+  # ---------------------------------------------------------------------------
+  advisory-ai-web:
+    image: registry.stella-ops.org/stellaops/advisory-ai-web:china
+    environment:
+      <<: *crypto-env
+    volumes:
+      - ../../etc/llm-providers:/app/etc/llm-providers:ro
+      - advisory-ai-queue:/var/lib/advisory-ai/queue
+      - advisory-ai-plans:/var/lib/advisory-ai/plans
+      - advisory-ai-outputs:/var/lib/advisory-ai/outputs
+      - ../../etc/appsettings.crypto.china.yaml:/app/etc/appsettings.crypto.yaml:ro
+      - ../../etc/crypto-plugins-manifest.json:/app/etc/crypto-plugins-manifest.json:ro
+    labels:
+      com.stellaops.crypto.profile: "china"
+
+  # ---------------------------------------------------------------------------
+  # Advisory AI Worker - China crypto overlay
+  # ---------------------------------------------------------------------------
+  advisory-ai-worker:
+    image: registry.stella-ops.org/stellaops/advisory-ai-worker:china
+    environment:
+      <<: *crypto-env
+    volumes:
+      - ../../etc/llm-providers:/app/etc/llm-providers:ro
+      - advisory-ai-queue:/var/lib/advisory-ai/queue
+      - advisory-ai-plans:/var/lib/advisory-ai/plans
+      - advisory-ai-outputs:/var/lib/advisory-ai/outputs
+      - ../../etc/appsettings.crypto.china.yaml:/app/etc/appsettings.crypto.yaml:ro
+      - ../../etc/crypto-plugins-manifest.json:/app/etc/crypto-plugins-manifest.json:ro
+    labels:
+      com.stellaops.crypto.profile: "china"
+
+  # ---------------------------------------------------------------------------
+  # Web UI - China crypto overlay
+  # ---------------------------------------------------------------------------
+  web-ui:
+    image: registry.stella-ops.org/stellaops/web-ui:china
+    labels:
+      com.stellaops.crypto.profile: "china"

deploy/compose/docker-compose.compliance-eu.yml

@@ -0,0 +1,209 @@
+# =============================================================================
+# STELLA OPS - COMPLIANCE OVERLAY: EU
+# =============================================================================
+# eIDAS qualified trust services crypto overlay.
+# This file extends docker-compose.stella-ops.yml with EU-specific crypto.
+#
+# Usage:
+#   docker compose -f devops/compose/docker-compose.stella-ops.yml \
+#     -f devops/compose/docker-compose.compliance-eu.yml up -d
+#
+# Cryptography:
+# - eIDAS-compliant qualified electronic signatures
+# - ETSI TS 119 312 compliant algorithms
+# - Qualified Trust Service Provider (QTSP) integration
+#
+# =============================================================================
+
+x-crypto-env: &crypto-env
+  STELLAOPS_CRYPTO_PROFILE: "eu"
+  STELLAOPS_CRYPTO_CONFIG_PATH: "/app/etc/appsettings.crypto.yaml"
+  STELLAOPS_CRYPTO_MANIFEST_PATH: "/app/etc/crypto-plugins-manifest.json"
+
+x-crypto-volumes: &crypto-volumes
+  - ../../etc/appsettings.crypto.eu.yaml:/app/etc/appsettings.crypto.yaml:ro
+  - ../../etc/crypto-plugins-manifest.json:/app/etc/crypto-plugins-manifest.json:ro
+
+services:
+  # ---------------------------------------------------------------------------
+  # Authority - EU crypto overlay
+  # ---------------------------------------------------------------------------
+  authority:
+    image: registry.stella-ops.org/stellaops/authority:eu
+    environment:
+      <<: *crypto-env
+    volumes:
+      - ../../etc/authority:/app/etc/authority:ro
+      - ../../etc/certificates/trust-roots:/etc/ssl/certs/stellaops:ro
+      - ../../etc/appsettings.crypto.eu.yaml:/app/etc/appsettings.crypto.yaml:ro
+      - ../../etc/crypto-plugins-manifest.json:/app/etc/crypto-plugins-manifest.json:ro
+    labels:
+      com.stellaops.crypto.profile: "eu"
+      com.stellaops.compliance: "eidas"
+
+  # ---------------------------------------------------------------------------
+  # Signer - EU crypto overlay
+  # ---------------------------------------------------------------------------
+  signer:
+    image: registry.stella-ops.org/stellaops/signer:eu
+    environment:
+      <<: *crypto-env
+    volumes:
+      - ../../etc/appsettings.crypto.eu.yaml:/app/etc/appsettings.crypto.yaml:ro
+      - ../../etc/crypto-plugins-manifest.json:/app/etc/crypto-plugins-manifest.json:ro
+    labels:
+      com.stellaops.crypto.profile: "eu"
+      com.stellaops.compliance: "eidas"
+
+  # ---------------------------------------------------------------------------
+  # Attestor - EU crypto overlay
+  # ---------------------------------------------------------------------------
+  attestor:
+    image: registry.stella-ops.org/stellaops/attestor:eu
+    environment:
+      <<: *crypto-env
+    volumes:
+      - ../../etc/appsettings.crypto.eu.yaml:/app/etc/appsettings.crypto.yaml:ro
+      - ../../etc/crypto-plugins-manifest.json:/app/etc/crypto-plugins-manifest.json:ro
+    labels:
+      com.stellaops.crypto.profile: "eu"
+      com.stellaops.compliance: "eidas"
+
+  # ---------------------------------------------------------------------------
+  # Concelier - EU crypto overlay
+  # ---------------------------------------------------------------------------
+  concelier:
+    image: registry.stella-ops.org/stellaops/concelier:eu
+    environment:
+      <<: *crypto-env
+    volumes:
+      - concelier-jobs:/var/lib/concelier/jobs
+      - ../../etc/appsettings.crypto.eu.yaml:/app/etc/appsettings.crypto.yaml:ro
+      - ../../etc/crypto-plugins-manifest.json:/app/etc/crypto-plugins-manifest.json:ro
+    labels:
+      com.stellaops.crypto.profile: "eu"
+      com.stellaops.compliance: "eidas"
+
+  # ---------------------------------------------------------------------------
+  # Scanner Web - EU crypto overlay
+  # ---------------------------------------------------------------------------
+  scanner-web:
+    image: registry.stella-ops.org/stellaops/scanner-web:eu
+    environment:
+      <<: *crypto-env
+    volumes:
+      - ../../etc/scanner:/app/etc/scanner:ro
+      - ../../etc/certificates/trust-roots:/etc/ssl/certs/stellaops:ro
+      - scanner-surface-cache:/var/lib/stellaops/surface
+      - ${SURFACE_SECRETS_HOST_PATH:-./offline/surface-secrets}:${SCANNER_SURFACE_SECRETS_ROOT:-/etc/stellaops/secrets}:ro
+      - ${SCANNER_OFFLINEKIT_TRUSTROOTS_HOST_PATH:-./offline/trust-roots}:${SCANNER_OFFLINEKIT_TRUSTROOTDIRECTORY:-/etc/stellaops/trust-roots}:ro
+      - ${SCANNER_OFFLINEKIT_REKOR_SNAPSHOT_HOST_PATH:-./offline/rekor-snapshot}:${SCANNER_OFFLINEKIT_REKORSNAPSHOTDIRECTORY:-/var/lib/stellaops/rekor-snapshot}:ro
+      - ../../etc/appsettings.crypto.eu.yaml:/app/etc/appsettings.crypto.yaml:ro
+      - ../../etc/crypto-plugins-manifest.json:/app/etc/crypto-plugins-manifest.json:ro
+    labels:
+      com.stellaops.crypto.profile: "eu"
+      com.stellaops.compliance: "eidas"
+
+  # ---------------------------------------------------------------------------
+  # Scanner Worker - EU crypto overlay
+  # ---------------------------------------------------------------------------
+  scanner-worker:
+    image: registry.stella-ops.org/stellaops/scanner-worker:eu
+    environment:
+      <<: *crypto-env
+    volumes:
+      - scanner-surface-cache:/var/lib/stellaops/surface
+      - ${SURFACE_SECRETS_HOST_PATH:-./offline/surface-secrets}:${SCANNER_SURFACE_SECRETS_ROOT:-/etc/stellaops/secrets}:ro
+      - ../../etc/appsettings.crypto.eu.yaml:/app/etc/appsettings.crypto.yaml:ro
+      - ../../etc/crypto-plugins-manifest.json:/app/etc/crypto-plugins-manifest.json:ro
+    labels:
+      com.stellaops.crypto.profile: "eu"
+      com.stellaops.compliance: "eidas"
+
+  # ---------------------------------------------------------------------------
+  # Scheduler Worker - EU crypto overlay
+  # ---------------------------------------------------------------------------
+  scheduler-worker:
+    image: registry.stella-ops.org/stellaops/scheduler-worker:eu
+    environment:
+      <<: *crypto-env
+    volumes:
+      - ../../etc/appsettings.crypto.eu.yaml:/app/etc/appsettings.crypto.yaml:ro
+      - ../../etc/crypto-plugins-manifest.json:/app/etc/crypto-plugins-manifest.json:ro
+    labels:
+      com.stellaops.crypto.profile: "eu"
+      com.stellaops.compliance: "eidas"
+
+  # ---------------------------------------------------------------------------
+  # Notify Web - EU crypto overlay
+  # ---------------------------------------------------------------------------
+  notify-web:
+    image: registry.stella-ops.org/stellaops/notify-web:eu
+    environment:
+      <<: *crypto-env
+    volumes:
+      - ../../etc/notify:/app/etc/notify:ro
+      - ../../etc/appsettings.crypto.eu.yaml:/app/etc/appsettings.crypto.yaml:ro
+      - ../../etc/crypto-plugins-manifest.json:/app/etc/crypto-plugins-manifest.json:ro
+    labels:
+      com.stellaops.crypto.profile: "eu"
+      com.stellaops.compliance: "eidas"
+
+  # ---------------------------------------------------------------------------
+  # Excititor - EU crypto overlay
+  # ---------------------------------------------------------------------------
+  excititor:
+    image: registry.stella-ops.org/stellaops/excititor:eu
+    environment:
+      <<: *crypto-env
+    volumes:
+      - ../../etc/appsettings.crypto.eu.yaml:/app/etc/appsettings.crypto.yaml:ro
+      - ../../etc/crypto-plugins-manifest.json:/app/etc/crypto-plugins-manifest.json:ro
+    labels:
+      com.stellaops.crypto.profile: "eu"
+      com.stellaops.compliance: "eidas"
+
+  # ---------------------------------------------------------------------------
+  # Advisory AI Web - EU crypto overlay
+  # ---------------------------------------------------------------------------
+  advisory-ai-web:
+    image: registry.stella-ops.org/stellaops/advisory-ai-web:eu
+    environment:
+      <<: *crypto-env
+    volumes:
+      - ../../etc/llm-providers:/app/etc/llm-providers:ro
+      - advisory-ai-queue:/var/lib/advisory-ai/queue
+      - advisory-ai-plans:/var/lib/advisory-ai/plans
+      - advisory-ai-outputs:/var/lib/advisory-ai/outputs
+      - ../../etc/appsettings.crypto.eu.yaml:/app/etc/appsettings.crypto.yaml:ro
+      - ../../etc/crypto-plugins-manifest.json:/app/etc/crypto-plugins-manifest.json:ro
+    labels:
+      com.stellaops.crypto.profile: "eu"
+      com.stellaops.compliance: "eidas"
+
+  # ---------------------------------------------------------------------------
+  # Advisory AI Worker - EU crypto overlay
+  # ---------------------------------------------------------------------------
+  advisory-ai-worker:
+    image: registry.stella-ops.org/stellaops/advisory-ai-worker:eu
+    environment:
+      <<: *crypto-env
+    volumes:
+      - ../../etc/llm-providers:/app/etc/llm-providers:ro
+      - advisory-ai-queue:/var/lib/advisory-ai/queue
+      - advisory-ai-plans:/var/lib/advisory-ai/plans
+      - advisory-ai-outputs:/var/lib/advisory-ai/outputs
+      - ../../etc/appsettings.crypto.eu.yaml:/app/etc/appsettings.crypto.yaml:ro
+      - ../../etc/crypto-plugins-manifest.json:/app/etc/crypto-plugins-manifest.json:ro
+    labels:
+      com.stellaops.crypto.profile: "eu"
+      com.stellaops.compliance: "eidas"
+
+  # ---------------------------------------------------------------------------
+  # Web UI - EU crypto overlay
+  # ---------------------------------------------------------------------------
+  web-ui:
+    image: registry.stella-ops.org/stellaops/web-ui:eu
+    labels:
+      com.stellaops.crypto.profile: "eu"
+      com.stellaops.compliance: "eidas"

deploy/compose/docker-compose.compliance-russia.yml

@@ -0,0 +1,216 @@
+# =============================================================================
+# STELLA OPS - COMPLIANCE OVERLAY: RUSSIA
+# =============================================================================
+# GOST R 34.10-2012, GOST R 34.11-2012 (Streebog) crypto overlay.
+# This file extends docker-compose.stella-ops.yml with Russia-specific crypto.
+#
+# Usage:
+#   docker compose -f devops/compose/docker-compose.stella-ops.yml \
+#     -f devops/compose/docker-compose.compliance-russia.yml up -d
+#
+# With CryptoPro CSP:
+#   docker compose -f devops/compose/docker-compose.stella-ops.yml \
+#     -f devops/compose/docker-compose.compliance-russia.yml \
+#     -f devops/compose/docker-compose.cryptopro.yml up -d
+#
+# Cryptography:
+# - GOST R 34.10-2012: Digital signature
+# - GOST R 34.11-2012: Hash function (Streebog, 256/512-bit)
+# - GOST R 34.12-2015: Block cipher (Kuznyechik)
+#
+# Providers: openssl.gost, pkcs11.gost, cryptopro.gost
+#
+# =============================================================================
+
+x-crypto-env: &crypto-env
+  STELLAOPS_CRYPTO_PROFILE: "russia"
+  STELLAOPS_CRYPTO_CONFIG_PATH: "/app/etc/appsettings.crypto.yaml"
+  STELLAOPS_CRYPTO_MANIFEST_PATH: "/app/etc/crypto-plugins-manifest.json"
+  STELLAOPS_CRYPTO_PROVIDERS: "openssl.gost,pkcs11.gost,cryptopro.gost"
+
+x-crypto-volumes: &crypto-volumes
+  - ../../etc/appsettings.crypto.russia.yaml:/app/etc/appsettings.crypto.yaml:ro
+  - ../../etc/crypto-plugins-manifest.json:/app/etc/crypto-plugins-manifest.json:ro
+
+services:
+  # ---------------------------------------------------------------------------
+  # Authority - Russia crypto overlay
+  # ---------------------------------------------------------------------------
+  authority:
+    image: registry.stella-ops.org/stellaops/authority:russia
+    environment:
+      <<: *crypto-env
+    volumes:
+      - ../../etc/authority:/app/etc/authority:ro
+      - ../../etc/certificates/trust-roots:/etc/ssl/certs/stellaops:ro
+      - ../../etc/appsettings.crypto.russia.yaml:/app/etc/appsettings.crypto.yaml:ro
+      - ../../etc/crypto-plugins-manifest.json:/app/etc/crypto-plugins-manifest.json:ro
+    labels:
+      com.stellaops.crypto.profile: "russia"
+      com.stellaops.crypto.provider: "openssl.gost,pkcs11.gost,cryptopro.gost"
+
+  # ---------------------------------------------------------------------------
+  # Signer - Russia crypto overlay
+  # ---------------------------------------------------------------------------
+  signer:
+    image: registry.stella-ops.org/stellaops/signer:russia
+    environment:
+      <<: *crypto-env
+    volumes:
+      - ../../etc/appsettings.crypto.russia.yaml:/app/etc/appsettings.crypto.yaml:ro
+      - ../../etc/crypto-plugins-manifest.json:/app/etc/crypto-plugins-manifest.json:ro
+    labels:
+      com.stellaops.crypto.profile: "russia"
+      com.stellaops.crypto.provider: "openssl.gost,pkcs11.gost,cryptopro.gost"
+
+  # ---------------------------------------------------------------------------
+  # Attestor - Russia crypto overlay
+  # ---------------------------------------------------------------------------
+  attestor:
+    image: registry.stella-ops.org/stellaops/attestor:russia
+    environment:
+      <<: *crypto-env
+    volumes:
+      - ../../etc/appsettings.crypto.russia.yaml:/app/etc/appsettings.crypto.yaml:ro
+      - ../../etc/crypto-plugins-manifest.json:/app/etc/crypto-plugins-manifest.json:ro
+    labels:
+      com.stellaops.crypto.profile: "russia"
+      com.stellaops.crypto.provider: "openssl.gost,pkcs11.gost,cryptopro.gost"
+
+  # ---------------------------------------------------------------------------
+  # Concelier - Russia crypto overlay
+  # ---------------------------------------------------------------------------
+  concelier:
+    image: registry.stella-ops.org/stellaops/concelier:russia
+    environment:
+      <<: *crypto-env
+    volumes:
+      - concelier-jobs:/var/lib/concelier/jobs
+      - ../../etc/appsettings.crypto.russia.yaml:/app/etc/appsettings.crypto.yaml:ro
+      - ../../etc/crypto-plugins-manifest.json:/app/etc/crypto-plugins-manifest.json:ro
+    labels:
+      com.stellaops.crypto.profile: "russia"
+      com.stellaops.crypto.provider: "openssl.gost,pkcs11.gost,cryptopro.gost"
+
+  # ---------------------------------------------------------------------------
+  # Scanner Web - Russia crypto overlay
+  # ---------------------------------------------------------------------------
+  scanner-web:
+    image: registry.stella-ops.org/stellaops/scanner-web:russia
+    environment:
+      <<: *crypto-env
+    volumes:
+      - ../../etc/scanner:/app/etc/scanner:ro
+      - ../../etc/certificates/trust-roots:/etc/ssl/certs/stellaops:ro
+      - scanner-surface-cache:/var/lib/stellaops/surface
+      - ${SURFACE_SECRETS_HOST_PATH:-./offline/surface-secrets}:${SCANNER_SURFACE_SECRETS_ROOT:-/etc/stellaops/secrets}:ro
+      - ${SCANNER_OFFLINEKIT_TRUSTROOTS_HOST_PATH:-./offline/trust-roots}:${SCANNER_OFFLINEKIT_TRUSTROOTDIRECTORY:-/etc/stellaops/trust-roots}:ro
+      - ${SCANNER_OFFLINEKIT_REKOR_SNAPSHOT_HOST_PATH:-./offline/rekor-snapshot}:${SCANNER_OFFLINEKIT_REKORSNAPSHOTDIRECTORY:-/var/lib/stellaops/rekor-snapshot}:ro
+      - ../../etc/appsettings.crypto.russia.yaml:/app/etc/appsettings.crypto.yaml:ro
+      - ../../etc/crypto-plugins-manifest.json:/app/etc/crypto-plugins-manifest.json:ro
+    labels:
+      com.stellaops.crypto.profile: "russia"
+      com.stellaops.crypto.provider: "openssl.gost,pkcs11.gost,cryptopro.gost"
+
+  # ---------------------------------------------------------------------------
+  # Scanner Worker - Russia crypto overlay
+  # ---------------------------------------------------------------------------
+  scanner-worker:
+    image: registry.stella-ops.org/stellaops/scanner-worker:russia
+    environment:
+      <<: *crypto-env
+    volumes:
+      - scanner-surface-cache:/var/lib/stellaops/surface
+      - ${SURFACE_SECRETS_HOST_PATH:-./offline/surface-secrets}:${SCANNER_SURFACE_SECRETS_ROOT:-/etc/stellaops/secrets}:ro
+      - ../../etc/appsettings.crypto.russia.yaml:/app/etc/appsettings.crypto.yaml:ro
+      - ../../etc/crypto-plugins-manifest.json:/app/etc/crypto-plugins-manifest.json:ro
+    labels:
+      com.stellaops.crypto.profile: "russia"
+      com.stellaops.crypto.provider: "openssl.gost,pkcs11.gost,cryptopro.gost"
+
+  # ---------------------------------------------------------------------------
+  # Scheduler Worker - Russia crypto overlay
+  # ---------------------------------------------------------------------------
+  scheduler-worker:
+    image: registry.stella-ops.org/stellaops/scheduler-worker:russia
+    environment:
+      <<: *crypto-env
+    volumes:
+      - ../../etc/appsettings.crypto.russia.yaml:/app/etc/appsettings.crypto.yaml:ro
+      - ../../etc/crypto-plugins-manifest.json:/app/etc/crypto-plugins-manifest.json:ro
+    labels:
+      com.stellaops.crypto.profile: "russia"
+      com.stellaops.crypto.provider: "openssl.gost,pkcs11.gost,cryptopro.gost"
+
+  # ---------------------------------------------------------------------------
+  # Notify Web - Russia crypto overlay
+  # ---------------------------------------------------------------------------
+  notify-web:
+    image: registry.stella-ops.org/stellaops/notify-web:russia
+    environment:
+      <<: *crypto-env
+    volumes:
+      - ../../etc/notify:/app/etc/notify:ro
+      - ../../etc/appsettings.crypto.russia.yaml:/app/etc/appsettings.crypto.yaml:ro
+      - ../../etc/crypto-plugins-manifest.json:/app/etc/crypto-plugins-manifest.json:ro
+    labels:
+      com.stellaops.crypto.profile: "russia"
+      com.stellaops.crypto.provider: "openssl.gost,pkcs11.gost,cryptopro.gost"
+
+  # ---------------------------------------------------------------------------
+  # Excititor - Russia crypto overlay
+  # ---------------------------------------------------------------------------
+  excititor:
+    image: registry.stella-ops.org/stellaops/excititor:russia
+    environment:
+      <<: *crypto-env
+    volumes:
+      - ../../etc/appsettings.crypto.russia.yaml:/app/etc/appsettings.crypto.yaml:ro
+      - ../../etc/crypto-plugins-manifest.json:/app/etc/crypto-plugins-manifest.json:ro
+    labels:
+      com.stellaops.crypto.profile: "russia"
+      com.stellaops.crypto.provider: "openssl.gost,pkcs11.gost,cryptopro.gost"
+
+  # ---------------------------------------------------------------------------
+  # Advisory AI Web - Russia crypto overlay
+  # ---------------------------------------------------------------------------
+  advisory-ai-web:
+    image: registry.stella-ops.org/stellaops/advisory-ai-web:russia
+    environment:
+      <<: *crypto-env
+    volumes:
+      - ../../etc/llm-providers:/app/etc/llm-providers:ro
+      - advisory-ai-queue:/var/lib/advisory-ai/queue
+      - advisory-ai-plans:/var/lib/advisory-ai/plans
+      - advisory-ai-outputs:/var/lib/advisory-ai/outputs
+      - ../../etc/appsettings.crypto.russia.yaml:/app/etc/appsettings.crypto.yaml:ro
+      - ../../etc/crypto-plugins-manifest.json:/app/etc/crypto-plugins-manifest.json:ro
+    labels:
+      com.stellaops.crypto.profile: "russia"
+      com.stellaops.crypto.provider: "openssl.gost,pkcs11.gost,cryptopro.gost"
+
+  # ---------------------------------------------------------------------------
+  # Advisory AI Worker - Russia crypto overlay
+  # ---------------------------------------------------------------------------
+  advisory-ai-worker:
+    image: registry.stella-ops.org/stellaops/advisory-ai-worker:russia
+    environment:
+      <<: *crypto-env
+    volumes:
+      - ../../etc/llm-providers:/app/etc/llm-providers:ro
+      - advisory-ai-queue:/var/lib/advisory-ai/queue
+      - advisory-ai-plans:/var/lib/advisory-ai/plans
+      - advisory-ai-outputs:/var/lib/advisory-ai/outputs
+      - ../../etc/appsettings.crypto.russia.yaml:/app/etc/appsettings.crypto.yaml:ro
+      - ../../etc/crypto-plugins-manifest.json:/app/etc/crypto-plugins-manifest.json:ro
+    labels:
+      com.stellaops.crypto.profile: "russia"
+      com.stellaops.crypto.provider: "openssl.gost,pkcs11.gost,cryptopro.gost"
+
+  # ---------------------------------------------------------------------------
+  # Web UI - Russia crypto overlay
+  # ---------------------------------------------------------------------------
+  web-ui:
+    image: registry.stella-ops.org/stellaops/web-ui:russia
+    labels:
+      com.stellaops.crypto.profile: "russia"

deploy/compose/docker-compose.corpus.yml

@@ -0,0 +1,42 @@
+# =============================================================================
+# CORPUS - FUNCTION BEHAVIOR DATABASE
+# =============================================================================
+# PostgreSQL database for function behavior corpus analysis.
+#
+# Usage:
+#   docker compose -f docker-compose.corpus.yml up -d
+#
+# Environment:
+#   CORPUS_DB_PASSWORD - PostgreSQL password for corpus database
+# =============================================================================
+
+services:
+  corpus-postgres:
+    image: postgres:18.1-alpine
+    container_name: stellaops-corpus-db
+    environment:
+      POSTGRES_DB: stellaops_corpus
+      POSTGRES_USER: corpus_user
+      POSTGRES_PASSWORD: ${CORPUS_DB_PASSWORD:-stellaops_corpus_dev}
+      POSTGRES_INITDB_ARGS: "-E UTF8 --locale=C"
+    volumes:
+      - corpus-data:/var/lib/postgresql/data
+      - ../../docs/db/schemas/corpus.sql:/docker-entrypoint-initdb.d/10-corpus-schema.sql:ro
+      - ../docker/corpus/scripts/init-test-data.sql:/docker-entrypoint-initdb.d/20-test-data.sql:ro
+    ports:
+      - "${CORPUS_DB_PORT:-5435}:5432"
+    networks:
+      - stellaops-corpus
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U corpus_user -d stellaops_corpus"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+    restart: unless-stopped
+
+volumes:
+  corpus-data:
+
+networks:
+  stellaops-corpus:
+    driver: bridge

deploy/compose/docker-compose.crypto-sim.yml

@@ -0,0 +1,119 @@
+# =============================================================================
+# STELLA OPS - CRYPTO SIMULATION OVERLAY
+# =============================================================================
+# Universal crypto simulation service for testing sovereign crypto without
+# licensed hardware or certified modules.
+#
+# This overlay provides the sim-crypto-service which simulates:
+# - GOST R 34.10-2012 (Russia): GOST12-256, GOST12-512, ru.magma.sim, ru.kuznyechik.sim
+# - SM2/SM3/SM4 (China): SM2, sm.sim, sm2.sim
+# - Post-Quantum: DILITHIUM3, FALCON512, pq.sim
+# - FIPS/eIDAS/KCMVP: fips.sim, eidas.sim, kcmvp.sim, world.sim
+#
+# Usage with China compliance:
+#   docker compose -f docker-compose.stella-ops.yml \
+#     -f docker-compose.compliance-china.yml \
+#     -f docker-compose.crypto-sim.yml up -d
+#
+# Usage with Russia compliance:
+#   docker compose -f docker-compose.stella-ops.yml \
+#     -f docker-compose.compliance-russia.yml \
+#     -f docker-compose.crypto-sim.yml up -d
+#
+# Usage with EU compliance:
+#   docker compose -f docker-compose.stella-ops.yml \
+#     -f docker-compose.compliance-eu.yml \
+#     -f docker-compose.crypto-sim.yml up -d
+#
+# IMPORTANT: This is for TESTING/DEVELOPMENT ONLY.
+# - Uses deterministic HMAC-SHA256 for SM/GOST/PQ (not real algorithms)
+# - Uses static ECDSA P-256 key for FIPS/eIDAS/KCMVP
+# - NOT suitable for production or compliance certification
+#
+# =============================================================================
+
+x-crypto-sim-labels: &crypto-sim-labels
+  com.stellaops.component: "crypto-sim"
+  com.stellaops.profile: "simulation"
+  com.stellaops.production: "false"
+
+x-sim-crypto-env: &sim-crypto-env
+  STELLAOPS_CRYPTO_ENABLE_SIM: "1"
+  STELLAOPS_CRYPTO_SIM_URL: "http://sim-crypto:8080"
+
+networks:
+  stellaops:
+    external: true
+    name: stellaops
+
+services:
+  # ---------------------------------------------------------------------------
+  # Sim Crypto Service - Universal sovereign crypto simulator
+  # ---------------------------------------------------------------------------
+  sim-crypto:
+    build:
+      context: ../services/crypto/sim-crypto-service
+      dockerfile: Dockerfile
+    image: registry.stella-ops.org/stellaops/sim-crypto:dev
+    container_name: stellaops-sim-crypto
+    restart: unless-stopped
+    environment:
+      ASPNETCORE_URLS: "http://0.0.0.0:8080"
+      ASPNETCORE_ENVIRONMENT: "Development"
+    ports:
+      - "${SIM_CRYPTO_PORT:-18090}:8080"
+    networks:
+      - stellaops
+    healthcheck:
+      test: ["CMD", "curl", "-f", "http://localhost:8080/keys"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 10s
+    labels: *crypto-sim-labels
+
+  # ---------------------------------------------------------------------------
+  # Override services to use sim-crypto
+  # ---------------------------------------------------------------------------
+
+  # Authority - Enable sim crypto
+  authority:
+    environment:
+      <<: *sim-crypto-env
+    labels:
+      com.stellaops.crypto.simulator: "enabled"
+
+  # Signer - Enable sim crypto
+  signer:
+    environment:
+      <<: *sim-crypto-env
+    labels:
+      com.stellaops.crypto.simulator: "enabled"
+
+  # Attestor - Enable sim crypto
+  attestor:
+    environment:
+      <<: *sim-crypto-env
+    labels:
+      com.stellaops.crypto.simulator: "enabled"
+
+  # Scanner Web - Enable sim crypto
+  scanner-web:
+    environment:
+      <<: *sim-crypto-env
+    labels:
+      com.stellaops.crypto.simulator: "enabled"
+
+  # Scanner Worker - Enable sim crypto
+  scanner-worker:
+    environment:
+      <<: *sim-crypto-env
+    labels:
+      com.stellaops.crypto.simulator: "enabled"
+
+  # Excititor - Enable sim crypto
+  excititor:
+    environment:
+      <<: *sim-crypto-env
+    labels:
+      com.stellaops.crypto.simulator: "enabled"

deploy/compose/docker-compose.cryptopro.yml

@@ -0,0 +1,149 @@
+# =============================================================================
+# STELLA OPS - CRYPTOPRO CSP OVERLAY (Russia)
+# =============================================================================
+# CryptoPro CSP licensed provider overlay for compliance-russia.yml.
+# Adds real CryptoPro CSP service for certified GOST R 34.10-2012 operations.
+#
+# IMPORTANT: Requires EULA acceptance before use.
+#
+# Usage (MUST be combined with stella-ops AND compliance-russia):
+#   CRYPTOPRO_ACCEPT_EULA=1 docker compose \
+#     -f docker-compose.stella-ops.yml \
+#     -f docker-compose.compliance-russia.yml \
+#     -f docker-compose.cryptopro.yml up -d
+#
+# For development/testing without CryptoPro license, use crypto-sim.yml instead:
+#   docker compose \
+#     -f docker-compose.stella-ops.yml \
+#     -f docker-compose.compliance-russia.yml \
+#     -f docker-compose.crypto-sim.yml up -d
+#
+# Requirements:
+# - CryptoPro CSP license files in opt/cryptopro/downloads/
+# - CRYPTOPRO_ACCEPT_EULA=1 environment variable
+# - CryptoPro container images with GOST engine
+#
+# GOST Algorithms Provided:
+# - GOST R 34.10-2012: Digital signature (256/512-bit)
+# - GOST R 34.11-2012: Hash function (Streebog, 256/512-bit)
+# - GOST R 34.12-2015: Block cipher (Kuznyechik, Magma)
+#
+# =============================================================================
+
+x-cryptopro-labels: &cryptopro-labels
+  com.stellaops.component: "cryptopro-csp"
+  com.stellaops.crypto.provider: "cryptopro"
+  com.stellaops.crypto.profile: "russia"
+  com.stellaops.crypto.certified: "true"
+
+x-cryptopro-env: &cryptopro-env
+  STELLAOPS_CRYPTO_PROVIDERS: "cryptopro.gost"
+  STELLAOPS_CRYPTO_CRYPTOPRO_URL: "http://cryptopro-csp:8080"
+  STELLAOPS_CRYPTO_CRYPTOPRO_ENABLED: "true"
+
+networks:
+  stellaops:
+    external: true
+    name: stellaops
+
+services:
+  # ---------------------------------------------------------------------------
+  # CryptoPro CSP - Certified GOST cryptography provider
+  # ---------------------------------------------------------------------------
+  cryptopro-csp:
+    build:
+      context: ../..
+      dockerfile: devops/services/cryptopro/linux-csp-service/Dockerfile
+      args:
+        CRYPTOPRO_ACCEPT_EULA: "${CRYPTOPRO_ACCEPT_EULA:-0}"
+    image: registry.stella-ops.org/stellaops/cryptopro-csp:2025.10.0
+    container_name: stellaops-cryptopro-csp
+    restart: unless-stopped
+    environment:
+      ASPNETCORE_URLS: "http://0.0.0.0:8080"
+      CRYPTOPRO_ACCEPT_EULA: "${CRYPTOPRO_ACCEPT_EULA:-0}"
+      # GOST algorithm configuration
+      CRYPTOPRO_GOST_SIGNATURE_ALGORITHM: "GOST R 34.10-2012"
+      CRYPTOPRO_GOST_HASH_ALGORITHM: "GOST R 34.11-2012"
+      # Container and key store settings
+      CRYPTOPRO_CONTAINER_NAME: "${CRYPTOPRO_CONTAINER_NAME:-stellaops-signing}"
+      CRYPTOPRO_USE_MACHINE_STORE: "${CRYPTOPRO_USE_MACHINE_STORE:-true}"
+      CRYPTOPRO_PROVIDER_TYPE: "${CRYPTOPRO_PROVIDER_TYPE:-80}"
+    volumes:
+      - ../../opt/cryptopro/downloads:/opt/cryptopro/downloads:ro
+      - ../../etc/cryptopro:/app/etc/cryptopro:ro
+      # Optional: Mount key containers
+      - cryptopro-keys:/var/opt/cprocsp/keys
+    ports:
+      - "${CRYPTOPRO_PORT:-18080}:8080"
+    networks:
+      - stellaops
+    healthcheck:
+      test: ["CMD", "curl", "-f", "http://localhost:8080/health"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 30s
+    labels: *cryptopro-labels
+
+  # ---------------------------------------------------------------------------
+  # Override services to use CryptoPro
+  # ---------------------------------------------------------------------------
+
+  # Authority - Use CryptoPro for GOST signatures
+  authority:
+    environment:
+      <<: *cryptopro-env
+    depends_on:
+      - cryptopro-csp
+    labels:
+      com.stellaops.crypto.provider: "cryptopro"
+
+  # Signer - Use CryptoPro for GOST signatures
+  signer:
+    environment:
+      <<: *cryptopro-env
+    depends_on:
+      - cryptopro-csp
+    labels:
+      com.stellaops.crypto.provider: "cryptopro"
+
+  # Attestor - Use CryptoPro for GOST signatures
+  attestor:
+    environment:
+      <<: *cryptopro-env
+    depends_on:
+      - cryptopro-csp
+    labels:
+      com.stellaops.crypto.provider: "cryptopro"
+
+  # Scanner Web - Use CryptoPro for verification
+  scanner-web:
+    environment:
+      <<: *cryptopro-env
+    depends_on:
+      - cryptopro-csp
+    labels:
+      com.stellaops.crypto.provider: "cryptopro"
+
+  # Scanner Worker - Use CryptoPro for verification
+  scanner-worker:
+    environment:
+      <<: *cryptopro-env
+    depends_on:
+      - cryptopro-csp
+    labels:
+      com.stellaops.crypto.provider: "cryptopro"
+
+  # Excititor - Use CryptoPro for VEX signing
+  excititor:
+    environment:
+      <<: *cryptopro-env
+    depends_on:
+      - cryptopro-csp
+    labels:
+      com.stellaops.crypto.provider: "cryptopro"
+
+volumes:
+  cryptopro-keys:
+    name: stellaops-cryptopro-keys

deploy/compose/docker-compose.dev.yml

@@ -0,0 +1,73 @@
+# =============================================================================
+# DEVELOPMENT STACK - MINIMAL LOCAL DEVELOPMENT
+# =============================================================================
+# Minimal infrastructure for local development. Use this when you only need
+# the core infrastructure without all application services.
+#
+# For full platform, use docker-compose.stella-ops.yml instead.
+#
+# Usage:
+#   docker compose -f docker-compose.dev.yml up -d
+#
+# This provides:
+#   - PostgreSQL 18.1 on port 5432
+#   - Valkey 9.0.1 on port 6379
+#   - RustFS on port 8080
+# =============================================================================
+
+services:
+  postgres:
+    image: postgres:18.1-alpine
+    container_name: stellaops-dev-postgres
+    restart: unless-stopped
+    environment:
+      POSTGRES_USER: ${POSTGRES_USER:-stellaops}
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-stellaops}
+      POSTGRES_DB: ${POSTGRES_DB:-stellaops_dev}
+    volumes:
+      - postgres-data:/var/lib/postgresql/data
+    ports:
+      - "${POSTGRES_PORT:-5432}:5432"
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-stellaops}"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+
+  valkey:
+    image: valkey/valkey:9.0.1-alpine
+    container_name: stellaops-dev-valkey
+    restart: unless-stopped
+    command: ["valkey-server", "--appendonly", "yes"]
+    volumes:
+      - valkey-data:/data
+    ports:
+      - "${VALKEY_PORT:-6379}:6379"
+    healthcheck:
+      test: ["CMD", "valkey-cli", "ping"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+
+  rustfs:
+    image: registry.stella-ops.org/stellaops/rustfs:2025.09.2
+    container_name: stellaops-dev-rustfs
+    restart: unless-stopped
+    command: ["serve", "--listen", "0.0.0.0:8080", "--root", "/data"]
+    environment:
+      RUSTFS__LOG__LEVEL: info
+      RUSTFS__STORAGE__PATH: /data
+    volumes:
+      - rustfs-data:/data
+    ports:
+      - "${RUSTFS_PORT:-8080}:8080"
+    healthcheck:
+      test: ["CMD", "curl", "-f", "http://localhost:8080/health"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+
+volumes:
+  postgres-data:
+  valkey-data:
+  rustfs-data:

deploy/compose/docker-compose.gpu.yaml

@@ -0,0 +1,40 @@
+# =============================================================================
+# STELLA OPS GPU OVERLAY
+# =============================================================================
+# Enables NVIDIA GPU acceleration for Advisory AI inference services.
+#
+# Prerequisites:
+#   - NVIDIA GPU with CUDA support
+#   - nvidia-container-toolkit installed
+#   - Docker configured with nvidia runtime
+#
+# Usage:
+#   docker compose -f docker-compose.stella-ops.yml \
+#     -f docker-compose.gpu.yaml up -d
+#
+# =============================================================================
+
+services:
+  advisory-ai-worker:
+    deploy:
+      resources:
+        reservations:
+          devices:
+            - capabilities: [gpu]
+              driver: nvidia
+              count: 1
+    environment:
+      ADVISORY_AI_INFERENCE_GPU: "true"
+    runtime: nvidia
+
+  advisory-ai-web:
+    deploy:
+      resources:
+        reservations:
+          devices:
+            - capabilities: [gpu]
+              driver: nvidia
+              count: 1
+    environment:
+      ADVISORY_AI_INFERENCE_GPU: "true"
+    runtime: nvidia

deploy/compose/docker-compose.sealed-ci.yml

@@ -0,0 +1,121 @@
+# =============================================================================
+# SEALED CI - AIR-GAPPED TESTING ENVIRONMENT
+# =============================================================================
+# Sealed/air-gapped CI environment for testing offline functionality.
+# All services run in isolated network with no external egress.
+#
+# Usage:
+#   docker compose -f docker-compose.sealed-ci.yml up -d
+# =============================================================================
+
+x-release-labels: &release-labels
+  com.stellaops.profile: 'sealed-ci'
+  com.stellaops.airgap.mode: 'sealed'
+
+networks:
+  sealed-ci:
+    driver: bridge
+
+volumes:
+  sealed-postgres-data:
+  sealed-valkey-data:
+
+services:
+  postgres:
+    image: docker.io/library/postgres@sha256:8e97b8526ed19304b144f7478bc9201646acf0723cdc6e4b19bc9eb34879a27e
+    restart: unless-stopped
+    environment:
+      POSTGRES_USER: sealedci
+      POSTGRES_PASSWORD: sealedci-secret
+      POSTGRES_DB: stellaops
+    volumes:
+      - sealed-postgres-data:/var/lib/postgresql/data
+    networks:
+      - sealed-ci
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U sealedci -d stellaops"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+    labels: *release-labels
+
+  valkey:
+    image: docker.io/valkey/valkey:9.0.1-alpine
+    restart: unless-stopped
+    command: ["valkey-server", "--appendonly", "yes"]
+    volumes:
+      - sealed-valkey-data:/data
+    networks:
+      - sealed-ci
+    healthcheck:
+      test: ["CMD", "valkey-cli", "ping"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+    labels: *release-labels
+
+  authority:
+    image: registry.stella-ops.org/stellaops/authority@sha256:a8e8faec44a579aa5714e58be835f25575710430b1ad2ccd1282a018cd9ffcdd
+    depends_on:
+      postgres:
+        condition: service_healthy
+      valkey:
+        condition: service_healthy
+    restart: unless-stopped
+    environment:
+      ASPNETCORE_URLS: http://+:5088
+      STELLAOPS_AUTHORITY__ISSUER: http://authority.sealed-ci.local
+      STELLAOPS_AUTHORITY__STORAGE__DRIVER: postgres
+      STELLAOPS_AUTHORITY__STORAGE__POSTGRES__CONNECTIONSTRING: "Host=postgres;Port=5432;Database=authority;Username=sealedci;Password=sealedci-secret"
+      STELLAOPS_AUTHORITY__CACHE__REDIS__CONNECTIONSTRING: "valkey:6379"
+      STELLAOPS_AUTHORITY__PLUGINDIRECTORIES__0: /app/plugins
+      STELLAOPS_AUTHORITY__PLUGINS__CONFIGURATIONDIRECTORY: /app/plugins
+      STELLAOPS_AUTHORITY__SECURITY__SENDERCONSTRAINTS__DPOP__ENABLED: 'true'
+      STELLAOPS_AUTHORITY__SECURITY__SENDERCONSTRAINTS__MTLS__ENABLED: 'true'
+      STELLAOPS_AUTHORITY__AIRGAP__EGRESS__MODE: Sealed
+    volumes:
+      - ../services/sealed-mode-ci/authority.harness.yaml:/etc/authority.yaml:ro
+      - ../services/sealed-mode-ci/plugins:/app/plugins:ro
+      - ../../certificates:/certificates:ro
+    ports:
+      - '5088:5088'
+    networks:
+      - sealed-ci
+    labels: *release-labels
+
+  signer:
+    image: registry.stella-ops.org/stellaops/signer@sha256:8bfef9a75783883d49fc18e3566553934e970b00ee090abee9cb110d2d5c3298
+    depends_on:
+      - authority
+    restart: unless-stopped
+    environment:
+      ASPNETCORE_URLS: http://+:6088
+      SIGNER__AUTHORITY__BASEURL: http://authority:5088
+      SIGNER__POE__INTROSPECTURL: http://authority:5088/device-code
+      SIGNER__STORAGE__DRIVER: postgres
+      SIGNER__STORAGE__POSTGRES__CONNECTIONSTRING: "Host=postgres;Port=5432;Database=signer;Username=sealedci;Password=sealedci-secret"
+      SIGNER__CACHE__REDIS__CONNECTIONSTRING: "valkey:6379"
+      SIGNER__SEALED__MODE: Enabled
+    ports:
+      - '6088:6088'
+    networks:
+      - sealed-ci
+    labels: *release-labels
+
+  attestor:
+    image: registry.stella-ops.org/stellaops/attestor@sha256:5cc417948c029da01dccf36e4645d961a3f6d8de7e62fe98d845f07cd2282114
+    depends_on:
+      - signer
+    restart: unless-stopped
+    environment:
+      ASPNETCORE_URLS: http://+:7088
+      ATTESTOR__SIGNER__BASEURL: http://signer:6088
+      ATTESTOR__STORAGE__DRIVER: postgres
+      ATTESTOR__STORAGE__POSTGRES__CONNECTIONSTRING: "Host=postgres;Port=5432;Database=attestor;Username=sealedci;Password=sealedci-secret"
+      ATTESTOR__CACHE__REDIS__CONNECTIONSTRING: "valkey:6379"
+      ATTESTOR__SEALED__MODE: Enabled
+    ports:
+      - '7088:7088'
+    networks:
+      - sealed-ci
+    labels: *release-labels

deploy/compose/docker-compose.sm-remote.yml

@@ -0,0 +1,153 @@
+# =============================================================================
+# STELLA OPS - SM REMOTE OVERLAY (China)
+# =============================================================================
+# SM Remote service overlay for compliance-china.yml.
+# Provides SM2/SM3/SM4 (ShangMi) cryptographic operations via software provider
+# or integration with OSCCA-certified hardware security modules.
+#
+# Usage (MUST be combined with stella-ops AND compliance-china):
+#   docker compose \
+#     -f docker-compose.stella-ops.yml \
+#     -f docker-compose.compliance-china.yml \
+#     -f docker-compose.sm-remote.yml up -d
+#
+# For development/testing without SM hardware, use crypto-sim.yml instead:
+#   docker compose \
+#     -f docker-compose.stella-ops.yml \
+#     -f docker-compose.compliance-china.yml \
+#     -f docker-compose.crypto-sim.yml up -d
+#
+# SM Algorithms Provided:
+# - SM2: Public key cryptography (ECDSA-like, 256-bit curve) - GM/T 0003-2012
+# - SM3: Cryptographic hash function (256-bit output) - GM/T 0004-2012
+# - SM4: Block cipher (128-bit key/block, AES-like) - GM/T 0002-2012
+# - SM9: Identity-based cryptography - GM/T 0044-2016
+#
+# Providers:
+# - cn.sm.soft: Software-only implementation using BouncyCastle
+# - cn.sm.remote.http: Remote HSM integration via HTTP API
+#
+# OSCCA Compliance:
+# - All cryptographic operations use SM algorithms exclusively
+# - Hardware Security Modules should be OSCCA-certified
+# - Certificates comply with GM/T 0015 (Certificate Profile)
+#
+# =============================================================================
+
+x-sm-remote-labels: &sm-remote-labels
+  com.stellaops.component: "sm-remote"
+  com.stellaops.crypto.provider: "sm"
+  com.stellaops.crypto.profile: "china"
+  com.stellaops.crypto.jurisdiction: "china"
+
+x-sm-remote-env: &sm-remote-env
+  STELLAOPS_CRYPTO_PROVIDERS: "cn.sm.soft,cn.sm.remote.http"
+  STELLAOPS_CRYPTO_SM_REMOTE_URL: "http://sm-remote:56080"
+  STELLAOPS_CRYPTO_SM_ENABLED: "true"
+  SM_SOFT_ALLOWED: "1"
+
+networks:
+  stellaops:
+    external: true
+    name: stellaops
+
+services:
+  # ---------------------------------------------------------------------------
+  # SM Remote Service - ShangMi cryptography provider
+  # ---------------------------------------------------------------------------
+  sm-remote:
+    build:
+      context: ../..
+      dockerfile: devops/services/sm-remote/Dockerfile
+    image: registry.stella-ops.org/stellaops/sm-remote:2025.10.0
+    container_name: stellaops-sm-remote
+    restart: unless-stopped
+    environment:
+      ASPNETCORE_URLS: "http://0.0.0.0:56080"
+      ASPNETCORE_ENVIRONMENT: "Production"
+      # Enable software-only SM2 provider (for testing/development)
+      SM_SOFT_ALLOWED: "${SM_SOFT_ALLOWED:-1}"
+      # Optional: Remote HSM configuration (for production with OSCCA-certified HSM)
+      SM_REMOTE_HSM_URL: "${SM_REMOTE_HSM_URL:-}"
+      SM_REMOTE_HSM_API_KEY: "${SM_REMOTE_HSM_API_KEY:-}"
+      SM_REMOTE_HSM_TIMEOUT: "${SM_REMOTE_HSM_TIMEOUT:-30000}"
+      # Optional: Client certificate authentication for HSM
+      SM_REMOTE_CLIENT_CERT_PATH: "${SM_REMOTE_CLIENT_CERT_PATH:-}"
+      SM_REMOTE_CLIENT_CERT_PASSWORD: "${SM_REMOTE_CLIENT_CERT_PASSWORD:-}"
+    volumes:
+      - ../../etc/sm-remote:/app/etc/sm-remote:ro
+      # Optional: Mount SM key containers
+      - sm-remote-keys:/var/lib/stellaops/sm-keys
+    ports:
+      - "${SM_REMOTE_PORT:-56080}:56080"
+    networks:
+      - stellaops
+    healthcheck:
+      test: ["CMD", "curl", "-f", "http://localhost:56080/status"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 15s
+    labels: *sm-remote-labels
+
+  # ---------------------------------------------------------------------------
+  # Override services to use SM Remote
+  # ---------------------------------------------------------------------------
+
+  # Authority - Use SM Remote for SM2 signatures
+  authority:
+    environment:
+      <<: *sm-remote-env
+    depends_on:
+      - sm-remote
+    labels:
+      com.stellaops.crypto.provider: "sm"
+
+  # Signer - Use SM Remote for SM2 signatures
+  signer:
+    environment:
+      <<: *sm-remote-env
+    depends_on:
+      - sm-remote
+    labels:
+      com.stellaops.crypto.provider: "sm"
+
+  # Attestor - Use SM Remote for SM2 signatures
+  attestor:
+    environment:
+      <<: *sm-remote-env
+    depends_on:
+      - sm-remote
+    labels:
+      com.stellaops.crypto.provider: "sm"
+
+  # Scanner Web - Use SM Remote for verification
+  scanner-web:
+    environment:
+      <<: *sm-remote-env
+    depends_on:
+      - sm-remote
+    labels:
+      com.stellaops.crypto.provider: "sm"
+
+  # Scanner Worker - Use SM Remote for verification
+  scanner-worker:
+    environment:
+      <<: *sm-remote-env
+    depends_on:
+      - sm-remote
+    labels:
+      com.stellaops.crypto.provider: "sm"
+
+  # Excititor - Use SM Remote for VEX signing
+  excititor:
+    environment:
+      <<: *sm-remote-env
+    depends_on:
+      - sm-remote
+    labels:
+      com.stellaops.crypto.provider: "sm"
+
+volumes:
+  sm-remote-keys:
+    name: stellaops-sm-remote-keys

deploy/compose/docker-compose.telemetry-offline.yml

@@ -0,0 +1,90 @@
+# =============================================================================
+# TELEMETRY OFFLINE - AIR-GAPPED OBSERVABILITY
+# =============================================================================
+# Offline-compatible telemetry stack for air-gapped deployments.
+# Does not require external connectivity.
+#
+# Usage:
+#   docker compose -f docker-compose.telemetry-offline.yml up -d
+#
+# For online deployments, use docker-compose.telemetry.yml instead.
+# =============================================================================
+
+services:
+  loki:
+    image: grafana/loki:3.0.1
+    container_name: stellaops-loki-offline
+    command: ["-config.file=/etc/loki/local-config.yaml"]
+    volumes:
+      - loki-data:/loki
+      - ../offline/airgap/observability/loki-config.yaml:/etc/loki/local-config.yaml:ro
+    ports:
+      - "${LOKI_PORT:-3100}:3100"
+    networks:
+      - sealed
+    restart: unless-stopped
+
+  promtail:
+    image: grafana/promtail:3.0.1
+    container_name: stellaops-promtail-offline
+    command: ["-config.file=/etc/promtail/config.yml"]
+    volumes:
+      - promtail-data:/var/log
+      - ../offline/airgap/promtail-config.yaml:/etc/promtail/config.yml:ro
+    networks:
+      - sealed
+    restart: unless-stopped
+
+  otel-collector:
+    image: otel/opentelemetry-collector-contrib:0.97.0
+    container_name: stellaops-otel-offline
+    command: ["--config=/etc/otel/config.yaml"]
+    volumes:
+      - ../offline/airgap/otel-offline.yaml:/etc/otel/config.yaml:ro
+      - otel-data:/var/otel
+    ports:
+      - "${OTEL_GRPC_PORT:-4317}:4317"
+      - "${OTEL_HTTP_PORT:-4318}:4318"
+    networks:
+      - sealed
+    restart: unless-stopped
+
+  tempo:
+    image: grafana/tempo:2.4.1
+    container_name: stellaops-tempo-offline
+    command: ["-config.file=/etc/tempo/config.yaml"]
+    volumes:
+      - tempo-data:/var/tempo
+      - ../offline/airgap/observability/tempo-config.yaml:/etc/tempo/config.yaml:ro
+    ports:
+      - "${TEMPO_PORT:-3200}:3200"
+    networks:
+      - sealed
+    restart: unless-stopped
+
+  prometheus:
+    image: prom/prometheus:v2.51.0
+    container_name: stellaops-prometheus-offline
+    command:
+      - '--config.file=/etc/prometheus/prometheus.yml'
+      - '--storage.tsdb.path=/prometheus'
+      - '--storage.tsdb.retention.time=15d'
+    volumes:
+      - prometheus-data:/prometheus
+      - ../offline/airgap/observability/prometheus.yml:/etc/prometheus/prometheus.yml:ro
+    ports:
+      - "${PROMETHEUS_PORT:-9090}:9090"
+    networks:
+      - sealed
+    restart: unless-stopped
+
+networks:
+  sealed:
+    driver: bridge
+
+volumes:
+  loki-data:
+  promtail-data:
+  otel-data:
+  tempo-data:
+  prometheus-data:

deploy/compose/docker-compose.telemetry.yml

@@ -0,0 +1,144 @@
+# =============================================================================
+# STELLA OPS - TELEMETRY STACK
+# =============================================================================
+# All-in-one observability: OpenTelemetry Collector, Prometheus, Tempo, Loki
+#
+# Usage:
+#   docker compose -f devops/compose/docker-compose.telemetry.yml up -d
+#
+# With main stack:
+#   docker compose -f devops/compose/docker-compose.stella-ops.yml \
+#     -f devops/compose/docker-compose.telemetry.yml up -d
+#
+# =============================================================================
+
+x-telemetry-labels: &telemetry-labels
+  com.stellaops.component: "telemetry"
+  com.stellaops.profile: "observability"
+
+networks:
+  stellaops-telemetry:
+    driver: bridge
+    name: stellaops-telemetry
+  stellaops:
+    external: true
+    name: stellaops
+
+volumes:
+  prometheus-data:
+  tempo-data:
+  loki-data:
+
+services:
+  # ---------------------------------------------------------------------------
+  # OpenTelemetry Collector - Unified telemetry ingestion
+  # ---------------------------------------------------------------------------
+  otel-collector:
+    image: otel/opentelemetry-collector:0.105.0
+    container_name: stellaops-otel-collector
+    restart: unless-stopped
+    command:
+      - "--config=/etc/otel-collector/config.yaml"
+    environment:
+      STELLAOPS_OTEL_TLS_CERT: /etc/otel-collector/tls/collector.crt
+      STELLAOPS_OTEL_TLS_KEY: /etc/otel-collector/tls/collector.key
+      STELLAOPS_OTEL_TLS_CA: /etc/otel-collector/tls/ca.crt
+      STELLAOPS_OTEL_PROMETHEUS_ENDPOINT: 0.0.0.0:9464
+      STELLAOPS_OTEL_REQUIRE_CLIENT_CERT: "true"
+      STELLAOPS_TENANT_ID: ${STELLAOPS_TENANT_ID:-default}
+      STELLAOPS_TEMPO_ENDPOINT: http://tempo:3200
+      STELLAOPS_TEMPO_TLS_CERT_FILE: /etc/otel-collector/tls/client.crt
+      STELLAOPS_TEMPO_TLS_KEY_FILE: /etc/otel-collector/tls/client.key
+      STELLAOPS_TEMPO_TLS_CA_FILE: /etc/otel-collector/tls/ca.crt
+      STELLAOPS_LOKI_ENDPOINT: http://loki:3100/loki/api/v1/push
+      STELLAOPS_LOKI_TLS_CERT_FILE: /etc/otel-collector/tls/client.crt
+      STELLAOPS_LOKI_TLS_KEY_FILE: /etc/otel-collector/tls/client.key
+      STELLAOPS_LOKI_TLS_CA_FILE: /etc/otel-collector/tls/ca.crt
+    volumes:
+      - ../telemetry/otel-collector-config.yaml:/etc/otel-collector/config.yaml:ro
+      - ../telemetry/certs:/etc/otel-collector/tls:ro
+    ports:
+      - "${OTEL_GRPC_PORT:-4317}:4317"      # OTLP gRPC
+      - "${OTEL_HTTP_PORT:-4318}:4318"      # OTLP HTTP
+      - "${OTEL_PROMETHEUS_PORT:-9464}:9464" # Prometheus exporter
+      - "${OTEL_HEALTH_PORT:-13133}:13133"  # Health check
+      - "${OTEL_PPROF_PORT:-1777}:1777"     # pprof
+    healthcheck:
+      test: ["CMD", "curl", "-f", "http://localhost:13133/healthz"]
+      interval: 30s
+      start_period: 15s
+      timeout: 5s
+      retries: 3
+    networks:
+      - stellaops-telemetry
+      - stellaops
+    labels: *telemetry-labels
+
+  # ---------------------------------------------------------------------------
+  # Prometheus - Metrics storage
+  # ---------------------------------------------------------------------------
+  prometheus:
+    image: prom/prometheus:v2.53.0
+    container_name: stellaops-prometheus
+    restart: unless-stopped
+    command:
+      - "--config.file=/etc/prometheus/prometheus.yaml"
+      - "--storage.tsdb.path=/prometheus"
+      - "--storage.tsdb.retention.time=${PROMETHEUS_RETENTION:-15d}"
+      - "--web.enable-lifecycle"
+    volumes:
+      - ../telemetry/storage/prometheus.yaml:/etc/prometheus/prometheus.yaml:ro
+      - prometheus-data:/prometheus
+      - ../telemetry/certs:/etc/telemetry/tls:ro
+      - ../telemetry/storage/auth:/etc/telemetry/auth:ro
+    environment:
+      PROMETHEUS_COLLECTOR_TARGET: otel-collector:9464
+    ports:
+      - "${PROMETHEUS_PORT:-9090}:9090"
+    depends_on:
+      - otel-collector
+    networks:
+      - stellaops-telemetry
+    labels: *telemetry-labels
+
+  # ---------------------------------------------------------------------------
+  # Tempo - Distributed tracing backend
+  # ---------------------------------------------------------------------------
+  tempo:
+    image: grafana/tempo:2.5.0
+    container_name: stellaops-tempo
+    restart: unless-stopped
+    command:
+      - "-config.file=/etc/tempo/tempo.yaml"
+    volumes:
+      - ../telemetry/storage/tempo.yaml:/etc/tempo/tempo.yaml:ro
+      - ../telemetry/storage/tenants/tempo-overrides.yaml:/etc/telemetry/tenants/tempo-overrides.yaml:ro
+      - ../telemetry/certs:/etc/telemetry/tls:ro
+      - tempo-data:/var/tempo
+    environment:
+      TEMPO_ZONE: docker
+    ports:
+      - "${TEMPO_PORT:-3200}:3200"
+    networks:
+      - stellaops-telemetry
+    labels: *telemetry-labels
+
+  # ---------------------------------------------------------------------------
+  # Loki - Log aggregation
+  # ---------------------------------------------------------------------------
+  loki:
+    image: grafana/loki:3.1.0
+    container_name: stellaops-loki
+    restart: unless-stopped
+    command:
+      - "-config.file=/etc/loki/loki.yaml"
+    volumes:
+      - ../telemetry/storage/loki.yaml:/etc/loki/loki.yaml:ro
+      - ../telemetry/storage/tenants/loki-overrides.yaml:/etc/telemetry/tenants/loki-overrides.yaml:ro
+      - ../telemetry/certs:/etc/telemetry/tls:ro
+      - loki-data:/var/loki
+    ports:
+      - "${LOKI_PORT:-3100}:3100"
+    networks:
+      - stellaops-telemetry
+    labels: *telemetry-labels

deploy/compose/docker-compose.testing.yml

@@ -0,0 +1,327 @@
+# =============================================================================
+# STELLA OPS - TESTING STACK
+# =============================================================================
+# Consolidated CI, mock services, and Gitea for integration testing.
+# Uses different ports to avoid conflicts with development/production services.
+#
+# Usage:
+#   docker compose -f devops/compose/docker-compose.testing.yml up -d
+#
+# CI infrastructure only:
+#   docker compose -f devops/compose/docker-compose.testing.yml --profile ci up -d
+#
+# Mock services only:
+#   docker compose -f devops/compose/docker-compose.testing.yml --profile mock up -d
+#
+# Gitea only:
+#   docker compose -f devops/compose/docker-compose.testing.yml --profile gitea up -d
+#
+# =============================================================================
+
+x-testing-labels: &testing-labels
+  com.stellaops.profile: "testing"
+  com.stellaops.environment: "ci"
+
+networks:
+  testing-net:
+    driver: bridge
+    name: stellaops-testing
+
+volumes:
+  # CI volumes
+  ci-postgres-data:
+    name: stellaops-ci-postgres
+  ci-valkey-data:
+    name: stellaops-ci-valkey
+  ci-rustfs-data:
+    name: stellaops-ci-rustfs
+  # Gitea volumes
+  gitea-data:
+  gitea-config:
+
+services:
+  # ===========================================================================
+  # CI INFRASTRUCTURE (different ports to avoid conflicts)
+  # ===========================================================================
+
+  # ---------------------------------------------------------------------------
+  # PostgreSQL 18.1 - Test database (port 5433)
+  # ---------------------------------------------------------------------------
+  postgres-test:
+    image: postgres:18.1-alpine
+    container_name: stellaops-postgres-test
+    profiles: ["ci", "all"]
+    environment:
+      POSTGRES_USER: stellaops_ci
+      POSTGRES_PASSWORD: ci_test_password
+      POSTGRES_DB: stellaops_test
+      POSTGRES_INITDB_ARGS: "--data-checksums"
+    ports:
+      - "${TEST_POSTGRES_PORT:-5433}:5432"
+    volumes:
+      - ci-postgres-data:/var/lib/postgresql/data
+    networks:
+      - testing-net
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U stellaops_ci -d stellaops_test"]
+      interval: 5s
+      timeout: 5s
+      retries: 10
+      start_period: 10s
+    restart: unless-stopped
+    labels: *testing-labels
+
+  # ---------------------------------------------------------------------------
+  # Valkey 9.0.1 - Test cache/queue (port 6380)
+  # ---------------------------------------------------------------------------
+  valkey-test:
+    image: valkey/valkey:9.0.1-alpine
+    container_name: stellaops-valkey-test
+    profiles: ["ci", "all"]
+    command: ["valkey-server", "--appendonly", "yes", "--maxmemory", "256mb", "--maxmemory-policy", "allkeys-lru"]
+    ports:
+      - "${TEST_VALKEY_PORT:-6380}:6379"
+    volumes:
+      - ci-valkey-data:/data
+    networks:
+      - testing-net
+    healthcheck:
+      test: ["CMD", "valkey-cli", "ping"]
+      interval: 5s
+      timeout: 5s
+      retries: 5
+    restart: unless-stopped
+    labels: *testing-labels
+
+  # ---------------------------------------------------------------------------
+  # RustFS - Test artifact storage (port 8180)
+  # ---------------------------------------------------------------------------
+  rustfs-test:
+    image: registry.stella-ops.org/stellaops/rustfs:2025.09.2
+    container_name: stellaops-rustfs-test
+    profiles: ["ci", "all"]
+    command: ["serve", "--listen", "0.0.0.0:8080", "--root", "/data"]
+    environment:
+      RUSTFS__LOG__LEVEL: info
+      RUSTFS__STORAGE__PATH: /data
+    ports:
+      - "${TEST_RUSTFS_PORT:-8180}:8080"
+    volumes:
+      - ci-rustfs-data:/data
+    networks:
+      - testing-net
+    restart: unless-stopped
+    labels: *testing-labels
+
+  # ---------------------------------------------------------------------------
+  # Mock Container Registry (port 5001)
+  # ---------------------------------------------------------------------------
+  mock-registry:
+    image: registry:2
+    container_name: stellaops-registry-test
+    profiles: ["ci", "all"]
+    ports:
+      - "${TEST_REGISTRY_PORT:-5001}:5000"
+    environment:
+      REGISTRY_STORAGE_DELETE_ENABLED: "true"
+    networks:
+      - testing-net
+    restart: unless-stopped
+    labels: *testing-labels
+
+  # ---------------------------------------------------------------------------
+  # Sigstore CLI tools (on-demand)
+  # ---------------------------------------------------------------------------
+  rekor-cli:
+    image: ghcr.io/sigstore/rekor-cli:v1.4.3
+    entrypoint: ["rekor-cli"]
+    command: ["version"]
+    profiles: ["sigstore"]
+    networks:
+      - testing-net
+    labels: *testing-labels
+
+  cosign:
+    image: ghcr.io/sigstore/cosign:v3.0.4
+    entrypoint: ["cosign"]
+    command: ["version"]
+    profiles: ["sigstore"]
+    networks:
+      - testing-net
+    labels: *testing-labels
+
+  # ===========================================================================
+  # MOCK SERVICES (for extended integration testing)
+  # ===========================================================================
+
+  # ---------------------------------------------------------------------------
+  # Orchestrator mock
+  # ---------------------------------------------------------------------------
+  orchestrator:
+    image: registry.stella-ops.org/stellaops/orchestrator@sha256:97f12856ce870bafd3328bda86833bcccbf56d255941d804966b5557f6610119
+    container_name: stellaops-orchestrator-mock
+    profiles: ["mock", "all"]
+    command: ["dotnet", "StellaOps.Orchestrator.WebService.dll"]
+    depends_on:
+      - postgres-test
+      - valkey-test
+    environment:
+      ORCHESTRATOR__STORAGE__DRIVER: "postgres"
+      ORCHESTRATOR__STORAGE__POSTGRES__CONNECTIONSTRING: "Host=postgres-test;Port=5432;Database=stellaops_test;Username=stellaops_ci;Password=ci_test_password"
+      ORCHESTRATOR__QUEUE__DRIVER: "valkey"
+      ORCHESTRATOR__QUEUE__VALKEY__URL: "valkey-test:6379"
+    networks:
+      - testing-net
+    labels: *testing-labels
+
+  # ---------------------------------------------------------------------------
+  # Policy Registry mock
+  # ---------------------------------------------------------------------------
+  policy-registry:
+    image: registry.stella-ops.org/stellaops/policy-registry@sha256:c6cad8055e9827ebcbebb6ad4d6866dce4b83a0a49b0a8a6500b736a5cb26fa7
+    container_name: stellaops-policy-registry-mock
+    profiles: ["mock", "all"]
+    command: ["dotnet", "StellaOps.Policy.Engine.dll"]
+    depends_on:
+      - postgres-test
+    environment:
+      POLICY__STORAGE__DRIVER: "postgres"
+      POLICY__STORAGE__POSTGRES__CONNECTIONSTRING: "Host=postgres-test;Port=5432;Database=stellaops_test;Username=stellaops_ci;Password=ci_test_password"
+    networks:
+      - testing-net
+    labels: *testing-labels
+
+  # ---------------------------------------------------------------------------
+  # VEX Lens mock
+  # ---------------------------------------------------------------------------
+  vex-lens:
+    image: registry.stella-ops.org/stellaops/vex-lens@sha256:b44e63ecfeebc345a70c073c1ce5ace709c58be0ffaad0e2862758aeee3092fb
+    container_name: stellaops-vex-lens-mock
+    profiles: ["mock", "all"]
+    command: ["dotnet", "StellaOps.VexLens.dll"]
+    depends_on:
+      - postgres-test
+    environment:
+      VEXLENS__STORAGE__DRIVER: "postgres"
+      VEXLENS__STORAGE__POSTGRES__CONNECTIONSTRING: "Host=postgres-test;Port=5432;Database=stellaops_test;Username=stellaops_ci;Password=ci_test_password"
+    networks:
+      - testing-net
+    labels: *testing-labels
+
+  # ---------------------------------------------------------------------------
+  # Findings Ledger mock
+  # ---------------------------------------------------------------------------
+  findings-ledger:
+    image: registry.stella-ops.org/stellaops/findings-ledger@sha256:71d4c361ba8b2f8b69d652597bc3f2efc8a64f93fab854ce25272a88506df49c
+    container_name: stellaops-findings-ledger-mock
+    profiles: ["mock", "all"]
+    command: ["dotnet", "StellaOps.Findings.Ledger.WebService.dll"]
+    depends_on:
+      - postgres-test
+    environment:
+      FINDINGSLEDGER__STORAGE__DRIVER: "postgres"
+      FINDINGSLEDGER__STORAGE__POSTGRES__CONNECTIONSTRING: "Host=postgres-test;Port=5432;Database=stellaops_test;Username=stellaops_ci;Password=ci_test_password"
+    networks:
+      - testing-net
+    labels: *testing-labels
+
+  # ---------------------------------------------------------------------------
+  # Vuln Explorer API mock
+  # ---------------------------------------------------------------------------
+  vuln-explorer-api:
+    image: registry.stella-ops.org/stellaops/vuln-explorer-api@sha256:7fc7e43a05cbeb0106ce7d4d634612e83de6fdc119aaab754a71c1d60b82841d
+    container_name: stellaops-vuln-explorer-mock
+    profiles: ["mock", "all"]
+    command: ["dotnet", "StellaOps.VulnExplorer.Api.dll"]
+    depends_on:
+      - findings-ledger
+    networks:
+      - testing-net
+    labels: *testing-labels
+
+  # ---------------------------------------------------------------------------
+  # Packs Registry mock
+  # ---------------------------------------------------------------------------
+  packs-registry:
+    image: registry.stella-ops.org/stellaops/packs-registry@sha256:1f5e9416c4dc608594ad6fad87c24d72134427f899c192b494e22b268499c791
+    container_name: stellaops-packs-registry-mock
+    profiles: ["mock", "all"]
+    command: ["dotnet", "StellaOps.PacksRegistry.dll"]
+    depends_on:
+      - postgres-test
+    environment:
+      PACKSREGISTRY__STORAGE__DRIVER: "postgres"
+      PACKSREGISTRY__STORAGE__POSTGRES__CONNECTIONSTRING: "Host=postgres-test;Port=5432;Database=stellaops_test;Username=stellaops_ci;Password=ci_test_password"
+    networks:
+      - testing-net
+    labels: *testing-labels
+
+  # ---------------------------------------------------------------------------
+  # Task Runner mock
+  # ---------------------------------------------------------------------------
+  task-runner:
+    image: registry.stella-ops.org/stellaops/task-runner@sha256:eb5ad992b49a41554f41516be1a6afcfa6522faf2111c08ff2b3664ad2fc954b
+    container_name: stellaops-task-runner-mock
+    profiles: ["mock", "all"]
+    command: ["dotnet", "StellaOps.TaskRunner.WebService.dll"]
+    depends_on:
+      - packs-registry
+      - postgres-test
+    environment:
+      TASKRUNNER__STORAGE__DRIVER: "postgres"
+      TASKRUNNER__STORAGE__POSTGRES__CONNECTIONSTRING: "Host=postgres-test;Port=5432;Database=stellaops_test;Username=stellaops_ci;Password=ci_test_password"
+    networks:
+      - testing-net
+    labels: *testing-labels
+
+  # ===========================================================================
+  # GITEA (SCM integration testing)
+  # ===========================================================================
+
+  # ---------------------------------------------------------------------------
+  # Gitea - Git hosting with package registry
+  # ---------------------------------------------------------------------------
+  gitea:
+    image: gitea/gitea:1.21
+    container_name: stellaops-gitea-test
+    profiles: ["gitea", "all"]
+    environment:
+      - USER_UID=1000
+      - USER_GID=1000
+      # Enable package registry
+      - GITEA__packages__ENABLED=true
+      - GITEA__packages__CHUNKED_UPLOAD_PATH=/data/tmp/package-upload
+      # Enable NuGet
+      - GITEA__packages__NUGET_ENABLED=true
+      # Enable Container registry
+      - GITEA__packages__CONTAINER_ENABLED=true
+      # Database (SQLite for simplicity)
+      - GITEA__database__DB_TYPE=sqlite3
+      - GITEA__database__PATH=/data/gitea/gitea.db
+      # Server config
+      - GITEA__server__ROOT_URL=http://localhost:${TEST_GITEA_PORT:-3000}/
+      - GITEA__server__HTTP_PORT=3000
+      # Disable metrics/telemetry
+      - GITEA__metrics__ENABLED=false
+      # Session config
+      - GITEA__session__PROVIDER=memory
+      # Cache config
+      - GITEA__cache__ADAPTER=memory
+      # Log level
+      - GITEA__log__LEVEL=Warn
+    volumes:
+      - gitea-data:/data
+      - gitea-config:/etc/gitea
+    ports:
+      - "${TEST_GITEA_PORT:-3000}:3000"
+      - "${TEST_GITEA_SSH_PORT:-3022}:22"
+    networks:
+      - testing-net
+    restart: unless-stopped
+    healthcheck:
+      test: ["CMD", "curl", "-f", "http://localhost:3000/api/healthz"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 60s
+    labels: *testing-labels

deploy/compose/docker-compose.tile-proxy.yml

@@ -0,0 +1,80 @@
+# =============================================================================
+# STELLA OPS TILE PROXY OVERLAY
+# =============================================================================
+# Rekor tile caching proxy for air-gapped and offline deployments.
+# Caches tiles from upstream Rekor (public Sigstore or private) locally.
+#
+# Use Cases:
+#   - Air-gapped deployments with periodic sync
+#   - Reduce latency by caching frequently-accessed tiles
+#   - Offline verification when upstream is unavailable
+#
+# Note: This is an ALTERNATIVE to running your own rekor-v2 instance.
+# Use tile-proxy when you want to cache from public Sigstore.
+# Use rekor-v2 (--profile sigstore) when running your own transparency log.
+#
+# Usage:
+#   docker compose -f docker-compose.stella-ops.yml \
+#     -f docker-compose.tile-proxy.yml up -d
+#
+# =============================================================================
+
+x-release-labels: &release-labels
+  com.stellaops.release.version: "2025.10.0"
+  com.stellaops.release.channel: "stable"
+  com.stellaops.component: "tile-proxy"
+
+volumes:
+  tile-cache:
+    driver: local
+  tuf-cache:
+    driver: local
+
+services:
+  tile-proxy:
+    build:
+      context: ../..
+      dockerfile: src/Attestor/StellaOps.Attestor.TileProxy/Dockerfile
+    image: registry.stella-ops.org/stellaops/tile-proxy:2025.10.0
+    container_name: stellaops-tile-proxy
+    restart: unless-stopped
+    ports:
+      - "${TILE_PROXY_PORT:-8090}:8080"
+    volumes:
+      - tile-cache:/var/cache/stellaops/tiles
+      - tuf-cache:/var/cache/stellaops/tuf
+    environment:
+      # Upstream Rekor configuration
+      TILE_PROXY__UPSTREAMURL: "${REKOR_SERVER_URL:-https://rekor.sigstore.dev}"
+      TILE_PROXY__ORIGIN: "${REKOR_ORIGIN:-rekor.sigstore.dev - 1985497715}"
+
+      # TUF configuration (optional - for checkpoint signature validation)
+      TILE_PROXY__TUF__ENABLED: "${TILE_PROXY_TUF_ENABLED:-false}"
+      TILE_PROXY__TUF__URL: "${TILE_PROXY_TUF_ROOT_URL:-}"
+      TILE_PROXY__TUF__VALIDATECHECKPOINTSIGNATURE: "${TILE_PROXY_TUF_VALIDATE_CHECKPOINT:-true}"
+
+      # Cache configuration
+      TILE_PROXY__CACHE__BASEPATH: /var/cache/stellaops/tiles
+      TILE_PROXY__CACHE__MAXSIZEGB: "${TILE_PROXY_CACHE_MAX_SIZE_GB:-10}"
+      TILE_PROXY__CACHE__CHECKPOINTTTLMINUTES: "${TILE_PROXY_CHECKPOINT_TTL_MINUTES:-5}"
+
+      # Sync job configuration (for air-gapped pre-fetching)
+      TILE_PROXY__SYNC__ENABLED: "${TILE_PROXY_SYNC_ENABLED:-true}"
+      TILE_PROXY__SYNC__SCHEDULE: "${TILE_PROXY_SYNC_SCHEDULE:-0 */6 * * *}"
+      TILE_PROXY__SYNC__DEPTH: "${TILE_PROXY_SYNC_DEPTH:-10000}"
+
+      # Request handling
+      TILE_PROXY__REQUEST__COALESCINGENABLED: "${TILE_PROXY_COALESCING_ENABLED:-true}"
+      TILE_PROXY__REQUEST__TIMEOUTSECONDS: "${TILE_PROXY_REQUEST_TIMEOUT_SECONDS:-30}"
+
+      # Logging
+      Serilog__MinimumLevel__Default: "${TILE_PROXY_LOG_LEVEL:-Information}"
+    healthcheck:
+      test: ["CMD", "curl", "-f", "http://localhost:8080/_admin/health"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 5s
+    networks:
+      - stellaops
+    labels: *release-labels

deploy/compose/env/cas.env.example

@@ -0,0 +1,118 @@
+# CAS (Content Addressable Storage) Environment Configuration
+# Copy to .env and customize for your deployment
+#
+# Aligned with best-in-class vulnerability scanner retention policies:
+# - Trivy: 7 days vulnerability DB
+# - Grype: 5 days DB, configurable
+# - Anchore Enterprise: 90-365 days typical
+# - Snyk Enterprise: 365 days
+
+# =============================================================================
+# DATA PATHS (ensure directories exist with proper permissions)
+# =============================================================================
+CAS_DATA_PATH=/var/lib/stellaops/cas
+CAS_EVIDENCE_PATH=/var/lib/stellaops/evidence
+CAS_ATTESTATION_PATH=/var/lib/stellaops/attestations
+
+# =============================================================================
+# RUSTFS CONFIGURATION
+# =============================================================================
+RUSTFS_LOG_LEVEL=info
+RUSTFS_COMPRESSION=zstd
+RUSTFS_COMPRESSION_LEVEL=3
+
+# =============================================================================
+# PORTS
+# =============================================================================
+RUSTFS_CAS_PORT=8180
+RUSTFS_EVIDENCE_PORT=8181
+RUSTFS_ATTESTATION_PORT=8182
+
+# =============================================================================
+# ACCESS CONTROL - API KEYS
+# IMPORTANT: Change these in production!
+# =============================================================================
+
+# CAS Storage (mutable, lifecycle-managed)
+RUSTFS_CAS_API_KEY=cas-api-key-CHANGE-IN-PRODUCTION
+RUSTFS_CAS_READONLY_KEY=cas-readonly-key-CHANGE-IN-PRODUCTION
+
+# Evidence Storage (immutable)
+RUSTFS_EVIDENCE_API_KEY=evidence-api-key-CHANGE-IN-PRODUCTION
+RUSTFS_EVIDENCE_READONLY_KEY=evidence-readonly-key-CHANGE-IN-PRODUCTION
+
+# Attestation Storage (immutable)
+RUSTFS_ATTESTATION_API_KEY=attestation-api-key-CHANGE-IN-PRODUCTION
+RUSTFS_ATTESTATION_READONLY_KEY=attestation-readonly-key-CHANGE-IN-PRODUCTION
+
+# =============================================================================
+# SERVICE ACCOUNT KEYS
+# Each service has its own key for fine-grained access control
+# IMPORTANT: Generate unique keys per environment!
+# =============================================================================
+
+# Scanner service - access to scanner artifacts, surface cache, runtime facts
+RUSTFS_SCANNER_KEY=scanner-svc-key-GENERATE-UNIQUE
+# Bucket access: scanner-artifacts (rw), surface-cache (rw), runtime-facts (rw)
+
+# Signals service - access to runtime facts, signals data, provenance feed
+RUSTFS_SIGNALS_KEY=signals-svc-key-GENERATE-UNIQUE
+# Bucket access: runtime-facts (rw), signals-data (rw), provenance-feed (rw)
+
+# Replay service - access to replay bundles, inputs lock files
+RUSTFS_REPLAY_KEY=replay-svc-key-GENERATE-UNIQUE
+# Bucket access: replay-bundles (rw), inputs-lock (rw)
+
+# Ledger service - access to evidence bundles, merkle roots, hash chains
+RUSTFS_LEDGER_KEY=ledger-svc-key-GENERATE-UNIQUE
+# Bucket access: evidence-bundles (rw), merkle-roots (rw), hash-chains (rw)
+
+# Exporter service - read-only access to evidence bundles
+RUSTFS_EXPORTER_KEY=exporter-svc-key-GENERATE-UNIQUE
+# Bucket access: evidence-bundles (r)
+
+# Attestor service - access to attestations, DSSE envelopes, Rekor receipts
+RUSTFS_ATTESTOR_KEY=attestor-svc-key-GENERATE-UNIQUE
+# Bucket access: attestations (rw), dsse-envelopes (rw), rekor-receipts (rw)
+
+# Verifier service - read-only access to attestations
+RUSTFS_VERIFIER_KEY=verifier-svc-key-GENERATE-UNIQUE
+# Bucket access: attestations (r), dsse-envelopes (r), rekor-receipts (r)
+
+# Global read-only key (for debugging/auditing)
+RUSTFS_READONLY_KEY=readonly-global-key-GENERATE-UNIQUE
+# Bucket access: * (r)
+
+# =============================================================================
+# LIFECYCLE MANAGEMENT
+# =============================================================================
+# Cron schedule for retention policy enforcement (default: 3 AM daily)
+LIFECYCLE_CRON=0 3 * * *
+LIFECYCLE_TELEMETRY=true
+
+# =============================================================================
+# RETENTION POLICIES (days, 0 = indefinite)
+# Aligned with enterprise vulnerability scanner best practices
+# =============================================================================
+# Vulnerability DB: 7 days (matches Trivy default, Grype uses 5)
+CAS_RETENTION_VULNERABILITY_DB_DAYS=7
+
+# SBOM artifacts: 365 days (audit compliance - SOC2, ISO27001, FedRAMP)
+CAS_RETENTION_SBOM_ARTIFACTS_DAYS=365
+
+# Scan results: 90 days (common compliance window)
+CAS_RETENTION_SCAN_RESULTS_DAYS=90
+
+# Evidence bundles: indefinite (content-addressed, immutable, audit trail)
+CAS_RETENTION_EVIDENCE_BUNDLES_DAYS=0
+
+# Attestations: indefinite (signed, immutable, verifiable)
+CAS_RETENTION_ATTESTATIONS_DAYS=0
+
+# Temporary artifacts: 1 day (work-in-progress, intermediate files)
+CAS_RETENTION_TEMP_ARTIFACTS_DAYS=1
+
+# =============================================================================
+# TELEMETRY (optional)
+# =============================================================================
+OTLP_ENDPOINT=

deploy/compose/env/compliance-china.env.example

@@ -0,0 +1,48 @@
+# =============================================================================
+# STELLA OPS CHINA COMPLIANCE ENVIRONMENT
+# =============================================================================
+# Environment template for China (SM2/SM3/SM4) compliance deployments.
+#
+# Usage with simulation:
+#   cp env/compliance-china.env.example .env
+#   docker compose -f docker-compose.stella-ops.yml \
+#     -f docker-compose.compliance-china.yml \
+#     -f docker-compose.crypto-sim.yml up -d
+#
+# Usage with SM Remote (production):
+#   docker compose -f docker-compose.stella-ops.yml \
+#     -f docker-compose.compliance-china.yml \
+#     -f docker-compose.sm-remote.yml up -d
+#
+# =============================================================================
+
+# Crypto profile
+STELLAOPS_CRYPTO_PROFILE=china
+
+# =============================================================================
+# SM REMOTE SERVICE CONFIGURATION
+# =============================================================================
+
+SM_REMOTE_PORT=56080
+
+# Software-only SM2 provider (for testing/development)
+SM_SOFT_ALLOWED=1
+
+# OSCCA-certified HSM configuration (for production)
+# Set these when using a certified hardware security module
+SM_REMOTE_HSM_URL=
+SM_REMOTE_HSM_API_KEY=
+SM_REMOTE_HSM_TIMEOUT=30000
+
+# Client certificate authentication for HSM (optional)
+SM_REMOTE_CLIENT_CERT_PATH=
+SM_REMOTE_CLIENT_CERT_PASSWORD=
+
+# =============================================================================
+# CRYPTO SIMULATION (for testing only)
+# =============================================================================
+
+# Enable simulation mode
+STELLAOPS_CRYPTO_ENABLE_SIM=1
+STELLAOPS_CRYPTO_SIM_URL=http://sim-crypto:8080
+SIM_CRYPTO_PORT=18090

deploy/compose/env/compliance-eu.env.example

@@ -0,0 +1,40 @@
+# =============================================================================
+# STELLA OPS EU COMPLIANCE ENVIRONMENT
+# =============================================================================
+# Environment template for EU (eIDAS) compliance deployments.
+#
+# Usage with simulation:
+#   cp env/compliance-eu.env.example .env
+#   docker compose -f docker-compose.stella-ops.yml \
+#     -f docker-compose.compliance-eu.yml \
+#     -f docker-compose.crypto-sim.yml up -d
+#
+# Usage for production:
+#   docker compose -f docker-compose.stella-ops.yml \
+#     -f docker-compose.compliance-eu.yml up -d
+#
+# Note: EU eIDAS deployments typically integrate with external Qualified Trust
+# Service Providers (QTSPs) rather than hosting crypto locally.
+#
+# =============================================================================
+
+# Crypto profile
+STELLAOPS_CRYPTO_PROFILE=eu
+
+# =============================================================================
+# eIDAS / QTSP CONFIGURATION
+# =============================================================================
+
+# Qualified Trust Service Provider integration (configure in application settings)
+# EIDAS_QTSP_URL=https://qtsp.example.eu
+# EIDAS_QTSP_CLIENT_ID=
+# EIDAS_QTSP_CLIENT_SECRET=
+
+# =============================================================================
+# CRYPTO SIMULATION (for testing only)
+# =============================================================================
+
+# Enable simulation mode
+STELLAOPS_CRYPTO_ENABLE_SIM=1
+STELLAOPS_CRYPTO_SIM_URL=http://sim-crypto:8080
+SIM_CRYPTO_PORT=18090

deploy/compose/env/compliance-russia.env.example

@@ -0,0 +1,51 @@
+# =============================================================================
+# STELLA OPS RUSSIA COMPLIANCE ENVIRONMENT
+# =============================================================================
+# Environment template for Russia (GOST R 34.10-2012) compliance deployments.
+#
+# Usage with simulation:
+#   cp env/compliance-russia.env.example .env
+#   docker compose -f docker-compose.stella-ops.yml \
+#     -f docker-compose.compliance-russia.yml \
+#     -f docker-compose.crypto-sim.yml up -d
+#
+# Usage with CryptoPro CSP (production):
+#   CRYPTOPRO_ACCEPT_EULA=1 docker compose -f docker-compose.stella-ops.yml \
+#     -f docker-compose.compliance-russia.yml \
+#     -f docker-compose.cryptopro.yml up -d
+#
+# =============================================================================
+
+# Crypto profile
+STELLAOPS_CRYPTO_PROFILE=russia
+
+# =============================================================================
+# CRYPTOPRO CSP CONFIGURATION
+# =============================================================================
+
+CRYPTOPRO_PORT=18080
+
+# IMPORTANT: Set to 1 to accept CryptoPro EULA (required for production)
+CRYPTOPRO_ACCEPT_EULA=0
+
+# CryptoPro container settings
+CRYPTOPRO_CONTAINER_NAME=stellaops-signing
+CRYPTOPRO_USE_MACHINE_STORE=true
+CRYPTOPRO_PROVIDER_TYPE=80
+
+# =============================================================================
+# GOST ALGORITHM CONFIGURATION
+# =============================================================================
+
+# Default GOST algorithms
+CRYPTOPRO_GOST_SIGNATURE_ALGORITHM=GOST R 34.10-2012
+CRYPTOPRO_GOST_HASH_ALGORITHM=GOST R 34.11-2012
+
+# =============================================================================
+# CRYPTO SIMULATION (for testing only)
+# =============================================================================
+
+# Enable simulation mode
+STELLAOPS_CRYPTO_ENABLE_SIM=1
+STELLAOPS_CRYPTO_SIM_URL=http://sim-crypto:8080
+SIM_CRYPTO_PORT=18090

deploy/compose/env/stellaops.env.example

@@ -0,0 +1,171 @@
+# =============================================================================
+# STELLA OPS ENVIRONMENT CONFIGURATION
+# =============================================================================
+# Main environment template for docker-compose.stella-ops.yml
+# Copy to .env and customize for your deployment.
+#
+# Usage:
+#   cp env/stellaops.env.example .env
+#   docker compose -f docker-compose.stella-ops.yml up -d
+#
+# =============================================================================
+
+# =============================================================================
+# INFRASTRUCTURE
+# =============================================================================
+
+# PostgreSQL Database
+POSTGRES_USER=stellaops
+POSTGRES_PASSWORD=REPLACE_WITH_STRONG_PASSWORD
+POSTGRES_DB=stellaops_platform
+POSTGRES_PORT=5432
+
+# Valkey (Redis-compatible cache and messaging)
+VALKEY_PORT=6379
+
+# RustFS Object Storage
+RUSTFS_HTTP_PORT=8080
+
+# =============================================================================
+# CORE SERVICES
+# =============================================================================
+
+# Authority (OAuth2/OIDC)
+AUTHORITY_ISSUER=https://authority.example.com
+AUTHORITY_PORT=8440
+AUTHORITY_OFFLINE_CACHE_TOLERANCE=00:30:00
+
+# Signer
+SIGNER_POE_INTROSPECT_URL=https://licensing.example.com/introspect
+SIGNER_PORT=8441
+
+# Attestor
+ATTESTOR_PORT=8442
+
+# Issuer Directory
+ISSUER_DIRECTORY_PORT=8447
+ISSUER_DIRECTORY_SEED_CSAF=true
+
+# Concelier
+CONCELIER_PORT=8445
+
+# Notify
+NOTIFY_WEB_PORT=8446
+
+# Web UI
+UI_PORT=8443
+
+# =============================================================================
+# SCANNER CONFIGURATION
+# =============================================================================
+
+SCANNER_WEB_PORT=8444
+
+# Queue configuration (Valkey only - NATS removed)
+SCANNER__QUEUE__BROKER=valkey://valkey:6379
+
+# Event streaming
+SCANNER_EVENTS_ENABLED=false
+SCANNER_EVENTS_DRIVER=valkey
+SCANNER_EVENTS_DSN=valkey:6379
+SCANNER_EVENTS_STREAM=stella.events
+SCANNER_EVENTS_PUBLISH_TIMEOUT_SECONDS=5
+SCANNER_EVENTS_MAX_STREAM_LENGTH=10000
+
+# Surface cache configuration
+SCANNER_SURFACE_FS_ENDPOINT=http://rustfs:8080
+SCANNER_SURFACE_FS_BUCKET=surface-cache
+SCANNER_SURFACE_CACHE_ROOT=/var/lib/stellaops/surface
+SCANNER_SURFACE_CACHE_QUOTA_MB=4096
+SCANNER_SURFACE_PREFETCH_ENABLED=false
+SCANNER_SURFACE_TENANT=default
+SCANNER_SURFACE_FEATURES=
+SCANNER_SURFACE_SECRETS_PROVIDER=file
+SCANNER_SURFACE_SECRETS_NAMESPACE=
+SCANNER_SURFACE_SECRETS_ROOT=/etc/stellaops/secrets
+SCANNER_SURFACE_SECRETS_FALLBACK_PROVIDER=
+SCANNER_SURFACE_SECRETS_ALLOW_INLINE=false
+SURFACE_SECRETS_HOST_PATH=./offline/surface-secrets
+
+# Offline Kit configuration
+SCANNER_OFFLINEKIT_ENABLED=false
+SCANNER_OFFLINEKIT_REQUIREDSSE=true
+SCANNER_OFFLINEKIT_REKOROFFLINEMODE=true
+SCANNER_OFFLINEKIT_TRUSTROOTDIRECTORY=/etc/stellaops/trust-roots
+SCANNER_OFFLINEKIT_REKORSNAPSHOTDIRECTORY=/var/lib/stellaops/rekor-snapshot
+SCANNER_OFFLINEKIT_TRUSTROOTS_HOST_PATH=./offline/trust-roots
+SCANNER_OFFLINEKIT_REKOR_SNAPSHOT_HOST_PATH=./offline/rekor-snapshot
+
+# =============================================================================
+# SCHEDULER CONFIGURATION
+# =============================================================================
+
+# Queue configuration (Valkey only - NATS removed)
+SCHEDULER__QUEUE__KIND=Valkey
+SCHEDULER__QUEUE__VALKEY__URL=valkey:6379
+SCHEDULER_SCANNER_BASEADDRESS=http://scanner-web:8444
+
+# =============================================================================
+# REKOR / SIGSTORE CONFIGURATION
+# =============================================================================
+
+# Rekor server URL (default: public Sigstore, use http://rekor-v2:3000 for local)
+REKOR_SERVER_URL=https://rekor.sigstore.dev
+REKOR_VERSION=V2
+REKOR_TILE_BASE_URL=
+REKOR_LOG_ID=c0d23d6ad406973f9559f3ba2d1ca01f84147d8ffc5b8445c224f98b9591801d
+REKOR_TILES_IMAGE=ghcr.io/sigstore/rekor-tiles:latest
+
+# =============================================================================
+# ADVISORY AI CONFIGURATION
+# =============================================================================
+
+ADVISORY_AI_WEB_PORT=8448
+ADVISORY_AI_SBOM_BASEADDRESS=http://scanner-web:8444
+ADVISORY_AI_INFERENCE_MODE=Local
+ADVISORY_AI_REMOTE_BASEADDRESS=
+ADVISORY_AI_REMOTE_APIKEY=
+
+# =============================================================================
+# CRYPTO CONFIGURATION
+# =============================================================================
+
+# Crypto profile: default, china, russia, eu
+STELLAOPS_CRYPTO_PROFILE=default
+
+# Enable crypto simulation (for testing)
+STELLAOPS_CRYPTO_ENABLE_SIM=0
+STELLAOPS_CRYPTO_SIM_URL=http://sim-crypto:8080
+
+# CryptoPro (Russia only) - requires EULA acceptance
+CRYPTOPRO_PORT=18080
+CRYPTOPRO_ACCEPT_EULA=0
+CRYPTOPRO_CONTAINER_NAME=stellaops-signing
+CRYPTOPRO_USE_MACHINE_STORE=true
+CRYPTOPRO_PROVIDER_TYPE=80
+
+# SM Remote (China only)
+SM_REMOTE_PORT=56080
+SM_SOFT_ALLOWED=1
+SM_REMOTE_HSM_URL=
+SM_REMOTE_HSM_API_KEY=
+SM_REMOTE_HSM_TIMEOUT=30000
+
+# =============================================================================
+# NETWORKING
+# =============================================================================
+
+# External reverse proxy network (Traefik, Envoy, etc.)
+FRONTDOOR_NETWORK=stellaops_frontdoor
+
+# =============================================================================
+# TELEMETRY (optional)
+# =============================================================================
+
+OTEL_GRPC_PORT=4317
+OTEL_HTTP_PORT=4318
+OTEL_PROMETHEUS_PORT=9464
+PROMETHEUS_PORT=9090
+TEMPO_PORT=3200
+LOKI_PORT=3100
+PROMETHEUS_RETENTION=15d

deploy/compose/env/testing.env.example

@@ -0,0 +1,45 @@
+# =============================================================================
+# STELLA OPS TESTING ENVIRONMENT CONFIGURATION
+# =============================================================================
+# Environment template for docker-compose.testing.yml
+# Uses different ports to avoid conflicts with development/production.
+#
+# Usage:
+#   cp env/testing.env.example .env
+#   docker compose -f docker-compose.testing.yml --profile ci up -d
+#
+# =============================================================================
+
+# =============================================================================
+# CI INFRASTRUCTURE (different ports to avoid conflicts)
+# =============================================================================
+
+# PostgreSQL Test Database (port 5433)
+TEST_POSTGRES_PORT=5433
+TEST_POSTGRES_USER=stellaops_ci
+TEST_POSTGRES_PASSWORD=ci_test_password
+TEST_POSTGRES_DB=stellaops_test
+
+# Valkey Test (port 6380)
+TEST_VALKEY_PORT=6380
+
+# RustFS Test (port 8180)
+TEST_RUSTFS_PORT=8180
+
+# Mock Registry (port 5001)
+TEST_REGISTRY_PORT=5001
+
+# =============================================================================
+# GITEA CONFIGURATION
+# =============================================================================
+
+TEST_GITEA_PORT=3000
+TEST_GITEA_SSH_PORT=3022
+
+# =============================================================================
+# SIGSTORE TOOLS
+# =============================================================================
+
+# Rekor CLI and Cosign versions (for sigstore profile)
+REKOR_CLI_VERSION=v1.4.3
+COSIGN_VERSION=v3.0.4

deploy/compose/scripts/backup.sh

@@ -0,0 +1,28 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+echo "StellaOps Compose Backup"
+echo "This will create a tar.gz of PostgreSQL, RustFS (object-store), and Valkey data volumes."
+read -rp "Proceed? [y/N] " ans
+[[ ${ans:-N} =~ ^[Yy]$ ]] || { echo "Aborted."; exit 1; }
+
+TS=$(date -u +%Y%m%dT%H%M%SZ)
+OUT_DIR=${BACKUP_DIR:-backups}
+mkdir -p "$OUT_DIR"
+
+docker compose ps >/dev/null
+
+echo "Pausing worker containers for consistency..."
+docker compose pause scanner-worker scheduler-worker taskrunner-worker || true
+
+echo "Backing up volumes..."
+docker run --rm \
+  -v stellaops-postgres:/data/postgres:ro \
+  -v stellaops-rustfs:/data/rustfs:ro \
+  -v stellaops-valkey:/data/valkey:ro \
+  -v "$PWD/$OUT_DIR":/out \
+  alpine sh -c "cd / && tar czf /out/stellaops-backup-$TS.tar.gz data"
+
+docker compose unpause scanner-worker scheduler-worker taskrunner-worker || true
+
+echo "Backup written to $OUT_DIR/stellaops-backup-$TS.tar.gz"

deploy/compose/scripts/quickstart.sh

@@ -0,0 +1,25 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+COMPOSE_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"
+
+ENV_FILE="${1:-$COMPOSE_DIR/env/dev.env.example}"
+USE_MOCK="${USE_MOCK:-0}"
+
+FILES=(-f "$COMPOSE_DIR/docker-compose.dev.yaml")
+ENV_FILES=(--env-file "$ENV_FILE")
+
+if [[ "$USE_MOCK" == "1" ]]; then
+  FILES+=(-f "$COMPOSE_DIR/docker-compose.mock.yaml")
+  ENV_FILES+=(--env-file "$COMPOSE_DIR/env/mock.env.example")
+fi
+
+echo "Validating compose config..."
+docker compose "${ENV_FILES[@]}" "${FILES[@]}" config > /tmp/compose-validated.yaml
+echo "Config written to /tmp/compose-validated.yaml"
+
+echo "Starting stack..."
+docker compose "${ENV_FILES[@]}" "${FILES[@]}" up -d
+
+echo "Stack started. To stop: docker compose ${ENV_FILES[*]} ${FILES[*]} down"

deploy/compose/scripts/reset.sh

@@ -0,0 +1,15 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+echo "WARNING: This will stop the stack and wipe PostgreSQL, RustFS, and Valkey volumes."
+read -rp "Type 'RESET' to continue: " ans
+[[ ${ans:-} == "RESET" ]] || { echo "Aborted."; exit 1; }
+
+docker compose down
+
+for vol in stellaops-postgres stellaops-rustfs stellaops-valkey; do
+  echo "Removing volume $vol"
+  docker volume rm "$vol" || true
+done
+
+echo "Reset complete. Re-run compose with your env file to recreate volumes."