Add new features and tests for AirGap and Time modules

- Introduced `SbomService` tasks documentation.
- Updated `StellaOps.sln` to include new projects: `StellaOps.AirGap.Time` and `StellaOps.AirGap.Importer`.
- Added unit tests for `BundleImportPlanner`, `DsseVerifier`, `ImportValidator`, and other components in the `StellaOps.AirGap.Importer.Tests` namespace.
- Implemented `InMemoryBundleRepositories` for testing bundle catalog and item repositories.
- Created `MerkleRootCalculator`, `RootRotationPolicy`, and `TufMetadataValidator` tests.
- Developed `StalenessCalculator` and `TimeAnchorLoader` tests in the `StellaOps.AirGap.Time.Tests` namespace.
- Added `fetch-sbomservice-deps.sh` script for offline dependency fetching.

docs/modules/export-center/prep/2025-11-20-crypto-90-001-prep.md

@@ -0,0 +1,17 @@
+# Export Crypto Prep — PREP-EXPORT-CRYPTO-90-001
+
+Status: Draft (2025-11-20)
+Owners: Exporter Service · Security Guild
+Scope: Capture crypto requirements pending Nov-18 review and reference implementation.
+
+## Needs
+- Mapping of signing/encryption algorithms per export profile.
+- Integration with `ICryptoProviderRegistry` (same as Evidence Locker) for provider selection.
+- Hashing defaults (sha256) and optional sha512/sha3 for high-assurance paths.
+
+## Open decisions
+- Final provider list and key storage (KMS/HSM) per profile.
+- Whether to sign both manifest and per-artifact hashes.
+
+## Handoff
+Use as prep artefact for EXPORT-CRYPTO-90-001; fill once Security delivers profile list and reference implementation.

docs/modules/export-center/prep/2025-11-20-exporter-evid-blocker.md

@@ -0,0 +1,15 @@
+# Exporter Service Blocker — PREP-EXPORTER-SERVICE-BLOCKED-WAITING-ON-EVID
+
+Status: Draft (2025-11-20)
+Owners: Planning
+Scope: Document EvidenceLocker dependency blocking exporter service.
+
+## Blocker
+- EvidenceLocker spec not published; need replay/export bundle schemas and ICryptoProviderRegistry availability.
+
+## What we need
+- Bundle schema pointers (from EvidenceLocker) and retention rules.
+- Sample payloads to mirror into exporter tests.
+
+## Handoff
+Use this note to track unblock; update when EvidenceLocker spec is available.

docs/modules/export-center/prep/2025-11-20-notify-obs-52-prep.md

@@ -0,0 +1,29 @@
+# Export Notifications Schema Prep — PREP-EXPORT-NOTIFY-SCHEMA-OBS-52
+
+Status: Draft (2025-11-20)
+Owners: Notifications Guild · Exporter Service
+Scope: Define notification envelope/payloads for export lifecycle events.
+
+## Event types
+- `export.started`, `export.completed`, `export.failed`.
+
+## Envelope (proposed)
+```json
+{
+  "type": "export.completed",
+  "export_id": "...",
+  "profile_id": "...",
+  "tenant_id": "...",
+  "artifact_counts": {"json": 2, "mirror": 1},
+  "sha256": "...",
+  "created_at": "2025-11-20T00:00:00Z"
+}
+```
+- Deterministic key ordering; timestamps UTC.
+
+## Open decisions
+- Channel/transport (NATS vs Redis streams vs webhooks).
+- Required retry/backoff policy and DLQ routing.
+
+## Handoff
+Use this prep doc for PREP-EXPORT-NOTIFY-SCHEMA-OBS-52; update once transport + DLQ policy are chosen.

docs/modules/export-center/prep/2025-11-20-obs-50-001-prep.md

@@ -0,0 +1,17 @@
+# Export Telemetry Prep — PREP-EXPORT-OBS-50-001
+
+Status: Draft (2025-11-20)
+Owners: Exporter Service · Observability Guild
+Scope: Define telemetry schema for exporter service bootstrap.
+
+## Proposed metrics/logs
+- Metrics (Prometheus/Otel): `export_runs_total{profile, tenant}`, `export_run_duration_seconds`, `export_artifacts_total{type}`, `export_failures_total`, `export_bytes_total`.
+- Logs: structured with fields `{export_id, profile, tenant, artifact_type, status, duration_ms}`.
+- Traces: span names `export.run`, `export.plan`, `export.write`; tags include `profile`, `tenant`, `artifact_count`.
+
+## Open decisions
+- Histogram buckets for duration/bytes.
+- Required correlation IDs for downstream Console ingestion.
+
+## Handoff
+Use this as PREP artefact for EXPORT-OBS-50-001; update buckets and trace tags once Observability finalizes naming.

docs/modules/export-center/prep/2025-11-20-risk-69-001-prep.md

@@ -0,0 +1,21 @@
+# Export Risk Bundle Prep — PREP-EXPORT-RISK-69-001
+
+Status: Draft (2025-11-20)
+Owners: Exporter Service · Risk Bundle Export Guild
+Scope: Capture provider selection rules and schema needs for risk bundle job handler.
+
+## Provider selection (proposed)
+- Inputs: `risk_profile_id`, `tenant_id`, `preferred_provider`, `fallback_provider`.
+- Selection order: tenant override → profile default → system default.
+- Providers must advertise capabilities `{formats[], signing_profiles[]}`.
+
+## Manifest expectations
+- Fields: `bundle_id`, `profile_id`, `provider_id`, `inputs_hash`, `created_at`, `artifacts[] {path, sha256, media_type}`.
+- Deterministic ordering and sha256 for all artifacts.
+
+## Open decisions
+- Final list of providers and signing profiles.
+- Whether to embed policy/export bundle pointers.
+
+## Handoff
+Use this as PREP artefact for EXPORT-RISK-69-001; update provider list and manifest once phase I artifacts land.

docs/modules/export-center/prep/2025-11-20-svc-35-001-prep.md

@@ -0,0 +1,21 @@
+# Export Service Bootstrap Prep — PREP-EXPORT-SVC-35-001
+
+Status: Draft (2025-11-20)
+Owners: Exporter Service
+Scope: Capture phase I readiness for exporter service project/migrations.
+
+## Project baseline
+- Service: minimal API (net10.0), Postgres storage for `export_profiles`, `export_runs`, `export_inputs`, `export_distributions`.
+- Tests: xUnit + integration harness with deterministic timestamps.
+
+## Schema notes
+- `export_profiles`: `{id, name, tenant_id?, config_json}`.
+- `export_runs`: `{id, profile_id, tenant_id, status, started_at, completed_at, artifact_counts JSONB}`.
+- Deterministic defaults: UTC timestamps; snake_case columns.
+
+## Open decisions
+- Final Postgres schema (indices, enums for status).
+- Whether to store metrics snapshots inline or via observability pipeline.
+
+## Handoff
+Use this as PREP artefact for EXPORT-SVC-35-001; update once phase I readiness and synthetic telemetry feeds are defined.

docs/modules/export-center/prep/2025-11-20-svc-35-002-prep.md

@@ -0,0 +1,20 @@
+# Export Service Planner Prep — PREP-EXPORT-SVC-35-002
+
+Status: Draft (2025-11-20)
+Owners: Exporter Service
+Scope: Planner + scope resolver for exports, depends on 35-001 bootstrap.
+
+## Planner inputs
+- `profile_id`, `tenant_id`, `inputs` (bundle pointers), `priority`.
+- `limits`: max artifacts, max runtime.
+
+## Outputs
+- Plan document `{plan_id, profile_id, tenant_id, steps[], estimated_bytes, estimated_duration_ms}`.
+- Steps sorted; deterministic hashing of plan.
+
+## Open decisions
+- Step types allowed (json adapters, mirror, manifest signing).
+- How to surface rejection reasons to upstream services.
+
+## Handoff
+Use as prep artefact; update once 35-001 schema is fixed.

docs/modules/export-center/prep/2025-11-20-svc-35-003-prep.md

@@ -0,0 +1,16 @@
+# Export JSON Adapter Prep — PREP-EXPORT-SVC-35-003
+
+Status: Draft (2025-11-20)
+Owners: Exporter Service
+Scope: JSON adapters (`json:raw`, `json:policy`) normalization/redaction/compression.
+
+## Deliverable shape
+- Adapter config: `{type, redactions[], compress: bool, normalize_paths: bool}`.
+- Output manifest entry: `{path, sha256, media_type, original_size, compressed_size?}`.
+
+## Open decisions
+- Redaction rules list and ordering.
+- Compression algorithm (gzip vs zstd) and level defaults.
+
+## Handoff
+Prep artefact for 35-003; align with plan model once 35-002 is fixed.

docs/modules/export-center/prep/2025-11-20-svc-35-004-prep.md

@@ -0,0 +1,17 @@
+# Export Mirror Adapter Prep — PREP-EXPORT-SVC-35-004
+
+Status: Draft (2025-11-20)
+Owners: Exporter Service
+Scope: Mirror (full) adapter producing filesystem layout, indexes, manifests, README.
+
+## Layout proposal
+- root manifest `mirror.manifest.json` with Merkle root.
+- Directories: `artifacts/`, `indexes/`, `docs/README.md`.
+- Deterministic ordering, UTC timestamps.
+
+## Open decisions
+- Which indexes required (by profile vs dataset).
+- Manifest fields alignment with Mirror thin bundle.
+
+## Handoff
+Use as prep artefact; fill fields once 35-003 outputs and mirror schema decisions are in.

docs/modules/export-center/prep/2025-11-20-svc-35-005-prep.md

@@ -0,0 +1,16 @@
+# Export Manifest/Signing Prep — PREP-EXPORT-SVC-35-005
+
+Status: Draft (2025-11-20)
+Owners: Exporter Service · Security Guild
+Scope: Manifest/provenance writer + KMS signing/attestation.
+
+## Proposed manifest
+- `export_id`, `profile_id`, `tenant_id`, `artifacts[] {path, sha256, media_type}`, `created_at`, `inputs_hash`, `signatures[]`.
+- DSSE envelope for manifest; signer from ICryptoProviderRegistry.
+
+## Open decisions
+- Signing profile list and KMS/HSM mapping.
+- Rekor/Transparency use in offline vs online.
+
+## Handoff
+Prep artefact for 35-005; update once crypto profile and provider registry decisions land.