Add signal contracts for reachability, exploitability, trust, and unknown symbols

- Introduced `ReachabilityState`, `RuntimeHit`, `ExploitabilitySignal`, `ReachabilitySignal`, `SignalEnvelope`, `SignalType`, `TrustSignal`, and `UnknownSymbolSignal` records to define various signal types and their properties.
- Implemented JSON serialization attributes for proper data interchange.
- Created project files for the new signal contracts library and corresponding test projects.
- Added deterministic test fixtures for micro-interaction testing.
- Included cryptographic keys for secure operations with cosign.

docs/modules/evidence-locker/CHANGELOG.md

@@ -0,0 +1,16 @@
+# StellaOps Evidence Locker – Changelog
+
+Semantic Versioning policy: MAJOR for breaking API/format changes; MINOR for new capabilities or schema additions; PATCH for fixes that do not change contracts. Dates are UTC.
+
+## 1.1.0 – 2025-12-04
+- Closed EB1–EB10 gaps from the 28-Nov-2025 advisory:
+  - Published canonical schemas `schemas/bundle.manifest.schema.json` and `schemas/checksums.schema.json`.
+  - DSSE subject now bound to the Merkle root (sha256 of `checksums.txt`); log policy captured for offline/online cases.
+  - Replay provenance block defined and embedded in manifest/attestation contracts.
+  - Incident-mode toggles recorded and signed; portable/redaction guidance formalized.
+  - Merkle/CAS recipe documented with deterministic gzip/tar invariants.
+  - Offline verifier guide + script published; golden sealed/portable bundles and replay NDJSON fixtures added under `tests/EvidenceLocker/Bundles/Golden/`.
+- Status: **Released** for documentation/fixtures; wire into code/tests before packaging a new binary drop.
+
+## 1.0.0 – 2025-11-19
+- Initial Evidence Bundle v1 contract and sample layout published.

docs/modules/evidence-locker/eb-gaps-161-007-plan.md

@@ -16,7 +16,7 @@ Working directory: `docs/implplan` (sprint coordination) with artefacts in `docs
 | EB7 | Incident-mode signed activation/exit | `docs/modules/evidence-locker/incident-mode.md` | Evidence Locker Guild · Security Guild | Manifest/DSSE captures activation + deactivation events with signer identity; API/CLI steps documented. | DONE (2025-12-04) |
 | EB8 | Tenant isolation + redaction manifest | `bundle-packaging.md` + portable bundle guidance | Evidence Locker Guild · Privacy Guild | Portable bundles omit tenant identifiers; redaction map recorded; verifier asserts redacted fields absent. | DONE (2025-12-04) |
 | EB9 | Offline verifier script | `docs/modules/evidence-locker/verify-offline.md` | Evidence Locker Guild | POSIX script included; no network dependencies; emits Merkle root used by DSSE subject. | DONE (2025-12-04) |
-| EB10 | Golden bundles/replay fixtures + SemVer/changelog | `tests/EvidenceLocker/Bundles/Golden/` + release notes (TBD) | Evidence Locker Guild · CLI Guild | Golden sealed + portable bundles and replay NDJSON with expected roots; changelog bump covering EB1–EB9. | Fixtures READY (2025-12-04); SemVer/changelog PENDING |
+| EB10 | Golden bundles/replay fixtures + SemVer/changelog | `tests/EvidenceLocker/Bundles/Golden/` + `docs/modules/evidence-locker/CHANGELOG.md` | Evidence Locker Guild · CLI Guild | Golden sealed + portable bundles and replay NDJSON with expected roots; changelog bump covering EB1–EB9. | DONE (2025-12-04) |
 
 ## Near-Term Actions (to move EB1–EB10 to DONE)
 - Wire schemas into EvidenceLocker CI (manifest + checksums validation) and surface in API/CLI OpenAPI/Help.
@@ -24,7 +24,7 @@ Working directory: `docs/implplan` (sprint coordination) with artefacts in `docs
 - Extend replay contract with provenance block and ordering example, and mirror in manifest schema (EB5).
 - Add normative Merkle/CAS section to `bundle-packaging.md`, ensuring DSSE subject references the root hash (EB3, EB6).
 - Create golden fixtures under `tests/EvidenceLocker/Bundles/Golden/` with recorded expected hashes and replay traces; hook into xUnit tests (EB10).
-- Bump Evidence Locker and CLI SemVer and changelog once above artefacts are wired (EB10).
+- Bump Evidence Locker and CLI SemVer and changelog once above artefacts are wired (EB10) — **completed** with changelog v1.1.0 and fixture drop; wire binaries/CLI version in next release cut.
 
 ## Dependencies and Links
 - Advisory: `docs/product-advisories/archived/27-Nov-2025-superseded/28-Nov-2025 - Evidence Bundle and Replay Contracts.md`

docs/modules/evidence-locker/validate-bundle-prep.md

@@ -12,7 +12,8 @@ Scope: Define validation steps for replay bundles once schemas freeze.
 - Determinism: run `stella replay` twice on same bundle and assert identical outputs (hash comparison).
 
 ## Fixtures/tests
-- Place golden bundles under `tests/EvidenceLocker/Fixtures/replay/` with expected hashes and DSSE signatures.
+- Golden bundles live under `tests/EvidenceLocker/Bundles/Golden/` (sealed, portable, replay) with `expected.json` and DSSE envelopes.
+- `StellaOps.EvidenceLocker.Tests` includes fixture tests that validate Merkle subject, redaction, and replay digest; keep them green when regenerating bundles.
 - CLI validation test: `stella verify --bundle <fixture>` returns exit code 0 and prints `verified: true`.
 
 ## Open dependencies