stella-ops.org/git.stella-ops.org
1
0
Fork 0
Code Issues Pull Requests Actions 2 Releases Wiki Activity

feat: add stella-callgraph-node for JavaScript/TypeScript call graph extraction

Browse Source 
- Implemented a new tool `stella-callgraph-node` that extracts call graphs from JavaScript/TypeScript projects using Babel AST.
- Added command-line interface with options for JSON output and help.
- Included functionality to analyze project structure, detect functions, and build call graphs.
- Created a package.json file for dependency management.

feat: introduce stella-callgraph-python for Python call graph extraction

- Developed `stella-callgraph-python` to extract call graphs from Python projects using AST analysis.
- Implemented command-line interface with options for JSON output and verbose logging.
- Added framework detection to identify popular web frameworks and their entry points.
- Created an AST analyzer to traverse Python code and extract function definitions and calls.
- Included requirements.txt for project dependencies.

chore: add framework detection for Python projects

- Implemented framework detection logic to identify frameworks like Flask, FastAPI, Django, and others based on project files and import patterns.
- Enhanced the AST analyzer to recognize entry points based on decorators and function definitions.
This commit is contained in:
master
2025-12-19 18:11:59 +02:00
parent 951a38d561
commit 8779e9226f
130 changed files with 19011 additions and 422 deletions
Download Patch File Download Diff File Expand all files Collapse all files

0
docs/implplan/archived/SPRINT_0120_0001_0002_excititor_ii.md → docs/implplan/SPRINT_0120_0001_0002_excititor_ii.md
View File

0
docs/implplan/archived/SPRINT_0140_0001_0001_runtime_signals.md → docs/implplan/SPRINT_0140_0001_0001_runtime_signals.md
View File

0
docs/implplan/archived/SPRINT_0170_0001_0001_notifications_telemetry.md → docs/implplan/SPRINT_0170_0001_0001_notifications_telemetry.md
View File

0
docs/implplan/archived/SPRINT_0211_0001_0003_ui_iii.md → docs/implplan/SPRINT_0211_0001_0003_ui_iii.md
View File

0
docs/implplan/archived/SPRINT_0216_0001_0001_web_v.md → docs/implplan/SPRINT_0216_0001_0001_web_v.md
View File

0
docs/implplan/archived/SPRINT_0406_0001_0001_scanner_node_detection_gaps.md → docs/implplan/SPRINT_0406_0001_0001_scanner_node_detection_gaps.md
View File

0
docs/implplan/archived/SPRINT_0407_0001_0001_scanner_bun_detection_gaps.md → docs/implplan/SPRINT_0407_0001_0001_scanner_bun_detection_gaps.md
View File

0
docs/implplan/archived/SPRINT_0410_0001_0001_entrypoint_detection_reengineering_program.md → docs/implplan/SPRINT_0410_0001_0001_entrypoint_detection_reengineering_program.md
View File

0
docs/implplan/archived/SPRINT_0411_0001_0001_semantic_entrypoint_engine.md → docs/implplan/SPRINT_0411_0001_0001_semantic_entrypoint_engine.md
View File

0
docs/implplan/archived/SPRINT_3407_0001_0001_postgres_cleanup.md → docs/implplan/SPRINT_3407_0001_0001_postgres_cleanup.md
View File

3
docs/implplan/SPRINT_3600_0001_0001_reachability_drift_master.md
View File

@@ -111,6 +111,7 @@ SPRINT_3600_0004 (UI) API Integration
| Date (UTC) | Action | Owner | Notes |
|---|---|---|---|
| 2025-12-17 | Created master sprint from advisory analysis | Agent | Initial planning |
| 2025-12-19 | RDRIFT-MASTER-0006 DONE: Created docs/airgap/reachability-drift-airgap-workflows.md | Agent | Air-gap workflows documented |
---
@@ -269,7 +270,7 @@ SPRINT_3600_0004 (UI) Integration
| 3 | RDRIFT-MASTER-0003 | 3600 | DONE | Update Scanner AGENTS.md |
| 4 | RDRIFT-MASTER-0004 | 3600 | DONE | Update Web AGENTS.md |
| 5 | RDRIFT-MASTER-0005 | 3600 | TODO | Validate benchmark cases pass |
| 6 | RDRIFT-MASTER-0006 | 3600 | TODO | Document air-gap workflows |
| 6 | RDRIFT-MASTER-0006 | 3600 | DONE | Document air-gap workflows |
---

51
docs/implplan/SPRINT_3610_0001_0001_java_callgraph.md
View File

@@ -180,26 +180,26 @@ Java sinks from `SinkTaxonomy.cs`:
| # | Task ID | Status | Description |
|---|---------|--------|-------------|
| 1 | JCG-001 | TODO | Create JavaCallGraphExtractor.cs skeleton |
| 2 | JCG-002 | TODO | Set up IKVM.NET / ASM interop |
| 3 | JCG-003 | TODO | Implement .class file discovery (JARs, WARs, dirs) |
| 4 | JCG-004 | TODO | Implement ASM ClassVisitor for method extraction |
| 5 | JCG-005 | TODO | Implement method call extraction (INVOKE* opcodes) |
| 6 | JCG-006 | TODO | Implement INVOKEDYNAMIC handling (lambdas) |
| 7 | JCG-007 | TODO | Implement annotation reading |
| 8 | JCG-008 | TODO | Implement Spring MVC entrypoint detection |
| 9 | JCG-009 | TODO | Implement JAX-RS entrypoint detection |
| 10 | JCG-010 | TODO | Implement Spring Scheduler detection |
| 11 | JCG-011 | TODO | Implement Spring Kafka/AMQP detection |
| 12 | JCG-012 | TODO | Implement Micronaut entrypoint detection |
| 13 | JCG-013 | TODO | Implement Quarkus entrypoint detection |
| 14 | JCG-014 | TODO | Implement Java sink matching |
| 15 | JCG-015 | TODO | Implement stable symbol ID generation |
| 16 | JCG-016 | TODO | Add benchmark: java-spring-deserialize |
| 17 | JCG-017 | TODO | Add benchmark: java-spring-guarded |
| 18 | JCG-018 | TODO | Unit tests for JavaCallGraphExtractor |
| 19 | JCG-019 | TODO | Integration tests with Testcontainers |
| 20 | JCG-020 | TODO | Verify deterministic output |
| 1 | JCG-001 | DONE | Create JavaCallGraphExtractor.cs skeleton |
| 2 | JCG-002 | DONE | Set up pure .NET bytecode parsing (no IKVM required) |
| 3 | JCG-003 | DONE | Implement .class file discovery (JARs, WARs, dirs) |
| 4 | JCG-004 | DONE | Implement bytecode parser for method extraction |
| 5 | JCG-005 | DONE | Implement method call extraction (INVOKE* opcodes) |
| 6 | JCG-006 | DONE | Implement INVOKEDYNAMIC handling (lambdas) |
| 7 | JCG-007 | DONE | Implement annotation reading |
| 8 | JCG-008 | DONE | Implement Spring MVC entrypoint detection |
| 9 | JCG-009 | DONE | Implement JAX-RS entrypoint detection |
| 10 | JCG-010 | DONE | Implement Spring Scheduler detection |
| 11 | JCG-011 | DONE | Implement Spring Kafka/AMQP detection |
| 12 | JCG-012 | DONE | Implement Micronaut entrypoint detection |
| 13 | JCG-013 | DONE | Implement Quarkus entrypoint detection |
| 14 | JCG-014 | DONE | Implement Java sink matching |
| 15 | JCG-015 | DONE | Implement stable symbol ID generation |
| 16 | JCG-016 | DONE | Add benchmark: java-spring-deserialize |
| 17 | JCG-017 | DONE | Add benchmark: java-spring-guarded |
| 18 | JCG-018 | DONE | Unit tests for JavaCallGraphExtractor |
| 19 | JCG-019 | DONE | Integration tests with Testcontainers |
| 20 | JCG-020 | DONE | Verify deterministic output |
---
@@ -284,3 +284,14 @@ Java sinks from `SinkTaxonomy.cs`:
- [JVM Specification - Instructions](https://docs.oracle.com/javase/specs/jvms/se17/html/jvms-6.html)
- [Spring MVC Annotations](https://docs.spring.io/spring-framework/docs/current/reference/html/web.html)
- [JAX-RS Specification](https://jakarta.ee/specifications/restful-ws/)
---
## Execution Log
| Date (UTC) | Update | Owner |
|------------|--------|-------|
| 2025-12-19 | Fixed build errors: SinkCategory enum mismatches, EntrypointType.EventHandler added, duplicate switch cases removed, CallGraphEdgeComparer extracted to shared location. | Agent |
| 2025-12-19 | Files now compile: JavaCallGraphExtractor.cs, JavaBytecodeAnalyzer.cs, JavaEntrypointClassifier.cs, JavaSinkMatcher.cs. | Agent |
| 2025-12-19 | JCG-018 DONE: Created JavaCallGraphExtractorTests.cs with 24 unit tests covering entrypoint classification (Spring, JAX-RS, gRPC, Kafka, Scheduled, main), sink matching (CmdExec, SqlRaw, UnsafeDeser, Ssrf, XXE, CodeInjection), bytecode parsing, and integration tests. All tests pass. | Agent |
| 2025-12-19 | JCG-020 DONE: Added 6 determinism verification tests. Fixed BinaryRelocation.SymbolIndex property. All 30 tests pass. | Agent |

46
docs/implplan/SPRINT_3610_0002_0001_go_callgraph.md
View File

@@ -269,29 +269,29 @@ Go sinks from `SinkTaxonomy.cs`:
| # | Task ID | Status | Description |
|---|---------|--------|-------------|
| 1 | GCG-001 | TODO | Create GoCallGraphExtractor.cs skeleton |
| 2 | GCG-002 | TODO | Create stella-callgraph-go project structure |
| 3 | GCG-003 | TODO | Implement Go module loading (packages.Load) |
| 4 | GCG-004 | TODO | Implement SSA program building |
| 5 | GCG-005 | TODO | Implement CHA call graph analysis |
| 6 | GCG-006 | TODO | Implement RTA call graph analysis |
| 7 | GCG-007 | TODO | Implement JSON output formatting |
| 8 | GCG-008 | TODO | Implement net/http entrypoint detection |
| 9 | GCG-009 | TODO | Implement Gin entrypoint detection |
| 10 | GCG-010 | TODO | Implement Echo entrypoint detection |
| 11 | GCG-011 | TODO | Implement Fiber entrypoint detection |
| 12 | GCG-012 | TODO | Implement Chi entrypoint detection |
| 13 | GCG-013 | TODO | Implement gRPC server detection |
| 14 | GCG-014 | TODO | Implement Cobra CLI detection |
| 15 | GCG-015 | TODO | Implement Go sink detection |
| 16 | GCG-016 | TODO | Create GoSsaResultParser.cs |
| 17 | GCG-017 | TODO | Create GoEntrypointClassifier.cs |
| 18 | GCG-018 | TODO | Create GoSymbolIdBuilder.cs |
| 19 | GCG-019 | TODO | Add benchmark: go-gin-exec |
| 20 | GCG-020 | TODO | Add benchmark: go-grpc-sql |
| 21 | GCG-021 | TODO | Unit tests for GoCallGraphExtractor |
| 22 | GCG-022 | TODO | Integration tests |
| 23 | GCG-023 | TODO | Verify deterministic output |
| 1 | GCG-001 | DONE | Create GoCallGraphExtractor.cs skeleton |
| 2 | GCG-002 | DONE | Create stella-callgraph-go project structure |
| 3 | GCG-003 | DONE | Implement Go module loading (packages.Load) |
| 4 | GCG-004 | DONE | Implement SSA program building |
| 5 | GCG-005 | DONE | Implement CHA call graph analysis |
| 6 | GCG-006 | DONE | Implement RTA call graph analysis |
| 7 | GCG-007 | DONE | Implement JSON output formatting |
| 8 | GCG-008 | DONE | Implement net/http entrypoint detection |
| 9 | GCG-009 | DONE | Implement Gin entrypoint detection |
| 10 | GCG-010 | DONE | Implement Echo entrypoint detection |
| 11 | GCG-011 | DONE | Implement Fiber entrypoint detection |
| 12 | GCG-012 | DONE | Implement Chi entrypoint detection |
| 13 | GCG-013 | DONE | Implement gRPC server detection |
| 14 | GCG-014 | DONE | Implement Cobra CLI detection |
| 15 | GCG-015 | DONE | Implement Go sink detection |
| 16 | GCG-016 | DONE | Create GoSsaResultParser.cs |
| 17 | GCG-017 | DONE | Create GoEntrypointClassifier.cs |
| 18 | GCG-018 | DONE | Create GoSymbolIdBuilder.cs |
| 19 | GCG-019 | DONE | Add benchmark: go-gin-exec |
| 20 | GCG-020 | DONE | Add benchmark: go-grpc-sql |
| 21 | GCG-021 | DONE | Unit tests for GoCallGraphExtractor |
| 22 | GCG-022 | DONE | Integration tests |
| 23 | GCG-023 | DONE | Verify deterministic output |
---

35
docs/implplan/SPRINT_3610_0003_0001_nodejs_callgraph.md
View File

@@ -61,24 +61,27 @@ Implement Node.js call graph extraction using Babel AST parsing via an external
| # | Task ID | Status | Description |
|---|---------|--------|-------------|
| 1 | NCG-001 | TODO | Create stella-callgraph-node project |
| 2 | NCG-002 | TODO | Implement Babel AST analysis |
| 3 | NCG-003 | TODO | Implement CallExpression extraction |
| 4 | NCG-004 | TODO | Implement require/import resolution |
| 5 | NCG-005 | TODO | Implement Express detection |
| 6 | NCG-006 | TODO | Implement Fastify detection |
| 7 | NCG-007 | TODO | Implement NestJS decorator detection |
| 8 | NCG-008 | TODO | Implement socket.io detection |
| 9 | NCG-009 | TODO | Implement AWS Lambda detection |
| 10 | NCG-010 | TODO | Update NodeCallGraphExtractor.cs |
| 11 | NCG-011 | TODO | Create BabelResultParser.cs |
| 12 | NCG-012 | TODO | Unit tests |
| 1 | NCG-001 | DONE | Create stella-callgraph-node project |
| 2 | NCG-002 | DONE | Implement Babel AST analysis |
| 3 | NCG-003 | DONE | Implement CallExpression extraction |
| 4 | NCG-004 | DONE | Implement require/import resolution |
| 5 | NCG-005 | DONE | Implement Express detection |
| 6 | NCG-006 | DONE | Implement Fastify detection |
| 7 | NCG-007 | DONE | Implement NestJS decorator detection |
| 8 | NCG-008 | DONE | Implement socket.io detection |
| 9 | NCG-009 | DONE | Implement AWS Lambda detection |
| 10 | NCG-010 | DONE | Update NodeCallGraphExtractor.cs (JavaScriptCallGraphExtractor.cs created) |
| 11 | NCG-011 | DONE | Create BabelResultParser.cs |
| 12 | NCG-012 | DONE | Unit tests |
| 13 | NCG-013 | DONE | Create JsEntrypointClassifier.cs |
| 14 | NCG-014 | DONE | Create JsSinkMatcher.cs |
| 15 | NCG-015 | DONE | Create framework-detect.js |
---
## Acceptance Criteria
- [ ] Babel AST analysis working for JS/TS
- [ ] Express/Fastify/NestJS entrypoints detected
- [ ] socket.io/Lambda entrypoints detected
- [ ] Node.js sinks matched (child_process, eval)
- [x] Babel AST analysis working for JS/TS
- [x] Express/Fastify/NestJS entrypoints detected
- [x] socket.io/Lambda entrypoints detected
- [x] Node.js sinks matched (child_process, eval)

32
docs/implplan/SPRINT_3610_0004_0001_python_callgraph.md
View File

@@ -60,23 +60,25 @@ Implement Python call graph extraction using AST analysis via an external tool,
| # | Task ID | Status | Description |
|---|---------|--------|-------------|
| 1 | PCG-001 | TODO | Create stella-callgraph-python project |
| 2 | PCG-002 | TODO | Implement Python AST analysis |
| 3 | PCG-003 | TODO | Implement Flask detection |
| 4 | PCG-004 | TODO | Implement FastAPI detection |
| 5 | PCG-005 | TODO | Implement Django URL detection |
| 6 | PCG-006 | TODO | Implement Click/argparse detection |
| 7 | PCG-007 | TODO | Implement Celery detection |
| 8 | PCG-008 | TODO | Create PythonCallGraphExtractor.cs |
| 9 | PCG-009 | TODO | Python sinks (pickle, subprocess, eval) |
| 10 | PCG-010 | TODO | Unit tests |
| 1 | PCG-001 | DONE | Create stella-callgraph-python project |
| 2 | PCG-002 | DONE | Implement Python AST analysis |
| 3 | PCG-003 | DONE | Implement Flask detection |
| 4 | PCG-004 | DONE | Implement FastAPI detection |
| 5 | PCG-005 | DONE | Implement Django URL detection |
| 6 | PCG-006 | DONE | Implement Click/argparse detection |
| 7 | PCG-007 | DONE | Implement Celery detection |
| 8 | PCG-008 | DONE | Create PythonCallGraphExtractor.cs |
| 9 | PCG-009 | DONE | Python sinks (pickle, subprocess, eval) |
| 10 | PCG-010 | DONE | Unit tests |
| 11 | PCG-011 | DONE | Create PythonEntrypointClassifier.cs |
| 12 | PCG-012 | DONE | Create PythonSinkMatcher.cs |
---
## Acceptance Criteria
- [ ] Python AST analysis working
- [ ] Flask/FastAPI/Django entrypoints detected
- [ ] Click CLI entrypoints detected
- [ ] Celery task entrypoints detected
- [ ] Python sinks matched
- [x] Python AST analysis working
- [x] Flask/FastAPI/Django entrypoints detected
- [x] Click CLI entrypoints detected
- [x] Celery task entrypoints detected
- [x] Python sinks matched

32
docs/implplan/SPRINT_3610_0005_0001_ruby_php_bun_deno.md
View File

@@ -51,22 +51,26 @@ Implement call graph extractors for Ruby, PHP, Bun, and Deno runtimes.
| # | Task ID | Status | Description |
|---|---------|--------|-------------|
| 1 | RCG-001 | TODO | Implement RubyCallGraphExtractor |
| 2 | RCG-002 | TODO | Rails ActionController detection |
| 3 | RCG-003 | TODO | Sinatra route detection |
| 4 | PHP-001 | TODO | Implement PhpCallGraphExtractor |
| 5 | PHP-002 | TODO | Laravel route detection |
| 6 | PHP-003 | TODO | Symfony annotation detection |
| 7 | BUN-001 | TODO | Implement BunCallGraphExtractor |
| 8 | BUN-002 | TODO | Elysia entrypoint detection |
| 9 | DENO-001 | TODO | Implement DenoCallGraphExtractor |
| 10 | DENO-002 | TODO | Oak/Fresh entrypoint detection |
| 1 | RCG-001 | DONE | Implement RubyCallGraphExtractor |
| 2 | RCG-002 | DONE | Rails ActionController detection |
| 3 | RCG-003 | DONE | Sinatra route detection |
| 4 | RCG-004 | DONE | Create RubyEntrypointClassifier |
| 5 | RCG-005 | DONE | Create RubySinkMatcher |
| 6 | PHP-001 | DONE | Implement PhpCallGraphExtractor |
| 7 | PHP-002 | DONE | Laravel route detection |
| 8 | PHP-003 | DONE | Symfony annotation detection |
| 9 | PHP-004 | DONE | Create PhpEntrypointClassifier |
| 10 | PHP-005 | DONE | Create PhpSinkMatcher |
| 11 | BUN-001 | DONE | Implement BunCallGraphExtractor |
| 12 | BUN-002 | DONE | Elysia entrypoint detection |
| 13 | DENO-001 | DONE | Implement DenoCallGraphExtractor |
| 14 | DENO-002 | DONE | Oak/Fresh entrypoint detection |
---
## Acceptance Criteria
- [ ] Ruby call graph extraction working (Rails, Sinatra)
- [ ] PHP call graph extraction working (Laravel, Symfony)
- [ ] Bun call graph extraction working (Elysia)
- [ ] Deno call graph extraction working (Oak, Fresh)
- [x] Ruby call graph extraction working (Rails, Sinatra)
- [x] PHP call graph extraction working (Laravel, Symfony)
- [x] Bun call graph extraction working (Elysia)
- [x] Deno call graph extraction working (Oak, Fresh)

28
docs/implplan/SPRINT_3610_0006_0001_binary_callgraph.md
View File

@@ -57,21 +57,23 @@ Implement binary call graph extraction using symbol table and relocation analysi
| # | Task ID | Status | Description |
|---|---------|--------|-------------|
| 1 | BCG-001 | TODO | Create BinaryCallGraphExtractor |
| 2 | BCG-002 | TODO | Implement ELF symbol reading |
| 3 | BCG-003 | TODO | Implement PE symbol reading |
| 4 | BCG-004 | TODO | Implement Mach-O symbol reading |
| 5 | BCG-005 | TODO | Implement DWARF parsing |
| 6 | BCG-006 | TODO | Implement relocation-based edges |
| 7 | BCG-007 | TODO | Implement init array detection |
| 8 | BCG-008 | TODO | Unit tests |
| 1 | BCG-001 | DONE | Create BinaryCallGraphExtractor |
| 2 | BCG-002 | DONE | Implement ELF symbol reading |
| 3 | BCG-003 | DONE | Implement PE symbol reading |
| 4 | BCG-004 | DONE | Implement Mach-O symbol reading |
| 5 | BCG-005 | DONE | Implement DWARF parsing |
| 6 | BCG-006 | DONE | Implement relocation-based edges |
| 7 | BCG-007 | DONE | Implement init array detection |
| 8 | BCG-008 | DONE | Unit tests |
| 9 | BCG-009 | DONE | Create BinaryEntrypointClassifier |
| 10 | BCG-010 | DONE | Create DwarfDebugReader.cs |
---
## Acceptance Criteria
- [ ] ELF symbol table extracted
- [ ] PE symbol table extracted
- [ ] Mach-O symbol table extracted
- [ ] Relocation-based call edges created
- [ ] Init array/ctors entrypoints detected
- [x] ELF symbol table extracted
- [x] PE symbol table extracted
- [x] Mach-O symbol table extracted
- [x] Relocation-based call edges created
- [x] Init array/ctors entrypoints detected

2
docs/implplan/SPRINT_3700_0004_0001_reachability_integration.md
View File

@@ -100,7 +100,7 @@ Integrate vulnerability surfaces into the reachability analysis pipeline:
| 10 | REACH-010 | DONE | Update ReachabilityReport with surface metadata |
| 11 | REACH-011 | DONE | Add surface cache for repeated lookups |
| 12 | REACH-012 | DONE | Create SurfaceQueryServiceTests |
| 13 | REACH-013 | TODO | Integration tests with end-to-end flow |
| 13 | REACH-013 | BLOCKED | Integration tests with end-to-end flow - requires IReachabilityGraphService mock setup and ICallGraphAccessor fixture |
| 14 | REACH-014 | DONE | Update reachability documentation |
| 15 | REACH-015 | DONE | Add metrics for surface hit/miss |

12
docs/implplan/SPRINT_3700_0005_0001_witness_ui_cli.md
View File

@@ -120,17 +120,17 @@ Badge Colors:
| 4 | UI-004 | DONE | Implement signature verification in browser |
| 5 | UI-005 | DONE | Add witness.service.ts API client |
| 6 | UI-006 | DONE | Create ConfidenceTierBadgeComponent |
| 7 | UI-007 | TODO | Integrate modal into VulnerabilityExplorer |
| 8 | UI-008 | TODO | Add "Show Witness" button to vuln rows |
| 7 | UI-007 | DONE | Integrate modal into VulnerabilityExplorer |
| 8 | UI-008 | DONE | Add "Show Witness" button to vuln rows |
| 9 | UI-009 | DONE | Add download JSON functionality |
| 10 | CLI-001 | DONE | Add `stella witness show <id>` command |
| 11 | CLI-002 | DONE | Add `stella witness verify <id>` command |
| 12 | CLI-003 | DONE | Add `stella witness list --scan <id>` command |
| 13 | CLI-004 | DONE | Add `stella witness export <id> --format json|sarif` |
| 14 | PR-001 | TODO | Add PR annotation with state flip summary |
| 15 | PR-002 | TODO | Link to witnesses in PR comments |
| 16 | TEST-001 | TODO | Create WitnessModalComponent tests |
| 17 | TEST-002 | TODO | Create CLI witness command tests |
| 14 | PR-001 | DONE | Add PR annotation with state flip summary |
| 15 | PR-002 | DONE | Link to witnesses in PR comments |
| 16 | TEST-001 | DONE | Create WitnessModalComponent tests |
| 17 | TEST-002 | DONE | Create CLI witness command tests |
---

49
docs/implplan/SPRINT_5000_0001_0001_advisory_alignment.md
View File

@@ -238,25 +238,40 @@ This sprint addresses architectural alignment between StellaOps and the referenc
| Task | Status | Notes |
|------|--------|-------|
| 1.1 Research CycloneDX.Core 10.0.2+ | TODO | Check GitHub releases |
| 1.2 Update Package References | TODO | 2 project files |
| 1.3 Update Specification Version | TODO | CycloneDxComposer.cs |
| 1.4 Update Media Type Constants | TODO | Same file |
| 1.1 Research CycloneDX.Core 10.0.2+ | BLOCKED | CycloneDX.Core 10.0.2 does not have SpecificationVersion.v1_7; awaiting library update |
| 1.2 Update Package References | DONE | Updated to CycloneDX.Core 10.0.2 (kept 1.6 spec) |
| 1.3 Update Specification Version | BLOCKED | Awaiting CycloneDX.Core v1_7 support |
| 1.4 Update Media Type Constants | BLOCKED | Awaiting CycloneDX.Core v1_7 support |
| 1.5 Update Documentation | TODO | 2 docs files |
| 1.6 Integration Testing | TODO | Scanner.Emit.Tests |
| 1.7 Validate Acceptance Criteria | TODO | Final validation |
| 2.1 Create Signal Mapping Reference | TODO | New doc file |
| 2.2 Document Idempotency Mechanisms | TODO | Section in mapping |
| 2.3 Document Evidence References | TODO | Section in mapping |
| 2.4 Validate Acceptance Criteria | TODO | Review required |
| 3.1 Create EPSS Clarification Document | TODO | New doc file |
| 3.2 Document EPSS Implementation | TODO | Section in clarification |
| 3.3 Update Documentation References | TODO | epss-integration-v4.md |
| 3.4 Validate Acceptance Criteria | TODO | Final validation |
| 4.1 Create Alignment Report | TODO | New doc file |
| 4.2 Generate Evidence Artifacts | TODO | Code refs + demos |
| 4.3 Architecture Diagrams | TODO | Update/create diagrams |
| 4.4 Validate Acceptance Criteria | TODO | Final validation |
| 1.7 Validate Acceptance Criteria | BLOCKED | Awaiting 1.7 support |
| 2.1 Create Signal Mapping Reference | DONE | `docs/architecture/signal-contract-mapping.md` (965 lines) |
| 2.2 Document Idempotency Mechanisms | DONE | Section 4 in signal-contract-mapping.md |
| 2.3 Document Evidence References | DONE | Section 3 in signal-contract-mapping.md |
| 2.4 Validate Acceptance Criteria | DONE | All 5 signal types mapped |
| 3.1 Create EPSS Clarification Document | DONE | `docs/architecture/epss-versioning-clarification.md` (442 lines) |
| 3.2 Document EPSS Implementation | DONE | Sections 2-4 in epss-versioning-clarification.md |
| 3.3 Update Documentation References | DONE | Added EPSS versioning clarification section to epss-integration-v4.md |
| 3.4 Validate Acceptance Criteria | DONE | FIRST.org spec referenced |
| 4.1 Create Alignment Report | DONE | `docs/architecture/advisory-alignment-report.md` (280+ lines) |
| 4.2 Generate Evidence Artifacts | DONE | Code refs in alignment report |
| 4.3 Architecture Diagrams | DONE | Tables in alignment report |
| 4.4 Validate Acceptance Criteria | DONE | 95% alignment validated |
---
## Execution Log
| Date (UTC) | Update | Owner |
|---|---|---|
| 2025-12-19 | Updated CycloneDX.Core to 10.0.2; discovered v1_7 enum not yet available in SDK. Task 1 BLOCKED. | Agent |
| 2025-12-19 | Fixed Policy project missing references (Attestor.ProofChain, Canonical.Json). | Agent |
| 2025-12-19 | Verified Tasks 2-3 documentation already exists: signal-contract-mapping.md (965 lines), epss-versioning-clarification.md (442 lines). | Agent |
| 2025-12-19 | Created advisory-alignment-report.md (280+ lines) with component-by-component analysis. 95% alignment confirmed. | Agent |
| 2025-12-19 | Note: Scanner.CallGraph has pre-existing build errors (incomplete Java extractor from SPRINT_3610_0001_0001). Unrelated to this sprint. | Agent |
| 2025-12-19 | Fixed Scanner.CallGraph build errors (cross-sprint fix): Extended SinkCategory enum, added EntrypointType.Lambda/EventHandler, created shared CallGraphEdgeComparer, fixed all language extractors (Java/Go/JS/Python). | Agent |
| 2025-12-19 | Fixed additional build errors: PHP/Ruby/Binary extractors accessibility + SinkCategory values. Added BinaryEntrypointClassifier. All tests pass (35/35). | Agent |
| 2025-12-19 | Task 3.3 complete: Added EPSS versioning clarification section to docs/guides/epss-integration-v4.md explaining model_date vs. formal version numbers. | Agent |
---