feat: Add VEX Lens CI and Load Testing Plan

- Introduced a comprehensive CI job structure for VEX Lens, including build, test, linting, and load testing.
- Defined load test parameters and SLOs for VEX Lens API and Issuer Directory.
- Created Grafana dashboards and alerting mechanisms for monitoring API performance and error rates.
- Established offline posture guidelines for CI jobs and load testing.

feat: Implement deterministic projection verification script

- Added `verify_projection.sh` script for verifying the integrity of projection exports against expected hashes.
- Ensured robust error handling for missing files and hash mismatches.

feat: Develop Vuln Explorer CI and Ops Plan

- Created CI jobs for Vuln Explorer, including build, test, and replay verification.
- Implemented backup and disaster recovery strategies for MongoDB and Redis.
- Established Merkle anchoring verification and automation for ledger projector.

feat: Introduce EventEnvelopeHasher for hashing event envelopes

- Implemented `EventEnvelopeHasher` to compute SHA256 hashes for event envelopes.

feat: Add Risk Store and Dashboard components

- Developed `RiskStore` for managing risk data and state.
- Created `RiskDashboardComponent` for displaying risk profiles with filtering capabilities.
- Implemented unit tests for `RiskStore` and `RiskDashboardComponent`.

feat: Enhance Vulnerability Detail Component

- Developed `VulnerabilityDetailComponent` for displaying detailed information about vulnerabilities.
- Implemented error handling for missing vulnerability IDs and loading failures.

docs/modules/zastava/kit/README.md

@@ -0,0 +1,12 @@
+# Zastava Kit (offline bundle) – Draft
+
+Contents to include when built:
+- Observations and admissions exports (NDJSON) signed via DSSE.
+- Schemas: `schemas/observer_event.schema.json`, `schemas/webhook_admission.schema.json`.
+- Thresholds: `thresholds.yaml` (DSSE-signed).
+- Hash manifest: `SHA256SUMS` (covering all kit files).
+- Verify script: `verify.sh` (hash + DSSE verification; fail closed on mismatch).
+
+Deterministic packaging: `tar --mtime @0 --owner 0 --group 0 --numeric-owner -cf - kit | zstd -19 --long=27 --no-progress > zastava-kit.tzst`.
+
+Pending: fill with signed artefacts and Evidence Locker URIs after DSSE signing.

docs/modules/zastava/kit/verify.sh

@@ -0,0 +1,14 @@
+#!/usr/bin/env bash
+set -euo pipefail
+ROOT="$(cd "$(dirname "$0")" && pwd)"
+cd "$ROOT"
+
+if ! command -v sha256sum >/dev/null; then
+  echo "sha256sum required" >&2; exit 1
+fi
+
+sha256sum --check SHA256SUMS
+# TODO: add DSSE verification once signatures are available; placeholder below
+# cosign verify-blob --key cosign.pub --signature observer_event.schema.json.sig observer_event.schema.json
+
+echo "OK: hashes verified (DSSE verification pending)"