consolidation of some of the modules, localization fixes, product advisories work, qa work

src/Attestor/StellaOps.Signer/AGENTS.md

@@ -0,0 +1,32 @@
+# Signer Guild
+
+## Mission
+Operate the Stella Ops Signer service: authenticate trusted callers, enforce proof‑of‑entitlement and release integrity policy, and mint verifiable DSSE bundles (keyless or KMS-backed) for downstream attestation.
+
+## Teams On Call
+- Team 11 (Signer API)
+- Team 12 (Signer Reliability & Quotas)
+
+## Operating Principles
+- Accept requests only with Authority-issued OpToks plus DPoP or mTLS sender binding; reject unsigned/cross-tenant traffic.
+- Treat PoE claims as hard gates for quota, version windows, and license validity; cache results deterministically with bounded TTLs.
+- Verify scanner image release signatures via OCI Referrers before signing; fail closed on ambiguity.
+- Keep the hot path stateless and deterministic; persist audit trails with structured logging, metrics, and correlation IDs.
+- Update `TASKS.md`, architecture notes, and tests whenever behaviour or contracts evolve.
+
+## Key Directories
+- `src/Signer/StellaOps.Signer/StellaOps.Signer.WebService/` — Minimal API host and HTTP surface (to be scaffolded).
+- `src/Signer/StellaOps.Signer/StellaOps.Signer.Core/` — Domain contracts, signing pipeline, quota enforcement (to be scaffolded).
+- `src/Signer/StellaOps.Signer/StellaOps.Signer.Infrastructure/` — External clients (Authority, Licensing, Fulcio/KMS, OCI) and persistence (to be scaffolded).
+- `src/Signer/StellaOps.Signer/StellaOps.Signer.Tests/` — Unit/integration test suites (to be scaffolded).
+
+## Required Reading
+- `docs/modules/signer/architecture.md`
+- `docs/modules/platform/architecture-overview.md`
+
+## Working Agreement
+- 1. Update task status to `DOING`/`DONE` in both correspoding sprint file `/docs/implplan/SPRINT_*.md` and the local `TASKS.md` when you start or finish work.
+- 2. Review this charter and the Required Reading documents before coding; confirm prerequisites are met.
+- 3. Keep changes deterministic (stable ordering, timestamps, hashes) and align with offline/air-gap expectations.
+- 4. Coordinate doc updates, tests, and cross-guild communication whenever contracts or workflows change.
+- 5. Revert to `TODO` if you pause the task without shipping changes; leave notes in commit/PR descriptions for context.