docs consolidation
This commit is contained in:
StellaOps Bot
@@ -1,26 +0,0 @@
|
||||
# Replay Delivery Coordination Prep — PREP-EVIDENCE-LOCKER-GUILD-REPLAY-DELIVERY-GU
|
||||
|
||||
Status: Draft (2025-11-20)
|
||||
Owners: Planning · Evidence Locker Guild · Replay Delivery Guild · CLI Guild
|
||||
Scope: Define minimum contract notes for replay delivery so EVID-REPLAY-187-001/002 and RUNBOOK-REPLAY-187-004 can move once schemas freeze.
|
||||
|
||||
## Ledger & delivery contract (draft)
|
||||
- **Ingress API stub**: `POST /replay/records` (internal) accepting NDJSON of replay record envelopes (see `docs/modules/evidence-locker/replay-payload-contract.md`).
|
||||
- **Indexing**: Mongo collection `replay_records` indexed on `{tenant_id, record_id, scan_id, created_at}`; TTL disabled until retention policy lands.
|
||||
- **Delivery targets**:
|
||||
- Evidence Locker storage CAS path `cas://replay/{tenant_id}/{record_id}/record.ndjson`
|
||||
- Optional mirror to ExportCenter bundle queue once export contracts freeze (Sprint 162).
|
||||
- **Retention knobs (placeholders)**: `max_records_per_tenant`, `max_age_days`, `max_bytes_per_tenant`. Defaults to be supplied by Replay Delivery Guild once ledger policy lands.
|
||||
|
||||
## Coordination points
|
||||
- Replay Delivery Guild to publish retention defaults + eviction order alongside ledger spec; reference back here once available.
|
||||
- CLI Guild to validate that CAS path + schema version are sufficient for `stella replay|verify|diff` flows (see `docs/modules/cli/guides/replay-cli-prep.md`).
|
||||
- Ops/Runbook owners to mirror delivery + retention behaviour in `docs/runbooks/replay_ops.md` when promoted.
|
||||
|
||||
## Open questions to close before DOING
|
||||
- Final subject keys for CAS path (include `source` or keep tenant/record only?).
|
||||
- Whether exports to TimelineIndexer need additional fan-out event (likely tied to Orchestrator envelope once defined).
|
||||
- Required observability signals: proposal is counter `evidence_replay_records_ingested_total{tenant,source}` and gauge `evidence_replay_storage_bytes{tenant}`.
|
||||
|
||||
## Handoff
|
||||
Treat this as the PREP artefact for PREP-EVIDENCE-LOCKER-GUILD-REPLAY-DELIVERY-GU. Update with concrete retention values and event/fan-out decisions once the Replay Ledger spec is published.
|
||||
@@ -1,29 +0,0 @@
|
||||
# Evidence Locker Schema Readiness Prep — PREP-EVIDENCE-LOCKER-GUILD-BLOCKED-SCHEMAS-NO
|
||||
|
||||
Status: Draft (2025-11-20)
|
||||
Owners: Planning · Evidence Locker Guild · AdvisoryAI Guild · Orchestrator/Notifications Guild
|
||||
Scope: Capture the exact signals still missing to unfreeze Evidence Locker replay/bundle schemas, so downstream implementation can proceed without ambiguity.
|
||||
|
||||
## Outstanding upstream artefacts (must land before new DOING status)
|
||||
- **AdvisoryAI evidence bundle schema + payload notes** (Sprint 110.A)
|
||||
- Need: JSON schema and at least one signed sample bundle covering SBOM + VEX + reachability attachments.
|
||||
- Acceptance: versioned under `docs/modules/advisory-ai/schemas/evidence-bundle-v1.json` with hash and sample at `docs/samples/advisory-ai/evidence-bundle-v1.json`.
|
||||
- **Orchestrator + Notifications capsule envelopes** (Sprint 150.A / 140)
|
||||
- Need: capsule envelope schema carrying replay IDs and DSSE metadata used by ExportCenter/TimelineIndexer.
|
||||
- Acceptance: schema at `docs/events/orchestrator-scanner-events.md` updated with `replay_id`, `dsse_envelope_hash`, and `tenant_id` fields plus sample message.
|
||||
- **Replay Ledger retention policy** (shared with Replay Delivery Guild)
|
||||
- Need: retention limits (days / count), eviction order, and required indexes for `{tenant_id, record_id, scan_id}` in Mongo.
|
||||
- Acceptance: recorded in `docs/replay/DETERMINISTIC_REPLAY.md` section 8 with deterministic eviction rules.
|
||||
|
||||
## Ready-to-start criteria for Evidence Locker tasks
|
||||
- Both schemas above are versioned and checksummed.
|
||||
- Sample payloads are placed under `docs/samples/{advisory-ai,orchestrator}/` and referenced from this sprint.
|
||||
- Recorded hashes are copied into `docs/modules/evidence-locker/replay-payload-contract.md` (section 5 once available).
|
||||
|
||||
## Temporary guidance until freeze
|
||||
- Keep Evidence Locker tasks BLOCKED for code changes; only doc prep allowed.
|
||||
- Use the draft schema hash from AdvisoryAI if provided, but mark it "unstable" in dependent docs.
|
||||
- Prefer canonical JSON ordering and UTC RFC3339 timestamps in any provisional samples.
|
||||
|
||||
## Handoff
|
||||
Use this document as the prep artefact for PREP-EVIDENCE-LOCKER-GUILD-BLOCKED-SCHEMAS-NO. Update or retire once the upstream schema hashes are frozen and recorded in this sprint’s Decisions & Risks.
|
||||
@@ -1,25 +0,0 @@
|
||||
# Security & Evidence Coordination Prep — PREP-EVIDENCE-LOCKER-GUILD-SECURITY-GUILD-DOC
|
||||
|
||||
Status: Draft (2025-11-20)
|
||||
Owners: Evidence Locker Guild · Security Guild · Docs Guild · Exporter Service Guild · Mirror Creator Guild · DevOps Guild · Timeline Indexer Guild
|
||||
Scope: Enumerate security-critical deliverables that must be frozen before EvidenceLocker/ExportCenter/TimelineIndexer move to DOING.
|
||||
|
||||
## Required artefacts (to freeze)
|
||||
- **RootPack & crypto profiles**: confirm `ICryptoProviderRegistry` defaults and RootPack publication flow per `docs/security/crypto-routing-audit-2025-11-07.md`; publish profile matrix for FIPS/eIDAS/GOST.
|
||||
- **Evidence bundle trust**: DSSE signing policy, Rekor optional segment, checksum publication location; hash-record table to be mirrored in DevPortal bundle verification CLI (DVOFF-64-002).
|
||||
- **Air-gapped import**: mirror bundle path, checksum & signature publication steps for offline kits; rollback checklist for failed imports.
|
||||
- **Audit & RLS**: required audit fields for EvidenceLocker/Postgres (TimelineIndexer) with tenant scoping; indexes to enforce retention caps once ledger policy lands.
|
||||
|
||||
## Deliverables & locations
|
||||
- `docs/modules/evidence-locker/bundle-packaging.md` — add DSSE + checksum publication matrix (owner: Evidence Locker Guild).
|
||||
- `docs/modules/export-center/profiles.md` — mirror bundle signing/verifier defaults (owner: Exporter Service Guild).
|
||||
- `docs/modules/timelineindexer/architecture.md` — include RLS/audit fields for evidence linkage (owner: Timeline Indexer Guild).
|
||||
- `docs/security/crypto-registry-decision-2025-11-18.md` — referenced as normative source for crypto provider defaults.
|
||||
|
||||
## Ready-to-start checklist (for downstream tasks)
|
||||
- Above docs updated with hashes and profile matrix.
|
||||
- Sample signed bundle + manifest published under `docs/samples/export-center/bundles/` with SHA256 + DSSE envelope.
|
||||
- TimelineIndexer RLS/audit fields reviewed by Security.
|
||||
|
||||
## Handoff
|
||||
Treat this file as the published prep artefact for PREP-EVIDENCE-LOCKER-GUILD-SECURITY-GUILD-DOC. Once the four bullets in “Required artefacts” are frozen, flip the sprint task to DONE and unblock downstream implementation tasks.
|
||||
@@ -1,23 +0,0 @@
|
||||
# Evidence Locker sealed bundle contract · 2025-11-24
|
||||
|
||||
Owners: Evidence Locker Guild · Security Guild
|
||||
Status: Published 2025-11-24 (source for ELOCKER-CONTRACT-2001)
|
||||
|
||||
## Deliverables
|
||||
- Bundle schema: `bundle.schema.json` (sealed DSSE envelope + manifest) — stored under `docs/modules/evidence-locker/schemas/bundle.schema.json`.
|
||||
- DSSE layout: subject digests, payload (`evidence_bundle.json`), and signatures recorded; transparency optional; canonical hash: `SHA256:6f51d7a5c9d0c5db8a1f6e9d4a0af13e3e7eb5bcb4fa8457de99d8b1c2b3b8ff`.
|
||||
- Sample bundle: `docs/modules/evidence-locker/samples/evidence-bundle-sample.tgz` with accompanying `.sha256` file.
|
||||
|
||||
## Scope and guarantees
|
||||
- Sealed, offline-friendly; deterministic ordering of files in the tarball; UTC timestamps fixed to `1970-01-01T00:00:00Z` for reproducibility.
|
||||
- Payload includes: `manifest.json`, `evidence_bundle.json`, `signatures/` (DSSE), `checksums.txt`.
|
||||
- No network dependencies; validation and hashing performed locally.
|
||||
|
||||
## Validation
|
||||
- `docs/modules/evidence-locker/schemas/bundle.schema.json` validated via `ajv` offline run (see `prep/validate.sh`).
|
||||
- DSSE signature verifies with sample keypair; transparency step skipped (optional).
|
||||
|
||||
## Next steps
|
||||
- Publish NuGet contract (if needed) referencing the schema path.
|
||||
- Provide CLI/Export Center consumers with manifest path and hash above.
|
||||
- Unblock ATTEST-PLAN-2001; keep downstream sprints updated.
|
||||
Reference in New Issue
Block a user