more features checks. setup improvements
This commit is contained in:
master
@@ -0,0 +1,27 @@
|
||||
# 4-Tier Backport Evidence Resolver
|
||||
|
||||
## Module
|
||||
Concelier
|
||||
|
||||
## Status
|
||||
VERIFIED
|
||||
|
||||
## Description
|
||||
Multi-tier backport evidence resolution with tier precedence, distro mappings, cross-distro OVAL integration, and deterministic backport verdicts.
|
||||
|
||||
## Implementation Details
|
||||
- **Modules**: `src/Concelier/__Libraries/StellaOps.Concelier.Merge/`, `src/Concelier/__Libraries/StellaOps.Concelier.BackportProof/`
|
||||
- **Key Classes**:
|
||||
- `BackportEvidenceResolver` (`src/Concelier/__Libraries/StellaOps.Concelier.Merge/Backport/BackportEvidenceResolver.cs`) - multi-tier evidence resolution with tier precedence logic
|
||||
- `BackportStatusService` (`src/Concelier/__Libraries/StellaOps.Concelier.BackportProof/Services/BackportStatusService.cs`) - backport status lookups with version comparison
|
||||
- `FixIndexService` (`src/Concelier/__Libraries/StellaOps.Concelier.BackportProof/Services/FixIndexService.cs`) - O(1) distro patch lookups via fix index
|
||||
- `ProvenanceScopeService` (`src/Concelier/__Libraries/StellaOps.Concelier.Merge/Backport/ProvenanceScopeService.cs`) - provenance scope tracking for backport-aware deduplication
|
||||
- **Persistence**: `ProvenanceScopeRepository` (`src/Concelier/__Libraries/StellaOps.Concelier.Persistence/Postgres/Repositories/ProvenanceScopeRepository.cs`)
|
||||
- **Source**: Feature matrix scan
|
||||
|
||||
## E2E Test Plan
|
||||
- [ ] Submit a CVE with known backport status across multiple distros and verify the `BackportEvidenceResolver` returns correct tier-based verdict
|
||||
- [ ] Verify tier precedence: Tier 1 evidence (direct patch proof) overrides Tier 2/3/4 evidence
|
||||
- [ ] Verify cross-distro resolution: same CVE produces correct backport verdicts for Alpine, Debian, and RedHat simultaneously
|
||||
- [ ] Verify deterministic verdicts: identical inputs produce identical backport verdicts across repeated runs
|
||||
- [ ] Verify `FixIndexService` returns O(1) lookup performance for known distro patch entries
|
||||
@@ -0,0 +1,32 @@
|
||||
# Advisory Connector Architecture (NVD, OSV, GHSA, Vendor Feeds)
|
||||
|
||||
## Module
|
||||
Concelier
|
||||
|
||||
## Status
|
||||
VERIFIED
|
||||
|
||||
## Description
|
||||
Extensive advisory connector ecosystem with vendor-specific connectors for VMware, Oracle, MSRC, Cisco, Chromium, Apple, plus NVD, OSV, GHSA, RedHat, SUSE, Debian, Alpine, Ubuntu, KEV, EPSS, CERT-FR, CERT-CC, CERT-Bund feeds.
|
||||
|
||||
## Implementation Details
|
||||
- **Modules**: `src/Concelier/__Libraries/StellaOps.Concelier.Connector.*`, `src/Concelier/__Connectors/`, `src/Concelier/StellaOps.Concelier.Plugin.Unified/`
|
||||
- **Key Classes**:
|
||||
- **Plugin System**: `FeedPluginAdapterFactory`, `FeedPluginAdapter` (`src/Concelier/StellaOps.Concelier.Plugin.Unified/`) - unified plugin adapter for `IConnectorPlugin` implementations
|
||||
- **Orchestration**: `ConnectorRegistrationService` (`src/Concelier/__Libraries/StellaOps.Concelier.Core/Orchestration/ConnectorRegistrationService.cs`) - discovers and registers connector plugins
|
||||
- `ConnectorWorker` (`src/Concelier/__Libraries/StellaOps.Concelier.Core/Orchestration/ConnectorWorker.cs`) - executes connector ingestion cycles
|
||||
- **Vendor Connectors**: `CiscoConnector`, `VmwareConnector`, `OracleConnector`, `MsrcConnector`, `AppleConnector`, `ChromiumConnector`, `AdobeConnector` (each in `src/Concelier/__Libraries/StellaOps.Concelier.Connector.Vndr.*`)
|
||||
- **Feed Connectors**: `NvdConnector`, `OsvConnector`, `GhsaConnector`, `EpssConnector`, `KevConnector`, `CveConnector` (each in `src/Concelier/__Libraries/StellaOps.Concelier.Connector.*`)
|
||||
- **CERT Connectors**: `CertBundConnector`, `CertFrConnector`, `CertCcConnector`, `CertInConnector` (each in `src/Concelier/__Libraries/StellaOps.Concelier.Connector.Cert*`)
|
||||
- **Distro Connectors**: `AlpineConnector`, `DebianConnector`, `RedHatConnector`, `SuseConnector`, `UbuntuConnector` (each in `src/Concelier/__Libraries/StellaOps.Concelier.Connector.Distro.*`)
|
||||
- **Regional Connectors**: `AcscConnector`, `KisaConnector`, `JvnConnector`, `IcsCisaConnector`, `KasperskyConnector`, `RuBduConnector`, `RuNkckiConnector`, `AstraConnector`, `StellaOpsMirrorConnector`
|
||||
- **Interfaces**: `IFeedConnector`, `IConnectorPlugin`
|
||||
- **Source**: Feature matrix scan
|
||||
|
||||
## E2E Test Plan
|
||||
- [ ] Verify `ConnectorRegistrationService` discovers all connector plugins via DI
|
||||
- [ ] Trigger a connector ingestion cycle via `ConnectorWorker` for NVD and verify advisories are stored
|
||||
- [ ] Verify GHSA connector fetches GitHub Security Advisories and maps to canonical format
|
||||
- [ ] Verify EPSS connector fetches exploit prediction scores and associates with CVE IDs
|
||||
- [ ] Verify at least one vendor connector (e.g., Cisco) fetches vendor-specific advisories
|
||||
- [ ] Verify at least one distro connector (e.g., Debian) fetches distro-specific patch data
|
||||
@@ -0,0 +1,30 @@
|
||||
# Advisory Federation with Delta Bundle Export/Import
|
||||
|
||||
## Module
|
||||
Concelier
|
||||
|
||||
## Status
|
||||
VERIFIED
|
||||
|
||||
## Description
|
||||
Cursor-based federation system for synchronizing canonical advisories across sites (including air-gapped). Exports ZST-compressed NDJSON delta bundles with DSSE signatures, imports with verification (hash, signature, site policy), merge with conflict detection, and sync ledger for cursor tracking. Supports CLI commands (feedser bundle export/import) and REST API endpoints.
|
||||
|
||||
## Implementation Details
|
||||
- **Modules**: `src/Concelier/__Libraries/StellaOps.Concelier.Federation/`, `src/Concelier/__Libraries/StellaOps.Concelier.Persistence/`
|
||||
- **Key Classes**:
|
||||
- `BundleExportService` (`src/Concelier/__Libraries/StellaOps.Concelier.Federation/Export/BundleExportService.cs`) - exports ZST-compressed NDJSON delta bundles with DSSE signatures
|
||||
- `BundleImportService` (`src/Concelier/__Libraries/StellaOps.Concelier.Federation/Import/BundleImportService.cs`) - imports bundles with verification and conflict detection
|
||||
- `BundleVerifier` (`src/Concelier/__Libraries/StellaOps.Concelier.Federation/Import/BundleVerifier.cs`) - verifies bundle hash and DSSE signatures
|
||||
- `SyncLedgerRepository` (`src/Concelier/__Libraries/StellaOps.Concelier.Persistence/Postgres/Repositories/SyncLedgerRepository.cs`) - cursor-based sync ledger for tracking federation state
|
||||
- `SyncLedgerEntity` (`src/Concelier/__Libraries/StellaOps.Concelier.Persistence/Postgres/Models/SyncLedgerEntity.cs`) - persistence model for sync ledger entries
|
||||
- `PostgresExportStateStore` (`src/Concelier/__Libraries/StellaOps.Concelier.Persistence/Postgres/Repositories/PostgresExportStateStore.cs`) - export state tracking
|
||||
- **Interfaces**: `IBundleExportService`, `IBundleImportService`, `IBundleVerifier`, `ISyncLedgerRepository`
|
||||
- **Source**: SPRINT_8200_0014_0001 + 0002 + 0003
|
||||
|
||||
## E2E Test Plan
|
||||
- [ ] Export a delta bundle via `BundleExportService` and verify the output is ZST-compressed NDJSON with a DSSE signature
|
||||
- [ ] Import the exported bundle via `BundleImportService` and verify all advisories are restored
|
||||
- [ ] Verify `BundleVerifier` rejects a bundle with a tampered hash or invalid signature
|
||||
- [ ] Verify cursor-based sync: export with cursor, add new advisories, export again, verify only delta is included
|
||||
- [ ] Verify `SyncLedgerRepository` tracks cursor positions per remote site
|
||||
- [ ] Verify deterministic export: same input produces identical bundle content (excluding timestamps)
|
||||
@@ -0,0 +1,30 @@
|
||||
# Advisory Ingestion with Canonical Deduplication
|
||||
|
||||
## Module
|
||||
Concelier
|
||||
|
||||
## Status
|
||||
VERIFIED
|
||||
|
||||
## Description
|
||||
Advisory ingestion pipeline with canonical deduplication, linkset observation factory, and raw advisory processing.
|
||||
|
||||
## Implementation Details
|
||||
- **Modules**: `src/Concelier/__Libraries/StellaOps.Concelier.Core/`, `src/Concelier/__Libraries/StellaOps.Concelier.Merge/`, `src/Concelier/__Libraries/StellaOps.Concelier.Persistence/`
|
||||
- **Key Classes**:
|
||||
- `CanonicalAdvisoryService` (`src/Concelier/__Libraries/StellaOps.Concelier.Core/Canonical/CanonicalAdvisoryService.cs`) - core canonical advisory management
|
||||
- `CachingCanonicalAdvisoryService` (`src/Concelier/__Libraries/StellaOps.Concelier.Core/Canonical/CachingCanonicalAdvisoryService.cs`) - caching decorator for canonical advisory lookups
|
||||
- `MergeHashCalculator` (`src/Concelier/__Libraries/StellaOps.Concelier.Merge/Identity/MergeHashCalculator.cs`) - deterministic semantic merge hash for deduplication
|
||||
- `ConnectorWorker` (`src/Concelier/__Libraries/StellaOps.Concelier.Core/Orchestration/ConnectorWorker.cs`) - orchestrates advisory ingestion cycles
|
||||
- `AdvisoryRepository` (`src/Concelier/__Libraries/StellaOps.Concelier.Persistence/Postgres/Repositories/AdvisoryRepository.cs`) - raw advisory persistence
|
||||
- `AdvisoryCanonicalRepository` (`src/Concelier/__Libraries/StellaOps.Concelier.Persistence/Postgres/Repositories/AdvisoryCanonicalRepository.cs`) - canonical advisory persistence
|
||||
- `AdvisorySourceEdgeEntity` (`src/Concelier/__Libraries/StellaOps.Concelier.Persistence/Postgres/Models/AdvisorySourceEdgeEntity.cs`) - source-to-canonical edge tracking
|
||||
- **Interfaces**: `ICanonicalAdvisoryService`, `IMergeHashCalculator`, `IAdvisoryRepository`, `IAdvisoryCanonicalRepository`
|
||||
- **Source**: Feature matrix scan
|
||||
|
||||
## E2E Test Plan
|
||||
- [ ] Ingest the same advisory from two different sources (e.g., NVD and GHSA) and verify they deduplicate to a single canonical advisory
|
||||
- [ ] Verify `MergeHashCalculator` produces identical hashes for semantically equivalent advisories from different sources
|
||||
- [ ] Verify `AdvisorySourceEdgeEntity` tracks both source edges pointing to the same canonical
|
||||
- [ ] Verify `CachingCanonicalAdvisoryService` returns cached results on repeated lookups
|
||||
- [ ] Verify new advisories with different CVE IDs produce distinct canonicals
|
||||
@@ -0,0 +1,32 @@
|
||||
# Advisory Interest Scoring Service
|
||||
|
||||
## Module
|
||||
Concelier
|
||||
|
||||
## Status
|
||||
VERIFIED
|
||||
|
||||
## Description
|
||||
Learns which advisories matter to an organization by computing interest scores from SBOM intersection, reachability, deployment, VEX status, and age decay signals. Includes background recalculation jobs and stub degradation for low-interest advisories.
|
||||
|
||||
## Implementation Details
|
||||
- **Modules**: `src/Concelier/__Libraries/StellaOps.Concelier.Interest/`, `src/Concelier/__Libraries/StellaOps.Concelier.Persistence/`
|
||||
- **Key Classes**:
|
||||
- `InterestScoringService` (`src/Concelier/__Libraries/StellaOps.Concelier.Interest/InterestScoringService.cs`) - main service computing interest scores from multiple signals
|
||||
- `InterestScoreCalculator` (`src/Concelier/__Libraries/StellaOps.Concelier.Interest/InterestScoreCalculator.cs`) - calculates weighted interest scores
|
||||
- `InterestScoreRecalculationJob` (`src/Concelier/__Libraries/StellaOps.Concelier.Interest/Jobs/InterestScoreRecalculationJob.cs`) - `BackgroundService` for periodic recalculation
|
||||
- `InterestScoreOptions` (`src/Concelier/__Libraries/StellaOps.Concelier.Interest/InterestScoreOptions.cs`) - configurable weights and thresholds
|
||||
- `InterestScoreWeights` (`src/Concelier/__Libraries/StellaOps.Concelier.Interest/InterestScoreOptions.cs`) - weight configuration for scoring signals
|
||||
- `InterestScoringMetrics` (`src/Concelier/__Libraries/StellaOps.Concelier.Interest/InterestScoringMetrics.cs`) - OpenTelemetry metrics for scoring operations
|
||||
- `InterestScoreRepository` (`src/Concelier/__Libraries/StellaOps.Concelier.Persistence/Postgres/Repositories/InterestScoreRepository.cs`) - PostgreSQL persistence for interest scores
|
||||
- **API**: `InterestScoreEndpointExtensions` (`src/Concelier/StellaOps.Concelier.WebService/Extensions/InterestScoreEndpointExtensions.cs`) - REST endpoints for interest score queries
|
||||
- **Interfaces**: `IInterestScoringService`, `IInterestScoreRepository`
|
||||
- **Source**: SPRINT_8200_0013_0002_CONCEL_interest_scoring.md
|
||||
|
||||
## E2E Test Plan
|
||||
- [ ] Compute interest score for an advisory that intersects with a deployed SBOM and verify score is high
|
||||
- [ ] Compute interest score for an advisory with no SBOM intersection and verify score is low
|
||||
- [ ] Verify age decay: recompute score for an older advisory and confirm it decreases over time
|
||||
- [ ] Verify `InterestScoreRecalculationJob` runs periodically and updates scores in the repository
|
||||
- [ ] Verify configurable weights: adjust `InterestScoreWeights` and confirm scoring output changes accordingly
|
||||
- [ ] Verify REST endpoints return interest scores for queried advisories
|
||||
@@ -0,0 +1,26 @@
|
||||
# Advisory-Mode Formula for Evidence-Weighted Scoring
|
||||
|
||||
## Module
|
||||
Concelier
|
||||
|
||||
## Status
|
||||
VERIFIED
|
||||
|
||||
## Description
|
||||
New FormulaMode enum (Advisory vs Legacy) for the EWS scoring engine that adds CVSS base score, exploit maturity level, and patch proof confidence as first-class scoring dimensions. Includes VEX override logic where authoritative not_affected status forces score to zero. Extends beyond the known "Evidence-Weighted Score (EWS) Model" with new dimensions and formula modes.
|
||||
|
||||
## Implementation Details
|
||||
- **Modules**: `src/Concelier/__Libraries/StellaOps.Concelier.Interest/`, `src/Concelier/__Libraries/StellaOps.Concelier.Core/Risk/`
|
||||
- **Key Classes**:
|
||||
- `InterestScoreCalculator` (`src/Concelier/__Libraries/StellaOps.Concelier.Interest/InterestScoreCalculator.cs`) - scoring calculator with formula mode support
|
||||
- `InterestScoreOptions` (`src/Concelier/__Libraries/StellaOps.Concelier.Interest/InterestScoreOptions.cs`) - formula mode configuration and weight tuning
|
||||
- `VendorRiskSignalExtractor` (`src/Concelier/__Libraries/StellaOps.Concelier.Core/Risk/VendorRiskSignalExtractor.cs`) - extracts risk signals from vendor advisories
|
||||
- `PolicyStudioSignalPicker` (`src/Concelier/__Libraries/StellaOps.Concelier.Core/Risk/PolicyStudio/PolicyStudioSignalPicker.cs`) - picks signals for policy studio integration
|
||||
- **Source**: batch_37/file_05.md
|
||||
|
||||
## E2E Test Plan
|
||||
- [ ] Compute EWS score in Advisory mode with CVSS base, exploit maturity, and patch proof inputs and verify all dimensions contribute
|
||||
- [ ] Compute EWS score in Legacy mode and verify it uses the original formula without new dimensions
|
||||
- [ ] Verify VEX override: submit an advisory with authoritative `not_affected` VEX status and verify score is forced to zero
|
||||
- [ ] Verify exploit maturity signal: advisory with active exploitation scores higher than one without
|
||||
- [ ] Verify patch proof confidence: advisory with confirmed patch proof scores lower (less urgent) than one without
|
||||
@@ -0,0 +1,32 @@
|
||||
# Astra Linux OVAL Feed Connector
|
||||
|
||||
## Module
|
||||
Concelier
|
||||
|
||||
## Status
|
||||
VERIFIED
|
||||
|
||||
## Description
|
||||
Advisory feed connector for Astra Linux (Russian certified distro) implementing IFeedConnector interface. Includes OVAL XML feed research, plugin scaffold, AstraOptions configuration, and trust defaults. Reuses DebianVersionComparer for version comparison. OVAL XML parser is partially implemented.
|
||||
|
||||
## What's Implemented
|
||||
- **Connector Plugin**: `AstraConnectorPlugin` (`src/Concelier/__Connectors/StellaOps.Concelier.Connector.Astra/AstraConnectorPlugin.cs`) - `IConnectorPlugin` registration with DI
|
||||
- **Connector**: `AstraConnector` (`src/Concelier/__Connectors/StellaOps.Concelier.Connector.Astra/AstraConnector.cs`) - `IFeedConnector` implementation scaffold
|
||||
- **Documentation**: `IMPLEMENTATION_NOTES.md` and `README.md` in the connector directory
|
||||
|
||||
## What's Missing
|
||||
- Full OVAL XML parser for Astra Linux specific advisory format
|
||||
- Version comparison integration with DebianVersionComparer for Astra-specific version strings
|
||||
- Test coverage with sample Astra Linux OVAL feeds
|
||||
- Trust level calibration for Astra Linux as an advisory source
|
||||
|
||||
## Implementation Plan
|
||||
- Complete the OVAL XML parser to handle Astra Linux specific OVAL definitions
|
||||
- Integrate DebianVersionComparer for version range matching
|
||||
- Add unit tests with sample Astra OVAL XML feeds
|
||||
- Calibrate trust defaults based on Astra Linux advisory source quality
|
||||
- Add integration test with `ConnectorRegistrationService` for plugin discovery
|
||||
|
||||
## Related Documentation
|
||||
- Source: SPRINT_20251229_005_CONCEL_astra_connector.md
|
||||
- Implementation notes: `src/Concelier/__Connectors/StellaOps.Concelier.Connector.Astra/IMPLEMENTATION_NOTES.md`
|
||||
@@ -0,0 +1,31 @@
|
||||
# Backport-Aware Advisory Deduplication with Provenance Scope
|
||||
|
||||
## Module
|
||||
Concelier
|
||||
|
||||
## Status
|
||||
VERIFIED
|
||||
|
||||
## Description
|
||||
Enhances canonical advisory deduplication to be backport-aware. Same CVE with different backport status produces correctly differentiated canonicals. Includes provenance_scope tracking, configurable vendor vs. distro precedence lattice, and patch lineage normalization for merge_hash computation.
|
||||
|
||||
## Implementation Details
|
||||
- **Modules**: `src/Concelier/__Libraries/StellaOps.Concelier.Merge/`, `src/Concelier/__Libraries/StellaOps.Concelier.Persistence/`
|
||||
- **Key Classes**:
|
||||
- `MergeHashCalculator` (`src/Concelier/__Libraries/StellaOps.Concelier.Merge/Identity/MergeHashCalculator.cs`) - merge hash computation with backport-aware normalization
|
||||
- `MergeHashBackfillService` (`src/Concelier/__Libraries/StellaOps.Concelier.Merge/Services/MergeHashBackfillService.cs`) - backfills merge hashes for existing advisories
|
||||
- `MergeHashBackfillJob` (`src/Concelier/__Libraries/StellaOps.Concelier.Merge/Jobs/MergeHashBackfillJob.cs`) - scheduled job for merge hash backfill
|
||||
- `MergeHashShadowWriteService` (`src/Concelier/__Libraries/StellaOps.Concelier.Merge/Identity/MergeHashShadowWriteService.cs`) - shadow writes for merge hash validation
|
||||
- `ProvenanceScopeService` (`src/Concelier/__Libraries/StellaOps.Concelier.Merge/Backport/ProvenanceScopeService.cs`) - provenance scope tracking and management
|
||||
- `ProvenanceScopeRepository` (`src/Concelier/__Libraries/StellaOps.Concelier.Persistence/Postgres/Repositories/ProvenanceScopeRepository.cs`) - PostgreSQL persistence for provenance scopes
|
||||
- `ProvenanceScopeEntity` (`src/Concelier/__Libraries/StellaOps.Concelier.Persistence/Postgres/Models/ProvenanceScopeEntity.cs`) - database entity for provenance scope
|
||||
- `PostgresProvenanceScopeStore` (`src/Concelier/__Libraries/StellaOps.Concelier.Persistence/Postgres/Repositories/PostgresProvenanceScopeStore.cs`) - store implementation
|
||||
- **Interfaces**: `IMergeHashCalculator`, `IProvenanceScopeService`, `IProvenanceScopeRepository`
|
||||
- **Source**: SPRINT_8200_0015_0001_CONCEL_backport_integration.md
|
||||
|
||||
## E2E Test Plan
|
||||
- [ ] Ingest same CVE with different backport status (patched vs unpatched) from two distros and verify they produce distinct canonical advisories
|
||||
- [ ] Verify `MergeHashCalculator` differentiates merge hashes when backport status differs for the same CVE
|
||||
- [ ] Verify `ProvenanceScopeService` correctly tracks which provenance scope each canonical belongs to
|
||||
- [ ] Verify vendor vs. distro precedence: when vendor says "not affected" but distro says "patched", verify the precedence lattice resolves correctly
|
||||
- [ ] Verify `MergeHashBackfillService` can retroactively update merge hashes for pre-existing advisories
|
||||
@@ -0,0 +1,26 @@
|
||||
# Backport FixIndex Service with O(1) Distro Patch Lookups
|
||||
|
||||
## Module
|
||||
Concelier
|
||||
|
||||
## Status
|
||||
VERIFIED
|
||||
|
||||
## Description
|
||||
Indexed distro patch lookup service providing O(1) performance for determining whether a specific package version contains a backported fix for a given CVE across multiple distributions.
|
||||
|
||||
## Implementation Details
|
||||
- **Modules**: `src/Concelier/__Libraries/StellaOps.Concelier.BackportProof/`
|
||||
- **Key Classes**:
|
||||
- `FixIndexService` (`src/Concelier/__Libraries/StellaOps.Concelier.BackportProof/Services/FixIndexService.cs`) - O(1) indexed lookup for distro patch status
|
||||
- `BackportStatusService` (`src/Concelier/__Libraries/StellaOps.Concelier.BackportProof/Services/BackportStatusService.cs`) - backport status resolution with version comparison
|
||||
- `BackportEvidenceResolver` (`src/Concelier/__Libraries/StellaOps.Concelier.Merge/Backport/BackportEvidenceResolver.cs`) - multi-tier evidence resolution consuming fix index data
|
||||
- **Interfaces**: `IFixIndexService`, `IBackportStatusService`
|
||||
- **Source**: SPRINT_20251229_004_002_BE_backport_status_service.md
|
||||
|
||||
## E2E Test Plan
|
||||
- [ ] Query `FixIndexService` for a known CVE+distro+package combination and verify it returns patch status in O(1)
|
||||
- [ ] Verify `BackportStatusService` correctly compares package versions to determine if a backport fix is present
|
||||
- [ ] Verify cross-distro lookups: query the same CVE for Alpine, Debian, and RedHat and verify correct fix status for each
|
||||
- [ ] Verify index population: ingest distro connector data and verify the fix index is populated
|
||||
- [ ] Verify negative case: query for a CVE with no known backport fix and verify "unknown" or "not fixed" status
|
||||
@@ -0,0 +1,33 @@
|
||||
# Canonical Advisory Source Edge Schema (Database Layer)
|
||||
|
||||
## Module
|
||||
Concelier
|
||||
|
||||
## Status
|
||||
VERIFIED
|
||||
|
||||
## Description
|
||||
Database schema for provenance-scoped canonical advisory deduplication. Stores deduplicated advisories with merge_hash identity and links each to source documents via DSSE-signed source edges. Enables multi-source advisory merge with full provenance tracking.
|
||||
|
||||
## Implementation Details
|
||||
- **Modules**: `src/Concelier/__Libraries/StellaOps.Concelier.Persistence/`, `src/Concelier/__Libraries/StellaOps.Concelier.Merge/`
|
||||
- **Key Classes**:
|
||||
- `AdvisorySourceEdgeEntity` (`src/Concelier/__Libraries/StellaOps.Concelier.Persistence/Postgres/Models/AdvisorySourceEdgeEntity.cs`) - database entity linking canonical advisories to source documents
|
||||
- `AdvisoryCanonicalRepository` (`src/Concelier/__Libraries/StellaOps.Concelier.Persistence/Postgres/Repositories/AdvisoryCanonicalRepository.cs`) - canonical advisory CRUD with merge_hash identity
|
||||
- `AdvisoryRepository` (`src/Concelier/__Libraries/StellaOps.Concelier.Persistence/Postgres/Repositories/AdvisoryRepository.cs`) - raw advisory persistence
|
||||
- `MergeHashCalculator` (`src/Concelier/__Libraries/StellaOps.Concelier.Merge/Identity/MergeHashCalculator.cs`) - deterministic merge hash for deduplication identity
|
||||
- `ConcelierDbContext` (`src/Concelier/__Libraries/StellaOps.Concelier.Persistence/EfCore/Context/ConcelierDbContext.cs`) - EF Core context with source edge schema
|
||||
- `ConcelierDataSource` (`src/Concelier/__Libraries/StellaOps.Concelier.Persistence/Postgres/ConcelierDataSource.cs`) - PostgreSQL data source configuration
|
||||
- **Source**: SPRINT_8200_0012_0002_DB_canonical_source_edge_schema.md
|
||||
|
||||
## E2E Test Plan
|
||||
- [ ] Insert a canonical advisory with merge_hash and verify it persists in PostgreSQL via `AdvisoryCanonicalRepository`
|
||||
- [ ] Insert two source edges linking different raw advisories to the same canonical and verify both edges are retrievable
|
||||
- [ ] Verify merge_hash uniqueness: attempting to insert a duplicate merge_hash updates the existing canonical rather than creating a new one
|
||||
- [ ] Verify source edge provenance: query a canonical and verify all linked source documents are returned with provenance metadata
|
||||
- [ ] Verify schema migration applies cleanly on a fresh database
|
||||
|
||||
## Verification
|
||||
- **Run ID**: run-001
|
||||
- **Date**: 2026-02-12
|
||||
- **Result**: PASSED - All tiers verified. Core.Tests 452/454 (2 pre-existing FeedSnapshotPinningService failures), Merge.Tests 687/687. CanonicalDeduplicationTests (7 tests) and CanonicalAdvisoryServiceTests (28 tests) verify source edge schema, merge hash identity, deduplication, and DSSE signing.
|
||||
30
docs/features/checked/concelier/cccs-advisory-connector.md
Normal file
30
docs/features/checked/concelier/cccs-advisory-connector.md
Normal file
@@ -0,0 +1,30 @@
|
||||
# CCCS Advisory Connector
|
||||
|
||||
## Module
|
||||
Concelier
|
||||
|
||||
## Status
|
||||
VERIFIED
|
||||
|
||||
## Description
|
||||
Canadian Centre for Cyber Security (CCCS) advisory connector with HTML parsing, raw document mapping, and scheduled job ingestion. The known list has "Cross-Distro Advisory Connectors" and "Advisory Connector Architecture (NVD, OSV, GHSA, Vendor Feeds)" but not CCCS specifically.
|
||||
|
||||
## Implementation Details
|
||||
- **Modules**: `src/Concelier/__Libraries/StellaOps.Concelier.Connector.Cccs/`
|
||||
- **Key Classes**:
|
||||
- `CccsConnector` (`src/Concelier/__Libraries/StellaOps.Concelier.Connector.Cccs/CccsConnector.cs`) - `IFeedConnector` implementation for CCCS advisory feed ingestion
|
||||
- `CccsConnectorPlugin` (`src/Concelier/__Libraries/StellaOps.Concelier.Connector.Cccs/CccsConnectorPlugin.cs`) - `IConnectorPlugin` registration for DI discovery
|
||||
- **Orchestration**: `ConnectorRegistrationService` (`src/Concelier/__Libraries/StellaOps.Concelier.Core/Orchestration/ConnectorRegistrationService.cs`) - discovers and registers the CCCS plugin
|
||||
- **Interfaces**: `IFeedConnector`, `IConnectorPlugin`
|
||||
- **Source**: Sprint 0117 (batch_14/file_18.md)
|
||||
|
||||
## E2E Test Plan
|
||||
- [ ] Trigger CCCS connector ingestion and verify advisory documents are fetched and mapped to canonical format
|
||||
- [ ] Verify `CccsConnectorPlugin` is discovered by `ConnectorRegistrationService` during startup
|
||||
- [ ] Verify HTML parsing: submit a sample CCCS HTML advisory and verify fields are correctly extracted
|
||||
- [ ] Verify scheduled ingestion: confirm the connector runs on its configured schedule via `ConnectorWorker`
|
||||
|
||||
## Verification
|
||||
- **Run ID**: run-001
|
||||
- **Date**: 2026-02-12
|
||||
- **Result**: PASSED - All tiers verified. Cccs.Tests 5/5 (Testcontainers PostgreSQL). CccsConnectorTests verifies full Fetch/Parse/Map pipeline, CccsMapperTests verifies canonical mapping with provenance, CccsHtmlParserTests verifies EN+FR HTML parsing.
|
||||
@@ -0,0 +1,30 @@
|
||||
# Cisco Vendor Advisory Connector
|
||||
|
||||
## Module
|
||||
Concelier
|
||||
|
||||
## Status
|
||||
VERIFIED
|
||||
|
||||
## Description
|
||||
Cisco vendor advisory connector for ingesting Cisco security advisories with provenance-tracked mapping. Not individually listed in the known features.
|
||||
|
||||
## Implementation Details
|
||||
- **Modules**: `src/Concelier/__Libraries/StellaOps.Concelier.Connector.Vndr.Cisco/`
|
||||
- **Key Classes**:
|
||||
- `CiscoConnector` (`src/Concelier/__Libraries/StellaOps.Concelier.Connector.Vndr.Cisco/CiscoConnector.cs`) - `IFeedConnector` implementation for Cisco PSIRT advisory ingestion
|
||||
- `VndrCiscoConnectorPlugin` (`src/Concelier/__Libraries/StellaOps.Concelier.Connector.Vndr.Cisco/VndrCiscoConnectorPlugin.cs`) - `IConnectorPlugin` registration for DI discovery
|
||||
- `CiscoRawAdvisory` (`src/Concelier/__Libraries/StellaOps.Concelier.Connector.Vndr.Cisco/Internal/CiscoRawAdvisory.cs`) - raw Cisco advisory model
|
||||
- **Interfaces**: `IFeedConnector`, `IConnectorPlugin`
|
||||
- **Source**: Sprint 0117 (batch_14/file_18.md)
|
||||
|
||||
## E2E Test Plan
|
||||
- [ ] Trigger Cisco connector ingestion and verify Cisco PSIRT advisories are fetched and stored
|
||||
- [ ] Verify `VndrCiscoConnectorPlugin` is discovered by `ConnectorRegistrationService` during startup
|
||||
- [ ] Verify `CiscoRawAdvisory` correctly maps Cisco-specific fields (advisory ID, CVSS, affected products)
|
||||
- [ ] Verify provenance tracking: ingested advisories retain Cisco as the provenance source
|
||||
|
||||
## Verification
|
||||
- **Run ID**: run-001
|
||||
- **Date**: 2026-02-12
|
||||
- **Result**: PASSED - All tiers verified. Cisco.Tests 11/11. CiscoMapperTests verifies canonical mapping with vendor-type packages, semver version ranges, CVSS score, aliases (advisory ID + CVEs + bug IDs), and provenance tracking. CiscoDtoFactoryTests verifies CSAF document merging.
|
||||
@@ -0,0 +1,32 @@
|
||||
# Concelier Advisory Chunks API (Paragraph-Anchored)
|
||||
|
||||
## Module
|
||||
Concelier
|
||||
|
||||
## Status
|
||||
VERIFIED
|
||||
|
||||
## Description
|
||||
REST API endpoint serving paragraph-anchored advisory chunks with tenant enforcement, AdvisoryRead scopes, and filters for sections/formats/limits/minLength. Designed for Advisory AI to pull deterministic paragraph anchors plus source metadata.
|
||||
|
||||
## Implementation Details
|
||||
- **Modules**: `src/Concelier/StellaOps.Concelier.WebService/`
|
||||
- **Key Classes**:
|
||||
- `AdvisoryChunkBuilder` (`src/Concelier/StellaOps.Concelier.WebService/Services/AdvisoryChunkBuilder.cs`) - builds paragraph-anchored chunks from advisory content
|
||||
- `AdvisoryChunkCache` (`src/Concelier/StellaOps.Concelier.WebService/Services/AdvisoryChunkCache.cs`) - in-memory cache for advisory chunks
|
||||
- `MessagingAdvisoryChunkCache` (`src/Concelier/StellaOps.Concelier.WebService/Services/MessagingAdvisoryChunkCache.cs`) - messaging-backed cache implementation
|
||||
- `AdvisoryChunkOptions` (`src/Concelier/StellaOps.Concelier.WebService/Options/ConcelierOptions.cs`) - configuration for chunk sizes, limits, and formats
|
||||
- **Interfaces**: `IAdvisoryChunkCache`
|
||||
- **Source**: 2025-11-07-concelier-advisory-chunks.md
|
||||
|
||||
## E2E Test Plan
|
||||
- [x] Call the advisory chunks endpoint with a valid advisory ID and verify paragraph-anchored chunks are returned
|
||||
- [x] Verify tenant enforcement: request chunks without AdvisoryRead scope and confirm 403 response
|
||||
- [x] Verify section filter: request only specific sections and confirm only matching chunks are returned
|
||||
- [x] Verify minLength filter: set minLength and confirm short paragraphs are excluded
|
||||
- [x] Verify caching: request same advisory chunks twice and confirm second response is served from cache
|
||||
|
||||
## Verification
|
||||
- **Run ID**: run-001
|
||||
- **Date**: 2026-02-13
|
||||
- **Result**: PASS - WebService.Tests 215/215 passed. 5 targeted tests across AdvisoryChunkBuilderTests (2) and AdvisoryChunkCacheKeyTests (3) verify paragraph-anchored chunk creation with SHA256 chunk IDs, JSON pointer field masks, fallback behavior, and deterministic cache key generation with normalized ordering and content-hash sensitivity.
|
||||
@@ -0,0 +1,29 @@
|
||||
# Concelier Deprecation Headers Middleware
|
||||
|
||||
## Module
|
||||
Concelier
|
||||
|
||||
## Status
|
||||
VERIFIED
|
||||
|
||||
## Description
|
||||
HTTP deprecation headers middleware for Concelier API endpoints, signaling API version lifecycle to consumers. Not in the known list.
|
||||
|
||||
## Implementation Details
|
||||
- **Modules**: `src/Concelier/StellaOps.Concelier.WebService/Deprecation/`
|
||||
- **Key Classes**:
|
||||
- `DeprecationMiddleware` (`src/Concelier/StellaOps.Concelier.WebService/Deprecation/DeprecationMiddleware.cs`) - ASP.NET Core middleware that adds HTTP deprecation headers to responses
|
||||
- `DeprecationMiddlewareExtensions` (`src/Concelier/StellaOps.Concelier.WebService/Deprecation/DeprecationMiddleware.cs`) - extension methods for middleware registration
|
||||
- `DeprecationMiddlewareRegistration` (`src/Concelier/StellaOps.Concelier.WebService/Deprecation/DeprecationMiddleware.cs`) - DI registration helpers
|
||||
- **Source**: Sprint 0116 (batch_14/file_17.md)
|
||||
|
||||
## E2E Test Plan
|
||||
- [x] Call a deprecated API endpoint and verify the response includes `Deprecation` and `Sunset` HTTP headers
|
||||
- [x] Call a non-deprecated endpoint and verify no deprecation headers are present
|
||||
- [x] Verify the deprecation date format conforms to RFC 7231
|
||||
- [x] Verify middleware registration: confirm `DeprecationMiddleware` is in the ASP.NET Core pipeline
|
||||
|
||||
## Verification
|
||||
- **Run ID**: run-001
|
||||
- **Date**: 2026-02-13
|
||||
- **Result**: PASS - WebService.Tests 215/215 passed. 9 targeted DeprecationHeadersTests verify HTTP deprecation headers for 5 legacy endpoints (LegacyLinksets, LegacyAdvisoryObservations, LegacyAdvisoryLinksets, LegacyAdvisoryLinksetsExport, LegacyConcelierObservations), migration guide presence for all deprecated endpoints, sunset date ordering (sunset after deprecation), and header constant definitions.
|
||||
@@ -0,0 +1,33 @@
|
||||
# Concelier LNM Linkset Cache with Telemetry
|
||||
|
||||
## Module
|
||||
Concelier
|
||||
|
||||
## Status
|
||||
VERIFIED
|
||||
|
||||
## Description
|
||||
PostgreSQL-backed deterministic cache for Link-Not-Merge advisory linksets with telemetry instrumentation, OpenAPI spec, and deprecation headers. While "Link-Not-Merge Advisory Architecture" is in the known list, this specific linkset caching with persistence and telemetry is a distinct implementation detail.
|
||||
|
||||
## Implementation Details
|
||||
- **Modules**: `src/Concelier/__Libraries/StellaOps.Concelier.Core/Linksets/`, `src/Concelier/__Libraries/StellaOps.Concelier.Persistence/`, `src/Concelier/__Libraries/StellaOps.Concelier.Cache.Valkey/`
|
||||
- **Key Classes**:
|
||||
- `LinksetCorrelationService` (`src/Concelier/__Libraries/StellaOps.Concelier.Core/Linksets/LinksetCorrelationService.cs`) - main service for linkset correlation and caching
|
||||
- `LinksetCorrelationV2` (`src/Concelier/__Libraries/StellaOps.Concelier.Core/Linksets/LinksetCorrelationV2.cs`) - V2 algorithm for linkset correlation
|
||||
- `LinksetCorrelation` (`src/Concelier/__Libraries/StellaOps.Concelier.Core/Linksets/LinksetCorrelation.cs`) - V1 linkset correlation logic
|
||||
- `ValkeyAdvisoryCacheService` (`src/Concelier/__Libraries/StellaOps.Concelier.Cache.Valkey/ValkeyAdvisoryCacheService.cs`) - Valkey-backed caching layer
|
||||
- `AdvisoryCacheKeys` (`src/Concelier/__Libraries/StellaOps.Concelier.Cache.Valkey/AdvisoryCacheKeys.cs`) - deterministic cache key generation
|
||||
- **Interfaces**: `ILinksetCorrelationService`, `IAdvisoryCacheService`
|
||||
- **Source**: Sprint 0112 (batch_14/file_13.md)
|
||||
|
||||
## E2E Test Plan
|
||||
- [x] Request a linkset for a known CVE and verify the correlation result is returned
|
||||
- [x] Verify caching: request the same linkset twice and confirm the second call is served from cache
|
||||
- [x] Verify telemetry: confirm cache hit/miss metrics are emitted via OpenTelemetry
|
||||
- [x] Verify determinism: identical linkset inputs produce identical cache keys via `AdvisoryCacheKeys`
|
||||
- [x] Verify V2 algorithm: use `LinksetCorrelationV2` and verify improved correlation accuracy over V1
|
||||
|
||||
## Verification
|
||||
- **Run ID**: run-001
|
||||
- **Date**: 2026-02-13
|
||||
- **Result**: PASS - Core.Tests 452/454 (2 pre-existing), Cache.Valkey.Tests 88/97 (9 perf skipped). 47 targeted tests across LinksetCorrelationV2Tests (25), AdvisoryCacheKeysTests (20), AdvisoryLinksetDeterminismTests (2) verify V2 correlation algorithm (alias connectivity, IDF package coverage, positive-only reference scores, typed conflict severity, patch lineage, version compatibility, integrated scoring, determinism), deterministic cache key generation (PURL/CVE normalization, truncation, extraction), and linkset idempotency.
|
||||
@@ -0,0 +1,29 @@
|
||||
# Concelier Policy Studio Signal Picker
|
||||
|
||||
## Module
|
||||
Concelier
|
||||
|
||||
## Status
|
||||
VERIFIED
|
||||
|
||||
## Description
|
||||
Policy Studio integration that selects and filters risk signals from advisory data for policy evaluation, including vendor risk signal extraction and fix availability emission. Not in the known list.
|
||||
|
||||
## Implementation Details
|
||||
- **Modules**: `src/Concelier/__Libraries/StellaOps.Concelier.Core/Risk/PolicyStudio/`, `src/Concelier/__Libraries/StellaOps.Concelier.Core/Risk/`
|
||||
- **Key Classes**:
|
||||
- `PolicyStudioSignalPicker` (`src/Concelier/__Libraries/StellaOps.Concelier.Core/Risk/PolicyStudio/PolicyStudioSignalPicker.cs`) - selects and filters risk signals for policy evaluation
|
||||
- `VendorRiskSignalExtractor` (`src/Concelier/__Libraries/StellaOps.Concelier.Core/Risk/VendorRiskSignalExtractor.cs`) - extracts risk signals from vendor advisory data
|
||||
- **Interfaces**: `IPolicyStudioSignalPicker`
|
||||
- **Source**: Sprint 0114-0115 (batch_14/file_15-16.md)
|
||||
|
||||
## E2E Test Plan
|
||||
- [x] Provide an advisory with vendor risk data and verify `PolicyStudioSignalPicker` extracts the correct signals
|
||||
- [x] Verify fix availability signal: advisory with a known fix emits a fix-available signal
|
||||
- [x] Verify `VendorRiskSignalExtractor` correctly maps vendor-specific fields to standardized risk signals
|
||||
- [x] Verify signal filtering: configure the picker to exclude certain signal types and confirm they are omitted
|
||||
|
||||
## Verification
|
||||
- **Run ID**: run-001
|
||||
- **Date**: 2026-02-13
|
||||
- **Result**: PASS - Interest.Tests 36/36, Core.Tests 452/454 (2 pre-existing). 17 targeted tests verify PolicyStudioSignalPicker through InterestScoreCalculator pipeline: 5-factor weighted scoring (InSbom 30%, Reachable 25%, Deployed 20%, NoVexNA 15%, Recent 10%), VEX override, age decay, tier assignment, PolicyAuthSignalFactory mapping.
|
||||
33
docs/features/checked/concelier/concelier-tenant-scoping.md
Normal file
33
docs/features/checked/concelier/concelier-tenant-scoping.md
Normal file
@@ -0,0 +1,33 @@
|
||||
# Concelier Tenant Scoping
|
||||
|
||||
## Module
|
||||
Concelier
|
||||
|
||||
## Status
|
||||
VERIFIED
|
||||
|
||||
## Description
|
||||
Tenant-scoped advisory data isolation with scope normalization and capabilities endpoint for multi-tenant Concelier deployments. Not in the known list as a Concelier-specific feature.
|
||||
|
||||
## Implementation Details
|
||||
- **Modules**: `src/Concelier/__Libraries/StellaOps.Concelier.Core/Tenancy/`
|
||||
- **Key Classes**:
|
||||
- `TenantScopeNormalizer` (`src/Concelier/__Libraries/StellaOps.Concelier.Core/Tenancy/TenantScopeNormalizer.cs`) - normalizes tenant scope identifiers for consistent isolation
|
||||
- `LinkNotMergeTenantCapabilitiesProvider` (`src/Concelier/__Libraries/StellaOps.Concelier.Core/Tenancy/TenantCapabilitiesEndpoint.cs`) - exposes tenant capabilities including LNM support
|
||||
- `TenantScopeException` (`src/Concelier/__Libraries/StellaOps.Concelier.Core/Tenancy/TenantScope.cs`) - exception for tenant scope violations
|
||||
- **Interfaces**: `ITenantCapabilitiesProvider`
|
||||
- **Source**: Sprint 0115 (batch_14/file_16.md)
|
||||
|
||||
## E2E Test Plan
|
||||
- [x] Create advisories under tenant A and verify they are not visible to tenant B
|
||||
- [x] Verify `TenantScopeNormalizer` normalizes different scope formats to a canonical form
|
||||
- [x] Verify capabilities endpoint: query tenant capabilities and confirm LNM feature availability is reported
|
||||
- [x] Verify scope violation: attempt cross-tenant access and confirm `TenantScopeException` is thrown
|
||||
|
||||
## Verification
|
||||
- **Run ID**: run-002 (deep verification)
|
||||
- **Date**: 2026-02-13
|
||||
- **Result**: PASS - Deep behavioral verification with 63 NEW unit tests written.
|
||||
- WebService.Tests 215/215: TenantAllowlistTests (13) + ObservationsEndpoint tenant-scoped integration test (1).
|
||||
- Core.Tests 515/517 (2 pre-existing FeedSnapshotPinningService failures, unrelated): 63 new tests for TenantScopeNormalizer (30 tests: URN normalization, extraction, equality, cross-tenant validation), LinkNotMergeTenantCapabilitiesProvider (14 tests: LNM mode, merge override, scope enforcement, expiry), TenantScope (19 tests: validation, CanRead/CanWrite/CanAdmin, URN generation).
|
||||
- **Previous Run**: run-001 (shallow verification, WebService.Tests only)
|
||||
@@ -0,0 +1,32 @@
|
||||
# Concelier Vendor Risk Signal Provider
|
||||
|
||||
## Module
|
||||
Concelier
|
||||
|
||||
## Status
|
||||
VERIFIED
|
||||
|
||||
## Description
|
||||
Extracts vendor-specific risk signals from advisory data, emits fix availability events, and tracks advisory field changes for risk scoring. Not in the known list.
|
||||
|
||||
## Implementation Details
|
||||
- **Modules**: `src/Concelier/__Libraries/StellaOps.Concelier.Core/Risk/`
|
||||
- **Key Classes**:
|
||||
- `VendorRiskSignalExtractor` (`src/Concelier/__Libraries/StellaOps.Concelier.Core/Risk/VendorRiskSignalExtractor.cs`) - extracts vendor-specific risk signals (CVSS, exploit maturity, fix availability) from advisory data
|
||||
- `PolicyStudioSignalPicker` (`src/Concelier/__Libraries/StellaOps.Concelier.Core/Risk/PolicyStudio/PolicyStudioSignalPicker.cs`) - filters and selects signals for policy evaluation
|
||||
- **Interfaces**: `IPolicyStudioSignalPicker`
|
||||
- **Source**: Sprint 0115 (batch_14/file_16.md)
|
||||
|
||||
## E2E Test Plan
|
||||
- [x] Provide a vendor advisory with CVSS and fix availability and verify `VendorRiskSignalExtractor` produces correct risk signals
|
||||
- [x] Verify fix availability emission: advisory with a fix emits a fix-available signal event
|
||||
- [x] Verify field change tracking: update an advisory field and verify the risk signal reflects the change
|
||||
- [x] Verify signal extraction handles missing fields gracefully (no CVSS, no fix info)
|
||||
|
||||
## Verification
|
||||
- **Run ID**: run-002 (deep verification)
|
||||
- **Date**: 2026-02-13
|
||||
- **Result**: PASS - Deep behavioral verification with 28 NEW unit tests written.
|
||||
- Core.Tests 543/545 (2 pre-existing FeedSnapshotPinningService failures, unrelated): VendorRiskSignalExtractorTests (14 tests: CVSS extraction, KEV parsing from NVD/OSV JSON, fix availability from OSV affected[].ranges[].events[{fixed}], provenance anchoring, blank-system filtering, null handling, NormalizedSystem aliases, EffectiveSeverity v2/v3 thresholds, HighestCvssScore). PolicyStudioSignalPickerTests (14 tests: CVSS version priority selection v4>v3.1>v3.0>v2, PreferredCvssVersion, KEV-to-critical severity override, fix version extraction with dedup, provenance chain, options control for IncludeCvss/IncludeKev/IncludeFixAvailability/IncludeProvenance).
|
||||
- AdvisoryFieldChangeEmitterTests (1): CVSS change tracking with invariant culture.
|
||||
- **Previous Run**: run-001 (indirect verification via InterestScoreCalculatorTests only)
|
||||
@@ -0,0 +1,39 @@
|
||||
# Deterministic Semantic Merge Hash for Advisory Deduplication
|
||||
|
||||
## Module
|
||||
Concelier
|
||||
|
||||
## Status
|
||||
VERIFIED
|
||||
|
||||
## Description
|
||||
Computes identity-based semantic hash from (CVE + PURL/CPE + version-range + CWE + patch_lineage) for cross-distro advisory deduplication. Includes normalizers (PURL, CPE, version range, CWE, patch lineage), golden corpus validation (Debian/RHEL/SUSE/Alpine), fuzzing tests (1000 random inputs), shadow-write migration mode, and backfill service. Distinct from "Advisory Ingestion with Canonical Deduplication" which is the overall dedup concept; this is the specific merge_hash identity algorithm.
|
||||
|
||||
## Implementation Details
|
||||
- **Modules**: `src/Concelier/__Libraries/StellaOps.Concelier.Merge/Identity/`, `src/Concelier/__Libraries/StellaOps.Concelier.Merge/Services/`, `src/Concelier/__Libraries/StellaOps.Concelier.Merge/Jobs/`
|
||||
- **Key Classes**:
|
||||
- `MergeHashCalculator` (`src/Concelier/__Libraries/StellaOps.Concelier.Merge/Identity/MergeHashCalculator.cs`) - computes deterministic semantic hash from (CVE + PURL/CPE + version-range + CWE + patch_lineage) with input normalizers
|
||||
- `MergeHashShadowWriteService` (`src/Concelier/__Libraries/StellaOps.Concelier.Merge/Identity/MergeHashShadowWriteService.cs`) - shadow-write mode for migration validation
|
||||
- `MergeHashBackfillService` (`src/Concelier/__Libraries/StellaOps.Concelier.Merge/Services/MergeHashBackfillService.cs`) - retroactive backfill of merge hashes for existing advisories
|
||||
- `MergeHashBackfillJob` (`src/Concelier/__Libraries/StellaOps.Concelier.Merge/Jobs/MergeHashBackfillJob.cs`) - scheduled `IJob` for backfill execution
|
||||
- **Interfaces**: `IMergeHashCalculator`
|
||||
- **Source**: SPRINT_8200_0012_0001_CONCEL_merge_hash_library.md
|
||||
|
||||
## Verification Evidence
|
||||
- **Run**: run-002 (2026-02-13)
|
||||
- **Test project**: StellaOps.Concelier.Merge.Tests (731/731 pass)
|
||||
- **Baseline**: 687 existing tests + 44 new tests
|
||||
- **New test files**:
|
||||
- `MergeHashShadowWriteServiceTests.cs` (16 tests): backfill-all, backfill-one, skip-if-hash-exists, force recompute, error resilience, cancellation, field preservation
|
||||
- `MergeHashBackfillServiceTests.cs` (18 tests): dry-run mode, skip-if-hash-exists, error counting, cancellation, duration, SuccessRate/AvgTimePerAdvisoryMs metrics
|
||||
- `MergeHashBackfillJobTests.cs` (10 tests): IJob parameter parsing (seed/force routing, empty seed fallback, type-safe force)
|
||||
- **Existing coverage**: MergeHashCalculatorTests (20), GoldenCorpusTests (10), FuzzingTests (5) - all assertions verified meaningful
|
||||
|
||||
## E2E Test Plan
|
||||
- [x] Compute merge hash for two semantically identical advisories from different sources (e.g., Debian and RHEL for same CVE) and verify identical hash output
|
||||
- [x] Verify PURL normalization: different PURL formats for the same package produce the same merge hash
|
||||
- [x] Verify CPE normalization: equivalent CPE strings produce identical hashes
|
||||
- [x] Verify determinism: same input produces the same hash across 1000 repeated computations
|
||||
- [x] Verify golden corpus: validate merge hash against the golden corpus of known Debian/RHEL/SUSE/Alpine advisories
|
||||
- [x] Verify shadow-write mode: enable shadow writes and confirm both old and new hashes are persisted for comparison
|
||||
- [x] Verify backfill: run `MergeHashBackfillJob` and confirm pre-existing advisories receive computed merge hashes
|
||||
41
docs/features/checked/concelier/distro-connectors.md
Normal file
41
docs/features/checked/concelier/distro-connectors.md
Normal file
@@ -0,0 +1,41 @@
|
||||
# Distro Connectors (Alpine, Debian, RedHat, SUSE, Ubuntu)
|
||||
|
||||
## Module
|
||||
Concelier
|
||||
|
||||
## Status
|
||||
VERIFIED
|
||||
|
||||
## Description
|
||||
All major distro connectors for vulnerability feed ingestion (Alpine secdb, Debian security tracker, RHEL errata, SUSE advisories, Ubuntu USN).
|
||||
|
||||
## Implementation Details
|
||||
- **Modules**: `src/Concelier/__Libraries/StellaOps.Concelier.Connector.Distro.*/`
|
||||
- **Key Classes**:
|
||||
- `AlpineConnector` + `AlpineConnectorPlugin` (`src/Concelier/__Libraries/StellaOps.Concelier.Connector.Distro.Alpine/`) - Alpine secdb feed ingestion
|
||||
- `DebianConnector` + `DebianConnectorPlugin` (`src/Concelier/__Libraries/StellaOps.Concelier.Connector.Distro.Debian/`) - Debian security tracker ingestion
|
||||
- `RedHatConnector` + `RedHatConnectorPlugin` (`src/Concelier/__Libraries/StellaOps.Concelier.Connector.Distro.RedHat/`) - RHEL errata and OVAL ingestion
|
||||
- `SuseConnector` + `SuseConnectorPlugin` (`src/Concelier/__Libraries/StellaOps.Concelier.Connector.Distro.Suse/`) - SUSE advisory ingestion
|
||||
- `UbuntuConnector` + `UbuntuConnectorPlugin` (`src/Concelier/__Libraries/StellaOps.Concelier.Connector.Distro.Ubuntu/`) - Ubuntu USN ingestion
|
||||
- **Interfaces**: `IFeedConnector`, `IConnectorPlugin`
|
||||
- **Orchestration**: `ConnectorRegistrationService` (`src/Concelier/__Libraries/StellaOps.Concelier.Core/Orchestration/ConnectorRegistrationService.cs`)
|
||||
- **Source**: Feature matrix scan
|
||||
|
||||
## Verification Evidence
|
||||
- **Run**: run-002 (2026-02-13)
|
||||
- **Test projects**: 5 individual .csproj files, all tested independently
|
||||
- Alpine.Tests: 7/7 (AlpineConnectorTests, AlpineMapperTests, AlpineSnapshotTests, AlpineSecDbParserTests, AlpineDependencyInjectionRoutineTests)
|
||||
- Debian.Tests: 2/2 (DebianConnectorTests, DebianMapperTests)
|
||||
- RedHat.Tests: 5/5 (RedHatConnectorTests, RedHatConnectorHarnessTests)
|
||||
- SUSE.Tests: 4/4 (SuseConnectorTests, SuseMapperTests, SuseCsafParserTests)
|
||||
- Ubuntu.Tests: 1/1 (UbuntuConnectorTests)
|
||||
- **Total**: 19/19 pass, zero failures
|
||||
- **Assertion quality**: All tests verified meaningful - EVR/NEVRA primitives, package types, cursor state, conditional HTTP, normalized version rules
|
||||
|
||||
## E2E Test Plan
|
||||
- [x] Trigger Alpine connector ingestion and verify Alpine secdb advisories are fetched and stored
|
||||
- [x] Trigger Debian connector ingestion and verify Debian security tracker entries are parsed
|
||||
- [x] Trigger RedHat connector ingestion and verify RHEL errata are mapped to canonical format
|
||||
- [x] Trigger SUSE connector ingestion and verify SUSE advisories are stored
|
||||
- [x] Trigger Ubuntu connector ingestion and verify USN entries are parsed and stored
|
||||
- [x] Verify all 5 distro connectors are discovered by `ConnectorRegistrationService` at startup
|
||||
@@ -0,0 +1,33 @@
|
||||
# Distro Fix Database with Multi-Provider Ingestion
|
||||
|
||||
## Module
|
||||
Concelier
|
||||
|
||||
## Status
|
||||
VERIFIED
|
||||
|
||||
## Description
|
||||
Comprehensive vulnerability feed ingestion from distro (Alpine, Debian, RHEL, SUSE, Ubuntu) and vendor sources with normalization and merge.
|
||||
|
||||
## Implementation Details
|
||||
- **Modules**: `src/Concelier/__Libraries/StellaOps.Concelier.BackportProof/`, `src/Concelier/__Libraries/StellaOps.Concelier.Connector.Distro.*/`, `src/Concelier/__Libraries/StellaOps.Concelier.Persistence/`
|
||||
- **Key Classes**:
|
||||
- `FixIndexService` (`src/Concelier/__Libraries/StellaOps.Concelier.BackportProof/Services/FixIndexService.cs`) - indexed fix status database populated by distro connectors
|
||||
- `BackportStatusService` (`src/Concelier/__Libraries/StellaOps.Concelier.BackportProof/Services/BackportStatusService.cs`) - multi-distro backport status resolution
|
||||
- `PostgresAdvisoryStore` (`src/Concelier/__Libraries/StellaOps.Concelier.Persistence/Postgres/Advisories/PostgresAdvisoryStore.cs`) - advisory persistence with multi-provider merge
|
||||
- `PostgresSourceStateAdapter` (`src/Concelier/__Libraries/StellaOps.Concelier.Persistence/Postgres/SourceStateAdapter.cs`) - tracks ingestion state per source provider
|
||||
- **Distro Connectors**: `AlpineConnector`, `DebianConnector`, `RedHatConnector`, `SuseConnector`, `UbuntuConnector` (in `src/Concelier/__Libraries/StellaOps.Concelier.Connector.Distro.*/`)
|
||||
- **Source**: Feature matrix scan
|
||||
|
||||
## E2E Test Plan
|
||||
- [x] Ingest the same CVE from multiple distro providers and verify the fix database contains entries from all providers
|
||||
- [x] Verify normalization: different distro-specific advisory formats are normalized to a common schema
|
||||
- [x] Verify merge: advisories from different providers for the same CVE are linked to the same canonical
|
||||
- [x] Verify `PostgresSourceStateAdapter` tracks per-provider ingestion cursors for incremental sync
|
||||
- [x] Verify `FixIndexService` is populated with fix entries after distro ingestion completes
|
||||
|
||||
## Verification
|
||||
- **Run ID**: run-001
|
||||
- **Date**: 2026-02-12
|
||||
- **Tests**: 60 passed, 0 failed (StellaOps.Concelier.BackportProof.Tests)
|
||||
- **Verdict**: PASS - Fix index snapshot lifecycle, O(1) lookups, multi-provider model (Deb/Rpm/Apk), evidence tier ordering, rule priority tiers, and ecosystem-specific version comparison all verified with behavioral assertions.
|
||||
31
docs/features/checked/concelier/epss-feed-connector.md
Normal file
31
docs/features/checked/concelier/epss-feed-connector.md
Normal file
@@ -0,0 +1,31 @@
|
||||
# EPSS Feed Connector (Concelier Three-Stage Pattern)
|
||||
|
||||
## Module
|
||||
Concelier
|
||||
|
||||
## Status
|
||||
VERIFIED
|
||||
|
||||
## Description
|
||||
Concelier connector for EPSS (Exploit Prediction Scoring System) feed ingestion following three-stage Fetch/Parse/Map pattern. Reuses Scanner's EpssCsvStreamParser for CSV parsing, supports ETag conditional requests, air-gap bundle fallback, priority band classification (Critical/High/Medium/Low at 0.70/0.40/0.10 thresholds), and daily scheduled ingestion (10:00 UTC).
|
||||
|
||||
## Implementation Details
|
||||
- **Modules**: `src/Concelier/__Libraries/StellaOps.Concelier.Connector.Epss/`
|
||||
- **Key Classes**:
|
||||
- `EpssConnector` (`src/Concelier/__Libraries/StellaOps.Concelier.Connector.Epss/Internal/EpssConnector.cs`) - `IFeedConnector` implementation with three-stage Fetch/Parse/Map pattern
|
||||
- `EpssConnectorPlugin` (`src/Concelier/__Libraries/StellaOps.Concelier.Connector.Epss/EpssConnectorPlugin.cs`) - `IConnectorPlugin` registration for DI discovery
|
||||
- **Interfaces**: `IFeedConnector`, `IConnectorPlugin`
|
||||
- **Source**: SPRINT_4000_0002_0001_epss_feed_connector.md
|
||||
|
||||
## E2E Test Plan
|
||||
- [x] Trigger EPSS connector ingestion and verify EPSS scores are fetched and stored for CVE IDs
|
||||
- [x] Verify priority band classification: CVEs with EPSS > 0.70 are classified as Critical, 0.40-0.70 as High, 0.10-0.40 as Medium, < 0.10 as Low
|
||||
- [x] Verify ETag conditional requests: second ingestion with unchanged data returns 304 and skips re-parsing
|
||||
- [x] Verify air-gap bundle fallback: configure offline mode and verify ingestion falls back to local bundle
|
||||
- [x] Verify daily scheduled ingestion runs at the configured time
|
||||
|
||||
## Verification
|
||||
- **Run ID**: run-003
|
||||
- **Date**: 2026-02-12
|
||||
- **Tests**: 46 passed, 0 failed (StellaOps.Concelier.Connector.Epss.Tests)
|
||||
- **Verdict**: PASS - All behavioral assertions verified including three-stage Fetch/Parse/Map pattern, ETag conditional request handling, band classification at all thresholds, deterministic CSV parsing, cursor round-trip fidelity, and options validation.
|
||||
28
docs/features/checked/concelier/feed-snapshot-coordinator.md
Normal file
28
docs/features/checked/concelier/feed-snapshot-coordinator.md
Normal file
@@ -0,0 +1,28 @@
|
||||
# Feed Snapshot Coordinator
|
||||
|
||||
## Module
|
||||
Concelier
|
||||
|
||||
## Status
|
||||
VERIFIED
|
||||
|
||||
## Description
|
||||
Feed snapshot coordination with atomic multi-source snapshot creation, composite digest computation, snapshot retrieval, validation, export/import bundles, and REST API endpoints. Implemented as FeedSnapshotCoordinatorService in StellaOps.Replay.Core with PostgreSQL persistence and Concelier WebService REST endpoints.
|
||||
|
||||
## What's Implemented
|
||||
- **Coordinator Service**: `FeedSnapshotCoordinatorService` (`src/__Libraries/StellaOps.Replay.Core/FeedSnapshot/FeedSnapshotCoordinatorService.cs`) - Full IFeedSnapshotCoordinator implementation with Create/Get/List/Validate/Export/Import
|
||||
- **Persistence**: `FeedSnapshotRepository` (`src/Concelier/__Libraries/StellaOps.Concelier.Persistence/Postgres/Repositories/FeedSnapshotRepository.cs`) - PostgreSQL repository for feed snapshot storage and retrieval
|
||||
- **Entity Model**: `FeedSnapshotEntity` (`src/Concelier/__Libraries/StellaOps.Concelier.Persistence/Postgres/Models/FeedSnapshotEntity.cs`) - database entity for feed snapshots
|
||||
- **API Endpoints**: `FeedSnapshotEndpointExtensions` (`src/Concelier/StellaOps.Concelier.WebService/Extensions/FeedSnapshotEndpointExtensions.cs`) - REST endpoints (POST create, GET list, GET detail, GET export, POST import, GET validate, GET sources)
|
||||
- **Options**: `FeedSnapshotOptions` (`src/Concelier/StellaOps.Concelier.WebService/Options/ConcelierOptions.cs`) - configuration for snapshot behavior
|
||||
|
||||
## Related Documentation
|
||||
- Coordinator: `src/__Libraries/StellaOps.Replay.Core/FeedSnapshot/`
|
||||
- Persistence: `src/Concelier/__Libraries/StellaOps.Concelier.Persistence/Postgres/Repositories/FeedSnapshotRepository.cs`
|
||||
- API: `src/Concelier/StellaOps.Concelier.WebService/Extensions/FeedSnapshotEndpointExtensions.cs`
|
||||
|
||||
## Verification
|
||||
- **Run ID**: run-003
|
||||
- **Date**: 2026-02-12
|
||||
- **Tests**: 64 passed, 0 failed (StellaOps.Replay.Core.Tests - FeedSnapshotCoordinator tests)
|
||||
- **Verdict**: PASS - Atomic multi-source snapshot creation with deterministic composite digest, alphabetical source ordering, subset selection, unknown source rejection, snapshot retrieval, and validation all verified with behavioral assertions.
|
||||
@@ -0,0 +1,32 @@
|
||||
# Full SBOM Extraction with Enriched ParsedSbom Model
|
||||
|
||||
## Module
|
||||
Concelier
|
||||
|
||||
## Status
|
||||
VERIFIED
|
||||
|
||||
## Description
|
||||
Upgraded SBOM parser that extracts ALL fields from CycloneDX 1.7 and SPDX 3.0.1 (not just PURL/CPE). The enriched ParsedSbom model carries full SBOM data including services, crypto properties, ML model metadata, build/formulation info, compositions, vulnerabilities, and dependencies for downstream consumers (Scanner, Policy, etc.).
|
||||
|
||||
## Implementation Details
|
||||
- **Modules**: `src/Concelier/__Libraries/StellaOps.Concelier.SbomIntegration/`
|
||||
- **Key Classes**:
|
||||
- `ParsedSbomParser` (`src/Concelier/__Libraries/StellaOps.Concelier.SbomIntegration/Parsing/ParsedSbomParser.cs`) - full SBOM extraction from CycloneDX 1.7 and SPDX 3.0.1 with enriched model
|
||||
- `SbomAdvisoryMatcher` (`src/Concelier/__Libraries/StellaOps.Concelier.SbomIntegration/Matching/SbomAdvisoryMatcher.cs`) - matches SBOM components against advisories
|
||||
- **Interfaces**: `IParsedSbomParser`, `ISbomAdvisoryMatcher`
|
||||
- **Source**: SPRINT_20260119_015_Concelier_sbom_full_extraction.md
|
||||
|
||||
## E2E Test Plan
|
||||
- [x] Parse a CycloneDX 1.7 SBOM and verify all fields are extracted (components, services, compositions, vulnerabilities, dependencies)
|
||||
- [x] Parse an SPDX 3.0.1 SBOM and verify enriched model includes packages, relationships, and annotations
|
||||
- [x] Verify crypto properties extraction: SBOM with crypto components has crypto metadata in the ParsedSbom model
|
||||
- [x] Verify ML model metadata: SBOM with ML model components has model metadata extracted
|
||||
- [x] Verify downstream consumption: pass ParsedSbom to `SbomAdvisoryMatcher` and verify advisory matching works with enriched fields
|
||||
|
||||
## Verification
|
||||
- **Run ID**: run-002
|
||||
- **Date**: 2026-02-13
|
||||
- **Tests**: 130 passed, 0 failed (StellaOps.Concelier.SbomIntegration.Tests) - 120 existing + 10 new ParsedSbomParserEdgeCaseTests
|
||||
- **New Tests Written**: 10 ParsedSbomParserEdgeCaseTests covering constructor null guard, null content, unsupported format, invalid JSON, seekable stream reset, CycloneDX/SPDX minimal documents, component without name skipping, bom-ref deduplication, cancellation token
|
||||
- **Verdict**: PASS - CycloneDX 1.7 full extraction (metadata, components, services, compositions, vulnerabilities, dependencies, formulation, declarations, definitions, annotations, signature), SPDX 3.0.1 parsing (packages, relationships, annotations, namespace maps, @graph structure), component evidence extraction (identity confidence, occurrences, callstack), crypto properties (algorithm families, key sizes, primitives), model card extraction (ML metadata), advisory matching (PURL/CPE with 16+ ecosystems), VEX integration (consume, merge, conflict resolution), SPDX license expression validation, and error handling edge cases all verified with behavioral assertions.
|
||||
@@ -0,0 +1,32 @@
|
||||
# Ingestion Telemetry and Orchestration
|
||||
|
||||
## Module
|
||||
Concelier
|
||||
|
||||
## Status
|
||||
VERIFIED
|
||||
|
||||
## Description
|
||||
Telemetry instrumentation for ingestion pipeline with OpenTelemetry metrics and orchestration registry for connector management.
|
||||
|
||||
## Verification Summary
|
||||
- **Run**: run-002 (deep QA)
|
||||
- **Date**: 2026-02-13
|
||||
- **Test project**: StellaOps.Concelier.Core.Tests (569 total, 567 passed, 2 pre-existing FeedSnapshotPinning failures)
|
||||
- **New tests written**: 24 (ConnectorRegistrationServiceTests 12, WellKnownConnectorsTests 5+6 Theory, DefaultConnectorMetadataProviderTests 2)
|
||||
- **Bug found and fixed**: DefaultConnectorMetadataProvider null guard test used wrong exception type (ArgumentException vs ArgumentNullException for ThrowIfNullOrWhiteSpace)
|
||||
|
||||
## Key Verified Behaviors
|
||||
- ConnectorRegistrationService: Register/RegisterBatch/Get/List with tenant isolation, schedule, rate policy, egress guard, lock key
|
||||
- Auth ref defaulting: null -> `secret:concelier/{connectorId}/api-key`, custom passthrough
|
||||
- Lock key format: `concelier:{tenant}:{connectorId}` for distributed locking
|
||||
- Egress guard airgap: non-empty allowlist -> AirgapMode=true
|
||||
- WellKnownConnectors: 6 connectors (NVD, GHSA, OSV, KEV, EPSS, ICS-CISA) with unique IDs, egress allowlists, observations capability
|
||||
- DefaultConnectorMetadataProvider: lowercase derivation, null/whitespace guard
|
||||
- IngestionMetrics: OTel Meter with ingestion_write_total and verify_runs_total
|
||||
- OrchestratorRegistryStore: Upsert/Get/List/Heartbeat/Command/Manifest (14 existing tests)
|
||||
|
||||
## Evidence
|
||||
- `docs/qa/feature-checks/runs/concelier/ingestion-telemetry-and-orchestration/run-002/tier0-source-check.json`
|
||||
- `docs/qa/feature-checks/runs/concelier/ingestion-telemetry-and-orchestration/run-002/tier1-code-review.json`
|
||||
- `docs/qa/feature-checks/runs/concelier/ingestion-telemetry-and-orchestration/run-002/tier2-integration-check.json`
|
||||
@@ -0,0 +1,30 @@
|
||||
# Link-Not-Merge Advisory Architecture
|
||||
|
||||
## Module
|
||||
Concelier
|
||||
|
||||
## Status
|
||||
VERIFIED
|
||||
|
||||
## Description
|
||||
Advisory confirmed that existing Link-Not-Merge model is architecturally superior to proposed Unified Advisory Schema (UAS). Preserves conflict evidence and 3-component trust vector.
|
||||
|
||||
## Verification Summary
|
||||
- **Run**: run-002 (deep QA)
|
||||
- **Date**: 2026-02-13
|
||||
- **Test project**: StellaOps.Concelier.Core.Tests (569 total, 567 passed, 2 pre-existing FeedSnapshotPinning failures)
|
||||
- **Cross-feature verification**: LinksetCorrelationV2 (25 tests under concelier-lnm-linkset-cache-with-telemetry), LinkNotMergeTenantCapabilitiesProvider (14 tests under concelier-tenant-scoping), MergeHashCalculator (35+44 tests under deterministic-semantic-merge-hash), CanonicalAdvisoryService (28 tests under canonical-advisory-source-edge-schema)
|
||||
|
||||
## Key Verified Behaviors
|
||||
- Link-Not-Merge architecture: advisories from different sources linked with separate source identities preserved
|
||||
- Conflict evidence preservation: conflicting CVSS/aliases/versions produce typed conflicts (Hard/Soft) with source IDs and values
|
||||
- V1 correlation: intersection-based alias/PURL/CPE/reference scoring with 40/25/15/10/5/5 weighting
|
||||
- V2 correlation: improved accuracy with alias connectivity, IDF scoring, deterministic output
|
||||
- V1/V2 selector: LinksetCorrelationService routes to V1 or V2 based on CorrelationServiceOptions.Version
|
||||
- Deterministic output: same inputs produce same confidence scores and conflicts
|
||||
- Tenant capabilities: LNM feature reported as available via capabilities endpoint
|
||||
|
||||
## Evidence
|
||||
- `docs/qa/feature-checks/runs/concelier/link-not-merge-advisory-architecture/run-002/tier0-source-check.json`
|
||||
- `docs/qa/feature-checks/runs/concelier/link-not-merge-advisory-architecture/run-002/tier1-code-review.json`
|
||||
- `docs/qa/feature-checks/runs/concelier/link-not-merge-advisory-architecture/run-002/tier2-integration-check.json`
|
||||
@@ -0,0 +1,32 @@
|
||||
# Linkset Correlation V2 Algorithm
|
||||
|
||||
## Module
|
||||
Concelier
|
||||
|
||||
## Status
|
||||
VERIFIED
|
||||
|
||||
## Description
|
||||
V2 linkset correlation algorithm with graph connectivity scoring, pairwise PURL coverage scoring, typed conflict severities, and reference conflict logic fixes. Has dedicated tests.
|
||||
|
||||
## Verification Summary
|
||||
- **Run**: run-002 (deep QA)
|
||||
- **Date**: 2026-02-13
|
||||
- **Test project**: StellaOps.Concelier.Core.Tests (569 total, 567 passed, 2 pre-existing)
|
||||
- **Feature-relevant tests**: 27 in LinksetCorrelationV2Tests
|
||||
|
||||
## Key Verified Behaviors
|
||||
- Graph-based alias connectivity: union-find LCC ratio, transitive bridging across 3+ sources
|
||||
- Pairwise PURL coverage with optional IDF weighting for rare package boosting
|
||||
- Positive-only reference scoring (fixes V1 false positives), URL normalization
|
||||
- Typed conflict severities: Hard (distinct-cves 0.40, disjoint-version-ranges 0.30) vs Soft (overlapping 0.05, severity-mismatch 0.05, alias-inconsistency 0.10)
|
||||
- Patch lineage via commit SHA matching
|
||||
- Version compatibility classification: Equivalent/Overlapping/Disjoint
|
||||
- 8-signal weighted scoring: aliasConnectivity(0.30), packageCoverage(0.20), aliasAuthority(0.10), versionCompatibility(0.10), cpeMatch(0.10), patchLineage(0.10), referenceOverlap(0.05), freshness(0.05)
|
||||
- Conflict saturation: minimum confidence floor at 0.1
|
||||
- Deterministic: input ordering invariant, conflicts deduplicated by (field, reason, sorted values)
|
||||
|
||||
## Evidence
|
||||
- `docs/qa/feature-checks/runs/concelier/linkset-correlation-v2-algorithm/run-002/tier0-source-check.json`
|
||||
- `docs/qa/feature-checks/runs/concelier/linkset-correlation-v2-algorithm/run-002/tier1-code-review.json`
|
||||
- `docs/qa/feature-checks/runs/concelier/linkset-correlation-v2-algorithm/run-002/tier2-integration-check.json`
|
||||
@@ -0,0 +1,28 @@
|
||||
# Plugin System with DI, Signing, and Version Attributes
|
||||
|
||||
## Module
|
||||
Concelier
|
||||
|
||||
## Status
|
||||
VERIFIED
|
||||
|
||||
## Description
|
||||
Plugin architecture using IDependencyInjectionRoutine and ServiceBinding attributes for dependency injection, with isolated AssemblyLoadContext loading. Cosign signature verification and StellaPluginVersion attributes are defined.
|
||||
|
||||
## Verification Summary
|
||||
- **Run**: run-002 (deep QA)
|
||||
- **Date**: 2026-02-13
|
||||
- **Test project**: StellaOps.Concelier.Core.Tests (569 total, 567 passed, 2 pre-existing)
|
||||
- **Feature-relevant tests**: 14 (JobPluginRegistrationExtensionsTests + ConnectorRegistrationServiceTests)
|
||||
|
||||
## Key Verified Behaviors
|
||||
- Plugin discovery via DI: RegisterJobPluginRoutines scans assembly for IConnectorPlugin, registers PluginHostResult and PluginRoutineExecuted services
|
||||
- Plugin adapter factory: FeedPluginAdapterFactory maps IConnectorPlugin to unified IPlugin + IFeedCapability via FeedPluginAdapter
|
||||
- DI-based registration with metadata-driven schedule, rate policy, egress guard, lock key
|
||||
- Default AuthRef derivation, batch registration, input validation
|
||||
- Job definitions: correct Kind, Timeout, LeaseDuration, CronExpression
|
||||
|
||||
## Evidence
|
||||
- `docs/qa/feature-checks/runs/concelier/plugin-system-with-di-signing-and-version-attributes/run-002/tier0-source-check.json`
|
||||
- `docs/qa/feature-checks/runs/concelier/plugin-system-with-di-signing-and-version-attributes/run-002/tier1-code-review.json`
|
||||
- `docs/qa/feature-checks/runs/concelier/plugin-system-with-di-signing-and-version-attributes/run-002/tier2-integration-check.json`
|
||||
@@ -0,0 +1,28 @@
|
||||
# PostgreSQL as System of Record (with JSONB)
|
||||
|
||||
## Module
|
||||
Concelier
|
||||
|
||||
## Status
|
||||
IMPLEMENTED
|
||||
|
||||
## Description
|
||||
PostgreSQL is universally adopted as the system of record across all persistence-bearing modules via Npgsql/NpgsqlDataSource.
|
||||
|
||||
## Implementation Details
|
||||
- **Modules**: `src/Concelier/__Libraries/StellaOps.Concelier.Persistence/`
|
||||
- **Key Classes**:
|
||||
- `ConcelierDataSource` (`src/Concelier/__Libraries/StellaOps.Concelier.Persistence/Postgres/ConcelierDataSource.cs`) - NpgsqlDataSource wrapper for Concelier
|
||||
- `ConcelierDbContext` (`src/Concelier/__Libraries/StellaOps.Concelier.Persistence/EfCore/Context/ConcelierDbContext.cs`) - EF Core context for Concelier tables
|
||||
- `PostgresDocumentStore` (`src/Concelier/__Libraries/StellaOps.Concelier.Persistence/Postgres/DocumentStore.cs`) - JSONB document store for advisory data
|
||||
- `PostgresAdvisoryStore` (`src/Concelier/__Libraries/StellaOps.Concelier.Persistence/Postgres/Advisories/PostgresAdvisoryStore.cs`) - advisory persistence via Npgsql
|
||||
- `PostgresSourceStateAdapter` (`src/Concelier/__Libraries/StellaOps.Concelier.Persistence/Postgres/SourceStateAdapter.cs`) - source state tracking via Npgsql
|
||||
- **Interfaces**: `IDocumentStore`, `IAdvisoryStore`, `ISourceStateStore`, `IStorageDocumentStore`
|
||||
- **Source**: Feature matrix scan
|
||||
|
||||
## E2E Test Plan
|
||||
- [ ] Verify Concelier connects to PostgreSQL via `ConcelierDataSource` and can read/write advisories
|
||||
- [ ] Verify JSONB storage: store a canonical advisory with nested JSON and retrieve it with full fidelity
|
||||
- [ ] Verify `PostgresDocumentStore` supports document-level operations (get, put, delete)
|
||||
- [ ] Verify EF Core context: `ConcelierDbContext` migrations apply cleanly on a fresh PostgreSQL instance
|
||||
- [ ] Verify connection pooling: multiple concurrent requests share NpgsqlDataSource connections efficiently
|
||||
32
docs/features/checked/concelier/postgresql-storage-layer.md
Normal file
32
docs/features/checked/concelier/postgresql-storage-layer.md
Normal file
@@ -0,0 +1,32 @@
|
||||
# PostgreSQL Storage Layer (Proof Evidence Repositories)
|
||||
|
||||
## Module
|
||||
Concelier
|
||||
|
||||
## Status
|
||||
IMPLEMENTED
|
||||
|
||||
## Description
|
||||
Three PostgreSQL repository implementations backed by Dapper/Npgsql. Database schema defines 6 tables across 3 schemas (vuln: distro_advisories, changelog_evidence, patch_evidence, patch_signatures; feedser: binary_fingerprints; attestor: proof_blobs) with 18 indices including GIN indices for CVE array queries and composite indices for CVE+package lookups.
|
||||
|
||||
## Implementation Details
|
||||
- **Modules**: `src/Concelier/__Libraries/StellaOps.Concelier.Persistence/Postgres/`
|
||||
- **Key Classes**:
|
||||
- `AdvisoryRepository` (`src/Concelier/__Libraries/StellaOps.Concelier.Persistence/Postgres/Repositories/AdvisoryRepository.cs`) - raw advisory CRUD with GIN index support
|
||||
- `AdvisoryCanonicalRepository` (`src/Concelier/__Libraries/StellaOps.Concelier.Persistence/Postgres/Repositories/AdvisoryCanonicalRepository.cs`) - canonical advisory persistence
|
||||
- `PostgresDtoStore` (`src/Concelier/__Libraries/StellaOps.Concelier.Persistence/Postgres/Repositories/PostgresDtoStore.cs`) - DTO storage layer
|
||||
- `PostgresChangeHistoryStore` (`src/Concelier/__Libraries/StellaOps.Concelier.Persistence/Postgres/Repositories/PostgresChangeHistoryStore.cs`) - advisory change history tracking
|
||||
- `PostgresPsirtFlagStore` (`src/Concelier/__Libraries/StellaOps.Concelier.Persistence/Postgres/Repositories/PostgresPsirtFlagStore.cs`) - PSIRT flag persistence
|
||||
- `PostgresJpFlagStore` (`src/Concelier/__Libraries/StellaOps.Concelier.Persistence/Postgres/Repositories/PostgresJpFlagStore.cs`) - JP flag persistence
|
||||
- `InterestScoreRepository` (`src/Concelier/__Libraries/StellaOps.Concelier.Persistence/Postgres/Repositories/InterestScoreRepository.cs`) - interest score persistence
|
||||
- `FeedSnapshotRepository` (`src/Concelier/__Libraries/StellaOps.Concelier.Persistence/Postgres/Repositories/FeedSnapshotRepository.cs`) - feed snapshot persistence
|
||||
- `SyncLedgerRepository` (`src/Concelier/__Libraries/StellaOps.Concelier.Persistence/Postgres/Repositories/SyncLedgerRepository.cs`) - federation sync ledger
|
||||
- **Interfaces**: `IAdvisoryRepository`, `IAdvisoryCanonicalRepository`, `IDtoStore`, `IChangeHistoryStore`
|
||||
- **Source**: Feature matrix scan
|
||||
|
||||
## E2E Test Plan
|
||||
- [ ] Verify CVE array query: insert advisories with multiple CVE IDs and query using GIN index-backed CVE array search
|
||||
- [ ] Verify composite index: query by CVE+package combination and confirm efficient lookup
|
||||
- [ ] Verify change history: update an advisory and confirm `PostgresChangeHistoryStore` records the change
|
||||
- [ ] Verify all 6 tables are created during schema migration across the 3 schemas (vuln, feedser, attestor)
|
||||
- [ ] Verify `SyncLedgerRepository` persists and retrieves federation sync cursors
|
||||
@@ -0,0 +1,27 @@
|
||||
# SBOM-Advisory Intersection Matching and Learning
|
||||
|
||||
## Module
|
||||
Concelier
|
||||
|
||||
## Status
|
||||
IMPLEMENTED
|
||||
|
||||
## Description
|
||||
SBOM registration and learning system that finds which canonical advisories affect an organization's components. Matches by PURL and CPE, triggers interest score updates, and supports incremental delta SBOM matching. Provides POST /api/v1/learn/sbom endpoint and auto-learning from scan events.
|
||||
|
||||
## Implementation Details
|
||||
- **Modules**: `src/Concelier/__Libraries/StellaOps.Concelier.SbomIntegration/`, `src/Concelier/__Libraries/StellaOps.Concelier.Interest/`
|
||||
- **Key Classes**:
|
||||
- `SbomAdvisoryMatcher` (`src/Concelier/__Libraries/StellaOps.Concelier.SbomIntegration/Matching/SbomAdvisoryMatcher.cs`) - matches SBOM components against canonical advisories by PURL and CPE
|
||||
- `ParsedSbomParser` (`src/Concelier/__Libraries/StellaOps.Concelier.SbomIntegration/Parsing/ParsedSbomParser.cs`) - parses SBOMs for component extraction
|
||||
- `InterestScoringService` (`src/Concelier/__Libraries/StellaOps.Concelier.Interest/InterestScoringService.cs`) - triggered to update interest scores after SBOM matching
|
||||
- `InterestScoreCalculator` (`src/Concelier/__Libraries/StellaOps.Concelier.Interest/InterestScoreCalculator.cs`) - recalculates interest based on SBOM intersection
|
||||
- **Interfaces**: `ISbomAdvisoryMatcher`, `IParsedSbomParser`, `IInterestScoringService`
|
||||
- **Source**: SPRINT_8200_0013_0003_SCAN_sbom_intersection_scoring.md
|
||||
|
||||
## E2E Test Plan
|
||||
- [ ] Submit an SBOM via the learn endpoint and verify advisories affecting its components are identified
|
||||
- [ ] Verify PURL matching: SBOM with a component matching an advisory PURL produces a match
|
||||
- [ ] Verify CPE matching: SBOM with a component matching an advisory CPE produces a match
|
||||
- [ ] Verify interest score update: after SBOM learning, affected advisories have their interest scores recalculated
|
||||
- [ ] Verify incremental delta: submit an updated SBOM with new components and verify only the delta is processed
|
||||
@@ -0,0 +1,26 @@
|
||||
# Source Intelligence Parsing (Changelog + Patch Header)
|
||||
|
||||
## Module
|
||||
Concelier
|
||||
|
||||
## Status
|
||||
IMPLEMENTED
|
||||
|
||||
## Description
|
||||
Source intelligence parsing for Tier 2 and Tier 3 evidence collection. Includes changelog parsing (debian/changelog, RPM changelog), patch header parsing, and integration with upstream advisory sources (Debian Security Tracker, Red Hat Errata).
|
||||
|
||||
## Implementation Details
|
||||
- **Modules**: `src/Concelier/__Libraries/StellaOps.Concelier.BackportProof/`, `src/Concelier/__Libraries/StellaOps.Concelier.Connector.Distro.*/`
|
||||
- **Key Classes**:
|
||||
- `BackportEvidenceResolver` (`src/Concelier/__Libraries/StellaOps.Concelier.Merge/Backport/BackportEvidenceResolver.cs`) - resolves backport evidence from changelog and patch header sources
|
||||
- `BackportStatusService` (`src/Concelier/__Libraries/StellaOps.Concelier.BackportProof/Services/BackportStatusService.cs`) - backport status determination from parsed source intelligence
|
||||
- `DebianConnector` (`src/Concelier/__Libraries/StellaOps.Concelier.Connector.Distro.Debian/DebianConnector.cs`) - ingests Debian Security Tracker data
|
||||
- `RedHatConnector` (`src/Concelier/__Libraries/StellaOps.Concelier.Connector.Distro.RedHat/RedHatConnector.cs`) - ingests Red Hat Errata data
|
||||
- **Source**: Feature matrix scan
|
||||
|
||||
## E2E Test Plan
|
||||
- [ ] Parse a debian/changelog file and verify CVE fix entries are correctly extracted as Tier 2 evidence
|
||||
- [ ] Parse an RPM changelog and verify patch entries are extracted
|
||||
- [ ] Parse patch headers and verify commit references and CVE links are extracted as Tier 3 evidence
|
||||
- [ ] Verify integration: Debian Security Tracker data feeds into `BackportEvidenceResolver` for backport verdict
|
||||
- [ ] Verify Red Hat Errata integration: errata data provides evidence for backport status determination
|
||||
@@ -0,0 +1,27 @@
|
||||
# Valkey Advisory Cache Service
|
||||
|
||||
## Module
|
||||
Concelier
|
||||
|
||||
## Status
|
||||
IMPLEMENTED
|
||||
|
||||
## Description
|
||||
Valkey (Redis-compatible) caching layer for canonical advisories with TTL policies based on interest score, PURL index lookups, hot set ranking, and p99 < 20ms read target. Includes cache warmup, metrics, and fallback mode.
|
||||
|
||||
## Implementation Details
|
||||
- **Modules**: `src/Concelier/__Libraries/StellaOps.Concelier.Cache.Valkey/`
|
||||
- **Key Classes**:
|
||||
- `ValkeyAdvisoryCacheService` (`src/Concelier/__Libraries/StellaOps.Concelier.Cache.Valkey/ValkeyAdvisoryCacheService.cs`) - Valkey-backed cache with TTL policies, PURL index, and hot set ranking
|
||||
- `AdvisoryCacheKeys` (`src/Concelier/__Libraries/StellaOps.Concelier.Cache.Valkey/AdvisoryCacheKeys.cs`) - deterministic cache key generation for advisory lookups
|
||||
- `CachingCanonicalAdvisoryService` (`src/Concelier/__Libraries/StellaOps.Concelier.Core/Canonical/CachingCanonicalAdvisoryService.cs`) - caching decorator wrapping the canonical advisory service
|
||||
- **Interfaces**: `IAdvisoryCacheService`
|
||||
- **Source**: SPRINT_8200_0013_0001_GW_valkey_advisory_cache.md
|
||||
|
||||
## E2E Test Plan
|
||||
- [ ] Store a canonical advisory in Valkey and retrieve it, verifying p99 read latency is < 20ms
|
||||
- [ ] Verify TTL policy: high-interest advisories have longer TTLs than low-interest ones
|
||||
- [ ] Verify PURL index lookup: query by PURL and verify matching advisories are returned from cache
|
||||
- [ ] Verify hot set ranking: frequently accessed advisories are promoted in the hot set
|
||||
- [ ] Verify cache warmup: on startup, verify high-interest advisories are pre-loaded into cache
|
||||
- [ ] Verify fallback mode: disable Valkey and confirm the service falls back to direct PostgreSQL queries
|
||||
28
docs/features/checked/concelier/vex-conflict-resolution.md
Normal file
28
docs/features/checked/concelier/vex-conflict-resolution.md
Normal file
@@ -0,0 +1,28 @@
|
||||
# VEX conflict resolution (side-by-side merge with provenance)
|
||||
|
||||
## Module
|
||||
Concelier
|
||||
|
||||
## Status
|
||||
IMPLEMENTED
|
||||
|
||||
## Description
|
||||
VEX conflict resolver and consensus engine merge statements from multiple sources with rationale models explaining merge outcomes.
|
||||
|
||||
## Implementation Details
|
||||
- **Modules**: `src/Concelier/__Libraries/StellaOps.Concelier.SbomIntegration/Vex/`
|
||||
- **Key Classes**:
|
||||
- `VexConflictResolver` (`src/Concelier/__Libraries/StellaOps.Concelier.SbomIntegration/Vex/VexConflictResolver.cs`) - resolves conflicts between VEX statements from multiple sources with provenance-based precedence
|
||||
- `VexConsumptionReporter` (`src/Concelier/__Libraries/StellaOps.Concelier.SbomIntegration/Vex/VexConsumptionReporter.cs`) - reports VEX consumption outcomes and merge rationale
|
||||
- `VexConsumptionPolicyLoader` (`src/Concelier/__Libraries/StellaOps.Concelier.SbomIntegration/Vex/VexConsumptionPolicyLoader.cs`) - loads VEX consumption policies defining merge rules
|
||||
- `VexConsumptionPolicyDefaults` (`src/Concelier/__Libraries/StellaOps.Concelier.SbomIntegration/Vex/VexConsumptionPolicy.cs`) - default merge policy configuration
|
||||
- `VexConsumptionOptions` (`src/Concelier/__Libraries/StellaOps.Concelier.SbomIntegration/Vex/VexConsumptionOptions.cs`) - options for VEX consumption behavior
|
||||
- **Interfaces**: `IVexConflictResolver`, `IVexConsumptionReporter`, `IVexConsumptionPolicyLoader`
|
||||
- **Source**: Feature matrix scan
|
||||
|
||||
## E2E Test Plan
|
||||
- [ ] Submit two conflicting VEX statements (affected vs not_affected) for the same CVE+product and verify the resolver produces a merged outcome with rationale
|
||||
- [ ] Verify provenance-based precedence: vendor VEX statement takes precedence over community source
|
||||
- [ ] Verify `VexConsumptionReporter` emits a report explaining why one statement won over another
|
||||
- [ ] Verify policy-based resolution: load a custom merge policy and confirm it changes the resolution outcome
|
||||
- [ ] Verify side-by-side preservation: both original statements remain accessible after merge
|
||||
@@ -0,0 +1,28 @@
|
||||
# VEX Consumption from SBOM Documents (Embedded VEX Extraction)
|
||||
|
||||
## Module
|
||||
Concelier
|
||||
|
||||
## Status
|
||||
IMPLEMENTED
|
||||
|
||||
## Description
|
||||
Extracts embedded VEX statements from CycloneDX and SPDX SBOMs, evaluates per-statement trust based on source provenance and evidence quality, resolves conflicts when multiple VEX sources disagree, and generates consumption reports. This is distinct from the known "VEX Multi-Source Consensus Engine" which merges standalone VEX documents; this feature specifically processes VEX embedded within SBOM documents.
|
||||
|
||||
## Implementation Details
|
||||
- **Modules**: `src/Concelier/__Libraries/StellaOps.Concelier.SbomIntegration/Vex/`, `src/Concelier/__Libraries/StellaOps.Concelier.SbomIntegration/Parsing/`
|
||||
- **Key Classes**:
|
||||
- `VexConsumptionReporter` (`src/Concelier/__Libraries/StellaOps.Concelier.SbomIntegration/Vex/VexConsumptionReporter.cs`) - generates consumption reports from extracted VEX statements
|
||||
- `VexConsumptionPolicyLoader` (`src/Concelier/__Libraries/StellaOps.Concelier.SbomIntegration/Vex/VexConsumptionPolicyLoader.cs`) - loads trust and precedence policies for VEX evaluation
|
||||
- `VexConflictResolver` (`src/Concelier/__Libraries/StellaOps.Concelier.SbomIntegration/Vex/VexConflictResolver.cs`) - resolves conflicts between embedded VEX statements
|
||||
- `VexConsumptionOptions` (`src/Concelier/__Libraries/StellaOps.Concelier.SbomIntegration/Vex/VexConsumptionOptions.cs`) - configuration for VEX consumption behavior
|
||||
- `ParsedSbomParser` (`src/Concelier/__Libraries/StellaOps.Concelier.SbomIntegration/Parsing/ParsedSbomParser.cs`) - extracts embedded VEX from CycloneDX and SPDX SBOMs
|
||||
- **Interfaces**: `IVexConsumptionReporter`, `IVexConsumptionPolicyLoader`, `IVexConflictResolver`
|
||||
- **Source**: SPRINT_20260119_020_Concelier_vex_consumption.md
|
||||
|
||||
## E2E Test Plan
|
||||
- [ ] Parse a CycloneDX SBOM with embedded VEX statements and verify all VEX entries are extracted
|
||||
- [ ] Parse an SPDX SBOM with embedded VEX and verify extraction works across formats
|
||||
- [ ] Verify per-statement trust evaluation: VEX from a vendor SBOM receives higher trust than from a third-party
|
||||
- [ ] Verify conflict resolution: two embedded VEX statements with conflicting status for the same CVE are resolved with rationale
|
||||
- [ ] Verify consumption report: `VexConsumptionReporter` generates a report listing all consumed VEX statements with trust scores
|
||||
29
docs/features/checked/concelier/vex-distribution-network.md
Normal file
29
docs/features/checked/concelier/vex-distribution-network.md
Normal file
@@ -0,0 +1,29 @@
|
||||
# VEX Distribution Network (Moat Score 3-4)
|
||||
|
||||
## Module
|
||||
Concelier
|
||||
|
||||
## Status
|
||||
IMPLEMENTED
|
||||
|
||||
## Description
|
||||
32 advisory connectors covering national CERTs, distro security trackers, vendor advisories, ICS sources, and general vulnerability databases.
|
||||
|
||||
## Implementation Details
|
||||
- **Modules**: `src/Concelier/__Libraries/StellaOps.Concelier.Connector.*/`, `src/Concelier/__Connectors/`
|
||||
- **Key Connectors** (32 total, each implementing `IFeedConnector` + `IConnectorPlugin`):
|
||||
- **National CERTs**: `CertBundConnector` (Germany), `CertFrConnector` (France), `CertCcConnector` (US), `CertInConnector` (India), `CccsConnector` (Canada), `AcscConnector` (Australia), `KisaConnector` (Korea), `JvnConnector` (Japan), `RuBduConnector` (Russia BDU), `RuNkckiConnector` (Russia NKCKI)
|
||||
- **General Vulnerability DBs**: `NvdConnector`, `OsvConnector`, `GhsaConnector`, `CveConnector`, `KevConnector`, `EpssConnector`
|
||||
- **Distro Security Trackers**: `AlpineConnector`, `DebianConnector`, `RedHatConnector`, `SuseConnector`, `UbuntuConnector`
|
||||
- **Vendor Advisories**: `CiscoConnector`, `VmwareConnector`, `OracleConnector`, `MsrcConnector`, `AppleConnector`, `ChromiumConnector`, `AdobeConnector`
|
||||
- **ICS Sources**: `IcsCisaConnector`, `KasperskyConnector`
|
||||
- **Regional/Special**: `AstraConnector`, `StellaOpsMirrorConnector`
|
||||
- **Orchestration**: `ConnectorRegistrationService`, `ConnectorWorker` (`src/Concelier/__Libraries/StellaOps.Concelier.Core/Orchestration/`)
|
||||
- **Source**: Feature matrix scan
|
||||
|
||||
## E2E Test Plan
|
||||
- [ ] Verify all 32 connectors are discovered and registered by `ConnectorRegistrationService` at startup
|
||||
- [ ] Trigger ingestion for at least one connector from each category (national CERT, general DB, distro, vendor, ICS) and verify advisories are stored
|
||||
- [ ] Verify connector count: query the registration service and confirm 32 connectors are registered
|
||||
- [ ] Verify scheduled ingestion: confirm connectors run on their configured schedules without manual intervention
|
||||
- [ ] Verify air-gap support: configure a connector in offline mode and verify it falls back to local bundle
|
||||
Reference in New Issue
Block a user