stella-ops.org/git.stella-ops.org
1
0
Fork 0
Code Issues Pull Requests Actions 2 Releases Wiki Activity

more features checks. setup improvements

Browse Source
This commit is contained in:
master
2026-02-13 02:04:55 +02:00
parent 9911b7d73c
commit 9ca2de05df
675 changed files with 37550 additions and 1826 deletions
Download Patch File Download Diff File Expand all files Collapse all files

27
docs/qa/feature-checks/runs/policy/blast-radius-fleet-view/run-001/tier0-source-check.json Normal file
View File

@@ -0,0 +1,27 @@
{
"tier": 0,
"type": "source_check",
"capturedAtUtc": "2026-02-12T22:10:00Z",
"feature": "blast-radius-fleet-view",
"module": "policy",
"result": "pass",
"filesExpected": [
"src/Policy/__Libraries/StellaOps.Policy.Unknowns/Models/BlastRadius.cs",
"src/Policy/__Libraries/StellaOps.Policy.Unknowns/Models/ContainmentSignals.cs",
"src/Policy/__Libraries/StellaOps.Policy.Unknowns/Services/UnknownRanker.cs",
"src/Policy/__Libraries/StellaOps.Policy.Unknowns/Models/Unknown.cs",
"src/Policy/__Libraries/StellaOps.Policy.Unknowns/UnknownsBudgetEnforcer.cs",
"src/Policy/StellaOps.Policy.Engine/Endpoints/UnknownsEndpoints.cs"
],
"filesFound": [
"src/Policy/__Libraries/StellaOps.Policy.Unknowns/Models/BlastRadius.cs",
"src/Policy/__Libraries/StellaOps.Policy.Unknowns/Models/ContainmentSignals.cs",
"src/Policy/__Libraries/StellaOps.Policy.Unknowns/Services/UnknownRanker.cs",
"src/Policy/__Libraries/StellaOps.Policy.Unknowns/Models/Unknown.cs",
"src/Policy/__Libraries/StellaOps.Policy.Unknowns/UnknownsBudgetEnforcer.cs",
"src/Policy/StellaOps.Policy.Engine/Endpoints/UnknownsEndpoints.cs"
],
"filesMissing": [],
"percentFound": 100,
"notes": "All 6 source files found. BlastRadius model (27 lines), ContainmentSignals model (24 lines), UnknownRanker service (369 lines) with ComputeContainmentReduction method."
}

27
docs/qa/feature-checks/runs/policy/blast-radius-fleet-view/run-001/tier1-code-review.json Normal file
View File

@@ -0,0 +1,27 @@
{
"tier": 1,
"type": "code_review",
"capturedAtUtc": "2026-02-12T22:12:00Z",
"feature": "blast-radius-fleet-view",
"module": "policy",
"claimsVerified": true,
"missingClaims": [],
"presentClaims": [
"BlastRadius.cs (27 lines): sealed record with Dependents (int), NetFacing (bool), Privilege (string?) fields",
"ContainmentSignals.cs (24 lines): sealed record with Seccomp, FileSystem, NetworkPolicy string fields",
"UnknownRanker.cs (369 lines): sealed class implementing IUnknownRanker with Rank(UnknownRankInput) method",
"ComputeContainmentReduction integrates BlastRadius: Dependents==0 -> 15%, !NetFacing -> 5%, non-root Privilege -> 5%",
"ContainmentSignals integration: Seccomp enforced -> 10%, FileSystem ro -> 10%, NetworkPolicy isolated -> 5%",
"MaxContainmentReduction capped at 40% via Math.Min",
"UnknownRankerOptions with configurable reduction values: IsolatedReduction=0.15m, NotNetFacingReduction=0.05m, NonRootReduction=0.05m",
"UnknownsBudgetEnforcer.cs exists for blast radius-aware budget thresholds",
"UnknownsEndpoints.cs exists for REST API querying unknowns with blast radius data",
"Tests: 35+ tests in UnknownRankerTests.cs covering containment reduction (6 tests), blast radius isolation, cap at 40%, determinism, disabled option"
],
"testFiles": [
"src/Policy/__Tests/StellaOps.Policy.Unknowns.Tests/Services/UnknownRankerTests.cs"
],
"testCount": "35+ tests in UnknownRankerTests.cs covering blast radius containment reduction specifically",
"verdict": "pass",
"notes": "Non-trivial implementation verified. BlastRadius model feeds into ComputeContainmentReduction in UnknownRanker. Isolated package (Dependents=0) gets 15% reduction, not network-facing gets 5%, non-root gets 5%. Containment signals add up to 25% more (seccomp 10%, ro fs 10%, isolated network 5%). Total capped at 40%. Tests verify specific reduction values, cap, determinism, and disable option."
}

27
docs/qa/feature-checks/runs/policy/blast-radius-fleet-view/run-001/tier2-integration-check.json Normal file
View File

@@ -0,0 +1,27 @@
{
"tier": 2,
"type": "integration_check",
"subtype": "2d",
"capturedAtUtc": "2026-02-12T22:15:00Z",
"feature": "blast-radius-fleet-view",
"module": "policy",
"testCommand": "dotnet test src/Policy/StellaOps.Policy.tests.slnf --no-build --verbosity normal",
"testResult": "pass",
"totalTests": 708,
"passedTests": 708,
"failedTests": 0,
"skippedTests": 0,
"relevantTestBehaviors": [
"ComputeContainmentReduction_NullInputs_ReturnsZero - null blast radius and containment returns 0 reduction",
"ComputeContainmentReduction_IsolatedPackage_Returns15Percent - Dependents=0, NetFacing=true yields 15% reduction",
"ComputeContainmentReduction_AllContainmentFactors_CapsAt40Percent - full containment signals + blast radius isolation capped at 40%",
"Rank_WithContainment_AppliesReductionToScore - high score 60.00 reduced to 48.00 with 20% containment (Dependents=0 only)",
"Rank_ContainmentDisabled_NoReduction - EnableContainmentReduction=false yields 0 reduction and full score",
"Rank_ScoreAbove75_AssignsHotBand - maximum uncertainty + KEV pressure yields Hot band",
"Rank_ScoreBetween50And75_AssignsWarmBand - medium factors yield Warm band",
"Rank_ScoreBetween25And50_AssignsColdBand - lower factors yield Cold band",
"Rank_ScoreBelow25_AssignsResolvedBand - minimal factors yield Resolved band"
],
"verdict": "pass",
"notes": "708/708 tests pass. Blast radius fleet view behaviors verified: BlastRadius model (Dependents/NetFacing/Privilege), ContainmentSignals (Seccomp/FileSystem/NetworkPolicy), reduction percentages (15%/5%/5%/10%/10%/5%), 40% cap, band assignment with containment integration, disable option."
}

37
docs/qa/feature-checks/runs/policy/blast-radius-fleet-view/run-002/tier0-source-check.json Normal file
View File

@@ -0,0 +1,37 @@
{
"tier": 0,
"type": "source_check",
"capturedAtUtc": "2026-02-12T23:10:00Z",
"feature": "blast-radius-fleet-view",
"module": "policy",
"runId": "run-002",
"result": "pass",
"filesExpected": [
"src/Policy/__Libraries/StellaOps.Policy.Unknowns/Models/BlastRadius.cs",
"src/Policy/__Libraries/StellaOps.Policy.Unknowns/Models/ContainmentSignals.cs",
"src/Policy/__Libraries/StellaOps.Policy.Unknowns/Services/UnknownRanker.cs",
"src/Policy/__Libraries/StellaOps.Policy.Unknowns/Models/Unknown.cs",
"src/Policy/__Libraries/StellaOps.Policy.Unknowns/UnknownsBudgetEnforcer.cs",
"src/Policy/StellaOps.Policy.Engine/Endpoints/UnknownsEndpoints.cs"
],
"filesFound": [
"src/Policy/__Libraries/StellaOps.Policy.Unknowns/Models/BlastRadius.cs",
"src/Policy/__Libraries/StellaOps.Policy.Unknowns/Models/ContainmentSignals.cs",
"src/Policy/__Libraries/StellaOps.Policy.Unknowns/Services/UnknownRanker.cs",
"src/Policy/__Libraries/StellaOps.Policy.Unknowns/Models/Unknown.cs",
"src/Policy/__Libraries/StellaOps.Policy.Unknowns/UnknownsBudgetEnforcer.cs",
"src/Policy/StellaOps.Policy.Engine/Endpoints/UnknownsEndpoints.cs"
],
"filesMissing": [],
"classesVerified": [
"BlastRadius (sealed record): Dependents, NetFacing, Privilege fields",
"ContainmentSignals (sealed record): Seccomp, FileSystem, NetworkPolicy fields",
"UnknownRanker (sealed class implements IUnknownRanker): ComputeContainmentReduction method",
"Unknown (sealed record): BlastRadius reference field",
"UnknownsBudgetEnforcer: budget-aware threshold enforcement",
"UnknownsEndpoints: REST API for querying unknowns with blast radius data"
],
"percentFound": 100,
"verdict": "pass",
"notes": "All 6 source files verified on disk. BlastRadius model defines Dependents(int)/NetFacing(bool)/Privilege(string?). ContainmentSignals model defines Seccomp/FileSystem/NetworkPolicy. UnknownRanker.ComputeContainmentReduction implements blast radius scoring with configurable reductions."
}

50
docs/qa/feature-checks/runs/policy/blast-radius-fleet-view/run-002/tier2-integration-check.json Normal file
View File

@@ -0,0 +1,50 @@
{
"tier": 2,
"type": "integration",
"subtype": "2d",
"capturedAtUtc": "2026-02-12T23:12:00Z",
"feature": "blast-radius-fleet-view",
"module": "policy",
"runId": "run-002",
"testCommand": "dotnet test src/Policy/StellaOps.Policy.tests.slnf --filter \"FullyQualifiedName~UnknownRankerTests\" --no-restore -v normal",
"testFilter": "FullyQualifiedName~UnknownRankerTests",
"testProject": "StellaOps.Policy.Tests",
"testFile": "src/Policy/__Tests/StellaOps.Policy.Unknowns.Tests/Services/UnknownRankerTests.cs",
"testsRun": 708,
"testsPassed": 708,
"testsFailed": 0,
"testsSkipped": 0,
"filterNote": "Microsoft.Testing.Platform runs all 708 tests in the slnf; filter is advisory. UnknownRankerTests contains 34 targeted test methods covering blast radius fleet view behaviors.",
"targetedTestMethods": [
"ComputeContainmentReduction_NullInputs_ReturnsZero",
"ComputeContainmentReduction_IsolatedPackage_Returns15Percent",
"ComputeContainmentReduction_AllContainmentFactors_CapsAt40Percent",
"Rank_WithContainment_AppliesReductionToScore",
"Rank_ContainmentDisabled_NoReduction",
"Rank_ScoreAbove75_AssignsHotBand",
"Rank_ScoreBetween50And75_AssignsWarmBand",
"Rank_ScoreBetween25And50_AssignsColdBand",
"Rank_ScoreBelow25_AssignsResolvedBand"
],
"behaviorVerified": [
"BlastRadius.Dependents=0 yields 15% IsolatedReduction (ComputeContainmentReduction_IsolatedPackage_Returns15Percent asserts 0.15m)",
"BlastRadius.NetFacing=false yields 5% NotNetFacingReduction (covered in AllContainmentFactors test with NetFacing=false)",
"BlastRadius.Privilege='none' yields 5% NonRootReduction (covered in AllContainmentFactors test with Privilege='none')",
"ContainmentSignals.Seccomp='enforced' yields 10% reduction (covered in AllContainmentFactors test)",
"ContainmentSignals.FileSystem='ro' yields 10% reduction (covered in AllContainmentFactors test)",
"ContainmentSignals.NetworkPolicy='isolated' yields 5% reduction (covered in AllContainmentFactors test)",
"Maximum containment reduction capped at 40% (AllContainmentFactors_CapsAt40Percent asserts 0.40m with total signals summing to 50%)",
"Score with containment: 60.00 * (1 - 0.20) = 48.00 (Rank_WithContainment_AppliesReductionToScore)",
"EnableContainmentReduction=false disables all reduction (Rank_ContainmentDisabled_NoReduction asserts 0m reduction and full 60.00 score)",
"Null blast radius and containment returns 0 reduction (ComputeContainmentReduction_NullInputs_ReturnsZero)",
"Band assignment: Hot >= 75, Warm >= 50, Cold >= 25, Resolved < 25 (4 band tests with meaningful score range assertions)"
],
"assertionTypes": [
"FluentAssertions .Should().Be() for exact decimal score equality",
"FluentAssertions .Should().BeGreaterThanOrEqualTo() for band threshold ranges",
"FluentAssertions .Should().BeLessThan() for upper band boundary exclusion",
"FluentAssertions .Should().Be(UnknownBand.Hot/Warm/Cold/Resolved) for enum band assignment"
],
"verdict": "pass",
"notes": "708/708 tests pass (3.6s). UnknownRankerTests comprehensively covers blast radius fleet view: BlastRadius model (Dependents/NetFacing/Privilege), ContainmentSignals model (Seccomp/FileSystem/NetworkPolicy), per-factor reduction percentages (15%/5%/5%/10%/10%/5%), 40% max cap, score application formula (decayedScore * (1 - containmentReduction)), disable option via EnableContainmentReduction=false, and band assignment integration."
}