stella-ops.org/git.stella-ops.org
1
0
Fork 0
Code Issues Pull Requests Actions 16 Releases Wiki Activity

feat: Add documentation and task tracking for Sprints 508 to 514 in Ops & Offline

Browse Source 
- Created detailed markdown files for Sprints 508 (Ops Offline Kit), 509 (Samples), 510 (AirGap), 511 (Api), 512 (Bench), 513 (Provenance), and 514 (Sovereign Crypto Enablement) outlining tasks, dependencies, and owners.
- Introduced a comprehensive Reachability Evidence Delivery Guide to streamline the reachability signal process.
- Implemented unit tests for Advisory AI to block known injection patterns and redact secrets.
- Added AuthoritySenderConstraintHelper to manage sender constraints in OpenIddict transactions.
This commit is contained in:
master
2025-11-08 23:18:28 +02:00
parent 536f6249a6
commit ae69b1a8a1
187 changed files with 4326 additions and 3196 deletions
Download Patch File Download Diff File Expand all files Collapse all files

89
docs/implplan/SPRINT_129_policy_reasoning.md Normal file
View File

@@ -0,0 +1,89 @@
# Sprint 129 - Policy & Reasoning
_Last updated: November 8, 2025. Implementation order is DOING → TODO → BLOCKED._
Focus areas below were split out of the previous combined sprint; execute sections in order unless noted.
## Policy.VII
Dependency: Sprint 120.C - Policy.VI (must land before this track).
Focus: Policy & Reasoning focus on Policy (phase VII).
| # | Task ID & handle | State | Key dependency / next step | Owners |
| --- | --- | --- | --- | --- |
| 1 | POLICY-TEN-48-001 | TODO | Add `tenant_id`/`project_id` columns, enable RLS, update evaluators to require tenant context, and emit rationale IDs including tenant metadata | Policy Guild / src/Policy/StellaOps.Policy.Engine/TASKS.md |
| 2 | REGISTRY-API-27-001 | TODO | Define OpenAPI specification covering workspaces, versions, reviews, simulations, promotions, and attestations; publish typed clients for Console/CLI | Policy Registry Guild / src/Policy/StellaOps.Policy.Registry/TASKS.md |
| 3 | REGISTRY-API-27-002 | TODO | Implement workspace storage (Mongo collections, object storage buckets) with CRUD endpoints, diff history, and retention policies (Deps: REGISTRY-API-27-001) | Policy Registry Guild / src/Policy/StellaOps.Policy.Registry/TASKS.md |
| 4 | REGISTRY-API-27-003 | TODO | Integrate compile endpoint: forward source bundle to Policy Engine, persist diagnostics, symbol table, rule index, and complexity metrics (Deps: REGISTRY-API-27-002) | Policy Registry Guild / src/Policy/StellaOps.Policy.Registry/TASKS.md |
| 5 | REGISTRY-API-27-004 | TODO | Implement quick simulation API with request limits (sample size, timeouts), returning counts, heatmap, sampled explains (Deps: REGISTRY-API-27-003) | Policy Registry Guild / src/Policy/StellaOps.Policy.Registry/TASKS.md |
| 6 | REGISTRY-API-27-005 | TODO | Build batch simulation orchestration: enqueue shards, collect partials, reduce deltas, produce evidence bundles + signed manifest (Deps: REGISTRY-API-27-004) | Policy Registry Guild, Scheduler Guild / src/Policy/StellaOps.Policy.Registry/TASKS.md |
| 7 | REGISTRY-API-27-006 | TODO | Implement review workflow (comments, votes, required approvers, status transitions) with audit trails and webhooks (Deps: REGISTRY-API-27-005) | Policy Registry Guild / src/Policy/StellaOps.Policy.Registry/TASKS.md |
| 8 | REGISTRY-API-27-007 | TODO | Implement publish pipeline: sign source/compiled digests, create attestations, mark version immutable, emit events (Deps: REGISTRY-API-27-006) | Policy Registry Guild, Security Guild / src/Policy/StellaOps.Policy.Registry/TASKS.md |
| 9 | REGISTRY-API-27-008 | TODO | Implement promotion bindings per tenant/environment with canary subsets, rollback path, and environment history (Deps: REGISTRY-API-27-007) | Policy Registry Guild / src/Policy/StellaOps.Policy.Registry/TASKS.md |
| 10 | REGISTRY-API-27-009 | TODO | Instrument metrics/logs/traces (compile time, diagnostics rate, sim queue depth, approval latency) and expose dashboards (Deps: REGISTRY-API-27-008) | Policy Registry Guild, Observability Guild / src/Policy/StellaOps.Policy.Registry/TASKS.md |
| 11 | REGISTRY-API-27-010 | TODO | Build unit/integration/load test suites for compile/sim/review/publish/promote flows; provide seeded fixtures for CI (Deps: REGISTRY-API-27-009) | Policy Registry Guild, QA Guild / src/Policy/StellaOps.Policy.Registry/TASKS.md |
## RiskEngine
Dependency: Sprint 110.A - AdvisoryAI (must land before this track).
Focus: Policy & Reasoning focus on RiskEngine).
| # | Task ID & handle | State | Key dependency / next step | Owners |
| --- | --- | --- | --- | --- |
| 1 | RISK-ENGINE-66-001 | TODO | Scaffold scoring service (job queue, worker loop, provider registry) with deterministic execution harness | Risk Engine Guild / src/RiskEngine/StellaOps.RiskEngine/TASKS.md |
| 2 | RISK-ENGINE-66-002 | TODO | Implement default transforms (linear, minmax, logistic, piecewise), clamping, gating, and contribution calculator (Deps: RISK-ENGINE-66-001) | Risk Engine Guild / src/RiskEngine/StellaOps.RiskEngine/TASKS.md |
| 3 | RISK-ENGINE-67-001 | TODO | Integrate CVSS and KEV providers pulling data from Conseiller; implement reducers (`max`, `any`, `consensus`) (Deps: RISK-ENGINE-66-002) | Risk Engine Guild, Concelier Guild / src/RiskEngine/StellaOps.RiskEngine/TASKS.md |
| 4 | RISK-ENGINE-67-002 | TODO | Integrate VEX gate provider and ensure gating short-circuits scoring as configured (Deps: RISK-ENGINE-67-001) | Risk Engine Guild, Excitor Guild / src/RiskEngine/StellaOps.RiskEngine/TASKS.md |
| 5 | RISK-ENGINE-67-003 | TODO | Add fix availability, asset criticality, and internet exposure providers with caching + TTL enforcement (Deps: RISK-ENGINE-67-002) | Risk Engine Guild, Policy Engine Guild / src/RiskEngine/StellaOps.RiskEngine/TASKS.md |
| 6 | RISK-ENGINE-68-001 | TODO | Persist scoring results + explanation pointers to Findings Ledger; handle incremental updates via input hash (Deps: RISK-ENGINE-67-003) | Risk Engine Guild, Findings Ledger Guild / src/RiskEngine/StellaOps.RiskEngine/TASKS.md |
| 7 | RISK-ENGINE-68-002 | TODO | Expose APIs (`/risk/jobs`, `/risk/results`, `/risk/results/{id}/explanation`); include pagination, filtering, error codes (Deps: RISK-ENGINE-68-001) | Risk Engine Guild, API Guild / src/RiskEngine/StellaOps.RiskEngine/TASKS.md |
| 8 | RISK-ENGINE-69-001 | TODO | Implement simulation mode producing distributions and top movers without mutating ledger (Deps: RISK-ENGINE-68-002) | Risk Engine Guild, Policy Studio Guild / src/RiskEngine/StellaOps.RiskEngine/TASKS.md |
| 9 | RISK-ENGINE-69-002 | TODO | Add telemetry (spans, metrics, logs) for provider latency, job throughput, cache hits; define SLO dashboards (Deps: RISK-ENGINE-69-001) | Risk Engine Guild, Observability Guild / src/RiskEngine/StellaOps.RiskEngine/TASKS.md |
| 10 | RISK-ENGINE-70-001 | TODO | Support offline provider bundles with manifest verification and missing-data reporting (Deps: RISK-ENGINE-69-002) | Risk Engine Guild, Export Guild / src/RiskEngine/StellaOps.RiskEngine/TASKS.md |
| 11 | RISK-ENGINE-70-002 | TODO | Integrate runtime evidence provider and reachability provider outputs with caching + TTL (Deps: RISK-ENGINE-70-001) | Risk Engine Guild, Observability Guild / src/RiskEngine/StellaOps.RiskEngine/TASKS.md |
## VexLens.I
Dependency: Sprint 110.A - AdvisoryAI (must land before this track).
Focus: Policy & Reasoning focus on VexLens (phase I).
| # | Task ID & handle | State | Key dependency / next step | Owners |
| --- | --- | --- | --- | --- |
| 1 | VEXLENS-30-001 | TODO | Implement normalization pipeline for CSAF VEX, OpenVEX, CycloneDX VEX (status mapping, justification mapping, product tree parsing) | VEX Lens Guild / src/VexLens/StellaOps.VexLens/TASKS.md |
| 2 | VEXLENS-30-002 | TODO | Build product mapping library (CPE/CPE2.3/vendor tokens → purl/version) with scope quality scoring and path metadata (Deps: VEXLENS-30-001) | VEX Lens Guild / src/VexLens/StellaOps.VexLens/TASKS.md |
| 3 | VEXLENS-30-003 | TODO | Integrate signature verification (Ed25519, DSSE, PKIX) using issuer keys, annotate evidence with verification state and failure reasons (Deps: VEXLENS-30-002) | VEX Lens Guild, Issuer Directory Guild / src/VexLens/StellaOps.VexLens/TASKS.md |
| 4 | VEXLENS-30-004 | TODO | Implement trust weighting engine (issuer base weights, signature modifiers, recency decay, justification modifiers, scope score adjustments) controlled by policy config (Deps: VEXLENS-30-003) | VEX Lens Guild, Policy Guild / src/VexLens/StellaOps.VexLens/TASKS.md |
| 5 | VEXLENS-30-005 | TODO | Implement consensus algorithm producing `consensus_state`, `confidence`, `weights`, `quorum`, `rationale`; support states: NOT_AFFECTED, AFFECTED, FIXED, UNDER_INVESTIGATION, DISPUTED, INCONCLUSIVE (Deps: VEXLENS-30-004) | VEX Lens Guild / src/VexLens/StellaOps.VexLens/TASKS.md |
| 6 | VEXLENS-30-006 | TODO | Materialize consensus projection storage with idempotent workers triggered by VEX/Policy changes; expose change events for downstream consumers (Deps: VEXLENS-30-005) | VEX Lens Guild, Findings Ledger Guild / src/VexLens/StellaOps.VexLens/TASKS.md |
| 7 | VEXLENS-30-007 | TODO | Expose APIs (`/vex/consensus`, `/vex/consensus/query`, `/vex/consensus/{id}`, `/vex/consensus/simulate`, `/vex/consensus/export`) with pagination, cost budgets, and OpenAPI docs (Deps: VEXLENS-30-006) | VEX Lens Guild / src/VexLens/StellaOps.VexLens/TASKS.md |
| 8 | VEXLENS-30-008 | TODO | Integrate consensus signals with Policy Engine (thresholds, suppression, simulation inputs) and Vuln Explorer detail view (Deps: VEXLENS-30-007) | VEX Lens Guild, Policy Guild / src/VexLens/StellaOps.VexLens/TASKS.md |
| 9 | VEXLENS-30-009 | TODO | Instrument metrics (`vex_consensus_compute_latency`, `vex_consensus_disputed_total`, `vex_signature_verification_rate`), structured logs, and traces; publish dashboards/alerts (Deps: VEXLENS-30-008) | VEX Lens Guild, Observability Guild / src/VexLens/StellaOps.VexLens/TASKS.md |
| 10 | VEXLENS-30-010 | TODO | Develop unit/property/integration/load tests (10M records), determinism harness, fuzz testing for malformed product trees (Deps: VEXLENS-30-009) | VEX Lens Guild, QA Guild / src/VexLens/StellaOps.VexLens/TASKS.md |
| 11 | VEXLENS-30-011 | TODO | Provide deployment manifests, caching configuration, scaling guides, offline kit seeds, and runbooks (Deps: VEXLENS-30-010) | VEX Lens Guild, DevOps Guild / src/VexLens/StellaOps.VexLens/TASKS.md |
| 12 | VEXLENS-AIAI-31-001 | TODO | Expose consensus rationale API enhancements (policy factors, issuer details, mapping issues) for Advisory AI conflict explanations | VEX Lens Guild / src/VexLens/StellaOps.VexLens/TASKS.md |
| 13 | VEXLENS-AIAI-31-002 | TODO | Provide caching hooks for consensus lookups used by Advisory AI (batch endpoints, TTL hints) (Deps: VEXLENS-AIAI-31-001) | VEX Lens Guild / src/VexLens/StellaOps.VexLens/TASKS.md |
| 14 | VEXLENS-EXPORT-35-001 | TODO | Provide consensus snapshot API delivering deterministic JSONL (state, confidence, provenance) for exporter mirror bundles | VEX Lens Guild / src/VexLens/StellaOps.VexLens/TASKS.md |
| 15 | VEXLENS-ORCH-33-001 | TODO | Register `consensus_compute` job type with orchestrator, integrate worker SDK, and expose job planning hooks for consensus batches | VEX Lens Guild / src/VexLens/StellaOps.VexLens/TASKS.md |
## VexLens.II
Dependency: Sprint 120.E - VexLens.I (must land before this track).
Focus: Policy & Reasoning focus on VexLens (phase II).
| # | Task ID & handle | State | Key dependency / next step | Owners |
| --- | --- | --- | --- | --- |
| 1 | VEXLENS-ORCH-34-001 | TODO | Emit consensus completion events into orchestrator run ledger and provenance chain, including confidence metadata (Deps: VEXLENS-ORCH-33-001) | VEX Lens Guild / src/VexLens/StellaOps.VexLens/TASKS.md |
## VulnExplorer
Dependency: Sprint 110.A - AdvisoryAI (must land before this track).
Focus: Policy & Reasoning focus on VulnExplorer).
| # | Task ID & handle | State | Key dependency / next step | Owners |
| --- | --- | --- | --- | --- |
| 1 | VULN-API-29-001 | TODO | Define OpenAPI spec (list/detail/query/simulation/workflow/export), query JSON schema, pagination/grouping contracts, and error codes | Vuln Explorer API Guild / src/VulnExplorer/StellaOps.VulnExplorer.Api/TASKS.md |
| 2 | VULN-API-29-002 | TODO | Implement list/query endpoints with policy parameter, grouping, server paging, caching, and cost budgets (Deps: VULN-API-29-001) | Vuln Explorer API Guild / src/VulnExplorer/StellaOps.VulnExplorer.Api/TASKS.md |
| 3 | VULN-API-29-003 | TODO | Implement detail endpoint aggregating evidence, policy rationale, paths (Graph Explorer deep link), and workflow summary (Deps: VULN-API-29-002) | Vuln Explorer API Guild / src/VulnExplorer/StellaOps.VulnExplorer.Api/TASKS.md |
| 4 | VULN-API-29-004 | TODO | Expose workflow endpoints (assign, comment, accept-risk, verify-fix, target-fix, reopen) that write ledger events with idempotency + validation (Deps: VULN-API-29-003) | Vuln Explorer API Guild, Findings Ledger Guild / src/VulnExplorer/StellaOps.VulnExplorer.Api/TASKS.md |
| 5 | VULN-API-29-005 | TODO | Implement simulation endpoint comparing `policy_from` vs `policy_to`, returning diffs without side effects; hook into Policy Engine batch eval (Deps: VULN-API-29-004) | Vuln Explorer API Guild, Policy Guild / src/VulnExplorer/StellaOps.VulnExplorer.Api/TASKS.md |
| 6 | VULN-API-29-006 | TODO | Integrate resolver results with Graph Explorer: include shortest path metadata, line up deep-link parameters, expose `paths` array in details (Deps: VULN-API-29-005) | Vuln Explorer API Guild / src/VulnExplorer/StellaOps.VulnExplorer.Api/TASKS.md |
| 7 | VULN-API-29-007 | TODO | Enforce RBAC/ABAC scopes; implement CSRF/anti-forgery checks for Console; secure attachment URLs; audit logging (Deps: VULN-API-29-006) | Vuln Explorer API Guild, Security Guild / src/VulnExplorer/StellaOps.VulnExplorer.Api/TASKS.md |
| 8 | VULN-API-29-008 | TODO | Build export orchestrator producing signed bundles (manifest, NDJSON, checksums, signature). Integrate with Findings Ledger for evidence and Policy Engine metadata (Deps: VULN-API-29-007) | Vuln Explorer API Guild / src/VulnExplorer/StellaOps.VulnExplorer.Api/TASKS.md |
| 9 | VULN-API-29-009 | TODO | Instrument metrics (`vuln_list_latency`, `vuln_simulation_latency`, `vuln_export_duration`, `vuln_workflow_events_total`), structured logs, and traces; publish dashboards/alerts (Deps: VULN-API-29-008) | Vuln Explorer API Guild, Observability Guild / src/VulnExplorer/StellaOps.VulnExplorer.Api/TASKS.md |
| 10 | VULN-API-29-010 | TODO | Provide unit/integration/perf tests (5M findings), fuzz query validation, determinism harness comparing repeated queries (Deps: VULN-API-29-009) | Vuln Explorer API Guild, QA Guild / src/VulnExplorer/StellaOps.VulnExplorer.Api/TASKS.md |
| 11 | VULN-API-29-011 | TODO | Package deployment (Helm/Compose), health checks, CI smoke, offline kit steps, and scaling guidance (Deps: VULN-API-29-010) | Vuln Explorer API Guild, DevOps Guild / src/VulnExplorer/StellaOps.VulnExplorer.Api/TASKS.md |