archive audit attempts

docs/contracts/schemas/artifact-canonical-record-v1.schema.json

@@ -0,0 +1,131 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "title": "Artifact Canonical Record v1",
+  "description": "Unified evidence record aggregating all attestations, referrers, and VEX refs for a single artifact identified by canonical_id. See docs/contracts/artifact-canonical-record-v1.md.",
+  "type": "object",
+  "required": ["canonical_id", "format", "sbom_ref", "created_at"],
+  "properties": {
+    "canonical_id": {
+      "type": "string",
+      "description": "sha256:<hex> computed per canonical-sbom-id-v1.md",
+      "pattern": "^sha256:[a-f0-9]{64}$"
+    },
+    "format": {
+      "type": "string",
+      "description": "Canonicalization format identifier",
+      "const": "cyclonedx-jcs:1"
+    },
+    "sbom_ref": {
+      "type": "string",
+      "description": "Content-addressable reference to the SBOM (CAS URI or OCI ref)",
+      "examples": [
+        "cas://sbom/inventory/abc123.json",
+        "oci://registry/repo@sha256:abc123"
+      ]
+    },
+    "attestations": {
+      "type": "array",
+      "description": "All DSSE attestations referencing this artifact",
+      "items": {
+        "type": "object",
+        "required": ["predicate_type", "dsse_digest", "signed_at"],
+        "properties": {
+          "predicate_type": {
+            "type": "string",
+            "description": "Predicate type URI from the predicate registry"
+          },
+          "dsse_digest": {
+            "type": "string",
+            "description": "SHA-256 of the DSSE envelope body",
+            "pattern": "^sha256:[a-f0-9]{64}$"
+          },
+          "signer_keyid": {
+            "type": "string",
+            "description": "Key ID of the signer"
+          },
+          "rekor_entry_id": {
+            "type": "string",
+            "description": "Rekor transparency log entry UUID (null if offline)"
+          },
+          "rekor_tile": {
+            "type": "string",
+            "description": "Rekor tile URL for inclusion proof verification"
+          },
+          "signed_at": {
+            "type": "string",
+            "format": "date-time"
+          }
+        }
+      }
+    },
+    "referrers": {
+      "type": "array",
+      "description": "OCI referrers (symbol bundles, attestation manifests)",
+      "items": {
+        "type": "object",
+        "required": ["media_type", "descriptor_digest"],
+        "properties": {
+          "media_type": {
+            "type": "string",
+            "description": "OCI media type",
+            "examples": [
+              "application/vnd.stella.symbols+tar",
+              "application/vnd.in-toto+json"
+            ]
+          },
+          "descriptor_digest": {
+            "type": "string",
+            "pattern": "^sha256:[a-f0-9]{64}$"
+          },
+          "registry": {
+            "type": "string",
+            "description": "Registry hostname"
+          }
+        }
+      }
+    },
+    "vex_refs": {
+      "type": "array",
+      "description": "VEX consensus records targeting this artifact",
+      "items": {
+        "type": "object",
+        "required": ["vulnerability_id", "consensus_status"],
+        "properties": {
+          "vulnerability_id": {
+            "type": "string",
+            "description": "CVE or advisory ID"
+          },
+          "consensus_status": {
+            "type": "string",
+            "enum": ["affected", "not_affected", "under_investigation", "fixed"]
+          },
+          "confidence_score": {
+            "type": "number",
+            "minimum": 0,
+            "maximum": 1
+          },
+          "consensus_digest": {
+            "type": "string",
+            "description": "SHA-256 of the VexLens consensus record"
+          },
+          "dsse_digest": {
+            "type": "string",
+            "description": "SHA-256 of the VEX attestation DSSE (if signed)"
+          },
+          "rekor_tile": {
+            "type": "string",
+            "description": "Rekor tile URL (if anchored)"
+          }
+        }
+      }
+    },
+    "created_at": {
+      "type": "string",
+      "format": "date-time"
+    },
+    "updated_at": {
+      "type": "string",
+      "format": "date-time"
+    }
+  }
+}

docs/contracts/schemas/triage-suppress-v1.schema.json

@@ -0,0 +1,60 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "title": "Triage Suppress Predicate v1",
+  "description": "Predicate schema for stella.ops/triageSuppress@v1. See docs/contracts/triage-suppress-v1.md.",
+  "type": "object",
+  "required": ["cve_id", "suppress_reason", "vex_consensus", "witness_evidence", "reachability_state", "timestamp"],
+  "properties": {
+    "cve_id": {
+      "type": "string",
+      "description": "CVE identifier (e.g., CVE-2025-0001)",
+      "pattern": "^CVE-\\d{4}-\\d{4,}$"
+    },
+    "suppress_reason": {
+      "type": "string",
+      "enum": ["vex_not_affected_with_unreachability_confirmation"],
+      "description": "Machine-readable reason for suppression"
+    },
+    "vex_consensus": {
+      "type": "object",
+      "required": ["status", "confidence_score", "consensus_digest", "computed_at"],
+      "properties": {
+        "status": { "type": "string", "enum": ["not_affected"] },
+        "justification": { "type": "string" },
+        "confidence_score": { "type": "number", "minimum": 0, "maximum": 1 },
+        "consensus_digest": { "type": "string", "description": "SHA-256 of the VexLens consensus record" },
+        "source_count": { "type": "integer", "description": "Number of VEX sources contributing" },
+        "computed_at": { "type": "string", "format": "date-time" }
+      }
+    },
+    "witness_evidence": {
+      "type": "object",
+      "required": ["witness_id", "dsse_digest", "observation_type"],
+      "properties": {
+        "witness_id": { "type": "string", "description": "Witness ID (wit:sha256:...)" },
+        "dsse_digest": { "type": "string", "description": "SHA-256 of the witness DSSE envelope" },
+        "observation_type": { "type": "string", "enum": ["RuntimeUnobserved", "ConfirmedUnreachable", "StaticallyUnreachable"] },
+        "predicate_type": { "type": "string", "description": "URI of the witness predicate type" }
+      }
+    },
+    "reachability_state": {
+      "type": "string",
+      "enum": ["ConfirmedUnreachable", "StaticallyUnreachable", "RuntimeUnobserved"],
+      "description": "Lattice state from the 8-state reachability model"
+    },
+    "timestamp": {
+      "type": "string",
+      "format": "date-time",
+      "description": "UTC timestamp of suppression evaluation"
+    },
+    "deterministic_replay_inputs": {
+      "type": "object",
+      "description": "Inputs sufficient to replay this suppression decision",
+      "properties": {
+        "canonical_id": { "type": "string" },
+        "vex_consensus_digest": { "type": "string" },
+        "witness_id": { "type": "string" }
+      }
+    }
+  }
+}