up teams work

src/StellaOps.Feedser/StellaOps.Feedser.Exporter.Json/AGENTS.md

@@ -0,0 +1,23 @@
+# AGENTS
+## Role
+Optional exporter producing vuln-list-shaped JSON tree for downstream trivy-db builder or interoperability. Deterministic, provenance-preserving.
+## Scope
+- Transform canonical advisories into directory tree structure mirroring aquasecurity/vuln-list (by ecosystem/vendor/distro as applicable).
+- Sorting and serialization invariants: stable key order, newline policy, UTC ISO-8601.
+- Cursoring/incremental export: export_state tracks last advisory hash/time to avoid full rewrites.
+- Packaging: output directory under exports/json/<timestamp> with reproducible naming; optionally symlink latest.
+- Optional auxiliary index files (for example severity summaries) may be generated when explicitly requested, but must remain deterministic and avoid altering canonical payloads.
+## Participants
+- Storage.Mongo.AdvisoryStore as input; ExportState repository for cursors/digests.
+- Core scheduler runs JsonExportJob; Plugin DI wires JsonExporter + job.
+- TrivyDb exporter may consume the rendered tree in v0 (builder path) if configured.
+## Interfaces & contracts
+- Job kind: export:json (JsonExportJob).
+- Determinism: same inputs -> identical file bytes; hash snapshot persisted.
+- Provenance: include minimal provenance fields when helpful; keep identity stable.
+## In/Out of scope
+In: JSON rendering and layout; incremental/deterministic writes.
+Out: ORAS push and Trivy DB BoltDB writing (owned by Trivy exporter).
+## Observability & security expectations
+- Metrics: export.json.records, bytes, duration, delta.changed.
+- Logs: target path, record counts, digest; no sensitive data.