Fix release health multi-scope evidence contracts

2026-03-07 05:13:36 +02:00
parent afa23fc504
commit b70457712b
15 changed files with 842 additions and 36 deletions
--- a/src/Platform/StellaOps.Platform.WebService/Contracts/EvidenceReadModels.cs
+++ b/src/Platform/StellaOps.Platform.WebService/Contracts/EvidenceReadModels.cs
@@ -0,0 +1,13 @@
+using System;
+
+namespace StellaOps.Platform.WebService.Contracts;
+
+public sealed record EvidencePackProjection(
+    string CapsuleId,
+    string RunId,
+    string ReleaseId,
+    string? Environment,
+    string? Region,
+    string Status,
+    DateTimeOffset UpdatedAt,
+    string CapsuleRoute);
--- a/src/Platform/StellaOps.Platform.WebService/Endpoints/EvidenceReadModelEndpoints.cs
+++ b/src/Platform/StellaOps.Platform.WebService/Endpoints/EvidenceReadModelEndpoints.cs
@@ -0,0 +1,83 @@
+using Microsoft.AspNetCore.Builder;
+using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.AspNetCore.Routing;
+using StellaOps.Auth.ServerIntegration.Tenancy;
+using StellaOps.Platform.WebService.Constants;
+using StellaOps.Platform.WebService.Contracts;
+using StellaOps.Platform.WebService.Services;
+using System.Threading;
+using System.Threading.Tasks;
+
+namespace StellaOps.Platform.WebService.Endpoints;
+
+public static class EvidenceReadModelEndpoints
+{
+    public static IEndpointRouteBuilder MapEvidenceReadModelEndpoints(this IEndpointRouteBuilder app)
+    {
+        var evidence = app.MapGroup("/api/v2/evidence")
+            .WithTags("Evidence V2")
+            .RequireAuthorization(PlatformPolicies.ReleaseControlRead)
+            .RequireTenant();
+
+        evidence.MapGet("/packs", async Task<IResult>(
+            HttpContext context,
+            PlatformRequestContextResolver resolver,
+            ReleaseReadModelService service,
+            TimeProvider timeProvider,
+            [AsParameters] EvidencePackListQuery query,
+            CancellationToken cancellationToken) =>
+        {
+            if (!TryResolveContext(context, resolver, out var requestContext, out var failure))
+            {
+                return failure!;
+            }
+
+            var page = await service.ListEvidencePacksAsync(
+                requestContext!,
+                query.Region,
+                query.Environment,
+                query.Limit,
+                query.Offset,
+                cancellationToken).ConfigureAwait(false);
+
+            return Results.Ok(new PlatformListResponse<EvidencePackProjection>(
+                requestContext!.TenantId,
+                requestContext.ActorId,
+                timeProvider.GetUtcNow(),
+                Cached: false,
+                CacheTtlSeconds: 0,
+                page.Items,
+                page.Total,
+                page.Limit,
+                page.Offset));
+        })
+        .WithName("ListEvidencePacksV2")
+        .WithSummary("List Pack-22 evidence pack projections")
+        .RequireAuthorization(PlatformPolicies.ReleaseControlRead);
+
+        return app;
+    }
+
+    private static bool TryResolveContext(
+        HttpContext context,
+        PlatformRequestContextResolver resolver,
+        out PlatformRequestContext? requestContext,
+        out IResult? failure)
+    {
+        if (resolver.TryResolve(context, out requestContext, out var error))
+        {
+            failure = null;
+            return true;
+        }
+
+        failure = Results.BadRequest(new { error = error ?? "tenant_missing" });
+        return false;
+    }
+
+    public sealed record EvidencePackListQuery(
+        string? Region,
+        string? Environment,
+        int? Limit,
+        int? Offset);
+}
--- a/src/Platform/StellaOps.Platform.WebService/Program.cs
+++ b/src/Platform/StellaOps.Platform.WebService/Program.cs
@@ -321,6 +321,7 @@ app.MapReleaseControlEndpoints();
 app.MapReleaseReadModelEndpoints();
 app.MapTopologyReadModelEndpoints();
 app.MapSecurityReadModelEndpoints();
+app.MapEvidenceReadModelEndpoints();
 app.MapIntegrationReadModelEndpoints();
 app.MapLegacyAliasEndpoints();
 app.MapPackAdapterEndpoints();
--- a/src/Platform/StellaOps.Platform.WebService/Services/ReleaseReadModelService.cs
+++ b/src/Platform/StellaOps.Platform.WebService/Services/ReleaseReadModelService.cs
@@ -37,8 +37,8 @@ public sealed class ReleaseReadModelService
    {
        var normalizedLimit = NormalizeLimit(limit);
        var normalizedOffset = NormalizeOffset(offset);
-        var normalizedRegion = NormalizeFilter(region);
-        var normalizedEnvironment = NormalizeFilter(environment);
+        var regionFilter = ParseFilterSet(region);
+        var environmentFilter = ParseFilterSet(environment);
        var normalizedType = NormalizeFilter(releaseType);
        var normalizedStatus = NormalizeFilter(status);

@@ -66,8 +66,8 @@ public sealed class ReleaseReadModelService
        var projected = bundles
            .Select(bundle => BuildReleaseProjection(bundle, runsByBundle.GetValueOrDefault(bundle.Id, Array.Empty<ReleaseControlBundleMaterializationRun>())))
            .Where(release =>
-                (string.IsNullOrEmpty(normalizedRegion) || string.Equals(release.TargetRegion, normalizedRegion, StringComparison.Ordinal))
-                && (string.IsNullOrEmpty(normalizedEnvironment) || string.Equals(release.TargetEnvironment, normalizedEnvironment, StringComparison.Ordinal))
+                MatchesFilters(release.TargetRegion, regionFilter)
+                && MatchesFilters(release.TargetEnvironment, environmentFilter)
                && (string.IsNullOrEmpty(normalizedType) || string.Equals(release.ReleaseType, normalizedType, StringComparison.Ordinal))
                && (string.IsNullOrEmpty(normalizedStatus) || string.Equals(release.Status, normalizedStatus, StringComparison.Ordinal)))
            .OrderByDescending(release => release.UpdatedAt)
@@ -132,8 +132,8 @@ public sealed class ReleaseReadModelService
    {
        var normalizedLimit = NormalizeLimit(limit);
        var normalizedOffset = NormalizeOffset(offset);
-        var normalizedRegion = NormalizeFilter(region);
-        var normalizedEnvironment = NormalizeFilter(environment);
+        var regionFilter = ParseFilterSet(region);
+        var environmentFilter = ParseFilterSet(environment);

        var bundles = await store.ListBundlesAsync(
            context.TenantId,
@@ -184,8 +184,8 @@ public sealed class ReleaseReadModelService

        var filtered = activity
            .Where(item =>
-                (string.IsNullOrEmpty(normalizedRegion) || string.Equals(item.TargetRegion, normalizedRegion, StringComparison.Ordinal))
-                && (string.IsNullOrEmpty(normalizedEnvironment) || string.Equals(item.TargetEnvironment, normalizedEnvironment, StringComparison.Ordinal)))
+                MatchesFilters(item.TargetRegion, regionFilter)
+                && MatchesFilters(item.TargetEnvironment, environmentFilter))
            .OrderByDescending(item => item.OccurredAt)
            .ThenBy(item => item.ActivityId, StringComparer.Ordinal)
            .ToArray();
@@ -210,8 +210,8 @@ public sealed class ReleaseReadModelService
        var normalizedLimit = NormalizeLimit(limit);
        var normalizedOffset = NormalizeOffset(offset);
        var normalizedStatus = NormalizeFilter(status);
-        var normalizedRegion = NormalizeFilter(region);
-        var normalizedEnvironment = NormalizeFilter(environment);
+        var regionFilter = ParseFilterSet(region);
+        var environmentFilter = ParseFilterSet(environment);

        var bundles = await store.ListBundlesAsync(
            context.TenantId,
@@ -241,8 +241,8 @@ public sealed class ReleaseReadModelService
        var filtered = approvals
            .Where(item =>
                string.Equals(item.Status, effectiveStatus, StringComparison.Ordinal)
-                && (string.IsNullOrEmpty(normalizedRegion) || string.Equals(item.TargetRegion, normalizedRegion, StringComparison.Ordinal))
-                && (string.IsNullOrEmpty(normalizedEnvironment) || string.Equals(item.TargetEnvironment, normalizedEnvironment, StringComparison.Ordinal)))
+                && MatchesFilters(item.TargetRegion, regionFilter)
+                && MatchesFilters(item.TargetEnvironment, environmentFilter))
            .OrderByDescending(item => item.RequestedAt)
            .ThenBy(item => item.ApprovalId, StringComparer.Ordinal)
            .ToArray();
@@ -270,8 +270,8 @@ public sealed class ReleaseReadModelService
    {
        var normalizedStatus = NormalizeFilter(status);
        var normalizedLane = NormalizeFilter(lane);
-        var normalizedEnvironment = NormalizeFilter(environment);
-        var normalizedRegion = NormalizeFilter(region);
+        var environmentFilter = ParseFilterSet(environment);
+        var regionFilter = ParseFilterSet(region);
        var normalizedOutcome = NormalizeFilter(outcome);
        var normalizedLimit = NormalizeLimit(limit);
        var normalizedOffset = NormalizeOffset(offset);
@@ -281,8 +281,8 @@ public sealed class ReleaseReadModelService
            .Where(run =>
                (string.IsNullOrEmpty(normalizedStatus) || string.Equals(run.Status, normalizedStatus, StringComparison.Ordinal))
                && (string.IsNullOrEmpty(normalizedLane) || string.Equals(run.Lane, normalizedLane, StringComparison.Ordinal))
-                && (string.IsNullOrEmpty(normalizedEnvironment) || string.Equals(run.TargetEnvironment, normalizedEnvironment, StringComparison.Ordinal))
-                && (string.IsNullOrEmpty(normalizedRegion) || string.Equals(run.TargetRegion, normalizedRegion, StringComparison.Ordinal))
+                && MatchesFilters(run.TargetEnvironment, environmentFilter)
+                && MatchesFilters(run.TargetRegion, regionFilter)
                && (string.IsNullOrEmpty(normalizedOutcome) || string.Equals(run.Outcome, normalizedOutcome, StringComparison.Ordinal))
                && (needsApproval is null || run.NeedsApproval == needsApproval.Value)
                && (blockedByDataIntegrity is null || run.BlockedByDataIntegrity == blockedByDataIntegrity.Value))
@@ -298,6 +298,53 @@ public sealed class ReleaseReadModelService
        return new ReleasePageResult<ReleaseRunProjection>(paged, projections.Length, normalizedLimit, normalizedOffset);
    }

+    public async Task<ReleasePageResult<EvidencePackProjection>> ListEvidencePacksAsync(
+        PlatformRequestContext context,
+        string? region,
+        string? environment,
+        int? limit,
+        int? offset,
+        CancellationToken cancellationToken = default)
+    {
+        var regionFilter = ParseFilterSet(region);
+        var environmentFilter = ParseFilterSet(environment);
+        var normalizedLimit = NormalizeLimit(limit);
+        var normalizedOffset = NormalizeOffset(offset);
+
+        var projections = (await LoadRunSeedsAsync(context, cancellationToken).ConfigureAwait(false))
+            .Select(seed =>
+            {
+                var run = BuildRunProjection(seed);
+                if (!MatchesFilters(run.TargetRegion, regionFilter) || !MatchesFilters(run.TargetEnvironment, environmentFilter))
+                {
+                    return null;
+                }
+
+                var evidence = BuildRunEvidence(seed);
+                return new EvidencePackProjection(
+                    CapsuleId: evidence.DecisionCapsuleId,
+                    RunId: run.RunId,
+                    ReleaseId: run.ReleaseId,
+                    Environment: run.TargetEnvironment,
+                    Region: run.TargetRegion,
+                    Status: ResolveEvidencePackStatus(run, evidence),
+                    UpdatedAt: run.UpdatedAt,
+                    CapsuleRoute: evidence.CapsuleRoute);
+            })
+            .Where(static item => item is not null)
+            .Select(static item => item!)
+            .OrderByDescending(item => item.UpdatedAt)
+            .ThenBy(item => item.CapsuleId, StringComparer.Ordinal)
+            .ToArray();
+
+        var paged = projections
+            .Skip(normalizedOffset)
+            .Take(normalizedLimit)
+            .ToArray();
+
+        return new ReleasePageResult<EvidencePackProjection>(paged, projections.Length, normalizedLimit, normalizedOffset);
+    }
+
    public async Task<ReleaseRunDetailProjection?> GetRunDetailAsync(
        PlatformRequestContext context,
        Guid runId,
@@ -1469,6 +1516,59 @@ public sealed class ReleaseReadModelService
        return value.Trim().ToLowerInvariant();
    }

+    private static HashSet<string> ParseFilterSet(string? value)
+    {
+        if (string.IsNullOrWhiteSpace(value))
+        {
+            return new HashSet<string>(StringComparer.Ordinal);
+        }
+
+        return value
+            .Split(',', StringSplitOptions.RemoveEmptyEntries | StringSplitOptions.TrimEntries)
+            .Select(static item => NormalizeFilter(item))
+            .Where(static item => !string.IsNullOrWhiteSpace(item))
+            .Select(static item => item!)
+            .ToHashSet(StringComparer.Ordinal);
+    }
+
+    private static bool MatchesFilters(string? value, HashSet<string> filter)
+    {
+        if (filter.Count == 0)
+        {
+            return true;
+        }
+
+        var normalized = NormalizeFilter(value);
+        return normalized is not null && filter.Contains(normalized);
+    }
+
+    private static string ResolveEvidencePackStatus(
+        ReleaseRunProjection run,
+        ReleaseRunEvidenceProjection evidence)
+    {
+        if (evidence.ReplayMismatch)
+        {
+            return "stale";
+        }
+
+        if (run.Status is "queued" or "pending")
+        {
+            return "pending";
+        }
+
+        if (string.Equals(evidence.SignatureStatus, "unsigned", StringComparison.Ordinal))
+        {
+            return "unsigned";
+        }
+
+        if (string.Equals(evidence.ChainCompleteness, "partial", StringComparison.Ordinal))
+        {
+            return "stale";
+        }
+
+        return "current";
+    }
+
    private static int NormalizeLimit(int? value)
    {
        return value switch
--- a/src/Platform/__Tests/StellaOps.Platform.WebService.Tests/EvidenceReadModelEndpointsTests.cs
+++ b/src/Platform/__Tests/StellaOps.Platform.WebService.Tests/EvidenceReadModelEndpointsTests.cs
@@ -0,0 +1,150 @@
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Routing;
+using Microsoft.Extensions.DependencyInjection;
+using StellaOps.Platform.WebService.Constants;
+using StellaOps.Platform.WebService.Contracts;
+using StellaOps.TestKit;
+using System.Linq;
+using System.Net;
+using System.Net.Http.Json;
+
+namespace StellaOps.Platform.WebService.Tests;
+
+public sealed class EvidenceReadModelEndpointsTests : IClassFixture<PlatformWebApplicationFactory>
+{
+    private readonly PlatformWebApplicationFactory _factory;
+
+    public EvidenceReadModelEndpointsTests(PlatformWebApplicationFactory factory)
+    {
+        _factory = factory;
+    }
+
+    [Trait("Category", TestCategories.Unit)]
+    [Fact]
+    public async Task EvidencePacksEndpoint_ReturnsDeterministicFilteredProjections()
+    {
+        var tenantId = Guid.NewGuid().ToString("D");
+        using var client = CreateTenantClient(tenantId);
+
+        var search = await SeedReleaseAsync(client, "search-evidence", "Search Evidence", "us-prod", "critical-fix");
+        var catalog = await SeedReleaseAsync(client, "catalog-evidence", "Catalog Evidence", "eu-prod", "policy-review");
+
+        var first = await client.GetFromJsonAsync<PlatformListResponse<EvidencePackProjection>>(
+            "/api/v2/evidence/packs?region=us-east,eu-west&environment=us-prod,eu-prod&limit=50&offset=0",
+            TestContext.Current.CancellationToken);
+        var second = await client.GetFromJsonAsync<PlatformListResponse<EvidencePackProjection>>(
+            "/api/v2/evidence/packs?region=us-east,eu-west&environment=us-prod,eu-prod&limit=50&offset=0",
+            TestContext.Current.CancellationToken);
+
+        Assert.NotNull(first);
+        Assert.NotNull(second);
+        Assert.NotEmpty(first!.Items);
+        Assert.Equal(
+            first.Items.Select(item => item.CapsuleId).ToArray(),
+            second!.Items.Select(item => item.CapsuleId).ToArray());
+
+        Assert.Contains(first.Items, item => item.ReleaseId == search.Bundle.Id.ToString("D"));
+        Assert.Contains(first.Items, item => item.ReleaseId == catalog.Bundle.Id.ToString("D"));
+        Assert.All(first.Items, item =>
+        {
+            Assert.Contains(item.Region, new[] { "us-east", "eu-west" });
+            Assert.Contains(item.Environment, new[] { "us-prod", "eu-prod" });
+            Assert.False(string.IsNullOrWhiteSpace(item.CapsuleRoute));
+        });
+    }
+
+    [Trait("Category", TestCategories.Unit)]
+    [Fact]
+    public async Task EvidencePacksEndpoint_WithoutTenantHeader_ReturnsBadRequest()
+    {
+        using var client = _factory.CreateClient();
+        var response = await client.GetAsync("/api/v2/evidence/packs", TestContext.Current.CancellationToken);
+        Assert.Equal(HttpStatusCode.BadRequest, response.StatusCode);
+    }
+
+    [Trait("Category", TestCategories.Unit)]
+    [Fact]
+    public void EvidencePacksEndpoint_RequiresReleaseControlReadPolicy()
+    {
+        var endpoints = _factory.Services
+            .GetRequiredService<EndpointDataSource>()
+            .Endpoints
+            .OfType<RouteEndpoint>()
+            .ToArray();
+
+        var endpoint = endpoints.Single(candidate =>
+            string.Equals(candidate.RoutePattern.RawText, "/api/v2/evidence/packs", StringComparison.Ordinal)
+            && candidate.Metadata.GetMetadata<HttpMethodMetadata>()?.HttpMethods.Contains("GET", StringComparer.OrdinalIgnoreCase) == true);
+
+        var policies = endpoint.Metadata
+            .GetOrderedMetadata<IAuthorizeData>()
+            .Select(metadata => metadata.Policy)
+            .Where(static policy => !string.IsNullOrWhiteSpace(policy))
+            .ToArray();
+
+        Assert.Contains(PlatformPolicies.ReleaseControlRead, policies);
+    }
+
+    private static async Task<SeededRelease> SeedReleaseAsync(
+        HttpClient client,
+        string slug,
+        string name,
+        string targetEnvironment,
+        string reason)
+    {
+        var createResponse = await client.PostAsJsonAsync(
+            "/api/v1/release-control/bundles",
+            new CreateReleaseControlBundleRequest(slug, name, $"{name} description"),
+            TestContext.Current.CancellationToken);
+        createResponse.EnsureSuccessStatusCode();
+
+        var bundle = await createResponse.Content.ReadFromJsonAsync<ReleaseControlBundleDetail>(
+            TestContext.Current.CancellationToken);
+        Assert.NotNull(bundle);
+
+        var publishResponse = await client.PostAsJsonAsync(
+            $"/api/v1/release-control/bundles/{bundle!.Id:D}/versions",
+            new PublishReleaseControlBundleVersionRequest(
+                Changelog: "baseline",
+                Components:
+                [
+                    new ReleaseControlBundleComponentInput(
+                        ComponentVersionId: $"{slug}@1.0.0",
+                        ComponentName: slug,
+                        ImageDigest: "sha256:1111111111111111111111111111111111111111111111111111111111111111",
+                        DeployOrder: 10,
+                        MetadataJson: "{\"track\":\"stable\"}")
+                ]),
+            TestContext.Current.CancellationToken);
+        publishResponse.EnsureSuccessStatusCode();
+
+        var version = await publishResponse.Content.ReadFromJsonAsync<ReleaseControlBundleVersionDetail>(
+            TestContext.Current.CancellationToken);
+        Assert.NotNull(version);
+
+        var materializeResponse = await client.PostAsJsonAsync(
+            $"/api/v1/release-control/bundles/{bundle.Id:D}/versions/{version!.Id:D}/materialize",
+            new MaterializeReleaseControlBundleVersionRequest(targetEnvironment, reason, Guid.NewGuid().ToString("N")),
+            TestContext.Current.CancellationToken);
+        materializeResponse.EnsureSuccessStatusCode();
+
+        var run = await materializeResponse.Content.ReadFromJsonAsync<ReleaseControlBundleMaterializationRun>(
+            TestContext.Current.CancellationToken);
+        Assert.NotNull(run);
+
+        return new SeededRelease(bundle, version, run!);
+    }
+
+    private HttpClient CreateTenantClient(string tenantId)
+    {
+        var client = _factory.CreateClient();
+        client.DefaultRequestHeaders.Add("X-StellaOps-Tenant", tenantId);
+        client.DefaultRequestHeaders.Add("X-StellaOps-Actor", "evidence-v2-tests");
+        return client;
+    }
+
+    private sealed record SeededRelease(
+        ReleaseControlBundleDetail Bundle,
+        ReleaseControlBundleVersionDetail Version,
+        ReleaseControlBundleMaterializationRun Run);
+}
--- a/src/Platform/__Tests/StellaOps.Platform.WebService.Tests/ReleaseReadModelEndpointsTests.cs
+++ b/src/Platform/__Tests/StellaOps.Platform.WebService.Tests/ReleaseReadModelEndpointsTests.cs
@@ -133,6 +133,27 @@ public sealed class ReleaseReadModelEndpointsTests : IClassFixture<PlatformWebAp
        Assert.All(euApprovals.Items, item => Assert.Equal("eu-west", item.TargetRegion));
    }

+    [Trait("Category", TestCategories.Unit)]
+    [Fact]
+    public async Task ReleasesEndpoints_AcceptCommaDelimitedRegionAndEnvironmentFilters()
+    {
+        var tenantId = Guid.NewGuid().ToString("D");
+        using var client = CreateTenantClient(tenantId);
+
+        await SeedReleaseAsync(client, "search-hotfix", "Search Hotfix", "us-prod", "critical-fix");
+        await SeedReleaseAsync(client, "catalog-release", "Catalog Release", "eu-prod", "policy-review");
+
+        var activity = await client.GetFromJsonAsync<PlatformListResponse<ReleaseActivityProjection>>(
+            "/api/v2/releases/activity?region=us-east,eu-west&environment=us-prod,eu-prod&limit=50&offset=0",
+            TestContext.Current.CancellationToken);
+
+        Assert.NotNull(activity);
+        Assert.NotEmpty(activity!.Items);
+        Assert.Contains(activity.Items, item => item.TargetRegion == "us-east");
+        Assert.Contains(activity.Items, item => item.TargetRegion == "eu-west");
+        Assert.All(activity.Items, item => Assert.Contains(item.TargetEnvironment, new[] { "us-prod", "eu-prod" }));
+    }
+
    [Trait("Category", TestCategories.Unit)]
    [Fact]
    public async Task ReleasesEndpoints_WithoutTenantHeader_ReturnBadRequest()
--- a/src/Web/StellaOps.Web/src/app/core/context/global-context-http.interceptor.ts
+++ b/src/Web/StellaOps.Web/src/app/core/context/global-context-http.interceptor.ts
@@ -25,13 +25,15 @@ export class GlobalContextHttpInterceptor implements HttpInterceptor {
    }

    if (regions.length > 0 && !params.has('regions') && !params.has('region')) {
-      params = params.set('regions', regions.join(','));
-      params = params.set('region', regions[0]);
+      const regionFilter = regions.join(',');
+      params = params.set('regions', regionFilter);
+      params = params.set('region', regionFilter);
    }

    if (environments.length > 0 && !params.has('environments') && !params.has('environment')) {
-      params = params.set('environments', environments.join(','));
-      params = params.set('environment', environments[0]);
+      const environmentFilter = environments.join(',');
+      params = params.set('environments', environmentFilter);
+      params = params.set('environment', environmentFilter);
    }

    if (timeWindow && !params.has('timeWindow')) {
--- a/src/Web/StellaOps.Web/src/app/core/testing/environment-posture-page.component.spec.ts
+++ b/src/Web/StellaOps.Web/src/app/core/testing/environment-posture-page.component.spec.ts
@@ -0,0 +1,105 @@
+import { provideHttpClient, withInterceptorsFromDi } from '@angular/common/http';
+import { HttpTestingController, provideHttpClientTesting } from '@angular/common/http/testing';
+import { TestBed } from '@angular/core/testing';
+import { ActivatedRoute, convertToParamMap } from '@angular/router';
+import { BehaviorSubject } from 'rxjs';
+
+import { PlatformContextStore } from '../../core/context/platform-context.store';
+import { EnvironmentPosturePageComponent } from '../../features/topology/environment-posture-page.component';
+
+describe('EnvironmentPosturePageComponent', () => {
+  const paramMap$ = new BehaviorSubject(convertToParamMap({}));
+  const queryParamMap$ = new BehaviorSubject(convertToParamMap({}));
+
+  let httpMock: HttpTestingController;
+
+  beforeEach(() => {
+    paramMap$.next(convertToParamMap({}));
+    queryParamMap$.next(convertToParamMap({}));
+
+    TestBed.configureTestingModule({
+      imports: [EnvironmentPosturePageComponent],
+      providers: [
+        provideHttpClient(withInterceptorsFromDi()),
+        provideHttpClientTesting(),
+        {
+          provide: ActivatedRoute,
+          useValue: {
+            paramMap: paramMap$.asObservable(),
+            queryParamMap: queryParamMap$.asObservable(),
+          },
+        },
+        {
+          provide: PlatformContextStore,
+          useValue: {
+            initialize: () => undefined,
+            regionSummary: () => '4 regions',
+          },
+        },
+      ],
+    });
+
+    httpMock = TestBed.inject(HttpTestingController);
+  });
+
+  afterEach(() => {
+    httpMock.verify();
+  });
+
+  it('falls back to synced query environment context when the route has no environmentId param', () => {
+    queryParamMap$.next(convertToParamMap({ environments: 'dev' }));
+
+    const fixture = TestBed.createComponent(EnvironmentPosturePageComponent);
+    const component = fixture.componentInstance;
+
+    const inventoryReq = httpMock.expectOne((req) =>
+      req.url === '/api/v2/topology/environments' && req.params.get('environment') === 'dev',
+    );
+    const runsReq = httpMock.expectOne((req) =>
+      req.url === '/api/v2/releases/activity' && req.params.get('environment') === 'dev',
+    );
+    const findingsReq = httpMock.expectOne((req) =>
+      req.url === '/api/v2/security/findings' && req.params.get('environment') === 'dev',
+    );
+    const capsulesReq = httpMock.expectOne((req) =>
+      req.url === '/api/v2/evidence/packs' && req.params.get('environment') === 'dev',
+    );
+
+    inventoryReq.flush({
+      items: [
+        {
+          environmentId: 'dev',
+          displayName: 'Development',
+          regionId: 'us-east',
+          status: 'healthy',
+        },
+        {
+          environmentId: 'dev',
+          displayName: 'Development',
+          regionId: 'eu-west',
+          status: 'healthy',
+        },
+      ],
+    });
+    runsReq.flush({ items: [] });
+    findingsReq.flush({ items: [] });
+    capsulesReq.flush({ items: [] });
+
+    expect(component.environmentId()).toBe('dev');
+    expect(component.environmentLabel()).toBe('Development');
+    expect(component.regionLabel()).toBe('4 regions');
+    expect(component.error()).toBeNull();
+  });
+
+  it('shows an explicit guidance message when no environment context is available', () => {
+    const fixture = TestBed.createComponent(EnvironmentPosturePageComponent);
+    const component = fixture.componentInstance;
+
+    expect(component.environmentId()).toBe('');
+    expect(component.error()).toBe('Select an environment from Mission Control or Topology to view release health.');
+    expect(component.loading()).toBe(false);
+    expect(component.runRows()).toEqual([]);
+    expect(component.findingRows()).toEqual([]);
+    expect(component.capsuleRows()).toEqual([]);
+  });
+});
--- a/src/Web/StellaOps.Web/src/app/core/testing/global-context-http.interceptor.spec.ts
+++ b/src/Web/StellaOps.Web/src/app/core/testing/global-context-http.interceptor.spec.ts
@@ -0,0 +1,48 @@
+import { HTTP_INTERCEPTORS, HttpClient, provideHttpClient, withInterceptorsFromDi } from '@angular/common/http';
+import { HttpTestingController, provideHttpClientTesting } from '@angular/common/http/testing';
+import { TestBed } from '@angular/core/testing';
+
+import { GlobalContextHttpInterceptor } from '../context/global-context-http.interceptor';
+import { PlatformContextStore } from '../context/platform-context.store';
+
+describe('GlobalContextHttpInterceptor', () => {
+  let http: HttpClient;
+  let httpMock: HttpTestingController;
+
+  beforeEach(() => {
+    TestBed.configureTestingModule({
+      providers: [
+        provideHttpClient(withInterceptorsFromDi()),
+        provideHttpClientTesting(),
+        {
+          provide: HTTP_INTERCEPTORS,
+          useClass: GlobalContextHttpInterceptor,
+          multi: true,
+        },
+        {
+          provide: PlatformContextStore,
+          useValue: {
+            tenantId: () => 'demo-prod',
+            selectedRegions: () => ['apac', 'eu-west', 'us-east', 'us-west'],
+            selectedEnvironments: () => ['dev', 'stage'],
+            timeWindow: () => '24h',
+          },
+        },
+      ],
+    });
+
+    http = TestBed.inject(HttpClient);
+    httpMock = TestBed.inject(HttpTestingController);
+  });
+
+  afterEach(() => {
+    httpMock.verify();
+  });
+
+  it('propagates comma-delimited region and environment scope instead of collapsing to the first selection', () => {
+    http.get('/api/v2/releases/activity').subscribe();
+
+    const request = httpMock.expectOne('/api/v2/releases/activity?tenant=demo-prod&tenantId=demo-prod&regions=apac,eu-west,us-east,us-west&region=apac,eu-west,us-east,us-west&environments=dev,stage&environment=dev,stage&timeWindow=24h');
+    request.flush({ items: [] });
+  });
+});
--- a/src/Web/StellaOps.Web/src/app/features/topology/environment-posture-page.component.ts
+++ b/src/Web/StellaOps.Web/src/app/features/topology/environment-posture-page.component.ts
@@ -1,9 +1,12 @@
 import { HttpClient, HttpParams } from '@angular/common/http';
 import { ChangeDetectionStrategy, Component, computed, inject, signal } from '@angular/core';
 import { ActivatedRoute, RouterLink } from '@angular/router';
-import { forkJoin, of } from 'rxjs';
+import { combineLatest, forkJoin, of } from 'rxjs';
 import { catchError, map, take } from 'rxjs/operators';

+import { PlatformContextStore } from '../../core/context/platform-context.store';
+import { summarizeEnvironmentScope } from './environment-scope-summary';
+
 interface PlatformListResponse<T> {
  items: T[];
 }
@@ -12,6 +15,7 @@ interface EnvironmentInventoryRow {
  environmentId: string;
  displayName: string;
  regionId: string;
+  environmentType?: string;
  status?: string;
 }

@@ -98,8 +102,12 @@ interface EvidenceCapsuleRow {
  changeDetection: ChangeDetectionStrategy.OnPush,
 })
 export class EnvironmentPosturePageComponent {
+  private static readonly MissingEnvironmentMessage =
+    'Select an environment from Mission Control or Topology to view release health.';
+
  private readonly http = inject(HttpClient);
  private readonly route = inject(ActivatedRoute);
+  private readonly context = inject(PlatformContextStore);

  readonly loading = signal(false);
  readonly error = signal<string | null>(null);
@@ -147,12 +155,30 @@ export class EnvironmentPosturePageComponent {
  });

  constructor() {
-    this.route.paramMap.subscribe((params) => {
-      const id = params.get('environmentId') ?? '';
-      this.environmentId.set(id);
-      if (id) {
-        this.reload(id);
+    this.context.initialize();
+
+    combineLatest([this.route.paramMap, this.route.queryParamMap]).subscribe(([params, queryParams]) => {
+      const id = this.resolveEnvironmentId(
+        params.get('environmentId'),
+        queryParams.get('environment'),
+        queryParams.get('environments'),
+        queryParams.get('env'),
+      );
+
+      if (!id) {
+        this.environmentId.set('');
+        this.environmentLabel.set('Environment');
+        this.regionLabel.set('region');
+        this.runRows.set([]);
+        this.findingRows.set([]);
+        this.capsuleRows.set([]);
+        this.loading.set(false);
+        this.error.set(EnvironmentPosturePageComponent.MissingEnvironmentMessage);
+        return;
      }
+
+      this.environmentId.set(id);
+      this.reload(id);
    });
  }

@@ -160,12 +186,12 @@ export class EnvironmentPosturePageComponent {
    this.loading.set(true);
    this.error.set(null);

-    const envParams = new HttpParams().set('limit', '1').set('offset', '0').set('environment', environmentId);
+    const envParams = new HttpParams().set('limit', '200').set('offset', '0').set('environment', environmentId);
    const inventory$ = this.http
      .get<PlatformListResponse<EnvironmentInventoryRow>>('/api/v2/topology/environments', { params: envParams })
      .pipe(
-        map((response) => response.items?.[0] ?? null),
-        catchError(() => of(null)),
+        map((response) => response.items ?? []),
+        catchError(() => of([] as EnvironmentInventoryRow[])),
      );

    const runs$ = this.http
@@ -193,8 +219,14 @@ export class EnvironmentPosturePageComponent {
      .pipe(take(1))
      .subscribe({
        next: ({ inventory, runs, findings, capsules }) => {
-          this.environmentLabel.set(inventory?.displayName ?? environmentId);
-          this.regionLabel.set(inventory?.regionId ?? 'unknown-region');
+          const scopeSummary = summarizeEnvironmentScope(
+            inventory,
+            environmentId,
+            this.resolveScopeRegionLabel(),
+          );
+
+          this.environmentLabel.set(scopeSummary.environmentLabel);
+          this.regionLabel.set(scopeSummary.regionLabel);
          this.runRows.set(runs);
          this.findingRows.set(findings);
          this.capsuleRows.set(capsules);
@@ -209,6 +241,40 @@ export class EnvironmentPosturePageComponent {
        },
      });
  }
+
+  private resolveEnvironmentId(
+    routeEnvironmentId: string | null,
+    queryEnvironmentId: string | null,
+    queryEnvironments: string | null,
+    legacyEnvironmentId: string | null,
+  ): string {
+    const candidate =
+      routeEnvironmentId
+      ?? queryEnvironmentId
+      ?? this.parseFirstEnvironment(queryEnvironments)
+      ?? legacyEnvironmentId
+      ?? '';
+
+    return candidate.trim();
+  }
+
+  private parseFirstEnvironment(value: string | null): string | null {
+    if (!value) {
+      return null;
+    }
+
+    const first = value
+      .split(',')
+      .map((entry) => entry.trim())
+      .find((entry) => entry.length > 0);
+
+    return first ?? null;
+  }
+
+  private resolveScopeRegionLabel(): string {
+    const summary = this.context.regionSummary();
+    return summary.trim().length > 0 ? summary : 'current scope';
+  }
 }


--- a/src/Web/StellaOps.Web/src/app/features/topology/environment-scope-summary.ts
+++ b/src/Web/StellaOps.Web/src/app/features/topology/environment-scope-summary.ts
@@ -0,0 +1,36 @@
+export interface EnvironmentScopeSummarySource {
+  displayName?: string | null;
+  regionId?: string | null;
+  environmentType?: string | null;
+}
+
+export interface EnvironmentScopeSummary {
+  environmentLabel: string;
+  regionLabel: string;
+  environmentTypeLabel: string;
+  hasMatch: boolean;
+}
+
+export function summarizeEnvironmentScope(
+  rows: readonly EnvironmentScopeSummarySource[],
+  fallbackEnvironmentLabel: string,
+  fallbackRegionLabel: string,
+  fallbackEnvironmentTypeLabel = 'unknown-type',
+): EnvironmentScopeSummary {
+  const displayNames = uniqueNonEmpty(rows.map((row) => row.displayName));
+  const regions = uniqueNonEmpty(rows.map((row) => row.regionId));
+  const environmentTypes = uniqueNonEmpty(rows.map((row) => row.environmentType));
+
+  return {
+    environmentLabel: displayNames.length === 1 ? displayNames[0] : fallbackEnvironmentLabel,
+    regionLabel: regions.length === 1 ? regions[0] : fallbackRegionLabel,
+    environmentTypeLabel: environmentTypes.length === 1 ? environmentTypes[0] : fallbackEnvironmentTypeLabel,
+    hasMatch: rows.length > 0,
+  };
+}
+
+function uniqueNonEmpty(values: ReadonlyArray<string | null | undefined>): string[] {
+  return [...new Set(values
+    .map((value) => value?.trim())
+    .filter((value): value is string => Boolean(value && value.length > 0)))];
+}
--- a/src/Web/StellaOps.Web/src/app/features/topology/topology-environment-detail-page.component.ts
+++ b/src/Web/StellaOps.Web/src/app/features/topology/topology-environment-detail-page.component.ts
@@ -5,6 +5,7 @@ import { catchError, forkJoin, of, take } from 'rxjs';

 import { PlatformContextStore } from '../../core/context/platform-context.store';
 import { TopologyDataService } from './topology-data.service';
+import { summarizeEnvironmentScope } from './environment-scope-summary';
 import {
  EvidenceCapsuleRow,
  PlatformListResponse,
@@ -539,10 +540,15 @@ export class TopologyEnvironmentDetailPageComponent {
        ),
    }).subscribe({
      next: ({ environmentRows, targets, agents, runs, findings, capsules }) => {
-        const environment = environmentRows[0];
-        this.environmentLabel.set(environment?.displayName ?? environmentId);
-        this.regionLabel.set(environment?.regionId ?? 'unknown-region');
-        this.environmentTypeLabel.set(environment?.environmentType ?? 'unknown-type');
+        const scopeSummary = summarizeEnvironmentScope(
+          environmentRows,
+          environmentId,
+          this.context.regionSummary(),
+        );
+
+        this.environmentLabel.set(scopeSummary.environmentLabel);
+        this.regionLabel.set(scopeSummary.regionLabel);
+        this.environmentTypeLabel.set(scopeSummary.environmentTypeLabel);

        this.targetRows.set(targets);
        this.agentRows.set(agents);