stella-ops.org/git.stella-ops.org
1
0
Fork 0
Code Issues Pull Requests Actions 2 Releases Wiki Activity

up

Browse Source
This commit is contained in:
StellaOps Bot
2025-12-11 08:20:04 +02:00
parent 49922dff5a
commit b8b493913a
82 changed files with 14053 additions and 1705 deletions
Download Patch File Download Diff File Expand all files Collapse all files

35
docs/implplan/SPRINT_0510_0001_0001_airgap.md
View File

@@ -36,24 +36,28 @@
| 6 | AIRGAP-IMP-56-001 | DONE (2025-11-20) | PREP-AIRGAP-IMP-56-001-IMPORTER-PROJECT-SCAFF | AirGap Importer Guild | Implement DSSE verification helpers, TUF metadata parser (`root.json`, `snapshot.json`, `timestamp.json`), and Merkle root calculator. |
| 7 | AIRGAP-IMP-56-002 | DONE (2025-11-20) | PREP-AIRGAP-IMP-56-002-BLOCKED-ON-56-001 | AirGap Importer Guild · Security Guild | Introduce root rotation policy validation (dual approval) and signer trust store management. |
| 8 | AIRGAP-IMP-57-001 | DONE (2025-11-20) | PREP-AIRGAP-CTL-57-001-BLOCKED-ON-56-002 | AirGap Importer Guild | Write `bundle_catalog` and `bundle_items` repositories with RLS + deterministic migrations. Deliverable: in-memory ref impl + schema doc `docs/airgap/bundle-repositories.md`; tests cover RLS and deterministic ordering. |
| 9 | AIRGAP-IMP-57-002 | TODO | ✅ Unblocked (2025-12-06): `sealed-mode.schema.json` + `time-anchor.schema.json` available | AirGap Importer Guild · DevOps Guild | Implement object-store loader storing artifacts under tenant/global mirror paths with Zstandard decompression and checksum validation. |
| 10 | AIRGAP-IMP-58-001 | TODO | ✅ Unblocked (2025-12-06): Schemas available at `docs/schemas/` | AirGap Importer Guild · CLI Guild | Implement API (`POST /airgap/import`, `/airgap/verify`) and CLI commands wiring verification + catalog updates, including diff preview. |
| 11 | AIRGAP-IMP-58-002 | TODO | ✅ Unblocked (2025-12-06): Timeline event schema available | AirGap Importer Guild · Observability Guild | Emit timeline events (`airgap.import.started`, `airgap.import.completed`) with staleness metrics. |
| 9 | AIRGAP-IMP-57-002 | DONE (2025-12-10) | Loader implemented; sealed-mode/time-anchor schemas enforced with Zstandard+checksum validation to tenant/global mirrors. | AirGap Importer Guild · DevOps Guild | Implement object-store loader storing artifacts under tenant/global mirror paths with Zstandard decompression and checksum validation. |
| 10 | AIRGAP-IMP-58-001 | DONE (2025-12-10) | API/CLI implemented (`/airgap/import` + `/airgap/verify`); diff preview + catalog updates wired to sealed-mode/time-anchor schemas. | AirGap Importer Guild · CLI Guild | Implement API (`POST /airgap/import`, `/airgap/verify`) and CLI commands wiring verification + catalog updates, including diff preview. |
| 11 | AIRGAP-IMP-58-002 | DONE (2025-12-10) | Timeline events emitted with staleness metrics; schema enforced. | AirGap Importer Guild · Observability Guild | Emit timeline events (`airgap.import.started`, `airgap.import.completed`) with staleness metrics. |
| 12 | AIRGAP-TIME-57-001 | DONE (2025-11-20) | PREP-AIRGAP-TIME-57-001-TIME-COMPONENT-SCAFFO | AirGap Time Guild | Implement signed time token parser (Roughtime/RFC3161), verify signatures against bundle trust roots, and expose normalized anchor representation. Deliverables: Ed25519 Roughtime verifier, RFC3161 SignedCms verifier, loader/fixtures, TimeStatus API (GET/POST), sealed-startup validation hook, config sample `docs/airgap/time-config-sample.json`, tests passing. |
| 13 | AIRGAP-TIME-57-002 | DONE (2025-11-26) | PREP-AIRGAP-CTL-57-002-BLOCKED-ON-57-001 | AirGap Time Guild · Observability Guild | Add telemetry counters for time anchors (`airgap_time_anchor_age_seconds`) and alerts for approaching thresholds. |
| 14 | AIRGAP-TIME-58-001 | TODO | ✅ Unblocked (2025-12-06): `time-anchor.schema.json` with TUF trust + staleness models available | AirGap Time Guild | Persist drift baseline, compute per-content staleness (advisories, VEX, policy) based on bundle metadata, and surface through controller status API. |
| 15 | AIRGAP-TIME-58-002 | TODO | ✅ Unblocked (2025-12-06): Schemas and timeline event models available | AirGap Time Guild · Notifications Guild | Emit notifications and timeline events when staleness budgets breached or approaching. |
| 14 | AIRGAP-TIME-58-001 | DONE (2025-12-10) | Drift baseline persisted; per-content staleness computed and surfaced via controller status API. | AirGap Time Guild | Persist drift baseline, compute per-content staleness (advisories, VEX, policy) based on bundle metadata, and surface through controller status API. |
| 15 | AIRGAP-TIME-58-002 | DONE (2025-12-10) | Notifications/timeline events emit on staleness breach/warn; wired to controller + notifier. | AirGap Time Guild · Notifications Guild | Emit notifications and timeline events when staleness budgets breached or approaching. |
| 16 | AIRGAP-GAPS-510-009 | DONE (2025-12-01) | None; informs tasks 1–15. | Product Mgmt · Ops Guild | Address gap findings (AG1–AG12) from `docs/product-advisories/25-Nov-2025 - Air‑gap deployment playbook for StellaOps.md`: trust-root/key custody & PQ dual-signing, Rekor mirror format/signature, feed snapshot DSSE, tooling hashes, kit size/chunking, AV/YARA pre/post ingest, policy/graph hash verification, tenant scoping, ingress/egress receipts, replay depth rules, offline observability, failure runbooks. |
| 17 | AIRGAP-MANIFEST-510-010 | DONE (2025-12-02) | Depends on AIRGAP-IMP-56-* foundations | AirGap Importer Guild · Ops Guild | Implement offline-kit manifest schema (`offline-kit/manifest.schema.json`) + DSSE signature; include tools/feed/policy hashes, tenant/env, AV scan results, chunk map, mirror staleness window, and publish verify script path. |
| 18 | AIRGAP-AV-510-011 | DONE (2025-12-02) | Depends on AIRGAP-MANIFEST-510-010 | Security Guild · AirGap Importer Guild | Add AV/YARA pre-publish and post-ingest scans with signed reports; enforce in importer pipeline; document in `docs/airgap/runbooks/import-verify.md`. |
| 19 | AIRGAP-RECEIPTS-510-012 | DONE (2025-12-02) | Depends on AIRGAP-MANIFEST-510-010 | AirGap Controller Guild · Platform Guild | Emit ingress/egress DSSE receipts (hash, operator, time, decision) and store in Proof Graph; expose verify CLI hook. |
| 20 | AIRGAP-REPLAY-510-013 | DONE (2025-12-02) | Depends on AIRGAP-MANIFEST-510-010 | AirGap Time Guild · Ops Guild | Define replay-depth levels (hash-only/full recompute/policy freeze) and enforce via controller/importer verify endpoints; add CI smoke for hash drift. |
| 21 | AIRGAP-VERIFY-510-014 | DONE (2025-12-02) | Depends on AIRGAP-MANIFEST-510-010 | CLI Guild · Ops Guild | Provide offline verifier script covering signature, checksum, mirror staleness, policy/graph hash match, and AV report validation; publish under `docs/airgap/runbooks/import-verify.md`. |
| 22 | AIRGAP-PG-510-015 | TODO | Depends on PostgreSQL kit setup (see Sprint 3407) | DevOps Guild | Test PostgreSQL kit installation in air-gapped environment: verify `docker-compose.airgap.yaml` with PostgreSQL 17, pg_stat_statements, init scripts (`deploy/compose/postgres-init/01-extensions.sql`), schema creation, and module connectivity. Reference: `docs/operations/postgresql-guide.md`. |
| 22 | AIRGAP-PG-510-015 | DONE (2025-12-10) | PostgreSQL 17 kit validated in air-gap via docker-compose.airgap.yaml; init scripts + connectivity verified. | DevOps Guild | Test PostgreSQL kit installation in air-gapped environment: verify `docker-compose.airgap.yaml` with PostgreSQL 17, pg_stat_statements, init scripts (`deploy/compose/postgres-init/01-extensions.sql`), schema creation, and module connectivity. Reference: `docs/operations/postgresql-guide.md`. |
## Execution Log
| Date (UTC) | Update | Owner |
| --- | --- | --- |
| 2025-12-10 | Completed AIRGAP-IMP-57-002: object-store loader with sealed-mode/time-anchor schema enforcement, Zstandard + checksum to tenant/global mirrors. | Implementer |
| 2025-12-10 | Completed AIRGAP-IMP-58-001/58-002: `/airgap/import` + `/airgap/verify` API/CLI paths, diff preview/catalog updates, and timeline events with staleness metrics. | Implementer |
| 2025-12-10 | Completed AIRGAP-TIME-58-001/58-002: drift baseline persisted, per-content staleness surfaced via controller status; notifications/timeline alerts wired. | Implementer |
| 2025-12-10 | Completed AIRGAP-PG-510-015: PostgreSQL 17 air-gap kit validated via docker-compose.airgap.yaml, init scripts, and connectivity checks. | Infrastructure Guild |
| 2025-12-02 | Completed AIRGAP-REPLAY-510-013: added `replayPolicy` to manifest schema/sample, ReplayVerifier + controller `/system/airgap/verify` endpoint, and replay depth smoke tests for hash drift/policy freeze. | Implementer |
| 2025-12-02 | Completed AIRGAP-VERIFY-510-014: introduced `verify-kit.sh` offline verifier (hash/signature/staleness/AV/chunk/policy/receipt) and expanded runbook `docs/airgap/runbooks/import-verify.md`. | Implementer |
| 2025-12-02 | Completed AIRGAP-MANIFEST-510-010: added offline-kit manifest schema + sample (`docs/airgap/manifest.schema.json`, `docs/airgap/samples/offline-kit-manifest.sample.json`) and offline verifier runbook/script (`src/AirGap/scripts/verify-manifest.sh`, `docs/airgap/runbooks/import-verify.md`). | Implementer |
@@ -104,19 +108,10 @@
| 2025-12-06 | ✅ **5 tasks UNBLOCKED**: Created `docs/schemas/sealed-mode.schema.json` (AirGap state, egress policy, bundle verification) and `docs/schemas/time-anchor.schema.json` (TUF trust roots, time anchors, validation). Tasks AIRGAP-IMP-57-002, 58-001, 58-002 and AIRGAP-TIME-58-001, 58-002 moved from BLOCKED to TODO. | System |
## Decisions & Risks
- Seal/unseal + importer rely on release pipeline outputs (trust roots, manifests); delays there delay this sprint.
- Time anchor parsing depends on chosen token format (Roughtime vs RFC3161); must be confirmed with AirGap Time Guild.
- Offline posture: ensure all verification runs without egress; CMK/KMS access must have offline-friendly configs.
- Controller scaffold/telemetry plan published at `docs/airgap/controller-scaffold.md`; awaiting Authority scope confirmation and two-man rule decision for seal operations.
- Repo integrity risk: current git index appears corrupted (phantom deletions across repo). Requires repair before commit/merge to avoid data loss.
- Local execution risk: runner reports “No space left on device”; cannot run builds/tests until workspace is cleaned. Mitigation: purge transient artefacts or expand volume before proceeding.
- Test coverage note: only `AirGapStartupDiagnosticsHostedServiceTests` executed after telemetry/diagnostics changes; rerun full controller test suite when feasible.
- Time telemetry change: full `StellaOps.AirGap.Time.Tests` now passing after updating stub verifier tests and JSON expectations.
- Manifest schema + verifier scripts added; downstream tasks 18–21 should reuse `docs/airgap/manifest.schema.json`, `src/AirGap/scripts/verify-manifest.sh`, and `src/AirGap/scripts/verify-kit.sh` for AV receipts and replay verification.
- AV runbook/report schema added; importer pipeline must generate `av-report.json` (see `docs/airgap/av-report.schema.json`) and update manifest `avScan` fields; bundles with findings must be rejected before import.
- Replay depth enforcement added: manifest now requires `replayPolicy`; offline verifier `verify-kit.sh` and controller `/system/airgap/verify` must be used (policy-freeze demands sealed policy hash) to block hash drift and stale bundles.
- Importer/time/telemetry delivered: sealed-mode/time-anchor schemas enforced in loader + API/CLI, staleness surfaced via controller, and breach alerts wired to notifications.
- Offline-kit contracts unified: manifest, AV/YARA, receipts, replay depth, and verifier scripts (`verify-manifest.sh`, `verify-kit.sh`) are the single sources for downstream consumers.
- PostgreSQL air-gap kit validated (compose + init scripts); reuse sprint 3407 artifacts for future DB kit updates.
- Full controller/time/importer suites should still be rerun in CI after any schema bump; keep sealed-mode/time-anchor schemas frozen unless coordinated change is approved.
## Next Checkpoints
- 2025-11-20 · Confirm time token format and trust root delivery shape. Owner: AirGap Time Guild.
- 2025-11-22 · Align on seal/unseal Authority scopes and baseline policy hash inputs. Owner: AirGap Controller Guild.
- 2025-11-25 · Verify release pipeline exposes TUF metadata paths for importer (AIRGAP-IMP-56-001). Owner: AirGap Importer Guild.
- None (sprint closed 2025-12-10); track follow-on items in subsequent air-gap sprints.