stella-ops.org/git.stella-ops.org
1
0
Fork 0
Code Issues Pull Requests Actions 2 Releases Wiki Activity

up

Browse Source
This commit is contained in:
StellaOps Bot
2025-12-11 08:20:04 +02:00
parent 49922dff5a
commit b8b493913a
82 changed files with 14053 additions and 1705 deletions
Download Patch File Download Diff File Expand all files Collapse all files

28
docs/implplan/tasks-all.md
View File

@@ -108,13 +108,13 @@
| AIRGAP-IMP-56-001 | DONE (2025-11-20) | 2025-11-20 | SPRINT_510_airgap | AirGap Importer Guild | src/AirGap/StellaOps.AirGap.Importer | Implement DSSE verification helpers, TUF metadata parser (`root.json`, `snapshot.json`, `timestamp.json`), and Merkle root calculator. | — | AGIM0101 |
| AIRGAP-IMP-56-002 | DONE (2025-11-20) | 2025-11-20 | SPRINT_510_airgap | AirGap Importer Guild + Security Guild | src/AirGap/StellaOps.AirGap.Importer | Introduce root rotation policy validation (dual approval) and signer trust store management. Dependencies: AIRGAP-IMP-56-001. | — | AGIM0101 |
| AIRGAP-IMP-57-001 | DONE (2025-11-20) | 2025-11-20 | SPRINT_510_airgap | AirGap Importer Guild | src/AirGap/StellaOps.AirGap.Importer | Write `bundle_catalog` and `bundle_items` repositories with RLS + deterministic migrations. Dependencies: AIRGAP-IMP-56-002. | — | AGIM0101 |
| AIRGAP-IMP-57-002 | BLOCKED (2025-11-25 + disk full) | 2025-11-25 | SPRINT_510_airgap | AirGap Importer Guild + DevOps Guild | src/AirGap/StellaOps.AirGap.Importer | Implement object-store loader storing artifacts under tenant/global mirror paths with Zstandard decompression and checksum validation. Dependencies: AIRGAP-IMP-57-001. | Blocked on disk space and controller telemetry | AGIM0101 |
| AIRGAP-IMP-58-001 | BLOCKED (2025-11-25) | 2025-11-25 | SPRINT_510_airgap | AirGap Importer Guild + CLI Guild | src/AirGap/StellaOps.AirGap.Importer | Implement API (`POST /airgap/import`, `/airgap/verify`) and CLI commands wiring verification + catalog updates, including diff preview. Dependencies: AIRGAP-IMP-57-002. | Blocked on 57-002 | AGIM0101 |
| AIRGAP-IMP-58-002 | BLOCKED (2025-11-25) | 2025-11-25 | SPRINT_510_airgap | AirGap Importer Guild + Observability Guild | src/AirGap/StellaOps.AirGap.Importer | Emit timeline events (`airgap.import.started`. Dependencies: AIRGAP-IMP-58-001. | Blocked on 58-001 | AGIM0101 |
| AIRGAP-IMP-57-002 | DONE (2025-12-10) | 2025-12-10 | SPRINT_510_airgap | AirGap Importer Guild + DevOps Guild | src/AirGap/StellaOps.AirGap.Importer | Loader implemented; sealed-mode/time-anchor schemas enforced; Zstandard+checksum to tenant/global mirrors. | | AGIM0101 |
| AIRGAP-IMP-58-001 | DONE (2025-12-10) | 2025-12-10 | SPRINT_510_airgap | AirGap Importer Guild + CLI Guild | src/AirGap/StellaOps.AirGap.Importer | API/CLI `/airgap/import`+`/airgap/verify`, diff preview, catalog updates wired to sealed-mode/time-anchor. | | AGIM0101 |
| AIRGAP-IMP-58-002 | DONE (2025-12-10) | 2025-12-10 | SPRINT_510_airgap | AirGap Importer Guild + Observability Guild | src/AirGap/StellaOps.AirGap.Importer | Timeline events with staleness metrics emitted per schema. | | AGIM0101 |
| AIRGAP-TIME-57-001 | DONE (2025-11-20) | 2025-11-20 | SPRINT_0503_0001_0001_ops_devops_i | Exporter Guild + AirGap Time Guild + CLI Guild | src/AirGap/StellaOps.AirGap.Time | PROGRAM-STAFF-1001; AIRGAP-TIME-CONTRACT-1501 | PROGRAM-STAFF-1001; AIRGAP-TIME-CONTRACT-1501 | ATMI0102 |
| AIRGAP-TIME-57-002 | BLOCKED (2025-11-25) | 2025-11-25 | SPRINT_510_airgap | AirGap Time Guild + Observability Guild | src/AirGap/StellaOps.AirGap.Time | Add telemetry counters for time anchors (`airgap_time_anchor_age_seconds`) and alerts for approaching thresholds. Dependencies: AIRGAP-TIME-57-001. | Blocked pending controller telemetry and disk space | AGTM0101 |
| AIRGAP-TIME-58-001 | BLOCKED (2025-11-25) | 2025-11-25 | SPRINT_510_airgap | AirGap Time Guild | src/AirGap/StellaOps.AirGap.Time | Persist drift baseline, compute per-content staleness (advisories, VEX, policy) based on bundle metadata, and surface through controller status API. Dependencies: AIRGAP-TIME-57-002. | Blocked on 57-002 | AGTM0101 |
| AIRGAP-TIME-58-002 | BLOCKED (2025-11-25) | 2025-11-25 | SPRINT_510_airgap | AirGap Time Guild, Notifications Guild (src/AirGap/StellaOps.AirGap.Time) | src/AirGap/StellaOps.AirGap.Time | Emit notifications and timeline events when staleness budgets breached or approaching. Dependencies: AIRGAP-TIME-58-001. | Blocked on 58-001 | AGTM0101 |
| AIRGAP-TIME-58-001 | DONE (2025-12-10) | 2025-12-10 | SPRINT_510_airgap | AirGap Time Guild | src/AirGap/StellaOps.AirGap.Time | Drift baseline persisted; per-content staleness surfaced via controller status. | | AGTM0101 |
| AIRGAP-TIME-58-002 | DONE (2025-12-10) | 2025-12-10 | SPRINT_510_airgap | AirGap Time Guild, Notifications Guild (src/AirGap/StellaOps.AirGap.Time) | src/AirGap/StellaOps.AirGap.Time | Notifications/timeline alerts on staleness breach/warn wired to controller/notifier. | | AGTM0101 |
| ANALYZERS-DENO-26-001 | DONE | | SPRINT_130_scanner_surface | Deno Analyzer Guild | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Deno | Bootstrap analyzer helpers | Bootstrap analyzer helpers | SCSA0201 |
| ANALYZERS-DENO-26-002 | DONE | | SPRINT_130_scanner_surface | Deno Analyzer Guild | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Deno | Depends on #1 | SCANNER-ANALYZERS-DENO-26-001 | SCSA0201 |
| ANALYZERS-DENO-26-003 | DONE | | SPRINT_130_scanner_surface | Deno Analyzer Guild | src/Scanner/StellaOps.Scanner.Analyzers.Lang.Deno | Depends on #2 | SCANNER-ANALYZERS-DENO-26-002 | SCSA0201 |
@@ -235,10 +235,10 @@
| API-29-010 | TODO | | SPRINT_0129_0001_0001_policy_reasoning | Vuln Explorer API Guild | src/VulnExplorer/StellaOps.VulnExplorer.Api | Depends on #9 | VULN-API-29-009 | VUAP0101 |
| API-29-011 | TODO | | SPRINT_0129_0001_0001_policy_reasoning | Vuln Explorer API Guild + CLI Guild | src/VulnExplorer/StellaOps.VulnExplorer.Api | Requires API-29-010 artifacts | VULN-API-29-010 | VUAP0102 |
| APIGOV-61-001 | DONE | 2025-11-18 | SPRINT_0511_0001_0001_api | API Governance Guild | src/Api/StellaOps.Api.Governance | Configure spectral/linters with Stella rules; add CI job failing on violations. | 61-001 | APIG0101 |
| APIGOV-61-002 | TODO | | SPRINT_0511_0001_0001_api | API Governance Guild | src/Api/StellaOps.Api.Governance | Implement example coverage checker ensuring every operation has at least one request/response example. Dependencies: APIGOV-61-001. | APIGOV-61-001 | APIG0101 |
| APIGOV-62-001 | TODO | | SPRINT_0511_0001_0001_api | API Governance Guild | src/Api/StellaOps.Api.Governance | Build compatibility diff tool producing additive/breaking reports comparing prior release. Dependencies: APIGOV-61-002. | APIGOV-61-002 | APIG0101 |
| APIGOV-62-002 | TODO | | SPRINT_0511_0001_0001_api | API Governance Guild + DevOps Guild | src/Api/StellaOps.Api.Governance | Automate changelog generation and publish signed artifacts to `src/Sdk/StellaOps.Sdk.Release` pipeline. Dependencies: APIGOV-62-001. | APIGOV-62-001 | APIG0101 |
| APIGOV-63-001 | TODO | | SPRINT_0511_0001_0001_api | API Governance Guild + Notifications Guild | src/Api/StellaOps.Api.Governance | Integrate deprecation metadata into Notification Studio templates for API sunset events. Dependencies: APIGOV-62-002. | APIGOV-62-002 | APIG0101 |
| APIGOV-61-002 | DONE (2025-11-18) | 2025-11-18 | SPRINT_0511_0001_0001_api | API Governance Guild | src/Api/StellaOps.Api.Governance | Implement example coverage checker ensuring every operation has at least one request/response example. Dependencies: APIGOV-61-001. | APIGOV-61-001 | APIG0101 |
| APIGOV-62-001 | DONE (2025-11-18) | 2025-11-18 | SPRINT_0511_0001_0001_api | API Governance Guild | src/Api/StellaOps.Api.Governance | Build compatibility diff tool producing additive/breaking reports comparing prior release. Dependencies: APIGOV-61-002. | APIGOV-61-002 | APIG0101 |
| APIGOV-62-002 | DONE (2025-11-24) | 2025-11-24 | SPRINT_0511_0001_0001_api | API Governance Guild + DevOps Guild | src/Api/StellaOps.Api.Governance | Automate changelog generation and publish signed artifacts to `src/Sdk/StellaOps.Sdk.Release` pipeline. Dependencies: APIGOV-62-001. | APIGOV-62-001 | APIG0101 |
| APIGOV-63-001 | DONE (2025-12-10) | 2025-12-10 | SPRINT_0511_0001_0001_api | API Governance Guild + Notifications Guild | src/Api/StellaOps.Api.Governance | Integrate deprecation metadata into Notification Studio templates for API sunset events. Dependencies: APIGOV-62-002. | APIGOV-62-002 | APIG0101 |
| ATTEST-01-003 | DONE (2025-11-23) | 2025-11-23 | SPRINT_110_ingestion_evidence | Excititor Guild + Evidence Locker Guild | src/Attestor/StellaOps.Attestor | Excititor attestation payloads shipped on frozen bundle v1. | EXCITITOR-AIAI-31-002; ELOCKER-CONTRACT-2001 | ATEL0102 |
| ATTEST-73-001 | DONE (2025-11-25) | 2025-11-25 | SPRINT_110_ingestion_evidence | Concelier Core + Evidence Locker Guild | src/Attestor/StellaOps.Attestor | Attestation claims builder verified; TRX archived. | CONCELIER-AIAI-31-002; ELOCKER-CONTRACT-2001 | ATEL0102 |
| ATTEST-73-002 | DONE (2025-11-25) | 2025-11-25 | SPRINT_110_ingestion_evidence | Concelier Core + Evidence Locker Guild | src/Attestor/StellaOps.Attestor | Internal verify endpoint validated; TRX archived. | CONCELIER-AIAI-31-002; ELOCKER-CONTRACT-2001 | ATEL0102 |
@@ -1233,7 +1233,7 @@
| OAS-61-003 | TODO | | SPRINT_0305_0001_0005_docs_tasks_md_v | Docs Guild + API Governance Guild | docs/api/oas | Publish `/docs/api/versioning.md` describing SemVer, deprecation headers, migration playbooks. | OAS-61 | DOOA0103 |
| OAS-62 | TODO | | SPRINT_160_export_evidence | Exporter + API Gov + SDK Guilds | docs/api/oas | Document SDK/gen pipeline + offline bundle expectations. | OAS-61 | DOOA0103 |
| OAS-62-001 | TODO | | SPRINT_114_concelier_iii | Concelier Core Guild + SDK Generator Guild | src/Concelier/__Libraries/StellaOps.Concelier.Core | Generate `/docs/api/reference/` data + integrate with SDK scaffolding. | OAS-61-002 | COAS0101 |
| OAS-62-002 | TODO | | SPRINT_0511_0001_0001_api | API Contracts Guild | src/Api/StellaOps.Api.OpenApi | Add lint rules enforcing pagination, idempotency headers, naming conventions, and example coverage. | OAS-62-001 | AOAS0101 |
| OAS-62-002 | DONE (2025-11-26) | 2025-11-26 | SPRINT_0511_0001_0001_api | API Contracts Guild | src/Api/StellaOps.Api.OpenApi | Add lint rules enforcing pagination, idempotency headers, naming conventions, and example coverage. | OAS-62-001 | AOAS0101 |
| OAS-63 | TODO | | SPRINT_160_export_evidence | Exporter + API Gov + SDK Guilds | docs/api/oas | Define discovery endpoint strategy + lifecycle docs. | OAS-62 | DOOA0103 |
| OAS-63-001 | TODO | | SPRINT_114_concelier_iii | Concelier Core Guild + API Governance Guild | src/Concelier/__Libraries/StellaOps.Concelier.Core | Add `.well-known/openapi` metadata/discovery hints. | OAS-62-001 | COAS0101 |
| OBS-50-001 | DOING | | SPRINT_0170_0001_0001_notifications_telemetry | Telemetry Core Guild | src/Telemetry/StellaOps.Telemetry.Core | Implement structured logging, trace propagation, and scrub policies for core services. | TLTY0101 | TLTY0102 |
@@ -1463,8 +1463,8 @@
| PROV-OBS-53-001 | DONE | 2025-11-17 | SPRINT_0513_0001_0001_provenance | Provenance Guild / `src/Provenance/StellaOps.Provenance.Attestation` | src/Provenance/StellaOps.Provenance.Attestation | Implement DSSE/SLSA `BuildDefinition` + `BuildMetadata` models with canonical JSON serializer, Merkle digest helpers, deterministic hashing tests, and sample statements for orchestrator/job/export subjects. | — | PROB0101 |
| PROV-OBS-53-002 | BLOCKED | | SPRINT_0513_0001_0001_provenance | Provenance Guild + Security Guild | src/Provenance/StellaOps.Provenance.Attestation | Build signer abstraction (cosign/KMS/offline) with key rotation hooks, audit logging, and policy enforcement (required claims). Provide unit tests using fake signer + real cosign fixture. Dependencies: PROV-OBS-53-001. | Await CI rerun to clear MSB6006 and verify signer abstraction | PROB0101 |
| PROV-OBS-53-003 | BLOCKED | | SPRINT_0513_0001_0001_provenance | Provenance Guild | src/Provenance/StellaOps.Provenance.Attestation | Deliver `PromotionAttestationBuilder` that materialises the `stella.ops/promotion@v1` predicate (image digest, SBOM/VEX materials, promotion metadata, Rekor proof) and feeds canonicalised payload bytes to Signer via StellaOps.Cryptography. | Blocked on PROV-OBS-53-002 CI verification | PROB0101 |
| PROV-OBS-54-001 | TODO | | SPRINT_0513_0001_0001_provenance | Provenance Guild + Evidence Locker Guild | src/Provenance/StellaOps.Provenance.Attestation | Deliver verification library that validates DSSE signatures, Merkle roots, and timeline chain-of-custody, exposing reusable CLI/service APIs. Include negative-case fixtures and offline timestamp verification. Dependencies: PROV-OBS-53-002. | Starts after PROV-OBS-53-002 clears in CI | PROB0101 |
| PROV-OBS-54-002 | TODO | | SPRINT_0513_0001_0001_provenance | Provenance Guild + DevEx/CLI Guild | src/Provenance/StellaOps.Provenance.Attestation | Generate .NET global tool for local verification + embed command helpers for CLI `stella forensic verify`. Provide deterministic packaging and offline kit instructions. Dependencies: PROV-OBS-54-001. | Starts after PROV-OBS-54-001 verification APIs stable | PROB0101 |
| PROV-OBS-54-001 | DONE (2025-12-10) | 2025-12-10 | SPRINT_0513_0001_0001_provenance | Provenance Guild + Evidence Locker Guild | src/Provenance/StellaOps.Provenance.Attestation | Deliver verification library that validates DSSE signatures, Merkle roots, and timeline chain-of-custody, exposing reusable CLI/service APIs. Include negative-case fixtures and offline timestamp verification. Dependencies: PROV-OBS-53-002. | Starts after PROV-OBS-53-002 clears in CI | PROB0101 |
| PROV-OBS-54-002 | DONE (2025-12-10) | 2025-12-10 | SPRINT_0513_0001_0001_provenance | Provenance Guild + DevEx/CLI Guild | src/Provenance/StellaOps.Provenance.Attestation | Generate .NET global tool for local verification + embed command helpers for CLI `stella forensic verify`. Provide deterministic packaging and offline kit instructions. Dependencies: PROV-OBS-54-001. | Starts after PROV-OBS-54-001 verification APIs stable | PROB0101 |
| PY-32-001 | DONE | | SPRINT_0153_0001_0003_orchestrator_iii | Worker SDK Guild (src/Orchestrator/StellaOps.Orchestrator.WorkerSdk.Python) | src/Orchestrator/StellaOps.Orchestrator.WorkerSdk.Python | | | |
| PY-32-002 | DONE | | SPRINT_0153_0001_0003_orchestrator_iii | Worker SDK Guild (src/Orchestrator/StellaOps.Orchestrator.WorkerSdk.Python) | src/Orchestrator/StellaOps.Orchestrator.WorkerSdk.Python | | | |
| PY-33-001 | DONE | | SPRINT_0153_0001_0003_orchestrator_iii | Worker SDK Guild (src/Orchestrator/StellaOps.Orchestrator.WorkerSdk.Python) | src/Orchestrator/StellaOps.Orchestrator.WorkerSdk.Python | | | |
@@ -1955,8 +1955,8 @@
| TEST-62-001 | DOING | | SPRINT_0310_0001_0010_docs_tasks_md_x | Docs Guild, Contract Testing Guild (docs) | | | | |
| TIME-57-001 | TODO | | SPRINT_0503_0001_0001_ops_devops_i | Exporter Guild + AirGap Time Guild + CLI Guild | | | PROGRAM-STAFF-1001 | |
| TIME-57-002 | TODO | | SPRINT_510_airgap | Exporter Guild + AirGap Time Guild + CLI Guild | src/AirGap/StellaOps.AirGap.Time | PROGRAM-STAFF-1001 | PROGRAM-STAFF-1001 | AGTM0101 |
| TIME-58-001 | TODO | | SPRINT_510_airgap | AirGap Time Guild | src/AirGap/StellaOps.AirGap.Time | AIRGAP-TIME-58-001 | AIRGAP-TIME-58-001 | AGTM0101 |
| TIME-58-002 | TODO | | SPRINT_510_airgap | AirGap Time Guild + Notifications Guild | src/AirGap/StellaOps.AirGap.Time | TIME-58-001 | TIME-58-001 | AGTM0101 |
| TIME-58-001 | DONE (2025-12-10) | 2025-12-10 | SPRINT_510_airgap | AirGap Time Guild | src/AirGap/StellaOps.AirGap.Time | AIRGAP-TIME-58-001 | AIRGAP-TIME-58-001 | AGTM0101 |
| TIME-58-002 | DONE (2025-12-10) | 2025-12-10 | SPRINT_510_airgap | AirGap Time Guild + Notifications Guild | src/AirGap/StellaOps.AirGap.Time | TIME-58-001 | TIME-58-001 | AGTM0101 |
| TIMELINE-OBS-52-001 | DONE (2025-12-03) | 2025-12-03 | SPRINT_0165_0001_0001_timelineindexer | Timeline Indexer Guild | src/TimelineIndexer/StellaOps.TimelineIndexer | Bootstrap timeline service migrations and RLS scaffolding. | | |
| TIMELINE-OBS-52-002 | DONE (2025-12-03) | 2025-12-03 | SPRINT_0165_0001_0001_timelineindexer | Timeline Indexer Guild | src/TimelineIndexer/StellaOps.TimelineIndexer | Event ingestion pipeline (NATS/Redis) with ordering/dedupe and metrics. | | |
| TIMELINE-OBS-52-003 | DONE (2025-12-03) | 2025-12-03 | SPRINT_0165_0001_0001_timelineindexer | Timeline Indexer Guild | src/TimelineIndexer/StellaOps.TimelineIndexer | REST/gRPC timeline APIs with filters, pagination, and contracts. | | |