feat: Enhance Authority Identity Provider Registry with Bootstrap Capability

- Added support for bootstrap providers in AuthorityIdentityProviderRegistry.
- Introduced a new property for bootstrap providers and updated AggregateCapabilities.
- Updated relevant methods to handle bootstrap capabilities during provider registration.

feat: Introduce Sealed Mode Status in OpenIddict Handlers

- Added SealedModeStatusProperty to AuthorityOpenIddictConstants.
- Enhanced ValidateClientCredentialsHandler, ValidatePasswordGrantHandler, and ValidateRefreshTokenGrantHandler to validate sealed mode evidence.
- Implemented logic to handle airgap seal confirmation requirements.

feat: Update Program Configuration for Sealed Mode

- Registered IAuthoritySealedModeEvidenceValidator in Program.cs.
- Added logging for bootstrap capabilities in identity provider plugins.
- Implemented checks for bootstrap support in API endpoints.

chore: Update Tasks and Documentation

- Marked AUTH-MTLS-11-002 as DONE in TASKS.md.
- Updated documentation to reflect changes in sealed mode and bootstrap capabilities.

fix: Improve CLI Command Handlers Output

- Enhanced output formatting for command responses and prompts in CommandHandlers.cs.

feat: Extend Advisory AI Models

- Added Response property to AdvisoryPipelineOutputModel for better output handling.

fix: Adjust Concelier Web Service Authentication

- Improved JWT token handling in Concelier Web Service to ensure proper token extraction and logging.

test: Enhance Web Service Endpoints Tests

- Added detailed logging for authentication failures in WebServiceEndpointsTests.
- Enabled PII logging for better debugging of authentication issues.

feat: Introduce Air-Gap Configuration Options

- Added AuthorityAirGapOptions and AuthoritySealedModeOptions to StellaOpsAuthorityOptions.
- Implemented validation logic for air-gap configurations to ensure proper setup.

deploy/helm/stellaops/values-airgap.yaml

@@ -156,6 +156,40 @@ services:
     env:
       EXCITITOR__CONCELIER__BASEURL: "https://stellaops-concelier:8445"
       EXCITITOR__STORAGE__MONGO__CONNECTIONSTRING: "mongodb://stellaops-airgap:stellaops-airgap@stellaops-mongo:27017"
+  advisory-ai-web:
+    image: registry.stella-ops.org/stellaops/advisory-ai-web:2025.09.2-airgap
+    service:
+      port: 8448
+    env:
+      ADVISORYAI__AdvisoryAI__SbomBaseAddress: https://stellaops-scanner-web:8444
+      ADVISORYAI__AdvisoryAI__Queue__DirectoryPath: /var/lib/advisory-ai/queue
+      ADVISORYAI__AdvisoryAI__Storage__PlanCacheDirectory: /var/lib/advisory-ai/plans
+      ADVISORYAI__AdvisoryAI__Storage__OutputDirectory: /var/lib/advisory-ai/outputs
+      ADVISORYAI__AdvisoryAI__Inference__Mode: Local
+      ADVISORYAI__AdvisoryAI__Inference__Remote__BaseAddress: ""
+      ADVISORYAI__AdvisoryAI__Inference__Remote__ApiKey: ""
+    volumeMounts:
+      - name: advisory-ai-data
+        mountPath: /var/lib/advisory-ai
+    volumeClaims:
+      - name: advisory-ai-data
+        claimName: stellaops-advisory-ai-data
+  advisory-ai-worker:
+    image: registry.stella-ops.org/stellaops/advisory-ai-worker:2025.09.2-airgap
+    env:
+      ADVISORYAI__AdvisoryAI__SbomBaseAddress: https://stellaops-scanner-web:8444
+      ADVISORYAI__AdvisoryAI__Queue__DirectoryPath: /var/lib/advisory-ai/queue
+      ADVISORYAI__AdvisoryAI__Storage__PlanCacheDirectory: /var/lib/advisory-ai/plans
+      ADVISORYAI__AdvisoryAI__Storage__OutputDirectory: /var/lib/advisory-ai/outputs
+      ADVISORYAI__AdvisoryAI__Inference__Mode: Local
+      ADVISORYAI__AdvisoryAI__Inference__Remote__BaseAddress: ""
+      ADVISORYAI__AdvisoryAI__Inference__Remote__ApiKey: ""
+    volumeMounts:
+      - name: advisory-ai-data
+        mountPath: /var/lib/advisory-ai
+    volumeClaims:
+      - name: advisory-ai-data
+        claimName: stellaops-advisory-ai-data
   web-ui:
     image: registry.stella-ops.org/stellaops/web-ui@sha256:bee9668011ff414572131dc777faab4da24473fe12c230893f161cabee092a1d
     service:

deploy/helm/stellaops/values-dev.yaml

@@ -160,6 +160,40 @@ services:
     env:
       EXCITITOR__CONCELIER__BASEURL: "https://stellaops-concelier:8445"
       EXCITITOR__STORAGE__MONGO__CONNECTIONSTRING: "mongodb://stellaops:stellaops@stellaops-mongo:27017"
+  advisory-ai-web:
+    image: registry.stella-ops.org/stellaops/advisory-ai-web:2025.10.0-edge
+    service:
+      port: 8448
+    env:
+      ADVISORYAI__AdvisoryAI__SbomBaseAddress: http://stellaops-scanner-web:8444
+      ADVISORYAI__AdvisoryAI__Queue__DirectoryPath: /var/lib/advisory-ai/queue
+      ADVISORYAI__AdvisoryAI__Storage__PlanCacheDirectory: /var/lib/advisory-ai/plans
+      ADVISORYAI__AdvisoryAI__Storage__OutputDirectory: /var/lib/advisory-ai/outputs
+      ADVISORYAI__AdvisoryAI__Inference__Mode: Local
+      ADVISORYAI__AdvisoryAI__Inference__Remote__BaseAddress: ""
+      ADVISORYAI__AdvisoryAI__Inference__Remote__ApiKey: ""
+    volumeMounts:
+      - name: advisory-ai-data
+        mountPath: /var/lib/advisory-ai
+    volumeClaims:
+      - name: advisory-ai-data
+        claimName: stellaops-advisory-ai-data
+  advisory-ai-worker:
+    image: registry.stella-ops.org/stellaops/advisory-ai-worker:2025.10.0-edge
+    env:
+      ADVISORYAI__AdvisoryAI__SbomBaseAddress: http://stellaops-scanner-web:8444
+      ADVISORYAI__AdvisoryAI__Queue__DirectoryPath: /var/lib/advisory-ai/queue
+      ADVISORYAI__AdvisoryAI__Storage__PlanCacheDirectory: /var/lib/advisory-ai/plans
+      ADVISORYAI__AdvisoryAI__Storage__OutputDirectory: /var/lib/advisory-ai/outputs
+      ADVISORYAI__AdvisoryAI__Inference__Mode: Local
+      ADVISORYAI__AdvisoryAI__Inference__Remote__BaseAddress: ""
+      ADVISORYAI__AdvisoryAI__Inference__Remote__ApiKey: ""
+    volumeMounts:
+      - name: advisory-ai-data
+        mountPath: /var/lib/advisory-ai
+    volumeClaims:
+      - name: advisory-ai-data
+        claimName: stellaops-advisory-ai-data
   web-ui:
     image: registry.stella-ops.org/stellaops/web-ui@sha256:38b225fa7767a5b94ebae4dae8696044126aac429415e93de514d5dd95748dcf
     service:

deploy/helm/stellaops/values-prod.yaml

@@ -170,6 +170,46 @@ services:
     envFrom:
       - secretRef:
           name: stellaops-prod-core
+  advisory-ai-web:
+    image: registry.stella-ops.org/stellaops/advisory-ai-web:2025.09.2
+    service:
+      port: 8448
+    env:
+      ADVISORYAI__AdvisoryAI__SbomBaseAddress: https://stellaops-scanner-web:8444
+      ADVISORYAI__AdvisoryAI__Queue__DirectoryPath: /var/lib/advisory-ai/queue
+      ADVISORYAI__AdvisoryAI__Storage__PlanCacheDirectory: /var/lib/advisory-ai/plans
+      ADVISORYAI__AdvisoryAI__Storage__OutputDirectory: /var/lib/advisory-ai/outputs
+      ADVISORYAI__AdvisoryAI__Inference__Mode: Local
+      ADVISORYAI__AdvisoryAI__Inference__Remote__BaseAddress: ""
+      ADVISORYAI__AdvisoryAI__Inference__Remote__ApiKey: ""
+    envFrom:
+      - secretRef:
+          name: stellaops-prod-core
+    volumeMounts:
+      - name: advisory-ai-data
+        mountPath: /var/lib/advisory-ai
+    volumeClaims:
+      - name: advisory-ai-data
+        claimName: stellaops-advisory-ai-data
+  advisory-ai-worker:
+    image: registry.stella-ops.org/stellaops/advisory-ai-worker:2025.09.2
+    env:
+      ADVISORYAI__AdvisoryAI__SbomBaseAddress: https://stellaops-scanner-web:8444
+      ADVISORYAI__AdvisoryAI__Queue__DirectoryPath: /var/lib/advisory-ai/queue
+      ADVISORYAI__AdvisoryAI__Storage__PlanCacheDirectory: /var/lib/advisory-ai/plans
+      ADVISORYAI__AdvisoryAI__Storage__OutputDirectory: /var/lib/advisory-ai/outputs
+      ADVISORYAI__AdvisoryAI__Inference__Mode: Local
+      ADVISORYAI__AdvisoryAI__Inference__Remote__BaseAddress: ""
+      ADVISORYAI__AdvisoryAI__Inference__Remote__ApiKey: ""
+    envFrom:
+      - secretRef:
+          name: stellaops-prod-core
+    volumeMounts:
+      - name: advisory-ai-data
+        mountPath: /var/lib/advisory-ai
+    volumeClaims:
+      - name: advisory-ai-data
+        claimName: stellaops-advisory-ai-data
   web-ui:
     image: registry.stella-ops.org/stellaops/web-ui@sha256:10d924808c48e4353e3a241da62eb7aefe727a1d6dc830eb23a8e181013b3a23
     service:

deploy/helm/stellaops/values.yaml

@@ -111,3 +111,37 @@ services:
       SCHEDULER__STORAGE__CONNECTIONSTRING: mongodb://scheduler-mongo:27017
       SCHEDULER__STORAGE__DATABASE: stellaops_scheduler
       SCHEDULER__WORKER__RUNNER__SCANNER__BASEADDRESS: http://scanner-web:8444
+  advisory-ai-web:
+    image: registry.stella-ops.org/stellaops/advisory-ai-web:2025.10.0-edge
+    service:
+      port: 8448
+    env:
+      ADVISORYAI__AdvisoryAI__SbomBaseAddress: http://scanner-web:8444
+      ADVISORYAI__AdvisoryAI__Queue__DirectoryPath: /var/lib/advisory-ai/queue
+      ADVISORYAI__AdvisoryAI__Storage__PlanCacheDirectory: /var/lib/advisory-ai/plans
+      ADVISORYAI__AdvisoryAI__Storage__OutputDirectory: /var/lib/advisory-ai/outputs
+      ADVISORYAI__AdvisoryAI__Inference__Mode: Local
+      ADVISORYAI__AdvisoryAI__Inference__Remote__BaseAddress: ""
+      ADVISORYAI__AdvisoryAI__Inference__Remote__ApiKey: ""
+    volumeMounts:
+      - name: advisory-ai-data
+        mountPath: /var/lib/advisory-ai
+    volumeClaims:
+      - name: advisory-ai-data
+        claimName: stellaops-advisory-ai-data
+  advisory-ai-worker:
+    image: registry.stella-ops.org/stellaops/advisory-ai-worker:2025.10.0-edge
+    env:
+      ADVISORYAI__AdvisoryAI__SbomBaseAddress: http://scanner-web:8444
+      ADVISORYAI__AdvisoryAI__Queue__DirectoryPath: /var/lib/advisory-ai/queue
+      ADVISORYAI__AdvisoryAI__Storage__PlanCacheDirectory: /var/lib/advisory-ai/plans
+      ADVISORYAI__AdvisoryAI__Storage__OutputDirectory: /var/lib/advisory-ai/outputs
+      ADVISORYAI__AdvisoryAI__Inference__Mode: Local
+      ADVISORYAI__AdvisoryAI__Inference__Remote__BaseAddress: ""
+      ADVISORYAI__AdvisoryAI__Inference__Remote__ApiKey: ""
+    volumeMounts:
+      - name: advisory-ai-data
+        mountPath: /var/lib/advisory-ai
+    volumeClaims:
+      - name: advisory-ai-data
+        claimName: stellaops-advisory-ai-data