up

etc/rootpack/cn/crypto.profile.yaml

@@ -3,13 +3,21 @@ StellaOps:
     Registry:
       ActiveProfile: cn-soft
       PreferredProviders:
+        - cn.sm.remote.http
         - cn.sm.soft
       Profiles:
         cn-soft:
           PreferredProviders:
+            - cn.sm.remote.http
             - cn.sm.soft
     SmSoft:
       RequireEnvironmentGate: true
       # Optional seed keys (PKCS#8 DER/PEM)
       Keys: []
+    SmRemote:
+      BaseAddress: http://sm-remote:56080
+      SkipProbe: false
+      Keys:
+        - KeyId: sm2-remote-default
+          RemoteKeyId: sm2-remote-default
     # Note: This SM profile is software-only (non-certified). Set SM_SOFT_ALLOWED=1 to enable.

etc/rootpack/ru/crypto.profile.yaml

@@ -19,6 +19,7 @@ StellaOps:
             - ru.openssl.gost
             - ru.pkcs11
     CryptoPro:
+      Status: pending
       Keys:
         - KeyId: ru-csp-default
           Algorithm: GOST12-256

etc/signals.yaml.sample

@@ -49,10 +49,23 @@ Signals:
   Cache:
     ConnectionString: "localhost:6379"
     DefaultTtlSeconds: 600
+  Events:
+    Enabled: true
+    # Transport driver: "redis" (default) or "inmemory" for local smoke.
+    Driver: "redis"
+    ConnectionString: "localhost:6379"
+    Stream: "signals.fact.updated.v1"
+    DeadLetterStream: "signals.fact.updated.dlq"
+    PublishTimeoutSeconds: 5
+    MaxStreamLength: 10000
+    DefaultTenant: "tenant-default"
+    Producer: "StellaOps.Signals"
+    Pipeline: "signals"
+    Release: ""
   AirGap:
     # Optional override for fact-update event topic when signaling across air-gap boundaries.
-    # Defaults to "signals.fact.updated" when omitted.
-    EventTopic: "signals.fact.updated"
+    # Defaults to "signals.fact.updated.v1" when omitted.
+    EventTopic: "signals.fact.updated.v1"
     SealedMode:
       EnforcementEnabled: false
       EvidencePath: "../ops/devops/sealed-mode-ci/artifacts/sealed-mode-ci/latest/signals-sealed-ci.json"