feat: Add Promotion-Time Attestations for Stella Ops

- Introduced a new document for promotion-time attestations, detailing the purpose, predicate schema, producer workflow, verification flow, APIs, and security considerations.
- Implemented the `stella.ops/promotion@v1` predicate schema to capture promotion evidence including image digest, SBOM/VEX artifacts, and Rekor proof.
- Defined producer responsibilities and workflows for CLI orchestration, signer responsibilities, and Export Center integration.
- Added verification steps for auditors to validate promotion attestations offline.

feat: Create Symbol Manifest v1 Specification

- Developed a specification for Symbol Manifest v1 to provide a deterministic format for publishing debug symbols and source maps.
- Defined the manifest structure, including schema, entries, source maps, toolchain, and provenance.
- Outlined upload and verification processes, resolve APIs, runtime proxy, caching, and offline bundle generation.
- Included security considerations and related tasks for implementation.

chore: Add Ruby Analyzer with Git Sources

- Created a Gemfile and Gemfile.lock for Ruby analyzer with dependencies on git-gem, httparty, and path-gem.
- Implemented main application logic to utilize the defined gems and output their versions.
- Added expected JSON output for the Ruby analyzer to validate the integration of the new gems and their functionalities.
- Developed internal observation classes for Ruby packages, runtime edges, and capabilities, including serialization logic for observations.

test: Add tests for Ruby Analyzer

- Created test fixtures for Ruby analyzer, including Gemfile, Gemfile.lock, main application, and expected JSON output.
- Ensured that the tests validate the correct integration and functionality of the Ruby analyzer with the specified gems.

docs/policy/dsl.md

@@ -167,7 +167,8 @@ Missing fields evaluate to `null`, which is falsey in boolean context and propag
 | `vex.latest()` | `→ Statement` | Lexicographically newest statement. |
 | `advisory.has_tag(tag)` | `string → bool` | Checks advisory metadata tags. |
 | `advisory.matches(pattern)` | `string → bool` | Glob match against advisory identifiers. |
-| `sbom.has_tag(tag)` | `string → bool` | Uses SBOM inventory tags (usage vs inventory). |
+| `sbom.has_tag(tag)` | `string → bool` | Uses SBOM inventory tags (usage vs inventory). |
+| `sbom.any_component(predicate)` | `(Component → bool) → bool` | Iterates SBOM components, exposing `component` plus language scopes (e.g., `ruby`). |
 | `exists(expression)` | `→ bool` | `true` when value is non-null/empty. |
 | `coalesce(a, b, ...)` | `→ value` | First non-null argument. |
 | `days_between(dateA, dateB)` | `→ int` | Absolute day difference (UTC). |
@@ -180,12 +181,29 @@ Missing fields evaluate to `null`, which is falsey in boolean context and propag
 | `secret.path.allowlist(patterns)` | `list<string> → bool` | True when all findings fall within allowed path patterns (useful for waivers). |
 
 All built-ins are pure; if inputs are null the result is null unless otherwise noted.
-
----
-
-## 7 · Rule Semantics
-
-1. **Ordering:** Rules execute in ascending `priority`. When priorities tie, lexical order defines precedence.
+
+---
+
+### 6.1 · Ruby Component Scope
+
+Inside `sbom.any_component(...)`, Ruby gems surface a `ruby` scope with the following helpers:
+
+| Helper | Signature | Description |
+|--------|-----------|-------------|
+| `ruby.group(name)` | `string → bool` | Matches Bundler group membership (`development`, `test`, etc.). |
+| `ruby.groups()` | `→ set<string>` | Returns all groups for the active component. |
+| `ruby.declared_only()` | `→ bool` | `true` when no vendor cache artefacts were observed for the gem. |
+| `ruby.source(kind?)` | `string? → bool` | Returns the raw source when called without args, or matches provenance kinds (`registry`, `git`, `path`, `vendor-cache`). |
+| `ruby.capability(name)` | `string → bool` | Checks capability flags emitted by the analyzer (`exec`, `net`, `scheduler`, `scheduler.activejob`, etc.). |
+| `ruby.capability_any(names)` | `set<string> → bool` | `true` when any capability in the set is present. |
+
+Scheduler capability sub-types use dot notation (`ruby.capability("scheduler.sidekiq")`) and inherit from the broad `scheduler` capability.
+
+---
+
+## 7 · Rule Semantics
+
+1. **Ordering:** Rules execute in ascending `priority`. When priorities tie, lexical order defines precedence.
 2. **Short-circuit:** Once a rule sets `status`, subsequent rules only execute if they use `combine`. Use this sparingly to avoid ambiguity.
 3. **Actions:**
    - `status := <string>` – Allowed values: `affected`, `not_affected`, `fixed`, `suppressed`, `under_investigation`, `escalated`.