preparation for ui re-shelling
This commit is contained in:
master
@@ -0,0 +1,153 @@
|
||||
# Sprint 20260218_005 - UI V2 Rewire Spec Freeze
|
||||
|
||||
## Topic & Scope
|
||||
- Freeze all unresolved IA decisions before implementation sprints begin so downstream work cannot diverge.
|
||||
- Produce complete, self-contained specs for Advisory Sources, Release Control capability rendering, trust ownership transition, and route deprecation.
|
||||
- Bootstrap a root-domain endpoint contract ledger that classifies all screens as `EXISTS_COMPAT`, `EXISTS_ADAPT`, or `MISSING_NEW`.
|
||||
- Working directory: `docs/modules/ui/v2-rewire`.
|
||||
- Expected evidence: finalized specification docs, route mapping matrix, contract ledger v1, and signed handoff packet.
|
||||
|
||||
## Dependencies & Concurrency
|
||||
- Upstream dependencies: none.
|
||||
- Downstream dependencies: this sprint must be DONE before sprints `20260218_006`, `20260218_007`, and `20260218_008` can move to DOING.
|
||||
- Safe parallelism:
|
||||
- `R0-01` and `R0-02` can run in parallel.
|
||||
- `R0-03` can run in parallel with `R0-01` and `R0-02`.
|
||||
- `R0-04` depends on `R0-01`, `R0-02`, and `R0-03`.
|
||||
- `R0-05` depends on `R0-03` and `R0-04`.
|
||||
- `R0-06` depends on `R0-01` through `R0-05`.
|
||||
|
||||
## Documentation Prerequisites
|
||||
- `docs/modules/ui/v2-rewire/source-of-truth.md`
|
||||
- `docs/modules/ui/v2-rewire/authority-matrix.md`
|
||||
- `docs/modules/ui/v2-rewire/sprint-planning-guide.md`
|
||||
- `docs/modules/ui/v2-rewire/multi-sprint-plan.md`
|
||||
- `docs/modules/ui/v2-rewire/pack-19.md`
|
||||
- `docs/modules/ui/v2-rewire/pack-20.md`
|
||||
- `docs/modules/ui/v2-rewire/pack-21.md`
|
||||
- `src/Web/StellaOps.Web/src/app/app.routes.ts`
|
||||
- `src/Web/StellaOps.Web/src/app/layout/app-sidebar/app-sidebar.component.ts`
|
||||
- `src/Web/StellaOps.Web/src/app/routes/legacy-redirects.routes.ts`
|
||||
|
||||
## Delivery Tracker
|
||||
|
||||
### R0-01 - Freeze canonical IA taxonomy and ownership model
|
||||
Status: TODO
|
||||
Dependency: none
|
||||
Owners: Product Manager, Documentation author
|
||||
Task description:
|
||||
- Finalize the top-level IA taxonomy as the only allowed root-domain structure for implementation work. The taxonomy must explicitly define the seven roots: Dashboard, Release Control, Security and Risk, Evidence and Audit, Integrations, Platform Ops, and Administration.
|
||||
- Freeze ownership boundaries that resolve known conflicts from earlier packs. The self-contained spec must explicitly define: Policy Governance owner, Trust and Signing owner, System owner, and the split of legacy Security Data between Integrations, Platform Ops, and Security and Risk.
|
||||
- Define forbidden alternatives so downstream sprints cannot re-open superseded placements.
|
||||
|
||||
Completion criteria:
|
||||
- [ ] Canonical root-domain taxonomy is documented with final naming and order.
|
||||
- [ ] Ownership boundaries for Policy, Trust, System, and Security Data split are explicit and conflict-free.
|
||||
- [ ] Superseded alternatives are listed as non-allowed implementations.
|
||||
- [ ] Decision record includes rationale and impacted downstream sprints.
|
||||
|
||||
### R0-02 - Produce full Advisory Sources screen specification
|
||||
Status: TODO
|
||||
Dependency: none
|
||||
Owners: Product Manager, Security lead, Documentation author
|
||||
Task description:
|
||||
- Create a complete screen spec for `Security and Risk -> Advisory Sources` with no reliance on pack text at implementation time. The spec must include exact screen sections, filters, columns, actions, detail drawer/page behavior, empty states, stale data states, and hard-fail states.
|
||||
- The spec must define field-level ownership and the link contract between Advisory Sources and the two adjacent surfaces: `Integrations` (connectivity and source config) and `Platform Ops` (mirror and freshness operations).
|
||||
- Include explicit behavior for conflicting advisory signals, unsigned advisories, and stale source freshness relative to policy gate decisions.
|
||||
|
||||
Completion criteria:
|
||||
- [ ] Screen layout and interaction model are fully specified.
|
||||
- [ ] Field-level ownership matrix is present for Security and Risk vs Integrations vs Platform Ops.
|
||||
- [ ] Data-state behavior is defined for healthy, stale, unavailable, and conflict conditions.
|
||||
- [ ] API dependency list for this screen is present with initial status class per dependency.
|
||||
|
||||
### R0-03 - Freeze Release Control capability rendering policy
|
||||
Status: TODO
|
||||
Dependency: none
|
||||
Owners: Project Manager, UX lead, Frontend lead
|
||||
Task description:
|
||||
- Freeze one nav rendering policy for Release Control-owned capabilities. The policy must explicitly answer whether Releases and Approvals appear as direct shortcuts, nested-only entries, or hybrid shortcuts with strict ownership labeling.
|
||||
- The policy must include desktop and mobile nav behavior, breadcrumbs, route naming, and legacy-label transition text. It must explicitly prevent mixed implementations across teams.
|
||||
- Include route alias requirements needed to support staged migration from current navigation.
|
||||
|
||||
Completion criteria:
|
||||
- [ ] One rendering policy is selected and documented for desktop and mobile.
|
||||
- [ ] Breadcrumb and route naming rules are specified with concrete examples.
|
||||
- [ ] Legacy label behavior is specified for migration period.
|
||||
- [ ] Explicit do and do-not list prevents mixed rendering variants.
|
||||
|
||||
### R0-04 - Freeze Trust and Signing ownership transition policy
|
||||
Status: TODO
|
||||
Dependency: R0-01
|
||||
Owners: Product Manager, Security architect, Documentation author
|
||||
Task description:
|
||||
- Finalize transition where `Administration` is owner of Trust and Signing and `Evidence and Audit` plus `Security and Risk` consume trust state via deep links and context panels.
|
||||
- Define canonical link paths, allowed embedding patterns, and non-allowed ownership regressions.
|
||||
- Define temporary aliasing behavior for legacy trust routes and timeline for removal.
|
||||
|
||||
Completion criteria:
|
||||
- [ ] Ownership and consumption model is explicit and final.
|
||||
- [ ] Cross-link contract is defined for all consuming screens.
|
||||
- [ ] Alias and deprecation behavior is defined by route family.
|
||||
- [ ] Auth scope and role implications are documented.
|
||||
|
||||
### R0-05 - Produce route deprecation and migration baseline
|
||||
Status: TODO
|
||||
Dependency: R0-03
|
||||
Owners: Project Manager, Frontend lead
|
||||
Task description:
|
||||
- Create a complete route baseline mapping current paths to target IA paths. Include routes from root navigation, settings-derived paths, and legacy redirects.
|
||||
- Each route must be assigned one explicit action: keep, redirect, alias, or remove-later. Include rationale and migration risk per high-traffic route.
|
||||
- Include sequence guidance for when redirects can be activated relative to implementation sprints.
|
||||
|
||||
Completion criteria:
|
||||
- [ ] Baseline map covers all root domains and major child route families.
|
||||
- [ ] Every mapped route has exactly one migration action.
|
||||
- [ ] High-risk deep-link routes have mitigation notes.
|
||||
- [ ] Activation sequence aligns with downstream sprint dependency plan.
|
||||
|
||||
### R0-06 - Bootstrap endpoint contract ledger v1
|
||||
Status: TODO
|
||||
Dependency: R0-02
|
||||
Owners: Project Manager, API architect, Module leads
|
||||
Task description:
|
||||
- Produce v1 endpoint contract ledger for all active-authority screens defined in `docs/modules/ui/v2-rewire/authority-matrix.md`. The ledger must be self-contained and include candidate endpoints, status class, owner module, auth scope impact, schema delta, and ticket linkage.
|
||||
- No screen may remain unclassified. `MISSING_NEW` entries must include proposed endpoint contracts and owning module.
|
||||
- Ledger must identify cross-module dependencies that require explicit allowance in implementation sprint files.
|
||||
|
||||
Completion criteria:
|
||||
- [ ] All active-authority screens are present in ledger v1.
|
||||
- [ ] All rows have non-empty status class and owner module.
|
||||
- [ ] All `MISSING_NEW` rows include concrete proposed endpoint contracts.
|
||||
- [ ] Ledger review sign-off captured from frontend and backend leads.
|
||||
|
||||
### R0-07 - Publish S00 handoff packet
|
||||
Status: TODO
|
||||
Dependency: R0-06
|
||||
Owners: Project Manager
|
||||
Task description:
|
||||
- Publish a handoff packet for sprints `20260218_006` through `20260218_008` containing frozen decisions, unresolved risks, route migration baseline, and contract ledger references.
|
||||
- The handoff packet must explicitly list blocked topics (if any) and mitigation actions with owners.
|
||||
|
||||
Completion criteria:
|
||||
- [ ] Handoff packet is published and linked from the sprint file.
|
||||
- [ ] Downstream sprint owners and dependencies are explicit.
|
||||
- [ ] Remaining risks have owners and checkpoint dates.
|
||||
- [ ] All non-shipped exploratory work is reset to TODO with notes.
|
||||
|
||||
## Execution Log
|
||||
| Date (UTC) | Update | Owner |
|
||||
| --- | --- | --- |
|
||||
| 2026-02-18 | Sprint created for v2 rewire spec freeze and contract-ledger bootstrap. | Planning |
|
||||
|
||||
## Decisions & Risks
|
||||
- Decision pending: final rendering policy for Release Control-owned capabilities (`Releases`, `Approvals`, `Deployments`, `Regions and Environments`, `Bundles`) must be frozen before nav implementation.
|
||||
- Risk: unresolved Advisory Sources boundary can duplicate logic across Security and Risk, Integrations, and Platform Ops; mitigation is field-level ownership matrix in `R0-02`.
|
||||
- Risk: trust ownership transition can break historical deep links and user expectations; mitigation is explicit alias/deprecation policy in `R0-04` and `R0-05`.
|
||||
- Risk: hidden backend gaps may stall frontend sprints; mitigation is complete classification in `R0-06` with `MISSING_NEW` proposals.
|
||||
- Existing code references for migration analysis: `src/Web/StellaOps.Web/src/app/app.routes.ts`, `src/Web/StellaOps.Web/src/app/features/settings/settings.routes.ts`, `src/Web/StellaOps.Web/src/app/routes/legacy-redirects.routes.ts`.
|
||||
|
||||
## Next Checkpoints
|
||||
- 2026-02-19: Review drafts for `R0-01`, `R0-02`, and `R0-03`.
|
||||
- 2026-02-20: Review and sign off `R0-04` and `R0-05`.
|
||||
- 2026-02-21: Review `R0-06` ledger and publish `R0-07` handoff packet.
|
||||
@@ -0,0 +1,120 @@
|
||||
# Sprint 20260218_006 - UI V2 Rewire Navigation Shell and Route Migration
|
||||
|
||||
## Topic & Scope
|
||||
- Implement the canonical navigation shell and route framework for the new IA, using frozen outputs from sprint `20260218_005`.
|
||||
- Deliver a single rendering model for root domains and Release Control-owned capabilities with deterministic route behavior.
|
||||
- Include migration-safe aliases, breadcrumbs, and transition labels that preserve usability during staged cutover.
|
||||
- Working directory: `src/Web/StellaOps.Web`.
|
||||
- Expected evidence: route tree changes, nav model updates, redirect behavior tests, breadcrumb/label verification artifacts.
|
||||
|
||||
## Dependencies & Concurrency
|
||||
- Upstream dependencies: `SPRINT_20260218_005_DOCS_ui_v2_rewire_spec_freeze.md` must be DONE.
|
||||
- Downstream dependencies: required before `20260218_007`, `20260218_008`, `20260218_009`, and `20260218_010` can finalize routes.
|
||||
- Safe parallelism:
|
||||
- `N1-01` and `N1-02` can run in parallel after dependency resolution.
|
||||
- `N1-03` depends on `N1-01`.
|
||||
- `N1-04` depends on `N1-02`.
|
||||
- `N1-05` depends on `N1-01` through `N1-04`.
|
||||
|
||||
## Documentation Prerequisites
|
||||
- `docs/modules/ui/v2-rewire/source-of-truth.md`
|
||||
- `docs/modules/ui/v2-rewire/authority-matrix.md`
|
||||
- `docs/modules/ui/v2-rewire/sprint-planning-guide.md`
|
||||
- `docs/modules/ui/v2-rewire/S00_sprint_spec_package.md`
|
||||
- `src/Web/StellaOps.Web/src/app/app.routes.ts`
|
||||
- `src/Web/StellaOps.Web/src/app/layout/app-sidebar/app-sidebar.component.ts`
|
||||
- `src/Web/StellaOps.Web/src/app/routes/legacy-redirects.routes.ts`
|
||||
- `src/Web/StellaOps.Web/src/app/layout/breadcrumb/breadcrumb.component.ts`
|
||||
|
||||
## Delivery Tracker
|
||||
|
||||
### N1-01 - Implement canonical root-domain navigation model
|
||||
Status: TODO
|
||||
Dependency: none
|
||||
Owners: Frontend developer, UX developer
|
||||
Task description:
|
||||
- Replace current sidebar root model with canonical domains in this order: Dashboard, Release Control, Security and Risk, Evidence and Audit, Integrations, Platform Ops, Administration.
|
||||
- Implement the frozen Release Control capability rendering policy from sprint `20260218_005` with explicit prevention of mixed variants.
|
||||
- Preserve scope-based visibility behavior and ensure hidden groups do not break active-route resolution.
|
||||
|
||||
Completion criteria:
|
||||
- [ ] Root nav displays canonical domains and labels exactly.
|
||||
- [ ] Release Control capability rendering matches frozen policy for desktop and mobile.
|
||||
- [ ] Scope gating behavior remains deterministic and tested.
|
||||
- [ ] No orphaned nav items link to removed or undefined routes.
|
||||
|
||||
### N1-02 - Build canonical route tree scaffolding for IA v2
|
||||
Status: TODO
|
||||
Dependency: none
|
||||
Owners: Frontend developer
|
||||
Task description:
|
||||
- Refactor root route declarations to align with canonical IA while keeping runtime compatibility via staged aliases.
|
||||
- Introduce target route families for each domain and define placeholder-compatible child trees for sprints `007` to `015`.
|
||||
- Ensure route titles and metadata match canonical naming.
|
||||
|
||||
Completion criteria:
|
||||
- [ ] Root route tree includes all canonical domains.
|
||||
- [ ] Target child route families exist for all planned capability areas.
|
||||
- [ ] Route metadata uses canonical names and ownership.
|
||||
- [ ] Existing deep links continue to resolve via aliases or redirects.
|
||||
|
||||
### N1-03 - Implement breadcrumb and transition-label policy
|
||||
Status: TODO
|
||||
Dependency: N1-01
|
||||
Owners: Frontend developer, UX developer
|
||||
Task description:
|
||||
- Apply one breadcrumb convention across canonical domains and child routes.
|
||||
- Add transition labels (formerly called) where migration policy requires them.
|
||||
- Ensure transition labels are contextual, temporary, and do not alter canonical route names.
|
||||
|
||||
Completion criteria:
|
||||
- [ ] Breadcrumb behavior is consistent across root and child routes.
|
||||
- [ ] Transition labels appear only where specified by migration policy.
|
||||
- [ ] Canonical labels remain primary in all navigational surfaces.
|
||||
- [ ] Unit tests cover breadcrumb generation and transition-label conditions.
|
||||
|
||||
### N1-04 - Implement migration alias and redirect framework
|
||||
Status: TODO
|
||||
Dependency: N1-02
|
||||
Owners: Frontend developer
|
||||
Task description:
|
||||
- Update redirect and alias rules to map legacy paths to canonical IA routes according to the baseline deprecation map from sprint `20260218_005`.
|
||||
- Ensure query parameters and fragments remain preserved through redirects.
|
||||
- Add guard-safe behavior for authenticated and unauthenticated redirect paths.
|
||||
|
||||
Completion criteria:
|
||||
- [ ] Legacy settings and historical routes map to canonical targets per approved policy.
|
||||
- [ ] Query and fragment preservation is verified for redirect families.
|
||||
- [ ] No redirect loops are present in route tests.
|
||||
- [ ] Redirect behavior is documented in sprint execution evidence.
|
||||
|
||||
### N1-05 - Navigation shell verification and regression tests
|
||||
Status: TODO
|
||||
Dependency: N1-04
|
||||
Owners: Frontend developer, QA
|
||||
Task description:
|
||||
- Add targeted unit and E2E checks for sidebar groups, root routes, breadcrumbs, and key redirects.
|
||||
- Verify behavior for desktop collapsed sidebar, desktop expanded, and mobile navigation drawer.
|
||||
- Verify scope-filtered user profiles do not produce dead-end navigation.
|
||||
|
||||
Completion criteria:
|
||||
- [ ] Unit tests cover nav model, visibility filtering, and breadcrumb rules.
|
||||
- [ ] E2E checks cover canonical root traversal and critical redirects.
|
||||
- [ ] Mobile and desktop nav behavior passes targeted checks.
|
||||
- [ ] No runtime nav errors in console/network during traversal.
|
||||
|
||||
## Execution Log
|
||||
| Date (UTC) | Update | Owner |
|
||||
| --- | --- | --- |
|
||||
| 2026-02-18 | Sprint created for v2 navigation shell and route migration foundation. | Planning |
|
||||
|
||||
## Decisions & Risks
|
||||
- Decision dependency: Release Control capability rendering policy from sprint `20260218_005` is binding.
|
||||
- Risk: redirect misconfiguration can silently break deep links; mitigate with explicit alias tests and no-loop checks.
|
||||
- Risk: scope-filtered visibility can hide required parent groups; mitigate with permission-profile test matrix.
|
||||
- Existing code references: `src/Web/StellaOps.Web/src/app/layout/app-sidebar/app-sidebar.component.ts`, `src/Web/StellaOps.Web/src/app/app.routes.ts`, `src/Web/StellaOps.Web/src/app/routes/legacy-redirects.routes.ts`.
|
||||
|
||||
## Next Checkpoints
|
||||
- 2026-02-20: Confirm canonical root nav and route tree (`N1-01`, `N1-02`).
|
||||
- 2026-02-21: Validate breadcrumb, transition labels, and redirect framework (`N1-03`, `N1-04`).
|
||||
- 2026-02-22: Complete verification and publish regression evidence (`N1-05`).
|
||||
@@ -0,0 +1,132 @@
|
||||
# Sprint 20260218_007 - UI V2 Rewire Administration Foundation
|
||||
|
||||
## Topic & Scope
|
||||
- Implement the Administration domain as the owner surface for IAM, tenants/branding, notifications, usage/limits, policy governance, trust/signing, and system admin controls.
|
||||
- Deliver fully specified Admin A0 through A7 screens with explicit cross-links to Release Control, Security and Risk, Evidence and Audit, and Platform Ops.
|
||||
- Preserve migration compatibility from legacy settings paths while converging on canonical IA ownership.
|
||||
- Working directory: `src/Web/StellaOps.Web`.
|
||||
- Expected evidence: implemented admin routes/screens, cross-link behavior proofs, access-control validation, and migration checks.
|
||||
|
||||
## Dependencies & Concurrency
|
||||
- Upstream dependencies: `SPRINT_20260218_005_DOCS_ui_v2_rewire_spec_freeze.md`, `SPRINT_20260218_006_FE_ui_v2_rewire_navigation_shell_route_migration.md`.
|
||||
- Downstream dependencies: informs `20260218_014` and `20260218_015` trust and policy consumption surfaces.
|
||||
- Safe parallelism:
|
||||
- `A2-01` and `A2-02` can run in parallel.
|
||||
- `A2-03` depends on `A2-01`.
|
||||
- `A2-04` depends on `A2-01` and `A2-02`.
|
||||
- `A2-05` depends on `A2-04`.
|
||||
- `A2-06` depends on `A2-01` through `A2-05`.
|
||||
|
||||
## Documentation Prerequisites
|
||||
- `docs/modules/ui/v2-rewire/source-of-truth.md`
|
||||
- `docs/modules/ui/v2-rewire/authority-matrix.md`
|
||||
- `docs/modules/ui/v2-rewire/pack-21.md`
|
||||
- `docs/modules/ui/v2-rewire/S00_sprint_spec_package.md`
|
||||
- `src/Web/StellaOps.Web/src/app/features/settings/settings.routes.ts`
|
||||
- `src/Web/StellaOps.Web/src/app/app.routes.ts`
|
||||
- `src/Web/StellaOps.Web/src/app/core/auth/`
|
||||
|
||||
## Delivery Tracker
|
||||
|
||||
### A2-01 - Build Administration shell and A0 overview
|
||||
Status: TODO
|
||||
Dependency: none
|
||||
Owners: Frontend developer, UX developer
|
||||
Task description:
|
||||
- Implement `Administration` root shell and overview (`A0`) with summary cards for Identity and Access, Tenant and Branding, Notifications, Usage and Limits, Policy Governance, Trust and Signing, and System.
|
||||
- Overview must include operational drilldown links for quotas and system health while maintaining Administration ownership.
|
||||
|
||||
Completion criteria:
|
||||
- [ ] Administration shell route and overview screen are implemented.
|
||||
- [ ] A0 contains all canonical cards and link targets.
|
||||
- [ ] Ownership labels are explicit and match canonical IA.
|
||||
- [ ] Legacy settings links route correctly into Administration surfaces.
|
||||
|
||||
### A2-02 - Implement A1 through A4 operational admin pages
|
||||
Status: TODO
|
||||
Dependency: none
|
||||
Owners: Frontend developer
|
||||
Task description:
|
||||
- Implement `A1 Identity and Access`, `A2 Tenant and Branding`, `A3 Notifications`, and `A4 Usage and Limits` with complete page-level structure.
|
||||
- Each page must include explicit action surfaces and linkouts: identity scope diagnostics, tenant branding application state, notification rule/channel/template management, and usage policy controls.
|
||||
|
||||
Completion criteria:
|
||||
- [ ] A1 through A4 routes and page components are implemented.
|
||||
- [ ] Each page includes defined sections, actions, and state handling.
|
||||
- [ ] Cross-links to dependent domains are present where required.
|
||||
- [ ] Access-controlled actions respect existing scopes and permissions.
|
||||
|
||||
### A2-03 - Implement A5 Policy Governance under Administration ownership
|
||||
Status: TODO
|
||||
Dependency: A2-01
|
||||
Owners: Frontend developer, Policy UX owner
|
||||
Task description:
|
||||
- Implement `A5 Policy Governance` as Administration-owned surface with deep links to Release Control gate usage contexts.
|
||||
- Include policy baseline, rule, simulation, and exception-workflow views or links according to frozen ownership policy.
|
||||
- Explicitly prevent regression to Release Control ownership labeling.
|
||||
|
||||
Completion criteria:
|
||||
- [ ] A5 surface is present under Administration and labeled as owner.
|
||||
- [ ] Policy sub-areas are reachable and internally consistent.
|
||||
- [ ] Release Control linkage exists as consumer context, not owner.
|
||||
- [ ] Breadcrumbs and labels reflect final ownership policy.
|
||||
|
||||
### A2-04 - Implement A6 Trust and Signing plus A7 System
|
||||
Status: TODO
|
||||
Dependency: A2-02
|
||||
Owners: Frontend developer, Security UX owner
|
||||
Task description:
|
||||
- Implement `A6 Trust and Signing` and `A7 System` as Administration-owned surfaces.
|
||||
- A6 must expose keys, issuers, certificates, transparency log, trust scoring, and audit references, with explicit consumer links to Evidence and Security pages.
|
||||
- A7 must expose system admin controls and diagnostics with drilldowns into Platform Ops operational pages.
|
||||
|
||||
Completion criteria:
|
||||
- [ ] A6 and A7 routes and UI surfaces are implemented.
|
||||
- [ ] A6 shows all trust primitives and allowed consumer links.
|
||||
- [ ] A7 includes diagnostics/admin controls and ops drilldowns.
|
||||
- [ ] Ownership labels prevent fallback to Evidence/System-root legacy models.
|
||||
|
||||
### A2-05 - Migrate legacy settings routes to Administration targets
|
||||
Status: TODO
|
||||
Dependency: A2-04
|
||||
Owners: Frontend developer
|
||||
Task description:
|
||||
- Update route mappings for legacy settings items that now belong to Administration.
|
||||
- Ensure each legacy path resolves to one canonical Administration destination with preserved query and fragment where applicable.
|
||||
- Keep transitional compatibility labels where migration policy requires them.
|
||||
|
||||
Completion criteria:
|
||||
- [ ] All Administration-owned legacy settings routes have explicit canonical targets.
|
||||
- [ ] Redirect/alias behavior matches deprecation baseline.
|
||||
- [ ] Query and fragment preservation verified.
|
||||
- [ ] No duplicate ownership routes remain active.
|
||||
|
||||
### A2-06 - Administration verification and access-control coverage
|
||||
Status: TODO
|
||||
Dependency: A2-05
|
||||
Owners: Frontend developer, QA
|
||||
Task description:
|
||||
- Add targeted tests for Administration route coverage, ownership labeling, deep links, and permission behavior.
|
||||
- Validate no regressions for authenticated admin and non-admin users.
|
||||
|
||||
Completion criteria:
|
||||
- [ ] Unit/E2E tests cover A0 through A7 primary paths.
|
||||
- [ ] Permission matrix checks validate visibility and action gating.
|
||||
- [ ] Migration routes are validated via automated or scripted checks.
|
||||
- [ ] Execution evidence captures passing behavior and residual risks.
|
||||
|
||||
## Execution Log
|
||||
| Date (UTC) | Update | Owner |
|
||||
| --- | --- | --- |
|
||||
| 2026-02-18 | Sprint created for Administration ownership implementation in IA v2. | Planning |
|
||||
|
||||
## Decisions & Risks
|
||||
- Decision binding: Administration owns Policy Governance, Trust and Signing, and System per sprint `20260218_005` freeze.
|
||||
- Risk: trust ownership migration can create duplicate entry points; mitigate by canonical route enforcement and alias pruning.
|
||||
- Risk: policy governance users may expect Release Control ownership; mitigate with explicit context links and transition labels.
|
||||
- Existing code references: `src/Web/StellaOps.Web/src/app/features/settings/settings.routes.ts`, `src/Web/StellaOps.Web/src/app/core/auth/`, `src/Web/StellaOps.Web/src/app/routes/legacy-redirects.routes.ts`.
|
||||
|
||||
## Next Checkpoints
|
||||
- 2026-02-21: A0-A4 implementation review (`A2-01`, `A2-02`).
|
||||
- 2026-02-22: A5-A7 ownership and linkage review (`A2-03`, `A2-04`).
|
||||
- 2026-02-23: Migration and verification closure (`A2-05`, `A2-06`).
|
||||
@@ -0,0 +1,134 @@
|
||||
# Sprint 20260218_008 - UI V2 Rewire Integrations and Platform Ops Data Integrity
|
||||
|
||||
## Topic & Scope
|
||||
- Implement canonical Integrations taxonomy and Platform Ops Data Integrity model with explicit separation of connectivity ownership and decision-impact consumption.
|
||||
- Deliver screen-level behavior for integrations hub/detail and platform data-integrity operations including feeds, mirrors, airgap, locks, and health confidence.
|
||||
- Ensure Security Data split is implemented exactly: Integrations and Platform Ops own source health operations, Security and Risk consumes gating impact.
|
||||
- Working directory: `src/Web/StellaOps.Web`.
|
||||
- Expected evidence: implemented integrations/ops routes and pages, cross-domain links, freshness-state behavior tests, and contract classification updates.
|
||||
|
||||
## Dependencies & Concurrency
|
||||
- Upstream dependencies: `SPRINT_20260218_005_DOCS_ui_v2_rewire_spec_freeze.md`, `SPRINT_20260218_006_FE_ui_v2_rewire_navigation_shell_route_migration.md`.
|
||||
- Downstream dependencies: feeds into dashboard, approvals, environment detail, and advisory sources in sprints `012`, `011`, `013`, and `014`.
|
||||
- Safe parallelism:
|
||||
- `I3-01` and `I3-02` can run in parallel.
|
||||
- `I3-03` depends on `I3-01`.
|
||||
- `I3-04` depends on `I3-02`.
|
||||
- `I3-05` depends on `I3-03` and `I3-04`.
|
||||
- `I3-06` depends on `I3-01` through `I3-05`.
|
||||
|
||||
## Documentation Prerequisites
|
||||
- `docs/modules/ui/v2-rewire/source-of-truth.md`
|
||||
- `docs/modules/ui/v2-rewire/authority-matrix.md`
|
||||
- `docs/modules/ui/v2-rewire/pack-10.md`
|
||||
- `docs/modules/ui/v2-rewire/pack-15.md`
|
||||
- `docs/modules/ui/v2-rewire/pack-21.md`
|
||||
- `docs/modules/ui/v2-rewire/S00_endpoint_contract_ledger_v1.md`
|
||||
- `src/Web/StellaOps.Web/src/app/features/operations/operations.routes.ts`
|
||||
- `src/Web/StellaOps.Web/src/app/features/integration-hub/`
|
||||
- `src/Web/StellaOps.Web/src/app/features/feed-mirror/`
|
||||
|
||||
## Delivery Tracker
|
||||
|
||||
### I3-01 - Implement Integrations domain taxonomy and overview
|
||||
Status: TODO
|
||||
Dependency: none
|
||||
Owners: Frontend developer
|
||||
Task description:
|
||||
- Implement Integrations root with canonical categories: SCM, CI/CD, Registries, Secrets, Targets/Runtimes, Feeds, Notification Providers.
|
||||
- Implement Integrations overview with operational health summary, degradation indicators, and direct jump actions to connector detail pages.
|
||||
|
||||
Completion criteria:
|
||||
- [ ] Integrations taxonomy and root pages match canonical category model.
|
||||
- [ ] Overview includes status/freshness/impact summary cards.
|
||||
- [ ] Category filtering and search behavior is deterministic.
|
||||
- [ ] Broken/degraded connectors expose actionable drilldowns.
|
||||
|
||||
### I3-02 - Implement Platform Ops Data Integrity overview and subpages
|
||||
Status: TODO
|
||||
Dependency: none
|
||||
Owners: Frontend developer
|
||||
Task description:
|
||||
- Implement Data Integrity as Platform Ops source of truth with subpages: overview, nightly report, feeds freshness, scan pipeline health, reachability ingest health, integration connectivity, DLQ and replays, data quality SLOs.
|
||||
- Ensure pages summarize and link to specialized operational pages without duplicating ownership responsibilities.
|
||||
|
||||
Completion criteria:
|
||||
- [ ] Data Integrity overview and all required subpages are implemented.
|
||||
- [ ] Subpage models include state for healthy, degraded, stale, and failed conditions.
|
||||
- [ ] Deep links route to owning operational screens.
|
||||
- [ ] No duplicated conflicting health source-of-truth is introduced.
|
||||
|
||||
### I3-03 - Implement Integration detail standard contract view
|
||||
Status: TODO
|
||||
Dependency: I3-01
|
||||
Owners: Frontend developer
|
||||
Task description:
|
||||
- Implement standardized Integration detail template with required sections: config, status and health, errors/logs, test connection, impact map, permissions/scopes.
|
||||
- Impact map must explicitly list affected release, approvals, SBOM ingest, and evidence workflows.
|
||||
|
||||
Completion criteria:
|
||||
- [ ] Detail template is consistent across connector categories.
|
||||
- [ ] Impact map fields and links are present and actionable.
|
||||
- [ ] Scope/permission diagnostics are visible and accurate.
|
||||
- [ ] Error and recovery actions are available for degraded connectors.
|
||||
|
||||
### I3-04 - Implement Feeds and AirGap ops surfaces under Platform Ops
|
||||
Status: TODO
|
||||
Dependency: I3-02
|
||||
Owners: Frontend developer
|
||||
Task description:
|
||||
- Implement or align pages for feed sources/freshness, mirrors, airgap bundles, and version locks under Platform Ops.
|
||||
- Ensure Integrations and Data Integrity pages link to these screens as operational drilldowns.
|
||||
- Enforce canonical ownership: these are operations controls, not settings controls.
|
||||
|
||||
Completion criteria:
|
||||
- [ ] Feed source, mirror, airgap, and lock pages are accessible under Platform Ops.
|
||||
- [ ] Cross-links from Integrations and Data Integrity are implemented.
|
||||
- [ ] Ownership labels and breadcrumbs are canonical.
|
||||
- [ ] No stale settings-era route remains primary for these capabilities.
|
||||
|
||||
### I3-05 - Implement Security Data split wiring and impact propagation
|
||||
Status: TODO
|
||||
Dependency: I3-04
|
||||
Owners: Frontend developer, Product engineer
|
||||
Task description:
|
||||
- Wire split contract for legacy Security Data:
|
||||
- Connectivity and freshness managed in Integrations and Platform Ops.
|
||||
- Decision impact consumed in Security and Risk Advisory Sources surface.
|
||||
- Implement explicit context payload transfer for source freshness and impact severity used by downstream domains.
|
||||
|
||||
Completion criteria:
|
||||
- [ ] Split ownership is visible and consistent in UI flows.
|
||||
- [ ] Context payloads for impact and freshness are available to downstream surfaces.
|
||||
- [ ] No single page incorrectly combines both ownership responsibilities.
|
||||
- [ ] Contract-ledger status is updated for affected rows.
|
||||
|
||||
### I3-06 - Verification, contract classification, and regression checks
|
||||
Status: TODO
|
||||
Dependency: I3-05
|
||||
Owners: Frontend developer, QA
|
||||
Task description:
|
||||
- Execute targeted tests for Integrations and Data Integrity route families, including degraded/stale states.
|
||||
- Update endpoint contract ledger with observed status class for all screens in this sprint scope.
|
||||
|
||||
Completion criteria:
|
||||
- [ ] Unit/E2E checks cover Integrations and Data Integrity critical paths.
|
||||
- [ ] Stale and degraded state behavior is validated.
|
||||
- [ ] Contract ledger rows for this sprint are updated and reviewed.
|
||||
- [ ] Residual risks are documented with concrete follow-up actions.
|
||||
|
||||
## Execution Log
|
||||
| Date (UTC) | Update | Owner |
|
||||
| --- | --- | --- |
|
||||
| 2026-02-18 | Sprint created for Integrations and Platform Ops Data Integrity implementation. | Planning |
|
||||
|
||||
## Decisions & Risks
|
||||
- Decision binding: Security Data ownership split from sprint `20260218_005` is mandatory.
|
||||
- Risk: same data shown by multiple domains may drift; mitigate with single-source ownership and linked drilldowns only.
|
||||
- Risk: degraded-state UX can become inconsistent across connectors; mitigate with one detail template and shared status conventions.
|
||||
- Existing code references: `src/Web/StellaOps.Web/src/app/features/integration-hub/`, `src/Web/StellaOps.Web/src/app/features/feed-mirror/`, `src/Web/StellaOps.Web/src/app/features/operations/operations.routes.ts`.
|
||||
|
||||
## Next Checkpoints
|
||||
- 2026-02-22: Integrations taxonomy and Data Integrity overview review (`I3-01`, `I3-02`).
|
||||
- 2026-02-23: Detail and Feeds/AirGap ops review (`I3-03`, `I3-04`).
|
||||
- 2026-02-24: Split wiring and verification closure (`I3-05`, `I3-06`).
|
||||
@@ -0,0 +1,129 @@
|
||||
# Sprint 20260218_009 - UI V2 Rewire Bundle Organizer and Lifecycle
|
||||
|
||||
## Topic & Scope
|
||||
- Implement the Release Control bundle lifecycle as the immutable release input model.
|
||||
- Deliver complete bundle catalog, bundle detail, bundle builder, bundle version detail, and materialize-to-environment flow.
|
||||
- Ensure bundle identity is digest-first and supports per-repository changelog and config contract materialization.
|
||||
- Working directory: `src/Web/StellaOps.Web`.
|
||||
- Expected evidence: bundle route implementation, builder workflow behavior, validation states, and contract-ledger updates.
|
||||
|
||||
## Dependencies & Concurrency
|
||||
- Upstream dependencies: `SPRINT_20260218_005_DOCS_ui_v2_rewire_spec_freeze.md`, `SPRINT_20260218_006_FE_ui_v2_rewire_navigation_shell_route_migration.md`, `SPRINT_20260218_008_FE_ui_v2_rewire_integrations_platform_ops_data_integrity.md`.
|
||||
- Downstream dependencies: required for promotions (`010`), approvals (`011`), environment detail (`013`), and dashboard risk summaries (`012`).
|
||||
- Safe parallelism:
|
||||
- `B4-01` and `B4-02` can run in parallel.
|
||||
- `B4-03` depends on `B4-01`.
|
||||
- `B4-04` depends on `B4-02`.
|
||||
- `B4-05` depends on `B4-03` and `B4-04`.
|
||||
- `B4-06` depends on `B4-01` through `B4-05`.
|
||||
|
||||
## Documentation Prerequisites
|
||||
- `docs/modules/ui/v2-rewire/source-of-truth.md`
|
||||
- `docs/modules/ui/v2-rewire/authority-matrix.md`
|
||||
- `docs/modules/ui/v2-rewire/pack-12.md`
|
||||
- `docs/modules/ui/v2-rewire/S00_endpoint_contract_ledger_v1.md`
|
||||
- `src/Web/StellaOps.Web/src/app/features/release-orchestrator/`
|
||||
- `src/Web/StellaOps.Web/src/app/core/api/`
|
||||
|
||||
## Delivery Tracker
|
||||
|
||||
### B4-01 - Implement bundle catalog and bundle detail
|
||||
Status: TODO
|
||||
Dependency: none
|
||||
Owners: Frontend developer
|
||||
Task description:
|
||||
- Implement bundle catalog view with canonical columns: bundle name, latest bundle version, component count, regions/environments impact, readiness indicators.
|
||||
- Implement bundle detail with overview, versions, deployments usage, and evidence pointers.
|
||||
|
||||
Completion criteria:
|
||||
- [ ] Bundle catalog route and page are implemented with required fields.
|
||||
- [ ] Bundle detail route and sections are implemented.
|
||||
- [ ] Catalog-to-detail navigation and filtering work deterministically.
|
||||
- [ ] Empty and error states are implemented with actionable guidance.
|
||||
|
||||
### B4-02 - Implement bundle builder workflow shell
|
||||
Status: TODO
|
||||
Dependency: none
|
||||
Owners: Frontend developer, UX developer
|
||||
Task description:
|
||||
- Implement builder workflow with steps: select component versions, config contracts, changelog preview, validation.
|
||||
- Builder must preserve a clear draft state model and prevent invalid step advancement.
|
||||
|
||||
Completion criteria:
|
||||
- [ ] Builder route and step navigation are implemented.
|
||||
- [ ] Step progression is gated by required validations.
|
||||
- [ ] Draft state is deterministic and recoverable on refresh/re-entry.
|
||||
- [ ] Step error messaging is explicit and actionable.
|
||||
|
||||
### B4-03 - Implement component selection and digest-first identity view
|
||||
Status: TODO
|
||||
Dependency: B4-01
|
||||
Owners: Frontend developer
|
||||
Task description:
|
||||
- Implement component version selection table with digest-first identity and display version labels.
|
||||
- Show required metadata: SBOM presence/freshness, finding counters, reachability coverage, provenance pointers.
|
||||
|
||||
Completion criteria:
|
||||
- [ ] Component selector exposes digest-first identity and display version correctly.
|
||||
- [ ] Required metadata fields are visible and sortable/filterable.
|
||||
- [ ] Selection constraints prevent incompatible component combinations.
|
||||
- [ ] Selection state is carried forward to later builder steps.
|
||||
|
||||
### B4-04 - Implement config-contract and changelog steps
|
||||
Status: TODO
|
||||
Dependency: B4-02
|
||||
Owners: Frontend developer
|
||||
Task description:
|
||||
- Implement config-contract step including required inputs, source bindings (Vault/Consul style), and readiness checks.
|
||||
- Implement changelog preview grouped by repository with clear commit/range summaries.
|
||||
|
||||
Completion criteria:
|
||||
- [ ] Config-contract step validates required inputs and binding readiness.
|
||||
- [ ] Changelog step presents per-repo diffs with deterministic ordering.
|
||||
- [ ] Validation failures are surfaced with clear remediation guidance.
|
||||
- [ ] Output from both steps is preserved in draft bundle state.
|
||||
|
||||
### B4-05 - Implement bundle validation and immutable version detail
|
||||
Status: TODO
|
||||
Dependency: B4-04
|
||||
Owners: Frontend developer
|
||||
Task description:
|
||||
- Implement final validation step covering policy readiness, SBOM readiness, reachability evidence availability, and data-freshness preconditions.
|
||||
- Implement bundle version detail as immutable snapshot containing manifest digest, component map, config snapshot, and evidence links.
|
||||
|
||||
Completion criteria:
|
||||
- [ ] Validation summary includes all required readiness checks.
|
||||
- [ ] Version publish action creates immutable snapshot representation in UI state.
|
||||
- [ ] Bundle version detail displays manifest and linked evidence context.
|
||||
- [ ] Failure states block publish with explicit blocking reasons.
|
||||
|
||||
### B4-06 - Implement materialize-to-environment flow and verification
|
||||
Status: TODO
|
||||
Dependency: B4-05
|
||||
Owners: Frontend developer, QA
|
||||
Task description:
|
||||
- Implement materialize-to-environment flow from bundle version detail, including environment selection and input readiness summary.
|
||||
- Add targeted tests for bundle lifecycle routes and state transitions.
|
||||
- Update contract ledger rows for bundle pages and builder dependencies.
|
||||
|
||||
Completion criteria:
|
||||
- [ ] Materialization flow is available from bundle version detail.
|
||||
- [ ] Environment readiness summary includes required preconditions.
|
||||
- [ ] Bundle lifecycle unit/E2E checks pass.
|
||||
- [ ] Contract ledger updates are complete and reviewed.
|
||||
|
||||
## Execution Log
|
||||
| Date (UTC) | Update | Owner |
|
||||
| --- | --- | --- |
|
||||
| 2026-02-18 | Sprint created for bundle organizer and lifecycle implementation. | Planning |
|
||||
|
||||
## Decisions & Risks
|
||||
- Decision binding: bundle lifecycle semantics are digest-first and immutable.
|
||||
- Risk: builder complexity can create fragile client state; mitigate with explicit step state machine and test coverage.
|
||||
- Risk: missing backend composition endpoints may block progress; mitigate via early contract classification and `MISSING_NEW` proposals.
|
||||
- Existing code references: `src/Web/StellaOps.Web/src/app/features/release-orchestrator/`, `src/Web/StellaOps.Web/src/app/core/api/`.
|
||||
|
||||
## Next Checkpoints
|
||||
- 2026-02-23: Catalog/detail and builder shell review (`B4-01`, `B4-02`).
|
||||
- 2026-02-24: Selection/config/changelog review (`B4-03`, `B4-04`).
|
||||
- 2026-02-25: Validation/materialization and test closure (`B4-05`, `B4-06`).
|
||||
@@ -0,0 +1,114 @@
|
||||
# Sprint 20260218_010 - UI V2 Rewire Releases Promotions and Run Timeline
|
||||
|
||||
## Topic & Scope
|
||||
- Implement bundle-version anchored promotions and release detail flow in Release Control.
|
||||
- Deliver release creation, release list, release detail, and run timeline integration with rollback and replay-context entry points.
|
||||
- Ensure promotion decisions and execution states are traceable and linked to approvals, evidence, and environment context.
|
||||
- Working directory: `src/Web/StellaOps.Web`.
|
||||
- Expected evidence: release routes/screens, promotion wizard behavior, timeline behavior, and contract-ledger updates.
|
||||
|
||||
## Dependencies & Concurrency
|
||||
- Upstream dependencies: `SPRINT_20260218_009_FE_ui_v2_rewire_bundle_organizer_lifecycle.md`, `SPRINT_20260218_006_FE_ui_v2_rewire_navigation_shell_route_migration.md`, `SPRINT_20260218_008_FE_ui_v2_rewire_integrations_platform_ops_data_integrity.md`.
|
||||
- Downstream dependencies: required before approvals enhancements (`011`) and final dashboard/environment risk surfacing (`012`, `013`).
|
||||
- Safe parallelism:
|
||||
- `R5-01` and `R5-02` can run in parallel.
|
||||
- `R5-03` depends on `R5-01`.
|
||||
- `R5-04` depends on `R5-02`.
|
||||
- `R5-05` depends on `R5-03` and `R5-04`.
|
||||
|
||||
## Documentation Prerequisites
|
||||
- `docs/modules/ui/v2-rewire/source-of-truth.md`
|
||||
- `docs/modules/ui/v2-rewire/authority-matrix.md`
|
||||
- `docs/modules/ui/v2-rewire/pack-13.md`
|
||||
- `docs/modules/ui/v2-rewire/pack-14.md`
|
||||
- `docs/modules/ui/v2-rewire/S00_endpoint_contract_ledger_v1.md`
|
||||
- `src/Web/StellaOps.Web/src/app/features/release-orchestrator/releases/`
|
||||
- `src/Web/StellaOps.Web/src/app/features/deployments/`
|
||||
|
||||
## Delivery Tracker
|
||||
|
||||
### R5-01 - Implement promotions list with bundle-version identity
|
||||
Status: TODO
|
||||
Dependency: none
|
||||
Owners: Frontend developer
|
||||
Task description:
|
||||
- Implement release promotions list with canonical columns: promotion id, bundle version identity, source and target env path, gate status, decision status, run status, and freshness indicators.
|
||||
- Include list-level filters for environment, status, risk summary, and freshness state.
|
||||
|
||||
Completion criteria:
|
||||
- [ ] Promotions list route and page are implemented.
|
||||
- [ ] Required columns and filters are present.
|
||||
- [ ] Row navigation to release detail is deterministic.
|
||||
- [ ] Empty, loading, and error states are complete.
|
||||
|
||||
### R5-02 - Implement create promotion wizard
|
||||
Status: TODO
|
||||
Dependency: none
|
||||
Owners: Frontend developer
|
||||
Task description:
|
||||
- Implement wizard for selecting bundle version, promotion path, target environments, and input materialization readiness.
|
||||
- Wizard must surface preflight checks and block submission when gating prerequisites are unresolved.
|
||||
|
||||
Completion criteria:
|
||||
- [ ] Create promotion wizard route and steps are implemented.
|
||||
- [ ] Preflight checks and blocking states are visible and enforceable.
|
||||
- [ ] Submission payload includes bundle-version identity and target path context.
|
||||
- [ ] Validation and failure messages are actionable.
|
||||
|
||||
### R5-03 - Implement release detail with gate and evidence summary
|
||||
Status: TODO
|
||||
Dependency: R5-01
|
||||
Owners: Frontend developer
|
||||
Task description:
|
||||
- Implement release detail as canonical promotion case file with overview, gates summary, security snapshot, ops/data summary, and evidence pointers.
|
||||
- Ensure detail page deep-links into approvals, environment detail, and run timeline.
|
||||
|
||||
Completion criteria:
|
||||
- [ ] Release detail sections and summaries are implemented.
|
||||
- [ ] Deep links to approvals/env/run/evidence targets function correctly.
|
||||
- [ ] Gate status is human-readable and includes blocking rationale.
|
||||
- [ ] Page supports stale/partial data states gracefully.
|
||||
|
||||
### R5-04 - Implement run timeline shell and step detail integration
|
||||
Status: TODO
|
||||
Dependency: R5-02
|
||||
Owners: Frontend developer
|
||||
Task description:
|
||||
- Implement run timeline entry from release detail showing stage checkpoints, step statuses, and evidence capture moments.
|
||||
- Implement step-detail navigation with logs/artifacts/evidence pointers and rollback trigger visibility.
|
||||
|
||||
Completion criteria:
|
||||
- [ ] Timeline view and step navigation are implemented.
|
||||
- [ ] Step detail includes logs, artifacts, and evidence pointers.
|
||||
- [ ] Rollback/retry control visibility follows status and role conditions.
|
||||
- [ ] Timeline state handling is deterministic for partial runs.
|
||||
|
||||
### R5-05 - Verify promotions and timeline flows and update contract ledger
|
||||
Status: TODO
|
||||
Dependency: R5-04
|
||||
Owners: Frontend developer, QA
|
||||
Task description:
|
||||
- Add targeted unit and E2E checks for release list, create wizard, release detail, and timeline paths.
|
||||
- Update endpoint contract ledger for promotions and run timeline APIs, including any `MISSING_NEW` proposals.
|
||||
|
||||
Completion criteria:
|
||||
- [ ] Tests cover create -> detail -> timeline flow.
|
||||
- [ ] Blocking and degraded states are tested.
|
||||
- [ ] Contract-ledger rows are updated and reviewed.
|
||||
- [ ] Residual risks are documented with owner and follow-up sprint.
|
||||
|
||||
## Execution Log
|
||||
| Date (UTC) | Update | Owner |
|
||||
| --- | --- | --- |
|
||||
| 2026-02-18 | Sprint created for promotions and run timeline implementation. | Planning |
|
||||
|
||||
## Decisions & Risks
|
||||
- Decision binding: promotions are anchored to immutable bundle versions.
|
||||
- Risk: run timeline may depend on backend step granularity not currently exposed; mitigate with early contract classification.
|
||||
- Risk: promotion preflight checks can diverge from approval checks; mitigate by reusing shared gate summary model.
|
||||
- Existing code references: `src/Web/StellaOps.Web/src/app/features/release-orchestrator/releases/`, `src/Web/StellaOps.Web/src/app/features/deployments/`, `src/Web/StellaOps.Web/src/app/core/api/`.
|
||||
|
||||
## Next Checkpoints
|
||||
- 2026-02-24: Promotions list and creation wizard review (`R5-01`, `R5-02`).
|
||||
- 2026-02-25: Release detail and timeline integration review (`R5-03`, `R5-04`).
|
||||
- 2026-02-26: Verification and contract-ledger closure (`R5-05`).
|
||||
@@ -0,0 +1,117 @@
|
||||
# Sprint 20260218_011 - UI V2 Rewire Approvals Decision Cockpit
|
||||
|
||||
## Topic & Scope
|
||||
- Implement approvals v2 as a self-sufficient decision cockpit with full operational/security/evidence context.
|
||||
- Deliver approvals queue and approval detail tabs: overview, gates, security, reachability, ops/data health, evidence, replay/verify, and history.
|
||||
- Ensure decision actions are auditable and clearly linked to policy, evidence, and environment impact.
|
||||
- Working directory: `src/Web/StellaOps.Web`.
|
||||
- Expected evidence: approvals UI implementation, decision-flow tests, audit-linked actions, and contract-ledger updates.
|
||||
|
||||
## Dependencies & Concurrency
|
||||
- Upstream dependencies: `SPRINT_20260218_010_FE_ui_v2_rewire_releases_promotions_run_timeline.md`, `SPRINT_20260218_008_FE_ui_v2_rewire_integrations_platform_ops_data_integrity.md`, `SPRINT_20260218_006_FE_ui_v2_rewire_navigation_shell_route_migration.md`.
|
||||
- Downstream dependencies: dashboard and environment standardization sprints consume approval summaries.
|
||||
- Safe parallelism:
|
||||
- `A6-01` and `A6-02` can run in parallel.
|
||||
- `A6-03` depends on `A6-01`.
|
||||
- `A6-04` depends on `A6-02`.
|
||||
- `A6-05` depends on `A6-03` and `A6-04`.
|
||||
|
||||
## Documentation Prerequisites
|
||||
- `docs/modules/ui/v2-rewire/source-of-truth.md`
|
||||
- `docs/modules/ui/v2-rewire/authority-matrix.md`
|
||||
- `docs/modules/ui/v2-rewire/pack-17.md`
|
||||
- `docs/modules/ui/v2-rewire/pack-13.md`
|
||||
- `docs/modules/ui/v2-rewire/S00_endpoint_contract_ledger_v1.md`
|
||||
- `src/Web/StellaOps.Web/src/app/features/approvals/`
|
||||
- `src/Web/StellaOps.Web/src/app/core/api/`
|
||||
|
||||
## Delivery Tracker
|
||||
|
||||
### A6-01 - Implement approvals queue v2
|
||||
Status: TODO
|
||||
Dependency: none
|
||||
Owners: Frontend developer
|
||||
Task description:
|
||||
- Implement approvals queue with decision-critical columns: request id, bundle version, source and target env, gate status, risk summary (`CritR`, SBOM freshness), data confidence, pending approvers, and age.
|
||||
- Add filter and search model for environment, status, risk type, and data confidence severity.
|
||||
|
||||
Completion criteria:
|
||||
- [ ] Queue route and page are implemented with required columns.
|
||||
- [ ] Filters and search support decision-critical triage.
|
||||
- [ ] Queue rows link to approval detail reliably.
|
||||
- [ ] Empty/error/loading states are complete.
|
||||
|
||||
### A6-02 - Implement approval detail overview and gates tabs
|
||||
Status: TODO
|
||||
Dependency: none
|
||||
Owners: Frontend developer
|
||||
Task description:
|
||||
- Implement overview tab with promotion summary, target risk, data confidence summary, and quick decision context.
|
||||
- Implement gates tab with full gate trace including policy decisions, timestamps, and blocking rationale.
|
||||
|
||||
Completion criteria:
|
||||
- [ ] Overview and gates tabs are implemented.
|
||||
- [ ] Gate trace contains explicit pass/fail/waived states.
|
||||
- [ ] Blocking reasons are human-readable and actionable.
|
||||
- [ ] Tabs handle partial data and stale snapshots gracefully.
|
||||
|
||||
### A6-03 - Implement security, reachability, and ops/data tabs
|
||||
Status: TODO
|
||||
Dependency: A6-01
|
||||
Owners: Frontend developer
|
||||
Task description:
|
||||
- Implement security tab showing SBOM findings by environment and delta context.
|
||||
- Implement reachability tab with hybrid B/I/R summary and evidence age.
|
||||
- Implement ops/data health tab with data integrity confidence and failing-source links.
|
||||
|
||||
Completion criteria:
|
||||
- [ ] Security tab includes env-scoped findings and summary metrics.
|
||||
- [ ] Reachability tab includes B/I/R coverage and evidence-age indicators.
|
||||
- [ ] Ops/data tab links to Data Integrity and source details.
|
||||
- [ ] All three tabs use consistent severity and freshness semantics.
|
||||
|
||||
### A6-04 - Implement evidence, replay/verify, and history tabs
|
||||
Status: TODO
|
||||
Dependency: A6-02
|
||||
Owners: Frontend developer
|
||||
Task description:
|
||||
- Implement evidence tab with decision packet contents and export hooks.
|
||||
- Implement replay/verify tab for contextual verification path entry.
|
||||
- Implement history tab with decision lifecycle timeline and actor trail.
|
||||
|
||||
Completion criteria:
|
||||
- [ ] Evidence tab includes packet references and actions.
|
||||
- [ ] Replay/verify tab links to correct verification contexts.
|
||||
- [ ] History tab captures lifecycle chronology and actors.
|
||||
- [ ] Tabs preserve context identifiers across navigation.
|
||||
|
||||
### A6-05 - Implement decision actions and verify approvals flow
|
||||
Status: TODO
|
||||
Dependency: A6-04
|
||||
Owners: Frontend developer, QA
|
||||
Task description:
|
||||
- Implement approve/reject/defer/escalate actions with confirmation, reason capture, and auditable submission.
|
||||
- Add targeted tests for queue to detail traversal and decision action outcomes.
|
||||
- Update endpoint contract ledger entries for approvals and linked evidence/gate APIs.
|
||||
|
||||
Completion criteria:
|
||||
- [ ] Decision actions enforce reason capture and confirmation rules.
|
||||
- [ ] Action outcomes are reflected in queue/detail/history states.
|
||||
- [ ] Approvals flow tests pass for happy path and blocking path.
|
||||
- [ ] Contract-ledger rows are updated and reviewed.
|
||||
|
||||
## Execution Log
|
||||
| Date (UTC) | Update | Owner |
|
||||
| --- | --- | --- |
|
||||
| 2026-02-18 | Sprint created for approvals decision cockpit implementation. | Planning |
|
||||
|
||||
## Decisions & Risks
|
||||
- Decision binding: approvals must be decision-complete without forcing operators to hunt across domains.
|
||||
- Risk: tab payload fan-out may cause latency and partial data; mitigate with clear stale/partial states and lazy loading strategy.
|
||||
- Risk: decision actions without audit context can fail compliance; mitigate with enforced reason capture and history linkage.
|
||||
- Existing code references: `src/Web/StellaOps.Web/src/app/features/approvals/`, `src/Web/StellaOps.Web/src/app/core/api/`, `src/Web/StellaOps.Web/tests/e2e/`.
|
||||
|
||||
## Next Checkpoints
|
||||
- 2026-02-25: Queue and core tab review (`A6-01`, `A6-02`).
|
||||
- 2026-02-26: Advanced tabs review (`A6-03`, `A6-04`).
|
||||
- 2026-02-27: Decision action verification and ledger update (`A6-05`).
|
||||
@@ -0,0 +1,113 @@
|
||||
# Sprint 20260218_012 - UI V2 Rewire Dashboard V3 Mission Board
|
||||
|
||||
## Topic & Scope
|
||||
- Implement Dashboard v3 as the release mission board with environment risk, SBOM state, hybrid reachability, and data-integrity signals.
|
||||
- Deliver mission-critical drilldowns to releases, approvals, environment detail, security findings, and ops data integrity.
|
||||
- Ensure dashboard aggregates are accurate, freshness-aware, and non-duplicative of owning domains.
|
||||
- Working directory: `src/Web/StellaOps.Web`.
|
||||
- Expected evidence: dashboard UI implementation, card/drawer flows, cross-link tests, and aggregate contract-ledger updates.
|
||||
|
||||
## Dependencies & Concurrency
|
||||
- Upstream dependencies: `SPRINT_20260218_008_FE_ui_v2_rewire_integrations_platform_ops_data_integrity.md`, `SPRINT_20260218_010_FE_ui_v2_rewire_releases_promotions_run_timeline.md`, `SPRINT_20260218_011_FE_ui_v2_rewire_approvals_decision_cockpit.md`.
|
||||
- Downstream dependencies: consumed by environment detail and security/evidence consolidation sprints.
|
||||
- Safe parallelism:
|
||||
- `D7-01` and `D7-02` can run in parallel.
|
||||
- `D7-03` depends on `D7-01`.
|
||||
- `D7-04` depends on `D7-02`.
|
||||
- `D7-05` depends on `D7-03` and `D7-04`.
|
||||
|
||||
## Documentation Prerequisites
|
||||
- `docs/modules/ui/v2-rewire/source-of-truth.md`
|
||||
- `docs/modules/ui/v2-rewire/authority-matrix.md`
|
||||
- `docs/modules/ui/v2-rewire/pack-16.md`
|
||||
- `docs/modules/ui/v2-rewire/S00_endpoint_contract_ledger_v1.md`
|
||||
- `src/Web/StellaOps.Web/src/app/features/control-plane/`
|
||||
- `src/Web/StellaOps.Web/src/app/layout/`
|
||||
|
||||
## Delivery Tracker
|
||||
|
||||
### D7-01 - Implement dashboard header, filters, and mission summary
|
||||
Status: TODO
|
||||
Dependency: none
|
||||
Owners: Frontend developer
|
||||
Task description:
|
||||
- Implement dashboard header with global filters (region, environment, time window) and mission status summary.
|
||||
- Include canonical mission summary indicators for active promotions, blocked promotions, highest risk environment, and data integrity status.
|
||||
|
||||
Completion criteria:
|
||||
- [ ] Header and global filters are implemented and functional.
|
||||
- [ ] Mission summary indicators are visible and context-aware.
|
||||
- [ ] Filter state is deterministic and URL-safe where required.
|
||||
- [ ] Empty and loading states are defined.
|
||||
|
||||
### D7-02 - Implement regional pipeline status board
|
||||
Status: TODO
|
||||
Dependency: none
|
||||
Owners: Frontend developer
|
||||
Task description:
|
||||
- Implement regional pipeline board showing per-environment deploy status, SBOM freshness, CritR summary, and B/I/R coverage.
|
||||
- Provide direct links to environment detail and release detail from pipeline nodes.
|
||||
|
||||
Completion criteria:
|
||||
- [ ] Regional pipeline board includes required env-level status fields.
|
||||
- [ ] Node links route to environment and release context correctly.
|
||||
- [ ] Severity and freshness indicators follow shared conventions.
|
||||
- [ ] Board handles incomplete regional data without breaking layout.
|
||||
|
||||
### D7-03 - Implement SBOM findings snapshot and drawer flow
|
||||
Status: TODO
|
||||
Dependency: D7-01
|
||||
Owners: Frontend developer
|
||||
Task description:
|
||||
- Implement SBOM findings snapshot card and expandable drawer with environment-level breakdown.
|
||||
- Include filters for critical reachable focus, prod-only scope, and stale/missing SBOM states.
|
||||
|
||||
Completion criteria:
|
||||
- [ ] Snapshot card is present with actionable summary values.
|
||||
- [ ] Drawer flow includes env breakdown and quick filters.
|
||||
- [ ] Drawer links to security findings with preserved context.
|
||||
- [ ] Error/stale indicators are explicit.
|
||||
|
||||
### D7-04 - Implement hybrid reachability and nightly/data-integrity cards
|
||||
Status: TODO
|
||||
Dependency: D7-02
|
||||
Owners: Frontend developer
|
||||
Task description:
|
||||
- Implement hybrid reachability summary card (B/I/R coverage) and nightly/data-integrity signals card.
|
||||
- Cards must link to owning domains (Security and Risk, Platform Ops Data Integrity) and avoid duplicating deep operational controls.
|
||||
|
||||
Completion criteria:
|
||||
- [ ] Hybrid reachability and nightly/data cards are implemented.
|
||||
- [ ] Cards link to owning pages with context filters.
|
||||
- [ ] Card semantics and thresholds align with shared severity model.
|
||||
- [ ] No duplicated ownership behavior is introduced.
|
||||
|
||||
### D7-05 - Dashboard verification and aggregate contract updates
|
||||
Status: TODO
|
||||
Dependency: D7-04
|
||||
Owners: Frontend developer, QA
|
||||
Task description:
|
||||
- Add tests covering dashboard mission board interactions, drawer behavior, and drilldown links.
|
||||
- Update endpoint contract ledger rows for dashboard aggregate dependencies and freshness model.
|
||||
|
||||
Completion criteria:
|
||||
- [ ] Unit/E2E checks pass for dashboard critical flows.
|
||||
- [ ] Drilldown navigation is validated across key cards.
|
||||
- [ ] Aggregate contract rows updated in ledger.
|
||||
- [ ] Residual dashboard risks documented with follow-up owners.
|
||||
|
||||
## Execution Log
|
||||
| Date (UTC) | Update | Owner |
|
||||
| --- | --- | --- |
|
||||
| 2026-02-18 | Sprint created for dashboard v3 mission-board implementation. | Planning |
|
||||
|
||||
## Decisions & Risks
|
||||
- Decision binding: dashboard is a mission board and must summarize, not re-own, downstream domain controls.
|
||||
- Risk: aggregate cards may mask stale source data; mitigate with explicit freshness badges and stale state UX.
|
||||
- Risk: too many cards can fragment operator attention; mitigate by preserving critical path ordering and contextual drilldowns.
|
||||
- Existing code references: `src/Web/StellaOps.Web/src/app/features/control-plane/`, `src/Web/StellaOps.Web/src/app/layout/`, `src/Web/StellaOps.Web/src/app/core/api/`.
|
||||
|
||||
## Next Checkpoints
|
||||
- 2026-02-26: Header, filters, and pipeline board review (`D7-01`, `D7-02`).
|
||||
- 2026-02-27: Snapshot and integrity card review (`D7-03`, `D7-04`).
|
||||
- 2026-02-28: Verification and ledger update closure (`D7-05`).
|
||||
@@ -0,0 +1,115 @@
|
||||
# Sprint 20260218_013 - UI V2 Rewire Environment Detail Standardization
|
||||
|
||||
## Topic & Scope
|
||||
- Implement standardized Environment Detail as the single environment decision view.
|
||||
- Deliver canonical environment header and tabs: overview, deploy status, SBOM/findings, reachability, inputs, promotions/approvals, data confidence, evidence/audit.
|
||||
- Ensure environment page links to bundle, release run, security, ops, and evidence contexts without ownership duplication.
|
||||
- Working directory: `src/Web/StellaOps.Web`.
|
||||
- Expected evidence: environment detail implementation, tab behavior checks, cross-link validation, and contract-ledger updates.
|
||||
|
||||
## Dependencies & Concurrency
|
||||
- Upstream dependencies: `SPRINT_20260218_009_FE_ui_v2_rewire_bundle_organizer_lifecycle.md`, `SPRINT_20260218_010_FE_ui_v2_rewire_releases_promotions_run_timeline.md`, `SPRINT_20260218_008_FE_ui_v2_rewire_integrations_platform_ops_data_integrity.md`, `SPRINT_20260218_012_FE_ui_v2_rewire_dashboard_v3_mission_board.md`.
|
||||
- Downstream dependencies: provides core context for approvals, security, and evidence deep-link consistency.
|
||||
- Safe parallelism:
|
||||
- `E8-01` and `E8-02` can run in parallel.
|
||||
- `E8-03` depends on `E8-01`.
|
||||
- `E8-04` depends on `E8-02`.
|
||||
- `E8-05` depends on `E8-03` and `E8-04`.
|
||||
|
||||
## Documentation Prerequisites
|
||||
- `docs/modules/ui/v2-rewire/source-of-truth.md`
|
||||
- `docs/modules/ui/v2-rewire/authority-matrix.md`
|
||||
- `docs/modules/ui/v2-rewire/pack-18.md`
|
||||
- `docs/modules/ui/v2-rewire/S00_endpoint_contract_ledger_v1.md`
|
||||
- `src/Web/StellaOps.Web/src/app/features/release-orchestrator/environments/`
|
||||
|
||||
## Delivery Tracker
|
||||
|
||||
### E8-01 - Implement standardized environment header shell
|
||||
Status: TODO
|
||||
Dependency: none
|
||||
Owners: Frontend developer
|
||||
Task description:
|
||||
- Implement environment detail shell with canonical header summary: deploy status, SBOM freshness, CritR, hybrid B/I/R coverage, and data confidence.
|
||||
- Header must include explicit identity for region, environment, and active bundle/release context.
|
||||
|
||||
Completion criteria:
|
||||
- [ ] Header shows all required summary fields.
|
||||
- [ ] Region/environment identity and context links are explicit.
|
||||
- [ ] Severity and freshness semantics align with shared model.
|
||||
- [ ] Header supports partial data with deterministic fallback states.
|
||||
|
||||
### E8-02 - Implement overview and deploy-status tabs
|
||||
Status: TODO
|
||||
Dependency: none
|
||||
Owners: Frontend developer
|
||||
Task description:
|
||||
- Implement overview tab with top risks, pending actions, and quick links.
|
||||
- Implement deploy-status tab with runtime targets, service states, and recent deployment checkpoints.
|
||||
|
||||
Completion criteria:
|
||||
- [ ] Overview tab includes risk and action summaries.
|
||||
- [ ] Deploy tab includes target/service status detail.
|
||||
- [ ] Links route to release run and deployment details correctly.
|
||||
- [ ] Tab state remains stable across filter changes.
|
||||
|
||||
### E8-03 - Implement SBOM/findings and reachability tabs
|
||||
Status: TODO
|
||||
Dependency: E8-01
|
||||
Owners: Frontend developer
|
||||
Task description:
|
||||
- Implement SBOM/findings tab with deployed inventory, SBOM state, CritR/HighR/HighNR summaries, and finding links.
|
||||
- Implement reachability tab with hybrid B/I/R matrix, source presence, and evidence age indicators.
|
||||
|
||||
Completion criteria:
|
||||
- [ ] SBOM/findings tab includes env-scoped inventory and finding summary.
|
||||
- [ ] Reachability tab includes B/I/R matrix and evidence-age fields.
|
||||
- [ ] Links to Security and Risk findings preserve environment context.
|
||||
- [ ] Non-available data states are represented clearly.
|
||||
|
||||
### E8-04 - Implement inputs, promotions/approvals, data confidence, and evidence tabs
|
||||
Status: TODO
|
||||
Dependency: E8-02
|
||||
Owners: Frontend developer
|
||||
Task description:
|
||||
- Implement inputs tab with configuration materialization readiness and binding diagnostics.
|
||||
- Implement promotions/approvals tab with env-scoped timeline and pending decisions.
|
||||
- Implement data confidence tab as env-scoped Data Integrity summary.
|
||||
- Implement evidence/audit tab with env snapshot and proof references.
|
||||
|
||||
Completion criteria:
|
||||
- [ ] Inputs tab includes readiness and binding visibility.
|
||||
- [ ] Promotions/approvals tab includes pending and historical context.
|
||||
- [ ] Data confidence tab links to owning Ops Data Integrity pages.
|
||||
- [ ] Evidence tab links to Evidence and Audit exports/references.
|
||||
|
||||
### E8-05 - Verify environment detail and update contract ledger
|
||||
Status: TODO
|
||||
Dependency: E8-04
|
||||
Owners: Frontend developer, QA
|
||||
Task description:
|
||||
- Add tests for environment detail shell and all canonical tabs.
|
||||
- Verify deep links to bundles, release runs, approvals, security, ops, and evidence.
|
||||
- Update endpoint contract ledger rows for environment-scoped data dependencies.
|
||||
|
||||
Completion criteria:
|
||||
- [ ] Tab-level tests cover major happy path and degraded path scenarios.
|
||||
- [ ] Cross-domain deep links are validated end-to-end.
|
||||
- [ ] Ledger rows for environment detail dependencies are updated.
|
||||
- [ ] Residual risks are recorded with owner and mitigation path.
|
||||
|
||||
## Execution Log
|
||||
| Date (UTC) | Update | Owner |
|
||||
| --- | --- | --- |
|
||||
| 2026-02-18 | Sprint created for standardized environment detail implementation. | Planning |
|
||||
|
||||
## Decisions & Risks
|
||||
- Decision binding: environment detail is the single environment decision page and must aggregate, not duplicate domain ownership.
|
||||
- Risk: tab fan-out can create latency or stale states; mitigate with explicit loading/staleness semantics.
|
||||
- Risk: inconsistent context propagation can break drilldowns; mitigate with canonical environment context payload across links.
|
||||
- Existing code references: `src/Web/StellaOps.Web/src/app/features/release-orchestrator/environments/`, `src/Web/StellaOps.Web/src/app/core/api/`.
|
||||
|
||||
## Next Checkpoints
|
||||
- 2026-02-27: Header and first tab-set review (`E8-01`, `E8-02`).
|
||||
- 2026-02-28: Remaining tab-set review (`E8-03`, `E8-04`).
|
||||
- 2026-03-01: Verification and ledger update closure (`E8-05`).
|
||||
@@ -0,0 +1,115 @@
|
||||
# Sprint 20260218_014 - UI V2 Rewire Security and Risk Consolidation
|
||||
|
||||
## Topic & Scope
|
||||
- Implement the consolidated Security and Risk domain with decision-first ordering.
|
||||
- Deliver risk overview, findings explorer/detail, vulnerabilities explorer/detail, SBOM lake/graph placement, VEX, exceptions, and Advisory Sources.
|
||||
- Preserve second-class visibility of reachability and enforce ownership split for advisory source operations vs decision impact.
|
||||
- Working directory: `src/Web/StellaOps.Web`.
|
||||
- Expected evidence: security route implementation, cross-link behavior, advisory-source behavior, and contract-ledger updates.
|
||||
|
||||
## Dependencies & Concurrency
|
||||
- Upstream dependencies: `SPRINT_20260218_005_DOCS_ui_v2_rewire_spec_freeze.md`, `SPRINT_20260218_008_FE_ui_v2_rewire_integrations_platform_ops_data_integrity.md`, `SPRINT_20260218_012_FE_ui_v2_rewire_dashboard_v3_mission_board.md`, `SPRINT_20260218_013_FE_ui_v2_rewire_environment_detail_standardization.md`.
|
||||
- Downstream dependencies: evidence and audit integration checks in sprint `015` and cutover in sprint `016`.
|
||||
- Safe parallelism:
|
||||
- `S9-01` and `S9-02` can run in parallel.
|
||||
- `S9-03` depends on `S9-01`.
|
||||
- `S9-04` depends on `S9-02`.
|
||||
- `S9-05` depends on `S9-03` and `S9-04`.
|
||||
|
||||
## Documentation Prerequisites
|
||||
- `docs/modules/ui/v2-rewire/source-of-truth.md`
|
||||
- `docs/modules/ui/v2-rewire/authority-matrix.md`
|
||||
- `docs/modules/ui/v2-rewire/pack-19.md`
|
||||
- `docs/modules/ui/v2-rewire/S00_advisory_sources_spec.md` (or equivalent signed output from sprint `20260218_005`)
|
||||
- `docs/modules/ui/v2-rewire/S00_endpoint_contract_ledger_v1.md`
|
||||
- `src/Web/StellaOps.Web/src/app/features/security/`
|
||||
|
||||
## Delivery Tracker
|
||||
|
||||
### S9-01 - Implement risk overview and findings explorer
|
||||
Status: TODO
|
||||
Dependency: none
|
||||
Owners: Frontend developer
|
||||
Task description:
|
||||
- Implement risk overview as the entry page emphasizing what blocks releases and where critical reachable risk exists.
|
||||
- Implement findings explorer with filters for severity, reachability, environment, bundle, freshness, and exception status.
|
||||
|
||||
Completion criteria:
|
||||
- [ ] Risk overview and findings explorer routes are implemented.
|
||||
- [ ] Findings filters support decision-critical triage dimensions.
|
||||
- [ ] Risk-to-release and risk-to-environment links are functional.
|
||||
- [ ] Data-state behavior for stale/partial feeds is clear.
|
||||
|
||||
### S9-02 - Implement vulnerabilities explorer and detail surfaces
|
||||
Status: TODO
|
||||
Dependency: none
|
||||
Owners: Frontend developer
|
||||
Task description:
|
||||
- Implement vulnerabilities explorer for CVE-centric analysis with impacted environment and disposition context.
|
||||
- Implement vulnerability detail with affected components, evidence pointers, exception linkage, and issuer/VEX context where applicable.
|
||||
|
||||
Completion criteria:
|
||||
- [ ] Vulnerabilities list and detail routes are implemented.
|
||||
- [ ] Required impacted-context fields are visible.
|
||||
- [ ] Links to findings, exceptions, and evidence are functional.
|
||||
- [ ] Placeholder-only legacy behavior is removed.
|
||||
|
||||
### S9-03 - Implement SBOM data surfaces and VEX/Exceptions integration
|
||||
Status: TODO
|
||||
Dependency: S9-01
|
||||
Owners: Frontend developer
|
||||
Task description:
|
||||
- Implement SBOM lake and SBOM graph placement within Security and Risk domain with decision-context links.
|
||||
- Implement VEX and exceptions pages with explicit links to trust, policy, and approval implications.
|
||||
|
||||
Completion criteria:
|
||||
- [ ] SBOM lake/graph pages are reachable within canonical security structure.
|
||||
- [ ] VEX and exceptions pages include decision-context links.
|
||||
- [ ] Trust consumer links align with Administration ownership policy.
|
||||
- [ ] Reachability remains second-class but visible in relevant views.
|
||||
|
||||
### S9-04 - Implement Advisory Sources screen and split ownership behavior
|
||||
Status: TODO
|
||||
Dependency: S9-02
|
||||
Owners: Frontend developer, Product engineer
|
||||
Task description:
|
||||
- Implement Advisory Sources according to signed S00 spec, including source health, decision-impact indicators, and drilldowns.
|
||||
- Enforce split behavior:
|
||||
- Integrations and Platform Ops own connectivity and mirror operations.
|
||||
- Security and Risk owns gating impact representation and policy relevance.
|
||||
|
||||
Completion criteria:
|
||||
- [ ] Advisory Sources route and screen are implemented per signed S00 spec.
|
||||
- [ ] Source health and decision-impact fields follow ownership matrix.
|
||||
- [ ] Drilldowns to Integrations and Platform Ops preserve context.
|
||||
- [ ] Conflict/stale/unavailable advisory states are explicitly handled.
|
||||
|
||||
### S9-05 - Security consolidation verification and ledger updates
|
||||
Status: TODO
|
||||
Dependency: S9-04
|
||||
Owners: Frontend developer, QA
|
||||
Task description:
|
||||
- Add targeted tests for all consolidated security routes and cross-domain links.
|
||||
- Update endpoint contract ledger rows for security and advisory-source dependencies.
|
||||
|
||||
Completion criteria:
|
||||
- [ ] Unit/E2E checks pass for risk/findings/vuln/SBOM/VEX/exceptions/advisory routes.
|
||||
- [ ] Cross-links to approvals/releases/env/evidence/ops are validated.
|
||||
- [ ] Contract-ledger rows updated with final status class and deltas.
|
||||
- [ ] Residual issues are recorded with owner and mitigation plan.
|
||||
|
||||
## Execution Log
|
||||
| Date (UTC) | Update | Owner |
|
||||
| --- | --- | --- |
|
||||
| 2026-02-18 | Sprint created for Security and Risk consolidation implementation. | Planning |
|
||||
|
||||
## Decisions & Risks
|
||||
- Decision binding: Security and Risk is decision-first; reachability remains visible as second-class context.
|
||||
- Risk: Advisory Sources can regress into mixed ownership; mitigate with strict field-level ownership contract from S00.
|
||||
- Risk: SBOM and vulnerability models may diverge in filters/labels; mitigate with shared taxonomy and filter-strip components.
|
||||
- Existing code references: `src/Web/StellaOps.Web/src/app/features/security/`, `src/Web/StellaOps.Web/src/app/core/api/`, `src/Web/StellaOps.Web/tests/e2e/`.
|
||||
|
||||
## Next Checkpoints
|
||||
- 2026-02-28: Core risk/findings/vuln review (`S9-01`, `S9-02`).
|
||||
- 2026-03-01: SBOM/VEX/Exceptions and Advisory Sources review (`S9-03`, `S9-04`).
|
||||
- 2026-03-02: Verification and ledger closure (`S9-05`).
|
||||
@@ -0,0 +1,115 @@
|
||||
# Sprint 20260218_015 - UI V2 Rewire Evidence and Audit Consolidation
|
||||
|
||||
## Topic & Scope
|
||||
- Implement consolidated Evidence and Audit domain centered on release, bundle, environment, and approval evidence retrieval.
|
||||
- Deliver evidence home router, evidence packs, bundles, export center, proof chains, replay/verify, and audit log surfaces.
|
||||
- Enforce trust ownership transition: Trust and Signing remains Administration-owned with Evidence as consumer.
|
||||
- Working directory: `src/Web/StellaOps.Web`.
|
||||
- Expected evidence: evidence route implementation, retrieval/export flows, audit navigation proofs, and contract-ledger updates.
|
||||
|
||||
## Dependencies & Concurrency
|
||||
- Upstream dependencies: `SPRINT_20260218_005_DOCS_ui_v2_rewire_spec_freeze.md`, `SPRINT_20260218_007_FE_ui_v2_rewire_administration_foundation.md`, `SPRINT_20260218_010_FE_ui_v2_rewire_releases_promotions_run_timeline.md`, `SPRINT_20260218_011_FE_ui_v2_rewire_approvals_decision_cockpit.md`.
|
||||
- Downstream dependencies: cutover and QA sprint `016`.
|
||||
- Safe parallelism:
|
||||
- `V10-01` and `V10-02` can run in parallel.
|
||||
- `V10-03` depends on `V10-01`.
|
||||
- `V10-04` depends on `V10-02`.
|
||||
- `V10-05` depends on `V10-03` and `V10-04`.
|
||||
|
||||
## Documentation Prerequisites
|
||||
- `docs/modules/ui/v2-rewire/source-of-truth.md`
|
||||
- `docs/modules/ui/v2-rewire/authority-matrix.md`
|
||||
- `docs/modules/ui/v2-rewire/pack-20.md`
|
||||
- `docs/modules/ui/v2-rewire/S00_trust_ownership_transition.md` (or equivalent signed output from sprint `20260218_005`)
|
||||
- `docs/modules/ui/v2-rewire/S00_endpoint_contract_ledger_v1.md`
|
||||
- `src/Web/StellaOps.Web/src/app/features/evidence/`
|
||||
- `src/Web/StellaOps.Web/src/app/features/evidence-export/`
|
||||
|
||||
## Delivery Tracker
|
||||
|
||||
### V10-01 - Implement evidence home router and navigation model
|
||||
Status: TODO
|
||||
Dependency: none
|
||||
Owners: Frontend developer
|
||||
Task description:
|
||||
- Implement Evidence home as router page that directs users by evidence need: promotion decision, bundle evidence, environment snapshot, proof verification, and audit trail.
|
||||
- Include clear entry actions to packs, bundles, exports, proof chains, replay, and audit log.
|
||||
|
||||
Completion criteria:
|
||||
- [ ] Evidence home route and page are implemented.
|
||||
- [ ] Router shortcuts map to canonical evidence surfaces.
|
||||
- [ ] Context keys for release/bundle/env/approval are preserved.
|
||||
- [ ] Empty/error states provide actionable next steps.
|
||||
|
||||
### V10-02 - Implement evidence packs, bundles, and detail pages
|
||||
Status: TODO
|
||||
Dependency: none
|
||||
Owners: Frontend developer
|
||||
Task description:
|
||||
- Implement evidence packs list/detail and evidence bundles list/detail pages.
|
||||
- Detail pages must include payload summary, evidence inventory, related decisions, and export actions.
|
||||
|
||||
Completion criteria:
|
||||
- [ ] Packs and bundles list/detail routes are implemented.
|
||||
- [ ] Detail pages show inventory and relation context.
|
||||
- [ ] Export and cross-link actions are functional.
|
||||
- [ ] Search/filter behavior is deterministic.
|
||||
|
||||
### V10-03 - Implement export center, proof chains, and replay/verify
|
||||
Status: TODO
|
||||
Dependency: V10-01
|
||||
Owners: Frontend developer
|
||||
Task description:
|
||||
- Implement export center with export jobs and scope templates.
|
||||
- Implement proof chains view and detail traversal.
|
||||
- Implement replay/verify surface with context-preserving entry from approvals and releases.
|
||||
|
||||
Completion criteria:
|
||||
- [ ] Export center, proof chains, and replay routes are implemented.
|
||||
- [ ] Context-preserving links from approvals/releases are functioning.
|
||||
- [ ] Job/status handling includes queued/running/failed/succeeded states.
|
||||
- [ ] Replay entry paths retain decision context identifiers.
|
||||
|
||||
### V10-04 - Implement consolidated audit log and trust consumer links
|
||||
Status: TODO
|
||||
Dependency: V10-02
|
||||
Owners: Frontend developer
|
||||
Task description:
|
||||
- Implement consolidated audit log view with filters for actor, action, resource type, and domain context.
|
||||
- Implement consumer links from evidence pages to Administration-owned Trust and Signing pages per transition policy.
|
||||
|
||||
Completion criteria:
|
||||
- [ ] Audit log route and filter model are implemented.
|
||||
- [ ] Audit entries deep-link to related evidence/release/approval entities.
|
||||
- [ ] Trust links follow Administration ownership without duplicate owner pages.
|
||||
- [ ] Legacy trust-in-evidence ownership labels are removed.
|
||||
|
||||
### V10-05 - Evidence consolidation verification and ledger updates
|
||||
Status: TODO
|
||||
Dependency: V10-04
|
||||
Owners: Frontend developer, QA
|
||||
Task description:
|
||||
- Add targeted tests for end-to-end evidence retrieval/export/replay/audit navigation.
|
||||
- Update endpoint contract ledger rows for evidence APIs and ownership boundaries.
|
||||
|
||||
Completion criteria:
|
||||
- [ ] Unit/E2E checks pass for evidence critical workflows.
|
||||
- [ ] Cross-domain links from approvals/releases/env remain intact.
|
||||
- [ ] Contract-ledger rows are updated and reviewed.
|
||||
- [ ] Residual risks and blockers are captured with mitigation owners.
|
||||
|
||||
## Execution Log
|
||||
| Date (UTC) | Update | Owner |
|
||||
| --- | --- | --- |
|
||||
| 2026-02-18 | Sprint created for Evidence and Audit consolidation implementation. | Planning |
|
||||
|
||||
## Decisions & Risks
|
||||
- Decision binding: Trust and Signing ownership remains in Administration; Evidence consumes trust state.
|
||||
- Risk: evidence context keys can drift between pages; mitigate with unified context identifier model.
|
||||
- Risk: export and replay status handling may diverge by endpoint; mitigate with shared status component and contract alignment.
|
||||
- Existing code references: `src/Web/StellaOps.Web/src/app/features/evidence/`, `src/Web/StellaOps.Web/src/app/features/evidence-export/`, `src/Web/StellaOps.Web/src/app/core/api/`.
|
||||
|
||||
## Next Checkpoints
|
||||
- 2026-03-01: Home router and packs/bundles review (`V10-01`, `V10-02`).
|
||||
- 2026-03-02: Export/proof/replay and audit/trust-link review (`V10-03`, `V10-04`).
|
||||
- 2026-03-03: Verification and ledger closure (`V10-05`).
|
||||
@@ -0,0 +1,118 @@
|
||||
# Sprint 20260218_016 - UI V2 Rewire Cutover Redirects and QA Readiness
|
||||
|
||||
## Topic & Scope
|
||||
- Execute final IA cutover for canonical routes and labels with migration-safe redirects and compatibility behavior.
|
||||
- Complete end-to-end QA coverage for all root domains and critical workflows under the finalized IA.
|
||||
- Deliver release-readiness evidence package with residual risk register and go/no-go checklist.
|
||||
- Working directory: `src/Web/StellaOps.Web`.
|
||||
- Expected evidence: final redirect map implementation, E2E verification artifacts, accessibility checks, readiness report.
|
||||
|
||||
## Dependencies & Concurrency
|
||||
- Upstream dependencies: `SPRINT_20260218_006_FE_ui_v2_rewire_navigation_shell_route_migration.md`, `SPRINT_20260218_007_FE_ui_v2_rewire_administration_foundation.md`, `SPRINT_20260218_008_FE_ui_v2_rewire_integrations_platform_ops_data_integrity.md`, `SPRINT_20260218_009_FE_ui_v2_rewire_bundle_organizer_lifecycle.md`, `SPRINT_20260218_010_FE_ui_v2_rewire_releases_promotions_run_timeline.md`, `SPRINT_20260218_011_FE_ui_v2_rewire_approvals_decision_cockpit.md`, `SPRINT_20260218_012_FE_ui_v2_rewire_dashboard_v3_mission_board.md`, `SPRINT_20260218_013_FE_ui_v2_rewire_environment_detail_standardization.md`, `SPRINT_20260218_014_FE_ui_v2_rewire_security_risk_consolidation.md`, `SPRINT_20260218_015_FE_ui_v2_rewire_evidence_audit_consolidation.md`.
|
||||
- Safe parallelism:
|
||||
- `C11-01` and `C11-02` can run in parallel.
|
||||
- `C11-03` depends on `C11-01`.
|
||||
- `C11-04` depends on `C11-02`.
|
||||
- `C11-05` depends on `C11-03` and `C11-04`.
|
||||
|
||||
## Documentation Prerequisites
|
||||
- `docs/modules/ui/v2-rewire/source-of-truth.md`
|
||||
- `docs/modules/ui/v2-rewire/authority-matrix.md`
|
||||
- `docs/modules/ui/v2-rewire/S00_route_deprecation_map.md` (or equivalent signed output from sprint `20260218_005`)
|
||||
- `docs/modules/ui/v2-rewire/S00_endpoint_contract_ledger_v1.md`
|
||||
- `src/Web/StellaOps.Web/src/app/routes/legacy-redirects.routes.ts`
|
||||
- `src/Web/StellaOps.Web/tests/e2e/`
|
||||
- `docs/qa/feature-checks/FLOW.md`
|
||||
|
||||
## Delivery Tracker
|
||||
|
||||
### C11-01 - Finalize redirect and alias cutover behavior
|
||||
Status: TODO
|
||||
Dependency: none
|
||||
Owners: Frontend developer
|
||||
Task description:
|
||||
- Apply final redirect/alias behavior from approved deprecation map for all legacy route families.
|
||||
- Remove temporary aliases marked remove-later where safe and maintain required compatibility aliases.
|
||||
- Verify query and fragment preservation for all retained redirects.
|
||||
|
||||
Completion criteria:
|
||||
- [ ] Redirect map implementation matches approved deprecation baseline.
|
||||
- [ ] Removed aliases are explicitly listed with rationale.
|
||||
- [ ] Preserved aliases are tested for query/fragment behavior.
|
||||
- [ ] No redirect loops remain.
|
||||
|
||||
### C11-02 - Apply final canonical labeling and breadcrumb cleanup
|
||||
Status: TODO
|
||||
Dependency: none
|
||||
Owners: Frontend developer, UX developer
|
||||
Task description:
|
||||
- Remove stale transition labels where migration window is complete and keep only required compatibility labels.
|
||||
- Ensure all root and child routes use canonical names in nav, headers, breadcrumbs, and search entries.
|
||||
|
||||
Completion criteria:
|
||||
- [ ] Canonical naming is consistent across all navigation surfaces.
|
||||
- [ ] Deprecated labels are removed or marked with explicit sunset policy.
|
||||
- [ ] Breadcrumb chains are accurate across all root domains.
|
||||
- [ ] Search and quick-nav entries align with canonical names.
|
||||
|
||||
### C11-03 - Execute critical-path E2E verification suite
|
||||
Status: TODO
|
||||
Dependency: C11-01
|
||||
Owners: QA, Frontend developer
|
||||
Task description:
|
||||
- Execute E2E verification for critical workflows:
|
||||
- dashboard to release to approval decision flow,
|
||||
- bundle to promotion to run timeline,
|
||||
- environment detail to security and evidence,
|
||||
- admin trust/policy/system cross-domain flows,
|
||||
- integrations and data-integrity stale/failure handling.
|
||||
|
||||
Completion criteria:
|
||||
- [ ] Critical-path E2E scenarios pass with evidence artifacts.
|
||||
- [ ] Failures are triaged with root cause and owner assignment.
|
||||
- [ ] No unresolved critical severity failures remain.
|
||||
- [ ] Verification records include command output and artifact paths.
|
||||
|
||||
### C11-04 - Execute accessibility and regression hardening checks
|
||||
Status: TODO
|
||||
Dependency: C11-02
|
||||
Owners: QA, Frontend developer
|
||||
Task description:
|
||||
- Run focused accessibility checks on nav, complex tables, tab systems, and action dialogs.
|
||||
- Run regression checks for permissions, mobile navigation, and high-latency/stale-data UI behavior.
|
||||
|
||||
Completion criteria:
|
||||
- [ ] Accessibility checks are run and documented for critical surfaces.
|
||||
- [ ] Keyboard and focus behavior is verified for nav and dialogs.
|
||||
- [ ] Mobile navigation and responsive behavior pass checks.
|
||||
- [ ] Regression issues are triaged with owner and priority.
|
||||
|
||||
### C11-05 - Publish release readiness package and go/no-go decision
|
||||
Status: TODO
|
||||
Dependency: C11-04
|
||||
Owners: Project Manager, QA lead
|
||||
Task description:
|
||||
- Publish final readiness package including route cutover summary, QA outcomes, contract-ledger status, and residual risks.
|
||||
- Produce go/no-go recommendation with explicit blocking conditions if unresolved.
|
||||
|
||||
Completion criteria:
|
||||
- [ ] Readiness package includes route, QA, and contract-ledger summaries.
|
||||
- [ ] Residual risks are clearly prioritized with mitigation owner.
|
||||
- [ ] Go/no-go recommendation is explicit and justified.
|
||||
- [ ] Sprint closure status reflects real outcome (`DONE` or `BLOCKED`).
|
||||
|
||||
## Execution Log
|
||||
| Date (UTC) | Update | Owner |
|
||||
| --- | --- | --- |
|
||||
| 2026-02-18 | Sprint created for final IA cutover, redirects, and QA readiness. | Planning |
|
||||
|
||||
## Decisions & Risks
|
||||
- Risk: removing aliases too early can break saved deep links; mitigate with explicit traffic/usage checks before removal.
|
||||
- Risk: final label cleanup can confuse users during transition; mitigate with controlled compatibility labels and communication.
|
||||
- Risk: cross-domain E2E suite may reveal latent contract gaps; mitigate with strict triage and no silent acceptance.
|
||||
- Existing code references: `src/Web/StellaOps.Web/src/app/routes/legacy-redirects.routes.ts`, `src/Web/StellaOps.Web/tests/e2e/`, `src/Web/StellaOps.Web/src/app/layout/`.
|
||||
|
||||
## Next Checkpoints
|
||||
- 2026-03-03: Redirect and labeling cutover review (`C11-01`, `C11-02`).
|
||||
- 2026-03-04: E2E and accessibility/regression review (`C11-03`, `C11-04`).
|
||||
- 2026-03-05: Readiness package and go/no-go decision (`C11-05`).
|
||||
Reference in New Issue
Block a user