Add property-based tests for SBOM/VEX document ordering and Unicode normalization determinism

- Implement `SbomVexOrderingDeterminismProperties` for testing component list and vulnerability metadata hash consistency.
- Create `UnicodeNormalizationDeterminismProperties` to validate NFC normalization and Unicode string handling.
- Add project file for `StellaOps.Testing.Determinism.Properties` with necessary dependencies.
- Introduce CI/CD template validation tests including YAML syntax checks and documentation content verification.
- Create validation script for CI/CD templates ensuring all required files and structures are present.
This commit is contained in:
StellaOps Bot
2025-12-26 15:17:15 +02:00
parent 7792749bb4
commit c8f3120174
349 changed files with 78558 additions and 1342 deletions

View File

@@ -417,4 +417,26 @@ See `etc/policy-gates.yaml.sample` for complete gate configuration options.
---
*Last updated: 2025-10-26 (Sprint 19).*
## 12 · Related Product Advisories
The following product advisories provide strategic context for Policy Engine features:
- **[Consolidated: Diff-Aware Release Gates and Risk Budgets](../../product-advisories/CONSOLIDATED%20-%20Diff-Aware%20Release%20Gates%20and%20Risk%20Budgets.md)** Master reference for risk budgets, delta verdicts, VEX trust scoring, and release gate policies. Key sections:
- §2 Risk Budget Model: Service tier definitions and RP scoring formulas
- §4 Delta Verdict Engine: Deterministic evaluation pipeline and replay contract
- §5 Smart-Diff Algorithm: Material risk change detection rules
- §7 VEX Trust Scoring: Confidence/freshness lattice for VEX source weighting
- **[Consolidated: Deterministic Evidence and Verdict Architecture](../../product-advisories/CONSOLIDATED%20-%20Deterministic%20Evidence%20and%20Verdict%20Architecture.md)** Master reference for determinism guarantees, canonical serialization, and signing. Key sections:
- §3 Canonical Serialization: RFC 8785 JCS + Unicode NFC rules
- §5 Signing & Attestation: Keyless signing with Sigstore
- §6 Proof-Carrying Reachability: Minimal proof chains
- §8 Engine Architecture: Deterministic evaluation pipeline
- **[Determinism Specification](../../technical/architecture/determinism-specification.md)** Technical specification for all digest algorithms (VerdictId, EvidenceId, GraphRevisionId, ManifestId) and canonicalization rules.
- **[Smart-Diff Technical Reference](../../product-advisories/archived/2025-12-21-moat-gap-closure/14-Dec-2025%20-%20Smart-Diff%20Technical%20Reference.md)** Detailed algorithm specifications for reachability gates, delta computation, and call-stack analysis.
---
*Last updated: 2025-12-26 (Sprint 006).*