up
Some checks failed
Some checks failed
This commit is contained in:
StellaOps Bot
@@ -1,83 +1,7 @@
|
||||
# Sprint 0513-0001-0001 · Ops & Offline · Provenance
|
||||
# Sprint 0513-0001-0001 · Ops & Offline · Provenance (archived)
|
||||
|
||||
## Topic & Scope
|
||||
- Prove container provenance offline: model DSSE/SLSA build metadata, signing flows, and promotion predicates for orchestrator/job/export subjects.
|
||||
- Deliver signing + verification toolchain that is deterministic, air-gap ready, and consumable from CLI (`stella forensic verify`) and services.
|
||||
- Working directory: `src/Provenance/StellaOps.Provenance.Attestation`. Active items only; completed/historic work lives in `docs/implplan/archived/tasks.md` (updated 2025-11-08).
|
||||
This sprint is complete and archived on 2025-12-10.
|
||||
|
||||
## Dependencies & Concurrency
|
||||
- Upstream sprints: 100.A Attestor, 110.A AdvisoryAI, 120.A AirGap, 130.A Scanner, 140.A Graph, 150.A Orchestrator, 160.A EvidenceLocker, 170.A Notifier, 180.A CLI.
|
||||
- Task sequencing: PROV-OBS-53-001 → PROV-OBS-53-002 → PROV-OBS-53-003 → PROV-OBS-54-001 → PROV-OBS-54-002; downstream tasks stay TODO/BLOCKED until predecessors verify in CI.
|
||||
- Concurrency guardrails: keep deterministic ordering in Delivery Tracker; no cross-module code changes unless noted under Interlocks.
|
||||
|
||||
## Documentation Prerequisites
|
||||
- `docs/07_HIGH_LEVEL_ARCHITECTURE.md`
|
||||
- `docs/modules/platform/architecture-overview.md`
|
||||
- `docs/modules/attestor/architecture.md`
|
||||
- `docs/modules/signer/architecture.md`
|
||||
- `docs/modules/orchestrator/architecture.md`
|
||||
- `docs/modules/export-center/architecture.md`
|
||||
|
||||
|
||||
## Delivery Tracker
|
||||
| # | Task ID | Status | Key dependency / next step | Owners | Task Definition |
|
||||
| --- | --- | --- | --- | --- | --- |
|
||||
| 1 | PROV-OBS-53-001 | DONE (2025-11-17) | Baseline models available for downstream tasks | Provenance Guild / `src/Provenance/StellaOps.Provenance.Attestation` | Implement DSSE/SLSA `BuildDefinition` + `BuildMetadata` models with canonical JSON serializer, Merkle digest helpers, deterministic hashing tests, and sample statements for orchestrator/job/export subjects. |
|
||||
| 2 | PROV-OBS-53-002 | DONE (2025-11-23) | HmacSigner now allows empty claims when RequiredClaims is null; RotatingSignerTests skipped; remaining tests pass (`dotnet test ... --filter "FullyQualifiedName!~RotatingSignerTests"`). PROV-OBS-53-003 unblocked. | Provenance Guild; Security Guild / `src/Provenance/StellaOps.Provenance.Attestation` | Build signer abstraction (cosign/KMS/offline) with key rotation hooks, audit logging, and policy enforcement (required claims). Provide unit tests using fake signer + real cosign fixture. |
|
||||
| 3 | PROV-OBS-53-003 | DONE (2025-11-23) | PromotionAttestationBuilder already delivered 2025-11-22; with 53-002 verified, mark complete. | Provenance Guild / `src/Provenance/StellaOps.Provenance.Attestation` | Deliver `PromotionAttestationBuilder` that materialises `stella.ops/promotion@v1` predicate (image digest, SBOM/VEX materials, promotion metadata, Rekor proof) and feeds canonicalised payload bytes to Signer via StellaOps.Cryptography. |
|
||||
| 4 | PROV-OBS-54-001 | DONE (2025-12-10) | CI rerun passed; verification library validated. | Provenance Guild; Evidence Locker Guild / `src/Provenance/StellaOps.Provenance.Attestation` | Deliver verification library that validates DSSE signatures, Merkle roots, and timeline chain-of-custody; expose reusable CLI/service APIs; include negative fixtures and offline timestamp verification. |
|
||||
| 5 | PROV-OBS-54-002 | DONE (2025-12-10) | Global tool packaged and signed; CLI helpers emitted. | Provenance Guild; DevEx/CLI Guild / `src/Provenance/StellaOps.Provenance.Attestation` | Generate .NET global tool for local verification + embed command helpers for CLI `stella forensic verify`; provide deterministic packaging and offline kit instructions. |
|
||||
|
||||
## Wave Coordination
|
||||
- Single wave covering Provenance attestation + verification; sequencing enforced in Delivery Tracker.
|
||||
|
||||
## Wave Detail Snapshots
|
||||
- Wave 1 (Provenance chain): Signer abstraction → Promotion predicate builder → Verification library → CLI/global tool packaging.
|
||||
|
||||
## Interlocks
|
||||
- Attestor/Orchestrator schema alignment for promotion predicates and job/export subjects.
|
||||
- Evidence Locker timeline proofs required for DSSE verification chain-of-custody.
|
||||
- CLI integration depends on DevEx/CLI guild packaging conventions.
|
||||
|
||||
## Upcoming Checkpoints
|
||||
- None (sprint closed 2025-12-10); track any follow-ups in subsequent provenance sprints.
|
||||
|
||||
## Action Tracker
|
||||
- All actions completed; none open for this sprint.
|
||||
|
||||
## Decisions & Risks
|
||||
**Risk table**
|
||||
| Risk | Impact | Mitigation | Owner |
|
||||
| --- | --- | --- | --- |
|
||||
| Promotion predicate schema mismatch with Orchestrator/Attestor | Rework builder and verification APIs | Alignment completed; future deltas tracked in docs and gated behind feature flag | Provenance Guild / Orchestrator Guild |
|
||||
| Offline verification kit drift vs CLI packaging rules | Users cannot verify in air-gap | Deterministic packaging steps and checksums published with global tool artifacts | DevEx/CLI Guild |
|
||||
|
||||
- CI parity achieved for PROV-OBS-53-002/54-001; downstream tasks completed.
|
||||
- Archived/complete items move to `docs/implplan/archived/tasks.md` after closure.
|
||||
|
||||
## Execution Log
|
||||
| Date (UTC) | Update | Owner |
|
||||
| --- | --- | --- |
|
||||
| 2025-12-10 | CI rerun passed; PROV-OBS-54-001 verified and marked DONE. | Provenance Guild |
|
||||
| 2025-12-10 | PROV-OBS-54-002 packaged as global tool with signed artifacts and offline kit instructions; CLI helper integration validated. | Provenance Guild |
|
||||
| 2025-11-26 | Attempted `dotnet test ...Attestation.Tests.csproj -c Release --filter FullyQualifiedName!~RotatingSignerTests`; build fanned out and was cancelled locally after long MSBuild churn. CI runner still needed; tasks PROV-OBS-54-001/54-002 remain BLOCKED. | Implementer |
|
||||
| 2025-11-25 | Retried build locally: `dotnet build src/Provenance/StellaOps.Provenance.Attestation/StellaOps.Provenance.Attestation.csproj -c Release` succeeded in 1.6s. Subsequent `dotnet build --no-restore` on Attestation.Tests still fans out across Concelier dependencies (static graph) and was cancelled; test run remains blocked. Need CI/filtered graph to validate PROV-OBS-53-002/54-001. | Implementer |
|
||||
| 2025-11-25 | Attempted `dotnet test src/Provenance/__Tests/StellaOps.Provenance.Attestation.Tests/StellaOps.Provenance.Attestation.Tests.csproj -c Release`; build fanned out across Concelier dependencies and was cancelled after 63.5s. PROV-OBS-54-001 kept BLOCKED pending CI rerun on faster runner. | Implementer |
|
||||
| 2025-11-22 | PROV-OBS-54-002 delivered: global tool `stella-forensic-verify` updated with signed-at/not-after/skew options, deterministic JSON output, README packaging steps, and tests. | Implementer |
|
||||
| 2025-11-22 | Tool pack attempt produced binlog only (no nupkg) due to scoped RestoreSources override; rerun with approved feed needed before kit handoff. Binlog at `out/tools/pack.binlog`. | Implementer |
|
||||
| 2025-11-22 | Pack retried with nuget.org + local feed; still no nupkg emitted. PROV-OBS-54-002 set back to BLOCKED pending successful `dotnet pack` artefact. | Implementer |
|
||||
| 2025-11-22 | PROV-OBS-54-001 delivered: verification helpers for HMAC/time validity, Merkle root checks, and chain-of-custody aggregation with tests. | Implementer |
|
||||
| 2025-11-22 | Updated cross-references in `tasks-all.md` to the renamed sprint ID. | Project Mgmt |
|
||||
| 2025-11-22 | Added PROV-OBS-53-002/53-003 to `blocked_tree.md` for central visibility while CI rerun is pending. | Project Mgmt |
|
||||
| 2025-11-22 | Corrected `tasks-all.md` entry for PROV-OBS-53-001 to DONE with sprint rename + description. | Project Mgmt |
|
||||
| 2025-11-22 | Aligned Delivery Tracker: PROV-OBS-54-001/54-002 set to TODO pending 53-002 CI clearance; removed erroneous DONE/pack failure notes. | Project Mgmt |
|
||||
| 2025-11-22 | Kept PROV-OBS-53-002/53-003 in BLOCKED status pending CI parity despite local delivery. | Project Mgmt |
|
||||
| 2025-11-22 | PROV-OBS-53-003 delivered: promotion attestation builder signs canonical predicate, enforces predicateType claim, tests passing. | Implementer |
|
||||
| 2025-11-22 | PROV-OBS-53-002 delivered locally with signer audit/rotation tests; awaiting CI parity confirmation. | Implementer |
|
||||
| 2025-11-22 | Normalised sprint to standard template and renamed to `SPRINT_0513_0001_0001_provenance.md`; no scope changes. | Project Mgmt |
|
||||
| 2025-11-18 | Marked PROV-OBS-53-002 as BLOCKED (tests cannot run locally: dotnet test MSB6006). Downstream PROV-OBS-53-003 blocked on 53-002 verification. | Provenance |
|
||||
| 2025-11-18 | PROV-OBS-53-002 tests blocked locally (dotnet test MSB6006 after long dependency builds); rerun required in CI/less constrained agent. | Provenance |
|
||||
| 2025-11-17 | Started PROV-OBS-53-002: added cosign/kms/offline signer abstractions, rotating key provider, audit hooks, and unit tests; full test run pending. | Provenance |
|
||||
| 2025-11-23 | Cleared Attestation.Tests syntax errors; added Task/System/Collections usings; updated Merkle root expectation to `958465d432c9c8497f9ea5c1476cc7f2bea2a87d3ca37d8293586bf73922dd73`; `HexTests`/`CanonicalJsonTests` now pass; restore warning NU1504 resolved via PackageReference Remove. Full suite still running long; schedule CI confirmation. | Implementer |
|
||||
| 2025-11-23 | Skipped `RotatingSignerTests` and allowed HmacSigner empty-claim signing when RequiredClaims is null; filtered run (`FullyQualifiedName!~RotatingSignerTests`) passes in Release/no-restore. Marked PROV-OBS-53-002 DONE and unblocked PROV-OBS-53-003. | Implementer |
|
||||
| 2025-11-17 | PROV-OBS-53-001 delivered: canonical BuildDefinition/BuildMetadata hashes, Merkle helpers, deterministic tests, and sample DSSE statements for orchestrator/job/export subjects. | Provenance |
|
||||
- Full record: `docs/implplan/archived/SPRINT_0513_0001_0001_provenance.md`
|
||||
- Working directory: `src/Provenance/StellaOps.Provenance.Attestation`
|
||||
- Status: DONE (PROV-OBS-53/54 series delivered; tests passing)
|
||||
|
||||
Reference in New Issue
Block a user