From cef4cb2c5a2d29b5b40a4a25cd7f8426c8c5dd4f Mon Sep 17 00:00:00 2001
From: master <>
Date: Sun, 9 Nov 2025 21:59:57 +0200
Subject: [PATCH] =?UTF-8?q?Add=20support=20for=20=D0=93=D0=9E=D0=A1=D0=A2?=
=?UTF-8?q?=20=D0=A0=2034.10=20digital=20signatures?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
- Implemented the GostKeyValue class for handling public key parameters in ГОСТ Р 34.10 digital signatures.
- Created the GostSignedXml class to manage XML signatures using ГОСТ 34.10, including methods for computing and checking signatures.
- Developed the GostSignedXmlImpl class to encapsulate the signature computation logic and public key retrieval.
- Added specific key value classes for ГОСТ Р 34.10-2001, ГОСТ Р 34.10-2012/256, and ГОСТ Р 34.10-2012/512 to support different signature algorithms.
- Ensured compatibility with existing XML signature standards while integrating ГОСТ cryptography.
---
Directory.Build.props | 35 +-
docs/11_AUTHORITY.md | 1 +
docs/19_TEST_SUITE_OVERVIEW.md | 9 +-
.../31_AUTHORITY_PLUGIN_DEVELOPER_GUIDE.md | 2 +
.../implplan/SPRINT_110_ingestion_evidence.md | 2 +-
docs/implplan/SPRINT_111_advisoryai.md | 3 +-
docs/implplan/SPRINT_112_concelier_i.md | 28 +-
docs/implplan/SPRINT_113_concelier_ii.md | 32 +-
docs/implplan/SPRINT_114_concelier_iii.md | 30 +-
docs/implplan/SPRINT_115_concelier_iv.md | 28 +-
docs/implplan/SPRINT_116_concelier_v.md | 32 +-
docs/implplan/SPRINT_117_concelier_vi.md | 19 +-
docs/implplan/SPRINT_118_concelier_vii.md | 9 -
docs/implplan/SPRINT_119_excititor_i.md | 28 +-
docs/implplan/SPRINT_120_excititor_ii.md | 6 +-
docs/implplan/SPRINT_121_excititor_iii.md | 23 +-
docs/implplan/SPRINT_122_excititor_iv.md | 25 +-
docs/implplan/SPRINT_123_excititor_v.md | 25 +-
docs/implplan/SPRINT_124_excititor_vi.md | 19 +-
docs/implplan/SPRINT_125_mirror.md | 2 +-
docs/implplan/SPRINT_136_scanner_surface.md | 4 +
docs/implplan/SPRINT_140_runtime_signals.md | 2 +-
docs/implplan/SPRINT_141_graph.md | 2 +-
docs/implplan/SPRINT_142_sbomservice.md | 2 +-
docs/implplan/SPRINT_143_signals.md | 2 +-
docs/implplan/SPRINT_144_zastava.md | 2 +-
.../SPRINT_150_scheduling_automation.md | 2 +-
docs/implplan/SPRINT_151_orchestrator_i.md | 2 +-
docs/implplan/SPRINT_152_orchestrator_ii.md | 2 +-
docs/implplan/SPRINT_153_orchestrator_iii.md | 2 +-
docs/implplan/SPRINT_154_packsregistry.md | 2 +-
docs/implplan/SPRINT_155_scheduler_i.md | 2 +-
docs/implplan/SPRINT_156_scheduler_ii.md | 2 +-
docs/implplan/SPRINT_157_taskrunner_i.md | 2 +-
docs/implplan/SPRINT_158_taskrunner_ii.md | 2 +-
docs/implplan/SPRINT_160_export_evidence.md | 2 +-
docs/implplan/SPRINT_161_evidencelocker.md | 2 +-
docs/implplan/SPRINT_162_exportcenter_i.md | 2 +-
docs/implplan/SPRINT_163_exportcenter_ii.md | 2 +-
docs/implplan/SPRINT_164_exportcenter_iii.md | 2 +-
docs/implplan/SPRINT_165_timelineindexer.md | 2 +-
.../SPRINT_170_notifications_telemetry.md | 2 +-
docs/implplan/SPRINT_171_notifier_i.md | 2 +-
docs/implplan/SPRINT_172_notifier_ii.md | 2 +-
docs/implplan/SPRINT_173_notifier_iii.md | 2 +-
docs/implplan/SPRINT_174_telemetry.md | 2 +-
docs/implplan/SPRINT_200_experience_sdks.md | 2 +-
docs/implplan/SPRINT_201_cli_i.md | 2 +-
docs/implplan/SPRINT_202_cli_ii.md | 2 +-
docs/implplan/SPRINT_203_cli_iii.md | 6 +-
docs/implplan/SPRINT_204_cli_iv.md | 2 +-
docs/implplan/SPRINT_205_cli_v.md | 2 +-
docs/implplan/SPRINT_206_devportal.md | 2 +-
docs/implplan/SPRINT_207_graph.md | 2 +-
docs/implplan/SPRINT_208_sdk.md | 2 +-
docs/implplan/SPRINT_209_ui_i.md | 6 +-
docs/implplan/SPRINT_210_ui_ii.md | 2 +-
docs/implplan/SPRINT_211_ui_iii.md | 2 +-
docs/implplan/SPRINT_212_web_i.md | 2 +-
docs/implplan/SPRINT_213_web_ii.md | 2 +-
docs/implplan/SPRINT_214_web_iii.md | 2 +-
docs/implplan/SPRINT_215_web_iv.md | 2 +-
docs/implplan/SPRINT_216_web_v.md | 2 +-
.../SPRINT_300_documentation_process.md | 2 +-
docs/implplan/SPRINT_301_docs_tasks_md_i.md | 7 +-
docs/implplan/SPRINT_302_docs_tasks_md_ii.md | 2 +-
docs/implplan/SPRINT_303_docs_tasks_md_iii.md | 2 +-
docs/implplan/SPRINT_304_docs_tasks_md_iv.md | 2 +-
docs/implplan/SPRINT_305_docs_tasks_md_v.md | 2 +-
docs/implplan/SPRINT_306_docs_tasks_md_vi.md | 2 +-
docs/implplan/SPRINT_307_docs_tasks_md_vii.md | 2 +-
.../implplan/SPRINT_308_docs_tasks_md_viii.md | 2 +-
docs/implplan/SPRINT_309_docs_tasks_md_ix.md | 2 +-
docs/implplan/SPRINT_310_docs_tasks_md_x.md | 2 +-
docs/implplan/SPRINT_311_docs_tasks_md_xi.md | 2 +-
.../SPRINT_312_docs_modules_advisory_ai.md | 2 +-
.../SPRINT_313_docs_modules_attestor.md | 2 +-
.../SPRINT_314_docs_modules_authority.md | 2 +-
docs/implplan/SPRINT_315_docs_modules_ci.md | 2 +-
docs/implplan/SPRINT_316_docs_modules_cli.md | 2 +-
.../SPRINT_317_docs_modules_concelier.md | 2 +-
.../SPRINT_318_docs_modules_devops.md | 2 +-
.../SPRINT_319_docs_modules_excititor.md | 2 +-
.../SPRINT_320_docs_modules_export_center.md | 2 +-
.../implplan/SPRINT_321_docs_modules_graph.md | 2 +-
.../SPRINT_322_docs_modules_notify.md | 2 +-
.../SPRINT_323_docs_modules_orchestrator.md | 2 +-
.../SPRINT_324_docs_modules_platform.md | 2 +-
.../SPRINT_325_docs_modules_policy.md | 2 +-
.../SPRINT_326_docs_modules_registry.md | 2 +-
.../SPRINT_327_docs_modules_scanner.md | 2 +-
.../SPRINT_328_docs_modules_scheduler.md | 2 +-
.../SPRINT_329_docs_modules_signer.md | 2 +-
.../SPRINT_330_docs_modules_telemetry.md | 2 +-
docs/implplan/SPRINT_331_docs_modules_ui.md | 2 +-
.../SPRINT_332_docs_modules_vex_lens.md | 2 +-
.../SPRINT_333_docs_modules_excititor.md | 2 +-
.../SPRINT_334_docs_modules_vuln_explorer.md | 2 +-
.../SPRINT_335_docs_modules_zastava.md | 2 +-
...00_runtime_facts_static_callgraph_union.md | 4 +-
.../SPRINT_401_reachability_evidence_chain.md | 5 +-
docs/implplan/SPRINT_500_ops_offline.md | 2 +-
docs/implplan/SPRINT_501_ops_deployment_i.md | 2 +-
docs/implplan/SPRINT_502_ops_deployment_ii.md | 2 +-
docs/implplan/SPRINT_503_ops_devops_i.md | 2 +-
docs/implplan/SPRINT_504_ops_devops_ii.md | 2 +-
docs/implplan/SPRINT_505_ops_devops_iii.md | 2 +-
docs/implplan/SPRINT_506_ops_devops_iv.md | 2 +-
docs/implplan/SPRINT_507_ops_devops_v.md | 2 +-
docs/implplan/SPRINT_508_ops_offline_kit.md | 2 +-
docs/implplan/SPRINT_509_samples.md | 2 +-
docs/implplan/SPRINT_510_airgap.md | 2 +-
docs/implplan/SPRINT_511_api.md | 2 +-
docs/implplan/SPRINT_512_bench.md | 2 +-
docs/implplan/SPRINT_513_provenance.md | 2 +-
.../SPRINT_514_sovereign_crypto_enablement.md | 18 +-
.../SPRINT_100_identity_signing.md | 9 +-
.../tasks.md} | 2 +
docs/modules/advisory-ai/architecture.md | 268 ++--
docs/modules/authority/architecture.md | 1 +
docs/modules/cli/guides/packs-profiles.md | 2 +
docs/modules/excititor/README.md | 1 +
.../excititor/operations/ubuntu-csaf.md | 66 +
.../scanner/deterministic-sbom-compose.md | 66 +
docs/modules/vex-lens/README.md | 7 +
docs/modules/vex-lens/architecture.md | 20 +-
docs/modules/vex-lens/implementation_plan.md | 4 +-
docs/reachability/DELIVERY_GUIDE.md | 3 +-
docs/reachability/REACHABILITY_GAP_TASKS.md | 49 +
docs/rfcs/authority-plugin-ldap.md | 2 +-
.../crypto-routing-audit-2025-11-07.md | 29 +-
docs/security/pack-signing-and-rbac.md | 3 +-
docs/security/rootpack_ru_package.md | 17 +-
docs/security/rootpack_ru_validation.md | 12 +-
docs/task-packs/authoring-guide.md | 2 +-
docs/task-packs/runbook.md | 3 +-
docs/task-packs/spec.md | 3 +-
docs/vex/consensus-json.md | 18 +
etc/authority.plugins/ldap.yaml | 16 +
etc/authority.yaml.sample | 1 +
etc/rootpack/ru/crypto.profile.yaml | 9 +
head.tmp | 0
src/AdvisoryAI/StellaOps.AdvisoryAI/TASKS.md | 8 -
.../AdvisoryGuardrailInjectionTests.cs | 187 ++-
.../AdvisoryPipelineOrchestratorTests.cs | 3 +-
.../AdvisoryPlanCacheTests.cs | 67 +-
.../FileSystemAdvisoryOutputStoreTests.cs | 106 ++
.../FileSystemAdvisoryPlanCacheTests.cs | 126 ++
.../TestData/guardrail-injection-cases.json | 22 +-
.../DeterministicTimeProvider.cs | 27 +
.../TestUtilities/TempDirectory.cs | 51 +
.../StellaOpsClaimTypes.cs | 15 +
.../StellaOps.Auth.Client.csproj | 2 +-
...StellaOpsScopeAuthorizationHandlerTests.cs | 105 ++
.../StellaOpsScopeAuthorizationHandler.cs | 252 ++-
.../LdapCapabilityProbeTests.cs | 69 +
.../Credentials/LdapCredentialStoreTests.cs | 157 +-
...ellaOps.Authority.Plugin.Ldap.Tests.csproj | 8 +-
.../ClientProvisioning/LdapCapabilityProbe.cs | 159 ++
.../Credentials/LdapCredentialStore.cs | 167 ++
.../LdapIdentityProviderPlugin.cs | 76 +-
.../LdapPluginRegistrar.cs | 4 +-
.../OpenIddict/PasswordGrantHandlersTests.cs | 70 +-
.../AuthorityOpenIddictConstants.cs | 6 +
.../Handlers/PasswordGrantHandlers.cs | 136 ++
.../OpenIddict/TokenRequestTamperInspector.cs | 3 +
src/Cli/StellaOps.Cli/StellaOps.Cli.csproj | 5 +-
.../Diagnostics/AdvisoryAiMetrics.cs | 55 +
.../Options/ConcelierOptions.cs | 2 +
.../Options/ConcelierOptionsValidator.cs | 5 +
.../StellaOps.Concelier.WebService/Program.cs | 65 +-
.../Services/AdvisoryAiTelemetry.cs | 128 ++
.../Services/AdvisoryChunkBuilder.cs | 73 +-
.../Services/AdvisoryChunkCache.cs | 109 ++
.../WebServiceEndpointsTests.cs | 95 +-
.../RancherHubConnector.cs | 195 ++-
.../Configuration/UbuntuConnectorOptions.cs | 86 +-
.../UbuntuCsafConnector.cs | 149 +-
.../Connectors/RancherHubConnectorTests.cs | 57 +-
.../Connectors/UbuntuCsafConnectorTests.cs | 135 +-
src/Tools/StellaOps.CryptoRu.Cli/Program.cs | 245 +++
.../StellaOps.CryptoRu.Cli.csproj | 22 +
.../StellaOps.Configuration.csproj | 5 +-
.../StellaOpsCryptoOptions.cs | 7 +-
...llaOpsCryptoServiceCollectionExtensions.cs | 8 +-
.../CryptoServiceCollectionExtensions.cs | 22 +-
...ps.Cryptography.DependencyInjection.csproj | 38 +-
.../StellaOpsCryptoOptions.cs | 9 +-
.../CryptoProCertificateResolver.cs | 2 +-
...ptoProCryptoServiceCollectionExtensions.cs | 6 +-
.../CryptoProGostCryptoProvider.cs | 6 +-
.../CryptoProGostKeyEntry.cs | 12 +-
.../CryptoProGostKeyOptions.cs | 14 +-
.../CryptoProGostSigner.cs | 108 +-
.../Properties/AssemblyInfo.cs | 3 +
...laOps.Cryptography.Plugin.CryptoPro.csproj | 3 +-
...penSslCryptoServiceCollectionExtensions.cs | 25 +
.../OpenSslGostKeyEntry.cs | 40 +
.../OpenSslGostKeyOptions.cs | 29 +
.../OpenSslGostProvider.cs | 136 ++
.../OpenSslGostProviderOptions.cs | 10 +
.../OpenSslGostSigner.cs | 108 ++
.../OpenSslPemLoader.cs | 73 +
.../Properties/AssemblyInfo.cs | 3 +
...Ops.Cryptography.Plugin.OpenSslGost.csproj | 17 +
.../GostSignatureEncoding.cs | 126 ++
.../GostSignatureFormat.cs | 13 +
.../StellaOps.Cryptography/TASKS.md | 11 -
.../CryptoProGostSignerTests.cs | 41 +
.../GostSignatureEncodingTests.cs | 42 +
.../OpenSslGostSignerTests.cs | 50 +
.../StellaOps.Cryptography.Tests.csproj | 6 +-
.../forks/AlexMAS.GostCryptography/.gitignore | 211 +++
.../GostCryptography.sln | 31 +
.../GostCryptography.sln.DotSettings | 236 +++
.../forks/AlexMAS.GostCryptography/LICENSE | 22 +
.../forks/AlexMAS.GostCryptography/README.md | 51 +
.../AlexMAS.GostCryptography/STELLA_NOTES.md | 15 +
.../Data/EncryptedXmlExample.xml | 15 +
.../Data/SignedXmlExample.xml | 6 +
.../Data/SmevExample.xml | 53 +
.../GostCryptography.Tests.csproj | 37 +
.../EncryptDecryptSessionKeyTest.cs | 103 ++
.../Gost_28147_89_ImitHashAlgorithmTest.cs | 83 +
.../Gost_28147_89_SymmetricAlgorithmTest.cs | 77 +
.../KuznyechikEncryptDecryptSessionKeyTest.cs | 103 ++
.../KuznyechikImitHashAlgorithmTest.cs | 83 +
.../KuznyechikSymmetricAlgorithmTest.cs | 77 +
.../MagmaEncryptDecryptSessionKeyTest.cs | 103 ++
.../MagmaImitHashAlgorithmTest.cs | 83 +
.../MagmaSymmetricAlgorithmTest.cs | 77 +
.../Gost_R3410/SetContainerPasswordTest.cs | 129 ++
.../Gost_R3411_2012_256_HMACTest.cs | 84 +
.../Gost_R3411_2012_256_HashAlgorithmTest.cs | 48 +
.../Gost_R3411/Gost_R3411_2012_256_PRFTest.cs | 120 ++
.../Gost_R3411_2012_512_HMACTest.cs | 84 +
.../Gost_R3411_2012_512_HashAlgorithmTest.cs | 48 +
.../Gost_R3411/Gost_R3411_2012_512_PRFTest.cs | 120 ++
.../Gost_R3411/Gost_R3411_94_HMACTest.cs | 84 +
.../Gost_R3411_94_HashAlgorithmTest.cs | 48 +
.../Gost_R3411/Gost_R3411_94_PRFTest.cs | 114 ++
.../Pkcs/EnvelopedCmsEncryptTest.cs | 71 +
.../Pkcs/SignedCmsDetachedSignTest.cs | 83 +
.../SignedCmsSignAndExcludeCertificates.cs | 90 ++
.../Pkcs/SignedCmsSignTest.cs | 83 +
.../Properties/Resources.Designer.cs | 118 ++
.../Properties/Resources.resx | 130 ++
.../Sign/SignDataStreamCertificateTest.cs | 74 +
.../SignDataStreamSignatureDescriptionTest.cs | 88 ++
.../SignDataStreamSignatureFormatterTest.cs | 80 +
.../TestCertificateInfo.cs | 21 +
.../GostCryptography.Tests/TestConfig.cs | 79 +
.../Xml/Encrypt/EncryptedXmlBroadcastTest.cs | 211 +++
.../Encrypt/EncryptedXmlCertificateTest.cs | 80 +
.../Encrypt/EncryptedXmlKeyContainerTest.cs | 193 +++
.../Xml/Encrypt/EncryptedXmlSessionKey.cs | 113 ++
.../Xml/Encrypt/EncryptedXmlSharedKeyTest.cs | 107 ++
.../KuznyechikEncryptedXmlCertificateTest.cs | 94 ++
.../MagmaEncryptedXmlCertificateTest.cs | 94 ++
.../Xml/Sign/SignedXmlCertificateTest.cs | 102 ++
.../Xml/Sign/SignedXmlDocumentTest.cs | 105 ++
.../Xml/Sign/SignedXmlKeyContainerTest.cs | 140 ++
.../Xml/Sign/SignedXmlSmevTest.cs | 154 ++
.../Xml/Sign/SignedXmlTransformTest.cs | 131 ++
.../Asn1/Ber/Asn18BitCharString.cs | 21 +
.../Asn1/Ber/Asn1BerDecodeBuffer.cs | 401 +++++
.../Asn1/Ber/Asn1BerDecodeContext.cs | 72 +
.../Asn1/Ber/Asn1BerEncodeBuffer.cs | 305 ++++
.../Asn1/Ber/Asn1BerInputStream.cs | 41 +
.../Asn1/Ber/Asn1BerMessageDumpHandler.cs | 135 ++
.../Asn1/Ber/Asn1BerOutputStream.cs | 277 ++++
.../Asn1/Ber/Asn1BigInteger.cs | 137 ++
.../Asn1/Ber/Asn1BitString.cs | 455 ++++++
.../Asn1/Ber/Asn1BmpString.cs | 125 ++
.../GostCryptography/Asn1/Ber/Asn1Boolean.cs | 102 ++
.../Asn1/Ber/Asn1CerInputStream.cs | 12 +
.../Asn1/Ber/Asn1CerOutputStream.cs | 236 +++
.../Asn1/Ber/Asn1CharRange.cs | 46 +
.../GostCryptography/Asn1/Ber/Asn1CharSet.cs | 35 +
.../Asn1/Ber/Asn1CharString.cs | 156 ++
.../GostCryptography/Asn1/Ber/Asn1Choice.cs | 55 +
.../Asn1/Ber/Asn1ChoiceExt.cs | 23 +
.../Asn1/Ber/Asn1DecodeBuffer.cs | 326 ++++
.../Asn1/Ber/Asn1DerDecodeBuffer.cs | 17 +
.../Asn1/Ber/Asn1DerEncodeBuffer.cs | 16 +
.../Asn1/Ber/Asn1DerInputStream.cs | 42 +
.../Asn1/Ber/Asn1DiscreteCharSet.cs | 58 +
.../Asn1/Ber/Asn1EncodeBuffer.cs | 84 +
.../Asn1/Ber/Asn1Enumerated.cs | 80 +
.../Asn1/Ber/Asn1GeneralString.cs | 35 +
.../Asn1/Ber/Asn1GeneralizedTime.cs | 344 +++++
.../Asn1/Ber/Asn1GraphicString.cs | 35 +
.../Asn1/Ber/Asn1Ia5String.cs | 35 +
.../GostCryptography/Asn1/Ber/Asn1Integer.cs | 91 ++
.../Asn1/Ber/Asn1MessageBuffer.cs | 24 +
.../GostCryptography/Asn1/Ber/Asn1Null.cs | 48 +
.../Asn1/Ber/Asn1NumericString.cs | 35 +
.../Asn1/Ber/Asn1ObjectDescriptor.cs | 35 +
.../Asn1/Ber/Asn1ObjectIdentifier.cs | 137 ++
.../Asn1/Ber/Asn1OctetString.cs | 235 +++
.../GostCryptography/Asn1/Ber/Asn1OpenExt.cs | 86 ++
.../GostCryptography/Asn1/Ber/Asn1OpenType.cs | 103 ++
.../Asn1/Ber/Asn1OutputStream.cs | 87 ++
.../Asn1/Ber/Asn1PrintableString.cs | 35 +
.../GostCryptography/Asn1/Ber/Asn1Real.cs | 371 +++++
.../Asn1/Ber/Asn1RelativeOid.cs | 74 +
.../GostCryptography/Asn1/Ber/Asn1RunTime.cs | 151 ++
.../GostCryptography/Asn1/Ber/Asn1Status.cs | 7 +
.../Asn1/Ber/Asn1T61String.cs | 35 +
.../GostCryptography/Asn1/Ber/Asn1Tag.cs | 108 ++
.../GostCryptography/Asn1/Ber/Asn1Time.cs | 569 +++++++
.../Asn1/Ber/Asn1TraceHandler.cs | 46 +
.../GostCryptography/Asn1/Ber/Asn1Type.cs | 168 ++
.../Asn1/Ber/Asn1UniversalString.cs | 227 +++
.../GostCryptography/Asn1/Ber/Asn1UtcTime.cs | 361 +++++
.../Asn1/Ber/Asn1Utf8String.cs | 98 ++
.../GostCryptography/Asn1/Ber/Asn1Util.cs | 336 ++++
.../GostCryptography/Asn1/Ber/Asn1Value.cs | 170 ++
.../Asn1/Ber/Asn1VarWidthCharString.cs | 21 +
.../Asn1/Ber/Asn1VideotexString.cs | 35 +
.../Asn1/Ber/Asn1VisibleString.cs | 35 +
.../GostCryptography/Asn1/Ber/BigInteger.cs | 809 ++++++++++
.../Asn1/Ber/IAsn1InputStream.cs | 12 +
.../Asn1/Ber/IAsn1NamedEventHandler.cs | 9 +
.../Asn1/Ber/IAsn1TaggedEventHandler.cs | 9 +
.../GostCryptography/Asn1/Ber/IAsn1Type.cs | 12 +
.../GostCryptography/Asn1/Ber/IntHolder.cs | 16 +
.../GostCryptography/Asn1/Ber/Tokenizer.cs | 156 ++
.../Asn1/Gost/GostAsn1Choice.cs | 75 +
.../Gost_28147_89/Gost_28147_89_BlobParams.cs | 70 +
.../Gost_28147_89/Gost_28147_89_Constants.cs | 20 +
.../Gost_28147_89_EncryptedKey.cs | 82 +
.../Gost/Gost_28147_89/Gost_28147_89_Iv.cs | 35 +
.../Gost/Gost_28147_89/Gost_28147_89_Key.cs | 44 +
.../Gost_28147_89_KeyExchangeInfo.cs | 153 ++
.../Gost_28147_89/Gost_28147_89_KeyWrap.cs | 54 +
.../Gost_28147_89_KeyWrapParams.cs | 67 +
.../Gost/Gost_28147_89/Gost_28147_89_Mac.cs | 45 +
.../Gost_28147_89/Gost_28147_89_Params.cs | 55 +
.../Gost/Gost_R3410/Gost_R3410_KeyExchange.cs | 165 ++
.../Gost_R3410_KeyExchangeParams.cs | 161 ++
.../Gost_R3410/Gost_R3410_KeyTransport.cs | 61 +
.../Gost/Gost_R3410/Gost_R3410_PublicKey.cs | 42 +
.../Gost_R3410/Gost_R3410_PublicKeyParams.cs | 83 +
.../Gost_R3410/Gost_R3410_PublicKeyType.cs | 9 +
.../Gost_R3410/Gost_R3410_TransportParams.cs | 85 +
.../Gost_R3410_2001_Constants.cs | 25 +
.../Gost_R3410_2001_DhPublicKeyType.cs | 13 +
.../Gost_R3410_2001_KeyExchange.cs | 17 +
.../Gost_R3410_2001_KeyExchangeParams.cs | 28 +
.../Gost_R3410_2001_PublicKey.cs | 13 +
.../Gost_R3410_2001_PublicKeyParams.cs | 8 +
.../Gost_R3410_2001_PublicKeyType.cs | 13 +
.../Gost_R3411_2001_DigestParams.cs | 8 +
.../Gost_R3411_2001_DigestParamsType.cs | 13 +
.../Gost_R3410_2012_256_Constants.cs | 25 +
.../Gost_R3410_2012_256_DhPublicKeyType.cs | 13 +
.../Gost_R3410_2012_256_KeyExchange.cs | 17 +
.../Gost_R3410_2012_256_KeyExchangeParams.cs | 28 +
.../Gost_R3410_2012_256_PublicKey.cs | 13 +
.../Gost_R3410_2012_256_PublicKeyParams.cs | 8 +
.../Gost_R3410_2012_256_PublicKeyType.cs | 13 +
.../Gost_R3411_2012_256_DigestParams.cs | 8 +
.../Gost_R3411_2012_256_DigestParamsType.cs | 13 +
.../Gost_R3410_2012_512_Constants.cs | 25 +
.../Gost_R3410_2012_512_DhPublicKeyType.cs | 13 +
.../Gost_R3410_2012_512_KeyExchange.cs | 17 +
.../Gost_R3410_2012_512_KeyExchangeParams.cs | 28 +
.../Gost_R3410_2012_512_PublicKey.cs | 13 +
.../Gost_R3410_2012_512_PublicKeyParams.cs | 8 +
.../Gost_R3410_2012_512_PublicKeyType.cs | 13 +
.../Gost_R3411_2012_512_DigestParams.cs | 8 +
.../Gost_R3411_2012_512_DigestParamsType.cs | 13 +
.../Gost_R3410_94/Gost_R3410_94_Constants.cs | 25 +
.../Gost_R3410_94_DhPublicKeyType.cs | 13 +
.../Gost_R3410_94_KeyExchange.cs | 17 +
.../Gost_R3410_94_KeyExchangeParams.cs | 28 +
.../Gost_R3410_94/Gost_R3410_94_PublicKey.cs | 13 +
.../Gost_R3410_94_PublicKeyParams.cs | 8 +
.../Gost_R3410_94_PublicKeyType.cs | 13 +
.../Gost_R3411_94_DigestParams.cs | 8 +
.../Gost_R3411_94_DigestParamsType.cs | 13 +
.../Gost_R3411/Gost_R3411_DigestParams.cs | 8 +
.../Gost_R3411/Gost_R3411_DigestParamsType.cs | 9 +
.../Asn1/Gost/PublicKey/AlgorithmId.cs | 18 +
.../Gost/PublicKey/AlgorithmIdentifier.cs | 104 ++
.../Asn1/Gost/PublicKey/PkiConstants.cs | 116 ++
.../Gost/PublicKey/SubjectPublicKeyInfo.cs | 54 +
.../GostCryptography/Asn1/NullParams.cs | 8 +
.../Source/GostCryptography/Asn1/OidValue.cs | 104 ++
.../Base/GostAsymmetricAlgorithm.cs | 58 +
.../Base/GostExternalAsymmetricAlgorithm.cs | 59 +
.../Source/GostCryptography/Base/GostHMAC.cs | 44 +
.../Base/GostHashAlgorithm.cs | 44 +
.../Base/GostKeyExchangeAlgorithm.cs | 78 +
.../Base/GostKeyExchangeDeformatter.cs | 18 +
.../Base/GostKeyExchangeExportMethod.cs | 23 +
.../Base/GostKeyExchangeFormatter.cs | 18 +
.../Base/GostKeyedHashAlgorithm.cs | 44 +
.../Source/GostCryptography/Base/GostPrf.cs | 49 +
.../Base/GostSignatureDeformatter.cs | 80 +
.../Base/GostSignatureDescription.cs | 11 +
.../Base/GostSignatureFormatter.cs | 75 +
.../Base/GostSymmetricAlgorithm.cs | 64 +
.../GostCryptography/Base/IGostAlgorithm.cs | 18 +
.../GostCryptography/Base/ProviderType.cs | 85 +
.../Config/GostCryptoConfig.cs | 237 +++
.../GostCryptography/ExceptionUtility.cs | 50 +
.../GostCryptography/GostCryptography.csproj | 62 +
.../Gost_28147_89_CryptoTransform.cs | 289 ++++
.../Gost_28147_89_CryptoTransformMode.cs | 8 +
.../Gost_28147_89_ImitHashAlgorithm.cs | 156 ++
.../Gost_28147_89_ImitHashAlgorithmBase.cs | 26 +
.../Gost_28147_89_SymmetricAlgorithm.cs | 462 ++++++
.../Gost_28147_89_SymmetricAlgorithmBase.cs | 42 +
.../Gost_3412_K_ImitHashAlgorithm.cs | 156 ++
.../Gost_3412_K_SymmetricAlgorithm.cs | 471 ++++++
.../Gost_3412_M_ImitHashAlgorithm.cs | 156 ++
.../Gost_3412_M_SymmetricAlgorithm.cs | 471 ++++++
.../Gost_R3410_2001_AsymmetricAlgorithm.cs | 134 ++
...R3410_2001_EphemeralAsymmetricAlgorithm.cs | 114 ++
.../Gost_R3410_2001_KeyExchangeAlgorithm.cs | 19 +
.../Gost_R3410_2001_KeyExchangeDeformatter.cs | 25 +
.../Gost_R3410_2001_KeyExchangeFormatter.cs | 32 +
...ost_R3410_2001_KeyExchangeXmlSerializer.cs | 21 +
.../Gost_R3410_2001_SignatureDescription.cs | 20 +
...Gost_R3410_2012_256_AsymmetricAlgorithm.cs | 129 ++
...0_2012_256_EphemeralAsymmetricAlgorithm.cs | 114 ++
...ost_R3410_2012_256_KeyExchangeAlgorithm.cs | 19 +
...t_R3410_2012_256_KeyExchangeDeformatter.cs | 25 +
...ost_R3410_2012_256_KeyExchangeFormatter.cs | 32 +
...R3410_2012_256_KeyExchangeXmlSerializer.cs | 21 +
...ost_R3410_2012_256_SignatureDescription.cs | 20 +
...Gost_R3410_2012_512_AsymmetricAlgorithm.cs | 129 ++
...0_2012_512_EphemeralAsymmetricAlgorithm.cs | 114 ++
...ost_R3410_2012_512_KeyExchangeAlgorithm.cs | 19 +
...t_R3410_2012_512_KeyExchangeDeformatter.cs | 25 +
...ost_R3410_2012_512_KeyExchangeFormatter.cs | 32 +
...R3410_2012_512_KeyExchangeXmlSerializer.cs | 21 +
...ost_R3410_2012_512_SignatureDescription.cs | 20 +
.../Gost_R3410_AsymmetricAlgorithm.cs | 653 ++++++++
.../Gost_R3410_AsymmetricAlgorithmBase.cs | 86 ++
...Gost_R3410_EphemeralAsymmetricAlgorithm.cs | 123 ++
.../Gost_R3410_KeyExchangeAlgorithm.cs | 180 +++
.../Gost_R3410_KeyExchangeDeformatter.cs | 108 ++
.../Gost_R3410_KeyExchangeFormatter.cs | 167 ++
.../Gost_R3410_KeyExchangeXmlSerializer.cs | 205 +++
.../Gost_R3411/Gost_R3411_2012_256_HMAC.cs | 54 +
.../Gost_R3411_2012_256_HashAlgorithm.cs | 58 +
.../Gost_R3411/Gost_R3411_2012_256_PRF.cs | 52 +
.../Gost_R3411/Gost_R3411_2012_512_HMAC.cs | 54 +
.../Gost_R3411_2012_512_HashAlgorithm.cs | 58 +
.../Gost_R3411/Gost_R3411_2012_512_PRF.cs | 52 +
.../Gost_R3411/Gost_R3411_94_HMAC.cs | 59 +
.../Gost_R3411/Gost_R3411_94_HashAlgorithm.cs | 63 +
.../Gost_R3411/Gost_R3411_94_PRF.cs | 53 +
.../Gost_R3411/Gost_R3411_HMAC.cs | 145 ++
.../Gost_R3411/Gost_R3411_HashAlgorithm.cs | 92 ++
.../Gost_R3411/Gost_R3411_PRF.cs | 174 +++
.../GostCryptography/Native/Constants.cs | 489 ++++++
.../GostCryptography/Native/CryptoApi.cs | 169 ++
.../Native/CryptoApiHelper.cs | 1368 +++++++++++++++++
.../Native/ISafeHandleProvider.cs | 33 +
.../Native/SafeHashHandleImpl.cs | 34 +
.../Native/SafeKeyHandleImpl.cs | 37 +
.../Native/SafeProvHandleImpl.cs | 82 +
.../GostCryptography/Pkcs/GostSignedCms.cs | 201 +++
.../Properties/AssemblyInfo.cs | 6 +
.../Properties/Resources.Designer.cs | 900 +++++++++++
.../Properties/Resources.resx | 399 +++++
.../Reflection/CryptographyUtils.cs | 58 +
.../Reflection/CryptographyXmlUtils.cs | 139 ++
.../Reflection/CspKeyContainerInfoHelper.cs | 79 +
.../Reflection/EncryptedXmlHelper.cs | 86 ++
.../Reflection/SignedCmsHelper.cs | 134 ++
.../Reflection/SignedXmlHelper.cs | 125 ++
.../Reflection/X509CertificateHelper.cs | 300 ++++
.../Xml/GetIdElementDelegate.cs | 11 +
.../GostCryptography/Xml/GostEncryptedXml.cs | 356 +++++
.../Xml/GostEncryptedXmlImpl.cs | 446 ++++++
.../GostCryptography/Xml/GostKeyValue.cs | 54 +
.../GostCryptography/Xml/GostSignedXml.cs | 151 ++
.../GostCryptography/Xml/GostSignedXmlImpl.cs | 164 ++
.../Xml/Gost_R3410_2001_KeyValue.cs | 37 +
.../Xml/Gost_R3410_2012_256_KeyValue.cs | 37 +
.../Xml/Gost_R3410_2012_512_KeyValue.cs | 37 +
486 files changed, 32952 insertions(+), 801 deletions(-)
delete mode 100644 docs/implplan/SPRINT_118_concelier_vii.md
rename docs/implplan/{ => archived}/SPRINT_100_identity_signing.md (81%)
rename docs/implplan/{archived_sprints_tasks.md => archived/tasks.md} (99%)
create mode 100644 docs/modules/excititor/operations/ubuntu-csaf.md
create mode 100644 docs/modules/scanner/deterministic-sbom-compose.md
create mode 100644 docs/reachability/REACHABILITY_GAP_TASKS.md
create mode 100644 head.tmp
delete mode 100644 src/AdvisoryAI/StellaOps.AdvisoryAI/TASKS.md
create mode 100644 src/AdvisoryAI/__Tests/StellaOps.AdvisoryAI.Tests/FileSystemAdvisoryOutputStoreTests.cs
create mode 100644 src/AdvisoryAI/__Tests/StellaOps.AdvisoryAI.Tests/FileSystemAdvisoryPlanCacheTests.cs
create mode 100644 src/AdvisoryAI/__Tests/StellaOps.AdvisoryAI.Tests/TestUtilities/DeterministicTimeProvider.cs
create mode 100644 src/AdvisoryAI/__Tests/StellaOps.AdvisoryAI.Tests/TestUtilities/TempDirectory.cs
create mode 100644 src/Authority/StellaOps.Authority/StellaOps.Authority.Plugin.Ldap.Tests/ClientProvisioning/LdapCapabilityProbeTests.cs
create mode 100644 src/Authority/StellaOps.Authority/StellaOps.Authority.Plugin.Ldap/ClientProvisioning/LdapCapabilityProbe.cs
create mode 100644 src/Concelier/StellaOps.Concelier.WebService/Diagnostics/AdvisoryAiMetrics.cs
create mode 100644 src/Concelier/StellaOps.Concelier.WebService/Services/AdvisoryAiTelemetry.cs
create mode 100644 src/Concelier/StellaOps.Concelier.WebService/Services/AdvisoryChunkCache.cs
create mode 100644 src/Tools/StellaOps.CryptoRu.Cli/Program.cs
create mode 100644 src/Tools/StellaOps.CryptoRu.Cli/StellaOps.CryptoRu.Cli.csproj
create mode 100644 src/__Libraries/StellaOps.Cryptography.Plugin.CryptoPro/Properties/AssemblyInfo.cs
create mode 100644 src/__Libraries/StellaOps.Cryptography.Plugin.OpenSslGost/OpenSslCryptoServiceCollectionExtensions.cs
create mode 100644 src/__Libraries/StellaOps.Cryptography.Plugin.OpenSslGost/OpenSslGostKeyEntry.cs
create mode 100644 src/__Libraries/StellaOps.Cryptography.Plugin.OpenSslGost/OpenSslGostKeyOptions.cs
create mode 100644 src/__Libraries/StellaOps.Cryptography.Plugin.OpenSslGost/OpenSslGostProvider.cs
create mode 100644 src/__Libraries/StellaOps.Cryptography.Plugin.OpenSslGost/OpenSslGostProviderOptions.cs
create mode 100644 src/__Libraries/StellaOps.Cryptography.Plugin.OpenSslGost/OpenSslGostSigner.cs
create mode 100644 src/__Libraries/StellaOps.Cryptography.Plugin.OpenSslGost/OpenSslPemLoader.cs
create mode 100644 src/__Libraries/StellaOps.Cryptography.Plugin.OpenSslGost/Properties/AssemblyInfo.cs
create mode 100644 src/__Libraries/StellaOps.Cryptography.Plugin.OpenSslGost/StellaOps.Cryptography.Plugin.OpenSslGost.csproj
create mode 100644 src/__Libraries/StellaOps.Cryptography/GostSignatureEncoding.cs
create mode 100644 src/__Libraries/StellaOps.Cryptography/GostSignatureFormat.cs
delete mode 100644 src/__Libraries/StellaOps.Cryptography/TASKS.md
create mode 100644 src/__Libraries/__Tests/StellaOps.Cryptography.Tests/CryptoProGostSignerTests.cs
create mode 100644 src/__Libraries/__Tests/StellaOps.Cryptography.Tests/GostSignatureEncodingTests.cs
create mode 100644 src/__Libraries/__Tests/StellaOps.Cryptography.Tests/OpenSslGostSignerTests.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/.gitignore
create mode 100644 third_party/forks/AlexMAS.GostCryptography/GostCryptography.sln
create mode 100644 third_party/forks/AlexMAS.GostCryptography/GostCryptography.sln.DotSettings
create mode 100644 third_party/forks/AlexMAS.GostCryptography/LICENSE
create mode 100644 third_party/forks/AlexMAS.GostCryptography/README.md
create mode 100644 third_party/forks/AlexMAS.GostCryptography/STELLA_NOTES.md
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography.Tests/Data/EncryptedXmlExample.xml
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography.Tests/Data/SignedXmlExample.xml
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography.Tests/Data/SmevExample.xml
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography.Tests/GostCryptography.Tests.csproj
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography.Tests/Gost_28147_89/EncryptDecryptSessionKeyTest.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography.Tests/Gost_28147_89/Gost_28147_89_ImitHashAlgorithmTest.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography.Tests/Gost_28147_89/Gost_28147_89_SymmetricAlgorithmTest.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography.Tests/Gost_28147_89/KuznyechikEncryptDecryptSessionKeyTest.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography.Tests/Gost_28147_89/KuznyechikImitHashAlgorithmTest.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography.Tests/Gost_28147_89/KuznyechikSymmetricAlgorithmTest.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography.Tests/Gost_28147_89/MagmaEncryptDecryptSessionKeyTest.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography.Tests/Gost_28147_89/MagmaImitHashAlgorithmTest.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography.Tests/Gost_28147_89/MagmaSymmetricAlgorithmTest.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography.Tests/Gost_R3410/SetContainerPasswordTest.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography.Tests/Gost_R3411/Gost_R3411_2012_256_HMACTest.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography.Tests/Gost_R3411/Gost_R3411_2012_256_HashAlgorithmTest.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography.Tests/Gost_R3411/Gost_R3411_2012_256_PRFTest.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography.Tests/Gost_R3411/Gost_R3411_2012_512_HMACTest.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography.Tests/Gost_R3411/Gost_R3411_2012_512_HashAlgorithmTest.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography.Tests/Gost_R3411/Gost_R3411_2012_512_PRFTest.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography.Tests/Gost_R3411/Gost_R3411_94_HMACTest.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography.Tests/Gost_R3411/Gost_R3411_94_HashAlgorithmTest.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography.Tests/Gost_R3411/Gost_R3411_94_PRFTest.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography.Tests/Pkcs/EnvelopedCmsEncryptTest.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography.Tests/Pkcs/SignedCmsDetachedSignTest.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography.Tests/Pkcs/SignedCmsSignAndExcludeCertificates.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography.Tests/Pkcs/SignedCmsSignTest.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography.Tests/Properties/Resources.Designer.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography.Tests/Properties/Resources.resx
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography.Tests/Sign/SignDataStreamCertificateTest.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography.Tests/Sign/SignDataStreamSignatureDescriptionTest.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography.Tests/Sign/SignDataStreamSignatureFormatterTest.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography.Tests/TestCertificateInfo.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography.Tests/TestConfig.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography.Tests/Xml/Encrypt/EncryptedXmlBroadcastTest.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography.Tests/Xml/Encrypt/EncryptedXmlCertificateTest.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography.Tests/Xml/Encrypt/EncryptedXmlKeyContainerTest.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography.Tests/Xml/Encrypt/EncryptedXmlSessionKey.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography.Tests/Xml/Encrypt/EncryptedXmlSharedKeyTest.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography.Tests/Xml/Encrypt/KuznyechikEncryptedXmlCertificateTest.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography.Tests/Xml/Encrypt/MagmaEncryptedXmlCertificateTest.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography.Tests/Xml/Sign/SignedXmlCertificateTest.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography.Tests/Xml/Sign/SignedXmlDocumentTest.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography.Tests/Xml/Sign/SignedXmlKeyContainerTest.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography.Tests/Xml/Sign/SignedXmlSmevTest.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography.Tests/Xml/Sign/SignedXmlTransformTest.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Ber/Asn18BitCharString.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Ber/Asn1BerDecodeBuffer.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Ber/Asn1BerDecodeContext.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Ber/Asn1BerEncodeBuffer.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Ber/Asn1BerInputStream.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Ber/Asn1BerMessageDumpHandler.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Ber/Asn1BerOutputStream.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Ber/Asn1BigInteger.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Ber/Asn1BitString.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Ber/Asn1BmpString.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Ber/Asn1Boolean.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Ber/Asn1CerInputStream.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Ber/Asn1CerOutputStream.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Ber/Asn1CharRange.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Ber/Asn1CharSet.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Ber/Asn1CharString.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Ber/Asn1Choice.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Ber/Asn1ChoiceExt.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Ber/Asn1DecodeBuffer.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Ber/Asn1DerDecodeBuffer.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Ber/Asn1DerEncodeBuffer.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Ber/Asn1DerInputStream.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Ber/Asn1DiscreteCharSet.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Ber/Asn1EncodeBuffer.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Ber/Asn1Enumerated.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Ber/Asn1GeneralString.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Ber/Asn1GeneralizedTime.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Ber/Asn1GraphicString.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Ber/Asn1Ia5String.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Ber/Asn1Integer.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Ber/Asn1MessageBuffer.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Ber/Asn1Null.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Ber/Asn1NumericString.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Ber/Asn1ObjectDescriptor.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Ber/Asn1ObjectIdentifier.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Ber/Asn1OctetString.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Ber/Asn1OpenExt.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Ber/Asn1OpenType.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Ber/Asn1OutputStream.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Ber/Asn1PrintableString.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Ber/Asn1Real.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Ber/Asn1RelativeOid.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Ber/Asn1RunTime.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Ber/Asn1Status.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Ber/Asn1T61String.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Ber/Asn1Tag.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Ber/Asn1Time.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Ber/Asn1TraceHandler.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Ber/Asn1Type.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Ber/Asn1UniversalString.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Ber/Asn1UtcTime.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Ber/Asn1Utf8String.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Ber/Asn1Util.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Ber/Asn1Value.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Ber/Asn1VarWidthCharString.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Ber/Asn1VideotexString.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Ber/Asn1VisibleString.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Ber/BigInteger.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Ber/IAsn1InputStream.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Ber/IAsn1NamedEventHandler.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Ber/IAsn1TaggedEventHandler.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Ber/IAsn1Type.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Ber/IntHolder.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Ber/Tokenizer.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Gost/GostAsn1Choice.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Gost/Gost_28147_89/Gost_28147_89_BlobParams.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Gost/Gost_28147_89/Gost_28147_89_Constants.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Gost/Gost_28147_89/Gost_28147_89_EncryptedKey.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Gost/Gost_28147_89/Gost_28147_89_Iv.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Gost/Gost_28147_89/Gost_28147_89_Key.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Gost/Gost_28147_89/Gost_28147_89_KeyExchangeInfo.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Gost/Gost_28147_89/Gost_28147_89_KeyWrap.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Gost/Gost_28147_89/Gost_28147_89_KeyWrapParams.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Gost/Gost_28147_89/Gost_28147_89_Mac.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Gost/Gost_28147_89/Gost_28147_89_Params.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Gost/Gost_R3410/Gost_R3410_KeyExchange.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Gost/Gost_R3410/Gost_R3410_KeyExchangeParams.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Gost/Gost_R3410/Gost_R3410_KeyTransport.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Gost/Gost_R3410/Gost_R3410_PublicKey.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Gost/Gost_R3410/Gost_R3410_PublicKeyParams.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Gost/Gost_R3410/Gost_R3410_PublicKeyType.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Gost/Gost_R3410/Gost_R3410_TransportParams.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Gost/Gost_R3410_2001/Gost_R3410_2001_Constants.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Gost/Gost_R3410_2001/Gost_R3410_2001_DhPublicKeyType.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Gost/Gost_R3410_2001/Gost_R3410_2001_KeyExchange.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Gost/Gost_R3410_2001/Gost_R3410_2001_KeyExchangeParams.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Gost/Gost_R3410_2001/Gost_R3410_2001_PublicKey.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Gost/Gost_R3410_2001/Gost_R3410_2001_PublicKeyParams.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Gost/Gost_R3410_2001/Gost_R3410_2001_PublicKeyType.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Gost/Gost_R3410_2001/Gost_R3411_2001_DigestParams.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Gost/Gost_R3410_2001/Gost_R3411_2001_DigestParamsType.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Gost/Gost_R3410_2012_256/Gost_R3410_2012_256_Constants.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Gost/Gost_R3410_2012_256/Gost_R3410_2012_256_DhPublicKeyType.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Gost/Gost_R3410_2012_256/Gost_R3410_2012_256_KeyExchange.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Gost/Gost_R3410_2012_256/Gost_R3410_2012_256_KeyExchangeParams.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Gost/Gost_R3410_2012_256/Gost_R3410_2012_256_PublicKey.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Gost/Gost_R3410_2012_256/Gost_R3410_2012_256_PublicKeyParams.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Gost/Gost_R3410_2012_256/Gost_R3410_2012_256_PublicKeyType.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Gost/Gost_R3410_2012_256/Gost_R3411_2012_256_DigestParams.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Gost/Gost_R3410_2012_256/Gost_R3411_2012_256_DigestParamsType.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Gost/Gost_R3410_2012_512/Gost_R3410_2012_512_Constants.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Gost/Gost_R3410_2012_512/Gost_R3410_2012_512_DhPublicKeyType.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Gost/Gost_R3410_2012_512/Gost_R3410_2012_512_KeyExchange.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Gost/Gost_R3410_2012_512/Gost_R3410_2012_512_KeyExchangeParams.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Gost/Gost_R3410_2012_512/Gost_R3410_2012_512_PublicKey.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Gost/Gost_R3410_2012_512/Gost_R3410_2012_512_PublicKeyParams.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Gost/Gost_R3410_2012_512/Gost_R3410_2012_512_PublicKeyType.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Gost/Gost_R3410_2012_512/Gost_R3411_2012_512_DigestParams.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Gost/Gost_R3410_2012_512/Gost_R3411_2012_512_DigestParamsType.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Gost/Gost_R3410_94/Gost_R3410_94_Constants.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Gost/Gost_R3410_94/Gost_R3410_94_DhPublicKeyType.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Gost/Gost_R3410_94/Gost_R3410_94_KeyExchange.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Gost/Gost_R3410_94/Gost_R3410_94_KeyExchangeParams.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Gost/Gost_R3410_94/Gost_R3410_94_PublicKey.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Gost/Gost_R3410_94/Gost_R3410_94_PublicKeyParams.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Gost/Gost_R3410_94/Gost_R3410_94_PublicKeyType.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Gost/Gost_R3410_94/Gost_R3411_94_DigestParams.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Gost/Gost_R3410_94/Gost_R3411_94_DigestParamsType.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Gost/Gost_R3411/Gost_R3411_DigestParams.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Gost/Gost_R3411/Gost_R3411_DigestParamsType.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Gost/PublicKey/AlgorithmId.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Gost/PublicKey/AlgorithmIdentifier.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Gost/PublicKey/PkiConstants.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/Gost/PublicKey/SubjectPublicKeyInfo.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/NullParams.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Asn1/OidValue.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Base/GostAsymmetricAlgorithm.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Base/GostExternalAsymmetricAlgorithm.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Base/GostHMAC.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Base/GostHashAlgorithm.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Base/GostKeyExchangeAlgorithm.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Base/GostKeyExchangeDeformatter.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Base/GostKeyExchangeExportMethod.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Base/GostKeyExchangeFormatter.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Base/GostKeyedHashAlgorithm.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Base/GostPrf.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Base/GostSignatureDeformatter.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Base/GostSignatureDescription.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Base/GostSignatureFormatter.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Base/GostSymmetricAlgorithm.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Base/IGostAlgorithm.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Base/ProviderType.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Config/GostCryptoConfig.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/ExceptionUtility.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/GostCryptography.csproj
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Gost_28147_89/Gost_28147_89_CryptoTransform.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Gost_28147_89/Gost_28147_89_CryptoTransformMode.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Gost_28147_89/Gost_28147_89_ImitHashAlgorithm.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Gost_28147_89/Gost_28147_89_ImitHashAlgorithmBase.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Gost_28147_89/Gost_28147_89_SymmetricAlgorithm.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Gost_28147_89/Gost_28147_89_SymmetricAlgorithmBase.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Gost_28147_89/Gost_3412_K_ImitHashAlgorithm.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Gost_28147_89/Gost_3412_K_SymmetricAlgorithm.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Gost_28147_89/Gost_3412_M_ImitHashAlgorithm.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Gost_28147_89/Gost_3412_M_SymmetricAlgorithm.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Gost_R3410/Gost_R3410_2001_AsymmetricAlgorithm.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Gost_R3410/Gost_R3410_2001_EphemeralAsymmetricAlgorithm.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Gost_R3410/Gost_R3410_2001_KeyExchangeAlgorithm.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Gost_R3410/Gost_R3410_2001_KeyExchangeDeformatter.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Gost_R3410/Gost_R3410_2001_KeyExchangeFormatter.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Gost_R3410/Gost_R3410_2001_KeyExchangeXmlSerializer.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Gost_R3410/Gost_R3410_2001_SignatureDescription.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Gost_R3410/Gost_R3410_2012_256_AsymmetricAlgorithm.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Gost_R3410/Gost_R3410_2012_256_EphemeralAsymmetricAlgorithm.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Gost_R3410/Gost_R3410_2012_256_KeyExchangeAlgorithm.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Gost_R3410/Gost_R3410_2012_256_KeyExchangeDeformatter.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Gost_R3410/Gost_R3410_2012_256_KeyExchangeFormatter.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Gost_R3410/Gost_R3410_2012_256_KeyExchangeXmlSerializer.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Gost_R3410/Gost_R3410_2012_256_SignatureDescription.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Gost_R3410/Gost_R3410_2012_512_AsymmetricAlgorithm.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Gost_R3410/Gost_R3410_2012_512_EphemeralAsymmetricAlgorithm.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Gost_R3410/Gost_R3410_2012_512_KeyExchangeAlgorithm.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Gost_R3410/Gost_R3410_2012_512_KeyExchangeDeformatter.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Gost_R3410/Gost_R3410_2012_512_KeyExchangeFormatter.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Gost_R3410/Gost_R3410_2012_512_KeyExchangeXmlSerializer.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Gost_R3410/Gost_R3410_2012_512_SignatureDescription.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Gost_R3410/Gost_R3410_AsymmetricAlgorithm.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Gost_R3410/Gost_R3410_AsymmetricAlgorithmBase.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Gost_R3410/Gost_R3410_EphemeralAsymmetricAlgorithm.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Gost_R3410/Gost_R3410_KeyExchangeAlgorithm.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Gost_R3410/Gost_R3410_KeyExchangeDeformatter.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Gost_R3410/Gost_R3410_KeyExchangeFormatter.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Gost_R3410/Gost_R3410_KeyExchangeXmlSerializer.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Gost_R3411/Gost_R3411_2012_256_HMAC.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Gost_R3411/Gost_R3411_2012_256_HashAlgorithm.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Gost_R3411/Gost_R3411_2012_256_PRF.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Gost_R3411/Gost_R3411_2012_512_HMAC.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Gost_R3411/Gost_R3411_2012_512_HashAlgorithm.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Gost_R3411/Gost_R3411_2012_512_PRF.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Gost_R3411/Gost_R3411_94_HMAC.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Gost_R3411/Gost_R3411_94_HashAlgorithm.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Gost_R3411/Gost_R3411_94_PRF.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Gost_R3411/Gost_R3411_HMAC.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Gost_R3411/Gost_R3411_HashAlgorithm.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Gost_R3411/Gost_R3411_PRF.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Native/Constants.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Native/CryptoApi.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Native/CryptoApiHelper.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Native/ISafeHandleProvider.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Native/SafeHashHandleImpl.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Native/SafeKeyHandleImpl.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Native/SafeProvHandleImpl.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Pkcs/GostSignedCms.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Properties/AssemblyInfo.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Properties/Resources.Designer.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Properties/Resources.resx
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Reflection/CryptographyUtils.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Reflection/CryptographyXmlUtils.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Reflection/CspKeyContainerInfoHelper.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Reflection/EncryptedXmlHelper.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Reflection/SignedCmsHelper.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Reflection/SignedXmlHelper.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Reflection/X509CertificateHelper.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Xml/GetIdElementDelegate.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Xml/GostEncryptedXml.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Xml/GostEncryptedXmlImpl.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Xml/GostKeyValue.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Xml/GostSignedXml.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Xml/GostSignedXmlImpl.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Xml/Gost_R3410_2001_KeyValue.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Xml/Gost_R3410_2012_256_KeyValue.cs
create mode 100644 third_party/forks/AlexMAS.GostCryptography/Source/GostCryptography/Xml/Gost_R3410_2012_512_KeyValue.cs
diff --git a/Directory.Build.props b/Directory.Build.props
index 07bb742d7..1de477147 100644
--- a/Directory.Build.props
+++ b/Directory.Build.props
@@ -1,12 +1,23 @@
-
-
- $([System.IO.Path]::GetFullPath('$(MSBuildThisFileDirectory)'))
- $([System.IO.Path]::GetFullPath('$(StellaOpsRepoRoot)local-nuget/'))
- https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-public/nuget/v3/index.json
- https://api.nuget.org/v3/index.json
- <_StellaOpsDefaultRestoreSources>$(StellaOpsLocalNuGetSource);$(StellaOpsDotNetPublicSource);$(StellaOpsNuGetOrgSource)
- <_StellaOpsOriginalRestoreSources Condition="'$(_StellaOpsOriginalRestoreSources)' == ''">$(RestoreSources)
- $(_StellaOpsDefaultRestoreSources)
- $(_StellaOpsDefaultRestoreSources);$(_StellaOpsOriginalRestoreSources)
-
-
+
+
+
+
+ $([System.IO.Path]::GetFullPath('$(MSBuildThisFileDirectory)'))
+ $([System.IO.Path]::GetFullPath('$(StellaOpsRepoRoot)local-nuget/'))
+ https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-public/nuget/v3/index.json
+ https://api.nuget.org/v3/index.json
+ <_StellaOpsDefaultRestoreSources>$(StellaOpsLocalNuGetSource);$(StellaOpsDotNetPublicSource);$(StellaOpsNuGetOrgSource)
+ <_StellaOpsOriginalRestoreSources Condition="'$(_StellaOpsOriginalRestoreSources)' == ''">$(RestoreSources)
+ $(_StellaOpsDefaultRestoreSources)
+ $(_StellaOpsDefaultRestoreSources);$(_StellaOpsOriginalRestoreSources)
+
+
+
+ false
+
+
+
+ $(DefineConstants);STELLAOPS_CRYPTO_PRO
+
+
+
diff --git a/docs/11_AUTHORITY.md b/docs/11_AUTHORITY.md
index 8704d3771..4aecfedbd 100644
--- a/docs/11_AUTHORITY.md
+++ b/docs/11_AUTHORITY.md
@@ -102,6 +102,7 @@ Resource servers (Concelier WebService, Backend, Agent) **must not** assume in-m
- Policy Studio scopes (`policy:author`, `policy:review`, `policy:approve`, `policy:operate`, `policy:publish`, `policy:promote`, `policy:audit`, `policy:simulate`, `policy:run`, `policy:activate`) require a tenant assignment; Authority rejects tokens missing the hint with `invalid_client` and records `scope.invalid` metadata for auditing. The `policy:publish`/`policy:promote` scopes are interactive-only and demand additional metadata (see “Policy attestation metadata” below).
- Policy attestation tokens must include three parameters: `policy_reason` (≤512 chars describing why the attestation is being produced), `policy_ticket` (≤128 chars change/request reference), and `policy_digest` (32–128 char hex digest of the policy package). Authority rejects requests missing any value, over the limits, or providing a non-hex digest. Password-grant issuance stamps these values into the resulting token/audit trail and enforces a five-minute fresh-auth window via the `auth_time` claim.
- Task Pack scopes (`packs.read`, `packs.write`, `packs.run`, `packs.approve`) require a tenant assignment; Authority rejects tokens missing the hint with `invalid_client` and logs `authority.pack_scope_violation` metadata for audit correlation.
+- `packs.approve` tokens must include `pack_run_id`, `pack_gate_id`, `pack_plan_hash`, and an `auth_time` within five minutes. `/token` enforces the metadata, and the resource-server scope handler double-checks freshness before allowing approvals (see `docs/task-packs/runbook.md#4-approvals-workflow`). Missing metadata or stale authentication produces deterministic audit telemetry tagged with `pack.*` properties.
- **AOC pairing guardrails** – Tokens that request `advisory:read`, `advisory-ai:view`, `advisory-ai:operate`, `advisory-ai:admin`, `vex:read`, or any `signals:*` scope must also request `aoc:verify`. Authority rejects mismatches with `invalid_scope` (e.g., `Scope 'aoc:verify' is required when requesting advisory/advisory-ai/vex read scopes.` or `Scope 'aoc:verify' is required when requesting signals scopes.`) so automation surfaces deterministic errors.
- **Signals ingestion guardrails** – Sensors and services requesting `signals:write`/`signals:admin` must also request `aoc:verify`; Authority records the `authority.aoc_scope_violation` tag when the pairing is missing so operators can trace failing sensors immediately.
- Password grant flows reuse the client registration's tenant and enforce the configured scope allow-list. Requested scopes outside that list (or mismatched tenants) trigger `invalid_scope`/`invalid_client` failures, ensuring cross-tenant access is denied before token issuance.
diff --git a/docs/19_TEST_SUITE_OVERVIEW.md b/docs/19_TEST_SUITE_OVERVIEW.md
index f9717564e..fa9c2551d 100755
--- a/docs/19_TEST_SUITE_OVERVIEW.md
+++ b/docs/19_TEST_SUITE_OVERVIEW.md
@@ -61,9 +61,12 @@ The script spins up MongoDB/Redis via Testcontainers and requires:
Multiple suites (Concelier connectors, Excititor worker/WebService, Scheduler)
fall back to [Mongo2Go](https://github.com/Mongo2Go/Mongo2Go) when a developer
-does not have a local `mongod` listening on `127.0.0.1:27017`. Modern distros
-ship OpenSSL 3 by default, so you **must** expose the legacy OpenSSL 1.1
-libraries that the embedded `mongod` requires:
+does not have a local `mongod` listening on `127.0.0.1:27017`. **This is a
+test-only dependency**: production/dev runtime MongoDB always runs inside the
+compose/k8s network using the standard StellaOps cryptography stack. Modern
+distros ship OpenSSL 3 by default, so when Mongo2Go starts its embedded
+`mongod` you **must** expose the legacy OpenSSL 1.1 libraries that binary
+expects:
1. From the repo root, export the provided binaries before running any tests:
diff --git a/docs/dev/31_AUTHORITY_PLUGIN_DEVELOPER_GUIDE.md b/docs/dev/31_AUTHORITY_PLUGIN_DEVELOPER_GUIDE.md
index 856565909..b4cf42bda 100644
--- a/docs/dev/31_AUTHORITY_PLUGIN_DEVELOPER_GUIDE.md
+++ b/docs/dev/31_AUTHORITY_PLUGIN_DEVELOPER_GUIDE.md
@@ -178,6 +178,8 @@ _Source:_ `docs/assets/authority/authority-plugin-bootstrap-sequence.mmd`
- **Attribute pass-through.** `claims.extraAttributes` pairs the outgoing claim name with the LDAP attribute to read (first value wins). Only non-empty strings are written, which keeps audit/compliance data deterministic.
- **Mongo claims cache.** `claims.cache.enabled=true` wires the `MongoLdapClaimsCache` (default collection `ldap_claims_cache_`). Set `ttlSeconds` according to your directory freshness SLA and adjust `maxEntries` to cap disk usage; eviction is deterministic (oldest entries removed first). Offline Kit bundles now include the collection name requirements so replicas can pre-create capped collections.
- **Client provisioning audit mirror.** `clientProvisioning.auditMirror.enabled=true` persists every LDAP write into Mongo (`ldap_client_provisioning_` by default) with `{operation, dn, tenant, project, secretHash}`. That mirror is shipped in Offline Kits so regulators can diff LDAP state even without directory access. When `clientProvisioning.enabled=false`, the registrar logs a warning and downgrades the capability at runtime.
+- **Bootstrap seeding + audits.** `bootstrap.*` mirrors the provisioning contract for human operators: the plug-in writes `uid={username}` entries under `bootstrap.containerDn`, applies `staticAttributes` placeholders (`{username}`, `{displayName}`), and mirrors deterministic audit documents to Mongo (`ldap_bootstrap_` by default) with hashed secrets (`AuthoritySecretHasher`). Bootstrap only lights up when (1) the manifest advertises the capability, (2) `bootstrap.enabled=true`, **and** (3) the plug-in proves the bind account can add/delete under the configured container. Otherwise the capability is silently downgraded and health checks surface `capabilities=bootstrapDisabled`.
+- **Capability proofing.** On startup the plug-in performs a short-lived LDAP write probe (add→delete) inside each configured container. If either probe fails, the respective capability (`clientProvisioning`, `bootstrap`) is removed, `ClientProvisioning` stays `null`, and `CheckHealthAsync` reports `Degraded` until permissions are restored. This keeps read-only deployments safe while making it obvious when operators still need to grant write scope.
- **Sample manifest + binaries.** The curated manifest lives at `etc/authority.plugins/ldap.yaml` and demonstrates TLS, regex mappings, caching, and audit mirror options. Offline Kits copy both the manifest and the compiled plug-in into `plugins/authority/StellaOps.Authority.Plugin.Ldap/` so operators can drop them straight into air-gapped composer deployments.
## 7. Configuration & Secrets
diff --git a/docs/implplan/SPRINT_110_ingestion_evidence.md b/docs/implplan/SPRINT_110_ingestion_evidence.md
index 6b2b48353..de888505b 100644
--- a/docs/implplan/SPRINT_110_ingestion_evidence.md
+++ b/docs/implplan/SPRINT_110_ingestion_evidence.md
@@ -1,6 +1,6 @@
# Sprint 110 - Ingestion & Evidence
-Active items only. Completed/historic work now resides in docs/implplan/archived_sprints_tasks.md (updated 2025-11-08).
+Active items only. Completed/historic work now resides in docs/implplan/archived/tasks.md (updated 2025-11-08).
## Status Snapshot (2025-11-04)
diff --git a/docs/implplan/SPRINT_111_advisoryai.md b/docs/implplan/SPRINT_111_advisoryai.md
index e6f45496b..7095f0efe 100644
--- a/docs/implplan/SPRINT_111_advisoryai.md
+++ b/docs/implplan/SPRINT_111_advisoryai.md
@@ -1,6 +1,6 @@
# Sprint 111 - Ingestion & Evidence · 110.A) AdvisoryAI
-Active items only. Completed/historic work now resides in docs/implplan/archived_sprints_tasks.md (updated 2025-11-08).
+Active items only. Completed/historic work now resides in docs/implplan/archived/tasks.md (updated 2025-11-08).
[Ingestion & Evidence] 110.A) AdvisoryAI
Depends on: Sprint 100.A - Attestor
@@ -33,6 +33,7 @@ SBOM-AIAI-31-003 | TODO (2025-11-03) | Publish the Advisory AI hand-off kit for
> 2025-11-06: AIAI-31-007 completed – Advisory AI WebService/Worker emit latency histograms, guardrail/validation counters, citation coverage ratios, and OTEL spans; Grafana dashboard + burn-rate alerts refreshed.
AIAI-31-008 | TODO | Package inference on-prem container, remote inference toggle, Helm/Compose manifests, scaling guidance, offline kit instructions. Dependencies: AIAI-31-006..007. | Advisory AI Guild, DevOps Guild (src/AdvisoryAI/StellaOps.AdvisoryAI)
AIAI-31-009 | DOING (2025-11-09) | Develop unit/golden/property/perf tests, injection harness, and regression suite; ensure determinism with seeded caches. Dependencies: AIAI-31-001..006. | Advisory AI Guild, QA Guild (src/AdvisoryAI/StellaOps.AdvisoryAI)
+> 2025-11-09: Guardrail harness converted to JSON fixtures + legacy payloads, property-style plan cache load tests added, and file-system cache/output suites cover seeded/offline scenarios.
diff --git a/docs/implplan/SPRINT_112_concelier_i.md b/docs/implplan/SPRINT_112_concelier_i.md
index 070281aaf..11998835c 100644
--- a/docs/implplan/SPRINT_112_concelier_i.md
+++ b/docs/implplan/SPRINT_112_concelier_i.md
@@ -1,22 +1,22 @@
# Sprint 112 - Ingestion & Evidence · 110.B) Concelier.I
-Active items only. Completed/historic work now resides in docs/implplan/archived_sprints_tasks.md (updated 2025-11-08).
+Active items only. Completed/historic work now resides in docs/implplan/archived/tasks.md (updated 2025-11-08).
[Ingestion & Evidence] 110.B) Concelier.I
Depends on: Sprint 100.A - Attestor
Summary: Ingestion & Evidence focus on Concelier (phase I).
Task ID | State | Task description | Owners (Source)
--- | --- | --- | ---
-CONCELIER-AIAI-31-002 `Structured fields` | TODO | Ensure observation APIs expose upstream workaround/fix/CVSS fields with provenance; add caching for summary queries. Dependencies: CONCELIER-AIAI-31-001. | Concelier WebService Guild (src/Concelier/StellaOps.Concelier.WebService)
-CONCELIER-AIAI-31-003 `Advisory AI telemetry` | TODO | Emit metrics/logs for chunk requests, cache hits, and guardrail blocks triggered by advisory payloads. Dependencies: CONCELIER-AIAI-31-001. | Concelier WebService Guild, Observability Guild (src/Concelier/StellaOps.Concelier.WebService)
-CONCELIER-AIRGAP-56-001 `Mirror ingestion adapters` | TODO | Add mirror source adapters reading advisories from imported bundles, preserving source metadata and bundle IDs. Ensure ingestion remains append-only. Dependencies: AIRGAP-IMP-57-002, MIRROR-CRT-56-001. | Concelier Core Guild (src/Concelier/__Libraries/StellaOps.Concelier.Core)
-CONCELIER-AIRGAP-56-002 `Bundle catalog linking` | TODO | Persist `bundle_id`, `merkle_root`, and time anchor references on observations/linksets for provenance. Dependencies: CONCELIER-AIRGAP-56-001, AIRGAP-IMP-57-001. | Concelier Core Guild, AirGap Importer Guild (src/Concelier/__Libraries/StellaOps.Concelier.Core)
-CONCELIER-AIRGAP-57-001 `Sealed-mode source restrictions` | TODO | Enforce sealed-mode egress rules by disallowing non-mirror connectors and surfacing remediation errors. Dependencies: CONCELIER-AIRGAP-56-001, AIRGAP-POL-56-001. | Concelier Core Guild, AirGap Policy Guild (src/Concelier/__Libraries/StellaOps.Concelier.Core)
-CONCELIER-AIRGAP-57-002 `Staleness annotations` | TODO | Compute staleness metadata for advisories per bundle and expose via API for Console/CLI badges. Dependencies: CONCELIER-AIRGAP-56-002, AIRGAP-TIME-58-001. | Concelier Core Guild, AirGap Time Guild (src/Concelier/__Libraries/StellaOps.Concelier.Core)
-CONCELIER-AIRGAP-58-001 `Portable advisory evidence` | TODO | Package advisory evidence fragments into portable evidence bundles for cross-domain transfer. Dependencies: CONCELIER-OBS-53-001, EVID-OBS-54-001. | Concelier Core Guild, Evidence Locker Guild (src/Concelier/__Libraries/StellaOps.Concelier.Core)
-CONCELIER-ATTEST-73-001 `ScanResults attestation inputs` | TODO | Provide observation artifacts and linkset digests needed for ScanResults attestations (raw data + provenance, no merge outputs). Dependencies: ATTEST-TYPES-72-001. | Concelier Core Guild, Attestor Service Guild (src/Concelier/__Libraries/StellaOps.Concelier.Core)
-CONCELIER-ATTEST-73-002 `Transparency metadata` | TODO | Ensure Conseiller exposes source digests for transparency proofs and explainability. Dependencies: CONCELIER-ATTEST-73-001. | Concelier Core Guild (src/Concelier/__Libraries/StellaOps.Concelier.Core)
-CONCELIER-CONSOLE-23-001 `Advisory aggregation views` | TODO | Expose `/console/advisories` endpoints returning aggregation groups (per linkset) with source chips, provider-reported severity columns (no local consensus), and provenance metadata for Console list + dashboard cards. Support filters by source, ecosystem, published/modified window, tenant enforcement. Dependencies: CONCELIER-LNM-21-201, CONCELIER-LNM-21-202. | Concelier WebService Guild, BE-Base Platform Guild (src/Concelier/StellaOps.Concelier.WebService)
-CONCELIER-CONSOLE-23-002 `Dashboard deltas API` | TODO | Provide aggregated advisory delta counts (new, modified, conflicting) for Console dashboard + live status ticker; emit structured events for queue lag metrics. Ensure deterministic counts across repeated queries. Dependencies: CONCELIER-CONSOLE-23-001, CONCELIER-LNM-21-203. | Concelier WebService Guild (src/Concelier/StellaOps.Concelier.WebService)
-CONCELIER-CONSOLE-23-003 `Search fan-out helpers` | TODO | Deliver fast lookup endpoints for CVE/GHSA/purl search (linksets, observations) returning evidence fragments for Console global search; implement caching + scope guards. Dependencies: CONCELIER-CONSOLE-23-001. | Concelier WebService Guild (src/Concelier/StellaOps.Concelier.WebService)
-CONCELIER-CORE-AOC-19-013 `Authority tenant scope smoke coverage` | TODO | Extend Concelier smoke/e2e fixtures to configure `requiredTenants` and assert cross-tenant rejection with updated Authority tokens. Dependencies: AUTH-AOC-19-002. | Concelier Core Guild (src/Concelier/__Libraries/StellaOps.Concelier.Core)
\ No newline at end of file
+CONCELIER-AIAI-31-002 `Structured fields` | TODO | Ship chunked advisory observation responses (workaround/fix notes, CVSS, affected range) where every field is traced back to the upstream document via provenance anchors; enforce deterministic sorting/pagination and add read-through caching so Advisory AI can hydrate RAG contexts without recomputing severity. | Concelier WebService Guild (src/Concelier/StellaOps.Concelier.WebService)
+CONCELIER-AIAI-31-003 `Advisory AI telemetry` | DOING | Instrument the new chunk endpoints with request/tenant metrics, cache-hit ratios, and guardrail violation counters so we can prove Concelier is serving raw evidence safely (no merges, no derived fields). | Concelier WebService Guild, Observability Guild (src/Concelier/StellaOps.Concelier.WebService)
+CONCELIER-AIRGAP-56-001 `Mirror ingestion adapters` | TODO | Add mirror ingestion paths that read advisory bundles, persist bundle IDs/merkle roots unchanged, and assert append-only semantics so sealed deployments ingest the same raw facts as online clusters. | Concelier Core Guild (src/Concelier/__Libraries/StellaOps.Concelier.Core)
+CONCELIER-AIRGAP-56-002 `Bundle catalog linking` | TODO | Record `bundle_id`, `merkle_root`, and time-anchor metadata on every observation/linkset so provenance survives exports; document how Offline Kit verifiers replay the references. Depends on CONCELIER-AIRGAP-56-001. | Concelier Core Guild, AirGap Importer Guild (src/Concelier/__Libraries/StellaOps.Concelier.Core)
+CONCELIER-AIRGAP-57-001 `Sealed-mode source restrictions` | TODO | Enforce sealed-mode policies that disable non-mirror connectors, emit actionable remediation errors, and log attempts without touching advisory content. Depends on CONCELIER-AIRGAP-56-001. | Concelier Core Guild, AirGap Policy Guild (src/Concelier/__Libraries/StellaOps.Concelier.Core)
+CONCELIER-AIRGAP-57-002 `Staleness annotations` | TODO | Compute staleness metadata per bundle (fetched/published delta, clock source) and expose it via observation APIs so consoles/CLI can highlight out-of-date advisories without altering evidence. Depends on CONCELIER-AIRGAP-56-002. | Concelier Core Guild, AirGap Time Guild (src/Concelier/__Libraries/StellaOps.Concelier.Core)
+CONCELIER-AIRGAP-58-001 `Portable advisory evidence` | TODO | Package advisory observations/linksets plus provenance notes into portable evidence bundles tied to timeline IDs; include verifier instructions for cross-domain transfer. Depends on CONCELIER-AIRGAP-57-002. | Concelier Core Guild, Evidence Locker Guild (src/Concelier/__Libraries/StellaOps.Concelier.Core)
+CONCELIER-ATTEST-73-001 `ScanResults attestation inputs` | TODO | Emit observation and linkset digests required for ScanResults attestations (raw JSON, provenance metadata) so Attestor can sign outputs without Concelier inferring verdicts. | Concelier Core Guild, Attestor Service Guild (src/Concelier/__Libraries/StellaOps.Concelier.Core)
+CONCELIER-ATTEST-73-002 `Transparency metadata` | TODO | Surface per-observation digests and bundle IDs through read APIs so transparency proofs/explainers can cite immutable evidence. Depends on CONCELIER-ATTEST-73-001. | Concelier Core Guild (src/Concelier/__Libraries/StellaOps.Concelier.Core)
+CONCELIER-CONSOLE-23-001 `Advisory aggregation views` | TODO | Provide `/console/advisories` list/detail endpoints that group linksets, display per-source severity/status chips, and expose provenance metadata—never merge or override upstream values. Depends on CONCELIER-LNM-21-201/202. | Concelier WebService Guild, BE-Base Platform Guild (src/Concelier/StellaOps.Concelier.WebService)
+CONCELIER-CONSOLE-23-002 `Dashboard deltas API` | TODO | Calculate deterministic advisory deltas (new, modified, conflicting) for Console dashboards, referencing linkset IDs and timestamps rather than computed verdicts. Depends on CONCELIER-CONSOLE-23-001. | Concelier WebService Guild (src/Concelier/StellaOps.Concelier.WebService)
+CONCELIER-CONSOLE-23-003 `Search fan-out helpers` | TODO | Implement CVE/GHSA/PURL lookup helpers that return observation/linkset excerpts plus provenance pointers so global search can preview raw evidence safely; include caching + tenant guards. | Concelier WebService Guild (src/Concelier/StellaOps.Concelier.WebService)
+CONCELIER-CORE-AOC-19-013 `Authority tenant scope smoke coverage` | TODO | Expand smoke/e2e suites so Authority tokens + tenant headers are required for every ingest/read path, proving that aggregation stays tenant-scoped and merge-free. | Concelier Core Guild (src/Concelier/__Libraries/StellaOps.Concelier.Core)
diff --git a/docs/implplan/SPRINT_113_concelier_ii.md b/docs/implplan/SPRINT_113_concelier_ii.md
index bfc54b15a..34553472f 100644
--- a/docs/implplan/SPRINT_113_concelier_ii.md
+++ b/docs/implplan/SPRINT_113_concelier_ii.md
@@ -1,24 +1,24 @@
# Sprint 113 - Ingestion & Evidence · 110.B) Concelier.II
-Active items only. Completed/historic work now resides in docs/implplan/archived_sprints_tasks.md (updated 2025-11-08).
+Active items only. Completed/historic work now resides in docs/implplan/archived/tasks.md (updated 2025-11-08).
[Ingestion & Evidence] 110.B) Concelier.II
Depends on: Sprint 110.B - Concelier.I
Summary: Ingestion & Evidence focus on Concelier (phase II).
Task ID | State | Task description | Owners (Source)
--- | --- | --- | ---
-CONCELIER-GRAPH-21-001 `SBOM projection enrichment` | BLOCKED (2025-10-27) | Extend SBOM normalization to emit full relationship graph (depends_on/contains/provides), scope tags, entrypoint annotations, and component metadata required by Cartographer. | Concelier Core Guild, Cartographer Guild (src/Concelier/__Libraries/StellaOps.Concelier.Core)
-CONCELIER-GRAPH-21-002 `Change events` | BLOCKED (2025-10-27) | Publish change events (new SBOM version, relationship delta) for Cartographer build queue; ensure events include tenant/context metadata. Dependencies: CONCELIER-GRAPH-21-001. | Concelier Core Guild, Scheduler Guild (src/Concelier/__Libraries/StellaOps.Concelier.Core)
-CONCELIER-GRAPH-24-101 `Advisory summary API` | TODO | Expose `/advisories/summary` returning raw linkset/observation metadata for overlay services; no derived severity or fix hints. Dependencies: CONCELIER-GRAPH-21-002. | Concelier WebService Guild (src/Concelier/StellaOps.Concelier.WebService)
-CONCELIER-GRAPH-28-102 `Evidence batch API` | TODO | Add batch fetch for advisory observations/linksets keyed by component sets to feed Graph overlay tooltips efficiently. Dependencies: CONCELIER-GRAPH-24-101. | Concelier WebService Guild (src/Concelier/StellaOps.Concelier.WebService)
-CONCELIER-LNM-21-001 `Advisory observation schema` | TODO | Introduce immutable `advisory_observations` model with AOC metadata, raw payload pointers, structured per-source fields (version ranges, severity, CVSS), and tenancy guardrails; publish schema definition. `DOCS-LNM-22-001` blocked pending this deliverable. | Concelier Core Guild (src/Concelier/__Libraries/StellaOps.Concelier.Core)
-CONCELIER-LNM-21-002 `Linkset builder` | TODO | Implement correlation pipeline (alias graph, PURL overlap, CVSS vector equality, fuzzy title match) that produces `advisory_linksets` with confidence + conflict annotations. Docs note: unblock `DOCS-LNM-22-001` once builder lands. Dependencies: CONCELIER-LNM-21-001. | Concelier Core Guild, Data Science Guild (src/Concelier/__Libraries/StellaOps.Concelier.Core)
-CONCELIER-LNM-21-003 `Conflict annotator` | TODO | Detect field disagreements (severity, CVSS, ranges, references) and record structured conflicts on linksets; surface to API/UI. Docs awaiting structured conflict payloads. Dependencies: CONCELIER-LNM-21-002. | Concelier Core Guild (src/Concelier/__Libraries/StellaOps.Concelier.Core)
-CONCELIER-LNM-21-004 `Merge code removal` | TODO | Excise existing merge/dedup logic, enforce immutability on observations, and add guards/tests to prevent future merges. Dependencies: CONCELIER-LNM-21-003. | Concelier Core Guild (src/Concelier/__Libraries/StellaOps.Concelier.Core)
-CONCELIER-LNM-21-005 `Event emission` | TODO | Emit `advisory.linkset.updated` events with delta payloads for downstream Policy Engine/Cartographer consumers; ensure idempotent delivery. Dependencies: CONCELIER-LNM-21-004. | Concelier Core Guild, Platform Events Guild (src/Concelier/__Libraries/StellaOps.Concelier.Core)
-CONCELIER-LNM-21-101 `Observations collections` | TODO | Provision `advisory_observations` and `advisory_linksets` collections with hashed shard keys, TTL for ingest metadata, and required indexes (`aliases`, `purls`, `observation_ids`). Dependencies: CONCELIER-LNM-21-005. | Concelier Storage Guild (src/Concelier/__Libraries/StellaOps.Concelier.Storage.Mongo)
-CONCELIER-LNM-21-102 `Migration tooling` | TODO | Backfill legacy merged advisories into observation/linkset collections, create tombstones for merged docs, and supply rollback scripts. Dependencies: CONCELIER-LNM-21-101. | Concelier Storage Guild, DevOps Guild (src/Concelier/__Libraries/StellaOps.Concelier.Storage.Mongo)
-CONCELIER-LNM-21-103 `Blob/store wiring` | TODO | Store large raw payloads in object storage with pointers from observations; update bootstrapper/offline kit to seed sample blobs. Dependencies: CONCELIER-LNM-21-102. | Concelier Storage Guild (src/Concelier/__Libraries/StellaOps.Concelier.Storage.Mongo)
-CONCELIER-LNM-21-201 `Observation APIs` | TODO | Add REST endpoints for advisory observations (`GET /advisories/observations`) with filters (alias, purl, source), pagination, and tenancy enforcement. Dependencies: CONCELIER-LNM-21-103. | Concelier WebService Guild, BE-Base Platform Guild (src/Concelier/StellaOps.Concelier.WebService)
-CONCELIER-LNM-21-202 `Linkset APIs` | TODO | Implement linkset read/export endpoints (`/advisories/linksets/{id}`, `/advisories/by-purl/{purl}`, `/advisories/linksets/{id}/export`, `/evidence`) with correlation/conflict payloads and `ERR_AGG_*` mapping. Dependencies: CONCELIER-LNM-21-201. | Concelier WebService Guild (src/Concelier/StellaOps.Concelier.WebService)
-CONCELIER-LNM-21-203 `Ingest events` | TODO | Publish NATS/Redis events for new observations/linksets and ensure idempotent consumer contracts; document event schemas. Dependencies: CONCELIER-LNM-21-202. | Concelier WebService Guild, Platform Events Guild (src/Concelier/StellaOps.Concelier.WebService)
\ No newline at end of file
+CONCELIER-GRAPH-21-001 `SBOM projection enrichment` | BLOCKED (2025-10-27) | Extend SBOM normalization so every relationship (depends_on, contains, provides) and scope tag is captured as raw observation metadata with provenance pointers; Cartographer can then join SBOM + advisory facts without Concelier inferring impact. | Concelier Core Guild, Cartographer Guild (src/Concelier/__Libraries/StellaOps.Concelier.Core)
+CONCELIER-GRAPH-21-002 `Change events` | BLOCKED (2025-10-27) | Publish `sbom.observation.updated` events whenever new SBOM versions arrive, including tenant/context metadata and advisory references—never send judgments, only facts. Depends on CONCELIER-GRAPH-21-001. | Concelier Core Guild, Scheduler Guild (src/Concelier/__Libraries/StellaOps.Concelier.Core)
+CONCELIER-GRAPH-24-101 `Advisory summary API` | TODO | Provide `/advisories/summary` responses that bundle observation/linkset metadata (aliases, confidence, conflicts) for graph overlays while keeping upstream values intact. Depends on CONCELIER-GRAPH-21-002. | Concelier WebService Guild (src/Concelier/StellaOps.Concelier.WebService)
+CONCELIER-GRAPH-28-102 `Evidence batch API` | TODO | Add batch fetch endpoints keyed by component sets so graph tooltips can pull raw observations/linksets efficiently; include provenance + timestamps but no derived severity. Depends on CONCELIER-GRAPH-24-101. | Concelier WebService Guild (src/Concelier/StellaOps.Concelier.WebService)
+CONCELIER-LNM-21-001 `Advisory observation schema` | TODO | Define the immutable `advisory_observations` model (per-source fields, version ranges, severity text, provenance metadata, tenant guards) so every ingestion path records raw statements without merge artifacts. | Concelier Core Guild (src/Concelier/__Libraries/StellaOps.Concelier.Core)
+CONCELIER-LNM-21-002 `Linkset builder` | TODO | Implement correlation pipelines (alias graph, purl overlap, CVSS vector compare) that output linksets with confidence scores + conflict markers, never collapsing conflicting facts into single values. Depends on CONCELIER-LNM-21-001. | Concelier Core Guild, Data Science Guild (src/Concelier/__Libraries/StellaOps.Concelier.Core)
+CONCELIER-LNM-21-003 `Conflict annotator` | TODO | Record disagreements (severity, CVSS, references) on linksets as structured conflict entries so consumers can reason about divergence without Concelier resolving it. Depends on CONCELIER-LNM-21-002. | Concelier Core Guild (src/Concelier/__Libraries/StellaOps.Concelier.Core)
+CONCELIER-LNM-21-004 `Merge code removal` | TODO | Delete legacy merge/dedup logic, add guardrails/tests to keep ingestion append-only, and document how linksets supersede the old merge outputs. Depends on CONCELIER-LNM-21-003. | Concelier Core Guild (src/Concelier/__Libraries/StellaOps.Concelier.Core)
+CONCELIER-LNM-21-005 `Event emission` | TODO | Emit `advisory.linkset.updated` events containing delta descriptions + observation ids so downstream evaluators can subscribe deterministically. Depends on CONCELIER-LNM-21-004. | Concelier Core Guild, Platform Events Guild (src/Concelier/__Libraries/StellaOps.Concelier.Core)
+CONCELIER-LNM-21-101 `Observations collections` | TODO | Provision the Mongo collections (`advisory_observations`, `advisory_linksets`) with hashed shard keys, tenant indexes, and TTL for ingest metadata to support Link-Not-Merge at scale. Depends on CONCELIER-LNM-21-005. | Concelier Storage Guild (src/Concelier/__Libraries/StellaOps.Concelier.Storage.Mongo)
+CONCELIER-LNM-21-102 `Migration tooling` | TODO | Backfill legacy merged advisories into the new observation/linkset collections, seed tombstones for deprecated docs, and provide rollback tooling for Offline Kit operators. Depends on CONCELIER-LNM-21-101. | Concelier Storage Guild, DevOps Guild (src/Concelier/__Libraries/StellaOps.Concelier.Storage.Mongo)
+CONCELIER-LNM-21-103 `Blob/store wiring` | TODO | Move large raw payloads to object storage with deterministic pointers, update bootstrapper/offline kit seeds, and guarantee provenance metadata remains intact. Depends on CONCELIER-LNM-21-102. | Concelier Storage Guild (src/Concelier/__Libraries/StellaOps.Concelier.Storage.Mongo)
+CONCELIER-LNM-21-201 `Observation APIs` | TODO | Add `/advisories/observations` with filters for alias/purl/source plus strict tenant scopes; responses must only echo upstream values + provenance fields. Depends on CONCELIER-LNM-21-103. | Concelier WebService Guild, BE-Base Platform Guild (src/Concelier/StellaOps.Concelier.WebService)
+CONCELIER-LNM-21-202 `Linkset APIs` | TODO | Implement `/advisories/linksets`/`export`/`evidence` endpoints surfacing correlation + conflict payloads and `ERR_AGG_*` error mapping, never exposing synthesis/merge results. Depends on CONCELIER-LNM-21-201. | Concelier WebService Guild (src/Concelier/StellaOps.Concelier.WebService)
+CONCELIER-LNM-21-203 `Ingest events` | TODO | Publish idempotent NATS/Redis events for new observations/linksets with schemas documented for downstream consumers; include tenant + provenance references only. Depends on CONCELIER-LNM-21-202. | Concelier WebService Guild, Platform Events Guild (src/Concelier/StellaOps.Concelier.WebService)
diff --git a/docs/implplan/SPRINT_114_concelier_iii.md b/docs/implplan/SPRINT_114_concelier_iii.md
index 8d887e55d..a9aea2283 100644
--- a/docs/implplan/SPRINT_114_concelier_iii.md
+++ b/docs/implplan/SPRINT_114_concelier_iii.md
@@ -1,23 +1,23 @@
# Sprint 114 - Ingestion & Evidence · 110.B) Concelier.III
-Active items only. Completed/historic work now resides in docs/implplan/archived_sprints_tasks.md (updated 2025-11-08).
+Active items only. Completed/historic work now resides in docs/implplan/archived/tasks.md (updated 2025-11-08).
[Ingestion & Evidence] 110.B) Concelier.III
Depends on: Sprint 110.B - Concelier.II
Summary: Ingestion & Evidence focus on Concelier (phase III).
Task ID | State | Task description | Owners (Source)
--- | --- | --- | ---
-CONCELIER-OAS-61-001 `Spec coverage` | TODO | Update Concelier OAS with advisory observation/linkset endpoints, standard pagination, and source provenance fields. | Concelier Core Guild, API Contracts Guild (src/Concelier/__Libraries/StellaOps.Concelier.Core)
-CONCELIER-OAS-61-002 `Examples library` | TODO | Provide rich examples for advisories, linksets, conflict annotations used by SDK + docs. Dependencies: CONCELIER-OAS-61-001. | Concelier Core Guild (src/Concelier/__Libraries/StellaOps.Concelier.Core)
-CONCELIER-OAS-62-001 `SDK smoke tests` | TODO | Add SDK tests covering advisory search, pagination, and conflict handling; ensure source metadata surfaced. Dependencies: CONCELIER-OAS-61-002. | Concelier Core Guild, SDK Generator Guild (src/Concelier/__Libraries/StellaOps.Concelier.Core)
-CONCELIER-OAS-63-001 `Deprecation headers` | TODO | Implement deprecation header support and timeline events for retiring endpoints. Dependencies: CONCELIER-OAS-62-001. | Concelier Core Guild, API Governance Guild (src/Concelier/__Libraries/StellaOps.Concelier.Core)
-CONCELIER-OBS-51-001 `Metrics & SLOs` | TODO | Emit metrics for ingest latency (cold/warm), queue depth, aoc violation rate, and publish SLO burn-rate alerts (ingest P95 <30s cold / <5s warm). Ship dashboards + alert configs. Dependencies: CONCELIER-OBS-50-001. | Concelier Core Guild, DevOps Guild (src/Concelier/__Libraries/StellaOps.Concelier.Core)
-CONCELIER-OBS-52-001 `Timeline events` | TODO | Emit `timeline_event` records for advisory ingest/normalization/linkset creation with provenance, trace IDs, conflict summaries, and evidence placeholders. Dependencies: CONCELIER-OBS-51-001. | Concelier Core Guild (src/Concelier/__Libraries/StellaOps.Concelier.Core)
-CONCELIER-OBS-53-001 `Evidence snapshots` | TODO | Produce advisory evaluation bundle payloads (raw doc, linkset, normalization diff) for evidence locker; ensure Merkle manifests seeded with content hashes. Dependencies: CONCELIER-OBS-52-001. | Concelier Core Guild, Evidence Locker Guild (src/Concelier/__Libraries/StellaOps.Concelier.Core)
-CONCELIER-OBS-54-001 `Attestation & verification` | TODO | Attach DSSE attestations for advisory processing batches, expose verification API to confirm bundle integrity, and link attestation IDs back to timeline + ledger. Dependencies: CONCELIER-OBS-53-001. | Concelier Core Guild, Provenance Guild (src/Concelier/__Libraries/StellaOps.Concelier.Core)
-CONCELIER-OBS-55-001 `Incident mode hooks` | TODO | Increase sampling, capture raw payload snapshots, and extend retention under incident mode; emit activation events + guardrails against PII leak. Dependencies: CONCELIER-OBS-54-001. | Concelier Core Guild, DevOps Guild (src/Concelier/__Libraries/StellaOps.Concelier.Core)
-CONCELIER-ORCH-32-001 `Source registry integration` | TODO | Register Concelier data sources with orchestrator (metadata, schedules, rate policies) and wire provenance IDs/security scopes. | Concelier Core Guild (src/Concelier/__Libraries/StellaOps.Concelier.Core)
-CONCELIER-ORCH-32-002 `Worker SDK adoption` | TODO | Embed orchestrator worker SDK in ingestion loops, emit heartbeats/progress/artifact hashes, and enforce idempotency keys. Dependencies: CONCELIER-ORCH-32-001. | Concelier Core Guild (src/Concelier/__Libraries/StellaOps.Concelier.Core)
-CONCELIER-ORCH-33-001 `Control hook compliance` | TODO | Honor orchestrator throttle/pause/retry actions, surface structured error classes, and persist safe checkpoints for resume. Dependencies: CONCELIER-ORCH-32-002. | Concelier Core Guild (src/Concelier/__Libraries/StellaOps.Concelier.Core)
-CONCELIER-ORCH-34-001 `Backfill + ledger linkage` | TODO | Execute orchestrator-driven backfills, reuse artifact hashes to avoid duplicates, and link provenance to run ledger exports. Dependencies: CONCELIER-ORCH-33-001. | Concelier Core Guild (src/Concelier/__Libraries/StellaOps.Concelier.Core)
-CONCELIER-POLICY-20-001 `Policy selection endpoints` | TODO | Add batch advisory lookup APIs (`/policy/select/advisories`, `/policy/select/vex`) optimized for PURL/ID lists with pagination, tenant scoping, and explain metadata. | Concelier WebService Guild (src/Concelier/StellaOps.Concelier.WebService)
\ No newline at end of file
+CONCELIER-OAS-61-001 `Spec coverage` | TODO | Update the OpenAPI spec so every observation/linkset/timeline endpoint documents provenance fields, tenant scopes, and AOC guarantees (no consensus fields), giving downstream SDKs unambiguous contracts. | Concelier Core Guild, API Contracts Guild (src/Concelier/__Libraries/StellaOps.Concelier.Core)
+CONCELIER-OAS-61-002 `Examples library` | TODO | Provide realistic examples (conflict linksets, multi-source severity, timeline snippets) showing how raw advisories are surfaced without merges; wire them into docs/SDKs. Depends on CONCELIER-OAS-61-001. | Concelier Core Guild (src/Concelier/__Libraries/StellaOps.Concelier.Core)
+CONCELIER-OAS-62-001 `SDK smoke tests` | TODO | Add SDK scenarios covering advisory search, pagination, and conflict handling to ensure each language client preserves provenance fields and does not infer verdicts. Depends on CONCELIER-OAS-61-002. | Concelier Core Guild, SDK Generator Guild (src/Concelier/__Libraries/StellaOps.Concelier.Core)
+CONCELIER-OAS-63-001 `Deprecation headers` | TODO | Implement Sunset/Deprecation headers + timeline notices for legacy endpoints being retired, keeping operators informed while discouraging use of merge-era APIs. Depends on CONCELIER-OAS-62-001. | Concelier Core Guild, API Governance Guild (src/Concelier/__Libraries/StellaOps.Concelier.Core)
+CONCELIER-OBS-51-001 `Metrics & SLOs` | TODO | Emit ingestion latency, queue depth, and AOC violation metrics with burn-rate alerts so we can prove the evidence pipeline remains healthy without resorting to heuristics. | Concelier Core Guild, DevOps Guild (src/Concelier/__Libraries/StellaOps.Concelier.Core)
+CONCELIER-OBS-52-001 `Timeline events` | TODO | Produce timeline records for ingest/normalization/linkset updates containing trace IDs, conflict summaries, and evidence hashes—pure facts for downstream replay. Depends on CONCELIER-OBS-51-001. | Concelier Core Guild (src/Concelier/__Libraries/StellaOps.Concelier.Core)
+CONCELIER-OBS-53-001 `Evidence snapshots` | TODO | Generate evidence locker bundles (raw doc, normalization diff, linkset) with Merkle manifests so audits can replay advisory history without touching live Mongo. Depends on CONCELIER-OBS-52-001. | Concelier Core Guild, Evidence Locker Guild (src/Concelier/__Libraries/StellaOps.Concelier.Core)
+CONCELIER-OBS-54-001 `Attestation & verification` | TODO | Attach DSSE attestations to advisory batches, expose verification APIs, and link attestation IDs into timeline + ledger for transparency. Depends on CONCELIER-OBS-53-001. | Concelier Core Guild, Provenance Guild (src/Concelier/__Libraries/StellaOps.Concelier.Core)
+CONCELIER-OBS-55-001 `Incident mode hooks` | TODO | Implement incident-mode levers (extra sampling, retention overrides, redaction guards) that collect more raw evidence without mutating advisory content. Depends on CONCELIER-OBS-54-001. | Concelier Core Guild, DevOps Guild (src/Concelier/__Libraries/StellaOps.Concelier.Core)
+CONCELIER-ORCH-32-001 `Source registry integration` | TODO | Register every advisory connector with the orchestrator (metadata, auth scopes, rate policies) so ingest scheduling is transparent and reproducible. | Concelier Core Guild (src/Concelier/__Libraries/StellaOps.Concelier.Core)
+CONCELIER-ORCH-32-002 `Worker SDK adoption` | TODO | Adopt the orchestrator worker SDK in ingestion loops, emitting heartbeats/progress/artifact hashes to guarantee deterministic replays. Depends on CONCELIER-ORCH-32-001. | Concelier Core Guild (src/Concelier/__Libraries/StellaOps.Concelier.Core)
+CONCELIER-ORCH-33-001 `Control hook compliance` | TODO | Honor orchestrator pause/throttle/retry controls with structured error outputs and persisted checkpoints so operators can intervene without losing evidence. Depends on CONCELIER-ORCH-32-002. | Concelier Core Guild (src/Concelier/__Libraries/StellaOps.Concelier.Core)
+CONCELIER-ORCH-34-001 `Backfill + ledger linkage` | TODO | Execute orchestrator-driven backfills that reuse artifact hashes/signatures, log provenance, and push run metadata to the ledger for audits. Depends on CONCELIER-ORCH-33-001. | Concelier Core Guild (src/Concelier/__Libraries/StellaOps.Concelier.Core)
+CONCELIER-POLICY-20-001 `Policy selection endpoints` | TODO | Provide batch advisory lookup APIs for Policy Engine (purl/advisory filters, tenant scopes, explain metadata) so policy can join raw evidence without Concelier suggesting outcomes. | Concelier WebService Guild (src/Concelier/StellaOps.Concelier.WebService)
diff --git a/docs/implplan/SPRINT_115_concelier_iv.md b/docs/implplan/SPRINT_115_concelier_iv.md
index 85c52e464..d32e12bd1 100644
--- a/docs/implplan/SPRINT_115_concelier_iv.md
+++ b/docs/implplan/SPRINT_115_concelier_iv.md
@@ -1,22 +1,22 @@
# Sprint 115 - Ingestion & Evidence · 110.B) Concelier.IV
-Active items only. Completed/historic work now resides in docs/implplan/archived_sprints_tasks.md (updated 2025-11-08).
+Active items only. Completed/historic work now resides in docs/implplan/archived/tasks.md (updated 2025-11-08).
[Ingestion & Evidence] 110.B) Concelier.IV
Depends on: Sprint 110.B - Concelier.III
Summary: Ingestion & Evidence focus on Concelier (phase IV).
Task ID | State | Task description | Owners (Source)
--- | --- | --- | ---
-CONCELIER-POLICY-20-002 `Linkset enrichment for policy` | TODO | Strengthen linkset builders with vendor-specific equivalence tables, NEVRA/PURL normalization, and version range parsing to maximize policy join recall; update fixtures + docs. Dependencies: CONCELIER-POLICY-20-001. | Concelier Core Guild, Policy Guild (src/Concelier/__Libraries/StellaOps.Concelier.Core)
-CONCELIER-POLICY-20-003 `Selection cursors` | TODO | Add advisory/vex selection cursors (per policy run) with change stream checkpoints, indexes, and offline migration scripts to support incremental evaluations. Dependencies: CONCELIER-POLICY-20-002. | Concelier Storage Guild (src/Concelier/__Libraries/StellaOps.Concelier.Storage.Mongo)
-CONCELIER-POLICY-23-001 `Evidence indexes` | TODO | Add secondary indexes/materialized views to accelerate policy lookups (alias, provider severity per observation, correlation confidence). Document query contracts for runtime. Dependencies: CONCELIER-POLICY-20-003. | Concelier Core Guild (src/Concelier/__Libraries/StellaOps.Concelier.Core)
-CONCELIER-POLICY-23-002 `Event guarantees` | TODO | Ensure `advisory.linkset.updated` emits at-least-once with idempotent keys and include policy-relevant metadata (confidence, conflict summary). Dependencies: CONCELIER-POLICY-23-001. | Concelier Core Guild, Platform Events Guild (src/Concelier/__Libraries/StellaOps.Concelier.Core)
-CONCELIER-RISK-66-001 `CVSS/KEV providers` | TODO | Expose CVSS, KEV, fix availability data via provider APIs with source metadata preserved. Dependencies: RISK-ENGINE-67-001. | Concelier Core Guild, Risk Engine Guild (src/Concelier/__Libraries/StellaOps.Concelier.Core)
-CONCELIER-RISK-66-002 `Fix availability signals` | TODO | Provide structured fix availability and release metadata consumable by risk engine; document provenance. Dependencies: CONCELIER-RISK-66-001. | Concelier Core Guild (src/Concelier/__Libraries/StellaOps.Concelier.Core)
-CONCELIER-RISK-67-001 `Source coverage metrics` | TODO | Add per-source coverage metrics for linked advisories (observation counts, conflicting statuses) without computing consensus scores; ensure explainability includes source digests. Dependencies: CONCELIER-RISK-66-001. | Concelier Core Guild (src/Concelier/__Libraries/StellaOps.Concelier.Core)
-CONCELIER-RISK-68-001 `Policy Studio integration` | TODO | Surface advisory fields in Policy Studio profile editor (signal pickers, reducers). Dependencies: POLICY-RISK-68-001. | Concelier Core Guild, Policy Studio Guild (src/Concelier/__Libraries/StellaOps.Concelier.Core)
-CONCELIER-RISK-69-001 `Notification hooks` | TODO | Emit events when advisory signals change impacting risk scores (e.g., fix available). Dependencies: CONCELIER-RISK-66-002. | Concelier Core Guild, Notifications Guild (src/Concelier/__Libraries/StellaOps.Concelier.Core)
-CONCELIER-SIG-26-001 `Vulnerable symbol exposure` | TODO | Expose advisory metadata (affected symbols/functions) via API to enrich reachability scoring; update fixtures. Dependencies: SIGNALS-24-002. | Concelier Core Guild, Signals Guild (src/Concelier/__Libraries/StellaOps.Concelier.Core)
-CONCELIER-STORE-AOC-19-005 `Raw linkset backfill` | TODO (2025-11-04) | Plan and execute advisory_observations `rawLinkset` backfill (online + Offline Kit bundles), supply migration scripts + rehearse rollback. Follow the coordination plan in `docs/dev/raw-linkset-backfill-plan.md`. Dependencies: CONCELIER-CORE-AOC-19-004. | Concelier Storage Guild, DevOps Guild (src/Concelier/__Libraries/StellaOps.Concelier.Storage.Mongo)
-CONCELIER-TEN-48-001 `Tenant-aware linking` | TODO | Ensure advisory normalization/linking runs per tenant with RLS enforcing isolation; emit capability endpoint reporting `merge=false`; update events with tenant context. Dependencies: AUTH-TEN-47-001. | Concelier Core Guild (src/Concelier/__Libraries/StellaOps.Concelier.Core)
-CONCELIER-VEXLENS-30-001 `Advisory rationale bridges` | TODO | Guarantee advisory key consistency and cross-links for consensus rationale; Label: VEX-Lens. Dependencies: CONCELIER-VULN-29-001, VEXLENS-30-005. | Concelier WebService Guild, VEX Lens Guild (src/Concelier/StellaOps.Concelier.WebService)
\ No newline at end of file
+CONCELIER-POLICY-20-002 `Linkset enrichment for policy` | TODO | Expand linkset builders with vendor-specific equivalence tables, NEVRA/PURL normalization, and version-range parsing so policy joins become more accurate without Concelier prioritizing sources. Depends on CONCELIER-POLICY-20-001. | Concelier Core Guild, Policy Guild (src/Concelier/__Libraries/StellaOps.Concelier.Core)
+CONCELIER-POLICY-20-003 `Selection cursors` | TODO | Introduce advisory selection cursors + change-stream checkpoints that let Policy Engine process deltas deterministically; include offline migration scripts. Depends on CONCELIER-POLICY-20-002. | Concelier Storage Guild (src/Concelier/__Libraries/StellaOps.Concelier.Storage.Mongo)
+CONCELIER-POLICY-23-001 `Evidence indexes` | TODO | Add secondary indexes/materialized views (alias, provider severity, correlation confidence) so policy lookups stay fast without caching derived verdicts; document the supported query patterns. Depends on CONCELIER-POLICY-20-003. | Concelier Core Guild (src/Concelier/__Libraries/StellaOps.Concelier.Core)
+CONCELIER-POLICY-23-002 `Event guarantees` | TODO | Ensure `advisory.linkset.updated` events ship with idempotent IDs, confidence summaries, and tenant metadata so policy consumers can replay evidence feeds safely. Depends on CONCELIER-POLICY-23-001. | Concelier Core Guild, Platform Events Guild (src/Concelier/__Libraries/StellaOps.Concelier.Core)
+CONCELIER-RISK-66-001 `CVSS/KEV providers` | TODO | Surface vendor-provided CVSS/KEV/fix data exactly as published (with provenance anchors) through provider APIs so risk engines can reason about upstream intent. | Concelier Core Guild, Risk Engine Guild (src/Concelier/__Libraries/StellaOps.Concelier.Core)
+CONCELIER-RISK-66-002 `Fix availability signals` | TODO | Emit structured fix-availability metadata per observation/linkset (release version, advisory link, evidence timestamp) without guessing exploitability. Depends on CONCELIER-RISK-66-001. | Concelier Core Guild (src/Concelier/__Libraries/StellaOps.Concelier.Core)
+CONCELIER-RISK-67-001 `Source coverage metrics` | TODO | Publish per-source coverage/conflict metrics (counts, disagreements) so explainers can cite which upstream statements exist; no weighting is applied inside Concelier. Depends on CONCELIER-RISK-66-001. | Concelier Core Guild (src/Concelier/__Libraries/StellaOps.Concelier.Core)
+CONCELIER-RISK-68-001 `Policy Studio integration` | TODO | Wire advisory signal pickers into Policy Studio so curators can select which raw advisory fields feed policy gating; validation must confirm fields are provenance-backed. Depends on POLICY-RISK-68-001. | Concelier Core Guild, Policy Studio Guild (src/Concelier/__Libraries/StellaOps.Concelier.Core)
+CONCELIER-RISK-69-001 `Notification hooks` | TODO | Emit notifications when upstream advisory fields change (e.g., fix available) with observation IDs + provenance so Notifications service can alert without inferring severity. Depends on CONCELIER-RISK-66-002. | Concelier Core Guild, Notifications Guild (src/Concelier/__Libraries/StellaOps.Concelier.Core)
+CONCELIER-SIG-26-001 `Vulnerable symbol exposure` | TODO | Expose upstream-provided affected symbol/function lists via APIs to help reachability scoring; maintain provenance and do not infer exploitability. Depends on SIGNALS-24-002. | Concelier Core Guild, Signals Guild (src/Concelier/__Libraries/StellaOps.Concelier.Core)
+CONCELIER-STORE-AOC-19-005 `Raw linkset backfill` | TODO (2025-11-04) | Execute the raw-linkset backfill/rollback plan (`docs/dev/raw-linkset-backfill-plan.md`) so Mongo + Offline Kit bundles reflect Link-Not-Merge data; rehearse rollback. Depends on CONCELIER-CORE-AOC-19-004. | Concelier Storage Guild, DevOps Guild (src/Concelier/__Libraries/StellaOps.Concelier.Storage.Mongo)
+CONCELIER-TEN-48-001 `Tenant-aware linking` | TODO | Enforce tenant scoping throughout normalization/linking, expose capability endpoint advertising `merge=false`, and ensure events include tenant IDs. Depends on AUTH-TEN-47-001. | Concelier Core Guild (src/Concelier/__Libraries/StellaOps.Concelier.Core)
+CONCELIER-VEXLENS-30-001 `Advisory rationale bridges` | TODO | Guarantee advisory key consistency and cross-links consumed by VEX Lens so consensus explanations can cite Concelier evidence without requesting merges. Depends on CONCELIER-VULN-29-001, VEXLENS-30-005. | Concelier WebService Guild, VEX Lens Guild (src/Concelier/StellaOps.Concelier.WebService)
diff --git a/docs/implplan/SPRINT_116_concelier_v.md b/docs/implplan/SPRINT_116_concelier_v.md
index cf6df11d6..4def86b60 100644
--- a/docs/implplan/SPRINT_116_concelier_v.md
+++ b/docs/implplan/SPRINT_116_concelier_v.md
@@ -1,24 +1,24 @@
# Sprint 116 - Ingestion & Evidence · 110.B) Concelier.V
-Active items only. Completed/historic work now resides in docs/implplan/archived_sprints_tasks.md (updated 2025-11-08).
+Active items only. Completed/historic work now resides in docs/implplan/archived/tasks.md (updated 2025-11-08).
[Ingestion & Evidence] 110.B) Concelier.V
Depends on: Sprint 110.B - Concelier.IV
Summary: Ingestion & Evidence focus on Concelier (phase V).
Task ID | State | Task description | Owners (Source)
--- | --- | --- | ---
-CONCELIER-VULN-29-004 `Observability enhancements` | TODO | Instrument metrics/logs for observation + linkset pipelines (identifier collisions, withdrawn flags) and emit events consumed by Vuln Explorer resolver. Dependencies: CONCELIER-VULN-29-001. | Concelier WebService Guild, Observability Guild (src/Concelier/StellaOps.Concelier.WebService)
-CONCELIER-WEB-AIRGAP-56-001 `Mirror import APIs` | TODO | Extend ingestion endpoints to register mirror bundle sources, expose bundle catalog queries, and block external feed URLs in sealed mode. | Concelier WebService Guild (src/Concelier/StellaOps.Concelier.WebService)
-CONCELIER-WEB-AIRGAP-56-002 `Airgap status surfaces` | TODO | Add staleness metadata and bundle provenance to advisory APIs (`/advisories/observations`, `/advisories/linksets`). Dependencies: CONCELIER-WEB-AIRGAP-56-001. | Concelier WebService Guild (src/Concelier/StellaOps.Concelier.WebService)
-CONCELIER-WEB-AIRGAP-57-001 `Error remediation` | TODO | Map sealed-mode violations to `AIRGAP_EGRESS_BLOCKED` responses with user guidance. Dependencies: CONCELIER-WEB-AIRGAP-56-002. | Concelier WebService Guild, AirGap Policy Guild (src/Concelier/StellaOps.Concelier.WebService)
-CONCELIER-WEB-AIRGAP-58-001 `Import timeline emission` | TODO | Emit timeline events for bundle ingestion operations with bundle ID, scope, and actor metadata. Dependencies: CONCELIER-WEB-AIRGAP-57-001. | Concelier WebService Guild, AirGap Importer Guild (src/Concelier/StellaOps.Concelier.WebService)
-CONCELIER-WEB-AOC-19-003 `Schema/guard unit tests` | TODO | Add unit tests covering schema validation failures, forbidden field rejections (`ERR_AOC_001/002/006/007`), idempotent upserts, and supersedes chains using deterministic fixtures. Dependencies: CONCELIER-WEB-AOC-19-002. | QA Guild (src/Concelier/StellaOps.Concelier.WebService)
-CONCELIER-WEB-AOC-19-004 `End-to-end ingest verification` | TODO | Create integration tests ingesting large advisory batches (cold/warm) validating linkset enrichment, metrics emission, and reproducible outputs. Capture load-test scripts + doc notes for Offline Kit dry runs. Dependencies: CONCELIER-WEB-AOC-19-003. | Concelier WebService Guild, QA Guild (src/Concelier/StellaOps.Concelier.WebService)
-CONCELIER-WEB-AOC-19-005 `Chunk evidence regression` | TODO (2025-11-08) | Fix `/advisories/{key}/chunks` fixture seeding so AdvisoryChunksEndpoint tests stop returning 404/not-found when raw documents are pre-populated; ensure the Mongo migration no longer emits “Unable to locate advisory_raw documents” during WebService test boot. Dependencies: CONCELIER-WEB-AOC-19-002. | Concelier WebService Guild, QA Guild (src/Concelier/StellaOps.Concelier.WebService)
-CONCELIER-WEB-AOC-19-006 `Allowlist ingest auth parity` | TODO (2025-11-08) | Align WebService auth defaults with the test tokens so the allowlisted tenant can create an advisory before forbidden tenants are rejected in `AdvisoryIngestEndpoint_RejectsTenantOutsideAllowlist`. Dependencies: CONCELIER-WEB-AOC-19-002. | Concelier WebService Guild (src/Concelier/StellaOps.Concelier.WebService)
-CONCELIER-WEB-AOC-19-007 `AOC verify violation codes` | TODO (2025-11-08) | Update AOC verify logic/fixtures so guard failures produce the expected `ERR_AOC_001` payload (current regression returns `ERR_AOC_004`) while keeping mapper/guard parity exercised by the new tests. Dependencies: CONCELIER-WEB-AOC-19-002. | Concelier WebService Guild, QA Guild (src/Concelier/StellaOps.Concelier.WebService)
-CONCELIER-WEB-OAS-61-002 `Error envelope migration` | TODO | Ensure all API responses use standardized error envelope; update controllers/tests. Dependencies: CONCELIER-WEB-OAS-61-001. | Concelier WebService Guild (src/Concelier/StellaOps.Concelier.WebService)
-CONCELIER-WEB-OAS-62-001 `Examples expansion` | TODO | Add curated examples for advisory observations/linksets/conflicts; integrate into dev portal. Dependencies: CONCELIER-WEB-OAS-61-002. | Concelier WebService Guild (src/Concelier/StellaOps.Concelier.WebService)
-CONCELIER-WEB-OAS-63-001 `Deprecation headers` | TODO | Add Sunset/Deprecation headers for retiring endpoints and update documentation/notifications. Dependencies: CONCELIER-WEB-OAS-62-001. | Concelier WebService Guild, API Governance Guild (src/Concelier/StellaOps.Concelier.WebService)
-CONCELIER-WEB-OBS-51-001 `Observability APIs` | TODO | Surface ingest health metrics, queue depth, and SLO status via `/obs/concelier/health` endpoint for Console widgets, with caching and tenant partitioning. Dependencies: CONCELIER-WEB-OBS-50-001. | Concelier WebService Guild (src/Concelier/StellaOps.Concelier.WebService)
-CONCELIER-WEB-OBS-52-001 `Timeline streaming` | TODO | Provide SSE stream `/obs/concelier/timeline` bridging to Timeline Indexer with paging tokens, guardrails, and audit logging. Dependencies: CONCELIER-WEB-OBS-51-001. | Concelier WebService Guild (src/Concelier/StellaOps.Concelier.WebService)
\ No newline at end of file
+CONCELIER-VULN-29-004 `Observability enhancements` | TODO | Instrument observation/linkset pipelines with metrics for identifier collisions, withdrawn statements, and chunk latencies; stream them to Vuln Explorer without altering evidence payloads. Depends on CONCELIER-VULN-29-001. | Concelier WebService Guild, Observability Guild (src/Concelier/StellaOps.Concelier.WebService)
+CONCELIER-WEB-AIRGAP-56-001 `Mirror import APIs` | TODO | Extend ingestion endpoints to register mirror bundle sources, expose bundle catalogs, and enforce sealed-mode by blocking direct internet feeds. | Concelier WebService Guild (src/Concelier/StellaOps.Concelier.WebService)
+CONCELIER-WEB-AIRGAP-56-002 `Airgap status surfaces` | TODO | Add staleness + bundle provenance metadata to `/advisories/observations` and `/advisories/linksets` so operators can see freshness without Excitior deriving outcomes. Depends on CONCELIER-WEB-AIRGAP-56-001. | Concelier WebService Guild (src/Concelier/StellaOps.Concelier.WebService)
+CONCELIER-WEB-AIRGAP-57-001 `Error remediation` | TODO | Map sealed-mode violations to consistent `AIRGAP_EGRESS_BLOCKED` payloads that explain how to remediate, leaving advisory content untouched. Depends on CONCELIER-WEB-AIRGAP-56-002. | Concelier WebService Guild, AirGap Policy Guild (src/Concelier/StellaOps.Concelier.WebService)
+CONCELIER-WEB-AIRGAP-58-001 `Import timeline emission` | TODO | Emit timeline events for bundle imports (bundle ID, scope, actor) so audit trails capture every evidence change. Depends on CONCELIER-WEB-AIRGAP-57-001. | Concelier WebService Guild, AirGap Importer Guild (src/Concelier/StellaOps.Concelier.WebService)
+CONCELIER-WEB-AOC-19-003 `Schema/guard unit tests` | TODO | Add unit tests for schema validators, forbidden-field guards (`ERR_AOC_001/2/6/7`), and supersedes chains to keep ingestion append-only. Depends on CONCELIER-WEB-AOC-19-002. | QA Guild (src/Concelier/StellaOps.Concelier.WebService)
+CONCELIER-WEB-AOC-19-004 `End-to-end ingest verification` | TODO | Create integration tests that ingest large advisory batches (cold/warm), verify reproducible linksets, and record metrics/fixtures for Offline Kit rehearsals. Depends on CONCELIER-WEB-AOC-19-003. | Concelier WebService Guild, QA Guild (src/Concelier/StellaOps.Concelier.WebService)
+CONCELIER-WEB-AOC-19-005 `Chunk evidence regression` | TODO (2025-11-08) | Fix `/advisories/{key}/chunks` test data so pre-seeded raw docs resolve correctly; ensure Mongo migrations stop logging “Unable to locate advisory_raw documents” during tests. Depends on CONCELIER-WEB-AOC-19-002. | Concelier WebService Guild, QA Guild (src/Concelier/StellaOps.Concelier.WebService)
+CONCELIER-WEB-AOC-19-006 `Allowlist ingest auth parity` | TODO (2025-11-08) | Align default auth/tenant configs with the test fixtures so allowlisted tenants can ingest before forbidden tenants are rejected, closing the gap in `AdvisoryIngestEndpoint_RejectsTenantOutsideAllowlist`. Depends on CONCELIER-WEB-AOC-19-002. | Concelier WebService Guild (src/Concelier/StellaOps.Concelier.WebService)
+CONCELIER-WEB-AOC-19-007 `AOC verify violation codes` | TODO (2025-11-08) | Update AOC verify logic so guard failures emit `ERR_AOC_001` (not `_004`) and keep mapper/guard parity covered by regression tests. Depends on CONCELIER-WEB-AOC-19-002. | Concelier WebService Guild, QA Guild (src/Concelier/StellaOps.Concelier.WebService)
+CONCELIER-WEB-OAS-61-002 `Error envelope migration` | TODO | Ensure every API returns the standardized error envelope and update controllers/tests accordingly (prereq for SDK/doc alignment). | Concelier WebService Guild (src/Concelier/StellaOps.Concelier.WebService)
+CONCELIER-WEB-OAS-62-001 `Examples expansion` | TODO | Publish curated examples for observations/linksets/conflicts and wire them into the developer portal. Depends on CONCELIER-WEB-OAS-61-002. | Concelier WebService Guild (src/Concelier/StellaOps.Concelier.WebService)
+CONCELIER-WEB-OAS-63-001 `Deprecation headers` | TODO | Emit deprecation headers + notifications for retiring endpoints, steering clients toward Link-Not-Merge APIs. Depends on CONCELIER-WEB-OAS-62-001. | Concelier WebService Guild, API Governance Guild (src/Concelier/StellaOps.Concelier.WebService)
+CONCELIER-WEB-OBS-51-001 `Observability APIs` | TODO | Add `/obs/concelier/health` surfaces for ingest health, queue depth, and SLO status so Console widgets can display real-time evidence pipeline stats. Depends on CONCELIER-WEB-OBS-50-001. | Concelier WebService Guild (src/Concelier/StellaOps.Concelier.WebService)
+CONCELIER-WEB-OBS-52-001 `Timeline streaming` | TODO | Provide SSE stream `/obs/concelier/timeline` with paging tokens, guardrails, and audit logging so operators can monitor evidence changes live. Depends on CONCELIER-WEB-OBS-51-001. | Concelier WebService Guild (src/Concelier/StellaOps.Concelier.WebService)
diff --git a/docs/implplan/SPRINT_117_concelier_vi.md b/docs/implplan/SPRINT_117_concelier_vi.md
index 977629ee2..71df6e749 100644
--- a/docs/implplan/SPRINT_117_concelier_vi.md
+++ b/docs/implplan/SPRINT_117_concelier_vi.md
@@ -1,19 +1,16 @@
# Sprint 117 - Ingestion & Evidence · 110.B) Concelier.VI
-Active items only. Completed/historic work now resides in docs/implplan/archived_sprints_tasks.md (updated 2025-11-08).
+Active items only. Completed/historic work now resides in docs/implplan/archived/tasks.md (updated 2025-11-08).
[Ingestion & Evidence] 110.B) Concelier.VI
Depends on: Sprint 110.B - Concelier.V
Summary: Ingestion & Evidence focus on Concelier (phase VI).
Task ID | State | Task description | Owners (Source)
--- | --- | --- | ---
-CONCELIER-WEB-OBS-53-001 `Evidence locker integration` | TODO | Add `/evidence/advisories/*` routes invoking evidence locker snapshots, verifying tenant scopes (`evidence:read`), and returning signed manifest metadata. Dependencies: CONCELIER-WEB-OBS-52-001. | Concelier WebService Guild, Evidence Locker Guild (src/Concelier/StellaOps.Concelier.WebService)
-CONCELIER-WEB-OBS-54-001 `Attestation exposure` | TODO | Provide `/attestations/advisories/*` read APIs surfacing DSSE status, verification summary, and provenance chain for Console/CLI. Dependencies: CONCELIER-WEB-OBS-53-001. | Concelier WebService Guild (src/Concelier/StellaOps.Concelier.WebService)
-CONCELIER-WEB-OBS-55-001 `Incident mode toggles` | TODO | Implement incident mode toggle endpoints, propagate to orchestrator/locker, and document cooldown/backoff semantics. Dependencies: CONCELIER-WEB-OBS-54-001. | Concelier WebService Guild, DevOps Guild (src/Concelier/StellaOps.Concelier.WebService)
-FEEDCONN-CCCS-02-009 Version range provenance (Oct 2025) | BE-Conn-CCCS | **TODO (due 2025-10-21)** – Map CCCS advisories into the new `advisory_observations.affected.versions[]` structure, preserving each upstream range with provenance anchors (`cccs:{serial}:{index}`) and normalized comparison keys. Update mapper tests/fixtures for the Link-Not-Merge schema and verify linkset builders consume the ranges without relying on legacy merge counters.
2025-10-29: `docs/dev/normalized-rule-recipes.md` now documents helper snippets for building observation version entries—use them instead of merge-specific builders and refresh fixtures with `UPDATE_CCCS_FIXTURES=1`. | CONCELIER-LNM-21-001 (src/Concelier/__Libraries/StellaOps.Concelier.Connector.Cccs)
-FEEDCONN-CERTBUND-02-010 Version range provenance | BE-Conn-CERTBUND | **TODO (due 2025-10-22)** – Translate `product.Versions` phrases (e.g., `2023.1 bis 2024.2`, `alle`) into comparison helpers for `advisory_observations.affected.versions[]`, capturing provenance (`certbund:{advisoryId}:{vendor}`) and localisation notes. Update mapper/tests for the Link-Not-Merge schema and refresh documentation accordingly. | CONCELIER-LNM-21-001 (src/Concelier/__Libraries/StellaOps.Concelier.Connector.CertBund)
-FEEDCONN-CISCO-02-009 SemVer range provenance | BE-Conn-Cisco | **DOING (2025-11-08)** – Emitting Cisco SemVer ranges into `advisory_observations.affected.versions[]` with provenance identifiers (`cisco:{productId}`) and deterministic comparison keys. Updating mapper/tests for the Link-Not-Merge schema and replacing legacy merge counter checks with observation/linkset validation. | CONCELIER-LNM-21-001 (src/Concelier/__Libraries/StellaOps.Concelier.Connector.Vndr.Cisco)
-FEEDMERGE-COORD-02-901 Connector deadline check-ins | DROPPED (2025-11-07) | Scope removed: FeedMerge coordination requires an AOC policy that does not exist yet. Re-open once governance/ownership is defined. | —
-FEEDMERGE-COORD-02-902 ICS-CISA version comparison support | DROPPED (2025-11-07) | Blocked on FEEDMERGE policy/ownership; dropped alongside 02-901. | —
-FEEDMERGE-COORD-02-903 KISA firmware scheme review | DROPPED (2025-11-07) | Blocked on FEEDMERGE policy/ownership; dropped alongside 02-901. | —
-DOCS-LNM-22-008 | DONE (2025-11-03) | Write `/docs/migration/no-merge.md` describing migration plan, backfill steps, rollback procedures, and feature-flag toggles for Link-Not-Merge rollout. | Docs Guild, DevOps Guild (docs)
+CONCELIER-WEB-OBS-53-001 `Evidence locker integration` | TODO | Add `/evidence/advisories/*` routes that proxy evidence locker snapshots, verify `evidence:read` scopes, and return signed manifest metadata—no shortcut paths into raw storage. Depends on CONCELIER-WEB-OBS-52-001. | Concelier WebService Guild, Evidence Locker Guild (src/Concelier/StellaOps.Concelier.WebService)
+CONCELIER-WEB-OBS-54-001 `Attestation exposure` | TODO | Provide `/attestations/advisories/*` endpoints surfacing DSSE status, verification summary, and provenance chain so CLI/Console can audit trust without hitting databases. Depends on CONCELIER-WEB-OBS-53-001. | Concelier WebService Guild (src/Concelier/StellaOps.Concelier.WebService)
+CONCELIER-WEB-OBS-55-001 `Incident mode toggles` | TODO | Implement incident-mode APIs that coordinate ingest, locker, and orchestrator, capturing activation events + cooldown semantics but leaving evidence untouched. Depends on CONCELIER-WEB-OBS-54-001. | Concelier WebService Guild, DevOps Guild (src/Concelier/StellaOps.Concelier.WebService)
+FEEDCONN-CCCS-02-009 `Version range provenance (Oct 2025)` | TODO | Emit CCCS version ranges into `advisory_observations.affected.versions[]` with provenance anchors (`cccs:{serial}:{index}`) and normalized comparison keys per the Link-Not-Merge schema/doc recipes. Depends on CONCELIER-LNM-21-001. | Concelier Connector Guild – CCCS (src/Concelier/__Libraries/StellaOps.Concelier.Connector.Cccs)
+FEEDCONN-CERTBUND-02-010 `Version range provenance` | TODO | Translate CERT-Bund `product.Versions` phrases into normalized ranges + provenance identifiers (`certbund:{advisoryId}:{vendor}`) while retaining localisation notes; update mapper/tests for Link-Not-Merge. Depends on CONCELIER-LNM-21-001. | Concelier Connector Guild – CertBund (src/Concelier/__Libraries/StellaOps.Concelier.Connector.CertBund)
+FEEDCONN-CISCO-02-009 `SemVer range provenance` | DOING (2025-11-08) | Emit Cisco SemVer ranges into the new observation schema with provenance IDs (`cisco:{productId}`) and deterministic comparison keys; refresh fixtures to remove merge counters. Depends on CONCELIER-LNM-21-001. | Concelier Connector Guild – Cisco (src/Concelier/__Libraries/StellaOps.Concelier.Connector.Vndr.Cisco)
+DOCS-LNM-22-008 `No-merge migration doc` | DONE (2025-11-03) | Documented Link-Not-Merge migration plan in `docs/migration/no-merge.md`; keep synced with ongoing tasks. | Docs Guild, DevOps Guild (docs)
diff --git a/docs/implplan/SPRINT_118_concelier_vii.md b/docs/implplan/SPRINT_118_concelier_vii.md
deleted file mode 100644
index 113093371..000000000
--- a/docs/implplan/SPRINT_118_concelier_vii.md
+++ /dev/null
@@ -1,9 +0,0 @@
-# Sprint 118 - Ingestion & Evidence · 110.B) Concelier.VII
-
-Active items only. Completed/historic work now resides in docs/implplan/archived_sprints_tasks.md (updated 2025-11-08).
-
-[Ingestion & Evidence] 110.B) Concelier.VII
-Depends on: Sprint 110.B - Concelier.VI
-Summary: Ingestion & Evidence focus on Concelier (phase VII).
-Task ID | State | Task description | Owners (Source)
---- | --- | --- | ---
\ No newline at end of file
diff --git a/docs/implplan/SPRINT_119_excititor_i.md b/docs/implplan/SPRINT_119_excititor_i.md
index 72be76c34..15e827517 100644
--- a/docs/implplan/SPRINT_119_excititor_i.md
+++ b/docs/implplan/SPRINT_119_excititor_i.md
@@ -1,6 +1,6 @@
# Sprint 119 - Ingestion & Evidence · 110.C) Excititor.I
-Active items only. Completed/historic work now resides in docs/implplan/archived_sprints_tasks.md (updated 2025-11-08).
+Active items only. Completed/historic work now resides in docs/implplan/archived/tasks.md (updated 2025-11-08).
[Ingestion & Evidence] 110.C) Excititor.I
Depends on: Sprint 100.A - Attestor
@@ -8,18 +8,14 @@ Summary: Ingestion & Evidence focus on Excititor (phase I).
> **Prep:** Read `docs/modules/excititor/architecture.md` and the relevant Excititor `AGENTS.md` files (per component directory) before working any tasks below; this preserves the guidance that previously lived in the component boards.
Task ID | State | Task description | Owners (Source)
--- | --- | --- | ---
-EXCITITOR-AIAI-31-001 `Justification enrichment` | DOING (2025-11-09) | Expose normalized VEX justifications, product trees, and paragraph anchors for Advisory AI conflict explanations. | Excititor WebService Guild (src/Excititor/StellaOps.Excititor.WebService)
-EXCITITOR-AIAI-31-002 `VEX chunk API` | TODO | Provide `/vex/evidence/chunks` endpoint returning tenant-scoped VEX statements with signature metadata and scope scores for RAG. Dependencies: EXCITITOR-AIAI-31-001. | Excititor WebService Guild (src/Excititor/StellaOps.Excititor.WebService)
-EXCITITOR-AIAI-31-003 `Telemetry` | TODO | Emit metrics/logs for VEX chunk usage, signature verification failures, and guardrail triggers. Dependencies: EXCITITOR-AIAI-31-002. | Excititor WebService Guild, Observability Guild (src/Excititor/StellaOps.Excititor.WebService)
-EXCITITOR-AIRGAP-56-001 `Mirror ingestion adapters` | TODO | Add mirror-based VEX ingestion, preserving statement digests and bundle IDs. | Excititor Core Guild (src/Excititor/__Libraries/StellaOps.Excititor.Core)
-EXCITITOR-AIRGAP-56-002 `Bundle provenance` | TODO | Persist bundle metadata on VEX observations/linksets with provenance references. Dependencies: EXCITITOR-AIRGAP-56-001. | Excititor Core Guild, AirGap Importer Guild (src/Excititor/__Libraries/StellaOps.Excititor.Core)
-EXCITITOR-AIRGAP-57-001 `Sealed-mode enforcement` | TODO | Block non-mirror connectors in sealed mode and surface remediation errors. Dependencies: EXCITITOR-AIRGAP-56-002. | Excititor Core Guild, AirGap Policy Guild (src/Excititor/__Libraries/StellaOps.Excititor.Core)
-EXCITITOR-AIRGAP-57-002 `Staleness annotations` | TODO | Annotate VEX statements with staleness metrics and expose via API. Dependencies: EXCITITOR-AIRGAP-57-001. | Excititor Core Guild, AirGap Time Guild (src/Excititor/__Libraries/StellaOps.Excititor.Core)
-EXCITITOR-AIRGAP-58-001 `Portable VEX evidence` | TODO | Package VEX evidence segments into portable evidence bundles linked to timeline. Dependencies: EXCITITOR-AIRGAP-57-002. | Excititor Core Guild, Evidence Locker Guild (src/Excititor/__Libraries/StellaOps.Excititor.Core)
-EXCITITOR-ATTEST-01-003 – Verification suite & observability | Team Excititor Attestation | TODO (2025-11-06) – Continuing implementation: build `IVexAttestationVerifier`, wire metrics/logging, and add regression tests. Draft plan in `EXCITITOR-ATTEST-01-003-plan.md` (2025-10-19) guides scope; updating with worknotes as progress lands.
2025-10-31: Verifier now tolerates duplicate source providers from AOC raw projections, downgrades offline Rekor verification to a degraded result, and enforces trusted signer registry checks with detailed diagnostics/tests.
2025-11-05 14:35Z: Resuming with diagnostics/observability deliverables (typed diagnostics record, ActivitySource wiring, metrics dimensions) before WebService/Worker integration.
2025-11-06 07:12Z: Worker & web service suites pass with new diagnostics (`dotnet test` via staged libssl1.1); export envelope context exposed publicly for mirror bundle publishing.
2025-11-06 07:55Z: Paused—automation for OpenSSL shim tracked under `DEVOPS-OPENSSL-11-001/002`. | EXCITITOR-ATTEST-01-002 (src/Excititor/__Libraries/StellaOps.Excititor.Attestation)
-EXCITITOR-ATTEST-73-001 `VEX attestation payloads` | TODO | Provide VEX statement metadata (supplier identity, justification, scope) required for VEXAttestation payloads. Dependencies: EXCITITOR-ATTEST-01-003. | Excititor Core Guild, Attestation Payloads Guild (src/Excititor/__Libraries/StellaOps.Excititor.Core)
-EXCITITOR-ATTEST-73-002 `Chain provenance` | TODO | Expose linkage from VEX statements to subject/product for chain of custody graph. Dependencies: EXCITITOR-ATTEST-73-001. | Excititor Core Guild (src/Excititor/__Libraries/StellaOps.Excititor.Core)
-EXCITITOR-CONN-MS-01-003 – Trust metadata & provenance hints | Team Excititor Connectors – MSRC | TODO – Emit cosign/AAD issuer metadata, attach provenance details, and document policy integration. | EXCITITOR-CONN-MS-01-002, EXCITITOR-POLICY-01-001 (src/Excititor/__Libraries/StellaOps.Excititor.Connectors.MSRC.CSAF)
-EXCITITOR-CONN-ORACLE-01-003 – Trust provenance enrichment | Team Excititor Connectors – Oracle | TODO – Emit Oracle signing metadata (PGP/cosign fingerprint list, issuer trust tier) into raw provenance so downstream services can evaluate trust. Connector must not apply consensus weighting during ingestion. | EXCITITOR-CONN-ORACLE-01-002, EXCITITOR-POLICY-01-001 (src/Excititor/__Libraries/StellaOps.Excititor.Connectors.Oracle.CSAF)
-EXCITITOR-CONN-STELLA-07-002 | TODO | Parse mirror bundles into raw `VexClaim` batches, preserving original provider metadata and mirror provenance without applying consensus or weighting. | Excititor Connectors – Stella (src/Excititor/StellaOps.Excititor.Connectors.StellaOpsMirror)
-EXCITITOR-CONN-STELLA-07-003 | TODO | Implement incremental cursor handling per-export digest for raw claim replays, support resume, and document configuration for downstream Excititor mirrors. Dependencies: EXCITITOR-CONN-STELLA-07-002. | Excititor Connectors – Stella (src/Excititor/StellaOps.Excititor.Connectors.StellaOpsMirror)
+EXCITITOR-AIAI-31-001 `Justification enrichment` | DOING (2025-11-09) | Expose normalized VEX justifications, product scope trees, and paragraph/JSON-pointer anchors via `VexObservation` projections so Advisory AI can cite raw evidence without invoking any consensus logic. | Excititor WebService Guild (src/Excititor/StellaOps.Excititor.WebService)
+EXCITITOR-AIAI-31-002 `VEX chunk API` | TODO | Ship `/vex/evidence/chunks` with tenant/policy filters that streams raw statements, signature metadata, and scope scores for Retrieval-Augmented Generation clients; response must stay aggregation-only and reference observation/linkset IDs. Depends on EXCITITOR-AIAI-31-001. | Excititor WebService Guild (src/Excititor/StellaOps.Excititor.WebService)
+EXCITITOR-AIAI-31-003 `Telemetry & guardrails` | TODO | Instrument the new evidence APIs with request counters, chunk sizes, signature verification failure meters, and AOC guard violations so Lens/Advisory AI teams can detect misuse quickly. Depends on EXCITITOR-AIAI-31-002. | Excititor WebService Guild, Observability Guild (src/Excititor/StellaOps.Excititor.WebService)
+EXCITITOR-AIAI-31-004 `Schema & docs alignment` | TODO | Update OpenAPI/SDK/docs to codify the Advisory-AI evidence contract (fields, determinism guarantees, pagination) and describe how consumers map observation IDs back to raw storage. | Excititor WebService Guild, Docs Guild (src/Excititor/StellaOps.Excititor.WebService)
+EXCITITOR-AIRGAP-56-001 `Mirror-first ingestion` | TODO | Wire mirror bundle ingestion paths that preserve upstream digests, bundle IDs, and provenance metadata exactly so offline Advisory-AI/Lens deployments can replay evidence with AOC parity. | Excititor Core Guild (src/Excititor/__Libraries/StellaOps.Excititor.Core)
+EXCITITOR-AIRGAP-57-001 `Sealed-mode enforcement` | TODO | Enforce sealed-mode policies that disable external connectors, emit actionable remediation errors, and record staleness annotations that Advisory AI can surface as “evidence freshness” signals. Depends on EXCITITOR-AIRGAP-56-001. | Excititor Core Guild, AirGap Policy Guild (src/Excititor/__Libraries/StellaOps.Excititor.Core)
+EXCITITOR-AIRGAP-58-001 `Portable evidence bundles` | TODO | Package tenant-scoped VEX evidence (raw JSON, normalization diff, provenance) into portable bundles tied to timeline events so Advisory AI can hydrate contexts in sealed environments. Depends on EXCITITOR-AIRGAP-57-001. | Excititor Core Guild, Evidence Locker Guild (src/Excititor/__Libraries/StellaOps.Excititor.Core)
+EXCITITOR-ATTEST-01-003 `Verification suite & observability` | TODO (2025-11-06) | Finish `IVexAttestationVerifier`, wire structured diagnostics/metrics, and prove we can verify DSSE bundles for every evidence batch without touching consensus results (see `EXCITITOR-ATTEST-01-003-plan.md`). | Excititor Attestation Guild (src/Excititor/__Libraries/StellaOps.Excititor.Attestation)
+EXCITITOR-ATTEST-73-001 `VEX attestation payloads` | TODO | Emit attestation payloads that capture supplier identity, justification summary, and scope metadata so downstream Lens/Policy jobs can chain trust without Excititor interpreting the evidence. Depends on EXCITITOR-ATTEST-01-003. | Excititor Core Guild, Attestation Payloads Guild (src/Excititor/__Libraries/StellaOps.Excititor.Core)
+EXCITITOR-ATTEST-73-002 `Chain provenance` | TODO | Provide APIs that link attestation IDs back to observation/linkset/product tuples, enabling Advisory AI to cite provenance without any derived verdict. Depends on EXCITITOR-ATTEST-73-001. | Excititor Core Guild (src/Excititor/__Libraries/StellaOps.Excititor.Core)
+EXCITITOR-CONN-TRUST-01-001 `Connector provenance parity` | TODO | Update MSRC, Oracle, Ubuntu, and Stella mirror connectors to emit signer fingerprints, issuer tiers, and bundle references while remaining aggregation-only; document how Lens consumers should interpret these hints. | Excititor Connectors Guild (src/Excititor/__Libraries/StellaOps.Excititor.Connectors.*)
diff --git a/docs/implplan/SPRINT_120_excititor_ii.md b/docs/implplan/SPRINT_120_excititor_ii.md
index b0c63f13d..9efedf7c8 100644
--- a/docs/implplan/SPRINT_120_excititor_ii.md
+++ b/docs/implplan/SPRINT_120_excititor_ii.md
@@ -1,6 +1,6 @@
# Sprint 120 - Ingestion & Evidence · 110.C) Excititor.II
-Active items only. Completed/historic work now resides in docs/implplan/archived_sprints_tasks.md (updated 2025-11-08).
+Active items only. Completed/historic work now resides in docs/implplan/archived/tasks.md (updated 2025-11-08).
[Ingestion & Evidence] 110.C) Excititor.II
Depends on: Sprint 110.C - Excititor.I
@@ -8,8 +8,8 @@ Summary: Ingestion & Evidence focus on Excititor (phase II).
> **Prep:** Read `docs/modules/excititor/architecture.md` and the relevant Excititor `AGENTS.md` files within the component directories before touching the tasks below.
Task ID | State | Task description | Owners (Source)
--- | --- | --- | ---
-EXCITITOR-CONN-SUSE-01-003 – Trust metadata provenance | Team Excititor Connectors – SUSE | TODO – Emit provider trust configuration (signer fingerprints, trust tier notes) into the raw provenance envelope so downstream VEX Lens/Policy components can weigh issuers. Connector must not apply weighting or consensus inside ingestion. | EXCITITOR-CONN-SUSE-01-002, EXCITITOR-POLICY-01-001 (src/Excititor/__Libraries/StellaOps.Excititor.Connectors.SUSE.RancherVEXHub)
-EXCITITOR-CONN-UBUNTU-01-003 – Trust provenance enrichment | Team Excititor Connectors – Ubuntu | TODO – Emit Ubuntu signing metadata (GPG fingerprints, issuer trust tier) inside raw provenance artifacts so downstream Policy/VEX Lens consumers can weigh issuers. Connector must remain aggregation-only with no inline weighting. | EXCITITOR-CONN-UBUNTU-01-002, EXCITITOR-POLICY-01-001 (src/Excititor/__Libraries/StellaOps.Excititor.Connectors.Ubuntu.CSAF)
+EXCITITOR-CONN-SUSE-01-003 – Trust metadata provenance | Team Excititor Connectors – SUSE | DONE (2025-11-09) – Emit provider trust configuration (signer fingerprints, trust tier notes) into the raw provenance envelope so downstream VEX Lens/Policy components can weigh issuers. Connector must not apply weighting or consensus inside ingestion. | EXCITITOR-CONN-SUSE-01-002, EXCITITOR-POLICY-01-001 (src/Excititor/__Libraries/StellaOps.Excititor.Connectors.SUSE.RancherVEXHub)
+EXCITITOR-CONN-UBUNTU-01-003 – Trust provenance enrichment | Team Excititor Connectors – Ubuntu | DONE (2025-11-09) – Emit Ubuntu signing metadata (GPG fingerprints, issuer trust tier) inside raw provenance artifacts so downstream Policy/VEX Lens consumers can weigh issuers. Connector must remain aggregation-only with no inline weighting. | EXCITITOR-CONN-UBUNTU-01-002, EXCITITOR-POLICY-01-001 (src/Excititor/__Libraries/StellaOps.Excititor.Connectors.Ubuntu.CSAF)
EXCITITOR-CONSOLE-23-001 `VEX aggregation views` | TODO | Expose `/console/vex` endpoints returning grouped VEX statements per advisory/component with status chips, justification metadata, precedence trace pointers, and tenant-scoped filters for Console explorer. Dependencies: EXCITITOR-LNM-21-201, EXCITITOR-LNM-21-202. | Excititor WebService Guild, BE-Base Platform Guild (src/Excititor/StellaOps.Excititor.WebService)
EXCITITOR-CONSOLE-23-002 `Dashboard VEX deltas` | TODO | Provide aggregated counts for VEX overrides (new, not_affected, revoked) powering Console dashboard + live status ticker; emit metrics for policy explain integration. Dependencies: EXCITITOR-CONSOLE-23-001, EXCITITOR-LNM-21-203. | Excititor WebService Guild (src/Excititor/StellaOps.Excititor.WebService)
EXCITITOR-CONSOLE-23-003 `VEX search helpers` | TODO | Deliver rapid lookup endpoints of VEX by advisory/component for Console global search; ensure response includes provenance and precedence context; include caching and RBAC. Dependencies: EXCITITOR-CONSOLE-23-001. | Excititor WebService Guild (src/Excititor/StellaOps.Excititor.WebService)
diff --git a/docs/implplan/SPRINT_121_excititor_iii.md b/docs/implplan/SPRINT_121_excititor_iii.md
index 16726f790..14e0b3527 100644
--- a/docs/implplan/SPRINT_121_excititor_iii.md
+++ b/docs/implplan/SPRINT_121_excititor_iii.md
@@ -1,6 +1,6 @@
# Sprint 121 - Ingestion & Evidence · 110.C) Excititor.III
-Active items only. Completed/historic work now resides in docs/implplan/archived_sprints_tasks.md (updated 2025-11-08).
+Active items only. Completed/historic work now resides in docs/implplan/archived/tasks.md (updated 2025-11-08).
[Ingestion & Evidence] 110.C) Excititor.III
Depends on: Sprint 110.C - Excititor.II
@@ -8,17 +8,10 @@ Summary: Ingestion & Evidence focus on Excititor (phase III).
> **Prep:** Read `docs/modules/excititor/architecture.md` and the Excititor component `AGENTS.md` guidance before acting on these tasks (requirement carried over from the component boards).
Task ID | State | Task description | Owners (Source)
--- | --- | --- | ---
-EXCITITOR-LNM-21-002 `Linkset correlator` | TODO | Build correlation pipeline combining alias + product PURL signals to form `vex_linksets` with confidence metrics. Docs waiting to finalize VEX aggregation guide. Dependencies: EXCITITOR-LNM-21-001. | Excititor Core Guild (src/Excititor/__Libraries/StellaOps.Excititor.Core)
-EXCITITOR-LNM-21-003 `Conflict annotator` | TODO | Record status/justification disagreements within linksets and expose structured conflicts. Provide structured payloads for `DOCS-LNM-22-002`. Dependencies: EXCITITOR-LNM-21-002. | Excititor Core Guild (src/Excititor/__Libraries/StellaOps.Excititor.Core)
-EXCITITOR-LNM-21-004 `Merge removal` | TODO | Remove legacy VEX merge logic, enforce immutability, and add guards/tests to prevent future merges. Dependencies: EXCITITOR-LNM-21-003. | Excititor Core Guild (src/Excititor/__Libraries/StellaOps.Excititor.Core)
-EXCITITOR-LNM-21-005 `Event emission` | TODO | Emit `vex.linkset.updated` events for downstream consumers with delta descriptions and tenant context. Dependencies: EXCITITOR-LNM-21-004. | Excititor Core Guild, Platform Events Guild (src/Excititor/__Libraries/StellaOps.Excititor.Core)
-EXCITITOR-LNM-21-101 `Observations collections` | TODO | Provision `vex_observations`/`vex_linksets` collections with shard keys, indexes over aliases & product PURLs, and multi-tenant guards. Dependencies: EXCITITOR-LNM-21-005. | Excititor Storage Guild (src/Excititor/__Libraries/StellaOps.Excititor.Storage.Mongo)
-EXCITITOR-LNM-21-102 `Migration/backfill` | TODO | Backfill legacy merged VEX docs into observations/linksets, add provenance notes, and produce rollback scripts. Dependencies: EXCITITOR-LNM-21-101. | Excititor Storage Guild, DevOps Guild (src/Excititor/__Libraries/StellaOps.Excititor.Storage.Mongo)
-EXCITITOR-LNM-21-201 `Observation APIs` | TODO | Add VEX observation read endpoints with filters, pagination, RBAC, and tenant scoping. Dependencies: EXCITITOR-LNM-21-102. | Excititor WebService Guild, BE-Base Platform Guild (src/Excititor/StellaOps.Excititor.WebService)
-EXCITITOR-LNM-21-202 `Linkset APIs` | TODO | Implement linkset read/export/evidence endpoints returning correlation/conflict payloads and map errors to `ERR_AGG_*`. Dependencies: EXCITITOR-LNM-21-201. | Excititor WebService Guild (src/Excititor/StellaOps.Excititor.WebService)
-EXCITITOR-LNM-21-203 `Event publishing` | TODO | Publish `vex.linkset.updated` events, document schema, and ensure idempotent delivery. Dependencies: EXCITITOR-LNM-21-202. | Excititor WebService Guild, Platform Events Guild (src/Excititor/StellaOps.Excititor.WebService)
-EXCITITOR-OAS-61-001 `Spec coverage` | TODO | Update VEX OAS to include observation/linkset endpoints with provenance fields and examples. | Excititor Core Guild, API Contracts Guild (src/Excititor/__Libraries/StellaOps.Excititor.Core)
-EXCITITOR-OAS-61-002 `Example catalog` | TODO | Provide examples for VEX justifications, statuses, conflicts; ensure SDK docs reference them. Dependencies: EXCITITOR-OAS-61-001. | Excititor Core Guild (src/Excititor/__Libraries/StellaOps.Excititor.Core)
-EXCITITOR-OAS-62-001 `SDK smoke tests` | TODO | Add SDK scenarios for VEX observation queries and conflict handling to language smoke suites. Dependencies: EXCITITOR-OAS-61-002. | Excititor Core Guild, SDK Generator Guild (src/Excititor/__Libraries/StellaOps.Excititor.Core)
-EXCITITOR-OAS-63-001 `Deprecation headers` | TODO | Add deprecation metadata and notifications for legacy VEX routes. Dependencies: EXCITITOR-OAS-62-001. | Excititor Core Guild, API Governance Guild (src/Excititor/__Libraries/StellaOps.Excititor.Core)
-EXCITITOR-OBS-51-001 `Metrics & SLOs` | TODO | Publish metrics for VEX ingest latency, scope resolution success, conflict rate, signature verification failures. Define SLOs (link latency P95 <30s) and configure burn-rate alerts. Dependencies: EXCITITOR-OBS-50-001. | Excititor Core Guild, DevOps Guild (src/Excititor/__Libraries/StellaOps.Excititor.Core)
+EXCITITOR-LNM-21-001 `Observation & linkset stores` | TODO | Stand up `vex_observations` and `vex_linksets` collections with shard keys, tenant guards, and migrations that retire any residual merge-era data without mutating raw content. | Excititor Storage Guild (src/Excititor/__Libraries/StellaOps.Excititor.Storage.Mongo)
+EXCITITOR-LNM-21-002 `Conflict annotations` | TODO | Capture disagreement metadata (status + justification deltas) directly inside linksets with confidence scores so downstream consumers can highlight conflicts without Excititor choosing winners. Depends on EXCITITOR-LNM-21-001. | Excititor Core Guild (src/Excititor/__Libraries/StellaOps.Excititor.Core)
+EXCITITOR-LNM-21-003 `Event emission` | TODO | Emit `vex.linkset.updated` events and describe payload shape (observation ids, confidence, conflict summary) so Policy/Lens/UI can subscribe while Excititor stays aggregation-only. Depends on EXCITITOR-LNM-21-002. | Excititor Core Guild, Platform Events Guild (src/Excititor/__Libraries/StellaOps.Excititor.Core)
+EXCITITOR-LNM-21-201 `Observation APIs` | TODO | Ship `/vex/observations` read endpoints with filters for advisory/product/issuer, strict RBAC, and deterministic pagination (no derived verdict fields). Depends on EXCITITOR-LNM-21-003. | Excititor WebService Guild (src/Excititor/StellaOps.Excititor.WebService)
+EXCITITOR-LNM-21-202 `Linkset APIs` | TODO | Provide `/vex/linksets` + export endpoints that surface alias mappings, conflict markers, and provenance proofs exactly as stored; errors must map to `ERR_AGG_*`. Depends on EXCITITOR-LNM-21-201. | Excititor WebService Guild (src/Excititor/StellaOps.Excititor.WebService)
+EXCITITOR-LNM-21-203 `Docs & SDK examples` | TODO | Update OpenAPI, SDK smoke tests, and documentation to cover the new observation/linkset endpoints with realistic examples Advisory AI/Lens teams can rely on. Depends on EXCITITOR-LNM-21-202. | Excititor WebService Guild, Docs Guild (src/Excititor/StellaOps.Excititor.WebService)
+EXCITITOR-OBS-51-001 `Metrics & SLOs` | TODO | Publish ingest latency, scope resolution success, conflict rate, and signature verification metrics plus SLO burn alerts so we can prove Excititor meets the AOC “evidence freshness” mission. | Excititor Core Guild, DevOps Guild (src/Excititor/__Libraries/StellaOps.Excititor.Core)
diff --git a/docs/implplan/SPRINT_122_excititor_iv.md b/docs/implplan/SPRINT_122_excititor_iv.md
index ce5cec49d..ff785924d 100644
--- a/docs/implplan/SPRINT_122_excititor_iv.md
+++ b/docs/implplan/SPRINT_122_excititor_iv.md
@@ -1,6 +1,6 @@
# Sprint 122 - Ingestion & Evidence · 110.C) Excititor.IV
-Active items only. Completed/historic work now resides in docs/implplan/archived_sprints_tasks.md (updated 2025-11-08).
+Active items only. Completed/historic work now resides in docs/implplan/archived/tasks.md (updated 2025-11-08).
[Ingestion & Evidence] 110.C) Excititor.IV
Depends on: Sprint 110.C - Excititor.III
@@ -8,18 +8,11 @@ Summary: Ingestion & Evidence focus on Excititor (phase IV).
> **Prep:** Read `docs/modules/excititor/architecture.md` and the relevant Excititor `AGENTS.md` files before updating these tasks.
Task ID | State | Task description | Owners (Source)
--- | --- | --- | ---
-EXCITITOR-OBS-52-001 `Timeline events` | TODO | Emit `timeline_event` entries for VEX ingest/linking/outcome changes with trace IDs, justification summaries, and evidence placeholders. Dependencies: EXCITITOR-OBS-51-001. | Excititor Core Guild (src/Excititor/__Libraries/StellaOps.Excititor.Core)
-EXCITITOR-OBS-53-001 `Evidence snapshots` | TODO | Build evidence payloads for VEX statements (raw doc, normalization diff, precedence notes) and push to evidence locker with Merkle manifests. Dependencies: EXCITITOR-OBS-52-001. | Excititor Core Guild, Evidence Locker Guild (src/Excititor/__Libraries/StellaOps.Excititor.Core)
-EXCITITOR-OBS-54-001 `Attestation & verification` | TODO | Attach DSSE attestations to VEX batch processing, verify chain-of-custody via Provenance library, and link attestation IDs to timeline + ledger. Dependencies: EXCITITOR-OBS-53-001. | Excititor Core Guild, Provenance Guild (src/Excititor/__Libraries/StellaOps.Excititor.Core)
-EXCITITOR-OBS-55-001 `Incident mode` | TODO | Implement incident sampling bump, additional raw payload retention, and activation events for VEX pipelines with redaction guard rails. Dependencies: EXCITITOR-OBS-54-001. | Excititor Core Guild, DevOps Guild (src/Excititor/__Libraries/StellaOps.Excititor.Core)
-EXCITITOR-ORCH-32-001 `Worker SDK adoption` | TODO | Integrate orchestrator worker SDK in Excititor ingestion jobs, emit heartbeats/progress/artifact hashes, and register source metadata. | Excititor Worker Guild (src/Excititor/StellaOps.Excititor.Worker)
-EXCITITOR-ORCH-33-001 `Control compliance` | TODO | Honor orchestrator pause/throttle/retry actions, classify error outputs, and persist restart checkpoints. Dependencies: EXCITITOR-ORCH-32-001. | Excititor Worker Guild (src/Excititor/StellaOps.Excititor.Worker)
-EXCITITOR-ORCH-34-001 `Backfill & circuit breaker` | TODO | Implement orchestrator-driven backfills, apply circuit breaker reset rules, and ensure artifact dedupe alignment. Dependencies: EXCITITOR-ORCH-33-001. | Excititor Worker Guild (src/Excititor/StellaOps.Excititor.Worker)
-EXCITITOR-POLICY-02-002 – Diagnostics for scoring signals | Team Excititor Policy | BACKLOG – Update diagnostics reports to surface missing severity/KEV/EPSS mappings, coefficient overrides, and provide actionable recommendations for policy tuning. | EXCITITOR-POLICY-02-001 (src/Excititor/__Libraries/StellaOps.Excititor.Policy)
-EXCITITOR-POLICY-20-001 `Policy selection endpoints` | TODO | Provide VEX lookup APIs supporting PURL/advisory batching, scope filtering, and tenant enforcement with deterministic ordering + pagination. Dependencies: EXCITITOR-POLICY-02-002. | Excititor WebService Guild (src/Excititor/StellaOps.Excititor.WebService)
-EXCITITOR-POLICY-20-002 `Scope-aware linksets` | TODO | Enhance VEX linkset extraction with scope resolution (product/component) + version range matching to boost policy join accuracy; refresh fixtures/tests. Dependencies: EXCITITOR-POLICY-20-001. | Excititor Core Guild, Policy Guild (src/Excititor/__Libraries/StellaOps.Excititor.Core)
-EXCITITOR-POLICY-20-003 `Selection cursors` | TODO | Introduce VEX selection cursor collections + indexes powering incremental policy runs; bundle change-stream checkpoint migrations and Offline Kit tooling. Dependencies: EXCITITOR-POLICY-20-002. | Excititor Storage Guild (src/Excititor/__Libraries/StellaOps.Excititor.Storage.Mongo)
-EXCITITOR-POLICY-23-001 `Evidence indexes` | TODO | Provide indexes/materialized views for policy runtime (status, justification, product PURL) to accelerate queries; document contract. Dependencies: EXCITITOR-POLICY-20-003. | Excititor Core Guild (src/Excititor/__Libraries/StellaOps.Excititor.Core)
-EXCITITOR-POLICY-23-002 `Event guarantees` | TODO | Ensure `vex.linkset.updated` events include correlation confidence, conflict summaries, and idempotent ids for evaluator consumption. Dependencies: EXCITITOR-POLICY-23-001. | Excititor Core Guild, Platform Events Guild (src/Excititor/__Libraries/StellaOps.Excititor.Core)
-EXCITITOR-RISK-66-001 `VEX gate provider` | TODO | Supply VEX status and justification data for risk engine gating with full source provenance. | Excititor Core Guild, Risk Engine Guild (src/Excititor/__Libraries/StellaOps.Excititor.Core)
-EXCITITOR-RISK-66-002 `Reachability inputs` | TODO | Provide component/product scoping metadata enabling reachability and runtime factor mapping. Dependencies: EXCITITOR-RISK-66-001. | Excititor Core Guild (src/Excititor/__Libraries/StellaOps.Excititor.Core)
+EXCITITOR-OBS-52-001 `Timeline events` | TODO | Emit `timeline_event` entries for every ingest/linkset change with trace IDs, justification summaries, and evidence hashes so downstream systems can replay the raw facts chronologically. Depends on EXCITITOR-OBS-51-001. | Excititor Core Guild (src/Excititor/__Libraries/StellaOps.Excititor.Core)
+EXCITITOR-OBS-53-001 `Evidence snapshots` | TODO | Build locker payloads (raw doc, normalization diff, provenance) and Merkle manifests so sealed-mode sites can audit evidence without Excititor reinterpreting it. Depends on EXCITITOR-OBS-52-001. | Excititor Core Guild, Evidence Locker Guild (src/Excititor/__Libraries/StellaOps.Excititor.Core)
+EXCITITOR-OBS-54-001 `Attestation & verification` | TODO | Attach DSSE attestations to every evidence batch, verify chains via Provenance tooling, and surface attestation IDs on timeline events. Depends on EXCITITOR-OBS-53-001. | Excititor Core Guild, Provenance Guild (src/Excititor/__Libraries/StellaOps.Excititor.Core)
+EXCITITOR-ORCH-32-001 `Worker orchestration` | TODO | Adopt the orchestrator worker SDK for Excititor jobs, emitting heartbeats/progress/artifact hashes so ingestion remains deterministic and restartable without reprocessing evidence. | Excititor Worker Guild (src/Excititor/StellaOps.Excititor.Worker)
+EXCITITOR-ORCH-33-001 `Control compliance` | TODO | Honor orchestrator pause/throttle/retry commands, persist checkpoints, and classify error outputs to keep ingestion safe under outages. Depends on EXCITITOR-ORCH-32-001. | Excititor Worker Guild (src/Excititor/StellaOps.Excititor.Worker)
+EXCITITOR-POLICY-20-001 `Policy selection APIs` | TODO | Provide VEX lookup APIs (PURL/advisory batching, scope filters, tenant enforcement) that Policy Engine uses to join evidence without Excititor performing any verdict logic. Depends on EXCITITOR-AOC-20-004. | Excititor WebService Guild (src/Excititor/StellaOps.Excititor.WebService)
+EXCITITOR-POLICY-20-002 `Scope-aware linksets` | TODO | Enhance linksets with scope resolution + version range metadata so Policy/Reachability can reason about applicability while Excititor continues to report only raw context. Depends on EXCITITOR-POLICY-20-001. | Excititor Core Guild (src/Excititor/__Libraries/StellaOps.Excititor.Core)
+EXCITITOR-RISK-66-001 `Risk gating feed` | TODO | Publish risk-engine ready feeds (status, justification, provenance) with zero derived severity so gating services can reference Excititor as a source of truth. Depends on EXCITITOR-POLICY-20-002. | Excititor Core Guild, Risk Engine Guild (src/Excititor/__Libraries/StellaOps.Excititor.Core)
diff --git a/docs/implplan/SPRINT_123_excititor_v.md b/docs/implplan/SPRINT_123_excititor_v.md
index ac61e1225..98982f6d2 100644
--- a/docs/implplan/SPRINT_123_excititor_v.md
+++ b/docs/implplan/SPRINT_123_excititor_v.md
@@ -1,6 +1,6 @@
# Sprint 123 - Ingestion & Evidence · 110.C) Excititor.V
-Active items only. Completed/historic work now resides in docs/implplan/archived_sprints_tasks.md (updated 2025-11-08).
+Active items only. Completed/historic work now resides in docs/implplan/archived/tasks.md (updated 2025-11-08).
[Ingestion & Evidence] 110.C) Excititor.V
Depends on: Sprint 110.C - Excititor.IV
@@ -8,18 +8,11 @@ Summary: Ingestion & Evidence focus on Excititor (phase V).
> **Prep:** Read `docs/modules/excititor/architecture.md` and the Excititor component `AGENTS.md` files before touching this sprint’s tasks.
Task ID | State | Task description | Owners (Source)
--- | --- | --- | ---
-EXCITITOR-RISK-67-001 `Explainability metadata` | TODO | Include VEX justification, status reasoning, and source digests in explainability artifacts. Dependencies: EXCITITOR-RISK-66-002. | Excititor Core Guild (src/Excititor/__Libraries/StellaOps.Excititor.Core)
-EXCITITOR-RISK-68-001 `Policy Studio integration` | TODO | Surface VEX-specific gates/weights within profile editor UI and validation messages. Dependencies: EXCITITOR-RISK-67-001. | Excititor Core Guild, Policy Studio Guild (src/Excititor/__Libraries/StellaOps.Excititor.Core)
-EXCITITOR-SIG-26-001 `Vendor exploitability hints` | TODO | Surface vendor-provided exploitability indicators and affected symbol lists to Signals service via projection endpoints. | Excititor Core Guild, Signals Guild (src/Excititor/__Libraries/StellaOps.Excititor.Core)
-EXCITITOR-STORE-AOC-19-001 `vex_raw schema validator` | TODO | Define Mongo JSON schema for `vex_raw` enforcing required fields and forbidding derived/consensus/severity fields. Ship unit tests with Mongo2Go to validate rejects. | Excititor Storage Guild (src/Excititor/__Libraries/StellaOps.Excititor.Storage.Mongo)
-EXCITITOR-STORE-AOC-19-002 `idempotency unique index` | TODO | Create `(source.vendor, upstream.upstream_id, upstream.content_hash, tenant)` unique index with backfill checker, updating migrations + bootstrapper for offline installs. Dependencies: EXCITITOR-STORE-AOC-19-001. | Excititor Storage Guild (src/Excititor/__Libraries/StellaOps.Excititor.Storage.Mongo)
-EXCITITOR-STORE-AOC-19-003 `append-only migration plan` | TODO | Migrate legacy consensus collections to `_backup_*`, seed supersedes chain for raw docs, and document rollback path + dry-run verification. Dependencies: EXCITITOR-STORE-AOC-19-002. | Excititor Storage Guild (src/Excititor/__Libraries/StellaOps.Excititor.Storage.Mongo)
-EXCITITOR-STORE-AOC-19-004 `validator deployment docset` | TODO | Update migration runbooks and Offline Kit packaging to bundle schema validator scripts, with smoke instructions for air-gapped clusters. Dependencies: EXCITITOR-STORE-AOC-19-003. | Excititor Storage Guild, DevOps Guild (src/Excititor/__Libraries/StellaOps.Excititor.Storage.Mongo)
-EXCITITOR-TEN-48-001 `Tenant-aware VEX linking` | TODO | Apply tenant context to VEX linkers, enable RLS, and expose capability endpoint confirming aggregation-only behavior. | Excititor Core Guild (src/Excititor/__Libraries/StellaOps.Excititor.Core)
-EXCITITOR-VEXLENS-30-001 `VEX evidence enrichers` | TODO | Include issuer hints, signatures, and product trees in evidence payloads for VEX Lens; Label: VEX-Lens. | Excititor WebService Guild, VEX Lens Guild (src/Excititor/StellaOps.Excititor.WebService)
-EXCITITOR-VULN-29-001 `VEX key canonicalization` | TODO | Canonicalize (lossless) VEX advisory/product keys (map to `advisory_key`, capture product scopes); expose original sources in `links[]`; AOC-compliant: no merge, no derived fields, no suppression; backfill existing records. | Excititor WebService Guild (src/Excititor/StellaOps.Excititor.WebService)
-EXCITITOR-VULN-29-002 `Evidence retrieval` | TODO | Provide `/vuln/evidence/vex/{advisory_key}` returning raw VEX statements filtered by tenant/product scope for Explorer evidence tabs. Dependencies: EXCITITOR-VULN-29-001. | Excititor WebService Guild (src/Excititor/StellaOps.Excititor.WebService)
-EXCITITOR-VULN-29-004 `Observability` | TODO | Add metrics/logs for VEX normalization, suppression scopes, withdrawn statements; emit events consumed by Vuln Explorer resolver. Dependencies: EXCITITOR-VULN-29-002. | Excititor WebService Guild, Observability Guild (src/Excititor/StellaOps.Excititor.WebService)
-EXCITITOR-WEB-AIRGAP-56-001 | TODO | Support mirror bundle registration via APIs, expose bundle provenance in VEX responses, and block external connectors in sealed mode. | Excititor WebService Guild (src/Excititor/StellaOps.Excititor.WebService)
-EXCITITOR-WEB-AIRGAP-56-002 | TODO | Return VEX staleness metrics and time anchor info in API responses for Console/CLI use. Dependencies: EXCITITOR-WEB-AIRGAP-56-001. | Excititor WebService Guild, AirGap Time Guild (src/Excititor/StellaOps.Excititor.WebService)
-EXCITITOR-WEB-AIRGAP-57-001 | TODO | Map sealed-mode violations to standardized error payload with remediation guidance. Dependencies: EXCITITOR-WEB-AIRGAP-56-002. | Excititor WebService Guild, AirGap Policy Guild (src/Excititor/StellaOps.Excititor.WebService)
+EXCITITOR-VEXLENS-30-001 `VEX evidence enrichers` | TODO | Ensure every observation exported to VEX Lens carries issuer hints, signature blobs, product tree snippets, and staleness metadata so the lens can compute consensus without calling back into Excititor. | Excititor WebService Guild, VEX Lens Guild (src/Excititor/StellaOps.Excititor.WebService)
+EXCITITOR-VULN-29-001 `VEX key canonicalization` | TODO | Canonicalize advisory/product keys (map to `advisory_key`, capture scope metadata) while preserving original identifiers in `links[]`; run backfill + regression tests. | Excititor WebService Guild (src/Excititor/StellaOps.Excititor.WebService)
+EXCITITOR-VULN-29-002 `Evidence retrieval APIs` | TODO | Provide `/vuln/evidence/vex/{advisory_key}` returning tenant-scoped raw statements, provenance, and attestation references for Vuln Explorer evidence tabs. Depends on EXCITITOR-VULN-29-001. | Excititor WebService Guild (src/Excititor/StellaOps.Excititor.WebService)
+EXCITITOR-VULN-29-004 `Observability` | TODO | Add metrics/logs for normalization errors, suppression scopes, withdrawn statements, and feed them to Vuln Explorer + Advisory AI dashboards. Depends on EXCITITOR-VULN-29-002. | Excititor WebService Guild, Observability Guild (src/Excititor/StellaOps.Excititor.WebService)
+EXCITITOR-STORE-AOC-19-001 `vex_raw schema validator` | TODO | Ship Mongo JSON Schema + validator tooling (including Offline Kit instructions) so operators can prove Excititor stores only immutable evidence. | Excititor Storage Guild (src/Excititor/__Libraries/StellaOps.Excititor.Storage.Mongo)
+EXCITITOR-STORE-AOC-19-002 `Idempotency index & migration` | TODO | Create unique indexes, run migrations/backfills, and document rollback steps for the new schema validator. Depends on EXCITITOR-STORE-AOC-19-001. | Excititor Storage Guild, DevOps Guild (src/Excititor/__Libraries/StellaOps.Excititor.Storage.Mongo)
+EXCITITOR-AIRGAP-56-001 `Mirror registration APIs` | TODO | Support mirror bundle registration + provenance exposure, including sealed-mode error mapping and staleness metrics surfaced via API responses. | Excititor WebService Guild (src/Excititor/StellaOps.Excititor.WebService)
+EXCITITOR-AIRGAP-58-001 `Portable evidence bundles` | TODO | Produce portable evidence bundles linked to timeline + attestation metadata for sealed deployments, and document verifier steps for Advisory AI teams. Depends on EXCITITOR-AIRGAP-56-001. | Excititor Core Guild, Evidence Locker Guild (src/Excititor/__Libraries/StellaOps.Excititor.Core)
diff --git a/docs/implplan/SPRINT_124_excititor_vi.md b/docs/implplan/SPRINT_124_excititor_vi.md
index 65fd4db8f..5421a225c 100644
--- a/docs/implplan/SPRINT_124_excititor_vi.md
+++ b/docs/implplan/SPRINT_124_excititor_vi.md
@@ -1,6 +1,6 @@
# Sprint 124 - Ingestion & Evidence · 110.C) Excititor.VI
-Active items only. Completed/historic work now resides in docs/implplan/archived_sprints_tasks.md (updated 2025-11-08).
+Active items only. Completed/historic work now resides in docs/implplan/archived/tasks.md (updated 2025-11-08).
[Ingestion & Evidence] 110.C) Excititor.VI
Depends on: Sprint 110.C - Excititor.V
@@ -8,13 +8,10 @@ Summary: Ingestion & Evidence focus on Excititor (phase VI).
> **Prep:** Read `docs/modules/excititor/architecture.md` and the Excititor component `AGENTS.md` files before working any items listed below.
Task ID | State | Task description | Owners (Source)
--- | --- | --- | ---
-EXCITITOR-WEB-AIRGAP-58-001 | TODO | Emit timeline events for VEX bundle imports with bundle ID, scope, and actor metadata. Dependencies: EXCITITOR-WEB-AIRGAP-57-001. | Excititor WebService Guild, AirGap Importer Guild (src/Excititor/StellaOps.Excititor.WebService)
-EXCITITOR-WEB-OAS-61-001 | TODO | Implement `/.well-known/openapi` discovery endpoint with spec version metadata. | Excititor WebService Guild (src/Excititor/StellaOps.Excititor.WebService)
-EXCITITOR-WEB-OAS-61-002 | TODO | Standardize error envelope responses and update controller/unit tests. Dependencies: EXCITITOR-WEB-OAS-61-001. | Excititor WebService Guild (src/Excititor/StellaOps.Excititor.WebService)
-EXCITITOR-WEB-OAS-62-001 | TODO | Add curated examples for VEX observation/linkset endpoints and ensure portal displays them. Dependencies: EXCITITOR-WEB-OAS-61-002. | Excititor WebService Guild (src/Excititor/StellaOps.Excititor.WebService)
-EXCITITOR-WEB-OAS-63-001 | TODO | Emit deprecation headers and update docs for retiring VEX APIs. Dependencies: EXCITITOR-WEB-OAS-62-001. | Excititor WebService Guild, API Governance Guild (src/Excititor/StellaOps.Excititor.WebService)
-EXCITITOR-WEB-OBS-52-001 `Timeline streaming` | TODO | Provide SSE bridge for VEX timeline events with tenant filters, pagination, and guardrails. Dependencies: EXCITITOR-WEB-OBS-51-001. | Excititor WebService Guild (src/Excititor/StellaOps.Excititor.WebService)
-EXCITITOR-WEB-OBS-53-001 `Evidence APIs` | TODO | Expose `/evidence/vex/*` endpoints that fetch locker bundles, enforce scopes, and surface verification metadata. Dependencies: EXCITITOR-WEB-OBS-52-001. | Excititor WebService Guild, Evidence Locker Guild (src/Excititor/StellaOps.Excititor.WebService)
-EXCITITOR-WEB-OBS-54-001 `Attestation APIs` | TODO | Add `/attestations/vex/*` endpoints returning DSSE verification state, builder identity, and chain-of-custody links. Dependencies: EXCITITOR-WEB-OBS-53-001. | Excititor WebService Guild (src/Excititor/StellaOps.Excititor.WebService)
-EXCITITOR-WEB-OBS-55-001 `Incident mode toggles` | TODO | Provide incident mode API for VEX pipelines with activation audit logs and retention override previews. Dependencies: EXCITITOR-WEB-OBS-54-001. | Excititor WebService Guild, DevOps Guild (src/Excititor/StellaOps.Excititor.WebService)
-EXCITITOR-CRYPTO-90-001 | TODO | Replace direct `System.Security.Cryptography` hashing/signing inside connector loaders, VEX exporters, and OpenAPI discovery with `ICryptoProviderRegistry` + `ICryptoHash` per `docs/security/crypto-routing-audit-2025-11-07.md`. | Excititor WebService Guild, Security Guild (src/Excititor/StellaOps.Excititor.WebService)
+EXCITITOR-WEB-OBS-52-001 `Timeline streaming` | TODO | Provide SSE/WebSocket bridges for VEX timeline events with tenant filters, pagination anchors, and guardrails so downstream consoles can monitor raw evidence changes in real time. Depends on EXCITITOR-OBS-52-001. | Excititor WebService Guild (src/Excititor/StellaOps.Excititor.WebService)
+EXCITITOR-WEB-OBS-53-001 `Evidence APIs` | TODO | Expose `/evidence/vex/*` endpoints that fetch locker bundles, enforce scopes, and surface verification metadata without synthesizing verdicts. Depends on EXCITITOR-WEB-OBS-52-001. | Excititor WebService Guild, Evidence Locker Guild (src/Excititor/StellaOps.Excititor.WebService)
+EXCITITOR-WEB-OBS-54-001 `Attestation APIs` | TODO | Add `/attestations/vex/*` endpoints returning DSSE verification state, builder identity, and chain-of-custody links so consumers never need direct datastore access. Depends on EXCITITOR-WEB-OBS-53-001. | Excititor WebService Guild (src/Excititor/StellaOps.Excititor.WebService)
+EXCITITOR-WEB-OAS-61-001 `OpenAPI discovery` | TODO | Implement `/.well-known/openapi` with spec version metadata plus standard error envelopes, then update controller/unit tests accordingly. | Excititor WebService Guild (src/Excititor/StellaOps.Excititor.WebService)
+EXCITITOR-WEB-OAS-62-001 `Examples & deprecation headers` | TODO | Publish curated examples for the new evidence/attestation/timeline endpoints, emit deprecation headers for legacy routes, and align SDK docs. Depends on EXCITITOR-WEB-OAS-61-001. | Excititor WebService Guild, API Governance Guild (src/Excititor/StellaOps.Excititor.WebService)
+EXCITITOR-WEB-AIRGAP-58-001 `Bundle import telemetry` | TODO | Emit timeline events + audit logs for mirror bundle imports (bundle ID, scope, actor) and map sealed-mode violations to actionable remediation guidance. | Excititor WebService Guild, AirGap Importer/Policy Guilds (src/Excititor/StellaOps.Excititor.WebService)
+EXCITITOR-CRYPTO-90-001 `Crypto provider abstraction` | TODO | Replace ad-hoc hashing/signing in connectors/exporters/OpenAPI discovery with `ICryptoProviderRegistry` implementations approved by security so evidence verification stays deterministic across crypto profiles. | Excititor WebService Guild, Security Guild (src/Excititor/StellaOps.Excititor.WebService)
diff --git a/docs/implplan/SPRINT_125_mirror.md b/docs/implplan/SPRINT_125_mirror.md
index b9ff390ec..2fc2889db 100644
--- a/docs/implplan/SPRINT_125_mirror.md
+++ b/docs/implplan/SPRINT_125_mirror.md
@@ -1,6 +1,6 @@
# Sprint 125 - Ingestion & Evidence · 110.D) Mirror
-Active items only. Completed/historic work now resides in docs/implplan/archived_sprints_tasks.md (updated 2025-11-08).
+Active items only. Completed/historic work now resides in docs/implplan/archived/tasks.md (updated 2025-11-08).
[Ingestion & Evidence] 110.D) Mirror
Depends on: Sprint 100.A - Attestor
diff --git a/docs/implplan/SPRINT_136_scanner_surface.md b/docs/implplan/SPRINT_136_scanner_surface.md
index 9c23827eb..624b0fcbb 100644
--- a/docs/implplan/SPRINT_136_scanner_surface.md
+++ b/docs/implplan/SPRINT_136_scanner_surface.md
@@ -43,6 +43,10 @@ Dependency: Sprint 135 - 6. Scanner.VI — Scanner & Surface focus on Scanner (p
| `SURFACE-FS-04` | TODO | Integrate Surface.FS reader into Zastava Observer runtime drift loop. | Zastava Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.FS) | SURFACE-FS-02 |
| `SURFACE-FS-05` | TODO | Expose Surface.FS pointers via Scanner WebService reports and coordinate rescan planning with Scheduler. | Scanner Guild, Scheduler Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.FS) | SURFACE-FS-03 |
| `SURFACE-FS-06` | TODO | Update scanner-engine guide and offline kit docs with Surface.FS workflow. | Docs Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.FS) | SURFACE-FS-02..05 |
+| `SCANNER-SURFACE-04` | TODO | DSSE-sign every `layer.fragments` payload, emit `_composition.json`, and persist DSSE envelopes so offline kits can replay deterministically (see `docs/modules/scanner/deterministic-sbom-compose.md` §2.1). | Scanner Worker Guild (src/Scanner/StellaOps.Scanner.Worker) | SCANNER-SURFACE-01, SURFACE-FS-03 |
+| `SURFACE-FS-07` | TODO | Extend Surface.FS manifest schema with `composition.recipe`, fragment attestation metadata, and verification helpers per deterministic SBOM spec. | Scanner Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.FS) | SCANNER-SURFACE-04 |
+| `SCANNER-EMIT-15-001` | TODO | Enforce canonical JSON (`stella.contentHash`, Merkle root metadata, zero timestamps) for fragments and composed CycloneDX inventory/usage BOMs. Documented in `docs/modules/scanner/deterministic-sbom-compose.md` §2.2. | Scanner Emit Guild (src/Scanner/__Libraries/StellaOps.Scanner.Emit) | SCANNER-SURFACE-04 |
+| `SCANNER-SORT-02` | TODO | Sort layer fragments by digest and components by `identity.purl`/`identity.key` before composition; add determinism regression tests. | Scanner Core Guild (src/Scanner/__Libraries/StellaOps.Scanner.Core) | SCANNER-EMIT-15-001 |
| `SURFACE-VAL-01` | DOING (2025-11-01) | Define the Surface validation framework (`surface-validation.md`) covering env/cache/secret checks and extension hooks. | Scanner Guild, Security Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.Validation) | SURFACE-FS-01, SURFACE-ENV-01 |
| `SURFACE-VAL-02` | TODO | Implement base validation library with check registry and default validators for env/cached manifests/secret refs. | Scanner Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.Validation) | SURFACE-VAL-01, SURFACE-ENV-02, SURFACE-FS-02 |
| `SURFACE-VAL-03` | TODO | Integrate validation pipeline into Scanner analyzers so checks run before processing. | Scanner Guild, Analyzer Guild (src/Scanner/__Libraries/StellaOps.Scanner.Surface.Validation) | SURFACE-VAL-02 |
diff --git a/docs/implplan/SPRINT_140_runtime_signals.md b/docs/implplan/SPRINT_140_runtime_signals.md
index f4ade4660..39acf909c 100644
--- a/docs/implplan/SPRINT_140_runtime_signals.md
+++ b/docs/implplan/SPRINT_140_runtime_signals.md
@@ -1,6 +1,6 @@
# Sprint 140 - Runtime & Signals
-Active items only. Completed/historic work now resides in docs/implplan/archived_sprints_tasks.md (updated 2025-11-08).
+Active items only. Completed/historic work now resides in docs/implplan/archived/tasks.md (updated 2025-11-08).
This file now only tracks the runtime & signals status snapshot. Active backlog lives in Sprint 141+ files.
diff --git a/docs/implplan/SPRINT_141_graph.md b/docs/implplan/SPRINT_141_graph.md
index bc4cd116e..ffc0e44eb 100644
--- a/docs/implplan/SPRINT_141_graph.md
+++ b/docs/implplan/SPRINT_141_graph.md
@@ -1,6 +1,6 @@
# Sprint 141 - Runtime & Signals · 140.A) Graph
-Active items only. Completed/historic work now resides in docs/implplan/archived_sprints_tasks.md (updated 2025-11-08).
+Active items only. Completed/historic work now resides in docs/implplan/archived/tasks.md (updated 2025-11-08).
[Runtime & Signals] 140.A) Graph
Depends on: Sprint 120.A - AirGap, Sprint 130.A - Scanner
diff --git a/docs/implplan/SPRINT_142_sbomservice.md b/docs/implplan/SPRINT_142_sbomservice.md
index ca89b3433..1116f789a 100644
--- a/docs/implplan/SPRINT_142_sbomservice.md
+++ b/docs/implplan/SPRINT_142_sbomservice.md
@@ -1,6 +1,6 @@
# Sprint 142 - Runtime & Signals · 140.B) SbomService
-Active items only. Completed/historic work now resides in docs/implplan/archived_sprints_tasks.md (updated 2025-11-08).
+Active items only. Completed/historic work now resides in docs/implplan/archived/tasks.md (updated 2025-11-08).
[Runtime & Signals] 140.B) SbomService
Depends on: Sprint 120.A - AirGap, Sprint 130.A - Scanner
diff --git a/docs/implplan/SPRINT_143_signals.md b/docs/implplan/SPRINT_143_signals.md
index 93e4eba0f..010f77d3f 100644
--- a/docs/implplan/SPRINT_143_signals.md
+++ b/docs/implplan/SPRINT_143_signals.md
@@ -1,6 +1,6 @@
# Sprint 143 - Runtime & Signals · 140.C) Signals
-Active items only. Completed/historic work now resides in docs/implplan/archived_sprints_tasks.md (updated 2025-11-08).
+Active items only. Completed/historic work now resides in docs/implplan/archived/tasks.md (updated 2025-11-08).
[Runtime & Signals] 140.C) Signals
Depends on: Sprint 120.A - AirGap, Sprint 130.A - Scanner
diff --git a/docs/implplan/SPRINT_144_zastava.md b/docs/implplan/SPRINT_144_zastava.md
index c2ba052d0..b20581543 100644
--- a/docs/implplan/SPRINT_144_zastava.md
+++ b/docs/implplan/SPRINT_144_zastava.md
@@ -1,6 +1,6 @@
# Sprint 144 - Runtime & Signals · 140.D) Zastava
-Active items only. Completed/historic work now resides in docs/implplan/archived_sprints_tasks.md (updated 2025-11-08).
+Active items only. Completed/historic work now resides in docs/implplan/archived/tasks.md (updated 2025-11-08).
[Runtime & Signals] 140.D) Zastava
Depends on: Sprint 120.A - AirGap, Sprint 130.A - Scanner
diff --git a/docs/implplan/SPRINT_150_scheduling_automation.md b/docs/implplan/SPRINT_150_scheduling_automation.md
index ae4c3ed97..7ca1b2115 100644
--- a/docs/implplan/SPRINT_150_scheduling_automation.md
+++ b/docs/implplan/SPRINT_150_scheduling_automation.md
@@ -1,6 +1,6 @@
# Sprint 150 - Scheduling & Automation
-Active items only. Completed/historic work now resides in docs/implplan/archived_sprints_tasks.md (updated 2025-11-08).
+Active items only. Completed/historic work now resides in docs/implplan/archived/tasks.md (updated 2025-11-08).
This file now only tracks the scheduling & automation status snapshot. Active backlog lives in Sprint 151+ files.
diff --git a/docs/implplan/SPRINT_151_orchestrator_i.md b/docs/implplan/SPRINT_151_orchestrator_i.md
index 68cc96a56..284bf2cf3 100644
--- a/docs/implplan/SPRINT_151_orchestrator_i.md
+++ b/docs/implplan/SPRINT_151_orchestrator_i.md
@@ -1,6 +1,6 @@
# Sprint 151 - Scheduling & Automation · 150.A) Orchestrator.I
-Active items only. Completed/historic work now resides in docs/implplan/archived_sprints_tasks.md (updated 2025-11-08).
+Active items only. Completed/historic work now resides in docs/implplan/archived/tasks.md (updated 2025-11-08).
[Scheduling & Automation] 150.A) Orchestrator.I
Depends on: Sprint 120.A - AirGap, Sprint 130.A - Scanner, Sprint 140.A - Graph
diff --git a/docs/implplan/SPRINT_152_orchestrator_ii.md b/docs/implplan/SPRINT_152_orchestrator_ii.md
index 989e4959a..08c9bc7e0 100644
--- a/docs/implplan/SPRINT_152_orchestrator_ii.md
+++ b/docs/implplan/SPRINT_152_orchestrator_ii.md
@@ -1,6 +1,6 @@
# Sprint 152 - Scheduling & Automation · 150.A) Orchestrator.II
-Active items only. Completed/historic work now resides in docs/implplan/archived_sprints_tasks.md (updated 2025-11-08).
+Active items only. Completed/historic work now resides in docs/implplan/archived/tasks.md (updated 2025-11-08).
[Scheduling & Automation] 150.A) Orchestrator.II
Depends on: Sprint 150.A - Orchestrator.I
diff --git a/docs/implplan/SPRINT_153_orchestrator_iii.md b/docs/implplan/SPRINT_153_orchestrator_iii.md
index 662b9139b..e4f222cc2 100644
--- a/docs/implplan/SPRINT_153_orchestrator_iii.md
+++ b/docs/implplan/SPRINT_153_orchestrator_iii.md
@@ -1,6 +1,6 @@
# Sprint 153 - Scheduling & Automation · 150.A) Orchestrator.III
-Active items only. Completed/historic work now resides in docs/implplan/archived_sprints_tasks.md (updated 2025-11-08).
+Active items only. Completed/historic work now resides in docs/implplan/archived/tasks.md (updated 2025-11-08).
[Scheduling & Automation] 150.A) Orchestrator.III
Depends on: Sprint 150.A - Orchestrator.II
diff --git a/docs/implplan/SPRINT_154_packsregistry.md b/docs/implplan/SPRINT_154_packsregistry.md
index 25cd7e273..a40634e5d 100644
--- a/docs/implplan/SPRINT_154_packsregistry.md
+++ b/docs/implplan/SPRINT_154_packsregistry.md
@@ -1,6 +1,6 @@
# Sprint 154 - Scheduling & Automation · 150.B) PacksRegistry
-Active items only. Completed/historic work now resides in docs/implplan/archived_sprints_tasks.md (updated 2025-11-08).
+Active items only. Completed/historic work now resides in docs/implplan/archived/tasks.md (updated 2025-11-08).
[Scheduling & Automation] 150.B) PacksRegistry
Depends on: Sprint 120.A - AirGap, Sprint 130.A - Scanner, Sprint 140.A - Graph
diff --git a/docs/implplan/SPRINT_155_scheduler_i.md b/docs/implplan/SPRINT_155_scheduler_i.md
index f33f828d9..7474fd9a5 100644
--- a/docs/implplan/SPRINT_155_scheduler_i.md
+++ b/docs/implplan/SPRINT_155_scheduler_i.md
@@ -1,6 +1,6 @@
# Sprint 155 - Scheduling & Automation · 150.C) Scheduler.I
-Active items only. Completed/historic work now resides in docs/implplan/archived_sprints_tasks.md (updated 2025-11-08).
+Active items only. Completed/historic work now resides in docs/implplan/archived/tasks.md (updated 2025-11-08).
[Scheduling & Automation] 150.C) Scheduler.I
Depends on: Sprint 120.A - AirGap, Sprint 130.A - Scanner, Sprint 140.A - Graph
diff --git a/docs/implplan/SPRINT_156_scheduler_ii.md b/docs/implplan/SPRINT_156_scheduler_ii.md
index 54742db29..43ae4d5d4 100644
--- a/docs/implplan/SPRINT_156_scheduler_ii.md
+++ b/docs/implplan/SPRINT_156_scheduler_ii.md
@@ -1,6 +1,6 @@
# Sprint 156 - Scheduling & Automation · 150.C) Scheduler.II
-Active items only. Completed/historic work now resides in docs/implplan/archived_sprints_tasks.md (updated 2025-11-08).
+Active items only. Completed/historic work now resides in docs/implplan/archived/tasks.md (updated 2025-11-08).
[Scheduling & Automation] 150.C) Scheduler.II
Depends on: Sprint 150.C - Scheduler.I
diff --git a/docs/implplan/SPRINT_157_taskrunner_i.md b/docs/implplan/SPRINT_157_taskrunner_i.md
index 42b30c6c9..35c883245 100644
--- a/docs/implplan/SPRINT_157_taskrunner_i.md
+++ b/docs/implplan/SPRINT_157_taskrunner_i.md
@@ -1,6 +1,6 @@
# Sprint 157 - Scheduling & Automation · 150.D) TaskRunner.I
-Active items only. Completed/historic work now resides in docs/implplan/archived_sprints_tasks.md (updated 2025-11-08).
+Active items only. Completed/historic work now resides in docs/implplan/archived/tasks.md (updated 2025-11-08).
[Scheduling & Automation] 150.D) TaskRunner.I
Depends on: Sprint 120.A - AirGap, Sprint 130.A - Scanner, Sprint 140.A - Graph
diff --git a/docs/implplan/SPRINT_158_taskrunner_ii.md b/docs/implplan/SPRINT_158_taskrunner_ii.md
index 2c4f7849c..1f32be4af 100644
--- a/docs/implplan/SPRINT_158_taskrunner_ii.md
+++ b/docs/implplan/SPRINT_158_taskrunner_ii.md
@@ -1,6 +1,6 @@
# Sprint 158 - Scheduling & Automation · 150.D) TaskRunner.II
-Active items only. Completed/historic work now resides in docs/implplan/archived_sprints_tasks.md (updated 2025-11-08).
+Active items only. Completed/historic work now resides in docs/implplan/archived/tasks.md (updated 2025-11-08).
[Scheduling & Automation] 150.D) TaskRunner.II
Depends on: Sprint 150.D - TaskRunner.I
diff --git a/docs/implplan/SPRINT_160_export_evidence.md b/docs/implplan/SPRINT_160_export_evidence.md
index 9fa5ace5e..4faedb660 100644
--- a/docs/implplan/SPRINT_160_export_evidence.md
+++ b/docs/implplan/SPRINT_160_export_evidence.md
@@ -1,6 +1,6 @@
# Sprint 160 - Export & Evidence
-Active items only. Completed/historic work now resides in docs/implplan/archived_sprints_tasks.md (updated 2025-11-08).
+Active items only. Completed/historic work now resides in docs/implplan/archived/tasks.md (updated 2025-11-08).
This file now only tracks the export & evidence status snapshot. Active backlog lives in Sprint 161+ files.
diff --git a/docs/implplan/SPRINT_161_evidencelocker.md b/docs/implplan/SPRINT_161_evidencelocker.md
index 7e0f815d1..f339d874b 100644
--- a/docs/implplan/SPRINT_161_evidencelocker.md
+++ b/docs/implplan/SPRINT_161_evidencelocker.md
@@ -1,6 +1,6 @@
# Sprint 161 - Export & Evidence · 160.A) EvidenceLocker
-Active items only. Completed/historic work now resides in docs/implplan/archived_sprints_tasks.md (updated 2025-11-08).
+Active items only. Completed/historic work now resides in docs/implplan/archived/tasks.md (updated 2025-11-08).
[Export & Evidence] 160.A) EvidenceLocker
Depends on: Sprint 110.A - AdvisoryAI, Sprint 120.A - AirGap, Sprint 130.A - Scanner, Sprint 150.A - Orchestrator
diff --git a/docs/implplan/SPRINT_162_exportcenter_i.md b/docs/implplan/SPRINT_162_exportcenter_i.md
index fb6764b82..6bfc6bf91 100644
--- a/docs/implplan/SPRINT_162_exportcenter_i.md
+++ b/docs/implplan/SPRINT_162_exportcenter_i.md
@@ -1,6 +1,6 @@
# Sprint 162 - Export & Evidence · 160.B) ExportCenter.I
-Active items only. Completed/historic work now resides in docs/implplan/archived_sprints_tasks.md (updated 2025-11-08).
+Active items only. Completed/historic work now resides in docs/implplan/archived/tasks.md (updated 2025-11-08).
[Export & Evidence] 160.B) ExportCenter.I
Depends on: Sprint 110.A - AdvisoryAI, Sprint 120.A - AirGap, Sprint 130.A - Scanner, Sprint 150.A - Orchestrator
diff --git a/docs/implplan/SPRINT_163_exportcenter_ii.md b/docs/implplan/SPRINT_163_exportcenter_ii.md
index ba0490c85..08c493703 100644
--- a/docs/implplan/SPRINT_163_exportcenter_ii.md
+++ b/docs/implplan/SPRINT_163_exportcenter_ii.md
@@ -1,6 +1,6 @@
# Sprint 163 - Export & Evidence · 160.B) ExportCenter.II
-Active items only. Completed/historic work now resides in docs/implplan/archived_sprints_tasks.md (updated 2025-11-08).
+Active items only. Completed/historic work now resides in docs/implplan/archived/tasks.md (updated 2025-11-08).
[Export & Evidence] 160.B) ExportCenter.II
Depends on: Sprint 160.B - ExportCenter.I
diff --git a/docs/implplan/SPRINT_164_exportcenter_iii.md b/docs/implplan/SPRINT_164_exportcenter_iii.md
index 2b4eaa407..0845ae3bc 100644
--- a/docs/implplan/SPRINT_164_exportcenter_iii.md
+++ b/docs/implplan/SPRINT_164_exportcenter_iii.md
@@ -1,6 +1,6 @@
# Sprint 164 - Export & Evidence · 160.B) ExportCenter.III
-Active items only. Completed/historic work now resides in docs/implplan/archived_sprints_tasks.md (updated 2025-11-08).
+Active items only. Completed/historic work now resides in docs/implplan/archived/tasks.md (updated 2025-11-08).
[Export & Evidence] 160.B) ExportCenter.III
Depends on: Sprint 160.B - ExportCenter.II
diff --git a/docs/implplan/SPRINT_165_timelineindexer.md b/docs/implplan/SPRINT_165_timelineindexer.md
index 7777ac033..8a3c28bb8 100644
--- a/docs/implplan/SPRINT_165_timelineindexer.md
+++ b/docs/implplan/SPRINT_165_timelineindexer.md
@@ -1,6 +1,6 @@
# Sprint 165 - Export & Evidence · 160.C) TimelineIndexer
-Active items only. Completed/historic work now resides in docs/implplan/archived_sprints_tasks.md (updated 2025-11-08).
+Active items only. Completed/historic work now resides in docs/implplan/archived/tasks.md (updated 2025-11-08).
[Export & Evidence] 160.C) TimelineIndexer
Depends on: Sprint 110.A - AdvisoryAI, Sprint 120.A - AirGap, Sprint 130.A - Scanner, Sprint 150.A - Orchestrator
diff --git a/docs/implplan/SPRINT_170_notifications_telemetry.md b/docs/implplan/SPRINT_170_notifications_telemetry.md
index 702ad0bb6..965bf2d5f 100644
--- a/docs/implplan/SPRINT_170_notifications_telemetry.md
+++ b/docs/implplan/SPRINT_170_notifications_telemetry.md
@@ -1,6 +1,6 @@
# Sprint 170 - Notifications & Telemetry
-Active items only. Completed/historic work now resides in docs/implplan/archived_sprints_tasks.md (updated 2025-11-08).
+Active items only. Completed/historic work now resides in docs/implplan/archived/tasks.md (updated 2025-11-08).
This file now only tracks the notifications & telemetry status snapshot. Active backlog lives in Sprint 171+ files.
diff --git a/docs/implplan/SPRINT_171_notifier_i.md b/docs/implplan/SPRINT_171_notifier_i.md
index 0130255e1..05daab535 100644
--- a/docs/implplan/SPRINT_171_notifier_i.md
+++ b/docs/implplan/SPRINT_171_notifier_i.md
@@ -1,6 +1,6 @@
# Sprint 171 - Notifications & Telemetry · 170.A) Notifier.I
-Active items only. Completed/historic work now resides in docs/implplan/archived_sprints_tasks.md (updated 2025-11-08).
+Active items only. Completed/historic work now resides in docs/implplan/archived/tasks.md (updated 2025-11-08).
[Notifications & Telemetry] 170.A) Notifier.I
Depends on: Sprint 150.A - Orchestrator
diff --git a/docs/implplan/SPRINT_172_notifier_ii.md b/docs/implplan/SPRINT_172_notifier_ii.md
index 3d65dd1c5..96784997e 100644
--- a/docs/implplan/SPRINT_172_notifier_ii.md
+++ b/docs/implplan/SPRINT_172_notifier_ii.md
@@ -1,6 +1,6 @@
# Sprint 172 - Notifications & Telemetry · 170.A) Notifier.II
-Active items only. Completed/historic work now resides in docs/implplan/archived_sprints_tasks.md (updated 2025-11-08).
+Active items only. Completed/historic work now resides in docs/implplan/archived/tasks.md (updated 2025-11-08).
[Notifications & Telemetry] 170.A) Notifier.II
Depends on: Sprint 170.A - Notifier.I
diff --git a/docs/implplan/SPRINT_173_notifier_iii.md b/docs/implplan/SPRINT_173_notifier_iii.md
index df3b3a3d9..4d16cd4e9 100644
--- a/docs/implplan/SPRINT_173_notifier_iii.md
+++ b/docs/implplan/SPRINT_173_notifier_iii.md
@@ -1,6 +1,6 @@
# Sprint 173 - Notifications & Telemetry · 170.A) Notifier.III
-Active items only. Completed/historic work now resides in docs/implplan/archived_sprints_tasks.md (updated 2025-11-08).
+Active items only. Completed/historic work now resides in docs/implplan/archived/tasks.md (updated 2025-11-08).
[Notifications & Telemetry] 170.A) Notifier.III
Depends on: Sprint 170.A - Notifier.II
diff --git a/docs/implplan/SPRINT_174_telemetry.md b/docs/implplan/SPRINT_174_telemetry.md
index 766f5c18e..9fb0243fb 100644
--- a/docs/implplan/SPRINT_174_telemetry.md
+++ b/docs/implplan/SPRINT_174_telemetry.md
@@ -1,6 +1,6 @@
# Sprint 174 - Notifications & Telemetry · 170.B) Telemetry
-Active items only. Completed/historic work now resides in docs/implplan/archived_sprints_tasks.md (updated 2025-11-08).
+Active items only. Completed/historic work now resides in docs/implplan/archived/tasks.md (updated 2025-11-08).
[Notifications & Telemetry] 170.B) Telemetry
Depends on: Sprint 150.A - Orchestrator
diff --git a/docs/implplan/SPRINT_200_experience_sdks.md b/docs/implplan/SPRINT_200_experience_sdks.md
index d8ed64a96..c985b4c28 100644
--- a/docs/implplan/SPRINT_200_experience_sdks.md
+++ b/docs/implplan/SPRINT_200_experience_sdks.md
@@ -1,5 +1,5 @@
# Sprint 200 - Experience & SDKs
-Active items only. Completed/historic work now resides in docs/implplan/archived_sprints_tasks.md (updated 2025-11-08).
+Active items only. Completed/historic work now resides in docs/implplan/archived/tasks.md (updated 2025-11-08).
This file now only tracks the Experience & SDKs status snapshot. Active backlog lives in Sprint 201 and later files.
diff --git a/docs/implplan/SPRINT_201_cli_i.md b/docs/implplan/SPRINT_201_cli_i.md
index ce7488037..1c31df5d1 100644
--- a/docs/implplan/SPRINT_201_cli_i.md
+++ b/docs/implplan/SPRINT_201_cli_i.md
@@ -1,6 +1,6 @@
# Sprint 201 - Experience & SDKs · 180.A) Cli.I
-Active items only. Completed/historic work now resides in docs/implplan/archived_sprints_tasks.md (updated 2025-11-08).
+Active items only. Completed/historic work now resides in docs/implplan/archived/tasks.md (updated 2025-11-08).
[Experience & SDKs] 180.A) Cli.I
Depends on: Sprint 120.A - AirGap, Sprint 130.A - Scanner, Sprint 150.A - Orchestrator, Sprint 170.A - Notifier
diff --git a/docs/implplan/SPRINT_202_cli_ii.md b/docs/implplan/SPRINT_202_cli_ii.md
index eb36ea46c..862449df3 100644
--- a/docs/implplan/SPRINT_202_cli_ii.md
+++ b/docs/implplan/SPRINT_202_cli_ii.md
@@ -1,6 +1,6 @@
# Sprint 202 - Experience & SDKs · 180.A) Cli.II
-Active items only. Completed/historic work now resides in docs/implplan/archived_sprints_tasks.md (updated 2025-11-08).
+Active items only. Completed/historic work now resides in docs/implplan/archived/tasks.md (updated 2025-11-08).
[Experience & SDKs] 180.A) Cli.II
Depends on: Sprint 180.A - Cli.I
diff --git a/docs/implplan/SPRINT_203_cli_iii.md b/docs/implplan/SPRINT_203_cli_iii.md
index dcfaaf25c..d867b29b5 100644
--- a/docs/implplan/SPRINT_203_cli_iii.md
+++ b/docs/implplan/SPRINT_203_cli_iii.md
@@ -1,6 +1,6 @@
# Sprint 203 - Experience & SDKs · 180.A) Cli.III
-Active items only. Completed/historic work now resides in docs/implplan/archived_sprints_tasks.md (updated 2025-11-08).
+Active items only. Completed/historic work now resides in docs/implplan/archived/tasks.md (updated 2025-11-08).
[Experience & SDKs] 180.A) Cli.III
Depends on: Sprint 180.A - Cli.II
@@ -17,8 +17,10 @@ CLI-PACKS-42-001 | TODO | Implement Task Pack commands (`pack plan/run/push/pull
CLI-PACKS-43-001 | TODO | Deliver advanced pack features (approvals pause/resume, secret injection, localization, man pages, offline cache). Dependencies: CLI-PACKS-42-001. | DevEx/CLI Guild (src/Cli/StellaOps.Cli)
CLI-PARITY-41-001 | TODO | Deliver parity command groups (`policy`, `sbom`, `vuln`, `vex`, `advisory`, `export`, `orchestrator`) with `--explain`, deterministic outputs, and parity matrix entries. | DevEx/CLI Guild (src/Cli/StellaOps.Cli)
CLI-PARITY-41-002 | TODO | Implement `notify`, `aoc`, `auth` command groups, idempotency keys, shell completions, config docs, and parity matrix export tooling. Dependencies: CLI-PARITY-41-001. | DevEx/CLI Guild (src/Cli/StellaOps.Cli)
+CLI-SBOM-60-001 | TODO | Ship `stella sbomer layer`/`compose` verbs that capture per-layer fragments, run canonicalization, verify fragment DSSE, and emit `_composition.json` + Merkle diagnostics (ref `docs/modules/scanner/deterministic-sbom-compose.md`). Dependencies: CLI-PARITY-41-001, SCANNER-SURFACE-04. | DevEx/CLI Guild (src/Cli/StellaOps.Cli)
+CLI-SBOM-60-002 | TODO | Add `stella sbomer drift --explain` + `verify` commands that rerun composition locally, highlight which arrays/keys broke determinism, and integrate with Offline Kit bundles. Dependencies: CLI-SBOM-60-001. | DevEx/CLI Guild (src/Cli/StellaOps.Cli)
CLI-POLICY-20-001 | TODO | Add `stella policy new | DevEx/CLI Guild (src/Cli/StellaOps.Cli)
CLI-POLICY-23-004 | TODO | Add `stella policy lint` command validating SPL files with compiler diagnostics; support JSON output. Dependencies: CLI-POLICY-20-001. | DevEx/CLI Guild (src/Cli/StellaOps.Cli)
> 2025-11-06: CLI enforces `--version` as mandatory and adds scheduled activation timestamp normalization tests while keeping exit codes intact.
CLI-POLICY-23-006 | TODO | Provide `stella policy history` and `stella policy explain` commands to pull run history and explanation trees. Dependencies: CLI-POLICY-23-005. | DevEx/CLI Guild (src/Cli/StellaOps.Cli)
-CLI-POLICY-27-001 | TODO | Implement policy workspace commands (`stella policy init`, `edit`, `lint`, `compile`, `test`) with template selection, local cache, JSON output, and deterministic temp directories. Dependencies: CLI-POLICY-23-006. | DevEx/CLI Guild (src/Cli/StellaOps.Cli)
\ No newline at end of file
+CLI-POLICY-27-001 | TODO | Implement policy workspace commands (`stella policy init`, `edit`, `lint`, `compile`, `test`) with template selection, local cache, JSON output, and deterministic temp directories. Dependencies: CLI-POLICY-23-006. | DevEx/CLI Guild (src/Cli/StellaOps.Cli)
diff --git a/docs/implplan/SPRINT_204_cli_iv.md b/docs/implplan/SPRINT_204_cli_iv.md
index 615a914e5..d6cea45cc 100644
--- a/docs/implplan/SPRINT_204_cli_iv.md
+++ b/docs/implplan/SPRINT_204_cli_iv.md
@@ -1,6 +1,6 @@
# Sprint 204 - Experience & SDKs · 180.A) Cli.IV
-Active items only. Completed/historic work now resides in docs/implplan/archived_sprints_tasks.md (updated 2025-11-08).
+Active items only. Completed/historic work now resides in docs/implplan/archived/tasks.md (updated 2025-11-08).
[Experience & SDKs] 180.A) Cli.IV
Depends on: Sprint 180.A - Cli.III
diff --git a/docs/implplan/SPRINT_205_cli_v.md b/docs/implplan/SPRINT_205_cli_v.md
index cb4d56537..ad8cfecd0 100644
--- a/docs/implplan/SPRINT_205_cli_v.md
+++ b/docs/implplan/SPRINT_205_cli_v.md
@@ -1,6 +1,6 @@
# Sprint 205 - Experience & SDKs · 180.A) Cli.V
-Active items only. Completed/historic work now resides in docs/implplan/archived_sprints_tasks.md (updated 2025-11-08).
+Active items only. Completed/historic work now resides in docs/implplan/archived/tasks.md (updated 2025-11-08).
[Experience & SDKs] 180.A) Cli.V
Depends on: Sprint 180.A - Cli.IV
diff --git a/docs/implplan/SPRINT_206_devportal.md b/docs/implplan/SPRINT_206_devportal.md
index be95068ae..93b7d5f3f 100644
--- a/docs/implplan/SPRINT_206_devportal.md
+++ b/docs/implplan/SPRINT_206_devportal.md
@@ -1,6 +1,6 @@
# Sprint 206 - Experience & SDKs · 180.B) DevPortal
-Active items only. Completed/historic work now resides in docs/implplan/archived_sprints_tasks.md (updated 2025-11-08).
+Active items only. Completed/historic work now resides in docs/implplan/archived/tasks.md (updated 2025-11-08).
[Experience & SDKs] 180.B) DevPortal
Depends on: Sprint 120.A - AirGap, Sprint 130.A - Scanner, Sprint 150.A - Orchestrator, Sprint 170.A - Notifier
diff --git a/docs/implplan/SPRINT_207_graph.md b/docs/implplan/SPRINT_207_graph.md
index eb849cdb5..b45306264 100644
--- a/docs/implplan/SPRINT_207_graph.md
+++ b/docs/implplan/SPRINT_207_graph.md
@@ -1,6 +1,6 @@
# Sprint 207 - Experience & SDKs · 180.C) Graph
-Active items only. Completed/historic work now resides in docs/implplan/archived_sprints_tasks.md (updated 2025-11-08).
+Active items only. Completed/historic work now resides in docs/implplan/archived/tasks.md (updated 2025-11-08).
[Experience & SDKs] 180.C) Graph
Depends on: Sprint 120.A - AirGap, Sprint 130.A - Scanner, Sprint 150.A - Orchestrator, Sprint 170.A - Notifier
diff --git a/docs/implplan/SPRINT_208_sdk.md b/docs/implplan/SPRINT_208_sdk.md
index 1dbf740ad..5742d790e 100644
--- a/docs/implplan/SPRINT_208_sdk.md
+++ b/docs/implplan/SPRINT_208_sdk.md
@@ -1,6 +1,6 @@
# Sprint 208 - Experience & SDKs · 180.D) Sdk
-Active items only. Completed/historic work now resides in docs/implplan/archived_sprints_tasks.md (updated 2025-11-08).
+Active items only. Completed/historic work now resides in docs/implplan/archived/tasks.md (updated 2025-11-08).
[Experience & SDKs] 180.D) Sdk
Depends on: Sprint 120.A - AirGap, Sprint 130.A - Scanner, Sprint 150.A - Orchestrator, Sprint 170.A - Notifier
diff --git a/docs/implplan/SPRINT_209_ui_i.md b/docs/implplan/SPRINT_209_ui_i.md
index fffa591f4..09d8242aa 100644
--- a/docs/implplan/SPRINT_209_ui_i.md
+++ b/docs/implplan/SPRINT_209_ui_i.md
@@ -1,6 +1,6 @@
# Sprint 209 - Experience & SDKs · 180.E) UI.I
-Active items only. Completed/historic work now resides in docs/implplan/archived_sprints_tasks.md (updated 2025-11-08).
+Active items only. Completed/historic work now resides in docs/implplan/archived/tasks.md (updated 2025-11-08).
[Experience & SDKs] 180.E) UI.I
Depends on: Sprint 120.A - AirGap, Sprint 130.A - Scanner, Sprint 150.A - Orchestrator, Sprint 170.A - Notifier
@@ -21,4 +21,6 @@ UI-GRAPH-24-002 | TODO | Implement overlays (Policy, Evidence, License, Exposure
UI-GRAPH-24-003 | TODO | Deliver filters/search panel with facets, saved views, permalinks, and share modal. Dependencies: UI-GRAPH-24-002. | UI Guild (src/UI/StellaOps.UI)
UI-GRAPH-24-004 | TODO | Add side panels (Details, What-if, History) with upgrade simulation integration and SBOM diff viewer. Dependencies: UI-GRAPH-24-003. | UI Guild (src/UI/StellaOps.UI)
UI-GRAPH-24-006 | TODO | Ensure accessibility (keyboard nav, screen reader labels, contrast), add hotkeys (`f`,`e`,`.`), and analytics instrumentation. Dependencies: UI-GRAPH-24-004. | UI Guild, Accessibility Guild (src/UI/StellaOps.UI)
-UI-LNM-22-001 | TODO | Build Evidence panel showing policy decision with advisory observations/linksets side-by-side, conflict badges, AOC chain, and raw doc download links. Docs `DOCS-LNM-22-005` waiting on delivered UI for screenshots + flows. | UI Guild, Policy Guild (src/UI/StellaOps.UI)
\ No newline at end of file
+UI-LNM-22-001 | TODO | Build Evidence panel showing policy decision with advisory observations/linksets side-by-side, conflict badges, AOC chain, and raw doc download links. Docs `DOCS-LNM-22-005` waiting on delivered UI for screenshots + flows. | UI Guild, Policy Guild (src/UI/StellaOps.UI)
+UI-SBOM-DET-01 | TODO | Add a “Determinism” badge plus drill-down that surfaces fragment hashes, `_composition.json`, and Merkle root consistency when viewing scan details (per `docs/modules/scanner/deterministic-sbom-compose.md`). | UI Guild (src/UI/StellaOps.UI) |
+UI-POLICY-DET-01 | TODO | Wire policy gate indicators + remediation hints into Release/Policy flows, blocking publishes when determinism checks fail; coordinate with Policy Engine schema updates. Dependencies: UI-SBOM-DET-01. | UI Guild, Policy Guild (src/UI/StellaOps.UI) |
diff --git a/docs/implplan/SPRINT_210_ui_ii.md b/docs/implplan/SPRINT_210_ui_ii.md
index c211d51e2..cb00ffed3 100644
--- a/docs/implplan/SPRINT_210_ui_ii.md
+++ b/docs/implplan/SPRINT_210_ui_ii.md
@@ -1,6 +1,6 @@
# Sprint 210 - Experience & SDKs · 180.E) UI.II
-Active items only. Completed/historic work now resides in docs/implplan/archived_sprints_tasks.md (updated 2025-11-08).
+Active items only. Completed/historic work now resides in docs/implplan/archived/tasks.md (updated 2025-11-08).
[Experience & SDKs] 180.E) UI.II
Depends on: Sprint 180.E - UI.I
diff --git a/docs/implplan/SPRINT_211_ui_iii.md b/docs/implplan/SPRINT_211_ui_iii.md
index 2a7caea41..299a638b7 100644
--- a/docs/implplan/SPRINT_211_ui_iii.md
+++ b/docs/implplan/SPRINT_211_ui_iii.md
@@ -1,6 +1,6 @@
# Sprint 211 - Experience & SDKs · 180.E) UI.III
-Active items only. Completed/historic work now resides in docs/implplan/archived_sprints_tasks.md (updated 2025-11-08).
+Active items only. Completed/historic work now resides in docs/implplan/archived/tasks.md (updated 2025-11-08).
[Experience & SDKs] 180.E) UI.III
Depends on: Sprint 180.E - UI.II
diff --git a/docs/implplan/SPRINT_212_web_i.md b/docs/implplan/SPRINT_212_web_i.md
index 17c498f51..4763156d9 100644
--- a/docs/implplan/SPRINT_212_web_i.md
+++ b/docs/implplan/SPRINT_212_web_i.md
@@ -1,6 +1,6 @@
# Sprint 212 - Experience & SDKs · 180.F) Web.I
-Active items only. Completed/historic work now resides in docs/implplan/archived_sprints_tasks.md (updated 2025-11-08).
+Active items only. Completed/historic work now resides in docs/implplan/archived/tasks.md (updated 2025-11-08).
[Experience & SDKs] 180.F) Web.I
Depends on: Sprint 120.A - AirGap, Sprint 130.A - Scanner, Sprint 150.A - Orchestrator, Sprint 170.A - Notifier
diff --git a/docs/implplan/SPRINT_213_web_ii.md b/docs/implplan/SPRINT_213_web_ii.md
index a5c740f49..0eb632b30 100644
--- a/docs/implplan/SPRINT_213_web_ii.md
+++ b/docs/implplan/SPRINT_213_web_ii.md
@@ -1,6 +1,6 @@
# Sprint 213 - Experience & SDKs · 180.F) Web.II
-Active items only. Completed/historic work now resides in docs/implplan/archived_sprints_tasks.md (updated 2025-11-08).
+Active items only. Completed/historic work now resides in docs/implplan/archived/tasks.md (updated 2025-11-08).
[Experience & SDKs] 180.F) Web.II
Depends on: Sprint 180.F - Web.I
diff --git a/docs/implplan/SPRINT_214_web_iii.md b/docs/implplan/SPRINT_214_web_iii.md
index 1b5163e27..70d9e632f 100644
--- a/docs/implplan/SPRINT_214_web_iii.md
+++ b/docs/implplan/SPRINT_214_web_iii.md
@@ -1,6 +1,6 @@
# Sprint 214 - Experience & SDKs · 180.F) Web.III
-Active items only. Completed/historic work now resides in docs/implplan/archived_sprints_tasks.md (updated 2025-11-08).
+Active items only. Completed/historic work now resides in docs/implplan/archived/tasks.md (updated 2025-11-08).
[Experience & SDKs] 180.F) Web.III
Depends on: Sprint 180.F - Web.II
diff --git a/docs/implplan/SPRINT_215_web_iv.md b/docs/implplan/SPRINT_215_web_iv.md
index 2ffb7af10..b9958722f 100644
--- a/docs/implplan/SPRINT_215_web_iv.md
+++ b/docs/implplan/SPRINT_215_web_iv.md
@@ -1,6 +1,6 @@
# Sprint 215 - Experience & SDKs · 180.F) Web.IV
-Active items only. Completed/historic work now resides in docs/implplan/archived_sprints_tasks.md (updated 2025-11-08).
+Active items only. Completed/historic work now resides in docs/implplan/archived/tasks.md (updated 2025-11-08).
[Experience & SDKs] 180.F) Web.IV
Depends on: Sprint 180.F - Web.III
diff --git a/docs/implplan/SPRINT_216_web_v.md b/docs/implplan/SPRINT_216_web_v.md
index 2283e9bf4..e0264a5bb 100644
--- a/docs/implplan/SPRINT_216_web_v.md
+++ b/docs/implplan/SPRINT_216_web_v.md
@@ -1,6 +1,6 @@
# Sprint 216 - Experience & SDKs · 180.F) Web.V
-Active items only. Completed/historic work now resides in docs/implplan/archived_sprints_tasks.md (updated 2025-11-08).
+Active items only. Completed/historic work now resides in docs/implplan/archived/tasks.md (updated 2025-11-08).
[Experience & SDKs] 180.F) Web.V
Depends on: Sprint 180.F - Web.IV
diff --git a/docs/implplan/SPRINT_300_documentation_process.md b/docs/implplan/SPRINT_300_documentation_process.md
index 6585ad59e..04ad771ba 100644
--- a/docs/implplan/SPRINT_300_documentation_process.md
+++ b/docs/implplan/SPRINT_300_documentation_process.md
@@ -1,5 +1,5 @@
# Sprint 300 - Documentation & Process
-Active items only. Completed/historic work now resides in docs/implplan/archived_sprints_tasks.md (updated 2025-11-08).
+Active items only. Completed/historic work now resides in docs/implplan/archived/tasks.md (updated 2025-11-08).
This file now only tracks the documentation & process status snapshot. Active backlog lives in Sprint 301 and later files.
diff --git a/docs/implplan/SPRINT_301_docs_tasks_md_i.md b/docs/implplan/SPRINT_301_docs_tasks_md_i.md
index 656308d69..87f20f9a3 100644
--- a/docs/implplan/SPRINT_301_docs_tasks_md_i.md
+++ b/docs/implplan/SPRINT_301_docs_tasks_md_i.md
@@ -1,6 +1,6 @@
# Sprint 301 - Documentation & Process · 200.A) Docs Tasks.Md.I
-Active items only. Completed/historic work now resides in docs/implplan/archived_sprints_tasks.md (updated 2025-11-08).
+Active items only. Completed/historic work now resides in docs/implplan/archived/tasks.md (updated 2025-11-08).
[Documentation & Process] 200.A) Docs Tasks.Md.I
Depends on: Sprint 100.A - Attestor, Sprint 110.A - AdvisoryAI, Sprint 120.A - AirGap, Sprint 130.A - Scanner, Sprint 140.A - Graph, Sprint 150.A - Orchestrator, Sprint 160.A - EvidenceLocker, Sprint 170.A - Notifier, Sprint 180.A - Cli, Sprint 190.A - Ops Deployment
@@ -17,4 +17,7 @@ DOCS-AIRGAP-56-002 | TODO | Author `/docs/airgap/sealing-and-egress.md` covering
DOCS-AIRGAP-56-003 | TODO | Create `/docs/airgap/mirror-bundles.md` describing bundle format, DSSE/TUF/Merkle validation, creation/import workflows. Dependencies: DOCS-AIRGAP-56-002. | Docs Guild, Exporter Guild (docs)
DOCS-AIRGAP-56-004 | TODO | Publish `/docs/airgap/bootstrap.md` detailing Bootstrap Pack creation, validation, and install procedures. Dependencies: DOCS-AIRGAP-56-003. | Docs Guild, Deployment Guild (docs)
DOCS-AIRGAP-57-001 | TODO | Write `/docs/airgap/staleness-and-time.md` explaining time anchors, drift policies, staleness budgets, and UI indicators. Dependencies: DOCS-AIRGAP-56-004. | Docs Guild, AirGap Time Guild (docs)
-DOCS-AIRGAP-57-002 | TODO | Publish `/docs/console/airgap.md` covering sealed badge, import wizard, staleness dashboards. Dependencies: DOCS-AIRGAP-57-001. | Docs Guild, Console Guild (docs)
\ No newline at end of file
+DOCS-AIRGAP-57-002 | TODO | Publish `/docs/console/airgap.md` covering sealed badge, import wizard, staleness dashboards. Dependencies: DOCS-AIRGAP-57-001. | Docs Guild, Console Guild (docs)
+DOCS-SCANNER-DET-01 | TODO | Author `/docs/modules/scanner/deterministic-sbom-compose.md` plus scan guide updates describing fragment DSSE, `_composition.json`, and offline verification (ties to Sprint 136 tasks). | Docs Guild, Scanner Guild (docs)
+DOCS-POLICY-DET-01 | TODO | Extend `docs/modules/policy/architecture.md` with determinism gate semantics, SPL examples, and provenance references for UI badge/policy blockers. | Docs Guild, Policy Guild (docs)
+DOCS-CLI-DET-01 | TODO | Document new `stella sbomer` verbs (`layer`, `compose`, `drift`, `verify`) with examples, exit codes, and Offline Kit instructions in `docs/cli/commands/sbomer.md`. Dependencies: CLI-SBOM-60-001/002. | Docs Guild, DevEx/CLI Guild (docs)
diff --git a/docs/implplan/SPRINT_302_docs_tasks_md_ii.md b/docs/implplan/SPRINT_302_docs_tasks_md_ii.md
index 8b5b61100..c01adb315 100644
--- a/docs/implplan/SPRINT_302_docs_tasks_md_ii.md
+++ b/docs/implplan/SPRINT_302_docs_tasks_md_ii.md
@@ -1,6 +1,6 @@
# Sprint 302 - Documentation & Process · 200.A) Docs Tasks.Md.II
-Active items only. Completed/historic work now resides in docs/implplan/archived_sprints_tasks.md (updated 2025-11-08).
+Active items only. Completed/historic work now resides in docs/implplan/archived/tasks.md (updated 2025-11-08).
[Documentation & Process] 200.A) Docs Tasks.Md.II
Depends on: Sprint 200.A - Docs Tasks.Md.I
diff --git a/docs/implplan/SPRINT_303_docs_tasks_md_iii.md b/docs/implplan/SPRINT_303_docs_tasks_md_iii.md
index f9cf16601..bbda054f9 100644
--- a/docs/implplan/SPRINT_303_docs_tasks_md_iii.md
+++ b/docs/implplan/SPRINT_303_docs_tasks_md_iii.md
@@ -1,6 +1,6 @@
# Sprint 303 - Documentation & Process · 200.A) Docs Tasks.Md.III
-Active items only. Completed/historic work now resides in docs/implplan/archived_sprints_tasks.md (updated 2025-11-08).
+Active items only. Completed/historic work now resides in docs/implplan/archived/tasks.md (updated 2025-11-08).
[Documentation & Process] 200.A) Docs Tasks.Md.III
Depends on: Sprint 200.A - Docs Tasks.Md.II
diff --git a/docs/implplan/SPRINT_304_docs_tasks_md_iv.md b/docs/implplan/SPRINT_304_docs_tasks_md_iv.md
index 5332f7875..52afa1d12 100644
--- a/docs/implplan/SPRINT_304_docs_tasks_md_iv.md
+++ b/docs/implplan/SPRINT_304_docs_tasks_md_iv.md
@@ -1,6 +1,6 @@
# Sprint 304 - Documentation & Process · 200.A) Docs Tasks.Md.IV
-Active items only. Completed/historic work now resides in docs/implplan/archived_sprints_tasks.md (updated 2025-11-08).
+Active items only. Completed/historic work now resides in docs/implplan/archived/tasks.md (updated 2025-11-08).
[Documentation & Process] 200.A) Docs Tasks.Md.IV
Depends on: Sprint 200.A - Docs Tasks.Md.III
diff --git a/docs/implplan/SPRINT_305_docs_tasks_md_v.md b/docs/implplan/SPRINT_305_docs_tasks_md_v.md
index 29eb3d11a..85c718d37 100644
--- a/docs/implplan/SPRINT_305_docs_tasks_md_v.md
+++ b/docs/implplan/SPRINT_305_docs_tasks_md_v.md
@@ -1,6 +1,6 @@
# Sprint 305 - Documentation & Process · 200.A) Docs Tasks.Md.V
-Active items only. Completed/historic work now resides in docs/implplan/archived_sprints_tasks.md (updated 2025-11-08).
+Active items only. Completed/historic work now resides in docs/implplan/archived/tasks.md (updated 2025-11-08).
[Documentation & Process] 200.A) Docs Tasks.Md.V
Depends on: Sprint 200.A - Docs Tasks.Md.IV
diff --git a/docs/implplan/SPRINT_306_docs_tasks_md_vi.md b/docs/implplan/SPRINT_306_docs_tasks_md_vi.md
index 889dddf10..5f42b1256 100644
--- a/docs/implplan/SPRINT_306_docs_tasks_md_vi.md
+++ b/docs/implplan/SPRINT_306_docs_tasks_md_vi.md
@@ -1,6 +1,6 @@
# Sprint 306 - Documentation & Process · 200.A) Docs Tasks.Md.VI
-Active items only. Completed/historic work now resides in docs/implplan/archived_sprints_tasks.md (updated 2025-11-08).
+Active items only. Completed/historic work now resides in docs/implplan/archived/tasks.md (updated 2025-11-08).
[Documentation & Process] 200.A) Docs Tasks.Md.VI
Depends on: Sprint 200.A - Docs Tasks.Md.V
diff --git a/docs/implplan/SPRINT_307_docs_tasks_md_vii.md b/docs/implplan/SPRINT_307_docs_tasks_md_vii.md
index 9dfd8a6e4..dda2298ab 100644
--- a/docs/implplan/SPRINT_307_docs_tasks_md_vii.md
+++ b/docs/implplan/SPRINT_307_docs_tasks_md_vii.md
@@ -1,6 +1,6 @@
# Sprint 307 - Documentation & Process · 200.A) Docs Tasks.Md.VII
-Active items only. Completed/historic work now resides in docs/implplan/archived_sprints_tasks.md (updated 2025-11-08).
+Active items only. Completed/historic work now resides in docs/implplan/archived/tasks.md (updated 2025-11-08).
[Documentation & Process] 200.A) Docs Tasks.Md.VII
Depends on: Sprint 200.A - Docs Tasks.Md.VI
diff --git a/docs/implplan/SPRINT_308_docs_tasks_md_viii.md b/docs/implplan/SPRINT_308_docs_tasks_md_viii.md
index 9379c995f..c1db6f88f 100644
--- a/docs/implplan/SPRINT_308_docs_tasks_md_viii.md
+++ b/docs/implplan/SPRINT_308_docs_tasks_md_viii.md
@@ -1,6 +1,6 @@
# Sprint 308 - Documentation & Process · 200.A) Docs Tasks.Md.VIII
-Active items only. Completed/historic work now resides in docs/implplan/archived_sprints_tasks.md (updated 2025-11-08).
+Active items only. Completed/historic work now resides in docs/implplan/archived/tasks.md (updated 2025-11-08).
[Documentation & Process] 200.A) Docs Tasks.Md.VIII
Depends on: Sprint 200.A - Docs Tasks.Md.VII
diff --git a/docs/implplan/SPRINT_309_docs_tasks_md_ix.md b/docs/implplan/SPRINT_309_docs_tasks_md_ix.md
index 8e55da9f3..0b1f0a8b7 100644
--- a/docs/implplan/SPRINT_309_docs_tasks_md_ix.md
+++ b/docs/implplan/SPRINT_309_docs_tasks_md_ix.md
@@ -1,6 +1,6 @@
# Sprint 309 - Documentation & Process · 200.A) Docs Tasks.Md.IX
-Active items only. Completed/historic work now resides in docs/implplan/archived_sprints_tasks.md (updated 2025-11-08).
+Active items only. Completed/historic work now resides in docs/implplan/archived/tasks.md (updated 2025-11-08).
[Documentation & Process] 200.A) Docs Tasks.Md.IX
Depends on: Sprint 200.A - Docs Tasks.Md.VIII
diff --git a/docs/implplan/SPRINT_310_docs_tasks_md_x.md b/docs/implplan/SPRINT_310_docs_tasks_md_x.md
index 1805fb049..1a507f31d 100644
--- a/docs/implplan/SPRINT_310_docs_tasks_md_x.md
+++ b/docs/implplan/SPRINT_310_docs_tasks_md_x.md
@@ -1,6 +1,6 @@
# Sprint 310 - Documentation & Process · 200.A) Docs Tasks.Md.X
-Active items only. Completed/historic work now resides in docs/implplan/archived_sprints_tasks.md (updated 2025-11-08).
+Active items only. Completed/historic work now resides in docs/implplan/archived/tasks.md (updated 2025-11-08).
[Documentation & Process] 200.A) Docs Tasks.Md.X
Depends on: Sprint 200.A - Docs Tasks.Md.IX
diff --git a/docs/implplan/SPRINT_311_docs_tasks_md_xi.md b/docs/implplan/SPRINT_311_docs_tasks_md_xi.md
index 74e73aec5..76459daee 100644
--- a/docs/implplan/SPRINT_311_docs_tasks_md_xi.md
+++ b/docs/implplan/SPRINT_311_docs_tasks_md_xi.md
@@ -1,6 +1,6 @@
# Sprint 311 - Documentation & Process · 200.A) Docs Tasks.Md.XI
-Active items only. Completed/historic work now resides in docs/implplan/archived_sprints_tasks.md (updated 2025-11-08).
+Active items only. Completed/historic work now resides in docs/implplan/archived/tasks.md (updated 2025-11-08).
[Documentation & Process] 200.A) Docs Tasks.Md.XI
Depends on: Sprint 200.A - Docs Tasks.Md.X
diff --git a/docs/implplan/SPRINT_312_docs_modules_advisory_ai.md b/docs/implplan/SPRINT_312_docs_modules_advisory_ai.md
index f84f965b7..0fbbfeba1 100644
--- a/docs/implplan/SPRINT_312_docs_modules_advisory_ai.md
+++ b/docs/implplan/SPRINT_312_docs_modules_advisory_ai.md
@@ -1,6 +1,6 @@
# Sprint 312 - Documentation & Process · 200.B) Docs Modules Advisory Ai
-Active items only. Completed/historic work now resides in docs/implplan/archived_sprints_tasks.md (updated 2025-11-08).
+Active items only. Completed/historic work now resides in docs/implplan/archived/tasks.md (updated 2025-11-08).
[Documentation & Process] 200.B) Docs Modules Advisory Ai
Depends on: Sprint 100.A - Attestor, Sprint 110.A - AdvisoryAI, Sprint 120.A - AirGap, Sprint 130.A - Scanner, Sprint 140.A - Graph, Sprint 150.A - Orchestrator, Sprint 160.A - EvidenceLocker, Sprint 170.A - Notifier, Sprint 180.A - Cli, Sprint 190.A - Ops Deployment
diff --git a/docs/implplan/SPRINT_313_docs_modules_attestor.md b/docs/implplan/SPRINT_313_docs_modules_attestor.md
index 31b9f4d80..41ccf18eb 100644
--- a/docs/implplan/SPRINT_313_docs_modules_attestor.md
+++ b/docs/implplan/SPRINT_313_docs_modules_attestor.md
@@ -1,6 +1,6 @@
# Sprint 313 - Documentation & Process · 200.C) Docs Modules Attestor
-Active items only. Completed/historic work now resides in docs/implplan/archived_sprints_tasks.md (updated 2025-11-08).
+Active items only. Completed/historic work now resides in docs/implplan/archived/tasks.md (updated 2025-11-08).
[Documentation & Process] 200.C) Docs Modules Attestor
Depends on: Sprint 100.A - Attestor, Sprint 110.A - AdvisoryAI, Sprint 120.A - AirGap, Sprint 130.A - Scanner, Sprint 140.A - Graph, Sprint 150.A - Orchestrator, Sprint 160.A - EvidenceLocker, Sprint 170.A - Notifier, Sprint 180.A - Cli, Sprint 190.A - Ops Deployment
diff --git a/docs/implplan/SPRINT_314_docs_modules_authority.md b/docs/implplan/SPRINT_314_docs_modules_authority.md
index ff6412d5c..556edc6c8 100644
--- a/docs/implplan/SPRINT_314_docs_modules_authority.md
+++ b/docs/implplan/SPRINT_314_docs_modules_authority.md
@@ -1,6 +1,6 @@
# Sprint 314 - Documentation & Process · 200.D) Docs Modules Authority
-Active items only. Completed/historic work now resides in docs/implplan/archived_sprints_tasks.md (updated 2025-11-08).
+Active items only. Completed/historic work now resides in docs/implplan/archived/tasks.md (updated 2025-11-08).
[Documentation & Process] 200.D) Docs Modules Authority
Depends on: Sprint 100.A - Attestor, Sprint 110.A - AdvisoryAI, Sprint 120.A - AirGap, Sprint 130.A - Scanner, Sprint 140.A - Graph, Sprint 150.A - Orchestrator, Sprint 160.A - EvidenceLocker, Sprint 170.A - Notifier, Sprint 180.A - Cli, Sprint 190.A - Ops Deployment
diff --git a/docs/implplan/SPRINT_315_docs_modules_ci.md b/docs/implplan/SPRINT_315_docs_modules_ci.md
index 5a80106f2..43ed9b415 100644
--- a/docs/implplan/SPRINT_315_docs_modules_ci.md
+++ b/docs/implplan/SPRINT_315_docs_modules_ci.md
@@ -1,6 +1,6 @@
# Sprint 315 - Documentation & Process · 200.E) Docs Modules Ci
-Active items only. Completed/historic work now resides in docs/implplan/archived_sprints_tasks.md (updated 2025-11-08).
+Active items only. Completed/historic work now resides in docs/implplan/archived/tasks.md (updated 2025-11-08).
[Documentation & Process] 200.E) Docs Modules Ci
Depends on: Sprint 100.A - Attestor, Sprint 110.A - AdvisoryAI, Sprint 120.A - AirGap, Sprint 130.A - Scanner, Sprint 140.A - Graph, Sprint 150.A - Orchestrator, Sprint 160.A - EvidenceLocker, Sprint 170.A - Notifier, Sprint 180.A - Cli, Sprint 190.A - Ops Deployment
diff --git a/docs/implplan/SPRINT_316_docs_modules_cli.md b/docs/implplan/SPRINT_316_docs_modules_cli.md
index b1ed11d02..e81300d35 100644
--- a/docs/implplan/SPRINT_316_docs_modules_cli.md
+++ b/docs/implplan/SPRINT_316_docs_modules_cli.md
@@ -1,6 +1,6 @@
# Sprint 316 - Documentation & Process · 200.F) Docs Modules Cli
-Active items only. Completed/historic work now resides in docs/implplan/archived_sprints_tasks.md (updated 2025-11-08).
+Active items only. Completed/historic work now resides in docs/implplan/archived/tasks.md (updated 2025-11-08).
[Documentation & Process] 200.F) Docs Modules Cli
Depends on: Sprint 100.A - Attestor, Sprint 110.A - AdvisoryAI, Sprint 120.A - AirGap, Sprint 130.A - Scanner, Sprint 140.A - Graph, Sprint 150.A - Orchestrator, Sprint 160.A - EvidenceLocker, Sprint 170.A - Notifier, Sprint 180.A - Cli, Sprint 190.A - Ops Deployment
diff --git a/docs/implplan/SPRINT_317_docs_modules_concelier.md b/docs/implplan/SPRINT_317_docs_modules_concelier.md
index dc27288e1..fb5f534e0 100644
--- a/docs/implplan/SPRINT_317_docs_modules_concelier.md
+++ b/docs/implplan/SPRINT_317_docs_modules_concelier.md
@@ -1,6 +1,6 @@
# Sprint 317 - Documentation & Process · 200.G) Docs Modules Concelier
-Active items only. Completed/historic work now resides in docs/implplan/archived_sprints_tasks.md (updated 2025-11-08).
+Active items only. Completed/historic work now resides in docs/implplan/archived/tasks.md (updated 2025-11-08).
[Documentation & Process] 200.G) Docs Modules Concelier
Depends on: Sprint 100.A - Attestor, Sprint 110.A - AdvisoryAI, Sprint 120.A - AirGap, Sprint 130.A - Scanner, Sprint 140.A - Graph, Sprint 150.A - Orchestrator, Sprint 160.A - EvidenceLocker, Sprint 170.A - Notifier, Sprint 180.A - Cli, Sprint 190.A - Ops Deployment
diff --git a/docs/implplan/SPRINT_318_docs_modules_devops.md b/docs/implplan/SPRINT_318_docs_modules_devops.md
index 9bae4460b..93caabe77 100644
--- a/docs/implplan/SPRINT_318_docs_modules_devops.md
+++ b/docs/implplan/SPRINT_318_docs_modules_devops.md
@@ -1,6 +1,6 @@
# Sprint 318 - Documentation & Process · 200.H) Docs Modules Devops
-Active items only. Completed/historic work now resides in docs/implplan/archived_sprints_tasks.md (updated 2025-11-08).
+Active items only. Completed/historic work now resides in docs/implplan/archived/tasks.md (updated 2025-11-08).
[Documentation & Process] 200.H) Docs Modules Devops
Depends on: Sprint 100.A - Attestor, Sprint 110.A - AdvisoryAI, Sprint 120.A - AirGap, Sprint 130.A - Scanner, Sprint 140.A - Graph, Sprint 150.A - Orchestrator, Sprint 160.A - EvidenceLocker, Sprint 170.A - Notifier, Sprint 180.A - Cli, Sprint 190.A - Ops Deployment
diff --git a/docs/implplan/SPRINT_319_docs_modules_excititor.md b/docs/implplan/SPRINT_319_docs_modules_excititor.md
index ae48ce019..3a2f9b4a3 100644
--- a/docs/implplan/SPRINT_319_docs_modules_excititor.md
+++ b/docs/implplan/SPRINT_319_docs_modules_excititor.md
@@ -1,6 +1,6 @@
# Sprint 319 - Documentation & Process · 200.I) Docs Modules Excititor
-Active items only. Completed/historic work now resides in docs/implplan/archived_sprints_tasks.md (updated 2025-11-08).
+Active items only. Completed/historic work now resides in docs/implplan/archived/tasks.md (updated 2025-11-08).
[Documentation & Process] 200.I) Docs Modules Excititor
Depends on: Sprint 100.A - Attestor, Sprint 110.A - AdvisoryAI, Sprint 120.A - AirGap, Sprint 130.A - Scanner, Sprint 140.A - Graph, Sprint 150.A - Orchestrator, Sprint 160.A - EvidenceLocker, Sprint 170.A - Notifier, Sprint 180.A - Cli, Sprint 190.A - Ops Deployment
diff --git a/docs/implplan/SPRINT_320_docs_modules_export_center.md b/docs/implplan/SPRINT_320_docs_modules_export_center.md
index 5cd53ba43..6a4181f8c 100644
--- a/docs/implplan/SPRINT_320_docs_modules_export_center.md
+++ b/docs/implplan/SPRINT_320_docs_modules_export_center.md
@@ -1,6 +1,6 @@
# Sprint 320 - Documentation & Process · 200.J) Docs Modules Export Center
-Active items only. Completed/historic work now resides in docs/implplan/archived_sprints_tasks.md (updated 2025-11-08).
+Active items only. Completed/historic work now resides in docs/implplan/archived/tasks.md (updated 2025-11-08).
[Documentation & Process] 200.J) Docs Modules Export Center
Depends on: Sprint 100.A - Attestor, Sprint 110.A - AdvisoryAI, Sprint 120.A - AirGap, Sprint 130.A - Scanner, Sprint 140.A - Graph, Sprint 150.A - Orchestrator, Sprint 160.A - EvidenceLocker, Sprint 170.A - Notifier, Sprint 180.A - Cli, Sprint 190.A - Ops Deployment
diff --git a/docs/implplan/SPRINT_321_docs_modules_graph.md b/docs/implplan/SPRINT_321_docs_modules_graph.md
index 9af652bfb..98f81fecf 100644
--- a/docs/implplan/SPRINT_321_docs_modules_graph.md
+++ b/docs/implplan/SPRINT_321_docs_modules_graph.md
@@ -1,6 +1,6 @@
# Sprint 321 - Documentation & Process · 200.K) Docs Modules Graph
-Active items only. Completed/historic work now resides in docs/implplan/archived_sprints_tasks.md (updated 2025-11-08).
+Active items only. Completed/historic work now resides in docs/implplan/archived/tasks.md (updated 2025-11-08).
[Documentation & Process] 200.K) Docs Modules Graph
Depends on: Sprint 100.A - Attestor, Sprint 110.A - AdvisoryAI, Sprint 120.A - AirGap, Sprint 130.A - Scanner, Sprint 140.A - Graph, Sprint 150.A - Orchestrator, Sprint 160.A - EvidenceLocker, Sprint 170.A - Notifier, Sprint 180.A - Cli, Sprint 190.A - Ops Deployment
diff --git a/docs/implplan/SPRINT_322_docs_modules_notify.md b/docs/implplan/SPRINT_322_docs_modules_notify.md
index e3638641e..35e6a7dca 100644
--- a/docs/implplan/SPRINT_322_docs_modules_notify.md
+++ b/docs/implplan/SPRINT_322_docs_modules_notify.md
@@ -1,6 +1,6 @@
# Sprint 322 - Documentation & Process · 200.L) Docs Modules Notify
-Active items only. Completed/historic work now resides in docs/implplan/archived_sprints_tasks.md (updated 2025-11-08).
+Active items only. Completed/historic work now resides in docs/implplan/archived/tasks.md (updated 2025-11-08).
[Documentation & Process] 200.L) Docs Modules Notify
Depends on: Sprint 100.A - Attestor, Sprint 110.A - AdvisoryAI, Sprint 120.A - AirGap, Sprint 130.A - Scanner, Sprint 140.A - Graph, Sprint 150.A - Orchestrator, Sprint 160.A - EvidenceLocker, Sprint 170.A - Notifier, Sprint 180.A - Cli, Sprint 190.A - Ops Deployment
diff --git a/docs/implplan/SPRINT_323_docs_modules_orchestrator.md b/docs/implplan/SPRINT_323_docs_modules_orchestrator.md
index 7fcb75cab..d4d0fabfe 100644
--- a/docs/implplan/SPRINT_323_docs_modules_orchestrator.md
+++ b/docs/implplan/SPRINT_323_docs_modules_orchestrator.md
@@ -1,6 +1,6 @@
# Sprint 323 - Documentation & Process · 200.M) Docs Modules Orchestrator
-Active items only. Completed/historic work now resides in docs/implplan/archived_sprints_tasks.md (updated 2025-11-08).
+Active items only. Completed/historic work now resides in docs/implplan/archived/tasks.md (updated 2025-11-08).
[Documentation & Process] 200.M) Docs Modules Orchestrator
Depends on: Sprint 100.A - Attestor, Sprint 110.A - AdvisoryAI, Sprint 120.A - AirGap, Sprint 130.A - Scanner, Sprint 140.A - Graph, Sprint 150.A - Orchestrator, Sprint 160.A - EvidenceLocker, Sprint 170.A - Notifier, Sprint 180.A - Cli, Sprint 190.A - Ops Deployment
diff --git a/docs/implplan/SPRINT_324_docs_modules_platform.md b/docs/implplan/SPRINT_324_docs_modules_platform.md
index db52b7b06..0b1d611b7 100644
--- a/docs/implplan/SPRINT_324_docs_modules_platform.md
+++ b/docs/implplan/SPRINT_324_docs_modules_platform.md
@@ -1,6 +1,6 @@
# Sprint 324 - Documentation & Process · 200.N) Docs Modules Platform
-Active items only. Completed/historic work now resides in docs/implplan/archived_sprints_tasks.md (updated 2025-11-08).
+Active items only. Completed/historic work now resides in docs/implplan/archived/tasks.md (updated 2025-11-08).
[Documentation & Process] 200.N) Docs Modules Platform
Depends on: Sprint 100.A - Attestor, Sprint 110.A - AdvisoryAI, Sprint 120.A - AirGap, Sprint 130.A - Scanner, Sprint 140.A - Graph, Sprint 150.A - Orchestrator, Sprint 160.A - EvidenceLocker, Sprint 170.A - Notifier, Sprint 180.A - Cli, Sprint 190.A - Ops Deployment
diff --git a/docs/implplan/SPRINT_325_docs_modules_policy.md b/docs/implplan/SPRINT_325_docs_modules_policy.md
index 3380af128..b5db96b9c 100644
--- a/docs/implplan/SPRINT_325_docs_modules_policy.md
+++ b/docs/implplan/SPRINT_325_docs_modules_policy.md
@@ -1,6 +1,6 @@
# Sprint 325 - Documentation & Process · 200.O) Docs Modules Policy
-Active items only. Completed/historic work now resides in docs/implplan/archived_sprints_tasks.md (updated 2025-11-08).
+Active items only. Completed/historic work now resides in docs/implplan/archived/tasks.md (updated 2025-11-08).
[Documentation & Process] 200.O) Docs Modules Policy
Depends on: Sprint 100.A - Attestor, Sprint 110.A - AdvisoryAI, Sprint 120.A - AirGap, Sprint 130.A - Scanner, Sprint 140.A - Graph, Sprint 150.A - Orchestrator, Sprint 160.A - EvidenceLocker, Sprint 170.A - Notifier, Sprint 180.A - Cli, Sprint 190.A - Ops Deployment
diff --git a/docs/implplan/SPRINT_326_docs_modules_registry.md b/docs/implplan/SPRINT_326_docs_modules_registry.md
index a2bc2379d..073da2e6e 100644
--- a/docs/implplan/SPRINT_326_docs_modules_registry.md
+++ b/docs/implplan/SPRINT_326_docs_modules_registry.md
@@ -1,6 +1,6 @@
# Sprint 326 - Documentation & Process · 200.P) Docs Modules Registry
-Active items only. Completed/historic work now resides in docs/implplan/archived_sprints_tasks.md (updated 2025-11-08).
+Active items only. Completed/historic work now resides in docs/implplan/archived/tasks.md (updated 2025-11-08).
[Documentation & Process] 200.P) Docs Modules Registry
Depends on: Sprint 100.A - Attestor, Sprint 110.A - AdvisoryAI, Sprint 120.A - AirGap, Sprint 130.A - Scanner, Sprint 140.A - Graph, Sprint 150.A - Orchestrator, Sprint 160.A - EvidenceLocker, Sprint 170.A - Notifier, Sprint 180.A - Cli, Sprint 190.A - Ops Deployment
diff --git a/docs/implplan/SPRINT_327_docs_modules_scanner.md b/docs/implplan/SPRINT_327_docs_modules_scanner.md
index 58dd52711..c51dd7c70 100644
--- a/docs/implplan/SPRINT_327_docs_modules_scanner.md
+++ b/docs/implplan/SPRINT_327_docs_modules_scanner.md
@@ -1,6 +1,6 @@
# Sprint 327 - Documentation & Process · 200.Q) Docs Modules Scanner
-Active items only. Completed/historic work now resides in docs/implplan/archived_sprints_tasks.md (updated 2025-11-08).
+Active items only. Completed/historic work now resides in docs/implplan/archived/tasks.md (updated 2025-11-08).
[Documentation & Process] 200.Q) Docs Modules Scanner
Depends on: Sprint 100.A - Attestor, Sprint 110.A - AdvisoryAI, Sprint 120.A - AirGap, Sprint 130.A - Scanner, Sprint 140.A - Graph, Sprint 150.A - Orchestrator, Sprint 160.A - EvidenceLocker, Sprint 170.A - Notifier, Sprint 180.A - Cli, Sprint 190.A - Ops Deployment
diff --git a/docs/implplan/SPRINT_328_docs_modules_scheduler.md b/docs/implplan/SPRINT_328_docs_modules_scheduler.md
index c59c8276e..b1c30d061 100644
--- a/docs/implplan/SPRINT_328_docs_modules_scheduler.md
+++ b/docs/implplan/SPRINT_328_docs_modules_scheduler.md
@@ -1,6 +1,6 @@
# Sprint 328 - Documentation & Process · 200.R) Docs Modules Scheduler
-Active items only. Completed/historic work now resides in docs/implplan/archived_sprints_tasks.md (updated 2025-11-08).
+Active items only. Completed/historic work now resides in docs/implplan/archived/tasks.md (updated 2025-11-08).
[Documentation & Process] 200.R) Docs Modules Scheduler
Depends on: Sprint 100.A - Attestor, Sprint 110.A - AdvisoryAI, Sprint 120.A - AirGap, Sprint 130.A - Scanner, Sprint 140.A - Graph, Sprint 150.A - Orchestrator, Sprint 160.A - EvidenceLocker, Sprint 170.A - Notifier, Sprint 180.A - Cli, Sprint 190.A - Ops Deployment
diff --git a/docs/implplan/SPRINT_329_docs_modules_signer.md b/docs/implplan/SPRINT_329_docs_modules_signer.md
index ad0850ac7..cffee64ec 100644
--- a/docs/implplan/SPRINT_329_docs_modules_signer.md
+++ b/docs/implplan/SPRINT_329_docs_modules_signer.md
@@ -1,6 +1,6 @@
# Sprint 329 - Documentation & Process · 200.S) Docs Modules Signer
-Active items only. Completed/historic work now resides in docs/implplan/archived_sprints_tasks.md (updated 2025-11-08).
+Active items only. Completed/historic work now resides in docs/implplan/archived/tasks.md (updated 2025-11-08).
[Documentation & Process] 200.S) Docs Modules Signer
Depends on: Sprint 100.A - Attestor, Sprint 110.A - AdvisoryAI, Sprint 120.A - AirGap, Sprint 130.A - Scanner, Sprint 140.A - Graph, Sprint 150.A - Orchestrator, Sprint 160.A - EvidenceLocker, Sprint 170.A - Notifier, Sprint 180.A - Cli, Sprint 190.A - Ops Deployment
diff --git a/docs/implplan/SPRINT_330_docs_modules_telemetry.md b/docs/implplan/SPRINT_330_docs_modules_telemetry.md
index f1f86a2dd..ddf8488e9 100644
--- a/docs/implplan/SPRINT_330_docs_modules_telemetry.md
+++ b/docs/implplan/SPRINT_330_docs_modules_telemetry.md
@@ -1,6 +1,6 @@
# Sprint 330 - Documentation & Process · 200.T) Docs Modules Telemetry
-Active items only. Completed/historic work now resides in docs/implplan/archived_sprints_tasks.md (updated 2025-11-08).
+Active items only. Completed/historic work now resides in docs/implplan/archived/tasks.md (updated 2025-11-08).
[Documentation & Process] 200.T) Docs Modules Telemetry
Depends on: Sprint 100.A - Attestor, Sprint 110.A - AdvisoryAI, Sprint 120.A - AirGap, Sprint 130.A - Scanner, Sprint 140.A - Graph, Sprint 150.A - Orchestrator, Sprint 160.A - EvidenceLocker, Sprint 170.A - Notifier, Sprint 180.A - Cli, Sprint 190.A - Ops Deployment
diff --git a/docs/implplan/SPRINT_331_docs_modules_ui.md b/docs/implplan/SPRINT_331_docs_modules_ui.md
index 76ea5f3b2..86049ff90 100644
--- a/docs/implplan/SPRINT_331_docs_modules_ui.md
+++ b/docs/implplan/SPRINT_331_docs_modules_ui.md
@@ -1,6 +1,6 @@
# Sprint 331 - Documentation & Process · 200.U) Docs Modules Ui
-Active items only. Completed/historic work now resides in docs/implplan/archived_sprints_tasks.md (updated 2025-11-08).
+Active items only. Completed/historic work now resides in docs/implplan/archived/tasks.md (updated 2025-11-08).
[Documentation & Process] 200.U) Docs Modules Ui
Depends on: Sprint 100.A - Attestor, Sprint 110.A - AdvisoryAI, Sprint 120.A - AirGap, Sprint 130.A - Scanner, Sprint 140.A - Graph, Sprint 150.A - Orchestrator, Sprint 160.A - EvidenceLocker, Sprint 170.A - Notifier, Sprint 180.A - Cli, Sprint 190.A - Ops Deployment
diff --git a/docs/implplan/SPRINT_332_docs_modules_vex_lens.md b/docs/implplan/SPRINT_332_docs_modules_vex_lens.md
index c7c806403..53de9c9b5 100644
--- a/docs/implplan/SPRINT_332_docs_modules_vex_lens.md
+++ b/docs/implplan/SPRINT_332_docs_modules_vex_lens.md
@@ -1,6 +1,6 @@
# Sprint 332 - Documentation & Process · 200.V) Docs Modules Vex Lens
-Active items only. Completed/historic work now resides in docs/implplan/archived_sprints_tasks.md (updated 2025-11-08).
+Active items only. Completed/historic work now resides in docs/implplan/archived/tasks.md (updated 2025-11-08).
[Documentation & Process] 200.V) Docs Modules Vex Lens
Depends on: Sprint 100.A - Attestor, Sprint 110.A - AdvisoryAI, Sprint 120.A - AirGap, Sprint 130.A - Scanner, Sprint 140.A - Graph, Sprint 150.A - Orchestrator, Sprint 160.A - EvidenceLocker, Sprint 170.A - Notifier, Sprint 180.A - Cli, Sprint 190.A - Ops Deployment
diff --git a/docs/implplan/SPRINT_333_docs_modules_excititor.md b/docs/implplan/SPRINT_333_docs_modules_excititor.md
index 496676760..167d1a228 100644
--- a/docs/implplan/SPRINT_333_docs_modules_excititor.md
+++ b/docs/implplan/SPRINT_333_docs_modules_excititor.md
@@ -1,6 +1,6 @@
# Sprint 333 - Documentation & Process · 200.W) Docs Modules Excititor
-Active items only. Completed/historic work now resides in docs/implplan/archived_sprints_tasks.md (updated 2025-11-08).
+Active items only. Completed/historic work now resides in docs/implplan/archived/tasks.md (updated 2025-11-08).
[Documentation & Process] 200.W) Docs Modules Excititor
Depends on: Sprint 100.A - Attestor, Sprint 110.A - AdvisoryAI, Sprint 120.A - AirGap, Sprint 130.A - Scanner, Sprint 140.A - Graph, Sprint 150.A - Orchestrator, Sprint 160.A - EvidenceLocker, Sprint 170.A - Notifier, Sprint 180.A - Cli, Sprint 190.A - Ops Deployment
diff --git a/docs/implplan/SPRINT_334_docs_modules_vuln_explorer.md b/docs/implplan/SPRINT_334_docs_modules_vuln_explorer.md
index 975dbbf22..1b654880f 100644
--- a/docs/implplan/SPRINT_334_docs_modules_vuln_explorer.md
+++ b/docs/implplan/SPRINT_334_docs_modules_vuln_explorer.md
@@ -1,6 +1,6 @@
# Sprint 334 - Documentation & Process · 200.X) Docs Modules Vuln Explorer
-Active items only. Completed/historic work now resides in docs/implplan/archived_sprints_tasks.md (updated 2025-11-08).
+Active items only. Completed/historic work now resides in docs/implplan/archived/tasks.md (updated 2025-11-08).
[Documentation & Process] 200.X) Docs Modules Vuln Explorer
Depends on: Sprint 100.A - Attestor, Sprint 110.A - AdvisoryAI, Sprint 120.A - AirGap, Sprint 130.A - Scanner, Sprint 140.A - Graph, Sprint 150.A - Orchestrator, Sprint 160.A - EvidenceLocker, Sprint 170.A - Notifier, Sprint 180.A - Cli, Sprint 190.A - Ops Deployment
diff --git a/docs/implplan/SPRINT_335_docs_modules_zastava.md b/docs/implplan/SPRINT_335_docs_modules_zastava.md
index de29337b4..fb19db37a 100644
--- a/docs/implplan/SPRINT_335_docs_modules_zastava.md
+++ b/docs/implplan/SPRINT_335_docs_modules_zastava.md
@@ -1,6 +1,6 @@
# Sprint 335 - Documentation & Process · 200.Y) Docs Modules Zastava
-Active items only. Completed/historic work now resides in docs/implplan/archived_sprints_tasks.md (updated 2025-11-08).
+Active items only. Completed/historic work now resides in docs/implplan/archived/tasks.md (updated 2025-11-08).
[Documentation & Process] 200.Y) Docs Modules Zastava
Depends on: Sprint 100.A - Attestor, Sprint 110.A - AdvisoryAI, Sprint 120.A - AirGap, Sprint 130.A - Scanner, Sprint 140.A - Graph, Sprint 150.A - Orchestrator, Sprint 160.A - EvidenceLocker, Sprint 170.A - Notifier, Sprint 180.A - Cli, Sprint 190.A - Ops Deployment
diff --git a/docs/implplan/SPRINT_400_runtime_facts_static_callgraph_union.md b/docs/implplan/SPRINT_400_runtime_facts_static_callgraph_union.md
index c8ea97ceb..e38f90b34 100644
--- a/docs/implplan/SPRINT_400_runtime_facts_static_callgraph_union.md
+++ b/docs/implplan/SPRINT_400_runtime_facts_static_callgraph_union.md
@@ -15,5 +15,7 @@ SIGNALS-REACH-201-004 | DOING (2025-11-08) | Build the reachability scoring engi
REPLAY-REACH-201-005 | DOING (2025-11-08) | Update `StellaOps.Replay.Core` manifest schema + bundle writer so replay packs capture reachability graphs, runtime traces, analyzer versions, and evidence hashes; document new CAS namespace. | BE-Base Platform Guild (`src/__Libraries/StellaOps.Replay.Core`)
DOCS-REACH-201-006 | TODO | Author the reachability doc set (`docs/signals/reachability.md`, `callgraph-formats.md`, `runtime-facts.md`, CLI/UI appendices) plus update Zastava + Replay guides with the new evidence and operators’ workflow. | Docs Guild (`docs`)
QA-REACH-201-007 | TODO | Integrate `reachbench-2025-expanded` fixture pack under `tests/reachability/`, add evaluator harness tests that validate reachable vs unreachable cases, and wire CI guidance for deterministic runs. | QA Guild (`tests/README.md`)
+SCAN-GAP-201-008 | TODO | Deliver binary/language Symbolizers that emit `richgraph-v1` payloads with canonical `SymbolID = {file:hash, section, addr, name, linkage}`, persist them to CAS via `StellaOps.Scanner.Reachability`, and document analyzer knobs. See `docs/reachability/REACHABILITY_GAP_TASKS.md#3`. | Scanner Worker Guild (`src/Scanner/StellaOps.Scanner.Worker`, `docs/modules/scanner/architecture.md`)
+ZASTAVA-GAP-201-009 | TODO | Implement runtime NDJSON emission (`SymbolID`, hit counts, CAS URIs, entrypoint context) and ship operator runbook `docs/runbooks/reachability-runtime.md`, wiring `/signals/runtime-facts` once Sprint 401 endpoint lands. See `docs/reachability/REACHABILITY_GAP_TASKS.md#3`. | Zastava Observer Guild (`src/Zastava/StellaOps.Zastava.Observer`, `docs/modules/zastava/architecture.md`)
-> 2025-11-07: reachbench starter + expanded packs staged under repo root; consuming guilds must relocate fixtures into `tests/reachability/fixtures/` as part of QA-REACH-201-007 before enabling CI.
\ No newline at end of file
+> 2025-11-07: reachbench starter + expanded packs staged under repo root; consuming guilds must relocate fixtures into `tests/reachability/fixtures/` as part of QA-REACH-201-007 before enabling CI.
diff --git a/docs/implplan/SPRINT_401_reachability_evidence_chain.md b/docs/implplan/SPRINT_401_reachability_evidence_chain.md
index afdd5d71b..d6b8e38a8 100644
--- a/docs/implplan/SPRINT_401_reachability_evidence_chain.md
+++ b/docs/implplan/SPRINT_401_reachability_evidence_chain.md
@@ -13,6 +13,9 @@ _Theme:_ Finish the provable reachability pipeline (graph CAS → replay → DSS
| POLICY-VEX-401-006 | TODO | Policy Engine consumes reachability facts, emits OpenVEX with evidence references, updates SPL schema with `reachability.state/confidence` predicates, and produces API metrics. | Policy Guild (`src/Policy/StellaOps.Policy.Engine`, `src/Policy/__Libraries/StellaOps.Policy`) |
| UI-CLI-401-007 | TODO | Implement CLI `stella graph explain` + UI explain drawer showing signed call-path, predicates, runtime hits, and DSSE pointers; include counterfactual controls. | UI & CLI Guilds (`src/Cli/StellaOps.Cli`, `src/UI/StellaOps.UI`) |
| QA-DOCS-401-008 | TODO | Wire `reachbench-2025-expanded` fixtures into CI, document CAS layouts + replay steps in `docs/reachability/DELIVERY_GUIDE.md`, and publish operator runbook for runtime ingestion. | QA & Docs Guilds (`docs`, `tests/README.md`) |
+| SIGNALS-GAP-401-009 | TODO | Track `/signals/runtime-facts` GA and lattice scoring thresholds (policy-driven `max_path_conf`) with CAS-backed runtime storage per `docs/reachability/REACHABILITY_GAP_TASKS.md#3`. Emit `signals.fact.updated` events + retention docs. | Signals Guild (`src/Signals/StellaOps.Signals`, `docs/reachability/REACHABILITY_GAP_TASKS.md`) |
+| REPLAY-GAP-401-010 | TODO | Enforce BLAKE3 hashing + CAS registration for graphs/traces before manifest writes and document schema v2 impacts. | BE-Base Platform Guild (`src/__Libraries/StellaOps.Replay.Core`, `docs/replay/DETERMINISTIC_REPLAY.md`) |
+| POLICY-GAP-401-011 | TODO | Implement policy thresholds + OpenVEX evidence references (graph hash, runtime facts) so `status=affected` only when confidence ≥ configured value. Update SPL + API docs. | Policy Guild (`src/Policy/StellaOps.Policy.Engine`, `docs/modules/policy/architecture.md`) |
+| EXPERIENCE-GAP-401-012 | TODO | Expose reachability evidence to CLI/UI (explain drawer, `--evidence=graph`, `--threshold`) and update Notify templates + API reference accordingly. | UI & CLI Guilds, Notify Guild (`src/Cli/StellaOps.Cli`, `src/UI/StellaOps.UI`, `docs/09_API_CLI_REFERENCE.md`) |
> Use `docs/reachability/DELIVERY_GUIDE.md` for architecture context, dependencies, and acceptance tests.
-
diff --git a/docs/implplan/SPRINT_500_ops_offline.md b/docs/implplan/SPRINT_500_ops_offline.md
index e890f8969..9ec929bd8 100644
--- a/docs/implplan/SPRINT_500_ops_offline.md
+++ b/docs/implplan/SPRINT_500_ops_offline.md
@@ -1,5 +1,5 @@
# Sprint 500 - Ops & Offline
-Active items only. Completed/historic work now resides in docs/implplan/archived_sprints_tasks.md (updated 2025-11-08).
+Active items only. Completed/historic work now resides in docs/implplan/archived/tasks.md (updated 2025-11-08).
This file now only tracks the Ops & Offline status snapshot. Active backlog lives in Sprint 501 and later files.
diff --git a/docs/implplan/SPRINT_501_ops_deployment_i.md b/docs/implplan/SPRINT_501_ops_deployment_i.md
index bc86831d3..50ad766da 100644
--- a/docs/implplan/SPRINT_501_ops_deployment_i.md
+++ b/docs/implplan/SPRINT_501_ops_deployment_i.md
@@ -1,6 +1,6 @@
# Sprint 501 - Ops & Offline · 190.A) Ops Deployment.I
-Active items only. Completed/historic work now resides in docs/implplan/archived_sprints_tasks.md (updated 2025-11-08).
+Active items only. Completed/historic work now resides in docs/implplan/archived/tasks.md (updated 2025-11-08).
[Ops & Offline] 190.A) Ops Deployment.I
Depends on: Sprint 100.A - Attestor, Sprint 110.A - AdvisoryAI, Sprint 120.A - AirGap, Sprint 130.A - Scanner, Sprint 140.A - Graph, Sprint 150.A - Orchestrator, Sprint 160.A - EvidenceLocker, Sprint 170.A - Notifier, Sprint 180.A - Cli
diff --git a/docs/implplan/SPRINT_502_ops_deployment_ii.md b/docs/implplan/SPRINT_502_ops_deployment_ii.md
index 6aa1f9a68..b698853c7 100644
--- a/docs/implplan/SPRINT_502_ops_deployment_ii.md
+++ b/docs/implplan/SPRINT_502_ops_deployment_ii.md
@@ -1,6 +1,6 @@
# Sprint 502 - Ops & Offline · 190.A) Ops Deployment.II
-Active items only. Completed/historic work now resides in docs/implplan/archived_sprints_tasks.md (updated 2025-11-08).
+Active items only. Completed/historic work now resides in docs/implplan/archived/tasks.md (updated 2025-11-08).
[Ops & Offline] 190.A) Ops Deployment.II
Depends on: Sprint 190.A - Ops Deployment.I
diff --git a/docs/implplan/SPRINT_503_ops_devops_i.md b/docs/implplan/SPRINT_503_ops_devops_i.md
index cccae839d..ed1c33fb2 100644
--- a/docs/implplan/SPRINT_503_ops_devops_i.md
+++ b/docs/implplan/SPRINT_503_ops_devops_i.md
@@ -1,6 +1,6 @@
# Sprint 503 - Ops & Offline · 190.B) Ops Devops.I
-Active items only. Completed/historic work now resides in docs/implplan/archived_sprints_tasks.md (updated 2025-11-08).
+Active items only. Completed/historic work now resides in docs/implplan/archived/tasks.md (updated 2025-11-08).
[Ops & Offline] 190.B) Ops Devops.I
Depends on: Sprint 100.A - Attestor, Sprint 110.A - AdvisoryAI, Sprint 120.A - AirGap, Sprint 130.A - Scanner, Sprint 140.A - Graph, Sprint 150.A - Orchestrator, Sprint 160.A - EvidenceLocker, Sprint 170.A - Notifier, Sprint 180.A - Cli
diff --git a/docs/implplan/SPRINT_504_ops_devops_ii.md b/docs/implplan/SPRINT_504_ops_devops_ii.md
index 116ed9086..51cde9039 100644
--- a/docs/implplan/SPRINT_504_ops_devops_ii.md
+++ b/docs/implplan/SPRINT_504_ops_devops_ii.md
@@ -1,6 +1,6 @@
# Sprint 504 - Ops & Offline · 190.B) Ops Devops.II
-Active items only. Completed/historic work now resides in docs/implplan/archived_sprints_tasks.md (updated 2025-11-08).
+Active items only. Completed/historic work now resides in docs/implplan/archived/tasks.md (updated 2025-11-08).
[Ops & Offline] 190.B) Ops Devops.II
Depends on: Sprint 190.B - Ops Devops.I
diff --git a/docs/implplan/SPRINT_505_ops_devops_iii.md b/docs/implplan/SPRINT_505_ops_devops_iii.md
index d3a795087..a87951b29 100644
--- a/docs/implplan/SPRINT_505_ops_devops_iii.md
+++ b/docs/implplan/SPRINT_505_ops_devops_iii.md
@@ -1,6 +1,6 @@
# Sprint 505 - Ops & Offline · 190.B) Ops Devops.III
-Active items only. Completed/historic work now resides in docs/implplan/archived_sprints_tasks.md (updated 2025-11-08).
+Active items only. Completed/historic work now resides in docs/implplan/archived/tasks.md (updated 2025-11-08).
[Ops & Offline] 190.B) Ops Devops.III
Depends on: Sprint 190.B - Ops Devops.II
diff --git a/docs/implplan/SPRINT_506_ops_devops_iv.md b/docs/implplan/SPRINT_506_ops_devops_iv.md
index 7b5dd20a2..9a1c8cc15 100644
--- a/docs/implplan/SPRINT_506_ops_devops_iv.md
+++ b/docs/implplan/SPRINT_506_ops_devops_iv.md
@@ -1,6 +1,6 @@
# Sprint 506 - Ops & Offline · 190.B) Ops Devops.IV
-Active items only. Completed/historic work now resides in docs/implplan/archived_sprints_tasks.md (updated 2025-11-08).
+Active items only. Completed/historic work now resides in docs/implplan/archived/tasks.md (updated 2025-11-08).
[Ops & Offline] 190.B) Ops Devops.IV
Depends on: Sprint 190.B - Ops Devops.III
diff --git a/docs/implplan/SPRINT_507_ops_devops_v.md b/docs/implplan/SPRINT_507_ops_devops_v.md
index 128b82794..84c41b79a 100644
--- a/docs/implplan/SPRINT_507_ops_devops_v.md
+++ b/docs/implplan/SPRINT_507_ops_devops_v.md
@@ -1,6 +1,6 @@
# Sprint 507 - Ops & Offline · 190.B) Ops Devops.V
-Active items only. Completed/historic work now resides in docs/implplan/archived_sprints_tasks.md (updated 2025-11-08).
+Active items only. Completed/historic work now resides in docs/implplan/archived/tasks.md (updated 2025-11-08).
[Ops & Offline] 190.B) Ops Devops.V
Depends on: Sprint 190.B - Ops Devops.IV
diff --git a/docs/implplan/SPRINT_508_ops_offline_kit.md b/docs/implplan/SPRINT_508_ops_offline_kit.md
index 8941c1a03..ae445b9e9 100644
--- a/docs/implplan/SPRINT_508_ops_offline_kit.md
+++ b/docs/implplan/SPRINT_508_ops_offline_kit.md
@@ -1,6 +1,6 @@
# Sprint 508 - Ops & Offline · 190.C) Ops Offline Kit
-Active items only. Completed/historic work now resides in docs/implplan/archived_sprints_tasks.md (updated 2025-11-08).
+Active items only. Completed/historic work now resides in docs/implplan/archived/tasks.md (updated 2025-11-08).
[Ops & Offline] 190.C) Ops Offline Kit
Depends on: Sprint 100.A - Attestor, Sprint 110.A - AdvisoryAI, Sprint 120.A - AirGap, Sprint 130.A - Scanner, Sprint 140.A - Graph, Sprint 150.A - Orchestrator, Sprint 160.A - EvidenceLocker, Sprint 170.A - Notifier, Sprint 180.A - Cli
diff --git a/docs/implplan/SPRINT_509_samples.md b/docs/implplan/SPRINT_509_samples.md
index 6324f72e1..9eced3067 100644
--- a/docs/implplan/SPRINT_509_samples.md
+++ b/docs/implplan/SPRINT_509_samples.md
@@ -1,6 +1,6 @@
# Sprint 509 - Ops & Offline · 190.D) Samples
-Active items only. Completed/historic work now resides in docs/implplan/archived_sprints_tasks.md (updated 2025-11-08).
+Active items only. Completed/historic work now resides in docs/implplan/archived/tasks.md (updated 2025-11-08).
[Ops & Offline] 190.D) Samples
Depends on: Sprint 100.A - Attestor, Sprint 110.A - AdvisoryAI, Sprint 120.A - AirGap, Sprint 130.A - Scanner, Sprint 140.A - Graph, Sprint 150.A - Orchestrator, Sprint 160.A - EvidenceLocker, Sprint 170.A - Notifier, Sprint 180.A - Cli
diff --git a/docs/implplan/SPRINT_510_airgap.md b/docs/implplan/SPRINT_510_airgap.md
index ef8b4c74e..a86fd5886 100644
--- a/docs/implplan/SPRINT_510_airgap.md
+++ b/docs/implplan/SPRINT_510_airgap.md
@@ -1,6 +1,6 @@
# Sprint 510 - Ops & Offline · 190.E) AirGap
-Active items only. Completed/historic work now resides in docs/implplan/archived_sprints_tasks.md (updated 2025-11-08).
+Active items only. Completed/historic work now resides in docs/implplan/archived/tasks.md (updated 2025-11-08).
[Ops & Offline] 190.E) AirGap
Depends on: Sprint 100.A - Attestor, Sprint 110.A - AdvisoryAI, Sprint 120.A - AirGap, Sprint 130.A - Scanner, Sprint 140.A - Graph, Sprint 150.A - Orchestrator, Sprint 160.A - EvidenceLocker, Sprint 170.A - Notifier, Sprint 180.A - Cli
diff --git a/docs/implplan/SPRINT_511_api.md b/docs/implplan/SPRINT_511_api.md
index f79c1c851..678f9a386 100644
--- a/docs/implplan/SPRINT_511_api.md
+++ b/docs/implplan/SPRINT_511_api.md
@@ -1,6 +1,6 @@
# Sprint 511 - Ops & Offline · 190.F) Api
-Active items only. Completed/historic work now resides in docs/implplan/archived_sprints_tasks.md (updated 2025-11-08).
+Active items only. Completed/historic work now resides in docs/implplan/archived/tasks.md (updated 2025-11-08).
[Ops & Offline] 190.F) Api
Depends on: Sprint 100.A - Attestor, Sprint 110.A - AdvisoryAI, Sprint 120.A - AirGap, Sprint 130.A - Scanner, Sprint 140.A - Graph, Sprint 150.A - Orchestrator, Sprint 160.A - EvidenceLocker, Sprint 170.A - Notifier, Sprint 180.A - Cli
diff --git a/docs/implplan/SPRINT_512_bench.md b/docs/implplan/SPRINT_512_bench.md
index 4dfdb988f..8cde26271 100644
--- a/docs/implplan/SPRINT_512_bench.md
+++ b/docs/implplan/SPRINT_512_bench.md
@@ -1,6 +1,6 @@
# Sprint 512 - Ops & Offline · 190.G) Bench
-Active items only. Completed/historic work now resides in docs/implplan/archived_sprints_tasks.md (updated 2025-11-08).
+Active items only. Completed/historic work now resides in docs/implplan/archived/tasks.md (updated 2025-11-08).
[Ops & Offline] 190.G) Bench
Depends on: Sprint 100.A - Attestor, Sprint 110.A - AdvisoryAI, Sprint 120.A - AirGap, Sprint 130.A - Scanner, Sprint 140.A - Graph, Sprint 150.A - Orchestrator, Sprint 160.A - EvidenceLocker, Sprint 170.A - Notifier, Sprint 180.A - Cli
diff --git a/docs/implplan/SPRINT_513_provenance.md b/docs/implplan/SPRINT_513_provenance.md
index c018790f4..52ffee5d9 100644
--- a/docs/implplan/SPRINT_513_provenance.md
+++ b/docs/implplan/SPRINT_513_provenance.md
@@ -1,6 +1,6 @@
# Sprint 513 - Ops & Offline · 190.H) Provenance
-Active items only. Completed/historic work now resides in docs/implplan/archived_sprints_tasks.md (updated 2025-11-08).
+Active items only. Completed/historic work now resides in docs/implplan/archived/tasks.md (updated 2025-11-08).
[Ops & Offline] 190.H) Provenance
Depends on: Sprint 100.A - Attestor, Sprint 110.A - AdvisoryAI, Sprint 120.A - AirGap, Sprint 130.A - Scanner, Sprint 140.A - Graph, Sprint 150.A - Orchestrator, Sprint 160.A - EvidenceLocker, Sprint 170.A - Notifier, Sprint 180.A - Cli
diff --git a/docs/implplan/SPRINT_514_sovereign_crypto_enablement.md b/docs/implplan/SPRINT_514_sovereign_crypto_enablement.md
index ca3141d3c..fb3fa279e 100644
--- a/docs/implplan/SPRINT_514_sovereign_crypto_enablement.md
+++ b/docs/implplan/SPRINT_514_sovereign_crypto_enablement.md
@@ -1,6 +1,6 @@
# Sprint 514 - Ops & Offline · 190.K) Sovereign Crypto Enablement
-Active items only. Completed/historic work now resides in docs/implplan/archived_sprints_tasks.md (updated 2025-11-08).
+Active items only. Completed/historic work now resides in docs/implplan/archived/tasks.md (updated 2025-11-08).
[Ops & Offline] 190.K) Sovereign Crypto Enablement
@@ -8,8 +8,15 @@ Depends on: Sprint 100.A - Attestor, Sprint 110.A - AdvisoryAI, Sprint 120.A - A
Summary: Deliver RootPack_RU-ready sovereign crypto providers (CryptoPro + PKCS#11), configuration knobs, deterministic tests, and repo-wide crypto routing audit.
+Fork status: `third_party/forks/AlexMAS.GostCryptography` tracks upstream commit `31413f6` (2024-07-01) so we can patch/build the CryptoPro plug-in without pulling the vulnerable `IT.GostCryptography` binary.
+
Task ID | State | Task description | Owners (Source)
--- | --- | --- | ---
+SEC-CRYPTO-90-017 | TODO | Vendor `third_party/forks/AlexMAS.GostCryptography` into the solution build (solution filters, Directory.Build props, CI) so the library compiles with the rest of the repo and publishes artifacts for downstream consumers. | Security Guild (third_party/forks + src/__Libraries/StellaOps.Cryptography.Plugin.CryptoPro)
+SEC-CRYPTO-90-018 | TODO | Update developer/RootPack documentation to describe the new fork, sync steps, and licensing so operators know where the CryptoPro sources live and how to refresh them. | Security & Docs Guilds (docs/security/rootpack_ru_*.md, docs/dev/crypto.md)
+SEC-CRYPTO-90-019 | TODO | Patch the fork to drop vulnerable `System.Security.Cryptography.{Pkcs,Xml}` 6.0.0 dependencies (target .NET 8+, adopt fixed BCL packages, re-run tests). | Security Guild (third_party/forks/AlexMAS.GostCryptography)
+SEC-CRYPTO-90-020 | TODO | Re-point `StellaOps.Cryptography.Plugin.CryptoPro` to the forked sources (replace NuGet package references, adjust DI wiring) and prove the plugin works end-to-end. | Security Guild (src/__Libraries/StellaOps.Cryptography.Plugin.CryptoPro)
+SEC-CRYPTO-90-021 | TODO | Validate the forked library + plugin on both Windows (CryptoPro CSP) and Linux (OpenSSL GOST fallback) builds/tests; document any platform-specific prerequisites. | Security & QA Guilds (scripts/crypto/**, docs/security/rootpack_ru_validation.md)
SEC-CRYPTO-90-001 | DONE (2025-11-07) | Produce the RootPack_RU implementation plan, provider strategy (CryptoPro + PKCS#11), and backlog split for sovereign crypto work. | Security Guild (src/__Libraries/StellaOps.Cryptography)
SEC-CRYPTO-90-002 | DONE (2025-11-07) | Extend signature/catalog constants and configuration schema to recognize `GOST12-256/512`, regional crypto profiles, and provider preference ordering. | Security Guild (src/__Libraries/StellaOps.Cryptography)
SEC-CRYPTO-90-003 | DONE (2025-11-07) | Implement `StellaOps.Cryptography.Plugin.CryptoPro` provider (sign/verify/JWK export) using CryptoPro CSP with deterministic logging/tests. | Security Guild (src/__Libraries/StellaOps.Cryptography)
@@ -18,13 +25,14 @@ SEC-CRYPTO-90-005 | DONE (2025-11-08) | Add configuration-driven provider select
SEC-CRYPTO-90-006 | DONE (2025-11-08) | Build deterministic Streebog/signature harnesses and RootPack audit metadata/runbooks. | Security Guild (src/__Libraries/StellaOps.Cryptography)
SEC-CRYPTO-90-007 | DONE (2025-11-08) | Package RootPack_RU artifacts (plugins, trust anchors, configs) with deployment documentation. | Security Guild (src/__Libraries/StellaOps.Cryptography)
SEC-CRYPTO-90-008 | DONE (2025-11-08) | Audit repository for direct crypto usage bypassing the new abstractions and file remediation tasks. | Security Guild (src/__Libraries/StellaOps.Cryptography)
-SEC-CRYPTO-90-009 | TODO | Replace the placeholder CryptoPro plug-in with a true CryptoPro CSP implementation (GostCryptography, certificate-store lookup, DER/raw normalization) so RootPack_RU exposes a qualified-signature path. | Security Guild (src/__Libraries/StellaOps.Cryptography.Plugin.CryptoPro)
-SEC-CRYPTO-90-010 | TODO | Introduce `StellaOpsCryptoOptions` / configuration binding for registry profiles/keys and ship an `AddStellaOpsCryptoRu(IConfiguration, …)` helper so hosts can enable `ru-offline` via YAML without custom code. | Security Guild (src/__Libraries/StellaOps.Cryptography + .DependencyInjection)
-SEC-CRYPTO-90-011 | TODO | Build the sovereign crypto CLI (`StellaOps.CryptoRu.Cli`) to list keys, perform test-sign operations, and emit determinism/audit snapshots referenced in the RootPack docs. | Security & Ops Guilds (src/Tools/StellaOps.CryptoRu.Cli)
+SEC-CRYPTO-90-009 | DONE (2025-11-09) | Replace the placeholder CryptoPro plug-in with a true CryptoPro CSP implementation (GostCryptography, certificate-store lookup, DER/raw normalization) so RootPack_RU exposes a qualified-signature path. | Security Guild (src/__Libraries/StellaOps.Cryptography.Plugin.CryptoPro)
+SEC-CRYPTO-90-010 | DONE (2025-11-09) | Introduce `StellaOpsCryptoOptions` / configuration binding for registry profiles/keys and ship an `AddStellaOpsCryptoRu(IConfiguration, …)` helper so hosts can enable `ru-offline` via YAML without custom code. | Security Guild (src/__Libraries/StellaOps.Cryptography + .DependencyInjection)
+SEC-CRYPTO-90-011 | DONE (2025-11-09) | Build the sovereign crypto CLI (`StellaOps.CryptoRu.Cli`) to list keys, perform test-sign operations, and emit determinism/audit snapshots referenced in the RootPack docs. | Security & Ops Guilds (src/Tools/StellaOps.CryptoRu.Cli)
SEC-CRYPTO-90-012 | TODO | Add CryptoPro + PKCS#11 integration tests (env/pin gated) and wire them into `scripts/crypto/run-rootpack-ru-tests.sh`, covering Streebog vectors and DER/raw signatures. | Security Guild (src/__Libraries/__Tests/StellaOps.Cryptography.Tests)
SEC-CRYPTO-90-013 | TODO | Extend the shared crypto stack with sovereign symmetric algorithms (Magma/Kuznyechik) so exports/data-at-rest can request Russian ciphers via the provider registry. | Security Guild (src/__Libraries/StellaOps.Cryptography)
SEC-CRYPTO-90-014 | TODO | Update runtime hosts (Authority, Scanner WebService/Worker, Concelier, etc.) to register the RU providers, bind `StellaOps:Crypto` profiles, and expose configuration toggles per the new options model. | Security Guild + Service Guilds (multi-module)
SEC-CRYPTO-90-015 | TODO | Refresh RootPack/validation documentation once the CLI/config/tests exist (remove TODO callouts, document final workflows). | Security Guild & Docs Guild (docs/security/rootpack_ru_*.md)
+SEC-CRYPTO-90-016 | DONE (2025-11-09) | Quarantine CryptoPro dependencies by default until IT.GostCryptography is patched; add MSBuild flag `StellaOpsEnableCryptoPro` and follow-up plan to re-enable the plug-in once a safe package exists. | Security Guild (src/__Libraries/StellaOps.Cryptography.DependencyInjection + .Plugin.CryptoPro)
AUTH-CRYPTO-90-001 | DOING (2025-11-08) | Migrate Authority signing/key-loading paths (provider registry + crypto hash) so regional bundles can select sovereign providers per docs/security/crypto-routing-audit-2025-11-07.md. | Authority Core & Security Guild (src/Authority/StellaOps.Authority)
CONCELIER-WEB-AOC-19-005 | DOING (2025-11-08) | Fix `/advisories/{key}/chunks` seeded fixtures so AdvisoryChunksEndpoint tests stop returning 404/not-found when raw documents are pre-populated; ensure Mongo migrations no longer emit “Unable to locate advisory_raw documents” during test boot. | Concelier WebService Guild, QA Guild (src/Concelier/StellaOps.Concelier.WebService)
@@ -32,4 +40,6 @@ CONCELIER-WEB-AOC-19-006 | DOING (2025-11-08) | Align WebService auth defaults w
CONCELIER-WEB-AOC-19-007 | DOING (2025-11-08) | Update AOC verify logic/fixtures so guard failures produce the expected `ERR_AOC_001` payload while keeping mapper/guard parity covered by tests. | Concelier WebService Guild, QA Guild (src/Concelier/StellaOps.Concelier.WebService)
SCANNER-CRYPTO-90-001 | TODO | Route hashing/signing flows (`ScanIdGenerator`, `ReportSigner`, Sbomer BuildX plugin) through `ICryptoProviderRegistry` so sovereign deployments can select RU providers per the crypto routing audit. | Scanner WebService Guild, Security Guild (src/Scanner/StellaOps.Scanner.WebService)
SCANNER-WORKER-CRYPTO-90-001 | TODO | Wire Scanner Worker and BuildX analyzers to the crypto provider registry/hash abstractions, ensuring replay/report parity for sovereign bundles. | Scanner Worker Guild, Security Guild (src/Scanner/StellaOps.Scanner.Worker)
+SCANNER-CRYPTO-90-002 | TODO | Enable PQ-friendly DSSE (Dilithium/Falcon) for fragment signing + `_composition.json` attestations via crypto provider options; ship configuration docs and fixture coverage. | Scanner WebService Guild, Security Guild (src/Scanner/StellaOps.Scanner.WebService) |
+SCANNER-CRYPTO-90-003 | TODO | Add regression tests that rerun deterministic composition with RU/PQ profiles and validate Merkle roots + DSSE chains (hooked into `docs/replay/DETERMINISTIC_REPLAY.md`). Dependencies: SCANNER-CRYPTO-90-002. | Scanner Worker Guild, QA Guild (src/Scanner/__Tests) |
ATTESTOR-CRYPTO-90-001 | TODO | Migrate attestation bundle hashing/witness flows to the registry + hash abstractions, enabling CryptoPro/PKCS#11 deployments. | Attestor Service Guild, Security Guild (src/Attestor/StellaOps.Attestor)
diff --git a/docs/implplan/SPRINT_100_identity_signing.md b/docs/implplan/archived/SPRINT_100_identity_signing.md
similarity index 81%
rename from docs/implplan/SPRINT_100_identity_signing.md
rename to docs/implplan/archived/SPRINT_100_identity_signing.md
index 74416e2b6..4cd9b7545 100644
--- a/docs/implplan/SPRINT_100_identity_signing.md
+++ b/docs/implplan/archived/SPRINT_100_identity_signing.md
@@ -1,6 +1,8 @@
# Sprint 100 - Identity & Signing
-_Last updated: November 8, 2025. Implementation order is DOING → TODO → BLOCKED._
+_Last updated: November 9, 2025. Implementation order is DOING → TODO → BLOCKED._
+
+Active items are mirrored to `docs/implplan/archived/tasks.md` (refreshed 2025-11-09) now that Sprint 100 is closed.
Sprint 100 tracks Identity & Signing readiness; sections below list only in-flight tasks.
@@ -11,7 +13,7 @@ Focus: Identity & Signing focus on Authority (phase I).
| # | Task ID & handle | State | Key dependency / next step | Owners |
| --- | --- | --- | --- | --- |
| 1 | AUTH-AIRGAP-57-001 | DONE (2025-11-08) | Enforce sealed-mode CI gating by refusing token issuance when declared sealed install lacks sealing confirmation. (Deps: AUTH-AIRGAP-56-001, DEVOPS-AIRGAP-57-002.) | Authority Core & Security Guild, DevOps Guild (src/Authority/StellaOps.Authority) |
-| 2 | AUTH-PACKS-43-001 | BLOCKED (2025-10-27) | Enforce pack signing policies, approval RBAC checks, CLI CI token scopes, and audit logging for approvals. (Deps: AUTH-PACKS-41-001, TASKRUN-42-001, ORCH-SVC-42-101.) | Authority Core & Security Guild (src/Authority/StellaOps.Authority) |
+| 2 | AUTH-PACKS-43-001 | DONE (2025-11-09) | Enforce pack signing policies, approval RBAC checks, CLI CI token scopes, and audit logging for approvals. (Deps: AUTH-PACKS-41-001, TASKRUN-42-001, ORCH-SVC-42-101.) | Authority Core & Security Guild (src/Authority/StellaOps.Authority) |
## 100.B) Authority.II
Dependency: None specified; follow module prerequisites.
@@ -30,12 +32,15 @@ Focus: Identity & Signing focus on Authority (phase II).
| 9 | PLG7.IMPL-003 | DONE (2025-11-09) | Claims enricher ships with DN map + regex substitutions, Mongo claims cache (TTL + capacity enforcement) wired through DI, plus unit tests covering enrichment + cache eviction. | BE-Auth Plugin (src/Authority/StellaOps.Authority/StellaOps.Authority.Plugin.Standard) |
| 10 | PLG7.IMPL-004 | DONE (2025-11-09) | LDAP plug-in now ships `clientProvisioning.*` options, a Mongo-audited `LdapClientProvisioningStore`, capability gating, and docs/tests covering LDAP writes + cache shims. | BE-Auth Plugin, DevOps Guild (src/Authority/StellaOps.Authority/StellaOps.Authority.Plugin.Ldap) |
| 11 | PLG7.IMPL-005 | DONE (2025-11-09) | LDAP plug-in docs refreshed (mutual TLS, regex mappings, cache/audit mirror guidance), sample manifest updated, Offline Kit + release notes now reference the bundled plug-in assets. | BE-Auth Plugin, Docs Guild (src/Authority/StellaOps.Authority/StellaOps.Authority.Plugin.Standard) |
+| 12 | PLG7.IMPL-006 | DONE (2025-11-09) | LDAP bootstrap provisioning added (write probe, Mongo audit mirror, capability downgrade + health status) with docs/tests + sample manifest updates. | BE-Auth Plugin (src/Authority/StellaOps.Authority/StellaOps.Authority.Plugin.Ldap) |
- 2025-11-08: PLG4-6.CAPABILITIES marked DONE – bootstrap capability surfaced in code/docs, registry logs updated, and bootstrap APIs now gate on providers that advertise it (`dotnet test` across plugins + Authority core).
- 2025-11-08: AUTH-AIRGAP-57-001 landed — new `airGap.sealedMode` options, file-backed evidence ingestion, client metadata gating, docs/tests, and audit telemetry ensure sealed tenants cannot mint tokens until `authority-sealed-ci.json` passes.
- 2025-11-09: PLG7.IMPL-003 + PLG7.IMPL-004 complete — LDAP claims enricher/cache + client provisioning store with audit mirror, LDAP DN escapes, DI wiring, and plugin docs/tests refreshed.
- 2025-11-09: PLG7.IMPL-003 complete — LDAP claims enricher + Mongo cache wired (DI + tests), regex placeholder compatibility finalised, sample config/docs updated, and plugin tests green (`StellaOps.Authority.Plugin.Ldap.Tests`).
- 2025-11-09: PLG7.IMPL-005 complete — Developer guide, sample manifest, Offline Kit notes, and release updates now cover LDAP mutual TLS, regex mappings, caching, and the audit mirror workflow.
+- 2025-11-09: PLG7.IMPL-006 complete — LDAP plug-in now provisions bootstrap users with hashed audit mirrors, capability probes that prove write access before advertising `clientProvisioning`/`bootstrap`, degraded health signalling when directories are read-only, updated docs, and passing targeted tests.
+- 2025-11-09: AUTH-PACKS-43-001 complete — Authority `/token` now requires `pack_run_id`/`pack_gate_id`/`pack_plan_hash` for `packs.approve`, scope handler enforces a 5‑minute fresh-auth window, docs (`docs/security/pack-signing-and-rbac.md`, `docs/task-packs/runbook.md`) describe the procedure, and CLI/tests cover the new claims.
## 100.D) __Libraries
Dependency: None specified; follow module prerequisites.
diff --git a/docs/implplan/archived_sprints_tasks.md b/docs/implplan/archived/tasks.md
similarity index 99%
rename from docs/implplan/archived_sprints_tasks.md
rename to docs/implplan/archived/tasks.md
index 52559ca38..db5ab640d 100644
--- a/docs/implplan/archived_sprints_tasks.md
+++ b/docs/implplan/archived/tasks.md
@@ -1683,6 +1683,7 @@ This file describe implementation of Stella Ops (docs/README.md). Implementation
| 100.B) Authority.I | AUTH-AIAI-31-002 | DONE (2025-11-01) | Authority Core & Security Guild (src/Authority/StellaOps.Authority) | Enforce anonymized prompt logging, tenant consent for remote inference, and audit logging of assistant tasks. (Deps: AUTH-AIAI-31-001, AIAI-31-006.) |
| 100.B) Authority.I | AUTH-AIRGAP-56-001 | DONE (2025-11-04) | Authority Core & Security Guild (src/Authority/StellaOps.Authority) | Provision new scopes (`airgap:seal`, `airgap:import`, `airgap:status:read`) in configuration metadata, offline kit defaults, and issuer templates. (Deps: AIRGAP-CTL-56-001.) |
| 100.B) Authority.I | AUTH-AIRGAP-56-002 | DONE (2025-11-04) | Authority Core & Security Guild (src/Authority/StellaOps.Authority) | Audit import actions with actor, tenant, bundle ID, and trace ID; expose `/authority/audit/airgap` endpoint. (Deps: AUTH-AIRGAP-56-001, AIRGAP-IMP-58-001.) |
+| 100.B) Authority.I | AUTH-PACKS-43-001 | DONE (2025-11-09) | Authority Core & Security Guild (src/Authority/StellaOps.Authority) | Enforce pack approval metadata (`pack_run_id`, `pack_gate_id`, `pack_plan_hash`) plus five-minute fresh-auth; scope handler downgrades missing metadata, docs/runbook updated, and Authority tests cover new claims + audit properties. |
| 100.B) Authority.I | AUTH-NOTIFY-38-001 | DONE (2025-11-01) | Authority Core & Security Guild (src/Authority/StellaOps.Authority) | Define `Notify.Viewer`, `Notify.Operator`, `Notify.Admin` scopes/roles, update discovery metadata, offline defaults, and issuer templates. |
| 100.B) Authority.I | AUTH-NOTIFY-40-001 | DONE (2025-11-02) | Authority Core & Security Guild (src/Authority/StellaOps.Authority) | Implement signed ack token key rotation, webhook allowlists, admin-only escalation settings, and audit logging of ack actions. (Deps: AUTH-NOTIFY-38-001, WEB-NOTIFY-40-001.) |
| 100.B) Authority.I | AUTH-NOTIFY-42-001 | DONE (2025-11-02) | Authority Core & Security Guild (src/Authority/StellaOps.Authority) | Investigate ack token rotation 500 errors (test Rotate_ReturnsBadRequest_WhenKeyIdMissing_AndAuditsFailure still failing). Capture logs, identify root cause, and patch handler. (Deps: AUTH-NOTIFY-40-001.) |
@@ -1692,6 +1693,7 @@ This file describe implementation of Stella Ops (docs/README.md). Implementation
| 100.B) Authority.I | AUTH-OBS-52-001 | DONE (2025-11-02) | Authority Core & Security Guild (src/Authority/StellaOps.Authority) | Configure resource server policies for Timeline Indexer, Evidence Locker, Exporter, and Observability APIs enforcing new scopes + tenant claims. Emit audit events including scope usage and trace IDs. (Deps: AUTH-OBS-50-001, TIMELINE-OBS-52-003, EVID-OBS-53-003.) |
| 100.B) Authority.I | AUTH-OBS-55-001 | DONE (2025-11-02) | Authority Core & Security Guild, Ops Guild (src/Authority/StellaOps.Authority) | Harden incident mode authorization: require `obs:incident` scope + fresh auth, log activation reason, and expose verification endpoint for auditors. Update docs/runbooks. (Deps: AUTH-OBS-50-001, WEB-OBS-55-001.) |
| 100.B) Authority.I | AUTH-ORCH-34-001 | DONE (2025-11-02) | Authority Core & Security Guild (src/Authority/StellaOps.Authority) | Introduce `Orch.Admin` role with quota/backfill scopes, enforce audit reason on quota changes, and update offline defaults/docs. (Deps: AUTH-ORCH-33-001.) |
+| Sprint 100 | Authority Identity & Signing | docs/implplan/SPRINT_100_identity_signing.md | DONE (2025-11-09) | Authority Core, Security Guild, Docs Guild | SEC2/SEC3/SEC5 plug-in telemetry landed (credential audit events, lockout retry metadata), PLG7.IMPL-005 updated docs/sample manifests/Offline Kit guidance for the LDAP plug-in. |
| 100.B) Authority.I | AUTH-PACKS-41-001 | DONE (2025-11-04) | Authority Core & Security Guild (src/Authority/StellaOps.Authority) | Define CLI SSO profiles and pack scopes (`Packs.Read`, `Packs.Write`, `Packs.Run`, `Packs.Approve`), update discovery metadata, offline defaults, and issuer templates. (Deps: AUTH-AOC-19-001.) |
| 100.B) Authority.II | AUTH-POLICY-23-001 | DONE (2025-10-27) | Authority Core & Docs Guild (src/Authority/StellaOps.Authority) | Introduce fine-grained policy scopes (`policy:read`, `policy:author`, `policy:review`, `policy:simulate`, `findings:read`) for CLI/service accounts; update discovery metadata, issuer templates, and offline defaults. (Deps: AUTH-AOC-19-002.) |
| 100.B) Authority.II | AUTH-POLICY-23-002 | DONE (2025-11-08) | Authority Core & Security Guild (src/Authority/StellaOps.Authority) | Implement optional two-person rule for activation: require two distinct `policy:activate` approvals when configured; emit audit logs. (Deps: AUTH-POLICY-23-001.) |
diff --git a/docs/modules/advisory-ai/architecture.md b/docs/modules/advisory-ai/architecture.md
index 015d4364a..be91fe511 100644
--- a/docs/modules/advisory-ai/architecture.md
+++ b/docs/modules/advisory-ai/architecture.md
@@ -1,136 +1,136 @@
-# Advisory AI architecture
-
-> Captures the retrieval, guardrail, and inference packaging requirements defined in the Advisory AI implementation plan and related module guides.
-
-## 1) Goals
-
-- Summarise advisories/VEX evidence into operator-ready briefs with citations.
-- Explain conflicting statements with provenance and trust weights (using VEX Lens & Excititor data).
-- Suggest remediation plans aligned with Offline Kit deployment models and scheduler follow-ups.
-- Operate deterministically where possible; cache generated artefacts with digests for audit.
-
-## 2) Pipeline overview
-
-```
- +---------------------+
- Concelier/VEX Lens | Evidence Retriever |
- Policy Engine ----> | (vector + keyword) | ---> Context Pack (JSON)
- Zastava runtime +---------------------+
- |
- v
- +-------------+
- | Prompt |
- | Assembler |
- +-------------+
- |
- v
- +-------------+
- | Guarded LLM |
- | (local/host)|
- +-------------+
- |
- v
- +-----------------+
- | Citation & |
- | Validation |
- +-----------------+
- |
- v
- +----------------+
- | Output cache |
- | (hash, bundle) |
- +----------------+
-```
-
-## 3) Retrieval & context
-
-- Hybrid search: vector embeddings (SBERT-compatible) + keyword filters for advisory IDs, PURLs, CVEs.
-- Context packs include:
- - Advisory raw excerpts with highlighted sections and source URLs.
- - VEX statements (normalized tuples + trust metadata).
- - Policy explain traces for the affected finding.
- - Runtime/impact hints from Zastava (exposure, entrypoints).
- - Export-ready remediation data (fixed versions, patches).
-- **SBOM context retriever** (AIAI-31-002) hydrates:
- - Version timelines (first/last observed, status, fix availability).
- - Dependency paths (runtime vs build/test, deduped by coordinate chain).
- - Tenant environment flags (prod/stage toggles) with optional blast radius summary.
- - Service-side clamps: max 500 timeline entries, 200 dependency paths, with client-provided toggles for env/blast data.
- - `AddSbomContextHttpClient(...)` registers the typed HTTP client that calls `/v1/sbom/context`, while `NullSbomContextClient` remains the safe default for environments that have not yet exposed the SBOM service.
-
- **Sample configuration** (wire real SBOM base URL + API key):
-
- ```csharp
- services.AddSbomContextHttpClient(options =>
- {
- options.BaseAddress = new Uri("https://sbom-service.internal");
- options.Endpoint = "/v1/sbom/context";
- options.ApiKey = configuration["SBOM_SERVICE_API_KEY"];
- options.UserAgent = "stellaops-advisoryai/1.0";
- options.Tenant = configuration["TENANT_ID"];
- });
-
- services.AddAdvisoryPipeline();
- ```
-
- After configuration, issue a smoke request (e.g., `ISbomContextRetriever.RetrieveAsync`) during deployment validation to confirm end-to-end connectivity and credentials before enabling Advisory AI endpoints.
-
-Retriever requests and results are trimmed/normalized before hashing; metadata (counts, provenance keys) is returned for downstream guardrails. Unit coverage ensures deterministic ordering and flag handling.
-
-All context references include `content_hash` and `source_id` enabling verifiable citations.
-
-## 4) Guardrails
-
-- Prompt templates enforce structure: summary, conflicts, remediation, references.
-- Response validator ensures:
- - No hallucinated advisories (every fact must map to input context).
- - Citations follow `[n]` indexing referencing actual sources.
- - Remediation suggestions only cite policy-approved sources (fixed versions, vendor hotfixes).
-- Moderation/PII filters prevent leaking secrets; responses failing validation are rejected and logged.
-- Pre-flight guardrails redact secrets (AWS keys, generic API tokens, PEM blobs), block "ignore previous instructions"-style prompt injection attempts, enforce citation presence, and cap prompt payload length (default 16 kB). Guardrail outcomes and redaction counts surface via `advisory_guardrail_blocks` / `advisory_outputs_stored` metrics.
-
-## 5) Deterministic tooling
-
-- **Version comparators** — offline semantic version + RPM EVR parsers with range evaluators. Supports chained constraints (`>=`, `<=`, `!=`) used by remediation advice and blast radius calcs.
- - Registered via `AddAdvisoryDeterministicToolset` for reuse across orchestrator, CLI, and services.
-- **Orchestration pipeline** — see `orchestration-pipeline.md` for prerequisites, task breakdown, and cross-guild responsibilities before wiring the execution flows.
-- **Planned extensions** — NEVRA/EVR comparators, ecosystem-specific normalisers, dependency chain scorers (AIAI-31-003 scope).
-- Exposed via internal interfaces to allow orchestrator/toolchain reuse; all helpers stay side-effect free and deterministic for golden testing.
-
-## 6) Output persistence
-
-- Cached artefacts stored in `advisory_ai_outputs` with fields:
- - `output_hash` (sha256 of JSON response).
- - `input_digest` (hash of context pack).
- - `summary`, `conflicts`, `remediation`, `citations`.
- - `generated_at`, `model_id`, `profile` (Sovereign/FIPS etc.).
- - `signatures` (optional DSSE if run in deterministic mode).
-- Offline bundle format contains `summary.md`, `citations.json`, `context_manifest.json`, `signatures/`.
-
-## 7) Profiles & sovereignty
-
-- **Profiles:** `default`, `fips-local` (FIPS-compliant local model), `gost-local`, `cloud-openai` (optional, disabled by default). Each profile defines allowed models, key management, and telemetry endpoints.
-- **CryptoProfile/RootPack integration:** generated artefacts can be signed using configured CryptoProfile to satisfy procurement/trust requirements.
-
-## 8) APIs
-
-- `POST /api/v1/advisory/{task}` — executes Summary/Conflict/Remediation pipeline (`task` ∈ `summary|conflict|remediation`). Requests accept `{advisoryKey, artifactId?, policyVersion?, profile, preferredSections?, forceRefresh}` and return sanitized prompt payloads, citations, guardrail metadata, provenance hash, and cache hints.
-- `GET /api/v1/advisory/outputs/{cacheKey}?taskType=SUMMARY&profile=default` — retrieves cached artefacts for downstream consumers (Console, CLI, Export Center). Guardrail state and provenance hash accompany results.
-
-All endpoints accept `profile` parameter (default `fips-local`) and return `output_hash`, `input_digest`, and `citations` for verification.
-
-## 9) Observability
-
-- Metrics: `advisory_ai_requests_total{profile,type}`, `advisory_ai_latency_seconds`, `advisory_ai_validation_failures_total`.
-- Logs: include `output_hash`, `input_digest`, `profile`, `model_id`, `tenant`, `artifacts`. Sensitive context is not logged.
-- Traces: spans for retrieval, prompt assembly, model inference, validation, cache write.
-
-## 10) Operational controls
-
-- Feature flags per tenant (`ai.summary.enabled`, `ai.remediation.enabled`).
-- Rate limits (per tenant, per profile) enforced by Orchestrator to prevent runaway usage.
-- Offline/air-gapped deployments run local models packaged with Offline Kit; model weights validated via manifest digests.
-
+# Advisory AI architecture
+
+> Captures the retrieval, guardrail, and inference packaging requirements defined in the Advisory AI implementation plan and related module guides.
+
+## 1) Goals
+
+- Summarise advisories/VEX evidence into operator-ready briefs with citations.
+- Explain conflicting statements with provenance and trust weights (using VEX Lens & Excititor data).
+- Suggest remediation plans aligned with Offline Kit deployment models and scheduler follow-ups.
+- Operate deterministically where possible; cache generated artefacts with digests for audit.
+
+## 2) Pipeline overview
+
+```
+ +---------------------+
+ Concelier/VEX Lens | Evidence Retriever |
+ Policy Engine ----> | (vector + keyword) | ---> Context Pack (JSON)
+ Zastava runtime +---------------------+
+ |
+ v
+ +-------------+
+ | Prompt |
+ | Assembler |
+ +-------------+
+ |
+ v
+ +-------------+
+ | Guarded LLM |
+ | (local/host)|
+ +-------------+
+ |
+ v
+ +-----------------+
+ | Citation & |
+ | Validation |
+ +-----------------+
+ |
+ v
+ +----------------+
+ | Output cache |
+ | (hash, bundle) |
+ +----------------+
+```
+
+## 3) Retrieval & context
+
+- Hybrid search: vector embeddings (SBERT-compatible) + keyword filters for advisory IDs, PURLs, CVEs.
+- Context packs include:
+ - Advisory raw excerpts with highlighted sections and source URLs.
+ - VEX statements (normalized tuples + trust metadata).
+ - Policy explain traces for the affected finding.
+ - Runtime/impact hints from Zastava (exposure, entrypoints).
+ - Export-ready remediation data (fixed versions, patches).
+- **SBOM context retriever** (AIAI-31-002) hydrates:
+ - Version timelines (first/last observed, status, fix availability).
+ - Dependency paths (runtime vs build/test, deduped by coordinate chain).
+ - Tenant environment flags (prod/stage toggles) with optional blast radius summary.
+ - Service-side clamps: max 500 timeline entries, 200 dependency paths, with client-provided toggles for env/blast data.
+ - `AddSbomContextHttpClient(...)` registers the typed HTTP client that calls `/v1/sbom/context`, while `NullSbomContextClient` remains the safe default for environments that have not yet exposed the SBOM service.
+
+ **Sample configuration** (wire real SBOM base URL + API key):
+
+ ```csharp
+ services.AddSbomContextHttpClient(options =>
+ {
+ options.BaseAddress = new Uri("https://sbom-service.internal");
+ options.Endpoint = "/v1/sbom/context";
+ options.ApiKey = configuration["SBOM_SERVICE_API_KEY"];
+ options.UserAgent = "stellaops-advisoryai/1.0";
+ options.Tenant = configuration["TENANT_ID"];
+ });
+
+ services.AddAdvisoryPipeline();
+ ```
+
+ After configuration, issue a smoke request (e.g., `ISbomContextRetriever.RetrieveAsync`) during deployment validation to confirm end-to-end connectivity and credentials before enabling Advisory AI endpoints.
+
+Retriever requests and results are trimmed/normalized before hashing; metadata (counts, provenance keys) is returned for downstream guardrails. Unit coverage ensures deterministic ordering and flag handling.
+
+All context references include `content_hash` and `source_id` enabling verifiable citations.
+
+## 4) Guardrails
+
+- Prompt templates enforce structure: summary, conflicts, remediation, references.
+- Response validator ensures:
+ - No hallucinated advisories (every fact must map to input context).
+ - Citations follow `[n]` indexing referencing actual sources.
+ - Remediation suggestions only cite policy-approved sources (fixed versions, vendor hotfixes).
+- Moderation/PII filters prevent leaking secrets; responses failing validation are rejected and logged.
+- Pre-flight guardrails redact secrets (AWS keys, generic API tokens, PEM blobs), block "ignore previous instructions"-style prompt injection attempts, enforce citation presence, and cap prompt payload length (default 16 kB). Guardrail outcomes and redaction counts surface via `advisory_guardrail_blocks` / `advisory_outputs_stored` metrics.
+
+## 5) Deterministic tooling
+
+- **Version comparators** — offline semantic version + RPM EVR parsers with range evaluators. Supports chained constraints (`>=`, `<=`, `!=`) used by remediation advice and blast radius calcs.
+ - Registered via `AddAdvisoryDeterministicToolset` for reuse across orchestrator, CLI, and services.
+- **Orchestration pipeline** — see `orchestration-pipeline.md` for prerequisites, task breakdown, and cross-guild responsibilities before wiring the execution flows.
+- **Planned extensions** — NEVRA/EVR comparators, ecosystem-specific normalisers, dependency chain scorers (AIAI-31-003 scope).
+- Exposed via internal interfaces to allow orchestrator/toolchain reuse; all helpers stay side-effect free and deterministic for golden testing.
+
+## 6) Output persistence
+
+- Cached artefacts stored in `advisory_ai_outputs` with fields:
+ - `output_hash` (sha256 of JSON response).
+ - `input_digest` (hash of context pack).
+ - `summary`, `conflicts`, `remediation`, `citations`.
+ - `generated_at`, `model_id`, `profile` (Sovereign/FIPS etc.).
+ - `signatures` (optional DSSE if run in deterministic mode).
+- Offline bundle format contains `summary.md`, `citations.json`, `context_manifest.json`, `signatures/`.
+
+## 7) Profiles & sovereignty
+
+- **Profiles:** `default`, `fips-local` (FIPS-compliant local model), `gost-local`, `cloud-openai` (optional, disabled by default). Each profile defines allowed models, key management, and telemetry endpoints.
+- **CryptoProfile/RootPack integration:** generated artefacts can be signed using configured CryptoProfile to satisfy procurement/trust requirements.
+
+## 8) APIs
+
+- `POST /api/v1/advisory/{task}` — executes Summary/Conflict/Remediation pipeline (`task` ∈ `summary|conflict|remediation`). Requests accept `{advisoryKey, artifactId?, policyVersion?, profile, preferredSections?, forceRefresh}` and return sanitized prompt payloads, citations, guardrail metadata, provenance hash, and cache hints.
+- `GET /api/v1/advisory/outputs/{cacheKey}?taskType=SUMMARY&profile=default` — retrieves cached artefacts for downstream consumers (Console, CLI, Export Center). Guardrail state and provenance hash accompany results.
+
+All endpoints accept `profile` parameter (default `fips-local`) and return `output_hash`, `input_digest`, and `citations` for verification.
+
+## 9) Observability
+
+- Metrics: `advisory_ai_requests_total{profile,type}`, `advisory_ai_latency_seconds`, `advisory_ai_validation_failures_total`.
+- Logs: include `output_hash`, `input_digest`, `profile`, `model_id`, `tenant`, `artifacts`. Sensitive context is not logged.
+- Traces: spans for retrieval, prompt assembly, model inference, validation, cache write.
+
+## 10) Operational controls
+
+- Feature flags per tenant (`ai.summary.enabled`, `ai.remediation.enabled`).
+- Rate limits (per tenant, per profile) enforced by Orchestrator to prevent runaway usage.
+- Offline/air-gapped deployments run local models packaged with Offline Kit; model weights validated via manifest digests.
+
## 11) Hosting surfaces
- **WebService** — exposes `/v1/advisory-ai/pipeline/{task}` to materialise plans and enqueue execution messages.
@@ -140,7 +140,7 @@ All endpoints accept `profile` parameter (default `fips-local`) and return `outp
## 12) QA harness & determinism (Sprint 110 refresh)
-- **Injection fixtures:** `src/AdvisoryAI/__Tests/StellaOps.AdvisoryAI.Tests/TestData/prompt-injection-fixtures.txt` drives `AdvisoryGuardrailInjectionTests`, ensuring blocked phrases (`ignore previous instructions`, `override the system prompt`, etc.) are rejected with redaction counters, preventing prompt-injection regressions.
+- **Injection fixtures:** `src/AdvisoryAI/__Tests/StellaOps.AdvisoryAI.Tests/TestData/guardrail-injection-cases.json` now enumerates both blocked and allow-listed prompts (redactions, citation checks, prompt-length clamps) while the legacy `prompt-injection-fixtures.txt` file continues to supply quick block-only payloads. `AdvisoryGuardrailInjectionTests` consumes both datasets so guardrail regressions surface with metadata (blocked phrase counts, redaction counters, citation enforcement) instead of single-signal failures.
- **Golden prompts:** `summary-prompt.json` now pairs with `conflict-prompt.json`; `AdvisoryPromptAssemblerTests` load both to enforce deterministic JSON payloads across task types and verify vector preview truncation (600 characters + ellipsis) keeps prompts under the documented perf ceiling.
- **Plan determinism:** `AdvisoryPipelineOrchestratorTests` shuffle structured/vector/SBOM inputs and assert cache keys + metadata remain stable, proving that seeded plan caches stay deterministic even when retrievers emit out-of-order results.
- **Execution telemetry:** `AdvisoryPipelineExecutorTests` exercise partial citation coverage (target ≥0.5 when only half the structured chunks are cited) so `advisory_ai_citation_coverage_ratio` reflects real guardrail quality.
diff --git a/docs/modules/authority/architecture.md b/docs/modules/authority/architecture.md
index 09d59bbc6..c50f3e481 100644
--- a/docs/modules/authority/architecture.md
+++ b/docs/modules/authority/architecture.md
@@ -321,6 +321,7 @@ Every Stella Ops service that consumes Authority tokens **must**:
* `authority.jwks_rotations_total`
* `authority.errors_total{type}`
* **Audit log** (immutable sink): token issuance (`sub`, `aud`, `scopes`, `tid`, `inst`, `cnf thumbprint`, `jti`), revocations, admin changes.
+* **Plugin telemetry**: password-capable plug-ins (Standard, LDAP) emit `authority.plugin..password_verification` events via `IAuthEventSink`, inheriting correlation/client/tenant/network metadata from `AuthorityCredentialAuditContext`. Each event includes `plugin.failed_attempts`, `plugin.lockout_until`, `plugin.retry_after_seconds`, `plugin.failure_code`, and any plug-in specific signals so SOC tooling can trace lockouts and rate-limit responses even in air-gapped deployments. Offline Kits ship the plug-in binaries plus the curated manifests (`etc/authority.plugins/*.yaml`) so these audit flows exist out of the box.
* **Tracing**: token flows, DB reads, JWKS cache.
---
diff --git a/docs/modules/cli/guides/packs-profiles.md b/docs/modules/cli/guides/packs-profiles.md
index 9bca3370b..c316be1c4 100644
--- a/docs/modules/cli/guides/packs-profiles.md
+++ b/docs/modules/cli/guides/packs-profiles.md
@@ -52,3 +52,5 @@ StellaOps:
3. Export `STELLA_PROFILE=` before running `stella auth login` or individual pack commands.
The CLI reads the profile, applies the Authority configuration, and requests the listed scopes so the resulting tokens satisfy Task Runner and Packs Registry expectations.
+
+> **Pack approval tip** – `stella pack approve` now relays `--pack-run-id`, `--pack-gate-id`, and `--pack-plan-hash` to Authority whenever it asks for `packs.approve`. Profiles don’t store these values (they change per run), but keeping the approver profile loaded ensures the CLI can prompt for the metadata, validate it against the plan hash, and satisfy the Authority procedure documented in `docs/task-packs/runbook.md#4-approvals-workflow`.
diff --git a/docs/modules/excititor/README.md b/docs/modules/excititor/README.md
index 5326e0c92..df86d5c56 100644
--- a/docs/modules/excititor/README.md
+++ b/docs/modules/excititor/README.md
@@ -33,6 +33,7 @@ Excititor converts heterogeneous VEX feeds into raw observations and linksets th
- MongoDB for observation storage and job metadata.
- Offline kit packaging aligned with Concelier merges.
- Connector-specific runbooks (see `docs/modules/concelier/operations/connectors`).
+- Ubuntu CSAF provenance knobs: [`operations/ubuntu-csaf.md`](operations/ubuntu-csaf.md) captures TrustWeight/Tier, cosign, and fingerprint configuration for the sprint 120 enrichment.
## Backlog references
- DOCS-LNM-22-006 / DOCS-LNM-22-007 (shared with Concelier).
diff --git a/docs/modules/excititor/operations/ubuntu-csaf.md b/docs/modules/excititor/operations/ubuntu-csaf.md
new file mode 100644
index 000000000..a3cf09305
--- /dev/null
+++ b/docs/modules/excititor/operations/ubuntu-csaf.md
@@ -0,0 +1,66 @@
+# Ubuntu CSAF connector runbook
+
+> Updated 2025-11-09 alongside sprint 110/120 trust-provenance work.
+
+## Purpose
+- Ingest Ubuntu USN/CSAF statements via the restart-only connector (`StellaOps.Excititor.Connectors.Ubuntu.CSAF`).
+- Preserve Aggregation-Only Contract guarantees while surfacing issuance provenance (`vex.provenance.*`) for VEX Lens and Policy Engine.
+- Allow operators to tune trust weighting (tiers, fingerprints, cosign issuers) without recompiling the connector.
+
+## Configuration keys
+| Key | Default | Notes |
+| --- | --- | --- |
+| `Excititor:Connectors:Ubuntu:IndexUri` | `https://ubuntu.com/security/csaf/index.json` | Ubuntu CSAF index. Override only when mirroring the feed. |
+| `...:Channels` | `["stable"]` | List of channel names to poll. Order preserved for deterministic cursoring. |
+| `...:MetadataCacheDuration` | `4h` | How long to cache catalog metadata before re-fetching. |
+| `...:PreferOfflineSnapshot` / `OfflineSnapshotPath` / `PersistOfflineSnapshot` | `false` / `null` / `true` | Enable when running from Offline Kit bundles. Snapshot path must be reachable/read-only under sealed deployments. |
+| `...:TrustWeight` | `0.75` | Baseline trust weight (0–1). Lens multiplies this by freshness/justification modifiers. |
+| `...:TrustTier` | `"distro"` | Friendly tier label surfaced via `vex.provenance.trust.tier` (e.g., `distro-trusted`, `community`). |
+| `...:CosignIssuer` / `CosignIdentityPattern` | `null` | Supply when Ubuntu publishes cosign attestations (issuer URL and identity regex). Required together. |
+| `...:PgpFingerprints` | `[]` | Ordered list of trusted PGP fingerprints. Emitted verbatim as `vex.provenance.pgp.fingerprints`. |
+
+## Example `appsettings.json`
+```jsonc
+{
+ "Excititor": {
+ "Connectors": {
+ "Ubuntu": {
+ "IndexUri": "https://mirror.example.com/security/csaf/index.json",
+ "Channels": ["stable", "esm-apps"],
+ "TrustWeight": 0.82,
+ "TrustTier": "distro-trusted",
+ "CosignIssuer": "https://issuer.ubuntu.com",
+ "CosignIdentityPattern": "spiffe://ubuntu/vex/*",
+ "PgpFingerprints": [
+ "0123456789ABCDEF0123456789ABCDEF01234567",
+ "89ABCDEF0123456789ABCDEF0123456789ABCDEF"
+ ],
+ "PreferOfflineSnapshot": true,
+ "OfflineSnapshotPath": "/opt/stella/offline/ubuntu/index.json"
+ }
+ }
+ }
+}
+```
+
+## Environment variable cheatsheet
+```
+Excititor__Connectors__Ubuntu__TrustWeight=0.9
+Excititor__Connectors__Ubuntu__TrustTier=distro-critical
+Excititor__Connectors__Ubuntu__PgpFingerprints__0=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+Excititor__Connectors__Ubuntu__PgpFingerprints__1=BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB
+Excititor__Connectors__Ubuntu__CosignIssuer=https://issuer.ubuntu.com
+Excititor__Connectors__Ubuntu__CosignIdentityPattern=spiffe://ubuntu/vex/*
+```
+
+## Operational checklist
+1. **Before enabling** – import the Ubuntu PGP bundle (Offline Kit provides `certificates/ubuntu-vex.gpg`) and set the fingerprints so provenance metadata stays deterministic.
+2. **Validate provenance output** – run `dotnet test src/Excititor/__Tests/StellaOps.Excititor.Connectors.Ubuntu.CSAF.Tests --filter FetchAsync_IngestsNewDocument` to ensure the connector emits the `vex.provenance.*` fields expected by VEX Lens.
+3. **Monitor Lens weights** – Grafana panels `VEX Lens / Trust Inputs` show the weight/tier captured per provider. Ubuntu rows should reflect the configured `TrustWeight` and fingerprints.
+4. **Rotate fingerprints** – update `PgpFingerprints` when Canonical rotates signing keys. Apply the change, restart Excititor workers, verify the provenance metadata, then trigger a targeted Lens recompute for Ubuntu issuers.
+5. **Offline mode** – populate `OfflineSnapshotPath` via Offline Kit bundles before toggling `PreferOfflineSnapshot`. Keep snapshots in the sealed `/opt/stella/offline` hierarchy for auditability.
+
+## Troubleshooting
+- **Connector refuses to start** – check logs for `InvalidOperationException` referencing `CosignIssuer`/`CosignIdentityPattern` or missing snapshot path; the validator enforces complete pairs and on-disk paths.
+- **Lens still sees default weights** – confirm the Excititor deployment picked up the new settings (view `/excititor/health` JSON → `connectors.providers[].options`). Lens only overrides when the provenance payload includes `vex.provenance.trust.*` fields.
+- **PGP mismatch alerts** – if Lens reports fingerprint mismatches, ensure the list ordering matches Canonical’s published order; duplicates are trimmed, so provide each fingerprint once.
diff --git a/docs/modules/scanner/deterministic-sbom-compose.md b/docs/modules/scanner/deterministic-sbom-compose.md
new file mode 100644
index 000000000..8359d22f5
--- /dev/null
+++ b/docs/modules/scanner/deterministic-sbom-compose.md
@@ -0,0 +1,66 @@
+# Deterministic SBOM Composition (Spec Draft)
+
+> **Status:** Draft v0.1 (Sprint 136 / 203 / 209 linkage)
+> **Owners:** Scanner Guild · DevEx/CLI Guild · UI Guild · Docs Guild · Security Guild
+> **Related Tasks:** `SCANNER-SURFACE-04`, `SURFACE-FS-07`, `SCANNER-EMIT-15-001`, `SCANNER-SORT-02`, `CLI-SBOM-60-001`, `CLI-SBOM-60-002`, `UI-SBOM-DET-01`, `UI-POLICY-DET-01`, `DOCS-SCANNER-DET-01`, `DOCS-POLICY-DET-01`, `DOCS-CLI-DET-01`, `SCANNER-CRYPTO-90-002`, `SCANNER-CRYPTO-90-003`
+
+## 1. Purpose
+
+Guarantee that every container scan yields **provably deterministic** SBOM artifacts that can be verified offline. Each layer fragment is DSSE-signed before merge, `_composition.json` captures the canonical merge recipe, and the final CycloneDX inventory/usage SBOMs expose Merkle roots and `stella.contentHash` properties. CLI/UI/policy layers consume those signals to block non-deterministic releases and provide human-friendly diagnostics.
+
+## 2. Scope
+
+### 2.1 Fragment attestation
+
+- Scanner Worker emits `layer.fragments` payloads as canonical JSON (lexicographic keys, compact whitespace, normalized timestamps, ordered component arrays).
+- Each fragment is signed via DSSE (default Ed25519; PQ/Dilithium toggle routed through `ICryptoProviderRegistry`).
+- `_composition.json` records `{layerDigest, fragmentSha256, dsseEnvelopeSha256}` per fragment alongside the overall Merkle root.
+- Surface manifests append links to fragment DSSE envelopes so offline kits can fetch them without re-scan.
+
+### 2.2 Canonical merge
+
+- Merge order strictly follows `layerDigest` (ascending hex) and then `component.identity.purl` (fallback to `identity.key`).
+- CycloneDX metadata gains:
+ - `properties["stellaops:stella.contentHash"]` for each fragment and composition root.
+ - `properties["stellaops:composition.manifest"]` referencing `_composition.json` CAS URI.
+ - `properties["stellaops:merkle.root"]` for the composed BOM.
+- `ScannerTimestamps.Normalize` continues to zero fractional microseconds; SBOM timestamps should default to `"0001-01-01T00:00:00Z"` when no semantic timestamp is required.
+
+### 2.3 Surface manifest extensions
+
+- `SurfaceManifestArtifact` gains optional `attestations[]` with `{kind, mediaType, digest, uri}` for DSSE envelopes.
+- `_composition.json` is published as an additional artifact kind `composition.recipe`.
+- Surface reader/writer validate Merkle roots before caching manifest entries.
+
+### 2.4 Tooling impacts
+
+- **CLI (`stella sbomer ...`)**: adds `layer` and `compose` verbs, deterministic diff reporting, and offline verification per `_composition.json`.
+- **UI/Policy**: determinism badge, drift diffs, and a policy gate that blocks releases when fragment DSSE/verifications fail.
+- **Docs**: new guides under `docs/scanner` & `docs/cli` plus policy references detailing how to interpret determinism metadata.
+- **Crypto**: PQ-friendly DSSE toggle delivered via `SCANNER-CRYPTO-90-002/003` so sovereign bundles can select Dilithium/Falcon.
+
+## 3. Verification Flow (offline kit)
+
+1. Verify DSSE on each fragment (using `verifiers.json`).
+2. Recompute `sha256(c14n(fragment))` and compare with `_composition.json`.
+3. Re-run composition locally (using canonical ordering) and compare `sha256(c14n(composed))` against `manifest.properties["stellaops:merkle.root"]`.
+4. Optionally validate provided Merkle proofs (leaf → root) and attest that the UI/Policy gate marked the scan as deterministic.
+
+## 4. Deliverables Checklist
+
+| Area | Deliverable |
+| --- | --- |
+| Scanner Worker | DSSE per fragment, `_composition.json`, canonical fragment serializer, Surface manifest updates |
+| Emit pipeline | Layer-sorted composition, `stella.contentHash`, Merkle metadata, PQ-aware signing hooks |
+| CLI | `stella sbomer layer/compose/drift`, verification commands, documentation |
+| UI | Determinism badge, drift diagnostics, policy gate wiring |
+| Docs | Updated scanner/cli/policy guides, offline kit instructions |
+| Tests | Regression suites covering canonicalization, DSSE verification, PQ keypaths, Merkle roots |
+
+## 5. References
+
+- `docs/modules/scanner/architecture.md`
+- `docs/modules/scanner/design/surface-fs.md`
+- `docs/replay/DETERMINISTIC_REPLAY.md`
+- `docs/modules/cli/architecture.md`
+- `docs/modules/policy/architecture.md`
diff --git a/docs/modules/vex-lens/README.md b/docs/modules/vex-lens/README.md
index 587ddcd3b..51dc7fffb 100644
--- a/docs/modules/vex-lens/README.md
+++ b/docs/modules/vex-lens/README.md
@@ -15,6 +15,13 @@ VEX Lens produces a deterministic, provenance-rich consensus view of VEX stateme
- **Explainability traces** — capture derived-from chains, conflicting issuers, and trust deltas to power UI drilldowns and CLI audits.
- **Recompute orchestration** — Orchestrator jobs trigger recompute on Excititor deltas, issuer updates, or policy knob changes with deterministic ordering and SRM manifests.
+### Provenance-aware trust weighting (new)
+
+- **Connector metadata contract.** Excititor connectors now emit `vex.provenance.*` fields (provider id/name/kind, `trust.weight`, `trust.tier`, human-readable `trust.note`, `cosign.*`, and ordered `pgp.fingerprints`). VEX Lens must ingest these keys verbatim so the trust engine can reason about issuer pedigree without hitting external registries for every statement.
+- **Weight calculation.** Lens uses the supplied `trust.weight` as the baseline score, then multiplies by freshness decay and justification scope multipliers. Missing weights default to the Issuer Directory profile, but connector-provided values take precedence so Ubuntu/SUSE mirror feeds can tune their relative influence.
+- **Integrity hints.** Presence of `vex.provenance.cosign.*` or `pgp.fingerprints` toggles signature-policy shortcuts: if Lens sees a statement whose provenance indicates cosign keyless mode plus Rekor URI, it can skip redundant issuer lookups and apply the “cryptographically verified” confidence tier immediately.
+- **Policy exposure.** Consensus APIs surface the original provenance payload inside each `sources[]` entry so Policy Engine, Advisory AI, and Console can explain why a lower-tier issuer lost a conflict (e.g., different `trust.tier` or missing fingerprints). See the updated payload reference in `docs/vex/consensus-json.md`.
+
## Current workstreams (Q4 2025)
- `VEXLENS-30-001..004` — build normalisation pipeline, product mapping library, and trust weighting engine (in progress; dependencies captured in src/VexLens/StellaOps.VexLens/TASKS.md).
- `VEXLENS-30-005..007` — expose consensus APIs and export flows, aligning docs with future `/docs/vex/consensus-*.md` deliverables.
diff --git a/docs/modules/vex-lens/architecture.md b/docs/modules/vex-lens/architecture.md
index cc8033c8b..db104969c 100644
--- a/docs/modules/vex-lens/architecture.md
+++ b/docs/modules/vex-lens/architecture.md
@@ -8,9 +8,23 @@ Compute a deterministic, reproducible consensus view over multiple VEX statement
## 2) Inputs
-- `vex_normalized` tuples emitted by Excititor (status, justification, scope, timestamp, content hash).
-- Issuer trust registry (`vex_issuer_registry`) providing trust tier, confidence, authority scope.
-- Optional runtime context (Zastava exposure) and policy precedence rules.
+- `vex_normalized` tuples emitted by Excititor (status, justification, scope, timestamp, content hash).
+- Issuer trust registry (`vex_issuer_registry`) providing trust tier, confidence, authority scope.
+- Optional runtime context (Zastava exposure) and policy precedence rules.
+
+### Provenance field mapping (new input contract)
+
+Excititor connectors now stamp every raw VEX document with `vex.provenance.*` metadata. Lens ingests these keys alongside the normalized tuples:
+
+| Field | Description | Lens usage |
+| --- | --- | --- |
+| `vex.provenance.provider` / `providerName` / `providerKind` | Logical issuer identity and type supplied by the connector (e.g., `excititor:ubuntu`, `distro`). | Seed issuer lookup, short-circuit Issuer Directory calls when we already trust the connector’s profile. |
+| `vex.provenance.trust.weight` | Connector-provided base weight (0–1). | Multiplied by freshness decay & justification multipliers; overrides registry default. |
+| `vex.provenance.trust.tier` & `trust.note` | Human/ops tier labels (`vendor`, `distro-trusted`, etc.) plus descriptive note. | Drives secondary sort (after timestamp) and Console labels; conflicts report per-tier deltas. |
+| `vex.provenance.cosign.*` | Cosign issuer/identity pattern (+ optional Fulcio/Rekor URIs). | When present, Lens marks the statement as “cryptographically attested” and applies the higher confidence bucket immediately. |
+| `vex.provenance.pgp.fingerprints` | Ordered list of PGP fingerprints used by the feed. | Enables Lens to validate deterministic fingerprint sets against Issuer Directory entries and flag mismatches in conflict summaries. |
+
+The trust engine preserves the raw metadata so downstream components can audit decisions or remap tiers without replaying ingestion.
## 3) Core algorithm
diff --git a/docs/modules/vex-lens/implementation_plan.md b/docs/modules/vex-lens/implementation_plan.md
index 612c5255a..5de9af176 100644
--- a/docs/modules/vex-lens/implementation_plan.md
+++ b/docs/modules/vex-lens/implementation_plan.md
@@ -15,11 +15,11 @@
## Work breakdown
- **VEX Lens service**
- Normalise VEX payloads, maintain scope scores, compute consensus digest.
- - Trust weighting functions (issuer tier, freshness decay, scope quality).
+ - Trust weighting functions (issuer tier, freshness decay, scope quality) ingest the new `vex.provenance.*` contract emitted by Excititor connectors (provider weight/tier, cosign metadata, fingerprints) so connector-tuned trust flows all the way to consensus.
- Idempotent workers for consensus projection and history tracking.
- Conflict handling queue for manual review and notifications.
- **Integrations**
- - Excitor: enrich VEX events with issuer hints, signatures, product trees.
+ - Excitor: enrich VEX events with issuer hints, signatures, product trees, and now connector-supplied trust weights/tiers that Lens consumes directly.
- Policy Engine: trust knobs, simulation endpoints, policy-driven recompute.
- Vuln Explorer & Advisory AI: consensus badges, conflict surfacing.
- **Issuer Directory**
diff --git a/docs/reachability/DELIVERY_GUIDE.md b/docs/reachability/DELIVERY_GUIDE.md
index eb9d407cc..d336efd2a 100644
--- a/docs/reachability/DELIVERY_GUIDE.md
+++ b/docs/reachability/DELIVERY_GUIDE.md
@@ -2,7 +2,7 @@
_Last updated: November 8, 2025. Owner: Reachability Tiger Team (Scanner, Signals, Replay, Policy, Authority, UI)._
-This guide translates the deterministic reachability blueprint into concrete work streams that average contributors can pick up without re-reading the entire proposal. Use it as the single navigation point when you land a reachability ticket.
+This guide translates the deterministic reachability blueprint into concrete work streams that average contributors can pick up without re-reading the entire proposal. Use it as the single navigation point when you land a reachability ticket. For a task-centric view of remaining gaps, see `docs/reachability/REACHABILITY_GAP_TASKS.md`.
---
@@ -115,4 +115,3 @@ Each sprint is two weeks; refer to `docs/implplan/SPRINT_401_reachability_eviden
- **Decision log** – Append ADRs under `docs/adr/reachability-*` for schema changes.
Keep this guide updated whenever scope shifts or a new sprint is added.
-
diff --git a/docs/reachability/REACHABILITY_GAP_TASKS.md b/docs/reachability/REACHABILITY_GAP_TASKS.md
new file mode 100644
index 000000000..cb2647418
--- /dev/null
+++ b/docs/reachability/REACHABILITY_GAP_TASKS.md
@@ -0,0 +1,49 @@
+# Reachability Evidence – Gap Analysis & Task References
+
+_Last updated: 2025-11-09 (Business Analysis role)._
+_Scope:_ outline the missing functionality required to make binary-level reachability evidence first-class across Scanner, Signals, Policy, Replay, and VEX emission.
+
+## 1. Source Materials
+
+| Area | Reference |
+|------|-----------|
+| Architecture vision | `docs/reachability/DELIVERY_GUIDE.md`, `docs/modules/platform/architecture-overview.md:145` |
+| Active sprints | `docs/implplan/SPRINT_400_runtime_facts_static_callgraph_union.md`, `docs/implplan/SPRINT_401_reachability_evidence_chain.md` |
+| Current implementations | `src/Signals/StellaOps.Signals/Program.cs:214-287`, `src/Signals/StellaOps.Signals/Services/CallgraphIngestionService.cs`, `src/Signals/StellaOps.Signals/Services/ReachabilityScoringService.cs`, `src/Scanner/__Libraries/StellaOps.Scanner.Reachability`, `tests/reachability/*` |
+
+Use this document to break down outstanding work into actionable tasks and to keep documentation links synchronized.
+
+## 2. Current Snapshot (11 Nov 2025)
+
+1. **Callgraph ingestion exists** – Signals exposes `/signals/callgraphs` and stores graphs + CAS metadata (`Program.cs`, `CallgraphIngestionService`).
+2. **Reachability recompute API exists but is simplistic** – BFS scoring with static confidences, no lattice states, no CAS evidence linking.
+3. **Runtime ingestion is a stub** – `/signals/runtime-facts` returns HTTP 501.
+4. **Scanner Worker doesn’t emit canonical SymbolIDs/graphs** – `StellaOps.Scanner.Reachability` library exists, yet Worker binaries do not reference it.
+5. **Replay manifests record reachability via helpers** – `ReachabilityReplayWriter` can add graph/trace refs, but manifests don’t enforce CAS registration/hashing.
+6. **Policy/UI still consume coarse `reachability:*` tags** – no OpenVEX evidence blocks or graph hashes attached to statements/events.
+
+## 3. Gap Breakdown & Tasks
+
+Canonical sprint tracking for these tasks now lives in `docs/implplan/SPRINT_400_runtime_facts_static_callgraph_union.md` and `docs/implplan/SPRINT_401_reachability_evidence_chain.md`. Use the table below as a consolidated reference when planning cross-guild work.
+
+| Task ID | Module / Doc anchor | Description | Dependencies | Deliverables |
+|---------|--------------------|-------------|--------------|--------------|
+| GAP-SCAN-001 | `src/Scanner/StellaOps.Scanner.Worker`, `docs/modules/scanner/architecture.md` | Implement binary/language Symbolizers that emit `richgraph-v1` payloads with canonical `SymbolID = {file:hash, section, addr, name, linkage}`. Persist graphs to CAS and register them via `ReachabilityGraphBuilder`. | Sprint 400 `SCAN-REACH-201-002` | Analyzer services + config docs updated, sample graph fixtures, regression tests under `tests/reachability/StellaOps.ScannerSignals.IntegrationTests`. |
+| GAP-ZAS-002 | `src/Zastava/StellaOps.Zastava.Observer`, `docs/modules/zastava/architecture.md` | Stream runtime NDJSON batches with `SymbolID`, hit counts, CAS URIs to `/signals/runtime-facts`. Capture build-ids + entrypoint context per sprint spec. | Sprint 400 `ZASTAVA-REACH-201-001` | Observer implementation, operator runbook `docs/runbooks/reachability-runtime.md`, fixture updates. |
+| GAP-SIG-003 | `src/Signals/StellaOps.Signals/Program.cs`, `ReachabilityScoringService.cs`, `docs/reachability/DELIVERY_GUIDE.md#5.2` | Finish `/signals/runtime-facts`, introduce CAS-backed runtime storage, extend scoring to lattice states (`Unknown/NotPresent/Unreachable/Conditional/Reachable/Observed`) with per-path confidence accumulation. Emit `signals.fact.updated` events. | Sprint 401 `SIGNALS-RUNTIME-401-002`, `SIGNALS-SCORING-401-003` | API schema, Mongo indices, deterministic scoring tests (`tests/reachability/StellaOps.Signals.Reachability.Tests`). |
+| GAP-REP-004 | `src/__Libraries/StellaOps.Replay.Core`, `docs/replay/DETERMINISTIC_REPLAY.md` | Enforce CAS registration + BLAKE3 hashing for graphs/traces before manifest writes. Upgrade manifest schema v2 to include analyzer versions + policy thresholds. | Sprint 400 `REPLAY-REACH-201-005`, Sprint 401 `REPLAY-401-004` | Updated schema docs, fixture pack coverage (`tests/reachability/StellaOps.Replay.Core.Tests`). |
+| GAP-POL-005 | `src/Policy/StellaOps.Policy.Engine`, `docs/modules/policy/architecture.md` | Ingest Signals reachability facts, expose `reachability.state/confidence` in SPL, and generate OpenVEX evidence blocks referencing graph hashes + runtime facts. Implement policy threshold (e.g., affected if `max_path_conf ≥ 0.6`). | Sprint 401 `POLICY-VEX-401-006` | Updated policy schemas (`policy-scoring-schema@1.json`), OpenVEX templates, backend tests.
+| GAP-VEX-006 | `docs/modules/excititor/architecture.md`, `docs/modules/ui/architecture.md`, `docs/implplan/SPRINT_401_reachability_evidence_chain.md` | Wire VEX emission/UI surfaces: CLI/UI explain drawer with call-path visualization, DSSE evidence attachments, `--threshold` and `--evidence=graph` flags. | Sprint 401 `UI-CLI-401-007` | CLI documentation, UI walkthrough, Notify templates referencing reachability evidence. |
+
+## 4. Documentation Actions
+
+1. **Module dossiers** – Once each GAP task lands, update the matching module architecture doc to reflect binary reachability specifics (symbol schema, APIs, thresholds).
+2. **Runbooks** – Create `docs/runbooks/reachability-runtime.md` for operators (Zastava deployment, retention, troubleshooting) and extend `docs/runbooks/replay_ops.md` with reachability CAS sections.
+3. **API references** – Add `/signals/runtime-facts` and explain reachability fields to `docs/09_API_CLI_REFERENCE.md` and `docs/api/policy.md`.
+4. **Sample payloads** – Under `samples/`, add OpenVEX examples that include `facts.type = stella.reachability` with `graph_hash`, entrypoints, and analyzer versions.
+
+## 5. Next Steps for Business Analysis
+
+- Socialize this gap list with module owners; confirm task ownership aligns with the sprint trackers.
+- Link this document from `docs/reachability/DELIVERY_GUIDE.md` so engineers can reference the gap tasks quickly.
+- Revisit after Sprint 401 midpoint to mark completed tasks and add any newly discovered blockers.
diff --git a/docs/rfcs/authority-plugin-ldap.md b/docs/rfcs/authority-plugin-ldap.md
index c48924e3e..06d89be6b 100644
--- a/docs/rfcs/authority-plugin-ldap.md
+++ b/docs/rfcs/authority-plugin-ldap.md
@@ -44,7 +44,7 @@ Many on-prem StellaOps deployments rely on existing LDAP/Active Directory domain
2. **Connection factory**: pooled LDAP connections using a resilient client (preferred dependency: `Novell.Directory.Ldap.NETStandard`).
3. **Credential validator** (`IUserCredentialStore`): performs bind-as-user flow with optional fallback bind using service account when directories disallow anonymous search.
4. **Claims enricher** (`IClaimsEnricher`): queries group membership/attributes and projects them into canonical roles/claims.
-5. **Optional client provisioning** (`IClientProvisioningStore`): maintains machine/service principals either in Mongo (metadata) or via LDAP `serviceConnectionPoint` entries based on configuration.
+5. **Optional client provisioning / bootstrap** (`IClientProvisioningStore` + `IUserCredentialStore.UpsertUserAsync`): maintains machine/service principals either in Mongo (metadata) or via LDAP entries based on configuration. Capabilities are only advertised when the manifest requests them, configuration enables them, **and** the plug-in proves the bind identity can add/delete entries beneath the configured containers; otherwise the feature is automatically downgraded so read-only deployments remain safe.
6. **Health checks**: periodic LDAP `whoami` or `search` probes surfaced through `AuthorityPluginHealthResult`.
```
diff --git a/docs/security/crypto-routing-audit-2025-11-07.md b/docs/security/crypto-routing-audit-2025-11-07.md
index 2df708bdc..f4834c7ef 100644
--- a/docs/security/crypto-routing-audit-2025-11-07.md
+++ b/docs/security/crypto-routing-audit-2025-11-07.md
@@ -34,12 +34,14 @@ StellaOps:
Registry:
PreferredProviders:
- default
+ - ru.openssl.gost
- ru.pkcs11
ActiveProfile: ru-offline
Profiles:
ru-offline:
PreferredProviders:
- ru.cryptopro.csp
+ - ru.openssl.gost
- ru.pkcs11
Pkcs11:
Keys:
@@ -53,10 +55,27 @@ StellaOps:
- KeyId: ru-csp-token
ProviderName: "Crypto-Pro GOST R 34.10-2012 Cryptographic Service Provider"
CertificateThumbprint: ""
- CertificateStoreLocation: LocalMachine
- CertificateStoreName: My
+ OpenSsl:
+ Keys:
+ - KeyId: ru-openssl-token
+ PrivateKeyPath: /etc/stellaops/keys/ru-openssl.pem
+ PrivateKeyPassphraseEnvVar: RU_OPENSSL_PASS
+ SignatureFormat: Der
```
+Windows hosts still prefer `ru.cryptopro.csp`, but Linux deployments automatically fall back to the new `ru.openssl.gost` provider (BouncyCastle/OpenSSL-backed) so sovereign GOST signing works without CryptoPro.
+
+#### CLI quick check
+
+Use the diagnostics CLI to inspect providers or produce test signatures without editing service hosts:
+
+```bash
+dotnet run --project src/Tools/StellaOps.CryptoRu.Cli -- providers --config etc/rootpack/ru/crypto.profile.yaml --profile ru-offline
+dotnet run --project src/Tools/StellaOps.CryptoRu.Cli -- sign --config etc/rootpack/ru/crypto.profile.yaml --key-id ru-openssl-token --alg GOST12-256 --file samples/message.bin --format base64
+```
+
+The CLI accepts JSON or YAML configs, applies registry profile overrides, and prints the resolved provider name (for example, `ru.cryptopro.csp` on Windows and `ru.openssl.gost` on Linux).
+
Call `builder.Services.AddStellaOpsCryptoRu(builder.Configuration)` to bind this configuration and register the RU providers with the correct preferred order.
Each deployment picks a profile (`activeProfile`) that resolves to a deterministic provider order, and individual services call into `ICryptoProviderRegistry` rather than new-ing crypto stacks directly.
@@ -65,10 +84,8 @@ Each deployment picks a profile (`activeProfile`) that resolves to a determinist
Even after the initial plug-ins landed, several sovereign-crypto deliverables remain outstanding. These items must be addressed before RootPack_RU can be treated as GA:
-1. **CryptoPro CSP integration** – `StellaOps.Cryptography.Plugin.CryptoPro` currently reuses the PKCS#11 core and never talks to CryptoPro CSP / GostCryptography. Replace it with a real CSP-backed signer, including certificate-store lookup and DER/raw normalization.
-2. **Ops CLI** – The promised `StellaOps.CryptoRu.Cli` (list keys, try-sign, emit determinism records) has not been implemented; operators are blind when staging PKCS#11/CryptoPro keys.
-3. **Integration tests** – There are zero CryptoPro/PKCS#11 tests in `src/__Libraries/__Tests/StellaOps.Cryptography.Tests/`. The RootPack validation script cannot validate hardware paths today.
-4. **Symmetric GOST** – Magma/Kuznyechik (RFC 5830 / RFC 7801) support is missing, so RU deployments cannot request sovereign symmetric encryption for exports/data-at-rest.
+1. **Integration tests** – There are zero CryptoPro/PKCS#11 tests in `src/__Libraries/__Tests/StellaOps.Cryptography.Tests/`. The RootPack validation script cannot validate hardware paths today.
+2. **Symmetric GOST** – Magma/Kuznyechik (RFC 5830 / RFC 7801) support is missing, so RU deployments cannot request sovereign symmetric encryption for exports/data-at-rest.
5. **Host adoption** – Authority, Scanner, Concelier, etc. register only the default providers; none call the RU DI helpers or set `ActiveProfile = ru-offline`, leaving sovereign bundles inert.
6. **Docs/runbooks** – RootPack docs reference the CLI/config/test harnesses, but they do not yet exist; we need explicit TODOs (see rootpack docs) and follow-up edits once tooling ships.
diff --git a/docs/security/pack-signing-and-rbac.md b/docs/security/pack-signing-and-rbac.md
index 3ced9f83e..3db1447ad 100644
--- a/docs/security/pack-signing-and-rbac.md
+++ b/docs/security/pack-signing-and-rbac.md
@@ -73,12 +73,13 @@ Roles are tenant-scoped; cross-tenant access requires explicit addition.
- `stella pack push` → `packs.write`.
- `stella pack approve` → `packs.approve`.
- Offline tokens must include same scopes; CLI warns if missing.
+- Approval flows must also pass `pack_run_id`, `pack_gate_id`, and `pack_plan_hash` when requesting `packs.approve`. The CLI exposes these via `stella pack approve --pack-run-id ... --pack-gate-id ... --pack-plan-hash ...` (see `docs/task-packs/runbook.md#4-approvals-workflow` for the full procedure). Authority rejects approval grants that omit or truncate any of these fields and tags the audit record with `pack.*` metadata for replay audits.
---
## 4 · Approvals & Fresh Auth
-- Approval commands require recent fresh-auth (< 5 minutes). CLI prompts automatically; Console enforces via Authority.
+- Approval commands require recent fresh-auth (< 5 minutes). CLI prompts automatically; Console enforces via Authority. When the `packs.approve` scope is present, `/token` demands `pack_run_id`, `pack_gate_id`, and `pack_plan_hash`, and the resource-layer scope handler verifies the metadata is present plus the `auth_time` timestamp falls within the five-minute window. Missing metadata or stale authentication produce `authority.pack_scope_violation` audit events with the offending field noted.
- Approval payload includes:
- `runId`
- `gateId`
diff --git a/docs/security/rootpack_ru_package.md b/docs/security/rootpack_ru_package.md
index 7d3269fc0..8a2e12ed8 100644
--- a/docs/security/rootpack_ru_package.md
+++ b/docs/security/rootpack_ru_package.md
@@ -6,7 +6,7 @@ This guide describes the reproducible process for assembling the sovereign crypt
| Directory | Purpose |
|-----------|---------|
-| `artifacts/` | Published binaries for `StellaOps.Cryptography.Plugin.CryptoPro` and `StellaOps.Cryptography.Plugin.Pkcs11Gost` (targeting `net10.0`). |
+| `artifacts/` | Published binaries for `StellaOps.Cryptography.Plugin.CryptoPro`, `StellaOps.Cryptography.Plugin.OpenSslGost`, and `StellaOps.Cryptography.Plugin.Pkcs11Gost` (targeting `net10.0`). |
| `config/rootpack_ru.crypto.yaml` | Opinionated configuration template that enables the `ru-offline` crypto profile and defines CryptoPro + PKCS#11 keys. |
| `docs/` | Validation runbook, audit report, and this packaging guide. |
| `trust/` | Russian trust-anchor PEM files copied from `certificates/russian_trusted_*`. |
@@ -29,6 +29,8 @@ The script performs the following steps:
4. Adds the Russian trust anchors from `certificates/russian_trusted_*`.
5. Emits `README.txt` and optionally creates a `*.tar.gz` archive (set `PACKAGE_TAR=0` to skip the tarball).
+> **Temporary quarantine (2025-11-09).** To keep day-to-day builds free of the vulnerable GostCryptography dependency, the repository disables the CryptoPro plug-in unless you pass `-p:StellaOpsEnableCryptoPro=true`. RootPack packaging still works because this script publishes the plug-in directly, but any host/service build that needs CryptoPro must opt in with that MSBuild property until the patched package lands.
+
## 3. Attach deterministic test evidence
After running `scripts/crypto/package-rootpack-ru.sh`, execute the deterministic harness to capture logs:
@@ -65,13 +67,24 @@ Store these artifacts under `logs/rootpack_ru_/` (same directory as t
1. Import the bundled trust anchors into the target installation (Authority + Scanner).
2. Apply `config/rootpack_ru.crypto.yaml`, update certificate thumbprints, slots, and container labels to match the operator tokens.
3. Restart the services so `ICryptoProviderRegistry` reloads the `ru-offline` profile.
+ - Windows nodes will prioritize `ru.cryptopro.csp`; Linux nodes automatically fall back to `ru.openssl.gost` (PEM/private-key based) before consulting `ru.pkcs11`.
+
+### 5.1 Diagnostics CLI
+
+Use the diagnostics CLI to validate configs before rolling out changes:
+
+```bash
+dotnet run --project src/Tools/StellaOps.CryptoRu.Cli -- providers --config etc/rootpack/ru/crypto.profile.yaml --profile ru-offline
+dotnet run --project src/Tools/StellaOps.CryptoRu.Cli -- sign --config etc/rootpack/ru/crypto.profile.yaml --key-id ru-openssl-default --alg GOST12-256 --file samples/message.bin --format base64
+```
+
+Ship the CLI binary inside the RootPack so operators in sealed environments can run the same diagnostics offline.
4. Re-run the validation runbook to confirm JWKS, telemetry, and RootPack evidence are aligned with the shipping bundle.
## Known gaps (2025-11-09)
The bundle and scripts above assume several pieces of functionality that have not landed yet:
-- **Ops CLI:** The CLI referenced in the validation runbook (list/verify keys, emit determinism records) has not been implemented. Operators currently rely on manual pkcs11-tool / certmgr commands.
- **Integration tests:** `scripts/crypto/run-rootpack-ru-tests.sh` exercises only SHA/Ed25519 paths because CryptoPro/PKCS#11 integration tests are still TODO.
- **Symmetric GOST:** RootPack artifacts ship only signing plug-ins; Magma/Kuznyechik support for exports/data-at-rest is pending.
diff --git a/docs/security/rootpack_ru_validation.md b/docs/security/rootpack_ru_validation.md
index 36c0d81e5..269f17614 100644
--- a/docs/security/rootpack_ru_validation.md
+++ b/docs/security/rootpack_ru_validation.md
@@ -2,7 +2,7 @@
## Purpose
-This runbook documents the repeatable steps for validating the Russian sovereign crypto profile (CryptoPro + PKCS#11) prior to publishing a RootPack bundle. It supplements the crypto routing audit by covering deterministic tests, hardware validation, and the audit metadata artifacts that must be attached to each release.
+This runbook documents the repeatable steps for validating the Russian sovereign crypto profile (CryptoPro on Windows, OpenSSL/Bouncy-managed on Linux, plus PKCS#11) prior to publishing a RootPack bundle. It supplements the crypto routing audit by covering deterministic tests, hardware validation, and the audit metadata artifacts that must be attached to each release.
## 1. Deterministic Test Harness
@@ -20,14 +20,20 @@ This runbook documents the repeatable steps for validating the Russian sovereign
1. Install CryptoPro CSP (v5.0 or later) on the validation host and import the qualified certificate configured for the deployment.
2. Configure `StellaOps:Crypto:CryptoPro:Keys` with the container handle and certificate thumbprint and set `StellaOps:Crypto:Registry:ActiveProfile=ru-offline`.
3. Run the provider diagnostics to confirm the key material is visible:
- - `stellaops crypto providers --profile ru-offline --json > logs/ru_cryptopro_providers.json`
+ - `dotnet run --project src/Tools/StellaOps.CryptoRu.Cli -- providers --config etc/rootpack/ru/crypto.profile.yaml --profile ru-offline --json > logs/ru_cryptopro_providers.json`
4. Issue a JWKS fetch (`curl https://authority.local/.well-known/jwks`) and verify the `kid` and `crv` values match the CryptoPro-backed key.
5. Capture the Authority logs showing `AuthoritySecretHasherInitializer` startup and the `CryptoProviderMetrics` counters for `ru.cryptopro.csp` usage.
+### 2.1 Hardware Validation (OpenSSL/Bouncy Linux path)
+
+1. Install OpenSSL with the `gost` engine (or vendor equivalent) on the validation host and import the PEM key/cert that will back `StellaOps:Crypto:OpenSsl:Keys`.
+2. Configure the `OpenSsl` section (PEM path plus `PrivateKeyPassphraseEnvVar`), keep `StellaOps:Crypto:Registry:ActiveProfile=ru-offline`, and restart the services.
+3. Execute a signing workflow and confirm `CryptoProviderMetrics` records `ru.openssl.gost` activity. Linux nodes should no longer attempt to load `ru.cryptopro.csp`.
+
## 3. Hardware Validation (PKCS#11 Tokens)
1. Install the vendor PKCS#11 library (e.g., Rutoken `rtPKCS11ECP.dll` or JaCarta) and configure the slot/PIN inside `StellaOps:Crypto:Pkcs11:Keys`.
-2. Switch the registry profile to prioritize `ru.pkcs11` and rerun `stellaops crypto providers --profile ru-offline --json > logs/ru_pkcs11_providers.json`.
+2. Switch the registry profile to prioritize `ru.pkcs11` and rerun `dotnet run --project src/Tools/StellaOps.CryptoRu.Cli -- providers --config etc/rootpack/ru/crypto.profile.yaml --profile ru-offline --json > logs/ru_pkcs11_providers.json`.
3. Execute a signing workflow (Authority JWKS refresh or Scanner manifest publish) and confirm the `CryptoProviderMetrics` counters record `ru.pkcs11` activity.
4. Export the token audit logs (if available) and store them with the RootPack evidence bundle.
diff --git a/docs/task-packs/authoring-guide.md b/docs/task-packs/authoring-guide.md
index abf3833b4..949be4075 100644
--- a/docs/task-packs/authoring-guide.md
+++ b/docs/task-packs/authoring-guide.md
@@ -62,6 +62,7 @@ stella pack init --name sbom-remediation
### 3.4 Configure approvals
- Add `spec.approvals` entries for each required review.
+- Capture the metadata Authority enforces: `runId`, `gateId`, and `planHash` should be documented so approvers can pass them through `stella pack approve --pack-run-id/--pack-gate-id/--pack-plan-hash` (see `docs/task-packs/runbook.md#4-approvals-workflow`).
- Provide informative `reasonTemplate` with placeholders.
- Set `expiresAfter` to match operational policy (e.g., 4 h for security reviews).
- Document fallback contacts in `docs/runbook.md`.
@@ -205,4 +206,3 @@ Registry verifies signature, stores provenance, and updates index.
---
*Last updated: 2025-10-27 (Sprint 43).*
-
diff --git a/docs/task-packs/runbook.md b/docs/task-packs/runbook.md
index d56518205..9bf114ee6 100644
--- a/docs/task-packs/runbook.md
+++ b/docs/task-packs/runbook.md
@@ -69,6 +69,8 @@ stella pack approve \
--comment "Validated remediation scope; proceeding."
```
+- Metadata parameters are mandatory: `--pack-run-id`, `--pack-gate-id`, and `--pack-plan-hash` map 1:1 to the Authority token parameters (`pack_run_id`, `pack_gate_id`, `pack_plan_hash`). The CLI resolves sensible defaults from `stella pack plan`, but operators can override them explicitly for out-of-band runs. Authority `/token` rejects `packs.approve` requests missing any of these fields and records the failure in `authority.pack_scope_violation`. Keep this section (and `docs/security/pack-signing-and-rbac.md`) handy—the Authority team references it as the canonical procedure.
+
- Auto-expiry triggers run cancellation (configurable per gate).
- Approval events logged and included in evidence bundle.
@@ -159,4 +161,3 @@ Escalations must include run ID, tenant, pack version, plan hash, and timestamps
---
*Last updated: 2025-10-27 (Sprint 43).*
-
diff --git a/docs/task-packs/spec.md b/docs/task-packs/spec.md
index e6cc9b6df..3b3d947a0 100644
--- a/docs/task-packs/spec.md
+++ b/docs/task-packs/spec.md
@@ -131,7 +131,7 @@ spec:
| `metadata` | Human-facing metadata; used for registry listings and RBAC hints. | `name` (DNS-1123), `version` (SemVer), `description` ≤ 2048 chars. |
| `spec.inputs` | Declarative inputs validated at plan time. | Must include type; custom schema optional but recommended. |
| `spec.secrets` | Secrets requested at runtime; never stored in pack bundle. | Each secret references Authority scope; CLI prompts or injects from profiles. |
-| `spec.approvals` | Named approval gates with required grants and TTL. | ID unique per pack; `grants` map to Authority roles. |
+| `spec.approvals` | Named approval gates with required grants and TTL. | ID unique per pack; `grants` map to Authority roles. Approval metadata (`runId`, `gateId`, `planHash`) feeds Authority’s `pack_run_id`/`pack_gate_id`/`pack_plan_hash` parameters (see `docs/task-packs/runbook.md#4-approvals-workflow`). |
| `spec.steps` | Execution graph; each step is `run`, `gate`, `parallel`, or `map`. | Steps must declare deterministic `uses` module and `id`. |
| `spec.outputs` | Declared artifacts for downstream automation. | `type` can be `file`, `object`, or `url`; path/expression required. |
| `success` / `failure` | Messages + retry policy. | `failure.retries.maxAttempts` + `backoffSeconds` default to 0. |
@@ -246,4 +246,3 @@ CLI enforces compatibility: running pack with unsupported features yields `ERR_P
---
*Last updated: 2025-10-27 (Sprint 43).*
-
diff --git a/docs/vex/consensus-json.md b/docs/vex/consensus-json.md
index 9ddafbb32..5b537ad08 100644
--- a/docs/vex/consensus-json.md
+++ b/docs/vex/consensus-json.md
@@ -11,6 +11,18 @@
"status": "NOT_AFFECTED",
"justification": "component_not_present",
"weight": 0.62,
+ "trust": {
+ "tier": "distro",
+ "note": "tier=distro;weight=0.62",
+ "weight": 0.62,
+ "cosign": {
+ "issuer": "https://issuer.redhat.com",
+ "identityPattern": "spiffe://redhat/vex/*"
+ },
+ "pgpFingerprints": [
+ "04F2C0A87B1D9E90B1D8A35DCEB5ABCD12345678"
+ ]
+ },
"lastObserved": "2025-11-04T18:22:31Z",
"accepted": true,
"reason": "trust-tier vendor, signed OpenVEX"
@@ -20,6 +32,11 @@
"status": "AFFECTED",
"justification": null,
"weight": 0.27,
+ "trust": {
+ "tier": "community",
+ "note": "tier=community;weight=0.27",
+ "weight": 0.27
+ },
"lastObserved": "2025-11-05T01:12:03Z",
"accepted": false,
"reason": "lower trust tier and stale statement"
@@ -32,3 +49,4 @@
```
> **Note:** This payload is generated from the beta consensus endpoint and is subject to change prior to GA. Keys and semantics are documented alongside API previews in `docs/modules/excitor/README.md`.
+> **New:** `sources[].trust` mirrors the `vex.provenance.*` envelope emitted by Excititor connectors (provider weight/tier, cosign hints, PGP fingerprints). VEX Lens copies the raw metadata so Policy Engine, Console, and Advisory AI can explain consensus decisions without replaying ingestion.
diff --git a/etc/authority.plugins/ldap.yaml b/etc/authority.plugins/ldap.yaml
index 82fec56d8..097bf0204 100644
--- a/etc/authority.plugins/ldap.yaml
+++ b/etc/authority.plugins/ldap.yaml
@@ -64,6 +64,22 @@ clientProvisioning:
enabled: true
collectionName: "ldap_client_provisioning" # Mongo mirror ships inside the Offline Kit for auditors
+bootstrap:
+ enabled: false
+ containerDn: "ou=people,dc=example,dc=internal"
+ rdnAttribute: "uid"
+ usernameAttribute: "uid"
+ displayNameAttribute: "displayName"
+ givenNameAttribute: "givenName"
+ surnameAttribute: "sn"
+ emailAttribute: "mail"
+ secretAttribute: "userPassword"
+ staticAttributes:
+ description: "StellaOps bootstrap user for {username}"
+ auditMirror:
+ enabled: true
+ collectionName: "ldap_bootstrap_audit"
+
health:
probeIntervalSeconds: 60
timeoutSeconds: 5
diff --git a/etc/authority.yaml.sample b/etc/authority.yaml.sample
index b7887e616..5f1a857eb 100644
--- a/etc/authority.yaml.sample
+++ b/etc/authority.yaml.sample
@@ -328,6 +328,7 @@ clients:
grantTypes: [ "client_credentials" ]
audiences: [ "api://task-runner" ]
scopes: [ "packs.approve", "packs.read" ]
+ # Tokens minted with packs.approve must include pack_run_id, pack_gate_id, and pack_plan_hash parameters per docs/task-packs/runbook.md.
tenant: "tenant-default"
senderConstraint: "dpop"
auth:
diff --git a/etc/rootpack/ru/crypto.profile.yaml b/etc/rootpack/ru/crypto.profile.yaml
index f4b1c6db7..bf1d91a51 100644
--- a/etc/rootpack/ru/crypto.profile.yaml
+++ b/etc/rootpack/ru/crypto.profile.yaml
@@ -8,6 +8,7 @@ StellaOps:
ru-offline:
PreferredProviders:
- ru.cryptopro.csp
+ - ru.openssl.gost
- ru.pkcs11
CryptoPro:
Keys:
@@ -27,6 +28,14 @@ StellaOps:
Pin: "${PKCS11_PIN}"
PrivateKeyLabel: rootpack-signing
CertificateThumbprint: ""
+ OpenSsl:
+ Keys:
+ - KeyId: ru-openssl-default
+ Algorithm: GOST12-256
+ PrivateKeyPath: /opt/stellaops/keys/ru_openssl_priv.pem
+ PrivateKeyPassphraseEnvVar: RU_OPENSSL_PRIV_PASS
+ CertificatePath: /opt/stellaops/certs/ru_openssl_cert.pem
+ SignatureFormat: Der
Diagnostics:
Providers:
Enabled: true
diff --git a/head.tmp b/head.tmp
new file mode 100644
index 000000000..e69de29bb
diff --git a/src/AdvisoryAI/StellaOps.AdvisoryAI/TASKS.md b/src/AdvisoryAI/StellaOps.AdvisoryAI/TASKS.md
deleted file mode 100644
index 98102c5a9..000000000
--- a/src/AdvisoryAI/StellaOps.AdvisoryAI/TASKS.md
+++ /dev/null
@@ -1,8 +0,0 @@
-# Advisory AI Active Tasks — Sprint 111
-
-| ID | Status | Description | Last Update |
-|----|--------|-------------|-------------|
-| AIAI-31-008 | DONE (2025-11-08) | Package inference on-prem container, remote inference toggle, deployment manifests, and Offline Kit guidance. | Remote toggle + deployment docs merged during Sprint 110 close-out. |
-| AIAI-31-009 | DOING (2025-11-09) | Expand unit/property/perf tests, strengthen injection harness, and enforce deterministic caches. | Extending orchestrator + executor regression coverage and guardrail fixtures this sprint. |
-
-> Mirror statuses with `docs/implplan/SPRINT_111_advisoryai.md`. Update this table when starting, pausing, or finishing work.
diff --git a/src/AdvisoryAI/__Tests/StellaOps.AdvisoryAI.Tests/AdvisoryGuardrailInjectionTests.cs b/src/AdvisoryAI/__Tests/StellaOps.AdvisoryAI.Tests/AdvisoryGuardrailInjectionTests.cs
index 8712a1b92..184d92662 100644
--- a/src/AdvisoryAI/__Tests/StellaOps.AdvisoryAI.Tests/AdvisoryGuardrailInjectionTests.cs
+++ b/src/AdvisoryAI/__Tests/StellaOps.AdvisoryAI.Tests/AdvisoryGuardrailInjectionTests.cs
@@ -1,8 +1,12 @@
using System.Collections.Generic;
using System.Collections.Immutable;
+using System.Globalization;
using System.IO;
using System.Linq;
+using System.Text.Json;
+using System.Text.Json.Serialization;
using System.Threading;
+using System.Threading.Tasks;
using FluentAssertions;
using Microsoft.Extensions.Logging.Abstractions;
using Microsoft.Extensions.Options;
@@ -15,67 +19,118 @@ namespace StellaOps.AdvisoryAI.Tests;
public sealed class AdvisoryGuardrailInjectionTests
{
- public static IEnumerable