feat: Initialize Zastava Webhook service with TLS and Authority authentication

- Added Program.cs to set up the web application with Serilog for logging, health check endpoints, and a placeholder admission endpoint.
- Configured Kestrel server to use TLS 1.3 and handle client certificates appropriately.
- Created StellaOps.Zastava.Webhook.csproj with necessary dependencies including Serilog and Polly.
- Documented tasks in TASKS.md for the Zastava Webhook project, outlining current work and exit criteria for each task.

src/StellaOps.Attestor/AGENTS.md

@@ -0,0 +1,21 @@
+# Attestor Guild
+
+## Mission
+Operate the StellaOps Attestor service: accept signed DSSE envelopes from the Signer over mTLS, submit them to Rekor v2, persist inclusion proofs, and expose verification APIs for downstream services and operators.
+
+## Teams On Call
+- Team 11 (Attestor API)
+- Team 12 (Attestor Observability) — partners on logging, metrics, and alerting
+
+## Operating Principles
+- Enforce mTLS + Authority tokens for every submission; never accept anonymous callers.
+- Deterministic hashing, canonical JSON, and idempotent Rekor interactions (`bundleSha256` is the source of truth).
+- Persist everything (entries, dedupe, audit) before acknowledging; background jobs must be resumable.
+- Structured logs + metrics for each stage (`validate`, `submit`, `proof`, `persist`, `archive`).
+- Update `TASKS.md`, architecture docs, and tests whenever behaviour changes.
+
+## Key Directories
+- `src/StellaOps.Attestor/StellaOps.Attestor.WebService/` — Minimal API host and HTTP surface.
+- `src/StellaOps.Attestor/StellaOps.Attestor.Core/` — Domain contracts, submission/verification pipelines.
+- `src/StellaOps.Attestor/StellaOps.Attestor.Infrastructure/` — Mongo, Redis, Rekor, and archival implementations.
+- `src/StellaOps.Attestor/StellaOps.Attestor.Tests/` — Unit and integration tests.

src/StellaOps.Attestor/StellaOps.Attestor.Core/Audit/AttestorAuditRecord.cs

@@ -0,0 +1,42 @@
+using System;
+using System.Collections.Generic;
+
+namespace StellaOps.Attestor.Core.Audit;
+
+public sealed class AttestorAuditRecord
+{
+    public string Action { get; init; } = string.Empty;
+
+    public string Result { get; init; } = string.Empty;
+
+    public string? RekorUuid { get; init; }
+
+    public long? Index { get; init; }
+
+    public string ArtifactSha256 { get; init; } = string.Empty;
+
+    public string BundleSha256 { get; init; } = string.Empty;
+
+    public string Backend { get; init; } = string.Empty;
+
+    public long LatencyMs { get; init; }
+
+    public DateTimeOffset Timestamp { get; init; } = DateTimeOffset.UtcNow;
+
+    public CallerDescriptor Caller { get; init; } = new();
+
+    public IDictionary<string, string> Metadata { get; init; } = new Dictionary<string, string>();
+
+    public sealed class CallerDescriptor
+    {
+        public string? Subject { get; init; }
+
+        public string? Audience { get; init; }
+
+        public string? ClientId { get; init; }
+
+        public string? MtlsThumbprint { get; init; }
+
+        public string? Tenant { get; init; }
+    }
+}

src/StellaOps.Attestor/StellaOps.Attestor.Core/Observability/AttestorMetrics.cs

@@ -0,0 +1,45 @@
+using System.Diagnostics.Metrics;
+
+namespace StellaOps.Attestor.Core.Observability;
+
+public sealed class AttestorMetrics : IDisposable
+{
+    public const string MeterName = "StellaOps.Attestor";
+
+    private readonly Meter _meter;
+    private bool _disposed;
+
+    public AttestorMetrics()
+    {
+        _meter = new Meter(MeterName);
+        SubmitTotal = _meter.CreateCounter<long>("attestor.submit_total", description: "Total submission attempts grouped by result and backend.");
+        SubmitLatency = _meter.CreateHistogram<double>("attestor.submit_latency_seconds", unit: "s", description: "Submission latency in seconds per backend.");
+        ProofFetchTotal = _meter.CreateCounter<long>("attestor.proof_fetch_total", description: "Proof fetch attempts grouped by result.");
+        VerifyTotal = _meter.CreateCounter<long>("attestor.verify_total", description: "Verification attempts grouped by result.");
+        DedupeHitsTotal = _meter.CreateCounter<long>("attestor.dedupe_hits_total", description: "Number of dedupe hits by outcome.");
+        ErrorTotal = _meter.CreateCounter<long>("attestor.errors_total", description: "Total errors grouped by type.");
+    }
+
+    public Counter<long> SubmitTotal { get; }
+
+    public Histogram<double> SubmitLatency { get; }
+
+    public Counter<long> ProofFetchTotal { get; }
+
+    public Counter<long> VerifyTotal { get; }
+
+    public Counter<long> DedupeHitsTotal { get; }
+
+    public Counter<long> ErrorTotal { get; }
+
+    public void Dispose()
+    {
+        if (_disposed)
+        {
+            return;
+        }
+
+        _meter.Dispose();
+        _disposed = true;
+    }
+}

src/StellaOps.Attestor/StellaOps.Attestor.Core/Options/AttestorOptions.cs

@@ -0,0 +1,144 @@
+using System.Collections.Generic;
+
+namespace StellaOps.Attestor.Core.Options;
+
+/// <summary>
+/// Strongly typed configuration for the Attestor service.
+/// </summary>
+public sealed class AttestorOptions
+{
+    public string Listen { get; set; } = "https://0.0.0.0:8444";
+
+    public SecurityOptions Security { get; set; } = new();
+
+    public RekorOptions Rekor { get; set; } = new();
+
+    public MongoOptions Mongo { get; set; } = new();
+
+    public RedisOptions Redis { get; set; } = new();
+
+    public S3Options S3 { get; set; } = new();
+
+    public QuotaOptions Quotas { get; set; } = new();
+
+    public TelemetryOptions Telemetry { get; set; } = new();
+
+    public sealed class SecurityOptions
+    {
+        public MtlsOptions Mtls { get; set; } = new();
+
+        public AuthorityOptions Authority { get; set; } = new();
+
+        public SignerIdentityOptions SignerIdentity { get; set; } = new();
+    }
+
+    public sealed class MtlsOptions
+    {
+        public bool RequireClientCertificate { get; set; } = true;
+
+        public string? CaBundle { get; set; }
+    }
+
+    public sealed class AuthorityOptions
+    {
+        public string? Issuer { get; set; }
+
+        public string? JwksUrl { get; set; }
+
+        public string? RequireSenderConstraint { get; set; }
+
+        public bool RequireHttpsMetadata { get; set; } = true;
+
+        public IList<string> Audiences { get; set; } = new List<string>();
+
+        public IList<string> RequiredScopes { get; set; } = new List<string>();
+    }
+
+    public sealed class SignerIdentityOptions
+    {
+        public IList<string> Mode { get; set; } = new List<string> { "keyless", "kms" };
+
+        public IList<string> FulcioRoots { get; set; } = new List<string>();
+
+        public IList<string> AllowedSans { get; set; } = new List<string>();
+
+        public IList<string> KmsKeys { get; set; } = new List<string>();
+    }
+
+    public sealed class RekorOptions
+    {
+        public RekorBackendOptions Primary { get; set; } = new();
+
+        public RekorMirrorOptions Mirror { get; set; } = new();
+    }
+
+    public class RekorBackendOptions
+    {
+        public string? Url { get; set; }
+
+        public int ProofTimeoutMs { get; set; } = 15_000;
+
+        public int PollIntervalMs { get; set; } = 250;
+
+        public int MaxAttempts { get; set; } = 60;
+    }
+
+    public sealed class RekorMirrorOptions : RekorBackendOptions
+    {
+        public bool Enabled { get; set; }
+    }
+
+    public sealed class MongoOptions
+    {
+        public string? Uri { get; set; }
+
+        public string Database { get; set; } = "attestor";
+
+        public string EntriesCollection { get; set; } = "entries";
+
+        public string DedupeCollection { get; set; } = "dedupe";
+
+        public string AuditCollection { get; set; } = "audit";
+    }
+
+    public sealed class RedisOptions
+    {
+        public string? Url { get; set; }
+
+        public string? DedupePrefix { get; set; } = "attestor:dedupe:";
+    }
+
+    public sealed class S3Options
+    {
+        public bool Enabled { get; set; }
+
+        public string? Endpoint { get; set; }
+
+        public string? Bucket { get; set; }
+
+        public string? Prefix { get; set; }
+
+        public string? ObjectLockMode { get; set; }
+
+        public bool UseTls { get; set; } = true;
+    }
+
+    public sealed class QuotaOptions
+    {
+        public PerCallerQuotaOptions PerCaller { get; set; } = new();
+    }
+
+    public sealed class PerCallerQuotaOptions
+    {
+        public int Qps { get; set; } = 50;
+
+        public int Burst { get; set; } = 100;
+    }
+
+    public sealed class TelemetryOptions
+    {
+        public bool EnableLogging { get; set; } = true;
+
+        public bool EnableTracing { get; set; } = false;
+    }
+}

src/StellaOps.Attestor/StellaOps.Attestor.Core/Rekor/IRekorClient.cs

@@ -0,0 +1,18 @@
+using System.Threading;
+using System.Threading.Tasks;
+using StellaOps.Attestor.Core.Submission;
+
+namespace StellaOps.Attestor.Core.Rekor;
+
+public interface IRekorClient
+{
+    Task<RekorSubmissionResponse> SubmitAsync(
+        AttestorSubmissionRequest request,
+        RekorBackend backend,
+        CancellationToken cancellationToken = default);
+
+    Task<RekorProofResponse?> GetProofAsync(
+        string rekorUuid,
+        RekorBackend backend,
+        CancellationToken cancellationToken = default);
+}

src/StellaOps.Attestor/StellaOps.Attestor.Core/Rekor/RekorBackend.cs

@@ -0,0 +1,16 @@
+using System;
+
+namespace StellaOps.Attestor.Core.Rekor;
+
+public sealed class RekorBackend
+{
+    public required string Name { get; init; }
+
+    public required Uri Url { get; init; }
+
+    public TimeSpan ProofTimeout { get; init; } = TimeSpan.FromSeconds(15);
+
+    public TimeSpan PollInterval { get; init; } = TimeSpan.FromMilliseconds(250);
+
+    public int MaxAttempts { get; init; } = 60;
+}

src/StellaOps.Attestor/StellaOps.Attestor.Core/Rekor/RekorProofResponse.cs

@@ -0,0 +1,38 @@
+using System;
+using System.Collections.Generic;
+using System.Text.Json.Serialization;
+
+namespace StellaOps.Attestor.Core.Rekor;
+
+public sealed class RekorProofResponse
+{
+    [JsonPropertyName("checkpoint")]
+    public RekorCheckpoint? Checkpoint { get; set; }
+
+    [JsonPropertyName("inclusion")]
+    public RekorInclusionProof? Inclusion { get; set; }
+
+    public sealed class RekorCheckpoint
+    {
+        [JsonPropertyName("origin")]
+        public string? Origin { get; set; }
+
+        [JsonPropertyName("size")]
+        public long Size { get; set; }
+
+        [JsonPropertyName("rootHash")]
+        public string? RootHash { get; set; }
+
+        [JsonPropertyName("timestamp")]
+        public DateTimeOffset? Timestamp { get; set; }
+    }
+
+    public sealed class RekorInclusionProof
+    {
+        [JsonPropertyName("leafHash")]
+        public string? LeafHash { get; set; }
+
+        [JsonPropertyName("path")]
+        public IReadOnlyList<string> Path { get; set; } = Array.Empty<string>();
+    }
+}

src/StellaOps.Attestor/StellaOps.Attestor.Core/Rekor/RekorSubmissionResponse.cs

@@ -0,0 +1,21 @@
+using System.Text.Json.Serialization;
+
+namespace StellaOps.Attestor.Core.Rekor;
+
+public sealed class RekorSubmissionResponse
+{
+    [JsonPropertyName("uuid")]
+    public string Uuid { get; set; } = string.Empty;
+
+    [JsonPropertyName("index")]
+    public long? Index { get; set; }
+
+    [JsonPropertyName("logURL")]
+    public string? LogUrl { get; set; }
+
+    [JsonPropertyName("status")]
+    public string Status { get; set; } = "included";
+
+    [JsonPropertyName("proof")]
+    public RekorProofResponse? Proof { get; set; }
+}

src/StellaOps.Attestor/StellaOps.Attestor.Core/StellaOps.Attestor.Core.csproj

@@ -0,0 +1,9 @@
+<Project Sdk="Microsoft.NET.Sdk">
+  <PropertyGroup>
+    <TargetFramework>net10.0</TargetFramework>
+    <LangVersion>preview</LangVersion>
+    <Nullable>enable</Nullable>
+    <ImplicitUsings>enable</ImplicitUsings>
+    <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
+  </PropertyGroup>
+</Project>

src/StellaOps.Attestor/StellaOps.Attestor.Core/Storage/AttestorArchiveBundle.cs

@@ -0,0 +1,19 @@
+using System;
+using System.Collections.Generic;
+
+namespace StellaOps.Attestor.Core.Storage;
+
+public sealed class AttestorArchiveBundle
+{
+    public string RekorUuid { get; init; } = string.Empty;
+
+    public string ArtifactSha256 { get; init; } = string.Empty;
+
+    public string BundleSha256 { get; init; } = string.Empty;
+
+    public byte[] CanonicalBundleJson { get; init; } = Array.Empty<byte>();
+
+    public byte[] ProofJson { get; init; } = Array.Empty<byte>();
+
+    public IReadOnlyDictionary<string, string> Metadata { get; init; } = new Dictionary<string, string>();
+}

src/StellaOps.Attestor/StellaOps.Attestor.Core/Storage/AttestorEntry.cs

@@ -0,0 +1,82 @@
+using System;
+using System.Collections.Generic;
+
+namespace StellaOps.Attestor.Core.Storage;
+
+/// <summary>
+/// Canonical representation of a Rekor entry persisted in Mongo.
+/// </summary>
+public sealed class AttestorEntry
+{
+    public string RekorUuid { get; init; } = string.Empty;
+
+    public ArtifactDescriptor Artifact { get; init; } = new();
+
+    public string BundleSha256 { get; init; } = string.Empty;
+
+    public long? Index { get; init; }
+
+    public ProofDescriptor? Proof { get; init; }
+
+    public LogDescriptor Log { get; init; } = new();
+
+    public DateTimeOffset CreatedAt { get; init; }
+
+    public string Status { get; init; } = "pending";
+
+    public SignerIdentityDescriptor SignerIdentity { get; init; } = new();
+
+    public sealed class ArtifactDescriptor
+    {
+        public string Sha256 { get; init; } = string.Empty;
+
+        public string Kind { get; init; } = string.Empty;
+
+        public string? ImageDigest { get; init; }
+
+        public string? SubjectUri { get; init; }
+    }
+
+    public sealed class ProofDescriptor
+    {
+        public CheckpointDescriptor? Checkpoint { get; init; }
+
+        public InclusionDescriptor? Inclusion { get; init; }
+    }
+
+    public sealed class CheckpointDescriptor
+    {
+        public string? Origin { get; init; }
+
+        public long Size { get; init; }
+
+        public string? RootHash { get; init; }
+
+        public DateTimeOffset? Timestamp { get; init; }
+    }
+
+    public sealed class InclusionDescriptor
+    {
+        public string? LeafHash { get; init; }
+
+        public IReadOnlyList<string> Path { get; init; } = Array.Empty<string>();
+    }
+
+    public sealed class LogDescriptor
+    {
+        public string Url { get; init; } = string.Empty;
+
+        public string? LogId { get; init; }
+    }
+
+    public sealed class SignerIdentityDescriptor
+    {
+        public string Mode { get; init; } = string.Empty;
+
+        public string? Issuer { get; init; }
+
+        public string? SubjectAlternativeName { get; init; }
+
+        public string? KeyId { get; init; }
+    }
+}

src/StellaOps.Attestor/StellaOps.Attestor.Core/Storage/IAttestorArchiveStore.cs

@@ -0,0 +1,9 @@
+using System.Threading;
+using System.Threading.Tasks;
+
+namespace StellaOps.Attestor.Core.Storage;
+
+public interface IAttestorArchiveStore
+{
+    Task ArchiveBundleAsync(AttestorArchiveBundle bundle, CancellationToken cancellationToken = default);
+}

src/StellaOps.Attestor/StellaOps.Attestor.Core/Storage/IAttestorAuditSink.cs

@@ -0,0 +1,10 @@
+using StellaOps.Attestor.Core.Audit;
+using System.Threading;
+using System.Threading.Tasks;
+
+namespace StellaOps.Attestor.Core.Storage;
+
+public interface IAttestorAuditSink
+{
+    Task WriteAsync(AttestorAuditRecord record, CancellationToken cancellationToken = default);
+}

src/StellaOps.Attestor/StellaOps.Attestor.Core/Storage/IAttestorDedupeStore.cs

@@ -0,0 +1,12 @@
+using System;
+using System.Threading;
+using System.Threading.Tasks;
+
+namespace StellaOps.Attestor.Core.Storage;
+
+public interface IAttestorDedupeStore
+{
+    Task<string?> TryGetExistingAsync(string bundleSha256, CancellationToken cancellationToken = default);
+
+    Task SetAsync(string bundleSha256, string rekorUuid, TimeSpan ttl, CancellationToken cancellationToken = default);
+}

src/StellaOps.Attestor/StellaOps.Attestor.Core/Storage/IAttestorEntryRepository.cs

@@ -0,0 +1,16 @@
+using System.Collections.Generic;
+using System.Threading;
+using System.Threading.Tasks;
+
+namespace StellaOps.Attestor.Core.Storage;
+
+public interface IAttestorEntryRepository
+{
+    Task<AttestorEntry?> GetByBundleShaAsync(string bundleSha256, CancellationToken cancellationToken = default);
+
+    Task<AttestorEntry?> GetByUuidAsync(string rekorUuid, CancellationToken cancellationToken = default);
+
+    Task<IReadOnlyList<AttestorEntry>> GetByArtifactShaAsync(string artifactSha256, CancellationToken cancellationToken = default);
+
+    Task SaveAsync(AttestorEntry entry, CancellationToken cancellationToken = default);
+}

src/StellaOps.Attestor/StellaOps.Attestor.Core/Submission/AttestorSubmissionRequest.cs

@@ -0,0 +1,79 @@
+using System.Collections.Generic;
+using System.Text.Json.Serialization;
+
+namespace StellaOps.Attestor.Core.Submission;
+
+/// <summary>
+/// Incoming submission payload for <c>/api/v1/rekor/entries</c>.
+/// </summary>
+public sealed class AttestorSubmissionRequest
+{
+    [JsonPropertyName("bundle")]
+    public SubmissionBundle Bundle { get; set; } = new();
+
+    [JsonPropertyName("meta")]
+    public SubmissionMeta Meta { get; set; } = new();
+
+    public sealed class SubmissionBundle
+    {
+        [JsonPropertyName("dsse")]
+        public DsseEnvelope Dsse { get; set; } = new();
+
+        [JsonPropertyName("certificateChain")]
+        public IList<string> CertificateChain { get; set; } = new List<string>();
+
+        [JsonPropertyName("mode")]
+        public string Mode { get; set; } = "keyless";
+    }
+
+    public sealed class DsseEnvelope
+    {
+        [JsonPropertyName("payloadType")]
+        public string PayloadType { get; set; } = string.Empty;
+
+        [JsonPropertyName("payload")]
+        public string PayloadBase64 { get; set; } = string.Empty;
+
+        [JsonPropertyName("signatures")]
+        public IList<DsseSignature> Signatures { get; set; } = new List<DsseSignature>();
+    }
+
+    public sealed class DsseSignature
+    {
+        [JsonPropertyName("keyid")]
+        public string? KeyId { get; set; }
+
+        [JsonPropertyName("sig")]
+        public string Signature { get; set; } = string.Empty;
+    }
+
+    public sealed class SubmissionMeta
+    {
+        [JsonPropertyName("artifact")]
+        public ArtifactInfo Artifact { get; set; } = new();
+
+        [JsonPropertyName("bundleSha256")]
+        public string BundleSha256 { get; set; } = string.Empty;
+
+        [JsonPropertyName("logPreference")]
+        public string LogPreference { get; set; } = "primary";
+
+        [JsonPropertyName("archive")]
+        public bool Archive { get; set; } = true;
+    }
+
+    public sealed class ArtifactInfo
+    {
+        [JsonPropertyName("sha256")]
+        public string Sha256 { get; set; } = string.Empty;
+
+        [JsonPropertyName("kind")]
+        public string Kind { get; set; } = string.Empty;
+
+        [JsonPropertyName("imageDigest")]
+        public string? ImageDigest { get; set; }
+
+        [JsonPropertyName("subjectUri")]
+        public string? SubjectUri { get; set; }
+    }
+}

src/StellaOps.Attestor/StellaOps.Attestor.Core/Submission/AttestorSubmissionResult.cs

@@ -0,0 +1,59 @@
+using System;
+using System.Collections.Generic;
+using System.Text.Json.Serialization;
+
+namespace StellaOps.Attestor.Core.Submission;
+
+/// <summary>
+/// Result returned to callers after processing a submission.
+/// </summary>
+public sealed class AttestorSubmissionResult
+{
+    [JsonPropertyName("uuid")]
+    public string? Uuid { get; set; }
+
+    [JsonPropertyName("index")]
+    public long? Index { get; set; }
+
+    [JsonPropertyName("proof")]
+    public RekorProof? Proof { get; set; }
+
+    [JsonPropertyName("logURL")]
+    public string? LogUrl { get; set; }
+
+    [JsonPropertyName("status")]
+    public string Status { get; set; } = "pending";
+
+    public sealed class RekorProof
+    {
+        [JsonPropertyName("checkpoint")]
+        public Checkpoint? Checkpoint { get; set; }
+
+        [JsonPropertyName("inclusion")]
+        public InclusionProof? Inclusion { get; set; }
+    }
+
+    public sealed class Checkpoint
+    {
+        [JsonPropertyName("origin")]
+        public string? Origin { get; set; }
+
+        [JsonPropertyName("size")]
+        public long Size { get; set; }
+
+        [JsonPropertyName("rootHash")]
+        public string? RootHash { get; set; }
+
+        [JsonPropertyName("timestamp")]
+        public string? Timestamp { get; set; }
+    }
+
+    public sealed class InclusionProof
+    {
+        [JsonPropertyName("leafHash")]
+        public string? LeafHash { get; set; }
+
+        [JsonPropertyName("path")]
+        public IReadOnlyList<string> Path { get; init; } = Array.Empty<string>();
+    }
+}

src/StellaOps.Attestor/StellaOps.Attestor.Core/Submission/AttestorSubmissionValidationResult.cs

@@ -0,0 +1,11 @@
+namespace StellaOps.Attestor.Core.Submission;
+
+public sealed class AttestorSubmissionValidationResult
+{
+    public AttestorSubmissionValidationResult(byte[] canonicalBundle)
+    {
+        CanonicalBundle = canonicalBundle;
+    }
+
+    public byte[] CanonicalBundle { get; }
+}

src/StellaOps.Attestor/StellaOps.Attestor.Core/Submission/AttestorSubmissionValidator.cs

@@ -0,0 +1,167 @@
+using System;
+using System.Buffers.Text;
+using System.Security.Cryptography;
+using System.Text;
+using System.Threading;
+using System.Threading.Tasks;
+
+namespace StellaOps.Attestor.Core.Submission;
+
+public sealed class AttestorSubmissionValidator
+{
+    private static readonly string[] AllowedKinds = ["sbom", "report", "vex-export"];
+
+    private readonly IDsseCanonicalizer _canonicalizer;
+
+    public AttestorSubmissionValidator(IDsseCanonicalizer canonicalizer)
+    {
+        _canonicalizer = canonicalizer ?? throw new ArgumentNullException(nameof(canonicalizer));
+    }
+
+    public async Task<AttestorSubmissionValidationResult> ValidateAsync(AttestorSubmissionRequest request, CancellationToken cancellationToken = default)
+    {
+        ArgumentNullException.ThrowIfNull(request);
+
+        if (request.Bundle is null)
+        {
+            throw new AttestorValidationException("bundle_missing", "Submission bundle payload is required.");
+        }
+
+        if (request.Bundle.Dsse is null)
+        {
+            throw new AttestorValidationException("dsse_missing", "DSSE envelope is required.");
+        }
+
+        if (string.IsNullOrWhiteSpace(request.Bundle.Dsse.PayloadType))
+        {
+            throw new AttestorValidationException("payload_type_missing", "DSSE payloadType is required.");
+        }
+
+        if (string.IsNullOrWhiteSpace(request.Bundle.Dsse.PayloadBase64))
+        {
+            throw new AttestorValidationException("payload_missing", "DSSE payload must be provided.");
+        }
+
+        if (request.Bundle.Dsse.Signatures.Count == 0)
+        {
+            throw new AttestorValidationException("signature_missing", "At least one DSSE signature is required.");
+        }
+
+        if (request.Meta is null)
+        {
+            throw new AttestorValidationException("meta_missing", "Submission metadata is required.");
+        }
+
+        if (request.Meta.Artifact is null)
+        {
+            throw new AttestorValidationException("artifact_missing", "Artifact metadata is required.");
+        }
+
+        if (string.IsNullOrWhiteSpace(request.Meta.Artifact.Sha256))
+        {
+            throw new AttestorValidationException("artifact_sha_missing", "Artifact sha256 is required.");
+        }
+
+        if (!IsHex(request.Meta.Artifact.Sha256, expectedLength: 64))
+        {
+            throw new AttestorValidationException("artifact_sha_invalid", "Artifact sha256 must be a 64-character hex string.");
+        }
+
+        if (string.IsNullOrWhiteSpace(request.Meta.BundleSha256))
+        {
+            throw new AttestorValidationException("bundle_sha_missing", "bundleSha256 is required.");
+        }
+
+        if (!IsHex(request.Meta.BundleSha256, expectedLength: 64))
+        {
+            throw new AttestorValidationException("bundle_sha_invalid", "bundleSha256 must be a 64-character hex string.");
+        }
+
+        if (Array.IndexOf(AllowedKinds, request.Meta.Artifact.Kind) < 0)
+        {
+            throw new AttestorValidationException("artifact_kind_invalid", $"Artifact kind '{request.Meta.Artifact.Kind}' is not supported.");
+        }
+
+        if (!Base64UrlDecode(request.Bundle.Dsse.PayloadBase64, out _))
+        {
+            throw new AttestorValidationException("payload_invalid_base64", "DSSE payload must be valid base64.");
+        }
+
+        var canonical = await _canonicalizer.CanonicalizeAsync(request, cancellationToken).ConfigureAwait(false);
+        Span<byte> hash = stackalloc byte[32];
+        if (!SHA256.TryHashData(canonical, hash, out _))
+        {
+            throw new AttestorValidationException("bundle_sha_failure", "Failed to compute canonical bundle hash.");
+        }
+
+        var hashHex = Convert.ToHexString(hash).ToLowerInvariant();
+        if (!string.Equals(hashHex, request.Meta.BundleSha256, StringComparison.OrdinalIgnoreCase))
+        {
+            throw new AttestorValidationException("bundle_sha_mismatch", "bundleSha256 does not match canonical DSSE hash.");
+        }
+
+        if (!string.Equals(request.Meta.LogPreference, "primary", StringComparison.OrdinalIgnoreCase)
+            && !string.Equals(request.Meta.LogPreference, "mirror", StringComparison.OrdinalIgnoreCase)
+            && !string.Equals(request.Meta.LogPreference, "both", StringComparison.OrdinalIgnoreCase))
+        {
+            throw new AttestorValidationException("log_preference_invalid", "logPreference must be 'primary', 'mirror', or 'both'.");
+        }
+
+        return new AttestorSubmissionValidationResult(canonical);
+    }
+
+    private static bool IsHex(string value, int expectedLength)
+    {
+        if (value.Length != expectedLength)
+        {
+            return false;
+        }
+
+        foreach (var ch in value)
+        {
+            var isHex = ch is >= '0' and <= '9' or >= 'a' and <= 'f' or >= 'A' and <= 'F';
+            if (!isHex)
+            {
+                return false;
+            }
+        }
+
+        return true;
+    }
+
+    private static bool Base64UrlDecode(string value, out byte[] bytes)
+    {
+        try
+        {
+            bytes = Convert.FromBase64String(Normalise(value));
+            return true;
+        }
+        catch (FormatException)
+        {
+            bytes = Array.Empty<byte>();
+            return false;
+        }
+    }
+
+    private static string Normalise(string value)
+    {
+        if (value.Contains('-') || value.Contains('_'))
+        {
+            Span<char> buffer = value.ToCharArray();
+            for (var i = 0; i < buffer.Length; i++)
+            {
+                buffer[i] = buffer[i] switch
+                {
+                    '-' => '+',
+                    '_' => '/',
+                    _ => buffer[i]
+                };
+            }
+
+            var padding = 4 - (buffer.Length % 4);
+            return padding == 4 ? new string(buffer) : new string(buffer) + new string('=', padding);
+        }
+
+        return value;
+    }
+}

src/StellaOps.Attestor/StellaOps.Attestor.Core/Submission/AttestorValidationException.cs

@@ -0,0 +1,14 @@
+using System;
+
+namespace StellaOps.Attestor.Core.Submission;
+
+public sealed class AttestorValidationException : Exception
+{
+    public AttestorValidationException(string code, string message)
+        : base(message)
+    {
+        Code = code;
+    }
+
+    public string Code { get; }
+}

src/StellaOps.Attestor/StellaOps.Attestor.Core/Submission/IAttestorSubmissionService.cs

@@ -0,0 +1,12 @@
+using System.Threading;
+using System.Threading.Tasks;
+
+namespace StellaOps.Attestor.Core.Submission;
+
+public interface IAttestorSubmissionService
+{
+    Task<AttestorSubmissionResult> SubmitAsync(
+        AttestorSubmissionRequest request,
+        SubmissionContext context,
+        CancellationToken cancellationToken = default);
+}

src/StellaOps.Attestor/StellaOps.Attestor.Core/Submission/IDsseCanonicalizer.cs

@@ -0,0 +1,9 @@
+using System.Threading;
+using System.Threading.Tasks;
+
+namespace StellaOps.Attestor.Core.Submission;
+
+public interface IDsseCanonicalizer
+{
+    Task<byte[]> CanonicalizeAsync(AttestorSubmissionRequest request, CancellationToken cancellationToken = default);
+}

src/StellaOps.Attestor/StellaOps.Attestor.Core/Submission/SubmissionContext.cs

@@ -0,0 +1,21 @@
+using System.Security.Cryptography.X509Certificates;
+
+namespace StellaOps.Attestor.Core.Submission;
+
+/// <summary>
+/// Ambient information about the caller used for policy and audit decisions.
+/// </summary>
+public sealed class SubmissionContext
+{
+    public required string CallerSubject { get; init; }
+
+    public required string CallerAudience { get; init; }
+
+    public required string? CallerClientId { get; init; }
+
+    public required string? CallerTenant { get; init; }
+
+    public X509Certificate2? ClientCertificate { get; init; }
+
+    public string? MtlsThumbprint { get; init; }
+}

src/StellaOps.Attestor/StellaOps.Attestor.Core/Verification/AttestorVerificationException.cs

@@ -0,0 +1,14 @@
+using System;
+
+namespace StellaOps.Attestor.Core.Verification;
+
+public sealed class AttestorVerificationException : Exception
+{
+    public AttestorVerificationException(string code, string message)
+        : base(message)
+    {
+        Code = code;
+    }
+
+    public string Code { get; }
+}

src/StellaOps.Attestor/StellaOps.Attestor.Core/Verification/AttestorVerificationRequest.cs

@@ -0,0 +1,15 @@
+namespace StellaOps.Attestor.Core.Verification;
+
+/// <summary>
+/// Payload accepted by the verification service.
+/// </summary>
+public sealed class AttestorVerificationRequest
+{
+    public string? Uuid { get; set; }
+
+    public Submission.AttestorSubmissionRequest.SubmissionBundle? Bundle { get; set; }
+
+    public string? ArtifactSha256 { get; set; }
+
+    public bool RefreshProof { get; set; }
+}

src/StellaOps.Attestor/StellaOps.Attestor.Core/Verification/AttestorVerificationResult.cs

@@ -0,0 +1,21 @@
+using System;
+using System.Collections.Generic;
+
+namespace StellaOps.Attestor.Core.Verification;
+
+public sealed class AttestorVerificationResult
+{
+    public bool Ok { get; init; }
+
+    public string? Uuid { get; init; }
+
+    public long? Index { get; init; }
+
+    public string? LogUrl { get; init; }
+
+    public DateTimeOffset CheckedAt { get; init; } = DateTimeOffset.UtcNow;
+
+    public string Status { get; init; } = "unknown";
+
+    public IReadOnlyList<string> Issues { get; init; } = Array.Empty<string>();
+}

src/StellaOps.Attestor/StellaOps.Attestor.Core/Verification/IAttestorVerificationService.cs

@@ -0,0 +1,12 @@
+using System.Threading;
+using System.Threading.Tasks;
+using StellaOps.Attestor.Core.Storage;
+
+namespace StellaOps.Attestor.Core.Verification;
+
+public interface IAttestorVerificationService
+{
+    Task<AttestorVerificationResult> VerifyAsync(AttestorVerificationRequest request, CancellationToken cancellationToken = default);
+
+    Task<AttestorEntry?> GetEntryAsync(string rekorUuid, bool refreshProof, CancellationToken cancellationToken = default);
+}

src/StellaOps.Attestor/StellaOps.Attestor.Infrastructure/Properties/AssemblyInfo.cs

@@ -0,0 +1,3 @@
+using System.Runtime.CompilerServices;
+
+[assembly: InternalsVisibleTo("StellaOps.Attestor.Tests")]

src/StellaOps.Attestor/StellaOps.Attestor.Infrastructure/Rekor/HttpRekorClient.cs

@@ -0,0 +1,157 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Net;
+using System.Net.Http;
+using System.Net.Http.Json;
+using System.Text.Json;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.Extensions.Logging;
+using StellaOps.Attestor.Core.Rekor;
+using StellaOps.Attestor.Core.Submission;
+
+namespace StellaOps.Attestor.Infrastructure.Rekor;
+
+internal sealed class HttpRekorClient : IRekorClient
+{
+    private static readonly JsonSerializerOptions SerializerOptions = new(JsonSerializerDefaults.Web);
+
+    private readonly HttpClient _httpClient;
+    private readonly ILogger<HttpRekorClient> _logger;
+
+    public HttpRekorClient(HttpClient httpClient, ILogger<HttpRekorClient> logger)
+    {
+        _httpClient = httpClient;
+        _logger = logger;
+    }
+
+    public async Task<RekorSubmissionResponse> SubmitAsync(AttestorSubmissionRequest request, RekorBackend backend, CancellationToken cancellationToken = default)
+    {
+        var submissionUri = BuildUri(backend.Url, "api/v2/log/entries");
+
+        using var httpRequest = new HttpRequestMessage(HttpMethod.Post, submissionUri)
+        {
+            Content = JsonContent.Create(BuildSubmissionPayload(request), options: SerializerOptions)
+        };
+
+        using var response = await _httpClient.SendAsync(httpRequest, cancellationToken).ConfigureAwait(false);
+
+        if (response.StatusCode == HttpStatusCode.Conflict)
+        {
+            var message = await response.Content.ReadAsStringAsync(cancellationToken).ConfigureAwait(false);
+            throw new InvalidOperationException($"Rekor reported a conflict: {message}");
+        }
+
+        response.EnsureSuccessStatusCode();
+
+        await using var stream = await response.Content.ReadAsStreamAsync(cancellationToken).ConfigureAwait(false);
+        using var document = await JsonDocument.ParseAsync(stream, cancellationToken: cancellationToken).ConfigureAwait(false);
+
+        var root = document.RootElement;
+
+        long? index = null;
+        if (root.TryGetProperty("index", out var indexElement) && indexElement.TryGetInt64(out var indexValue))
+        {
+            index = indexValue;
+        }
+
+        return new RekorSubmissionResponse
+        {
+            Uuid = root.TryGetProperty("uuid", out var uuidElement) ? uuidElement.GetString() ?? string.Empty : string.Empty,
+            Index = index,
+            LogUrl = root.TryGetProperty("logURL", out var urlElement) ? urlElement.GetString() ?? backend.Url.ToString() : backend.Url.ToString(),
+            Status = root.TryGetProperty("status", out var statusElement) ? statusElement.GetString() ?? "included" : "included",
+            Proof = TryParseProof(root.TryGetProperty("proof", out var proofElement) ? proofElement : default)
+        };
+    }
+
+    public async Task<RekorProofResponse?> GetProofAsync(string rekorUuid, RekorBackend backend, CancellationToken cancellationToken = default)
+    {
+        var proofUri = BuildUri(backend.Url, $"api/v2/log/entries/{rekorUuid}/proof");
+
+        using var request = new HttpRequestMessage(HttpMethod.Get, proofUri);
+        using var response = await _httpClient.SendAsync(request, cancellationToken).ConfigureAwait(false);
+
+        if (response.StatusCode == HttpStatusCode.NotFound)
+        {
+            _logger.LogDebug("Rekor proof for {Uuid} not found", rekorUuid);
+            return null;
+        }
+
+        response.EnsureSuccessStatusCode();
+
+        await using var stream = await response.Content.ReadAsStreamAsync(cancellationToken).ConfigureAwait(false);
+        using var document = await JsonDocument.ParseAsync(stream, cancellationToken: cancellationToken).ConfigureAwait(false);
+
+        return TryParseProof(document.RootElement);
+    }
+
+    private static object BuildSubmissionPayload(AttestorSubmissionRequest request)
+    {
+        var signatures = new List<object>();
+        foreach (var sig in request.Bundle.Dsse.Signatures)
+        {
+            signatures.Add(new { keyid = sig.KeyId, sig = sig.Signature });
+        }
+
+        return new
+        {
+            entries = new[]
+            {
+                new
+                {
+                    dsseEnvelope = new
+                    {
+                        payload = request.Bundle.Dsse.PayloadBase64,
+                        payloadType = request.Bundle.Dsse.PayloadType,
+                        signatures
+                    }
+                }
+            }
+        };
+    }
+
+    private static RekorProofResponse? TryParseProof(JsonElement proofElement)
+    {
+        if (proofElement.ValueKind == JsonValueKind.Undefined || proofElement.ValueKind == JsonValueKind.Null)
+        {
+            return null;
+        }
+
+        var checkpointElement = proofElement.TryGetProperty("checkpoint", out var cp) ? cp : default;
+        var inclusionElement = proofElement.TryGetProperty("inclusion", out var inc) ? inc : default;
+
+        return new RekorProofResponse
+        {
+            Checkpoint = checkpointElement.ValueKind == JsonValueKind.Object
+                ? new RekorProofResponse.RekorCheckpoint
+                {
+                    Origin = checkpointElement.TryGetProperty("origin", out var origin) ? origin.GetString() : null,
+                    Size = checkpointElement.TryGetProperty("size", out var size) && size.TryGetInt64(out var sizeValue) ? sizeValue : 0,
+                    RootHash = checkpointElement.TryGetProperty("rootHash", out var rootHash) ? rootHash.GetString() : null,
+                    Timestamp = checkpointElement.TryGetProperty("timestamp", out var ts) && ts.ValueKind == JsonValueKind.String && DateTimeOffset.TryParse(ts.GetString(), out var dto) ? dto : null
+                }
+                : null,
+            Inclusion = inclusionElement.ValueKind == JsonValueKind.Object
+                ? new RekorProofResponse.RekorInclusionProof
+                {
+                    LeafHash = inclusionElement.TryGetProperty("leafHash", out var leaf) ? leaf.GetString() : null,
+                    Path = inclusionElement.TryGetProperty("path", out var pathElement) && pathElement.ValueKind == JsonValueKind.Array
+                        ? pathElement.EnumerateArray().Select(p => p.GetString() ?? string.Empty).ToArray()
+                        : Array.Empty<string>()
+                }
+                : null
+        };
+    }
+
+    private static Uri BuildUri(Uri baseUri, string relative)
+    {
+        if (!relative.StartsWith("/", StringComparison.Ordinal))
+        {
+            relative = "/" + relative;
+        }
+
+        return new Uri(baseUri, relative);
+    }
+}

src/StellaOps.Attestor/StellaOps.Attestor.Infrastructure/Rekor/StubRekorClient.cs

@@ -0,0 +1,71 @@
+using System;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.Extensions.Logging;
+using StellaOps.Attestor.Core.Rekor;
+using StellaOps.Attestor.Core.Submission;
+
+namespace StellaOps.Attestor.Infrastructure.Rekor;
+
+internal sealed class StubRekorClient : IRekorClient
+{
+    private readonly ILogger<StubRekorClient> _logger;
+
+    public StubRekorClient(ILogger<StubRekorClient> logger)
+    {
+        _logger = logger;
+    }
+
+    public Task<RekorSubmissionResponse> SubmitAsync(AttestorSubmissionRequest request, RekorBackend backend, CancellationToken cancellationToken = default)
+    {
+        var uuid = Guid.NewGuid().ToString();
+        _logger.LogInformation("Stub Rekor submission for bundle {BundleSha} -> {Uuid}", request.Meta.BundleSha256, uuid);
+
+        var proof = new RekorProofResponse
+        {
+            Checkpoint = new RekorProofResponse.RekorCheckpoint
+            {
+                Origin = backend.Url.Host,
+                Size = 1,
+                RootHash = request.Meta.BundleSha256,
+                Timestamp = DateTimeOffset.UtcNow
+            },
+            Inclusion = new RekorProofResponse.RekorInclusionProof
+            {
+                LeafHash = request.Meta.BundleSha256,
+                Path = Array.Empty<string>()
+            }
+        };
+
+        var response = new RekorSubmissionResponse
+        {
+            Uuid = uuid,
+            Index = Random.Shared.NextInt64(1, long.MaxValue),
+            LogUrl = new Uri(backend.Url, $"/api/v2/log/entries/{uuid}").ToString(),
+            Status = "included",
+            Proof = proof
+        };
+
+        return Task.FromResult(response);
+    }
+
+    public Task<RekorProofResponse?> GetProofAsync(string rekorUuid, RekorBackend backend, CancellationToken cancellationToken = default)
+    {
+        _logger.LogInformation("Stub Rekor proof fetch for {Uuid}", rekorUuid);
+        return Task.FromResult<RekorProofResponse?>(new RekorProofResponse
+        {
+            Checkpoint = new RekorProofResponse.RekorCheckpoint
+            {
+                Origin = backend.Url.Host,
+                Size = 1,
+                RootHash = string.Empty,
+                Timestamp = DateTimeOffset.UtcNow
+            },
+            Inclusion = new RekorProofResponse.RekorInclusionProof
+            {
+                LeafHash = string.Empty,
+                Path = Array.Empty<string>()
+            }
+        });
+    }
+}

src/StellaOps.Attestor/StellaOps.Attestor.Infrastructure/ServiceCollectionExtensions.cs

@@ -0,0 +1,118 @@
+using System;
+using Amazon.Runtime;
+using Amazon.S3;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Logging;
+using Microsoft.Extensions.Options;
+using MongoDB.Driver;
+using StackExchange.Redis;
+using StellaOps.Attestor.Core.Options;
+using StellaOps.Attestor.Core.Observability;
+using StellaOps.Attestor.Core.Rekor;
+using StellaOps.Attestor.Core.Storage;
+using StellaOps.Attestor.Core.Submission;
+using StellaOps.Attestor.Infrastructure.Rekor;
+using StellaOps.Attestor.Infrastructure.Storage;
+using StellaOps.Attestor.Infrastructure.Submission;
+using StellaOps.Attestor.Core.Verification;
+using StellaOps.Attestor.Infrastructure.Verification;
+
+namespace StellaOps.Attestor.Infrastructure;
+
+public static class ServiceCollectionExtensions
+{
+    public static IServiceCollection AddAttestorInfrastructure(this IServiceCollection services)
+    {
+        services.AddSingleton<IDsseCanonicalizer, DefaultDsseCanonicalizer>();
+        services.AddSingleton<AttestorSubmissionValidator>();
+        services.AddSingleton<AttestorMetrics>();
+        services.AddSingleton<IAttestorSubmissionService, AttestorSubmissionService>();
+        services.AddSingleton<IAttestorVerificationService, AttestorVerificationService>();
+        services.AddHttpClient<HttpRekorClient>(client =>
+        {
+            client.Timeout = TimeSpan.FromSeconds(30);
+        });
+        services.AddSingleton<IRekorClient>(sp => sp.GetRequiredService<HttpRekorClient>());
+
+        services.AddSingleton<IMongoClient>(sp =>
+        {
+            var options = sp.GetRequiredService<IOptions<AttestorOptions>>().Value;
+            if (string.IsNullOrWhiteSpace(options.Mongo.Uri))
+            {
+                throw new InvalidOperationException("Attestor MongoDB connection string is not configured.");
+            }
+
+            return new MongoClient(options.Mongo.Uri);
+        });
+
+        services.AddSingleton(sp =>
+        {
+            var opts = sp.GetRequiredService<IOptions<AttestorOptions>>().Value;
+            var client = sp.GetRequiredService<IMongoClient>();
+            var databaseName = MongoUrl.Create(opts.Mongo.Uri).DatabaseName ?? opts.Mongo.Database;
+            return client.GetDatabase(databaseName);
+        });
+
+        services.AddSingleton(sp =>
+        {
+            var opts = sp.GetRequiredService<IOptions<AttestorOptions>>().Value;
+            var database = sp.GetRequiredService<IMongoDatabase>();
+            return database.GetCollection<MongoAttestorEntryRepository.AttestorEntryDocument>(opts.Mongo.EntriesCollection);
+        });
+
+        services.AddSingleton(sp =>
+        {
+            var opts = sp.GetRequiredService<IOptions<AttestorOptions>>().Value;
+            var database = sp.GetRequiredService<IMongoDatabase>();
+            return database.GetCollection<MongoAttestorAuditSink.AttestorAuditDocument>(opts.Mongo.AuditCollection);
+        });
+
+        services.AddSingleton<IAttestorEntryRepository, MongoAttestorEntryRepository>();
+        services.AddSingleton<IAttestorAuditSink, MongoAttestorAuditSink>();
+
+
+        services.AddSingleton<IAttestorDedupeStore>(sp =>
+        {
+            var options = sp.GetRequiredService<IOptions<AttestorOptions>>().Value;
+            if (string.IsNullOrWhiteSpace(options.Redis.Url))
+            {
+                return new InMemoryAttestorDedupeStore();
+            }
+
+            var multiplexer = sp.GetRequiredService<IConnectionMultiplexer>();
+            return new RedisAttestorDedupeStore(multiplexer, sp.GetRequiredService<IOptions<AttestorOptions>>());
+        });
+
+        services.AddSingleton<IConnectionMultiplexer>(sp =>
+        {
+            var options = sp.GetRequiredService<IOptions<AttestorOptions>>().Value;
+            if (string.IsNullOrWhiteSpace(options.Redis.Url))
+            {
+                throw new InvalidOperationException("Redis connection string is required when redis dedupe is enabled.");
+            }
+
+            return ConnectionMultiplexer.Connect(options.Redis.Url);
+        });
+
+        services.AddSingleton<IAttestorArchiveStore>(sp =>
+        {
+            var options = sp.GetRequiredService<IOptions<AttestorOptions>>().Value;
+            if (options.S3.Enabled && !string.IsNullOrWhiteSpace(options.S3.Endpoint) && !string.IsNullOrWhiteSpace(options.S3.Bucket))
+            {
+                var config = new AmazonS3Config
+                {
+                    ServiceURL = options.S3.Endpoint,
+                    ForcePathStyle = true,
+                    UseHttp = !options.S3.UseTls
+                };
+
+                var client = new AmazonS3Client(FallbackCredentialsFactory.GetCredentials(), config);
+                return new S3AttestorArchiveStore(client, sp.GetRequiredService<IOptions<AttestorOptions>>(), sp.GetRequiredService<ILogger<S3AttestorArchiveStore>>());
+            }
+
+            return new NullAttestorArchiveStore(sp.GetRequiredService<ILogger<NullAttestorArchiveStore>>());
+        });
+
+        return services;
+    }
+}

src/StellaOps.Attestor/StellaOps.Attestor.Infrastructure/StellaOps.Attestor.Infrastructure.csproj

@@ -0,0 +1,21 @@
+<Project Sdk="Microsoft.NET.Sdk">
+  <PropertyGroup>
+    <TargetFramework>net10.0</TargetFramework>
+    <LangVersion>preview</LangVersion>
+    <Nullable>enable</Nullable>
+    <ImplicitUsings>enable</ImplicitUsings>
+    <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
+  </PropertyGroup>
+  <ItemGroup>
+    <ProjectReference Include="..\StellaOps.Attestor.Core\StellaOps.Attestor.Core.csproj" />
+  </ItemGroup>
+  <ItemGroup>
+    <PackageReference Include="Microsoft.Extensions.DependencyInjection.Abstractions" Version="8.0.1" />
+    <PackageReference Include="Microsoft.Extensions.Logging.Abstractions" Version="8.0.1" />
+    <PackageReference Include="Microsoft.Extensions.Options" Version="8.0.2" />
+    <PackageReference Include="Microsoft.Extensions.Http" Version="8.0.0" />
+    <PackageReference Include="MongoDB.Driver" Version="3.5.0" />
+    <PackageReference Include="StackExchange.Redis" Version="2.8.24" />
+    <PackageReference Include="AWSSDK.S3" Version="3.7.307.6" />
+  </ItemGroup>
+</Project>

src/StellaOps.Attestor/StellaOps.Attestor.Infrastructure/Storage/InMemoryAttestorDedupeStore.cs

@@ -0,0 +1,33 @@
+using System;
+using System.Collections.Concurrent;
+using System.Threading;
+using System.Threading.Tasks;
+using StellaOps.Attestor.Core.Storage;
+
+namespace StellaOps.Attestor.Infrastructure.Storage;
+
+internal sealed class InMemoryAttestorDedupeStore : IAttestorDedupeStore
+{
+    private readonly ConcurrentDictionary<string, (string Uuid, DateTimeOffset ExpiresAt)> _store = new();
+
+    public Task<string?> TryGetExistingAsync(string bundleSha256, CancellationToken cancellationToken = default)
+    {
+        if (_store.TryGetValue(bundleSha256, out var entry))
+        {
+            if (entry.ExpiresAt > DateTimeOffset.UtcNow)
+            {
+                return Task.FromResult<string?>(entry.Uuid);
+            }
+
+            _store.TryRemove(bundleSha256, out _);
+        }
+
+        return Task.FromResult<string?>(null);
+    }
+
+    public Task SetAsync(string bundleSha256, string rekorUuid, TimeSpan ttl, CancellationToken cancellationToken = default)
+    {
+        _store[bundleSha256] = (rekorUuid, DateTimeOffset.UtcNow.Add(ttl));
+        return Task.CompletedTask;
+    }
+}

src/StellaOps.Attestor/StellaOps.Attestor.Infrastructure/Storage/MongoAttestorAuditSink.cs

@@ -0,0 +1,115 @@
+using System;
+using System.Threading;
+using System.Threading.Tasks;
+using MongoDB.Bson;
+using MongoDB.Bson.Serialization.Attributes;
+using MongoDB.Driver;
+using StellaOps.Attestor.Core.Audit;
+using StellaOps.Attestor.Core.Storage;
+
+namespace StellaOps.Attestor.Infrastructure.Storage;
+
+internal sealed class MongoAttestorAuditSink : IAttestorAuditSink
+{
+    private readonly IMongoCollection<AttestorAuditDocument> _collection;
+
+    public MongoAttestorAuditSink(IMongoCollection<AttestorAuditDocument> collection)
+    {
+        _collection = collection;
+    }
+
+    public Task WriteAsync(AttestorAuditRecord record, CancellationToken cancellationToken = default)
+    {
+        var document = AttestorAuditDocument.FromRecord(record);
+        return _collection.InsertOneAsync(document, cancellationToken: cancellationToken);
+    }
+
+    internal sealed class AttestorAuditDocument
+    {
+        [BsonId]
+        public ObjectId Id { get; set; }
+
+        [BsonElement("ts")]
+        public BsonDateTime Timestamp { get; set; } = BsonDateTime.Create(DateTime.UtcNow);
+
+        [BsonElement("action")]
+        public string Action { get; set; } = string.Empty;
+
+        [BsonElement("result")]
+        public string Result { get; set; } = string.Empty;
+
+        [BsonElement("rekorUuid")]
+        public string? RekorUuid { get; set; }
+
+        [BsonElement("index")]
+        public long? Index { get; set; }
+
+        [BsonElement("artifactSha256")]
+        public string ArtifactSha256 { get; set; } = string.Empty;
+
+        [BsonElement("bundleSha256")]
+        public string BundleSha256 { get; set; } = string.Empty;
+
+        [BsonElement("backend")]
+        public string Backend { get; set; } = string.Empty;
+
+        [BsonElement("latencyMs")]
+        public long LatencyMs { get; set; }
+
+        [BsonElement("caller")]
+        public CallerDocument Caller { get; set; } = new();
+
+        [BsonElement("metadata")]
+        public BsonDocument Metadata { get; set; } = new();
+
+        public static AttestorAuditDocument FromRecord(AttestorAuditRecord record)
+        {
+            var metadata = new BsonDocument();
+            foreach (var kvp in record.Metadata)
+            {
+                metadata[kvp.Key] = kvp.Value;
+            }
+
+            return new AttestorAuditDocument
+            {
+                Id = ObjectId.GenerateNewId(),
+                Timestamp = BsonDateTime.Create(record.Timestamp.UtcDateTime),
+                Action = record.Action,
+                Result = record.Result,
+                RekorUuid = record.RekorUuid,
+                Index = record.Index,
+                ArtifactSha256 = record.ArtifactSha256,
+                BundleSha256 = record.BundleSha256,
+                Backend = record.Backend,
+                LatencyMs = record.LatencyMs,
+                Caller = new CallerDocument
+                {
+                    Subject = record.Caller.Subject,
+                    Audience = record.Caller.Audience,
+                    ClientId = record.Caller.ClientId,
+                    MtlsThumbprint = record.Caller.MtlsThumbprint,
+                    Tenant = record.Caller.Tenant
+                },
+                Metadata = metadata
+            };
+        }
+
+        internal sealed class CallerDocument
+        {
+            [BsonElement("subject")]
+            public string? Subject { get; set; }
+
+            [BsonElement("audience")]
+            public string? Audience { get; set; }
+
+            [BsonElement("clientId")]
+            public string? ClientId { get; set; }
+
+            [BsonElement("mtlsThumbprint")]
+            public string? MtlsThumbprint { get; set; }
+
+            [BsonElement("tenant")]
+            public string? Tenant { get; set; }
+        }
+    }
+}

src/StellaOps.Attestor/StellaOps.Attestor.Infrastructure/Storage/MongoAttestorEntryRepository.cs

@@ -0,0 +1,245 @@
+using System;
+using System.Collections.Generic;
+using System.Threading;
+using System.Threading.Tasks;
+using MongoDB.Bson;
+using MongoDB.Bson.Serialization.Attributes;
+using MongoDB.Driver;
+using StellaOps.Attestor.Core.Storage;
+
+namespace StellaOps.Attestor.Infrastructure.Storage;
+
+internal sealed class MongoAttestorEntryRepository : IAttestorEntryRepository
+{
+    private readonly IMongoCollection<AttestorEntryDocument> _entries;
+
+    public MongoAttestorEntryRepository(IMongoCollection<AttestorEntryDocument> entries)
+    {
+        _entries = entries;
+    }
+
+    public async Task<AttestorEntry?> GetByBundleShaAsync(string bundleSha256, CancellationToken cancellationToken = default)
+    {
+        var filter = Builders<AttestorEntryDocument>.Filter.Eq(x => x.BundleSha256, bundleSha256);
+        var document = await _entries.Find(filter).FirstOrDefaultAsync(cancellationToken).ConfigureAwait(false);
+        return document?.ToDomain();
+    }
+
+    public async Task<AttestorEntry?> GetByUuidAsync(string rekorUuid, CancellationToken cancellationToken = default)
+    {
+        var filter = Builders<AttestorEntryDocument>.Filter.Eq(x => x.Id, rekorUuid);
+        var document = await _entries.Find(filter).FirstOrDefaultAsync(cancellationToken).ConfigureAwait(false);
+        return document?.ToDomain();
+    }
+
+    public async Task<IReadOnlyList<AttestorEntry>> GetByArtifactShaAsync(string artifactSha256, CancellationToken cancellationToken = default)
+    {
+        var filter = Builders<AttestorEntryDocument>.Filter.Eq(x => x.Artifact.Sha256, artifactSha256);
+        var documents = await _entries.Find(filter).ToListAsync(cancellationToken).ConfigureAwait(false);
+        return documents.ConvertAll(static doc => doc.ToDomain());
+    }
+
+    public async Task SaveAsync(AttestorEntry entry, CancellationToken cancellationToken = default)
+    {
+        var document = AttestorEntryDocument.FromDomain(entry);
+        var filter = Builders<AttestorEntryDocument>.Filter.Eq(x => x.Id, document.Id);
+        await _entries.ReplaceOneAsync(filter, document, new ReplaceOptions { IsUpsert = true }, cancellationToken).ConfigureAwait(false);
+    }
+
+    [BsonIgnoreExtraElements]
+    internal sealed class AttestorEntryDocument
+    {
+        [BsonId]
+        public string Id { get; set; } = string.Empty;
+
+        [BsonElement("artifact")]
+        public ArtifactDocument Artifact { get; set; } = new();
+
+        [BsonElement("bundleSha256")]
+        public string BundleSha256 { get; set; } = string.Empty;
+
+        [BsonElement("index")]
+        public long? Index { get; set; }
+
+        [BsonElement("proof")]
+        public ProofDocument? Proof { get; set; }
+
+        [BsonElement("log")]
+        public LogDocument Log { get; set; } = new();
+
+        [BsonElement("createdAt")]
+        public BsonDateTime CreatedAt { get; set; } = BsonDateTime.Create(System.DateTimeOffset.UtcNow);
+
+        [BsonElement("status")]
+        public string Status { get; set; } = "pending";
+
+        [BsonElement("signerIdentity")]
+        public SignerIdentityDocument SignerIdentity { get; set; } = new();
+
+        public static AttestorEntryDocument FromDomain(AttestorEntry entry)
+        {
+            return new AttestorEntryDocument
+            {
+                Id = entry.RekorUuid,
+                Artifact = new ArtifactDocument
+                {
+                    Sha256 = entry.Artifact.Sha256,
+                    Kind = entry.Artifact.Kind,
+                    ImageDigest = entry.Artifact.ImageDigest,
+                    SubjectUri = entry.Artifact.SubjectUri
+                },
+                BundleSha256 = entry.BundleSha256,
+                Index = entry.Index,
+                Proof = entry.Proof is null ? null : new ProofDocument
+                {
+                    Checkpoint = entry.Proof.Checkpoint is null ? null : new CheckpointDocument
+                    {
+                        Origin = entry.Proof.Checkpoint.Origin,
+                        Size = entry.Proof.Checkpoint.Size,
+                        RootHash = entry.Proof.Checkpoint.RootHash,
+                        Timestamp = entry.Proof.Checkpoint.Timestamp is null
+                            ? null
+                            : BsonDateTime.Create(entry.Proof.Checkpoint.Timestamp.Value)
+                    },
+                    Inclusion = entry.Proof.Inclusion is null ? null : new InclusionDocument
+                    {
+                        LeafHash = entry.Proof.Inclusion.LeafHash,
+                        Path = entry.Proof.Inclusion.Path
+                    }
+                },
+                Log = new LogDocument
+                {
+                    Url = entry.Log.Url,
+                    LogId = entry.Log.LogId
+                },
+                CreatedAt = BsonDateTime.Create(entry.CreatedAt.UtcDateTime),
+                Status = entry.Status,
+                SignerIdentity = new SignerIdentityDocument
+                {
+                    Mode = entry.SignerIdentity.Mode,
+                    Issuer = entry.SignerIdentity.Issuer,
+                    SubjectAlternativeName = entry.SignerIdentity.SubjectAlternativeName,
+                    KeyId = entry.SignerIdentity.KeyId
+                }
+            };
+        }
+
+        public AttestorEntry ToDomain()
+        {
+            return new AttestorEntry
+            {
+                RekorUuid = Id,
+                Artifact = new AttestorEntry.ArtifactDescriptor
+                {
+                    Sha256 = Artifact.Sha256,
+                    Kind = Artifact.Kind,
+                    ImageDigest = Artifact.ImageDigest,
+                    SubjectUri = Artifact.SubjectUri
+                },
+                BundleSha256 = BundleSha256,
+                Index = Index,
+                Proof = Proof is null ? null : new AttestorEntry.ProofDescriptor
+                {
+                    Checkpoint = Proof.Checkpoint is null ? null : new AttestorEntry.CheckpointDescriptor
+                    {
+                        Origin = Proof.Checkpoint.Origin,
+                        Size = Proof.Checkpoint.Size,
+                        RootHash = Proof.Checkpoint.RootHash,
+                        Timestamp = Proof.Checkpoint.Timestamp?.ToUniversalTime()
+                    },
+                    Inclusion = Proof.Inclusion is null ? null : new AttestorEntry.InclusionDescriptor
+                    {
+                        LeafHash = Proof.Inclusion.LeafHash,
+                        Path = Proof.Inclusion.Path
+                    }
+                },
+                Log = new AttestorEntry.LogDescriptor
+                {
+                    Url = Log.Url,
+                    LogId = Log.LogId
+                },
+                CreatedAt = CreatedAt.ToUniversalTime(),
+                Status = Status,
+                SignerIdentity = new AttestorEntry.SignerIdentityDescriptor
+                {
+                    Mode = SignerIdentity.Mode,
+                    Issuer = SignerIdentity.Issuer,
+                    SubjectAlternativeName = SignerIdentity.SubjectAlternativeName,
+                    KeyId = SignerIdentity.KeyId
+                }
+            };
+        }
+
+        internal sealed class ArtifactDocument
+        {
+            [BsonElement("sha256")]
+            public string Sha256 { get; set; } = string.Empty;
+
+            [BsonElement("kind")]
+            public string Kind { get; set; } = string.Empty;
+
+            [BsonElement("imageDigest")]
+            public string? ImageDigest { get; set; }
+
+            [BsonElement("subjectUri")]
+            public string? SubjectUri { get; set; }
+        }
+
+        internal sealed class ProofDocument
+        {
+            [BsonElement("checkpoint")]
+            public CheckpointDocument? Checkpoint { get; set; }
+
+            [BsonElement("inclusion")]
+            public InclusionDocument? Inclusion { get; set; }
+        }
+
+        internal sealed class CheckpointDocument
+        {
+            [BsonElement("origin")]
+            public string? Origin { get; set; }
+
+            [BsonElement("size")]
+            public long Size { get; set; }
+
+            [BsonElement("rootHash")]
+            public string? RootHash { get; set; }
+
+            [BsonElement("timestamp")]
+            public BsonDateTime? Timestamp { get; set; }
+        }
+
+        internal sealed class InclusionDocument
+        {
+            [BsonElement("leafHash")]
+            public string? LeafHash { get; set; }
+
+            [BsonElement("path")]
+            public IReadOnlyList<string> Path { get; set; } = System.Array.Empty<string>();
+        }
+
+        internal sealed class LogDocument
+        {
+            [BsonElement("url")]
+            public string Url { get; set; } = string.Empty;
+
+            [BsonElement("logId")]
+            public string? LogId { get; set; }
+        }
+
+        internal sealed class SignerIdentityDocument
+        {
+            [BsonElement("mode")]
+            public string Mode { get; set; } = string.Empty;
+
+            [BsonElement("issuer")]
+            public string? Issuer { get; set; }
+
+            [BsonElement("san")]
+            public string? SubjectAlternativeName { get; set; }
+
+            [BsonElement("kid")]
+            public string? KeyId { get; set; }
+        }
+    }
+}

src/StellaOps.Attestor/StellaOps.Attestor.Infrastructure/Storage/NullAttestorArchiveStore.cs

@@ -0,0 +1,22 @@
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.Extensions.Logging;
+using StellaOps.Attestor.Core.Storage;
+
+namespace StellaOps.Attestor.Infrastructure.Storage;
+
+internal sealed class NullAttestorArchiveStore : IAttestorArchiveStore
+{
+    private readonly ILogger<NullAttestorArchiveStore> _logger;
+
+    public NullAttestorArchiveStore(ILogger<NullAttestorArchiveStore> logger)
+    {
+        _logger = logger;
+    }
+
+    public Task ArchiveBundleAsync(AttestorArchiveBundle bundle, CancellationToken cancellationToken = default)
+    {
+        _logger.LogDebug("Archive disabled; skipping bundle {BundleSha}", bundle.BundleSha256);
+        return Task.CompletedTask;
+    }
+}

src/StellaOps.Attestor/StellaOps.Attestor.Infrastructure/Storage/RedisAttestorDedupeStore.cs

@@ -0,0 +1,34 @@
+using System;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.Extensions.Options;
+using StackExchange.Redis;
+using StellaOps.Attestor.Core.Options;
+using StellaOps.Attestor.Core.Storage;
+
+namespace StellaOps.Attestor.Infrastructure.Storage;
+
+internal sealed class RedisAttestorDedupeStore : IAttestorDedupeStore
+{
+    private readonly IDatabase _database;
+    private readonly string _prefix;
+
+    public RedisAttestorDedupeStore(IConnectionMultiplexer multiplexer, IOptions<AttestorOptions> options)
+    {
+        _database = multiplexer.GetDatabase();
+        _prefix = options.Value.Redis.DedupePrefix ?? "attestor:dedupe:";
+    }
+
+    public async Task<string?> TryGetExistingAsync(string bundleSha256, CancellationToken cancellationToken = default)
+    {
+        var value = await _database.StringGetAsync(BuildKey(bundleSha256)).ConfigureAwait(false);
+        return value.HasValue ? value.ToString() : null;
+    }
+
+    public Task SetAsync(string bundleSha256, string rekorUuid, TimeSpan ttl, CancellationToken cancellationToken = default)
+    {
+        return _database.StringSetAsync(BuildKey(bundleSha256), rekorUuid, ttl);
+    }
+
+    private RedisKey BuildKey(string bundleSha256) => new RedisKey(_prefix + bundleSha256);
+}

src/StellaOps.Attestor/StellaOps.Attestor.Infrastructure/Storage/S3AttestorArchiveStore.cs

@@ -0,0 +1,72 @@
+using System;
+using System.IO;
+using System.Text.Json;
+using System.Threading;
+using System.Threading.Tasks;
+using Amazon.S3;
+using Amazon.S3.Model;
+using Microsoft.Extensions.Logging;
+using Microsoft.Extensions.Options;
+using StellaOps.Attestor.Core.Options;
+using StellaOps.Attestor.Core.Storage;
+
+namespace StellaOps.Attestor.Infrastructure.Storage;
+
+internal sealed class S3AttestorArchiveStore : IAttestorArchiveStore, IDisposable
+{
+    private readonly IAmazonS3 _s3;
+    private readonly AttestorOptions.S3Options _options;
+    private readonly ILogger<S3AttestorArchiveStore> _logger;
+    private bool _disposed;
+
+    public S3AttestorArchiveStore(IAmazonS3 s3, IOptions<AttestorOptions> options, ILogger<S3AttestorArchiveStore> logger)
+    {
+        _s3 = s3;
+        _options = options.Value.S3;
+        _logger = logger;
+    }
+
+    public async Task ArchiveBundleAsync(AttestorArchiveBundle bundle, CancellationToken cancellationToken = default)
+    {
+        if (string.IsNullOrWhiteSpace(_options.Bucket))
+        {
+            _logger.LogWarning("S3 archive bucket is not configured; skipping archive for bundle {Bundle}", bundle.BundleSha256);
+            return;
+        }
+
+        var prefix = _options.Prefix ?? "attest/";
+
+        await PutObjectAsync(prefix + "dsse/" + bundle.BundleSha256 + ".json", bundle.CanonicalBundleJson, cancellationToken).ConfigureAwait(false);
+        if (bundle.ProofJson.Length > 0)
+        {
+            await PutObjectAsync(prefix + "proof/" + bundle.RekorUuid + ".json", bundle.ProofJson, cancellationToken).ConfigureAwait(false);
+        }
+
+        var metadataObject = JsonSerializer.SerializeToUtf8Bytes(bundle.Metadata);
+        await PutObjectAsync(prefix + "meta/" + bundle.RekorUuid + ".json", metadataObject, cancellationToken).ConfigureAwait(false);
+    }
+
+    private Task PutObjectAsync(string key, byte[] content, CancellationToken cancellationToken)
+    {
+        using var stream = new MemoryStream(content);
+        var request = new PutObjectRequest
+        {
+            BucketName = _options.Bucket,
+            Key = key,
+            InputStream = stream,
+            AutoCloseStream = false
+        };
+        return _s3.PutObjectAsync(request, cancellationToken);
+    }
+
+    public void Dispose()
+    {
+        if (_disposed)
+        {
+            return;
+        }
+
+        _s3.Dispose();
+        _disposed = true;
+    }
+}

src/StellaOps.Attestor/StellaOps.Attestor.Infrastructure/Submission/AttestorSubmissionService.cs

@@ -0,0 +1,284 @@
+using System;
+using System.Collections.Generic;
+using System.Text.Json;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.Extensions.Logging;
+using Microsoft.Extensions.Options;
+using StellaOps.Attestor.Core.Audit;
+using StellaOps.Attestor.Core.Options;
+using StellaOps.Attestor.Core.Observability;
+using StellaOps.Attestor.Core.Rekor;
+using StellaOps.Attestor.Core.Storage;
+using StellaOps.Attestor.Core.Submission;
+
+namespace StellaOps.Attestor.Infrastructure.Submission;
+
+internal sealed class AttestorSubmissionService : IAttestorSubmissionService
+{
+    private static readonly TimeSpan DedupeTtl = TimeSpan.FromHours(48);
+
+    private readonly AttestorSubmissionValidator _validator;
+    private readonly IAttestorEntryRepository _repository;
+    private readonly IAttestorDedupeStore _dedupeStore;
+    private readonly IRekorClient _rekorClient;
+    private readonly IAttestorArchiveStore _archiveStore;
+    private readonly IAttestorAuditSink _auditSink;
+    private readonly ILogger<AttestorSubmissionService> _logger;
+    private readonly TimeProvider _timeProvider;
+    private readonly AttestorOptions _options;
+    private readonly AttestorMetrics _metrics;
+
+    public AttestorSubmissionService(
+        AttestorSubmissionValidator validator,
+        IAttestorEntryRepository repository,
+        IAttestorDedupeStore dedupeStore,
+        IRekorClient rekorClient,
+        IAttestorArchiveStore archiveStore,
+        IAttestorAuditSink auditSink,
+        IOptions<AttestorOptions> options,
+        ILogger<AttestorSubmissionService> logger,
+        TimeProvider timeProvider,
+        AttestorMetrics metrics)
+    {
+        _validator = validator;
+        _repository = repository;
+        _dedupeStore = dedupeStore;
+        _rekorClient = rekorClient;
+        _archiveStore = archiveStore;
+        _auditSink = auditSink;
+        _logger = logger;
+        _timeProvider = timeProvider;
+        _options = options.Value;
+        _metrics = metrics;
+    }
+
+    public async Task<AttestorSubmissionResult> SubmitAsync(
+        AttestorSubmissionRequest request,
+        SubmissionContext context,
+        CancellationToken cancellationToken = default)
+    {
+        var start = System.Diagnostics.Stopwatch.GetTimestamp();
+
+        var validation = await _validator.ValidateAsync(request, cancellationToken).ConfigureAwait(false);
+
+        var canonicalBundle = validation.CanonicalBundle;
+
+        var dedupeUuid = await _dedupeStore.TryGetExistingAsync(request.Meta.BundleSha256, cancellationToken).ConfigureAwait(false);
+        if (!string.IsNullOrEmpty(dedupeUuid))
+        {
+            _logger.LogInformation("Dedupe hit for bundle {BundleSha256} -> {RekorUuid}", request.Meta.BundleSha256, dedupeUuid);
+            _metrics.DedupeHitsTotal.Add(1, new KeyValuePair<string, object?>("result", "hit"));
+            var existing = await _repository.GetByUuidAsync(dedupeUuid, cancellationToken).ConfigureAwait(false)
+                ?? await _repository.GetByBundleShaAsync(request.Meta.BundleSha256, cancellationToken).ConfigureAwait(false);
+
+            if (existing is not null)
+            {
+                _metrics.SubmitTotal.Add(1,
+                    new KeyValuePair<string, object?>("result", "dedupe"),
+                    new KeyValuePair<string, object?>("backend", "cache"));
+                return ToResult(existing);
+            }
+        }
+        else
+        {
+            _metrics.DedupeHitsTotal.Add(1, new KeyValuePair<string, object?>("result", "miss"));
+        }
+
+        var primaryBackend = BuildBackend("primary", _options.Rekor.Primary);
+        RekorSubmissionResponse submissionResponse;
+        try
+        {
+            submissionResponse = await _rekorClient.SubmitAsync(request, primaryBackend, cancellationToken).ConfigureAwait(false);
+        }
+        catch (Exception ex)
+        {
+            _metrics.ErrorTotal.Add(1, new KeyValuePair<string, object?>("type", "submit"));
+            _logger.LogError(ex, "Failed to submit bundle {BundleSha} to Rekor backend {Backend}", request.Meta.BundleSha256, primaryBackend.Name);
+            throw;
+        }
+
+        var proof = submissionResponse.Proof;
+        if (proof is null && string.Equals(submissionResponse.Status, "included", StringComparison.OrdinalIgnoreCase))
+        {
+            try
+            {
+                proof = await _rekorClient.GetProofAsync(submissionResponse.Uuid, primaryBackend, cancellationToken).ConfigureAwait(false);
+                _metrics.ProofFetchTotal.Add(1,
+                    new KeyValuePair<string, object?>("result", proof is null ? "missing" : "ok"));
+            }
+            catch (Exception ex)
+            {
+                _metrics.ErrorTotal.Add(1, new KeyValuePair<string, object?>("type", "proof_fetch"));
+                _logger.LogWarning(ex, "Proof fetch failed for {Uuid} on backend {Backend}", submissionResponse.Uuid, primaryBackend.Name);
+            }
+        }
+
+        var entry = CreateEntry(request, submissionResponse, proof, context, canonicalBundle);
+        await _repository.SaveAsync(entry, cancellationToken).ConfigureAwait(false);
+        await _dedupeStore.SetAsync(request.Meta.BundleSha256, entry.RekorUuid, DedupeTtl, cancellationToken).ConfigureAwait(false);
+
+        if (request.Meta.Archive)
+        {
+            var archiveBundle = new AttestorArchiveBundle
+            {
+                RekorUuid = entry.RekorUuid,
+                ArtifactSha256 = entry.Artifact.Sha256,
+                BundleSha256 = entry.BundleSha256,
+                CanonicalBundleJson = canonicalBundle,
+                ProofJson = proof is null ? Array.Empty<byte>() : JsonSerializer.SerializeToUtf8Bytes(proof, JsonSerializerOptions.Default),
+                Metadata = new Dictionary<string, string>
+                {
+                    ["logUrl"] = entry.Log.Url,
+                    ["status"] = entry.Status
+                }
+            };
+
+            try
+            {
+                await _archiveStore.ArchiveBundleAsync(archiveBundle, cancellationToken).ConfigureAwait(false);
+            }
+            catch (Exception ex)
+            {
+                _logger.LogWarning(ex, "Failed to archive bundle {BundleSha}", entry.BundleSha256);
+                _metrics.ErrorTotal.Add(1, new KeyValuePair<string, object?>("type", "archive"));
+            }
+        }
+
+        var elapsed = System.Diagnostics.Stopwatch.GetElapsedTime(start, System.Diagnostics.Stopwatch.GetTimestamp());
+        _metrics.SubmitTotal.Add(1,
+            new KeyValuePair<string, object?>("result", submissionResponse.Status ?? "unknown"),
+            new KeyValuePair<string, object?>("backend", primaryBackend.Name));
+        _metrics.SubmitLatency.Record(elapsed.TotalSeconds, new KeyValuePair<string, object?>("backend", primaryBackend.Name));
+        await WriteAuditAsync(request, context, entry, submissionResponse, (long)elapsed.TotalMilliseconds, cancellationToken).ConfigureAwait(false);
+
+        return ToResult(entry);
+    }
+
+    private static AttestorSubmissionResult ToResult(AttestorEntry entry)
+    {
+        return new AttestorSubmissionResult
+        {
+            Uuid = entry.RekorUuid,
+            Index = entry.Index,
+            LogUrl = entry.Log.Url,
+            Status = entry.Status,
+            Proof = entry.Proof is null ? null : new AttestorSubmissionResult.RekorProof
+            {
+                Checkpoint = entry.Proof.Checkpoint is null ? null : new AttestorSubmissionResult.Checkpoint
+                {
+                    Origin = entry.Proof.Checkpoint.Origin,
+                    Size = entry.Proof.Checkpoint.Size,
+                    RootHash = entry.Proof.Checkpoint.RootHash,
+                    Timestamp = entry.Proof.Checkpoint.Timestamp?.ToString("O")
+                },
+                Inclusion = entry.Proof.Inclusion is null ? null : new AttestorSubmissionResult.InclusionProof
+                {
+                    LeafHash = entry.Proof.Inclusion.LeafHash,
+                    Path = entry.Proof.Inclusion.Path
+                }
+            }
+        };
+    }
+
+    private AttestorEntry CreateEntry(
+        AttestorSubmissionRequest request,
+        RekorSubmissionResponse submission,
+        RekorProofResponse? proof,
+        SubmissionContext context,
+        byte[] canonicalBundle)
+    {
+        var now = _timeProvider.GetUtcNow();
+        return new AttestorEntry
+        {
+            RekorUuid = submission.Uuid,
+            Artifact = new AttestorEntry.ArtifactDescriptor
+            {
+                Sha256 = request.Meta.Artifact.Sha256,
+                Kind = request.Meta.Artifact.Kind,
+                ImageDigest = request.Meta.Artifact.ImageDigest,
+                SubjectUri = request.Meta.Artifact.SubjectUri
+            },
+            BundleSha256 = request.Meta.BundleSha256,
+            Index = submission.Index,
+            Proof = proof is null ? null : new AttestorEntry.ProofDescriptor
+            {
+                Checkpoint = proof.Checkpoint is null ? null : new AttestorEntry.CheckpointDescriptor
+                {
+                    Origin = proof.Checkpoint.Origin,
+                    Size = proof.Checkpoint.Size,
+                    RootHash = proof.Checkpoint.RootHash,
+                    Timestamp = proof.Checkpoint.Timestamp
+                },
+                Inclusion = proof.Inclusion is null ? null : new AttestorEntry.InclusionDescriptor
+                {
+                    LeafHash = proof.Inclusion.LeafHash,
+                    Path = proof.Inclusion.Path
+                }
+            },
+            Log = new AttestorEntry.LogDescriptor
+            {
+                Url = submission.LogUrl ?? string.Empty,
+                LogId = null
+            },
+            CreatedAt = now,
+            Status = submission.Status ?? "included",
+            SignerIdentity = new AttestorEntry.SignerIdentityDescriptor
+            {
+                Mode = request.Bundle.Mode,
+                Issuer = context.CallerAudience,
+                SubjectAlternativeName = context.CallerSubject,
+                KeyId = context.CallerClientId
+            }
+        };
+    }
+
+    private Task WriteAuditAsync(
+        AttestorSubmissionRequest request,
+        SubmissionContext context,
+        AttestorEntry entry,
+        RekorSubmissionResponse submission,
+        long latencyMs,
+        CancellationToken cancellationToken)
+    {
+        var record = new AttestorAuditRecord
+        {
+            Action = "submit",
+            Result = submission.Status ?? "included",
+            RekorUuid = submission.Uuid,
+            Index = submission.Index,
+            ArtifactSha256 = request.Meta.Artifact.Sha256,
+            BundleSha256 = request.Meta.BundleSha256,
+            Backend = "primary",
+            LatencyMs = latencyMs,
+            Timestamp = _timeProvider.GetUtcNow(),
+            Caller = new AttestorAuditRecord.CallerDescriptor
+            {
+                Subject = context.CallerSubject,
+                Audience = context.CallerAudience,
+                ClientId = context.CallerClientId,
+                MtlsThumbprint = context.MtlsThumbprint,
+                Tenant = context.CallerTenant
+            }
+        };
+
+        return _auditSink.WriteAsync(record, cancellationToken);
+    }
+
+    private static RekorBackend BuildBackend(string name, AttestorOptions.RekorBackendOptions options)
+    {
+        if (string.IsNullOrWhiteSpace(options.Url))
+        {
+            throw new InvalidOperationException($"Rekor backend '{name}' is not configured.");
+        }
+
+        return new RekorBackend
+        {
+            Name = name,
+            Url = new Uri(options.Url, UriKind.Absolute),
+            ProofTimeout = TimeSpan.FromMilliseconds(options.ProofTimeoutMs),
+            PollInterval = TimeSpan.FromMilliseconds(options.PollIntervalMs),
+            MaxAttempts = options.MaxAttempts
+        };
+    }
+}

src/StellaOps.Attestor/StellaOps.Attestor.Infrastructure/Submission/DefaultDsseCanonicalizer.cs

@@ -0,0 +1,49 @@
+using System.Text.Json;
+using System.Text.Json.Nodes;
+using System.Threading;
+using System.Threading.Tasks;
+using StellaOps.Attestor.Core.Submission;
+
+namespace StellaOps.Attestor.Infrastructure.Submission;
+
+public sealed class DefaultDsseCanonicalizer : IDsseCanonicalizer
+{
+    private static readonly JsonSerializerOptions SerializerOptions = new(JsonSerializerDefaults.Web)
+    {
+        WriteIndented = false,
+        PropertyNamingPolicy = JsonNamingPolicy.CamelCase
+    };
+
+    public Task<byte[]> CanonicalizeAsync(AttestorSubmissionRequest request, CancellationToken cancellationToken = default)
+    {
+        var node = new JsonObject
+        {
+            ["payloadType"] = request.Bundle.Dsse.PayloadType,
+            ["payload"] = request.Bundle.Dsse.PayloadBase64,
+            ["signatures"] = CreateSignaturesArray(request)
+        };
+
+        var json = node.ToJsonString(SerializerOptions);
+        return Task.FromResult(JsonSerializer.SerializeToUtf8Bytes(JsonNode.Parse(json)!, SerializerOptions));
+    }
+
+    private static JsonArray CreateSignaturesArray(AttestorSubmissionRequest request)
+    {
+        var array = new JsonArray();
+        foreach (var signature in request.Bundle.Dsse.Signatures)
+        {
+            var obj = new JsonObject
+            {
+                ["sig"] = signature.Signature
+            };
+            if (!string.IsNullOrWhiteSpace(signature.KeyId))
+            {
+                obj["keyid"] = signature.KeyId;
+            }
+
+            array.Add(obj);
+        }
+
+        return array;
+    }
+}

src/StellaOps.Attestor/StellaOps.Attestor.Infrastructure/Verification/AttestorVerificationService.cs

@@ -0,0 +1,261 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.Extensions.Logging;
+using Microsoft.Extensions.Options;
+using StellaOps.Attestor.Core.Options;
+using StellaOps.Attestor.Core.Rekor;
+using StellaOps.Attestor.Core.Storage;
+using StellaOps.Attestor.Core.Submission;
+using StellaOps.Attestor.Core.Verification;
+using System.Security.Cryptography;
+
+namespace StellaOps.Attestor.Infrastructure.Verification;
+
+internal sealed class AttestorVerificationService : IAttestorVerificationService
+{
+    private readonly IAttestorEntryRepository _repository;
+    private readonly IDsseCanonicalizer _canonicalizer;
+    private readonly IRekorClient _rekorClient;
+    private readonly ILogger<AttestorVerificationService> _logger;
+    private readonly AttestorOptions _options;
+
+    public AttestorVerificationService(
+        IAttestorEntryRepository repository,
+        IDsseCanonicalizer canonicalizer,
+        IRekorClient rekorClient,
+        IOptions<AttestorOptions> options,
+        ILogger<AttestorVerificationService> logger)
+    {
+        _repository = repository;
+        _canonicalizer = canonicalizer;
+        _rekorClient = rekorClient;
+        _logger = logger;
+        _options = options.Value;
+    }
+
+    public async Task<AttestorVerificationResult> VerifyAsync(AttestorVerificationRequest request, CancellationToken cancellationToken = default)
+    {
+        if (request is null)
+        {
+            throw new ArgumentNullException(nameof(request));
+        }
+
+        var entry = await ResolveEntryAsync(request, cancellationToken).ConfigureAwait(false);
+        if (entry is null)
+        {
+            throw new AttestorVerificationException("not_found", "No attestor entry matched the supplied query.");
+        }
+
+        var issues = new List<string>();
+
+        if (request.Bundle is not null)
+        {
+            var canonicalBundle = await _canonicalizer.CanonicalizeAsync(new AttestorSubmissionRequest
+            {
+                Bundle = request.Bundle,
+                Meta = new AttestorSubmissionRequest.SubmissionMeta
+                {
+                    Artifact = new AttestorSubmissionRequest.ArtifactInfo
+                    {
+                        Sha256 = entry.Artifact.Sha256,
+                        Kind = entry.Artifact.Kind
+                    },
+                    BundleSha256 = entry.BundleSha256
+                }
+            }, cancellationToken).ConfigureAwait(false);
+
+            var computedHash = Convert.ToHexString(System.Security.Cryptography.SHA256.HashData(canonicalBundle)).ToLowerInvariant();
+            if (!string.Equals(computedHash, entry.BundleSha256, StringComparison.OrdinalIgnoreCase))
+            {
+                issues.Add("Bundle hash does not match stored canonical hash.");
+            }
+        }
+
+        if (request.RefreshProof || entry.Proof is null)
+        {
+            var backend = BuildBackend("primary", _options.Rekor.Primary);
+            try
+            {
+                var proof = await _rekorClient.GetProofAsync(entry.RekorUuid, backend, cancellationToken).ConfigureAwait(false);
+                if (proof is not null)
+                {
+                    var updated = CloneWithProof(entry, proof.ToProofDescriptor());
+                    await _repository.SaveAsync(updated, cancellationToken).ConfigureAwait(false);
+                    entry = updated;
+                }
+            }
+            catch (Exception ex)
+            {
+                _logger.LogWarning(ex, "Failed to refresh proof for entry {Uuid}", entry.RekorUuid);
+                issues.Add("Proof refresh failed: " + ex.Message);
+            }
+        }
+
+        var ok = issues.Count == 0 && string.Equals(entry.Status, "included", StringComparison.OrdinalIgnoreCase);
+
+        return new AttestorVerificationResult
+        {
+            Ok = ok,
+            Uuid = entry.RekorUuid,
+            Index = entry.Index,
+            LogUrl = entry.Log.Url,
+            Status = entry.Status,
+            Issues = issues,
+            CheckedAt = DateTimeOffset.UtcNow
+        };
+    }
+
+    public Task<AttestorEntry?> GetEntryAsync(string rekorUuid, bool refreshProof, CancellationToken cancellationToken = default)
+    {
+        if (string.IsNullOrWhiteSpace(rekorUuid))
+        {
+            throw new ArgumentException("Value cannot be null or whitespace.", nameof(rekorUuid));
+        }
+
+        return ResolveEntryByUuidAsync(rekorUuid, refreshProof, cancellationToken);
+    }
+
+    private async Task<AttestorEntry?> ResolveEntryAsync(AttestorVerificationRequest request, CancellationToken cancellationToken)
+    {
+        if (!string.IsNullOrWhiteSpace(request.Uuid))
+        {
+            return await ResolveEntryByUuidAsync(request.Uuid, request.RefreshProof, cancellationToken).ConfigureAwait(false);
+        }
+
+        if (request.Bundle is not null)
+        {
+            var canonical = await _canonicalizer.CanonicalizeAsync(new AttestorSubmissionRequest
+            {
+                Bundle = request.Bundle,
+                Meta = new AttestorSubmissionRequest.SubmissionMeta
+                {
+                    Artifact = new AttestorSubmissionRequest.ArtifactInfo
+                    {
+                        Sha256 = string.Empty,
+                        Kind = string.Empty
+                    }
+                }
+            }, cancellationToken).ConfigureAwait(false);
+
+            var bundleSha = Convert.ToHexString(System.Security.Cryptography.SHA256.HashData(canonical)).ToLowerInvariant();
+            return await ResolveEntryByBundleShaAsync(bundleSha, request.RefreshProof, cancellationToken).ConfigureAwait(false);
+        }
+
+        if (!string.IsNullOrWhiteSpace(request.ArtifactSha256))
+        {
+            return await ResolveEntryByArtifactAsync(request.ArtifactSha256, request.RefreshProof, cancellationToken).ConfigureAwait(false);
+        }
+
+        throw new AttestorVerificationException("invalid_query", "At least one of uuid, bundle, or artifactSha256 must be provided.");
+    }
+
+    private async Task<AttestorEntry?> ResolveEntryByUuidAsync(string uuid, bool refreshProof, CancellationToken cancellationToken)
+    {
+        var entry = await _repository.GetByUuidAsync(uuid, cancellationToken).ConfigureAwait(false);
+        if (entry is null || !refreshProof)
+        {
+            return entry;
+        }
+
+        var backend = BuildBackend("primary", _options.Rekor.Primary);
+        try
+        {
+            var proof = await _rekorClient.GetProofAsync(uuid, backend, cancellationToken).ConfigureAwait(false);
+            if (proof is not null)
+            {
+                var updated = CloneWithProof(entry, proof.ToProofDescriptor());
+                await _repository.SaveAsync(updated, cancellationToken).ConfigureAwait(false);
+                entry = updated;
+            }
+        }
+        catch (Exception ex)
+        {
+            _logger.LogWarning(ex, "Failed to refresh proof for entry {Uuid}", uuid);
+        }
+
+        return entry;
+    }
+
+    private async Task<AttestorEntry?> ResolveEntryByBundleShaAsync(string bundleSha, bool refreshProof, CancellationToken cancellationToken)
+    {
+        var entry = await _repository.GetByBundleShaAsync(bundleSha, cancellationToken).ConfigureAwait(false);
+        if (entry is null || !refreshProof)
+        {
+            return entry;
+        }
+
+        return await ResolveEntryByUuidAsync(entry.RekorUuid, true, cancellationToken).ConfigureAwait(false);
+    }
+
+    private async Task<AttestorEntry?> ResolveEntryByArtifactAsync(string artifactSha256, bool refreshProof, CancellationToken cancellationToken)
+    {
+        var entries = await _repository.GetByArtifactShaAsync(artifactSha256, cancellationToken).ConfigureAwait(false);
+        var entry = entries.OrderByDescending(e => e.CreatedAt).FirstOrDefault();
+        if (entry is null)
+        {
+            return null;
+        }
+
+        return refreshProof
+            ? await ResolveEntryByUuidAsync(entry.RekorUuid, true, cancellationToken).ConfigureAwait(false)
+            : entry;
+    }
+
+    private static AttestorEntry CloneWithProof(AttestorEntry entry, AttestorEntry.ProofDescriptor? proof)
+    {
+        return new AttestorEntry
+        {
+            RekorUuid = entry.RekorUuid,
+            Artifact = entry.Artifact,
+            BundleSha256 = entry.BundleSha256,
+            Index = entry.Index,
+            Proof = proof,
+            Log = entry.Log,
+            CreatedAt = entry.CreatedAt,
+            Status = entry.Status,
+            SignerIdentity = entry.SignerIdentity
+        };
+    }
+
+    private static RekorBackend BuildBackend(string name, AttestorOptions.RekorBackendOptions options)
+    {
+        if (string.IsNullOrWhiteSpace(options.Url))
+        {
+            throw new InvalidOperationException($"Rekor backend '{name}' is not configured.");
+        }
+
+        return new RekorBackend
+        {
+            Name = name,
+            Url = new Uri(options.Url, UriKind.Absolute),
+            ProofTimeout = TimeSpan.FromMilliseconds(options.ProofTimeoutMs),
+            PollInterval = TimeSpan.FromMilliseconds(options.PollIntervalMs),
+            MaxAttempts = options.MaxAttempts
+        };
+    }
+}
+
+internal static class RekorProofResponseExtensions
+{
+    public static AttestorEntry.ProofDescriptor ToProofDescriptor(this RekorProofResponse response)
+    {
+        return new AttestorEntry.ProofDescriptor
+        {
+            Checkpoint = response.Checkpoint is null ? null : new AttestorEntry.CheckpointDescriptor
+            {
+                Origin = response.Checkpoint.Origin,
+                Size = response.Checkpoint.Size,
+                RootHash = response.Checkpoint.RootHash,
+                Timestamp = response.Checkpoint.Timestamp
+            },
+            Inclusion = response.Inclusion is null ? null : new AttestorEntry.InclusionDescriptor
+            {
+                LeafHash = response.Inclusion.LeafHash,
+                Path = response.Inclusion.Path
+            }
+        };
+    }
+}

src/StellaOps.Attestor/StellaOps.Attestor.Tests/AttestorSubmissionServiceTests.cs

@@ -0,0 +1,120 @@
+using System;
+using System.Security.Cryptography;
+using System.Text;
+using System.Threading.Tasks;
+using Microsoft.Extensions.Logging.Abstractions;
+using Microsoft.Extensions.Options;
+using StellaOps.Attestor.Core.Options;
+using StellaOps.Attestor.Core.Submission;
+using StellaOps.Attestor.Core.Observability;
+using StellaOps.Attestor.Infrastructure.Rekor;
+using StellaOps.Attestor.Infrastructure.Storage;
+using StellaOps.Attestor.Infrastructure.Submission;
+using Xunit;
+
+namespace StellaOps.Attestor.Tests;
+
+public sealed class AttestorSubmissionServiceTests
+{
+    [Fact]
+    public async Task SubmitAsync_ReturnsDeterministicUuid_OnDuplicateBundle()
+    {
+        var options = Options.Create(new AttestorOptions
+        {
+            Redis = new AttestorOptions.RedisOptions
+            {
+                Url = string.Empty
+            },
+            Rekor = new AttestorOptions.RekorOptions
+            {
+                Primary = new AttestorOptions.RekorBackendOptions
+                {
+                    Url = "https://rekor.stellaops.test",
+                    ProofTimeoutMs = 1000,
+                    PollIntervalMs = 50,
+                    MaxAttempts = 2
+                }
+            }
+        });
+
+        var canonicalizer = new DefaultDsseCanonicalizer();
+        var validator = new AttestorSubmissionValidator(canonicalizer);
+        var repository = new InMemoryAttestorEntryRepository();
+        var dedupeStore = new InMemoryAttestorDedupeStore();
+        var rekorClient = new StubRekorClient(new NullLogger<StubRekorClient>());
+        var archiveStore = new NullAttestorArchiveStore(new NullLogger<NullAttestorArchiveStore>());
+        var auditSink = new InMemoryAttestorAuditSink();
+        var logger = new NullLogger<AttestorSubmissionService>();
+        using var metrics = new AttestorMetrics();
+        var service = new AttestorSubmissionService(
+            validator,
+            repository,
+            dedupeStore,
+            rekorClient,
+            archiveStore,
+            auditSink,
+            options,
+            logger,
+            TimeProvider.System,
+            metrics);
+
+        var request = CreateValidRequest(canonicalizer);
+        var context = new SubmissionContext
+        {
+            CallerSubject = "urn:stellaops:signer",
+            CallerAudience = "attestor",
+            CallerClientId = "signer-service",
+            CallerTenant = "default",
+            ClientCertificate = null,
+            MtlsThumbprint = "00"
+        };
+
+        var first = await service.SubmitAsync(request, context);
+        var second = await service.SubmitAsync(request, context);
+
+        Assert.NotNull(first.Uuid);
+        Assert.Equal(first.Uuid, second.Uuid);
+
+        var stored = await repository.GetByBundleShaAsync(request.Meta.BundleSha256);
+        Assert.NotNull(stored);
+        Assert.Equal(first.Uuid, stored!.RekorUuid);
+    }
+
+    private static AttestorSubmissionRequest CreateValidRequest(DefaultDsseCanonicalizer canonicalizer)
+    {
+        var request = new AttestorSubmissionRequest
+        {
+            Bundle = new AttestorSubmissionRequest.SubmissionBundle
+            {
+                Mode = "keyless",
+                Dsse = new AttestorSubmissionRequest.DsseEnvelope
+                {
+                    PayloadType = "application/vnd.in-toto+json",
+                    PayloadBase64 = Convert.ToBase64String(System.Text.Encoding.UTF8.GetBytes("{}")),
+                    Signatures =
+                    {
+                        new AttestorSubmissionRequest.DsseSignature
+                        {
+                            KeyId = "test",
+                            Signature = Convert.ToBase64String(RandomNumberGenerator.GetBytes(32))
+                        }
+                    }
+                }
+            },
+            Meta = new AttestorSubmissionRequest.SubmissionMeta
+            {
+                Artifact = new AttestorSubmissionRequest.ArtifactInfo
+                {
+                    Sha256 = new string('a', 64),
+                    Kind = "sbom"
+                },
+                LogPreference = "primary",
+                Archive = false
+            }
+        };
+
+        var canonical = canonicalizer.CanonicalizeAsync(request).GetAwaiter().GetResult();
+        request.Meta.BundleSha256 = Convert.ToHexString(SHA256.HashData(canonical)).ToLowerInvariant();
+        return request;
+    }
+}

src/StellaOps.Attestor/StellaOps.Attestor.Tests/AttestorVerificationServiceTests.cs

@@ -0,0 +1,194 @@
+using System.Security.Cryptography;
+using System.Text;
+using System.Threading.Tasks;
+using Microsoft.Extensions.Logging.Abstractions;
+using Microsoft.Extensions.Options;
+using StellaOps.Attestor.Core.Options;
+using StellaOps.Attestor.Core.Submission;
+using StellaOps.Attestor.Core.Verification;
+using StellaOps.Attestor.Infrastructure.Storage;
+using StellaOps.Attestor.Infrastructure.Submission;
+using StellaOps.Attestor.Infrastructure.Verification;
+using StellaOps.Attestor.Infrastructure.Rekor;
+using StellaOps.Attestor.Core.Observability;
+using Xunit;
+
+namespace StellaOps.Attestor.Tests;
+
+public sealed class AttestorVerificationServiceTests
+{
+    [Fact]
+    public async Task VerifyAsync_ReturnsOk_ForExistingUuid()
+    {
+        var options = Options.Create(new AttestorOptions
+        {
+            Redis = new AttestorOptions.RedisOptions
+            {
+                Url = string.Empty
+            },
+            Rekor = new AttestorOptions.RekorOptions
+            {
+                Primary = new AttestorOptions.RekorBackendOptions
+                {
+                    Url = "https://rekor.stellaops.test",
+                    ProofTimeoutMs = 1000,
+                    PollIntervalMs = 50,
+                    MaxAttempts = 2
+                }
+            }
+        });
+
+        using var metrics = new AttestorMetrics();
+        var canonicalizer = new DefaultDsseCanonicalizer();
+        var repository = new InMemoryAttestorEntryRepository();
+        var dedupeStore = new InMemoryAttestorDedupeStore();
+        var rekorClient = new StubRekorClient(new NullLogger<StubRekorClient>());
+        var archiveStore = new NullAttestorArchiveStore(new NullLogger<NullAttestorArchiveStore>());
+        var auditSink = new InMemoryAttestorAuditSink();
+        var submissionService = new AttestorSubmissionService(
+            new AttestorSubmissionValidator(canonicalizer),
+            repository,
+            dedupeStore,
+            rekorClient,
+            archiveStore,
+            auditSink,
+            options,
+            new NullLogger<AttestorSubmissionService>(),
+            TimeProvider.System,
+            metrics);
+
+        var submission = CreateSubmissionRequest(canonicalizer);
+        var context = new SubmissionContext
+        {
+            CallerSubject = "urn:stellaops:signer",
+            CallerAudience = "attestor",
+            CallerClientId = "signer-service",
+            CallerTenant = "default"
+        };
+
+        var response = await submissionService.SubmitAsync(submission, context);
+
+        var verificationService = new AttestorVerificationService(
+            repository,
+            canonicalizer,
+            rekorClient,
+            options,
+            new NullLogger<AttestorVerificationService>());
+
+        var verifyResult = await verificationService.VerifyAsync(new AttestorVerificationRequest
+        {
+            Uuid = response.Uuid
+        });
+
+        Assert.True(verifyResult.Ok);
+        Assert.Equal(response.Uuid, verifyResult.Uuid);
+        Assert.Empty(verifyResult.Issues);
+    }
+
+    [Fact]
+    public async Task VerifyAsync_FlagsTamperedBundle()
+    {
+        var options = Options.Create(new AttestorOptions
+        {
+            Redis = new AttestorOptions.RedisOptions { Url = string.Empty },
+            Rekor = new AttestorOptions.RekorOptions
+            {
+                Primary = new AttestorOptions.RekorBackendOptions
+                {
+                    Url = "https://rekor.example/",
+                    ProofTimeoutMs = 1000,
+                    PollIntervalMs = 50,
+                    MaxAttempts = 2
+                }
+            }
+        });
+
+        using var metrics = new AttestorMetrics();
+        var canonicalizer = new DefaultDsseCanonicalizer();
+        var repository = new InMemoryAttestorEntryRepository();
+        var dedupeStore = new InMemoryAttestorDedupeStore();
+        var rekorClient = new StubRekorClient(new NullLogger<StubRekorClient>());
+        var archiveStore = new NullAttestorArchiveStore(new NullLogger<NullAttestorArchiveStore>());
+        var auditSink = new InMemoryAttestorAuditSink();
+        var submissionService = new AttestorSubmissionService(
+            new AttestorSubmissionValidator(canonicalizer),
+            repository,
+            dedupeStore,
+            rekorClient,
+            archiveStore,
+            auditSink,
+            options,
+            new NullLogger<AttestorSubmissionService>(),
+            TimeProvider.System,
+            metrics);
+
+        var submission = CreateSubmissionRequest(canonicalizer);
+        var context = new SubmissionContext
+        {
+            CallerSubject = "urn:stellaops:signer",
+            CallerAudience = "attestor",
+            CallerClientId = "signer-service",
+            CallerTenant = "default"
+        };
+
+        var response = await submissionService.SubmitAsync(submission, context);
+
+        var verificationService = new AttestorVerificationService(
+            repository,
+            canonicalizer,
+            rekorClient,
+            options,
+            new NullLogger<AttestorVerificationService>());
+
+        var tamperedBundle = submission.Bundle;
+        tamperedBundle.Dsse.PayloadBase64 = Convert.ToBase64String(Encoding.UTF8.GetBytes("{\"tampered\":true}"));
+
+        var result = await verificationService.VerifyAsync(new AttestorVerificationRequest
+        {
+            Uuid = response.Uuid,
+            Bundle = tamperedBundle
+        });
+
+        Assert.False(result.Ok);
+        Assert.Contains(result.Issues, issue => issue.Contains("Bundle hash", StringComparison.OrdinalIgnoreCase));
+    }
+
+    private static AttestorSubmissionRequest CreateSubmissionRequest(DefaultDsseCanonicalizer canonicalizer)
+    {
+        var payload = Encoding.UTF8.GetBytes("{}");
+        var request = new AttestorSubmissionRequest
+        {
+            Bundle = new AttestorSubmissionRequest.SubmissionBundle
+            {
+                Mode = "keyless",
+                Dsse = new AttestorSubmissionRequest.DsseEnvelope
+                {
+                    PayloadType = "application/vnd.in-toto+json",
+                    PayloadBase64 = Convert.ToBase64String(payload),
+                    Signatures =
+                    {
+                        new AttestorSubmissionRequest.DsseSignature
+                        {
+                            KeyId = "test",
+                            Signature = Convert.ToBase64String(RandomNumberGenerator.GetBytes(32))
+                        }
+                    }
+                }
+            },
+            Meta = new AttestorSubmissionRequest.SubmissionMeta
+            {
+                Artifact = new AttestorSubmissionRequest.ArtifactInfo
+                {
+                    Sha256 = new string('a', 64),
+                    Kind = "sbom"
+                },
+                LogPreference = "primary",
+                Archive = false
+            }
+        };
+
+        var canonical = canonicalizer.CanonicalizeAsync(request).GetAwaiter().GetResult();
+        request.Meta.BundleSha256 = Convert.ToHexString(SHA256.HashData(canonical)).ToLowerInvariant();
+        return request;
+    }
+}

src/StellaOps.Attestor/StellaOps.Attestor.Tests/HttpRekorClientTests.cs

@@ -0,0 +1,149 @@
+using System;
+using System.Net;
+using System.Net.Http;
+using System.Text;
+using System.Text.Json;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.Extensions.Logging.Abstractions;
+using StellaOps.Attestor.Core.Rekor;
+using StellaOps.Attestor.Core.Submission;
+using StellaOps.Attestor.Infrastructure.Rekor;
+using Xunit;
+
+namespace StellaOps.Attestor.Tests;
+
+public sealed class HttpRekorClientTests
+{
+    [Fact]
+    public async Task SubmitAsync_ParsesResponse()
+    {
+        var payload = new
+        {
+            uuid = "123",
+            index = 42,
+            logURL = "https://rekor.example/api/v2/log/entries/123",
+            status = "included",
+            proof = new
+            {
+                checkpoint = new { origin = "rekor", size = 10, rootHash = "abc", timestamp = "2025-10-19T00:00:00Z" },
+                inclusion = new { leafHash = "leaf", path = new[] { "p1", "p2" } }
+            }
+        };
+
+        var client = CreateClient(HttpStatusCode.Created, payload);
+        var rekorClient = new HttpRekorClient(client, NullLogger<HttpRekorClient>.Instance);
+
+        var request = new AttestorSubmissionRequest
+        {
+            Bundle = new AttestorSubmissionRequest.SubmissionBundle
+            {
+                Dsse = new AttestorSubmissionRequest.DsseEnvelope
+                {
+                    PayloadType = "application/json",
+                    PayloadBase64 = Convert.ToBase64String(Encoding.UTF8.GetBytes("{}")),
+                    Signatures = { new AttestorSubmissionRequest.DsseSignature { Signature = "sig" } }
+                }
+            }
+        };
+
+        var backend = new RekorBackend
+        {
+            Name = "primary",
+            Url = new Uri("https://rekor.example/"),
+            ProofTimeout = TimeSpan.FromSeconds(1),
+            PollInterval = TimeSpan.FromMilliseconds(100),
+            MaxAttempts = 1
+        };
+
+        var response = await rekorClient.SubmitAsync(request, backend);
+
+        Assert.Equal("123", response.Uuid);
+        Assert.Equal(42, response.Index);
+        Assert.Equal("included", response.Status);
+        Assert.NotNull(response.Proof);
+        Assert.Equal("leaf", response.Proof!.Inclusion!.LeafHash);
+    }
+
+    [Fact]
+    public async Task SubmitAsync_ThrowsOnConflict()
+    {
+        var client = CreateClient(HttpStatusCode.Conflict, new { error = "duplicate" });
+        var rekorClient = new HttpRekorClient(client, NullLogger<HttpRekorClient>.Instance);
+
+        var request = new AttestorSubmissionRequest
+        {
+            Bundle = new AttestorSubmissionRequest.SubmissionBundle
+            {
+                Dsse = new AttestorSubmissionRequest.DsseEnvelope
+                {
+                    PayloadType = "application/json",
+                    PayloadBase64 = Convert.ToBase64String(Encoding.UTF8.GetBytes("{}")),
+                    Signatures = { new AttestorSubmissionRequest.DsseSignature { Signature = "sig" } }
+                }
+            }
+        };
+
+        var backend = new RekorBackend
+        {
+            Name = "primary",
+            Url = new Uri("https://rekor.example/"),
+            ProofTimeout = TimeSpan.FromSeconds(1),
+            PollInterval = TimeSpan.FromMilliseconds(100),
+            MaxAttempts = 1
+        };
+
+        await Assert.ThrowsAsync<InvalidOperationException>(() => rekorClient.SubmitAsync(request, backend));
+    }
+
+    [Fact]
+    public async Task GetProofAsync_ReturnsNullOnNotFound()
+    {
+        var client = CreateClient(HttpStatusCode.NotFound, new { });
+        var rekorClient = new HttpRekorClient(client, NullLogger<HttpRekorClient>.Instance);
+
+        var backend = new RekorBackend
+        {
+            Name = "primary",
+            Url = new Uri("https://rekor.example/"),
+            ProofTimeout = TimeSpan.FromSeconds(1),
+            PollInterval = TimeSpan.FromMilliseconds(100),
+            MaxAttempts = 1
+        };
+
+        var proof = await rekorClient.GetProofAsync("abc", backend);
+        Assert.Null(proof);
+    }
+
+    private static HttpClient CreateClient(HttpStatusCode statusCode, object payload)
+    {
+        var handler = new StubHandler(statusCode, payload);
+        return new HttpClient(handler)
+        {
+            BaseAddress = new Uri("https://rekor.example/")
+        };
+    }
+
+    private sealed class StubHandler : HttpMessageHandler
+    {
+        private readonly HttpStatusCode _statusCode;
+        private readonly object _payload;
+
+        public StubHandler(HttpStatusCode statusCode, object payload)
+        {
+            _statusCode = statusCode;
+            _payload = payload;
+        }
+
+        protected override Task<HttpResponseMessage> SendAsync(HttpRequestMessage request, CancellationToken cancellationToken)
+        {
+            var json = JsonSerializer.Serialize(_payload);
+            var response = new HttpResponseMessage(_statusCode)
+            {
+                Content = new StringContent(json, Encoding.UTF8, "application/json")
+            };
+
+            return Task.FromResult(response);
+        }
+    }
+}

src/StellaOps.Attestor/StellaOps.Attestor.Tests/StellaOps.Attestor.Tests.csproj

@@ -0,0 +1,25 @@
+<Project Sdk="Microsoft.NET.Sdk">
+  <PropertyGroup>
+    <TargetFramework>net10.0</TargetFramework>
+    <LangVersion>preview</LangVersion>
+    <Nullable>enable</Nullable>
+    <ImplicitUsings>enable</ImplicitUsings>
+    <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
+    <UseConcelierTestInfra>false</UseConcelierTestInfra>
+  </PropertyGroup>
+  <ItemGroup>
+    <PackageReference Include="Microsoft.AspNetCore.Mvc.Testing" Version="8.0.8" />
+    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.14.0" />
+    <PackageReference Include="Mongo2Go" Version="3.1.3" />
+    <PackageReference Include="xunit" Version="2.9.2" />
+    <PackageReference Include="xunit.runner.visualstudio" Version="2.8.2" />
+    <PackageReference Include="coverlet.collector" Version="6.0.4" />
+  </ItemGroup>
+  <ItemGroup>
+    <ProjectReference Include="..\StellaOps.Attestor.WebService\StellaOps.Attestor.WebService.csproj" />
+    <ProjectReference Include="..\StellaOps.Attestor.Infrastructure\StellaOps.Attestor.Infrastructure.csproj" />
+    <ProjectReference Include="..\StellaOps.Attestor.Core\StellaOps.Attestor.Core.csproj" />
+    <ProjectReference Include="..\..\StellaOps.Configuration\StellaOps.Configuration.csproj" />
+    <ProjectReference Include="..\..\StellaOps.DependencyInjection\StellaOps.DependencyInjection.csproj" />
+  </ItemGroup>
+</Project>

src/StellaOps.Attestor/StellaOps.Attestor.Tests/TestDoubles.cs

@@ -0,0 +1,54 @@
+using System;
+using System.Collections.Concurrent;
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using StellaOps.Attestor.Core.Audit;
+using StellaOps.Attestor.Core.Storage;
+
+namespace StellaOps.Attestor.Tests;
+
+internal sealed class InMemoryAttestorEntryRepository : IAttestorEntryRepository
+{
+    private readonly ConcurrentDictionary<string, AttestorEntry> _entries = new();
+
+    public Task<AttestorEntry?> GetByBundleShaAsync(string bundleSha256, CancellationToken cancellationToken = default)
+    {
+        var entry = _entries.Values.FirstOrDefault(e => string.Equals(e.BundleSha256, bundleSha256, StringComparison.OrdinalIgnoreCase));
+        return Task.FromResult(entry);
+    }
+
+    public Task<AttestorEntry?> GetByUuidAsync(string rekorUuid, CancellationToken cancellationToken = default)
+    {
+        _entries.TryGetValue(rekorUuid, out var entry);
+        return Task.FromResult(entry);
+    }
+
+    public Task<IReadOnlyList<AttestorEntry>> GetByArtifactShaAsync(string artifactSha256, CancellationToken cancellationToken = default)
+    {
+        var entries = _entries.Values
+            .Where(e => string.Equals(e.Artifact.Sha256, artifactSha256, StringComparison.OrdinalIgnoreCase))
+            .OrderBy(e => e.CreatedAt)
+            .ToList();
+
+        return Task.FromResult<IReadOnlyList<AttestorEntry>>(entries);
+    }
+
+    public Task SaveAsync(AttestorEntry entry, CancellationToken cancellationToken = default)
+    {
+        _entries[entry.RekorUuid] = entry;
+        return Task.CompletedTask;
+    }
+}
+
+internal sealed class InMemoryAttestorAuditSink : IAttestorAuditSink
+{
+    public List<AttestorAuditRecord> Records { get; } = new();
+
+    public Task WriteAsync(AttestorAuditRecord record, CancellationToken cancellationToken = default)
+    {
+        Records.Add(record);
+        return Task.CompletedTask;
+    }
+}

src/StellaOps.Attestor/StellaOps.Attestor.WebService/Program.cs

@@ -0,0 +1,234 @@
+using System.Collections.Generic;
+using System.Security.Claims;
+using System.Security.Cryptography.X509Certificates;
+using Serilog;
+using Serilog.Events;
+using StellaOps.Attestor.Core.Options;
+using StellaOps.Attestor.Core.Submission;
+using StellaOps.Attestor.Infrastructure;
+using StellaOps.Configuration;
+using StellaOps.Auth.ServerIntegration;
+using Microsoft.Extensions.Diagnostics.HealthChecks;
+using OpenTelemetry.Metrics;
+using StellaOps.Attestor.Core.Observability;
+using StellaOps.Attestor.Core.Verification;
+using Microsoft.AspNetCore.Server.Kestrel.Https;
+
+const string ConfigurationSection = "attestor";
+
+var builder = WebApplication.CreateBuilder(args);
+
+builder.Configuration.AddStellaOpsDefaults(options =>
+{
+    options.BasePath = builder.Environment.ContentRootPath;
+    options.EnvironmentPrefix = "ATTESTOR_";
+    options.BindingSection = ConfigurationSection;
+});
+
+builder.Host.UseSerilog((context, services, loggerConfiguration) =>
+{
+    loggerConfiguration
+        .MinimumLevel.Information()
+        .MinimumLevel.Override("Microsoft", LogEventLevel.Warning)
+        .Enrich.FromLogContext()
+        .WriteTo.Console();
+});
+
+var attestorOptions = builder.Configuration.BindOptions<AttestorOptions>(ConfigurationSection);
+
+builder.Services.AddSingleton(TimeProvider.System);
+builder.Services.AddSingleton(attestorOptions);
+
+builder.Services.AddOptions<AttestorOptions>()
+    .Bind(builder.Configuration.GetSection(ConfigurationSection))
+    .ValidateOnStart();
+
+builder.Services.AddProblemDetails();
+builder.Services.AddEndpointsApiExplorer();
+builder.Services.AddAttestorInfrastructure();
+builder.Services.AddHttpContextAccessor();
+builder.Services.AddHealthChecks()
+    .AddCheck("self", () => HealthCheckResult.Healthy());
+
+builder.Services.AddOpenTelemetry()
+    .WithMetrics(metricsBuilder =>
+    {
+        metricsBuilder.AddMeter(AttestorMetrics.MeterName);
+        metricsBuilder.AddAspNetCoreInstrumentation();
+        metricsBuilder.AddRuntimeInstrumentation();
+    });
+
+if (attestorOptions.Security.Authority is { Issuer: not null } authority)
+{
+    builder.Services.AddStellaOpsResourceServerAuthentication(
+        builder.Configuration,
+        configurationSection: null,
+        configure: resourceOptions =>
+        {
+            resourceOptions.Authority = authority.Issuer!;
+            resourceOptions.RequireHttpsMetadata = authority.RequireHttpsMetadata;
+            if (!string.IsNullOrWhiteSpace(authority.JwksUrl))
+            {
+                resourceOptions.MetadataAddress = authority.JwksUrl;
+            }
+
+            foreach (var audience in authority.Audiences)
+            {
+                resourceOptions.Audiences.Add(audience);
+            }
+
+            foreach (var scope in authority.RequiredScopes)
+            {
+                resourceOptions.RequiredScopes.Add(scope);
+            }
+        });
+
+    builder.Services.AddAuthorization(options =>
+    {
+        options.AddPolicy("attestor:write", policy =>
+        {
+            policy.RequireAuthenticatedUser();
+            policy.RequireClaim("scope", authority.RequiredScopes);
+        });
+    });
+}
+else
+{
+    builder.Services.AddAuthorization();
+}
+
+builder.WebHost.ConfigureKestrel(kestrel =>
+{
+    kestrel.ConfigureHttpsDefaults(https =>
+    {
+        if (attestorOptions.Security.Mtls.RequireClientCertificate)
+        {
+            https.ClientCertificateMode = ClientCertificateMode.RequireCertificate;
+        }
+    });
+});
+
+var app = builder.Build();
+
+app.UseSerilogRequestLogging();
+
+app.UseExceptionHandler(static handler =>
+{
+    handler.Run(async context =>
+    {
+        var result = Results.Problem(statusCode: StatusCodes.Status500InternalServerError);
+        await result.ExecuteAsync(context);
+    });
+});
+
+app.UseAuthentication();
+app.UseAuthorization();
+
+app.MapHealthChecks("/health/ready");
+app.MapHealthChecks("/health/live");
+
+app.MapPost("/api/v1/rekor/entries", async (AttestorSubmissionRequest request, HttpContext httpContext, IAttestorSubmissionService submissionService, CancellationToken cancellationToken) =>
+{
+    var certificate = httpContext.Connection.ClientCertificate;
+    if (certificate is null)
+    {
+        return Results.Problem(statusCode: StatusCodes.Status403Forbidden, title: "Client certificate required");
+    }
+
+    var user = httpContext.User;
+    if (user?.Identity is not { IsAuthenticated: true })
+    {
+        return Results.Problem(statusCode: StatusCodes.Status401Unauthorized, title: "Authentication required");
+    }
+
+    var submissionContext = BuildSubmissionContext(user, certificate);
+
+    try
+    {
+        var result = await submissionService.SubmitAsync(request, submissionContext, cancellationToken).ConfigureAwait(false);
+        return Results.Ok(result);
+    }
+    catch (AttestorValidationException validationEx)
+    {
+        return Results.Problem(statusCode: StatusCodes.Status400BadRequest, title: validationEx.Message, extensions: new Dictionary<string, object?>
+        {
+            ["code"] = validationEx.Code
+        });
+    }
+})
+.RequireAuthorization("attestor:write");
+
+app.MapGet("/api/v1/rekor/entries/{uuid}", async (string uuid, bool? refresh, IAttestorVerificationService verificationService, CancellationToken cancellationToken) =>
+{
+    var entry = await verificationService.GetEntryAsync(uuid, refresh is true, cancellationToken).ConfigureAwait(false);
+    if (entry is null)
+    {
+        return Results.NotFound();
+    }
+
+    return Results.Ok(new
+    {
+        uuid = entry.RekorUuid,
+        index = entry.Index,
+        proof = entry.Proof is null ? null : new
+        {
+            checkpoint = entry.Proof.Checkpoint is null ? null : new
+            {
+                origin = entry.Proof.Checkpoint.Origin,
+                size = entry.Proof.Checkpoint.Size,
+                rootHash = entry.Proof.Checkpoint.RootHash,
+                timestamp = entry.Proof.Checkpoint.Timestamp?.ToString("O")
+            },
+            inclusion = entry.Proof.Inclusion is null ? null : new
+            {
+                leafHash = entry.Proof.Inclusion.LeafHash,
+                path = entry.Proof.Inclusion.Path
+            }
+        },
+        logURL = entry.Log.Url,
+        status = entry.Status,
+        artifact = new
+        {
+            sha256 = entry.Artifact.Sha256,
+            kind = entry.Artifact.Kind,
+            imageDigest = entry.Artifact.ImageDigest,
+            subjectUri = entry.Artifact.SubjectUri
+        }
+    });
+}).RequireAuthorization("attestor:write");
+
+app.MapPost("/api/v1/rekor/verify", async (AttestorVerificationRequest request, IAttestorVerificationService verificationService, CancellationToken cancellationToken) =>
+{
+    try
+    {
+        var result = await verificationService.VerifyAsync(request, cancellationToken).ConfigureAwait(false);
+        return Results.Ok(result);
+    }
+    catch (AttestorVerificationException ex)
+    {
+        return Results.Problem(statusCode: StatusCodes.Status400BadRequest, title: ex.Message, extensions: new Dictionary<string, object?>
+        {
+            ["code"] = ex.Code
+        });
+    }
+}).RequireAuthorization("attestor:write");
+
+app.Run();
+
+static SubmissionContext BuildSubmissionContext(ClaimsPrincipal user, X509Certificate2 certificate)
+{
+    var subject = user.FindFirst("sub")?.Value ?? certificate.Subject;
+    var audience = user.FindFirst("aud")?.Value ?? string.Empty;
+    var clientId = user.FindFirst("client_id")?.Value;
+    var tenant = user.FindFirst("tenant")?.Value;
+
+    return new SubmissionContext
+    {
+        CallerSubject = subject,
+        CallerAudience = audience,
+        CallerClientId = clientId,
+        CallerTenant = tenant,
+        ClientCertificate = certificate,
+        MtlsThumbprint = certificate.Thumbprint
+    };
+}

src/StellaOps.Attestor/StellaOps.Attestor.WebService/StellaOps.Attestor.WebService.csproj

@@ -0,0 +1,30 @@
+<Project Sdk="Microsoft.NET.Sdk.Web">
+  <PropertyGroup>
+    <TargetFramework>net10.0</TargetFramework>
+    <LangVersion>preview</LangVersion>
+    <Nullable>enable</Nullable>
+    <ImplicitUsings>enable</ImplicitUsings>
+    <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
+  </PropertyGroup>
+  <ItemGroup>
+    <PackageReference Include="Microsoft.AspNetCore.OpenApi" Version="8.0.8" />
+    <PackageReference Include="MongoDB.Driver" Version="3.5.0" />
+    <PackageReference Include="OpenTelemetry.Extensions.Hosting" Version="1.12.0" />
+    <PackageReference Include="OpenTelemetry.Instrumentation.AspNetCore" Version="1.12.0" />
+    <PackageReference Include="OpenTelemetry.Instrumentation.Http" Version="1.12.0" />
+    <PackageReference Include="OpenTelemetry.Instrumentation.Runtime" Version="1.12.0" />
+    <PackageReference Include="Serilog.AspNetCore" Version="8.0.1" />
+    <PackageReference Include="Serilog.Sinks.Console" Version="5.0.1" />
+    <PackageReference Include="StackExchange.Redis" Version="2.8.24" />
+  </ItemGroup>
+  <ItemGroup>
+    <ProjectReference Include="..\StellaOps.Attestor.Core\StellaOps.Attestor.Core.csproj" />
+    <ProjectReference Include="..\StellaOps.Attestor.Infrastructure\StellaOps.Attestor.Infrastructure.csproj" />
+    <ProjectReference Include="..\..\StellaOps.Configuration\StellaOps.Configuration.csproj" />
+    <ProjectReference Include="..\..\StellaOps.DependencyInjection\StellaOps.DependencyInjection.csproj" />
+    <ProjectReference Include="..\..\StellaOps.Cryptography\StellaOps.Cryptography.csproj" />
+    <ProjectReference Include="..\..\StellaOps.Authority\StellaOps.Auth.Abstractions\StellaOps.Auth.Abstractions.csproj" />
+    <ProjectReference Include="..\..\StellaOps.Authority\StellaOps.Auth.Client\StellaOps.Auth.Client.csproj" />
+    <ProjectReference Include="..\..\StellaOps.Authority\StellaOps.Auth.ServerIntegration\StellaOps.Auth.ServerIntegration.csproj" />
+  </ItemGroup>
+</Project>

src/StellaOps.Attestor/StellaOps.Attestor.sln

@@ -0,0 +1,118 @@
+
+Microsoft Visual Studio Solution File, Format Version 12.00
+# Visual Studio Version 17
+VisualStudioVersion = 17.0.31903.59
+MinimumVisualStudioVersion = 10.0.40219.1
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "StellaOps.Attestor.Core", "StellaOps.Attestor.Core\StellaOps.Attestor.Core.csproj", "{C0FE77EB-933C-4E47-8195-758AB049157A}"
+EndProject
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "StellaOps.Attestor.Infrastructure", "StellaOps.Attestor.Infrastructure\StellaOps.Attestor.Infrastructure.csproj", "{996D74F8-8683-45FA-90AB-DA7ACE78D4B3}"
+EndProject
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "StellaOps.Attestor.WebService", "StellaOps.Attestor.WebService\StellaOps.Attestor.WebService.csproj", "{B238B098-32B1-4875-99A7-393A63AC3CCF}"
+EndProject
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "StellaOps.Configuration", "..\StellaOps.Configuration\StellaOps.Configuration.csproj", "{988E2AC7-50E0-4845-B1C2-BA4931F2FFD7}"
+EndProject
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "StellaOps.Cryptography", "..\StellaOps.Cryptography\StellaOps.Cryptography.csproj", "{82EFA477-307D-4B47-A4CF-1627F076D60A}"
+EndProject
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "StellaOps.DependencyInjection", "..\StellaOps.DependencyInjection\StellaOps.DependencyInjection.csproj", "{21327A4F-2586-49F8-9D4A-3840DE64C48E}"
+EndProject
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "StellaOps.Attestor.Tests", "StellaOps.Attestor.Tests\StellaOps.Attestor.Tests.csproj", "{4B7592CD-D67C-4F4D-82FE-DF99BAAC4275}"
+EndProject
+Global
+	GlobalSection(SolutionConfigurationPlatforms) = preSolution
+		Debug|Any CPU = Debug|Any CPU
+		Debug|x64 = Debug|x64
+		Debug|x86 = Debug|x86
+		Release|Any CPU = Release|Any CPU
+		Release|x64 = Release|x64
+		Release|x86 = Release|x86
+	EndGlobalSection
+	GlobalSection(ProjectConfigurationPlatforms) = postSolution
+		{C0FE77EB-933C-4E47-8195-758AB049157A}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		{C0FE77EB-933C-4E47-8195-758AB049157A}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{C0FE77EB-933C-4E47-8195-758AB049157A}.Debug|x64.ActiveCfg = Debug|Any CPU
+		{C0FE77EB-933C-4E47-8195-758AB049157A}.Debug|x64.Build.0 = Debug|Any CPU
+		{C0FE77EB-933C-4E47-8195-758AB049157A}.Debug|x86.ActiveCfg = Debug|Any CPU
+		{C0FE77EB-933C-4E47-8195-758AB049157A}.Debug|x86.Build.0 = Debug|Any CPU
+		{C0FE77EB-933C-4E47-8195-758AB049157A}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{C0FE77EB-933C-4E47-8195-758AB049157A}.Release|Any CPU.Build.0 = Release|Any CPU
+		{C0FE77EB-933C-4E47-8195-758AB049157A}.Release|x64.ActiveCfg = Release|Any CPU
+		{C0FE77EB-933C-4E47-8195-758AB049157A}.Release|x64.Build.0 = Release|Any CPU
+		{C0FE77EB-933C-4E47-8195-758AB049157A}.Release|x86.ActiveCfg = Release|Any CPU
+		{C0FE77EB-933C-4E47-8195-758AB049157A}.Release|x86.Build.0 = Release|Any CPU
+		{996D74F8-8683-45FA-90AB-DA7ACE78D4B3}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		{996D74F8-8683-45FA-90AB-DA7ACE78D4B3}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{996D74F8-8683-45FA-90AB-DA7ACE78D4B3}.Debug|x64.ActiveCfg = Debug|Any CPU
+		{996D74F8-8683-45FA-90AB-DA7ACE78D4B3}.Debug|x64.Build.0 = Debug|Any CPU
+		{996D74F8-8683-45FA-90AB-DA7ACE78D4B3}.Debug|x86.ActiveCfg = Debug|Any CPU
+		{996D74F8-8683-45FA-90AB-DA7ACE78D4B3}.Debug|x86.Build.0 = Debug|Any CPU
+		{996D74F8-8683-45FA-90AB-DA7ACE78D4B3}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{996D74F8-8683-45FA-90AB-DA7ACE78D4B3}.Release|Any CPU.Build.0 = Release|Any CPU
+		{996D74F8-8683-45FA-90AB-DA7ACE78D4B3}.Release|x64.ActiveCfg = Release|Any CPU
+		{996D74F8-8683-45FA-90AB-DA7ACE78D4B3}.Release|x64.Build.0 = Release|Any CPU
+		{996D74F8-8683-45FA-90AB-DA7ACE78D4B3}.Release|x86.ActiveCfg = Release|Any CPU
+		{996D74F8-8683-45FA-90AB-DA7ACE78D4B3}.Release|x86.Build.0 = Release|Any CPU
+		{B238B098-32B1-4875-99A7-393A63AC3CCF}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		{B238B098-32B1-4875-99A7-393A63AC3CCF}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{B238B098-32B1-4875-99A7-393A63AC3CCF}.Debug|x64.ActiveCfg = Debug|Any CPU
+		{B238B098-32B1-4875-99A7-393A63AC3CCF}.Debug|x64.Build.0 = Debug|Any CPU
+		{B238B098-32B1-4875-99A7-393A63AC3CCF}.Debug|x86.ActiveCfg = Debug|Any CPU
+		{B238B098-32B1-4875-99A7-393A63AC3CCF}.Debug|x86.Build.0 = Debug|Any CPU
+		{B238B098-32B1-4875-99A7-393A63AC3CCF}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{B238B098-32B1-4875-99A7-393A63AC3CCF}.Release|Any CPU.Build.0 = Release|Any CPU
+		{B238B098-32B1-4875-99A7-393A63AC3CCF}.Release|x64.ActiveCfg = Release|Any CPU
+		{B238B098-32B1-4875-99A7-393A63AC3CCF}.Release|x64.Build.0 = Release|Any CPU
+		{B238B098-32B1-4875-99A7-393A63AC3CCF}.Release|x86.ActiveCfg = Release|Any CPU
+		{B238B098-32B1-4875-99A7-393A63AC3CCF}.Release|x86.Build.0 = Release|Any CPU
+		{988E2AC7-50E0-4845-B1C2-BA4931F2FFD7}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		{988E2AC7-50E0-4845-B1C2-BA4931F2FFD7}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{988E2AC7-50E0-4845-B1C2-BA4931F2FFD7}.Debug|x64.ActiveCfg = Debug|Any CPU
+		{988E2AC7-50E0-4845-B1C2-BA4931F2FFD7}.Debug|x64.Build.0 = Debug|Any CPU
+		{988E2AC7-50E0-4845-B1C2-BA4931F2FFD7}.Debug|x86.ActiveCfg = Debug|Any CPU
+		{988E2AC7-50E0-4845-B1C2-BA4931F2FFD7}.Debug|x86.Build.0 = Debug|Any CPU
+		{988E2AC7-50E0-4845-B1C2-BA4931F2FFD7}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{988E2AC7-50E0-4845-B1C2-BA4931F2FFD7}.Release|Any CPU.Build.0 = Release|Any CPU
+		{988E2AC7-50E0-4845-B1C2-BA4931F2FFD7}.Release|x64.ActiveCfg = Release|Any CPU
+		{988E2AC7-50E0-4845-B1C2-BA4931F2FFD7}.Release|x64.Build.0 = Release|Any CPU
+		{988E2AC7-50E0-4845-B1C2-BA4931F2FFD7}.Release|x86.ActiveCfg = Release|Any CPU
+		{988E2AC7-50E0-4845-B1C2-BA4931F2FFD7}.Release|x86.Build.0 = Release|Any CPU
+		{82EFA477-307D-4B47-A4CF-1627F076D60A}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		{82EFA477-307D-4B47-A4CF-1627F076D60A}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{82EFA477-307D-4B47-A4CF-1627F076D60A}.Debug|x64.ActiveCfg = Debug|Any CPU
+		{82EFA477-307D-4B47-A4CF-1627F076D60A}.Debug|x64.Build.0 = Debug|Any CPU
+		{82EFA477-307D-4B47-A4CF-1627F076D60A}.Debug|x86.ActiveCfg = Debug|Any CPU
+		{82EFA477-307D-4B47-A4CF-1627F076D60A}.Debug|x86.Build.0 = Debug|Any CPU
+		{82EFA477-307D-4B47-A4CF-1627F076D60A}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{82EFA477-307D-4B47-A4CF-1627F076D60A}.Release|Any CPU.Build.0 = Release|Any CPU
+		{82EFA477-307D-4B47-A4CF-1627F076D60A}.Release|x64.ActiveCfg = Release|Any CPU
+		{82EFA477-307D-4B47-A4CF-1627F076D60A}.Release|x64.Build.0 = Release|Any CPU
+		{82EFA477-307D-4B47-A4CF-1627F076D60A}.Release|x86.ActiveCfg = Release|Any CPU
+		{82EFA477-307D-4B47-A4CF-1627F076D60A}.Release|x86.Build.0 = Release|Any CPU
+		{21327A4F-2586-49F8-9D4A-3840DE64C48E}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		{21327A4F-2586-49F8-9D4A-3840DE64C48E}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{21327A4F-2586-49F8-9D4A-3840DE64C48E}.Debug|x64.ActiveCfg = Debug|Any CPU
+		{21327A4F-2586-49F8-9D4A-3840DE64C48E}.Debug|x64.Build.0 = Debug|Any CPU
+		{21327A4F-2586-49F8-9D4A-3840DE64C48E}.Debug|x86.ActiveCfg = Debug|Any CPU
+		{21327A4F-2586-49F8-9D4A-3840DE64C48E}.Debug|x86.Build.0 = Debug|Any CPU
+		{21327A4F-2586-49F8-9D4A-3840DE64C48E}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{21327A4F-2586-49F8-9D4A-3840DE64C48E}.Release|Any CPU.Build.0 = Release|Any CPU
+		{21327A4F-2586-49F8-9D4A-3840DE64C48E}.Release|x64.ActiveCfg = Release|Any CPU
+		{21327A4F-2586-49F8-9D4A-3840DE64C48E}.Release|x64.Build.0 = Release|Any CPU
+		{21327A4F-2586-49F8-9D4A-3840DE64C48E}.Release|x86.ActiveCfg = Release|Any CPU
+		{21327A4F-2586-49F8-9D4A-3840DE64C48E}.Release|x86.Build.0 = Release|Any CPU
+		{4B7592CD-D67C-4F4D-82FE-DF99BAAC4275}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		{4B7592CD-D67C-4F4D-82FE-DF99BAAC4275}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{4B7592CD-D67C-4F4D-82FE-DF99BAAC4275}.Debug|x64.ActiveCfg = Debug|Any CPU
+		{4B7592CD-D67C-4F4D-82FE-DF99BAAC4275}.Debug|x64.Build.0 = Debug|Any CPU
+		{4B7592CD-D67C-4F4D-82FE-DF99BAAC4275}.Debug|x86.ActiveCfg = Debug|Any CPU
+		{4B7592CD-D67C-4F4D-82FE-DF99BAAC4275}.Debug|x86.Build.0 = Debug|Any CPU
+		{4B7592CD-D67C-4F4D-82FE-DF99BAAC4275}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{4B7592CD-D67C-4F4D-82FE-DF99BAAC4275}.Release|Any CPU.Build.0 = Release|Any CPU
+		{4B7592CD-D67C-4F4D-82FE-DF99BAAC4275}.Release|x64.ActiveCfg = Release|Any CPU
+		{4B7592CD-D67C-4F4D-82FE-DF99BAAC4275}.Release|x64.Build.0 = Release|Any CPU
+		{4B7592CD-D67C-4F4D-82FE-DF99BAAC4275}.Release|x86.ActiveCfg = Release|Any CPU
+		{4B7592CD-D67C-4F4D-82FE-DF99BAAC4275}.Release|x86.Build.0 = Release|Any CPU
+	EndGlobalSection
+	GlobalSection(SolutionProperties) = preSolution
+		HideSolutionNode = FALSE
+	EndGlobalSection
+EndGlobal

src/StellaOps.Attestor/TASKS.md

@@ -0,0 +1,11 @@
+# Attestor Guild Task Board (UTC 2025-10-19)
+
+| ID | Status | Owner(s) | Depends on | Description | Exit Criteria |
+|----|--------|----------|------------|-------------|---------------|
+| ATTESTOR-API-11-201 | DONE (2025-10-19) | Attestor Guild | — | `/rekor/entries` submission pipeline with dedupe, proof acquisition, and persistence. | ✅ `POST /api/v1/rekor/entries` enforces mTLS + Authority OpTok, validates DSSE bundles, and handles dual-log preferences.<br>✅ Redis/Mongo idempotency returns existing UUID on duplicate `bundleSha256` without re-submitting to Rekor.<br>✅ Rekor driver fetches inclusion proofs (or schedules async fetch) and persists canonical entry/proof metadata.<br>✅ Optional archive path stores DSSE/proof bundles to MinIO/S3; integration tests cover success/pending/error flows. |
+| ATTESTOR-VERIFY-11-202 | DONE (2025-10-19) | Attestor Guild | — | `/rekor/verify` + retrieval endpoints validating signatures and Merkle proofs. | ✅ `GET /api/v1/rekor/entries/{uuid}` surfaces cached entries with optional backend refresh and handles not-found/refresh flows.<br>✅ `POST /api/v1/rekor/verify` accepts UUID, bundle, or artifact hash inputs; verifies DSSE signatures, Merkle proofs, and checkpoint anchors.<br>✅ Verification output returns `{ok, uuid, index, logURL, checkedAt}` with failure diagnostics for invalid proofs.<br>✅ Unit/integration tests exercise cache hits, backend refresh, invalid bundle/proof scenarios, and checkpoint trust anchor enforcement. |
+| ATTESTOR-OBS-11-203 | DONE (2025-10-19) | Attestor Guild | — | Telemetry, alerting, mTLS hardening, and archive workflow for Attestor. | ✅ Structured logs, metrics, and optional traces record submission latency, proof fetch outcomes, verification results, and Rekor error buckets with correlation IDs.<br>✅ mTLS enforcement hardened (peer allowlist, SAN checks, rate limiting) and documented; TLS settings audited for modern ciphers only.<br>✅ Alerting/dashboard pack covers error rates, proof backlog, Redis/Mongo health, and archive job failures; runbook updated.<br>✅ Archive workflow includes retention policy jobs, failure alerts, and periodic verification of stored bundles and proofs. |
+
+> Remark (2025-10-19): Wave 0 prerequisites reviewed (none outstanding); Attestor Guild tasks moved to DOING for execution.
+> Remark (2025-10-19): `/rekor/entries` submission service implemented with Mongo/Redis persistence, optional S3 archival, Rekor HTTP client, and OpenTelemetry metrics; verification APIs (`/rekor/entries/{uuid}`, `/rekor/verify`) added with proof refresh and canonical hash checks. Remaining: integrate real Rekor endpoints in staging and expand failure-mode tests.
+> Remark (2025-10-19): Added Rekor mock client + integration harness to unblock attestor verification testing without external connectivity. Follow-up tasks to wire staging Rekor and record retry/error behavior still pending.