nuget reorganization

docs/modules/excititor/operations/evidence-api.md

@@ -31,14 +31,73 @@ Headers:
 ## `/v1/vex/evidence/chunks`
 
 - **Query params**: `vulnerabilityId` (required), `productKey` (required), optional `providerId`, `status`, `since`, `limit`.
+- **Limits**: default `limit=500`, max `2000`.
 - **Response**: **NDJSON** stream; each line is a `VexEvidenceChunkResponse`.
 - **Chunk fields**: `observationId`, `linksetId`, `vulnerabilityId`, `productKey`, `providerId`, `status`, `justification`, `detail`, `scopeScore` (from confidence or signals), `firstSeen`, `lastSeen`, `scope{...}`, `document{digest,format,sourceUri,revision}`, `signature{type,subject,issuer,keyId,verifiedAt,transparencyRef}`, `metadata` (flattened additionalMetadata).
-- **Headers**: same truncation/total headers as projection API.
+- **Headers**: `Excititor-Results-Total`, `Excititor-Results-Truncated` (mirrors projection API naming).
 - **Streaming guidance (SDK/clients)**:
   - Use HTTP client that supports response streaming; read line-by-line and JSON-deserialize per line.
-  - Treat stream as unbounded list up to `limit`; do not assume array brackets.
+  - Treat stream as an NDJSON list up to `limit`; no outer array.
   - Back-off or paginate by adjusting `since` or narrowing providers/statuses.
 
+OpenAPI (excerpt):
+
+```yaml
+paths:
+  /v1/vex/evidence/chunks:
+    get:
+      summary: Stream evidence chunks for a vulnerability/product
+      parameters:
+        - in: query
+          name: vulnerabilityId
+          schema: { type: string }
+          required: true
+        - in: query
+          name: productKey
+          schema: { type: string }
+          required: true
+        - in: query
+          name: providerId
+          schema: { type: string }
+          description: Comma-separated provider ids
+        - in: query
+          name: status
+          schema: { type: string }
+          description: Comma-separated VEX statuses
+        - in: query
+          name: since
+          schema: { type: string, format: date-time }
+        - in: query
+          name: limit
+          schema: { type: integer, minimum: 1, maximum: 2000, default: 500 }
+      responses:
+        "200":
+          description: NDJSON stream of VexEvidenceChunkResponse
+          headers:
+            Excititor-Results-Total: { schema: { type: integer } }
+            Excititor-Results-Truncated: { schema: { type: boolean } }
+          content:
+            application/x-ndjson:
+              schema:
+                type: string
+                description: One JSON object per line (VexEvidenceChunkResponse)
+```
+
+Example (curl):
+
+```bash
+curl -s -H "Authorization: Bearer <token>" \
+     -H "X-Stella-Tenant: acme" \
+     "https://exc.example.test/v1/vex/evidence/chunks?vulnerabilityId=CVE-2025-0001&productKey=pkg:docker/demo&limit=2" |
+  head -n 2
+```
+
+Sample NDJSON line:
+
+```json
+{"observationId":"provider-a:4d2f...","linksetId":"CVE-2025-0001:pkg:docker/demo","vulnerabilityId":"CVE-2025-0001","productKey":"pkg:docker/demo","providerId":"provider-a","status":"Affected","justification":"ComponentNotPresent","detail":"demo detail","scopeScore":0.9,"firstSeen":"2025-11-10T12:00:00Z","lastSeen":"2025-11-12T12:00:00Z","scope":{"key":"pkg:docker/demo","name":"demo","version":"1.0.0","purl":"pkg:docker/demo","cpe":null,"componentIdentifiers":["component-a"]},"document":{"digest":"sha256:e7...","format":"sbomcyclonedx","sourceUri":"https://example.test/vex.json","revision":"r1"},"signature":{"type":"cosign","subject":"demo","issuer":"issuer","keyId":"kid","verifiedAt":"2025-11-12T12:00:00Z","transparencyRef":null},"metadata":{}}
+```
+
 ## `/v1/vex/attestations/{attestationId}`
 
 - **Purpose**: Lookup attestation provenance (supplier ↔ observation/linkset ↔ product/vulnerability) without touching consensus.