audit, advisories and doctors/setup work

src/AdvisoryAI/StellaOps.AdvisoryAI/Explanation/NullEvidenceRetrievalService.cs

@@ -0,0 +1,43 @@
+// <copyright file="NullEvidenceRetrievalService.cs" company="StellaOps">
+// Copyright (c) StellaOps. Licensed under the AGPL-3.0-or-later.
+// </copyright>
+using System.Security.Cryptography;
+
+namespace StellaOps.AdvisoryAI.Explanation;
+
+public sealed class NullEvidenceRetrievalService : IEvidenceRetrievalService
+{
+    private static readonly EvidenceContext EmptyContext = new()
+    {
+        SbomEvidence = Array.Empty<EvidenceNode>(),
+        ReachabilityEvidence = Array.Empty<EvidenceNode>(),
+        RuntimeEvidence = Array.Empty<EvidenceNode>(),
+        VexEvidence = Array.Empty<EvidenceNode>(),
+        PatchEvidence = Array.Empty<EvidenceNode>(),
+        ContextHash = ComputeEmptyContextHash()
+    };
+
+    public Task<EvidenceContext> RetrieveEvidenceAsync(
+        string findingId,
+        string artifactDigest,
+        string vulnerabilityId,
+        string? componentPurl = null,
+        CancellationToken cancellationToken = default)
+        => Task.FromResult(EmptyContext);
+
+    public Task<EvidenceNode?> GetEvidenceNodeAsync(
+        string evidenceId,
+        CancellationToken cancellationToken = default)
+        => Task.FromResult<EvidenceNode?>(null);
+
+    public Task<bool> ValidateEvidenceAsync(
+        IEnumerable<string> evidenceIds,
+        CancellationToken cancellationToken = default)
+        => Task.FromResult(true);
+
+    private static string ComputeEmptyContextHash()
+    {
+        var bytes = SHA256.HashData(Array.Empty<byte>());
+        return Convert.ToHexStringLower(bytes);
+    }
+}