audit, advisories and doctors/setup work

src/Doctor/AGENTS.md

@@ -0,0 +1,48 @@
+# AGENTS - StellaOps Doctor
+
+## Roles
+- Backend engineer: Doctor engine, pack loader, checks, and evidence output.
+- QA engineer: unit/integration tests for Doctor engine and web service.
+- Docs/PM: keep sprint status in `docs/implplan/SPRINT_*` aligned and update Doctor docs.
+
+## Working directory
+- Primary: `src/Doctor/**` (web service, plugins, tests).
+- Allowed shared libraries:
+  - `src/__Libraries/StellaOps.Doctor/**`
+  - `src/__Libraries/StellaOps.Doctor.Plugins.*/**`
+  - `src/__Libraries/__Tests/StellaOps.Doctor.*.Tests/**`
+- Do not edit other modules unless the sprint explicitly allows cross-module edits.
+
+## Required reading (treat as read before DOING)
+- `docs/README.md`
+- `docs/technical/architecture/07_HIGH_LEVEL_ARCHITECTURE.md`
+- `docs/modules/platform/architecture-overview.md`
+- `docs/doctor/doctor-capabilities.md`
+- `docs/doctor/cli-reference.md`
+- `docs/doctor/README.md`
+- Sprint file under `docs/implplan/`
+
+## Coding standards
+- Target .NET 10 with preview features as configured.
+- Determinism: stable ordering, UTC timestamps, invariant culture, fixed JSON options.
+- Never call `DateTime.UtcNow`, `Guid.NewGuid()`, or `Random.Shared` directly; use injected providers.
+- DSSE PAE and JSON canonicalization must use shared helpers; do not reimplement.
+- Remediation commands must be non-destructive; destructive steps are manual guidance only.
+
+## Evidence and remediation
+- Every check emits evidence and `how_to_fix` alias for agent/CLI/UI consumption.
+- Evidence logs are JSONL with deterministic ordering and include `doctor_command`.
+- DSSE summaries assume operator execution and include the same command note.
+
+## Testing
+- Doctor engine tests: `src/__Libraries/__Tests/StellaOps.Doctor.Tests`
+- Plugin tests: `src/__Libraries/__Tests/StellaOps.Doctor.Plugins.*.Tests`
+- Web service tests: `src/Doctor/__Tests/StellaOps.Doctor.WebService.Tests`
+- Tests must be offline-safe and deterministic (no network access, fixed inputs).
+
+## Sprint/status discipline
+- Mirror task state in the relevant `SPRINT_*` doc (TODO -> DOING -> DONE/BLOCKED).
+- If a decision is needed, mark the task BLOCKED in the sprint and continue with other tasks.
+
+## Contacts/ownership
+- Module owner: Doctor Guild