sprints update
Some checks failed
Docs CI / lint-and-preview (push) Has been cancelled
Mirror Thin Bundle Sign & Verify / mirror-sign (push) Has been cancelled

This commit is contained in:
StellaOps Bot
2025-11-25 07:49:24 +02:00
parent 17826bdca1
commit d92973d6fd
37 changed files with 892 additions and 703 deletions

View File

@@ -0,0 +1,29 @@
# Export / Orchestrator Mirror Hook — EXPORT-MIRROR-ORCH-1501
Date: 2025-11-24
Owners: Exporter Guild · CLI Guild
Scope: Define orchestration/export hook payload when mirror bundles become ready so CLI/automation can consume without Ops backlog leakage.
## Hook payload
Event: `mirror.ready`
Fields (deterministic, lower-case keys):
- `bundleId` (string)
- `generation` (string/number-as-string, matches mirrorGeneration)
- `generatedAt` (ISO-8601 UTC)
- `manifestDigest` (sha256:… of mirror.json)
- `dsseDigest` (sha256:… of mirror.dsse payload)
- `location` (URI or offline path where bundle is staged)
- `rekorUUID` (optional; present when transparency entry exists)
## Behavior
- Emitted by ExportCenter/Orchestrator when mirror bundle artifacts land in staging.
- At-least-once; consumers must de-dup by `(bundleId,generation)`.
- No external fetches; payload entirely local/offline friendly.
## Actions
- Exporter Guild: add hook emission to bundle pipeline; include `mirror.dsse.json` header path in payload for CLI verification.
- CLI Guild: subscribe to `mirror.ready`; surface manifest/dsse digests and location in `stella mirror status`.
## Risks
- Field names may shift with ExportCenter manifest v1.1; keep aliasing if needed.
- Rekor optional; CLI should warn when absent but proceed with local verification.