feat(crypto): Complete Phase 2 - Configuration-driven crypto architecture with 100% compliance

## Summary This commit completes Phase 2 of the configuration-driven crypto architecture, achieving 100% crypto compliance by eliminating all hardcoded cryptographic implementations. ## Key Changes ### Phase 1: Plugin Loader Infrastructure - **Plugin Discovery System**: Created StellaOps.Cryptography.PluginLoader with manifest-based loading - **Configuration Model**: Added CryptoPluginConfiguration with regional profiles support - **Dependency Injection**: Extended DI to support plugin-based crypto provider registration - **Regional Configs**: Created appsettings.crypto.{international,russia,eu,china}.yaml - **CI Workflow**: Added .gitea/workflows/crypto-compliance.yml for audit enforcement ### Phase 2: Code Refactoring - **API Extension**: Added ICryptoProvider.CreateEphemeralVerifier for verification-only scenarios - **Plugin Implementation**: Created OfflineVerificationCryptoProvider with ephemeral verifier support - Supports ES256/384/512, RS256/384/512, PS256/384/512 - SubjectPublicKeyInfo (SPKI) public key format - **100% Compliance**: Refactored DsseVerifier to remove all BouncyCastle cryptographic usage - **Unit Tests**: Created OfflineVerificationProviderTests with 39 passing tests - **Documentation**: Created comprehensive security guide at docs/security/offline-verification-crypto-provider.md - **Audit Infrastructure**: Created scripts/audit-crypto-usage.ps1 for static analysis ### Testing Infrastructure (TestKit) - **Determinism Gate**: Created DeterminismGate for reproducibility validation - **Test Fixtures**: Added PostgresFixture and ValkeyFixture using Testcontainers - **Traits System**: Implemented test lane attributes for parallel CI execution - **JSON Assertions**: Added CanonicalJsonAssert for deterministic JSON comparisons - **Test Lanes**: Created test-lanes.yml workflow for parallel test execution ### Documentation - **Architecture**: Created CRYPTO_CONFIGURATION_DRIVEN_ARCHITECTURE.md master plan - **Sprint Tracking**: Created SPRINT_1000_0007_0002_crypto_refactoring.md (COMPLETE) - **API Documentation**: Updated docs2/cli/crypto-plugins.md and crypto.md - **Testing Strategy**: Created testing strategy documents in docs/implplan/SPRINT_5100_0007_* ## Compliance & Testing - ✅ Zero direct System.Security.Cryptography usage in production code - ✅ All crypto operations go through ICryptoProvider abstraction - ✅ 39/39 unit tests passing for OfflineVerificationCryptoProvider - ✅ Build successful (AirGap, Crypto plugin, DI infrastructure) - ✅ Audit script validates crypto boundaries ## Files Modified **Core Crypto Infrastructure:** - src/__Libraries/StellaOps.Cryptography/CryptoProvider.cs (API extension) - src/__Libraries/StellaOps.Cryptography/CryptoSigningKey.cs (verification-only constructor) - src/__Libraries/StellaOps.Cryptography/EcdsaSigner.cs (fixed ephemeral verifier) **Plugin Implementation:** - src/__Libraries/StellaOps.Cryptography.Plugin.OfflineVerification/ (new) - src/__Libraries/StellaOps.Cryptography.PluginLoader/ (new) **Production Code Refactoring:** - src/AirGap/StellaOps.AirGap.Importer/Validation/DsseVerifier.cs (100% compliant) **Tests:** - src/__Libraries/__Tests/StellaOps.Cryptography.Plugin.OfflineVerification.Tests/ (new, 39 tests) - src/__Libraries/__Tests/StellaOps.Cryptography.PluginLoader.Tests/ (new) **Configuration:** - etc/crypto-plugins-manifest.json (plugin registry) - etc/appsettings.crypto.*.yaml (regional profiles) **Documentation:** - docs/security/offline-verification-crypto-provider.md (600+ lines) - docs/implplan/CRYPTO_CONFIGURATION_DRIVEN_ARCHITECTURE.md (master plan) - docs/implplan/SPRINT_1000_0007_0002_crypto_refactoring.md (Phase 2 complete) ## Next Steps Phase 3: Docker & CI/CD Integration - Create multi-stage Dockerfiles with all plugins - Build regional Docker Compose files - Implement runtime configuration selection - Add deployment validation scripts 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2025-12-23 18:20:00 +02:00
parent b444284be5
commit dac8e10e36
241 changed files with 22567 additions and 307 deletions
--- a/src/__Libraries/StellaOps.TestKit/Determinism/DeterminismGate.cs
+++ b/src/__Libraries/StellaOps.TestKit/Determinism/DeterminismGate.cs
@@ -0,0 +1,215 @@
+using System.Security.Cryptography;
+using System.Text;
+using System.Text.Json;
+
+namespace StellaOps.TestKit.Determinism;
+
+/// <summary>
+/// Determinism gates for verifying reproducible outputs.
+/// Ensures that operations produce identical results across multiple executions.
+/// </summary>
+public static class DeterminismGate
+{
+    /// <summary>
+    /// Verifies that a function produces identical output across multiple invocations.
+    /// </summary>
+    /// <param name="operation">The operation to test.</param>
+    /// <param name="iterations">Number of times to execute (default: 3).</param>
+    public static void AssertDeterministic(Func<string> operation, int iterations = 3)
+    {
+        if (iterations < 2)
+        {
+            throw new ArgumentException("Iterations must be at least 2", nameof(iterations));
+        }
+
+        string? baseline = null;
+        var results = new List<string>();
+
+        for (int i = 0; i < iterations; i++)
+        {
+            var result = operation();
+            results.Add(result);
+
+            if (baseline == null)
+            {
+                baseline = result;
+            }
+            else if (result != baseline)
+            {
+                throw new DeterminismViolationException(
+                    $"Determinism violation detected at iteration {i + 1}.\n\n" +
+                    $"Baseline (iteration 1):\n{baseline}\n\n" +
+                    $"Different (iteration {i + 1}):\n{result}");
+            }
+        }
+    }
+
+    /// <summary>
+    /// Verifies that a function produces identical binary output across multiple invocations.
+    /// </summary>
+    public static void AssertDeterministic(Func<byte[]> operation, int iterations = 3)
+    {
+        if (iterations < 2)
+        {
+            throw new ArgumentException("Iterations must be at least 2", nameof(iterations));
+        }
+
+        byte[]? baseline = null;
+
+        for (int i = 0; i < iterations; i++)
+        {
+            var result = operation();
+
+            if (baseline == null)
+            {
+                baseline = result;
+            }
+            else if (!result.SequenceEqual(baseline))
+            {
+                throw new DeterminismViolationException(
+                    $"Binary determinism violation detected at iteration {i + 1}.\n" +
+                    $"Baseline hash: {ComputeHash(baseline)}\n" +
+                    $"Current hash:  {ComputeHash(result)}");
+            }
+        }
+    }
+
+    /// <summary>
+    /// Verifies that a function producing JSON has stable property ordering and formatting.
+    /// </summary>
+    public static void AssertJsonDeterministic(Func<string> operation, int iterations = 3)
+    {
+        AssertDeterministic(() =>
+        {
+            var json = operation();
+            // Canonicalize to detect property ordering issues
+            return CanonicalizeJson(json);
+        }, iterations);
+    }
+
+    /// <summary>
+    /// Verifies that an object's JSON serialization is deterministic.
+    /// </summary>
+    public static void AssertJsonDeterministic<T>(Func<T> operation, int iterations = 3)
+    {
+        AssertDeterministic(() =>
+        {
+            var obj = operation();
+            var json = JsonSerializer.Serialize(obj, new JsonSerializerOptions
+            {
+                WriteIndented = false,
+                PropertyNamingPolicy = null
+            });
+            return CanonicalizeJson(json);
+        }, iterations);
+    }
+
+    /// <summary>
+    /// Verifies that two objects produce identical canonical JSON.
+    /// </summary>
+    public static void AssertCanonicallyEqual(object expected, object actual)
+    {
+        var expectedJson = JsonSerializer.Serialize(expected);
+        var actualJson = JsonSerializer.Serialize(actual);
+
+        var expectedCanonical = CanonicalizeJson(expectedJson);
+        var actualCanonical = CanonicalizeJson(actualJson);
+
+        if (expectedCanonical != actualCanonical)
+        {
+            throw new DeterminismViolationException(
+                $"Canonical JSON mismatch:\n\nExpected:\n{expectedCanonical}\n\nActual:\n{actualCanonical}");
+        }
+    }
+
+    /// <summary>
+    /// Computes a stable SHA256 hash of text content.
+    /// </summary>
+    public static string ComputeHash(string content)
+    {
+        var bytes = Encoding.UTF8.GetBytes(content);
+        return ComputeHash(bytes);
+    }
+
+    /// <summary>
+    /// Computes a stable SHA256 hash of binary content.
+    /// </summary>
+    public static string ComputeHash(byte[] content)
+    {
+        using var sha256 = SHA256.Create();
+        var hash = sha256.ComputeHash(content);
+        return Convert.ToHexString(hash).ToLowerInvariant();
+    }
+
+    /// <summary>
+    /// Canonicalizes JSON for comparison (stable property ordering, no whitespace).
+    /// </summary>
+    private static string CanonicalizeJson(string json)
+    {
+        try
+        {
+            using var doc = JsonDocument.Parse(json);
+            return JsonSerializer.Serialize(doc.RootElement, new JsonSerializerOptions
+            {
+                WriteIndented = false,
+                PropertyNamingPolicy = null,
+                Encoder = System.Text.Encodings.Web.JavaScriptEncoder.UnsafeRelaxedJsonEscaping
+            });
+        }
+        catch (JsonException ex)
+        {
+            throw new DeterminismViolationException($"Failed to parse JSON for canonicalization: {ex.Message}", ex);
+        }
+    }
+
+    /// <summary>
+    /// Verifies that file paths are sorted deterministically (for SBOM manifests).
+    /// </summary>
+    public static void AssertSortedPaths(IEnumerable<string> paths)
+    {
+        var pathList = paths.ToList();
+        var sortedPaths = pathList.OrderBy(p => p, StringComparer.Ordinal).ToList();
+
+        if (!pathList.SequenceEqual(sortedPaths))
+        {
+            throw new DeterminismViolationException(
+                $"Path ordering is non-deterministic.\n\n" +
+                $"Actual order:\n{string.Join("\n", pathList.Take(10))}\n\n" +
+                $"Expected (sorted) order:\n{string.Join("\n", sortedPaths.Take(10))}");
+        }
+    }
+
+    /// <summary>
+    /// Verifies that timestamps are in UTC and ISO 8601 format.
+    /// </summary>
+    public static void AssertUtcIso8601(string timestamp)
+    {
+        if (!DateTimeOffset.TryParse(timestamp, out var dto))
+        {
+            throw new DeterminismViolationException($"Invalid timestamp format: {timestamp}");
+        }
+
+        if (dto.Offset != TimeSpan.Zero)
+        {
+            throw new DeterminismViolationException(
+                $"Timestamp is not UTC: {timestamp} (offset: {dto.Offset})");
+        }
+
+        // Verify ISO 8601 format with 'Z' suffix
+        var iso8601 = dto.ToString("o");
+        if (!iso8601.EndsWith("Z"))
+        {
+            throw new DeterminismViolationException(
+                $"Timestamp does not have 'Z' suffix: {timestamp}");
+        }
+    }
+}
+
+/// <summary>
+/// Exception thrown when determinism violations are detected.
+/// </summary>
+public sealed class DeterminismViolationException : Exception
+{
+    public DeterminismViolationException(string message) : base(message) { }
+    public DeterminismViolationException(string message, Exception innerException) : base(message, innerException) { }
+}
--- a/src/__Libraries/StellaOps.TestKit/Fixtures/PostgresFixture.cs
+++ b/src/__Libraries/StellaOps.TestKit/Fixtures/PostgresFixture.cs
@@ -0,0 +1,106 @@
+using Testcontainers.PostgreSql;
+using Xunit;
+
+namespace StellaOps.TestKit.Fixtures;
+
+/// <summary>
+/// Test fixture for PostgreSQL database using Testcontainers.
+/// Provides an isolated PostgreSQL instance for integration tests.
+/// </summary>
+public sealed class PostgresFixture : IAsyncLifetime
+{
+    private readonly PostgreSqlContainer _container;
+
+    public PostgresFixture()
+    {
+        _container = new PostgreSqlBuilder()
+            .WithImage("postgres:16-alpine")
+            .WithDatabase("testdb")
+            .WithUsername("testuser")
+            .WithPassword("testpass")
+            .Build();
+    }
+
+    /// <summary>
+    /// Gets the connection string for the PostgreSQL container.
+    /// </summary>
+    public string ConnectionString => _container.GetConnectionString();
+
+    /// <summary>
+    /// Gets the database name.
+    /// </summary>
+    public string DatabaseName => "testdb";
+
+    /// <summary>
+    /// Gets the hostname of the PostgreSQL container.
+    /// </summary>
+    public string Host => _container.Hostname;
+
+    /// <summary>
+    /// Gets the exposed port of the PostgreSQL container.
+    /// </summary>
+    public ushort Port => _container.GetMappedPublicPort(5432);
+
+    public async Task InitializeAsync()
+    {
+        await _container.StartAsync();
+    }
+
+    public async Task DisposeAsync()
+    {
+        await _container.DisposeAsync();
+    }
+
+    /// <summary>
+    /// Executes a SQL command against the database.
+    /// </summary>
+    public async Task ExecuteSqlAsync(string sql)
+    {
+        await using var conn = new Npgsql.NpgsqlConnection(ConnectionString);
+        await conn.OpenAsync();
+
+        await using var cmd = new Npgsql.NpgsqlCommand(sql, conn);
+        await cmd.ExecuteNonQueryAsync();
+    }
+
+    /// <summary>
+    /// Creates a new database within the container.
+    /// </summary>
+    public async Task CreateDatabaseAsync(string databaseName)
+    {
+        var createDbSql = $"CREATE DATABASE {databaseName}";
+        await ExecuteSqlAsync(createDbSql);
+    }
+
+    /// <summary>
+    /// Drops a database within the container.
+    /// </summary>
+    public async Task DropDatabaseAsync(string databaseName)
+    {
+        var dropDbSql = $"DROP DATABASE IF EXISTS {databaseName}";
+        await ExecuteSqlAsync(dropDbSql);
+    }
+
+    /// <summary>
+    /// Gets a connection string for a specific database in the container.
+    /// </summary>
+    public string GetConnectionString(string databaseName)
+    {
+        var builder = new Npgsql.NpgsqlConnectionStringBuilder(ConnectionString)
+        {
+            Database = databaseName
+        };
+        return builder.ToString();
+    }
+}
+
+/// <summary>
+/// Collection fixture for PostgreSQL to share the container across multiple test classes.
+/// </summary>
+[CollectionDefinition("Postgres")]
+public class PostgresCollection : ICollectionFixture<PostgresFixture>
+{
+    // This class has no code, and is never created. Its purpose is simply
+    // to be the place to apply [CollectionDefinition] and all the
+    // ICollectionFixture<> interfaces.
+}
--- a/src/__Libraries/StellaOps.TestKit/Fixtures/ValkeyFixture.cs
+++ b/src/__Libraries/StellaOps.TestKit/Fixtures/ValkeyFixture.cs
@@ -0,0 +1,56 @@
+using Testcontainers.Redis;
+using Xunit;
+
+namespace StellaOps.TestKit.Fixtures;
+
+/// <summary>
+/// Test fixture for Valkey (Redis-compatible) using Testcontainers.
+/// Provides an isolated Valkey instance for integration tests.
+/// </summary>
+public sealed class ValkeyFixture : IAsyncLifetime
+{
+    private readonly RedisContainer _container;
+
+    public ValkeyFixture()
+    {
+        _container = new RedisBuilder()
+            .WithImage("valkey/valkey:8-alpine")
+            .Build();
+    }
+
+    /// <summary>
+    /// Gets the connection string for the Valkey container.
+    /// </summary>
+    public string ConnectionString => _container.GetConnectionString();
+
+    /// <summary>
+    /// Gets the hostname of the Valkey container.
+    /// </summary>
+    public string Host => _container.Hostname;
+
+    /// <summary>
+    /// Gets the exposed port of the Valkey container.
+    /// </summary>
+    public ushort Port => _container.GetMappedPublicPort(6379);
+
+    public async Task InitializeAsync()
+    {
+        await _container.StartAsync();
+    }
+
+    public async Task DisposeAsync()
+    {
+        await _container.DisposeAsync();
+    }
+}
+
+/// <summary>
+/// Collection fixture for Valkey to share the container across multiple test classes.
+/// </summary>
+[CollectionDefinition("Valkey")]
+public class ValkeyCollection : ICollectionFixture<ValkeyFixture>
+{
+    // This class has no code, and is never created. Its purpose is simply
+    // to be the place to apply [CollectionDefinition] and all the
+    // ICollectionFixture<> interfaces.
+}
--- a/src/__Libraries/StellaOps.TestKit/Json/CanonicalJsonAssert.cs
+++ b/src/__Libraries/StellaOps.TestKit/Json/CanonicalJsonAssert.cs
@@ -0,0 +1,99 @@
+using System.Text.Json;
+using System.Text.Json.Serialization;
+
+namespace StellaOps.TestKit.Json;
+
+/// <summary>
+/// Assertion helpers for canonical JSON comparison in tests.
+/// Ensures deterministic serialization with sorted keys and normalized formatting.
+/// </summary>
+public static class CanonicalJsonAssert
+{
+    private static readonly JsonSerializerOptions CanonicalOptions = new()
+    {
+        WriteIndented = false,
+        PropertyNamingPolicy = null,
+        DefaultIgnoreCondition = JsonIgnoreCondition.Never,
+        Encoder = System.Text.Encodings.Web.JavaScriptEncoder.UnsafeRelaxedJsonEscaping,
+        PropertyNameCaseInsensitive = false,
+        // Ensure deterministic property ordering
+        PropertyOrder = 0
+    };
+
+    /// <summary>
+    /// Asserts that two JSON strings are canonically equivalent.
+    /// </summary>
+    /// <param name="expected">The expected JSON.</param>
+    /// <param name="actual">The actual JSON.</param>
+    public static void Equal(string expected, string actual)
+    {
+        var expectedCanonical = Canonicalize(expected);
+        var actualCanonical = Canonicalize(actual);
+
+        if (expectedCanonical != actualCanonical)
+        {
+            throw new CanonicalJsonAssertException(
+                $"JSON mismatch:\nExpected (canonical):\n{expectedCanonical}\n\nActual (canonical):\n{actualCanonical}");
+        }
+    }
+
+    /// <summary>
+    /// Asserts that two objects produce canonically equivalent JSON when serialized.
+    /// </summary>
+    public static void EquivalentObjects<T>(T expected, T actual)
+    {
+        var expectedJson = JsonSerializer.Serialize(expected, CanonicalOptions);
+        var actualJson = JsonSerializer.Serialize(actual, CanonicalOptions);
+
+        Equal(expectedJson, actualJson);
+    }
+
+    /// <summary>
+    /// Canonicalizes a JSON string by parsing and re-serializing with deterministic formatting.
+    /// </summary>
+    public static string Canonicalize(string json)
+    {
+        try
+        {
+            using var doc = JsonDocument.Parse(json);
+            return JsonSerializer.Serialize(doc.RootElement, CanonicalOptions);
+        }
+        catch (JsonException ex)
+        {
+            throw new CanonicalJsonAssertException($"Failed to parse JSON: {ex.Message}", ex);
+        }
+    }
+
+    /// <summary>
+    /// Computes a stable hash of canonical JSON for comparison.
+    /// </summary>
+    public static string ComputeHash(string json)
+    {
+        var canonical = Canonicalize(json);
+        using var sha256 = System.Security.Cryptography.SHA256.Create();
+        var hashBytes = sha256.ComputeHash(System.Text.Encoding.UTF8.GetBytes(canonical));
+        return Convert.ToHexString(hashBytes).ToLowerInvariant();
+    }
+
+    /// <summary>
+    /// Asserts that JSON matches a specific hash (for regression testing).
+    /// </summary>
+    public static void MatchesHash(string expectedHash, string json)
+    {
+        var actualHash = ComputeHash(json);
+        if (!string.Equals(expectedHash, actualHash, StringComparison.OrdinalIgnoreCase))
+        {
+            throw new CanonicalJsonAssertException(
+                $"JSON hash mismatch:\nExpected hash: {expectedHash}\nActual hash:   {actualHash}\n\nJSON (canonical):\n{Canonicalize(json)}");
+        }
+    }
+}
+
+/// <summary>
+/// Exception thrown when canonical JSON assertions fail.
+/// </summary>
+public sealed class CanonicalJsonAssertException : Exception
+{
+    public CanonicalJsonAssertException(string message) : base(message) { }
+    public CanonicalJsonAssertException(string message, Exception innerException) : base(message, innerException) { }
+}
--- a/src/__Libraries/StellaOps.TestKit/README.md
+++ b/src/__Libraries/StellaOps.TestKit/README.md
@@ -0,0 +1,174 @@
+# StellaOps.TestKit
+
+Test infrastructure and fixtures for StellaOps projects. Provides deterministic time/random, canonical JSON assertions, snapshot testing, database fixtures, and OpenTelemetry capture.
+
+## Features
+
+### Deterministic Time
+```csharp
+using StellaOps.TestKit.Time;
+
+// Create a clock at a fixed time
+var clock = new DeterministicClock();
+var now = clock.UtcNow; // 2025-01-01T00:00:00Z
+
+// Advance time
+clock.Advance(TimeSpan.FromMinutes(5));
+
+// Or use helpers
+var clock2 = DeterministicClockExtensions.AtTestEpoch();
+var clock3 = DeterministicClockExtensions.At("2025-06-15T10:30:00Z");
+```
+
+### Deterministic Random
+```csharp
+using StellaOps.TestKit.Random;
+
+// Create deterministic RNG with standard test seed (42)
+var rng = DeterministicRandomExtensions.WithTestSeed();
+
+// Generate reproducible values
+var number = rng.Next(1, 100);
+var text = rng.NextString(10);
+var item = rng.PickOne(new[] { "a", "b", "c" });
+```
+
+### Canonical JSON Assertions
+```csharp
+using StellaOps.TestKit.Json;
+
+// Assert JSON equality (ignores formatting)
+CanonicalJsonAssert.Equal(expectedJson, actualJson);
+
+// Assert object equivalence
+CanonicalJsonAssert.EquivalentObjects(expectedObj, actualObj);
+
+// Hash-based regression testing
+var hash = CanonicalJsonAssert.ComputeHash(json);
+CanonicalJsonAssert.MatchesHash("abc123...", json);
+```
+
+### Snapshot Testing
+```csharp
+using StellaOps.TestKit.Snapshots;
+
+public class MyTests
+{
+    [Fact]
+    public void TestOutput()
+    {
+        var output = GenerateSomeOutput();
+
+        // Compare against __snapshots__/test_output.txt
+        var snapshotPath = SnapshotHelper.GetSnapshotPath("test_output");
+        SnapshotHelper.VerifySnapshot(output, snapshotPath);
+    }
+
+    [Fact]
+    public void TestJsonOutput()
+    {
+        var obj = new { Name = "test", Value = 42 };
+
+        // Compare JSON serialization
+        var snapshotPath = SnapshotHelper.GetSnapshotPath("test_json", ".json");
+        SnapshotHelper.VerifyJsonSnapshot(obj, snapshotPath);
+    }
+}
+
+// Update snapshots: set environment variable UPDATE_SNAPSHOTS=1
+```
+
+### PostgreSQL Fixture
+```csharp
+using StellaOps.TestKit.Fixtures;
+using Xunit;
+
+[Collection("Postgres")]
+public class DatabaseTests
+{
+    private readonly PostgresFixture _postgres;
+
+    public DatabaseTests(PostgresFixture postgres)
+    {
+        _postgres = postgres;
+    }
+
+    [Fact]
+    public async Task TestQuery()
+    {
+        // Use connection string
+        await using var conn = new Npgsql.NpgsqlConnection(_postgres.ConnectionString);
+        await conn.OpenAsync();
+
+        // Execute SQL
+        await _postgres.ExecuteSqlAsync("CREATE TABLE test (id INT)");
+
+        // Create additional databases
+        await _postgres.CreateDatabaseAsync("otherdb");
+    }
+}
+```
+
+### Valkey/Redis Fixture
+```csharp
+using StellaOps.TestKit.Fixtures;
+using Xunit;
+
+[Collection("Valkey")]
+public class CacheTests
+{
+    private readonly ValkeyFixture _valkey;
+
+    public CacheTests(ValkeyFixture valkey)
+    {
+        _valkey = valkey;
+    }
+
+    [Fact]
+    public void TestCache()
+    {
+        var connectionString = _valkey.ConnectionString;
+        // Use with your Redis/Valkey client
+    }
+}
+```
+
+### OpenTelemetry Capture
+```csharp
+using StellaOps.TestKit.Telemetry;
+
+[Fact]
+public void TestTracing()
+{
+    using var otel = new OTelCapture("my-service");
+
+    // Code that emits traces
+    using (var activity = otel.ActivitySource.StartActivity("operation"))
+    {
+        activity?.SetTag("key", "value");
+    }
+
+    // Assert traces
+    otel.AssertActivityExists("operation");
+    otel.AssertActivityHasTag("operation", "key", "value");
+
+    // Get summary for debugging
+    Console.WriteLine(otel.GetTraceSummary());
+}
+```
+
+## Usage in Tests
+
+Add to your test project:
+```xml
+<ItemGroup>
+  <ProjectReference Include="..\..\__Libraries\StellaOps.TestKit\StellaOps.TestKit.csproj" />
+</ItemGroup>
+```
+
+## Design Principles
+
+- **Determinism**: All utilities produce reproducible results
+- **Offline-first**: No network dependencies (uses Testcontainers for local infrastructure)
+- **Minimal dependencies**: Only essential packages
+- **xUnit-friendly**: Works seamlessly with xUnit fixtures and collections
--- a/src/__Libraries/StellaOps.TestKit/Random/DeterministicRandom.cs
+++ b/src/__Libraries/StellaOps.TestKit/Random/DeterministicRandom.cs
@@ -0,0 +1,107 @@
+namespace StellaOps.TestKit.Random;
+
+/// <summary>
+/// Deterministic random number generator for testing with reproducible sequences.
+/// </summary>
+public sealed class DeterministicRandom
+{
+    private readonly System.Random _rng;
+    private readonly int _seed;
+
+    /// <summary>
+    /// Creates a new deterministic random number generator with the specified seed.
+    /// </summary>
+    /// <param name="seed">The seed value. If null, uses 42 (standard test seed).</param>
+    public DeterministicRandom(int? seed = null)
+    {
+        _seed = seed ?? 42;
+        _rng = new System.Random(_seed);
+    }
+
+    /// <summary>
+    /// Gets the seed used for this random number generator.
+    /// </summary>
+    public int Seed => _seed;
+
+    /// <summary>
+    /// Returns a non-negative random integer.
+    /// </summary>
+    public int Next() => _rng.Next();
+
+    /// <summary>
+    /// Returns a non-negative random integer less than the specified maximum.
+    /// </summary>
+    public int Next(int maxValue) => _rng.Next(maxValue);
+
+    /// <summary>
+    /// Returns a random integer within the specified range.
+    /// </summary>
+    public int Next(int minValue, int maxValue) => _rng.Next(minValue, maxValue);
+
+    /// <summary>
+    /// Returns a random double between 0.0 and 1.0.
+    /// </summary>
+    public double NextDouble() => _rng.NextDouble();
+
+    /// <summary>
+    /// Fills the specified byte array with random bytes.
+    /// </summary>
+    public void NextBytes(byte[] buffer) => _rng.NextBytes(buffer);
+
+    /// <summary>
+    /// Fills the specified span with random bytes.
+    /// </summary>
+    public void NextBytes(Span<byte> buffer) => _rng.NextBytes(buffer);
+
+    /// <summary>
+    /// Returns a random boolean value.
+    /// </summary>
+    public bool NextBool() => _rng.Next(2) == 1;
+
+    /// <summary>
+    /// Returns a random string of the specified length using alphanumeric characters.
+    /// </summary>
+    public string NextString(int length)
+    {
+        const string chars = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";
+        var result = new char[length];
+        for (int i = 0; i < length; i++)
+        {
+            result[i] = chars[_rng.Next(chars.Length)];
+        }
+        return new string(result);
+    }
+
+    /// <summary>
+    /// Selects a random element from the specified collection.
+    /// </summary>
+    public T PickOne<T>(IReadOnlyList<T> items)
+    {
+        if (items.Count == 0)
+        {
+            throw new ArgumentException("Cannot pick from empty collection", nameof(items));
+        }
+        return items[_rng.Next(items.Count)];
+    }
+}
+
+/// <summary>
+/// Extensions for working with deterministic random generators in tests.
+/// </summary>
+public static class DeterministicRandomExtensions
+{
+    /// <summary>
+    /// Standard test seed value.
+    /// </summary>
+    public const int TestSeed = 42;
+
+    /// <summary>
+    /// Creates a deterministic random generator with the standard test seed.
+    /// </summary>
+    public static DeterministicRandom WithTestSeed() => new(TestSeed);
+
+    /// <summary>
+    /// Creates a deterministic random generator with a specific seed.
+    /// </summary>
+    public static DeterministicRandom WithSeed(int seed) => new(seed);
+}
--- a/src/__Libraries/StellaOps.TestKit/Snapshots/SnapshotHelper.cs
+++ b/src/__Libraries/StellaOps.TestKit/Snapshots/SnapshotHelper.cs
@@ -0,0 +1,114 @@
+using System.Runtime.CompilerServices;
+using System.Text;
+using System.Text.Json;
+
+namespace StellaOps.TestKit.Snapshots;
+
+/// <summary>
+/// Helper for snapshot testing - comparing test output against golden files.
+/// </summary>
+public static class SnapshotHelper
+{
+    private static readonly JsonSerializerOptions DefaultOptions = new()
+    {
+        WriteIndented = true,
+        PropertyNamingPolicy = JsonNamingPolicy.CamelCase
+    };
+
+    /// <summary>
+    /// Verifies that actual content matches a snapshot file.
+    /// </summary>
+    /// <param name="actual">The actual content to verify.</param>
+    /// <param name="snapshotPath">Path to the snapshot file.</param>
+    /// <param name="updateSnapshots">If true, updates the snapshot file instead of comparing. Use for regenerating snapshots.</param>
+    public static void VerifySnapshot(string actual, string snapshotPath, bool updateSnapshots = false)
+    {
+        var normalizedActual = NormalizeLineEndings(actual);
+
+        if (updateSnapshots)
+        {
+            // Update mode: write the snapshot
+            Directory.CreateDirectory(Path.GetDirectoryName(snapshotPath)!);
+            File.WriteAllText(snapshotPath, normalizedActual, Encoding.UTF8);
+            return;
+        }
+
+        // Verify mode: compare against existing snapshot
+        if (!File.Exists(snapshotPath))
+        {
+            throw new SnapshotMismatchException(
+                $"Snapshot file not found: {snapshotPath}\n\nTo create it, run with updateSnapshots=true or set environment variable UPDATE_SNAPSHOTS=1");
+        }
+
+        var expected = File.ReadAllText(snapshotPath, Encoding.UTF8);
+        var normalizedExpected = NormalizeLineEndings(expected);
+
+        if (normalizedActual != normalizedExpected)
+        {
+            throw new SnapshotMismatchException(
+                $"Snapshot mismatch for {Path.GetFileName(snapshotPath)}:\n\nExpected:\n{normalizedExpected}\n\nActual:\n{normalizedActual}");
+        }
+    }
+
+    /// <summary>
+    /// Verifies that an object's JSON serialization matches a snapshot file.
+    /// </summary>
+    public static void VerifyJsonSnapshot<T>(T value, string snapshotPath, bool updateSnapshots = false, JsonSerializerOptions? options = null)
+    {
+        var json = JsonSerializer.Serialize(value, options ?? DefaultOptions);
+        VerifySnapshot(json, snapshotPath, updateSnapshots);
+    }
+
+    /// <summary>
+    /// Gets the snapshot directory for the calling test class.
+    /// </summary>
+    /// <param name="testFilePath">Automatically populated by compiler.</param>
+    /// <returns>Path to the __snapshots__ directory next to the test file.</returns>
+    public static string GetSnapshotDirectory([CallerFilePath] string testFilePath = "")
+    {
+        var testDir = Path.GetDirectoryName(testFilePath)!;
+        return Path.Combine(testDir, "__snapshots__");
+    }
+
+    /// <summary>
+    /// Gets the full path for a snapshot file.
+    /// </summary>
+    /// <param name="snapshotName">Name of the snapshot file (without extension).</param>
+    /// <param name="extension">File extension (default: .txt).</param>
+    /// <param name="testFilePath">Automatically populated by compiler.</param>
+    public static string GetSnapshotPath(
+        string snapshotName,
+        string extension = ".txt",
+        [CallerFilePath] string testFilePath = "")
+    {
+        var snapshotDir = GetSnapshotDirectory(testFilePath);
+        var fileName = $"{snapshotName}{extension}";
+        return Path.Combine(snapshotDir, fileName);
+    }
+
+    /// <summary>
+    /// Normalizes line endings to LF for cross-platform consistency.
+    /// </summary>
+    private static string NormalizeLineEndings(string content)
+    {
+        return content.Replace("\r\n", "\n").Replace("\r", "\n");
+    }
+
+    /// <summary>
+    /// Checks if snapshot update mode is enabled via environment variable.
+    /// </summary>
+    public static bool IsUpdateMode()
+    {
+        var updateEnv = Environment.GetEnvironmentVariable("UPDATE_SNAPSHOTS");
+        return string.Equals(updateEnv, "1", StringComparison.OrdinalIgnoreCase) ||
+               string.Equals(updateEnv, "true", StringComparison.OrdinalIgnoreCase);
+    }
+}
+
+/// <summary>
+/// Exception thrown when snapshot verification fails.
+/// </summary>
+public sealed class SnapshotMismatchException : Exception
+{
+    public SnapshotMismatchException(string message) : base(message) { }
+}
--- a/src/__Libraries/StellaOps.TestKit/StellaOps.TestKit.csproj
+++ b/src/__Libraries/StellaOps.TestKit/StellaOps.TestKit.csproj
@@ -0,0 +1,30 @@
+<Project Sdk="Microsoft.NET.Sdk">
+
+  <PropertyGroup>
+    <TargetFramework>net10.0</TargetFramework>
+    <LangVersion>preview</LangVersion>
+    <Nullable>enable</Nullable>
+    <ImplicitUsings>enable</ImplicitUsings>
+    <IsPackable>true</IsPackable>
+    <GenerateDocumentationFile>true</GenerateDocumentationFile>
+  </PropertyGroup>
+
+  <PropertyGroup>
+    <AssemblyName>StellaOps.TestKit</AssemblyName>
+    <RootNamespace>StellaOps.TestKit</RootNamespace>
+    <Description>Test infrastructure and fixtures for StellaOps projects - deterministic time/random, canonical JSON, snapshots, and database fixtures</Description>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <PackageReference Include="xunit.abstractions" Version="2.0.3" />
+    <PackageReference Include="xunit.extensibility.core" Version="2.9.2" />
+    <PackageReference Include="Testcontainers.PostgreSql" Version="4.1.0" />
+    <PackageReference Include="Testcontainers.Redis" Version="4.1.0" />
+    <PackageReference Include="Npgsql" Version="9.0.2" />
+    <PackageReference Include="System.Text.Json" Version="10.0.0" />
+    <PackageReference Include="OpenTelemetry" Version="1.10.0" />
+    <PackageReference Include="OpenTelemetry.Api" Version="1.10.0" />
+    <PackageReference Include="OpenTelemetry.Exporter.InMemory" Version="1.10.0" />
+  </ItemGroup>
+
+</Project>
--- a/src/__Libraries/StellaOps.TestKit/Telemetry/OTelCapture.cs
+++ b/src/__Libraries/StellaOps.TestKit/Telemetry/OTelCapture.cs
@@ -0,0 +1,150 @@
+using OpenTelemetry;
+using OpenTelemetry.Resources;
+using OpenTelemetry.Trace;
+using System.Diagnostics;
+
+namespace StellaOps.TestKit.Telemetry;
+
+/// <summary>
+/// Captures OpenTelemetry traces in-memory for testing.
+/// </summary>
+public sealed class OTelCapture : IDisposable
+{
+    private readonly TracerProvider _tracerProvider;
+    private readonly InMemoryExporter _exporter;
+    private readonly ActivitySource _activitySource;
+
+    public OTelCapture(string serviceName = "test-service")
+    {
+        _exporter = new InMemoryExporter();
+        _activitySource = new ActivitySource(serviceName);
+
+        _tracerProvider = Sdk.CreateTracerProviderBuilder()
+            .SetResourceBuilder(ResourceBuilder.CreateDefault().AddService(serviceName))
+            .AddSource(serviceName)
+            .AddInMemoryExporter(_exporter)
+            .Build()!;
+    }
+
+    /// <summary>
+    /// Gets all captured activities (spans).
+    /// </summary>
+    public IReadOnlyList<Activity> Activities => _exporter.Activities;
+
+    /// <summary>
+    /// Gets the activity source for creating spans in tests.
+    /// </summary>
+    public ActivitySource ActivitySource => _activitySource;
+
+    /// <summary>
+    /// Clears all captured activities.
+    /// </summary>
+    public void Clear()
+    {
+        _exporter.Activities.Clear();
+    }
+
+    /// <summary>
+    /// Finds activities by operation name.
+    /// </summary>
+    public IEnumerable<Activity> FindByOperationName(string operationName)
+    {
+        return Activities.Where(a => a.OperationName == operationName);
+    }
+
+    /// <summary>
+    /// Finds activities by tag value.
+    /// </summary>
+    public IEnumerable<Activity> FindByTag(string tagKey, string tagValue)
+    {
+        return Activities.Where(a => a.Tags.Any(t => t.Key == tagKey && t.Value == tagValue));
+    }
+
+    /// <summary>
+    /// Asserts that at least one activity with the specified operation name exists.
+    /// </summary>
+    public void AssertActivityExists(string operationName)
+    {
+        if (!Activities.Any(a => a.OperationName == operationName))
+        {
+            var availableOps = string.Join(", ", Activities.Select(a => a.OperationName).Distinct());
+            throw new OTelAssertException(
+                $"No activity found with operation name '{operationName}'. Available operations: {availableOps}");
+        }
+    }
+
+    /// <summary>
+    /// Asserts that an activity has a specific tag.
+    /// </summary>
+    public void AssertActivityHasTag(string operationName, string tagKey, string expectedValue)
+    {
+        var activities = FindByOperationName(operationName).ToList();
+        if (activities.Count == 0)
+        {
+            throw new OTelAssertException($"No activity found with operation name '{operationName}'");
+        }
+
+        var activity = activities.First();
+        var tag = activity.Tags.FirstOrDefault(t => t.Key == tagKey);
+        if (tag.Key == null)
+        {
+            throw new OTelAssertException($"Activity '{operationName}' does not have tag '{tagKey}'");
+        }
+
+        if (tag.Value != expectedValue)
+        {
+            throw new OTelAssertException(
+                $"Tag '{tagKey}' on activity '{operationName}' has value '{tag.Value}' but expected '{expectedValue}'");
+        }
+    }
+
+    /// <summary>
+    /// Gets a summary of captured traces for debugging.
+    /// </summary>
+    public string GetTraceSummary()
+    {
+        if (Activities.Count == 0)
+        {
+            return "No traces captured";
+        }
+
+        var summary = new System.Text.StringBuilder();
+        summary.AppendLine($"Captured {Activities.Count} activities:");
+        foreach (var activity in Activities)
+        {
+            summary.AppendLine($"  - {activity.OperationName} ({activity.Duration.TotalMilliseconds:F2}ms)");
+            foreach (var tag in activity.Tags)
+            {
+                summary.AppendLine($"      {tag.Key} = {tag.Value}");
+            }
+        }
+        return summary.ToString();
+    }
+
+    public void Dispose()
+    {
+        _tracerProvider?.Dispose();
+        _activitySource?.Dispose();
+    }
+}
+
+/// <summary>
+/// In-memory exporter for OpenTelemetry activities.
+/// </summary>
+internal sealed class InMemoryExporter
+{
+    public List<Activity> Activities { get; } = new();
+
+    public void Export(Activity activity)
+    {
+        Activities.Add(activity);
+    }
+}
+
+/// <summary>
+/// Exception thrown when OTel assertions fail.
+/// </summary>
+public sealed class OTelAssertException : Exception
+{
+    public OTelAssertException(string message) : base(message) { }
+}
--- a/src/__Libraries/StellaOps.TestKit/Time/DeterministicClock.cs
+++ b/src/__Libraries/StellaOps.TestKit/Time/DeterministicClock.cs
@@ -0,0 +1,70 @@
+namespace StellaOps.TestKit.Time;
+
+/// <summary>
+/// Deterministic clock for testing that returns a fixed time.
+/// </summary>
+public sealed class DeterministicClock
+{
+    private DateTimeOffset _currentTime;
+
+    /// <summary>
+    /// Creates a new deterministic clock with the specified initial time.
+    /// </summary>
+    /// <param name="initialTime">The initial time. If null, uses 2025-01-01T00:00:00Z.</param>
+    public DeterministicClock(DateTimeOffset? initialTime = null)
+    {
+        _currentTime = initialTime ?? new DateTimeOffset(2025, 1, 1, 0, 0, 0, TimeSpan.Zero);
+    }
+
+    /// <summary>
+    /// Gets the current time.
+    /// </summary>
+    public DateTimeOffset UtcNow => _currentTime;
+
+    /// <summary>
+    /// Advances the clock by the specified duration.
+    /// </summary>
+    /// <param name="duration">The duration to advance.</param>
+    public void Advance(TimeSpan duration)
+    {
+        _currentTime = _currentTime.Add(duration);
+    }
+
+    /// <summary>
+    /// Sets the clock to a specific time.
+    /// </summary>
+    /// <param name="time">The time to set.</param>
+    public void SetTime(DateTimeOffset time)
+    {
+        _currentTime = time;
+    }
+
+    /// <summary>
+    /// Resets the clock to the initial time.
+    /// </summary>
+    public void Reset()
+    {
+        _currentTime = new DateTimeOffset(2025, 1, 1, 0, 0, 0, TimeSpan.Zero);
+    }
+}
+
+/// <summary>
+/// Extensions for working with deterministic clocks in tests.
+/// </summary>
+public static class DeterministicClockExtensions
+{
+    /// <summary>
+    /// Standard test epoch: 2025-01-01T00:00:00Z
+    /// </summary>
+    public static readonly DateTimeOffset TestEpoch = new(2025, 1, 1, 0, 0, 0, TimeSpan.Zero);
+
+    /// <summary>
+    /// Creates a clock at the standard test epoch.
+    /// </summary>
+    public static DeterministicClock AtTestEpoch() => new(TestEpoch);
+
+    /// <summary>
+    /// Creates a clock at a specific ISO 8601 timestamp.
+    /// </summary>
+    public static DeterministicClock At(string iso8601) => new(DateTimeOffset.Parse(iso8601));
+}
--- a/src/__Libraries/StellaOps.TestKit/Traits/LaneTraitDiscoverer.cs
+++ b/src/__Libraries/StellaOps.TestKit/Traits/LaneTraitDiscoverer.cs
@@ -0,0 +1,21 @@
+using Xunit.Abstractions;
+using Xunit.Sdk;
+
+namespace StellaOps.TestKit.Traits;
+
+/// <summary>
+/// Trait discoverer for Lane attribute.
+/// </summary>
+public sealed class LaneTraitDiscoverer : ITraitDiscoverer
+{
+    public IEnumerable<KeyValuePair<string, string>> GetTraits(IAttributeInfo traitAttribute)
+    {
+        var lane = traitAttribute.GetNamedArgument<string>(nameof(LaneAttribute.Lane))
+                   ?? traitAttribute.GetConstructorArguments().FirstOrDefault()?.ToString();
+
+        if (!string.IsNullOrEmpty(lane))
+        {
+            yield return new KeyValuePair<string, string>("Lane", lane);
+        }
+    }
+}
--- a/src/__Libraries/StellaOps.TestKit/Traits/TestTraitAttributes.cs
+++ b/src/__Libraries/StellaOps.TestKit/Traits/TestTraitAttributes.cs
@@ -0,0 +1,144 @@
+using Xunit.Sdk;
+
+namespace StellaOps.TestKit.Traits;
+
+/// <summary>
+/// Base attribute for test traits that categorize tests by lane and type.
+/// </summary>
+[AttributeUsage(AttributeTargets.Method | AttributeTargets.Class, AllowMultiple = true)]
+public abstract class TestTraitAttributeBase : Attribute, ITraitAttribute
+{
+    protected TestTraitAttributeBase(string traitName, string value)
+    {
+        TraitName = traitName;
+        Value = value;
+    }
+
+    public string TraitName { get; }
+    public string Value { get; }
+}
+
+/// <summary>
+/// Marks a test as belonging to a specific test lane.
+/// Lanes: Unit, Contract, Integration, Security, Performance, Live
+/// </summary>
+[TraitDiscoverer("StellaOps.TestKit.Traits.LaneTraitDiscoverer", "StellaOps.TestKit")]
+[AttributeUsage(AttributeTargets.Method | AttributeTargets.Class, AllowMultiple = false)]
+public sealed class LaneAttribute : Attribute, ITraitAttribute
+{
+    public LaneAttribute(string lane)
+    {
+        Lane = lane ?? throw new ArgumentNullException(nameof(lane));
+    }
+
+    public string Lane { get; }
+}
+
+/// <summary>
+/// Marks a test with a specific test type trait.
+/// Common types: unit, property, snapshot, determinism, integration_postgres, contract, authz, etc.
+/// </summary>
+[TraitDiscoverer("StellaOps.TestKit.Traits.TestTypeTraitDiscoverer", "StellaOps.TestKit")]
+[AttributeUsage(AttributeTargets.Method | AttributeTargets.Class, AllowMultiple = true)]
+public sealed class TestTypeAttribute : Attribute, ITraitAttribute
+{
+    public TestTypeAttribute(string testType)
+    {
+        TestType = testType ?? throw new ArgumentNullException(nameof(testType));
+    }
+
+    public string TestType { get; }
+}
+
+// Lane-specific convenience attributes
+
+/// <summary>
+/// Marks a test as a Unit test.
+/// </summary>
+public sealed class UnitTestAttribute : LaneAttribute
+{
+    public UnitTestAttribute() : base("Unit") { }
+}
+
+/// <summary>
+/// Marks a test as a Contract test.
+/// </summary>
+public sealed class ContractTestAttribute : LaneAttribute
+{
+    public ContractTestAttribute() : base("Contract") { }
+}
+
+/// <summary>
+/// Marks a test as an Integration test.
+/// </summary>
+public sealed class IntegrationTestAttribute : LaneAttribute
+{
+    public IntegrationTestAttribute() : base("Integration") { }
+}
+
+/// <summary>
+/// Marks a test as a Security test.
+/// </summary>
+public sealed class SecurityTestAttribute : LaneAttribute
+{
+    public SecurityTestAttribute() : base("Security") { }
+}
+
+/// <summary>
+/// Marks a test as a Performance test.
+/// </summary>
+public sealed class PerformanceTestAttribute : LaneAttribute
+{
+    public PerformanceTestAttribute() : base("Performance") { }
+}
+
+/// <summary>
+/// Marks a test as a Live test (requires external connectivity).
+/// These tests should be opt-in only and never PR-gating.
+/// </summary>
+public sealed class LiveTestAttribute : LaneAttribute
+{
+    public LiveTestAttribute() : base("Live") { }
+}
+
+// Test type-specific convenience attributes
+
+/// <summary>
+/// Marks a test as testing determinism.
+/// </summary>
+public sealed class DeterminismTestAttribute : TestTypeAttribute
+{
+    public DeterminismTestAttribute() : base("determinism") { }
+}
+
+/// <summary>
+/// Marks a test as a snapshot test.
+/// </summary>
+public sealed class SnapshotTestAttribute : TestTypeAttribute
+{
+    public SnapshotTestAttribute() : base("snapshot") { }
+}
+
+/// <summary>
+/// Marks a test as a property-based test.
+/// </summary>
+public sealed class PropertyTestAttribute : TestTypeAttribute
+{
+    public PropertyTestAttribute() : base("property") { }
+}
+
+/// <summary>
+/// Marks a test as an authorization test.
+/// </summary>
+public sealed class AuthzTestAttribute : TestTypeAttribute
+{
+    public AuthzTestAttribute() : base("authz") { }
+}
+
+/// <summary>
+/// Marks a test as testing OpenTelemetry traces.
+/// </summary>
+public sealed class OTelTestAttribute : TestTypeAttribute
+{
+    public OTelTestAttribute() : base("otel") { }
+}
--- a/src/__Libraries/StellaOps.TestKit/Traits/TestTypeTraitDiscoverer.cs
+++ b/src/__Libraries/StellaOps.TestKit/Traits/TestTypeTraitDiscoverer.cs
@@ -0,0 +1,21 @@
+using Xunit.Abstractions;
+using Xunit.Sdk;
+
+namespace StellaOps.TestKit.Traits;
+
+/// <summary>
+/// Trait discoverer for TestType attribute.
+/// </summary>
+public sealed class TestTypeTraitDiscoverer : ITraitDiscoverer
+{
+    public IEnumerable<KeyValuePair<string, string>> GetTraits(IAttributeInfo traitAttribute)
+    {
+        var testType = traitAttribute.GetNamedArgument<string>(nameof(TestTypeAttribute.TestType))
+                       ?? traitAttribute.GetConstructorArguments().FirstOrDefault()?.ToString();
+
+        if (!string.IsNullOrEmpty(testType))
+        {
+            yield return new KeyValuePair<string, string>("TestType", testType);
+        }
+    }
+}