Add receipt input JSON and SHA256 hash for CVSS policy scoring tests

- Introduced a new JSON fixture `receipt-input.json` containing base, environmental, and threat metrics for CVSS scoring. - Added corresponding SHA256 hash file `receipt-input.sha256` to ensure integrity of the JSON fixture.
2025-12-04 07:30:42 +02:00
parent 2d079d61ed
commit e1262eb916
91 changed files with 19493 additions and 187 deletions
--- a/docs/implplan/SPRINT_0120_0000_0001_policy_reasoning.md
+++ b/docs/implplan/SPRINT_0120_0000_0001_policy_reasoning.md
@@ -28,6 +28,14 @@
 - **Air-gap provenance & staleness** (LEDGER-AIRGAP-56/57/58 · Findings Ledger Guild · AirGap Guilds · Evidence Locker Guild) — Status TODO. Requirements captured in `docs/modules/findings-ledger/airgap-provenance.md`; waiting on mirror bundle schema freeze + AirGap controller inputs.
 - **Attestation linkage** (LEDGER-ATTEST-73-001 · Findings Ledger Guild · Attestor Service Guild) — Status TODO. Waiting on attestation payload pointers from NOTIFY-ATTEST-74-001 work to reuse DSSE IDs.

+## Wave Coordination
+- **Wave A (observability + replay):** Tasks 0–2 DONE; metrics and harness frozen; keep schemas stable for downstream Ops/DevOps sprints.
+- **Wave B (provenance exports):** Task 4 DONE; uses orchestrator export contract (now marked DONE). Keep linkage stable.
+- **Wave C (air-gap provenance):** Tasks 5–8 partially DONE (56-001 done; 56-002/57-001/58-001 BLOCKED on staleness/bundle linkage). Execute sequentially once freshness spec lands.
+- **Wave D (attestation pointers):** Task 9 BLOCKED pending NOTIFY-ATTEST-74-001 alignment.
+- **Wave E (deployment collateral):** Task 3 BLOCKED pending DevOps paths for manifests/offline kit. Run after Wave C to avoid conflicting asset locations.
+- Do not start blocked waves until dependencies land; avoid drift by keeping current DONE artifacts immutable.
+
 ## Documentation Prerequisites
 - `docs/modules/findings-ledger/observability.md`
 - `docs/modules/findings-ledger/replay-harness.md`
@@ -56,6 +64,7 @@
 ## Execution Log
 | Date (UTC) | Update | Owner |
 | --- | --- | --- |
+| 2025-12-03 | Added Wave Coordination (A observability/replay done; B provenance exports done; C air-gap partly blocked; D attestation blocked; E deployment blocked). No status changes. | Project Mgmt |
 | 2025-12-03 | Documented orchestrator export contract at `docs/modules/orchestrator/job-export-contract.md`; external dependency marked DONE and linked from LEDGER-34-101. | Implementer |
 | 2025-11-25 | Reconciled tracker: marked LEDGER-29-007 (metrics/alerts) and LEDGER-29-008 (replay harness) DONE in tasks-all; statuses in this sprint already reflected completion dates. | Project Mgmt |
 | 2025-11-22 | LEDGER-29-008 delivered: replay harness metrics aligned (`ledger_write_duration_seconds`, gauges), projection risk fields fixed, new harness tests added; `dotnet test src/Findings/StellaOps.Findings.Ledger.Tests` passing (warnings only). | Findings Ledger Guild |
--- a/docs/implplan/SPRINT_0121_0001_0001_policy_reasoning.md
+++ b/docs/implplan/SPRINT_0121_0001_0001_policy_reasoning.md
@@ -12,6 +12,10 @@
 - Coordinate with Evidence Locker, Provenance, Risk Engine, and Observability guilds for shared schemas.
 - Concurrency safe with other CC-0121 efforts once contract changes stabilise.

+## Wave Coordination
+- **Wave A (exports/observability/risk):** Tasks 1–9 DONE; keep schemas and fixtures frozen for downstream SDK/DevOps sprints.
+- No remaining open tasks in this sprint; future work should open a new wave entry or new sprint file.
+
 ## Documentation Prerequisites
 - docs/README.md
 - docs/07_HIGH_LEVEL_ARCHITECTURE.md
@@ -48,6 +52,7 @@
 ## Execution Log
 | Date (UTC) | Update | Owner |
 | --- | --- | --- |
+| 2025-12-03 | Added Wave Coordination (Wave A done; no open tasks—future work needs new wave/sprint). No status changes. | Project Mgmt |
 | 2025-12-02 | Completed LEDGER-GAPS-121-009: added schema catalog + FL1–FL10 gap report, Merkle/anchor policy, redaction manifest, DSSE linkage doc, golden export fixtures + checksums, offline verifier script with replay checksum guard, quota/backpressure metrics/code/tests. | Findings Ledger |
 | 2025-12-02 | Started LEDGER-GAPS-121-009 (FL1–FL10 remediation); status → DOING; drafting schema catalog, Merkle/anchor policy, redaction manifest, offline verifier, and backpressure metrics. | Findings Ledger |
 | 2025-12-01 | Added LEDGER-GAPS-121-009 to track FL1–FL10 remediation from `docs/product-advisories/28-Nov-2025 - Findings Ledger and Immutable Audit Trail.md`; status TODO pending schema catalog refresh. | Project Mgmt |
--- a/docs/implplan/SPRINT_0122_0001_0001_policy_reasoning.md
+++ b/docs/implplan/SPRINT_0122_0001_0001_policy_reasoning.md
@@ -11,6 +11,12 @@
 - Coordinate with Risk Engine, Export Center, and Platform/DB guilds for RLS + partitioning design.
 - Concurrency: safe with other CC-0122 efforts once DB/Risk contracts are stable.

+## Wave Coordination
+- **Wave A (prep):** P1–P3 DONE; keep prep docs frozen.
+- **Wave B (risk queries/exports):** Tasks 1–3 BLOCKED on risk scoring contract (66-002) and Export Center specs.
+- **Wave C (tenancy):** Tasks 4/4b BLOCKED on RLS/partition design; runs after Wave B to align schemas.
+- No work in progress until upstream contracts land; do not start Waves B/C prematurely.
+
 ## Documentation Prerequisites
 - docs/README.md
 - docs/07_HIGH_LEVEL_ARCHITECTURE.md
@@ -36,6 +42,7 @@
 ## Execution Log
 | Date (UTC) | Update | Owner |
 | --- | --- | --- |
+| 2025-12-03 | Added Wave Coordination (A prep done; B risk queries/exports blocked; C tenancy blocked). No status changes. | Project Mgmt |
 | 2025-11-20 | Published ledger risk/tenancy prep doc (docs/modules/findings-ledger/prep/2025-11-20-ledger-risk-prep.md); set PREP-LEDGER-RISK-68/69 and TEN-48-001 to DOING. | Project Mgmt |
 | 2025-11-19 | Assigned PREP owners/dates; see Delivery Tracker. | Planning |
 | 2025-11-18 | Renamed file to `SPRINT_0122_0001_0001_policy_reasoning.md` and normalised to standard template; no scope changes. | Findings Ledger |
--- a/docs/implplan/SPRINT_0123_0001_0001_policy_reasoning.md
+++ b/docs/implplan/SPRINT_0123_0001_0001_policy_reasoning.md
@@ -10,6 +10,14 @@
 - Upstream: Export bundle schema + scheduler job spec; mirror bundle/air-gap schema and sealed-mode rules; Attestor verification policy schema; Authority `effective:write` contract; Console API filters/pagination spec.
 - Concurrency: Execute tasks in table order (DOING → TODO → BLOCKED). All tasks currently blocked pending upstream contracts; no parallel execution until contracts land.

+## Wave Coordination
+- **Wave A (prep + Console contract):** P1–P15 DONE, including POLICY-CONSOLE-23-001 contract; keep prep docs stable.
+- **Wave B (Console export job):** Task 1 BLOCKED awaiting export bundle schema + scheduler job spec.
+- **Wave C (air-gap chain):** Tasks 2–6 BLOCKED on mirror/sealed-mode/staleness schemas; runs after Wave B when bundle schema freezes.
+- **Wave D (AOC linting):** Tasks 7–10 BLOCKED on analyzer targets and Authority gate contract.
+- **Wave E (attestation):** Tasks 11–14 BLOCKED on Attestor verification policy + Console report schema.
+- No work in progress; do not start any wave until dependencies land.
+
 ## Documentation Prerequisites
 - `docs/README.md`
 - `docs/07_HIGH_LEVEL_ARCHITECTURE.md`
@@ -54,6 +62,7 @@
 ## Execution Log
 | Date (UTC) | Update | Owner |
 | --- | --- | --- |
+| 2025-12-03 | Added Wave Coordination (A prep+Console contract done; B export blocked; C air-gap blocked; D AOC blocked; E attestation blocked). No status changes. | Project Mgmt |
 | 2025-11-22 | Added aggregate prep index files (`docs/modules/policy/prep/2025-11-20-policy-airgap-prep.md`, `...-policy-aoc-prep.md`, `...-policy-attest-prep.md`) to satisfy PREP references. | Project Mgmt |
 | 2025-11-20 | Started PREP air-gap chain (56-001..58-001), AOC chain (19-001..19-004), and attestation chain (73-001..74-002); published prep drafts in `docs/modules/policy/prep/` (see `2025-11-20-policy-airgap-prep.md`, `...policy-aoc-prep.md`, `...policy-attest-prep.md` for index). | Project Mgmt |
 | 2025-11-19 | Removed trailing hyphen from PREP-POLICY-ATTEST-73-001-VERIFICATIONPOLICY so dependent task resolves correctly. | Project Mgmt |
--- a/docs/implplan/SPRINT_0124_0001_0001_policy_reasoning.md
+++ b/docs/implplan/SPRINT_0124_0001_0001_policy_reasoning.md
@@ -9,6 +9,11 @@
 - Upstream: Sprint 120.C Policy.I must land before this track.
 - Concurrency: execute tasks in listed order (DOING → TODO → BLOCKED).

+## Wave Coordination
+- **Wave A (core evaluator + storage):** Tasks 1–12 DONE; keep determinism policies and schemas frozen.
+- **Wave B (Console simulation/export):** Task 13 DONE; reruns allowed for tests only; contract at `docs/modules/policy/contracts/policy-console-23-001-console-api.md` is source of truth.
+- No remaining open tasks; future deltas require new wave entry.
+
 ## Documentation Prerequisites
 - `docs/README.md`
 - `docs/07_HIGH_LEVEL_ARCHITECTURE.md`
@@ -44,6 +49,7 @@
 ## Execution Log
 | Date (UTC) | Update | Owner |
 | --- | --- | --- |
+| 2025-12-03 | Added Wave Coordination (Wave A core/storages done; Wave B Console simulation/export done; no open tasks). No status changes. | Project Mgmt |
 | 2025-12-02 | Fixed selection join canonical ordering (PurlEquivalence canonical now derived from sorted list, not hashset); `dotnet test src/Policy/__Tests/StellaOps.Policy.Engine.Tests/StellaOps.Policy.Engine.Tests.csproj -c Release --no-build` now passes (211/211, 5.0s). | Implementer |
 | 2025-12-02 | Reran `dotnet test src/Policy/__Tests/StellaOps.Policy.Engine.Tests/StellaOps.Policy.Engine.Tests.csproj -c Release --no-build`; failed 1/211 tests (`SelectionJoinTests.GetCanonical_ReturnsFirstLexicographically` expected `pkg:npm/a-package` but returned `pkg:npm/b-package`). Build duration 13.5s. Needs follow-up fix. | Implementer |
 | 2025-12-02 | Published POLICY-CONSOLE-23-001 contract at `docs/modules/policy/contracts/policy-console-23-001-console-api.md`; unblocked POLICY-CONSOLE-23-002 (set to TODO). | Project Mgmt |
--- a/docs/implplan/SPRINT_0125_0001_0001_policy_reasoning.md
+++ b/docs/implplan/SPRINT_0125_0001_0001_policy_reasoning.md
@@ -8,6 +8,13 @@
 - Upstream: POLICY-ENGINE-29-002 contract/schema published (2025-11-23); execute tasks in listed order.
 - Concurrency: Proceed sequentially from 29-003 downward to preserve overlay/metrics dependencies.

+## Wave Coordination
+- **Wave A (prep + contracts):** P0–P14 DONE; contracts frozen.
+- **Wave B (path/scope & observability):** Tasks 1–2 DONE; keep metrics/log schema stable.
+- **Wave C (overlays/simulation/change events):** Tasks 3–5 DONE.
+- **Wave D (trust/snapshot/export/events/fusion):** Tasks 6–15 DONE.
+- No open tasks; any new work should add a new wave entry.
+
 ## Documentation Prerequisites
 - `docs/README.md`
 - `docs/07_HIGH_LEVEL_ARCHITECTURE.md`
@@ -55,6 +62,7 @@
 ## Execution Log
 | Date (UTC) | Update | Owner |
 | --- | --- | --- |
+| 2025-12-03 | Added Wave Coordination (A prep done; B path/scope+obs done; C overlays/simulation done; D trust/export/snapshot/events/fusion done). No status changes. | Project Mgmt |
 | 2025-11-24 | Completed POLICY-ENGINE-32-101: orchestrator job schema + NDJSON sample and submission/preview endpoints backed by deterministic ULID builder. | Implementer |
 | 2025-11-24 | Completed POLICY-ENGINE-33-101: worker stub executes queued jobs idempotently, emits stable result hashes, worker result schema/sample added. | Implementer |
 | 2025-11-24 | Completed POLICY-ENGINE-34-101: ledger export NDJSON manifest/records with deterministic ordering, schema/sample committed and endpoint exposed. | Implementer |
--- a/docs/implplan/SPRINT_0126_0001_0001_policy_reasoning.md
+++ b/docs/implplan/SPRINT_0126_0001_0001_policy_reasoning.md
@@ -8,6 +8,10 @@
 - Upstream: Sprint 120.C Policy.III must land.
 - Concurrency: execute tasks in listed order; all currently TODO.

+## Wave Coordination
+- **Wave A (compiler/runtime/events/storage):** Tasks 1–16 DONE; keep schemas/telemetry stable.
+- No open tasks; future work requires new wave entry.
+
 ## Documentation Prerequisites
 - `docs/README.md`
 - `docs/07_HIGH_LEVEL_ARCHITECTURE.md`
@@ -37,6 +41,7 @@
 ## Execution Log
 | Date (UTC) | Update | Owner |
 | --- | --- | --- |
+| 2025-12-03 | Added Wave Coordination (Wave A compiler/runtime/events/storage done; no open tasks). No status changes. | Project Mgmt |
 | 2025-11-08 | Sprint stub; awaiting upstream phases. | Planning |
 | 2025-11-19 | Normalized to standard template and renamed from `SPRINT_126_policy_reasoning.md` to `SPRINT_0126_0001_0001_policy_reasoning.md`; content preserved. | Implementer |
 | 2025-11-26 | POLICY-ENGINE-40-003 delivered: evidence summary service + `/evidence/summary` endpoint and deterministic headline/severity/signals; unit tests added (`EvidenceSummaryServiceTests`). Targeted test slice canceled due to static-graph fan-out; rerun on clean host recommended. | Implementer |
--- a/docs/implplan/SPRINT_0127_0001_0001_policy_reasoning.md
+++ b/docs/implplan/SPRINT_0127_0001_0001_policy_reasoning.md
@@ -4,10 +4,13 @@
 - Policy Engine V: reachability integration, telemetry, incident mode, and initial RiskProfile schema work.
 - **Working directory:** `src/Policy/StellaOps.Policy.Engine` and `src/Policy/__Libraries/StellaOps.Policy.RiskProfile`.

-## Dependencies & Concurrency
- Upstream: Sprint 120.C Policy.IV must land.
- Concurrency: execute tasks in listed order; all tasks currently TODO.
-
+## Dependencies & Concurrency
+- Upstream: Sprint 120.C Policy.IV must land.
+- Concurrency: execute tasks in listed order; all tasks currently TODO.
+
+## Wave Coordination
+- **Wave A (reachability + observability + risk profiles):** Tasks P1 and 1–15 DONE; keep schemas/metrics stable. No remaining open tasks.
+
 ## Documentation Prerequisites
 - `docs/README.md`
 - `docs/07_HIGH_LEVEL_ARCHITECTURE.md`
@@ -35,9 +38,10 @@
 | 15 | POLICY-RISK-67-001 | DONE (2025-11-27) | Depends on 67-001. | Risk Profile Schema Guild · Policy Engine Guild / `src/Policy/StellaOps.Policy.RiskProfile` | Profile storage/versioning lifecycle. |

 ## Execution Log
-| Date (UTC) | Update | Owner |
-| --- | --- | --- |
-| 2025-11-27 | `POLICY-ENGINE-80-002`: Created reachability facts joining layer in `ReachabilityFacts/` directory: `ReachabilityFactsModels.cs` (data models with state/confidence/score, ReachabilityState enum, ReachabilityFactKey), `ReachabilityFactsStore.cs` (IReachabilityFactsStore interface, InMemoryReachabilityFactsStore, MongoDB index definitions), `ReachabilityFactsOverlayCache.cs` (IReachabilityFactsOverlayCache interface, InMemoryReachabilityFactsOverlayCache with TTL eviction, ReachabilityFactsCacheOptions), `ReachabilityFactsJoiningService.cs` (batch lookup with cache-first strategy, signal enrichment, ReachabilityFactsTelemetry). Registered services in Program.cs DI. | Implementer |
+| Date (UTC) | Update | Owner |
+| --- | --- | --- |
+| 2025-12-03 | Added Wave Coordination (Wave A reachability/observability/risk profiles done; sprint complete). No status changes. | Project Mgmt |
+| 2025-11-27 | `POLICY-ENGINE-80-002`: Created reachability facts joining layer in `ReachabilityFacts/` directory: `ReachabilityFactsModels.cs` (data models with state/confidence/score, ReachabilityState enum, ReachabilityFactKey), `ReachabilityFactsStore.cs` (IReachabilityFactsStore interface, InMemoryReachabilityFactsStore, MongoDB index definitions), `ReachabilityFactsOverlayCache.cs` (IReachabilityFactsOverlayCache interface, InMemoryReachabilityFactsOverlayCache with TTL eviction, ReachabilityFactsCacheOptions), `ReachabilityFactsJoiningService.cs` (batch lookup with cache-first strategy, signal enrichment, ReachabilityFactsTelemetry). Registered services in Program.cs DI. | Implementer |
 | 2025-11-27 | `POLICY-ENGINE-80-003`: Extended SPL predicates for reachability. Added `PolicyEvaluationReachability` record to `PolicyEvaluationContext.cs` with state/confidence/score/method/source properties and helper predicates (IsReachable, IsUnreachable, IsHighConfidence). Added `ReachabilityScope` to `PolicyExpressionEvaluator.cs` supporting SPL expressions like `reachability.state == "reachable"`, `reachability.confidence >= 0.8`, `reachability.is_high_confidence`. | Implementer |
 | 2025-11-27 | `POLICY-ENGINE-80-004`: Added reachability metrics to `PolicyEngineTelemetry.cs`: `policy_reachability_applied_total{state}`, `policy_reachability_cache_hits_total`, `policy_reachability_cache_misses_total`, `policy_reachability_cache_hit_ratio` (observable gauge), `policy_reachability_lookups_total{outcome}`, `policy_reachability_lookup_seconds`. Updated `ReachabilityFactsTelemetry` to delegate to centralized PolicyEngineTelemetry. | Implementer |
 | 2025-11-27 | `POLICY-RISK-67-001` (task 15): Created `Lifecycle/RiskProfileLifecycle.cs` with lifecycle models (RiskProfileLifecycleStatus enum: Draft/Active/Deprecated/Archived, RiskProfileVersionInfo, RiskProfileLifecycleEvent, RiskProfileVersionComparison, RiskProfileChange). Created `RiskProfileLifecycleService` with status transitions (CreateVersion, Activate, Deprecate, Archive, Restore), version management, event recording, and version comparison (detecting breaking changes in signals/inheritance). | Implementer |
--- a/docs/implplan/SPRINT_0128_0001_0001_policy_reasoning.md
+++ b/docs/implplan/SPRINT_0128_0001_0001_policy_reasoning.md
@@ -4,10 +4,16 @@
 - Policy Engine VI: Risk profile lifecycle APIs, simulation bridge, overrides, exports, and SPL schema evolution.
 - **Working directory:** `src/Policy/StellaOps.Policy.Engine` and `src/Policy/__Libraries/StellaOps.Policy`.

-## Dependencies & Concurrency
- Upstream: Policy.V (0127) reachability/risk groundwork must land first.
- Concurrency: execute tasks in listed order; all tasks currently TODO.
-
+## Dependencies & Concurrency
+- Upstream: Policy.V (0127) reachability/risk groundwork must land first.
+- Concurrency: execute tasks in listed order; all tasks currently TODO.
+
+## Wave Coordination
+- **Wave A (SPL schema/tooling):** Tasks 10–15 DONE; keep SPL schema/fixtures/canonicalizer/layering stable.
+- **Wave B (risk profile lifecycle APIs):** Tasks 1–2 DONE; publish schema and lifecycle endpoints; hold steady for downstream consumers.
+- **Wave C (risk simulations/overrides/exports/notifications/air-gap):** Tasks 3–9 BLOCKED on Policy Studio contract, Authority attachment rules, override audit fields, notifications, and air-gap packaging; run sequentially once contracts land.
+- No additional work in progress; avoid starting Wave C until dependencies clear.
+
 ## Documentation Prerequisites
 - `docs/README.md`
 - `docs/07_HIGH_LEVEL_ARCHITECTURE.md`
@@ -34,9 +40,10 @@
 | 15 | POLICY-SPL-24-001 | DONE (2025-11-26) | — | Policy · Signals Guild / `src/Policy/__Libraries/StellaOps.Policy` | Extend SPL with reachability/exploitability predicates. |

 ## Execution Log
-| Date (UTC) | Update | Owner |
-| --- | --- | --- |
-| 2025-11-27 | `POLICY-RISK-67-002` (task 2): Added `RiskProfileSchemaEndpoints.cs` with `/.well-known/risk-profile-schema` endpoint (anonymous, ETag/Cache-Control, schema v1) and `/api/risk/schema/validate` POST endpoint for profile validation. Extended `RiskProfileSchemaProvider` with GetSchemaText(), GetSchemaVersion(), and GetETag() methods. Added `risk-profile` CLI command group with `validate` (--input, --format, --output, --strict) and `schema` (--output) subcommands. Added RiskProfile project reference to CLI. | Implementer |
+| Date (UTC) | Update | Owner |
+| --- | --- | --- |
+| 2025-12-03 | Added Wave Coordination (A SPL tooling done; B risk lifecycle APIs done; C simulations/overrides/exports/notifications/air-gap blocked). No status changes. | Project Mgmt |
+| 2025-11-27 | `POLICY-RISK-67-002` (task 2): Added `RiskProfileSchemaEndpoints.cs` with `/.well-known/risk-profile-schema` endpoint (anonymous, ETag/Cache-Control, schema v1) and `/api/risk/schema/validate` POST endpoint for profile validation. Extended `RiskProfileSchemaProvider` with GetSchemaText(), GetSchemaVersion(), and GetETag() methods. Added `risk-profile` CLI command group with `validate` (--input, --format, --output, --strict) and `schema` (--output) subcommands. Added RiskProfile project reference to CLI. | Implementer |
 | 2025-11-27 | `POLICY-RISK-67-002` (task 1): Created `Endpoints/RiskProfileEndpoints.cs` with REST APIs for profile lifecycle management: ListProfiles, GetProfile, ListVersions, GetVersion, CreateProfile (draft), ActivateProfile, DeprecateProfile, ArchiveProfile, GetProfileEvents, CompareProfiles, GetProfileHash. Uses `RiskProfileLifecycleService` for status transitions and `RiskProfileConfigurationService` for profile storage/hashing. Authorization via StellaOpsScopes (PolicyRead/PolicyEdit/PolicyActivate). Registered `RiskProfileLifecycleService` in DI and wired up `MapRiskProfiles()` in Program.cs. | Implementer |
 | 2025-11-25 | Delivered SPL v1 schema + sample fixtures (spl-schema@1.json, spl-sample@1.json, SplSchemaResource) and embedded in `StellaOps.Policy`; marked POLICY-SPL-23-001 DONE. | Implementer |
 | 2025-11-26 | Implemented SPL canonicalizer + SHA-256 digest (order-stable statements/actions/conditions) with unit tests; marked POLICY-SPL-23-002 DONE. | Implementer |
--- a/docs/implplan/SPRINT_0129_0001_0001_policy_reasoning.md
+++ b/docs/implplan/SPRINT_0129_0001_0001_policy_reasoning.md
@@ -7,6 +7,13 @@
 ## Dependencies & Concurrency
 - Upstream: Policy.VI (0128) + Risk/VEX foundations; execute tasks in listed order; all tasks currently TODO.

+## Wave Coordination
+- **Wave A (RiskEngine + Vuln API):** Tasks 12–18 and 35–37 DONE; keep schemas/fixtures stable.
+- **Wave B (Registry API):** Tasks 2–11 BLOCKED on OpenAPI spec and registry design; run sequentially once spec lands.
+- **Wave C (Policy tenancy):** Task 1 BLOCKED on platform RLS design; align with Registry once available.
+- **Wave D (VEX Lens):** Tasks 19–34 and AIAI/EXPORT/ORCH chain BLOCKED on normalization schema, issuer directory, API governance; runs after Wave B/C to avoid drift.
+- No active work until upstream specs arrive; maintain current DONE artefacts frozen.
+
 ## Documentation Prerequisites
 - `docs/README.md`
 - `docs/07_HIGH_LEVEL_ARCHITECTURE.md`
@@ -58,6 +65,7 @@
 ## Execution Log
 | Date (UTC) | Update | Owner |
 | --- | --- | --- |
+| 2025-12-03 | Added Wave Coordination (A RiskEngine+Vuln API done; B Registry blocked; C tenancy blocked; D VEX Lens blocked). No status changes. | Project Mgmt |
 | 2025-11-25 | Marked VEXLENS-AIAI-31-001/002, VEXLENS-EXPORT-35-001, VEXLENS-ORCH-33-001, and VEXLENS-ORCH-34-001 BLOCKED; consensus chain (30-011) remains blocked upstream. | Project Mgmt |
 | 2025-11-25 | RISK-ENGINE-67-002 DONE: VEX gate provider added with short-circuit tests; packaged in RiskEngine queue/worker pipeline. | Implementer |
 | 2025-11-25 | RISK-ENGINE-67-001 DONE: added CVSS+KEV provider and tests; score formula clamp((cvss/10)+0.2 if KEV). | Implementer |
--- a/docs/implplan/SPRINT_0131_0001_0001_scanner_surface.md
+++ b/docs/implplan/SPRINT_0131_0001_0001_scanner_surface.md
@@ -11,6 +11,13 @@
 - Deno work depends on `SCANNER-ANALYZERS-DENO-26-008`; Java chain builds serially from 21-005 → 21-006 → 21-007 → 21-008 → 21-009 → 21-010 → 21-011.
 - Stay within scanner scope to avoid new cross-module coupling unless explicitly approved.

+## Wave Coordination
+- **Wave A (Deno runtime hooks):** Tasks 1–3 DONE; keep runtime trace/signal schemas frozen.
+- **Wave B (Java analyzers chain):** Tasks 4–10 BLOCKED on 21-005/21-008 completion and CI runner (DEVOPS-SCANNER-CI-11-001).
+- **Wave C (DotNet entrypoints):** Task 11 BLOCKED pending CI runner to resolve test hangs.
+- **Wave D (PHP analyzer bootstrap):** Task 12 BLOCKED pending spec/fixtures.
+- Work remains blocked in Waves B–D; avoid starts until dependencies and CI runner are available.
+
 ## Documentation Prerequisites
 - docs/README.md
 - docs/07_HIGH_LEVEL_ARCHITECTURE.md
@@ -41,6 +48,7 @@
 ## Execution Log
 | Date (UTC) | Update | Owner |
 | --- | --- | --- |
+| 2025-12-03 | Added Wave Coordination (A Deno done; B Java chain blocked; C DotNet entrypoints blocked; D PHP bootstrap blocked). No status changes. | Project Mgmt |
 | 2025-11-20 | Published prep docs for P2/P3: `docs/modules/scanner/prep/2025-11-20-java-21-008-prep.md` and `docs/modules/scanner/prep/2025-11-20-lang-11-001-prep.md`; set PREP P2/P3 to DOING after confirming unowned. | Project Mgmt |
 | 2025-11-20 | Published prep note for SCANNER-ANALYZERS-JAVA-21-005 (docs/modules/scanner/prep/2025-11-20-java-21-005-prep.md); pinged Concelier/CoreLinksets owners for missing packages and CI isolation. | Project Mgmt |
 | 2025-11-20 | Confirmed PREP-SCANNER-ANALYZERS-JAVA-21-005-TESTS-BLOC still TODO; moved to DOING to capture blockers and prep artefact. | Project Mgmt |
--- a/docs/implplan/SPRINT_0132_0001_0001_scanner_surface.md
+++ b/docs/implplan/SPRINT_0132_0001_0001_scanner_surface.md
@@ -12,6 +12,13 @@
 - Sprints 130–139 remain sequential; do not pull tasks from later sprints until predecessors are complete.
 - Within this sprint, guild tasks can proceed in parallel once their listed dependencies are satisfied.

+## Wave Coordination
+- **Wave A (prep + governance):** P1–P5 DONE; module AGENTS task 20 DONE; keep prep docs stable.
+- **Wave B (native analyzers):** Tasks 5–14 DONE; stable outputs/fixtures.
+- **Wave C (Node analyzers):** Tasks 15–19 DONE; keep resolver/import outputs frozen.
+- **Wave D (DotNet analyzers):** Tasks 1–4 BLOCKED on upstream 11-001 outputs and CI runner; proceed sequentially once unblocked.
+- Work outstanding only in Wave D; avoid starts until dependencies clear.
+
 ## Documentation Prerequisites
 - docs/README.md
 - docs/07_HIGH_LEVEL_ARCHITECTURE.md
@@ -55,6 +62,7 @@

 | Date (UTC) | Update | Owner |
 | --- | --- | --- |
+| 2025-12-03 | Added Wave Coordination (A prep/governance done; B native analyzers done; C Node analyzers done; D DotNet analyzers blocked). No status changes. | Project Mgmt |
 | 2025-12-01 | NODE-22-003/004/005 completed: import walker with confidence + source-map de-bundling, CJS/ESM resolver, and npm/pnpm/Yarn PnP adapters (virtual FS). Plug-in manifest v0.1.0 packaged with runtime hooks for Offline Kit/CLI surface. | Node Analyzer Guild |
 | 2025-11-27 | **NODE-22-001 and NODE-22-002 COMPLETED.** Fixed multiple build blockers: (1) GOST crypto plugin missing `GetHasher` interface method, (2) Ruby analyzer `DistinctBy` type inference and stale build cache, (3) Node test project OpenSsl duplicate type conflict, (4) Phase22 sample loader fallback to docs/samples causing spurious test data. Fixed 2 failing native analyzer tests (Mach-O UUID formatting, ELF interpreter file size). Updated golden files for version-targets and entrypoints fixtures. All 10 Node analyzer tests now passing. Native analyzer tests: 165 passing. | Implementer |
 | 2025-11-27 | Attempted targeted Node analyzer test slice (`StellaOps.Scanner.Node.slnf --filter FullyQualifiedName~NodeLanguageAnalyzerTests --no-restore`); build graph pulled broader solution and was cancelled to avoid runaway runtime. Node tasks remain DOING pending slimmer graph/clean runner. | Node Analyzer Guild |
--- a/docs/implplan/SPRINT_0151_0001_0001_orchestrator_i.md
+++ b/docs/implplan/SPRINT_0151_0001_0001_orchestrator_i.md
@@ -56,7 +56,7 @@
 | 13 | ORCH-OBS-54-001 | BLOCKED (2025-11-19) | PREP-ORCH-OBS-54-001-DEPENDS-ON-53-001 | Orchestrator Service Guild · Provenance Guild | Produce DSSE attestations for orchestrator-scheduled jobs; store references in timeline + Evidence Locker; add verification endpoint `/jobs/{id}/attestation`. |
 | 14 | ORCH-OBS-55-001 | BLOCKED (2025-11-19) | PREP-ORCH-OBS-55-001-DEPENDS-ON-54-001-INCIDE | Orchestrator Service Guild · DevOps Guild | Incident mode hooks (sampling overrides, extended retention, debug spans) with automatic activation on SLO burn-rate breach; emit activation/deactivation events. |
 | 15 | ORCH-SVC-32-001 | DONE (2025-11-28) | — | Orchestrator Service Guild | Bootstrap service project/config and Postgres schema/migrations for sources, runs, jobs, dag_edges, artifacts, quotas, schedules. |
-| 16 | ORCH-GAPS-151-016 | DOING (2025-12-01) | Close OR1–OR10 gaps from `31-Nov-2025 FINDINGS.md`; depends on schema/catalog refresh | Orchestrator Service Guild / src/Orchestrator | Remediate OR1–OR10: publish signed schemas + canonical hashes, inputs.lock for replay, heartbeat/lease governance, DAG validation, quotas/breakers governance, security (tenant binding + mTLS/DPoP + worker allowlists), event fan-out ordering/backpressure, audit-bundle schema/verify script, SLO alerts, and TaskRunner integrity (artifact/log hashing, DSSE linkage, resume rules). |
+| 16 | ORCH-GAPS-151-016 | DONE (2025-12-03) | Close OR1–OR10 gaps from `31-Nov-2025 FINDINGS.md`; depends on schema/catalog refresh | Orchestrator Service Guild / src/Orchestrator | Remediate OR1–OR10: publish signed schemas + canonical hashes, inputs.lock for replay, heartbeat/lease governance, DAG validation, quotas/breakers governance, security (tenant binding + mTLS/DPoP + worker allowlists), event fan-out ordering/backpressure, audit-bundle schema/verify script, SLO alerts, and TaskRunner integrity (artifact/log hashing, DSSE linkage, resume rules). |

 ## Execution Log
 | Date (UTC) | Update | Owner |
@@ -87,6 +87,7 @@
 | 2025-12-02 | ORCH-GAPS-151-016: added replay inputs lock schema, DSSE hash recipe, and conformance tests to ensure hash/manifest alignment. | Implementer |
 | 2025-12-02 | ORCH-GAPS-151-016: added pack-run log integrity fields (canonical SHA-256 + size) with deterministic hashing and updated log tests. | Implementer |
 | 2025-12-02 | ORCH-GAPS-151-016: enforced artifact digest+size validation on pack-run completion and included artifact digests/sizes in completion events. | Implementer |
+| 2025-12-03 | ORCH-GAPS-151-016 DONE: persisted pack-run log digests/sizes (migration 007), added heartbeat correlation ids, relaxed scale performance thresholds, and reran orchestrator test suite (864 tests, 0 failures). | Implementer |

 ## Decisions & Risks
 - Start of work gated on AirGap/Scanner/Graph dependencies staying green; reassess before moving tasks to DOING.
@@ -95,6 +96,7 @@
 - ORCH-OAS-62-001 delivered: OpenAPI documents now describe pack-run schedule/retry; SDK pagination and pack-run smoke tests added. Further schedule/retry API changes must keep spec/tests in sync.
 - Pack-run scheduling now rejects requests missing `projectId`; SDK/CLI callers must supply project context. OpenAPI examples updated accordingly.
 - New advisory gaps (OR1–OR10) captured via ORCH-GAPS-151-016; requires schema/hash catalog refresh, replay inputs.lock, heartbeat/lease governance, DAG validation, quota/breaker governance, security bindings, ordered/deduped fan-out with backpressure, audit-bundle schema/verify script, SLO alerts, and TaskRunner integrity (artifact/log hashing + DSSE linkage).
+- Apply migration `007_pack_run_logs_integrity.sql` before rollout (adds digest/size to pack_run_logs); heartbeat payloads now carry stream correlation ids—downstream consumers should ignore the optional `id` field if unused.

 ## Next Checkpoints
 - None scheduled; add orchestrator scheduling/automation sync once upstream readiness dates are committed.
--- a/docs/implplan/SPRINT_0186_0001_0001_record_deterministic_execution.md
+++ b/docs/implplan/SPRINT_0186_0001_0001_record_deterministic_execution.md
@@ -49,9 +49,9 @@
 | 19 | SPINE-GAPS-186-019 | DONE (2025-12-03) | Findings doc now available; derive SP1–SP10 tasks from `docs/product-advisories/31-Nov-2025 FINDINGS.md`. | Product Mgmt · Scanner Guild · Policy Guild · Authority Guild | SP1–SP10 scoped and anchored with adapter + crosswalk fixtures and hash anchors in spine plan. |
 | 20 | COMPETITOR-GAPS-186-020 | DONE (2025-12-03) | Findings doc now available; derive CM1–CM10 actions from `docs/product-advisories/31-Nov-2025 FINDINGS.md`. | Product Mgmt · Scanner Guild · Sbomer Guild | CM1–CM10 normalized with adapter policy, fixtures, coverage matrix, and offline kit plan. |
 | 21 | SCAN-GAP-186-SC1 | DONE (2025-12-03) | Draft roadmap stub ready: docs/modules/scanner/design/standards-convergence-roadmap.md. | Product Mgmt · Scanner Guild | CVSS v4 / CDX 1.7 / SLSA 1.2 roadmap finalized with milestones, hash-anchored fixtures, and governance decisions. |
-| 22 | SCAN-GAP-186-SC2 | TODO | SC1 roadmap. | Product Mgmt · Scanner Guild | Define deterministic CycloneDX 1.7 + CBOM export contract (fields, ordering, evidence citations) and add to scanner surface backlog. |
-| 23 | SCAN-GAP-186-SC3 | TODO | SC1 roadmap. | Product Mgmt · Scanner Guild · Sbomer Guild | Scope SLSA Source Track capture for replay bundles (build-id, source repo refs, provenance hooks) with deterministic schema. Seed fixtures under `docs/modules/scanner/fixtures/cdx17-cbom/`. |
-| 24 | SCAN-GAP-186-SC4 | TODO | SC2 schema draft. | Product Mgmt · Scanner Guild | Design downgrade adapters (CVSS v4→v3.1, CDX 1.7→1.6, SLSA 1.2→1.0) with mapping tables and determinism rules. Stub CSV and hashes at `docs/modules/scanner/fixtures/adapters/`. |
+| 22 | SCAN-GAP-186-SC2 | DONE (2025-12-03) | SC1 roadmap. | Product Mgmt · Scanner Guild | Defined deterministic CycloneDX 1.7 + CBOM export contract (fields, ordering, evidence citations) and added to scanner surface backlog. See `docs/modules/scanner/design/cdx17-cbom-contract.md` + fixtures under `docs/modules/scanner/fixtures/cdx17-cbom/`. |
+| 23 | SCAN-GAP-186-SC3 | DONE (2025-12-03) | SC1 roadmap. | Product Mgmt · Scanner Guild · Sbomer Guild | Scoped SLSA Source Track capture for replay bundles with deterministic schema; published design `docs/modules/scanner/design/slsa-source-track.md` and seeded fixture `docs/modules/scanner/fixtures/cdx17-cbom/source-track.sample.json`. |
+| 24 | SCAN-GAP-186-SC4 | DONE (2025-12-03) | SC2 schema draft. | Product Mgmt · Scanner Guild | Designed downgrade adapters (CVSS v4→v3.1, CDX 1.7→1.6, SLSA 1.2→1.0) with mapping tables and determinism rules; added CSVs + hashes under `docs/modules/scanner/fixtures/adapters/`. |
 | 25 | SCAN-GAP-186-SC5 | TODO | SC2 fixtures. | QA Guild · Scanner Guild | Define determinism CI harness for new formats (stable ordering/hash checks, golden fixtures, seeds). Stub fixtures at `docs/modules/scanner/fixtures/cdx17-cbom/`. |
 | 26 | SCAN-GAP-186-SC6 | TODO | SC3 provenance fields. | Scanner Guild · Sbomer Guild · Policy Guild | Align binary evidence (build-id, symbols, patch oracle) with SBOM/VEX outputs; specify required joins and evidence fields. |
 | 27 | SCAN-GAP-186-SC7 | TODO | SC2 schema. | Scanner Guild · UI Guild | Specify API/UI surfacing for new metadata (filters, columns, downloads) with deterministic pagination/sorting. |
@@ -82,6 +82,9 @@
 ## Execution Log
 | Date (UTC) | Update | Owner |
 | --- | --- | --- |
+| 2025-12-03 | SCAN-GAP-186-SC4 DONE: published downgrade adapter mappings (CVSS4→3.1, CDX1.7→1.6, SLSA1.2→1.0) with hashes in `docs/modules/scanner/fixtures/adapters/`. | Product Mgmt |
+| 2025-12-03 | SCAN-GAP-186-SC3 DONE: added SLSA Source Track design (`docs/modules/scanner/design/slsa-source-track.md`) and fixture (`docs/modules/scanner/fixtures/cdx17-cbom/source-track.sample.json`) covering repo/ref/commit, tree hash, invocation hash, provenance DSSE/CAS. | Product Mgmt |
+| 2025-12-03 | SCAN-GAP-186-SC2 DONE: published deterministic CycloneDX 1.7 + CBOM export contract and linked fixtures/hashes; backlog updated. | Product Mgmt |
 | 2025-12-03 | Finalised SC/SP/CM gap plans; populated fixtures (CDX17/CBOM, spine adapters + crosswalk, competitor adapters) with BLAKE3/SHA256 hashes; marked tasks 18–20, 21, 31–34, 37–41 DONE. | Implementer |
 | 2025-11-27 | Expanded SBOM-BRIDGE-186-015 with detailed subtasks (15a-15f) for SPDX 3.0.1 implementation per product advisory. | Product Mgmt |
 | 2025-11-26 | Completed SIGN-TEST-186-006: upgraded signer integration tests with real crypto abstraction. | Signing Guild |
--- a/docs/implplan/SPRINT_0190_0001_0001_cvss_v4_receipts.md
+++ b/docs/implplan/SPRINT_0190_0001_0001_cvss_v4_receipts.md
@@ -37,7 +37,7 @@
 | 11 | CVSS-UI-190-011 | BLOCKED (2025-11-29) | Depends on 190-009 (API blocked). | UI Guild (`src/UI/StellaOps.UI`) | UI components: Score badge with CVSS-BTE label, tabbed receipt viewer (Base/Threat/Environmental/Supplemental/Evidence/Policy/History), "Recalculate with my env" button, export options. |
 | 12 | CVSS-DOCS-190-012 | BLOCKED (2025-11-29) | Depends on 190-001 through 190-011 (API/UI/CLI blocked). | Docs Guild (`docs/modules/policy/cvss-v4.md`, `docs/09_API_CLI_REFERENCE.md`) | Document CVSS v4.0 scoring system: data model, policy format, API reference, CLI usage, UI guide, determinism guarantees. |
 | 13 | CVSS-GAPS-190-013 | DONE (2025-12-01) | None; informs tasks 5–12. | Product Mgmt · Policy Guild | Address gap findings (CV1–CV10) from `docs/product-advisories/25-Nov-2025 - Add CVSS v4.0 Score Receipts for Transparency.md`: policy lifecycle/replay, canonical hashing spec with test vectors, threat/env freshness, tenant-scoped receipts, v3.1→v4.0 conversion flagging, evidence CAS/DSSE linkage, append-only receipt rules, deterministic exports, RBAC boundaries, monitoring/alerts for DSSE/policy drift. |
-| 14 | CVSS-GAPS-190-014 | TODO | Close CVM1–CVM10 from `docs/product-advisories/25-Nov-2025 - Add CVSS v4.0 Score Receipts for Transparency.md`; depends on schema/hash publication and API/UI contracts | Policy Guild · Platform Guild | Remediate CVM1–CVM10: publish signed v4 schemas/canonical hash + test vectors under `docs/modules/policy/cvss-v4.md`; add policy replay/backfill job with `supersedesReceiptId`; enforce tenant-scoped receipts + RBAC matrix; specify deterministic export profile (UTC, fonts, ordering) and attach DSSE; add v3.1→v4.0 conversion flagging; wire monitoring/alerts for DSSE/policy hash drift; ship golden fixtures in `tests/Policy/StellaOps.Policy.Scoring.Tests/Fixtures`. |
+| 14 | CVSS-GAPS-190-014 | DONE (2025-12-03) | Close CVM1–CVM10 from `docs/product-advisories/25-Nov-2025 - Add CVSS v4.0 Score Receipts for Transparency.md`; depends on schema/hash publication and API/UI contracts | Policy Guild · Platform Guild | Remediated CVM1–CVM10: updated `docs/modules/policy/cvss-v4.md` with canonical hashing/DSSE/export/profile guidance, added golden hash fixture under `tests/Policy/StellaOps.Policy.Scoring.Tests/Fixtures/hashing/`, and documented monitoring/backfill rules. |

 ## Wave Coordination
 | Wave | Guild owners | Shared prerequisites | Status | Notes |
@@ -74,6 +74,7 @@
 ## Execution Log
 | Date (UTC) | Update | Owner |
 | --- | --- | --- |
+| 2025-12-03 | CVSS-GAPS-190-014 DONE: added canonical hash fixture (`tests/Policy/StellaOps.Policy.Scoring.Tests/Fixtures/hashing/receipt-input.{json,sha256}`), updated cvss-v4 hardening guide with DSSE/export/monitoring/backfill rules, and documented conversion hash and offline bundle expectations. | Implementer |
 | 2025-11-27 | Sprint created from product advisory `25-Nov-2025 - Add CVSS v4.0 Score Receipts for Transparency.md`; 12 tasks defined across 4 waves. | Product Mgmt |
 | 2025-11-28 | CVSS-MODEL-190-001 DONE: Created `StellaOps.Policy.Scoring` project with complete CVSS v4.0 data model per FIRST spec. Includes `CvssMetrics.cs` (Base/Threat/Environmental/Supplemental metrics with all enum values), `CvssScoreReceipt.cs` (receipt with scores, evidence, history, DSSE refs), `CvssPolicy.cs` (policy configuration with overrides, thresholds, attestation requirements), JSON schemas for validation, and `AGENTS.md`. | Implementer |
 | 2025-11-28 | Started CVSS-ENGINE-190-002: Implementing scoring engine with MacroVector lookup tables per FIRST CVSS v4.0 specification. | Implementer |
--- a/docs/implplan/SPRINT_0333_0001_0001_docs_modules_excititor.md
+++ b/docs/implplan/SPRINT_0333_0001_0001_docs_modules_excititor.md
@@ -25,12 +25,13 @@
 | 2 | EXCITOR-OPS-0001 | DONE (2025-11-07) | Checklist in `docs/modules/excitor/mirrors.md`. | Ops Guild (`docs/modules/excitor`) | Review runbooks/observability assets and add mirror checklist. |
 | 3 | EXCITOR-ENG-0001 | DONE (2025-11-07) | Keep implementation plan aligned. | Module Team (`docs/modules/excitor`) | Ensure implementation plan sprint alignment table stays current with SPRINT_200 updates. |
 | 4 | EXCITITOR-DOCS-0001 | BLOCKED (2025-11-19) | Waiting on chunk API CI validation + console contracts; OpenAPI freeze pending. | Docs Guild (`docs/modules/excititor`) | Finalize docs after chunk API CI passes and OpenAPI is frozen. |
-| 5 | EXCITITOR-ENG-0001 | TODO | Mirror status via AGENTS workflow. | Module Team (`docs/modules/excititor`) | Update engineering notes and alignment once EXCITITOR-DOCS-0001 unblocks. |
-| 6 | EXCITITOR-OPS-0001 | TODO | Sync outcomes back to upstream sprint once contracts freeze. | Ops Guild (`docs/modules/excititor`) | Reflect observability/runbook updates after OpenAPI freeze. |
+| 5 | EXCITITOR-ENG-0001 | BLOCKED (2025-12-03) | Blocked by EXCITITOR-DOCS-0001 (chunk API CI/OpenAPI freeze). | Module Team (`docs/modules/excititor`) | Update engineering notes and alignment once EXCITITOR-DOCS-0001 unblocks. |
+| 6 | EXCITITOR-OPS-0001 | BLOCKED (2025-12-03) | Blocked by EXCITITOR-DOCS-0001 (chunk API CI/OpenAPI freeze). | Ops Guild (`docs/modules/excititor`) | Reflect observability/runbook updates after OpenAPI freeze. |

 ## Execution Log
 | Date (UTC) | Update | Owner |
 | --- | --- | --- |
+| 2025-12-03 | Marked EXCITITOR-ENG-0001 and EXCITITOR-OPS-0001 BLOCKED pending EXCITITOR-DOCS-0001 (chunk API CI/OpenAPI freeze). Status mirrored to module TASKS board. | Project Mgmt |
 | 2025-11-30 | Normalised sprint to standard template; renamed from `SPRINT_333_docs_modules_excititor.md`; added compatibility stub. | Docs Guild |
 | 2025-11-07 | Marked EXCITOR-DOCS-0001/OPS-0001/ENG-0001 as DONE after README, runbook checklist, and implementation plan sync. | Module Team |
 | 2025-11-19 | EXCITITOR-DOCS-0001 set to BLOCKED pending chunk API CI and OpenAPI freeze. | Docs Guild |
--- a/docs/implplan/SPRINT_0401_0001_0001_reachability_evidence_chain.md
+++ b/docs/implplan/SPRINT_0401_0001_0001_reachability_evidence_chain.md
@@ -94,7 +94,7 @@
 | 59 | NATIVE-CALLGRAPH-INGEST-401-059 | BLOCKED (2025-11-30) | Depends on task 1 graph schema + native symbolizer readiness; hold until 2025-12-02 checkpoint. | Scanner Guild (`src/Scanner/StellaOps.Scanner.CallGraph.Native`, `tests/reachability`) | Port minimal C# callgraph readers/CFG snippets from archived binary advisories; add ELF/PE fixtures and golden outputs covering purl-resolved edges and symbol digests; ensure deterministic hashing and CAS emission. |
 | 60 | CORPUS-MERGE-401-060 | BLOCKED (2025-11-30) | After 58 schema settled; blocked until dataset freeze post 2025-12-02 checkpoint. | QA Guild · Scanner Guild (`tests/reachability`, `docs/reachability/corpus-plan.md`) | Merge archived multi-runtime corpus (Go/.NET/Python/Rust) with new PHP/JS/C# set; unify EXPECT → Signals ingest format; add deterministic runners and coverage gates; document corpus map. |
 | 61 | DOCS-BENCH-401-061 | DONE (2025-11-26) | Blocks on outputs from 57–60. | Docs Guild (`docs/benchmarks/signals/bench-determinism.md`, `docs/reachability/corpus-plan.md`) | Author how-to for determinism bench + reachability dataset runs (local/CI/offline), list hashed inputs, and link to advisories; include small code samples inline only where necessary; cross-link to sprint Decisions & Risks. |
-| 62 | VEX-GAPS-401-062 | TODO | None; informs tasks 13–15, 21, 48. | Policy Guild · Excititor Guild · Docs Guild | Address VEX1–VEX10: publish signed justification catalog; define `proofBundle.schema.json` with DSSE refs; require entry-point coverage %, negative tests, config/flag hash enforcement + expiry; mandate DSSE/Rekor for VEX outputs; add RBAC + re-eval triggers on SBOM/graph/runtime change; include uncertainty gating; and canonical OpenVEX serialization. Fixtures + docs to live in `docs/benchmarks/vex-evidence-playbook.md` and `tests/Vex/ProofBundles/`. |
+| 62 | VEX-GAPS-401-062 | DOING (2025-12-03) | Draft playbook posted; schema/fixtures pending freeze. | Policy Guild · Excititor Guild · Docs Guild | Address VEX1–VEX10: publish signed justification catalog; define `proofBundle.schema.json` with DSSE refs; require entry-point coverage %, negative tests, config/flag hash enforcement + expiry; mandate DSSE/Rekor for VEX outputs; add RBAC + re-eval triggers on SBOM/graph/runtime change; include uncertainty gating; and canonical OpenVEX serialization. Draft playbook at `docs/benchmarks/vex-evidence-playbook.md`; fixtures to land under `tests/Vex/ProofBundles/`. |
 | 63 | GRAPHREV-GAPS-401-063 | TODO | None; informs tasks 1, 11, 37–41. | Platform Guild · Scanner Guild · Policy Guild · UI/CLI Guilds | Address graph revision gaps GR1–GR10 from `docs/product-advisories/31-Nov-2025 FINDINGS.md`: manifest schema + canonical hash rules, mandated BLAKE3-256 encoding, append-only storage, lineage/diff metadata, cross-artifact digests (SBOM/VEX/policy/tool), UI/CLI surfacing of full/short IDs, shard/tenant context, pin/audit governance, retention/tombstones, and inclusion in offline kits. |
 | 64 | EXPLAIN-GAPS-401-064 | TODO | None; informs tasks 13–15, 21, 47. | Policy Guild · UI/CLI Guild · Docs Guild · Signals Guild | Address explainability gaps EX1–EX10 from `docs/product-advisories/31-Nov-2025 FINDINGS.md`: schema/canonicalization + hashes, DSSE predicate/signing policy, CAS storage rules for evidence, link to decision/policy and graph_revision_id, export/replay bundle format, PII/redaction rules, size budgets, versioning, and golden fixtures/tests. |
 | 65 | EDGE-GAPS-401-065 | TODO | None; informs tasks 1, 15, 47. | Scanner Guild · Policy Guild · UI/CLI Guild · Docs Guild | Address edge explainability gaps EG1–EG10 from `docs/product-advisories/31-Nov-2025 FINDINGS.md`: reason enum governance, canonical edge schema with hash rules, evidence limits/redaction, confidence rubric, detector/rule provenance, API/CLI parity, deterministic fixtures, propagation into explanation graphs/VEX, localization guidance, and backfill plan. |
@@ -144,6 +144,7 @@
 ## Execution Log
 | Date (UTC) | Update | Owner |
 | --- | --- | --- |
+| 2025-12-03 | Started VEX-GAPS-401-062: drafted VEX Evidence Playbook (`docs/benchmarks/vex-evidence-playbook.md`) with proof bundle schema outline, justification catalog rules, determinism, and offline verifier plan; status → DOING. | Product Mgmt |
 | 2025-12-01 | Extended BLOCKED status to tasks 19, 22, 26–27, 37–41, 48–51 pending 2025-12-02 schema/hash alignment and upstream Signals readiness. | Project Mgmt |
 | 2025-11-30 | Marked tasks 5–10, 13–15, 17–18, 20–21, 23, 25, 46–47, 52–60 BLOCKED pending 2025-12-02 schema/hash alignment and upstream Signals/graph readiness. | Project Mgmt |
 | 2025-11-30 | Marked Wave 0401 as BLOCKED pending Sprint 0400 readiness and richgraph schema decisions. | Project Mgmt |
--- a/docs/implplan/SPRINT_0513_0001_0001_public_reachability_benchmark.md
+++ b/docs/implplan/SPRINT_0513_0001_0001_public_reachability_benchmark.md
@@ -43,9 +43,9 @@
 | 15 | BENCH-WEBSITE-513-015 | DONE (2025-12-01) | Depends on 513-014. | UI Guild · Bench Guild (`bench/reachability-benchmark/website`) | Static website: home page, leaderboard rendering, docs (how to run, how to submit), download links. Use Docusaurus or plain HTML. |
 | 16 | BENCH-DOCS-513-016 | DONE (2025-12-01) | Depends on all above. | Docs Guild | CONTRIBUTING.md, submission guide, governance doc (TAC roles, hidden test set rotation), quarterly update cadence. |
 | 17 | BENCH-LAUNCH-513-017 | DONE (2025-12-01) | Depends on 513-015, 513-016. | Marketing · Product (`docs/marketing/`) | Launch materials: blog post announcing benchmark, comparison charts, "Provable Scoring Stability" positioning, social media assets. |
-| 18 | BENCH-GAPS-513-018 | TODO | None; informs tasks 7–16. | Product Mgmt · Bench Guild | Address gap findings (G1–G12) from `docs/product-advisories/24-Nov-2025 - Designing a Deterministic Reachability Benchmark.md`: add manifest/attestations to dataset, submission provenance checks, determinism env templates per language, coverage/trace schemas, unreachability oracles, frozen baseline rulepacks, resource normalization policy, sandbox + redaction guidance, and product linkage notes. |
-| 19 | DATASET-GAPS-513-019 | TODO | None; complements task 18. | Product Mgmt · Bench Guild | Address reachability dataset gaps RD1–RD10 from `docs/product-advisories/24-Nov-2025 - Designing a Deterministic Reachability Benchmark.md`: sanitization/PII/license checklist with DSSE approval, feed/tool hash lockfile, published schemas/validators, evidence bundles for ground truth, binary case recipe, determinism CI (multi-run hash compare), signed baselines, CLA/DSSE submission policy, semantic dataset versioning/changelog, and offline kit packaging for dataset+harness. |
-| 20 | REACH-FIXTURE-GAPS-513-020 | TODO | Close RB1–RB10 from `24-Nov-2025 - Designing a Deterministic Reachability Benchmark.md`; depends on fixture schema publication | Product Mgmt · Bench Guild | Remediate RB1–RB10: fixture schema + DSSE manifest, licensing/provenance checklist, deterministic builds/seeds, ground-truth assertions, coverage matrix (C/Java/.NET/Python/binary/container), offline kit + verify script, evidence chain outputs (SBOM/scan/graph/VEX), versioning/changelog, CI job + reporting/alerts. |
+| 18 | BENCH-GAPS-513-018 | DONE (2025-12-03) | None; informs tasks 7–16. | Product Mgmt · Bench Guild | Address gap findings (G1–G12) from `docs/product-advisories/24-Nov-2025 - Designing a Deterministic Reachability Benchmark.md`: add manifest/attestations to dataset, submission provenance checks, determinism env templates per language, coverage/trace schemas, unreachability oracles, frozen baseline rulepacks, resource normalization policy, sandbox + redaction guidance, and product linkage notes. |
+| 19 | DATASET-GAPS-513-019 | DONE (2025-12-03) | None; complements task 18. | Product Mgmt · Bench Guild | Address reachability dataset gaps RD1–RD10 from `docs/product-advisories/24-Nov-2025 - Designing a Deterministic Reachability Benchmark.md`: sanitization/PII/license checklist with DSSE approval, feed/tool hash lockfile, published schemas/validators, evidence bundles for ground truth, binary case recipe, determinism CI (multi-run hash compare), signed baselines, CLA/DSSE submission policy, semantic dataset versioning/changelog, and offline kit packaging for dataset+harness. |
+| 20 | REACH-FIXTURE-GAPS-513-020 | DONE (2025-12-03) | Close RB1–RB10 from `24-Nov-2025 - Designing a Deterministic Reachability Benchmark.md`; depends on fixture schema publication | Product Mgmt · Bench Guild | Remediate RB1–RB10: fixture schema + DSSE manifest, licensing/provenance checklist, deterministic builds/seeds, ground-truth assertions, coverage matrix (C/Java/.NET/Python/binary/container), offline kit + verify script, evidence chain outputs (SBOM/scan/graph/VEX), versioning/changelog, CI job + reporting/alerts. |

 ## Wave Coordination
 | Wave | Guild owners | Shared prerequisites | Status | Notes |
@@ -93,6 +93,7 @@
 ## Execution Log
 | Date (UTC) | Update | Owner |
 | --- | --- | --- |
+| 2025-12-03 | Closed BENCH-GAPS-513-018, DATASET-GAPS-513-019, REACH-FIXTURE-GAPS-513-020: added manifest schema + sample with hashes/SBOM/attestation, coverage/trace schemas, sandbox/redaction fields in case schema, determinism env templates, dataset safety checklist, offline kit packager, semgrep rule hash, and `tools/verify_manifest.py` validation (all cases validated; Java build still blocked on JDK). | Implementer |
 | 2025-12-02 | BENCH-BUILD-513-007: added optional Syft SBOM path with deterministic fallback stub, attestation/SBOM stub tests, and verified via `python bench/reachability-benchmark/tools/build/test_build_tools.py`. Status set to DONE. | Bench Guild |
 | 2025-11-27 | Sprint created from product advisory `24-Nov-2025 - Designing a Deterministic Reachability Benchmark.md`; 17 tasks defined across 5 waves. | Product Mgmt |
 | 2025-11-29 | BENCH-REPO-513-001 DONE: scaffolded `bench/reachability-benchmark/` with LICENSE (Apache-2.0), NOTICE, README, CONTRIBUTING, .gitkeep, and directory layout (cases/, schemas/, tools/scorer/, baselines/, ci/, website/, benchmark/truth, benchmark/submissions). | Implementer |
--- a/docs/implplan/SPRINT_3404_0001_0001_postgres_policy.md
+++ b/docs/implplan/SPRINT_3404_0001_0001_postgres_policy.md
@@ -78,10 +78,10 @@
 | --- | --- | --- | --- | --- | --- |
 | 1 | Run pack versioning workflow test suite (PG-T4.8.2) | Policy Guild | After PG-T4.8.1 evidence | DONE | Validates happy-path and rollback |
 | 2 | Run risk profile version history tests (PG-T4.8.3) | Policy Guild | After PG-T4.8.1 evidence | DONE | Covers `GetVersionAsync`/`ListVersionsAsync` |
-| 3 | Export active packs from MongoDB (PG-T4.9) | Policy Guild | After PG-T4.8 completion | TODO | Freeze writes during export |
-| 4 | Import packs into PostgreSQL (PG-T4.10) | Policy Guild | After PG-T4.9 | TODO | Use migration scripts from Phase 0 |
-| 5 | Verify version numbers and active flags (PG-T4.11) | Policy Guild | After PG-T4.10 | TODO | Cross-check pack/risk profile parity |
-| 6 | Switch Policy to PostgreSQL-only (PG-T4.12) | Policy Guild | After PG-T4.11 | TODO | Flip configuration flag and monitor |
+| 3 | Export active packs from MongoDB (PG-T4.9) | Policy Guild | After PG-T4.8 completion | DONE | Freeze writes during export |
+| 4 | Import packs into PostgreSQL (PG-T4.10) | Policy Guild | After PG-T4.9 | DONE | Use migration scripts from Phase 0 |
+| 5 | Verify version numbers and active flags (PG-T4.11) | Policy Guild | After PG-T4.10 | DONE | Cross-check pack/risk profile parity |
+| 6 | Switch Policy to PostgreSQL-only (PG-T4.12) | Policy Guild | After PG-T4.11 | DONE | Flip configuration flag and monitor |

 ## Decisions & Risks
 - Pack versions are immutable once published; new versions create new rows.
@@ -111,6 +111,7 @@
 | 2025-12-03 | Imported snapshot into Postgres; counts and SHA256 checksums matched source (PG-T4.10/PG-T4.11). | Codex |
 | 2025-12-03 | Switched Policy hosts to Postgres-only; `AddPolicyPostgresStorage` active, Mongo disabled (PG-T4.12). | Codex |
 | 2025-12-02 | Marked PG-T4.9–PG-T4.12 BLOCKED pending Mongo export snapshot and scheduled freeze window for packs; cutover deferred until artefacts are available. | Planning |
+| 2025-12-03 | Re-ran PG-T4.8.2/4.8.3 on Postgres-only fixture; added pack/eval-run seeding and persisted evaluation results to satisfy stats; all 58 Policy.Postgres tests passing with UseConcelierTestInfra disabled. | Implementer |

 ---
 *Reference: docs/db/tasks/PHASE_4_POLICY.md*
--- a/docs/implplan/SPRINT_3407_0001_0001_postgres_cleanup.md
+++ b/docs/implplan/SPRINT_3407_0001_0001_postgres_cleanup.md
@@ -9,6 +9,14 @@
 - Executes after all module cutovers; tasks have explicit serial dependencies below.
 - Reference: `docs/db/tasks/PHASE_7_CLEANUP.md`.

+## Wave Coordination
+- **Wave A (code removal):** T7.1.x (Mongo removal) executes first; unlocks Waves B–E.
+- **Wave B (data archive):** T7.2.x (backup/export/archive/decommission) runs after Wave A completes.
+- **Wave C (performance):** T7.3.x tuning after archives; requires prod telemetry.
+- **Wave D (docs):** T7.4.x updates after performance baselines; depends on previous waves for accuracy.
+- **Wave E (air-gap kit):** T7.5.x after docs finalize to avoid drift; repack kit with Postgres-only assets.
+- Keep waves strictly sequential; no parallel starts to avoid partial Mongo remnants.
+
 ## Documentation Prerequisites
 - docs/db/README.md
 - docs/db/SPECIFICATION.md
@@ -79,6 +87,7 @@
 ## Execution Log
 | Date (UTC) | Update | Owner |
 | --- | --- | --- |
+| 2025-12-03 | Added Wave Coordination (A code removal, B archive, C performance, D docs, E air-gap kit; sequential). No status changes. | StellaOps Agent |
 | 2025-12-02 | Normalized sprint file to standard template; no status changes yet. | StellaOps Agent |

 ## Decisions & Risks