feat: Add DigestUpsertRequest and LockEntity models

- Introduced DigestUpsertRequest for handling digest upsert requests with properties like ChannelId, Recipient, DigestKey, Events, and CollectUntil.
- Created LockEntity to represent a lightweight distributed lock entry with properties such as Id, TenantId, Resource, Owner, ExpiresAt, and CreatedAt.

feat: Implement ILockRepository interface and LockRepository class

- Defined ILockRepository interface with methods for acquiring and releasing locks.
- Implemented LockRepository class with methods to try acquiring a lock and releasing it, using SQL for upsert operations.

feat: Add SurfaceManifestPointer record for manifest pointers

- Introduced SurfaceManifestPointer to represent a minimal pointer to a Surface.FS manifest associated with an image digest.

feat: Create PolicySimulationInputLock and related validation logic

- Added PolicySimulationInputLock record to describe policy simulation inputs and expected digests.
- Implemented validation logic for policy simulation inputs, including checks for digest drift and shadow mode requirements.

test: Add unit tests for ReplayVerificationService and ReplayVerifier

- Created ReplayVerificationServiceTests to validate the behavior of the ReplayVerificationService under various scenarios.
- Developed ReplayVerifierTests to ensure the correctness of the ReplayVerifier logic.

test: Implement PolicySimulationInputLockValidatorTests

- Added tests for PolicySimulationInputLockValidator to verify the validation logic against expected inputs and conditions.

chore: Add cosign key example and signing scripts

- Included a placeholder cosign key example for development purposes.
- Added a script for signing Signals artifacts using cosign with support for both v2 and v3.

chore: Create script for uploading evidence to the evidence locker

- Developed a script to upload evidence to the evidence locker, ensuring required environment variables are set.

deploy/compose/docker-compose.airgap.yaml

@@ -11,23 +11,40 @@ volumes:
   mongo-data:
   minio-data:
   rustfs-data:
-  concelier-jobs:
-  nats-data:
-  scanner-surface-cache:
+  concelier-jobs:
+  nats-data:
+  scanner-surface-cache:
+  postgres-data:
 
 services:
-  mongo:
-    image: docker.io/library/mongo@sha256:c258b26dbb7774f97f52aff52231ca5f228273a84329c5f5e451c3739457db49
-    command: ["mongod", "--bind_ip_all"]
-    restart: unless-stopped
+  mongo:
+    image: docker.io/library/mongo@sha256:c258b26dbb7774f97f52aff52231ca5f228273a84329c5f5e451c3739457db49
+    command: ["mongod", "--bind_ip_all"]
+    restart: unless-stopped
     environment:
       MONGO_INITDB_ROOT_USERNAME: "${MONGO_INITDB_ROOT_USERNAME}"
       MONGO_INITDB_ROOT_PASSWORD: "${MONGO_INITDB_ROOT_PASSWORD}"
     volumes:
       - mongo-data:/data/db
-    networks:
-      - stellaops
-    labels: *release-labels
+    networks:
+      - stellaops
+    labels: *release-labels
+
+  postgres:
+    image: docker.io/library/postgres:16
+    restart: unless-stopped
+    environment:
+      POSTGRES_USER: "${POSTGRES_USER:-stellaops}"
+      POSTGRES_PASSWORD: "${POSTGRES_PASSWORD:-stellaops}"
+      POSTGRES_DB: "${POSTGRES_DB:-stellaops_platform}"
+      PGDATA: /var/lib/postgresql/data/pgdata
+    volumes:
+      - postgres-data:/var/lib/postgresql/data
+    ports:
+      - "${POSTGRES_PORT:-25432}:5432"
+    networks:
+      - stellaops
+    labels: *release-labels
 
   minio:
     image: docker.io/minio/minio@sha256:14cea493d9a34af32f524e538b8346cf79f3321eff8e708c1e2960462bd8936e
@@ -254,12 +271,12 @@ services:
       - stellaops
     labels: *release-labels
 
-  notify-web:
-    image: ${NOTIFY_WEB_IMAGE:-registry.stella-ops.org/stellaops/notify-web:2025.09.2}
-    restart: unless-stopped
-    depends_on:
-      - mongo
-      - authority
+  notify-web:
+    image: ${NOTIFY_WEB_IMAGE:-registry.stella-ops.org/stellaops/notify-web:2025.09.2}
+    restart: unless-stopped
+    depends_on:
+      - postgres
+      - authority
     environment:
       DOTNET_ENVIRONMENT: Production
     volumes:

deploy/compose/docker-compose.dev.yaml

@@ -16,9 +16,10 @@ volumes:
   advisory-ai-queue:
   advisory-ai-plans:
   advisory-ai-outputs:
+  postgres-data:
 
-services:
-  mongo:
+services:
+  mongo:
     image: docker.io/library/mongo@sha256:c258b26dbb7774f97f52aff52231ca5f228273a84329c5f5e451c3739457db49
     command: ["mongod", "--bind_ip_all"]
     restart: unless-stopped
@@ -46,6 +47,22 @@ services:
       - stellaops
     labels: *release-labels
 
+  postgres:
+    image: docker.io/library/postgres:16
+    restart: unless-stopped
+    environment:
+      POSTGRES_USER: "${POSTGRES_USER:-stellaops}"
+      POSTGRES_PASSWORD: "${POSTGRES_PASSWORD:-stellaops}"
+      POSTGRES_DB: "${POSTGRES_DB:-stellaops_platform}"
+      PGDATA: /var/lib/postgresql/data/pgdata
+    volumes:
+      - postgres-data:/var/lib/postgresql/data
+    ports:
+      - "${POSTGRES_PORT:-5432}:5432"
+    networks:
+      - stellaops
+    labels: *release-labels
+
   rustfs:
     image: registry.stella-ops.org/stellaops/rustfs:2025.10.0-edge
     command: ["serve", "--listen", "0.0.0.0:8080", "--root", "/data"]
@@ -228,12 +245,12 @@ services:
       - stellaops
     labels: *release-labels
 
-  notify-web:
-    image: ${NOTIFY_WEB_IMAGE:-registry.stella-ops.org/stellaops/notify-web:2025.10.0-edge}
-    restart: unless-stopped
-    depends_on:
-      - mongo
-      - authority
+  notify-web:
+    image: ${NOTIFY_WEB_IMAGE:-registry.stella-ops.org/stellaops/notify-web:2025.10.0-edge}
+    restart: unless-stopped
+    depends_on:
+      - postgres
+      - authority
     environment:
       DOTNET_ENVIRONMENT: Development
     volumes:

deploy/compose/docker-compose.prod.yaml

@@ -19,9 +19,10 @@ volumes:
   advisory-ai-queue:
   advisory-ai-plans:
   advisory-ai-outputs:
+  postgres-data:
 
-services:
-  mongo:
+services:
+  mongo:
     image: docker.io/library/mongo@sha256:c258b26dbb7774f97f52aff52231ca5f228273a84329c5f5e451c3739457db49
     command: ["mongod", "--bind_ip_all"]
     restart: unless-stopped
@@ -130,6 +131,22 @@ services:
       - frontdoor
     labels: *release-labels
 
+  postgres:
+    image: docker.io/library/postgres:16
+    restart: unless-stopped
+    environment:
+      POSTGRES_USER: "${POSTGRES_USER:-stellaops}"
+      POSTGRES_PASSWORD: "${POSTGRES_PASSWORD:-stellaops}"
+      POSTGRES_DB: "${POSTGRES_DB:-stellaops_platform}"
+      PGDATA: /var/lib/postgresql/data/pgdata
+    volumes:
+      - postgres-data:/var/lib/postgresql/data
+    ports:
+      - "${POSTGRES_PORT:-5432}:5432"
+    networks:
+      - stellaops
+    labels: *release-labels
+
   issuer-directory:
     image: registry.stella-ops.org/stellaops/issuer-directory-web:2025.10.0-edge
     restart: unless-stopped
@@ -236,12 +253,12 @@ services:
       - stellaops
     labels: *release-labels
 
-  notify-web:
-    image: ${NOTIFY_WEB_IMAGE:-registry.stella-ops.org/stellaops/notify-web:2025.09.2}
-    restart: unless-stopped
-    depends_on:
-      - mongo
-      - authority
+  notify-web:
+    image: ${NOTIFY_WEB_IMAGE:-registry.stella-ops.org/stellaops/notify-web:2025.09.2}
+    restart: unless-stopped
+    depends_on:
+      - postgres
+      - authority
     environment:
       DOTNET_ENVIRONMENT: Production
     volumes:

deploy/compose/docker-compose.stage.yaml

@@ -16,9 +16,10 @@ volumes:
   advisory-ai-queue:
   advisory-ai-plans:
   advisory-ai-outputs:
+  postgres-data:
 
-services:
-  mongo:
+services:
+  mongo:
     image: docker.io/library/mongo@sha256:c258b26dbb7774f97f52aff52231ca5f228273a84329c5f5e451c3739457db49
     command: ["mongod", "--bind_ip_all"]
     restart: unless-stopped
@@ -46,6 +47,22 @@ services:
       - stellaops
     labels: *release-labels
 
+  postgres:
+    image: docker.io/library/postgres:16
+    restart: unless-stopped
+    environment:
+      POSTGRES_USER: "${POSTGRES_USER:-stellaops}"
+      POSTGRES_PASSWORD: "${POSTGRES_PASSWORD:-stellaops}"
+      POSTGRES_DB: "${POSTGRES_DB:-stellaops_platform}"
+      PGDATA: /var/lib/postgresql/data/pgdata
+    volumes:
+      - postgres-data:/var/lib/postgresql/data
+    ports:
+      - "${POSTGRES_PORT:-5432}:5432"
+    networks:
+      - stellaops
+    labels: *release-labels
+
   rustfs:
     image: registry.stella-ops.org/stellaops/rustfs:2025.10.0-edge
     command: ["serve", "--listen", "0.0.0.0:8080", "--root", "/data"]
@@ -228,12 +245,12 @@ services:
       - stellaops
     labels: *release-labels
 
-  notify-web:
-    image: ${NOTIFY_WEB_IMAGE:-registry.stella-ops.org/stellaops/notify-web:2025.09.2}
-    restart: unless-stopped
-    depends_on:
-      - mongo
-      - authority
+  notify-web:
+    image: ${NOTIFY_WEB_IMAGE:-registry.stella-ops.org/stellaops/notify-web:2025.09.2}
+    restart: unless-stopped
+    depends_on:
+      - postgres
+      - authority
     environment:
       DOTNET_ENVIRONMENT: Production
     volumes: