feat: Add DigestUpsertRequest and LockEntity models

- Introduced DigestUpsertRequest for handling digest upsert requests with properties like ChannelId, Recipient, DigestKey, Events, and CollectUntil.
- Created LockEntity to represent a lightweight distributed lock entry with properties such as Id, TenantId, Resource, Owner, ExpiresAt, and CreatedAt.

feat: Implement ILockRepository interface and LockRepository class

- Defined ILockRepository interface with methods for acquiring and releasing locks.
- Implemented LockRepository class with methods to try acquiring a lock and releasing it, using SQL for upsert operations.

feat: Add SurfaceManifestPointer record for manifest pointers

- Introduced SurfaceManifestPointer to represent a minimal pointer to a Surface.FS manifest associated with an image digest.

feat: Create PolicySimulationInputLock and related validation logic

- Added PolicySimulationInputLock record to describe policy simulation inputs and expected digests.
- Implemented validation logic for policy simulation inputs, including checks for digest drift and shadow mode requirements.

test: Add unit tests for ReplayVerificationService and ReplayVerifier

- Created ReplayVerificationServiceTests to validate the behavior of the ReplayVerificationService under various scenarios.
- Developed ReplayVerifierTests to ensure the correctness of the ReplayVerifier logic.

test: Implement PolicySimulationInputLockValidatorTests

- Added tests for PolicySimulationInputLockValidator to verify the validation logic against expected inputs and conditions.

chore: Add cosign key example and signing scripts

- Included a placeholder cosign key example for development purposes.
- Added a script for signing Signals artifacts using cosign with support for both v2 and v3.

chore: Create script for uploading evidence to the evidence locker

- Developed a script to upload evidence to the evidence locker, ensuring required environment variables are set.

docs/airgap/samples/av-report.sample.json

@@ -0,0 +1,23 @@
+{
+  "$schema": "../av-report.schema.json",
+  "scanner": "clamav",
+  "scannerVersion": "1.4.1",
+  "startedAt": "2025-12-02T00:02:00Z",
+  "completedAt": "2025-12-02T00:04:30Z",
+  "status": "clean",
+  "artifacts": [
+    {
+      "path": "chunks/advisories-0001.tzst",
+      "sha256": "1234123412341234123412341234123412341234123412341234123412341234",
+      "result": "clean",
+      "yaraRules": []
+    },
+    {
+      "path": "chunks/vex-0001.tzst",
+      "sha256": "4321432143214321432143214321432143214321432143214321432143214321",
+      "result": "clean",
+      "yaraRules": []
+    }
+  ],
+  "errors": []
+}

docs/airgap/samples/offline-kit-manifest.sample.json

@@ -6,6 +6,7 @@
   "environment": "prod",
   "createdAt": "2025-12-02T00:00:00Z",
   "stalenessWindowHours": 168,
+  "replayPolicy": "policy-freeze",
   "tools": [
     { "name": "concelier-exporter", "version": "2.5.0", "sha256": "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcd" },
     { "name": "trivy-db", "version": "0.48.0", "sha256": "89abcdef0123456789abcdef0123456789abcdef0123456789abcdef01234567" }

docs/airgap/samples/receipt.sample.json

@@ -0,0 +1,21 @@
+{
+  "$schema": "../receipt.schema.json",
+  "schemaVersion": "1.0.0",
+  "receiptId": "receipt:ingress:2025-12-02T00-00Z",
+  "direction": "ingress",
+  "bundleId": "offline-kit:concelier:2025-12-02",
+  "tenant": "default",
+  "operator": { "id": "op-123", "role": "airgap-controller" },
+  "occurredAt": "2025-12-02T00:06:00Z",
+  "decision": "allow",
+  "hashes": {
+    "bundleSha256": "d3c3f6c75c6a3f0906bcee457cc77a2d6d7c0f9d1a1d7da78c0d2ab8e0dba111",
+    "manifestSha256": "29d58b9fdc5c4e65b26c03f3bd9f442ff0c7f8514b8a9225f8b6417ffabc0101"
+  },
+  "dsse": {
+    "envelopeDigest": "sha256:cc77cc77cc77cc77cc77cc77cc77cc77cc77cc77cc77cc77cc77cc77cc77cc77",
+    "signer": "airgap-receipts-dev",
+    "rekorUuid": "11111111-2222-3333-4444-555555555555"
+  },
+  "notes": "Ingress verified, AV clean, staleness within window."
+}