feat: Add DigestUpsertRequest and LockEntity models

- Introduced DigestUpsertRequest for handling digest upsert requests with properties like ChannelId, Recipient, DigestKey, Events, and CollectUntil.
- Created LockEntity to represent a lightweight distributed lock entry with properties such as Id, TenantId, Resource, Owner, ExpiresAt, and CreatedAt.

feat: Implement ILockRepository interface and LockRepository class

- Defined ILockRepository interface with methods for acquiring and releasing locks.
- Implemented LockRepository class with methods to try acquiring a lock and releasing it, using SQL for upsert operations.

feat: Add SurfaceManifestPointer record for manifest pointers

- Introduced SurfaceManifestPointer to represent a minimal pointer to a Surface.FS manifest associated with an image digest.

feat: Create PolicySimulationInputLock and related validation logic

- Added PolicySimulationInputLock record to describe policy simulation inputs and expected digests.
- Implemented validation logic for policy simulation inputs, including checks for digest drift and shadow mode requirements.

test: Add unit tests for ReplayVerificationService and ReplayVerifier

- Created ReplayVerificationServiceTests to validate the behavior of the ReplayVerificationService under various scenarios.
- Developed ReplayVerifierTests to ensure the correctness of the ReplayVerifier logic.

test: Implement PolicySimulationInputLockValidatorTests

- Added tests for PolicySimulationInputLockValidator to verify the validation logic against expected inputs and conditions.

chore: Add cosign key example and signing scripts

- Included a placeholder cosign key example for development purposes.
- Added a script for signing Signals artifacts using cosign with support for both v2 and v3.

chore: Create script for uploading evidence to the evidence locker

- Developed a script to upload evidence to the evidence locker, ensuring required environment variables are set.

etc/notify.airgap.yaml

@@ -7,10 +7,13 @@
 # Authority endpoints if your environment uses different hosts.
 
 storage:
-  driver: mongo
-  connectionString: "mongodb://stellaops:airgap-password@mongo:27017"
-  database: "stellaops_notify_airgap"
-  commandTimeoutSeconds: 45
+  driver: postgres
+
+postgres:
+  notify:
+    connectionString: "Host=postgres;Port=5432;Database=stellaops_notify_airgap;Username=stellaops;Password=airgap-password;Pooling=true;Maximum Pool Size=40;Minimum Pool Size=1"
+    commandTimeoutSeconds: 45
+    schemaName: notify
 
 authority:
   enabled: true

etc/notify.dev.yaml

@@ -1,10 +1,13 @@
-# Notify WebService configuration — development
-
-storage:
-  driver: mongo
-  connectionString: "mongodb://notify-mongo.dev.svc.cluster.local:27017"
-  database: "stellaops_notify_dev"
-  commandTimeoutSeconds: 30
+# Notify WebService configuration — development
+
+storage:
+  driver: postgres
+
+postgres:
+  notify:
+    connectionString: "Host=postgres;Port=5432;Database=stellaops_notify_dev;Username=stellaops;Password=stellaops;Pooling=true;Maximum Pool Size=50;Minimum Pool Size=1"
+    commandTimeoutSeconds: 30
+    schemaName: notify
 
 authority:
   enabled: true

etc/notify.prod.yaml

@@ -1,10 +1,13 @@
-# Notify WebService configuration — production
-
-storage:
-  driver: mongo
-  connectionString: "mongodb://notify-mongo.prod.svc.cluster.local:27017"
-  database: "stellaops_notify"
-  commandTimeoutSeconds: 60
+# Notify WebService configuration — production
+
+storage:
+  driver: postgres
+
+postgres:
+  notify:
+    connectionString: "Host=postgres;Port=5432;Database=stellaops_notify;Username=stellaops;Password=stellaops;Pooling=true;Maximum Pool Size=80;Minimum Pool Size=4"
+    commandTimeoutSeconds: 60
+    schemaName: notify
 
 authority:
   enabled: true

etc/notify.stage.yaml

@@ -1,14 +1,17 @@
-# Notify WebService configuration — staging
-
-storage:
-  driver: mongo
-  connectionString: "mongodb://notify-mongo.stage.svc.cluster.local:27017"
-  database: "stellaops_notify_stage"
-  commandTimeoutSeconds: 45
-
-authority:
-  enabled: true
-  issuer: "https://authority.stage.stella-ops.org"
+# Notify WebService configuration — staging
+
+storage:
+  driver: postgres
+
+postgres:
+  notify:
+    connectionString: "Host=postgres;Port=5432;Database=stellaops_notify_stage;Username=stellaops;Password=stellaops;Pooling=true;Maximum Pool Size=50;Minimum Pool Size=1"
+    commandTimeoutSeconds: 45
+    schemaName: notify
+
+authority:
+  enabled: true
+  issuer: "https://authority.stage.stella-ops.org"
   metadataAddress: "https://authority.stage.stella-ops.org/.well-known/openid-configuration"
   requireHttpsMetadata: true
   allowAnonymousFallback: false

etc/notify.yaml.sample

@@ -1,11 +1,14 @@
-# Notify WebService sample configuration
-
-storage:
-  # Use "mongo" for production deployments; set to "memory" only for tests/dev harnesses.
-  driver: mongo
-  connectionString: "mongodb://localhost:27017"
-  database: "stellaops_notify"
-  commandTimeoutSeconds: 30
+# Notify WebService sample configuration
+
+storage:
+  # Notify now runs on PostgreSQL only.
+  driver: postgres
+
+postgres:
+  notify:
+    connectionString: "Host=postgres;Port=5432;Database=stellaops_notify;Username=stellaops;Password=stellaops;Pooling=true;Maximum Pool Size=50;Minimum Pool Size=1"
+    commandTimeoutSeconds: 30
+    schemaName: notify
 
 authority:
   enabled: true