feat: Add DigestUpsertRequest and LockEntity models

- Introduced DigestUpsertRequest for handling digest upsert requests with properties like ChannelId, Recipient, DigestKey, Events, and CollectUntil.
- Created LockEntity to represent a lightweight distributed lock entry with properties such as Id, TenantId, Resource, Owner, ExpiresAt, and CreatedAt.

feat: Implement ILockRepository interface and LockRepository class

- Defined ILockRepository interface with methods for acquiring and releasing locks.
- Implemented LockRepository class with methods to try acquiring a lock and releasing it, using SQL for upsert operations.

feat: Add SurfaceManifestPointer record for manifest pointers

- Introduced SurfaceManifestPointer to represent a minimal pointer to a Surface.FS manifest associated with an image digest.

feat: Create PolicySimulationInputLock and related validation logic

- Added PolicySimulationInputLock record to describe policy simulation inputs and expected digests.
- Implemented validation logic for policy simulation inputs, including checks for digest drift and shadow mode requirements.

test: Add unit tests for ReplayVerificationService and ReplayVerifier

- Created ReplayVerificationServiceTests to validate the behavior of the ReplayVerificationService under various scenarios.
- Developed ReplayVerifierTests to ensure the correctness of the ReplayVerifier logic.

test: Implement PolicySimulationInputLockValidatorTests

- Added tests for PolicySimulationInputLockValidator to verify the validation logic against expected inputs and conditions.

chore: Add cosign key example and signing scripts

- Included a placeholder cosign key example for development purposes.
- Added a script for signing Signals artifacts using cosign with support for both v2 and v3.

chore: Create script for uploading evidence to the evidence locker

- Developed a script to upload evidence to the evidence locker, ensuring required environment variables are set.

src/AirGap/StellaOps.AirGap.Controller/Endpoints/AirGapEndpoints.cs

@@ -11,6 +11,7 @@ internal static class AirGapEndpoints
 {
     private const string StatusScope = "airgap:status:read";
     private const string SealScope = "airgap:seal";
+    private const string VerifyScope = "airgap:verify";
 
     public static RouteGroupBuilder MapAirGapEndpoints(this IEndpointRouteBuilder app)
     {
@@ -29,6 +30,10 @@ internal static class AirGapEndpoints
             .RequireScope(SealScope)
             .WithName("AirGapUnseal");
 
+        group.MapPost("/verify", HandleVerify)
+            .RequireScope(VerifyScope)
+            .WithName("AirGapVerify");
+
         return group;
     }
 
@@ -87,6 +92,24 @@ internal static class AirGapEndpoints
         return Results.Ok(AirGapStatusResponse.FromStatus(status));
     }
 
+    private static async Task<IResult> HandleVerify(
+        VerifyRequest request,
+        ReplayVerificationService verifier,
+        TimeProvider timeProvider,
+        HttpContext httpContext,
+        CancellationToken cancellationToken)
+    {
+        var tenantId = ResolveTenant(httpContext);
+        var now = timeProvider.GetUtcNow();
+        var result = await verifier.VerifyAsync(tenantId, request, now, cancellationToken);
+        if (!result.IsValid)
+        {
+            return Results.BadRequest(new VerifyResponse(false, result.Reason));
+        }
+
+        return Results.Ok(new VerifyResponse(true, result.Reason));
+    }
+
     private static string ResolveTenant(HttpContext httpContext)
     {
         if (httpContext.Request.Headers.TryGetValue("x-tenant-id", out var tenantHeader) && !string.IsNullOrWhiteSpace(tenantHeader))

src/AirGap/StellaOps.AirGap.Controller/Endpoints/Contracts/VerifyRequest.cs

@@ -0,0 +1,23 @@
+using StellaOps.AirGap.Importer.Contracts;
+
+namespace StellaOps.AirGap.Controller.Endpoints.Contracts;
+
+public sealed record VerifyRequest
+{
+    public ReplayDepth Depth { get; init; } = ReplayDepth.FullRecompute;
+    public string ManifestSha256 { get; init; } = string.Empty;
+    public string BundleSha256 { get; init; } = string.Empty;
+    public string? ComputedManifestSha256 { get; init; }
+        = null;
+    public string? ComputedBundleSha256 { get; init; }
+        = null;
+    public DateTimeOffset ManifestCreatedAt { get; init; }
+        = DateTimeOffset.MinValue;
+    public int StalenessWindowHours { get; init; } = 0;
+    public string? BundlePolicyHash { get; init; }
+        = null;
+    public string? SealedPolicyHash { get; init; }
+        = null;
+}
+
+public sealed record VerifyResponse(bool Valid, string Reason);