feat: Add DigestUpsertRequest and LockEntity models

- Introduced DigestUpsertRequest for handling digest upsert requests with properties like ChannelId, Recipient, DigestKey, Events, and CollectUntil.
- Created LockEntity to represent a lightweight distributed lock entry with properties such as Id, TenantId, Resource, Owner, ExpiresAt, and CreatedAt.

feat: Implement ILockRepository interface and LockRepository class

- Defined ILockRepository interface with methods for acquiring and releasing locks.
- Implemented LockRepository class with methods to try acquiring a lock and releasing it, using SQL for upsert operations.

feat: Add SurfaceManifestPointer record for manifest pointers

- Introduced SurfaceManifestPointer to represent a minimal pointer to a Surface.FS manifest associated with an image digest.

feat: Create PolicySimulationInputLock and related validation logic

- Added PolicySimulationInputLock record to describe policy simulation inputs and expected digests.
- Implemented validation logic for policy simulation inputs, including checks for digest drift and shadow mode requirements.

test: Add unit tests for ReplayVerificationService and ReplayVerifier

- Created ReplayVerificationServiceTests to validate the behavior of the ReplayVerificationService under various scenarios.
- Developed ReplayVerifierTests to ensure the correctness of the ReplayVerifier logic.

test: Implement PolicySimulationInputLockValidatorTests

- Added tests for PolicySimulationInputLockValidator to verify the validation logic against expected inputs and conditions.

chore: Add cosign key example and signing scripts

- Included a placeholder cosign key example for development purposes.
- Added a script for signing Signals artifacts using cosign with support for both v2 and v3.

chore: Create script for uploading evidence to the evidence locker

- Developed a script to upload evidence to the evidence locker, ensuring required environment variables are set.

src/Notify/StellaOps.Notify.WebService/Options/NotifyWebServiceOptions.cs

@@ -20,9 +20,9 @@ public sealed class NotifyWebServiceOptions
     public AuthorityOptions Authority { get; set; } = new();
 
     /// <summary>
-    /// Mongo storage configuration for configuration state and audit logs.
-    /// </summary>
-    public StorageOptions Storage { get; set; } = new();
+    /// Storage configuration (PostgreSQL-only after cutover).
+    /// </summary>
+    public StorageOptions Storage { get; set; } = new();
 
     /// <summary>
     /// Plug-in loader configuration.
@@ -71,7 +71,7 @@ public sealed class NotifyWebServiceOptions
 
     public sealed class StorageOptions
     {
-        public string Driver { get; set; } = "mongo";
+        public string Driver { get; set; } = "postgres";
 
         public string ConnectionString { get; set; } = string.Empty;
 

src/Notify/StellaOps.Notify.WebService/Options/NotifyWebServiceOptionsValidator.cs

@@ -19,29 +19,10 @@ internal static class NotifyWebServiceOptionsValidator
         ArgumentNullException.ThrowIfNull(storage);
 
         var driver = storage.Driver ?? string.Empty;
-        if (!string.Equals(driver, "mongo", StringComparison.OrdinalIgnoreCase) &&
-            !string.Equals(driver, "memory", StringComparison.OrdinalIgnoreCase))
-        {
-            throw new InvalidOperationException($"Unsupported storage driver '{storage.Driver}'.");
-        }
-
-        if (string.Equals(driver, "mongo", StringComparison.OrdinalIgnoreCase))
-        {
-            if (string.IsNullOrWhiteSpace(storage.ConnectionString))
-            {
-                throw new InvalidOperationException("notify:storage:connectionString must be provided.");
-            }
-
-            if (string.IsNullOrWhiteSpace(storage.Database))
-            {
-                throw new InvalidOperationException("notify:storage:database must be provided.");
-            }
-
-            if (storage.CommandTimeoutSeconds <= 0)
-            {
-                throw new InvalidOperationException("notify:storage:commandTimeoutSeconds must be positive.");
-            }
-        }
+        if (!string.Equals(driver, "postgres", StringComparison.OrdinalIgnoreCase))
+        {
+            throw new InvalidOperationException($"Unsupported storage driver '{storage.Driver}'. Only 'postgres' is supported after cutover.");
+        }
     }
 
     private static void ValidateAuthority(NotifyWebServiceOptions.AuthorityOptions authority)