Merge branch 'main' of https://git.stella-ops.org/stella-ops.org/git.stella-ops.org

docs/modules/attestor/implementation_plan.md

@@ -72,3 +72,91 @@
 - CLI/Console parity verified; Offline Kit procedures validated in sealed environment.
 - Cross-module dependencies acknowledged in ./TASKS.md and ../../TASKS.md.
 - Documentation set refreshed (overview, architecture, key management, transparency, CLI/UI) with imposed rule statement.
+
+---
+
+## Sprint readiness tracker
+
+> Last updated: 2025-11-27 (ATTESTOR-ENG-0001)
+
+This section maps delivery phases to implementation sprints and tracks readiness checkpoints.
+
+### Phase 1 — Foundations
+| Task ID | Status | Sprint | Notes |
+|---------|--------|--------|-------|
+| ATTEST-73-001 | ✅ DONE (2025-11-25) | SPRINT_110_ingestion_evidence | Attestation claims builder verified; TRX archived. |
+| ATTEST-73-002 | ✅ DONE (2025-11-25) | SPRINT_110_ingestion_evidence | Internal verify endpoint validated; TRX archived. |
+| ATTEST-PLAN-2001 | ✅ DONE (2025-11-24) | SPRINT_0200_0001_0001_attestation_coord | Coordination plan published at `docs/modules/attestor/prep/2025-11-24-attest-plan-2001.md`. |
+| ELOCKER-CONTRACT-2001 | ✅ DONE (2025-11-24) | SPRINT_0200_0001_0001_attestation_coord | Evidence Locker contract published. |
+| KMSI-73-001/002 | ✅ DONE (2025-11-03) | SPRINT_100_identity_signing | KMS key management and FIDO2 profile. |
+
+**Checkpoint:** Foundations complete — service skeleton, DSSE ingestion, Rekor client, and cache layer operational.
+
+### Phase 2 — Policies & UI
+| Task ID | Status | Sprint | Notes |
+|---------|--------|--------|-------|
+| POLICY-ATTEST-73-001 | ⏳ BLOCKED | SPRINT_0123_0001_0001_policy_reasoning | VerificationPolicy schema/persistence; awaiting prep artefact finalization. |
+| POLICY-ATTEST-73-002 | ⏳ BLOCKED | SPRINT_0123_0001_0001_policy_reasoning | Editor DTOs/validation; depends on 73-001. |
+| POLICY-ATTEST-74-001 | ⏳ BLOCKED | SPRINT_0123_0001_0001_policy_reasoning | Surface attestation reports; depends on 73-002. |
+| POLICY-ATTEST-74-002 | ⏳ BLOCKED | SPRINT_0123_0001_0001_policy_reasoning | Console report integration; depends on 74-001. |
+| CLI-ATTEST-73-001 | ⏳ BLOCKED | SPRINT_0201_0001_0001_cli_i | `stella attest sign` command; blocked by scanner analyzer issues. |
+| CLI-ATTEST-73-002 | ⏳ BLOCKED | SPRINT_0201_0001_0001_cli_i | `stella attest verify` command; depends on 73-001. |
+| CLI-ATTEST-74-001 | ⏳ BLOCKED | SPRINT_0201_0001_0001_cli_i | `stella attest list` command; depends on 73-002. |
+| CLI-ATTEST-74-002 | ⏳ BLOCKED | SPRINT_0201_0001_0001_cli_i | `stella attest fetch` command; depends on 74-001. |
+
+**Checkpoint:** Policy Studio integration and Console verification views blocked on upstream schema/API deliverables.
+
+### Phase 3 — Scan & VEX support
+| Task ID | Status | Sprint | Notes |
+|---------|--------|--------|-------|
+| ATTEST-01-003 | ✅ DONE (2025-11-23) | SPRINT_110_ingestion_evidence | Excititor attestation payloads shipped on frozen bundle v1. |
+| CONCELIER-ATTEST-73-001 | ✅ DONE (2025-11-25) | SPRINT_110_ingestion_evidence | Core/WebService attestation suites executed. |
+| CONCELIER-ATTEST-73-002 | ✅ DONE (2025-11-25) | SPRINT_110_ingestion_evidence | Attestation verify endpoint validated. |
+
+**Checkpoint:** Scan/VEX attestation payloads integrated; ingestion flows verified.
+
+### Phase 4 — Transparency & keys
+| Task ID | Status | Sprint | Notes |
+|---------|--------|--------|-------|
+| NOTIFY-ATTEST-74-001 | ✅ DONE (2025-11-16) | SPRINT_0171_0001_0001_notifier_i | Notification templates for verification/key events created. |
+| NOTIFY-ATTEST-74-002 | 📝 TODO | SPRINT_0171_0001_0001_notifier_i | Wire notifications to key rotation/revocation; blocked on payload localization freeze. |
+| ATTEST-REPLAY-187-003 | 📝 TODO | SPRINT_187_evidence_locker_cli_integration | Wire Attestor/Rekor anchoring for replay manifests. |
+
+**Checkpoint:** Key event notifications partially complete; witness endorsements and rotation workflows pending.
+
+### Phase 5 — Bulk & air gap
+| Task ID | Status | Sprint | Notes |
+|---------|--------|--------|-------|
+| EXPORT-ATTEST-74-001 | ⏳ BLOCKED | SPRINT_0162_0001_0001_exportcenter_i | Export job producing attestation bundles; needs EvidenceLocker DSSE layout. |
+| EXPORT-ATTEST-74-002 | ⏳ BLOCKED | SPRINT_0162_0001_0001_exportcenter_i | CI/offline kit integration; depends on 74-001. |
+| EXPORT-ATTEST-75-001 | ⏳ BLOCKED | SPRINT_0162_0001_0001_exportcenter_i | CLI `stella attest bundle verify/import`; depends on 74-002. |
+| EXPORT-ATTEST-75-002 | ⏳ BLOCKED | SPRINT_0162_0001_0001_exportcenter_i | Offline kit integration; depends on 75-001. |
+
+**Checkpoint:** Bulk/air-gap workflows blocked awaiting Export Center contracts.
+
+### Phase 6 — Performance & hardening
+| Task ID | Status | Sprint | Notes |
+|---------|--------|--------|-------|
+| ATTEST-73-003 | 📝 TODO | SPRINT_302_docs_tasks_md_ii | Evidence documentation; waiting on ATEL0102 evidence. |
+| ATTEST-73-004 | 📝 TODO | SPRINT_302_docs_tasks_md_ii | Extended documentation; depends on 73-003. |
+
+**Checkpoint:** Performance benchmarks and incident playbooks pending; observability coverage to be validated.
+
+---
+
+### Overall readiness summary
+
+| Phase | Status | Blocking items |
+|-------|--------|----------------|
+| **1 – Foundations** | ✅ Complete | — |
+| **2 – Policies & UI** | ⏳ Blocked | POLICY-ATTEST-73-001 prep; CLI build issues |
+| **3 – Scan & VEX** | ✅ Complete | — |
+| **4 – Transparency & keys** | 🔄 In progress | NOTIFY-ATTEST-74-002 payload freeze |
+| **5 – Bulk & air gap** | ⏳ Blocked | EXPORT-ATTEST-74-001 contract |
+| **6 – Performance** | 📝 Not started | Upstream phase completion |
+
+### Next actions
+1. Track POLICY-ATTEST-73-001 prep artefact publication (Sprint 0123).
+2. Resolve CLI build blockers to unblock CLI-ATTEST-73-001 (Sprint 0201).
+3. Complete NOTIFY-ATTEST-74-002 wiring once payload localization freezes (Sprint 0171).
+4. Monitor Export Center contract finalization for Phase 5 tasks (Sprint 0162).

docs/modules/authority/implementation_plan.md

@@ -20,3 +20,77 @@
 - Review ./AGENTS.md before picking up new work.
 - Sync with cross-cutting teams noted in `/docs/implplan/SPRINT_*.md`.
 - Update this plan whenever scope, dependencies, or guardrails change.
+
+---
+
+## Sprint readiness tracker
+
+> Last updated: 2025-11-27 (AUTHORITY-ENG-0001)
+
+This section maps epic milestones to implementation sprints and tracks readiness checkpoints.
+
+### Epic 1 — AOC enforcement
+| Task ID | Status | Sprint | Notes |
+|---------|--------|--------|-------|
+| AUTH-SIG-26-001 | ✅ DONE (2025-10-29) | SPRINT_0143_0000_0001_signals | Signals scopes + AOC role templates; propagation validation complete. |
+| AUTH-AIRGAP-57-001 | ✅ DONE (2025-11-08) | SPRINT_100_identity_signing | Sealed-mode CI gating; refuses tokens when sealed install lacks confirmation. |
+
+**Checkpoint:** AOC enforcement operational with guardrails and scope policies in place.
+
+### Epic 2 — Policy Engine & Editor
+| Task ID | Status | Sprint | Notes |
+|---------|--------|--------|-------|
+| AUTH-DPOP-11-001 | ✅ DONE (2025-11-08) | SPRINT_100_identity_signing | DPoP validation on `/token` grants; interactive tokens inherit `cnf.jkt`. |
+| AUTH-MTLS-11-002 | ✅ DONE (2025-11-08) | SPRINT_100_identity_signing | Refresh grants enforce original client cert; `x5t#S256` metadata persisted. |
+
+**Checkpoint:** DPoP and mTLS sender-constraint flows operational.
+
+### Epic 4 — Policy Studio
+| Task ID | Status | Sprint | Notes |
+|---------|--------|--------|-------|
+| AUTH-PACKS-43-001 | ✅ DONE (2025-11-09) | SPRINT_100_identity_signing | Pack signing policies, approval RBAC, CLI CI token scopes, audit logging. |
+
+**Checkpoint:** Pack signing and approval flows with fresh-auth prompts complete.
+
+### Epic 14 — Identity & Tenancy
+| Task ID | Status | Sprint | Notes |
+|---------|--------|--------|-------|
+| AUTH-TEN-47-001 | ✅ Contract published | SPRINT_0115_0001_0004_concelier_iv | Tenant-scope contract at `docs/modules/authority/tenant-scope-47-001.md`. |
+| AUTH-CRYPTO-90-001 | 🔄 DOING | SPRINT_0514_0001_0001_sovereign_crypto | Sovereign signing provider; key-loading path migration in progress. |
+
+**Checkpoint:** Tenancy contract published; sovereign crypto provider integration in progress.
+
+### Future tasks
+| Task ID | Status | Sprint | Notes |
+|---------|--------|--------|-------|
+| AUTH-REACH-401-005 | 📝 TODO | SPRINT_0401_0001_0001_reachability_evidence_chain | DSSE predicate types for SBOM/Graph/VEX/Replay; blocked on predicate definitions. |
+| AUTH-VERIFY-186-007 | 📝 TODO | SPRINT_186_record_deterministic_execution | Verification helper for DSSE signatures and Rekor proofs; awaits provenance harness. |
+
+**Checkpoint:** Attestation predicate support and verification helpers pending upstream dependencies.
+
+---
+
+### Overall readiness summary
+
+| Epic | Status | Blocking items |
+|------|--------|----------------|
+| **1 – AOC enforcement** | ✅ Complete | — |
+| **2 – Policy Engine & Editor** | ✅ Complete | — |
+| **4 – Policy Studio** | ✅ Complete | — |
+| **14 – Identity & Tenancy** | 🔄 In progress | AUTH-CRYPTO-90-001 provider contract |
+| **Future (Attestation)** | 📝 Not started | DSSE predicate schema; provenance harness |
+
+### Cross-module dependencies
+
+| Dependency | Required by | Status |
+|------------|-------------|--------|
+| Signals scope propagation | AUTH-SIG-26-001 | ✅ Validated |
+| Sealed-mode CI evidence | AUTH-AIRGAP-57-001 | ✅ Implemented |
+| DSSE predicate definitions | AUTH-REACH-401-005 | Schema draft pending |
+| Provenance harness (PROB0101) | AUTH-VERIFY-186-007 | In progress |
+| Sovereign crypto keystore plan | AUTH-CRYPTO-90-001 | ✅ Prep published |
+
+### Next actions
+1. Complete AUTH-CRYPTO-90-001 provider registry wiring (Sprint 0514).
+2. Coordinate DSSE predicate schema with Signer guild for AUTH-REACH-401-005 (Sprint 0401).
+3. Monitor PROB0101 provenance harness for AUTH-VERIFY-186-007 (Sprint 186).

docs/modules/notifier/prep/2025-11-20-ten-48-001-prep.md

@@ -1,12 +1,121 @@
 # Notifier Tenancy Prep — PREP-NOTIFY-TEN-48-001
 
-Status: Draft (2025-11-20)
+Status: Implemented (2025-11-27)
 Owners: Notifications Service Guild
-Scope: Tenancy model and DAL/routes for Notifier (depends on Notifier II sprint).
+Scope: Tenancy model and DAL/routes for tenant context in Notifier WebService.
 
-## Needs
-- Tenancy model decision; DAL/routes for tenant context in Notifier WebService.
-- Alignment with Notifier II scope (Sprint 0172).
+## Overview
 
-## Handoff
-Use as prep artefact; update when tenancy model is published.
+Tenant scoping for the Notifier module ensures that rules, templates, incidents, and channels
+are isolated per tenant with proper row-level security (RLS) in MongoDB storage.
+
+## Implementation Summary
+
+### 1. Tenant Context Service (`src/Notifier/StellaOps.Notifier.Worker/Tenancy/`)
+
+- **TenantContext.cs**: AsyncLocal-based context propagation for tenant ID and actor
+- **TenantServiceExtensions.cs**: DI registration and configuration options
+- **ITenantAccessor**: Interface for accessing tenant from HTTP context
+
+Key pattern:
+```csharp
+// Set tenant context for async scope
+using var scope = tenantContext.SetContext(tenantId, actor);
+await ProcessEventAsync();
+
+// Or with extension method
+await tenantContext.WithTenantAsync(tenantId, actor, async () =>
+{
+    await ProcessNotificationAsync();
+});
+```
+
+### 2. Incident Repository (`src/Notify/__Libraries/StellaOps.Notify.Storage.Mongo/`)
+
+New files:
+- **Repositories/INotifyIncidentRepository.cs**: Repository interface for incident persistence
+- **Repositories/NotifyIncidentRepository.cs**: MongoDB implementation with tenant filtering
+- **Serialization/NotifyIncidentDocumentMapper.cs**: BSON serialization for incidents
+
+Key features:
+- All queries include mandatory `tenantId` filter
+- Document IDs use `{tenantId}:{resourceId}` composite pattern for RLS
+- Correlation key lookup scoped to tenant
+- Soft delete support with `deletedAt` field
+
+### 3. MongoDB Indexes (tenant-scoped)
+
+Added in `EnsureNotifyIndexesMigration.cs`:
+```javascript
+// incidents collection
+{ tenantId: 1, status: 1, lastOccurrence: -1 }  // Status filtering
+{ tenantId: 1, correlationKey: 1, status: 1 }   // Correlation lookup
+```
+
+### 4. Existing Tenancy Infrastructure
+
+The following was already in place:
+- All models have `TenantId` property (NotifyRule, NotifyChannel, NotifyTemplate, etc.)
+- Repository interfaces take `tenantId` as parameter
+- Endpoints extract tenant from `X-StellaOps-Tenant` header
+- MongoDB document IDs use tenant-prefixed composite keys
+
+## Configuration
+
+```json
+{
+  "Notifier": {
+    "Tenant": {
+      "TenantIdHeader": "X-StellaOps-Tenant",
+      "ActorHeader": "X-StellaOps-Actor",
+      "RequireTenant": true,
+      "DefaultActor": "system",
+      "ExcludedPaths": ["/health", "/ready", "/metrics", "/openapi"]
+    }
+  }
+}
+```
+
+## Usage Examples
+
+### HTTP API
+```http
+GET /api/v2/rules HTTP/1.1
+X-StellaOps-Tenant: tenant-123
+X-StellaOps-Actor: user@example.com
+```
+
+### Worker Processing
+```csharp
+public class NotificationProcessor
+{
+    private readonly ITenantContext _tenantContext;
+
+    public async Task ProcessAsync(NotifyEvent @event)
+    {
+        using var scope = _tenantContext.SetContext(@event.TenantId, "worker");
+
+        // All subsequent operations are scoped to tenant
+        var rules = await _rules.ListAsync(@event.TenantId);
+        // ...
+    }
+}
+```
+
+## Handoff Notes
+
+- Incident storage moved from in-memory to MongoDB with full tenant isolation
+- Worker should use `ITenantContext.SetContext()` before processing events
+- All new repositories MUST include tenant filtering in queries
+- Test tenant isolation with multi-tenant integration tests
+
+## Related Files
+
+- `src/Notifier/StellaOps.Notifier.Worker/Tenancy/TenantContext.cs`
+- `src/Notifier/StellaOps.Notifier.Worker/Tenancy/TenantServiceExtensions.cs`
+- `src/Notify/__Libraries/StellaOps.Notify.Storage.Mongo/Repositories/INotifyIncidentRepository.cs`
+- `src/Notify/__Libraries/StellaOps.Notify.Storage.Mongo/Repositories/NotifyIncidentRepository.cs`
+- `src/Notify/__Libraries/StellaOps.Notify.Storage.Mongo/Serialization/NotifyIncidentDocumentMapper.cs`
+- `src/Notify/__Libraries/StellaOps.Notify.Storage.Mongo/Options/NotifyMongoOptions.cs` (added IncidentsCollection)
+- `src/Notify/__Libraries/StellaOps.Notify.Storage.Mongo/Migrations/EnsureNotifyIndexesMigration.cs` (added incident indexes)
+- `src/Notify/__Libraries/StellaOps.Notify.Storage.Mongo/ServiceCollectionExtensions.cs` (added INotifyIncidentRepository registration)

docs/modules/notify/implementation_plan.md

@@ -59,3 +59,97 @@
 ## Definition of done
 - Notify service, workers, connectors, Console/CLI, observability, and Offline Kit assets shipped with documentation and runbooks.
 - Compliance checklist appended to docs; ./TASKS.md and ../../TASKS.md updated with progress.
+
+---
+
+## Sprint readiness tracker
+
+> Last updated: 2025-11-27 (NOTIFY-ENG-0001)
+
+This section maps delivery phases to implementation sprints and tracks readiness checkpoints.
+
+### Phase 1 — Core rules engine & delivery ledger
+| Task ID | Status | Sprint | Notes |
+|---------|--------|--------|-------|
+| NOTIFY-SVC-37-001 | ✅ DONE (2025-11-24) | SPRINT_0172_0001_0002_notifier_ii | Pack approval contract published (OpenAPI schema, payloads). |
+| NOTIFY-SVC-37-002 | ✅ DONE (2025-11-24) | SPRINT_0172_0001_0002_notifier_ii | Ingestion endpoint with Mongo persistence, idempotent writes, audit trail. |
+| NOTIFY-SVC-37-003 | 🔄 DOING | SPRINT_0172_0001_0002_notifier_ii | Approval/policy templates, routing predicates; dispatch/rendering pending. |
+| NOTIFY-SVC-37-004 | ✅ DONE (2025-11-24) | SPRINT_0172_0001_0002_notifier_ii | Acknowledgement API, test harness, metrics. |
+| NOTIFY-OAS-61-001 | ✅ DONE (2025-11-17) | SPRINT_0171_0001_0001_notifier_i | OAS with rules/templates/incidents/quiet hours endpoints. |
+| NOTIFY-OAS-61-002 | ✅ DONE (2025-11-17) | SPRINT_0171_0001_0001_notifier_i | `/.well-known/openapi` discovery endpoint. |
+| NOTIFY-OAS-62-001 | ✅ DONE (2025-11-17) | SPRINT_0171_0001_0001_notifier_i | SDK examples for rule CRUD. |
+| NOTIFY-OAS-63-001 | ✅ DONE (2025-11-17) | SPRINT_0171_0001_0001_notifier_i | Deprecation headers and templates. |
+
+**Checkpoint:** Core rules engine mostly complete; template dispatch/rendering in progress.
+
+### Phase 2 — Connectors & rendering
+| Task ID | Status | Sprint | Notes |
+|---------|--------|--------|-------|
+| NOTIFY-SVC-38-002 | 📝 TODO | SPRINT_0172_0001_0002_notifier_ii | Channel adapters (email, chat webhook, generic webhook) with retry policies. |
+| NOTIFY-SVC-38-003 | 📝 TODO | SPRINT_0172_0001_0002_notifier_ii | Template service, renderer with redaction and localization. |
+| NOTIFY-SVC-38-004 | 📝 TODO | SPRINT_0172_0001_0002_notifier_ii | REST + WS APIs for rules CRUD, templates preview, incidents. |
+| NOTIFY-DOC-70-001 | ✅ DONE (2025-11-02) | SPRINT_0171_0001_0001_notifier_i | Architecture docs for `src/Notify` vs `src/Notifier` split. |
+
+**Checkpoint:** Connector and rendering work not yet started; depends on Phase 1 completion.
+
+### Phase 3 — Console & CLI authoring
+| Task ID | Status | Sprint | Notes |
+|---------|--------|--------|-------|
+| NOTIFY-SVC-39-001 | 📝 TODO | SPRINT_0172_0001_0002_notifier_ii | Correlation engine with throttler, quiet hours, incident lifecycle. |
+| NOTIFY-SVC-39-002 | 📝 TODO | SPRINT_0172_0001_0002_notifier_ii | Digest generator with schedule runner. |
+| NOTIFY-SVC-39-003 | 📝 TODO | SPRINT_0172_0001_0002_notifier_ii | Simulation engine for dry-run rules against historical events. |
+| NOTIFY-SVC-39-004 | 📝 TODO | SPRINT_0172_0001_0002_notifier_ii | Quiet hour calendars with audit logging. |
+
+**Checkpoint:** Console/CLI authoring work not started; depends on Phase 2 completion.
+
+### Phase 4 — Governance & observability
+| Task ID | Status | Sprint | Notes |
+|---------|--------|--------|-------|
+| NOTIFY-SVC-40-001 | 📝 TODO | SPRINT_0172_0001_0002_notifier_ii | Escalations, on-call schedules, PagerDuty/OpsGenie adapters. |
+| NOTIFY-SVC-40-002 | 📝 TODO | SPRINT_0172_0001_0002_notifier_ii | Summary storm breaker, localization bundles. |
+| NOTIFY-SVC-40-003 | 📝 TODO | SPRINT_0172_0001_0002_notifier_ii | Security hardening (signed ack links, webhook HMAC). |
+| NOTIFY-SVC-40-004 | 📝 TODO | SPRINT_0172_0001_0002_notifier_ii | Observability metrics/traces, dead-letter handling, chaos tests. |
+| NOTIFY-OBS-51-001 | ✅ DONE (2025-11-22) | SPRINT_0171_0001_0001_notifier_i | SLO evaluator webhooks with templates/routing/suppression. |
+| NOTIFY-OBS-55-001 | ✅ DONE (2025-11-22) | SPRINT_0171_0001_0001_notifier_i | Incident mode templates with evidence/trace/retention context. |
+| NOTIFY-ATTEST-74-001 | ✅ DONE (2025-11-16) | SPRINT_0171_0001_0001_notifier_i | Templates for verification failures, key revocations, transparency. |
+| NOTIFY-ATTEST-74-002 | 📝 TODO | SPRINT_0171_0001_0001_notifier_i | Wire notifications to key rotation/revocation events. |
+| NOTIFY-RISK-66-001 | ⏳ BLOCKED | SPRINT_0171_0001_0001_notifier_i | Risk severity escalation triggers; needs POLICY-RISK-40-002. |
+| NOTIFY-RISK-67-001 | ⏳ BLOCKED | SPRINT_0171_0001_0001_notifier_i | Risk profile publish/deprecate notifications. |
+| NOTIFY-RISK-68-001 | ⏳ BLOCKED | SPRINT_0171_0001_0001_notifier_i | Per-profile routing, quiet hours, dedupe. |
+
+**Checkpoint:** Core observability complete; governance and risk notifications blocked on upstream dependencies.
+
+### Phase 5 — Offline & compliance
+| Task ID | Status | Sprint | Notes |
+|---------|--------|--------|-------|
+| NOTIFY-AIRGAP-56-002 | ✅ DONE | SPRINT_0171_0001_0001_notifier_i | Bootstrap Pack with deterministic secrets and offline validation. |
+| NOTIFY-TEN-48-001 | ⏳ BLOCKED | SPRINT_0173_0001_0003_notifier_iii | Tenant-scope rules/templates; needs Sprint 0172 tenancy model. |
+
+**Checkpoint:** Offline basics complete; tenancy work blocked on upstream Sprint 0172.
+
+---
+
+### Overall readiness summary
+
+| Phase | Status | Blocking items |
+|-------|--------|----------------|
+| **1 – Core rules engine** | 🔄 In progress | NOTIFY-SVC-37-003 dispatch/rendering |
+| **2 – Connectors & rendering** | 📝 Not started | Phase 1 completion |
+| **3 – Console & CLI** | 📝 Not started | Phase 2 completion |
+| **4 – Governance & observability** | 🔄 Partial | POLICY-RISK-40-002 for risk notifications |
+| **5 – Offline & compliance** | 🔄 Partial | Sprint 0172 tenancy model |
+
+### Cross-module dependencies
+
+| Dependency | Required by | Status |
+|------------|-------------|--------|
+| Attestor payload localization | NOTIFY-ATTEST-74-002 | Freeze pending |
+| POLICY-RISK-40-002 export | NOTIFY-RISK-66/67/68 | BLOCKED |
+| Sprint 0172 tenancy model | NOTIFY-TEN-48-001 | In progress |
+| Telemetry SLO webhook schema | NOTIFY-OBS-51-001 | ✅ Published (`docs/notifications/slo-webhook-schema.md`) |
+
+### Next actions
+1. Complete NOTIFY-SVC-37-003 dispatch/rendering wiring (Sprint 0172).
+2. Start NOTIFY-SVC-38-002 channel adapters once Phase 1 closes.
+3. Track POLICY-RISK-40-002 to unblock risk notification tasks.
+4. Monitor Sprint 0172 tenancy model for NOTIFY-TEN-48-001.

docs/modules/signer/implementation_plan.md

@@ -59,3 +59,78 @@
 - Export Center + Attestor dependencies validated; CLI parity confirmed.
 - Documentation updated (README, architecture, runbooks, CLI guides) with imposed rule compliance.
 - ./TASKS.md and ../../TASKS.md reflect the latest status transitions.
+
+---
+
+## Sprint readiness tracker
+
+> Last updated: 2025-11-27 (SIGNER-ENG-0001)
+
+This section maps delivery phases to implementation sprints and tracks readiness checkpoints.
+
+### Phase 1 — Core service & PoE
+| Task ID | Status | Sprint | Notes |
+|---------|--------|--------|-------|
+| KMSI-73-001 | ✅ DONE (2025-11-03) | SPRINT_100_identity_signing | KMS key management foundations with staffing + DSSE contract. |
+| KMSI-73-002 | ✅ DONE (2025-11-03) | SPRINT_100_identity_signing | FIDO2 profile integration. |
+| PROV-OBS-53-001 | ✅ DONE (2025-11-17) | SPRINT_0513_0001_0001_provenance | DSSE/SLSA BuildDefinition + BuildMetadata models with canonical JSON serializer. |
+| PROV-OBS-53-002 | ✅ DONE (2025-11-23) | SPRINT_0513_0001_0001_provenance | Signer abstraction (cosign/KMS/offline) with key rotation hooks and audit logging. |
+| SEC-CRYPTO-90-020 | 🔄 IN PROGRESS | SPRINT_0514_0001_0001_sovereign_crypto | CryptoPro signer plugin; Windows CSP runner pending. |
+
+**Checkpoint:** Core signing infrastructure operational — KMS drivers, signer abstractions, and DSSE models delivered.
+
+### Phase 2 — Export Center integration
+| Task ID | Status | Sprint | Notes |
+|---------|--------|--------|-------|
+| PROV-OBS-53-003 | ✅ DONE (2025-11-23) | SPRINT_0513_0001_0001_provenance | PromotionAttestationBuilder feeding canonicalised payloads to Signer. |
+| SIGN-REPLAY-186-003 | 📝 TODO | SPRINT_186_record_deterministic_execution | Extend Signer/Authority DSSE flows for replay manifest/bundle payloads. |
+| SIGN-CORE-186-004 | 📝 TODO | SPRINT_186_record_deterministic_execution | Replace HMAC demo with StellaOps.Cryptography providers (keyless + KMS). |
+| SIGN-CORE-186-005 | 📝 TODO | SPRINT_186_record_deterministic_execution | Refactor SignerStatementBuilder for StellaOps predicate types. |
+| SIGN-TEST-186-006 | 📝 TODO | SPRINT_186_record_deterministic_execution | Upgrade signer integration tests with real crypto + fixture predicates. |
+
+**Checkpoint:** Export Center signing APIs partially complete; replay manifest support and crypto provider refactoring pending.
+
+### Phase 3 — Attestor alignment
+| Task ID | Status | Sprint | Notes |
+|---------|--------|--------|-------|
+| AUTH-REACH-401-005 | 📝 TODO | SPRINT_0401_0001_0001_reachability_evidence_chain | DSSE predicate types for SBOM/Graph/VEX/Replay; blocked on predicate definitions. |
+| SIGN-VEX-401-018 | 📝 TODO | SPRINT_0401_0001_0001_reachability_evidence_chain | Extend predicate catalog with `stella.ops/vexDecision@v1`. |
+| PROV-OBS-54-001 | 📝 TODO | SPRINT_0513_0001_0001_provenance | Verification library for DSSE signatures, Merkle roots, timeline chain. |
+| PROV-OBS-54-002 | 📝 TODO | SPRINT_0513_0001_0001_provenance | .NET global tool for local verification + CLI `stella forensic verify`. |
+
+**Checkpoint:** Attestor DSSE alignment pending; predicate catalog extension and verification library not started.
+
+### Phase 4 — Observability & resilience
+| Task ID | Status | Sprint | Notes |
+|---------|--------|--------|-------|
+| DOCS-PROMO-70-001 | 📝 TODO | SPRINT_304_docs_tasks_md_iv | Promotion attestations doc (CLI commands, Signer/Attestor integration, offline verification). |
+| CLI-PROMO-70-002 | 📝 TODO | SPRINT_203_cli_iii | `stella promotion attest` / `promotion verify` commands. |
+| CLI-FORENSICS-54-002 | 📝 TODO | SPRINT_202_cli_ii | `stella forensic attest show <artifact>` listing signer details. |
+
+**Checkpoint:** Observability and CLI integration pending; waiting on upstream signing pipeline completion.
+
+---
+
+### Overall readiness summary
+
+| Phase | Status | Blocking items |
+|-------|--------|----------------|
+| **1 – Core service & PoE** | ✅ Complete | — |
+| **2 – Export Center integration** | 🔄 In progress | SIGN-CORE-186-004/005 crypto provider refactoring |
+| **3 – Attestor alignment** | 📝 Not started | AUTH-REACH-401-005 predicate definitions |
+| **4 – Observability & resilience** | 📝 Not started | Upstream phase completion |
+
+### Cross-module dependencies
+
+| Dependency | Required by | Status |
+|------------|-------------|--------|
+| Attestor DSSE bundle schema | SIGN-VEX-401-018 | Documented in `docs/modules/attestor/architecture.md` §1 |
+| Provenance library canonicalisation | SIGN-CORE-186-005 | Available via PROV-OBS-53-001/002 |
+| Export Center bundle manifest | SIGN-REPLAY-186-003 | Pending Sprint 162/163 deliverables |
+| Authority predicate definitions | AUTH-REACH-401-005 | Schema draft pending |
+
+### Next actions
+1. Complete CryptoPro signer plugin Windows smoke test (SEC-CRYPTO-90-020, Sprint 0514).
+2. Start SIGN-CORE-186-004 once replay bundle schema finalises (Sprint 186).
+3. Track AUTH-REACH-401-005 predicate schema draft for Attestor alignment (Sprint 401).
+4. Monitor PROV-OBS-54-001/002 for verification library availability.