diff --git a/docs/implplan/ROADMAP_20260102_advisory_gap_closure.md b/docs/implplan/ROADMAP_20260102_advisory_gap_closure.md
new file mode 100644
index 000000000..e6ccd2a03
--- /dev/null
+++ b/docs/implplan/ROADMAP_20260102_advisory_gap_closure.md
@@ -0,0 +1,316 @@
+# Implementation Roadmap: Product Advisory Gap Closure
+
+**Document ID:** ROADMAP_20260102_advisory_gap_closure
+**Created:** 2026-01-02
+**Status:** APPROVED FOR IMPLEMENTATION
+
+## Executive Summary
+
+Analysis of 7 unprocessed product advisories revealed significant gaps in three areas:
+1. **Binary-Level Patch Verification** - Detecting backported fixes at the code level
+2. **Supply Chain Provenance** - in-toto link generation for SLSA compliance
+3. **VEX Verdict Explainability** - Full proof objects for audit trails
+
+This roadmap consolidates these gaps into 4 implementation sprints spanning 9-14 weeks.
+
+## Advisory Analysis Summary
+
+### Advisories Reviewed
+
+| Date | Advisory | Theme | Status |
+|------|----------|-------|--------|
+| 02-Dec-2025 | Designing offline DSSE + in-toto attestations | Provenance | Gap identified |
+| 02-Dec-2025 | Handle RPM versions with EVR tuples | Version comparison | **FULLY IMPLEMENTED** |
+| 02-Dec-2025 | Snapshot advisories for time-aware verdicts | Reproducibility | **FULLY IMPLEMENTED** |
+| 30-Dec-2025 | Binary Diff Signatures for Patch Detection | Binary analysis | Gap identified |
+| 30-Dec-2025 | Building a Golden Set for Patch Validation | Testing | Gap identified |
+| 30-Dec-2025 | Designing a Deterministic VEX Resolver | VEX consensus | Partial gap |
+| 30-Dec-2025 | Evidence-Gated AI Explanations | AI UX | **FULLY IMPLEMENTED** |
+
+### Key Finding
+
+**3 of 7 advisories are already fully implemented** (RPM EVR, Time-aware snapshots, Evidence-gated AI). The remaining gaps are addressable in 4 sprints.
+
+## Implementation Roadmap
+
+```
+Week 1-2 Week 3-4 Week 5-6 Week 7-8 Week 9-10 Week 11-12 Week 13-14
+ │ │ │ │ │ │ │
+ ▼──────────▼──────────▼──────────▼ │ │ │
+ ╔═══════════════════════════════════════════╗ │ │
+ ║ SPRINT 001: Binary Delta Signatures ║ │ │
+ ║ • B2R2 disassembly integration ║ │ │
+ ║ • Instruction normalization ║ │ │
+ ║ • Delta signature generation ║ │ │
+ ║ • CLI: stella deltasig ║ │ │
+ ╚═══════════════════════════════════════════╝ │ │
+ │ │ │
+ ▼─────────────────────▼ │
+ ╔═════════════════════════════════╗
+ ║ SPRINT 002: in-toto Links ║
+ ║ • Link recorder service ║
+ ║ • Layout verifier ║
+ ║ • Scanner integration ║
+ ╚═════════════════════════════════╝
+ │ │
+ ▼───────────▼
+ ╔═══════════════════════╗
+ ║ SPRINT 003: VEX ║
+ ║ Proof Objects ║
+ ║ • Proof schema ║
+ ║ • Propagation rules ║
+ ║ • Condition eval ║
+ ╚═══════════════════════╝
+ │
+ ▼
+ ╔═══════════════════════╗
+ ║ SPRINT 004: Polish ║
+ ║ • CycloneDX 1.7 ║
+ ║ • Shuffle tests ║
+ ║ • Golden corpus ║
+ ╚═══════════════════════╝
+```
+
+## Sprint Details
+
+### Sprint 001: Binary Delta Signatures
+
+| Attribute | Value |
+|-----------|-------|
+| **ID** | SPRINT_20260102_001_BE |
+| **Duration** | 4-6 weeks |
+| **Working Dir** | `src/BinaryIndex/` |
+| **Key Deliverable** | `stella deltasig` CLI with B2R2-powered binary analysis |
+
+**Why This Matters:**
+- Competitors trust version strings; we provide **cryptographic proof** of fix presence
+- Eliminates false positives from distro backports
+- Major competitive differentiator
+
+**Key Technical Decisions:**
+- **Disassembler:** B2R2 (fully managed .NET, MIT license, multi-arch)
+- **Storage:** PostgreSQL `binaryindex.delta_signature` table
+- **Distribution:** Offline signature packs (ZIP) for air-gapped environments
+
+**Success Criteria:**
+- [ ] Extract normalized hashes from ELF binaries (x86-64, ARM64)
+- [ ] Author signatures from vulnerable/patched binary pairs
+- [ ] Match binaries against signature database
+- [ ] Detect Heartbleed backport in RHEL 6 OpenSSL (golden test)
+
+---
+
+### Sprint 002: in-toto Link Generation
+
+| Attribute | Value |
+|-----------|-------|
+| **ID** | SPRINT_20260102_002_BE |
+| **Duration** | 2-3 weeks |
+| **Working Dir** | `src/Attestor/` |
+| **Key Deliverable** | `ILinkRecorder` service with Scanner integration |
+
+**Why This Matters:**
+- SLSA compliance requires provenance attestations
+- Supply chain transparency for audit trails
+- Foundation for layout-based policy enforcement
+
+**Key Technical Decisions:**
+- **Predicate Format:** in-toto Link v1 per spec
+- **Envelope:** DSSE (existing infrastructure)
+- **Verification:** Layout verification is optional (Phase 2)
+
+**Success Criteria:**
+- [ ] Record scan operations as in-toto links
+- [ ] Sign links with existing DSSE infrastructure
+- [ ] Verify link signatures offline
+- [ ] Basic layout verification (single step)
+
+---
+
+### Sprint 003: VEX Proof Objects & Propagation
+
+| Attribute | Value |
+|-----------|-------|
+| **ID** | SPRINT_20260102_003_BE |
+| **Duration** | 2-3 weeks |
+| **Working Dir** | `src/VexLens/`, `src/Policy/` |
+| **Key Deliverable** | Full proof objects alongside VEX verdicts |
+
+**Why This Matters:**
+- Audit requirement: explain every verdict
+- Reproducibility: same inputs → same outputs
+- Trust: show your work
+
+**Key Technical Decisions:**
+- **Proof Schema:** `stellaops.vex-proof.v1` with digest
+- **Propagation:** Configurable rules via policy
+- **Conditions:** Platform, distro, features, build flags
+
+**Success Criteria:**
+- [ ] Every verdict includes proof object
+- [ ] Proof contains all inputs, merge steps, graph paths
+- [ ] Propagation rules documented and tested
+- [ ] Condition evaluation handles Unknown explicitly
+
+---
+
+### Sprint 004: Polish & Testing
+
+| Attribute | Value |
+|-----------|-------|
+| **ID** | SPRINT_20260102_004_BE |
+| **Duration** | 1-2 weeks |
+| **Working Dir** | Various |
+| **Key Deliverable** | Complete test coverage, CycloneDX 1.7, golden corpus |
+
+**Why This Matters:**
+- Confidence in determinism claims
+- Industry standard compliance (CycloneDX 1.7)
+- Regression prevention
+
+**Key Technical Decisions:**
+- **Shuffle Tests:** 1000 random permutations for large sets
+- **Golden Corpus:** Top 20 backport cases from advisory
+- **CycloneDX:** Full analysis.state/justification mapping
+
+**Success Criteria:**
+- [ ] Shuffle determinism tests pass for all consensus modes
+- [ ] 20 golden backport cases in corpus
+- [ ] CycloneDX 1.7 analysis fields fully mapped
+- [ ] End-to-end regression suite in CI
+
+---
+
+## Resource Allocation
+
+### New Projects Created
+
+| Project | Sprint | Purpose |
+|---------|--------|---------|
+| `StellaOps.BinaryIndex.Disassembly` | 001 | B2R2 wrapper |
+| `StellaOps.BinaryIndex.Normalization` | 001 | Instruction normalization |
+| `StellaOps.BinaryIndex.DeltaSig` | 001 | Signature generation |
+| `StellaOps.BinaryIndex.DeltaSig.Persistence` | 001 | PostgreSQL storage |
+| `StellaOps.BinaryIndex.Cli` | 001 | CLI commands |
+| `StellaOps.Attestor.InToto` | 002 | in-toto primitives |
+
+### Dependencies Added
+
+| Package | Version | License | Sprint |
+|---------|---------|---------|--------|
+| B2R2.FrontEnd.API | 0.9.1+ | MIT | 001 |
+
+### Database Migrations
+
+| Schema | Table | Sprint |
+|--------|-------|--------|
+| `binaryindex` | `delta_signature` | 001 |
+| `binaryindex` | `signature_pack` | 001 |
+| `binaryindex` | `signature_pack_entry` | 001 |
+
+---
+
+## Risk Register
+
+| ID | Risk | Probability | Impact | Mitigation |
+|----|------|-------------|--------|------------|
+| R-001 | B2R2 F# learning curve | Medium | Low | Thin C# wrapper, team training |
+| R-002 | Compiler optimization variance | High | Medium | Rolling chunk hashes, multiple variants |
+| R-003 | Golden corpus curation effort | Medium | Low | Start with 20, expand iteratively |
+| R-004 | Proof object size bloat | Low | Medium | Optional compression, summary mode |
+| R-005 | in-toto layout complexity | Medium | Low | Defer complex layouts to Phase 2 |
+
+---
+
+## Definition of Done
+
+### Sprint 001 (Binary Delta Signatures)
+- [ ] B2R2 integration tests pass
+- [ ] Normalization property tests pass
+- [ ] `stella deltasig extract` works on real ELF
+- [ ] `stella deltasig match` detects Heartbleed backport
+- [ ] Documentation in AGENTS.md
+
+### Sprint 002 (in-toto Links)
+- [ ] Link recorder unit tests pass
+- [ ] Scanner emits links for scans
+- [ ] Links are DSSE-signed
+- [ ] Basic layout verification works
+- [ ] Integration test with Rekor
+
+### Sprint 003 (VEX Proofs)
+- [ ] Proof objects emitted for all verdicts
+- [ ] Proof digest computation is deterministic
+- [ ] Propagation rules tested
+- [ ] Condition evaluator handles all cases
+- [ ] Shuffle determinism tests pass (preview)
+
+### Sprint 004 (Polish)
+- [ ] CycloneDX 1.7 tests pass
+- [ ] All shuffle determinism tests pass
+- [ ] 20 golden corpus cases loaded
+- [ ] End-to-end regression in CI
+- [ ] All documentation updated
+
+---
+
+## Approval
+
+| Role | Name | Date | Signature |
+|------|------|------|-----------|
+| Product Manager | | | |
+| Tech Lead | | | |
+| Security Review | | | |
+
+---
+
+## Related Documents
+
+- [SPRINT_20260102_001_BE_binary_delta_signatures.md](./SPRINT_20260102_001_BE_binary_delta_signatures.md)
+- [SPRINT_20260102_002_BE_intoto_link_generation.md](./SPRINT_20260102_002_BE_intoto_link_generation.md)
+- [SPRINT_20260102_003_BE_vex_proof_objects.md](./SPRINT_20260102_003_BE_vex_proof_objects.md)
+- [SPRINT_20260102_004_BE_polish_and_testing.md](./SPRINT_20260102_004_BE_polish_and_testing.md)
+
+## Appendix A: What Was Already Implemented
+
+The following advisory items required **no new implementation**:
+
+### RPM EVR Comparison (Advisory: Handle RPM versions with EVR tuples)
+
+**Status:** Fully implemented in `StellaOps.VersionComparison`
+
+- `RpmVersionComparer` with proper rpmvercmp semantics
+- NEVRA parsing with 32 known architectures
+- DPKG and APK comparers
+- 43+ unit tests, property tests, golden file tests, integration tests
+
+### Time-Aware Snapshots (Advisory: Snapshot advisories for time-aware verdicts)
+
+**Status:** Fully implemented in `StellaOps.Replay.Core` and `StellaOps.Concelier`
+
+- Atomic feed snapshots with composite digests
+- Point-in-time replay via `AdvisoryEventLog.ReplayAsync(asOf)`
+- RFC 8785 JCS canonicalization
+- Air-gapped time anchors and staleness budgets
+- REST API for snapshot management
+
+### Evidence-Gated AI (Advisory: Evidence-Gated AI Explanations)
+
+**Status:** Fully implemented in `StellaOps.Signals`, `StellaOps.Policy`, `StellaOps.AdvisoryAI`
+
+- 6-dimensional evidence bucket scoring
+- Confidence tiers (VeryHigh, High, Medium, Low, VeryLow)
+- AI consent gating (`AiConsentGateComponent`)
+- Citation verification (≥80% = EvidenceBacked)
+- Fill-the-gaps UI components
+- Environment-based thresholds
+
+## Appendix B: Task Count Summary
+
+| Sprint | Task Count | Complexity |
+|--------|------------|------------|
+| 001 - Binary Delta Signatures | 43 tasks | High |
+| 002 - in-toto Links | 25 tasks | Medium |
+| 003 - VEX Proofs | 30 tasks | Medium |
+| 004 - Polish & Testing | 21 tasks | Low-Medium |
+| **Total** | **119 tasks** | |
diff --git a/docs/implplan/SPRINT_20251229_049_BE_csproj_audit_maint_tests.md b/docs/implplan/SPRINT_20251229_049_BE_csproj_audit_maint_tests.md
index c256ef7e9..f480cc5fc 100644
--- a/docs/implplan/SPRINT_20251229_049_BE_csproj_audit_maint_tests.md
+++ b/docs/implplan/SPRINT_20251229_049_BE_csproj_audit_maint_tests.md
@@ -46,10 +46,10 @@ Bulk task definitions (applies to every project row below):
| 24 | AUDIT-0008-A | DONE | Applied + tests | Guild | src/Tools/LanguageAnalyzerSmoke/LanguageAnalyzerSmoke.csproj - APPLY |
| 25 | AUDIT-0009-M | DONE | Report | Guild | src/Findings/StellaOps.Findings.Ledger/tools/LedgerReplayHarness/LedgerReplayHarness.csproj - MAINT |
| 26 | AUDIT-0009-T | DONE | Report | Guild | src/Findings/StellaOps.Findings.Ledger/tools/LedgerReplayHarness/LedgerReplayHarness.csproj - TEST |
-| 27 | AUDIT-0009-A | TODO | Approval | Guild | src/Findings/StellaOps.Findings.Ledger/tools/LedgerReplayHarness/LedgerReplayHarness.csproj - APPLY |
+| 27 | AUDIT-0009-A | DONE | Approval | Guild | src/Findings/StellaOps.Findings.Ledger/tools/LedgerReplayHarness/LedgerReplayHarness.csproj - APPLY |
| 28 | AUDIT-0010-M | DONE | Report | Guild | src/Findings/tools/LedgerReplayHarness/LedgerReplayHarness.csproj - MAINT |
| 29 | AUDIT-0010-T | DONE | Report | Guild | src/Findings/tools/LedgerReplayHarness/LedgerReplayHarness.csproj - TEST |
-| 30 | AUDIT-0010-A | TODO | Approval | Guild | src/Findings/tools/LedgerReplayHarness/LedgerReplayHarness.csproj - APPLY |
+| 30 | AUDIT-0010-A | DONE | Approval | Guild | src/Findings/tools/LedgerReplayHarness/LedgerReplayHarness.csproj - APPLY |
| 31 | AUDIT-0011-M | DONE | Report | Guild | src/Tools/NotifySmokeCheck/NotifySmokeCheck.csproj - MAINT |
| 32 | AUDIT-0011-T | DONE | Report | Guild | src/Tools/NotifySmokeCheck/NotifySmokeCheck.csproj - TEST |
| 33 | AUDIT-0011-A | DONE | Applied + tests | Guild | src/Tools/NotifySmokeCheck/NotifySmokeCheck.csproj - APPLY |
@@ -97,22 +97,22 @@ Bulk task definitions (applies to every project row below):
| 75 | AUDIT-0025-A | DONE | Waived (test project) | Guild | src/AirGap/__Tests/StellaOps.AirGap.Controller.Tests/StellaOps.AirGap.Controller.Tests.csproj - APPLY |
| 76 | AUDIT-0026-M | DONE | Report | Guild | src/AirGap/StellaOps.AirGap.Importer/StellaOps.AirGap.Importer.csproj - MAINT |
| 77 | AUDIT-0026-T | DONE | Report | Guild | src/AirGap/StellaOps.AirGap.Importer/StellaOps.AirGap.Importer.csproj - TEST |
-| 78 | AUDIT-0026-A | TODO | Approval | Guild | src/AirGap/StellaOps.AirGap.Importer/StellaOps.AirGap.Importer.csproj - APPLY |
+| 78 | AUDIT-0026-A | DOING | Approval | Guild | src/AirGap/StellaOps.AirGap.Importer/StellaOps.AirGap.Importer.csproj - APPLY |
| 79 | AUDIT-0027-M | DONE | Report | Guild | src/AirGap/__Tests/StellaOps.AirGap.Importer.Tests/StellaOps.AirGap.Importer.Tests.csproj - MAINT |
| 80 | AUDIT-0027-T | DONE | Report | Guild | src/AirGap/__Tests/StellaOps.AirGap.Importer.Tests/StellaOps.AirGap.Importer.Tests.csproj - TEST |
| 81 | AUDIT-0027-A | DONE | Waived (test project) | Guild | src/AirGap/__Tests/StellaOps.AirGap.Importer.Tests/StellaOps.AirGap.Importer.Tests.csproj - APPLY |
| 82 | AUDIT-0028-M | DONE | Report | Guild | src/AirGap/__Libraries/StellaOps.AirGap.Persistence/StellaOps.AirGap.Persistence.csproj - MAINT |
| 83 | AUDIT-0028-T | DONE | Report | Guild | src/AirGap/__Libraries/StellaOps.AirGap.Persistence/StellaOps.AirGap.Persistence.csproj - TEST |
-| 84 | AUDIT-0028-A | TODO | Approval | Guild | src/AirGap/__Libraries/StellaOps.AirGap.Persistence/StellaOps.AirGap.Persistence.csproj - APPLY |
+| 84 | AUDIT-0028-A | DONE | Applied schema + determinism fixes | Guild | src/AirGap/__Libraries/StellaOps.AirGap.Persistence/StellaOps.AirGap.Persistence.csproj - APPLY |
| 85 | AUDIT-0029-M | DONE | Report | Guild | src/AirGap/__Tests/StellaOps.AirGap.Persistence.Tests/StellaOps.AirGap.Persistence.Tests.csproj - MAINT |
| 86 | AUDIT-0029-T | DONE | Report | Guild | src/AirGap/__Tests/StellaOps.AirGap.Persistence.Tests/StellaOps.AirGap.Persistence.Tests.csproj - TEST |
| 87 | AUDIT-0029-A | DONE | Waived (test project) | Guild | src/AirGap/__Tests/StellaOps.AirGap.Persistence.Tests/StellaOps.AirGap.Persistence.Tests.csproj - APPLY |
| 88 | AUDIT-0030-M | DONE | Report | Guild | src/AirGap/StellaOps.AirGap.Policy/StellaOps.AirGap.Policy/StellaOps.AirGap.Policy.csproj - MAINT |
| 89 | AUDIT-0030-T | DONE | Report | Guild | src/AirGap/StellaOps.AirGap.Policy/StellaOps.AirGap.Policy/StellaOps.AirGap.Policy.csproj - TEST |
-| 90 | AUDIT-0030-A | TODO | Approval | Guild | src/AirGap/StellaOps.AirGap.Policy/StellaOps.AirGap.Policy/StellaOps.AirGap.Policy.csproj - APPLY |
+| 90 | AUDIT-0030-A | DONE | Applied reloadable policy + allowlist de-dup + client factory overload | Guild | src/AirGap/StellaOps.AirGap.Policy/StellaOps.AirGap.Policy/StellaOps.AirGap.Policy.csproj - APPLY |
| 91 | AUDIT-0031-M | DONE | Report | Guild | src/AirGap/StellaOps.AirGap.Policy/StellaOps.AirGap.Policy.Analyzers/StellaOps.AirGap.Policy.Analyzers.csproj - MAINT |
| 92 | AUDIT-0031-T | DONE | Report | Guild | src/AirGap/StellaOps.AirGap.Policy/StellaOps.AirGap.Policy.Analyzers/StellaOps.AirGap.Policy.Analyzers.csproj - TEST |
-| 93 | AUDIT-0031-A | TODO | Approval | Guild | src/AirGap/StellaOps.AirGap.Policy/StellaOps.AirGap.Policy.Analyzers/StellaOps.AirGap.Policy.Analyzers.csproj - APPLY |
+| 93 | AUDIT-0031-A | DONE | Applied analyzer symbol match + code-fix handler preservation | Guild | src/AirGap/StellaOps.AirGap.Policy/StellaOps.AirGap.Policy.Analyzers/StellaOps.AirGap.Policy.Analyzers.csproj - APPLY |
| 94 | AUDIT-0032-M | DONE | Report | Guild | src/AirGap/StellaOps.AirGap.Policy/StellaOps.AirGap.Policy.Analyzers.Tests/StellaOps.AirGap.Policy.Analyzers.Tests.csproj - MAINT |
| 95 | AUDIT-0032-T | DONE | Report | Guild | src/AirGap/StellaOps.AirGap.Policy/StellaOps.AirGap.Policy.Analyzers.Tests/StellaOps.AirGap.Policy.Analyzers.Tests.csproj - TEST |
| 96 | AUDIT-0032-A | DONE | Waived (test project) | Guild | src/AirGap/StellaOps.AirGap.Policy/StellaOps.AirGap.Policy.Analyzers.Tests/StellaOps.AirGap.Policy.Analyzers.Tests.csproj - APPLY |
@@ -121,22 +121,22 @@ Bulk task definitions (applies to every project row below):
| 99 | AUDIT-0033-A | DONE | Waived (test project) | Guild | src/AirGap/StellaOps.AirGap.Policy/StellaOps.AirGap.Policy.Tests/StellaOps.AirGap.Policy.Tests.csproj - APPLY |
| 100 | AUDIT-0034-M | DONE | Report | Guild | src/AirGap/StellaOps.AirGap.Time/StellaOps.AirGap.Time.csproj - MAINT |
| 101 | AUDIT-0034-T | DONE | Report | Guild | src/AirGap/StellaOps.AirGap.Time/StellaOps.AirGap.Time.csproj - TEST |
-| 102 | AUDIT-0034-A | TODO | Approval | Guild | src/AirGap/StellaOps.AirGap.Time/StellaOps.AirGap.Time.csproj - APPLY |
+| 102 | AUDIT-0034-A | DONE | Applied time-provider wiring, options reload, and trust-root/roughtime hardening | Guild | src/AirGap/StellaOps.AirGap.Time/StellaOps.AirGap.Time.csproj - APPLY |
| 103 | AUDIT-0035-M | DONE | Report | Guild | src/AirGap/__Tests/StellaOps.AirGap.Time.Tests/StellaOps.AirGap.Time.Tests.csproj - MAINT |
| 104 | AUDIT-0035-T | DONE | Report | Guild | src/AirGap/__Tests/StellaOps.AirGap.Time.Tests/StellaOps.AirGap.Time.Tests.csproj - TEST |
| 105 | AUDIT-0035-A | DONE | Waived (test project) | Guild | src/AirGap/__Tests/StellaOps.AirGap.Time.Tests/StellaOps.AirGap.Time.Tests.csproj - APPLY |
| 106 | AUDIT-0036-M | DONE | Report | Guild | src/Aoc/__Libraries/StellaOps.Aoc/StellaOps.Aoc.csproj - MAINT |
| 107 | AUDIT-0036-T | DONE | Report | Guild | src/Aoc/__Libraries/StellaOps.Aoc/StellaOps.Aoc.csproj - TEST |
-| 108 | AUDIT-0036-A | TODO | Approval | Guild | src/Aoc/__Libraries/StellaOps.Aoc/StellaOps.Aoc.csproj - APPLY |
+| 108 | AUDIT-0036-A | DONE | Applied error-code fixes and guard validation hardening | Guild | src/Aoc/__Libraries/StellaOps.Aoc/StellaOps.Aoc.csproj - APPLY |
| 109 | AUDIT-0037-M | DONE | Report | Guild | src/Aoc/__Analyzers/StellaOps.Aoc.Analyzers/StellaOps.Aoc.Analyzers.csproj - MAINT |
| 110 | AUDIT-0037-T | DONE | Report | Guild | src/Aoc/__Analyzers/StellaOps.Aoc.Analyzers/StellaOps.Aoc.Analyzers.csproj - TEST |
-| 111 | AUDIT-0037-A | TODO | Approval | Guild | src/Aoc/__Analyzers/StellaOps.Aoc.Analyzers/StellaOps.Aoc.Analyzers.csproj - APPLY |
+| 111 | AUDIT-0037-A | DONE | Applied ingestion markers, guard-scope, and DB detection fixes | Guild | src/Aoc/__Analyzers/StellaOps.Aoc.Analyzers/StellaOps.Aoc.Analyzers.csproj - APPLY |
| 112 | AUDIT-0038-M | DONE | Report | Guild | src/Aoc/__Tests/StellaOps.Aoc.Analyzers.Tests/StellaOps.Aoc.Analyzers.Tests.csproj - MAINT |
| 113 | AUDIT-0038-T | DONE | Report | Guild | src/Aoc/__Tests/StellaOps.Aoc.Analyzers.Tests/StellaOps.Aoc.Analyzers.Tests.csproj - TEST |
| 114 | AUDIT-0038-A | DONE | Waived (test project) | Guild | src/Aoc/__Tests/StellaOps.Aoc.Analyzers.Tests/StellaOps.Aoc.Analyzers.Tests.csproj - APPLY |
| 115 | AUDIT-0039-M | DONE | Report | Guild | src/Aoc/__Libraries/StellaOps.Aoc.AspNetCore/StellaOps.Aoc.AspNetCore.csproj - MAINT |
| 116 | AUDIT-0039-T | DONE | Report | Guild | src/Aoc/__Libraries/StellaOps.Aoc.AspNetCore/StellaOps.Aoc.AspNetCore.csproj - TEST |
-| 117 | AUDIT-0039-A | TODO | Approval | Guild | src/Aoc/__Libraries/StellaOps.Aoc.AspNetCore/StellaOps.Aoc.AspNetCore.csproj - APPLY |
+| 117 | AUDIT-0039-A | DONE | Applied guard filter hardening and tests | Guild | src/Aoc/__Libraries/StellaOps.Aoc.AspNetCore/StellaOps.Aoc.AspNetCore.csproj - APPLY |
| 118 | AUDIT-0040-M | DONE | Report | Guild | src/Aoc/__Tests/StellaOps.Aoc.AspNetCore.Tests/StellaOps.Aoc.AspNetCore.Tests.csproj - MAINT |
| 119 | AUDIT-0040-T | DONE | Report | Guild | src/Aoc/__Tests/StellaOps.Aoc.AspNetCore.Tests/StellaOps.Aoc.AspNetCore.Tests.csproj - TEST |
| 120 | AUDIT-0040-A | DONE | Waived (test project) | Guild | src/Aoc/__Tests/StellaOps.Aoc.AspNetCore.Tests/StellaOps.Aoc.AspNetCore.Tests.csproj - APPLY |
@@ -148,13 +148,13 @@ Bulk task definitions (applies to every project row below):
| 126 | AUDIT-0042-A | DONE | Waived (test project) | Guild | src/__Tests/architecture/StellaOps.Architecture.Tests/StellaOps.Architecture.Tests.csproj - APPLY |
| 127 | AUDIT-0043-M | DONE | Report | Guild | src/Attestor/StellaOps.Attestation/StellaOps.Attestation.csproj - MAINT |
| 128 | AUDIT-0043-T | DONE | Report | Guild | src/Attestor/StellaOps.Attestation/StellaOps.Attestation.csproj - TEST |
-| 129 | AUDIT-0043-A | TODO | Approval | Guild | src/Attestor/StellaOps.Attestation/StellaOps.Attestation.csproj - APPLY |
+| 129 | AUDIT-0043-A | DONE | Applied DSSE PAE alignment + base64 validation | Guild | src/Attestor/StellaOps.Attestation/StellaOps.Attestation.csproj - APPLY |
| 130 | AUDIT-0044-M | DONE | Report | Guild | src/Attestor/StellaOps.Attestation.Tests/StellaOps.Attestation.Tests.csproj - MAINT |
| 131 | AUDIT-0044-T | DONE | Report | Guild | src/Attestor/StellaOps.Attestation.Tests/StellaOps.Attestation.Tests.csproj - TEST |
| 132 | AUDIT-0044-A | DONE | Waived (test project) | Guild | src/Attestor/StellaOps.Attestation.Tests/StellaOps.Attestation.Tests.csproj - APPLY |
| 133 | AUDIT-0045-M | DONE | Report | Guild | src/Attestor/__Libraries/StellaOps.Attestor.Bundle/StellaOps.Attestor.Bundle.csproj - MAINT |
| 134 | AUDIT-0045-T | DONE | Report | Guild | src/Attestor/__Libraries/StellaOps.Attestor.Bundle/StellaOps.Attestor.Bundle.csproj - TEST |
-| 135 | AUDIT-0045-A | TODO | Approval | Guild | src/Attestor/__Libraries/StellaOps.Attestor.Bundle/StellaOps.Attestor.Bundle.csproj - APPLY |
+| 135 | AUDIT-0045-A | DONE | - | Guild | src/Attestor/__Libraries/StellaOps.Attestor.Bundle/StellaOps.Attestor.Bundle.csproj - APPLY |
| 136 | AUDIT-0046-M | DONE | Report | Guild | src/Attestor/__Tests/StellaOps.Attestor.Bundle.Tests/StellaOps.Attestor.Bundle.Tests.csproj - MAINT |
| 137 | AUDIT-0046-T | DONE | Report | Guild | src/Attestor/__Tests/StellaOps.Attestor.Bundle.Tests/StellaOps.Attestor.Bundle.Tests.csproj - TEST |
| 138 | AUDIT-0046-A | DONE | Waived (test project) | Guild | src/Attestor/__Tests/StellaOps.Attestor.Bundle.Tests/StellaOps.Attestor.Bundle.Tests.csproj - APPLY |
@@ -878,113 +878,113 @@ Bulk task definitions (applies to every project row below):
| 856 | AUDIT-0286-M | DONE | Report | Guild | src/__Libraries/__Tests/StellaOps.Evidence.Tests/StellaOps.Evidence.Tests.csproj - MAINT |
| 857 | AUDIT-0286-T | DONE | Report | Guild | src/__Libraries/__Tests/StellaOps.Evidence.Tests/StellaOps.Evidence.Tests.csproj - TEST |
| 858 | AUDIT-0286-A | TODO | Approval | Guild | src/__Libraries/__Tests/StellaOps.Evidence.Tests/StellaOps.Evidence.Tests.csproj - APPLY |
-| 859 | AUDIT-0287-M | TODO | Report | Guild | src/EvidenceLocker/StellaOps.EvidenceLocker/StellaOps.EvidenceLocker.csproj - MAINT |
-| 860 | AUDIT-0287-T | TODO | Report | Guild | src/EvidenceLocker/StellaOps.EvidenceLocker/StellaOps.EvidenceLocker.csproj - TEST |
+| 859 | AUDIT-0287-M | DONE | Report | Guild | src/EvidenceLocker/StellaOps.EvidenceLocker/StellaOps.EvidenceLocker.csproj - MAINT |
+| 860 | AUDIT-0287-T | DONE | Report | Guild | src/EvidenceLocker/StellaOps.EvidenceLocker/StellaOps.EvidenceLocker.csproj - TEST |
| 861 | AUDIT-0287-A | TODO | Approval | Guild | src/EvidenceLocker/StellaOps.EvidenceLocker/StellaOps.EvidenceLocker.csproj - APPLY |
-| 862 | AUDIT-0288-M | TODO | Report | Guild | src/EvidenceLocker/StellaOps.EvidenceLocker/StellaOps.EvidenceLocker.Core/StellaOps.EvidenceLocker.Core.csproj - MAINT |
-| 863 | AUDIT-0288-T | TODO | Report | Guild | src/EvidenceLocker/StellaOps.EvidenceLocker/StellaOps.EvidenceLocker.Core/StellaOps.EvidenceLocker.Core.csproj - TEST |
+| 862 | AUDIT-0288-M | DONE | Report | Guild | src/EvidenceLocker/StellaOps.EvidenceLocker/StellaOps.EvidenceLocker.Core/StellaOps.EvidenceLocker.Core.csproj - MAINT |
+| 863 | AUDIT-0288-T | DONE | Report | Guild | src/EvidenceLocker/StellaOps.EvidenceLocker/StellaOps.EvidenceLocker.Core/StellaOps.EvidenceLocker.Core.csproj - TEST |
| 864 | AUDIT-0288-A | TODO | Approval | Guild | src/EvidenceLocker/StellaOps.EvidenceLocker/StellaOps.EvidenceLocker.Core/StellaOps.EvidenceLocker.Core.csproj - APPLY |
-| 865 | AUDIT-0289-M | TODO | Report | Guild | src/EvidenceLocker/StellaOps.EvidenceLocker/StellaOps.EvidenceLocker.Infrastructure/StellaOps.EvidenceLocker.Infrastructure.csproj - MAINT |
-| 866 | AUDIT-0289-T | TODO | Report | Guild | src/EvidenceLocker/StellaOps.EvidenceLocker/StellaOps.EvidenceLocker.Infrastructure/StellaOps.EvidenceLocker.Infrastructure.csproj - TEST |
+| 865 | AUDIT-0289-M | DONE | Report | Guild | src/EvidenceLocker/StellaOps.EvidenceLocker/StellaOps.EvidenceLocker.Infrastructure/StellaOps.EvidenceLocker.Infrastructure.csproj - MAINT |
+| 866 | AUDIT-0289-T | DONE | Report | Guild | src/EvidenceLocker/StellaOps.EvidenceLocker/StellaOps.EvidenceLocker.Infrastructure/StellaOps.EvidenceLocker.Infrastructure.csproj - TEST |
| 867 | AUDIT-0289-A | TODO | Approval | Guild | src/EvidenceLocker/StellaOps.EvidenceLocker/StellaOps.EvidenceLocker.Infrastructure/StellaOps.EvidenceLocker.Infrastructure.csproj - APPLY |
-| 868 | AUDIT-0290-M | TODO | Report | Guild | src/EvidenceLocker/StellaOps.EvidenceLocker/StellaOps.EvidenceLocker.Tests/StellaOps.EvidenceLocker.Tests.csproj - MAINT |
-| 869 | AUDIT-0290-T | TODO | Report | Guild | src/EvidenceLocker/StellaOps.EvidenceLocker/StellaOps.EvidenceLocker.Tests/StellaOps.EvidenceLocker.Tests.csproj - TEST |
+| 868 | AUDIT-0290-M | DONE | Report | Guild | src/EvidenceLocker/StellaOps.EvidenceLocker/StellaOps.EvidenceLocker.Tests/StellaOps.EvidenceLocker.Tests.csproj - MAINT |
+| 869 | AUDIT-0290-T | DONE | Report | Guild | src/EvidenceLocker/StellaOps.EvidenceLocker/StellaOps.EvidenceLocker.Tests/StellaOps.EvidenceLocker.Tests.csproj - TEST |
| 870 | AUDIT-0290-A | DONE | Waived (test project) | Guild | src/EvidenceLocker/StellaOps.EvidenceLocker/StellaOps.EvidenceLocker.Tests/StellaOps.EvidenceLocker.Tests.csproj - APPLY |
-| 871 | AUDIT-0291-M | TODO | Report | Guild | src/EvidenceLocker/StellaOps.EvidenceLocker/StellaOps.EvidenceLocker.WebService/StellaOps.EvidenceLocker.WebService.csproj - MAINT |
-| 872 | AUDIT-0291-T | TODO | Report | Guild | src/EvidenceLocker/StellaOps.EvidenceLocker/StellaOps.EvidenceLocker.WebService/StellaOps.EvidenceLocker.WebService.csproj - TEST |
+| 871 | AUDIT-0291-M | DONE | Report | Guild | src/EvidenceLocker/StellaOps.EvidenceLocker/StellaOps.EvidenceLocker.WebService/StellaOps.EvidenceLocker.WebService.csproj - MAINT |
+| 872 | AUDIT-0291-T | DONE | Report | Guild | src/EvidenceLocker/StellaOps.EvidenceLocker/StellaOps.EvidenceLocker.WebService/StellaOps.EvidenceLocker.WebService.csproj - TEST |
| 873 | AUDIT-0291-A | TODO | Approval | Guild | src/EvidenceLocker/StellaOps.EvidenceLocker/StellaOps.EvidenceLocker.WebService/StellaOps.EvidenceLocker.WebService.csproj - APPLY |
-| 874 | AUDIT-0292-M | TODO | Report | Guild | src/EvidenceLocker/StellaOps.EvidenceLocker/StellaOps.EvidenceLocker.Worker/StellaOps.EvidenceLocker.Worker.csproj - MAINT |
-| 875 | AUDIT-0292-T | TODO | Report | Guild | src/EvidenceLocker/StellaOps.EvidenceLocker/StellaOps.EvidenceLocker.Worker/StellaOps.EvidenceLocker.Worker.csproj - TEST |
+| 874 | AUDIT-0292-M | DONE | Report | Guild | src/EvidenceLocker/StellaOps.EvidenceLocker/StellaOps.EvidenceLocker.Worker/StellaOps.EvidenceLocker.Worker.csproj - MAINT |
+| 875 | AUDIT-0292-T | DONE | Report | Guild | src/EvidenceLocker/StellaOps.EvidenceLocker/StellaOps.EvidenceLocker.Worker/StellaOps.EvidenceLocker.Worker.csproj - TEST |
| 876 | AUDIT-0292-A | TODO | Approval | Guild | src/EvidenceLocker/StellaOps.EvidenceLocker/StellaOps.EvidenceLocker.Worker/StellaOps.EvidenceLocker.Worker.csproj - APPLY |
-| 877 | AUDIT-0293-M | TODO | Report | Guild | src/Excititor/__Libraries/StellaOps.Excititor.ArtifactStores.S3/StellaOps.Excititor.ArtifactStores.S3.csproj - MAINT |
-| 878 | AUDIT-0293-T | TODO | Report | Guild | src/Excititor/__Libraries/StellaOps.Excititor.ArtifactStores.S3/StellaOps.Excititor.ArtifactStores.S3.csproj - TEST |
+| 877 | AUDIT-0293-M | DONE | Report | Guild | src/Excititor/__Libraries/StellaOps.Excititor.ArtifactStores.S3/StellaOps.Excititor.ArtifactStores.S3.csproj - MAINT |
+| 878 | AUDIT-0293-T | DONE | Report | Guild | src/Excititor/__Libraries/StellaOps.Excititor.ArtifactStores.S3/StellaOps.Excititor.ArtifactStores.S3.csproj - TEST |
| 879 | AUDIT-0293-A | TODO | Approval | Guild | src/Excititor/__Libraries/StellaOps.Excititor.ArtifactStores.S3/StellaOps.Excititor.ArtifactStores.S3.csproj - APPLY |
-| 880 | AUDIT-0294-M | TODO | Report | Guild | src/Excititor/__Tests/StellaOps.Excititor.ArtifactStores.S3.Tests/StellaOps.Excititor.ArtifactStores.S3.Tests.csproj - MAINT |
-| 881 | AUDIT-0294-T | TODO | Report | Guild | src/Excititor/__Tests/StellaOps.Excititor.ArtifactStores.S3.Tests/StellaOps.Excititor.ArtifactStores.S3.Tests.csproj - TEST |
+| 880 | AUDIT-0294-M | DONE | Report | Guild | src/Excititor/__Tests/StellaOps.Excititor.ArtifactStores.S3.Tests/StellaOps.Excititor.ArtifactStores.S3.Tests.csproj - MAINT |
+| 881 | AUDIT-0294-T | DONE | Report | Guild | src/Excititor/__Tests/StellaOps.Excititor.ArtifactStores.S3.Tests/StellaOps.Excititor.ArtifactStores.S3.Tests.csproj - TEST |
| 882 | AUDIT-0294-A | DONE | Waived (test project) | Guild | src/Excititor/__Tests/StellaOps.Excititor.ArtifactStores.S3.Tests/StellaOps.Excititor.ArtifactStores.S3.Tests.csproj - APPLY |
-| 883 | AUDIT-0295-M | TODO | Report | Guild | src/Excititor/__Libraries/StellaOps.Excititor.Attestation/StellaOps.Excititor.Attestation.csproj - MAINT |
-| 884 | AUDIT-0295-T | TODO | Report | Guild | src/Excititor/__Libraries/StellaOps.Excititor.Attestation/StellaOps.Excititor.Attestation.csproj - TEST |
+| 883 | AUDIT-0295-M | DONE | Report | Guild | src/Excititor/__Libraries/StellaOps.Excititor.Attestation/StellaOps.Excititor.Attestation.csproj - MAINT |
+| 884 | AUDIT-0295-T | DONE | Report | Guild | src/Excititor/__Libraries/StellaOps.Excititor.Attestation/StellaOps.Excititor.Attestation.csproj - TEST |
| 885 | AUDIT-0295-A | TODO | Approval | Guild | src/Excititor/__Libraries/StellaOps.Excititor.Attestation/StellaOps.Excititor.Attestation.csproj - APPLY |
-| 886 | AUDIT-0296-M | TODO | Report | Guild | src/Excititor/__Tests/StellaOps.Excititor.Attestation.Tests/StellaOps.Excititor.Attestation.Tests.csproj - MAINT |
-| 887 | AUDIT-0296-T | TODO | Report | Guild | src/Excititor/__Tests/StellaOps.Excititor.Attestation.Tests/StellaOps.Excititor.Attestation.Tests.csproj - TEST |
+| 886 | AUDIT-0296-M | DONE | Report | Guild | src/Excititor/__Tests/StellaOps.Excititor.Attestation.Tests/StellaOps.Excititor.Attestation.Tests.csproj - MAINT |
+| 887 | AUDIT-0296-T | DONE | Report | Guild | src/Excititor/__Tests/StellaOps.Excititor.Attestation.Tests/StellaOps.Excititor.Attestation.Tests.csproj - TEST |
| 888 | AUDIT-0296-A | DONE | Waived (test project) | Guild | src/Excititor/__Tests/StellaOps.Excititor.Attestation.Tests/StellaOps.Excititor.Attestation.Tests.csproj - APPLY |
-| 889 | AUDIT-0297-M | TODO | Report | Guild | src/Excititor/__Libraries/StellaOps.Excititor.Connectors.Abstractions/StellaOps.Excititor.Connectors.Abstractions.csproj - MAINT |
-| 890 | AUDIT-0297-T | TODO | Report | Guild | src/Excititor/__Libraries/StellaOps.Excititor.Connectors.Abstractions/StellaOps.Excititor.Connectors.Abstractions.csproj - TEST |
+| 889 | AUDIT-0297-M | DONE | Report | Guild | src/Excititor/__Libraries/StellaOps.Excititor.Connectors.Abstractions/StellaOps.Excititor.Connectors.Abstractions.csproj - MAINT |
+| 890 | AUDIT-0297-T | DONE | Report | Guild | src/Excititor/__Libraries/StellaOps.Excititor.Connectors.Abstractions/StellaOps.Excititor.Connectors.Abstractions.csproj - TEST |
| 891 | AUDIT-0297-A | TODO | Approval | Guild | src/Excititor/__Libraries/StellaOps.Excititor.Connectors.Abstractions/StellaOps.Excititor.Connectors.Abstractions.csproj - APPLY |
-| 892 | AUDIT-0298-M | TODO | Report | Guild | src/Excititor/__Libraries/StellaOps.Excititor.Connectors.Cisco.CSAF/StellaOps.Excititor.Connectors.Cisco.CSAF.csproj - MAINT |
-| 893 | AUDIT-0298-T | TODO | Report | Guild | src/Excititor/__Libraries/StellaOps.Excititor.Connectors.Cisco.CSAF/StellaOps.Excititor.Connectors.Cisco.CSAF.csproj - TEST |
+| 892 | AUDIT-0298-M | DONE | Report | Guild | src/Excititor/__Libraries/StellaOps.Excititor.Connectors.Cisco.CSAF/StellaOps.Excititor.Connectors.Cisco.CSAF.csproj - MAINT |
+| 893 | AUDIT-0298-T | DONE | Report | Guild | src/Excititor/__Libraries/StellaOps.Excititor.Connectors.Cisco.CSAF/StellaOps.Excititor.Connectors.Cisco.CSAF.csproj - TEST |
| 894 | AUDIT-0298-A | TODO | Approval | Guild | src/Excititor/__Libraries/StellaOps.Excititor.Connectors.Cisco.CSAF/StellaOps.Excititor.Connectors.Cisco.CSAF.csproj - APPLY |
-| 895 | AUDIT-0299-M | TODO | Report | Guild | src/Excititor/__Tests/StellaOps.Excititor.Connectors.Cisco.CSAF.Tests/StellaOps.Excititor.Connectors.Cisco.CSAF.Tests.csproj - MAINT |
-| 896 | AUDIT-0299-T | TODO | Report | Guild | src/Excititor/__Tests/StellaOps.Excititor.Connectors.Cisco.CSAF.Tests/StellaOps.Excititor.Connectors.Cisco.CSAF.Tests.csproj - TEST |
+| 895 | AUDIT-0299-M | DONE | Report | Guild | src/Excititor/__Tests/StellaOps.Excititor.Connectors.Cisco.CSAF.Tests/StellaOps.Excititor.Connectors.Cisco.CSAF.Tests.csproj - MAINT |
+| 896 | AUDIT-0299-T | DONE | Report | Guild | src/Excititor/__Tests/StellaOps.Excititor.Connectors.Cisco.CSAF.Tests/StellaOps.Excititor.Connectors.Cisco.CSAF.Tests.csproj - TEST |
| 897 | AUDIT-0299-A | DONE | Waived (test project) | Guild | src/Excititor/__Tests/StellaOps.Excititor.Connectors.Cisco.CSAF.Tests/StellaOps.Excititor.Connectors.Cisco.CSAF.Tests.csproj - APPLY |
-| 898 | AUDIT-0300-M | TODO | Report | Guild | src/Excititor/__Libraries/StellaOps.Excititor.Connectors.MSRC.CSAF/StellaOps.Excititor.Connectors.MSRC.CSAF.csproj - MAINT |
-| 899 | AUDIT-0300-T | TODO | Report | Guild | src/Excititor/__Libraries/StellaOps.Excititor.Connectors.MSRC.CSAF/StellaOps.Excititor.Connectors.MSRC.CSAF.csproj - TEST |
+| 898 | AUDIT-0300-M | DONE | Report | Guild | src/Excititor/__Libraries/StellaOps.Excititor.Connectors.MSRC.CSAF/StellaOps.Excititor.Connectors.MSRC.CSAF.csproj - MAINT |
+| 899 | AUDIT-0300-T | DONE | Report | Guild | src/Excititor/__Libraries/StellaOps.Excititor.Connectors.MSRC.CSAF/StellaOps.Excititor.Connectors.MSRC.CSAF.csproj - TEST |
| 900 | AUDIT-0300-A | TODO | Approval | Guild | src/Excititor/__Libraries/StellaOps.Excititor.Connectors.MSRC.CSAF/StellaOps.Excititor.Connectors.MSRC.CSAF.csproj - APPLY |
-| 901 | AUDIT-0301-M | TODO | Report | Guild | src/Excititor/__Tests/StellaOps.Excititor.Connectors.MSRC.CSAF.Tests/StellaOps.Excititor.Connectors.MSRC.CSAF.Tests.csproj - MAINT |
-| 902 | AUDIT-0301-T | TODO | Report | Guild | src/Excititor/__Tests/StellaOps.Excititor.Connectors.MSRC.CSAF.Tests/StellaOps.Excititor.Connectors.MSRC.CSAF.Tests.csproj - TEST |
+| 901 | AUDIT-0301-M | DONE | Report | Guild | src/Excititor/__Tests/StellaOps.Excititor.Connectors.MSRC.CSAF.Tests/StellaOps.Excititor.Connectors.MSRC.CSAF.Tests.csproj - MAINT |
+| 902 | AUDIT-0301-T | DONE | Report | Guild | src/Excititor/__Tests/StellaOps.Excititor.Connectors.MSRC.CSAF.Tests/StellaOps.Excititor.Connectors.MSRC.CSAF.Tests.csproj - TEST |
| 903 | AUDIT-0301-A | DONE | Waived (test project) | Guild | src/Excititor/__Tests/StellaOps.Excititor.Connectors.MSRC.CSAF.Tests/StellaOps.Excititor.Connectors.MSRC.CSAF.Tests.csproj - APPLY |
-| 904 | AUDIT-0302-M | TODO | Report | Guild | src/Excititor/__Libraries/StellaOps.Excititor.Connectors.OCI.OpenVEX.Attest/StellaOps.Excititor.Connectors.OCI.OpenVEX.Attest.csproj - MAINT |
-| 905 | AUDIT-0302-T | TODO | Report | Guild | src/Excititor/__Libraries/StellaOps.Excititor.Connectors.OCI.OpenVEX.Attest/StellaOps.Excititor.Connectors.OCI.OpenVEX.Attest.csproj - TEST |
+| 904 | AUDIT-0302-M | DONE | Report | Guild | src/Excititor/__Libraries/StellaOps.Excititor.Connectors.OCI.OpenVEX.Attest/StellaOps.Excititor.Connectors.OCI.OpenVEX.Attest.csproj - MAINT |
+| 905 | AUDIT-0302-T | DONE | Report | Guild | src/Excititor/__Libraries/StellaOps.Excititor.Connectors.OCI.OpenVEX.Attest/StellaOps.Excititor.Connectors.OCI.OpenVEX.Attest.csproj - TEST |
| 906 | AUDIT-0302-A | TODO | Approval | Guild | src/Excititor/__Libraries/StellaOps.Excititor.Connectors.OCI.OpenVEX.Attest/StellaOps.Excititor.Connectors.OCI.OpenVEX.Attest.csproj - APPLY |
-| 907 | AUDIT-0303-M | TODO | Report | Guild | src/Excititor/__Tests/StellaOps.Excititor.Connectors.OCI.OpenVEX.Attest.Tests/StellaOps.Excititor.Connectors.OCI.OpenVEX.Attest.Tests.csproj - MAINT |
-| 908 | AUDIT-0303-T | TODO | Report | Guild | src/Excititor/__Tests/StellaOps.Excititor.Connectors.OCI.OpenVEX.Attest.Tests/StellaOps.Excititor.Connectors.OCI.OpenVEX.Attest.Tests.csproj - TEST |
+| 907 | AUDIT-0303-M | DONE | Report | Guild | src/Excititor/__Tests/StellaOps.Excititor.Connectors.OCI.OpenVEX.Attest.Tests/StellaOps.Excititor.Connectors.OCI.OpenVEX.Attest.Tests.csproj - MAINT |
+| 908 | AUDIT-0303-T | DONE | Report | Guild | src/Excititor/__Tests/StellaOps.Excititor.Connectors.OCI.OpenVEX.Attest.Tests/StellaOps.Excititor.Connectors.OCI.OpenVEX.Attest.Tests.csproj - TEST |
| 909 | AUDIT-0303-A | DONE | Waived (test project) | Guild | src/Excititor/__Tests/StellaOps.Excititor.Connectors.OCI.OpenVEX.Attest.Tests/StellaOps.Excititor.Connectors.OCI.OpenVEX.Attest.Tests.csproj - APPLY |
-| 910 | AUDIT-0304-M | TODO | Report | Guild | src/Excititor/__Libraries/StellaOps.Excititor.Connectors.Oracle.CSAF/StellaOps.Excititor.Connectors.Oracle.CSAF.csproj - MAINT |
-| 911 | AUDIT-0304-T | TODO | Report | Guild | src/Excititor/__Libraries/StellaOps.Excititor.Connectors.Oracle.CSAF/StellaOps.Excititor.Connectors.Oracle.CSAF.csproj - TEST |
+| 910 | AUDIT-0304-M | DONE | Report | Guild | src/Excititor/__Libraries/StellaOps.Excititor.Connectors.Oracle.CSAF/StellaOps.Excititor.Connectors.Oracle.CSAF.csproj - MAINT |
+| 911 | AUDIT-0304-T | DONE | Report | Guild | src/Excititor/__Libraries/StellaOps.Excititor.Connectors.Oracle.CSAF/StellaOps.Excititor.Connectors.Oracle.CSAF.csproj - TEST |
| 912 | AUDIT-0304-A | TODO | Approval | Guild | src/Excititor/__Libraries/StellaOps.Excititor.Connectors.Oracle.CSAF/StellaOps.Excititor.Connectors.Oracle.CSAF.csproj - APPLY |
-| 913 | AUDIT-0305-M | TODO | Report | Guild | src/Excititor/__Tests/StellaOps.Excititor.Connectors.Oracle.CSAF.Tests/StellaOps.Excititor.Connectors.Oracle.CSAF.Tests.csproj - MAINT |
-| 914 | AUDIT-0305-T | TODO | Report | Guild | src/Excititor/__Tests/StellaOps.Excititor.Connectors.Oracle.CSAF.Tests/StellaOps.Excititor.Connectors.Oracle.CSAF.Tests.csproj - TEST |
+| 913 | AUDIT-0305-M | DONE | Report | Guild | src/Excititor/__Tests/StellaOps.Excititor.Connectors.Oracle.CSAF.Tests/StellaOps.Excititor.Connectors.Oracle.CSAF.Tests.csproj - MAINT |
+| 914 | AUDIT-0305-T | DONE | Report | Guild | src/Excititor/__Tests/StellaOps.Excititor.Connectors.Oracle.CSAF.Tests/StellaOps.Excititor.Connectors.Oracle.CSAF.Tests.csproj - TEST |
| 915 | AUDIT-0305-A | DONE | Waived (test project) | Guild | src/Excititor/__Tests/StellaOps.Excititor.Connectors.Oracle.CSAF.Tests/StellaOps.Excititor.Connectors.Oracle.CSAF.Tests.csproj - APPLY |
-| 916 | AUDIT-0306-M | TODO | Report | Guild | src/Excititor/__Libraries/StellaOps.Excititor.Connectors.RedHat.CSAF/StellaOps.Excititor.Connectors.RedHat.CSAF.csproj - MAINT |
-| 917 | AUDIT-0306-T | TODO | Report | Guild | src/Excititor/__Libraries/StellaOps.Excititor.Connectors.RedHat.CSAF/StellaOps.Excititor.Connectors.RedHat.CSAF.csproj - TEST |
+| 916 | AUDIT-0306-M | DONE | Report | Guild | src/Excititor/__Libraries/StellaOps.Excititor.Connectors.RedHat.CSAF/StellaOps.Excititor.Connectors.RedHat.CSAF.csproj - MAINT |
+| 917 | AUDIT-0306-T | DONE | Report | Guild | src/Excititor/__Libraries/StellaOps.Excititor.Connectors.RedHat.CSAF/StellaOps.Excititor.Connectors.RedHat.CSAF.csproj - TEST |
| 918 | AUDIT-0306-A | TODO | Approval | Guild | src/Excititor/__Libraries/StellaOps.Excititor.Connectors.RedHat.CSAF/StellaOps.Excititor.Connectors.RedHat.CSAF.csproj - APPLY |
-| 919 | AUDIT-0307-M | TODO | Report | Guild | src/Excititor/__Tests/StellaOps.Excititor.Connectors.RedHat.CSAF.Tests/StellaOps.Excititor.Connectors.RedHat.CSAF.Tests.csproj - MAINT |
-| 920 | AUDIT-0307-T | TODO | Report | Guild | src/Excititor/__Tests/StellaOps.Excititor.Connectors.RedHat.CSAF.Tests/StellaOps.Excititor.Connectors.RedHat.CSAF.Tests.csproj - TEST |
+| 919 | AUDIT-0307-M | DONE | Report | Guild | src/Excititor/__Tests/StellaOps.Excititor.Connectors.RedHat.CSAF.Tests/StellaOps.Excititor.Connectors.RedHat.CSAF.Tests.csproj - MAINT |
+| 920 | AUDIT-0307-T | DONE | Report | Guild | src/Excititor/__Tests/StellaOps.Excititor.Connectors.RedHat.CSAF.Tests/StellaOps.Excititor.Connectors.RedHat.CSAF.Tests.csproj - TEST |
| 921 | AUDIT-0307-A | DONE | Waived (test project) | Guild | src/Excititor/__Tests/StellaOps.Excititor.Connectors.RedHat.CSAF.Tests/StellaOps.Excititor.Connectors.RedHat.CSAF.Tests.csproj - APPLY |
-| 922 | AUDIT-0308-M | TODO | Report | Guild | src/Excititor/__Libraries/StellaOps.Excititor.Connectors.SUSE.RancherVEXHub/StellaOps.Excititor.Connectors.SUSE.RancherVEXHub.csproj - MAINT |
-| 923 | AUDIT-0308-T | TODO | Report | Guild | src/Excititor/__Libraries/StellaOps.Excititor.Connectors.SUSE.RancherVEXHub/StellaOps.Excititor.Connectors.SUSE.RancherVEXHub.csproj - TEST |
+| 922 | AUDIT-0308-M | DONE | Report | Guild | src/Excititor/__Libraries/StellaOps.Excititor.Connectors.SUSE.RancherVEXHub/StellaOps.Excititor.Connectors.SUSE.RancherVEXHub.csproj - MAINT |
+| 923 | AUDIT-0308-T | DONE | Report | Guild | src/Excititor/__Libraries/StellaOps.Excititor.Connectors.SUSE.RancherVEXHub/StellaOps.Excititor.Connectors.SUSE.RancherVEXHub.csproj - TEST |
| 924 | AUDIT-0308-A | TODO | Approval | Guild | src/Excititor/__Libraries/StellaOps.Excititor.Connectors.SUSE.RancherVEXHub/StellaOps.Excititor.Connectors.SUSE.RancherVEXHub.csproj - APPLY |
-| 925 | AUDIT-0309-M | TODO | Report | Guild | src/Excititor/__Tests/StellaOps.Excititor.Connectors.SUSE.RancherVEXHub.Tests/StellaOps.Excititor.Connectors.SUSE.RancherVEXHub.Tests.csproj - MAINT |
-| 926 | AUDIT-0309-T | TODO | Report | Guild | src/Excititor/__Tests/StellaOps.Excititor.Connectors.SUSE.RancherVEXHub.Tests/StellaOps.Excititor.Connectors.SUSE.RancherVEXHub.Tests.csproj - TEST |
+| 925 | AUDIT-0309-M | DONE | Report | Guild | src/Excititor/__Tests/StellaOps.Excititor.Connectors.SUSE.RancherVEXHub.Tests/StellaOps.Excititor.Connectors.SUSE.RancherVEXHub.Tests.csproj - MAINT |
+| 926 | AUDIT-0309-T | DONE | Report | Guild | src/Excititor/__Tests/StellaOps.Excititor.Connectors.SUSE.RancherVEXHub.Tests/StellaOps.Excititor.Connectors.SUSE.RancherVEXHub.Tests.csproj - TEST |
| 927 | AUDIT-0309-A | DONE | Waived (test project) | Guild | src/Excititor/__Tests/StellaOps.Excititor.Connectors.SUSE.RancherVEXHub.Tests/StellaOps.Excititor.Connectors.SUSE.RancherVEXHub.Tests.csproj - APPLY |
-| 928 | AUDIT-0310-M | TODO | Report | Guild | src/Excititor/__Libraries/StellaOps.Excititor.Connectors.Ubuntu.CSAF/StellaOps.Excititor.Connectors.Ubuntu.CSAF.csproj - MAINT |
-| 929 | AUDIT-0310-T | TODO | Report | Guild | src/Excititor/__Libraries/StellaOps.Excititor.Connectors.Ubuntu.CSAF/StellaOps.Excititor.Connectors.Ubuntu.CSAF.csproj - TEST |
+| 928 | AUDIT-0310-M | DONE | Report | Guild | src/Excititor/__Libraries/StellaOps.Excititor.Connectors.Ubuntu.CSAF/StellaOps.Excititor.Connectors.Ubuntu.CSAF.csproj - MAINT |
+| 929 | AUDIT-0310-T | DONE | Report | Guild | src/Excititor/__Libraries/StellaOps.Excititor.Connectors.Ubuntu.CSAF/StellaOps.Excititor.Connectors.Ubuntu.CSAF.csproj - TEST |
| 930 | AUDIT-0310-A | TODO | Approval | Guild | src/Excititor/__Libraries/StellaOps.Excititor.Connectors.Ubuntu.CSAF/StellaOps.Excititor.Connectors.Ubuntu.CSAF.csproj - APPLY |
-| 931 | AUDIT-0311-M | TODO | Report | Guild | src/Excititor/__Tests/StellaOps.Excititor.Connectors.Ubuntu.CSAF.Tests/StellaOps.Excititor.Connectors.Ubuntu.CSAF.Tests.csproj - MAINT |
-| 932 | AUDIT-0311-T | TODO | Report | Guild | src/Excititor/__Tests/StellaOps.Excititor.Connectors.Ubuntu.CSAF.Tests/StellaOps.Excititor.Connectors.Ubuntu.CSAF.Tests.csproj - TEST |
+| 931 | AUDIT-0311-M | DONE | Report | Guild | src/Excititor/__Tests/StellaOps.Excititor.Connectors.Ubuntu.CSAF.Tests/StellaOps.Excititor.Connectors.Ubuntu.CSAF.Tests.csproj - MAINT |
+| 932 | AUDIT-0311-T | DONE | Report | Guild | src/Excititor/__Tests/StellaOps.Excititor.Connectors.Ubuntu.CSAF.Tests/StellaOps.Excititor.Connectors.Ubuntu.CSAF.Tests.csproj - TEST |
| 933 | AUDIT-0311-A | DONE | Waived (test project) | Guild | src/Excititor/__Tests/StellaOps.Excititor.Connectors.Ubuntu.CSAF.Tests/StellaOps.Excititor.Connectors.Ubuntu.CSAF.Tests.csproj - APPLY |
-| 934 | AUDIT-0312-M | TODO | Report | Guild | src/Excititor/__Libraries/StellaOps.Excititor.Core/StellaOps.Excititor.Core.csproj - MAINT |
-| 935 | AUDIT-0312-T | TODO | Report | Guild | src/Excititor/__Libraries/StellaOps.Excititor.Core/StellaOps.Excititor.Core.csproj - TEST |
+| 934 | AUDIT-0312-M | DONE | Report | Guild | src/Excititor/__Libraries/StellaOps.Excititor.Core/StellaOps.Excititor.Core.csproj - MAINT |
+| 935 | AUDIT-0312-T | DONE | Report | Guild | src/Excititor/__Libraries/StellaOps.Excititor.Core/StellaOps.Excititor.Core.csproj - TEST |
| 936 | AUDIT-0312-A | TODO | Approval | Guild | src/Excititor/__Libraries/StellaOps.Excititor.Core/StellaOps.Excititor.Core.csproj - APPLY |
-| 937 | AUDIT-0313-M | TODO | Report | Guild | src/Excititor/__Tests/StellaOps.Excititor.Core.Tests/StellaOps.Excititor.Core.Tests.csproj - MAINT |
-| 938 | AUDIT-0313-T | TODO | Report | Guild | src/Excititor/__Tests/StellaOps.Excititor.Core.Tests/StellaOps.Excititor.Core.Tests.csproj - TEST |
+| 937 | AUDIT-0313-M | DONE | Report | Guild | src/Excititor/__Tests/StellaOps.Excititor.Core.Tests/StellaOps.Excititor.Core.Tests.csproj - MAINT |
+| 938 | AUDIT-0313-T | DONE | Report | Guild | src/Excititor/__Tests/StellaOps.Excititor.Core.Tests/StellaOps.Excititor.Core.Tests.csproj - TEST |
| 939 | AUDIT-0313-A | DONE | Waived (test project) | Guild | src/Excititor/__Tests/StellaOps.Excititor.Core.Tests/StellaOps.Excititor.Core.Tests.csproj - APPLY |
-| 940 | AUDIT-0314-M | TODO | Report | Guild | src/Excititor/__Tests/StellaOps.Excititor.Core.UnitTests/StellaOps.Excititor.Core.UnitTests.csproj - MAINT |
-| 941 | AUDIT-0314-T | TODO | Report | Guild | src/Excititor/__Tests/StellaOps.Excititor.Core.UnitTests/StellaOps.Excititor.Core.UnitTests.csproj - TEST |
+| 940 | AUDIT-0314-M | DONE | Report | Guild | src/Excititor/__Tests/StellaOps.Excititor.Core.UnitTests/StellaOps.Excititor.Core.UnitTests.csproj - MAINT |
+| 941 | AUDIT-0314-T | DONE | Report | Guild | src/Excititor/__Tests/StellaOps.Excititor.Core.UnitTests/StellaOps.Excititor.Core.UnitTests.csproj - TEST |
| 942 | AUDIT-0314-A | DONE | Waived (test project) | Guild | src/Excititor/__Tests/StellaOps.Excititor.Core.UnitTests/StellaOps.Excititor.Core.UnitTests.csproj - APPLY |
-| 943 | AUDIT-0315-M | TODO | Report | Guild | src/Excititor/__Libraries/StellaOps.Excititor.Export/StellaOps.Excititor.Export.csproj - MAINT |
-| 944 | AUDIT-0315-T | TODO | Report | Guild | src/Excititor/__Libraries/StellaOps.Excititor.Export/StellaOps.Excititor.Export.csproj - TEST |
+| 943 | AUDIT-0315-M | DONE | Report | Guild | src/Excititor/__Libraries/StellaOps.Excititor.Export/StellaOps.Excititor.Export.csproj - MAINT |
+| 944 | AUDIT-0315-T | DONE | Report | Guild | src/Excititor/__Libraries/StellaOps.Excititor.Export/StellaOps.Excititor.Export.csproj - TEST |
| 945 | AUDIT-0315-A | TODO | Approval | Guild | src/Excititor/__Libraries/StellaOps.Excititor.Export/StellaOps.Excititor.Export.csproj - APPLY |
-| 946 | AUDIT-0316-M | TODO | Report | Guild | src/Excititor/__Tests/StellaOps.Excititor.Export.Tests/StellaOps.Excititor.Export.Tests.csproj - MAINT |
-| 947 | AUDIT-0316-T | TODO | Report | Guild | src/Excititor/__Tests/StellaOps.Excititor.Export.Tests/StellaOps.Excititor.Export.Tests.csproj - TEST |
+| 946 | AUDIT-0316-M | DONE | Report | Guild | src/Excititor/__Tests/StellaOps.Excititor.Export.Tests/StellaOps.Excititor.Export.Tests.csproj - MAINT |
+| 947 | AUDIT-0316-T | DONE | Report | Guild | src/Excititor/__Tests/StellaOps.Excititor.Export.Tests/StellaOps.Excititor.Export.Tests.csproj - TEST |
| 948 | AUDIT-0316-A | DONE | Waived (test project) | Guild | src/Excititor/__Tests/StellaOps.Excititor.Export.Tests/StellaOps.Excititor.Export.Tests.csproj - APPLY |
-| 949 | AUDIT-0317-M | TODO | Report | Guild | src/Excititor/__Libraries/StellaOps.Excititor.Formats.CSAF/StellaOps.Excititor.Formats.CSAF.csproj - MAINT |
-| 950 | AUDIT-0317-T | TODO | Report | Guild | src/Excititor/__Libraries/StellaOps.Excititor.Formats.CSAF/StellaOps.Excititor.Formats.CSAF.csproj - TEST |
+| 949 | AUDIT-0317-M | DONE | Report | Guild | src/Excititor/__Libraries/StellaOps.Excititor.Formats.CSAF/StellaOps.Excititor.Formats.CSAF.csproj - MAINT |
+| 950 | AUDIT-0317-T | DONE | Report | Guild | src/Excititor/__Libraries/StellaOps.Excititor.Formats.CSAF/StellaOps.Excititor.Formats.CSAF.csproj - TEST |
| 951 | AUDIT-0317-A | TODO | Approval | Guild | src/Excititor/__Libraries/StellaOps.Excititor.Formats.CSAF/StellaOps.Excititor.Formats.CSAF.csproj - APPLY |
-| 952 | AUDIT-0318-M | TODO | Report | Guild | src/Excititor/__Tests/StellaOps.Excititor.Formats.CSAF.Tests/StellaOps.Excititor.Formats.CSAF.Tests.csproj - MAINT |
-| 953 | AUDIT-0318-T | TODO | Report | Guild | src/Excititor/__Tests/StellaOps.Excititor.Formats.CSAF.Tests/StellaOps.Excititor.Formats.CSAF.Tests.csproj - TEST |
+| 952 | AUDIT-0318-M | DONE | Report | Guild | src/Excititor/__Tests/StellaOps.Excititor.Formats.CSAF.Tests/StellaOps.Excititor.Formats.CSAF.Tests.csproj - MAINT |
+| 953 | AUDIT-0318-T | DONE | Report | Guild | src/Excititor/__Tests/StellaOps.Excititor.Formats.CSAF.Tests/StellaOps.Excititor.Formats.CSAF.Tests.csproj - TEST |
| 954 | AUDIT-0318-A | DONE | Waived (test project) | Guild | src/Excititor/__Tests/StellaOps.Excititor.Formats.CSAF.Tests/StellaOps.Excititor.Formats.CSAF.Tests.csproj - APPLY |
-| 955 | AUDIT-0319-M | TODO | Report | Guild | src/Excititor/__Libraries/StellaOps.Excititor.Formats.CycloneDX/StellaOps.Excititor.Formats.CycloneDX.csproj - MAINT |
-| 956 | AUDIT-0319-T | TODO | Report | Guild | src/Excititor/__Libraries/StellaOps.Excititor.Formats.CycloneDX/StellaOps.Excititor.Formats.CycloneDX.csproj - TEST |
+| 955 | AUDIT-0319-M | DONE | Report | Guild | src/Excititor/__Libraries/StellaOps.Excititor.Formats.CycloneDX/StellaOps.Excititor.Formats.CycloneDX.csproj - MAINT |
+| 956 | AUDIT-0319-T | DONE | Report | Guild | src/Excititor/__Libraries/StellaOps.Excititor.Formats.CycloneDX/StellaOps.Excititor.Formats.CycloneDX.csproj - TEST |
| 957 | AUDIT-0319-A | TODO | Approval | Guild | src/Excititor/__Libraries/StellaOps.Excititor.Formats.CycloneDX/StellaOps.Excititor.Formats.CycloneDX.csproj - APPLY |
-| 958 | AUDIT-0320-M | TODO | Report | Guild | src/Excititor/__Tests/StellaOps.Excititor.Formats.CycloneDX.Tests/StellaOps.Excititor.Formats.CycloneDX.Tests.csproj - MAINT |
-| 959 | AUDIT-0320-T | TODO | Report | Guild | src/Excititor/__Tests/StellaOps.Excititor.Formats.CycloneDX.Tests/StellaOps.Excititor.Formats.CycloneDX.Tests.csproj - TEST |
+| 958 | AUDIT-0320-M | DONE | Report | Guild | src/Excititor/__Tests/StellaOps.Excititor.Formats.CycloneDX.Tests/StellaOps.Excititor.Formats.CycloneDX.Tests.csproj - MAINT |
+| 959 | AUDIT-0320-T | DONE | Report | Guild | src/Excititor/__Tests/StellaOps.Excititor.Formats.CycloneDX.Tests/StellaOps.Excititor.Formats.CycloneDX.Tests.csproj - TEST |
| 960 | AUDIT-0320-A | DONE | Waived (test project) | Guild | src/Excititor/__Tests/StellaOps.Excititor.Formats.CycloneDX.Tests/StellaOps.Excititor.Formats.CycloneDX.Tests.csproj - APPLY |
-| 961 | AUDIT-0321-M | TODO | Report | Guild | src/Excititor/__Libraries/StellaOps.Excititor.Formats.OpenVEX/StellaOps.Excititor.Formats.OpenVEX.csproj - MAINT |
-| 962 | AUDIT-0321-T | TODO | Report | Guild | src/Excititor/__Libraries/StellaOps.Excititor.Formats.OpenVEX/StellaOps.Excititor.Formats.OpenVEX.csproj - TEST |
+| 961 | AUDIT-0321-M | DONE | Report | Guild | src/Excititor/__Libraries/StellaOps.Excititor.Formats.OpenVEX/StellaOps.Excititor.Formats.OpenVEX.csproj - MAINT |
+| 962 | AUDIT-0321-T | DONE | Report | Guild | src/Excititor/__Libraries/StellaOps.Excititor.Formats.OpenVEX/StellaOps.Excititor.Formats.OpenVEX.csproj - TEST |
| 963 | AUDIT-0321-A | TODO | Approval | Guild | src/Excititor/__Libraries/StellaOps.Excititor.Formats.OpenVEX/StellaOps.Excititor.Formats.OpenVEX.csproj - APPLY |
-| 964 | AUDIT-0322-M | TODO | Report | Guild | src/Excititor/__Tests/StellaOps.Excititor.Formats.OpenVEX.Tests/StellaOps.Excititor.Formats.OpenVEX.Tests.csproj - MAINT |
-| 965 | AUDIT-0322-T | TODO | Report | Guild | src/Excititor/__Tests/StellaOps.Excititor.Formats.OpenVEX.Tests/StellaOps.Excititor.Formats.OpenVEX.Tests.csproj - TEST |
+| 964 | AUDIT-0322-M | DONE | Report | Guild | src/Excititor/__Tests/StellaOps.Excititor.Formats.OpenVEX.Tests/StellaOps.Excititor.Formats.OpenVEX.Tests.csproj - MAINT |
+| 965 | AUDIT-0322-T | DONE | Report | Guild | src/Excititor/__Tests/StellaOps.Excititor.Formats.OpenVEX.Tests/StellaOps.Excititor.Formats.OpenVEX.Tests.csproj - TEST |
| 966 | AUDIT-0322-A | DONE | Waived (test project) | Guild | src/Excititor/__Tests/StellaOps.Excititor.Formats.OpenVEX.Tests/StellaOps.Excititor.Formats.OpenVEX.Tests.csproj - APPLY |
| 967 | AUDIT-0323-M | TODO | Report | Guild | src/Excititor/__Libraries/StellaOps.Excititor.Persistence/StellaOps.Excititor.Persistence.csproj - MAINT |
| 968 | AUDIT-0323-T | TODO | Report | Guild | src/Excititor/__Libraries/StellaOps.Excititor.Persistence/StellaOps.Excititor.Persistence.csproj - TEST |
@@ -2160,6 +2160,83 @@ Bulk task definitions (applies to every project row below):
## Execution Log
| Date (UTC) | Update | Owner |
| --- | --- | --- |
+| 2026-01-02 | Completed AUDIT-0034-A (AirGap.Time apply fixes) and updated tests. | Codex |
+| 2026-01-02 | Completed AUDIT-0036-A (AOC guard library apply fixes) and updated tests. | Codex |
+| 2026-01-02 | Completed AUDIT-0037-A (AOC analyzer apply fixes) and updated tests. | Codex |
+| 2026-01-02 | Completed AUDIT-0039-A (AOC ASP.NET Core apply fixes) and updated tests. | Codex |
+| 2026-01-02 | Completed AUDIT-0043-A (Attestation apply fixes) and updated tests. | Codex |
+| 2026-01-02 | Created TASKS.md for Excititor Core library. | Planning |
+| 2026-01-02 | Created AGENTS.md and TASKS.md for Excititor Core tests project. | Planning |
+| 2026-01-02 | Completed MAINT/TEST audits for AUDIT-0312; report updated in docs/implplan/SPRINT_20251229_049_BE_csproj_audit_report.md. | Planning |
+| 2026-01-02 | Completed MAINT/TEST audits for AUDIT-0313; report updated in docs/implplan/SPRINT_20251229_049_BE_csproj_audit_report.md. | Planning |
+| 2026-01-02 | Created AGENTS.md and TASKS.md for Excititor Core unit tests project. | Planning |
+| 2026-01-02 | Completed MAINT/TEST audits for AUDIT-0314; report updated in docs/implplan/SPRINT_20251229_049_BE_csproj_audit_report.md. | Planning |
+| 2026-01-02 | Created TASKS.md for Excititor Export library. | Planning |
+| 2026-01-02 | Completed MAINT/TEST audits for AUDIT-0315; report updated in docs/implplan/SPRINT_20251229_049_BE_csproj_audit_report.md. | Planning |
+| 2026-01-02 | Created AGENTS.md and TASKS.md for Excititor Export tests project. | Planning |
+| 2026-01-02 | Completed MAINT/TEST audits for AUDIT-0316; report updated in docs/implplan/SPRINT_20251229_049_BE_csproj_audit_report.md. | Planning |
+| 2026-01-02 | Created TASKS.md for Excititor Formats CSAF library. | Planning |
+| 2026-01-02 | Completed MAINT/TEST audits for AUDIT-0317; report updated in docs/implplan/SPRINT_20251229_049_BE_csproj_audit_report.md. | Planning |
+| 2026-01-02 | Created AGENTS.md and TASKS.md for Excititor Formats CSAF tests project. | Planning |
+| 2026-01-02 | Completed MAINT/TEST audits for AUDIT-0318; report updated in docs/implplan/SPRINT_20251229_049_BE_csproj_audit_report.md. | Planning |
+| 2026-01-02 | Created TASKS.md for Excititor Formats CycloneDX library. | Planning |
+| 2026-01-02 | Completed MAINT/TEST audits for AUDIT-0319; report updated in docs/implplan/SPRINT_20251229_049_BE_csproj_audit_report.md. | Planning |
+| 2026-01-02 | Created AGENTS.md and TASKS.md for Excititor Formats CycloneDX tests project. | Planning |
+| 2026-01-02 | Completed MAINT/TEST audits for AUDIT-0320; report updated in docs/implplan/SPRINT_20251229_049_BE_csproj_audit_report.md. | Planning |
+| 2026-01-02 | Created TASKS.md for Excititor Formats OpenVEX library. | Planning |
+| 2026-01-02 | Completed MAINT/TEST audits for AUDIT-0321; report updated in docs/implplan/SPRINT_20251229_049_BE_csproj_audit_report.md. | Planning |
+| 2026-01-02 | Created AGENTS.md and TASKS.md for Excititor Formats OpenVEX tests project. | Planning |
+| 2026-01-02 | Completed MAINT/TEST audits for AUDIT-0322; report updated in docs/implplan/SPRINT_20251229_049_BE_csproj_audit_report.md. | Planning |
+| 2026-01-02 | Created TASKS.md for Excititor Connectors Ubuntu CSAF library. | Planning |
+| 2026-01-02 | Created AGENTS.md and TASKS.md for Excititor Connectors Ubuntu CSAF tests project. | Planning |
+| 2026-01-02 | Completed MAINT/TEST audits for AUDIT-0310; report updated in docs/implplan/SPRINT_20251229_049_BE_csproj_audit_report.md. | Planning |
+| 2026-01-02 | Completed MAINT/TEST audits for AUDIT-0311; report updated in docs/implplan/SPRINT_20251229_049_BE_csproj_audit_report.md. | Planning |
+| 2026-01-02 | Created TASKS.md for Excititor Connectors SUSE Rancher VEX Hub library. | Planning |
+| 2026-01-02 | Created AGENTS.md and TASKS.md for Excititor Connectors SUSE Rancher VEX Hub tests project. | Planning |
+| 2026-01-02 | Completed MAINT/TEST audits for AUDIT-0308; report updated in docs/implplan/SPRINT_20251229_049_BE_csproj_audit_report.md. | Planning |
+| 2026-01-02 | Completed MAINT/TEST audits for AUDIT-0309; report updated in docs/implplan/SPRINT_20251229_049_BE_csproj_audit_report.md. | Planning |
+| 2026-01-02 | Created TASKS.md for Excititor Connectors RedHat CSAF library. | Planning |
+| 2026-01-02 | Created AGENTS.md and TASKS.md for Excititor Connectors RedHat CSAF tests project. | Planning |
+| 2026-01-02 | Completed MAINT/TEST audits for AUDIT-0306; report updated in docs/implplan/SPRINT_20251229_049_BE_csproj_audit_report.md. | Planning |
+| 2026-01-02 | Completed MAINT/TEST audits for AUDIT-0307; report updated in docs/implplan/SPRINT_20251229_049_BE_csproj_audit_report.md. | Planning |
+| 2026-01-02 | Created TASKS.md for Excititor Connectors Oracle CSAF library. | Planning |
+| 2026-01-02 | Created AGENTS.md and TASKS.md for Excititor Connectors Oracle CSAF tests project. | Planning |
+| 2026-01-02 | Completed MAINT/TEST audits for AUDIT-0304; report updated in docs/implplan/SPRINT_20251229_049_BE_csproj_audit_report.md. | Planning |
+| 2026-01-02 | Completed MAINT/TEST audits for AUDIT-0305; report updated in docs/implplan/SPRINT_20251229_049_BE_csproj_audit_report.md. | Planning |
+| 2026-01-02 | Created TASKS.md for Excititor Connectors OCI OpenVEX Attest library. | Planning |
+| 2026-01-02 | Created AGENTS.md and TASKS.md for Excititor Connectors OCI OpenVEX Attest tests project. | Planning |
+| 2026-01-02 | Completed MAINT/TEST audits for AUDIT-0302; report updated in docs/implplan/SPRINT_20251229_049_BE_csproj_audit_report.md. | Planning |
+| 2026-01-02 | Completed MAINT/TEST audits for AUDIT-0303; report updated in docs/implplan/SPRINT_20251229_049_BE_csproj_audit_report.md. | Planning |
+| 2026-01-02 | Created TASKS.md for Excititor Connectors MSRC CSAF library. | Planning |
+| 2026-01-02 | Created AGENTS.md and TASKS.md for Excititor Connectors MSRC CSAF tests project. | Planning |
+| 2026-01-02 | Completed MAINT/TEST audits for AUDIT-0300; report updated in docs/implplan/SPRINT_20251229_049_BE_csproj_audit_report.md. | Planning |
+| 2026-01-02 | Completed MAINT/TEST audits for AUDIT-0301; report updated in docs/implplan/SPRINT_20251229_049_BE_csproj_audit_report.md. | Planning |
+| 2026-01-02 | Created AGENTS.md and TASKS.md for Excititor Connectors Cisco CSAF tests project. | Planning |
+| 2026-01-02 | Completed MAINT/TEST audits for AUDIT-0299; report updated in docs/implplan/SPRINT_20251229_049_BE_csproj_audit_report.md. | Planning |
+| 2026-01-02 | Created TASKS.md for Excititor Connectors Cisco CSAF library. | Planning |
+| 2026-01-02 | Completed MAINT/TEST audits for AUDIT-0298; report updated in docs/implplan/SPRINT_20251229_049_BE_csproj_audit_report.md. | Planning |
+| 2025-12-30 | Created TASKS.md for Excititor Connectors Abstractions library. | Planning |
+| 2025-12-30 | Completed MAINT/TEST audits for AUDIT-0297; report updated in docs/implplan/SPRINT_20251229_049_BE_csproj_audit_report.md. | Planning |
+| 2025-12-30 | Created AGENTS.md and TASKS.md for Excititor Attestation tests project. | Planning |
+| 2025-12-30 | Completed MAINT/TEST audits for AUDIT-0296; report updated in docs/implplan/SPRINT_20251229_049_BE_csproj_audit_report.md. | Planning |
+| 2025-12-30 | Created TASKS.md for Excititor Attestation library. | Planning |
+| 2025-12-30 | Completed MAINT/TEST audits for AUDIT-0295; report updated in docs/implplan/SPRINT_20251229_049_BE_csproj_audit_report.md. | Planning |
+| 2025-12-30 | Created AGENTS.md and TASKS.md for Excititor S3 Artifact Store tests project. | Planning |
+| 2025-12-30 | Completed MAINT/TEST audits for AUDIT-0294; report updated in docs/implplan/SPRINT_20251229_049_BE_csproj_audit_report.md. | Planning |
+| 2025-12-30 | Created AGENTS.md and TASKS.md for Excititor S3 Artifact Store library. | Planning |
+| 2025-12-30 | Completed MAINT/TEST audits for AUDIT-0293; report updated in docs/implplan/SPRINT_20251229_049_BE_csproj_audit_report.md. | Planning |
+| 2025-12-30 | Created AGENTS.md and TASKS.md for Evidence Locker Worker project. | Planning |
+| 2025-12-30 | Completed MAINT/TEST audits for AUDIT-0292; report updated in docs/implplan/SPRINT_20251229_049_BE_csproj_audit_report.md. | Planning |
+| 2025-12-30 | Created AGENTS.md and TASKS.md for Evidence Locker WebService project. | Planning |
+| 2025-12-30 | Completed MAINT/TEST audits for AUDIT-0291; report updated in docs/implplan/SPRINT_20251229_049_BE_csproj_audit_report.md. | Planning |
+| 2025-12-30 | Created AGENTS.md and TASKS.md for Evidence Locker Tests project. | Planning |
+| 2025-12-30 | Completed MAINT/TEST audits for AUDIT-0290; report updated in docs/implplan/SPRINT_20251229_049_BE_csproj_audit_report.md. | Planning |
+| 2025-12-30 | Created AGENTS.md and TASKS.md for Evidence Locker Infrastructure library. | Planning |
+| 2025-12-30 | Completed MAINT/TEST audits for AUDIT-0289; report updated in docs/implplan/SPRINT_20251229_049_BE_csproj_audit_report.md. | Planning |
+| 2025-12-30 | Created AGENTS.md and TASKS.md for Evidence Locker Core library. | Planning |
+| 2025-12-30 | Completed MAINT/TEST audits for AUDIT-0288; report updated in docs/implplan/SPRINT_20251229_049_BE_csproj_audit_report.md. | Planning |
+| 2025-12-30 | Created TASKS.md for Evidence Locker service. | Planning |
+| 2025-12-30 | Completed MAINT/TEST audits for AUDIT-0287; report updated in docs/implplan/SPRINT_20251229_049_BE_csproj_audit_report.md. | Planning |
| 2025-12-30 | Created AGENTS.md and TASKS.md for Evidence tests. | Planning |
| 2025-12-30 | Completed MAINT/TEST audits for AUDIT-0286; report updated in docs/implplan/SPRINT_20251229_049_BE_csproj_audit_report.md. | Planning |
| 2025-12-30 | Created AGENTS.md and TASKS.md for Evidence Persistence tests. | Planning |
@@ -2483,6 +2560,7 @@ Bulk task definitions (applies to every project row below):
| 2025-12-30 | Completed MAINT/TEST audits for AUDIT-0047 to AUDIT-0048; report updated in docs/implplan/SPRINT_20251229_049_BE_csproj_audit_report.md. | Planning |
| 2025-12-30 | Created AGENTS.md and TASKS.md for Attestor bundle library and tests. | Planning |
| 2025-12-30 | Completed MAINT/TEST audits for AUDIT-0045 to AUDIT-0046; report updated in docs/implplan/SPRINT_20251229_049_BE_csproj_audit_report.md. | Planning |
+| 2026-01-02 | Completed AUDIT-0045-A (bundle validation, verifier hardening, tests). | Guild |
| 2025-12-30 | Created AGENTS.md and TASKS.md for architecture tests and attestation projects. | Planning |
| 2025-12-30 | Completed MAINT/TEST audits for AUDIT-0042 to AUDIT-0044; report updated in docs/implplan/SPRINT_20251229_049_BE_csproj_audit_report.md. | Planning |
| 2025-12-30 | Created AGENTS.md and TASKS.md for AOC module and subprojects. | Planning |
diff --git a/docs/implplan/SPRINT_20251229_049_BE_csproj_audit_report.md b/docs/implplan/SPRINT_20251229_049_BE_csproj_audit_report.md
index 09bf028d6..442a4c966 100644
--- a/docs/implplan/SPRINT_20251229_049_BE_csproj_audit_report.md
+++ b/docs/implplan/SPRINT_20251229_049_BE_csproj_audit_report.md
@@ -1,7 +1,7 @@
# Sprint 20251229_049_BE - C# Audit Report (Initial Tranche)
## Scope
-- Projects audited in this tranche: 286 (Router examples + Tools (7) + Findings LedgerReplayHarness x2 + Scheduler.Backfill + AdvisoryAI core + AdvisoryAI hosting + AdvisoryAI tests + AdvisoryAI web service + AdvisoryAI worker + AirGap bundle library + AirGap bundle tests + AirGap controller + AirGap controller tests + AirGap importer + AirGap importer tests + AirGap persistence + AirGap persistence tests + AirGap policy + AirGap policy analyzers + AirGap policy analyzer tests + AirGap policy tests + AirGap time + AirGap time tests + AOC guard library + AOC analyzers + AOC analyzer tests + AOC ASP.NET Core + AOC ASP.NET Core tests + AOC tests + Architecture tests + Attestation library + Attestation tests + Attestor bundle library + Attestor bundle tests + Attestor bundling library + Attestor bundling tests + Attestor core + Attestor core tests + Attestor envelope + Attestor envelope tests + Attestor GraphRoot library + Attestor GraphRoot tests + Attestor infrastructure + Attestor OCI library + Attestor OCI tests + Attestor offline library + Attestor offline tests + Attestor persistence library + Attestor persistence tests + Attestor proof chain library + Attestor proof chain tests + Attestor standard predicates library + Attestor standard predicates tests + Attestor tests + Attestor TrustVerdict library + Attestor TrustVerdict tests + Attestor Types generator tool + Attestor Types tests + Attestor Verify + Attestor WebService + Audit ReplayToken library + Audit ReplayToken tests + AuditPack library + AuditPack tests (libraries) + AuditPack unit tests + Auth Abstractions + Auth Abstractions tests + Auth Client + Auth Client tests + Auth Security + Auth Server Integration + Auth Server Integration tests + Authority service + Authority tests + Authority Core + Authority Core tests + Authority Persistence + Authority Persistence tests + Authority LDAP plugin + Authority LDAP plugin tests + Authority OIDC plugin + Authority OIDC plugin tests + Authority SAML plugin + Authority SAML plugin tests + Authority Standard plugin + Authority Standard plugin tests + Authority Plugin Abstractions + Authority Plugin Abstractions tests + Binary Lookup benchmark + LinkNotMerge benchmark + LinkNotMerge benchmark tests + LinkNotMerge VEX benchmark + LinkNotMerge VEX benchmark tests + Notify benchmark + Notify benchmark tests + PolicyEngine benchmark + ProofChain benchmark + Scanner Analyzers benchmark + Scanner Analyzers benchmark tests + BinaryIndex Builders library + BinaryIndex Builders tests + BinaryIndex Cache library + BinaryIndex Contracts library + BinaryIndex Core library + BinaryIndex Core tests + BinaryIndex Corpus library + BinaryIndex Corpus Alpine library + BinaryIndex Corpus Debian library + BinaryIndex Corpus RPM library + BinaryIndex Fingerprints library + BinaryIndex Fingerprints tests + BinaryIndex FixIndex library + BinaryIndex Persistence library + BinaryIndex Persistence tests + BinaryIndex VexBridge library + BinaryIndex VexBridge tests + BinaryIndex WebService + Canonical Json library + Canonical Json tests + Canonicalization library + Canonicalization tests + Cartographer + Cartographer tests + Chaos Router tests + CLI + CLI AOC plugin + CLI NonCore plugin + CLI Symbols plugin + CLI Verdict plugin + CLI VEX plugin + CLI tests + Concelier analyzers + Concelier Valkey cache + Concelier Valkey cache tests + Concelier ACSC connector + Concelier ACSC connector tests + Concelier CCCS connector + Concelier CCCS connector tests + Concelier CERT-Bund connector + Concelier CERT-Bund connector tests + Concelier CERT/CC connector + Concelier CERT/CC connector tests + Concelier CERT-FR connector + Concelier CERT-FR connector tests + Concelier CERT-In connector + Concelier CERT-In connector tests + Concelier Connector Common + Concelier Connector Common tests + Concelier CVE connector + Concelier CVE connector tests + Concelier Distro.Alpine connector + Concelier Distro.Alpine connector tests + Concelier Distro.Debian connector + Concelier Distro.Debian connector tests + Concelier Distro.RedHat connector + Concelier Distro.RedHat connector tests + Concelier Distro.Suse connector + Concelier Distro.Suse connector tests + Concelier Distro.Ubuntu connector + Concelier Distro.Ubuntu connector tests + Concelier EPSS connector + Concelier EPSS connector tests + Concelier GHSA connector + Concelier GHSA connector tests + Concelier ICS CISA connector + Concelier ICS CISA connector tests + Concelier ICS Kaspersky connector + Concelier ICS Kaspersky connector tests + Concelier JVN connector + Concelier JVN connector tests + Concelier KEV connector + Concelier KEV connector tests + Concelier KISA connector + Concelier KISA connector tests + Concelier NVD connector + Concelier NVD connector tests + Concelier OSV connector + Concelier OSV connector tests + Concelier Ru.Bdu connector + Concelier Ru.Bdu connector tests + Concelier Ru.Nkcki connector + Concelier Ru.Nkcki connector tests + Concelier StellaOpsMirror connector + Concelier StellaOpsMirror connector tests + Concelier Vndr.Adobe connector + Concelier Vndr.Adobe connector tests + Concelier Vndr.Apple connector + Concelier Vndr.Apple connector tests + Concelier Vndr.Chromium connector + Concelier Vndr.Chromium connector tests + Concelier Vndr.Cisco connector + Concelier Vndr.Cisco connector tests + Concelier Vndr.Msrc connector + Concelier Vndr.Msrc connector tests + Concelier Vndr.Oracle connector + Concelier Vndr.Oracle connector tests + Concelier Vndr.Vmware connector + Concelier Vndr.Vmware connector tests + Concelier Core library + Concelier Core tests + Concelier JSON exporter + Concelier JSON exporter tests + Concelier TrivyDb exporter + Concelier TrivyDb exporter tests + Concelier Federation library + Concelier Federation tests + Concelier Integration tests + Concelier Interest library + Concelier Interest tests + Concelier Merge library + Concelier Merge analyzers + Concelier Merge analyzers tests + Concelier Merge tests + Concelier Models library + Concelier Models tests + Concelier Normalization library + Concelier Normalization tests + Concelier Persistence library + Concelier Persistence tests + Concelier ProofService library + Concelier ProofService Postgres library + Concelier ProofService Postgres tests + Concelier RawModels library + Concelier RawModels tests + Concelier SbomIntegration library + Concelier SbomIntegration tests + Concelier SourceIntel library + Concelier SourceIntel tests + Concelier Testing library + Concelier WebService + Concelier WebService tests + StellaOps.Configuration + StellaOps.Configuration tests + StellaOps.Cryptography + Crypto Profiles (src/Cryptography/StellaOps.Cryptography) + Crypto DependencyInjection + Crypto Kms + Crypto Kms Tests + Crypto BouncyCastle plugin + CryptoPro plugin + Crypto eIDAS plugin + Crypto eIDAS tests + Crypto OfflineVerification plugin + Crypto OfflineVerification tests + Crypto OpenSslGost plugin + Crypto Pkcs11Gost plugin + Crypto PqSoft plugin + Crypto SimRemote plugin + Crypto SmRemote plugin + Crypto SmRemote tests + Crypto SmSoft plugin + Crypto SmSoft tests + Crypto WineCsp plugin + Crypto PluginLoader + Crypto PluginLoader tests + Crypto Profiles Ecdsa + Crypto Profiles EdDsa + Crypto OfflineVerification provider + Crypto Tests (__Tests) + Crypto Tests (libraries) + DeltaVerdict library + DeltaVerdict tests + DependencyInjection library + Determinism Abstractions library + Determinism Analyzers + Determinism Analyzers tests + Evidence library + Evidence Bundle library + Evidence Bundle tests + Evidence Core library + Evidence Core tests + Evidence Persistence library + Evidence Persistence tests + Evidence tests).
-- MAINT + TEST tasks completed for AUDIT-0001 to AUDIT-0286.
+- Projects audited in this tranche: 322 (Router examples + Tools (7) + Findings LedgerReplayHarness x2 + Scheduler.Backfill + AdvisoryAI core + AdvisoryAI hosting + AdvisoryAI tests + AdvisoryAI web service + AdvisoryAI worker + AirGap bundle library + AirGap bundle tests + AirGap controller + AirGap controller tests + AirGap importer + AirGap importer tests + AirGap persistence + AirGap persistence tests + AirGap policy + AirGap policy analyzers + AirGap policy analyzer tests + AirGap policy tests + AirGap time + AirGap time tests + AOC guard library + AOC analyzers + AOC analyzer tests + AOC ASP.NET Core + AOC ASP.NET Core tests + AOC tests + Architecture tests + Attestation library + Attestation tests + Attestor bundle library + Attestor bundle tests + Attestor bundling library + Attestor bundling tests + Attestor core + Attestor core tests + Attestor envelope + Attestor envelope tests + Attestor GraphRoot library + Attestor GraphRoot tests + Attestor infrastructure + Attestor OCI library + Attestor OCI tests + Attestor offline library + Attestor offline tests + Attestor persistence library + Attestor persistence tests + Attestor proof chain library + Attestor proof chain tests + Attestor standard predicates library + Attestor standard predicates tests + Attestor tests + Attestor TrustVerdict library + Attestor TrustVerdict tests + Attestor Types generator tool + Attestor Types tests + Attestor Verify + Attestor WebService + Audit ReplayToken library + Audit ReplayToken tests + AuditPack library + AuditPack tests (libraries) + AuditPack unit tests + Auth Abstractions + Auth Abstractions tests + Auth Client + Auth Client tests + Auth Security + Auth Server Integration + Auth Server Integration tests + Authority service + Authority tests + Authority Core + Authority Core tests + Authority Persistence + Authority Persistence tests + Authority LDAP plugin + Authority LDAP plugin tests + Authority OIDC plugin + Authority OIDC plugin tests + Authority SAML plugin + Authority SAML plugin tests + Authority Standard plugin + Authority Standard plugin tests + Authority Plugin Abstractions + Authority Plugin Abstractions tests + Binary Lookup benchmark + LinkNotMerge benchmark + LinkNotMerge benchmark tests + LinkNotMerge VEX benchmark + LinkNotMerge VEX benchmark tests + Notify benchmark + Notify benchmark tests + PolicyEngine benchmark + ProofChain benchmark + Scanner Analyzers benchmark + Scanner Analyzers benchmark tests + BinaryIndex Builders library + BinaryIndex Builders tests + BinaryIndex Cache library + BinaryIndex Contracts library + BinaryIndex Core library + BinaryIndex Core tests + BinaryIndex Corpus library + BinaryIndex Corpus Alpine library + BinaryIndex Corpus Debian library + BinaryIndex Corpus RPM library + BinaryIndex Fingerprints library + BinaryIndex Fingerprints tests + BinaryIndex FixIndex library + BinaryIndex Persistence library + BinaryIndex Persistence tests + BinaryIndex VexBridge library + BinaryIndex VexBridge tests + BinaryIndex WebService + Canonical Json library + Canonical Json tests + Canonicalization library + Canonicalization tests + Cartographer + Cartographer tests + Chaos Router tests + CLI + CLI AOC plugin + CLI NonCore plugin + CLI Symbols plugin + CLI Verdict plugin + CLI VEX plugin + CLI tests + Concelier analyzers + Concelier Valkey cache + Concelier Valkey cache tests + Concelier ACSC connector + Concelier ACSC connector tests + Concelier CCCS connector + Concelier CCCS connector tests + Concelier CERT-Bund connector + Concelier CERT-Bund connector tests + Concelier CERT/CC connector + Concelier CERT/CC connector tests + Concelier CERT-FR connector + Concelier CERT-FR connector tests + Concelier CERT-In connector + Concelier CERT-In connector tests + Concelier Connector Common + Concelier Connector Common tests + Concelier CVE connector + Concelier CVE connector tests + Concelier Distro.Alpine connector + Concelier Distro.Alpine connector tests + Concelier Distro.Debian connector + Concelier Distro.Debian connector tests + Concelier Distro.RedHat connector + Concelier Distro.RedHat connector tests + Concelier Distro.Suse connector + Concelier Distro.Suse connector tests + Concelier Distro.Ubuntu connector + Concelier Distro.Ubuntu connector tests + Concelier EPSS connector + Concelier EPSS connector tests + Concelier GHSA connector + Concelier GHSA connector tests + Concelier ICS CISA connector + Concelier ICS CISA connector tests + Concelier ICS Kaspersky connector + Concelier ICS Kaspersky connector tests + Concelier JVN connector + Concelier JVN connector tests + Concelier KEV connector + Concelier KEV connector tests + Concelier KISA connector + Concelier KISA connector tests + Concelier NVD connector + Concelier NVD connector tests + Concelier OSV connector + Concelier OSV connector tests + Concelier Ru.Bdu connector + Concelier Ru.Bdu connector tests + Concelier Ru.Nkcki connector + Concelier Ru.Nkcki connector tests + Concelier StellaOpsMirror connector + Concelier StellaOpsMirror connector tests + Concelier Vndr.Adobe connector + Concelier Vndr.Adobe connector tests + Concelier Vndr.Apple connector + Concelier Vndr.Apple connector tests + Concelier Vndr.Chromium connector + Concelier Vndr.Chromium connector tests + Concelier Vndr.Cisco connector + Concelier Vndr.Cisco connector tests + Concelier Vndr.Msrc connector + Concelier Vndr.Msrc connector tests + Concelier Vndr.Oracle connector + Concelier Vndr.Oracle connector tests + Concelier Vndr.Vmware connector + Concelier Vndr.Vmware connector tests + Concelier Core library + Concelier Core tests + Concelier JSON exporter + Concelier JSON exporter tests + Concelier TrivyDb exporter + Concelier TrivyDb exporter tests + Concelier Federation library + Concelier Federation tests + Concelier Integration tests + Concelier Interest library + Concelier Interest tests + Concelier Merge library + Concelier Merge analyzers + Concelier Merge analyzers tests + Concelier Merge tests + Concelier Models library + Concelier Models tests + Concelier Normalization library + Concelier Normalization tests + Concelier Persistence library + Concelier Persistence tests + Concelier ProofService library + Concelier ProofService Postgres library + Concelier ProofService Postgres tests + Concelier RawModels library + Concelier RawModels tests + Concelier SbomIntegration library + Concelier SbomIntegration tests + Concelier SourceIntel library + Concelier SourceIntel tests + Concelier Testing library + Concelier WebService + Concelier WebService tests + StellaOps.Configuration + StellaOps.Configuration tests + StellaOps.Cryptography + Crypto Profiles (src/Cryptography/StellaOps.Cryptography) + Crypto DependencyInjection + Crypto Kms + Crypto Kms Tests + Crypto BouncyCastle plugin + CryptoPro plugin + Crypto eIDAS plugin + Crypto eIDAS tests + Crypto OfflineVerification plugin + Crypto OfflineVerification tests + Crypto OpenSslGost plugin + Crypto Pkcs11Gost plugin + Crypto PqSoft plugin + Crypto SimRemote plugin + Crypto SmRemote plugin + Crypto SmRemote tests + Crypto SmSoft plugin + Crypto SmSoft tests + Crypto WineCsp plugin + Crypto PluginLoader + Crypto PluginLoader tests + Crypto Profiles Ecdsa + Crypto Profiles EdDsa + Crypto OfflineVerification provider + Crypto Tests (__Tests) + Crypto Tests (libraries) + DeltaVerdict library + DeltaVerdict tests + DependencyInjection library + Determinism Abstractions library + Determinism Analyzers + Determinism Analyzers tests + Evidence library + Evidence Bundle library + Evidence Bundle tests + Evidence Core library + Evidence Core tests + Evidence Persistence library + Evidence Persistence tests + Evidence tests + Evidence Locker Core library + Evidence Locker Infrastructure library + Evidence Locker Tests + Evidence Locker WebService + Evidence Locker Worker + Excititor ArtifactStores S3 library + Excititor ArtifactStores S3 tests + Excititor Attestation library + Excititor Attestation tests + Excititor Connectors Abstractions library + Excititor Connectors Cisco CSAF library + Excititor Connectors Cisco CSAF tests + Excititor Connectors MSRC CSAF library + Excititor Connectors MSRC CSAF tests + Excititor Connectors OCI OpenVEX Attest library + Excititor Connectors OCI OpenVEX Attest tests + Excititor Connectors Oracle CSAF library + Excititor Connectors Oracle CSAF tests + Excititor Connectors RedHat CSAF library + Excititor Connectors RedHat CSAF tests + Excititor Connectors SUSE Rancher VEX Hub library + Excititor Connectors SUSE Rancher VEX Hub tests + Excititor Connectors Ubuntu CSAF library + Excititor Connectors Ubuntu CSAF tests + Excititor Core library + Excititor Core tests + Excititor Core unit tests + Excititor Export library + Excititor Export tests + Excititor Formats CSAF library + Excititor Formats CSAF tests + Excititor Formats CycloneDX library + Excititor Formats CycloneDX tests + Excititor Formats OpenVEX library + Excititor Formats OpenVEX tests).
+- MAINT + TEST tasks completed for AUDIT-0001 to AUDIT-0322.
- APPLY tasks remain pending approval for non-example projects.
## Findings
### src/Router/examples/Examples.Billing.Microservice/Examples.Billing.Microservice.csproj
@@ -2749,7 +2749,314 @@
- TEST: Coverage exists for EvidenceIndex serialization/validation, EvidenceQueryService summary, and EvidenceBudgetService behaviors.
- TEST: Missing tests for EvidenceIndexValidator error cases (invalid signatures, digest mismatch, missing unknown for inconclusive reachability) and deterministic ordering in EvidenceLinker.
- Proposed changes (pending approval): add explicit test SDK refs or document central management; use fixed timestamps and deterministic IDs in fixtures; add negative-path validation tests and ordering determinism tests.
+### src/EvidenceLocker/StellaOps.EvidenceLocker/StellaOps.EvidenceLocker.csproj
+- MAINT: TreatWarningsAsErrors is set to false in the project file; warning discipline is relaxed.
+- MAINT: Project references include OpenTelemetry/Serilog and multiple module references that are unused by this project (root code only includes Storage classes); dependency surface is larger than needed.
+- MAINT: VerdictAttestationRecord.CreatedAt defaults to DateTimeOffset.UtcNow; records are nondeterministic if callers omit explicit timestamps.
+- MAINT: PostgresVerdictRepository.GetVerdictAsync and ListVerdictsForRunAsync/CountVerdictsForRunAsync do not enforce tenant scoping; cross-tenant access is possible when verdict/run IDs overlap.
+- MAINT: ListVerdictsForRunAsync and ListVerdictsAsync order only by evaluated_at; ties can return nondeterministic ordering.
+- MAINT: VerdictListOptions is not null-checked in list/count methods; null options will throw.
+- MAINT: StoreVerdictAsync upsert updates only envelope and updated_at; other fields will not refresh if a verdict changes.
+- MAINT: Migrations/001_CreateVerdictAttestations.sql is not embedded or applied by this project; schema management path is unclear.
+- TEST: No dedicated tests for PostgresVerdictRepository CRUD, tenant scoping, pagination/ordering, or migration application.
+- Proposed changes (pending approval): enable TreatWarningsAsErrors; trim unused dependencies; make CreatedAt explicit or inject time; enforce tenant scoping in all queries; add stable ordering tie-breakers; guard null options; clarify upsert semantics; add repository/migration tests.
+### src/EvidenceLocker/StellaOps.EvidenceLocker/StellaOps.EvidenceLocker.Core/StellaOps.EvidenceLocker.Core.csproj
+- MAINT: TreatWarningsAsErrors is set to false in the project file; warning discipline is relaxed.
+- MAINT: MerkleTreeCalculator hashes leaves in caller-provided order; root hash changes if inputs are not pre-sorted or canonicalized.
+- MAINT: EvidenceSnapshotRequest/EvidenceSnapshotMaterial use mutable collections and allow empty Sha256; core models do not validate required fields or ordering.
+- MAINT: EvidenceSnapshotResult.BundleId is a Guid instead of EvidenceBundleId; typed ID validation is bypassed.
+- MAINT: EvidenceHoldRequest.BundleId is a Guid? instead of EvidenceBundleId?; empty values can pass without typed validation.
+- TEST: EvidenceLocker.Tests cover bundle builder and snapshot service flows, but no direct tests for MerkleTreeCalculator ordering/empty inputs or snapshot model invariants.
+- Proposed changes (pending approval): enable TreatWarningsAsErrors; enforce or document sorted leaf inputs (or sort internally); add core validation for snapshot materials/metadata and enforce non-empty Sha256; switch snapshot/hold request IDs to EvidenceBundleId (or validate Guid.Empty); add unit tests for Merkle root ordering/empty inputs and snapshot model validation.
+### src/EvidenceLocker/StellaOps.EvidenceLocker/StellaOps.EvidenceLocker.Infrastructure/StellaOps.EvidenceLocker.Infrastructure.csproj
+- MAINT: TreatWarningsAsErrors is set to false in the project file; warning discipline is relaxed.
+- MAINT: EvidenceBundleBuilder updates bundle status to Sealed inside BuildAsync; EvidenceSnapshotService later sets Assembling then Sealed, so status transitions are duplicated and inconsistent.
+- MAINT: EvidenceSnapshotService incident snapshot JSON serializes Dictionary metadata/attributes without sorting; incident snapshot bytes can vary across runs when dictionary insertion order differs.
+- MAINT: EvidenceSnapshotService uses Guid.NewGuid for bundle/hold IDs with no injectable ID provider; deterministic fixture generation is harder.
+- MAINT: EvidenceBundleRepository.UpdateStorageKeyAsync uses NOW() in SQL for updated_at; time source diverges from TimeProvider-based timestamps and is nondeterministic in tests.
+- MAINT: TimelineIndexerEvidenceTimelinePublisher accepts TimeProvider but never uses it; timeline event IDs are random Guid values with no deterministic option.
+- MAINT: EvidencePortableBundleService.BuildInstructions hard-codes "bundle.json" instead of using PortableOptions.MetadataFileName; instructions drift when the filename is configured.
+- MAINT: Rfc3161TimestampAuthorityClient mutates HttpClient.Timeout per request; shared HttpClient instances can see unexpected timeout changes.
+- TEST: Coverage exists for snapshot/packaging services, object stores, signature service, timeline publisher, and migration runner in StellaOps.EvidenceLocker.Tests.
+- TEST: Missing tests for EvidenceBundleRepository.UpdateStorageKey/UpdatePortableStorageKey timestamp behavior, incident snapshot determinism (sorted metadata/attributes), StorageKeyGenerator sanitization/prefix handling, and timeline event ID determinism.
+- Proposed changes (pending approval): enable TreatWarningsAsErrors; centralize bundle status transitions (builder should not set Sealed or should use Assembling); sort incident metadata/attributes before serialization; add injectable ID provider or optional explicit IDs for snapshots/holds; accept updatedAt in UpdateStorageKeyAsync; either use/remove TimeProvider in timeline publisher and allow deterministic event IDs; use options.MetadataFileName in portable instructions; move per-request timeouts into HttpClientFactory config or CancellationToken; add tests for the noted gaps.
+### src/EvidenceLocker/StellaOps.EvidenceLocker/StellaOps.EvidenceLocker.Tests/StellaOps.EvidenceLocker.Tests.csproj
+- MAINT: TreatWarningsAsErrors is set to false in the project file; warning discipline is relaxed.
+- MAINT: Explicit Microsoft.NET.Test.Sdk references are absent; test discovery relies on centralized props or SDK configuration.
+- MAINT: OutputType is set to Exe with UseXunitV3; ensure this is intentional and documented to avoid runner confusion.
+- MAINT: Tests use Guid.NewGuid and DateTimeOffset.UtcNow widely (web application factory, snapshot tests, immutability tests, integration tests); nondeterministic fixtures reduce reproducibility.
+- MAINT: DatabaseMigrationTests uses Testcontainers/Docker but is labeled TestCategories.Unit; category misclassification obscures integration requirements.
+- TEST: Coverage exists for web service contracts/integration, snapshot service, bundle packaging, signature service, object stores, timeline publisher, and migration runner behavior.
+- TEST: Missing tests for deterministic timestamp usage in test fakes (TestTimestampAuthorityClient/TestEvidenceObjectStore), deterministic IDs/time in web/integration fixtures, and StorageKeyGenerator sanitization behavior.
+- Disposition: skipped (test project; no apply changes).
+### src/EvidenceLocker/StellaOps.EvidenceLocker/StellaOps.EvidenceLocker.WebService/StellaOps.EvidenceLocker.WebService.csproj
+- MAINT: TreatWarningsAsErrors is set to false in the project file; warning discipline is relaxed.
+- MAINT: Program.cs registers EvidenceSnapshotService even though AddEvidenceLockerInfrastructure already registers it; duplicate registration adds noise.
+- MAINT: /evidence/snapshot requires EvidenceHold scope while tests use EvidenceCreate; scope intent is inconsistent and may be misconfigured.
+- MAINT: DataAnnotations on request DTOs are not enforced in Minimal API; Program.cs uses request.Materials.Count before validation, so null Materials can throw.
+- MAINT: /evidence/verify does not guard BundleId/RootHash; EvidenceBundleId.FromGuid or VerifyAsync can throw and yield 500 instead of 400.
+- MAINT: Error handling for holds inspects exception messages to decide outcomes; string matching is brittle and locale-dependent.
+- MAINT: appsettings.json and appsettings.Development.json are truncated/invalid JSON; configuration loading can fail at runtime.
+- MAINT: StellaOps.EvidenceLocker.WebService.http still references /weatherforecast which is not exposed; sample request is stale.
+- TEST: Coverage exists for snapshot/hold/verify/download endpoints and contract tests in StellaOps.EvidenceLocker.Tests.
+- TEST: Missing tests for invalid request bodies (null Materials, empty RootHash, empty BundleId) and for scope enforcement differences between EvidenceCreate/EvidenceHold.
+- Proposed changes (pending approval): enable TreatWarningsAsErrors; remove duplicate EvidenceSnapshotService registration; align snapshot endpoint scope with intended policy; add explicit validation filters or guards before accessing request.Materials; validate verify inputs and return 400; replace exception message matching with typed errors; fix appsettings JSON files; update the .http sample; add tests for invalid inputs and scope enforcement.
+### src/EvidenceLocker/StellaOps.EvidenceLocker/StellaOps.EvidenceLocker.Worker/StellaOps.EvidenceLocker.Worker.csproj
+- MAINT: TreatWarningsAsErrors is set to false in the project file; warning discipline is relaxed.
+- MAINT: appsettings.json and appsettings.Development.json are truncated/invalid JSON; configuration loading can fail at runtime.
+- MAINT: Worker only checks DB connectivity and then sleeps indefinitely; no periodic health checks or dependency validation beyond startup.
+- MAINT: Worker logs the database name but does not include tenant or configuration context; observability is limited.
+- TEST: No dedicated tests for worker startup/host configuration or failure behavior.
+- Proposed changes (pending approval): enable TreatWarningsAsErrors; fix appsettings JSON files; add periodic connectivity check/metrics or remove the worker if it is only for migrations; add a minimal hosted service test for startup failures and configuration validation.
+### src/Excititor/__Libraries/StellaOps.Excititor.ArtifactStores.S3/StellaOps.Excititor.ArtifactStores.S3.csproj
+- MAINT: TreatWarningsAsErrors is set to false in the project file; warning discipline is relaxed.
+- MAINT: S3ArtifactClient.GetObjectAsync reads the entire object into a MemoryStream and never disposes the GetObjectResponse; this can leak connections and consume unnecessary memory.
+- MAINT: S3ArtifactClient does not validate bucket/key/content/metadata inputs; null metadata or empty keys will surface as runtime exceptions from AWS SDK calls.
+- MAINT: AddVexS3ArtifactClient does not validate S3ArtifactClientOptions (Region/ServiceUrl); misconfiguration fails late at runtime.
+- TEST: Coverage exists in src/Excititor/__Tests/StellaOps.Excititor.ArtifactStores.S3.Tests for ObjectExistsAsync and PutObjectAsync metadata mapping.
+- TEST: Missing tests for GetObjectAsync not-found behavior, DeleteObjectAsync invocation, options mapping (ServiceUrl/ForcePathStyle), and large-object streaming behavior.
+- Proposed changes (pending approval): enable TreatWarningsAsErrors; dispose S3 responses or return a stream wrapper; avoid full buffering or cap/stream; validate inputs and allow null metadata; add options validation; add tests for not-found/delete/options/streaming paths.
+### src/Excititor/__Tests/StellaOps.Excititor.ArtifactStores.S3.Tests/StellaOps.Excititor.ArtifactStores.S3.Tests.csproj
+- MAINT: TreatWarningsAsErrors is set to false in the project file; warning discipline is relaxed.
+- MAINT: Explicit Microsoft.NET.Test.Sdk references are absent; test discovery relies on centralized props or SDK configuration.
+- TEST: Coverage exists for ObjectExistsAsync and PutObjectAsync metadata mapping.
+- TEST: Missing tests for GetObjectAsync not-found behavior, DeleteObjectAsync invocation, and options mapping (ServiceUrl/ForcePathStyle).
+- Disposition: skipped (test project; no apply changes).
+### src/Excititor/__Libraries/StellaOps.Excititor.Attestation/StellaOps.Excititor.Attestation.csproj
+- MAINT: TreatWarningsAsErrors is set to false in the project file; warning discipline is relaxed.
+- MAINT: VexAttestationClient builds diagnostics with serialized envelope JSON; this may log large payloads and leaks sensitive metadata into diagnostics by default.
+- MAINT: VexAttestationClient merges request metadata over defaults but does not enforce size/ordering rules; metadata ordering in the predicate may be nondeterministic if caller uses unordered dictionaries.
+- MAINT: VexEvidenceAttestor.CreateAttestationId uses current time; attestation IDs are nondeterministic and time-based collisions are possible under high throughput.
+- MAINT: VexEvidenceAttestor.VerifyAttestationAsync does not verify DSSE signatures; only payload/manifest fields are checked.
+- MAINT: RekorHttpClient reuses StringContent across retries, which can fail after the first send; BaseAddress and Authorization headers are set on shared HttpClient instance, risking cross-client contamination in DI.
+- MAINT: RekorHttpClient.ParseEntryLocation uses Guid.NewGuid when uuid is missing; transparency IDs are nondeterministic in diagnostics.
+- MAINT: VexDsseBuilder.ComputeEnvelopeDigest uses JsonSerializer with new options (camelCase, ignore null) which may reorder properties and differs from the builder serializer; digest may change if envelope serialization changes.
+- TEST: Coverage exists in src/Excititor/__Tests/StellaOps.Excititor.Attestation.Tests for VexDsseBuilder, VexAttestationClient, and VexAttestationVerifier.
+- TEST: Missing tests for RekorHttpClient retry/content reuse, BaseAddress/Auth header configuration, VexEvidenceAttestor signature verification, deterministic attestation IDs, and envelope digest stability across serialization options.
+- Proposed changes (pending approval): enable TreatWarningsAsErrors; guard diagnostics to avoid logging full envelopes by default; normalize metadata ordering before predicate build; make attestation ID deterministic or add collision-safe nonce; verify DSSE signature in VerifyAttestationAsync; allocate new HttpContent per retry and avoid mutating shared HttpClient headers; parse Rekor entry fields deterministically; align envelope digest serialization options and add tests for stability and Rekor client behavior.
+### src/Excititor/__Tests/StellaOps.Excititor.Attestation.Tests/StellaOps.Excititor.Attestation.Tests.csproj
+- MAINT: TreatWarningsAsErrors is set to false in the project file; warning discipline is relaxed.
+- MAINT: Tests use DateTimeOffset.UtcNow and Guid.NewGuid in fixtures; nondeterministic inputs reduce reproducibility.
+- TEST: Coverage exists for VexDsseBuilder, VexAttestationClient, and VexAttestationVerifier happy-path and failure cases.
+- TEST: Missing tests for deterministic envelope digest stability, VexAttestationClient metadata ordering, and Rekor client retry behavior.
+- Disposition: skipped (test project; no apply changes).
+### src/Excititor/__Libraries/StellaOps.Excititor.Connectors.Abstractions/StellaOps.Excititor.Connectors.Abstractions.csproj
+- MAINT: TreatWarningsAsErrors is set to false in the project file; warning discipline is relaxed.
+- MAINT: VexConnectorOptionsBinder ignores null-valued keys entirely; options with explicit nulls are silently dropped, which can mask misconfiguration.
+- MAINT: VexConnectorOptionsBinder errors are aggregated but do not include key names or values; diagnosis is harder for large configs.
+- MAINT: VexConnectorBase.CreateRawDocument computes SHA256 by copying content to a new array if TryHashData fails; large content will allocate.
+- MAINT: VexConnectorLogScope prefixes metadata keys with "vex." but does not sanitize values; logs could leak secrets if caller passes sensitive metadata.
+- TEST: No dedicated tests for VexConnectorOptionsBinder binding behavior, unknown-key handling, DataAnnotations validation, or log scope ordering.
+- Proposed changes (pending approval): enable TreatWarningsAsErrors; preserve null key reporting or expose missing keys in validation errors; include key names in validation messages; avoid extra allocations when hashing large payloads; add metadata redaction helper; add unit tests for binder validation and log scope ordering/determinism.
+### src/Excititor/__Libraries/StellaOps.Excititor.Connectors.Cisco.CSAF/StellaOps.Excititor.Connectors.Cisco.CSAF.csproj
+- MAINT: TreatWarningsAsErrors is set to false in the project file; warning discipline is relaxed.
+- MAINT: CiscoCsafConnector stores every document digest indefinitely; state grows unbounded across runs and can bloat storage.
+- MAINT: Catalog parsing silently stops when the index is invalid or missing advisories; fetch failures are not logged.
+- MAINT: Advisories with missing published/lastModified timestamps are skipped once since is set; updates can be silently ignored.
+- MAINT: FetchAsync buffers full CSAF payloads with no size guard; large documents can spike memory.
+- TEST: Coverage exists for fetch happy path, metadata loader network/offline, and CSAF normalizer fixtures.
+- TEST: Missing tests for catalog pagination (`next`), invalid/missing advisory URLs, and timestamp handling when lastModified/published are missing.
+- Proposed changes (pending approval): enable TreatWarningsAsErrors; add digest retention/cap policy; log and surface catalog parse failures; add a safe fallback or logging for missing timestamps; add optional payload size limits or streaming guardrails; add tests for pagination, URL validation, and timestamp/state handling.
+- Disposition: pending implementation (non-test project; apply recommendations remain open)
+### src/Excititor/__Tests/StellaOps.Excititor.Connectors.Cisco.CSAF.Tests/StellaOps.Excititor.Connectors.Cisco.CSAF.Tests.csproj
+- MAINT: TreatWarningsAsErrors is set to false in the project file; warning discipline is relaxed.
+- MAINT: Test fixtures create raw documents with DateTimeOffset.UtcNow and Guid.NewGuid; nondeterministic inputs reduce reproducibility.
+- MAINT: HttpResponseMessageExtensions.Clone blocks on ReadAsStringAsync; sync-over-async can deadlock under certain runners.
+- MAINT: PackageReference indentation is inconsistent (FluentAssertions line), making diffs noisier.
+- TEST: Coverage exists for connector fetch, metadata loader network/offline, and CSAF normalizer fixture snapshots.
+- TEST: Missing tests for catalog pagination (`next`), invalid index payloads, and missing published/lastModified timestamp handling.
+- Disposition: waived (test project; no apply changes).
+### src/Excititor/__Libraries/StellaOps.Excititor.Connectors.MSRC.CSAF/StellaOps.Excititor.Connectors.MSRC.CSAF.csproj
+- MAINT: TreatWarningsAsErrors is set to false in the project file; warning discipline is relaxed.
+- MAINT: CreateAuthenticatedClientAsync mutates DefaultRequestHeaders with Authorization/locale/api-version on pooled HttpClient; tokens/locales can bleed across runs or tenants.
+- MAINT: DownloadCsafAsync buffers the entire payload; ValidateCsafPayload copies payload for zip/gzip and parses full JSON with no size guard, risking large memory spikes.
+- MAINT: EnumerateSummariesAsync does not log or handle invalid JSON; a malformed summary response will abort the fetch without context.
+- MAINT: Cursor advancement only uses lastModified/release; if both are missing, LastUpdated stays stale even when documents are stored.
+- TEST: Coverage exists for token provider caching/offline flows, connector fetch/dedupe/quarantine, signer metadata enrichment, and CSAF normalizer fixtures.
+- TEST: Missing tests for pagination (`@odata.nextLink`), invalid summary payload handling, and cursor advancement when timestamps are missing.
+- Proposed changes (pending approval): enable TreatWarningsAsErrors; set auth/locale/version headers per request; add payload size guards or streaming validation for zip/gzip payloads; log/handle summary JSON errors; add a safe fallback or logging for missing timestamps; add tests for pagination, invalid summary payloads, and cursor advancement.
+- Disposition: pending implementation (non-test project; apply recommendations remain open)
+### src/Excititor/__Tests/StellaOps.Excititor.Connectors.MSRC.CSAF.Tests/StellaOps.Excititor.Connectors.MSRC.CSAF.Tests.csproj
+- MAINT: TreatWarningsAsErrors is set to false in the project file; warning discipline is relaxed.
+- MAINT: Normalizer fixtures create raw documents with DateTimeOffset.UtcNow and Guid.NewGuid; nondeterministic inputs reduce reproducibility.
+- MAINT: Signer metadata test toggles a process-wide environment variable; parallel runs can race if tests execute concurrently.
+- TEST: Coverage exists for token provider caching/refresh/offline, connector fetch/dedupe/quarantine, signer metadata enrichment, and CSAF normalizer snapshots.
+- TEST: Missing tests for pagination (`@odata.nextLink`), invalid summary payload handling, and gzip payload validation.
+- Disposition: waived (test project; no apply changes).
+### src/Excititor/__Libraries/StellaOps.Excititor.Connectors.OCI.OpenVEX.Attest/StellaOps.Excititor.Connectors.OCI.OpenVEX.Attest.csproj
+- MAINT: TreatWarningsAsErrors is set to false in the project file; warning discipline is relaxed.
+- MAINT: MaxParallelResolutions is validated but unused; concurrency control intent is not implemented.
+- MAINT: OciAttestationDiscoveryService cache key omits Cosign and registry auth options; changing verification mode can reuse stale discovery results.
+- MAINT: Registry and offline fetch paths buffer entire attestation payloads (tar/gzip/registry blob) without size guards; large attestations can spike memory.
+- MAINT: OciRegistryClient does not log invalid JSON or referrer parsing errors; a malformed referrer index aborts without context.
+- TEST: Coverage exists for discovery caching, options validation, connector offline fetch, and OpenVEX fixture parsing.
+- TEST: Missing tests for registry fetch path, referrer pagination handling, offline tar/gzip ingestion, and invalid referrer payloads.
+- Proposed changes (pending approval): enable TreatWarningsAsErrors; either remove or implement MaxParallelResolutions; include Cosign/auth options in discovery cache key or disable caching for security-sensitive options; add payload size guards/streaming; add logging for referrer parse failures; add tests for registry fetch, pagination, and offline archive handling.
+- Disposition: pending implementation (non-test project; apply recommendations remain open)
+### src/Excititor/__Tests/StellaOps.Excititor.Connectors.OCI.OpenVEX.Attest.Tests/StellaOps.Excititor.Connectors.OCI.OpenVEX.Attest.Tests.csproj
+- MAINT: TreatWarningsAsErrors is set to false in the project file; warning discipline is relaxed.
+- MAINT: Connector tests use DateTimeOffset.UtcNow for signature metadata; nondeterministic timestamps reduce reproducibility.
+- MAINT: Signer metadata tests mutate a process-wide environment variable; parallel test runs can race.
+- TEST: Coverage exists for discovery cache behavior, options validation, connector offline fetch, and OpenVEX fixture parsing.
+- TEST: Missing tests for registry fetch path, referrer pagination handling, offline tar/gzip ingestion, and invalid referrer payloads.
+- Disposition: waived (test project; no apply changes).
+### src/Excititor/__Libraries/StellaOps.Excititor.Connectors.Oracle.CSAF/StellaOps.Excititor.Connectors.Oracle.CSAF.csproj
+- MAINT: TreatWarningsAsErrors is set to false in the project file; warning discipline is relaxed.
+- MAINT: OracleCsafConnector retains all digests indefinitely; state grows unbounded and can bloat storage.
+- MAINT: DownloadWithRetryAsync uses exponential backoff but no cap; retries can back off too long under repeated failures.
+- MAINT: Connector ignores entry size metadata; payloads are buffered with no size guard.
+- MAINT: OracleCatalogLoader cache key ignores OfflineSnapshotPath and PreferOfflineSnapshot; different modes can reuse stale cache entries.
+- TEST: Coverage exists for catalog loader fetch/offline fallback and connector fetch/checksum handling.
+- TEST: Missing tests for entry ordering (published default handling), request delay usage, and offline snapshot persistence failures.
+- Proposed changes (pending approval): enable TreatWarningsAsErrors; cap or trim digest history; cap retry backoff and expose retry policy; add size limits for payloads; include offline options in cache key or bypass cache for offline mode; add tests for ordering, request delay, and snapshot persistence errors.
+- Disposition: pending implementation (non-test project; apply recommendations remain open)
+### src/Excititor/__Tests/StellaOps.Excititor.Connectors.Oracle.CSAF.Tests/StellaOps.Excititor.Connectors.Oracle.CSAF.Tests.csproj
+- MAINT: TreatWarningsAsErrors is set to false in the project file; warning discipline is relaxed.
+- MAINT: Normalizer fixtures create raw documents with DateTimeOffset.UtcNow and Guid.NewGuid; nondeterministic inputs reduce reproducibility.
+- MAINT: HttpResponseMessageExtensions.Clone blocks on ReadAsByteArrayAsync; sync-over-async can deadlock under certain runners.
+- TEST: Coverage exists for offline catalog loading, connector fetch, checksum validation, and CSAF normalizer fixtures.
+- TEST: Missing tests for catalog schedule merge edge cases, retry backoff timing, and checksum mismatch logging.
+- Disposition: waived (test project; no apply changes).
+### src/Excititor/__Libraries/StellaOps.Excititor.Connectors.RedHat.CSAF/StellaOps.Excititor.Connectors.RedHat.CSAF.csproj
+- MAINT: TreatWarningsAsErrors is set to false in the project file; warning discipline is relaxed.
+- MAINT: RedHatCsafConnector retains all digests indefinitely; state grows unbounded and can bloat storage.
+- MAINT: RedHatProviderMetadataLoader cache key is static; changes to MetadataUri/offline options can reuse stale cache entries.
+- MAINT: FetchRolieEntriesAsync and DownloadCsafDocumentAsync buffer full responses with no size guard; large feeds or documents can spike memory.
+- MAINT: ROLIE feed parsing failures are not logged; malformed XML will throw without context.
+- TEST: Coverage exists for provider metadata loading (cache/offline/etag), connector since/duplicate behavior, CSAF fixtures, and opt-in live schema checks.
+- TEST: Missing tests for ROLIE feed parsing failures, missing document links, and offline snapshot persistence errors.
+- Proposed changes (pending approval): enable TreatWarningsAsErrors; cap or trim digest history; scope cache key to options (MetadataUri/offline flags); add size limits/streaming; add error logging around XML parse; add tests for feed parse failures and missing links.
+- Disposition: pending implementation (non-test project; apply recommendations remain open)
+### src/Excititor/__Tests/StellaOps.Excititor.Connectors.RedHat.CSAF.Tests/StellaOps.Excititor.Connectors.RedHat.CSAF.Tests.csproj
+- MAINT: TreatWarningsAsErrors is set to false in the project file; warning discipline is relaxed.
+- MAINT: Normalizer fixtures create raw documents with DateTimeOffset.UtcNow and Guid.NewGuid; nondeterministic inputs reduce reproducibility.
+- TEST: Coverage exists for connector fetch/state handling, provider metadata loader, CSAF normalizer fixtures, and opt-in live schema checks.
+- TEST: Missing tests for ROLIE feed parsing errors, missing link handling, and offline snapshot persistence failures.
+- Disposition: waived (test project; no apply changes).
+### src/Excititor/__Libraries/StellaOps.Excititor.Connectors.SUSE.RancherVEXHub/StellaOps.Excititor.Connectors.SUSE.RancherVEXHub.csproj
+- MAINT: TreatWarningsAsErrors is set to false in the project file; warning discipline is relaxed.
+- MAINT: RancherHubTokenProvider caches tokens by ClientId only; differing token endpoints/scopes/audience can reuse stale tokens across connectors.
+- MAINT: RancherHubMetadataLoader cache key only uses DiscoveryUri; offline snapshot paths or auth changes can reuse stale metadata.
+- MAINT: Event batch and document fetch paths buffer entire payloads (ReadAsStringAsync/ReadAsByteArrayAsync) with no size guard; large hubs can spike memory.
+- TEST: Coverage exists for token provider caching, metadata loader network/offline fallback, and OpenVEX fixture normalization.
+- TEST: Missing tests for event client batch parsing, connector fetch/dedupe/quarantine and digest mismatch handling, checkpoint save/load, metadata ETag 304/invalid payload handling, and token provider client_secret_post/invalid token responses.
+- Proposed changes (pending approval): enable TreatWarningsAsErrors; harden token and metadata cache keys; add payload size guards/streaming; add tests for event client, connector fetch/quarantine, checkpoint state, metadata 304/invalid payloads, and token provider auth schemes.
+- Disposition: pending implementation (non-test project; apply recommendations remain open)
+### src/Excititor/__Tests/StellaOps.Excititor.Connectors.SUSE.RancherVEXHub.Tests/StellaOps.Excititor.Connectors.SUSE.RancherVEXHub.Tests.csproj
+- MAINT: TreatWarningsAsErrors is set to false in the project file; warning discipline is relaxed.
+- MAINT: Connectors/RancherHubConnectorTests.cs is empty (0 bytes), so connector coverage is effectively missing.
+- MAINT: Normalizer fixtures create raw documents with DateTimeOffset.UtcNow and Guid.NewGuid; nondeterministic inputs reduce reproducibility.
+- TEST: Coverage exists for token provider caching, metadata loader network/offline fallback, and OpenVEX fixture normalization.
+- TEST: Missing tests for event client batch parsing, connector fetch/dedupe/quarantine and digest mismatch handling, checkpoint manager behavior, metadata ETag 304/invalid payload handling, and token provider client_secret_post/invalid token responses.
+- Disposition: waived (test project; no apply changes).
+### src/Excititor/__Libraries/StellaOps.Excititor.Connectors.Ubuntu.CSAF/StellaOps.Excititor.Connectors.Ubuntu.CSAF.csproj
+- MAINT: TreatWarningsAsErrors is set to false in the project file; warning discipline is relaxed.
+- MAINT: Connector state persists digest and ETag tokens indefinitely; state grows unbounded across runs.
+- MAINT: UbuntuCatalogLoader cache key uses IndexUri and channels only; offline snapshot path or PreferOfflineSnapshot changes can reuse stale metadata.
+- MAINT: Channel catalog SHA256 from the index is not validated; catalog integrity is unchecked.
+- MAINT: DownloadDocumentAsync buffers the entire payload with ReadAsByteArrayAsync and no size guard; large advisories can spike memory.
+- TEST: Coverage exists for catalog loader caching/offline snapshot, connector fetch with checksum/ETag handling, and CSAF normalizer fixtures.
+- TEST: Missing tests for catalog resources missing/invalid handling, invalid index JSON/offline snapshot missing when PreferOfflineSnapshot, and document download failure path.
+- Proposed changes (pending approval): enable TreatWarningsAsErrors; cap or trim state tokens; include offline snapshot options in the cache key; validate catalog SHA256 or log mismatches; add payload size guards; add tests for catalog error paths, offline snapshot missing, and download failures.
+- Disposition: pending implementation (non-test project; apply recommendations remain open)
+### src/Excititor/__Tests/StellaOps.Excititor.Connectors.Ubuntu.CSAF.Tests/StellaOps.Excititor.Connectors.Ubuntu.CSAF.Tests.csproj
+- MAINT: TreatWarningsAsErrors is set to false in the project file; warning discipline is relaxed.
+- MAINT: UbuntuCsafConnectorTests toggles process-wide STELLAOPS_CONNECTOR_SIGNER_METADATA_PATH; parallel runs can race.
+- MAINT: Normalizer fixtures create raw documents with DateTimeOffset.UtcNow and Guid.NewGuid; nondeterministic inputs reduce reproducibility.
+- TEST: Coverage exists for connector fetch with checksum/ETag handling, catalog loader caching/offline fallback, and CSAF normalizer fixtures.
+- TEST: Missing tests for catalog resources missing/invalid handling, PreferOfflineSnapshot missing snapshot error, and document download failure path.
+- Disposition: waived (test project; no apply changes).
+### src/Excititor/__Libraries/StellaOps.Excititor.Core/StellaOps.Excititor.Core.csproj
+- MAINT: TreatWarningsAsErrors is set to false in the project file; warning discipline is relaxed.
+- MAINT: InMemoryVexObservationStore.InsertManyAsync uses InsertAsync(...).Result, introducing sync-over-async and potential deadlocks. (`src/Excititor/__Libraries/StellaOps.Excititor.Core/Storage/InMemoryVexStores.cs`)
+- MAINT: InMemoryVexConnectorStateRepository and InMemoryAppendOnlyLinksetStore stamp DateTimeOffset.UtcNow directly; VexLinkset defaults/updates use UtcNow, which undermines deterministic test scenarios. (`src/Excititor/__Libraries/StellaOps.Excititor.Core/Storage/InMemoryVexStores.cs`, `src/Excititor/__Libraries/StellaOps.Excititor.Core/Observations/VexLinkset.cs`)
+- MAINT: ClaimScoreMerger uses DateTime.UtcNow/DateTimeOffset.UtcNow for merge timestamps and scoring cutoff; no time provider injection. (`src/Excititor/__Libraries/StellaOps.Excititor.Core/Lattice/ClaimScoreMerger.cs`)
+- MAINT: RiskFeedService uses DateTimeOffset.UtcNow for generatedAt and item retrieval; feed output is nondeterministic and time provider is not injectable. (`src/Excititor/__Libraries/StellaOps.Excititor.Core/RiskFeed/RiskFeedService.cs`)
+- MAINT: TimeBoxedConfidence.IsExpired/TimeRemaining uses DateTimeOffset.UtcNow even though manager uses TimeProvider, leading to inconsistent time semantics. (`src/Excititor/__Libraries/StellaOps.Excititor.Core/AutoVex/TimeBoxedConfidence.cs`)
+- TEST: Coverage exists for canonical JSON, policy binder/diagnostics, calibration, trust vectors, observations, AutoVex, and verification flows.
+- TEST: Missing tests for in-memory store behaviors (connector state/raw/linkset), RiskFeedService deterministic output, ClaimScoreMerger time handling, and TimeBoxedConfidence IsExpired/TimeRemaining with injected time.
+- Proposed changes (pending approval): enable TreatWarningsAsErrors; remove sync-over-async; add TimeProvider injection for time-stamped flows; add tests for in-memory stores, risk feed determinism, and claim score merging.
+- Disposition: pending implementation (non-test project; apply recommendations remain open)
+### src/Excititor/__Tests/StellaOps.Excititor.Core.Tests/StellaOps.Excititor.Core.Tests.csproj
+- MAINT: TreatWarningsAsErrors is set to false in the project file; warning discipline is relaxed.
+- MAINT: Multiple tests use DateTimeOffset.UtcNow and Guid.NewGuid in fixtures (AutoVex, Verification, PreservePrune, Observations), reducing determinism.
+- TEST: Coverage exists for canonical JSON, attestation payloads, policy diagnostics, calibration, lattice, observation queries, AutoVex, and verification.
+- TEST: Missing tests for in-memory store behaviors, RiskFeedService deterministic output, and ClaimScoreMerger time handling.
+- Disposition: waived (test project; no apply changes).
+### src/Excititor/__Tests/StellaOps.Excititor.Core.UnitTests/StellaOps.Excititor.Core.UnitTests.csproj
+- MAINT: TreatWarningsAsErrors is set to false in the project file; warning discipline is relaxed.
+- MAINT: Unit tests use DateTimeOffset.UtcNow and Guid.NewGuid in fixtures (timeline events, evidence attestor/locker, append-only linkset extraction, authority tenant seeding), reducing determinism.
+- MAINT: Test-local InMemoryAppendOnlyLinksetStore stamps mutation events with DateTimeOffset.UtcNow, making mutation log timing nondeterministic if asserted.
+- TEST: Coverage exists for timeline event normalization/validation, evidence attestation and locker manifests, chunk query shaping, linkset extraction and append-only behavior, advisory/product canonicalization, and tenant seeding helpers.
+- TEST: Missing tests for evidence attestor invalid statement/predicate type and base64 decode failures, evidence locker VerifyManifest false cases, and chunk truncation/ordering when results exceed limit.
+- Disposition: waived (test project; no apply changes).
+### src/Excititor/__Libraries/StellaOps.Excititor.Export/StellaOps.Excititor.Export.csproj
+- MAINT: TreatWarningsAsErrors is set to false in the project file; warning discipline is relaxed.
+- MAINT: VexExportEngine buffers exports into MemoryStream and copies with ToArray for artifact stores; large exports can double-buffer and spike memory.
+- MAINT: FileSystemArtifactStore derives stored locations via string Replace on the root path; repeated substrings can produce incorrect relative paths instead of using Path.GetRelativePath.
+- MAINT: OfflineBundleArtifactStore.WriteOfflineBundle performs synchronous writes and ignores cancellation; large bundles cannot be aborted cleanly.
+- MAINT: VexMirrorBundlePublisher reads existing bundle/manifest JSON without recovery; invalid JSON throws and aborts publishing for all domains.
+- TEST: Coverage exists for export caching/force refresh, artifact store saves (filesystem/offline/S3), mirror bundle output, and cache maintenance operations.
+- TEST: Missing tests for PortableEvidenceBundleBuilder and ReachabilityEvidenceEnricher behavior, FileSystem/Offline/S3 delete and open-read paths, mirror signing path and invalid bundle recovery, and ExportEngine missing exporter or artifact-store failure paths.
+- Proposed changes (pending approval): enable TreatWarningsAsErrors; stream exports or add size caps before buffering; use Path.GetRelativePath for stored locations; honor cancellation in offline bundle creation; add safe fallback/logging for invalid mirror JSON; add tests for builders/enricher, store delete/read, mirror signing, and exporter/store failure handling.
+- Disposition: pending implementation (non-test project; apply recommendations remain open)
+### src/Excititor/__Tests/StellaOps.Excititor.Export.Tests/StellaOps.Excititor.Export.Tests.csproj
+- MAINT: TreatWarningsAsErrors is set to false in the project file; warning discipline is relaxed.
+- MAINT: Tests use DateTimeOffset.UtcNow in ExportEngineTests and VexExportCacheServiceTests; nondeterministic inputs reduce reproducibility.
+- TEST: Coverage exists for export caching/force refresh, artifact store saves (filesystem/offline/S3), mirror bundle output, and cache maintenance operations.
+- TEST: Missing tests for PortableEvidenceBundleBuilder and ReachabilityEvidenceEnricher, artifact store delete/open-read and overwrite behaviors, mirror signing and invalid bundle/manifest recovery, and ExportEngine missing exporter or artifact-store failure paths.
+- Disposition: waived (test project; no apply changes).
+### src/Excititor/__Libraries/StellaOps.Excititor.Formats.CSAF/StellaOps.Excititor.Formats.CSAF.csproj
+- MAINT: TreatWarningsAsErrors is set to false in the project file; warning discipline is relaxed.
+- MAINT: CsafNormalizer.ParseDate uses DateTimeOffset.TryParse without invariant culture or roundtrip styles; parsing can be locale-sensitive and accept ambiguous inputs.
+- MAINT: CsafNormalizer parses JSON via JsonDocument.Parse(document.Content.ToArray()), which duplicates the payload; prefer the ReadOnlyMemory overload to avoid extra buffering.
+- TEST: Coverage exists for CSAF normalizer product/status mapping, Red Hat fixture parsing, missing justification diagnostics, and exporter deterministic output.
+- TEST: Missing tests for status precedence resolution, product group expansion, justification flags/conflicts and unsupported-status diagnostics, invalid JSON handling, tracking date ordering, and exporter behavior for non-CVE IDs or missing details.
+- Proposed changes (pending approval): enable TreatWarningsAsErrors; parse dates with invariant culture/roundtrip styles; avoid extra buffer copy; add tests for precedence, groups/flags, diagnostics, invalid JSON, and non-CVE exporter paths.
+- Disposition: pending implementation (non-test project; apply recommendations remain open)
+### src/Excititor/__Tests/StellaOps.Excititor.Formats.CSAF.Tests/StellaOps.Excititor.Formats.CSAF.Tests.csproj
+- MAINT: TreatWarningsAsErrors is not set in the project file; warning discipline is relaxed.
+- TEST: Coverage exists for CSAF exporter deterministic output, normalizer product/status mapping, Red Hat fixture parsing, and missing-justification diagnostics.
+- TEST: Missing tests for unsupported status/justification diagnostics, product group expansion, status precedence, invalid JSON handling, and exporter behavior for non-CVE IDs or missing detail.
+- Disposition: waived (test project; no apply changes).
+### src/Excititor/__Libraries/StellaOps.Excititor.Formats.CycloneDX/StellaOps.Excititor.Formats.CycloneDX.csproj
+- MAINT: TreatWarningsAsErrors is set to false in the project file; warning discipline is relaxed.
+- MAINT: CycloneDxExporter falls back to Guid.NewGuid when the query signature hash is missing/short, making serial numbers nondeterministic.
+- MAINT: CycloneDxNormalizer parses JSON via JsonDocument.Parse(document.Content.ToArray()), which duplicates the payload; prefer the ReadOnlyMemory overload to avoid extra buffering.
+- MAINT: CycloneDxNormalizer.ParseDate uses DateTimeOffset.TryParse without invariant culture or roundtrip styles; parsing can be locale-sensitive and accept ambiguous inputs.
+- TEST: Coverage exists for exporter output structure and severity mapping, normalizer analysis mapping/spec version normalization, and component reconciliation diagnostics.
+- TEST: Missing tests for deterministic serial number fallback behavior, component reconciliation when purl conflicts, unsupported analysis state/justification mapping, invalid JSON handling, externalReferences CPE parsing, and analysis response ordering.
+- Proposed changes (pending approval): enable TreatWarningsAsErrors; remove nondeterministic GUID fallback (use stable hash-based GUID or error); avoid extra buffer copy; parse dates with invariant culture/roundtrip styles; add tests for fallback serial number, reconciliation conflict, unsupported mappings, JSON errors, and external reference parsing.
+- Disposition: pending implementation (non-test project; apply recommendations remain open)
+### src/Excititor/__Tests/StellaOps.Excititor.Formats.CycloneDX.Tests/StellaOps.Excititor.Formats.CycloneDX.Tests.csproj
+- MAINT: TreatWarningsAsErrors is not set in the project file; warning discipline is relaxed.
+- MAINT: Component reconciliation tests use DateTimeOffset.UtcNow in fixtures; nondeterministic inputs reduce reproducibility.
+- TEST: Coverage exists for exporter output structure and severity mapping, normalizer analysis mapping/spec version normalization, and component reconciliation diagnostics.
+- TEST: Missing tests for unsupported analysis state/justification mapping, invalid JSON handling, externalReferences CPE parsing, analysis response ordering, and component reconciliation purl conflicts.
+- Disposition: waived (test project; no apply changes).
+### src/Excititor/__Libraries/StellaOps.Excititor.Formats.OpenVEX/StellaOps.Excititor.Formats.OpenVEX.csproj
+- MAINT: TreatWarningsAsErrors is set to false in the project file; warning discipline is relaxed.
+- MAINT: OpenVexNormalizer generates statement IDs with Guid.NewGuid when missing, making normalization nondeterministic.
+- MAINT: OpenVexStatementMerger uses DateTimeOffset.UtcNow for staleness, making merge output time-dependent; a TimeProvider would keep determinism.
+- MAINT: OpenVexNormalizer parses JSON via JsonDocument.Parse(document.Content.ToArray()), which duplicates the payload; prefer the ReadOnlyMemory overload to avoid extra buffering.
+- MAINT: OpenVexNormalizer.ParseDate uses DateTimeOffset.TryParse without invariant culture or roundtrip styles; parsing can be locale-sensitive and accept ambiguous inputs.
+- TEST: Coverage exists for OpenVEX exporter output, normalizer mapping, and statement merge conflict handling.
+- TEST: Missing tests for missing statement/product handling, deterministic ID generation, justification conflict diagnostics, trust-weight ordering, and invalid JSON handling.
+- Proposed changes (pending approval): enable TreatWarningsAsErrors; replace Guid.NewGuid with deterministic ID generation (hash of vuln+product+source); inject TimeProvider for merge staleness; avoid extra buffer copy; parse dates with invariant culture/roundtrip styles; add tests for ID fallback, conflict diagnostics, ordering, and invalid JSON.
+- Disposition: pending implementation (non-test project; apply recommendations remain open)
+### src/Excititor/__Tests/StellaOps.Excititor.Formats.OpenVEX.Tests/StellaOps.Excititor.Formats.OpenVEX.Tests.csproj
+- MAINT: TreatWarningsAsErrors is not set in the project file; warning discipline is relaxed.
+- MAINT: OpenVexStatementMergerTests uses DateTimeOffset.UtcNow in fixtures; nondeterministic inputs reduce reproducibility.
+- TEST: Coverage exists for OpenVEX exporter output, normalizer mapping, and statement merge conflict handling.
+- TEST: Missing tests for missing statement/product handling, deterministic ID generation, justification conflict diagnostics, trust-weight ordering, invalid JSON handling, and merge trace serialization.
+- Disposition: waived (test project; no apply changes).
## Notes
- Example projects waived at requester direction; APPLY tasks closed with no changes.
- APPLY tasks remain pending approval of proposed changes for non-example projects.
- Disposition: skipped (test project; no apply changes)
+
+
+
+
+
+
diff --git a/docs/implplan/SPRINT_20260102_001_BE_binary_delta_signatures.md b/docs/implplan/SPRINT_20260102_001_BE_binary_delta_signatures.md
new file mode 100644
index 000000000..c31b09be8
--- /dev/null
+++ b/docs/implplan/SPRINT_20260102_001_BE_binary_delta_signatures.md
@@ -0,0 +1,580 @@
+# SPRINT_20260102_001_BE_binary_delta_signatures.md
+
+## Sprint Overview
+
+| Field | Value |
+|-------|-------|
+| **Sprint ID** | SPRINT_20260102_001_BE |
+| **Title** | Binary Delta Signatures for Patch Detection |
+| **Working Directory** | `src/BinaryIndex/` |
+| **Duration** | 4-6 weeks |
+| **Dependencies** | None (foundational sprint) |
+| **Advisory Source** | `docs/product-advisories/30-Dec-2025 - Binary Diff Signatures for Patch Detection.md` |
+
+## Problem Statement
+
+Vulnerability scanners today rely on version string comparison to determine if a package is vulnerable. But Linux distributions (RHEL, Debian, Ubuntu, SUSE, Alpine) routinely **backport** security fixes into older versions without bumping the upstream version number.
+
+**Example:** OpenSSL 1.0.1e on RHEL 6 has Heartbleed patched, but upstream says `1.0.1e < 1.0.1g` (the fix version), so scanners flag it as vulnerable. This is **wrong**.
+
+**Solution:** Examine the compiled binary itself. Hash the normalized code of affected functions. Compare against known "patched" and "vulnerable" signatures. This provides **cryptographic proof** the fix is present.
+
+## Technical Design
+
+### Disassembly Engine Selection
+
+**Chosen: B2R2** (fully managed .NET, MIT license)
+
+Rationale:
+- **Purely managed (.NET)** - no P/Invoke, runs anywhere .NET runs
+- **Multi-format** - ELF, PE, Mach-O (covers Linux, Windows, macOS)
+- **Multi-ISA** - x86-64, ARM64 (covers server + Apple Silicon + ARM servers)
+- **MIT license** - compatible with AGPL-3.0
+- **Lifting capability** - can convert to IR for semantic normalization
+- **Performance** - Second fastest after Iced in benchmarks
+
+NuGet: `B2R2.FrontEnd.API` (targets net9.0, compatible with net10.0)
+
+### Architecture
+
+```
+┌─────────────────────────────────────────────────────────────────┐
+│ IDisassemblyEngine │
+│ (abstraction over disassembly - hides F# from C# consumers) │
+├─────────────────────────────────────────────────────────────────┤
+│ B2R2DisassemblyEngine │ (future) IcedDisassemblyEngine │
+│ - ELF/PE/Mach-O loading │ - x86-64 fast path only │
+│ - x86-64 + ARM64 │ │
+│ - IR lifting support │ │
+└─────────────────────────────────────────────────────────────────┘
+ │
+ ▼
+┌─────────────────────────────────────────────────────────────────┐
+│ INormalizationPipeline │
+│ Transforms raw instructions into deterministic, hashable form │
+├─────────────────────────────────────────────────────────────────┤
+│ Steps: │
+│ 1. Apply relocations │
+│ 2. Zero relocation targets / absolute addresses │
+│ 3. Canonicalize NOP sleds → single NOP │
+│ 4. Canonicalize PLT/GOT stubs → symbolic tokens │
+│ 5. Normalize jump tables (relative deltas) │
+│ 6. Zero padding bytes │
+└─────────────────────────────────────────────────────────────────┘
+ │
+ ▼
+┌─────────────────────────────────────────────────────────────────┐
+│ IDeltaSignatureGenerator │
+│ Produces deterministic signatures for functions/symbols │
+├─────────────────────────────────────────────────────────────────┤
+│ Outputs per symbol: │
+│ - hash_hex (SHA-256 of normalized bytes) │
+│ - size_bytes │
+│ - cfg_bb_count (basic block count) │
+│ - cfg_edge_hash (CFG structure hash) │
+│ - chunk_hashes (rolling 2KB window hashes for resilience) │
+└─────────────────────────────────────────────────────────────────┘
+```
+
+### Project Structure
+
+```
+src/BinaryIndex/
+├── __Libraries/
+│ ├── StellaOps.BinaryIndex.Disassembly/ # NEW - B2R2 wrapper
+│ │ ├── IDisassemblyEngine.cs
+│ │ ├── DisassembledInstruction.cs
+│ │ ├── CodeRegion.cs
+│ │ ├── BinaryInfo.cs
+│ │ └── B2R2/
+│ │ ├── B2R2DisassemblyEngine.cs
+│ │ ├── B2R2InstructionMapper.cs
+│ │ └── B2R2LiftingSupport.cs
+│ │
+│ ├── StellaOps.BinaryIndex.Normalization/ # NEW - Instruction normalization
+│ │ ├── INormalizationPipeline.cs
+│ │ ├── NormalizedFunction.cs
+│ │ ├── NormalizationOptions.cs
+│ │ ├── X64/
+│ │ │ ├── X64NormalizationPipeline.cs
+│ │ │ ├── X64AddressNormalizer.cs
+│ │ │ ├── X64NopCanonicalizer.cs
+│ │ │ └── X64PltGotNormalizer.cs
+│ │ └── Arm64/
+│ │ ├── Arm64NormalizationPipeline.cs
+│ │ └── Arm64AddressNormalizer.cs
+│ │
+│ ├── StellaOps.BinaryIndex.DeltaSig/ # NEW - Delta signature logic
+│ │ ├── IDeltaSignatureGenerator.cs
+│ │ ├── DeltaSignature.cs
+│ │ ├── SymbolSignature.cs
+│ │ ├── SignatureRecipe.cs
+│ │ ├── DeltaSignatureGenerator.cs
+│ │ ├── DeltaSignatureMatcher.cs
+│ │ └── Authoring/
+│ │ ├── SignatureAuthoringService.cs
+│ │ └── VulnPatchedPairExtractor.cs
+│ │
+│ ├── StellaOps.BinaryIndex.DeltaSig.Persistence/ # NEW - Storage
+│ │ ├── IDeltaSignatureStore.cs
+│ │ ├── DeltaSignatureEntity.cs
+│ │ └── Postgres/
+│ │ └── PostgresDeltaSignatureStore.cs
+│ │
+│ └── StellaOps.BinaryIndex.Fingerprints/ # EXISTING - extend
+│ └── Generators/
+│ └── BasicBlockFingerprintGenerator.cs # Refactor to use IDisassemblyEngine
+│
+├── __Tests/
+│ ├── StellaOps.BinaryIndex.Disassembly.Tests/
+│ │ ├── B2R2DisassemblyEngineTests.cs
+│ │ ├── Fixtures/
+│ │ │ ├── test_x64.elf # Small test ELF
+│ │ │ ├── test_arm64.elf
+│ │ │ └── test_x64.pe
+│ │ └── Properties/
+│ │ └── NormalizationPropertyTests.cs # FsCheck property tests
+│ │
+│ ├── StellaOps.BinaryIndex.DeltaSig.Tests/
+│ │ ├── DeltaSignatureGeneratorTests.cs
+│ │ ├── DeltaSignatureMatcherTests.cs
+│ │ └── Golden/
+│ │ └── openssl_heartbleed.golden.json # Known CVE signatures
+│ │
+│ └── StellaOps.BinaryIndex.Integration.Tests/
+│ └── EndToEndDeltaSigTests.cs
+│
+└── StellaOps.BinaryIndex.Cli/ # NEW - CLI commands
+ ├── Commands/
+ │ ├── ExtractCommand.cs
+ │ ├── AuthorCommand.cs
+ │ ├── SignCommand.cs
+ │ ├── VerifyCommand.cs
+ │ ├── MatchCommand.cs
+ │ ├── PackCommand.cs
+ │ └── InspectCommand.cs
+ └── Program.cs
+```
+
+### Database Schema
+
+```sql
+-- File: migrations/binaryindex/V001__delta_signatures.sql
+
+CREATE SCHEMA IF NOT EXISTS binaryindex;
+
+-- Delta signatures for CVE fixes
+CREATE TABLE binaryindex.delta_signature (
+ id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+
+ -- CVE identification
+ cve_id VARCHAR(20) NOT NULL,
+
+ -- Package targeting
+ package_name VARCHAR(255) NOT NULL,
+ soname VARCHAR(255),
+
+ -- Architecture targeting
+ arch VARCHAR(20) NOT NULL, -- x86_64, aarch64
+ abi VARCHAR(20) NOT NULL DEFAULT 'gnu', -- gnu, musl, android
+
+ -- Normalization recipe (for reproducibility)
+ recipe_id VARCHAR(50) NOT NULL, -- e.g., 'elf.delta.norm.v1'
+ recipe_version VARCHAR(10) NOT NULL, -- e.g., '1.0.0'
+
+ -- Symbol-level signature
+ symbol_name VARCHAR(255) NOT NULL,
+ scope VARCHAR(20) NOT NULL DEFAULT '.text', -- .text, .rodata
+
+ -- The signature hash
+ hash_alg VARCHAR(20) NOT NULL DEFAULT 'sha256',
+ hash_hex VARCHAR(64) NOT NULL,
+ size_bytes INT NOT NULL,
+
+ -- Enhanced signature data (optional, for resilience)
+ cfg_bb_count INT,
+ cfg_edge_hash VARCHAR(64),
+ chunk_hashes JSONB, -- Array of {offset, size, hash}
+
+ -- State: 'vulnerable' or 'patched'
+ signature_state VARCHAR(20) NOT NULL, -- 'vulnerable', 'patched'
+
+ -- Provenance
+ created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+ attestation_dsse BYTEA, -- DSSE envelope (optional)
+
+ -- Metadata
+ metadata JSONB,
+
+ CONSTRAINT uq_delta_sig_key UNIQUE (
+ cve_id, package_name, arch, abi, symbol_name,
+ recipe_version, signature_state
+ )
+);
+
+-- Indexes for efficient lookup
+CREATE INDEX idx_delta_sig_cve ON binaryindex.delta_signature(cve_id);
+CREATE INDEX idx_delta_sig_pkg ON binaryindex.delta_signature(package_name, soname);
+CREATE INDEX idx_delta_sig_hash ON binaryindex.delta_signature(hash_hex);
+CREATE INDEX idx_delta_sig_state ON binaryindex.delta_signature(signature_state);
+
+-- Signature packs (offline bundles)
+CREATE TABLE binaryindex.signature_pack (
+ id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+ pack_id VARCHAR(100) NOT NULL UNIQUE, -- e.g., 'stellaops-deltasig-2026-01'
+ schema_version VARCHAR(10) NOT NULL DEFAULT '1.0',
+ signature_count INT NOT NULL,
+ composite_digest VARCHAR(64) NOT NULL, -- SHA-256 of all signatures
+ created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+ attestation_dsse BYTEA,
+ metadata JSONB
+);
+
+-- Many-to-many: signatures in packs
+CREATE TABLE binaryindex.signature_pack_entry (
+ pack_id UUID NOT NULL REFERENCES binaryindex.signature_pack(id) ON DELETE CASCADE,
+ signature_id UUID NOT NULL REFERENCES binaryindex.delta_signature(id) ON DELETE CASCADE,
+ PRIMARY KEY (pack_id, signature_id)
+);
+```
+
+### Key Interfaces
+
+```csharp
+// src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Disassembly/IDisassemblyEngine.cs
+
+namespace StellaOps.BinaryIndex.Disassembly;
+
+///
+/// Abstraction over binary disassembly engines.
+/// Hides implementation details (B2R2's F#) from C# consumers.
+///
+public interface IDisassemblyEngine
+{
+ ///
+ /// Loads a binary from a stream and detects format/architecture.
+ ///
+ BinaryInfo LoadBinary(Stream stream, string? hint = null);
+
+ ///
+ /// Gets executable code regions (sections) from the binary.
+ ///
+ IEnumerable GetCodeRegions(BinaryInfo binary);
+
+ ///
+ /// Gets symbols (functions) from the binary.
+ ///
+ IEnumerable GetSymbols(BinaryInfo binary);
+
+ ///
+ /// Disassembles a code region to instructions.
+ ///
+ IEnumerable Disassemble(
+ BinaryInfo binary,
+ CodeRegion region);
+
+ ///
+ /// Disassembles a specific symbol/function.
+ ///
+ IEnumerable DisassembleSymbol(
+ BinaryInfo binary,
+ SymbolInfo symbol);
+
+ ///
+ /// Supported architectures.
+ ///
+ IReadOnlySet SupportedArchitectures { get; }
+
+ ///
+ /// Supported binary formats.
+ ///
+ IReadOnlySet SupportedFormats { get; }
+}
+
+public sealed record BinaryInfo(
+ string Format, // ELF, PE, MachO
+ string Architecture, // x86_64, aarch64
+ string? Abi, // gnu, musl
+ string? BuildId,
+ IReadOnlyDictionary Metadata);
+
+public sealed record CodeRegion(
+ string Name, // .text, .rodata
+ ulong VirtualAddress,
+ ulong FileOffset,
+ ulong Size,
+ bool IsExecutable,
+ bool IsReadable,
+ bool IsWritable);
+
+public sealed record SymbolInfo(
+ string Name,
+ ulong Address,
+ ulong Size,
+ SymbolType Type,
+ SymbolBinding Binding,
+ string? Section);
+
+public sealed record DisassembledInstruction(
+ ulong Address,
+ byte[] RawBytes,
+ string Mnemonic,
+ string OperandsText,
+ InstructionKind Kind,
+ IReadOnlyList Operands);
+
+public enum InstructionKind
+{
+ Unknown,
+ Arithmetic,
+ Logic,
+ Move,
+ Load,
+ Store,
+ Branch,
+ ConditionalBranch,
+ Call,
+ Return,
+ Nop,
+ Syscall,
+ Interrupt
+}
+```
+
+```csharp
+// src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.Normalization/INormalizationPipeline.cs
+
+namespace StellaOps.BinaryIndex.Normalization;
+
+///
+/// Normalizes disassembled instructions for deterministic hashing.
+/// Removes compiler/linker variance to enable cross-build comparison.
+///
+public interface INormalizationPipeline
+{
+ ///
+ /// Normalizes a sequence of instructions.
+ ///
+ NormalizedFunction Normalize(
+ IEnumerable instructions,
+ NormalizationOptions options);
+
+ ///
+ /// Gets the recipe identifier for this pipeline.
+ ///
+ string RecipeId { get; }
+
+ ///
+ /// Gets the recipe version.
+ ///
+ string RecipeVersion { get; }
+}
+
+public sealed record NormalizationOptions(
+ bool ZeroAbsoluteAddresses = true,
+ bool ZeroRelocations = true,
+ bool CanonicalizeNops = true,
+ bool CanonicalizePltGot = true,
+ bool CanonicalizeJumpTables = true,
+ bool ZeroPadding = true,
+ bool PreserveCallTargets = false);
+
+public sealed record NormalizedFunction(
+ string RecipeId,
+ string RecipeVersion,
+ ImmutableArray Instructions,
+ int OriginalSize,
+ int NormalizedSize);
+
+public sealed record NormalizedInstruction(
+ InstructionKind Kind,
+ string NormalizedMnemonic,
+ ImmutableArray Operands,
+ byte[] NormalizedBytes);
+```
+
+```csharp
+// src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.DeltaSig/IDeltaSignatureGenerator.cs
+
+namespace StellaOps.BinaryIndex.DeltaSig;
+
+///
+/// Generates delta signatures from normalized functions.
+///
+public interface IDeltaSignatureGenerator
+{
+ ///
+ /// Generates a signature for a single symbol.
+ ///
+ SymbolSignature GenerateSymbolSignature(
+ NormalizedFunction function,
+ string symbolName,
+ string scope,
+ SignatureOptions? options = null);
+
+ ///
+ /// Generates signatures for multiple symbols in a binary.
+ ///
+ Task GenerateSignaturesAsync(
+ Stream binaryStream,
+ DeltaSignatureRequest request,
+ CancellationToken ct = default);
+}
+
+public sealed record DeltaSignatureRequest(
+ string Cve,
+ string Package,
+ string? Soname,
+ string Arch,
+ string Abi,
+ IReadOnlyList TargetSymbols,
+ string SignatureState, // 'vulnerable' or 'patched'
+ SignatureOptions? Options = null);
+
+public sealed record SignatureOptions(
+ bool IncludeCfg = true,
+ bool IncludeChunks = true,
+ int ChunkSize = 2048);
+
+public sealed record DeltaSignature(
+ string Schema, // "stellaops.deltasig.v1"
+ string Cve,
+ PackageRef Package,
+ TargetRef Target,
+ NormalizationRef Normalization,
+ string SignatureState,
+ ImmutableArray Symbols);
+
+public sealed record PackageRef(string Name, string? Soname);
+public sealed record TargetRef(string Arch, string Abi);
+public sealed record NormalizationRef(string RecipeId, string RecipeVersion, ImmutableArray Steps);
+
+public sealed record SymbolSignature(
+ string Name,
+ string Scope,
+ string HashAlg,
+ string HashHex,
+ int SizeBytes,
+ int? CfgBbCount,
+ string? CfgEdgeHash,
+ ImmutableArray? Chunks);
+
+public sealed record ChunkHash(int Offset, int Size, string HashHex);
+```
+
+### CLI Commands
+
+```
+stella deltasig extract
+ --binary Path to ELF/PE/Mach-O binary
+ --symbols Comma-separated symbol names to extract
+ --arch Architecture hint (x86_64, aarch64)
+ --out Output JSON path
+ [--json] Machine-readable output
+
+stella deltasig author
+ --vuln Path to vulnerable binary
+ --patched Path to patched binary
+ --cve CVE identifier
+ --package Package name
+ [--soname ] Shared object name
+ --arch Architecture
+ [--abi ] ABI (default: gnu)
+ --out Output directory for signature payloads
+
+stella deltasig sign
+ --in Input payload JSON
+ --key Private key PEM
+ --out Output DSSE envelope
+ [--alg ] Algorithm (ecdsa-p256-sha256, rsa-pss-sha256)
+
+stella deltasig verify
+ --in Input DSSE envelope
+ --pub Public key PEM
+
+stella deltasig match
+ --binary Binary to check
+ --sigpack Signature pack (ZIP) or directory
+ [--cve ] Filter to specific CVE
+ [--json] Machine-readable output
+
+stella deltasig pack
+ --in-dir Directory containing *.dsse.json
+ --out Output ZIP path
+
+stella deltasig inspect
+ --in Payload or envelope to inspect
+```
+
+## Delivery Tracker
+
+| Task ID | Description | Status | Assignee | Notes |
+|---------|-------------|--------|----------|-------|
+| **DS-001** | Create `StellaOps.BinaryIndex.Disassembly` project | TODO | | |
+| **DS-002** | Add B2R2.FrontEnd.API NuGet reference | TODO | | net9.0 compatible with net10.0 |
+| **DS-003** | Implement `IDisassemblyEngine` interface | TODO | | |
+| **DS-004** | Implement `B2R2DisassemblyEngine` | TODO | | Wrap F# in C# facade |
+| **DS-005** | Add x86-64 instruction decoding | TODO | | |
+| **DS-006** | Add ARM64 instruction decoding | TODO | | |
+| **DS-007** | Add ELF format support | TODO | | |
+| **DS-008** | Add PE format support | TODO | | Lower priority |
+| **DS-009** | Add Mach-O format support | TODO | | Lower priority |
+| **DS-010** | Create `StellaOps.BinaryIndex.Normalization` project | TODO | | |
+| **DS-011** | Implement `INormalizationPipeline` interface | TODO | | |
+| **DS-012** | Implement `X64NormalizationPipeline` | TODO | | |
+| **DS-013** | Implement `Arm64NormalizationPipeline` | TODO | | |
+| **DS-014** | Implement address/relocation zeroing | TODO | | |
+| **DS-015** | Implement NOP canonicalization | TODO | | |
+| **DS-016** | Implement PLT/GOT normalization | TODO | | |
+| **DS-017** | Create `StellaOps.BinaryIndex.DeltaSig` project | TODO | | |
+| **DS-018** | Implement `IDeltaSignatureGenerator` | TODO | | |
+| **DS-019** | Implement `DeltaSignatureMatcher` | TODO | | |
+| **DS-020** | Implement CFG extraction | TODO | | |
+| **DS-021** | Implement rolling chunk hashes | TODO | | |
+| **DS-022** | Create `StellaOps.BinaryIndex.DeltaSig.Persistence` | TODO | | |
+| **DS-023** | Add PostgreSQL schema migration | TODO | | |
+| **DS-024** | Implement `PostgresDeltaSignatureStore` | TODO | | |
+| **DS-025** | Create `StellaOps.BinaryIndex.Cli` project | TODO | | |
+| **DS-026** | Implement `extract` command | TODO | | |
+| **DS-027** | Implement `author` command | TODO | | |
+| **DS-028** | Implement `sign` command | TODO | | Reuse Attestor DSSE |
+| **DS-029** | Implement `verify` command | TODO | | |
+| **DS-030** | Implement `match` command | TODO | | |
+| **DS-031** | Implement `pack` command | TODO | | |
+| **DS-032** | Implement `inspect` command | TODO | | |
+| **DS-033** | Refactor `BasicBlockFingerprintGenerator` to use `IDisassemblyEngine` | TODO | | |
+| **DS-034** | Unit tests for B2R2 wrapper | TODO | | |
+| **DS-035** | Unit tests for normalization | TODO | | |
+| **DS-036** | Unit tests for signature generation | TODO | | |
+| **DS-037** | Property tests for normalization idempotency | TODO | | FsCheck |
+| **DS-038** | Golden tests with known CVE signatures | TODO | | Heartbleed, etc. |
+| **DS-039** | Integration tests end-to-end | TODO | | |
+| **DS-040** | Scanner integration (match service) | TODO | | |
+| **DS-041** | VEX evidence emission for backport detection | TODO | | |
+| **DS-042** | Documentation: AGENTS.md for BinaryIndex | TODO | | |
+| **DS-043** | Documentation: Architecture decision record | TODO | | |
+
+## Decisions & Risks
+
+| ID | Decision/Risk | Status | Notes |
+|----|---------------|--------|-------|
+| D-001 | Use B2R2 as primary disassembly engine | DECIDED | Fully managed, multi-arch, MIT license |
+| D-002 | Wrap B2R2 F# in C# facade | DECIDED | Hide F# from rest of codebase |
+| D-003 | Store signatures in PostgreSQL | DECIDED | Consistent with rest of platform |
+| D-004 | Support offline signature packs | DECIDED | Critical for air-gapped deployments |
+| R-001 | B2R2 is F# - may have learning curve | OPEN | Mitigated by thin wrapper |
+| R-002 | Compiler optimization variance | OPEN | Mitigated by rolling chunk hashes |
+| R-003 | LTO may change function layout | OPEN | Require multiple signature variants |
+
+## Execution Log
+
+| Date | Event | Notes |
+|------|-------|-------|
+| 2026-01-02 | Sprint created | Based on product advisory analysis |
+
+## References
+
+- [B2R2 GitHub](https://github.com/B2R2-org/B2R2)
+- [B2R2 NuGet](https://www.nuget.org/packages/B2R2.FrontEnd.API/)
+- [Product Advisory: Binary Diff Signatures](../product-advisories/30-Dec-2025%20-%20Binary%20Diff%20Signatures%20for%20Patch%20Detection.md)
+- [Product Advisory: Golden Set for Patch Validation](../product-advisories/30-Dec-2025%20-%20Building%20a%20Golden%20Set%20for%20Patch%20Validation.md)
diff --git a/docs/implplan/SPRINT_20260102_002_BE_intoto_link_generation.md b/docs/implplan/SPRINT_20260102_002_BE_intoto_link_generation.md
new file mode 100644
index 000000000..6220488c7
--- /dev/null
+++ b/docs/implplan/SPRINT_20260102_002_BE_intoto_link_generation.md
@@ -0,0 +1,473 @@
+# SPRINT_20260102_002_BE_intoto_link_generation.md
+
+## Sprint Overview
+
+| Field | Value |
+|-------|-------|
+| **Sprint ID** | SPRINT_20260102_002_BE |
+| **Title** | in-toto Link Generation for Supply Chain Provenance |
+| **Working Directory** | `src/Attestor/` |
+| **Duration** | 2-3 weeks |
+| **Dependencies** | Existing DSSE infrastructure (complete) |
+| **Advisory Source** | `docs/product-advisories/02-Dec-2025 - Designing offline DSSE + in‑toto attestations.md` |
+
+## Problem Statement
+
+StellaOps has robust DSSE signing and verification infrastructure, but lacks **in-toto link generation**. in-toto links record the **materials** (inputs), **products** (outputs), and **command** executed for each step in a supply chain. This is required for:
+
+1. **SLSA compliance** - SLSA levels require provenance attestations
+2. **Supply chain transparency** - Prove what went into a build/scan
+3. **Audit trails** - Forensic analysis of build processes
+4. **Policy enforcement** - Verify required steps were executed by authorized functionaries
+
+### Current State
+
+| Component | Status |
+|-----------|--------|
+| DSSE signing | ✅ Complete - Multiple implementations |
+| DSSE verification | ✅ Complete - Offline capable |
+| Rekor integration | ✅ Complete - Offline receipts supported |
+| in-toto link generation | ❌ Missing |
+| in-toto layout verification | ❌ Missing |
+
+## Technical Design
+
+### in-toto Link Predicate
+
+Following the [in-toto attestation spec](https://github.com/in-toto/attestation/blob/main/spec/predicates/link.md):
+
+```json
+{
+ "_type": "https://in-toto.io/Statement/v1",
+ "subject": [
+ {
+ "name": "sbom.cdx.json",
+ "digest": { "sha256": "abc123..." }
+ }
+ ],
+ "predicateType": "https://in-toto.io/Link/v1",
+ "predicate": {
+ "name": "scan",
+ "command": ["stella", "scan", "--image", "nginx:1.25"],
+ "materials": [
+ {
+ "uri": "oci://docker.io/library/nginx@sha256:...",
+ "digest": { "sha256": "..." }
+ }
+ ],
+ "products": [
+ {
+ "uri": "file://sbom.cdx.json",
+ "digest": { "sha256": "..." }
+ },
+ {
+ "uri": "file://vulns.json",
+ "digest": { "sha256": "..." }
+ }
+ ],
+ "byproducts": {
+ "return-value": 0,
+ "stderr": "",
+ "stdout": ""
+ },
+ "environment": {
+ "STELLAOPS_VERSION": "2026.01",
+ "SCANNER_VERSION": "1.5.0"
+ }
+ }
+}
+```
+
+### Architecture
+
+```
+┌─────────────────────────────────────────────────────────────────┐
+│ ILinkRecorder │
+│ Records step execution and emits in-toto link predicates │
+├─────────────────────────────────────────────────────────────────┤
+│ Methods: │
+│ - RecordStepAsync(stepName, action, materials, products) │
+│ - AddMaterial(uri, digest) │
+│ - AddProduct(uri, digest) │
+│ - SetCommand(args) │
+│ - SetEnvironment(vars) │
+│ - FinalizeLink() -> InTotoLink │
+└─────────────────────────────────────────────────────────────────┘
+ │
+ ▼
+┌─────────────────────────────────────────────────────────────────┐
+│ IAttestationSigningService │
+│ (EXISTING) - Signs link as DSSE envelope │
+└─────────────────────────────────────────────────────────────────┘
+ │
+ ▼
+┌─────────────────────────────────────────────────────────────────┐
+│ ILayoutVerifier │
+│ Verifies link chains against in-toto layouts │
+├─────────────────────────────────────────────────────────────────┤
+│ Methods: │
+│ - Verify(layout, links, trustedKeys) -> VerificationResult │
+│ - ValidateStepOrder(links, layout) │
+│ - ValidateFunctionaries(links, layout) │
+│ - ValidateMaterialProductChain(links) │
+└─────────────────────────────────────────────────────────────────┘
+```
+
+### Project Structure
+
+```
+src/Attestor/
+├── StellaOps.Attestor/
+│ └── StellaOps.Attestor.Core/
+│ ├── InToto/ # NEW
+│ │ ├── ILinkRecorder.cs
+│ │ ├── InTotoLink.cs
+│ │ ├── InTotoLinkPredicate.cs
+│ │ ├── InTotoMaterial.cs
+│ │ ├── InTotoProduct.cs
+│ │ ├── LinkRecorder.cs
+│ │ ├── LinkBuilder.cs
+│ │ └── Layout/
+│ │ ├── ILayoutVerifier.cs
+│ │ ├── InTotoLayout.cs
+│ │ ├── LayoutStep.cs
+│ │ ├── LayoutVerifier.cs
+│ │ └── LayoutVerificationResult.cs
+│ │
+│ └── Signing/
+│ └── DsseSigningService.cs # EXISTING - reuse
+│
+├── StellaOps.Attestor.Infrastructure/
+│ └── InToto/ # NEW
+│ ├── FileSystemLinkRecorder.cs # Computes digests from files
+│ └── StreamLinkRecorder.cs # Computes digests from streams
+│
+└── StellaOps.Attestor.Core.Tests/
+ └── InToto/ # NEW
+ ├── LinkRecorderTests.cs
+ ├── LinkBuilderTests.cs
+ ├── LayoutVerifierTests.cs
+ └── Fixtures/
+ ├── sample_link.json
+ └── sample_layout.json
+```
+
+### Key Interfaces
+
+```csharp
+// src/Attestor/StellaOps.Attestor/StellaOps.Attestor.Core/InToto/ILinkRecorder.cs
+
+namespace StellaOps.Attestor.Core.InToto;
+
+///
+/// Records supply chain step execution as an in-toto link.
+/// Use this to capture materials, products, and execution metadata.
+///
+public interface ILinkRecorder
+{
+ ///
+ /// Records a step execution and produces an in-toto link.
+ ///
+ /// Name of the step (e.g., "scan", "build", "sign")
+ /// The action to execute
+ /// Paths/URIs to input files
+ /// Paths/URIs to output files
+ /// Cancellation token
+ /// The recorded in-toto link
+ Task RecordStepAsync(
+ string stepName,
+ Func> action,
+ IEnumerable materials,
+ IEnumerable products,
+ CancellationToken ct = default);
+
+ ///
+ /// Records a step without executing an action (for external steps).
+ ///
+ Task RecordExternalStepAsync(
+ string stepName,
+ IEnumerable command,
+ int returnValue,
+ IEnumerable materials,
+ IEnumerable products,
+ CancellationToken ct = default);
+}
+
+///
+/// Specification for a material (input).
+///
+public sealed record MaterialSpec(
+ string Uri,
+ string? LocalPath = null, // If set, compute digest from file
+ ArtifactDigests? Digest = null); // If set, use provided digest
+
+///
+/// Specification for a product (output).
+///
+public sealed record ProductSpec(
+ string Uri,
+ string? LocalPath = null,
+ ArtifactDigests? Digest = null);
+
+///
+/// Cryptographic digests for an artifact.
+///
+public sealed record ArtifactDigests(
+ string? Sha256 = null,
+ string? Sha512 = null,
+ string? Sha1 = null);
+```
+
+```csharp
+// src/Attestor/StellaOps.Attestor/StellaOps.Attestor.Core/InToto/InTotoLink.cs
+
+namespace StellaOps.Attestor.Core.InToto;
+
+///
+/// An in-toto link attestation.
+///
+public sealed record InTotoLink
+{
+ public const string StatementType = "https://in-toto.io/Statement/v1";
+ public const string PredicateType = "https://in-toto.io/Link/v1";
+
+ ///
+ /// Subject artifacts (products of this step).
+ ///
+ public required ImmutableArray Subjects { get; init; }
+
+ ///
+ /// The link predicate containing step details.
+ ///
+ public required InTotoLinkPredicate Predicate { get; init; }
+
+ ///
+ /// Serializes to in-toto statement JSON.
+ ///
+ public string ToJson(bool indented = false);
+
+ ///
+ /// Parses from in-toto statement JSON.
+ ///
+ public static InTotoLink FromJson(string json);
+}
+
+public sealed record InTotoSubject(
+ string Name,
+ ArtifactDigests Digest);
+
+public sealed record InTotoLinkPredicate(
+ string Name,
+ ImmutableArray Command,
+ ImmutableArray Materials,
+ ImmutableArray Products,
+ InTotoByProducts ByProducts,
+ ImmutableDictionary Environment);
+
+public sealed record InTotoMaterial(
+ string Uri,
+ ArtifactDigests Digest);
+
+public sealed record InTotoProduct(
+ string Uri,
+ ArtifactDigests Digest);
+
+public sealed record InTotoByProducts(
+ int ReturnValue,
+ string? Stdout = null,
+ string? Stderr = null);
+```
+
+```csharp
+// src/Attestor/StellaOps.Attestor/StellaOps.Attestor.Core/InToto/Layout/ILayoutVerifier.cs
+
+namespace StellaOps.Attestor.Core.InToto.Layout;
+
+///
+/// Verifies in-toto link chains against layouts.
+///
+public interface ILayoutVerifier
+{
+ ///
+ /// Verifies that links satisfy the layout constraints.
+ ///
+ /// The layout defining required steps and rules
+ /// The links to verify
+ /// Trusted functionary public keys
+ /// Verification result with details
+ LayoutVerificationResult Verify(
+ InTotoLayout layout,
+ IEnumerable links,
+ IEnumerable trustedKeys);
+}
+
+public sealed record SignedLink(
+ InTotoLink Link,
+ DsseEnvelope Envelope,
+ string SignerKeyId);
+
+public sealed record TrustedKey(
+ string KeyId,
+ string PublicKeyPem,
+ ImmutableHashSet AllowedSteps);
+
+public sealed record LayoutVerificationResult(
+ bool Success,
+ ImmutableArray Violations,
+ ImmutableArray VerifiedSteps,
+ ImmutableDictionary StepToFunctionary);
+
+public sealed record LayoutViolation(
+ string StepName,
+ LayoutViolationType Type,
+ string Message);
+
+public enum LayoutViolationType
+{
+ MissingStep,
+ UnauthorizedFunctionary,
+ InvalidSignature,
+ MaterialMismatch,
+ ProductMismatch,
+ ThresholdNotMet
+}
+```
+
+### Integration Points
+
+#### Scanner Integration
+
+```csharp
+// Example: Scanner emits link for scan operation
+
+public class ScanService
+{
+ private readonly ILinkRecorder _linkRecorder;
+ private readonly IAttestationSigningService _signer;
+
+ public async Task ScanWithProvenanceAsync(
+ string imageRef,
+ ScanOptions options,
+ CancellationToken ct)
+ {
+ var materials = new[]
+ {
+ new MaterialSpec($"oci://{imageRef}")
+ };
+
+ var sbomPath = Path.GetTempFileName();
+ var vulnsPath = Path.GetTempFileName();
+
+ var products = new[]
+ {
+ new ProductSpec("file://sbom.cdx.json", sbomPath),
+ new ProductSpec("file://vulns.json", vulnsPath)
+ };
+
+ // Record the scan step
+ var link = await _linkRecorder.RecordStepAsync(
+ stepName: "scan",
+ action: async () =>
+ {
+ var result = await PerformScanAsync(imageRef, options, sbomPath, vulnsPath, ct);
+ return result.ExitCode;
+ },
+ materials: materials,
+ products: products,
+ ct: ct);
+
+ // Sign as DSSE
+ var envelope = await _signer.SignAsync(
+ payloadType: InTotoLink.PredicateType,
+ payload: Encoding.UTF8.GetBytes(link.ToJson()),
+ ct: ct);
+
+ return new ScanResult
+ {
+ Sbom = await File.ReadAllTextAsync(sbomPath, ct),
+ Vulnerabilities = await File.ReadAllTextAsync(vulnsPath, ct),
+ ProvenanceLink = link,
+ SignedEnvelope = envelope
+ };
+ }
+}
+```
+
+#### Attestor WebService Integration
+
+```
+POST /api/v1/attestor/links
+Content-Type: application/json
+
+{
+ "stepName": "build",
+ "command": ["make", "release"],
+ "materials": [
+ {"uri": "git://github.com/org/repo@abc123", "digest": {"sha256": "..."}}
+ ],
+ "products": [
+ {"uri": "file://dist/app.tar.gz", "digest": {"sha256": "..."}}
+ ],
+ "returnValue": 0
+}
+
+Response:
+{
+ "link": { ... },
+ "envelope": { ... },
+ "rekorEntry": { ... }
+}
+```
+
+## Delivery Tracker
+
+| Task ID | Description | Status | Assignee | Notes |
+|---------|-------------|--------|----------|-------|
+| **IT-001** | Create `InToto/` directory structure in Attestor.Core | TODO | | |
+| **IT-002** | Define `ILinkRecorder` interface | TODO | | |
+| **IT-003** | Define `InTotoLink` and related models | TODO | | |
+| **IT-004** | Define `InTotoLinkPredicate` model | TODO | | |
+| **IT-005** | Implement `LinkRecorder` | TODO | | |
+| **IT-006** | Implement `LinkBuilder` (fluent API) | TODO | | |
+| **IT-007** | Implement digest computation for files | TODO | | SHA-256, SHA-512 |
+| **IT-008** | Implement `FileSystemLinkRecorder` | TODO | | |
+| **IT-009** | Implement `StreamLinkRecorder` | TODO | | |
+| **IT-010** | Define `ILayoutVerifier` interface | TODO | | |
+| **IT-011** | Define `InTotoLayout` model | TODO | | |
+| **IT-012** | Implement `LayoutVerifier` | TODO | | |
+| **IT-013** | Implement step order validation | TODO | | |
+| **IT-014** | Implement functionary validation | TODO | | |
+| **IT-015** | Implement material/product chain validation | TODO | | |
+| **IT-016** | Implement threshold verification | TODO | | |
+| **IT-017** | Unit tests for `LinkRecorder` | TODO | | |
+| **IT-018** | Unit tests for `LinkBuilder` | TODO | | |
+| **IT-019** | Unit tests for `LayoutVerifier` | TODO | | |
+| **IT-020** | Integration with `IAttestationSigningService` | TODO | | |
+| **IT-021** | Scanner integration | TODO | | Emit links for scans |
+| **IT-022** | Attestor WebService endpoint | TODO | | POST /api/v1/attestor/links |
+| **IT-023** | CLI command: `stella attestor link` | TODO | | |
+| **IT-024** | Documentation: in-toto usage guide | TODO | | |
+| **IT-025** | Golden tests with reference in-toto links | TODO | | |
+
+## Decisions & Risks
+
+| ID | Decision/Risk | Status | Notes |
+|----|---------------|--------|-------|
+| D-001 | Use in-toto attestation spec v1 | DECIDED | Current stable version |
+| D-002 | DSSE as envelope format | DECIDED | Consistent with existing infrastructure |
+| D-003 | Layout verification is optional phase | DECIDED | Links first, layouts second |
+| R-001 | Layout complexity | OPEN | Start with simple single-step layouts |
+| R-002 | Key management for functionaries | OPEN | Reuse existing Authority key management |
+
+## Execution Log
+
+| Date | Event | Notes |
+|------|-------|-------|
+| 2026-01-02 | Sprint created | Based on product advisory analysis |
+
+## References
+
+- [in-toto Specification](https://github.com/in-toto/attestation)
+- [in-toto Link Predicate](https://github.com/in-toto/attestation/blob/main/spec/predicates/link.md)
+- [SLSA Provenance](https://slsa.dev/provenance/v1)
+- [Product Advisory: Offline DSSE + in-toto](../product-advisories/02-Dec-2025%20-%20Designing%20offline%20DSSE%20+%20in‑toto%20attestations.md)
diff --git a/docs/implplan/SPRINT_20260102_003_BE_vex_proof_objects.md b/docs/implplan/SPRINT_20260102_003_BE_vex_proof_objects.md
new file mode 100644
index 000000000..d4865c78a
--- /dev/null
+++ b/docs/implplan/SPRINT_20260102_003_BE_vex_proof_objects.md
@@ -0,0 +1,588 @@
+# SPRINT_20260102_003_BE_vex_proof_objects.md
+
+## Sprint Overview
+
+| Field | Value |
+|-------|-------|
+| **Sprint ID** | SPRINT_20260102_003_BE |
+| **Title** | VEX Proof Objects and Dependency Propagation |
+| **Working Directory** | `src/VexLens/`, `src/Policy/` |
+| **Duration** | 2-3 weeks |
+| **Dependencies** | VexLens consensus engine (complete) |
+| **Advisory Source** | `docs/product-advisories/30-Dec-2025 - Designing a Deterministic VEX Resolver.md` |
+
+## Problem Statement
+
+VexLens produces verdicts but **doesn't emit the full trace of how it got there**. For audits, compliance, and reproducibility, we need:
+
+1. **Proof Objects** - Complete record of inputs, conditions, merge steps, and graph paths
+2. **Propagation Rules** - Explicit rules for transitive impact (if dependency affected, is product affected?)
+3. **Condition Evaluation** - Deterministic handling of platform, build flags, and feature context
+
+### Current State
+
+| Component | Status |
+|-----------|--------|
+| Lattice-based consensus | ✅ Complete - 4 modes, conflict detection |
+| Trust weighting | ✅ Complete - Issuer, signature, freshness, format |
+| VexConsensusResult | ⚠️ Partial - Has rationale but not full proof |
+| Proof objects | ❌ Missing |
+| Propagation rules | ❌ Missing |
+| Condition evaluation | ❌ Missing |
+
+## Technical Design
+
+### VEX Proof Object Schema
+
+```json
+{
+ "schema": "stellaops.vex-proof.v1",
+ "proofId": "proof-2026-01-02T10:30:00Z-abc123",
+ "computedAt": "2026-01-02T10:30:00Z",
+
+ "verdict": {
+ "vulnerabilityId": "CVE-2023-12345",
+ "productKey": "pkg:npm/lodash@4.17.21",
+ "status": "not_affected",
+ "justification": "vulnerable_code_not_in_execute_path",
+ "confidence": 0.78
+ },
+
+ "inputs": {
+ "statements": [
+ {
+ "id": "stmt-001",
+ "source": "openvex",
+ "issuer": {
+ "id": "lodash-maintainers",
+ "category": "vendor",
+ "trustTier": "high"
+ },
+ "status": "not_affected",
+ "justification": "vulnerable_code_not_in_execute_path",
+ "weight": {
+ "composite": 0.85,
+ "factors": {
+ "issuer": 0.90,
+ "signature": 1.00,
+ "freshness": 0.95,
+ "format": 1.00,
+ "specificity": 0.70
+ }
+ },
+ "timestamp": "2023-06-15T10:30:00Z",
+ "signatureVerified": true
+ },
+ {
+ "id": "stmt-002",
+ "source": "nvd",
+ "issuer": {
+ "id": "nvd",
+ "category": "aggregator",
+ "trustTier": "medium"
+ },
+ "status": "affected",
+ "weight": {
+ "composite": 0.60,
+ "factors": {
+ "issuer": 0.70,
+ "signature": 0.50,
+ "freshness": 0.80,
+ "format": 0.95,
+ "specificity": 0.50
+ }
+ },
+ "timestamp": "2023-06-10T00:00:00Z",
+ "signatureVerified": false
+ }
+ ],
+ "context": {
+ "platform": "linux/amd64",
+ "distro": null,
+ "features": ["esm"],
+ "buildFlags": [],
+ "evaluationTime": "2026-01-02T10:30:00Z"
+ }
+ },
+
+ "resolution": {
+ "mode": "lattice",
+ "qualifiedStatements": 2,
+ "disqualifiedStatements": 0,
+ "disqualificationReasons": [],
+
+ "latticeComputation": {
+ "ordering": ["unknown", "under_investigation", "affected", "fixed", "not_affected"],
+ "mergeSteps": [
+ {
+ "step": 1,
+ "statementId": "stmt-001",
+ "inputPosition": "not_affected",
+ "weight": 0.85,
+ "action": "initialize"
+ },
+ {
+ "step": 2,
+ "statementId": "stmt-002",
+ "inputPosition": "affected",
+ "weight": 0.60,
+ "action": "merge",
+ "conflict": true,
+ "resolution": "higher_weight_wins",
+ "resultPosition": "not_affected"
+ }
+ ],
+ "finalPosition": "not_affected"
+ },
+
+ "conflictAnalysis": {
+ "hasConflicts": true,
+ "conflicts": [
+ {
+ "statementA": "stmt-001",
+ "statementB": "stmt-002",
+ "statusA": "not_affected",
+ "statusB": "affected",
+ "severity": "high",
+ "resolution": "weight_based",
+ "winner": "stmt-001"
+ }
+ ],
+ "conflictPenalty": 0.10
+ }
+ },
+
+ "propagation": {
+ "applied": true,
+ "rules": [
+ {
+ "ruleId": "direct-dependency-affected",
+ "description": "If direct dependency is affected, product inherits affected unless overridden",
+ "triggered": false
+ }
+ ],
+ "graphPaths": [
+ {
+ "root": "pkg:npm/my-app@1.0.0",
+ "path": ["lodash@4.17.21"],
+ "pathType": "direct_dependency",
+ "depth": 1
+ }
+ ],
+ "inheritedStatus": null,
+ "overrideApplied": false
+ },
+
+ "conditions": {
+ "evaluated": [
+ {
+ "conditionId": "platform-linux",
+ "expression": "platform == 'linux/*'",
+ "result": true,
+ "contextValue": "linux/amd64"
+ }
+ ],
+ "unevaluated": [],
+ "unknownCount": 0
+ },
+
+ "confidence": {
+ "score": 0.78,
+ "tier": "high",
+ "breakdown": {
+ "weightSpread": 0.85,
+ "conflictPenalty": -0.10,
+ "freshnessBonus": 0.03,
+ "signatureBonus": 0.05,
+ "conditionCoverage": 1.00
+ },
+ "improvements": [
+ {
+ "factor": "runtime",
+ "action": "Add runtime signal observation",
+ "potentialGain": 0.10
+ }
+ ]
+ },
+
+ "digest": "sha256:abc123..."
+}
+```
+
+### Architecture
+
+```
+┌─────────────────────────────────────────────────────────────────┐
+│ VexConsensusEngine │
+│ (EXISTING) - Extended to emit VexProof alongside verdict │
+├─────────────────────────────────────────────────────────────────┤
+│ Changes: │
+│ - ComputeConsensusAsync returns VexResolutionResult │
+│ - VexResolutionResult contains (Verdict, Proof, Conflicts) │
+│ - Each merge step recorded in proof │
+└─────────────────────────────────────────────────────────────────┘
+ │
+ ▼
+┌─────────────────────────────────────────────────────────────────┐
+│ IPropagationRuleEngine │
+│ Computes transitive impact through dependency graph │
+├─────────────────────────────────────────────────────────────────┤
+│ Rules: │
+│ - DirectDependencyAffected: inherit unless override │
+│ - TransitiveDependencyAffected: flag but don't auto-inherit │
+│ - DependencyFixed: allow parent NotAffected if code removed │
+│ - DependencyNotAffected: inherit if dependency is leaf │
+└─────────────────────────────────────────────────────────────────┘
+ │
+ ▼
+┌─────────────────────────────────────────────────────────────────┐
+│ IConditionEvaluator │
+│ Evaluates VEX conditions against execution context │
+├─────────────────────────────────────────────────────────────────┤
+│ Context includes: │
+│ - Platform (linux/amd64, darwin/arm64, windows/amd64) │
+│ - Distro (rhel:9, debian:12, ubuntu:22.04) │
+│ - Features (enabled feature flags) │
+│ - BuildFlags (compiler options) │
+│ - Runtime (eBPF signals, process info) │
+└─────────────────────────────────────────────────────────────────┘
+```
+
+### Project Structure
+
+```
+src/VexLens/
+├── StellaOps.VexLens/
+│ ├── Consensus/
+│ │ ├── VexConsensusEngine.cs # MODIFY - emit proof
+│ │ ├── IVexConsensusEngine.cs # MODIFY - return VexResolutionResult
+│ │ └── VexProofBuilder.cs # NEW
+│ │
+│ ├── Proof/ # NEW
+│ │ ├── VexProof.cs
+│ │ ├── VexProofInput.cs
+│ │ ├── VexProofResolution.cs
+│ │ ├── VexProofPropagation.cs
+│ │ ├── VexProofConditions.cs
+│ │ ├── VexProofConfidence.cs
+│ │ └── VexProofSerializer.cs
+│ │
+│ ├── Propagation/ # NEW
+│ │ ├── IPropagationRuleEngine.cs
+│ │ ├── PropagationRule.cs
+│ │ ├── PropagationResult.cs
+│ │ ├── PropagationRuleEngine.cs
+│ │ └── Rules/
+│ │ ├── DirectDependencyAffectedRule.cs
+│ │ ├── TransitiveDependencyRule.cs
+│ │ ├── DependencyFixedRule.cs
+│ │ └── DependencyNotAffectedRule.cs
+│ │
+│ └── Conditions/ # NEW
+│ ├── IConditionEvaluator.cs
+│ ├── EvaluationContext.cs
+│ ├── ConditionResult.cs
+│ ├── ConditionEvaluator.cs
+│ └── Expressions/
+│ ├── PlatformCondition.cs
+│ ├── DistroCondition.cs
+│ ├── FeatureCondition.cs
+│ └── BuildFlagCondition.cs
+│
+├── __Tests/
+│ └── StellaOps.VexLens.Tests/
+│ ├── Proof/
+│ │ ├── VexProofBuilderTests.cs
+│ │ └── VexProofSerializerTests.cs
+│ ├── Propagation/
+│ │ ├── PropagationRuleEngineTests.cs
+│ │ └── PropagationRulesTests.cs
+│ ├── Conditions/
+│ │ ├── ConditionEvaluatorTests.cs
+│ │ └── ExpressionTests.cs
+│ └── Integration/
+│ └── ProofDeterminismTests.cs # Shuffle tests
+
+src/Policy/
+├── __Libraries/
+│ └── StellaOps.Policy/
+│ └── Vex/
+│ └── VexProofGate.cs # NEW - gate on proof quality
+```
+
+### Key Interfaces
+
+```csharp
+// src/VexLens/StellaOps.VexLens/Consensus/IVexConsensusEngine.cs (MODIFIED)
+
+namespace StellaOps.VexLens.Consensus;
+
+public interface IVexConsensusEngine
+{
+ ///
+ /// Computes consensus with full proof object.
+ ///
+ Task ComputeConsensusAsync(
+ VexConsensusRequest request,
+ CancellationToken cancellationToken = default);
+
+ // ... existing methods
+}
+
+///
+/// Complete result including verdict and proof.
+///
+public sealed record VexResolutionResult(
+ VexConsensusResult Verdict,
+ VexProof Proof,
+ ImmutableArray Conflicts);
+```
+
+```csharp
+// src/VexLens/StellaOps.VexLens/Proof/VexProof.cs
+
+namespace StellaOps.VexLens.Proof;
+
+///
+/// Complete proof object for a VEX verdict.
+/// Contains all inputs, conditions, merge steps, and graph paths.
+///
+public sealed record VexProof
+{
+ public const string SchemaVersion = "stellaops.vex-proof.v1";
+
+ public required string ProofId { get; init; }
+ public required DateTimeOffset ComputedAt { get; init; }
+
+ public required VexProofVerdict Verdict { get; init; }
+ public required VexProofInputs Inputs { get; init; }
+ public required VexProofResolution Resolution { get; init; }
+ public required VexProofPropagation Propagation { get; init; }
+ public required VexProofConditions Conditions { get; init; }
+ public required VexProofConfidence Confidence { get; init; }
+
+ ///
+ /// SHA-256 digest of canonical proof JSON.
+ ///
+ public required string Digest { get; init; }
+
+ ///
+ /// Serializes to canonical JSON.
+ ///
+ public string ToCanonicalJson();
+
+ ///
+ /// Computes digest of proof.
+ ///
+ public static string ComputeDigest(VexProof proof);
+}
+
+public sealed record VexProofVerdict(
+ string VulnerabilityId,
+ string ProductKey,
+ VexStatus Status,
+ string? Justification,
+ decimal Confidence);
+
+public sealed record VexProofInputs(
+ ImmutableArray Statements,
+ VexProofContext Context);
+
+public sealed record VexProofStatement(
+ string Id,
+ string Source,
+ VexProofIssuer Issuer,
+ VexStatus Status,
+ string? Justification,
+ VexProofWeight Weight,
+ DateTimeOffset Timestamp,
+ bool SignatureVerified);
+
+public sealed record VexProofResolution(
+ ConsensusMode Mode,
+ int QualifiedStatements,
+ int DisqualifiedStatements,
+ ImmutableArray DisqualificationReasons,
+ VexProofLatticeComputation? LatticeComputation,
+ VexProofConflictAnalysis ConflictAnalysis);
+
+public sealed record VexProofLatticeComputation(
+ ImmutableArray Ordering,
+ ImmutableArray MergeSteps,
+ VexStatus FinalPosition);
+
+public sealed record VexProofMergeStep(
+ int Step,
+ string StatementId,
+ VexStatus InputPosition,
+ decimal Weight,
+ string Action,
+ bool Conflict,
+ string? Resolution,
+ VexStatus ResultPosition);
+```
+
+```csharp
+// src/VexLens/StellaOps.VexLens/Propagation/IPropagationRuleEngine.cs
+
+namespace StellaOps.VexLens.Propagation;
+
+///
+/// Computes transitive impact through dependency graph.
+///
+public interface IPropagationRuleEngine
+{
+ ///
+ /// Propagates verdict through dependency graph.
+ ///
+ PropagationResult Propagate(
+ VexVerdict componentVerdict,
+ DependencyGraph graph,
+ PropagationPolicy policy);
+
+ ///
+ /// Gets all configured rules.
+ ///
+ IReadOnlyList GetRules();
+}
+
+public sealed record PropagationResult(
+ bool Applied,
+ ImmutableArray RuleApplications,
+ ImmutableArray GraphPaths,
+ VexStatus? InheritedStatus,
+ bool OverrideApplied);
+
+public sealed record PropagationRuleApplication(
+ string RuleId,
+ string Description,
+ bool Triggered,
+ string? Reason);
+
+public sealed record GraphPath(
+ string Root,
+ ImmutableArray Path,
+ string PathType,
+ int Depth);
+
+public sealed record PropagationPolicy(
+ bool InheritDirectDependencyAffected = true,
+ bool InheritTransitiveAffected = false,
+ bool AllowProductOverride = true,
+ int MaxDepth = 10);
+```
+
+```csharp
+// src/VexLens/StellaOps.VexLens/Conditions/IConditionEvaluator.cs
+
+namespace StellaOps.VexLens.Conditions;
+
+///
+/// Evaluates VEX conditions against execution context.
+///
+public interface IConditionEvaluator
+{
+ ///
+ /// Evaluates a condition against context.
+ ///
+ ConditionResult Evaluate(
+ VexCondition condition,
+ EvaluationContext context);
+
+ ///
+ /// Evaluates multiple conditions.
+ ///
+ IReadOnlyList EvaluateAll(
+ IEnumerable conditions,
+ EvaluationContext context);
+}
+
+public sealed record EvaluationContext(
+ string? Platform, // linux/amd64, darwin/arm64
+ string? Distro, // rhel:9, debian:12
+ ImmutableHashSet Features,
+ ImmutableDictionary BuildFlags,
+ ImmutableDictionary Environment,
+ DateTimeOffset EvaluationTime);
+
+public sealed record ConditionResult(
+ string ConditionId,
+ string Expression,
+ ConditionOutcome Outcome,
+ string? ContextValue,
+ string? Reason);
+
+public enum ConditionOutcome
+{
+ True,
+ False,
+ Unknown // Cannot evaluate (missing context)
+}
+```
+
+### Propagation Rules
+
+| Rule ID | Description | When Applied |
+|---------|-------------|--------------|
+| `direct-dependency-affected` | If direct dependency is affected, product inherits affected unless product-level override | Dependency is direct (depth=1) and status=affected |
+| `transitive-dependency-affected` | If transitive dependency is affected, flag for review but don't auto-inherit | Dependency is transitive (depth>1) and status=affected |
+| `dependency-fixed` | If dependency was affected but is now fixed, allow product NotAffected if vulnerable code was removed | Dependency status=fixed and product has override |
+| `dependency-not-affected` | If dependency is not_affected, product may inherit if dependency is leaf | Dependency is leaf node with status=not_affected |
+
+## Delivery Tracker
+
+| Task ID | Description | Status | Assignee | Notes |
+|---------|-------------|--------|----------|-------|
+| **VP-001** | Define `VexProof` and related models | TODO | | |
+| **VP-002** | Implement `VexProofBuilder` | TODO | | |
+| **VP-003** | Implement `VexProofSerializer` (canonical JSON) | TODO | | |
+| **VP-004** | Modify `VexConsensusEngine` to build proof | TODO | | |
+| **VP-005** | Modify `IVexConsensusEngine` to return `VexResolutionResult` | TODO | | |
+| **VP-006** | Record merge steps in lattice computation | TODO | | |
+| **VP-007** | Record conflict analysis in proof | TODO | | |
+| **VP-008** | Define `IPropagationRuleEngine` interface | TODO | | |
+| **VP-009** | Implement `PropagationRuleEngine` | TODO | | |
+| **VP-010** | Implement `DirectDependencyAffectedRule` | TODO | | |
+| **VP-011** | Implement `TransitiveDependencyRule` | TODO | | |
+| **VP-012** | Implement `DependencyFixedRule` | TODO | | |
+| **VP-013** | Implement `DependencyNotAffectedRule` | TODO | | |
+| **VP-014** | Define `IConditionEvaluator` interface | TODO | | |
+| **VP-015** | Implement `ConditionEvaluator` | TODO | | |
+| **VP-016** | Implement `PlatformCondition` | TODO | | |
+| **VP-017** | Implement `DistroCondition` | TODO | | |
+| **VP-018** | Implement `FeatureCondition` | TODO | | |
+| **VP-019** | Implement `BuildFlagCondition` | TODO | | |
+| **VP-020** | Integrate propagation into consensus | TODO | | |
+| **VP-021** | Integrate condition evaluation into consensus | TODO | | |
+| **VP-022** | Unit tests for `VexProofBuilder` | TODO | | |
+| **VP-023** | Unit tests for `VexProofSerializer` | TODO | | |
+| **VP-024** | Unit tests for propagation rules | TODO | | |
+| **VP-025** | Unit tests for condition evaluator | TODO | | |
+| **VP-026** | **Shuffle determinism tests** | TODO | | Critical |
+| **VP-027** | Proof digest computation tests | TODO | | |
+| **VP-028** | Add `VexProofGate` to Policy | TODO | | |
+| **VP-029** | API endpoint to retrieve proofs | TODO | | |
+| **VP-030** | Documentation: Proof schema reference | TODO | | |
+
+## Decisions & Risks
+
+| ID | Decision/Risk | Status | Notes |
+|----|---------------|--------|-------|
+| D-001 | Proof schema version "stellaops.vex-proof.v1" | DECIDED | Allows future evolution |
+| D-002 | Include digest in proof for integrity | DECIDED | SHA-256 of canonical JSON |
+| D-003 | Propagation rules are configurable via policy | DECIDED | Flexibility for different use cases |
+| D-004 | Unknown conditions don't fail evaluation | DECIDED | Explicit Unknown state, not error |
+| R-001 | Proof size may be large for many statements | OPEN | Consider compression or summary mode |
+| R-002 | Condition expression language complexity | OPEN | Start simple, extend as needed |
+
+## Execution Log
+
+| Date | Event | Notes |
+|------|-------|-------|
+| 2026-01-02 | Sprint created | Based on product advisory analysis |
+
+## References
+
+- [Product Advisory: Deterministic VEX Resolver](../product-advisories/30-Dec-2025%20-%20Designing%20a%20Deterministic%20VEX%20Resolver.md)
+- [CycloneDX VEX](https://cyclonedx.org/use-cases/vulnerability-exploitability/)
+- [OpenVEX Spec](https://github.com/openvex/spec)
diff --git a/docs/implplan/SPRINT_20260102_004_BE_polish_and_testing.md b/docs/implplan/SPRINT_20260102_004_BE_polish_and_testing.md
new file mode 100644
index 000000000..09fced2da
--- /dev/null
+++ b/docs/implplan/SPRINT_20260102_004_BE_polish_and_testing.md
@@ -0,0 +1,351 @@
+# SPRINT_20260102_004_BE_polish_and_testing.md
+
+## Sprint Overview
+
+| Field | Value |
+|-------|-------|
+| **Sprint ID** | SPRINT_20260102_004_BE |
+| **Title** | Polish, Testing, and CycloneDX 1.7 Completion |
+| **Working Directory** | Various (`src/VexLens/`, `src/Concelier/`, `src/__Tests/`) |
+| **Duration** | 1-2 weeks |
+| **Dependencies** | Sprints 001-003 |
+| **Advisory Sources** | Multiple advisories consolidated |
+
+## Objectives
+
+This sprint completes the remaining gaps identified in the product advisory analysis:
+
+1. **CycloneDX 1.7 Complete Mapping** - Map `analysis.state` and `analysis.justification`
+2. **Shuffle Determinism Tests** - Prove consensus is order-independent
+3. **Golden Corpus Curation** - Backport test cases from advisory #5
+4. **End-to-End Regression Suite** - Full pipeline determinism validation
+
+## Task Groups
+
+### 1. CycloneDX 1.7 Completion
+
+**Current State:** Basic CycloneDX ingestion works, but `analysis.state` and `analysis.justification` are not fully mapped.
+
+**Gap:** CycloneDX 1.7 vulnerability analysis model has:
+- `analysis.state` - Exploitability status (resolved, exploitable, in_triage, false_positive, not_affected)
+- `analysis.justification` - Why status was assigned
+- `analysis.response` - Vendor response (workaround, update, rollback, will_not_fix)
+- `analysis.detail` - Detailed analysis notes
+
+**Implementation:**
+
+```csharp
+// src/VexLens/StellaOps.VexLens/Normalization/CycloneDxVexNormalizer.cs
+
+public NormalizedStatement NormalizeCycloneDx(
+ CycloneDxVulnerability vuln,
+ CycloneDxAnalysis? analysis)
+{
+ var status = MapAnalysisState(analysis?.State);
+ var justification = MapJustification(analysis?.Justification);
+
+ return new NormalizedStatement(
+ StatementId: GenerateStatementId(vuln),
+ VulnerabilityId: vuln.Id,
+ Status: status,
+ Justification: justification,
+ // ... other fields
+ Metadata: new Dictionary
+ {
+ ["cyclonedx.analysis.state"] = analysis?.State ?? "",
+ ["cyclonedx.analysis.justification"] = analysis?.Justification ?? "",
+ ["cyclonedx.analysis.response"] = string.Join(",", analysis?.Response ?? []),
+ ["cyclonedx.analysis.detail"] = analysis?.Detail ?? ""
+ });
+}
+
+private static VexStatus MapAnalysisState(string? state) => state?.ToLowerInvariant() switch
+{
+ "resolved" => VexStatus.Fixed,
+ "resolved_with_pedigree" => VexStatus.Fixed,
+ "exploitable" => VexStatus.Affected,
+ "in_triage" => VexStatus.UnderInvestigation,
+ "false_positive" => VexStatus.NotAffected,
+ "not_affected" => VexStatus.NotAffected,
+ _ => VexStatus.Unknown
+};
+
+private static string? MapJustification(string? justification) => justification?.ToLowerInvariant() switch
+{
+ "code_not_present" => "vulnerable_code_not_present",
+ "code_not_reachable" => "vulnerable_code_not_in_execute_path",
+ "requires_configuration" => "vulnerable_code_cannot_be_controlled_by_adversary",
+ "requires_dependency" => "vulnerable_code_not_present",
+ "requires_environment" => "inline_mitigations_already_exist",
+ "protected_by_compiler" => "inline_mitigations_already_exist",
+ "protected_at_runtime" => "inline_mitigations_already_exist",
+ "protected_at_perimeter" => "inline_mitigations_already_exist",
+ "protected_by_mitigating_control" => "inline_mitigations_already_exist",
+ _ => justification
+};
+```
+
+### 2. Shuffle Determinism Tests
+
+**Objective:** Prove that VexConsensusEngine produces identical results regardless of input order.
+
+**Test Strategy:**
+1. Take a set of N statements
+2. Generate all permutations (or random sample for large N)
+3. Compute consensus for each permutation
+4. Assert all results are identical
+
+```csharp
+// src/VexLens/__Tests/StellaOps.VexLens.Tests/Consensus/ShuffleDeterminismTests.cs
+
+[Theory]
+[MemberData(nameof(GetShuffleTestCases))]
+public async Task Consensus_IsOrderIndependent(ShuffleTestCase testCase)
+{
+ // Arrange
+ var engine = new VexConsensusEngine();
+ var permutations = GeneratePermutations(testCase.Statements, testCase.SampleSize);
+
+ // Act
+ var results = new List();
+ foreach (var permutation in permutations)
+ {
+ var request = new VexConsensusRequest(
+ VulnerabilityId: testCase.VulnerabilityId,
+ ProductKey: testCase.ProductKey,
+ Statements: permutation.ToImmutableArray(),
+ Context: testCase.Context);
+
+ var result = await engine.ComputeConsensusAsync(request);
+ results.Add(result.Verdict);
+ }
+
+ // Assert - all results must be identical
+ var first = results[0];
+ foreach (var result in results.Skip(1))
+ {
+ Assert.Equal(first.ConsensusStatus, result.ConsensusStatus);
+ Assert.Equal(first.ConsensusJustification, result.ConsensusJustification);
+ Assert.Equal(first.ConfidenceScore, result.ConfidenceScore);
+ Assert.Equal(first.Outcome, result.Outcome);
+ }
+}
+
+public static IEnumerable