feat(concelier,excititor): MVP connector wiring — 9→31 advisory sources, 4→7 VEX providers
Closes SPRINT_20260422_009 (archived). Lifts backend-wired connector
coverage from 13 to 38 (MVP ~90%) by seeding the 19 fully-implemented
connectors the 2026-04-22 gap survey identified.
Concelier vuln.sources +22 rows (embedded migration
011_seed_connector_sources.sql, INSERT ... ON CONFLICT DO NOTHING):
- Primary: nvd, cve, epss, kev
- Vendor: oracle, adobe, apple, chromium (public CSAF/bulletin feeds)
- CERT: cert-fr, cert-de (cert-bund), cert-cc, cert-in, cccs, us-cert,
jpcert, krcert (KISA aliased)
- ICS: kaspersky-ics
- Regional: fstec-bdu (RU-BDU), nkcki (RU-NKCKI)
- Credentialed (seeded enabled=false, gated by SRC-CREDS-005 blocked-
readiness contract): ghsa, microsoft, cisco.
Excititor vex.providers +3 rows (embedded migration
008_seed_csaf_providers.sql, MSRC + SUSE Rancher + OCI OpenVEX all
seeded enabled=false; operators flip via VexProviderConfigurationService
once credentials land). Existing excititor:{cisco, oracle, redhat,
ubuntu} untouched — Option B naming kept.
WIRE-MVP-002 finding: stale premise. All 6 Excititor CSAF connectors
already had ServiceCollectionExtensions in their
DependencyInjection/ folders and were already registered in Excititor
Worker + WebService Program.cs (Excititor uses direct registration, not
Concelier's IDependencyInjectionRoutine plugin pattern). No new DI
stubs needed; confirmed by sweep.
Connectivity verification (stellaops-cli sources check against 19
newly-seeded non-credentialed sources):
- 17/19 HEALTHY: nvd, cve, epss, kev, oracle, apple, cert-fr, cert-de,
cert-cc, cert-in, cccs, us-cert, jpcert, krcert, kaspersky-ics,
fstec-bdu, nkcki (latencies 228-3544 ms).
- 2 probe-level quirks (not URL rot, rows stay enabled=true):
- adobe: 30s timeout on helpx.adobe.com — suspect geo/anti-bot on
dev host; connector fetch may still work via job path.
- chromium: HTTP 302 on chromereleases.googleblog.com/atom.xml — CLI
probe doesn't follow redirects; connector fetch follows them.
Ingest verification deferred to UI-driven db fetch (CLI can't mint
aoc:verify scope — known asymmetry documented in connector-setup-guide).
Evidence: docs/qa/connector-mvp-wiring-20260422/EVIDENCE.md with full
probe results.
Sprint SPRINT_20260422_009 archived — all 4 tasks DONE.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
master
@@ -1,94 +0,0 @@
|
||||
# Sprint 20260422-009 — Concelier + Excititor connector MVP wiring
|
||||
|
||||
## Topic & Scope
|
||||
- Close the gap the 2026-04-22 connector-gap survey identified: 19 Concelier connectors are fully implemented but missing DB seed rows + source_type registration, and 6 Excititor CSAF connectors are missing DI routines that would let them register alongside the 1 wired CSAF connector.
|
||||
- Goal: 26 connectors enabled (9 existing + 17 newly wired) = **MVP ~90% coverage**, up from 13.
|
||||
- Working directory: `src/Concelier/__Libraries/StellaOps.Concelier.Connector.*` (DI bootstrap surfaces), `src/Concelier/__Libraries/StellaOps.Excititor.Connectors.*/` (new DI stubs), `src/Concelier/__Libraries/StellaOps.Concelier.Persistence/Migrations/` (seed data), `src/Concelier/__Libraries/StellaOps.Excititor.Persistence/Migrations/` (seed data).
|
||||
- Explicitly out of scope: the per-provider persisted-settings control plane owned by SPRINT_20260422_007 (EXCITITOR-CFG-*); credentials creation for the 3 auth-required connectors (GHSA, Cisco-PSIRT, MSRC) which stay disabled until operators add tokens.
|
||||
|
||||
## Dependencies & Concurrency
|
||||
- Downstream of the already-shipped source key alignment (SPRINT_20260421_001/003, archived).
|
||||
- Safe parallelism with SPRINT_20260422_007 (Excititor persisted credentials) — that sprint touches `src/Concelier/StellaOps.Concelier.WebService/` and the `vex.providers` runtime; this sprint seeds `vuln.sources` + `vex.providers` rows and extends DI under `__Libraries/StellaOps.Excititor.Connectors.*`. File boundary is clean: no `WebService/` edits here.
|
||||
|
||||
## Documentation Prerequisites
|
||||
- `docs/ops/connector-setup-guide.md` (updated 2026-04-22).
|
||||
- `src/Concelier/__Libraries/StellaOps.Concelier.Core/Sources/SourceDefinitions.cs` — catalog source of truth.
|
||||
- Existing wired-connector pattern, e.g. `src/Concelier/__Libraries/StellaOps.Excititor.Connectors.RedHat.CSAF/` (fully wired) vs. `Cisco.CSAF/` (stub missing DI).
|
||||
|
||||
## Delivery Tracker
|
||||
|
||||
### WIRE-MVP-001 — Seed 19 Concelier `vuln.sources` rows
|
||||
Status: TODO
|
||||
Dependency: none
|
||||
Owners: Developer / Implementer
|
||||
Task description:
|
||||
- Add an embedded seed migration under `src/Concelier/__Libraries/StellaOps.Concelier.Persistence/Migrations/` (numeric prefix so the `Startup` category picks it up — NOT `S` prefix which is Seed-category manual-only per `StartupMigrationHost.cs:158`).
|
||||
- Insert rows for: `nvd, cve, epss, kev, ghsa (enabled=false), vndr.cisco (enabled=false), vndr.msrc (enabled=false), vndr.oracle, vndr.adobe, vndr.apple, vndr.chromium, cert-fr, cert-bund, cert-cc, cert-in, cccs, ics-cisa, kaspersky-ics, ru-bdu, ru-nkcki, jvn, kisa`.
|
||||
- Idempotent: `INSERT ... ON CONFLICT (key) DO NOTHING`.
|
||||
- Three credentialed connectors (`ghsa`, `vndr.cisco`, `vndr.msrc`) seeded with `enabled=false` — they'll move to `readiness=blocked` when operators turn them on without credentials (per the SRC-CREDS-005 contract landed in `838257245`).
|
||||
|
||||
Completion criteria:
|
||||
- [ ] Seed migration is an embedded resource + auto-applied on startup.
|
||||
- [ ] Fresh-volume `down -v && up -d` produces all 22 rows.
|
||||
- [ ] `stellaops-cli sources status` reports non-empty results.
|
||||
- [ ] `sources check <id>` returns healthy for at least the non-credentialed ones (connectivity test against upstream).
|
||||
|
||||
### WIRE-MVP-002 — Complete the 6 Excititor CSAF DI stubs
|
||||
Status: TODO
|
||||
Dependency: none
|
||||
Owners: Developer / Implementer
|
||||
Task description:
|
||||
- For each of: `Cisco.CSAF`, `MSRC.CSAF`, `Oracle.CSAF`, `Ubuntu.CSAF`, `SUSE.RancherVEXHub`, `OCI.OpenVEX.Attest` — add the missing `*DependencyInjectionRoutine.cs` + `*ServiceCollectionExtensions.cs` file pair using `RedHat.CSAF` as the reference pattern (that one already works).
|
||||
- Register each in the Excititor worker's plugin discovery path so `IExcititorConnectorPlugin` instances enumerate correctly.
|
||||
- Do NOT edit `src/Concelier/StellaOps.Excititor.WebService/` — parallel agent `excititor-cfg` owns that.
|
||||
|
||||
Completion criteria:
|
||||
- [ ] Each of the 6 connectors has DI + extension files matching the RedHat pattern.
|
||||
- [ ] `dotnet build src/Concelier/StellaOps.Excititor.sln` (or equivalent) is clean.
|
||||
- [ ] Worker startup logs show all 7 CSAF connectors registered (existing RedHat + 6 new).
|
||||
|
||||
### WIRE-MVP-003 — Seed `vex.providers` rows for the 6 newly-wired CSAF connectors
|
||||
Status: TODO
|
||||
Dependency: WIRE-MVP-002
|
||||
Owners: Developer / Implementer
|
||||
Task description:
|
||||
- Add an embedded seed migration under `src/Concelier/__Libraries/StellaOps.Excititor.Persistence/Migrations/`. Insert rows for: `excititor:cisco-csaf` (can alias or replace `excititor:cisco`), `excititor:msrc-csaf`, `excititor:oracle-csaf`, `excititor:ubuntu-csaf` (likely replaces or aliases `excititor:ubuntu`), `excititor:suse-rancher`, `excititor:oci-openvex`.
|
||||
- Idempotent with `ON CONFLICT DO NOTHING`. Base URIs from public CSAF feeds (e.g. `https://www.cisco.com/.well-known/csaf/`, `https://msrc.microsoft.com/update-guide/`, `https://www.oracle.com/security-alerts/csaf/`).
|
||||
- If the new `*-csaf` id collides with an existing shorter id (e.g. `excititor:cisco`), decide: rename the existing to `-csaf` suffix OR keep both with different priorities. Document the decision in Decisions & Risks.
|
||||
|
||||
Completion criteria:
|
||||
- [ ] Seed migration embedded + auto-applied.
|
||||
- [ ] `SELECT id, kind, enabled, base_uris FROM vex.providers` shows the new rows after fresh-volume bring-up.
|
||||
- [ ] No id collisions or orphaned rows.
|
||||
|
||||
### WIRE-MVP-004 — Connectivity + ingest verification
|
||||
Status: TODO
|
||||
Dependency: WIRE-MVP-001, WIRE-MVP-003
|
||||
Owners: Developer / Implementer, QA
|
||||
Task description:
|
||||
- Run `stellaops-cli sources check <id>` against all 22 newly-seeded Concelier sources; record healthy/unhealthy per source.
|
||||
- For the non-credentialed healthy sources, optionally trigger one `db fetch --source <id> --stage fetch` to confirm end-to-end ingest (must be done from inside the compose network or with trusted cert; skip if cert blocks).
|
||||
- Record results in `docs/qa/connector-mvp-wiring-20260422/`.
|
||||
|
||||
Completion criteria:
|
||||
- [ ] Connectivity table captured in evidence dir.
|
||||
- [ ] At least one non-credentialed newly-wired source ingests at least 1 advisory.
|
||||
- [ ] Any systematic failure (e.g. URL changed, parser broken) noted with specific source + error.
|
||||
|
||||
## Execution Log
|
||||
| Date (UTC) | Update | Owner |
|
||||
| --- | --- | --- |
|
||||
| 2026-04-22 | Sprint created to land the MVP wiring identified by the connector-gap survey agent — fully-implemented connectors are waiting on only DB seed rows + source_type registration. | Claude |
|
||||
|
||||
## Decisions & Risks
|
||||
- **Decision**: MVP stops at 26 wired connectors (13 existing + 13 newly-wired via WIRE-MVP-001, plus the 7 Excititor CSAF post-WIRE-MVP-003). Pure greenfield work (ecosystem npm/pypi/maven, cloud AWS/GCP/Azure, hardware Intel/AMD/Siemens) is explicitly deferred pending demand signal — tracked as follow-up sprints not in this one.
|
||||
- **Decision**: credentialed connectors (`ghsa`, `vndr.cisco`, `vndr.msrc`) ship as `enabled=false` rows. Operators flip them via UI/CLI once they paste credentials; readiness contract from SRC-CREDS-005 handles the blocked-until-configured state.
|
||||
- **Risk**: `auscert` currently maps to `acsc` alias; if the seed migration also seeds `acsc` there may be a duplicate. Mitigation: use `ON CONFLICT` + the `SourceKeyAliases` normaliser to avoid collisions.
|
||||
- **Risk**: Excititor CSAF naming collision (`excititor:cisco` already exists; adding `excititor:cisco-csaf` creates two Cisco entries). Mitigation: prefer renaming the existing short-form id to `-csaf` suffix, using the migration to rename + re-link. Document whichever choice is taken.
|
||||
- **Risk**: some "fully implemented" connectors in the survey may have URL-rot or parser drift since last runtime. The WIRE-MVP-004 connectivity sweep is the gate — don't declare DONE if a systematic failure shows up.
|
||||
|
||||
## Next Checkpoints
|
||||
- WIRE-MVP-001 DONE: `vuln.sources` shows 22 newly-seeded rows after fresh-volume bring-up.
|
||||
- WIRE-MVP-002 DONE: Excititor DI stubs complete; worker logs all 7 CSAF providers.
|
||||
- WIRE-MVP-003 DONE: `vex.providers` shows the new CSAF rows.
|
||||
- WIRE-MVP-004 DONE: connectivity sweep captured, at least one new source ingests.
|
||||
Reference in New Issue
Block a user