- Switch default repository to start empty when Postgres is configured;
GraphDataLoaderHostedService loads real data from graph.graph_nodes/edges
on startup and refreshes every 5 minutes
- Keep InMemoryGraphRepository with hardcoded seed as fallback when no DB
- Add Reload() method to InMemoryGraphRepository for hot-swapping data
- Add GetAllNodesAsync/GetAllEdgesAsync to PostgresGraphRepository
- Deprecate hardcoded seed data in InMemoryGraphRepository
- Fix graph-api port mismatch: container listens on 8080 (ASPNETCORE_URLS)
but compose mapped 80:80; corrected to 80:8080 + healthcheck to 8080
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Introduce PostgresGraphSavedViewStore with SQL migration, in-memory fallback,
CompatibilityEndpoints for UI contract alignment, and integration tests
with a shared Postgres fixture.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- Add resource limits (heavy/medium/light tiers) to all 59 .NET services
- Add .NET GC tuning (server/workstation GC, DATAS, conserve memory)
- Convert FirstSignalSnapshotWriter from 10s polling to Valkey pub/sub
- Convert EnvironmentSettingsRefreshService from 60s polling to Valkey pub/sub
- Consolidate GraphAnalytics dual timers to single timer with idle-skip
- Increase healthcheck interval from 30s to 60s (configurable)
- Reduce debug logging to Information on 4 high-traffic services
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Sprint: SPRINT_20251229_049_BE_csproj_audit_maint_tests
Tasks: AUDIT-0001 through AUDIT-0147 APPLY tasks (approved decisions 1-9)
Changes:
- Set TreatWarningsAsErrors=true for all production .NET projects
- Fixed nullable warnings in Scanner.EntryTrace, Scanner.Evidence,
Scheduler.Worker, Concelier connectors, and other modules
- Injected TimeProvider/IGuidProvider for deterministic time/ID generation
- Added path traversal validation in AirGap.Bundle
- Fixed NULL handling in various cursor classes
- Third-party GostCryptography retains TreatWarningsAsErrors=false (preserves original)
- Test projects excluded per user decision (rejected decision 10)
Note: All 17 ACSC connector tests pass after snapshot fixture sync
- Implemented unit tests for PathConfidenceScorer to evaluate path scoring under various conditions, including empty constraints, known and unknown constraints, environmental dependencies, and custom weights.
- Developed tests for PathEnumerator to ensure correct path enumeration from simple scripts, handling known environments, and respecting maximum paths and depth limits.
- Created tests for ShellSymbolicExecutor to validate execution of shell scripts, including handling of commands, branching, and environment tracking.
- Added tests for SymbolicState to verify state management, variable handling, constraint addition, and environment dependency collection.
- Added DefaultCryptoHmac class implementing ICryptoHmac interface.
- Introduced purpose-based HMAC computation methods.
- Implemented verification methods for HMACs with constant-time comparison.
- Created HmacAlgorithms and HmacPurpose classes for well-known identifiers.
- Added compliance profile support for HMAC algorithms.
- Included asynchronous methods for HMAC computation from streams.
- Introduced `ReachabilityState`, `RuntimeHit`, `ExploitabilitySignal`, `ReachabilitySignal`, `SignalEnvelope`, `SignalType`, `TrustSignal`, and `UnknownSymbolSignal` records to define various signal types and their properties.
- Implemented JSON serialization attributes for proper data interchange.
- Created project files for the new signal contracts library and corresponding test projects.
- Added deterministic test fixtures for micro-interaction testing.
- Included cryptographic keys for secure operations with cosign.
- Introduced Storybook configuration files (`main.ts`, `preview.ts`, `tsconfig.json`) for Angular components.
- Created motion tokens in `motion-tokens.ts` to define durations, easing functions, and transforms.
- Developed a Storybook story for motion tokens showcasing their usage and reduced motion fallback.
- Added SCSS variables for motion durations, easing, and transforms in `_motion.scss`.
- Implemented accessibility smoke tests using Playwright and Axe for automated accessibility checks.
- Created portable and sealed bundle structures with corresponding JSON files for evidence locker.
- Added shell script for verifying notify kit determinism.
feat(sbomservice): Add placeholder for SHA256SUMS in LNM v1 fixtures
docs(devportal): Create README for SDK archives in public directory
build(devportal): Implement offline bundle build script
test(devportal): Add link checker script for validating links in documentation
test(devportal): Create performance check script for dist folder size
test(devportal): Implement accessibility check script using Playwright and Axe
docs(devportal): Add SDK quickstart guide with examples for Node.js, Python, and cURL
feat(excititor): Implement MongoDB storage for airgap import records
test(findings): Add unit tests for export filters hash determinism
feat(findings): Define attestation contracts for ledger web service
feat(graph): Add MongoDB options and service collection extensions for graph indexing
test(graph): Implement integration tests for MongoDB provider and service collection extensions
feat(zastava): Define configuration options for Zastava surface secrets
build(tests): Create script to run Concelier linkset tests with TRX output
feat: Implement BsonJsonConverter for converting BsonDocument and BsonArray to JSON
fix: Update project file to include MongoDB.Bson package
test: Add GraphOverlayExporterTests to validate NDJSON export functionality
refactor: Refactor Program.cs in Attestation Tool for improved argument parsing and error handling
docs: Update README for stella-forensic-verify with usage instructions and exit codes
feat: Enhance HmacVerifier with clock skew and not-after checks
feat: Add MerkleRootVerifier and ChainOfCustodyVerifier for additional verification methods
fix: Update DenoRuntimeShim to correctly handle file paths
feat: Introduce ComposerAutoloadData and related parsing in ComposerLockReader
test: Add tests for Deno runtime execution and verification
test: Enhance PHP package tests to include autoload data verification
test: Add unit tests for HmacVerifier and verification logic
- Implemented the PhpAnalyzerPlugin to analyze PHP projects.
- Created ComposerLockData class to represent data from composer.lock files.
- Developed ComposerLockReader to load and parse composer.lock files asynchronously.
- Introduced ComposerPackage class to encapsulate package details.
- Added PhpPackage class to represent PHP packages with metadata and evidence.
- Implemented PhpPackageCollector to gather packages from ComposerLockData.
- Created PhpLanguageAnalyzer to perform analysis and emit results.
- Added capability signals for known PHP frameworks and CMS.
- Developed unit tests for the PHP language analyzer and its components.
- Included sample composer.lock and expected output for testing.
- Updated project files for the new PHP analyzer library and tests.
- Implemented LdapDistinguishedNameHelper for escaping RDN and filter values.
- Created AuthorityCredentialAuditContext and IAuthorityCredentialAuditContextAccessor for managing credential audit context.
- Developed StandardCredentialAuditLogger with tests for success, failure, and lockout events.
- Introduced AuthorityAuditSink for persisting audit records with structured logging.
- Added CryptoPro related classes for certificate resolution and signing operations.
