stella-ops.org/git.stella-ops.org
1
0
Fork 0
Code Issues Pull Requests Actions 2 Releases Wiki Activity
1,349 Commits 2 Branches 0 Tags
b2b0c905b86dfca1b4edacc90f3adb0d58c70292
Commit Graph

1349 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
master
b2b0c905b8 feat(audit): wire AddAuditEmission in 7 services (AUDIT-002 wave A) 
Sprint SPRINT_20260408_004_Timeline_unified_audit_sink AUDIT-002.

Wire the unified audit emitter in 7 webservices that were listed in the
AUDIT-002 priority table but missing the call:
- Concelier.WebService (priority 6a)
- Excititor.WebService (priority 6b)
- SbomService (priority 8)
- Graph.Api (priority 12)
- BinaryIndex.WebService (priority 14)
- Policy.Gateway (priority 3b)
- Notifier.WebService (priority 4b)

Each adds:
- ProjectReference to __Libraries/StellaOps.Audit.Emission
- using StellaOps.Audit.Emission;
- builder.Services.AddAuditEmission(builder.Configuration) in Program.cs
  placed after auth wiring, before authorization policies.

AUDIT-002 completion criterion "AddAuditEmission() called in all 14+
service Program.cs files" is now met for the listed priority services.
Endpoint-level AuditActionAttribute decoration is a separate wave.

All 7 projects build clean against the existing Audit.Emission lib.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-04-19 16:00:33 +03:00
master
6eb4394b1b docs(implplan,concelier): close SPRINT_20260419_027 REALPLAN-007-F 
Durable advisory-observation + affected-symbol runtime is live:
PostgresAdvisoryObservationStore persists observations and delegates
to IAffectedSymbolExtractor during upsert; PostgresAffectedSymbolStore
backs /v1/signals/symbols/*. Non-testing runtime resolves both durable
stores (Unsupported* registration removed).

Targeted xUnit runs via scripts/test-targeted-xunit.ps1:
- PostgresAdvisoryObservationStoreTests 2/2
- PostgresAffectedSymbolStoreTests 2/2
- ConcelierInfrastructureRegistrationTests 3/3
- UnsupportedRuntimeWiringTests 9/9

docs/modules/concelier/architecture.md updated to reflect the
durable /v1/signals/symbols/* contract.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-04-19 15:00:59 +03:00
master
2e35bf4591 fix(tools,concelier): xunit helper strict-mode + test async disposal 
- scripts/test-targeted-xunit.ps1: replace @(x).Count checks with
  [bool] coercion in Assert-FilterShape; StrictMode 'Latest' rejects
  .Count on null even when wrapped in @().
- ConcelierInfrastructureRegistrationTests.AddConcelierPostgresStorage_
  RegistersDurableObservationAndAffectedSymbolServices: wrap provider
  in try/finally with DisposeAsync — ConcelierDataSource is
  IAsyncDisposable only, so sync Dispose at `using` scope end throws.

Follow-up to SPRINT_20260419_027/028.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-04-19 14:57:24 +03:00
master
54e3ca1f1a docs(implplan): close SPRINT_20260419_028 TEST-RUNNER-001 
test-targeted-xunit.ps1 verified end-to-end against
SchedulerStorageConfigurationTests (3/3 pass via direct DLL exec).
QA flow + testing-practices docs updated.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-04-19 14:52:17 +03:00
master
5ce0124cb9 docs(implplan): close SPRINT_20260417_002 SCHEDULER-COMPAT-001 
SchedulerStorageConfiguration ResolveConnectionString supports flat,
compose-nested, and legacy keys; web host fails fast with a clear
message listing all three. Targeted xUnit run of
SchedulerStorageConfigurationTests passes 3/3.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-04-19 14:51:18 +03:00
master
45fba7af47 docs(implplan): archive SPRINT_20260418_001 — all tasks DONE 
All three tasks are now DONE per the 2026-04-19 execution log:
- ADV-SETUP-006 setup source probe/apply reflects real connectivity
- ADV-SETUP-007 enabled-but-broken advisory warning + auth helper
- ADV-SETUP-008 targeted Platform + Concelier xUnit verification
  passed via the direct xUnit runner workflow.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-04-19 14:49:33 +03:00
master
3d14332609 wip(tools): xunit runner helper + QA guidance iteration 
Follow-up to SPRINT_20260419_028 TEST-RUNNER-001.

- scripts/test-targeted-xunit.ps1: refinements to the helper.
- docs/code-of-conduct/TESTING_PRACTICES.md: default targeted xUnit v3
  verification to the new helper.
- docs/qa/feature-checks/FLOW.md: call out Microsoft Testing Platform
  filter-ignore behaviour and point to the helper.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-04-19 14:48:48 +03:00
master
333d894690 wip(tools): targeted xunit runner helper 
Sprint SPRINT_20260419_028_Tools_targeted_xunit_runner_workflow
(TEST-RUNNER-001 DOING — sprint remains active).

- scripts/test-targeted-xunit.ps1: rebuild-and-invoke xUnit v3 in-process
  runner directly so targeted filters work under Microsoft Testing Platform
  (dotnet test --filter is ignored there).
- Register sprint file in implplan.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-04-19 14:48:23 +03:00
master
55ba864798 wip(concelier): tests for observation + affected symbol stores 
Follow-up to SPRINT_20260419_027_Concelier_durable_affected_symbol_runtime.

PostgresAdvisoryObservationStoreTests + PostgresAffectedSymbolStoreTests
covering the durable store behaviour.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-04-19 14:48:04 +03:00
master
d6a7788070 wip(concelier): durable advisory observation + affected symbol stores 
Follow-up to SPRINT_20260419_027_Concelier_durable_affected_symbol_runtime
(REALPLAN-007-F still DOING).

Postgres-backed IAdvisoryObservationStore + IAffectedSymbolStore
implementations for the durable observation + affected-symbol
persistence path introduced by migration 008.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-04-19 14:47:49 +03:00
master
7d8078985f docs(implplan): archive 34 DONE sprints; mark 2 active + 1 DOING 
Archive every sprint in docs/implplan where all tasks are Status: DONE,
plus two Platform sprints that were moved manually but not yet tracked.

Archived (34):
- SPRINT_20260415_001 master cutover plan
- SPRINT_20260415_002 FE integration audit links + dashboard tips
- SPRINT_20260415_002..007 DOCS: notify/notifier, scheduler/registry,
  runtime data plane, platform/binaryindex/doctor, policy/findings/signer,
  concelier/excititor
- SPRINT_20260416_003..017 (Graph, Replay, Timeline, BinaryIndex symbols,
  Router, Notify x4 sub-sprints, Authority x2, ExportCenter x3, Attestor)
- SPRINT_20260417_001 Platform setup advisory/vex onboarding
- SPRINT_20260417_018..024 (AdvisoryAI x2, JobEngine webhook limiter,
  Integrations, Doctor, Concelier x2) + DevOps dotnet image
- SPRINT_20260418_025 Concelier durable mirror bundle import
- SPRINT_20260419_026 Concelier mirror import allowlisted root

Previously moved (2) now tracked under docs-archived:
- SPRINT_20260416_001 Platform local compose reset/rebuild + CLI bootstrap
- SPRINT_20260416_013 Platform truthful default bootstrap without demo seed

Still active in docs/implplan (5):
- SPRINT_20260408_004 Timeline unified audit sink (AUDIT-002..007 TODO)
- SPRINT_20260408_005 Audit endpoint filters deprecation
  (DEPRECATE-001..003 TODO; CAPSULE-001 BLOCKED)
- SPRINT_20260417_002 JobEngine scheduler storage compose compat (DOING)
- SPRINT_20260418_001 Platform advisory setup hardening (ADV-SETUP-008 DOING)
- SPRINT_20260419_027 Concelier durable affected symbol runtime (DOING)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-04-19 14:47:26 +03:00
master
34e70d9090 wip(concelier): adjust unsupported runtime wiring test after guard removal 
Follow-up to SPRINT_20260419_027_Concelier_durable_affected_symbol_runtime.

UnsupportedRuntimeWiringTests updated for the removed non-testing
UnsupportedAffectedSymbol registration.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-04-19 14:47:01 +03:00
master
b6064f084c wip(concelier): wire observation pipeline; drop affected-symbol guard 
Follow-up to SPRINT_20260419_027_Concelier_durable_affected_symbol_runtime
(REALPLAN-007-F still DOING).

- Program.cs: register AddConcelierObservationPipeline and drop the
  non-testing UnsupportedAffectedSymbolStore/Provider overrides — the
  durable stores will replace them as REALPLAN-007-F lands.
- ConcelierInfrastructureRegistrationTests: contract test asserting
  AddConcelierPostgresStorage registers durable observation lookup/sink
  and affected-symbol store services.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-04-19 14:46:52 +03:00
master
78464b6dbe wip(concelier): advisory observations + affected-symbol migration 008 
Sprint SPRINT_20260419_027_Concelier_durable_affected_symbol_runtime
(REALPLAN-007-F still DOING — sprint remains active).

- Migration 008: advisory_observations + affected_symbols tables.
- ConcelierPersistenceExtensions + Postgres ServiceCollectionExtensions
  hooks for future durable observation + affected-symbol stores.
- Register sprint file in implplan.

Sprint _023's `501` fallback (UnsupportedAffectedSymbolServices) stays in
place until the durable stores + ingest wiring land.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-04-19 14:45:44 +03:00
master
fdf95e0f46 docs: module dossier + install/quickstart sync for truthful cutover sprints 
- API_CLI_REFERENCE.md, INSTALL_GUIDE.md, quickstart.md, architecture/integrations.md, dev/DEV_ENVIRONMENT_SETUP.md, integrations/LOCAL_SERVICES.md: reflect real-service wiring.
- docs/modules/**: module dossier updates across the modules touched by SPRINT_20260415_001..007 + SPRINT_20260416_003..017 + SPRINT_20260417_018..024 + SPRINT_20260418_025 + SPRINT_20260419_026.
- docs/features/checked/web/**: update feature notes where UI changed.
- docs/qa/feature-checks/runs/web/evidence-presentation-ux/: QA evidence artifacts.
- docs/setup/**, docs/technical/**: align with setup wizard contracts.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-04-19 14:45:09 +03:00
master
ad62ba7f76 feat(signals,reachgraph,airgap,zastava): postgres runtime persistence 
Cross-module truthful runtime persistence supporting the sprint_20260415
and sprint_20260416 cutovers. These modules have no single dedicated
sprint owner in the current batch, but they unblock downstream wiring
in Policy (reachability facts), ReachGraph (signals adapter), and the
air-gap controller/time services.

- Signals.Persistence: migration 003 runtime_canonical_tables; Postgres
  repos (callgraph + projection, reachability fact/store, deployment refs,
  graph metrics); DB context factory + service collection extensions.
- Signals: swap in-memory callgraph/reachability repositories for Postgres
  wired via SignalsPersistenceExtensions; durable host tests.
- ReachGraph.WebService: SignalsHttpAdapter + program wiring; host wiring +
  adapter tests.
- AirGap.Controller: service-collection extensions + infrastructure wiring;
  endpoint + startup contract tests.
- AirGap.Time: PostgresTimeAnchorStore + startup service; runtime contract
  + persistence tests.
- AirGap.Persistence: persistence extensions.
- Zastava: csproj cleanup (Observer + Core).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-04-19 14:44:57 +03:00
master
87a5d2ee22 chore(libs): infrastructure postgres host + attestation slicing + testkit 
Shared infrastructure supporting the truthful runtime persistence cutover
sprints — no dedicated sprint owner, these libs are consumed by multiple
services.

- Infrastructure.Postgres: MigrationCategory + StartupMigrationHost +
  tests (MigrationExecution, Recording, Flags).
- AdvisoryAI.Attestation: slice AiAttestationService into partial files
  (Create/Read/Verify), align IAiAttestationStore + InMemory store,
  service tests.
- TestKit: ValkeyFixture for tests that need a shared valkey instance.
- Doctor/AdvisoryAI/IEvidenceSchemaRegistry: shared interface.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-04-19 14:44:43 +03:00
master
07cdba01cd feat(web): integration hub audit links + dashboard tips + e2e 
Sprint SPRINT_20260415_002_FE_integration_audit_links_and_dashboard_tips.

- integration-hub: integration-detail component + spec with audit links.
- dashboard-v3: component + specs (core/testing + tests/dashboard) with
  getting-started tips.
- audit-log: audit-log-table component + spec.
- policy-governance: client + scope helper.
- deploy-diff: panel + page + service.
- graph: graph-filters component.
- jobengine: scheduler-workers-panel component.
- reachability: reachability-center + witness page components.
- release-investigation: release-investigation-context.
- E2E: audit-consolidation, integrations, policy-orchestrator specs +
  live-auth fixture; live-frontdoor-auth script + playwright outputs.
- Utility scripts: debug-auth, probe-services, scan-pages.
- package.json tweaks.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-04-19 14:44:06 +03:00
master
64ea1f0994 feat(concelier): durable mirror bundle import with allowlisted root 
Sprints SPRINT_20260418_025_Concelier_durable_mirror_bundle_import_runtime
and SPRINT_20260419_026_Concelier_mirror_import_allowlisted_root.

- MirrorBundleImportRuntimeService: durable PostgreSQL-backed live mirror
  bundle importer replacing the testing-only in-memory path.
- Enforces an allowlisted import root (Mirror.ImportRoot) and rejects
  bundle/trust-root paths that resolve outside it; relative paths resolve
  against the configured root, not the process cwd.

_025 and _026 ship together because _026 extends the same live importer
introduced in _025; splitting leaves an unguarded filesystem reach.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-04-19 14:43:42 +03:00
master
24be2f2268 chore(devops): dotnet release image + compose/bootstrap stabilization 
Sprint SPRINT_20260417_024_DevOps_dotnet_release_image_stabilization.

- Dockerfile.platform + Dockerfile.dotnet-service adjustments for
  deterministic layer ordering and cache-friendly publish.
- devops/release/components.json updates.
- devops/compose: .env, README, legacy + stella-services docker-compose,
  stellaops env example, postgres-init 04/04b/15/16 authority + release
  schemas, setup.bootstrap.local.yaml.
- Gitea build_release.py script.
- scripts/register-local-integrations.ps1.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-04-19 14:43:23 +03:00
master
c7109ed214 feat(concelier): postgres feed mirror runtime + management endpoints 
Sprint SPRINT_20260417_024_Concelier_truthful_feed_mirror_runtime.

- WebService extensions: feed mirror management endpoints, mirror domain
  management endpoint extensions, mirror endpoint extensions.
- Persisted mirror runtime settings provider.
- StellaOpsMirror connector: Jobs, StellaOpsMirrorConnector,
  StellaOpsMirrorDependencyInjectionRoutine, runtime settings provider.
- Tests: StellaOpsMirrorConnectorTests + mirror-advisory expected fixture.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-04-19 14:43:14 +03:00
master
77b88cbfa3 feat(concelier): unsupported affected-symbol runtime guard 
Sprint SPRINT_20260417_023_Concelier_truthful_affected_symbol_runtime.

UnsupportedAffectedSymbolServices shim returning a clear
501/unsupported response until the durable affected-symbol backend ships.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-04-19 14:42:34 +03:00
master
9bcd0fdba3 feat(advisoryai): testing-only runtime fallback contract tests 
Sprint SPRINT_20260417_022_AdvisoryAI_truthful_testing_only_runtime_fallback.

AdvisoryAiRuntimeStartupContractTests documenting the testing-only
in-memory fallback and its boundary versus the durable runtime.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-04-19 14:42:28 +03:00
master
f2eaf6bb3d feat(doctor): evidence schema registry runtime 
Sprint SPRINT_20260417_021_Doctor_truthful_evidence_schema_registry_runtime.

IEvidenceSchemaRegistry contract, service-collection extension,
registration tests.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-04-19 14:41:58 +03:00
master
fb3762ef6c feat(integrations): built-in plugin catalog runtime + impact endpoints 
Sprint SPRINT_20260417_020_Integrations_truthful_builtin_plugin_runtime.

- IntegrationBuiltInPluginCatalog + IntegrationEndpoints +
  IntegrationService wiring, program updates, csproj.
- Tests: plugin loader, service, impact endpoints.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-04-19 14:41:48 +03:00
master
70cbfcee72 feat(scheduler): postgres + redis webhook rate limiter runtime 
Sprint SPRINT_20260417_019_JobEngine_truthful_webhook_rate_limiter_runtime.

NoOpWebhookRateLimiter + RedisWebhookRateLimiter, service-collection
wiring, WebhookRateLimiterRuntimeTests, SCHED-WEB-16-104-WEBHOOKS doc.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-04-19 14:41:42 +03:00
master
052de213e1 feat(advisoryai): postgres runtime state cutover 
Sprint SPRINT_20260417_018_AdvisoryAI_truthful_runtime_state_cutover.

- Migrations 009 ai_runtime_state + 010 advisory_ai_runtime_state_extensions.
- PostgresConversationService + PostgresAdvisoryChatSettingsStore.
- PostgresExplanationStore, PostgresPolicyIntentStore, PostgresRunStore,
  PostgresAiAttestationStore, PostgresAiConsentStore.
- Core + WebService runtime persistence extensions and program wiring.
- Chat integration + durable runtime tests.

Sub-sprint _022 (testing-only runtime fallback) follows.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-04-19 14:41:34 +03:00
master
a15405431b wip(scheduler): compose storage configuration compatibility 
Sprint SPRINT_20260417_002_JobEngine_scheduler_storage_compose_compatibility
(SCHEDULER-COMPAT-001 still DOING — sprint remains active).

Adds scheduler storage configuration adapter layer so the web host
accepts the compose-shaped storage configuration without manual remapping,
plus SchedulerStorageConfigurationTests.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-04-19 14:41:18 +03:00
master
0b7ba36f30 feat(web): advisory/vex onboarding setup wizard 
Sprint SPRINT_20260417_001_Platform_setup_advisory_vex_onboarding
(Platform backend landed in commit 9393baf1a).

- Setup wizard feature: components (setup-wizard, step-content,
  step-content.defaults.spec), models, services
  (setup-wizard-api.service, setup-wizard-state.service) + specs.
- Advisory source catalog component + behavior spec.
- Live setup-wizard first-run bootstrap script + playwright auth/state
  output fixtures.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-04-19 14:41:08 +03:00
master
fcf9cc1b77 feat(attestor): postgres entry repo + audit sink + bulk shim 
Sprint SPRINT_20260416_017_Attestor_truthful_runtime_storage_cutover.

- Attestor.Persistence: migration 002 attestor_runtime_entries_and_watchlist,
  PostgresAttestorEntryRepository + PostgresAttestorAuditSink,
  service-collection extensions.
- Attestor.WebService: composition + endpoints wiring.
- Attestor.Infrastructure: UnsupportedBulkVerificationJobStore shim.
- Tests: AttestorTruthfulRuntimeTests.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-04-19 14:40:40 +03:00
master
5c574cd787 feat(exportcenter): truthful web/job-admin/timeline-sink runtime cutover 
Sprints SPRINT_20260416_014/015/016_ExportCenter_truthful_*_runtime.

- Infrastructure: PostgresExportArtifactRepository.
- WebService: unsupported-shims for export attestation, audit-bundle job
  handler, exception report generator, incident manager, promotion
  attestation assembler, risk-bundle job handler, simulation exporter,
  timeline notification sink; runtime/verification scaffolding.
- Tests: AuditBundle program HTTP integration + runtime suites.

Consolidated because sprints _014 (web), _015 (job admin), _016
(timeline sink) share repo + Program.cs + runtime wiring; splitting
would produce non-buildable intermediate states.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-04-19 14:40:31 +03:00
master
f6f1bde5f2 feat(issuerdirectory): postgres persistence runtime + sample config 
Sprint SPRINT_20260416_013_Authority_issuerdirectory_truthful_persistence_runtime.

IssuerDirectory.WebService Postgres persistence, options,
program wiring, tests. Sample config under etc/.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-04-19 14:40:22 +03:00
master
fe3eacbba4 feat(authority): truthful dpop runtime extensions 
Sprint SPRINT_20260416_012_Authority_truthful_dpop_runtime.

AuthorityDpopRuntimeExtensions wiring, standard plugin bootstrapper +
options tests, DPoP runtime security tests.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-04-19 14:40:16 +03:00
master
45ebcb88b9 feat(notifier): security + deadletter runtime 
Sprint SPRINT_20260416_011_Notify_truthful_security_deadletter_runtime.

- Migration 004 security_deadletter_runtime_state.
- DeadLetterRuntimeEntity + WebhookSecurityConfigEntity +
  WebhookValidationNonceEntity persistence models.
- PostgresDeadLetterService + PostgresDeadLetterHandler observability.
- PostgresTenantIsolationValidator + PostgresWebhookSecurityService.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-04-19 14:40:06 +03:00
master
43d8398a5d feat(notifier): quiet-hours + maintenance window runtime 
Sprint SPRINT_20260416_010_Notify_truthful_quiet_hours_maintenance_runtime.

- Migration 002 quiet_hours_maintenance_runtime_metadata.
- QuietHoursEntity + MaintenanceWindowEntity persistence models.
- PostgresQuietHoursRuntimeServices + QuietHoursRuntimeProjection.
- Notify + Notifier WebService compat shims.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-04-19 14:39:56 +03:00
master
9148c088da feat(notifier): postgres escalation + on-call schedule compat 
Sprint SPRINT_20260416_009_Notify_truthful_escalation_oncall_runtime.

PostgresEscalationRuntimeServices plus Notify + Notifier WebService
compat shims for escalation policy and on-call schedule service.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-04-19 14:39:47 +03:00
master
b877e13b3c feat(notifier): postgres suppression admin runtime 
Sprint SPRINT_20260416_008_Notify_truthful_suppression_admin_runtime.

Postgres-backed suppression runtime services wired through the admin
runtime extension registered in the durable storage bootstrap.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-04-19 14:39:37 +03:00
master
23bef5befc feat(router,gateway): postgres dpop replay + cache store + claim mapper 
Sprint SPRINT_20260416_007_Router_truthful_dpop_replay_runtime.

- Gateway.WebService: GatewayDpopReplayRuntimeExtensions, authorization
  middleware + integration + dpop replay runtime tests.
- Messaging.Transport.Postgres: PostgresCacheStore + tests.
- Microservice.AspNetCore: DefaultAuthorizationClaimMapper + tests.
- Router.Common: ClaimRequirement.
- Router.Gateway: authorization middleware, OpenAPI claim security
  mapper + document generator.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-04-19 14:39:28 +03:00
master
8ed3f869f5 feat(binaryindex,symbols): truthful symbol-source runtime + migrations 
Sprint SPRINT_20260416_006_BinaryIndex_symbols_truthful_manifest_runtime.

Symbols.Server: in-memory symbol source read repository with real
endpoints, program wiring, migrations, tests services.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-04-19 14:39:20 +03:00
master
9efe5cdb64 feat(timeline): truthful ingestion transport + indexer wiring 
Sprint SPRINT_20260416_005_Timeline_truthful_ingestion_transport_contract.

Timeline WebService + TimelineIndexer worker program wiring; infrastructure
DI extension with null subscriber fallback; startup registration +
ingestion runtime registration tests.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-04-19 14:39:14 +03:00
master
9d569fdeb8 feat(replay): truthful snapshot index runtime 
Sprint SPRINT_20260416_004_Replay_truthful_snapshot_index_cutover.

Replay WebService program wiring; runtime startup contract tests,
point-in-time query API integration tests, test environment variable
scope helper.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-04-19 14:39:09 +03:00
master
32551baf0e feat(graph): truthful postgres runtime + unsupported feature gating 
Sprint SPRINT_20260416_003_Graph_graph_api_truthful_runtime_cutover.

Postgres-backed graph repository + runtime repo with
GraphFeatureUnavailableException and GraphRuntimeFallbackServices.
Runtime-state compatibility endpoints, tenant authorization alignment,
integration tests for edge metadata / export / query overlay /
unsupported feature paths.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-04-19 14:39:03 +03:00
master
2b58c9ed3c feat(concelier,excititor): postgres lease + vex attestations + graph overlay 
Sprint SPRINT_20260415_007_DOCS_concelier_excititor_real_backend_cutover.

- Concelier.Persistence: migrations 000 (pg_trgm) + 007 (job_leases),
  PostgresLeaseStore + service collection wiring + tests.
- Concelier.Core.Sources: source definitions / registry / sync trigger
  contract.
- Concelier.WebService: Postgres-backed advisory/source services,
  job registration, immediate sync trigger, options post-configure +
  validator, internal setup-source endpoint extensions, plugin unified
  adapter factory, unsupported job/coordinator/orchestrator shims.
- Excititor.WebService: graph options + overlay store wiring.
- Excititor.Persistence: migrations 004 (graph overlays) + 005
  (vex attestations), PostgresVexAttestationStore + tests.

Sub-sprints _023 (affected symbol guard), _024 (feed mirror runtime),
_025 (durable mirror bundle import), _026 (allowlisted root) follow up.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-04-19 14:38:44 +03:00
master
462565fdab feat(policy,signer): postgres stores + verdict rekor wiring 
Sprint SPRINT_20260415_006_DOCS_policy_findings_signer_real_backend_cutover
(findings portion landed in commit e60d5e0fc).

- Policy.Engine: Postgres stores for airgap state, attestation reports,
  verification policy, console export, policy pack repo, risk scoring job,
  violation events; messaging-backed evaluation + reachability facts cache;
  governance / violation / simulation endpoints; UnsupportedVerdictRekorClient.
- Policy.Persistence: migrations 010 (policy pack runtime state),
  011 (violation fusion results), 012 (runtime canonical state).
- Policy.Gateway: governance + simulation endpoints + rekor/token-cache
  runtime wiring tests.
- Policy.Registry: in-memory store scaffolding + testing harness.
- Signer: Postgres ceremony repo + audit sink, structured logging sink,
  stateless quota service, configured POE introspector, runtime proof /
  wiring / key rotation / observability / negative / contract tests.
- Signer.KeyManagement: migrations 002 ceremony runtime state,
  003 trust anchor runtime state, 004 key audit log shape fix.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-04-19 14:37:43 +03:00
master
9393baf1ad feat(platform,binaryindex,doctor): runtime persistence cutover 
Sprint SPRINT_20260415_005_DOCS_platform_binaryindex_doctor_real_backend_cutover.

- Platform.WebService: AoC/quota compatibility endpoints, platform health
  service, setup wizard contracts/endpoints/service, release migrations
  058 (trust signing demo seed) + 067 (cleanup), context migration tests.
- BinaryIndex.WebService: golden-set controller + storage extensions,
  runtime persistence extensions, durable runtime + storage registration
  tests.
- Doctor: scheduler runtime guard, report storage extensions,
  scheduler + webservice registration tests.

Sub-sprints _006 (symbols truthful manifest) and _021 (doctor evidence
schema registry) land as follow-ups.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-04-19 14:37:20 +03:00
master
e60d5e0fce feat(findings,sbomservice,scanner): runtime data plane cutover 
Sprint SPRINT_20260415_004_DOCS_runtime_data_plane_real_backend_cutover.

- Findings.Ledger: Postgres-backed endpoints (runtime timeline/traces,
  scoring, vuln-explorer, webhook), unsupported-compat shim, ledger data
  source, vulnerability detail service.
- RiskEngine.WebService: web application factory + runtime wiring tests.
- SbomService: rename InMemory -> ManifestBacked metadata repo, add
  Postgres registry source/ledger/lineage/event/watermark repos +
  migrations 001 initial schema and 002 runtime durable state.
- Scanner: SBOM uploads store + migration 026, scan runtime state +
  migration 027, persisted scan coordinator, Postgres policy repos,
  VEX gate query service + controller, reachability evidence migration 022.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-04-19 14:36:40 +03:00
master
302826aedb feat(scheduler,packsregistry,registry): postgres backend cutover 
Sprint SPRINT_20260415_003_DOCS_scheduler_registry_real_backend_cutover.

- Scheduler WebService: Postgres-backed audit service + resolver job service,
  system schedule bootstrap, durable host tests, jwt app factory
- PacksRegistry: persistence extensions + migration 002 runtime pack repo,
  durable runtime + startup contract tests
- Registry.TokenService: Postgres plan rule store + admin endpoints,
  migration 001 initial schema, durable runtime + persistence tests
- Scheduler.Plugin.Doctor: wiring for doctor job plugin
- Sprint _019 (webhook rate limiter) and _002 (compose storage compat)
  land separately.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-04-19 14:36:05 +03:00
master
6b89bd5652 feat(notify,notifier): postgres durable runtime base cutover 
Sprint SPRINT_20260415_002_DOCS_notify_notifier_real_backend_cutover.

Base durable storage wiring for both Notify and Notifier:
- NotifyDbContext + EF migrations (002 pack_approvals, 003 operator_override)
- Pack approval / operator override / retention / tenant isolation repos
- Notifier worker Postgres repository adapters (audit, channel, delivery,
  inbox, localization, lock, rule, template) + runtime service base
- Durable runtime fixture + integration test scaffolding
- WebService compat shims for pack approval, operator override, throttle

Sub-sprints _008 (suppression), _009 (escalation), _010 (quiet hours),
_011 (security/deadletter) land as follow-ups.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-04-19 14:35:30 +03:00
master
577a56ebc0 docs(implplan): real-service cutover master plan 
Sprint SPRINT_20260415_001 — track execution across the cutover
sub-sprints and record per-module evidence.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-04-19 14:34:08 +03:00
master
44c4aec0d4 chore: ignore claude code agent worktrees 
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-04-19 14:33:59 +03:00