stella-ops.org/git.stella-ops.org
1
0
Fork 0
Code Issues Pull Requests Actions 2 Releases Wiki Activity
1,209 Commits 1 Branch 0 Tags
f5a9f874d043fcf398b568005266ee997accb0f5
Commit Graph

353 Commits

Author SHA1 Message Date
master
65106afe4c refactor: DB schema fixes + container renames + compose include + audit sprint 
- FindingsLedger: change schema from public to findings (V3-01)
- Add 9 migration module plugins: RiskEngine, Replay, ExportCenter, Integrations, Signer, IssuerDirectory, Workflow, PacksRegistry, OpsMemory (V4-01 to V4-09)
- Remove 16 redundant inline CREATE SCHEMA patterns (V4-10)
- Rename export→export-web, excititor→excititor-web for consistency
- Compose stella-ops.yml: thin wrapper using include: directive
- Fix dead /api/v1/jobengine/* gateway routes → release-orchestrator/packsregistry
- Scheduler plugin architecture: ISchedulerJobPlugin + ScanJobPlugin + DoctorJobPlugin
- Create unified audit sink sprint plan
- VulnExplorer integration tests + gap analysis

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-04-08 16:10:36 +03:00
master
6592cdcc9b refactor(graph): absorb Cartographer into graph-api + wire Graph Indexer 
- Wire Graph Indexer library + Persistence into graph-api (csproj refs + DI)
- Add build/overlay endpoints matching Scheduler HTTP contracts
  (POST/GET /api/graphs/builds, POST/GET /api/graphs/overlays)
- Add PostgresGraphRepository for reading from graph.graph_nodes/edges
- Register SBOM ingest, analytics, change-stream, and inspector pipelines
- Comment out Cartographer container in compose (empty shell, Slot 21)
- Add cartographer.stella-ops.local as backwards-compat alias on graph-api
- Update Scheduler config to target graph.stella-ops.local
- Update services-matrix.env, hosts file, port-registry, module-matrix
- Update component-map, architecture docs, Scanner/Graph READMEs
- Eliminates 1 container (stellaops-cartographer)

All 133 existing tests pass (77 Api + 37 Indexer + 19 Core).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-04-08 15:48:18 +03:00
master
0e25344bd7 refactor(jobengine): delete TaskRunner service 
- Remove TaskRunner source, tests, libraries (3 directories)
- Remove from compose, services-matrix, nginx, hosts, smoke tests
- Remove CLI commands, UI references, Authority scopes
- Remove docs, OpenAPI spec, QA state files
- Leave task_runner_id DB columns as nullable legacy
- PacksRegistry preserved (independent service)
- Eliminates 2 containers (taskrunner-web + taskrunner-worker)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-04-08 14:11:20 +03:00
master
80c33d3c59 Merge branch 'worktree-agent-a09ac2bf' 2026-04-08 13:45:25 +03:00
master
6b15d9827d refactor(findings): merge VulnExplorer into Findings Ledger 
- Move VulnExplorer DTOs into Ledger WebService Contracts/VulnExplorer/
  (VulnModels, VexDecisionModels, TriageWorkflowModels, AttestationModels,
   FixVerificationModels, EvidenceSubgraphContracts)
- Create VulnExplorerEndpoints.cs mounting all 10 original endpoints
  (/v1/vulns, /v1/vex-decisions, /v1/evidence-subgraph,
   /v1/fix-verifications, /v1/audit-bundles)
- Create adapter services (VulnExplorerAdapters.cs) that delegate to
  existing Ledger services (FindingSummaryService, VulnerabilityDetailService,
  EvidenceGraphBuilder, VexConsensusService)
- Wire VulnExplorer authorization policies and service registrations
  in Ledger Program.cs
- Comment out api (VulnExplorer) container in docker-compose.stella-ops.yml
- Add vulnexplorer.stella-ops.local as network alias on findings-ledger-web
- Update gateway route: /api/vuln-explorer(..) -> findings.stella-ops.local
- Update STELLAOPS_VULNEXPLORER_URL -> findings.stella-ops.local
- Comment out VulnExplorer in services-matrix.env and hosts file
- Update docs: port-registry, component-map, module-matrix, webservice-catalog,
  findings-ledger README
- Eliminates 1 container (stellaops-api)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-04-08 13:43:04 +03:00
master
c1ecc75ace refactor(policy): merge policy gateway into policy-engine 
- Move 24 gateway source files (endpoints, services, contracts) into engine
  under Endpoints/Gateway/, Services/Gateway/, Contracts/Gateway/ namespaces
- Add gateway DI registrations and endpoint mappings to engine Program.cs
- Add missing project references (StellaOps.Policy.Scoring, DeltaVerdict, Localization)
- Remove HTTP proxy layer (PolicyEngineClient, DPoP, forwarding context not copied)
- Update gateway routes in router appsettings to point to policy-engine
- Comment out policy service in docker-compose, add backwards-compat network alias
- Update services-matrix (gateway build line commented out)
- Update all codebase references: AdvisoryAI, JobEngine, CLI, router tests, helm
- Update docs: OFFLINE_KIT, configuration-migration, gateway guide, port-registry
- Deprecate etc/policy-gateway.yaml.sample with notice
- Eliminates 1 container, 9 HTTP round-trips, DPoP token flow

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-04-08 13:19:09 +03:00
master
9eec100204 refactor(notify): merge Notifier WebService into Notify WebService 
- Delete dead Notify Worker (NoOp handler)
- Move 51 source files (endpoints, contracts, services, compat stores)
- Transform namespaces from Notifier.WebService to Notify.WebService
- Update DI registrations, WebSocket support, v2 endpoint mapping
- Comment out notifier-web in compose, update gateway routes
- Update architecture docs, port registry, rollout matrix
- Notifier Worker stays as separate delivery engine container

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-04-08 13:17:13 +03:00
master
3a95f315bd feat(airgap): multi-source import (server path, URL, file upload) with overlay UX 
Import now supports three sources: server-side path (USB/NFS volumes),
backend URL download, and browser file upload. Export/import workflows
refactored from routed pages to overlay dialogs. Docs updated with
volume mount instructions and source comparison table.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-04-07 15:33:21 +03:00
master
071209a2ae Complete TASK-5 source coverage audit and archive all 20 finished sprints 
Add docs/modules/concelier/source-coverage.md with 70-source audit (33/70
connectors implemented, P1 fully covered, 9 P2 gaps identified).
Archive all 20 completed sprints from docs/implplan/ to docs-archived/.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-04-06 09:58:33 +03:00
master
50abd2137f Update docs, sprint plans, and compose configuration 
Add 12 new sprint files (Integrations, Graph, JobEngine, FE, Router,
AdvisoryAI), archive completed scheduler UI sprint, update module
architecture docs (router, graph, jobengine, web, integrations),
and add Gitea entrypoint script for local dev.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-04-06 08:53:50 +03:00
master
fc798a1573 Harden remaining runtime transport lifecycles 2026-04-06 00:24:16 +03:00
master
f96c6cb9ed Complete release compatibility and host inventory sprints 
Signed-off-by: master <>
 2026-03-31 23:53:45 +03:00
master
b6bf113b99 feat(web): harden split release promotion handoff 
Signed-off-by: master <>
 2026-03-31 23:52:32 +03:00
master
0d858ba9d1 fix(platform): make topology probe fallback truthful 
Signed-off-by: master <>
 2026-03-31 23:44:40 +03:00
master
152c1b1357 doctor: complete runtime check documentation sprint 
Signed-off-by: master <>
 2026-03-31 23:26:24 +03:00
master
404d50bcb7 feat(web): complete topology host verification ui 2026-03-31 23:24:10 +03:00
master
a6ffb38ecf Update module architecture docs and workflow tutorials 
- Module dossiers: attestor, authority, cli, graph, scanner
- Policy assistant parameters guide
- UI v2-rewire navigation rendering policy
- Test suite overview update
- Workflow engine requirements and tutorial series (01-08)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-03-30 17:25:37 +03:00
master
4d8a48a05f Sprint 7+8: Journey UX fixes + identity envelope shared middleware 
Sprint 7 — Deep journey fixes:
  S7-T01: Trust & Signing empty state with "Go to Signing Keys" CTA
  S7-T02: Notifications 3-step setup guide (channel→rule→test)
  S7-T03: Topology validate step skip — "Skip Validation" when API fails,
    with validateSkipped signal matching agentSkipped pattern
  S7-T04: VEX export note on Risk Report tab linking to VEX Ledger

Sprint 8 — Identity envelope shared middleware (ARCHITECTURE):
  S8-T01: New UseIdentityEnvelopeAuthentication() extension in
    StellaOps.Router.AspNet. Reads X-StellaOps-Identity-Envelope headers,
    verifies HMAC-SHA256 via GatewayIdentityEnvelopeCodec, creates
    ClaimsPrincipal with sub/tenant/scopes/roles. 5min clock skew.
  S8-T02: Concelier refactored — removed 78 lines of inline impl,
    now uses shared one-liner
  S8-T03: Scanner — UseIdentityEnvelopeAuthentication() added
  S8-T04: JobEngine — UseIdentityEnvelopeAuthentication() added
  S8-T05: Timeline — UseIdentityEnvelopeAuthentication() added
  S8-T06: Integrations — UseIdentityEnvelopeAuthentication() added
  S8-T07: docs/modules/router/IDENTITY_ENVELOPE_MIDDLEWARE.md

All services now authenticate ReverseProxy requests via gateway envelope.
Scanner scan submit should now work with authenticated identity.

Angular: 0 errors. .NET (6 services): 0 errors.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-03-16 18:27:46 +02:00
master
189171c594 Sidebar 5-group restructure + demo data badges + audit emission infrastructure 
Sprint 4 — Sidebar restructure (S4-T01+T02):
  5 groups: Release Control, Security, Operations, Audit & Evidence, Setup & Admin
  Groups 4+5 collapsed by default for new users
  Operations extracted from Release Control into own group
  Audit extracted from Security into own group
  groupOrder and resolveMenuGroupLabel updated
  Approvals badge moved to section-level

Sprint 2 — Demo data badges (S2-T04+T05):
  Backend: isDemo=true on all compatibility/seed responses in
    PackAdapterEndpoints, QuotaCompatibilityEndpoints, VulnerabilitiesController
  Frontend: "(Demo)" badges on Usage & Limits page quotas
  Frontend: "(Demo)" badges on triage artifact list when seed data
  New PlatformItemResponse/PlatformListResponse with IsDemo field

Sprint 6 — Audit emission infrastructure (S6-T01+T02):
  New shared library: src/__Libraries/StellaOps.Audit.Emission/
    - AuditActionAttribute: [AuditAction("module", "action")] endpoint tag
    - AuditActionFilter: IEndpointFilter that auto-emits UnifiedAuditEvent
    - HttpAuditEventEmitter: POSTs to Timeline /api/v1/audit/ingest
    - Single-line DI: services.AddAuditEmission(configuration)
  Timeline service: POST /api/v1/audit/ingest ingestion endpoint
    - IngestAuditEventStore: 10k-event ring buffer
    - CompositeUnifiedAuditEventProvider: merges HTTP-polled + ingested
  Documentation: docs/modules/audit/AUDIT_EMISSION_GUIDE.md

Angular build: 0 errors. .NET builds: 0 errors.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-03-16 14:48:18 +02:00
master
da76d6e93e Add topology auth policies + journey findings notes 
Concelier:
- Register Topology.Read, Topology.Manage, Topology.Admin authorization
  policies mapped to OrchRead/OrchOperate/PlatformContextRead/IntegrationWrite
  scopes. Previously these policies were referenced by endpoints but never
  registered, causing System.InvalidOperationException on every topology
  API call.

Gateway routes:
- Simplified targets/environments routes (removed specific sub-path routes,
  use catch-all patterns instead)
- Changed environments base route to JobEngine (where CRUD lives)
- Changed to ReverseProxy type for all topology routes

KNOWN ISSUE (not yet fixed):
- ReverseProxy routes don't forward the gateway's identity envelope to
  Concelier. The regions/targets/bindings endpoints return 401 because
  hasPrincipal=False — the gateway authenticates the user but doesn't
  pass the identity to the backend via ReverseProxy. Microservice routes
  use Valkey transport which includes envelope headers. Topology endpoints
  need either: (a) Valkey transport registration in Concelier, or
  (b) Concelier configured to accept raw bearer tokens on ReverseProxy paths.
  This is an architecture-level fix.

Journey findings collected so far:
- Integration wizard (Harbor + GitHub App): works end-to-end
- Advisory Check All: fixed (parallel individual checks)
- Mirror domain creation: works, generate-immediately fails silently
- Topology wizard Step 1 (Region): blocked by auth passthrough issue
- Topology wizard Step 2 (Environment): POST to JobEngine needs verify
- User ID resolution: raw hashes shown everywhere

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-03-16 08:12:39 +02:00
master
b2cc26b161 Document mirror client setup wizard and consumer API endpoints 
mirror.md: added section 8 covering the 4-step UI wizard flow, wizard
vs env var comparison table, and air-gap bundle import via UI and CLI.

architecture.md: added 6 consumer API endpoints (GET/PUT /consumer,
discover, verify-signature, import, import/status) to REST API section.

airgap-operations-runbook.md: cross-reference to UI import alternative.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-15 14:49:43 +02:00
master
254d8b9cfc Update documentation for 75-source catalog and mirror management 
connectors.md: categorized index of all 75 sources across 14 categories
with descriptions, auth requirements, priorities, regions, and status.
FSTEC BDU, NKCKI, and Kaspersky ICS promoted from beta to stable.

architecture.md: updated source families (75 sources, 14 categories),
added mirror domain management API (12 endpoints) to REST APIs section.

mirrors.md: added MirrorExportScheduler docs, multi-value filter support
(sourceCategory/sourceTag shorthands), mirror config UI sections (wizard,
dashboard, catalog integration).

docker.md: added section 7 with mirror env var reference (11 vars),
domain config via env vars, filter shorthand documentation.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-15 14:34:49 +02:00
master
bd78523564 Widen scratch iteration 011 with fixture-backed integrations QA 2026-03-14 03:11:45 +02:00
master
bf4ff5bfd7 Close scratch iteration 009 grouped policy and VEX audit repairs 2026-03-13 19:25:48 +02:00
master
317e55e623 Complete scratch iteration 004 setup and grouped route-action fixes 2026-03-12 19:28:42 +02:00
master
29b68f5bee Repair search result routing and advisory query ranking 2026-03-12 11:57:40 +02:00
master
66e67f1a97 Restore Doctor search after AdvisoryAI cold-start race 2026-03-11 21:19:42 +02:00
master
f0b2ef3319 Align live evidence export with audit bundles 2026-03-11 18:21:47 +02:00
master
9dd8592a2a Repair triage artifact scope and evidence contracts 2026-03-11 14:25:59 +02:00
master
568a1df468 Fix watchlist draft hydration and update contracts 2026-03-11 10:56:31 +02:00
master
5c874c8f64 Make remote localization startup non-blocking 2026-03-11 10:07:30 +02:00
master
3865b93091 Repair live jobs queues action handoffs 2026-03-10 20:46:55 +02:00
master
f727ec24fd Auto-rebuild AdvisoryAI knowledge corpus on startup 2026-03-10 20:18:12 +02:00
master
8578065675 Fix notifications surface ownership and frontdoor contracts 2026-03-10 16:54:25 +02:00
master
fc7aaf4d37 Restore platform ownership for v2 evidence routes 2026-03-10 13:10:06 +02:00
master
d881fff387 Segment-bound doctor and scheduler frontdoor chunks 2026-03-10 12:47:51 +02:00
master
1b6051662f Repair router frontdoor route boundaries and service prefixes 2026-03-10 12:28:48 +02:00
master
7acf0ae8f2 Fix router frontdoor readiness and route contracts 2026-03-10 10:19:49 +02:00
master
eae2dfc9d4 Harden policy simulation direct-route defaults 2026-03-10 09:09:29 +02:00
master
425bccf10a Preserve topology and triage scope in live setup flows 2026-03-10 07:37:20 +02:00
master
6578c82602 Eliminate legacy gateway container (consolidate into router-gateway) 
The gateway service was a redundant deployment of the same
StellaOps.Gateway.WebService binary already running as router-gateway.
It served no unique purpose — all traffic is handled by router-gateway
(slot 0). This removes the container, its route table entries, nginx
proxy blocks, health/quota stubs, and redirects STELLAOPS_GATEWAY_URL
to router.stella-ops.local so the Angular frontend resolves API base
URLs through the canonical frontdoor.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-10 03:50:16 +02:00
master
72084355a6 Align policy simulation auth passthrough at the frontdoor 2026-03-10 01:55:51 +02:00
master
d16d7a1692 Repair live JobEngine runtime contracts 2026-03-10 01:38:38 +02:00
master
18246cd74c Align live console and policy governance clients 2026-03-10 01:37:42 +02:00
master
1df79ac75e Restore policy simulation history compatibility 2026-03-10 00:42:18 +02:00
master
ac544c0064 Repair live watchlist frontdoor routing 2026-03-10 00:25:34 +02:00
master
359fafa9da Repair release investigation workspace contracts 2026-03-09 23:19:42 +02:00
master
00bf2fa99a Repair live unified search corpus runtime 2026-03-09 19:44:16 +02:00
master
bf937c9395 Repair router frontdoor convergence and live route contracts 2026-03-09 19:09:19 +02:00
master
d27d68d8c6 feat(web): derive timeline-list into canonical audit-grade event-stream timeline [SPRINT-029] 
Rework the orphan TimelineListComponent into a canonical audit-grade
event-stream primitive for all mounted chronology surfaces.

Canonical event model (FE-TLD-001):
- TimelineEvent with id, timestamp (ISO-8601 UTC), title, description,
  actor, eventKind (info/success/warning/error/critical/neutral), icon,
  evidenceLink, metadata key-value pairs, and expandable detail payload
- Relative time for <24h, absolute UTC for >=24h, full ISO on tooltip
- Date grouping when events span multiple days

Derived primitive (FE-TLD-002):
- Vertical timeline with colored severity markers
- Deterministic UTC timestamp formatting
- Expandable detail sections with expand/collapse toggle
- Optional actor, metadata chips, and evidence links
- Loading skeleton and empty state
- Accessibility: role="feed", role="article", aria-labels, datetime attrs
- Content projection via ng-template for domain-specific rendering

Adopted on 3 surfaces (FE-TLD-003):
- incident-timeline: replaces bespoke inline timeline markers with shared
  component; preserves affected-services chips and correlated-events via
  expandable and content projection
- audit-timeline-search: replaces bespoke timeline rendering; preserves
  module/action badges via content projection
- releases-activity: replaces timeline view mode (was rendering duplicate
  table) with canonical timeline; preserves lane/env/outcome chips

Tests (FE-TLD-004): 32 focused tests covering event rendering, severity
markers, timestamp formatting, expandable toggle, loading/empty states,
date grouping, accessibility, and default fallbacks.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-08 23:23:23 +02:00