Merge remote-tracking branch 'origin/main' into feature/docs-mdx-skeletons

- Created StellaOps.Notify.Storage.Mongo project with initial configuration.
- Added expected output files for acceptance tests (at1.txt to at10.txt).
- Added fixture input files for acceptance tests (at1 to at10).
- Created input and signature files for test cases fc1 to fc5.

.claude/settings.local.json

@@ -1,30 +1,8 @@
 {
   "permissions": {
     "allow": [
-      "Bash(dotnet build:*)",
+      "Bash(wc:*)",
-      "Bash(dotnet restore:*)",
+      "Bash(sort:*)"
-      "Bash(chmod:*)",
-      "Bash(cat:*)",
-      "Bash(dotnet nuget:*)",
-      "Bash(cd /mnt/c/dev/New\\ folder/git.stella-ops.org && python3:*)",
-      "Bash(cd:*)",
-      "Bash(grep:*)",
-      "Bash(src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs )",
-      "Bash(src/Cli/StellaOps.Cli/Configuration/CliProfile.cs )",
-      "Bash(src/Cli/StellaOps.Cli/Configuration/GlobalOptions.cs )",
-      "Bash(src/Cli/StellaOps.Cli/Output/CliError.cs )",
-      "Bash(src/Cli/StellaOps.Cli/Services/BackendOperationsClient.cs )",
-      "Bash(src/Cli/StellaOps.Cli/Services/OrchestratorClient.cs )",
-      "Bash(src/Cli/StellaOps.Cli/Services/PromotionAssembler.cs )",
-      "Bash(src/Cli/StellaOps.Cli/Services/VexObservationsClient.cs )",
-      "Bash(src/Cli/StellaOps.Cli/Telemetry/TraceparentHttpMessageHandler.cs)",
-      "Bash(python3:*)",
-      "Bash(dotnet list:*)",
-      "WebSearch",
-      "Bash(find:*)",
-      "Bash(xargs:*)",
-      "Bash(ls:*)",
-      "Bash(mkdir -p:*)"
     ],
     "deny": [],
     "ask": []

.gitea/workflows/airgap-sealed-ci.yml

@@ -20,6 +20,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v4
+      - name: Task Pack offline bundle fixtures
+        run: python3 scripts/packs/run-fixtures-check.sh
       - name: Install dnslib
         run: pip install dnslib
       - name: Run sealed-mode smoke

.gitea/workflows/aoc-guard.yml

@@ -32,6 +32,9 @@ jobs:
         with:
           fetch-depth: 0
 
+      - name: Task Pack offline bundle fixtures
+        run: python3 scripts/packs/run-fixtures-check.sh
+
       - name: Export OpenSSL 1.1 shim for Mongo2Go
         run: scripts/enable-openssl11-shim.sh
 
@@ -78,6 +81,9 @@ jobs:
         with:
           fetch-depth: 0
 
+      - name: Task Pack offline bundle fixtures
+        run: python3 scripts/packs/run-fixtures-check.sh
+
       - name: Export OpenSSL 1.1 shim for Mongo2Go
         run: scripts/enable-openssl11-shim.sh
 

.gitea/workflows/api-governance.yml

@@ -17,6 +17,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v4
+      - name: Task Pack offline bundle fixtures
+        run: python3 scripts/packs/run-fixtures-check.sh
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:

.gitea/workflows/attestation-bundle.yml

@@ -14,6 +14,9 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
+      - name: Task Pack offline bundle fixtures
+        run: python3 scripts/packs/run-fixtures-check.sh
+
       - name: Build bundle
         run: |
           chmod +x scripts/attest/build-attestation-bundle.sh

.gitea/workflows/authority-key-rotation.yml

@@ -58,6 +58,9 @@ jobs:
         with:
           fetch-depth: 0
 
+      - name: Task Pack offline bundle fixtures
+        run: python3 scripts/packs/run-fixtures-check.sh
+
       - name: Resolve Authority configuration
         id: config
         run: |

.gitea/workflows/bench-determinism.yml

@@ -8,6 +8,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v4
+      - name: Task Pack offline bundle fixtures
+        run: python3 scripts/packs/run-fixtures-check.sh
 
       - name: Setup Python
         uses: actions/setup-python@v5

.gitea/workflows/build-test-deploy.yml

@@ -111,6 +111,10 @@ jobs:
       - name: Validate telemetry storage configuration
         run: python3 ops/devops/telemetry/validate_storage_stack.py
 
+      - name: Task Pack offline bundle fixtures
+        run: |
+          python3 scripts/packs/run-fixtures-check.sh
+
       - name: Telemetry tenant isolation smoke
         env:
           COMPOSE_DIR: ${GITHUB_WORKSPACE}/deploy/compose
@@ -203,6 +207,14 @@ jobs:
               --results-directory "$TEST_RESULTS_DIR"
           done
 
+      - name: Run TimelineIndexer tests (EB1 evidence linkage gate)
+        run: |
+          mkdir -p "$TEST_RESULTS_DIR"
+          dotnet test src/TimelineIndexer/StellaOps.TimelineIndexer/StellaOps.TimelineIndexer.sln \
+            --configuration $BUILD_CONFIGURATION \
+            --logger "trx;LogFileName=timelineindexer-tests.trx" \
+            --results-directory "$TEST_RESULTS_DIR"
+
       - name: Lint policy DSL samples
         run: dotnet run --project tools/PolicyDslValidator/PolicyDslValidator.csproj -- --strict docs/examples/policies/*.yaml
 
@@ -333,6 +345,56 @@ PY
             --logger "trx;LogFileName=stellaops-scanner-lang-tests.trx" \
             --results-directory "$TEST_RESULTS_DIR"
 
+      - name: Build and test Router components
+        run: |
+          set -euo pipefail
+          ROUTER_PROJECTS=(
+            src/__Libraries/StellaOps.Router.Common/StellaOps.Router.Common.csproj
+            src/__Libraries/StellaOps.Router.Config/StellaOps.Router.Config.csproj
+            src/__Libraries/StellaOps.Router.Transport.InMemory/StellaOps.Router.Transport.InMemory.csproj
+            src/__Libraries/StellaOps.Router.Transport.Tcp/StellaOps.Router.Transport.Tcp.csproj
+            src/__Libraries/StellaOps.Router.Transport.Tls/StellaOps.Router.Transport.Tls.csproj
+            src/__Libraries/StellaOps.Router.Transport.Udp/StellaOps.Router.Transport.Udp.csproj
+            src/__Libraries/StellaOps.Router.Transport.RabbitMq/StellaOps.Router.Transport.RabbitMq.csproj
+            src/__Libraries/StellaOps.Microservice/StellaOps.Microservice.csproj
+            src/__Libraries/StellaOps.Microservice.SourceGen/StellaOps.Microservice.SourceGen.csproj
+          )
+          for project in "${ROUTER_PROJECTS[@]}"; do
+            echo "::group::Build $project"
+            dotnet build "$project" --configuration $BUILD_CONFIGURATION --no-restore -warnaserror
+            echo "::endgroup::"
+          done
+
+      - name: Run Router and Microservice tests
+        run: |
+          mkdir -p "$TEST_RESULTS_DIR"
+          ROUTER_TEST_PROJECTS=(
+            # Core Router libraries
+            src/__Libraries/__Tests/StellaOps.Router.Common.Tests/StellaOps.Router.Common.Tests.csproj
+            src/__Libraries/__Tests/StellaOps.Router.Config.Tests/StellaOps.Router.Config.Tests.csproj
+            # Transport layers
+            src/__Libraries/__Tests/StellaOps.Router.Transport.InMemory.Tests/StellaOps.Router.Transport.InMemory.Tests.csproj
+            src/__Libraries/__Tests/StellaOps.Router.Transport.Tcp.Tests/StellaOps.Router.Transport.Tcp.Tests.csproj
+            src/__Libraries/__Tests/StellaOps.Router.Transport.Tls.Tests/StellaOps.Router.Transport.Tls.Tests.csproj
+            src/__Libraries/__Tests/StellaOps.Router.Transport.Udp.Tests/StellaOps.Router.Transport.Udp.Tests.csproj
+            # Microservice SDK
+            src/__Libraries/__Tests/StellaOps.Microservice.Tests/StellaOps.Microservice.Tests.csproj
+            src/__Libraries/__Tests/StellaOps.Microservice.SourceGen.Tests/StellaOps.Microservice.SourceGen.Tests.csproj
+            # Integration tests
+            src/__Libraries/__Tests/StellaOps.Router.Integration.Tests/StellaOps.Router.Integration.Tests.csproj
+            # Gateway tests
+            src/Gateway/__Tests/StellaOps.Gateway.WebService.Tests/StellaOps.Gateway.WebService.Tests.csproj
+          )
+          for project in "${ROUTER_TEST_PROJECTS[@]}"; do
+            name="$(basename "${project%.*}")"
+            echo "::group::Test $name"
+            dotnet test "$project" \
+              --configuration $BUILD_CONFIGURATION \
+              --logger "trx;LogFileName=${name}.trx" \
+              --results-directory "$TEST_RESULTS_DIR"
+            echo "::endgroup::"
+          done
+
       - name: Run scanner analyzer performance benchmark
         env:
           PERF_OUTPUT_DIR: ${{ github.workspace }}/artifacts/perf/scanner-analyzers

.gitea/workflows/cli-build.yml

@@ -22,6 +22,9 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
+      - name: Task Pack offline bundle fixtures
+        run: python3 scripts/packs/run-fixtures-check.sh
+
       - name: Setup .NET
         uses: actions/setup-dotnet@v4
         with:

.gitea/workflows/cli-chaos-parity.yml

@@ -18,6 +18,9 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
+      - name: Task Pack offline bundle fixtures
+        run: python3 scripts/packs/run-fixtures-check.sh
+
       - name: Setup .NET
         uses: actions/setup-dotnet@v4
         with:

.gitea/workflows/concelier-attestation-tests.yml

@@ -17,6 +17,9 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
+      - name: Task Pack offline bundle fixtures
+        run: python3 scripts/packs/run-fixtures-check.sh
+
       - name: Setup .NET 10 preview
         uses: actions/setup-dotnet@v4
         with:

.gitea/workflows/console-ci.yml

@@ -24,6 +24,9 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v4
+
+      - name: Task Pack offline bundle fixtures
+        run: python3 scripts/packs/run-fixtures-check.sh
         with:
           fetch-depth: 0
 

.gitea/workflows/containers-multiarch.yml

@@ -25,6 +25,9 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
+      - name: Task Pack offline bundle fixtures
+        run: python3 scripts/packs/run-fixtures-check.sh
+
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v3
 

.gitea/workflows/cryptopro-optin.yml

@@ -19,6 +19,9 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
+      - name: Task Pack offline bundle fixtures
+        run: python3 scripts/packs/run-fixtures-check.sh
+
       - name: Setup .NET 10 (preview)
         uses: actions/setup-dotnet@v4
         with:

.gitea/workflows/devportal-offline.yml

@@ -11,6 +11,9 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
+      - name: Task Pack offline bundle fixtures
+        run: python3 scripts/packs/run-fixtures-check.sh
+
       - name: Setup Node (corepack/pnpm)
         uses: actions/setup-node@v4
         with:

.gitea/workflows/docs.yml

@@ -29,6 +29,9 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v4
 
+      - name: Task Pack offline bundle fixtures
+        run: python3 scripts/packs/run-fixtures-check.sh
+
       - name: Export OpenSSL 1.1 shim for Mongo2Go
         run: scripts/enable-openssl11-shim.sh
 

.gitea/workflows/evidence-locker.yml

@@ -14,6 +14,9 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
+      - name: Task Pack offline bundle fixtures
+        run: python3 scripts/packs/run-fixtures-check.sh
+
       - name: Emit retention summary
         env:
           RETENTION_TARGET: ${{ github.event.inputs.retention_target }}
@@ -31,14 +34,35 @@ jobs:
     needs: check-evidence-locker
     env:
       STAGED_DIR: evidence-locker/zastava/2025-12-02
+      MODULE_ROOT: docs/modules/zastava
     steps:
       - name: Checkout
         uses: actions/checkout@v4
 
+      - name: Task Pack offline bundle fixtures
+        run: python3 scripts/packs/run-fixtures-check.sh
+
       - name: Package staged Zastava artefacts
         run: |
-          test -d "$STAGED_DIR" || { echo "missing $STAGED_DIR" >&2; exit 1; }
+          test -d "$MODULE_ROOT" || { echo "missing $MODULE_ROOT" >&2; exit 1; }
-          tar -cf /tmp/zastava-evidence.tar -C "$STAGED_DIR" .
+          tmpdir=$(mktemp -d)
+          rsync -a --relative \
+            "$MODULE_ROOT/SHA256SUMS" \
+            "$MODULE_ROOT/schemas/" \
+            "$MODULE_ROOT/exports/" \
+            "$MODULE_ROOT/thresholds.yaml" \
+            "$MODULE_ROOT/thresholds.yaml.dsse" \
+            "$MODULE_ROOT/kit/verify.sh" \
+            "$MODULE_ROOT/kit/README.md" \
+            "$MODULE_ROOT/kit/ed25519.pub" \
+            "$MODULE_ROOT/kit/zastava-kit.tzst" \
+            "$MODULE_ROOT/kit/zastava-kit.tzst.dsse" \
+            "$MODULE_ROOT/evidence/README.md" \
+            "$tmpdir/"
+          (cd "$tmpdir/docs/modules/zastava" && sha256sum --check SHA256SUMS)
+          tar --sort=name --mtime="UTC 1970-01-01" --owner=0 --group=0 --numeric-owner \
+            -cf /tmp/zastava-evidence.tar -C "$tmpdir/docs/modules/zastava" .
+          sha256sum /tmp/zastava-evidence.tar
 
       - name: Upload staged artefacts (fallback)
         uses: actions/upload-artifact@v4

.gitea/workflows/export-ci.yml

@@ -28,6 +28,9 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v4
+
+      - name: Task Pack offline bundle fixtures
+        run: python3 scripts/packs/run-fixtures-check.sh
         with:
           fetch-depth: 0
 

.gitea/workflows/export-compat.yml

@@ -14,6 +14,9 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
+      - name: Task Pack offline bundle fixtures
+        run: python3 scripts/packs/run-fixtures-check.sh
+
       - name: Setup Trivy
         uses: aquasecurity/trivy-action@v0.24.0
         with:

.gitea/workflows/graph-load.yml

@@ -22,6 +22,9 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
+      - name: Task Pack offline bundle fixtures
+        run: python3 scripts/packs/run-fixtures-check.sh
+
       - name: Install k6
         run: |
           sudo apt-get update -qq

.gitea/workflows/graph-ui-sim.yml

@@ -22,6 +22,9 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
+      - name: Task Pack offline bundle fixtures
+        run: python3 scripts/packs/run-fixtures-check.sh
+
       - name: Setup Node
         uses: actions/setup-node@v4
         with:

.gitea/workflows/lnm-backfill.yml

@@ -26,6 +26,9 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v4
+
+      - name: Task Pack offline bundle fixtures
+        run: python3 scripts/packs/run-fixtures-check.sh
         with:
           fetch-depth: 0
 

.gitea/workflows/lnm-vex-backfill.yml

@@ -30,6 +30,9 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v4
+
+      - name: Task Pack offline bundle fixtures
+        run: python3 scripts/packs/run-fixtures-check.sh
         with:
           fetch-depth: 0
 

.gitea/workflows/mirror-sign.yml

@@ -24,6 +24,9 @@ jobs:
           dotnet-version: 10.0.100-rc.2.25502.107
           include-prerelease: true
 
+      - name: Task Pack offline bundle fixtures
+        run: python3 scripts/packs/run-fixtures-check.sh
+
       - name: Verify signing prerequisites
         run: scripts/mirror/check_signing_prereqs.sh
 

.gitea/workflows/oas-ci.yml

@@ -20,6 +20,9 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
+      - name: Task Pack offline bundle fixtures
+        run: python3 scripts/packs/run-fixtures-check.sh
+
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:

.gitea/workflows/obs-slo.yml

@@ -14,6 +14,9 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
+      - name: Task Pack offline bundle fixtures
+        run: python3 scripts/packs/run-fixtures-check.sh
+
       - name: Setup Python (telemetry schema checks)
         uses: actions/setup-python@v5
         with:

.gitea/workflows/obs-stream.yml

@@ -14,6 +14,9 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
+      - name: Task Pack offline bundle fixtures
+        run: python3 scripts/packs/run-fixtures-check.sh
+
       - name: Install nats CLI
         run: |
           curl -sSL https://github.com/nats-io/natscli/releases/download/v0.1.4/nats-0.1.4-linux-amd64.tar.gz -o /tmp/natscli.tgz

.gitea/workflows/policy-lint.yml

@@ -26,6 +26,9 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v4
+
+      - name: Task Pack offline bundle fixtures
+        run: python3 scripts/packs/run-fixtures-check.sh
         with:
           fetch-depth: 0
 

.gitea/workflows/policy-simulate.yml

@@ -27,6 +27,9 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v4
+
+      - name: Task Pack offline bundle fixtures
+        run: python3 scripts/packs/run-fixtures-check.sh
         with:
           fetch-depth: 0
 

.gitea/workflows/promote.yml

@@ -25,6 +25,9 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v4
 
+      - name: Task Pack offline bundle fixtures
+        run: python3 scripts/packs/run-fixtures-check.sh
+
       - name: Resolve staging credentials
         id: staging
         run: |

.gitea/workflows/provenance-check.yml

@@ -9,6 +9,9 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
+      - name: Task Pack offline bundle fixtures
+        run: python3 scripts/packs/run-fixtures-check.sh
+
       - name: Emit provenance summary
         run: |
           mkdir -p out/provenance

.gitea/workflows/release.yml

@@ -44,6 +44,9 @@ jobs:
         with:
           fetch-depth: 0
 
+      - name: Task Pack offline bundle fixtures
+        run: python3 scripts/packs/run-fixtures-check.sh
+
       - name: Validate NuGet restore source ordering
         run: python3 ops/devops/validate_restore_sources.py
 

.gitea/workflows/scanner-analyzers-release.yml

@@ -14,6 +14,9 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
+      - name: Task Pack offline bundle fixtures
+        run: python3 scripts/packs/run-fixtures-check.sh
+
       - name: Setup .NET
         uses: actions/setup-dotnet@v4
         with:

.gitea/workflows/scanner-determinism.yml

@@ -9,6 +9,9 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
+      - name: Task Pack offline bundle fixtures
+        run: python3 scripts/packs/run-fixtures-check.sh
+
       - name: Setup .NET
         uses: actions/setup-dotnet@v4
         with:

.gitea/workflows/sdk-generator.yml

@@ -17,6 +17,9 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
+      - name: Task Pack offline bundle fixtures
+        run: python3 scripts/packs/run-fixtures-check.sh
+
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:

.gitea/workflows/sdk-publish.yml

@@ -33,6 +33,9 @@ jobs:
         with:
           fetch-depth: 0
 
+      - name: Task Pack offline bundle fixtures
+        run: python3 scripts/packs/run-fixtures-check.sh
+
       - name: Setup .NET 10 RC
         uses: actions/setup-dotnet@v4
         with:

.gitea/workflows/signals-ci.yml

@@ -31,6 +31,9 @@ jobs:
         with:
           fetch-depth: 0
 
+      - name: Task Pack offline bundle fixtures
+        run: python3 scripts/packs/run-fixtures-check.sh
+
       - name: Setup .NET 10 RC
         uses: actions/setup-dotnet@v4
         with:

.gitea/workflows/signals-dsse-sign.yml

@@ -34,6 +34,9 @@ jobs:
         with:
           fetch-depth: 0
 
+      - name: Task Pack offline bundle fixtures
+        run: python3 scripts/packs/run-fixtures-check.sh
+
       - name: Install cosign
         uses: sigstore/cosign-installer@v3
         with:

.gitea/workflows/signals-evidence-locker.yml

@@ -0,0 +1,67 @@
+name: signals-evidence-locker
+on:
+  workflow_dispatch:
+    inputs:
+      retention_target:
+        description: "Retention days target"
+        required: false
+        default: "180"
+
+jobs:
+  prepare-signals-evidence:
+    runs-on: ubuntu-latest
+    env:
+      MODULE_ROOT: docs/modules/signals
+      OUT_DIR: evidence-locker/signals/2025-12-05
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Task Pack offline bundle fixtures
+        run: python3 scripts/packs/run-fixtures-check.sh
+
+      - name: Build deterministic signals evidence tar
+        run: |
+          set -euo pipefail
+          test -d "$MODULE_ROOT" || { echo "missing $MODULE_ROOT" >&2; exit 1; }
+
+          tmpdir=$(mktemp -d)
+          rsync -a --relative \
+            "$OUT_DIR/SHA256SUMS" \
+            "$OUT_DIR/confidence_decay_config.sigstore.json" \
+            "$OUT_DIR/unknowns_scoring_manifest.sigstore.json" \
+            "$OUT_DIR/heuristics_catalog.sigstore.json" \
+            "$MODULE_ROOT/decay/confidence_decay_config.yaml" \
+            "$MODULE_ROOT/unknowns/unknowns_scoring_manifest.json" \
+            "$MODULE_ROOT/heuristics/heuristics.catalog.json" \
+            "$tmpdir/"
+
+          (cd "$tmpdir/$OUT_DIR" && sha256sum --check SHA256SUMS)
+
+          tar --sort=name --mtime="UTC 1970-01-01" --owner=0 --group=0 --numeric-owner \
+            -cf /tmp/signals-evidence.tar -C "$tmpdir" .
+
+          sha256sum /tmp/signals-evidence.tar > /tmp/signals-evidence.tar.sha256
+
+      - name: Upload artifact (fallback)
+        uses: actions/upload-artifact@v4
+        with:
+          name: signals-evidence-2025-12-05
+          path: |
+            /tmp/signals-evidence.tar
+            /tmp/signals-evidence.tar.sha256
+
+      - name: Push to Evidence Locker
+        if: ${{ secrets.CI_EVIDENCE_LOCKER_TOKEN != '' && env.EVIDENCE_LOCKER_URL != '' }}
+        env:
+          TOKEN: ${{ secrets.CI_EVIDENCE_LOCKER_TOKEN }}
+          URL: ${{ env.EVIDENCE_LOCKER_URL }}
+        run: |
+          curl -f -X PUT "$URL/signals/2025-12-05/signals-evidence.tar" \
+            -H "Authorization: Bearer $TOKEN" \
+            --data-binary @/tmp/signals-evidence.tar
+
+      - name: Skip push (missing secret or URL)
+        if: ${{ secrets.CI_EVIDENCE_LOCKER_TOKEN == '' || env.EVIDENCE_LOCKER_URL == '' }}
+        run: |
+          echo "Locker push skipped: set CI_EVIDENCE_LOCKER_TOKEN and EVIDENCE_LOCKER_URL to enable." >&2

.gitea/workflows/symbols-ci.yml

@@ -26,6 +26,9 @@ jobs:
         with:
           fetch-depth: 0
 
+      - name: Task Pack offline bundle fixtures
+        run: python3 scripts/packs/run-fixtures-check.sh
+
       - name: Export OpenSSL 1.1 shim for Mongo2Go
         run: scripts/enable-openssl11-shim.sh
 

.gitea/workflows/symbols-release.yml

@@ -17,6 +17,9 @@ jobs:
         with:
           fetch-depth: 0
 
+      - name: Task Pack offline bundle fixtures
+        run: python3 scripts/packs/run-fixtures-check.sh
+
       - name: Export OpenSSL 1.1 shim for Mongo2Go
         run: scripts/enable-openssl11-shim.sh
 

.gitea/workflows/vex-proof-bundles.yml

@@ -21,6 +21,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v4
+      - name: Task Pack offline bundle fixtures
+        run: python3 scripts/packs/run-fixtures-check.sh
 
       - name: Setup Python
         uses: actions/setup-python@v5

.gitignore

@@ -39,3 +39,28 @@ build/
 /src/Sdk/StellaOps.Sdk.Release/out/**
 /src/Sdk/StellaOps.Sdk.Generator/out/**
 /out/scanner-analyzers/**
+
+# Node / frontend
+node_modules/
+dist/
+.build/
+.cache/
+
+# .NET
+bin/
+obj/
+
+# IDEs
+.vscode/
+.idea/
+*.user
+*.suo
+
+# Misc
+logs/
+tmp/
+coverage/
+.nuget/
+local-nugets/
+local-nuget/
+src/Sdk/StellaOps.Sdk.Generator/tools/jdk-21.0.1+12

.nuget/packages/Google.Api.Gax.Grpc.GrpcCore.4.11.0.nupkg

@@ -1,3 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?><Error><Code>BlobNotFound</Code><Message>The specified blob does not exist.
-RequestId:111b5cf5-801e-0033-51f3-4ee25c000000
-Time:2025-11-06T08:00:59.9404934Z</Message></Error>