Merge branch 'main' of https://git.stella-ops.org/stella-ops.org/git.stella-ops.org

- Implement `SbomVexOrderingDeterminismProperties` for testing component list and vulnerability metadata hash consistency.
- Create `UnicodeNormalizationDeterminismProperties` to validate NFC normalization and Unicode string handling.
- Add project file for `StellaOps.Testing.Determinism.Properties` with necessary dependencies.
- Introduce CI/CD template validation tests including YAML syntax checks and documentation content verification.
- Create validation script for CI/CD templates ensuring all required files and structures are present.

.claude/settings.local.json

@@ -0,0 +1,37 @@
+{
+  "permissions": {
+    "allow": [
+      "Bash(dotnet --list-sdks:*)",
+      "Bash(winget install:*)",
+      "Bash(dotnet restore:*)",
+      "Bash(dotnet nuget:*)",
+      "Bash(csc -parse:*)",
+      "Bash(grep:*)",
+      "Bash(dotnet build:*)",
+      "Bash(cat:*)",
+      "Bash(copy:*)",
+      "Bash(dotnet test:*)",
+      "Bash(dir:*)",
+      "Bash(Select-Object -ExpandProperty FullName)",
+      "Bash(echo:*)",
+      "Bash(Out-File -FilePath \"E:\\dev\\git.stella-ops.org\\src\\Scanner\\__Libraries\\StellaOps.Scanner.Surface\\StellaOps.Scanner.Surface.csproj\" -Encoding utf8)",
+      "Bash(wc:*)",
+      "Bash(find:*)",
+      "WebFetch(domain:docs.gradle.org)",
+      "WebSearch",
+      "Bash(dotnet msbuild:*)",
+      "Bash(test:*)",
+      "Bash(taskkill:*)",
+      "Bash(timeout /t)",
+      "Bash(dotnet clean:*)",
+      "Bash(if not exist \"E:\\dev\\git.stella-ops.org\\src\\Scanner\\__Tests\\StellaOps.Scanner.Analyzers.Lang.Java.Tests\\Internal\" mkdir \"E:\\dev\\git.stella-ops.org\\src\\Scanner\\__Tests\\StellaOps.Scanner.Analyzers.Lang.Java.Tests\\Internal\")",
+      "Bash(if not exist \"E:\\dev\\git.stella-ops.org\\src\\Scanner\\__Tests\\StellaOps.Scanner.Analyzers.Lang.Node.Tests\\Internal\" mkdir \"E:\\dev\\git.stella-ops.org\\src\\Scanner\\__Tests\\StellaOps.Scanner.Analyzers.Lang.Node.Tests\\Internal\")",
+      "Bash(rm:*)",
+      "Bash(if not exist \"C:\\dev\\New folder\\git.stella-ops.org\\docs\\implplan\\archived\" mkdir \"C:\\dev\\New folder\\git.stella-ops.org\\docs\\implplan\\archived\")",
+      "Bash(del \"C:\\dev\\New folder\\git.stella-ops.org\\docs\\implplan\\SPRINT_0510_0001_0001_airgap.md\")"
+    ],
+    "deny": [],
+    "ask": []
+  },
+  "outputStyle": "default"
+}

.config/dotnet-tools.json

@@ -0,0 +1,12 @@
+{
+  "version": 1,
+  "isRoot": true,
+  "tools": {
+    "dotnet-stryker": {
+      "version": "4.4.0",
+      "commands": [
+        "stryker"
+      ]
+    }
+  }
+}

.dockerignore

@@ -0,0 +1,23 @@
+.git
+.gitignore
+.gitea
+.venv
+bin
+obj
+**/bin
+**/obj
+local-nugets
+.nuget
+**/node_modules
+**/dist
+**/coverage
+**/*.user
+**/*.suo
+**/*.cache
+**/.vscode
+**/.idea
+**/.DS_Store
+**/TestResults
+**/out
+**/packages
+/tmp

.editorconfig

@@ -0,0 +1,5 @@
+
+[src/Scanner/StellaOps.Scanner.Analyzers.Native/**.cs]
+dotnet_diagnostic.CA2022.severity = none
+[src/Scanner/__Tests/StellaOps.Scanner.Analyzers.Native.Tests/**.cs]
+dotnet_diagnostic.CA2022.severity = none

.gitattributes

@@ -1,2 +1,5 @@
 # Ensure analyzer fixture assets keep LF endings for deterministic hashes
 src/Scanner/__Tests/StellaOps.Scanner.Analyzers.Lang.Python.Tests/Fixtures/** text eol=lf
+
+# Ensure reachability sample assets keep LF endings for deterministic hashes
+tests/reachability/samples-public/** text eol=lf

.gitea/AGENTS.md

@@ -0,0 +1,22 @@
+# .gitea AGENTS
+
+## Purpose & Scope
+- Working directory: `.gitea/` (CI workflows, templates, pipeline configs).
+- Roles: DevOps engineer, QA automation.
+
+## Required Reading (treat as read before DOING)
+- `docs/README.md`
+- `docs/modules/ci/architecture.md`
+- `docs/modules/devops/architecture.md`
+- Relevant sprint file(s).
+
+## Working Agreements
+- Keep workflows deterministic and offline-friendly.
+- Pin versions for tooling where possible.
+- Use UTC timestamps in comments/logs.
+- Avoid adding external network calls unless the sprint explicitly requires them.
+- Record workflow changes in the sprint Execution Log and Decisions & Risks.
+
+## Validation
+- Manually validate YAML structure and paths.
+- Ensure workflow paths match repository layout.

.gitea/workflows/advisory-ai-release.yml

@@ -0,0 +1,70 @@
+name: Advisory AI Feed Release
+
+on:
+  workflow_dispatch:
+    inputs:
+      allow_dev_key:
+        description: 'Allow dev key for testing (1=yes)'
+        required: false
+        default: '0'
+  push:
+    branches: [main]
+    paths:
+      - 'src/AdvisoryAI/feeds/**'
+      - 'docs/samples/advisory-feeds/**'
+
+jobs:
+  package-feeds:
+    runs-on: ubuntu-22.04
+    env:
+      COSIGN_PRIVATE_KEY_B64: ${{ secrets.COSIGN_PRIVATE_KEY_B64 }}
+      COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup cosign
+        uses: sigstore/cosign-installer@v3
+        with:
+          cosign-release: 'v2.6.0'
+
+      - name: Fallback to dev key when secret is absent
+        run: |
+          if [ -z "${COSIGN_PRIVATE_KEY_B64}" ]; then
+            echo "[warn] COSIGN_PRIVATE_KEY_B64 not set; using dev key for non-production"
+            echo "COSIGN_ALLOW_DEV_KEY=1" >> $GITHUB_ENV
+            echo "COSIGN_PASSWORD=stellaops-dev" >> $GITHUB_ENV
+          fi
+          # Manual override
+          if [ "${{ github.event.inputs.allow_dev_key }}" = "1" ]; then
+            echo "COSIGN_ALLOW_DEV_KEY=1" >> $GITHUB_ENV
+            echo "COSIGN_PASSWORD=stellaops-dev" >> $GITHUB_ENV
+          fi
+
+      - name: Package advisory feeds
+        run: |
+          chmod +x ops/deployment/advisory-ai/package-advisory-feeds.sh
+          ops/deployment/advisory-ai/package-advisory-feeds.sh
+
+      - name: Generate SBOM
+        run: |
+          # Install syft
+          curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s -- -b /usr/local/bin v1.0.0
+
+          # Generate SBOM for feed bundle
+          syft dir:out/advisory-ai/feeds/stage \
+            -o spdx-json=out/advisory-ai/feeds/advisory-feeds.sbom.json \
+            --name advisory-feeds
+
+      - name: Upload artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: advisory-feeds-${{ github.run_number }}
+          path: |
+            out/advisory-ai/feeds/advisory-feeds.tar.gz
+            out/advisory-ai/feeds/advisory-feeds.manifest.json
+            out/advisory-ai/feeds/advisory-feeds.manifest.dsse.json
+            out/advisory-ai/feeds/advisory-feeds.sbom.json
+            out/advisory-ai/feeds/provenance.json
+          if-no-files-found: warn
+          retention-days: 30

.gitea/workflows/airgap-sealed-ci.yml

@@ -0,0 +1,28 @@
+name: Airgap Sealed CI Smoke
+
+on:
+  push:
+    branches: [ main ]
+    paths:
+      - 'ops/devops/airgap/**'
+      - '.gitea/workflows/airgap-sealed-ci.yml'
+  pull_request:
+    branches: [ main, develop ]
+    paths:
+      - 'ops/devops/airgap/**'
+      - '.gitea/workflows/airgap-sealed-ci.yml'
+
+jobs:
+  sealed-smoke:
+    runs-on: ubuntu-22.04
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Task Pack offline bundle fixtures
+        run: python3 scripts/packs/run-fixtures-check.sh
+      - name: Install dnslib
+        run: pip install dnslib
+      - name: Run sealed-mode smoke
+        run: sudo ops/devops/airgap/sealed-ci-smoke.sh

.gitea/workflows/aoc-backfill-release.yml

@@ -0,0 +1,83 @@
+name: AOC Backfill Release
+
+on:
+  workflow_dispatch:
+    inputs:
+      dataset_hash:
+        description: 'Dataset hash from dev rehearsal (leave empty for dev mode)'
+        required: false
+        default: ''
+      allow_dev_key:
+        description: 'Allow dev key for testing (1=yes)'
+        required: false
+        default: '0'
+
+jobs:
+  package-backfill:
+    runs-on: ubuntu-22.04
+    env:
+      COSIGN_PRIVATE_KEY_B64: ${{ secrets.COSIGN_PRIVATE_KEY_B64 }}
+      COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup .NET
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: 10.0.100
+          include-prerelease: true
+
+      - name: Setup cosign
+        uses: sigstore/cosign-installer@v3
+        with:
+          cosign-release: 'v2.6.0'
+
+      - name: Restore AOC CLI
+        run: dotnet restore src/Aoc/StellaOps.Aoc.Cli/StellaOps.Aoc.Cli.csproj
+
+      - name: Configure signing
+        run: |
+          if [ -z "${COSIGN_PRIVATE_KEY_B64}" ]; then
+            echo "[info] No production key; using dev key"
+            echo "COSIGN_ALLOW_DEV_KEY=1" >> $GITHUB_ENV
+            echo "COSIGN_PASSWORD=stellaops-dev" >> $GITHUB_ENV
+          fi
+          if [ "${{ github.event.inputs.allow_dev_key }}" = "1" ]; then
+            echo "COSIGN_ALLOW_DEV_KEY=1" >> $GITHUB_ENV
+            echo "COSIGN_PASSWORD=stellaops-dev" >> $GITHUB_ENV
+          fi
+
+      - name: Package AOC backfill release
+        run: |
+          chmod +x ops/devops/aoc/package-backfill-release.sh
+          DATASET_HASH="${{ github.event.inputs.dataset_hash }}" \
+            ops/devops/aoc/package-backfill-release.sh
+        env:
+          DATASET_HASH: ${{ github.event.inputs.dataset_hash }}
+
+      - name: Generate SBOM with syft
+        run: |
+          curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s -- -b /usr/local/bin v1.0.0
+          syft dir:out/aoc/cli \
+            -o spdx-json=out/aoc/aoc-backfill-runner.sbom.json \
+            --name aoc-backfill-runner || true
+
+      - name: Verify checksums
+        run: |
+          cd out/aoc
+          sha256sum -c SHA256SUMS
+
+      - name: Upload artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: aoc-backfill-release-${{ github.run_number }}
+          path: |
+            out/aoc/aoc-backfill-runner.tar.gz
+            out/aoc/aoc-backfill-runner.manifest.json
+            out/aoc/aoc-backfill-runner.sbom.json
+            out/aoc/aoc-backfill-runner.provenance.json
+            out/aoc/aoc-backfill-runner.dsse.json
+            out/aoc/SHA256SUMS
+          if-no-files-found: warn
+          retention-days: 30

.gitea/workflows/aoc-guard.yml

@@ -0,0 +1,170 @@
+name: AOC Guard CI
+
+on:
+  push:
+    branches: [ main ]
+    paths:
+      - 'src/Aoc/**'
+      - 'src/Concelier/**'
+      - 'src/Authority/**'
+      - 'src/Excititor/**'
+      - 'ops/devops/aoc/**'
+      - '.gitea/workflows/aoc-guard.yml'
+  pull_request:
+    branches: [ main, develop ]
+    paths:
+      - 'src/Aoc/**'
+      - 'src/Concelier/**'
+      - 'src/Authority/**'
+      - 'src/Excititor/**'
+      - 'ops/devops/aoc/**'
+      - '.gitea/workflows/aoc-guard.yml'
+
+jobs:
+  aoc-guard:
+    runs-on: ubuntu-22.04
+    env:
+      DOTNET_VERSION: '10.0.100'
+      ARTIFACT_DIR: ${{ github.workspace }}/.artifacts
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Task Pack offline bundle fixtures
+        run: python3 scripts/packs/run-fixtures-check.sh
+
+      - name: Export OpenSSL 1.1 shim for Mongo2Go
+        run: scripts/enable-openssl11-shim.sh
+
+      - name: Set up .NET SDK
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: ${{ env.DOTNET_VERSION }}
+          include-prerelease: true
+
+      - name: Restore analyzers
+        run: dotnet restore src/Aoc/__Analyzers/StellaOps.Aoc.Analyzers/StellaOps.Aoc.Analyzers.csproj
+
+      - name: Build analyzers
+        run: dotnet build src/Aoc/__Analyzers/StellaOps.Aoc.Analyzers/StellaOps.Aoc.Analyzers.csproj -c Release
+
+      - name: Run analyzers against ingestion projects
+        run: |
+          dotnet build src/Concelier/StellaOps.Concelier.Ingestion/StellaOps.Concelier.Ingestion.csproj -c Release /p:RunAnalyzers=true /p:TreatWarningsAsErrors=true
+          dotnet build src/Authority/StellaOps.Authority.Ingestion/StellaOps.Authority.Ingestion.csproj -c Release /p:RunAnalyzers=true /p:TreatWarningsAsErrors=true
+          dotnet build src/Excititor/StellaOps.Excititor.Ingestion/StellaOps.Excititor.Ingestion.csproj -c Release /p:RunAnalyzers=true /p:TreatWarningsAsErrors=true
+
+      - name: Run analyzer tests with coverage
+        run: |
+          mkdir -p $ARTIFACT_DIR
+          dotnet test src/Aoc/__Tests/StellaOps.Aoc.Analyzers.Tests/StellaOps.Aoc.Analyzers.Tests.csproj -c Release \
+            --settings src/Aoc/aoc.runsettings \
+            --collect:"XPlat Code Coverage" \
+            --logger "trx;LogFileName=aoc-analyzers-tests.trx" \
+            --results-directory $ARTIFACT_DIR
+
+      - name: Run AOC library tests with coverage
+        run: |
+          dotnet test src/Aoc/__Tests/StellaOps.Aoc.Tests/StellaOps.Aoc.Tests.csproj -c Release \
+            --settings src/Aoc/aoc.runsettings \
+            --collect:"XPlat Code Coverage" \
+            --logger "trx;LogFileName=aoc-lib-tests.trx" \
+            --results-directory $ARTIFACT_DIR
+
+      - name: Run AOC CLI tests with coverage
+        run: |
+          dotnet test src/Aoc/__Tests/StellaOps.Aoc.Cli.Tests/StellaOps.Aoc.Cli.Tests.csproj -c Release \
+            --settings src/Aoc/aoc.runsettings \
+            --collect:"XPlat Code Coverage" \
+            --logger "trx;LogFileName=aoc-cli-tests.trx" \
+            --results-directory $ARTIFACT_DIR
+
+      - name: Generate coverage report
+        run: |
+          dotnet tool install --global dotnet-reportgenerator-globaltool || true
+          reportgenerator \
+            -reports:"$ARTIFACT_DIR/**/coverage.cobertura.xml" \
+            -targetdir:"$ARTIFACT_DIR/coverage-report" \
+            -reporttypes:"Html;Cobertura;TextSummary" || true
+          if [ -f "$ARTIFACT_DIR/coverage-report/Summary.txt" ]; then
+            cat "$ARTIFACT_DIR/coverage-report/Summary.txt"
+          fi
+
+      - name: Upload artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: aoc-guard-artifacts
+          path: ${{ env.ARTIFACT_DIR }}
+
+  aoc-verify:
+    needs: aoc-guard
+    runs-on: ubuntu-22.04
+    if: github.event_name != 'schedule'
+    env:
+      DOTNET_VERSION: '10.0.100'
+      ARTIFACT_DIR: ${{ github.workspace }}/.artifacts
+      AOC_VERIFY_SINCE: ${{ github.event.pull_request.base.sha || 'HEAD~1' }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Task Pack offline bundle fixtures
+        run: python3 scripts/packs/run-fixtures-check.sh
+
+      - name: Export OpenSSL 1.1 shim for Mongo2Go
+        run: scripts/enable-openssl11-shim.sh
+
+      - name: Set up .NET SDK
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: ${{ env.DOTNET_VERSION }}
+          include-prerelease: true
+
+      - name: Run AOC verify
+        env:
+          STAGING_MONGO_URI: ${{ secrets.STAGING_MONGO_URI || vars.STAGING_MONGO_URI }}
+          STAGING_POSTGRES_URI: ${{ secrets.STAGING_POSTGRES_URI || vars.STAGING_POSTGRES_URI }}
+        run: |
+          mkdir -p $ARTIFACT_DIR
+
+          # Prefer PostgreSQL, fall back to MongoDB (legacy)
+          if [ -n "${STAGING_POSTGRES_URI:-}" ]; then
+            echo "Using PostgreSQL for AOC verification"
+            dotnet run --project src/Aoc/StellaOps.Aoc.Cli -- verify \
+              --since "$AOC_VERIFY_SINCE" \
+              --postgres "$STAGING_POSTGRES_URI" \
+              --output "$ARTIFACT_DIR/aoc-verify.json" \
+              --ndjson "$ARTIFACT_DIR/aoc-verify.ndjson" \
+              --verbose || VERIFY_EXIT=$?
+          elif [ -n "${STAGING_MONGO_URI:-}" ]; then
+            echo "Using MongoDB for AOC verification (deprecated)"
+            dotnet run --project src/Aoc/StellaOps.Aoc.Cli -- verify \
+              --since "$AOC_VERIFY_SINCE" \
+              --mongo "$STAGING_MONGO_URI" \
+              --output "$ARTIFACT_DIR/aoc-verify.json" \
+              --ndjson "$ARTIFACT_DIR/aoc-verify.ndjson" \
+              --verbose || VERIFY_EXIT=$?
+          else
+            echo "::warning::Neither STAGING_POSTGRES_URI nor STAGING_MONGO_URI set; running dry-run verification"
+            dotnet run --project src/Aoc/StellaOps.Aoc.Cli -- verify \
+              --since "$AOC_VERIFY_SINCE" \
+              --postgres "placeholder" \
+              --dry-run \
+              --verbose
+            exit 0
+          fi
+
+          if [ -n "${VERIFY_EXIT:-}" ] && [ "${VERIFY_EXIT}" -ne 0 ]; then
+            echo "::error::AOC verify reported violations"; exit ${VERIFY_EXIT}
+          fi
+
+      - name: Upload verify artifacts
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: aoc-verify-artifacts
+          path: ${{ env.ARTIFACT_DIR }}

.gitea/workflows/api-governance.yml

@@ -0,0 +1,51 @@
+name: api-governance
+on:
+  push:
+    paths:
+      - "src/Api/**"
+      - ".spectral.yaml"
+      - "package.json"
+  pull_request:
+    paths:
+      - "src/Api/**"
+      - ".spectral.yaml"
+      - "package.json"
+
+jobs:
+  spectral-lint:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Task Pack offline bundle fixtures
+        run: python3 scripts/packs/run-fixtures-check.sh
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: "18"
+      - name: Install npm deps
+        run: npm install --ignore-scripts --no-progress
+      - name: Compose aggregate OpenAPI
+        run: npm run api:compose
+      - name: Validate examples coverage
+        run: npm run api:examples
+      - name: Compatibility diff (previous commit)
+        run: |
+          set -e
+          if git show HEAD~1:src/Api/StellaOps.Api.OpenApi/stella.yaml > /tmp/stella-prev.yaml 2>/dev/null; then
+            node scripts/api-compat-diff.mjs /tmp/stella-prev.yaml src/Api/StellaOps.Api.OpenApi/stella.yaml --output text --fail-on-breaking
+          else
+            echo "[api:compat] previous stella.yaml not found; skipping"
+          fi
+      - name: Compatibility diff (baseline)
+        run: |
+          set -e
+          if [ -f src/Api/StellaOps.Api.OpenApi/baselines/stella-baseline.yaml ]; then
+            node scripts/api-compat-diff.mjs src/Api/StellaOps.Api.OpenApi/baselines/stella-baseline.yaml src/Api/StellaOps.Api.OpenApi/stella.yaml --output text
+          else
+            echo "[api:compat] baseline file missing; skipping"
+          fi
+      - name: Generate changelog
+        run: npm run api:changelog
+      - name: Spectral lint (fail on warning+)
+        run: npm run api:lint

.gitea/workflows/artifact-signing.yml

@@ -0,0 +1,128 @@
+name: Artifact Signing
+
+on:
+  push:
+    tags:
+      - 'v*'
+  workflow_dispatch:
+    inputs:
+      artifact_path:
+        description: 'Path to artifact to sign'
+        required: false
+        default: ''
+
+env:
+  COSIGN_VERSION: 'v2.2.0'
+
+jobs:
+  sign-containers:
+    name: Sign Container Images
+    runs-on: ubuntu-latest
+    if: startsWith(github.ref, 'refs/tags/v')
+    permissions:
+      contents: read
+      id-token: write
+      packages: write
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install cosign
+        uses: sigstore/cosign-installer@v3
+        with:
+          cosign-release: ${{ env.COSIGN_VERSION }}
+
+      - name: Log in to registry
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Sign images (keyless)
+        if: ${{ !env.COSIGN_PRIVATE_KEY_B64 }}
+        env:
+          COSIGN_EXPERIMENTAL: "1"
+        run: |
+          IMAGES=(
+            "ghcr.io/${{ github.repository }}/concelier"
+            "ghcr.io/${{ github.repository }}/scanner"
+            "ghcr.io/${{ github.repository }}/authority"
+          )
+          for img in "${IMAGES[@]}"; do
+            if docker manifest inspect "${img}:${{ github.ref_name }}" > /dev/null 2>&1; then
+              echo "Signing ${img}:${{ github.ref_name }}..."
+              cosign sign --yes "${img}:${{ github.ref_name }}"
+            fi
+          done
+
+      - name: Sign images (with key)
+        if: ${{ env.COSIGN_PRIVATE_KEY_B64 }}
+        env:
+          COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY_B64 }}
+          COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
+        run: |
+          echo "$COSIGN_PRIVATE_KEY" | base64 -d > /tmp/cosign.key
+          IMAGES=(
+            "ghcr.io/${{ github.repository }}/concelier"
+            "ghcr.io/${{ github.repository }}/scanner"
+            "ghcr.io/${{ github.repository }}/authority"
+          )
+          for img in "${IMAGES[@]}"; do
+            if docker manifest inspect "${img}:${{ github.ref_name }}" > /dev/null 2>&1; then
+              echo "Signing ${img}:${{ github.ref_name }}..."
+              cosign sign --key /tmp/cosign.key "${img}:${{ github.ref_name }}"
+            fi
+          done
+          rm -f /tmp/cosign.key
+
+  sign-sbom:
+    name: Sign SBOM Artifacts
+    runs-on: ubuntu-latest
+    if: startsWith(github.ref, 'refs/tags/v')
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install cosign
+        uses: sigstore/cosign-installer@v3
+        with:
+          cosign-release: ${{ env.COSIGN_VERSION }}
+
+      - name: Generate and sign SBOM
+        run: |
+          # Generate SBOM using syft
+          if command -v syft &> /dev/null; then
+            syft . -o cyclonedx-json > sbom.cdx.json
+            cosign sign-blob --yes sbom.cdx.json --output-signature sbom.cdx.json.sig
+          else
+            echo "syft not installed, skipping SBOM generation"
+          fi
+
+      - name: Upload signed artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: signed-sbom
+          path: |
+            sbom.cdx.json
+            sbom.cdx.json.sig
+          if-no-files-found: ignore
+
+  verify-signatures:
+    name: Verify Existing Signatures
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install cosign
+        uses: sigstore/cosign-installer@v3
+        with:
+          cosign-release: ${{ env.COSIGN_VERSION }}
+
+      - name: Verify DSSE envelopes
+        run: |
+          find . -name "*.dsse" -o -name "*.dsse.json" | while read f; do
+            echo "Checking $f..."
+            # Basic JSON validation
+            if ! jq empty "$f" 2>/dev/null; then
+              echo "Warning: Invalid JSON in $f"
+            fi
+          done

.gitea/workflows/attestation-bundle.yml

@@ -0,0 +1,29 @@
+name: attestation-bundle
+on:
+  workflow_dispatch:
+    inputs:
+      attest_dir:
+        description: "Directory containing attestation artefacts"
+        required: true
+        default: "out/attest"
+
+jobs:
+  bundle:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Task Pack offline bundle fixtures
+        run: python3 scripts/packs/run-fixtures-check.sh
+
+      - name: Build bundle
+        run: |
+          chmod +x scripts/attest/build-attestation-bundle.sh
+          scripts/attest/build-attestation-bundle.sh "${{ github.event.inputs.attest_dir }}"
+
+      - name: Upload bundle
+        uses: actions/upload-artifact@v4
+        with:
+          name: attestation-bundle
+          path: out/attest-bundles/**

.gitea/workflows/authority-key-rotation.yml

@@ -58,6 +58,9 @@ jobs:
         with:
           fetch-depth: 0
 
+      - name: Task Pack offline bundle fixtures
+        run: python3 scripts/packs/run-fixtures-check.sh
+
       - name: Resolve Authority configuration
         id: config
         run: |

.gitea/workflows/bench-determinism.yml

@@ -0,0 +1,30 @@
+name: bench-determinism
+on:
+  workflow_dispatch: {}
+
+jobs:
+  bench-determinism:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Task Pack offline bundle fixtures
+        run: python3 scripts/packs/run-fixtures-check.sh
+
+      - name: Setup Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+
+      - name: Run determinism bench
+        env:
+          BENCH_DETERMINISM_THRESHOLD: "0.95"
+        run: |
+          chmod +x scripts/bench/determinism-run.sh
+          scripts/bench/determinism-run.sh
+
+      - name: Upload determinism artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: bench-determinism
+          path: out/bench-determinism/**

.gitea/workflows/benchmark-vs-competitors.yml

@@ -0,0 +1,173 @@
+name: Benchmark vs Competitors
+
+on:
+  schedule:
+    # Run weekly on Sunday at 00:00 UTC
+    - cron: '0 0 * * 0'
+  workflow_dispatch:
+    inputs:
+      competitors:
+        description: 'Comma-separated list of competitors to benchmark against'
+        required: false
+        default: 'trivy,grype'
+      corpus_size:
+        description: 'Number of images from corpus to test'
+        required: false
+        default: '50'
+  push:
+    paths:
+      - 'src/Scanner/__Libraries/StellaOps.Scanner.Benchmark/**'
+      - 'src/__Tests/__Benchmarks/competitors/**'
+
+env:
+  DOTNET_VERSION: '10.0.x'
+  TRIVY_VERSION: '0.50.1'
+  GRYPE_VERSION: '0.74.0'
+  SYFT_VERSION: '0.100.0'
+
+jobs:
+  benchmark:
+    name: Run Competitive Benchmark
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Setup .NET
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: ${{ env.DOTNET_VERSION }}
+
+      - name: Install Trivy
+        run: |
+          curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin v${{ env.TRIVY_VERSION }}
+          trivy --version
+
+      - name: Install Grype
+        run: |
+          curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh -s -- -b /usr/local/bin v${{ env.GRYPE_VERSION }}
+          grype version
+
+      - name: Install Syft
+        run: |
+          curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s -- -b /usr/local/bin v${{ env.SYFT_VERSION }}
+          syft version
+
+      - name: Build benchmark library
+        run: |
+          dotnet build src/Scanner/__Libraries/StellaOps.Scanner.Benchmark/StellaOps.Scanner.Benchmark.csproj -c Release
+
+      - name: Load corpus manifest
+        id: corpus
+        run: |
+          echo "corpus_path=src/__Tests/__Benchmarks/competitors/corpus/corpus-manifest.json" >> $GITHUB_OUTPUT
+
+      - name: Run Stella Ops scanner
+        run: |
+          echo "Running Stella Ops scanner on corpus..."
+          # TODO: Implement actual scan command
+          # stella scan --corpus ${{ steps.corpus.outputs.corpus_path }} --output src/__Tests/__Benchmarks/results/stellaops.json
+
+      - name: Run Trivy on corpus
+        run: |
+          echo "Running Trivy on corpus images..."
+          # Process each image in corpus
+          mkdir -p src/__Tests/__Benchmarks/results/trivy
+
+      - name: Run Grype on corpus
+        run: |
+          echo "Running Grype on corpus images..."
+          mkdir -p src/__Tests/__Benchmarks/results/grype
+
+      - name: Calculate metrics
+        run: |
+          echo "Calculating precision/recall/F1 metrics..."
+          # dotnet run --project src/Scanner/__Libraries/StellaOps.Scanner.Benchmark \
+          #   --calculate-metrics \
+          #   --ground-truth ${{ steps.corpus.outputs.corpus_path }} \
+          #   --results src/__Tests/__Benchmarks/results/ \
+          #   --output src/__Tests/__Benchmarks/results/metrics.json
+
+      - name: Generate comparison report
+        run: |
+          echo "Generating comparison report..."
+          mkdir -p src/__Tests/__Benchmarks/results
+          cat > src/__Tests/__Benchmarks/results/summary.json << 'EOF'
+          {
+            "timestamp": "$(date -u +%Y-%m-%dT%H:%M:%SZ)",
+            "competitors": ["trivy", "grype", "syft"],
+            "status": "pending_implementation"
+          }
+          EOF
+
+      - name: Upload benchmark results
+        uses: actions/upload-artifact@v4
+        with:
+          name: benchmark-results-${{ github.run_id }}
+          path: src/__Tests/__Benchmarks/results/
+          retention-days: 90
+
+      - name: Update claims index
+        if: github.ref == 'refs/heads/main'
+        run: |
+          echo "Updating claims index with new evidence..."
+          # dotnet run --project src/Scanner/__Libraries/StellaOps.Scanner.Benchmark \
+          #   --update-claims \
+          #   --metrics src/__Tests/__Benchmarks/results/metrics.json \
+          #   --output docs/claims-index.md
+
+      - name: Comment on PR
+        if: github.event_name == 'pull_request'
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const fs = require('fs');
+            const metrics = fs.existsSync('src/__Tests/__Benchmarks/results/metrics.json')
+              ? JSON.parse(fs.readFileSync('src/__Tests/__Benchmarks/results/metrics.json', 'utf8'))
+              : { status: 'pending' };
+
+            const body = `## Benchmark Results
+
+            | Tool | Precision | Recall | F1 Score |
+            |------|-----------|--------|----------|
+            | Stella Ops | ${metrics.stellaops?.precision || 'N/A'} | ${metrics.stellaops?.recall || 'N/A'} | ${metrics.stellaops?.f1 || 'N/A'} |
+            | Trivy | ${metrics.trivy?.precision || 'N/A'} | ${metrics.trivy?.recall || 'N/A'} | ${metrics.trivy?.f1 || 'N/A'} |
+            | Grype | ${metrics.grype?.precision || 'N/A'} | ${metrics.grype?.recall || 'N/A'} | ${metrics.grype?.f1 || 'N/A'} |
+
+            [Full report](${process.env.GITHUB_SERVER_URL}/${process.env.GITHUB_REPOSITORY}/actions/runs/${process.env.GITHUB_RUN_ID})
+            `;
+
+            github.rest.issues.createComment({
+              issue_number: context.issue.number,
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              body: body
+            });
+
+  verify-claims:
+    name: Verify Claims
+    runs-on: ubuntu-latest
+    needs: benchmark
+    if: github.ref == 'refs/heads/main'
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Download benchmark results
+        uses: actions/download-artifact@v4
+        with:
+          name: benchmark-results-${{ github.run_id }}
+          path: src/__Tests/__Benchmarks/results/
+
+      - name: Verify all claims
+        run: |
+          echo "Verifying all claims against new evidence..."
+          # stella benchmark verify --all
+
+      - name: Report claim status
+        run: |
+          echo "Generating claim verification report..."
+          # Output claim status summary

.gitea/workflows/build-test-deploy.yml

@@ -37,7 +37,7 @@ on:
         type: boolean
 
 env:
-  DOTNET_VERSION: '10.0.100-rc.1.25451.107'
+  DOTNET_VERSION: '10.0.100'
   BUILD_CONFIGURATION: Release
   CI_CACHE_ROOT: /data/.cache/stella-ops/feedser
   RUNNER_TOOL_CACHE: /toolcache
@@ -84,10 +84,21 @@ jobs:
         with:
           fetch-depth: 0
 
-      - name: Ensure Mongo test URI configured
+      - name: Export OpenSSL 1.1 shim for Mongo2Go
+        run: scripts/enable-openssl11-shim.sh
+
+      - name: Verify binary layout
+        run: scripts/verify-binaries.sh
+
+      - name: Ensure binary manifests are up to date
         run: |
-          if [ -z "${STELLAOPS_TEST_MONGO_URI:-}" ]; then
-            echo "::error::STELLAOPS_TEST_MONGO_URI must be provided via repository secrets or variables for Graph Indexer integration tests."
+          python3 scripts/update-binary-manifests.py
+          git diff --exit-code .nuget/manifest.json vendor/manifest.json offline/feeds/manifest.json
+
+      - name: Ensure PostgreSQL test URI configured
+        run: |
+          if [ -z "${STELLAOPS_TEST_POSTGRES_CONNECTION:-}" ]; then
+            echo "::error::STELLAOPS_TEST_POSTGRES_CONNECTION must be provided via repository secrets or variables for integration tests."
             exit 1
           fi
 
@@ -100,6 +111,10 @@ jobs:
       - name: Validate telemetry storage configuration
         run: python3 ops/devops/telemetry/validate_storage_stack.py
 
+      - name: Task Pack offline bundle fixtures
+        run: |
+          python3 scripts/packs/run-fixtures-check.sh
+
       - name: Telemetry tenant isolation smoke
         env:
           COMPOSE_DIR: ${GITHUB_WORKSPACE}/deploy/compose
@@ -169,6 +184,37 @@ jobs:
             --logger "trx;LogFileName=stellaops-concelier-tests.trx" \
             --results-directory "$TEST_RESULTS_DIR"
 
+      - name: Run PostgreSQL storage integration tests (Testcontainers)
+        env:
+          POSTGRES_TEST_IMAGE: postgres:16-alpine
+        run: |
+          set -euo pipefail
+          mkdir -p "$TEST_RESULTS_DIR"
+          PROJECTS=(
+            src/__Libraries/__Tests/StellaOps.Infrastructure.Postgres.Tests/StellaOps.Infrastructure.Postgres.Tests.csproj
+            src/Authority/__Tests/StellaOps.Authority.Storage.Postgres.Tests/StellaOps.Authority.Storage.Postgres.Tests.csproj
+            src/Scheduler/__Tests/StellaOps.Scheduler.Storage.Postgres.Tests/StellaOps.Scheduler.Storage.Postgres.Tests.csproj
+            src/Concelier/__Tests/StellaOps.Concelier.Storage.Postgres.Tests/StellaOps.Concelier.Storage.Postgres.Tests.csproj
+            src/Excititor/__Tests/StellaOps.Excititor.Storage.Postgres.Tests/StellaOps.Excititor.Storage.Postgres.Tests.csproj
+            src/Notify/__Tests/StellaOps.Notify.Storage.Postgres.Tests/StellaOps.Notify.Storage.Postgres.Tests.csproj
+            src/Policy/__Tests/StellaOps.Policy.Storage.Postgres.Tests/StellaOps.Policy.Storage.Postgres.Tests.csproj
+          )
+          for project in "${PROJECTS[@]}"; do
+            name="$(basename "${project%.*}")"
+            dotnet test "$project" \
+              --configuration $BUILD_CONFIGURATION \
+              --logger "trx;LogFileName=${name}.trx" \
+              --results-directory "$TEST_RESULTS_DIR"
+          done
+
+      - name: Run TimelineIndexer tests (EB1 evidence linkage gate)
+        run: |
+          mkdir -p "$TEST_RESULTS_DIR"
+          dotnet test src/TimelineIndexer/StellaOps.TimelineIndexer/StellaOps.TimelineIndexer.sln \
+            --configuration $BUILD_CONFIGURATION \
+            --logger "trx;LogFileName=timelineindexer-tests.trx" \
+            --results-directory "$TEST_RESULTS_DIR"
+
       - name: Lint policy DSL samples
         run: dotnet run --project tools/PolicyDslValidator/PolicyDslValidator.csproj -- --strict docs/examples/policies/*.yaml
 
@@ -299,6 +345,56 @@ PY
             --logger "trx;LogFileName=stellaops-scanner-lang-tests.trx" \
             --results-directory "$TEST_RESULTS_DIR"
 
+      - name: Build and test Router components
+        run: |
+          set -euo pipefail
+          ROUTER_PROJECTS=(
+            src/__Libraries/StellaOps.Router.Common/StellaOps.Router.Common.csproj
+            src/__Libraries/StellaOps.Router.Config/StellaOps.Router.Config.csproj
+            src/__Libraries/StellaOps.Router.Transport.InMemory/StellaOps.Router.Transport.InMemory.csproj
+            src/__Libraries/StellaOps.Router.Transport.Tcp/StellaOps.Router.Transport.Tcp.csproj
+            src/__Libraries/StellaOps.Router.Transport.Tls/StellaOps.Router.Transport.Tls.csproj
+            src/__Libraries/StellaOps.Router.Transport.Udp/StellaOps.Router.Transport.Udp.csproj
+            src/__Libraries/StellaOps.Router.Transport.RabbitMq/StellaOps.Router.Transport.RabbitMq.csproj
+            src/__Libraries/StellaOps.Microservice/StellaOps.Microservice.csproj
+            src/__Libraries/StellaOps.Microservice.SourceGen/StellaOps.Microservice.SourceGen.csproj
+          )
+          for project in "${ROUTER_PROJECTS[@]}"; do
+            echo "::group::Build $project"
+            dotnet build "$project" --configuration $BUILD_CONFIGURATION --no-restore -warnaserror
+            echo "::endgroup::"
+          done
+
+      - name: Run Router and Microservice tests
+        run: |
+          mkdir -p "$TEST_RESULTS_DIR"
+          ROUTER_TEST_PROJECTS=(
+            # Core Router libraries
+            src/__Libraries/__Tests/StellaOps.Router.Common.Tests/StellaOps.Router.Common.Tests.csproj
+            src/__Libraries/__Tests/StellaOps.Router.Config.Tests/StellaOps.Router.Config.Tests.csproj
+            # Transport layers
+            src/__Libraries/__Tests/StellaOps.Router.Transport.InMemory.Tests/StellaOps.Router.Transport.InMemory.Tests.csproj
+            src/__Libraries/__Tests/StellaOps.Router.Transport.Tcp.Tests/StellaOps.Router.Transport.Tcp.Tests.csproj
+            src/__Libraries/__Tests/StellaOps.Router.Transport.Tls.Tests/StellaOps.Router.Transport.Tls.Tests.csproj
+            src/__Libraries/__Tests/StellaOps.Router.Transport.Udp.Tests/StellaOps.Router.Transport.Udp.Tests.csproj
+            # Microservice SDK
+            src/__Libraries/__Tests/StellaOps.Microservice.Tests/StellaOps.Microservice.Tests.csproj
+            src/__Libraries/__Tests/StellaOps.Microservice.SourceGen.Tests/StellaOps.Microservice.SourceGen.Tests.csproj
+            # Integration tests
+            src/__Libraries/__Tests/StellaOps.Router.Integration.Tests/StellaOps.Router.Integration.Tests.csproj
+            # Gateway tests
+            src/Gateway/__Tests/StellaOps.Gateway.WebService.Tests/StellaOps.Gateway.WebService.Tests.csproj
+          )
+          for project in "${ROUTER_TEST_PROJECTS[@]}"; do
+            name="$(basename "${project%.*}")"
+            echo "::group::Test $name"
+            dotnet test "$project" \
+              --configuration $BUILD_CONFIGURATION \
+              --logger "trx;LogFileName=${name}.trx" \
+              --results-directory "$TEST_RESULTS_DIR"
+            echo "::endgroup::"
+          done
+
       - name: Run scanner analyzer performance benchmark
         env:
           PERF_OUTPUT_DIR: ${{ github.workspace }}/artifacts/perf/scanner-analyzers
@@ -479,6 +575,209 @@ PY
           if-no-files-found: ignore
           retention-days: 7
 
+  # ============================================================================
+  # Quality Gates Foundation (Sprint 0350)
+  # ============================================================================
+  quality-gates:
+    runs-on: ubuntu-22.04
+    needs: build-test
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Reachability quality gate
+        id: reachability
+        run: |
+          set -euo pipefail
+          echo "::group::Computing reachability metrics"
+          if [ -f scripts/ci/compute-reachability-metrics.sh ]; then
+            chmod +x scripts/ci/compute-reachability-metrics.sh
+            METRICS=$(./scripts/ci/compute-reachability-metrics.sh --dry-run 2>/dev/null || echo '{}')
+            echo "metrics=$METRICS" >> $GITHUB_OUTPUT
+            echo "Reachability metrics: $METRICS"
+          else
+            echo "Reachability script not found, skipping"
+          fi
+          echo "::endgroup::"
+
+      - name: TTFS regression gate
+        id: ttfs
+        run: |
+          set -euo pipefail
+          echo "::group::Computing TTFS metrics"
+          if [ -f scripts/ci/compute-ttfs-metrics.sh ]; then
+            chmod +x scripts/ci/compute-ttfs-metrics.sh
+            METRICS=$(./scripts/ci/compute-ttfs-metrics.sh --dry-run 2>/dev/null || echo '{}')
+            echo "metrics=$METRICS" >> $GITHUB_OUTPUT
+            echo "TTFS metrics: $METRICS"
+          else
+            echo "TTFS script not found, skipping"
+          fi
+          echo "::endgroup::"
+
+      - name: Performance SLO gate
+        id: slo
+        run: |
+          set -euo pipefail
+          echo "::group::Enforcing performance SLOs"
+          if [ -f scripts/ci/enforce-performance-slos.sh ]; then
+            chmod +x scripts/ci/enforce-performance-slos.sh
+            ./scripts/ci/enforce-performance-slos.sh --warn-only || true
+          else
+            echo "Performance SLO script not found, skipping"
+          fi
+          echo "::endgroup::"
+
+      - name: RLS policy validation
+        id: rls
+        run: |
+          set -euo pipefail
+          echo "::group::Validating RLS policies"
+          if [ -f deploy/postgres-validation/001_validate_rls.sql ]; then
+            echo "RLS validation script found"
+            # Check that all tenant-scoped schemas have RLS enabled
+            SCHEMAS=("scheduler" "vex" "authority" "notify" "policy" "findings_ledger")
+            for schema in "${SCHEMAS[@]}"; do
+              echo "Checking RLS for schema: $schema"
+              # Validate migration files exist
+              if ls src/*/Migrations/*enable_rls*.sql 2>/dev/null | grep -q "$schema"; then
+                echo "  ✓ RLS migration exists for $schema"
+              fi
+            done
+            echo "RLS validation passed (static check)"
+          else
+            echo "RLS validation script not found, skipping"
+          fi
+          echo "::endgroup::"
+
+      - name: Upload quality gate results
+        uses: actions/upload-artifact@v4
+        with:
+          name: quality-gate-results
+          path: |
+            scripts/ci/*.json
+            scripts/ci/*.yaml
+          if-no-files-found: ignore
+          retention-days: 14
+
+  security-testing:
+    runs-on: ubuntu-22.04
+    needs: build-test
+    if: github.event_name == 'pull_request' || github.event_name == 'schedule'
+    permissions:
+      contents: read
+    env:
+      DOTNET_VERSION: '10.0.100'
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Setup .NET
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: ${{ env.DOTNET_VERSION }}
+
+      - name: Restore dependencies
+        run: dotnet restore src/__Tests/security/StellaOps.Security.Tests/StellaOps.Security.Tests.csproj
+
+      - name: Run OWASP security tests
+        run: |
+          set -euo pipefail
+          echo "::group::Running security tests"
+          dotnet test src/__Tests/security/StellaOps.Security.Tests/StellaOps.Security.Tests.csproj \
+            --no-restore \
+            --logger "trx;LogFileName=security-tests.trx" \
+            --results-directory ./security-test-results \
+            --filter "Category=Security" \
+            --verbosity normal
+          echo "::endgroup::"
+
+      - name: Upload security test results
+        uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: security-test-results
+          path: security-test-results/
+          if-no-files-found: ignore
+          retention-days: 30
+
+  mutation-testing:
+    runs-on: ubuntu-22.04
+    needs: build-test
+    if: github.event_name == 'schedule' || (github.event_name == 'pull_request' && contains(github.event.pull_request.labels.*.name, 'mutation-test'))
+    permissions:
+      contents: read
+    env:
+      DOTNET_VERSION: '10.0.100'
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Setup .NET
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: ${{ env.DOTNET_VERSION }}
+
+      - name: Restore tools
+        run: dotnet tool restore
+
+      - name: Run mutation tests - Scanner.Core
+        id: scanner-mutation
+        run: |
+          set -euo pipefail
+          echo "::group::Mutation testing Scanner.Core"
+          cd src/Scanner/__Libraries/StellaOps.Scanner.Core
+          dotnet stryker --reporter json --reporter html --output ../../../mutation-results/scanner-core || echo "MUTATION_FAILED=true" >> $GITHUB_ENV
+          echo "::endgroup::"
+        continue-on-error: true
+
+      - name: Run mutation tests - Policy.Engine
+        id: policy-mutation
+        run: |
+          set -euo pipefail
+          echo "::group::Mutation testing Policy.Engine"
+          cd src/Policy/__Libraries/StellaOps.Policy
+          dotnet stryker --reporter json --reporter html --output ../../../mutation-results/policy-engine || echo "MUTATION_FAILED=true" >> $GITHUB_ENV
+          echo "::endgroup::"
+        continue-on-error: true
+
+      - name: Run mutation tests - Authority.Core
+        id: authority-mutation
+        run: |
+          set -euo pipefail
+          echo "::group::Mutation testing Authority.Core"
+          cd src/Authority/StellaOps.Authority
+          dotnet stryker --reporter json --reporter html --output ../../mutation-results/authority-core || echo "MUTATION_FAILED=true" >> $GITHUB_ENV
+          echo "::endgroup::"
+        continue-on-error: true
+
+      - name: Upload mutation results
+        uses: actions/upload-artifact@v4
+        with:
+          name: mutation-testing-results
+          path: mutation-results/
+          if-no-files-found: ignore
+          retention-days: 30
+
+      - name: Check mutation thresholds
+        run: |
+          set -euo pipefail
+          echo "Checking mutation score thresholds..."
+          # Parse JSON results and check against thresholds
+          if [ -f "mutation-results/scanner-core/mutation-report.json" ]; then
+            SCORE=$(jq '.mutationScore // 0' mutation-results/scanner-core/mutation-report.json)
+            echo "Scanner.Core mutation score: $SCORE%"
+            if (( $(echo "$SCORE < 65" | bc -l) )); then
+              echo "::error::Scanner.Core mutation score below threshold"
+            fi
+          fi
+
   sealed-mode-ci:
     runs-on: ubuntu-22.04
     needs: build-test

.gitea/workflows/cli-build.yml

@@ -0,0 +1,48 @@
+name: cli-build
+on:
+  workflow_dispatch:
+    inputs:
+      rids:
+        description: "Comma-separated RIDs (e.g., linux-x64,win-x64,osx-arm64)"
+        required: false
+        default: "linux-x64,win-x64,osx-arm64"
+      config:
+        description: "Build configuration"
+        required: false
+        default: "Release"
+      sign:
+        description: "Enable cosign signing (requires COSIGN_KEY)"
+        required: false
+        default: "false"
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Task Pack offline bundle fixtures
+        run: python3 scripts/packs/run-fixtures-check.sh
+
+      - name: Setup .NET
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: "10.0.100"
+
+      - name: Install syft (SBOM)
+        uses: anchore/sbom-action/download-syft@v0
+
+      - name: Build CLI artifacts
+        run: |
+          chmod +x scripts/cli/build-cli.sh
+          RIDS="${{ github.event.inputs.rids }}" CONFIG="${{ github.event.inputs.config }}" SBOM_TOOL=syft SIGN="${{ github.event.inputs.sign }}" COSIGN_KEY="${{ secrets.COSIGN_KEY }}" scripts/cli/build-cli.sh
+
+      - name: List artifacts
+        run: find out/cli -maxdepth 3 -type f -print
+
+      - name: Upload CLI artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: stella-cli
+          path: out/cli/**

.gitea/workflows/cli-chaos-parity.yml

@@ -0,0 +1,47 @@
+name: cli-chaos-parity
+on:
+  workflow_dispatch:
+    inputs:
+      chaos:
+        description: "Run chaos smoke (true/false)"
+        required: false
+        default: "true"
+      parity:
+        description: "Run parity diff (true/false)"
+        required: false
+        default: "true"
+
+jobs:
+  cli-checks:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Task Pack offline bundle fixtures
+        run: python3 scripts/packs/run-fixtures-check.sh
+
+      - name: Setup .NET
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: "10.0.100"
+
+      - name: Chaos smoke
+        if: ${{ github.event.inputs.chaos == 'true' }}
+        run: |
+          chmod +x scripts/cli/chaos-smoke.sh
+          scripts/cli/chaos-smoke.sh
+
+      - name: Parity diff
+        if: ${{ github.event.inputs.parity == 'true' }}
+        run: |
+          chmod +x scripts/cli/parity-diff.sh
+          scripts/cli/parity-diff.sh
+
+      - name: Upload evidence
+        uses: actions/upload-artifact@v4
+        with:
+          name: cli-chaos-parity
+          path: |
+            out/cli-chaos/**
+            out/cli-goldens/**

.gitea/workflows/concelier-attestation-tests.yml

@@ -0,0 +1,47 @@
+name: Concelier Attestation Tests
+
+on:
+  push:
+    paths:
+      - 'src/Concelier/**'
+      - '.gitea/workflows/concelier-attestation-tests.yml'
+  pull_request:
+    paths:
+      - 'src/Concelier/**'
+      - '.gitea/workflows/concelier-attestation-tests.yml'
+
+jobs:
+  attestation-tests:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Task Pack offline bundle fixtures
+        run: python3 scripts/packs/run-fixtures-check.sh
+
+      - name: Setup .NET 10 preview
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: '10.0.100'
+
+      - name: Restore Concelier solution
+        run: dotnet restore src/Concelier/StellaOps.Concelier.sln
+
+      - name: Build WebService Tests (no analyzers)
+        run: dotnet build src/Concelier/__Tests/StellaOps.Concelier.WebService.Tests/StellaOps.Concelier.WebService.Tests.csproj -c Release -p:DisableAnalyzers=true
+
+      - name: Run WebService attestation test
+        run: dotnet test src/Concelier/__Tests/StellaOps.Concelier.WebService.Tests/StellaOps.Concelier.WebService.Tests.csproj -c Release --filter InternalAttestationVerify --no-build --logger trx --results-directory TestResults
+
+      - name: Build Core Tests (no analyzers)
+        run: dotnet build src/Concelier/__Tests/StellaOps.Concelier.Core.Tests/StellaOps.Concelier.Core.Tests.csproj -c Release -p:DisableAnalyzers=true
+
+      - name: Run Core attestation builder tests
+        run: dotnet test src/Concelier/__Tests/StellaOps.Concelier.Core.Tests/StellaOps.Concelier.Core.Tests.csproj -c Release --filter EvidenceBundleAttestationBuilderTests --no-build --logger trx --results-directory TestResults
+
+      - name: Upload TRX results
+        uses: actions/upload-artifact@v4
+        with:
+          name: concelier-attestation-tests-trx
+          path: '**/TestResults/*.trx'

.gitea/workflows/concelier-store-aoc-19-005.yml

@@ -0,0 +1,32 @@
+name: Concelier STORE-AOC-19-005 Dataset
+
+on:
+  workflow_dispatch: {}
+
+jobs:
+  build-dataset:
+    runs-on: ubuntu-22.04
+    env:
+      ARTIFACT_DIR: ${{ github.workspace }}/out/linksets
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Install dependencies
+        run: sudo apt-get update && sudo apt-get install -y zstd
+
+      - name: Build dataset tarball
+        run: |
+          chmod +x scripts/concelier/build-store-aoc-19-005-dataset.sh scripts/concelier/test-store-aoc-19-005-dataset.sh
+          scripts/concelier/build-store-aoc-19-005-dataset.sh "${ARTIFACT_DIR}/linksets-stage-backfill.tar.zst"
+
+      - name: Validate dataset
+        run: scripts/concelier/test-store-aoc-19-005-dataset.sh "${ARTIFACT_DIR}/linksets-stage-backfill.tar.zst"
+
+      - name: Upload dataset artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: concelier-store-aoc-19-005-dataset
+          path: |
+            ${ARTIFACT_DIR}/linksets-stage-backfill.tar.zst
+            ${ARTIFACT_DIR}/linksets-stage-backfill.tar.zst.sha256

.gitea/workflows/connector-fixture-drift.yml

@@ -0,0 +1,247 @@
+# -----------------------------------------------------------------------------
+# connector-fixture-drift.yml
+# Sprint: SPRINT_5100_0007_0005_connector_fixtures
+# Task: CONN-FIX-016
+# Description: Weekly schema drift detection for connector fixtures with auto-PR
+# -----------------------------------------------------------------------------
+
+name: Connector Fixture Drift
+
+on:
+  # Weekly schedule: Sunday at 2:00 UTC
+  schedule:
+    - cron: '0 2 * * 0'
+  # Manual trigger for on-demand drift detection
+  workflow_dispatch:
+    inputs:
+      auto_update:
+        description: 'Auto-update fixtures if drift detected'
+        required: false
+        default: 'true'
+        type: boolean
+      create_pr:
+        description: 'Create PR for updated fixtures'
+        required: false
+        default: 'true'
+        type: boolean
+
+env:
+  DOTNET_NOLOGO: 1
+  DOTNET_CLI_TELEMETRY_OPTOUT: 1
+  TZ: UTC
+
+jobs:
+  detect-drift:
+    runs-on: ubuntu-22.04
+    permissions:
+      contents: write
+      pull-requests: write
+    outputs:
+      has_drift: ${{ steps.drift.outputs.has_drift }}
+      drift_count: ${{ steps.drift.outputs.drift_count }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Setup .NET
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: '10.0.100'
+          include-prerelease: true
+
+      - name: Cache NuGet packages
+        uses: actions/cache@v4
+        with:
+          path: |
+            .nuget/packages
+          key: fixture-drift-nuget-${{ runner.os }}-${{ hashFiles('**/*.csproj') }}
+
+      - name: Restore solution
+        run: dotnet restore src/StellaOps.sln --configfile nuget.config
+
+      - name: Build test projects
+        run: |
+          dotnet build src/Concelier/__Tests/StellaOps.Concelier.Connector.Ghsa.Tests/StellaOps.Concelier.Connector.Ghsa.Tests.csproj -c Release --no-restore
+          dotnet build src/Excititor/__Tests/StellaOps.Excititor.Connectors.RedHat.CSAF.Tests/StellaOps.Excititor.Connectors.RedHat.CSAF.Tests.csproj -c Release --no-restore
+
+      - name: Run Live schema drift tests
+        id: drift
+        env:
+          STELLAOPS_LIVE_TESTS: 'true'
+          STELLAOPS_UPDATE_FIXTURES: ${{ inputs.auto_update || 'true' }}
+        run: |
+          set +e
+
+          # Run Live tests and capture output
+          dotnet test src/StellaOps.sln \
+            --filter "Category=Live" \
+            --no-build \
+            -c Release \
+            --logger "console;verbosity=detailed" \
+            --results-directory out/drift-results \
+            2>&1 | tee out/drift-output.log
+
+          EXIT_CODE=$?
+
+          # Check for fixture changes
+          CHANGED_FILES=$(git diff --name-only -- '**/Fixtures/*.json' '**/Expected/*.json' | wc -l)
+
+          if [ "$CHANGED_FILES" -gt 0 ]; then
+            echo "has_drift=true" >> $GITHUB_OUTPUT
+            echo "drift_count=$CHANGED_FILES" >> $GITHUB_OUTPUT
+            echo "::warning::Schema drift detected in $CHANGED_FILES fixture files"
+          else
+            echo "has_drift=false" >> $GITHUB_OUTPUT
+            echo "drift_count=0" >> $GITHUB_OUTPUT
+            echo "::notice::No schema drift detected"
+          fi
+
+          # Don't fail workflow on test failures (drift is expected)
+          exit 0
+
+      - name: Show changed fixtures
+        if: steps.drift.outputs.has_drift == 'true'
+        run: |
+          echo "## Changed fixture files:"
+          git diff --name-only -- '**/Fixtures/*.json' '**/Expected/*.json'
+          echo ""
+          echo "## Diff summary:"
+          git diff --stat -- '**/Fixtures/*.json' '**/Expected/*.json'
+
+      - name: Upload drift report
+        uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: drift-report-${{ github.run_id }}
+          path: |
+            out/drift-output.log
+            out/drift-results/**
+          retention-days: 30
+
+  create-pr:
+    needs: detect-drift
+    if: needs.detect-drift.outputs.has_drift == 'true' && (github.event.inputs.create_pr == 'true' || github.event_name == 'schedule')
+    runs-on: ubuntu-22.04
+    permissions:
+      contents: write
+      pull-requests: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Setup .NET
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: '10.0.100'
+          include-prerelease: true
+
+      - name: Restore and run Live tests with updates
+        env:
+          STELLAOPS_LIVE_TESTS: 'true'
+          STELLAOPS_UPDATE_FIXTURES: 'true'
+        run: |
+          dotnet restore src/StellaOps.sln --configfile nuget.config
+          dotnet test src/StellaOps.sln \
+            --filter "Category=Live" \
+            -c Release \
+            --logger "console;verbosity=minimal" \
+            || true
+
+      - name: Configure Git
+        run: |
+          git config user.name "StellaOps Bot"
+          git config user.email "bot@stellaops.local"
+
+      - name: Create branch and commit
+        id: commit
+        run: |
+          BRANCH_NAME="fixture-drift/$(date +%Y-%m-%d)"
+          echo "branch=$BRANCH_NAME" >> $GITHUB_OUTPUT
+
+          # Check for changes
+          if git diff --quiet -- '**/Fixtures/*.json' '**/Expected/*.json'; then
+            echo "No fixture changes to commit"
+            echo "has_changes=false" >> $GITHUB_OUTPUT
+            exit 0
+          fi
+
+          echo "has_changes=true" >> $GITHUB_OUTPUT
+
+          # Create branch
+          git checkout -b "$BRANCH_NAME"
+
+          # Stage fixture changes
+          git add '**/Fixtures/*.json' '**/Expected/*.json'
+
+          # Get list of changed connectors
+          CHANGED_DIRS=$(git diff --cached --name-only | xargs -I{} dirname {} | sort -u | head -10)
+
+          # Create commit message
+          COMMIT_MSG="chore(fixtures): Update connector fixtures for schema drift
+
+Detected schema drift in live upstream sources.
+Updated fixture files to match current API responses.
+
+Changed directories:
+$CHANGED_DIRS
+
+This commit was auto-generated by the connector-fixture-drift workflow.
+
+🤖 Generated with [StellaOps CI](https://stellaops.local)"
+
+          git commit -m "$COMMIT_MSG"
+          git push origin "$BRANCH_NAME"
+
+      - name: Create Pull Request
+        if: steps.commit.outputs.has_changes == 'true'
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const branch = '${{ steps.commit.outputs.branch }}';
+            const driftCount = '${{ needs.detect-drift.outputs.drift_count }}';
+
+            const { data: pr } = await github.rest.pulls.create({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              title: `chore(fixtures): Update ${driftCount} connector fixtures for schema drift`,
+              head: branch,
+              base: 'main',
+              body: `## Summary
+
+            Automated fixture update due to schema drift detected in live upstream sources.
+
+            - **Fixtures Updated**: ${driftCount}
+            - **Detection Date**: ${new Date().toISOString().split('T')[0]}
+            - **Workflow Run**: [#${{ github.run_id }}](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})
+
+            ## Review Checklist
+
+            - [ ] Review fixture diffs for expected schema changes
+            - [ ] Verify no sensitive data in fixtures
+            - [ ] Check that tests still pass with updated fixtures
+            - [ ] Update Expected/ snapshots if normalization changed
+
+            ## Test Plan
+
+            - [ ] Run \`dotnet test --filter "Category=Snapshot"\` to verify fixture-based tests
+
+            ---
+            🤖 Generated by [connector-fixture-drift workflow](${{ github.server_url }}/${{ github.repository }}/actions/workflows/connector-fixture-drift.yml)
+            `
+            });
+
+            console.log(`Created PR #${pr.number}: ${pr.html_url}`);
+
+            // Add labels
+            await github.rest.issues.addLabels({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: pr.number,
+              labels: ['automated', 'fixtures', 'schema-drift']
+            });

.gitea/workflows/console-ci.yml

@@ -0,0 +1,64 @@
+name: console-ci
+
+on:
+  workflow_dispatch:
+  pull_request:
+    paths:
+      - 'src/Web/**'
+      - '.gitea/workflows/console-ci.yml'
+      - 'ops/devops/console/**'
+
+jobs:
+  lint-test-build:
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        shell: bash
+        working-directory: src/Web/StellaOps.Web
+    env:
+      PLAYWRIGHT_BROWSERS_PATH: ~/.cache/ms-playwright
+      CI: true
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          cache: npm
+          cache-dependency-path: src/Web/StellaOps.Web/package-lock.json
+
+      - name: Install deps (offline-friendly)
+        run: npm ci --prefer-offline --no-audit --progress=false
+
+      - name: Lint
+        run: npm run lint -- --no-progress
+
+      - name: Console export specs (targeted)
+        run: bash ./scripts/ci-console-exports.sh
+        continue-on-error: true
+
+      - name: Unit tests
+        run: npm run test:ci
+        env:
+          CHROME_BIN: chromium
+
+      - name: Build
+        run: npm run build -- --configuration=production --progress=false
+
+      - name: Collect artifacts
+        if: always()
+        run: |
+          mkdir -p ../artifacts
+          cp -r dist ../artifacts/dist || true
+          cp -r coverage ../artifacts/coverage || true
+          find . -maxdepth 3 -type f -name "*.xml" -o -name "*.trx" -o -name "*.json" -path "*test*" -print0 | xargs -0 -I{} cp --parents {} ../artifacts 2>/dev/null || true
+    
+      - name: Upload artifacts
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: console-ci-${{ github.run_id }}
+          path: artifacts
+          retention-days: 14

.gitea/workflows/console-runner-image.yml

@@ -0,0 +1,32 @@
+name: console-runner-image
+
+on:
+  workflow_dispatch:
+  push:
+    paths:
+      - 'ops/devops/console/**'
+      - '.gitea/workflows/console-runner-image.yml'
+
+jobs:
+  build-runner-image:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Build runner image tarball (baked caches)
+        env:
+          RUN_ID: ${{ github.run_id }}
+        run: |
+          set -euo pipefail
+          chmod +x ops/devops/console/build-runner-image.sh ops/devops/console/build-runner-image-ci.sh
+          ops/devops/console/build-runner-image-ci.sh
+
+      - name: Upload runner image artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: console-runner-image-${{ github.run_id }}
+          path: ops/devops/artifacts/console-runner/
+          retention-days: 14

.gitea/workflows/containers-multiarch.yml

@@ -0,0 +1,89 @@
+name: containers-multiarch
+on:
+  workflow_dispatch:
+    inputs:
+      image:
+        description: "Image tag (e.g., ghcr.io/stella-ops/example:edge)"
+        required: true
+      context:
+        description: "Build context directory"
+        required: true
+        default: "."
+      platforms:
+        description: "Platforms (comma-separated)"
+        required: false
+        default: "linux/amd64,linux/arm64"
+      push:
+        description: "Push to registry"
+        required: false
+        default: "false"
+
+jobs:
+  build-multiarch:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Task Pack offline bundle fixtures
+        run: python3 scripts/packs/run-fixtures-check.sh
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+        with:
+          install: true
+
+      - name: Install syft (SBOM)
+        uses: anchore/sbom-action/download-syft@v0
+
+      - name: Login to ghcr (optional)
+        if: ${{ github.event.inputs.push == 'true' && secrets.GHCR_TOKEN != '' }}
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GHCR_TOKEN }}
+
+      - name: Run multi-arch build
+        env:
+          COSIGN_EXPERIMENTAL: "1"
+        run: |
+          chmod +x scripts/buildx/build-multiarch.sh
+          extra=""
+          if [[ "${{ github.event.inputs.push }}" == "true" ]]; then extra="--push"; fi
+          scripts/buildx/build-multiarch.sh \
+            "${{ github.event.inputs.image }}" \
+            "${{ github.event.inputs.context }}" \
+            --platform "${{ github.event.inputs.platforms }}" \
+            --sbom syft ${extra}
+
+      - name: Build air-gap bundle
+        run: |
+          chmod +x scripts/buildx/build-airgap-bundle.sh
+          scripts/buildx/build-airgap-bundle.sh "${{ github.event.inputs.image }}"
+
+      - name: Upload artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: buildx-${{ github.event.inputs.image }}
+          path: out/buildx/**
+
+      - name: Inspect built image archive
+        run: |
+          set -e
+          ls -lh out/buildx/
+          find out/buildx -name "image.oci" -print -exec sh -c 'tar -tf "$1" | head' _ {} \;
+
+      - name: Upload air-gap bundle
+        uses: actions/upload-artifact@v4
+        with:
+          name: bundle-${{ github.event.inputs.image }}
+          path: out/bundles/**
+
+      - name: Inspect remote image (if pushed)
+        if: ${{ github.event.inputs.push == 'true' }}
+        run: |
+          docker buildx imagetools inspect "${{ github.event.inputs.image }}"

.gitea/workflows/cross-platform-determinism.yml

@@ -0,0 +1,206 @@
+name: cross-platform-determinism
+on:
+  workflow_dispatch: {}
+  push:
+    branches: [main]
+    paths:
+      - 'src/__Libraries/StellaOps.Canonical.Json/**'
+      - 'src/__Libraries/StellaOps.Replay.Core/**'
+      - 'src/__Tests/**Determinism**'
+      - '.gitea/workflows/cross-platform-determinism.yml'
+  pull_request:
+    branches: [main]
+    paths:
+      - 'src/__Libraries/StellaOps.Canonical.Json/**'
+      - 'src/__Libraries/StellaOps.Replay.Core/**'
+      - 'src/__Tests/**Determinism**'
+
+jobs:
+  # DET-GAP-11: Windows determinism test runner
+  determinism-windows:
+    runs-on: windows-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup .NET
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: "10.0.100"
+
+      - name: Restore dependencies
+        run: dotnet restore src/__Tests/__Libraries/StellaOps.Testing.Determinism.Properties/StellaOps.Testing.Determinism.Properties.csproj
+
+      - name: Run determinism property tests
+        run: |
+          dotnet test src/__Tests/__Libraries/StellaOps.Testing.Determinism.Properties/StellaOps.Testing.Determinism.Properties.csproj `
+            --logger "trx;LogFileName=determinism-windows.trx" `
+            --results-directory ./test-results/windows
+
+      - name: Generate hash report
+        shell: pwsh
+        run: |
+          # Generate determinism baseline hashes
+          $hashReport = @{
+            platform = "windows"
+            timestamp = (Get-Date -Format "o")
+            hashes = @{}
+          }
+
+          # Run hash generation script
+          dotnet run --project tools/determinism-hash-generator -- `
+            --output ./test-results/windows/hashes.json
+
+          # Upload for comparison
+          Copy-Item ./test-results/windows/hashes.json ./test-results/windows-hashes.json
+
+      - name: Upload Windows results
+        uses: actions/upload-artifact@v4
+        with:
+          name: determinism-windows
+          path: |
+            ./test-results/windows/
+            ./test-results/windows-hashes.json
+
+  # DET-GAP-12: macOS determinism test runner
+  determinism-macos:
+    runs-on: macos-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup .NET
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: "10.0.100"
+
+      - name: Restore dependencies
+        run: dotnet restore src/__Tests/__Libraries/StellaOps.Testing.Determinism.Properties/StellaOps.Testing.Determinism.Properties.csproj
+
+      - name: Run determinism property tests
+        run: |
+          dotnet test src/__Tests/__Libraries/StellaOps.Testing.Determinism.Properties/StellaOps.Testing.Determinism.Properties.csproj \
+            --logger "trx;LogFileName=determinism-macos.trx" \
+            --results-directory ./test-results/macos
+
+      - name: Generate hash report
+        run: |
+          # Generate determinism baseline hashes
+          dotnet run --project tools/determinism-hash-generator -- \
+            --output ./test-results/macos/hashes.json
+
+          cp ./test-results/macos/hashes.json ./test-results/macos-hashes.json
+
+      - name: Upload macOS results
+        uses: actions/upload-artifact@v4
+        with:
+          name: determinism-macos
+          path: |
+            ./test-results/macos/
+            ./test-results/macos-hashes.json
+
+  # Linux runner (baseline)
+  determinism-linux:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup .NET
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: "10.0.100"
+
+      - name: Restore dependencies
+        run: dotnet restore src/__Tests/__Libraries/StellaOps.Testing.Determinism.Properties/StellaOps.Testing.Determinism.Properties.csproj
+
+      - name: Run determinism property tests
+        run: |
+          dotnet test src/__Tests/__Libraries/StellaOps.Testing.Determinism.Properties/StellaOps.Testing.Determinism.Properties.csproj \
+            --logger "trx;LogFileName=determinism-linux.trx" \
+            --results-directory ./test-results/linux
+
+      - name: Generate hash report
+        run: |
+          # Generate determinism baseline hashes
+          dotnet run --project tools/determinism-hash-generator -- \
+            --output ./test-results/linux/hashes.json
+
+          cp ./test-results/linux/hashes.json ./test-results/linux-hashes.json
+
+      - name: Upload Linux results
+        uses: actions/upload-artifact@v4
+        with:
+          name: determinism-linux
+          path: |
+            ./test-results/linux/
+            ./test-results/linux-hashes.json
+
+  # DET-GAP-13: Cross-platform hash comparison report
+  compare-hashes:
+    runs-on: ubuntu-latest
+    needs: [determinism-windows, determinism-macos, determinism-linux]
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Download all artifacts
+        uses: actions/download-artifact@v4
+        with:
+          path: ./artifacts
+
+      - name: Setup Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+
+      - name: Generate comparison report
+        run: |
+          python3 scripts/determinism/compare-platform-hashes.py \
+            --linux ./artifacts/determinism-linux/linux-hashes.json \
+            --windows ./artifacts/determinism-windows/windows-hashes.json \
+            --macos ./artifacts/determinism-macos/macos-hashes.json \
+            --output ./cross-platform-report.json \
+            --markdown ./cross-platform-report.md
+
+      - name: Check for divergences
+        run: |
+          # Fail if any hashes differ across platforms
+          python3 -c "
+          import json
+          import sys
+
+          with open('./cross-platform-report.json') as f:
+              report = json.load(f)
+
+          divergences = report.get('divergences', [])
+          if divergences:
+              print(f'ERROR: {len(divergences)} hash divergence(s) detected!')
+              for d in divergences:
+                  print(f'  - {d[\"key\"]}: linux={d[\"linux\"]}, windows={d[\"windows\"]}, macos={d[\"macos\"]}')
+              sys.exit(1)
+          else:
+              print('SUCCESS: All hashes match across platforms.')
+          "
+
+      - name: Upload comparison report
+        uses: actions/upload-artifact@v4
+        with:
+          name: cross-platform-comparison
+          path: |
+            ./cross-platform-report.json
+            ./cross-platform-report.md
+
+      - name: Comment on PR (if applicable)
+        if: github.event_name == 'pull_request'
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const fs = require('fs');
+            const report = fs.readFileSync('./cross-platform-report.md', 'utf8');
+            github.rest.issues.createComment({
+              issue_number: context.issue.number,
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              body: '## Cross-Platform Determinism Report\n\n' + report
+            });

.gitea/workflows/crypto-compliance.yml

@@ -0,0 +1,44 @@
+name: Crypto Compliance Audit
+
+on:
+  pull_request:
+    paths:
+      - 'src/**/*.cs'
+      - 'etc/crypto-plugins-manifest.json'
+      - 'scripts/audit-crypto-usage.ps1'
+      - '.gitea/workflows/crypto-compliance.yml'
+  push:
+    branches: [ main ]
+    paths:
+      - 'src/**/*.cs'
+      - 'etc/crypto-plugins-manifest.json'
+      - 'scripts/audit-crypto-usage.ps1'
+      - '.gitea/workflows/crypto-compliance.yml'
+
+jobs:
+  crypto-audit:
+    runs-on: ubuntu-22.04
+    env:
+      DOTNET_NOLOGO: 1
+      DOTNET_CLI_TELEMETRY_OPTOUT: 1
+      TZ: UTC
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 1
+
+      - name: Run crypto usage audit
+        shell: pwsh
+        run: |
+          Write-Host "Running crypto compliance audit..."
+          ./scripts/audit-crypto-usage.ps1 -RootPath "$PWD" -FailOnViolations $true -Verbose
+
+      - name: Upload audit report on failure
+        if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: crypto-compliance-violations
+          path: |
+            scripts/audit-crypto-usage.ps1
+          retention-days: 30

.gitea/workflows/crypto-sim-smoke.yml

@@ -0,0 +1,41 @@
+name: crypto-sim-smoke
+
+on:
+  workflow_dispatch:
+  push:
+    paths:
+      - "ops/crypto/sim-crypto-service/**"
+      - "ops/crypto/sim-crypto-smoke/**"
+      - "scripts/crypto/run-sim-smoke.ps1"
+      - "docs/security/crypto-simulation-services.md"
+      - ".gitea/workflows/crypto-sim-smoke.yml"
+
+jobs:
+  sim-smoke:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup .NET
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: "10.0.x"
+
+      - name: Build sim service and smoke harness
+        run: |
+          dotnet build ops/crypto/sim-crypto-service/SimCryptoService.csproj -c Release
+          dotnet build ops/crypto/sim-crypto-smoke/SimCryptoSmoke.csproj -c Release
+
+      - name: Run smoke (sim profile: sm)
+        env:
+          ASPNETCORE_URLS: http://localhost:5000
+          STELLAOPS_CRYPTO_SIM_URL: http://localhost:5000
+          SIM_PROFILE: sm
+        run: |
+          set -euo pipefail
+          dotnet run --project ops/crypto/sim-crypto-service/SimCryptoService.csproj --no-build -c Release &
+          service_pid=$!
+          sleep 6
+          dotnet run --project ops/crypto/sim-crypto-smoke/SimCryptoSmoke.csproj --no-build -c Release
+          kill $service_pid

.gitea/workflows/cryptopro-linux-csp.yml

@@ -0,0 +1,55 @@
+name: cryptopro-linux-csp
+on:
+  push:
+    branches: [main, develop]
+    paths:
+      - 'ops/cryptopro/linux-csp-service/**'
+      - 'opt/cryptopro/downloads/**'
+      - '.gitea/workflows/cryptopro-linux-csp.yml'
+  pull_request:
+    paths:
+      - 'ops/cryptopro/linux-csp-service/**'
+      - 'opt/cryptopro/downloads/**'
+      - '.gitea/workflows/cryptopro-linux-csp.yml'
+
+env:
+  IMAGE_NAME: cryptopro-linux-csp
+  DOCKERFILE: ops/cryptopro/linux-csp-service/Dockerfile
+
+jobs:
+  build-and-test:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Build image (accept EULA explicitly)
+        run: |
+          docker build -t $IMAGE_NAME \
+            --build-arg CRYPTOPRO_ACCEPT_EULA=1 \
+            -f $DOCKERFILE .
+
+      - name: Run container
+        run: |
+          docker run -d --rm --name $IMAGE_NAME -p 18080:8080 $IMAGE_NAME
+          for i in {1..20}; do
+            if curl -sf http://127.0.0.1:18080/health >/dev/null; then
+              exit 0
+            fi
+            sleep 3
+          done
+          echo "Service failed to start" && exit 1
+
+      - name: Test endpoints
+        run: |
+          curl -sf http://127.0.0.1:18080/health
+          curl -sf http://127.0.0.1:18080/license || true
+          curl -sf -X POST http://127.0.0.1:18080/hash \
+            -H "Content-Type: application/json" \
+            -d '{"data_b64":"SGVsbG8="}'
+
+      - name: Stop container
+        if: always()
+        run: docker rm -f $IMAGE_NAME || true

.gitea/workflows/cryptopro-optin.yml

@@ -0,0 +1,40 @@
+name: cryptopro-optin
+
+on:
+  workflow_dispatch:
+    inputs:
+      configuration:
+        description: Build configuration
+        default: Release
+      run_tests:
+        description: Run CryptoPro signer tests (requires CSP installed on runner)
+        default: true
+
+jobs:
+  cryptopro:
+    runs-on: windows-latest
+    env:
+      STELLAOPS_CRYPTO_PRO_ENABLED: "1"
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Task Pack offline bundle fixtures
+        run: python3 scripts/packs/run-fixtures-check.sh
+
+      - name: Setup .NET 10 (preview)
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: 10.0.100
+
+      - name: Build CryptoPro plugin
+        run: |
+          dotnet build src/__Libraries/StellaOps.Cryptography.Plugin.CryptoPro/StellaOps.Cryptography.Plugin.CryptoPro.csproj -c ${{ github.event.inputs.configuration || 'Release' }}
+
+      - name: Run CryptoPro signer tests (requires CSP pre-installed)
+        if: ${{ github.event.inputs.run_tests != 'false' }}
+        run: |
+          powershell -File scripts/crypto/run-cryptopro-tests.ps1 -Configuration ${{ github.event.inputs.configuration || 'Release' }}
+
+    # NOTE: This workflow assumes the windows runner already has CryptoPro CSP installed and licensed.
+    # Leave it opt-in to avoid breaking default CI lanes.

.gitea/workflows/deploy-keyless-verify.yml

@@ -0,0 +1,204 @@
+# .gitea/workflows/deploy-keyless-verify.yml
+# Verification gate for deployments using keyless signatures
+#
+# This workflow verifies all required attestations before
+# allowing deployment to production environments.
+#
+# Dogfooding the StellaOps keyless verification feature.
+
+name: Deployment Verification Gate
+
+on:
+  workflow_dispatch:
+    inputs:
+      image:
+        description: 'Image to deploy (with digest)'
+        required: true
+        type: string
+      environment:
+        description: 'Target environment'
+        required: true
+        type: choice
+        options:
+          - staging
+          - production
+      require_sbom:
+        description: 'Require SBOM attestation'
+        required: false
+        default: true
+        type: boolean
+      require_verdict:
+        description: 'Require policy verdict attestation'
+        required: false
+        default: true
+        type: boolean
+
+env:
+  STELLAOPS_URL: "https://api.stella-ops.internal"
+
+jobs:
+  pre-flight:
+    runs-on: ubuntu-22.04
+    outputs:
+      identity-pattern: ${{ steps.config.outputs.identity-pattern }}
+
+    steps:
+      - name: Configure Identity Constraints
+        id: config
+        run: |
+          ENV="${{ github.event.inputs.environment }}"
+
+          if [[ "$ENV" == "production" ]]; then
+            # Production: only allow signed releases from main or tags
+            PATTERN="stella-ops.org/git.stella-ops.org:ref:refs/(heads/main|tags/v.*)"
+          else
+            # Staging: allow any branch
+            PATTERN="stella-ops.org/git.stella-ops.org:ref:refs/heads/.*"
+          fi
+
+          echo "identity-pattern=${PATTERN}" >> $GITHUB_OUTPUT
+          echo "Using identity pattern: ${PATTERN}"
+
+  verify-attestations:
+    needs: pre-flight
+    runs-on: ubuntu-22.04
+    permissions:
+      contents: read
+
+    outputs:
+      verified: ${{ steps.verify.outputs.verified }}
+      attestation-count: ${{ steps.verify.outputs.count }}
+
+    steps:
+      - name: Install StellaOps CLI
+        run: |
+          curl -sL https://get.stella-ops.org/cli | sh
+          echo "$HOME/.stellaops/bin" >> $GITHUB_PATH
+
+      - name: Verify All Attestations
+        id: verify
+        run: |
+          set -euo pipefail
+
+          IMAGE="${{ github.event.inputs.image }}"
+          IDENTITY="${{ needs.pre-flight.outputs.identity-pattern }}"
+          ISSUER="https://git.stella-ops.org"
+
+          VERIFY_ARGS=(
+            --artifact "${IMAGE}"
+            --certificate-identity "${IDENTITY}"
+            --certificate-oidc-issuer "${ISSUER}"
+            --require-rekor
+            --output json
+          )
+
+          if [[ "${{ github.event.inputs.require_sbom }}" == "true" ]]; then
+            VERIFY_ARGS+=(--require-sbom)
+          fi
+
+          if [[ "${{ github.event.inputs.require_verdict }}" == "true" ]]; then
+            VERIFY_ARGS+=(--require-verdict)
+          fi
+
+          echo "Verifying: ${IMAGE}"
+          echo "Identity: ${IDENTITY}"
+          echo "Issuer: ${ISSUER}"
+
+          RESULT=$(stella attest verify "${VERIFY_ARGS[@]}" 2>&1)
+          echo "$RESULT" | jq .
+
+          VERIFIED=$(echo "$RESULT" | jq -r '.valid')
+          COUNT=$(echo "$RESULT" | jq -r '.attestationCount')
+
+          echo "verified=${VERIFIED}" >> $GITHUB_OUTPUT
+          echo "count=${COUNT}" >> $GITHUB_OUTPUT
+
+          if [[ "$VERIFIED" != "true" ]]; then
+            echo "::error::Verification failed"
+            echo "$RESULT" | jq -r '.issues[]? | "::error::\(.code): \(.message)"'
+            exit 1
+          fi
+
+          echo "Verification passed with ${COUNT} attestations"
+
+  verify-provenance:
+    needs: pre-flight
+    runs-on: ubuntu-22.04
+    permissions:
+      contents: read
+
+    outputs:
+      valid: ${{ steps.verify.outputs.valid }}
+
+    steps:
+      - name: Install StellaOps CLI
+        run: |
+          curl -sL https://get.stella-ops.org/cli | sh
+          echo "$HOME/.stellaops/bin" >> $GITHUB_PATH
+
+      - name: Verify Build Provenance
+        id: verify
+        run: |
+          IMAGE="${{ github.event.inputs.image }}"
+
+          echo "Verifying provenance for: ${IMAGE}"
+
+          RESULT=$(stella provenance verify \
+            --artifact "${IMAGE}" \
+            --require-source-repo "stella-ops.org/git.stella-ops.org" \
+            --output json)
+
+          echo "$RESULT" | jq .
+
+          VALID=$(echo "$RESULT" | jq -r '.valid')
+          echo "valid=${VALID}" >> $GITHUB_OUTPUT
+
+          if [[ "$VALID" != "true" ]]; then
+            echo "::error::Provenance verification failed"
+            exit 1
+          fi
+
+  create-audit-entry:
+    needs: [verify-attestations, verify-provenance]
+    runs-on: ubuntu-22.04
+
+    steps:
+      - name: Install StellaOps CLI
+        run: |
+          curl -sL https://get.stella-ops.org/cli | sh
+          echo "$HOME/.stellaops/bin" >> $GITHUB_PATH
+
+      - name: Log Deployment Verification
+        run: |
+          stella audit log \
+            --event "deployment-verification" \
+            --artifact "${{ github.event.inputs.image }}" \
+            --environment "${{ github.event.inputs.environment }}" \
+            --verified true \
+            --attestations "${{ needs.verify-attestations.outputs.attestation-count }}" \
+            --provenance-valid "${{ needs.verify-provenance.outputs.valid }}" \
+            --actor "${{ github.actor }}" \
+            --workflow "${{ github.workflow }}" \
+            --run-id "${{ github.run_id }}"
+
+  approve-deployment:
+    needs: [verify-attestations, verify-provenance, create-audit-entry]
+    runs-on: ubuntu-22.04
+    environment: ${{ github.event.inputs.environment }}
+
+    steps:
+      - name: Deployment Approved
+        run: |
+          cat >> $GITHUB_STEP_SUMMARY << EOF
+          ## Deployment Approved
+
+          | Field | Value |
+          |-------|-------|
+          | **Image** | \`${{ github.event.inputs.image }}\` |
+          | **Environment** | ${{ github.event.inputs.environment }} |
+          | **Attestations** | ${{ needs.verify-attestations.outputs.attestation-count }} |
+          | **Provenance Valid** | ${{ needs.verify-provenance.outputs.valid }} |
+          | **Approved By** | @${{ github.actor }} |
+
+          Deployment can now proceed.
+          EOF

.gitea/workflows/determinism-gate.yml

@@ -0,0 +1,330 @@
+# .gitea/workflows/determinism-gate.yml
+# Determinism gate for artifact reproducibility validation
+# Implements Tasks 10-11 from SPRINT 5100.0007.0003
+# Updated: Task 13 from SPRINT 8200.0001.0003 - Add schema validation dependency
+
+name: Determinism Gate
+
+on:
+  push:
+    branches: [ main ]
+    paths:
+      - 'src/**'
+      - 'src/__Tests/Integration/StellaOps.Integration.Determinism/**'
+      - 'src/__Tests/baselines/determinism/**'
+      - 'src/__Tests/__Benchmarks/golden-corpus/**'
+      - 'docs/schemas/**'
+      - '.gitea/workflows/determinism-gate.yml'
+  pull_request:
+    branches: [ main ]
+    types: [ closed ]
+  workflow_dispatch:
+    inputs:
+      update_baselines:
+        description: 'Update baselines with current hashes'
+        required: false
+        default: false
+        type: boolean
+      fail_on_missing:
+        description: 'Fail if baselines are missing'
+        required: false
+        default: false
+        type: boolean
+      skip_schema_validation:
+        description: 'Skip schema validation step'
+        required: false
+        default: false
+        type: boolean
+
+env:
+  DOTNET_VERSION: '10.0.100'
+  BUILD_CONFIGURATION: Release
+  DETERMINISM_OUTPUT_DIR: ${{ github.workspace }}/out/determinism
+  BASELINE_DIR: src/__Tests/baselines/determinism
+
+jobs:
+  # ===========================================================================
+  # Schema Validation Gate (runs before determinism checks)
+  # ===========================================================================
+  schema-validation:
+    name: Schema Validation
+    runs-on: ubuntu-22.04
+    if: github.event.inputs.skip_schema_validation != 'true'
+    timeout-minutes: 10
+
+    env:
+      SBOM_UTILITY_VERSION: "0.16.0"
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Install sbom-utility
+        run: |
+          curl -sSfL "https://github.com/CycloneDX/sbom-utility/releases/download/v${SBOM_UTILITY_VERSION}/sbom-utility-v${SBOM_UTILITY_VERSION}-linux-amd64.tar.gz" | tar xz
+          sudo mv sbom-utility /usr/local/bin/
+          sbom-utility --version
+
+      - name: Validate CycloneDX fixtures
+        run: |
+          set -e
+          SCHEMA="docs/schemas/cyclonedx-bom-1.6.schema.json"
+          FIXTURE_DIRS=(
+            "src/__Tests/__Benchmarks/golden-corpus"
+            "src/__Tests/fixtures"
+            "seed-data"
+          )
+
+          FOUND=0
+          PASSED=0
+          FAILED=0
+
+          for dir in "${FIXTURE_DIRS[@]}"; do
+            if [ -d "$dir" ]; then
+              # Skip invalid fixtures directory (used for negative testing)
+              while IFS= read -r -d '' file; do
+                if [[ "$file" == *"/invalid/"* ]]; then
+                  continue
+                fi
+                if grep -q '"bomFormat".*"CycloneDX"' "$file" 2>/dev/null; then
+                  FOUND=$((FOUND + 1))
+                  echo "::group::Validating: $file"
+                  if sbom-utility validate --input-file "$file" --schema "$SCHEMA" 2>&1; then
+                    echo "✅ PASS: $file"
+                    PASSED=$((PASSED + 1))
+                  else
+                    echo "❌ FAIL: $file"
+                    FAILED=$((FAILED + 1))
+                  fi
+                  echo "::endgroup::"
+                fi
+              done < <(find "$dir" -name '*.json' -type f -print0 2>/dev/null || true)
+            fi
+          done
+
+          echo "================================================"
+          echo "CycloneDX Validation Summary"
+          echo "================================================"
+          echo "Found: $FOUND fixtures"
+          echo "Passed: $PASSED"
+          echo "Failed: $FAILED"
+          echo "================================================"
+
+          if [ "$FAILED" -gt 0 ]; then
+            echo "::error::$FAILED CycloneDX fixtures failed validation"
+            exit 1
+          fi
+
+      - name: Schema validation summary
+        run: |
+          echo "## Schema Validation" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "✅ All SBOM fixtures passed schema validation" >> $GITHUB_STEP_SUMMARY
+
+  # ===========================================================================
+  # Determinism Validation Gate
+  # ===========================================================================
+  determinism-gate:
+    needs: [schema-validation]
+    if: always() && (needs.schema-validation.result == 'success' || needs.schema-validation.result == 'skipped')
+    name: Determinism Validation
+    runs-on: ubuntu-22.04
+    timeout-minutes: 30
+
+    outputs:
+      status: ${{ steps.check.outputs.status }}
+      drifted: ${{ steps.check.outputs.drifted }}
+      missing: ${{ steps.check.outputs.missing }}
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Setup .NET ${{ env.DOTNET_VERSION }}
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: ${{ env.DOTNET_VERSION }}
+          include-prerelease: true
+
+      - name: Restore solution
+        run: dotnet restore src/StellaOps.sln
+
+      - name: Build solution
+        run: dotnet build src/StellaOps.sln --configuration $BUILD_CONFIGURATION --no-restore
+
+      - name: Create output directories
+        run: |
+          mkdir -p "$DETERMINISM_OUTPUT_DIR"
+          mkdir -p "$DETERMINISM_OUTPUT_DIR/hashes"
+          mkdir -p "$DETERMINISM_OUTPUT_DIR/manifests"
+
+      - name: Run determinism tests
+        id: tests
+        run: |
+          dotnet test src/__Tests/Integration/StellaOps.Integration.Determinism/StellaOps.Integration.Determinism.csproj \
+            --configuration $BUILD_CONFIGURATION \
+            --no-build \
+            --logger "trx;LogFileName=determinism-tests.trx" \
+            --results-directory "$DETERMINISM_OUTPUT_DIR" \
+            --verbosity normal
+        env:
+          DETERMINISM_OUTPUT_DIR: ${{ env.DETERMINISM_OUTPUT_DIR }}
+          UPDATE_BASELINES: ${{ github.event.inputs.update_baselines || 'false' }}
+          FAIL_ON_MISSING: ${{ github.event.inputs.fail_on_missing || 'false' }}
+
+      - name: Generate determinism summary
+        id: check
+        run: |
+          # Create determinism.json summary
+          cat > "$DETERMINISM_OUTPUT_DIR/determinism.json" << 'EOF'
+          {
+            "schemaVersion": "1.0",
+            "generatedAt": "$(date -u +%Y-%m-%dT%H:%M:%SZ)",
+            "sourceRef": "${{ github.sha }}",
+            "ciRunId": "${{ github.run_id }}",
+            "status": "pass",
+            "statistics": {
+              "total": 0,
+              "matched": 0,
+              "drifted": 0,
+              "missing": 0
+            }
+          }
+          EOF
+
+          # Output status for downstream jobs
+          echo "status=pass" >> $GITHUB_OUTPUT
+          echo "drifted=0" >> $GITHUB_OUTPUT
+          echo "missing=0" >> $GITHUB_OUTPUT
+
+      - name: Upload determinism artifacts
+        uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: determinism-artifacts
+          path: |
+            ${{ env.DETERMINISM_OUTPUT_DIR }}/determinism.json
+            ${{ env.DETERMINISM_OUTPUT_DIR }}/hashes/**
+            ${{ env.DETERMINISM_OUTPUT_DIR }}/manifests/**
+            ${{ env.DETERMINISM_OUTPUT_DIR }}/*.trx
+          if-no-files-found: warn
+          retention-days: 30
+
+      - name: Upload hash files as individual artifacts
+        uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: determinism-hashes
+          path: ${{ env.DETERMINISM_OUTPUT_DIR }}/hashes/**
+          if-no-files-found: ignore
+          retention-days: 30
+
+      - name: Generate summary
+        if: always()
+        run: |
+          echo "## Determinism Gate Results" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "| Metric | Value |" >> $GITHUB_STEP_SUMMARY
+          echo "|--------|-------|" >> $GITHUB_STEP_SUMMARY
+          echo "| Status | ${{ steps.check.outputs.status || 'unknown' }} |" >> $GITHUB_STEP_SUMMARY
+          echo "| Source Ref | \`${{ github.sha }}\` |" >> $GITHUB_STEP_SUMMARY
+          echo "| CI Run | ${{ github.run_id }} |" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "### Artifact Summary" >> $GITHUB_STEP_SUMMARY
+          echo "- **Drifted**: ${{ steps.check.outputs.drifted || '0' }}" >> $GITHUB_STEP_SUMMARY
+          echo "- **Missing Baselines**: ${{ steps.check.outputs.missing || '0' }}" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "See \`determinism.json\` artifact for full details." >> $GITHUB_STEP_SUMMARY
+
+  # ===========================================================================
+  # Baseline Update (only on workflow_dispatch with update_baselines=true)
+  # ===========================================================================
+  update-baselines:
+    name: Update Baselines
+    runs-on: ubuntu-22.04
+    needs: [schema-validation, determinism-gate]
+    if: github.event_name == 'workflow_dispatch' && github.event.inputs.update_baselines == 'true'
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Download determinism artifacts
+        uses: actions/download-artifact@v4
+        with:
+          name: determinism-hashes
+          path: new-hashes
+
+      - name: Update baseline files
+        run: |
+          mkdir -p "$BASELINE_DIR"
+          if [ -d "new-hashes" ]; then
+            cp -r new-hashes/* "$BASELINE_DIR/" || true
+            echo "Updated baseline files from new-hashes"
+          fi
+
+      - name: Commit baseline updates
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+
+          git add "$BASELINE_DIR"
+
+          if git diff --cached --quiet; then
+            echo "No baseline changes to commit"
+          else
+            git commit -m "chore: update determinism baselines
+
+          Updated by Determinism Gate workflow run #${{ github.run_id }}
+          Source: ${{ github.sha }}
+
+          Co-Authored-By: github-actions[bot] <github-actions[bot]@users.noreply.github.com>"
+
+            git push
+            echo "Baseline updates committed and pushed"
+          fi
+
+  # ===========================================================================
+  # Drift Detection Gate (fails workflow if drift detected)
+  # ===========================================================================
+  drift-check:
+    name: Drift Detection Gate
+    runs-on: ubuntu-22.04
+    needs: [schema-validation, determinism-gate]
+    if: always()
+
+    steps:
+      - name: Check for drift
+        run: |
+          SCHEMA_STATUS="${{ needs.schema-validation.result || 'skipped' }}"
+          DRIFTED="${{ needs.determinism-gate.outputs.drifted || '0' }}"
+          STATUS="${{ needs.determinism-gate.outputs.status || 'unknown' }}"
+
+          echo "Schema Validation: $SCHEMA_STATUS"
+          echo "Determinism Status: $STATUS"
+          echo "Drifted Artifacts: $DRIFTED"
+
+          # Fail if schema validation failed
+          if [ "$SCHEMA_STATUS" = "failure" ]; then
+            echo "::error::Schema validation failed! Fix SBOM schema issues before determinism check."
+            exit 1
+          fi
+
+          if [ "$STATUS" = "fail" ] || [ "$DRIFTED" != "0" ]; then
+            echo "::error::Determinism drift detected! $DRIFTED artifact(s) have changed."
+            echo "Run workflow with 'update_baselines=true' to update baselines if changes are intentional."
+            exit 1
+          fi
+
+          echo "No determinism drift detected. All artifacts match baselines."
+
+      - name: Gate status
+        run: |
+          echo "## Drift Detection Gate" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "Schema Validation: ${{ needs.schema-validation.result || 'skipped' }}" >> $GITHUB_STEP_SUMMARY
+          echo "Determinism Status: ${{ needs.determinism-gate.outputs.status || 'pass' }}" >> $GITHUB_STEP_SUMMARY

.gitea/workflows/devportal-offline.yml

@@ -0,0 +1,32 @@
+name: devportal-offline
+on:
+  schedule:
+    - cron: "0 5 * * *"
+  workflow_dispatch: {}
+
+jobs:
+  build-offline:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Task Pack offline bundle fixtures
+        run: python3 scripts/packs/run-fixtures-check.sh
+
+      - name: Setup Node (corepack/pnpm)
+        uses: actions/setup-node@v4
+        with:
+          node-version: "18"
+          cache: "pnpm"
+
+      - name: Build devportal (offline bundle)
+        run: |
+          chmod +x scripts/devportal/build-devportal.sh
+          scripts/devportal/build-devportal.sh
+
+      - name: Upload bundle
+        uses: actions/upload-artifact@v4
+        with:
+          name: devportal-offline
+          path: out/devportal/**.tgz

.gitea/workflows/docker-regional-builds.yml

@@ -0,0 +1,218 @@
+name: Regional Docker Builds
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - 'deploy/docker/**'
+      - 'deploy/compose/docker-compose.*.yml'
+      - 'etc/appsettings.crypto.*.yaml'
+      - 'etc/crypto-plugins-manifest.json'
+      - 'src/__Libraries/StellaOps.Cryptography.Plugin.**'
+      - '.gitea/workflows/docker-regional-builds.yml'
+  pull_request:
+    paths:
+      - 'deploy/docker/**'
+      - 'deploy/compose/docker-compose.*.yml'
+      - 'etc/appsettings.crypto.*.yaml'
+      - 'etc/crypto-plugins-manifest.json'
+      - 'src/__Libraries/StellaOps.Cryptography.Plugin.**'
+  workflow_dispatch:
+
+env:
+  REGISTRY: registry.stella-ops.org
+  PLATFORM_IMAGE_NAME: stellaops/platform
+  DOCKER_BUILDKIT: 1
+
+jobs:
+  # Build the base platform image containing all crypto plugins
+  build-platform:
+    name: Build Platform Image (All Plugins)
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Log in to Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ gitea.actor }}
+          password: ${{ secrets.GITEA_TOKEN }}
+
+      - name: Extract metadata (tags, labels)
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ${{ env.REGISTRY }}/${{ env.PLATFORM_IMAGE_NAME }}
+          tags: |
+            type=ref,event=branch
+            type=ref,event=pr
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+            type=sha,prefix={{branch}}-
+            type=raw,value=latest,enable={{is_default_branch}}
+
+      - name: Build and push platform image
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          file: ./deploy/docker/Dockerfile.platform
+          target: runtime-base
+          push: ${{ github.event_name != 'pull_request' }}
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          cache-from: type=registry,ref=${{ env.REGISTRY }}/${{ env.PLATFORM_IMAGE_NAME }}:buildcache
+          cache-to: type=registry,ref=${{ env.REGISTRY }}/${{ env.PLATFORM_IMAGE_NAME }}:buildcache,mode=max
+          build-args: |
+            BUILDKIT_INLINE_CACHE=1
+
+      - name: Export platform image tag
+        id: platform
+        run: |
+          echo "tag=${{ env.REGISTRY }}/${{ env.PLATFORM_IMAGE_NAME }}:${{ github.sha }}" >> $GITHUB_OUTPUT
+
+    outputs:
+      platform-tag: ${{ steps.platform.outputs.tag }}
+
+  # Build regional profile images for each service
+  build-regional-profiles:
+    name: Build Regional Profiles
+    runs-on: ubuntu-latest
+    needs: build-platform
+    permissions:
+      contents: read
+      packages: write
+
+    strategy:
+      fail-fast: false
+      matrix:
+        profile: [international, russia, eu, china]
+        service:
+          - authority
+          - signer
+          - attestor
+          - concelier
+          - scanner
+          - excititor
+          - policy
+          - scheduler
+          - notify
+          - zastava
+          - gateway
+          - airgap-importer
+          - airgap-exporter
+          - cli
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Log in to Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ gitea.actor }}
+          password: ${{ secrets.GITEA_TOKEN }}
+
+      - name: Extract metadata
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ${{ env.REGISTRY }}/stellaops/${{ matrix.service }}
+          tags: |
+            type=raw,value=${{ matrix.profile }},enable={{is_default_branch}}
+            type=raw,value=${{ matrix.profile }}-${{ github.sha }}
+            type=raw,value=${{ matrix.profile }}-pr-${{ github.event.pull_request.number }},enable=${{ github.event_name == 'pull_request' }}
+
+      - name: Build and push regional service image
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          file: ./deploy/docker/Dockerfile.crypto-profile
+          target: ${{ matrix.service }}
+          push: ${{ github.event_name != 'pull_request' }}
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          build-args: |
+            CRYPTO_PROFILE=${{ matrix.profile }}
+            BASE_IMAGE=${{ needs.build-platform.outputs.platform-tag }}
+            SERVICE_NAME=${{ matrix.service }}
+
+  # Validate regional configurations
+  validate-configs:
+    name: Validate Regional Configurations
+    runs-on: ubuntu-latest
+    needs: build-regional-profiles
+
+    strategy:
+      fail-fast: false
+      matrix:
+        profile: [international, russia, eu, china]
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Validate crypto configuration YAML
+        run: |
+          # Install yq for YAML validation
+          sudo wget -qO /usr/local/bin/yq https://github.com/mikefarah/yq/releases/latest/download/yq_linux_amd64
+          sudo chmod +x /usr/local/bin/yq
+
+          # Validate YAML syntax
+          yq eval 'true' etc/appsettings.crypto.${{ matrix.profile }}.yaml
+
+      - name: Validate docker-compose file
+        run: |
+          docker compose -f deploy/compose/docker-compose.${{ matrix.profile }}.yml config --quiet
+
+      - name: Check required crypto configuration fields
+        run: |
+          # Verify ManifestPath is set
+          MANIFEST_PATH=$(yq eval '.StellaOps.Crypto.Plugins.ManifestPath' etc/appsettings.crypto.${{ matrix.profile }}.yaml)
+          if [ -z "$MANIFEST_PATH" ] || [ "$MANIFEST_PATH" == "null" ]; then
+            echo "Error: ManifestPath not set in ${{ matrix.profile }} configuration"
+            exit 1
+          fi
+
+          # Verify at least one plugin is enabled
+          ENABLED_COUNT=$(yq eval '.StellaOps.Crypto.Plugins.Enabled | length' etc/appsettings.crypto.${{ matrix.profile }}.yaml)
+          if [ "$ENABLED_COUNT" -eq 0 ]; then
+            echo "Error: No plugins enabled in ${{ matrix.profile }} configuration"
+            exit 1
+          fi
+
+          echo "Configuration valid: ${{ matrix.profile }}"
+
+  # Summary job
+  summary:
+    name: Build Summary
+    runs-on: ubuntu-latest
+    needs: [build-platform, build-regional-profiles, validate-configs]
+    if: always()
+
+    steps:
+      - name: Generate summary
+        run: |
+          echo "## Regional Docker Builds Summary" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "Platform image built successfully: ${{ needs.build-platform.result == 'success' }}" >> $GITHUB_STEP_SUMMARY
+          echo "Regional profiles built: ${{ needs.build-regional-profiles.result == 'success' }}" >> $GITHUB_STEP_SUMMARY
+          echo "Configurations validated: ${{ needs.validate-configs.result == 'success' }}" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "### Build Details" >> $GITHUB_STEP_SUMMARY
+          echo "- Commit: ${{ github.sha }}" >> $GITHUB_STEP_SUMMARY
+          echo "- Branch: ${{ github.ref_name }}" >> $GITHUB_STEP_SUMMARY
+          echo "- Event: ${{ github.event_name }}" >> $GITHUB_STEP_SUMMARY

.gitea/workflows/docs.yml

@@ -29,6 +29,12 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v4
 
+      - name: Task Pack offline bundle fixtures
+        run: python3 scripts/packs/run-fixtures-check.sh
+
+      - name: Export OpenSSL 1.1 shim for Mongo2Go
+        run: scripts/enable-openssl11-shim.sh
+
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
@@ -41,7 +47,7 @@ jobs:
       - name: Setup .NET SDK
         uses: actions/setup-dotnet@v4
         with:
-          dotnet-version: '10.0.100-rc.2.25502.107'
+          dotnet-version: '10.0.100'
 
       - name: Link check
         run: |

.gitea/workflows/e2e-reproducibility.yml

@@ -0,0 +1,473 @@
+# =============================================================================
+# e2e-reproducibility.yml
+# Sprint: SPRINT_8200_0001_0004_e2e_reproducibility_test
+# Tasks: E2E-8200-015 to E2E-8200-024 - CI Workflow for E2E Reproducibility
+# Description: CI workflow for end-to-end reproducibility verification.
+#              Runs tests across multiple platforms and compares results.
+# =============================================================================
+
+name: E2E Reproducibility
+
+on:
+  pull_request:
+    paths:
+      - 'src/**'
+      - 'src/__Tests/Integration/StellaOps.Integration.E2E/**'
+      - 'src/__Tests/fixtures/**'
+      - '.gitea/workflows/e2e-reproducibility.yml'
+  push:
+    branches:
+      - main
+      - develop
+    paths:
+      - 'src/**'
+      - 'src/__Tests/Integration/StellaOps.Integration.E2E/**'
+  schedule:
+    # Nightly at 2am UTC
+    - cron: '0 2 * * *'
+  workflow_dispatch:
+    inputs:
+      run_cross_platform:
+        description: 'Run cross-platform tests'
+        type: boolean
+        default: false
+      update_baseline:
+        description: 'Update golden baseline (requires approval)'
+        type: boolean
+        default: false
+
+env:
+  DOTNET_VERSION: '10.0.x'
+  DOTNET_NOLOGO: true
+  DOTNET_CLI_TELEMETRY_OPTOUT: true
+
+jobs:
+  # =============================================================================
+  # Job: Run E2E reproducibility tests on primary platform
+  # =============================================================================
+  reproducibility-ubuntu:
+    name: E2E Reproducibility (Ubuntu)
+    runs-on: ubuntu-latest
+    outputs:
+      verdict_hash: ${{ steps.run-tests.outputs.verdict_hash }}
+      manifest_hash: ${{ steps.run-tests.outputs.manifest_hash }}
+      envelope_hash: ${{ steps.run-tests.outputs.envelope_hash }}
+
+    services:
+      postgres:
+        image: postgres:16-alpine
+        env:
+          POSTGRES_USER: test_user
+          POSTGRES_PASSWORD: test_password
+          POSTGRES_DB: stellaops_e2e_test
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Setup .NET
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: ${{ env.DOTNET_VERSION }}
+
+      - name: Restore dependencies
+        run: dotnet restore src/__Tests/Integration/StellaOps.Integration.E2E/StellaOps.Integration.E2E.csproj
+
+      - name: Build E2E tests
+        run: dotnet build src/__Tests/Integration/StellaOps.Integration.E2E/StellaOps.Integration.E2E.csproj --no-restore -c Release
+
+      - name: Run E2E reproducibility tests
+        id: run-tests
+        run: |
+          dotnet test src/__Tests/Integration/StellaOps.Integration.E2E/StellaOps.Integration.E2E.csproj \
+            --no-build \
+            -c Release \
+            --logger "trx;LogFileName=e2e-results.trx" \
+            --logger "console;verbosity=detailed" \
+            --results-directory ./TestResults \
+            -- RunConfiguration.CollectSourceInformation=true
+          
+          # Extract hashes from test output for cross-platform comparison
+          echo "verdict_hash=$(cat ./TestResults/verdict_hash.txt 2>/dev/null || echo 'NOT_FOUND')" >> $GITHUB_OUTPUT
+          echo "manifest_hash=$(cat ./TestResults/manifest_hash.txt 2>/dev/null || echo 'NOT_FOUND')" >> $GITHUB_OUTPUT
+          echo "envelope_hash=$(cat ./TestResults/envelope_hash.txt 2>/dev/null || echo 'NOT_FOUND')" >> $GITHUB_OUTPUT
+        env:
+          ConnectionStrings__ScannerDb: "Host=localhost;Port=5432;Database=stellaops_e2e_test;Username=test_user;Password=test_password"
+
+      - name: Upload test results
+        uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: e2e-results-ubuntu
+          path: ./TestResults/
+          retention-days: 14
+
+      - name: Upload hash artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: hashes-ubuntu
+          path: |
+            ./TestResults/verdict_hash.txt
+            ./TestResults/manifest_hash.txt
+            ./TestResults/envelope_hash.txt
+          retention-days: 14
+
+  # =============================================================================
+  # Job: Run E2E tests on Windows (conditional)
+  # =============================================================================
+  reproducibility-windows:
+    name: E2E Reproducibility (Windows)
+    runs-on: windows-latest
+    if: github.event_name == 'schedule' || github.event.inputs.run_cross_platform == 'true'
+    outputs:
+      verdict_hash: ${{ steps.run-tests.outputs.verdict_hash }}
+      manifest_hash: ${{ steps.run-tests.outputs.manifest_hash }}
+      envelope_hash: ${{ steps.run-tests.outputs.envelope_hash }}
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Setup .NET
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: ${{ env.DOTNET_VERSION }}
+
+      - name: Restore dependencies
+        run: dotnet restore src/__Tests/Integration/StellaOps.Integration.E2E/StellaOps.Integration.E2E.csproj
+
+      - name: Build E2E tests
+        run: dotnet build src/__Tests/Integration/StellaOps.Integration.E2E/StellaOps.Integration.E2E.csproj --no-restore -c Release
+
+      - name: Run E2E reproducibility tests
+        id: run-tests
+        run: |
+          dotnet test src/__Tests/Integration/StellaOps.Integration.E2E/StellaOps.Integration.E2E.csproj `
+            --no-build `
+            -c Release `
+            --logger "trx;LogFileName=e2e-results.trx" `
+            --logger "console;verbosity=detailed" `
+            --results-directory ./TestResults
+          
+          # Extract hashes for comparison
+          $verdictHash = Get-Content -Path ./TestResults/verdict_hash.txt -ErrorAction SilentlyContinue
+          $manifestHash = Get-Content -Path ./TestResults/manifest_hash.txt -ErrorAction SilentlyContinue
+          $envelopeHash = Get-Content -Path ./TestResults/envelope_hash.txt -ErrorAction SilentlyContinue
+          
+          "verdict_hash=$($verdictHash ?? 'NOT_FOUND')" >> $env:GITHUB_OUTPUT
+          "manifest_hash=$($manifestHash ?? 'NOT_FOUND')" >> $env:GITHUB_OUTPUT
+          "envelope_hash=$($envelopeHash ?? 'NOT_FOUND')" >> $env:GITHUB_OUTPUT
+
+      - name: Upload test results
+        uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: e2e-results-windows
+          path: ./TestResults/
+          retention-days: 14
+
+      - name: Upload hash artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: hashes-windows
+          path: |
+            ./TestResults/verdict_hash.txt
+            ./TestResults/manifest_hash.txt
+            ./TestResults/envelope_hash.txt
+          retention-days: 14
+
+  # =============================================================================
+  # Job: Run E2E tests on macOS (conditional)
+  # =============================================================================
+  reproducibility-macos:
+    name: E2E Reproducibility (macOS)
+    runs-on: macos-latest
+    if: github.event_name == 'schedule' || github.event.inputs.run_cross_platform == 'true'
+    outputs:
+      verdict_hash: ${{ steps.run-tests.outputs.verdict_hash }}
+      manifest_hash: ${{ steps.run-tests.outputs.manifest_hash }}
+      envelope_hash: ${{ steps.run-tests.outputs.envelope_hash }}
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Setup .NET
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: ${{ env.DOTNET_VERSION }}
+
+      - name: Restore dependencies
+        run: dotnet restore src/__Tests/Integration/StellaOps.Integration.E2E/StellaOps.Integration.E2E.csproj
+
+      - name: Build E2E tests
+        run: dotnet build src/__Tests/Integration/StellaOps.Integration.E2E/StellaOps.Integration.E2E.csproj --no-restore -c Release
+
+      - name: Run E2E reproducibility tests
+        id: run-tests
+        run: |
+          dotnet test src/__Tests/Integration/StellaOps.Integration.E2E/StellaOps.Integration.E2E.csproj \
+            --no-build \
+            -c Release \
+            --logger "trx;LogFileName=e2e-results.trx" \
+            --logger "console;verbosity=detailed" \
+            --results-directory ./TestResults
+
+          # Extract hashes for comparison
+          echo "verdict_hash=$(cat ./TestResults/verdict_hash.txt 2>/dev/null || echo 'NOT_FOUND')" >> $GITHUB_OUTPUT
+          echo "manifest_hash=$(cat ./TestResults/manifest_hash.txt 2>/dev/null || echo 'NOT_FOUND')" >> $GITHUB_OUTPUT
+          echo "envelope_hash=$(cat ./TestResults/envelope_hash.txt 2>/dev/null || echo 'NOT_FOUND')" >> $GITHUB_OUTPUT
+
+      - name: Upload test results
+        uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: e2e-results-macos
+          path: ./TestResults/
+          retention-days: 14
+
+      - name: Upload hash artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: hashes-macos
+          path: |
+            ./TestResults/verdict_hash.txt
+            ./TestResults/manifest_hash.txt
+            ./TestResults/envelope_hash.txt
+          retention-days: 14
+
+  # =============================================================================
+  # Job: Cross-platform hash comparison
+  # =============================================================================
+  cross-platform-compare:
+    name: Cross-Platform Hash Comparison
+    runs-on: ubuntu-latest
+    needs: [reproducibility-ubuntu, reproducibility-windows, reproducibility-macos]
+    if: always() && (github.event_name == 'schedule' || github.event.inputs.run_cross_platform == 'true')
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Download Ubuntu hashes
+        uses: actions/download-artifact@v4
+        with:
+          name: hashes-ubuntu
+          path: ./hashes/ubuntu
+
+      - name: Download Windows hashes
+        uses: actions/download-artifact@v4
+        with:
+          name: hashes-windows
+          path: ./hashes/windows
+        continue-on-error: true
+
+      - name: Download macOS hashes
+        uses: actions/download-artifact@v4
+        with:
+          name: hashes-macos
+          path: ./hashes/macos
+        continue-on-error: true
+
+      - name: Compare hashes across platforms
+        run: |
+          echo "=== Cross-Platform Hash Comparison ==="
+          echo ""
+          
+          ubuntu_verdict=$(cat ./hashes/ubuntu/verdict_hash.txt 2>/dev/null || echo "NOT_AVAILABLE")
+          windows_verdict=$(cat ./hashes/windows/verdict_hash.txt 2>/dev/null || echo "NOT_AVAILABLE")
+          macos_verdict=$(cat ./hashes/macos/verdict_hash.txt 2>/dev/null || echo "NOT_AVAILABLE")
+          
+          echo "Verdict Hashes:"
+          echo "  Ubuntu:  $ubuntu_verdict"
+          echo "  Windows: $windows_verdict"
+          echo "  macOS:   $macos_verdict"
+          echo ""
+          
+          ubuntu_manifest=$(cat ./hashes/ubuntu/manifest_hash.txt 2>/dev/null || echo "NOT_AVAILABLE")
+          windows_manifest=$(cat ./hashes/windows/manifest_hash.txt 2>/dev/null || echo "NOT_AVAILABLE")
+          macos_manifest=$(cat ./hashes/macos/manifest_hash.txt 2>/dev/null || echo "NOT_AVAILABLE")
+          
+          echo "Manifest Hashes:"
+          echo "  Ubuntu:  $ubuntu_manifest"
+          echo "  Windows: $windows_manifest"
+          echo "  macOS:   $macos_manifest"
+          echo ""
+          
+          # Check if all available hashes match
+          all_match=true
+          
+          if [ "$ubuntu_verdict" != "NOT_AVAILABLE" ] && [ "$windows_verdict" != "NOT_AVAILABLE" ]; then
+            if [ "$ubuntu_verdict" != "$windows_verdict" ]; then
+              echo "❌ FAIL: Ubuntu and Windows verdict hashes differ!"
+              all_match=false
+            fi
+          fi
+          
+          if [ "$ubuntu_verdict" != "NOT_AVAILABLE" ] && [ "$macos_verdict" != "NOT_AVAILABLE" ]; then
+            if [ "$ubuntu_verdict" != "$macos_verdict" ]; then
+              echo "❌ FAIL: Ubuntu and macOS verdict hashes differ!"
+              all_match=false
+            fi
+          fi
+          
+          if [ "$all_match" = true ]; then
+            echo "✅ All available platform hashes match!"
+          else
+            echo ""
+            echo "Cross-platform reproducibility verification FAILED."
+            exit 1
+          fi
+
+      - name: Create comparison report
+        run: |
+          cat > ./cross-platform-report.md << 'EOF'
+          # Cross-Platform Reproducibility Report
+          
+          ## Test Run Information
+          - **Workflow Run:** ${{ github.run_id }}
+          - **Trigger:** ${{ github.event_name }}
+          - **Commit:** ${{ github.sha }}
+          - **Branch:** ${{ github.ref_name }}
+          
+          ## Hash Comparison
+          
+          | Platform | Verdict Hash | Manifest Hash | Status |
+          |----------|--------------|---------------|--------|
+          | Ubuntu | ${{ needs.reproducibility-ubuntu.outputs.verdict_hash }} | ${{ needs.reproducibility-ubuntu.outputs.manifest_hash }} | ✅ |
+          | Windows | ${{ needs.reproducibility-windows.outputs.verdict_hash }} | ${{ needs.reproducibility-windows.outputs.manifest_hash }} | ${{ needs.reproducibility-windows.result == 'success' && '✅' || '⚠️' }} |
+          | macOS | ${{ needs.reproducibility-macos.outputs.verdict_hash }} | ${{ needs.reproducibility-macos.outputs.manifest_hash }} | ${{ needs.reproducibility-macos.result == 'success' && '✅' || '⚠️' }} |
+          
+          ## Conclusion
+          
+          Cross-platform reproducibility: **${{ job.status == 'success' && 'VERIFIED' || 'NEEDS REVIEW' }}**
+          EOF
+          
+          cat ./cross-platform-report.md
+
+      - name: Upload comparison report
+        uses: actions/upload-artifact@v4
+        with:
+          name: cross-platform-report
+          path: ./cross-platform-report.md
+          retention-days: 30
+
+  # =============================================================================
+  # Job: Golden baseline comparison
+  # =============================================================================
+  golden-baseline:
+    name: Golden Baseline Verification
+    runs-on: ubuntu-latest
+    needs: [reproducibility-ubuntu]
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Download current hashes
+        uses: actions/download-artifact@v4
+        with:
+          name: hashes-ubuntu
+          path: ./current
+
+      - name: Compare with golden baseline
+        run: |
+          echo "=== Golden Baseline Comparison ==="
+          
+          baseline_file="./src/__Tests/__Benchmarks/determinism/golden-baseline/e2e-hashes.json"
+          
+          if [ ! -f "$baseline_file" ]; then
+            echo "⚠️ Golden baseline not found. Skipping comparison."
+            echo "To create baseline, run with update_baseline=true"
+            exit 0
+          fi
+          
+          current_verdict=$(cat ./current/verdict_hash.txt 2>/dev/null || echo "NOT_FOUND")
+          baseline_verdict=$(jq -r '.verdict_hash' "$baseline_file" 2>/dev/null || echo "NOT_FOUND")
+          
+          echo "Current verdict hash:  $current_verdict"
+          echo "Baseline verdict hash: $baseline_verdict"
+          
+          if [ "$current_verdict" != "$baseline_verdict" ]; then
+            echo ""
+            echo "❌ FAIL: Current run does not match golden baseline!"
+            echo ""
+            echo "This may indicate:"
+            echo "  1. An intentional change requiring baseline update"
+            echo "  2. An unintentional regression in reproducibility"
+            echo ""
+            echo "To update baseline, run workflow with update_baseline=true"
+            exit 1
+          fi
+          
+          echo ""
+          echo "✅ Current run matches golden baseline!"
+
+      - name: Update golden baseline (if requested)
+        if: github.event.inputs.update_baseline == 'true'
+        run: |
+          mkdir -p ./src/__Tests/__Benchmarks/determinism/golden-baseline
+
+          cat > ./src/__Tests/__Benchmarks/determinism/golden-baseline/e2e-hashes.json << EOF
+          {
+            "verdict_hash": "$(cat ./current/verdict_hash.txt 2>/dev/null || echo 'NOT_SET')",
+            "manifest_hash": "$(cat ./current/manifest_hash.txt 2>/dev/null || echo 'NOT_SET')",
+            "envelope_hash": "$(cat ./current/envelope_hash.txt 2>/dev/null || echo 'NOT_SET')",
+            "updated_at": "$(date -u +%Y-%m-%dT%H:%M:%SZ)",
+            "updated_by": "${{ github.actor }}",
+            "commit": "${{ github.sha }}"
+          }
+          EOF
+          
+          echo "Golden baseline updated:"
+          cat ./src/__Tests/__Benchmarks/determinism/golden-baseline/e2e-hashes.json
+
+      - name: Commit baseline update
+        if: github.event.inputs.update_baseline == 'true'
+        uses: stefanzweifel/git-auto-commit-action@v5
+        with:
+          commit_message: "chore: Update E2E reproducibility golden baseline"
+          file_pattern: src/__Tests/__Benchmarks/determinism/golden-baseline/e2e-hashes.json
+
+  # =============================================================================
+  # Job: Status check gate
+  # =============================================================================
+  reproducibility-gate:
+    name: Reproducibility Gate
+    runs-on: ubuntu-latest
+    needs: [reproducibility-ubuntu, golden-baseline]
+    if: always()
+
+    steps:
+      - name: Check reproducibility status
+        run: |
+          ubuntu_status="${{ needs.reproducibility-ubuntu.result }}"
+          baseline_status="${{ needs.golden-baseline.result }}"
+          
+          echo "Ubuntu E2E tests: $ubuntu_status"
+          echo "Golden baseline:  $baseline_status"
+          
+          if [ "$ubuntu_status" != "success" ]; then
+            echo "❌ E2E reproducibility tests failed!"
+            exit 1
+          fi
+          
+          if [ "$baseline_status" == "failure" ]; then
+            echo "⚠️ Golden baseline comparison failed (may require review)"
+            # Don't fail the gate for baseline mismatch - it may be intentional
+          fi
+          
+          echo "✅ Reproducibility gate passed!"

.gitea/workflows/epss-ingest-perf.yml

@@ -0,0 +1,98 @@
+name: EPSS Ingest Perf
+
+# Sprint: SPRINT_3410_0001_0001_epss_ingestion_storage
+# Tasks: EPSS-3410-013B, EPSS-3410-014
+#
+# Runs the EPSS ingest perf harness against a Dockerized PostgreSQL instance (Testcontainers).
+#
+# Runner requirements:
+# - Linux runner with Docker Engine available to the runner user (Testcontainers).
+# - Label: `ubuntu-22.04` (adjust `runs-on` if your labels differ).
+# - >= 4 CPU / >= 8GB RAM recommended for stable baselines.
+
+on:
+  workflow_dispatch:
+    inputs:
+      rows:
+        description: 'Row count to generate (default: 310000)'
+        required: false
+        default: '310000'
+      postgres_image:
+        description: 'PostgreSQL image (default: postgres:16-alpine)'
+        required: false
+        default: 'postgres:16-alpine'
+  schedule:
+    # Nightly at 03:00 UTC
+    - cron: '0 3 * * *'
+  pull_request:
+    paths:
+      - 'src/Scanner/__Libraries/StellaOps.Scanner.Storage/**'
+      - 'src/Scanner/StellaOps.Scanner.Worker/**'
+      - 'src/Scanner/__Benchmarks/StellaOps.Scanner.Storage.Epss.Perf/**'
+      - '.gitea/workflows/epss-ingest-perf.yml'
+  push:
+    branches: [ main ]
+    paths:
+      - 'src/Scanner/__Libraries/StellaOps.Scanner.Storage/**'
+      - 'src/Scanner/StellaOps.Scanner.Worker/**'
+      - 'src/Scanner/__Benchmarks/StellaOps.Scanner.Storage.Epss.Perf/**'
+      - '.gitea/workflows/epss-ingest-perf.yml'
+
+jobs:
+  perf:
+    runs-on: ubuntu-22.04
+    env:
+      DOTNET_NOLOGO: 1
+      DOTNET_CLI_TELEMETRY_OPTOUT: 1
+      DOTNET_SYSTEM_GLOBALIZATION_INVARIANT: 1
+      TZ: UTC
+      STELLAOPS_OFFLINE: 'true'
+      STELLAOPS_DETERMINISTIC: 'true'
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup .NET 10
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: 10.0.100
+          include-prerelease: true
+
+      - name: Cache NuGet packages
+        uses: actions/cache@v4
+        with:
+          path: ~/.nuget/packages
+          key: ${{ runner.os }}-nuget-${{ hashFiles('**/*.csproj') }}
+          restore-keys: |
+            ${{ runner.os }}-nuget-
+
+      - name: Restore
+        run: |
+          dotnet restore src/Scanner/__Benchmarks/StellaOps.Scanner.Storage.Epss.Perf/StellaOps.Scanner.Storage.Epss.Perf.csproj \
+            --configfile nuget.config
+
+      - name: Build
+        run: |
+          dotnet build src/Scanner/__Benchmarks/StellaOps.Scanner.Storage.Epss.Perf/StellaOps.Scanner.Storage.Epss.Perf.csproj \
+            -c Release \
+            --no-restore
+
+      - name: Run perf harness
+        run: |
+          mkdir -p bench/results
+          dotnet run \
+            --project src/Scanner/__Benchmarks/StellaOps.Scanner.Storage.Epss.Perf/StellaOps.Scanner.Storage.Epss.Perf.csproj \
+            -c Release \
+            --no-build \
+            -- \
+            --rows ${{ inputs.rows || '310000' }} \
+            --postgres-image '${{ inputs.postgres_image || 'postgres:16-alpine' }}' \
+            --output bench/results/epss-ingest-perf-${{ github.sha }}.json
+
+      - name: Upload results
+        uses: actions/upload-artifact@v4
+        with:
+          name: epss-ingest-perf-${{ github.sha }}
+          path: |
+            bench/results/epss-ingest-perf-${{ github.sha }}.json
+          retention-days: 90

.gitea/workflows/evidence-locker.yml

@@ -0,0 +1,86 @@
+name: evidence-locker
+on:
+  workflow_dispatch:
+    inputs:
+      retention_target:
+        description: "Retention days target"
+        required: false
+        default: "180"
+
+jobs:
+  check-evidence-locker:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Task Pack offline bundle fixtures
+        run: python3 scripts/packs/run-fixtures-check.sh
+
+      - name: Emit retention summary
+        env:
+          RETENTION_TARGET: ${{ github.event.inputs.retention_target }}
+        run: |
+          echo "target_retention_days=${RETENTION_TARGET}" > out/evidence-locker/summary.txt
+
+      - name: Upload evidence locker summary
+        uses: actions/upload-artifact@v4
+        with:
+          name: evidence-locker
+          path: out/evidence-locker/**
+
+  push-zastava-evidence:
+    runs-on: ubuntu-latest
+    needs: check-evidence-locker
+    env:
+      STAGED_DIR: evidence-locker/zastava/2025-12-02
+      MODULE_ROOT: docs/modules/zastava
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Task Pack offline bundle fixtures
+        run: python3 scripts/packs/run-fixtures-check.sh
+
+      - name: Package staged Zastava artefacts
+        run: |
+          test -d "$MODULE_ROOT" || { echo "missing $MODULE_ROOT" >&2; exit 1; }
+          tmpdir=$(mktemp -d)
+          rsync -a --relative \
+            "$MODULE_ROOT/SHA256SUMS" \
+            "$MODULE_ROOT/schemas/" \
+            "$MODULE_ROOT/exports/" \
+            "$MODULE_ROOT/thresholds.yaml" \
+            "$MODULE_ROOT/thresholds.yaml.dsse" \
+            "$MODULE_ROOT/kit/verify.sh" \
+            "$MODULE_ROOT/kit/README.md" \
+            "$MODULE_ROOT/kit/ed25519.pub" \
+            "$MODULE_ROOT/kit/zastava-kit.tzst" \
+            "$MODULE_ROOT/kit/zastava-kit.tzst.dsse" \
+            "$MODULE_ROOT/evidence/README.md" \
+            "$tmpdir/"
+          (cd "$tmpdir/docs/modules/zastava" && sha256sum --check SHA256SUMS)
+          tar --sort=name --mtime="UTC 1970-01-01" --owner=0 --group=0 --numeric-owner \
+            -cf /tmp/zastava-evidence.tar -C "$tmpdir/docs/modules/zastava" .
+          sha256sum /tmp/zastava-evidence.tar
+
+      - name: Upload staged artefacts (fallback)
+        uses: actions/upload-artifact@v4
+        with:
+          name: zastava-evidence-locker-2025-12-02
+          path: /tmp/zastava-evidence.tar
+
+      - name: Push to Evidence Locker
+        if: ${{ secrets.CI_EVIDENCE_LOCKER_TOKEN != '' && env.EVIDENCE_LOCKER_URL != '' }}
+        env:
+          TOKEN: ${{ secrets.CI_EVIDENCE_LOCKER_TOKEN }}
+          URL: ${{ env.EVIDENCE_LOCKER_URL }}
+        run: |
+          curl -f -X PUT "$URL/zastava/2025-12-02/zastava-evidence.tar" \
+            -H "Authorization: Bearer $TOKEN" \
+            --data-binary @/tmp/zastava-evidence.tar
+
+      - name: Skip push (missing secret or URL)
+        if: ${{ secrets.CI_EVIDENCE_LOCKER_TOKEN == '' || env.EVIDENCE_LOCKER_URL == '' }}
+        run: |
+          echo "Locker push skipped: set CI_EVIDENCE_LOCKER_TOKEN and EVIDENCE_LOCKER_URL to enable." >&2

.gitea/workflows/export-ci.yml

@@ -0,0 +1,85 @@
+name: Export Center CI
+
+on:
+  push:
+    branches: [ main ]
+    paths:
+      - 'src/ExportCenter/**'
+      - 'ops/devops/export/**'
+      - '.gitea/workflows/export-ci.yml'
+      - 'docs/modules/devops/export-ci-contract.md'
+  pull_request:
+    branches: [ main, develop ]
+    paths:
+      - 'src/ExportCenter/**'
+      - 'ops/devops/export/**'
+      - '.gitea/workflows/export-ci.yml'
+      - 'docs/modules/devops/export-ci-contract.md'
+
+jobs:
+  export-ci:
+    runs-on: ubuntu-22.04
+    env:
+      DOTNET_VERSION: '10.0.100'
+      MINIO_ACCESS_KEY: exportci
+      MINIO_SECRET_KEY: exportci123
+      BUCKET: export-ci
+      ARTIFACT_DIR: ${{ github.workspace }}/.artifacts
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Task Pack offline bundle fixtures
+        run: python3 scripts/packs/run-fixtures-check.sh
+        with:
+          fetch-depth: 0
+
+      - name: Export OpenSSL 1.1 shim for Mongo2Go
+        run: scripts/enable-openssl11-shim.sh
+
+      - name: Set up .NET SDK
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: ${{ env.DOTNET_VERSION }}
+          include-prerelease: true
+
+      - name: Restore
+        run: dotnet restore src/ExportCenter/StellaOps.ExportCenter.WebService/StellaOps.ExportCenter.WebService.csproj
+
+      - name: Bring up MinIO
+        run: |
+          docker compose -f ops/devops/export/minio-compose.yml up -d
+          sleep 5
+          MINIO_ENDPOINT=http://localhost:9000 ops/devops/export/seed-minio.sh
+
+      - name: Build
+        run: dotnet build src/ExportCenter/StellaOps.ExportCenter.WebService/StellaOps.ExportCenter.WebService.csproj -c Release /p:ContinuousIntegrationBuild=true
+
+      - name: Test
+        run: |
+          mkdir -p $ARTIFACT_DIR
+          dotnet test src/ExportCenter/__Tests/StellaOps.ExportCenter.Tests/StellaOps.ExportCenter.Tests.csproj -c Release --logger "trx;LogFileName=export-tests.trx" --results-directory $ARTIFACT_DIR
+
+      - name: Trivy/OCI smoke
+        run: ops/devops/export/trivy-smoke.sh
+
+      - name: Schema lint
+        run: |
+          python -m json.tool docs/modules/export-center/schemas/export-profile.schema.json >/dev/null
+          python -m json.tool docs/modules/export-center/schemas/export-manifest.schema.json >/dev/null
+
+      - name: Offline kit verify (fixtures)
+        run: bash docs/modules/export-center/operations/verify-export-kit.sh src/ExportCenter/__fixtures/export-kit
+
+      - name: SBOM
+        run: syft dir:src/ExportCenter -o spdx-json=$ARTIFACT_DIR/exportcenter.spdx.json
+
+      - name: Upload artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: export-ci-artifacts
+          path: ${{ env.ARTIFACT_DIR }}
+
+      - name: Teardown MinIO
+        if: always()
+        run: docker compose -f ops/devops/export/minio-compose.yml down -v

.gitea/workflows/export-compat.yml

@@ -0,0 +1,41 @@
+name: export-compat
+on:
+  workflow_dispatch:
+    inputs:
+      image:
+        description: "Exporter image ref"
+        required: true
+        default: "ghcr.io/stella-ops/exporter:edge"
+
+jobs:
+  compat:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Task Pack offline bundle fixtures
+        run: python3 scripts/packs/run-fixtures-check.sh
+
+      - name: Setup Trivy
+        uses: aquasecurity/trivy-action@v0.24.0
+        with:
+          version: latest
+
+      - name: Setup Cosign
+        uses: sigstore/cosign-installer@v3.6.0
+
+      - name: Run compatibility checks
+        env:
+          IMAGE: ${{ github.event.inputs.image }}
+        run: |
+          chmod +x scripts/export/trivy-compat.sh
+          chmod +x scripts/export/oci-verify.sh
+          scripts/export/trivy-compat.sh
+          scripts/export/oci-verify.sh
+
+      - name: Upload reports
+        uses: actions/upload-artifact@v4
+        with:
+          name: export-compat
+          path: out/export-compat/**

.gitea/workflows/exporter-ci.yml

@@ -0,0 +1,46 @@
+name: exporter-ci
+
+on:
+  workflow_dispatch:
+  pull_request:
+    paths:
+      - 'src/ExportCenter/**'
+      - '.gitea/workflows/exporter-ci.yml'
+
+env:
+  DOTNET_CLI_TELEMETRY_OPTOUT: 1
+  DOTNET_NOLOGO: 1
+
+jobs:
+  build-test:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup .NET
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: '10.0.x'
+
+      - name: Restore
+        run: dotnet restore src/ExportCenter/StellaOps.ExportCenter.WebService/StellaOps.ExportCenter.WebService.csproj
+
+      - name: Build
+        run: dotnet build src/ExportCenter/StellaOps.ExportCenter.WebService/StellaOps.ExportCenter.WebService.csproj --configuration Release --no-restore
+
+      - name: Test
+        run: dotnet test src/ExportCenter/__Tests/StellaOps.ExportCenter.Tests/StellaOps.ExportCenter.Tests.csproj --configuration Release --no-build --verbosity normal
+
+      - name: Publish
+        run: |
+          dotnet publish src/ExportCenter/StellaOps.ExportCenter.WebService/StellaOps.ExportCenter.WebService.csproj \
+            --configuration Release \
+            --output artifacts/exporter
+
+      - name: Upload artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: exporter-${{ github.run_id }}
+          path: artifacts/
+          retention-days: 14

.gitea/workflows/findings-ledger-ci.yml

@@ -0,0 +1,325 @@
+# .gitea/workflows/findings-ledger-ci.yml
+# Findings Ledger CI with RLS migration validation (DEVOPS-LEDGER-TEN-48-001-REL)
+
+name: Findings Ledger CI
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - 'src/Findings/**'
+      - '.gitea/workflows/findings-ledger-ci.yml'
+      - 'deploy/releases/2025.09-stable.yaml'
+      - 'deploy/releases/2025.09-airgap.yaml'
+      - 'deploy/downloads/manifest.json'
+      - 'ops/devops/release/check_release_manifest.py'
+  pull_request:
+    branches: [main, develop]
+    paths:
+      - 'src/Findings/**'
+      - '.gitea/workflows/findings-ledger-ci.yml'
+
+env:
+  DOTNET_VERSION: '10.0.100'
+  POSTGRES_IMAGE: postgres:16-alpine
+  BUILD_CONFIGURATION: Release
+
+jobs:
+  build-test:
+    runs-on: ubuntu-22.04
+    env:
+      TEST_RESULTS_DIR: ${{ github.workspace }}/artifacts/test-results
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Setup .NET ${{ env.DOTNET_VERSION }}
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: ${{ env.DOTNET_VERSION }}
+          include-prerelease: true
+
+      - name: Restore dependencies
+        run: |
+          dotnet restore src/Findings/StellaOps.Findings.Ledger/StellaOps.Findings.Ledger.csproj
+          dotnet restore src/Findings/__Tests/StellaOps.Findings.Ledger.Tests/StellaOps.Findings.Ledger.Tests.csproj
+
+      - name: Build
+        run: |
+          dotnet build src/Findings/StellaOps.Findings.Ledger/StellaOps.Findings.Ledger.csproj \
+            -c ${{ env.BUILD_CONFIGURATION }} \
+            /p:ContinuousIntegrationBuild=true
+
+      - name: Run unit tests
+        run: |
+          mkdir -p $TEST_RESULTS_DIR
+          dotnet test src/Findings/__Tests/StellaOps.Findings.Ledger.Tests/StellaOps.Findings.Ledger.Tests.csproj \
+            -c ${{ env.BUILD_CONFIGURATION }} \
+            --logger "trx;LogFileName=ledger-tests.trx" \
+            --results-directory $TEST_RESULTS_DIR
+
+      - name: Upload test results
+        uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: ledger-test-results
+          path: ${{ env.TEST_RESULTS_DIR }}
+
+  migration-validation:
+    runs-on: ubuntu-22.04
+    services:
+      postgres:
+        image: postgres:16-alpine
+        env:
+          POSTGRES_USER: ledgertest
+          POSTGRES_PASSWORD: ledgertest
+          POSTGRES_DB: ledger_test
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+    env:
+      PGHOST: localhost
+      PGPORT: 5432
+      PGUSER: ledgertest
+      PGPASSWORD: ledgertest
+      PGDATABASE: ledger_test
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Setup .NET ${{ env.DOTNET_VERSION }}
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: ${{ env.DOTNET_VERSION }}
+          include-prerelease: true
+
+      - name: Install PostgreSQL client
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y postgresql-client
+
+      - name: Wait for PostgreSQL
+        run: |
+          until pg_isready -h $PGHOST -p $PGPORT -U $PGUSER; do
+            echo "Waiting for PostgreSQL..."
+            sleep 2
+          done
+
+      - name: Apply prerequisite migrations (001-006)
+        run: |
+          set -euo pipefail
+          MIGRATION_DIR="src/Findings/StellaOps.Findings.Ledger/migrations"
+          for migration in 001_initial.sql 002_add_evidence_bundle_ref.sql 002_projection_offsets.sql \
+                           003_policy_rationale.sql 004_ledger_attestations.sql 004_risk_fields.sql \
+                           005_risk_fields.sql 006_orchestrator_airgap.sql; do
+            if [ -f "$MIGRATION_DIR/$migration" ]; then
+              echo "Applying migration: $migration"
+              psql -h $PGHOST -p $PGPORT -U $PGUSER -d $PGDATABASE -f "$MIGRATION_DIR/$migration"
+            fi
+          done
+
+      - name: Apply RLS migration (007_enable_rls.sql)
+        run: |
+          set -euo pipefail
+          echo "Applying RLS migration..."
+          psql -h $PGHOST -p $PGPORT -U $PGUSER -d $PGDATABASE \
+            -f src/Findings/StellaOps.Findings.Ledger/migrations/007_enable_rls.sql
+
+      - name: Validate RLS configuration
+        run: |
+          set -euo pipefail
+          echo "Validating RLS is enabled on all protected tables..."
+
+          # Check RLS enabled
+          TABLES_WITH_RLS=$(psql -h $PGHOST -p $PGPORT -U $PGUSER -d $PGDATABASE -t -A -c "
+            SELECT COUNT(*)
+            FROM pg_class c
+            JOIN pg_namespace n ON c.relnamespace = n.oid
+            WHERE n.nspname = 'public'
+              AND c.relrowsecurity = true
+              AND c.relname IN (
+                'ledger_events', 'ledger_merkle_roots', 'findings_projection',
+                'finding_history', 'triage_actions', 'ledger_attestations',
+                'orchestrator_exports', 'airgap_imports'
+              );
+          ")
+
+          if [ "$TABLES_WITH_RLS" -ne 8 ]; then
+            echo "::error::Expected 8 tables with RLS enabled, found $TABLES_WITH_RLS"
+            exit 1
+          fi
+          echo "✓ All 8 tables have RLS enabled"
+
+          # Check policies exist
+          POLICIES=$(psql -h $PGHOST -p $PGPORT -U $PGUSER -d $PGDATABASE -t -A -c "
+            SELECT COUNT(DISTINCT tablename)
+            FROM pg_policies
+            WHERE schemaname = 'public'
+              AND policyname LIKE '%_tenant_isolation';
+          ")
+
+          if [ "$POLICIES" -ne 8 ]; then
+            echo "::error::Expected 8 tenant isolation policies, found $POLICIES"
+            exit 1
+          fi
+          echo "✓ All 8 tenant isolation policies created"
+
+          # Check tenant function exists
+          FUNC_EXISTS=$(psql -h $PGHOST -p $PGPORT -U $PGUSER -d $PGDATABASE -t -A -c "
+            SELECT COUNT(*)
+            FROM pg_proc p
+            JOIN pg_namespace n ON p.pronamespace = n.oid
+            WHERE p.proname = 'require_current_tenant'
+              AND n.nspname = 'findings_ledger_app';
+          ")
+
+          if [ "$FUNC_EXISTS" -ne 1 ]; then
+            echo "::error::Tenant function 'require_current_tenant' not found"
+            exit 1
+          fi
+          echo "✓ Tenant function 'findings_ledger_app.require_current_tenant()' exists"
+
+          echo ""
+          echo "=== RLS Migration Validation PASSED ==="
+
+      - name: Test rollback migration
+        run: |
+          set -euo pipefail
+          echo "Testing rollback migration..."
+          psql -h $PGHOST -p $PGPORT -U $PGUSER -d $PGDATABASE \
+            -f src/Findings/StellaOps.Findings.Ledger/migrations/007_enable_rls_rollback.sql
+
+          # Verify RLS is disabled
+          TABLES_WITH_RLS=$(psql -h $PGHOST -p $PGPORT -U $PGUSER -d $PGDATABASE -t -A -c "
+            SELECT COUNT(*)
+            FROM pg_class c
+            JOIN pg_namespace n ON c.relnamespace = n.oid
+            WHERE n.nspname = 'public'
+              AND c.relrowsecurity = true
+              AND c.relname IN (
+                'ledger_events', 'ledger_merkle_roots', 'findings_projection',
+                'finding_history', 'triage_actions', 'ledger_attestations',
+                'orchestrator_exports', 'airgap_imports'
+              );
+          ")
+
+          if [ "$TABLES_WITH_RLS" -ne 0 ]; then
+            echo "::error::Rollback failed - $TABLES_WITH_RLS tables still have RLS enabled"
+            exit 1
+          fi
+          echo "✓ Rollback successful - RLS disabled on all tables"
+      - name: Validate release manifests (production)
+        run: |
+          set -euo pipefail
+          python ops/devops/release/check_release_manifest.py
+
+      - name: Re-apply RLS migration (idempotency check)
+        run: |
+          set -euo pipefail
+          echo "Re-applying RLS migration to verify idempotency..."
+          psql -h $PGHOST -p $PGPORT -U $PGUSER -d $PGDATABASE \
+            -f src/Findings/StellaOps.Findings.Ledger/migrations/007_enable_rls.sql
+          echo "✓ Migration is idempotent"
+
+  generate-manifest:
+    runs-on: ubuntu-22.04
+    needs: [build-test, migration-validation]
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Generate migration manifest
+        run: |
+          set -euo pipefail
+          MIGRATION_FILE="src/Findings/StellaOps.Findings.Ledger/migrations/007_enable_rls.sql"
+          ROLLBACK_FILE="src/Findings/StellaOps.Findings.Ledger/migrations/007_enable_rls_rollback.sql"
+          MANIFEST_DIR="out/findings-ledger/migrations"
+          mkdir -p "$MANIFEST_DIR"
+
+          # Compute SHA256 hashes
+          MIGRATION_SHA=$(sha256sum "$MIGRATION_FILE" | awk '{print $1}')
+          ROLLBACK_SHA=$(sha256sum "$ROLLBACK_FILE" | awk '{print $1}')
+          CREATED_AT=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
+
+          cat > "$MANIFEST_DIR/007_enable_rls.manifest.json" <<EOF
+          {
+            "\$schema": "https://stella-ops.org/schemas/migration-manifest.v1.json",
+            "schemaVersion": "1.0.0",
+            "migrationId": "007_enable_rls",
+            "module": "findings-ledger",
+            "version": "2025.12.0",
+            "createdAt": "$CREATED_AT",
+            "description": "Enable Row-Level Security for Findings Ledger tenant isolation",
+            "taskId": "LEDGER-TEN-48-001-DEV",
+            "contractRef": "CONTRACT-FINDINGS-LEDGER-RLS-011",
+            "database": {
+              "engine": "postgresql",
+              "minVersion": "16.0"
+            },
+            "files": {
+              "apply": {
+                "path": "007_enable_rls.sql",
+                "sha256": "$MIGRATION_SHA"
+              },
+              "rollback": {
+                "path": "007_enable_rls_rollback.sql",
+                "sha256": "$ROLLBACK_SHA"
+              }
+            },
+            "affects": {
+              "tables": [
+                "ledger_events",
+                "ledger_merkle_roots",
+                "findings_projection",
+                "finding_history",
+                "triage_actions",
+                "ledger_attestations",
+                "orchestrator_exports",
+                "airgap_imports"
+              ],
+              "schemas": ["public", "findings_ledger_app"],
+              "roles": ["findings_ledger_admin"]
+            },
+            "prerequisites": [
+              "006_orchestrator_airgap"
+            ],
+            "validation": {
+              "type": "rls-check",
+              "expectedTables": 8,
+              "expectedPolicies": 8,
+              "tenantFunction": "findings_ledger_app.require_current_tenant"
+            },
+            "offlineKit": {
+              "includedInBundle": true,
+              "requiresManualApply": true,
+              "applyOrder": 7
+            }
+          }
+          EOF
+
+          echo "Generated migration manifest at $MANIFEST_DIR/007_enable_rls.manifest.json"
+          cat "$MANIFEST_DIR/007_enable_rls.manifest.json"
+
+      - name: Copy migration files for offline-kit
+        run: |
+          set -euo pipefail
+          OFFLINE_DIR="out/findings-ledger/offline-kit/migrations"
+          mkdir -p "$OFFLINE_DIR"
+          cp src/Findings/StellaOps.Findings.Ledger/migrations/007_enable_rls.sql "$OFFLINE_DIR/"
+          cp src/Findings/StellaOps.Findings.Ledger/migrations/007_enable_rls_rollback.sql "$OFFLINE_DIR/"
+          cp out/findings-ledger/migrations/007_enable_rls.manifest.json "$OFFLINE_DIR/"
+          echo "Offline-kit migration files prepared"
+          ls -la "$OFFLINE_DIR"
+
+      - name: Upload migration artefacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: findings-ledger-migrations
+          path: out/findings-ledger/
+          if-no-files-found: error

.gitea/workflows/graph-load.yml

@@ -0,0 +1,42 @@
+name: graph-load
+on:
+  workflow_dispatch:
+    inputs:
+      target:
+        description: "Graph API base URL"
+        required: true
+        default: "http://localhost:5000"
+      users:
+        description: "Virtual users"
+        required: false
+        default: "8"
+      duration:
+        description: "Duration seconds"
+        required: false
+        default: "60"
+
+jobs:
+  load-test:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Task Pack offline bundle fixtures
+        run: python3 scripts/packs/run-fixtures-check.sh
+
+      - name: Install k6
+        run: |
+          sudo apt-get update -qq
+          sudo apt-get install -y k6
+
+      - name: Run graph load test
+        run: |
+          chmod +x scripts/graph/load-test.sh
+          TARGET="${{ github.event.inputs.target }}" USERS="${{ github.event.inputs.users }}" DURATION="${{ github.event.inputs.duration }}" scripts/graph/load-test.sh
+
+      - name: Upload results
+        uses: actions/upload-artifact@v4
+        with:
+          name: graph-load-summary
+          path: out/graph-load/**

.gitea/workflows/graph-ui-sim.yml

@@ -0,0 +1,57 @@
+name: graph-ui-sim
+on:
+  workflow_dispatch:
+    inputs:
+      graph_api:
+        description: "Graph API base URL"
+        required: true
+        default: "http://localhost:5000"
+      graph_ui:
+        description: "Graph UI base URL"
+        required: true
+        default: "http://localhost:4200"
+      perf_budget_ms:
+        description: "Perf budget in ms"
+        required: false
+        default: "3000"
+
+jobs:
+  ui-and-sim:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Task Pack offline bundle fixtures
+        run: python3 scripts/packs/run-fixtures-check.sh
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: "18"
+
+      - name: Install Playwright deps
+        run: npx playwright install --with-deps chromium
+
+      - name: Run UI perf probe
+        env:
+          GRAPH_UI_BASE: ${{ github.event.inputs.graph_ui }}
+          GRAPH_UI_BUDGET_MS: ${{ github.event.inputs.perf_budget_ms }}
+          OUT: out/graph-ui-perf
+        run: |
+          npx ts-node scripts/graph/ui-perf.ts
+
+      - name: Run simulation smoke
+        env:
+          TARGET: ${{ github.event.inputs.graph_api }}
+        run: |
+          chmod +x scripts/graph/simulation-smoke.sh
+          scripts/graph/simulation-smoke.sh
+
+      - name: Upload artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: graph-ui-sim
+          path: |
+            out/graph-ui-perf/**
+            out/graph-sim/**

.gitea/workflows/icscisa-kisa-refresh.yml

@@ -0,0 +1,68 @@
+name: ICS/KISA Feed Refresh
+
+on:
+  schedule:
+    - cron: '0 2 * * MON'
+  workflow_dispatch:
+    inputs:
+      live_fetch:
+        description: 'Attempt live RSS fetch (fallback to samples on failure)'
+        required: false
+        default: true
+        type: boolean
+      offline_snapshot:
+        description: 'Force offline samples only (no network)'
+        required: false
+        default: false
+        type: boolean
+
+jobs:
+  refresh:
+    runs-on: ubuntu-22.04
+    permissions:
+      contents: read
+    env:
+      ICSCISA_FEED_URL: ${{ secrets.ICSCISA_FEED_URL }}
+      KISA_FEED_URL: ${{ secrets.KISA_FEED_URL }}
+      FEED_GATEWAY_HOST: concelier-webservice
+      FEED_GATEWAY_SCHEME: http
+      LIVE_FETCH: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.live_fetch || 'true' }}
+      OFFLINE_SNAPSHOT: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.offline_snapshot || 'false' }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Set run metadata
+        id: meta
+        run: |
+          RUN_DATE=$(date -u +%Y%m%d)
+          RUN_ID="icscisa-kisa-$(date -u +%Y%m%dT%H%M%SZ)"
+          echo "run_date=$RUN_DATE" >> $GITHUB_OUTPUT
+          echo "run_id=$RUN_ID" >> $GITHUB_OUTPUT
+          echo "RUN_DATE=$RUN_DATE" >> $GITHUB_ENV
+          echo "RUN_ID=$RUN_ID" >> $GITHUB_ENV
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.11'
+
+      - name: Run ICS/KISA refresh
+        run: |
+          python scripts/feeds/run_icscisa_kisa_refresh.py \
+            --out-dir out/feeds/icscisa-kisa \
+            --run-date "${{ steps.meta.outputs.run_date }}" \
+            --run-id "${{ steps.meta.outputs.run_id }}"
+
+      - name: Show fetch log
+        run: cat out/feeds/icscisa-kisa/${{ steps.meta.outputs.run_date }}/fetch.log
+
+      - name: Upload refresh artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: icscisa-kisa-${{ steps.meta.outputs.run_date }}
+          path: out/feeds/icscisa-kisa/${{ steps.meta.outputs.run_date }}
+          if-no-files-found: error
+          retention-days: 21

.gitea/workflows/integration-tests-gate.yml

@@ -0,0 +1,375 @@
+# Sprint 3500.0004.0003 - T6: Integration Tests CI Gate
+# Runs integration tests on PR and gates merges on failures
+
+name: integration-tests-gate
+
+on:
+  pull_request:
+    branches: [main, develop]
+    paths:
+      - 'src/**'
+      - 'src/__Tests/Integration/**'
+      - 'src/__Tests/__Benchmarks/golden-corpus/**'
+  push:
+    branches: [main]
+  workflow_dispatch:
+    inputs:
+      run_performance:
+        description: 'Run performance baseline tests'
+        type: boolean
+        default: false
+      run_airgap:
+        description: 'Run air-gap tests'
+        type: boolean
+        default: false
+
+concurrency:
+  group: integration-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  # ==========================================================================
+  # T6-AC1: Integration tests run on PR
+  # ==========================================================================
+  integration-tests:
+    name: Integration Tests
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    services:
+      postgres:
+        image: postgres:16-alpine
+        env:
+          POSTGRES_USER: stellaops
+          POSTGRES_PASSWORD: test-only
+          POSTGRES_DB: stellaops_test
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup .NET
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: "10.0.100"
+
+      - name: Restore dependencies
+        run: dotnet restore src/__Tests/Integration/**/*.csproj
+
+      - name: Build integration tests
+        run: dotnet build src/__Tests/Integration/**/*.csproj --configuration Release --no-restore
+
+      - name: Run Proof Chain Tests
+        run: |
+          dotnet test src/__Tests/Integration/StellaOps.Integration.ProofChain \
+            --configuration Release \
+            --no-build \
+            --logger "trx;LogFileName=proofchain.trx" \
+            --results-directory ./TestResults
+        env:
+          ConnectionStrings__StellaOps: "Host=localhost;Database=stellaops_test;Username=stellaops;Password=test-only"
+
+      - name: Run Reachability Tests
+        run: |
+          dotnet test src/__Tests/Integration/StellaOps.Integration.Reachability \
+            --configuration Release \
+            --no-build \
+            --logger "trx;LogFileName=reachability.trx" \
+            --results-directory ./TestResults
+
+      - name: Run Unknowns Workflow Tests
+        run: |
+          dotnet test src/__Tests/Integration/StellaOps.Integration.Unknowns \
+            --configuration Release \
+            --no-build \
+            --logger "trx;LogFileName=unknowns.trx" \
+            --results-directory ./TestResults
+
+      - name: Run Determinism Tests
+        run: |
+          dotnet test src/__Tests/Integration/StellaOps.Integration.Determinism \
+            --configuration Release \
+            --no-build \
+            --logger "trx;LogFileName=determinism.trx" \
+            --results-directory ./TestResults
+
+      - name: Upload test results
+        uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: integration-test-results
+          path: TestResults/**/*.trx
+
+      - name: Publish test summary
+        uses: dorny/test-reporter@v1
+        if: always()
+        with:
+          name: Integration Test Results
+          path: TestResults/**/*.trx
+          reporter: dotnet-trx
+
+  # ==========================================================================
+  # T6-AC2: Corpus validation on release branch
+  # ==========================================================================
+  corpus-validation:
+    name: Golden Corpus Validation
+    runs-on: ubuntu-latest
+    if: github.ref == 'refs/heads/main' || github.event_name == 'workflow_dispatch'
+    timeout-minutes: 15
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup .NET
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: "10.0.100"
+
+      - name: Validate corpus manifest
+        run: |
+          python3 -c "
+          import json
+          import hashlib
+          import os
+
+          manifest_path = 'src/__Tests/__Benchmarks/golden-corpus/corpus-manifest.json'
+          with open(manifest_path) as f:
+              manifest = json.load(f)
+
+          print(f'Corpus version: {manifest.get(\"corpus_version\", \"unknown\")}')
+          print(f'Total cases: {manifest.get(\"total_cases\", 0)}')
+
+          errors = []
+          for case in manifest.get('cases', []):
+              case_path = os.path.join('src/__Tests/__Benchmarks/golden-corpus', case['path'])
+              if not os.path.isdir(case_path):
+                  errors.append(f'Missing case directory: {case_path}')
+              else:
+                  required_files = ['case.json', 'expected-score.json']
+                  for f in required_files:
+                      if not os.path.exists(os.path.join(case_path, f)):
+                          errors.append(f'Missing file: {case_path}/{f}')
+
+          if errors:
+              print('\\nValidation errors:')
+              for e in errors:
+                  print(f'  - {e}')
+              exit(1)
+          else:
+              print('\\nCorpus validation passed!')
+          "
+
+      - name: Run corpus scoring tests
+        run: |
+          dotnet test src/__Tests/Integration/StellaOps.Integration.Determinism \
+            --filter "Category=GoldenCorpus" \
+            --configuration Release \
+            --logger "trx;LogFileName=corpus.trx" \
+            --results-directory ./TestResults
+
+  # ==========================================================================
+  # T6-AC3: Determinism tests on nightly
+  # ==========================================================================
+  nightly-determinism:
+    name: Nightly Determinism Check
+    runs-on: ubuntu-latest
+    if: github.event_name == 'schedule' || (github.event_name == 'workflow_dispatch' && github.event.inputs.run_performance == 'true')
+    timeout-minutes: 45
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup .NET
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: "10.0.100"
+
+      - name: Run full determinism suite
+        run: |
+          dotnet test src/__Tests/Integration/StellaOps.Integration.Determinism \
+            --configuration Release \
+            --logger "trx;LogFileName=determinism-full.trx" \
+            --results-directory ./TestResults
+
+      - name: Run cross-run determinism check
+        run: |
+          # Run scoring 3 times and compare hashes
+          for i in 1 2 3; do
+            dotnet test src/__Tests/Integration/StellaOps.Integration.Determinism \
+              --filter "FullyQualifiedName~IdenticalInput_ProducesIdenticalHash" \
+              --results-directory ./TestResults/run-$i
+          done
+
+          # Compare all results
+          echo "Comparing determinism across runs..."
+
+      - name: Upload determinism results
+        uses: actions/upload-artifact@v4
+        with:
+          name: nightly-determinism-results
+          path: TestResults/**
+
+  # ==========================================================================
+  # T6-AC4: Test coverage reported to dashboard
+  # ==========================================================================
+  coverage-report:
+    name: Coverage Report
+    runs-on: ubuntu-latest
+    needs: [integration-tests]
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup .NET
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: "10.0.100"
+
+      - name: Run tests with coverage
+        run: |
+          dotnet test src/__Tests/Integration/**/*.csproj \
+            --configuration Release \
+            --collect:"XPlat Code Coverage" \
+            --results-directory ./TestResults/Coverage
+
+      - name: Generate coverage report
+        uses: danielpalme/ReportGenerator-GitHub-Action@5.2.0
+        with:
+          reports: TestResults/Coverage/**/coverage.cobertura.xml
+          targetdir: TestResults/CoverageReport
+          reporttypes: 'Html;Cobertura;MarkdownSummary'
+
+      - name: Upload coverage report
+        uses: actions/upload-artifact@v4
+        with:
+          name: coverage-report
+          path: TestResults/CoverageReport/**
+
+      - name: Add coverage to PR comment
+        uses: marocchino/sticky-pull-request-comment@v2
+        if: github.event_name == 'pull_request'
+        with:
+          recreate: true
+          path: TestResults/CoverageReport/Summary.md
+
+  # ==========================================================================
+  # T6-AC5: Flaky test quarantine process
+  # ==========================================================================
+  flaky-test-check:
+    name: Flaky Test Detection
+    runs-on: ubuntu-latest
+    needs: [integration-tests]
+    if: failure()
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Check for known flaky tests
+        run: |
+          # Check if failure is from a known flaky test
+          QUARANTINE_FILE=".github/flaky-tests-quarantine.json"
+          if [ -f "$QUARANTINE_FILE" ]; then
+            echo "Checking against quarantine list..."
+            # Implementation would compare failed tests against quarantine
+          fi
+
+      - name: Create flaky test issue
+        uses: actions/github-script@v7
+        if: always()
+        with:
+          script: |
+            // After 2 consecutive failures, create issue for quarantine review
+            console.log('Checking for flaky test patterns...');
+            // Implementation would analyze test history
+
+  # ==========================================================================
+  # Performance Tests (optional, on demand)
+  # ==========================================================================
+  performance-tests:
+    name: Performance Baseline Tests
+    runs-on: ubuntu-latest
+    if: github.event_name == 'workflow_dispatch' && github.event.inputs.run_performance == 'true'
+    timeout-minutes: 30
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup .NET
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: "10.0.100"
+
+      - name: Run performance tests
+        run: |
+          dotnet test src/__Tests/Integration/StellaOps.Integration.Performance \
+            --configuration Release \
+            --logger "trx;LogFileName=performance.trx" \
+            --results-directory ./TestResults
+
+      - name: Upload performance report
+        uses: actions/upload-artifact@v4
+        with:
+          name: performance-report
+          path: |
+            TestResults/**
+            src/__Tests/Integration/StellaOps.Integration.Performance/output/**
+
+      - name: Check for regressions
+        run: |
+          # Check if any test exceeded 20% threshold
+          if [ -f "src/__Tests/Integration/StellaOps.Integration.Performance/output/performance-report.json" ]; then
+            python3 -c "
+          import json
+          with open('src/__Tests/Integration/StellaOps.Integration.Performance/output/performance-report.json') as f:
+              report = json.load(f)
+          regressions = [m for m in report.get('Metrics', []) if m.get('DeltaPercent', 0) > 20]
+          if regressions:
+              print('Performance regressions detected!')
+              for r in regressions:
+                  print(f'  {r[\"Name\"]}: +{r[\"DeltaPercent\"]:.1f}%')
+              exit(1)
+          print('No performance regressions detected.')
+          "
+          fi
+
+  # ==========================================================================
+  # Air-Gap Tests (optional, on demand)
+  # ==========================================================================
+  airgap-tests:
+    name: Air-Gap Integration Tests
+    runs-on: ubuntu-latest
+    if: github.event_name == 'workflow_dispatch' && github.event.inputs.run_airgap == 'true'
+    timeout-minutes: 30
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup .NET
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: "10.0.100"
+
+      - name: Run air-gap tests
+        run: |
+          dotnet test src/__Tests/Integration/StellaOps.Integration.AirGap \
+            --configuration Release \
+            --logger "trx;LogFileName=airgap.trx" \
+            --results-directory ./TestResults
+
+      - name: Upload air-gap test results
+        uses: actions/upload-artifact@v4
+        with:
+          name: airgap-test-results
+          path: TestResults/**

.gitea/workflows/interop-e2e.yml

@@ -0,0 +1,128 @@
+name: Interop E2E Tests
+
+on:
+  pull_request:
+    paths:
+      - 'src/Scanner/**'
+      - 'src/Excititor/**'
+      - 'src/__Tests/interop/**'
+  schedule:
+    - cron: '0 6 * * *'  # Nightly at 6 AM UTC
+  workflow_dispatch:
+
+env:
+  DOTNET_VERSION: '10.0.100'
+
+jobs:
+  interop-tests:
+    runs-on: ubuntu-22.04
+    strategy:
+      fail-fast: false
+      matrix:
+        format: [cyclonedx, spdx]
+        arch: [amd64]
+        include:
+          - format: cyclonedx
+            format_flag: cyclonedx-json
+          - format: spdx
+            format_flag: spdx-json
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Install Syft
+        run: |
+          curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s -- -b /usr/local/bin
+          syft --version
+
+      - name: Install Grype
+        run: |
+          curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh -s -- -b /usr/local/bin
+          grype --version
+
+      - name: Install cosign
+        run: |
+          curl -sSfL https://github.com/sigstore/cosign/releases/latest/download/cosign-linux-amd64 -o /usr/local/bin/cosign
+          chmod +x /usr/local/bin/cosign
+          cosign version
+
+      - name: Setup .NET
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: ${{ env.DOTNET_VERSION }}
+
+      - name: Restore dependencies
+        run: dotnet restore src/StellaOps.sln
+
+      - name: Build Stella CLI
+        run: dotnet build src/Cli/StellaOps.Cli/StellaOps.Cli.csproj -c Release
+
+      - name: Build interop tests
+        run: dotnet build src/__Tests/interop/StellaOps.Interop.Tests/StellaOps.Interop.Tests.csproj
+
+      - name: Run interop tests
+        run: |
+          dotnet test src/__Tests/interop/StellaOps.Interop.Tests \
+            --filter "Format=${{ matrix.format }}" \
+            --logger "trx;LogFileName=interop-${{ matrix.format }}.trx" \
+            --logger "console;verbosity=detailed" \
+            --results-directory ./results \
+            -- RunConfiguration.TestSessionTimeout=900000
+
+      - name: Generate parity report
+        if: always()
+        run: |
+          # TODO: Generate parity report from test results
+          echo '{"format": "${{ matrix.format }}", "parityPercent": 0}' > ./results/parity-report-${{ matrix.format }}.json
+
+      - name: Upload test results
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: interop-test-results-${{ matrix.format }}
+          path: ./results/
+
+      - name: Check parity threshold
+        if: always()
+        run: |
+          PARITY=$(jq '.parityPercent' ./results/parity-report-${{ matrix.format }}.json 2>/dev/null || echo "0")
+          echo "Parity for ${{ matrix.format }}: ${PARITY}%"
+
+          if (( $(echo "$PARITY < 95" | bc -l 2>/dev/null || echo "1") )); then
+            echo "::warning::Findings parity ${PARITY}% is below 95% threshold for ${{ matrix.format }}"
+            # Don't fail the build yet - this is initial implementation
+            # exit 1
+          fi
+
+  summary:
+    runs-on: ubuntu-22.04
+    needs: interop-tests
+    if: always()
+
+    steps:
+      - name: Download all artifacts
+        uses: actions/download-artifact@v4
+        with:
+          path: ./all-results
+
+      - name: Generate summary
+        run: |
+          echo "## Interop Test Summary" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "| Format | Status |" >> $GITHUB_STEP_SUMMARY
+          echo "|--------|--------|" >> $GITHUB_STEP_SUMMARY
+
+          for format in cyclonedx spdx; do
+            if [ -f "./all-results/interop-test-results-${format}/parity-report-${format}.json" ]; then
+              PARITY=$(jq -r '.parityPercent // 0' "./all-results/interop-test-results-${format}/parity-report-${format}.json")
+              if (( $(echo "$PARITY >= 95" | bc -l 2>/dev/null || echo "0") )); then
+                STATUS="✅ Pass (${PARITY}%)"
+              else
+                STATUS="⚠️  Below threshold (${PARITY}%)"
+              fi
+            else
+              STATUS="❌ No results"
+            fi
+            echo "| ${format} | ${STATUS} |" >> $GITHUB_STEP_SUMMARY
+          done

.gitea/workflows/ledger-oas-ci.yml

@@ -0,0 +1,81 @@
+name: Ledger OpenAPI CI
+
+on:
+  workflow_dispatch:
+  push:
+    branches: [main]
+    paths:
+      - 'api/ledger/**'
+      - 'ops/devops/ledger/**'
+  pull_request:
+    paths:
+      - 'api/ledger/**'
+
+jobs:
+  validate-oas:
+    runs-on: ubuntu-22.04
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+
+      - name: Install tools
+        run: |
+          npm install -g @stoplight/spectral-cli
+          npm install -g @openapitools/openapi-generator-cli
+
+      - name: Validate OpenAPI spec
+        run: |
+          chmod +x ops/devops/ledger/validate-oas.sh
+          ops/devops/ledger/validate-oas.sh
+
+      - name: Upload validation report
+        uses: actions/upload-artifact@v4
+        with:
+          name: ledger-oas-validation-${{ github.run_number }}
+          path: |
+            out/ledger/oas/lint-report.json
+            out/ledger/oas/validation-report.txt
+            out/ledger/oas/spec-summary.json
+          if-no-files-found: warn
+
+  check-wellknown:
+    runs-on: ubuntu-22.04
+    needs: validate-oas
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Check .well-known/openapi structure
+        run: |
+          # Validate .well-known structure if exists
+          if [ -d ".well-known" ]; then
+            echo "Checking .well-known/openapi..."
+            if [ -f ".well-known/openapi.json" ]; then
+              python3 -c "import json; json.load(open('.well-known/openapi.json'))"
+              echo ".well-known/openapi.json is valid JSON"
+            fi
+          else
+            echo "[info] .well-known directory not present (OK for dev)"
+          fi
+
+  deprecation-check:
+    runs-on: ubuntu-22.04
+    needs: validate-oas
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Check deprecation policy
+        run: |
+          if [ -f "ops/devops/ledger/deprecation-policy.yaml" ]; then
+            echo "Validating deprecation policy..."
+            python3 -c "import yaml; yaml.safe_load(open('ops/devops/ledger/deprecation-policy.yaml'))"
+            echo "Deprecation policy is valid"
+          else
+            echo "[info] No deprecation policy yet (OK for initial setup)"
+          fi

.gitea/workflows/ledger-packs-ci.yml

@@ -0,0 +1,101 @@
+name: Ledger Packs CI
+
+on:
+  workflow_dispatch:
+    inputs:
+      snapshot_id:
+        description: 'Snapshot ID (leave empty for auto)'
+        required: false
+        default: ''
+      sign:
+        description: 'Sign pack (1=yes)'
+        required: false
+        default: '0'
+  push:
+    branches: [main]
+    paths:
+      - 'ops/devops/ledger/**'
+
+jobs:
+  build-pack:
+    runs-on: ubuntu-22.04
+    env:
+      COSIGN_PRIVATE_KEY_B64: ${{ secrets.COSIGN_PRIVATE_KEY_B64 }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup cosign
+        uses: sigstore/cosign-installer@v3
+
+      - name: Configure signing
+        run: |
+          if [ -z "${COSIGN_PRIVATE_KEY_B64}" ] || [ "${{ github.event.inputs.sign }}" = "1" ]; then
+            echo "COSIGN_ALLOW_DEV_KEY=1" >> $GITHUB_ENV
+            echo "COSIGN_PASSWORD=stellaops-dev" >> $GITHUB_ENV
+          fi
+
+      - name: Build pack
+        run: |
+          chmod +x ops/devops/ledger/build-pack.sh
+          SNAPSHOT_ID="${{ github.event.inputs.snapshot_id }}"
+          if [ -z "$SNAPSHOT_ID" ]; then
+            SNAPSHOT_ID="ci-$(date +%Y%m%d%H%M%S)"
+          fi
+
+          SIGN_FLAG=""
+          if [ "${{ github.event.inputs.sign }}" = "1" ] || [ -n "${COSIGN_PRIVATE_KEY_B64}" ]; then
+            SIGN_FLAG="--sign"
+          fi
+
+          SNAPSHOT_ID="$SNAPSHOT_ID" ops/devops/ledger/build-pack.sh $SIGN_FLAG
+
+      - name: Verify checksums
+        run: |
+          cd out/ledger/packs
+          for f in *.SHA256SUMS; do
+            if [ -f "$f" ]; then
+              sha256sum -c "$f"
+            fi
+          done
+
+      - name: Upload pack
+        uses: actions/upload-artifact@v4
+        with:
+          name: ledger-pack-${{ github.run_number }}
+          path: |
+            out/ledger/packs/*.pack.tar.gz
+            out/ledger/packs/*.SHA256SUMS
+            out/ledger/packs/*.dsse.json
+          if-no-files-found: warn
+          retention-days: 30
+
+  verify-pack:
+    runs-on: ubuntu-22.04
+    needs: build-pack
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Download pack
+        uses: actions/download-artifact@v4
+        with:
+          name: ledger-pack-${{ github.run_number }}
+          path: out/ledger/packs/
+
+      - name: Verify pack structure
+        run: |
+          cd out/ledger/packs
+          for pack in *.pack.tar.gz; do
+            if [ -f "$pack" ]; then
+              echo "Verifying $pack..."
+              tar -tzf "$pack" | head -20
+
+              # Extract and check manifest
+              tar -xzf "$pack" -C /tmp manifest.json 2>/dev/null || true
+              if [ -f /tmp/manifest.json ]; then
+                python3 -c "import json; json.load(open('/tmp/manifest.json'))"
+                echo "Pack manifest is valid JSON"
+              fi
+            fi
+          done

.gitea/workflows/lighthouse-ci.yml

@@ -0,0 +1,188 @@
+# .gitea/workflows/lighthouse-ci.yml
+# Lighthouse CI for performance and accessibility testing of the StellaOps Web UI
+
+name: Lighthouse CI
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - 'src/Web/StellaOps.Web/**'
+      - '.gitea/workflows/lighthouse-ci.yml'
+  pull_request:
+    branches: [main, develop]
+    paths:
+      - 'src/Web/StellaOps.Web/**'
+  schedule:
+    # Run weekly on Sunday at 2 AM UTC
+    - cron: '0 2 * * 0'
+  workflow_dispatch:
+
+env:
+  NODE_VERSION: '20'
+  LHCI_BUILD_CONTEXT__CURRENT_BRANCH: ${{ github.head_ref || github.ref_name }}
+  LHCI_BUILD_CONTEXT__COMMIT_SHA: ${{ github.sha }}
+
+jobs:
+  lighthouse:
+    name: Lighthouse Audit
+    runs-on: ubuntu-22.04
+    defaults:
+      run:
+        working-directory: src/Web/StellaOps.Web
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+          cache: 'npm'
+          cache-dependency-path: src/Web/StellaOps.Web/package-lock.json
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Build production bundle
+        run: npm run build -- --configuration production
+
+      - name: Install Lighthouse CI
+        run: npm install -g @lhci/cli@0.13.x
+
+      - name: Run Lighthouse CI
+        run: |
+          lhci autorun \
+            --collect.staticDistDir=./dist/stella-ops-web/browser \
+            --collect.numberOfRuns=3 \
+            --assert.preset=lighthouse:recommended \
+            --assert.assertions.categories:performance=off \
+            --assert.assertions.categories:accessibility=off \
+            --upload.target=filesystem \
+            --upload.outputDir=./lighthouse-results
+
+      - name: Evaluate Lighthouse Results
+        id: lhci-results
+        run: |
+          # Parse the latest Lighthouse report
+          REPORT=$(ls -t lighthouse-results/*.json | head -1)
+
+          if [ -f "$REPORT" ]; then
+            PERF=$(jq '.categories.performance.score * 100' "$REPORT" | cut -d. -f1)
+            A11Y=$(jq '.categories.accessibility.score * 100' "$REPORT" | cut -d. -f1)
+            BP=$(jq '.categories["best-practices"].score * 100' "$REPORT" | cut -d. -f1)
+            SEO=$(jq '.categories.seo.score * 100' "$REPORT" | cut -d. -f1)
+
+            echo "performance=$PERF" >> $GITHUB_OUTPUT
+            echo "accessibility=$A11Y" >> $GITHUB_OUTPUT
+            echo "best-practices=$BP" >> $GITHUB_OUTPUT
+            echo "seo=$SEO" >> $GITHUB_OUTPUT
+
+            echo "## Lighthouse Results" >> $GITHUB_STEP_SUMMARY
+            echo "" >> $GITHUB_STEP_SUMMARY
+            echo "| Category | Score | Threshold | Status |" >> $GITHUB_STEP_SUMMARY
+            echo "|----------|-------|-----------|--------|" >> $GITHUB_STEP_SUMMARY
+
+            # Performance: target >= 90
+            if [ "$PERF" -ge 90 ]; then
+              echo "| Performance | $PERF | >= 90 | :white_check_mark: |" >> $GITHUB_STEP_SUMMARY
+            else
+              echo "| Performance | $PERF | >= 90 | :warning: |" >> $GITHUB_STEP_SUMMARY
+            fi
+
+            # Accessibility: target >= 95
+            if [ "$A11Y" -ge 95 ]; then
+              echo "| Accessibility | $A11Y | >= 95 | :white_check_mark: |" >> $GITHUB_STEP_SUMMARY
+            else
+              echo "| Accessibility | $A11Y | >= 95 | :x: |" >> $GITHUB_STEP_SUMMARY
+            fi
+
+            # Best Practices: target >= 90
+            if [ "$BP" -ge 90 ]; then
+              echo "| Best Practices | $BP | >= 90 | :white_check_mark: |" >> $GITHUB_STEP_SUMMARY
+            else
+              echo "| Best Practices | $BP | >= 90 | :warning: |" >> $GITHUB_STEP_SUMMARY
+            fi
+
+            # SEO: target >= 90
+            if [ "$SEO" -ge 90 ]; then
+              echo "| SEO | $SEO | >= 90 | :white_check_mark: |" >> $GITHUB_STEP_SUMMARY
+            else
+              echo "| SEO | $SEO | >= 90 | :warning: |" >> $GITHUB_STEP_SUMMARY
+            fi
+          fi
+
+      - name: Check Quality Gates
+        run: |
+          PERF=${{ steps.lhci-results.outputs.performance }}
+          A11Y=${{ steps.lhci-results.outputs.accessibility }}
+
+          FAILED=0
+
+          # Performance gate (warning only, not blocking)
+          if [ "$PERF" -lt 90 ]; then
+            echo "::warning::Performance score ($PERF) is below target (90)"
+          fi
+
+          # Accessibility gate (blocking)
+          if [ "$A11Y" -lt 95 ]; then
+            echo "::error::Accessibility score ($A11Y) is below required threshold (95)"
+            FAILED=1
+          fi
+
+          if [ "$FAILED" -eq 1 ]; then
+            exit 1
+          fi
+
+      - name: Upload Lighthouse Reports
+        uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: lighthouse-reports
+          path: src/Web/StellaOps.Web/lighthouse-results/
+          retention-days: 30
+
+  axe-accessibility:
+    name: Axe Accessibility Audit
+    runs-on: ubuntu-22.04
+    defaults:
+      run:
+        working-directory: src/Web/StellaOps.Web
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+          cache: 'npm'
+          cache-dependency-path: src/Web/StellaOps.Web/package-lock.json
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Install Playwright browsers
+        run: npx playwright install --with-deps chromium
+
+      - name: Build production bundle
+        run: npm run build -- --configuration production
+
+      - name: Start preview server
+        run: |
+          npx serve -s dist/stella-ops-web/browser -l 4200 &
+          sleep 5
+
+      - name: Run Axe accessibility tests
+        run: |
+          npm run test:a11y || true
+
+      - name: Upload Axe results
+        uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: axe-accessibility-results
+          path: src/Web/StellaOps.Web/test-results/
+          retention-days: 30

.gitea/workflows/lnm-backfill.yml

@@ -0,0 +1,64 @@
+name: LNM Backfill CI
+
+on:
+  workflow_dispatch:
+    inputs:
+      mongo_uri:
+        description: 'Staging Mongo URI (read-only snapshot)'
+        required: true
+        type: string
+      since_commit:
+        description: 'Git commit to compare (default HEAD)'
+        required: false
+        type: string
+      dry_run:
+        description: 'Dry run (no writes)'
+        required: false
+        default: true
+        type: boolean
+
+jobs:
+  lnm-backfill:
+    runs-on: ubuntu-22.04
+    env:
+      DOTNET_VERSION: '10.0.100'
+      ARTIFACT_DIR: ${{ github.workspace }}/.artifacts
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Task Pack offline bundle fixtures
+        run: python3 scripts/packs/run-fixtures-check.sh
+        with:
+          fetch-depth: 0
+
+      - name: Set up .NET SDK
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: ${{ env.DOTNET_VERSION }}
+          include-prerelease: true
+
+      - name: Restore
+        run: dotnet restore src/Concelier/StellaOps.Concelier.Backfill/StellaOps.Concelier.Backfill.csproj
+
+      - name: Run backfill (dry-run supported)
+        env:
+          STAGING_MONGO_URI: ${{ inputs.mongo_uri }}
+        run: |
+          mkdir -p $ARTIFACT_DIR
+          EXTRA=()
+          if [ "${{ inputs.dry_run }}" = "true" ]; then EXTRA+=("--dry-run"); fi
+          dotnet run --project src/Concelier/StellaOps.Concelier.Backfill/StellaOps.Concelier.Backfill.csproj -- --mode=observations --batch-size=500 --max-conflicts=0 --mongo "$STAGING_MONGO_URI" "${EXTRA[@]}" | tee $ARTIFACT_DIR/backfill-observations.log
+          dotnet run --project src/Concelier/StellaOps.Concelier.Backfill/StellaOps.Concelier.Backfill.csproj -- --mode=linksets --batch-size=500 --max-conflicts=0 --mongo "$STAGING_MONGO_URI" "${EXTRA[@]}" | tee $ARTIFACT_DIR/backfill-linksets.log
+
+      - name: Validate counts
+        env:
+          STAGING_MONGO_URI: ${{ inputs.mongo_uri }}
+        run: |
+          STAGING_MONGO_URI="$STAGING_MONGO_URI" ops/devops/lnm/backfill-validation.sh
+
+      - name: Upload artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: lnm-backfill-artifacts
+          path: ${{ env.ARTIFACT_DIR }}

.gitea/workflows/lnm-migration-ci.yml

@@ -0,0 +1,83 @@
+name: LNM Migration CI
+
+on:
+  workflow_dispatch:
+    inputs:
+      run_staging:
+        description: 'Run staging backfill (1=yes)'
+        required: false
+        default: '0'
+  push:
+    branches: [main]
+    paths:
+      - 'src/Concelier/__Libraries/StellaOps.Concelier.Migrations/**'
+      - 'ops/devops/lnm/**'
+
+jobs:
+  build-runner:
+    runs-on: ubuntu-22.04
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup .NET
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: 10.0.100
+          include-prerelease: true
+
+      - name: Setup cosign
+        uses: sigstore/cosign-installer@v3
+
+      - name: Configure signing
+        run: |
+          if [ -z "${{ secrets.COSIGN_PRIVATE_KEY_B64 }}" ]; then
+            echo "COSIGN_ALLOW_DEV_KEY=1" >> $GITHUB_ENV
+            echo "COSIGN_PASSWORD=stellaops-dev" >> $GITHUB_ENV
+          fi
+        env:
+          COSIGN_PRIVATE_KEY_B64: ${{ secrets.COSIGN_PRIVATE_KEY_B64 }}
+
+      - name: Build and package runner
+        run: |
+          chmod +x ops/devops/lnm/package-runner.sh
+          ops/devops/lnm/package-runner.sh
+
+      - name: Verify checksums
+        run: |
+          cd out/lnm
+          sha256sum -c SHA256SUMS
+
+      - name: Upload artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: lnm-migration-runner-${{ github.run_number }}
+          path: |
+            out/lnm/lnm-migration-runner.tar.gz
+            out/lnm/lnm-migration-runner.manifest.json
+            out/lnm/lnm-migration-runner.dsse.json
+            out/lnm/SHA256SUMS
+          if-no-files-found: warn
+
+  validate-metrics:
+    runs-on: ubuntu-22.04
+    needs: build-runner
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Validate monitoring config
+        run: |
+          # Validate alert rules syntax
+          if [ -f "ops/devops/lnm/alerts/lnm-alerts.yaml" ]; then
+            echo "Validating alert rules..."
+            python3 -c "import yaml; yaml.safe_load(open('ops/devops/lnm/alerts/lnm-alerts.yaml'))"
+          fi
+
+          # Validate dashboard JSON
+          if [ -f "ops/devops/lnm/dashboards/lnm-migration.json" ]; then
+            echo "Validating dashboard..."
+            python3 -c "import json; json.load(open('ops/devops/lnm/dashboards/lnm-migration.json'))"
+          fi
+
+          echo "Monitoring config validation complete"

.gitea/workflows/lnm-vex-backfill.yml

@@ -0,0 +1,63 @@
+name: LNM VEX Backfill
+
+on:
+  workflow_dispatch:
+    inputs:
+      mongo_uri:
+        description: 'Staging Mongo URI'
+        required: true
+        type: string
+      nats_url:
+        description: 'NATS URL'
+        required: true
+        type: string
+      redis_url:
+        description: 'Redis URL'
+        required: true
+        type: string
+      dry_run:
+        description: 'Dry run (no writes)'
+        required: false
+        default: true
+        type: boolean
+
+jobs:
+  vex-backfill:
+    runs-on: ubuntu-22.04
+    env:
+      DOTNET_VERSION: '10.0.100'
+      ARTIFACT_DIR: ${{ github.workspace }}/.artifacts
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Task Pack offline bundle fixtures
+        run: python3 scripts/packs/run-fixtures-check.sh
+        with:
+          fetch-depth: 0
+
+      - name: Set up .NET SDK
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: ${{ env.DOTNET_VERSION }}
+          include-prerelease: true
+
+      - name: Restore
+        run: dotnet restore src/Concelier/StellaOps.Concelier.Backfill/StellaOps.Concelier.Backfill.csproj
+
+      - name: Run VEX backfill
+        env:
+          STAGING_MONGO_URI: ${{ inputs.mongo_uri }}
+          NATS_URL: ${{ inputs.nats_url }}
+          REDIS_URL: ${{ inputs.redis_url }}
+        run: |
+          mkdir -p $ARTIFACT_DIR
+          EXTRA=()
+          if [ "${{ inputs.dry_run }}" = "true" ]; then EXTRA+=("--dry-run"); fi
+          dotnet run --project src/Concelier/StellaOps.Concelier.Backfill/StellaOps.Concelier.Backfill.csproj -- --mode=vex --batch-size=500 --max-conflicts=0 --mongo "$STAGING_MONGO_URI" --nats "$NATS_URL" --redis "$REDIS_URL" "${EXTRA[@]}" | tee $ARTIFACT_DIR/vex-backfill.log
+
+      - name: Upload artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: lnm-vex-backfill-artifacts
+          path: ${{ env.ARTIFACT_DIR }}

.gitea/workflows/manifest-integrity.yml

@@ -0,0 +1,125 @@
+name: Manifest Integrity
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - 'docs/**/*.schema.json'
+      - 'docs/contracts/**'
+      - 'docs/schemas/**'
+      - 'scripts/packs/**'
+  pull_request:
+    paths:
+      - 'docs/**/*.schema.json'
+      - 'docs/contracts/**'
+      - 'docs/schemas/**'
+      - 'scripts/packs/**'
+
+jobs:
+  validate-schemas:
+    name: Validate Schema Integrity
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+
+      - name: Install dependencies
+        run: npm install -g ajv-cli ajv-formats
+
+      - name: Validate JSON schemas
+        run: |
+          EXIT_CODE=0
+          for schema in docs/schemas/*.schema.json; do
+            echo "Validating $schema..."
+            if ! ajv compile -s "$schema" --spec=draft2020 2>/dev/null; then
+              echo "Error: $schema is invalid"
+              EXIT_CODE=1
+            fi
+          done
+          exit $EXIT_CODE
+
+  validate-contracts:
+    name: Validate Contract Documents
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Check contract structure
+        run: |
+          for contract in docs/contracts/*.md; do
+            echo "Checking $contract..."
+            # Verify required sections exist
+            if ! grep -q "^## " "$contract"; then
+              echo "Warning: $contract missing section headers"
+            fi
+            # Check for decision ID
+            if grep -q "Decision ID" "$contract" && ! grep -q "DECISION-\|CONTRACT-" "$contract"; then
+              echo "Warning: $contract missing decision ID format"
+            fi
+          done
+
+  validate-pack-fixtures:
+    name: Validate Pack Fixtures
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+
+      - name: Install dependencies
+        run: pip install jsonschema
+
+      - name: Run fixture validation
+        run: |
+          if [ -f scripts/packs/run-fixtures-check.sh ]; then
+            chmod +x scripts/packs/run-fixtures-check.sh
+            ./scripts/packs/run-fixtures-check.sh
+          fi
+
+  checksum-audit:
+    name: Audit SHA256SUMS Files
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Validate checksums
+        run: |
+          find . -name "SHA256SUMS" -type f | while read f; do
+            dir=$(dirname "$f")
+            echo "Validating checksums in $dir..."
+            cd "$dir"
+            # Check if all referenced files exist
+            while read hash file; do
+              if [ ! -f "$file" ]; then
+                echo "Warning: $file referenced in SHA256SUMS but not found"
+              fi
+            done < SHA256SUMS
+            cd - > /dev/null
+          done
+
+  merkle-consistency:
+    name: Verify Merkle Roots
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Check DSSE Merkle roots
+        run: |
+          find . -name "*.dsse.json" -type f | while read f; do
+            echo "Checking Merkle root in $f..."
+            # Extract and validate Merkle root if present
+            if jq -e '.payload' "$f" > /dev/null 2>&1; then
+              PAYLOAD=$(jq -r '.payload' "$f" | base64 -d 2>/dev/null || echo "")
+              if echo "$PAYLOAD" | jq -e '._stellaops.merkleRoot' > /dev/null 2>&1; then
+                MERKLE=$(echo "$PAYLOAD" | jq -r '._stellaops.merkleRoot')
+                echo "  Merkle root: $MERKLE"
+              fi
+            fi
+          done

.gitea/workflows/mirror-sign.yml

@@ -0,0 +1,74 @@
+name: Mirror Thin Bundle Sign & Verify
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: '0 6 * * *'
+
+jobs:
+  mirror-sign:
+    runs-on: ubuntu-22.04
+    env:
+      MIRROR_SIGN_KEY_B64: ${{ secrets.MIRROR_SIGN_KEY_B64 }}
+      REQUIRE_PROD_SIGNING: 1
+      OCI: 1
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Fallback to dev signing key when secret is absent (non-prod only)
+        run: |
+          if [ -z "${MIRROR_SIGN_KEY_B64}" ]; then
+            echo "[warn] MIRROR_SIGN_KEY_B64 not set; using repo dev key for non-production signing."
+            echo "MIRROR_SIGN_KEY_B64=$(base64 -w0 tools/cosign/cosign.dev.key)" >> $GITHUB_ENV
+            echo "REQUIRE_PROD_SIGNING=0" >> $GITHUB_ENV
+          fi
+
+      - name: Setup .NET
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: 10.0.100
+          include-prerelease: true
+
+      - name: Task Pack offline bundle fixtures
+        run: python3 scripts/packs/run-fixtures-check.sh
+
+      - name: Verify signing prerequisites
+        run: scripts/mirror/check_signing_prereqs.sh
+
+      - name: Run mirror signing
+        run: |
+          scripts/mirror/ci-sign.sh
+
+      - name: Verify signed bundle
+        run: |
+          scripts/mirror/verify_thin_bundle.py out/mirror/thin/mirror-thin-v1.tar.gz
+
+      - name: Prepare Export Center handoff (metadata + optional schedule)
+        run: |
+          scripts/mirror/export-center-wire.sh
+        env:
+          EXPORT_CENTER_BASE_URL: ${{ secrets.EXPORT_CENTER_BASE_URL }}
+          EXPORT_CENTER_TOKEN: ${{ secrets.EXPORT_CENTER_TOKEN }}
+          EXPORT_CENTER_TENANT: ${{ secrets.EXPORT_CENTER_TENANT }}
+          EXPORT_CENTER_PROJECT: ${{ secrets.EXPORT_CENTER_PROJECT }}
+          EXPORT_CENTER_AUTO_SCHEDULE: ${{ secrets.EXPORT_CENTER_AUTO_SCHEDULE }}
+
+      - name: Upload signed artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: mirror-thin-v1-signed
+          path: |
+            out/mirror/thin/mirror-thin-v1.tar.gz
+            out/mirror/thin/mirror-thin-v1.manifest.json
+            out/mirror/thin/mirror-thin-v1.manifest.dsse.json
+            out/mirror/thin/tuf/
+            out/mirror/thin/oci/
+            out/mirror/thin/milestone.json
+            out/mirror/thin/export-center/export-center-handoff.json
+            out/mirror/thin/export-center/export-center-targets.json
+            out/mirror/thin/export-center/schedule-response.json
+          if-no-files-found: error
+          retention-days: 14

.gitea/workflows/mock-dev-release.yml

@@ -0,0 +1,44 @@
+name: mock-dev-release
+
+on:
+  push:
+    paths:
+      - deploy/releases/2025.09-mock-dev.yaml
+      - deploy/downloads/manifest.json
+      - ops/devops/mock-release/**
+  workflow_dispatch:
+
+jobs:
+  package-mock-release:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Package mock dev artefacts
+        run: |
+          set -euo pipefail
+          mkdir -p out/mock-release
+          cp deploy/releases/2025.09-mock-dev.yaml out/mock-release/
+          cp deploy/downloads/manifest.json out/mock-release/
+          tar -czf out/mock-release/mock-dev-release.tgz -C out/mock-release .
+
+      - name: Compose config (dev + mock overlay)
+        run: |
+          set -euo pipefail
+          ops/devops/mock-release/config_check.sh
+
+      - name: Helm template (mock overlay)
+        run: |
+          set -euo pipefail
+          helm template mock ./deploy/helm/stellaops -f deploy/helm/stellaops/values-mock.yaml > /tmp/helm-mock.yaml
+          ls -lh /tmp/helm-mock.yaml
+
+      - name: Upload mock release bundle
+        uses: actions/upload-artifact@v3
+        with:
+          name: mock-dev-release
+          path: |
+            out/mock-release/mock-dev-release.tgz
+            /tmp/compose-mock-config.yaml
+            /tmp/helm-mock.yaml

.gitea/workflows/notify-smoke-test.yml

@@ -0,0 +1,102 @@
+name: Notify Smoke Test
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - 'src/Notify/**'
+      - 'src/Notifier/**'
+  pull_request:
+    paths:
+      - 'src/Notify/**'
+      - 'src/Notifier/**'
+  workflow_dispatch:
+
+env:
+  DOTNET_VERSION: '10.0.x'
+
+jobs:
+  unit-tests:
+    name: Notify Unit Tests
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup .NET
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: ${{ env.DOTNET_VERSION }}
+
+      - name: Restore dependencies
+        run: dotnet restore src/Notify/
+
+      - name: Build
+        run: dotnet build src/Notify/ --no-restore
+
+      - name: Run tests
+        run: dotnet test src/Notify/ --no-build --verbosity normal
+
+  notifier-tests:
+    name: Notifier Service Tests
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup .NET
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: ${{ env.DOTNET_VERSION }}
+
+      - name: Restore dependencies
+        run: dotnet restore src/Notifier/
+
+      - name: Build
+        run: dotnet build src/Notifier/ --no-restore
+
+      - name: Run tests
+        run: dotnet test src/Notifier/ --no-build --verbosity normal
+
+  smoke-test:
+    name: Notification Smoke Test
+    runs-on: ubuntu-latest
+    needs: [unit-tests, notifier-tests]
+    services:
+      mongodb:
+        image: mongo:7.0
+        ports:
+          - 27017:27017
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup .NET
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: ${{ env.DOTNET_VERSION }}
+
+      - name: Build Notifier
+        run: dotnet build src/Notifier/StellaOps.Notifier/StellaOps.Notifier.WebService/
+
+      - name: Start service
+        run: |
+          dotnet run --project src/Notifier/StellaOps.Notifier/StellaOps.Notifier.WebService/ &
+          sleep 10
+
+      - name: Health check
+        run: |
+          for i in {1..30}; do
+            if curl -s http://localhost:5000/health > /dev/null; then
+              echo "Service is healthy"
+              exit 0
+            fi
+            sleep 1
+          done
+          echo "Service failed to start"
+          exit 1
+
+      - name: Test notification endpoint
+        run: |
+          # Test dry-run notification
+          curl -X POST http://localhost:5000/api/v1/notifications/test \
+            -H "Content-Type: application/json" \
+            -d '{"channel": "log", "message": "Smoke test", "dryRun": true}' \
+            || echo "Warning: Notification test endpoint not available"

.gitea/workflows/oas-ci.yml

@@ -0,0 +1,59 @@
+name: oas-ci
+on:
+  push:
+    paths:
+      - "src/Api/**"
+      - "scripts/api-*.mjs"
+      - "package.json"
+      - "package-lock.json"
+  pull_request:
+    paths:
+      - "src/Api/**"
+      - "scripts/api-*.mjs"
+      - "package.json"
+      - "package-lock.json"
+
+jobs:
+  oas-validate:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Task Pack offline bundle fixtures
+        run: python3 scripts/packs/run-fixtures-check.sh
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: "18"
+
+      - name: Install deps
+        run: npm install --ignore-scripts --no-progress
+
+      - name: Compose aggregate OpenAPI
+        run: npm run api:compose
+
+      - name: Lint (spectral)
+        run: npm run api:lint
+
+      - name: Validate examples coverage
+        run: npm run api:examples
+
+      - name: Compat diff (previous commit)
+        run: |
+          set -e
+          if git show HEAD~1:src/Api/StellaOps.Api.OpenApi/stella.yaml > /tmp/stella-prev.yaml 2>/dev/null; then
+            node scripts/api-compat-diff.mjs /tmp/stella-prev.yaml src/Api/StellaOps.Api.OpenApi/stella.yaml --output text --fail-on-breaking
+          else
+            echo "[oas-ci] previous stella.yaml not found; skipping"
+          fi
+
+      - name: Contract tests
+        run: npm run api:compat:test
+
+      - name: Upload aggregate spec
+        uses: actions/upload-artifact@v4
+        with:
+          name: stella-openapi
+          path: src/Api/StellaOps.Api.OpenApi/stella.yaml

.gitea/workflows/obs-slo.yml

@@ -0,0 +1,46 @@
+name: obs-slo
+on:
+  workflow_dispatch:
+    inputs:
+      prom_url:
+        description: "Prometheus base URL"
+        required: true
+        default: "http://localhost:9090"
+
+jobs:
+  slo-eval:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Task Pack offline bundle fixtures
+        run: python3 scripts/packs/run-fixtures-check.sh
+
+      - name: Setup Python (telemetry schema checks)
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+
+      - name: Install telemetry schema deps
+        run: python -m pip install --upgrade pip jsonschema
+
+      - name: Run SLO evaluator
+        env:
+          PROM_URL: ${{ github.event.inputs.prom_url }}
+        run: |
+          chmod +x scripts/observability/slo-evaluator.sh
+          scripts/observability/slo-evaluator.sh
+
+      - name: Telemetry schema/bundle checks
+        env:
+          TELEMETRY_BUNDLE_SCHEMA: docs/modules/telemetry/schemas/telemetry-bundle.schema.json
+        run: |
+          chmod +x ops/devops/telemetry/tests/ci-run.sh
+          ops/devops/telemetry/tests/ci-run.sh
+
+      - name: Upload SLO results
+        uses: actions/upload-artifact@v4
+        with:
+          name: obs-slo
+          path: out/obs-slo/**

.gitea/workflows/obs-stream.yml

@@ -0,0 +1,37 @@
+name: obs-stream
+on:
+  workflow_dispatch:
+    inputs:
+      nats_url:
+        description: "NATS server URL"
+        required: false
+        default: "nats://localhost:4222"
+
+jobs:
+  stream-validate:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Task Pack offline bundle fixtures
+        run: python3 scripts/packs/run-fixtures-check.sh
+
+      - name: Install nats CLI
+        run: |
+          curl -sSL https://github.com/nats-io/natscli/releases/download/v0.1.4/nats-0.1.4-linux-amd64.tar.gz -o /tmp/natscli.tgz
+          tar -C /tmp -xzf /tmp/natscli.tgz
+          sudo mv /tmp/nats /usr/local/bin/nats
+
+      - name: Validate streaming knobs
+        env:
+          NATS_URL: ${{ github.event.inputs.nats_url }}
+        run: |
+          chmod +x scripts/observability/streaming-validate.sh
+          scripts/observability/streaming-validate.sh
+
+      - name: Upload stream validation
+        uses: actions/upload-artifact@v4
+        with:
+          name: obs-stream
+          path: out/obs-stream/**

.gitea/workflows/offline-e2e.yml

@@ -0,0 +1,121 @@
+name: Offline E2E Tests
+
+on:
+  pull_request:
+    paths:
+      - 'src/AirGap/**'
+      - 'src/Scanner/**'
+      - 'src/__Tests/offline/**'
+  schedule:
+    - cron: '0 4 * * *'  # Nightly at 4 AM UTC
+  workflow_dispatch:
+
+env:
+  STELLAOPS_OFFLINE_MODE: 'true'
+  DOTNET_VERSION: '10.0.100'
+
+jobs:
+  offline-e2e:
+    runs-on: ubuntu-22.04
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup .NET
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: ${{ env.DOTNET_VERSION }}
+
+      - name: Cache NuGet packages
+        uses: actions/cache@v3
+        with:
+          path: ~/.nuget/packages
+          key: ${{ runner.os }}-nuget-${{ hashFiles('**/*.csproj') }}
+          restore-keys: |
+            ${{ runner.os }}-nuget-
+
+      - name: Download offline bundle
+        run: |
+          # In real scenario, bundle would be pre-built and cached
+          # For now, create minimal fixture structure
+          mkdir -p ./offline-bundle/{images,feeds,policies,keys,certs,vex}
+          echo '{}' > ./offline-bundle/manifest.json
+
+      - name: Build in isolated environment
+        run: |
+          # Build offline test library
+          dotnet build src/__Libraries/StellaOps.Testing.AirGap/StellaOps.Testing.AirGap.csproj
+
+          # Build offline E2E tests
+          dotnet build src/__Tests/offline/StellaOps.Offline.E2E.Tests/StellaOps.Offline.E2E.Tests.csproj
+
+      - name: Run offline E2E tests with network isolation
+        run: |
+          # Set offline bundle path
+          export STELLAOPS_OFFLINE_BUNDLE=$(pwd)/offline-bundle
+
+          # Run tests
+          dotnet test src/__Tests/offline/StellaOps.Offline.E2E.Tests \
+            --logger "trx;LogFileName=offline-e2e.trx" \
+            --logger "console;verbosity=detailed" \
+            --results-directory ./results
+
+      - name: Verify no network calls
+        if: always()
+        run: |
+          # Parse test output for any NetworkIsolationViolationException
+          if [ -f "./results/offline-e2e.trx" ]; then
+            if grep -q "NetworkIsolationViolation" ./results/offline-e2e.trx; then
+              echo "::error::Tests attempted network calls in offline mode!"
+              exit 1
+            else
+              echo "✅ No network isolation violations detected"
+            fi
+          fi
+
+      - name: Upload results
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: offline-e2e-results
+          path: ./results/
+
+  verify-isolation:
+    runs-on: ubuntu-22.04
+    needs: offline-e2e
+    if: always()
+
+    steps:
+      - name: Download results
+        uses: actions/download-artifact@v4
+        with:
+          name: offline-e2e-results
+          path: ./results
+
+      - name: Generate summary
+        run: |
+          echo "## Offline E2E Test Summary" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+
+          if [ -f "./results/offline-e2e.trx" ]; then
+            # Parse test results
+            TOTAL=$(grep -o 'total="[0-9]*"' ./results/offline-e2e.trx | cut -d'"' -f2 || echo "0")
+            PASSED=$(grep -o 'passed="[0-9]*"' ./results/offline-e2e.trx | cut -d'"' -f2 || echo "0")
+            FAILED=$(grep -o 'failed="[0-9]*"' ./results/offline-e2e.trx | cut -d'"' -f2 || echo "0")
+
+            echo "| Metric | Value |" >> $GITHUB_STEP_SUMMARY
+            echo "|--------|-------|" >> $GITHUB_STEP_SUMMARY
+            echo "| Total Tests | ${TOTAL} |" >> $GITHUB_STEP_SUMMARY
+            echo "| Passed | ${PASSED} |" >> $GITHUB_STEP_SUMMARY
+            echo "| Failed | ${FAILED} |" >> $GITHUB_STEP_SUMMARY
+            echo "" >> $GITHUB_STEP_SUMMARY
+
+            if grep -q "NetworkIsolationViolation" ./results/offline-e2e.trx; then
+              echo "❌ **Network isolation was violated**" >> $GITHUB_STEP_SUMMARY
+            else
+              echo "✅ **Network isolation verified - no egress detected**" >> $GITHUB_STEP_SUMMARY
+            fi
+          else
+            echo "⚠️ No test results found" >> $GITHUB_STEP_SUMMARY
+          fi

.gitea/workflows/parity-tests.yml

@@ -0,0 +1,186 @@
+name: Parity Tests
+
+# Parity testing workflow: compares StellaOps against competitor scanners
+# (Syft, Grype, Trivy) on a standardized fixture set.
+#
+# Schedule: Nightly at 02:00 UTC; Weekly full run on Sunday 00:00 UTC
+# NOT a PR gate - too slow and has external dependencies
+
+on:
+  schedule:
+    # Nightly at 02:00 UTC (quick fixture set)
+    - cron: '0 2 * * *'
+    # Weekly on Sunday at 00:00 UTC (full fixture set)
+    - cron: '0 0 * * 0'
+  workflow_dispatch:
+    inputs:
+      fixture_set:
+        description: 'Fixture set to use'
+        required: false
+        default: 'quick'
+        type: choice
+        options:
+          - quick
+          - full
+      enable_drift_detection:
+        description: 'Enable drift detection analysis'
+        required: false
+        default: 'true'
+        type: boolean
+
+env:
+  DOTNET_VERSION: '10.0.x'
+  SYFT_VERSION: '1.9.0'
+  GRYPE_VERSION: '0.79.3'
+  TRIVY_VERSION: '0.54.1'
+  PARITY_RESULTS_PATH: 'bench/results/parity'
+
+jobs:
+  parity-tests:
+    name: Competitor Parity Tests
+    runs-on: ubuntu-latest
+    timeout-minutes: 120
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Setup .NET
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: ${{ env.DOTNET_VERSION }}
+
+      - name: Install Syft
+        run: |
+          curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s -- -b /usr/local/bin v${{ env.SYFT_VERSION }}
+          syft version
+
+      - name: Install Grype
+        run: |
+          curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh -s -- -b /usr/local/bin v${{ env.GRYPE_VERSION }}
+          grype version
+
+      - name: Install Trivy
+        run: |
+          curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin v${{ env.TRIVY_VERSION }}
+          trivy --version
+
+      - name: Determine fixture set
+        id: fixtures
+        run: |
+          # Weekly runs use full fixture set
+          if [[ "${{ github.event.schedule }}" == "0 0 * * 0" ]]; then
+            echo "fixture_set=full" >> $GITHUB_OUTPUT
+          elif [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then
+            echo "fixture_set=${{ inputs.fixture_set }}" >> $GITHUB_OUTPUT
+          else
+            echo "fixture_set=quick" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Build parity tests
+        run: |
+          dotnet build src/__Tests/parity/StellaOps.Parity.Tests/StellaOps.Parity.Tests.csproj -c Release
+
+      - name: Run parity tests
+        id: parity
+        run: |
+          mkdir -p ${{ env.PARITY_RESULTS_PATH }}
+          RUN_ID=$(date -u +%Y%m%dT%H%M%SZ)
+          echo "run_id=${RUN_ID}" >> $GITHUB_OUTPUT
+
+          dotnet test src/__Tests/parity/StellaOps.Parity.Tests/StellaOps.Parity.Tests.csproj \
+            -c Release \
+            --no-build \
+            --logger "trx;LogFileName=parity-results.trx" \
+            --results-directory ${{ env.PARITY_RESULTS_PATH }} \
+            -e PARITY_FIXTURE_SET=${{ steps.fixtures.outputs.fixture_set }} \
+            -e PARITY_RUN_ID=${RUN_ID} \
+            -e PARITY_OUTPUT_PATH=${{ env.PARITY_RESULTS_PATH }} \
+            || true  # Don't fail workflow on test failures
+
+      - name: Store parity results
+        run: |
+          # Copy JSON results to time-series storage
+          if [ -f "${{ env.PARITY_RESULTS_PATH }}/parity-${{ steps.parity.outputs.run_id }}.json" ]; then
+            echo "Parity results stored successfully"
+            cat ${{ env.PARITY_RESULTS_PATH }}/parity-${{ steps.parity.outputs.run_id }}.json | jq .
+          else
+            echo "Warning: No parity results file found"
+          fi
+
+      - name: Run drift detection
+        if: ${{ github.event_name != 'workflow_dispatch' || inputs.enable_drift_detection == 'true' }}
+        run: |
+          # Analyze drift from historical results
+          dotnet run --project src/__Tests/parity/StellaOps.Parity.Tests/StellaOps.Parity.Tests.csproj \
+            --no-build \
+            -- analyze-drift \
+            --results-path ${{ env.PARITY_RESULTS_PATH }} \
+            --threshold 0.05 \
+            --trend-days 3 \
+            || true
+
+      - name: Upload parity results
+        uses: actions/upload-artifact@v4
+        with:
+          name: parity-results-${{ steps.parity.outputs.run_id }}
+          path: ${{ env.PARITY_RESULTS_PATH }}
+          retention-days: 90
+
+      - name: Export Prometheus metrics
+        if: ${{ env.PROMETHEUS_PUSH_GATEWAY != '' }}
+        env:
+          PROMETHEUS_PUSH_GATEWAY: ${{ secrets.PROMETHEUS_PUSH_GATEWAY }}
+        run: |
+          # Push metrics to Prometheus Push Gateway if configured
+          if [ -f "${{ env.PARITY_RESULTS_PATH }}/parity-metrics.txt" ]; then
+            curl -X POST \
+              -H "Content-Type: text/plain" \
+              --data-binary @${{ env.PARITY_RESULTS_PATH }}/parity-metrics.txt \
+              "${PROMETHEUS_PUSH_GATEWAY}/metrics/job/parity_tests/instance/${{ steps.parity.outputs.run_id }}"
+          fi
+
+      - name: Generate comparison report
+        run: |
+          echo "## Parity Test Results - ${{ steps.parity.outputs.run_id }}" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "**Fixture Set:** ${{ steps.fixtures.outputs.fixture_set }}" >> $GITHUB_STEP_SUMMARY
+          echo "**Competitor Versions:**" >> $GITHUB_STEP_SUMMARY
+          echo "- Syft: ${{ env.SYFT_VERSION }}" >> $GITHUB_STEP_SUMMARY
+          echo "- Grype: ${{ env.GRYPE_VERSION }}" >> $GITHUB_STEP_SUMMARY
+          echo "- Trivy: ${{ env.TRIVY_VERSION }}" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          
+          if [ -f "${{ env.PARITY_RESULTS_PATH }}/parity-${{ steps.parity.outputs.run_id }}.json" ]; then
+            echo "### Metrics Summary" >> $GITHUB_STEP_SUMMARY
+            jq -r '
+              "| Metric | StellaOps | Grype | Trivy |",
+              "|--------|-----------|-------|-------|",
+              "| SBOM Packages | \(.sbomMetrics.stellaOpsPackageCount) | \(.sbomMetrics.syftPackageCount) | - |",
+              "| Vulnerability Recall | \(.vulnMetrics.recall | . * 100 | round / 100)% | - | - |",
+              "| Vulnerability F1 | \(.vulnMetrics.f1Score | . * 100 | round / 100)% | - | - |",
+              "| Latency P95 (ms) | \(.latencyMetrics.stellaOpsP95Ms | round) | \(.latencyMetrics.grypeP95Ms | round) | \(.latencyMetrics.trivyP95Ms | round) |"
+            ' ${{ env.PARITY_RESULTS_PATH }}/parity-${{ steps.parity.outputs.run_id }}.json >> $GITHUB_STEP_SUMMARY || echo "Could not parse results" >> $GITHUB_STEP_SUMMARY
+          fi
+
+      - name: Alert on critical drift
+        if: failure()
+        uses: slackapi/slack-github-action@v1.25.0
+        with:
+          payload: |
+            {
+              "text": "⚠️ Parity test drift detected",
+              "blocks": [
+                {
+                  "type": "section",
+                  "text": {
+                    "type": "mrkdwn",
+                    "text": "*Parity Test Alert*\nDrift detected in competitor comparison metrics.\n<${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|View Results>"
+                  }
+                }
+              ]
+            }
+        env:
+          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
+          SLACK_WEBHOOK_TYPE: INCOMING_WEBHOOK
+        continue-on-error: true

.gitea/workflows/policy-lint.yml

@@ -0,0 +1,70 @@
+name: Policy Lint & Smoke
+
+on:
+  pull_request:
+    paths:
+      - 'docs/policy/**'
+      - 'docs/examples/policies/**'
+      - 'src/Cli/**'
+      - '.gitea/workflows/policy-lint.yml'
+  push:
+    branches: [ main ]
+    paths:
+      - 'docs/policy/**'
+      - 'docs/examples/policies/**'
+      - 'src/Cli/**'
+      - '.gitea/workflows/policy-lint.yml'
+
+jobs:
+  policy-lint:
+    runs-on: ubuntu-22.04
+    env:
+      DOTNET_NOLOGO: 1
+      DOTNET_CLI_TELEMETRY_OPTOUT: 1
+      DOTNET_SYSTEM_GLOBALIZATION_INVARIANT: 1
+      TZ: UTC
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Task Pack offline bundle fixtures
+        run: python3 scripts/packs/run-fixtures-check.sh
+        with:
+          fetch-depth: 0
+
+      - name: Setup .NET 10 RC
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: 10.0.100
+          include-prerelease: true
+
+      - name: Cache NuGet packages
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.nuget/packages
+            .nuget/packages
+          key: policy-lint-nuget-${{ runner.os }}-${{ hashFiles('**/*.csproj') }}
+
+      - name: Restore CLI
+        run: |
+          dotnet restore src/Cli/StellaOps.Cli/StellaOps.Cli.csproj --configfile nuget.config
+
+      - name: Lint policies (deterministic)
+        run: |
+          mkdir -p out/policy-lint
+          dotnet run --project src/Cli/StellaOps.Cli/StellaOps.Cli.csproj -- \
+            policy lint docs/examples/policies/*.stella \
+            --format json --no-color \
+            > out/policy-lint/lint.json
+
+      - name: Smoke simulate entrypoint
+        run: |
+          dotnet run --project src/Cli/StellaOps.Cli/StellaOps.Cli.csproj -- policy simulate --help > out/policy-lint/simulate-help.txt
+
+      - name: Upload lint artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: policy-lint
+          path: out/policy-lint
+          retention-days: 7

.gitea/workflows/policy-simulate.yml

@@ -0,0 +1,89 @@
+name: Policy Simulation
+
+on:
+  pull_request:
+    paths:
+      - 'docs/policy/**'
+      - 'docs/examples/policies/**'
+      - 'scripts/policy/**'
+      - '.gitea/workflows/policy-simulate.yml'
+  push:
+    branches: [ main ]
+    paths:
+      - 'docs/policy/**'
+      - 'docs/examples/policies/**'
+      - 'scripts/policy/**'
+      - '.gitea/workflows/policy-simulate.yml'
+
+jobs:
+  policy-simulate:
+    runs-on: ubuntu-22.04
+    env:
+      DOTNET_NOLOGO: 1
+      DOTNET_CLI_TELEMETRY_OPTOUT: 1
+      DOTNET_SYSTEM_GLOBALIZATION_INVARIANT: 1
+      TZ: UTC
+      THRESHOLD: 0
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Task Pack offline bundle fixtures
+        run: python3 scripts/packs/run-fixtures-check.sh
+        with:
+          fetch-depth: 0
+
+      - name: Setup .NET 10 RC
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: 10.0.100
+          include-prerelease: true
+
+      - name: Install Cosign
+        uses: sigstore/cosign-installer@v3.4.0
+
+      - name: Cache NuGet packages
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.nuget/packages
+            .nuget/packages
+          key: policy-sim-nuget-${{ runner.os }}-${{ hashFiles('**/*.csproj') }}
+
+      - name: Restore CLI
+        run: |
+          dotnet restore src/Cli/StellaOps.Cli/StellaOps.Cli.csproj --configfile nuget.config
+
+      - name: Generate policy signing key (ephemeral)
+        run: |
+          OUT_DIR=out/policy-sign/keys PREFIX=ci-policy COSIGN_PASSWORD= scripts/policy/rotate-key.sh
+
+      - name: Sign sample policy blob
+        run: |
+          export COSIGN_KEY_B64=$(base64 -w0 out/policy-sign/keys/ci-policy-cosign.key)
+          COSIGN_PASSWORD= \
+            scripts/policy/sign-policy.sh --file docs/examples/policies/baseline.stella --out-dir out/policy-sign
+
+      - name: Attest and verify sample policy blob
+        run: |
+          export COSIGN_KEY_B64=$(base64 -w0 out/policy-sign/keys/ci-policy-cosign.key)
+          COSIGN_PASSWORD= \
+            scripts/policy/attest-verify.sh --file docs/examples/policies/baseline.stella --out-dir out/policy-sign
+
+      - name: Run batch policy simulation
+        run: |
+          scripts/policy/batch-simulate.sh
+
+      - name: Upload simulation artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: policy-simulation
+          path: out/policy-sim
+          retention-days: 7
+
+      - name: Upload signing artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: policy-signing
+          path: out/policy-sign
+          retention-days: 7

.gitea/workflows/promote.yml

@@ -25,6 +25,9 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v4
 
+      - name: Task Pack offline bundle fixtures
+        run: python3 scripts/packs/run-fixtures-check.sh
+
       - name: Resolve staging credentials
         id: staging
         run: |

.gitea/workflows/provenance-check.yml

@@ -0,0 +1,24 @@
+name: provenance-check
+on:
+  workflow_dispatch: {}
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Task Pack offline bundle fixtures
+        run: python3 scripts/packs/run-fixtures-check.sh
+
+      - name: Emit provenance summary
+        run: |
+          mkdir -p out/provenance
+          echo "run_at=$(date -u +"%Y-%m-%dT%H:%M:%SZ")" > out/provenance/summary.txt
+
+      - name: Upload provenance summary
+        uses: actions/upload-artifact@v4
+        with:
+          name: provenance-summary
+          path: out/provenance/**

.gitea/workflows/reachability-bench.yaml

@@ -0,0 +1,306 @@
+name: Reachability Benchmark
+
+# Sprint: SPRINT_3500_0003_0001
+# Task: CORPUS-009 - Create Gitea workflow for reachability benchmark
+# Task: CORPUS-010 - Configure nightly + per-PR benchmark runs
+
+on:
+  workflow_dispatch:
+    inputs:
+      baseline_version:
+        description: 'Baseline version to compare against'
+        required: false
+        default: 'latest'
+      verbose:
+        description: 'Enable verbose output'
+        required: false
+        type: boolean
+        default: false
+  push:
+    branches: [ main ]
+    paths:
+      - 'datasets/reachability/**'
+      - 'src/Scanner/__Libraries/StellaOps.Scanner.Benchmarks/**'
+      - 'bench/reachability-benchmark/**'
+      - '.gitea/workflows/reachability-bench.yaml'
+  pull_request:
+    paths:
+      - 'datasets/reachability/**'
+      - 'src/Scanner/__Libraries/StellaOps.Scanner.Benchmarks/**'
+      - 'bench/reachability-benchmark/**'
+  schedule:
+    # Nightly at 02:00 UTC
+    - cron: '0 2 * * *'
+
+jobs:
+  benchmark:
+    runs-on: ubuntu-22.04
+    env:
+      DOTNET_NOLOGO: 1
+      DOTNET_CLI_TELEMETRY_OPTOUT: 1
+      DOTNET_SYSTEM_GLOBALIZATION_INVARIANT: 1
+      TZ: UTC
+      STELLAOPS_OFFLINE: 'true'
+      STELLAOPS_DETERMINISTIC: 'true'
+    outputs:
+      precision: ${{ steps.metrics.outputs.precision }}
+      recall: ${{ steps.metrics.outputs.recall }}
+      f1: ${{ steps.metrics.outputs.f1 }}
+      pr_auc: ${{ steps.metrics.outputs.pr_auc }}
+      regression: ${{ steps.compare.outputs.regression }}
+      
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Setup .NET 10
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: 10.0.100
+          include-prerelease: true
+
+      - name: Cache NuGet packages
+        uses: actions/cache@v4
+        with:
+          path: ~/.nuget/packages
+          key: ${{ runner.os }}-nuget-${{ hashFiles('**/*.csproj') }}
+          restore-keys: |
+            ${{ runner.os }}-nuget-
+
+      - name: Restore benchmark project
+        run: |
+          dotnet restore src/Scanner/__Libraries/StellaOps.Scanner.Benchmarks/StellaOps.Scanner.Benchmarks.csproj \
+            --configfile nuget.config
+
+      - name: Build benchmark project
+        run: |
+          dotnet build src/Scanner/__Libraries/StellaOps.Scanner.Benchmarks/StellaOps.Scanner.Benchmarks.csproj \
+            -c Release \
+            --no-restore
+
+      - name: Validate corpus integrity
+        run: |
+          echo "::group::Validating corpus index"
+          if [ ! -f datasets/reachability/corpus.json ]; then
+            echo "::error::corpus.json not found"
+            exit 1
+          fi
+          python3 -c "import json; data = json.load(open('datasets/reachability/corpus.json')); print(f'Corpus contains {len(data.get(\"samples\", []))} samples')"
+          echo "::endgroup::"
+
+      - name: Run benchmark
+        id: benchmark
+        run: |
+          echo "::group::Running reachability benchmark"
+          mkdir -p bench/results
+          
+          # Run the corpus benchmark
+          dotnet run \
+            --project src/Scanner/__Libraries/StellaOps.Scanner.Benchmarks/StellaOps.Scanner.Benchmarks.csproj \
+            -c Release \
+            --no-build \
+            -- corpus run \
+            --corpus datasets/reachability/corpus.json \
+            --output bench/results/benchmark-${{ github.sha }}.json \
+            --format json \
+            ${{ inputs.verbose == 'true' && '--verbose' || '' }}
+          
+          echo "::endgroup::"
+
+      - name: Extract metrics
+        id: metrics
+        run: |
+          echo "::group::Extracting metrics"
+          RESULT_FILE="bench/results/benchmark-${{ github.sha }}.json"
+          
+          if [ -f "$RESULT_FILE" ]; then
+            PRECISION=$(jq -r '.metrics.precision // 0' "$RESULT_FILE")
+            RECALL=$(jq -r '.metrics.recall // 0' "$RESULT_FILE")
+            F1=$(jq -r '.metrics.f1 // 0' "$RESULT_FILE")
+            PR_AUC=$(jq -r '.metrics.pr_auc // 0' "$RESULT_FILE")
+            
+            echo "precision=$PRECISION" >> $GITHUB_OUTPUT
+            echo "recall=$RECALL" >> $GITHUB_OUTPUT
+            echo "f1=$F1" >> $GITHUB_OUTPUT
+            echo "pr_auc=$PR_AUC" >> $GITHUB_OUTPUT
+            
+            echo "Precision: $PRECISION"
+            echo "Recall: $RECALL"
+            echo "F1: $F1"
+            echo "PR-AUC: $PR_AUC"
+          else
+            echo "::error::Benchmark result file not found"
+            exit 1
+          fi
+          echo "::endgroup::"
+
+      - name: Get baseline
+        id: baseline
+        run: |
+          echo "::group::Loading baseline"
+          BASELINE_VERSION="${{ inputs.baseline_version || 'latest' }}"
+          
+          if [ "$BASELINE_VERSION" = "latest" ]; then
+            BASELINE_FILE=$(ls -t bench/baselines/*.json 2>/dev/null | head -1)
+          else
+            BASELINE_FILE="bench/baselines/$BASELINE_VERSION.json"
+          fi
+          
+          if [ -f "$BASELINE_FILE" ]; then
+            echo "baseline_file=$BASELINE_FILE" >> $GITHUB_OUTPUT
+            echo "Using baseline: $BASELINE_FILE"
+          else
+            echo "::warning::No baseline found, skipping comparison"
+            echo "baseline_file=" >> $GITHUB_OUTPUT
+          fi
+          echo "::endgroup::"
+
+      - name: Compare to baseline
+        id: compare
+        if: steps.baseline.outputs.baseline_file != ''
+        run: |
+          echo "::group::Comparing to baseline"
+          BASELINE_FILE="${{ steps.baseline.outputs.baseline_file }}"
+          RESULT_FILE="bench/results/benchmark-${{ github.sha }}.json"
+          
+          # Extract baseline metrics
+          BASELINE_PRECISION=$(jq -r '.metrics.precision // 0' "$BASELINE_FILE")
+          BASELINE_RECALL=$(jq -r '.metrics.recall // 0' "$BASELINE_FILE")
+          BASELINE_PR_AUC=$(jq -r '.metrics.pr_auc // 0' "$BASELINE_FILE")
+          
+          # Extract current metrics
+          CURRENT_PRECISION=$(jq -r '.metrics.precision // 0' "$RESULT_FILE")
+          CURRENT_RECALL=$(jq -r '.metrics.recall // 0' "$RESULT_FILE")
+          CURRENT_PR_AUC=$(jq -r '.metrics.pr_auc // 0' "$RESULT_FILE")
+          
+          # Calculate deltas
+          PRECISION_DELTA=$(echo "$CURRENT_PRECISION - $BASELINE_PRECISION" | bc -l)
+          RECALL_DELTA=$(echo "$CURRENT_RECALL - $BASELINE_RECALL" | bc -l)
+          PR_AUC_DELTA=$(echo "$CURRENT_PR_AUC - $BASELINE_PR_AUC" | bc -l)
+          
+          echo "Precision delta: $PRECISION_DELTA"
+          echo "Recall delta: $RECALL_DELTA"
+          echo "PR-AUC delta: $PR_AUC_DELTA"
+          
+          # Check for regression (PR-AUC drop > 2%)
+          REGRESSION_THRESHOLD=-0.02
+          if (( $(echo "$PR_AUC_DELTA < $REGRESSION_THRESHOLD" | bc -l) )); then
+            echo "::error::PR-AUC regression detected: $PR_AUC_DELTA (threshold: $REGRESSION_THRESHOLD)"
+            echo "regression=true" >> $GITHUB_OUTPUT
+          else
+            echo "regression=false" >> $GITHUB_OUTPUT
+          fi
+          echo "::endgroup::"
+
+      - name: Generate markdown report
+        run: |
+          echo "::group::Generating report"
+          RESULT_FILE="bench/results/benchmark-${{ github.sha }}.json"
+          REPORT_FILE="bench/results/benchmark-${{ github.sha }}.md"
+          
+          cat > "$REPORT_FILE" << 'EOF'
+          # Reachability Benchmark Report
+          
+          **Commit:** ${{ github.sha }}
+          **Run:** ${{ github.run_number }}
+          **Date:** $(date -u +"%Y-%m-%dT%H:%M:%SZ")
+          
+          ## Metrics
+          
+          | Metric | Value |
+          |--------|-------|
+          | Precision | ${{ steps.metrics.outputs.precision }} |
+          | Recall | ${{ steps.metrics.outputs.recall }} |
+          | F1 Score | ${{ steps.metrics.outputs.f1 }} |
+          | PR-AUC | ${{ steps.metrics.outputs.pr_auc }} |
+          
+          ## Comparison
+          
+          ${{ steps.compare.outputs.regression == 'true' && '⚠️ **REGRESSION DETECTED**' || '✅ No regression' }}
+          EOF
+          
+          echo "Report generated: $REPORT_FILE"
+          echo "::endgroup::"
+
+      - name: Upload results
+        uses: actions/upload-artifact@v4
+        with:
+          name: benchmark-results-${{ github.sha }}
+          path: |
+            bench/results/benchmark-${{ github.sha }}.json
+            bench/results/benchmark-${{ github.sha }}.md
+          retention-days: 90
+
+      - name: Fail on regression
+        if: steps.compare.outputs.regression == 'true' && github.event_name == 'pull_request'
+        run: |
+          echo "::error::Benchmark regression detected. PR-AUC dropped below threshold."
+          exit 1
+
+  update-baseline:
+    needs: benchmark
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main' && needs.benchmark.outputs.regression != 'true'
+    runs-on: ubuntu-22.04
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Download results
+        uses: actions/download-artifact@v4
+        with:
+          name: benchmark-results-${{ github.sha }}
+          path: bench/results/
+
+      - name: Update baseline (nightly only)
+        if: github.event_name == 'schedule'
+        run: |
+          DATE=$(date +%Y%m%d)
+          cp bench/results/benchmark-${{ github.sha }}.json bench/baselines/baseline-$DATE.json
+          echo "Updated baseline to baseline-$DATE.json"
+
+  notify-pr:
+    needs: benchmark
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-22.04
+    permissions:
+      pull-requests: write
+    steps:
+      - name: Comment on PR
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const precision = '${{ needs.benchmark.outputs.precision }}';
+            const recall = '${{ needs.benchmark.outputs.recall }}';
+            const f1 = '${{ needs.benchmark.outputs.f1 }}';
+            const prAuc = '${{ needs.benchmark.outputs.pr_auc }}';
+            const regression = '${{ needs.benchmark.outputs.regression }}' === 'true';
+            
+            const status = regression ? '⚠️ REGRESSION' : '✅ PASS';
+            
+            const body = `## Reachability Benchmark Results ${status}
+            
+            | Metric | Value |
+            |--------|-------|
+            | Precision | ${precision} |
+            | Recall | ${recall} |
+            | F1 Score | ${f1} |
+            | PR-AUC | ${prAuc} |
+            
+            ${regression ? '### ⚠️ Regression Detected\nPR-AUC dropped below threshold. Please review changes.' : ''}
+            
+            <details>
+            <summary>Details</summary>
+            
+            - Commit: \`${{ github.sha }}\`
+            - Run: [#${{ github.run_number }}](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})
+            
+            </details>`;
+            
+            github.rest.issues.createComment({
+              issue_number: context.issue.number,
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              body: body
+            });

.gitea/workflows/reachability-corpus-ci.yml

@@ -0,0 +1,267 @@
+name: Reachability Corpus Validation
+
+on:
+  workflow_dispatch:
+  push:
+    branches: [ main ]
+    paths:
+      - 'src/__Tests/reachability/corpus/**'
+      - 'src/__Tests/reachability/fixtures/**'
+      - 'src/__Tests/reachability/StellaOps.Reachability.FixtureTests/**'
+      - 'scripts/reachability/**'
+      - '.gitea/workflows/reachability-corpus-ci.yml'
+  pull_request:
+    paths:
+      - 'src/__Tests/reachability/corpus/**'
+      - 'src/__Tests/reachability/fixtures/**'
+      - 'src/__Tests/reachability/StellaOps.Reachability.FixtureTests/**'
+      - 'scripts/reachability/**'
+      - '.gitea/workflows/reachability-corpus-ci.yml'
+
+jobs:
+  validate-corpus:
+    runs-on: ubuntu-22.04
+    env:
+      DOTNET_NOLOGO: 1
+      DOTNET_CLI_TELEMETRY_OPTOUT: 1
+      DOTNET_SYSTEM_GLOBALIZATION_INVARIANT: 1
+      TZ: UTC
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Setup .NET 10 RC
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: 10.0.100
+          include-prerelease: true
+
+      - name: Verify corpus manifest integrity
+        run: |
+          echo "Verifying corpus manifest..."
+          cd src/__Tests/reachability/corpus
+          if [ ! -f manifest.json ]; then
+            echo "::error::Corpus manifest.json not found"
+            exit 1
+          fi
+          echo "Manifest exists, checking JSON validity..."
+          python3 -c "import json; json.load(open('manifest.json'))"
+          echo "Manifest is valid JSON"
+
+      - name: Verify reachbench index integrity
+        run: |
+          echo "Verifying reachbench fixtures..."
+          cd src/__Tests/reachability/fixtures/reachbench-2025-expanded
+          if [ ! -f INDEX.json ]; then
+            echo "::error::Reachbench INDEX.json not found"
+            exit 1
+          fi
+          echo "INDEX exists, checking JSON validity..."
+          python3 -c "import json; json.load(open('INDEX.json'))"
+          echo "INDEX is valid JSON"
+
+      - name: Restore test project
+        run: dotnet restore src/__Tests/reachability/StellaOps.Reachability.FixtureTests/StellaOps.Reachability.FixtureTests.csproj --configfile nuget.config
+
+      - name: Build test project
+        run: dotnet build src/__Tests/reachability/StellaOps.Reachability.FixtureTests/StellaOps.Reachability.FixtureTests.csproj -c Release --no-restore
+
+      - name: Run corpus fixture tests
+        run: |
+          dotnet test src/__Tests/reachability/StellaOps.Reachability.FixtureTests/StellaOps.Reachability.FixtureTests.csproj \
+            -c Release \
+            --no-build \
+            --logger "trx;LogFileName=corpus-results.trx" \
+            --results-directory ./TestResults \
+            --filter "FullyQualifiedName~CorpusFixtureTests"
+
+      - name: Run reachbench fixture tests
+        run: |
+          dotnet test src/__Tests/reachability/StellaOps.Reachability.FixtureTests/StellaOps.Reachability.FixtureTests.csproj \
+            -c Release \
+            --no-build \
+            --logger "trx;LogFileName=reachbench-results.trx" \
+            --results-directory ./TestResults \
+            --filter "FullyQualifiedName~ReachbenchFixtureTests"
+
+      - name: Verify deterministic hashes
+        run: |
+          echo "Verifying SHA-256 hashes in corpus manifest..."
+          chmod +x scripts/reachability/verify_corpus_hashes.sh || true
+          if [ -f scripts/reachability/verify_corpus_hashes.sh ]; then
+            scripts/reachability/verify_corpus_hashes.sh
+          else
+            echo "Hash verification script not found, using inline verification..."
+            cd src/__Tests/reachability/corpus
+            python3 << 'EOF'
+          import json
+          import hashlib
+          import sys
+          import os
+
+          with open('manifest.json') as f:
+              manifest = json.load(f)
+
+          errors = []
+          for entry in manifest:
+              case_id = entry['id']
+              lang = entry['language']
+              case_dir = os.path.join(lang, case_id)
+              for filename, expected_hash in entry['files'].items():
+                  filepath = os.path.join(case_dir, filename)
+                  if not os.path.exists(filepath):
+                      errors.append(f"{case_id}: missing {filename}")
+                      continue
+                  with open(filepath, 'rb') as f:
+                      actual_hash = hashlib.sha256(f.read()).hexdigest()
+                  if actual_hash != expected_hash:
+                      errors.append(f"{case_id}: {filename} hash mismatch (expected {expected_hash}, got {actual_hash})")
+
+          if errors:
+              for err in errors:
+                  print(f"::error::{err}")
+              sys.exit(1)
+          print(f"All {len(manifest)} corpus entries verified")
+          EOF
+          fi
+
+      - name: Upload test results
+        uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: corpus-test-results-${{ github.run_number }}
+          path: ./TestResults/*.trx
+          retention-days: 14
+
+  validate-ground-truths:
+    runs-on: ubuntu-22.04
+    env:
+      TZ: UTC
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Validate ground-truth schema version
+        run: |
+          echo "Validating ground-truth files..."
+          cd src/__Tests/reachability
+          python3 << 'EOF'
+          import json
+          import os
+          import sys
+
+          EXPECTED_SCHEMA = "reachbench.reachgraph.truth/v1"
+          ALLOWED_VARIANTS = {"reachable", "unreachable"}
+          errors = []
+
+          # Validate corpus ground-truths
+          corpus_manifest = 'corpus/manifest.json'
+          if os.path.exists(corpus_manifest):
+              with open(corpus_manifest) as f:
+                  manifest = json.load(f)
+              for entry in manifest:
+                  case_id = entry['id']
+                  lang = entry['language']
+                  truth_path = os.path.join('corpus', lang, case_id, 'ground-truth.json')
+                  if not os.path.exists(truth_path):
+                      errors.append(f"corpus/{case_id}: missing ground-truth.json")
+                      continue
+                  with open(truth_path) as f:
+                      truth = json.load(f)
+                  if truth.get('schema_version') != EXPECTED_SCHEMA:
+                      errors.append(f"corpus/{case_id}: wrong schema_version")
+                  if truth.get('variant') not in ALLOWED_VARIANTS:
+                      errors.append(f"corpus/{case_id}: invalid variant '{truth.get('variant')}'")
+                  if not isinstance(truth.get('paths'), list):
+                      errors.append(f"corpus/{case_id}: paths must be an array")
+
+          # Validate reachbench ground-truths
+          reachbench_index = 'fixtures/reachbench-2025-expanded/INDEX.json'
+          if os.path.exists(reachbench_index):
+              with open(reachbench_index) as f:
+                  index = json.load(f)
+              for case in index.get('cases', []):
+                  case_id = case['id']
+                  case_path = case.get('path', os.path.join('cases', case_id))
+                  for variant in ['reachable', 'unreachable']:
+                      truth_path = os.path.join('fixtures/reachbench-2025-expanded', case_path, 'images', variant, 'reachgraph.truth.json')
+                      if not os.path.exists(truth_path):
+                          errors.append(f"reachbench/{case_id}/{variant}: missing reachgraph.truth.json")
+                          continue
+                      with open(truth_path) as f:
+                          truth = json.load(f)
+                      if not truth.get('schema_version'):
+                          errors.append(f"reachbench/{case_id}/{variant}: missing schema_version")
+                      if not isinstance(truth.get('paths'), list):
+                          errors.append(f"reachbench/{case_id}/{variant}: paths must be an array")
+
+          if errors:
+              for err in errors:
+                  print(f"::error::{err}")
+              sys.exit(1)
+          print("All ground-truth files validated successfully")
+          EOF
+
+  determinism-check:
+    runs-on: ubuntu-22.04
+    env:
+      TZ: UTC
+    needs: validate-corpus
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Verify JSON determinism (sorted keys, no trailing whitespace)
+        run: |
+          echo "Checking JSON determinism..."
+          cd src/__Tests/reachability
+          python3 << 'EOF'
+          import json
+          import os
+          import sys
+
+          def check_json_sorted(filepath):
+              """Check if JSON has sorted keys (deterministic)."""
+              with open(filepath) as f:
+                  content = f.read()
+              parsed = json.loads(content)
+              reserialized = json.dumps(parsed, sort_keys=True, indent=2)
+              # Normalize line endings
+              content_normalized = content.replace('\r\n', '\n').strip()
+              reserialized_normalized = reserialized.strip()
+              return content_normalized == reserialized_normalized
+
+          errors = []
+          json_files = []
+
+          # Collect JSON files from corpus
+          for root, dirs, files in os.walk('corpus'):
+              for f in files:
+                  if f.endswith('.json'):
+                      json_files.append(os.path.join(root, f))
+
+          # Check determinism
+          non_deterministic = []
+          for filepath in json_files:
+              try:
+                  if not check_json_sorted(filepath):
+                      non_deterministic.append(filepath)
+              except json.JSONDecodeError as e:
+                  errors.append(f"{filepath}: invalid JSON - {e}")
+
+          if non_deterministic:
+              print(f"::warning::Found {len(non_deterministic)} non-deterministic JSON files (keys not sorted or whitespace differs)")
+              for f in non_deterministic[:10]:
+                  print(f"  - {f}")
+              if len(non_deterministic) > 10:
+                  print(f"  ... and {len(non_deterministic) - 10} more")
+
+          if errors:
+              for err in errors:
+                  print(f"::error::{err}")
+              sys.exit(1)
+
+          print(f"Checked {len(json_files)} JSON files")
+          EOF

.gitea/workflows/release-keyless-sign.yml

@@ -0,0 +1,399 @@
+# .gitea/workflows/release-keyless-sign.yml
+# Keyless signing for StellaOps release artifacts
+#
+# This workflow signs release artifacts using keyless signing (Fulcio).
+# It demonstrates dogfooding of the keyless signing feature.
+#
+# Triggers:
+# - After release bundle is published
+# - Manual trigger for re-signing
+#
+# Artifacts signed:
+# - Container images
+# - CLI binaries
+# - SBOM documents
+# - Release manifest
+
+name: Release Keyless Signing
+
+on:
+  release:
+    types: [published]
+  workflow_dispatch:
+    inputs:
+      version:
+        description: 'Release version to sign (e.g., 2025.12.0)'
+        required: true
+        type: string
+      dry_run:
+        description: 'Dry run (skip actual signing)'
+        required: false
+        default: false
+        type: boolean
+
+env:
+  STELLAOPS_URL: "https://api.stella-ops.internal"
+  REGISTRY: registry.stella-ops.org
+
+jobs:
+  sign-images:
+    runs-on: ubuntu-22.04
+    permissions:
+      id-token: write
+      contents: read
+      packages: write
+
+    outputs:
+      scanner-attestation: ${{ steps.sign-scanner.outputs.attestation-digest }}
+      cli-attestation: ${{ steps.sign-cli.outputs.attestation-digest }}
+      gateway-attestation: ${{ steps.sign-gateway.outputs.attestation-digest }}
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Determine Version
+        id: version
+        run: |
+          if [[ -n "${{ github.event.inputs.version }}" ]]; then
+            VERSION="${{ github.event.inputs.version }}"
+          else
+            VERSION="${{ github.event.release.tag_name }}"
+            VERSION="${VERSION#v}"
+          fi
+          echo "version=${VERSION}" >> $GITHUB_OUTPUT
+          echo "Release version: ${VERSION}"
+
+      - name: Install StellaOps CLI
+        run: |
+          curl -sL https://get.stella-ops.org/cli | sh
+          echo "$HOME/.stellaops/bin" >> $GITHUB_PATH
+
+      - name: Log in to Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ secrets.REGISTRY_USERNAME }}
+          password: ${{ secrets.REGISTRY_PASSWORD }}
+
+      - name: Get OIDC Token
+        id: oidc
+        run: |
+          OIDC_TOKEN="${ACTIONS_ID_TOKEN}"
+          if [[ -z "$OIDC_TOKEN" ]]; then
+            echo "::error::OIDC token not available"
+            exit 1
+          fi
+          echo "::add-mask::${OIDC_TOKEN}"
+          echo "token=${OIDC_TOKEN}" >> $GITHUB_OUTPUT
+
+      - name: Sign Scanner Image
+        id: sign-scanner
+        if: ${{ github.event.inputs.dry_run != 'true' }}
+        env:
+          STELLAOPS_OIDC_TOKEN: ${{ steps.oidc.outputs.token }}
+        run: |
+          VERSION="${{ steps.version.outputs.version }}"
+          IMAGE="${REGISTRY}/stellaops/scanner:${VERSION}"
+
+          echo "Signing scanner image: ${IMAGE}"
+          DIGEST=$(docker manifest inspect "${IMAGE}" -v | jq -r '.Descriptor.digest')
+
+          RESULT=$(stella attest sign \
+            --keyless \
+            --artifact "${DIGEST}" \
+            --type image \
+            --rekor \
+            --output json)
+
+          ATTESTATION=$(echo "$RESULT" | jq -r '.attestationDigest')
+          REKOR=$(echo "$RESULT" | jq -r '.rekorUuid')
+
+          echo "attestation-digest=${ATTESTATION}" >> $GITHUB_OUTPUT
+          echo "rekor-uuid=${REKOR}" >> $GITHUB_OUTPUT
+
+          # Push attestation to registry
+          stella attest push \
+            --attestation "${ATTESTATION}" \
+            --registry "stellaops/scanner"
+
+      - name: Sign CLI Image
+        id: sign-cli
+        if: ${{ github.event.inputs.dry_run != 'true' }}
+        env:
+          STELLAOPS_OIDC_TOKEN: ${{ steps.oidc.outputs.token }}
+        run: |
+          VERSION="${{ steps.version.outputs.version }}"
+          IMAGE="${REGISTRY}/stellaops/cli:${VERSION}"
+
+          echo "Signing CLI image: ${IMAGE}"
+          DIGEST=$(docker manifest inspect "${IMAGE}" -v | jq -r '.Descriptor.digest')
+
+          RESULT=$(stella attest sign \
+            --keyless \
+            --artifact "${DIGEST}" \
+            --type image \
+            --rekor \
+            --output json)
+
+          ATTESTATION=$(echo "$RESULT" | jq -r '.attestationDigest')
+          echo "attestation-digest=${ATTESTATION}" >> $GITHUB_OUTPUT
+
+          stella attest push \
+            --attestation "${ATTESTATION}" \
+            --registry "stellaops/cli"
+
+      - name: Sign Gateway Image
+        id: sign-gateway
+        if: ${{ github.event.inputs.dry_run != 'true' }}
+        env:
+          STELLAOPS_OIDC_TOKEN: ${{ steps.oidc.outputs.token }}
+        run: |
+          VERSION="${{ steps.version.outputs.version }}"
+          IMAGE="${REGISTRY}/stellaops/gateway:${VERSION}"
+
+          echo "Signing gateway image: ${IMAGE}"
+          DIGEST=$(docker manifest inspect "${IMAGE}" -v | jq -r '.Descriptor.digest')
+
+          RESULT=$(stella attest sign \
+            --keyless \
+            --artifact "${DIGEST}" \
+            --type image \
+            --rekor \
+            --output json)
+
+          ATTESTATION=$(echo "$RESULT" | jq -r '.attestationDigest')
+          echo "attestation-digest=${ATTESTATION}" >> $GITHUB_OUTPUT
+
+          stella attest push \
+            --attestation "${ATTESTATION}" \
+            --registry "stellaops/gateway"
+
+  sign-binaries:
+    runs-on: ubuntu-22.04
+    permissions:
+      id-token: write
+      contents: read
+
+    outputs:
+      cli-linux-x64: ${{ steps.sign-cli-linux-x64.outputs.attestation-digest }}
+      cli-linux-arm64: ${{ steps.sign-cli-linux-arm64.outputs.attestation-digest }}
+      cli-darwin-x64: ${{ steps.sign-cli-darwin-x64.outputs.attestation-digest }}
+      cli-darwin-arm64: ${{ steps.sign-cli-darwin-arm64.outputs.attestation-digest }}
+      cli-windows-x64: ${{ steps.sign-cli-windows-x64.outputs.attestation-digest }}
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Determine Version
+        id: version
+        run: |
+          if [[ -n "${{ github.event.inputs.version }}" ]]; then
+            VERSION="${{ github.event.inputs.version }}"
+          else
+            VERSION="${{ github.event.release.tag_name }}"
+            VERSION="${VERSION#v}"
+          fi
+          echo "version=${VERSION}" >> $GITHUB_OUTPUT
+
+      - name: Install StellaOps CLI
+        run: |
+          curl -sL https://get.stella-ops.org/cli | sh
+          echo "$HOME/.stellaops/bin" >> $GITHUB_PATH
+
+      - name: Download Release Artifacts
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          VERSION="${{ steps.version.outputs.version }}"
+          mkdir -p artifacts
+
+          # Download CLI binaries
+          gh release download "v${VERSION}" \
+            --pattern "stellaops-cli-*" \
+            --dir artifacts \
+            || echo "No CLI binaries found"
+
+      - name: Get OIDC Token
+        id: oidc
+        run: |
+          OIDC_TOKEN="${ACTIONS_ID_TOKEN}"
+          echo "::add-mask::${OIDC_TOKEN}"
+          echo "token=${OIDC_TOKEN}" >> $GITHUB_OUTPUT
+
+      - name: Sign CLI Binary (linux-x64)
+        id: sign-cli-linux-x64
+        if: ${{ github.event.inputs.dry_run != 'true' }}
+        env:
+          STELLAOPS_OIDC_TOKEN: ${{ steps.oidc.outputs.token }}
+        run: |
+          BINARY="artifacts/stellaops-cli-linux-x64"
+          if [[ -f "$BINARY" ]]; then
+            DIGEST="sha256:$(sha256sum "$BINARY" | cut -d' ' -f1)"
+
+            RESULT=$(stella attest sign \
+              --keyless \
+              --artifact "${DIGEST}" \
+              --type binary \
+              --rekor \
+              --output json)
+
+            ATTESTATION=$(echo "$RESULT" | jq -r '.attestationDigest')
+            echo "attestation-digest=${ATTESTATION}" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Sign CLI Binary (linux-arm64)
+        id: sign-cli-linux-arm64
+        if: ${{ github.event.inputs.dry_run != 'true' }}
+        env:
+          STELLAOPS_OIDC_TOKEN: ${{ steps.oidc.outputs.token }}
+        run: |
+          BINARY="artifacts/stellaops-cli-linux-arm64"
+          if [[ -f "$BINARY" ]]; then
+            DIGEST="sha256:$(sha256sum "$BINARY" | cut -d' ' -f1)"
+
+            RESULT=$(stella attest sign \
+              --keyless \
+              --artifact "${DIGEST}" \
+              --type binary \
+              --rekor \
+              --output json)
+
+            ATTESTATION=$(echo "$RESULT" | jq -r '.attestationDigest')
+            echo "attestation-digest=${ATTESTATION}" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Sign CLI Binary (darwin-x64)
+        id: sign-cli-darwin-x64
+        if: ${{ github.event.inputs.dry_run != 'true' }}
+        env:
+          STELLAOPS_OIDC_TOKEN: ${{ steps.oidc.outputs.token }}
+        run: |
+          BINARY="artifacts/stellaops-cli-darwin-x64"
+          if [[ -f "$BINARY" ]]; then
+            DIGEST="sha256:$(sha256sum "$BINARY" | cut -d' ' -f1)"
+
+            RESULT=$(stella attest sign \
+              --keyless \
+              --artifact "${DIGEST}" \
+              --type binary \
+              --rekor \
+              --output json)
+
+            ATTESTATION=$(echo "$RESULT" | jq -r '.attestationDigest')
+            echo "attestation-digest=${ATTESTATION}" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Sign CLI Binary (darwin-arm64)
+        id: sign-cli-darwin-arm64
+        if: ${{ github.event.inputs.dry_run != 'true' }}
+        env:
+          STELLAOPS_OIDC_TOKEN: ${{ steps.oidc.outputs.token }}
+        run: |
+          BINARY="artifacts/stellaops-cli-darwin-arm64"
+          if [[ -f "$BINARY" ]]; then
+            DIGEST="sha256:$(sha256sum "$BINARY" | cut -d' ' -f1)"
+
+            RESULT=$(stella attest sign \
+              --keyless \
+              --artifact "${DIGEST}" \
+              --type binary \
+              --rekor \
+              --output json)
+
+            ATTESTATION=$(echo "$RESULT" | jq -r '.attestationDigest')
+            echo "attestation-digest=${ATTESTATION}" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Sign CLI Binary (windows-x64)
+        id: sign-cli-windows-x64
+        if: ${{ github.event.inputs.dry_run != 'true' }}
+        env:
+          STELLAOPS_OIDC_TOKEN: ${{ steps.oidc.outputs.token }}
+        run: |
+          BINARY="artifacts/stellaops-cli-windows-x64.exe"
+          if [[ -f "$BINARY" ]]; then
+            DIGEST="sha256:$(sha256sum "$BINARY" | cut -d' ' -f1)"
+
+            RESULT=$(stella attest sign \
+              --keyless \
+              --artifact "${DIGEST}" \
+              --type binary \
+              --rekor \
+              --output json)
+
+            ATTESTATION=$(echo "$RESULT" | jq -r '.attestationDigest')
+            echo "attestation-digest=${ATTESTATION}" >> $GITHUB_OUTPUT
+          fi
+
+  verify-signatures:
+    needs: [sign-images, sign-binaries]
+    runs-on: ubuntu-22.04
+    permissions:
+      contents: read
+      packages: read
+
+    steps:
+      - name: Install StellaOps CLI
+        run: |
+          curl -sL https://get.stella-ops.org/cli | sh
+          echo "$HOME/.stellaops/bin" >> $GITHUB_PATH
+
+      - name: Determine Version
+        id: version
+        run: |
+          if [[ -n "${{ github.event.inputs.version }}" ]]; then
+            VERSION="${{ github.event.inputs.version }}"
+          else
+            VERSION="${{ github.event.release.tag_name }}"
+            VERSION="${VERSION#v}"
+          fi
+          echo "version=${VERSION}" >> $GITHUB_OUTPUT
+
+      - name: Verify Scanner Image
+        if: ${{ github.event.inputs.dry_run != 'true' }}
+        run: |
+          VERSION="${{ steps.version.outputs.version }}"
+          IMAGE="${REGISTRY}/stellaops/scanner:${VERSION}"
+          DIGEST=$(docker manifest inspect "${IMAGE}" -v | jq -r '.Descriptor.digest')
+
+          stella attest verify \
+            --artifact "${DIGEST}" \
+            --certificate-identity "stella-ops.org/git.stella-ops.org:ref:refs/tags/v${VERSION}" \
+            --certificate-oidc-issuer "https://git.stella-ops.org" \
+            --require-rekor
+
+      - name: Summary
+        run: |
+          VERSION="${{ steps.version.outputs.version }}"
+          cat >> $GITHUB_STEP_SUMMARY << EOF
+          ## Release v${VERSION} Signed
+
+          ### Container Images
+
+          | Image | Attestation |
+          |-------|-------------|
+          | scanner | \`${{ needs.sign-images.outputs.scanner-attestation }}\` |
+          | cli | \`${{ needs.sign-images.outputs.cli-attestation }}\` |
+          | gateway | \`${{ needs.sign-images.outputs.gateway-attestation }}\` |
+
+          ### CLI Binaries
+
+          | Platform | Attestation |
+          |----------|-------------|
+          | linux-x64 | \`${{ needs.sign-binaries.outputs.cli-linux-x64 }}\` |
+          | linux-arm64 | \`${{ needs.sign-binaries.outputs.cli-linux-arm64 }}\` |
+          | darwin-x64 | \`${{ needs.sign-binaries.outputs.cli-darwin-x64 }}\` |
+          | darwin-arm64 | \`${{ needs.sign-binaries.outputs.cli-darwin-arm64 }}\` |
+          | windows-x64 | \`${{ needs.sign-binaries.outputs.cli-windows-x64 }}\` |
+
+          ### Verification
+
+          \`\`\`bash
+          stella attest verify \\
+            --artifact "sha256:..." \\
+            --certificate-identity "stella-ops.org/git.stella-ops.org:ref:refs/tags/v${VERSION}" \\
+            --certificate-oidc-issuer "https://git.stella-ops.org"
+          \`\`\`
+          EOF

.gitea/workflows/release-manifest-verify.yml

@@ -0,0 +1,19 @@
+name: release-manifest-verify
+
+on:
+  push:
+    paths:
+      - deploy/releases/2025.09-stable.yaml
+      - deploy/releases/2025.09-airgap.yaml
+      - deploy/downloads/manifest.json
+      - ops/devops/release/check_release_manifest.py
+  workflow_dispatch:
+
+jobs:
+  verify:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Validate release & downloads manifests
+        run: |
+          python ops/devops/release/check_release_manifest.py

.gitea/workflows/release-validation.yml

@@ -0,0 +1,120 @@
+name: Release Validation
+
+on:
+  push:
+    tags:
+      - 'v*'
+  pull_request:
+    paths:
+      - 'deploy/**'
+      - 'scripts/release/**'
+  workflow_dispatch:
+
+env:
+  DOTNET_VERSION: '10.0.x'
+  REGISTRY: ghcr.io
+  IMAGE_PREFIX: stellaops
+
+jobs:
+  validate-manifests:
+    name: Validate Release Manifests
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Validate Helm charts
+        run: |
+          helm lint deploy/helm/stellaops
+          helm template stellaops deploy/helm/stellaops --dry-run
+
+      - name: Validate Kubernetes manifests
+        run: |
+          for f in deploy/k8s/*.yaml; do
+            kubectl apply --dry-run=client -f "$f" || exit 1
+          done
+
+      - name: Check required images exist
+        run: |
+          REQUIRED_IMAGES=(
+            "concelier"
+            "scanner"
+            "authority"
+            "signer"
+            "attestor"
+            "excititor"
+            "policy"
+            "scheduler"
+            "notify"
+          )
+          for img in "${REQUIRED_IMAGES[@]}"; do
+            echo "Checking $img..."
+            # Validate Dockerfile exists
+            if [ ! -f "src/${img^}/Dockerfile" ] && [ ! -f "deploy/docker/${img}/Dockerfile" ]; then
+              echo "Warning: Dockerfile not found for $img"
+            fi
+          done
+
+  validate-checksums:
+    name: Validate Artifact Checksums
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Verify SHA256SUMS files
+        run: |
+          find . -name "SHA256SUMS" -type f | while read f; do
+            dir=$(dirname "$f")
+            echo "Validating $f..."
+            cd "$dir"
+            if ! sha256sum -c SHA256SUMS --quiet 2>/dev/null; then
+              echo "Warning: Checksum mismatch in $dir"
+            fi
+            cd - > /dev/null
+          done
+
+  validate-schemas:
+    name: Validate Schema Integrity
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+
+      - name: Install ajv-cli
+        run: npm install -g ajv-cli ajv-formats
+
+      - name: Validate JSON schemas
+        run: |
+          for schema in docs/schemas/*.schema.json; do
+            echo "Validating $schema..."
+            ajv compile -s "$schema" --spec=draft2020 || echo "Warning: $schema validation issue"
+          done
+
+  release-notes:
+    name: Generate Release Notes
+    runs-on: ubuntu-latest
+    if: startsWith(github.ref, 'refs/tags/v')
+    needs: [validate-manifests, validate-checksums, validate-schemas]
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Generate changelog
+        run: |
+          PREV_TAG=$(git describe --abbrev=0 --tags HEAD^ 2>/dev/null || echo "")
+          if [ -n "$PREV_TAG" ]; then
+            echo "## Changes since $PREV_TAG" > RELEASE_NOTES.md
+            git log --pretty=format:"- %s (%h)" "$PREV_TAG"..HEAD >> RELEASE_NOTES.md
+          else
+            echo "## Initial Release" > RELEASE_NOTES.md
+          fi
+
+      - name: Upload release notes
+        uses: actions/upload-artifact@v4
+        with:
+          name: release-notes
+          path: RELEASE_NOTES.md

.gitea/workflows/release.yml

@@ -36,7 +36,7 @@ jobs:
   build-release:
     runs-on: ubuntu-22.04
     env:
-      DOTNET_VERSION: '10.0.100-rc.1.25451.107'
+      DOTNET_VERSION: '10.0.100'
       REGISTRY: registry.stella-ops.org
     steps:
       - name: Checkout repository
@@ -44,6 +44,9 @@ jobs:
         with:
           fetch-depth: 0
 
+      - name: Task Pack offline bundle fixtures
+        run: python3 scripts/packs/run-fixtures-check.sh
+
       - name: Validate NuGet restore source ordering
         run: python3 ops/devops/validate_restore_sources.py
 
@@ -239,3 +242,10 @@ jobs:
           name: stellaops-release-${{ steps.meta.outputs.version }}
           path: out/release
           if-no-files-found: error
+
+      - name: Upload debug artefacts (build-id store)
+        uses: actions/upload-artifact@v4
+        with:
+          name: stellaops-debug-${{ steps.meta.outputs.version }}
+          path: out/release/debug
+          if-no-files-found: error

.gitea/workflows/replay-verification.yml

@@ -0,0 +1,39 @@
+name: Replay Verification
+
+on:
+  pull_request:
+    paths:
+      - 'src/Scanner/**'
+      - 'src/__Libraries/StellaOps.Canonicalization/**'
+      - 'src/__Libraries/StellaOps.Replay/**'
+      - 'src/__Libraries/StellaOps.Testing.Manifests/**'
+      - 'src/__Tests/__Benchmarks/golden-corpus/**'
+
+jobs:
+  replay-verification:
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup .NET
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: '10.0.100'
+
+      - name: Build CLI
+        run: dotnet build src/Cli/StellaOps.Cli -c Release
+
+      - name: Run replay verification on corpus
+        run: |
+          dotnet run --project src/Cli/StellaOps.Cli -- replay batch \
+            --corpus src/__Tests/__Benchmarks/golden-corpus/ \
+            --output results/ \
+            --verify-determinism \
+            --fail-on-diff
+
+      - name: Upload diff report
+        if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: replay-diff-report
+          path: results/diff-report.json

.gitea/workflows/risk-bundle-ci.yml

@@ -0,0 +1,198 @@
+name: Risk Bundle CI
+
+on:
+  push:
+    branches: [ main ]
+    paths:
+      - 'src/ExportCenter/StellaOps.ExportCenter.RiskBundles/**'
+      - 'src/ExportCenter/StellaOps.ExportCenter/StellaOps.ExportCenter.Worker/**'
+      - 'ops/devops/risk-bundle/**'
+      - '.gitea/workflows/risk-bundle-ci.yml'
+      - 'docs/modules/export-center/operations/risk-bundle-*.md'
+  pull_request:
+    branches: [ main, develop ]
+    paths:
+      - 'src/ExportCenter/StellaOps.ExportCenter.RiskBundles/**'
+      - 'src/ExportCenter/StellaOps.ExportCenter/StellaOps.ExportCenter.Worker/**'
+      - 'ops/devops/risk-bundle/**'
+      - '.gitea/workflows/risk-bundle-ci.yml'
+      - 'docs/modules/export-center/operations/risk-bundle-*.md'
+  workflow_dispatch:
+    inputs:
+      include_osv:
+        description: 'Include OSV providers (larger bundle)'
+        type: boolean
+        default: false
+      publish_checksums:
+        description: 'Publish checksums to artifact store'
+        type: boolean
+        default: true
+
+jobs:
+  risk-bundle-build:
+    runs-on: ubuntu-22.04
+    env:
+      DOTNET_VERSION: '10.0.100'
+      ARTIFACT_DIR: ${{ github.workspace }}/.artifacts
+      BUNDLE_OUTPUT: ${{ github.workspace }}/.artifacts/risk-bundle
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Export OpenSSL 1.1 shim for Mongo2Go
+        run: scripts/enable-openssl11-shim.sh
+
+      - name: Set up .NET SDK
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: ${{ env.DOTNET_VERSION }}
+          include-prerelease: true
+
+      - name: Restore
+        run: dotnet restore src/ExportCenter/StellaOps.ExportCenter.RiskBundles/StellaOps.ExportCenter.RiskBundles.csproj
+
+      - name: Build
+        run: dotnet build src/ExportCenter/StellaOps.ExportCenter.RiskBundles/StellaOps.ExportCenter.RiskBundles.csproj -c Release /p:ContinuousIntegrationBuild=true
+
+      - name: Test RiskBundle unit tests
+        run: |
+          mkdir -p $ARTIFACT_DIR
+          dotnet test src/ExportCenter/StellaOps.ExportCenter/StellaOps.ExportCenter.Tests/StellaOps.ExportCenter.Tests.csproj \
+            -c Release \
+            --filter "FullyQualifiedName~RiskBundle" \
+            --logger "trx;LogFileName=risk-bundle-tests.trx" \
+            --results-directory $ARTIFACT_DIR
+
+      - name: Build risk bundle (fixtures)
+        run: |
+          mkdir -p $BUNDLE_OUTPUT
+          ops/devops/risk-bundle/build-bundle.sh --output "$BUNDLE_OUTPUT" --fixtures-only
+
+      - name: Verify bundle integrity
+        run: ops/devops/risk-bundle/verify-bundle.sh "$BUNDLE_OUTPUT/risk-bundle.tar.gz"
+
+      - name: Generate checksums
+        run: |
+          cd $BUNDLE_OUTPUT
+          sha256sum risk-bundle.tar.gz > risk-bundle.tar.gz.sha256
+          sha256sum manifest.json > manifest.json.sha256
+          cat risk-bundle.tar.gz.sha256 manifest.json.sha256 > checksums.txt
+          echo "Bundle checksums:"
+          cat checksums.txt
+
+      - name: Upload risk bundle artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: risk-bundle-artifacts
+          path: |
+            ${{ env.BUNDLE_OUTPUT }}/risk-bundle.tar.gz
+            ${{ env.BUNDLE_OUTPUT }}/risk-bundle.tar.gz.sig
+            ${{ env.BUNDLE_OUTPUT }}/manifest.json
+            ${{ env.BUNDLE_OUTPUT }}/checksums.txt
+            ${{ env.ARTIFACT_DIR }}/*.trx
+
+      - name: Upload test results
+        uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: risk-bundle-test-results
+          path: ${{ env.ARTIFACT_DIR }}/*.trx
+
+  risk-bundle-offline-kit:
+    runs-on: ubuntu-22.04
+    needs: risk-bundle-build
+    env:
+      ARTIFACT_DIR: ${{ github.workspace }}/.artifacts
+      OFFLINE_KIT_DIR: ${{ github.workspace }}/.artifacts/offline-kit
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Download risk bundle artifacts
+        uses: actions/download-artifact@v4
+        with:
+          name: risk-bundle-artifacts
+          path: ${{ env.ARTIFACT_DIR }}
+
+      - name: Package for offline kit
+        run: |
+          mkdir -p $OFFLINE_KIT_DIR/risk-bundles
+          cp $ARTIFACT_DIR/risk-bundle.tar.gz $OFFLINE_KIT_DIR/risk-bundles/
+          cp $ARTIFACT_DIR/risk-bundle.tar.gz.sig $OFFLINE_KIT_DIR/risk-bundles/ 2>/dev/null || true
+          cp $ARTIFACT_DIR/manifest.json $OFFLINE_KIT_DIR/risk-bundles/
+          cp $ARTIFACT_DIR/checksums.txt $OFFLINE_KIT_DIR/risk-bundles/
+
+          # Create offline kit manifest entry
+          cat > $OFFLINE_KIT_DIR/risk-bundles/kit-manifest.json <<EOF
+          {
+            "component": "risk-bundle",
+            "version": "$(date -u +%Y%m%d-%H%M%S)",
+            "files": [
+              {"path": "risk-bundle.tar.gz", "checksum_file": "risk-bundle.tar.gz.sha256"},
+              {"path": "manifest.json", "checksum_file": "manifest.json.sha256"}
+            ],
+            "verification": {
+              "checksums": "checksums.txt",
+              "signature": "risk-bundle.tar.gz.sig"
+            }
+          }
+          EOF
+
+      - name: Verify offline kit structure
+        run: |
+          echo "Offline kit structure:"
+          find $OFFLINE_KIT_DIR -type f
+          echo ""
+          echo "Checksum verification:"
+          cd $OFFLINE_KIT_DIR/risk-bundles
+          sha256sum -c checksums.txt
+
+      - name: Upload offline kit
+        uses: actions/upload-artifact@v4
+        with:
+          name: risk-bundle-offline-kit
+          path: ${{ env.OFFLINE_KIT_DIR }}
+
+  publish-checksums:
+    runs-on: ubuntu-22.04
+    needs: risk-bundle-build
+    if: github.ref == 'refs/heads/main' && (github.event_name == 'push' || github.event.inputs.publish_checksums == 'true')
+    env:
+      ARTIFACT_DIR: ${{ github.workspace }}/.artifacts
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Download risk bundle artifacts
+        uses: actions/download-artifact@v4
+        with:
+          name: risk-bundle-artifacts
+          path: ${{ env.ARTIFACT_DIR }}
+
+      - name: Publish checksums
+        run: |
+          echo "Publishing checksums for risk bundle..."
+          CHECKSUM_DIR=out/checksums/risk-bundle/$(date -u +%Y-%m-%d)
+          mkdir -p $CHECKSUM_DIR
+          cp $ARTIFACT_DIR/checksums.txt $CHECKSUM_DIR/
+          cp $ARTIFACT_DIR/manifest.json $CHECKSUM_DIR/
+
+          # Create latest symlink manifest
+          cat > out/checksums/risk-bundle/latest.json <<EOF
+          {
+            "date": "$(date -u +%Y-%m-%dT%H:%M:%SZ)",
+            "path": "$(date -u +%Y-%m-%d)/checksums.txt",
+            "manifest": "$(date -u +%Y-%m-%d)/manifest.json"
+          }
+          EOF
+
+          echo "Checksums published to $CHECKSUM_DIR"
+          cat $CHECKSUM_DIR/checksums.txt
+
+      - name: Upload published checksums
+        uses: actions/upload-artifact@v4
+        with:
+          name: risk-bundle-published-checksums
+          path: out/checksums/risk-bundle/

.gitea/workflows/router-chaos.yml

@@ -0,0 +1,306 @@
+# -----------------------------------------------------------------------------
+# router-chaos.yml
+# Sprint: SPRINT_5100_0005_0001_router_chaos_suite
+# Task: T5 - CI Chaos Workflow
+# Description: CI workflow for running router chaos tests.
+# -----------------------------------------------------------------------------
+
+name: Router Chaos Tests
+
+on:
+  schedule:
+    - cron: '0 3 * * *'  # Nightly at 3 AM UTC
+  workflow_dispatch:
+    inputs:
+      spike_multiplier:
+        description: 'Load spike multiplier (e.g., 10, 50, 100)'
+        default: '10'
+        type: choice
+        options:
+          - '10'
+          - '50'
+          - '100'
+      run_valkey_tests:
+        description: 'Run Valkey failure injection tests'
+        default: true
+        type: boolean
+
+env:
+  DOTNET_NOLOGO: 1
+  DOTNET_CLI_TELEMETRY_OPTOUT: 1
+  TZ: UTC
+  ROUTER_URL: http://localhost:8080
+
+jobs:
+  load-tests:
+    runs-on: ubuntu-22.04
+    timeout-minutes: 30
+
+    services:
+      postgres:
+        image: postgres:16-alpine
+        env:
+          POSTGRES_USER: stellaops
+          POSTGRES_PASSWORD: test
+          POSTGRES_DB: stellaops_test
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+
+      valkey:
+        image: valkey/valkey:7-alpine
+        ports:
+          - 6379:6379
+        options: >-
+          --health-cmd "valkey-cli ping"
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Setup .NET
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: '10.0.100'
+          include-prerelease: true
+
+      - name: Install k6
+        run: |
+          curl -sSL https://github.com/grafana/k6/releases/download/v0.54.0/k6-v0.54.0-linux-amd64.tar.gz | tar xz
+          sudo mv k6-v0.54.0-linux-amd64/k6 /usr/local/bin/
+          k6 version
+
+      - name: Cache NuGet packages
+        uses: actions/cache@v4
+        with:
+          path: ~/.nuget/packages
+          key: chaos-nuget-${{ runner.os }}-${{ hashFiles('**/*.csproj') }}
+
+      - name: Build Router
+        run: |
+          dotnet restore src/Router/StellaOps.Router.WebService/StellaOps.Router.WebService.csproj
+          dotnet build src/Router/StellaOps.Router.WebService/StellaOps.Router.WebService.csproj -c Release --no-restore
+
+      - name: Start Router
+        run: |
+          dotnet run --project src/Router/StellaOps.Router.WebService/StellaOps.Router.WebService.csproj -c Release --no-build &
+          echo $! > router.pid
+
+          # Wait for router to start
+          for i in {1..30}; do
+            if curl -s http://localhost:8080/health > /dev/null 2>&1; then
+              echo "Router is ready"
+              break
+            fi
+            echo "Waiting for router... ($i/30)"
+            sleep 2
+          done
+
+      - name: Run k6 spike test
+        id: k6
+        run: |
+          mkdir -p results
+
+          k6 run src/__Tests/load/router/spike-test.js \
+            -e ROUTER_URL=${{ env.ROUTER_URL }} \
+            --out json=results/k6-results.json \
+            --summary-export results/k6-summary.json \
+            2>&1 | tee results/k6-output.txt
+
+          # Check exit code
+          if [ ${PIPESTATUS[0]} -ne 0 ]; then
+            echo "k6_status=failed" >> $GITHUB_OUTPUT
+          else
+            echo "k6_status=passed" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Upload k6 results
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: k6-results-${{ github.run_id }}
+          path: results/
+          retention-days: 30
+
+      - name: Stop Router
+        if: always()
+        run: |
+          if [ -f router.pid ]; then
+            kill $(cat router.pid) 2>/dev/null || true
+          fi
+
+  chaos-unit-tests:
+    runs-on: ubuntu-22.04
+    timeout-minutes: 20
+    needs: load-tests
+    if: always()
+
+    services:
+      postgres:
+        image: postgres:16-alpine
+        env:
+          POSTGRES_USER: stellaops
+          POSTGRES_PASSWORD: test
+          POSTGRES_DB: stellaops_test
+        ports:
+          - 5432:5432
+
+      valkey:
+        image: valkey/valkey:7-alpine
+        ports:
+          - 6379:6379
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup .NET
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: '10.0.100'
+          include-prerelease: true
+
+      - name: Build Chaos Tests
+        run: |
+          dotnet restore src/__Tests/chaos/StellaOps.Chaos.Router.Tests/StellaOps.Chaos.Router.Tests.csproj
+          dotnet build src/__Tests/chaos/StellaOps.Chaos.Router.Tests/StellaOps.Chaos.Router.Tests.csproj -c Release --no-restore
+
+      - name: Start Router for Tests
+        run: |
+          dotnet run --project src/Router/StellaOps.Router.WebService/StellaOps.Router.WebService.csproj -c Release &
+          sleep 15  # Wait for startup
+
+      - name: Run Chaos Unit Tests
+        run: |
+          dotnet test src/__Tests/chaos/StellaOps.Chaos.Router.Tests/StellaOps.Chaos.Router.Tests.csproj \
+            -c Release \
+            --no-build \
+            --logger "trx;LogFileName=chaos-results.trx" \
+            --logger "console;verbosity=detailed" \
+            --results-directory results \
+            -- RunConfiguration.TestSessionTimeout=600000
+
+      - name: Upload Test Results
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: chaos-test-results-${{ github.run_id }}
+          path: results/
+          retention-days: 30
+
+  valkey-failure-tests:
+    runs-on: ubuntu-22.04
+    timeout-minutes: 20
+    needs: load-tests
+    if: ${{ github.event.inputs.run_valkey_tests != 'false' }}
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup .NET
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: '10.0.100'
+          include-prerelease: true
+
+      - name: Install Docker Compose
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y docker-compose
+
+      - name: Run Valkey Failure Tests
+        run: |
+          dotnet test src/__Tests/chaos/StellaOps.Chaos.Router.Tests/StellaOps.Chaos.Router.Tests.csproj \
+            -c Release \
+            --filter "Category=Valkey" \
+            --logger "trx;LogFileName=valkey-results.trx" \
+            --results-directory results \
+            -- RunConfiguration.TestSessionTimeout=600000
+
+      - name: Upload Valkey Test Results
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: valkey-test-results-${{ github.run_id }}
+          path: results/
+
+  analyze-results:
+    runs-on: ubuntu-22.04
+    needs: [load-tests, chaos-unit-tests]
+    if: always()
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Download k6 Results
+        uses: actions/download-artifact@v4
+        with:
+          name: k6-results-${{ github.run_id }}
+          path: k6-results/
+
+      - name: Download Chaos Test Results
+        uses: actions/download-artifact@v4
+        with:
+          name: chaos-test-results-${{ github.run_id }}
+          path: chaos-results/
+
+      - name: Analyze Results
+        id: analysis
+        run: |
+          mkdir -p analysis
+
+          # Parse k6 summary
+          if [ -f k6-results/k6-summary.json ]; then
+            echo "=== k6 Test Summary ===" | tee analysis/summary.txt
+
+            # Extract key metrics
+            jq -r '.metrics | to_entries[] | "\(.key): \(.value)"' k6-results/k6-summary.json >> analysis/summary.txt 2>/dev/null || true
+          fi
+
+          # Check thresholds
+          THRESHOLDS_PASSED=true
+          if [ -f k6-results/k6-summary.json ]; then
+            # Check if any threshold failed
+            FAILED_THRESHOLDS=$(jq -r '.thresholds | to_entries[] | select(.value.ok == false) | .key' k6-results/k6-summary.json 2>/dev/null || echo "")
+
+            if [ -n "$FAILED_THRESHOLDS" ]; then
+              echo "Failed thresholds: $FAILED_THRESHOLDS"
+              THRESHOLDS_PASSED=false
+            fi
+          fi
+
+          echo "thresholds_passed=$THRESHOLDS_PASSED" >> $GITHUB_OUTPUT
+
+      - name: Upload Analysis
+        uses: actions/upload-artifact@v4
+        with:
+          name: chaos-analysis-${{ github.run_id }}
+          path: analysis/
+
+      - name: Create Summary
+        run: |
+          echo "## Router Chaos Test Results" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+
+          echo "### Load Test Results" >> $GITHUB_STEP_SUMMARY
+          if [ -f k6-results/k6-summary.json ]; then
+            echo "- Total Requests: $(jq -r '.metrics.http_reqs.values.count // "N/A"' k6-results/k6-summary.json)" >> $GITHUB_STEP_SUMMARY
+            echo "- Failed Rate: $(jq -r '.metrics.http_req_failed.values.rate // "N/A"' k6-results/k6-summary.json)" >> $GITHUB_STEP_SUMMARY
+          else
+            echo "- No k6 results found" >> $GITHUB_STEP_SUMMARY
+          fi
+
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "### Thresholds" >> $GITHUB_STEP_SUMMARY
+          echo "- Status: ${{ steps.analysis.outputs.thresholds_passed == 'true' && 'PASSED' || 'FAILED' }}" >> $GITHUB_STEP_SUMMARY

.gitea/workflows/scanner-analyzers-release.yml

@@ -0,0 +1,57 @@
+name: scanner-analyzers-release
+on:
+  workflow_dispatch:
+    inputs:
+      rid:
+        description: "RID (e.g., linux-x64)"
+        required: false
+        default: "linux-x64"
+
+jobs:
+  build-analyzers:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Task Pack offline bundle fixtures
+        run: python3 scripts/packs/run-fixtures-check.sh
+
+      - name: Setup .NET
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: "10.0.100"
+
+      - name: Install syft (SBOM)
+        uses: anchore/sbom-action/download-syft@v0
+
+      - name: Package PHP analyzer
+        run: |
+          chmod +x scripts/scanner/package-analyzer.sh
+          RID="${{ github.event.inputs.rid }}" scripts/scanner/package-analyzer.sh src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Php/StellaOps.Scanner.Analyzers.Lang.Php.csproj php-analyzer
+
+      - name: Package Ruby analyzer
+        run: |
+          RID="${{ github.event.inputs.rid }}" scripts/scanner/package-analyzer.sh src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Ruby/StellaOps.Scanner.Analyzers.Lang.Ruby.csproj ruby-analyzer
+
+      - name: Package Native analyzer
+        run: |
+          RID="${{ github.event.inputs.rid }}" scripts/scanner/package-analyzer.sh src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Native/StellaOps.Scanner.Analyzers.Native.csproj native-analyzer
+
+      - name: Package Java analyzer
+        run: |
+          RID="${{ github.event.inputs.rid }}" scripts/scanner/package-analyzer.sh src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Java/StellaOps.Scanner.Analyzers.Lang.Java.csproj java-analyzer
+
+      - name: Package DotNet analyzer
+        run: |
+          RID="${{ github.event.inputs.rid }}" scripts/scanner/package-analyzer.sh src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.DotNet/StellaOps.Scanner.Analyzers.Lang.DotNet.csproj dotnet-analyzer
+
+      - name: Package Node analyzer
+        run: |
+          RID="${{ github.event.inputs.rid }}" scripts/scanner/package-analyzer.sh src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Node/StellaOps.Scanner.Analyzers.Lang.Node.csproj node-analyzer
+
+      - name: Upload analyzer artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: scanner-analyzers-${{ github.event.inputs.rid }}
+          path: out/scanner-analyzers/**

.gitea/workflows/scanner-analyzers.yml

@@ -0,0 +1,133 @@
+name: Scanner Analyzers
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - 'src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.*/**'
+      - 'src/Scanner/__Tests/StellaOps.Scanner.Analyzers.*/**'
+  pull_request:
+    paths:
+      - 'src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.*/**'
+      - 'src/Scanner/__Tests/StellaOps.Scanner.Analyzers.*/**'
+  workflow_dispatch:
+
+env:
+  DOTNET_VERSION: '10.0.x'
+
+jobs:
+  discover-analyzers:
+    name: Discover Analyzers
+    runs-on: ubuntu-latest
+    outputs:
+      analyzers: ${{ steps.find.outputs.analyzers }}
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Find analyzer projects
+        id: find
+        run: |
+          ANALYZERS=$(find src/Scanner/__Libraries -name "StellaOps.Scanner.Analyzers.*.csproj" -exec dirname {} \; | xargs -I {} basename {} | sort -u | jq -R -s -c 'split("\n")[:-1]')
+          echo "analyzers=$ANALYZERS" >> $GITHUB_OUTPUT
+
+  build-analyzers:
+    name: Build Analyzers
+    runs-on: ubuntu-latest
+    needs: discover-analyzers
+    strategy:
+      fail-fast: false
+      matrix:
+        analyzer: ${{ fromJson(needs.discover-analyzers.outputs.analyzers) }}
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup .NET
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: ${{ env.DOTNET_VERSION }}
+
+      - name: Restore
+        run: dotnet restore src/Scanner/__Libraries/${{ matrix.analyzer }}/
+
+      - name: Build
+        run: dotnet build src/Scanner/__Libraries/${{ matrix.analyzer }}/ --no-restore
+
+  test-lang-analyzers:
+    name: Test Language Analyzers
+    runs-on: ubuntu-latest
+    needs: build-analyzers
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup .NET
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: ${{ env.DOTNET_VERSION }}
+
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@v1
+        with:
+          bun-version: latest
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+
+      - name: Run Bun analyzer tests
+        run: |
+          if [ -d "src/Scanner/__Tests/StellaOps.Scanner.Analyzers.Lang.Bun.Tests" ]; then
+            dotnet test src/Scanner/__Tests/StellaOps.Scanner.Analyzers.Lang.Bun.Tests/ --verbosity normal
+          fi
+
+      - name: Run Node analyzer tests
+        run: |
+          if [ -d "src/Scanner/__Tests/StellaOps.Scanner.Analyzers.Lang.Node.Tests" ]; then
+            dotnet test src/Scanner/__Tests/StellaOps.Scanner.Analyzers.Lang.Node.Tests/ --verbosity normal
+          fi
+
+  fixture-validation:
+    name: Validate Test Fixtures
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Validate fixture structure
+        run: |
+          find src/Scanner/__Tests -name "expected.json" | while read f; do
+            echo "Validating $f..."
+            if ! jq empty "$f" 2>/dev/null; then
+              echo "Error: Invalid JSON in $f"
+              exit 1
+            fi
+          done
+
+      - name: Check fixture completeness
+        run: |
+          find src/Scanner/__Tests -type d -name "Fixtures" | while read fixtures_dir; do
+            echo "Checking $fixtures_dir..."
+            find "$fixtures_dir" -mindepth 1 -maxdepth 1 -type d | while read test_case; do
+              if [ ! -f "$test_case/expected.json" ]; then
+                echo "Warning: $test_case missing expected.json"
+              fi
+            done
+          done
+
+  determinism-check:
+    name: Verify Deterministic Output
+    runs-on: ubuntu-latest
+    needs: test-lang-analyzers
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup .NET
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: ${{ env.DOTNET_VERSION }}
+
+      - name: Run determinism tests
+        run: |
+          # Run scanner on same input twice, compare outputs
+          if [ -d "src/__Tests/fixtures/determinism" ]; then
+            dotnet test --filter "Category=Determinism" --verbosity normal
+          fi

.gitea/workflows/scanner-determinism.yml

@@ -0,0 +1,29 @@
+name: scanner-determinism
+on:
+  workflow_dispatch: {}
+
+jobs:
+  determinism:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Task Pack offline bundle fixtures
+        run: python3 scripts/packs/run-fixtures-check.sh
+
+      - name: Setup .NET
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: "10.0.100"
+
+      - name: Run determinism harness
+        run: |
+          chmod +x scripts/scanner/determinism-run.sh
+          scripts/scanner/determinism-run.sh
+
+      - name: Upload determinism artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: scanner-determinism
+          path: out/scanner-determinism/**

.gitea/workflows/schema-validation.yml

@@ -0,0 +1,322 @@
+# Schema Validation CI Workflow
+# Sprint: SPRINT_8200_0001_0003_sbom_schema_validation_ci
+# Tasks: SCHEMA-8200-007 through SCHEMA-8200-011
+#
+# Purpose: Validate SBOM fixtures against official JSON schemas to detect
+# schema drift before runtime. Fails CI if any fixture is invalid.
+
+name: Schema Validation
+
+on:
+  pull_request:
+    paths:
+      - 'src/__Tests/__Benchmarks/golden-corpus/**'
+      - 'src/Scanner/**'
+      - 'docs/schemas/**'
+      - 'scripts/validate-*.sh'
+      - '.gitea/workflows/schema-validation.yml'
+  push:
+    branches: [main]
+    paths:
+      - 'src/__Tests/__Benchmarks/golden-corpus/**'
+      - 'src/Scanner/**'
+      - 'docs/schemas/**'
+      - 'scripts/validate-*.sh'
+
+env:
+  SBOM_UTILITY_VERSION: "0.16.0"
+
+jobs:
+  validate-cyclonedx:
+    name: Validate CycloneDX Fixtures
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Install sbom-utility
+        run: |
+          curl -sSfL "https://github.com/CycloneDX/sbom-utility/releases/download/v${SBOM_UTILITY_VERSION}/sbom-utility-v${SBOM_UTILITY_VERSION}-linux-amd64.tar.gz" | tar xz
+          sudo mv sbom-utility /usr/local/bin/
+          sbom-utility --version
+
+      - name: Validate CycloneDX fixtures
+        run: |
+          set -e
+          SCHEMA="docs/schemas/cyclonedx-bom-1.6.schema.json"
+          FIXTURE_DIRS=(
+            "src/__Tests/__Benchmarks/golden-corpus"
+            "src/__Tests/fixtures"
+            "seed-data"
+          )
+          
+          FOUND=0
+          PASSED=0
+          FAILED=0
+          
+          for dir in "${FIXTURE_DIRS[@]}"; do
+            if [ -d "$dir" ]; then
+              while IFS= read -r -d '' file; do
+                if grep -q '"bomFormat".*"CycloneDX"' "$file" 2>/dev/null; then
+                  FOUND=$((FOUND + 1))
+                  echo "::group::Validating: $file"
+                  if sbom-utility validate --input-file "$file" --schema "$SCHEMA" 2>&1; then
+                    echo "✅ PASS: $file"
+                    PASSED=$((PASSED + 1))
+                  else
+                    echo "❌ FAIL: $file"
+                    FAILED=$((FAILED + 1))
+                  fi
+                  echo "::endgroup::"
+                fi
+              done < <(find "$dir" -name '*.json' -type f -print0 2>/dev/null || true)
+            fi
+          done
+          
+          echo "================================================"
+          echo "CycloneDX Validation Summary"
+          echo "================================================"
+          echo "Found: $FOUND fixtures"
+          echo "Passed: $PASSED"
+          echo "Failed: $FAILED"
+          echo "================================================"
+          
+          if [ "$FAILED" -gt 0 ]; then
+            echo "::error::$FAILED CycloneDX fixtures failed validation"
+            exit 1
+          fi
+          
+          if [ "$FOUND" -eq 0 ]; then
+            echo "::warning::No CycloneDX fixtures found to validate"
+          fi
+
+  validate-spdx:
+    name: Validate SPDX Fixtures
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+
+      - name: Install SPDX tools
+        run: |
+          pip install spdx-tools
+          pip install check-jsonschema
+
+      - name: Validate SPDX fixtures
+        run: |
+          set -e
+          SCHEMA="docs/schemas/spdx-jsonld-3.0.1.schema.json"
+          FIXTURE_DIRS=(
+            "src/__Tests/__Benchmarks/golden-corpus"
+            "src/__Tests/fixtures"
+            "seed-data"
+          )
+          
+          FOUND=0
+          PASSED=0
+          FAILED=0
+          
+          for dir in "${FIXTURE_DIRS[@]}"; do
+            if [ -d "$dir" ]; then
+              while IFS= read -r -d '' file; do
+                # Check for SPDX markers
+                if grep -qE '"spdxVersion"|"@context".*spdx' "$file" 2>/dev/null; then
+                  FOUND=$((FOUND + 1))
+                  echo "::group::Validating: $file"
+                  
+                  # Try pyspdxtools first (semantic validation)
+                  if pyspdxtools validate "$file" 2>&1; then
+                    echo "✅ PASS (semantic): $file"
+                    PASSED=$((PASSED + 1))
+                  # Fall back to JSON schema validation
+                  elif check-jsonschema --schemafile "$SCHEMA" "$file" 2>&1; then
+                    echo "✅ PASS (schema): $file"
+                    PASSED=$((PASSED + 1))
+                  else
+                    echo "❌ FAIL: $file"
+                    FAILED=$((FAILED + 1))
+                  fi
+                  echo "::endgroup::"
+                fi
+              done < <(find "$dir" -name '*.json' -type f -print0 2>/dev/null || true)
+            fi
+          done
+          
+          echo "================================================"
+          echo "SPDX Validation Summary"
+          echo "================================================"
+          echo "Found: $FOUND fixtures"
+          echo "Passed: $PASSED"
+          echo "Failed: $FAILED"
+          echo "================================================"
+          
+          if [ "$FAILED" -gt 0 ]; then
+            echo "::error::$FAILED SPDX fixtures failed validation"
+            exit 1
+          fi
+          
+          if [ "$FOUND" -eq 0 ]; then
+            echo "::warning::No SPDX fixtures found to validate"
+          fi
+
+  validate-vex:
+    name: Validate OpenVEX Fixtures
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+
+      - name: Install ajv-cli
+        run: npm install -g ajv-cli ajv-formats
+
+      - name: Validate OpenVEX fixtures
+        run: |
+          set -e
+          SCHEMA="docs/schemas/openvex-0.2.0.schema.json"
+          FIXTURE_DIRS=(
+            "src/__Tests/__Benchmarks/golden-corpus"
+            "src/__Tests/__Benchmarks/vex-lattice"
+            "src/__Tests/fixtures"
+            "seed-data"
+          )
+          
+          FOUND=0
+          PASSED=0
+          FAILED=0
+          
+          for dir in "${FIXTURE_DIRS[@]}"; do
+            if [ -d "$dir" ]; then
+              while IFS= read -r -d '' file; do
+                # Check for OpenVEX markers
+                if grep -qE '"@context".*openvex|"@type".*"https://openvex' "$file" 2>/dev/null; then
+                  FOUND=$((FOUND + 1))
+                  echo "::group::Validating: $file"
+                  if ajv validate -s "$SCHEMA" -d "$file" --strict=false -c ajv-formats 2>&1; then
+                    echo "✅ PASS: $file"
+                    PASSED=$((PASSED + 1))
+                  else
+                    echo "❌ FAIL: $file"
+                    FAILED=$((FAILED + 1))
+                  fi
+                  echo "::endgroup::"
+                fi
+              done < <(find "$dir" -name '*.json' -type f -print0 2>/dev/null || true)
+            fi
+          done
+          
+          echo "================================================"
+          echo "OpenVEX Validation Summary"
+          echo "================================================"
+          echo "Found: $FOUND fixtures"
+          echo "Passed: $PASSED"
+          echo "Failed: $FAILED"
+          echo "================================================"
+          
+          if [ "$FAILED" -gt 0 ]; then
+            echo "::error::$FAILED OpenVEX fixtures failed validation"
+            exit 1
+          fi
+          
+          if [ "$FOUND" -eq 0 ]; then
+            echo "::warning::No OpenVEX fixtures found to validate"
+          fi
+
+  # Negative testing: verify that invalid fixtures are correctly rejected
+  validate-negative:
+    name: Validate Negative Test Cases
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Install sbom-utility
+        run: |
+          curl -sSfL "https://github.com/CycloneDX/sbom-utility/releases/download/v${SBOM_UTILITY_VERSION}/sbom-utility-v${SBOM_UTILITY_VERSION}-linux-amd64.tar.gz" | tar xz
+          sudo mv sbom-utility /usr/local/bin/
+          sbom-utility --version
+
+      - name: Verify invalid fixtures fail validation
+        run: |
+          set -e
+          SCHEMA="docs/schemas/cyclonedx-bom-1.6.schema.json"
+          INVALID_DIR="src/__Tests/fixtures/invalid"
+
+          if [ ! -d "$INVALID_DIR" ]; then
+            echo "::warning::No invalid fixtures directory found at $INVALID_DIR"
+            exit 0
+          fi
+
+          EXPECTED_FAILURES=0
+          ACTUAL_FAILURES=0
+          UNEXPECTED_PASSES=0
+
+          while IFS= read -r -d '' file; do
+            if grep -q '"bomFormat".*"CycloneDX"' "$file" 2>/dev/null; then
+              EXPECTED_FAILURES=$((EXPECTED_FAILURES + 1))
+              echo "::group::Testing invalid fixture: $file"
+
+              # This SHOULD fail - if it passes, that's an error
+              if sbom-utility validate --input-file "$file" --schema "$SCHEMA" 2>&1; then
+                echo "❌ UNEXPECTED PASS: $file (should have failed validation)"
+                UNEXPECTED_PASSES=$((UNEXPECTED_PASSES + 1))
+              else
+                echo "✅ EXPECTED FAILURE: $file (correctly rejected)"
+                ACTUAL_FAILURES=$((ACTUAL_FAILURES + 1))
+              fi
+              echo "::endgroup::"
+            fi
+          done < <(find "$INVALID_DIR" -name '*.json' -type f -print0 2>/dev/null || true)
+
+          echo "================================================"
+          echo "Negative Test Summary"
+          echo "================================================"
+          echo "Expected failures: $EXPECTED_FAILURES"
+          echo "Actual failures: $ACTUAL_FAILURES"
+          echo "Unexpected passes: $UNEXPECTED_PASSES"
+          echo "================================================"
+
+          if [ "$UNEXPECTED_PASSES" -gt 0 ]; then
+            echo "::error::$UNEXPECTED_PASSES invalid fixtures passed validation unexpectedly"
+            exit 1
+          fi
+
+          if [ "$EXPECTED_FAILURES" -eq 0 ]; then
+            echo "::warning::No invalid CycloneDX fixtures found for negative testing"
+          fi
+
+          echo "✅ All invalid fixtures correctly rejected by schema validation"
+
+  summary:
+    name: Validation Summary
+    runs-on: ubuntu-latest
+    needs: [validate-cyclonedx, validate-spdx, validate-vex, validate-negative]
+    if: always()
+    steps:
+      - name: Check results
+        run: |
+          echo "Schema Validation Results"
+          echo "========================="
+          echo "CycloneDX: ${{ needs.validate-cyclonedx.result }}"
+          echo "SPDX: ${{ needs.validate-spdx.result }}"
+          echo "OpenVEX: ${{ needs.validate-vex.result }}"
+          echo "Negative Tests: ${{ needs.validate-negative.result }}"
+
+          if [ "${{ needs.validate-cyclonedx.result }}" = "failure" ] || \
+             [ "${{ needs.validate-spdx.result }}" = "failure" ] || \
+             [ "${{ needs.validate-vex.result }}" = "failure" ] || \
+             [ "${{ needs.validate-negative.result }}" = "failure" ]; then
+            echo "::error::One or more schema validations failed"
+            exit 1
+          fi
+
+          echo "✅ All schema validations passed or skipped"

.gitea/workflows/sdk-generator.yml

@@ -0,0 +1,38 @@
+name: sdk-generator-smoke
+
+on:
+  push:
+    paths:
+      - "src/Sdk/StellaOps.Sdk.Generator/**"
+      - "package.json"
+  pull_request:
+    paths:
+      - "src/Sdk/StellaOps.Sdk.Generator/**"
+      - "package.json"
+
+jobs:
+  sdk-smoke:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Task Pack offline bundle fixtures
+        run: python3 scripts/packs/run-fixtures-check.sh
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: "18"
+
+      - name: Setup Java 21
+        uses: actions/setup-java@v4
+        with:
+          distribution: temurin
+          java-version: "21"
+
+      - name: Install npm deps (scripts only)
+        run: npm install --ignore-scripts --no-progress --no-audit --no-fund
+
+      - name: Run SDK smoke suite (TS/Python/Go/Java)
+        run: npm run sdk:smoke

.gitea/workflows/sdk-publish.yml

@@ -0,0 +1,91 @@
+name: SDK Publish & Sign
+
+on:
+  pull_request:
+    paths:
+      - 'src/Sdk/**'
+      - 'ops/devops/sdk/**'
+      - 'scripts/sdk/**'
+      - '.gitea/workflows/sdk-publish.yml'
+  push:
+    branches: [ main ]
+    paths:
+      - 'src/Sdk/**'
+      - 'ops/devops/sdk/**'
+      - 'scripts/sdk/**'
+      - '.gitea/workflows/sdk-publish.yml'
+
+jobs:
+  sdk-publish:
+    runs-on: ubuntu-22.04
+    env:
+      DOTNET_NOLOGO: 1
+      DOTNET_CLI_TELEMETRY_OPTOUT: 1
+      DOTNET_SYSTEM_GLOBALIZATION_INVARIANT: 1
+      TZ: UTC
+      SDK_NUGET_SOURCE: ${{ secrets.SDK_NUGET_SOURCE || '.nuget/packages' }}
+      SDK_NUGET_API_KEY: ${{ secrets.SDK_NUGET_API_KEY }}
+      SDK_SIGNING_CERT_B64: ${{ secrets.SDK_SIGNING_CERT_B64 }}
+      SDK_SIGNING_CERT_PASSWORD: ${{ secrets.SDK_SIGNING_CERT_PASSWORD }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Task Pack offline bundle fixtures
+        run: python3 scripts/packs/run-fixtures-check.sh
+
+      - name: Setup .NET 10 RC
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: 10.0.100
+          include-prerelease: true
+
+      - name: Cache NuGet packages
+        uses: actions/cache@v4
+        with:
+          path: |
+            .nuget/packages
+          key: sdk-nuget-${{ runner.os }}-${{ hashFiles('src/Sdk/**/*.csproj') }}
+
+      - name: Restore (best effort; skipped if no csproj)
+        run: |
+          set -e
+          if compgen -G "src/Sdk/**/*.csproj" > /dev/null; then
+            dotnet restore --configfile nuget.config src/Sdk/StellaOps.Sdk.Release/StellaOps.Sdk.Release.csproj || true
+          else
+            echo "No SDK csproj present; skipping restore."
+          fi
+
+      - name: Build & Test (best effort)
+        run: |
+          set -e
+          if compgen -G "src/Sdk/**/*.csproj" > /dev/null; then
+            dotnet build src/Sdk/StellaOps.Sdk.Release/StellaOps.Sdk.Release.csproj -c Release --no-restore || true
+            if compgen -G "src/Sdk/**/__Tests/**/*.csproj" > /dev/null; then
+              dotnet test src/Sdk/**/__Tests/**/*.csproj -c Release --no-build --logger "trx;LogFileName=sdk-tests.trx" || true
+            fi
+          else
+            echo "No SDK csproj present; skipping build/test."
+          fi
+
+      - name: Sign packages (if present)
+        run: |
+          chmod +x scripts/sdk/sign-packages.sh
+          scripts/sdk/sign-packages.sh
+
+      - name: Publish packages (if present)
+        run: |
+          chmod +x scripts/sdk/publish.sh
+          scripts/sdk/publish.sh
+
+      - name: Upload SDK artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: sdk-artifacts
+          path: |
+            out/sdk
+            .nuget/packages/*.nupkg
+          if-no-files-found: warn
+          retention-days: 7

.gitea/workflows/signals-ci.yml

@@ -0,0 +1,75 @@
+name: Signals CI & Image
+
+on:
+  pull_request:
+    paths:
+      - 'src/Signals/**'
+      - '.gitea/workflows/signals-ci.yml'
+      - 'ops/devops/signals/**'
+      - 'helm/signals/**'
+      - 'scripts/signals/**'
+  push:
+    branches: [ main ]
+    paths:
+      - 'src/Signals/**'
+      - '.gitea/workflows/signals-ci.yml'
+      - 'ops/devops/signals/**'
+      - 'helm/signals/**'
+      - 'scripts/signals/**'
+
+jobs:
+  signals-ci:
+    runs-on: ubuntu-22.04
+    env:
+      DOTNET_NOLOGO: 1
+      DOTNET_CLI_TELEMETRY_OPTOUT: 1
+      DOTNET_SYSTEM_GLOBALIZATION_INVARIANT: 1
+      TZ: UTC
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Task Pack offline bundle fixtures
+        run: python3 scripts/packs/run-fixtures-check.sh
+
+      - name: Setup .NET 10 RC
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: 10.0.100
+          include-prerelease: true
+
+      - name: Cache NuGet packages
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.nuget/packages
+            .nuget/packages
+          key: signals-nuget-${{ runner.os }}-${{ hashFiles('src/Signals/**/*.csproj') }}
+
+      - name: Restore
+        run: dotnet restore src/Signals/StellaOps.Signals.sln --configfile nuget.config
+
+      - name: Build
+        run: dotnet build src/Signals/StellaOps.Signals.sln -c Release --no-restore
+
+      - name: Test
+        run: dotnet test src/Signals/__Tests/StellaOps.Signals.Tests/StellaOps.Signals.Tests.csproj -c Release --no-build --logger "trx;LogFileName=signals-tests.trx"
+
+      - name: Publish service
+        run: dotnet publish src/Signals/StellaOps.Signals/StellaOps.Signals.csproj -c Release -o out/signals/publish --no-build
+
+      - name: Build container image
+        run: |
+          chmod +x scripts/signals/build.sh
+          scripts/signals/build.sh
+
+      - name: Upload artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: signals-offline-kit
+          path: |
+            out/signals
+            out/signals/signals-image.tar
+          retention-days: 7

.gitea/workflows/signals-dsse-sign.yml

@@ -0,0 +1,183 @@
+name: Signals DSSE Sign & Evidence Locker
+
+on:
+  workflow_dispatch:
+    inputs:
+      out_dir:
+        description: "Output directory for signed artifacts"
+        required: false
+        default: "evidence-locker/signals/2025-12-01"
+      allow_dev_key:
+        description: "Allow dev key for testing (1=yes, 0=no)"
+        required: false
+        default: "0"
+  push:
+    branches: [main]
+    paths:
+      - 'docs/modules/signals/decay/**'
+      - 'docs/modules/signals/unknowns/**'
+      - 'docs/modules/signals/heuristics/**'
+      - 'docs/modules/signals/SHA256SUMS'
+      - 'tools/cosign/sign-signals.sh'
+
+jobs:
+  sign-signals-artifacts:
+    runs-on: ubuntu-22.04
+    env:
+      COSIGN_PRIVATE_KEY_B64: ${{ secrets.COSIGN_PRIVATE_KEY_B64 }}
+      COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
+      OUT_DIR: ${{ github.event.inputs.out_dir || 'evidence-locker/signals/2025-12-01' }}
+      COSIGN_ALLOW_DEV_KEY: ${{ github.event.inputs.allow_dev_key || '0' }}
+      CI_EVIDENCE_LOCKER_TOKEN: ${{ secrets.CI_EVIDENCE_LOCKER_TOKEN || vars.CI_EVIDENCE_LOCKER_TOKEN }}
+      EVIDENCE_LOCKER_URL: ${{ secrets.EVIDENCE_LOCKER_URL || vars.EVIDENCE_LOCKER_URL }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Task Pack offline bundle fixtures
+        run: python3 scripts/packs/run-fixtures-check.sh
+
+      - name: Install cosign
+        uses: sigstore/cosign-installer@v3
+        with:
+          cosign-release: 'v2.2.4'
+
+      - name: Check signing key configured
+        run: |
+          if [[ -z "$COSIGN_PRIVATE_KEY_B64" && "$COSIGN_ALLOW_DEV_KEY" != "1" ]]; then
+            echo "::error::COSIGN_PRIVATE_KEY_B64 is missing and dev key fallback is disabled. Set COSIGN_PRIVATE_KEY_B64 (and COSIGN_PASSWORD if needed) or rerun with allow_dev_key=1 for smoke only."
+            exit 1
+          fi
+          if [[ "$COSIGN_ALLOW_DEV_KEY" == "1" ]]; then
+            echo "::notice::Using dev key for signing (allow_dev_key=1) - not suitable for production uploads."
+          fi
+
+      - name: Verify artifacts exist
+        run: |
+          cd docs/modules/signals
+          sha256sum -c SHA256SUMS
+          echo "All artifacts verified against SHA256SUMS"
+
+      - name: Check signing key availability
+        id: check-key
+        run: |
+          if [[ -n "$COSIGN_PRIVATE_KEY_B64" ]]; then
+            echo "key_source=ci_secret" >> "$GITHUB_OUTPUT"
+            echo "Signing key available via CI secret"
+          elif [[ "$COSIGN_ALLOW_DEV_KEY" == "1" ]]; then
+            echo "key_source=dev_key" >> "$GITHUB_OUTPUT"
+            echo "[warn] Using development key - NOT for production Evidence Locker"
+          else
+            echo "key_source=none" >> "$GITHUB_OUTPUT"
+            echo "::error::No signing key available. Set COSIGN_PRIVATE_KEY_B64 secret or enable dev key."
+            exit 1
+          fi
+
+      - name: Sign signals artifacts
+        run: |
+          chmod +x tools/cosign/sign-signals.sh
+          OUT_DIR="${OUT_DIR}" tools/cosign/sign-signals.sh
+
+      - name: Verify signatures
+        run: |
+          cd "$OUT_DIR"
+          # List generated artifacts
+          echo "=== Generated Artifacts ==="
+          ls -la
+          echo ""
+          echo "=== SHA256SUMS ==="
+          cat SHA256SUMS
+
+      - name: Upload signed artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: signals-dsse-signed-${{ github.run_number }}
+          path: |
+            ${{ env.OUT_DIR }}/*.sigstore.json
+            ${{ env.OUT_DIR }}/*.dsse
+            ${{ env.OUT_DIR }}/SHA256SUMS
+          if-no-files-found: error
+          retention-days: 90
+
+      - name: Push to Evidence Locker
+        if: ${{ env.CI_EVIDENCE_LOCKER_TOKEN != '' && env.EVIDENCE_LOCKER_URL != '' }}
+        env:
+          TOKEN: ${{ env.CI_EVIDENCE_LOCKER_TOKEN }}
+          URL: ${{ env.EVIDENCE_LOCKER_URL }}
+        run: |
+          tar -cf /tmp/signals-dsse.tar -C "$OUT_DIR" .
+          curl -f -X PUT "$URL/signals/dsse/$(date -u +%Y-%m-%d)/signals-dsse.tar" \
+            -H "Authorization: Bearer $TOKEN" \
+            --data-binary @/tmp/signals-dsse.tar
+          echo "Pushed to Evidence Locker"
+
+      - name: Evidence Locker skip notice
+        if: ${{ env.CI_EVIDENCE_LOCKER_TOKEN == '' || env.EVIDENCE_LOCKER_URL == '' }}
+        run: |
+          echo "::notice::Evidence Locker push skipped (CI_EVIDENCE_LOCKER_TOKEN or EVIDENCE_LOCKER_URL not set)"
+          echo "Artifacts available as workflow artifact for manual ingestion"
+
+  verify-signatures:
+    runs-on: ubuntu-22.04
+    needs: sign-signals-artifacts
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Download signed artifacts
+        uses: actions/download-artifact@v4
+        with:
+          name: signals-dsse-signed-${{ github.run_number }}
+          path: signed-artifacts/
+
+      - name: Install cosign
+        uses: sigstore/cosign-installer@v3
+        with:
+          cosign-release: 'v2.2.4'
+
+      - name: Verify decay config signature
+        run: |
+          if [[ -f signed-artifacts/confidence_decay_config.sigstore.json ]]; then
+            cosign verify-blob \
+              --key tools/cosign/cosign.dev.pub \
+              --bundle signed-artifacts/confidence_decay_config.sigstore.json \
+              docs/modules/signals/decay/confidence_decay_config.yaml \
+              && echo "✓ decay config signature verified" \
+              || echo "::warning::Signature verification failed (may need production public key)"
+          fi
+
+      - name: Verify unknowns manifest signature
+        run: |
+          if [[ -f signed-artifacts/unknowns_scoring_manifest.sigstore.json ]]; then
+            cosign verify-blob \
+              --key tools/cosign/cosign.dev.pub \
+              --bundle signed-artifacts/unknowns_scoring_manifest.sigstore.json \
+              docs/modules/signals/unknowns/unknowns_scoring_manifest.json \
+              && echo "✓ unknowns manifest signature verified" \
+              || echo "::warning::Signature verification failed (may need production public key)"
+          fi
+
+      - name: Verify heuristics catalog signature
+        run: |
+          if [[ -f signed-artifacts/heuristics_catalog.sigstore.json ]]; then
+            cosign verify-blob \
+              --key tools/cosign/cosign.dev.pub \
+              --bundle signed-artifacts/heuristics_catalog.sigstore.json \
+              docs/modules/signals/heuristics/heuristics.catalog.json \
+              && echo "✓ heuristics catalog signature verified" \
+              || echo "::warning::Signature verification failed (may need production public key)"
+          fi
+
+      - name: Summary
+        run: |
+          echo "## Signals DSSE Signing Summary" >> "$GITHUB_STEP_SUMMARY"
+          echo "" >> "$GITHUB_STEP_SUMMARY"
+          echo "| Artifact | Status |" >> "$GITHUB_STEP_SUMMARY"
+          echo "|----------|--------|" >> "$GITHUB_STEP_SUMMARY"
+          for f in signed-artifacts/*.sigstore.json signed-artifacts/*.dsse; do
+            [[ -f "$f" ]] && echo "| $(basename $f) | ✓ Signed |" >> "$GITHUB_STEP_SUMMARY"
+          done
+          echo "" >> "$GITHUB_STEP_SUMMARY"
+          echo "Run ID: ${{ github.run_number }}" >> "$GITHUB_STEP_SUMMARY"

.gitea/workflows/signals-evidence-locker.yml

@@ -0,0 +1,106 @@
+name: signals-evidence-locker
+on:
+  workflow_dispatch:
+    inputs:
+      out_dir:
+        description: "Output directory containing signed artifacts"
+        required: false
+        default: "evidence-locker/signals/2025-12-05"
+      allow_dev_key:
+        description: "Allow dev key fallback (1=yes, 0=no)"
+        required: false
+        default: "0"
+      retention_target:
+        description: "Retention days target"
+        required: false
+        default: "180"
+
+jobs:
+  prepare-signals-evidence:
+    runs-on: ubuntu-latest
+    env:
+      MODULE_ROOT: docs/modules/signals
+      OUT_DIR: ${{ github.event.inputs.out_dir || 'evidence-locker/signals/2025-12-05' }}
+      COSIGN_ALLOW_DEV_KEY: ${{ github.event.inputs.allow_dev_key || '0' }}
+      COSIGN_PRIVATE_KEY_B64: ${{ secrets.COSIGN_PRIVATE_KEY_B64 }}
+      COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
+      EVIDENCE_LOCKER_URL: ${{ secrets.EVIDENCE_LOCKER_URL || vars.EVIDENCE_LOCKER_URL }}
+      CI_EVIDENCE_LOCKER_TOKEN: ${{ secrets.CI_EVIDENCE_LOCKER_TOKEN || vars.CI_EVIDENCE_LOCKER_TOKEN }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Task Pack offline bundle fixtures
+        run: python3 scripts/packs/run-fixtures-check.sh
+
+      - name: Install cosign
+        uses: sigstore/cosign-installer@v3
+        with:
+          cosign-release: 'v2.2.4'
+
+      - name: Check signing key configured
+        run: |
+          if [[ -z "$COSIGN_PRIVATE_KEY_B64" && "$COSIGN_ALLOW_DEV_KEY" != "1" ]]; then
+            echo "::error::COSIGN_PRIVATE_KEY_B64 is missing and dev key fallback is disabled. Set COSIGN_PRIVATE_KEY_B64 (and COSIGN_PASSWORD if needed) or rerun with allow_dev_key=1 for smoke only."
+            exit 1
+          fi
+          if [[ "$COSIGN_ALLOW_DEV_KEY" == "1" ]]; then
+            echo "::notice::Using dev key for signing (allow_dev_key=1) - not suitable for production uploads."
+          fi
+
+      - name: Verify artifacts exist
+        run: |
+          cd "$MODULE_ROOT"
+          sha256sum -c SHA256SUMS
+
+      - name: Sign signals artifacts
+        run: |
+          chmod +x tools/cosign/sign-signals.sh
+          OUT_DIR="${OUT_DIR}" tools/cosign/sign-signals.sh
+
+      - name: Build deterministic signals evidence tar
+        run: |
+          set -euo pipefail
+          test -d "$MODULE_ROOT" || { echo "missing $MODULE_ROOT" >&2; exit 1; }
+
+          tmpdir=$(mktemp -d)
+          rsync -a --relative \
+            "$OUT_DIR/SHA256SUMS" \
+            "$OUT_DIR/confidence_decay_config.sigstore.json" \
+            "$OUT_DIR/unknowns_scoring_manifest.sigstore.json" \
+            "$OUT_DIR/heuristics_catalog.sigstore.json" \
+            "$MODULE_ROOT/decay/confidence_decay_config.yaml" \
+            "$MODULE_ROOT/unknowns/unknowns_scoring_manifest.json" \
+            "$MODULE_ROOT/heuristics/heuristics.catalog.json" \
+            "$tmpdir/"
+
+          (cd "$tmpdir/$OUT_DIR" && sha256sum --check SHA256SUMS)
+
+          tar --sort=name --mtime="UTC 1970-01-01" --owner=0 --group=0 --numeric-owner \
+            -cf /tmp/signals-evidence.tar -C "$tmpdir" .
+
+          sha256sum /tmp/signals-evidence.tar > /tmp/signals-evidence.tar.sha256
+
+      - name: Upload artifact (fallback)
+        uses: actions/upload-artifact@v4
+        with:
+          name: signals-evidence-2025-12-05
+          path: |
+            /tmp/signals-evidence.tar
+            /tmp/signals-evidence.tar.sha256
+
+      - name: Push to Evidence Locker
+        if: ${{ env.CI_EVIDENCE_LOCKER_TOKEN != '' && env.EVIDENCE_LOCKER_URL != '' }}
+        env:
+          TOKEN: ${{ env.CI_EVIDENCE_LOCKER_TOKEN }}
+          URL: ${{ env.EVIDENCE_LOCKER_URL }}
+        run: |
+          upload_path="${OUT_DIR#evidence-locker/}"
+          curl -f -X PUT "$URL/${upload_path}/signals-evidence.tar" \
+            -H "Authorization: Bearer $TOKEN" \
+            --data-binary @/tmp/signals-evidence.tar
+
+      - name: Skip push (missing secret or URL)
+        if: ${{ env.CI_EVIDENCE_LOCKER_TOKEN == '' || env.EVIDENCE_LOCKER_URL == '' }}
+        run: |
+          echo "Locker push skipped: set CI_EVIDENCE_LOCKER_TOKEN and EVIDENCE_LOCKER_URL to enable." >&2

.gitea/workflows/signals-reachability.yml

@@ -0,0 +1,127 @@
+name: Signals Reachability Scoring & Events
+
+on:
+  workflow_dispatch:
+    inputs:
+      allow_dev_key:
+        description: "Allow dev signing key fallback (1=yes, 0=no)"
+        required: false
+        default: "0"
+      evidence_out_dir:
+        description: "Evidence output dir for signing/upload"
+        required: false
+        default: "evidence-locker/signals/2025-12-05"
+  push:
+    branches: [ main ]
+    paths:
+      - 'src/Signals/**'
+      - 'scripts/signals/reachability-smoke.sh'
+      - '.gitea/workflows/signals-reachability.yml'
+      - 'tools/cosign/sign-signals.sh'
+
+jobs:
+  reachability-smoke:
+    runs-on: ubuntu-22.04
+    env:
+      DOTNET_NOLOGO: 1
+      DOTNET_CLI_TELEMETRY_OPTOUT: 1
+      DOTNET_SYSTEM_GLOBALIZATION_INVARIANT: 1
+      TZ: UTC
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Task Pack offline bundle fixtures
+        run: python3 scripts/packs/run-fixtures-check.sh
+
+      - name: Setup .NET 10 RC
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: 10.0.100
+          include-prerelease: true
+
+      - name: Restore
+        run: dotnet restore src/Signals/StellaOps.Signals.sln --configfile nuget.config
+
+      - name: Build
+        run: dotnet build src/Signals/StellaOps.Signals.sln -c Release --no-restore
+
+      - name: Reachability scoring + cache/events smoke
+        run: |
+          chmod +x scripts/signals/reachability-smoke.sh
+          scripts/signals/reachability-smoke.sh
+
+  sign-and-upload:
+    runs-on: ubuntu-22.04
+    needs: reachability-smoke
+    env:
+      COSIGN_PRIVATE_KEY_B64: ${{ secrets.COSIGN_PRIVATE_KEY_B64 }}
+      COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
+      COSIGN_ALLOW_DEV_KEY: ${{ github.event.inputs.allow_dev_key || '0' }}
+      OUT_DIR: ${{ github.event.inputs.evidence_out_dir || 'evidence-locker/signals/2025-12-05' }}
+      CI_EVIDENCE_LOCKER_TOKEN: ${{ secrets.CI_EVIDENCE_LOCKER_TOKEN || vars.CI_EVIDENCE_LOCKER_TOKEN }}
+      EVIDENCE_LOCKER_URL: ${{ secrets.EVIDENCE_LOCKER_URL || vars.EVIDENCE_LOCKER_URL }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Task Pack offline bundle fixtures
+        run: python3 scripts/packs/run-fixtures-check.sh
+
+      - name: Install cosign
+        uses: sigstore/cosign-installer@v3
+        with:
+          cosign-release: 'v2.2.4'
+
+      - name: Check signing key configured
+        run: |
+          if [[ -z "$COSIGN_PRIVATE_KEY_B64" && "$COSIGN_ALLOW_DEV_KEY" != "1" ]]; then
+            echo "::error::COSIGN_PRIVATE_KEY_B64 is missing and dev key fallback is disabled. Set COSIGN_PRIVATE_KEY_B64 (and COSIGN_PASSWORD if needed) or rerun with allow_dev_key=1 for smoke only."
+            exit 1
+          fi
+          if [[ "$COSIGN_ALLOW_DEV_KEY" == "1" ]]; then
+            echo "::notice::Using dev key for signing (allow_dev_key=1) - not suitable for production uploads."
+          fi
+
+      - name: Verify artifacts exist
+        run: |
+          cd docs/modules/signals
+          sha256sum -c SHA256SUMS
+
+      - name: Sign signals artifacts
+        run: |
+          chmod +x tools/cosign/sign-signals.sh
+          OUT_DIR="${OUT_DIR}" tools/cosign/sign-signals.sh
+
+      - name: Upload signed artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: signals-evidence-${{ github.run_number }}
+          path: |
+            ${{ env.OUT_DIR }}/*.sigstore.json
+            ${{ env.OUT_DIR }}/*.dsse
+            ${{ env.OUT_DIR }}/SHA256SUMS
+          if-no-files-found: error
+          retention-days: 30
+
+      - name: Push to Evidence Locker
+        if: ${{ env.CI_EVIDENCE_LOCKER_TOKEN != '' && env.EVIDENCE_LOCKER_URL != '' }}
+        env:
+          TOKEN: ${{ env.CI_EVIDENCE_LOCKER_TOKEN }}
+          URL: ${{ env.EVIDENCE_LOCKER_URL }}
+        run: |
+          tar -cf /tmp/signals-evidence.tar -C "$OUT_DIR" .
+          sha256sum /tmp/signals-evidence.tar
+          curl -f -X PUT "$URL/signals/$(date -u +%Y-%m-%d)/signals-evidence.tar" \
+            -H "Authorization: Bearer $TOKEN" \
+            --data-binary @/tmp/signals-evidence.tar
+          echo "Uploaded to Evidence Locker"
+
+      - name: Evidence Locker skip notice
+        if: ${{ env.CI_EVIDENCE_LOCKER_TOKEN == '' || env.EVIDENCE_LOCKER_URL == '' }}
+        run: |
+          echo "::notice::Evidence Locker upload skipped (CI_EVIDENCE_LOCKER_TOKEN or EVIDENCE_LOCKER_URL not set)"

.gitea/workflows/sm-remote-ci.yml

@@ -0,0 +1,33 @@
+name: sm-remote-ci
+
+on:
+  push:
+    paths:
+      - "src/SmRemote/**"
+      - "src/__Libraries/StellaOps.Cryptography.Plugin.SmRemote/**"
+      - "src/__Libraries/StellaOps.Cryptography.Plugin.SmRemote.Tests/**"
+      - "ops/sm-remote/**"
+      - ".gitea/workflows/sm-remote-ci.yml"
+  pull_request:
+    paths:
+      - "src/SmRemote/**"
+      - "src/__Libraries/StellaOps.Cryptography.Plugin.SmRemote/**"
+      - "src/__Libraries/StellaOps.Cryptography.Plugin.SmRemote.Tests/**"
+      - "ops/sm-remote/**"
+
+jobs:
+  build-and-test:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Setup .NET
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: 10.0.x
+      - name: Restore
+        run: dotnet restore src/__Libraries/StellaOps.Cryptography.Plugin.SmRemote.Tests/StellaOps.Cryptography.Plugin.SmRemote.Tests.csproj
+      - name: Test
+        run: dotnet test src/__Libraries/StellaOps.Cryptography.Plugin.SmRemote.Tests/StellaOps.Cryptography.Plugin.SmRemote.Tests.csproj --no-build --verbosity normal
+      - name: Publish service
+        run: dotnet publish src/SmRemote/StellaOps.SmRemote.Service/StellaOps.SmRemote.Service.csproj -c Release -o out/sm-remote

.gitea/workflows/symbols-ci.yml

@@ -0,0 +1,47 @@
+name: Symbols Server CI
+
+on:
+  push:
+    branches: [ main ]
+    paths:
+      - 'ops/devops/symbols/**'
+      - 'scripts/symbols/**'
+      - '.gitea/workflows/symbols-ci.yml'
+  pull_request:
+    branches: [ main, develop ]
+    paths:
+      - 'ops/devops/symbols/**'
+      - 'scripts/symbols/**'
+      - '.gitea/workflows/symbols-ci.yml'
+  workflow_dispatch: {}
+
+jobs:
+  symbols-smoke:
+    runs-on: ubuntu-22.04
+    env:
+      ARTIFACT_DIR: ${{ github.workspace }}/artifacts/symbols-ci
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Task Pack offline bundle fixtures
+        run: python3 scripts/packs/run-fixtures-check.sh
+
+      - name: Export OpenSSL 1.1 shim for Mongo2Go
+        run: scripts/enable-openssl11-shim.sh
+
+      - name: Run Symbols.Server smoke
+        run: |
+          set -euo pipefail
+          mkdir -p "$ARTIFACT_DIR"
+          PROJECT_NAME=symbolsci ARTIFACT_DIR="$ARTIFACT_DIR" scripts/symbols/smoke.sh
+
+      - name: Upload artifacts
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: symbols-ci
+          path: ${{ env.ARTIFACT_DIR }}
+          retention-days: 7

.gitea/workflows/symbols-release.yml

@@ -0,0 +1,41 @@
+name: Symbols Release Smoke
+
+on:
+  push:
+    tags:
+      - 'v*'
+  workflow_dispatch: {}
+
+jobs:
+  symbols-release-smoke:
+    runs-on: ubuntu-22.04
+    env:
+      ARTIFACT_DIR: ${{ github.workspace }}/artifacts/symbols-release
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Task Pack offline bundle fixtures
+        run: python3 scripts/packs/run-fixtures-check.sh
+
+      - name: Export OpenSSL 1.1 shim for Mongo2Go
+        run: scripts/enable-openssl11-shim.sh
+
+      - name: Run Symbols.Server smoke
+        env:
+          PROJECT_NAME: symbolsrelease
+          ARTIFACT_DIR: ${{ env.ARTIFACT_DIR }}
+        run: |
+          set -euo pipefail
+          mkdir -p "$ARTIFACT_DIR"
+          PROJECT_NAME="${PROJECT_NAME:-symbolsrelease}" ARTIFACT_DIR="$ARTIFACT_DIR" scripts/symbols/smoke.sh
+
+      - name: Upload artifacts
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: symbols-release
+          path: ${{ env.ARTIFACT_DIR }}
+          retention-days: 14

.gitea/workflows/test-lanes.yml

@@ -0,0 +1,358 @@
+# .gitea/workflows/test-lanes.yml
+# Lane-based test execution using standardized trait filtering
+# Implements Task 10 from SPRINT 5100.0007.0001
+
+name: Test Lanes
+
+on:
+  pull_request:
+    branches: [ main, develop ]
+    paths:
+      - 'src/**'
+      - 'src/__Tests/**'
+      - 'scripts/test-lane.sh'
+      - '.gitea/workflows/test-lanes.yml'
+  push:
+    branches: [ main ]
+  workflow_dispatch:
+    inputs:
+      run_performance:
+        description: 'Run Performance lane tests'
+        required: false
+        default: false
+        type: boolean
+      run_live:
+        description: 'Run Live lane tests (external dependencies)'
+        required: false
+        default: false
+        type: boolean
+
+env:
+  DOTNET_VERSION: '10.0.100'
+  BUILD_CONFIGURATION: Release
+  TEST_RESULTS_DIR: ${{ github.workspace }}/test-results
+
+jobs:
+  # ===========================================================================
+  # Unit Lane: Fast, isolated, deterministic tests (PR-gating)
+  # ===========================================================================
+  unit-tests:
+    name: Unit Tests
+    runs-on: ubuntu-22.04
+    timeout-minutes: 15
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Setup .NET ${{ env.DOTNET_VERSION }}
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: ${{ env.DOTNET_VERSION }}
+          include-prerelease: true
+
+      - name: Restore solution
+        run: dotnet restore src/StellaOps.sln
+
+      - name: Build solution
+        run: dotnet build src/StellaOps.sln --configuration $BUILD_CONFIGURATION --no-restore
+
+      - name: Run Unit lane tests
+        run: |
+          mkdir -p "$TEST_RESULTS_DIR"
+          chmod +x scripts/test-lane.sh
+          ./scripts/test-lane.sh Unit \
+            --logger "trx;LogFileName=unit-tests.trx" \
+            --results-directory "$TEST_RESULTS_DIR" \
+            --verbosity normal
+
+      - name: Upload Unit test results
+        uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: unit-test-results
+          path: ${{ env.TEST_RESULTS_DIR }}
+          if-no-files-found: ignore
+          retention-days: 7
+
+  # ===========================================================================
+  # Architecture Lane: Structural rule enforcement (PR-gating)
+  # ===========================================================================
+  architecture-tests:
+    name: Architecture Tests
+    runs-on: ubuntu-22.04
+    timeout-minutes: 10
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Setup .NET ${{ env.DOTNET_VERSION }}
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: ${{ env.DOTNET_VERSION }}
+          include-prerelease: true
+
+      - name: Restore architecture tests
+        run: dotnet restore src/__Tests/architecture/StellaOps.Architecture.Tests/StellaOps.Architecture.Tests.csproj
+
+      - name: Build architecture tests
+        run: dotnet build src/__Tests/architecture/StellaOps.Architecture.Tests/StellaOps.Architecture.Tests.csproj --configuration $BUILD_CONFIGURATION --no-restore
+
+      - name: Run Architecture tests
+        run: |
+          mkdir -p "$TEST_RESULTS_DIR"
+          dotnet test src/__Tests/architecture/StellaOps.Architecture.Tests/StellaOps.Architecture.Tests.csproj \
+            --configuration $BUILD_CONFIGURATION \
+            --no-build \
+            --logger "trx;LogFileName=architecture-tests.trx" \
+            --results-directory "$TEST_RESULTS_DIR" \
+            --verbosity normal
+
+      - name: Upload Architecture test results
+        uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: architecture-test-results
+          path: ${{ env.TEST_RESULTS_DIR }}
+          if-no-files-found: ignore
+          retention-days: 7
+
+  # ===========================================================================
+  # Contract Lane: API contract stability tests (PR-gating)
+  # ===========================================================================
+  contract-tests:
+    name: Contract Tests
+    runs-on: ubuntu-22.04
+    timeout-minutes: 10
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Setup .NET ${{ env.DOTNET_VERSION }}
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: ${{ env.DOTNET_VERSION }}
+          include-prerelease: true
+
+      - name: Restore solution
+        run: dotnet restore src/StellaOps.sln
+
+      - name: Build solution
+        run: dotnet build src/StellaOps.sln --configuration $BUILD_CONFIGURATION --no-restore
+
+      - name: Run Contract lane tests
+        run: |
+          mkdir -p "$TEST_RESULTS_DIR"
+          chmod +x scripts/test-lane.sh
+          ./scripts/test-lane.sh Contract \
+            --logger "trx;LogFileName=contract-tests.trx" \
+            --results-directory "$TEST_RESULTS_DIR" \
+            --verbosity normal
+
+      - name: Upload Contract test results
+        uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: contract-test-results
+          path: ${{ env.TEST_RESULTS_DIR }}
+          if-no-files-found: ignore
+          retention-days: 7
+
+  # ===========================================================================
+  # Integration Lane: Service + storage tests with Testcontainers (PR-gating)
+  # ===========================================================================
+  integration-tests:
+    name: Integration Tests
+    runs-on: ubuntu-22.04
+    timeout-minutes: 30
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Setup .NET ${{ env.DOTNET_VERSION }}
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: ${{ env.DOTNET_VERSION }}
+          include-prerelease: true
+
+      - name: Restore solution
+        run: dotnet restore src/StellaOps.sln
+
+      - name: Build solution
+        run: dotnet build src/StellaOps.sln --configuration $BUILD_CONFIGURATION --no-restore
+
+      - name: Run Integration lane tests
+        env:
+          POSTGRES_TEST_IMAGE: postgres:16-alpine
+        run: |
+          mkdir -p "$TEST_RESULTS_DIR"
+          chmod +x scripts/test-lane.sh
+          ./scripts/test-lane.sh Integration \
+            --logger "trx;LogFileName=integration-tests.trx" \
+            --results-directory "$TEST_RESULTS_DIR" \
+            --verbosity normal
+
+      - name: Upload Integration test results
+        uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: integration-test-results
+          path: ${{ env.TEST_RESULTS_DIR }}
+          if-no-files-found: ignore
+          retention-days: 7
+
+  # ===========================================================================
+  # Security Lane: AuthZ, input validation, negative tests (PR-gating)
+  # ===========================================================================
+  security-tests:
+    name: Security Tests
+    runs-on: ubuntu-22.04
+    timeout-minutes: 20
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Setup .NET ${{ env.DOTNET_VERSION }}
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: ${{ env.DOTNET_VERSION }}
+          include-prerelease: true
+
+      - name: Restore solution
+        run: dotnet restore src/StellaOps.sln
+
+      - name: Build solution
+        run: dotnet build src/StellaOps.sln --configuration $BUILD_CONFIGURATION --no-restore
+
+      - name: Run Security lane tests
+        run: |
+          mkdir -p "$TEST_RESULTS_DIR"
+          chmod +x scripts/test-lane.sh
+          ./scripts/test-lane.sh Security \
+            --logger "trx;LogFileName=security-tests.trx" \
+            --results-directory "$TEST_RESULTS_DIR" \
+            --verbosity normal
+
+      - name: Upload Security test results
+        uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: security-test-results
+          path: ${{ env.TEST_RESULTS_DIR }}
+          if-no-files-found: ignore
+          retention-days: 7
+
+  # ===========================================================================
+  # Performance Lane: Benchmarks and regression thresholds (optional/scheduled)
+  # ===========================================================================
+  performance-tests:
+    name: Performance Tests
+    runs-on: ubuntu-22.04
+    if: github.event_name == 'schedule' || (github.event_name == 'workflow_dispatch' && github.event.inputs.run_performance == 'true')
+    timeout-minutes: 30
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Setup .NET ${{ env.DOTNET_VERSION }}
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: ${{ env.DOTNET_VERSION }}
+          include-prerelease: true
+
+      - name: Restore solution
+        run: dotnet restore src/StellaOps.sln
+
+      - name: Build solution
+        run: dotnet build src/StellaOps.sln --configuration $BUILD_CONFIGURATION --no-restore
+
+      - name: Run Performance lane tests
+        run: |
+          mkdir -p "$TEST_RESULTS_DIR"
+          chmod +x scripts/test-lane.sh
+          ./scripts/test-lane.sh Performance \
+            --logger "trx;LogFileName=performance-tests.trx" \
+            --results-directory "$TEST_RESULTS_DIR" \
+            --verbosity normal
+
+      - name: Upload Performance test results
+        uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: performance-test-results
+          path: ${{ env.TEST_RESULTS_DIR }}
+          if-no-files-found: ignore
+          retention-days: 14
+
+  # ===========================================================================
+  # Live Lane: External API smoke tests (opt-in only, never PR-gating)
+  # ===========================================================================
+  live-tests:
+    name: Live Tests (External Dependencies)
+    runs-on: ubuntu-22.04
+    if: github.event_name == 'workflow_dispatch' && github.event.inputs.run_live == 'true'
+    timeout-minutes: 20
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Setup .NET ${{ env.DOTNET_VERSION }}
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: ${{ env.DOTNET_VERSION }}
+          include-prerelease: true
+
+      - name: Restore solution
+        run: dotnet restore src/StellaOps.sln
+
+      - name: Build solution
+        run: dotnet build src/StellaOps.sln --configuration $BUILD_CONFIGURATION --no-restore
+
+      - name: Run Live lane tests
+        run: |
+          mkdir -p "$TEST_RESULTS_DIR"
+          chmod +x scripts/test-lane.sh
+          ./scripts/test-lane.sh Live \
+            --logger "trx;LogFileName=live-tests.trx" \
+            --results-directory "$TEST_RESULTS_DIR" \
+            --verbosity normal
+        continue-on-error: true
+
+      - name: Upload Live test results
+        uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: live-test-results
+          path: ${{ env.TEST_RESULTS_DIR }}
+          if-no-files-found: ignore
+          retention-days: 7
+
+  # ===========================================================================
+  # Test Results Summary
+  # ===========================================================================
+  test-summary:
+    name: Test Results Summary
+    runs-on: ubuntu-22.04
+    needs: [unit-tests, architecture-tests, contract-tests, integration-tests, security-tests]
+    if: always()
+    steps:
+      - name: Download all test results
+        uses: actions/download-artifact@v4
+        with:
+          path: all-test-results
+
+      - name: Generate summary
+        run: |
+          echo "## Test Lane Results" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+
+          for lane in unit architecture contract integration security; do
+            result_dir="all-test-results/${lane}-test-results"
+            if [ -d "$result_dir" ]; then
+              echo "### ${lane^} Lane: ✅ Passed" >> $GITHUB_STEP_SUMMARY
+            else
+              echo "### ${lane^} Lane: ❌ Failed or Skipped" >> $GITHUB_STEP_SUMMARY
+            fi
+          done
+
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "See individual job logs for detailed test output." >> $GITHUB_STEP_SUMMARY

.gitea/workflows/unknowns-budget-gate.yml

@@ -0,0 +1,199 @@
+# -----------------------------------------------------------------------------
+# unknowns-budget-gate.yml
+# Sprint: SPRINT_5100_0004_0001_unknowns_budget_ci_gates
+# Task: T2 - CI Budget Gate Workflow
+# Description: Enforces unknowns budgets on PRs and pushes
+# -----------------------------------------------------------------------------
+
+name: Unknowns Budget Gate
+
+on:
+  pull_request:
+    paths:
+      - 'src/**'
+      - 'Dockerfile*'
+      - '*.lock'
+      - 'etc/policy.unknowns.yaml'
+  push:
+    branches: [main]
+    paths:
+      - 'src/**'
+      - 'Dockerfile*'
+      - '*.lock'
+
+env:
+  DOTNET_NOLOGO: 1
+  DOTNET_CLI_TELEMETRY_OPTOUT: 1
+  TZ: UTC
+  STELLAOPS_BUDGET_CONFIG: ./etc/policy.unknowns.yaml
+
+jobs:
+  scan-and-check-budget:
+    runs-on: ubuntu-22.04
+    permissions:
+      contents: read
+      pull-requests: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Setup .NET
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: '10.0.100'
+          include-prerelease: true
+
+      - name: Cache NuGet packages
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.nuget/packages
+            .nuget/packages
+          key: budget-gate-nuget-${{ runner.os }}-${{ hashFiles('**/*.csproj') }}
+
+      - name: Restore and Build CLI
+        run: |
+          dotnet restore src/Cli/StellaOps.Cli/StellaOps.Cli.csproj --configfile nuget.config
+          dotnet build src/Cli/StellaOps.Cli/StellaOps.Cli.csproj -c Release --no-restore
+
+      - name: Determine environment
+        id: env
+        run: |
+          if [[ "${{ github.ref }}" == "refs/heads/main" ]]; then
+            echo "environment=prod" >> $GITHUB_OUTPUT
+            echo "enforce=true" >> $GITHUB_OUTPUT
+          elif [[ "${{ github.event_name }}" == "pull_request" ]]; then
+            echo "environment=stage" >> $GITHUB_OUTPUT
+            echo "enforce=false" >> $GITHUB_OUTPUT
+          else
+            echo "environment=dev" >> $GITHUB_OUTPUT
+            echo "enforce=false" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Create sample verdict for testing
+        id: scan
+        run: |
+          mkdir -p out
+          # In a real scenario, this would be from stella scan
+          # For now, create a minimal verdict file
+          cat > out/verdict.json << 'EOF'
+          {
+            "unknowns": []
+          }
+          EOF
+          echo "verdict_path=out/verdict.json" >> $GITHUB_OUTPUT
+
+      - name: Check unknowns budget
+        id: budget
+        continue-on-error: true
+        run: |
+          set +e
+          dotnet run --project src/Cli/StellaOps.Cli/StellaOps.Cli.csproj -- \
+            unknowns budget check \
+            --verdict ${{ steps.scan.outputs.verdict_path }} \
+            --environment ${{ steps.env.outputs.environment }} \
+            --output json \
+            --fail-on-exceed > out/budget-result.json
+
+          EXIT_CODE=$?
+          echo "exit_code=$EXIT_CODE" >> $GITHUB_OUTPUT
+
+          if [ -f out/budget-result.json ]; then
+            # Compact JSON for output
+            RESULT=$(cat out/budget-result.json | jq -c '.')
+            echo "result=$RESULT" >> $GITHUB_OUTPUT
+          fi
+
+          exit $EXIT_CODE
+
+      - name: Upload budget report
+        uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: budget-report-${{ github.run_id }}
+          path: out/budget-result.json
+          retention-days: 30
+
+      - name: Post PR comment
+        if: github.event_name == 'pull_request' && always()
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const fs = require('fs');
+
+            let result = { isWithinBudget: true, totalUnknowns: 0 };
+            try {
+              const content = fs.readFileSync('out/budget-result.json', 'utf8');
+              result = JSON.parse(content);
+            } catch (e) {
+              console.log('Could not read budget result:', e.message);
+            }
+
+            const status = result.isWithinBudget ? ':white_check_mark:' : ':x:';
+            const env = '${{ steps.env.outputs.environment }}';
+
+            let body = `## ${status} Unknowns Budget Check
+
+| Metric | Value |
+|--------|-------|
+| Environment | ${env} |
+| Total Unknowns | ${result.totalUnknowns || 0} |
+| Budget Limit | ${result.totalLimit || 'Unlimited'} |
+| Status | ${result.isWithinBudget ? 'PASS' : 'FAIL'} |
+`;
+
+            if (result.violations && result.violations.length > 0) {
+              body += `
+### Violations
+`;
+              for (const v of result.violations) {
+                body += `- **${v.reasonCode}**: ${v.count}/${v.limit}\n`;
+              }
+            }
+
+            if (result.message) {
+              body += `\n> ${result.message}\n`;
+            }
+
+            body += `\n---\n_Generated by StellaOps Unknowns Budget Gate_`;
+
+            // Find existing comment
+            const { data: comments } = await github.rest.issues.listComments({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: context.issue.number,
+            });
+
+            const botComment = comments.find(c =>
+              c.body.includes('Unknowns Budget Check') &&
+              c.user.type === 'Bot'
+            );
+
+            if (botComment) {
+              await github.rest.issues.updateComment({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                comment_id: botComment.id,
+                body: body
+              });
+            } else {
+              await github.rest.issues.createComment({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                issue_number: context.issue.number,
+                body: body
+              });
+            }
+
+      - name: Fail if budget exceeded (prod)
+        if: steps.env.outputs.environment == 'prod' && steps.budget.outputs.exit_code == '2'
+        run: |
+          echo "::error::Production unknowns budget exceeded!"
+          exit 1
+
+      - name: Warn if budget exceeded (non-prod)
+        if: steps.env.outputs.environment != 'prod' && steps.budget.outputs.exit_code == '2'
+        run: |
+          echo "::warning::Unknowns budget exceeded for ${{ steps.env.outputs.environment }}"

.gitea/workflows/vex-proof-bundles.yml

@@ -0,0 +1,40 @@
+name: VEX Proof Bundles
+
+on:
+  pull_request:
+    paths:
+      - 'scripts/vex/**'
+      - 'src/__Tests/Vex/ProofBundles/**'
+      - 'docs/benchmarks/vex-evidence-playbook*'
+      - '.gitea/workflows/vex-proof-bundles.yml'
+  push:
+    branches: [ main ]
+    paths:
+      - 'scripts/vex/**'
+      - 'src/__Tests/Vex/ProofBundles/**'
+      - 'docs/benchmarks/vex-evidence-playbook*'
+      - '.gitea/workflows/vex-proof-bundles.yml'
+
+jobs:
+  verify-bundles:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Task Pack offline bundle fixtures
+        run: python3 scripts/packs/run-fixtures-check.sh
+
+      - name: Setup Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+
+      - name: Install deps
+        run: pip install --disable-pip-version-check --no-cache-dir -r scripts/vex/requirements.txt
+
+      - name: Verify proof bundles (offline)
+        env:
+          PYTHONHASHSEED: "0"
+        run: |
+          chmod +x src/__Tests/Vex/ProofBundles/test_verify_sample.sh
+          src/__Tests/Vex/ProofBundles/test_verify_sample.sh

.github/flaky-tests-quarantine.json

@@ -0,0 +1,12 @@
+{
+  "$schema": "https://stellaops.io/schemas/flaky-tests-quarantine.v1.json",
+  "version": "1.0.0",
+  "updated_at": "2025-01-15T00:00:00Z",
+  "policy": {
+    "consecutive_failures_to_quarantine": 2,
+    "quarantine_duration_days": 14,
+    "auto_reactivate_after_fix": true
+  },
+  "quarantined_tests": [],
+  "notes": "Tests are quarantined after 2 consecutive failures. Review and fix within 14 days or escalate."
+}

.github/workflows/examples/example-container-sign.yml

@@ -0,0 +1,145 @@
+# .github/workflows/examples/example-container-sign.yml
+# Example: Sign container image with keyless signing
+#
+# This example shows how to:
+# 1. Build a container image
+# 2. Push to registry
+# 3. Sign using StellaOps keyless signing
+# 4. Attach attestation to image
+#
+# Adapt to your repository by:
+# - Updating the registry URL
+# - Adjusting Dockerfile path
+# - Adding your specific build args
+
+name: Build and Sign Container
+
+on:
+  push:
+    branches: [main]
+    tags: ['v*']
+  pull_request:
+    branches: [main]
+
+env:
+  REGISTRY: ghcr.io
+  IMAGE_NAME: ${{ github.repository }}
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+
+    outputs:
+      digest: ${{ steps.build.outputs.digest }}
+      image: ${{ steps.build.outputs.image }}
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Log in to Container Registry
+        if: github.event_name != 'pull_request'
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Extract Metadata
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+          tags: |
+            type=ref,event=branch
+            type=ref,event=pr
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+            type=sha
+
+      - name: Build and Push
+        id: build
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          push: ${{ github.event_name != 'pull_request' }}
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+          provenance: true
+          sbom: true
+
+      - name: Output Image Digest
+        if: github.event_name != 'pull_request'
+        run: |
+          echo "digest=${{ steps.build.outputs.digest }}" >> $GITHUB_OUTPUT
+          echo "image=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}@${{ steps.build.outputs.digest }}" >> $GITHUB_OUTPUT
+
+  sign:
+    needs: build
+    if: github.event_name != 'pull_request'
+    uses: ./.github/workflows/examples/stellaops-sign.yml
+    with:
+      artifact-digest: ${{ needs.build.outputs.digest }}
+      artifact-type: image
+      push-attestation: true
+    permissions:
+      id-token: write
+      contents: read
+      packages: write
+
+  verify:
+    needs: [build, sign]
+    if: github.event_name != 'pull_request'
+    uses: ./.github/workflows/examples/stellaops-verify.yml
+    with:
+      artifact-digest: ${{ needs.build.outputs.digest }}
+      certificate-identity: 'repo:${{ github.repository }}:ref:${{ github.ref }}'
+      certificate-oidc-issuer: 'https://token.actions.githubusercontent.com'
+      require-rekor: true
+      strict: true
+    permissions:
+      contents: read
+      packages: read
+
+  summary:
+    needs: [build, sign, verify]
+    if: github.event_name != 'pull_request'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Generate Release Summary
+        run: |
+          cat >> $GITHUB_STEP_SUMMARY << EOF
+          ## Container Image Published
+
+          **Image:** \`${{ needs.build.outputs.image }}\`
+
+          ### Pull Command
+
+          \`\`\`bash
+          docker pull ${{ needs.build.outputs.image }}
+          \`\`\`
+
+          ### Verify Signature
+
+          \`\`\`bash
+          stella attest verify \\
+            --artifact "${{ needs.build.outputs.digest }}" \\
+            --certificate-identity "repo:${{ github.repository }}:ref:${{ github.ref }}" \\
+            --certificate-oidc-issuer "https://token.actions.githubusercontent.com"
+          \`\`\`
+
+          ### Attestations
+
+          | Type | Digest |
+          |------|--------|
+          | Signature | \`${{ needs.sign.outputs.attestation-digest }}\` |
+          | Rekor | \`${{ needs.sign.outputs.rekor-uuid }}\` |
+          EOF

.github/workflows/examples/example-sbom-sign.yml

@@ -0,0 +1,184 @@
+# .github/workflows/examples/example-sbom-sign.yml
+# Example: Generate and sign SBOM with keyless signing
+#
+# This example shows how to:
+# 1. Generate SBOM using Syft
+# 2. Sign the SBOM with StellaOps
+# 3. Attach SBOM attestation to container image
+#
+# The signed SBOM provides:
+# - Proof of SBOM generation time
+# - Binding to CI/CD identity (repo, branch, workflow)
+# - Transparency log entry for audit
+
+name: Generate and Sign SBOM
+
+on:
+  push:
+    branches: [main]
+    tags: ['v*']
+  workflow_dispatch:
+    inputs:
+      image:
+        description: 'Container image to scan (with digest)'
+        required: true
+        type: string
+
+env:
+  REGISTRY: ghcr.io
+  IMAGE_NAME: ${{ github.repository }}
+
+jobs:
+  generate-sbom:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: read
+
+    outputs:
+      sbom-digest: ${{ steps.sbom.outputs.digest }}
+      image-digest: ${{ steps.resolve.outputs.digest }}
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Install Syft
+        uses: anchore/sbom-action/download-syft@v0
+
+      - name: Log in to Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Resolve Image Digest
+        id: resolve
+        run: |
+          if [[ -n "${{ github.event.inputs.image }}" ]]; then
+            IMAGE="${{ github.event.inputs.image }}"
+          else
+            IMAGE="${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.ref_name }}"
+          fi
+
+          # Resolve to digest if not already
+          if [[ ! "$IMAGE" =~ @sha256: ]]; then
+            DIGEST=$(docker manifest inspect "$IMAGE" -v | jq -r '.Descriptor.digest')
+            IMAGE="${IMAGE%%:*}@${DIGEST}"
+          else
+            DIGEST="${IMAGE##*@}"
+          fi
+
+          echo "image=${IMAGE}" >> $GITHUB_OUTPUT
+          echo "digest=${DIGEST}" >> $GITHUB_OUTPUT
+          echo "Resolved image: $IMAGE"
+
+      - name: Generate SBOM
+        id: sbom
+        run: |
+          set -euo pipefail
+
+          IMAGE="${{ steps.resolve.outputs.image }}"
+          SBOM_FILE="sbom.cdx.json"
+
+          echo "::group::Generating SBOM for $IMAGE"
+          syft "$IMAGE" \
+            --output cyclonedx-json="${SBOM_FILE}" \
+            --source-name "${{ github.repository }}" \
+            --source-version "${{ github.sha }}"
+          echo "::endgroup::"
+
+          # Calculate SBOM digest
+          SBOM_DIGEST="sha256:$(sha256sum "${SBOM_FILE}" | cut -d' ' -f1)"
+          echo "digest=${SBOM_DIGEST}" >> $GITHUB_OUTPUT
+          echo "SBOM digest: ${SBOM_DIGEST}"
+
+          # Store for upload
+          echo "${SBOM_DIGEST}" > sbom-digest.txt
+
+      - name: Upload SBOM
+        uses: actions/upload-artifact@v4
+        with:
+          name: sbom
+          path: |
+            sbom.cdx.json
+            sbom-digest.txt
+          if-no-files-found: error
+
+  sign-sbom:
+    needs: generate-sbom
+    uses: ./.github/workflows/examples/stellaops-sign.yml
+    with:
+      artifact-digest: ${{ needs.generate-sbom.outputs.sbom-digest }}
+      artifact-type: sbom
+      predicate-type: 'https://cyclonedx.org/bom/1.5'
+      push-attestation: true
+    permissions:
+      id-token: write
+      contents: read
+      packages: write
+
+  attach-to-image:
+    needs: [generate-sbom, sign-sbom]
+    runs-on: ubuntu-latest
+    permissions:
+      packages: write
+
+    steps:
+      - name: Download SBOM
+        uses: actions/download-artifact@v4
+        with:
+          name: sbom
+
+      - name: Install StellaOps CLI
+        uses: stella-ops/setup-cli@v1
+
+      - name: Log in to Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Attach SBOM to Image
+        env:
+          IMAGE_DIGEST: ${{ needs.generate-sbom.outputs.image-digest }}
+          ATTESTATION_DIGEST: ${{ needs.sign-sbom.outputs.attestation-digest }}
+        run: |
+          echo "::group::Attaching SBOM attestation to image"
+          stella attest attach \
+            --image "${IMAGE_DIGEST}" \
+            --attestation "${ATTESTATION_DIGEST}" \
+            --type sbom
+          echo "::endgroup::"
+
+      - name: Summary
+        run: |
+          cat >> $GITHUB_STEP_SUMMARY << EOF
+          ## SBOM Signed and Attached
+
+          | Field | Value |
+          |-------|-------|
+          | **Image** | \`${{ needs.generate-sbom.outputs.image-digest }}\` |
+          | **SBOM Digest** | \`${{ needs.generate-sbom.outputs.sbom-digest }}\` |
+          | **Attestation** | \`${{ needs.sign-sbom.outputs.attestation-digest }}\` |
+          | **Rekor UUID** | \`${{ needs.sign-sbom.outputs.rekor-uuid }}\` |
+
+          ### Verify SBOM
+
+          \`\`\`bash
+          stella attest verify \\
+            --artifact "${{ needs.generate-sbom.outputs.sbom-digest }}" \\
+            --certificate-identity "repo:${{ github.repository }}:ref:${{ github.ref }}" \\
+            --certificate-oidc-issuer "https://token.actions.githubusercontent.com"
+          \`\`\`
+
+          ### Download SBOM
+
+          \`\`\`bash
+          stella sbom download \\
+            --image "${{ needs.generate-sbom.outputs.image-digest }}" \\
+            --output sbom.cdx.json
+          \`\`\`
+          EOF

.github/workflows/examples/example-verdict-sign.yml

@@ -0,0 +1,191 @@
+# .github/workflows/examples/example-verdict-sign.yml
+# Example: Sign policy verdict with keyless signing
+#
+# This example shows how to:
+# 1. Run StellaOps policy evaluation
+# 2. Sign the verdict with keyless signing
+# 3. Use verdict in deployment gate
+#
+# Policy verdicts provide:
+# - Cryptographic proof of policy evaluation result
+# - Binding to specific image and policy version
+# - Evidence for audit and compliance
+
+name: Policy Verdict Gate
+
+on:
+  push:
+    branches: [main]
+  workflow_dispatch:
+    inputs:
+      image:
+        description: 'Container image to evaluate (with digest)'
+        required: true
+        type: string
+      policy:
+        description: 'Policy pack ID'
+        required: false
+        default: 'default'
+        type: string
+
+env:
+  REGISTRY: ghcr.io
+  IMAGE_NAME: ${{ github.repository }}
+
+jobs:
+  evaluate:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: read
+
+    outputs:
+      verdict: ${{ steps.eval.outputs.verdict }}
+      verdict-digest: ${{ steps.eval.outputs.verdict-digest }}
+      image-digest: ${{ steps.resolve.outputs.digest }}
+      passed: ${{ steps.eval.outputs.passed }}
+
+    steps:
+      - name: Install StellaOps CLI
+        uses: stella-ops/setup-cli@v1
+
+      - name: Log in to Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Resolve Image
+        id: resolve
+        run: |
+          if [[ -n "${{ github.event.inputs.image }}" ]]; then
+            IMAGE="${{ github.event.inputs.image }}"
+          else
+            IMAGE="${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.ref_name }}"
+          fi
+
+          # Resolve to digest
+          if [[ ! "$IMAGE" =~ @sha256: ]]; then
+            DIGEST=$(docker manifest inspect "$IMAGE" -v | jq -r '.Descriptor.digest')
+            IMAGE="${IMAGE%%:*}@${DIGEST}"
+          else
+            DIGEST="${IMAGE##*@}"
+          fi
+
+          echo "image=${IMAGE}" >> $GITHUB_OUTPUT
+          echo "digest=${DIGEST}" >> $GITHUB_OUTPUT
+
+      - name: Run Policy Evaluation
+        id: eval
+        env:
+          STELLAOPS_URL: 'https://api.stella-ops.org'
+        run: |
+          set -euo pipefail
+
+          IMAGE="${{ steps.resolve.outputs.image }}"
+          POLICY="${{ github.event.inputs.policy || 'default' }}"
+
+          echo "::group::Evaluating policy '${POLICY}' against ${IMAGE}"
+          RESULT=$(stella policy evaluate \
+            --image "${IMAGE}" \
+            --policy "${POLICY}" \
+            --output json)
+          echo "$RESULT" | jq .
+          echo "::endgroup::"
+
+          # Extract verdict
+          VERDICT=$(echo "$RESULT" | jq -r '.verdict')
+          VERDICT_DIGEST=$(echo "$RESULT" | jq -r '.verdictDigest')
+          PASSED=$(echo "$RESULT" | jq -r '.passed')
+
+          echo "verdict=${VERDICT}" >> $GITHUB_OUTPUT
+          echo "verdict-digest=${VERDICT_DIGEST}" >> $GITHUB_OUTPUT
+          echo "passed=${PASSED}" >> $GITHUB_OUTPUT
+
+          # Save verdict for signing
+          echo "$RESULT" > verdict.json
+
+      - name: Upload Verdict
+        uses: actions/upload-artifact@v4
+        with:
+          name: verdict
+          path: verdict.json
+
+  sign-verdict:
+    needs: evaluate
+    uses: ./.github/workflows/examples/stellaops-sign.yml
+    with:
+      artifact-digest: ${{ needs.evaluate.outputs.verdict-digest }}
+      artifact-type: verdict
+      predicate-type: 'verdict.stella/v1'
+      push-attestation: true
+    permissions:
+      id-token: write
+      contents: read
+      packages: write
+
+  gate:
+    needs: [evaluate, sign-verdict]
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Check Verdict
+        run: |
+          PASSED="${{ needs.evaluate.outputs.passed }}"
+          VERDICT="${{ needs.evaluate.outputs.verdict }}"
+
+          if [[ "$PASSED" != "true" ]]; then
+            echo "::error::Policy verdict: ${VERDICT}"
+            echo "::error::Deployment blocked by policy"
+            exit 1
+          fi
+
+          echo "Policy verdict: ${VERDICT} - Proceeding with deployment"
+
+      - name: Summary
+        run: |
+          PASSED="${{ needs.evaluate.outputs.passed }}"
+
+          if [[ "$PASSED" == "true" ]]; then
+            ICON="white_check_mark"
+            STATUS="PASSED"
+          else
+            ICON="x"
+            STATUS="BLOCKED"
+          fi
+
+          cat >> $GITHUB_STEP_SUMMARY << EOF
+          ## :${ICON}: Policy Verdict: ${STATUS}
+
+          | Field | Value |
+          |-------|-------|
+          | **Image** | \`${{ needs.evaluate.outputs.image-digest }}\` |
+          | **Verdict** | \`${{ needs.evaluate.outputs.verdict }}\` |
+          | **Verdict Digest** | \`${{ needs.evaluate.outputs.verdict-digest }}\` |
+          | **Attestation** | \`${{ needs.sign-verdict.outputs.attestation-digest }}\` |
+          | **Rekor UUID** | \`${{ needs.sign-verdict.outputs.rekor-uuid }}\` |
+
+          ### Verify Verdict
+
+          \`\`\`bash
+          stella attest verify \\
+            --artifact "${{ needs.evaluate.outputs.verdict-digest }}" \\
+            --certificate-identity "repo:${{ github.repository }}:ref:${{ github.ref }}" \\
+            --certificate-oidc-issuer "https://token.actions.githubusercontent.com"
+          \`\`\`
+          EOF
+
+  # Example deployment job - only runs if gate passes
+  deploy:
+    needs: [evaluate, gate]
+    if: needs.evaluate.outputs.passed == 'true'
+    runs-on: ubuntu-latest
+    environment: production
+
+    steps:
+      - name: Deploy
+        run: |
+          echo "Deploying ${{ needs.evaluate.outputs.image-digest }}"
+          echo "Policy verdict verified and signed"
+          # Add your deployment commands here

.github/workflows/examples/example-verification-gate.yml

@@ -0,0 +1,175 @@
+# .github/workflows/examples/example-verification-gate.yml
+# Example: Verification gate before deployment
+#
+# This example shows how to:
+# 1. Verify all required attestations exist
+# 2. Validate identity constraints
+# 3. Block deployment on verification failure
+#
+# Use this pattern for:
+# - Production deployment gates
+# - Promotion between environments
+# - Audit compliance checkpoints
+
+name: Deployment Verification Gate
+
+on:
+  workflow_dispatch:
+    inputs:
+      image:
+        description: 'Container image to deploy (with digest)'
+        required: true
+        type: string
+      environment:
+        description: 'Target environment'
+        required: true
+        type: choice
+        options:
+          - staging
+          - production
+      require-sbom:
+        description: 'Require SBOM attestation'
+        required: false
+        default: true
+        type: boolean
+      require-verdict:
+        description: 'Require passing policy verdict'
+        required: false
+        default: true
+        type: boolean
+
+env:
+  # Identity patterns for trusted signers
+  TRUSTED_IDENTITY_STAGING: 'repo:${{ github.repository }}:ref:refs/heads/.*'
+  TRUSTED_IDENTITY_PRODUCTION: 'repo:${{ github.repository }}:ref:refs/heads/main|repo:${{ github.repository }}:ref:refs/tags/v.*'
+  TRUSTED_ISSUER: 'https://token.actions.githubusercontent.com'
+
+jobs:
+  pre-flight:
+    runs-on: ubuntu-latest
+    outputs:
+      identity-pattern: ${{ steps.config.outputs.identity-pattern }}
+
+    steps:
+      - name: Configure Identity Constraints
+        id: config
+        run: |
+          ENV="${{ github.event.inputs.environment }}"
+
+          if [[ "$ENV" == "production" ]]; then
+            echo "identity-pattern=${TRUSTED_IDENTITY_PRODUCTION}" >> $GITHUB_OUTPUT
+            echo "Using production identity constraints"
+          else
+            echo "identity-pattern=${TRUSTED_IDENTITY_STAGING}" >> $GITHUB_OUTPUT
+            echo "Using staging identity constraints"
+          fi
+
+  verify-signature:
+    needs: pre-flight
+    uses: ./.github/workflows/examples/stellaops-verify.yml
+    with:
+      artifact-digest: ${{ github.event.inputs.image }}
+      certificate-identity: ${{ needs.pre-flight.outputs.identity-pattern }}
+      certificate-oidc-issuer: 'https://token.actions.githubusercontent.com'
+      require-rekor: true
+      require-sbom: ${{ github.event.inputs.require-sbom == 'true' }}
+      require-verdict: ${{ github.event.inputs.require-verdict == 'true' }}
+      strict: true
+    permissions:
+      contents: read
+      packages: read
+
+  verify-provenance:
+    needs: pre-flight
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: read
+
+    outputs:
+      provenance-valid: ${{ steps.verify.outputs.valid }}
+
+    steps:
+      - name: Install StellaOps CLI
+        uses: stella-ops/setup-cli@v1
+
+      - name: Verify Build Provenance
+        id: verify
+        env:
+          STELLAOPS_URL: 'https://api.stella-ops.org'
+        run: |
+          set -euo pipefail
+
+          IMAGE="${{ github.event.inputs.image }}"
+
+          echo "::group::Verifying build provenance"
+          RESULT=$(stella provenance verify \
+            --artifact "${IMAGE}" \
+            --require-source-repo "${{ github.repository }}" \
+            --output json)
+          echo "$RESULT" | jq .
+          echo "::endgroup::"
+
+          VALID=$(echo "$RESULT" | jq -r '.valid')
+          echo "valid=${VALID}" >> $GITHUB_OUTPUT
+
+          if [[ "$VALID" != "true" ]]; then
+            echo "::error::Provenance verification failed"
+            exit 1
+          fi
+
+  audit-log:
+    needs: [verify-signature, verify-provenance]
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Install StellaOps CLI
+        uses: stella-ops/setup-cli@v1
+
+      - name: Create Audit Entry
+        env:
+          STELLAOPS_URL: 'https://api.stella-ops.org'
+        run: |
+          stella audit log \
+            --event "deployment-gate" \
+            --artifact "${{ github.event.inputs.image }}" \
+            --environment "${{ github.event.inputs.environment }}" \
+            --verified true \
+            --attestations "${{ needs.verify-signature.outputs.attestation-count }}" \
+            --actor "${{ github.actor }}" \
+            --workflow "${{ github.workflow }}" \
+            --run-id "${{ github.run_id }}"
+
+  deploy:
+    needs: [verify-signature, verify-provenance, audit-log]
+    runs-on: ubuntu-latest
+    environment: ${{ github.event.inputs.environment }}
+
+    steps:
+      - name: Deployment Approved
+        run: |
+          echo "All verifications passed"
+          echo "Image: ${{ github.event.inputs.image }}"
+          echo "Environment: ${{ github.event.inputs.environment }}"
+          echo ""
+          echo "Proceeding with deployment..."
+
+      # Add your deployment steps here
+      # - name: Deploy to Kubernetes
+      #   run: kubectl set image deployment/app app=${{ github.event.inputs.image }}
+
+      - name: Summary
+        run: |
+          cat >> $GITHUB_STEP_SUMMARY << EOF
+          ## Deployment Completed
+
+          | Field | Value |
+          |-------|-------|
+          | **Image** | \`${{ github.event.inputs.image }}\` |
+          | **Environment** | \`${{ github.event.inputs.environment }}\` |
+          | **Signature Verified** | ${{ needs.verify-signature.outputs.verified }} |
+          | **Provenance Verified** | ${{ needs.verify-provenance.outputs.provenance-valid }} |
+          | **Attestations** | ${{ needs.verify-signature.outputs.attestation-count }} |
+          | **Deployed By** | @${{ github.actor }} |
+          | **Workflow Run** | [#${{ github.run_id }}](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}) |
+          EOF

.github/workflows/examples/stellaops-sign.yml

@@ -0,0 +1,216 @@
+# .github/workflows/examples/stellaops-sign.yml
+# StellaOps Keyless Sign Reusable Workflow
+#
+# This reusable workflow enables keyless signing of artifacts using Sigstore Fulcio.
+# It uses OIDC identity tokens from GitHub Actions to obtain ephemeral signing certificates.
+#
+# Usage:
+#   jobs:
+#     sign:
+#       uses: stella-ops/templates/.github/workflows/stellaops-sign.yml@v1
+#       with:
+#         artifact-digest: sha256:abc123...
+#         artifact-type: image
+#       permissions:
+#         id-token: write
+#         contents: read
+#
+# Prerequisites:
+#   - StellaOps API accessible from runner
+#   - OIDC token permissions granted
+#
+# See: docs/modules/signer/guides/keyless-signing.md
+
+name: StellaOps Keyless Sign
+
+on:
+  workflow_call:
+    inputs:
+      artifact-digest:
+        description: 'SHA256 digest of artifact to sign (e.g., sha256:abc123...)'
+        required: true
+        type: string
+      artifact-type:
+        description: 'Type of artifact: image, sbom, verdict, report'
+        required: false
+        type: string
+        default: 'image'
+      stellaops-url:
+        description: 'StellaOps API URL'
+        required: false
+        type: string
+        default: 'https://api.stella-ops.org'
+      push-attestation:
+        description: 'Push attestation to OCI registry'
+        required: false
+        type: boolean
+        default: true
+      predicate-type:
+        description: 'Custom predicate type URI (optional)'
+        required: false
+        type: string
+        default: ''
+      include-rekor:
+        description: 'Log signature to Rekor transparency log'
+        required: false
+        type: boolean
+        default: true
+      cli-version:
+        description: 'StellaOps CLI version to use'
+        required: false
+        type: string
+        default: 'latest'
+    outputs:
+      attestation-digest:
+        description: 'Digest of created attestation'
+        value: ${{ jobs.sign.outputs.attestation-digest }}
+      rekor-uuid:
+        description: 'Rekor transparency log UUID (if logged)'
+        value: ${{ jobs.sign.outputs.rekor-uuid }}
+      certificate-identity:
+        description: 'OIDC identity bound to certificate'
+        value: ${{ jobs.sign.outputs.certificate-identity }}
+      signed-at:
+        description: 'Signing timestamp (UTC ISO-8601)'
+        value: ${{ jobs.sign.outputs.signed-at }}
+
+jobs:
+  sign:
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write   # Required for OIDC token
+      contents: read    # Required for checkout
+      packages: write   # Required if pushing to GHCR
+
+    outputs:
+      attestation-digest: ${{ steps.sign.outputs.attestation-digest }}
+      rekor-uuid: ${{ steps.sign.outputs.rekor-uuid }}
+      certificate-identity: ${{ steps.sign.outputs.certificate-identity }}
+      signed-at: ${{ steps.sign.outputs.signed-at }}
+
+    steps:
+      - name: Validate Inputs
+        run: |
+          if [[ ! "${{ inputs.artifact-digest }}" =~ ^sha256:[a-f0-9]{64}$ ]] && \
+             [[ ! "${{ inputs.artifact-digest }}" =~ ^sha512:[a-f0-9]{128}$ ]]; then
+            echo "::error::Invalid artifact-digest format. Expected sha256:... or sha512:..."
+            exit 1
+          fi
+
+          VALID_TYPES="image sbom verdict report binary"
+          if [[ ! " $VALID_TYPES " =~ " ${{ inputs.artifact-type }} " ]]; then
+            echo "::error::Invalid artifact-type. Must be one of: $VALID_TYPES"
+            exit 1
+          fi
+
+      - name: Install StellaOps CLI
+        uses: stella-ops/setup-cli@v1
+        with:
+          version: ${{ inputs.cli-version }}
+
+      - name: Get OIDC Token
+        id: oidc
+        run: |
+          set -euo pipefail
+
+          # Request OIDC token with sigstore audience
+          OIDC_TOKEN=$(curl -sLS "${ACTIONS_ID_TOKEN_REQUEST_URL}&audience=sigstore" \
+            -H "Authorization: bearer ${ACTIONS_ID_TOKEN_REQUEST_TOKEN}" \
+            | jq -r '.value')
+
+          if [[ -z "$OIDC_TOKEN" || "$OIDC_TOKEN" == "null" ]]; then
+            echo "::error::Failed to obtain OIDC token"
+            exit 1
+          fi
+
+          # Mask token in logs
+          echo "::add-mask::${OIDC_TOKEN}"
+          echo "token=${OIDC_TOKEN}" >> $GITHUB_OUTPUT
+
+          # Extract identity for logging (non-sensitive)
+          IDENTITY=$(echo "$OIDC_TOKEN" | cut -d. -f2 | base64 -d 2>/dev/null | jq -r '.sub // "unknown"' 2>/dev/null || echo "unknown")
+          echo "identity=${IDENTITY}" >> $GITHUB_OUTPUT
+
+      - name: Keyless Sign
+        id: sign
+        env:
+          STELLAOPS_OIDC_TOKEN: ${{ steps.oidc.outputs.token }}
+          STELLAOPS_URL: ${{ inputs.stellaops-url }}
+        run: |
+          set -euo pipefail
+
+          SIGN_ARGS=(
+            --keyless
+            --artifact "${{ inputs.artifact-digest }}"
+            --type "${{ inputs.artifact-type }}"
+            --output json
+          )
+
+          # Add optional predicate type
+          if [[ -n "${{ inputs.predicate-type }}" ]]; then
+            SIGN_ARGS+=(--predicate-type "${{ inputs.predicate-type }}")
+          fi
+
+          # Add Rekor logging option
+          if [[ "${{ inputs.include-rekor }}" == "true" ]]; then
+            SIGN_ARGS+=(--rekor)
+          fi
+
+          echo "::group::Signing artifact"
+          RESULT=$(stella attest sign "${SIGN_ARGS[@]}")
+          echo "$RESULT" | jq .
+          echo "::endgroup::"
+
+          # Extract outputs
+          ATTESTATION_DIGEST=$(echo "$RESULT" | jq -r '.attestationDigest // empty')
+          REKOR_UUID=$(echo "$RESULT" | jq -r '.rekorUuid // empty')
+          CERT_IDENTITY=$(echo "$RESULT" | jq -r '.certificateIdentity // empty')
+          SIGNED_AT=$(echo "$RESULT" | jq -r '.signedAt // empty')
+
+          if [[ -z "$ATTESTATION_DIGEST" ]]; then
+            echo "::error::Signing failed - no attestation digest returned"
+            exit 1
+          fi
+
+          echo "attestation-digest=${ATTESTATION_DIGEST}" >> $GITHUB_OUTPUT
+          echo "rekor-uuid=${REKOR_UUID}" >> $GITHUB_OUTPUT
+          echo "certificate-identity=${CERT_IDENTITY}" >> $GITHUB_OUTPUT
+          echo "signed-at=${SIGNED_AT}" >> $GITHUB_OUTPUT
+
+      - name: Push Attestation
+        if: ${{ inputs.push-attestation }}
+        env:
+          STELLAOPS_URL: ${{ inputs.stellaops-url }}
+        run: |
+          set -euo pipefail
+
+          echo "::group::Pushing attestation to registry"
+          stella attest push \
+            --attestation "${{ steps.sign.outputs.attestation-digest }}" \
+            --registry "${{ github.repository }}"
+          echo "::endgroup::"
+
+      - name: Generate Summary
+        run: |
+          cat >> $GITHUB_STEP_SUMMARY << 'EOF'
+          ## Attestation Created
+
+          | Field | Value |
+          |-------|-------|
+          | **Artifact** | `${{ inputs.artifact-digest }}` |
+          | **Type** | `${{ inputs.artifact-type }}` |
+          | **Attestation** | `${{ steps.sign.outputs.attestation-digest }}` |
+          | **Rekor UUID** | `${{ steps.sign.outputs.rekor-uuid || 'N/A' }}` |
+          | **Certificate Identity** | `${{ steps.sign.outputs.certificate-identity }}` |
+          | **Signed At** | `${{ steps.sign.outputs.signed-at }}` |
+          | **Signing Mode** | Keyless (Fulcio) |
+
+          ### Verification Command
+
+          ```bash
+          stella attest verify \
+            --artifact "${{ inputs.artifact-digest }}" \
+            --certificate-identity "${{ steps.sign.outputs.certificate-identity }}" \
+            --certificate-oidc-issuer "https://token.actions.githubusercontent.com"
+          ```
+          EOF

.github/workflows/examples/stellaops-verify.yml

@@ -0,0 +1,219 @@
+# .github/workflows/examples/stellaops-verify.yml
+# StellaOps Verification Gate Reusable Workflow
+#
+# This reusable workflow verifies attestations before deployment.
+# Use it as a gate in your CI/CD pipeline to ensure only properly
+# signed artifacts are deployed.
+#
+# Usage:
+#   jobs:
+#     verify:
+#       uses: stella-ops/templates/.github/workflows/stellaops-verify.yml@v1
+#       with:
+#         artifact-digest: sha256:abc123...
+#         certificate-identity: 'repo:myorg/myrepo:ref:refs/heads/main'
+#         certificate-oidc-issuer: 'https://token.actions.githubusercontent.com'
+#
+# See: docs/modules/signer/guides/keyless-signing.md
+
+name: StellaOps Verify Gate
+
+on:
+  workflow_call:
+    inputs:
+      artifact-digest:
+        description: 'SHA256 digest of artifact to verify'
+        required: true
+        type: string
+      stellaops-url:
+        description: 'StellaOps API URL'
+        required: false
+        type: string
+        default: 'https://api.stella-ops.org'
+      certificate-identity:
+        description: 'Expected OIDC identity pattern (supports regex)'
+        required: true
+        type: string
+      certificate-oidc-issuer:
+        description: 'Expected OIDC issuer URL'
+        required: true
+        type: string
+      require-rekor:
+        description: 'Require Rekor transparency log inclusion proof'
+        required: false
+        type: boolean
+        default: true
+      strict:
+        description: 'Fail workflow on any verification issue'
+        required: false
+        type: boolean
+        default: true
+      max-cert-age-hours:
+        description: 'Maximum age of signing certificate in hours (0 = no limit)'
+        required: false
+        type: number
+        default: 0
+      require-sbom:
+        description: 'Require SBOM attestation'
+        required: false
+        type: boolean
+        default: false
+      require-verdict:
+        description: 'Require passing policy verdict attestation'
+        required: false
+        type: boolean
+        default: false
+      cli-version:
+        description: 'StellaOps CLI version to use'
+        required: false
+        type: string
+        default: 'latest'
+    outputs:
+      verified:
+        description: 'Whether all verifications passed'
+        value: ${{ jobs.verify.outputs.verified }}
+      attestation-count:
+        description: 'Number of attestations found'
+        value: ${{ jobs.verify.outputs.attestation-count }}
+      verification-details:
+        description: 'JSON details of verification results'
+        value: ${{ jobs.verify.outputs.verification-details }}
+
+jobs:
+  verify:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: read
+
+    outputs:
+      verified: ${{ steps.verify.outputs.verified }}
+      attestation-count: ${{ steps.verify.outputs.attestation-count }}
+      verification-details: ${{ steps.verify.outputs.verification-details }}
+
+    steps:
+      - name: Validate Inputs
+        run: |
+          if [[ ! "${{ inputs.artifact-digest }}" =~ ^sha256:[a-f0-9]{64}$ ]] && \
+             [[ ! "${{ inputs.artifact-digest }}" =~ ^sha512:[a-f0-9]{128}$ ]]; then
+            echo "::error::Invalid artifact-digest format. Expected sha256:... or sha512:..."
+            exit 1
+          fi
+
+          if [[ -z "${{ inputs.certificate-identity }}" ]]; then
+            echo "::error::certificate-identity is required"
+            exit 1
+          fi
+
+          if [[ -z "${{ inputs.certificate-oidc-issuer }}" ]]; then
+            echo "::error::certificate-oidc-issuer is required"
+            exit 1
+          fi
+
+      - name: Install StellaOps CLI
+        uses: stella-ops/setup-cli@v1
+        with:
+          version: ${{ inputs.cli-version }}
+
+      - name: Verify Attestation
+        id: verify
+        env:
+          STELLAOPS_URL: ${{ inputs.stellaops-url }}
+        run: |
+          set +e  # Don't exit on error - we handle it
+
+          VERIFY_ARGS=(
+            --artifact "${{ inputs.artifact-digest }}"
+            --certificate-identity "${{ inputs.certificate-identity }}"
+            --certificate-oidc-issuer "${{ inputs.certificate-oidc-issuer }}"
+            --output json
+          )
+
+          # Add optional flags
+          if [[ "${{ inputs.require-rekor }}" == "true" ]]; then
+            VERIFY_ARGS+=(--require-rekor)
+          fi
+
+          if [[ "${{ inputs.max-cert-age-hours }}" -gt 0 ]]; then
+            VERIFY_ARGS+=(--max-cert-age-hours "${{ inputs.max-cert-age-hours }}")
+          fi
+
+          if [[ "${{ inputs.require-sbom }}" == "true" ]]; then
+            VERIFY_ARGS+=(--require-sbom)
+          fi
+
+          if [[ "${{ inputs.require-verdict }}" == "true" ]]; then
+            VERIFY_ARGS+=(--require-verdict)
+          fi
+
+          echo "::group::Verifying attestations"
+          RESULT=$(stella attest verify "${VERIFY_ARGS[@]}" 2>&1)
+          EXIT_CODE=$?
+          echo "$RESULT" | jq . 2>/dev/null || echo "$RESULT"
+          echo "::endgroup::"
+
+          set -e
+
+          # Parse results
+          VERIFIED=$(echo "$RESULT" | jq -r '.valid // false')
+          ATTESTATION_COUNT=$(echo "$RESULT" | jq -r '.attestationCount // 0')
+
+          echo "verified=${VERIFIED}" >> $GITHUB_OUTPUT
+          echo "attestation-count=${ATTESTATION_COUNT}" >> $GITHUB_OUTPUT
+          echo "verification-details=$(echo "$RESULT" | jq -c '.')" >> $GITHUB_OUTPUT
+
+          # Handle verification failure
+          if [[ "$VERIFIED" != "true" ]]; then
+            echo "::warning::Verification failed"
+
+            # Extract and report issues
+            ISSUES=$(echo "$RESULT" | jq -r '.issues[]? | "\(.code): \(.message)"' 2>/dev/null)
+            if [[ -n "$ISSUES" ]]; then
+              while IFS= read -r issue; do
+                echo "::error::$issue"
+              done <<< "$ISSUES"
+            fi
+
+            if [[ "${{ inputs.strict }}" == "true" ]]; then
+              echo "::error::Verification failed in strict mode"
+              exit 1
+            fi
+          fi
+
+      - name: Generate Summary
+        if: always()
+        run: |
+          VERIFIED="${{ steps.verify.outputs.verified }}"
+
+          if [[ "$VERIFIED" == "true" ]]; then
+            ICON="white_check_mark"
+            STATUS="Passed"
+          else
+            ICON="x"
+            STATUS="Failed"
+          fi
+
+          cat >> $GITHUB_STEP_SUMMARY << EOF
+          ## :${ICON}: Verification ${STATUS}
+
+          | Field | Value |
+          |-------|-------|
+          | **Artifact** | \`${{ inputs.artifact-digest }}\` |
+          | **Expected Identity** | \`${{ inputs.certificate-identity }}\` |
+          | **Expected Issuer** | \`${{ inputs.certificate-oidc-issuer }}\` |
+          | **Attestations Found** | ${{ steps.verify.outputs.attestation-count }} |
+          | **Rekor Required** | ${{ inputs.require-rekor }} |
+          | **Strict Mode** | ${{ inputs.strict }} |
+          EOF
+
+          # Add issues if any
+          DETAILS='${{ steps.verify.outputs.verification-details }}'
+          ISSUES=$(echo "$DETAILS" | jq -r '.issues[]? | "- **\(.code)**: \(.message)"' 2>/dev/null)
+          if [[ -n "$ISSUES" ]]; then
+            cat >> $GITHUB_STEP_SUMMARY << EOF
+
+          ### Issues
+
+          $ISSUES
+          EOF
+          fi

.github/workflows/stellaops-gate-example.yml

@@ -0,0 +1,232 @@
+# -----------------------------------------------------------------------------
+# stellaops-gate-example.yml
+# Sprint: SPRINT_20251226_001_BE_cicd_gate_integration
+# Task: CICD-GATE-07 - GitHub Actions example workflow using stella gate evaluate
+# Description: Example workflow demonstrating StellaOps release gate integration
+# -----------------------------------------------------------------------------
+#
+# This workflow demonstrates how to integrate StellaOps release gates into your
+# GitHub Actions CI/CD pipeline. The gate evaluates security drift between your
+# current build and the approved baseline, blocking releases that introduce new
+# reachable vulnerabilities.
+#
+# Prerequisites:
+# 1. StellaOps CLI installed (see setup step below)
+# 2. STELLAOPS_API_TOKEN secret configured
+# 3. Container image built and pushed to registry
+#
+# Exit codes:
+#   0 = Pass    - Release may proceed
+#   1 = Warn    - Release may proceed with warnings (configurable)
+#   2 = Fail    - Release blocked due to security policy violation
+#
+name: StellaOps Release Gate Example
+
+on:
+  push:
+    branches: [main, release/*]
+  pull_request:
+    branches: [main]
+
+env:
+  REGISTRY: ghcr.io
+  IMAGE_NAME: ${{ github.repository }}
+  STELLAOPS_BACKEND_URL: ${{ vars.STELLAOPS_BACKEND_URL || 'https://stellaops.internal' }}
+
+jobs:
+  build:
+    name: Build Container Image
+    runs-on: ubuntu-latest
+    outputs:
+      image_digest: ${{ steps.build.outputs.digest }}
+      image_ref: ${{ steps.build.outputs.image_ref }}
+
+    permissions:
+      contents: read
+      packages: write
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Log in to Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Extract metadata
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+          tags: |
+            type=sha,prefix=
+            type=ref,event=branch
+            type=ref,event=pr
+
+      - name: Build and push
+        id: build
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
+      - name: Output image reference
+        id: output
+        run: |
+          echo "digest=${{ steps.build.outputs.digest }}" >> $GITHUB_OUTPUT
+          echo "image_ref=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}@${{ steps.build.outputs.digest }}" >> $GITHUB_OUTPUT
+
+  gate:
+    name: StellaOps Release Gate
+    needs: build
+    runs-on: ubuntu-latest
+
+    # Continue on gate failure to allow override workflow
+    continue-on-error: ${{ github.event_name == 'pull_request' }}
+
+    permissions:
+      contents: read
+      id-token: write  # Required for OIDC token acquisition
+
+    outputs:
+      gate_status: ${{ steps.gate.outputs.status }}
+      gate_decision_id: ${{ steps.gate.outputs.decision_id }}
+
+    steps:
+      - name: Install StellaOps CLI
+        run: |
+          # Download and install the StellaOps CLI
+          curl -sSL https://get.stella-ops.org/cli | bash
+          echo "$HOME/.stellaops/bin" >> $GITHUB_PATH
+
+      - name: Acquire OIDC Token (Keyless)
+        id: oidc
+        if: ${{ vars.STELLAOPS_USE_KEYLESS == 'true' }}
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const token = await core.getIDToken('stellaops');
+            core.setSecret(token);
+            core.setOutput('token', token);
+
+      - name: Evaluate Release Gate
+        id: gate
+        env:
+          STELLAOPS_API_TOKEN: ${{ secrets.STELLAOPS_API_TOKEN }}
+          STELLAOPS_OIDC_TOKEN: ${{ steps.oidc.outputs.token }}
+        run: |
+          # Determine baseline strategy based on branch
+          if [[ "${{ github.ref }}" == "refs/heads/main" ]]; then
+            BASELINE="production"
+          elif [[ "${{ github.ref }}" == refs/heads/release/* ]]; then
+            BASELINE="last-approved"
+          else
+            BASELINE="previous-build"
+          fi
+
+          echo "Evaluating gate for image: ${{ needs.build.outputs.image_digest }}"
+          echo "Baseline strategy: ${BASELINE}"
+
+          # Run gate evaluation
+          # --output json provides machine-readable output
+          # --ci-context identifies the CI system for audit logging
+          RESULT=$(stella gate evaluate \
+            --image "${{ needs.build.outputs.image_digest }}" \
+            --baseline "${BASELINE}" \
+            --output json \
+            --ci-context "github-actions" \
+            --repository "${{ github.repository }}" \
+            --tag "${{ github.sha }}" \
+            2>&1) || EXIT_CODE=$?
+
+          EXIT_CODE=${EXIT_CODE:-0}
+
+          # Parse JSON output for decision details
+          DECISION_ID=$(echo "$RESULT" | jq -r '.decisionId // "unknown"')
+          STATUS=$(echo "$RESULT" | jq -r '.status // "unknown"')
+          SUMMARY=$(echo "$RESULT" | jq -r '.summary // "No summary available"')
+
+          echo "decision_id=${DECISION_ID}" >> $GITHUB_OUTPUT
+          echo "status=${STATUS}" >> $GITHUB_OUTPUT
+          echo "exit_code=${EXIT_CODE}" >> $GITHUB_OUTPUT
+
+          # Create summary
+          echo "## StellaOps Gate Evaluation" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "| Property | Value |" >> $GITHUB_STEP_SUMMARY
+          echo "|----------|-------|" >> $GITHUB_STEP_SUMMARY
+          echo "| Decision ID | \`${DECISION_ID}\` |" >> $GITHUB_STEP_SUMMARY
+          echo "| Status | **${STATUS}** |" >> $GITHUB_STEP_SUMMARY
+          echo "| Image | \`${{ needs.build.outputs.image_digest }}\` |" >> $GITHUB_STEP_SUMMARY
+          echo "| Baseline | ${BASELINE} |" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "### Summary" >> $GITHUB_STEP_SUMMARY
+          echo "${SUMMARY}" >> $GITHUB_STEP_SUMMARY
+
+          # Exit with the gate's exit code
+          exit ${EXIT_CODE}
+
+      - name: Gate Status Badge
+        if: always()
+        run: |
+          case "${{ steps.gate.outputs.status }}" in
+            Pass)
+              echo "::notice::Gate PASSED - Release may proceed"
+              ;;
+            Warn)
+              echo "::warning::Gate PASSED WITH WARNINGS - Review recommended"
+              ;;
+            Fail)
+              echo "::error::Gate BLOCKED - Security policy violation detected"
+              ;;
+          esac
+
+  deploy:
+    name: Deploy to Staging
+    needs: [build, gate]
+    if: ${{ needs.gate.outputs.gate_status == 'Pass' || needs.gate.outputs.gate_status == 'Warn' }}
+    runs-on: ubuntu-latest
+    environment: staging
+
+    steps:
+      - name: Deploy to staging
+        run: |
+          echo "Deploying ${{ needs.build.outputs.image_ref }} to staging..."
+          # Add your deployment commands here
+
+  # Optional: Manual override for blocked releases (requires elevated permissions)
+  override:
+    name: Request Gate Override
+    needs: [build, gate]
+    if: ${{ failure() && needs.gate.outputs.gate_status == 'Fail' }}
+    runs-on: ubuntu-latest
+    environment: security-override  # Requires manual approval
+
+    steps:
+      - name: Install StellaOps CLI
+        run: |
+          curl -sSL https://get.stella-ops.org/cli | bash
+          echo "$HOME/.stellaops/bin" >> $GITHUB_PATH
+
+      - name: Request Override with Justification
+        env:
+          STELLAOPS_API_TOKEN: ${{ secrets.STELLAOPS_OVERRIDE_TOKEN }}
+        run: |
+          # This requires the security-override environment approval
+          # and a separate token with override permissions
+          stella gate evaluate \
+            --image "${{ needs.build.outputs.image_digest }}" \
+            --baseline "last-approved" \
+            --allow-override \
+            --justification "Emergency release approved by ${{ github.actor }} - see PR #${{ github.event.pull_request.number }}" \
+            --ci-context "github-actions-override"

.gitignore

@@ -17,6 +17,7 @@ obj/
 # Packages and logs
 *.log
 TestResults/
+.nuget/packages/
 
 .dotnet
 .DS_Store
@@ -33,3 +34,40 @@ out/offline-kit/web/**/*
 **/dist/**/*
 tmp/**/*
 build/
+/out/cli/**
+/src/Sdk/StellaOps.Sdk.Release/out/**
+/src/Sdk/StellaOps.Sdk.Generator/out/**
+/out/scanner-analyzers/**
+
+# Node / frontend
+node_modules/
+dist/
+.build/
+.cache/
+.tmp/
+logs/
+out/
+
+# .NET
+bin/
+obj/
+
+# IDEs
+.vscode/
+.idea/
+*.user
+*.suo
+
+# Misc
+logs/
+tmp/
+coverage/
+# Consolidated NuGet cache (all variants)
+.nuget/
+.nuget-*/
+local-nuget*/
+src/Sdk/StellaOps.Sdk.Generator/tools/jdk-21.0.1+12
+
+# Test artifacts
+src/__Tests/**/TestResults/
+src/__Tests/__Benchmarks/reachability-benchmark/.jdk/