44 lines
2.8 KiB
Markdown
44 lines
2.8 KiB
Markdown
# VexTrustGate Policy Integration
|
|
|
|
## Module
|
|
Policy
|
|
|
|
## Status
|
|
IMPLEMENTED
|
|
|
|
## Description
|
|
Integrates VEX trust evaluation as a named policy gate in the policy evaluation chain. VexTrustGate validates VEX statement trust levels against configurable thresholds before accepting VEX-based risk reductions. Registered in the GateSelector alongside existing gates. Distinct from known "VEX Trust Scoring" (which computes scores) -- this gates policy decisions based on those scores.
|
|
|
|
## Implementation Details
|
|
- **VexTrustGate**: `src/Policy/StellaOps.Policy.Engine/Gates/VexTrustGate.cs` (implements `IVexTrustGate`)
|
|
- `EvaluateAsync(VexTrustGateRequest)` evaluates trust score against thresholds
|
|
- Returns VexTrustGateResult with decision (Pass/Warn/Block), details, and recommendations
|
|
- Checks: composite score >= threshold, issuer verified, accuracy rate, freshness
|
|
- **VexTrustGateOptions**: `src/Policy/StellaOps.Policy.Engine/Gates/VexTrustGateOptions.cs`
|
|
- Section key: `"Policy:Gates:VexTrust"`
|
|
- Enabled flag (default true)
|
|
- ApplyToStatuses: ["not_affected", "fixed"]
|
|
- Per-environment thresholds (production/staging/development/default)
|
|
- MissingTrustBehavior: Allow, Warn, Block
|
|
- EmitMetrics: true (OpenTelemetry)
|
|
- TenantOverrides for multi-tenant deployments
|
|
- **PolicyGateEvaluator integration**: `src/Policy/StellaOps.Policy.Engine/Gates/PolicyGateEvaluator.cs`
|
|
- VEX Trust gate is 3rd in the 5-gate sequential pipeline
|
|
- Evaluates after Evidence Completeness and Lattice State gates
|
|
- Per-environment thresholds with MissingTrustBehavior fallback
|
|
- **VexTrustGateMetrics**: `src/Policy/StellaOps.Policy.Engine/Gates/VexTrustGateMetrics.cs`
|
|
- OpenTelemetry metrics: gate decisions, trust scores, evaluation duration
|
|
- Tags: environment, decision, trust_score_bucket
|
|
|
|
## E2E Test Plan
|
|
- [ ] Evaluate VEX trust in production with score 0.85 (above 0.80 threshold); verify gate passes
|
|
- [ ] Evaluate VEX trust in production with score 0.75 (below 0.80 threshold); verify gate blocks
|
|
- [ ] Evaluate VEX trust in staging with score 0.55 (below 0.60 threshold); verify gate warns (FailureAction=Warn)
|
|
- [ ] Evaluate VEX trust in development with score 0.35 (below 0.40 threshold); verify gate warns
|
|
- [ ] Evaluate without VEX trust data, MissingTrustBehavior=Warn; verify gate warns with descriptive message
|
|
- [ ] Evaluate without VEX trust data, MissingTrustBehavior=Block; verify gate blocks
|
|
- [ ] Evaluate without VEX trust data, MissingTrustBehavior=Allow; verify gate passes
|
|
- [ ] Configure TenantOverrides for tenant-A with custom staging threshold 0.70; evaluate in staging for tenant-A; verify custom threshold used
|
|
- [ ] Verify VexTrustGateMetrics emits gate decision metric with environment and decision tags
|
|
- [ ] Disable VexTrustGate (Enabled=false); evaluate; verify gate is skipped in pipeline
|