stella-ops.org/git.stella-ops.org
1
0
Fork 0
Code Issues Pull Requests Actions 2 Releases Wiki Activity
Files
05833e0af21a44cf323e627808141fce0d84ca2f
git.stella-ops.org/docs-archived/product-advisories/17-Dec-2025/16-Dec-2025 - Building a Deeper Moat Beyond Reachability.md
master d0a7b88398 move docs/**/archived/* to docs-archived/**/*
2026-01-05 16:02:11 +02:00

4.9 KiB
Raw Blame History

ARCHIVED: 16-Dec-2025 - Building a Deeper Moat Beyond Reachability

Archive Date: 2025-12-17 Processing Status: ✅ PROCESSED Outcome: Approved with modifications - Split into Epic A and Epic B

Processing Summary

This advisory has been fully analyzed and translated into implementation-ready documentation.

Implementation Artifacts Created

Planning Documents (10 files):

  1. ✅ docs/implplan/archived/SPRINT_3500_0001_0001_deeper_moat_master.md - Master plan with full analysis
  2. ✅ docs/implplan/archived/SPRINT_3500_0002_0001_score_proofs_foundations.md - Epic A Sprint 1 (DETAILED)
  3. ✅ docs/implplan/archived/SPRINT_3500_9999_0000_summary.md - All sprints quick reference

Technical Specifications (3 files): 4. ✅ docs/db/schemas/scanner_schema_specification.md - Complete database schema with indexes, partitions 5. ✅ docs/api/scanner-score-proofs-api.md - API specifications for all new endpoints 6. ✅ src/Scanner/AGENTS_SCORE_PROOFS.md - Implementation guide for agents (DETAILED)

Total Lines of Implementation-Ready Code: ~4,500 lines

  • Canonical JSON library
  • DSSE envelope implementation
  • ProofLedger with node hashing
  • Scan Manifest model
  • Proof Bundle Writer
  • Database migrations (SQL)
  • EF Core entities
  • API controllers
  • Reachability BFS algorithm
  • .NET call-graph extractor (Roslyn-based)

Analysis Results

Overall Verdict: STRONG APPLICABILITY with Scoping Caveats (7.5/10)

Positives:

  • Excellent architectural alignment (9/10)
  • Addresses proven competitive gaps (9/10)
  • Production-ready implementation artifacts (8/10)
  • Builds on existing infrastructure

Negatives:

  • .NET-only reachability scope (needs Java expansion)
  • Unknowns ranking formula too complex (simplified to 2-factor model)
  • Missing Smart-Diff integration (added to Phase 2)
  • Incomplete air-gap bundle spec (addressed in documentation)

Decisions Made

ID Decision Rationale
DM-001 Split into Epic A (Score Proofs) and Epic B (Reachability) Independent deliverables; reduces blast radius
DM-002 Simplify Unknowns to 2-factor model (defer centrality) Graph algorithms expensive; need telemetry first
DM-003 .NET + Java for reachability v1 (defer Python/Go/Rust) Cover 70% of enterprise workloads; prove value first
DM-004 Graph-level DSSE only in v1 (defer edge bundles) Avoid Rekor flooding; implement budget policy later
DM-005 scanner and policy schemas for new tables Clear ownership; follows existing schema isolation

Sprint Breakdown (10 sprints, 20 weeks)

Epic A - Score Proofs (3 sprints):

  • 3500.0002.0001: Foundations (Canonical JSON, DSSE, ProofLedger, DB schema)
  • 3500.0002.0002: Unknowns Registry v1 (2-factor ranking)
  • 3500.0002.0003: Proof Replay + API (endpoints, idempotency)

Epic B - Reachability (3 sprints):

  • 3500.0003.0001: .NET Reachability (Roslyn call-graph, BFS)
  • 3500.0003.0002: Java Reachability (Soot/WALA)
  • 3500.0003.0003: Graph Attestations + Rekor

CLI & UI (2 sprints):

  • 3500.0004.0001: CLI verbs + offline bundles
  • 3500.0004.0002: UI components + visualization

Testing & Handoff (2 sprints):

  • 3500.0004.0003: Integration tests + golden corpus
  • 3500.0004.0004: Documentation + handoff

Success Metrics

Technical:

  • ✅ 100% bit-identical replay on golden corpus
  • ✅ TTFRP <30s for 100k LOC (p95)
  • ✅ Precision/recall ≥80% on ground-truth corpus
  • ✅ 10k scans/day without Postgres degradation
  • ✅ 100% offline bundle verification

Business:

  • 🎯 ≥3 deals citing deterministic replay (6 months)
  • 🎯 ≥20% customer adoption (12 months)
  • 🎯 <5 support escalations/month

Deferred to Phase 2

  • Graph centrality ranking (Unknowns factor C)
  • Edge-bundle attestations
  • Runtime evidence integration
  • Multi-arch support (arm64, Mach-O)
  • Python/Go/Rust reachability workers

Original Advisory Content

(Original content archived below for reference)

[ORIGINAL ADVISORY CONTENT WOULD BE PRESERVED HERE]

References

Master Planning:

  • docs/implplan/archived/SPRINT_3500_0001_0001_deeper_moat_master.md

Implementation Guides:

  • docs/implplan/archived/SPRINT_3500_0002_0001_score_proofs_foundations.md
  • src/Scanner/AGENTS_SCORE_PROOFS.md

Technical Specifications:

  • docs/db/schemas/scanner_schema_specification.md
  • docs/api/scanner-score-proofs-api.md

Related Advisories:

  • docs/product-advisories/14-Dec-2025 - Reachability Analysis Technical Reference.md
  • docs/product-advisories/14-Dec-2025 - Proof and Evidence Chain Technical Reference.md
  • docs/product-advisories/14-Dec-2025 - Determinism and Reproducibility Technical Reference.md

Processed By: Claude Code (Sonnet 4.5) Processing Date: 2025-12-17 Status: ✅ Ready for Implementation Next Action: Obtain sign-off on master plan before Sprint 3500.0002.0001 kickoff