stella-ops.org/git.stella-ops.org
1
0
Fork 0
Code Issues Pull Requests Actions 16 Releases Wiki Activity
Files
108d1c64b323808d6085fca05818fc581c6b003a
git.stella-ops.org/docs/modules/evidence-locker/replay-payload-contract.md
StellaOps Bot 600f3a7a3c
Some checks failed
AOC Guard CI / aoc-guard (push) Has been cancelled
Details
AOC Guard CI / aoc-verify (push) Has been cancelled
Details
Concelier Attestation Tests / attestation-tests (push) Has been cancelled
Details
Docs CI / lint-and-preview (push) Has been cancelled
Details
Console CI / console-ci (push) Has been cancelled
Details
Export Center CI / export-ci (push) Has been cancelled
Details
feat(graph): introduce graph.inspect.v1 contract and schema for SBOM relationships 
- Added graph.inspect.v1 documentation outlining payload structure and determinism rules.
- Created JSON schema for graph.inspect.v1 to enforce payload validation.
- Defined mapping rules for graph relationships, advisories, and VEX statements.

feat(notifications): establish remediation blueprint for gaps NR1-NR10

- Documented requirements, evidence, and tests for Notifier runtime.
- Specified deliverables and next steps for addressing identified gaps.

docs(notifications): organize operations and schemas documentation

- Created README files for operations, schemas, and security notes to clarify deliverables and policies.

feat(advisory): implement PostgreSQL caching for Link-Not-Merge linksets

- Created database schema for advisory linkset cache.
- Developed repository for managing advisory linkset cache operations.
- Added tests to ensure correct functionality of the AdvisoryLinksetCacheRepository.
2025-12-04 09:36:59 +02:00

1.8 KiB
Raw Blame History

Replay Payload Contract (Prep for PREP-EVID-REPLAY-187-001)

Status: Ready for implementation (2025-12-04 refresh for EB5) Owners: Evidence Locker Guild · Scanner Guild Scope: Define deterministic scanner record payload shape required to ingest replay bundles (Sprint 0187) and to link replay provenance into bundle manifests and attestations (EB5).

Payload shape

  • NDJSON per record; sorted by recordedAtUtc then scanId (stable ordering required by docs/replay/DETERMINISTIC_REPLAY.md).
  • Fields:
    • scanId (GUID), tenantId, subjectDigest (sha256:...), scanKind (sbom|vuln|policy),
    • startedAtUtc, completedAtUtc, recordedAtUtc (ISO-8601, UTC),
    • artifacts: array of { type: sbom|vex|log, digest, uri },
    • provenance: { dsseEnvelope, transparencyLog? } (base64 DSSE; optional Rekor entry),
    • summary: { findings: int, advisories: int, policies: int }.
  • Replay provenance (new, EB5):
    • Evidence Locker records replayProvenance in the bundle manifest with recordDigest, optional sequence, ledgerUri, dsseEnvelope, and optional transparencyLog { rekorUuid, logIndex, inclusionProof }.
    • The recordDigest is the sha256 of the canonical NDJSON content (as ingested) and becomes part of hashSummary in the manifest and the DSSE predicate.
  • Determinism: no wall-clock except the recorded timestamps above; DSSE envelope copied verbatim from scanner output; NDJSON must be UTF-8, LF line endings, and canonical key ordering per record.

Acceptance criteria

  • Scanner Guild provides sample NDJSON (10 records) with DSSE envelope redacted allowed.
  • Evidence Locker can ingest and store bundle with deterministic ordering and hash (SHA256) across runs; recomputes recordDigest to bind replayProvenance.
  • Contract published here and referenced in Sprint 0187 P1/P2/P3 and manifests/attestations per EB5.