git.stella-ops.org/src/Policy/StellaOps.Policy.Engine/TASKS.md

Policy Engine Service Task Board — Epic 2

ID	Status	Owner(s)	Depends on	Description	Exit Criteria

2025-10-26: Added policy-engine host bootstrap (config, auth client, resource server auth, readiness probe) + sample YAML and compliance readme. | POLICY-ENGINE-20-002 | BLOCKED (2025-10-26) | Policy Guild | POLICY-ENGINE-20-001 | Build deterministic evaluator honoring lexical/priority order, first-match semantics, and safe value types (no wall-clock/network access). | Evaluator executes policies deterministically in unit/property tests; guard rejects forbidden intrinsics; perf baseline recorded. | 2025-10-26: Blocked while bootstrapping DSL parser/evaluator; remaining grammar coverage (profile keywords, condition parsing) and rule evaluation semantics still pending to satisfy acceptance tests. | POLICY-ENGINE-20-003 | TODO | Policy Guild, Concelier Core Guild, Excititor Core Guild | POLICY-ENGINE-20-001, CONCELIER-POLICY-20-002, EXCITITOR-POLICY-20-002 | Implement selection joiners resolving SBOM↔advisory↔VEX tuples using linksets and PURL equivalence tables, with deterministic batching. | Joiners fetch correct candidate sets in integration tests; batching meets memory targets; explain traces list input provenance. | 2025-10-26: Scheduler DTO contracts for runs/diffs/explains available (src/Scheduler/__Libraries/StellaOps.Scheduler.Models/docs/SCHED-MODELS-20-001-POLICY-RUNS.md); consume PolicyRunRequest/Status/DiffSummary from samples under samples/api/scheduler/. 2025-10-31: Raw Concelier observations expose rawLinkset; update joiners/tests to consume it and align rollout/backfill per docs/dev/raw-linkset-backfill-plan.md. | POLICY-ENGINE-20-004 | TODO | Policy Guild, Platform Storage Guild | POLICY-ENGINE-20-003, CONCELIER-POLICY-20-003, EXCITITOR-POLICY-20-003 | Ship materialization writer that upserts into effective_finding_{policyId} with append-only history, tenant scoping, and trace references. | Writes restricted to Policy Engine identity; idempotent upserts proven via tests; collections indexed per design and docs updated. | | POLICY-ENGINE-20-005 | TODO | Policy Guild, Security Engineering | POLICY-ENGINE-20-002 | Enforce determinism guard banning wall-clock, RNG, and network usage during evaluation via static analysis + runtime sandbox. | Guard blocks forbidden APIs in unit/integration tests; violations emit ERR_POL_004; CI analyzer wired. | | POLICY-ENGINE-20-006 | TODO | Policy Guild, Scheduler Worker Guild | POLICY-ENGINE-20-003, POLICY-ENGINE-20-004, SCHED-WORKER-20-301 | Implement incremental orchestrator reacting to advisory/vex/SBOM change streams and scheduling partial policy re-evaluations. | Change stream listeners enqueue affected tuples with dedupe; orchestrator meets 5 min SLA in perf tests; metrics exposed (policy_run_seconds). | 2025-10-29: Scheduler worker delta targeting (SCHED-WORKER-20-302) is live; change-stream orchestrator should supply metadata (delta.*) expected by the worker before enabling incremental benches/benchmarks. | POLICY-ENGINE-20-007 | TODO | Policy Guild, Observability Guild | POLICY-ENGINE-20-002 | Emit structured traces/logs of rule hits with sampling controls, metrics (rules_fired_total, vex_overrides_total), and expose explain trace exports. | Trace spans present in integration tests; metrics registered with counters/histograms; sampled rule hit logs validated. | | POLICY-ENGINE-20-008 | TODO | Policy Guild, QA Guild | POLICY-ENGINE-20-002, POLICY-ENGINE-20-003, POLICY-ENGINE-20-004, POLICY-ENGINE-20-005, POLICY-ENGINE-20-006, POLICY-ENGINE-20-007 | Add unit/property/golden/perf suites covering policy compilation, evaluation correctness, determinism, and SLA targets. | Golden fixtures pass deterministically across two seeded runs; property tests run in CI; perf regression budget documented. | | POLICY-ENGINE-20-009 | TODO | Policy Guild, Storage Guild | POLICY-ENGINE-20-000, POLICY-ENGINE-20-004 | Define Mongo schemas/indexes for policies, policy_runs, and effective_finding_*; implement migrations and tenant enforcement. | Collections + indexes created via bootstrapper; migrations documented; tests cover tenant scoping + write restrictions. |

Policy Studio RBAC Alignment (Sprint 27)

ID	Status	Owner(s)	Depends on	Description	Exit Criteria

2025-10-31: Policy Gateway now enforces policy:author/review/operate scopes, configuration defaults and Offline Kit samples updated, Authority clients seeded with new bundles, and scope verification script adjusted for the refreshed set.

Gateway Implementation (Sprint 18.5)

ID	Status	Owner(s)	Depends on	Description	Exit Criteria

2025-10-27: Added the StellaOps.Policy.Gateway project with configuration bootstrapper, JSON logging, Authority resource server auth, and health/readiness endpoints plus sample config and solution wiring. 2025-10-27: Implemented /api/policy/packs gateway routes with per-scope authorisation, forwarded bearer/DPoP/tenant headers, typed Policy Engine client, and deterministic DTO/ProblemDetails mapping. 2025-10-27: Gateway proxy annotates activation outcomes (activated, pending_second_approval, etc.), emits policy_gateway_activation_* metrics, and logs PackId/Version/Tenant for auditability. 2025-10-27: Added client-credential fallback with ES256 DPoP proofs, Polly retry policy, and uniform ProblemDetails mapping for upstream failures. 2025-10-27: Published /docs/policy/gateway.md, Offline Kit instructions for bundling configs/keys, and curl workflows for Console/CLI verification.

StellaOps Console (Sprint 23)

ID	Status	Owner(s)	Depends on	Description	Exit Criteria
POLICY-CONSOLE-23-001	TODO	Policy Guild, BE-Base Platform Guild	POLICY-ENGINE-20-003, POLICY-ENGINE-20-004, POLICY-ENGINE-20-007	Optimize findings/explain APIs for Console: cursor-based pagination at scale, global filter parameters (severity bands, policy version, time window), rule trace summarization, and aggregation hints for dashboard cards. Ensure deterministic ordering and expose provenance refs.	APIs return deterministic cursors, aggregation hints validated against golden fixtures, latency SLO ≤ 250 ms P95 on seeded data, documentation updated.
POLICY-CONSOLE-23-002	TODO	Policy Guild, Product Ops	POLICY-ENGINE-20-006, POLICY-ENGINE-20-007, POLICY-ENGINE-20-008	Produce simulation diff metadata (before/after counts, severity deltas, rule impact summaries) and approval state endpoints consumed by Console policy workspace; expose RBAC-aware status transitions.	Simulation diff payload documented, approval endpoints enforce scopes, integration tests cover workflow paths, metrics record diff generation latency.
EXPORT-CONSOLE-23-001	TODO	Policy Guild, Scheduler Guild, Observability Guild	POLICY-ENGINE-20-004, SCHED-WORKER-20-301, POLICY-CONSOLE-23-001	Build evidence bundle/export generator producing signed manifests, CSV/JSON replay endpoints, and trace attachments; integrate with scheduler jobs and expose progress telemetry.	Evidence bundles reproducible with checksums, manifests signed (cosign), API streams zipped content, telemetry metrics/logs added, docs updated.

Policy Studio (Sprint 27)

ID	Status	Owner(s)	Depends on	Description	Exit Criteria
POLICY-ENGINE-27-001	TODO	Policy Guild	POLICY-ENGINE-20-001, REGISTRY-API-27-003	Extend compile outputs to include rule coverage metadata, symbol table, inline documentation, and rule index for editor autocomplete; persist deterministic hashes.	Compile endpoint returns coverage + symbol table; responses validated with fixtures; hashing deterministic across runs; docs updated.
POLICY-ENGINE-27-002	TODO	Policy Guild, Observability Guild	POLICY-ENGINE-20-002, POLICY-ENGINE-27-001	Enhance simulate endpoints to emit rule firing counts, heatmap aggregates, sampled explain traces with deterministic ordering, and delta summaries for quick/batch sims.	Simulation outputs include ordered heatmap + sample explains; integration tests verify determinism; telemetry emits policy_rule_fired_total.
POLICY-ENGINE-27-003	TODO	Policy Guild, Security Guild	POLICY-ENGINE-20-005	Implement complexity/time limit enforcement with compiler scoring, configurable thresholds, and structured diagnostics (ERR_POL_COMPLEXITY).	Policies exceeding limits return actionable diagnostics; limits configurable per tenant; regression tests cover allow/block cases.
POLICY-ENGINE-27-004	TODO	Policy Guild, QA Guild	POLICY-ENGINE-27-001..003	Update golden/property tests to cover new coverage metrics, symbol tables, explain traces, and complexity limits; provide fixtures for Registry/Console integration.	Test suites extended; fixtures shared under StellaOps.Policy.Engine.Tests/Fixtures/policy-studio; CI ensures determinism across runs.

Epic 3: Graph Explorer v1

ID	Status	Owner(s)	Depends on	Description	Exit Criteria
POLICY-ENGINE-30-001	TODO	Policy Guild, Cartographer Guild	POLICY-ENGINE-20-004, CARTO-GRAPH-21-005	Define overlay contract for graph nodes/edges (status, severity, rationale refs, path relevance), expose projection API for Cartographer, and document schema versioning.	Overlay contract published (OpenAPI + schema); integration tests validate payloads against fixtures; versioning strategy documented.
POLICY-ENGINE-30-002	TODO	Policy Guild, Cartographer Guild	POLICY-ENGINE-30-001, CARTO-GRAPH-21-006	Implement simulation bridge returning on-the-fly overlays for Cartographer/Graph Explorer when invoking Policy Engine simulate; ensure no writes and deterministic outputs.	Simulation API returns overlays within SLA; end-to-end test from Graph Explorer consumes results; docs updated.
POLICY-ENGINE-30-003	TODO	Policy Guild, Scheduler Guild, Cartographer Guild	POLICY-ENGINE-20-006, CARTO-GRAPH-21-007	Emit change events (policy.effective.updated) with graph-friendly payloads so Cartographer overlay worker refreshes nodes/edges within 2 minutes.	Event published on run completion; Cartographer listener integration test passes; metrics capture lag.
POLICY-ENGINE-30-101	TODO	Policy Guild	POLICY-ENGINE-29-001	Surface trust weighting configuration (issuer base weights, signature modifiers, recency decay, scope adjustments) for VEX Lens via Policy Studio + API; ensure deterministic evaluation.	Trust weighting config exposed; Policy Studio UI updated; integration tests verify VEX Lens consumption.

Link-Not-Merge v1

ID	Status	Owner(s)	Depends on	Description	Exit Criteria
POLICY-ENGINE-40-001	TODO	Policy Guild, Concelier Guild	CONCELIER-LNM-21-002	Update severity/status evaluation pipelines to consume multiple source severities per linkset, supporting selection strategies (max, preferred source, policy-defined).	Policy evaluation handles multiple source inputs; tests cover selection strategies; documentation updated.
POLICY-ENGINE-40-002	TODO	Policy Guild, Excititor Guild	EXCITITOR-LNM-21-002	Accept VEX linkset conflicts and provide rationale references in effective findings; ensure explain traces cite observation IDs.	Effective findings include observation IDs + conflict reasons; explain endpoints updated; integration tests added.
POLICY-ENGINE-40-003	TODO	Policy Guild, Web Scanner Guild	POLICY-ENGINE-40-001	Provide API/SDK utilities for consumers (Web Scanner, Graph Explorer) to request policy decisions with source evidence summaries (top severity sources, conflict counts).	Utilities published; Web Scanner integration tests confirm new payload; docs updated.

Vulnerability Explorer (Sprint 29)

ID	Status	Owner(s)	Depends on	Description	Exit Criteria
POLICY-ENGINE-29-001	TODO	Policy Guild	POLICY-ENGINE-27-001	Implement batch evaluation endpoint (POST /policy/eval/batch) returning determinations + rationale chain for sets of (artifact,purl,version,advisory) tuples; support pagination and cost budgets.	Endpoint documented; latency within SLA; integration tests cover large batches; telemetry recorded.
POLICY-ENGINE-29-002	TODO	Policy Guild, Findings Ledger Guild	POLICY-ENGINE-29-001, LEDGER-29-003	Provide streaming simulation API comparing two policy versions, returning per-finding deltas without writes; align determinism with Vuln Explorer simulation.	Simulation output deterministic; diff schema shared; tests cover suppression/severity changes.
POLICY-ENGINE-29-003	TODO	Policy Guild, SBOM Service Guild	POLICY-ENGINE-29-001, SBOM-VULN-29-001	Surface path/scope awareness in determinations (signal optional/dev/test downgrade, runtime boost) for Vuln Explorer display.	Determinations include path annotations; policy docs updated; tests cover path-specific cases.
POLICY-ENGINE-29-004	TODO	Policy Guild, Observability Guild	POLICY-ENGINE-29-001	Add metrics/logs for batch evaluation (latency, queue depth) and simulation diff counts; update dashboards.	Metrics exposed; dashboards updated; alert thresholds defined.

Advisory AI (Sprint 31)

ID	Status	Owner(s)	Depends on	Description	Exit Criteria
POLICY-ENGINE-31-001	TODO	Policy Guild	VEXLENS-30-008, AIAI-31-004	Expose policy knobs for Advisory AI (trust presets, temperature, token limits, plan ranking weights, TTLs) via Policy Studio and config APIs.	Knobs available; Policy Studio integration documented; tests cover overrides.
POLICY-ENGINE-31-002	TODO	Policy Guild	POLICY-ENGINE-31-001	Provide batch endpoint delivering policy context (thresholds, obligations) consumed by Advisory AI remediation planner.	Endpoint documented; integration tests confirm data; latency within SLA.

Policy Engine + Editor v1 (Epic 5)

ID	Status	Owner(s)	Depends on	Description	Exit Criteria
POLICY-ENGINE-50-001	TODO	Policy Guild, Platform Security	POLICY-SPL-23-002	Implement SPL compiler: validate YAML, canonicalize, produce signed bundle, store artifact in object storage, write policy_revisions with AOC metadata.	Compiler CLI/API available; bundles stored with hashes/AOC; unit/integration tests green.
POLICY-ENGINE-50-002	TODO	Policy Guild, Runtime Guild	POLICY-ENGINE-50-001	Build runtime evaluator executing compiled plans over advisory/vex linksets + SBOM asset metadata with deterministic caching (Redis) and fallback path.	Evaluator meets latency targets; cache hit/miss metrics emitted; deterministic tests pass across runs.
POLICY-ENGINE-50-003	TODO	Policy Guild, Observability Guild	POLICY-ENGINE-50-002	Implement evaluation/compilation metrics, tracing, and structured logs (policy_eval_seconds, policy_compiles_total, explanation sampling).	Metrics available in Prometheus; traces wired; log schema documented.
POLICY-ENGINE-50-004	TODO	Policy Guild, Platform Events Guild	POLICY-ENGINE-50-002, CONCELIER-LNM-21-005, EXCITITOR-LNM-21-005, SBOM-SERVICE-21-002	Build event pipeline: subscribe to linkset/SBOM updates, schedule re-eval jobs, emit policy.effective.updated events with diff metadata.	Events consumed/produced reliably; idempotent keys; integration tests with mock inputs.
POLICY-ENGINE-50-005	TODO	Policy Guild, Storage Guild	POLICY-ENGINE-50-001	Design and implement policy_packs, policy_revisions, policy_runs, policy_artifacts collections with indexes, TTL, and tenant scoping.	Collections + indexes created via migrations; documentation of schema; tests cover CRUD.
POLICY-ENGINE-50-006	TODO	Policy Guild, QA Guild	POLICY-ENGINE-50-002	Implement explainer persistence + retrieval APIs linking decisions to explanation tree and AOC chain.	Explain data stored/retrievable via API; UI/CLI fixtures updated; determinism verified.
POLICY-ENGINE-50-007	TODO	Policy Guild, Scheduler Worker Guild	POLICY-ENGINE-50-004, SCHED-WORKER-23-101	Provide evaluation worker host/DI wiring and job orchestration hooks for batch re-evaluations after policy activation.	Worker host runs in CI; handles sharded workloads; telemetry integrated.

Graph & Vuln Explorer v1

ID	Status	Owner(s)	Depends on	Description	Exit Criteria
POLICY-ENGINE-60-001	TODO	Policy Guild, SBOM Service Guild	POLICY-ENGINE-50-004, SBOM-GRAPH-24-002	Maintain Redis effective decision maps per asset/snapshot for Graph overlays; implement versioning and eviction strategy.	Cache warmed with metrics; invalidation on policy/graph updates; tests ensure consistency.
POLICY-ENGINE-60-002	TODO	Policy Guild, BE-Base Platform Guild	POLICY-ENGINE-60-001, WEB-GRAPH-24-002	Expose simulation bridge for Graph What-if APIs, supporting hypothetical SBOM diffs and draft policies without persisting results.	Simulation API returns projections; integration tests verify idempotence; performance <3s for target assets.

Exceptions v1 (Epic 7)

ID	Status	Owner(s)	Depends on	Description	Exit Criteria
POLICY-ENGINE-70-002	TODO	Policy Guild, Storage Guild	POLICY-ENGINE-70-001	Design and create Mongo collections (exceptions, exception_reviews, exception_bindings) with indexes and migrations; expose repository APIs.	Collections created; migrations documented; tests cover CRUD and binding lookups.
POLICY-ENGINE-70-003	TODO	Policy Guild, Runtime Guild	POLICY-ENGINE-70-001	Build Redis exception decision cache (exceptions_effective_map) with warm/invalidation logic reacting to exception.* events.	Cache layer operational; metrics track hit/miss; fallback path tested.
POLICY-ENGINE-70-004	TODO	Policy Guild, Observability Guild	POLICY-ENGINE-70-001	Extend metrics/tracing/logging for exception application (latency, counts, expiring events) and include AOC references in logs.	Metrics emitted (policy_exception_applied_total etc.); traces updated; log schema documented.
POLICY-ENGINE-70-005	TODO	Policy Guild, Scheduler Worker Guild	POLICY-ENGINE-70-002	Provide APIs/workers hook for exception activation/expiry (auto start/end) and event emission (exception.activated/expired).	Auto transitions tested; events published; integration with workers verified.

Reachability v1 (Epic 8)

ID	Status	Owner(s)	Depends on	Description	Exit Criteria
POLICY-ENGINE-80-001	TODO	Policy Guild, Signals Guild	SIGNALS-24-004	Integrate reachability/exploitability inputs into evaluation pipeline (state/score/confidence) with caching and explain support.	Policy evaluation consumes signals data; explainer includes reachability evidence; tests cover scoring impact.
POLICY-ENGINE-80-002	TODO	Policy Guild, Storage Guild	SIGNALS-24-004	Create joining layer to read reachability_facts efficiently (indexes, projections) and populate Redis overlay caches.	Queries optimized with indexes; cache warmed; performance <8 ms p95; tests pass.
POLICY-ENGINE-80-003	TODO	Policy Guild, Policy Editor Guild	POLICY-ENGINE-80-001	Extend SPL predicates/actions to reference reachability state/score/confidence; update compiler validation.	SPL accepts new predicates; canonicalization updated; schema docs regenerated.
POLICY-ENGINE-80-004	TODO	Policy Guild, Observability Guild	POLICY-ENGINE-80-001	Emit metrics (policy_reachability_applied_total, policy_reachability_cache_hit_ratio) and traces for signals usage.	Metrics/traces available; dashboards updated; alert thresholds defined.

Orchestrator Dashboard (Epic 9)

ID	Status	Owner(s)	Depends on	Description	Exit Criteria
POLICY-ENGINE-32-101	TODO	Policy Guild	ORCH-SVC-32-001, ORCH-SVC-32-003	Define orchestrator policy_eval job schema, idempotency keys, and enqueue hooks triggered by advisory/VEX/SBOM events.	Job schema documented; enqueue hooks tested; OpenAPI references updated; determinism tests cover idempotent keys.
POLICY-ENGINE-33-101	TODO	Policy Guild	POLICY-ENGINE-32-101, ORCH-SVC-33-001, WORKER-GO-33-001, WORKER-PY-33-001	Implement orchestrator-driven policy evaluation workers using SDK heartbeats, respecting throttles, and emitting SLO metrics.	Worker claims jobs in integration tests; metrics exported; pause/resume/backfill scenarios covered; docs updated.
POLICY-ENGINE-34-101	TODO	Policy Guild	POLICY-ENGINE-33-101, ORCH-SVC-34-001, LEDGER-34-101	Publish policy run ledger exports + SLO burn-rate metrics to orchestrator; ensure provenance chain links to Findings Ledger.	Ledger export endpoint live; burn metrics recorded; tests ensure tenant isolation; documentation references run-ledger doc.

Export Center (Epic 10)

ID	Status	Owner(s)	Depends on	Description	Exit Criteria
POLICY-ENGINE-35-201	TODO	Policy Guild	POLICY-ENGINE-20-004, LEDGER-EXPORT-35-001	Expose deterministic policy snapshot API and evaluated findings stream keyed by policy version for exporter consumption.	Snapshot endpoint live; outputs deterministic; provenance metadata included; tests cover policy pinning.
POLICY-ENGINE-38-201	TODO	Policy Guild	ORCH-SVC-38-101	Emit enriched policy violation events (decision rationale ids, risk bands) via orchestrator event bus for Notifications Studio.	Events published with rationale IDs; schema documented; integration tests with notifier ensure fields present.

Authority-Backed Scopes & Tenancy (Epic 14)

ID	Status	Owner(s)	Depends on	Description	Exit Criteria
POLICY-TEN-48-001	TODO	Policy Guild	AUTH-TEN-47-001	Add tenant_id/project_id columns, enable RLS, update evaluators to require tenant context, and emit rationale IDs including tenant metadata.	RLS enabled; tests prove isolation; rationale IDs stable; docs updated.

Observability & Forensics (Epic 15)

ID	Status	Owner(s)	Depends on	Description	Exit Criteria
POLICY-OBS-50-001	TODO	Policy Guild, Observability Guild	TELEMETRY-OBS-50-001, TELEMETRY-OBS-50-002	Integrate telemetry core into policy API + worker hosts, ensuring spans/logs cover compile/evaluate flows with tenant_id, policy_version, decision_effect, and trace IDs.	Telemetry observed in integration tests; logging contract validated; CLI trace propagation confirmed.
POLICY-OBS-51-001	TODO	Policy Guild, DevOps Guild	POLICY-OBS-50-001, TELEMETRY-OBS-51-001	Emit golden-signal metrics (compile latency, evaluate latency, rule hits, override counts) and define SLOs (evaluation P95 <2s). Publish Grafana dashboards + burn-rate alert rules.	Metrics visible in dashboards; SLO alert tested; documentation updated.
POLICY-OBS-52-001	TODO	Policy Guild	POLICY-OBS-50-001, TIMELINE-OBS-52-002	Emit timeline events policy.evaluate.started, policy.evaluate.completed, policy.decision.recorded with trace IDs, input digests, and rule summary. Provide contract tests and retry semantics.	Timeline events pass fixture tests; duplicates prevented; docs reference schema.
POLICY-OBS-53-001	TODO	Policy Guild, Evidence Locker Guild	POLICY-OBS-52-001, EVID-OBS-53-002	Produce evaluation evidence bundles (inputs slice, rule trace, engine version, config snapshot) through evidence locker integration; ensure redaction + deterministic manifests.	Bundles generated/verified in integration tests; manifests deterministic; redaction guard tests pass.
POLICY-OBS-54-001	TODO	Policy Guild, Provenance Guild	POLICY-OBS-53-001, PROV-OBS-53-002	Generate DSSE attestations for evaluation outputs, expose /evaluations/{id}/attestation, and link attestation IDs in timeline + console. Provide verification harness.	Attestations validated; endpoint live; docs updated.
POLICY-OBS-55-001	TODO	Policy Guild, DevOps Guild	POLICY-OBS-51-001, DEVOPS-OBS-55-001	Implement incident mode sampling overrides (full rule trace capture, extended retention) with auto-activation on SLO breach and manual override API. Emit activation events to timeline + notifier.	Incident mode validated; retention resets post incident; activation logged.

Risk Profiles (Epic 18)

ID	Status	Owner(s)	Depends on	Description	Exit Criteria
POLICY-RISK-66-003	TODO	Policy Guild, Risk Profile Schema Guild	POLICY-RISK-66-001	Integrate RiskProfile schema into Policy Engine configuration, ensuring validation and default profile deployment.	Policy Engine loads profiles with schema validation; unit tests cover invalid docs.
POLICY-RISK-67-001	TODO	Policy Guild, Risk Engine Guild	POLICY-RISK-66-003, RISK-ENGINE-66-001	Trigger scoring jobs on new/updated findings via Policy Engine orchestration hooks.	Scoring jobs enqueued deterministically; tests cover delta events.
POLICY-RISK-67-002	TODO	Policy Guild	POLICY-RISK-66-003	Implement profile lifecycle APIs (/risk/profiles create/publish/deprecate) and scope attachment logic.	APIs documented; authorization enforced; integration tests pass.
POLICY-RISK-68-001	TODO	Policy Guild, Policy Studio Guild	POLICY-RISK-67-002	Provide simulation API bridging Policy Studio with risk engine; returns distributions and top movers.	Simulation endpoint live with documented schema; golden tests verified.
POLICY-RISK-69-001	TODO	Policy Guild, Notifications Guild	POLICY-RISK-67-002	Emit events/notifications on profile publish, deprecate, and severity threshold changes.	Notifications templates live; staging event triggers announcement.
POLICY-RISK-70-001	TODO	Policy Guild, Export Guild	POLICY-RISK-67-002, RISK-BUNDLE-69-001	Support exporting/importing profiles with signatures for air-gapped bundles.	Export/import CLI works; signatures verified; docs updated.

Attestor Console (Epic 19)

ID	Status	Owner(s)	Depends on	Description	Exit Criteria
POLICY-ATTEST-73-001	TODO	Policy Guild, Attestor Service Guild	ATTESTOR-73-002	Introduce VerificationPolicy object: schema, persistence, versioning, and lifecycle.	Policy CRUD operational; validation implemented; tests cover publish/deprecate.
POLICY-ATTEST-73-002	TODO	Policy Guild	POLICY-ATTEST-73-001	Provide Policy Studio editor with validation, dry-run simulation, and version diff.	UI supports editing/publishing policies; dry-run returns detailed feedback; docs updated.
POLICY-ATTEST-74-001	TODO	Policy Guild, Attestor Service Guild	POLICY-ATTEST-73-001	Integrate verification policies into attestor verification pipeline with caching and waiver support.	Verification uses policies; waivers logged; regression suite passes.
POLICY-ATTEST-74-002	TODO	Policy Guild, Console Guild	POLICY-ATTEST-73-002	Surface policy evaluations in Console verification reports with rule explanations.	Reports show rule hits/misses; tests confirm data flow.

Air-Gapped Mode (Epic 16)

ID	Status	Owner(s)	Depends on	Description	Exit Criteria
POLICY-AIRGAP-56-001	TODO	Policy Guild	AIRGAP-IMP-56-001, CONCELIER-OBS-52-001	Support policy pack imports from Mirror Bundles, track bundle_id metadata, and ensure deterministic caching.	Policy packs import via API/CLI; bundle ID persisted; tests cover idempotent re-import and rollback.
POLICY-AIRGAP-56-002	TODO	Policy Guild, Policy Studio Guild	POLICY-AIRGAP-56-001, MIRROR-CRT-56-001	Export policy sub-bundles (stella policy bundle export) with DSSE signatures for outbound transfer.	Export command produces signed bundle; verification succeeds; docs updated.
POLICY-AIRGAP-57-001	TODO	Policy Guild, AirGap Policy Guild	POLICY-AIRGAP-56-001, AIRGAP-POL-56-001	Enforce sealed-mode guardrails in evaluation (no outbound fetch), surface AIRGAP_EGRESS_BLOCKED errors with remediation.	Evaluations fail with standard error when egress attempt occurs; unit tests cover sealed/unsealed.
POLICY-AIRGAP-57-002	TODO	Policy Guild, AirGap Time Guild	POLICY-AIRGAP-56-001, AIRGAP-TIME-58-001	Annotate rule explanations with staleness information and fallback data (cached EPSS, vendor risk).	Explain output shows fallback source + timestamp; UI consumes new fields; tests updated.
POLICY-AIRGAP-58-001	TODO	Policy Guild, Notifications Guild	POLICY-AIRGAP-56-001, NOTIFY-OBS-51-001	Emit notifications when policy packs near staleness thresholds or missing required bundles.	Notifications dispatched with remediation; CLI/Console show consistent warnings; integration tests cover thresholds.