stella-ops.org/git.stella-ops.org
1
0
Fork 0
Code Issues Pull Requests Actions 1 Releases Wiki Activity
Files
3bd095520218c6cba7adf09eb98b8f5c81d011b4
git.stella-ops.org/src/Authority/StellaOps.Authority/TASKS.md
master 3bd0955202
Some checks are pending
Docs CI / lint-and-preview (push) Waiting to run
Details
feat: Enhance Task Runner with simulation and failure policy support 
- Added tests for output projection and failure policy population in TaskPackPlanner.
- Introduced new failure policy manifest in TestManifests.
- Implemented simulation endpoints in the web service for task execution.
- Created TaskRunnerServiceOptions for configuration management.
- Updated appsettings.json to include TaskRunner configuration.
- Enhanced PackRunWorkerService to handle execution graphs and state management.
- Added support for parallel execution and conditional steps in the worker service.
- Updated documentation to reflect new features and changes in execution flow.
2025-11-04 19:05:56 +02:00

22 KiB
Raw Blame History

Authority Host Task Board — Epic 1: Aggregation-Only Contract

ID Status Owner(s) Depends on Description Exit Criteria

2025-10-26: Rate limiter metadata/audit records now include tenants, password grant scopes/tenants enforced, token persistence + tests updated. Docs refresh tracked via AUTH-AOC-19-003. 2025-10-27: Client credential ingestion scopes now require tenant assignment; access token validation backfills tenants and rejects cross-tenant mismatches with tests. 2025-10-27: dotnet test blocked — Concelier build fails (AdvisoryObservationQueryService returns ImmutableHashSet<string?>), preventing Authority test suite run; waiting on Concelier fix before rerun. 2025-10-26: Docs updated (docs/11_AUTHORITY.md, Concelier audit runbook, docs/security/authority-scopes.md); sample config highlights tenant-aware clients. Release notes + smoke verification pending (blocked on Concelier/Excititor smoke updates). 2025-10-27: Scope catalogue aligned with advisory:ingest/advisory:read/vex:ingest/vex:read, aoc:verify pairing documented, console/CLI references refreshed, and etc/authority.yaml.sample updated to require read scopes for verification clients. 2025-10-31: Client credentials and password grants now reject advisory/vex read or signals scopes without aoc:verify, enforce tenant assignment for aoc:verify, tag violations via authority.aoc_scope_violation, extend tests, and refresh scope catalogue docs/sample roles.

Link-Not-Merge v1

ID Status Owner(s) Depends on Description Exit Criteria

2025-10-29: Rejected legacy concelier.merge scope during client credential validation, removed it from known scope catalog, blocked discovery/issuance, added regression tests, and refreshed scope documentation.

Policy Engine v2

ID Status Owner(s) Depends on Description Exit Criteria

2025-10-26: Restricted effective:write to Policy Engine service identities with tenant requirement, registered full scope set, and tightened resource server default scope enforcement (unit tests pass). 2025-10-26: Authority docs now detail policy scopes/service identity guardrails with checklist; authority.yaml.sample includes properties.serviceIdentity example.

Graph Explorer v1

ID Status Owner(s) Depends on Description Exit Criteria

Policy Engine + Editor v1

ID Status Owner(s) Depends on Description Exit Criteria
AUTH-POLICY-23-002 BLOCKED (2025-10-29) Authority Core & Security Guild AUTH-POLICY-23-001 Implement optional two-person rule for activation: require two distinct policy:activate approvals when configured; emit audit logs. Activation endpoint enforces rule; audit logs contain approver IDs; tests cover 2-person path.

Blocked: Policy Engine/Studio have not yet exposed activation workflow endpoints or approval payloads needed to enforce dual-control (WEB-POLICY-23-002, POLICY-ENGINE-23-002). Revisit once activation contract lands. | AUTH-POLICY-23-003 | BLOCKED (2025-10-29) | Authority Core & Docs Guild | AUTH-POLICY-23-001 | Update documentation and sample configs for policy roles, approval workflow, and signing requirements. | Docs updated with reviewer checklist; configuration examples validated. | Blocked pending AUTH-POLICY-23-002 dual-approval implementation so docs can capture final activation behaviour. 2025-10-27: Added policy-cli defaults to Authority config/secrets, refreshed CLI/CI documentation with the new scope bundle, recorded release migration guidance, and introduced scripts/verify-policy-scopes.py to guard against regressions.

Graph & Vuln Explorer v1

ID Status Owner(s) Depends on Description Exit Criteria

2025-10-27: Paused work after exploratory spike (scope enforcement still outstanding); no functional changes merged.

Orchestrator Dashboard

ID Status Owner(s) Depends on Description Exit Criteria

2025-10-31: Picked up during Console/Orchestrator alignment; focusing on scope catalog + tenant enforcement first. 2025-10-31: orch:read added to scope catalogue and Authority runtime, Console defaults include the scope, Orch.Viewer role documented, and client-credential tests enforce tenant requirements. 2025-10-27: Added orch:operate scope, enforced operator_reason/operator_ticket on token issuance, updated Authority configs/docs, and captured audit metadata for control actions. 2025-10-28: Policy gateway + scanner now pass the expanded token client signature (null metadata by default), test stubs capture the optional parameters, and Policy Gateway/Scanner suites are green after fixing the Concelier storage build break. 2025-10-28: Authority password-grant tests now hit the new constructors but still need updates to drop obsolete IOptions arguments before the suite can pass. | AUTH-ORCH-34-001 | DONE (2025-11-02) | Authority Core & Security Guild | AUTH-ORCH-33-001 | Introduce Orch.Admin role with quota/backfill scopes, enforce audit reason on quota changes, and update offline defaults/docs. | Admin role available; quotas/backfills require scope + reason; tests confirm tenant isolation; documentation updated. | 2025-11-02: orch:backfill scope added with mandatory backfill_reason/backfill_ticket, client-credential validation and resource authorization paths emit audit fields, CLI picks up new configuration/env vars, and Authority docs/config samples updated for Orch.Admin.

StellaOps Console (Sprint 23)

ID Status Owner(s) Depends on Description Exit Criteria

2025-10-29: Authorization code flow enabled with PKCE requirement, console client seeded in authority.yaml.sample, discovery docs updated, and console runbook guidance added. 2025-10-31: Added /console/tenants, /console/profile, /console/token/introspect endpoints with tenant header filter, scope enforcement (ui.read, authority:tenants.read), and structured audit events. Console test harness covers success/mismatch cases. 2025-10-28: docs/security/console-security.md drafted with PKCE + DPoP (120 s OpTok, 300 s fresh-auth) and scope table. Authority Core to confirm /fresh-auth semantics, token lifetimes, and scope bundles align before closing task. 2025-10-31: Security guide expanded for /console endpoints & orchestrator scope, sample YAML annotated, ops runbook updated, and release note docs/updates/2025-10-31-console-security-refresh.md published. 2025-10-31: Default access-token lifetime reduced to 120 s, console tests updated with dual auth schemes, docs/config/ops notes refreshed, release note logged.

Policy Studio (Sprint 27)

ID Status Owner(s) Depends on Description Exit Criteria

2025-10-31: Added Policy Studio scope family (policy:author/review/operate/audit), updated OpenAPI + discovery headers, enforced tenant requirements in grant handlers, seeded new roles in Authority config/offline kit docs, and refreshed CLI/Console documentation + tests to validate the new catalogue. | AUTH-POLICY-27-002 | DONE (2025-11-02) | Authority Core & Security Guild | AUTH-POLICY-27-001, REGISTRY-API-27-007 | Provide attestation signing service bindings (OIDC token exchange, cosign integration) and enforce publish/promote scope checks, fresh-auth requirements, and audit logging. | Publish/promote requests require fresh auth + correct scopes; attestations signed with validated identity; audit logs enriched with digest + tenant; integration tests pass. | Docs dependency: DOCS-POLICY-27-009 awaiting signing guidance from this work. 2025-11-02: Added policy:publish/policy:promote scopes with interactive-only enforcement, metadata parameters (policy_reason, policy_ticket, policy_digest), fresh-auth token validation, audit augmentations, and updated config/docs references. | AUTH-POLICY-27-003 | DONE (2025-11-04) | Authority Core & Docs Guild | AUTH-POLICY-27-001, AUTH-POLICY-27-002 | Update Authority configuration/docs for Policy Studio roles, signing policies, approval workflows, and CLI integration; include compliance checklist. | Docs merged; samples validated; governance checklist appended; release notes updated. | 2025-11-04: Policy Studio roles/scopes documented across docs/11_AUTHORITY.md, sample configs, and OpenAPI; compliance checklist appended and Authority tests rerun to validate fresh-auth + scope enforcement.

Exceptions v1

ID Status Owner(s) Depends on Description Exit Criteria

2025-10-29: Added exception scopes + routing template options, enforced MFA requirement in password grant handlers, updated configuration samples. 2025-10-31: Authority scopes/routing docs updated (docs/security/authority-scopes.md, docs/11_AUTHORITY.md, docs/policy/exception-effects.md), monitoring guide covers new MFA audit events, and etc/authority.yaml.sample now demonstrates exception clients/templates.

Reachability v1

ID Status Owner(s) Depends on Description Exit Criteria

2025-10-29: Signals scopes added with tenant + aoc:verify enforcement; sensors guided via SignalsUploader template; tests cover gating.

Vulnerability Explorer (Sprint 29)

ID Status Owner(s) Depends on Description Exit Criteria
AUTH-VULN-29-001 DONE (2025-11-03) Authority Core & Security Guild AUTH-POLICY-27-001 Define Vuln Explorer scopes/roles (vuln:view, vuln:investigate, vuln:operate, vuln:audit) with ABAC attributes (env, owner, business_tier) and update discovery metadata/offline kit defaults. Roles/scopes published; issuer templates updated; integration tests cover ABAC filters; docs refreshed.
AUTH-VULN-29-002 DONE (2025-11-03) Authority Core & Security Guild AUTH-VULN-29-001, LEDGER-29-002 Enforce CSRF/anti-forgery tokens for workflow actions, sign attachment tokens, and record audit logs with ledger event hashes. Workflow calls require valid tokens; audit logs include ledger references; security tests cover token expiry/abuse.
AUTH-VULN-29-003 DONE (2025-11-04) Authority Core & Docs Guild AUTH-VULN-29-001..002 Update security docs/config samples for Vuln Explorer roles, ABAC policies, attachment signing, and ledger verification guidance. Docs merged with compliance checklist; configuration examples validated; release notes updated.

2025-11-03: Vuln workflow CSRF + attachment token services live with audit enrichment and negative-path tests. Awaiting completion of full Authority suite run after repository-wide build finishes. 2025-11-04: Verified Vuln Explorer RBAC/ABAC coverage in Authority docs/security guides, attachment token guidance, and offline samples; Authority tests rerun confirming ledger-token + anti-forgery behaviours.

Advisory AI (Sprint 31)

ID Status Owner(s) Depends on Description Exit Criteria
AUTH-AIAI-31-001 DONE (2025-11-01) Authority Core & Security Guild AUTH-VULN-29-001 Define Advisory AI scopes (advisory-ai:view, advisory-ai:operate, advisory-ai:admin) and remote inference toggles; update discovery metadata/offline defaults. Scopes/flags published; integration tests cover RBAC + opt-in settings; docs updated.
AUTH-AIAI-31-002 DONE (2025-11-01) Authority Core & Security Guild AUTH-AIAI-31-001, AIAI-31-006 Enforce anonymized prompt logging, tenant consent for remote inference, and audit logging of assistant tasks. Logging/audit flows verified; privacy review passed; docs updated.

Export Center

ID Status Owner(s) Depends on Description Exit Criteria

Notifications Studio

ID Status Owner(s) Depends on Description Exit Criteria
AUTH-NOTIFY-38-001 DONE (2025-11-01) Authority Core & Security Guild — Define Notify.Viewer, Notify.Operator, Notify.Admin scopes/roles, update discovery metadata, offline defaults, and issuer templates. Scopes available; metadata updated; tests ensure enforcement; offline kit defaults refreshed.
AUTH-NOTIFY-40-001 DONE (2025-11-02) Authority Core & Security Guild AUTH-NOTIFY-38-001, WEB-NOTIFY-40-001 Implement signed ack token key rotation, webhook allowlists, admin-only escalation settings, and audit logging of ack actions. Ack tokens signed/rotated; webhook allowlists enforced; admin enforcement validated; audit logs capture ack/resolution.

2025-11-02: /notify/ack-tokens/rotate exposed (notify.admin), emits notify.ack.key_rotated|notify.ack.key_rotation_failed, and DSSE rotation tests cover allowlist + scope enforcement. | AUTH-NOTIFY-42-001 | DONE (2025-11-02) | Authority Core & Security Guild | AUTH-NOTIFY-40-001 | Investigate ack token rotation 500 errors (test Rotate_ReturnsBadRequest_WhenKeyIdMissing_AndAuditsFailure still failing). Capture logs, identify root cause, and patch handler. | Failure mode understood; fix merged; regression test passes. | 2025-11-02: Aliased StellaOpsBearer to the test auth handler, corrected bootstrap /notifications/ack-tokens/rotate defaults, and validated Rotate_ReturnsBadRequest_WhenKeyIdMissing_AndAuditsFailure via targeted dotnet test.

CLI Parity & Task Packs

ID Status Owner(s) Depends on Description Exit Criteria
AUTH-PACKS-41-001 DONE (2025-11-04) Authority Core & Security Guild AUTH-AOC-19-001 Define CLI SSO profiles and pack scopes (Packs.Read, Packs.Write, Packs.Run, Packs.Approve), update discovery metadata, offline defaults, and issuer templates. Scopes available; metadata updated; tests ensure enforcement; offline kit templates refreshed.

2025-11-02: Added Pack scope policies, Authority role defaults, and CLI profile guidance covering operator/publisher/approver flows. 2025-11-02: Shared OpenSSL 1.1 shim feeds Authority & Signals Mongo2Go harnesses so pack scope coverage keeps running on OpenSSL 3 hosts (AUTH-PACKS-41-001). 2025-11-04: Discovery metadata/OpenAPI advertise packs scopes, configs/offline kit templates bundle new roles, and Authority tests re-run to validate tenant gating for packs.*. | AUTH-PACKS-43-001 | BLOCKED (2025-10-27) | Authority Core & Security Guild | AUTH-PACKS-41-001, TASKRUN-42-001, ORCH-SVC-42-101 | Enforce pack signing policies, approval RBAC checks, CLI CI token scopes, and audit logging for approvals. | Signing policies enforced; approvals require correct roles; CI token scope tests pass; audit logs recorded. | Blocked: Task Runner approval APIs (ORCH-SVC-42-101, TASKRUN-42-001) still outstanding. Pack scope catalog (AUTH-PACKS-41-001) landed 2025-11-04; resume once execution/approval contracts are published.

Authority-Backed Scopes & Tenancy (Epic 14)

ID Status Owner(s) Depends on Description Exit Criteria

2025-10-28: Tidied advisory raw idempotency migration to avoid LINQ-on-BsonValue (explicit array copy) while continuing duplicate guardrail validation; scoped scanner/policy token call sites updated to honor new metadata parameter. | AUTH-TEN-49-001 | DONE (2025-11-04) | Authority Core & Security Guild | AUTH-TEN-47-001 | Implement service accounts & delegation tokens (act chain), per-tenant quotas, audit stream of auth decisions, and revocation APIs. | Service tokens minted with scopes/TTL; delegation logged; quotas configurable; audit stream live; docs updated. | 2025-11-02: Authority bootstrap test harness now seeds service accounts via AuthorityDelegation options; /internal/service-accounts endpoints validated with targeted vstest run. 2025-11-02: Added Mongo service-account store, seeded options/collection initializers, token persistence metadata (tokenKind, serviceAccountId, actorChain), and docs/config samples. Introduced quota checks + tests covering service account issuance and persistence. 2025-11-02: Documented bootstrap service-account admin APIs in docs/11_AUTHORITY.md, noting API key requirements and stable upsert behaviour. 2025-11-03: Seeded explicit enabled service-account fixtures for integration tests and reran StellaOps.Authority.Tests to greenlight /internal/service-accounts listing + revocation scenarios. 2025-11-04: Confirmed service-account docs/config examples, quota tuning, and audit stream wiring; Authority suite re-executed to cover issuance/listing/revocation flows.

Observability & Forensics (Epic 15)

ID Status Owner(s) Depends on Description Exit Criteria
AUTH-OBS-50-001 DONE (2025-11-02) Authority Core & Security Guild AUTH-AOC-19-001 Introduce scopes obs:read, timeline:read, timeline:write, evidence:create, evidence:read, evidence:hold, attest:read, and obs:incident (all tenant-scoped). Update discovery metadata, offline defaults, and scope grammar docs. Scopes exposed via metadata; issuer templates updated; offline kit seeded; integration tests cover new scopes.
AUTH-OBS-52-001 DONE (2025-11-02) Authority Core & Security Guild AUTH-OBS-50-001, TIMELINE-OBS-52-003, EVID-OBS-53-003 Configure resource server policies for Timeline Indexer, Evidence Locker, Exporter, and Observability APIs enforcing new scopes + tenant claims. Emit audit events including scope usage and trace IDs. Policies deployed; unauthorized access blocked; audit logs prove scope usage; contract tests updated.
AUTH-OBS-55-001 DONE (2025-11-02) Authority Core & Security Guild, Ops Guild AUTH-OBS-50-001, WEB-OBS-55-001 Harden incident mode authorization: require obs:incident scope + fresh auth, log activation reason, and expose verification endpoint for auditors. Update docs/runbooks. Incident activate/deactivate requires scope; audit entries logged; docs updated with imposed rule reminder.

Air-Gapped Mode (Epic 16)

ID Status Owner(s) Depends on Description Exit Criteria
AUTH-AIRGAP-56-001 DONE (2025-11-04) Authority Core & Security Guild AIRGAP-CTL-56-001 Provision new scopes (airgap:seal, airgap:import, airgap:status:read) in configuration metadata, offline kit defaults, and issuer templates. Scopes exposed in discovery docs; offline kit updated; integration tests cover issuance.
AUTH-AIRGAP-56-002 DONE (2025-11-04) Authority Core & Security Guild AUTH-AIRGAP-56-001, AIRGAP-IMP-58-001 Audit import actions with actor, tenant, bundle ID, and trace ID; expose /authority/audit/airgap endpoint. Audit records persisted; endpoint paginates results; tests cover RBAC + filtering.

2025-11-04: Airgap scope constants are wired through discovery metadata, etc/authority.yaml.sample, and offline kit docs; scope issuance tests executed via dotnet test. 2025-11-04: /authority/audit/airgap API persists tenant-scoped audit entries with pagination and authorization guards validated by the Authority integration suite (187 tests). | AUTH-AIRGAP-57-001 | BLOCKED (2025-11-01) | Authority Core & Security Guild, DevOps Guild | AUTH-AIRGAP-56-001, DEVOPS-AIRGAP-57-002 | Enforce sealed-mode CI gating by refusing token issuance when declared sealed install lacks sealing confirmation. | Awaiting clarified sealed-confirmation contract and configuration structure before implementation. | 2025-11-01: AUTH-AIRGAP-57-001 blocked pending guidance on sealed-confirmation contract and configuration expectations before gating changes (Authority Core & Security Guild, DevOps Guild).

SDKs & OpenAPI (Epic 17)

ID Status Owner(s) Depends on Description Exit Criteria

2025-10-28: Auth OpenAPI authored at src/Api/StellaOps.Api.OpenApi/authority/openapi.yaml covering /token, /introspect, /revoke, /jwks, scope catalog, and error envelopes; parsed via PyYAML sanity check and referenced in Epic 17 docs. 2025-10-28: Added /.well-known/openapi endpoint wiring cached spec metadata, YAML/JSON negotiation, HTTP cache headers, and tests verifying ETag + Accept handling. Authority spec (src/Api/StellaOps.Api.OpenApi/authority/openapi.yaml) now includes grant/scope extensions. | AUTH-OAS-62-001 | DONE (2025-11-02) | Authority Core & Security Guild, SDK Generator Guild | AUTH-OAS-61-001, SDKGEN-63-001 | Provide SDK helpers for OAuth2/PAT flows, tenancy override header; add integration tests. | SDKs expose auth helpers; tests cover token issuance; docs updated. | 2025-11-02: AddStellaOpsApiAuthentication shipped (OAuth2 + PAT), tenant header injection added, and client tests updated for caching behaviour. | AUTH-OAS-63-001 | DONE (2025-11-02) | Authority Core & Security Guild, API Governance Guild | APIGOV-63-001 | Emit deprecation headers and notifications for legacy auth endpoints. | Headers emitted; notifications verified; migration guide published. | 2025-11-02: AUTH-OAS-63-001 completed — legacy OAuth shims emit Deprecation/Sunset/Warning headers, audit events captured, and migration guide published (Authority Core & Security Guild, API Governance Guild).