2eb6852d34
Some checks failed
Docs CI / lint-and-preview (push) Has been cancelled
- Implement `SbomIngestServiceCollectionExtensionsTests` to verify the SBOM ingestion pipeline exports snapshots correctly. - Create `SbomIngestTransformerTests` to ensure the transformation produces expected nodes and edges, including deduplication of license nodes and normalization of timestamps. - Add `SbomSnapshotExporterTests` to test the export functionality for manifest, adjacency, nodes, and edges. - Introduce `VexOverlayTransformerTests` to validate the transformation of VEX nodes and edges. - Set up project file for the test project with necessary dependencies and configurations. - Include JSON fixture files for testing purposes.
33 lines
1.7 KiB
Markdown
33 lines
1.7 KiB
Markdown
# StellaOps Graph
|
||
|
||
Graph module (upcoming) will power graph-indexed queries for SBOM relationships, lineage, and blast-radius analysis.
|
||
|
||
## Responsibilities
|
||
- Model SBOM and advisory entities as a navigable graph.
|
||
- Provide APIs for dependency impact, provenance chains, and reachability analysis.
|
||
- Integrate with Scheduler/Policy for graph-driven re-evaluation.
|
||
- Expose tooling for offline explorers.
|
||
- Maintain [Graph Index Canonical Schema](schema.md) with deterministic identities, fixtures, and attribute dictionary.
|
||
|
||
### Domain highlights (Epic 5)
|
||
- **Nodes:** artifacts/images, SBOM components, packages/versions, files/paths, licences, advisories, VEX statements, provenance attestations, policy versions.
|
||
- **Edges:** `depends_on`, `contains`, `built_from`, `declared_in`, `affected_by`, `vex_exempts`, `governs_with`, `produced_by`, each timestamped and tenant-scoped.
|
||
- **Overlays:** policy verdict overlays, VEX consensus, runtime telemetry, and export-ready snapshots with diff support.
|
||
- **Queries:** reachability (`impact(graph, advisory)`), blast radius (`reverseDepends(component)`), provenance timeline, saved query library with semantic zoom for Console.
|
||
|
||
## Key components
|
||
- Planned services documented in implementation plan (to be delivered).
|
||
|
||
## Integrations & dependencies
|
||
- SBOM Service / Cartographer for data ingestion.
|
||
- Policy & CLI for query surfaces.
|
||
|
||
## Operational notes
|
||
- Pending — see implementation plan for staged milestones.
|
||
|
||
## Backlog references
|
||
- DOCS-GRAPH-24-003 (architecture index) and SCHED-MODELS-21-001 tasks.
|
||
|
||
## Epic alignment
|
||
- **Epic 5 – SBOM Graph Explorer:** deliver graph indexer, API, Console explorer, saved queries, overlays, and exports.
|