e923880694
Some checks failed
AOC Guard CI / aoc-guard (push) Has been cancelled
AOC Guard CI / aoc-verify (push) Has been cancelled
Concelier Attestation Tests / attestation-tests (push) Has been cancelled
Docs CI / lint-and-preview (push) Has been cancelled
Export Center CI / export-ci (push) Has been cancelled
Mirror Thin Bundle Sign & Verify / mirror-sign (push) Has been cancelled
- Introduced DigestUpsertRequest for handling digest upsert requests with properties like ChannelId, Recipient, DigestKey, Events, and CollectUntil. - Created LockEntity to represent a lightweight distributed lock entry with properties such as Id, TenantId, Resource, Owner, ExpiresAt, and CreatedAt. feat: Implement ILockRepository interface and LockRepository class - Defined ILockRepository interface with methods for acquiring and releasing locks. - Implemented LockRepository class with methods to try acquiring a lock and releasing it, using SQL for upsert operations. feat: Add SurfaceManifestPointer record for manifest pointers - Introduced SurfaceManifestPointer to represent a minimal pointer to a Surface.FS manifest associated with an image digest. feat: Create PolicySimulationInputLock and related validation logic - Added PolicySimulationInputLock record to describe policy simulation inputs and expected digests. - Implemented validation logic for policy simulation inputs, including checks for digest drift and shadow mode requirements. test: Add unit tests for ReplayVerificationService and ReplayVerifier - Created ReplayVerificationServiceTests to validate the behavior of the ReplayVerificationService under various scenarios. - Developed ReplayVerifierTests to ensure the correctness of the ReplayVerifier logic. test: Implement PolicySimulationInputLockValidatorTests - Added tests for PolicySimulationInputLockValidator to verify the validation logic against expected inputs and conditions. chore: Add cosign key example and signing scripts - Included a placeholder cosign key example for development purposes. - Added a script for signing Signals artifacts using cosign with support for both v2 and v3. chore: Create script for uploading evidence to the evidence locker - Developed a script to upload evidence to the evidence locker, ensuring required environment variables are set.
StellaOps Notify
Notify (Notifications Studio) converts platform events into tenant-scoped alerts with deterministic delivery, offline parity, and a full audit trail. The service is split between the reusable tooling in src/Notify/* and the runtime host in src/Notifier/* (decision recorded 2025-11-02) so downstream systems can embed the rules engine without inheriting the Studio UI.
Latest updates (2025-11-30)
- Sprint tracker
docs/implplan/SPRINT_322_docs_modules_notify.mdand moduleTASKS.mdadded to mirror status. - Observability runbook stub and Grafana placeholder added under
operations/(offline import); finalize after next demo. - NOTIFY-DOCS-0002 remains blocked pending NOTIFY-SVC-39-001..004 outputs (correlation/digests/simulation/quiet hours).
Scope & responsibilities
- Apply tenant-scoped rules to events from Scanner, Scheduler, VEX Lens, Attestor, Task Runner, and Zastava.
- Render channel-specific payloads (Slack, Teams, Email, webhook) using deterministic templates with localisation safeguards.
- Enforce throttling, digests, and quiet-hour calendars so bursts stay explainable and recoverable.
- Persist deliveries, attempts, throttles, and DSSE hashes for CLI/UI investigation and compliance export.
Current capabilities (Sprint 38 foundations)
- Rules + channels API:
StellaOps.Notify.WebServiceexposes CRUD, previews, and health probes secured by Authority scopes. - Worker pipeline:
StellaOps.Notify.Workeringests bus events, evaluates match predicates, applies per-tenant throttles, and dispatches deliveries. - Connector plug-ins: Restart-time plug-ins under
StellaOps.Notify.Connectors.*(Slack, Teams, Email, generic webhook) with health checks and retry policy hints declared innotify-plugin.json. - Template engine: Deterministic rendering with safe helpers, locale bundles, and redaction defaults that keep Offline Kit parity.
- Delivery ledger: Mongo-backed ledger storing hashed payloads, attempts, throttled/digested markers, and provenance links for audit + exports.
In progress / upcoming (Sprint 39 focus)
NOTIFY-SVC-39-001correlation engine with token-bucket throttles, incident lifecycle, and quiet-hours evaluator.NOTIFY-SVC-39-002digest generator with schedule runner, ledger queries, and distribution across existing channels.NOTIFY-SVC-39-003simulation API for rule dry-runs against historical events.NOTIFY-SVC-39-004quiet-hour calendar integration and default throttles with audit logging. Status for these items is tracked insrc/Notifier/StellaOps.Notifier/TASKS.mdand sprint plans; update this README once tasks merge.
Key docs & release alignment
docs/notifications/overview.md— summary of capabilities, imposed rules, and customer journey.docs/notifications/architecture.md— Notifications Studio runtime view (published 2025-10-29).docs/notifications/rules.md— declarative matcher syntax and evaluation order.docs/notifications/digests.md— digest windows, coalescing logic, and delivery samples.docs/notifications/templates.md— template helpers, localisation, and redaction guidelines.docs/updates/2025-10-29-notify-docs.md— latest release note; follow-ups remain to validate connector metadata, quiet-hours semantics, and simulation payloads once Sprint 39 drops land.
Integrations & dependencies
- Storage: MongoDB (
rules,channels,deliveries,digests,throttles) with change streams for worker snapshots. - Queues: Redis Streams or NATS JetStream for ingestion, throttling, and DLQs (
notify.dlq). - Authority: OpTok-protected APIs, DPoP-backed CLI/UI scopes (
notify.viewer,notify.operator,notify.admin), and secret references for channel credentials. - Observability: Prometheus metrics (
notify.sent_total,notify.failed_total,notify.digest_coalesced_total, etc.), OTEL traces, and dashboards documented indocs/notifications/architecture.md#12-observability-prometheus--otel.
Operational notes
- Schema fixtures live in
./resources/schemas; event and delivery samples live in./resources/samplesfor contract tests and UI mocks. - Offline Kit bundles ship plug-ins, default templates, and seed rules; update manifests under
ops/offline-kit/when connectors change. - Dashboards and alert references depend on
DEVOPS-NOTIFY-39-002; coordinate before renaming metrics or labels. - Observability assets:
operations/observability.mdandoperations/dashboards/notify-observability.json(offline import). - When releasing new rule or connector features, mirror guidance into
docs/notifications/*.mdand checklists indocs/updates/2025-10-29-notify-docs.mduntil the follow-ups are closed.
Epic alignment
- Epic 11 – Notifications Studio: notifications workspace, preview tooling, immutable delivery ledger, throttling/digest controls, and forthcoming correlation/simulation features.