11597679ed
Some checks failed
AOC Guard CI / aoc-guard (push) Has been cancelled
AOC Guard CI / aoc-verify (push) Has been cancelled
Concelier Attestation Tests / attestation-tests (push) Has been cancelled
Docs CI / lint-and-preview (push) Has been cancelled
Policy Lint & Smoke / policy-lint (push) Has been cancelled
Scanner Analyzers / Discover Analyzers (push) Has been cancelled
Scanner Analyzers / Build Analyzers (push) Has been cancelled
Scanner Analyzers / Test Language Analyzers (push) Has been cancelled
Scanner Analyzers / Validate Test Fixtures (push) Has been cancelled
Scanner Analyzers / Verify Deterministic Output (push) Has been cancelled
console-runner-image / build-runner-image (push) Has been cancelled
wine-csp-build / Build Wine CSP Image (push) Has been cancelled
wine-csp-build / Integration Tests (push) Has been cancelled
wine-csp-build / Security Scan (push) Has been cancelled
wine-csp-build / Generate SBOM (push) Has been cancelled
wine-csp-build / Publish Image (push) Has been cancelled
wine-csp-build / Air-Gap Bundle (push) Has been cancelled
wine-csp-build / Test Summary (push) Has been cancelled
- Added BerkeleyDbReader class to read and extract RPM header blobs from BerkeleyDB hash databases. - Implemented methods to detect BerkeleyDB format and extract values, including handling of page sizes and magic numbers. - Added tests for BerkeleyDbReader to ensure correct functionality and header extraction. feat: Add Yarn PnP data tests - Created YarnPnpDataTests to validate package resolution and data loading from Yarn PnP cache. - Implemented tests for resolved keys, package presence, and loading from cache structure. test: Add egg-info package fixtures for Python tests - Created egg-info package fixtures for testing Python analyzers. - Included PKG-INFO, entry_points.txt, and installed-files.txt for comprehensive coverage. test: Enhance RPM database reader tests - Added tests for RpmDatabaseReader to validate fallback to legacy packages when SQLite is missing. - Implemented helper methods to create legacy package files and RPM headers for testing. test: Implement dual signing tests - Added DualSignTests to validate secondary signature addition when configured. - Created stub implementations for crypto providers and key resolvers to facilitate testing. chore: Update CI script for Playwright Chromium installation - Modified ci-console-exports.sh to ensure deterministic Chromium binary installation for console exports tests. - Added checks for Windows compatibility and environment variable setups for Playwright browsers.
StellaOps Database Documentation
This directory contains all documentation related to the StellaOps database architecture, including the MongoDB to PostgreSQL conversion project.
ADR Reference: See ADR-0001: PostgreSQL for Control-Plane Storage for the architectural decision rationale.
Document Index
| Document | Purpose |
|---|---|
| SPECIFICATION.md | PostgreSQL schema design specification, data types, naming conventions |
| RULES.md | Database coding rules, patterns, and constraints for all developers |
| CONVERSION_PLAN.md | Strategic plan for MongoDB to PostgreSQL conversion |
| VERIFICATION.md | Testing and verification requirements for database changes |
Task Definitions
Sprint-level task definitions for the conversion project:
| Phase | Document | Status |
|---|---|---|
| Phase 0 | tasks/PHASE_0_FOUNDATIONS.md | TODO |
| Phase 1 | tasks/PHASE_1_AUTHORITY.md | DONE |
| Phase 2 | tasks/PHASE_2_SCHEDULER.md | TODO |
| Phase 3 | tasks/PHASE_3_NOTIFY.md | DONE |
| Phase 4 | tasks/PHASE_4_POLICY.md | TODO |
| Phase 5 | tasks/PHASE_5_VULNERABILITIES.md | TODO |
| Phase 6 | tasks/PHASE_6_VEX_GRAPH.md | TODO |
| Phase 7 | tasks/PHASE_7_CLEANUP.md | TODO |
Schema Reference
Schema DDL files (generated from specifications):
| Schema | File | Tables |
|---|---|---|
| authority | schemas/authority.sql | 12 |
| vuln | schemas/vuln.sql | 12 |
| vex | schemas/vex.sql | 13 |
| scheduler | schemas/scheduler.sql | 10 |
| notify | schemas/notify.sql | 17 |
| policy | schemas/policy.sql | 8 |
| packs | Included in policy schema | — |
| issuer | schemas/issuer.sql | PROPOSED |
| audit (shared) | schemas/audit.sql | PROPOSED |
Notes:
- Authority, vuln, vex, scheduler DDLs have been exported from SPECIFICATION.md. Notify, policy, packs, issuer, and audit remain to be exported (placeholders present).
- Persistence configuration template:
docs/db/persistence-config-template.yaml(replace hosts/creds per environment). - Cluster provisioning inputs template:
docs/db/cluster-provisioning.md.
Quick Links
- For developers: Start with RULES.md for coding conventions
- For architects: Review SPECIFICATION.md for design rationale
- For project managers: See CONVERSION_PLAN.md for timeline and phases
- For QA: Check VERIFICATION.md for testing requirements
Key Principles
- Determinism First: All database operations must produce reproducible, stable outputs
- Tenant Isolation: Multi-tenancy via
tenant_idcolumn with row-level security - Strangler Fig Pattern: Gradual conversion with rollback capability per module
- JSONB for Flexibility: Semi-structured data stays as JSONB, relational data normalizes