61f963fd52
Some checks failed
Docs CI / lint-and-preview (push) Has been cancelled
- Added `LedgerMetrics` class to record write latency and total events for ledger operations. - Created comprehensive tests for Ruby packages endpoints, covering scenarios for missing inventory, successful retrieval, and identifier handling. - Introduced `TestSurfaceSecretsScope` for managing environment variables during tests. - Developed `ProvenanceMongoExtensions` for attaching DSSE provenance and trust information to event documents. - Implemented `EventProvenanceWriter` and `EventWriter` classes for managing event provenance in MongoDB. - Established MongoDB indexes for efficient querying of events based on provenance and trust. - Added models and JSON parsing logic for DSSE provenance and trust information.
6.4 KiB
6.4 KiB
Sprint 163 - Export & Evidence · 160.B) ExportCenter.II
Active items only. Completed/historic work now resides in docs/implplan/archived/tasks.md (updated 2025-11-08).
[Export & Evidence] 160.B) ExportCenter.II Depends on: Sprint 160.B - ExportCenter.I Summary: Export & Evidence focus on ExportCenter (phase II).
| Task ID | State | Task description | Owners (Source) |
|---|---|---|---|
| EXPORT-OAS-63-001 | TODO | Implement deprecation headers and notifications for legacy export endpoints. Dependencies: EXPORT-OAS-62-001. | Exporter Service Guild, API Governance Guild (src/ExportCenter/StellaOps.ExportCenter) |
| EXPORT-OBS-50-001 | TODO | Adopt telemetry core in exporter service + workers, ensuring spans/logs capture profile id, tenant, artifact counts, distribution type, and trace IDs. | Exporter Service Guild, Observability Guild (src/ExportCenter/StellaOps.ExportCenter) |
| EXPORT-OBS-51-001 | TODO | Emit metrics for export planner latency, bundle build time, distribution success rate, bundle size, and define SLOs (bundle availability P95 <90s). Add Grafana dashboards + burn-rate alerts. Dependencies: EXPORT-OBS-50-001. | Exporter Service Guild, DevOps Guild (src/ExportCenter/StellaOps.ExportCenter) |
| EXPORT-OBS-52-001 | TODO | Publish timeline events for export lifecycle (export.requested, export.built, export.distributed, export.failed) embedding manifest hashes and evidence refs. Provide dedupe + retry logic. Dependencies: EXPORT-OBS-51-001. |
Exporter Service Guild (src/ExportCenter/StellaOps.ExportCenter) |
| EXPORT-OBS-53-001 | TODO | Push export manifests + distribution transcripts to evidence locker bundles, ensuring Merkle root alignment and DSSE pre-sign data available. Dependencies: EXPORT-OBS-52-001. | Exporter Service Guild, Evidence Locker Guild (src/ExportCenter/StellaOps.ExportCenter) |
| EXPORT-OBS-54-001 | TODO | Produce DSSE attestations for each export artifact and distribution target, expose verification API /exports/{id}/attestation, and integrate with CLI verify path. Dependencies: EXPORT-OBS-53-001. |
Exporter Service Guild, Provenance Guild (src/ExportCenter/StellaOps.ExportCenter) |
| EXPORT-OBS-54-002 | TODO | Add promotion attestation assembly to export runs (compute SBOM/VEX digests, embed Rekor proofs, bundle DSSE envelopes) and ensure Offline Kit packaging includes the resulting JSON + DSSE envelopes. Dependencies: EXPORT-OBS-54-001, PROV-OBS-53-003. | Exporter Service Guild, Provenance Guild (src/ExportCenter/StellaOps.ExportCenter) |
| EXPORT-OBS-55-001 | TODO | Add incident mode enhancements (extra tracing for slow exports, additional debug logs, retention bump). Emit incident activation events to timeline + notifier. Dependencies: EXPORT-OBS-54-001. | Exporter Service Guild, DevOps Guild (src/ExportCenter/StellaOps.ExportCenter) |
| EXPORT-RISK-69-001 | TODO | Add Export Center job handler risk-bundle with provider selection, manifest signing, and audit logging. |
Exporter Service Guild, Risk Bundle Export Guild (src/ExportCenter/StellaOps.ExportCenter) |
| EXPORT-RISK-69-002 | TODO | Enable simulation report exports pulling scored data + explainability snapshots. Dependencies: EXPORT-RISK-69-001. | Exporter Service Guild, Risk Engine Guild (src/ExportCenter/StellaOps.ExportCenter) |
| EXPORT-RISK-70-001 | TODO | Integrate risk bundle builds into offline kit packaging with checksum verification. Dependencies: EXPORT-RISK-69-002. | Exporter Service Guild, DevOps Guild (src/ExportCenter/StellaOps.ExportCenter) |
| EXPORT-SVC-35-001 | BLOCKED (2025-10-29) | Bootstrap exporter service project, configuration, and Postgres migrations for export_profiles, export_runs, export_inputs, export_distributions with tenant scoping + tests. |
Exporter Service Guild (src/ExportCenter/StellaOps.ExportCenter) |
| EXPORT-SVC-35-002 | TODO | Implement planner + scope resolver translating filters into ledger iterators and orchestrator job payloads; include deterministic sampling and validation. Dependencies: EXPORT-SVC-35-001. | Exporter Service Guild (src/ExportCenter/StellaOps.ExportCenter) |
| EXPORT-SVC-35-003 | TODO | Deliver JSON adapters (json:raw, json:policy) with canonical normalization, redaction allowlists, compression, and manifest counts. Dependencies: EXPORT-SVC-35-002. |
Exporter Service Guild (src/ExportCenter/StellaOps.ExportCenter) |
| EXPORT-SVC-35-004 | TODO | Build mirror (full) adapter producing filesystem layout, indexes, manifests, and README with download-only distribution. Dependencies: EXPORT-SVC-35-003. | Exporter Service Guild (src/ExportCenter/StellaOps.ExportCenter) |
| EXPORT-SVC-35-005 | TODO | Implement manifest/provenance writer and KMS signing/attestation (detached + embedded) for bundle outputs. Dependencies: EXPORT-SVC-35-004. | Exporter Service Guild (src/ExportCenter/StellaOps.ExportCenter) |
| EXPORT-CRYPTO-90-001 | TODO | Ensure manifest hashing, signing, and bundle encryption flows route through ICryptoProviderRegistry/ICryptoHash so RootPack deployments can select CryptoPro/PKCS#11 providers per docs/security/crypto-routing-audit-2025-11-07.md. |
Exporter Service Guild, Security Guild (src/ExportCenter/StellaOps.ExportCenter) |
Task snapshot (2025-11-12)
- Service core:
EXPORT-SVC-35-001…005hardens planner, worker, adapters, and provenance writers for deterministic outputs. - Observability/audit:
EXPORT-OBS-50/51/52ensure traces, metrics, and audit logs capture tenants, profiles, DSSE digests. - API lifecycle:
EXPORT-OAS-63-001delivers deprecation headers + notifications for legacy endpoints. - Crypto parity:
EXPORT-CRYPTO-90-001wires sovereign provider support matching EvidenceLocker design.
Dependencies & blockers
- Requires Sprint 162 (phase I) outputs and EvidenceLocker contracts to supply DSSE digests for observability tests.
- Depends on Security Guild publishing the crypto routing reference ahead of the 2025-11-18 readiness review.
- Needs orchestrator/notifications schema finalization to define audit trail payloads and event IDs.
- Export planner/worker queue relies on Orchestrator/Scheduler telemetry readiness (Sprint 150), still in BLOCKED state.
Ready-to-start checklist
- Mirror the EvidenceLocker DSSE manifest schema into exporter tests once AdvisoryAI + orchestrator schemas freeze.
- Define telemetry schema (traces/logs/metrics) per Observability guidelines and attach to this doc.
- Draft deprecation communication plan for legacy endpoints with API Governance before coding
EXPORT-OAS-63-001. - Stage crypto provider configuration (default, CryptoPro, PKCS#11) for fast integration after the Nov-18 review.