stella-ops.org/git.stella-ops.org
1
0
Fork 0
Code Issues Pull Requests Actions Releases Wiki Activity
Files
651b8e0fa3a1276d9f51430bbe1d19644ed5478f
git.stella-ops.org/src/StellaOps.Scheduler.WebService/TASKS.md
master 651b8e0fa3 feat: Add new projects to solution and implement contract testing documentation 
- Added "StellaOps.Policy.Engine", "StellaOps.Cartographer", and "StellaOps.SbomService" projects to the StellaOps solution.
- Created AGENTS.md to outline the Contract Testing Guild Charter, detailing mission, scope, and definition of done.
- Established TASKS.md for the Contract Testing Task Board, outlining tasks for Sprint 62 and Sprint 63 related to mock servers and replay testing.
2025-10-27 07:57:55 +02:00

5.9 KiB
Raw Blame History

Scheduler WebService Task Board (Sprint 16)

ID Status Owner(s) Depends on Description Exit Criteria
SCHED-WEB-16-101 DOING (2025-10-19) Scheduler WebService Guild SCHED-MODELS-16-101 Bootstrap Minimal API host with Authority OpTok + DPoP, health endpoints, plug-in discovery per architecture §§1–2. Service boots with config validation; /healthz//readyz pass; restart-only plug-ins enforced.
SCHED-WEB-16-102 TODO Scheduler WebService Guild SCHED-WEB-16-101 Implement schedules CRUD (tenant-scoped) with cron validation, pause/resume, audit logging. CRUD operations tested; invalid cron inputs rejected; audit entries persisted.
SCHED-WEB-16-103 TODO Scheduler WebService Guild SCHED-WEB-16-102 Runs API (list/detail/cancel), ad-hoc run POST, and impact preview endpoints. Integration tests cover run lifecycle; preview returns counts/sample; cancellation honoured.
SCHED-WEB-16-104 TODO Scheduler WebService Guild SCHED-QUEUE-16-401, SCHED-STORAGE-16-201 Webhook endpoints for Feedser/Vexer exports with mTLS/HMAC validation and rate limiting. Webhooks validated via tests; invalid signatures rejected; rate limits documented.

Policy Engine v2 (Sprint 20)

ID Status Owner(s) Depends on Description Exit Criteria
SCHED-WEB-20-001 TODO Scheduler WebService Guild, Policy Guild SCHED-WEB-16-101, POLICY-ENGINE-20-000 Expose policy run scheduling APIs (POST /policy/runs, GET /policy/runs) with tenant scoping and RBAC enforcement for policy:run. Endpoints documented; integration tests cover run creation/status; unauthorized access blocked.
SCHED-WEB-20-002 TODO Scheduler WebService Guild SCHED-WEB-20-001, SCHED-WORKER-20-301 Provide simulation trigger endpoint returning diff preview metadata and job state for UI/CLI consumption. Simulation endpoint returns deterministic diffs metadata; rate limits enforced; tests cover concurrency.

Graph Explorer v1 (Sprint 21)

ID Status Owner(s) Depends on Description Exit Criteria
SCHED-WEB-21-001 TODO Scheduler WebService Guild, Cartographer Guild SCHED-WEB-16-101, SCHED-MODELS-21-001 Expose graph build/overlay job APIs (POST /graphs/build, GET /graphs/jobs) with graph:write/graph:read enforcement and tenant scoping. APIs documented; integration tests cover job submission/status; unauthorized requests blocked.
SCHED-WEB-21-002 TODO Scheduler WebService Guild SCHED-WEB-21-001, CARTO-GRAPH-21-007 Provide overlay lag metrics endpoint and webhook to notify Cartographer of job completions; include correlation IDs. Endpoint returns metrics; webhook tested end-to-end; observability docs updated.

StellaOps Console (Sprint 23)

ID Status Owner(s) Depends on Description Exit Criteria
SCHED-CONSOLE-23-001 TODO Scheduler WebService Guild, BE-Base Platform Guild SCHED-WEB-16-103, SCHED-WEB-20-001 Extend runs APIs with live progress SSE endpoints (/console/runs/{id}/stream), queue lag summaries, diff metadata fetch, retry/cancel hooks with RBAC enforcement, and deterministic pagination for history views consumed by Console. SSE emits heartbeats/backoff headers, progress payload schema documented, unauthorized actions blocked in integration tests, metrics/logs expose queue lag + correlation IDs.

Policy Studio (Sprint 27)

ID Status Owner(s) Depends on Description Exit Criteria
SCHED-CONSOLE-27-001 TODO Scheduler WebService Guild, Policy Registry Guild SCHED-WEB-16-103, REGISTRY-API-27-005 Provide policy batch simulation orchestration endpoints (/policies/simulations POST/GET) exposing run creation, shard status, SSE progress, cancellation, and retries with RBAC enforcement. API handles shard lifecycle with SSE heartbeats + retry headers; unauthorized requests rejected; integration tests cover submit/cancel/resume flows.
SCHED-CONSOLE-27-002 TODO Scheduler WebService Guild, Observability Guild SCHED-CONSOLE-27-001 Emit telemetry endpoints/metrics (policy_simulation_queue_depth, policy_simulation_latency) and webhook callbacks for completion/failure consumed by Registry. Metrics exposed via gateway, dashboards seeded, webhook contract documented, integration tests validate metrics emission.

Vulnerability Explorer (Sprint 29)

ID Status Owner(s) Depends on Description Exit Criteria
SCHED-VULN-29-001 TODO Scheduler WebService Guild, Findings Ledger Guild SCHED-WEB-16-103, SBOM-VULN-29-001 Expose resolver job APIs (POST /vuln/resolver/jobs, GET /vuln/resolver/jobs/{id}) to trigger candidate recomputation per artifact/policy change with RBAC and rate limits. Resolver APIs documented; integration tests cover submit/status/cancel; unauthorized requests rejected.
SCHED-VULN-29-002 TODO Scheduler WebService Guild, Observability Guild SCHED-VULN-29-001 Provide projector lag metrics endpoint and webhook notifications for backlog breaches consumed by DevOps dashboards. Lag metrics exposed; webhook events triggered on thresholds; docs updated.

Notes

  • 2025-10-19: SCHED-MODELS-16-101 (schemas/DTOs) is DONE, so API contracts for schedules/runs are ready to consume.
  • Next steps for SCHED-WEB-16-101: create Minimal API host project scaffold, wire Authority OpTok + DPoP authentication via existing DI helpers, expose /healthz + /readyz, and load restart-only plugins per architecture §§1–2. Capture configuration validation and log shape aligned with Scheduler platform guidance before moving to CRUD implementation.