stella-ops.org/git.stella-ops.org
1
0
Fork 0
Code Issues Pull Requests Actions 16 Releases Wiki Activity
Files
75c2bcafced8b7a9e4e442cd10af3972f5788d35
git.stella-ops.org/docs/implplan/SPRINT_401_reachability_evidence_chain.md
master 75c2bcafce
Some checks failed
Docs CI / lint-and-preview (push) Has been cancelled
Details
Add LDAP Distinguished Name Helper and Credential Audit Context 
- Implemented LdapDistinguishedNameHelper for escaping RDN and filter values.
- Created AuthorityCredentialAuditContext and IAuthorityCredentialAuditContextAccessor for managing credential audit context.
- Developed StandardCredentialAuditLogger with tests for success, failure, and lockout events.
- Introduced AuthorityAuditSink for persisting audit records with structured logging.
- Added CryptoPro related classes for certificate resolution and signing operations.
2025-11-09 12:21:38 +02:00

2.7 KiB
Raw Blame History

Sprint 401 – Reachability Evidence Chain

Window: November 11 – November 22, 2025
Theme: Finish the provable reachability pipeline (graph CAS → replay → DSSE → policy/UI) so Sprint 402 can focus on polish.

Task ID State Task description Owners (Source)
GRAPH-CAS-401-001 TODO Finalize richgraph schema (richgraph-v1), emit canonical SymbolIDs, compute graph hash (BLAKE3), and store CAS manifests under cas://reachability/graphs/{sha256}. Update Scanner Worker adapters + fixtures. Scanner Worker Guild (src/Scanner/StellaOps.Scanner.Worker)
SIGNALS-RUNTIME-401-002 TODO Ship /signals/runtime-facts ingestion for NDJSON (and gzip) batches, dedupe hits, and link runtime evidence CAS URIs to callgraph nodes. Include retention + RBAC tests. Signals Guild (src/Signals/StellaOps.Signals)
SIGNALS-SCORING-401-003 TODO Extend ReachabilityScoringService to lattice states (Unknown/NotPresent/Unreachable/Conditional/Reachable/Observed), persist predicates + blocked edges, and expose /graphs/{scanId} CAS lookups. Signals Guild (src/Signals/StellaOps.Signals)
REPLAY-401-004 TODO Bump replay manifest to v2 (feeds, analyzers, policies), have ReachabilityReplayWriter enforce CAS registration + hash sorting, and add deterministic tests to tests/reachability/StellaOps.Reachability.FixtureTests. BE-Base Platform Guild (src/__Libraries/StellaOps.Replay.Core)
AUTH-REACH-401-005 TODO Introduce DSSE predicate types for SBOM/Graph/VEX/Replay, plumb signing through Authority + Signer, and mirror statements to Rekor (including PQ variants where required). Authority & Signer Guilds (src/Authority/StellaOps.Authority, src/Signer/StellaOps.Signer)
POLICY-VEX-401-006 TODO Policy Engine consumes reachability facts, emits OpenVEX with evidence references, updates SPL schema with reachability.state/confidence predicates, and produces API metrics. Policy Guild (src/Policy/StellaOps.Policy.Engine, src/Policy/__Libraries/StellaOps.Policy)
UI-CLI-401-007 TODO Implement CLI stella graph explain + UI explain drawer showing signed call-path, predicates, runtime hits, and DSSE pointers; include counterfactual controls. UI & CLI Guilds (src/Cli/StellaOps.Cli, src/UI/StellaOps.UI)
QA-DOCS-401-008 TODO Wire reachbench-2025-expanded fixtures into CI, document CAS layouts + replay steps in docs/reachability/DELIVERY_GUIDE.md, and publish operator runbook for runtime ingestion. QA & Docs Guilds (docs, tests/README.md)

Use docs/reachability/DELIVERY_GUIDE.md for architecture context, dependencies, and acceptance tests.