Authority Host Task Board — Epic 1: Aggregation-Only Contract
| ID |
Status |
Owner(s) |
Depends on |
Description |
Exit Criteria |
| AUTH-AOC-19-001 |
DONE (2025-10-26) |
Authority Core & Security Guild |
— |
Introduce scopes advisory:read, advisory:ingest, vex:read, vex:ingest, aoc:verify with configuration binding, migrations, and offline kit defaults. |
Scopes published in metadata/OpenAPI, configuration validates scope lists, tests cover token issuance + enforcement. |
| AUTH-AOC-19-002 |
DONE (2025-10-27) |
Authority Core & Security Guild |
AUTH-AOC-19-001 |
Propagate tenant claim + scope enforcement for ingestion identities; ensure cross-tenant writes/read blocked and audit logs capture tenant context. |
Tenant claim injected into downstream services; forbidden cross-tenant access rejected; audit/log fixtures updated. |
2025-10-26: Rate limiter metadata/audit records now include tenants, password grant scopes/tenants enforced, token persistence + tests updated. Docs refresh tracked via AUTH-AOC-19-003.
2025-10-27: Client credential ingestion scopes now require tenant assignment; access token validation backfills tenants and rejects cross-tenant mismatches with tests.
2025-10-27: dotnet test blocked — Concelier build fails (AdvisoryObservationQueryService returns ImmutableHashSet<string?>), preventing Authority test suite run; waiting on Concelier fix before rerun.
| AUTH-AOC-19-003 | DONE (2025-10-27) | Authority Core & Docs Guild | AUTH-AOC-19-001 | Update Authority docs and sample configs to describe new scopes, tenancy enforcement, and verify endpoints. | Docs and examples refreshed; release notes prepared; smoke tests confirm new scopes required. |
2025-10-26: Docs updated (docs/11_AUTHORITY.md, Concelier audit runbook, docs/security/authority-scopes.md); sample config highlights tenant-aware clients. Release notes + smoke verification pending (blocked on Concelier/Excititor smoke updates).
2025-10-27: Scope catalogue aligned with advisory:ingest/advisory:read/vex:ingest/vex:read, aoc:verify pairing documented, console/CLI references refreshed, and etc/authority.yaml.sample updated to require read scopes for verification clients.
| AUTH-AOC-19-004 | DONE (2025-10-31) | Authority Core & Security Guild | AUTH-AOC-19-002 | Enforce AOC scope pairings: require aoc:verify alongside advisory/vex read scopes and for any signals:* requests; emit deterministic errors and telemetry. | Client/token issuance rejects missing pairings with structured errors; logs/metrics capture violations; tests and docs updated. |
2025-10-31: Client credentials and password grants now reject advisory/vex read or signals scopes without aoc:verify, enforce tenant assignment for aoc:verify, tag violations via authority.aoc_scope_violation, extend tests, and refresh scope catalogue docs/sample roles.
Link-Not-Merge v1
| ID |
Status |
Owner(s) |
Depends on |
Description |
Exit Criteria |
| AUTH-AOC-22-001 |
DONE (2025-10-29) |
Authority Core Guild |
AUTH-AOC-19-001 |
Roll out new advisory/vex ingest/read scopes. |
Legacy scopes rejected; metadata/docs/configs updated; integration tests cover advisory/vex scope enforcement for Link-Not-Merge APIs. |
2025-10-29: Rejected legacy concelier.merge scope during client credential validation, removed it from known scope catalog, blocked discovery/issuance, added regression tests, and refreshed scope documentation.
Policy Engine v2
| ID |
Status |
Owner(s) |
Depends on |
Description |
Exit Criteria |
| AUTH-POLICY-20-001 |
DONE (2025-10-26) |
Authority Core & Security Guild |
AUTH-AOC-19-001 |
Add scopes policy:write, policy:submit, policy:approve, policy:run, findings:read, effective:write with configuration binding and issuer policy updates. |
Scopes available in metadata; token issuance validated; offline kit defaults updated; tests cover scope combinations. |
| AUTH-POLICY-20-002 |
DONE (2025-10-26) |
Authority Core & Security Guild |
AUTH-POLICY-20-001, AUTH-AOC-19-002 |
Enforce Policy Engine service identity with effective:write and ensure API gateway enforces scopes/tenant claims for new endpoints. |
Gateway policies updated; unauthorized requests rejected in tests; audit logs capture scope usage. |
2025-10-26: Restricted effective:write to Policy Engine service identities with tenant requirement, registered full scope set, and tightened resource server default scope enforcement (unit tests pass).
| AUTH-POLICY-20-003 | DONE (2025-10-26) | Authority Core & Docs Guild | AUTH-POLICY-20-001 | Update Authority configuration/docs with policy scopes, service identities, and approval workflows; include compliance checklist. | Docs refreshed; samples updated; release notes prepared; doc lint passes. |
2025-10-26: Authority docs now detail policy scopes/service identity guardrails with checklist; authority.yaml.sample includes properties.serviceIdentity example.
Graph Explorer v1
| ID |
Status |
Owner(s) |
Depends on |
Description |
Exit Criteria |
| AUTH-GRAPH-21-001 |
DONE (2025-10-26) |
Authority Core & Security Guild |
AUTH-POLICY-20-001 |
Define scopes graph:write, graph:read, graph:export, graph:simulate, update metadata/OpenAPI, and add OFFLINE kit defaults. |
Scopes exposed via discovery docs; smoke tests ensure enforcement; offline kit updated. |
| AUTH-GRAPH-21-002 |
DONE (2025-10-26) |
Authority Core & Security Guild |
AUTH-GRAPH-21-001, AUTH-AOC-19-002 |
Wire gateway enforcement for new graph scopes, Cartographer service identity, and tenant propagation across graph APIs. |
Gateway config updated; unauthorized access blocked in integration tests; audit logs include graph scope usage. |
| AUTH-GRAPH-21-003 |
DONE (2025-10-26) |
Authority Core & Docs Guild |
AUTH-GRAPH-21-001 |
Update security docs and samples describing graph access roles, least privilege guidance, and service identities. |
Docs merged with compliance checklist; examples refreshed; release notes prepared. |
Policy Engine + Editor v1
| ID |
Status |
Owner(s) |
Depends on |
Description |
Exit Criteria |
| AUTH-POLICY-23-001 |
DONE (2025-10-29) |
Authority Core & Security Guild |
AUTH-POLICY-20-001 |
Introduce fine-grained scopes policy:read, policy:edit, policy:approve, policy:activate, policy:simulate; update issuer templates and metadata. |
Scopes exposed; integration tests confirm enforcement; offline kit updated. |
| AUTH-POLICY-23-002 |
BLOCKED (2025-10-29) |
Authority Core & Security Guild |
AUTH-POLICY-23-001 |
Implement optional two-person rule for activation: require two distinct policy:activate approvals when configured; emit audit logs. |
Activation endpoint enforces rule; audit logs contain approver IDs; tests cover 2-person path. |
Blocked: Policy Engine/Studio have not yet exposed activation workflow endpoints or approval payloads needed to enforce dual-control (WEB-POLICY-23-002, POLICY-ENGINE-23-002). Revisit once activation contract lands.
| AUTH-POLICY-23-003 | BLOCKED (2025-10-29) | Authority Core & Docs Guild | AUTH-POLICY-23-001 | Update documentation and sample configs for policy roles, approval workflow, and signing requirements. | Docs updated with reviewer checklist; configuration examples validated. |
Blocked pending AUTH-POLICY-23-002 dual-approval implementation so docs can capture final activation behaviour.
| AUTH-POLICY-23-004 | DONE (2025-10-27) | Authority Core & DevOps Guild | AUTH-POLICY-23-001 | Migrate default Authority client registrations/offline kit templates to the new policy scope set and provide migration guidance for existing tokens. | Updated configs committed (Authority, CLI, CI samples); migration note added to release docs; verification script confirms scopes. |
2025-10-27: Added policy-cli defaults to Authority config/secrets, refreshed CLI/CI documentation with the new scope bundle, recorded release migration guidance, and introduced scripts/verify-policy-scopes.py to guard against regressions.
Graph & Vuln Explorer v1
| ID |
Status |
Owner(s) |
Depends on |
Description |
Exit Criteria |
| AUTH-VULN-24-001 |
DONE (2025-10-29) |
Authority Core & Security Guild |
AUTH-GRAPH-21-001 |
Extend scopes to include vuln:read and signed permalinks with scoped claims for Vuln Explorer; update metadata. |
Scopes published; permalinks validated; integration tests cover RBAC. |
2025-10-27: Paused work after exploratory spike (scope enforcement still outstanding); no functional changes merged.
Orchestrator Dashboard
| ID |
Status |
Owner(s) |
Depends on |
Description |
Exit Criteria |
| AUTH-ORCH-32-001 |
DONE (2025-10-31) |
Authority Core & Security Guild |
— |
Define orch:read scope, register Orch.Viewer role, update discovery metadata, and seed offline defaults. |
Scope/role available in metadata; integration tests confirm read-only enforcement; offline kit updated. |
2025-10-31: Picked up during Console/Orchestrator alignment; focusing on scope catalog + tenant enforcement first.
2025-10-31: orch:read added to scope catalogue and Authority runtime, Console defaults include the scope, Orch.Viewer role documented, and client-credential tests enforce tenant requirements.
| AUTH-ORCH-33-001 | DOING (2025-10-27) | Authority Core & Security Guild | AUTH-ORCH-32-001 | Add Orch.Operator role/scopes for control actions, require reason/ticket attributes, and update issuer templates. | Operator tokens issued; action endpoints enforce scope + reason; audit logs capture operator info; docs refreshed. |
2025-10-27: Added orch:operate scope, enforced operator_reason/operator_ticket on token issuance, updated Authority configs/docs, and captured audit metadata for control actions.
2025-10-28: Policy gateway + scanner now pass the expanded token client signature (null metadata by default), test stubs capture the optional parameters, and Policy Gateway/Scanner suites are green after fixing the Concelier storage build break.
2025-10-28: Authority password-grant tests now hit the new constructors but still need updates to drop obsolete IOptions arguments before the suite can pass.
| AUTH-ORCH-34-001 | TODO | Authority Core & Security Guild | AUTH-ORCH-33-001 | Introduce Orch.Admin role with quota/backfill scopes, enforce audit reason on quota changes, and update offline defaults/docs. | Admin role available; quotas/backfills require scope + reason; tests confirm tenant isolation; documentation updated. |
StellaOps Console (Sprint 23)
| ID |
Status |
Owner(s) |
Depends on |
Description |
Exit Criteria |
| AUTH-CONSOLE-23-001 |
DONE (2025-10-29) |
Authority Core & Security Guild |
AUTH-POLICY-20-001 |
Register StellaOps Console confidential client with OIDC PKCE support, short-lived ID/access tokens, console:* audience claims, and SPA-friendly refresh (token exchange endpoint). Publish discovery metadata + offline kit defaults. |
Client registration committed; configuration templates updated; integration tests validate PKCE + scope issuance; security review recorded. |
2025-10-29: Authorization code flow enabled with PKCE requirement, console client seeded in authority.yaml.sample, discovery docs updated, and console runbook guidance added.
| AUTH-CONSOLE-23-002 | DONE (2025-10-31) | Authority Core & Security Guild | AUTH-CONSOLE-23-001, AUTH-AOC-19-002 | Expose tenant catalog, user profile, and token introspection endpoints required by Console (fresh-auth prompts, scope checks); enforce tenant header requirements and audit logging with correlation IDs. | Endpoints ship with RBAC enforcement, audit logs include tenant+scope, integration tests cover unauthorized/tenant-mismatch scenarios. |
2025-10-31: Added /console/tenants, /console/profile, /console/token/introspect endpoints with tenant header filter, scope enforcement (ui.read, authority:tenants.read), and structured audit events. Console test harness covers success/mismatch cases.
| AUTH-CONSOLE-23-003 | DONE (2025-10-31) | Authority Core & Docs Guild | AUTH-CONSOLE-23-001, AUTH-CONSOLE-23-002 | Update security docs/config samples for Console flows (PKCE, tenant badge, fresh-auth for admin actions, session inactivity timeouts) with compliance checklist. | Docs merged, config samples validated, release notes updated, ops runbook references new flows. |
2025-10-28: docs/security/console-security.md drafted with PKCE + DPoP (120 s OpTok, 300 s fresh-auth) and scope table. Authority Core to confirm /fresh-auth semantics, token lifetimes, and scope bundles align before closing task.
2025-10-31: Security guide expanded for /console endpoints & orchestrator scope, sample YAML annotated, ops runbook updated, and release note docs/updates/2025-10-31-console-security-refresh.md published.
| AUTH-CONSOLE-23-004 | DONE (2025-10-31) | Authority Core & Security Guild | AUTH-CONSOLE-23-003, DOCS-CONSOLE-23-012 | Validate console security guide assumptions (120 s OpTok TTL, 300 s fresh-auth window, scope bundles) against Authority implementation and update configs/audit fixtures if needed. | Confirmation recorded in sprint log; Authority config samples/tests updated when adjustments required; /fresh-auth behaviour documented in release notes. |
2025-10-31: Default access-token lifetime reduced to 120 s, console tests updated with dual auth schemes, docs/config/ops notes refreshed, release note logged.
Policy Studio (Sprint 27)
| ID |
Status |
Owner(s) |
Depends on |
Description |
Exit Criteria |
| AUTH-POLICY-27-001 |
DONE (2025-10-31) |
Authority Core & Security Guild |
AUTH-POLICY-20-001, AUTH-CONSOLE-23-001 |
Define Policy Studio roles (policy:author, policy:review, policy:approve, policy:operate, policy:audit) with tenant-scoped claims, update issuer metadata, and seed offline kit defaults. |
Scopes/roles exposed via discovery docs; tokens issued with correct claims; integration tests cover role combinations; docs updated. |
2025-10-31: Added Policy Studio scope family (policy:author/review/operate/audit), updated OpenAPI + discovery headers, enforced tenant requirements in grant handlers, seeded new roles in Authority config/offline kit docs, and refreshed CLI/Console documentation + tests to validate the new catalogue.
| AUTH-POLICY-27-002 | TODO | Authority Core & Security Guild | AUTH-POLICY-27-001, REGISTRY-API-27-007 | Provide attestation signing service bindings (OIDC token exchange, cosign integration) and enforce publish/promote scope checks, fresh-auth requirements, and audit logging. | Publish/promote requests require fresh auth + correct scopes; attestations signed with validated identity; audit logs enriched with digest + tenant; integration tests pass. |
Docs dependency: DOCS-POLICY-27-009 awaiting signing guidance from this work.
| AUTH-POLICY-27-003 | TODO | Authority Core & Docs Guild | AUTH-POLICY-27-001, AUTH-POLICY-27-002 | Update Authority configuration/docs for Policy Studio roles, signing policies, approval workflows, and CLI integration; include compliance checklist. | Docs merged; samples validated; governance checklist appended; release notes updated. |
Exceptions v1
| ID |
Status |
Owner(s) |
Depends on |
Description |
Exit Criteria |
| AUTH-EXC-25-001 |
DONE (2025-10-29) |
Authority Core & Security Guild |
AUTH-POLICY-23-001 |
Introduce exception scopes (exceptions:read, exceptions:write, exceptions:approve) and approval routing configuration with MFA gating. |
Scopes published in metadata; routing matrix validated; integration tests enforce scope + MFA rules. |
2025-10-29: Added exception scopes + routing template options, enforced MFA requirement in password grant handlers, updated configuration samples.
| AUTH-EXC-25-002 | DONE (2025-10-31) | Authority Core & Docs Guild | AUTH-EXC-25-001 | Update documentation/samples for exception roles, routing matrix, MFA requirements, and audit trail references. | Docs merged with compliance checklist; samples verified. |
2025-10-31: Authority scopes/routing docs updated (docs/security/authority-scopes.md, docs/11_AUTHORITY.md, docs/policy/exception-effects.md), monitoring guide covers new MFA audit events, and etc/authority.yaml.sample now demonstrates exception clients/templates.
Reachability v1
| ID |
Status |
Owner(s) |
Depends on |
Description |
Exit Criteria |
| AUTH-SIG-26-001 |
DONE (2025-10-29) |
Authority Core & Security Guild |
AUTH-EXC-25-001 |
Add signals:read, signals:write, signals:admin scopes, issue SignalsUploader role template, and enforce AOC for sensor identities. |
Scopes exposed; configuration validated; integration tests ensure RBAC + AOC enforcement. |
2025-10-29: Signals scopes added with tenant + aoc:verify enforcement; sensors guided via SignalsUploader template; tests cover gating.
Vulnerability Explorer (Sprint 29)
| ID |
Status |
Owner(s) |
Depends on |
Description |
Exit Criteria |
| AUTH-VULN-29-001 |
TODO |
Authority Core & Security Guild |
AUTH-POLICY-27-001 |
Define Vuln Explorer scopes/roles (vuln:view, vuln:investigate, vuln:operate, vuln:audit) with ABAC attributes (env, owner, business_tier) and update discovery metadata/offline kit defaults. |
Roles/scopes published; issuer templates updated; integration tests cover ABAC filters; docs refreshed. |
| AUTH-VULN-29-002 |
TODO |
Authority Core & Security Guild |
AUTH-VULN-29-001, LEDGER-29-002 |
Enforce CSRF/anti-forgery tokens for workflow actions, sign attachment tokens, and record audit logs with ledger event hashes. |
Workflow calls require valid tokens; audit logs include ledger references; security tests cover token expiry/abuse. |
| AUTH-VULN-29-003 |
TODO |
Authority Core & Docs Guild |
AUTH-VULN-29-001..002 |
Update security docs/config samples for Vuln Explorer roles, ABAC policies, attachment signing, and ledger verification guidance. |
Docs merged with compliance checklist; configuration examples validated; release notes updated. |
Advisory AI (Sprint 31)
| ID |
Status |
Owner(s) |
Depends on |
Description |
Exit Criteria |
| AUTH-AIAI-31-001 |
TODO |
Authority Core & Security Guild |
AUTH-VULN-29-001 |
Define Advisory AI scopes (advisory-ai:view, advisory-ai:operate, advisory-ai:admin) and remote inference toggles; update discovery metadata/offline defaults. |
Scopes/flags published; integration tests cover RBAC + opt-in settings; docs updated. |
| AUTH-AIAI-31-002 |
TODO |
Authority Core & Security Guild |
AUTH-AIAI-31-001, AIAI-31-006 |
Enforce anonymized prompt logging, tenant consent for remote inference, and audit logging of assistant tasks. |
Logging/audit flows verified; privacy review passed; docs updated. |
Export Center
| ID |
Status |
Owner(s) |
Depends on |
Description |
Exit Criteria |
| AUTH-EXPORT-35-001 |
DONE (2025-10-28) |
Authority Core & Security Guild |
AUTH-AOC-19-001 |
Introduce Export.Viewer, Export.Operator, Export.Admin scopes, configure issuer templates, and update discovery metadata/offline defaults. |
Scopes available; metadata updated; tests ensure enforcement; offline kit defaults refreshed. |
| AUTH-EXPORT-37-001 |
DONE (2025-10-28) |
Authority Core & Security Guild |
AUTH-EXPORT-35-001, WEB-EXPORT-37-001 |
Enforce admin-only access for scheduling, retention, encryption key references, and verify endpoints with audit reason capture. |
Admin scope required; audit logs include reason/ticket; integration tests cover denial cases; docs updated. |
Notifications Studio
| ID |
Status |
Owner(s) |
Depends on |
Description |
Exit Criteria |
| AUTH-NOTIFY-38-001 |
TODO |
Authority Core & Security Guild |
— |
Define Notify.Viewer, Notify.Operator, Notify.Admin scopes/roles, update discovery metadata, offline defaults, and issuer templates. |
Scopes available; metadata updated; tests ensure enforcement; offline kit defaults refreshed. |
| AUTH-NOTIFY-40-001 |
TODO |
Authority Core & Security Guild |
AUTH-NOTIFY-38-001, WEB-NOTIFY-40-001 |
Implement signed ack token key rotation, webhook allowlists, admin-only escalation settings, and audit logging of ack actions. |
Ack tokens signed/rotated; webhook allowlists enforced; admin enforcement validated; audit logs capture ack/resolution. |
CLI Parity & Task Packs
| ID |
Status |
Owner(s) |
Depends on |
Description |
Exit Criteria |
| AUTH-PACKS-41-001 |
TODO |
Authority Core & Security Guild |
AUTH-AOC-19-001 |
Define CLI SSO profiles and pack scopes (Packs.Read, Packs.Write, Packs.Run, Packs.Approve), update discovery metadata, offline defaults, and issuer templates. |
Scopes available; metadata updated; tests ensure enforcement; offline kit templates refreshed. |
| AUTH-PACKS-43-001 |
BLOCKED (2025-10-27) |
Authority Core & Security Guild |
AUTH-PACKS-41-001, TASKRUN-42-001, ORCH-SVC-42-101 |
Enforce pack signing policies, approval RBAC checks, CLI CI token scopes, and audit logging for approvals. |
Signing policies enforced; approvals require correct roles; CI token scope tests pass; audit logs recorded. |
Blocked: Pack scopes (AUTH-PACKS-41-001) and Task Runner pack approvals (ORCH-SVC-42-101, TASKRUN-42-001) are still TODO. Authority lacks baseline Packs.* scope definitions and approval/audit endpoints to enforce policies. Revisit once dependent teams deliver scope catalog + Task Runner approval API.
Authority-Backed Scopes & Tenancy (Epic 14)
| ID |
Status |
Owner(s) |
Depends on |
Description |
Exit Criteria |
| AUTH-TEN-47-001 |
DOING (2025-10-28) |
Authority Core & Security Guild |
AUTH-AOC-19-001 |
Align Authority with OIDC/JWT claims (tenants, projects, scopes), implement JWKS caching/rotation, publish scope grammar, and enforce required claims on tokens. |
Tokens include tenant/project claims; JWKS cache validated; docs updated; imposed rule noted. |
2025-10-28: Tidied advisory raw idempotency migration to avoid LINQ-on-BsonValue (explicit array copy) while continuing duplicate guardrail validation; scoped scanner/policy token call sites updated to honor new metadata parameter.
| AUTH-TEN-49-001 | TODO | Authority Core & Security Guild | AUTH-TEN-47-001 | Implement service accounts & delegation tokens (act chain), per-tenant quotas, audit stream of auth decisions, and revocation APIs. | Service tokens minted with scopes/TTL; delegation logged; quotas configurable; audit stream live; docs updated. |
Observability & Forensics (Epic 15)
| ID |
Status |
Owner(s) |
Depends on |
Description |
Exit Criteria |
| AUTH-OBS-50-001 |
TODO |
Authority Core & Security Guild |
AUTH-AOC-19-001 |
Introduce scopes obs:read, timeline:read, timeline:write, evidence:create, evidence:read, evidence:hold, attest:read, and obs:incident (all tenant-scoped). Update discovery metadata, offline defaults, and scope grammar docs. |
Scopes exposed via metadata; issuer templates updated; offline kit seeded; integration tests cover new scopes. |
| AUTH-OBS-52-001 |
TODO |
Authority Core & Security Guild |
AUTH-OBS-50-001, TIMELINE-OBS-52-003, EVID-OBS-53-003 |
Configure resource server policies for Timeline Indexer, Evidence Locker, Exporter, and Observability APIs enforcing new scopes + tenant claims. Emit audit events including scope usage and trace IDs. |
Policies deployed; unauthorized access blocked; audit logs prove scope usage; contract tests updated. |
| AUTH-OBS-55-001 |
TODO |
Authority Core & Security Guild, Ops Guild |
AUTH-OBS-50-001, WEB-OBS-55-001 |
Harden incident mode authorization: require obs:incident scope + fresh auth, log activation reason, and expose verification endpoint for auditors. Update docs/runbooks. |
Incident activate/deactivate requires scope; audit entries logged; docs updated with imposed rule reminder. |
Air-Gapped Mode (Epic 16)
| ID |
Status |
Owner(s) |
Depends on |
Description |
Exit Criteria |
| AUTH-AIRGAP-56-001 |
TODO |
Authority Core & Security Guild |
AIRGAP-CTL-56-001 |
Provision new scopes (airgap:seal, airgap:import, airgap:status:read) in configuration metadata, offline kit defaults, and issuer templates. |
Scopes exposed in discovery docs; offline kit updated; integration tests cover issuance. |
| AUTH-AIRGAP-56-002 |
TODO |
Authority Core & Security Guild |
AUTH-AIRGAP-56-001, AIRGAP-IMP-58-001 |
Audit import actions with actor, tenant, bundle ID, and trace ID; expose /authority/audit/airgap endpoint. |
Audit records persisted; endpoint paginates results; tests cover RBAC + filtering. |
| AUTH-AIRGAP-57-001 |
TODO |
Authority Core & Security Guild, DevOps Guild |
AUTH-AIRGAP-56-001, DEVOPS-AIRGAP-57-002 |
Enforce sealed-mode CI gating by refusing token issuance when declared sealed install lacks sealing confirmation. |
CI scenario validated; error surfaces remediation; docs updated. |
SDKs & OpenAPI (Epic 17)
| ID |
Status |
Owner(s) |
Depends on |
Description |
Exit Criteria |
| AUTH-OAS-61-001 |
DONE (2025-10-28) |
Authority Core & Security Guild, API Contracts Guild |
OAS-61-001 |
Document Authority authentication/token endpoints in OAS with scopes, examples, and error envelopes. |
Spec complete with security schemes; lint passes. |
2025-10-28: Auth OpenAPI authored at src/StellaOps.Api.OpenApi/authority/openapi.yaml covering /token, /introspect, /revoke, /jwks, scope catalog, and error envelopes; parsed via PyYAML sanity check and referenced in Epic 17 docs.
| AUTH-OAS-61-002 | DONE (2025-10-28) | Authority Core & Security Guild | AUTH-OAS-61-001 | Implement /.well-known/openapi with scope metadata, supported grant types, and build version. | Endpoint deployed; contract tests cover discovery. |
2025-10-28: Added /.well-known/openapi endpoint wiring cached spec metadata, YAML/JSON negotiation, HTTP cache headers, and tests verifying ETag + Accept handling. Authority spec (src/StellaOps.Api.OpenApi/authority/openapi.yaml) now includes grant/scope extensions.
| AUTH-OAS-62-001 | TODO | Authority Core & Security Guild, SDK Generator Guild | AUTH-OAS-61-001, SDKGEN-63-001 | Provide SDK helpers for OAuth2/PAT flows, tenancy override header; add integration tests. | SDKs expose auth helpers; tests cover token issuance; docs updated. |
| AUTH-OAS-63-001 | TODO | Authority Core & Security Guild, API Governance Guild | APIGOV-63-001 | Emit deprecation headers and notifications for legacy auth endpoints. | Headers emitted; notifications verified; migration guide published. |
95daa159c4