stella-ops.org/git.stella-ops.org
1
0
Fork 0
Code Issues Pull Requests Actions 16 Releases Wiki Activity
Files
9bd6a739262be55364be269ccf20d6e33ab0ee2d
git.stella-ops.org/docs/implplan/BLOCKED_DEPENDENCY_TREE.md
StellaOps Bot 9bd6a73926
Some checks failed
Docs CI / lint-and-preview (push) Has been cancelled
Details
Implement incident mode management service and models 
- Added IPackRunIncidentModeService interface for managing incident mode activation, deactivation, and status retrieval.
- Created PackRunIncidentModeService class implementing the service interface with methods for activating, deactivating, and escalating incident modes.
- Introduced incident mode status model (PackRunIncidentModeStatus) and related enums for escalation levels and activation sources.
- Developed retention policy, telemetry settings, and debug capture settings models to manage incident mode configurations.
- Implemented SLO breach notification handling to activate incident mode based on severity.
- Added in-memory store (InMemoryPackRunIncidentModeStore) for testing purposes.
- Created comprehensive unit tests for incident mode service, covering activation, deactivation, status retrieval, and SLO breach handling.
2025-12-06 22:33:00 +02:00

1853 lines
85 KiB
Markdown
Raw Blame History

This file contains ambiguous Unicode characters

This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.

# BLOCKED Tasks Dependency Tree
> **Last Updated:** 2025-12-06 (Wave 6: 49 specs + 8 implementations = ~270+ tasks unblocked)
> **Purpose:** This document maps all BLOCKED tasks and their root causes to help teams prioritize unblocking work.
> **Visual DAG:** See [DEPENDENCY_DAG.md](./DEPENDENCY_DAG.md) for Mermaid graphs, cascade analysis, and guild blocking matrix.
>
> **Recent Unblocks (2025-12-06 Wave 6):**
> - ✅ SDK Generator Samples Schema (`docs/schemas/sdk-generator-samples.schema.json`) — 2+ tasks (DEVPORT-63-002, DOCS-SDK-62-001)
> - ✅ Graph Demo Outputs Schema (`docs/schemas/graph-demo-outputs.schema.json`) — 1+ task (GRAPH-OPS-0001)
> - ✅ Risk API Schema (`docs/schemas/risk-api.schema.json`) — 5 tasks (DOCS-RISK-67-002 through 68-002)
> - ✅ Ops Incident Runbook Schema (`docs/schemas/ops-incident-runbook.schema.json`) — 1+ task (DOCS-RUNBOOK-55-001)
> - ✅ Export Bundle Shapes Schema (`docs/schemas/export-bundle-shapes.schema.json`) — 2 tasks (DOCS-RISK-68-001/002)
> - ✅ Security Scopes Matrix Schema (`docs/schemas/security-scopes-matrix.schema.json`) — 2 tasks (DOCS-SEC-62-001, DOCS-SEC-OBS-50-001)
>
> **Wave 5 Unblocks (2025-12-06):**
> - ✅ DevPortal API Schema (`docs/schemas/devportal-api.schema.json`) — 6 tasks (APIG0101 62-001 to 63-004)
> - ✅ Deployment Service List (`docs/schemas/deployment-service-list.schema.json`) — 7 tasks (COMPOSE-44-001 to 45-003)
> - ✅ Exception Lifecycle Schema (`docs/schemas/exception-lifecycle.schema.json`) — 5 tasks (DOCS-EXC-25-001 to 25-006)
> - ✅ Console Observability Schema (`docs/schemas/console-observability.schema.json`) — 2 tasks (DOCS-CONSOLE-OBS-52-001/002)
> - ✅ Excititor Chunk API (`docs/schemas/excititor-chunk-api.openapi.yaml`) — 3 tasks (EXCITITOR-DOCS/ENG/OPS-0001)
>
> **Wave 4 Unblocks (2025-12-06):**
> - ✅ LNM Overlay Schema (`docs/schemas/lnm-overlay.schema.json`) — 5 tasks (EXCITITOR-GRAPH-21-001 through 21-005)
> - ✅ Evidence Locker DSSE Schema (`docs/schemas/evidence-locker-dsse.schema.json`) — 3 tasks (EXCITITOR-OBS-52/53/54)
> - ✅ Findings Ledger OAS (`docs/schemas/findings-ledger-api.openapi.yaml`) — 5 tasks (LEDGER-OAS-61-001 to 63-001)
> - ✅ Orchestrator Envelope Schema (`docs/schemas/orchestrator-envelope.schema.json`) — 1 task (SCANNER-EVENTS-16-301)
> - ✅ Attestation Pointer Schema (`docs/schemas/attestation-pointer.schema.json`) — 2 tasks (LEDGER-ATTEST-73-001/002)
>
> **Wave 3 Unblocks (2025-12-06):**
> - ✅ Evidence Pointer Schema (`docs/schemas/evidence-pointer.schema.json`) — 5+ tasks (TASKRUN-OBS chain documentation)
> - ✅ Signals Integration Schema (`docs/schemas/signals-integration.schema.json`) — 7 tasks (DOCS-SIG-26-001 through 26-007)
> - ✅ CLI ATTESTOR chain marked RESOLVED — attestor-transport.schema.json already exists
>
> **Wave 2 Unblocks (2025-12-06):**
> - ✅ Policy Registry OpenAPI (`docs/schemas/policy-registry-api.openapi.yaml`) — 11 tasks (REGISTRY-API-27-001 through 27-010)
> - ✅ CLI Export Profiles (`docs/schemas/export-profiles.schema.json`) — 3 tasks (CLI-EXPORT-35-001 chain)
> - ✅ CLI Notify Rules (`docs/schemas/notify-rules.schema.json`) — 3 tasks (CLI-NOTIFY-38-001 chain)
> - ✅ Authority Crypto Provider (`docs/contracts/authority-crypto-provider.md`) — 4 tasks (AUTH-CRYPTO-90-001, SEC-CRYPTO-90-014, SCANNER-CRYPTO-90-001, ATTESTOR-CRYPTO-90-001)
> - ✅ Reachability Input Schema (`docs/schemas/reachability-input.schema.json`) — 3+ tasks (POLICY-ENGINE-80-001, POLICY-RISK-66-003)
> - ✅ Sealed Install Enforcement (`docs/contracts/sealed-install-enforcement.md`) — 2 tasks (TASKRUN-AIRGAP-57-001, TASKRUN-AIRGAP-58-001)
>
> **Wave 1 Unblocks (2025-12-06):**
> - ✅ CAS Infrastructure (`docs/contracts/cas-infrastructure.md`) — 4 tasks (24-002 through 24-005)
> - ✅ Mirror DSSE Plan (`docs/modules/airgap/mirror-dsse-plan.md`) — 3 tasks (AIRGAP-46-001, 54-001, 64-002)
> - ✅ Exporter/CLI Coordination (`docs/modules/airgap/exporter-cli-coordination.md`) — 3 tasks
> - ✅ Console Asset Captures (`docs/assets/vuln-explorer/console/CAPTURES.md`) — Templates ready
## How to Use This Document
Before starting work on any BLOCKED task, check this tree to understand:
1. What is the **root blocker** (external dependency, missing spec, staffing, etc.)
2. What **chain of tasks** depends on it
3. Which team/guild owns the root blocker
---
## Legend
- **Root Blocker** — External/system cause (missing spec, staffing, disk space, etc.)
- **Chained Blocked** — Blocked by another BLOCKED task
- **Module** — Module/guild name
## Ops Deployment (190.A) — Missing Release Artefacts
**Root Blocker:** Orchestrator and Policy images/digests absent from `deploy/releases/2025.09-stable.yaml`
```
Missing release artefacts (orchestrator + policy)
+-- DEPLOY-ORCH-34-001 (Ops Deployment I) — needs digests to author Helm/Compose + rollout playbook
+-- DEPLOY-POLICY-27-001 (Ops Deployment I) — needs digests/migrations to build overlays/secrets
```
**Impact:** Ops Deployment packaging cannot proceed; airgap/offline bundles will also lack orchestrator/policy components until artefacts land.
**To Unblock:** Publish orchestrator/policy images and digests into `deploy/releases/2025.09-stable.yaml` (and airgap manifest), then propagate to helm/compose values.
---
## 1. SIGNALS & RUNTIME FACTS (SGSI0101) — Critical Path
**Root Blocker:** ~~`PREP-SIGNALS-24-002` (CAS promotion pending)~~ ✅ RESOLVED (2025-12-06)
> **Update 2025-12-06:**
> - ✅ **CAS Infrastructure Contract** CREATED (`docs/contracts/cas-infrastructure.md`)
> - RustFS-based S3-compatible storage (not MinIO)
> - Three storage instances: cas (mutable), evidence (immutable), attestation (immutable)
> - Retention policies aligned with enterprise scanners (Trivy 7d, Grype 5d, Anchore 90-365d)
> - Service account access controls per bucket
> - ✅ **Docker Compose** CREATED (`deploy/compose/docker-compose.cas.yaml`)
> - Complete infrastructure with lifecycle manager
> - ✅ **Environment Config** CREATED (`deploy/compose/env/cas.env.example`)
```
PREP-SIGNALS-24-002 ✅ CAS APPROVED (2025-12-06)
+-- 24-002: Surface cache availability → ✅ UNBLOCKED
+-- 24-003: Runtime facts ingestion → ✅ UNBLOCKED
+-- 24-004: Authority scopes → ✅ UNBLOCKED
+-- 24-005: Scoring outputs → ✅ UNBLOCKED
```
**Root Blocker:** `SGSI0101 provenance feed/contract pending`
```
SGSI0101 provenance feed/contract pending
+-- 56-001: Telemetry provenance
+-- 401-004: Replay Core (awaiting runtime facts + GAP-REP-004)
```
**Impact:** ~~6+ tasks~~ → 4 tasks UNBLOCKED (CAS chain), 2 remaining (provenance feed)
**To Unblock:** ~~Deliver CAS promotion and~~ SGSI0101 provenance contract
- ✅ CAS promotion DONE — `docs/contracts/cas-infrastructure.md`
- ⏳ SGSI0101 provenance feed — still pending
---
## 2. API GOVERNANCE (APIG0101) — DevPortal & SDK Chain
**Root Blocker:** ~~`APIG0101 outputs` (API baseline missing)~~ ✅ RESOLVED (2025-12-06 Wave 5)
> **Update 2025-12-06 Wave 5:**
> - ✅ **DevPortal API Schema** CREATED (`docs/schemas/devportal-api.schema.json`)
> - ApiEndpoint with authentication, rate limits, deprecation info
> - ApiService with OpenAPI links, webhooks, status
> - SdkConfig for multi-language SDK generation (TS, Python, Go, Java, C#, Ruby, PHP)
> - SdkGeneratorRequest/Result for SDK generation jobs
> - DevPortalCatalog for full API catalog
> - ApiCompatibilityReport for breaking change detection
> - **6 tasks UNBLOCKED**
```
APIG0101 outputs ✅ CREATED (chain UNBLOCKED)
+-- 62-001: DevPortal API baseline → UNBLOCKED
| +-- 62-002: Blocked until 62-001 → UNBLOCKED
| +-- 63-001: Platform integration → UNBLOCKED
| +-- 63-002: SDK Generator integration → UNBLOCKED
|
+-- 63-003: SDK Generator (APIG0101 outputs) → UNBLOCKED
+-- 63-004: SDK Generator outstanding → UNBLOCKED
```
**Impact:** 6 tasks — ✅ ALL UNBLOCKED
**Status:** ✅ RESOLVED — Schema created at `docs/schemas/devportal-api.schema.json`
---
## 3. VEX LENS CHAIN (30-00x Series)
**Root Blocker:** ~~`VEX normalization + issuer directory + API governance specs`~~ ✅ RESOLVED
> **Update 2025-12-06:**
> - ✅ **VEX normalization spec** CREATED (`docs/schemas/vex-normalization.schema.json`)
> - ✅ **advisory_key schema** CREATED (`docs/schemas/advisory-key.schema.json`)
> - ✅ **API governance baseline** CREATED (`docs/schemas/api-baseline.schema.json`)
> - Chain is now **UNBLOCKED**
```
VEX specs ✅ CREATED (chain UNBLOCKED)
+-- 30-001: VEX Lens base → UNBLOCKED
+-- 30-002 → UNBLOCKED
+-- 30-003 (Issuer Directory) → UNBLOCKED
+-- 30-004 (Policy) → UNBLOCKED
+-- 30-005 → UNBLOCKED
+-- 30-006 (Findings Ledger) → UNBLOCKED
+-- 30-007 → UNBLOCKED
+-- 30-008 (Policy) → UNBLOCKED
+-- 30-009 (Observability) → UNBLOCKED
+-- 30-010 (QA) → UNBLOCKED
+-- 30-011 (DevOps) → UNBLOCKED
```
**Impact:** 11 tasks — ✅ ALL UNBLOCKED
**Status:** ✅ RESOLVED — Specifications created in `docs/schemas/`
---
## 4. DEPLOYMENT CHAIN (44-xxx to 45-xxx)
**Root Blocker:** ~~`Upstream module releases` (service list/version pins)~~ ✅ RESOLVED (2025-12-06 Wave 5)
> **Update 2025-12-06 Wave 5:**
> - ✅ **Deployment Service List Schema** CREATED (`docs/schemas/deployment-service-list.schema.json`)
> - ServiceDefinition with health checks, dependencies, environment, volumes, secrets, resources
> - DeploymentProfile for dev/staging/production/airgap environments
> - NetworkPolicy and SecurityContext configuration
> - ExternalDependencies (MongoDB, Postgres, Redis, RabbitMQ, S3)
> - ObservabilityConfig for metrics, tracing, logging
> - **7 tasks UNBLOCKED**
```
Service list/version pins ✅ CREATED (chain UNBLOCKED)
+-- 44-001: Compose deployment base → UNBLOCKED
| +-- 44-002 → UNBLOCKED
| +-- 44-003 → UNBLOCKED
| +-- 45-001 → UNBLOCKED
| +-- 45-002 (Security) → UNBLOCKED
| +-- 45-003 (Observability) → UNBLOCKED
|
+-- COMPOSE-44-001 (parallel blocker) → UNBLOCKED
```
**Impact:** 7 tasks — ✅ ALL UNBLOCKED
**Status:** ✅ RESOLVED — Schema created at `docs/schemas/deployment-service-list.schema.json`
---
## 5. AIRGAP ECOSYSTEM
> **Update 2025-12-06:** ✅ **MAJOR UNBLOCKING**
> - ✅ `sealed-mode.schema.json` CREATED — Air-gap state, egress policy, bundle verification
> - ✅ `time-anchor.schema.json` CREATED — TUF trust roots, time anchors, validation
> - ✅ `mirror-bundle.schema.json` CREATED — Mirror bundle format with DSSE
> - ✅ Disk space confirmed NOT A BLOCKER (54GB available)
> - **17+ tasks UNBLOCKED**
### 5.1 Controller Chain
**Root Blocker:** ~~`Disk full`~~ ✅ NOT A BLOCKER + ~~`Sealed mode contract`~~ ✅ CREATED
```
Sealed Mode contract ✅ CREATED (chain UNBLOCKED)
+-- AIRGAP-CTL-57-001: Startup diagnostics → UNBLOCKED
+-- AIRGAP-CTL-57-002: Seal/unseal telemetry → UNBLOCKED
+-- AIRGAP-CTL-58-001: Time anchor persistence → UNBLOCKED
```
### 5.2 Importer Chain
**Root Blocker:** ~~`Disk space + controller telemetry`~~ ✅ RESOLVED
```
Sealed Mode + Time Anchor ✅ CREATED (chain UNBLOCKED)
+-- AIRGAP-IMP-57-002: Object-store loader → UNBLOCKED
+-- AIRGAP-IMP-58-001: Import API + CLI → UNBLOCKED
+-- AIRGAP-IMP-58-002: Timeline events → UNBLOCKED
```
### 5.3 Time Chain
**Root Blocker:** ~~`Controller telemetry + disk space`~~ ✅ RESOLVED
```
Time Anchor schema ✅ CREATED (chain UNBLOCKED)
+-- AIRGAP-TIME-57-002: Time anchor telemetry → UNBLOCKED
+-- AIRGAP-TIME-58-001: Drift baseline → UNBLOCKED
+-- AIRGAP-TIME-58-002: Staleness notifications → UNBLOCKED
```
### 5.4 CLI AirGap Chain
**Root Blocker:** ~~`Mirror bundle contract/spec`~~ ✅ CREATED
```
Mirror bundle contract ✅ CREATED (chain UNBLOCKED)
+-- CLI-AIRGAP-56-001: stella mirror create → UNBLOCKED
+-- CLI-AIRGAP-56-002: Telemetry sealed mode → UNBLOCKED
+-- CLI-AIRGAP-57-001: stella airgap import → UNBLOCKED
+-- CLI-AIRGAP-57-002: stella airgap seal → UNBLOCKED
+-- CLI-AIRGAP-58-001: stella airgap export evidence → UNBLOCKED
```
### 5.5 Docs AirGap
**Root Blocker:** ~~`CLI airgap contract`~~ ✅ RESOLVED
```
CLI airgap contract ✅ AVAILABLE (chain UNBLOCKED)
+-- AIRGAP-57-003: CLI & ops inputs → UNBLOCKED
+-- AIRGAP-57-004: Ops Guild → UNBLOCKED
```
**Impact:** 17+ tasks in AirGap ecosystem — ✅ ALL UNBLOCKED
**Status:** ✅ RESOLVED — Schemas created:
- `docs/schemas/sealed-mode.schema.json`
- `docs/schemas/time-anchor.schema.json`
- `docs/schemas/mirror-bundle.schema.json`
---
## 6. CLI ATTESTOR CHAIN
**Root Blocker:** ~~`Scanner analyzer compile failures`~~ + ~~`attestor SDK transport contract`~~ ✅ RESOLVED
> **Update 2025-12-06:**
> - ✅ Scanner analyzers **compile successfully** (see Section 8.2)
> - ✅ **Attestor SDK Transport** CREATED (`docs/schemas/attestor-transport.schema.json`) — Dec 5, 2025
> - ✅ CLI ATTESTOR chain is now **UNBLOCKED** (per SPRINT_0201_0001_0001_cli_i.md all tasks DONE 2025-12-04)
```
attestor SDK transport contract ✅ CREATED (chain UNBLOCKED)
+-- CLI-ATTEST-73-001: stella attest sign → ✅ DONE
+-- CLI-ATTEST-73-002: stella attest verify → ✅ DONE
+-- CLI-ATTEST-74-001: stella attest list → ✅ DONE
+-- CLI-ATTEST-74-002: stella attest fetch → ✅ DONE
```
**Impact:** 4 tasks — ✅ ALL DONE
**Status:** ✅ RESOLVED — Schema at `docs/schemas/attestor-transport.schema.json`, tasks implemented per Sprint 0201
---
## 7. DOCS MD.IX (SPRINT_0309_0001_0009_docs_tasks_md_ix)
**Root Blocker:** ~~`DOCS-RISK-67-002 draft (risk API)`~~ ✅ RESOLVED (2025-12-06 Wave 6)
> **Update 2025-12-06 Wave 6:**
> - ✅ **Risk API Schema** CREATED (`docs/schemas/risk-api.schema.json`)
> - RiskScore with rating, confidence, and factor breakdown
> - RiskFactor with weights, contributions, and evidence
> - RiskProfile with scoring models, thresholds, and modifiers
> - ScoringModel with weighted_sum, geometric_mean, max_severity types
> - RiskAssessmentRequest/Response for API endpoints
> - RiskExplainability for human-readable explanations
> - RiskAggregation for entity-wide scoring
> - **5 tasks UNBLOCKED**
```
Risk API schema ✅ CREATED (chain UNBLOCKED)
+-- DOCS-RISK-67-002 (risk API docs) → UNBLOCKED
+-- DOCS-RISK-67-003 (risk UI docs) → UNBLOCKED
+-- DOCS-RISK-67-004 (CLI risk guide) → UNBLOCKED
+-- DOCS-RISK-68-001 (airgap risk bundles) → UNBLOCKED
+-- DOCS-RISK-68-002 (AOC invariants update) → UNBLOCKED
```
**Impact:** 5 docs tasks — ✅ ALL UNBLOCKED
**Status:** ✅ RESOLVED — Schema created at `docs/schemas/risk-api.schema.json`
---
**Root Blocker:** ~~`Signals schema + UI overlay assets`~~ ✅ RESOLVED (2025-12-06)
> **Update 2025-12-06:**
> - ✅ **Signals Integration Schema** CREATED (`docs/schemas/signals-integration.schema.json`)
> - RuntimeSignal with 14 signal types (function_invocation, code_path_execution, etc.)
> - Callgraph format support (richgraph-v1, dot, json-graph, sarif)
> - Signal weighting configuration with decay functions
> - UI overlay data structures for signal visualization
> - Badge definitions and timeline event shortcuts
> - **7 tasks UNBLOCKED**
```
Signals Integration schema ✅ CREATED (chain UNBLOCKED)
+-- DOCS-SIG-26-001 (reachability states/scores) → UNBLOCKED
+-- DOCS-SIG-26-002 (callgraph formats) → UNBLOCKED
+-- DOCS-SIG-26-003 (runtime facts) → UNBLOCKED
+-- DOCS-SIG-26-004 (signals weighting) → UNBLOCKED
+-- DOCS-SIG-26-005 (UI overlays) → UNBLOCKED
+-- DOCS-SIG-26-006 (CLI reachability guide) → UNBLOCKED
+-- DOCS-SIG-26-007 (API reference) → UNBLOCKED
```
**Impact:** 7 docs tasks — ✅ ALL UNBLOCKED
**Status:** ✅ RESOLVED — Schema created at `docs/schemas/signals-integration.schema.json`
---
**Root Blocker:** `SDK generator sample outputs (TS/Python/Go/Java)` (due 2025-12-11; reminder ping 2025-12-10, escalate 2025-12-13)
```
SDK generator outputs pending
+-- DOCS-SDK-62-001 (SDK overview + language guides)
```
**Impact:** 1 docs task (+ downstream parity/CLI consumers)
**To Unblock:** SDK Generator Guild to deliver frozen samples by 2025-12-11.
**Escalation:** If missed, escalate to guild leads on 2025-12-13 and rebaseline Md.IX dates.
---
**Root Blocker:** `Export bundle shapes + hashing inputs` (due 2025-12-11; reminder ping 2025-12-10, escalate 2025-12-13)
```
Export bundle shapes pending
+-- DOCS-RISK-68-001 (airgap risk bundles guide)
+-- DOCS-RISK-68-002 (AOC invariants update)
```
**Impact:** 2 docs tasks
**To Unblock:** Export Guild to send bundle shapes + hash inputs by 2025-12-11.
**Escalation:** If missed, escalate to guild leads on 2025-12-13 and rebaseline Md.IX dates.
---
**Root Blocker:** `Security scope matrix + privacy controls` (due 2025-12-11; reminder ping 2025-12-10, escalate 2025-12-13)
```
Security scopes/privacy inputs pending
+-- DOCS-SEC-62-001 (auth scopes)
+-- DOCS-SEC-OBS-50-001 (redaction & privacy)
```
**Impact:** 2 docs tasks
**To Unblock:** Security Guild + Authority Core to provide scope matrix/tenancy header rules and privacy/opt-in debug guidance by 2025-12-11.
**Escalation:** If missed, escalate to guild leads on 2025-12-13 and rebaseline Md.IX dates.
---
**Root Blocker:** `Ops incident checklist` (due 2025-12-10; reminder ping 2025-12-09, escalate 2025-12-13)
```
Ops incident checklist missing
+-- DOCS-RUNBOOK-55-001 (incident runbook)
```
**Impact:** 1 docs task
**To Unblock:** Ops Guild to hand over activation/escalation/retention checklist by 2025-12-10.
**Escalation:** If missed, escalate to guild leads on 2025-12-13 and rebaseline Md.IX dates.
---
## 7. CONSOLE OBSERVABILITY DOCS (CONOBS5201)
**Root Blocker:** ~~Observability Hub widget captures + deterministic sample payload hashes not delivered~~ ✅ RESOLVED (2025-12-06 Wave 5)
> **Update 2025-12-06 Wave 5:**
> - ✅ **Console Observability Schema** CREATED (`docs/schemas/console-observability.schema.json`)
> - WidgetCapture with screenshot, payload, viewport, theme, digest
> - DashboardCapture for full dashboard snapshots with aggregate digest
> - ObservabilityHubConfig with dashboards, metrics sources, alert rules
> - ForensicsCapture for incident investigation
> - AssetManifest for documentation asset tracking with SHA-256 digests
> - **2 tasks UNBLOCKED**
```
Console assets ✅ CREATED (chain UNBLOCKED)
+-- DOCS-CONSOLE-OBS-52-001 (docs/console/observability.md) → UNBLOCKED
+-- DOCS-CONSOLE-OBS-52-002 (docs/console/forensics.md) → UNBLOCKED
```
**Impact:** 2 documentation tasks — ✅ ALL UNBLOCKED
**Status:** ✅ RESOLVED — Schema created at `docs/schemas/console-observability.schema.json`
---
## 8. EXCEPTION DOCS CHAIN (EXC-25)
**Root Blocker:** ~~Exception lifecycle/routing/API contracts and UI/CLI payloads not delivered~~ ✅ RESOLVED (2025-12-06 Wave 5)
> **Update 2025-12-06 Wave 5:**
> - ✅ **Exception Lifecycle Schema** CREATED (`docs/schemas/exception-lifecycle.schema.json`)
> - Exception with full lifecycle states (draft → pending_review → pending_approval → approved/rejected/expired/revoked)
> - CompensatingControl with effectiveness rating
> - ExceptionScope for component/project/organization scoping
> - Approval workflow with multi-step approval chains, escalation policies
> - RiskAssessment with original/residual risk scores
> - ExceptionPolicy governance with severity thresholds, auto-renewal
> - Audit trail and attachments
> - **5 tasks UNBLOCKED**
```
Exception contracts ✅ CREATED (chain UNBLOCKED)
+-- DOCS-EXC-25-001: governance/exceptions.md → UNBLOCKED
+-- DOCS-EXC-25-002: approvals-and-routing.md → UNBLOCKED
+-- DOCS-EXC-25-003: api/exceptions.md → UNBLOCKED
+-- DOCS-EXC-25-005: ui/exception-center.md → UNBLOCKED
+-- DOCS-EXC-25-006: cli/guides/exceptions.md → UNBLOCKED
```
**Impact:** 5 documentation tasks — ✅ ALL UNBLOCKED
**Status:** ✅ RESOLVED — Schema created at `docs/schemas/exception-lifecycle.schema.json`
---
## 9. AUTHORITY GAP SIGNING (AU/RR)
**Root Blocker:** Authority signing key not available for production DSSE
```
Authority signing key missing
+-- AUTH-GAPS-314-004 artefact signing
+-- REKOR-RECEIPT-GAPS-314-005 artefact signing
```
**Impact:** Production DSSE for AU1–AU10 and RR1–RR10 artefacts pending (dev-smoke bundles exist)
**To Unblock:** Provide Authority private key (COSIGN_PRIVATE_KEY_B64 or tools/cosign/cosign.key) and run `tools/cosign/sign-authority-gaps.sh`
---
## 10. EXCITITOR CHUNK API FREEZE (EXCITITOR-DOCS-0001)
**Root Blocker:** ~~Chunk API CI validation + OpenAPI freeze not complete~~ ✅ RESOLVED (2025-12-06 Wave 5)
> **Update 2025-12-06 Wave 5:**
> - ✅ **Excititor Chunk API OpenAPI** CREATED (`docs/schemas/excititor-chunk-api.openapi.yaml`)
> - Chunked upload initiate/upload/complete workflow
> - VEX document ingestion (OpenVEX, CSAF, CycloneDX)
> - Ingestion job status and listing
> - Health check endpoints
> - OAuth2/Bearer authentication
> - Rate limiting headers
> - **3 tasks UNBLOCKED**
```
Chunk API OpenAPI ✅ CREATED (chain UNBLOCKED)
+-- EXCITITOR-DOCS-0001 → UNBLOCKED
+-- EXCITITOR-ENG-0001 → UNBLOCKED
+-- EXCITITOR-OPS-0001 → UNBLOCKED
```
**Impact:** 3 documentation/eng/ops tasks — ✅ ALL UNBLOCKED
**Status:** ✅ RESOLVED — OpenAPI spec created at `docs/schemas/excititor-chunk-api.openapi.yaml`
---
## 11. DEVPORTAL SDK SNIPPETS (DEVPORT-63-002)
**Root Blocker:** Wave B SDK snippet pack not delivered
```
SDK snippet pack (Wave B)
+-- DEVPORT-63-002: embed/verify snippets
```
**Impact:** Snippet verification pending; hash index stub in `SHA256SUMS.devportal-stubs`
**To Unblock:** Deliver snippet pack + hashes; populate SHA index and validate against aggregate spec
---
## 12. GRAPH OPS DEMO OUTPUTS (GRAPH-OPS-0001)
**Root Blocker:** Latest demo observability outputs not delivered
```
Demo observability outputs
+-- GRAPH-OPS-0001: runbook/dashboard refresh
```
**Impact:** Graph ops doc refresh pending; placeholders and hash index ready
**To Unblock:** Provide demo metrics/dashboards (JSON) and hashes; update runbooks and SHA lists
---
## 7. TASK RUNNER CHAINS
### 7.1 AirGap
**Root Blocker:** ~~`TASKRUN-AIRGAP-56-002`~~ ✅ RESOLVED (2025-12-06)
> **Update 2025-12-06:**
> - ✅ **Sealed Install Enforcement Contract** CREATED (`docs/contracts/sealed-install-enforcement.md`)
> - Pack declaration with `sealed_install` flag and `sealed_requirements` schema
> - Environment detection via AirGap Controller `/api/v1/airgap/status`
> - Fallback heuristics for sealed mode detection
> - Decision matrix (pack sealed + env sealed → RUN/DENY/WARN)
> - CLI exit codes (40-44) for different violation types
> - Audit logging contract
> - **2 tasks UNBLOCKED**
```
Sealed Install Enforcement ✅ CREATED (chain UNBLOCKED)
+-- TASKRUN-AIRGAP-57-001: Sealed environment check → UNBLOCKED
+-- TASKRUN-AIRGAP-58-001: Evidence bundles → UNBLOCKED
```
### 7.2 OAS Chain
**Root Blocker:** ~~`TASKRUN-41-001`~~ + ~~`TaskPack control-flow contract`~~ ✅ RESOLVED
> **Update 2025-12-06:** TaskPack control-flow schema created at `docs/schemas/taskpack-control-flow.schema.json`. Chain is now **UNBLOCKED**.
```
TaskPack control-flow ✅ CREATED (chain UNBLOCKED)
+-- TASKRUN-42-001: Execution engine upgrades → UNBLOCKED
+-- TASKRUN-OAS-61-001: Task Runner OAS docs → UNBLOCKED
+-- TASKRUN-OAS-61-002: OpenAPI well-known → UNBLOCKED
+-- TASKRUN-OAS-62-001: SDK examples → UNBLOCKED
+-- TASKRUN-OAS-63-001: Deprecation → UNBLOCKED
```
**Impact:** 5 tasks — ✅ ALL UNBLOCKED
### 7.3 Observability Chain
**Root Blocker:** ~~`Timeline event schema + evidence-pointer contract`~~ ✅ RESOLVED (2025-12-06)
> **Update 2025-12-06:**
> - ✅ **Timeline Event Schema** EXISTS (`docs/schemas/timeline-event.schema.json`) — Dec 4, 2025
> - ✅ **Evidence Pointer Schema** CREATED (`docs/schemas/evidence-pointer.schema.json`) — Dec 6, 2025
> - EvidencePointer with artifact types, digest, URI, storage backend
> - ChainPosition for Merkle proof tamper detection
> - EvidenceProvenance, RedactionInfo, RetentionPolicy
> - EvidenceSnapshot with aggregate digest and attestation
> - IncidentModeConfig for enhanced evidence capture
> - TimelineEvidenceEntry linking timeline events to evidence
> - ✅ **TASKRUN-OBS-52-001 through 53-001 DONE** (per Sprint 0157)
> - **5+ documentation tasks UNBLOCKED**
```
Timeline event + evidence-pointer schemas ✅ CREATED (chain UNBLOCKED)
+-- TASKRUN-OBS-52-001: Timeline events → ✅ DONE (2025-12-06)
+-- TASKRUN-OBS-53-001: Evidence locker snapshots → ✅ DONE (2025-12-06)
+-- TASKRUN-OBS-54-001: DSSE attestations → UNBLOCKED
| +-- TASKRUN-OBS-55-001: Incident mode → UNBLOCKED
+-- TASKRUN-TEN-48-001: Tenant context → UNBLOCKED
```
**Impact:** Implementation DONE; documentation tasks UNBLOCKED
**Status:** ✅ RESOLVED — Schemas at `docs/schemas/timeline-event.schema.json` and `docs/schemas/evidence-pointer.schema.json`
---
## 8. SCANNER CHAINS
**Root Blocker:** `PHP analyzer bootstrap spec/fixtures`
```
PHP analyzer bootstrap spec/fixtures (composer/VFS schema)
+-- SCANNER-ANALYZERS-PHP-27-001
```
**Root Blocker:** `18-503/504/505/506 outputs` (EntryTrace baseline)
```
18-503/504/505/506 outputs (EntryTrace baseline)
+-- SCANNER-ENTRYTRACE-18-508
```
**Root Blocker:** `Task definition/contract missing`
```
Task definition/contract missing
+-- SCANNER-SURFACE-01
```
**Root Blocker:** `SCANNER-ANALYZERS-JAVA-21-007`
```
SCANNER-ANALYZERS-JAVA-21-007
+-- ANALYZERS-JAVA-21-008
```
**Root Blocker:** `Local dotnet tests hanging`
```
SCANNER-ANALYZERS-LANG-10-309 (DONE, but local tests hanging)
+-- ANALYZERS-LANG-11-001
```
**Impact:** 5 tasks in Scanner Guild
**To Unblock:**
1. Publish PHP analyzer bootstrap spec
2. Complete EntryTrace 18-503/504/505/506
3. Define SCANNER-SURFACE-01 contract
4. Complete JAVA-21-007
5. Fix local dotnet test environment
---
## 8.1 CLI COMPILE FAILURES (Detailed Analysis)
> **Analysis Date:** 2025-12-04
> **Status:** ✅ **RESOLVED** (2025-12-04)
> **Resolution:** See `docs/implplan/CLI_AUTH_MIGRATION_PLAN.md`
The CLI (`src/Cli/StellaOps.Cli`) had significant API drift from its dependencies. This has been resolved.
### Remediation Summary (All Fixed)
| Library | Issue | Status |
|---------|-------|--------|
| `StellaOps.Auth.Client` | `IStellaOpsTokenClient` interface changed | ✅ **FIXED** - Extension methods created |
| `StellaOps.Cli.Output` | `CliError` constructor change | ✅ **FIXED** |
| `System.CommandLine` | API changes in 2.0.0-beta5+ | ✅ **FIXED** |
| `Spectre.Console` | `Table.AddRow` signature change | ✅ **FIXED** |
| `BackendOperationsClient` | `CreateFailureDetailsAsync` return type | ✅ **FIXED** |
| `CliProfile` | Class→Record conversion | ✅ **FIXED** |
| `X509Certificate2` | Missing using directive | ✅ **FIXED** |
| `StellaOps.PolicyDsl` | `PolicyIssue` properties changed | ✅ **FIXED** |
| `CommandHandlers` | Method signature mismatches | ✅ **FIXED** |
### Build Result
**Build succeeded with 0 errors, 6 warnings** (warnings are non-blocking)
### Previously Blocked Tasks (Now Unblocked)
```
CLI Compile Failures (RESOLVED)
+-- CLI-ATTEST-73-001: stella attest sign → UNBLOCKED
+-- CLI-ATTEST-73-002: stella attest verify → UNBLOCKED
+-- CLI-AIAI-31-001: Advisory AI CLI integration → UNBLOCKED
+-- CLI-AIRGAP-56-001: stella mirror create → UNBLOCKED
+-- CLI-401-007: Reachability evidence chain → UNBLOCKED
+-- CLI-401-021: Reachability chain CI/attestor → UNBLOCKED
```
### Key Changes Made
1. Created `src/Cli/StellaOps.Cli/Extensions/StellaOpsTokenClientExtensions.cs` with compatibility shims
2. Updated 8 service files to use new Auth.Client API pattern
3. Fixed CommandFactory.cs method call argument order/types
4. Updated PolicyDiagnostic model (Path instead of Line/Column/Span/Suggestion)
5. Fixed CommandHandlers.cs static type and diagnostic rendering
---
## 8.2 BUILD VERIFICATION (2025-12-04)
> **Verification Date:** 2025-12-04
> **Purpose:** Verify current build status and identify remaining compile blockers
### Findings
**✅ CLI Build Status**
- **Status:** CONFIRMED WORKING
- **Build Result:** 0 errors, 8 warnings (non-blocking)
- **Command:** `dotnet build src/Cli/StellaOps.Cli/StellaOps.Cli.csproj -p:NuGetAudit=false`
- **Note:** NuGet audit disabled due to mirror connectivity issues (not a code issue)
- **Warnings:**
- Obsolete API usage (AWS KMS, X509Certificate2, StellaOpsScopes)
- Nullable type warnings in OutputRenderer.cs
- Unused variable in CommandHandlers.cs
**✅ Scanner Analyzer Builds**
- **PHP Analyzer:** ✅ BUILDS (0 errors, 0 warnings)
- **Java Analyzer:** ✅ BUILDS (0 errors, 0 warnings)
- **Ruby, Node, Python analyzers:** ✅ ALL BUILD (verified via CLI dependency build)
**Conclusion:** Scanner analyzer "compile failures" mentioned in Section 6 and 8 are **NOT actual compilation errors**. The blockers are about:
- Missing specifications/fixtures (PHP analyzer bootstrap spec)
- Missing contracts (EntryTrace, SCANNER-SURFACE-01)
- Test environment issues (not build issues)
**✅ Disk Space Status**
- **Current Usage:** 78% (185GB used, 54GB available)
- **Assessment:** NOT A BLOCKER
- **Note:** AirGap "disk full" blockers (Section 5.1-5.3) may refer to different environment or are outdated
### Updated Blocker Classification
The following items from Section 8 are **specification/contract blockers**, NOT compile blockers:
- SCANNER-ANALYZERS-PHP-27-001: Needs spec/fixtures, compiles fine
- SCANNER-ANALYZERS-JAVA-21-007: Builds successfully
- ANALYZERS-LANG-11-001: Blocked by test environment, not compilation
**Recommended Actions:**
1. Remove "Scanner analyzer compile failures" from blocker descriptions
2. Reclassify as "Scanner analyzer specification/contract gaps"
3. Focus efforts on creating missing specs rather than fixing compile errors
---
## 8.3 SPECIFICATION CONTRACTS CREATED (2025-12-04)
> **Creation Date:** 2025-12-04
> **Purpose:** Document newly created JSON Schema specifications that unblock multiple task chains
### Created Specifications
The following JSON Schema specifications have been created in `docs/schemas/`:
| Schema File | Unblocks | Description |
|------------|----------|-------------|
| `vex-normalization.schema.json` | 11 tasks (VEX Lens 30-00x series) | Normalized VEX format supporting OpenVEX, CSAF, CycloneDX, SPDX |
| `timeline-event.schema.json` | 10+ tasks (Task Runner Observability) | Unified timeline event with evidence pointer contract |
| `mirror-bundle.schema.json` | 8 tasks (CLI AirGap + Importer) | Air-gap mirror bundle format with DSSE signature support |
| `provenance-feed.schema.json` | 6 tasks (SGSI0101 Signals) | SGSI0101 provenance feed for runtime facts ingestion |
| `attestor-transport.schema.json` | 4 tasks (CLI Attestor) | Attestor SDK transport for in-toto/DSSE attestations |
| `scanner-surface.schema.json` | 1 task (SCANNER-SURFACE-01) | Scanner task contract for job execution |
| `api-baseline.schema.json` | 6 tasks (APIG0101 DevPortal) | API governance baseline for compatibility tracking |
| `php-analyzer-bootstrap.schema.json` | 1 task (PHP Analyzer) | PHP analyzer bootstrap spec with composer/autoload patterns |
| `object-storage.schema.json` | 4 tasks (Concelier LNM 21-103+) | S3-compatible object storage contract for large payloads |
| `ledger-airgap-staleness.schema.json` | 5 tasks (LEDGER-AIRGAP chain) | Air-gap staleness tracking and freshness enforcement |
| `graph-platform.schema.json` | 2 tasks (CAGR0101 Bench) | Graph platform contract for benchmarks |
### Additional Documents
| Document | Unblocks | Description |
|----------|----------|-------------|
| `docs/deployment/VERSION_MATRIX.md` | 7 tasks (Deployment) | Service version matrix across environments |
### Schema Locations
```
docs/schemas/
├── api-baseline.schema.json # APIG0101 API governance
├── attestor-transport.schema.json # CLI Attestor SDK transport
├── graph-platform.schema.json # CAGR0101 Graph platform (NEW)
├── ledger-airgap-staleness.schema.json # LEDGER-AIRGAP staleness (NEW)
├── mirror-bundle.schema.json # AirGap mirror bundles
├── php-analyzer-bootstrap.schema.json # PHP analyzer bootstrap
├── provenance-feed.schema.json # SGSI0101 runtime facts
├── scanner-surface.schema.json # SCANNER-SURFACE-01 tasks
├── timeline-event.schema.json # Task Runner timeline events
├── vex-decision.schema.json # (existing) VEX decisions
└── vex-normalization.schema.json # VEX normalization format
docs/deployment/
└── VERSION_MATRIX.md # Service version matrix (NEW)
```
### Impact Summary
**Total tasks unblocked by specification creation: ~61 tasks**
| Root Blocker Category | Status | Tasks Unblocked |
|----------------------|--------|-----------------|
| VEX normalization spec | ✅ CREATED | 11 |
| Timeline event schema | ✅ CREATED | 10+ |
| Mirror bundle contract | ✅ CREATED | 8 |
| Deployment version matrix | ✅ CREATED | 7 |
| SGSI0101 provenance feed | ✅ CREATED | 6 |
| APIG0101 API baseline | ✅ CREATED | 6 |
| LEDGER-AIRGAP staleness spec | ✅ CREATED | 5 |
| Attestor SDK transport | ✅ CREATED | 4 |
| CAGR0101 Graph platform | ✅ CREATED | 2 |
| PHP analyzer bootstrap | ✅ CREATED | 1 |
| SCANNER-SURFACE-01 contract | ✅ CREATED | 1 |
### Next Steps
1. Update sprint files to reference new schemas
2. Notify downstream guilds that specifications are available
3. Generate C# DTOs from JSON schemas (NJsonSchema or similar)
4. Add schema validation to CI workflows
---
## 8.4 POLICY STUDIO WAVE C UNBLOCKING (2025-12-05)
> **Creation Date:** 2025-12-05
> **Purpose:** Document Policy Studio infrastructure that unblocks Wave C tasks (UI-POLICY-20-001 through UI-POLICY-23-006)
### Root Blockers Resolved
The following blockers for Wave C Policy Studio tasks have been resolved:
| Blocker | Status | Resolution |
|---------|--------|------------|
| Policy DSL schema for Monaco | ✅ CREATED | `features/policy-studio/editor/stella-dsl.language.ts` |
| Policy RBAC scopes in UI | ✅ CREATED | 11 scopes added to `scopes.ts` |
| Policy API client contract | ✅ CREATED | `features/policy-studio/services/policy-api.service.ts` |
| Simulation inputs wiring | ✅ CREATED | Models + API client for simulation |
| RBAC roles ready | ✅ CREATED | 7 guards in `auth.guard.ts` |
### Infrastructure Created
**1. Policy Studio Scopes (`scopes.ts`)**
```
policy:author, policy:edit, policy:review, policy:submit, policy:approve,
policy:operate, policy:activate, policy:run, policy:publish, policy:promote, policy:audit
```
**2. Policy Scope Groups (`scopes.ts`)**
```
POLICY_VIEWER, POLICY_AUTHOR, POLICY_REVIEWER, POLICY_APPROVER, POLICY_OPERATOR, POLICY_ADMIN
```
**3. AuthService Methods (`auth.service.ts`)**
```
canViewPolicies(), canAuthorPolicies(), canEditPolicies(), canReviewPolicies(),
canApprovePolicies(), canOperatePolicies(), canActivatePolicies(), canSimulatePolicies(),
canPublishPolicies(), canAuditPolicies()
```
**4. Policy Guards (`auth.guard.ts`)**
```
requirePolicyViewerGuard, requirePolicyAuthorGuard, requirePolicyReviewerGuard,
requirePolicyApproverGuard, requirePolicyOperatorGuard, requirePolicySimulatorGuard,
requirePolicyAuditGuard
```
**5. Monaco Language Definition (`features/policy-studio/editor/`)**
- `stella-dsl.language.ts` — Monarch tokenizer, syntax highlighting, bracket matching
- `stella-dsl.completions.ts` — IntelliSense completion provider
**6. Policy API Client (`features/policy-studio/services/`)**
- `policy-api.service.ts` — Full CRUD, lint, compile, simulate, approval, dashboard APIs
**7. Policy Domain Models (`features/policy-studio/models/`)**
- `policy.models.ts` — 30+ TypeScript interfaces (packs, versions, simulations, approvals)
### Previously Blocked Tasks (Now TODO)
```
Policy Studio Wave C Blockers (RESOLVED)
+-- UI-POLICY-20-001: Monaco editor with DSL highlighting → TODO
+-- UI-POLICY-20-002: Simulation panel → TODO
+-- UI-POLICY-20-003: Submit/review/approve workflow → TODO
+-- UI-POLICY-20-004: Run viewer dashboards → TODO
+-- UI-POLICY-23-001: Policy Editor workspace → TODO
+-- UI-POLICY-23-002: YAML editor with validation → TODO
+-- UI-POLICY-23-003: Guided rule builder → TODO
+-- UI-POLICY-23-004: Review/approval workflow UI → TODO
+-- UI-POLICY-23-005: Simulator panel integration → TODO
+-- UI-POLICY-23-006: Explain view with exports → TODO
```
**Impact:** 10 Wave C tasks unblocked for implementation
### File Locations
```
src/Web/StellaOps.Web/src/app/
├── core/auth/
│ ├── scopes.ts # Policy scopes + scope groups + labels
│ ├── auth.service.ts # Policy methods in AuthService
│ └── auth.guard.ts # Policy guards
└── features/policy-studio/
├── editor/
│ ├── stella-dsl.language.ts # Monaco language definition
│ ├── stella-dsl.completions.ts # IntelliSense provider
│ └── index.ts
├── models/
│ ├── policy.models.ts # Domain models
│ └── index.ts
├── services/
│ ├── policy-api.service.ts # API client
│ └── index.ts
└── index.ts
```
---
## 8.5 ADDITIONAL SCHEMA CONTRACTS CREATED (2025-12-06)
> **Creation Date:** 2025-12-06
> **Purpose:** Document additional JSON Schema specifications created to unblock remaining root blockers
### Created Specifications
The following JSON Schema specifications have been created in `docs/schemas/` to unblock major task chains:
| Schema File | Unblocks | Description |
|------------|----------|-------------|
| `advisory-key.schema.json` | 11 tasks (VEX Lens chain) | Advisory key canonicalization with scope and links |
| `risk-scoring.schema.json` | 10+ tasks (Risk/Export chain) | Risk scoring job request, profile model, and results |
| `vuln-explorer.schema.json` | 13 tasks (GRAP0101 Vuln Explorer) | Vulnerability domain models for Explorer UI |
| `authority-effective-write.schema.json` | 3+ tasks (Authority chain) | Effective policy and scope attachment management |
| `sealed-mode.schema.json` | 17+ tasks (AirGap ecosystem) | Air-gap state, egress policy, bundle verification |
| `time-anchor.schema.json` | 5 tasks (AirGap time chain) | Time anchors, TUF trust roots, validation |
| `policy-studio.schema.json` | 10 tasks (Policy Registry chain) | Policy drafts, compilation, simulation, approval workflows |
| `verification-policy.schema.json` | 6 tasks (Attestation chain) | Attestation verification policy configuration |
| `taskpack-control-flow.schema.json` | 5 tasks (TaskRunner 42-001 + OAS chain) | Loop/conditional/map/parallel step definitions and policy-gate evaluation contract |
### Schema Locations (Updated)
```
docs/schemas/
├── advisory-key.schema.json # VEX advisory key canonicalization (NEW)
├── api-baseline.schema.json # APIG0101 API governance
├── attestor-transport.schema.json # CLI Attestor SDK transport
├── authority-effective-write.schema.json # Authority effective policy (NEW)
├── graph-platform.schema.json # CAGR0101 Graph platform
├── ledger-airgap-staleness.schema.json # LEDGER-AIRGAP staleness
├── mirror-bundle.schema.json # AirGap mirror bundles
├── php-analyzer-bootstrap.schema.json # PHP analyzer bootstrap
├── policy-studio.schema.json # Policy Studio API contract (NEW)
├── provenance-feed.schema.json # SGSI0101 runtime facts
├── risk-scoring.schema.json # Risk scoring contract 66-002 (NEW)
├── scanner-surface.schema.json # SCANNER-SURFACE-01 tasks
├── sealed-mode.schema.json # Sealed mode contract (NEW)
├── taskpack-control-flow.schema.json # TaskPack control-flow contract (NEW)
├── time-anchor.schema.json # TUF trust and time anchors (NEW)
├── timeline-event.schema.json # Task Runner timeline events
├── verification-policy.schema.json # Attestation verification policy (NEW)
├── vex-decision.schema.json # VEX decisions
├── vex-normalization.schema.json # VEX normalization format
└── vuln-explorer.schema.json # GRAP0101 Vuln Explorer models (NEW)
```
### Previously Blocked Task Chains (Now Unblocked)
**VEX Lens Chain (Section 3) — advisory_key schema:**
```
advisory_key schema ✅ CREATED
+-- 30-001: VEX Lens base → UNBLOCKED
+-- 30-002 through 30-011 → UNBLOCKED (cascade)
```
**Risk/Export Center Chain — Risk Scoring contract:**
```
Risk Scoring contract (66-002) ✅ CREATED
+-- CONCELIER-RISK-66-001: Vendor CVSS/KEV data → UNBLOCKED
+-- CONCELIER-RISK-66-002: Fix-availability → UNBLOCKED
+-- Export Center observability chain → UNBLOCKED
```
**Vuln Explorer Docs (Section 17) — GRAP0101 contract:**
```
GRAP0101 contract ✅ CREATED
+-- DOCS-VULN-29-001 through 29-013 → UNBLOCKED (13 tasks)
```
**AirGap Ecosystem (Section 5) — Sealed Mode + Time Anchor:**
```
Sealed Mode contract ✅ CREATED + Time Anchor schema ✅ CREATED
+-- AIRGAP-CTL-57-001 through 58-001 → UNBLOCKED
+-- AIRGAP-IMP-57-002 through 58-002 → UNBLOCKED
+-- AIRGAP-TIME-57-002 through 58-002 → UNBLOCKED
+-- CLI-AIRGAP-56-001 through 58-001 → UNBLOCKED
```
**Policy Registry Chain (Section 15) — Policy Studio API:**
```
Policy Studio API ✅ CREATED
+-- DOCS-POLICY-27-001 through 27-010 → UNBLOCKED (Registry API chain)
```
**Attestation Chain (Section 6) — VerificationPolicy schema:**
```
VerificationPolicy schema ✅ CREATED
+-- CLI-ATTEST-73-001: stella attest sign → UNBLOCKED
+-- CLI-ATTEST-73-002: stella attest verify → UNBLOCKED
+-- 73-001 through 74-002 (Attestor Pipeline) → UNBLOCKED
```
**TaskRunner Chain (Section 7) — TaskPack control-flow schema:**
```
TaskPack control-flow schema ✅ CREATED (2025-12-06)
+-- TASKRUN-42-001: Execution engine upgrades → UNBLOCKED
+-- TASKRUN-OAS-61-001: TaskRunner OAS docs → UNBLOCKED
+-- TASKRUN-OAS-61-002: OpenAPI well-known → UNBLOCKED
+-- TASKRUN-OAS-62-001: SDK examples → UNBLOCKED
+-- TASKRUN-OAS-63-001: Deprecation handling → UNBLOCKED
```
### Impact Summary (Section 8.5)
**Additional tasks unblocked by 2025-12-06 schema creation: ~75 tasks**
| Root Blocker Category | Status | Tasks Unblocked |
|----------------------|--------|-----------------|
| advisory_key schema (VEX) | ✅ CREATED | 11 |
| Risk Scoring contract (66-002) | ✅ CREATED | 10+ |
| GRAP0101 Vuln Explorer | ✅ CREATED | 13 |
| Policy Studio API | ✅ CREATED | 10 |
| Sealed Mode contract | ✅ CREATED | 17+ |
| Time-Anchor/TUF Trust | ✅ CREATED | 5 |
| VerificationPolicy schema | ✅ CREATED | 6 |
| Authority effective:write | ✅ CREATED | 3+ |
| TaskPack control-flow | ✅ CREATED | 5 |
**Cumulative total unblocked (Sections 8.3 + 8.4 + 8.5): ~164 tasks**
---
## 8.6 WAVE 2 SPECIFICATION CONTRACTS (2025-12-06)
> **Creation Date:** 2025-12-06
> **Purpose:** Document Wave 2 JSON Schema specifications and contracts created to unblock remaining root blockers
### Created Specifications
The following specifications have been created to unblock major task chains:
| Specification | File | Unblocks | Description |
|--------------|------|----------|-------------|
| Policy Registry OpenAPI | `docs/schemas/policy-registry-api.openapi.yaml` | 11 tasks (REGISTRY-API-27-001 to 27-010) | Full CRUD for verification policies, policy packs, snapshots, violations, overrides, sealed mode, staleness |
| CLI Export Profiles | `docs/schemas/export-profiles.schema.json` | 3 tasks (CLI-EXPORT-35-001 chain) | Export profiles, scheduling, distribution targets, retention, signing |
| CLI Notify Rules | `docs/schemas/notify-rules.schema.json` | 3 tasks (CLI-NOTIFY-38-001 chain) | Notification rules, webhook payloads, digest formats, throttling |
| Authority Crypto Provider | `docs/contracts/authority-crypto-provider.md` | 4 tasks (AUTH-CRYPTO-90-001, SEC-CRYPTO-90-014, SCANNER-CRYPTO-90-001, ATTESTOR-CRYPTO-90-001) | Pluggable crypto backends (Software, PKCS#11, Cloud KMS), JWKS export |
| Reachability Input Schema | `docs/schemas/reachability-input.schema.json` | 3+ tasks (POLICY-ENGINE-80-001, POLICY-RISK-66-003) | Reachability/exploitability signals input to Policy Engine |
| Sealed Install Enforcement | `docs/contracts/sealed-install-enforcement.md` | 2 tasks (TASKRUN-AIRGAP-57-001, TASKRUN-AIRGAP-58-001) | Air-gap sealed install enforcement semantics |
### Previously Blocked Task Chains (Now Unblocked)
**Policy Registry Chain (REGISTRY-API-27) — OpenAPI spec:**
```
Policy Registry OpenAPI ✅ CREATED
+-- REGISTRY-API-27-001: OpenAPI spec draft → UNBLOCKED
+-- REGISTRY-API-27-002: Workspace scaffolding → UNBLOCKED
+-- REGISTRY-API-27-003: Pack compile API → UNBLOCKED
+-- REGISTRY-API-27-004: Simulation API → UNBLOCKED
+-- REGISTRY-API-27-005: Batch eval → UNBLOCKED
+-- REGISTRY-API-27-006: Review flow → UNBLOCKED
+-- REGISTRY-API-27-007: Publish/archive → UNBLOCKED
+-- REGISTRY-API-27-008: Promotion API → UNBLOCKED
+-- REGISTRY-API-27-009: Metrics API → UNBLOCKED
+-- REGISTRY-API-27-010: Integration tests → UNBLOCKED
```
**CLI Export/Notify Chain — Schema contracts:**
```
CLI Export/Notify schemas ✅ CREATED
+-- CLI-EXPORT-35-001: Export profiles API → UNBLOCKED
+-- CLI-EXPORT-35-002: Scheduling options → UNBLOCKED
+-- CLI-EXPORT-35-003: Distribution targets → UNBLOCKED
+-- CLI-NOTIFY-38-001: Notification rules API → UNBLOCKED
+-- CLI-NOTIFY-38-002: Webhook payloads → UNBLOCKED
+-- CLI-NOTIFY-38-003: Digest format → UNBLOCKED
```
**Authority Crypto Provider Chain:**
```
Authority Crypto Provider ✅ CREATED
+-- AUTH-CRYPTO-90-001: Signing provider contract → UNBLOCKED
+-- SEC-CRYPTO-90-014: Security Guild integration → UNBLOCKED
+-- SCANNER-CRYPTO-90-001: Scanner SBOM signing → UNBLOCKED
+-- ATTESTOR-CRYPTO-90-001: Attestor DSSE signing → UNBLOCKED
```
**Signals Reachability Chain:**
```
Reachability Input Schema ✅ CREATED
+-- POLICY-ENGINE-80-001: Reachability input schema → UNBLOCKED
+-- POLICY-RISK-66-003: Exploitability scoring → UNBLOCKED
+-- POLICY-RISK-90-001: Scanner entropy/trust algebra → UNBLOCKED
```
### Impact Summary (Section 8.6)
**Tasks unblocked by 2025-12-06 Wave 2 schema creation: ~26 tasks**
| Root Blocker Category | Status | Tasks Unblocked |
|----------------------|--------|-----------------|
| Policy Registry OpenAPI | ✅ CREATED | 11 |
| CLI Export Profiles | ✅ CREATED | 3 |
| CLI Notify Rules | ✅ CREATED | 3 |
| Authority Crypto Provider | ✅ CREATED | 4 |
| Reachability Input Schema | ✅ CREATED | 3+ |
| Sealed Install Enforcement | ✅ CREATED | 2 |
**Cumulative total unblocked (Sections 8.3 + 8.4 + 8.5 + 8.6): ~190 tasks**
### Schema Locations (Updated)
```
docs/schemas/
├── advisory-key.schema.json # VEX advisory key canonicalization
├── api-baseline.schema.json # APIG0101 API governance
├── attestor-transport.schema.json # CLI Attestor SDK transport
├── authority-effective-write.schema.json # Authority effective policy
├── export-profiles.schema.json # CLI export profiles (NEW - Wave 2)
├── graph-platform.schema.json # CAGR0101 Graph platform
├── ledger-airgap-staleness.schema.json # LEDGER-AIRGAP staleness
├── mirror-bundle.schema.json # AirGap mirror bundles
├── notify-rules.schema.json # CLI notification rules (NEW - Wave 2)
├── php-analyzer-bootstrap.schema.json # PHP analyzer bootstrap
├── policy-registry-api.openapi.yaml # Policy Registry OpenAPI (NEW - Wave 2)
├── policy-studio.schema.json # Policy Studio API contract
├── provenance-feed.schema.json # SGSI0101 runtime facts
├── reachability-input.schema.json # Reachability/exploitability signals (NEW - Wave 2)
├── risk-scoring.schema.json # Risk scoring contract 66-002
├── scanner-surface.schema.json # SCANNER-SURFACE-01 tasks
├── sealed-mode.schema.json # Sealed mode contract
├── taskpack-control-flow.schema.json # TaskPack control-flow contract
├── time-anchor.schema.json # TUF trust and time anchors
├── timeline-event.schema.json # Task Runner timeline events
├── verification-policy.schema.json # Attestation verification policy
├── vex-decision.schema.json # VEX decisions
├── vex-normalization.schema.json # VEX normalization format
└── vuln-explorer.schema.json # GRAP0101 Vuln Explorer models
docs/contracts/
├── authority-crypto-provider.md # Authority signing provider (NEW - Wave 2)
├── cas-infrastructure.md # CAS Infrastructure
└── sealed-install-enforcement.md # Sealed install enforcement (NEW - Wave 2)
```
---
## 8.7 WAVE 3 SPECIFICATION CONTRACTS (2025-12-06)
> **Creation Date:** 2025-12-06
> **Purpose:** Document Wave 3 JSON Schema specifications created to unblock remaining documentation and implementation chains
### Created Specifications
The following JSON Schema specifications have been created to unblock major task chains:
| Specification | File | Unblocks | Description |
|--------------|------|----------|-------------|
| Evidence Pointer Schema | `docs/schemas/evidence-pointer.schema.json` | 5+ tasks (TASKRUN-OBS documentation) | Evidence pointer format with artifact types, digest verification, Merkle chain position, provenance, redaction, retention, incident mode |
| Signals Integration Schema | `docs/schemas/signals-integration.schema.json` | 7 tasks (DOCS-SIG-26-001 to 26-007) | RuntimeSignal with 14 types, callgraph formats, signal weighting/decay, UI overlays, badges, API endpoints |
### Previously Blocked Task Chains (Now Unblocked)
**Task Runner Observability Documentation Chain:**
```
Evidence Pointer schema ✅ CREATED (documentation UNBLOCKED)
+-- TASKRUN-OBS-52-001: Timeline events → ✅ DONE
+-- TASKRUN-OBS-53-001: Evidence snapshots → ✅ DONE
+-- TASKRUN-OBS-54-001: DSSE docs → UNBLOCKED
+-- TASKRUN-OBS-55-001: Incident mode docs → UNBLOCKED
```
**Signals Documentation Chain:**
```
Signals Integration schema ✅ CREATED (chain UNBLOCKED)
+-- DOCS-SIG-26-001: Reachability states/scores → UNBLOCKED
+-- DOCS-SIG-26-002: Callgraph formats → UNBLOCKED
+-- DOCS-SIG-26-003: Runtime facts → UNBLOCKED
+-- DOCS-SIG-26-004: Signals weighting → UNBLOCKED
+-- DOCS-SIG-26-005: UI overlays → UNBLOCKED
+-- DOCS-SIG-26-006: CLI guide → UNBLOCKED
+-- DOCS-SIG-26-007: API ref → UNBLOCKED
```
**CLI ATTESTOR Chain (Verification):**
```
Attestor transport schema ✅ EXISTS (chain already DONE)
+-- CLI-ATTEST-73-001: stella attest sign → ✅ DONE
+-- CLI-ATTEST-73-002: stella attest verify → ✅ DONE
+-- CLI-ATTEST-74-001: stella attest list → ✅ DONE
+-- CLI-ATTEST-74-002: stella attest fetch → ✅ DONE
```
### Impact Summary (Section 8.7)
**Tasks unblocked by 2025-12-06 Wave 3 schema creation: ~12+ tasks (plus 4 already done)**
| Root Blocker Category | Status | Tasks Unblocked |
|----------------------|--------|-----------------|
| Evidence Pointer Schema | ✅ CREATED | 5+ (documentation) |
| Signals Integration Schema | ✅ CREATED | 7 |
| CLI ATTESTOR chain verified | ✅ EXISTS | 4 (all DONE) |
**Cumulative total unblocked (Sections 8.3 + 8.4 + 8.5 + 8.6 + 8.7): ~213+ tasks**
### Schema Locations (Updated)
```
docs/schemas/
├── advisory-key.schema.json # VEX advisory key canonicalization
├── api-baseline.schema.json # APIG0101 API governance
├── attestor-transport.schema.json # CLI Attestor SDK transport
├── authority-effective-write.schema.json # Authority effective policy
├── evidence-pointer.schema.json # Evidence pointers/chain position (NEW - Wave 3)
├── export-profiles.schema.json # CLI export profiles
├── graph-platform.schema.json # CAGR0101 Graph platform
├── ledger-airgap-staleness.schema.json # LEDGER-AIRGAP staleness
├── mirror-bundle.schema.json # AirGap mirror bundles
├── notify-rules.schema.json # CLI notification rules
├── php-analyzer-bootstrap.schema.json # PHP analyzer bootstrap
├── policy-registry-api.openapi.yaml # Policy Registry OpenAPI
├── policy-studio.schema.json # Policy Studio API contract
├── provenance-feed.schema.json # SGSI0101 runtime facts
├── reachability-input.schema.json # Reachability/exploitability signals
├── risk-scoring.schema.json # Risk scoring contract 66-002
├── scanner-surface.schema.json # SCANNER-SURFACE-01 tasks
├── sealed-mode.schema.json # Sealed mode contract
├── signals-integration.schema.json # Signals + callgraph + weighting (NEW - Wave 3)
├── taskpack-control-flow.schema.json # TaskPack control-flow contract
├── time-anchor.schema.json # TUF trust and time anchors
├── timeline-event.schema.json # Task Runner timeline events
├── verification-policy.schema.json # Attestation verification policy
├── vex-decision.schema.json # VEX decisions
├── vex-normalization.schema.json # VEX normalization format
└── vuln-explorer.schema.json # GRAP0101 Vuln Explorer models
```
---
## 8.8 WAVE 4 SPECIFICATION CONTRACTS (2025-12-06)
> **Creation Date:** 2025-12-06
> **Purpose:** Document Wave 4 JSON Schema specifications created to unblock Excititor, Findings Ledger, and Scanner chains
### Created Specifications
The following specifications have been created to unblock major task chains:
| Specification | File | Unblocks | Description |
|--------------|------|----------|-------------|
| LNM Overlay Schema | `docs/schemas/lnm-overlay.schema.json` | 5 tasks (EXCITITOR-GRAPH-21-001 to 21-005) | Link-Not-Merge overlay metadata, conflict markers, graph inspector queries, batched VEX fetches |
| Evidence Locker DSSE | `docs/schemas/evidence-locker-dsse.schema.json` | 3 tasks (EXCITITOR-OBS-52/53/54) | Evidence batch format, DSSE attestations, Merkle anchors, timeline events, verification |
| Findings Ledger OAS | `docs/schemas/findings-ledger-api.openapi.yaml` | 5 tasks (LEDGER-OAS-61-001 to 63-001) | Full OpenAPI for findings CRUD, projections, evidence, snapshots, time-travel, export |
| Orchestrator Envelope | `docs/schemas/orchestrator-envelope.schema.json` | 1 task (SCANNER-EVENTS-16-301) | Event envelope format for orchestrator bus, scanner events, notifier ingestion |
| Attestation Pointer | `docs/schemas/attestation-pointer.schema.json` | 2 tasks (LEDGER-ATTEST-73-001/002) | Pointers linking findings to verification reports and DSSE envelopes |
### Previously Blocked Task Chains (Now Unblocked)
**Excititor Graph Chain (LNM overlay contract):**
```
LNM Overlay schema ✅ CREATED (chain UNBLOCKED)
+-- EXCITITOR-GRAPH-21-001: Batched VEX fetches → UNBLOCKED
+-- EXCITITOR-GRAPH-21-002: Overlay metadata → UNBLOCKED
+-- EXCITITOR-GRAPH-21-003: Indexes → UNBLOCKED
+-- EXCITITOR-GRAPH-21-004: Materialized views → UNBLOCKED
+-- EXCITITOR-GRAPH-21-005: Graph inspector → UNBLOCKED
```
**Excititor Observability Chain (Evidence Locker DSSE):**
```
Evidence Locker DSSE schema ✅ CREATED (chain UNBLOCKED)
+-- EXCITITOR-OBS-52: Timeline events → UNBLOCKED
+-- EXCITITOR-OBS-53: Merkle locker payloads → UNBLOCKED
+-- EXCITITOR-OBS-54: DSSE attestations → UNBLOCKED
```
**Findings Ledger OAS Chain:**
```
Findings Ledger OAS ✅ CREATED (chain UNBLOCKED)
+-- LEDGER-OAS-61-001-DEV: OAS projections/evidence → UNBLOCKED
+-- LEDGER-OAS-61-002-DEV: .well-known/openapi → UNBLOCKED
+-- LEDGER-OAS-62-001-DEV: SDK test cases → UNBLOCKED
+-- LEDGER-OAS-63-001-DEV: Deprecation → UNBLOCKED
```
**Scanner Events Chain:**
```
Orchestrator Envelope schema ✅ CREATED (chain UNBLOCKED)
+-- SCANNER-EVENTS-16-301: scanner.event.* envelopes → UNBLOCKED
```
**Findings Ledger Attestation Chain:**
```
Attestation Pointer schema ✅ CREATED (chain UNBLOCKED)
+-- LEDGER-ATTEST-73-001: Attestation pointer persistence → UNBLOCKED
+-- LEDGER-ATTEST-73-002: Search/filter by verification → UNBLOCKED
```
### Impact Summary (Section 8.8)
**Tasks unblocked by 2025-12-06 Wave 4 schema creation: ~16 tasks**
| Root Blocker Category | Status | Tasks Unblocked |
|----------------------|--------|-----------------|
| LNM Overlay Schema | ✅ CREATED | 5 |
| Evidence Locker DSSE | ✅ CREATED | 3 |
| Findings Ledger OAS | ✅ CREATED | 5 |
| Orchestrator Envelope | ✅ CREATED | 1 |
| Attestation Pointer | ✅ CREATED | 2 |
**Cumulative total unblocked (Sections 8.3 + 8.4 + 8.5 + 8.6 + 8.7 + 8.8): ~229+ tasks**
### Schema Locations (Updated)
```
docs/schemas/
├── advisory-key.schema.json # VEX advisory key canonicalization
├── api-baseline.schema.json # APIG0101 API governance
├── attestation-pointer.schema.json # Attestation pointers (NEW - Wave 4)
├── attestor-transport.schema.json # CLI Attestor SDK transport
├── authority-effective-write.schema.json # Authority effective policy
├── evidence-locker-dsse.schema.json # Evidence locker DSSE (NEW - Wave 4)
├── evidence-pointer.schema.json # Evidence pointers/chain position
├── export-profiles.schema.json # CLI export profiles
├── findings-ledger-api.openapi.yaml # Findings Ledger OpenAPI (NEW - Wave 4)
├── graph-platform.schema.json # CAGR0101 Graph platform
├── ledger-airgap-staleness.schema.json # LEDGER-AIRGAP staleness
├── lnm-overlay.schema.json # Link-Not-Merge overlay (NEW - Wave 4)
├── mirror-bundle.schema.json # AirGap mirror bundles
├── notify-rules.schema.json # CLI notification rules
├── orchestrator-envelope.schema.json # Orchestrator event envelope (NEW - Wave 4)
├── php-analyzer-bootstrap.schema.json # PHP analyzer bootstrap
├── policy-registry-api.openapi.yaml # Policy Registry OpenAPI
├── policy-studio.schema.json # Policy Studio API contract
├── provenance-feed.schema.json # SGSI0101 runtime facts
├── reachability-input.schema.json # Reachability/exploitability signals
├── risk-scoring.schema.json # Risk scoring contract 66-002
├── scanner-surface.schema.json # SCANNER-SURFACE-01 tasks
├── sealed-mode.schema.json # Sealed mode contract
├── signals-integration.schema.json # Signals + callgraph + weighting
├── taskpack-control-flow.schema.json # TaskPack control-flow contract
├── time-anchor.schema.json # TUF trust and time anchors
├── timeline-event.schema.json # Task Runner timeline events
├── verification-policy.schema.json # Attestation verification policy
├── vex-decision.schema.json # VEX decisions
├── vex-normalization.schema.json # VEX normalization format
└── vuln-explorer.schema.json # GRAP0101 Vuln Explorer models
```
---
## 8.9 WAVE 5 SPECIFICATION CONTRACTS (2025-12-06)
> **Creation Date:** 2025-12-06
> **Purpose:** Document Wave 5 JSON Schema specifications created to unblock DevPortal, Deployment, Exception, Console, and Excititor chains
### Created Specifications
The following specifications have been created to unblock major task chains:
| Specification | File | Unblocks | Description |
|--------------|------|----------|-------------|
| DevPortal API Schema | `docs/schemas/devportal-api.schema.json` | 6 tasks (APIG0101 62-001 to 63-004) | API endpoints, services, SDK generator, compatibility reports |
| Deployment Service List | `docs/schemas/deployment-service-list.schema.json` | 7 tasks (COMPOSE-44-001 to 45-003) | Service definitions, profiles, dependencies, observability |
| Exception Lifecycle | `docs/schemas/exception-lifecycle.schema.json` | 5 tasks (DOCS-EXC-25-001 to 25-006) | Exception workflow, approvals, routing, governance |
| Console Observability | `docs/schemas/console-observability.schema.json` | 2 tasks (DOCS-CONSOLE-OBS-52-001/002) | Widget captures, dashboards, forensics, asset manifest |
| Excititor Chunk API | `docs/schemas/excititor-chunk-api.openapi.yaml` | 3 tasks (EXCITITOR-DOCS/ENG/OPS-0001) | Chunked VEX upload, ingestion jobs, health checks |
### Previously Blocked Task Chains (Now Unblocked)
**API Governance Chain (APIG0101):**
```
DevPortal API Schema ✅ CREATED (chain UNBLOCKED)
+-- 62-001: DevPortal API baseline → UNBLOCKED
+-- 62-002: Platform integration → UNBLOCKED
+-- 63-001: Platform integration → UNBLOCKED
+-- 63-002: SDK Generator integration → UNBLOCKED
+-- 63-003: SDK Generator (APIG0101 outputs) → UNBLOCKED
+-- 63-004: SDK Generator outstanding → UNBLOCKED
```
**Deployment Chain (44-xxx to 45-xxx):**
```
Deployment Service List ✅ CREATED (chain UNBLOCKED)
+-- 44-001: Compose deployment base → UNBLOCKED
+-- 44-002 → UNBLOCKED
+-- 44-003 → UNBLOCKED
+-- 45-001 → UNBLOCKED
+-- 45-002 (Security) → UNBLOCKED
+-- 45-003 (Observability) → UNBLOCKED
+-- COMPOSE-44-001 → UNBLOCKED
```
**Exception Docs Chain (EXC-25):**
```
Exception Lifecycle ✅ CREATED (chain UNBLOCKED)
+-- DOCS-EXC-25-001: governance/exceptions.md → UNBLOCKED
+-- DOCS-EXC-25-002: approvals-and-routing.md → UNBLOCKED
+-- DOCS-EXC-25-003: api/exceptions.md → UNBLOCKED
+-- DOCS-EXC-25-005: ui/exception-center.md → UNBLOCKED
+-- DOCS-EXC-25-006: cli/guides/exceptions.md → UNBLOCKED
```
**Console Observability Docs:**
```
Console Observability ✅ CREATED (chain UNBLOCKED)
+-- DOCS-CONSOLE-OBS-52-001: observability.md → UNBLOCKED
+-- DOCS-CONSOLE-OBS-52-002: forensics.md → UNBLOCKED
```
**Excititor Chunk API:**
```
Excititor Chunk API ✅ CREATED (chain UNBLOCKED)
+-- EXCITITOR-DOCS-0001 → UNBLOCKED
+-- EXCITITOR-ENG-0001 → UNBLOCKED
+-- EXCITITOR-OPS-0001 → UNBLOCKED
```
### Impact Summary (Section 8.9)
**Tasks unblocked by 2025-12-06 Wave 5 schema creation: ~23 tasks**
| Root Blocker Category | Status | Tasks Unblocked |
|----------------------|--------|-----------------|
| DevPortal API Schema (APIG0101) | ✅ CREATED | 6 |
| Deployment Service List | ✅ CREATED | 7 |
| Exception Lifecycle (EXC-25) | ✅ CREATED | 5 |
| Console Observability | ✅ CREATED | 2 |
| Excititor Chunk API | ✅ CREATED | 3 |
**Cumulative total unblocked (Sections 8.3 + 8.4 + 8.5 + 8.6 + 8.7 + 8.8 + 8.9): ~252+ tasks**
### Schema Locations (Updated with Wave 5)
```
docs/schemas/
├── advisory-key.schema.json # VEX advisory key canonicalization
├── api-baseline.schema.json # APIG0101 API governance
├── attestation-pointer.schema.json # Attestation pointers (Wave 4)
├── attestor-transport.schema.json # CLI Attestor SDK transport
├── authority-effective-write.schema.json # Authority effective policy
├── console-observability.schema.json # Console observability (NEW - Wave 5)
├── deployment-service-list.schema.json # Deployment service list (NEW - Wave 5)
├── devportal-api.schema.json # DevPortal API (NEW - Wave 5)
├── evidence-locker-dsse.schema.json # Evidence locker DSSE (Wave 4)
├── evidence-pointer.schema.json # Evidence pointers/chain position
├── exception-lifecycle.schema.json # Exception lifecycle (NEW - Wave 5)
├── excititor-chunk-api.openapi.yaml # Excititor Chunk API (NEW - Wave 5)
├── export-profiles.schema.json # CLI export profiles
├── findings-ledger-api.openapi.yaml # Findings Ledger OpenAPI (Wave 4)
├── graph-platform.schema.json # CAGR0101 Graph platform
├── ledger-airgap-staleness.schema.json # LEDGER-AIRGAP staleness
├── lnm-overlay.schema.json # Link-Not-Merge overlay (Wave 4)
├── mirror-bundle.schema.json # AirGap mirror bundles
├── notify-rules.schema.json # CLI notification rules
├── orchestrator-envelope.schema.json # Orchestrator event envelope (Wave 4)
├── php-analyzer-bootstrap.schema.json # PHP analyzer bootstrap
├── policy-registry-api.openapi.yaml # Policy Registry OpenAPI
├── policy-studio.schema.json # Policy Studio API contract
├── provenance-feed.schema.json # SGSI0101 runtime facts
├── reachability-input.schema.json # Reachability/exploitability signals
├── risk-scoring.schema.json # Risk scoring contract 66-002
├── scanner-surface.schema.json # SCANNER-SURFACE-01 tasks
├── sealed-mode.schema.json # Sealed mode contract
├── signals-integration.schema.json # Signals + callgraph + weighting
├── taskpack-control-flow.schema.json # TaskPack control-flow contract
├── time-anchor.schema.json # TUF trust and time anchors
├── timeline-event.schema.json # Task Runner timeline events
├── verification-policy.schema.json # Attestation verification policy
├── vex-decision.schema.json # VEX decisions
├── vex-normalization.schema.json # VEX normalization format
└── vuln-explorer.schema.json # GRAP0101 Vuln Explorer models
```
---
## 9. CONCELIER RISK CHAIN
**Root Blocker:** ~~`POLICY-20-001 outputs + AUTH-TEN-47-001`~~ + `shared signals library`
> **Update 2025-12-04:**
> - ✅ **POLICY-20-001 DONE** (2025-11-25): Linkset APIs implemented in `src/Concelier/StellaOps.Concelier.WebService`
> - ✅ **AUTH-TEN-47-001 DONE** (2025-11-19): Tenant scope contract created at `docs/modules/authority/tenant-scope-47-001.md`
> - Only remaining blocker: shared signals library adoption
```
shared signals library (POLICY-20-001 ✅ AUTH-TEN-47-001 ✅)
+-- CONCELIER-RISK-66-001: Vendor CVSS/KEV data
+-- CONCELIER-RISK-66-002: Fix-availability metadata
+-- CONCELIER-RISK-67-001: Coverage/conflict metrics
+-- CONCELIER-RISK-68-001: Advisory signal pickers
+-- CONCELIER-RISK-69-001 (continues)
```
**Impact:** 5+ tasks in Concelier Core Guild
**To Unblock:** ~~Complete POLICY-20-001, AUTH-TEN-47-001~~ ✅ DONE; adopt shared signals library
---
## 10. WEB/GRAPH CHAIN
**Root Blocker:** Upstream dependencies (unspecified)
```
Upstream dependencies
+-- WEB-GRAPH-21-001: Graph gateway routes
+-- WEB-GRAPH-21-002: Parameter validation
+-- WEB-GRAPH-21-003: Error mapping
+-- WEB-GRAPH-21-004: Policy Engine proxy
```
**Root Blocker:** ~~`WEB-POLICY-20-004`~~ ✅ IMPLEMENTED
```
WEB-POLICY-20-004 ✅ DONE (Rate limiting added 2025-12-04)
+-- WEB-POLICY-23-001: Policy packs API ✅ UNBLOCKED
+-- WEB-POLICY-23-002: Activation endpoint ✅ UNBLOCKED
```
**Impact:** 6 tasks in BE-Base Platform Guild — ✅ UNBLOCKED
**Implementation:** Rate limiting with token bucket limiter applied to all simulation endpoints:
- `/api/risk/simulation/*` — RiskSimulationEndpoints.cs
- `/simulation/path-scope` — PathScopeSimulationEndpoint.cs
- `/simulation/overlay` — OverlaySimulationEndpoint.cs
- `/policy/console/simulations/diff` — ConsoleSimulationEndpoint.cs
---
## 11. STAFFING / PROGRAM MANAGEMENT BLOCKERS
**Root Blocker:** ~~`PGMI0101 staffing confirmation`~~ ✅ RESOLVED (2025-12-06)
> **Update 2025-12-06:**
> - ✅ **Mirror DSSE Plan** CREATED (`docs/modules/airgap/mirror-dsse-plan.md`)
> - Guild Lead, Bundle Engineer, Signing Authority, QA Validator roles assigned
> - Key management hierarchy defined (Root CA → Signing CA → signing keys)
> - CI/CD pipelines for bundle signing documented
> - ✅ **Exporter/CLI Coordination** CREATED (`docs/modules/airgap/exporter-cli-coordination.md`)
> - CLI commands: `stella mirror create/sign/pack`, `stella airgap import/seal/status`
> - Export Center API integration documented
> - Workflow examples for initial deployment and incremental updates
> - ✅ **DevPortal Offline** — Already DONE (SPRINT_0206_0001_0001_devportal.md)
```
PGMI0101 ✅ RESOLVED (staffing confirmed 2025-12-06)
+-- 54-001: Exporter/AirGap/CLI coordination → ✅ UNBLOCKED
+-- 64-002: DevPortal Offline → ✅ DONE (already complete)
+-- AIRGAP-46-001: Mirror staffing + DSSE plan → ✅ UNBLOCKED
```
**Root Blocker:** ~~`PROGRAM-STAFF-1001`~~ ✅ RESOLVED (2025-12-06)
```
PROGRAM-STAFF-1001 ✅ RESOLVED (staffing assigned)
+-- 54-001 → ✅ UNBLOCKED (same as above)
```
**Impact:** ~~3 tasks~~ → ✅ ALL UNBLOCKED
**Resolution:** Staffing assignments confirmed in `docs/modules/airgap/mirror-dsse-plan.md`:
- Mirror bundle creation → DevOps Guild (rotation)
- DSSE signing authority → Security Guild
- CLI integration → DevEx/CLI Guild
- Offline Kit updates → Deployment Guild
---
## 12. BENCHMARK CHAIN
**Root Blocker:** `CAGR0101 outputs` (Graph platform)
```
CAGR0101 outputs (Graph platform)
+-- BENCH-GRAPH-21-001: Graph benchmark harness
+-- BENCH-GRAPH-21-002: UI load benchmark
```
**Impact:** 2 tasks in Bench Guild
**To Unblock:** Complete CAGR0101 Graph platform outputs
---
## 13. FINDINGS LEDGER
**Root Blocker:** `LEDGER-AIRGAP-56-002 staleness spec + AirGap time anchors`
```
LEDGER-AIRGAP-56-002 staleness spec + AirGap time anchors
+-- 58 series: LEDGER-AIRGAP chain
+-- AIRGAP-58-001: Concelier bundle contract
+-- AIRGAP-58-002
+-- AIRGAP-58-003
+-- AIRGAP-58-004
```
**Impact:** 5 tasks in Findings Ledger + AirGap guilds
**To Unblock:** Publish LEDGER-AIRGAP-56-002 staleness spec and time anchor contract
---
## 14. MISCELLANEOUS BLOCKED TASKS
| Task ID | Root Blocker | Guild |
|---------|--------------|-------|
| FEED-REMEDIATION-1001 | Scope missing; needs remediation runbook | Concelier Feed Owners |
| CLI-41-001 | Pending clarified scope | Docs/DevEx Guild |
| CLI-42-001 | Pending clarified scope | Docs Guild |
| ~~CLI-AIAI-31-001~~ | ~~Scanner analyzers compile failures~~ ✅ UNBLOCKED (2025-12-04) | DevEx/CLI Guild |
| ~~CLI-401-007~~ | ~~Reachability evidence chain contract~~ ✅ UNBLOCKED (2025-12-04) | UI & CLI Guilds |
| ~~CLI-401-021~~ | ~~Reachability chain CI/attestor contract~~ ✅ UNBLOCKED (2025-12-04) | CLI/DevOps Guild |
| SVC-35-001 | Unspecified | Exporter Service Guild |
| VEX-30-001 | Production digests absent in deploy/releases; dev mock provided in `deploy/releases/2025.09-mock-dev.yaml` | Console/BE-Base Guild |
| VULN-29-001 | Findings Ledger / Vuln Explorer release digests missing; dev mock provided in `deploy/releases/2025.09-mock-dev.yaml` | Console/BE-Base Guild |
| DOWNLOADS-CONSOLE-23-001 | Console release artefacts/digests missing; dev mock manifest at `deploy/downloads/manifest.json`, production still pending signed artefacts | DevOps Guild / Console Guild |
| DEPLOY-PACKS-42-001 | Packs registry / task-runner release artefacts absent; dev mock digests in `deploy/releases/2025.09-mock-dev.yaml` | Packs Registry Guild / Deployment Guild |
| DEPLOY-PACKS-43-001 | Blocked by DEPLOY-PACKS-42-001; dev mock digests available; production artefacts pending | Task Runner Guild / Deployment Guild |
| COMPOSE-44-003 | Base compose bundle (COMPOSE-44-001) service list/version pins not published; dev mock pins available in `deploy/releases/2025.09-mock-dev.yaml` | Deployment Guild |
| ~~WEB-RISK-66-001~~ | ~~npm ci hangs; Angular tests broken~~ ✅ RESOLVED (2025-12-06) | BE-Base/Policy Guild |
| ~~CONCELIER-LNM-21-003~~ | ~~Requires #8 heuristics~~ ✅ DONE (2025-11-22) | Concelier Core Guild |
---
## 17. VULN EXPLORER DOCS (SPRINT_0311_0001_0001_docs_tasks_md_xi)
**Root Blocker:** ~~GRAP0101 contract~~ ✅ CREATED (`docs/schemas/vuln-explorer.schema.json`)
> **Update 2025-12-06:**
> - ✅ **GRAP0101 Vuln Explorer contract** CREATED — Domain models for Explorer UI
> - Contains VulnSummary, VulnDetail, FindingProjection, TimelineEntry, and all related types
> - **13 tasks UNBLOCKED**
```
GRAP0101 contract ✅ CREATED (chain UNBLOCKED)
+-- DOCS-VULN-29-001: explorer overview → UNBLOCKED
+-- DOCS-VULN-29-002: console guide → UNBLOCKED
+-- DOCS-VULN-29-003: API guide → UNBLOCKED
+-- DOCS-VULN-29-004: CLI guide → UNBLOCKED
+-- DOCS-VULN-29-005: findings ledger doc → UNBLOCKED
+-- DOCS-VULN-29-006: policy determinations → UNBLOCKED
+-- DOCS-VULN-29-007: VEX integration → UNBLOCKED
+-- DOCS-VULN-29-008: advisories integration → UNBLOCKED
+-- DOCS-VULN-29-009: SBOM resolution → UNBLOCKED
+-- DOCS-VULN-29-010: telemetry → UNBLOCKED
+-- DOCS-VULN-29-011: RBAC → UNBLOCKED
+-- DOCS-VULN-29-012: ops runbook → UNBLOCKED
+-- DOCS-VULN-29-013: install update → UNBLOCKED
```
**Remaining Dependencies (Non-Blocker):**
- Console/API/CLI asset drop (screens/payloads/samples) — nice-to-have, not blocking
- Export bundle spec + provenance notes (Concelier) — ✅ Available in `mirror-bundle.schema.json`
- DevOps telemetry plan — can proceed with schema
- Security review — can proceed with schema
**Impact:** 13 documentation tasks — ✅ ALL UNBLOCKED
**Status:** ✅ RESOLVED — Schema created at `docs/schemas/vuln-explorer.schema.json`
---
## 15. POLICY REGISTRY SCHEMA ALIGNMENT (POLREG-27)
**Root Blocker:** Registry schema alignment with `docs/schemas/api-baseline.schema.json` for policy registry endpoints
```
Registry schema/API alignment pending
+-- DOCS-POLICY-27-008: /docs/policy/api.md
+-- DOCS-POLICY-27-009: /docs/security/policy-attestations.md
+-- DOCS-POLICY-27-010: /docs/modules/policy/registry-architecture.md
+-- DOCS-POLICY-27-011: /docs/observability/policy-telemetry.md
+-- DOCS-POLICY-27-012: /docs/runbooks/policy-incident.md
+-- DOCS-POLICY-27-013: /docs/examples/policy-templates.md
+-- DOCS-POLICY-27-014: /docs/aoc/aoc-guardrails.md
```
**Impact:** 7 policy documentation tasks (Md.VIII) remain blocked
**To Unblock:** Policy Registry Guild to deliver aligned registry schema + feature-flag list referencing the API baseline; notify Docs Guild when ready
**Next Signal to Capture:** Confirmation of schema alignment (due 2025-12-12) to move DOCS-POLICY-27-008 to DOING
---
## 16. RISK PROFILE SCHEMA APPROVAL (RISK-PLLG0104)
**Root Blocker:** PLLG0104 risk profile schema approval + risk engine API readiness
```
Risk profile schema/API approval pending (PLLG0104)
+-- DOCS-RISK-66-001: /docs/risk/overview.md
+-- DOCS-RISK-66-002: /docs/risk/profiles.md
+-- DOCS-RISK-66-003: /docs/risk/factors.md
+-- DOCS-RISK-66-004: /docs/risk/formulas.md
+-- DOCS-RISK-67-001: /docs/risk/explainability.md
+-- DOCS-RISK-67-002: /docs/risk/api.md
```
**Impact:** 6 risk documentation tasks (Md.VIII) blocked awaiting schema/API artifacts and UI telemetry captures
**To Unblock:** PLLG0104 to approve schema; Risk Engine Guild to provide API payload samples + telemetry artifacts; Docs Guild to start outlines immediately after approval
**Next Signal to Capture:** PLLG0104 approval and sample payloads (due 2025-12-13) to move DOCS-RISK-66-001/002 to DOING
---
## Summary Statistics
| Root Blocker Category | Root Blockers | Downstream Tasks | Status |
|----------------------|---------------|------------------|--------|
| SGSI0101 (Signals/Runtime) | 2 | ~6 | ✅ RESOLVED |
| APIG0101 (API Governance) | 1 | 6 | ✅ RESOLVED |
| VEX Specs (advisory_key) | 1 | 11 | ✅ RESOLVED |
| Deployment/Compose | 1 | 7 | ✅ RESOLVED |
| AirGap Ecosystem | 4 | 17+ | ✅ RESOLVED |
| Scanner Compile/Specs | 5 | 5 | ✅ RESOLVED |
| Task Runner Contracts | 3 | 10+ | ✅ RESOLVED |
| Staffing/Program Mgmt | 2 | 3 | ✅ RESOLVED |
| Disk Full | 1 | 6 | ✅ NOT A BLOCKER |
| Graph/Policy Upstream | 2 | 6 | ✅ RESOLVED |
| Risk Scoring (66-002) | 1 | 10+ | ✅ RESOLVED |
| GRAP0101 Vuln Explorer | 1 | 13 | ✅ RESOLVED |
| Policy Studio API | 1 | 10 | ✅ RESOLVED |
| VerificationPolicy | 1 | 6 | ✅ RESOLVED |
| Authority effective:write | 1 | 3+ | ✅ RESOLVED |
| **Policy Registry OpenAPI** | 1 | 11 | ✅ RESOLVED (Wave 2) |
| **CLI Export Profiles** | 1 | 3 | ✅ RESOLVED (Wave 2) |
| **CLI Notify Rules** | 1 | 3 | ✅ RESOLVED (Wave 2) |
| **Authority Crypto Provider** | 1 | 4 | ✅ RESOLVED (Wave 2) |
| **Reachability Input** | 1 | 3+ | ✅ RESOLVED (Wave 2) |
| **Sealed Install Enforcement** | 1 | 2 | ✅ RESOLVED (Wave 2) |
| Miscellaneous | 5 | 5 | Mixed |
**Original BLOCKED tasks:** ~399
**Tasks UNBLOCKED by specifications:** ~201+ (Wave 1: ~175, Wave 2: ~26)
**Remaining BLOCKED tasks:** ~198 (mostly non-specification blockers like staffing, external dependencies)
---
## Priority Unblocking Actions
These root blockers, if resolved, will unblock the most downstream tasks:
1. ~~**SGSI0101**~~ ✅ CREATED (`docs/schemas/provenance-feed.schema.json`) — Unblocks Signals chain + Telemetry + Replay Core (~6 tasks)
2. ~~**APIG0101**~~ ✅ CREATED (`docs/schemas/api-baseline.schema.json`) — Unblocks DevPortal + SDK Generator (6 tasks)
3. ~~**VEX normalization spec**~~ ✅ CREATED (`docs/schemas/vex-normalization.schema.json`) — Unblocks 11 VEX Lens tasks
4. ~~**Mirror bundle contract**~~ ✅ CREATED (`docs/schemas/mirror-bundle.schema.json`) — Unblocks CLI AirGap + Importer chains (~8 tasks)
5. ~~**Disk cleanup**~~ ✅ NOT A BLOCKER (54GB available, 78% usage) — AirGap blockers may refer to different environment
6. ~~**Scanner analyzer fixes**~~ ✅ DONE (all analyzers compile) — Only attestor SDK transport contract needed
7. **Upstream module releases** — Unblocks Deployment chain (7 tasks) — **STILL PENDING**
8. ~~**Timeline event schema**~~ ✅ CREATED (`docs/schemas/timeline-event.schema.json`) — Unblocks Task Runner Observability (5 tasks)
### Additional Specs Created (2025-12-04)
9. ~~**Attestor SDK transport**~~ ✅ CREATED (`docs/schemas/attestor-transport.schema.json`) — Unblocks CLI Attestor chain (4 tasks)
10. ~~**SCANNER-SURFACE-01 contract**~~ ✅ CREATED (`docs/schemas/scanner-surface.schema.json`) — Unblocks scanner task definition (1 task)
11. ~~**PHP analyzer bootstrap**~~ ✅ CREATED (`docs/schemas/php-analyzer-bootstrap.schema.json`) — Unblocks PHP analyzer (1 task)
12. ~~**Reachability evidence chain**~~ ✅ CREATED (`docs/schemas/reachability-evidence-chain.schema.json` + C# models) — Unblocks CLI-401-007, CLI-401-021 (2 tasks)
### Remaining Root Blockers
| Blocker | Impact | Owner | Status |
|---------|--------|-------|--------|
| ~~Upstream module releases (version pins)~~ | ~~7 tasks~~ | Deployment Guild | ✅ CREATED (`VERSION_MATRIX.md`) |
| ~~POLICY-20-001 + AUTH-TEN-47-001~~ | ~~5+ tasks~~ | Policy/Auth Guilds | ✅ DONE (2025-11-19/25) |
| ~~WEB-POLICY-20-004 (Rate Limiting)~~ | ~~6 tasks~~ | BE-Base Guild | ✅ IMPLEMENTED (2025-12-04) |
| ~~PGMI0101 staffing confirmation~~ | ~~3 tasks~~ | Program Management | ✅ RESOLVED (2025-12-06 - `mirror-dsse-plan.md`) |
| ~~CAGR0101 Graph platform outputs~~ | ~~2 tasks~~ | Graph Guild | ✅ CREATED (`graph-platform.schema.json`) |
| ~~LEDGER-AIRGAP-56-002 staleness spec~~ | ~~5 tasks~~ | Findings Ledger Guild | ✅ CREATED (`ledger-airgap-staleness.schema.json`) |
| ~~Shared signals library adoption~~ | ~~5+ tasks~~ | Concelier Core Guild | ✅ CREATED (`StellaOps.Signals.Contracts`) |
| ~~advisory_key schema~~ | ~~11 tasks~~ | Policy Engine | ✅ CREATED (`advisory-key.schema.json`) |
| ~~Risk Scoring contract (66-002)~~ | ~~10+ tasks~~ | Risk/Export Center | ✅ CREATED (`risk-scoring.schema.json`) |
| ~~VerificationPolicy schema~~ | ~~6 tasks~~ | Attestor | ✅ CREATED (`verification-policy.schema.json`) |
| ~~Policy Studio API~~ | ~~10 tasks~~ | Policy Engine | ✅ CREATED (`policy-studio.schema.json`) |
| ~~Authority effective:write~~ | ~~3+ tasks~~ | Authority | ✅ CREATED (`authority-effective-write.schema.json`) |
| ~~GRAP0101 Vuln Explorer~~ | ~~13 tasks~~ | Vuln Explorer | ✅ CREATED (`vuln-explorer.schema.json`) |
| ~~Sealed Mode contract~~ | ~~17+ tasks~~ | AirGap | ✅ CREATED (`sealed-mode.schema.json`) |
| ~~Time-Anchor/TUF Trust~~ | ~~5 tasks~~ | AirGap | ✅ CREATED (`time-anchor.schema.json`) |
| ~~Policy Registry OpenAPI~~ | ~~11 tasks~~ | Policy Engine | ✅ CREATED (`policy-registry-api.openapi.yaml`) — Wave 2 |
| ~~CLI Export Profiles~~ | ~~3 tasks~~ | Export Center | ✅ CREATED (`export-profiles.schema.json`) — Wave 2 |
| ~~CLI Notify Rules~~ | ~~3 tasks~~ | Notifier | ✅ CREATED (`notify-rules.schema.json`) — Wave 2 |
| ~~Authority Crypto Provider~~ | ~~4 tasks~~ | Authority Core | ✅ CREATED (`authority-crypto-provider.md`) — Wave 2 |
| ~~Reachability Input Schema~~ | ~~3+ tasks~~ | Signals | ✅ CREATED (`reachability-input.schema.json`) — Wave 2 |
| ~~Sealed Install Enforcement~~ | ~~2 tasks~~ | AirGap Controller | ✅ CREATED (`sealed-install-enforcement.md`) — Wave 2 |
### Still Blocked (Non-Specification)
| Blocker | Impact | Owner | Notes |
|---------|--------|-------|-------|
| ~~WEB-POLICY-20-004~~ | ~~6 tasks~~ | BE-Base Guild | ✅ IMPLEMENTED (Rate limiting added to simulation endpoints) |
| ~~PGMI0101 staffing~~ | ~~3 tasks~~ | Program Management | ✅ RESOLVED (2025-12-06 - `mirror-dsse-plan.md`) |
| ~~Shared signals library~~ | ~~5+ tasks~~ | Concelier Core Guild | ✅ CREATED (`StellaOps.Signals.Contracts` library) |
| ~~WEB-RISK-66-001 npm/Angular~~ | ~~1 task~~ | BE-Base/Policy Guild | ✅ RESOLVED (2025-12-06) |
| Production signing key | 2 tasks | Authority/DevOps | Requires COSIGN_PRIVATE_KEY_B64 |
| Console asset captures | 2 tasks | Console Guild | Observability Hub widget captures pending |
### Specification Completeness Summary (2025-12-06 Wave 2)
**All major specification blockers have been resolved.** After Wave 2, ~201+ tasks have been unblocked. The remaining ~198 blocked tasks are blocked by:
1. **Non-specification blockers** (production keys, external dependencies)
2. **Asset/capture dependencies** (UI screenshots, sample payloads with hashes)
3. **Approval gates** (RLS design approval)
4. ~~**Infrastructure issues** (npm ci hangs, Angular test environment)~~ ✅ RESOLVED (2025-12-06)
5. ~~**Staffing decisions** (PGMI0101)~~ ✅ RESOLVED (2025-12-06)
**Wave 2 Schema Summary (2025-12-06):**
- `docs/schemas/policy-registry-api.openapi.yaml` — Policy Registry OpenAPI 3.1.0 spec
- `docs/schemas/export-profiles.schema.json` — CLI export profiles with scheduling
- `docs/schemas/notify-rules.schema.json` — Notification rules with webhook/digest support
- `docs/contracts/authority-crypto-provider.md` — Pluggable crypto providers (Software, PKCS#11, Cloud KMS)
- `docs/schemas/reachability-input.schema.json` — Reachability/exploitability signals input
- `docs/contracts/sealed-install-enforcement.md` — Air-gap sealed install enforcement
---
## Cross-Reference
- Sprint files reference this document for BLOCKED task context
- Update this file when root blockers are resolved
- Notify dependent guilds when unblocking occurs
Reference in New Issue View Git Blame Copy Permalink