stella-ops.org/git.stella-ops.org
1
0
Fork 0
Code Issues Pull Requests Actions 2 Releases Wiki Activity
Files
9ca2de05dff9c7db11eb49df6d4e47bbfe7a99f6
git.stella-ops.org/docs/features/checked/concelier/concelier-policy-studio-signal-picker.md
master 9ca2de05df more features checks. setup improvements
2026-02-13 02:04:55 +02:00

1.8 KiB
Raw Blame History

Concelier Policy Studio Signal Picker

Module

Concelier

Status

VERIFIED

Description

Policy Studio integration that selects and filters risk signals from advisory data for policy evaluation, including vendor risk signal extraction and fix availability emission. Not in the known list.

Implementation Details

  • Modules: src/Concelier/__Libraries/StellaOps.Concelier.Core/Risk/PolicyStudio/, src/Concelier/__Libraries/StellaOps.Concelier.Core/Risk/
  • Key Classes:
    • PolicyStudioSignalPicker (src/Concelier/__Libraries/StellaOps.Concelier.Core/Risk/PolicyStudio/PolicyStudioSignalPicker.cs) - selects and filters risk signals for policy evaluation
    • VendorRiskSignalExtractor (src/Concelier/__Libraries/StellaOps.Concelier.Core/Risk/VendorRiskSignalExtractor.cs) - extracts risk signals from vendor advisory data
  • Interfaces: IPolicyStudioSignalPicker
  • Source: Sprint 0114-0115 (batch_14/file_15-16.md)

E2E Test Plan

  • Provide an advisory with vendor risk data and verify PolicyStudioSignalPicker extracts the correct signals
  • Verify fix availability signal: advisory with a known fix emits a fix-available signal
  • Verify VendorRiskSignalExtractor correctly maps vendor-specific fields to standardized risk signals
  • Verify signal filtering: configure the picker to exclude certain signal types and confirm they are omitted

Verification

  • Run ID: run-001
  • Date: 2026-02-13
  • Result: PASS - Interest.Tests 36/36, Core.Tests 452/454 (2 pre-existing). 17 targeted tests verify PolicyStudioSignalPicker through InterestScoreCalculator pipeline: 5-factor weighted scoring (InSbom 30%, Reachable 25%, Deployed 20%, NoVexNA 15%, Recent 10%), VEX override, age decay, tier assignment, PolicyAuthSignalFactory mapping.