885ce86af4
- Introduced a comprehensive CI job structure for VEX Lens, including build, test, linting, and load testing. - Defined load test parameters and SLOs for VEX Lens API and Issuer Directory. - Created Grafana dashboards and alerting mechanisms for monitoring API performance and error rates. - Established offline posture guidelines for CI jobs and load testing. feat: Implement deterministic projection verification script - Added `verify_projection.sh` script for verifying the integrity of projection exports against expected hashes. - Ensured robust error handling for missing files and hash mismatches. feat: Develop Vuln Explorer CI and Ops Plan - Created CI jobs for Vuln Explorer, including build, test, and replay verification. - Implemented backup and disaster recovery strategies for MongoDB and Redis. - Established Merkle anchoring verification and automation for ledger projector. feat: Introduce EventEnvelopeHasher for hashing event envelopes - Implemented `EventEnvelopeHasher` to compute SHA256 hashes for event envelopes. feat: Add Risk Store and Dashboard components - Developed `RiskStore` for managing risk data and state. - Created `RiskDashboardComponent` for displaying risk profiles with filtering capabilities. - Implemented unit tests for `RiskStore` and `RiskDashboardComponent`. feat: Enhance Vulnerability Detail Component - Developed `VulnerabilityDetailComponent` for displaying detailed information about vulnerabilities. - Implemented error handling for missing vulnerability IDs and loading failures.
36 lines
1.6 KiB
Markdown
36 lines
1.6 KiB
Markdown
# Signals DSSE Evidence Staging (runtime/signals gaps)
|
||
|
||
Artifacts prepared 2025-12-01 (UTC) for DSSE signing and Evidence Locker ingest:
|
||
|
||
- Decay config: `docs/modules/signals/decay/confidence_decay_config.yaml`
|
||
- Unknowns scoring manifest: `docs/modules/signals/unknowns/unknowns_scoring_manifest.json`
|
||
- Heuristic catalog + schema + fixtures: `docs/modules/signals/heuristics/`
|
||
- Checksums: `docs/modules/signals/SHA256SUMS`
|
||
|
||
Planned Evidence Locker paths (to fill post-signing):
|
||
- `evidence-locker/signals/decay/2025-12-01/confidence_decay_config.dsse`
|
||
- `evidence-locker/signals/unknowns/2025-12-01/unknowns_scoring_manifest.dsse`
|
||
- `evidence-locker/signals/heuristics/2025-12-01/heuristics_catalog.dsse`
|
||
- `evidence-locker/signals/heuristics/2025-12-01/fixtures/` (golden inputs/outputs)
|
||
|
||
Pending steps:
|
||
1) Sign each artifact with its predicate:
|
||
- `stella.ops/confidenceDecayConfig@v1`
|
||
- `stella.ops/unknownsScoringManifest@v1`
|
||
- `stella.ops/heuristicCatalog@v1`
|
||
Example (replace KEY):
|
||
```bash
|
||
cosign sign-blob \
|
||
--key cosign.key \
|
||
--predicate-type stella.ops/confidenceDecayConfig@v1 \
|
||
--output-signature confidence_decay_config.dsse \
|
||
decay/confidence_decay_config.yaml
|
||
```
|
||
2) Attach SHA256 from `SHA256SUMS` in DSSE headers/annotations.
|
||
3) Place signed envelopes + checksums in the Evidence Locker paths above; update sprint tracker Delivery Tracker rows 5–7 and Decisions & Risks with the final URIs.
|
||
4) Add signer/approver IDs to the sprint Execution Log once signatures are complete.
|
||
|
||
Notes:
|
||
- Use UTC timestamps in DSSE `issuedAt`.
|
||
- Ensure offline parity by copying envelopes + SHA256SUMS into the offline kit bundle when ready.
|