stella-ops.org/git.stella-ops.org
1
0
Fork 0
Code Issues Pull Requests Actions 16 Releases Wiki Activity
Files
ae69b1a8a1da7e0d01298f2ad94e60c2d3a007ca
git.stella-ops.org/docs/implplan/SPRINT_401_reachability_evidence_chain.md
master ae69b1a8a1 feat: Add documentation and task tracking for Sprints 508 to 514 in Ops & Offline 
- Created detailed markdown files for Sprints 508 (Ops Offline Kit), 509 (Samples), 510 (AirGap), 511 (Api), 512 (Bench), 513 (Provenance), and 514 (Sovereign Crypto Enablement) outlining tasks, dependencies, and owners.
- Introduced a comprehensive Reachability Evidence Delivery Guide to streamline the reachability signal process.
- Implemented unit tests for Advisory AI to block known injection patterns and redact secrets.
- Added AuthoritySenderConstraintHelper to manage sender constraints in OpenIddict transactions.
2025-11-08 23:18:28 +02:00

2.8 KiB
Raw Blame History

Sprint 401 – Reachability Evidence Chain

Window: November 11 – November 22, 2025
Theme: Finish the provable reachability pipeline (graph CAS → replay → DSSE → policy/UI) so Sprint 402 can focus on polish.

Task ID State Task description Owners (Source)
GRAPH-CAS-401-001 TODO Finalize richgraph schema (richgraph-v1), emit canonical SymbolIDs, compute graph hash (BLAKE3), and store CAS manifests under cas://reachability/graphs/{sha256}. Update Scanner Worker adapters + fixtures. Scanner Worker Guild (src/Scanner/StellaOps.Scanner.Worker/TASKS.md)
SIGNALS-RUNTIME-401-002 TODO Ship /signals/runtime-facts ingestion for NDJSON (and gzip) batches, dedupe hits, and link runtime evidence CAS URIs to callgraph nodes. Include retention + RBAC tests. Signals Guild (src/Signals/StellaOps.Signals/TASKS.md)
SIGNALS-SCORING-401-003 TODO Extend ReachabilityScoringService to lattice states (Unknown/NotPresent/Unreachable/Conditional/Reachable/Observed), persist predicates + blocked edges, and expose /graphs/{scanId} CAS lookups. Signals Guild (src/Signals/StellaOps.Signals/TASKS.md)
REPLAY-401-004 TODO Bump replay manifest to v2 (feeds, analyzers, policies), have ReachabilityReplayWriter enforce CAS registration + hash sorting, and add deterministic tests to tests/reachability/StellaOps.Reachability.FixtureTests. BE-Base Platform Guild (src/__Libraries/StellaOps.Replay.Core/TASKS.md)
AUTH-REACH-401-005 TODO Introduce DSSE predicate types for SBOM/Graph/VEX/Replay, plumb signing through Authority + Signer, and mirror statements to Rekor (including PQ variants where required). Authority & Signer Guilds (src/Authority/StellaOps.Authority/TASKS.md, src/Signer/StellaOps.Signer/TASKS.md)
POLICY-VEX-401-006 TODO Policy Engine consumes reachability facts, emits OpenVEX with evidence references, updates SPL schema with reachability.state/confidence predicates, and produces API metrics. Policy Guild (src/Policy/StellaOps.Policy.Engine/TASKS.md, src/Policy/__Libraries/StellaOps.Policy/TASKS.md)
UI-CLI-401-007 TODO Implement CLI stella graph explain + UI explain drawer showing signed call-path, predicates, runtime hits, and DSSE pointers; include counterfactual controls. UI & CLI Guilds (src/Cli/StellaOps.Cli/TASKS.md, src/UI/StellaOps.UI/TASKS.md)
QA-DOCS-401-008 TODO Wire reachbench-2025-expanded fixtures into CI, document CAS layouts + replay steps in docs/reachability/DELIVERY_GUIDE.md, and publish operator runbook for runtime ingestion. QA & Docs Guilds (docs/TASKS.md, tests/README.md)

Use docs/reachability/DELIVERY_GUIDE.md for architecture context, dependencies, and acceptance tests.