dac8e10e36
## Summary
This commit completes Phase 2 of the configuration-driven crypto architecture, achieving
100% crypto compliance by eliminating all hardcoded cryptographic implementations.
## Key Changes
### Phase 1: Plugin Loader Infrastructure
- **Plugin Discovery System**: Created StellaOps.Cryptography.PluginLoader with manifest-based loading
- **Configuration Model**: Added CryptoPluginConfiguration with regional profiles support
- **Dependency Injection**: Extended DI to support plugin-based crypto provider registration
- **Regional Configs**: Created appsettings.crypto.{international,russia,eu,china}.yaml
- **CI Workflow**: Added .gitea/workflows/crypto-compliance.yml for audit enforcement
### Phase 2: Code Refactoring
- **API Extension**: Added ICryptoProvider.CreateEphemeralVerifier for verification-only scenarios
- **Plugin Implementation**: Created OfflineVerificationCryptoProvider with ephemeral verifier support
- Supports ES256/384/512, RS256/384/512, PS256/384/512
- SubjectPublicKeyInfo (SPKI) public key format
- **100% Compliance**: Refactored DsseVerifier to remove all BouncyCastle cryptographic usage
- **Unit Tests**: Created OfflineVerificationProviderTests with 39 passing tests
- **Documentation**: Created comprehensive security guide at docs/security/offline-verification-crypto-provider.md
- **Audit Infrastructure**: Created scripts/audit-crypto-usage.ps1 for static analysis
### Testing Infrastructure (TestKit)
- **Determinism Gate**: Created DeterminismGate for reproducibility validation
- **Test Fixtures**: Added PostgresFixture and ValkeyFixture using Testcontainers
- **Traits System**: Implemented test lane attributes for parallel CI execution
- **JSON Assertions**: Added CanonicalJsonAssert for deterministic JSON comparisons
- **Test Lanes**: Created test-lanes.yml workflow for parallel test execution
### Documentation
- **Architecture**: Created CRYPTO_CONFIGURATION_DRIVEN_ARCHITECTURE.md master plan
- **Sprint Tracking**: Created SPRINT_1000_0007_0002_crypto_refactoring.md (COMPLETE)
- **API Documentation**: Updated docs2/cli/crypto-plugins.md and crypto.md
- **Testing Strategy**: Created testing strategy documents in docs/implplan/SPRINT_5100_0007_*
## Compliance & Testing
- ✅ Zero direct System.Security.Cryptography usage in production code
- ✅ All crypto operations go through ICryptoProvider abstraction
- ✅ 39/39 unit tests passing for OfflineVerificationCryptoProvider
- ✅ Build successful (AirGap, Crypto plugin, DI infrastructure)
- ✅ Audit script validates crypto boundaries
## Files Modified
**Core Crypto Infrastructure:**
- src/__Libraries/StellaOps.Cryptography/CryptoProvider.cs (API extension)
- src/__Libraries/StellaOps.Cryptography/CryptoSigningKey.cs (verification-only constructor)
- src/__Libraries/StellaOps.Cryptography/EcdsaSigner.cs (fixed ephemeral verifier)
**Plugin Implementation:**
- src/__Libraries/StellaOps.Cryptography.Plugin.OfflineVerification/ (new)
- src/__Libraries/StellaOps.Cryptography.PluginLoader/ (new)
**Production Code Refactoring:**
- src/AirGap/StellaOps.AirGap.Importer/Validation/DsseVerifier.cs (100% compliant)
**Tests:**
- src/__Libraries/__Tests/StellaOps.Cryptography.Plugin.OfflineVerification.Tests/ (new, 39 tests)
- src/__Libraries/__Tests/StellaOps.Cryptography.PluginLoader.Tests/ (new)
**Configuration:**
- etc/crypto-plugins-manifest.json (plugin registry)
- etc/appsettings.crypto.*.yaml (regional profiles)
**Documentation:**
- docs/security/offline-verification-crypto-provider.md (600+ lines)
- docs/implplan/CRYPTO_CONFIGURATION_DRIVEN_ARCHITECTURE.md (master plan)
- docs/implplan/SPRINT_1000_0007_0002_crypto_refactoring.md (Phase 2 complete)
## Next Steps
Phase 3: Docker & CI/CD Integration
- Create multi-stage Dockerfiles with all plugins
- Build regional Docker Compose files
- Implement runtime configuration selection
- Add deployment validation scripts
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
53 lines
3.1 KiB
Markdown
53 lines
3.1 KiB
Markdown
# Testing Strategy Models and Lanes (2026)
|
|
|
|
Source advisory: `docs/product-advisories/22-Dec-2026 - Better testing strategy.md`
|
|
Supersedes/extends: `docs/product-advisories/archived/2025-12-21-testing-strategy/20-Dec-2025 - Testing strategy.md`
|
|
|
|
## Purpose
|
|
- Define a single testing taxonomy for all StellaOps project types.
|
|
- Make determinism, offline readiness, and evidence integrity testable by default.
|
|
- Align CI lanes with a shared catalog so coverage is visible and enforceable.
|
|
|
|
## Strategy in brief
|
|
- Use test models (L0, S1, C1, W1, WK1, T1, AN1, CLI1, PERF) to encode required test types.
|
|
- Map every module to one or more models in `docs/testing/TEST_CATALOG.yml`.
|
|
- Run tests through standardized CI lanes (Unit, Contract, Integration, Security, Performance, Live).
|
|
|
|
## Test models (requirements)
|
|
- L0 (Library/Core): unit + property + snapshot + determinism.
|
|
- S1 (Storage/Postgres): migrations + idempotency + concurrency + query ordering.
|
|
- T1 (Transport/Queue): protocol roundtrip + fuzz invalid + delivery semantics.
|
|
- C1 (Connector/External): fixtures + snapshot + resilience + security; optional Live smoke.
|
|
- W1 (WebService/API): contract + authz + OTel trace assertions + negative cases.
|
|
- WK1 (Worker/Indexer): end-to-end job flow + retries + idempotency + telemetry.
|
|
- AN1 (Analyzer/SourceGen): Roslyn harness + diagnostics + golden generated output.
|
|
- CLI1 (Tool/CLI): exit codes + golden output + deterministic formatting.
|
|
- PERF (Benchmark): perf smoke subset + regression thresholds (relative).
|
|
|
|
## Repository foundations
|
|
- TestKit primitives: deterministic time/random, canonical JSON asserts, snapshot helpers, Postgres/Valkey fixtures, OTel capture.
|
|
- Determinism gate: canonical bytes and stable hashes for SBOM/VEX/verdict artifacts.
|
|
- Hybrid reachability posture: graph DSSE mandatory; edge-bundle DSSE optional/targeted with deterministic ordering.
|
|
- Architecture guards: enforce cross-module dependency boundaries (no lattice in Concelier/Excititor).
|
|
- Offline defaults: no network access unless explicitly tagged `Live`.
|
|
|
|
## CI lanes (standard filters)
|
|
- Unit: fast, offline; includes property and snapshot sub-traits.
|
|
- Contract: schema/OpenAPI stability and response envelopes.
|
|
- Integration: Testcontainers-backed service and storage tests.
|
|
- Security: authz/negative tests and security regressions.
|
|
- Performance: perf smoke and benchmark guards.
|
|
- Live: opt-in upstream connector checks (never PR gating by default).
|
|
|
|
## Documentation moments (when to update)
|
|
- New model or required test type: update `docs/testing/TEST_CATALOG.yml`.
|
|
- New lane or gate: update `docs/19_TEST_SUITE_OVERVIEW.md` and `docs/testing/ci-quality-gates.md`.
|
|
- Module-specific test policy change: update the module dossier under `docs/modules/<module>/`.
|
|
- New fixtures or runnable harnesses: place under `docs/benchmarks/**` or `tests/**` and link here.
|
|
|
|
## Related artifacts
|
|
- Test catalog (source of truth): `docs/testing/TEST_CATALOG.yml`
|
|
- Test suite overview: `docs/19_TEST_SUITE_OVERVIEW.md`
|
|
- Quality guardrails: `docs/testing/testing-quality-guardrails-implementation.md`
|
|
- Code samples from the advisory: `docs/benchmarks/testing/better-testing-strategy-samples.md`
|