stella-ops.org/git.stella-ops.org
1
0
Fork 0
Code Issues Pull Requests Actions 16 Releases Wiki Activity
Files
c2c6b58b416bc36020cc9d593f44c75e7401fbb7
git.stella-ops.org/docs/implplan/SPRINT_163_exportcenter_ii.md
master c2c6b58b41 feat: Add Promotion-Time Attestations for Stella Ops 
- Introduced a new document for promotion-time attestations, detailing the purpose, predicate schema, producer workflow, verification flow, APIs, and security considerations.
- Implemented the `stella.ops/promotion@v1` predicate schema to capture promotion evidence including image digest, SBOM/VEX artifacts, and Rekor proof.
- Defined producer responsibilities and workflows for CLI orchestration, signer responsibilities, and Export Center integration.
- Added verification steps for auditors to validate promotion attestations offline.

feat: Create Symbol Manifest v1 Specification

- Developed a specification for Symbol Manifest v1 to provide a deterministic format for publishing debug symbols and source maps.
- Defined the manifest structure, including schema, entries, source maps, toolchain, and provenance.
- Outlined upload and verification processes, resolve APIs, runtime proxy, caching, and offline bundle generation.
- Included security considerations and related tasks for implementation.

chore: Add Ruby Analyzer with Git Sources

- Created a Gemfile and Gemfile.lock for Ruby analyzer with dependencies on git-gem, httparty, and path-gem.
- Implemented main application logic to utilize the defined gems and output their versions.
- Added expected JSON output for the Ruby analyzer to validate the integration of the new gems and their functionalities.
- Developed internal observation classes for Ruby packages, runtime edges, and capabilities, including serialization logic for observations.

test: Add tests for Ruby Analyzer

- Created test fixtures for Ruby analyzer, including Gemfile, Gemfile.lock, main application, and expected JSON output.
- Ensured that the tests validate the correct integration and functionality of the Ruby analyzer with the specified gems.
2025-11-11 15:30:22 +02:00

5.0 KiB
Raw Blame History

Sprint 163 - Export & Evidence · 160.B) ExportCenter.II

Active items only. Completed/historic work now resides in docs/implplan/archived/tasks.md (updated 2025-11-08).

[Export & Evidence] 160.B) ExportCenter.II Depends on: Sprint 160.B - ExportCenter.I Summary: Export & Evidence focus on ExportCenter (phase II).

Task ID State Task description Owners (Source)
EXPORT-OAS-63-001 TODO Implement deprecation headers and notifications for legacy export endpoints. Dependencies: EXPORT-OAS-62-001. Exporter Service Guild, API Governance Guild (src/ExportCenter/StellaOps.ExportCenter)
EXPORT-OBS-50-001 TODO Adopt telemetry core in exporter service + workers, ensuring spans/logs capture profile id, tenant, artifact counts, distribution type, and trace IDs. Exporter Service Guild, Observability Guild (src/ExportCenter/StellaOps.ExportCenter)
EXPORT-OBS-51-001 TODO Emit metrics for export planner latency, bundle build time, distribution success rate, bundle size, and define SLOs (bundle availability P95 <90s). Add Grafana dashboards + burn-rate alerts. Dependencies: EXPORT-OBS-50-001. Exporter Service Guild, DevOps Guild (src/ExportCenter/StellaOps.ExportCenter)
EXPORT-OBS-52-001 TODO Publish timeline events for export lifecycle (export.requested, export.built, export.distributed, export.failed) embedding manifest hashes and evidence refs. Provide dedupe + retry logic. Dependencies: EXPORT-OBS-51-001. Exporter Service Guild (src/ExportCenter/StellaOps.ExportCenter)
EXPORT-OBS-53-001 TODO Push export manifests + distribution transcripts to evidence locker bundles, ensuring Merkle root alignment and DSSE pre-sign data available. Dependencies: EXPORT-OBS-52-001. Exporter Service Guild, Evidence Locker Guild (src/ExportCenter/StellaOps.ExportCenter)
EXPORT-OBS-54-001 TODO Produce DSSE attestations for each export artifact and distribution target, expose verification API /exports/{id}/attestation, and integrate with CLI verify path. Dependencies: EXPORT-OBS-53-001. Exporter Service Guild, Provenance Guild (src/ExportCenter/StellaOps.ExportCenter)
EXPORT-OBS-54-002 TODO Add promotion attestation assembly to export runs (compute SBOM/VEX digests, embed Rekor proofs, bundle DSSE envelopes) and ensure Offline Kit packaging includes the resulting JSON + DSSE envelopes. Dependencies: EXPORT-OBS-54-001, PROV-OBS-53-003. Exporter Service Guild, Provenance Guild (src/ExportCenter/StellaOps.ExportCenter)
EXPORT-OBS-55-001 TODO Add incident mode enhancements (extra tracing for slow exports, additional debug logs, retention bump). Emit incident activation events to timeline + notifier. Dependencies: EXPORT-OBS-54-001. Exporter Service Guild, DevOps Guild (src/ExportCenter/StellaOps.ExportCenter)
EXPORT-RISK-69-001 TODO Add Export Center job handler risk-bundle with provider selection, manifest signing, and audit logging. Exporter Service Guild, Risk Bundle Export Guild (src/ExportCenter/StellaOps.ExportCenter)
EXPORT-RISK-69-002 TODO Enable simulation report exports pulling scored data + explainability snapshots. Dependencies: EXPORT-RISK-69-001. Exporter Service Guild, Risk Engine Guild (src/ExportCenter/StellaOps.ExportCenter)
EXPORT-RISK-70-001 TODO Integrate risk bundle builds into offline kit packaging with checksum verification. Dependencies: EXPORT-RISK-69-002. Exporter Service Guild, DevOps Guild (src/ExportCenter/StellaOps.ExportCenter)
EXPORT-SVC-35-001 BLOCKED (2025-10-29) Bootstrap exporter service project, configuration, and Postgres migrations for export_profiles, export_runs, export_inputs, export_distributions with tenant scoping + tests. Exporter Service Guild (src/ExportCenter/StellaOps.ExportCenter)
EXPORT-SVC-35-002 TODO Implement planner + scope resolver translating filters into ledger iterators and orchestrator job payloads; include deterministic sampling and validation. Dependencies: EXPORT-SVC-35-001. Exporter Service Guild (src/ExportCenter/StellaOps.ExportCenter)
EXPORT-SVC-35-003 TODO Deliver JSON adapters (json:raw, json:policy) with canonical normalization, redaction allowlists, compression, and manifest counts. Dependencies: EXPORT-SVC-35-002. Exporter Service Guild (src/ExportCenter/StellaOps.ExportCenter)
EXPORT-SVC-35-004 TODO Build mirror (full) adapter producing filesystem layout, indexes, manifests, and README with download-only distribution. Dependencies: EXPORT-SVC-35-003. Exporter Service Guild (src/ExportCenter/StellaOps.ExportCenter)
EXPORT-SVC-35-005 TODO Implement manifest/provenance writer and KMS signing/attestation (detached + embedded) for bundle outputs. Dependencies: EXPORT-SVC-35-004. Exporter Service Guild (src/ExportCenter/StellaOps.ExportCenter)
EXPORT-CRYPTO-90-001 TODO Ensure manifest hashing, signing, and bundle encryption flows route through ICryptoProviderRegistry/ICryptoHash so RootPack deployments can select CryptoPro/PKCS#11 providers per docs/security/crypto-routing-audit-2025-11-07.md. Exporter Service Guild, Security Guild (src/ExportCenter/StellaOps.ExportCenter)