c2c6b58b41
- Introduced a new document for promotion-time attestations, detailing the purpose, predicate schema, producer workflow, verification flow, APIs, and security considerations. - Implemented the `stella.ops/promotion@v1` predicate schema to capture promotion evidence including image digest, SBOM/VEX artifacts, and Rekor proof. - Defined producer responsibilities and workflows for CLI orchestration, signer responsibilities, and Export Center integration. - Added verification steps for auditors to validate promotion attestations offline. feat: Create Symbol Manifest v1 Specification - Developed a specification for Symbol Manifest v1 to provide a deterministic format for publishing debug symbols and source maps. - Defined the manifest structure, including schema, entries, source maps, toolchain, and provenance. - Outlined upload and verification processes, resolve APIs, runtime proxy, caching, and offline bundle generation. - Included security considerations and related tasks for implementation. chore: Add Ruby Analyzer with Git Sources - Created a Gemfile and Gemfile.lock for Ruby analyzer with dependencies on git-gem, httparty, and path-gem. - Implemented main application logic to utilize the defined gems and output their versions. - Added expected JSON output for the Ruby analyzer to validate the integration of the new gems and their functionalities. - Developed internal observation classes for Ruby packages, runtime edges, and capabilities, including serialization logic for observations. test: Add tests for Ruby Analyzer - Created test fixtures for Ruby analyzer, including Gemfile, Gemfile.lock, main application, and expected JSON output. - Ensured that the tests validate the correct integration and functionality of the Ruby analyzer with the specified gems.
7.4 KiB
7.4 KiB
Sprint 401 – Reachability Evidence Chain
Window: November 11 – November 22, 2025
Theme: Finish the provable reachability pipeline (graph CAS → replay → DSSE → policy/UI) so Sprint 402 can focus on polish.
Wave coordination
| Wave | Guild owners | Shared prerequisites | Status | Notes |
|---|---|---|---|---|
| 401 Reachability Evidence Chain | Scanner Guild · Signals Guild · BE-Base Platform Guild · Policy Guild · UI/CLI Guilds · Docs Guild | Sprint 140 Runtime & Signals; Sprint 185 – Replay Core; Sprint 186 – Scanner Record Mode; Sprint 187 – Evidence Locker & CLI Integration | TODO | Foundation work (Sprint 400) is still in flight; advance only after Scanner record mode emits replay manifests and Evidence Locker APIs exist. |
| Task ID | State | Task description | Owners (Source) |
|---|---|---|---|
| GRAPH-CAS-401-001 | TODO | Finalize richgraph schema (richgraph-v1), emit canonical SymbolIDs, compute graph hash (BLAKE3), and store CAS manifests under cas://reachability/graphs/{sha256}. Update Scanner Worker adapters + fixtures. |
Scanner Worker Guild (src/Scanner/StellaOps.Scanner.Worker) |
| GAP-SYM-007 | TODO | Extend reachability evidence schema/DTOs with demangled symbol hints, symbol.source, confidence, and optional code_block_hash; ensure Scanner SBOM/evidence writers and CLI serializers emit the new fields deterministically. |
Scanner Worker Guild & Docs Guild (src/Scanner/StellaOps.Scanner.Models, docs/modules/scanner/architecture.md, docs/reachability/function-level-evidence.md) |
| SCAN-REACH-401-009 | TODO | Ship .NET/JVM symbolizers and call-graph generators (roots, edges, framework adapters), merge results into component-level reachability manifests, and back them with golden fixtures. | Scanner Worker Guild (src/Scanner/StellaOps.Scanner.Worker, src/Scanner/__Libraries) |
| SYMS-SERVER-401-011 | TODO | Deliver StellaOps.Symbols.Server (REST+gRPC) with DSSE-verified uploads, Mongo/MinIO storage, tenant isolation, and deterministic debugId indexing; publish health/manifest APIs (spec: docs/specs/SYMBOL_MANIFEST_v1.md). |
Symbols Guild (src/Symbols/StellaOps.Symbols.Server) |
| SYMS-CLIENT-401-012 | TODO | Ship StellaOps.Symbols.Client SDK (resolve/upload APIs, platform key derivation for ELF/PDB/Mach-O/JVM/Node, disk LRU cache) and integrate with Scanner.Symbolizer/runtime probes (ref. docs/specs/SYMBOL_MANIFEST_v1.md). |
Symbols Guild (src/Symbols/StellaOps.Symbols.Client, src/Scanner/StellaOps.Scanner.Symbolizer) |
| SYMS-INGEST-401-013 | TODO | Build symbols ingest CLI to emit DSSE-signed SymbolManifest v1, upload blobs, and register Rekor entries; document GitLab/Gitea pipeline usage. |
Symbols Guild, DevOps Guild (src/Symbols/StellaOps.Symbols.Ingestor.Cli, docs/specs/SYMBOL_MANIFEST_v1.md) |
| SIGNALS-RUNTIME-401-002 | TODO | Ship /signals/runtime-facts ingestion for NDJSON (and gzip) batches, dedupe hits, and link runtime evidence CAS URIs to callgraph nodes. Include retention + RBAC tests. |
Signals Guild (src/Signals/StellaOps.Signals) |
| RUNTIME-PROBE-401-010 | TODO | Implement lightweight runtime probes (EventPipe/.NET, JFR/JVM) that capture method enter events for the target components, package them as CAS traces, and feed them into the Signals ingestion pipeline. | Runtime Signals Guild (src/Signals/StellaOps.Signals.Runtime, ops/probes) |
| SIGNALS-SCORING-401-003 | TODO | Extend ReachabilityScoringService with deterministic scoring (static path +0.50, runtime hits +0.30/+0.10 sink, guard penalties, reflection penalty, floor 0.05), persist reachability labels (reachable/conditional/unreachable) and expose /graphs/{scanId} CAS lookups. |
Signals Guild (src/Signals/StellaOps.Signals) |
| REPLAY-401-004 | TODO | Bump replay manifest to v2 (feeds, analyzers, policies), have ReachabilityReplayWriter enforce CAS registration + hash sorting, and add deterministic tests to tests/reachability/StellaOps.Reachability.FixtureTests. |
BE-Base Platform Guild (src/__Libraries/StellaOps.Replay.Core) |
| AUTH-REACH-401-005 | TODO | Introduce DSSE predicate types for SBOM/Graph/VEX/Replay, plumb signing through Authority + Signer, and mirror statements to Rekor (including PQ variants where required). | Authority & Signer Guilds (src/Authority/StellaOps.Authority, src/Signer/StellaOps.Signer) |
| POLICY-VEX-401-006 | TODO | Policy Engine consumes reachability facts, applies the deterministic score/label buckets (≥0.80 reachable, 0.30–0.79 conditional, <0.30 unreachable), emits OpenVEX with call-path proofs, and updates SPL schema with reachability.state/confidence predicates and suppression gates. |
Policy Guild (src/Policy/StellaOps.Policy.Engine, src/Policy/__Libraries/StellaOps.Policy) |
| UI-CLI-401-007 | TODO | Implement CLI stella graph explain + UI explain drawer showing signed call-path, predicates, runtime hits, and DSSE pointers; include counterfactual controls. |
UI & CLI Guilds (src/Cli/StellaOps.Cli, src/UI/StellaOps.UI) |
| QA-DOCS-401-008 | TODO | Wire reachbench-2025-expanded fixtures into CI, document CAS layouts + replay steps in docs/reachability/DELIVERY_GUIDE.md, and publish operator runbook for runtime ingestion. |
QA & Docs Guilds (docs, tests/README.md) |
| GAP-SIG-003 | TODO | Finish /signals/runtime-facts ingestion, add CAS-backed runtime storage, extend scoring to lattice states (Unknown/NotPresent/Unreachable/Conditional/Reachable/Observed), and emit signals.fact.updated events. Document retention/RBAC. |
Signals Guild (src/Signals/StellaOps.Signals, docs/reachability/function-level-evidence.md) |
| GAP-REP-004 | TODO | Enforce BLAKE3 hashing + CAS registration for graphs/traces before manifest writes, upgrade replay manifest v2 with analyzer versions/policy thresholds, and add deterministic tests. | BE-Base Platform Guild (src/__Libraries/StellaOps.Replay.Core, docs/replay/DETERMINISTIC_REPLAY.md) |
| GAP-POL-005 | TODO | Ingest reachability facts into Policy Engine, expose reachability.state/confidence in SPL/API, enforce auto-suppress (<0.30) rules, and generate OpenVEX evidence blocks referencing graph hashes + runtime facts with policy thresholds. |
Policy Guild (src/Policy/StellaOps.Policy.Engine, docs/modules/policy/architecture.md, docs/reachability/function-level-evidence.md) |
| GAP-VEX-006 | TODO | Wire Policy/Excititor/UI/CLI surfaces so VEX emission and explain drawers show call paths, graph hashes, and runtime hits; add CLI --evidence=graph/--threshold plus Notify template updates. |
Policy, Excititor, UI, CLI & Notify Guilds (docs/modules/excititor/architecture.md, src/Cli/StellaOps.Cli, src/UI/StellaOps.UI, docs/09_API_CLI_REFERENCE.md) |
| GAP-DOC-008 | TODO | Publish the cross-module function-level evidence guide, update API/CLI references with the new code_id fields, and add OpenVEX/replay samples under samples/reachability/**. |
Docs Guild (docs/reachability/function-level-evidence.md, docs/09_API_CLI_REFERENCE.md, docs/api/policy.md) |
| SYMS-BUNDLE-401-014 | TODO | Produce deterministic symbol bundles for air-gapped installs (`symbols bundle create | verify |
Use
docs/reachability/DELIVERY_GUIDE.mdfor architecture context, dependencies, and acceptance tests.