Files
git.stella-ops.org/DROPPED_FEATURES.md

302 lines
21 KiB
Markdown

# Stella Ops - Dropped / Unimplemented Features
> Features described in product advisories but NOT found in current source code.
> Generated: 2026-02-07
> Consolidated: 2026-02-08 (pass 1 reduced 135 to 81; pass 2 reduced 81 to 37)
> These may have been dropped, deferred, replaced, or renamed.
## Summary
| Category | Count |
|----------|-------|
| Not Found (no code evidence) | 8 |
| Partially Implemented (incomplete) | 29 |
---
## Not Found Features
These features were described in advisories but no matching implementation was found in the current codebase.
### AI Codex / Zastava Companion
- **Status**: NOT_FOUND
- **Description**: The advisory AI module exists with policy studio and LatticeRuleGenerator, but the specific "AI Codex" or "Zastava Companion" branding/feature set described in the advisory is not found.
- **Expected modules**: `src/AdvisoryAI`
- **Source advisory**: file_09.md - Caching Reachability the Smart Way (09-Dec-2025)
### Advisory Lens (Core Library and UI)
- **Status**: NOT_FOUND
- **Description**: Proposed contextual copilot that learns from organizational data to surface explainable suggestions. Includes core library (semantic case matching), UI components (Lens Panel, inline hints, playbook drawer with dry-run preview). Not yet created; sprint tasks all at TODO status.
- **Expected modules**: `(planned for src/__Libraries/StellaOps.AdvisoryLens, src/Web)`
- **Source advisory**: file_08.md
### DORA Metrics
- **Status**: NOT_FOUND
- **Description**: No DORA metrics implementation found in the frontend or backend source code.
- **Source advisory**: file_12.md - Designing a Deterministic Vulnerability Scoring Matrix (12-Dec-2025)
### Golden Benchmark Fixtures (Core-10)
- **Status**: NOT_FOUND
- **Description**: The advisory describes 10 golden reachability benchmark fixtures (C, Java, .NET, Python, container), but no pre-built fixture datasets were found in the source tree. The ReachGraph service infrastructure exists and GoldenSet tests exist in BinaryIndex, but the specific Core-10 fixture data files are not present.
- **Source advisory**: 30-Nov-2025 - Reachability Benchmark Fixtures Snapshot.md
### Multi-Runtime Reachability Corpus (Go, .NET, Python, Rust)
- **Status**: NOT_FOUND
- **Description**: The multi-runtime reachability validation corpus with minimal apps per runtime, EXPECT.yaml ground truth, and runtime trace capture scripts is not implemented as a standalone test corpus.
- **Expected modules**: `None`
- **Source advisory**: file_11.md
### Outcome Analytics / Attribution
- **Status**: NOT_FOUND
- **Description**: The advisory's vision for outcome analytics with MTTR/MTTA attribution, cohort analysis, and executive reporting is not yet implemented.
- **Expected modules**: `None found`
- **Source advisory**: file_07.md
### Point-in-Time Vulnerability Query (As-Of Date)
- **Status**: NOT_FOUND
- **Description**: The ability to evaluate vulnerabilities against advisory data as of a specific historical date is not implemented. The replay system tracks inputs but does not provide temporal advisory queries. EPSS replay service has AsOfDate for EPSS scores but not for general vulnerability assessment.
- **Expected modules**: `None found`
- **Source advisory**: file_03.md
### Proof-Market Ledger and Adaptive Trust Economics
- **Status**: NOT_FOUND
- **Description**: No implementation of a proof marketplace or adaptive trust economics model was found in the source code. This was speculative/research-oriented.
- **Source advisory**: file_10.md - Smart-Diff and Provenance-Rich Binaries (09-Dec-2025)
---
## Partially Implemented Features
These features have some code but appear incomplete compared to advisory descriptions.
### AI Code Guard (Secrets Scanning + Attribution Check + License Hygiene)
- **Status**: PARTIALLY_IMPLEMENTED
- **Description**: AI Code Guard has policy signal binding and annotation services. Evidence provider interfaces exist. The advisory's proposed `stella guard run` CLI and full YAML-driven pipeline checks are partially represented through policy signal binding rather than a standalone CLI tool.
- **Modules**: `src/Integrations, src/Policy`
- **Evidence**: IAiCodeGuardEvidenceProvider.cs, AiCodeGuardSignalBinder.cs
### Binary Fingerprint Store and Trust Scoring
- **Status**: PARTIALLY_IMPLEMENTED
- **Description**: Binary analysis commands exist in the CLI with score gating. A full binary fingerprint database with ELF/PE section hashing is partially implemented through existing binary analysis infrastructure.
- **Modules**: `src/Attestor, src/Cli, src/Doctor, src/Policy`
- **Evidence**: BinaryAnalysisCommandTests.cs, ScoreGateCommandTests.cs
### CAS for SBOM/VEX/Attestation Artifacts
- **Status**: PARTIALLY_IMPLEMENTED
- **Description**: Content-addressed identifiers are implemented for proof chain artifacts. EvidenceLocker provides bundle building. Full OCI/MinIO CAS for SBOM/VEX blobs is not fully visible.
- **Modules**: `src/Attestor, src/EvidenceLocker`
- **Evidence**: ContentAddressedIdGenerator.cs, GenericContentAddressedId.cs
### Cross-Distro Golden Set for Backport Validation
- **Status**: PARTIALLY_IMPLEMENTED
- **Description**: Golden set infrastructure exists in BinaryIndex with analysis pipeline and API. The advisory's curated test cases (OpenSSL Heartbleed, sudo Baron Samedit, etc.) may not be fully populated yet.
- **Modules**: `src/BinaryIndex`
- **Evidence**: GoldenSetController.cs, GoldenSetAnalysisPipeline.cs
### Crypto-Sovereign Design (eIDAS/FIPS/GOST/SM/PQC)
- **Status**: PARTIALLY_IMPLEMENTED
- **Description**: SigningKeyProfile supports crypto-sovereign configurations. SM2 tests exist. The signing key registry supports multiple profiles. Additional crypto profiles (GOST R 34.10-2012, eIDAS, PQC) were explicitly deferred. Crypto modules exist under src/Cryptography and src/SmRemote but not all backends are fully implemented.
- **Modules**: `src/Attestor, src/Cryptography, src/SmRemote`
- **Evidence**: SigningKeyProfile.cs, Sm2AttestorTests.cs, eIDAS plugin with TrustServiceProviderClient
### DSSE Envelope Size Management and Gateway Traversal
- **Status**: PARTIALLY_IMPLEMENTED
- **Description**: Envelope size awareness exists in EPSS fetcher and delta-sig CLI commands. Bundling and queue options exist with configurable size limits. HMAC-based DSSE envelope signing exists in the scanner worker. No explicit size heuristic check (70-80KB) or automatic payload splitting/chunking logic found. NGINX/WAF gateway configuration is infrastructure-level.
- **Modules**: `src/Attestor, src/Cli, src/RiskEngine, src/Scanner`
- **Evidence**: BundlingOptions.cs, RekorQueueOptions.cs, HmacDsseEnvelopeSigner.cs
### DSSE-Signed Exception Objects with Recheck Policy
- **Status**: PARTIALLY_IMPLEMENTED
- **Description**: Policy exceptions framework with models, repositories, and services exists. DSSE signing infrastructure is available. Full UI exception modal with recheck policy enforcement is partially complete.
- **Modules**: `src/Attestor, src/Policy`
- **Evidence**: Policy.Exceptions/ (Models/, Repositories/, Services/), DsseEnvelope.cs
### DSSE-Wrapped Reach-Maps
- **Status**: PARTIALLY_IMPLEMENTED
- **Description**: Rich graphs and suppression witnesses exist with signing infrastructure available, but a specific "signed reach-map artifact" as a standalone DSSE-wrapped output is not distinctly implemented.
- **Modules**: `src/Attestor, src/Scanner`
- **Evidence**: SuppressionWitness.cs, RichGraph.cs
### Deterministic Trust Score and Vulnerability Scoring
- **Status**: PARTIALLY_IMPLEMENTED
- **Description**: EWS engine, Determinization system, UnifiedScoreService, and 6-dimension normalizers (RCH/RTS/BKP/XPL/SRC/MIT) provide the scoring foundation. TrustVerdict service and SmartDiff scoring exist. The unified facade combining EWS + Determinization exists as UnifiedScoreService. Specific basis-point fixed-point arithmetic and Score.v1 format are not built as distinct implementations.
- **Modules**: `src/Attestor, src/Policy, src/RiskEngine, src/Scanner, src/Signals`
- **Evidence**: UnifiedScoreService.cs, EvidenceWeightedScoreCalculator.cs, ReachabilityNormalizer.cs
### Determinism Hash / Signature Verification in UI
- **Status**: PARTIALLY_IMPLEMENTED
- **Description**: Proofs and proof-studio UI features exist for browsing proof artifacts. Bundle verification exists in CLI. The compare view has envelope-hashes component. Full inline determinism hash and signature verification status display may be partially wired up.
- **Modules**: `src/Cli, src/Web`
- **Evidence**: proof-studio feature directory, BundleVerifyCommand.cs, envelope-hashes.component.ts
### ELF Normalization and Delta Hashing
- **Status**: PARTIALLY_IMPLEMENTED
- **Description**: Binary normalization pipeline exists with x64 normalization tests and code normalizer AST. Delta signatures table exists in BinaryIndex migrations. The full low-entropy delta signatures with relocation zeroing, NOP canonicalization, and jump table rewriting as described may not be fully implemented.
- **Modules**: `src/BinaryIndex`
- **Evidence**: X64NormalizationPipelineTests.cs, CodeNormalizer.Ast.cs, 003_delta_signatures.sql
### Ecosystem Reality Acceptance Test Fixtures
- **Status**: PARTIALLY_IMPLEMENTED
- **Description**: SCA fixtures and acceptance packs exist but the advisory called for mapping five specific real-world incidents into deterministic tests. Some catalogue fixtures exist but full incident-to-test mapping is not fully evidenced.
- **Modules**: `src/Scanner, src/__Tests`
- **Evidence**: fixtures/sca/catalogue/README.md, acceptance packs, ScaFailureCatalogueTests.cs
### Evidence Coverage Score for AI Gating
- **Status**: PARTIALLY_IMPLEMENTED
- **Description**: AI output gating behind evidence quality exists via AIAuthorityClassifier which scores explanation, remediation, VEX draft, and policy draft quality. Specific UX badge component and standalone coverage scoring service are not implemented.
- **Modules**: `src/Attestor`
- **Evidence**: AIAuthorityClassifier.*.cs files
### Evidence TTL and staleness policy
- **Status**: PARTIALLY_IMPLEMENTED
- **Description**: Retention options and lifecycle services exist for evidence expiry, but the advisory noted TTL strategy at 50% coverage.
- **Modules**: `src/Signals, src/Unknowns`
- **Evidence**: SignalsRetentionOptions.cs, UnknownsLifecycleService.cs
### Graph Edge Metadata with Reason/Evidence/Provenance
- **Status**: PARTIALLY_IMPLEMENTED
- **Description**: EdgeReason and CallgraphEdge models exist in Signals with persistence projection, and EdgeBundle exists in Scanner reachability. However, the Graph module itself does not contain human-readable explanation layer types.
- **Modules**: `src/Graph, src/Scanner, src/Signals`
- **Evidence**: EdgeReason.cs, CallgraphEdge.cs, EdgeBundle.cs
### Ground-Truth Corpus with Reachability Tiers (R0-R4)
- **Status**: PARTIALLY_IMPLEMENTED
- **Description**: Golden fixture tests exist for smart-diff and reachability, but the full ground-truth corpus structure (/toys/svc-XX-<name>/ with labels.yaml) was not found.
- **Modules**: `src/Scanner`
- **Evidence**: StateComparisonGoldenTests.cs, reachability tests
### MI5 - Performance Budgets (Interaction Response, Animation Frame, LCP)
- **Status**: PARTIALLY_IMPLEMENTED
- **Description**: Lighthouse CI config exists for performance monitoring. Specific interaction response <=100ms, frame budget 16ms, and layout shift <0.05 budgets were not found as explicitly configured thresholds.
- **Modules**: `src/Web`
- **Evidence**: .lighthouserc.js
### MI10 - Theme/Contrast Guidance (Light/Dark/HC Tokens)
- **Status**: PARTIALLY_IMPLEMENTED
- **Description**: Color tokens and focus ring styles exist. Theme transition utilities are implemented. Explicit HC (high-contrast) mode tokens with contrast validation were not found as standalone artifacts.
- **Modules**: `src/Web`
- **Evidence**: _colors.scss, _interactions.scss
### Mirror Creator
- **Status**: PARTIALLY_IMPLEMENTED
- **Description**: Mirror creator module exists as a separate directory but appears to have limited implementation compared to the comprehensive AirGap module.
- **Modules**: `src/Mirror`
- **Evidence**: `src/Mirror/StellaOps.Mirror.Creator/`
### Noise Ledger (Audit Log of Suppressions)
- **Status**: PARTIALLY_IMPLEMENTED
- **Description**: Suppression witnesses and audit hash logging exist in the backend. CLI audit commands exist. SuppressionAuditLogger exists in Notifier. A dedicated "Noise Ledger" UX component is not present but the concept is implemented across backend services.
- **Modules**: `src/Attestor, src/Cli, src/Notifier, src/Scanner`
- **Evidence**: AuditCommandGroup.cs, SuppressionWitness.cs, SuppressionAuditLogger.cs
### Pipeline/Run-Centric View
- **Status**: PARTIALLY_IMPLEMENTED
- **Description**: Runs feature exists in the frontend with first-signal card components and prefetch services, but a full pipeline-centric view is only partially present.
- **Modules**: `src/Web`
- **Evidence**: runs feature directory with first-signal-card
### Provcache Invalidation and Evidence Chunk Paging
- **Status**: PARTIALLY_IMPLEMENTED
- **Description**: Provcache module exists with Valkey-backed store, write-behind queue, verification key builder. Evidence chunk storage and paged evidence API, signer-aware cache invalidation (SignerSetInvalidator), feed epoch invalidation, lazy evidence fetch, and air-gap export are in various stages. Multiple sprint waves describe this work, with ~90% completion noted.
- **Modules**: `src/__Libraries/StellaOps.Provcache/, src/Provenance/, src/Attestor/`
- **Evidence**: ValkeyProvcacheStore tests, WriteBehindQueue tests, VeriKeyBuilder tests
### SBOM Lineage Graph Visualization (Git-like Lane View)
- **Status**: PARTIALLY_IMPLEMENTED
- **Description**: Backend SBOM lineage graph service is fully implemented with controllers, repositories, and persistence. Frontend lineage components (~80% complete per advisory) exist with graph visualization, hover cards, SBOM diff, VEX diff, and compare panels. Components built but some not yet wired to backend APIs.
- **Modules**: `src/SbomService, src/Web`
- **Evidence**: LineageController.cs, SbomLineageGraphService.cs, ~41 UI files in features/lineage/
### Score UI Display Enhancement
- **Status**: PARTIALLY_IMPLEMENTED
- **Description**: A score comparison component exists in the UI, but the full unified score display with unknowns bands and delta-if-present was marked TODO.
- **Modules**: `src/Web`
- **Evidence**: score-comparison.component.ts
### Tier 5 Runtime Trace Evidence (eBPF Production-Grade)
- **Status**: PARTIALLY_IMPLEMENTED
- **Description**: Explicitly listed as future work in the advisory. eBPF-based function call tracing for runtime backport detection was not implemented at production-grade. eBPF probe infrastructure exists in `src/Signals/__Libraries/StellaOps.Signals.Ebpf/` and `src/Zastava/` but is early-stage/experimental, not the production-grade Tier 5 described. eBPF Runtime Signal Integration exists but is not production-ready.
- **Modules**: `src/Signals, src/Unknowns, src/Zastava`
- **Evidence**: StellaOps.Signals.Ebpf project, EbpfProbeManager.cs, RuntimeFactsIngestionService.cs
### VEX Findings API with Proof Artifacts
- **Status**: PARTIALLY_IMPLEMENTED
- **Description**: VEX verdict models, VEX delta predicates, and VexProofSpineService exist, but the full API contract (GET /vex/findings/:id with proof artifacts) is not visible as a standalone endpoint.
- **Modules**: `src/Attestor, src/Policy`
- **Evidence**: VexVerdictSummary.cs, VexVerdictId.cs
### VEX Gate (Inline Gated Action with Evidence Tiers)
- **Status**: PARTIALLY_IMPLEMENTED
- **Description**: VEX evidence and decision infrastructure exists (vex-evidence client, vex-decision-modal, evidence-ribbon). The specific VexGateButtonDirective with inline button morphing and tier-based gating was not found. The pattern is partially realized through separate VEX decision modals.
- **Modules**: `src/Web`
- **Evidence**: vex-decision-modal.component.ts, vex-evidence.client.ts
### Vulnerability-First Triage UX with Exploit Path Grouping and Proof Bundles
- **Status**: PARTIALLY_IMPLEMENTED
- **Description**: Backend triage service with DB context, reachability subgraph extraction, and proof generation exist. UI triage inbox and queue components are partially complete. Exploit path grouping tests exist.
- **Modules**: `src/Attestor, src/Scanner, src/Web`
- **Evidence**: Scanner.Triage/ (Entities, Models, Services), SubgraphExtractor.cs, triage-queue.component.ts
### VexLens Truth Table Tests
- **Status**: NOT_FOUND
- **Description**: Systematic truth table tests for VEX lattice merge correctness. The VexLens engine exists but comprehensive truth table test coverage is missing.
- **Modules**: `src/VexLens`
- **Source advisory**: file_14.md
---
## Removed in Pass 2 (44 entries removed)
The following entries were removed because they were found to be implemented, duplicated, or not actual features:
**Removed - Actually Implemented:**
- Base Image Detection and Recommendations: `BaseImageDetector.cs`, `IBaseImageDetector.cs` exist in Scanner.Manifest
- Delta-If-Present Calculations: `IncludeDeltaIfPresent` implemented in UnifiedScoreModels.cs
- Multi-scanner Comparative Benchmarking: `CompetitorBenchmarkTests.cs` with F1 precision/recall scoring
- Time-to-Evidence (TTE) Metric: `TimeToEvidenceMetrics.cs`, `TtePercentileExporter.cs` in Telemetry
- "Can I Ship?" Case Header: `case-header.component.ts` exists in triage
- 8-State Reachability Lattice: Full `LatticeState` enum (U/SR/SU/RO/RU/CR/CU/X) plus `ReachabilityLattice.cs` in multiple modules
- AI Chip Components: Extensive AI chip component family (ai-chip, ai-explain-chip, ai-vex-draft-chip, ai-fix-chip, etc.)
- Audit Trail "Why am I seeing this?": `verdict-why-summary.component.ts` exists
- Delta Verdict Attestation Predicate Types: `DeltaVerdictPredicate.cs`, `VexDeltaPredicate.cs`, `SbomDeltaPredicate.cs` all exist
- Evidence Subgraph UI Visualization: `evidence-subgraph.component.ts`, `evidence-subgraph.service.ts`, `evidence-subgraph.models.ts`
- Feed Snapshot Coordinator: `FeedSnapshotCoordinatorService` with 15+ partial files fully implemented
- Policy DSL (stella-dsl@1): `PolicyParser.cs`, `PolicyCompiler.cs`, `DslTokenizer.cs`, `DslCompletionProvider.cs` fully implemented
- Quota Governance and Circuit Breakers: Multiple circuit breaker implementations across Router, Scanner, Attestor, ReleaseOrchestrator
- Reachability Core Library: `IReachabilityIndex.cs`, `ReachabilityIndex.cs` exist in StellaOps.Reachability.Core
- Router Back-Pressure Middleware: `EnvironmentRateLimiter` with Valkey-backed store + circuit breaker fully implemented
- Score Replay and Verification: `ScoreReplayService.cs`, `ScoreReplayEndpoints.cs`, `ReplayVerifier.cs` all exist
- OCI Referrers for Evidence Storage: `OciReferrerPushClient.cs`, `OciReferrerDiscovery.cs` extensively implemented
- DSSE-signed offline scanner update bundles: `OfflineKit*` classes throughout Scanner, ExportCenter, Cli, AirGap
- Immutable Evidence Storage and Regulatory Alignment: `ComplianceEngine.cs`, `FrameworkMapper.cs`, `ReportGenerator.cs`, `NtiaComplianceReporter.cs`
- Verdict ladder UI: `verdict-ladder.component.ts`, `verdict-ladder-builder.service.ts`
- Monthly Bundle Rotation: `BundleRotationJob.cs` in Scheduler
- MI4 Toast/Snackbar: `toast.service.ts`, `toast-container.component.ts`
- Baseline Selection Logic: `BaselineSelector.cs`, `BaselineEndpoints.cs`
- Mirror Contracts (Time Anchor): Extensive `TimeAnchorService.*` in AirGap + `TimeAnchorPolicyService.*`
- PostgreSQL persistence layer: RLS migrations exist in multiple modules (Scheduler, Policy, Excititor, Authority, Findings)
- Idempotent Attestation/SBOM Submission APIs: Content-addressed IDs provide idempotency by design
- Metrics for attestation coverage: `TimeToEvidenceMetrics.cs`, `AttestationCompletenessCalculator.cs`
- Astra Linux OVAL Feed Connector: Tests show working connector plugin with options and trust defaults
- SBOM Graph Reachability Overlay: `graph-overlays.component.ts` exists
- Signals & Runtime Dashboard: `signals.client.ts`, `signals.models.ts` exist
- VEX Decision Filter with Reachability: Implemented through VexConsensusEngine + reachability facts integration
- Snapshot Export/Import for Air-Gap: Extensive OfflineBundle and SnapshotBundle infrastructure
- Vendor comparison / scanner parity tracking: `CompetitorBenchmarkTests.cs` with F1 scoring
- Unknowns Decay and Triage Queue: `triage-queue.component.ts`, `TriageInboxEndpoints.cs`, `UnknownRanker.cs`
- Evidence-Weighted Score (EWS) 6-Dimension: Merged with Deterministic Trust Score entry
**Removed - Not Features (process/docs/research items):**
- CI Lint Hook for Implementor Guidelines: CI infrastructure task, not a product feature
- MI6 Component-to-Interaction Token Mapping Document: Documentation artifact, not a product feature
- MI7 Telemetry Schema for ui.micro.* Events: Schema design task, not a product feature
- Benchmark Harness for FP Reduction: Benchmarking tool, not a product feature
- DSSE+Rekor Batch Size Benchmarking Tool: Benchmarking tool, not a product feature
- Comparative Evidence/Suppression Pattern Analysis: Research document influencing design, not a standalone feature
**Removed - Semantic Duplicates (merged into other entries):**
- DSSE Gateway Traversal: Merged into DSSE Envelope Size Management entry
- Immutable Advisory Feed Snapshots: Duplicate of Feed Snapshot Coordinator (now removed as implemented)
- eBPF Runtime Signal Integration: Merged into Tier 5 Runtime Trace Evidence entry
- EWS Model (6-Dimension Scoring): Merged into Deterministic Trust Score entry