stella-ops.org/git.stella-ops.org
1
0
Fork 0
Code Issues Pull Requests Actions 2 Releases Wiki Activity
Files
e59921374e40717c2c1dedb0d7c42cd478d395fd
git.stella-ops.org/docs/testing/testing-strategy-models.md
master dac8e10e36 feat(crypto): Complete Phase 2 - Configuration-driven crypto architecture with 100% compliance 
## Summary

This commit completes Phase 2 of the configuration-driven crypto architecture, achieving
100% crypto compliance by eliminating all hardcoded cryptographic implementations.

## Key Changes

### Phase 1: Plugin Loader Infrastructure
- **Plugin Discovery System**: Created StellaOps.Cryptography.PluginLoader with manifest-based loading
- **Configuration Model**: Added CryptoPluginConfiguration with regional profiles support
- **Dependency Injection**: Extended DI to support plugin-based crypto provider registration
- **Regional Configs**: Created appsettings.crypto.{international,russia,eu,china}.yaml
- **CI Workflow**: Added .gitea/workflows/crypto-compliance.yml for audit enforcement

### Phase 2: Code Refactoring
- **API Extension**: Added ICryptoProvider.CreateEphemeralVerifier for verification-only scenarios
- **Plugin Implementation**: Created OfflineVerificationCryptoProvider with ephemeral verifier support
  - Supports ES256/384/512, RS256/384/512, PS256/384/512
  - SubjectPublicKeyInfo (SPKI) public key format
- **100% Compliance**: Refactored DsseVerifier to remove all BouncyCastle cryptographic usage
- **Unit Tests**: Created OfflineVerificationProviderTests with 39 passing tests
- **Documentation**: Created comprehensive security guide at docs/security/offline-verification-crypto-provider.md
- **Audit Infrastructure**: Created scripts/audit-crypto-usage.ps1 for static analysis

### Testing Infrastructure (TestKit)
- **Determinism Gate**: Created DeterminismGate for reproducibility validation
- **Test Fixtures**: Added PostgresFixture and ValkeyFixture using Testcontainers
- **Traits System**: Implemented test lane attributes for parallel CI execution
- **JSON Assertions**: Added CanonicalJsonAssert for deterministic JSON comparisons
- **Test Lanes**: Created test-lanes.yml workflow for parallel test execution

### Documentation
- **Architecture**: Created CRYPTO_CONFIGURATION_DRIVEN_ARCHITECTURE.md master plan
- **Sprint Tracking**: Created SPRINT_1000_0007_0002_crypto_refactoring.md (COMPLETE)
- **API Documentation**: Updated docs2/cli/crypto-plugins.md and crypto.md
- **Testing Strategy**: Created testing strategy documents in docs/implplan/SPRINT_5100_0007_*

## Compliance & Testing

- ✅ Zero direct System.Security.Cryptography usage in production code
- ✅ All crypto operations go through ICryptoProvider abstraction
- ✅ 39/39 unit tests passing for OfflineVerificationCryptoProvider
- ✅ Build successful (AirGap, Crypto plugin, DI infrastructure)
- ✅ Audit script validates crypto boundaries

## Files Modified

**Core Crypto Infrastructure:**
- src/__Libraries/StellaOps.Cryptography/CryptoProvider.cs (API extension)
- src/__Libraries/StellaOps.Cryptography/CryptoSigningKey.cs (verification-only constructor)
- src/__Libraries/StellaOps.Cryptography/EcdsaSigner.cs (fixed ephemeral verifier)

**Plugin Implementation:**
- src/__Libraries/StellaOps.Cryptography.Plugin.OfflineVerification/ (new)
- src/__Libraries/StellaOps.Cryptography.PluginLoader/ (new)

**Production Code Refactoring:**
- src/AirGap/StellaOps.AirGap.Importer/Validation/DsseVerifier.cs (100% compliant)

**Tests:**
- src/__Libraries/__Tests/StellaOps.Cryptography.Plugin.OfflineVerification.Tests/ (new, 39 tests)
- src/__Libraries/__Tests/StellaOps.Cryptography.PluginLoader.Tests/ (new)

**Configuration:**
- etc/crypto-plugins-manifest.json (plugin registry)
- etc/appsettings.crypto.*.yaml (regional profiles)

**Documentation:**
- docs/security/offline-verification-crypto-provider.md (600+ lines)
- docs/implplan/CRYPTO_CONFIGURATION_DRIVEN_ARCHITECTURE.md (master plan)
- docs/implplan/SPRINT_1000_0007_0002_crypto_refactoring.md (Phase 2 complete)

## Next Steps

Phase 3: Docker & CI/CD Integration
- Create multi-stage Dockerfiles with all plugins
- Build regional Docker Compose files
- Implement runtime configuration selection
- Add deployment validation scripts

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2025-12-23 18:20:00 +02:00

3.1 KiB
Raw Blame History

Testing Strategy Models and Lanes (2026)

Source advisory: docs/product-advisories/22-Dec-2026 - Better testing strategy.md
Supersedes/extends: docs/product-advisories/archived/2025-12-21-testing-strategy/20-Dec-2025 - Testing strategy.md

Purpose

  • Define a single testing taxonomy for all StellaOps project types.
  • Make determinism, offline readiness, and evidence integrity testable by default.
  • Align CI lanes with a shared catalog so coverage is visible and enforceable.

Strategy in brief

  • Use test models (L0, S1, C1, W1, WK1, T1, AN1, CLI1, PERF) to encode required test types.
  • Map every module to one or more models in docs/testing/TEST_CATALOG.yml.
  • Run tests through standardized CI lanes (Unit, Contract, Integration, Security, Performance, Live).

Test models (requirements)

  • L0 (Library/Core): unit + property + snapshot + determinism.
  • S1 (Storage/Postgres): migrations + idempotency + concurrency + query ordering.
  • T1 (Transport/Queue): protocol roundtrip + fuzz invalid + delivery semantics.
  • C1 (Connector/External): fixtures + snapshot + resilience + security; optional Live smoke.
  • W1 (WebService/API): contract + authz + OTel trace assertions + negative cases.
  • WK1 (Worker/Indexer): end-to-end job flow + retries + idempotency + telemetry.
  • AN1 (Analyzer/SourceGen): Roslyn harness + diagnostics + golden generated output.
  • CLI1 (Tool/CLI): exit codes + golden output + deterministic formatting.
  • PERF (Benchmark): perf smoke subset + regression thresholds (relative).

Repository foundations

  • TestKit primitives: deterministic time/random, canonical JSON asserts, snapshot helpers, Postgres/Valkey fixtures, OTel capture.
  • Determinism gate: canonical bytes and stable hashes for SBOM/VEX/verdict artifacts.
  • Hybrid reachability posture: graph DSSE mandatory; edge-bundle DSSE optional/targeted with deterministic ordering.
  • Architecture guards: enforce cross-module dependency boundaries (no lattice in Concelier/Excititor).
  • Offline defaults: no network access unless explicitly tagged Live.

CI lanes (standard filters)

  • Unit: fast, offline; includes property and snapshot sub-traits.
  • Contract: schema/OpenAPI stability and response envelopes.
  • Integration: Testcontainers-backed service and storage tests.
  • Security: authz/negative tests and security regressions.
  • Performance: perf smoke and benchmark guards.
  • Live: opt-in upstream connector checks (never PR gating by default).

Documentation moments (when to update)

  • New model or required test type: update docs/testing/TEST_CATALOG.yml.
  • New lane or gate: update docs/19_TEST_SUITE_OVERVIEW.md and docs/testing/ci-quality-gates.md.
  • Module-specific test policy change: update the module dossier under docs/modules/<module>/.
  • New fixtures or runnable harnesses: place under docs/benchmarks/** or tests/** and link here.

Related artifacts

  • Test catalog (source of truth): docs/testing/TEST_CATALOG.yml
  • Test suite overview: docs/19_TEST_SUITE_OVERVIEW.md
  • Quality guardrails: docs/testing/testing-quality-guardrails-implementation.md
  • Code samples from the advisory: docs/benchmarks/testing/better-testing-strategy-samples.md