90c244948a
- Modified task status update instructions in AGENTS.md files to refer to corresponding sprint files as `/docs/implplan/SPRINT_*.md` instead of `docs/implplan/SPRINTS.md`. - Added a comprehensive document for Secret Leak Detection operations detailing scope, prerequisites, rule bundle lifecycle, enabling the analyzer, policy patterns, observability, troubleshooting, and references.
StellaOps Registry Token Service
The registry module issues scoped pull tokens for mirrored container registries while enforcing plan and licence constraints.
Responsibilities
- Validate Authority-issued OpToks and tenant scopes before issuance.
- Mint time-bound registry tokens and record issuance ledgers.
- Expose revocation and audit endpoints for security teams.
- Integrate with Offline Kit for deterministic token manifests.
Key components
StellaOps.Registry.TokenServiceminimal API host.- Mongo-backed issuance ledger.
- Tests under
src/Registry/__Tests.
Integrations & dependencies
- Authority for identity & scope verification.
- Export Center/Offline Kit for distribution.
- DevOps runbooks for deployment and rotation.
Operational notes
- Operational guide at ./operations/token-service.md.
- Telemetry dashboards pending (see ../../TASKS.md).
Related resources
- ./operations/token-service.md
Backlog references
- DEVOPS-REGISTRY items in ../../TASKS.md (future work).
- Registry automation stories tracked in src/Registry/TASKS.md if present.
Epic alignment
- Epic 10 – Export Center: provide signed, auditable registry token bundles for mirror distribution.
- Epic 14 – Identity & Tenancy: enforce tenant-aware scopes, PoE alignment, and revocation policies.