efd6850c38
- Implemented comprehensive tests for VexLensNormalizer including format detection and normalization scenarios. - Added tests for CpeParser covering CPE 2.3 and 2.2 formats, invalid inputs, and canonical key generation. - Created tests for ProductMapper to validate parsing and matching logic across different strictness levels. - Developed tests for PurlParser to ensure correct parsing of various PURL formats and validation of identifiers. - Introduced stubs for Monaco editor and worker to facilitate testing in the web application. - Updated project file for the test project to include necessary dependencies.
368 lines
16 KiB
Markdown
368 lines
16 KiB
Markdown
# Blocked Tasks Dependency DAG
|
|
|
|
> **Last Updated:** 2025-12-06
|
|
> **Total Blocked Tasks:** 399 across 61 sprint files
|
|
> **Root Blockers:** 42 unique blockers
|
|
> **Cross-Reference:** See [BLOCKED_DEPENDENCY_TREE.md](./BLOCKED_DEPENDENCY_TREE.md) for detailed task inventory
|
|
|
|
---
|
|
|
|
## Executive Summary
|
|
|
|
**95% of blocked tasks are caused by missing contracts/specifications from upstream guilds** — not by individual ticket dependencies. This is a systemic process failure in cross-team coordination.
|
|
|
|
| Metric | Value |
|
|
|--------|-------|
|
|
| Total BLOCKED tasks | 399 |
|
|
| Sprint files with blocks | 61 |
|
|
| Unique root blockers | 42+ |
|
|
| Longest dependency chain | 10 tasks (Registry API) |
|
|
| Tasks unblocked since 2025-12-04 | 84+ |
|
|
| Remaining blocked | ~315 |
|
|
|
|
---
|
|
|
|
## Master Dependency Graph
|
|
|
|
```mermaid
|
|
flowchart TB
|
|
subgraph ROOT_BLOCKERS["ROOT BLOCKERS (42 total)"]
|
|
RB1["SIGNALS CAS Promotion<br/>PREP-SIGNALS-24-002"]
|
|
RB2["Risk Scoring Contract<br/>66-002"]
|
|
RB3["VerificationPolicy Schema"]
|
|
RB4["advisory_key Schema"]
|
|
RB5["Policy Studio API"]
|
|
RB6["Authority effective:write"]
|
|
RB7["GRAP0101 Vuln Explorer"]
|
|
RB8["Sealed Mode Contract"]
|
|
RB9["Time-Anchor/TUF Trust"]
|
|
RB10["PGMI0101 Staffing"]
|
|
end
|
|
|
|
subgraph SIGNALS_CHAIN["SIGNALS CHAIN (15+ tasks)"]
|
|
S1["24-002 Cache"]
|
|
S2["24-003 Runtime Facts"]
|
|
S3["24-004 Authority Scopes"]
|
|
S4["24-005 Scoring"]
|
|
S5["GRAPH-28-007"]
|
|
S6["GRAPH-28-008"]
|
|
S7["GRAPH-28-009"]
|
|
S8["GRAPH-28-010"]
|
|
end
|
|
|
|
subgraph VEX_CHAIN["VEX LENS CHAIN (11 tasks)"]
|
|
V1["30-001 Base"]
|
|
V2["30-002"]
|
|
V3["30-003 Issuer Dir"]
|
|
V4["30-004 Policy"]
|
|
V5["30-005"]
|
|
V6["30-006 Ledger"]
|
|
V7["30-007"]
|
|
V8["30-008 Policy"]
|
|
V9["30-009 Observability"]
|
|
V10["30-010 QA"]
|
|
V11["30-011 DevOps"]
|
|
end
|
|
|
|
subgraph REGISTRY_CHAIN["REGISTRY API CHAIN (10 tasks)"]
|
|
R1["27-001 OpenAPI Spec"]
|
|
R2["27-002 Workspace"]
|
|
R3["27-003 Compile"]
|
|
R4["27-004 Simulation"]
|
|
R5["27-005 Batch"]
|
|
R6["27-006 Review"]
|
|
R7["27-007 Publish"]
|
|
R8["27-008 Promotion"]
|
|
R9["27-009 Metrics"]
|
|
R10["27-010 Tests"]
|
|
end
|
|
|
|
subgraph EXPORT_CHAIN["EXPORT CENTER CHAIN (8 tasks)"]
|
|
E1["OAS-63-001 Deprecation"]
|
|
E2["OBS-50-001 Telemetry"]
|
|
E3["OBS-51-001 Metrics"]
|
|
E4["OBS-52-001 Timeline"]
|
|
E5["OBS-53-001 Evidence"]
|
|
E6["OBS-54-001 DSSE"]
|
|
E7["OBS-54-002 Promotion"]
|
|
E8["OBS-55-001 Incident"]
|
|
end
|
|
|
|
subgraph AIRGAP_CHAIN["AIRGAP ECOSYSTEM (17+ tasks)"]
|
|
A1["CTL-57-001 Diagnostics"]
|
|
A2["CTL-57-002 Telemetry"]
|
|
A3["CTL-58-001 Time Anchor"]
|
|
A4["IMP-57-002 Loader"]
|
|
A5["IMP-58-001 API/CLI"]
|
|
A6["IMP-58-002 Timeline"]
|
|
A7["CLI-56-001 mirror create"]
|
|
A8["CLI-56-002 sealed mode"]
|
|
A9["CLI-57-001 airgap import"]
|
|
A10["CLI-57-002 airgap seal"]
|
|
A11["CLI-58-001 airgap export"]
|
|
end
|
|
|
|
subgraph ATTESTOR_CHAIN["ATTESTATION CHAIN (6 tasks)"]
|
|
AT1["73-001 VerificationPolicy"]
|
|
AT2["73-002 Verify Pipeline"]
|
|
AT3["74-001 Attestor Pipeline"]
|
|
AT4["74-002 Console Report"]
|
|
AT5["CLI-73-001 stella attest sign"]
|
|
AT6["CLI-73-002 stella attest verify"]
|
|
end
|
|
|
|
subgraph RISK_CHAIN["RISK/POLICY CHAIN (10+ tasks)"]
|
|
RI1["67-001 Risk Metadata"]
|
|
RI2["68-001 Policy Studio"]
|
|
RI3["68-002 Overrides"]
|
|
RI4["69-001 Notifications"]
|
|
RI5["70-001 AirGap Rules"]
|
|
end
|
|
|
|
subgraph VULN_DOCS["VULN EXPLORER DOCS (13 tasks)"]
|
|
VD1["29-001 Overview"]
|
|
VD2["29-002 Console"]
|
|
VD3["29-003 API"]
|
|
VD4["29-004 CLI"]
|
|
VD5["29-005 Ledger"]
|
|
VD6["..."]
|
|
VD7["29-013 Install"]
|
|
end
|
|
|
|
%% Root blocker connections
|
|
RB1 --> S1
|
|
S1 --> S2 --> S3 --> S4
|
|
S1 --> S5 --> S6 --> S7 --> S8
|
|
|
|
RB2 --> RI1 --> RI2 --> RI3 --> RI4 --> RI5
|
|
RB2 --> E1
|
|
|
|
RB3 --> AT1 --> AT2 --> AT3 --> AT4
|
|
RB3 --> AT5 --> AT6
|
|
|
|
RB4 --> V1 --> V2 --> V3 --> V4 --> V5 --> V6 --> V7 --> V8 --> V9 --> V10 --> V11
|
|
|
|
RB5 --> R1 --> R2 --> R3 --> R4 --> R5 --> R6 --> R7 --> R8 --> R9 --> R10
|
|
|
|
RB6 --> AT1
|
|
|
|
RB7 --> VD1 --> VD2 --> VD3 --> VD4 --> VD5 --> VD6 --> VD7
|
|
|
|
RB8 --> A1 --> A2 --> A3
|
|
RB8 --> A7 --> A8 --> A9 --> A10 --> A11
|
|
|
|
RB9 --> A3
|
|
RB9 --> A4 --> A5 --> A6
|
|
|
|
E1 --> E2 --> E3 --> E4 --> E5 --> E6 --> E7 --> E8
|
|
|
|
%% Styling
|
|
classDef rootBlocker fill:#ff6b6b,stroke:#333,stroke-width:2px,color:#fff
|
|
classDef blocked fill:#ffd93d,stroke:#333,stroke-width:1px
|
|
classDef resolved fill:#6bcb77,stroke:#333,stroke-width:1px
|
|
|
|
class RB1,RB2,RB3,RB4,RB5,RB6,RB7,RB8,RB9,RB10 rootBlocker
|
|
```
|
|
|
|
---
|
|
|
|
## Cascade Impact Analysis
|
|
|
|
```
|
|
+---------------------------------------------------------------------------------+
|
|
| ROOT BLOCKER -> DOWNSTREAM IMPACT |
|
|
+---------------------------------------------------------------------------------+
|
|
| |
|
|
| SIGNALS CAS (RB1) -----+---> 24-002 ---> 24-003 ---> 24-004 ---> 24-005 |
|
|
| Impact: 15+ tasks | |
|
|
| +---> GRAPH-28-007 ---> 28-008 ---> 28-009 ---> 28-010 |
|
|
| |
|
|
+---------------------------------------------------------------------------------+
|
|
| |
|
|
| VEX/advisory_key (RB4) ---> 30-001 ---> 30-002 ---> 30-003 ---> 30-004 ---> ...|
|
|
| Impact: 11 tasks +---> 30-011 |
|
|
| |
|
|
+---------------------------------------------------------------------------------+
|
|
| |
|
|
| Risk Contract (RB2) ---+---> 67-001 ---> 68-001 ---> 68-002 ---> 69-001 --> ...|
|
|
| Impact: 10+ tasks | |
|
|
| +---> EXPORT OAS-63-001 ---> OBS-50-001 ---> ... --> ...|
|
|
| |
|
|
+---------------------------------------------------------------------------------+
|
|
| |
|
|
| Policy Studio (RB5) -----> 27-001 ---> 27-002 ---> 27-003 ---> ... ---> 27-010 |
|
|
| Impact: 10 tasks |
|
|
| |
|
|
+---------------------------------------------------------------------------------+
|
|
| |
|
|
| Sealed Mode (RB8) -----+---> CTL-57-001 ---> CTL-57-002 ---> CTL-58-001 |
|
|
| Impact: 17+ tasks | |
|
|
| +---> IMP-57-002 ---> IMP-58-001 ---> IMP-58-002 |
|
|
| | |
|
|
| +---> CLI-56-001 ---> CLI-56-002 ---> CLI-57-001 ---> ...|
|
|
| +---> CLI-58-001 |
|
|
| |
|
|
+---------------------------------------------------------------------------------+
|
|
| |
|
|
| GRAP0101 Vuln (RB7) -----> 29-001 ---> 29-002 ---> 29-003 ---> ... ---> 29-013 |
|
|
| Impact: 13 tasks |
|
|
| |
|
|
+---------------------------------------------------------------------------------+
|
|
| |
|
|
| VerificationPolicy (RB3) +---> 73-001 ---> 73-002 ---> 74-001 ---> 74-002 |
|
|
| Impact: 6 tasks | |
|
|
| +---> CLI-73-001 ---> CLI-73-002 |
|
|
| |
|
|
+---------------------------------------------------------------------------------+
|
|
```
|
|
|
|
---
|
|
|
|
## Critical Path Timeline
|
|
|
|
```
|
|
2025-12-06 2025-12-09 2025-12-11 2025-12-13
|
|
| | | |
|
|
SIGNALS CAS -------------*=====================================================-->
|
|
(15+ tasks) | Checkpoint | | |
|
|
| Platform | | |
|
|
| Storage | | |
|
|
| Approval | | |
|
|
| | |
|
|
RISK CONTRACT ---------------------------*===========================================>
|
|
(10+ tasks) | Due | |
|
|
| | |
|
|
DOCS Md.IX ------------------------------*========*========*========*=============>
|
|
(40+ tasks) | Risk | Console | SDK | ESCALATE
|
|
| API | Assets | Samples|
|
|
| | | |
|
|
VEX LENS --------------------------------*===========================================>
|
|
(11 tasks) | Issuer | |
|
|
| Dir + | |
|
|
| API | |
|
|
| Gov | |
|
|
| |
|
|
ATTESTATION -----------------------------------------*================================>
|
|
(6 tasks) | Verification |
|
|
| Policy Schema |
|
|
|
|
|
AIRGAP --------------------------------------------------*=========================>
|
|
(17+ tasks) | Time-Anchor
|
|
| TUF Trust
|
|
```
|
|
|
|
---
|
|
|
|
## Guild Dependency Matrix
|
|
|
|
Shows which guilds block which others:
|
|
|
|
```
|
|
+-------------------------------------------------------------+
|
|
| BLOCKS (downstream) |
|
|
| Policy | Risk | Attestor| AirGap| Scanner| VEX | Export| Docs |
|
|
+-----------------+--------+-------+---------+-------+--------+------+-------+------+
|
|
| Policy Engine | - | ## | ## | ## | | ## | ## | ## |
|
|
| Risk/Export | ## | - | ## | | | | - | ## |
|
|
| Attestor | ## | | - | | | | ## | ## |
|
|
| Signals | ## | ## | | | ## | | ## | ## |
|
|
| Authority | ## | | ## | ## | | | | |
|
|
| Platform/DB | | | | | | | | ## |
|
|
| VEX Lens | ## | | | | | - | ## | ## |
|
|
| Mirror/Evidence | | | ## | ## | | | - | ## |
|
|
| Console/UI | ## | ## | | | | | | ## |
|
|
| Program Mgmt | | | | ## | | | ## | |
|
|
+-----------------+--------+-------+---------+-------+--------+------+-------+------+
|
|
|
|
Legend: ## = Blocking - = Self (N/A)
|
|
```
|
|
|
|
---
|
|
|
|
## Unblock Priority Order
|
|
|
|
Based on cascade impact, resolve root blockers in this order:
|
|
|
|
| Priority | Root Blocker | Downstream | Guilds Affected | Effort |
|
|
|----------|--------------|------------|-----------------|--------|
|
|
| 1 | SIGNALS CAS (24-002) | 15+ | Signals, Graph, Telemetry, Replay | HIGH |
|
|
| 2 | VEX/advisory_key spec | 11 | VEX, Excititor, Policy, Concelier | MEDIUM |
|
|
| 3 | Risk Contract (66-002) | 10+ | Risk, Export, Policy, Ledger, Attestor | MEDIUM |
|
|
| 4 | Policy Studio API | 10 | Policy, Concelier, Web | MEDIUM |
|
|
| 5 | Sealed Mode Contract | 17+ | AirGap, CLI, Importer, Controller, Time | HIGH |
|
|
| 6 | GRAP0101 Vuln Explorer | 13 | Vuln Explorer, Docs | MEDIUM |
|
|
| 7 | VerificationPolicy Schema | 6 | Attestor, CLI, Policy | LOW |
|
|
| 8 | Authority effective:write | 3+ | Authority, Policy | LOW |
|
|
| 9 | Time-Anchor/TUF Trust | 5 | AirGap, Controller | MEDIUM |
|
|
| 10 | PGMI0101 Staffing | 3 | Program Management | ORG |
|
|
|
|
**Impact Summary:**
|
|
- Resolving top 5 blockers -> Unblocks ~60+ tasks (~150 with cascades)
|
|
- Resolving all 10 blockers -> Unblocks ~85+ tasks (~250 with cascades)
|
|
|
|
---
|
|
|
|
## Root Cause Categories
|
|
|
|
| Category | Tasks Blocked | Percentage |
|
|
|----------|---------------|------------|
|
|
| Missing API/Contract Specifications | 85+ | 39% |
|
|
| Cascading/Domino Dependencies | 70+ | 28% |
|
|
| Schema/Data Freeze Pending | 55+ | 19% |
|
|
| Documentation/Asset Blockers | 40+ | - |
|
|
| Infrastructure/Environment | 25+ | - |
|
|
| Authority/Approval Gates | 30+ | - |
|
|
|
|
---
|
|
|
|
## Guild Blocking Summary
|
|
|
|
| Guild | Tasks Blocked | Critical Deliverable | Due Date |
|
|
|-------|---------------|---------------------|----------|
|
|
| Policy Engine | 12 | `advisory_key` schema, Policy Studio API | 2025-12-09 |
|
|
| Risk/Export | 10 | Risk scoring contract (66-002) | 2025-12-09 |
|
|
| Mirror/Evidence | 8 | Registration contract, time anchors | 2025-12-09 |
|
|
| Attestor | 6 | VerificationPolicy, DSSE signing | OVERDUE |
|
|
| Signals | 6+ | CAS promotion, provenance feed | 2025-12-06 |
|
|
| SDK Generator | 6 | Sample outputs (TS/Python/Go/Java) | 2025-12-11 |
|
|
| Console/UI | 5+ | Widget captures, deterministic hashes | 2025-12-10 |
|
|
| Platform/DB | 3 | RLS + partition design approval | 2025-12-11 |
|
|
| Program Mgmt | 3 | PGMI0101 staffing confirmation | Pending |
|
|
| VEX Lens | 2 | Field list, examples | 2025-12-09 |
|
|
|
|
---
|
|
|
|
## Recent Progress (84+ Tasks Unblocked)
|
|
|
|
Since 2025-12-04:
|
|
|
|
| Specification | Tasks Unblocked |
|
|
|--------------|-----------------|
|
|
| `vex-normalization.schema.json` | 11 |
|
|
| `timeline-event.schema.json` | 10+ |
|
|
| `mirror-bundle.schema.json` | 8 |
|
|
| `VERSION_MATRIX.md` | 7 |
|
|
| `provenance-feed.schema.json` | 6 |
|
|
| `api-baseline.schema.json` | 6 |
|
|
| `ledger-airgap-staleness.schema.json` | 5 |
|
|
| `attestor-transport.schema.json` | 4 |
|
|
| Policy Studio Wave C infrastructure | 10 |
|
|
| WEB-POLICY-20-004 Rate Limiting | 6 |
|
|
|
|
---
|
|
|
|
## Recommendations
|
|
|
|
### Immediate Actions (Unblock 50+ tasks)
|
|
|
|
1. **Escalate Md.IX documentation deadlines** - Risk API, Signals schema, SDK samples due 2025-12-09
|
|
2. **Publish release artifacts** to `deploy/releases/2025.09-stable.yaml` - Orchestrator, Policy, VEX Lens, Findings Ledger
|
|
3. **Complete Advisory Key spec** - Unblocks 6+ Excititor/Policy tasks
|
|
4. **Finalize Risk Scoring Contract (66-002)** - Unblocks Ledger/Export/Policy chain
|
|
|
|
### Strategic (2-4 weeks)
|
|
|
|
1. **Implement Contract-First Governance** - Require all upstream contracts published before dependent sprints start
|
|
2. **Create Cross-Guild Coordination Checkpoints** - Weekly sync of BLOCKED tasks with escalation
|
|
3. **Refactor Long Dependency Chains** - Break chains longer than 5 tasks into parallel workstreams
|