fcb5ffe25d
- Fix namespace conflicts (Subgraph → PoESubgraph) - Add hash sanitization for Windows filesystem (colon → underscore) - Update all test mocks to use It.IsAny<>() - Add direct orchestrator unit tests - All 8 PoE tests now passing (100% success rate) - Complete SPRINT_3500_0001_0001 documentation Fixes compilation errors and Windows filesystem compatibility issues. Tests: 8/8 passing Files: 8 modified, 1 new test, 1 completion report 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
37 lines
1.6 KiB
Markdown
37 lines
1.6 KiB
Markdown
# Architecture workflows
|
|
|
|
## Advisory and VEX ingestion (AOC)
|
|
1) Concelier and Excititor fetch upstream documents.
|
|
2) AOC guards validate provenance and append-only rules.
|
|
3) Raw facts are stored in PostgreSQL without derived severity.
|
|
4) Deterministic exports are produced for downstream policy evaluation.
|
|
|
|
## Scan and report
|
|
1) CLI or API submits an image digest or SBOM.
|
|
2) Scanner Worker analyzes layers and produces SBOM fragments.
|
|
3) Scanner Web composes inventory and usage SBOMs and runs diffs.
|
|
4) Policy Engine evaluates findings against advisories and VEX evidence.
|
|
5) Signer produces DSSE bundles; Attestor logs to Rekor when enabled.
|
|
|
|
## Reachability and unknowns
|
|
1) Scanner produces static call graphs.
|
|
2) Zastava produces runtime facts when enabled.
|
|
3) Signals computes reachability scores and unknowns pressure.
|
|
4) Policy Engine incorporates reachability evidence into VEX decisions.
|
|
|
|
## Scheduler re-evaluation
|
|
1) Concelier and Excititor emit delta events.
|
|
2) Scheduler identifies impacted images using BOM index metadata.
|
|
3) Scanner Web runs analysis-only reports against existing SBOMs.
|
|
4) Notify emits delta notifications to operators.
|
|
|
|
## Notifications
|
|
1) Scanner and Scheduler publish events to Valkey streams.
|
|
2) Notify Web applies routing rules and templates.
|
|
3) Notify Worker delivers to Slack, Teams, email, or webhooks.
|
|
|
|
## Export and offline bundles
|
|
1) Export Center creates deterministic export bundles (JSON, Trivy DB, mirror layouts).
|
|
2) Offline kits package feeds, images, analyzers, and manifests for air-gapped sites.
|
|
3) CLI verifies signatures and imports bundles atomically.
|