stella-ops.org/git.stella-ops.org
1
0
Fork 0
Code Issues Pull Requests Actions 1 Releases Wiki Activity
Files
ff0eca3a51f9612335c51d0653397060f79e0f53
git.stella-ops.org/src/AdvisoryAI/StellaOps.AdvisoryAI/TASKS.md
master ff0eca3a51 feat: Implement policy attestation features and service account delegation 
- Added new policy scopes: `policy:publish` and `policy:promote` with interactive-only enforcement.
- Introduced metadata parameters for policy actions: `policy_reason`, `policy_ticket`, and `policy_digest`.
- Enhanced token validation to require fresh authentication for policy attestation tokens.
- Updated grant handlers to enforce policy scope checks and log audit information.
- Implemented service account delegation configuration, including quotas and validation.
- Seeded service accounts during application initialization based on configuration.
- Updated documentation and tasks to reflect new features and changes.
2025-11-03 01:13:21 +02:00

3.5 KiB
Raw Blame History

Advisory AI Task Board — Epic 8

ID Status Owner(s) Depends on Description Exit Criteria
AIAI-31-001 DONE (2025-11-02) Advisory AI Guild CONCELIER-VULN-29-001, EXCITITOR-VULN-29-001 Implement structured and vector retrievers for advisories/VEX with paragraph anchors and citation metadata. Retrievers return deterministic chunks with source IDs/sections; unit tests cover CSAF/OSV/vendor formats.
AIAI-31-002 DOING Advisory AI Guild, SBOM Service Guild SBOM-VULN-29-001 Build SBOM context retriever (purl version timelines, dependency paths, env flags, blast radius estimator). Retriever returns paths/metrics under SLA; tests cover ecosystems.
AIAI-31-003 TODO Advisory AI Guild AIAI-31-001..002 Implement deterministic toolset (version comparators, range checks, dependency analysis, policy lookup) exposed via orchestrator. Tools validated with property tests; outputs cached; docs updated.
AIAI-31-004 TODO Advisory AI Guild AIAI-31-001..003, AUTH-VULN-29-001 Build orchestration pipeline for Summary/Conflict/Remediation tasks (prompt templates, tool calls, token budgets, caching). Pipeline executes tasks deterministically; caches keyed by tuple+policy; integration tests cover tasks.
AIAI-31-005 TODO Advisory AI Guild, Security Guild AIAI-31-004 Implement guardrails (redaction, injection defense, output validation, citation enforcement) and fail-safe handling. Guardrails block adversarial inputs; output validator enforces schemas; security tests pass.
AIAI-31-006 TODO Advisory AI Guild AIAI-31-004..005 Expose REST API endpoints (/advisory/ai/*) with RBAC, rate limits, OpenAPI schemas, and batching support. Endpoints deployed with schema validation; rate limits enforced; integration tests cover error codes.
AIAI-31-007 TODO Advisory AI Guild, Observability Guild AIAI-31-004..006 Instrument metrics (advisory_ai_latency, guardrail_blocks, validation_failures, citation_coverage), logs, and traces; publish dashboards/alerts. Telemetry live; dashboards approved; alerts configured.
AIAI-31-008 TODO Advisory AI Guild, DevOps Guild AIAI-31-006..007 Package inference on-prem container, remote inference toggle, Helm/Compose manifests, scaling guidance, offline kit instructions. Deployment docs merged; smoke deploy executed; offline kit updated; feature flags documented.
AIAI-31-010 DONE (2025-11-02) Advisory AI Guild CONCELIER-VULN-29-001, EXCITITOR-VULN-29-001 Implement Concelier advisory raw document provider mapping CSAF/OSV payloads into structured chunks for retrieval. Provider resolves content format, preserves metadata, and passes unit tests covering CSAF/OSV cases.
AIAI-31-011 DONE (2025-11-02) Advisory AI Guild EXCITITOR-LNM-21-201, EXCITITOR-CORE-AOC-19-002 Implement Excititor VEX document provider to surface structured VEX statements for vector retrieval. Provider returns conflict-aware VEX chunks with deterministic metadata and tests for representative statements.
AIAI-31-009 TODO Advisory AI Guild, QA Guild AIAI-31-001..006 Develop unit/golden/property/perf tests, injection harness, and regression suite; ensure determinism with seeded caches. Test suite green; golden outputs stored; injection tests pass; perf targets documented.

2025-11-02: AIAI-31-002 – SBOM context domain models finalized with limiter guards; retriever tests now cover flag toggles and path dedupe. Service client integration still pending with SBOM guild.