Skip to content

Commit 7e3b615

Browse files
committed
Add commercial evidence filesystem publication attachments
1 parent e0b25cd commit 7e3b615

7 files changed

Lines changed: 134 additions & 4 deletions

File tree

README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -75,7 +75,7 @@ The first production milestone is M3UA over a transport abstraction. SCCP, TCAP,
7575
| Commercial evidence execution orchestration | Phase 37 foundation-complete: evidence execution run identity, stage catalog, operator command plan, execution environment contract, artifact collection manifest, digest/redaction verification, blocker classification, retry/resume policy, status reporting, and final validation are available; real retained execution artifacts are still required before commercial publication |
7676
| Commercial evidence artifact intake | Phase 38 foundation-complete: artifact intake target identity, artifact source registration, SHA-256 digest coverage, redaction review, completeness evaluation, dossier reporting, promotion handoff, execution-to-dossier bridge, status reporting, and final validation are available, binding a stable intake id, reviewer identity, UTC receipt time, run-scoped dossier root, concrete source paths, unique retained dossier paths, retained digests, trace-bearing artifact approvals, explicit intake blockers, retained Markdown summary, digest-covered handoff, end-to-end intake assembly, and intake readiness status to a governed execution run; real artifact files are still required before commercial publication |
7777
| Commercial evidence file verification | Phase 39 foundation-complete: retained file evidence item verification, retained file manifest coverage, file verification blocker reporting, retention ledger modeling, integrity sealing, publication attachment planning, verified promotion gating, command planning, status reporting, final validation, and documentation alignment are available, checking file existence, non-empty size, SHA-256 validity, digest match, UTC observation time, unique retained paths, promotion-required handoff coverage, explicit verification blockers, reviewer identity, immutable retention, UTC retention windows, minimum duration, deterministic aggregate ledger digests, sealed ledger attachment coverage, trace-bearing redaction approval, commercial readiness report presence, explicit promotion approval, workflow-ready verification command order, and readiness status separation; real retained file evidence remains required before commercial publication |
78-
| Commercial evidence filesystem execution | Phase 40 in progress: filesystem observation, manifest execution, verification report execution, artifact writing, ledger execution, and seal execution are available, reading retained files from disk, computing real SHA-256 digests, reporting file existence and size, supporting retained-path-to-local-path overrides, building retained file manifests from real observations, exposing blocker-aware retained file reports from filesystem evidence, writing retained Markdown/TSV verification artifacts, creating retention ledgers from filesystem-backed reports, and sealing those ledgers with deterministic aggregate SHA-256 digests; attachment execution, promotion execution, command materialization, status reporting, and final validation remain |
78+
| Commercial evidence filesystem execution | Phase 40 in progress: filesystem observation, manifest execution, verification report execution, artifact writing, ledger execution, seal execution, and publication attachment execution are available, reading retained files from disk, computing real SHA-256 digests, reporting file existence and size, supporting retained-path-to-local-path overrides, building retained file manifests from real observations, exposing blocker-aware retained file reports from filesystem evidence, writing retained Markdown/TSV verification artifacts, creating retention ledgers from filesystem-backed reports, sealing those ledgers with deterministic aggregate SHA-256 digests, and creating release dossier attachments with redaction approval gates; promotion execution, command materialization, status reporting, and final validation remain |
7979

8080
## Requirements
8181

docs/PHASE40_COMMERCIAL_EVIDENCE_FILESYSTEM_EXECUTION.md

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -73,6 +73,18 @@ This unit connects real file verification output to the commercial evidence rete
7373

7474
This unit gives filesystem-backed evidence the same integrity seal contract used by the retained commercial evidence dossier.
7575

76+
## Unit 7 - Publication Attachment Execution
77+
78+
`SigtranCommercialEvidenceFileSystemPublicationAttachments` creates release dossier attachments from the filesystem-backed integrity seal:
79+
80+
- Requires the filesystem-backed integrity seal execution to be ready.
81+
- Creates publication attachments from sealed ledger entries.
82+
- Confirms attachments reference the current seal id and aggregate digest.
83+
- Requires trace-bearing artifacts to carry redaction approval.
84+
- Keeps publication attachment execution blocked when redaction approval is absent.
85+
86+
This unit connects sealed filesystem evidence to release dossier attachment planning without bypassing trace protection.
87+
7688
## Validation
7789

7890
Each unit in this phase is validated with:

docs/PHASE40_SUMMARY.md

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,8 @@ Phase 40 prepares the SDK to run commercial evidence file verification against r
1010
- Verification artifact writer that retains a Markdown verification report and tab-separated observation manifest on disk.
1111
- Retention ledger execution that creates ledger entries from filesystem-backed verification reports and written artifacts.
1212
- Integrity seal execution that signs the filesystem-backed ledger with a deterministic aggregate SHA-256 seal.
13+
- Publication attachment execution that creates release dossier attachments from the filesystem-backed seal and requires redaction approval for trace-bearing artifacts.
1314

1415
## Readiness Position
1516

16-
The phase is in progress. Filesystem observation, manifest execution, report execution, artifact writing, ledger execution, and seal execution are available. Attachment execution, promotion execution, command materialization, status reporting, and final validation remain.
17+
The phase is in progress. Filesystem observation, manifest execution, report execution, artifact writing, ledger execution, seal execution, and publication attachment execution are available. Promotion execution, command materialization, status reporting, and final validation remain.

docs/PHASE_INDEX.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -44,7 +44,7 @@ This index is the complete phase map for Sigtran.NET. It links each phase to the
4444
| 37 | Commercial evidence execution orchestration | [Phase 37 Commercial Evidence Execution Orchestration](PHASE37_COMMERCIAL_EVIDENCE_EXECUTION_ORCHESTRATION.md), [Phase 37 Summary](PHASE37_SUMMARY.md) | Foundation complete; real execution artifacts still required |
4545
| 38 | Commercial evidence artifact intake | [Phase 38 Commercial Evidence Artifact Intake](PHASE38_COMMERCIAL_EVIDENCE_ARTIFACT_INTAKE.md), [Phase 38 Summary](PHASE38_SUMMARY.md) | Foundation complete; real artifact files still required |
4646
| 39 | Commercial evidence file verification | [Phase 39 Commercial Evidence File Verification](PHASE39_COMMERCIAL_EVIDENCE_FILE_VERIFICATION.md), [Phase 39 Summary](PHASE39_SUMMARY.md) | Foundation complete; real retained file evidence required |
47-
| 40 | Commercial evidence filesystem execution | [Phase 40 Commercial Evidence Filesystem Execution](PHASE40_COMMERCIAL_EVIDENCE_FILESYSTEM_EXECUTION.md), [Phase 40 Summary](PHASE40_SUMMARY.md) | In progress; filesystem seal execution complete |
47+
| 40 | Commercial evidence filesystem execution | [Phase 40 Commercial Evidence Filesystem Execution](PHASE40_COMMERCIAL_EVIDENCE_FILESYSTEM_EXECUTION.md), [Phase 40 Summary](PHASE40_SUMMARY.md) | In progress; filesystem publication attachment execution complete |
4848

4949
## Current Commercial Gate
5050

docs/SDK_ROADMAP.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -355,7 +355,7 @@ Status: Phase 39 is foundation-complete. Retained file evidence item verificatio
355355
- Build verification manifests, reports, retained artifacts, ledger, seal, attachments, promotion gate, and command materialization from observed files.
356356
- Keep filesystem execution separate from commercial publication: helpers can verify real files, but publication remains blocked until retained evidence comes from an approved commercial run.
357357

358-
Status: Phase 40 is in progress. Filesystem observation now reads retained files from disk, computes real SHA-256 digests, records file existence and size, and maps observations into the retained file verification model. Filesystem manifest execution now observes every promotion handoff item, supports retained-path-to-local-path overrides, and builds retained file manifests from real observations. Filesystem verification report execution now evaluates those manifests and exposes retained file blockers from real files. Verification artifact writing now retains a Markdown report and tab-separated observation manifest on disk. Retention ledger execution now creates ledger entries from filesystem-backed verification reports and written artifacts. Integrity seal execution now seals filesystem-backed ledgers with deterministic aggregate SHA-256 digests. Attachment execution, promotion execution, command materialization, status reporting, and final validation remain in progress.
358+
Status: Phase 40 is in progress. Filesystem observation now reads retained files from disk, computes real SHA-256 digests, records file existence and size, and maps observations into the retained file verification model. Filesystem manifest execution now observes every promotion handoff item, supports retained-path-to-local-path overrides, and builds retained file manifests from real observations. Filesystem verification report execution now evaluates those manifests and exposes retained file blockers from real files. Verification artifact writing now retains a Markdown report and tab-separated observation manifest on disk. Retention ledger execution now creates ledger entries from filesystem-backed verification reports and written artifacts. Integrity seal execution now seals filesystem-backed ledgers with deterministic aggregate SHA-256 digests. Publication attachment execution now creates release dossier attachments from the filesystem-backed seal and requires approved redaction state for trace-bearing artifacts. Promotion execution, command materialization, status reporting, and final validation remain in progress.
359359

360360
## Recommended First Deliverable
361361

src/Sigtran.NET.Tests/Program.cs

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -311,6 +311,7 @@
311311
Run("SIGTRAN commercial evidence filesystem artifact writer retains reports", SigtranCommercialEvidenceFileSystemArtifactWriterRetainsReports);
312312
Run("SIGTRAN commercial evidence filesystem retention ledger covers verified files", SigtranCommercialEvidenceFileSystemRetentionLedgerCoversVerifiedFiles);
313313
Run("SIGTRAN commercial evidence filesystem integrity seal matches ledger", SigtranCommercialEvidenceFileSystemIntegritySealMatchesLedger);
314+
Run("SIGTRAN commercial evidence filesystem publication attachments protect trace evidence", SigtranCommercialEvidenceFileSystemPublicationAttachmentsProtectTraceEvidence);
314315
Run("SIGTRAN status capabilities use domain documentation labels", SigtranStatusCapabilitiesUseDomainDocumentationLabels);
315316
Run("Native SCTP platform probe reports socket creation capability", NativeSctpPlatformProbeReportsSocketCreationCapability);
316317
Run("Native SCTP socket factory creates or reports unsupported platform", NativeSctpSocketFactoryCreatesOrReportsUnsupportedPlatform);
@@ -5353,6 +5354,42 @@ static void SigtranCommercialEvidenceFileSystemIntegritySealMatchesLedger()
53535354
}
53545355
}
53555356

5357+
static void SigtranCommercialEvidenceFileSystemPublicationAttachmentsProtectTraceEvidence()
5358+
{
5359+
string tempRoot = Path.Combine(Path.GetTempPath(), "sigtran-commercial-evidence-" + Guid.NewGuid().ToString("N"));
5360+
Directory.CreateDirectory(tempRoot);
5361+
5362+
try
5363+
{
5364+
SigtranCommercialEvidenceFileSystemIntegritySealExecution sealExecution = CreateReadyCommercialEvidenceFileSystemIntegritySealExecution(tempRoot);
5365+
5366+
SigtranCommercialEvidenceFileSystemPublicationAttachmentExecution execution = SigtranCommercialEvidenceFileSystemPublicationAttachments.Create(sealExecution);
5367+
SigtranCommercialEvidenceFileSystemPublicationAttachmentExecution blocked = SigtranCommercialEvidenceFileSystemPublicationAttachments.Create(
5368+
sealExecution,
5369+
publishable: true,
5370+
redactionApproved: false);
5371+
5372+
Assert(execution.IsReady, execution.Describe());
5373+
Assert(execution.SealReady, "filesystem publication attachments should require a ready seal");
5374+
Assert(execution.UsesCurrentIntegritySeal, "filesystem publication attachments should use the current seal");
5375+
Assert(execution.CoversSealedLedgerEntries, "filesystem publication attachments should cover sealed ledger entries");
5376+
Assert(execution.ProtectsTraceBearingArtifacts, "filesystem publication attachments should protect trace-bearing evidence");
5377+
Assert(!blocked.IsReady, "missing redaction approval should block filesystem publication attachments");
5378+
Assert(!blocked.ProtectsTraceBearingArtifacts, "blocked filesystem publication attachments should expose trace protection failure");
5379+
}
5380+
finally
5381+
{
5382+
DeleteTempEvidenceRoot(tempRoot);
5383+
}
5384+
}
5385+
5386+
static SigtranCommercialEvidenceFileSystemIntegritySealExecution CreateReadyCommercialEvidenceFileSystemIntegritySealExecution(string tempRoot)
5387+
{
5388+
return SigtranCommercialEvidenceFileSystemIntegritySeals.Create(
5389+
CreateReadyCommercialEvidenceFileSystemRetentionLedgerExecution(tempRoot),
5390+
DateTimeOffset.UtcNow);
5391+
}
5392+
53565393
static SigtranCommercialEvidenceFileSystemRetentionLedgerExecution CreateReadyCommercialEvidenceFileSystemRetentionLedgerExecution(string tempRoot)
53575394
{
53585395
return SigtranCommercialEvidenceFileSystemRetentionLedgers.Create(
Lines changed: 80 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,80 @@
1+
namespace Sigtran.NET.Core.Utilities;
2+
3+
/// <summary>
4+
/// Describes filesystem-backed commercial evidence publication attachment execution.
5+
/// </summary>
6+
public sealed class SigtranCommercialEvidenceFileSystemPublicationAttachmentExecution
7+
{
8+
/// <summary>Creates filesystem-backed publication attachment execution.</summary>
9+
/// <param name="sealExecution">The filesystem-backed integrity seal execution.</param>
10+
/// <param name="attachmentManifest">The publication attachment manifest created from the seal.</param>
11+
public SigtranCommercialEvidenceFileSystemPublicationAttachmentExecution(
12+
SigtranCommercialEvidenceFileSystemIntegritySealExecution sealExecution,
13+
SigtranCommercialEvidencePublicationAttachmentManifest attachmentManifest)
14+
{
15+
SealExecution = sealExecution ?? throw new ArgumentNullException(nameof(sealExecution));
16+
AttachmentManifest = attachmentManifest ?? throw new ArgumentNullException(nameof(attachmentManifest));
17+
}
18+
19+
/// <summary>The filesystem-backed integrity seal execution.</summary>
20+
public SigtranCommercialEvidenceFileSystemIntegritySealExecution SealExecution { get; }
21+
22+
/// <summary>The publication attachment manifest created from the seal.</summary>
23+
public SigtranCommercialEvidencePublicationAttachmentManifest AttachmentManifest { get; }
24+
25+
/// <summary>Whether the source integrity seal execution is ready.</summary>
26+
public bool SealReady => SealExecution.IsReady;
27+
28+
/// <summary>Whether the attachment manifest references the current filesystem-backed seal.</summary>
29+
public bool UsesCurrentIntegritySeal => string.Equals(AttachmentManifest.Seal.SealId, SealExecution.Seal.SealId, StringComparison.Ordinal)
30+
&& string.Equals(AttachmentManifest.Seal.AggregateSha256, SealExecution.Seal.AggregateSha256, StringComparison.OrdinalIgnoreCase);
31+
32+
/// <summary>Whether attachments cover every sealed ledger entry.</summary>
33+
public bool CoversSealedLedgerEntries => AttachmentManifest.CoversSealedLedgerEntries;
34+
35+
/// <summary>Whether trace-bearing attachments have approved redaction state.</summary>
36+
public bool ProtectsTraceBearingArtifacts => AttachmentManifest.ProtectsTraceBearingArtifacts;
37+
38+
/// <summary>Whether all attachments are safe for publication.</summary>
39+
public bool AllAttachmentsSafeForPublication => AttachmentManifest.AllAttachmentsSafeForPublication;
40+
41+
/// <summary>Whether filesystem-backed publication attachment execution is ready for promotion evaluation.</summary>
42+
public bool IsReady => SealReady
43+
&& UsesCurrentIntegritySeal
44+
&& AttachmentManifest.IsReady
45+
&& CoversSealedLedgerEntries
46+
&& ProtectsTraceBearingArtifacts
47+
&& AllAttachmentsSafeForPublication;
48+
49+
/// <summary>Formats a compact filesystem publication attachment execution summary.</summary>
50+
/// <returns>The filesystem publication attachment execution summary.</returns>
51+
public string Describe()
52+
{
53+
return $"commercialEvidenceFileSystemPublicationAttachmentsReady={IsReady} attachments={AttachmentManifest.Attachments.Count}";
54+
}
55+
}
56+
57+
/// <summary>
58+
/// Provides filesystem-backed commercial evidence publication attachment helpers.
59+
/// </summary>
60+
public static class SigtranCommercialEvidenceFileSystemPublicationAttachments
61+
{
62+
/// <summary>Creates publication attachments from a filesystem-backed integrity seal execution.</summary>
63+
/// <param name="sealExecution">The filesystem-backed integrity seal execution.</param>
64+
/// <param name="publishable">Whether attachments can be included in a release dossier.</param>
65+
/// <param name="redactionApproved">Whether trace-bearing attachment redaction is approved.</param>
66+
/// <returns>The filesystem-backed publication attachment execution.</returns>
67+
public static SigtranCommercialEvidenceFileSystemPublicationAttachmentExecution Create(
68+
SigtranCommercialEvidenceFileSystemIntegritySealExecution sealExecution,
69+
bool publishable = true,
70+
bool redactionApproved = true)
71+
{
72+
ArgumentNullException.ThrowIfNull(sealExecution);
73+
SigtranCommercialEvidencePublicationAttachmentManifest manifest = SigtranCommercialEvidencePublicationAttachments.CreateDefault(
74+
sealExecution.Seal,
75+
publishable,
76+
redactionApproved);
77+
78+
return new(sealExecution, manifest);
79+
}
80+
}

0 commit comments

Comments
 (0)