DORA Info Sharing Event Contract v1

Version: dora-info-sharing-event-v1
Owner: Notify platform
Implementation: src/Notify/__Libraries/StellaOps.Notify.Connectors.DoraInfoSharing/
CLI: src/Cli/StellaOps.Cli/Commands/DoraInfoSharingCommandGroup.cs
Decision: docs/europe/decisions-log.md (DORA-Q5)

Part of the Stella Ops Contracts index. Audience: implementers and reviewers working on the Notify DORA info-sharing connector, its CLI, and downstream TAXII subscriber delivery.

Purpose

This contract defines Stella Ops’ DORA Article 45 outbound information-sharing batch. The canonical v1 format is a STIX 2.1-aligned JSON bundle delivered via a TAXII 2.1 collection manifest. MISP interoperability is future bridge work, not the v1 canonical path.

Export Center Assurance Profile

ExportCenter advertises the dora.info-sharing assurance profile for discovery and readiness. Signed export readiness remains fail-closed on dora-info-sharing-source-missing, dora-info-sharing-subscriber-approval-missing, dora-info-sharing-channel-disabled, and dora-info-sharing-schema-mapping-missing until the request supplies the source events, subscriber approval, channel enablement, and schema mapping required by the Notify DORA information-sharing connector.

POST /v1/exports/assurance/profiles/dora.info-sharing/runs is registered on the shared Assurance produce surface. While readiness is blocked, it returns HTTP 409 assurance_export_readiness_blocked. A readiness-satisfying request supplies { "doraInfoSharing": { "request": { ... }, "subscriberApprovalRef": "..." } }, where request is a JSON-friendly AssuranceProduceDoraInfoSharingExportRequest carrying tenant, collection, generated timestamp, channel, redaction profile, source events, and optional subscriber id. ExportCenter maps that DTO into the real Notify DoraInfoSharingExportRequest, invokes the Notify STIX/TAXII and DSSE services, and stores a deterministic wrapper bundle with media type application/vnd.stellaops.dora-info-sharing.http-bundle.v1+json. Signing material is sealed operator configuration under Export:Assurance:DoraInfoSharing (SigningKeyFile / SigningKey and SigningKeyId) and is never accepted from the request body.

Schema Pinning

All pinned values are declared as compile-time constants in DoraInfoSharingConstants and must not drift between the library, CLI, and this contract.

Batch Shape

The exported payload is canonical JSON. The bundle is serialised with CanonJson.Canonicalize (RFC 8785-style JCS canonical JSON); the x_stella_* extension properties below are emitted verbatim by DoraInfoSharingStixBatchBuilder.

{
  "type": "bundle",
  "id": "bundle--<deterministic-uuid>",
  "objects": [
    {
      "type": "indicator|incident|threat-actor",
      "spec_version": "2.1",
      "id": "<type>--<deterministic-uuid>",
      "created": "2026-04-30T08:00:00.000Z",
      "modified": "2026-04-30T08:30:00.000Z",
      "name": "string",
      "x_stella_authorised_pii": { "contact_email": "ops@example.test" },
      "x_stella_minimisation": {
        "profile_id": "dora-info-sharing-strict-v1",
        "mode": "strict|explicit-authorisation",
        "redacted_fields": ["description", "pii.contact_email"],
        "authorised_pii_fields": ["contact_email"],
        "authorisation_ref_hash": "sha256:<hex>"
      }
    }
  ],
  "x_stella_dora_info_sharing": {
    "contract_version": "dora-info-sharing-event-v1",
    "stix_spec_version": "2.1",
    "taxii_version": "2.1",
    "collection_id": "string",
    "generated_at": "2026-04-30T09:00:00.000Z",
    "tenant_id_hash": "sha256:<hex>",
    "channel_id": "string",
    "channel_purpose": "dora-info-sharing",
    "object_count": 1,
    "source_event_refs": ["sha256:<hex>"],
    "subscriber_id_hash": "sha256:<hex>",
    "redaction_profile": {
      "profile_id": "dora-info-sharing-strict-v1",
      "mode": "strict"
    }
  }
}

Field notes (grounded in DoraInfoSharingStixBatchBuilder):

Supported Object Kinds

The object kind enum (DoraInfoSharingObjectKind) has exactly three members: Indicator, Incident, ThreatActor.

Common optional STIX fields emitted on any kind when present on the source event: description (subject to redaction), labels, confidence (0–100), and external_references (each with source_name plus external_id and/or url).

Data Minimisation

Every export requires a DoraInfoSharingRedactionProfile.

Signing

The canonical STIX bundle bytes are wrapped in a DSSE envelope. The signing input is the shared DSSE pre-authentication encoding over the pinned payload type and the canonical payload bytes. Offline verification must:

  1. Decode the DSSE payload.
  2. Recompute the DSSE pre-authentication encoding.
  3. Verify at least one signature against the configured local trust material.
  4. Recompute the payload SHA-256 and compare it to the delivery ledger entry.

TAXII Manifest

The connector also emits a deterministic TAXII collection manifest:

{
  "type": "taxii-collection-manifest",
  "taxii_version": "2.1",
  "collection_id": "collection-tenant-a-dora",
  "title": "DORA Article 45 outbound stream for collection-tenant-a-dora",
  "can_read": true,
  "can_write": false,
  "media_types": ["application/stix+json;version=2.1"],
  "latest_batch": {
    "bundle_id": "bundle--<deterministic-uuid>",
    "payload_sha256": "sha256:<hex>",
    "object_count": 3,
    "added_after": "2026-04-30T09:00:00.000Z"
  },
  "x_stella_delivery": {
    "purpose": "dora-info-sharing",
    "channel_id": "string",
    "channel_type": "Custom",
    "endpoint": "https://subscriber.example/taxii2/collections/.../objects/",
    "tenant_id_hash": "sha256:<hex>",
    "subscriber_id_hash": "sha256:<hex>"
  }
}

title and the x_stella_delivery extension block are emitted by DoraTaxiiCollectionManifestBuilder. x_stella_delivery.endpoint resolves from the channel config (Endpoint falling back to Target), channel_type is the NotifyChannelType name, and subscriber_id_hash is present only when the export request carries a subscriberId. The TAXII verify path (CLI and library) asserts x_stella_delivery.purpose == "dora-info-sharing".

The v1 library builds the manifest and signed batch. CLI export, verify, and feed-setup commands are implemented (see CLI section below). Live server-side TAXII collection hosting (an inbound TAXII 2.1 HTTP server) is not part of v1; outbound subscriber push delivery is implemented by DoraInfoSharingSubscriberDeliveryService.

Subscriber Delivery (Outbound TAXII Push)

DoraInfoSharingSubscriberDeliveryService performs the live outbound push to a peer/authority TAXII subscriber. It exports the signed batch, re-verifies the DSSE envelope before transmission, and only then POSTs the delivery body.

CLI

The connector is driven offline through three stella commands (DoraInfoSharingCommandGroup). All signing uses a local HMAC-SHA256 key supplied via --signing-key-file or the STELLAOPS_DORA_INFO_SHARING_HMAC_KEY environment variable.

Deterministic Fixture Location

Adjacent deterministic coverage lives in:

src/Notify/__Tests/StellaOps.Notify.Connectors.DoraInfoSharing.Tests/

The tests assert redaction, canonical payload stability, TAXII manifest output, and DSSE offline verification using frozen inputs.

Replay And Offline Expectations