Authority CI/CD Timestamping

This document describes the CI/CD timestamping orchestration added in Sprint SPRINT_20260208_025_Authority_rfc_3161_tsa_client_for_ci_cd_timestamping.

Scope

• Automatically request RFC-3161 timestamps for pipeline artifacts (SBOMs, attestations, logs, or other digest-addressed artifacts).
• Persist deterministic artifact-to-token mappings for replay, lookup, and audit.
• Support pipeline-scoped and environment-scoped timestamp policies without requiring network access in tests.

Runtime status (verified 2026-07-18): this scope is implemented as a bounded Authority library, not as a production-composed workflow. No production host currently calls AddTimestamping, no durable IArtifactTimestampRegistry implementation exists, and no runtime configuration binds PipelineTimestampingPolicyOptions. Release Orchestrator’s optional Evidence Locker seal path is a separate successor contract and does not consume Authority CI/CD timestamp receipts.

Implementation

• Orchestration service:
  • src/Authority/__Libraries/StellaOps.Authority.Timestamping/CiCdTimestampingService.cs
  • src/Authority/__Libraries/StellaOps.Authority.Timestamping/ICiCdTimestampingService.cs
• Artifact timestamp registry:
  • src/Authority/__Libraries/StellaOps.Authority.Timestamping/IArtifactTimestampRegistry.cs
  • src/Authority/__Libraries/StellaOps.Authority.Timestamping/InMemoryArtifactTimestampRegistry.cs
  • The in-memory implementation is a Development/Testing harness only; production must register a durable IArtifactTimestampRegistry.
• Policy models:
  • src/Authority/__Libraries/StellaOps.Authority.Timestamping/PipelineTimestampingPolicyOptions.cs
  • src/Authority/__Libraries/StellaOps.Authority.Timestamping/CiCdTimestampingModels.cs
• DI registration:
  • src/Authority/__Libraries/StellaOps.Authority.Timestamping/TimestampingServiceCollectionExtensions.cs
  • AddTimestamping fails closed for timestamp cache/registry resolution until durable stores are registered.
  • AddTimestampingInMemoryStoresForLocalRuntime("Development"|"Testing") is the explicit harness opt-in.

Policy behavior

• DefaultPolicy applies when no pipeline override exists.
• Pipelines[<pipelineId>] overrides the default policy.
• Pipelines[<pipelineId>].Environments[<environment>] overrides the pipeline policy.
• Core controls:
  • Enabled
  • RequiredSuccessCount
  • MaxAttemptsPerArtifact
  • RequireDistinctProviders
  • IncludeNonce
  • CertificateRequired
  • HashAlgorithm
  • PolicyOid

Determinism and offline posture

• Artifact processing is deterministic: artifacts are sorted by digest and type before orchestration.
• Digest normalization is deterministic (algo:hex-lowercase).
• Nonce generation is deterministic when IncludeNonce=true (derived from pipeline/artifact identity and attempt index).
• Tests use in-memory fakes only and run without network access.
• Runtime in-memory stores are explicit local/test fixtures; production-like DI must fail closed instead of persisting timestamp receipts in process memory.

Verification and health boundary

• TimeStampTokenVerifier validates the CMS signature before applying caller-supplied trust roots, intermediates, revocation mode, and verification time through X509Chain; private/offline roots therefore do not depend on the operating-system trust store.
• SHA-1 message imprints fail with WeakHashAlgorithm unless AllowWeakHashAlgorithms=true is explicitly selected.
• The signer-certificate expiry warning is emitted while verifying an actual token. TsaProviderRegistry.CheckHealthAsync only performs a HEAD reachability probe and does not inspect the provider certificate or enforce an expiry-warning threshold.

Test coverage

• src/Authority/__Tests/StellaOps.Authority.Timestamping.Tests/CiCdTimestampingServiceTests.cs
• src/Authority/__Tests/StellaOps.Authority.Timestamping.Tests/InMemoryArtifactTimestampRegistryTests.cs
• src/Authority/__Tests/StellaOps.Authority.Timestamping.Tests/TimestampingRuntimeBindingTests.cs

Validation command used:

• pwsh ./tools/scripts/test-targeted-xunit.ps1 -Project src/Authority/__Tests/StellaOps.Authority.Timestamping.Tests/StellaOps.Authority.Timestamping.Tests.csproj -Class <exact-test-classes>