ENISA CRA Channel

Owner: Notify platform Contract: docs/contracts/enisa-incident-reporting-v1.md Decision: docs/europe/decisions-log.md DORA-Q1 and CRA-Q4 Operator runbook: docs/operations/cra-reporting-runbook.md

Scope

The ENISA CRA channel prepares CRA Article 14 incident and actively exploited vulnerability reports for ENISA SRP handoff. It is configured as a Notify Custom channel with purpose enisa-cra.

The default operator workflow is produce, sign, and drop on an operator-owned filesystem location. The connector does not submit to ENISA by default and does not fetch ENISA schemas or portal metadata at runtime.

This guide describes the channel mechanics only. The operator reporting workflow for roles, 24h / 72h / 14d cadence, Evidence Locker incident mode, approvals, fresh-auth, override, break-glass, retention, and blockers is docs/operations/cra-reporting-runbook.md.

The absent official ENISA SRP schema is documented as a future asset-intake trigger, not a standing test blocker. Tests must not wait on, fabricate, or fetch an upstream schema; they may only assert the default blocked posture, local envelope validation, and offline operator-supplied schema-source mechanics.

Operator Flow

  1. Create a Notify channel with purpose: "enisa-cra".
  2. Configure target or properties.dropDirectory to an operator handoff directory.
  3. Generate the CRA report from the shared timeline event.
  4. Sign through the SignerPipeline adapter.
  5. Drop the envelope, DSSE envelope, manifest, Notify delivery-ledger event, and audit event on the operator filesystem.
  6. Verify the DSSE envelope and local envelope hash offline before any external submission.

Channel Configuration

Default filesystem handoff:

{
  "name": "enisa-cra",
  "type": "Custom",
  "purpose": "enisa-cra",
  "target": "/var/lib/stellaops/handoff/enisa",
  "secretRef": "authority://secrets/notify/enisa"
}

Auto-submit planning is opt-in only:

{
  "name": "enisa-cra",
  "type": "Custom",
  "purpose": "enisa-cra",
  "endpoint": "https://tenant-configured-srp.example/report",
  "secretRef": "authority://secrets/notify/enisa",
  "properties": {
    "notify.channel.enisa.autoSubmit": "true",
    "notify.channel.enisa.srpEndpoint": "https://tenant-configured-srp.example/report",
    "notify.channel.enisa.tenantApproverRef": "approval://tenant-a/enisa/incident-cra-001",
    "notify.channel.enisa.freshAuthRef": "authn://tenant-a/session/fresh-001"
  }
}

If autoSubmit is true and any of srpEndpoint, tenantApproverRef, or freshAuthRef is missing, the connector fails closed. With all fields present, the connector performs a signed HTTP POST through EnisaSrpHttpTransport after the crypto trust material resolves through the provider registry. The fresh-auth reference is expected to represent an interactive authentication within the platform’s 5-minute freshness window, and incident actions should be audited with obs:incident scope where elevated incident access is used. Any pre-transmit gate failure, HTTP non-2xx response, or transport exception falls back to the operator filesystem drop and records the reason in the delivery ledger. A successful local stand-in receiver test is proof of transport behavior only; it is not proof of regulator receipt.

Official SRP Schema Status

Official ENISA SRP schema validation remains blocked in the default build. The repo contains the Stella-owned local envelope contract, but no official ENISA SRP JSON Schema, XSD, or OpenAPI package is vendored under docs/contracts/schemas/eu/, devops/, docs/samples/, or src/Notify/.

The connector has an offline operator-supplied JSON Schema hook (FileEnisaSrpSchemaSource): the operator provides a local path plus sha256:<64 lowercase hex> pin, the connector verifies the bytes, disables remote $ref fetching, evaluates the produced envelope with the repo-approved JsonSchema.Net validator, and emits validated only when the local schema accepts the envelope. Missing assets stay blocked; unreadable, unpinned, hash-mismatched, malformed, or rejecting assets fail closed as failed. This hook proves mechanics for a future reviewed asset; fixture schemas used in tests are not ENISA conformance evidence. Absent official-schema publication is not an active sprint or test blocker; when an approved schema package exists, open a new asset-intake sprint for license review, pinning, exact validator selection, and conformance tests.

Health And Test Send

The connector contributes Notify health and test-preview providers for Custom channels using purpose enisa-cra.

Health states:

Test-send returns a JSON preview with the local contract version, channel purpose, delivery mode, auto-submit flag, trace id, and blocked official SRP schema-validation status. It does not submit or write files.

Runtime Status

Implemented in this slice:

Blocked outside this slice:

Offline Expectations

The connector must run and test without internet access, a live ENISA endpoint, or external schema fetches. Official schema validation can move from blocked only after the exact ENISA schema package is pinned, license-reviewed, and tested locally.