Signals contracts (draft v0.1)

Audience: Engineers integrating the Policy, Authority, and Signals subsystems, and Concelier/Excititor consumers binding to shared evidence models. Status: Draft v0.1 (tracking task POLICY-AUTH-SIGNALS-LIB-115). The StellaOps.Policy.AuthSignals package is published as alpha and awaits guild ratification before promotion.

Purpose: deliver shared models and JSON schemas for Policy, Authority, and Signals so Concelier and Excititor consumers can bind to a common evidence shape without writing merge logic.

Core models (C#-friendly, JSON schema inline)

PolicyAuthSignal:
- id (string, required) — stable identifier (ULID preferred)
- tenant (string, required)
- subject (string, required) — e.g., purl, sbom://, service://
- signal_type (string, enum: reachability, attestation, risk, vex)
- source (string, required) — producer service
- confidence (float?, optional)
- evidence (array of EvidenceRef)
- created (string, UTC ISO-8601, required)
EvidenceRef:
- kind (string, enum: linkset, runtime, attestation, bundle)
- uri (string, required) — CAS or storage pointer
- digest (string, sha256, required)
- scope (string) — tenant/scopes
Provenance:
- pipeline (string) — build id
- inputs (array) — hashes of inputs
- signer (string)
- transparency (object: rekor_uuid or skip_reason)

JSON schema stub (add-only)

See schemas/policy-auth-signals-lib-115.json (to be emitted with the NuGet package).

Package plan

Project: StellaOps.Policy.AuthSignals (net10.0)
Deliverables: models, JSON schema, sample fixtures, PolicyAuthSignalJsonContext for source generators, deterministic serialization.
Publish target: local-nugets/ (version 0.1.0-alpha+draft), then promote after guild ratification.

Fixtures (to include in package)

fixtures/policy-auth-signal-sample.json
fixtures/policy-auth-signal-reachability.json
Schema: schemas/policy-auth-signals-lib-115.json

Status

NuGet package StellaOps.Policy.AuthSignals 0.1.0-alpha built and placed in local-nugets/ (sha256: 8ab5aa6c0daf5e56e1355d4d6bcaf110a8bc28b28a5ee1970864bcd4b6ba6750). Awaiting guild ratification to promote beyond alpha.