CAS Promotion Checklist (SIGNALS-24-002)

Audience: Signals Guild, Platform Storage Guild.

Purpose: Promote call graphs into content-addressable storage (CAS) with signed manifests, so the Signals module can serve immutable, verifiable callgraph artifacts. This checklist is the gate that moves SIGNALS-24-002 from BLOCKED to implementation.

Stella Ops stores call graphs as immutable, content-addressed blobs. Each blob is paired with a signed manifest so downstream consumers (Policy Engine, Reachability scoring, Console) can verify provenance before trusting the graph. The steps below stand up that storage tier and its signing/retention policy.

Preconditions

Steps

  1. Freeze manifest schema (fields: graph_id, digest, language, source, created, signer, signature).
  2. Generate manifests for existing callgraphs; store under cas://signals/manifests/{graph_id}.json.
  3. Sign each manifest; attach DSSE envelope; store under cas://signals/manifests/{graph_id}.json.dsse.
  4. Apply bucket policy: read-only for downstream, write for Signals service; deny deletes.
  5. Configure GC policy: retain manifests indefinitely; callgraph blobs keep 30d rolling unless referenced.
  6. Enable alerts for failed retrievals and missing manifest/DSSE pairs.
  7. Record hash list and signer key IDs in release notes.

Deliverables

Evidence locations (repo paths)

Owners

GuildResponsibility
Signals GuildImplementation
Platform Storage GuildPolicy and approvals

Status