TLPT Scoper

Owner: Tools Guild Contract: TLPT Scope v1 Primary code: src/Tools/StellaOps.Tools.TlptScoper/

Purpose

StellaOps.Tools.TlptScoper is a deterministic CLI that produces DORA TLPT scope JSON for white-team evidence preparation. It consumes Asset Registry v1 data, filters active tenant assets by criticality threshold, binds a ReachGraph subgraph reference, and emits a canonical tlpt-scope.v1 document.

It does not run offensive tooling and is not a red-team harness.

Input Modes

The local/offline path remains deterministic and is preferred for replay:

• --asset-registry points to an in-repo or operator-provided asset-registry.v1 JSON file.
• --reachability-subgraph points to a local ReachGraph JSON file and records its SHA-256 input hash.
• --reachability-subgraph-digest may override the recorded ReachGraph digest.
• --frozen-baseline-hash is caller-supplied until the Replay TLPT baseline sprint lands.

The live path is available when --asset-registry is omitted and --graph-asset-registry-url is provided. It uses Graph’s public IGraphAssetRegistryClient/HttpGraphAssetRegistryClient contract, sends the tenant as X-StellaOps-TenantId, follows /graph/assets/query cursors, maps AssetRegistryAssetRecord records into the local TLPT scope input shape, and records assetRegistry.source: graph-api. The command fails closed when neither local input nor a live Graph URL is provided, or when Graph is unavailable.

Deterministic Fixture

Fixture path:

src/Tools/StellaOps.Tools.TlptScoper/fixtures/synthetic-tenant/

The fixture contains:

• asset-registry.json: active/tombstoned/multi-tenant asset examples.
• reachgraph-subgraph.json: local ReachGraph-style subgraph input.

Example

dotnet run --project src/Tools/StellaOps.Tools.TlptScoper/StellaOps.Tools.TlptScoper.csproj -- scope `
  --tenant tenant-a `
  --criticality-threshold high `
  --asset-registry src/Tools/StellaOps.Tools.TlptScoper/fixtures/synthetic-tenant/asset-registry.json `
  --reachability-subgraph src/Tools/StellaOps.Tools.TlptScoper/fixtures/synthetic-tenant/reachgraph-subgraph.json `
  --frozen-baseline-hash sha256:2222222222222222222222222222222222222222222222222222222222222222 `
  --valid-from 2026-05-01T00:00:00Z `
  --valid-to 2026-08-01T00:00:00Z `
  --output scope.json

Live Graph example:

dotnet run --project src/Tools/StellaOps.Tools.TlptScoper/StellaOps.Tools.TlptScoper.csproj -- scope `
  --tenant tenant-a `
  --criticality-threshold high `
  --graph-asset-registry-url https://graph.internal.example `
  --graph-bearer-token $env:STELLAOPS_TOKEN `
  --reachability-subgraph-digest sha256:1111111111111111111111111111111111111111111111111111111111111111 `
  --frozen-baseline-hash sha256:2222222222222222222222222222222222222222222222222222222222222222 `
  --valid-from 2026-05-01T00:00:00Z `
  --valid-to 2026-08-01T00:00:00Z `
  --output scope.json

Output Guarantees

• Canonical JSON with sorted object properties and stable arrays.
• Stable scopeId and scopeHash for identical inputs.
• Warning when tenant asset criticality coverage is below 100%.
• No network access in local/offline mode.
• Live mode fails closed when Graph/API input is missing or unavailable.
• No secret values or dereferenced human PII copied from Asset Registry input.