Attestor Transparency Controls

Owner Surfaces

• Trust & Signing route: /setup/trust-signing/transparency
• Ops handoff route: /ops/operations/feeds-airgap?tab=airgap-bundles
• Backend owner: Evidence (src/Evidence/StellaOps.Evidence.WebService).
• Backend APIs: /api/evidence/v1/transparency/* and /api/evidence/v1/attestations*.
• Caller prefixes: src/Web/StellaOps.Web/src/app/core/api/api-path-prefixes.ts; consuming client: attestor-transparency.client.ts.

Source verification — 2026-10-07: checked against commit ed225f7338382c180774c2ebf582353e34472ed6. Evidence composes the carried Attestor module with /api/evidence/v1; the Console client uses the same transparency and attestation prefixes. Re-verify the host composition, client methods and src/Evidence/__Tests/StellaOps.Evidence.WebService.Tests/Fixtures/consolidated-route-inventory.tsv. This verifies source routes, not current deployment acceptance.

Operator Workflows

• Trust administrators create external Rekor-compatible targets with endpoint, trust-root reference, secret reference, required crypto profile, and operator label metadata.
• Connected sync starts as dry-run. Live sync requires explicit egress-window acknowledgement and is unavailable when Console offline mode is active.
• Manual exchange uses the same package mechanism as other air-gap workflows: create a signed schedule package, move it through controlled media, create a relay import package, validate it on the sealed site, then apply only after validation passes for the current package digest.
• Package file downloads decode backend contentBase64 into file bytes without modifying signed file contents. The browser never asks for private keys, bearer tokens, registry credentials, or external-log credentials.

Receipt Display Rules

• localTransparencyReceipt is shown as Local transparency receipt.
• externalMirrorReceipts[] are additive and use:
  • External mirror receipt
  • External mirror pending
  • External mirror failed
• Empty external receipts do not degrade local transparency success.
• Pending or failed external mirrors do not render as local transparency failures.

Verification

Focused tests cover:

• target list, target mutation routes, sync run route, manual exchange package routes, import validation, and attestation receipt route;
• Trust & Signing target table loaded/empty/disabled/failed states;
• live sync acknowledgement and offline-mode refusal;
• manual validate/apply separation, validate failure, apply failure, idempotent apply, and package file preservation;
• Ops air-gap handoff link into the Transparency tab.