Initial Commit

openspec/archive/2026-04-19-enterprise-slsa/tasks.md

@@ -0,0 +1,129 @@
+# Tasks — enterprise-slsa
+
+> Closed 2026-04-19 — landed alongside this change; all tasks completed unless noted.
+
+## Package scaffolding
+
+- [x] Move from `src/lib/*.ts` flat layout to co-located four-file
+      feature modules.
+- [x] Rewrite `package.json` with per-feature subpath `exports`.
+- [x] Rewrite `vite.config.ts` for preserveModules + workspace externals.
+- [x] Drop legacy `tsconfig.json`; keep `tsconfig.lib.json` only.
+- [x] Rewrite `vitest.config.ts` with istanbul provider and
+      polyfills setup file.
+- [x] Create `tests/setup/polyfills.ts` to polyfill WebCrypto under
+      Node.
+
+## Dependencies
+
+- [x] Add `@suaveplan/error` (workspace).
+- [x] Add `@suaveplan/types` (workspace).
+- [x] Add `@suaveplan/crypto` (workspace).
+- [x] Add `@suaveplan/crypto-hash` (workspace).
+- [x] Add `@suaveplan/crypto-utils` (workspace).
+- [x] Add `@suaveplan/serialize` (workspace).
+- [x] Add `@opentelemetry/api` (catalog:observability).
+- [x] Add `zod` (catalog:forms).
+
+## Errors
+
+- [x] Create `SLSA_CODES` registry via `defineCodes`.
+- [x] Create `SlsaError` base class.
+- [x] Create `InvalidProvenanceError`.
+- [x] Create `InvalidSbomError`.
+- [x] Create `VerificationFailedError`.
+- [x] Create `PolicyViolationError`.
+- [x] Create `RekorUploadError`.
+- [x] Create `RekorInclusionError`.
+- [x] Create `AttestationInvalidError`.
+- [x] Create `EnvironmentUnsupportedError`.
+- [x] Co-located tests, md, and barrel.
+
+## Schemas
+
+- [x] Provenance schemas (`ProvenanceStatementSchema` and descendants).
+- [x] SBOM schemas (`SbomSchema`, `SbomInputSchema`, components).
+- [x] Verification schemas (`VerificationPolicySchema`,
+      `VerificationResultSchema`, assessment).
+- [x] Attestation schemas (`DsseEnvelopeSchema`, `RekorEntrySchema`,
+      `InclusionProofSchema`).
+- [x] `parseProvenance` / `parseSbom` with structured error output.
+- [x] `parseProvenance` / `parseSbom` tests.
+
+## OTel
+
+- [x] `SlsaEventAttributes` typed attribute bag.
+- [x] `SlsaOtelAdapter` interface + `createSlsaOtelAdapter` factory.
+- [x] `noopSlsaOtelAdapter` default.
+- [x] Co-located tests, md.
+
+## Provenance
+
+- [x] `canonicalize` (sorted-key JSON).
+- [x] `computeDigest` via `@suaveplan/crypto-hash`.
+- [x] `generateProvenance` with Zod-compatible inputs.
+- [x] Validation via structured errors.
+- [x] `serializeProvenance`, `hashProvenance`.
+- [x] OTel `slsa.provenance.generated` event wiring.
+- [x] Co-located tests, md.
+
+## Verification
+
+- [x] Split `checks.ts` rule file.
+- [x] Add `checkBuildAge`, `checkSourceRepoPrefix`, `allowedBuilders`.
+- [x] `verifyProvenance` with injectable clock and OTel adapter.
+- [x] Co-located tests, md.
+
+## SBOM
+
+- [x] `generateSbom` with injectable clock + serial.
+- [x] Structured `InvalidSbomError` on missing fields.
+- [x] `serializeSbom`, `hashSbom`, `buildPurl`.
+- [x] Co-located tests, md.
+
+## Assessment
+
+- [x] `assessSlsaLevel` with optional Rekor inclusion signal.
+- [x] `detectEnvironment` reading `SLSA_*` env vars.
+- [x] Co-located tests, md.
+
+## Attestation (DSSE)
+
+- [x] `encodeDssePae` per DSSE spec.
+- [x] `wrapInDsse`.
+- [x] `verifyDsseEnvelope` (ed25519, keyid scoping).
+- [x] Co-located tests, md.
+
+## Rekor
+
+- [x] `verifyRfc6962InclusionProof` with odd-size carry-up.
+- [x] `rfc6962LeafHash` utility.
+- [x] `RekorClient` with injectable `fetch`.
+- [x] `uploadHashedrekord` v0.0.1.
+- [x] `uploadIntoto` v0.0.2 (computes payload sha256 automatically).
+- [x] `getEntryByUuid`, `getEntryByLogIndex`.
+- [x] `verifyInclusionProof` emits
+      `slsa.rekor.inclusion_verified` OTel event.
+- [x] Response envelope flattening + Zod validation.
+- [x] Co-located tests (no live Rekor), md.
+
+## Policy
+
+- [x] `evaluatePolicy` layering provenance verification + DSSE
+      signatures + Rekor inclusion + min SLSA level.
+- [x] OTel `slsa.policy.violation` on failures.
+- [x] Co-located tests, md.
+
+## Docs
+
+- [x] Co-located `.md` for every `.ts` implementation file.
+- [x] Root `README.md` rewritten with Modules section.
+
+## Verification
+
+- [x] `bunx turbo typecheck --filter=@suaveplan/slsa` green.
+- [x] `bunx turbo lint --filter=@suaveplan/slsa` green.
+- [x] `bunx turbo test --filter=@suaveplan/slsa` green (170 tests).
+- [x] `bunx turbo test:coverage --filter=@suaveplan/slsa` meets 95%
+      threshold on every axis.
+- [x] `bunx turbo build --filter=@suaveplan/slsa` green.