suaveplan/openspec/archive/2026-04-19-enterprise-slsa/tasks.md

Tasks — enterprise-slsa

Closed 2026-04-19 — landed alongside this change; all tasks completed unless noted.

Package scaffolding

• Move from src/lib/*.ts flat layout to co-located four-file feature modules.
• Rewrite package.json with per-feature subpath exports.
• Rewrite vite.config.ts for preserveModules + workspace externals.
• Drop legacy tsconfig.json; keep tsconfig.lib.json only.
• Rewrite vitest.config.ts with istanbul provider and polyfills setup file.
• Create tests/setup/polyfills.ts to polyfill WebCrypto under Node.

Dependencies

• Add @suaveplan/error (workspace).
• Add @suaveplan/types (workspace).
• Add @suaveplan/crypto (workspace).
• Add @suaveplan/crypto-hash (workspace).
• Add @suaveplan/crypto-utils (workspace).
• Add @suaveplan/serialize (workspace).
• Add @opentelemetry/api (catalog:observability).
• Add zod (catalog:forms).

Errors

• Create SLSA_CODES registry via defineCodes.
• Create SlsaError base class.
• Create InvalidProvenanceError.
• Create InvalidSbomError.
• Create VerificationFailedError.
• Create PolicyViolationError.
• Create RekorUploadError.
• Create RekorInclusionError.
• Create AttestationInvalidError.
• Create EnvironmentUnsupportedError.
• Co-located tests, md, and barrel.

Schemas

• Provenance schemas (ProvenanceStatementSchema and descendants).
• SBOM schemas (SbomSchema, SbomInputSchema, components).
• Verification schemas (VerificationPolicySchema, VerificationResultSchema, assessment).
• Attestation schemas (DsseEnvelopeSchema, RekorEntrySchema, InclusionProofSchema).
• parseProvenance / parseSbom with structured error output.
• parseProvenance / parseSbom tests.

OTel

• SlsaEventAttributes typed attribute bag.
• SlsaOtelAdapter interface + createSlsaOtelAdapter factory.
• noopSlsaOtelAdapter default.
• Co-located tests, md.

Provenance

• canonicalize (sorted-key JSON).
• computeDigest via @suaveplan/crypto-hash.
• generateProvenance with Zod-compatible inputs.
• Validation via structured errors.
• serializeProvenance, hashProvenance.
• OTel slsa.provenance.generated event wiring.
• Co-located tests, md.

Verification

• Split checks.ts rule file.
• Add checkBuildAge, checkSourceRepoPrefix, allowedBuilders.
• verifyProvenance with injectable clock and OTel adapter.
• Co-located tests, md.

SBOM

• generateSbom with injectable clock + serial.
• Structured InvalidSbomError on missing fields.
• serializeSbom, hashSbom, buildPurl.
• Co-located tests, md.

Assessment

• assessSlsaLevel with optional Rekor inclusion signal.
• detectEnvironment reading SLSA_* env vars.
• Co-located tests, md.

Attestation (DSSE)

• encodeDssePae per DSSE spec.
• wrapInDsse.
• verifyDsseEnvelope (ed25519, keyid scoping).
• Co-located tests, md.

Rekor

• verifyRfc6962InclusionProof with odd-size carry-up.
• rfc6962LeafHash utility.
• RekorClient with injectable fetch.
• uploadHashedrekord v0.0.1.
• uploadIntoto v0.0.2 (computes payload sha256 automatically).
• getEntryByUuid, getEntryByLogIndex.
• verifyInclusionProof emits slsa.rekor.inclusion_verified OTel event.
• Response envelope flattening + Zod validation.
• Co-located tests (no live Rekor), md.

Policy

• evaluatePolicy layering provenance verification + DSSE signatures + Rekor inclusion + min SLSA level.
• OTel slsa.policy.violation on failures.
• Co-located tests, md.

Docs

• Co-located .md for every .ts implementation file.
• Root README.md rewritten with Modules section.

Verification

• bunx turbo typecheck --filter=@suaveplan/slsa green.
• bunx turbo lint --filter=@suaveplan/slsa green.
• bunx turbo test --filter=@suaveplan/slsa green (170 tests).
• bunx turbo test:coverage --filter=@suaveplan/slsa meets 95% threshold on every axis.
• bunx turbo build --filter=@suaveplan/slsa green.