[girish1430]

Add traust observe repo-state for XWING-2214. The command uses Core to record one repository's forge facts and prints its freshly assembled state as JSON. Core owns observation models, providers, calculations and persistence; Contracts owns the table definitions.

• Require --core-config with explicitly provisioned Core storage. Findings and inventory inputs remain read-only; only forge facts are persisted.
• Support URL or filing-key selection, including missing URLs. Preserve unknown measurements and degraded status records; --no-network prevents forge calls.
• Keep Lane/EventSource vocabulary and the thin CLI in the security pack.
• Delegate legacy batch forge and portfolio-policy helpers to Core while preserving its threading, quota allocation, shared breaker and routing behavior.
• Keep command setup and field mapping in the existing CLI reference.

Rebased onto current main, retaining its ledger configuration changes and dependency updates. The Core/Contracts review pins remain explicit. This PR does not implement the new router, controller or dispatcher.

Validation after rebase: 2,425 tests passed, 40 skipped. The documentation consistency gate and locked dependency check passed. CLI coverage includes recorded forge replay, no-network behavior, and configuration/storage errors.

Merge order: Contracts #40 → Core #5 → this PR.

• Review the CLI and transitional batch integration.
• Merge upstream dependencies and reconcile their pins if commit IDs change.

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: girish1430

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [girish1430]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[chubirka]

what does this mean: "Core's SQL repository/unit-of-work pattern,"? Does that reference Traust-core? does it refer to the general SQL pattern for Traust or something else?
and what is "graph/repo-state.db?" That's not in the graph folder. Is that something you just created? There's a repo-graph, but I don't have anything called repo-state.db in that folder. Do we need to create another DB file for this @smith-xyz ? I thought I also added feature number/version change (major/minor) as a criterion. I'm also doing a classifier cleanup, @smith-xyz do we need to make sure these are consistent with the newer enums?

[smith-xyz]

Heads-up on where this code is headed: traust-security/traust-core#4 lays down the platform structure (stubs only for now) that a lot of this PR's logic maps onto. This PR follows what XWING-2214 asked for at the time; the core structure just didn't exist yet.

This PR	Where it lands in traust-core
observe_repo() forge facts (push, archived, compare since the audited SHA)	services/portfolio.py PortfolioService; forge access through providers/sources.py SourceProvider (already has info() → RepoInfo), extended with compare + quota rather than a separate ForgeClient protocol
audit_age_days, churn_ratio	services/assessment.py AssessmentService.freshness()
live_crit_high (read from findings.db)	repositories/findings.py FindingRepository.open_count()
risk_tier, exposure	services/portfolio.py PortfolioPolicy.risk_tier() / exposure_class()
LegacyObservationInputs (opens findings.db, graph.db, designations via build_rescan_worklist private helpers)	reads through the owning repositories/services instead of a pack adapter over sqlite files
RepoStateRepository + security_repo_state table	a core repository; DDL in traust-contracts (contracts owns all DDL)
Lane, EventSource, traust observe repo-state CLI	stay in the pack (routing vocabulary + thin CLI calling core)

Each stub raises NotImplementedError("stub: replaces …") naming the code it replaces, so grep "stub: replaces build_rescan_worklist" in core shows the targets. Implementation of this slice (Portfolio, freshness, open_count) is the first thing up after #4 merges.

One mechanical note: #4 removes traust_core.v1.domain; the imports here become traust_core.v1.models.base (Model), traust_core.v1.models.values (HttpsRepoUrl) and traust_core.v1.errors (ValidationError, RepositoryError). traust_core.v1.repositories.sql is unchanged.

[chubirka]

Please put this into traust-core, per @smith-xyz

[chubirka]

Please rebase and move into traust-core

[openshift-ci]

PR needs rebase.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[smith-xyz]

Thanks, Girish. This work shaped where observation landed, and that place is now traust-core, so I'm closing this as superseded:

• forge observation, freshness, risk tier and exposure live in traust-core (PortfolioService, services/observation.py, RepoStateQuery; core#5, fix: restore .crush agent wiring; drop the dead CHANGELOG link #16), along with the recorded forge fixtures
• forge facts are stored as an assessment of kind repo-state (traust-contracts#52, traust-core#18), not a separate security_repo_state table; recording and reading it are your inventory plans Repository policy and forge observation and Repo-state composite
• build_rescan_worklist.py gets replaced rather than delegated (PortfolioService / RepoStateQuery / Router), and traust moves onto the platform API, so a new in-process traust_core import here would be debt the consumer fence removes
• Lane / EventSource become contracts enums (work-lane, rescan-event-source)
• the thin traust observe repo-state CLI survives as the repo_state materializer calling the API (continuous-ops plan Materializers)