High-Level Architecture (Legacy Index)

This page preserves the legacy 07_ numbering so older links keep resolving. It is a pointer page only — the canonical high-level architecture now lives in two documents:

• Start here: ARCHITECTURE_OVERVIEW.md— the current architecture: trust boundaries, service map, flows, dependencies, and failure behaviour.
• Reference map: ARCHITECTURE_REFERENCE.md— the canonical index into module dossiers, flows, and schemas.

Related deep dives

Plugin extensibility (uniform runtime plugin model)

• dev/sdks/plugin-development.md — the shared fail-closed admission chokepoint and the per-module loader-status table (which microservices load executable plugins from mounted signed bundles at runtime)
• plugins/ARCHITECTURE.md — loader internals (static PluginHost, manifest model, load contexts) and the code-plugin vs. declarative-pack boundary
• modules/platform/architecture-overview.md— runtime plugin extensibility as a cross-cutting architectural property

Controlled conversational interface

• docs-archive/product/advisories/13-Jan-2026 - Controlled Conversational Interface.md
• modules/advisory-ai/chat-interface.md
• modules/advisory-ai/unified-search-architecture.md
• operations/unified-search-operations.md

AI code guard

• modules/scanner/operations/ai-code-guard.md
• modules/policy/guides/ai-code-guard-policy.md

Audit evidence packs

• modules/evidence-locker/export-format.md
• modules/evidence-locker/guides/evidence-pack-schema.md

Tenancy model

Stella Ops supports multiple logical tenants under one operator’s trust boundary: environments, business units, or other scopes that share the same security team, on-call authority, and incident-response owner. Cross-tenant adversarial workloads and shared-tenancy SaaS hosting are out of scope for the current architecture; see ADR-005. For token-selection mechanics within this posture, see ADR-002.