Stella Ops Module Documentation Index

Verified against: commit ab4b3ca1d9 (2026-09-26). The services, their source projects, databases, compose files, bundle presence and owning dossiers are in the generated service inventory. Re-verify with python tools/scripts/generate/service-inventory.py --check. Where an entry below disagrees with the inventory, the inventory is current.

This is the entry point for the documentation of every Stella Ops module. Use it to find the dossier for a module, see which service a module runs as, and find where a retired module went.

Conventions

• Module doc directories use kebab-case names that map to the PascalCase src/ directory (e.g. sbom-service/ → src/SbomService/).
• A service’s dossier is the directory named in the inventory’s Dossier column. Those directories, plus the library and tool modules listed below, carry a full dossier. _template/ is the scaffold for a new one.
• Pointer-stub convention (binding). A directory that is not the home of a dossier — a consolidated or retired module, or a directory holding only an autogenerated api-reference.md + openapi/ — carries a README.md stub naming its successor dossier and its src/ location.
• Autogenerated api-reference.md / openapi/ files describe the wire shape only. They are not dossiers and they do not carry the auth/tenancy contract — read the parent dossier before trusting a parameter list.
• Source is the ground truth. Per-module counts (migrations, endpoints, scopes) in the catalog are illustrative and can lag src/; verify against the code before relying on a specific number.

Module map

Service families

Each row is one service family, and its services share one database. The Database column names the database the family’s services resolve through their own STELLAOPS_POSTGRES_<SERVICE>_CONNECTION.

Libraries, tools and clients

Concept and cross-cutting documents

Retired modules

These directories are pointer stubs or frozen design records. Each names its successor.

Module Catalog

AdvisoryAI

• Source: src/AdvisoryAI/
• Docs: docs/modules/advisory-ai/
• Type: Service
• Database: PostgreSQL (2 SQL migrations: chat audit, knowledge search)
• Endpoints: 7 (attestation, chat, evidence pack, knowledge search, LLM adapter, run, companion explain)

AI-powered advisory summarization and knowledge search service using LLM inference to explain vulnerability advisories, VEX evidence, and remediation guidance. Uses retrieval-augmented generation (RAG) over advisories, VEX, and platform documentation with configurable LLM backends (Claude, OpenAI, Ollama, Gemini). Includes chat audit logging, doctor-search controls, and guardrails for determinism and offline operation.

Dependencies: Concelier, VEX Lens / Excititor, Policy Engine, SBOM Service, LLM providers.

AirGap

• Source: src/OfflineKit/__Libraries/StellaOps.AirGap.{Bundle,Importer,Time.Verification} and src/__Libraries/StellaOps.AirGap.Policy — the src/AirGap/ root retired at OK-14 (2026-09-14, 6cd91bfe5e); StellaOps.AirGap.Sync was withdrawn to src/__Obsoleted/OfflineKit/__Libraries/ (406e66e6be)
• Docs: docs/modules/airgap/
• Type: Libraries. No longer a service: the airgap-controller and airgap-time hosts retired at SPRINT_20260722_025 OK-5 (2026-09-11) and are frozen at src/__Obsoleted/AirGap/
• Database: none of its own. Sealed posture is ENVIRONMENT-scoped and lives in Platform’s platform.environment_state custodian (owner ruling A2); consumers replicate it rather than calling back
• Endpoints: none. Carrier custody and posture reads are served by offlinekit-web under /api/offlinekit/v1/**

Air-gapped deployment controller, importer, and cryptographic time anchor enabling StellaOps operation in fully disconnected environments. Handles bundle import/export, trust verification, and sealed-mode enforcement. Time service provides cryptographic time anchors using Roughtime or RFC3161.

Dependencies: Authority, Concelier / Excititor, Signer / Attestor.

Aoc

• Source: withdrawn 2026-09-27 (PCD-62); frozen at src/__Obsoleted/Aoc/
• Docs: docs/modules/aoc/
• Type: CLI / Library
• Database: None
• Endpoints: None

CLI tool and Roslyn analyzers enforcing the Aggregation-Only Contract (AOC) across the platform. Validates that ingestion services preserve raw upstream data without modification, maintain full provenance chains, and never merge conflicting observations.

Dependencies: None (standalone validation tool).

Api

• Source: src/Api/StellaOps.Api.OpenApi/
• Docs: docs/modules/api/
• Type: API-contract repository; no C# project and no deployable
• Database: None
• Endpoints: None

Hand-maintained OpenAPI 3.1 specifications for a subset of Stella Ops services, the shared schema, parameter, response and security components, and the aggregate specification. The specifications are contract documents, not runtime documents. src/Authority/StellaOps.Api.OpenApi/ holds a second, divergent Authority specification; the dossier records which consumer reads which copy.

Dependencies: None.

Attestor — RETIRED as a service

• Source: src/Attestor/ now holds the Signer, the tile proxy, the attestation and provenance libraries; the attestation application layer moved to src/Evidence/, and the attestor host is frozen at src/__Obsoleted/Attestor/ (44547f28e3, 2026-09-04)
• Docs: docs/modules/attestor/(retirement stub plus the format, predicate and algorithm reference); current dossier docs/modules/evidence/
• Type: none; the attestation surfaces are composed by evidence-web and evidence-worker
• Database: the attestor and proofchain schemas live in stellaops_evidence
• Endpoints: the carried minimal-API routes (attestations, Rekor, transparency, links, watchlist) under /api/evidence/v1; the predicate registry keeps /api/v1/attestor/predicates

DSSE attestation submission to Rekor v2, inclusion proofs, verification, the predicate type registry, the identity watchlist and trust verdict storage, now hosted by the Evidence family.

Two supporting containers are infrastructure, not src/ modules. stellaops-tsa is the local RFC 3161 Timestamp Authority built in-repo from an OpenSSL base (devops/docker/tsa/, ADR-036); stellaops-rekor is the Rekor v2 transparency log. The .NET timestamping clients live in src/Attestor/__Libraries/StellaOps.Attestor.Timestamping and src/EvidenceLocker/__Libraries/StellaOps.EvidenceLocker.Timestamping.

Dependencies: Signer, Rekor v2, TSA (RFC 3161), Authority.

Authority

• Source: src/Authority/ (StellaOps.Authority host; the IssuerDirectory surface folds into it behind IssuerDirectory:Fold:Enabled)
• Docs: docs/modules/authority/
• Type: Service (authority)
• Database: its own database, resolved only from STELLAOPS_POSTGRES_AUTHORITY_CONNECTION; migrations applied on startup
• Endpoints: OAuth 2.0 / OIDC (/authorize, /token, revocation, JWKS, discovery, /logout), console admin, audit groups, and /doctor/authority/checks

On-premises OIDC/OAuth 2.0 identity service issuing short-lived operational tokens, with DPoP sender constraint available per client. Supports RBAC scopes from the canonical catalog (StellaOpsScopes.cs), multi-tenant claims, console admin endpoints, the standard and LDAP identity-provider plugins, and bootstrap client seeding.

Dependencies: PostgreSQL (own database). Service, image, database and compose wiring: service inventory.

Bench (archived – absorbed into Tools)

• Source: src/Tools/StellaOps.Bench/
• Docs: docs/modules/tools/
• Type: Tool
• Database: None
• Endpoints: None

Performance benchmark harnesses for critical platform subsystems including Link-Not-Merge, VEX, Notify, Policy Engine, and Scanner analyzers. Absorbed into src/Tools/.

Dependencies: None (standalone benchmarks).

Binary analysis

Shared analysis foundations remain under src/BinaryIndex/; binary and symbol workflow, metadata and persistence belong to Vulnerabilities. See the current architecture. The predecessor hosts are frozen by BIN-10. Standing-estate retirement and schema-drop authorization remain distinct from source readiness.

Cartographer (absorbed into Scanner)

• Source: withdrawn to src/__Obsoleted/Scanner/StellaOps.Scanner.Cartographer/ (PCD-73, 2026-09-27); graph-api serves the cartographer.stella-ops.local alias
• Docs: Historical doc archived at docs-archive/modules/cartographer/README.md; active contract is docs/modules/scanner/
• Type: Withdrawn host project
• Database: None
• Endpoints: Defined in Scanner Program.cs

Infrastructure topology discovery and service mapping for container environments. Produces SBOM snapshots and topology graphs consumed by the Graph Indexer. Environment topology and promotion lanes are now owned by the Release Orchestrator. Consolidated into Scanner.

Dependencies: Graph, Scanner.

CLI

• Source: src/Cli/ (StellaOps.Cli, the stella executable, plus plug-ins under src/Cli/plugins/)
• Docs: docs/modules/cli/
• Type: CLI (.NET 10)
• Database: None
• Endpoints: None

Command-line interface for scanning, policy, vulnerability and VEX data, verification, offline-kit administration, Doctor diagnostics and administration. Authenticates against Authority with the client-credentials or password grant; tokens are cached per scope set. Runnable examples in the docs are checked by CliDocumentationContractTests.

Dependencies: Authority (tokens) and the service APIs through the gateway.

Concelier — RETIRED

• Source: frozen at src/__Obsoleted/Concelier/ (d80e7ce610 and 9b648b5534, 2026-09-11); src/Concelier/ no longer exists
• Docs: docs-archive/modules/concelier/ (historical); current dossier docs/modules/vulnerabilities/
• Type: none; advisory ingestion is served by vulnerabilities-web and vulnerabilities-worker
• Database: none; the hub owns stellaops_vuln
• Endpoints: 9 (advisory source, air-gap, canonical advisory, federation, feed mirror, feed snapshot, interest score, mirror, SBOM)

Advisory ingestion and Link-Not-Merge (LNM) observation pipeline producing deterministic raw observations, correlation linksets, and evidence events. Acquires authoritative vulnerability advisories from vendor PSIRTs, distros, OSS ecosystems, and CERTs, persisting them as immutable observations under AOC.

Dependencies: Policy Engine, Excititor, Graph, AirGap, Feedser.

Cryptography

• Source: src/Cryptography/ (regional plug-ins: eIDAS, FIPS, GOST, HSM, OpenPGP, SM; ECDSA and EdDSA profiles) and the shared src/__Libraries/StellaOps.Cryptography* libraries
• Docs: docs/modules/cryptography/
• Type: Library and plug-ins
• Database: None
• Endpoints: None

Pluggable cryptographic providers for regional standards with algorithm-agile signing and a fail-closed production guard. Regional deployments select providers through compose overlays that mount signed crypto packs.

Dependencies: None (consumed as a library by Signer, Evidence, Authority and other services).

DevPortal (archived – absorbed into Tools)

• Source: src/Tools/StellaOps.DevPortal.Site/
• Docs: docs/modules/tools/
• Type: Static Site
• Database: None
• Endpoints: None

Developer portal static site providing API documentation, integration guides, SDK references, and getting-started tutorials. Absorbed into src/Tools/.

Dependencies: None (static site).

Doctor

• Source: src/Doctor/ (plug-ins) and src/__Libraries/StellaOps.Doctor* (contracts, engine, per-service SDK)
• Docs: docs/modules/doctor/
• Type: Library, plug-ins and CLI. The doctor-web deployable retired on 2026-08-17 (0daa7e086c); its source host was withdrawn to src/__Obsoleted/Doctor/ on 2026-09-27 (PCD-73)
• Database: None
• Endpoints: none of its own; each service serves /doctor/<service>/checks, and Platform holds the registry and the aggregate view

Diagnostic framework: the doctor-check/v1 contract, the check engine and plug-ins, the per-service SDK, and the stella doctor CLI. JobEngine schedules estate-level packs.

Dependencies: Platform (registry and aggregate).

E2E (test harness – no dossier)

• Source: src/E2E/
• Docs: none (harness code + devops/compose/docker-compose.e2e-*.yml are the contract)
• Type: Test harness
• Database: None
• Endpoints: None

End-to-end coverage harnesses: StellaOps.E2E.AnalyzerCoverage, StellaOps.E2E.NotifyChannelCoverage, StellaOps.E2E.SyntheticRepos, plus __Tests. Driven by dedicated compose files (docker-compose.e2e-analyzer-coverage.yml, docker-compose.e2e-notify-coverage.yml). Test tooling, not a shipped service; it has no container in the default stack.

Dependencies: the services under test (Scanner analyzers, Notify channels).

EvidenceLocker — RETIRED as a service

• Source: src/EvidenceLocker/ is a residual predecessor tree; the hosts are frozen at src/__Obsoleted/EvidenceLocker/ (44547f28e3, 2026-09-04)
• Docs: docs-archive/modules/evidence-locker/ (retirement stub); current dossier docs/modules/evidence/
• Type: none; served by evidence-web and evidence-worker
• Database: the evidence_locker schemas live in stellaops_evidence
• Endpoints: 4 (evidence audit, evidence thread, export, verdict)

Tamper-proof, immutable evidence storage for vulnerability scan evidence, audit logs, and compliance artifacts with cryptographic sealing. Evidence is content-addressable. Once sealed, evidence cannot be modified. Supports threads, verdicts, bundle packaging, and portable bundles for offline compliance audits.

Dependencies: Attestor, Authority, object storage.

Excititor — RETIRED

• Source: frozen at src/__Obsoleted/Concelier/ (d80e7ce610, 2026-09-11)
• Docs: docs-archive/modules/excititor/ (historical reference); current dossier docs/modules/vulnerabilities/
• Type: none; VEX ingestion is served by the Vulnerabilities hub
• Database: PostgreSQL (10 SQL migrations, separate ExcititorDbContext)
• Endpoints: 11 (attestation, evidence, ingest, linkset, mirror, mirror registration, observation, policy, Rekor attestation, resolve, risk feed)

VEX ingestion and consensus pipeline converting heterogeneous VEX statements (OpenVEX, CSAF VEX, CycloneDX VEX) into immutable observations with provenance-preserving linksets. Does not decide PASS/FAIL; supplies evidence with statuses, justifications, and provenance weights. Conflicting observations are preserved unchanged. Consolidated into Concelier; DbContext remains separate.

Dependencies: Policy Engine, Concelier, Attestor, Graph.

ExportCenter — RETIRED

• Source: folded into src/OfflineKit/ (SPRINT_20260722_025 OK-4 lifted the domain, OK-10 retired the hosts on 2026-09-12). The two composition roots and the legacy private migration chain are frozen at src/__Obsoleted/ExportCenter/
• Docs: docs/modules/export-center/— retirement stub + historical record
• Type: none. export-web and export-worker were stopped in the 2026-09-13 consolidation window; the export plane is served by offlinekit-web
• Database: the export_center schema lives in stellaops_offlinekit now. The predecessor database stellaops_exportcenter still exists and still holds its rows — dropping it and revoking role exportcenter is a separate destructive window that has not run
• Endpoints: unchanged in shape, moved in prefix — the plane mounts at /api/offlinekit/v1/**, because the bare /v1/exports paths reached export-web through the HELLO service name exportcenter, which died with it

Nothing was withdrawn. The application layer is src/OfflineKit/__Libraries/StellaOps.ExportCenter.Application and the worker runtime is …/StellaOps.ExportCenter.WorkerRuntime; both still declare StellaOps.ExportCenter.* namespaces on purpose, because the lift was byte-identical so that no consumer using had to change.

Dependencies: unchanged — Findings, Policy Engine, JobEngine, Authority, Evidence, object storage.

Extensions (absorbed into Integrations)

• Source: src/Integrations/__Extensions/ (moved from src/Extensions/)
• Docs: See Integrations architecture
• Type: IDE Extensions (non-.NET: TypeScript/Kotlin)
• Database: None
• Endpoints: None

IDE extensions for JetBrains IDEs and Visual Studio Code providing inline vulnerability information, policy status, and StellaOps workflow integration directly within the developer’s editor environment. Now lives under the Integrations module.

Dependencies: Platform API, JobEngine API, Authority.

Feedser — RETIRED

• Source: frozen at src/__Obsoleted/Concelier/StellaOps.Feedser.Core/ (2026-09-11)
• Docs: docs-archive/modules/feedser/ (historical reference); current dossier docs/modules/vulnerabilities/
• Type: Library
• Database: None
• Endpoints: None

Evidence collection library for backport detection and binary fingerprinting supporting the four-tier backport proof system. Extracts patch signatures from unified diffs and binary fingerprints from compiled code. Consumed primarily by Concelier’s ProofService layer. All outputs are deterministic with canonical JSON serialization. Consolidated into Concelier.

Dependencies: None (consumed as a library by Concelier).

Findings

• Source: src/Findings/
• Docs: docs/modules/findings/architecture.md— the dossier; ledger design records in findings/ledger/; the analytics-ingestion lane in vuln-correlation.md
• Type: One deployable family, two replica roles — findings-web (HTTP) + findings-worker (projections/scoring)
• Database: PostgreSQL — its own stellaops_findings, resolved only from STELLAOPS_POSTGRES_FINDINGS_CONNECTION and fail-closed without it. Four data schemas (findings, findings_security, riskengine, analytics) plus two structural ones (findings_ledger_app, findings_archive).
• Endpoints: the canonical /api/findings/v1/* surface (ledger, scoring, capabilities, alerts, vex-decisions, evidence-subgraph, security, risk aggregated-status)

Centralized findings aggregation service providing backport tracking, evidence graphs, finding summaries, reachability maps, runtime timelines, scoring, and webhook notifications. Aggregates vulnerability findings from Scanner, Policy, Concelier, and Excititor into a unified query surface. Includes a LedgerReplayHarness tool for deterministic replay testing.

The consolidated Findings migration chain creates the analytics ingestion tables and helper functions. It excludes the legacy analytics materialized views, rollups and query functions. The retained StellaOps.Findings.VulnCorrelation.Application and .Persistence libraries have no serving registration caller; their former host and compose overlay were deleted at FND-10 (2026-08-27). The current worker’s advisory and Scanner projections do not call those legacy registrations. Platform’s /api/analytics/* API and maintenance lane were withdrawn by PCD-127 (2026-09-30), together with the Console SBOM Lake page and CLI analytics commands. See the VulnCorrelation dossier for the source revision, exact schema boundary and repeatable checks.

Dependencies: Scanner, Policy Engine, Concelier / Excititor, Attestor.

Gateway (deleted)

• Source: (deleted) – Gateway WebService now lives under src/Router/StellaOps.Gateway.WebService/
• Docs: docs-archive/modules/gateway/ (historical reference); active contract is docs/modules/router/
• Type: (deleted)
• Database: None
• Endpoints: None

The standalone src/Gateway/ module was deleted. The canonical Gateway WebService (StellaOps.Gateway.WebService) now lives under src/Router/. The Router module owns HTTP ingress, binary protocol bridging, routing, and transport abstraction.

Dependencies: See Router.

Graph

• Source: src/Graph/
• Docs: docs/modules/graph/
• Type: Service
• Database: PostgreSQL (1 SQL migration in Graph Indexer Persistence)
• Endpoints: 3 (graph query, analytics, overlay)

SBOM dependency graph store with a rich node/edge model covering artifacts, SBOMs, components, advisories, VEX statements, and policy versions with reachability overlays. The Graph Indexer processes events from Cartographer/SBOM Service, Concelier/Excititor, and policy runs to maintain the graph.

Dependencies: Cartographer / SBOM Service, Concelier / Excititor, Policy Engine, Scanner.

Integrations

• Source: src/Integrations/
• Docs: docs/modules/integrations/
• Type: Service
• Database: PostgreSQL (IntegrationDbContext, EF Core managed)
• Endpoints: 2

Integration hub managing connections to external systems (SCM, CI, registries, secrets vaults) with health monitoring. Stores connection profiles, manages credential references, and monitors integration health. Plugins under __Plugins provide specific connector implementations.

Dependencies: Authority, external SCM/CI/Registry/Vault systems.

IssuerDirectory (absorbed into Authority)

• Source: src/Authority/; the issuer-directory-web host is frozen at src/__Obsoleted/Authority/ (0f2efb7692, 2026-09-11)
• Docs: docs/modules/issuer-directory/(historical reference; see docs/modules/authority/)
• Type: none of its own; served by authority
• Database: the issuer schema in stellaops_authority
• Endpoints: 3 (issuer, issuer key, issuer trust)

Centralized trusted VEX/CSAF publisher metadata registry enabling issuer identity resolution, key management, and trust weight assignment. Key lifecycle management validates Ed25519, X.509, and DSSE public keys with fingerprint deduplication. On startup, imports default CSAF publishers into the global tenant. Consolidated into Authority; DbContext remains separate for security isolation.

Dependencies: Authority.

Mirror — RETIRED

• Source: folded into src/OfflineKit/ at SPRINT_20260722_025 OK-10 (2026-09-12). src/Mirror/ is absent from the tree entirely — not frozen, because the whole of it moved
• Docs: docs/modules/mirror/— retirement stub + historical record
• Type: Library / Tool, unchanged in kind
• Database: None
• Endpoints: None

The old StellaOps.Mirror.Creator library never assembled a bundle (its service failed closed); it was withdrawn on 2026-09-26 to src/__Obsoleted/OfflineKit/__Libraries/StellaOps.Mirror.Creator/. The mirror-profile planner that turns a kind = 5 export profile into a bundle plan is MirrorProfilePlanner, and the executor that would call it is OK-12 — so a mirror bundle is not yet producible end-to-end through the profile API.

Dependencies: Upstream vulnerability feeds (NVD, OSV, GHSA), Concelier.

Notifier (retired)

Merged into Notify. notifier-web merged into notify-web at NTF-5 and the notifier-worker deployable retired on 2026-09-04; the sources were frozen at src/__Obsoleted/Notifier/ on 2026-09-08 (SPRINT_20260722_015 NTF-10). Its documentation is now a pointer: docs-archive/modules/notifier/. Read the Notify entry below.

Notify

• Source: src/Notify/
• Docs: docs/modules/notify/
• Type: Service / Library
• Database: PostgreSQL (2 SQL migrations)
• Endpoints: 2 (via WebService Program.cs)

Rules-driven, tenant-aware notification engine providing event consumption, operator-defined routing, channel-specific rendering, and reliable delivery with idempotency, throttling, and digests. The notify-web host serves the API and notify-worker runs delivery, both over the shared StellaOps.Notify.Delivery library. Secrets for channels are referenced, not stored raw.

Dependencies: Scanner / Scheduler / Excititor / Concelier / Attestor / Zastava (event sources), Slack/Teams/Email/Webhook, Authority.

OpsMemory (consolidated into AdvisoryAI)

• Source: src/AdvisoryAI/__Libraries/StellaOps.OpsMemory/ (domain library), src/AdvisoryAI/__Libraries/StellaOps.OpsMemory.Application/ (HTTP surface, served in-process by advisoryai-web). The standalone host was retired 2026-09-07 and is frozen at src/__Obsoleted/AdvisoryAI/StellaOps.OpsMemory.WebService/.
• Docs: docs/modules/advisory-ai/architecture.md section 15
• Archived docs: docs-archive/modules/opsmemory/
• Type: Service
• Database: PostgreSQL (via shared infrastructure, schema managed programmatically)
• Endpoints: 1 (OpsMemoryEndpoints)

Decision ledger capturing the lifecycle of security decisions with similarity-based suggestion retrieval for organizational learning. Uses similarity vectors to suggest relevant precedents for new situations. Deterministic with fixed similarity formulas, no randomness in ranking, and multi-tenant isolation. Consolidated from standalone src/OpsMemory/ module into src/AdvisoryAI/.

Dependencies: AdvisoryAI, Authority, Findings Ledger.

JobEngine (formerly Orchestrator)

• Source: src/JobEngine/
• Docs: docs/modules/jobengine/
• Type: Service
• Database: PostgreSQL (via shared infrastructure)
• Endpoints: 25 (approvals, audit, circuit breakers, DAG, dead letter, export jobs, first signal, health, jobs, KPIs, ledger, OpenAPI, pack registry, pack runs, quotas, governance, release control v2, release dashboard, releases, runs, scale, SLOs, sources, streams, workers)

Source and job orchestration service managing job lifecycle, rate-limit governance, DAG execution, circuit breakers, and worker coordination. Applies quotas and rate limits per tenant/jobType, manages leasing to workers, handles completion tracking with retry policies, and supports replay. SDK bridges exist for Go and Python workers. Renamed from Orchestrator. Now includes Scheduler, TaskRunner, and PacksRegistry.

Dependencies: Concelier / Excititor / ExportCenter / Policy (job producers), Valkey or NATS, Authority.

PacksRegistry (absorbed into JobEngine)

• Source: src/JobEngine/; the packsregistry-web and packsregistry-worker hosts are frozen at src/__Obsoleted/JobEngine/ (c50d127955, 2026-09-12; 50a580ea60, 2026-09-13)
• Docs: docs-archive/modules/packs-registry/ (historical reference; see docs/modules/jobengine/)
• Type: none of its own; served by jobengine-web and jobengine-worker
• Database: the packs schema in stellaops_jobengine
• Endpoints: Defined in JobEngine Program.cs

Centralized registry for distributable task packs, policy packs, and analyzer bundles with versioned management and integrity verification. All packs are content-addressed. Consolidated into JobEngine.

Dependencies: JobEngine, object storage, Authority.

Platform

• Source: src/Platform/ (StellaOps.Platform.WebService; libraries under src/Platform/__Libraries/)
• Docs: docs/modules/platform/
• Type: Service (platform)
• Database: its own database, resolved only from STELLAOPS_POSTGRES_PLATFORM_CONNECTION; migrates only its own schema (PlatformMigrationModule, Startup band)
• Endpoints: Platform-owned context, environment settings, federation telemetry, integration and read models, setup, release control and read models, topology, trust-signing, verification keys, connector credentials, and the Doctor capability registry and aggregate. Score, function-map, policy-interop and security routes keep their public URLs but are owned by Signals, Scanner, Policy Engine and Findings.Security respectively.

Console backend: installation settings, tenant directory, read projections, federated telemetry, crypto and KEK administration, and the Doctor registry. The former central migration framework was deleted 2026-09-14 (SPRINT_20260722_021 PLT-4); MigrationModuleConsolidation survives only for the guided-setup wizard.

Dependencies: Authority, PostgreSQL (own database). Service, image, database and compose wiring: service inventory.

Plugin

• Source: src/Plugin/
• Docs: docs/modules/plugin/
• Type: Library / Framework
• Database: PostgreSQL (Plugin Registry, 1 SQL migration)
• Endpoints: None

Plugin SDK, registry, sandbox, and host framework enabling extensibility across the platform. Includes Abstractions (contracts), Sdk (development SDK), Host (lifecycle management), Registry (PostgreSQL persistence), Sandbox (isolated execution), Cli (management tool), Testing (test harness), and Samples.

Dependencies: None (framework consumed by other modules).

Policy

• Source: src/Policy/
• Docs: docs/modules/policy/
• Type: Service (policy-engine). The merged StellaOps.Policy.Gateway host project was withdrawn to src/__Obsoleted/Policy/ on 2026-09-27 (PCD-73)
• Database: PostgreSQL (5 SQL migrations plus demo seed)
• Endpoints: 59 (49 Engine + 10 Gateway)

Deterministic policy evaluation engine and gateway service compiling stella-dsl policy packs into verdicts by joining SBOM inventory, advisories, and VEX evidence. The Engine provides extensive coverage across advisory AI knobs, attestation reports, batch evaluation, budgets, conflicts, CVSS receipts, determinization, effective policy, merge previews, risk profiles/simulations, sealed mode, verification policy, and violation tracking. The Gateway handles admission decisions, deltas, exception approvals, gates, governance, and registry webhooks.

Dependencies: Concelier, Excititor, SBOM Service, Scanner, Authority, Scheduler.

Provenance (absorbed into Attestor)

• Source: src/Attestor/ (moved from src/Provenance/)
• Docs: docs/modules/provenance/(historical reference; see docs/modules/attestor/)
• Type: Library / Tool
• Database: None
• Endpoints: None

Provenance attestation library and CLI tool for generating and verifying supply-chain provenance records. Creates in-toto attestation statements linking build artifacts to source materials, build systems, and parameters. The separate provenance cache family retains its Core and Valkey libraries; its unadopted PostgreSQL provider was withdrawn by EST-9. See Provcache status. Attestation is consolidated into Attestor.

Dependencies: Attestor.

ReachGraph

• Source: src/Graph/__Libraries/StellaOps.ReachGraph.Application (HTTP surface) and src/__Libraries/StellaOps.ReachGraph* (model, persistence, cache, contracts). src/ReachGraph/ was deleted at 023 GRA-10 (2026-09-08).
• Docs: docs/modules/graph/reachability/ (folded into Graph); host-era record docs-archive/modules/reach-graph/
• Type: Module of the Graph service (not a deployable of its own)
• Database: stellaops_graph, schema reachgraph, converged by StellaOps.Graph.Persistence’s consolidated baseline
• Endpoints: served by graph-api; carried controllers under StellaOps.ReachGraph.Application/Controllers/

Unified reachability subgraph store providing fast, deterministic, audit-ready answers about why a dependency is reachable. Consolidates reachability data from Scanner (call graphs), Signals (runtime observations), and Attestor (PoE JSON) into content-addressed artifacts with edge-level explainability.

Dependencies: Scanner, Signals, Attestor.

Registry

• Source: src/Registry/: registry-web (StellaOps.Registry.WebService, the OCI data plane) and registry-token (StellaOps.Registry.TokenService), sharing stellaops_registry through STELLAOPS_POSTGRES_REGISTRY_CONNECTION
• Docs: docs/modules/registry/; autogenerated wire reference in registry-token/
• Type: Service (two deployables)
• Database: PostgreSQL registry_token schema (plan rules and audit) when a connection string is configured; otherwise a static in-config plan catalogue
• Endpoints: the OCI distribution API on registry-web; GET /token (Docker registry token exchange) and the /api/admin/plans plan-rule admin group on registry-token

registry-web is the Stella Ops OCI registry. registry-token validates Authority-issued caller tokens, authorizes requested registry scopes against the plan catalogue (anonymous pull-only plan off by default), and mints Docker-registry-compatible JWTs that registry-web accepts. Only the optional demo overlay devops/release/bundle/docker-compose.demo-registry.yml runs a third-party registry.

Dependencies: Authority.

ReleaseOrchestrator

• Source: src/ReleaseOrchestrator/ (host __Apps/StellaOps.ReleaseOrchestrator.WebApi, agents under __Agents/)
• Docs: docs/modules/release-orchestrator/
• Type: Service (release-orchestrator, release-orchestrator-agent-ca-init; agent-core on an opt-in profile)
• Database: its own database, resolved from STELLAOPS_POSTGRES_RELEASE_ORCHESTRATOR_CONNECTION; migrations from StellaOps.ReleaseOrchestrator.Persistence applied on startup
• Endpoints: releases, environments, promotions, deployments, agents, topology setup and gates

Central release control plane for non-Kubernetes container estates: promotion across environments, security and policy gates, deployment dispatch to agents, and verifiable evidence. It does not serve /api/v1/workflows and does not call the Workflow engine.

Dependencies: Platform, Policy Engine, Scanner, Authority. Service, image, database and compose wiring: service inventory.

Remediation — RETIRED

• Source: frozen at src/__Obsoleted/Remediation/ (db34e0e09c, 2026-08-19)
• Docs: docs-archive/modules/remediation/ (frozen design record)
• Type: none; the Console remediation surfaces are AdvisoryAI’s autofix
• Database: PostgreSQL (1 SQL migration)
• Endpoints: 3

Developer-facing signed-PR remediation marketplace enabling discovery, application, and verification of community-contributed fix templates for known CVEs. Templates include unified diff content, version range applicability, and trust scores. Tracks PR submission lifecycle with attestation evidence.

Dependencies: Scanner, Signer / Attestor, Authority.

Replay

• Source: src/Replay/
• Docs: docs/modules/replay/
• Type: Service (replay-web)
• Database: its own database, resolved from STELLAOPS_POSTGRES_REPLAY_CONNECTION
• Endpoints: /v1/replay/* (verdict replay, bundles), /v1/pit/* (point-in-time query), /doctor/replay/checks

Deterministic replay engine ensuring vulnerability assessments can be reproduced given the same inputs. Manages replay tokens bound to input digests, manifests and verification. Stores content-addressed references, not the data itself.

Dependencies: Policy Engine and ReleaseOrchestrator (outbound); Scanner consumes Replay.Contracts.

RiskEngine — deployables retired, capability kept

• Source: src/Findings/StellaOps.RiskEngine.Core + __Libraries/StellaOps.RiskEngine.Infrastructure (libraries only — the WebService, Worker and Application projects were deleted 2026-08-27)
• Docs: riskengine/README.md(pointer) → findings/architecture.md; pre-consolidation dossier in docs-archive/modules/risk-engine/
• Type: Not a service. No compose key, no image, no HTTP surface.
• Database: the riskengine schema (risk_score_results), inside the Findings family’s stellaops_findings
• Endpoints: none — /risk-scores/* and /exploit-maturity/* were retired by owner ruling Q-2 (2026-08-25)

Deterministic, explainable risk scoring by aggregating signals from EPSS, CVSS, KEV, VEX, and fix-exposure data, with audit trails and explainability payloads. It does not make PASS/FAIL decisions; it provides scores to the Policy Engine. The scoring providers and the exploit-maturity taxonomy live in StellaOps.RiskEngine.Core, kept as a library with no production caller: only StellaOps.RiskEngine.Infrastructure and the RiskEngine test project reference it. A read API for scores will be designed on /api/findings/v1/* when a real consumer exists.

Dependencies: Concelier, Excititor, Signals, Policy Engine.

Router

• Source: src/Router/ (StellaOps.Gateway.WebService, transport libraries)
• Docs: docs/modules/router/
• Type: Service (router-gateway) and framework
• Database: None
• Endpoints: the HTTP front door for every microservice route, the Console static files, /doctor/router-gateway/checks

HTTP ingress gateway and internal transport: microservices announce their endpoints over the messaging transport (Valkey in the bundle); TCP and UDP transports are development-only. The gateway serves the built Console from /app/wwwroot.

Dependencies: Authority, Valkey, every microservice that registers routes.

RuntimeInstrumentation

• Source: src/RuntimeInstrumentation/
• Docs: docs/modules/runtime-instrumentation/
• Type: Library
• Database: None
• Endpoints: None

Tetragon-based runtime instrumentation library for eBPF-based process and syscall monitoring. Provides integration with Cilium Tetragon enabling observation of actual process execution, file access, and network activity at the kernel level for runtime evidence collection.

Dependencies: Tetragon (eBPF runtime), Zastava / Signals (evidence consumers).

SbomService

• Source: src/SbomService/
• Docs: docs/modules/sbom-service/
• Type: Service
• Database: PostgreSQL (1 SQL migration in Lineage persistence)
• Endpoints: 5

Canonical SBOM projection, lookup, and timeline API serving deterministic, tenant-scoped SBOM data. Does not perform scanning; consumes Scanner outputs or supplied SPDX/CycloneDX blobs. SBOMs are append-only with mutations via new versions only. Owns the SBOM lineage ledger for versioned uploads, diffs, and retention pruning.

Dependencies: Scanner, Graph, AdvisoryAI, Policy Engine.

Scanner

• Source: src/Scanner/
• Docs: docs/modules/scanner/
• Type: Service
• Database: PostgreSQL (36 SQL migrations, multiple DbContexts including TriageDbContext)
• Endpoints: 77 (EPSS, observability, reachability evidence, replay, score replay, unknowns, scan, and 71 more)

Deterministic SBOM generation and vulnerability scanning engine for container images and filesystems with three-way diffs, per-layer caching, and attestation hand-off. Emits Inventory and Usage views. Does not produce PASS/FAIL verdicts. Second-highest migration count covering scans, findings, call graphs, EPSS, smart diffs, unknowns, reachability, binary evidence, secret detection, runtime observations, and score history.

Dependencies: Signer, Attestor, Authority, object storage / RustFS, SBOM Service, Concelier / Excititor.

Scheduler (absorbed into JobEngine)

• Source: src/JobEngine/; the scheduler-web host and the scheduler worker host are frozen at src/__Obsoleted/JobEngine/ (c50d127955, 2026-09-12; 6db1f066c8, 2026-09-13)
• Docs: docs/modules/scheduler/(historical reference; see docs/modules/jobengine/)
• Type: none of its own; served by jobengine-web
• Database: PostgreSQL (11 SQL migrations, separate SchedulerDbContext)
• Endpoints: 8 (event webhook, failure signature, graph job, policy run, policy simulation, run, schedule, resolver job)

Re-evaluation scheduler keeping scan results current by pinpointing affected images when new advisories or VEX claims arrive. Default mode is analysis-only (no image pull). Includes event webhooks, failure signature tracking, graph jobs, policy runs/simulations, and vulnerability resolver jobs. Consolidated into JobEngine; DbContext remains separate.

Dependencies: Scanner.WebService, Policy Engine, Concelier / Excititor, Notify, JobEngine.

Sdk (archived – absorbed into Tools)

• Source: src/Tools/StellaOps.Sdk.Generator/
• Docs: docs/modules/tools/
• Type: Library / Code Generator
• Database: None
• Endpoints: None

Client SDK generator and release SDK for producing typed API clients across multiple languages from OpenAPI specifications. Absorbed into src/Tools/.

Dependencies: Gateway / OpenAPI specs.

Signals

• Source: src/Signals/
• Docs: docs/modules/signals/
• Type: Service
• Database: PostgreSQL (6 SQL migrations)
• Endpoints: 1 (SCM webhook)

Unified evidence-weighted scoring system aggregating reachability, runtime observations, backport detection, exploit intelligence, source trust, and mitigations into a single 0-100 score. Maintains determinism, provides score decomposition with explanations, and supports SCM webhook integration for change-triggered re-scoring.

Dependencies: Scanner, Concelier / Excititor, RuntimeInstrumentation, Policy Engine.

Signer

• Source: src/Attestor/StellaOps.Signer/
• Docs: docs/modules/signer/
• Type: Service (signer), the key-custody boundary; it stays outside the Evidence family
• Database: stellaops_signer, resolved from STELLAOPS_POSTGRES_SIGNER_CONNECTION
• Endpoints: signing, key ceremonies, key rotation, /doctor/signer/checks

The only service permitted to produce Stella Ops-verified DSSE signatures over SBOMs and reports. Does not push to Rekor. Regional crypto profiles are selected by compose overlays that mount crypto packs into the one image.

Dependencies: Authority, Cryptography library, KMS/HSM.

SmRemote

• Source: src/SmRemote/ (StellaOps.SmRemote.Service)
• Docs: docs/modules/sm-remote/
• Type: Service, opt-in only (devops/compose/docker-compose.crypto-provider.smremote.yml or docker-compose.sm-remote.yml); not in the release bundle
• Database: None
• Endpoints: /hash, /encrypt, /decrypt, /sign, /verify

Stateless service for Chinese SM2/SM3/SM4 operations, so deployments that require SM compliance can offload them. The HTTP transport contract lives in src/__Libraries/StellaOps.Cryptography.Sm.Contracts/.

Dependencies: StellaOps.Cryptography.Sm.Contracts and the SM provider plug-ins.

Symbols

The hub owns global symbol source/catalog management, admitted manifests, CAS metadata and resolution. See binary analysis and symbol ownership and the Vulnerabilities API. The old Symbols.Server source and its wire documentation are frozen.

TaskRunner (absorbed into JobEngine)

• Source: src/JobEngine/
• Docs: docs-archive/modules/taskrunner/ (historical reference; see docs/modules/jobengine/)
• Type: none of its own; served by the JobEngine family
• Database: PostgreSQL (via infrastructure layer, stub DbContext)
• Endpoints: Defined in JobEngine Program.cs

Deterministic task pack execution engine with approvals, sealed-mode enforcement, evidence capture, and DSSE attestation for every completed run. Three-phase execution: Plan (build execution graph), optional Simulation (dry-run with gates), and Execution (verify plan hash, execute steps, stream logs). Operates offline/air-gapped. Consolidated into JobEngine.

Dependencies: JobEngine, Authority, Attestor, object storage.

Telemetry

• Source: src/Telemetry/ (Core, Analyzers, Federation)
• Docs: docs/modules/telemetry/
• Type: Library
• Database: None of its own; federation installation state is Platform-owned
• Endpoints: None

OpenTelemetry-based metrics, traces and logs with Roslyn analyzers for metric-label cardinality and credential-logging hygiene, log redaction, sealed-mode egress guardrails, and opt-in federated telemetry (DSSE-signed consent, k-anonymity and differential-privacy aggregation).

Dependencies: an OTLP collector when exporting.

Tester (QA-only service – opt-in overlay)

• Source: src/Tester/ (StellaOps.Tester.WebService)
• Docs: docs/modules/tester/— dossier: tester/architecture.md; binding invariants: src/Tester/AGENTS.md
• Type: Service (opt-in QA overlay; not production-safe)
• Database: None (stateless; seed artefacts from a read-only mount)
• Endpoints: /api/v1/tester/* — fixture import and per-scenario action endpoints (e.g. audit inject-batch, Authority proxy-login) plus POST /api/v1/tester/replay-and-compare, the determinism oracle

Dedicated QA harness service owning the fixture-injection endpoints that would otherwise leak into production modules. It must never reach a production stack: it lives in a standalone overlay (devops/compose/docker-compose.tester.yml, labelled com.stellaops.production-safe: "false") that is deliberately excluded from docker-compose.stella-ops.yml and every include: list; it only starts when an operator explicitly passes the overlay. Networks are declared external, so it refuses to come up without the base stack. It also authenticates nobody — every route is AllowAnonymous, bearer tokens are relayed unvalidated to the downstream service, tenant comes from a caller-supplied header, and proxy-login is an unauthenticated credential relay with source-IP injection. That is the harness contract, and it is why exposure is disqualifying.

Two caveats the dossier records and does not fix: only the findings scope of replay-and-compare is backed by a run-scoped upstream read (other scopes return indeterminate); and the isolation goal is not yet complete — Platform/Notify/Scanner still ship their embedded fixture endpoints, with Platform’s flag default-ON in the main compose.

Dependencies: Platform, Notify, Scanner, Findings, Evidence, ReleaseOrchestrator, Timeline, Authority (the modules it drives over public REST). Its Concelier advisory-import fixture targets a retired host and has no upstream.

Timeline

• Source: src/Timeline/
• Docs: docs/modules/timeline/
• Type: Service
• Database: PostgreSQL (1 SQL migration in Timeline.Core)
• Endpoints: 3 (export, replay, timeline)

Timeline query service providing export, replay, and timeline browsing endpoints for vulnerability history and event streams. Uses shared libraries from StellaOps.Eventing for event envelope schemas and StellaOps.Timeline.Core for core logic including critical path view.

Dependencies: All services (event sources). TimelineIndexer is now consolidated into the Timeline module (src/Timeline/).

Tools

• Source: src/Tools/; retired tools frozen at src/__Obsoleted/Tools/
• Docs: docs/modules/tools/
• Type: Developer tools
• Database: None
• Endpoints: None

Developer and CI utilities: benchmarks, GoldenPairs, LanguageAnalyzerSmoke, NotifySmokeCheck, PolicyDslValidator, PolicySchemaExporter, PolicySimulationSmoke, RustFsMigrator, the OpenAPI doc and SDK generators, the verifier, TlptScoper, the developer portal site, and a Python CERT-Bund offline snapshot tool. Distinct from the operator CLI.

Dependencies: Various (tool-specific).

Unknowns

• Source: src/Unknowns/
• Docs: docs/modules/unknowns/
• Type: Service
• Database: PostgreSQL (UnknownsDbContext, 4 SQL migrations)
• Endpoints: 2 (grey queue, unknowns)

Structured registry for tracking unresolved components, symbols, and incomplete mappings that Scanner and other analyzers cannot definitively identify. Includes a Grey Queue for lifecycle management (queueing, triage, resolution). Does not guess identities; records what cannot be determined.

Dependencies: Scanner, Signals.

Verifier (archived – absorbed into Tools)

• Source: src/Tools/StellaOps.Verifier/
• Docs: docs/modules/tools/
• Type: CLI Tool
• Database: None
• Endpoints: None

Standalone CLI tool for verifying the integrity and authenticity of signed evidence bundles produced by the platform. Absorbed into src/Tools/.

Dependencies: None (standalone verification).

VexHub — RETIRED

• Source: deleted 2026-08-05 (SPRINT_20260722_003 VULN-B1)
• Docs: docs-archive/modules/vex-hub/ — retirement stub + historical record
• Type: none (service stopped in the SPRINT_20260722_008 G1 window, 2026-08-04)
• Database: none — the vexhub schema was dropped in that window
• Endpoints: none — the B7 route swap removed every route reaching it

Superseded by the vulnerability hub, which models VEX as facts rather than statements/ observations and serves GET /api/vulnerabilities/v1/vex/{vulnerabilityId}/{productKey}. This is a narrower successor: no observation model, no per-statement signature records, no Rekor linkage.

VexLens — RETIRED

• Source: deleted 2026-08-05 (SPRINT_20260722_003 VULN-B1)
• Docs: docs-archive/modules/vex-lens/ — retirement stub + historical record
• Type: none (service stopped in the SPRINT_20260722_008 G1 window under owner ruling P8)
• Database: the vexlens schema was NOT in G1’s drop list and may still exist in stellaops_platform; dropping it is an unclaimed ops action
• Endpoints: none — the B7 route swap removed /api/v1/vexlens

SPRINT_20260722_022 EVL-1 decided a fold, and only half of it happened: consensus is covered by the hub’s consensus schema, but noise gating has no successor anywhere in the estate — G1 retired the surface instead of migrating it. The source is recoverable from git history.

Vulnerabilities (the live vulnerability plane)

• Source: src/Vulnerabilities/
• Docs: docs/modules/vulnerabilities/architecture.md
• Type: Service (vulnerabilities-web + vulnerabilities-worker)
• Database: stellaops_vuln — its OWN database (ADR-039), schemas ingest/facts/consensus/dist (no table since migration 020)/runtime/binaries/symbols + the shared eventing reliability schema
• Endpoints: /api/vulnerabilities/v1/* — readiness, lookup, corpus export, EPSS, issuer submission, event catch-up

The consolidation of Concelier (incl. Feedser + Excititor) + VexHub into one tenant-free vulnerability knowledge hub. Tenant-scoped decisions do NOT live here — they live in the control plane. Policy stores one tenant-free gate row per issue scope (policy.vuln_gate_global; a release scope that repeats the issue’s unscoped outcome is folded into that row) and tenant override rows (policy.vuln_gate_current); readers compose them through policy.vuln_gate_effective. Tenant VEX decisions live in the Findings ledger.

Currency: LIVE since the SPRINT_20260722_008 G1 cutover (2026-08-04). The old plane’s services are stopped, its vuln/vex/vexhub/concelier schemas are dropped, and its 70 gateway routes are gone. The VexHub and VexLens entries below are retirement stubs; the Concelier and Excititor entries describe a retired service whose source tree survives only because production projects still compile against parts of it.

Dependencies: Authority (auth + issuer directory), Router/Gateway. Consumers reach it via the API, events, or the corpus artifact — the only source-referenceable projects are the closed Contracts and Consensus SDKs.

VulnExplorer

• Source: (no standalone project) — merged into src/Findings/__Libraries/StellaOps.Findings.Ledger.Application/ (Endpoints/VulnExplorerEndpoints.cs, Contracts/VulnExplorer/, Services/VulnExplorerAdapters.cs) and mapped by the consolidated src/Findings/StellaOps.Findings.WebService; the standalone container was decommissioned, and the findings-ledger-web host that first absorbed this family was itself withdrawn to src/__Obsoleted/ at FND-20 (2026-08-28)
• Docs: live surface → findings/architecture.md; historical dossier → docs-archive/modules/vuln-explorer/
• Type: Endpoint family inside the consolidated Findings WebService
• Database: findings schema (VEX decisions in findings.vex_decisions)
• Endpoints: /v1/vulns*, /v1/vex-decisions*, /v1/evidence-subgraph/{vulnId}, /v1/fix-verifications*, /v1/audit-bundles under vuln:view / vuln:operate / vuln:audit

Vulnerability exploration API providing rich querying, filtering, and analysis of vulnerability findings across the platform. Aggregates data from Scanner, Concelier, Excititor, Policy, and Signals to present a unified vulnerability view with concept-based navigation and evidence links.

Dependencies: Scanner, Concelier, Excititor, Policy Engine, Signals, Findings Ledger.

Web

• Source: src/Web/StellaOps.Web/
• Docs: docs/modules/ui/(canonical Console dossier); docs/modules/web/keeps the per-surface feature contracts and the UX rule catalog that source cites
• Type: UI (Angular SPA), served by router-gateway from /app/wwwroot
• Database: None
• Endpoints: None

Angular operator console: release management, policy, evidence, SBOM exploration, vulnerability triage, notifications and administration.

Dependencies: the gateway and the backend APIs behind it.

Workflow (source retained – service dormant)

• Source: src/Workflow/
• Docs: docs/modules/workflow/ (architecture.md, analyzer.md, slot-lattice.md, api-reference.md, openapi/)
• Type: Service (dormant — not deployed; only the workflow-web publish key exists)
• Database: PostgreSQL workflow schema with fixed table names (RFC-14 Q-45); connection only from STELLAOPS_POSTGRES_WORKFLOW_CONNECTION, failing closed
• Endpoints: /api/workflow/* only if the dormant WebService is explicitly hosted — no compose service, no Router route

General-purpose workflow engine: definition deployment, instance lifecycle, signal-driven task transitions, dead-letter handling and retention. The source is retained but the service is dormant by owner ruling. No host serves /api/v1/workflows, and ReleaseOrchestrator does not call this engine. Its workflow:view / workflow:operate / workflow:admin policies are local strings, not canonical Authority scopes; reactivation needs an explicit product decision (scopes, grants, callers, compose wiring, gateway route).

Dependencies: none live today.

Zastava — RETIRED

• Source: none; src/Zastava/ no longer exists
• Docs: docs-archive/modules/zastava/ (retirement record)
• Type: none; the Kubernetes runtime direction is retired
• Database: None (stateless agents)
• Endpoints: Webhook endpoints, agent APIs defined in Program.cs

Runtime posture concepts are being re-scoped into RuntimeInstrumentation host agents for non-Kubernetes container estates. The former Zastava Kubernetes admission-webhook direction is retired and must not be used for new Stella Ops deployment work.

Dependencies: Scanner.WebService, Policy Engine, Signals, Attestor, Authority.

Documentation Standards

Each module folder should contain:

Use the _template/ scaffold (README.md, architecture.md, AGENTS.md) as the starting point for new module docs.