Advisory AI

Verified against commit 942a18727c on 2026-09-26 (UTC). Re-verify: git grep -n "serviceName: \"advisoryai\"\|AddServiceDoctorChecks" -- src/AdvisoryAI/StellaOps.AdvisoryAI.WebService/Program.cs and grep -nE "^ advisoryai-(web|worker|data-init):" devops/compose/docker-compose.advisoryai.yml devops/release/bundle/docker-compose.yml.

Service rows (host project, image, database and role, compose file, bundle presence, Doctor registration) are generated in docs/architecture/service-inventory.md; where this page and the inventory differ, the inventory is authoritative.

Advisory AI is the retrieval-augmented assistant of Stella Ops. It turns advisory, VEX, policy, SBOM and finding evidence into cited summaries, conflict explanations, remediation plans, chat answers and Evidence Packs, and it hosts Knowledge Search, Unified Search and the OpsMemory decision ledger.

Purpose

Advisory AI answers operator questions from the platform’s own evidence and records what it answered. Every generated output carries its inputs’ digests and citations. Inference is pluggable: a local in-house gateway, or signed LLM provider plugin bundles admitted at startup. OpsMemory, the decision ledger with playbook suggestions, is a module of this family, not a separate service.

Deployables

• Both roles and the init container are defined in devops/compose/docker-compose.advisoryai.yml. That file is a family overlay outside the default compose chain; operators add it with -f.
• Build keys advisoryai-web and advisoryai-worker live in devops/docker/build-service-publish.sh and devops/docker/services-matrix.env (slot 45).
• The release bundle does not deploy Advisory AI. The bundle’s platform service still names STELLAOPS_ADVISORYAI_URL and STELLAOPS_OPSMEMORY_URL as http://advisoryai.stella-ops.local, so those Platform features have no backend in a bundle-only install.
• Router microservice name: advisoryai (AddRouterMicroservice in the web Program.cs).
• Network aliases: advisoryai.stella-ops.local, advisoryai-web.stella-ops.local, advisoryai-worker.stella-ops.local.

Database

• Database stellaops_advisoryai, schemas advisoryai and opsmemory.
• Connection: STELLAOPS_POSTGRES_ADVISORYAI_CONNECTION, or Postgres:AdvisoryAI:ConnectionString. There is no generic or legacy fallback; hosts outside an explicit local harness fail closed.
• Migrations: src/AdvisoryAI/__Libraries/StellaOps.AdvisoryAI.Persistence/Migrations/, an immutable consolidated baseline 001 plus forward migrations. AddConsolidatedAdvisoryAiPersistence registers them with AddStartupMigrations; only advisoryai-web calls it. The worker uses the runtime DAL and never registers migrations.
• Queue, plan cache and outputs are file-backed under /var/lib/advisory-ai/{queue,plans,outputs}, prepared by advisoryai-data-init.

API surface

The web host maps each family below on its legacy path and again under the native root /api/advisoryai/v1 (Endpoints/AdvisoryAiConsolidatedRouteAliases.cs).

Scopes: advisory-ai:view, advisory-ai:operate, advisory-ai:admin, ops-memory:read, ops-memory:write (StellaOpsScopes.cs). The generated reference is api-reference.md.

Configuration

Guardrail and operator knobs are described in ../policy/guides/assistant-parameters.md.

Doctor checks

• AddServiceDoctorChecks("advisoryai-web") registers the standard service checks against the own database.
• doctor.advisoryai.retention.chat-audit, doctor.advisoryai.retention.conversation-state and doctor.advisoryai.retention.search-telemetry (StellaOps.AdvisoryAI.WebService/Retention/).
• Registration with the Platform Doctor registry is opt-in through Doctor:Registration:Enabled. The overlay defaults it to false (ADVISORYAI_DOCTOR_REGISTRATION_ENABLED).

Integrations

• The worker drains the file-backed queue with AdvisoryTaskWorker and reads advisory documents from the Vulnerabilities hub owner API (AdvisoryAI:DocumentProvider:Hub:BaseAddress).
• Unified Search live adapters call the Findings, Vulnerabilities and Policy owner APIs (AdvisoryAI:KnowledgeSearch:{Findings,Vex,Policy}AdapterBaseUrl in the overlay) with the stellaops-advisory-ai-internal Authority client.
• Unified audit events go to Timeline through StellaOps.Audit.Emission.

Retention

Every table carries a retention class (SPRINT_20260916_001 RFC-13, settled under owner ruling Q-41 on 2026-09-23). advisoryai.entity_alias is derived-rebuildable: the unified indexer rewrites it on every pass and rebuild (migration 007). Idle conversations are reclaimed after 7 days with their turns (migration 006); the chat audit lineage keeps its 90-day window (migration 003). Receipt: retention-classification-verification-20260923.json. The overlay still ships SearchAnalyticsRetentionEnabled off, so the search telemetry Doctor check reports unhealthy until an operator enables it.

Retired predecessors

• advisory-ai-web, advisory-ai-worker: replaced by advisoryai-web and advisoryai-worker on 2026-09-07 (SPRINT_20260722_013 AAI-10).
• opsmemory-web: host frozen at src/__Obsoleted/AdvisoryAI/StellaOps.OpsMemory.WebService/; the routes are served by advisoryai-web. The former OpsMemory dossier is archived at docs-archive/modules/opsmemory/ (the 2026-09-26 retirement copy is under retired-20260926/).

Subordinate documents

The Knowledge Search document manifest (src/AdvisoryAI/StellaOps.AdvisoryAI/KnowledgeSearch/knowledge-docs-manifest.json) records every markdown file in this directory that knowledge search indexes, by path and sha256 (pages carrying a retirement banner are skipped; the rule is in AGENTS.md). Adding, editing, moving or deleting a file here commits the regenerated manifest (python tools/scripts/validate/check-advisoryai-docs-manifest.py --write) in the same change; the Repo hygiene CI lane fails otherwise. See knowledge-search.md.