Aggregation-Only Contract (AOC) Guardrails

WITHDRAWN (2026-09-27, SPRINT_20260927_003 PCD-62). The AOC libraries (StellaOps.Aoc, StellaOps.Aoc.AspNetCore), the StellaOps.Aoc.Analyzers Roslyn analyzer and the CLI Aoc plug-in are no longer built or shipped. Their sources are frozen under src/__Obsoleted/Aoc/ and src/__Obsoleted/Cli/ (CODE_OF_CONDUCT 15.4). No service referenced them, and the plug-in’s direct-PostgreSQL verify form (--postgres option) read an aoc_documents table that no migration creates. This page describes the withdrawn code and is kept for reference. Still live and separate: the aoc:verify scope. The core CLI aoc command was withdrawn on 2026-10-01 (SPRINT_20260928_008 PCD-153); the Platform /api/v1/aoc/* compatibility endpoints (Development and testing only) and the Console AOC pages were withdrawn on 2026-10-08 (SPRINT_20261007_002 CCP-005 and CCP-004).

The Aggregation-Only Contract (AOC) keeps Stella Ops ingestion deterministic and policy-neutral: raw facts go in, and no opinions are formed at write time. Use these checkpoints whenever you add or modify ingestion-path work. They are written for service owners and reviewers working on any ingestion surface. The advisory and VEX ingestion services that first adopted these rules (Concelier, Excititor) are retired; production advisory and VEX ingestion is the vulnerability hub (../../vulnerabilities/architecture.md).

  1. Ingestion writes raw facts only. Ingestion appends immutable observations. No precedence, severity, suppression, or “safe fix” hints may be computed at ingest time.
  2. Derived semantics live elsewhere. Policy evaluation, findings composition, and downstream reporting attach severity, precedence, policy verdicts, and UI hints.
  3. Provenance is mandatory. Every ingestion write must include original source metadata, digests, and signing/provenance evidence when available. Reject writes lacking provenance.
  4. Deterministic outputs. Given the same inputs, ingestion must produce identical documents, hashes, and event payloads across reruns.
  5. Guardrails in code. The StellaOps.Aoc runtime guard and the StellaOps.Aoc.Analyzers Roslyn analyzer (AOC0001-AOC0003) are available to fail writes and builds that attempt forbidden fields. At commit 942a18727c no live deployable references them; see ../architecture.md §7.

For roles and ownership boundaries, see AGENTS.md at the repo root and the module dossiers under docs/modules/<module>/architecture.md.