Aggregation-Only Contract (AOC) Guardrails

The Aggregation-Only Contract (AOC) keeps Stella Ops ingestion services deterministic and policy-neutral: raw facts go in, and no opinions are formed at write time. Use these checkpoints whenever you add or modify ingestion-path work. They are written for service owners and reviewers working on Concelier, Excititor, and other ingestion surfaces.

  1. Ingestion writes raw facts only. Concelier and Excititor append immutable observations/linksets. No precedence, severity, suppression, or “safe fix” hints may be computed at ingest time.
  2. Derived semantics live elsewhere. Policy Engine overlays, Vuln Explorer composition, and downstream reporting layers attach severity, precedence, policy verdicts, and UI hints.
  3. Provenance is mandatory. Every ingestion write must include original source metadata, digests, and signing/provenance evidence when available. Reject writes lacking provenance.
  4. Deterministic outputs. Given the same inputs, ingestion must produce identical documents, hashes, and event payloads across reruns.
  5. Guardrails everywhere. Roslyn analyzers, schema validators, and CI smoke tests should fail builds that attempt forbidden writes.

For detailed roles and ownership boundaries, see AGENTS.md at the repo root and the module dossiers under docs/modules/<module>/architecture.md.