StellaOps Attestor

Verified against commit 942a18727c (2026-09-26, DOC-2 of SPRINT_20260926_001). Re-verify by reading the evidence paths listed in the Evidence section.

Service wiring (image, database and role, compose profile, bundle presence) is generated in the service inventory; this dossier does not restate it.

Status: the attestor deployable is RETIRED (2026-09-05). This directory is a pointer stub plus the format, predicate and algorithm reference that moved unchanged into the Evidence family.

Successor dossier: ../evidence/architecture.md.

What runs today

• Retired host. The attestor host shell is frozen at src/__Obsoleted/Attestor/StellaOps.Attestor/StellaOps.Attestor.WebService/ (owner ruling D-EVD5-7, executed as SPRINT_20260722_011 EVD-10a). Its application layer moved to src/Evidence/__Libraries/StellaOps.Attestor.Application/ and is composed by evidence-web, which registers with the Router as evidence. The Router service name attestor, the compose key attestor and the attestor.stella-ops.local alias are gone from the dev estate (devops/compose/docker-compose.stella-services.yml) and the release bundle (devops/release/bundle/docker-compose.yml).
• Routes. The minimal-API surface (attestations*, rekor/*, transparency/*, attestor/links, watchlist*) is served at /api/evidence/v1/..., for example POST /api/evidence/v1/rekor/entries. The predicate registry (/api/v1/attestor/predicates) and the MVC controllers keep their attribute routes. Full surface: ../evidence/architecture.mdand ./architecture.md§4.
• Database. Attestation tables (attestor.*, proofchain.*) live in the consolidated Evidence database (STELLAOPS_POSTGRES_EVIDENCE_CONNECTION) and are migrated by src/Evidence/__Libraries/StellaOps.Evidence.Persistence/Migrations/.
• src/Attestor/ still exists because it holds the signer and attestor-tileproxy hosts, the Signer libraries, and shared attestation libraries (StellaOps.Attestation, StellaOps.Attestor.Envelope, StellaOps.Attestor.Types, StellaOps.Provenance.Attestation, __Libraries/StellaOps.Attestor.{EvidencePack,FixChain,GraphRoot,Oci,Offline,Timestamping}). src/Attestor/StellaOps.Attestor.WebService/ is a verdict-ledger endpoint library without a Program.cs; it is not the retired host.

Where things went

Reference material kept in this directory

These documents describe formats and algorithms that moved unchanged into src/Evidence/__Libraries/StellaOps.Attestor.* (or stayed in src/Attestor/ libraries). Statements in them about hosts, containers, ports or compose keys are historical.

• Formats and algorithms: architecture.md, bundle-format.md, proof-chain-specification.md, proof-spine-algorithm.md, transparency.md, rekor-verification-design.md, timestamp-assurance-design.md, dsse-roundtrip-verification.md, repro-bundle-profile.md, build-profile.md.
• Predicates: predicate-schema-registry.md, fix-chain-predicate.md, operator-decision-predicate.md, vex-override-predicate.md, graph-root-attestation.md, payloads.md, schemas under schemas/.
• Interoperability: cosign-interop.md, cosign-verification-examples.md, intoto-link-guide.md, tuf-integration.md, guides under guides/.
• Operations: operations/ (observability runbook and dashboard, bundle rotation, the 2026-09-12 consumer-acceptance record) and the frozen acceptance evidence under evidence/.
• Wire shape: the attestor routes are served by the consolidated Evidence host under /api/evidence/v1; the generated reference is ../evidence/api-reference.md(source ../evidence/openapi/v1.json). The predecessor host’s generated capture is archived under docs-archive/modules/attestor/. openapi/proofs-openapi.yaml is a hand-written design record.

Supported library surface (consumer review, 2026-10-08)

The PCD-466 consumer review removed members that had no source, test or host consumer (pre-release removal, no deprecation shims):

• StellaOps.Attestation.DsseEnvelopeExtensions.ToSerializableDict, GetPayloadString and GetPayloadBase64. FromBase64 remains; canonical wire JSON comes from DsseEnvelopeSerializer.Serialize(envelope).CompactJson (StellaOps.Attestor.Envelope).
• The uncomposed VerdictEndpoints.MapVerdictEndpoints route mapper in the Attestor verdict-ledger handler class library, together with the three private handlers only it used; no host mapped it. The Evidence host’s own, composed verdict mapper is unchanged.
• The DI registration extensions AddFixChainAttestation (two overloads), AddFixChainAttestationStore, AddFixChainRekorClient, AddGraphRootAttestation (two overloads), AddAttestorOffline and the two AddKeylessSigning overloads. No production host called them; the libraries’ services, parsing/verification and signing algorithms remain, and a consumer composes them directly.

The Types generator (StellaOps.Attestor.Types.Generator) has a test consumer: GeneratorConsumerTests builds it through a build-only ProjectReference, runs it into scratch under tmp/scratch/, and requires the emitted schemas and Go/TypeScript files to equal the committed assets. This proves the generator and its generated TypeScript corpus have a source/test consumer; it is not an npm-package, production SDK or deployed-service claim. Re-verify with tools/scripts/test-targeted-xunit.ps1 on the Types, Attestation, FixChain and GraphRoot test projects and python3 tools/scripts/validate/check-consumer-census.py.

Formats that did not change

• Versioned payload schemas — StellaOps.BuildProvenance@1, StellaOps.SBOMAttestation@1, StellaOps.ScanResults@1, StellaOps.VEXAttestation@1, StellaOps.PolicyEvaluation@1, StellaOps.RiskProfileEvidence@1 — are generated by StellaOps.Attestor.Types (src/Attestor/StellaOps.Attestor.Types/Tools/StellaOps.Attestor.Types.Generator/, fixtures under src/Attestor/StellaOps.Attestor.Types/Fixtures/v1/).
• In-toto predicate URIs are tracked in proofchain.predicate_type_registry and listed by GET /api/v1/attestor/predicates (Endpoints/PredicateRegistryEndpoints.cs). Routing and validation go through PredicateTypeRouter; an unregistered predicate yields a validation error.
• DSSE envelopes are canonicalised, hashed and stored with the transparency UUID, index and proof. Multiple signatures per envelope are supported. Proofs carry the Merkle inclusion path and checkpoint metadata. The local Stella transparency log (stellaops://attestor/local-transparency) is the default primary; external Rekor-compatible logs are an operator-configured mirror.
• Scopes. The policy names attestor:read, attestor:verify and attestor:write map to the canonical claims attest:read and attest:create (Security/AttestorPolicies.cs); the identity watchlist uses watchlist:* policy names.

Evidence