Evidence consolidation — S0 target design (SPRINT_20260722_011 EVD-1)

Status: S0 DRAFT for review (2026-08-03). Verification base: the sprint’s recorded dig rounds (12/17 internals, EVL-4 owner approval), the live migration baselines (tables re-enumerated from src/ this pass), and the 2026-08-03 build-boundary register. Sections marked ⚠ carry explicit remaining-verification notes. Update 2026-08-03: all ⚠ marks are CLOSED (second pass, verified against src//live) — see §2.1, §2.3, §4, §5.

1. Current → target shape

Name collision, D-EVD3-14 (2026-08-10, EVD-3 Stage B). The D12 target DAL name this table and docs/architecture/database-ownership-matrix.md §5.2 both originally specified — StellaOps.Evidence.Persistence — is already taken by src/__Libraries/StellaOps.Evidence.Persistence, an unrelated shared library that owns a different evidence schema (generic evidence records, EF Core, once migrated centrally by platform-web’s EvidenceMigrationModulePlugin — deleted with the plugin mechanism on 2026-09-14, SPRINT_20260722_021 PLT-4) and is compiled by Platform.Database. Two projects cannot share an assembly name, so the merged DAL takes the .Consolidated suffix, following Notify / Timeline / ReleaseOrchestrator / Integrations / CredentialStore. The two evidence schemas never meet: that library’s lives in the shared platform database, the family’s lives in stellaops_evidence and holds only the migration ledger pair. | Excluded | Signer (key-custody boundary, non-negotiable) — consumed only through its client contract | unchanged |

2. Table inventory + dispositions (P13)

Re-enumerated from the live baselines this pass.

2.1 attestor (9 tables)

2.2 proofchain (8 tables + 1 materialized view)

dsse_envelopes, spines, graph_nodes, graph_edges, rekor_entries, sbom_entries, trust_anchors, predicate_type_registry — the proof-chain spine. All evidence/append or registry class; carry. The EVD-9 gate covers spines linkage too (round 17).

Corrected 2026-08-10 (EVD-3 Stage B, measured). This section said “9 tables” and included audit_log. There is no such table: the collapsed legacy baseline CREATEs it (mig061/001) and then DROPs it (mig061/004 — superseded by timeline.unified_audit_events), so the converged shape has eight. Reproducing it in the fresh baseline would have resurrected a table the estate deliberately retired. The section also omitted proofchain.artifact_canonical_records, a materialized view (the Evidence Thread read projection, REFRESH … CONCURRENTLY-able via its unique index), which does carry. Both facts come from applying the legacy chains to a throwaway instance and dumping the result, not from re-reading the migration files.

§2.1 above is titled “9 tables” while listing ten; ten is right, and the fresh baseline pins the exact set per schema (10 + 8 + 13).

2.3 vex.trust_verdicts (Attestor.TrustVerdict) — RESOLVED: DEAD WIRING (2026-08-03)

The mis-homing is only ON PAPER. StellaOps.Attestor.TrustVerdict has zero production consumers: no host references the project, nothing calls its registration extensions, and vex.trust_verdicts does not exist in the live database (its 001_create_trust_verdicts.sql — which would CREATE SCHEMA vex from an Attestor library — never ran anywhere). The library is a complete unshipped feature (service, OCI attacher, metrics, canonicalizer, RLS’d migration). OWNER RULING (2026-08-03, review item A7): DELETE (“ok, delete it”) — the library, its tests, and its never-applied migration are removed outright; no park, no adoption. Dead-wiring find #6 for the program.

EXECUTED 2026-08-03 (commit 38dd5fa): zero-consumer claim re-verified independently before deletion, then src/Attestor/__Libraries/StellaOps.Attestor.TrustVerdict/, its test project, and an orphan src/Attestor/__Tests/StellaOps.Attestor.TrustVerdict.Tests/TrustVerdictIntegrationTests.cs (a file with no .csproj — it never compiled) were removed, along with the entries in src/StellaOps.sln and src/Attestor/StellaOps.Attestor.sln. 83 files, 6 618 deletions, zero insertions. StellaOps.Attestor.WebService builds clean afterwards, and the build-boundary report regenerates byte-identical — the library was never a boundary participant. vex.trust_verdicts therefore cannot enter the fresh S3 baseline; nothing to park or adopt.

2.4 evidence_locker (13 tables; TWO migration homes — baseline hazard, RESOLVED)

StellaOps.EvidenceLocker/Migrations/ AND …Infrastructure/Db/Migrations/ both define verdict_attestations — live evidence 2026-08-03: the live DB holds ONE evidence_locker.verdict_attestations whose 16 columns MATCH the root Migrations/ home’s definition (verdict_id…rekor_log_index+timestamps); the fresh baseline adopts that shape and the duplicate definition dies with the collapse.

Resolved 2026-08-10 (EVD-3 Stage B) — the hazard is narrower than “two homes” suggests. The root home, src/EvidenceLocker/StellaOps.EvidenceLocker/Migrations/001_CreateVerdictAttestations.sql, is not an embedded resource of any project — StellaOps.EvidenceLocker.csproj declares no EmbeddedResource for Migrations\*.sql, only <Compile Remove> entries — and no code references it by name. It has therefore never applied anywhere, so this was one live definition and one dead file rather than a genuine double-definition race. The fresh baseline carries the Infrastructure shape (16 columns, verified) and the dead file dies with the collapse as planned.

3. Build-boundary dispositions (2026-08-03 register)

• Family-internal after the merge: attestor-tileproxy → attestor, evidence-locker-web → attestor — die by consolidation.
• → signer (from attestor, tileproxy, evidence-locker): stays a boundary — Signer is excluded by custody rule; the seam becomes the Signer client contract only (closed-graph verified), never implementation.
• attestor → concelier — hub repoint (003 consumer family; SourceIntel was flagged genuinely contract-shaped in the 003 survey — candidate closed-SDK classification).
• attestor → scanner — DC-15-class read seam with 017.
• Inbound (callers compiling THIS family — the merge must publish ONE closed Evidence client/contracts SDK): Policy (EvidenceLocker.Core + Attestor assemblies), ExportCenter (compiles the EvidenceLocker SERVICE project), VexLens/Findings (Attestor assemblies), SbomService (attestor family pin, 5 projects). The closed-SDK surface is the S0 deliverable that unblocks those programs’ repoints.

Reality note (2026-08-05, EVD-3 D-EVD3-1). The sentence above described the closed Evidence SDK as though it existed. It did not: src/EvidenceLocker had no client/contracts project of any kind, and ExportCenter reached the TLPT evidence-pack records and CapsuleManifestCanonicalizer by referencing StellaOps.EvidenceLocker.csproj — the SERVICE. Sprint 025 OK-4 (D-OK4-5) hit this as a hard blocker and left the OfflineKit hosts unwired rather than import the edge. The SDK now exists as src/EvidenceLocker/__Libraries/StellaOps.EvidenceLocker.Contracts (EVD-3 Stage A) and carries the wire manifests plus the canonicalisation rule only. Treat “closed Evidence SDK” in this document as the SINGULAR final surface the merge converges on; the locker-side contracts project is its first, live instalment, not the whole of it — the attestor-side carriers are classified separately in the ownership manifest.

4. Role topology (EVD-1 decision input)

Recommendation: one family, four run shapes — evidence-web (API: attestor + locker surfaces), evidence-worker (queues: rekor submission, bulk verification, locker export/pack jobs), evidence-tileproxy (existing proxy, unchanged runtime role), tsa (unchanged openssl infra container; compose grouping + docs ownership only). Availability argument: the web/worker split preserves today’s locker worker isolation; tileproxy stays a stateless edge; nothing gains a new single point of failure. Tileproxy config surface VERIFIED (2026-08-03): env prefix TILE_PROXY__tile_proxy__* (an idiosyncratic double-nested binding — the rename must carry or alias this exact surface: UpstreamUrl/Origin/Sync/Cache keys), tile cache on a mode-1777 tmpfs (rebuildable — stateless confirmed), cert volume + attestor-tileproxy.stella-ops.local alias; runs LIVE today alongside all five siblings.

4.1 Timestamp Assurance proposal (2026-08-19; not an owner ruling)

Owner-decision register item 14 asked for a separate sprint/information pack for the 22 orphaned Doctor Timestamping checks. The source-grounded recommendation is to place a Timestamp Assurance subsystem inside this Evidence family, split between evidence-web (authenticated API plus 17 installation-scoped doctor-check/v1 checks) and evidence-worker (scheduled probes, five tenant-scoped evidence checks, and re-timestamp work). This is proposed and unimplemented; it does not alter the approved EVD topology or claim owner acceptance.

The proposal creates no deployable or database. The OpenSSL tsa remains the database-less infrastructure role described above, and its private key stays in the operator-controlled tsa-data custody boundary; neither Evidence host mounts it. Signer remains excluded and separate. OfflineKit transports a versioned content-addressed trust bundle while Evidence owns semantic validation and retained evidence, avoiding the current Doctor plugin’s P19-invalid direct AirGap.Importer reference. The existing Evidence doctor checks (database identity, append-only, forced RLS, verdict-chain linkage, and legal-hold integrity) do not overlap timestamp issuance, token/trust/revocation posture, or time correlation.

Full source census, the row-by-row 22 → 17 installation + 5 tenant map, security/retention model, and first safe implementation slice: Timestamp Assurance design. Executable proposal: SPRINT_20260819_001.

4.2 EVD-5 source-composition checkpoint (2026-08-22)

The target hosts are no longer idle skeletons. evidence-web composes the two application layers extracted at EVD-4 without referencing either predecessor host project. Every compatibility connection key is assigned from the already fail-closed STELLAOPS_POSTGRES_EVIDENCE_CONNECTION resolution, so the carried repositories cannot select a legacy/shared database. The target composition suppresses Attestor.Persistence startup migrations, the private EvidenceLocker migration runner and every background loop in the web role; only StellaOps.Evidence.Persistence.Consolidated converges the database. The extracted endpoint mappers now accept a route prefix, and the target maps the manifest’s nine passthrough families natively at /api/evidence/v1/**, including a target alias on the proof controller.

evidence-worker has likewise stopped running the idle EvidenceQueueWorker. It composes the Attestor Rekor retry, bulk verification and configured transparency-sync workers plus the Locker retention and legacy-PII audit loops against the same one database, without either predecessor migration authority. A real-host test asserts representative target routes, proves those loops are absent from the web role, proves they are present in the worker role, and proves the Locker legacy migration host is absent from both. The focused composition tests are 2/2 and the full adjacent Evidence host project is 23/23; both target roles and all three touched predecessor roles build.

The six gateway-rewritten Locker groups (score, snapshot, UUID retrieval, QA assurance cases, verify, hold) have now been extracted into the owner application surface. The predecessor maps them at their unchanged /evidence/** paths; evidence-web maps the same methods, policies, endpoint names and prefix-aware resource links beneath /api/evidence/v1/evidence/**. Focused route-inventory and unauthenticated-behaviour tests pin the target surface.

This closes only the API-surface gap. The EVD-9 preflight remains NO-GO and the target is not cutover-ready.

The setup-owned default region and the tenant slug-to-UUID source path are now closed. The target requires Catalog:Replication:Tenants:Enabled=true, auto-migrates catalog_replica and eventing inside stellaops_evidence, and replaces only its carried IEvidenceLockerTenantResolver with an adapter over ReplicaStellaOpsTenantResolver. Exact active slugs resolve locally; suspended, tombstoned and measured-unknown slugs return no tenant; an unreadable or never-converged replica throws CatalogReplicaUnavailableException rather than manufacturing an absence. The live EvidenceLocker predecessor and its resolver remain unchanged. The complete Evidence web test project passed 32/32; after pinning the target database name and migration-table assertions, the final host-composition slice passed 11/11 with a clean 0-warning / 0-error build.

The still-open blocker categories are:

1. Direct callers still need their recorded census and window repoints. Section 4.3 records the initial two-reader census and the completed Platform and CLI source repoints, so no foreign direct SQL reader remains. The broader direct-HTTP caller receipt is still required.
2. Build-boundary conformance reports exactly four unpinned merge pairs: evidence-web and evidence-worker each reach both attestor and evidence-locker implementation. The union is 17 predecessor implementation projects: 13 Attestor projects in the web closure (12 in the worker closure) and four EvidenceLocker projects (three in the worker closure). Those same projects are still compiled by the three supported predecessor hosts. Therefore none of the obvious bookkeeping changes is a seam: re-homing/reclassifying only the libraries reverses the violation onto the predecessor hosts, rewriting both predecessor families to evidence changes 16 current pins owned across the estate, and four temporary pins hide rather than remove the dependency. check-evidence-p19-transition.ps1 accepts only the exact current pre-state or the complete EVD-10 post-state and rejects every mixture. The owner must choose the transition model: the recommended reviewed EVD-9/EVD-10 atomic source re-home + predecessor-host retirement, or an explicitly accepted temporary source-duplication model with a non-vacuous parity guard. No such duplication is authorized today.
3. Target image/runtime configuration and authorized/unauthorized plus store/retrieve forcing are still absent. Both tracked Authority Standard descriptors and their focused conformance test now define stellaops-evidence-web with exact default tenant, stellaops audience, client_credentials, and only catalog:replicate platform:doctor:register. The source prerequisite does not reconcile a running Authority or install a secret: the staged compose overlay remains fail-closed on an explicitly supplied client ID and operator-owned secret. EVD-9 must reconcile the live row, prove the exact token/feed claim set, and capture a durable local-replica checkpoint before forcing or enabling Doctor registration.
4. The complete EVD-9 operator runbook is recorded with ordered backup/copy/parity/hash-chain/repoint/revoke, rollback, soak and forcing steps. It still needs an approved rehearsal/window and the source-ownership decision above.

No boundary report/register, route table, compose activation, database or live container changes are implied by this design state.

4.3 Direct-SQL reader census and owner seams (2026-08-23)

A production-source scan outside src/Attestor, src/EvidenceLocker, src/Evidence, test trees and obsoleted trees initially found exactly two foreign direct-SQL readers of the three carried schemas. SPRINT_20260722_021 PLT-1A closed Platform’s row and SPRINT_20260722_026 CM-5 closed the CLI row; the same current-source scan now finds zero foreign direct-SQL consumers:

The Platform consumer now uses the seam that invokes the existing owner-side ILegacyCapsuleErasureRefusalService, including its refusal audit, instead of reproducing its joins or retention mapping. Producer tests pin the exact method, evidence:create policy, envelope tenant/request mapping, response projection, and anonymous denial; Platform tests verify the signed tenant envelope, both exact route prefixes, canonical precedence, response parity, and fail-closed no-retry/no-SQL behavior. The predecessor maps the same contract so Platform can leave SQL before the database move. The CLI now selects the same predecessor/target owner family at composition and verifies its proof locally, so only the broader direct-HTTP caller census/repoint remains an EVD-9 caller blocker.

That database-authority closure is deliberately narrower than P19 closure. A source and ownership re-census found that two of the production CLI’s seven direct Attestor references are already legal closed SDKs (StellaOps.Attestation and StellaOps.Attestor.Envelope), while five entered the Attestor service-family implementation. StellaOps.Attestor.TrustRepo was a dead edge: no CLI source named one of its types, its lone namespace import was stale, and suppressing the direct reference left no transitive path to the project. The reference and import are removed. Of the four remaining implementation edges, StellaOps.Attestor.Timestamping had a one-project closure and only served the attest sign --timestamp path, whose transport method unconditionally threw the recorded “No RFC-3161 TSA client is configured” failure. The CLI now preserves that exact exit-2/no-output failure locally and no longer compiles the unused implementation. The surviving StellaOps.Attestor.Oci edge is a legal producer-owned closed client SDK by measured shape rather than name: exactly five source files, one direct Attestor.Envelope reference, one logging-abstraction package, and a four-project closure containing only that same-producer SDK plus neutral Cryptography and Localization foundations. Registry transport is supplied by the CLI through IOciRegistryClient; the SDK owns no HTTP client, host, persistence, migration, background worker or DI composition. Executable conformance pins that exact surface and classification without changing OCI, registry or DSSE behavior. The two real implementation edges that remain are StellaOps.Attestor.StandardPredicates and StellaOps.Attestor.Core; each still requires its own behavior-owner split or seam.

4.4 Direct-HTTP caller census and cutover dispositions (2026-08-24)

The EVD-9 HTTP census is now a measured source artifact rather than a placeholder. The scan covers production C# outside tests and src/__Obsoleted, the canonical compose file, the standalone Scanner, ReleaseOrchestrator and Tester compose files, both generated and pinned release-bundle compose surfaces, and Platform’s development launch profile. It combines predecessor-host/config-key searches with typed HttpClient registration and route-literal tracing, because a caller can be direct without spelling the default hostname in its own source. EvidenceDirectHttpCallerConformanceTests pins the exact production source files and compose keys that still spell either predecessor binding, against the census in §4.5; a new binding fails closed, while a removed binding forces its census row into §4.5.3 in the same change.

Gateway translations are not counted as application callers: their complete disposition is the fifteen-to-one EVD-5 route manifest. Front-door consumers such as CLI BackendOperationsClient therefore ride that manifest rather than becoming direct-host rows. Browser routes are owned by EVD-6. Public Sigstore/Rekor URLs are also outside this census unless a supported configuration points that client at the StellaOps Attestor origin.

Configured production and target-internal callers

Accepted 2026-09-12: the caller acceptance and final role receipt close the dispositions below. Final roles run ebbd7814e4; receipt-specific limits remain explicit, including controlled invalid writer requests and conditional timestamp trust.

Supported tools, optional roles and measured non-callers

The 2026-09-12 consumer acceptance receipt records all 21 dispositions, controlled retained records, and exact limits. The writer rows certify this caller/route cutover, not a new deployment, promotion or TLPT exercise. Final native five-file archive acceptance passed after cold-start public trust verification, with identical API/CLI/Tester/cache bytes and successful original-signature verification plus tampered-payload and wrong-trust refusals. The package is a signed-reference archive; it does not embed referenced material bytes or certify timestamp/checkpoint signatures.

The supported compose binding inventory is enumerated per key in §4.5.2, and the production-source literal inventory in §4.5.4. A prose count used to stand here instead, and it went stale on its own: it still read ten assignments including a Findings one on 2026-09-01, five days after SPRINT_20260722_010 FND-10 retired that binding. Arithmetic in a sentence is not a census, so the inventory is now a table the conformance test reads. These bindings are configuration witnesses, not additional callers. The route-source and overlay predecessor URLs remain governed by the separate EVD-5 swap checker.

EVD-9’s caller-repoints.tsv must contain all EVD-HTTP-* IDs above. An active/configured row needs a target route and forcing receipt; a supported-but-stopped/on-demand/dormant row needs a named owner exclusion with the command/config evidence that makes it non-calling. “No old hostname in docker ps” is insufficient for a source-default or operator-invoked caller, and a zero direct-SQL count does not close any row in this section.

4.5 Reviewed predecessor-binding census (2026-09-12)

§4.4 says which caller must be repointed and why. This section says which literals still spell a predecessor origin, and it is the artefact EvidenceDirectHttpCallerConformanceTests reads: the test holds no census of its own, it parses the four tables below and fails when the repository disagrees with them. Adding or retiring a predecessor binding therefore means editing a reviewed document, not an array that no reviewer sees.

What reviewing a change here means. A new row in §4.5.2 or §4.5.4 must name an EVD-HTTP-* ID that exists in §4.4 and whose disposition still describes the caller; a row that leaves §4.5.2 must land in §4.5.3 with the sprint that retired it and the reason. The test enforces the measurable half — the surfaces, the markers, and that every cited ID exists in §4.4 — and refuses a retired key that is still set anywhere. Whether the disposition is still true is the human half, and it exists only because the rows are here.

4.5.1 Supported compose surfaces

bundle and bundle-pinned are generated from the canonical include chain, so a binding added to one of them by hand is drift; tools/scripts/validate/check-bundle-generated.sh owns that regeneration gate and exists because this census once compared three surfaces that had silently stopped agreeing about an entire retired service.

4.5.2 Active predecessor compose bindings

No supported compose surface selects a predecessor origin after the EVD-5 consumer repoint. Keys retained for configuration continuity now select Evidence and are measured in §4.5.5.

4.5.3 Retired predecessor compose bindings

A retired key must be set on no supported surface; the test asserts that, so this table cannot decay into a list of bindings that quietly came back.

4.5.4 Production source predecessor literals

The scan covers production C# under src/, excluding tests and src/__Obsoleted. A file is listed because it still spells a predecessor host or config key; that is weaker than being a live caller, which is why the Witnesses column points at the §4.4 row that classifies it — EVD-HTTP-17 is listed here and is measured as making no call at all.

Four markers are recognised: the two predecessor hosts http://attestor.stella-ops.local and http://evidencelocker.stella-ops.local, and the two config keys STELLAOPS_ATTESTOR_URL and STELLAOPS_EVIDENCELOCKER_URL. A caller can be direct without spelling any of them, which is why §4.4 was built from typed HttpClient registration and route-literal tracing as well; this table pins only what a text scan can hold, and it is a floor under §4.4 rather than a substitute for it.

4.5.5 Consolidated caller origin bindings

EVD-5 retains these option names while changing their sole owner origin. Typed clients use native /api/evidence/v1/** paths. Policy’s unchanged verdict controller path is /internal/api/v1/attestations/verdict; it receives only an origin repoint.

EvidenceLocker__BaseUrl moved from export-web to offlinekit-web on 2026-09-13 (SPRINT_20260722_025 OK-10): the OfflineKit consolidation retired both ExportCenter roles and the consolidated host composes the same export domain. The ORIGIN is unchanged, which is the point of recording it here — a consolidation that quietly repointed a caller at a different Evidence owner is exactly what this census exists to catch. Its surface moves from canonical to offlinekit because the consolidated host is declared in that overlay; the overlay is on the flagship include chain, so bundle and bundle-pinned still generate from it.

5. What S1 adds (decision already DONE — owner approved the widened merge 2026-07-22)

EVD-2 is closed; the S0 review should confirm: (1) the module home (src/Evidence/), (2) the vex.trust_verdicts disposition (§2.3 — now a park-or-adopt decision, the mis-homing is dead wiring), (3) the two-migration-homes collapse (§2.4), (4) the closed Evidence SDK surface.

Inbound-caller inventory DONE (2026-08-03) — and it reshapes EVD-3. The register shows ~25 consumer keys pinned to attestor/evidence-locker/signer, but the witness chains route through a SMALL set of shared carrier libraries, not per-consumer type usage: StellaOps.Attestation (the dominant carrier — authority, notify, policy-engine, RO, scanner, sbomservice, signer, vexhub/vexlens all enter through it), Attestor.Envelope (platform, airgap, binaryindex), Attestor.ProofChain (concelier, export), Attestor.Core, EvidenceLocker.Core/Evidence.Pack (evidence side), Signer.Core/Signer.Infrastructure (signer side). The EVD-3 contract freeze is therefore a LIBRARY-CLASSIFICATION pass (which of these carriers are pure closed contracts, which drag implementation and must split) — not a per-caller type enumeration; classifying ~7 carriers collapses ~25 consumers’ pins. (Same shape as the 024 finding: pins concentrate on edges, not on types.) OWNER RULING (2026-08-03, review item A5): approved as the EVD-3 approach.

Historical route + deploy inventory (2026-08-03; superseded by the Evidence cutover): ~14 gateway routes (/api/v1/watchlist, /api/v1/transparency, six /api/v1/evidence/* shapes, /api/v1/proofs, /api/v1/verdicts, /api/v1/attestations, /api/v1/rekor) split across attestor.stella-ops.local and evidencelocker.stella-ops.local — plus /api/v2/evidence fronted by PLATFORM (a Platform read-model surface to keep, not a family route). At that inventory all six containers ran in the live main stack (attestor, tileproxy, signer, evidence-locker web+worker, tsa). The later EVD-9 window carried the data and APIs onto Evidence; the remaining consumer repoints retain their explicit runtime acceptance gates. Compose: tsa-data + capsule CAS volume rows per matrix §6.3; family env keys consolidate at S8 with the usual own-database gate.