Concelier Connectors

This index is the authoritative operator-facing inventory for the Concelier advisory source catalog and the linked Excititor VEX provider control plane.

Current control-plane counts

• Advisory source catalog definitions: 71
• Advisory sources with built-in runnable fetch pipelines on this host: 50
• Advisory sources with stored connector configuration exposed through both Web UI and CLI: 50
• Excititor VEX providers in the provider catalog: 7

Operator entry points:

• Advisory source catalog: Ops -> Integrations -> Advisory & VEX Sources
• Advisory source stored configuration: source card -> Stored Connector Configuration
• Advisory source CLI path: stella db connectors configure <source-id>
• VEX provider catalog: Ops -> Integrations -> Advisory & VEX Sources -> VEX Providers
• VEX provider CLI path: stella excititor list-providers, show-provider, enable-provider, disable-provider, run-provider, update-provider

Bulk operator actions:

• Advisory-source Enable All / Disable All calls the Concelier source batch endpoints for Concelier-backed rows and the Excititor provider enable/disable endpoints for excititor:* VEX rows. VEX provider rows must never be sent to /api/v1/advisory-sources/batch-enable because Concelier does not own those provider IDs.
• Advisory-source Sync All triggers enabled runnable sources as a visible per-source queue instead of one long /api/v1/advisory-sources/sync request. This keeps progress visible and avoids frontdoor gateway timeouts. The single-source sync endpoint accepts queued manual runs; Concelier’s JobCoordinator enforces execution concurrency internally.

Related docs:

• Live Stella Ops Mirror aggregation state and seed-export plan: docs/modules/concelier/connector-aggregation-state.md
• Stored advisory credentials and endpoint overrides: docs/modules/concelier/operations/source-credentials.md
• Excititor provider control plane: docs/modules/excititor/operations/provider-control-plane.md
• Connector runbooks: docs/modules/concelier/operations/connectors/

Readiness model

Advisory sources and VEX providers preserve operator intent separately from runtime readiness.

Advisory sources return:

• enabled: persisted operator intent
• readiness and syncState: one of ready, blocked, disabled, or unsupported

Excititor VEX providers return:

• enabled: persisted operator intent
• readiness and syncState: one of ready, blocked, disabled, or planned

Interpretation:

• blocked means the operator wants the connector enabled, but the runtime is intentionally holding it until required configuration or retry cooldown conditions clear.
• unsupported means the advisory source exists in the catalog but this host does not register a runnable source:<id>:fetch pipeline.
• planned means the VEX provider exists in the provider catalog but the current Excititor host has not registered a runnable connector for it.

Canonical runtime note:

• Advisory source IDs come from src/Concelier/__Libraries/StellaOps.Concelier.Core/Sources/SourceDefinitions.cs
• Advisory source aliases are normalized by src/Concelier/__Libraries/StellaOps.Concelier.Core/Sources/SourceKeyAliases.cs
• Advisory source runnable pipelines come from src/Concelier/StellaOps.Concelier.WebService/Extensions/JobRegistrationExtensions.cs
• Excititor provider readiness comes from src/Concelier/StellaOps.Excititor.WebService/Services/VexProviderManagementService.cs

Advisory source inventory

Legend:

• Built-in runnable = yes means this Concelier WebService registers a source:<id>:fetch job.
• Stored config = UI+CLI means operators can persist credentials or endpoint overrides through both the Web UI and stella db connectors configure.
• Stored config = none means no persisted connector-specific source configuration schema exists today on the advisory side.

Unsupported/source-decision notes:

• centos is deprecated as a direct connector. Legacy CentOS Linux assessment can use Red Hat/RHSA history only with reduced confidence and an explicit RHEL-major mapping; CentOS Stream is not treated as covered by RHEL history.
• juniper is not runnable until an official stable all-Juniper JSA feed/API is available. A future juniper-mist/mist source can be added separately if Mist-only RSS coverage is accepted.
• cert-ch has public warning pages, but no current official machine-readable advisory feed suitable for Concelier ingestion was identified.
• google is too broad for a single source. Use the existing gcp and chromium sources, and split Android/Pixel into scoped sources if needed.
• poc-github and docker-official are not backlog items. They were removed: poc-github is uncurated and safety/legal ambiguous, and docker-official was Docker Hub/Official Images metadata rather than an official CVE/VEX feed.

Stored advisory configuration coverage

Every advisory source marked Built-in runnable = yes is configurable through the Web setup/source-management page and the persisted /api/v1/advisory-sources/{id}/configuration API. The CLI’s stella config sources tree manages enablement, connectivity, and status; it does not currently expose connector field editing. Some connectors expose only endpoint, timeout, public-feed, or fixture/offline snapshot overrides; auth fields appear only where the connector needs credentials.

The runnable and configurable advisory sources are:

• Primary and threat: cve, epss, ghsa, kev, nvd, osv
• Vendor and cloud: adobe, apple, aws, chromium, cisco, fortinet, gcp, microsoft, oracle, paloalto, redhat, vmware
• Distribution: alpine, amazon, arch, astra, debian, fedora, gentoo, suse, ubuntu
• CERT and national sources: auscert, cccs, cert-at, cert-be, cert-cc, cert-de, cert-eu, cert-fr, cert-in, cert-pl, cert-ua, fstec-bdu, jpcert, krcert, nkcki, us-cert
• Exploit, hardware, ICS, and mirror: amd, exploitdb, intel, kaspersky-ics, metasploit, siemens, stella-mirror

Policy-sensitive or regional sources such as fstec-bdu, nkcki, astra, kaspersky-ics, cert-in, cert-pl, cert-ua, amd, siemens, exploitdb, metasploit, and stella-mirror remain disabled by default. They are still visible in the setup UI so an operator can explicitly enable, configure, check, and sync them when local policy permits it.

Rows with Built-in runnable = no are either parent-covered aliases or catalog-visible unsupported sources. Parent-covered aliases (npm, pypi, go, maven, nuget, rhel, azure, and similar rows) are folded into the parent row in the setup UI as “Also covering …” notes. Unsupported rows such as centos, cert-ch, google, juniper, chainguard, and wolfi remain visible as catalog truth but cannot be enabled until a real fetch job is added.

Verification state for this inventory

Control-plane evidence reverified in Sprint 20260422_004:

• Advisory source catalog and status API coverage confirms built-in runnable vs parent-covered vs connector-missing behavior for representative connectors including nvd, osv, cccs, cert-cc, krcert, microsoft, ghsa, cisco, oracle, adobe, chromium, default-disabled opt-in sources (fstec-bdu, nkcki, astra, kaspersky-ics, cert-in, cert-pl, cert-ua, amd, siemens, stella-mirror), OSV-covered npm, GHSA-covered nuget, canonical aliases rhel/azure, and true missing connector rows.
• Legacy ARM source rows were removed in Sprint 20260601_001 because the former connector only failed closed and no approved machine-readable Arm feed is available.
• Advisory stored configuration persistence is covered for ghsa, adobe, and chromium
• Excititor provider management endpoints are covered by targeted backend tests and linked UI/CLI work is documented in docs/modules/excititor/operations/provider-control-plane.md

This page does not claim that all 79 advisory connectors were end-to-end re-ingested in this sprint. It records catalog truth, built-in host wiring, stored configuration coverage, and the specific control-plane verification completed during this implementation slice.