Findings

Verified against commit 942a18727c on 2026-09-26 (UTC). Re-verify: ls src/Findings src/Findings/__Libraries src/__Obsoleted/Findings and git grep -n "findings" -- devops/release/bundle/docker-compose.yml.

Service rows (host project, image, database and role, compose file, bundle presence, Doctor registration) are generated in docs/architecture/service-inventory.md; where this page and the inventory differ, the inventory is authoritative.

Purpose

src/Findings/ is the consolidated findings domain (ADR-039 D14): the append-only Findings Ledger, the security exposure read-model, vulnerability correlation, VulnExplorer read/write endpoints, runtime instrumentation, alerts and decisions, and the kept risk-scoring store. It is one deployable family with two roles and one database. The dossier is architecture.md.

Deployables

The release bundle (devops/release/bundle/docker-compose.yml) does not deploy either role, while three bundle services carry findings.stella-ops.local base addresses. See architecture.md §0.

Database

stellaops_findings, resolved only from STELLAOPS_POSTGRES_FINDINGS_CONNECTION (src/Findings/__Libraries/StellaOps.Findings.Persistence/Extensions/ConsolidatedFindingsPersistenceExtensions.cs), fail-closed. Schemas findings, findings_security, riskengine, analytics, plus the structural findings_ledger_app and findings_archive. Migrations: src/Findings/__Libraries/StellaOps.Findings.Persistence/Migrations/, converged on startup. Retention: retention-classification.md.

Source map

Retired predecessors

• findings-ledger-web, findings-security-web: withdrawn to src/__Obsoleted/Findings/ on 2026-08-28 (FND-20). Replaced by findings-web. Archived dossier: docs-archive/modules/findings-ledger/.
• riskengine-web, riskengine-worker, findings-vulncorrelation: deleted at FND-10 (2026-08-27). The risk-scoring capability folds into this family.
• VulnExplorer standalone host: decommissioned; endpoints mapped by findings-web. The historical dossier is docs-archive/modules/vuln-explorer/.
• The withdrawn host’s specification, formerly held at docs/modules/findings-ledger/openapi/findings-ledger.v1.yaml, is archived at docs-archive/modules/findings-ledger/openapi/findings-ledger.v1.yaml (2026-09-27). The ledger library’s OpenAPI metadata helper that resolved it had no live caller and is withdrawn to src/__Obsoleted/Findings/StellaOps.Findings.Ledger/OpenApi/. The served contract is openapi/v1.json.
• The ledger snapshot and time-travel services (SnapshotService, its snapshot and time-travel repositories, models and request contracts), whose only callers were the withdrawn host’s /v1/ledger/snapshots and time-travel routes, are withdrawn to src/__Obsoleted/Findings/StellaOps.Findings.Ledger/PCD-242/ (2026-10-01). Every time-travel query failed on the consolidated schema. No Findings host serves snapshots or time-travel queries; the findings.ledger_snapshots table stays in the migration chain with no reader or writer.
• The ledger library’s vulnerability-detail endpoint (MapSecurityVulnerabilityEndpoints(), GET /api/findings/v1/security/vulnerabilities/{identifier}), whose only caller was the withdrawn host, is withdrawn to src/__Obsoleted/Findings/__Libraries/StellaOps.Findings.Ledger.Application/PCD-230/ (2026-10-01). findings-web never mapped it: its template is ambiguous with the security read model’s GET /api/findings/v1/security/vulnerabilities/{vulnerabilityId}, which serves that path. The ledger detail service it called stays and answers GET /v1/vulns/{id}.

Subordinate documents