Graph

Verified against commit 942a18727c on 2026-09-26 (UTC). Re-verify: git grep -n "Map\(Get\|Post\|Delete\|Group\)(" -- src/Graph/StellaOps.Graph.Api and ls src/Graph/__Libraries/StellaOps.Graph.Persistence/Migrations.
Service rows (host project, image, database and role, compose file, bundle presence, Doctor registration) are generated in docs/architecture/service-inventory.md; where this page and the inventory differ, the inventory is authoritative.

Purpose

Graph is the estate’s graph store and query service. One deployable, graph-api, serves the tenant-scoped SBOM dependency and service graph (search, query, paths, diff, lineage, export, saved views, edge metadata), the asset registry, and the reachability store (content-addressed reachability subgraphs, slices, replay verification, CVE-to-symbol mappings). The Graph Indexer pipeline (SBOM and inspector ingestion, analytics, change stream, asset-source subscriptions, ephemeral retention) runs inside the same process.

The former standalone reachability service, reachgraph-web, is merged into graph-api; its reachability model, guides and schemas now live under reachability/.

Deployables

Deployable	Source	Compose	Release bundle
`graph-api`	`src/Graph/StellaOps.Graph.Api/` (`Program.cs`)	`devops/compose/docker-compose.graph.yml`	Yes: service `graph-api`, image `stellaops/graph-api`, network aliases `graph.stella-ops.local`, `cartographer.stella-ops.local`, `reachgraph.stella-ops.local`

The Indexer is a library (src/Graph/StellaOps.Graph.Indexer/), not a host: graph-api composes it (AddSbomIngestPipeline, AddInspectorIngestPipeline, AddGraphAnalyticsPipeline, AddGraphChangeStreamProcessor, AddGraphIndexerPersistence, AddGraphEphemeralRetention in Program.cs). The reachability HTTP surface is the library src/Graph/__Libraries/StellaOps.ReachGraph.Application/, composed by src/Graph/StellaOps.Graph.Api/Hosting/ReachGraphApplicationHostingExtensions.cs.

Database

Own database stellaops_graph, schemas graph and reachgraph (src/Graph/__Libraries/StellaOps.Graph.Operations/GraphSchemaTopology.cs).
Connection: STELLAOPS_POSTGRES_GRAPH_CONNECTION (host key Postgres:Graph:ConnectionString). The bundle fails closed when the variable is unset.
One migration authority: src/Graph/__Libraries/StellaOps.Graph.Persistence/Migrations/ (001_graph_consolidated_baseline.sql onward), applied on startup through AddStartupMigrations in ConsolidatedGraphPersistenceExtensions.

API surface

Family	Routes	Source
Graph queries	`/graph/search`, `/graph/query`, `/graph/paths`, `/graph/diff`, `/graph/lineage`, `/graph/export`, `/graph/edges/*`	`StellaOps.Graph.Api/Program.cs`
Asset registry	`/graph/assets/*`, `/graph/asset-registry/events`	`Endpoints/AssetRegistryEndpoints.cs`, `Endpoints/AssetRegistryEventFeedEndpoints.cs`
Console compatibility	`/graphs`, `/graphs/{id}`, `/graphs/{id}/tiles`, `/graphs/{id}/export`, `/graphs/{id}/saved-views`, `/search`, `/paths`, `/assets/{id}/snapshot`, `/nodes/{id}/adjacency`	`Endpoints/CompatibilityEndpoints.cs`
Scheduler build and overlay contract	`/api/graphs/builds`, `/api/graphs/overlays`	`Endpoints/CartographerEndpoints.cs`
Reachability store	`/v1/reachgraphs/`, `/v1/reachability/`, `/v1/cve-mappings/*`	`__Libraries/StellaOps.ReachGraph.Application/Controllers/`
Consolidated aliases	the families above under `/api/graph/v1/...`; of the scheduler contract only the build pair, as `/api/graph/v1/builds`	`Endpoints/GraphConsolidatedRouteAliases.cs`
Operations	`/healthz`, build info, service Doctor endpoints	`Program.cs`

Details, scopes and caveats: architecture.md.

Doctor checks

doctor.graph.database.own-database-cutover, doctor.graph.reachgraph.cas-tenant-isolation, doctor.graph.retention.ephemeral-backlog (StellaOps.Graph.Operations/Doctor/GraphDoctorChecks.cs) and doctor.graph.indexer.change-source (StellaOps.Graph.Api/Services/GraphChangeSourceDoctorCheck.cs), plus the standard service checks from AddServiceDoctorChecks("graph-api").

Retired predecessors

reachgraph-web (standalone reachability host): merged into graph-api. Its host-era dossier, OpenAPI spec and generated API reference are archived at docs-archive/modules/reach-graph/.
cartographer (standalone service): merged into graph-api; the cartographer.stella-ops.local alias resolves to the graph-api container.
Frozen projects: src/__Obsoleted/Graph/StellaOps.Graph.Api/ (predecessor saved-view migration authority, EST-9), src/__Obsoleted/Graph/StellaOps.Graph.Core/ and its tests (orphaned prototype, GRA-10). Each carries an AGENTS.md freeze record.
Planning-era documents (architecture index, implementation plan, packaging note, gateway spec draft) are archived at docs-archive/modules/graph/.

Subordinate documents

Document	Status
architecture.md	current
api-reference.md, openapi/v1.json	current generated reference; it does not yet include the reachability controllers or the `/api/graph/v1` aliases (see architecture)
asset-registry.md	design record, not re-verified 2026-09-26
asset-registry-feed-contract.md	design record, not re-verified 2026-09-26
consolidation-design.md	design record (GRA-1 target design), not re-verified 2026-09-26
schema.md	design record, not re-verified 2026-09-26
contracts/graph.inspect.v1.md and schema	design record, not re-verified 2026-09-26
analytics/	design record, not re-verified 2026-09-26
reachability/guides/, reachability/schemas/	design records (moved from the retired `reach-graph` dossier), not re-verified 2026-09-26; some name a runtime collector (“Zastava”) that is not a module in `src/`
AGENTS.md	current