Issuer Directory (served by Authority)

Verified against commit 942a18727c on 2026-09-26 (UTC). Re-verify: git grep -n "AddFoldedIssuerDirectory\|MapFoldedIssuerDirectory" -- src/Authority/StellaOps.Authority/StellaOps.Authority/Program.cs and grep -n -i "ISSUERDIRECTORY__FOLD\|IssuerDirectory__Fold" devops/compose/docker-compose.authority.yml devops/release/bundle/docker-compose.yml.

Service rows (host project, image, database and role, compose file, bundle presence, Doctor registration) are generated in docs/architecture/service-inventory.md; where this page and the inventory differ, the inventory is authoritative.

Issuer Directory is the trust registry of CSAF publishers and VEX statement issuers: issuer metadata, issuer signing keys with a rotation and revocation lifecycle, per-tenant trust weight overrides, and the operator decision-signing keys. It is a component of Authority, not a service of its own.

Where it runs

• Host: authority (src/Authority/StellaOps.Authority/StellaOps.Authority/). Program.cs calls AddFoldedIssuerDirectory and MapFoldedIssuerDirectory (src/Authority/__Libraries/StellaOps.IssuerDirectory.Api/Fold/IssuerDirectoryFold.cs).
• Switch: IssuerDirectory:Fold:Enabled (IssuerDirectoryFoldOptions, source default false). When it is false, Authority registers and maps nothing from this component.
• Compose: the Authority family overlay devops/compose/docker-compose.authority.yml sets ISSUERDIRECTORY__FOLD__ENABLED from AUTHORITY_ISSUER_DIRECTORY_FOLD_ENABLED (default true). That overlay is outside the default compose chain.
• Release bundle: devops/release/bundle/docker-compose.yml does not set the fold switch for authority, and the bundle’s mounted Authority configuration does not set it either. The source default applies, so a bundle-only install does not map the /issuer-directory routes, although the bundle’s platform service points STELLAOPS_ISSUERDIRECTORY_URL at Authority. This is recorded as an open observation for the Authority owner.
• Retired host: the standalone issuer-directory service was retired on 2026-09-11 (SPRINT_20260722_016 AUTH-10). Its project is frozen at src/__Obsoleted/Authority/StellaOps.IssuerDirectory.WebService/.

Source layout

Database

• Schema issuer inside Authority’s database stellaops_authority, through Authority’s own connection. IssuerDirectory:Fold:ConnectionString may override it; there is no generic fallback.
• The tables are created by Authority migration src/Authority/__Libraries/StellaOps.Authority.Persistence/Migrations/024_authority_issuer_directory_tables.sql (issuers, issuer_keys, trust_overrides, audit, operator_provider_change_receipts). The fold registers no migrator of its own. The SQL files under the Persistence project’s Migrations/ directory are historical and are not the migration authority.

API surface

All routes are mapped by Authority from StellaOps.IssuerDirectory.Api/Endpoints/.

Policies IssuerDirectory.Reader, IssuerDirectory.Writer and IssuerDirectory.Admin bind the scopes issuer-directory:read, issuer-directory:write and issuer-directory:admin. Operator signing-key routes also use authority:signing-keys.enroll and authority:signing-keys.admin (Security/IssuerDirectoryPolicies.cs, StellaOpsScopes.cs). The isolation tenant comes from the authenticated stellaops:tenant claim; see architecture.md section 4.

api-reference.md and openapi/v1.json were generated from the retired standalone host. Their paths and payloads match the folded surface; their server URL names the retired issuerdirectory.stella-ops.local alias.

Configuration

• IssuerDirectory:Fold (Enabled, ConnectionString, SchemaName): fold switch and persistence.
• IssuerDirectory (IssuerDirectoryApiOptions): API options. The fold forces SeedCsafPublishers off; CSAF seeding does not run on the folded host.
• Authentication, tenancy middleware, health endpoints and Router registration are Authority’s.

Observability

Meter StellaOps.IssuerDirectory (IssuerDirectoryMetrics): issuer_directory_changes_total, issuer_directory_key_operations_total, issuer_directory_key_validation_failures_total.

Tests

AuthorityIssuerFoldHostingTests and AuthorityIssuerFoldGlobalTenantTests (src/Authority/StellaOps.Authority/StellaOps.Authority.Tests/Integration/) boot the folded Authority host; IssuerDirectoryFoldMigrationTests (StellaOps.Authority.Persistence.Tests) covers migration 024; src/Authority/__Tests/StellaOps.IssuerDirectory.Persistence.Tests/ covers the repositories.

Retired predecessors

• issuer-directory service (image issuer-directory-web, alias issuerdirectory.stella-ops.local): replaced by the Authority fold on 2026-09-08, retired 2026-09-11. Its deployment, backup and Offline Kit procedures are archived at docs-archive/modules/issuer-directory/retired-20260926/operations/; the pre-2026-03 dossier is at docs-archive/modules/issuer-directory/.

Subordinate documents

Authority dossier: ../authority/architecture.md.