Policy

Verified against commit 942a18727c on 2026-09-26 (UTC). Re-verify: ls src/Policy src/Policy/__Libraries/StellaOps.Policy.Persistence/Migrations and git grep -n "policy-engine" -- devops/release/bundle/docker-compose.yml.
Service rows (host project, image, database and role, compose file, bundle presence, Doctor registration) are generated in docs/architecture/service-inventory.md; where this page and the inventory differ, the inventory is authoritative.

Purpose

Policy compiles and evaluates stella-dsl@1 policy packs deterministically and owns the promotion-gate decisions that Release Orchestrator enforces. It also owns exceptions and their approval workflow, risk profiles and overrides, CVSS receipts, budgets, and Policy-local projections of Vulnerabilities hub data used by gates. The dossier is architecture.md.

Deployable

Service	Host project	Release bundle	Compose estate
`policy-engine`	`src/Policy/StellaOps.Policy.Engine/`	yes, image `stellaops/policy-engine`, aliases `policy-engine.stella-ops.local`, `policy-gateway.stella-ops.local`	`devops/compose/docker-compose.stella-services.yml`

Database stellaops_policy (schemas policy, policy_app), connection STELLAOPS_POSTGRES_POLICY_CONNECTION, embedded migrations in src/Policy/__Libraries/StellaOps.Policy.Persistence/Migrations/ applied on startup. The generated OpenAPI mirror for this service lives in ../policy-engine/because the generator writes to docs/modules/<service>/.

Pack-first boundary

Policy packs, SPL documents, Rego interoperability documents, scoring profiles, gates, exception effects, trust weights and air-gap policy bundles are declarative data. Release-safety semantics (severity fusion, KEV and EPSS handling, reachability weighting, signature verification, gates, exceptions, verdict hashing) are implemented in src/Policy/, not loaded as executable plugins.

Retired predecessors

StellaOps.Policy.Gateway as a separate container: merged into policy-engine; the project was withdrawn to src/__Obsoleted/Policy/ on 2026-09-27 (PCD-73). See architecture.md §1.
The policy-engine dossier directory: now only the generated OpenAPI mirror (see above).
Remediation (src/__Obsoleted/Remediation/): obsoleted 2026-08-19; archived dossier at docs-archive/modules/remediation/architecture.md. Console remediation surfaces moved to AdvisoryAI autofix.
Verdict Postgres persistence: retired 2026-09-23 (RFC-14, Q-43); not a Policy store.
The previous long-form dossier and README are archived at docs-archive/modules/policy/.

Subordinate documents

Document	Status
`architecture.md`	current
`retention-classification.md`and its verification JSON	current (dated receipt 2026-09-21)
`environment-posture.md`	current for the ownership split (migration 010); design record otherwise
`gates/`	design record, not re-verified 2026-09-26
`guides/`(DSL, SPL, lifecycle, runs, runtime, governance, exceptions, scoring, verdict attestations, NIS2 register, conformity assessment, quotas, UI integration, FAQ)	design record, not re-verified 2026-09-26; several describe Concelier and Excititor as live inputs, which are retired into the Vulnerabilities hub
`guides/gateway.md`	design record; describes the endpoints merged from the Gateway into the Engine
`contracts/`, `design/`	design record, not re-verified 2026-09-26
`determinization-architecture.md`, `determinization-api.md`, `cvss-v4.md`, `dsl-grammar-specification.md`, `budget-attestation.md`, `evidence-hooks.md`, `recheck-policy.md`, `data-handling.md`, `notifications.md`, `promotion-gate-ownership-contract.md`, `POLICY_TEMPLATES.md`	design record, not re-verified 2026-09-26
`secret-leak-detection-readiness.md`, `windows-package-readiness.md`	readiness briefs for planned Scanner analyzers; not a statement of shipped behavior
`samples/`, `schemas/`, `fixtures/`, `openapi/gates-api.yaml`	reference artifacts, not re-verified 2026-09-26
previous `architecture.md`, `README.md`, `AGENTS.md`, `implementation_plan.md`	archived at `docs-archive/modules/policy/`