Router Valkey Transport Ownership and Historical Rollout Matrix
The February 2026 wave matrix is a historical rollout plan. Current transport and owner selection comes from the host’s Router composition and the checked-in Compose definition, with the generated service inventory providing deployment membership. Do not use an old wave row as a current migration instruction, a route-compatibility promise or a rollback authorization.
Verified against: 847bf843c3fd130726d1baf34a75d14632640782 (2026-10-07). Re-verify with
python tools/scripts/generate/service-inventory.py --check, inspect the owning host’sAddRouterMicroservicecomposition and its ComposeRouter__EnabledandRouter__Messaging__Transportsettings. This is source evidence; no new deployment or current live acceptance is asserted.
Current consolidated host boundaries
| Owner / web role | Docker discovery alias | Router service identity / API composition | Router-enabled input | Checked-in definition |
|---|---|---|---|---|
Evidence / evidence-web | evidence.stella-ops.local | evidence; /api/evidence/v1/* | EVIDENCE_ROUTER_ENABLED (default true) | docker-compose.evidence.yml |
Vulnerabilities / vulnerabilities-web | vulnerabilities.stella-ops.local | vulnerabilities-web; /api/vulnerabilities/v1/* | VULN_ROUTER_ENABLED (default true) | docker-compose.vulnerabilities.yml |
OfflineKit / offlinekit-web | offlinekit.stella-ops.local | OfflineKit family identity; /api/offlinekit/v1/* | OFFLINEKIT_ROUTER_ENABLED (default true) | docker-compose.offlinekit-consolidated.yml |
Findings / findings-web | findings.stella-ops.local | findings; /api/findings/v1/* | FINDINGS_ROUTER_ENABLED (default true) | docker-compose.findings.yml |
JobEngine / jobengine-web | jobengine.stella-ops.local | jobengine; Scheduler and PacksRegistry are composed modules | JOBENGINE_ROUTER_ENABLED (default true) | docker-compose.stella-services.yml |
AdvisoryAI / advisoryai-web | advisoryai.stella-ops.local | advisoryai; assistance, OpsMemory and remediation are composed modules | ADVISORYAI_ROUTER_ENABLED (default true) | docker-compose.advisoryai.yml |
Platform / platform | platform.stella-ops.local | Platform operator read models and Doctor aggregate | PLATFORM_ROUTER_ENABLED (default true) | docker-compose.stella-services.yml |
These are network discovery aliases, not evidence of host-published ports or reachable HTTPS endpoints. Evidence and Vulnerabilities explicitly declare their Valkey messaging settings; the remaining owning definitions likewise declare the selected transport and plugin mounts. Worker roles are not interchangeable with the family’s Router-published web role.
The gateway has PublishedEndpointRouting enabled in devops/compose/router-gateway-local.json. Inspect a host’s mapped endpoints and publication, rather than reconstructing broad static prefixes from the old snapshot. Some exact Vulnerabilities streaming endpoints intentionally remain HTTP ReverseProxy routes because message dispatch buffers their unbounded responses; that exception does not make the rest of the family a static proxy.
Evidence proof and verdict reads
The landed PCD-443 contract retains canonical proof reads and native verdict retrieval. This source-specific row supplements the host boundaries above; this documentation refresh does not claim a new live reachability result. Re-verify Evidence publication and the gateway’s PublishedEndpointRouting against the accepted source revision.
| Service Host | Compose Service | Supported source routes | Wave context | Owner | Contract | Rollback boundary |
|---|---|---|---|---|---|---|
| evidence.stella-ops.local | evidence-web | /api/evidence/v1/proofs/**, /api/evidence/v1/verdicts/** (native routes, published endpoint routing) | B | Evidence + Test Automation | The four proof-query GETs use attest:read or attest:create; the native verdict GET uses evidence:read. Both require the authenticated tenant. Predecessor proof/verdict aliases are withdrawn; static predecessor hints stay retired. Source: ProofChainController, VerdictEndpoints and Evidence Program.cs. | No predecessor route-type or environment-flag rollback; deployment rollback requires its own service window. |
Retirement and rollback boundaries
The generated inventory’s successor table records retired hosts. Their old Router switches and aliases must not be restored to make a historical matrix row work. Doctor checks run on owning hosts; Platform aggregates their registered checks. Watchlist is composed by Evidence’s Attestor module, not a Scanner route to be migrated according to the old wave table.
Setting a current host’s Router-enabled input to false disables publication; it does not install a ReverseProxy fallback. Reverting a static route’s Type is not a universal rollback after its predecessor host and aliases have retired. Use the owning service’s accepted deployment-window/rollback procedure and the actual selected Compose chain. This document authorizes no runtime change.
Historical RMW-01 wave plan withdrawn 2026-10-07
The original matrix below records the 2026-02-21 route snapshot and its later dated consolidation annotations. Wave names, acceptance owners, proposed compatibility paths, placeholder environment switches and blanket route-revert instructions are preserved as rollout history. They are no longer current operator instructions or transport-acceptance evidence. Source and the current owner boundaries above take precedence.
Scope
- Source route table:
devops/compose/router-gateway-local.json - Source service aliases:
devops/compose/docker-compose.stella-ops.yml - Snapshot date (UTC): 2026-02-21
- ReverseProxy routes in snapshot: 116
- Distinct target service hosts: 42
Legend:
Wave:A,B,C,D,PILOTAcceptance Owner: rollout sign-off owner for that host’s cutover waveMigration Disposition: current route-level migration intent
Service Migration Matrix
| Service Host | Compose Service | Current ReverseProxy Path Prefixes | Wave | Acceptance Owner | Migration Disposition | Rollback Switch |
|---|---|---|---|---|---|---|
| advisoryai.stella-ops.local | advisory-ai-web | /advisoryai, /api/v1/advisory, /api/v1/advisory-ai, /api/v1/advisory-ai/adapters, /v1/advisory-ai, /v1/advisory-ai/adapters | A | Developer + Test Automation (Wave A) | Migrate API prefixes to Microservice; keep root compatibility path until cutover acceptance. | Route type revert in router-gateway-local.json + ADVISORYAI_ROUTER_ENABLED=false (standardized in RMW-03). |
| (retired 2026-09-11) | /airgapController | – | N/A (retired) | Host retired at SPRINT_20260722_025 OK-5 and frozen to src/__Obsoleted/AirGap/StellaOps.AirGap.Controller/; nothing to migrate. The surviving /system/airgap/* surface is Policy Engine’s and rides that host’s row. | N/A. | |
| (retired 2026-09-11) | /airgapTime | – | N/A (retired) | Host retired at SPRINT_20260722_025 OK-5 and frozen to src/__Obsoleted/AirGap/StellaOps.AirGap.Time/; nothing to migrate. Time-anchor verification survives as a domain-neutral library, not a route. | N/A. | |
| Attestor predecessor (retired) | — | See the current Evidence row below | — | Evidence | The retired host is superseded by evidence-web; current attestation and proof routes belong to Evidence. See the supported contract. | No predecessor route or flag rollback; use the documented service deployment window rollback. |
| authority.stella-ops.local | authority | /.well-known, /api/v1/authority, /api/v1/trust, /authority, /connect, /console, /jwks | B | Developer + Test Automation (Wave B) | Migrate Authority API and OIDC identity routes to Microservice; use in-service OIDC bridge endpoints (/connect/*, /well-known/openid-configuration) for protocol compatibility. | Route type revert + AUTHORITY_ROUTER_ENABLED=false (RMW-03). |
| binaryindex (source retired) | predecessor host frozen | Hub-owned binary/symbol routes | - | Vulnerabilities | See current ownership; no legacy aliases | Standing-estate window separately authorized. |
| cartographer.stella-ops.local | (merged into graph-api) | /cartographer | – | N/A (retired) | Cartographer merged into graph-api; hostname is a network alias on graph-api container. | N/A. |
| concelier.stella-ops.local | concelier | /api/v1/concelier, /concelier | D | Developer + Test Automation (Wave D) | Migrate API prefix first, then root compatibility route. | Route type revert + CONCELIER_ROUTER_ENABLED=false (RMW-03). |
| doctor.stella-ops.local | doctor-web | /api/doctor, /doctor | D | Developer + Test Automation (Wave D) | Migrate API prefix first; keep root compatibility path until UI/runtime consumers are validated. | Route type revert + DOCTOR_ROUTER_ENABLED=false (RMW-03). |
| doctor-scheduler.stella-ops.local | (obsoleted) | /api/v1/doctor/scheduler | – | N/A (frozen 2026-08-09) | Host frozen to src/__Obsoleted/ under SPRINT_20260722_009 DOC-5; never deployed on the current stack. Scheduling is served by JobEngine at /api/v1/scheduler/doctor*, which the gateway already routes to scheduler.stella-ops.local. | N/A. |
| Evidence Locker predecessor (retired) | — | See current Evidence read contracts above | — | Evidence | Superseded by the consolidated native owner routes. | No predecessor route-type or environment-flag rollback. |
| excititor.stella-ops.local | excititor-web | /excititor | D | Developer + Test Automation (Wave D) | Add API-form microservice mapping if needed; migrate root compatibility route in Wave D. | Route type revert + EXCITITOR_ROUTER_ENABLED=false (RMW-03). |
| offlinekit.stella-ops.local (was exportcenter.stella-ops.local) | offlinekit-web (succeeded export-web 2026-09-13) | /api/offlinekit/v1 — already migrated | B | Developer + Test Automation (Wave B) | DONE at SPRINT_20260722_025 OK-6/OK-10. The route group is a single regex prefix on the successor host; the legacy /api/v1/export, /exportcenter and bare /v1/audit-bundles compatibility paths were deleted, not kept (§2.11 pre-release: no legacy aliases). Live probe 2026-09-14: /api/offlinekit/v1/exports/profiles → 401, /v1/exports → 404. | Route type revert is no longer available — the predecessor host is stopped and frozen. Rollback is the window’s documented stack revert. |
| findings.stella-ops.local | findings-ledger-web | /api/findings/v1 — already migrated (the pre-consolidation /api/v1/findings and sibling templates were deleted at SPRINT_20260928_004 PCD-152) | D | Developer + Test Automation (Wave D) | Migrate API prefix first, then root compatibility path. | Route type revert + FINDINGS_ROUTER_ENABLED=false (RMW-03). |
| (gateway.stella-ops.local — removed, consolidated into router-gateway) | — | — | — | — | Legacy gateway container eliminated; all traffic served by router-gateway (slot 0). | N/A |
| integrations.stella-ops.local | integrations-web | /api/v1/integrations, /integrations | A | Developer + Test Automation (Wave A) | Migrate API prefix first, then root compatibility path. | Route type revert + INTEGRATIONS_ROUTER_ENABLED=false (RMW-03). |
| issuerdirectory.stella-ops.local | issuer-directory | /issuerdirectory | B | Developer + Test Automation (Wave B) | Migrate route in trust-plane wave with issuer/auth verification checks. | Route type revert + ISSUERDIRECTORY_ROUTER_ENABLED=false (RMW-03). |
| notify.stella-ops.local (+ notifier.stella-ops.local alias) | notify-web | /api/v1/notify, /notify, /api/v1/notifier, /notifier | D | Developer + Test Automation (Wave D) | Merged: notifier-web folded into notify-web. | Route type revert + NOTIFY_ROUTER_ENABLED=false (RMW-03). |
| opsmemory.stella-ops.local | opsmemory-web | /api/v1/opsmemory, /opsmemory | A | Developer + Test Automation (Wave A) | Migrate API prefix first, then root compatibility path. | Route type revert + OPSMEMORY_ROUTER_ENABLED=false (RMW-03). |
| jobengine.stella-ops.local | orchestrator | /api/approvals, /api/jobengine, /api/release-orchestrator, /api/releases, /api/v1/jobengine, /api/v1/release-orchestrator, /api/v1/workflows, /orchestrator, /v1/runs | C | Developer + Test Automation (Wave C) | Migrate all API/v1 and v1 routes first; keep root compatibility path until control-plane acceptance. | Route type revert + ORCHESTRATOR_ROUTER_ENABLED=false (RMW-03). |
| packsregistry.stella-ops.local | packsregistry-web | /packsregistry | A | Developer + Test Automation (Wave A) | Add API-form endpoint mapping if required, then migrate root compatibility route. | Route type revert + PACKSREGISTRY_ROUTER_ENABLED=false (RMW-03). |
| platform.stella-ops.local | platform | /api, /api/admin, /api/analytics, /api/v1/authority/quotas, /api/v1/gateway/rate-limits, /api/v1/platform, /envsettings.json, /platform | C | Developer + Test Automation (Wave C) | Migrate API prefixes to Microservice; keep /platform and /envsettings.json reverse proxy for static/bootstrap behavior. | Route type revert + PLATFORM_ROUTER_ENABLED=false (RMW-03). |
| policy-engine.stella-ops.local | policy-engine | /api/risk, /api/risk-budget, /api/v1/determinization, /policyEngine | C | Developer + Test Automation (Wave C) | Migrate API prefixes first; keep root compatibility path until control-plane verification completes. | Route type revert + POLICY_ENGINE_ROUTER_ENABLED=false (RMW-03). |
| Merged into policy-engine above | - | - | Gateway merged into policy-engine. All routes now served by policy-engine. | - | ||
| reachgraph.stella-ops.local | reachgraph-web | none - not router-published | D | Developer + Test Automation (Wave D) | SPRINT_20260904_003 ROA-7: this host no longer registers with the Router at all (Router__Enabled: "false", hard-coded, no variable). graph-api composes the same StellaOps.ReachGraph.Application controllers and owns the /v1/reachgraphs, /v1/cve-mappings and /v1/reachability prefixes; publishing both made the answering host vary per request. The direct reachgraph.stella-ops.local alias is unaffected and stays until GRA-10 deletes the deployable. | No lever: there is nothing to roll back to. Re-enabling it restores the two-owner collision and fails RouterRoutePrefixOwnershipConformanceTests. |
| remediation.stella-ops.local | — (not in compose snapshot) | — (no ReverseProxy route in 2026-02-21 snapshot) | C | Developer + Test Automation (Wave C) | StellaOps.Remediation.WebService exists, but router/compose mapping is missing. Add explicit remediation API route inventory and then migrate to Microservice route type in control-plane wave. | Missing rollback key; add REMEDIATION_ROUTER_ENABLED once route is added. |
| registry-token.stella-ops.local | registry-token | /registryTokenservice | A | Developer + Test Automation (Wave A) | Migrate compatibility route with token flow validation in Wave A. | Route type revert + REGISTRY_TOKEN_ROUTER_ENABLED=false (RMW-03). |
| replay.stella-ops.local | replay-web | /replay | A | Developer + Test Automation (Wave A) | Migrate compatibility route in Wave A; add API-form alias if needed. | Route type revert + REPLAY_ROUTER_ENABLED=false (RMW-03). |
| riskengine.stella-ops.local | riskengine-web | /riskengine | C | Developer + Test Automation (Wave C) | Migrate compatibility route in control-plane wave; add API alias if required. | Route type revert + RISKENGINE_ROUTER_ENABLED=false (RMW-03). |
| sbomservice.stella-ops.local | sbomservice | /api/change-traces, /api/compare, /api/sbomservice, /api/v1/lineage, /api/v1/sbom, /api/v1/sources, /sbomservice | D | Developer + Test Automation (Wave D) | Migrate API prefixes first; keep root compatibility path until graph/feed wave acceptance. | Route type revert + SBOMSERVICE_ROUTER_ENABLED=false (RMW-03). |
| scanner.stella-ops.local | scanner-web | /api/fix-verification, /api/v1/scanner, /api/v1/secrets, /api/v1/triage, /api/v1/vulnerabilities, /api/v1/watchlist, /scanner | D | Developer + Test Automation (Wave D) | Migrate API prefixes first; keep root compatibility path until scanner behavioral checks pass. | Route type revert + SCANNER_ROUTER_ENABLED=false (RMW-03). |
| scheduler.stella-ops.local | scheduler-web | /api/scheduler, /scheduler | C | Developer + Test Automation (Wave C) | Migrate API prefix first, then root compatibility path. | Route type revert + SCHEDULER_ROUTER_ENABLED=false (RMW-03). |
| signals.stella-ops.local | signals | /api/v1/signals, /signals | D | Developer + Test Automation (Wave D) | Migrate API prefix first, then root compatibility path. | Route type revert + SIGNALS_ROUTER_ENABLED=false (RMW-03). |
| signer.stella-ops.local | signer | /signer | B | Developer + Test Automation (Wave B) | Migrate compatibility route in trust/evidence wave with signing validation. | Route type revert + SIGNER_ROUTER_ENABLED=false (RMW-03). |
| smremote.stella-ops.local | smremote | /smremote | A | Developer + Test Automation (Wave A) | Migrate compatibility route in Wave A; add API alias if required. | Route type revert + SMREMOTE_ROUTER_ENABLED=false (RMW-03). |
| symbols (source retired) | predecessor host frozen | Hub-owned binary/symbol routes | - | Vulnerabilities | See current ownership; no legacy aliases | Standing-estate window separately authorized. |
| taskrunner.stella-ops.local | taskrunner-web | /taskrunner | C | Developer + Test Automation (Wave C) | Migrate compatibility route in control-plane wave; add API alias if required. | Route type revert + TASKRUNNER_ROUTER_ENABLED=false (RMW-03). |
| timelineindexer.stella-ops.local | timeline-indexer-web | /timelineindexer | PILOT | Developer (pilot accepted) | Timeline API is already microservice (/api/v1/timeline); keep root compatibility route reverse proxy until later cleanup. | Route type revert + TIMELINE_ROUTER_ENABLED=false (already supported). |
| unknowns.stella-ops.local | unknowns-web | /unknowns | A | Developer + Test Automation (Wave A) | Migrate compatibility route in Wave A; add API alias if required. | Route type revert + UNKNOWNS_ROUTER_ENABLED=false (RMW-03). |
| vexhub.stella-ops.local | vexhub-web | /api/v1/vex, /api/vex, /vexhub | D | Developer + Test Automation (Wave D) | Migrate API prefixes first, then root compatibility path. | Route type revert + VEXHUB_ROUTER_ENABLED=false (RMW-03). |
| vexlens.stella-ops.local | vexlens-web | /api/v1/vexlens, /vexlens | D | Developer + Test Automation (Wave D) | Migrate API prefix first, then root compatibility path. | Route type revert + VEXLENS_ROUTER_ENABLED=false (RMW-03). |
| vulnexplorer.stella-ops.local | api | /api/vuln-explorer, /vulnexplorer | D | Developer + Test Automation (Wave D) | Migrate API prefix first; keep root compatibility path until vuln explorer routing is validated. | Route type revert + VULNEXPLORER_ROUTER_ENABLED=false (RMW-03). |
Wave Acceptance Mapping
| Wave | Acceptance Owner |
|---|---|
| A | Developer + Test Automation (Wave A) |
| B | Developer + Test Automation (Wave B) |
| C | Developer + Test Automation (Wave C) |
| D | Developer + Test Automation (Wave D) |
| PILOT | Developer (pilot accepted) |
Notes
- This matrix is the authoritative inventory artifact for sprint task
RMW-01. - Route-level rollback is always available by reverting route
Typeback toReverseProxyindevops/compose/router-gateway-local.json. - Service env rollback keys are currently planning placeholders and are standardized in
RMW-03.
Proof/verdict retrieval route contract verified against d456ec1a2c (2026-10-07). Re-verify this scoped contract with pwsh ./tools/scripts/test-targeted-xunit.ps1 -Project src/Evidence/__Tests/StellaOps.Evidence.WebService.Tests/StellaOps.Evidence.WebService.Tests.csproj -Class '*EvidenceAliasWithdrawalTests*' -BuildProjectReferences.