Federated Telemetry Architecture

Overview

The Federated Telemetry subsystem shares privacy-preserving runtime exploit intelligence across Stella Ops installations. Platform owns installation/site identity, synchronization, privacy accounting, bundles, and imported intelligence; each tenant controls whether its facts may participate. The optional peer lane is mTLS-authenticated, DSSE-verified, durable, and disabled by default.

Data Flow

Authenticated Tenant Runtime -> Platform Durable Fact Store -> TelemetryAggregator
    -> k-Anonymity Filter -> Laplacian Noise -> AggregationResult
    -> Consent Proof Set -> BundleBuilder -> DSSE-Signed Bundle
    -> Egress Allow-list -> Durable Local Outbox -> mTLS HTTPS peer delivery
    -> DSSE verify + digest-bound receipt -> Durable aggregate-intelligence store

Privacy Model

Differential Privacy (Epsilon Budget)

Each aggregation cycle consumes a portion of the total epsilon budget. The budget resets on a configurable period (default: 24 hours).

• Epsilon per bucket: total_budget / number_of_buckets
• Laplacian noise: -(sensitivity / epsilon) * sign(u) * ln(1 - 2|u|) where u ~ Uniform(-0.5, 0.5)
• Budget exhaustion: When remaining epsilon reaches zero, all further aggregation is suppressed until the next reset period.

K-Anonymity

Buckets (grouped by CVE ID) with contributions from fewer than k distinct consenting tenants are suppressed entirely. Each tenant’s contribution per CVE/window is bounded by MaxContributionsPerTenantPerCveWindow; that bound defines the sensitivity used for noise. The default threshold is k=5, configurable via FederatedTelemetryOptions.KAnonymityThreshold.

Consent Lifecycle

1. Not Granted (default) – no federation data leaves the instance.
2. Granted – admin explicitly grants consent with optional TTL. A DSSE-signed consent proof is created.
3. Expired – consent with a TTL automatically reverts to Not Granted after expiry.
4. Revoked – admin explicitly revokes consent.

Consent is tenant-scoped and persisted by Platform in platform.telemetry_federation_consents; revocation is retained instead of deleting the proof. The installation sync cycle claims facts only for active, unexpired consent proofs and records a non-identifying consent-set commitment.

NIS2 area KPI metrics follow the same opt-in boundary. They are local telemetry by default and are not exported to federation peers unless the existing federation consent is granted and sealed mode is disabled. There is no separate NIS2-only federation flag in v1; adding one would be a new global configuration pattern and is intentionally out of scope for sprint 060.

Sync Service

FederatedTelemetrySyncService is registered as a BackgroundService only when Platform:TelemetryFederation:Enabled=true. The default is disabled.

Current cycle behavior:

1. Skip with federation.sync.disabled when disabled.
2. Skip with federation.sync.sealed_mode when sealed.
3. Fail closed when durable runtime state, signer identity, destination, or egress allow-list is unavailable.
4. Atomically claim unbundled facts from active consenting tenants, aggregate with tenant bounds, persist a non-identifying consent-set commitment and signed installation bundle, and enqueue a durable local outbox row.

Migration 007 supplies durable consent, fact, privacy-ledger, consent-set, installation, bundle, and outbox tables. Migration 008 makes imported aggregate intelligence durable. Migration 009 adds leased delivery claims, peer receipt state, and the idempotent inbox. Peer delivery requires an HTTPS destination plus a mounted PKCS#12 client certificate; the receiver binds the certificate SHA-256 thumbprint to the signed source site.

Intelligence Merging

Incoming bundles from federation peers are processed by ExploitIntelligenceMerger:

• Entries are normalized (CVE ID uppercase, timestamps UTC, site IDs lowercase).
• Deduplication by (CveId, SourceSiteId) composite key.
• Conflict resolution: latest ObservedAt wins.
• Platform persists the resulting aggregate corpus in platform.telemetry_federation_intelligence.
• The internal receive route is excluded from public OpenAPI. It accepts only certificates explicitly bound to the signed source site and verifies the DSSE envelope before one atomic inbox/intelligence transaction.
• Duplicate (sourceSiteId, bundleId) delivery returns the deterministic receipt only when the envelope digest matches; a mismatch is rejected.

Bundle Format

A FederatedBundle contains:

• Unique ID (GUID)
• Source site identifier
• Aggregation result (buckets with noisy counts, suppression flags)
• A non-identifying consent-set commitment and privacy-policy version linkage.
• Bundle DSSE digest (integrity verification)
• DSSE envelope (signed payload)
• Creation timestamp

Sealed Mode

When FederatedTelemetryOptions.SealedModeEnabled is true:

• Sync service skips all cycles.
• No outbound traffic is generated.
• Local aggregation still functions for internal analytics.
• Intelligence merging is paused.

Configuration

{
  "Platform": {
    "TelemetryFederation": {
      "Enabled": false,
      "KAnonymityThreshold": 5,
      "MaxContributionsPerTenantPerCveWindow": 1,
      "ContributionWindow": "24:00:00",
      "PrivacyPolicyVersion": "federated-telemetry-privacy-v1",
      "DestinationSiteId": "mesh-eu",
      "EgressAllowedDestinationSiteIds": ["mesh-eu"],
      "EpsilonBudget": 1.0,
      "BudgetResetPeriod": "24:00:00",
      "AggregationInterval": "00:15:00",
      "SealedModeEnabled": false,
      "ConsentPredicateType": "stella.ops/federatedConsent@v1",
      "BundlePredicateType": "stella.ops/federatedTelemetry@v1",
      "SiteId": "site-001"
    }
  }
}

Platform:Federation is not an alias for this section; it configures ReleaseOrchestrator regional federation.

Peer delivery additionally sets PeerTransportEnabled=true, an absolute HTTPS PeerEndpoint, a mounted PeerClientCertificatePath (password supplied from a secret source), and PeerCertificateSiteBindings entries mapping SHA-256 certificate thumbprints to exact source site IDs. The receiving Platform HTTPS listener must request/require client certificates so ASP.NET Core populates Connection.ClientCertificate; an ordinary Gateway hop or forged certificate header is not an authentication substitute. MaximumPeerEnvelopeBytes, MaximumPeerBuckets, the delivery interval, claim lease, and per-cycle maximum are bounded configuration. The peer wire document contains only the DSSE envelope, its SHA-256 digest, and signer key hint; suppressed buckets and raw observation counts are not transmitted.

API Surface

See src/Platform/StellaOps.Platform.WebService/Endpoints/FederationTelemetryEndpoints.cs for the full REST API.

Source Files

• Project: src/Telemetry/StellaOps.Telemetry.Federation/
• Tests: src/Telemetry/StellaOps.Telemetry.Federation.Tests/
• API: src/Platform/StellaOps.Platform.WebService/Endpoints/FederationTelemetryEndpoints.cs
• UI: src/Web/StellaOps.Web/src/app/features/platform-ops/federation-telemetry/