Tester (`stellaops-tester`) — QA-isolation harness

Not a product surface. stellaops-tester is a QA harness: it authenticates nobody, relays credentials, and injects fixtures. It ships in a single opt-in compose overlay and must never run in a production stack. Read architecture.md §6 and §8 before deploying it anywhere that is not a throwaway QA stack.

Purpose

Own all QA fixture-import and per-scenario action endpoints, so production module images can shed their embedded test surface instead of shipping it behind an env-flag. It also hosts the determinism oracle, POST /api/v1/tester/replay-and-compare, which canonicalises and SHA-256-compares the same artefacts across two run ids and returns identical or drift.

Quick links

Architecture — surface, isolation mechanics, oracle contract, known gaps
Invariants (binding) — src/Tester/AGENTS.md
Original decision record
Replay — the production deterministic-replay engine (a different module)

Status

Attribute	Value
Type	Service — QA only, opt-in overlay
Production-safe	No. `com.stellaops.production-safe: "false"` on both the image and the compose service
Source	`src/Tester/StellaOps.Tester.WebService`
Database	None (stateless; seed artefacts from a read-only mount)
Deployment	`devops/compose/docker-compose.tester.yml` only — never in `docker-compose.stella-ops.yml` or any `include:` list
Gateway prefix	`/api/v1/tester/*` (Router `serviceName: tester`; absent ⇒ the prefix 503s)
Container	`127.1.0.60:80` → `8080`, alias `tester.stella-ops.local`

Run it

docker compose -f devops/compose/docker-compose.stella-ops.yml \
               -f devops/compose/docker-compose.tester.yml up -d

The overlay declares the platform networks external, so it refuses to start without the base stack.

Caveat you must not skip