Stella Ops Web UI information architecture

Status: Current source-aligned reference (2026-07-13)

This document describes the operator-visible navigation, role paths, and action boundaries of the Stella Ops Web console. Source code remains authoritative when this document and the implementation differ.

Authorities

• Sidebar grouping and labels: NAVIGATION_GROUPS
• Navigation forcing tests: navigation.config.spec.ts
• Router families and compatibility redirects: app.routes.ts
• Route inventory forcing test: ux-route-inventory.spec.ts
• Shared navigation/route access and persona profiles: route-access.ts
• Web scope mirror: scopes.ts
• Canonical issued-scope catalog: StellaOpsScopes.cs
• Role and ABAC intent: Stella Ops user roles

Navigation model

The rail presents five mission pillars in this order. A router family is not automatically a rail destination: app.routes.ts owns resolvability, while NAVIGATION_GROUPS owns what the operator sees. Contextual and compatibility routes may therefore remain reachable without creating another first-level menu item.

Home
└─ Dashboard
Vulnerabilities
├─ Exposure
├─ Images
└─ Intelligence
Deployment
├─ Releases
├─ Promotions
└─ Environments
Proof
├─ Chain
├─ Estate
└─ Compliance
Operate
├─ Operations
├─ Connections
├─ Access
└─ Settings

Every pillar stays within the four-destination first-level limit enforced by navigation.config.spec.ts. Removing a duplicate door does not remove its owner route or valid deep links.

Pillars, destinations, and owner surfaces

Home

Dashboard is the overview, not an owner for release, security, proof, or administration mutations. Its cards hand off to the owning destination with the current subject and scope context.

Vulnerabilities

Exposure is the canonical risk-work entry. Older Risk Overview, Vulnerability Database, Findings Explorer, and Triage Queue doors are represented as Exposure lenses or contextual routes rather than parallel rail entries.

Advisory & VEX Sources preserves a read-only Mirror view for advisory:read. Mirror domain creation, configuration, credential regeneration, and deletion require the backend-aligned integration:write or integration:operate claim at both route and action boundaries. VEX statement creation is not exposed: VexHub has no authenticated statement-create endpoint, so /ops/policy/vex/create redirects to search until that server contract exists.

Deployment

The same destinations reorder for the active persona; scope gates do not change. Operations and Security lead with Promotions, while Developer, Compliance, and Overview lead with the release library. Environments remains the third door.

Proof

Proof distinguishes three questions: trace one record through Chain, inspect deployed proof coverage in Estate, and review regulator-facing coverage in Compliance. Audit Trail is the evidence audit surface even though its owner route remains under /ops/operations; it is not the same as Operate > Access > Admin activity or Settings > Trust Center > Audit.

Verify is an active deterministic read operation: its route requires replay:read. It reruns a recorded gate decision from sealed evidence and reports whether the result reproduces. Explicit durable replay token, bundle, or snapshot production remains gated by replay:write.

Operate

Operate is the quiet back-of-house pillar. It groups owner workspaces into four questions and pushes administration gates to the relevant child so non-admin operators retain their lanes.

Security Data, Tenant & Branding, System Settings, and Platform Status are not duplicate first-level doors. Their valid functionality is owned by Feeds & Vuln Data, Tenants & Access, User Preferences/Appearance, or Health respectively; compatibility routes remain a router concern.

Role-oriented paths

Stella Ops authorizes with token scopes and backend ABAC, not a role name alone. The first four persona profiles below mirror PERSONA_ROUTE_MATRICES; they determine expected visibility, not an unconditional permission grant. Platform Access Administrator is a capability path governed by admin scopes rather than a fifth dashboard persona.

Service contribution never implies broad operator, publisher, approver, bypass, or admin power. If directUpdateAllowed is false or the target is outside the user ABAC envelope, the UI must create an approval-required request or show why the action is unavailable.

Read visibility versus mutation authority

Admin and ui.admin are guard wildcards in the Web route-access helper, but issued claims still come from the Authority catalog and backend endpoints remain the final authorization boundary.

Context, deep links, and Back behavior

Canonical owner pages must accept contextual handoffs without becoming duplicate menu doors. The shared context-route-state.ts defines the common contract:

• returnTo is an application-local absolute path. Values not starting with /, protocol-relative values beginning //, and values containing control characters are rejected.
• Scope context uses tenant/tenantId, region/regions, environment/environments, timeWindow, and stage query keys.
• View state may use tab, panel, drawer, scope, or view.
• Cross-pillar evidence handoffs use the documented subject passport: /evidence/custody?subject=<URL-encoded canonical subject>. New producers use subject; typed digest/purl/release keys are compatibility inputs only. Owner details retain their path ids, and a source adds returnTo only when it needs an exact Back destination.
• Back follows a valid returnTo; otherwise it returns to the target’s canonical owner list. Query merging must retain unrelated scope keys.

Current examples:

• Exposure -> vulnerability detail -> Chain of Custody carries the CVE in subject and preserves the originating Exposure lens in returnTo.
• Estate cells open /evidence/custody?subject=... while retaining the active scope query.
• Release and approval details build explicit returnTo values before handing off to findings, proof, or release-flow surfaces.
• Audit sections use one owner route with a tab query, while Assurance framework lenses use distinct canonical routes rather than a framework query parameter.
• Legacy route helpers preserve relevant query and fragment context when redirecting to a current owner route; new links should target the current route directly.

Canonical terminology

Related documentation

• Web UI architecture
• Accessibility
• Component library
• Stella Ops user roles
• Historical v2 rewire package