StellaOps.Vulnerabilities
Verified against commit
942a18727con 2026-09-26 (UTC). Re-verify:ls src/Vulnerabilities src/__Obsoleted/Concelierandgrep -n "vulnerabilities-web:\|vulnerabilities-worker:" devops/release/bundle/docker-compose.yml.Service rows (host project, image, database and role, compose file, bundle presence, Doctor registration) are generated in
docs/architecture/service-inventory.md; where this page and the inventory differ, the inventory is authoritative.
The vulnerability knowledge hub: one microservice with two deployables (vulnerabilities-web, vulnerabilities-worker) and one database (stellaops_vuln, connection STELLAOPS_POSTGRES_VULN_CONNECTION). It holds tenant-free raw and normalized vulnerability, VEX, distro, EPSS, binary and symbol knowledge for the platform. Both deployables ship in the release bundle, which seeds the hub from a signed offline mirror seed at install time.
It replaced the Concelier (including Feedser and Excititor), VexHub and VexLens services per ADR-039. Their sources are frozen under src/__Obsoleted/Concelier/, and their dossiers are archived under docs-archive/modules/ (see architecture.md section 14).
Subordinate documents
| Document | Status |
|---|---|
| architecture.md | current: the module dossier |
| api-reference.md, openapi/v1.json | current: generated from the OpenAPI document; do not hand-edit |
| connectors-architecture.md | current for the source policy and the implemented connectors; tier lists name policy, not shipped code |
| mirror-seed.md | current (DAY-10 and DAY-11 in flight) |
| symbol-management.md | current |
| advisory-symbols.md | current |
| build-id-index-api.md | current |
| exploit-evidence-consumer-contract.md | current (states its own verification commit) |
| vex-wire-formats.md | current |
| retention-classification.md, retention-classification-verification-20260921.json | current: retention and custody record |
| binary-fold-rehearsal.md | design record, not re-verified 2026-09-26 |
| production-reingest-closeout-20260911.md | dated record (2026-09-11) |
Operations: vulnerability operations runbook. Target design and build record: vulnerability-data-plane-v2-design.md.