Release notes — Excititor deprecated consensus removal

Sprint: 20260501-024 Audit: docs-archive/qa/audits/microservice-audit-pass2-2026-04-29.md §E4 Caller sweep: docs-archive/audits/2026-04-29_excititor_consensus_callers.md Status: Pre-prod, breaking changes explicitly authorized by user (2026-04-29).

Summary

The deprecated BaselineVexConsensusPolicy / VexConsensusResolver runtime, marked obsolete with diagnostic EXCITITOR001, has been deleted from Excititor. Verdict resolution is now exclusively a VexLens concern; Excititor preserves and transports linksets but does not compute consensus.

Removed types

The following types in StellaOps.Excititor.Core are gone:

• VexConsensus
• VexConsensusSource
• VexConsensusConflict
• VexConsensusStatus
• VexConsensusHold
• VexConsensusPolicyOptions
• IVexConsensusPolicy
• BaselineVexConsensusPolicy
• VexConsensusResolver
• VexConsensusRequest
• VexConsensusResolution
• VexConsensusDecisionTelemetry
• IVexConsensusStore and IVexConsensusHoldStore (Storage/VexConsensusStoreAbstractions.cs)

StellaOps.Excititor.Worker.Scheduling.VexConsensusRefreshService and its IVexConsensusRefreshScheduler interface are also deleted.

New types

StellaOps.Excititor.Policy:

• VexProviderWeights(Vendor, Distro, Platform, Hub, Attestation, Ceiling) — pure trust-weight carrier.
• VexEvidenceScoringOptions(Alpha, Beta) — scoring tuning record (no consensus algorithm attached).

StellaOps.Excititor.Core.Observations:

• VexLinksetReference(Digest, ConnectorId, StatementCount, ObservedAt) — wire reference to an append-only linkset.

VexPolicySnapshot exposes ProviderWeights and ScoringOptions as separate fields; ConsensusOptions and ConsensusPolicy are gone.

Wire contract changes

/excititor/resolve response (breaking)

The previous response shape (per-pair status, sources, conflicts, decisions, signed envelope) is removed. The endpoint now returns:

{
  "resolvedAt": "...",
  "policy": { "activeRevisionId", "version", "digest", "requestedRevisionId" },
  "results": [
    {
      "linksets": [
        { "digest", "connectorId", "statementCount", "observedAt" }
      ],
      "claimsByLinksetDigest": {
        "<linksetDigest>": [ /* VexClaim records */ ]
      },
      "providerWeights": { "vendor", "distro", "platform", "hub", "attestation", "ceiling" },
      "scoringOptions": { "alpha", "beta" },
      "policyDigest": { "revisionId", "version", "digest" },
      "vulnerabilityId": "...",
      "productKey": "..."
    }
  ]
}

VexLens consumes this shape and computes the verdict.

Export metadata keys (internal)

The export builder metadata dictionary now uses:

• linksetDigest (previously consensusDigest)
• linksetEntryCount (previously consensusEntryCount)

The score* keys (scoreAlpha, scoreBeta, scoreWeightCeiling, scoreDigest, scoreEntryCount) are unchanged.

Mirror bundle / VexExportManifest

For cross-module wire stability, the public manifest fields ConsensusDigest / ConsensusRevision and the mirror bundle wire fields consensusDigest / consensusDocument / consensusRevision are preserved. They now carry the canonical linkset reference digest / linkset-shaped JSON. CLI and Policy.Engine consumers do not need to change.

Portable evidence bundle

PortableEvidenceBundleContent.Consensus is removed; replaced with Linksets (ImmutableArray<VexLinksetReference>). PortableEvidenceBundleRequest.IncludeConsensus is removed; bundles are linkset-only.

IPortableEvidenceBundleBuilder.BuildAsync signature changed:

ValueTask<PortableEvidenceBundle> BuildAsync(
    PortableEvidenceBundleRequest request,
    IReadOnlyCollection<VexClaim> claims,
    IReadOnlyCollection<VexLinksetReference>? linksets,   // was VexConsensus?
    IReadOnlyCollection<TimelineEvent>? timelineEvents,
    VexAttestationMetadata? attestation,
    CancellationToken cancellationToken);

Configuration removed

• Excititor:Worker:Refresh (and all child keys including ConsensusTtl, ScanInterval, ScanBatchSize, Damper).
• Excititor:Worker:DisableConsensus (the consensus refresh service is gone, so the toggle is moot).

Operators upgrading to this version must remove these blocks from appsettings.json and corresponding environment variables. Validation will accept the document but unused keys are silently ignored.

Diagnostic suppressions

All #pragma warning disable EXCITITOR001 blocks have been removed from src/Concelier/.../Excititor.* and the matching __Tests/. The diagnostic id remains reserved for any future obsolete deprecations within the Excititor namespace.

Test impact

• VexConsensusRefreshServiceTests deleted alongside the hosted service.
• ExportEngineTests, MirrorBundlePublisherTests, format exporter tests, VexCanonicalJsonSerializerTests, VexPolicyBinderTests, VexPolicyDiagnosticsTests, VexPolicyProviderTests, ExcititorNoLatticeComputationTests, and TestServiceOverrides updated to construct VexLinksetReference and the new policy-weight records.

Cross-module migration

The cross-module sweep (committed at docs-archive/audits/2026-04-29_excititor_consensus_callers.md) confirmed no module outside src/Concelier/ consumed the deprecated Excititor consensus types directly. Namesake collisions in VexLens, Attestor, Findings.Ledger, ExportCenter, and Replay are independent types in their own namespaces and required no changes.

The consensusDigest / consensusRevision JSON wire fields on VexExportManifest and the mirror bundle remain part of the public contract for compatibility with StellaOps.Cli and StellaOps.Policy.Engine.AirGap.