Stella Ops Suite Documentation
Stella Ops is a self-hosted release control plane for non-Kubernetes container estates. Its promise is to help a team using existing CI deliver a governed release, recover safely and prove the decision later, including offline.
Start with the vision, product card and user roles. The governed release program records the gaps and acceptance work needed to complete that promise. These documents do not claim that the whole journey is already accepted in a deployed installation.
Working in this repo: start at the repository contract, then the runbooks.
Tenancy model
Stella Ops supports multiple logical tenants, such as environments, business units, or sub-organizations, inside one operator’s trust boundary. Those tenants share the same operator, security team, incident-response authority, and deployment posture. Cross-tenant adversarial workloads and shared-tenancy SaaS hosting for unrelated tenants are out of scope for the current architecture. See ADR-005.
Product outcomes and current evidence
| Outcome | What the product must establish |
|---|---|
| Governed release | Exact artifact/release/configuration identity, correct policy inputs and separately scoped approval and deployment authority. |
| Usable risk decision | Relevant findings, VEX and reachability within stated coverage; missing, unknown, stale and unavailable inputs remain explicit. |
| Observed delivery and recovery | Named target and observer, checked properties, interruption/retry/rollback outcomes; dispatch is distinct from completion. |
| Independent proof | Final decision revision, durable evidence completion and export that a separate supported verifier can check offline. |
| Repeatable operation | Changed-risk response and supported installation, upgrade, restore and maintenance. |
The key capabilities explain these boundaries. The capability matrix records dated source verification and recheck commands; current architecture identifies serving owners. Source wiring and route coverage do not establish deployed role acceptance. Regional crypto support and evidence export do not alone certify regulatory compliance.
The first acceptance profile is one Docker/Compose estate, two environments, real targets and a multi-component application under one operator. The roadmap prioritizes completing that journey before new discovery, analytics, framework scoring or federation expansion.
Two levels of documentation
- High-level (canonical): curated guides in
docs/*.md. - Detailed (reference): deep dives under
docs/**(module dossiers, architecture notes, API contracts/samples, runbooks, schemas).
Entry point:docs/technical/README.md.
This documentation set is intentionally consolidated and does not maintain compatibility stubs for old paths.
Start here
Product understanding
| Goal | Open this |
|---|---|
| Understand the suite quickly | overview.md |
| Understand user roles and workspace ownership | product/user-roles.md |
| Product operating card | product/release-with-confidence-product-card.md |
| Know what RC1 actually ships today | RC1_CAPABILITY_MATRIX.md |
| Capability cards | key-features.md |
| Historical capability vocabulary (matrix retired 2026-08-24) | docs-archive/FEATURE_MATRIX-rev6.1-2026-02-06.md |
| Terminology reference | GLOSSARY.md |
| Product vision | product/VISION.md |
| Assurance and optional compliance packs | compliance/README.md |
Getting started
| Goal | Open this |
|---|---|
| First run and basic workflows | quickstart.md |
| Installation guide | INSTALL_GUIDE.md |
| Operate a released site from the CLI image | modules/cli/guides/released-site-operator-quickstart.md |
| Runtime data assets (ML models, JDK, certs) | ../devops/runtime-assets/README.md |
| Operate live vulnerability/advisory ingestion | modules/vulnerabilities/architecture.md, runbooks/vulnerabilities/vuln-ops.md |
| Console (Web UI) operator guide | UI_GUIDE.md |
| Console persona/page gap analysis | modules/ui/persona-workspace-gap-analysis.md |
| Offline / air-gap operations | OFFLINE_KIT.md |
Architecture
| Goal | Open this |
|---|---|
| Architecture: high-level overview | ARCHITECTURE_OVERVIEW.md |
| Architecture: services, ownership, deployment shapes, retired hosts | 07_HIGH_LEVEL_ARCHITECTURE.md |
| Architecture: generated service inventory | architecture/service-inventory.md |
| Architecture: platform overview dossier | modules/platform/architecture-overview.md |
| Architecture: Assurance runtime and pack model | compliance/assurance-runtime.md |
| Architecture: Graph asset registry dossier | modules/graph/asset-registry.md |
| Architecture: full reference map | ARCHITECTURE_REFERENCE.md |
| Architecture: user flows (UML) | technical/architecture/user-flows.md |
| Architecture: module matrix | technical/architecture/module-matrix.md |
| Architecture: data flows | technical/architecture/data-flows.md |
| Architecture: schema mapping | technical/architecture/schema-mapping.md |
| Release Orchestration dossier | modules/release-orchestrator/architecture.md |
| Telemetry federation architecture | modules/telemetry/federation-architecture.md |
| Telemetry federation runbook | runbooks/federated-telemetry-operations.md |
| Telemetry federation contracts | contracts/federated-consent-v1.md, contracts/federated-telemetry-v1.md |
Service and module map
Verified against commit
ab4b3ca1d9(2026-09-26). The per-service table, with source project, image, database, compose file, bundle presence and dossier, is the generated service inventory;python tools/scripts/generate/service-inventory.py --checkfails when it drifts fromsrc/.
| Area | Services | Dossiers |
|---|---|---|
| Entry and identity | router-gateway, authority | router, authority |
| Control plane | platform, release-orchestrator, agent-core, jobengine-web, jobengine-worker, jobengine-estate-worker | platform, release-orchestrator, jobengine |
| Integrations and notifications | integrations-web, notify-web, notify-worker, timeline-web | integrations, notify, timeline |
| Scanning and SBOM | scanner-web, scanner-worker, sbomservice | scanner, sbom-service |
| Vulnerability data | vulnerabilities-web, vulnerabilities-worker | vulnerabilities |
| Reachability and graph | signals, graph-api | signals, graph |
| Policy, findings and risk | policy-engine, findings-web, findings-worker, unknowns-web | policy, findings, unknowns |
| AI assistance | advisoryai-web, advisoryai-worker | advisory-ai |
| Evidence, signing and replay | evidence-web, evidence-worker, attestor-tileproxy, tsa, signer, replay-web | evidence, signer, replay |
| Registry and offline exchange | registry-web, registry-token, offlinekit-web, offlinekit-worker | registry, offlinekit |
| Console, CLI and libraries | the Console SPA, the stella CLI, crypto and plugin SDKs | ui, cli, cryptography, plugin |
Every other directory under modules/documents a library, a tool, a concept, or a retired module that points to its successor. 07_HIGH_LEVEL_ARCHITECTURE.mdnames each retired host once with its successor.
Development and operations
| Goal | Open this |
|---|---|
| Develop plugins/connectors | PLUGIN_SDK_GUIDE.md |
| Secrets, keys & the master-key ceremony | operations/secrets-and-keys-guide.md |
| Registries & masked image references | operations/registries-and-masked-refs-guide.md |
| Automate releases with an OAuth service client | operations/release-automation-with-service-clients.md |
| Runtime diagnostics and health-check remediation | doctor/ |
| Console UI traversal map | qa/console-ui-traversal-map.md |
| Console UI QA strategy | qa/console-ui-qa-strategy.md |
| Security deployment hardening | SECURITY_HARDENING_GUIDE.md |
| Coordinated Vulnerability Disclosure (CVD) policy | security/coordinated-vulnerability-disclosure.md |
| EU supplier-security statement | europe/stella-supplier-security-statement.md |
| VEX consensus and issuer trust | VEX_CONSENSUS_GUIDE.md |
| Vulnerability Explorer guide | VULNERABILITY_EXPLORER_GUIDE.md |
| SBOM determinism guide | sboms/DETERMINISM.md |
| Engineering standards (for implementers) | code-of-conduct/CODE_OF_CONDUCT.md |
| Testing standards (for QA/automation) | code-of-conduct/TESTING_PRACTICES.md |
Detailed indexes
- Master documentation index (everything, by audience and topic):
INDEX.md - Technical index (everything):
docs/technical/README.md - End-to-end workflow flows:
docs/flows/ - Module dossiers:
docs/modules/ - API contracts and samples:
docs/api/ - Architecture notes / ADRs:
docs/technical/architecture/,docs/architecture/decisions/(accepted ADRs); RFCs (proposals) atdocs/rfcs/ - Operations and deployment:
docs/operations/ - Air-gap workflows:
docs/modules/airgap/guides/ - Security deep dives:
docs/security/ - Benchmarks and fixtures:
docs/benchmarks/,docs/assets/ - Product advisories:
docs/product/advisories/ - Hybrid diff patching blueprint:
docs/product/hybrid-diff-patching.md
License and notices
- Project license (BUSL-1.1 + Additional Use Grant):
../LICENSE - Product support policy:
docs/legal/product-support-policy.md - End-of-life policy:
docs/legal/eol-policy.md - Product lifecycle contract:
docs/contracts/product-lifecycle-v1.md - Third-party notices:
../NOTICE.md - Legal and licensing index:
docs/legal/README.md - Full dependency inventory:
docs/legal/THIRD-PARTY-DEPENDENCIES.md - Compatibility guidance:
docs/legal/LICENSE-COMPATIBILITY.md - Cryptography compliance:
docs/legal/crypto-compliance-review.md
Design principles (non-negotiable)
- Offline-first: core operations must work in restricted/air-gapped environments.
- Deterministic replay: same inputs yield the same outputs (stable ordering, canonical hashing).
- Evidence-linked decisions: every decision links to concrete evidence artifacts.
- Digest-first identity: releases are immutable OCI digests, not mutable tags.
- Pluggable integrations: connectors and steps are extensible; the core evidence chain stays stable.