Stella Ops Runbooks

Audience: operators running the Stella Ops release control plane in dev or production.

One home (LOCATIONS.md): every operational runbook lives here, bucketed by service/topic — docs/runbooks/<bucket>/<topic>.md. docs/operations/ carries GUIDES only (concepts, setup, reference); anything procedure-shaped belongs in a bucket below. Completed one-shot cutover runbooks are frozen in docs-archive/runbooks/. Agent role playbooks are a different genre and live in the agent knowledge base (see AGENTS.md — Memory).

Coverage ledger: COVERAGE.md. Restructured 2026-08-24 (knowledge-restructure P7, SPRINT_20260824_009) from eight historical homes; git history follows every file.

advisoryai (3)

• advisoryai-aai9-data-move.md — AdvisoryAI AAI-9 own-database data move and rollback
• advisoryai-aai9-window-plan.md — AdvisoryAI AAI-9 maintenance window — execution plan
• advisoryai-deploy-aai8-staged-stack.md — AdvisoryAI — building and deploying the staged consolidated stack (AAI-8)

airgap (3)

• airgap-operations-runbook.md — Air-Gap Operations Runbook
• offlinekit-cutover-ok6-route-swap.md — OfflineKit cutover — OK-6 gateway route swap
• offlinekit-deploy-ok9-staged-stack.md — OfflineKit — building and deploying the staged consolidated stack (OK-9)

authority (6)

• authority-break-glass-recovery.md — Runbook — Authority break-glass recovery
• authority-cutover-auth5-route-swap.md — Authority cutover — AUTH-5 gateway route change (issuer-directory fold)
• authority-deploy-auth8-staged-fold.md — Authority — building and deploying the staged issuer fold (AUTH-8)
• authority-gateway-auth-troubleshooting.md — Runbook — Authority / gateway auth troubleshooting
• authority-identity-provider-bundles.md — Authority identity-provider bundle operations
• break-glass-runbook.md — Authority Break-Glass Account Runbook

ci (4)

• ci-board-20260925.md — CI board on main, 2026-09-25: every lane, its latest run and the cause of each red one
• ci-lane-operations.md — Runbook — Live-stack CI lane operations (analyzer-coverage, airgap-federation-e2e)
• golden-corpus-operations.md — Golden Corpus Operations Runbook
• replay-determinism-test.md

Hub ingestion and predecessor pointers (6)

• concelier-connector-operations.md — current Vulnerabilities ingestion operations
• connector-nvd.md — current hub NVD configuration and diagnosis
• connector-osv.md — current hub OSV input configuration and diagnosis
• connector-ghsa.md — withdrawn standalone GHSA procedure; current owner and historical evidence
• connector-vendor-specific.md — withdrawn Concelier template; current source registration procedure
• concelier-airgap-bundle-deploy.md — withdrawn Concelier import procedure; use Offline Kit

database (6)

• artifact-migration-runbook.md — Artifact Store Migration Runbook
• database-maintenance.md — Runbook — routine database maintenance
• migration-recovery.md — Migration Recovery Runbook
• policy-database-cutover.md — Runbook — moving Policy onto its own database (stellaops_policy)
• postgres-ops.md — PostgreSQL Database Runbook
• postgresql-patterns-runbook.md — PostgreSQL Patterns Operational Runbook
• release-orchestrator-topology-copy-retirement.md — Runbook — retiring ReleaseOrchestrator’s topology copy (RO migration 009)

delivery (1)

• ansible-delivery-environment-onboarding.md — Onboard an Ansible delivery environment

deploy (15)

• agent-host-bootstrap.md — Agent host bootstrap (enroll a deployment agent beside the control plane or on a Docker host)
• backup-restore-drill.md — Backup and Restore Drill for One Installation
• backup-restore-ops.md — Runbook: Backup and Restore Operations
• blue-green-deployment.md — Blue/Green Compose Deployment Runbook
• bootstrap-determinism-test.md
• deployment-prerequisites.md
• deployment-upgrade.md — Stella Ops Deployment Upgrade & Rollback Runbook
• image-rebuild-order.md — Image Rebuild Order Runbook
• launch-cutover.md — Launch Cutover Runbook — Stella Ops
• launch-readiness.md — Launch Readiness Record — Stella Ops
• nuget-preview-bootstrap.md — NuGet Preview Bootstrap (Offline-Friendly)
• orchestrator-rollback-failed.md — Runbook: Release Orchestrator - Rollback Operation Failed
• v1-publication-dispatch.md — Publishing the corrected v1.0.0 image set (HDR-3)
• weighted-canary-deployment.md — Weighted Canary Deployment Runbook
• winrm-deploy-prerequisites.md — WinRM deploy target — prerequisites, the GPO wall, and revert (NX-3)
• zastava-deployment.md — Zastava Kubernetes Deployment Runbook — Retired

evidence (9)

• attestor-hsm-connection.md — Runbook: Attestor - HSM Connection Issues
• attestor-key-expired.md — Runbook: Attestor - Signing Key Expired
• attestor-rekor-unavailable.md — Runbook: Attestor - Rekor Transparency Log Unreachable
• attestor-signing-failed.md — Runbook: Attestor - Signature Generation Failures
• attestor-transparency-mirror-exchange.md — Attestor External Transparency Mirror Exchange
• attestor-verification-failed.md — Runbook: Attestor - Attestation Verification Failures
• evidence-evd9-data-move.md — Evidence EVD-9 data move and cutover
• evidence-locker-ops.md — Evidence Locker Operations Runbook
• orchestrator-evidence-missing.md — Runbook: Release Orchestrator Required Evidence Is Missing

findings (3)

• findings-cutover-fnd5-route-swap.md — FND-9 window — Findings consolidated route swap
• findings-graph-asset-registry-source-unavailable.md — Runbook: Findings - Graph asset registry source unavailable
• findings-service-deploy.md — Deploying the consolidated Findings service (findings-web / findings-worker)

general (26)

• _completed-cutovers-moved.md — Moved to docs-archive/runbooks/
• assistant-ops.md — Assistant Ops Runbook (DOCS-AIAI-31-009)
• checkpoint-divergence-runbook.md — Checkpoint Divergence Detection and Incident Response
• cra-reporting-runbook.md — CRA Article 14 Operator Reporting Runbook
• hlc-troubleshooting.md — HLC Troubleshooting Runbook
• incident-response-runbook.md
• incidents.md — Incident Mode Runbook
• local-composehost-docker-desktop.md — Deploy to local Docker Desktop with a ComposeHost target
• local-vm-targets.md — Local VM lab — operator runbook
• local-workspace-disk-hygiene.md
• operator-verify.md — Operator Verify Runbook
• orchestrator-gate-timeout.md — Runbook: Release Orchestrator - Gate Evaluation Timeout
• orchestrator-promotion-stuck.md — Runbook: Release Orchestrator - Promotion Not Progressing
• orchestrator-quota-exceeded.md — Runbook: Release Orchestrator - Resource Quota Exhausted
• orchestrator-runbook.md — Orchestrator Runbook (DOCS-ORCH-34-003)
• plugin-cross-alc-missingmethod.md — Runbook — Plugin MissingMethodException (cross-ALC type identity)
• proof-verification-runbook.md — Proof Verification Operations Runbook
• runtime-linkage-ops.md — Runtime Linkage Verification - Operational Runbook
• score-proofs-runbook.md — Score Proofs Operations Runbook
• tenant-onboarding.md — Tenant Onboarding — Auto-Grant CLI Client Access
• tlpt-runbook.md — DORA TLPT Operations Runbook
• trust-lattice-runbook.md — VEX Consensus Operations Runbook
• unknowns-queue-runbook.md — Unknowns Queue Management Runbook
• upgrade-runbook.md — Upgrade Runbook - Retired Kubernetes Procedure
• vex-ops.md — VEX Operations Runbook
• watchlist-monitoring-runbook.md — Identity Watchlist Monitoring Runbook

graph (4)

• graph-cutover-gra5-route-swap.md — GRA-9 window — Graph consolidated route swap
• graph-deploy-gra8-staged-stack.md — Graph — building and deploying the staged consolidated stack (GRA-8)
• reachability-runbook.md — Reachability Analysis Operations Runbook
• reachability-runtime.md — Reachability Runtime Ingestion Runbook

integrations (2)

• integrations-cutover-int4-route-swap.md — Integrations cutover — INT-4 gateway route swap
• integrations-deploy-int5-staged-repoint.md — Integrations deploy — INT-5 staged own-database repoint

jobengine (4)

• estate-doctor-plugin-staging.md — Estate-doctor Scheduler/worker runtime-plugin staging (repository-side only)
• jobengine-cutover-job5-route-swap.md — JOB-9 window — JobEngine consolidated route swap
• jobengine-deploy-job8-staged-stack.md — JobEngine — building and deploying the staged consolidated stack (JOB-8)
• packsregistry-dual-mode-storage-cutover.md — PacksRegistry dual-mode storage cutover, rollback and JOB-9 same-volume handoff

keys (16)

• credential-storage-algorithm-switch.md — Runbook — Credential storage algorithm switch (per-tenant)
• crypto-ops.md — Runbook: Regional Crypto Operations
• dual-control-ceremony-runbook.md — Dual-Control Ceremony Runbook
• hsm-setup-runbook.md — HSM Setup and Configuration Runbook
• kek-rotation.md — Runbook — Master KEK rotation
• kek-source-hsm.md — Runbook — HSM as the master KEK source
• kek-source-vault.md — Runbook — Vault as the master KEK source
• kestrel-certificate-rotation.md — Runbook — Kestrel TLS certificate rotation
• key-escrow-runbook.md — Key Escrow and Recovery Runbook
• key-rotation-runbook.md
• production-signing-runbook.md — Production signing runbook (compliance evidence)
• secret-provider-multi-provider.md — Runbook — Multi-provider secret registry (builtin + openbao + vault)
• verification-key-rotation.md — Runbook — Verification root-key rotation & re-enveloping
• vendor-entitlement-fulfilment.md — Runbook — From an accepted order to a delivered entitlement certificate
• vendor-entitlement-issuer.md — Runbook — Vendor entitlement issuer
• vendor-signing-key-ceremony.md — Runbook — Vendor signing keys: ceremony, custody, rotation and compromise recovery

notify (5)

• notifier-runbook.md
• notify-cutover-ntf5-route-swap.md — Notify cutover — NTF-5 gateway route swap (NTF-9 window)
• notify-deploy-ntf8-staged-stack.md — Notify — building and deploying the staged consolidated worker (NTF-8)
• notify-ntf9-data-move.md — Notify NTF-9 own-database data move and rollback
• notify-ntf9-delivery-forcing-function.md — Notify NTF-9 — attributable end-to-end delivery forcing function

platform (1)

• platform-well-known-actor-seed-recovery.md — Platform well-known actor seed recovery

policy (6)

• policy-compilation-failed.md — Runbook: Policy Engine - Policy Compilation Errors
• policy-evaluation-slow.md — Runbook: Policy Engine - Evaluation Latency High
• policy-incident.md — Policy Incident Runbook
• policy-opa-crash.md — Runbook: Policy Engine - OPA Evaluation Failure
• policy-storage-unavailable.md — Runbook: Policy Engine - Policy Storage Backend Down
• policy-version-mismatch.md — Runbook: Policy Engine — Policy Version Conflicts

registry (5)

• ci-registry-pull-through-cache.md — CI Docker Hub pull-through cache
• registry-auto-scan-sbom-readiness.md — Runbook — Registry added but images not scanned / deploy gate blocked on missing SBOM
• registry-bridge-cache.md — Registry bridge pull-through cache
• registry-compatibility.md — Registry Compatibility Quick Reference
• registry-referrer-troubleshooting.md — Registry Referrer Discovery Troubleshooting

replay (2)

• replay_ops.md — Runbook: Replay Operations
• score-replay-runbook.md — Score Replay Operations Runbook

router (2)

• add-router-transport.md — Runbook — Adding a Router Transport Plugin
• router-chaos-testing-runbook.md

scanner (7)

• scanner-hub-advisory-v2-cutover.md — Scanner Hub Advisory v2 cutover, acceptance, rollback, and soak
• scanner-oom.md — Runbook: Scanner — Out of Memory on Large Images
• scanner-registry-auth.md — Runbook: Scanner — Registry Authentication Failures
• scanner-sbom-generation-failed.md — Runbook: Scanner — SBOM Generation Failures
• scanner-scn5-data-move.md — Scanner SCN-5 own-database data move and rollback
• scanner-timeout.md — Runbook: Scanner — Scan Timeout on Complex Images
• scanner-worker-dotnet-callgraph-m1.md — Scanner-worker .NET callgraph — M1 (restore-aware) enable
• scanner-worker-stuck.md — Runbook: Scanner — Worker Not Processing Jobs

telemetry (1)

• federated-telemetry-operations.md — Federated Telemetry Operations Runbook

timeline (1)

• timeline-partition-cutover.md — Timeline unified-audit partition cutover

vulnerabilities (2)

• vuln-cutover-b7-route-swap.md — B7 window — old vulnerability-plane route swap
• vuln-ops.md — Vulnerability Operations Runbook