Vulnerabilities hub ingestion operations

Audience: operators investigating advisory ingestion on the current installation.

Source verification: 0da1a3c784, 2026-10-04 (PCD-283). The procedure below follows the current Vulnerabilities worker, owner API and registered CLI. It does not assert that a particular deployed source is healthy. The path retains its historical name for links; the current source owner is src/Vulnerabilities, with ingestion in vulnerabilities-worker and owner reads in vulnerabilities-web. Concelier backs nothing running. Do not obtain CVE Services credentials for the stopped source; its retirement is VULN-B1. Concelier and Excititor are retired. Their original operations record is frozen evidence, not an operating procedure.

Read the owner state

Use an installed CLI configured for the intended Vulnerabilities owner and the installation’s normal Authority authentication. The read capability is advisory:read. The CLI accepts an explicit owner base URL through STELLAOPS_VULNERABILITIES_URL; keep authentication material in the existing operator configuration rather than copying it into incident reports.

stella sources status --json
stella config sources list --json

Both commands read GET /api/vulnerabilities/v1/sources. They report stored generation accounting, not a source configuration catalogue or a connectivity probe. A source that has never created a generation may be absent; compare the response with the worker’s configured source list. A CLI/API failure is not an empty healthy result.

Record asOf, source, generation, state, inventoryScope, docsSeen, docsNew, docsQuarantined, lastCompletedGeneration and lastCompletedAt for the affected source. The API derives health in this order:

Health	Meaning
`never-completed`	No generation has completed.
`stalled`	An earlier generation completed, but the latest was abandoned.
`empty`	The last completed generation saw zero documents. This takes precedence over a new active run.
`ingesting`	A run is active and the source has a non-empty completed generation.
`healthy`	The recorded generation completed with documents.

These labels are derived from generation state, not a wall-clock freshness threshold. GET /api/vulnerabilities/v1/readiness, also protected by advisory:read, supplies the separate corpus-readiness result. A completed source does not alone prove that publication, downstream ingestion or a scanner result is current.

Verify worker configuration and scheduling

The vulnerabilities-worker host owns ingestion. Inspect only the relevant non-secret settings in the installation’s recorded configuration and the worker startup log. Do not dump rendered configuration or credentials into evidence.

Configuration key	Current meaning
`Vulnerabilities:Ingestion:Scheduler:Enabled`	Enables the worker loop; false by default in the options class.
`Vulnerabilities:Ingestion:Scheduler:EnabledSources`	Ordered source keys attempted by each cycle.
`Vulnerabilities:Ingestion:Scheduler:Interval`	Pause after a cycle; the options default is four hours.
`Vulnerabilities:Ingestion:Scheduler:NormalizeBatchSize`	Normalization batch size.
`Vulnerabilities:Ingestion:Scheduler:EpssEnabled`	Enables the separate EPSS snapshot step.

Environment binding uses double underscores between segments; list entries use numeric segments, for example Vulnerabilities__Ingestion__Scheduler__EnabledSources__0. Configuration changes use the installation’s normal service deployment procedure. This runbook does not trigger a deployment or authorize a broader source set.

The worker logs whether scheduling is disabled or enabled, including the selected sources and interval. When enabled it starts a cycle, then waits the configured interval. Review its Ingest cycle <source>: ok|FAILED outcomes and the corresponding generation changes. A source failure is reported separately so other configured sources can continue. Preserve the source key, generation and sanitized error evidence when escalating a failed cycle.

There is no replacement public source-administration or manual source-trigger API in this procedure. The former Concelier jobs, fetch/parse/map commands and configuration namespace do not control this worker. Do not repair ingestion by writing predecessor cursor tables.

Source configuration

Bindings live under Vulnerabilities:Ingestion:Sources:<Name> in the ingestion library’s ServiceCollectionExtensions.AddVulnerabilitiesIngestScheduling. Use the exact source key and binding name; a vendor name in the retired catalogue does not establish a current connector.

Source key	Binding name / procedure
`nvd`	`Nvd` — NVD ingestion
`osv`	`Osv` — OSV ingestion
`cve`	`Cve` — CVE List v5 contract
`kev`	`Kev`
`redhat-csaf`, `suse-csaf`	`RedHatCsaf`, `SuseCsaf`
`alpine-secdb`, `debian-security-tracker`	`AlpineSecdb`, `DebianSecurityTracker`
`distro-binary-corpus`	`DistroBinaryCorpus` — binary-corpus procedure
`stellaops-mirror`	`StellaOpsMirror` — consult the Offline Kit ownership and import procedure for signed carrier handling and domain activation.

The current Tier-0 registration has no standalone GHSA connector. Do not infer complete coverage for a retired source from the presence of OSV or another current source; inspect the configured input and resulting owner evidence.

Verify a recovery

Retain the before-state generation and relevant worker failure.
Correct the identified configuration, upstream/mirror availability or service fault through its owning procedure. Keep the source’s integrity and authentication requirements.
Observe the next configured cycle. Compare its generation, document counts and quarantine count with the before-state and the intended input; a zero-document completion needs review.
If consumers require a retained corpus, verify its current manifest through GET /api/vulnerabilities/v1/corpus/publications/current and follow the publication procedure. Record the returned artifact identity and digest. Source completion and publication are separate evidence boundaries.

Source and re-verification

Read these current files before adapting the procedure to a different revision:

src/Vulnerabilities/StellaOps.Vulnerabilities.WebService/Program.cs — owner read routes and authorization.
src/Vulnerabilities/StellaOps.Vulnerabilities.Worker/Program.cs — scheduled loop and outcomes.
src/Vulnerabilities/__Libraries/StellaOps.Vulnerabilities.Ingestion/Ingest/IngestScheduler.cs — options and cycle order.
src/Vulnerabilities/__Libraries/StellaOps.Vulnerabilities.Ingestion/Ingest/SourceGenerationReader.cs — generation fields and health derivation.
src/Vulnerabilities/__Libraries/StellaOps.Vulnerabilities.Ingestion/ServiceCollectionExtensions.cs — source bindings and registrations.
src/Cli/StellaOps.Cli/Commands/Sources/SourcesCommandGroup.cs, SourcesCommandHandlers.cs, src/Cli/StellaOps.Cli/Commands/CommandFactory.cs and src/Cli/StellaOps.Cli/Program.cs — registered reads and client authentication.

Re-verify the advertised CLI syntax with the actual documentation contract:

pwsh -NoProfile -File tools/scripts/test-targeted-xunit.ps1 -Project src/Cli/__Tests/StellaOps.Cli.Tests/StellaOps.Cli.Tests.csproj -Class "*CliDocumentationContractTests" -BuildProjectReferences

This is a parser contract check, not a live ingestion or authentication probe.