Platform Component Map

This is an orientation map of current source ownership. The generated service inventory lists deployables, Compose and bundle membership, source projects, database ownership and retired-host successors. Use that inventory for deployment selection; a capability name is not evidence of a separate process.

Verified against: 818afdc7523c57b24370f841d99a1ce622cfd9ee (2026-10-07), from host composition and the generated inventory. Re-verify with python tools/scripts/generate/service-inventory.py --check and inspect the owning Program.cs. No running-estate state is asserted here.

Advisory, scanning and effective findings

• Vulnerabilities — Owns the advisory ingestion, VEX and binary/symbol hub. src/Vulnerabilities/StellaOps.Vulnerabilities.WebService and .Worker are the deployable pair. Dossier.
• AdvisoryAI — Owns advisory assistance, operational-memory and remediation composition in src/AdvisoryAI; its web host composes these modules rather than starting separate predecessor hosts. Dossier.
• Scanner — Owns scan execution, its API and worker under src/Scanner. Dossier.
• SbomService — Owns the SBOM inventory service at src/SbomService/StellaOps.SbomService. Dossier.
• Findings — Owns effective findings, ledger and security projections in src/Findings/StellaOps.Findings.WebService and .Worker. Dossier.
• Graph — src/Graph/StellaOps.Graph.Api composes the graph and merged Cartographer/ReachGraph surfaces. Dossier.
• Policy — Policy evaluation and governance are owned by src/Policy/StellaOps.Policy.Engine. Dossier.

Identity, evidence and offline distribution

• Authority — Identity, scopes and issuer-directory composition live under src/Authority/StellaOps.Authority. Dossier.
• Evidence — Attestation and evidence-locker APIs share the single owning web host src/Evidence/StellaOps.Evidence.WebService; its worker is a role of that family. Dossier.
• Signer — The distinct signing host remains src/Attestor/StellaOps.Signer/StellaOps.Signer.WebService. Dossier.
• Attestor support — TileProxy and the provenance tool remain under src/Attestor; those surviving projects do not imply a separate attestation API host. The service inventory distinguishes their deployment roles.
• OfflineKit — Owns export, offline exchange and export-center composition in src/OfflineKit/StellaOps.OfflineKit.WebService and .Worker. Dossier.
• Registry — Owns the registry and token services under src/Registry. Dossier.
• Replay — Owns its replay web service under src/Replay. Dossier.

Scheduling, release control and operator surfaces

• JobEngine — Scheduling, PacksRegistry and job execution are composed by src/JobEngine/StellaOps.JobEngine.WebService, with the family’s worker roles. Dossier.
• ReleaseOrchestrator — Owns release control and the deployment agent under src/ReleaseOrchestrator/__Apps and __Agents. Dossier.
• Integrations — Owns the integration web host and connector composition in src/Integrations. Dossier.
• Workflow — The standalone host at src/Workflow/StellaOps.Workflow.WebService has a publish key but no default-estate or release-bundle Compose membership in the verified inventory. ReleaseOrchestrator owns its own workflow surfaces.
• Notify — The web and delivery-worker roles live under src/Notify. Dossier.
• Timeline — The web host at src/Timeline/StellaOps.Timeline.WebService owns timeline query and ingestion composition. Dossier.
• Signals — Runtime-signal service at src/Signals/StellaOps.Signals. Dossier.
• Unknowns — Unknowns queue and triage service under src/Unknowns. Dossier.
• Platform and Doctor — Platform owns its aggregate operator read models; Doctor checks also run in each owning service. There is no separate Doctor web deployable in the current inventory. Platform dossier.
• Router — HTTP ingress and transport composition are under src/Router, including StellaOps.Gateway.WebService. Dossier.
• Console — Angular source lives at src/Web/StellaOps.Web; it consumes owner APIs through the gateway. Dossier.
• Tester — The QA host under src/Tester is opt-in and excluded from production stacks. Dossier.

Shared libraries, CLI, cryptography, plugin infrastructure, runtime agents and development tools have their own src/ roots; they are not all service hosts. Use the build-boundary manifest for source-graph ownership.

Historical capability labels withdrawn 2026-10-07

Earlier diagrams used Concelier, Excititor, BinaryIndex, Symbols, ExportCenter, EvidenceLocker, Scheduler, PacksRegistry, OpsMemory, Remediation and VulnExplorer as separate module or host names. The generated inventory’s Retired hosts and their successors section records the actual freeze boundaries. In particular, VulnExplorer’s intermediate Findings Ledger host is historical; its current composition belongs to the consolidated Findings host above. These historical labels must not be used to select a runtime project or deployment target.