Complete Module Matrix

Audience: engineers and architects who need a one-page map of every Stella Ops module — what it is, where its code lives, and how it is deployed. Source of truth: src/ is authoritative; this matrix is reconciled in passes and may lag a consolidation. When the matrix and the code disagree, the code wins. Module build entry points are the module solutions listed in docs/dev/SOLUTION_BUILD_GUIDE.md.

This document inventories the top-level modules in the Stella Ops platform. Several historical modules have been consolidated into a parent (for example Signer and Provenance into Attestor, Feedser and Excititor into Concelier, Scheduler and PacksRegistry into JobEngine); those rows are annotated with the consolidation sprint so the older names remain searchable.

1. Module Count Explanation
2. Complete Module Inventory
3. Module Categories
4. Service Deployment Matrix
5. Module Dependencies

1. Module Count Explanation

The solution contains roughly four dozen top-level modules in src/. The architecture documentation focuses on the core user-facing modules; the table below groups them so the inventory in section 2 is easier to navigate. Counts are indicative, not a contract — the exact set shifts as modules are consolidated.

Category	Modules
Core Platform	Authority, Router (hosts the Gateway WebService), Platform
Data Ingestion	Concelier (includes Feedser, Excititor), VexLens, VexHub, Mirror
Scanning & Analysis	Scanner, BinaryIndex (includes Symbols), AdvisoryAI, ReachGraph
Artifacts & Evidence	Attestor (includes Signer, Provenance), SbomService, EvidenceLocker, ExportCenter, Provcache
Policy & Risk	Policy, Findings (includes RiskEngine, VulnExplorer), Unknowns
Operations	JobEngine (includes Scheduler, PacksRegistry), Notify, Notifier, Timeline, Replay
Integration	CLI, Zastava, Web, API, Registry
Infrastructure	Cryptography, Telemetry, Graph, Signals, AirGap, AOC
Testing & Benchmarks	Benchmark, Bench
Utility & Internal	Tools, SmRemote, PluginBinaries

Cartographer is retired (merged into Graph API). VulnExplorer and RiskEngine now live under Findings. src/Gateway/ was deleted (Sprint 200); the API gateway is hosted by Router as StellaOps.Gateway.WebService.

2. Complete Module Inventory

Core Platform (3 modules)

Module	Path	Purpose	WebService	Worker	Storage
Authority	`src/Authority/`	Authentication, authorization, OAuth/OIDC, DPoP, tenant management. Includes IssuerDirectory (Sprint 216).	Yes	No	PostgreSQL (`authority`)
Router	`src/Router/`	Transport-agnostic messaging (TCP/TLS/UDP/RabbitMQ/Valkey) and HTTP ingress gateway. `src/Gateway/` deleted (Sprint 200).	Yes	No	Valkey
Platform	`src/Platform/`	Platform Service aggregation APIs, console data composition	Yes	No	Aggregates

Data Ingestion (4 modules)

Module	Path	Purpose	WebService	Worker	Storage
Concelier	`src/Concelier/`	Vulnerability advisory ingestion (NVD, OSV, GHSA, CSAF), merge engine with AOC. Includes Feedser and Excititor (Sprint 203).	Yes	Yes	PostgreSQL (`vuln`, `vex`)
VexLens	`src/VexLens/`	VEX consensus computation across issuers, conflict analysis	Yes	No	PostgreSQL (cache)
VexHub	`src/VexHub/`	VEX distribution and exchange hub	Yes	No	PostgreSQL
Mirror	`src/Mirror/`	Vulnerability feed mirror and distribution	Yes	Yes	RustFS

Scanning & Analysis (4 modules)

Module	Path	Purpose	WebService	Worker	Storage
Scanner	`src/Scanner/`	Container scanning with SBOM generation (11 language analyzers), call graphs. Cartographer retired (merged into Graph API).	Yes	Yes	PostgreSQL (`scanner`) + RustFS
BinaryIndex	`src/BinaryIndex/`	Binary identity extraction and fingerprinting. Includes Symbols (Sprint 202).	Yes	No	PostgreSQL
AdvisoryAI	`src/AdvisoryAI/`	AI-assisted advisory analysis and summarization. Includes OpsMemory (Sprint 213).	Yes	No	PostgreSQL
ReachGraph	`src/ReachGraph/`	Reachability graph service, CVE reachability analysis	Yes	No	PostgreSQL

Artifacts & Evidence (5 modules)

Module	Path	Purpose	WebService	Worker	Storage
Attestor	`src/Attestor/`	in-toto/DSSE attestation generation, Rekor v2 integration. Includes Signer and Provenance (Sprint 204).	Yes	No	PostgreSQL + RustFS
SbomService	`src/SbomService/`	SBOM storage, versioning, and lineage ledger	Yes	No	PostgreSQL + RustFS
EvidenceLocker	`src/EvidenceLocker/`	Sealed evidence storage and export	Yes	No	RustFS
ExportCenter	`src/ExportCenter/`	Batch export and report generation (SARIF, SBOM, evidence bundles)	Yes	No	RustFS
Provcache	Library	Provenance cache utilities	Library	N/A	N/A

Policy & Risk (3 modules)

Module	Path	Purpose	WebService	Worker	Storage
Policy	`src/Policy/`	Policy engine with K4 lattice logic, confidence scoring, VEX emission	Yes	Yes	PostgreSQL (`policy`)
Unknowns	`src/Unknowns/`	Unknown component and symbol tracking registry (boundary preserved, Sprint 206)	Yes	No	PostgreSQL
Findings	`src/Findings/`	Centralized findings aggregation. Includes RiskEngine and VulnExplorer (Sprint 207).	Yes	No	PostgreSQL

Operations (5 modules)

Module	Path	Purpose	WebService	Worker	Storage
JobEngine	`src/JobEngine/`	Workflow orchestration, scheduling, pack registry. Includes Scheduler, PacksRegistry (Sprint 208); renamed from Orchestrator (Sprint 221). TaskRunner removed.	Yes	Yes	PostgreSQL (`orchestrator`, `scheduler`)
Notify	`src/Notify/`	Unified notification service (shared libraries + merged WebService). Notifier WebService merged into Notify WebService (2026-04-08).	Yes	N/A	PostgreSQL (`notify`)
Notifier	`src/Notifier/`	Notifier Worker (delivery engine). WebService merged into Notify (2026-04-08).	N/A	Yes	PostgreSQL (`notify`)
Timeline	`src/Timeline/`	Timeline query, event indexing, and replay. Includes TimelineIndexer (Sprint 210).	Yes	No	PostgreSQL
Replay	`src/Replay/`	Deterministic replay engine	Yes	No	PostgreSQL

Integration (5 modules)

Module	Path	Purpose	WebService	Worker	Storage
CLI	`src/Cli/`	Command-line interface (Native AOT, multi-platform)	CLI	N/A	N/A
Zastava	`src/Zastava/`	Container registry webhook observer, admission control	Yes	No	PostgreSQL
Web	`src/Web/`	Angular 21 frontend SPA	Static	N/A	N/A
API	`src/Api/`	OpenAPI contracts and governance	Library	N/A	N/A
Registry	`src/Registry/`	Container registry integration, token service	Yes	No	PostgreSQL

Infrastructure (6 modules)

Module	Path	Purpose	WebService	Worker	Storage
Cryptography	`src/Cryptography/`	Crypto plugins (FIPS, eIDAS, GOST, SM, PQ)	Library	N/A	N/A
Telemetry	`src/Telemetry/`	OpenTelemetry traces, metrics, logging	Library	N/A	N/A
Graph	`src/Graph/`	Call graph and reachability data structures	Library	N/A	N/A
Signals	`src/Signals/`	Runtime signal collection and correlation	Library	N/A	N/A
AirGap	`src/AirGap/`	Air-gapped deployment support, Offline Kit bundling	Yes	Yes	RustFS
AOC	`src/Aoc/`	Append-Only Contract enforcement (Roslyn analyzers)	Library	N/A	N/A

Testing & Benchmarks (2 modules)

Module	Path	Purpose	WebService	Worker	Storage
Benchmark	Scanner library	Competitive benchmarking (accuracy comparison)	Tool	N/A	N/A
Bench	`src/Bench/`	Performance benchmarks	Tool	N/A	N/A

Utility & Internal (3 modules)

Findings is detailed under Policy & Risk; it materializes effective findings from Policy outputs and feeds UI/CLI/Notify.

Module	Path	Purpose	Notes
SmRemote	`src/SmRemote/`	Remote SM2/SM3/SM4 cryptographic operations	Integration utility
Tools	`src/Tools/`	Utility programs (fixture generators, migration scripts). Includes Bench, Verifier, Sdk, DevPortal (Sprint 212).	Dev tooling
PluginBinaries	Various	Authority and Concelier plugin binaries	Plugin hosting

3. Module Categories

Category membership below uses the consolidated module names from section 2 (for example Excititor is part of Concelier, Signer is part of Attestor, Scheduler is part of JobEngine). Historical names are kept only where they aid search.

By Runtime Type

Type	Modules
WebService + Worker	Scanner, Concelier, Policy, Notifier, AirGap, Mirror
WebService Only	Authority, Router (hosts Gateway WebService), Platform, VexLens, VexHub, BinaryIndex, AdvisoryAI, ReachGraph, Attestor, SbomService, EvidenceLocker, ExportCenter, Findings, Unknowns, JobEngine, Timeline, Replay, Zastava, Registry
Library	Provcache, Notify, API, Cryptography, Telemetry, Graph, Signals, AOC
CLI/Tool	CLI, Benchmark, Bench, Tools
Static	Web (Angular SPA)

By Data Store

Store	Modules
PostgreSQL	Authority, Concelier, VexLens, VexHub, Scanner, BinaryIndex, AdvisoryAI, ReachGraph, Attestor, SbomService, Policy, Findings, Unknowns, JobEngine, Notify/Notifier, Timeline, Replay, Zastava, Registry
RustFS (S3)	Scanner, Attestor, SbomService, EvidenceLocker, ExportCenter, AirGap, Mirror
Valkey	Router, Scanner, Policy, JobEngine, Notifier (queues/cache)
Stateless	Platform, CLI, Web

By Communication Pattern

Pattern	Modules
HTTP REST	All WebService modules
Binary Frame (Router)	Gateway WebService to all backend services
Event Streams (Valkey/NATS)	Scanner, Concelier, Policy, JobEngine, Notifier
Direct Library	All Library modules

4. Service Deployment Matrix

Replica counts below are illustrative deployment guidance, not hard requirements; “2+” means “run more than one for availability”, “N” means “scale by workload”.

Service	Container Image	Replicas	Storage	Queue	Observable
Authority	`stellaops/authority`	2+	PostgreSQL	Valkey (DPoP)	Yes
Router Gateway	`stellaops/router-gateway`	2+	Stateless (Valkey)	-	Yes
Scanner.Web	`stellaops/scanner-web`	2+	PostgreSQL + RustFS	-	Yes
Scanner.Worker	`stellaops/scanner-worker`	N	RustFS	Valkey/NATS	Yes
Concelier.Web	`stellaops/concelier-web`	2+	PostgreSQL	-	Yes
Concelier.Worker	`stellaops/concelier-worker`	N	PostgreSQL	Valkey/NATS	Yes
Policy.Engine	`stellaops/policy-engine`	2+	PostgreSQL	Valkey	Yes
Policy.Worker	`stellaops/policy-worker`	N	PostgreSQL	Valkey	Yes
Scheduler	`stellaops/scheduler`	2+	PostgreSQL	Valkey	Yes
Notifier	`stellaops/notifier`	2+	PostgreSQL	Valkey	Yes
ExportCenter	`stellaops/export-center`	2+	RustFS	-	Yes
Web (UI)	`stellaops/web`	2+	Static	-	Yes

5. Module Dependencies

Core Dependency Graph

                                    +-------------+
                                    |  Authority  |
                                    +------+------+
                                           |
              +----------------------------+----------------------------+
              |                            |                            |
              v                            v                            v
        +----------+                 +----------+                 +----------+
        |  Gateway |---------------->|  Scanner |---------------->|  Policy  |
        | (Router) |                 +----+-----+                 +----+-----+
        +----+-----+                      |                            |
             |                            v                            v
             |                      +----------+                 +-----------------+
             |                      | Concelier|                 |    Attestor     |
             |                      +----------+                 | (Signer +       |
             |                                                   |  Provenance)    |
             v                                                   +-----------------+
        +----------+
        | Web (UI) |
        +----------+

Concelier subsumes the former Feedser and Excititor ingestion paths; Attestor subsumes Signer and Provenance.

Key Integration Points

From	To	Integration
Gateway (Router)	Authority	Token validation (JWKS)
Gateway (Router)	All Services	Binary frame routing
Scanner	Attestor	SBOM signing (Signer) + in-toto attestation
Policy	Concelier	Advisory + VEX data (read-only)
Policy	Scanner	SBOM data (read-only)
JobEngine (Scheduler)	Scanner	Trigger rescans
JobEngine (Scheduler)	Concelier	Observe advisory deltas
Notifier	All Services	Consume events