Canonical Webservice Catalog
This page is the source-of-truth inventory of StellaOps *.WebService runtime services: their canonical hostnames, purpose, persistence, source paths, and deployment status. Use it to look up which service serves a hostname, which module owns it, and whether it ships in the default stack. It is written for operators, integrators, and reviewers.
Scope and contract
- Inventory source:
rg --files src -g "*WebService.csproj"(32 projects match as of this reconciliation). - Lists every
*.WebServiceproject found insrc/, with deployment status called out per row. The “Active webservices” table covers services deployed in the main stack (devops/compose/docker-compose.stella-services.yml); the “Non-default and not-yet-deployed webservices” table covers*.WebServiceprojects that are opt-in, retired-but-retained, or shared library hosts not wired into a compose stack. - Excludes non-
WebServiceAPI binaries (for exampleStellaOps.Policy.Engine,StellaOps.Policy.Gateway,StellaOps.Graph.Api,StellaOps.Symbols.Server,StellaOps.Registry.TokenService,StellaOps.SmRemote.Service, andStellaOps.ReleaseOrchestrator.WebApi) even though they may bind*.stella-ops.localaliases. Note:StellaOps.VulnExplorer.Apihas been merged intoStellaOps.Findings.Ledger.WebService(SPRINT_20260408_002). - There is no
StellaOps.JobEngine.WebService. The historicjobengine/jobengine-workercontainers were retired (Slot 17 in compose: “jobengine and jobengine-worker removed; WebService retired”). Release orchestration, approvals, and DAG/workflow now live in therelease-orchestratorservice (StellaOps.ReleaseOrchestrator.WebApi, excluded above as a*.WebApibinary) and theworkflowservice (StellaOps.Workflow.WebService, listed below); scheduling stays inscheduler(StellaOps.Scheduler.WebService). - Canonical runtime hostname form:
<service>.stella-ops.local.
Runtime hostname convention and exceptions
- Runtime service-discovery URLs in docs should use
https://<service>.stella-ops.local(or the HTTP equivalent when TLS is intentionally not shown). - Permitted exceptions:
- Infrastructure aliases (
db.stella-ops.local,cache.stella-ops.local,s3.stella-ops.local,rekor.stella-ops.local,registry.stella-ops.local). - Loopback/dev diagnostics (
localhost,127.x.y.z) where transport wiring is the point of the example. - Non-runtime identifiers/file names (for example the
hosts.stellaops.localfile path).
- Infrastructure aliases (
Active webservices
| Domain | Webservice | Local hostname | Purpose | Persistence | Source path | Owner module |
|---|---|---|---|---|---|---|
| AdvisoryAI | AdvisoryAI | advisoryai.stella-ops.local | Advisory assistant APIs (chat, evidence-pack, knowledge search). | postgres | src/AdvisoryAI/StellaOps.AdvisoryAI.WebService | src/AdvisoryAI |
| AdvisoryAI | OpsMemory | opsmemory.stella-ops.local | Operational memory/query APIs for advisory workflows. | postgres | src/AdvisoryAI/StellaOps.OpsMemory.WebService | src/AdvisoryAI |
| Attestor | Attestor | attestor.stella-ops.local | Attestation, witness, and proof-chain APIs. | postgres | src/Attestor/StellaOps.Attestor/StellaOps.Attestor.WebService | src/Attestor |
| Attestor | Signer | signer.stella-ops.local | Signing and key-ceremony APIs. | postgres | src/Attestor/StellaOps.Signer/StellaOps.Signer.WebService | src/Attestor |
| Authority | IssuerDirectory | issuerdirectory.stella-ops.local | Issuer metadata and trust directory APIs. | postgres | src/Authority/StellaOps.IssuerDirectory/StellaOps.IssuerDirectory.WebService | src/Authority |
| BinaryIndex | BinaryIndex | binaryindex.stella-ops.local | Binary index, patch coverage, and resolution APIs. | postgres | src/BinaryIndex/StellaOps.BinaryIndex.WebService | src/BinaryIndex |
| Concelier | Concelier | concelier.stella-ops.local | Advisory ingestion and source-management APIs. | postgres | src/Concelier/StellaOps.Concelier.WebService | src/Concelier |
| Concelier | Excititor | excititor.stella-ops.local | VEX ingest, linkset, and evidence APIs. | postgres | src/Concelier/StellaOps.Excititor.WebService | src/Concelier |
| Doctor | Doctor | doctor.stella-ops.local | Health diagnostics and setup-check APIs. | in-memory (no service DB) | src/Doctor/StellaOps.Doctor.WebService | src/Doctor |
| EvidenceLocker | EvidenceLocker | evidencelocker.stella-ops.local | Evidence ingest, bundle, legal hold, and verification APIs. | postgres | src/EvidenceLocker/StellaOps.EvidenceLocker/StellaOps.EvidenceLocker.WebService | src/EvidenceLocker |
| ExportCenter | ExportCenter | exportcenter.stella-ops.local | Export/audit bundle/report APIs. | postgres | src/ExportCenter/StellaOps.ExportCenter/StellaOps.ExportCenter.WebService | src/ExportCenter |
| Findings | Findings.Ledger | findings.stella-ops.local | Findings ledger, summary, and evidence graph APIs. | postgres | src/Findings/StellaOps.Findings.Ledger.WebService | src/Findings |
| Findings | RiskEngine | riskengine.stella-ops.local | Exploit maturity and risk score APIs. | postgres (in-memory fallback for explicit test profile) | src/Findings/StellaOps.RiskEngine.WebService | src/Findings |
| Integrations | Integrations | integrations.stella-ops.local | Integration adapters and endpoint management APIs. | postgres | src/Integrations/StellaOps.Integrations.WebService | src/Integrations |
| JobEngine | PacksRegistry | packsregistry.stella-ops.local | Pack/provenance/attestation registry APIs. | postgres + seed-fs object payloads | src/JobEngine/StellaOps.PacksRegistry/StellaOps.PacksRegistry.WebService | src/JobEngine |
| JobEngine | Scheduler | scheduler.stella-ops.local | Schedule/run planning and event APIs (worker embedded, Scheduler:Worker:Embedded=true). | postgres (scheduler schema) | src/JobEngine/StellaOps.Scheduler.WebService | src/JobEngine |
| Workflow | Workflow | workflow.stella-ops.local | Workflow engine/orchestration, definitions, and render APIs (absorbed the orchestration role formerly attributed to JobEngine). | postgres (workflow schema; pluggable Mongo/Oracle datastores) | src/Workflow/StellaOps.Workflow.WebService | src/Workflow |
| Notify | Notify | notify.stella-ops.local | Notification rule/channel/template, delivery, escalation, incident, and simulation APIs (absorbed the Notifier web surface). | postgres | src/Notify/StellaOps.Notify.WebService | src/Notify |
| Platform | Platform | platform.stella-ops.local | Console aggregation, setup, admin, and read-model APIs. | postgres | src/Platform/StellaOps.Platform.WebService | src/Platform |
| ReachGraph | ReachGraph | reachgraph.stella-ops.local | Reachability graph and CVE mapping APIs. | postgres | src/ReachGraph/StellaOps.ReachGraph.WebService | src/ReachGraph |
| Remediation | Remediation | remediation.stella-ops.local | Remediation source, registry, and match APIs. | postgres | src/Remediation/StellaOps.Remediation.WebService | src/Remediation |
| Replay | Replay | replay.stella-ops.local | Point-in-time query and verdict replay APIs. | postgres + seed-fs snapshot blobs | src/Replay/StellaOps.Replay.WebService | src/Replay |
| Router | Gateway | router.stella-ops.local | Gateway dispatch, auth, and reverse-proxy APIs. | no-persistence | src/Router/StellaOps.Gateway.WebService | src/Router |
| Scanner | Scanner | scanner.stella-ops.local | Scan submission, triage, drift, and scan data APIs. | postgres | src/Scanner/StellaOps.Scanner.WebService | src/Scanner |
| Timeline | Timeline | timeline.stella-ops.local | Timeline query/export/replay APIs. | postgres | src/Timeline/StellaOps.Timeline.WebService | src/Timeline |
| Timeline | TimelineIndexer | timelineindexer.stella-ops.local | Timeline indexer control/status APIs. | postgres | src/Timeline/StellaOps.TimelineIndexer.WebService | src/Timeline |
| Unknowns | Unknowns | unknowns.stella-ops.local | Unknowns queue and triage APIs. | postgres | src/Unknowns/StellaOps.Unknowns.WebService | src/Unknowns |
| VexHub | VexHub | vexhub.stella-ops.local | VEX ingest and distribution APIs. | postgres | src/VexHub/StellaOps.VexHub.WebService | src/VexHub |
| VexLens | VexLens | vexlens.stella-ops.local | VEX lens, delta, and gate-view APIs. | postgres | src/VexLens/StellaOps.VexLens.WebService | src/VexLens |
Note:
TimelineIndexerandNotifyreflect in-place consolidations.timelineindexer.stella-ops.localis served by the mergedtimeline-webcontainer (Slot 23 → Slot 24), and the Notifier web surface runs insidenotify-web(Slot 28 commented out, kept for rollback); the separateStellaOps.TimelineIndexer.WebServiceandStellaOps.Notifier.WebServiceprojects still exist in the tree.
Non-default and not-yet-deployed webservices
These *.WebService projects exist in src/ but are not part of the default docker-compose.stella-services.yml runtime. They are listed for inventory completeness.
| Webservice | Local hostname | Status | Purpose | Persistence | Source path |
|---|---|---|---|---|---|
| Tester | tester.stella-ops.local | Opt-in only — started via docker-compose.tester.yml; never in the production stack (test/QA harness, see src/Tester/AGENTS.md). | Golden-chain QA forwarders and fixture/scenario actions; calls other modules over their public HTTP surface. | stateless (in-memory only; no PostgreSQL ownership) | src/Tester/StellaOps.Tester.WebService |
| Notifier | notifier.stella-ops.local (legacy alias) | Retired — web surface merged into notify-web (Slot 28 commented out for rollback); only notifier-worker still runs. | Notification rule/channel/template, escalation, incident, and simulation APIs (now served by Notify). | postgres | src/Notifier/StellaOps.Notifier/StellaOps.Notifier.WebService |
| Verdict | (not bound) | Not deployed — shared Verdict API composition-root host; not referenced by any Dockerfile/compose. FLAG: confirm whether this is intended to be hosted standalone or only embedded by consumers. | Shared Verdict API endpoints (StellaOps.Verdict.Api.VerdictEndpoints). | postgres (CGS replay store via AddPostgresCgsReplayStore) | src/__Libraries/StellaOps.Verdict.WebService |
Related references
- Port Registry — service ports and exposure
- Webservices Valkey Rollout Matrix — transport rollout state per service
- User Flow Architecture — gateway-facing endpoints by user action
- Schema Mapping — per-service persistence ownership