Rename Feedser to Concelier

docs/ARCHITECTURE_DEVOPS.md

@@ -42,7 +42,7 @@ Semantic core + calendar tag:
 A release is a **bundle** of image digests + charts + manifests. All services in a bundle are **wire‑compatible**. Mixed minor versions are allowed within a bounded skew:
 
 * **Web UI ↔ backend**: `±1 minor`.
-* **Scanner ↔ Policy/Excititor/Feedser**: `±1 minor`.
+* **Scanner ↔ Policy/Excititor/Concelier**: `±1 minor`.
 * **Authority/Signer/Attestor triangle**: **must** be same minor (crypto and DPoP/mTLS binding rules).
 
 At startup, services **self‑advertise** their semver & channel; the UI surfaces **mismatch warnings**.
@@ -75,7 +75,7 @@ At startup, services **self‑advertise** their semver & channel; the UI surface
 * **Static**: linters, codegen checks, protobuf API freeze (backward‑compat tests).
 * **Unit/integration**: per‑component, plus **end‑to‑end** flows (scan→vex→policy→sign→attest).
 * **Perf SLOs**: hot paths (SBOM compose, diff, export) measured against budgets.
-* **Security**: dependency audit vs Feedser export; container hardening tests; minimal caps.
+* **Security**: dependency audit vs Concelier export; container hardening tests; minimal caps.
 * **Canary cohort**: internal staging + selected customers; one week on **edge** before **stable** tag.
 
 ---
@@ -90,7 +90,7 @@ At startup, services **self‑advertise** their semver & channel; the UI surface
 
 **Gating policy**:
 
-* **Core images** (Authority, Scanner, Feedser, Excititor, Attestor, UI): public **read**.
+* **Core images** (Authority, Scanner, Concelier, Excititor, Attestor, UI): public **read**.
 * **Enterprise add‑ons** (if any) and **pre‑release**: private repos via OAuth2 token service.
 
 > Monetization lever is **signing** (PoE gate), not image pulls, so the core remains simple to consume.
@@ -115,7 +115,7 @@ At startup, services **self‑advertise** their semver & channel; the UI surface
     /attest/   DSSE bundles + Rekor proofs
     /charts/   Helm charts + values templates
     /compose/  docker-compose.yml + .env template
-    /plugins/  Feedser/Excititor connectors (restart-time)
+    /plugins/  Concelier/Excititor connectors (restart-time)
     /policy/   example policies
     /manifest/ release.yaml  (see §6.1)
   ```
@@ -169,7 +169,7 @@ helm install stella stellaops/platform \
   --set authority.issuer=https://authority.stella.local \
   --set scanner.minio.endpoint=http://minio.stella.local:9000 \
   --set scanner.mongo.uri=mongodb://mongo/scanner \
-  --set feedser.mongo.uri=mongodb://mongo/feedser \
+  --set concelier.mongo.uri=mongodb://mongo/concelier \
   --set excititor.mongo.uri=mongodb://mongo/excititor
 ```
 
@@ -185,7 +185,7 @@ helm install stella stellaops/platform \
   1. Authority (stateless, dual‑key rotation ready)
   2. Signer/Attestor (same minor)
   3. Scanner WebService & Workers
-  4. Feedser, then Excititor (schema migrations are expand/contract)
+  4. Concelier, then Excititor (schema migrations are expand/contract)
   5. UI last
 
 * **DB migrations** are **expand/contract**:
@@ -263,7 +263,7 @@ s3://stellaops/
     images/<imgDigest>/usage.cdx.pb
     diffs/<old>_<new>/diff.json.zst
     attest/<artifactSha256>.dsse.json
-  feedser/
+  concelier/
     json/<exportId>/...
     trivy/<exportId>/...
   excititor/
@@ -289,14 +289,14 @@ s3://stellaops/
 ### 7.4 Mongo retention
 
 * **Scanner**: `runtime.events` use TTL (e.g., 30–90 days); **catalog** permanent.
-* **Feedser/Excititor**: raw docs keep **last N windows**; canonical stores permanent.
+* **Concelier/Excititor**: raw docs keep **last N windows**; canonical stores permanent.
 * **Attestor**: `entries` permanent; `dedupe` TTL 24–48h.
 
 ---
 
 ## 8) Observability & SLOs (operations)
 
-* **Uptime SLO**: 99.9% for Signer/Authority/Attestor; 99.5% for Scanner WebService; Excititor/Feedser 99.0%.
+* **Uptime SLO**: 99.9% for Signer/Authority/Attestor; 99.5% for Scanner WebService; Excititor/Concelier 99.0%.
 * **Error budgets**: tracked per month; dashboards show burn rates.
 * **Golden signals**:
 
@@ -324,7 +324,7 @@ Prometheus + OTLP; Grafana dashboards ship in the charts.
 
 * **Vulnerability response**:
 
-  * Feedser red‑flag advisories trigger accelerated **stable** patch rollout; UI/CLI “security patch available” notice.
+  * Concelier red‑flag advisories trigger accelerated **stable** patch rollout; UI/CLI “security patch available” notice.
 
 * **Backups/DR**:
 
@@ -408,8 +408,8 @@ services:
   scanner-worker:
     image: registry.stella-ops.org/stellaops/scanner-worker@sha256:...
     deploy: { replicas: 4 }
-  feedser:
-    image: registry.stella-ops.org/stellaops/feedser@sha256:...
+  concelier:
+    image: registry.stella-ops.org/stellaops/concelier@sha256:...
   excititor:
     image: registry.stella-ops.org/stellaops/excititor@sha256:...
   web-ui:
@@ -446,7 +446,7 @@ services:
 * `signer.requests_total{result="success"}/minute` > 0 (when scans occur).
 * `attestor.submit_latency_seconds{quantile=0.95}` < 0.3.
 * `scanner.scan_latency_seconds{quantile=0.95}` < target per image size.
-* `feedser.export.duration_seconds` stable; `excititor.consensus.conflicts_total` not exploding after policy changes.
+* `concelier.export.duration_seconds` stable; `excititor.consensus.conflicts_total` not exploding after policy changes.
 * MinIO `s3_requests_errors_total` near zero; Mongo `opcounters` hit expected baseline.
 
 ### Appendix B — Upgrade safety checklist