stella-ops.org/git.stella-ops.org
1
0
Fork 0
Code Issues Pull Requests Actions 2 Releases Wiki Activity

archive these

Browse Source
This commit is contained in:
master
2026-03-08 21:41:38 +02:00
parent f40043ed50
commit 6efed23647
3 changed files with 0 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

110
docs-archived/implplan/CONSOLIDATION_DECISION_LEDGER.md Normal file
View File

@@ -0,0 +1,110 @@
# Consolidation Decision Ledger
> **Last updated:** 2026-03-04
> **Owner:** Sprint 218 (DOCS: Consolidation Decision Finalization)
> **Wave:** Microservices Consolidation Wave 1 (Feb-Mar 2026)
This document records the final outcome of every consolidation sprint in the first consolidation wave. Each sprint was evaluated for source-level consolidation (moving source directories under a parent module) and schema-level consolidation (merging DbContexts). In all cases where consolidation proceeded, only source consolidation was executed; schema merges were rejected to preserve security boundaries and avoid blast-radius expansion.
---
## Outcome Legend
| Outcome | Meaning |
|---------|---------|
| **Proceed (done)** | Source consolidation completed. Code moved under parent module. |
| **Boundary-preserved** | Evaluated and deliberately kept as separate modules. No consolidation. |
| **Deferred** | Consolidation approved in principle but deferred to a future wave. |
| **Canceled** | Consolidation evaluated and rejected. Will not proceed. |
| **No-op** | Not applicable to the consolidation wave. |
| **Completed separately** | Work done outside the consolidation wave. |
---
## Complete Outcome Table
| Sprint | ID | Description | Outcome | Sprint File |
|--------|----|-------------|---------|-------------|
| Gateway deletion | 200 | Delete `src/Gateway/`; Router is canonical | **Proceed (done)** | [`SPRINT_20260225_200_Platform_gateway_deletion.md`](../../docs-archived/implplan/2026-03-04-completed-sprints/SPRINT_20260225_200_Platform_gateway_deletion.md) |
| Scanner absorb Cartographer | 201 | Move Cartographer under Scanner | **Proceed (done)** | [`SPRINT_20260225_201_Scanner_absorb_cartographer.md`](../../docs-archived/implplan/2026-03-04-completed-sprints/SPRINT_20260225_201_Scanner_absorb_cartographer.md) |
| BinaryIndex absorb Symbols | 202 | Move Symbols under BinaryIndex | **Proceed (done)** | [`SPRINT_20260225_202_BinaryIndex_absorb_symbols.md`](../../docs-archived/implplan/2026-03-04-completed-sprints/SPRINT_20260225_202_BinaryIndex_absorb_symbols.md) |
| Concelier absorb Feedser/Excititor | 203 | Move Feedser and Excititor under Concelier | **Proceed (done)** | [`SPRINT_20260225_203_Concelier_absorb_feedser_excititor.md`](../../docs-archived/implplan/2026-03-04-completed-sprints/SPRINT_20260225_203_Concelier_absorb_feedser_excititor.md) |
| Attestor absorb Signer/Provenance | 204 | Move Signer and Provenance under Attestor | **Proceed (done)** | [`SPRINT_20260225_204_Attestor_absorb_signer_provenance.md`](../../docs-archived/implplan/2026-03-04-completed-sprints/SPRINT_20260225_204_Attestor_absorb_signer_provenance.md) |
| VEX consolidation (VexHub/VexLens) | 205 | Consolidate VexHub and VexLens | **Deferred** -- future wave | _(no sprint file; deferred before sprint creation)_ |
| Policy/Unknowns boundary | 206 | Evaluate Policy absorbing Unknowns | **Boundary-preserved** | [`SPRINT_20260225_206_Policy_absorb_unknowns.md`](../../docs-archived/implplan/2026-03-04-completed-sprints/SPRINT_20260225_206_Policy_absorb_unknowns.md) |
| Findings absorb RiskEngine/VulnExplorer | 207 | Move RiskEngine and VulnExplorer under Findings | **Proceed (done)** | [`SPRINT_20260225_207_Findings_absorb_riskengine_vulnexplorer.md`](../../docs-archived/implplan/2026-03-04-completed-sprints/SPRINT_20260225_207_Findings_absorb_riskengine_vulnexplorer.md) |
| Orchestrator absorb Scheduler/TaskRunner/PacksRegistry | 208 | Move Scheduler, TaskRunner, PacksRegistry under Orchestrator | **Proceed (done)** | [`SPRINT_20260225_208_Orchestrator_absorb_scheduler_taskrunner_packsregistry.md`](../../docs-archived/implplan/2026-03-04-completed-sprints/SPRINT_20260225_208_Orchestrator_absorb_scheduler_taskrunner_packsregistry.md) |
| Notify/Notifier boundary | 209 | Evaluate Notify absorbing Notifier | **Boundary-preserved** | [`SPRINT_20260225_209_Notify_absorb_notifier.md`](../../docs-archived/implplan/2026-03-04-completed-sprints/SPRINT_20260225_209_Notify_absorb_notifier.md) |
| Timeline absorb TimelineIndexer | 210 | Move TimelineIndexer under Timeline | **Proceed (done)** | [`SPRINT_20260225_210_Timeline_absorb_timelineindexer.md`](../../docs-archived/implplan/2026-03-04-completed-sprints/SPRINT_20260225_210_Timeline_absorb_timelineindexer.md) |
| ExportCenter/AirGap boundary | 211 | Evaluate ExportCenter absorbing Mirror and AirGap | **Boundary-preserved** | [`SPRINT_20260225_211_ExportCenter_absorb_mirror_airgap.md`](../../docs-archived/implplan/2026-03-04-completed-sprints/SPRINT_20260225_211_ExportCenter_absorb_mirror_airgap.md) |
| Tools absorb Bench/Verifier/Sdk/DevPortal | 212 | Move Bench, Verifier, Sdk, DevPortal under Tools | **Proceed (done)** | [`SPRINT_20260225_212_Tools_absorb_bench_verifier_sdk_devportal.md`](../../docs-archived/implplan/2026-03-04-completed-sprints/SPRINT_20260225_212_Tools_absorb_bench_verifier_sdk_devportal.md) |
| AdvisoryAI absorb OpsMemory | 213 | Move OpsMemory under AdvisoryAI | **Proceed (done)** | [`SPRINT_20260225_213_AdvisoryAI_absorb_opsmemory.md`](../../docs-archived/implplan/2026-03-04-completed-sprints/SPRINT_20260225_213_AdvisoryAI_absorb_opsmemory.md) |
| Integrations absorb Extensions | 214 | Move Extensions under Integrations | **Proceed (done)** | [`SPRINT_20260225_214_Integrations_absorb_extensions.md`](../../docs-archived/implplan/2026-03-04-completed-sprints/SPRINT_20260225_214_Integrations_absorb_extensions.md) |
| SmRemote standalone | 215 | SmRemote standalone evaluation | **No-op** in consolidation wave | _(no sprint file; SmRemote remains standalone)_ |
| Authority absorb IssuerDirectory | 216 | Move IssuerDirectory under Authority | **Proceed (done)** | [`SPRINT_20260225_216_Authority_absorb_issuerdirectory.md`](../../docs-archived/implplan/2026-03-04-completed-sprints/SPRINT_20260225_216_Authority_absorb_issuerdirectory.md) |
| Orphan library cleanup | 217 | Archive AdvisoryLens and Resolver | **Proceed (done)** | [`SPRINT_20260225_217_Platform_orphan_library_cleanup.md`](../../docs-archived/implplan/2026-03-04-completed-sprints/SPRINT_20260225_217_Platform_orphan_library_cleanup.md) |
| Consolidation docs finalization | 218 | Final documentation sweep | **Proceed (done)** | [`SPRINT_20260225_218_DOCS_consolidation_final_update.md`](../../docs-archived/implplan/2026-03-04-completed-sprints/SPRINT_20260225_218_DOCS_consolidation_final_update.md) |
| EF compiled model generation | 219 | EF compiled model pre-requisite | **Completed separately** | _(completed outside consolidation wave)_ |
| SbomService absorption | 220 | Evaluate SbomService merge | **Canceled** -- decision not to merge | _(canceled before sprint creation)_ |
| Orchestrator domain rename | 221 | Rename Orchestrator to JobEngine | **Proceed (done)** | [`SPRINT_20260225_221_Orchestrator_domain_rename.md`](../../docs-archived/implplan/2026-03-04-completed-sprints/SPRINT_20260225_221_Orchestrator_domain_rename.md) |
---
## Schema Merge Decisions (All Rejected)
Every consolidation sprint evaluated whether DbContexts should be merged in addition to source consolidation. In all cases, schema merges were **rejected**. The common rationale: merging DbContexts widens the blast radius of credential compromise and couples unrelated write patterns.
| Domain | Decision | Rationale |
|--------|----------|-----------|
| Orchestrator + Scheduler | No merge | `OrchestratorDbContext` (39 entities) and `SchedulerDbContext` (11 entities) have `Jobs`/`JobHistory` name collisions with incompatible semantics. |
| Authority + IssuerDirectory | No merge | `AuthorityDbContext` manages passwords, MFA, tokens. Merging would expose authentication internals to issuer metadata code paths. |
| Concelier + Excititor + Feedser | No merge | Three DbContexts (49 entities, 5 schemas) have distinct write lifecycles. Schema isolation is a feature. |
| Attestor + Signer | No merge | Security boundary between key material and attestation evidence is deliberate. |
| Policy + Unknowns | No merge | `UnknownsDbContext` retains independent schema ownership. Boundary preserved. |
| ExportCenter + AirGap | No merge | AirGap has 14+ external consumers vs ExportCenter's 2. Asymmetric coupling makes merge a poor tradeoff. |
| SbomService | Canceled | Decision not to merge SbomService into any other module. |
---
## Post-Consolidation Module Layout
After all consolidation sprints, the canonical module layout is:
| Module | Source Path | Notes |
|--------|------------|-------|
| Authority | `src/Authority/` | Now includes IssuerDirectory (Sprint 216) |
| Scanner | `src/Scanner/` | Now includes Cartographer (Sprint 201) |
| BinaryIndex | `src/BinaryIndex/` | Now includes Symbols (Sprint 202) |
| Concelier | `src/Concelier/` | Now includes Feedser and Excititor (Sprint 203) |
| Attestor | `src/Attestor/` | Now includes Signer and Provenance (Sprint 204) |
| Findings | `src/Findings/` | Now includes RiskEngine and VulnExplorer (Sprint 207) |
| JobEngine | `src/JobEngine/` | Now includes Scheduler, TaskRunner, PacksRegistry (Sprint 208); renamed from Orchestrator (Sprint 221) |
| Timeline | `src/Timeline/` | Now includes TimelineIndexer (Sprint 210) |
| Tools | `src/Tools/` | Now includes Bench, Verifier, Sdk, DevPortal (Sprint 212) |
| AdvisoryAI | `src/AdvisoryAI/` | Now includes OpsMemory (Sprint 213) |
| Integrations | `src/Integrations/` | Now includes Extensions (Sprint 214) |
### Preserved Boundaries (no consolidation)
| Module A | Module B | Sprint | Rationale |
|----------|----------|--------|-----------|
| Policy | Unknowns | 206 | Distinct domain ownership, separate DbContexts |
| Notify | Notifier | 209 | Library vs. host application boundary |
| ExportCenter | AirGap | 211 | Asymmetric coupling, blast radius |
### Deleted / Archived
| Item | Sprint | Action |
|------|--------|--------|
| `src/Gateway/` | 200 | Deleted (Router is canonical) |
| AdvisoryLens library | 217 | Archived |
| Resolver library | 217 | Archived |
### Deferred / Canceled
| Item | Sprint | Status |
|------|--------|--------|
| VexHub/VexLens consolidation | 205 | Deferred to future wave |
| SbomService absorption | 220 | Canceled |
| SmRemote | 215 | No-op (remains standalone) |

1238
docs-archived/implplan/CONSOLIDATION_SERVICE_INVENTORY_20260305.raw.json Normal file
View File

File diff suppressed because it is too large Load Diff

100
docs-archived/implplan/CONSOLIDATION_WEBSERVICE_FUNCTION_DB_MATRIX_20260305.md Normal file
View File

@@ -0,0 +1,100 @@
# Consolidation Investigation: WebService Function and Database Matrix (2026-03-05)
## Scope
- Source scan of all `*.WebService.csproj` under `src/`.
- This matrix captures webservice functional surface and the persistence backing currently wired in code.
- Inventory size: **31 webservices** across **23 domains/modules**.
## Domain Summary
| Domain | WebServices | Services | Persistence Modes |
| --- | ---: | --- | --- |
| AdvisoryAI | 2 | AdvisoryAI, OpsMemory | postgres |
| Attestor | 2 | Attestor, Signer | postgres |
| Authority | 1 | IssuerDirectory | postgres |
| BinaryIndex | 1 | BinaryIndex | postgres |
| Concelier | 2 | Concelier, Excititor | postgres |
| Doctor | 1 | Doctor | in-memory |
| EvidenceLocker | 1 | EvidenceLocker | postgres |
| ExportCenter | 1 | ExportCenter | postgres |
| Findings | 2 | Findings.Ledger, RiskEngine | postgres (in-memory fallback in RiskEngine test profile) |
| Integrations | 1 | Integrations | postgres |
| JobEngine | 4 | JobEngine, PacksRegistry, Scheduler, TaskRunner | postgres, seed-fs object-store |
| Notifier | 1 | Notifier | postgres |
| Notify | 1 | Notify | postgres |
| Platform | 1 | Platform | postgres |
| ReachGraph | 1 | ReachGraph | postgres |
| Remediation | 1 | Remediation | postgres |
| Replay | 1 | Replay | postgres, seed-fs object-store |
| Router | 1 | Gateway | no-persistence |
| Scanner | 1 | Scanner | postgres |
| Timeline | 2 | Timeline, TimelineIndexer | postgres |
| Unknowns | 1 | Unknowns | postgres |
| VexHub | 1 | VexHub | postgres |
| VexLens | 1 | VexLens | postgres |
## WebService Matrix
| Domain | WebService | Functions Served | DB Used | Evidence |
| --- | --- | --- | --- | --- |
| AdvisoryAI | AdvisoryAI | Endpoints: Attestation, Chat, EvidencePack, KnowledgeSearch (+5 more); routes: advisory-ai, chat, runs, search | AdvisoryAiDataSource, AdvisoryAiDbContext | src/AdvisoryAI/StellaOps.AdvisoryAI.WebService/Program.cs; src/AdvisoryAI/StellaOps.AdvisoryAI/Storage/EfCore/Context/AdvisoryAiDbContext.cs |
| AdvisoryAI | OpsMemory | Endpoints: OpsMemory; routes: opsmemory | PostgreSQL via NpgsqlDataSource + PostgresOpsMemoryStore (no EF DbContext) | src/AdvisoryAI/StellaOps.OpsMemory.WebService/Program.cs; src/AdvisoryAI/__Libraries/StellaOps.OpsMemory/Storage/PostgresOpsMemoryStore.cs |
| Attestor | Attestor | Endpoints: Anchors, AttestorWebService, Bundles, Chain (+7 more); routes: attestor, watchlist | ProofChainDbContext | src/Attestor/StellaOps.Attestor/StellaOps.Attestor.WebService/Program.cs; src/Attestor/__Libraries/StellaOps.Attestor.Persistence/ProofChainDbContext.cs |
| Attestor | Signer | Endpoints: Ceremony, KeyRotation, Signer; routes: anchors, ceremonies, signer | KeyManagementDbContext | src/Attestor/StellaOps.Signer/StellaOps.Signer.WebService/Program.cs; src/Attestor/__Libraries/StellaOps.Signer.KeyManagement/EfCore/Context/KeyManagementDbContext.cs |
| Authority | IssuerDirectory | Endpoints: Issuer, IssuerKey, IssuerTrust; routes: issuer-directory | IssuerDirectoryDataSource, IssuerDirectoryDbContext | src/Authority/StellaOps.IssuerDirectory/StellaOps.IssuerDirectory.WebService/Program.cs; src/Authority/__Libraries/StellaOps.IssuerDirectory.Persistence/EfCore/Context/IssuerDirectoryDbContext.cs |
| BinaryIndex | BinaryIndex | Endpoints: BinaryIndexOps, GoldenSet, PatchCoverage, Resolution | BinaryIndexDbContext, BinaryIndexPersistenceDbContext, GoldenSetDbContext | src/BinaryIndex/StellaOps.BinaryIndex.WebService/Program.cs; src/BinaryIndex/__Libraries/StellaOps.BinaryIndex.GoldenSet/EfCore/Context/GoldenSetDbContext.cs |
| Concelier | Concelier | Endpoints: FeedMirrorManagement; routes: advisory-sources, canonical, concelier, federation (+3 more) | ConcelierDataSource, ConcelierDbContext | src/Concelier/StellaOps.Concelier.WebService/Program.cs; src/Concelier/__Libraries/StellaOps.Concelier.Persistence/EfCore/Context/ConcelierDbContext.cs |
| Concelier | Excititor | Endpoints: Attestation, Evidence, Ingest, Linkset (+6 more); routes: airgap, attestations, excititor, risk (+1 more) | ExcititorDataSource, ExcititorDbContext | src/Concelier/StellaOps.Excititor.WebService/Program.cs; src/Concelier/__Libraries/StellaOps.Excititor.Persistence/EfCore/Context/ExcititorDbContext.cs |
| Doctor | Doctor | Endpoints: Doctor, Timestamping; routes: doctor | No service DB; in-memory report storage | src/Doctor/StellaOps.Doctor.WebService/Program.cs |
| EvidenceLocker | EvidenceLocker | Evidence ingest/scoring, snapshots, bundle download/portable package, verify, legal hold, plus export/verdict/evidence-thread adapters | EvidenceLockerDbContext | src/EvidenceLocker/StellaOps.EvidenceLocker/StellaOps.EvidenceLocker.WebService/Program.cs; src/EvidenceLocker/StellaOps.EvidenceLocker/StellaOps.EvidenceLocker.Infrastructure/EfCore/Context/EvidenceLockerDbContext.cs |
| ExportCenter | ExportCenter | Endpoints: Attestation, AuditBundle, ExceptionReport, ExportApi (+6 more); routes: audit-bundles, exports, incidents, lineage (+4 more) | ExportCenterDbContext | src/ExportCenter/StellaOps.ExportCenter/StellaOps.ExportCenter.WebService/Program.cs; src/ExportCenter/StellaOps.ExportCenter/StellaOps.ExportCenter.Infrastructure/EfCore/Context/ExportCenterDbContext.cs |
| Findings | Findings.Ledger | Endpoints: Backport, EvidenceGraph, FindingSummary, ReachabilityMap (+4 more); routes: findings, scoring | FindingsLedgerDbContext | src/Findings/StellaOps.Findings.Ledger.WebService/Program.cs; src/Findings/StellaOps.Findings.Ledger/EfCore/Context/FindingsLedgerDbContext.cs |
| Findings | RiskEngine | Endpoints: ExploitMaturity; routes: exploit-maturity | PostgresRiskScoreResultStore (in-memory fallback retained for explicit test profile) | src/Findings/StellaOps.RiskEngine.WebService/Program.cs; src/Findings/__Libraries/StellaOps.RiskEngine.Infrastructure/Stores/PostgresRiskScoreResultStore.cs |
| Integrations | Integrations | Endpoints: Integration; routes: integrations | IntegrationDbContext | src/Integrations/StellaOps.Integrations.WebService/Program.cs; src/Integrations/__Libraries/StellaOps.Integrations.Persistence/IntegrationDbContext.cs |
| JobEngine | JobEngine | Endpoints: Approval, Audit, CircuitBreaker, Dag (+21 more); routes: approvals, environments, jobengine, metrics (+2 more) | JobEngineDbContext | src/JobEngine/StellaOps.JobEngine/StellaOps.JobEngine.WebService/Program.cs; src/JobEngine/StellaOps.JobEngine/StellaOps.JobEngine.Infrastructure/EfCore/Context/JobEngineDbContext.cs |
| JobEngine | PacksRegistry | Packs upload/list/content/provenance/manifest/signature, attestations, parity/lifecycle, mirrors sync, compliance summary, offline-seed export | Postgres metadata/state repositories + seed-fs blob channel (`SeedFsPacksRegistryBlobStore`) | src/JobEngine/StellaOps.PacksRegistry/StellaOps.PacksRegistry.WebService/Program.cs; src/JobEngine/StellaOps.PacksRegistry.__Libraries/StellaOps.PacksRegistry.Persistence/Postgres/BlobStorage/SeedFsPacksRegistryBlobStore.cs |
| JobEngine | Scheduler | Endpoints: FailureSignature, Run, Schedule; routes: events, graphs, scheduler | SchedulerDataSource, SchedulerDbContext | src/JobEngine/StellaOps.Scheduler.WebService/Program.cs; src/JobEngine/StellaOps.Scheduler.__Libraries/StellaOps.Scheduler.Persistence/EfCore/Context/SchedulerDbContext.cs |
| JobEngine | TaskRunner | Run simulation/execution state/logs/artifacts/approvals/cancel, attestation APIs, incident-mode APIs, SLO breach webhook | Postgres run state/log/approval stores + seed-fs artifact/provenance payload channel | src/JobEngine/StellaOps.TaskRunner/StellaOps.TaskRunner.WebService/Program.cs; src/JobEngine/StellaOps.TaskRunner.__Libraries/StellaOps.TaskRunner.Persistence/Postgres/Repositories/PostgresPackRunStateStore.cs |
| Notifier | Notifier | Endpoints: Escalation, Fallback, Incident, Localization (+10 more); routes: ack, escalation-policies, escalations, fallback (+13 more) | NotifyDataSource, NotifyDbContext | src/Notifier/StellaOps.Notifier/StellaOps.Notifier.WebService/Program.cs; src/Notify/__Libraries/StellaOps.Notify.Persistence/EfCore/Context/NotifyDbContext.cs |
| Notify | Notify | Rules/channels/templates CRUD, deliveries history, digests, audit trail, lock APIs, internal normalize endpoints | NotifyDataSource, NotifyDbContext | src/Notify/StellaOps.Notify.WebService/Program.cs; src/Notify/__Libraries/StellaOps.Notify.Persistence/EfCore/Context/NotifyDbContext.cs |
| Platform | Platform | Endpoints: AdministrationTrustSigningMutation, Analytics, Context, EnvironmentSettings (+19 more); routes: admin, administration, analytics, authority (+26 more) | PlatformDbContext + module-local runtime contracts (`IReleaseControlBundleStore`, `IPlatformContextQuery`); migration-only foreign persistence references are allowlisted | src/Platform/StellaOps.Platform.WebService/Program.cs; src/Platform/StellaOps.Platform.WebService/Services/PlatformContextService.cs |
| ReachGraph | ReachGraph | Endpoints: CveMapping, Reachability, ReachGraph | ReachGraphDataSource, ReachGraphDbContext | src/ReachGraph/StellaOps.ReachGraph.WebService/Program.cs; src/__Libraries/StellaOps.ReachGraph.Persistence/EfCore/Context/ReachGraphDbContext.cs |
| Remediation | Remediation | Endpoints: RemediationMatch, RemediationRegistry, RemediationSource; routes: remediation | RemediationDataSource, RemediationDbContext | src/Remediation/StellaOps.Remediation.WebService/Program.cs; src/Remediation/StellaOps.Remediation.Persistence/EfCore/Context/RemediationDbContext.cs |
| Replay | Replay | Endpoints: PointInTimeQuery, VerdictReplay; routes: pit, replay | Postgres snapshot index store + seed-fs snapshot blob store | src/Replay/StellaOps.Replay.WebService/Program.cs; src/Replay/StellaOps.Replay.WebService/FeedSnapshotSupport.cs |
| Router | Gateway | Gateway route dispatch pipeline, authz/header enforcement, transport routing, OpenAPI aggregation | No application DB; gateway routing/middleware service | src/Router/StellaOps.Gateway.WebService/Program.cs |
| Scanner | Scanner | Endpoints: Actionables, Approval, Baseline, BatchTriage (+43 more); routes: drift, epss, github, hot-lookup (+12 more) | ScannerDbContext + ScannerSourcesDataSource + TriageDbContext (+ AuthorityDbContext path) | src/Scanner/StellaOps.Scanner.WebService/Program.cs; src/Authority/__Libraries/StellaOps.Authority.Persistence/EfCore/Context/AuthorityDbContext.cs |
| Timeline | Timeline | Endpoints: Export, Health, Replay, Timeline (+1 more); routes: audit, timeline | EventingDataSource, EventingDbContext, TimelineCoreDataSource, TimelineCoreDbContext | src/Timeline/StellaOps.Timeline.WebService/Program.cs; src/__Libraries/StellaOps.Eventing/EfCore/Context/EventingDbContext.cs |
| Timeline | TimelineIndexer | Timeline indexer API group for index status/control under /api/v1 | TimelineIndexerDataSource, TimelineIndexerDbContext | src/Timeline/StellaOps.TimelineIndexer.WebService/Program.cs; src/Timeline/__Libraries/StellaOps.TimelineIndexer.Infrastructure/EfCore/Context/TimelineIndexerDbContext.cs |
| Unknowns | Unknowns | Endpoints: GreyQueue, Unknowns; routes: grey-queue, unknowns | UnknownsDataSource, UnknownsDbContext | src/Unknowns/StellaOps.Unknowns.WebService/Program.cs; src/Unknowns/__Libraries/StellaOps.Unknowns.Persistence.EfCore/Context/UnknownsDbContext.cs |
| VexHub | VexHub | VEX ingest and distribution endpoints under /api/v1/vex | VexHubDataSource, VexHubDbContext | src/VexHub/StellaOps.VexHub.WebService/Program.cs; src/VexHub/__Libraries/StellaOps.VexHub.Persistence/EfCore/Context/VexHubDbContext.cs |
| VexLens | VexLens | VEX lens APIs for deltas/export/gating/issuer views | VexLensDataSource, VexLensDbContext | src/VexLens/StellaOps.VexLens.WebService/Program.cs; src/VexLens/StellaOps.VexLens.Persistence/EfCore/Context/VexLensDbContext.cs |
## Compose Storage Baseline (Policy Input)
- Main stack defines PostgreSQL as primary platform datastore (`devops/compose/docker-compose.stella-ops.yml` lines 71-127, `x-postgres-connection` at lines 28-30).
- Main stack defines RustFS (SeaweedFS S3 API) as object/blob storage (`devops/compose/docker-compose.stella-ops.yml` lines 162-180).
- Scanner already expresses the intended split: Postgres for metadata/state and RustFS for artifacts (`devops/compose/docker-compose.stella-ops.yml` lines 652-659 and 720-725).
- Testing stack explicitly expects Postgres drivers for PacksRegistry and TaskRunner (`devops/compose/docker-compose.testing.yml` lines 253-254 and 271-272).
## Policy Gaps (Postgres First, RustFS for Blobs)
| Service | Current Runtime Wiring | Compose Signal | Gap | Required Remediation |
| --- | --- | --- | --- | --- |
| PacksRegistry | `Storage:Driver=postgres` plus Postgres repositories for metadata/state; `Storage:ObjectStore:Driver=seed-fs` for blob payloads; startup rejects `rustfs` and unknown object-store drivers. | Main/testing compose provide Postgres connection and service storage-driver keys. | Closed (Sprint 312 + 2026-03-05 hardening) | Keep contract seed-fs-only until a dedicated RustFS adapter sprint lands with parity tests. |
| TaskRunner | `Storage:Driver=postgres` plus Postgres repositories for state/log/approval; `Storage:ObjectStore:Driver=seed-fs` for artifact payloads; startup rejects `rustfs` and unknown object-store drivers in WebService and Worker. | Main/testing compose provide Postgres connection and service storage-driver keys. | Closed (Sprint 312 + 2026-03-05 hardening) | Keep contract seed-fs-only until a dedicated RustFS adapter sprint lands with parity tests. |
| RiskEngine | Postgres-backed result store (`PostgresRiskScoreResultStore`) with explicit in-memory fallback for tests. | Main compose provides `ConnectionStrings__Default` (line 1048). | Closed (Sprint 312) | Keep in-memory fallback scoped to explicit test profile only; maintain parity tests for Postgres path. |
| Replay | `Storage:Driver=postgres` for snapshot index and `Storage:ObjectStore:Driver=seed-fs` for snapshot blobs; startup rejects `rustfs` and unknown object-store values. | Main compose provides `ConnectionStrings__Default` and storage driver keys for replay. | Closed (Sprint 312 + 2026-03-05 hardening) | Keep contract seed-fs-only until a dedicated RustFS adapter sprint lands with deterministic parity tests. |
| OpsMemory | Postgres store exists but connection key is `ConnectionStrings:OpsMemory` with localhost fallback (`src/AdvisoryAI/StellaOps.OpsMemory.WebService/Program.cs` lines 19-20) | Main compose sets only `ConnectionStrings__Default` (line 1537) | Medium | Accept `ConnectionStrings:Default` as primary fallback or map explicit `ConnectionStrings:OpsMemory` in compose; remove localhost fallback in non-dev runtime. |
| Scanner | Postgres + RustFS split already configured (`src/Scanner` + compose lines 652-659/720-725) | Explicitly aligned in compose | None | Use as reference implementation for storage-driver conventions. |
## Sprint 312 remediation status (2026-03-05)
| Service | Implemented end state | Validation evidence |
| --- | --- | --- |
| PacksRegistry | `Storage:Driver=postgres` for metadata/state repositories; `Storage:ObjectStore:Driver=seed-fs` for pack/provenance/attestation payload bytes via `SeedFsPacksRegistryBlobStore`. | `dotnet test src/JobEngine/StellaOps.PacksRegistry.__Tests/StellaOps.PacksRegistry.Persistence.Tests/StellaOps.PacksRegistry.Persistence.Tests.csproj -v minimal` (Passed 7/7, including `PostgresBlobStorageRepositoryTests`). |
| TaskRunner | `Storage:Driver=postgres` for run state/log/approval; `Storage:ObjectStore:Driver=seed-fs` for artifact payload root path. | `dotnet test src/JobEngine/StellaOps.TaskRunner.__Tests/StellaOps.TaskRunner.Persistence.Tests/StellaOps.TaskRunner.Persistence.Tests.csproj -v minimal` (Passed 4/4). |
| RiskEngine | Postgres-backed result store (`PostgresRiskScoreResultStore`) registered as production default; in-memory explicit fallback retained. | Targeted class run: `StellaOps.RiskEngine.Tests.exe -class "StellaOps.RiskEngine.Tests.PostgresRiskScoreResultStoreTests"` (Passed 2/2). Full suite still has unrelated auth harness failures. |
| Replay | Postgres snapshot index store (`PostgresFeedSnapshotIndexStore`) + seed-fs blob store (`SeedFsFeedSnapshotBlobStore`). | Targeted class run: `StellaOps.Replay.Core.Tests.exe -class "...PostgresFeedSnapshotIndexStoreTests" -class "...SeedFsFeedSnapshotBlobStoreTests"` (Passed 3/3). |
| OpsMemory | Connection precedence aligned to `ConnectionStrings:OpsMemory -> ConnectionStrings:Default`, non-development fail-fast retained. | `dotnet build src/AdvisoryAI/StellaOps.OpsMemory.WebService/StellaOps.OpsMemory.WebService.csproj -v minimal` and `dotnet test src/AdvisoryAI/__Tests/StellaOps.OpsMemory.Tests/StellaOps.OpsMemory.Tests.csproj -v minimal` (previously captured in sprint evidence). |
| Compose parity | Main/testing compose now declare explicit storage-driver keys for affected services; main compose validation fixed for `taskrunner-worker` artifact mount conflict. | `docker compose -f devops/compose/docker-compose.stella-ops.yml config` (OK), `docker compose -f devops/compose/docker-compose.testing.yml config` (OK). |
## Notes
- `DB Used` reflects runtime wiring in the current code snapshot; no consolidation merge assumptions are applied.
- Services marked file-backed/in-memory/no-persistence are currently not using EF/PostgreSQL service databases.
- Compose indicates target policy direction: Postgres-first persistence with RustFS object storage for blobs/artifacts.
- Raw extraction artifact: `docs/implplan/CONSOLIDATION_SERVICE_INVENTORY_20260305.raw.json`.