Add integration connector plugins and compose fixtures

Scaffold connector plugins for DockerRegistry, GitLab, Gitea,
Jenkins, and Nexus. Wire plugin discovery in IntegrationService
and add compose fixtures for local integration testing.

- 5 new connector plugins under src/Integrations/__Plugins/
- docker-compose.integrations.yml for local fixture services
- Advisory source catalog and source management API updates
- Integration e2e test specs and Playwright config
- Integration hub docs under docs/integrations/

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

src/Integrations/StellaOps.Integrations.WebService/Infrastructure/DefaultImplementations.cs

@@ -54,21 +54,67 @@ public sealed class LoggingAuditLogger : IIntegrationAuditLogger
 }
 
 /// <summary>
-/// Stub AuthRef resolver for development.
+/// Development AuthRef resolver that supports HashiCorp Vault for local integration testing.
 /// In production, integrate with Authority service.
+/// URI format: authref://vault/{path}#{key}
 /// </summary>
 public sealed class StubAuthRefResolver : IAuthRefResolver
 {
     private readonly ILogger<StubAuthRefResolver> _logger;
+    private readonly IHttpClientFactory _httpClientFactory;
+    private readonly string _vaultAddr;
+    private readonly string _vaultToken;
 
-    public StubAuthRefResolver(ILogger<StubAuthRefResolver> logger)
+    public StubAuthRefResolver(ILogger<StubAuthRefResolver> logger, IHttpClientFactory httpClientFactory)
     {
         _logger = logger;
+        _httpClientFactory = httpClientFactory;
+        _vaultAddr = Environment.GetEnvironmentVariable("VAULT_ADDR") ?? "http://vault.stella-ops.local:8200";
+        _vaultToken = Environment.GetEnvironmentVariable("VAULT_TOKEN") ?? "stellaops-dev-root-token-2026";
     }
 
-    public Task<string?> ResolveAsync(string authRefUri, CancellationToken cancellationToken = default)
+    public async Task<string?> ResolveAsync(string authRefUri, CancellationToken cancellationToken = default)
     {
-        _logger.LogWarning("StubAuthRefResolver: Would resolve {AuthRefUri} - returning null in dev mode", authRefUri);
-        return Task.FromResult<string?>(null);
+        if (string.IsNullOrEmpty(authRefUri))
+            return null;
+
+        // Parse authref://vault/{path}#{key}
+        if (authRefUri.StartsWith("authref://vault/", StringComparison.OrdinalIgnoreCase))
+        {
+            try
+            {
+                var remainder = authRefUri["authref://vault/".Length..];
+                var hashIndex = remainder.IndexOf('#');
+                var path = hashIndex >= 0 ? remainder[..hashIndex] : remainder;
+                var key = hashIndex >= 0 ? remainder[(hashIndex + 1)..] : "value";
+
+                var client = _httpClientFactory.CreateClient("VaultClient");
+                client.BaseAddress = new Uri(_vaultAddr);
+                client.DefaultRequestHeaders.Add("X-Vault-Token", _vaultToken);
+
+                var response = await client.GetAsync($"/v1/secret/data/{path}", cancellationToken);
+                if (response.IsSuccessStatusCode)
+                {
+                    var content = await response.Content.ReadAsStringAsync(cancellationToken);
+                    using var doc = JsonDocument.Parse(content);
+                    if (doc.RootElement.TryGetProperty("data", out var dataWrap) &&
+                        dataWrap.TryGetProperty("data", out var data) &&
+                        data.TryGetProperty(key, out var secretValue))
+                    {
+                        _logger.LogInformation("Resolved authref from Vault: {Path}#{Key}", path, key);
+                        return secretValue.GetString();
+                    }
+                }
+
+                _logger.LogWarning("Vault lookup failed for {AuthRefUri}: {StatusCode}", authRefUri, response.StatusCode);
+            }
+            catch (Exception ex)
+            {
+                _logger.LogWarning(ex, "Vault resolution failed for {AuthRefUri}", authRefUri);
+            }
+        }
+
+        _logger.LogDebug("AuthRef not resolved: {AuthRefUri}", authRefUri);
+        return null;
     }
 }

src/Integrations/StellaOps.Integrations.WebService/IntegrationService.cs

@@ -75,6 +75,33 @@ public sealed class IntegrationService
 
         _logger.LogInformation("Integration created: {Id} ({Name}) by {User}", created.Id, created.Name, userId);
 
+        // Auto-test connection when a plugin is available
+        var plugin = _pluginLoader.GetByProvider(created.Provider);
+        if (plugin is not null)
+        {
+            try
+            {
+                var resolvedSecret = created.AuthRefUri is not null
+                    ? await _authRefResolver.ResolveAsync(created.AuthRefUri, cancellationToken)
+                    : null;
+                var config = BuildConfig(created, resolvedSecret);
+                var testResult = await plugin.TestConnectionAsync(config, cancellationToken);
+
+                var newStatus = testResult.Success ? IntegrationStatus.Active : IntegrationStatus.Failed;
+                if (created.Status != newStatus)
+                {
+                    created.Status = newStatus;
+                    created.UpdatedAt = _timeProvider.GetUtcNow();
+                    await _repository.UpdateAsync(created, cancellationToken);
+                    _logger.LogInformation("Auto-test set integration {Id} to {Status}", created.Id, newStatus);
+                }
+            }
+            catch (Exception ex)
+            {
+                _logger.LogWarning(ex, "Auto test-connection failed for integration {Id}, leaving as Pending", created.Id);
+            }
+        }
+
         return MapToResponse(created);
     }
 

src/Integrations/StellaOps.Integrations.WebService/Program.cs

@@ -5,6 +5,11 @@ using StellaOps.Integrations.Persistence;
 using StellaOps.Integrations.Plugin.GitHubApp;
 using StellaOps.Integrations.Plugin.Harbor;
 using StellaOps.Integrations.Plugin.InMemory;
+using StellaOps.Integrations.Plugin.Gitea;
+using StellaOps.Integrations.Plugin.Jenkins;
+using StellaOps.Integrations.Plugin.Nexus;
+using StellaOps.Integrations.Plugin.DockerRegistry;
+using StellaOps.Integrations.Plugin.GitLab;
 using StellaOps.Integrations.WebService;
 using StellaOps.Integrations.WebService.AiCodeGuard;
 using StellaOps.Integrations.WebService.Infrastructure;
@@ -46,6 +51,9 @@ builder.Services.AddStartupMigrations(
 // Repository
 builder.Services.AddScoped<IIntegrationRepository, PostgresIntegrationRepository>();
 
+// HttpClient factory (used by AuthRef resolver for Vault)
+builder.Services.AddHttpClient();
+
 // Plugin loader
 builder.Services.AddSingleton<IntegrationPluginLoader>(sp =>
 {
@@ -67,7 +75,12 @@ builder.Services.AddSingleton<IntegrationPluginLoader>(sp =>
         typeof(Program).Assembly,
         typeof(GitHubAppConnectorPlugin).Assembly,
         typeof(HarborConnectorPlugin).Assembly,
-        typeof(InMemoryConnectorPlugin).Assembly
+        typeof(InMemoryConnectorPlugin).Assembly,
+        typeof(GiteaConnectorPlugin).Assembly,
+        typeof(JenkinsConnectorPlugin).Assembly,
+        typeof(NexusConnectorPlugin).Assembly,
+        typeof(DockerRegistryConnectorPlugin).Assembly,
+        typeof(GitLabConnectorPlugin).Assembly
     ]);
 
     return loader;

src/Integrations/StellaOps.Integrations.WebService/StellaOps.Integrations.WebService.csproj

@@ -17,6 +17,11 @@
     <ProjectReference Include="..\__Plugins\StellaOps.Integrations.Plugin.GitHubApp\StellaOps.Integrations.Plugin.GitHubApp.csproj" />
     <ProjectReference Include="..\__Plugins\StellaOps.Integrations.Plugin.Harbor\StellaOps.Integrations.Plugin.Harbor.csproj" />
     <ProjectReference Include="..\__Plugins\StellaOps.Integrations.Plugin.InMemory\StellaOps.Integrations.Plugin.InMemory.csproj" />
+    <ProjectReference Include="..\__Plugins\StellaOps.Integrations.Plugin.Gitea\StellaOps.Integrations.Plugin.Gitea.csproj" />
+    <ProjectReference Include="..\__Plugins\StellaOps.Integrations.Plugin.Jenkins\StellaOps.Integrations.Plugin.Jenkins.csproj" />
+    <ProjectReference Include="..\__Plugins\StellaOps.Integrations.Plugin.Nexus\StellaOps.Integrations.Plugin.Nexus.csproj" />
+    <ProjectReference Include="..\__Plugins\StellaOps.Integrations.Plugin.DockerRegistry\StellaOps.Integrations.Plugin.DockerRegistry.csproj" />
+    <ProjectReference Include="..\__Plugins\StellaOps.Integrations.Plugin.GitLab\StellaOps.Integrations.Plugin.GitLab.csproj" />
     <ProjectReference Include="..\..\__Libraries\StellaOps.Plugin\StellaOps.Plugin.csproj" />
     <ProjectReference Include="..\..\__Libraries\StellaOps.Infrastructure.Postgres\StellaOps.Infrastructure.Postgres.csproj" />
     <ProjectReference Include="..\..\Router\__Libraries\StellaOps.Messaging\StellaOps.Messaging.csproj" />

src/Integrations/__Plugins/StellaOps.Integrations.Plugin.DockerRegistry/DockerRegistryConnectorPlugin.cs

@@ -0,0 +1,163 @@
+using StellaOps.Integrations.Contracts;
+using StellaOps.Integrations.Core;
+using System.Net.Http.Headers;
+using System.Text.Json;
+
+namespace StellaOps.Integrations.Plugin.DockerRegistry;
+
+/// <summary>
+/// Docker Registry (OCI Distribution) connector plugin.
+/// Supports any OCI Distribution Spec-compliant registry (Docker Hub, self-hosted registry:2, etc.).
+/// </summary>
+public sealed class DockerRegistryConnectorPlugin : IIntegrationConnectorPlugin
+{
+    private readonly TimeProvider _timeProvider;
+
+    public DockerRegistryConnectorPlugin()
+        : this(TimeProvider.System)
+    {
+    }
+
+    public DockerRegistryConnectorPlugin(TimeProvider? timeProvider = null)
+    {
+        _timeProvider = timeProvider ?? TimeProvider.System;
+    }
+
+    public string Name => "docker-registry";
+
+    public IntegrationType Type => IntegrationType.Registry;
+
+    public IntegrationProvider Provider => IntegrationProvider.DockerHub;
+
+    public bool IsAvailable(IServiceProvider services) => true;
+
+    public async Task<TestConnectionResult> TestConnectionAsync(IntegrationConfig config, CancellationToken cancellationToken = default)
+    {
+        var startTime = _timeProvider.GetUtcNow();
+
+        using var client = CreateHttpClient(config);
+
+        try
+        {
+            // OCI Distribution Spec: GET /v2/ returns 200 {} when authenticated
+            var response = await client.GetAsync("/v2/", cancellationToken);
+            var duration = _timeProvider.GetUtcNow() - startTime;
+
+            if (response.IsSuccessStatusCode)
+            {
+                return new TestConnectionResult(
+                    Success: true,
+                    Message: "Docker Registry connection successful",
+                    Details: new Dictionary<string, string>
+                    {
+                        ["endpoint"] = config.Endpoint,
+                        ["apiVersion"] = response.Headers.TryGetValues("Docker-Distribution-Api-Version", out var versions)
+                            ? versions.FirstOrDefault() ?? "unknown"
+                            : "unknown"
+                    },
+                    Duration: duration);
+            }
+
+            return new TestConnectionResult(
+                Success: false,
+                Message: $"Docker Registry returned {response.StatusCode}",
+                Details: new Dictionary<string, string>
+                {
+                    ["endpoint"] = config.Endpoint,
+                    ["statusCode"] = ((int)response.StatusCode).ToString()
+                },
+                Duration: duration);
+        }
+        catch (Exception ex)
+        {
+            var duration = _timeProvider.GetUtcNow() - startTime;
+            return new TestConnectionResult(
+                Success: false,
+                Message: $"Connection failed: {ex.Message}",
+                Details: new Dictionary<string, string>
+                {
+                    ["endpoint"] = config.Endpoint,
+                    ["error"] = ex.GetType().Name
+                },
+                Duration: duration);
+        }
+    }
+
+    public async Task<HealthCheckResult> CheckHealthAsync(IntegrationConfig config, CancellationToken cancellationToken = default)
+    {
+        var startTime = _timeProvider.GetUtcNow();
+
+        using var client = CreateHttpClient(config);
+
+        try
+        {
+            // Check /v2/_catalog to verify registry is fully operational
+            var response = await client.GetAsync("/v2/_catalog", cancellationToken);
+            var duration = _timeProvider.GetUtcNow() - startTime;
+
+            if (response.IsSuccessStatusCode)
+            {
+                var content = await response.Content.ReadAsStringAsync(cancellationToken);
+                var catalog = JsonSerializer.Deserialize<DockerCatalogResponse>(content, JsonOptions);
+
+                return new HealthCheckResult(
+                    Status: HealthStatus.Healthy,
+                    Message: "Docker Registry is available",
+                    Details: new Dictionary<string, string>
+                    {
+                        ["repositories"] = (catalog?.Repositories?.Count ?? 0).ToString()
+                    },
+                    CheckedAt: _timeProvider.GetUtcNow(),
+                    Duration: duration);
+            }
+
+            return new HealthCheckResult(
+                Status: HealthStatus.Unhealthy,
+                Message: $"Docker Registry returned {response.StatusCode}",
+                Details: new Dictionary<string, string> { ["statusCode"] = ((int)response.StatusCode).ToString() },
+                CheckedAt: _timeProvider.GetUtcNow(),
+                Duration: duration);
+        }
+        catch (Exception ex)
+        {
+            var duration = _timeProvider.GetUtcNow() - startTime;
+            return new HealthCheckResult(
+                Status: HealthStatus.Unhealthy,
+                Message: $"Health check failed: {ex.Message}",
+                Details: new Dictionary<string, string> { ["error"] = ex.GetType().Name },
+                CheckedAt: _timeProvider.GetUtcNow(),
+                Duration: duration);
+        }
+    }
+
+    private static HttpClient CreateHttpClient(IntegrationConfig config)
+    {
+        var client = new HttpClient
+        {
+            BaseAddress = new Uri(config.Endpoint.TrimEnd('/')),
+            Timeout = TimeSpan.FromSeconds(30)
+        };
+
+        client.DefaultRequestHeaders.Accept.Add(new MediaTypeWithQualityHeaderValue("application/json"));
+
+        // Docker Registry uses Bearer token authentication if provided
+        if (!string.IsNullOrEmpty(config.ResolvedSecret))
+        {
+            client.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Bearer", config.ResolvedSecret);
+        }
+
+        return client;
+    }
+
+    private static readonly JsonSerializerOptions JsonOptions = new()
+    {
+        PropertyNameCaseInsensitive = true
+    };
+
+    // ── Docker Registry API DTOs ────────────────────────────────────
+
+    private sealed class DockerCatalogResponse
+    {
+        public List<string>? Repositories { get; set; }
+    }
+}

src/Integrations/__Plugins/StellaOps.Integrations.Plugin.DockerRegistry/StellaOps.Integrations.Plugin.DockerRegistry.csproj

@@ -0,0 +1,16 @@
+<Project Sdk="Microsoft.NET.Sdk">
+
+  <PropertyGroup>
+    <TargetFramework>net10.0</TargetFramework>
+    <Nullable>enable</Nullable>
+    <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
+    <ImplicitUsings>enable</ImplicitUsings>
+    <LangVersion>preview</LangVersion>
+    <RootNamespace>StellaOps.Integrations.Plugin.DockerRegistry</RootNamespace>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <ProjectReference Include="..\..\__Libraries\StellaOps.Integrations.Contracts\StellaOps.Integrations.Contracts.csproj" />
+  </ItemGroup>
+
+</Project>

src/Integrations/__Plugins/StellaOps.Integrations.Plugin.GitLab/GitLabConnectorPlugin.cs

@@ -0,0 +1,165 @@
+using StellaOps.Integrations.Contracts;
+using StellaOps.Integrations.Core;
+using System.Net.Http.Headers;
+using System.Text.Json;
+
+namespace StellaOps.Integrations.Plugin.GitLab;
+
+/// <summary>
+/// GitLab Server SCM connector plugin.
+/// Supports GitLab v4 API (self-managed instances).
+/// </summary>
+public sealed class GitLabConnectorPlugin : IIntegrationConnectorPlugin
+{
+    private readonly TimeProvider _timeProvider;
+
+    public GitLabConnectorPlugin()
+        : this(TimeProvider.System)
+    {
+    }
+
+    public GitLabConnectorPlugin(TimeProvider? timeProvider = null)
+    {
+        _timeProvider = timeProvider ?? TimeProvider.System;
+    }
+
+    public string Name => "gitlab-server";
+
+    public IntegrationType Type => IntegrationType.Scm;
+
+    public IntegrationProvider Provider => IntegrationProvider.GitLabServer;
+
+    public bool IsAvailable(IServiceProvider services) => true;
+
+    public async Task<TestConnectionResult> TestConnectionAsync(IntegrationConfig config, CancellationToken cancellationToken = default)
+    {
+        var startTime = _timeProvider.GetUtcNow();
+
+        using var client = CreateHttpClient(config);
+
+        try
+        {
+            var response = await client.GetAsync("/api/v4/version", cancellationToken);
+            var duration = _timeProvider.GetUtcNow() - startTime;
+
+            if (response.IsSuccessStatusCode)
+            {
+                var content = await response.Content.ReadAsStringAsync(cancellationToken);
+                var versionInfo = JsonSerializer.Deserialize<GitLabVersionResponse>(content, JsonOptions);
+
+                return new TestConnectionResult(
+                    Success: true,
+                    Message: "GitLab connection successful",
+                    Details: new Dictionary<string, string>
+                    {
+                        ["endpoint"] = config.Endpoint,
+                        ["version"] = versionInfo?.Version ?? "unknown",
+                        ["revision"] = versionInfo?.Revision ?? "unknown"
+                    },
+                    Duration: duration);
+            }
+
+            return new TestConnectionResult(
+                Success: false,
+                Message: $"GitLab returned {response.StatusCode}",
+                Details: new Dictionary<string, string>
+                {
+                    ["endpoint"] = config.Endpoint,
+                    ["statusCode"] = ((int)response.StatusCode).ToString()
+                },
+                Duration: duration);
+        }
+        catch (Exception ex)
+        {
+            var duration = _timeProvider.GetUtcNow() - startTime;
+            return new TestConnectionResult(
+                Success: false,
+                Message: $"Connection failed: {ex.Message}",
+                Details: new Dictionary<string, string>
+                {
+                    ["endpoint"] = config.Endpoint,
+                    ["error"] = ex.GetType().Name
+                },
+                Duration: duration);
+        }
+    }
+
+    public async Task<HealthCheckResult> CheckHealthAsync(IntegrationConfig config, CancellationToken cancellationToken = default)
+    {
+        var startTime = _timeProvider.GetUtcNow();
+
+        using var client = CreateHttpClient(config);
+
+        try
+        {
+            var response = await client.GetAsync("/api/v4/version", cancellationToken);
+            var duration = _timeProvider.GetUtcNow() - startTime;
+
+            if (response.IsSuccessStatusCode)
+            {
+                var content = await response.Content.ReadAsStringAsync(cancellationToken);
+                var versionInfo = JsonSerializer.Deserialize<GitLabVersionResponse>(content, JsonOptions);
+
+                return new HealthCheckResult(
+                    Status: HealthStatus.Healthy,
+                    Message: $"GitLab is running version {versionInfo?.Version ?? "unknown"}",
+                    Details: new Dictionary<string, string>
+                    {
+                        ["version"] = versionInfo?.Version ?? "unknown",
+                        ["revision"] = versionInfo?.Revision ?? "unknown"
+                    },
+                    CheckedAt: _timeProvider.GetUtcNow(),
+                    Duration: duration);
+            }
+
+            return new HealthCheckResult(
+                Status: HealthStatus.Unhealthy,
+                Message: $"GitLab returned {response.StatusCode}",
+                Details: new Dictionary<string, string> { ["statusCode"] = ((int)response.StatusCode).ToString() },
+                CheckedAt: _timeProvider.GetUtcNow(),
+                Duration: duration);
+        }
+        catch (Exception ex)
+        {
+            var duration = _timeProvider.GetUtcNow() - startTime;
+            return new HealthCheckResult(
+                Status: HealthStatus.Unhealthy,
+                Message: $"Health check failed: {ex.Message}",
+                Details: new Dictionary<string, string> { ["error"] = ex.GetType().Name },
+                CheckedAt: _timeProvider.GetUtcNow(),
+                Duration: duration);
+        }
+    }
+
+    private static HttpClient CreateHttpClient(IntegrationConfig config)
+    {
+        var client = new HttpClient
+        {
+            BaseAddress = new Uri(config.Endpoint.TrimEnd('/')),
+            Timeout = TimeSpan.FromSeconds(30)
+        };
+
+        client.DefaultRequestHeaders.Accept.Add(new MediaTypeWithQualityHeaderValue("application/json"));
+
+        // GitLab uses PRIVATE-TOKEN header for authentication
+        if (!string.IsNullOrEmpty(config.ResolvedSecret))
+        {
+            client.DefaultRequestHeaders.Add("PRIVATE-TOKEN", config.ResolvedSecret);
+        }
+
+        return client;
+    }
+
+    private static readonly JsonSerializerOptions JsonOptions = new()
+    {
+        PropertyNameCaseInsensitive = true
+    };
+
+    // ── GitLab API DTOs ────────────────────────────────────────────
+
+    private sealed class GitLabVersionResponse
+    {
+        public string? Version { get; set; }
+        public string? Revision { get; set; }
+    }
+}

src/Integrations/__Plugins/StellaOps.Integrations.Plugin.Gitea/GiteaConnectorPlugin.cs

@@ -0,0 +1,162 @@
+using StellaOps.Integrations.Contracts;
+using StellaOps.Integrations.Core;
+using System.Net.Http.Headers;
+using System.Text.Json;
+
+namespace StellaOps.Integrations.Plugin.Gitea;
+
+/// <summary>
+/// Gitea SCM connector plugin.
+/// Supports Gitea v1.x API.
+/// </summary>
+public sealed class GiteaConnectorPlugin : IIntegrationConnectorPlugin
+{
+    private readonly TimeProvider _timeProvider;
+
+    public GiteaConnectorPlugin()
+        : this(TimeProvider.System)
+    {
+    }
+
+    public GiteaConnectorPlugin(TimeProvider? timeProvider = null)
+    {
+        _timeProvider = timeProvider ?? TimeProvider.System;
+    }
+
+    public string Name => "gitea";
+
+    public IntegrationType Type => IntegrationType.Scm;
+
+    public IntegrationProvider Provider => IntegrationProvider.Gitea;
+
+    public bool IsAvailable(IServiceProvider services) => true;
+
+    public async Task<TestConnectionResult> TestConnectionAsync(IntegrationConfig config, CancellationToken cancellationToken = default)
+    {
+        var startTime = _timeProvider.GetUtcNow();
+
+        using var client = CreateHttpClient(config);
+
+        try
+        {
+            var response = await client.GetAsync("/api/v1/version", cancellationToken);
+            var duration = _timeProvider.GetUtcNow() - startTime;
+
+            if (response.IsSuccessStatusCode)
+            {
+                var content = await response.Content.ReadAsStringAsync(cancellationToken);
+                var versionInfo = JsonSerializer.Deserialize<GiteaVersionResponse>(content, JsonOptions);
+
+                return new TestConnectionResult(
+                    Success: true,
+                    Message: "Gitea connection successful",
+                    Details: new Dictionary<string, string>
+                    {
+                        ["endpoint"] = config.Endpoint,
+                        ["version"] = versionInfo?.Version ?? "unknown"
+                    },
+                    Duration: duration);
+            }
+
+            return new TestConnectionResult(
+                Success: false,
+                Message: $"Gitea returned {response.StatusCode}",
+                Details: new Dictionary<string, string>
+                {
+                    ["endpoint"] = config.Endpoint,
+                    ["statusCode"] = ((int)response.StatusCode).ToString()
+                },
+                Duration: duration);
+        }
+        catch (Exception ex)
+        {
+            var duration = _timeProvider.GetUtcNow() - startTime;
+            return new TestConnectionResult(
+                Success: false,
+                Message: $"Connection failed: {ex.Message}",
+                Details: new Dictionary<string, string>
+                {
+                    ["endpoint"] = config.Endpoint,
+                    ["error"] = ex.GetType().Name
+                },
+                Duration: duration);
+        }
+    }
+
+    public async Task<HealthCheckResult> CheckHealthAsync(IntegrationConfig config, CancellationToken cancellationToken = default)
+    {
+        var startTime = _timeProvider.GetUtcNow();
+
+        using var client = CreateHttpClient(config);
+
+        try
+        {
+            var response = await client.GetAsync("/api/v1/version", cancellationToken);
+            var duration = _timeProvider.GetUtcNow() - startTime;
+
+            if (response.IsSuccessStatusCode)
+            {
+                var content = await response.Content.ReadAsStringAsync(cancellationToken);
+                var versionInfo = JsonSerializer.Deserialize<GiteaVersionResponse>(content, JsonOptions);
+
+                return new HealthCheckResult(
+                    Status: HealthStatus.Healthy,
+                    Message: $"Gitea is running version {versionInfo?.Version ?? "unknown"}",
+                    Details: new Dictionary<string, string>
+                    {
+                        ["version"] = versionInfo?.Version ?? "unknown"
+                    },
+                    CheckedAt: _timeProvider.GetUtcNow(),
+                    Duration: duration);
+            }
+
+            return new HealthCheckResult(
+                Status: HealthStatus.Unhealthy,
+                Message: $"Gitea returned {response.StatusCode}",
+                Details: new Dictionary<string, string> { ["statusCode"] = ((int)response.StatusCode).ToString() },
+                CheckedAt: _timeProvider.GetUtcNow(),
+                Duration: duration);
+        }
+        catch (Exception ex)
+        {
+            var duration = _timeProvider.GetUtcNow() - startTime;
+            return new HealthCheckResult(
+                Status: HealthStatus.Unhealthy,
+                Message: $"Health check failed: {ex.Message}",
+                Details: new Dictionary<string, string> { ["error"] = ex.GetType().Name },
+                CheckedAt: _timeProvider.GetUtcNow(),
+                Duration: duration);
+        }
+    }
+
+    private static HttpClient CreateHttpClient(IntegrationConfig config)
+    {
+        var client = new HttpClient
+        {
+            BaseAddress = new Uri(config.Endpoint.TrimEnd('/')),
+            Timeout = TimeSpan.FromSeconds(30)
+        };
+
+        client.DefaultRequestHeaders.Accept.Add(new MediaTypeWithQualityHeaderValue("application/json"));
+
+        // Gitea uses token-based authentication: Authorization: token <secret>
+        if (!string.IsNullOrEmpty(config.ResolvedSecret))
+        {
+            client.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("token", config.ResolvedSecret);
+        }
+
+        return client;
+    }
+
+    private static readonly JsonSerializerOptions JsonOptions = new()
+    {
+        PropertyNameCaseInsensitive = true
+    };
+
+    // ── Gitea API DTOs ────────────────────────────────────────────
+
+    private sealed class GiteaVersionResponse
+    {
+        public string? Version { get; set; }
+    }
+}

src/Integrations/__Plugins/StellaOps.Integrations.Plugin.Gitea/StellaOps.Integrations.Plugin.Gitea.csproj

@@ -0,0 +1,16 @@
+<Project Sdk="Microsoft.NET.Sdk">
+
+  <PropertyGroup>
+    <TargetFramework>net10.0</TargetFramework>
+    <Nullable>enable</Nullable>
+    <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
+    <ImplicitUsings>enable</ImplicitUsings>
+    <LangVersion>preview</LangVersion>
+    <RootNamespace>StellaOps.Integrations.Plugin.Gitea</RootNamespace>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <ProjectReference Include="..\..\__Libraries\StellaOps.Integrations.Contracts\StellaOps.Integrations.Contracts.csproj" />
+  </ItemGroup>
+
+</Project>

src/Integrations/__Plugins/StellaOps.Integrations.Plugin.Jenkins/JenkinsConnectorPlugin.cs

@@ -0,0 +1,177 @@
+using StellaOps.Integrations.Contracts;
+using StellaOps.Integrations.Core;
+using System.Net.Http.Headers;
+using System.Text;
+using System.Text.Json;
+
+namespace StellaOps.Integrations.Plugin.Jenkins;
+
+/// <summary>
+/// Jenkins CI/CD connector plugin.
+/// Supports Jenkins REST API.
+/// </summary>
+public sealed class JenkinsConnectorPlugin : IIntegrationConnectorPlugin
+{
+    private readonly TimeProvider _timeProvider;
+
+    public JenkinsConnectorPlugin()
+        : this(TimeProvider.System)
+    {
+    }
+
+    public JenkinsConnectorPlugin(TimeProvider? timeProvider = null)
+    {
+        _timeProvider = timeProvider ?? TimeProvider.System;
+    }
+
+    public string Name => "jenkins";
+
+    public IntegrationType Type => IntegrationType.CiCd;
+
+    public IntegrationProvider Provider => IntegrationProvider.Jenkins;
+
+    public bool IsAvailable(IServiceProvider services) => true;
+
+    public async Task<TestConnectionResult> TestConnectionAsync(IntegrationConfig config, CancellationToken cancellationToken = default)
+    {
+        var startTime = _timeProvider.GetUtcNow();
+
+        using var client = CreateHttpClient(config);
+
+        try
+        {
+            var response = await client.GetAsync("/api/json", cancellationToken);
+            var duration = _timeProvider.GetUtcNow() - startTime;
+
+            if (response.IsSuccessStatusCode)
+            {
+                var content = await response.Content.ReadAsStringAsync(cancellationToken);
+                var info = JsonSerializer.Deserialize<JenkinsInfoResponse>(content, JsonOptions);
+
+                return new TestConnectionResult(
+                    Success: true,
+                    Message: "Jenkins connection successful",
+                    Details: new Dictionary<string, string>
+                    {
+                        ["endpoint"] = config.Endpoint,
+                        ["mode"] = info?.Mode ?? "unknown",
+                        ["nodeDescription"] = info?.NodeDescription ?? "unknown"
+                    },
+                    Duration: duration);
+            }
+
+            return new TestConnectionResult(
+                Success: false,
+                Message: $"Jenkins returned {response.StatusCode}",
+                Details: new Dictionary<string, string>
+                {
+                    ["endpoint"] = config.Endpoint,
+                    ["statusCode"] = ((int)response.StatusCode).ToString()
+                },
+                Duration: duration);
+        }
+        catch (Exception ex)
+        {
+            var duration = _timeProvider.GetUtcNow() - startTime;
+            return new TestConnectionResult(
+                Success: false,
+                Message: $"Connection failed: {ex.Message}",
+                Details: new Dictionary<string, string>
+                {
+                    ["endpoint"] = config.Endpoint,
+                    ["error"] = ex.GetType().Name
+                },
+                Duration: duration);
+        }
+    }
+
+    public async Task<HealthCheckResult> CheckHealthAsync(IntegrationConfig config, CancellationToken cancellationToken = default)
+    {
+        var startTime = _timeProvider.GetUtcNow();
+
+        using var client = CreateHttpClient(config);
+
+        try
+        {
+            var response = await client.GetAsync("/api/json", cancellationToken);
+            var duration = _timeProvider.GetUtcNow() - startTime;
+
+            if (response.IsSuccessStatusCode)
+            {
+                var content = await response.Content.ReadAsStringAsync(cancellationToken);
+                var info = JsonSerializer.Deserialize<JenkinsInfoResponse>(content, JsonOptions);
+
+                // Jenkins in QUIET mode is shutting down — treat as degraded
+                var status = info?.Mode switch
+                {
+                    "NORMAL" => HealthStatus.Healthy,
+                    "QUIET" => HealthStatus.Degraded,
+                    _ => HealthStatus.Unhealthy
+                };
+
+                return new HealthCheckResult(
+                    Status: status,
+                    Message: $"Jenkins mode: {info?.Mode ?? "unknown"}",
+                    Details: new Dictionary<string, string>
+                    {
+                        ["mode"] = info?.Mode ?? "unknown",
+                        ["nodeDescription"] = info?.NodeDescription ?? "unknown",
+                        ["numExecutors"] = info?.NumExecutors.ToString() ?? "0"
+                    },
+                    CheckedAt: _timeProvider.GetUtcNow(),
+                    Duration: duration);
+            }
+
+            return new HealthCheckResult(
+                Status: HealthStatus.Unhealthy,
+                Message: $"Jenkins returned {response.StatusCode}",
+                Details: new Dictionary<string, string> { ["statusCode"] = ((int)response.StatusCode).ToString() },
+                CheckedAt: _timeProvider.GetUtcNow(),
+                Duration: duration);
+        }
+        catch (Exception ex)
+        {
+            var duration = _timeProvider.GetUtcNow() - startTime;
+            return new HealthCheckResult(
+                Status: HealthStatus.Unhealthy,
+                Message: $"Health check failed: {ex.Message}",
+                Details: new Dictionary<string, string> { ["error"] = ex.GetType().Name },
+                CheckedAt: _timeProvider.GetUtcNow(),
+                Duration: duration);
+        }
+    }
+
+    private static HttpClient CreateHttpClient(IntegrationConfig config)
+    {
+        var client = new HttpClient
+        {
+            BaseAddress = new Uri(config.Endpoint.TrimEnd('/')),
+            Timeout = TimeSpan.FromSeconds(30)
+        };
+
+        client.DefaultRequestHeaders.Accept.Add(new MediaTypeWithQualityHeaderValue("application/json"));
+
+        // Jenkins uses Basic auth (username:apiToken or username:password)
+        if (!string.IsNullOrEmpty(config.ResolvedSecret))
+        {
+            var credentials = Convert.ToBase64String(Encoding.UTF8.GetBytes(config.ResolvedSecret));
+            client.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Basic", credentials);
+        }
+
+        return client;
+    }
+
+    private static readonly JsonSerializerOptions JsonOptions = new()
+    {
+        PropertyNameCaseInsensitive = true
+    };
+
+    // ── Jenkins API DTOs ────────────────────────────────────────────
+
+    private sealed class JenkinsInfoResponse
+    {
+        public string? Mode { get; set; }
+        public string? NodeDescription { get; set; }
+        public int NumExecutors { get; set; }
+    }
+}

src/Integrations/__Plugins/StellaOps.Integrations.Plugin.Jenkins/StellaOps.Integrations.Plugin.Jenkins.csproj

@@ -0,0 +1,16 @@
+<Project Sdk="Microsoft.NET.Sdk">
+
+  <PropertyGroup>
+    <TargetFramework>net10.0</TargetFramework>
+    <Nullable>enable</Nullable>
+    <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
+    <ImplicitUsings>enable</ImplicitUsings>
+    <LangVersion>preview</LangVersion>
+    <RootNamespace>StellaOps.Integrations.Plugin.Jenkins</RootNamespace>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <ProjectReference Include="..\..\__Libraries\StellaOps.Integrations.Contracts\StellaOps.Integrations.Contracts.csproj" />
+  </ItemGroup>
+
+</Project>

src/Integrations/__Plugins/StellaOps.Integrations.Plugin.Nexus/NexusConnectorPlugin.cs

@@ -0,0 +1,156 @@
+using StellaOps.Integrations.Contracts;
+using StellaOps.Integrations.Core;
+using System.Net.Http.Headers;
+using System.Text;
+using System.Text.Json;
+
+namespace StellaOps.Integrations.Plugin.Nexus;
+
+/// <summary>
+/// Sonatype Nexus Repository Manager connector plugin.
+/// Supports Nexus Repository Manager 3.x REST API.
+/// </summary>
+public sealed class NexusConnectorPlugin : IIntegrationConnectorPlugin
+{
+    private readonly TimeProvider _timeProvider;
+
+    public NexusConnectorPlugin()
+        : this(TimeProvider.System)
+    {
+    }
+
+    public NexusConnectorPlugin(TimeProvider? timeProvider = null)
+    {
+        _timeProvider = timeProvider ?? TimeProvider.System;
+    }
+
+    public string Name => "nexus";
+
+    public IntegrationType Type => IntegrationType.Registry;
+
+    public IntegrationProvider Provider => IntegrationProvider.Nexus;
+
+    public bool IsAvailable(IServiceProvider services) => true;
+
+    public async Task<TestConnectionResult> TestConnectionAsync(IntegrationConfig config, CancellationToken cancellationToken = default)
+    {
+        var startTime = _timeProvider.GetUtcNow();
+
+        using var client = CreateHttpClient(config);
+
+        try
+        {
+            var response = await client.GetAsync("/service/rest/v1/status", cancellationToken);
+            var duration = _timeProvider.GetUtcNow() - startTime;
+
+            if (response.IsSuccessStatusCode)
+            {
+                return new TestConnectionResult(
+                    Success: true,
+                    Message: "Nexus connection successful",
+                    Details: new Dictionary<string, string>
+                    {
+                        ["endpoint"] = config.Endpoint,
+                        ["statusCode"] = ((int)response.StatusCode).ToString()
+                    },
+                    Duration: duration);
+            }
+
+            return new TestConnectionResult(
+                Success: false,
+                Message: $"Nexus returned {response.StatusCode}",
+                Details: new Dictionary<string, string>
+                {
+                    ["endpoint"] = config.Endpoint,
+                    ["statusCode"] = ((int)response.StatusCode).ToString()
+                },
+                Duration: duration);
+        }
+        catch (Exception ex)
+        {
+            var duration = _timeProvider.GetUtcNow() - startTime;
+            return new TestConnectionResult(
+                Success: false,
+                Message: $"Connection failed: {ex.Message}",
+                Details: new Dictionary<string, string>
+                {
+                    ["endpoint"] = config.Endpoint,
+                    ["error"] = ex.GetType().Name
+                },
+                Duration: duration);
+        }
+    }
+
+    public async Task<HealthCheckResult> CheckHealthAsync(IntegrationConfig config, CancellationToken cancellationToken = default)
+    {
+        var startTime = _timeProvider.GetUtcNow();
+
+        using var client = CreateHttpClient(config);
+
+        try
+        {
+            var response = await client.GetAsync("/service/rest/v1/status", cancellationToken);
+            var duration = _timeProvider.GetUtcNow() - startTime;
+
+            if (response.IsSuccessStatusCode)
+            {
+                return new HealthCheckResult(
+                    Status: HealthStatus.Healthy,
+                    Message: "Nexus is available and ready",
+                    Details: new Dictionary<string, string>
+                    {
+                        ["statusCode"] = ((int)response.StatusCode).ToString()
+                    },
+                    CheckedAt: _timeProvider.GetUtcNow(),
+                    Duration: duration);
+            }
+
+            // Nexus returns 503 when starting up
+            var status = (int)response.StatusCode == 503
+                ? HealthStatus.Degraded
+                : HealthStatus.Unhealthy;
+
+            return new HealthCheckResult(
+                Status: status,
+                Message: $"Nexus returned {response.StatusCode}",
+                Details: new Dictionary<string, string> { ["statusCode"] = ((int)response.StatusCode).ToString() },
+                CheckedAt: _timeProvider.GetUtcNow(),
+                Duration: duration);
+        }
+        catch (Exception ex)
+        {
+            var duration = _timeProvider.GetUtcNow() - startTime;
+            return new HealthCheckResult(
+                Status: HealthStatus.Unhealthy,
+                Message: $"Health check failed: {ex.Message}",
+                Details: new Dictionary<string, string> { ["error"] = ex.GetType().Name },
+                CheckedAt: _timeProvider.GetUtcNow(),
+                Duration: duration);
+        }
+    }
+
+    private static HttpClient CreateHttpClient(IntegrationConfig config)
+    {
+        var client = new HttpClient
+        {
+            BaseAddress = new Uri(config.Endpoint.TrimEnd('/')),
+            Timeout = TimeSpan.FromSeconds(30)
+        };
+
+        client.DefaultRequestHeaders.Accept.Add(new MediaTypeWithQualityHeaderValue("application/json"));
+
+        // Nexus uses Basic auth (username:password)
+        if (!string.IsNullOrEmpty(config.ResolvedSecret))
+        {
+            var credentials = Convert.ToBase64String(Encoding.UTF8.GetBytes(config.ResolvedSecret));
+            client.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Basic", credentials);
+        }
+
+        return client;
+    }
+
+    private static readonly JsonSerializerOptions JsonOptions = new()
+    {
+        PropertyNameCaseInsensitive = true
+    };
+}

src/Integrations/__Plugins/StellaOps.Integrations.Plugin.Nexus/StellaOps.Integrations.Plugin.Nexus.csproj

@@ -0,0 +1,16 @@
+<Project Sdk="Microsoft.NET.Sdk">
+
+  <PropertyGroup>
+    <TargetFramework>net10.0</TargetFramework>
+    <Nullable>enable</Nullable>
+    <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
+    <ImplicitUsings>enable</ImplicitUsings>
+    <LangVersion>preview</LangVersion>
+    <RootNamespace>StellaOps.Integrations.Plugin.Nexus</RootNamespace>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <ProjectReference Include="..\..\__Libraries\StellaOps.Integrations.Contracts\StellaOps.Integrations.Contracts.csproj" />
+  </ItemGroup>
+
+</Project>

src/Web/StellaOps.Web/e2e/integrations.e2e.spec.ts

@@ -0,0 +1,385 @@
+/**
+ * Integration Services — End-to-End Test Suite
+ *
+ * Live infrastructure tests that validate the full integration lifecycle:
+ *   1. Docker compose health (fixtures + real services)
+ *   2. Direct endpoint probes to each 3rd-party service
+ *   3. Stella Ops connector plugin API (create, test, health, delete)
+ *   4. UI verification (Hub counts, tab switching, list views)
+ *   5. Advisory source catalog (74/74 healthy)
+ *
+ * Prerequisites:
+ *   - Main Stella Ops stack running (docker-compose.stella-ops.yml)
+ *   - Integration fixtures running (docker-compose.integration-fixtures.yml)
+ *   - Integration services running (docker-compose.integrations.yml)
+ *
+ * Usage:
+ *   PLAYWRIGHT_BASE_URL=https://stella-ops.local npx playwright test e2e/integrations.e2e.spec.ts
+ */
+
+import { execSync } from 'child_process';
+import { test, expect } from './fixtures/live-auth.fixture';
+
+const SCREENSHOT_DIR = 'e2e/screenshots/integrations';
+const BASE = process.env['PLAYWRIGHT_BASE_URL'] || 'https://stella-ops.local';
+
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+
+function dockerHealthy(containerName: string): boolean {
+  try {
+    const out = execSync(
+      `docker ps --filter "name=${containerName}" --format "{{.Status}}"`,
+      { encoding: 'utf-8', timeout: 5_000 },
+    ).trim();
+    return out.includes('(healthy)') || (out.startsWith('Up') && !out.includes('health: starting'));
+  } catch {
+    return false;
+  }
+}
+
+function dockerRunning(containerName: string): boolean {
+  try {
+    const out = execSync(
+      `docker ps --filter "name=${containerName}" --format "{{.Status}}"`,
+      { encoding: 'utf-8', timeout: 5_000 },
+    ).trim();
+    return out.startsWith('Up');
+  } catch {
+    return false;
+  }
+}
+
+async function snap(page: import('@playwright/test').Page, label: string) {
+  await page.screenshot({ path: `${SCREENSHOT_DIR}/${label}.png`, fullPage: true });
+}
+
+// ---------------------------------------------------------------------------
+// 1. Compose Health
+// ---------------------------------------------------------------------------
+
+test.describe('Integration Services — Compose Health', () => {
+  const fixtures = [
+    'stellaops-harbor-fixture',
+    'stellaops-github-app-fixture',
+    'stellaops-advisory-fixture',
+  ];
+
+  const services = [
+    'stellaops-gitea',
+    'stellaops-jenkins',
+    'stellaops-nexus',
+    'stellaops-vault',
+    'stellaops-docker-registry',
+    'stellaops-minio',
+  ];
+
+  for (const name of fixtures) {
+    test(`fixture container ${name} is healthy`, () => {
+      expect(dockerHealthy(name), `${name} should be healthy`).toBe(true);
+    });
+  }
+
+  for (const name of services) {
+    test(`service container ${name} is running`, () => {
+      expect(dockerRunning(name), `${name} should be running`).toBe(true);
+    });
+  }
+
+  test('core integrations-web service is healthy', () => {
+    expect(dockerHealthy('stellaops-integrations-web')).toBe(true);
+  });
+
+  test('core concelier service is healthy', () => {
+    expect(dockerHealthy('stellaops-concelier')).toBe(true);
+  });
+});
+
+// ---------------------------------------------------------------------------
+// 2. Direct Endpoint Probes
+// ---------------------------------------------------------------------------
+
+test.describe('Integration Services — Direct Endpoint Probes', () => {
+  const probes: Array<{ name: string; url: string; expect: string | number }> = [
+    { name: 'Harbor fixture', url: 'http://127.1.1.6/api/v2.0/health', expect: 'healthy' },
+    { name: 'GitHub App fixture', url: 'http://127.1.1.7/api/v3/app', expect: 'Stella QA' },
+    { name: 'Advisory fixture', url: 'http://127.1.1.8/health', expect: 'healthy' },
+    { name: 'Gitea', url: 'http://127.1.2.1:3000/api/v1/version', expect: 'version' },
+    { name: 'Jenkins', url: 'http://127.1.2.2:8080/api/json', expect: 200 },
+    { name: 'Nexus', url: 'http://127.1.2.3:8081/service/rest/v1/status', expect: 200 },
+    { name: 'Vault', url: 'http://127.1.2.4:8200/v1/sys/health', expect: 200 },
+    { name: 'Docker Registry', url: 'http://127.1.2.5:5000/v2/', expect: 200 },
+    { name: 'MinIO', url: 'http://127.1.2.6:9000/minio/health/live', expect: 200 },
+  ];
+
+  for (const probe of probes) {
+    test(`${probe.name} responds at ${new URL(probe.url).pathname}`, async ({ playwright }) => {
+      const ctx = await playwright.request.newContext({ ignoreHTTPSErrors: true });
+      try {
+        const resp = await ctx.get(probe.url, { timeout: 10_000 });
+        expect(resp.status(), `${probe.name} should return 2xx`).toBeLessThan(300);
+
+        if (typeof probe.expect === 'string') {
+          const body = await resp.text();
+          expect(body).toContain(probe.expect);
+        }
+      } finally {
+        await ctx.dispose();
+      }
+    });
+  }
+});
+
+// ---------------------------------------------------------------------------
+// 3. Stella Ops Connector Lifecycle
+// ---------------------------------------------------------------------------
+
+test.describe('Integration Services — Connector Lifecycle', () => {
+  const createdIds: string[] = [];
+
+  const integrations = [
+    {
+      name: 'E2E Harbor Registry',
+      type: 1, // Registry
+      provider: 100, // Harbor
+      endpoint: 'http://harbor-fixture.stella-ops.local',
+      authRefUri: null,
+      organizationId: 'e2e-test',
+      extendedConfig: { scheduleType: 'manual', repositories: ['e2e/test'] },
+      tags: ['e2e'],
+    },
+    {
+      name: 'E2E Docker Registry',
+      type: 1,
+      provider: 104, // DockerHub
+      endpoint: 'http://oci-registry.stella-ops.local:5000',
+      authRefUri: null,
+      organizationId: null,
+      extendedConfig: { scheduleType: 'manual' },
+      tags: ['e2e'],
+    },
+    {
+      name: 'E2E Nexus Repository',
+      type: 1,
+      provider: 107, // Nexus
+      endpoint: 'http://nexus.stella-ops.local:8081',
+      authRefUri: null,
+      organizationId: null,
+      extendedConfig: { scheduleType: 'manual' },
+      tags: ['e2e'],
+    },
+    {
+      name: 'E2E Gitea SCM',
+      type: 2, // Scm
+      provider: 203, // Gitea
+      endpoint: 'http://gitea.stella-ops.local:3000',
+      authRefUri: null,
+      organizationId: 'e2e',
+      extendedConfig: { scheduleType: 'manual', repositories: ['e2e/repo'] },
+      tags: ['e2e'],
+    },
+    {
+      name: 'E2E Jenkins CI',
+      type: 3, // CiCd
+      provider: 302, // Jenkins
+      endpoint: 'http://jenkins.stella-ops.local:8080',
+      authRefUri: null,
+      organizationId: null,
+      extendedConfig: { scheduleType: 'manual' },
+      tags: ['e2e'],
+    },
+  ];
+
+  test('GET /providers returns at least 8 connector plugins', async ({ apiRequest }) => {
+    const resp = await apiRequest.get('/api/v1/integrations/providers');
+    expect(resp.status()).toBe(200);
+    const providers = await resp.json();
+    expect(providers.length).toBeGreaterThanOrEqual(8);
+  });
+
+  for (const integration of integrations) {
+    test(`create ${integration.name} and auto-activate`, async ({ apiRequest }) => {
+      const resp = await apiRequest.post('/api/v1/integrations', { data: integration });
+      expect(resp.status()).toBe(201);
+      const body = await resp.json();
+
+      createdIds.push(body.id);
+      expect(body.name).toBe(integration.name);
+      // Auto-test should set status to Active (1) for reachable services
+      expect(body.status, `${integration.name} should be Active after auto-test`).toBe(1);
+    });
+  }
+
+  test('list integrations returns correct counts per type', async ({ apiRequest }) => {
+    const registries = await apiRequest.get('/api/v1/integrations?type=1&pageSize=100');
+    const scm = await apiRequest.get('/api/v1/integrations?type=2&pageSize=100');
+    const cicd = await apiRequest.get('/api/v1/integrations?type=3&pageSize=100');
+
+    const regBody = await registries.json();
+    const scmBody = await scm.json();
+    const cicdBody = await cicd.json();
+
+    expect(regBody.totalCount).toBeGreaterThanOrEqual(3);
+    expect(scmBody.totalCount).toBeGreaterThanOrEqual(1);
+    expect(cicdBody.totalCount).toBeGreaterThanOrEqual(1);
+  });
+
+  test('test-connection succeeds on all created integrations', async ({ apiRequest }) => {
+    for (const id of createdIds) {
+      const resp = await apiRequest.post(`/api/v1/integrations/${id}/test`);
+      expect(resp.status()).toBe(200);
+      const body = await resp.json();
+      expect(body.success, `test-connection for ${id} should succeed`).toBe(true);
+    }
+  });
+
+  test('health-check returns healthy on all created integrations', async ({ apiRequest }) => {
+    for (const id of createdIds) {
+      const resp = await apiRequest.get(`/api/v1/integrations/${id}/health`);
+      expect(resp.status()).toBe(200);
+      const body = await resp.json();
+      // HealthStatus.Healthy = 1
+      expect(body.status, `health for ${id} should be Healthy`).toBe(1);
+    }
+  });
+
+  test.afterAll(async ({ playwright }) => {
+    // Clean up: get a fresh token and delete all e2e integrations
+    if (createdIds.length === 0) return;
+
+    const browser = await playwright.chromium.launch();
+    const page = await browser.newPage({ ignoreHTTPSErrors: true });
+
+    await page.goto(BASE, { waitUntil: 'domcontentloaded' });
+    if (page.url().includes('/welcome')) {
+      await page.getByRole('button', { name: /sign in/i }).click();
+      await page.waitForURL('**/connect/authorize**', { timeout: 10_000 });
+    }
+    const usernameField = page.getByRole('textbox', { name: /username/i });
+    if (await usernameField.isVisible({ timeout: 5_000 }).catch(() => false)) {
+      await usernameField.fill('admin');
+      await page.getByRole('textbox', { name: /password/i }).fill('Admin@Stella2026!');
+      await page.getByRole('button', { name: /sign in/i }).click();
+      await page.waitForURL(`${BASE}/**`, { timeout: 15_000 });
+    }
+    await page.waitForLoadState('networkidle');
+
+    const token = await page.evaluate(() => {
+      const s = sessionStorage.getItem('stellaops.auth.session.full');
+      return s ? JSON.parse(s)?.tokens?.accessToken : null;
+    });
+
+    if (token) {
+      for (const id of createdIds) {
+        await page.evaluate(
+          async ([id, token]) => {
+            await fetch(`/api/v1/integrations/${id}`, {
+              method: 'DELETE',
+              headers: { Authorization: `Bearer ${token}` },
+            });
+          },
+          [id, token] as const,
+        );
+      }
+    }
+
+    await browser.close();
+  });
+});
+
+// ---------------------------------------------------------------------------
+// 4. Advisory Sources
+// ---------------------------------------------------------------------------
+
+test.describe('Integration Services — Advisory Sources', () => {
+  test('all advisory sources report healthy after check', async ({ apiRequest }) => {
+    // Trigger a full check (this takes ~60-90 seconds)
+    const checkResp = await apiRequest.post('/api/v1/advisory-sources/check', { timeout: 120_000 });
+    expect(checkResp.status()).toBe(200);
+    const result = await checkResp.json();
+
+    expect(result.totalChecked).toBeGreaterThanOrEqual(42);
+    expect(result.failedCount, `Expected 0 failed sources, got ${result.failedCount}`).toBe(0);
+  });
+});
+
+// ---------------------------------------------------------------------------
+// 5. UI Verification
+// ---------------------------------------------------------------------------
+
+test.describe('Integration Services — UI Verification', () => {
+  test('Hub tab shows correct connector counts', async ({ liveAuthPage: page }) => {
+    await page.goto(`${BASE}/setup/integrations`, { waitUntil: 'networkidle', timeout: 30_000 });
+    await page.waitForLoadState('domcontentloaded');
+    await page.waitForTimeout(2_000);
+
+    // Check that configured connectors count is shown
+    const countText = await page.locator('text=/configured connectors/').textContent();
+    expect(countText).toBeTruthy();
+
+    await snap(page, '01-hub-overview');
+  });
+
+  test('Registries tab lists registry integrations', async ({ liveAuthPage: page }) => {
+    await page.goto(`${BASE}/setup/integrations/registries`, { waitUntil: 'networkidle', timeout: 30_000 });
+    await page.waitForTimeout(2_000);
+
+    const heading = page.getByRole('heading', { name: /registry/i });
+    await expect(heading).toBeVisible({ timeout: 5_000 });
+
+    // Should have at least one row in the table
+    const rows = page.locator('table tbody tr');
+    const count = await rows.count();
+    expect(count).toBeGreaterThanOrEqual(1);
+
+    await snap(page, '02-registries-tab');
+  });
+
+  test('SCM tab lists SCM integrations', async ({ liveAuthPage: page }) => {
+    await page.goto(`${BASE}/setup/integrations/scm`, { waitUntil: 'networkidle', timeout: 30_000 });
+    await page.waitForTimeout(2_000);
+
+    const heading = page.getByRole('heading', { name: /scm/i });
+    await expect(heading).toBeVisible({ timeout: 5_000 });
+
+    const rows = page.locator('table tbody tr');
+    const count = await rows.count();
+    expect(count).toBeGreaterThanOrEqual(1);
+
+    await snap(page, '03-scm-tab');
+  });
+
+  test('CI/CD tab lists CI/CD integrations', async ({ liveAuthPage: page }) => {
+    await page.goto(`${BASE}/setup/integrations/ci`, { waitUntil: 'networkidle', timeout: 30_000 });
+    await page.waitForTimeout(2_000);
+
+    const heading = page.getByRole('heading', { name: /ci\/cd/i });
+    await expect(heading).toBeVisible({ timeout: 5_000 });
+
+    const rows = page.locator('table tbody tr');
+    const count = await rows.count();
+    expect(count).toBeGreaterThanOrEqual(1);
+
+    await snap(page, '04-cicd-tab');
+  });
+
+  test('tab switching navigates between all tabs', async ({ liveAuthPage: page }) => {
+    await page.goto(`${BASE}/setup/integrations`, { waitUntil: 'networkidle', timeout: 30_000 });
+    await page.waitForTimeout(2_000);
+
+    const tabs = ['Registries', 'SCM', 'CI/CD', 'Runtimes / Hosts', 'Advisory & VEX', 'Secrets', 'Hub'];
+
+    for (const tabName of tabs) {
+      const tab = page.getByRole('tab', { name: tabName });
+      await tab.click();
+      await page.waitForTimeout(500);
+
+      // Verify tab is now selected
+      const isSelected = await tab.getAttribute('aria-selected');
+      expect(isSelected, `Tab "${tabName}" should be selected after click`).toBe('true');
+    }
+
+    await snap(page, '05-tab-switching-final');
+  });
+});

src/Web/StellaOps.Web/playwright.integrations.config.ts

@@ -0,0 +1,19 @@
+import { defineConfig } from '@playwright/test';
+
+/**
+ * Playwright config for live integration tests.
+ * Runs against the real Stella Ops stack — no dev server, no mocking.
+ */
+export default defineConfig({
+  testDir: 'tests/e2e/integrations',
+  timeout: 120_000,
+  workers: 1,
+  retries: 0,
+  use: {
+    baseURL: process.env.PLAYWRIGHT_BASE_URL ?? 'https://stella-ops.local',
+    ignoreHTTPSErrors: true,
+    trace: 'retain-on-failure',
+    screenshot: 'only-on-failure',
+  },
+  // No webServer — tests run against the live stack
+});

src/Web/StellaOps.Web/src/app/features/integrations/advisory-vex-sources/advisory-source-catalog.component.ts

@@ -74,6 +74,13 @@ interface CategoryGroup {
             Check All
           }
         </button>
+        <button class="btn btn-primary" type="button" [disabled]="syncing()" (click)="onSyncAll()" style="margin-left: 0.5rem;">
+          @if (syncing()) {
+            Syncing ({{ syncProgress().done }}/{{ syncProgress().total }})...
+          } @else {
+            Sync All
+          }
+        </button>
       </header>
 
       <!-- Mirror context header -->
@@ -217,6 +224,15 @@ interface CategoryGroup {
                       >
                         Check
                       </button>
+                      <button
+                        class="btn btn-sm"
+                        type="button"
+                        style="background: var(--color-accent-bg); color: var(--color-accent-fg);"
+                        (click)="$event.stopPropagation(); onSyncSource(source.id)"
+                        [title]="'Trigger data sync for ' + source.displayName"
+                      >
+                        Sync
+                      </button>
                     </div>
 
                     @if (expandedSourceId() === source.id) {
@@ -930,6 +946,8 @@ export class AdvisorySourceCatalogComponent implements OnInit {
   readonly loading = signal(true);
   readonly checking = signal(false);
   readonly checkProgress = signal({ done: 0, total: 0 });
+  readonly syncing = signal(false);
+  readonly syncProgress = signal({ done: 0, total: 0 });
   readonly selectedIds = signal<Set<string>>(new Set());
   readonly searchTerm = signal('');
   readonly categoryFilter = signal<string | null>(null);
@@ -1211,6 +1229,64 @@ export class AdvisorySourceCatalogComponent implements OnInit {
     });
   }
 
+  onSyncSource(sourceId: string): void {
+    this.api.syncSource(sourceId).pipe(take(1)).subscribe({
+      next: (result) => {
+        console.log(`Sync triggered for ${sourceId}: ${result.outcome}`);
+      },
+      error: (err) => {
+        console.warn(`Sync failed for ${sourceId}:`, err);
+      },
+    });
+  }
+
+  onSyncAll(): void {
+    const items = this.catalog();
+    const enabledIds = items
+      .filter((item) => this.isSourceEnabled(item.id))
+      .map((item) => item.id);
+
+    if (enabledIds.length === 0) return;
+
+    this.syncing.set(true);
+    this.syncProgress.set({ done: 0, total: enabledIds.length });
+
+    const batchSize = 6;
+    let completed = 0;
+
+    const syncNext = (startIndex: number): void => {
+      const batch = enabledIds.slice(startIndex, startIndex + batchSize);
+      if (batch.length === 0) {
+        this.syncing.set(false);
+        return;
+      }
+
+      let batchDone = 0;
+      for (const sourceId of batch) {
+        this.api.syncSource(sourceId).pipe(take(1)).subscribe({
+          next: () => {
+            completed++;
+            batchDone++;
+            this.syncProgress.set({ done: completed, total: enabledIds.length });
+            if (batchDone === batch.length) {
+              syncNext(startIndex + batchSize);
+            }
+          },
+          error: () => {
+            completed++;
+            batchDone++;
+            this.syncProgress.set({ done: completed, total: enabledIds.length });
+            if (batchDone === batch.length) {
+              syncNext(startIndex + batchSize);
+            }
+          },
+        });
+      }
+    };
+
+    syncNext(0);
+  }
+
   enableAllInCategory(category: string): void {
     const ids = this.catalog()
       .filter((item) => {

src/Web/StellaOps.Web/src/app/features/integrations/advisory-vex-sources/source-management.api.ts

@@ -71,6 +71,20 @@ export interface BatchSourceResponse {
   results: BatchSourceResultItem[];
 }
 
+export interface SyncSourceResultDto {
+  sourceId: string;
+  jobKind: string;
+  outcome: string;
+  runId?: string | null;
+  message?: string | null;
+}
+
+export interface SyncAllResultDto {
+  totalTriggered: number;
+  totalSources: number;
+  results: SyncSourceResultDto[];
+}
+
 @Injectable({ providedIn: 'root' })
 export class SourceManagementApi {
   private readonly http = inject(HttpClient);
@@ -134,6 +148,20 @@ export class SourceManagementApi {
     );
   }
 
+  syncSource(sourceId: string): Observable<SyncSourceResultDto> {
+    return this.http.post<SyncSourceResultDto>(
+      `${this.baseUrl}/${encodeURIComponent(sourceId)}/sync`,
+      null,
+      { headers: this.buildHeaders() },
+    );
+  }
+
+  syncAll(): Observable<SyncAllResultDto> {
+    return this.http.post<SyncAllResultDto>(`${this.baseUrl}/sync`, null, {
+      headers: this.buildHeaders(),
+    });
+  }
+
   private buildHeaders(): HttpHeaders {
     const tenantId = this.authSession.getActiveTenantId();
     if (!tenantId) {

src/Web/StellaOps.Web/tests/e2e/integrations/integrations.e2e.spec.ts

@@ -0,0 +1,676 @@
+/**
+ * Integration Services — End-to-End Test Suite
+ *
+ * Live infrastructure tests that validate the full integration lifecycle:
+ *   1. Docker compose health (fixtures + real services)
+ *   2. Direct endpoint probes to each 3rd-party service
+ *   3. Stella Ops connector plugin API (create, test, health, delete)
+ *   4. UI verification (Hub counts, tab switching, list views)
+ *   5. Advisory source catalog (74/74 healthy)
+ *
+ * Prerequisites:
+ *   - Main Stella Ops stack running (docker-compose.stella-ops.yml)
+ *   - Integration fixtures running (docker-compose.integration-fixtures.yml)
+ *   - Integration services running (docker-compose.integrations.yml)
+ *
+ * Usage:
+ *   PLAYWRIGHT_BASE_URL=https://stella-ops.local npx playwright test e2e/integrations.e2e.spec.ts
+ */
+
+import { execSync } from 'child_process';
+import { test, expect } from './live-auth.fixture';
+
+const SCREENSHOT_DIR = 'e2e/screenshots/integrations';
+const BASE = process.env['PLAYWRIGHT_BASE_URL'] || 'https://stella-ops.local';
+const runId = process.env['E2E_RUN_ID'] || 'run1';
+
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+
+function dockerHealthy(containerName: string): boolean {
+  try {
+    const out = execSync(
+      `docker ps --filter "name=${containerName}" --format "{{.Status}}"`,
+      { encoding: 'utf-8', timeout: 5_000 },
+    ).trim();
+    return out.includes('(healthy)') || (out.startsWith('Up') && !out.includes('health: starting'));
+  } catch {
+    return false;
+  }
+}
+
+function dockerRunning(containerName: string): boolean {
+  try {
+    const out = execSync(
+      `docker ps --filter "name=${containerName}" --format "{{.Status}}"`,
+      { encoding: 'utf-8', timeout: 5_000 },
+    ).trim();
+    return out.startsWith('Up');
+  } catch {
+    return false;
+  }
+}
+
+async function snap(page: import('@playwright/test').Page, label: string) {
+  await page.screenshot({ path: `${SCREENSHOT_DIR}/${label}.png`, fullPage: true });
+}
+
+// ---------------------------------------------------------------------------
+// 1. Compose Health
+// ---------------------------------------------------------------------------
+
+test.describe('Integration Services — Compose Health', () => {
+  const fixtures = [
+    'stellaops-harbor-fixture',
+    'stellaops-github-app-fixture',
+    'stellaops-advisory-fixture',
+  ];
+
+  const services = [
+    'stellaops-gitea',
+    'stellaops-jenkins',
+    'stellaops-nexus',
+    'stellaops-vault',
+    'stellaops-docker-registry',
+    'stellaops-minio',
+  ];
+
+  for (const name of fixtures) {
+    test(`fixture container ${name} is healthy`, () => {
+      expect(dockerHealthy(name), `${name} should be healthy`).toBe(true);
+    });
+  }
+
+  for (const name of services) {
+    test(`service container ${name} is running`, () => {
+      expect(dockerRunning(name), `${name} should be running`).toBe(true);
+    });
+  }
+
+  test('core integrations-web service is healthy', () => {
+    expect(dockerHealthy('stellaops-integrations-web')).toBe(true);
+  });
+
+  test('core concelier service is healthy', () => {
+    expect(dockerHealthy('stellaops-concelier')).toBe(true);
+  });
+});
+
+// ---------------------------------------------------------------------------
+// 2. Direct Endpoint Probes
+// ---------------------------------------------------------------------------
+
+test.describe('Integration Services — Direct Endpoint Probes', () => {
+  const probes: Array<{ name: string; url: string; expect: string | number }> = [
+    { name: 'Harbor fixture', url: 'http://127.1.1.6/api/v2.0/health', expect: 'healthy' },
+    { name: 'GitHub App fixture', url: 'http://127.1.1.7/api/v3/app', expect: 'Stella QA' },
+    { name: 'Advisory fixture', url: 'http://127.1.1.8/health', expect: 'healthy' },
+    { name: 'Gitea', url: 'http://127.1.2.1:3000/api/v1/version', expect: 'version' },
+    { name: 'Jenkins', url: 'http://127.1.2.2:8080/api/json', expect: 200 },
+    { name: 'Nexus', url: 'http://127.1.2.3:8081/service/rest/v1/status', expect: 200 },
+    { name: 'Vault', url: 'http://127.1.2.4:8200/v1/sys/health', expect: 200 },
+    { name: 'Docker Registry', url: 'http://127.1.2.5:5000/v2/', expect: 200 },
+    { name: 'MinIO', url: 'http://127.1.2.6:9000/minio/health/live', expect: 200 },
+  ];
+
+  for (const probe of probes) {
+    test(`${probe.name} responds at ${new URL(probe.url).pathname}`, async ({ playwright }) => {
+      const ctx = await playwright.request.newContext({ ignoreHTTPSErrors: true });
+      try {
+        const resp = await ctx.get(probe.url, { timeout: 10_000 });
+        expect(resp.status(), `${probe.name} should return 2xx`).toBeLessThan(300);
+
+        if (typeof probe.expect === 'string') {
+          const body = await resp.text();
+          expect(body).toContain(probe.expect);
+        }
+      } finally {
+        await ctx.dispose();
+      }
+    });
+  }
+});
+
+// ---------------------------------------------------------------------------
+// 3. Stella Ops Connector Lifecycle
+// ---------------------------------------------------------------------------
+
+test.describe('Integration Services — Connector Lifecycle', () => {
+  const createdIds: string[] = [];
+
+  const integrations = [
+    {
+      name: `E2E Harbor Registry ${runId}`,
+      type: 1, // Registry
+      provider: 100, // Harbor
+      endpoint: 'http://harbor-fixture.stella-ops.local',
+      authRefUri: null,
+      organizationId: 'e2e-test',
+      extendedConfig: { scheduleType: 'manual', repositories: ['e2e/test'] },
+      tags: ['e2e'],
+    },
+    {
+      name: `E2E Docker Registry ${runId}`,
+      type: 1,
+      provider: 104, // DockerHub
+      endpoint: 'http://docker-registry.stella-ops.local:5000',
+      authRefUri: null,
+      organizationId: null,
+      extendedConfig: { scheduleType: 'manual' },
+      tags: ['e2e'],
+    },
+    {
+      name: `E2E Nexus Repository ${runId}`,
+      type: 1,
+      provider: 107, // Nexus
+      endpoint: 'http://nexus.stella-ops.local:8081',
+      authRefUri: null,
+      organizationId: null,
+      extendedConfig: { scheduleType: 'manual' },
+      tags: ['e2e'],
+    },
+    {
+      name: `E2E Gitea SCM ${runId}`,
+      type: 2, // Scm
+      provider: 203, // Gitea
+      endpoint: 'http://gitea.stella-ops.local:3000',
+      authRefUri: null,
+      organizationId: 'e2e',
+      extendedConfig: { scheduleType: 'manual', repositories: ['e2e/repo'] },
+      tags: ['e2e'],
+    },
+    {
+      name: `E2E Jenkins CI ${runId}`,
+      type: 3, // CiCd
+      provider: 302, // Jenkins
+      endpoint: 'http://jenkins.stella-ops.local:8080',
+      authRefUri: null,
+      organizationId: null,
+      extendedConfig: { scheduleType: 'manual' },
+      tags: ['e2e'],
+    },
+  ];
+
+  test('GET /providers returns at least 8 connector plugins', async ({ apiRequest }) => {
+    const resp = await apiRequest.get('/api/v1/integrations/providers');
+    expect(resp.status()).toBe(200);
+    const providers = await resp.json();
+    expect(providers.length).toBeGreaterThanOrEqual(8);
+  });
+
+  for (const integration of integrations) {
+    test(`create ${integration.name} and auto-activate`, async ({ apiRequest }) => {
+      const resp = await apiRequest.post('/api/v1/integrations', { data: integration });
+      expect(resp.status()).toBe(201);
+      const body = await resp.json();
+
+      createdIds.push(body.id);
+      expect(body.name).toContain('E2E');
+      // Auto-test should set status to Active (1) for reachable services
+      // Accept Pending (0) if auto-test had transient network issues
+      expect(
+        [0, 1],
+        `${integration.name} status should be Pending or Active, got ${body.status}`,
+      ).toContain(body.status);
+    });
+  }
+
+  test('list integrations returns results for each type', async ({ apiRequest }) => {
+    const registries = await apiRequest.get('/api/v1/integrations?type=1&pageSize=100');
+    const scm = await apiRequest.get('/api/v1/integrations?type=2&pageSize=100');
+    const cicd = await apiRequest.get('/api/v1/integrations?type=3&pageSize=100');
+
+    expect(registries.status()).toBe(200);
+    expect(scm.status()).toBe(200);
+    expect(cicd.status()).toBe(200);
+
+    const regBody = await registries.json();
+    const scmBody = await scm.json();
+    const cicdBody = await cicd.json();
+
+    // At minimum, the E2E integrations we just created should be present
+    expect(regBody.totalCount).toBeGreaterThanOrEqual(1);
+    expect(scmBody.totalCount).toBeGreaterThanOrEqual(1);
+    expect(cicdBody.totalCount).toBeGreaterThanOrEqual(1);
+  });
+
+  test('test-connection succeeds on all created integrations', async ({ apiRequest }) => {
+    for (const id of createdIds) {
+      const resp = await apiRequest.post(`/api/v1/integrations/${id}/test`);
+      expect(resp.status()).toBe(200);
+      const body = await resp.json();
+      expect(body.success, `test-connection for ${id} should succeed`).toBe(true);
+    }
+  });
+
+  test('health-check returns healthy on all created integrations', async ({ apiRequest }) => {
+    for (const id of createdIds) {
+      const resp = await apiRequest.get(`/api/v1/integrations/${id}/health`);
+      expect(resp.status()).toBe(200);
+      const body = await resp.json();
+      // HealthStatus.Healthy = 1
+      expect(body.status, `health for ${id} should be Healthy`).toBe(1);
+    }
+  });
+
+  test.afterAll(async ({ playwright }) => {
+    // Clean up: get a fresh token and delete all e2e integrations
+    if (createdIds.length === 0) return;
+
+    const browser = await playwright.chromium.launch();
+    const page = await browser.newPage({ ignoreHTTPSErrors: true });
+
+    await page.goto(BASE, { waitUntil: 'domcontentloaded' });
+    if (page.url().includes('/welcome')) {
+      await page.getByRole('button', { name: /sign in/i }).click();
+      await page.waitForURL('**/connect/authorize**', { timeout: 10_000 });
+    }
+    const usernameField = page.getByRole('textbox', { name: /username/i });
+    if (await usernameField.isVisible({ timeout: 5_000 }).catch(() => false)) {
+      await usernameField.fill('admin');
+      await page.getByRole('textbox', { name: /password/i }).fill('Admin@Stella2026!');
+      await page.getByRole('button', { name: /sign in/i }).click();
+      await page.waitForURL(`${BASE}/**`, { timeout: 15_000 });
+    }
+    await page.waitForLoadState('networkidle');
+
+    const token = await page.evaluate(() => {
+      const s = sessionStorage.getItem('stellaops.auth.session.full');
+      return s ? JSON.parse(s)?.tokens?.accessToken : null;
+    });
+
+    if (token) {
+      for (const id of createdIds) {
+        await page.evaluate(
+          async ([id, token]) => {
+            await fetch(`/api/v1/integrations/${id}`, {
+              method: 'DELETE',
+              headers: { Authorization: `Bearer ${token}` },
+            });
+          },
+          [id, token] as const,
+        );
+      }
+    }
+
+    await browser.close();
+  });
+});
+
+// ---------------------------------------------------------------------------
+// 4. Advisory Sources
+// ---------------------------------------------------------------------------
+
+test.describe('Integration Services — Advisory Sources', () => {
+  test('all advisory sources report healthy after check', async ({ apiRequest }) => {
+    const checkResp = await apiRequest.post('/api/v1/advisory-sources/check', { timeout: 120_000 });
+    expect(checkResp.status()).toBe(200);
+    const result = await checkResp.json();
+
+    expect(result.totalChecked).toBeGreaterThanOrEqual(42);
+    expect(result.failedCount, `Expected <=3 failed sources, got ${result.failedCount}`).toBeLessThanOrEqual(3);
+  });
+});
+
+// ---------------------------------------------------------------------------
+// 4b. Advisory Source Sync Lifecycle
+// ---------------------------------------------------------------------------
+
+test.describe('Integration Services — Advisory Source Sync Lifecycle', () => {
+
+  test('GET /catalog returns full source catalog with metadata', async ({ apiRequest }) => {
+    const resp = await apiRequest.get('/api/v1/advisory-sources/catalog');
+    expect(resp.status()).toBe(200);
+    const body = await resp.json();
+
+    expect(body.totalCount).toBeGreaterThanOrEqual(42);
+    expect(body.items.length).toBeGreaterThanOrEqual(42);
+
+    // Verify each source has required fields
+    const first = body.items[0];
+    expect(first.id).toBeTruthy();
+    expect(first.displayName).toBeTruthy();
+    expect(first.category).toBeTruthy();
+    expect(first.baseEndpoint).toBeTruthy();
+    expect(typeof first.enabledByDefault).toBe('boolean');
+  });
+
+  test('GET /status returns enabled/disabled state for all sources', async ({ apiRequest }) => {
+    const resp = await apiRequest.get('/api/v1/advisory-sources/status');
+    expect(resp.status()).toBe(200);
+    const body = await resp.json();
+
+    expect(body.sources.length).toBeGreaterThanOrEqual(42);
+    const enabledCount = body.sources.filter((s: any) => s.enabled).length;
+    expect(enabledCount).toBeGreaterThan(0);
+  });
+
+  test('POST /{sourceId}/enable then disable toggles source state', async ({ apiRequest }) => {
+    const sourceId = 'nvd';
+
+    // Disable first
+    const disableResp = await apiRequest.post(`/api/v1/advisory-sources/${sourceId}/disable`);
+    expect(disableResp.status()).toBe(200);
+    const disableBody = await disableResp.json();
+    expect(disableBody.enabled).toBe(false);
+
+    // Verify disabled in status
+    const statusResp1 = await apiRequest.get('/api/v1/advisory-sources/status');
+    const status1 = await statusResp1.json();
+    const nvdStatus1 = status1.sources.find((s: any) => s.sourceId === sourceId);
+    expect(nvdStatus1.enabled).toBe(false);
+
+    // Re-enable
+    const enableResp = await apiRequest.post(`/api/v1/advisory-sources/${sourceId}/enable`);
+    expect(enableResp.status()).toBe(200);
+    const enableBody = await enableResp.json();
+    expect(enableBody.enabled).toBe(true);
+
+    // Verify enabled in status
+    const statusResp2 = await apiRequest.get('/api/v1/advisory-sources/status');
+    const status2 = await statusResp2.json();
+    const nvdStatus2 = status2.sources.find((s: any) => s.sourceId === sourceId);
+    expect(nvdStatus2.enabled).toBe(true);
+  });
+
+  test('POST /{sourceId}/sync triggers fetch job for a source', async ({ apiRequest }) => {
+    const sourceId = 'redhat'; // Has a registered fetch job
+    const resp = await apiRequest.post(`/api/v1/advisory-sources/${sourceId}/sync`);
+    expect(resp.status()).toBeLessThan(500);
+    const body = await resp.json();
+
+    expect(body.sourceId).toBe(sourceId);
+    expect(body.jobKind).toBe(`source:${sourceId}:fetch`);
+    // Accepted or already_running or no_job_defined are all valid outcomes
+    expect(['accepted', 'already_running', 'no_job_defined']).toContain(body.outcome);
+  });
+
+  test('POST /sync triggers fetch for all enabled sources', async ({ apiRequest }) => {
+    const resp = await apiRequest.post('/api/v1/advisory-sources/sync');
+    expect(resp.status()).toBe(200);
+    const body = await resp.json();
+
+    expect(body.totalSources).toBeGreaterThan(0);
+    expect(body.results).toBeDefined();
+    expect(body.results.length).toBe(body.totalSources);
+
+    // Each result should have sourceId and outcome
+    for (const r of body.results) {
+      expect(r.sourceId).toBeTruthy();
+      expect(r.outcome).toBeTruthy();
+    }
+  });
+
+  test('POST /{sourceId}/sync returns 404 for unknown source', async ({ apiRequest }) => {
+    const resp = await apiRequest.post('/api/v1/advisory-sources/nonexistent-source-xyz/sync');
+    expect(resp.status()).toBe(404);
+  });
+
+  test('GET /summary returns freshness aggregation', async ({ apiRequest }) => {
+    const resp = await apiRequest.get('/api/v1/advisory-sources/summary');
+    expect(resp.status()).toBe(200);
+    const body = await resp.json();
+
+    expect(body.totalSources).toBeGreaterThanOrEqual(1);
+    expect(typeof body.healthySources).toBe('number');
+    expect(typeof body.staleSources).toBe('number');
+    expect(typeof body.unavailableSources).toBe('number');
+    expect(body.dataAsOf).toBeTruthy();
+  });
+
+  test('POST /{sourceId}/check returns connectivity result with details', async ({ apiRequest }) => {
+    const sourceId = 'nvd';
+    const resp = await apiRequest.post(`/api/v1/advisory-sources/${sourceId}/check`);
+    expect(resp.status()).toBe(200);
+    const body = await resp.json();
+
+    expect(body.sourceId).toBe(sourceId);
+    expect(body.isHealthy).toBe(true);
+    expect(body.checkedAt).toBeTruthy();
+  });
+
+  test('GET /{sourceId}/check-result returns last check result', async ({ apiRequest }) => {
+    const sourceId = 'nvd';
+    // Ensure at least one check has been performed
+    await apiRequest.post(`/api/v1/advisory-sources/${sourceId}/check`);
+
+    const resp = await apiRequest.get(`/api/v1/advisory-sources/${sourceId}/check-result`);
+    expect(resp.status()).toBe(200);
+    const body = await resp.json();
+
+    expect(body.sourceId).toBe(sourceId);
+  });
+
+  test('batch-enable and batch-disable work for multiple sources', async ({ apiRequest }) => {
+    const sourceIds = ['nvd', 'osv', 'cve'];
+
+    // Batch disable
+    const disableResp = await apiRequest.post('/api/v1/advisory-sources/batch-disable', {
+      data: { sourceIds },
+    });
+    expect(disableResp.status()).toBe(200);
+    const disableBody = await disableResp.json();
+    expect(disableBody.results.length).toBe(3);
+    for (const r of disableBody.results) {
+      expect(r.success).toBe(true);
+    }
+
+    // Batch re-enable
+    const enableResp = await apiRequest.post('/api/v1/advisory-sources/batch-enable', {
+      data: { sourceIds },
+    });
+    expect(enableResp.status()).toBe(200);
+    const enableBody = await enableResp.json();
+    expect(enableBody.results.length).toBe(3);
+    for (const r of enableBody.results) {
+      expect(r.success).toBe(true);
+    }
+  });
+});
+
+// ---------------------------------------------------------------------------
+// 4c. Integration Connector Full CRUD + Status Lifecycle
+// ---------------------------------------------------------------------------
+
+test.describe('Integration Services — Connector CRUD & Status', () => {
+  let testId: string | null = null;
+
+  test('create integration returns 201 with correct fields', async ({ apiRequest }) => {
+    const resp = await apiRequest.post('/api/v1/integrations', {
+      data: {
+        name: `E2E CRUD Test ${runId}`,
+        type: 1,
+        provider: 100,
+        endpoint: 'http://harbor-fixture.stella-ops.local',
+        authRefUri: null,
+        organizationId: 'crud-test',
+        extendedConfig: { scheduleType: 'manual' },
+        tags: ['e2e', 'crud-test'],
+      },
+    });
+    expect(resp.status()).toBe(201);
+    const body = await resp.json();
+
+    testId = body.id;
+    expect(body.id).toBeTruthy();
+    expect(body.name).toContain('E2E CRUD Test');
+    expect(body.type).toBe(1);
+    expect(body.provider).toBe(100);
+    expect(body.endpoint).toBe('http://harbor-fixture.stella-ops.local');
+    expect(body.hasAuth).toBe(false);
+    expect(body.organizationId).toBe('crud-test');
+    expect(body.tags).toContain('e2e');
+  });
+
+  test('GET by ID returns the created integration', async ({ apiRequest }) => {
+    expect(testId).toBeTruthy();
+    const resp = await apiRequest.get(`/api/v1/integrations/${testId}`);
+    expect(resp.status()).toBe(200);
+    const body = await resp.json();
+
+    expect(body.id).toBe(testId);
+    expect(body.name).toContain('E2E CRUD Test');
+  });
+
+  test('POST test-connection transitions status to Active', async ({ apiRequest }) => {
+    expect(testId).toBeTruthy();
+    const resp = await apiRequest.post(`/api/v1/integrations/${testId}/test`);
+    expect(resp.status()).toBe(200);
+    const body = await resp.json();
+
+    expect(body.success).toBe(true);
+    expect(body.message).toContain('Harbor');
+
+    // Verify status changed to Active
+    const getResp = await apiRequest.get(`/api/v1/integrations/${testId}`);
+    const integration = await getResp.json();
+    expect(integration.status).toBe(1); // Active
+  });
+
+  test('GET health returns Healthy after health check', async ({ apiRequest }) => {
+    expect(testId).toBeTruthy();
+    const resp = await apiRequest.get(`/api/v1/integrations/${testId}/health`);
+    expect(resp.status()).toBe(200);
+    const body = await resp.json();
+
+    expect(body.status).toBe(1); // Healthy
+    expect(body.checkedAt).toBeTruthy();
+  });
+
+  test('GET impact returns workflow impact map', async ({ apiRequest }) => {
+    expect(testId).toBeTruthy();
+    const resp = await apiRequest.get(`/api/v1/integrations/${testId}/impact`);
+    expect(resp.status()).toBe(200);
+    const body = await resp.json();
+
+    expect(body.integrationId).toBe(testId);
+    expect(body.type).toBe(1); // Registry
+    expect(body.severity).toBeTruthy();
+    expect(body.impactedWorkflows).toBeDefined();
+    expect(body.impactedWorkflows.length).toBeGreaterThan(0);
+  });
+
+  test('PUT update changes integration fields', async ({ apiRequest }) => {
+    expect(testId).toBeTruthy();
+    const resp = await apiRequest.put(`/api/v1/integrations/${testId}`, {
+      data: { name: `E2E CRUD Updated ${runId}`, description: 'Updated by E2E test' },
+    });
+    expect(resp.status()).toBe(200);
+    const body = await resp.json();
+
+    expect(body.name).toContain('E2E CRUD Updated');
+    expect(body.description).toBe('Updated by E2E test');
+  });
+
+  test('DELETE removes the integration', async ({ apiRequest }) => {
+    expect(testId).toBeTruthy();
+    const resp = await apiRequest.delete(`/api/v1/integrations/${testId}`);
+    // Accept 200 or 204 (No Content)
+    expect(resp.status()).toBeLessThan(300);
+
+    // Verify it's gone (404 or empty response)
+    const getResp = await apiRequest.get(`/api/v1/integrations/${testId}`);
+    expect([404, 204, 200]).toContain(getResp.status());
+  });
+
+  test('GET /providers lists all loaded connector plugins', async ({ apiRequest }) => {
+    const resp = await apiRequest.get('/api/v1/integrations/providers');
+    expect(resp.status()).toBe(200);
+    const providers = await resp.json();
+
+    expect(providers.length).toBeGreaterThanOrEqual(8);
+
+    // Verify known providers are present
+    const names = providers.map((p: any) => p.name);
+    expect(names).toContain('harbor');
+    expect(names).toContain('gitea');
+    expect(names).toContain('jenkins');
+    expect(names).toContain('nexus');
+    expect(names).toContain('docker-registry');
+    expect(names).toContain('gitlab-server');
+  });
+});
+
+// ---------------------------------------------------------------------------
+// 5. UI Verification
+// ---------------------------------------------------------------------------
+
+test.describe('Integration Services — UI Verification', () => {
+  test('landing page redirects to first populated tab or shows onboarding', async ({ liveAuthPage: page }) => {
+    await page.goto(`${BASE}/setup/integrations`, { waitUntil: 'networkidle', timeout: 30_000 });
+    await page.waitForLoadState('domcontentloaded');
+    await page.waitForTimeout(3_000);
+
+    const url = page.url();
+    // Should either redirect to a tab (registries/scm/ci) or show onboarding
+    const isOnTab = url.includes('/registries') || url.includes('/scm') || url.includes('/ci');
+    const hasOnboarding = await page.locator('text=/Get Started/').isVisible().catch(() => false);
+
+    expect(isOnTab || hasOnboarding, 'Should redirect to tab or show onboarding').toBe(true);
+
+    await snap(page, '01-landing');
+  });
+
+  test('Registries tab lists registry integrations', async ({ liveAuthPage: page }) => {
+    await page.goto(`${BASE}/setup/integrations/registries`, { waitUntil: 'networkidle', timeout: 30_000 });
+    await page.waitForTimeout(2_000);
+
+    const heading = page.getByRole('heading', { name: /registry/i });
+    await expect(heading).toBeVisible({ timeout: 5_000 });
+
+    // Should have at least one row in the table
+    const rows = page.locator('table tbody tr');
+    const count = await rows.count();
+    expect(count).toBeGreaterThanOrEqual(1);
+
+    await snap(page, '02-registries-tab');
+  });
+
+  test('SCM tab lists SCM integrations', async ({ liveAuthPage: page }) => {
+    await page.goto(`${BASE}/setup/integrations/scm`, { waitUntil: 'networkidle', timeout: 30_000 });
+    await page.waitForTimeout(2_000);
+
+    const heading = page.getByRole('heading', { name: /scm/i });
+    await expect(heading).toBeVisible({ timeout: 5_000 });
+
+    const rows = page.locator('table tbody tr');
+    const count = await rows.count();
+    expect(count).toBeGreaterThanOrEqual(1);
+
+    await snap(page, '03-scm-tab');
+  });
+
+  test('CI/CD tab lists CI/CD integrations', async ({ liveAuthPage: page }) => {
+    await page.goto(`${BASE}/setup/integrations/ci`, { waitUntil: 'networkidle', timeout: 30_000 });
+    await page.waitForTimeout(2_000);
+
+    const heading = page.getByRole('heading', { name: /ci\/cd/i });
+    await expect(heading).toBeVisible({ timeout: 5_000 });
+
+    const rows = page.locator('table tbody tr');
+    const count = await rows.count();
+    expect(count).toBeGreaterThanOrEqual(1);
+
+    await snap(page, '04-cicd-tab');
+  });
+
+  test('tab switching navigates between all tabs', async ({ liveAuthPage: page }) => {
+    await page.goto(`${BASE}/setup/integrations`, { waitUntil: 'networkidle', timeout: 30_000 });
+    await page.waitForTimeout(2_000);
+
+    const tabs = ['Registries', 'SCM', 'CI/CD', 'Runtimes / Hosts', 'Advisory & VEX', 'Secrets'];
+
+    for (const tabName of tabs) {
+      const tab = page.getByRole('tab', { name: tabName });
+      await tab.click();
+      await page.waitForTimeout(500);
+
+      // Verify tab is now selected
+      const isSelected = await tab.getAttribute('aria-selected');
+      expect(isSelected, `Tab "${tabName}" should be selected after click`).toBe('true');
+    }
+
+    await snap(page, '05-tab-switching-final');
+  });
+});

src/Web/StellaOps.Web/tests/e2e/integrations/live-auth.fixture.ts

@@ -0,0 +1,100 @@
+import { test as base, expect, Page, APIRequestContext } from '@playwright/test';
+
+/**
+ * Live auth fixture for integration tests against the real Stella Ops stack.
+ *
+ * Unlike the mocked auth.fixture.ts, this performs a real OIDC login against
+ * the live Authority service and extracts a Bearer token for API calls.
+ */
+
+const BASE_URL = process.env['PLAYWRIGHT_BASE_URL'] || 'https://stella-ops.local';
+const ADMIN_USER = process.env['STELLAOPS_ADMIN_USER'] || 'admin';
+const ADMIN_PASS = process.env['STELLAOPS_ADMIN_PASS'] || 'Admin@Stella2026!';
+
+async function loginAndGetToken(page: Page): Promise<string> {
+  // Navigate to the app
+  await page.goto(BASE_URL, { waitUntil: 'domcontentloaded', timeout: 30_000 });
+  await page.waitForTimeout(2_000);
+
+  // Check if already authenticated (session exists)
+  const existingToken = await page.evaluate(() => {
+    const s = sessionStorage.getItem('stellaops.auth.session.full');
+    return s ? JSON.parse(s)?.tokens?.accessToken : null;
+  });
+  if (existingToken) return existingToken;
+
+  // If we land on /welcome, click Sign In
+  if (page.url().includes('/welcome')) {
+    const signInBtn = page.getByRole('button', { name: /sign in/i });
+    await signInBtn.waitFor({ state: 'visible', timeout: 10_000 });
+    await signInBtn.click();
+    await page.waitForTimeout(3_000);
+  }
+
+  // If already on /connect/authorize, fill the login form
+  if (page.url().includes('/connect/')) {
+    const usernameField = page.getByRole('textbox', { name: /username/i });
+    await usernameField.waitFor({ state: 'visible', timeout: 15_000 });
+    await usernameField.fill(ADMIN_USER);
+    await page.getByRole('textbox', { name: /password/i }).fill(ADMIN_PASS);
+    await page.getByRole('button', { name: /sign in/i }).click();
+  }
+
+  // Wait for the session token to appear in sessionStorage (polls every 500ms)
+  const token = await page.waitForFunction(
+    () => {
+      const s = sessionStorage.getItem('stellaops.auth.session.full');
+      if (!s) return null;
+      try {
+        const parsed = JSON.parse(s);
+        return parsed?.tokens?.accessToken || null;
+      } catch { return null; }
+    },
+    null,
+    { timeout: 30_000, polling: 500 },
+  );
+
+  const tokenValue = await token.jsonValue() as string;
+  if (!tokenValue) {
+    throw new Error('Login succeeded but failed to extract auth token from sessionStorage');
+  }
+
+  return tokenValue;
+}
+
+export const test = base.extend<{
+  liveAuthPage: Page;
+  apiToken: string;
+  apiRequest: APIRequestContext;
+}>({
+  liveAuthPage: async ({ browser }, use) => {
+    const context = await browser.newContext({ ignoreHTTPSErrors: true });
+    const page = await context.newPage();
+    await loginAndGetToken(page);
+    await use(page);
+    await context.close();
+  },
+
+  apiToken: async ({ browser }, use) => {
+    const context = await browser.newContext({ ignoreHTTPSErrors: true });
+    const page = await context.newPage();
+    const token = await loginAndGetToken(page);
+    await use(token);
+    await context.close();
+  },
+
+  apiRequest: async ({ playwright, apiToken }, use) => {
+    const ctx = await playwright.request.newContext({
+      baseURL: BASE_URL,
+      extraHTTPHeaders: {
+        'Authorization': `Bearer ${apiToken}`,
+        'Content-Type': 'application/json',
+      },
+      ignoreHTTPSErrors: true,
+    });
+    await use(ctx);
+    await ctx.dispose();
+  },
+});
+
+export { expect };