stela ops usage fixes roles propagation and timoeut, one account to support multi tenants, migrations consolidation, search to support documentation, doctor and open api vector db search

docs/modules/advisory-ai/guides/api.md

@@ -202,6 +202,79 @@ Fetch cached artefact (same envelope as §6). Requires `advisory-ai:view`.
 
 When plan preview is enabled (feature flag `advisoryAi.planPreview.enabled`), this endpoint returns the orchestration plan using `AdvisoryPipelinePlanResponse` (task metadata, chunk/vector counts). Requires `advisory-ai:operate`.
 
+### 7.8 `LLM Adapter Exposure (RVM-08)`
+
+AdvisoryAI now exposes a unified adapter surface for provider discovery and OpenAI-compatible completion calls.
+
+- `GET /v1/advisory-ai/adapters/llm/providers`
+- `POST /v1/advisory-ai/adapters/llm/{providerId}/chat/completions`
+- `POST /v1/advisory-ai/adapters/openai/v1/chat/completions` (alias for `providerId=openai`)
+
+Scope requirements:
+
+- Read/discovery: `advisory:adapter:read` or `advisory:run`
+- Invoke/completion: `advisory:adapter:invoke` or `advisory:openai:invoke` or `advisory:{providerId}:invoke` or `advisory:run`
+
+Operational notes:
+
+- Adapter endpoints are disabled by default and must be explicitly enabled by config.
+- `stream=true` is currently rejected on adapter completion endpoints.
+- Provider discovery returns configuration/validation/exposure state per provider so operators can verify whether `openai` is configured before traffic cutover.
+
+Runtime config keys:
+
+- `AdvisoryAI:Adapters:Llm:Enabled` (env `ADVISORYAI__AdvisoryAI__Adapters__Llm__Enabled`)
+- `AdvisoryAI:LlmProviders:ConfigDirectory` (env `ADVISORYAI__AdvisoryAI__LlmProviders__ConfigDirectory`)
+
+Gateway exposure paths:
+
+- `/v1/advisory-ai/adapters`
+- `/api/v1/advisory-ai/adapters`
+
+### 7.9 `Knowledge Search (AKS)`
+
+Deterministic retrieval API for docs, OpenAPI operations, and Doctor checks.
+
+- `POST /v1/advisory-ai/search`
+- `POST /v1/advisory-ai/index/rebuild`
+
+Scope notes:
+- Search: one of `advisory:run`, `advisory:search`, `advisory:read`.
+- Rebuild: one of `advisory:run`, `advisory:admin`, `advisory:index:write`.
+
+Search request:
+```json
+{
+  "q": "docker login fails with x509 unknown authority",
+  "k": 10,
+  "filters": {
+    "type": ["docs", "doctor"],
+    "product": "stella-ops",
+    "version": "2026.02",
+    "service": "gateway",
+    "tags": ["troubleshooting", "tls"]
+  },
+  "includeDebug": false
+}
+```
+
+Search response contains only grounded results with source actions:
+- docs: `{ path, anchor, spanStart, spanEnd }`
+- api: `{ service, method, path, operationId }`
+- doctor: `{ checkCode, severity, canRun, runCommand }`
+
+Rebuild response:
+```json
+{
+  "documentCount": 12034,
+  "chunkCount": 68291,
+  "apiSpecCount": 41,
+  "apiOperationCount": 2132,
+  "doctorProjectionCount": 84,
+  "durationMs": 8245
+}
+```
+
 ## 8. Error model
 
 Errors follow a standard problem+JSON envelope: