CD/CD consolidation

2025-12-26 17:32:23 +02:00
parent a866eb6277
commit c786faae84
638 changed files with 3821 additions and 181 deletions
--- a/devops/compose/README.md
+++ b/devops/compose/README.md
@@ -0,0 +1,136 @@
+# Stella Ops Compose Profiles
+
+These Compose bundles ship the minimum services required to exercise the scanner pipeline plus control-plane dependencies. Every profile is pinned to immutable image digests sourced from `deploy/releases/*.yaml` and is linted via `docker compose config` in CI.
+
+## Layout
+
+| Path | Purpose |
+| ---- | ------- |
+| `docker-compose.dev.yaml` | Edge/nightly stack tuned for laptops and iterative work. |
+| `docker-compose.stage.yaml` | Stable channel stack mirroring pre-production clusters. |
+| `docker-compose.prod.yaml` | Production cutover stack with front-door network hand-off and Notify events enabled. |
+| `docker-compose.airgap.yaml` | Stable stack with air-gapped defaults (no outbound hostnames). |
+| `docker-compose.mirror.yaml` | Managed mirror topology for `*.stella-ops.org` distribution (Concelier + Excititor + CDN gateway). |
+| `docker-compose.telemetry.yaml` | Optional OpenTelemetry collector overlay (mutual TLS, OTLP ingest endpoints). |
+| `docker-compose.telemetry-storage.yaml` | Prometheus/Tempo/Loki storage overlay with multi-tenant defaults. |
+| `docker-compose.gpu.yaml` | Optional GPU overlay enabling NVIDIA devices for Advisory AI web/worker. Apply with `-f docker-compose.<env>.yaml -f docker-compose.gpu.yaml`. |
+| `env/*.env.example` | Seed `.env` files that document required secrets and ports per profile. |
+| `scripts/backup.sh` | Pauses workers and creates tar.gz of Mongo/MinIO/Redis volumes (deterministic snapshot). |
+| `scripts/reset.sh` | Stops the stack and removes Mongo/MinIO/Redis volumes after explicit confirmation. |
+| `scripts/quickstart.sh` | Helper to validate config and start dev stack; set `USE_MOCK=1` to include `docker-compose.mock.yaml` overlay. |
+| `docker-compose.mock.yaml` | Dev-only overlay with placeholder digests for missing services (orchestrator, policy-registry, packs, task-runner, VEX/Vuln stack). Use only with mock release manifest `deploy/releases/2025.09-mock-dev.yaml`. |
+
+## Usage
+
+```bash
+cp env/dev.env.example dev.env
+docker compose --env-file dev.env -f docker-compose.dev.yaml config
+docker compose --env-file dev.env -f docker-compose.dev.yaml up -d
+```
+
+The stage and airgap variants behave the same way—swap the file names accordingly. All profiles expose 443/8443 for the UI and REST APIs, and they share a `stellaops` Docker network scoped to the compose project.
+
+> **Surface.Secrets:** set `SCANNER_SURFACE_SECRETS_PROVIDER`/`SCANNER_SURFACE_SECRETS_ROOT` in your `.env` and point `SURFACE_SECRETS_HOST_PATH` to the decrypted bundle path (default `./offline/surface-secrets`). The stack mounts that path read-only into Scanner Web/Worker so `secret://` references resolve without embedding plaintext.
+
+> **Graph Explorer reminder:** If you enable Cartographer or Graph API containers alongside these profiles, update `etc/authority.yaml` so the `cartographer-service` client is marked with `properties.serviceIdentity: "cartographer"` and carries a tenant hint. The Authority host now refuses `graph:write` tokens without that marker, so apply the configuration change before rolling out the updated images.
+
+### Telemetry collector overlay
+
+The OpenTelemetry collector overlay is optional and can be layered on top of any profile:
+
+```bash
+./ops/devops/telemetry/generate_dev_tls.sh
+docker compose -f docker-compose.telemetry.yaml up -d
+python ../../ops/devops/telemetry/smoke_otel_collector.py --host localhost
+docker compose -f docker-compose.telemetry-storage.yaml up -d
+```
+
+The generator script creates a development CA plus server/client certificates under
+`deploy/telemetry/certs/`. The smoke test sends OTLP/HTTP payloads using the generated
+client certificate and asserts the collector reports accepted traces, metrics, and logs.
+The storage overlay starts Prometheus, Tempo, and Loki with multitenancy enabled so you
+can validate the end-to-end pipeline before promoting changes to staging. Adjust the
+configs in `deploy/telemetry/storage/` before running in production.
+Mount the same certificates when running workloads so the collector can enforce mutual TLS.
+
+For production cutovers copy `env/prod.env.example` to `prod.env`, update the secret placeholders, and create the external network expected by the profile:
+
+```bash
+docker network create stellaops_frontdoor
+docker compose --env-file prod.env -f docker-compose.prod.yaml config
+```
+
+### Scanner event stream settings
+
+Scanner WebService can emit signed `scanner.report.*` events to Redis Streams when `SCANNER__EVENTS__ENABLED=true`. Each profile ships environment placeholders you can override in the `.env` file:
+
+- `SCANNER_EVENTS_ENABLED` – toggle emission on/off (defaults to `false`).
+- `SCANNER_EVENTS_DRIVER` – currently only `redis` is supported.
+- `SCANNER_EVENTS_DSN` – Redis endpoint; leave blank to reuse the queue DSN when it uses `redis://`.
+- `SCANNER_EVENTS_STREAM` – stream name (`stella.events` by default).
+- `SCANNER_EVENTS_PUBLISH_TIMEOUT_SECONDS` – per-publish timeout window (defaults to `5`).
+- `SCANNER_EVENTS_MAX_STREAM_LENGTH` – max stream length before Redis trims entries (defaults to `10000`).
+
+Helm values mirror the same knobs under each service’s `env` map (see `deploy/helm/stellaops/values-*.yaml`).
+
+### Scheduler worker configuration
+
+Every Compose profile now provisions the `scheduler-worker` container (backed by the
+`StellaOps.Scheduler.Worker.Host` entrypoint). The environment placeholders exposed
+in the `.env` samples match the options bound by `AddSchedulerWorker`:
+
+- `SCHEDULER_QUEUE_KIND` – queue transport (`Nats` or `Redis`).
+- `SCHEDULER_QUEUE_NATS_URL` – NATS connection string used by planner/runner consumers.
+- `SCHEDULER_STORAGE_DATABASE` – PostgreSQL database name for scheduler state.
+- `SCHEDULER_SCANNER_BASEADDRESS` – base URL the runner uses when invoking Scanner’s
+  `/api/v1/reports` (defaults to the in-cluster `http://scanner-web:8444`).
+
+Helm deployments inherit the same defaults from `services.scheduler-worker.env` in
+`values.yaml`; override them per environment as needed.
+
+### Advisory AI configuration
+
+`advisory-ai-web` hosts the API/plan cache while `advisory-ai-worker` executes queued tasks. Both containers mount the shared volumes (`advisory-ai-queue`, `advisory-ai-plans`, `advisory-ai-outputs`) so they always read/write the same deterministic state. New environment knobs:
+
+- `ADVISORY_AI_SBOM_BASEADDRESS` – endpoint the SBOM context client hits (defaults to the in-cluster Scanner URL).
+- `ADVISORY_AI_INFERENCE_MODE` – `Local` (default) keeps inference on-prem; `Remote` posts sanitized prompts to the URL supplied via `ADVISORY_AI_REMOTE_BASEADDRESS`. Optional `ADVISORY_AI_REMOTE_APIKEY` carries the bearer token when remote inference is enabled.
+- `ADVISORY_AI_WEB_PORT` – host port for `advisory-ai-web`.
+
+The Helm chart mirrors these settings under `services.advisory-ai-web` / `advisory-ai-worker` and expects a PVC named `stellaops-advisory-ai-data` so both deployments can mount the same RWX volume.
+
+### Front-door network hand-off
+
+`docker-compose.prod.yaml` adds a `frontdoor` network so operators can attach Traefik, Envoy, or an on-prem load balancer that terminates TLS. Override `FRONTDOOR_NETWORK` in `prod.env` if your reverse proxy uses a different bridge name. Attach only the externally reachable services (Authority, Signer, Attestor, Concelier, Scanner Web, Notify Web, UI) to that network—internal infrastructure (Mongo, MinIO, RustFS, NATS) stays on the private `stellaops` network.
+
+### Updating to a new release
+
+1. Import the new manifest into `deploy/releases/` (see `deploy/README.md`).
+2. Update image digests in the relevant Compose file(s).
+3. Re-run `docker compose config` to confirm the bundle is deterministic.
+
+### Mock overlay for missing digests (dev only)
+
+Until official digests land, you can exercise Compose packaging with mock placeholders:
+
+```bash
+# assumes docker-compose.dev.yaml as the base profile
+USE_MOCK=1 ./scripts/quickstart.sh env/dev.env.example
+```
+
+The overlay pins the missing services (orchestrator, policy-registry, packs-registry, task-runner, VEX/Vuln stack) to mock digests from `deploy/releases/2025.09-mock-dev.yaml` and starts their real entrypoints so integration flows can be exercised end-to-end. Replace the mock pins with production digests once releases publish; keep the mock overlay dev-only.
+
+Keep digests synchronized between Compose, Helm, and the release manifest to preserve reproducibility guarantees. `deploy/tools/validate-profiles.sh` performs a quick audit.
+
+### GPU toggle for Advisory AI
+
+GPU is disabled by default. To run inference on NVIDIA GPUs:
+
+```bash
+docker compose \
+  --env-file prod.env \
+  -f docker-compose.prod.yaml \
+  -f docker-compose.gpu.yaml \
+  up -d
+```
+
+The GPU overlay requests one GPU for `advisory-ai-worker` and `advisory-ai-web` and sets `ADVISORY_AI_INFERENCE_GPU=true`. Ensure the host has the NVIDIA container runtime and that the base compose file still sets the correct digests.
--- a/devops/compose/docker-compose.airgap.yaml
+++ b/devops/compose/docker-compose.airgap.yaml
@@ -0,0 +1,383 @@
+x-release-labels: &release-labels
+  com.stellaops.release.version: "2025.09.2-airgap"
+  com.stellaops.release.channel: "airgap"
+  com.stellaops.profile: "airgap"
+
+networks:
+  stellaops:
+    driver: bridge
+
+volumes:
+  valkey-data:
+  rustfs-data:
+  concelier-jobs:
+  nats-data:
+  scanner-surface-cache:
+  postgres-data:
+  advisory-ai-queue:
+  advisory-ai-plans:
+  advisory-ai-outputs:
+
+services:
+  postgres:
+    image: docker.io/library/postgres:17
+    restart: unless-stopped
+    environment:
+      POSTGRES_USER: "${POSTGRES_USER:-stellaops}"
+      POSTGRES_PASSWORD: "${POSTGRES_PASSWORD:-stellaops}"
+      POSTGRES_DB: "${POSTGRES_DB:-stellaops}"
+      PGDATA: /var/lib/postgresql/data/pgdata
+    volumes:
+      - postgres-data:/var/lib/postgresql/data
+      - ./postgres-init:/docker-entrypoint-initdb.d:ro
+    command:
+      - "postgres"
+      - "-c"
+      - "shared_preload_libraries=pg_stat_statements"
+      - "-c"
+      - "pg_stat_statements.track=all"
+    ports:
+      - "${POSTGRES_PORT:-25432}:5432"
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U $$POSTGRES_USER -d $$POSTGRES_DB"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+    networks:
+      - stellaops
+    labels: *release-labels
+
+  valkey:
+    image: docker.io/valkey/valkey:8.0
+    restart: unless-stopped
+    command: ["valkey-server", "--appendonly", "yes"]
+    volumes:
+      - valkey-data:/data
+    ports:
+      - "${VALKEY_PORT:-26379}:6379"
+    networks:
+      - stellaops
+    labels: *release-labels
+
+  rustfs:
+    image: registry.stella-ops.org/stellaops/rustfs:2025.10.0-edge
+    command: ["serve", "--listen", "0.0.0.0:8080", "--root", "/data"]
+    restart: unless-stopped
+    environment:
+      RUSTFS__LOG__LEVEL: info
+      RUSTFS__STORAGE__PATH: /data
+    volumes:
+      - rustfs-data:/data
+    ports:
+      - "${RUSTFS_HTTP_PORT:-8080}:8080"
+    networks:
+      - stellaops
+    labels: *release-labels
+
+  nats:
+    image: docker.io/library/nats@sha256:c82559e4476289481a8a5196e675ebfe67eea81d95e5161e3e78eccfe766608e
+    command:
+      - "-js"
+      - "-sd"
+      - /data
+    restart: unless-stopped
+    ports:
+      - "${NATS_CLIENT_PORT:-24222}:4222"
+    volumes:
+      - nats-data:/data
+    networks:
+      - stellaops
+    labels: *release-labels
+
+  authority:
+    image: registry.stella-ops.org/stellaops/authority@sha256:5551a3269b7008cd5aceecf45df018c67459ed519557ccbe48b093b926a39bcc
+    restart: unless-stopped
+    depends_on:
+      - postgres
+      - valkey
+    environment:
+      STELLAOPS_AUTHORITY__ISSUER: "${AUTHORITY_ISSUER}"
+      STELLAOPS_AUTHORITY__STORAGE__DRIVER: "postgres"
+      STELLAOPS_AUTHORITY__STORAGE__POSTGRES__CONNECTIONSTRING: "Host=postgres;Port=5432;Database=${POSTGRES_DB:-stellaops_platform};Username=${POSTGRES_USER:-stellaops};Password=${POSTGRES_PASSWORD:-stellaops}"
+      STELLAOPS_AUTHORITY__CACHE__REDIS__CONNECTIONSTRING: "valkey:6379"
+      STELLAOPS_AUTHORITY__PLUGINDIRECTORIES__0: "/app/plugins"
+      STELLAOPS_AUTHORITY__PLUGINS__CONFIGURATIONDIRECTORY: "/app/etc/authority.plugins"
+    volumes:
+      - ../../etc/authority.yaml:/etc/authority.yaml:ro
+      - ../../etc/authority.plugins:/app/etc/authority.plugins:ro
+    ports:
+      - "${AUTHORITY_PORT:-8440}:8440"
+    networks:
+      - stellaops
+    labels: *release-labels
+
+  signer:
+    image: registry.stella-ops.org/stellaops/signer@sha256:ddbbd664a42846cea6b40fca6465bc679b30f72851158f300d01a8571c5478fc
+    restart: unless-stopped
+    depends_on:
+      - postgres
+      - authority
+    environment:
+      SIGNER__AUTHORITY__BASEURL: "https://authority:8440"
+      SIGNER__POE__INTROSPECTURL: "${SIGNER_POE_INTROSPECT_URL}"
+      SIGNER__STORAGE__DRIVER: "postgres"
+      SIGNER__STORAGE__POSTGRES__CONNECTIONSTRING: "Host=postgres;Port=5432;Database=${POSTGRES_DB:-stellaops_platform};Username=${POSTGRES_USER:-stellaops};Password=${POSTGRES_PASSWORD:-stellaops}"
+    ports:
+      - "${SIGNER_PORT:-8441}:8441"
+    networks:
+      - stellaops
+    labels: *release-labels
+
+  attestor:
+    image: registry.stella-ops.org/stellaops/attestor@sha256:1ff0a3124d66d3a2702d8e421df40fbd98cc75cb605d95510598ebbae1433c50
+    restart: unless-stopped
+    depends_on:
+      - signer
+      - postgres
+    environment:
+      ATTESTOR__SIGNER__BASEURL: "https://signer:8441"
+      ATTESTOR__STORAGE__DRIVER: "postgres"
+      ATTESTOR__STORAGE__POSTGRES__CONNECTIONSTRING: "Host=postgres;Port=5432;Database=${POSTGRES_DB:-stellaops_platform};Username=${POSTGRES_USER:-stellaops};Password=${POSTGRES_PASSWORD:-stellaops}"
+    ports:
+      - "${ATTESTOR_PORT:-8442}:8442"
+    networks:
+      - stellaops
+    labels: *release-labels
+
+  issuer-directory:
+    image: registry.stella-ops.org/stellaops/issuer-directory-web:2025.10.0-edge
+    restart: unless-stopped
+    depends_on:
+      - postgres
+      - authority
+    environment:
+      ISSUERDIRECTORY__CONFIG: "/etc/issuer-directory.yaml"
+      ISSUERDIRECTORY__AUTHORITY__ISSUER: "${AUTHORITY_ISSUER}"
+      ISSUERDIRECTORY__AUTHORITY__BASEURL: "https://authority:8440"
+      ISSUERDIRECTORY__STORAGE__DRIVER: "postgres"
+      ISSUERDIRECTORY__STORAGE__POSTGRES__CONNECTIONSTRING: "Host=postgres;Port=5432;Database=${POSTGRES_DB:-stellaops_platform};Username=${POSTGRES_USER:-stellaops};Password=${POSTGRES_PASSWORD:-stellaops}"
+      ISSUERDIRECTORY__SEEDCSAFPUBLISHERS: "${ISSUER_DIRECTORY_SEED_CSAF:-true}"
+    volumes:
+      - ../../etc/issuer-directory.yaml:/etc/issuer-directory.yaml:ro
+    ports:
+      - "${ISSUER_DIRECTORY_PORT:-8447}:8080"
+    networks:
+      - stellaops
+    labels: *release-labels
+
+  concelier:
+    image: registry.stella-ops.org/stellaops/concelier@sha256:29e2e1a0972707e092cbd3d370701341f9fec2aa9316fb5d8100480f2a1c76b5
+    restart: unless-stopped
+    depends_on:
+      - postgres
+      - valkey
+    environment:
+      CONCELIER__STORAGE__DRIVER: "postgres"
+      CONCELIER__STORAGE__POSTGRES__CONNECTIONSTRING: "Host=postgres;Port=5432;Database=${POSTGRES_DB:-stellaops_platform};Username=${POSTGRES_USER:-stellaops};Password=${POSTGRES_PASSWORD:-stellaops}"
+      CONCELIER__STORAGE__S3__ENDPOINT: "http://rustfs:8080"
+      CONCELIER__AUTHORITY__BASEURL: "https://authority:8440"
+      CONCELIER__AUTHORITY__RESILIENCE__ALLOWOFFLINECACHEFALLBACK: "true"
+      CONCELIER__AUTHORITY__RESILIENCE__OFFLINECACHETOLERANCE: "${AUTHORITY_OFFLINE_CACHE_TOLERANCE:-00:30:00}"
+    volumes:
+      - concelier-jobs:/var/lib/concelier/jobs
+    ports:
+      - "${CONCELIER_PORT:-8445}:8445"
+    networks:
+      - stellaops
+    labels: *release-labels
+
+  scanner-web:
+    image: registry.stella-ops.org/stellaops/scanner-web@sha256:3df8ca21878126758203c1a0444e39fd97f77ddacf04a69685cda9f1e5e94718
+    restart: unless-stopped
+    depends_on:
+      - postgres
+      - valkey
+      - concelier
+      - rustfs
+    environment:
+      SCANNER__STORAGE__DRIVER: "postgres"
+      SCANNER__STORAGE__POSTGRES__CONNECTIONSTRING: "Host=postgres;Port=5432;Database=${POSTGRES_DB:-stellaops_platform};Username=${POSTGRES_USER:-stellaops};Password=${POSTGRES_PASSWORD:-stellaops}"
+      SCANNER__CACHE__REDIS__CONNECTIONSTRING: "valkey:6379"
+      SCANNER__ARTIFACTSTORE__DRIVER: "rustfs"
+      SCANNER__ARTIFACTSTORE__ENDPOINT: "http://rustfs:8080/api/v1"
+      SCANNER__ARTIFACTSTORE__BUCKET: "scanner-artifacts"
+      SCANNER__ARTIFACTSTORE__TIMEOUTSECONDS: "30"
+      SCANNER__QUEUE__BROKER: "${SCANNER_QUEUE_BROKER:-valkey://valkey:6379}"
+      SCANNER__EVENTS__ENABLED: "${SCANNER_EVENTS_ENABLED:-false}"
+      SCANNER__EVENTS__DRIVER: "${SCANNER_EVENTS_DRIVER:-valkey}"
+      SCANNER__EVENTS__DSN: "${SCANNER_EVENTS_DSN:-}"
+      SCANNER__EVENTS__STREAM: "${SCANNER_EVENTS_STREAM:-stella.events}"
+      SCANNER__EVENTS__PUBLISHTIMEOUTSECONDS: "${SCANNER_EVENTS_PUBLISH_TIMEOUT_SECONDS:-5}"
+      SCANNER__EVENTS__MAXSTREAMLENGTH: "${SCANNER_EVENTS_MAX_STREAM_LENGTH:-10000}"
+      SCANNER__OFFLINEKIT__ENABLED: "${SCANNER_OFFLINEKIT_ENABLED:-false}"
+      SCANNER__OFFLINEKIT__REQUIREDSSE: "${SCANNER_OFFLINEKIT_REQUIREDSSE:-true}"
+      SCANNER__OFFLINEKIT__REKOROFFLINEMODE: "${SCANNER_OFFLINEKIT_REKOROFFLINEMODE:-true}"
+      SCANNER__OFFLINEKIT__TRUSTROOTDIRECTORY: "${SCANNER_OFFLINEKIT_TRUSTROOTDIRECTORY:-/etc/stellaops/trust-roots}"
+      SCANNER__OFFLINEKIT__REKORSNAPSHOTDIRECTORY: "${SCANNER_OFFLINEKIT_REKORSNAPSHOTDIRECTORY:-/var/lib/stellaops/rekor-snapshot}"
+      # Surface.Env configuration (see docs/modules/scanner/design/surface-env.md)
+      SCANNER_SURFACE_FS_ENDPOINT: "${SCANNER_SURFACE_FS_ENDPOINT:-http://rustfs:8080}"
+      SCANNER_SURFACE_FS_BUCKET: "${SCANNER_SURFACE_FS_BUCKET:-surface-cache}"
+      SCANNER_SURFACE_CACHE_ROOT: "${SCANNER_SURFACE_CACHE_ROOT:-/var/lib/stellaops/surface}"
+      SCANNER_SURFACE_CACHE_QUOTA_MB: "${SCANNER_SURFACE_CACHE_QUOTA_MB:-4096}"
+      SCANNER_SURFACE_PREFETCH_ENABLED: "${SCANNER_SURFACE_PREFETCH_ENABLED:-false}"
+      SCANNER_SURFACE_TENANT: "${SCANNER_SURFACE_TENANT:-default}"
+      SCANNER_SURFACE_FEATURES: "${SCANNER_SURFACE_FEATURES:-}"
+      SCANNER_SURFACE_SECRETS_PROVIDER: "${SCANNER_SURFACE_SECRETS_PROVIDER:-file}"
+      SCANNER_SURFACE_SECRETS_NAMESPACE: "${SCANNER_SURFACE_SECRETS_NAMESPACE:-}"
+      SCANNER_SURFACE_SECRETS_ROOT: "${SCANNER_SURFACE_SECRETS_ROOT:-/etc/stellaops/secrets}"
+      SCANNER_SURFACE_SECRETS_FALLBACK_PROVIDER: "${SCANNER_SURFACE_SECRETS_FALLBACK_PROVIDER:-}"
+      SCANNER_SURFACE_SECRETS_ALLOW_INLINE: "${SCANNER_SURFACE_SECRETS_ALLOW_INLINE:-false}"
+    volumes:
+      - scanner-surface-cache:/var/lib/stellaops/surface
+      - ${SURFACE_SECRETS_HOST_PATH:-./offline/surface-secrets}:${SCANNER_SURFACE_SECRETS_ROOT:-/etc/stellaops/secrets}:ro
+      - ${SCANNER_OFFLINEKIT_TRUSTROOTS_HOST_PATH:-./offline/trust-roots}:${SCANNER_OFFLINEKIT_TRUSTROOTDIRECTORY:-/etc/stellaops/trust-roots}:ro
+      - ${SCANNER_OFFLINEKIT_REKOR_SNAPSHOT_HOST_PATH:-./offline/rekor-snapshot}:${SCANNER_OFFLINEKIT_REKORSNAPSHOTDIRECTORY:-/var/lib/stellaops/rekor-snapshot}:ro
+    ports:
+      - "${SCANNER_WEB_PORT:-8444}:8444"
+    networks:
+      - stellaops
+    labels: *release-labels
+
+  scanner-worker:
+    image: registry.stella-ops.org/stellaops/scanner-worker@sha256:eea5d6cfe7835950c5ec7a735a651f2f0d727d3e470cf9027a4a402ea89c4fb5
+    restart: unless-stopped
+    depends_on:
+      - postgres
+      - valkey
+      - scanner-web
+      - rustfs
+    environment:
+      SCANNER__STORAGE__DRIVER: "postgres"
+      SCANNER__STORAGE__POSTGRES__CONNECTIONSTRING: "Host=postgres;Port=5432;Database=${POSTGRES_DB:-stellaops_platform};Username=${POSTGRES_USER:-stellaops};Password=${POSTGRES_PASSWORD:-stellaops}"
+      SCANNER__CACHE__REDIS__CONNECTIONSTRING: "valkey:6379"
+      SCANNER__ARTIFACTSTORE__DRIVER: "rustfs"
+      SCANNER__ARTIFACTSTORE__ENDPOINT: "http://rustfs:8080/api/v1"
+      SCANNER__ARTIFACTSTORE__BUCKET: "scanner-artifacts"
+      SCANNER__ARTIFACTSTORE__TIMEOUTSECONDS: "30"
+      SCANNER__QUEUE__BROKER: "${SCANNER_QUEUE_BROKER:-valkey://valkey:6379}"
+      # Surface.Env configuration (see docs/modules/scanner/design/surface-env.md)
+      SCANNER_SURFACE_FS_ENDPOINT: "${SCANNER_SURFACE_FS_ENDPOINT:-http://rustfs:8080}"
+      SCANNER_SURFACE_FS_BUCKET: "${SCANNER_SURFACE_FS_BUCKET:-surface-cache}"
+      SCANNER_SURFACE_CACHE_ROOT: "${SCANNER_SURFACE_CACHE_ROOT:-/var/lib/stellaops/surface}"
+      SCANNER_SURFACE_CACHE_QUOTA_MB: "${SCANNER_SURFACE_CACHE_QUOTA_MB:-4096}"
+      SCANNER_SURFACE_PREFETCH_ENABLED: "${SCANNER_SURFACE_PREFETCH_ENABLED:-false}"
+      SCANNER_SURFACE_TENANT: "${SCANNER_SURFACE_TENANT:-default}"
+      SCANNER_SURFACE_FEATURES: "${SCANNER_SURFACE_FEATURES:-}"
+      SCANNER_SURFACE_SECRETS_PROVIDER: "${SCANNER_SURFACE_SECRETS_PROVIDER:-file}"
+      SCANNER_SURFACE_SECRETS_NAMESPACE: "${SCANNER_SURFACE_SECRETS_NAMESPACE:-}"
+      SCANNER_SURFACE_SECRETS_ROOT: "${SCANNER_SURFACE_SECRETS_ROOT:-/etc/stellaops/secrets}"
+      SCANNER_SURFACE_SECRETS_FALLBACK_PROVIDER: "${SCANNER_SURFACE_SECRETS_FALLBACK_PROVIDER:-}"
+      SCANNER_SURFACE_SECRETS_ALLOW_INLINE: "${SCANNER_SURFACE_SECRETS_ALLOW_INLINE:-false}"
+    volumes:
+      - scanner-surface-cache:/var/lib/stellaops/surface
+      - ${SURFACE_SECRETS_HOST_PATH:-./offline/surface-secrets}:${SCANNER_SURFACE_SECRETS_ROOT:-/etc/stellaops/secrets}:ro
+    networks:
+      - stellaops
+    labels: *release-labels
+
+  scheduler-worker:
+    image: registry.stella-ops.org/stellaops/scheduler-worker:2025.10.0-edge
+    restart: unless-stopped
+    depends_on:
+      - postgres
+      - valkey
+      - scanner-web
+    command:
+      - "dotnet"
+      - "StellaOps.Scheduler.Worker.Host.dll"
+    environment:
+      SCHEDULER__STORAGE__DRIVER: "postgres"
+      SCHEDULER__STORAGE__POSTGRES__CONNECTIONSTRING: "Host=postgres;Port=5432;Database=${POSTGRES_DB:-stellaops_platform};Username=${POSTGRES_USER:-stellaops};Password=${POSTGRES_PASSWORD:-stellaops}"
+      SCHEDULER__QUEUE__KIND: "${SCHEDULER_QUEUE_KIND:-Valkey}"
+      SCHEDULER__QUEUE__VALKEY__URL: "${SCHEDULER_QUEUE_VALKEY_URL:-valkey:6379}"
+      SCHEDULER__WORKER__RUNNER__SCANNER__BASEADDRESS: "${SCHEDULER_SCANNER_BASEADDRESS:-http://scanner-web:8444}"
+    networks:
+      - stellaops
+    labels: *release-labels
+
+  notify-web:
+    image: ${NOTIFY_WEB_IMAGE:-registry.stella-ops.org/stellaops/notify-web:2025.09.2}
+    restart: unless-stopped
+    depends_on:
+      - postgres
+      - authority
+    environment:
+      DOTNET_ENVIRONMENT: Production
+    volumes:
+      - ../../etc/notify.airgap.yaml:/app/etc/notify.yaml:ro
+    ports:
+      - "${NOTIFY_WEB_PORT:-9446}:8446"
+    networks:
+      - stellaops
+    labels: *release-labels
+
+  excititor:
+    image: registry.stella-ops.org/stellaops/excititor@sha256:65c0ee13f773efe920d7181512349a09d363ab3f3e177d276136bd2742325a68
+    restart: unless-stopped
+    depends_on:
+      - postgres
+      - concelier
+    environment:
+      EXCITITOR__CONCELIER__BASEURL: "https://concelier:8445"
+      EXCITITOR__STORAGE__DRIVER: "postgres"
+      EXCITITOR__STORAGE__POSTGRES__CONNECTIONSTRING: "Host=postgres;Port=5432;Database=${POSTGRES_DB:-stellaops_platform};Username=${POSTGRES_USER:-stellaops};Password=${POSTGRES_PASSWORD:-stellaops}"
+    networks:
+      - stellaops
+    labels: *release-labels
+
+  advisory-ai-web:
+    image: registry.stella-ops.org/stellaops/advisory-ai-web:2025.09.2-airgap
+    restart: unless-stopped
+    depends_on:
+      - scanner-web
+    environment:
+      ADVISORYAI__AdvisoryAI__SbomBaseAddress: "${ADVISORY_AI_SBOM_BASEADDRESS:-http://scanner-web:8444}"
+      ADVISORYAI__AdvisoryAI__Queue__DirectoryPath: "/var/lib/advisory-ai/queue"
+      ADVISORYAI__AdvisoryAI__Storage__PlanCacheDirectory: "/var/lib/advisory-ai/plans"
+      ADVISORYAI__AdvisoryAI__Storage__OutputDirectory: "/var/lib/advisory-ai/outputs"
+      ADVISORYAI__AdvisoryAI__Inference__Mode: "${ADVISORY_AI_INFERENCE_MODE:-Local}"
+      ADVISORYAI__AdvisoryAI__Inference__Remote__BaseAddress: "${ADVISORY_AI_REMOTE_BASEADDRESS:-}"
+      ADVISORYAI__AdvisoryAI__Inference__Remote__ApiKey: "${ADVISORY_AI_REMOTE_APIKEY:-}"
+    ports:
+      - "${ADVISORY_AI_WEB_PORT:-8448}:8448"
+    volumes:
+      - advisory-ai-queue:/var/lib/advisory-ai/queue
+      - advisory-ai-plans:/var/lib/advisory-ai/plans
+      - advisory-ai-outputs:/var/lib/advisory-ai/outputs
+    networks:
+      - stellaops
+    labels: *release-labels
+
+  advisory-ai-worker:
+    image: registry.stella-ops.org/stellaops/advisory-ai-worker:2025.09.2-airgap
+    restart: unless-stopped
+    depends_on:
+      - advisory-ai-web
+    environment:
+      ADVISORYAI__AdvisoryAI__SbomBaseAddress: "${ADVISORY_AI_SBOM_BASEADDRESS:-http://scanner-web:8444}"
+      ADVISORYAI__AdvisoryAI__Queue__DirectoryPath: "/var/lib/advisory-ai/queue"
+      ADVISORYAI__AdvisoryAI__Storage__PlanCacheDirectory: "/var/lib/advisory-ai/plans"
+      ADVISORYAI__AdvisoryAI__Storage__OutputDirectory: "/var/lib/advisory-ai/outputs"
+      ADVISORYAI__AdvisoryAI__Inference__Mode: "${ADVISORY_AI_INFERENCE_MODE:-Local}"
+      ADVISORYAI__AdvisoryAI__Inference__Remote__BaseAddress: "${ADVISORY_AI_REMOTE_BASEADDRESS:-}"
+      ADVISORYAI__AdvisoryAI__Inference__Remote__ApiKey: "${ADVISORY_AI_REMOTE_APIKEY:-}"
+    volumes:
+      - advisory-ai-queue:/var/lib/advisory-ai/queue
+      - advisory-ai-plans:/var/lib/advisory-ai/plans
+      - advisory-ai-outputs:/var/lib/advisory-ai/outputs
+    networks:
+      - stellaops
+    labels: *release-labels
+
+  web-ui:
+    image: registry.stella-ops.org/stellaops/web-ui@sha256:bee9668011ff414572131dc777faab4da24473fe12c230893f161cabee092a1d
+    restart: unless-stopped
+    depends_on:
+      - scanner-web
+    environment:
+      STELLAOPS_UI__BACKEND__BASEURL: "https://scanner-web:8444"
+    ports:
+      - "${UI_PORT:-9443}:8443"
+    networks:
+      - stellaops
+    labels: *release-labels
--- a/devops/compose/docker-compose.cas.yaml
+++ b/devops/compose/docker-compose.cas.yaml
@@ -0,0 +1,191 @@
+# Content Addressable Storage (CAS) Infrastructure
+# Uses RustFS for S3-compatible immutable object storage
+# Aligned with best-in-class vulnerability scanner retention policies
+#
+# Usage:
+#   docker compose -f docker-compose.cas.yaml up -d
+#   docker compose -f docker-compose.cas.yaml -f docker-compose.dev.yaml up -d
+
+x-release-labels: &release-labels
+  com.stellaops.release.version: "2025.10.0-edge"
+  com.stellaops.release.channel: "edge"
+  com.stellaops.profile: "cas"
+
+x-cas-config: &cas-config
+  # Retention policies (aligned with Trivy/Grype/Anchore Enterprise)
+  # - vulnerability-db: 7 days (matches Trivy default)
+  # - sbom-artifacts: 365 days (audit compliance)
+  # - scan-results: 90 days (SOC2/ISO27001 typical)
+  # - evidence-bundles: indefinite (immutable, content-addressed)
+  # - attestations: indefinite (in-toto/DSSE signed)
+  CAS__RETENTION__VULNERABILITY_DB_DAYS: "7"
+  CAS__RETENTION__SBOM_ARTIFACTS_DAYS: "365"
+  CAS__RETENTION__SCAN_RESULTS_DAYS: "90"
+  CAS__RETENTION__EVIDENCE_BUNDLES_DAYS: "0"      # 0 = indefinite
+  CAS__RETENTION__ATTESTATIONS_DAYS: "0"          # 0 = indefinite
+  CAS__RETENTION__TEMP_ARTIFACTS_DAYS: "1"
+
+networks:
+  cas:
+    driver: bridge
+
+volumes:
+  rustfs-cas-data:
+    driver: local
+    driver_opts:
+      type: none
+      o: bind
+      device: ${CAS_DATA_PATH:-/var/lib/stellaops/cas}
+  rustfs-evidence-data:
+    driver: local
+    driver_opts:
+      type: none
+      o: bind
+      device: ${CAS_EVIDENCE_PATH:-/var/lib/stellaops/evidence}
+  rustfs-attestation-data:
+    driver: local
+    driver_opts:
+      type: none
+      o: bind
+      device: ${CAS_ATTESTATION_PATH:-/var/lib/stellaops/attestations}
+
+services:
+  # Primary CAS storage - runtime facts, signals, replay artifacts
+  rustfs-cas:
+    image: registry.stella-ops.org/stellaops/rustfs:2025.10.0-edge
+    command: ["serve", "--listen", "0.0.0.0:8080", "--root", "/data"]
+    restart: unless-stopped
+    environment:
+      RUSTFS__LOG__LEVEL: "${RUSTFS_LOG_LEVEL:-info}"
+      RUSTFS__STORAGE__PATH: /data
+      RUSTFS__STORAGE__DEDUP: "true"
+      RUSTFS__STORAGE__COMPRESSION: "${RUSTFS_COMPRESSION:-zstd}"
+      RUSTFS__STORAGE__COMPRESSION_LEVEL: "${RUSTFS_COMPRESSION_LEVEL:-3}"
+      # Bucket lifecycle (retention enforcement)
+      RUSTFS__LIFECYCLE__ENABLED: "true"
+      RUSTFS__LIFECYCLE__SCAN_INTERVAL_HOURS: "24"
+      RUSTFS__LIFECYCLE__DEFAULT_RETENTION_DAYS: "90"
+      # Access control
+      RUSTFS__AUTH__ENABLED: "${RUSTFS_AUTH_ENABLED:-true}"
+      RUSTFS__AUTH__API_KEY: "${RUSTFS_CAS_API_KEY:-cas-api-key-change-me}"
+      RUSTFS__AUTH__READONLY_KEY: "${RUSTFS_CAS_READONLY_KEY:-cas-readonly-key-change-me}"
+      # Service account configuration
+      RUSTFS__ACCOUNTS__SCANNER__KEY: "${RUSTFS_SCANNER_KEY:-scanner-svc-key}"
+      RUSTFS__ACCOUNTS__SCANNER__BUCKETS: "scanner-artifacts,surface-cache,runtime-facts"
+      RUSTFS__ACCOUNTS__SCANNER__PERMISSIONS: "read,write"
+      RUSTFS__ACCOUNTS__SIGNALS__KEY: "${RUSTFS_SIGNALS_KEY:-signals-svc-key}"
+      RUSTFS__ACCOUNTS__SIGNALS__BUCKETS: "runtime-facts,signals-data,provenance-feed"
+      RUSTFS__ACCOUNTS__SIGNALS__PERMISSIONS: "read,write"
+      RUSTFS__ACCOUNTS__REPLAY__KEY: "${RUSTFS_REPLAY_KEY:-replay-svc-key}"
+      RUSTFS__ACCOUNTS__REPLAY__BUCKETS: "replay-bundles,inputs-lock"
+      RUSTFS__ACCOUNTS__REPLAY__PERMISSIONS: "read,write"
+      RUSTFS__ACCOUNTS__READONLY__KEY: "${RUSTFS_READONLY_KEY:-readonly-svc-key}"
+      RUSTFS__ACCOUNTS__READONLY__BUCKETS: "*"
+      RUSTFS__ACCOUNTS__READONLY__PERMISSIONS: "read"
+      <<: *cas-config
+    volumes:
+      - rustfs-cas-data:/data
+    ports:
+      - "${RUSTFS_CAS_PORT:-8180}:8080"
+    networks:
+      - cas
+    labels: *release-labels
+    healthcheck:
+      test: ["CMD", "curl", "-f", "http://localhost:8080/health"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 10s
+
+  # Evidence storage - Merkle roots, hash chains, evidence bundles (immutable)
+  rustfs-evidence:
+    image: registry.stella-ops.org/stellaops/rustfs:2025.10.0-edge
+    command: ["serve", "--listen", "0.0.0.0:8080", "--root", "/data", "--immutable"]
+    restart: unless-stopped
+    environment:
+      RUSTFS__LOG__LEVEL: "${RUSTFS_LOG_LEVEL:-info}"
+      RUSTFS__STORAGE__PATH: /data
+      RUSTFS__STORAGE__DEDUP: "true"
+      RUSTFS__STORAGE__COMPRESSION: "${RUSTFS_COMPRESSION:-zstd}"
+      RUSTFS__STORAGE__IMMUTABLE: "true"  # Write-once, never delete
+      # Access control
+      RUSTFS__AUTH__ENABLED: "true"
+      RUSTFS__AUTH__API_KEY: "${RUSTFS_EVIDENCE_API_KEY:-evidence-api-key-change-me}"
+      RUSTFS__AUTH__READONLY_KEY: "${RUSTFS_EVIDENCE_READONLY_KEY:-evidence-readonly-key-change-me}"
+      # Service accounts
+      RUSTFS__ACCOUNTS__LEDGER__KEY: "${RUSTFS_LEDGER_KEY:-ledger-svc-key}"
+      RUSTFS__ACCOUNTS__LEDGER__BUCKETS: "evidence-bundles,merkle-roots,hash-chains"
+      RUSTFS__ACCOUNTS__LEDGER__PERMISSIONS: "read,write"
+      RUSTFS__ACCOUNTS__EXPORTER__KEY: "${RUSTFS_EXPORTER_KEY:-exporter-svc-key}"
+      RUSTFS__ACCOUNTS__EXPORTER__BUCKETS: "evidence-bundles"
+      RUSTFS__ACCOUNTS__EXPORTER__PERMISSIONS: "read"
+    volumes:
+      - rustfs-evidence-data:/data
+    ports:
+      - "${RUSTFS_EVIDENCE_PORT:-8181}:8080"
+    networks:
+      - cas
+    labels: *release-labels
+    healthcheck:
+      test: ["CMD", "curl", "-f", "http://localhost:8080/health"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 10s
+
+  # Attestation storage - DSSE envelopes, in-toto attestations (immutable)
+  rustfs-attestation:
+    image: registry.stella-ops.org/stellaops/rustfs:2025.10.0-edge
+    command: ["serve", "--listen", "0.0.0.0:8080", "--root", "/data", "--immutable"]
+    restart: unless-stopped
+    environment:
+      RUSTFS__LOG__LEVEL: "${RUSTFS_LOG_LEVEL:-info}"
+      RUSTFS__STORAGE__PATH: /data
+      RUSTFS__STORAGE__DEDUP: "true"
+      RUSTFS__STORAGE__COMPRESSION: "${RUSTFS_COMPRESSION:-zstd}"
+      RUSTFS__STORAGE__IMMUTABLE: "true"  # Write-once, never delete
+      # Access control
+      RUSTFS__AUTH__ENABLED: "true"
+      RUSTFS__AUTH__API_KEY: "${RUSTFS_ATTESTATION_API_KEY:-attestation-api-key-change-me}"
+      RUSTFS__AUTH__READONLY_KEY: "${RUSTFS_ATTESTATION_READONLY_KEY:-attestation-readonly-key-change-me}"
+      # Service accounts
+      RUSTFS__ACCOUNTS__ATTESTOR__KEY: "${RUSTFS_ATTESTOR_KEY:-attestor-svc-key}"
+      RUSTFS__ACCOUNTS__ATTESTOR__BUCKETS: "attestations,dsse-envelopes,rekor-receipts"
+      RUSTFS__ACCOUNTS__ATTESTOR__PERMISSIONS: "read,write"
+      RUSTFS__ACCOUNTS__VERIFIER__KEY: "${RUSTFS_VERIFIER_KEY:-verifier-svc-key}"
+      RUSTFS__ACCOUNTS__VERIFIER__BUCKETS: "attestations,dsse-envelopes,rekor-receipts"
+      RUSTFS__ACCOUNTS__VERIFIER__PERMISSIONS: "read"
+    volumes:
+      - rustfs-attestation-data:/data
+    ports:
+      - "${RUSTFS_ATTESTATION_PORT:-8182}:8080"
+    networks:
+      - cas
+    labels: *release-labels
+    healthcheck:
+      test: ["CMD", "curl", "-f", "http://localhost:8080/health"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 10s
+
+  # Lifecycle manager - enforces retention policies
+  cas-lifecycle:
+    image: registry.stella-ops.org/stellaops/cas-lifecycle:2025.10.0-edge
+    restart: unless-stopped
+    depends_on:
+      rustfs-cas:
+        condition: service_healthy
+    environment:
+      LIFECYCLE__CAS__ENDPOINT: "http://rustfs-cas:8080"
+      LIFECYCLE__CAS__API_KEY: "${RUSTFS_CAS_API_KEY:-cas-api-key-change-me}"
+      LIFECYCLE__SCHEDULE__CRON: "${LIFECYCLE_CRON:-0 3 * * *}"  # 3 AM daily
+      LIFECYCLE__POLICIES__VULNERABILITY_DB: "7d"
+      LIFECYCLE__POLICIES__SBOM_ARTIFACTS: "365d"
+      LIFECYCLE__POLICIES__SCAN_RESULTS: "90d"
+      LIFECYCLE__POLICIES__TEMP_ARTIFACTS: "1d"
+      LIFECYCLE__TELEMETRY__ENABLED: "${LIFECYCLE_TELEMETRY:-true}"
+      LIFECYCLE__TELEMETRY__OTLP_ENDPOINT: "${OTLP_ENDPOINT:-}"
+    networks:
+      - cas
+    labels: *release-labels
--- a/devops/compose/docker-compose.china.yml
+++ b/devops/compose/docker-compose.china.yml
@@ -0,0 +1,301 @@
+# StellaOps Docker Compose - International Profile
+# Cryptography: SM2, SM3, SM4 (ShangMi / Commercial Cipher - temporarily using NIST)
+# Provider: offline-verification
+# Jurisdiction: china, world
+
+x-release-labels: &release-labels
+  com.stellaops.release.version: "2025.10.0-edge"
+  com.stellaops.release.channel: "edge"
+  com.stellaops.profile: "china"
+  com.stellaops.crypto.profile: "china"
+  com.stellaops.crypto.provider: "offline-verification"
+
+x-crypto-env: &crypto-env
+  # Crypto configuration
+  STELLAOPS_CRYPTO_PROFILE: "china"
+  STELLAOPS_CRYPTO_CONFIG_PATH: "/app/etc/appsettings.crypto.yaml"
+  STELLAOPS_CRYPTO_MANIFEST_PATH: "/app/etc/crypto-plugins-manifest.json"
+
+networks:
+  stellaops:
+    driver: bridge
+
+volumes:
+  rustfs-data:
+  concelier-jobs:
+  nats-data:
+  valkey-data:
+  advisory-ai-queue:
+  advisory-ai-plans:
+  advisory-ai-outputs:
+  postgres-data:
+
+services:
+  postgres:
+    image: docker.io/library/postgres:16
+    restart: unless-stopped
+    environment:
+      POSTGRES_USER: "${POSTGRES_USER:-stellaops}"
+      POSTGRES_PASSWORD: "${POSTGRES_PASSWORD:-stellaops}"
+      POSTGRES_DB: "${POSTGRES_DB:-stellaops_platform}"
+      PGDATA: /var/lib/postgresql/data/pgdata
+    volumes:
+      - postgres-data:/var/lib/postgresql/data
+      - ../postgres-partitioning:/docker-entrypoint-initdb.d:ro
+    ports:
+      - "${POSTGRES_PORT:-5432}:5432"
+    networks:
+      - stellaops
+    labels: *release-labels
+
+  valkey:
+    image: docker.io/valkey/valkey:8.0
+    restart: unless-stopped
+    command: ["valkey-server", "--appendonly", "yes"]
+    volumes:
+      - valkey-data:/data
+    ports:
+      - "${VALKEY_PORT:-6379}:6379"
+    networks:
+      - stellaops
+    labels: *release-labels
+
+  rustfs:
+    image: registry.stella-ops.org/stellaops/rustfs:2025.10.0-edge
+    command: ["serve", "--listen", "0.0.0.0:8080", "--root", "/data"]
+    restart: unless-stopped
+    environment:
+      RUSTFS__LOG__LEVEL: info
+      RUSTFS__STORAGE__PATH: /data
+    volumes:
+      - rustfs-data:/data
+    ports:
+      - "${RUSTFS_HTTP_PORT:-8080}:8080"
+    networks:
+      - stellaops
+    labels: *release-labels
+
+  nats:
+    image: docker.io/library/nats@sha256:c82559e4476289481a8a5196e675ebfe67eea81d95e5161e3e78eccfe766608e
+    command:
+      - "-js"
+      - "-sd"
+      - /data
+    restart: unless-stopped
+    ports:
+      - "${NATS_CLIENT_PORT:-4222}:4222"
+    volumes:
+      - nats-data:/data
+    networks:
+      - stellaops
+    labels: *release-labels
+
+  authority:
+    image: registry.stella-ops.org/stellaops/authority:china
+    restart: unless-stopped
+    depends_on:
+      - postgres
+    environment:
+      <<: *crypto-env
+      STELLAOPS_AUTHORITY__ISSUER: "${AUTHORITY_ISSUER}"
+      STELLAOPS_AUTHORITY__STORAGE__DRIVER: "postgres"
+      STELLAOPS_AUTHORITY__STORAGE__POSTGRES__CONNECTIONSTRING: "Host=postgres;Port=5432;Database=${POSTGRES_DB:-stellaops_platform};Username=${POSTGRES_USER:-stellaops};Password=${POSTGRES_PASSWORD:-stellaops}"
+      STELLAOPS_AUTHORITY__PLUGINDIRECTORIES__0: "/app/plugins"
+      STELLAOPS_AUTHORITY__PLUGINS__CONFIGURATIONDIRECTORY: "/app/etc/authority.plugins"
+    volumes:
+      - ../../etc/authority.yaml:/etc/authority.yaml:ro
+      - ../../etc/authority.plugins:/app/etc/authority.plugins:ro
+      - ../../etc/appsettings.crypto.china.yaml:/app/etc/appsettings.crypto.yaml:ro
+      - ../../etc/crypto-plugins-manifest.json:/app/etc/crypto-plugins-manifest.json:ro
+    ports:
+      - "${AUTHORITY_PORT:-8440}:8440"
+    networks:
+      - stellaops
+    labels: *release-labels
+
+  signer:
+    image: registry.stella-ops.org/stellaops/signer:china
+    restart: unless-stopped
+    depends_on:
+      - postgres
+    environment:
+      <<: *crypto-env
+      STELLAOPS_SIGNER__STORAGE__DRIVER: "postgres"
+      STELLAOPS_SIGNER__STORAGE__POSTGRES__CONNECTIONSTRING: "Host=postgres;Port=5432;Database=${POSTGRES_DB:-stellaops_platform};Username=${POSTGRES_USER:-stellaops};Password=${POSTGRES_PASSWORD:-stellaops}"
+    volumes:
+      - ../../etc/appsettings.crypto.china.yaml:/app/etc/appsettings.crypto.yaml:ro
+      - ../../etc/crypto-plugins-manifest.json:/app/etc/crypto-plugins-manifest.json:ro
+    ports:
+      - "${SIGNER_PORT:-8441}:8441"
+    networks:
+      - stellaops
+    labels: *release-labels
+
+  attestor:
+    image: registry.stella-ops.org/stellaops/attestor:china
+    restart: unless-stopped
+    depends_on:
+      - signer
+    environment:
+      <<: *crypto-env
+      STELLAOPS_ATTESTOR__SIGNER__BASEURL: "http://signer:8441"
+    volumes:
+      - ../../etc/appsettings.crypto.china.yaml:/app/etc/appsettings.crypto.yaml:ro
+      - ../../etc/crypto-plugins-manifest.json:/app/etc/crypto-plugins-manifest.json:ro
+    ports:
+      - "${ATTESTOR_PORT:-8442}:8442"
+    networks:
+      - stellaops
+    labels: *release-labels
+
+  concelier:
+    image: registry.stella-ops.org/stellaops/concelier:china
+    restart: unless-stopped
+    depends_on:
+      - postgres
+      - rustfs
+    environment:
+      <<: *crypto-env
+      STELLAOPS_CONCELIER__STORAGE__DRIVER: "postgres"
+      STELLAOPS_CONCELIER__STORAGE__POSTGRES__CONNECTIONSTRING: "Host=postgres;Port=5432;Database=${POSTGRES_DB:-stellaops_platform};Username=${POSTGRES_USER:-stellaops};Password=${POSTGRES_PASSWORD:-stellaops}"
+      STELLAOPS_CONCELIER__STORAGE__RUSTFS__BASEURL: "http://rustfs:8080"
+    volumes:
+      - ../../etc/appsettings.crypto.china.yaml:/app/etc/appsettings.crypto.yaml:ro
+      - ../../etc/crypto-plugins-manifest.json:/app/etc/crypto-plugins-manifest.json:ro
+      - concelier-jobs:/app/jobs
+    ports:
+      - "${CONCELIER_PORT:-8443}:8443"
+    networks:
+      - stellaops
+    labels: *release-labels
+
+  scanner:
+    image: registry.stella-ops.org/stellaops/scanner:china
+    restart: unless-stopped
+    depends_on:
+      - postgres
+    environment:
+      <<: *crypto-env
+      STELLAOPS_SCANNER__STORAGE__DRIVER: "postgres"
+      STELLAOPS_SCANNER__STORAGE__POSTGRES__CONNECTIONSTRING: "Host=postgres;Port=5432;Database=${POSTGRES_DB:-stellaops_platform};Username=${POSTGRES_USER:-stellaops};Password=${POSTGRES_PASSWORD:-stellaops}"
+    volumes:
+      - ../../etc/appsettings.crypto.china.yaml:/app/etc/appsettings.crypto.yaml:ro
+      - ../../etc/crypto-plugins-manifest.json:/app/etc/crypto-plugins-manifest.json:ro
+    ports:
+      - "${SCANNER_PORT:-8444}:8444"
+    networks:
+      - stellaops
+    labels: *release-labels
+
+  excititor:
+    image: registry.stella-ops.org/stellaops/excititor:china
+    restart: unless-stopped
+    depends_on:
+      - postgres
+    environment:
+      <<: *crypto-env
+      STELLAOPS_EXCITITOR__STORAGE__DRIVER: "postgres"
+      STELLAOPS_EXCITITOR__STORAGE__POSTGRES__CONNECTIONSTRING: "Host=postgres;Port=5432;Database=${POSTGRES_DB:-stellaops_platform};Username=${POSTGRES_USER:-stellaops};Password=${POSTGRES_PASSWORD:-stellaops}"
+    volumes:
+      - ../../etc/appsettings.crypto.china.yaml:/app/etc/appsettings.crypto.yaml:ro
+      - ../../etc/crypto-plugins-manifest.json:/app/etc/crypto-plugins-manifest.json:ro
+    ports:
+      - "${EXCITITOR_PORT:-8445}:8445"
+    networks:
+      - stellaops
+    labels: *release-labels
+
+  policy:
+    image: registry.stella-ops.org/stellaops/policy:china
+    restart: unless-stopped
+    depends_on:
+      - postgres
+    environment:
+      <<: *crypto-env
+      STELLAOPS_POLICY__STORAGE__DRIVER: "postgres"
+      STELLAOPS_POLICY__STORAGE__POSTGRES__CONNECTIONSTRING: "Host=postgres;Port=5432;Database=${POSTGRES_DB:-stellaops_platform};Username=${POSTGRES_USER:-stellaops};Password=${POSTGRES_PASSWORD:-stellaops}"
+    volumes:
+      - ../../etc/appsettings.crypto.china.yaml:/app/etc/appsettings.crypto.yaml:ro
+      - ../../etc/crypto-plugins-manifest.json:/app/etc/crypto-plugins-manifest.json:ro
+    ports:
+      - "${POLICY_PORT:-8446}:8446"
+    networks:
+      - stellaops
+    labels: *release-labels
+
+  scheduler:
+    image: registry.stella-ops.org/stellaops/scheduler:china
+    restart: unless-stopped
+    depends_on:
+      - postgres
+      - nats
+    environment:
+      <<: *crypto-env
+      STELLAOPS_SCHEDULER__STORAGE__DRIVER: "postgres"
+      STELLAOPS_SCHEDULER__STORAGE__POSTGRES__CONNECTIONSTRING: "Host=postgres;Port=5432;Database=${POSTGRES_DB:-stellaops_platform};Username=${POSTGRES_USER:-stellaops};Password=${POSTGRES_PASSWORD:-stellaops}"
+      STELLAOPS_SCHEDULER__MESSAGING__NATS__URL: "nats://nats:4222"
+    volumes:
+      - ../../etc/appsettings.crypto.china.yaml:/app/etc/appsettings.crypto.yaml:ro
+      - ../../etc/crypto-plugins-manifest.json:/app/etc/crypto-plugins-manifest.json:ro
+    ports:
+      - "${SCHEDULER_PORT:-8447}:8447"
+    networks:
+      - stellaops
+    labels: *release-labels
+
+  notify:
+    image: registry.stella-ops.org/stellaops/notify:china
+    restart: unless-stopped
+    depends_on:
+      - postgres
+    environment:
+      <<: *crypto-env
+      STELLAOPS_NOTIFY__STORAGE__DRIVER: "postgres"
+      STELLAOPS_NOTIFY__STORAGE__POSTGRES__CONNECTIONSTRING: "Host=postgres;Port=5432;Database=${POSTGRES_DB:-stellaops_platform};Username=${POSTGRES_USER:-stellaops};Password=${POSTGRES_PASSWORD:-stellaops}"
+    volumes:
+      - ../../etc/appsettings.crypto.china.yaml:/app/etc/appsettings.crypto.yaml:ro
+      - ../../etc/crypto-plugins-manifest.json:/app/etc/crypto-plugins-manifest.json:ro
+    ports:
+      - "${NOTIFY_PORT:-8448}:8448"
+    networks:
+      - stellaops
+    labels: *release-labels
+
+  zastava:
+    image: registry.stella-ops.org/stellaops/zastava:china
+    restart: unless-stopped
+    depends_on:
+      - postgres
+    environment:
+      <<: *crypto-env
+      STELLAOPS_ZASTAVA__STORAGE__DRIVER: "postgres"
+      STELLAOPS_ZASTAVA__STORAGE__POSTGRES__CONNECTIONSTRING: "Host=postgres;Port=5432;Database=${POSTGRES_DB:-stellaops_platform};Username=${POSTGRES_USER:-stellaops};Password=${POSTGRES_PASSWORD:-stellaops}"
+    volumes:
+      - ../../etc/appsettings.crypto.china.yaml:/app/etc/appsettings.crypto.yaml:ro
+      - ../../etc/crypto-plugins-manifest.json:/app/etc/crypto-plugins-manifest.json:ro
+    ports:
+      - "${ZASTAVA_PORT:-8449}:8449"
+    networks:
+      - stellaops
+    labels: *release-labels
+
+  gateway:
+    image: registry.stella-ops.org/stellaops/gateway:china
+    restart: unless-stopped
+    depends_on:
+      - authority
+      - concelier
+      - scanner
+    environment:
+      <<: *crypto-env
+      STELLAOPS_GATEWAY__AUTHORITY__BASEURL: "http://authority:8440"
+      STELLAOPS_GATEWAY__CONCELIER__BASEURL: "http://concelier:8443"
+      STELLAOPS_GATEWAY__SCANNER__BASEURL: "http://scanner:8444"
+    volumes:
+      - ../../etc/appsettings.crypto.china.yaml:/app/etc/appsettings.crypto.yaml:ro
+      - ../../etc/crypto-plugins-manifest.json:/app/etc/crypto-plugins-manifest.json:ro
+    ports:
+      - "${GATEWAY_PORT:-8080}:8080"
+    networks:
+      - stellaops
+    labels: *release-labels
--- a/devops/compose/docker-compose.dev.yaml
+++ b/devops/compose/docker-compose.dev.yaml
@@ -0,0 +1,353 @@
+x-release-labels: &release-labels
+  com.stellaops.release.version: "2025.10.0-edge"
+  com.stellaops.release.channel: "edge"
+  com.stellaops.profile: "dev"
+
+networks:
+  stellaops:
+    driver: bridge
+
+volumes:
+  rustfs-data:
+  concelier-jobs:
+  nats-data:
+  valkey-data:
+  advisory-ai-queue:
+  advisory-ai-plans:
+  advisory-ai-outputs:
+  postgres-data:
+
+services:
+  postgres:
+    image: docker.io/library/postgres:16
+    restart: unless-stopped
+    environment:
+      POSTGRES_USER: "${POSTGRES_USER:-stellaops}"
+      POSTGRES_PASSWORD: "${POSTGRES_PASSWORD:-stellaops}"
+      POSTGRES_DB: "${POSTGRES_DB:-stellaops_platform}"
+      PGDATA: /var/lib/postgresql/data/pgdata
+    volumes:
+      - postgres-data:/var/lib/postgresql/data
+    ports:
+      - "${POSTGRES_PORT:-5432}:5432"
+    networks:
+      - stellaops
+    labels: *release-labels
+
+  valkey:
+    image: docker.io/valkey/valkey:8.0
+    restart: unless-stopped
+    command: ["valkey-server", "--appendonly", "yes"]
+    volumes:
+      - valkey-data:/data
+    ports:
+      - "${VALKEY_PORT:-6379}:6379"
+    networks:
+      - stellaops
+    labels: *release-labels
+
+  rustfs:
+    image: registry.stella-ops.org/stellaops/rustfs:2025.10.0-edge
+    command: ["serve", "--listen", "0.0.0.0:8080", "--root", "/data"]
+    restart: unless-stopped
+    environment:
+      RUSTFS__LOG__LEVEL: info
+      RUSTFS__STORAGE__PATH: /data
+    volumes:
+      - rustfs-data:/data
+    ports:
+      - "${RUSTFS_HTTP_PORT:-8080}:8080"
+    networks:
+      - stellaops
+    labels: *release-labels
+
+  nats:
+    image: docker.io/library/nats@sha256:c82559e4476289481a8a5196e675ebfe67eea81d95e5161e3e78eccfe766608e
+    command:
+      - "-js"
+      - "-sd"
+      - /data
+    restart: unless-stopped
+    ports:
+      - "${NATS_CLIENT_PORT:-4222}:4222"
+    volumes:
+      - nats-data:/data
+    networks:
+      - stellaops
+    labels: *release-labels
+
+  authority:
+    image: registry.stella-ops.org/stellaops/authority@sha256:a8e8faec44a579aa5714e58be835f25575710430b1ad2ccd1282a018cd9ffcdd
+    restart: unless-stopped
+    depends_on:
+      - postgres
+    environment:
+      STELLAOPS_AUTHORITY__ISSUER: "${AUTHORITY_ISSUER}"
+      STELLAOPS_AUTHORITY__STORAGE__DRIVER: "postgres"
+      STELLAOPS_AUTHORITY__STORAGE__POSTGRES__CONNECTIONSTRING: "Host=postgres;Port=5432;Database=${POSTGRES_DB:-stellaops_platform};Username=${POSTGRES_USER:-stellaops};Password=${POSTGRES_PASSWORD:-stellaops}"
+      STELLAOPS_AUTHORITY__PLUGINDIRECTORIES__0: "/app/plugins"
+      STELLAOPS_AUTHORITY__PLUGINS__CONFIGURATIONDIRECTORY: "/app/etc/authority.plugins"
+    volumes:
+      - ../../etc/authority.yaml:/etc/authority.yaml:ro
+      - ../../etc/authority.plugins:/app/etc/authority.plugins:ro
+    ports:
+      - "${AUTHORITY_PORT:-8440}:8440"
+    networks:
+      - stellaops
+    labels: *release-labels
+
+  signer:
+    image: registry.stella-ops.org/stellaops/signer@sha256:8bfef9a75783883d49fc18e3566553934e970b00ee090abee9cb110d2d5c3298
+    restart: unless-stopped
+    depends_on:
+      - authority
+      - valkey
+    environment:
+      SIGNER__AUTHORITY__BASEURL: "https://authority:8440"
+      SIGNER__POE__INTROSPECTURL: "${SIGNER_POE_INTROSPECT_URL}"
+      SIGNER__CACHE__REDIS__CONNECTIONSTRING: "valkey:6379"
+    ports:
+      - "${SIGNER_PORT:-8441}:8441"
+    networks:
+      - stellaops
+    labels: *release-labels
+
+  attestor:
+    image: registry.stella-ops.org/stellaops/attestor@sha256:5cc417948c029da01dccf36e4645d961a3f6d8de7e62fe98d845f07cd2282114
+    restart: unless-stopped
+    depends_on:
+      - signer
+      - valkey
+    environment:
+      ATTESTOR__SIGNER__BASEURL: "https://signer:8441"
+      ATTESTOR__CACHE__REDIS__CONNECTIONSTRING: "valkey:6379"
+    ports:
+      - "${ATTESTOR_PORT:-8442}:8442"
+    networks:
+      - stellaops
+    labels: *release-labels
+
+  issuer-directory:
+    image: registry.stella-ops.org/stellaops/issuer-directory-web:2025.10.0-edge
+    restart: unless-stopped
+    depends_on:
+      - postgres
+      - authority
+    environment:
+      ISSUERDIRECTORY__CONFIG: "/etc/issuer-directory.yaml"
+      ISSUERDIRECTORY__AUTHORITY__ISSUER: "${AUTHORITY_ISSUER}"
+      ISSUERDIRECTORY__AUTHORITY__BASEURL: "https://authority:8440"
+      ISSUERDIRECTORY__STORAGE__DRIVER: "postgres"
+      ISSUERDIRECTORY__STORAGE__POSTGRES__CONNECTIONSTRING: "Host=postgres;Port=5432;Database=${POSTGRES_DB:-stellaops_platform};Username=${POSTGRES_USER:-stellaops};Password=${POSTGRES_PASSWORD:-stellaops}"
+      ISSUERDIRECTORY__SEEDCSAFPUBLISHERS: "${ISSUER_DIRECTORY_SEED_CSAF:-true}"
+    volumes:
+      - ../../etc/issuer-directory.yaml:/etc/issuer-directory.yaml:ro
+    ports:
+      - "${ISSUER_DIRECTORY_PORT:-8447}:8080"
+    networks:
+      - stellaops
+    labels: *release-labels
+
+  concelier:
+    image: registry.stella-ops.org/stellaops/concelier@sha256:dafef3954eb4b837e2c424dd2d23e1e4d60fa83794840fac9cd3dea1d43bd085
+    restart: unless-stopped
+    depends_on:
+      - postgres
+    environment:
+      CONCELIER__STORAGE__DRIVER: "postgres"
+      CONCELIER__STORAGE__POSTGRES__CONNECTIONSTRING: "Host=postgres;Port=5432;Database=${POSTGRES_DB:-stellaops_platform};Username=${POSTGRES_USER:-stellaops};Password=${POSTGRES_PASSWORD:-stellaops}"
+      CONCELIER__AUTHORITY__BASEURL: "https://authority:8440"
+    volumes:
+      - concelier-jobs:/var/lib/concelier/jobs
+    ports:
+      - "${CONCELIER_PORT:-8445}:8445"
+    networks:
+      - stellaops
+    labels: *release-labels
+
+  scanner-web:
+    image: registry.stella-ops.org/stellaops/scanner-web@sha256:e0dfdb087e330585a5953029fb4757f5abdf7610820a085bd61b457dbead9a11
+    restart: unless-stopped
+    depends_on:
+      - postgres
+      - concelier
+      - rustfs
+      - nats
+      - valkey
+    environment:
+      SCANNER__STORAGE__DRIVER: "postgres"
+      SCANNER__STORAGE__POSTGRES__CONNECTIONSTRING: "Host=postgres;Port=5432;Database=${POSTGRES_DB:-stellaops_platform};Username=${POSTGRES_USER:-stellaops};Password=${POSTGRES_PASSWORD:-stellaops}"
+      SCANNER__ARTIFACTSTORE__DRIVER: "rustfs"
+      SCANNER__ARTIFACTSTORE__ENDPOINT: "http://rustfs:8080/api/v1"
+      SCANNER__ARTIFACTSTORE__BUCKET: "scanner-artifacts"
+      SCANNER__ARTIFACTSTORE__TIMEOUTSECONDS: "30"
+      SCANNER__QUEUE__BROKER: "nats://nats:4222"
+      SCANNER__CACHE__REDIS__CONNECTIONSTRING: "valkey:6379"
+      SCANNER__EVENTS__ENABLED: "${SCANNER_EVENTS_ENABLED:-false}"
+      SCANNER__EVENTS__DRIVER: "${SCANNER_EVENTS_DRIVER:-valkey}"
+      SCANNER__EVENTS__DSN: "${SCANNER_EVENTS_DSN:-valkey:6379}"
+      SCANNER__EVENTS__STREAM: "${SCANNER_EVENTS_STREAM:-stella.events}"
+      SCANNER__EVENTS__PUBLISHTIMEOUTSECONDS: "${SCANNER_EVENTS_PUBLISH_TIMEOUT_SECONDS:-5}"
+      SCANNER__EVENTS__MAXSTREAMLENGTH: "${SCANNER_EVENTS_MAX_STREAM_LENGTH:-10000}"
+      SCANNER__OFFLINEKIT__ENABLED: "${SCANNER_OFFLINEKIT_ENABLED:-false}"
+      SCANNER__OFFLINEKIT__REQUIREDSSE: "${SCANNER_OFFLINEKIT_REQUIREDSSE:-true}"
+      SCANNER__OFFLINEKIT__REKOROFFLINEMODE: "${SCANNER_OFFLINEKIT_REKOROFFLINEMODE:-true}"
+      SCANNER__OFFLINEKIT__TRUSTROOTDIRECTORY: "${SCANNER_OFFLINEKIT_TRUSTROOTDIRECTORY:-/etc/stellaops/trust-roots}"
+      SCANNER__OFFLINEKIT__REKORSNAPSHOTDIRECTORY: "${SCANNER_OFFLINEKIT_REKORSNAPSHOTDIRECTORY:-/var/lib/stellaops/rekor-snapshot}"
+    volumes:
+      - ${SCANNER_OFFLINEKIT_TRUSTROOTS_HOST_PATH:-./offline/trust-roots}:${SCANNER_OFFLINEKIT_TRUSTROOTDIRECTORY:-/etc/stellaops/trust-roots}:ro
+      - ${SCANNER_OFFLINEKIT_REKOR_SNAPSHOT_HOST_PATH:-./offline/rekor-snapshot}:${SCANNER_OFFLINEKIT_REKORSNAPSHOTDIRECTORY:-/var/lib/stellaops/rekor-snapshot}:ro
+    ports:
+      - "${SCANNER_WEB_PORT:-8444}:8444"
+    networks:
+      - stellaops
+    labels: *release-labels
+
+  scanner-worker:
+    image: registry.stella-ops.org/stellaops/scanner-worker@sha256:92dda42f6f64b2d9522104a5c9ffb61d37b34dd193132b68457a259748008f37
+    restart: unless-stopped
+    depends_on:
+      - scanner-web
+      - rustfs
+      - nats
+    environment:
+      SCANNER__STORAGE__DRIVER: "postgres"
+      SCANNER__STORAGE__POSTGRES__CONNECTIONSTRING: "Host=postgres;Port=5432;Database=${POSTGRES_DB:-stellaops_platform};Username=${POSTGRES_USER:-stellaops};Password=${POSTGRES_PASSWORD:-stellaops}"
+      SCANNER__ARTIFACTSTORE__DRIVER: "rustfs"
+      SCANNER__ARTIFACTSTORE__ENDPOINT: "http://rustfs:8080/api/v1"
+      SCANNER__ARTIFACTSTORE__BUCKET: "scanner-artifacts"
+      SCANNER__ARTIFACTSTORE__TIMEOUTSECONDS: "30"
+      SCANNER__QUEUE__BROKER: "nats://nats:4222"
+    networks:
+      - stellaops
+    labels: *release-labels
+
+  scheduler-worker:
+    image: registry.stella-ops.org/stellaops/scheduler-worker:2025.10.0-edge
+    restart: unless-stopped
+    depends_on:
+      - postgres
+      - nats
+      - scanner-web
+    command:
+      - "dotnet"
+      - "StellaOps.Scheduler.Worker.Host.dll"
+    environment:
+      SCHEDULER__QUEUE__KIND: "Nats"
+      SCHEDULER__QUEUE__NATS__URL: "nats://nats:4222"
+      SCHEDULER__STORAGE__DRIVER: "postgres"
+      SCHEDULER__STORAGE__POSTGRES__CONNECTIONSTRING: "Host=postgres;Port=5432;Database=${POSTGRES_DB:-stellaops_platform};Username=${POSTGRES_USER:-stellaops};Password=${POSTGRES_PASSWORD:-stellaops}"
+      SCHEDULER__WORKER__RUNNER__SCANNER__BASEADDRESS: "${SCHEDULER_SCANNER_BASEADDRESS:-http://scanner-web:8444}"
+    networks:
+      - stellaops
+    labels: *release-labels
+
+  notify-web:
+    image: ${NOTIFY_WEB_IMAGE:-registry.stella-ops.org/stellaops/notify-web:2025.10.0-edge}
+    restart: unless-stopped
+    depends_on:
+      - postgres
+      - authority
+      - valkey
+    environment:
+      DOTNET_ENVIRONMENT: Development
+      NOTIFY__STORAGE__DRIVER: "postgres"
+      NOTIFY__STORAGE__POSTGRES__CONNECTIONSTRING: "Host=postgres;Port=5432;Database=${POSTGRES_DB:-stellaops_platform};Username=${POSTGRES_USER:-stellaops};Password=${POSTGRES_PASSWORD:-stellaops}"
+      NOTIFY__QUEUE__DRIVER: "nats"
+      NOTIFY__QUEUE__NATS__URL: "nats://nats:4222"
+    volumes:
+      - ../../etc/notify.dev.yaml:/app/etc/notify.yaml:ro
+    ports:
+      - "${NOTIFY_WEB_PORT:-8446}:8446"
+    networks:
+      - stellaops
+    labels: *release-labels
+
+  excititor:
+    image: registry.stella-ops.org/stellaops/excititor@sha256:d9bd5cadf1eab427447ce3df7302c30ded837239771cc6433b9befb895054285
+    restart: unless-stopped
+    depends_on:
+      - postgres
+      - concelier
+    environment:
+      EXCITITOR__CONCELIER__BASEURL: "https://concelier:8445"
+      EXCITITOR__STORAGE__DRIVER: "postgres"
+      EXCITITOR__STORAGE__POSTGRES__CONNECTIONSTRING: "Host=postgres;Port=5432;Database=${POSTGRES_DB:-stellaops_platform};Username=${POSTGRES_USER:-stellaops};Password=${POSTGRES_PASSWORD:-stellaops}"
+    networks:
+      - stellaops
+    labels: *release-labels
+
+  advisory-ai-web:
+    image: registry.stella-ops.org/stellaops/advisory-ai-web:2025.10.0-edge
+    restart: unless-stopped
+    depends_on:
+      - scanner-web
+    environment:
+      ADVISORYAI__AdvisoryAI__SbomBaseAddress: "${ADVISORY_AI_SBOM_BASEADDRESS:-http://scanner-web:8444}"
+      ADVISORYAI__AdvisoryAI__Queue__DirectoryPath: "/var/lib/advisory-ai/queue"
+      ADVISORYAI__AdvisoryAI__Storage__PlanCacheDirectory: "/var/lib/advisory-ai/plans"
+      ADVISORYAI__AdvisoryAI__Storage__OutputDirectory: "/var/lib/advisory-ai/outputs"
+      ADVISORYAI__AdvisoryAI__Inference__Mode: "${ADVISORY_AI_INFERENCE_MODE:-Local}"
+      ADVISORYAI__AdvisoryAI__Inference__Remote__BaseAddress: "${ADVISORY_AI_REMOTE_BASEADDRESS:-}"
+      ADVISORYAI__AdvisoryAI__Inference__Remote__ApiKey: "${ADVISORY_AI_REMOTE_APIKEY:-}"
+    ports:
+      - "${ADVISORY_AI_WEB_PORT:-8448}:8448"
+    volumes:
+      - advisory-ai-queue:/var/lib/advisory-ai/queue
+      - advisory-ai-plans:/var/lib/advisory-ai/plans
+      - advisory-ai-outputs:/var/lib/advisory-ai/outputs
+    networks:
+      - stellaops
+    labels: *release-labels
+
+  advisory-ai-worker:
+    image: registry.stella-ops.org/stellaops/advisory-ai-worker:2025.10.0-edge
+    restart: unless-stopped
+    depends_on:
+      - advisory-ai-web
+    environment:
+      ADVISORYAI__AdvisoryAI__SbomBaseAddress: "${ADVISORY_AI_SBOM_BASEADDRESS:-http://scanner-web:8444}"
+      ADVISORYAI__AdvisoryAI__Queue__DirectoryPath: "/var/lib/advisory-ai/queue"
+      ADVISORYAI__AdvisoryAI__Storage__PlanCacheDirectory: "/var/lib/advisory-ai/plans"
+      ADVISORYAI__AdvisoryAI__Storage__OutputDirectory: "/var/lib/advisory-ai/outputs"
+      ADVISORYAI__AdvisoryAI__Inference__Mode: "${ADVISORY_AI_INFERENCE_MODE:-Local}"
+      ADVISORYAI__AdvisoryAI__Inference__Remote__BaseAddress: "${ADVISORY_AI_REMOTE_BASEADDRESS:-}"
+      ADVISORYAI__AdvisoryAI__Inference__Remote__ApiKey: "${ADVISORY_AI_REMOTE_APIKEY:-}"
+    volumes:
+      - advisory-ai-queue:/var/lib/advisory-ai/queue
+      - advisory-ai-plans:/var/lib/advisory-ai/plans
+      - advisory-ai-outputs:/var/lib/advisory-ai/outputs
+    networks:
+      - stellaops
+    labels: *release-labels
+
+  web-ui:
+    image: registry.stella-ops.org/stellaops/web-ui@sha256:38b225fa7767a5b94ebae4dae8696044126aac429415e93de514d5dd95748dcf
+    restart: unless-stopped
+    depends_on:
+      - scanner-web
+    environment:
+      STELLAOPS_UI__BACKEND__BASEURL: "https://scanner-web:8444"
+    ports:
+      - "${UI_PORT:-8443}:8443"
+    networks:
+      - stellaops
+    labels: *release-labels
+
+  cryptopro-csp:
+    build:
+      context: ../..
+      dockerfile: ops/cryptopro/linux-csp-service/Dockerfile
+      args:
+        CRYPTOPRO_ACCEPT_EULA: "${CRYPTOPRO_ACCEPT_EULA:-0}"
+    restart: unless-stopped
+    environment:
+      ASPNETCORE_URLS: "http://0.0.0.0:8080"
+      CRYPTOPRO_ACCEPT_EULA: "${CRYPTOPRO_ACCEPT_EULA:-0}"
+    volumes:
+      - ../../opt/cryptopro/downloads:/opt/cryptopro/downloads:ro
+    ports:
+      - "${CRYPTOPRO_PORT:-18080}:8080"
+    networks:
+      - stellaops
+    labels: *release-labels
--- a/devops/compose/docker-compose.eu.yml
+++ b/devops/compose/docker-compose.eu.yml
@@ -0,0 +1,301 @@
+# StellaOps Docker Compose - International Profile
+# Cryptography: eIDAS-compliant qualified trust services (temporarily using NIST)
+# Provider: offline-verification
+# Jurisdiction: eu, world
+
+x-release-labels: &release-labels
+  com.stellaops.release.version: "2025.10.0-edge"
+  com.stellaops.release.channel: "edge"
+  com.stellaops.profile: "eu"
+  com.stellaops.crypto.profile: "eu"
+  com.stellaops.crypto.provider: "offline-verification"
+
+x-crypto-env: &crypto-env
+  # Crypto configuration
+  STELLAOPS_CRYPTO_PROFILE: "eu"
+  STELLAOPS_CRYPTO_CONFIG_PATH: "/app/etc/appsettings.crypto.yaml"
+  STELLAOPS_CRYPTO_MANIFEST_PATH: "/app/etc/crypto-plugins-manifest.json"
+
+networks:
+  stellaops:
+    driver: bridge
+
+volumes:
+  rustfs-data:
+  concelier-jobs:
+  nats-data:
+  valkey-data:
+  advisory-ai-queue:
+  advisory-ai-plans:
+  advisory-ai-outputs:
+  postgres-data:
+
+services:
+  postgres:
+    image: docker.io/library/postgres:16
+    restart: unless-stopped
+    environment:
+      POSTGRES_USER: "${POSTGRES_USER:-stellaops}"
+      POSTGRES_PASSWORD: "${POSTGRES_PASSWORD:-stellaops}"
+      POSTGRES_DB: "${POSTGRES_DB:-stellaops_platform}"
+      PGDATA: /var/lib/postgresql/data/pgdata
+    volumes:
+      - postgres-data:/var/lib/postgresql/data
+      - ../postgres-partitioning:/docker-entrypoint-initdb.d:ro
+    ports:
+      - "${POSTGRES_PORT:-5432}:5432"
+    networks:
+      - stellaops
+    labels: *release-labels
+
+  valkey:
+    image: docker.io/valkey/valkey:8.0
+    restart: unless-stopped
+    command: ["valkey-server", "--appendonly", "yes"]
+    volumes:
+      - valkey-data:/data
+    ports:
+      - "${VALKEY_PORT:-6379}:6379"
+    networks:
+      - stellaops
+    labels: *release-labels
+
+  rustfs:
+    image: registry.stella-ops.org/stellaops/rustfs:2025.10.0-edge
+    command: ["serve", "--listen", "0.0.0.0:8080", "--root", "/data"]
+    restart: unless-stopped
+    environment:
+      RUSTFS__LOG__LEVEL: info
+      RUSTFS__STORAGE__PATH: /data
+    volumes:
+      - rustfs-data:/data
+    ports:
+      - "${RUSTFS_HTTP_PORT:-8080}:8080"
+    networks:
+      - stellaops
+    labels: *release-labels
+
+  nats:
+    image: docker.io/library/nats@sha256:c82559e4476289481a8a5196e675ebfe67eea81d95e5161e3e78eccfe766608e
+    command:
+      - "-js"
+      - "-sd"
+      - /data
+    restart: unless-stopped
+    ports:
+      - "${NATS_CLIENT_PORT:-4222}:4222"
+    volumes:
+      - nats-data:/data
+    networks:
+      - stellaops
+    labels: *release-labels
+
+  authority:
+    image: registry.stella-ops.org/stellaops/authority:eu
+    restart: unless-stopped
+    depends_on:
+      - postgres
+    environment:
+      <<: *crypto-env
+      STELLAOPS_AUTHORITY__ISSUER: "${AUTHORITY_ISSUER}"
+      STELLAOPS_AUTHORITY__STORAGE__DRIVER: "postgres"
+      STELLAOPS_AUTHORITY__STORAGE__POSTGRES__CONNECTIONSTRING: "Host=postgres;Port=5432;Database=${POSTGRES_DB:-stellaops_platform};Username=${POSTGRES_USER:-stellaops};Password=${POSTGRES_PASSWORD:-stellaops}"
+      STELLAOPS_AUTHORITY__PLUGINDIRECTORIES__0: "/app/plugins"
+      STELLAOPS_AUTHORITY__PLUGINS__CONFIGURATIONDIRECTORY: "/app/etc/authority.plugins"
+    volumes:
+      - ../../etc/authority.yaml:/etc/authority.yaml:ro
+      - ../../etc/authority.plugins:/app/etc/authority.plugins:ro
+      - ../../etc/appsettings.crypto.eu.yaml:/app/etc/appsettings.crypto.yaml:ro
+      - ../../etc/crypto-plugins-manifest.json:/app/etc/crypto-plugins-manifest.json:ro
+    ports:
+      - "${AUTHORITY_PORT:-8440}:8440"
+    networks:
+      - stellaops
+    labels: *release-labels
+
+  signer:
+    image: registry.stella-ops.org/stellaops/signer:eu
+    restart: unless-stopped
+    depends_on:
+      - postgres
+    environment:
+      <<: *crypto-env
+      STELLAOPS_SIGNER__STORAGE__DRIVER: "postgres"
+      STELLAOPS_SIGNER__STORAGE__POSTGRES__CONNECTIONSTRING: "Host=postgres;Port=5432;Database=${POSTGRES_DB:-stellaops_platform};Username=${POSTGRES_USER:-stellaops};Password=${POSTGRES_PASSWORD:-stellaops}"
+    volumes:
+      - ../../etc/appsettings.crypto.eu.yaml:/app/etc/appsettings.crypto.yaml:ro
+      - ../../etc/crypto-plugins-manifest.json:/app/etc/crypto-plugins-manifest.json:ro
+    ports:
+      - "${SIGNER_PORT:-8441}:8441"
+    networks:
+      - stellaops
+    labels: *release-labels
+
+  attestor:
+    image: registry.stella-ops.org/stellaops/attestor:eu
+    restart: unless-stopped
+    depends_on:
+      - signer
+    environment:
+      <<: *crypto-env
+      STELLAOPS_ATTESTOR__SIGNER__BASEURL: "http://signer:8441"
+    volumes:
+      - ../../etc/appsettings.crypto.eu.yaml:/app/etc/appsettings.crypto.yaml:ro
+      - ../../etc/crypto-plugins-manifest.json:/app/etc/crypto-plugins-manifest.json:ro
+    ports:
+      - "${ATTESTOR_PORT:-8442}:8442"
+    networks:
+      - stellaops
+    labels: *release-labels
+
+  concelier:
+    image: registry.stella-ops.org/stellaops/concelier:eu
+    restart: unless-stopped
+    depends_on:
+      - postgres
+      - rustfs
+    environment:
+      <<: *crypto-env
+      STELLAOPS_CONCELIER__STORAGE__DRIVER: "postgres"
+      STELLAOPS_CONCELIER__STORAGE__POSTGRES__CONNECTIONSTRING: "Host=postgres;Port=5432;Database=${POSTGRES_DB:-stellaops_platform};Username=${POSTGRES_USER:-stellaops};Password=${POSTGRES_PASSWORD:-stellaops}"
+      STELLAOPS_CONCELIER__STORAGE__RUSTFS__BASEURL: "http://rustfs:8080"
+    volumes:
+      - ../../etc/appsettings.crypto.eu.yaml:/app/etc/appsettings.crypto.yaml:ro
+      - ../../etc/crypto-plugins-manifest.json:/app/etc/crypto-plugins-manifest.json:ro
+      - concelier-jobs:/app/jobs
+    ports:
+      - "${CONCELIER_PORT:-8443}:8443"
+    networks:
+      - stellaops
+    labels: *release-labels
+
+  scanner:
+    image: registry.stella-ops.org/stellaops/scanner:eu
+    restart: unless-stopped
+    depends_on:
+      - postgres
+    environment:
+      <<: *crypto-env
+      STELLAOPS_SCANNER__STORAGE__DRIVER: "postgres"
+      STELLAOPS_SCANNER__STORAGE__POSTGRES__CONNECTIONSTRING: "Host=postgres;Port=5432;Database=${POSTGRES_DB:-stellaops_platform};Username=${POSTGRES_USER:-stellaops};Password=${POSTGRES_PASSWORD:-stellaops}"
+    volumes:
+      - ../../etc/appsettings.crypto.eu.yaml:/app/etc/appsettings.crypto.yaml:ro
+      - ../../etc/crypto-plugins-manifest.json:/app/etc/crypto-plugins-manifest.json:ro
+    ports:
+      - "${SCANNER_PORT:-8444}:8444"
+    networks:
+      - stellaops
+    labels: *release-labels
+
+  excititor:
+    image: registry.stella-ops.org/stellaops/excititor:eu
+    restart: unless-stopped
+    depends_on:
+      - postgres
+    environment:
+      <<: *crypto-env
+      STELLAOPS_EXCITITOR__STORAGE__DRIVER: "postgres"
+      STELLAOPS_EXCITITOR__STORAGE__POSTGRES__CONNECTIONSTRING: "Host=postgres;Port=5432;Database=${POSTGRES_DB:-stellaops_platform};Username=${POSTGRES_USER:-stellaops};Password=${POSTGRES_PASSWORD:-stellaops}"
+    volumes:
+      - ../../etc/appsettings.crypto.eu.yaml:/app/etc/appsettings.crypto.yaml:ro
+      - ../../etc/crypto-plugins-manifest.json:/app/etc/crypto-plugins-manifest.json:ro
+    ports:
+      - "${EXCITITOR_PORT:-8445}:8445"
+    networks:
+      - stellaops
+    labels: *release-labels
+
+  policy:
+    image: registry.stella-ops.org/stellaops/policy:eu
+    restart: unless-stopped
+    depends_on:
+      - postgres
+    environment:
+      <<: *crypto-env
+      STELLAOPS_POLICY__STORAGE__DRIVER: "postgres"
+      STELLAOPS_POLICY__STORAGE__POSTGRES__CONNECTIONSTRING: "Host=postgres;Port=5432;Database=${POSTGRES_DB:-stellaops_platform};Username=${POSTGRES_USER:-stellaops};Password=${POSTGRES_PASSWORD:-stellaops}"
+    volumes:
+      - ../../etc/appsettings.crypto.eu.yaml:/app/etc/appsettings.crypto.yaml:ro
+      - ../../etc/crypto-plugins-manifest.json:/app/etc/crypto-plugins-manifest.json:ro
+    ports:
+      - "${POLICY_PORT:-8446}:8446"
+    networks:
+      - stellaops
+    labels: *release-labels
+
+  scheduler:
+    image: registry.stella-ops.org/stellaops/scheduler:eu
+    restart: unless-stopped
+    depends_on:
+      - postgres
+      - nats
+    environment:
+      <<: *crypto-env
+      STELLAOPS_SCHEDULER__STORAGE__DRIVER: "postgres"
+      STELLAOPS_SCHEDULER__STORAGE__POSTGRES__CONNECTIONSTRING: "Host=postgres;Port=5432;Database=${POSTGRES_DB:-stellaops_platform};Username=${POSTGRES_USER:-stellaops};Password=${POSTGRES_PASSWORD:-stellaops}"
+      STELLAOPS_SCHEDULER__MESSAGING__NATS__URL: "nats://nats:4222"
+    volumes:
+      - ../../etc/appsettings.crypto.eu.yaml:/app/etc/appsettings.crypto.yaml:ro
+      - ../../etc/crypto-plugins-manifest.json:/app/etc/crypto-plugins-manifest.json:ro
+    ports:
+      - "${SCHEDULER_PORT:-8447}:8447"
+    networks:
+      - stellaops
+    labels: *release-labels
+
+  notify:
+    image: registry.stella-ops.org/stellaops/notify:eu
+    restart: unless-stopped
+    depends_on:
+      - postgres
+    environment:
+      <<: *crypto-env
+      STELLAOPS_NOTIFY__STORAGE__DRIVER: "postgres"
+      STELLAOPS_NOTIFY__STORAGE__POSTGRES__CONNECTIONSTRING: "Host=postgres;Port=5432;Database=${POSTGRES_DB:-stellaops_platform};Username=${POSTGRES_USER:-stellaops};Password=${POSTGRES_PASSWORD:-stellaops}"
+    volumes:
+      - ../../etc/appsettings.crypto.eu.yaml:/app/etc/appsettings.crypto.yaml:ro
+      - ../../etc/crypto-plugins-manifest.json:/app/etc/crypto-plugins-manifest.json:ro
+    ports:
+      - "${NOTIFY_PORT:-8448}:8448"
+    networks:
+      - stellaops
+    labels: *release-labels
+
+  zastava:
+    image: registry.stella-ops.org/stellaops/zastava:eu
+    restart: unless-stopped
+    depends_on:
+      - postgres
+    environment:
+      <<: *crypto-env
+      STELLAOPS_ZASTAVA__STORAGE__DRIVER: "postgres"
+      STELLAOPS_ZASTAVA__STORAGE__POSTGRES__CONNECTIONSTRING: "Host=postgres;Port=5432;Database=${POSTGRES_DB:-stellaops_platform};Username=${POSTGRES_USER:-stellaops};Password=${POSTGRES_PASSWORD:-stellaops}"
+    volumes:
+      - ../../etc/appsettings.crypto.eu.yaml:/app/etc/appsettings.crypto.yaml:ro
+      - ../../etc/crypto-plugins-manifest.json:/app/etc/crypto-plugins-manifest.json:ro
+    ports:
+      - "${ZASTAVA_PORT:-8449}:8449"
+    networks:
+      - stellaops
+    labels: *release-labels
+
+  gateway:
+    image: registry.stella-ops.org/stellaops/gateway:eu
+    restart: unless-stopped
+    depends_on:
+      - authority
+      - concelier
+      - scanner
+    environment:
+      <<: *crypto-env
+      STELLAOPS_GATEWAY__AUTHORITY__BASEURL: "http://authority:8440"
+      STELLAOPS_GATEWAY__CONCELIER__BASEURL: "http://concelier:8443"
+      STELLAOPS_GATEWAY__SCANNER__BASEURL: "http://scanner:8444"
+    volumes:
+      - ../../etc/appsettings.crypto.eu.yaml:/app/etc/appsettings.crypto.yaml:ro
+      - ../../etc/crypto-plugins-manifest.json:/app/etc/crypto-plugins-manifest.json:ro
+    ports:
+      - "${GATEWAY_PORT:-8080}:8080"
+    networks:
+      - stellaops
+    labels: *release-labels
--- a/devops/compose/docker-compose.gpu.yaml
+++ b/devops/compose/docker-compose.gpu.yaml
@@ -0,0 +1,26 @@
+version: "3.9"
+
+services:
+  advisory-ai-worker:
+    deploy:
+      resources:
+        reservations:
+          devices:
+            - capabilities: [gpu]
+              driver: nvidia
+              count: 1
+    environment:
+      ADVISORY_AI_INFERENCE_GPU: "true"
+    runtime: nvidia
+
+  advisory-ai-web:
+    deploy:
+      resources:
+        reservations:
+          devices:
+            - capabilities: [gpu]
+              driver: nvidia
+              count: 1
+    environment:
+      ADVISORY_AI_INFERENCE_GPU: "true"
+    runtime: nvidia
--- a/devops/compose/docker-compose.international.yml
+++ b/devops/compose/docker-compose.international.yml
@@ -0,0 +1,301 @@
+# StellaOps Docker Compose - International Profile
+# Cryptography: Standard NIST algorithms (ECDSA, RSA, SHA-2)
+# Provider: offline-verification
+# Jurisdiction: world
+
+x-release-labels: &release-labels
+  com.stellaops.release.version: "2025.10.0-edge"
+  com.stellaops.release.channel: "edge"
+  com.stellaops.profile: "international"
+  com.stellaops.crypto.profile: "international"
+  com.stellaops.crypto.provider: "offline-verification"
+
+x-crypto-env: &crypto-env
+  # Crypto configuration
+  STELLAOPS_CRYPTO_PROFILE: "international"
+  STELLAOPS_CRYPTO_CONFIG_PATH: "/app/etc/appsettings.crypto.yaml"
+  STELLAOPS_CRYPTO_MANIFEST_PATH: "/app/etc/crypto-plugins-manifest.json"
+
+networks:
+  stellaops:
+    driver: bridge
+
+volumes:
+  rustfs-data:
+  concelier-jobs:
+  nats-data:
+  valkey-data:
+  advisory-ai-queue:
+  advisory-ai-plans:
+  advisory-ai-outputs:
+  postgres-data:
+
+services:
+  postgres:
+    image: docker.io/library/postgres:16
+    restart: unless-stopped
+    environment:
+      POSTGRES_USER: "${POSTGRES_USER:-stellaops}"
+      POSTGRES_PASSWORD: "${POSTGRES_PASSWORD:-stellaops}"
+      POSTGRES_DB: "${POSTGRES_DB:-stellaops_platform}"
+      PGDATA: /var/lib/postgresql/data/pgdata
+    volumes:
+      - postgres-data:/var/lib/postgresql/data
+      - ../postgres-partitioning:/docker-entrypoint-initdb.d:ro
+    ports:
+      - "${POSTGRES_PORT:-5432}:5432"
+    networks:
+      - stellaops
+    labels: *release-labels
+
+  valkey:
+    image: docker.io/valkey/valkey:8.0
+    restart: unless-stopped
+    command: ["valkey-server", "--appendonly", "yes"]
+    volumes:
+      - valkey-data:/data
+    ports:
+      - "${VALKEY_PORT:-6379}:6379"
+    networks:
+      - stellaops
+    labels: *release-labels
+
+  rustfs:
+    image: registry.stella-ops.org/stellaops/rustfs:2025.10.0-edge
+    command: ["serve", "--listen", "0.0.0.0:8080", "--root", "/data"]
+    restart: unless-stopped
+    environment:
+      RUSTFS__LOG__LEVEL: info
+      RUSTFS__STORAGE__PATH: /data
+    volumes:
+      - rustfs-data:/data
+    ports:
+      - "${RUSTFS_HTTP_PORT:-8080}:8080"
+    networks:
+      - stellaops
+    labels: *release-labels
+
+  nats:
+    image: docker.io/library/nats@sha256:c82559e4476289481a8a5196e675ebfe67eea81d95e5161e3e78eccfe766608e
+    command:
+      - "-js"
+      - "-sd"
+      - /data
+    restart: unless-stopped
+    ports:
+      - "${NATS_CLIENT_PORT:-4222}:4222"
+    volumes:
+      - nats-data:/data
+    networks:
+      - stellaops
+    labels: *release-labels
+
+  authority:
+    image: registry.stella-ops.org/stellaops/authority:international
+    restart: unless-stopped
+    depends_on:
+      - postgres
+    environment:
+      <<: *crypto-env
+      STELLAOPS_AUTHORITY__ISSUER: "${AUTHORITY_ISSUER}"
+      STELLAOPS_AUTHORITY__STORAGE__DRIVER: "postgres"
+      STELLAOPS_AUTHORITY__STORAGE__POSTGRES__CONNECTIONSTRING: "Host=postgres;Port=5432;Database=${POSTGRES_DB:-stellaops_platform};Username=${POSTGRES_USER:-stellaops};Password=${POSTGRES_PASSWORD:-stellaops}"
+      STELLAOPS_AUTHORITY__PLUGINDIRECTORIES__0: "/app/plugins"
+      STELLAOPS_AUTHORITY__PLUGINS__CONFIGURATIONDIRECTORY: "/app/etc/authority.plugins"
+    volumes:
+      - ../../etc/authority.yaml:/etc/authority.yaml:ro
+      - ../../etc/authority.plugins:/app/etc/authority.plugins:ro
+      - ../../etc/appsettings.crypto.international.yaml:/app/etc/appsettings.crypto.yaml:ro
+      - ../../etc/crypto-plugins-manifest.json:/app/etc/crypto-plugins-manifest.json:ro
+    ports:
+      - "${AUTHORITY_PORT:-8440}:8440"
+    networks:
+      - stellaops
+    labels: *release-labels
+
+  signer:
+    image: registry.stella-ops.org/stellaops/signer:international
+    restart: unless-stopped
+    depends_on:
+      - postgres
+    environment:
+      <<: *crypto-env
+      STELLAOPS_SIGNER__STORAGE__DRIVER: "postgres"
+      STELLAOPS_SIGNER__STORAGE__POSTGRES__CONNECTIONSTRING: "Host=postgres;Port=5432;Database=${POSTGRES_DB:-stellaops_platform};Username=${POSTGRES_USER:-stellaops};Password=${POSTGRES_PASSWORD:-stellaops}"
+    volumes:
+      - ../../etc/appsettings.crypto.international.yaml:/app/etc/appsettings.crypto.yaml:ro
+      - ../../etc/crypto-plugins-manifest.json:/app/etc/crypto-plugins-manifest.json:ro
+    ports:
+      - "${SIGNER_PORT:-8441}:8441"
+    networks:
+      - stellaops
+    labels: *release-labels
+
+  attestor:
+    image: registry.stella-ops.org/stellaops/attestor:international
+    restart: unless-stopped
+    depends_on:
+      - signer
+    environment:
+      <<: *crypto-env
+      STELLAOPS_ATTESTOR__SIGNER__BASEURL: "http://signer:8441"
+    volumes:
+      - ../../etc/appsettings.crypto.international.yaml:/app/etc/appsettings.crypto.yaml:ro
+      - ../../etc/crypto-plugins-manifest.json:/app/etc/crypto-plugins-manifest.json:ro
+    ports:
+      - "${ATTESTOR_PORT:-8442}:8442"
+    networks:
+      - stellaops
+    labels: *release-labels
+
+  concelier:
+    image: registry.stella-ops.org/stellaops/concelier:international
+    restart: unless-stopped
+    depends_on:
+      - postgres
+      - rustfs
+    environment:
+      <<: *crypto-env
+      STELLAOPS_CONCELIER__STORAGE__DRIVER: "postgres"
+      STELLAOPS_CONCELIER__STORAGE__POSTGRES__CONNECTIONSTRING: "Host=postgres;Port=5432;Database=${POSTGRES_DB:-stellaops_platform};Username=${POSTGRES_USER:-stellaops};Password=${POSTGRES_PASSWORD:-stellaops}"
+      STELLAOPS_CONCELIER__STORAGE__RUSTFS__BASEURL: "http://rustfs:8080"
+    volumes:
+      - ../../etc/appsettings.crypto.international.yaml:/app/etc/appsettings.crypto.yaml:ro
+      - ../../etc/crypto-plugins-manifest.json:/app/etc/crypto-plugins-manifest.json:ro
+      - concelier-jobs:/app/jobs
+    ports:
+      - "${CONCELIER_PORT:-8443}:8443"
+    networks:
+      - stellaops
+    labels: *release-labels
+
+  scanner:
+    image: registry.stella-ops.org/stellaops/scanner:international
+    restart: unless-stopped
+    depends_on:
+      - postgres
+    environment:
+      <<: *crypto-env
+      STELLAOPS_SCANNER__STORAGE__DRIVER: "postgres"
+      STELLAOPS_SCANNER__STORAGE__POSTGRES__CONNECTIONSTRING: "Host=postgres;Port=5432;Database=${POSTGRES_DB:-stellaops_platform};Username=${POSTGRES_USER:-stellaops};Password=${POSTGRES_PASSWORD:-stellaops}"
+    volumes:
+      - ../../etc/appsettings.crypto.international.yaml:/app/etc/appsettings.crypto.yaml:ro
+      - ../../etc/crypto-plugins-manifest.json:/app/etc/crypto-plugins-manifest.json:ro
+    ports:
+      - "${SCANNER_PORT:-8444}:8444"
+    networks:
+      - stellaops
+    labels: *release-labels
+
+  excititor:
+    image: registry.stella-ops.org/stellaops/excititor:international
+    restart: unless-stopped
+    depends_on:
+      - postgres
+    environment:
+      <<: *crypto-env
+      STELLAOPS_EXCITITOR__STORAGE__DRIVER: "postgres"
+      STELLAOPS_EXCITITOR__STORAGE__POSTGRES__CONNECTIONSTRING: "Host=postgres;Port=5432;Database=${POSTGRES_DB:-stellaops_platform};Username=${POSTGRES_USER:-stellaops};Password=${POSTGRES_PASSWORD:-stellaops}"
+    volumes:
+      - ../../etc/appsettings.crypto.international.yaml:/app/etc/appsettings.crypto.yaml:ro
+      - ../../etc/crypto-plugins-manifest.json:/app/etc/crypto-plugins-manifest.json:ro
+    ports:
+      - "${EXCITITOR_PORT:-8445}:8445"
+    networks:
+      - stellaops
+    labels: *release-labels
+
+  policy:
+    image: registry.stella-ops.org/stellaops/policy:international
+    restart: unless-stopped
+    depends_on:
+      - postgres
+    environment:
+      <<: *crypto-env
+      STELLAOPS_POLICY__STORAGE__DRIVER: "postgres"
+      STELLAOPS_POLICY__STORAGE__POSTGRES__CONNECTIONSTRING: "Host=postgres;Port=5432;Database=${POSTGRES_DB:-stellaops_platform};Username=${POSTGRES_USER:-stellaops};Password=${POSTGRES_PASSWORD:-stellaops}"
+    volumes:
+      - ../../etc/appsettings.crypto.international.yaml:/app/etc/appsettings.crypto.yaml:ro
+      - ../../etc/crypto-plugins-manifest.json:/app/etc/crypto-plugins-manifest.json:ro
+    ports:
+      - "${POLICY_PORT:-8446}:8446"
+    networks:
+      - stellaops
+    labels: *release-labels
+
+  scheduler:
+    image: registry.stella-ops.org/stellaops/scheduler:international
+    restart: unless-stopped
+    depends_on:
+      - postgres
+      - nats
+    environment:
+      <<: *crypto-env
+      STELLAOPS_SCHEDULER__STORAGE__DRIVER: "postgres"
+      STELLAOPS_SCHEDULER__STORAGE__POSTGRES__CONNECTIONSTRING: "Host=postgres;Port=5432;Database=${POSTGRES_DB:-stellaops_platform};Username=${POSTGRES_USER:-stellaops};Password=${POSTGRES_PASSWORD:-stellaops}"
+      STELLAOPS_SCHEDULER__MESSAGING__NATS__URL: "nats://nats:4222"
+    volumes:
+      - ../../etc/appsettings.crypto.international.yaml:/app/etc/appsettings.crypto.yaml:ro
+      - ../../etc/crypto-plugins-manifest.json:/app/etc/crypto-plugins-manifest.json:ro
+    ports:
+      - "${SCHEDULER_PORT:-8447}:8447"
+    networks:
+      - stellaops
+    labels: *release-labels
+
+  notify:
+    image: registry.stella-ops.org/stellaops/notify:international
+    restart: unless-stopped
+    depends_on:
+      - postgres
+    environment:
+      <<: *crypto-env
+      STELLAOPS_NOTIFY__STORAGE__DRIVER: "postgres"
+      STELLAOPS_NOTIFY__STORAGE__POSTGRES__CONNECTIONSTRING: "Host=postgres;Port=5432;Database=${POSTGRES_DB:-stellaops_platform};Username=${POSTGRES_USER:-stellaops};Password=${POSTGRES_PASSWORD:-stellaops}"
+    volumes:
+      - ../../etc/appsettings.crypto.international.yaml:/app/etc/appsettings.crypto.yaml:ro
+      - ../../etc/crypto-plugins-manifest.json:/app/etc/crypto-plugins-manifest.json:ro
+    ports:
+      - "${NOTIFY_PORT:-8448}:8448"
+    networks:
+      - stellaops
+    labels: *release-labels
+
+  zastava:
+    image: registry.stella-ops.org/stellaops/zastava:international
+    restart: unless-stopped
+    depends_on:
+      - postgres
+    environment:
+      <<: *crypto-env
+      STELLAOPS_ZASTAVA__STORAGE__DRIVER: "postgres"
+      STELLAOPS_ZASTAVA__STORAGE__POSTGRES__CONNECTIONSTRING: "Host=postgres;Port=5432;Database=${POSTGRES_DB:-stellaops_platform};Username=${POSTGRES_USER:-stellaops};Password=${POSTGRES_PASSWORD:-stellaops}"
+    volumes:
+      - ../../etc/appsettings.crypto.international.yaml:/app/etc/appsettings.crypto.yaml:ro
+      - ../../etc/crypto-plugins-manifest.json:/app/etc/crypto-plugins-manifest.json:ro
+    ports:
+      - "${ZASTAVA_PORT:-8449}:8449"
+    networks:
+      - stellaops
+    labels: *release-labels
+
+  gateway:
+    image: registry.stella-ops.org/stellaops/gateway:international
+    restart: unless-stopped
+    depends_on:
+      - authority
+      - concelier
+      - scanner
+    environment:
+      <<: *crypto-env
+      STELLAOPS_GATEWAY__AUTHORITY__BASEURL: "http://authority:8440"
+      STELLAOPS_GATEWAY__CONCELIER__BASEURL: "http://concelier:8443"
+      STELLAOPS_GATEWAY__SCANNER__BASEURL: "http://scanner:8444"
+    volumes:
+      - ../../etc/appsettings.crypto.international.yaml:/app/etc/appsettings.crypto.yaml:ro
+      - ../../etc/crypto-plugins-manifest.json:/app/etc/crypto-plugins-manifest.json:ro
+    ports:
+      - "${GATEWAY_PORT:-8080}:8080"
+    networks:
+      - stellaops
+    labels: *release-labels
--- a/devops/compose/docker-compose.mirror.yaml
+++ b/devops/compose/docker-compose.mirror.yaml
@@ -0,0 +1,152 @@
+x-release-labels: &release-labels
+  com.stellaops.release.version: "2025.10.0-edge"
+  com.stellaops.release.channel: "edge"
+  com.stellaops.profile: "mirror-managed"
+
+networks:
+  mirror:
+    driver: bridge
+
+volumes:
+  mongo-data:
+  minio-data:
+  concelier-jobs:
+  concelier-exports:
+  excititor-exports:
+  nginx-cache:
+
+services:
+  mongo:
+    image: docker.io/library/mongo@sha256:c258b26dbb7774f97f52aff52231ca5f228273a84329c5f5e451c3739457db49
+    command: ["mongod", "--bind_ip_all"]
+    restart: unless-stopped
+    environment:
+      MONGO_INITDB_ROOT_USERNAME: "${MONGO_INITDB_ROOT_USERNAME:-stellaops_mirror}"
+      MONGO_INITDB_ROOT_PASSWORD: "${MONGO_INITDB_ROOT_PASSWORD:-mirror-password}"
+    volumes:
+      - mongo-data:/data/db
+    networks:
+      - mirror
+    labels: *release-labels
+
+  minio:
+    image: docker.io/minio/minio@sha256:14cea493d9a34af32f524e538b8346cf79f3321eff8e708c1e2960462bd8936e
+    command: ["server", "/data", "--console-address", ":9001"]
+    restart: unless-stopped
+    environment:
+      MINIO_ROOT_USER: "${MINIO_ROOT_USER:-stellaops-mirror}"
+      MINIO_ROOT_PASSWORD: "${MINIO_ROOT_PASSWORD:-mirror-minio-secret}"
+    volumes:
+      - minio-data:/data
+    networks:
+      - mirror
+    labels: *release-labels
+
+  concelier:
+    image: registry.stella-ops.org/stellaops/concelier@sha256:dafef3954eb4b837e2c424dd2d23e1e4d60fa83794840fac9cd3dea1d43bd085
+    restart: unless-stopped
+    depends_on:
+      - mongo
+      - minio
+    environment:
+      ASPNETCORE_URLS: "http://+:8445"
+      CONCELIER__STORAGE__MONGO__CONNECTIONSTRING: "mongodb://${MONGO_INITDB_ROOT_USERNAME:-stellaops_mirror}:${MONGO_INITDB_ROOT_PASSWORD:-mirror-password}@mongo:27017/concelier?authSource=admin"
+      CONCELIER__STORAGE__S3__ENDPOINT: "http://minio:9000"
+      CONCELIER__STORAGE__S3__ACCESSKEYID: "${MINIO_ROOT_USER:-stellaops-mirror}"
+      CONCELIER__STORAGE__S3__SECRETACCESSKEY: "${MINIO_ROOT_PASSWORD:-mirror-minio-secret}"
+      CONCELIER__TELEMETRY__SERVICENAME: "stellaops-concelier-mirror"
+      CONCELIER__MIRROR__ENABLED: "true"
+      CONCELIER__MIRROR__EXPORTROOT: "/exports/json"
+      CONCELIER__MIRROR__LATESTDIRECTORYNAME: "${CONCELIER_MIRROR_LATEST_SEGMENT:-latest}"
+      CONCELIER__MIRROR__MIRRORDIRECTORYNAME: "${CONCELIER_MIRROR_DIRECTORY_SEGMENT:-mirror}"
+      CONCELIER__MIRROR__REQUIREAUTHENTICATION: "${CONCELIER_MIRROR_REQUIRE_AUTH:-true}"
+      CONCELIER__MIRROR__MAXINDEXREQUESTSPERHOUR: "${CONCELIER_MIRROR_INDEX_BUDGET:-600}"
+      CONCELIER__MIRROR__DOMAINS__0__ID: "${CONCELIER_MIRROR_DOMAIN_PRIMARY_ID:-primary}"
+      CONCELIER__MIRROR__DOMAINS__0__DISPLAYNAME: "${CONCELIER_MIRROR_DOMAIN_PRIMARY_NAME:-Primary Mirror}"
+      CONCELIER__MIRROR__DOMAINS__0__REQUIREAUTHENTICATION: "${CONCELIER_MIRROR_DOMAIN_PRIMARY_AUTH:-true}"
+      CONCELIER__MIRROR__DOMAINS__0__MAXDOWNLOADREQUESTSPERHOUR: "${CONCELIER_MIRROR_DOMAIN_PRIMARY_DOWNLOAD_BUDGET:-3600}"
+      CONCELIER__MIRROR__DOMAINS__1__ID: "${CONCELIER_MIRROR_DOMAIN_SECONDARY_ID:-community}"
+      CONCELIER__MIRROR__DOMAINS__1__DISPLAYNAME: "${CONCELIER_MIRROR_DOMAIN_SECONDARY_NAME:-Community Mirror}"
+      CONCELIER__MIRROR__DOMAINS__1__REQUIREAUTHENTICATION: "${CONCELIER_MIRROR_DOMAIN_SECONDARY_AUTH:-false}"
+      CONCELIER__MIRROR__DOMAINS__1__MAXDOWNLOADREQUESTSPERHOUR: "${CONCELIER_MIRROR_DOMAIN_SECONDARY_DOWNLOAD_BUDGET:-1800}"
+      CONCELIER__AUTHORITY__ENABLED: "${CONCELIER_AUTHORITY_ENABLED:-true}"
+      CONCELIER__AUTHORITY__ALLOWANONYMOUSFALLBACK: "${CONCELIER_AUTHORITY_ALLOW_ANON:-false}"
+      CONCELIER__AUTHORITY__ISSUER: "${CONCELIER_AUTHORITY_ISSUER:-https://authority.stella-ops.org}"
+      CONCELIER__AUTHORITY__METADATAADDRESS: "${CONCELIER_AUTHORITY_METADATA:-}"
+      CONCELIER__AUTHORITY__CLIENTID: "${CONCELIER_AUTHORITY_CLIENT_ID:-stellaops-concelier-mirror}"
+      CONCELIER__AUTHORITY__CLIENTSECRETFILE: "/run/secrets/concelier-authority-client"
+      CONCELIER__AUTHORITY__CLIENTSCOPES__0: "${CONCELIER_AUTHORITY_SCOPE:-concelier.mirror.read}"
+      CONCELIER__AUTHORITY__AUDIENCES__0: "${CONCELIER_AUTHORITY_AUDIENCE:-api://concelier.mirror}"
+      CONCELIER__AUTHORITY__BYPASSNETWORKS__0: "10.0.0.0/8"
+      CONCELIER__AUTHORITY__BYPASSNETWORKS__1: "127.0.0.1/32"
+      CONCELIER__AUTHORITY__BYPASSNETWORKS__2: "::1/128"
+      CONCELIER__AUTHORITY__RESILIENCE__ENABLERETRIES: "true"
+      CONCELIER__AUTHORITY__RESILIENCE__RETRYDELAYS__0: "00:00:01"
+      CONCELIER__AUTHORITY__RESILIENCE__RETRYDELAYS__1: "00:00:02"
+      CONCELIER__AUTHORITY__RESILIENCE__RETRYDELAYS__2: "00:00:05"
+      CONCELIER__AUTHORITY__RESILIENCE__ALLOWOFFLINECACHEFALLBACK: "true"
+      CONCELIER__AUTHORITY__RESILIENCE__OFFLINECACHETOLERANCE: "00:10:00"
+    volumes:
+      - concelier-jobs:/var/lib/concelier/jobs
+      - concelier-exports:/exports/json
+      - ./mirror-secrets:/run/secrets:ro
+    networks:
+      - mirror
+    labels: *release-labels
+
+  excititor:
+    image: registry.stella-ops.org/stellaops/excititor@sha256:d9bd5cadf1eab427447ce3df7302c30ded837239771cc6433b9befb895054285
+    restart: unless-stopped
+    depends_on:
+      - mongo
+    environment:
+      ASPNETCORE_URLS: "http://+:8448"
+      EXCITITOR__STORAGE__MONGO__CONNECTIONSTRING: "mongodb://${MONGO_INITDB_ROOT_USERNAME:-stellaops_mirror}:${MONGO_INITDB_ROOT_PASSWORD:-mirror-password}@mongo:27017/excititor?authSource=admin"
+      EXCITITOR__STORAGE__MONGO__DATABASENAME: "${EXCITITOR_MONGO_DATABASE:-excititor}"
+      EXCITITOR__ARTIFACTS__FILESYSTEM__ROOT: "/exports"
+      EXCITITOR__ARTIFACTS__FILESYSTEM__OVERWRITEEXISTING: "${EXCITITOR_FILESYSTEM_OVERWRITE:-false}"
+      EXCITITOR__MIRROR__DOMAINS__0__ID: "${EXCITITOR_MIRROR_DOMAIN_PRIMARY_ID:-primary}"
+      EXCITITOR__MIRROR__DOMAINS__0__DISPLAYNAME: "${EXCITITOR_MIRROR_DOMAIN_PRIMARY_NAME:-Primary Mirror}"
+      EXCITITOR__MIRROR__DOMAINS__0__REQUIREAUTHENTICATION: "${EXCITITOR_MIRROR_DOMAIN_PRIMARY_AUTH:-true}"
+      EXCITITOR__MIRROR__DOMAINS__0__MAXINDEXREQUESTSPERHOUR: "${EXCITITOR_MIRROR_DOMAIN_PRIMARY_INDEX_BUDGET:-300}"
+      EXCITITOR__MIRROR__DOMAINS__0__MAXDOWNLOADREQUESTSPERHOUR: "${EXCITITOR_MIRROR_DOMAIN_PRIMARY_DOWNLOAD_BUDGET:-2400}"
+      EXCITITOR__MIRROR__DOMAINS__0__EXPORTS__0__KEY: "${EXCITITOR_MIRROR_PRIMARY_EXPORT_CONSENSUS_KEY:-consensus-json}"
+      EXCITITOR__MIRROR__DOMAINS__0__EXPORTS__0__FORMAT: "${EXCITITOR_MIRROR_PRIMARY_EXPORT_CONSENSUS_FORMAT:-json}"
+      EXCITITOR__MIRROR__DOMAINS__0__EXPORTS__0__VIEW: "${EXCITITOR_MIRROR_PRIMARY_EXPORT_CONSENSUS_VIEW:-consensus}"
+      EXCITITOR__MIRROR__DOMAINS__0__EXPORTS__1__KEY: "${EXCITITOR_MIRROR_PRIMARY_EXPORT_OPENVEX_KEY:-consensus-openvex}"
+      EXCITITOR__MIRROR__DOMAINS__0__EXPORTS__1__FORMAT: "${EXCITITOR_MIRROR_PRIMARY_EXPORT_OPENVEX_FORMAT:-openvex}"
+      EXCITITOR__MIRROR__DOMAINS__0__EXPORTS__1__VIEW: "${EXCITITOR_MIRROR_PRIMARY_EXPORT_OPENVEX_VIEW:-consensus}"
+      EXCITITOR__MIRROR__DOMAINS__1__ID: "${EXCITITOR_MIRROR_DOMAIN_SECONDARY_ID:-community}"
+      EXCITITOR__MIRROR__DOMAINS__1__DISPLAYNAME: "${EXCITITOR_MIRROR_DOMAIN_SECONDARY_NAME:-Community Mirror}"
+      EXCITITOR__MIRROR__DOMAINS__1__REQUIREAUTHENTICATION: "${EXCITITOR_MIRROR_DOMAIN_SECONDARY_AUTH:-false}"
+      EXCITITOR__MIRROR__DOMAINS__1__MAXINDEXREQUESTSPERHOUR: "${EXCITITOR_MIRROR_DOMAIN_SECONDARY_INDEX_BUDGET:-120}"
+      EXCITITOR__MIRROR__DOMAINS__1__MAXDOWNLOADREQUESTSPERHOUR: "${EXCITITOR_MIRROR_DOMAIN_SECONDARY_DOWNLOAD_BUDGET:-600}"
+      EXCITITOR__MIRROR__DOMAINS__1__EXPORTS__0__KEY: "${EXCITITOR_MIRROR_SECONDARY_EXPORT_KEY:-community-consensus}"
+      EXCITITOR__MIRROR__DOMAINS__1__EXPORTS__0__FORMAT: "${EXCITITOR_MIRROR_SECONDARY_EXPORT_FORMAT:-json}"
+      EXCITITOR__MIRROR__DOMAINS__1__EXPORTS__0__VIEW: "${EXCITITOR_MIRROR_SECONDARY_EXPORT_VIEW:-consensus}"
+    volumes:
+      - excititor-exports:/exports
+      - ./mirror-secrets:/run/secrets:ro
+    expose:
+      - "8448"
+    networks:
+      - mirror
+    labels: *release-labels
+
+  mirror-gateway:
+    image: docker.io/library/nginx@sha256:208b70eefac13ee9be00e486f79c695b15cef861c680527171a27d253d834be9
+    restart: unless-stopped
+    depends_on:
+      - concelier
+      - excititor
+    ports:
+      - "${MIRROR_GATEWAY_HTTP_PORT:-8080}:80"
+      - "${MIRROR_GATEWAY_HTTPS_PORT:-9443}:443"
+    volumes:
+      - nginx-cache:/var/cache/nginx
+      - ./mirror-gateway/conf.d:/etc/nginx/conf.d:ro
+      - ./mirror-gateway/tls:/etc/nginx/tls:ro
+      - ./mirror-gateway/secrets:/etc/nginx/secrets:ro
+    networks:
+      - mirror
+    labels: *release-labels
--- a/devops/compose/docker-compose.mock.yaml
+++ b/devops/compose/docker-compose.mock.yaml
@@ -0,0 +1,90 @@
+x-release-labels: &release-labels
+  com.stellaops.release.version: "2025.09.2-mock"
+  com.stellaops.release.channel: "dev-mock"
+  com.stellaops.profile: "mock-overlay"
+
+services:
+  orchestrator:
+    image: registry.stella-ops.org/stellaops/orchestrator@sha256:97f12856ce870bafd3328bda86833bcccbf56d255941d804966b5557f6610119
+    command: ["dotnet", "StellaOps.Orchestrator.WebService.dll"]
+    depends_on:
+      - mongo
+      - nats
+    labels: *release-labels
+    networks: [stellaops]
+
+  policy-registry:
+    image: registry.stella-ops.org/stellaops/policy-registry@sha256:c6cad8055e9827ebcbebb6ad4d6866dce4b83a0a49b0a8a6500b736a5cb26fa7
+    command: ["dotnet", "StellaOps.Policy.Engine.dll"]
+    depends_on:
+      - mongo
+    labels: *release-labels
+    networks: [stellaops]
+
+  vex-lens:
+    image: registry.stella-ops.org/stellaops/vex-lens@sha256:b44e63ecfeebc345a70c073c1ce5ace709c58be0ffaad0e2862758aeee3092fb
+    command: ["dotnet", "StellaOps.VexLens.dll"]
+    depends_on:
+      - mongo
+    labels: *release-labels
+    networks: [stellaops]
+
+  issuer-directory:
+    image: registry.stella-ops.org/stellaops/issuer-directory@sha256:67e8ef02c97d3156741e857756994888f30c373ace8e84886762edba9dc51914
+    command: ["dotnet", "StellaOps.IssuerDirectory.Web.dll"]
+    depends_on:
+      - mongo
+      - authority
+    labels: *release-labels
+    networks: [stellaops]
+
+  findings-ledger:
+    image: registry.stella-ops.org/stellaops/findings-ledger@sha256:71d4c361ba8b2f8b69d652597bc3f2efc8a64f93fab854ce25272a88506df49c
+    command: ["dotnet", "StellaOps.Findings.Ledger.WebService.dll"]
+    depends_on:
+      - postgres
+      - authority
+    labels: *release-labels
+    networks: [stellaops]
+
+  vuln-explorer-api:
+    image: registry.stella-ops.org/stellaops/vuln-explorer-api@sha256:7fc7e43a05cbeb0106ce7d4d634612e83de6fdc119aaab754a71c1d60b82841d
+    command: ["dotnet", "StellaOps.VulnExplorer.Api.dll"]
+    depends_on:
+      - findings-ledger
+      - authority
+    labels: *release-labels
+    networks: [stellaops]
+
+  packs-registry:
+    image: registry.stella-ops.org/stellaops/packs-registry@sha256:1f5e9416c4dc608594ad6fad87c24d72134427f899c192b494e22b268499c791
+    command: ["dotnet", "StellaOps.PacksRegistry.dll"]
+    depends_on:
+      - mongo
+    labels: *release-labels
+    networks: [stellaops]
+
+  task-runner:
+    image: registry.stella-ops.org/stellaops/task-runner@sha256:eb5ad992b49a41554f41516be1a6afcfa6522faf2111c08ff2b3664ad2fc954b
+    command: ["dotnet", "StellaOps.TaskRunner.WebService.dll"]
+    depends_on:
+      - packs-registry
+      - postgres
+    labels: *release-labels
+    networks: [stellaops]
+
+  cryptopro-csp:
+    build:
+      context: ../..
+      dockerfile: ops/cryptopro/linux-csp-service/Dockerfile
+      args:
+        CRYPTOPRO_ACCEPT_EULA: "${CRYPTOPRO_ACCEPT_EULA:-0}"
+    environment:
+      ASPNETCORE_URLS: "http://0.0.0.0:8080"
+      CRYPTOPRO_ACCEPT_EULA: "${CRYPTOPRO_ACCEPT_EULA:-0}"
+    volumes:
+      - ../../opt/cryptopro/downloads:/opt/cryptopro/downloads:ro
+    ports:
+      - "${CRYPTOPRO_PORT:-18080}:8080"
+    labels: *release-labels
+    networks: [stellaops]
--- a/devops/compose/docker-compose.prod.yaml
+++ b/devops/compose/docker-compose.prod.yaml
@@ -0,0 +1,380 @@
+x-release-labels: &release-labels
+  com.stellaops.release.version: "2025.09.2"
+  com.stellaops.release.channel: "stable"
+  com.stellaops.profile: "prod"
+
+networks:
+  stellaops:
+    driver: bridge
+  frontdoor:
+    external: true
+    name: ${FRONTDOOR_NETWORK:-stellaops_frontdoor}
+
+volumes:
+  valkey-data:
+  rustfs-data:
+  concelier-jobs:
+  nats-data:
+  scanner-surface-cache:
+  postgres-data:
+  advisory-ai-queue:
+  advisory-ai-plans:
+  advisory-ai-outputs:
+
+services:
+  valkey:
+    image: docker.io/valkey/valkey:8.0
+    restart: unless-stopped
+    command: ["valkey-server", "--appendonly", "yes"]
+    volumes:
+      - valkey-data:/data
+    ports:
+      - "${VALKEY_PORT:-6379}:6379"
+    networks:
+      - stellaops
+    labels: *release-labels
+
+  rustfs:
+    image: registry.stella-ops.org/stellaops/rustfs:2025.10.0-edge
+    command: ["serve", "--listen", "0.0.0.0:8080", "--root", "/data"]
+    restart: unless-stopped
+    environment:
+      RUSTFS__LOG__LEVEL: info
+      RUSTFS__STORAGE__PATH: /data
+    volumes:
+      - rustfs-data:/data
+    ports:
+      - "${RUSTFS_HTTP_PORT:-8080}:8080"
+    networks:
+      - stellaops
+    labels: *release-labels
+
+  nats:
+    image: docker.io/library/nats@sha256:c82559e4476289481a8a5196e675ebfe67eea81d95e5161e3e78eccfe766608e
+    command:
+      - "-js"
+      - "-sd"
+      - /data
+    restart: unless-stopped
+    ports:
+      - "${NATS_CLIENT_PORT:-4222}:4222"
+    volumes:
+      - nats-data:/data
+    networks:
+      - stellaops
+    labels: *release-labels
+
+  authority:
+    image: registry.stella-ops.org/stellaops/authority@sha256:b0348bad1d0b401cc3c71cb40ba034c8043b6c8874546f90d4783c9dbfcc0bf5
+    restart: unless-stopped
+    depends_on:
+      - postgres
+      - valkey
+    environment:
+      STELLAOPS_AUTHORITY__ISSUER: "${AUTHORITY_ISSUER}"
+      STELLAOPS_AUTHORITY__STORAGE__DRIVER: "postgres"
+      STELLAOPS_AUTHORITY__STORAGE__POSTGRES__CONNECTIONSTRING: "Host=postgres;Port=5432;Database=${POSTGRES_DB:-stellaops_platform};Username=${POSTGRES_USER:-stellaops};Password=${POSTGRES_PASSWORD:-stellaops}"
+      STELLAOPS_AUTHORITY__CACHE__REDIS__CONNECTIONSTRING: "valkey:6379"
+      STELLAOPS_AUTHORITY__PLUGINDIRECTORIES__0: "/app/plugins"
+      STELLAOPS_AUTHORITY__PLUGINS__CONFIGURATIONDIRECTORY: "/app/etc/authority.plugins"
+    volumes:
+      - ../../etc/authority.yaml:/etc/authority.yaml:ro
+      - ../../etc/authority.plugins:/app/etc/authority.plugins:ro
+    ports:
+      - "${AUTHORITY_PORT:-8440}:8440"
+    networks:
+      - stellaops
+      - frontdoor
+    labels: *release-labels
+
+  signer:
+    image: registry.stella-ops.org/stellaops/signer@sha256:8ad574e61f3a9e9bda8a58eb2700ae46813284e35a150b1137bc7c2b92ac0f2e
+    restart: unless-stopped
+    depends_on:
+      - postgres
+      - authority
+    environment:
+      SIGNER__AUTHORITY__BASEURL: "https://authority:8440"
+      SIGNER__POE__INTROSPECTURL: "${SIGNER_POE_INTROSPECT_URL}"
+      SIGNER__STORAGE__DRIVER: "postgres"
+      SIGNER__STORAGE__POSTGRES__CONNECTIONSTRING: "Host=postgres;Port=5432;Database=${POSTGRES_DB:-stellaops_platform};Username=${POSTGRES_USER:-stellaops};Password=${POSTGRES_PASSWORD:-stellaops}"
+    ports:
+      - "${SIGNER_PORT:-8441}:8441"
+    networks:
+      - stellaops
+      - frontdoor
+    labels: *release-labels
+
+  attestor:
+    image: registry.stella-ops.org/stellaops/attestor@sha256:0534985f978b0b5d220d73c96fddd962cd9135f616811cbe3bff4666c5af568f
+    restart: unless-stopped
+    depends_on:
+      - signer
+      - postgres
+    environment:
+      ATTESTOR__SIGNER__BASEURL: "https://signer:8441"
+      ATTESTOR__STORAGE__DRIVER: "postgres"
+      ATTESTOR__STORAGE__POSTGRES__CONNECTIONSTRING: "Host=postgres;Port=5432;Database=${POSTGRES_DB:-stellaops_platform};Username=${POSTGRES_USER:-stellaops};Password=${POSTGRES_PASSWORD:-stellaops}"
+    ports:
+      - "${ATTESTOR_PORT:-8442}:8442"
+    networks:
+      - stellaops
+      - frontdoor
+    labels: *release-labels
+
+  postgres:
+    image: docker.io/library/postgres:16
+    restart: unless-stopped
+    environment:
+      POSTGRES_USER: "${POSTGRES_USER:-stellaops}"
+      POSTGRES_PASSWORD: "${POSTGRES_PASSWORD:-stellaops}"
+      POSTGRES_DB: "${POSTGRES_DB:-stellaops_platform}"
+      PGDATA: /var/lib/postgresql/data/pgdata
+    volumes:
+      - postgres-data:/var/lib/postgresql/data
+    ports:
+      - "${POSTGRES_PORT:-5432}:5432"
+    networks:
+      - stellaops
+    labels: *release-labels
+
+  issuer-directory:
+    image: registry.stella-ops.org/stellaops/issuer-directory-web:2025.10.0-edge
+    restart: unless-stopped
+    depends_on:
+      - postgres
+      - authority
+    environment:
+      ISSUERDIRECTORY__CONFIG: "/etc/issuer-directory.yaml"
+      ISSUERDIRECTORY__AUTHORITY__ISSUER: "${AUTHORITY_ISSUER}"
+      ISSUERDIRECTORY__AUTHORITY__BASEURL: "https://authority:8440"
+      ISSUERDIRECTORY__STORAGE__DRIVER: "postgres"
+      ISSUERDIRECTORY__STORAGE__POSTGRES__CONNECTIONSTRING: "Host=postgres;Port=5432;Database=${POSTGRES_DB:-stellaops_platform};Username=${POSTGRES_USER:-stellaops};Password=${POSTGRES_PASSWORD:-stellaops}"
+      ISSUERDIRECTORY__SEEDCSAFPUBLISHERS: "${ISSUER_DIRECTORY_SEED_CSAF:-true}"
+    volumes:
+      - ../../etc/issuer-directory.yaml:/etc/issuer-directory.yaml:ro
+    ports:
+      - "${ISSUER_DIRECTORY_PORT:-8447}:8080"
+    networks:
+      - stellaops
+    labels: *release-labels
+
+  concelier:
+    image: registry.stella-ops.org/stellaops/concelier@sha256:c58cdcaee1d266d68d498e41110a589dd204b487d37381096bd61ab345a867c5
+    restart: unless-stopped
+    depends_on:
+      - postgres
+      - valkey
+    environment:
+      CONCELIER__STORAGE__DRIVER: "postgres"
+      CONCELIER__STORAGE__POSTGRES__CONNECTIONSTRING: "Host=postgres;Port=5432;Database=${POSTGRES_DB:-stellaops_platform};Username=${POSTGRES_USER:-stellaops};Password=${POSTGRES_PASSWORD:-stellaops}"
+      CONCELIER__STORAGE__S3__ENDPOINT: "http://rustfs:8080"
+      CONCELIER__AUTHORITY__BASEURL: "https://authority:8440"
+      CONCELIER__AUTHORITY__RESILIENCE__ALLOWOFFLINECACHEFALLBACK: "true"
+      CONCELIER__AUTHORITY__RESILIENCE__OFFLINECACHETOLERANCE: "${AUTHORITY_OFFLINE_CACHE_TOLERANCE:-00:30:00}"
+    volumes:
+      - concelier-jobs:/var/lib/concelier/jobs
+    ports:
+      - "${CONCELIER_PORT:-8445}:8445"
+    networks:
+      - stellaops
+      - frontdoor
+    labels: *release-labels
+
+  scanner-web:
+    image: registry.stella-ops.org/stellaops/scanner-web@sha256:14b23448c3f9586a9156370b3e8c1991b61907efa666ca37dd3aaed1e79fe3b7
+    restart: unless-stopped
+    depends_on:
+      - postgres
+      - valkey
+      - concelier
+      - rustfs
+    environment:
+      SCANNER__STORAGE__DRIVER: "postgres"
+      SCANNER__STORAGE__POSTGRES__CONNECTIONSTRING: "Host=postgres;Port=5432;Database=${POSTGRES_DB:-stellaops_platform};Username=${POSTGRES_USER:-stellaops};Password=${POSTGRES_PASSWORD:-stellaops}"
+      SCANNER__CACHE__REDIS__CONNECTIONSTRING: "valkey:6379"
+      SCANNER__ARTIFACTSTORE__DRIVER: "rustfs"
+      SCANNER__ARTIFACTSTORE__ENDPOINT: "http://rustfs:8080/api/v1"
+      SCANNER__ARTIFACTSTORE__BUCKET: "scanner-artifacts"
+      SCANNER__ARTIFACTSTORE__TIMEOUTSECONDS: "30"
+      SCANNER__QUEUE__BROKER: "${SCANNER_QUEUE_BROKER:-valkey://valkey:6379}"
+      SCANNER__EVENTS__ENABLED: "${SCANNER_EVENTS_ENABLED:-false}"
+      SCANNER__EVENTS__DRIVER: "${SCANNER_EVENTS_DRIVER:-valkey}"
+      SCANNER__EVENTS__DSN: "${SCANNER_EVENTS_DSN:-}"
+      SCANNER__EVENTS__STREAM: "${SCANNER_EVENTS_STREAM:-stella.events}"
+      SCANNER__EVENTS__PUBLISHTIMEOUTSECONDS: "${SCANNER_EVENTS_PUBLISH_TIMEOUT_SECONDS:-5}"
+      SCANNER__EVENTS__MAXSTREAMLENGTH: "${SCANNER_EVENTS_MAX_STREAM_LENGTH:-10000}"
+      SCANNER__OFFLINEKIT__ENABLED: "${SCANNER_OFFLINEKIT_ENABLED:-false}"
+      SCANNER__OFFLINEKIT__REQUIREDSSE: "${SCANNER_OFFLINEKIT_REQUIREDSSE:-true}"
+      SCANNER__OFFLINEKIT__REKOROFFLINEMODE: "${SCANNER_OFFLINEKIT_REKOROFFLINEMODE:-true}"
+      SCANNER__OFFLINEKIT__TRUSTROOTDIRECTORY: "${SCANNER_OFFLINEKIT_TRUSTROOTDIRECTORY:-/etc/stellaops/trust-roots}"
+      SCANNER__OFFLINEKIT__REKORSNAPSHOTDIRECTORY: "${SCANNER_OFFLINEKIT_REKORSNAPSHOTDIRECTORY:-/var/lib/stellaops/rekor-snapshot}"
+      SCANNER_SURFACE_FS_ENDPOINT: "${SCANNER_SURFACE_FS_ENDPOINT:-http://rustfs:8080}"
+      SCANNER_SURFACE_FS_BUCKET: "${SCANNER_SURFACE_FS_BUCKET:-surface-cache}"
+      SCANNER_SURFACE_CACHE_ROOT: "${SCANNER_SURFACE_CACHE_ROOT:-/var/lib/stellaops/surface}"
+      SCANNER_SURFACE_CACHE_QUOTA_MB: "${SCANNER_SURFACE_CACHE_QUOTA_MB:-4096}"
+      SCANNER_SURFACE_PREFETCH_ENABLED: "${SCANNER_SURFACE_PREFETCH_ENABLED:-false}"
+      SCANNER_SURFACE_TENANT: "${SCANNER_SURFACE_TENANT:-default}"
+      SCANNER_SURFACE_FEATURES: "${SCANNER_SURFACE_FEATURES:-}"
+      SCANNER_SURFACE_SECRETS_PROVIDER: "${SCANNER_SURFACE_SECRETS_PROVIDER:-file}"
+      SCANNER_SURFACE_SECRETS_NAMESPACE: "${SCANNER_SURFACE_SECRETS_NAMESPACE:-}"
+      SCANNER_SURFACE_SECRETS_ROOT: "${SCANNER_SURFACE_SECRETS_ROOT:-/etc/stellaops/secrets}"
+      SCANNER_SURFACE_SECRETS_FALLBACK_PROVIDER: "${SCANNER_SURFACE_SECRETS_FALLBACK_PROVIDER:-}"
+      SCANNER_SURFACE_SECRETS_ALLOW_INLINE: "${SCANNER_SURFACE_SECRETS_ALLOW_INLINE:-false}"
+    volumes:
+      - scanner-surface-cache:/var/lib/stellaops/surface
+      - ${SURFACE_SECRETS_HOST_PATH:-./offline/surface-secrets}:${SCANNER_SURFACE_SECRETS_ROOT:-/etc/stellaops/secrets}:ro
+      - ${SCANNER_OFFLINEKIT_TRUSTROOTS_HOST_PATH:-./offline/trust-roots}:${SCANNER_OFFLINEKIT_TRUSTROOTDIRECTORY:-/etc/stellaops/trust-roots}:ro
+      - ${SCANNER_OFFLINEKIT_REKOR_SNAPSHOT_HOST_PATH:-./offline/rekor-snapshot}:${SCANNER_OFFLINEKIT_REKORSNAPSHOTDIRECTORY:-/var/lib/stellaops/rekor-snapshot}:ro
+    ports:
+      - "${SCANNER_WEB_PORT:-8444}:8444"
+    networks:
+      - stellaops
+      - frontdoor
+    labels: *release-labels
+
+  scanner-worker:
+    image: registry.stella-ops.org/stellaops/scanner-worker@sha256:32e25e76386eb9ea8bee0a1ad546775db9a2df989fab61ac877e351881960dab
+    restart: unless-stopped
+    depends_on:
+      - postgres
+      - valkey
+      - scanner-web
+      - rustfs
+    environment:
+      SCANNER__STORAGE__DRIVER: "postgres"
+      SCANNER__STORAGE__POSTGRES__CONNECTIONSTRING: "Host=postgres;Port=5432;Database=${POSTGRES_DB:-stellaops_platform};Username=${POSTGRES_USER:-stellaops};Password=${POSTGRES_PASSWORD:-stellaops}"
+      SCANNER__CACHE__REDIS__CONNECTIONSTRING: "valkey:6379"
+      SCANNER__ARTIFACTSTORE__DRIVER: "rustfs"
+      SCANNER__ARTIFACTSTORE__ENDPOINT: "http://rustfs:8080/api/v1"
+      SCANNER__ARTIFACTSTORE__BUCKET: "scanner-artifacts"
+      SCANNER__ARTIFACTSTORE__TIMEOUTSECONDS: "30"
+      SCANNER__QUEUE__BROKER: "${SCANNER_QUEUE_BROKER:-valkey://valkey:6379}"
+      SCANNER_SURFACE_FS_ENDPOINT: "${SCANNER_SURFACE_FS_ENDPOINT:-http://rustfs:8080}"
+      SCANNER_SURFACE_FS_BUCKET: "${SCANNER_SURFACE_FS_BUCKET:-surface-cache}"
+      SCANNER_SURFACE_CACHE_ROOT: "${SCANNER_SURFACE_CACHE_ROOT:-/var/lib/stellaops/surface}"
+      SCANNER_SURFACE_CACHE_QUOTA_MB: "${SCANNER_SURFACE_CACHE_QUOTA_MB:-4096}"
+      SCANNER_SURFACE_PREFETCH_ENABLED: "${SCANNER_SURFACE_PREFETCH_ENABLED:-false}"
+      SCANNER_SURFACE_TENANT: "${SCANNER_SURFACE_TENANT:-default}"
+      SCANNER_SURFACE_FEATURES: "${SCANNER_SURFACE_FEATURES:-}"
+      SCANNER_SURFACE_SECRETS_PROVIDER: "${SCANNER_SURFACE_SECRETS_PROVIDER:-file}"
+      SCANNER_SURFACE_SECRETS_NAMESPACE: "${SCANNER_SURFACE_SECRETS_NAMESPACE:-}"
+      SCANNER_SURFACE_SECRETS_ROOT: "${SCANNER_SURFACE_SECRETS_ROOT:-/etc/stellaops/secrets}"
+      SCANNER_SURFACE_SECRETS_FALLBACK_PROVIDER: "${SCANNER_SURFACE_SECRETS_FALLBACK_PROVIDER:-}"
+      SCANNER_SURFACE_SECRETS_ALLOW_INLINE: "${SCANNER_SURFACE_SECRETS_ALLOW_INLINE:-false}"
+    volumes:
+      - scanner-surface-cache:/var/lib/stellaops/surface
+      - ${SURFACE_SECRETS_HOST_PATH:-./offline/surface-secrets}:${SCANNER_SURFACE_SECRETS_ROOT:-/etc/stellaops/secrets}:ro
+    networks:
+      - stellaops
+    labels: *release-labels
+
+  scheduler-worker:
+    image: registry.stella-ops.org/stellaops/scheduler-worker:2025.10.0-edge
+    restart: unless-stopped
+    depends_on:
+      - postgres
+      - valkey
+      - scanner-web
+    command:
+      - "dotnet"
+      - "StellaOps.Scheduler.Worker.Host.dll"
+    environment:
+      SCHEDULER__STORAGE__DRIVER: "postgres"
+      SCHEDULER__STORAGE__POSTGRES__CONNECTIONSTRING: "Host=postgres;Port=5432;Database=${POSTGRES_DB:-stellaops_platform};Username=${POSTGRES_USER:-stellaops};Password=${POSTGRES_PASSWORD:-stellaops}"
+      SCHEDULER__QUEUE__KIND: "${SCHEDULER_QUEUE_KIND:-Valkey}"
+      SCHEDULER__QUEUE__VALKEY__URL: "${SCHEDULER_QUEUE_VALKEY_URL:-valkey:6379}"
+      SCHEDULER__WORKER__RUNNER__SCANNER__BASEADDRESS: "${SCHEDULER_SCANNER_BASEADDRESS:-http://scanner-web:8444}"
+    networks:
+      - stellaops
+    labels: *release-labels
+
+  notify-web:
+    image: ${NOTIFY_WEB_IMAGE:-registry.stella-ops.org/stellaops/notify-web:2025.09.2}
+    restart: unless-stopped
+    depends_on:
+      - postgres
+      - authority
+    environment:
+      DOTNET_ENVIRONMENT: Production
+    volumes:
+      - ../../etc/notify.prod.yaml:/app/etc/notify.yaml:ro
+    ports:
+      - "${NOTIFY_WEB_PORT:-8446}:8446"
+    networks:
+      - stellaops
+      - frontdoor
+    labels: *release-labels
+
+  excititor:
+    image: registry.stella-ops.org/stellaops/excititor@sha256:59022e2016aebcef5c856d163ae705755d3f81949d41195256e935ef40a627fa
+    restart: unless-stopped
+    depends_on:
+      - postgres
+      - concelier
+    environment:
+      EXCITITOR__CONCELIER__BASEURL: "https://concelier:8445"
+      EXCITITOR__STORAGE__DRIVER: "postgres"
+      EXCITITOR__STORAGE__POSTGRES__CONNECTIONSTRING: "Host=postgres;Port=5432;Database=${POSTGRES_DB:-stellaops_platform};Username=${POSTGRES_USER:-stellaops};Password=${POSTGRES_PASSWORD:-stellaops}"
+    networks:
+      - stellaops
+    labels: *release-labels
+
+  advisory-ai-web:
+    image: registry.stella-ops.org/stellaops/advisory-ai-web:2025.09.2
+    restart: unless-stopped
+    depends_on:
+      - scanner-web
+    environment:
+      ADVISORYAI__AdvisoryAI__SbomBaseAddress: "${ADVISORY_AI_SBOM_BASEADDRESS:-http://scanner-web:8444}"
+      ADVISORYAI__AdvisoryAI__Queue__DirectoryPath: "/var/lib/advisory-ai/queue"
+      ADVISORYAI__AdvisoryAI__Storage__PlanCacheDirectory: "/var/lib/advisory-ai/plans"
+      ADVISORYAI__AdvisoryAI__Storage__OutputDirectory: "/var/lib/advisory-ai/outputs"
+      ADVISORYAI__AdvisoryAI__Inference__Mode: "${ADVISORY_AI_INFERENCE_MODE:-Local}"
+      ADVISORYAI__AdvisoryAI__Inference__Remote__BaseAddress: "${ADVISORY_AI_REMOTE_BASEADDRESS:-}"
+      ADVISORYAI__AdvisoryAI__Inference__Remote__ApiKey: "${ADVISORY_AI_REMOTE_APIKEY:-}"
+    ports:
+      - "${ADVISORY_AI_WEB_PORT:-8448}:8448"
+    volumes:
+      - advisory-ai-queue:/var/lib/advisory-ai/queue
+      - advisory-ai-plans:/var/lib/advisory-ai/plans
+      - advisory-ai-outputs:/var/lib/advisory-ai/outputs
+    networks:
+      - stellaops
+      - frontdoor
+    labels: *release-labels
+
+  advisory-ai-worker:
+    image: registry.stella-ops.org/stellaops/advisory-ai-worker:2025.09.2
+    restart: unless-stopped
+    depends_on:
+      - advisory-ai-web
+    environment:
+      ADVISORYAI__AdvisoryAI__SbomBaseAddress: "${ADVISORY_AI_SBOM_BASEADDRESS:-http://scanner-web:8444}"
+      ADVISORYAI__AdvisoryAI__Queue__DirectoryPath: "/var/lib/advisory-ai/queue"
+      ADVISORYAI__AdvisoryAI__Storage__PlanCacheDirectory: "/var/lib/advisory-ai/plans"
+      ADVISORYAI__AdvisoryAI__Storage__OutputDirectory: "/var/lib/advisory-ai/outputs"
+      ADVISORYAI__AdvisoryAI__Inference__Mode: "${ADVISORY_AI_INFERENCE_MODE:-Local}"
+      ADVISORYAI__AdvisoryAI__Inference__Remote__BaseAddress: "${ADVISORY_AI_REMOTE_BASEADDRESS:-}"
+      ADVISORYAI__AdvisoryAI__Inference__Remote__ApiKey: "${ADVISORY_AI_REMOTE_APIKEY:-}"
+    volumes:
+      - advisory-ai-queue:/var/lib/advisory-ai/queue
+      - advisory-ai-plans:/var/lib/advisory-ai/plans
+      - advisory-ai-outputs:/var/lib/advisory-ai/outputs
+    networks:
+      - stellaops
+    labels: *release-labels
+
+  web-ui:
+    image: registry.stella-ops.org/stellaops/web-ui@sha256:10d924808c48e4353e3a241da62eb7aefe727a1d6dc830eb23a8e181013b3a23
+    restart: unless-stopped
+    depends_on:
+      - scanner-web
+    environment:
+      STELLAOPS_UI__BACKEND__BASEURL: "https://scanner-web:8444"
+    ports:
+      - "${UI_PORT:-8443}:8443"
+    networks:
+      - stellaops
+      - frontdoor
+    labels: *release-labels
--- a/devops/compose/docker-compose.russia.yml
+++ b/devops/compose/docker-compose.russia.yml
@@ -0,0 +1,301 @@
+# StellaOps Docker Compose - International Profile
+# Cryptography: GOST R 34.10-2012, GOST R 34.11-2012 (Streebog)
+# Provider: openssl.gost, pkcs11.gost, cryptopro.gost
+# Jurisdiction: world
+
+x-release-labels: &release-labels
+  com.stellaops.release.version: "2025.10.0-edge"
+  com.stellaops.release.channel: "edge"
+  com.stellaops.profile: "russia"
+  com.stellaops.crypto.profile: "russia"
+  com.stellaops.crypto.provider: "openssl.gost, pkcs11.gost, cryptopro.gost"
+
+x-crypto-env: &crypto-env
+  # Crypto configuration
+  STELLAOPS_CRYPTO_PROFILE: "russia"
+  STELLAOPS_CRYPTO_CONFIG_PATH: "/app/etc/appsettings.crypto.yaml"
+  STELLAOPS_CRYPTO_MANIFEST_PATH: "/app/etc/crypto-plugins-manifest.json"
+
+networks:
+  stellaops:
+    driver: bridge
+
+volumes:
+  rustfs-data:
+  concelier-jobs:
+  nats-data:
+  valkey-data:
+  advisory-ai-queue:
+  advisory-ai-plans:
+  advisory-ai-outputs:
+  postgres-data:
+
+services:
+  postgres:
+    image: docker.io/library/postgres:16
+    restart: unless-stopped
+    environment:
+      POSTGRES_USER: "${POSTGRES_USER:-stellaops}"
+      POSTGRES_PASSWORD: "${POSTGRES_PASSWORD:-stellaops}"
+      POSTGRES_DB: "${POSTGRES_DB:-stellaops_platform}"
+      PGDATA: /var/lib/postgresql/data/pgdata
+    volumes:
+      - postgres-data:/var/lib/postgresql/data
+      - ../postgres-partitioning:/docker-entrypoint-initdb.d:ro
+    ports:
+      - "${POSTGRES_PORT:-5432}:5432"
+    networks:
+      - stellaops
+    labels: *release-labels
+
+  valkey:
+    image: docker.io/valkey/valkey:8.0
+    restart: unless-stopped
+    command: ["valkey-server", "--appendonly", "yes"]
+    volumes:
+      - valkey-data:/data
+    ports:
+      - "${VALKEY_PORT:-6379}:6379"
+    networks:
+      - stellaops
+    labels: *release-labels
+
+  rustfs:
+    image: registry.stella-ops.org/stellaops/rustfs:2025.10.0-edge
+    command: ["serve", "--listen", "0.0.0.0:8080", "--root", "/data"]
+    restart: unless-stopped
+    environment:
+      RUSTFS__LOG__LEVEL: info
+      RUSTFS__STORAGE__PATH: /data
+    volumes:
+      - rustfs-data:/data
+    ports:
+      - "${RUSTFS_HTTP_PORT:-8080}:8080"
+    networks:
+      - stellaops
+    labels: *release-labels
+
+  nats:
+    image: docker.io/library/nats@sha256:c82559e4476289481a8a5196e675ebfe67eea81d95e5161e3e78eccfe766608e
+    command:
+      - "-js"
+      - "-sd"
+      - /data
+    restart: unless-stopped
+    ports:
+      - "${NATS_CLIENT_PORT:-4222}:4222"
+    volumes:
+      - nats-data:/data
+    networks:
+      - stellaops
+    labels: *release-labels
+
+  authority:
+    image: registry.stella-ops.org/stellaops/authority:russia
+    restart: unless-stopped
+    depends_on:
+      - postgres
+    environment:
+      <<: *crypto-env
+      STELLAOPS_AUTHORITY__ISSUER: "${AUTHORITY_ISSUER}"
+      STELLAOPS_AUTHORITY__STORAGE__DRIVER: "postgres"
+      STELLAOPS_AUTHORITY__STORAGE__POSTGRES__CONNECTIONSTRING: "Host=postgres;Port=5432;Database=${POSTGRES_DB:-stellaops_platform};Username=${POSTGRES_USER:-stellaops};Password=${POSTGRES_PASSWORD:-stellaops}"
+      STELLAOPS_AUTHORITY__PLUGINDIRECTORIES__0: "/app/plugins"
+      STELLAOPS_AUTHORITY__PLUGINS__CONFIGURATIONDIRECTORY: "/app/etc/authority.plugins"
+    volumes:
+      - ../../etc/authority.yaml:/etc/authority.yaml:ro
+      - ../../etc/authority.plugins:/app/etc/authority.plugins:ro
+      - ../../etc/appsettings.crypto.russia.yaml:/app/etc/appsettings.crypto.yaml:ro
+      - ../../etc/crypto-plugins-manifest.json:/app/etc/crypto-plugins-manifest.json:ro
+    ports:
+      - "${AUTHORITY_PORT:-8440}:8440"
+    networks:
+      - stellaops
+    labels: *release-labels
+
+  signer:
+    image: registry.stella-ops.org/stellaops/signer:russia
+    restart: unless-stopped
+    depends_on:
+      - postgres
+    environment:
+      <<: *crypto-env
+      STELLAOPS_SIGNER__STORAGE__DRIVER: "postgres"
+      STELLAOPS_SIGNER__STORAGE__POSTGRES__CONNECTIONSTRING: "Host=postgres;Port=5432;Database=${POSTGRES_DB:-stellaops_platform};Username=${POSTGRES_USER:-stellaops};Password=${POSTGRES_PASSWORD:-stellaops}"
+    volumes:
+      - ../../etc/appsettings.crypto.russia.yaml:/app/etc/appsettings.crypto.yaml:ro
+      - ../../etc/crypto-plugins-manifest.json:/app/etc/crypto-plugins-manifest.json:ro
+    ports:
+      - "${SIGNER_PORT:-8441}:8441"
+    networks:
+      - stellaops
+    labels: *release-labels
+
+  attestor:
+    image: registry.stella-ops.org/stellaops/attestor:russia
+    restart: unless-stopped
+    depends_on:
+      - signer
+    environment:
+      <<: *crypto-env
+      STELLAOPS_ATTESTOR__SIGNER__BASEURL: "http://signer:8441"
+    volumes:
+      - ../../etc/appsettings.crypto.russia.yaml:/app/etc/appsettings.crypto.yaml:ro
+      - ../../etc/crypto-plugins-manifest.json:/app/etc/crypto-plugins-manifest.json:ro
+    ports:
+      - "${ATTESTOR_PORT:-8442}:8442"
+    networks:
+      - stellaops
+    labels: *release-labels
+
+  concelier:
+    image: registry.stella-ops.org/stellaops/concelier:russia
+    restart: unless-stopped
+    depends_on:
+      - postgres
+      - rustfs
+    environment:
+      <<: *crypto-env
+      STELLAOPS_CONCELIER__STORAGE__DRIVER: "postgres"
+      STELLAOPS_CONCELIER__STORAGE__POSTGRES__CONNECTIONSTRING: "Host=postgres;Port=5432;Database=${POSTGRES_DB:-stellaops_platform};Username=${POSTGRES_USER:-stellaops};Password=${POSTGRES_PASSWORD:-stellaops}"
+      STELLAOPS_CONCELIER__STORAGE__RUSTFS__BASEURL: "http://rustfs:8080"
+    volumes:
+      - ../../etc/appsettings.crypto.russia.yaml:/app/etc/appsettings.crypto.yaml:ro
+      - ../../etc/crypto-plugins-manifest.json:/app/etc/crypto-plugins-manifest.json:ro
+      - concelier-jobs:/app/jobs
+    ports:
+      - "${CONCELIER_PORT:-8443}:8443"
+    networks:
+      - stellaops
+    labels: *release-labels
+
+  scanner:
+    image: registry.stella-ops.org/stellaops/scanner:russia
+    restart: unless-stopped
+    depends_on:
+      - postgres
+    environment:
+      <<: *crypto-env
+      STELLAOPS_SCANNER__STORAGE__DRIVER: "postgres"
+      STELLAOPS_SCANNER__STORAGE__POSTGRES__CONNECTIONSTRING: "Host=postgres;Port=5432;Database=${POSTGRES_DB:-stellaops_platform};Username=${POSTGRES_USER:-stellaops};Password=${POSTGRES_PASSWORD:-stellaops}"
+    volumes:
+      - ../../etc/appsettings.crypto.russia.yaml:/app/etc/appsettings.crypto.yaml:ro
+      - ../../etc/crypto-plugins-manifest.json:/app/etc/crypto-plugins-manifest.json:ro
+    ports:
+      - "${SCANNER_PORT:-8444}:8444"
+    networks:
+      - stellaops
+    labels: *release-labels
+
+  excititor:
+    image: registry.stella-ops.org/stellaops/excititor:russia
+    restart: unless-stopped
+    depends_on:
+      - postgres
+    environment:
+      <<: *crypto-env
+      STELLAOPS_EXCITITOR__STORAGE__DRIVER: "postgres"
+      STELLAOPS_EXCITITOR__STORAGE__POSTGRES__CONNECTIONSTRING: "Host=postgres;Port=5432;Database=${POSTGRES_DB:-stellaops_platform};Username=${POSTGRES_USER:-stellaops};Password=${POSTGRES_PASSWORD:-stellaops}"
+    volumes:
+      - ../../etc/appsettings.crypto.russia.yaml:/app/etc/appsettings.crypto.yaml:ro
+      - ../../etc/crypto-plugins-manifest.json:/app/etc/crypto-plugins-manifest.json:ro
+    ports:
+      - "${EXCITITOR_PORT:-8445}:8445"
+    networks:
+      - stellaops
+    labels: *release-labels
+
+  policy:
+    image: registry.stella-ops.org/stellaops/policy:russia
+    restart: unless-stopped
+    depends_on:
+      - postgres
+    environment:
+      <<: *crypto-env
+      STELLAOPS_POLICY__STORAGE__DRIVER: "postgres"
+      STELLAOPS_POLICY__STORAGE__POSTGRES__CONNECTIONSTRING: "Host=postgres;Port=5432;Database=${POSTGRES_DB:-stellaops_platform};Username=${POSTGRES_USER:-stellaops};Password=${POSTGRES_PASSWORD:-stellaops}"
+    volumes:
+      - ../../etc/appsettings.crypto.russia.yaml:/app/etc/appsettings.crypto.yaml:ro
+      - ../../etc/crypto-plugins-manifest.json:/app/etc/crypto-plugins-manifest.json:ro
+    ports:
+      - "${POLICY_PORT:-8446}:8446"
+    networks:
+      - stellaops
+    labels: *release-labels
+
+  scheduler:
+    image: registry.stella-ops.org/stellaops/scheduler:russia
+    restart: unless-stopped
+    depends_on:
+      - postgres
+      - nats
+    environment:
+      <<: *crypto-env
+      STELLAOPS_SCHEDULER__STORAGE__DRIVER: "postgres"
+      STELLAOPS_SCHEDULER__STORAGE__POSTGRES__CONNECTIONSTRING: "Host=postgres;Port=5432;Database=${POSTGRES_DB:-stellaops_platform};Username=${POSTGRES_USER:-stellaops};Password=${POSTGRES_PASSWORD:-stellaops}"
+      STELLAOPS_SCHEDULER__MESSAGING__NATS__URL: "nats://nats:4222"
+    volumes:
+      - ../../etc/appsettings.crypto.russia.yaml:/app/etc/appsettings.crypto.yaml:ro
+      - ../../etc/crypto-plugins-manifest.json:/app/etc/crypto-plugins-manifest.json:ro
+    ports:
+      - "${SCHEDULER_PORT:-8447}:8447"
+    networks:
+      - stellaops
+    labels: *release-labels
+
+  notify:
+    image: registry.stella-ops.org/stellaops/notify:russia
+    restart: unless-stopped
+    depends_on:
+      - postgres
+    environment:
+      <<: *crypto-env
+      STELLAOPS_NOTIFY__STORAGE__DRIVER: "postgres"
+      STELLAOPS_NOTIFY__STORAGE__POSTGRES__CONNECTIONSTRING: "Host=postgres;Port=5432;Database=${POSTGRES_DB:-stellaops_platform};Username=${POSTGRES_USER:-stellaops};Password=${POSTGRES_PASSWORD:-stellaops}"
+    volumes:
+      - ../../etc/appsettings.crypto.russia.yaml:/app/etc/appsettings.crypto.yaml:ro
+      - ../../etc/crypto-plugins-manifest.json:/app/etc/crypto-plugins-manifest.json:ro
+    ports:
+      - "${NOTIFY_PORT:-8448}:8448"
+    networks:
+      - stellaops
+    labels: *release-labels
+
+  zastava:
+    image: registry.stella-ops.org/stellaops/zastava:russia
+    restart: unless-stopped
+    depends_on:
+      - postgres
+    environment:
+      <<: *crypto-env
+      STELLAOPS_ZASTAVA__STORAGE__DRIVER: "postgres"
+      STELLAOPS_ZASTAVA__STORAGE__POSTGRES__CONNECTIONSTRING: "Host=postgres;Port=5432;Database=${POSTGRES_DB:-stellaops_platform};Username=${POSTGRES_USER:-stellaops};Password=${POSTGRES_PASSWORD:-stellaops}"
+    volumes:
+      - ../../etc/appsettings.crypto.russia.yaml:/app/etc/appsettings.crypto.yaml:ro
+      - ../../etc/crypto-plugins-manifest.json:/app/etc/crypto-plugins-manifest.json:ro
+    ports:
+      - "${ZASTAVA_PORT:-8449}:8449"
+    networks:
+      - stellaops
+    labels: *release-labels
+
+  gateway:
+    image: registry.stella-ops.org/stellaops/gateway:russia
+    restart: unless-stopped
+    depends_on:
+      - authority
+      - concelier
+      - scanner
+    environment:
+      <<: *crypto-env
+      STELLAOPS_GATEWAY__AUTHORITY__BASEURL: "http://authority:8440"
+      STELLAOPS_GATEWAY__CONCELIER__BASEURL: "http://concelier:8443"
+      STELLAOPS_GATEWAY__SCANNER__BASEURL: "http://scanner:8444"
+    volumes:
+      - ../../etc/appsettings.crypto.russia.yaml:/app/etc/appsettings.crypto.yaml:ro
+      - ../../etc/crypto-plugins-manifest.json:/app/etc/crypto-plugins-manifest.json:ro
+    ports:
+      - "${GATEWAY_PORT:-8080}:8080"
+    networks:
+      - stellaops
+    labels: *release-labels
--- a/devops/compose/docker-compose.stage.yaml
+++ b/devops/compose/docker-compose.stage.yaml
@@ -0,0 +1,369 @@
+x-release-labels: &release-labels
+  com.stellaops.release.version: "2025.09.2"
+  com.stellaops.release.channel: "stable"
+  com.stellaops.profile: "stage"
+
+networks:
+  stellaops:
+    driver: bridge
+
+volumes:
+  valkey-data:
+  rustfs-data:
+  concelier-jobs:
+  nats-data:
+  scanner-surface-cache:
+  postgres-data:
+  advisory-ai-queue:
+  advisory-ai-plans:
+  advisory-ai-outputs:
+
+services:
+  valkey:
+    image: docker.io/valkey/valkey:8.0
+    restart: unless-stopped
+    command: ["valkey-server", "--appendonly", "yes"]
+    volumes:
+      - valkey-data:/data
+    ports:
+      - "${VALKEY_PORT:-6379}:6379"
+    networks:
+      - stellaops
+    labels: *release-labels
+
+  postgres:
+    image: docker.io/library/postgres:16
+    restart: unless-stopped
+    environment:
+      POSTGRES_USER: "${POSTGRES_USER:-stellaops}"
+      POSTGRES_PASSWORD: "${POSTGRES_PASSWORD:-stellaops}"
+      POSTGRES_DB: "${POSTGRES_DB:-stellaops_platform}"
+      PGDATA: /var/lib/postgresql/data/pgdata
+    volumes:
+      - postgres-data:/var/lib/postgresql/data
+    ports:
+      - "${POSTGRES_PORT:-5432}:5432"
+    networks:
+      - stellaops
+    labels: *release-labels
+
+  rustfs:
+    image: registry.stella-ops.org/stellaops/rustfs:2025.10.0-edge
+    command: ["serve", "--listen", "0.0.0.0:8080", "--root", "/data"]
+    restart: unless-stopped
+    environment:
+      RUSTFS__LOG__LEVEL: info
+      RUSTFS__STORAGE__PATH: /data
+    volumes:
+      - rustfs-data:/data
+    ports:
+      - "${RUSTFS_HTTP_PORT:-8080}:8080"
+    networks:
+      - stellaops
+    labels: *release-labels
+
+  nats:
+    image: docker.io/library/nats@sha256:c82559e4476289481a8a5196e675ebfe67eea81d95e5161e3e78eccfe766608e
+    command:
+      - "-js"
+      - "-sd"
+      - /data
+    restart: unless-stopped
+    ports:
+      - "${NATS_CLIENT_PORT:-4222}:4222"
+    volumes:
+      - nats-data:/data
+    networks:
+      - stellaops
+    labels: *release-labels
+
+  authority:
+    image: registry.stella-ops.org/stellaops/authority@sha256:b0348bad1d0b401cc3c71cb40ba034c8043b6c8874546f90d4783c9dbfcc0bf5
+    restart: unless-stopped
+    depends_on:
+      - postgres
+      - valkey
+    environment:
+      STELLAOPS_AUTHORITY__ISSUER: "${AUTHORITY_ISSUER}"
+      STELLAOPS_AUTHORITY__STORAGE__DRIVER: "postgres"
+      STELLAOPS_AUTHORITY__STORAGE__POSTGRES__CONNECTIONSTRING: "Host=postgres;Port=5432;Database=${POSTGRES_DB:-stellaops_platform};Username=${POSTGRES_USER:-stellaops};Password=${POSTGRES_PASSWORD:-stellaops}"
+      STELLAOPS_AUTHORITY__CACHE__REDIS__CONNECTIONSTRING: "valkey:6379"
+      STELLAOPS_AUTHORITY__PLUGINDIRECTORIES__0: "/app/plugins"
+      STELLAOPS_AUTHORITY__PLUGINS__CONFIGURATIONDIRECTORY: "/app/etc/authority.plugins"
+    volumes:
+      - ../../etc/authority.yaml:/etc/authority.yaml:ro
+      - ../../etc/authority.plugins:/app/etc/authority.plugins:ro
+    ports:
+      - "${AUTHORITY_PORT:-8440}:8440"
+    networks:
+      - stellaops
+    labels: *release-labels
+
+  signer:
+    image: registry.stella-ops.org/stellaops/signer@sha256:8ad574e61f3a9e9bda8a58eb2700ae46813284e35a150b1137bc7c2b92ac0f2e
+    restart: unless-stopped
+    depends_on:
+      - postgres
+      - authority
+    environment:
+      SIGNER__AUTHORITY__BASEURL: "https://authority:8440"
+      SIGNER__POE__INTROSPECTURL: "${SIGNER_POE_INTROSPECT_URL}"
+      SIGNER__STORAGE__DRIVER: "postgres"
+      SIGNER__STORAGE__POSTGRES__CONNECTIONSTRING: "Host=postgres;Port=5432;Database=${POSTGRES_DB:-stellaops_platform};Username=${POSTGRES_USER:-stellaops};Password=${POSTGRES_PASSWORD:-stellaops}"
+    ports:
+      - "${SIGNER_PORT:-8441}:8441"
+    networks:
+      - stellaops
+    labels: *release-labels
+
+  attestor:
+    image: registry.stella-ops.org/stellaops/attestor@sha256:0534985f978b0b5d220d73c96fddd962cd9135f616811cbe3bff4666c5af568f
+    restart: unless-stopped
+    depends_on:
+      - signer
+      - postgres
+    environment:
+      ATTESTOR__SIGNER__BASEURL: "https://signer:8441"
+      ATTESTOR__STORAGE__DRIVER: "postgres"
+      ATTESTOR__STORAGE__POSTGRES__CONNECTIONSTRING: "Host=postgres;Port=5432;Database=${POSTGRES_DB:-stellaops_platform};Username=${POSTGRES_USER:-stellaops};Password=${POSTGRES_PASSWORD:-stellaops}"
+    ports:
+      - "${ATTESTOR_PORT:-8442}:8442"
+    networks:
+      - stellaops
+    labels: *release-labels
+
+  issuer-directory:
+    image: registry.stella-ops.org/stellaops/issuer-directory-web:2025.10.0-edge
+    restart: unless-stopped
+    depends_on:
+      - postgres
+      - authority
+    environment:
+      ISSUERDIRECTORY__CONFIG: "/etc/issuer-directory.yaml"
+      ISSUERDIRECTORY__AUTHORITY__ISSUER: "${AUTHORITY_ISSUER}"
+      ISSUERDIRECTORY__AUTHORITY__BASEURL: "https://authority:8440"
+      ISSUERDIRECTORY__STORAGE__DRIVER: "postgres"
+      ISSUERDIRECTORY__STORAGE__POSTGRES__CONNECTIONSTRING: "Host=postgres;Port=5432;Database=${POSTGRES_DB:-stellaops_platform};Username=${POSTGRES_USER:-stellaops};Password=${POSTGRES_PASSWORD:-stellaops}"
+      ISSUERDIRECTORY__SEEDCSAFPUBLISHERS: "${ISSUER_DIRECTORY_SEED_CSAF:-true}"
+    volumes:
+      - ../../etc/issuer-directory.yaml:/etc/issuer-directory.yaml:ro
+    ports:
+      - "${ISSUER_DIRECTORY_PORT:-8447}:8080"
+    networks:
+      - stellaops
+    labels: *release-labels
+
+  concelier:
+    image: registry.stella-ops.org/stellaops/concelier@sha256:c58cdcaee1d266d68d498e41110a589dd204b487d37381096bd61ab345a867c5
+    restart: unless-stopped
+    depends_on:
+      - postgres
+      - valkey
+    environment:
+      CONCELIER__STORAGE__DRIVER: "postgres"
+      CONCELIER__STORAGE__POSTGRES__CONNECTIONSTRING: "Host=postgres;Port=5432;Database=${POSTGRES_DB:-stellaops_platform};Username=${POSTGRES_USER:-stellaops};Password=${POSTGRES_PASSWORD:-stellaops}"
+      CONCELIER__STORAGE__S3__ENDPOINT: "http://rustfs:8080"
+      CONCELIER__AUTHORITY__BASEURL: "https://authority:8440"
+      CONCELIER__AUTHORITY__RESILIENCE__ALLOWOFFLINECACHEFALLBACK: "true"
+      CONCELIER__AUTHORITY__RESILIENCE__OFFLINECACHETOLERANCE: "${AUTHORITY_OFFLINE_CACHE_TOLERANCE:-00:30:00}"
+    volumes:
+      - concelier-jobs:/var/lib/concelier/jobs
+    ports:
+      - "${CONCELIER_PORT:-8445}:8445"
+    networks:
+      - stellaops
+    labels: *release-labels
+
+  scanner-web:
+    image: registry.stella-ops.org/stellaops/scanner-web@sha256:14b23448c3f9586a9156370b3e8c1991b61907efa666ca37dd3aaed1e79fe3b7
+    restart: unless-stopped
+    depends_on:
+      - postgres
+      - valkey
+      - concelier
+      - rustfs
+    environment:
+      SCANNER__STORAGE__DRIVER: "postgres"
+      SCANNER__STORAGE__POSTGRES__CONNECTIONSTRING: "Host=postgres;Port=5432;Database=${POSTGRES_DB:-stellaops_platform};Username=${POSTGRES_USER:-stellaops};Password=${POSTGRES_PASSWORD:-stellaops}"
+      SCANNER__CACHE__REDIS__CONNECTIONSTRING: "valkey:6379"
+      SCANNER__ARTIFACTSTORE__DRIVER: "rustfs"
+      SCANNER__ARTIFACTSTORE__ENDPOINT: "http://rustfs:8080/api/v1"
+      SCANNER__ARTIFACTSTORE__BUCKET: "scanner-artifacts"
+      SCANNER__ARTIFACTSTORE__TIMEOUTSECONDS: "30"
+      SCANNER__QUEUE__BROKER: "${SCANNER_QUEUE_BROKER:-valkey://valkey:6379}"
+      SCANNER__EVENTS__ENABLED: "${SCANNER_EVENTS_ENABLED:-false}"
+      SCANNER__EVENTS__DRIVER: "${SCANNER_EVENTS_DRIVER:-valkey}"
+      SCANNER__EVENTS__DSN: "${SCANNER_EVENTS_DSN:-}"
+      SCANNER__EVENTS__STREAM: "${SCANNER_EVENTS_STREAM:-stella.events}"
+      SCANNER__EVENTS__PUBLISHTIMEOUTSECONDS: "${SCANNER_EVENTS_PUBLISH_TIMEOUT_SECONDS:-5}"
+      SCANNER__EVENTS__MAXSTREAMLENGTH: "${SCANNER_EVENTS_MAX_STREAM_LENGTH:-10000}"
+      SCANNER__OFFLINEKIT__ENABLED: "${SCANNER_OFFLINEKIT_ENABLED:-false}"
+      SCANNER__OFFLINEKIT__REQUIREDSSE: "${SCANNER_OFFLINEKIT_REQUIREDSSE:-true}"
+      SCANNER__OFFLINEKIT__REKOROFFLINEMODE: "${SCANNER_OFFLINEKIT_REKOROFFLINEMODE:-true}"
+      SCANNER__OFFLINEKIT__TRUSTROOTDIRECTORY: "${SCANNER_OFFLINEKIT_TRUSTROOTDIRECTORY:-/etc/stellaops/trust-roots}"
+      SCANNER__OFFLINEKIT__REKORSNAPSHOTDIRECTORY: "${SCANNER_OFFLINEKIT_REKORSNAPSHOTDIRECTORY:-/var/lib/stellaops/rekor-snapshot}"
+      SCANNER_SURFACE_FS_ENDPOINT: "${SCANNER_SURFACE_FS_ENDPOINT:-http://rustfs:8080}"
+      SCANNER_SURFACE_FS_BUCKET: "${SCANNER_SURFACE_FS_BUCKET:-surface-cache}"
+      SCANNER_SURFACE_CACHE_ROOT: "${SCANNER_SURFACE_CACHE_ROOT:-/var/lib/stellaops/surface}"
+      SCANNER_SURFACE_CACHE_QUOTA_MB: "${SCANNER_SURFACE_CACHE_QUOTA_MB:-4096}"
+      SCANNER_SURFACE_PREFETCH_ENABLED: "${SCANNER_SURFACE_PREFETCH_ENABLED:-false}"
+      SCANNER_SURFACE_TENANT: "${SCANNER_SURFACE_TENANT:-default}"
+      SCANNER_SURFACE_FEATURES: "${SCANNER_SURFACE_FEATURES:-}"
+      SCANNER_SURFACE_SECRETS_PROVIDER: "${SCANNER_SURFACE_SECRETS_PROVIDER:-file}"
+      SCANNER_SURFACE_SECRETS_NAMESPACE: "${SCANNER_SURFACE_SECRETS_NAMESPACE:-}"
+      SCANNER_SURFACE_SECRETS_ROOT: "${SCANNER_SURFACE_SECRETS_ROOT:-/etc/stellaops/secrets}"
+      SCANNER_SURFACE_SECRETS_FALLBACK_PROVIDER: "${SCANNER_SURFACE_SECRETS_FALLBACK_PROVIDER:-}"
+      SCANNER_SURFACE_SECRETS_ALLOW_INLINE: "${SCANNER_SURFACE_SECRETS_ALLOW_INLINE:-false}"
+    volumes:
+      - scanner-surface-cache:/var/lib/stellaops/surface
+      - ${SURFACE_SECRETS_HOST_PATH:-./offline/surface-secrets}:${SCANNER_SURFACE_SECRETS_ROOT:-/etc/stellaops/secrets}:ro
+      - ${SCANNER_OFFLINEKIT_TRUSTROOTS_HOST_PATH:-./offline/trust-roots}:${SCANNER_OFFLINEKIT_TRUSTROOTDIRECTORY:-/etc/stellaops/trust-roots}:ro
+      - ${SCANNER_OFFLINEKIT_REKOR_SNAPSHOT_HOST_PATH:-./offline/rekor-snapshot}:${SCANNER_OFFLINEKIT_REKORSNAPSHOTDIRECTORY:-/var/lib/stellaops/rekor-snapshot}:ro
+    ports:
+      - "${SCANNER_WEB_PORT:-8444}:8444"
+    networks:
+      - stellaops
+    labels: *release-labels
+
+  scanner-worker:
+    image: registry.stella-ops.org/stellaops/scanner-worker@sha256:32e25e76386eb9ea8bee0a1ad546775db9a2df989fab61ac877e351881960dab
+    restart: unless-stopped
+    depends_on:
+      - postgres
+      - valkey
+      - scanner-web
+      - rustfs
+    environment:
+      SCANNER__STORAGE__DRIVER: "postgres"
+      SCANNER__STORAGE__POSTGRES__CONNECTIONSTRING: "Host=postgres;Port=5432;Database=${POSTGRES_DB:-stellaops_platform};Username=${POSTGRES_USER:-stellaops};Password=${POSTGRES_PASSWORD:-stellaops}"
+      SCANNER__CACHE__REDIS__CONNECTIONSTRING: "valkey:6379"
+      SCANNER__ARTIFACTSTORE__DRIVER: "rustfs"
+      SCANNER__ARTIFACTSTORE__ENDPOINT: "http://rustfs:8080/api/v1"
+      SCANNER__ARTIFACTSTORE__BUCKET: "scanner-artifacts"
+      SCANNER__ARTIFACTSTORE__TIMEOUTSECONDS: "30"
+      SCANNER__QUEUE__BROKER: "${SCANNER_QUEUE_BROKER:-valkey://valkey:6379}"
+      SCANNER_SURFACE_FS_ENDPOINT: "${SCANNER_SURFACE_FS_ENDPOINT:-http://rustfs:8080}"
+      SCANNER_SURFACE_FS_BUCKET: "${SCANNER_SURFACE_FS_BUCKET:-surface-cache}"
+      SCANNER_SURFACE_CACHE_ROOT: "${SCANNER_SURFACE_CACHE_ROOT:-/var/lib/stellaops/surface}"
+      SCANNER_SURFACE_CACHE_QUOTA_MB: "${SCANNER_SURFACE_CACHE_QUOTA_MB:-4096}"
+      SCANNER_SURFACE_PREFETCH_ENABLED: "${SCANNER_SURFACE_PREFETCH_ENABLED:-false}"
+      SCANNER_SURFACE_TENANT: "${SCANNER_SURFACE_TENANT:-default}"
+      SCANNER_SURFACE_FEATURES: "${SCANNER_SURFACE_FEATURES:-}"
+      SCANNER_SURFACE_SECRETS_PROVIDER: "${SCANNER_SURFACE_SECRETS_PROVIDER:-file}"
+      SCANNER_SURFACE_SECRETS_NAMESPACE: "${SCANNER_SURFACE_SECRETS_NAMESPACE:-}"
+      SCANNER_SURFACE_SECRETS_ROOT: "${SCANNER_SURFACE_SECRETS_ROOT:-/etc/stellaops/secrets}"
+      SCANNER_SURFACE_SECRETS_FALLBACK_PROVIDER: "${SCANNER_SURFACE_SECRETS_FALLBACK_PROVIDER:-}"
+      SCANNER_SURFACE_SECRETS_ALLOW_INLINE: "${SCANNER_SURFACE_SECRETS_ALLOW_INLINE:-false}"
+    volumes:
+      - scanner-surface-cache:/var/lib/stellaops/surface
+      - ${SURFACE_SECRETS_HOST_PATH:-./offline/surface-secrets}:${SCANNER_SURFACE_SECRETS_ROOT:-/etc/stellaops/secrets}:ro
+    networks:
+      - stellaops
+    labels: *release-labels
+
+  scheduler-worker:
+    image: registry.stella-ops.org/stellaops/scheduler-worker:2025.10.0-edge
+    restart: unless-stopped
+    depends_on:
+      - postgres
+      - valkey
+      - scanner-web
+    command:
+      - "dotnet"
+      - "StellaOps.Scheduler.Worker.Host.dll"
+    environment:
+      SCHEDULER__STORAGE__DRIVER: "postgres"
+      SCHEDULER__STORAGE__POSTGRES__CONNECTIONSTRING: "Host=postgres;Port=5432;Database=${POSTGRES_DB:-stellaops_platform};Username=${POSTGRES_USER:-stellaops};Password=${POSTGRES_PASSWORD:-stellaops}"
+      SCHEDULER__QUEUE__KIND: "${SCHEDULER_QUEUE_KIND:-Valkey}"
+      SCHEDULER__QUEUE__VALKEY__URL: "${SCHEDULER_QUEUE_VALKEY_URL:-valkey:6379}"
+      SCHEDULER__WORKER__RUNNER__SCANNER__BASEADDRESS: "${SCHEDULER_SCANNER_BASEADDRESS:-http://scanner-web:8444}"
+    networks:
+      - stellaops
+    labels: *release-labels
+
+  notify-web:
+    image: ${NOTIFY_WEB_IMAGE:-registry.stella-ops.org/stellaops/notify-web:2025.09.2}
+    restart: unless-stopped
+    depends_on:
+      - postgres
+      - authority
+    environment:
+      DOTNET_ENVIRONMENT: Production
+    volumes:
+      - ../../etc/notify.stage.yaml:/app/etc/notify.yaml:ro
+    ports:
+      - "${NOTIFY_WEB_PORT:-8446}:8446"
+    networks:
+      - stellaops
+    labels: *release-labels
+
+  excititor:
+    image: registry.stella-ops.org/stellaops/excititor@sha256:59022e2016aebcef5c856d163ae705755d3f81949d41195256e935ef40a627fa
+    restart: unless-stopped
+    depends_on:
+      - postgres
+      - concelier
+    environment:
+      EXCITITOR__CONCELIER__BASEURL: "https://concelier:8445"
+      EXCITITOR__STORAGE__DRIVER: "postgres"
+      EXCITITOR__STORAGE__POSTGRES__CONNECTIONSTRING: "Host=postgres;Port=5432;Database=${POSTGRES_DB:-stellaops_platform};Username=${POSTGRES_USER:-stellaops};Password=${POSTGRES_PASSWORD:-stellaops}"
+    networks:
+      - stellaops
+    labels: *release-labels
+
+  advisory-ai-web:
+    image: registry.stella-ops.org/stellaops/advisory-ai-web:2025.09.2
+    restart: unless-stopped
+    depends_on:
+      - scanner-web
+    environment:
+      ADVISORYAI__AdvisoryAI__SbomBaseAddress: "${ADVISORY_AI_SBOM_BASEADDRESS:-http://scanner-web:8444}"
+      ADVISORYAI__AdvisoryAI__Queue__DirectoryPath: "/var/lib/advisory-ai/queue"
+      ADVISORYAI__AdvisoryAI__Storage__PlanCacheDirectory: "/var/lib/advisory-ai/plans"
+      ADVISORYAI__AdvisoryAI__Storage__OutputDirectory: "/var/lib/advisory-ai/outputs"
+      ADVISORYAI__AdvisoryAI__Inference__Mode: "${ADVISORY_AI_INFERENCE_MODE:-Local}"
+      ADVISORYAI__AdvisoryAI__Inference__Remote__BaseAddress: "${ADVISORY_AI_REMOTE_BASEADDRESS:-}"
+      ADVISORYAI__AdvisoryAI__Inference__Remote__ApiKey: "${ADVISORY_AI_REMOTE_APIKEY:-}"
+    ports:
+      - "${ADVISORY_AI_WEB_PORT:-8448}:8448"
+    volumes:
+      - advisory-ai-queue:/var/lib/advisory-ai/queue
+      - advisory-ai-plans:/var/lib/advisory-ai/plans
+      - advisory-ai-outputs:/var/lib/advisory-ai/outputs
+    networks:
+      - stellaops
+    labels: *release-labels
+
+  advisory-ai-worker:
+    image: registry.stella-ops.org/stellaops/advisory-ai-worker:2025.09.2
+    restart: unless-stopped
+    depends_on:
+      - advisory-ai-web
+    environment:
+      ADVISORYAI__AdvisoryAI__SbomBaseAddress: "${ADVISORY_AI_SBOM_BASEADDRESS:-http://scanner-web:8444}"
+      ADVISORYAI__AdvisoryAI__Queue__DirectoryPath: "/var/lib/advisory-ai/queue"
+      ADVISORYAI__AdvisoryAI__Storage__PlanCacheDirectory: "/var/lib/advisory-ai/plans"
+      ADVISORYAI__AdvisoryAI__Storage__OutputDirectory: "/var/lib/advisory-ai/outputs"
+      ADVISORYAI__AdvisoryAI__Inference__Mode: "${ADVISORY_AI_INFERENCE_MODE:-Local}"
+      ADVISORYAI__AdvisoryAI__Inference__Remote__BaseAddress: "${ADVISORY_AI_REMOTE_BASEADDRESS:-}"
+      ADVISORYAI__AdvisoryAI__Inference__Remote__ApiKey: "${ADVISORY_AI_REMOTE_APIKEY:-}"
+    volumes:
+      - advisory-ai-queue:/var/lib/advisory-ai/queue
+      - advisory-ai-plans:/var/lib/advisory-ai/plans
+      - advisory-ai-outputs:/var/lib/advisory-ai/outputs
+    networks:
+      - stellaops
+    labels: *release-labels
+
+  web-ui:
+    image: registry.stella-ops.org/stellaops/web-ui@sha256:10d924808c48e4353e3a241da62eb7aefe727a1d6dc830eb23a8e181013b3a23
+    restart: unless-stopped
+    depends_on:
+      - scanner-web
+    environment:
+      STELLAOPS_UI__BACKEND__BASEURL: "https://scanner-web:8444"
+    ports:
+      - "${UI_PORT:-8443}:8443"
+    networks:
+      - stellaops
+    labels: *release-labels
--- a/devops/compose/docker-compose.telemetry-storage.yaml
+++ b/devops/compose/docker-compose.telemetry-storage.yaml
@@ -0,0 +1,57 @@
+version: "3.9"
+
+services:
+  prometheus:
+    image: prom/prometheus:v2.53.0
+    container_name: stellaops-prometheus
+    command:
+      - "--config.file=/etc/prometheus/prometheus.yaml"
+    volumes:
+      - ../telemetry/storage/prometheus.yaml:/etc/prometheus/prometheus.yaml:ro
+      - prometheus-data:/prometheus
+      - ../telemetry/certs:/etc/telemetry/tls:ro
+      - ../telemetry/storage/auth:/etc/telemetry/auth:ro
+    environment:
+      PROMETHEUS_COLLECTOR_TARGET: stellaops-otel-collector:9464
+    ports:
+      - "9090:9090"
+    depends_on:
+      - tempo
+      - loki
+
+  tempo:
+    image: grafana/tempo:2.5.0
+    container_name: stellaops-tempo
+    command:
+      - "-config.file=/etc/tempo/tempo.yaml"
+    volumes:
+      - ../telemetry/storage/tempo.yaml:/etc/tempo/tempo.yaml:ro
+      - ../telemetry/storage/tenants/tempo-overrides.yaml:/etc/telemetry/tenants/tempo-overrides.yaml:ro
+      - ../telemetry/certs:/etc/telemetry/tls:ro
+      - tempo-data:/var/tempo
+    ports:
+      - "3200:3200"
+    environment:
+      TEMPO_ZONE: docker
+
+  loki:
+    image: grafana/loki:3.1.0
+    container_name: stellaops-loki
+    command:
+      - "-config.file=/etc/loki/loki.yaml"
+    volumes:
+      - ../telemetry/storage/loki.yaml:/etc/loki/loki.yaml:ro
+      - ../telemetry/storage/tenants/loki-overrides.yaml:/etc/telemetry/tenants/loki-overrides.yaml:ro
+      - ../telemetry/certs:/etc/telemetry/tls:ro
+      - loki-data:/var/loki
+    ports:
+      - "3100:3100"
+
+volumes:
+  prometheus-data:
+  tempo-data:
+  loki-data:
+
+networks:
+  default:
+    name: stellaops-telemetry
--- a/devops/compose/docker-compose.telemetry.yaml
+++ b/devops/compose/docker-compose.telemetry.yaml
@@ -0,0 +1,42 @@
+version: "3.9"
+
+services:
+  otel-collector:
+    image: otel/opentelemetry-collector:0.105.0
+    container_name: stellaops-otel-collector
+    command:
+      - "--config=/etc/otel-collector/config.yaml"
+    environment:
+      STELLAOPS_OTEL_TLS_CERT: /etc/otel-collector/tls/collector.crt
+      STELLAOPS_OTEL_TLS_KEY: /etc/otel-collector/tls/collector.key
+      STELLAOPS_OTEL_TLS_CA: /etc/otel-collector/tls/ca.crt
+      STELLAOPS_OTEL_PROMETHEUS_ENDPOINT: 0.0.0.0:9464
+      STELLAOPS_OTEL_REQUIRE_CLIENT_CERT: "true"
+      STELLAOPS_TENANT_ID: dev
+      STELLAOPS_TEMPO_ENDPOINT: https://stellaops-tempo:3200
+      STELLAOPS_TEMPO_TLS_CERT_FILE: /etc/otel-collector/tls/client.crt
+      STELLAOPS_TEMPO_TLS_KEY_FILE: /etc/otel-collector/tls/client.key
+      STELLAOPS_TEMPO_TLS_CA_FILE: /etc/otel-collector/tls/ca.crt
+      STELLAOPS_LOKI_ENDPOINT: https://stellaops-loki:3100/loki/api/v1/push
+      STELLAOPS_LOKI_TLS_CERT_FILE: /etc/otel-collector/tls/client.crt
+      STELLAOPS_LOKI_TLS_KEY_FILE: /etc/otel-collector/tls/client.key
+      STELLAOPS_LOKI_TLS_CA_FILE: /etc/otel-collector/tls/ca.crt
+    volumes:
+      - ../telemetry/otel-collector-config.yaml:/etc/otel-collector/config.yaml:ro
+      - ../telemetry/certs:/etc/otel-collector/tls:ro
+    ports:
+      - "4317:4317"    # OTLP gRPC (mTLS)
+      - "4318:4318"    # OTLP HTTP (mTLS)
+      - "9464:9464"    # Prometheus exporter (mTLS)
+      - "13133:13133"  # Health check
+      - "1777:1777"    # pprof
+    healthcheck:
+      test: ["CMD", "curl", "-fsk", "--cert", "/etc/otel-collector/tls/client.crt", "--key", "/etc/otel-collector/tls/client.key", "--cacert", "/etc/otel-collector/tls/ca.crt", "https://localhost:13133/healthz"]
+      interval: 30s
+      start_period: 15s
+      timeout: 5s
+      retries: 3
+
+networks:
+  default:
+    name: stellaops-telemetry
--- a/devops/compose/env/airgap.env.example
+++ b/devops/compose/env/airgap.env.example
@@ -0,0 +1,91 @@
+# Substitutions for docker-compose.airgap.yaml
+
+# PostgreSQL Database
+POSTGRES_USER=stellaops
+POSTGRES_PASSWORD=airgap-postgres-password
+POSTGRES_DB=stellaops_platform
+POSTGRES_PORT=25432
+
+# Valkey (Redis-compatible cache and messaging)
+VALKEY_PORT=26379
+
+# RustFS Object Storage
+RUSTFS_HTTP_PORT=8080
+
+# Authority (OAuth2/OIDC)
+AUTHORITY_ISSUER=https://authority.airgap.local
+AUTHORITY_PORT=8440
+AUTHORITY_OFFLINE_CACHE_TOLERANCE=00:45:00
+
+# Signer
+SIGNER_POE_INTROSPECT_URL=file:///offline/poe/introspect.json
+SIGNER_PORT=8441
+
+# Attestor
+ATTESTOR_PORT=8442
+
+# Issuer Directory
+ISSUER_DIRECTORY_PORT=8447
+ISSUER_DIRECTORY_SEED_CSAF=true
+
+# Concelier
+CONCELIER_PORT=8445
+
+# Scanner
+SCANNER_WEB_PORT=8444
+SCANNER_QUEUE_BROKER=valkey://valkey:6379
+SCANNER_EVENTS_ENABLED=false
+SCANNER_EVENTS_DRIVER=valkey
+SCANNER_EVENTS_DSN=
+SCANNER_EVENTS_STREAM=stella.events
+SCANNER_EVENTS_PUBLISH_TIMEOUT_SECONDS=5
+SCANNER_EVENTS_MAX_STREAM_LENGTH=10000
+
+# Surface.Env configuration
+SCANNER_SURFACE_FS_ENDPOINT=http://rustfs:8080
+SCANNER_SURFACE_FS_BUCKET=surface-cache
+SCANNER_SURFACE_CACHE_ROOT=/var/lib/stellaops/surface
+SCANNER_SURFACE_CACHE_QUOTA_MB=4096
+SCANNER_SURFACE_PREFETCH_ENABLED=false
+SCANNER_SURFACE_TENANT=default
+SCANNER_SURFACE_FEATURES=
+SCANNER_SURFACE_SECRETS_PROVIDER=file
+SCANNER_SURFACE_SECRETS_NAMESPACE=
+SCANNER_SURFACE_SECRETS_ROOT=/etc/stellaops/secrets
+SCANNER_SURFACE_SECRETS_FALLBACK_PROVIDER=
+SCANNER_SURFACE_SECRETS_ALLOW_INLINE=false
+SURFACE_SECRETS_HOST_PATH=./offline/surface-secrets
+
+# Offline Kit configuration
+SCANNER_OFFLINEKIT_ENABLED=false
+SCANNER_OFFLINEKIT_REQUIREDSSE=true
+SCANNER_OFFLINEKIT_REKOROFFLINEMODE=true
+SCANNER_OFFLINEKIT_TRUSTROOTDIRECTORY=/etc/stellaops/trust-roots
+SCANNER_OFFLINEKIT_REKORSNAPSHOTDIRECTORY=/var/lib/stellaops/rekor-snapshot
+SCANNER_OFFLINEKIT_TRUSTROOTS_HOST_PATH=./offline/trust-roots
+SCANNER_OFFLINEKIT_REKOR_SNAPSHOT_HOST_PATH=./offline/rekor-snapshot
+
+# Zastava inherits Scanner defaults; override if Observer/Webhook diverge
+ZASTAVA_SURFACE_FS_ENDPOINT=${SCANNER_SURFACE_FS_ENDPOINT}
+ZASTAVA_SURFACE_CACHE_ROOT=${SCANNER_SURFACE_CACHE_ROOT}
+
+# Scheduler
+SCHEDULER_QUEUE_KIND=Valkey
+SCHEDULER_QUEUE_VALKEY_URL=valkey:6379
+SCHEDULER_SCANNER_BASEADDRESS=http://scanner-web:8444
+
+# Notify
+NOTIFY_WEB_PORT=9446
+
+# Advisory AI
+ADVISORY_AI_WEB_PORT=8448
+ADVISORY_AI_SBOM_BASEADDRESS=http://scanner-web:8444
+ADVISORY_AI_INFERENCE_MODE=Local
+ADVISORY_AI_REMOTE_BASEADDRESS=
+ADVISORY_AI_REMOTE_APIKEY=
+
+# Web UI
+UI_PORT=9443
+
+# NATS
+NATS_CLIENT_PORT=24222
--- a/devops/compose/env/cas.env.example
+++ b/devops/compose/env/cas.env.example
@@ -0,0 +1,118 @@
+# CAS (Content Addressable Storage) Environment Configuration
+# Copy to .env and customize for your deployment
+#
+# Aligned with best-in-class vulnerability scanner retention policies:
+# - Trivy: 7 days vulnerability DB
+# - Grype: 5 days DB, configurable
+# - Anchore Enterprise: 90-365 days typical
+# - Snyk Enterprise: 365 days
+
+# =============================================================================
+# DATA PATHS (ensure directories exist with proper permissions)
+# =============================================================================
+CAS_DATA_PATH=/var/lib/stellaops/cas
+CAS_EVIDENCE_PATH=/var/lib/stellaops/evidence
+CAS_ATTESTATION_PATH=/var/lib/stellaops/attestations
+
+# =============================================================================
+# RUSTFS CONFIGURATION
+# =============================================================================
+RUSTFS_LOG_LEVEL=info
+RUSTFS_COMPRESSION=zstd
+RUSTFS_COMPRESSION_LEVEL=3
+
+# =============================================================================
+# PORTS
+# =============================================================================
+RUSTFS_CAS_PORT=8180
+RUSTFS_EVIDENCE_PORT=8181
+RUSTFS_ATTESTATION_PORT=8182
+
+# =============================================================================
+# ACCESS CONTROL - API KEYS
+# IMPORTANT: Change these in production!
+# =============================================================================
+
+# CAS Storage (mutable, lifecycle-managed)
+RUSTFS_CAS_API_KEY=cas-api-key-CHANGE-IN-PRODUCTION
+RUSTFS_CAS_READONLY_KEY=cas-readonly-key-CHANGE-IN-PRODUCTION
+
+# Evidence Storage (immutable)
+RUSTFS_EVIDENCE_API_KEY=evidence-api-key-CHANGE-IN-PRODUCTION
+RUSTFS_EVIDENCE_READONLY_KEY=evidence-readonly-key-CHANGE-IN-PRODUCTION
+
+# Attestation Storage (immutable)
+RUSTFS_ATTESTATION_API_KEY=attestation-api-key-CHANGE-IN-PRODUCTION
+RUSTFS_ATTESTATION_READONLY_KEY=attestation-readonly-key-CHANGE-IN-PRODUCTION
+
+# =============================================================================
+# SERVICE ACCOUNT KEYS
+# Each service has its own key for fine-grained access control
+# IMPORTANT: Generate unique keys per environment!
+# =============================================================================
+
+# Scanner service - access to scanner artifacts, surface cache, runtime facts
+RUSTFS_SCANNER_KEY=scanner-svc-key-GENERATE-UNIQUE
+# Bucket access: scanner-artifacts (rw), surface-cache (rw), runtime-facts (rw)
+
+# Signals service - access to runtime facts, signals data, provenance feed
+RUSTFS_SIGNALS_KEY=signals-svc-key-GENERATE-UNIQUE
+# Bucket access: runtime-facts (rw), signals-data (rw), provenance-feed (rw)
+
+# Replay service - access to replay bundles, inputs lock files
+RUSTFS_REPLAY_KEY=replay-svc-key-GENERATE-UNIQUE
+# Bucket access: replay-bundles (rw), inputs-lock (rw)
+
+# Ledger service - access to evidence bundles, merkle roots, hash chains
+RUSTFS_LEDGER_KEY=ledger-svc-key-GENERATE-UNIQUE
+# Bucket access: evidence-bundles (rw), merkle-roots (rw), hash-chains (rw)
+
+# Exporter service - read-only access to evidence bundles
+RUSTFS_EXPORTER_KEY=exporter-svc-key-GENERATE-UNIQUE
+# Bucket access: evidence-bundles (r)
+
+# Attestor service - access to attestations, DSSE envelopes, Rekor receipts
+RUSTFS_ATTESTOR_KEY=attestor-svc-key-GENERATE-UNIQUE
+# Bucket access: attestations (rw), dsse-envelopes (rw), rekor-receipts (rw)
+
+# Verifier service - read-only access to attestations
+RUSTFS_VERIFIER_KEY=verifier-svc-key-GENERATE-UNIQUE
+# Bucket access: attestations (r), dsse-envelopes (r), rekor-receipts (r)
+
+# Global read-only key (for debugging/auditing)
+RUSTFS_READONLY_KEY=readonly-global-key-GENERATE-UNIQUE
+# Bucket access: * (r)
+
+# =============================================================================
+# LIFECYCLE MANAGEMENT
+# =============================================================================
+# Cron schedule for retention policy enforcement (default: 3 AM daily)
+LIFECYCLE_CRON=0 3 * * *
+LIFECYCLE_TELEMETRY=true
+
+# =============================================================================
+# RETENTION POLICIES (days, 0 = indefinite)
+# Aligned with enterprise vulnerability scanner best practices
+# =============================================================================
+# Vulnerability DB: 7 days (matches Trivy default, Grype uses 5)
+CAS_RETENTION_VULNERABILITY_DB_DAYS=7
+
+# SBOM artifacts: 365 days (audit compliance - SOC2, ISO27001, FedRAMP)
+CAS_RETENTION_SBOM_ARTIFACTS_DAYS=365
+
+# Scan results: 90 days (common compliance window)
+CAS_RETENTION_SCAN_RESULTS_DAYS=90
+
+# Evidence bundles: indefinite (content-addressed, immutable, audit trail)
+CAS_RETENTION_EVIDENCE_BUNDLES_DAYS=0
+
+# Attestations: indefinite (signed, immutable, verifiable)
+CAS_RETENTION_ATTESTATIONS_DAYS=0
+
+# Temporary artifacts: 1 day (work-in-progress, intermediate files)
+CAS_RETENTION_TEMP_ARTIFACTS_DAYS=1
+
+# =============================================================================
+# TELEMETRY (optional)
+# =============================================================================
+OTLP_ENDPOINT=
--- a/devops/compose/env/dev.env.example
+++ b/devops/compose/env/dev.env.example
@@ -0,0 +1,78 @@
+# Substitutions for docker-compose.dev.yaml
+
+# PostgreSQL Database
+POSTGRES_USER=stellaops
+POSTGRES_PASSWORD=dev-postgres-password
+POSTGRES_DB=stellaops_platform
+POSTGRES_PORT=5432
+
+# Valkey (Redis-compatible cache and messaging)
+VALKEY_PORT=6379
+
+# RustFS Object Storage
+RUSTFS_HTTP_PORT=8080
+
+# Authority (OAuth2/OIDC)
+AUTHORITY_ISSUER=https://authority.localtest.me
+AUTHORITY_PORT=8440
+
+# Signer
+SIGNER_POE_INTROSPECT_URL=https://licensing.svc.local/introspect
+SIGNER_PORT=8441
+
+# Attestor
+ATTESTOR_PORT=8442
+
+# Issuer Directory
+ISSUER_DIRECTORY_PORT=8447
+ISSUER_DIRECTORY_SEED_CSAF=true
+
+# Concelier
+CONCELIER_PORT=8445
+
+# Scanner
+SCANNER_WEB_PORT=8444
+SCANNER_QUEUE_BROKER=nats://nats:4222
+SCANNER_EVENTS_ENABLED=false
+SCANNER_EVENTS_DRIVER=valkey
+SCANNER_EVENTS_DSN=valkey:6379
+SCANNER_EVENTS_STREAM=stella.events
+SCANNER_EVENTS_PUBLISH_TIMEOUT_SECONDS=5
+SCANNER_EVENTS_MAX_STREAM_LENGTH=10000
+
+# Surface.Env defaults keep worker/web service aligned with local RustFS and inline secrets
+SCANNER_SURFACE_FS_ENDPOINT=http://rustfs:8080/api/v1
+SCANNER_SURFACE_CACHE_ROOT=/var/lib/stellaops/surface
+SCANNER_SURFACE_SECRETS_PROVIDER=inline
+SCANNER_SURFACE_SECRETS_ROOT=
+
+# Zastava inherits Scanner defaults; override if Observer/Webhook diverge
+ZASTAVA_SURFACE_FS_ENDPOINT=${SCANNER_SURFACE_FS_ENDPOINT}
+ZASTAVA_SURFACE_CACHE_ROOT=${SCANNER_SURFACE_CACHE_ROOT}
+ZASTAVA_SURFACE_SECRETS_PROVIDER=${SCANNER_SURFACE_SECRETS_PROVIDER}
+ZASTAVA_SURFACE_SECRETS_ROOT=${SCANNER_SURFACE_SECRETS_ROOT}
+
+# Scheduler
+SCHEDULER_QUEUE_KIND=Nats
+SCHEDULER_QUEUE_NATS_URL=nats://nats:4222
+SCHEDULER_SCANNER_BASEADDRESS=http://scanner-web:8444
+
+# Notify
+NOTIFY_WEB_PORT=8446
+
+# Advisory AI
+ADVISORY_AI_WEB_PORT=8448
+ADVISORY_AI_SBOM_BASEADDRESS=http://scanner-web:8444
+ADVISORY_AI_INFERENCE_MODE=Local
+ADVISORY_AI_REMOTE_BASEADDRESS=
+ADVISORY_AI_REMOTE_APIKEY=
+
+# Web UI
+UI_PORT=8443
+
+# NATS
+NATS_CLIENT_PORT=4222
+
+# CryptoPro (optional)
+CRYPTOPRO_PORT=18080
+CRYPTOPRO_ACCEPT_EULA=0
--- a/devops/compose/env/mirror.env.example
+++ b/devops/compose/env/mirror.env.example
@@ -0,0 +1,64 @@
+# Managed mirror profile substitutions
+
+# Core infrastructure credentials
+MONGO_INITDB_ROOT_USERNAME=stellaops_mirror
+MONGO_INITDB_ROOT_PASSWORD=mirror-password
+MINIO_ROOT_USER=stellaops-mirror
+MINIO_ROOT_PASSWORD=mirror-minio-secret
+RUSTFS_HTTP_PORT=8080
+
+# Scanner surface integration
+SCANNER_SURFACE_FS_ENDPOINT=http://rustfs:8080/api/v1
+SCANNER_SURFACE_CACHE_ROOT=/var/lib/stellaops/surface
+SCANNER_SURFACE_SECRETS_PROVIDER=file
+SCANNER_SURFACE_SECRETS_ROOT=/etc/stellaops/secrets
+
+# Mirror HTTP listeners
+MIRROR_GATEWAY_HTTP_PORT=8080
+MIRROR_GATEWAY_HTTPS_PORT=9443
+
+# Concelier mirror configuration
+CONCELIER_MIRROR_LATEST_SEGMENT=latest
+CONCELIER_MIRROR_DIRECTORY_SEGMENT=mirror
+CONCELIER_MIRROR_REQUIRE_AUTH=true
+CONCELIER_MIRROR_INDEX_BUDGET=600
+CONCELIER_MIRROR_DOMAIN_PRIMARY_ID=primary
+CONCELIER_MIRROR_DOMAIN_PRIMARY_NAME=Primary Mirror
+CONCELIER_MIRROR_DOMAIN_PRIMARY_AUTH=true
+CONCELIER_MIRROR_DOMAIN_PRIMARY_DOWNLOAD_BUDGET=3600
+CONCELIER_MIRROR_DOMAIN_SECONDARY_ID=community
+CONCELIER_MIRROR_DOMAIN_SECONDARY_NAME=Community Mirror
+CONCELIER_MIRROR_DOMAIN_SECONDARY_AUTH=false
+CONCELIER_MIRROR_DOMAIN_SECONDARY_DOWNLOAD_BUDGET=1800
+
+# Authority integration (tokens issued by production Authority)
+CONCELIER_AUTHORITY_ENABLED=true
+CONCELIER_AUTHORITY_ALLOW_ANON=false
+CONCELIER_AUTHORITY_ISSUER=https://authority.stella-ops.org
+CONCELIER_AUTHORITY_METADATA=
+CONCELIER_AUTHORITY_CLIENT_ID=stellaops-concelier-mirror
+CONCELIER_AUTHORITY_SCOPE=concelier.mirror.read
+CONCELIER_AUTHORITY_AUDIENCE=api://concelier.mirror
+
+# Excititor mirror configuration
+EXCITITOR_MONGO_DATABASE=excititor
+EXCITITOR_FILESYSTEM_OVERWRITE=false
+EXCITITOR_MIRROR_DOMAIN_PRIMARY_ID=primary
+EXCITITOR_MIRROR_DOMAIN_PRIMARY_NAME=Primary Mirror
+EXCITITOR_MIRROR_DOMAIN_PRIMARY_AUTH=true
+EXCITITOR_MIRROR_DOMAIN_PRIMARY_INDEX_BUDGET=300
+EXCITITOR_MIRROR_DOMAIN_PRIMARY_DOWNLOAD_BUDGET=2400
+EXCITITOR_MIRROR_PRIMARY_EXPORT_CONSENSUS_KEY=consensus-json
+EXCITITOR_MIRROR_PRIMARY_EXPORT_CONSENSUS_FORMAT=json
+EXCITITOR_MIRROR_PRIMARY_EXPORT_CONSENSUS_VIEW=consensus
+EXCITITOR_MIRROR_PRIMARY_EXPORT_OPENVEX_KEY=consensus-openvex
+EXCITITOR_MIRROR_PRIMARY_EXPORT_OPENVEX_FORMAT=openvex
+EXCITITOR_MIRROR_PRIMARY_EXPORT_OPENVEX_VIEW=consensus
+EXCITITOR_MIRROR_DOMAIN_SECONDARY_ID=community
+EXCITITOR_MIRROR_DOMAIN_SECONDARY_NAME=Community Mirror
+EXCITITOR_MIRROR_DOMAIN_SECONDARY_AUTH=false
+EXCITITOR_MIRROR_DOMAIN_SECONDARY_INDEX_BUDGET=120
+EXCITITOR_MIRROR_DOMAIN_SECONDARY_DOWNLOAD_BUDGET=600
+EXCITITOR_MIRROR_SECONDARY_EXPORT_KEY=community-consensus
+EXCITITOR_MIRROR_SECONDARY_EXPORT_FORMAT=json
+EXCITITOR_MIRROR_SECONDARY_EXPORT_VIEW=consensus
--- a/devops/compose/env/mock.env.example
+++ b/devops/compose/env/mock.env.example
@@ -0,0 +1,12 @@
+# Dev-only overlay env for docker-compose.mock.yaml
+# Use together with dev.env.example:
+#   docker compose --env-file env/dev.env.example --env-file env/mock.env.example -f docker-compose.dev.yaml -f docker-compose.mock.yaml config
+
+# Optional: override ports if you expose mock services
+ORCHESTRATOR_PORT=8450
+POLICY_REGISTRY_PORT=8451
+VEX_LENS_PORT=8452
+FINDINGS_LEDGER_PORT=8453
+VULN_EXPLORER_API_PORT=8454
+PACKS_REGISTRY_PORT=8455
+TASK_RUNNER_PORT=8456
--- a/devops/compose/env/prod.env.example
+++ b/devops/compose/env/prod.env.example
@@ -0,0 +1,96 @@
+# Substitutions for docker-compose.prod.yaml
+# WARNING: Replace all placeholder secrets with values sourced from your secret manager.
+
+# PostgreSQL Database
+POSTGRES_USER=stellaops-prod
+POSTGRES_PASSWORD=REPLACE_WITH_STRONG_PASSWORD
+POSTGRES_DB=stellaops_platform
+POSTGRES_PORT=5432
+
+# Valkey (Redis-compatible cache and messaging)
+VALKEY_PORT=6379
+
+# RustFS Object Storage
+RUSTFS_HTTP_PORT=8080
+
+# Authority (OAuth2/OIDC)
+AUTHORITY_ISSUER=https://authority.prod.stella-ops.org
+AUTHORITY_PORT=8440
+AUTHORITY_OFFLINE_CACHE_TOLERANCE=00:30:00
+
+# Signer
+SIGNER_POE_INTROSPECT_URL=https://licensing.prod.stella-ops.org/introspect
+SIGNER_PORT=8441
+
+# Attestor
+ATTESTOR_PORT=8442
+
+# Issuer Directory
+ISSUER_DIRECTORY_PORT=8447
+ISSUER_DIRECTORY_SEED_CSAF=true
+
+# Concelier
+CONCELIER_PORT=8445
+
+# Scanner
+SCANNER_WEB_PORT=8444
+SCANNER_QUEUE_BROKER=valkey://valkey:6379
+# `true` enables signed scanner events for Notify ingestion.
+SCANNER_EVENTS_ENABLED=true
+SCANNER_EVENTS_DRIVER=valkey
+SCANNER_EVENTS_DSN=
+SCANNER_EVENTS_STREAM=stella.events
+SCANNER_EVENTS_PUBLISH_TIMEOUT_SECONDS=5
+SCANNER_EVENTS_MAX_STREAM_LENGTH=10000
+
+# Surface.Env configuration
+SCANNER_SURFACE_FS_ENDPOINT=https://surfacefs.prod.stella-ops.org/api/v1
+SCANNER_SURFACE_FS_BUCKET=surface-cache
+SCANNER_SURFACE_CACHE_ROOT=/var/lib/stellaops/surface
+SCANNER_SURFACE_CACHE_QUOTA_MB=4096
+SCANNER_SURFACE_PREFETCH_ENABLED=false
+SCANNER_SURFACE_TENANT=default
+SCANNER_SURFACE_FEATURES=
+SCANNER_SURFACE_SECRETS_PROVIDER=kubernetes
+SCANNER_SURFACE_SECRETS_NAMESPACE=
+SCANNER_SURFACE_SECRETS_ROOT=stellaops/scanner
+SCANNER_SURFACE_SECRETS_FALLBACK_PROVIDER=
+SCANNER_SURFACE_SECRETS_ALLOW_INLINE=false
+SURFACE_SECRETS_HOST_PATH=./offline/surface-secrets
+
+# Offline Kit configuration
+SCANNER_OFFLINEKIT_ENABLED=false
+SCANNER_OFFLINEKIT_REQUIREDSSE=true
+SCANNER_OFFLINEKIT_REKOROFFLINEMODE=true
+SCANNER_OFFLINEKIT_TRUSTROOTDIRECTORY=/etc/stellaops/trust-roots
+SCANNER_OFFLINEKIT_REKORSNAPSHOTDIRECTORY=/var/lib/stellaops/rekor-snapshot
+SCANNER_OFFLINEKIT_TRUSTROOTS_HOST_PATH=./offline/trust-roots
+SCANNER_OFFLINEKIT_REKOR_SNAPSHOT_HOST_PATH=./offline/rekor-snapshot
+
+# Zastava inherits Scanner defaults; override if Observer/Webhook diverge
+ZASTAVA_SURFACE_FS_ENDPOINT=${SCANNER_SURFACE_FS_ENDPOINT}
+ZASTAVA_SURFACE_CACHE_ROOT=${SCANNER_SURFACE_CACHE_ROOT}
+
+# Scheduler
+SCHEDULER_QUEUE_KIND=Valkey
+SCHEDULER_QUEUE_VALKEY_URL=valkey:6379
+SCHEDULER_SCANNER_BASEADDRESS=http://scanner-web:8444
+
+# Notify
+NOTIFY_WEB_PORT=8446
+
+# Advisory AI
+ADVISORY_AI_WEB_PORT=8448
+ADVISORY_AI_SBOM_BASEADDRESS=https://scanner-web:8444
+ADVISORY_AI_INFERENCE_MODE=Local
+ADVISORY_AI_REMOTE_BASEADDRESS=
+ADVISORY_AI_REMOTE_APIKEY=
+
+# Web UI
+UI_PORT=8443
+
+# NATS
+NATS_CLIENT_PORT=4222
+
+# External reverse proxy (Traefik, Envoy, etc.) that terminates TLS.
+FRONTDOOR_NETWORK=stellaops_frontdoor
--- a/devops/compose/env/stage.env.example
+++ b/devops/compose/env/stage.env.example
@@ -0,0 +1,91 @@
+# Substitutions for docker-compose.stage.yaml
+
+# PostgreSQL Database
+POSTGRES_USER=stellaops
+POSTGRES_PASSWORD=stage-postgres-password
+POSTGRES_DB=stellaops_platform
+POSTGRES_PORT=5432
+
+# Valkey (Redis-compatible cache and messaging)
+VALKEY_PORT=6379
+
+# RustFS Object Storage
+RUSTFS_HTTP_PORT=8080
+
+# Authority (OAuth2/OIDC)
+AUTHORITY_ISSUER=https://authority.stage.stella-ops.internal
+AUTHORITY_PORT=8440
+AUTHORITY_OFFLINE_CACHE_TOLERANCE=00:30:00
+
+# Signer
+SIGNER_POE_INTROSPECT_URL=https://licensing.stage.stella-ops.internal/introspect
+SIGNER_PORT=8441
+
+# Attestor
+ATTESTOR_PORT=8442
+
+# Issuer Directory
+ISSUER_DIRECTORY_PORT=8447
+ISSUER_DIRECTORY_SEED_CSAF=true
+
+# Concelier
+CONCELIER_PORT=8445
+
+# Scanner
+SCANNER_WEB_PORT=8444
+SCANNER_QUEUE_BROKER=valkey://valkey:6379
+SCANNER_EVENTS_ENABLED=false
+SCANNER_EVENTS_DRIVER=valkey
+SCANNER_EVENTS_DSN=
+SCANNER_EVENTS_STREAM=stella.events
+SCANNER_EVENTS_PUBLISH_TIMEOUT_SECONDS=5
+SCANNER_EVENTS_MAX_STREAM_LENGTH=10000
+
+# Surface.Env configuration
+SCANNER_SURFACE_FS_ENDPOINT=http://rustfs:8080
+SCANNER_SURFACE_FS_BUCKET=surface-cache
+SCANNER_SURFACE_CACHE_ROOT=/var/lib/stellaops/surface
+SCANNER_SURFACE_CACHE_QUOTA_MB=4096
+SCANNER_SURFACE_PREFETCH_ENABLED=false
+SCANNER_SURFACE_TENANT=default
+SCANNER_SURFACE_FEATURES=
+SCANNER_SURFACE_SECRETS_PROVIDER=kubernetes
+SCANNER_SURFACE_SECRETS_NAMESPACE=
+SCANNER_SURFACE_SECRETS_ROOT=stellaops/scanner
+SCANNER_SURFACE_SECRETS_FALLBACK_PROVIDER=
+SCANNER_SURFACE_SECRETS_ALLOW_INLINE=false
+SURFACE_SECRETS_HOST_PATH=./offline/surface-secrets
+
+# Offline Kit configuration
+SCANNER_OFFLINEKIT_ENABLED=false
+SCANNER_OFFLINEKIT_REQUIREDSSE=true
+SCANNER_OFFLINEKIT_REKOROFFLINEMODE=true
+SCANNER_OFFLINEKIT_TRUSTROOTDIRECTORY=/etc/stellaops/trust-roots
+SCANNER_OFFLINEKIT_REKORSNAPSHOTDIRECTORY=/var/lib/stellaops/rekor-snapshot
+SCANNER_OFFLINEKIT_TRUSTROOTS_HOST_PATH=./offline/trust-roots
+SCANNER_OFFLINEKIT_REKOR_SNAPSHOT_HOST_PATH=./offline/rekor-snapshot
+
+# Zastava inherits Scanner defaults; override if Observer/Webhook diverge
+ZASTAVA_SURFACE_FS_ENDPOINT=${SCANNER_SURFACE_FS_ENDPOINT}
+ZASTAVA_SURFACE_CACHE_ROOT=${SCANNER_SURFACE_CACHE_ROOT}
+
+# Scheduler
+SCHEDULER_QUEUE_KIND=Valkey
+SCHEDULER_QUEUE_VALKEY_URL=valkey:6379
+SCHEDULER_SCANNER_BASEADDRESS=http://scanner-web:8444
+
+# Notify
+NOTIFY_WEB_PORT=8446
+
+# Advisory AI
+ADVISORY_AI_WEB_PORT=8448
+ADVISORY_AI_SBOM_BASEADDRESS=http://scanner-web:8444
+ADVISORY_AI_INFERENCE_MODE=Local
+ADVISORY_AI_REMOTE_BASEADDRESS=
+ADVISORY_AI_REMOTE_APIKEY=
+
+# Web UI
+UI_PORT=8443
+
+# NATS
+NATS_CLIENT_PORT=4222
--- a/devops/compose/mirror-data/concelier/.gitkeep
+++ b/devops/compose/mirror-data/concelier/.gitkeep
--- a/devops/compose/mirror-data/excititor/.gitkeep
+++ b/devops/compose/mirror-data/excititor/.gitkeep
--- a/devops/compose/mirror-gateway/README.md
+++ b/devops/compose/mirror-gateway/README.md
@@ -0,0 +1,13 @@
+# Mirror Gateway Assets
+
+This directory holds the reverse-proxy configuration and TLS material for the managed
+mirror profile:
+
+- `conf.d/*.conf` – nginx configuration shipped with the profile.
+- `tls/` – place environment-specific certificates and private keys
+  (`mirror-primary.{crt,key}`, `mirror-community.{crt,key}`, etc.).
+- `secrets/` – populate Basic Auth credential stores (`*.htpasswd`) that gate each
+  mirror domain. Generate with `htpasswd -B`.
+
+The Compose bundle mounts these paths read-only. Populate `tls/` with the actual
+certificates before invoking `docker compose config` or `docker compose up`.
--- a/devops/compose/mirror-gateway/conf.d/mirror-locations.conf
+++ b/devops/compose/mirror-gateway/conf.d/mirror-locations.conf
@@ -0,0 +1,44 @@
+proxy_set_header Host              $host;
+proxy_set_header X-Real-IP         $remote_addr;
+proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
+proxy_set_header X-Forwarded-Proto $scheme;
+proxy_redirect                     off;
+
+add_header X-Cache-Status $upstream_cache_status always;
+
+location = /healthz {
+    default_type application/json;
+    return 200 '{"status":"ok"}';
+}
+
+location /concelier/exports/ {
+    proxy_pass http://concelier_backend/concelier/exports/;
+    proxy_cache mirror_cache;
+    proxy_cache_key $mirror_cache_key;
+    proxy_cache_valid 200 5m;
+    proxy_cache_valid 404 1m;
+    add_header Cache-Control "public, max-age=300, immutable" always;
+}
+
+location /concelier/ {
+    proxy_pass http://concelier_backend/concelier/;
+    proxy_cache off;
+}
+
+location /excititor/mirror/ {
+    proxy_pass http://excititor_backend/excititor/mirror/;
+    proxy_cache mirror_cache;
+    proxy_cache_key $mirror_cache_key;
+    proxy_cache_valid 200 5m;
+    proxy_cache_valid 404 1m;
+    add_header Cache-Control "public, max-age=300, immutable" always;
+}
+
+location /excititor/ {
+    proxy_pass http://excititor_backend/excititor/;
+    proxy_cache off;
+}
+
+location / {
+    return 404;
+}
--- a/devops/compose/mirror-gateway/conf.d/mirror.conf
+++ b/devops/compose/mirror-gateway/conf.d/mirror.conf
@@ -0,0 +1,51 @@
+proxy_cache_path /var/cache/nginx/mirror levels=1:2 keys_zone=mirror_cache:100m max_size=10g inactive=12h use_temp_path=off;
+
+map $request_uri $mirror_cache_key {
+    default $scheme$request_method$host$request_uri;
+}
+
+upstream concelier_backend {
+    server concelier:8445;
+    keepalive 32;
+}
+
+upstream excititor_backend {
+    server excititor:8448;
+    keepalive 32;
+}
+
+server {
+    listen 80;
+    server_name _;
+    return 301 https://$host$request_uri;
+}
+
+server {
+    listen 443 ssl http2;
+    server_name mirror-primary.stella-ops.org;
+
+    ssl_certificate     /etc/nginx/tls/mirror-primary.crt;
+    ssl_certificate_key /etc/nginx/tls/mirror-primary.key;
+    ssl_protocols       TLSv1.2 TLSv1.3;
+    ssl_prefer_server_ciphers on;
+
+    auth_basic "StellaOps Mirror – primary";
+    auth_basic_user_file /etc/nginx/secrets/mirror-primary.htpasswd;
+
+    include /etc/nginx/conf.d/mirror-locations.conf;
+}
+
+server {
+    listen 443 ssl http2;
+    server_name mirror-community.stella-ops.org;
+
+    ssl_certificate     /etc/nginx/tls/mirror-community.crt;
+    ssl_certificate_key /etc/nginx/tls/mirror-community.key;
+    ssl_protocols       TLSv1.2 TLSv1.3;
+    ssl_prefer_server_ciphers on;
+
+    auth_basic "StellaOps Mirror – community";
+    auth_basic_user_file /etc/nginx/secrets/mirror-community.htpasswd;
+
+    include /etc/nginx/conf.d/mirror-locations.conf;
+}
--- a/devops/compose/mirror-gateway/secrets/.gitkeep
+++ b/devops/compose/mirror-gateway/secrets/.gitkeep
--- a/devops/compose/mirror-gateway/tls/.gitkeep
+++ b/devops/compose/mirror-gateway/tls/.gitkeep
--- a/devops/compose/mirror-secrets/.gitkeep
+++ b/devops/compose/mirror-secrets/.gitkeep
--- a/devops/compose/postgres-init/01-extensions.sql
+++ b/devops/compose/postgres-init/01-extensions.sql
@@ -0,0 +1,33 @@
+-- PostgreSQL initialization for StellaOps air-gap deployment
+-- This script runs automatically on first container start
+
+-- Enable pg_stat_statements extension for query performance analysis
+CREATE EXTENSION IF NOT EXISTS pg_stat_statements;
+
+-- Enable other useful extensions
+CREATE EXTENSION IF NOT EXISTS pg_trgm;      -- Fuzzy text search
+CREATE EXTENSION IF NOT EXISTS btree_gin;    -- GIN indexes for scalar types
+CREATE EXTENSION IF NOT EXISTS pgcrypto;     -- Cryptographic functions
+
+-- Create schemas for all modules
+-- Migrations will create tables within these schemas
+CREATE SCHEMA IF NOT EXISTS authority;
+CREATE SCHEMA IF NOT EXISTS vuln;
+CREATE SCHEMA IF NOT EXISTS vex;
+CREATE SCHEMA IF NOT EXISTS scheduler;
+CREATE SCHEMA IF NOT EXISTS notify;
+CREATE SCHEMA IF NOT EXISTS policy;
+CREATE SCHEMA IF NOT EXISTS concelier;
+CREATE SCHEMA IF NOT EXISTS audit;
+CREATE SCHEMA IF NOT EXISTS unknowns;
+
+-- Grant usage to application user (assumes POSTGRES_USER is the app user)
+GRANT USAGE ON SCHEMA authority TO PUBLIC;
+GRANT USAGE ON SCHEMA vuln TO PUBLIC;
+GRANT USAGE ON SCHEMA vex TO PUBLIC;
+GRANT USAGE ON SCHEMA scheduler TO PUBLIC;
+GRANT USAGE ON SCHEMA notify TO PUBLIC;
+GRANT USAGE ON SCHEMA policy TO PUBLIC;
+GRANT USAGE ON SCHEMA concelier TO PUBLIC;
+GRANT USAGE ON SCHEMA audit TO PUBLIC;
+GRANT USAGE ON SCHEMA unknowns TO PUBLIC;
--- a/devops/compose/scripts/backup.sh
+++ b/devops/compose/scripts/backup.sh
@@ -0,0 +1,28 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+echo "StellaOps Compose Backup"
+echo "This will create a tar.gz of Mongo, MinIO (object-store), and Redis data volumes."
+read -rp "Proceed? [y/N] " ans
+[[ ${ans:-N} =~ ^[Yy]$ ]] || { echo "Aborted."; exit 1; }
+
+TS=$(date -u +%Y%m%dT%H%M%SZ)
+OUT_DIR=${BACKUP_DIR:-backups}
+mkdir -p "$OUT_DIR"
+
+docker compose ps >/dev/null
+
+echo "Pausing worker containers for consistency..."
+docker compose pause scanner-worker scheduler-worker taskrunner-worker || true
+
+echo "Backing up volumes..."
+docker run --rm \
+  -v stellaops-mongo:/data/db:ro \
+  -v stellaops-minio:/data/minio:ro \
+  -v stellaops-redis:/data/redis:ro \
+  -v "$PWD/$OUT_DIR":/out \
+  alpine sh -c "cd / && tar czf /out/stellaops-backup-$TS.tar.gz data"
+
+docker compose unpause scanner-worker scheduler-worker taskrunner-worker || true
+
+echo "Backup written to $OUT_DIR/stellaops-backup-$TS.tar.gz"
--- a/devops/compose/scripts/quickstart.sh
+++ b/devops/compose/scripts/quickstart.sh
@@ -0,0 +1,25 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+COMPOSE_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"
+
+ENV_FILE="${1:-$COMPOSE_DIR/env/dev.env.example}"
+USE_MOCK="${USE_MOCK:-0}"
+
+FILES=(-f "$COMPOSE_DIR/docker-compose.dev.yaml")
+ENV_FILES=(--env-file "$ENV_FILE")
+
+if [[ "$USE_MOCK" == "1" ]]; then
+  FILES+=(-f "$COMPOSE_DIR/docker-compose.mock.yaml")
+  ENV_FILES+=(--env-file "$COMPOSE_DIR/env/mock.env.example")
+fi
+
+echo "Validating compose config..."
+docker compose "${ENV_FILES[@]}" "${FILES[@]}" config > /tmp/compose-validated.yaml
+echo "Config written to /tmp/compose-validated.yaml"
+
+echo "Starting stack..."
+docker compose "${ENV_FILES[@]}" "${FILES[@]}" up -d
+
+echo "Stack started. To stop: docker compose ${ENV_FILES[*]} ${FILES[*]} down"
--- a/devops/compose/scripts/reset.sh
+++ b/devops/compose/scripts/reset.sh
@@ -0,0 +1,15 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+echo "WARNING: This will stop the stack and wipe Mongo, MinIO, and Redis volumes."
+read -rp "Type 'RESET' to continue: " ans
+[[ ${ans:-} == "RESET" ]] || { echo "Aborted."; exit 1; }
+
+docker compose down
+
+for vol in stellaops-mongo stellaops-minio stellaops-redis; do
+  echo "Removing volume $vol"
+  docker volume rm "$vol" || true
+done
+
+echo "Reset complete. Re-run compose with your env file to recreate volumes."