# Ingestion Telemetry and Orchestration

## Module
Concelier

## Status
VERIFIED

## Description
Telemetry instrumentation for ingestion pipeline with OpenTelemetry metrics and orchestration registry for connector management.

## Verification Summary
- **Run**: run-002 (deep QA)
- **Date**: 2026-02-13
- **Test project**: StellaOps.Concelier.Core.Tests (569 total, 567 passed, 2 pre-existing FeedSnapshotPinning failures)
- **New tests written**: 24 (ConnectorRegistrationServiceTests 12, WellKnownConnectorsTests 5+6 Theory, DefaultConnectorMetadataProviderTests 2)
- **Bug found and fixed**: DefaultConnectorMetadataProvider null guard test used wrong exception type (ArgumentException vs ArgumentNullException for ThrowIfNullOrWhiteSpace)

## Key Verified Behaviors
- ConnectorRegistrationService: Register/RegisterBatch/Get/List with tenant isolation, schedule, rate policy, egress guard, lock key
- Auth ref defaulting: null -> `secret:concelier/{connectorId}/api-key`, custom passthrough
- Lock key format: `concelier:{tenant}:{connectorId}` for distributed locking
- Egress guard airgap: non-empty allowlist -> AirgapMode=true
- WellKnownConnectors: 6 connectors (NVD, GHSA, OSV, KEV, EPSS, ICS-CISA) with unique IDs, egress allowlists, observations capability
- DefaultConnectorMetadataProvider: lowercase derivation, null/whitespace guard
- IngestionMetrics: OTel Meter with ingestion_write_total and verify_runs_total
- OrchestratorRegistryStore: Upsert/Get/List/Heartbeat/Command/Manifest (14 existing tests)

## Evidence
- `docs/qa/feature-checks/runs/concelier/ingestion-telemetry-and-orchestration/run-002/tier0-source-check.json`
- `docs/qa/feature-checks/runs/concelier/ingestion-telemetry-and-orchestration/run-002/tier1-code-review.json`
- `docs/qa/feature-checks/runs/concelier/ingestion-telemetry-and-orchestration/run-002/tier2-integration-check.json`