6578c82602
The gateway service was a redundant deployment of the same StellaOps.Gateway.WebService binary already running as router-gateway. It served no unique purpose — all traffic is handled by router-gateway (slot 0). This removes the container, its route table entries, nginx proxy blocks, health/quota stubs, and redirects STELLAOPS_GATEWAY_URL to router.stella-ops.local so the Angular frontend resolves API base URLs through the canonical frontdoor. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Platform architecture & module dossiers
Use this index to locate platform-level architecture references and per-module dossiers.
Core views
- Architecture overview (10-minute tour)
- High-level architecture (reference map)
- Scanner core contracts
- Authority (legacy overview)
- Console operator guide and deep dives under ui/operations and ux
- Component map (quick descriptions of every module under
src/)
Detailed references
- Canonical webservice catalog
- Platform topology
- Infrastructure dependencies
- Request and data flows
- Data isolation model
- Security boundaries
Docs validation
Use the architecture docs validation check to detect service-path and hostname drift:
powershell -NoProfile -ExecutionPolicy Bypass -File ./docs/technical/architecture/scripts/validate-webservice-docs.ps1
Intentional failing fixture (sanity check for the validator):
powershell -NoProfile -ExecutionPolicy Bypass -File ./docs/technical/architecture/scripts/validate-webservice-docs.ps1 `
-Files "docs/technical/architecture/fixtures/webservice-docs-invalid-fixture.md"
User-centric views (NEW)
- User flows (UML diagrams) - End-to-end flows from user perspective
- Module matrix - Complete 46-module inventory with categorization
- Data flows - SBOM, advisory, VEX, and policy data lifecycles
- Schema mapping - PostgreSQL, Valkey, and RustFS storage reference
Policy engine deep dives (NEW)
Comprehensive documentation of how data feeds policy decisions:
- Policy Engine Data Pipeline - Master view of all data flowing to policy engine
- SBOM Analyzer Inventory - Complete inventory of 25 analyzers (11 language, 9 OS, 4 surface, 1 capability)
- Runtime Agents Architecture - eBPF observation, Zastava container observer, signal processing
- Call Graph Analysis - ReachGraph construction, BFS path finding, 8-state reachability
- Confidence Scoring - 5-factor weighted scoring (RCH, RTS, VEX, PRV, POL)
- K4 Lattice Logic - Four-valued logic for handling uncertainty and conflicts
End-to-end workflow flows
Comprehensive flow documentation for all major StellaOps workflows: flows/
| Category | Flows |
|---|---|
| Core Platform | Dashboard, Scan Submission, SBOM Generation, Policy Evaluation, Notification, Export |
| Advanced | CI/CD Gate, Advisory Drift Re-scan, VEX Auto-Generation, Evidence Bundle Export |
| Enterprise | Multi-Tenant Policy Rollout, Exception Approval, Risk Score Dashboard |
| Specialized | Binary Delta Attestation, Offline Sync, Reachability Drift Alert |
Module catalogue
Each module directory bundles an ownership charter (AGENTS.md), current work (TASKS.md), an architecture dossier, and an implementation plan. Operations guides live under operations/ where applicable.
Tip: every module directory also exposes
README.md,AGENTS.md, andTASKS.mdfor roles, current backlog, and ownership responsibilities.