master
651b8e0fa3
- Added "StellaOps.Policy.Engine", "StellaOps.Cartographer", and "StellaOps.SbomService" projects to the StellaOps solution. - Created AGENTS.md to outline the Contract Testing Guild Charter, detailing mission, scope, and definition of done. - Established TASKS.md for the Contract Testing Task Board, outlining tasks for Sprint 62 and Sprint 63 related to mock servers and replay testing.
Stella Ops
Self‑hosted, SBOM‑first DevSecOps platform – offline‑friendly, AGPL‑3.0, free up to {{ quota_token }} scans per UTC day (soft delay only, never blocks).
Stella Ops lets you discover container vulnerabilities in < 5 s without sending a single byte outside your network.
Everything here is open‑source and versioned — when you check out a git tag, the docs match the code you are running.
🚀 Start here (first 60 minutes)
| Step | What you will learn | Doc |
|---|---|---|
| 1 ️⃣ | 90‑second elevator pitch & pillars | What Is Stella Ops? |
| 2 ️⃣ | Pain points it solves | Why Does It Exist? |
| 3 ️⃣ | Install & run a scan in 10 min | Install Guide |
| 4 ️⃣ | Components & data‑flow | High‑Level Architecture |
| 5 ️⃣ | Integrate the CLI / REST API | API & CLI Reference |
| 6 ️⃣ | Vocabulary used throughout the docs | Glossary |
📚 Complete Table of Contents
Click to expand the full docs index
Overview
- 01 – What Is Stella Ops?
- 02 – Why Does It Exist?
- 03 – Vision & Road‑map
- 04 – Feature Matrix
Reference & concepts
- 05 – System Requirements Specification
- 07 – High‑Level Architecture
- 08 – Architecture Decision Records
- 08 – Module Architecture Dossiers
- 09 – API & CLI Reference
- 10 – Plug‑in SDK Guide
- 10 – Concelier CLI Quickstart
- 10 – BuildX Generator Quickstart
- 10 – Scanner Cache Configuration
- 30 – Excititor Connector Packaging Guide
- 30 – Developer Templates
- 11 – Authority Service
- 11 – Data Schemas
- 12 – Performance Workbook
- 13 – Release‑Engineering Playbook
- 30 – Fixture Maintenance
User & operator guides
- 14 – Glossary
- 15 – UI Guide
- 17 – Security Hardening Guide
- 18 – Coding Standards
- 19 – Test‑Suite Overview
- 21 – Install Guide
- 22 – CI/CD Recipes Library
- 23 – FAQ
- 24 – Offline Update Kit Admin Guide
- 25 – Mirror Operations Runbook
- 26 – Concelier Apple Connector Operations
- 27 – Authority Key Rotation Playbook
- 28 – Concelier CCCS Connector Operations
- 29 – Concelier CISA ICS Connector Operations
- 30 – Concelier CERT-Bund Connector Operations
- 31 – Concelier MSRC Connector – AAD Onboarding
- 32 – Scanner Analyzer Bench Operations
- 33 – Scanner Artifact Store Migration
- 34 – Zastava Runtime Operations Runbook
Legal & licence
- 32 – Legal & Quota FAQ
🧹 Backlog hygiene
Imposed rule: Work of this type or tasks of this type on this component must also be applied everywhere else it should be applied.
- Aggregation-Only Contract (AOC). Ingestion services aggregate and link facts only—derived precedence, severity, and safe-fix hints live in Policy overlays and dedicated explorers. Review
../AGENTS.mdand the AOC guardrails inaoc/aoc-guardrails.md. - Cartographer owns graphs. SBOM Service emits projections/events; Cartographer (
CARTO-GRAPH-21-00x) builds graph storage, overlays, and tiles. SeeARCHITECTURE_CONCELIER.md(Cartographer handshake section) for handoff boundaries. - Notifier replaces legacy Notify. Sprint‑15
StellaOps.Notify.*tasks are frozen; use the Notifications Studio/Notifier backlogs (NOTIFY-SVC-38..40,WEB-NOTIFY-3x-00x,CLI-NOTIFY-3x-00x). - Dedicated services for Vuln & Policy. Vuln Explorer work flows through
src/StellaOps.VulnExplorer.Api/Console/CLI (Sprint 29); gateway routes proxy only. Policy Engine remains the sole source for precedence/suppression overlays. - Cleanup log. The backlog consolidation summary lives in
backlog/2025-10-cleanup.md.
© 2025 Stella Ops contributors – licensed AGPL‑3.0‑or‑later