3871732765
Continues the SPRINT_20260422_004_Concelier_full_connector_control_plane
feature stream started in commit 5c1b59580 (Excititor provider management
endpoints + contracts + service + tests). Adds the CLI + Web surfaces on
top of that backend.
CLI (src/Cli/**):
- CommandHandlers + BackendOperationsClient extended with provider
management calls
- ExcititorProviderSummary model added to the CLI's service models
- NonCoreCliCommandModule wires the new commands; tests updated
- TASKS.md entries synced
Web console (src/Web/StellaOps.Web/**):
- New vex-provider-catalog.component + vex-provider-management.api client
- advisory-source-catalog + advisory-vex-route-helpers extended to route
users to the new VEX provider surface
- integration-hub.routes.ts registers the new route
- security-disposition-page.component.ts updated for the flow
Excititor/Concelier docs + contracts:
- docs/modules/excititor/operations/provider-control-plane.md — operator
guide for the new control plane
- docs/modules/excititor/README.md + docs/modules/concelier/{README,
connectors}.md — cross-links + refs
- ConfiguredAdvisorySourceService.cs — additional provider plumbing
- StellaOps.Excititor.WebService/TASKS.md synced
Sprint doc (docs/implplan/SPRINT_20260422_004_*.md) reflects the
in-flight progress.
This is external-stream work picked up during the 2026-04-22 session's
closeout — bundling it now so the working tree is clean and main stays
in sync with local feature-branch state.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
77 lines
4.6 KiB
Markdown
77 lines
4.6 KiB
Markdown
# StellaOps Concelier
|
||
|
||
Concelier maintains a catalog of **78 advisory source definitions** and currently wires **31 built-in runnable advisory pipelines** in the default WebService host. It converts signed advisories into immutable observations plus linksets under the Aggregation-Only Contract (AOC).
|
||
|
||
Current operator references:
|
||
|
||
- Full advisory inventory and runnable-vs-catalog truth: [`connectors.md`](./connectors.md)
|
||
- Stored credential and endpoint override entry paths: [`operations/source-credentials.md`](./operations/source-credentials.md)
|
||
- Per-connector runbooks: `./operations/connectors/`
|
||
|
||
## Responsibilities
|
||
- Fetch and normalise vulnerability advisories via restart-time connectors.
|
||
- Persist observations and correlation linksets without precedence decisions.
|
||
- Emit deterministic exports (JSON, Trivy DB) for downstream policy evaluation.
|
||
- Coordinate offline/air-gap updates via Offline Kit bundles.
|
||
- Serve paragraph-anchored advisory chunks for Advisory AI consumers without breaking the Aggregation-Only Contract.
|
||
- Do not emit promotion PASS/FAIL decisions; promotion gate decisions are owned by Policy Engine.
|
||
|
||
## Key components
|
||
- `StellaOps.Concelier.WebService` orchestration host.
|
||
- Connector libraries under `StellaOps.Concelier.Connector.*`.
|
||
- Exporter packages (`StellaOps.Concelier.Exporter.*`).
|
||
|
||
## Recent updates
|
||
- **2025-11-07:** Paragraph-anchored `/advisories/{advisoryKey}/chunks` endpoint shipped for Advisory AI paragraph retrieval. Details and rollout notes live in [`../../implplan/archived/updates/2025-11-07-concelier-advisory-chunks.md`](../../implplan/archived/updates/2025-11-07-concelier-advisory-chunks.md).
|
||
|
||
## Integrations & dependencies
|
||
- PostgreSQL (schema `vuln`) for canonical observations and schedules.
|
||
- Policy Engine / Export Center / CLI for evidence consumption.
|
||
- Notify and UI for advisory deltas.
|
||
|
||
## Operational notes
|
||
- Connector runbooks in ./operations/connectors/.
|
||
- Mirror operations for Offline Kit parity.
|
||
- Grafana dashboards for connector health.
|
||
- **Authority toggle rollout (2025-10-22 update).** Follow the phased table and audit checklist in `../../CONCELIER_CLI_QUICKSTART.md` when enabling `authority.enabled`/`authority.allowAnonymousFallback`, and cross-check the refreshed `./operations/authority-audit-runbook.md` before enforcement.
|
||
|
||
## Related resources
|
||
- ./operations/conflict-resolution.md
|
||
- ./operations/mirror.md
|
||
- ./operations/authority-audit-runbook.md
|
||
- ../../CONCELIER_CLI_QUICKSTART.md (authority integration timeline & smoke tests)
|
||
|
||
## Backlog references
|
||
- DOCS-LNM-22-001, DOCS-LNM-22-007 in ../../TASKS.md.
|
||
- Connector-specific TODOs in `src/Concelier/**/TASKS.md`.
|
||
|
||
## Epic alignment
|
||
- **Epic 1 – AOC enforcement:** uphold raw observation invariants, provenance requirements, linkset-only enrichment, and AOC verifier guardrails across every connector.
|
||
- **Epic 10 – Export Center:** expose deterministic advisory exports and metadata required by JSON/Trivy/mirror bundles.
|
||
|
||
## Implementation Status
|
||
|
||
**Delivery Phases:**
|
||
- Phase 1 (Guardrails & schema) – PostgreSQL validators, AOCWriteGuard interceptor, deterministic linkset builders operational
|
||
- Phase 2 (API & observability) – Ingestion/verification endpoints with Authority scopes, telemetry, Offline Kit packaging
|
||
- Phase 3 (Experience polish) – CLI/Console affordances, Export Center hand-off metadata, CI enforcement
|
||
|
||
**Acceptance Criteria:**
|
||
- PostgreSQL validators and runtime guards reject forbidden fields and missing provenance with ERR_AOC_00x codes
|
||
- Linksets and supersedes chains deterministic; identical payloads yield byte-identical documents
|
||
- CLI `stella aoc verify` exits non-zero on violations, zero on clean datasets
|
||
- Export Center consumes advisory datasets without legacy normalized fields
|
||
- CI fails on lint violations or guard test regressions
|
||
|
||
**Key Risks & Mitigations:**
|
||
- Collector drift: guard middleware + CI lint + schema validation; RFC required for linkset changes
|
||
- Migration complexity: staged cutover with backup copies, temporary views for Policy Engine parity
|
||
- Performance overhead: guard remains O(number of keys), index review for insert latency targets
|
||
- Tenancy leakage: tenant required in schema, Authority claims enforced, observability alerts
|
||
|
||
**Recent Milestones:**
|
||
- Sprint 110 attestation chain validated, evidence bundle tests green
|
||
- Link-Not-Merge cache and console consumption docs frozen
|
||
- Observation events transport reviewed, NATS/air-gap guidance updated
|
||
- Testing-only legacy `AddInMemoryStorage()` compatibility moved into explicit web-service test harnesses, and runtime observation-event defaults no longer imply an undocumented `"inmemory"` transport
|