Findings

The dossier is architecture.mdin this directory — the consolidated Findings service (ADR-039 D14), live since the FND-9 cutover (2026-08-26). It replaced findings-ledger/architecture.mdas the “what runs today” view on 2026-08-27; that page is kept for the ledger’s event-spine, hashing and replay detail, which the consolidated family inherits unchanged.

src/Findings/ is the consolidated findings domain. One deployable family, two replica roles (findings-web, findings-worker), one database (stellaops_findings).

CapabilitySourceOwns
Consolidated host (the whole /api/findings/v1/* surface)src/Findings/StellaOps.Findings.WebService/—
Consolidated worker (projections, scoring role)src/Findings/StellaOps.Findings.Worker/—
Findings Ledger (append-only system of record)src/Findings/StellaOps.Findings.Ledger*findings schema
Security read-modelsrc/Findings/__Libraries/StellaOps.Findings.Security.Application/findings_security schema
Vulnerability correlation / analytics ingestion → findings-ledger/vuln-correlation.mdsrc/Findings/__Libraries/StellaOps.Findings.VulnCorrelation.*analytics schema
Risk scoring (capability kept, surface retired) → riskengine/src/Findings/StellaOps.RiskEngine.Core + __Libraries/StellaOps.RiskEngine.Infrastructureriskengine schema
VulnExplorer (merged, no standalone projects)src/Findings/__Libraries/StellaOps.Findings.Ledger.Application/Endpoints/VulnExplorerEndpoints.cs—

Predecessor hosts. riskengine-web, riskengine-worker and findings-vulncorrelation were deleted at FND-10 (2026-08-27). findings-ledger-web and findings-security-web still exist in src/; see architecture.md §7 for the measured reason.

VulnExplorer correction (2026-07-12; path re-verified 2026-08-25). There is no src/Findings/StellaOps.VulnExplorer.* project on disk: the standalone container was decommissioned (SPRINT_20260408_002) and the endpoints now live in the Ledger Application layer (src/Findings/__Libraries/StellaOps.Findings.Ledger.Application/ — Endpoints/VulnExplorerEndpoints.cs, Contracts/VulnExplorer/, Services/VulnExplorerAdapters.cs); the compose slot is commented out (docker-compose.stella-services.yml:1651). The historical dossier at docs-archive/modules/vuln-explorer/ is archived reference only.

riskengine-web surface disposition — Q-2 ruled 2026-08-25: retire-and-rehome. The /risk-scores/* and /exploit-maturity/* HTTP surfaces are RETIRED with the predecessor host (RiskEngine.WebService route mappings + RiskEngine.Application’s endpoint group — zero gateway routes, zero src/ callers, measured F-R0817-4). The risk-scoring CAPABILITY is kept and folds per ADR-039 D14: RiskEngine.Core, PostgresRiskScoreResultStore, the riskengine schema (risk_score_results), and worker-side scoring move into findings-web/findings-worker. Any future risk-score read API is designed on the canonical /api/findings/v1/* surface when a real consumer exists. Execution: SPRINT_20260722_010 FND-8 (composition) + FND-10 (deletion set).

/api/vuln-explorer/* disposition — Q-1 ruled 2026-08-25: retire-and-rehome. The route prefix is RETIRED: no host serves it (live-probed 404s), and the gateway rule preserved the prefix onto a path nothing implements. The capability endpoints above serve /v1/* paths (e.g. /v1/evidence-subgraph/{vulnId}) and are reached via the canonical /api/findings/v1/* surface. The sweep — gateway rule, Console repoint-or-delete, Authority vuln-explorer identity and stellaops:vuln-explorer permalink audience, remaining name-carriers — is SPRINT_20260722_010 FND-11.

Docs in this directory