RiskEngine (pointer — the deployables are retired)
The dossier is
findings/architecture.md. RiskEngine is not a separate service. Its source lives undersrc/Findings/and its capability is part of the consolidated Findings family (ADR-039 D14).
What happened
Owner ruling Q-2 (2026-08-25) — retire-and-rehome. Executed by SPRINT_20260722_010 FND-10 on 2026-08-27.
| Retired (deleted) | Kept (folded into Findings) |
|---|---|
StellaOps.RiskEngine.WebService — the /risk-scores/* route mappings | StellaOps.RiskEngine.Core — providers, contracts, scoring services |
StellaOps.RiskEngine.Worker — the CVSS/KEV snapshot exporter | StellaOps.RiskEngine.Infrastructure — PostgresRiskScoreResultStore |
StellaOps.RiskEngine.Application — the /exploit-maturity/* endpoint group | the riskengine schema and riskengine.risk_score_results, now in stellaops_findings |
the riskengine-web and riskengine-worker compose keys and images | worker-side scoring, as a role of findings-worker |
The evidence behind the ruling, measured on the running containers before they stopped: the HTTP surface had zero gateway routes in both live configs and zero callers anywhere in src/(the only hits outside its own tree were generated openapi_current.json files inside build output), and the worker’s hourly exporter produced zero exports in 16 hours of uptime because it returned early against the vuln.* schema the G1 cutover had dropped.
StellaOps.RiskEngine.Core is not dead code: src/Policy/__Libraries/StellaOps.Policy.Predicates references it directly, and src/__Tests/e2e/GoldenSetDiff compiles it. Do not delete it as part of a cleanup.
Where things went
| You were looking for | Read instead |
|---|---|
| architecture, persistence, operations | findings/architecture.md |
| the HTTP surface | there is none — a risk-score read API will be designed on /api/findings/v1/* when a real consumer exists |
| the scoring provider set and the exploit-maturity taxonomy | src/Findings/StellaOps.RiskEngine.Core/ (RiskScoreProviderRegistry, ExploitMaturityLevel) — still the source of truth |
the riskengine schema | StellaOps.Findings.Persistence/Migrations/001_findings_consolidated_baseline.sql |
| the pre-consolidation dossier | docs-archive/modules/risk-engine/ |
Historical API snapshot
openapi/v1.json is the retained snapshot of the retired RiskEngine host. api-reference.mdis its generated Markdown reference, not evidence of a live RiskEngine endpoint surface. Risk-scoring capability remains in the Findings family described above.
Live regeneration from the deleted host is unavailable. Offline Markdown regeneration from the unchanged retained specification remains supported by the first-party OpenAPI documentation generator and must pass the generated-doc byte-parity guard. Keep retirement context in this README, outside the generated reference. Do not rewrite the historical specification to describe Findings or restore a retired host merely to regenerate its documentation.