VexHub — RETIRED

Status: RETIRED (2026-08-05). Nothing in this directory describes a running system.
Successor: the vulnerability hub — ../vulnerabilities/architecture.md.

VexHub was the VEX aggregation and distribution service. It no longer exists:

Service stopped in the SPRINT_20260722_008 VULN-G1 cutover window (2026-08-04).
Schema dropped — vexhub was removed from stellaops_platform in the same window.
Routes removed — the B7 route swap deleted every gateway route reaching vexhub.
Console surfaces removed — the four old vulnerability-plane prefixes (concelier, concelierJobs, vexHub, vexLens) are out of the Console prefix registry. Those surfaces were removed rather than repointed, because the hub serves no successor for VEX statement search, consensus, conflicts, or noise gating.
Source deleted — src/VexHub/ was removed by SPRINT_20260722_003 VULN-B1 (2026-08-05) after a sweep found zero production consumers: the only ProjectReferences into the tree came from VexLens (deleted in the same change), and no .cs file outside the two trees carried a StellaOps.VexHub.* using directive.

Where its concerns went

VexHub concern	Where it lives now
VEX statement ingestion	Hub ingestion — raw documents plus the first-party issuer DSSE submission path (`vuln:submit`)
VEX modelling	Hub facts, not observations — `VulnFact` with the CSAF/OpenVEX normalizers
Serving VEX for a product	`GET /api/vulnerabilities/v1/vex/{vulnerabilityId}/{productKey}`
Offline distribution	Hub corpus export — `GET /api/vulnerabilities/v1/corpus/export`, consumed by `stella vuln-db export --from-hub`

This is a retirement with a narrower successor, not a like-for-like migration: the hub carries no observation model, no per-statement signature records, and no Rekor linkage.

The other files here are a historical record

architecture.md, api-reference.md, integration-guide.md, storage-model-decision.md and openapi/ describe the retired service. They are kept so the decision trail survives — they are not guidance, and the endpoints they document return 404 or 503 at the gateway today.