Canonical Webservice Catalog

This page is the source-of-truth inventory of StellaOps *.WebService runtime services: their canonical hostnames, purpose, persistence, source paths, and deployment status. Use it to look up which service serves a hostname, which module owns it, and whether it ships in the default stack. It is written for operators, integrators, and reviewers.

Scope and contract

• Inventory source: rg --files src -g "*WebService.csproj" (32 projects match as of this reconciliation).
• Lists every *.WebService project found in src/, with deployment status called out per row. The “Active webservices” table covers services deployed in the main stack (devops/compose/docker-compose.stella-services.yml); the “Non-default and not-yet-deployed webservices” table covers *.WebService projects that are opt-in, retired-but-retained, or shared library hosts not wired into a compose stack.
• Excludes non-WebService API binaries (for example StellaOps.Policy.Engine, StellaOps.Policy.Gateway, StellaOps.Graph.Api, StellaOps.Symbols.Server, StellaOps.Registry.TokenService, StellaOps.SmRemote.Service, and StellaOps.ReleaseOrchestrator.WebApi) even though they may bind *.stella-ops.local aliases. Note: StellaOps.VulnExplorer.Api has been merged into StellaOps.Findings.Ledger.WebService (SPRINT_20260408_002).
• There is no StellaOps.JobEngine.WebService. The historic jobengine / jobengine-worker containers were retired (Slot 17 in compose: “jobengine and jobengine-worker removed; WebService retired”). Release orchestration, approvals, and DAG/workflow now live in the release-orchestrator service (StellaOps.ReleaseOrchestrator.WebApi, excluded above as a *.WebApi binary) and the workflow service (StellaOps.Workflow.WebService, listed below); scheduling stays in scheduler (StellaOps.Scheduler.WebService).
• Canonical runtime hostname form: <service>.stella-ops.local.

Runtime hostname convention and exceptions

• Runtime service-discovery URLs in docs should use https://<service>.stella-ops.local (or the HTTP equivalent when TLS is intentionally not shown).
• Permitted exceptions:
  • Infrastructure aliases (db.stella-ops.local, cache.stella-ops.local, s3.stella-ops.local, rekor.stella-ops.local). registry.stella-ops.local LEFT this list at the SR-6 cutover (2026-08-21): it used to name a third-party zot, i.e. genuine infrastructure, and now names the product’s own registry-web, which follows the convention as a service rather than needing an exception. Its own canonical name is stella-registry.stella-ops.local; it also answers the inherited alias.
  • Loopback/dev diagnostics (localhost, 127.x.y.z) where transport wiring is the point of the example.
  • Non-runtime identifiers/file names (for example the hosts.stellaops.local file path).

Active webservices

Note: TimelineIndexer and Notify reflect in-place consolidations, and both are now complete. timelineindexer.stella-ops.local is served by the merged timeline-web container (Slot 23 → Slot 24) and StellaOps.TimelineIndexer.WebService was archived to src/__Obsoleted/Timeline/ on 2026-08-10. The Notifier web surface runs inside notify-web, and StellaOps.Notifier.WebService was archived to src/__Obsoleted/Notifier/ on 2026-09-08 (SPRINT_20260722_015 NTF-10) together with the rest of that tree. Neither builds.

Non-default and not-yet-deployed webservices

These *.WebService projects exist in src/ but are not part of the default docker-compose.stella-services.yml runtime. They are listed for inventory completeness.

Related references

• Port Registry — service ports and exposure
• Webservices Valkey Rollout Matrix — transport rollout state per service
• User Flow Architecture — gateway-facing endpoints by user action
• Schema Mapping — per-service persistence ownership