Add Decision Capsules, hybrid reachability, and evidence-linked VEX docs

Introduces new marketing bridge documents for Decision Capsules, Hybrid Reachability, and Evidence-Linked VEX. Updates product vision, README, key features, moat, reachability, and VEX consensus docs to reflect four differentiating capabilities: signed reachability (hybrid static/runtime), deterministic replay, explainable policy with evidence-linked VEX, and sovereign/offline operation. All scan decisions are now described as sealed, reproducible, and audit-grade, with explicit handling of 'Unknown' states and hybrid reachability evidence.

docs/reachability/hybrid-attestation.md

@@ -1,10 +1,25 @@
 # Hybrid Reachability Attestation (Graph + Edge-Bundle)
 
-> Decision date: 2025-11-23 · Owners: Scanner Guild, Attestor Guild, Signals Guild, Policy Guild
+> Decision date: 2025-12-11 · Owners: Scanner Guild, Attestor Guild, Signals Guild, Policy Guild
+
+<!-- TODO: Review for separate approval - updated hybrid attestation introduction -->
+## 0. Context: Four Capabilities
+
+This document supports **Signed Reachability**—one of four capabilities no competitor offers together:
+
+1. **Signed Reachability** – Every reachability graph is sealed with DSSE; optional edge-bundle attestations for runtime/init/contested paths. Both static call-graph edges and runtime-derived edges can be attested—true hybrid reachability.
+2. **Deterministic Replay** – Scans run bit-for-bit identical from frozen feeds and analyzer manifests.
+3. **Explainable Policy (Lattice VEX)** – Evidence-linked VEX decisions with explicit "Unknown" state handling.
+4. **Sovereign + Offline Operation** – FIPS/eIDAS/GOST/SM/PQC profiles and offline mirrors as first-class toggles.
+
+All evidence is sealed in **Decision Capsules** for audit-grade reproducibility.
+
+---
 
 ## 1. Purpose
 - Guarantee replayable, signed reachability evidence with **graph-level DSSE** for every scan while enabling **selective edge-level DSSE bundles** when finer provenance or dispute handling is required.
 - Keep CI/offline bundles lean (graph-first), but allow auditors/regulators to quarantine or prove individual edges without regenerating whole graphs.
+- Support **hybrid reachability** by attesting both static call-graph edges and runtime-derived edges.
 
 ## 2. Attestation levels
 - **Level 0 (Graph DSSE) — Required**
@@ -24,6 +39,7 @@
   - Always emit Level 0 graph + manifest.
   - When criteria match, emit Level 1 bundles; include `bundle_reason` (e.g., `runtime-hit`, `init-root`, `third-party`, `disputed`).
   - Canonicalise JSON (sorted keys/arrays) before hashing; BLAKE3 as graph hash, SHA-256 inside bundles.
+  - For hybrid reachability: tag edges with `source: static` or `source: runtime` to distinguish call-graph derived vs. runtime-observed edges.
 - **Attestor/Signer**
   - Apply DSSE for both levels; respect sovereign crypto modes (FIPS/GOST/SM/PQC) from environment.
   - Rekor: push graph envelope digests; push edge-bundle digests only when `rekor_publish=true` (policy/default for high-risk bundles).
@@ -35,7 +51,7 @@
 - **Policy**
   - Default trust path: graph DSSE + CAS object.
   - When an edge is quarantined/contested, drop it from consideration if an edge-bundle DSSE marks it `revoked=true` or if the Unknowns registry lists it with policy quarantine flag.
-  - For “evidence-required” rules, require either (a) graph DSSE + policy_hash match **or** (b) edge-bundle DSSE that covers the vulnerable path edges.
+  - For "evidence-required" rules, require either (a) graph DSSE + policy_hash match **or** (b) edge-bundle DSSE that covers the vulnerable path edges.
 - **Replay/Bench/CLI**
   - `stella graph verify` should accept `--graph {hash}` and optional `--edge-bundles` to validate deeper provenance offline.
 
@@ -43,13 +59,32 @@
 - **Happy path**: verify graph DSSE → verify Rekor inclusion (or mirror) → hash graph body → match `graph_hash` in policy/replay manifest → accept.
 - **Dispute/quarantine**: mark specific `edge_id` as `revoked` in an edge-bundle DSSE; Policy/Signals exclude it, recompute reachability, and surface delta in explainers.
 - **Offline**: retain graph DSSE and selected edge-bundles inside replay pack; Rekor proofs cached when available.
+- **Sovereign Verification Mode**: Even with no internet, all signatures and transparency proofs can be locally verified using Offline Update Kits.
 
 ## 6. Performance & storage guardrails
 - Default: only graph DSSE is mandatory; edge-bundles capped at 512 edges per envelope and emitted only on criteria above.
 - Rekor flood control: cap edge-bundle Rekor submissions per graph (config `reachability.edgeBundles.maxRekorPublishes`, default 5). Others stay CAS-only.
 - Determinism: bundle ordering = stable sort by `(bundle_reason, edge_id)`; hash before signing.
 
-## 7. Open decisions (tracked in Sprint 0401 tasks 53–56)
+## 7. Hybrid Reachability Details
+
+<!-- TODO: Review for separate approval - added hybrid reachability details -->
+Stella Ops provides **true hybrid reachability** by combining:
+
+| Signal Type | Source | Attestation |
+|-------------|--------|-------------|
+| Static call-graph edges | IL/bytecode analysis, framework routing models, entry-point proximity | Graph DSSE (Level 0) |
+| Runtime-observed edges | EventPipe, JFR, Node inspector, Go/Rust probes | Edge-bundle DSSE (Level 1) with `source: runtime` |
+
+**Why hybrid matters:**
+- Static analysis catches code paths that may not execute during observed runtime
+- Runtime analysis catches dynamic dispatch, reflection, and framework-injected paths
+- Combining both provides confidence across build and runtime contexts
+- Each edge type is separately attestable for audit and dispute resolution
+
+**Evidence linking:** Each edge in the graph or bundle includes `evidenceRefs` pointing to the underlying proof artifacts (static analysis artifacts, runtime traces), enabling **evidence-linked VEX decisions**.
+
+## 8. Open decisions (tracked in Sprint 0401 tasks 53–56)
 - Rekor publish defaults per deployment tier (regulated vs standard).
 - CLI UX for selective bundle verification.
 - Bench coverage for edge-bundle verification time/size.

docs/reachability/lattice.md

@@ -1,15 +1,20 @@
 # Reachability Lattice & Scoring Model
 
-> **Status:** Draft – mirrors the November 2025 advisory on confidence-based reachability.  
+> **Status:** Draft – mirrors the December 2025 advisory on confidence-based reachability.
 > **Owners:** Scanner Guild · Policy Guild · Signals Guild.
 
+> Stella Ops isn't just another scanner—it's a different product category: **deterministic, evidence-linked vulnerability decisions** that survive auditors, regulators, and supply-chain propagation.
+
 This document defines the confidence lattice, evidence types, mitigation scoring, and policy gates used to turn static/runtime signals into reproducible reachability decisions and VEX statuses.
 
 ---
 
 ## 1. Overview
 
-Classic “reachable: true/false” answers are too brittle. Stella Ops models reachability as an **ordered lattice** with explicit states and scores. Each analyzer/runtime probe emits `Evidence` documents; mitigations add `Mitigation` entries. The lattice engine joins both inputs into a `ReachDecision`:
+<!-- TODO: Review for separate approval - updated lattice overview -->
+**Key differentiator:** Unlike simplistic yes/no reachability approaches, the Stella Ops lattice model explicitly handles an **"Unknown"** (under_investigation) state, ensuring incomplete data doesn't lead to false safety. Every VEX decision is evidence-linked with proof pointers to the underlying reachability evidence.
+
+Classic "reachable: true/false" answers are too brittle. Stella Ops models reachability as an **ordered lattice** with explicit states and scores. Each analyzer/runtime probe emits `Evidence` documents; mitigations add `Mitigation` entries. The lattice engine joins both inputs into a `ReachDecision`:
 
 ```
 UNOBSERVED (0–9)
@@ -75,10 +80,10 @@ public sealed record ReachDecision(
 
 | Evidence class           | Base score contribution |
 |--------------------------|-------------------------|
-| Static path (call graph) | ≥ 30                    |
-| Runtime hit              | ≥ 60                    |
-| User-tainted flow        | ≥ 80                    |
-| “Constraints removed”    | = 100                   |
+| Static path (call graph) | ≥ 30                    |
+| Runtime hit              | ≥ 60                    |
+| User-tainted flow        | ≥ 80                    |
+| "Constraints removed"    | = 100                   |
 | Lockfile-only evidence   | 10 (if no other signals)|
 
 Mitigations subtract up to 40 points (configurable):
@@ -106,11 +111,11 @@ Default thresholds (edit in `reachability.policy.yml`):
 
 VEX mapping:
 
-* **not_affected**: score ≤ 25 or mitigations dominate (score reduced below threshold).
-* **affected**: score ≥ 60 (dynamic evidence without sufficient mitigation).
-* **under_investigation**: everything between.
+* **not_affected**: score ≤ 25 or mitigations dominate (score reduced below threshold).
+* **affected**: score ≥ 60 (dynamic evidence without sufficient mitigation).
+* **under_investigation**: everything between. **This explicit "Unknown" state is a key differentiator**—incomplete data never leads to false safety.
 
-Each decision records `reachability.policy.version`, analyzer versions, policy hash, and config snapshot so downstream verifiers can replay the exact logic.
+Each decision records `reachability.policy.version`, analyzer versions, policy hash, and config snapshot so downstream verifiers can replay the exact logic. All decisions are sealed in Decision Capsules for audit-grade reproducibility.
 
 ---
 
@@ -125,7 +130,7 @@ Each decision records `reachability.policy.version`, analyzer versions, policy h
 | Mitigations | WAF connectors, patch diff, kill switches | `MitigationKind.*` via `Mitigation` records |
 | Trust | Vendor VEX statements, manual overrides | `VendorVexNotAffected/Affected`, `ManualOverride` |
 
-Each evidence object **must** log `Source`, timestamps, and references (function IDs, config hashes) so auditors can trace it in the event graph.
+Each evidence object **must** log `Source`, timestamps, and references (function IDs, config hashes) so auditors can trace it in the event graph. This enables **evidence-linked VEX decisions** where every assertion includes pointers to the underlying proof.
 
 ---
 
@@ -185,7 +190,20 @@ See `src/Scanner/StellaOps.Scanner.WebService/Reachability/Runtime/DotNetRuntime
 
 ---
 
-## 9. Roadmap
+## 9. Hybrid Reachability
+
+<!-- TODO: Review for separate approval - added hybrid reachability section -->
+Stella Ops combines **static call-graph analysis** with **runtime process tracing** for true hybrid reachability:
+
+- **Static analysis** provides call-graph edges from IL/bytecode analysis, framework routing models, and entry-point proximity calculations.
+- **Runtime analysis** provides observed method hits, stack samples, and HTTP route hits from live or shadow traffic.
+- **Hybrid reconciliation** merges both signal types, with each edge type attestable via DSSE. See `docs/reachability/hybrid-attestation.md` for the attestation model.
+
+This hybrid approach ensures that both build-time and run-time context contribute to the same verdict, avoiding the blind spots of purely static or purely runtime analysis.
+
+---
+
+## 10. Roadmap
 
 | Task | Description |
 |------|-------------|
@@ -195,4 +213,3 @@ See `src/Scanner/StellaOps.Scanner.WebService/Reachability/Runtime/DotNetRuntime
 | `REACH-POLICY-402-026` | Expose reachability gates in Policy DSL & CLI (edit/lint/test). |
 
 Keep this doc updated as the lattice evolves or new signals/mitigations are added.
-*** End Patch