Add Decision Capsules, hybrid reachability, and evidence-linked VEX docs

Introduces new marketing bridge documents for Decision Capsules, Hybrid Reachability, and Evidence-Linked VEX. Updates product vision, README, key features, moat, reachability, and VEX consensus docs to reflect four differentiating capabilities: signed reachability (hybrid static/runtime), deterministic replay, explainable policy with evidence-linked VEX, and sovereign/offline operation. All scan decisions are now described as sealed, reproducible, and audit-grade, with explicit handling of 'Unknown' states and hybrid reachability evidence.

docs/reachability/lattice.md

@@ -1,15 +1,20 @@
 # Reachability Lattice & Scoring Model
 
-> **Status:** Draft – mirrors the November 2025 advisory on confidence-based reachability.  
+> **Status:** Draft – mirrors the December 2025 advisory on confidence-based reachability.
 > **Owners:** Scanner Guild · Policy Guild · Signals Guild.
 
+> Stella Ops isn't just another scanner—it's a different product category: **deterministic, evidence-linked vulnerability decisions** that survive auditors, regulators, and supply-chain propagation.
+
 This document defines the confidence lattice, evidence types, mitigation scoring, and policy gates used to turn static/runtime signals into reproducible reachability decisions and VEX statuses.
 
 ---
 
 ## 1. Overview
 
-Classic “reachable: true/false” answers are too brittle. Stella Ops models reachability as an **ordered lattice** with explicit states and scores. Each analyzer/runtime probe emits `Evidence` documents; mitigations add `Mitigation` entries. The lattice engine joins both inputs into a `ReachDecision`:
+<!-- TODO: Review for separate approval - updated lattice overview -->
+**Key differentiator:** Unlike simplistic yes/no reachability approaches, the Stella Ops lattice model explicitly handles an **"Unknown"** (under_investigation) state, ensuring incomplete data doesn't lead to false safety. Every VEX decision is evidence-linked with proof pointers to the underlying reachability evidence.
+
+Classic "reachable: true/false" answers are too brittle. Stella Ops models reachability as an **ordered lattice** with explicit states and scores. Each analyzer/runtime probe emits `Evidence` documents; mitigations add `Mitigation` entries. The lattice engine joins both inputs into a `ReachDecision`:
 
 ```
 UNOBSERVED (0–9)
@@ -75,10 +80,10 @@ public sealed record ReachDecision(
 
 | Evidence class           | Base score contribution |
 |--------------------------|-------------------------|
-| Static path (call graph) | ≥ 30                    |
-| Runtime hit              | ≥ 60                    |
-| User-tainted flow        | ≥ 80                    |
-| “Constraints removed”    | = 100                   |
+| Static path (call graph) | ≥ 30                    |
+| Runtime hit              | ≥ 60                    |
+| User-tainted flow        | ≥ 80                    |
+| "Constraints removed"    | = 100                   |
 | Lockfile-only evidence   | 10 (if no other signals)|
 
 Mitigations subtract up to 40 points (configurable):
@@ -106,11 +111,11 @@ Default thresholds (edit in `reachability.policy.yml`):
 
 VEX mapping:
 
-* **not_affected**: score ≤ 25 or mitigations dominate (score reduced below threshold).
-* **affected**: score ≥ 60 (dynamic evidence without sufficient mitigation).
-* **under_investigation**: everything between.
+* **not_affected**: score ≤ 25 or mitigations dominate (score reduced below threshold).
+* **affected**: score ≥ 60 (dynamic evidence without sufficient mitigation).
+* **under_investigation**: everything between. **This explicit "Unknown" state is a key differentiator**—incomplete data never leads to false safety.
 
-Each decision records `reachability.policy.version`, analyzer versions, policy hash, and config snapshot so downstream verifiers can replay the exact logic.
+Each decision records `reachability.policy.version`, analyzer versions, policy hash, and config snapshot so downstream verifiers can replay the exact logic. All decisions are sealed in Decision Capsules for audit-grade reproducibility.
 
 ---
 
@@ -125,7 +130,7 @@ Each decision records `reachability.policy.version`, analyzer versions, policy h
 | Mitigations | WAF connectors, patch diff, kill switches | `MitigationKind.*` via `Mitigation` records |
 | Trust | Vendor VEX statements, manual overrides | `VendorVexNotAffected/Affected`, `ManualOverride` |
 
-Each evidence object **must** log `Source`, timestamps, and references (function IDs, config hashes) so auditors can trace it in the event graph.
+Each evidence object **must** log `Source`, timestamps, and references (function IDs, config hashes) so auditors can trace it in the event graph. This enables **evidence-linked VEX decisions** where every assertion includes pointers to the underlying proof.
 
 ---
 
@@ -185,7 +190,20 @@ See `src/Scanner/StellaOps.Scanner.WebService/Reachability/Runtime/DotNetRuntime
 
 ---
 
-## 9. Roadmap
+## 9. Hybrid Reachability
+
+<!-- TODO: Review for separate approval - added hybrid reachability section -->
+Stella Ops combines **static call-graph analysis** with **runtime process tracing** for true hybrid reachability:
+
+- **Static analysis** provides call-graph edges from IL/bytecode analysis, framework routing models, and entry-point proximity calculations.
+- **Runtime analysis** provides observed method hits, stack samples, and HTTP route hits from live or shadow traffic.
+- **Hybrid reconciliation** merges both signal types, with each edge type attestable via DSSE. See `docs/reachability/hybrid-attestation.md` for the attestation model.
+
+This hybrid approach ensures that both build-time and run-time context contribute to the same verdict, avoiding the blind spots of purely static or purely runtime analysis.
+
+---
+
+## 10. Roadmap
 
 | Task | Description |
 |------|-------------|
@@ -195,4 +213,3 @@ See `src/Scanner/StellaOps.Scanner.WebService/Reachability/Runtime/DotNetRuntime
 | `REACH-POLICY-402-026` | Expose reachability gates in Policy DSL & CLI (edit/lint/test). |
 
 Keep this doc updated as the lattice evolves or new signals/mitigations are added.
-*** End Patch