docs consolidation and others

2026-01-06 19:02:21 +02:00
parent d7bdca6d97
commit 4789027317
849 changed files with 16551 additions and 66770 deletions
--- a/docs/modules/cli/guides/commands/audit-pack.md
+++ b/docs/modules/cli/guides/commands/audit-pack.md
@@ -0,0 +1,215 @@
+# Audit Pack CLI Commands
+
+## Overview
+
+The `stella audit-pack` command provides functionality for exporting, importing, verifying, and replaying audit packs for compliance and verification workflows.
+
+## Commands
+
+### Export
+
+Export an audit pack from a scan result.
+
+```bash
+stella audit-pack export --scan-id <id> --output audit-pack.tar.gz
+
+# With signing
+stella audit-pack export --scan-id <id> --sign --key signing-key.pem --output audit-pack.tar.gz
+
+# Minimize size
+stella audit-pack export --scan-id <id> --minimize --output audit-pack.tar.gz
+```
+
+**Options:**
+- `--scan-id <id>` - Scan ID to export
+- `--output <path>` - Output file path (tar.gz)
+- `--sign` - Sign the audit pack
+- `--key <path>` - Signing key path (required if --sign)
+- `--minimize` - Minimize bundle size (only required feeds/policies)
+- `--name <name>` - Custom pack name
+
+**Example:**
+```bash
+stella audit-pack export \
+  --scan-id abc123 \
+  --sign \
+  --key ~/.stella/keys/signing-key.pem \
+  --output compliance-pack-2025-12.tar.gz
+```
+
+---
+
+### Verify
+
+Verify audit pack integrity and signatures.
+
+```bash
+stella audit-pack verify audit-pack.tar.gz
+
+# Skip signature verification
+stella audit-pack verify --no-verify-signatures audit-pack.tar.gz
+```
+
+**Options:**
+- `--no-verify-signatures` - Skip signature verification
+- `--json` - Output results as JSON
+
+**Output:**
+```
+✅ Audit Pack Verification
+  Pack ID: abc-123-def-456
+  Created: 2025-12-22T00:00:00Z
+  Files: 42 (all digests valid)
+  Signature: Valid (verified with trust root 'prod-ca')
+```
+
+---
+
+### Info
+
+Display information about an audit pack.
+
+```bash
+stella audit-pack info audit-pack.tar.gz
+
+# JSON output
+stella audit-pack info --json audit-pack.tar.gz
+```
+
+**Output:**
+```
+Audit Pack Information
+  Pack ID:       abc-123-def-456
+  Name:          compliance-pack-2025-12
+  Created:       2025-12-22T00:00:00Z
+  Schema:        1.0.0
+
+  Contents:
+    Run Manifest:  included
+    Verdict:       included
+    Evidence:      included
+    SBOMs:         2 (CycloneDX, SPDX)
+    Attestations:  3
+    VEX Docs:      1
+    Trust Roots:   2
+
+  Bundle:
+    Feeds:         4 (NVD, GHSA, Debian, Alpine)
+    Policies:      2 (default, strict)
+    Size:          42.5 MB
+```
+
+---
+
+### Replay
+
+Replay scan from audit pack and compare results.
+
+```bash
+stella audit-pack replay audit-pack.tar.gz --output replay-result.json
+
+# Show differences
+stella audit-pack replay audit-pack.tar.gz --show-diff
+```
+
+**Options:**
+- `--output <path>` - Write replay results to file
+- `--show-diff` - Display verdict differences
+- `--json` - JSON output format
+
+**Output:**
+```
+✅ Replay Complete
+  Original Verdict Digest:  abc123...
+  Replayed Verdict Digest:  abc123...
+  Match:                    Identical
+  Duration:                 1.2s
+
+  Verdict Comparison:
+    ✅ All findings match
+    ✅ All severities match
+    ✅ VEX statements identical
+```
+
+---
+
+### Verify and Replay (Combined)
+
+Verify integrity and replay in one command.
+
+```bash
+stella audit-pack verify-and-replay audit-pack.tar.gz
+```
+
+This combines `verify` and `replay` for a complete verification workflow.
+
+**Output:**
+```
+Step 1/2: Verifying audit pack...
+✅ Integrity verified
+✅ Signatures valid
+
+Step 2/2: Replaying scan...
+✅ Replay complete
+✅ Verdicts match
+
+Overall Status: PASSED
+```
+
+---
+
+## Exit Codes
+
+| Code | Meaning |
+|------|---------|
+| 0 | Success |
+| 1 | Verification failed |
+| 2 | Replay failed |
+| 3 | Verdicts don't match |
+| 10 | Invalid arguments |
+
+---
+
+## Environment Variables
+
+- `STELLAOPS_AUDIT_PACK_VERIFY_SIGS` - Default signature verification (true/false)
+- `STELLAOPS_AUDIT_PACK_TRUST_ROOTS` - Directory containing trust roots
+- `STELLAOPS_OFFLINE_BUNDLE` - Offline bundle path for replay
+
+---
+
+## Examples
+
+### Full Compliance Workflow
+
+```bash
+# 1. Export audit pack from scan
+stella audit-pack export \
+  --scan-id prod-scan-2025-12-22 \
+  --sign \
+  --key production-signing-key.pem \
+  --output compliance-pack.tar.gz
+
+# 2. Transfer to auditor environment (air-gapped)
+scp compliance-pack.tar.gz auditor@secure-env:/audit/
+
+# 3. Auditor verifies and replays
+ssh auditor@secure-env
+stella audit-pack verify-and-replay /audit/compliance-pack.tar.gz
+
+# Output:
+# ✅ Verification PASSED
+# ✅ Replay PASSED - Verdicts identical
+```
+
+---
+
+## Implementation Notes
+
+CLI commands are implemented in:
+- `src/Cli/StellaOps.Cli/Commands/AuditPackCommands.cs`
+
+Backend services:
+- `StellaOps.AuditPack.Services.AuditPackBuilder`
+- `StellaOps.AuditPack.Services.AuditPackImporter`
+- `StellaOps.AuditPack.Services.AuditPackReplayer`
--- a/docs/modules/cli/guides/commands/db.md
+++ b/docs/modules/cli/guides/commands/db.md
@@ -56,5 +56,5 @@ Authenticate:
 stella auth login
 ```

-See: `docs/10_CONCELIER_CLI_QUICKSTART.md` and `docs/modules/concelier/operations/authority-audit-runbook.md`.
+See: `docs/CONCELIER_CLI_QUICKSTART.md` and `docs/modules/concelier/operations/authority-audit-runbook.md`.

--- a/docs/modules/cli/guides/commands/drift.md
+++ b/docs/modules/cli/guides/commands/drift.md
@@ -0,0 +1,263 @@
+# Drift CLI Reference
+
+**Sprint:** SPRINT_3600_0004_0001  
+**Task:** UI-024 - Update CLI documentation for drift commands
+
+## Overview
+
+The Drift CLI provides commands for detecting and analyzing reachability drift between scan results. Reachability drift occurs when the call paths to vulnerable code change between builds, potentially altering the risk profile of an application.
+
+## Commands
+
+### stellaops drift
+
+Parent command for reachability drift operations.
+
+```bash
+stellaops drift <SUBCOMMAND> [OPTIONS]
+```
+
+---
+
+### stellaops drift compare
+
+Compare reachability between two scans or graph snapshots.
+
+```bash
+stellaops drift compare [OPTIONS]
+```
+
+#### Required Options
+
+| Option | Alias | Description |
+|--------|-------|-------------|
+| `--base <ID>` | `-b` | Base scan/graph ID or commit SHA for comparison |
+
+#### Optional Options
+
+| Option | Alias | Description | Default |
+|--------|-------|-------------|---------|
+| `--head <ID>` | `-h` | Head scan/graph ID or commit SHA | latest |
+| `--image <REF>` | `-i` | Container image reference (digest or tag) | - |
+| `--repo <REPO>` | `-r` | Repository reference (owner/repo) | - |
+| `--output <FMT>` | `-o` | Output format: `table`, `json`, `sarif` | `table` |
+| `--min-severity <SEV>` | | Minimum severity: `critical`, `high`, `medium`, `low`, `info` | `medium` |
+| `--only-increases` | | Only show sinks with increased reachability | `false` |
+| `--verbose` | | Enable verbose output | `false` |
+
+#### Examples
+
+##### Compare by scan IDs
+
+```bash
+stellaops drift compare --base abc123 --head def456
+```
+
+##### Compare by commit SHAs
+
+```bash
+stellaops drift compare --base HEAD~1 --head HEAD --repo myorg/myapp
+```
+
+##### Filter to risk increases only
+
+```bash
+stellaops drift compare --base abc123 --only-increases --min-severity high
+```
+
+##### Output as JSON
+
+```bash
+stellaops drift compare --base abc123 --output json > drift.json
+```
+
+##### Output as SARIF for CI integration
+
+```bash
+stellaops drift compare --base abc123 --output sarif > drift.sarif
+```
+
+---
+
+### stellaops drift show
+
+Display details of a previously computed drift result.
+
+```bash
+stellaops drift show [OPTIONS]
+```
+
+#### Required Options
+
+| Option | Description |
+|--------|-------------|
+| `--id <ID>` | Drift result ID to display |
+
+#### Optional Options
+
+| Option | Alias | Description | Default |
+|--------|-------|-------------|---------|
+| `--output <FMT>` | `-o` | Output format: `table`, `json`, `sarif` | `table` |
+| `--expand-paths` | | Show full call paths instead of compressed view | `false` |
+| `--verbose` | | Enable verbose output | `false` |
+
+#### Examples
+
+##### Show drift result
+
+```bash
+stellaops drift show --id drift-abc123
+```
+
+##### Show with expanded paths
+
+```bash
+stellaops drift show --id drift-abc123 --expand-paths
+```
+
+---
+
+## Output Formats
+
+### Table Format (Default)
+
+Human-readable table output using Spectre.Console:
+
+```
+┌─────────────────────────────────────────────────────────────┐
+│ Reachability Drift (abc123)                                 │
+├───────────────────────────────┬─────────────────────────────┤
+│ Metric                        │ Value                       │
+├───────────────────────────────┼─────────────────────────────┤
+│ Trend                         │ ↑ Increasing                │
+│ Net Risk Delta                │ +3                          │
+│ Increased                     │ 4                           │
+│ Decreased                     │ 1                           │
+│ New Sinks                     │ 2                           │
+│ Removed Sinks                 │ 0                           │
+└───────────────────────────────┴─────────────────────────────┘
+
+┌──────────────┬──────────────────────┬───────────────┬─────────────────────────┬───────┐
+│ Severity     │ Sink                 │ CVE           │ Bucket Change           │ Delta │
+├──────────────┼──────────────────────┼───────────────┼─────────────────────────┼───────┤
+│ CRITICAL     │ SqlConnection.Open   │ CVE-2024-1234 │ Runtime → Entrypoint    │ +2    │
+│ HIGH         │ XmlParser.Parse      │ CVE-2024-5678 │ Unknown → Direct        │ +1    │
+└──────────────┴──────────────────────┴───────────────┴─────────────────────────┴───────┘
+```
+
+### JSON Format
+
+Structured JSON for programmatic processing:
+
+```json
+{
+  "id": "abc123",
+  "comparedAt": "2025-12-18T10:30:00Z",
+  "baseGraphId": "base-graph-id",
+  "headGraphId": "head-graph-id",
+  "summary": {
+    "totalSinks": 42,
+    "increasedReachability": 4,
+    "decreasedReachability": 1,
+    "unchangedReachability": 35,
+    "newSinks": 2,
+    "removedSinks": 0,
+    "riskTrend": "increasing",
+    "netRiskDelta": 3
+  },
+  "driftedSinks": [
+    {
+      "sinkSymbol": "SqlConnection.Open",
+      "cveId": "CVE-2024-1234",
+      "severity": "critical",
+      "previousBucket": "runtime",
+      "currentBucket": "entrypoint",
+      "isRiskIncrease": true,
+      "riskDelta": 2
+    }
+  ]
+}
+```
+
+### SARIF Format
+
+SARIF 2.1.0 output for CI/CD integration:
+
+```json
+{
+  "version": "2.1.0",
+  "$schema": "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json",
+  "runs": [
+    {
+      "tool": {
+        "driver": {
+          "name": "StellaOps Drift",
+          "version": "1.0.0",
+          "informationUri": "https://stellaops.io/docs/drift"
+        }
+      },
+      "results": [
+        {
+          "ruleId": "CVE-2024-1234",
+          "level": "error",
+          "message": {
+            "text": "Reachability changed: runtime → entrypoint"
+          }
+        }
+      ]
+    }
+  ]
+}
+```
+
+---
+
+## Exit Codes
+
+| Code | Description |
+|------|-------------|
+| `0` | Success (no risk increases or within threshold) |
+| `1` | Error during execution |
+| `2` | Risk increases detected |
+| `3` | Critical risk increases detected |
+
+---
+
+## CI/CD Integration
+
+### GitHub Actions
+
+```yaml
+- name: Check Reachability Drift
+  run: |
+    stellaops drift compare \
+      --base ${{ github.event.pull_request.base.sha }} \
+      --head ${{ github.sha }} \
+      --repo ${{ github.repository }} \
+      --output sarif > drift.sarif
+  continue-on-error: true
+
+- name: Upload SARIF
+  uses: github/codeql-action/upload-sarif@v2
+  with:
+    sarif_file: drift.sarif
+```
+
+### GitLab CI
+
+```yaml
+drift-check:
+  script:
+    - stellaops drift compare --base $CI_MERGE_REQUEST_DIFF_BASE_SHA --head $CI_COMMIT_SHA --output sarif > drift.sarif
+  artifacts:
+    reports:
+      sast: drift.sarif
+```
+
+---
+
+## Related Documentation
+
+- [Reachability Analysis](../reachability/README.md)
+- [Smart-Diff CLI](./smart-diff-cli.md)
+- [VEX Decisioning](../vex/decisioning.md)
--- a/docs/modules/cli/guides/commands/reachability-reference.md
+++ b/docs/modules/cli/guides/commands/reachability-reference.md
@@ -0,0 +1,558 @@
+# Reachability CLI Reference
+
+**Sprint:** SPRINT_3500_0004_0004  
+**Version:** 1.0.0
+
+## Overview
+
+The Reachability CLI commands enable call graph management, reachability computation, and explain queries. All commands support air-gapped operation.
+
+---
+
+## Commands
+
+### stella reachability
+
+Manage reachability analysis.
+
+```bash
+stella reachability <SUBCOMMAND> [OPTIONS]
+```
+
+#### Subcommands
+
+| Subcommand | Description |
+|------------|-------------|
+| `compute` | Trigger reachability computation |
+| `findings` | List reachability findings |
+| `explain` | Explain reachability verdict |
+| `explain-all` | Export all explanations |
+| `summary` | Show reachability summary |
+| `job-status` | Check computation job status |
+| `job-logs` | View job logs |
+| `job-cancel` | Cancel running job |
+
+---
+
+### stella reachability compute
+
+Trigger reachability computation for a scan.
+
+```bash
+stella reachability compute [OPTIONS]
+```
+
+#### Options
+
+| Option | Description | Default |
+|--------|-------------|---------|
+| `--scan-id <ID>` | Scan ID | Required |
+| `--max-depth <N>` | Maximum path length to explore | 10 |
+| `--indirect-resolution <MODE>` | Handle indirect calls: `conservative`, `aggressive`, `skip` | `conservative` |
+| `--timeout <DURATION>` | Maximum computation time | 300s |
+| `--parallel` | Enable parallel BFS | `true` |
+| `--include-runtime` | Merge runtime evidence | `true` |
+| `--offline` | Run in offline mode | `false` |
+| `--symbol-db <PATH>` | Symbol resolution database | System default |
+| `--deterministic` | Enable deterministic mode | `true` |
+| `--seed <BASE64>` | Random seed for determinism | Auto |
+| `--graph-digest <HASH>` | Use specific call graph version | Latest |
+| `--partition-by <KEY>` | Partition analysis: `artifact`, `entrypoint` | — |
+| `--force` | Force recomputation | `false` |
+| `--wait` | Wait for completion | `false` |
+
+#### Examples
+
+```bash
+# Basic computation
+stella reachability compute --scan-id $SCAN_ID
+
+# With custom options
+stella reachability compute --scan-id $SCAN_ID \
+  --max-depth 20 \
+  --timeout 600s \
+  --indirect-resolution conservative
+
+# Wait for completion
+stella reachability compute --scan-id $SCAN_ID --wait
+
+# Offline computation
+stella reachability compute --scan-id $SCAN_ID --offline
+```
+
+---
+
+### stella reachability findings
+
+List reachability findings for a scan.
+
+```bash
+stella reachability findings [OPTIONS]
+```
+
+#### Options
+
+| Option | Description | Default |
+|--------|-------------|---------|
+| `--scan-id <ID>` | Scan ID | Required |
+| `--status <STATUS>` | Filter by status (comma-separated) | All |
+| `--cve <ID>` | Filter by CVE ID | — |
+| `--purl <PURL>` | Filter by package URL | — |
+| `--min-confidence <N>` | Minimum confidence (0-1) | 0 |
+| `--output <PATH>` | Output file path | stdout |
+| `--output-format <FMT>` | Format: `json`, `yaml`, `table`, `sarif` | `table` |
+
+#### Status Values
+
+| Status | Description |
+|--------|-------------|
+| `UNREACHABLE` | No path found |
+| `POSSIBLY_REACHABLE` | Path with heuristic edges |
+| `REACHABLE_STATIC` | Statically proven path |
+| `REACHABLE_PROVEN` | Runtime confirmed |
+| `UNKNOWN` | Insufficient data |
+
+#### Examples
+
+```bash
+# List all findings
+stella reachability findings --scan-id $SCAN_ID
+
+# Filter by status
+stella reachability findings --scan-id $SCAN_ID \
+  --status REACHABLE_STATIC,REACHABLE_PROVEN
+
+# Export as SARIF for CI
+stella reachability findings --scan-id $SCAN_ID \
+  --status REACHABLE_STATIC,REACHABLE_PROVEN \
+  --output-format sarif \
+  --output findings.sarif
+
+# JSON output
+stella reachability findings --scan-id $SCAN_ID --output-format json
+```
+
+---
+
+### stella reachability explain
+
+Explain a reachability verdict.
+
+```bash
+stella reachability explain [OPTIONS]
+```
+
+#### Options
+
+| Option | Description | Default |
+|--------|-------------|---------|
+| `--scan-id <ID>` | Scan ID | Required |
+| `--cve <ID>` | CVE ID | Required |
+| `--purl <PURL>` | Package URL | Required |
+| `--all-paths` | Show all paths, not just shortest | `false` |
+| `--max-paths <N>` | Maximum paths to show | 5 |
+| `--verbose` | Show detailed explanation | `false` |
+| `--offline` | Run in offline mode | `false` |
+| `--output <PATH>` | Output file path | stdout |
+| `--output-format <FMT>` | Format: `json`, `yaml`, `text` | `text` |
+
+#### Examples
+
+```bash
+# Explain single finding
+stella reachability explain --scan-id $SCAN_ID \
+  --cve CVE-2024-1234 \
+  --purl "pkg:npm/lodash@4.17.20"
+
+# Show all paths
+stella reachability explain --scan-id $SCAN_ID \
+  --cve CVE-2024-1234 \
+  --purl "pkg:npm/lodash@4.17.20" \
+  --all-paths
+
+# JSON output
+stella reachability explain --scan-id $SCAN_ID \
+  --cve CVE-2024-1234 \
+  --purl "pkg:npm/lodash@4.17.20" \
+  --output-format json
+```
+
+#### Output Example
+
+```
+Status: REACHABLE_STATIC
+Confidence: 0.70
+
+Shortest Path (depth=3):
+[0] MyApp.Controllers.OrdersController::Get(Guid)
+    Entrypoint: HTTP GET /api/orders/{id}
+[1] MyApp.Services.OrderService::Process(Order)
+    Edge: static (direct_call)
+[2] Lodash.merge(Object, Object) [VULNERABLE]
+    Edge: static (direct_call)
+
+Why Reachable:
+- Static call path exists from HTTP entrypoint /api/orders/{id}
+- All edges are statically proven (no heuristics)
+- Vulnerable function Lodash.merge() is directly invoked
+
+Confidence Factors:
+  staticPathExists: +0.50
+  noHeuristicEdges: +0.20
+  runtimeConfirmed: +0.00
+
+Alternative Paths: 2
+```
+
+---
+
+### stella reachability explain-all
+
+Export all reachability explanations.
+
+```bash
+stella reachability explain-all [OPTIONS]
+```
+
+#### Options
+
+| Option | Description | Default |
+|--------|-------------|---------|
+| `--scan-id <ID>` | Scan ID | Required |
+| `--status <STATUS>` | Filter by status | All |
+| `--output <PATH>` | Output file path | Required |
+| `--offline` | Run in offline mode | `false` |
+
+#### Examples
+
+```bash
+# Export all explanations
+stella reachability explain-all --scan-id $SCAN_ID --output explanations.json
+
+# Export only reachable findings
+stella reachability explain-all --scan-id $SCAN_ID \
+  --status REACHABLE_STATIC,REACHABLE_PROVEN \
+  --output reachable-explanations.json
+```
+
+---
+
+### stella reachability summary
+
+Show reachability summary for a scan.
+
+```bash
+stella reachability summary [OPTIONS]
+```
+
+#### Options
+
+| Option | Description | Default |
+|--------|-------------|---------|
+| `--scan-id <ID>` | Scan ID | Required |
+| `--output-format <FMT>` | Format: `json`, `yaml`, `table` | `table` |
+
+#### Examples
+
+```bash
+# Show summary
+stella reachability summary --scan-id $SCAN_ID
+
+# Output:
+# Total vulnerabilities: 45
+# Unreachable: 38 (84%)
+# Possibly reachable: 4 (9%)
+# Reachable (static): 2 (4%)
+# Reachable (proven): 1 (2%)
+# Unknown: 0 (0%)
+```
+
+---
+
+### stella reachability job-status
+
+Check computation job status.
+
+```bash
+stella reachability job-status [OPTIONS]
+```
+
+#### Options
+
+| Option | Description | Default |
+|--------|-------------|---------|
+| `--job-id <ID>` | Job ID | Required |
+
+#### Examples
+
+```bash
+stella reachability job-status --job-id reachability-job-001
+
+# Output:
+# Status: running
+# Progress: 67% (8,234 / 12,345 nodes visited)
+# Started: 2025-12-20T10:00:00Z
+# Estimated completion: 2025-12-20T10:02:30Z
+```
+
+---
+
+## Call Graph Commands
+
+### stella scan graph
+
+Manage call graphs.
+
+```bash
+stella scan graph <SUBCOMMAND> [OPTIONS]
+```
+
+#### Subcommands
+
+| Subcommand | Description |
+|------------|-------------|
+| `upload` | Upload call graph |
+| `summary` | Show call graph summary |
+| `entrypoints` | List entrypoints |
+| `export` | Export call graph |
+| `validate` | Validate call graph |
+| `visualize` | Generate visualization |
+| `convert` | Convert graph format |
+| `partition` | Partition large graph |
+| `merge` | Merge multiple graphs |
+
+---
+
+### stella scan graph upload
+
+Upload a call graph to a scan.
+
+```bash
+stella scan graph upload [OPTIONS]
+```
+
+#### Options
+
+| Option | Description | Default |
+|--------|-------------|---------|
+| `--scan-id <ID>` | Scan ID | Required |
+| `--file <PATH>` | Call graph file | Required |
+| `--format <FMT>` | Format: `json`, `ndjson` | Auto-detect |
+| `--streaming` | Use streaming upload | `false` |
+| `--framework <NAME>` | Framework hint | Auto-detect |
+
+#### Examples
+
+```bash
+# Basic upload
+stella scan graph upload --scan-id $SCAN_ID --file callgraph.json
+
+# Streaming upload (large graphs)
+stella scan graph upload --scan-id $SCAN_ID \
+  --file callgraph.ndjson \
+  --format ndjson \
+  --streaming
+
+# With framework hint
+stella scan graph upload --scan-id $SCAN_ID \
+  --file callgraph.json \
+  --framework aspnetcore
+```
+
+---
+
+### stella scan graph summary
+
+Show call graph summary.
+
+```bash
+stella scan graph summary [OPTIONS]
+```
+
+#### Options
+
+| Option | Description | Default |
+|--------|-------------|---------|
+| `--scan-id <ID>` | Scan ID | Required |
+
+#### Examples
+
+```bash
+stella scan graph summary --scan-id $SCAN_ID
+
+# Output:
+# Nodes: 12,345
+# Edges: 56,789
+# Entrypoints: 42
+# Languages: [dotnet, java]
+# Size: 15.2 MB
+```
+
+---
+
+### stella scan graph entrypoints
+
+List detected entrypoints.
+
+```bash
+stella scan graph entrypoints [OPTIONS]
+```
+
+#### Options
+
+| Option | Description | Default |
+|--------|-------------|---------|
+| `--scan-id <ID>` | Scan ID | Required |
+| `--verbose` | Show detailed info | `false` |
+| `--output-format <FMT>` | Format: `json`, `yaml`, `table` | `table` |
+
+#### Examples
+
+```bash
+# List entrypoints
+stella scan graph entrypoints --scan-id $SCAN_ID
+
+# Output:
+# Kind     | Route               | Framework   | Node
+# ─────────┼─────────────────────┼─────────────┼────────────────
+# http     | GET /api/orders     | aspnetcore  | OrdersController::Get
+# http     | POST /api/orders    | aspnetcore  | OrdersController::Create
+# grpc     | OrderService.Get    | grpc-dotnet | OrderService::GetOrder
+```
+
+---
+
+### stella scan graph validate
+
+Validate call graph structure.
+
+```bash
+stella scan graph validate [OPTIONS]
+```
+
+#### Options
+
+| Option | Description | Default |
+|--------|-------------|---------|
+| `--scan-id <ID>` | Validate uploaded graph | — |
+| `--file <PATH>` | Validate local file | — |
+| `--strict` | Enable strict validation | `false` |
+
+#### Validation Checks
+
+- All edge targets exist as nodes
+- Entrypoints reference valid nodes
+- No orphan nodes
+- No cycles in entrypoint definitions
+- Schema compliance
+
+#### Examples
+
+```bash
+# Validate uploaded graph
+stella scan graph validate --scan-id $SCAN_ID
+
+# Validate before upload
+stella scan graph validate --file callgraph.json --strict
+```
+
+---
+
+### stella scan graph visualize
+
+Generate call graph visualization.
+
+```bash
+stella scan graph visualize [OPTIONS]
+```
+
+#### Options
+
+| Option | Description | Default |
+|--------|-------------|---------|
+| `--scan-id <ID>` | Scan ID | Required |
+| `--node <ID>` | Center on specific node | — |
+| `--depth <N>` | Visualization depth | 3 |
+| `--output <PATH>` | Output file (SVG/PNG/DOT) | Required |
+| `--format <FMT>` | Format: `svg`, `png`, `dot` | `svg` |
+
+#### Examples
+
+```bash
+# Visualize subgraph
+stella scan graph visualize --scan-id $SCAN_ID \
+  --node sha256:node123... \
+  --depth 3 \
+  --output subgraph.svg
+```
+
+---
+
+## Common Options
+
+### Authentication
+
+| Option | Description |
+|--------|-------------|
+| `--token <TOKEN>` | OAuth bearer token |
+| `--token-file <PATH>` | File containing token |
+| `--profile <NAME>` | Use named profile |
+
+### Output
+
+| Option | Description |
+|--------|-------------|
+| `--quiet` | Suppress non-error output |
+| `--verbose` | Enable verbose output |
+| `--debug` | Enable debug logging |
+| `--no-color` | Disable colored output |
+
+### Connection
+
+| Option | Description |
+|--------|-------------|
+| `--endpoint <URL>` | Scanner API endpoint |
+| `--timeout <DURATION>` | Request timeout |
+| `--insecure` | Skip TLS verification |
+
+---
+
+## Environment Variables
+
+| Variable | Description |
+|----------|-------------|
+| `STELLA_TOKEN` | OAuth token |
+| `STELLA_ENDPOINT` | API endpoint |
+| `STELLA_PROFILE` | Profile name |
+| `STELLA_OFFLINE` | Offline mode |
+| `STELLA_SYMBOL_DB` | Symbol database path |
+
+---
+
+## Exit Codes
+
+| Code | Meaning |
+|------|---------|
+| 0 | Success |
+| 1 | General error |
+| 2 | Invalid arguments |
+| 3 | Authentication failed |
+| 4 | Resource not found |
+| 5 | Computation failed |
+| 6 | Network error |
+| 10 | Timeout |
+
+---
+
+## Related Documentation
+
+- [Score Proofs CLI Reference](./score-proofs-cli-reference.md)
+- [Unknowns CLI Reference](./unknowns-cli-reference.md)
+- [Reachability API Reference](../api/score-proofs-reachability-api-reference.md)
+- [Reachability Runbook](../operations/reachability-runbook.md)
+
+---
+
+**Last Updated**: 2025-12-20  
+**Version**: 1.0.0  
+**Sprint**: 3500.0004.0004
--- a/docs/modules/cli/guides/commands/reference.md
+++ b/docs/modules/cli/guides/commands/reference.md
--- a/docs/modules/cli/guides/commands/sbomer.md
+++ b/docs/modules/cli/guides/commands/sbomer.md
@@ -0,0 +1,40 @@
+# stella sbomer (DOCS-CLI-DET-01)
+
+Offline-first usage of `stella sbomer` verbs with deterministic outputs.
+
+## Prerequisites
+- Install CLI from offline bundle; ensure `local-nugets/` is available.
+- Export images/charts locally; no network access required during commands.
+
+## Commands
+- `stella sbomer layer <image>`
+  - Emits deterministic SBOM per layer; options: `--format cyclonedx|spdx`, `--output <path>`, `--deterministic` (default true).
+- `stella sbomer compose <manifest>`
+  - Merges layer SBOMs with stable ordering; rejects missing hashes.
+- `stella sbomer drift <baseline> <current>`
+  - Computes drift; returns machine-readable diff with stable ordering.
+- `stella sbomer verify <sbom> --hash <sha256>`
+  - Validates hash/signature if provided; offline only.
+
+## Determinism rules
+- Use fixed sort keys (component name, version, purl) when composing.
+- All timestamps forced to `1970-01-01T00:00:00Z` unless `--timestamp` supplied.
+- GUID/UUID generation disabled; use content hashes as IDs.
+- Outputs written in UTF-8 with LF line endings; no BOM.
+
+## Examples
+```bash
+# generate layer SBOM
+stella sbomer layer ghcr.io/acme/app:1.2.3 --format cyclonedx --output app.cdx.json
+
+# compose
+stella sbomer compose app.cdx.json lib.cdx.json --output combined.cdx.json
+
+# drift
+stella sbomer drift baseline.cdx.json combined.cdx.json --output drift.json
+```
+
+## Offline tips
+- Preload registries; set `STELLA_SBOMER_OFFLINE=true` to prevent remote pulls.
+- Configure cache dir via `STELLA_CACHE_DIR` for reproducible paths.
+- For air-gapped logs, use `--log-format json` and capture to file for later analysis.
--- a/docs/modules/cli/guides/commands/score-proofs-reference.md
+++ b/docs/modules/cli/guides/commands/score-proofs-reference.md
@@ -0,0 +1,450 @@
+# Score Proofs CLI Reference
+
+**Sprint:** SPRINT_3500_0004_0004  
+**Version:** 1.0.0
+
+## Overview
+
+The Score Proofs CLI commands enable score computation, replay, proof verification, and proof bundle management. All commands support air-gapped operation.
+
+---
+
+## Commands
+
+### stella score
+
+Compute or replay vulnerability scores.
+
+```bash
+stella score <SUBCOMMAND> [OPTIONS]
+```
+
+#### Subcommands
+
+| Subcommand | Description |
+|------------|-------------|
+| `compute` | Compute scores for a scan |
+| `replay` | Replay score computation with different inputs |
+| `show` | Display score details for a scan |
+| `diff` | Compare scores between runs |
+| `manifest` | View/export scan manifest |
+| `inputs` | List scoring inputs |
+
+---
+
+### stella score compute
+
+Compute vulnerability scores for a scan.
+
+```bash
+stella score compute [OPTIONS]
+```
+
+#### Options
+
+| Option | Description | Default |
+|--------|-------------|---------|
+| `--scan-id <ID>` | Scan ID to compute scores for | Required |
+| `--deterministic` | Enable deterministic mode | `true` |
+| `--seed <BASE64>` | Random seed for determinism | Auto-generated |
+| `--output <PATH>` | Output file path | stdout |
+| `--output-format <FMT>` | Format: `json`, `yaml`, `table` | `table` |
+| `--include-proof` | Include proof ledger in output | `false` |
+
+#### Examples
+
+```bash
+# Compute scores
+stella score compute --scan-id $SCAN_ID
+
+# Compute with proof output
+stella score compute --scan-id $SCAN_ID --include-proof --output-format json
+
+# Compute in deterministic mode with fixed seed
+stella score compute --scan-id $SCAN_ID --deterministic --seed "AQIDBA=="
+```
+
+---
+
+### stella score replay
+
+Replay score computation with updated feeds or policies.
+
+```bash
+stella score replay [OPTIONS]
+```
+
+#### Options
+
+| Option | Description | Default |
+|--------|-------------|---------|
+| `--scan-id <ID>` | Scan ID to replay | Required |
+| `--feed-snapshot <HASH>` | Override feed snapshot hash | Current |
+| `--vex-snapshot <HASH>` | Override VEX snapshot hash | Current |
+| `--policy-snapshot <HASH>` | Override policy hash | Current |
+| `--use-original-snapshots` | Use exact original snapshots | `false` |
+| `--diff` | Show diff from original | `false` |
+| `--skip-unchanged` | Skip if no input changes | `false` |
+| `--offline` | Run in offline mode | `false` |
+| `--bundle <PATH>` | Use offline bundle for replay | — |
+| `--output <PATH>` | Output file path | stdout |
+| `--output-format <FMT>` | Format: `json`, `yaml`, `table` | `table` |
+
+#### Examples
+
+```bash
+# Replay with current feeds
+stella score replay --scan-id $SCAN_ID
+
+# Replay with specific feed snapshot
+stella score replay --scan-id $SCAN_ID --feed-snapshot sha256:newfeed...
+
+# Replay and compare with original
+stella score replay --scan-id $SCAN_ID --diff
+
+# Replay with original snapshots (exact reproduction)
+stella score replay --scan-id $SCAN_ID --use-original-snapshots
+
+# Offline replay
+stella score replay --scan-id $SCAN_ID --offline --bundle /path/to/bundle.zip
+```
+
+---
+
+### stella score show
+
+Display score details for a scan.
+
+```bash
+stella score show [OPTIONS]
+```
+
+#### Options
+
+| Option | Description | Default |
+|--------|-------------|---------|
+| `--scan-id <ID>` | Scan ID | Required |
+| `--verbose` | Show detailed breakdown | `false` |
+| `--include-evidence` | Include evidence references | `false` |
+| `--output-format <FMT>` | Format: `json`, `yaml`, `table` | `table` |
+
+#### Examples
+
+```bash
+# Show score summary
+stella score show --scan-id $SCAN_ID
+
+# Show detailed breakdown
+stella score show --scan-id $SCAN_ID --verbose
+
+# JSON output
+stella score show --scan-id $SCAN_ID --output-format json
+```
+
+---
+
+### stella score diff
+
+Compare scores between two runs.
+
+```bash
+stella score diff [OPTIONS]
+```
+
+#### Options
+
+| Option | Description | Default |
+|--------|-------------|---------|
+| `--scan-id <ID>` | Scan ID to compare | Required |
+| `--original` | Compare with original score | `false` |
+| `--replayed` | Compare with most recent replay | `false` |
+| `--base <RUN_ID>` | Base run ID for comparison | — |
+| `--target <RUN_ID>` | Target run ID for comparison | — |
+| `--output-format <FMT>` | Format: `json`, `yaml`, `table` | `table` |
+
+#### Examples
+
+```bash
+# Compare original vs replayed
+stella score diff --scan-id $SCAN_ID --original --replayed
+
+# Compare two specific runs
+stella score diff --scan-id $SCAN_ID --base run-001 --target run-002
+```
+
+---
+
+### stella score manifest
+
+View or export scan manifest.
+
+```bash
+stella score manifest [OPTIONS]
+```
+
+#### Options
+
+| Option | Description | Default |
+|--------|-------------|---------|
+| `--scan-id <ID>` | Scan ID | Required |
+| `--output <PATH>` | Output file path | stdout |
+| `--include-dsse` | Include DSSE envelope | `false` |
+| `--verify` | Verify DSSE signature | `false` |
+
+#### Examples
+
+```bash
+# View manifest
+stella score manifest --scan-id $SCAN_ID
+
+# Export with DSSE
+stella score manifest --scan-id $SCAN_ID --include-dsse --output manifest.json
+
+# Verify manifest signature
+stella score manifest --scan-id $SCAN_ID --verify
+```
+
+---
+
+## Proof Commands
+
+### stella proof
+
+Manage proof bundles.
+
+```bash
+stella proof <SUBCOMMAND> [OPTIONS]
+```
+
+#### Subcommands
+
+| Subcommand | Description |
+|------------|-------------|
+| `verify` | Verify a proof bundle |
+| `download` | Download proof bundle |
+| `export` | Export proof bundle |
+| `inspect` | Inspect proof bundle contents |
+| `status` | Check proof status |
+| `list` | List proofs for a scan |
+| `retrieve` | Retrieve from cold storage |
+
+---
+
+### stella proof verify
+
+Verify a proof bundle.
+
+```bash
+stella proof verify [OPTIONS]
+```
+
+#### Options
+
+| Option | Description | Default |
+|--------|-------------|---------|
+| `--bundle-id <HASH>` | Proof bundle ID (sha256:...) | — |
+| `--bundle <PATH>` | Local proof bundle file | — |
+| `--offline` | Skip Rekor verification | `false` |
+| `--skip-rekor` | Alias for --offline | `false` |
+| `--check-rekor` | Force Rekor verification | `false` |
+| `--trust-anchor <PATH>` | Trust anchor file | System default |
+| `--public-key <PATH>` | Public key file | — |
+| `--self-contained` | Use embedded trust anchors | `false` |
+| `--verbose` | Show detailed verification | `false` |
+| `--check <CHECK>` | Verify specific check only | All |
+
+#### Verification Checks
+
+| Check | Description |
+|-------|-------------|
+| `signatureValid` | DSSE signature verification |
+| `idRecomputed` | Content-addressed ID match |
+| `merklePathValid` | Merkle tree construction |
+| `rekorInclusion` | Transparency log entry |
+
+#### Examples
+
+```bash
+# Verify online
+stella proof verify --bundle-id sha256:proof123...
+
+# Verify offline
+stella proof verify --bundle proof.zip --offline
+
+# Verify with specific trust anchor
+stella proof verify --bundle proof.zip --offline --trust-anchor anchors.json
+
+# Verify specific check
+stella proof verify --bundle-id sha256:proof123... --check signatureValid
+```
+
+---
+
+### stella proof download
+
+Download proof bundle.
+
+```bash
+stella proof download [OPTIONS]
+```
+
+#### Options
+
+| Option | Description | Default |
+|--------|-------------|---------|
+| `--scan-id <ID>` | Scan ID | Required |
+| `--root-hash <HASH>` | Specific proof root hash | Latest |
+| `--output <PATH>` | Output file path | `proof-{scanId}.zip` |
+| `--all` | Download all proofs for scan | `false` |
+| `--output-dir <PATH>` | Output directory (with --all) | `.` |
+
+#### Examples
+
+```bash
+# Download latest proof
+stella proof download --scan-id $SCAN_ID --output proof.zip
+
+# Download specific proof
+stella proof download --scan-id $SCAN_ID --root-hash sha256:proof123... --output proof.zip
+
+# Download all proofs
+stella proof download --scan-id $SCAN_ID --all --output-dir ./proofs/
+```
+
+---
+
+### stella proof export
+
+Export proof bundle with additional data.
+
+```bash
+stella proof export [OPTIONS]
+```
+
+#### Options
+
+| Option | Description | Default |
+|--------|-------------|---------|
+| `--scan-id <ID>` | Scan ID | Required |
+| `--portable` | Create self-contained portable bundle | `false` |
+| `--include-manifest` | Include scan manifest | `true` |
+| `--include-chain` | Include full proof chain | `false` |
+| `--include-trust-anchors` | Include trust anchor keys | `false` |
+| `--output <PATH>` | Output file path | Required |
+
+#### Examples
+
+```bash
+# Export standard bundle
+stella proof export --scan-id $SCAN_ID --output proof-bundle.zip
+
+# Export portable bundle (for offline verification)
+stella proof export --scan-id $SCAN_ID --portable --include-trust-anchors --output portable.zip
+
+# Export with full chain
+stella proof export --scan-id $SCAN_ID --include-chain --output full-bundle.zip
+```
+
+---
+
+### stella proof inspect
+
+Inspect proof bundle contents.
+
+```bash
+stella proof inspect [OPTIONS]
+```
+
+#### Options
+
+| Option | Description | Default |
+|--------|-------------|---------|
+| `--bundle <PATH>` | Proof bundle file | Required |
+| `--output-dir <PATH>` | Extract to directory | — |
+| `--show-manifest` | Display manifest | `false` |
+| `--show-proof` | Display proof nodes | `false` |
+| `--show-meta` | Display metadata | `false` |
+
+#### Examples
+
+```bash
+# List bundle contents
+stella proof inspect --bundle proof.zip
+
+# Extract and inspect
+stella proof inspect --bundle proof.zip --output-dir ./inspection/
+
+# Show manifest
+stella proof inspect --bundle proof.zip --show-manifest
+```
+
+---
+
+## Common Options
+
+### Authentication
+
+| Option | Description |
+|--------|-------------|
+| `--token <TOKEN>` | OAuth bearer token |
+| `--token-file <PATH>` | File containing token |
+| `--profile <NAME>` | Use named profile |
+
+### Output
+
+| Option | Description |
+|--------|-------------|
+| `--quiet` | Suppress non-error output |
+| `--verbose` | Enable verbose output |
+| `--debug` | Enable debug logging |
+| `--no-color` | Disable colored output |
+
+### Connection
+
+| Option | Description |
+|--------|-------------|
+| `--endpoint <URL>` | Scanner API endpoint |
+| `--timeout <DURATION>` | Request timeout (e.g., 30s, 5m) |
+| `--insecure` | Skip TLS verification (dev only) |
+
+---
+
+## Environment Variables
+
+| Variable | Description | Equivalent Option |
+|----------|-------------|-------------------|
+| `STELLA_TOKEN` | OAuth token | `--token` |
+| `STELLA_ENDPOINT` | API endpoint | `--endpoint` |
+| `STELLA_PROFILE` | Profile name | `--profile` |
+| `STELLA_OFFLINE` | Offline mode | `--offline` |
+| `STELLA_TRUST_ANCHOR` | Trust anchor path | `--trust-anchor` |
+
+---
+
+## Exit Codes
+
+| Code | Meaning |
+|------|---------|
+| 0 | Success |
+| 1 | General error |
+| 2 | Invalid arguments |
+| 3 | Authentication failed |
+| 4 | Resource not found |
+| 5 | Verification failed |
+| 6 | Network error |
+| 10 | Timeout |
+
+---
+
+## Related Documentation
+
+- [Reachability CLI Reference](./reachability-cli-reference.md)
+- [Unknowns CLI Reference](./unknowns-cli-reference.md)
+- [Score Proofs API Reference](../api/score-proofs-reachability-api-reference.md)
+- [Score Proofs Runbook](../operations/score-proofs-runbook.md)
+
+---
+
+**Last Updated**: 2025-12-20  
+**Version**: 1.0.0  
+**Sprint**: 3500.0004.0004
--- a/docs/modules/cli/guides/commands/smart-diff.md
+++ b/docs/modules/cli/guides/commands/smart-diff.md
@@ -0,0 +1,284 @@
+# Smart-Diff CLI Reference
+
+**Sprint:** SPRINT_3500_0001_0001  
+**Task:** SDIFF-MASTER-0008 - Update CLI documentation with smart-diff commands
+
+## Overview
+
+Smart-Diff analyzes changes between container image versions to identify material risk changes. It detects reachability shifts, VEX status changes, binary hardening regressions, and intelligence signal updates.
+
+## Commands
+
+### stellaops smart-diff
+
+Compare two artifacts and report material risk changes.
+
+```bash
+stellaops smart-diff [OPTIONS]
+```
+
+#### Required Options
+
+| Option | Description |
+|--------|-------------|
+| `--base <ARTIFACT>` | Base artifact (image digest, SBOM path, or purl) |
+| `--target <ARTIFACT>` | Target artifact to compare against base |
+
+#### Output Options
+
+| Option | Description | Default |
+|--------|-------------|---------|
+| `--output <PATH>` | Output file path | stdout |
+| `--output-format <FMT>` | Output format: `json`, `yaml`, `table`, `sarif` | `table` |
+| `--output-dir <DIR>` | Output directory for bundle format | - |
+| `--include-proofs` | Include proof ledger in output | `false` |
+| `--include-evidence` | Include raw evidence data | `false` |
+| `--pretty` | Pretty-print JSON/YAML output | `false` |
+
+#### Analysis Options
+
+| Option | Description | Default |
+|--------|-------------|---------|
+| `--rules <PATH>` | Custom detection rules file | built-in |
+| `--config <PATH>` | Scoring configuration file | default config |
+| `--tier <TIER>` | Filter by evidence tier: `imported`, `executed`, `tainted_sink` | all |
+| `--min-priority <N>` | Minimum priority score (0-1) | 0.0 |
+| `--include-unchanged` | Include unchanged findings | `false` |
+
+#### Feed Options
+
+| Option | Description | Default |
+|--------|-------------|---------|
+| `--feed-snapshot <HASH>` | Use specific feed snapshot | latest |
+| `--offline` | Run in offline mode | `false` |
+| `--feed-dir <PATH>` | Local feed directory | - |
+
+### Examples
+
+#### Basic Comparison
+
+```bash
+# Compare two image versions
+stellaops smart-diff \
+  --base registry.example.com/app:v1.0.0 \
+  --target registry.example.com/app:v1.1.0
+
+# Output:
+# Smart-Diff Report: app:v1.0.0 → app:v1.1.0
+# ═══════════════════════════════════════════
+#
+# Summary:
+#   Total Changes: 5
+#   Risk Increased: 2
+#   Risk Decreased: 3
+#   Hardening Regressions: 1
+#
+# Material Changes:
+# ┌─────────────────┬──────────────────┬──────────┬──────────┐
+# │ Vulnerability   │ Component        │ Change   │ Priority │
+# ├─────────────────┼──────────────────┼──────────┼──────────┤
+# │ CVE-2024-1234   │ lodash@4.17.20   │ +reach   │ 0.85     │
+# │ CVE-2024-5678   │ requests@2.28.0  │ +kev     │ 0.95     │
+# │ CVE-2024-9999   │ urllib3@1.26.0   │ -reach   │ 0.60     │
+# └─────────────────┴──────────────────┴──────────┴──────────┘
+```
+
+#### SARIF Output for CI/CD
+
+```bash
+# Generate SARIF for GitHub Actions
+stellaops smart-diff \
+  --base app:v1.0.0 \
+  --target app:v1.1.0 \
+  --output-format sarif \
+  --output results.sarif
+```
+
+#### Filtered Analysis
+
+```bash
+# Only show high-priority changes
+stellaops smart-diff \
+  --base app:v1 \
+  --target app:v2 \
+  --min-priority 0.7 \
+  --output-format json
+
+# Only tainted_sink tier findings
+stellaops smart-diff \
+  --base app:v1 \
+  --target app:v2 \
+  --tier tainted_sink
+```
+
+#### Export with Proofs
+
+```bash
+# Full export with proof bundle
+stellaops smart-diff \
+  --base app:v1 \
+  --target app:v2 \
+  --output-dir ./smart-diff-export \
+  --include-proofs \
+  --include-evidence
+
+# Creates:
+# ./smart-diff-export/
+# ├── manifest.json
+# ├── diff-results.json
+# ├── proofs/
+# └── evidence/
+```
+
+#### Offline Mode
+
+```bash
+# Use local feeds only
+STELLAOPS_OFFLINE=true stellaops smart-diff \
+  --base sbom-v1.json \
+  --target sbom-v2.json \
+  --feed-dir /opt/stellaops/feeds
+```
+
+### stellaops smart-diff show
+
+Display results from a saved smart-diff report.
+
+```bash
+stellaops smart-diff show [OPTIONS] <INPUT>
+```
+
+#### Options
+
+| Option | Description | Default |
+|--------|-------------|---------|
+| `--format <FMT>` | Output format: `table`, `json`, `yaml` | `table` |
+| `--filter <EXPR>` | Filter expression (e.g., `priority>=0.8`) | - |
+| `--sort <FIELD>` | Sort field: `priority`, `vuln`, `component` | `priority` |
+| `--limit <N>` | Maximum results to show | all |
+
+#### Example
+
+```bash
+# Show top 5 highest priority changes
+stellaops smart-diff show \
+  --sort priority \
+  --limit 5 \
+  smart-diff-report.json
+```
+
+### stellaops smart-diff verify
+
+Verify a smart-diff report's proof bundle.
+
+```bash
+stellaops smart-diff verify [OPTIONS] <INPUT>
+```
+
+#### Options
+
+| Option | Description | Default |
+|--------|-------------|---------|
+| `--proof-bundle <PATH>` | Proof bundle path | inferred |
+| `--public-key <PATH>` | Public key for signature verification | - |
+| `--strict` | Fail on any warning | `false` |
+
+#### Example
+
+```bash
+# Verify report integrity
+stellaops smart-diff verify \
+  --proof-bundle ./proofs \
+  --public-key /path/to/key.pub \
+  smart-diff-report.json
+
+# Output:
+# ✓ Manifest hash verified: sha256:abc123...
+# ✓ Proof ledger valid (45 nodes)
+# ✓ Root hash matches
+# ✓ Signature valid (key: CN=scanner.stellaops.io)
+```
+
+### stellaops smart-diff replay
+
+Re-run smart-diff with different feed or config.
+
+```bash
+stellaops smart-diff replay [OPTIONS] <SCAN-ID>
+```
+
+#### Options
+
+| Option | Description | Default |
+|--------|-------------|---------|
+| `--feed-snapshot <HASH>` | Use specific feed snapshot | latest |
+| `--config <PATH>` | Different scoring config | original |
+| `--dry-run` | Preview without saving | `false` |
+
+#### Example
+
+```bash
+# Replay with new feed
+stellaops smart-diff replay \
+  --feed-snapshot sha256:abc123... \
+  scan-12345678
+
+# Preview impact of config change
+stellaops smart-diff replay \
+  --config strict-scoring.json \
+  --dry-run \
+  scan-12345678
+```
+
+## Exit Codes
+
+| Code | Meaning |
+|------|---------|
+| 0 | Success, no material changes |
+| 1 | Success, material changes found |
+| 2 | Success, hardening regressions found |
+| 3 | Success, KEV additions found |
+| 10 | Invalid arguments |
+| 11 | Artifact not found |
+| 12 | Feed not available |
+| 20 | Verification failed |
+| 99 | Internal error |
+
+## Environment Variables
+
+| Variable | Description |
+|----------|-------------|
+| `STELLAOPS_OFFLINE` | Run in offline mode |
+| `STELLAOPS_FEED_DIR` | Local feed directory |
+| `STELLAOPS_CONFIG` | Default config file |
+| `STELLAOPS_OUTPUT_FORMAT` | Default output format |
+
+## Configuration File
+
+```yaml
+# ~/.stellaops/smart-diff.yaml
+defaults:
+  output_format: json
+  include_proofs: true
+  min_priority: 0.3
+
+scoring:
+  reachability_flip_up_weight: 1.0
+  kev_added_weight: 1.5
+  hardening_regression_weight: 0.8
+
+rules:
+  custom_path: /path/to/custom-rules.json
+```
+
+## Related Commands
+
+- `stellaops scan` - Full vulnerability scan
+- `stellaops score replay` - Score replay
+- `stellaops verify-bundle` - Verify proof bundles
+
+## Related Documentation
+
+- [Smart-Diff Air-Gap Workflows](../airgap/smart-diff-airgap-workflows.md)
+- [SARIF Integration](../ci/sarif-integration.md)
+- [Scoring Configuration](../ci/scoring-configuration.md)
--- a/docs/modules/cli/guides/commands/triage.md
+++ b/docs/modules/cli/guides/commands/triage.md
@@ -0,0 +1,323 @@
+# Triage CLI Reference
+
+**Sprint:** SPRINT_3600_0001_0001  
+**Task:** TRI-MASTER-0008 - Update CLI documentation with offline commands
+
+## Overview
+
+The Triage CLI provides commands for vulnerability triage, decision management, and offline workflows. It supports evidence-based decision making and audit-ready replay tokens.
+
+## Commands
+
+### stellaops triage list
+
+List findings for triage.
+
+```bash
+stellaops triage list [OPTIONS]
+```
+
+#### Options
+
+| Option | Description | Default |
+|--------|-------------|---------|
+| `--scan-id <ID>` | Filter by scan ID | - |
+| `--status <STATUS>` | Filter: `untriaged`, `affected`, `not_affected`, `wont_fix`, `false_positive` | all |
+| `--priority-min <N>` | Minimum priority (0-1) | 0 |
+| `--priority-max <N>` | Maximum priority (0-1) | 1 |
+| `--sort <FIELD>` | Sort: `priority`, `vuln`, `component`, `created` | `priority` |
+| `--format <FMT>` | Output: `table`, `json`, `csv` | `table` |
+| `--limit <N>` | Max results | 50 |
+| `--workspace <PATH>` | Offline workspace | - |
+
+#### Examples
+
+```bash
+# List untriaged high-priority findings
+stellaops triage list \
+  --scan-id scan-12345678 \
+  --status untriaged \
+  --priority-min 0.7
+
+# Export for review
+stellaops triage list \
+  --scan-id scan-12345678 \
+  --format json > findings.json
+```
+
+### stellaops triage show
+
+Show finding details with evidence.
+
+```bash
+stellaops triage show <FINDING-ID> [OPTIONS]
+```
+
+#### Options
+
+| Option | Description | Default |
+|--------|-------------|---------|
+| `--show-evidence` | Include full evidence | `false` |
+| `--evidence-first` | Lead with evidence summary | `false` |
+| `--show-history` | Show decision history | `false` |
+| `--format <FMT>` | Output: `text`, `json`, `yaml` | `text` |
+| `--workspace <PATH>` | Offline workspace | - |
+
+#### Example
+
+```bash
+# Show with evidence
+stellaops triage show CVE-2024-1234 \
+  --show-evidence \
+  --evidence-first
+
+# Output:
+# ═══════════════════════════════════════════
+# CVE-2024-1234 · pkg:npm/lodash@4.17.20
+# ═══════════════════════════════════════════
+#
+# EVIDENCE
+# ────────
+# Reachability: TAINTED_SINK (tier 3/3)
+#   └─ api.js:42 → utils.js:15 → lodash/merge
+#
+# Call Stack:
+#   1. api.js:42     handleUserInput()
+#   2. utils.js:15   processData()
+#   3. lodash:merge  <vulnerable sink>
+#
+# VEX: No statement
+# EPSS: 0.67 (High)
+# KEV: No
+#
+# VULNERABILITY
+# ─────────────
+# CVE-2024-1234: Prototype Pollution in lodash
+# CVSS: 7.5 (High)
+# CWE: CWE-1321
+#
+# STATUS: untriaged
+```
+
+### stellaops triage decide
+
+Record a triage decision.
+
+```bash
+stellaops triage decide <FINDING-ID> [OPTIONS]
+```
+
+#### Options
+
+| Option | Description | Default |
+|--------|-------------|---------|
+| `--status <STATUS>` | Required: `affected`, `not_affected`, `wont_fix`, `false_positive` | - |
+| `--justification <TEXT>` | Decision justification | - |
+| `--reviewer <NAME>` | Reviewer identifier | current user |
+| `--vex-emit` | Emit VEX statement | `false` |
+| `--workspace <PATH>` | Offline workspace | - |
+
+#### Examples
+
+```bash
+# Mark as not affected
+stellaops triage decide CVE-2024-1234 \
+  --status not_affected \
+  --justification "Feature gated, unreachable in production"
+
+# Mark affected and emit VEX
+stellaops triage decide CVE-2024-5678 \
+  --status affected \
+  --justification "In use, remediation planned" \
+  --vex-emit
+```
+
+### stellaops triage batch
+
+Interactive batch triage mode.
+
+```bash
+stellaops triage batch [OPTIONS]
+```
+
+#### Options
+
+| Option | Description | Default |
+|--------|-------------|---------|
+| `--scan-id <ID>` | Scan to triage | - |
+| `--query <EXPR>` | Filter expression | - |
+| `--input <PATH>` | Offline bundle | - |
+| `--workspace <PATH>` | Offline workspace | - |
+
+#### Keyboard Shortcuts
+
+| Key | Action |
+|-----|--------|
+| `j` / `↓` | Next finding |
+| `k` / `↑` | Previous finding |
+| `a` | Mark affected |
+| `n` | Mark not affected |
+| `w` | Mark won't fix |
+| `f` | Mark false positive |
+| `e` | Show full evidence |
+| `g` | Show graph context |
+| `u` | Undo last decision |
+| `/` | Search findings |
+| `?` | Show help |
+| `q` | Save and quit |
+
+#### Example
+
+```bash
+# Interactive triage
+stellaops triage batch \
+  --scan-id scan-12345678 \
+  --query "priority>=0.5"
+```
+
+### stellaops triage export
+
+Export findings for offline triage.
+
+```bash
+stellaops triage export [OPTIONS]
+```
+
+#### Options
+
+| Option | Description | Default |
+|--------|-------------|---------|
+| `--scan-id <ID>` | Scan to export | required |
+| `--findings <IDS>` | Specific finding IDs (comma-separated) | - |
+| `--all-findings` | Export all findings | `false` |
+| `--include-evidence` | Include evidence data | `true` |
+| `--include-graph` | Include dependency graph | `true` |
+| `--output <PATH>` | Output path (.stella.bundle.tgz) | required |
+| `--sign` | Sign the bundle | `true` |
+
+#### Example
+
+```bash
+# Export specific findings
+stellaops triage export \
+  --scan-id scan-12345678 \
+  --findings CVE-2024-1234,CVE-2024-5678 \
+  --output triage-bundle.stella.bundle.tgz
+```
+
+### stellaops triage import
+
+Import offline bundle for triage.
+
+```bash
+stellaops triage import [OPTIONS]
+```
+
+#### Options
+
+| Option | Description | Default |
+|--------|-------------|---------|
+| `--input <PATH>` | Bundle path | required |
+| `--workspace <PATH>` | Target workspace | `~/.stellaops/triage` |
+| `--verify` | Verify signature | `true` |
+| `--public-key <PATH>` | Public key for verification | - |
+
+### stellaops triage export-decisions
+
+Export decisions for sync.
+
+```bash
+stellaops triage export-decisions [OPTIONS]
+```
+
+#### Options
+
+| Option | Description | Default |
+|--------|-------------|---------|
+| `--workspace <PATH>` | Workspace path | required |
+| `--output <PATH>` | Output path | required |
+| `--format <FMT>` | Format: `json`, `ndjson` | `json` |
+| `--sign` | Sign output | `true` |
+
+### stellaops triage import-decisions
+
+Import and apply decisions.
+
+```bash
+stellaops triage import-decisions [OPTIONS]
+```
+
+#### Options
+
+| Option | Description | Default |
+|--------|-------------|---------|
+| `--input <PATH>` | Decisions file | required |
+| `--verify` | Verify signatures | `true` |
+| `--apply` | Apply to server | `false` |
+| `--dry-run` | Preview only | `false` |
+| `--conflict-mode <MODE>` | Conflict handling: `keep-local`, `keep-server`, `newest`, `review` | `review` |
+
+### stellaops triage verify-bundle
+
+Verify bundle integrity.
+
+```bash
+stellaops triage verify-bundle [OPTIONS]
+```
+
+#### Options
+
+| Option | Description | Default |
+|--------|-------------|---------|
+| `--input <PATH>` | Bundle path | required |
+| `--public-key <PATH>` | Public key | required |
+| `--strict` | Fail on warnings | `false` |
+
+### stellaops triage show-token
+
+Display replay token details.
+
+```bash
+stellaops triage show-token <TOKEN>
+```
+
+### stellaops triage verify-token
+
+Verify replay token.
+
+```bash
+stellaops triage verify-token <TOKEN> [OPTIONS]
+```
+
+#### Options
+
+| Option | Description | Default |
+|--------|-------------|---------|
+| `--public-key <PATH>` | Public key | required |
+
+## Exit Codes
+
+| Code | Meaning |
+|------|---------|
+| 0 | Success |
+| 1 | Findings require attention |
+| 10 | Invalid arguments |
+| 11 | Resource not found |
+| 20 | Verification failed |
+| 21 | Signature invalid |
+| 30 | Conflict detected |
+| 99 | Internal error |
+
+## Environment Variables
+
+| Variable | Description |
+|----------|-------------|
+| `STELLAOPS_OFFLINE` | Enable offline mode |
+| `STELLAOPS_TRIAGE_WORKSPACE` | Default workspace |
+| `STELLAOPS_REVIEWER` | Default reviewer name |
+
+## Related Documentation
+
+- [Triage Air-Gap Workflows](../airgap/triage-airgap-workflows.md)
+- [Keyboard Shortcuts](./keyboard-shortcuts.md)
+- [Triage API Reference](../api/triage-api.md)
--- a/docs/modules/cli/guides/commands/unknowns-reference.md
+++ b/docs/modules/cli/guides/commands/unknowns-reference.md
@@ -0,0 +1,532 @@
+# Unknowns CLI Reference
+
+**Sprint:** SPRINT_3500_0004_0004  
+**Version:** 1.0.0
+
+## Overview
+
+The Unknowns CLI commands manage components that cannot be analyzed due to missing data, unrecognized formats, or resolution failures. These commands support triage workflows, escalation, and resolution tracking.
+
+---
+
+## Commands
+
+### stella unknowns
+
+Manage unknowns registry.
+
+```bash
+stella unknowns <SUBCOMMAND> [OPTIONS]
+```
+
+#### Subcommands
+
+| Subcommand | Description |
+|------------|-------------|
+| `list` | List unknowns |
+| `show` | Show unknown details |
+| `summary` | Show unknowns summary |
+| `escalate` | Escalate unknown |
+| `resolve` | Mark unknown resolved |
+| `suppress` | Suppress unknown |
+| `bulk-triage` | Bulk triage unknowns |
+| `export` | Export unknowns |
+| `import` | Import unknown resolutions |
+
+---
+
+### stella unknowns list
+
+List unknowns for a scan or workspace.
+
+```bash
+stella unknowns list [OPTIONS]
+```
+
+#### Options
+
+| Option | Description | Default |
+|--------|-------------|---------|
+| `--scan-id <ID>` | Filter by scan ID | — |
+| `--workspace-id <ID>` | Filter by workspace ID | — |
+| `--status <STATUS>` | Filter by status | All |
+| `--category <CAT>` | Filter by category | All |
+| `--priority <PRI>` | Filter by priority (1-10) | All |
+| `--min-score <N>` | Minimum 2-factor score | 0 |
+| `--max-age <DURATION>` | Maximum age | — |
+| `--purl <PATTERN>` | Filter by PURL pattern | — |
+| `--output <PATH>` | Output file path | stdout |
+| `--output-format <FMT>` | Format: `json`, `yaml`, `table`, `csv` | `table` |
+| `--limit <N>` | Maximum results | 100 |
+| `--offset <N>` | Pagination offset | 0 |
+| `--sort <FIELD>` | Sort field | `priority` |
+| `--order <DIR>` | Sort direction: `asc`, `desc` | `desc` |
+
+#### Status Values
+
+| Status | Description |
+|--------|-------------|
+| `pending` | Awaiting triage |
+| `escalated` | Escalated for manual review |
+| `suppressed` | Suppressed (accepted risk) |
+| `resolved` | Resolved |
+
+#### Category Values
+
+| Category | Description |
+|----------|-------------|
+| `unmapped_purl` | No CPE/OVAL mapping |
+| `checksum_miss` | Binary checksum not in DB |
+| `language_gap` | Unsupported language |
+| `parsing_failure` | Manifest parsing failed |
+| `network_timeout` | Feed unavailable |
+| `unrecognized_format` | Unknown format |
+
+#### Examples
+
+```bash
+# List all pending unknowns
+stella unknowns list --status pending
+
+# List high-priority unknowns
+stella unknowns list --min-score 7
+
+# List by category
+stella unknowns list --category unmapped_purl
+
+# Export to CSV
+stella unknowns list --scan-id $SCAN_ID --output-format csv --output unknowns.csv
+
+# Filter by PURL pattern
+stella unknowns list --purl "pkg:npm/*"
+```
+
+---
+
+### stella unknowns show
+
+Show details of a specific unknown.
+
+```bash
+stella unknowns show [OPTIONS]
+```
+
+#### Options
+
+| Option | Description | Default |
+|--------|-------------|---------|
+| `--id <ID>` | Unknown ID | Required |
+| `--verbose` | Show extended details | `false` |
+| `--output-format <FMT>` | Format: `json`, `yaml`, `text` | `text` |
+
+#### Examples
+
+```bash
+# Show unknown details
+stella unknowns show --id unknown-001
+
+# Output:
+# ID: unknown-001
+# PURL: pkg:npm/left-pad@1.3.0
+# Category: unmapped_purl
+# Status: pending
+# Priority: 6
+# Score: 7.2 (vuln: 3, impact: 4.2)
+# Created: 2025-12-20T10:00:00Z
+# Scans Affected: 5
+# Reason: No CVE/advisory mapping exists for this package
+
+# Verbose output
+stella unknowns show --id unknown-001 --verbose
+
+# JSON output
+stella unknowns show --id unknown-001 --output-format json
+```
+
+---
+
+### stella unknowns summary
+
+Show unknowns summary statistics.
+
+```bash
+stella unknowns summary [OPTIONS]
+```
+
+#### Options
+
+| Option | Description | Default |
+|--------|-------------|---------|
+| `--scan-id <ID>` | Filter by scan ID | — |
+| `--workspace-id <ID>` | Filter by workspace ID | — |
+| `--output-format <FMT>` | Format: `json`, `yaml`, `table` | `table` |
+
+#### Examples
+
+```bash
+# Summary for workspace
+stella unknowns summary --workspace-id $WS_ID
+
+# Output:
+# Total unknowns: 127
+# 
+# By Status:
+#   pending: 89
+#   escalated: 15
+#   suppressed: 12
+#   resolved: 11
+# 
+# By Category:
+#   unmapped_purl: 67
+#   checksum_miss: 34
+#   language_gap: 18
+#   parsing_failure: 8
+# 
+# Priority Distribution:
+#   High (8-10): 12
+#   Medium (5-7): 45
+#   Low (1-4): 70
+```
+
+---
+
+### stella unknowns escalate
+
+Escalate an unknown for manual review.
+
+```bash
+stella unknowns escalate [OPTIONS]
+```
+
+#### Options
+
+| Option | Description | Default |
+|--------|-------------|---------|
+| `--id <ID>` | Unknown ID | Required |
+| `--reason <TEXT>` | Escalation reason | — |
+| `--assignee <USER>` | Assign to user/team | — |
+| `--severity <LEVEL>` | Severity: `low`, `medium`, `high`, `critical` | `medium` |
+| `--due-date <DATE>` | Due date (ISO 8601) | — |
+
+#### Examples
+
+```bash
+# Basic escalation
+stella unknowns escalate --id unknown-001 --reason "Potential supply chain risk"
+
+# Escalate with assignment
+stella unknowns escalate --id unknown-001 \
+  --reason "Missing mapping for critical dependency" \
+  --assignee security-team \
+  --severity high \
+  --due-date 2025-12-27
+```
+
+---
+
+### stella unknowns resolve
+
+Mark an unknown as resolved.
+
+```bash
+stella unknowns resolve [OPTIONS]
+```
+
+#### Options
+
+| Option | Description | Default |
+|--------|-------------|---------|
+| `--id <ID>` | Unknown ID | Required |
+| `--resolution <TYPE>` | Resolution type | Required |
+| `--comment <TEXT>` | Resolution comment | — |
+| `--mapping <JSON>` | Custom mapping data | — |
+| `--evidence <PATH>` | Evidence file | — |
+
+#### Resolution Types
+
+| Type | Description |
+|------|-------------|
+| `mapped` | Package/CVE mapping added |
+| `not_applicable` | Not applicable to context |
+| `false_positive` | Detection was incorrect |
+| `accepted_risk` | Risk accepted |
+| `replaced` | Component replaced |
+| `removed` | Component removed |
+
+#### Examples
+
+```bash
+# Resolve with mapping
+stella unknowns resolve --id unknown-001 \
+  --resolution mapped \
+  --comment "Added CPE mapping to internal DB"
+
+# Resolve as accepted risk
+stella unknowns resolve --id unknown-001 \
+  --resolution accepted_risk \
+  --comment "Internal component, no external exposure"
+
+# Resolve with evidence
+stella unknowns resolve --id unknown-001 \
+  --resolution not_applicable \
+  --evidence ./analysis-report.pdf
+```
+
+---
+
+### stella unknowns suppress
+
+Suppress an unknown (accept risk).
+
+```bash
+stella unknowns suppress [OPTIONS]
+```
+
+#### Options
+
+| Option | Description | Default |
+|--------|-------------|---------|
+| `--id <ID>` | Unknown ID | Required |
+| `--reason <TEXT>` | Suppression reason | Required |
+| `--expires <DATE>` | Expiration date | — |
+| `--scope <SCOPE>` | Scope: `scan`, `workspace`, `global` | `scan` |
+| `--approver <USER>` | Approver name/email | — |
+
+#### Examples
+
+```bash
+# Suppress with expiration
+stella unknowns suppress --id unknown-001 \
+  --reason "Internal tooling, no risk exposure" \
+  --expires 2026-01-01
+
+# Workspace-wide suppression
+stella unknowns suppress --id unknown-001 \
+  --reason "Deprecated component, scheduled for removal" \
+  --scope workspace \
+  --approver security@example.com
+```
+
+---
+
+### stella unknowns bulk-triage
+
+Bulk triage multiple unknowns.
+
+```bash
+stella unknowns bulk-triage [OPTIONS]
+```
+
+#### Options
+
+| Option | Description | Default |
+|--------|-------------|---------|
+| `--file <PATH>` | Triage decisions file (JSON/YAML) | Required |
+| `--dry-run` | Preview changes | `false` |
+| `--continue-on-error` | Continue on individual failures | `false` |
+
+#### Input File Format
+
+```json
+{
+  "decisions": [
+    {
+      "id": "unknown-001",
+      "action": "resolve",
+      "resolution": "mapped",
+      "comment": "Added mapping"
+    },
+    {
+      "id": "unknown-002",
+      "action": "suppress",
+      "reason": "Accepted risk",
+      "expires": "2026-01-01"
+    },
+    {
+      "id": "unknown-003",
+      "action": "escalate",
+      "reason": "Needs security review",
+      "assignee": "security-team"
+    }
+  ]
+}
+```
+
+#### Examples
+
+```bash
+# Bulk triage with preview
+stella unknowns bulk-triage --file triage-decisions.json --dry-run
+
+# Apply bulk triage
+stella unknowns bulk-triage --file triage-decisions.json
+```
+
+---
+
+### stella unknowns export
+
+Export unknowns data.
+
+```bash
+stella unknowns export [OPTIONS]
+```
+
+#### Options
+
+| Option | Description | Default |
+|--------|-------------|---------|
+| `--scan-id <ID>` | Filter by scan ID | — |
+| `--workspace-id <ID>` | Filter by workspace ID | — |
+| `--status <STATUS>` | Filter by status | All |
+| `--output <PATH>` | Output file path | Required |
+| `--format <FMT>` | Format: `json`, `yaml`, `csv`, `ndjson` | `json` |
+| `--include-history` | Include resolution history | `false` |
+
+#### Examples
+
+```bash
+# Export all unknowns
+stella unknowns export --workspace-id $WS_ID --output unknowns.json
+
+# Export pending as CSV
+stella unknowns export --status pending --output pending.csv --format csv
+
+# Export with history
+stella unknowns export --scan-id $SCAN_ID \
+  --output unknowns-history.json \
+  --include-history
+```
+
+---
+
+### stella unknowns import
+
+Import unknown resolutions.
+
+```bash
+stella unknowns import [OPTIONS]
+```
+
+#### Options
+
+| Option | Description | Default |
+|--------|-------------|---------|
+| `--file <PATH>` | Resolutions file | Required |
+| `--format <FMT>` | Format: `json`, `yaml`, `csv` | Auto-detect |
+| `--dry-run` | Preview import | `false` |
+| `--conflict <MODE>` | Conflict handling: `skip`, `update`, `error` | `skip` |
+
+#### Examples
+
+```bash
+# Import resolutions
+stella unknowns import --file resolutions.json
+
+# Preview import
+stella unknowns import --file resolutions.json --dry-run
+
+# Update existing
+stella unknowns import --file resolutions.json --conflict update
+```
+
+---
+
+## Common Options
+
+### Authentication
+
+| Option | Description |
+|--------|-------------|
+| `--token <TOKEN>` | OAuth bearer token |
+| `--token-file <PATH>` | File containing token |
+| `--profile <NAME>` | Use named profile |
+
+### Output
+
+| Option | Description |
+|--------|-------------|
+| `--quiet` | Suppress non-error output |
+| `--verbose` | Enable verbose output |
+| `--debug` | Enable debug logging |
+| `--no-color` | Disable colored output |
+
+### Connection
+
+| Option | Description |
+|--------|-------------|
+| `--endpoint <URL>` | Scanner API endpoint |
+| `--timeout <DURATION>` | Request timeout |
+| `--insecure` | Skip TLS verification |
+
+---
+
+## Environment Variables
+
+| Variable | Description |
+|----------|-------------|
+| `STELLA_TOKEN` | OAuth token |
+| `STELLA_ENDPOINT` | API endpoint |
+| `STELLA_PROFILE` | Profile name |
+| `STELLA_WORKSPACE` | Default workspace ID |
+
+---
+
+## Exit Codes
+
+| Code | Meaning |
+|------|---------|
+| 0 | Success |
+| 1 | General error |
+| 2 | Invalid arguments |
+| 3 | Authentication failed |
+| 4 | Resource not found |
+| 5 | Operation failed |
+| 6 | Network error |
+
+---
+
+## Workflows
+
+### Daily Triage Workflow
+
+```bash
+# 1. Check summary
+stella unknowns summary --workspace-id $WS_ID
+
+# 2. List high-priority pending
+stella unknowns list --status pending --min-score 7
+
+# 3. Review and escalate critical items
+stella unknowns escalate --id unknown-001 \
+  --reason "Security review needed" \
+  --severity high
+
+# 4. Bulk resolve known patterns
+stella unknowns bulk-triage --file daily-resolutions.json
+```
+
+### Weekly Report Export
+
+```bash
+# Export all unknowns with history
+stella unknowns export \
+  --workspace-id $WS_ID \
+  --include-history \
+  --output weekly-unknowns-$(date +%Y%m%d).json
+```
+
+---
+
+## Related Documentation
+
+- [Score Proofs CLI Reference](./score-proofs-cli-reference.md)
+- [Reachability CLI Reference](./reachability-cli-reference.md)
+- [Unknowns API Reference](../api/score-proofs-reachability-api-reference.md)
+- [Unknowns Queue Runbook](../operations/unknowns-queue-runbook.md)
+
+---
+
+**Last Updated**: 2025-12-20  
+**Version**: 1.0.0  
+**Sprint**: 3500.0004.0004