docs consolidation and others

docs/modules/vuln-explorer/guides/explorer-overview.md

@@ -0,0 +1,25 @@
+# Vulnerability Explorer Overview (Detailed)
+
+The Vulnerability Explorer is the evidence-linked triage surface that brings together SBOM facts, advisory/VEX evidence, reachability signals, policy explainability, and operator decisions into a single auditable workflow.
+
+This document complements the high-level guide `docs/VULNERABILITY_EXPLORER_GUIDE.md` with additional detail and cross-links.
+
+## Core Objects
+
+- **Finding record:** the current enriched view of a vulnerability for a specific artifact/context (tenant, artifact/image digest, policy version).
+- **History:** append-only state transitions suitable for audit and replay.
+- **Triage actions:** operator actions (assignment, comment, mitigation note, exception request) with provenance.
+- **Evidence references:** stable pointers to evidence objects (SBOM slices, VEX observations/linksets, reachability proofs, explain traces, attestations).
+
+## Key Properties
+
+- **Narrative-first:** default view answers “Can I ship? If not, why? What’s the smallest safe change?”
+- **Proof-linked:** every important fact links to evidence (no “trust the UI”).
+- **Quiet by default, never silent:** suppression/muting is reversible and auditable.
+- **Offline-ready:** evidence bundles are verifiable without online lookups.
+
+## References
+
+- High-level guide: `docs/VULNERABILITY_EXPLORER_GUIDE.md`
+- Console operator guide: `docs/UI_GUIDE.md`
+- Module dossier: `docs/modules/vuln-explorer/architecture.md`

docs/modules/vuln-explorer/guides/explorer-using-console.md

@@ -0,0 +1,32 @@
+# Vulnerability Explorer Using the Console
+
+This document describes the operator workflow for triaging findings in the Console. It is intentionally evidence-first and audit-oriented.
+
+## Workflow (Typical)
+
+1. Start from the findings list filtered to the tenant/environment you care about.
+2. Open a finding to review:
+   - Verdict and “why” summary
+   - Effective VEX status and issuer provenance
+   - Reachability/impact signals (when available)
+   - Policy gate and explain trace
+3. Record a triage action (assign/comment/mitigation/exception) with justification.
+4. Export an evidence bundle when review, escalation, or offline verification is required.
+
+## What to Expect in a Finding View
+
+- Clear tenant context and artifact identifiers
+- Evidence rail (SBOM, VEX, advisories, reachability, attestations)
+- History/timeline of state changes and actions (append-only)
+- Copyable identifiers (finding ID, digests, correlation IDs)
+
+## Offline / Air-Gap Notes
+
+- When operating from Offline Kit snapshots, the Console should surface snapshot identity and staleness budgets.
+- Evidence bundle export is the primary bridge between online and offline review.
+
+## References
+
+- Console operator guide: `docs/UI_GUIDE.md`
+- Vulnerability Explorer guide: `docs/VULNERABILITY_EXPLORER_GUIDE.md`
+- Offline Kit: `docs/OFFLINE_KIT.md`

docs/modules/vuln-explorer/guides/findings-ledger.md

@@ -0,0 +1,22 @@
+# Findings Ledger and Replay (Vulnerability Explorer)
+
+The Findings Ledger is the append-only backbone for auditable triage. It records current finding state, history transitions, and operator actions in a way that supports deterministic replay and offline verification.
+
+This document provides a conceptual overview; the authoritative schema and hashing rules are in the Findings Ledger module docs.
+
+## What the Ledger Stores
+
+- **Finding records:** enriched, policy-derived findings (with references to advisories/VEX/SBOM/reachability and explain traces).
+- **History:** append-only state transitions with actor identity, justification, and timestamps (UTC).
+- **Triage actions:** discrete operator actions (comment, assignment, mitigation note, ticket link) with immutable provenance.
+
+## Replay and Verification
+
+- Replay reconstructs derived state from append-only history/actions and compares deterministic digests.
+- Offline bundles include the ledger exports plus integrity metadata so auditors can verify without trusting a live service.
+
+## References
+
+- Findings Ledger schema: `docs/modules/findings-ledger/schema.md`
+- Merkle anchoring policy: `docs/modules/findings-ledger/merkle-anchor-policy.md`
+- Vulnerability Explorer dossier: `docs/modules/vuln-explorer/architecture.md`