finish off sprint advisories and sprints

docs/modules/binary-index/architecture.md

@@ -1407,7 +1407,75 @@ Evidence bundles follow OCI/ORAS conventions:
     └── sha256:<timestamp>  # RFC 3161 timestamp
 ```
 
-### 10.6 Related Documentation
+### 10.6 Two-Tier Bundle Design and Large Blob References
+
+> **Sprint:** SPRINT_20260122_040_Platform_oci_delta_attestation_pipeline (040-04)
+
+Evidence bundles support two export modes to balance transfer speed with auditability:
+
+| Mode | Export Flag | Contents | Use Case |
+|------|------------|----------|----------|
+| **Light** | (default) | Manifest + attestation envelopes + metadata | Quick transfer, metadata-only audit |
+| **Full** | `--full` | Light + embedded binary blobs in `blobs/` | Air-gap replay, full provenance verification |
+
+#### 10.6.1 `largeBlobs[]` Field
+
+The `DeltaSigPredicate` includes a `largeBlobs` array referencing binary artifacts that may be too large to embed in attestation payloads:
+
+```json
+{
+  "schemaVersion": "1.0.0",
+  "subject": [...],
+  "delta": [...],
+  "largeBlobs": [
+    {
+      "kind": "binary-patch",
+      "digest": "sha256:a1b2c3...",
+      "mediaType": "application/octet-stream",
+      "sizeBytes": 1048576
+    },
+    {
+      "kind": "sbom-fragment",
+      "digest": "sha256:d4e5f6...",
+      "mediaType": "application/spdx+json",
+      "sizeBytes": 32768
+    }
+  ],
+  "sbomDigest": "sha256:789abc..."
+}
+```
+
+**Field Definitions:**
+
+| Field | Type | Description |
+|-------|------|-------------|
+| `largeBlobs[].kind` | string | Blob category: `binary-patch`, `sbom-fragment`, `debug-symbols`, etc. |
+| `largeBlobs[].digest` | string | Content-addressable digest (`sha256:<hex>`, `sha384:<hex>`, `sha512:<hex>`) |
+| `largeBlobs[].mediaType` | string | IANA media type of the blob |
+| `largeBlobs[].sizeBytes` | long | Blob size in bytes |
+| `sbomDigest` | string | Digest of the canonical SBOM associated with this delta |
+
+#### 10.6.2 Blob Fetch Strategy
+
+During `stella bundle verify --replay`, blobs are resolved in priority order:
+
+1. **Embedded** (full bundles): Read from `blobs/<digest-with-dash>` in bundle directory
+2. **Local source** (`--blob-source /path/`): Read from specified local directory
+3. **Registry** (`--blob-source https://...`): HTTP GET from OCI registry (blocked in `--offline` mode)
+
+#### 10.6.3 Digest Verification
+
+Fetched blobs are verified against their declared digest using the algorithm prefix:
+
+```
+sha256:<hex> → SHA-256
+sha384:<hex> → SHA-384
+sha512:<hex> → SHA-512
+```
+
+A mismatch fails the blob replay verification step.
+
+### 10.7 Related Documentation
 
 - [Golden Corpus KPIs](../../benchmarks/golden-corpus-kpis.md)
 - [Golden Corpus Seed List](../../benchmarks/golden-corpus-seed-list.md)