audit, advisories and doctors/setup work

docs/modules/cli/AGENTS.md

@@ -20,6 +20,7 @@ The `stella` CLI is the operator-facing Swiss army knife for scans, exports, pol
 - Preserve determinism: sort outputs, normalise timestamps (UTC ISO-8601), and avoid machine-specific artefacts.
 - Keep Offline Kit parity in mind—document air-gapped workflows for any new feature.
 - Update runbooks/observability assets when operational characteristics change.
+- Advisory commands must default to read-only and display evidence refs with citations.
 ## Required Reading
 - `docs/modules/cli/README.md`
 - `docs/modules/cli/architecture.md`

docs/modules/cli/architecture.md

@@ -174,7 +174,12 @@ Both subcommands honour offline-first expectations (no network access) and norma
   * Uses `STELLAOPS_ADVISORYAI_URL` when configured; otherwise it reuses the backend base address and adds `X-StellaOps-Scopes` (`advisory:run` + task scope) per request.
   * `--timeout 0` performs a single cache lookup (for CI flows that only want cached artefacts).
 
-### 2.12 Decision evidence (new)
+* `advise ask "<question>" [--evidence] [--no-action] [--conversation-id <id>] [--context <cve|scan|image>]`
+
+  * Calls advisory chat endpoints, returns a cited answer with evidence refs.
+  * `--no-action` disables action proposals; `--evidence` forces evidence chips in output.
+
+### 2.12 Decision evidence (new)
 
 - `decision export`