# Feature Matrix — Stella Ops Suite
*(rev 5.1 · 16 Jan 2026)*

> **Looking for a quick read?** Check [`key-features.md`](key-features.md) for the short capability cards; this matrix keeps full tier-by-tier detail.

---

## Product Evolution

**Stella Ops Suite** is now a centralized, auditable release control plane for non-Kubernetes container estates. The platform combines release orchestration with security decisioning as a gate.

- **Release orchestration** — UI-driven promotion (Dev → Stage → Prod), approvals, policy gates, rollbacks
- **Security decisioning as a gate** — Scan on build, evaluate on release, re-evaluate on CVE updates
- **OCI-digest-first releases** — Immutable digest-based release identity
- **Evidence packets** — Every release decision is cryptographically signed and stored

---

## Competitive Moat Features

*These differentiators are available across all plans.*

| Capability | Notes |
|------------|-------|
| Signed Replayable Risk Verdicts | Core differentiator |
| Decision Capsules | Audit-grade evidence bundles |
| VEX Decisioning Engine | Trust lattice + conflict resolution |
| Reachability with Portable Proofs | Three-layer analysis |
| Smart-Diff (Semantic Risk Delta) | Material change detection |
| Unknowns as First-Class State | Uncertainty budgets |
| Deterministic Replay | `stella replay srm.yaml` |
| Non-Kubernetes First-Class | Docker/Compose/ECS/Nomad targets |
| Digest-First Release Identity | Immutable releases |

---

## Release Orchestration (Planned)

*Release orchestration capabilities are planned for implementation.*

| Capability | Notes |
| **Environment Management** | |
| Environment CRUD | ⏳ Dev/Stage/Prod definitions |
| Freeze Windows | ⏳ Calendar-based blocking |
| Approval Policies | ⏳ Per-environment rules |
| **Release Management** | |
| Component Registry | ⏳ Service → repository mapping |
| Release Bundles | ⏳ Component → digest bundles |
| Semantic Versioning | ⏳ SemVer release versions |
| Tag → Digest Resolution | ⏳ Immutable digest pinning |
| **Promotion & Gates** | |
| Promotion Workflows | ⏳ Environment transitions |
| Security Gate | ⏳ Scan verdict evaluation |
| Approval Gate | ⏳ Human sign-off |
| Freeze Window Gate | ⏳ Calendar enforcement |
| Policy Gate (OPA/Rego) | ⏳ Custom rules |
| Decision Records | ⏳ Evidence-linked decisions |
| **Deployment Execution** | |
| Docker Host Agent | ⏳ Direct container deployment |
| Compose Host Agent | ⏳ Docker Compose deployment |
| SSH Agentless | ⏳ Linux remote execution |
| WinRM Agentless | ⏳ Windows remote execution |
| ECS Agent | ⏳ AWS ECS deployment |
| Nomad Agent | ⏳ HashiCorp Nomad deployment |
| Rollback | ⏳ Previous version restore |
| **Progressive Delivery** | |
| A/B Releases | ⏳ Traffic splitting |
| Canary Deployments | ⏳ Gradual rollout |
| Blue-Green | ⏳ Zero-downtime switch |
| Traffic Routing Plugins | ⏳ Nginx/HAProxy/Traefik/ALB |
| **Workflow Engine** | |
| DAG Workflow Execution | ⏳ Directed acyclic graphs |
| Step Registry | ⏳ Built-in + custom steps |
| Workflow Templates | ⏳ Reusable workflows |
| Script Steps (Bash/C#) | ⏳ Custom automation |
| **Evidence & Audit** | |
| Evidence Packets | ⏳ Sealed decision bundles |
| Version Stickers | ⏳ On-target deployment records |
| Audit Export | ⏳ Compliance reporting |
| **Integrations** | |
| GitHub Integration | ⏳ SCM + webhooks |
| GitLab Integration | ⏳ SCM + webhooks |
| Harbor Integration | ⏳ Registry + scanning |
| HashiCorp Vault | ⏳ Secrets management |
| AWS Secrets Manager | ⏳ Secrets management |
| **Plugin System** | |
| Plugin Manifest | ⏳ Static declarations |
| Connector Runtime | ⏳ Dynamic execution |
| Step Providers | ⏳ Custom workflow steps |
| Agent Types | ⏳ Custom deployment targets |

---

## Plan Limits

| Limit | Free | Pro | Enterprise |
|-------|:----:|:---:|:----------:|
| **Environments** | 3 | 33 | Unlimited |
| **New Digests/Day** | 333 | 3,333 | Unlimited |

---

## SBOM & Ingestion

| Capability | Notes |
|------------|-------|
| Trivy-JSON Ingestion | |
| SPDX-JSON 3.0.1 Ingestion | |
| CycloneDX 1.7 Ingestion (1.6 backward compatible) | |
| Auto-format Detection | |
| Delta-SBOM Cache | Warm scans <1s |
| SBOM Generation (all formats) | |
| Semantic SBOM Diff | |
| BYOS (Bring-Your-Own-SBOM) | |
| SBOM Lineage Ledger | Full versioned history |
| SBOM Lineage API | Traversal queries |

---

## Scanning & Detection

| Capability | Notes |
|------------|-------|
| CVE Lookup via Local DB | |
| Licence-Risk Detection | ⏳ Q4-2025 |
| **Automatic Detection (Class A)** | Runs implicitly during scan |
| — Secrets Detection | API keys, tokens, passwords; results in findings (see [docs/modules/ui/components/findings-list.md](docs/modules/ui/components/findings-list.md)) |
| — OS Package Analyzers | apk, apt, yum, dnf, rpm, pacman; results in SBOM (see [docs/modules/cli/guides/commands/sbom.md](docs/modules/cli/guides/commands/sbom.md)) |
| **Language Analyzers (All 11)** | |
| — .NET/C#, Java, Go, Python | |
| — Node.js, Ruby, Bun, Deno | |
| — PHP, Rust, Native binaries | |
| **Progressive Fidelity Modes** | |
| — Quick Mode | |
| — Standard Mode | |
| — Deep Mode | Full analysis |
| Base Image Detection | |
| Layer-Aware Analysis | |
| **Concurrent Scan Workers** | Configurable |

---

## Reachability Analysis

| Capability | Notes |
|------------|-------|
| Static Call Graph | |
| Entrypoint Detection | 9+ framework types |
| BFS Reachability | |
| Reachability Drift Detection | |
| Binary Loader Resolution | ELF/PE/Mach-O |
| Feature Flag/Config Gating | Layer 3 analysis |
| Runtime Signal Correlation | Zastava integration |
| Gate Detection (auth/admin) | Enterprise policies |
| Path Witness Generation | Audit evidence |
| Reachability Mini-Map API | UI visualization |
| Runtime Timeline API | Temporal analysis |

---

## Binary Analysis (BinaryIndex)

*Binary analysis capabilities are CLI-first (Class B). UI integration is minimal until user demand validates.*

| Capability | Notes |
|------------|-------|
| Binary Identity Extraction | Build-ID, hashes |
| Build-ID Vulnerability Lookup | |
| Debian/Ubuntu Corpus | |
| RPM/RHEL Corpus | |
| Patch-Aware Backport Detection | |
| PE/Mach-O/ELF Parsers | |
| Binary Fingerprint Generation | CLI: `stella binary fingerprint export` |
| Fingerprint Matching Engine | Similarity search |
| Binary Diff | CLI: `stella binary diff <base> <candidate>` |
| DWARF/Symbol Analysis | Debug symbols |

**CLI Commands (Class B):**
- `stella binary fingerprint export <artifact>` — Export fingerprint data (function hashes, section hashes, symbol table)
- `stella binary diff <base> <candidate>` — Compare binaries with function/symbol-level diff
- Output formats: `--format json|yaml|table`
- Usage and examples: [docs/modules/cli/guides/commands/binary.md](docs/modules/cli/guides/commands/binary.md)

---

## Advisory Sources (Concelier)

*Concelier provides 33+ vulnerability feed connectors with automatic sync, health monitoring, and conflict detection.*

| Connector | Notes |
|-----------|-------|
| **National CVE Databases** | |
| — NVD (NIST) | Primary CVE source |
| — CVE (MITRE) | CVE Record format 5.0 |
| **OSS Ecosystems** | |
| — OSV | Multi-ecosystem |
| — GHSA | GitHub Security Advisories |
| **Linux Distributions** | |
| — Alpine SecDB | |
| — Debian Security Tracker | |
| — Ubuntu USN | |
| — RHEL/CentOS OVAL | |
| — SUSE OVAL | |
| — Astra Linux | Russian distro |
| **CERTs / National CSIRTs** | |
| — CISA KEV | Known Exploited Vulns |
| — CISA ICS-CERT | Industrial control systems |
| — CERT-CC | Carnegie Mellon |
| — CERT-FR | France |
| — CERT-Bund (BSI) | Germany |
| — CERT-In | India |
| — ACSC | Australia |
| — CCCS | Canada |
| — KISA | South Korea |
| — JVN | Japan |
| **Russian Federation Sources** | |
| — FSTEC BDU | Russian vuln database |
| — NKCKI | Critical infrastructure |
| **Vendor PSIRTs** | |
| — Microsoft MSRC | |
| — Cisco PSIRT | |
| — Oracle CPU | |
| — VMware | |
| — Adobe PSIRT | |
| — Apple Security | |
| — Chromium | |
| **ICS/SCADA** | |
| — Kaspersky ICS-CERT | Industrial security |
| **Risk Scoring** | |
| — EPSS v4 | Exploit prediction |
| **Additional Features** | |
| Custom Advisory Connectors | Private feeds |
| Advisory Merge Engine | Conflict resolution |
| Connector Health CLI | `stella db connectors status` |

**Connector Operations Matrix (Status/Auth/Runbooks):**

| Connector | Status | Auth | Ops Runbook |
| --- | --- | --- | --- |
| NVD (NIST) | stable | api-key | [docs/modules/concelier/operations/connectors/nvd.md](docs/modules/concelier/operations/connectors/nvd.md) |
| CVE (MITRE) | stable | none | [docs/modules/concelier/operations/connectors/cve.md](docs/modules/concelier/operations/connectors/cve.md) |
| OSV | stable | none | [docs/modules/concelier/operations/connectors/osv.md](docs/modules/concelier/operations/connectors/osv.md) |
| GHSA | stable | api-token | [docs/modules/concelier/operations/connectors/ghsa.md](docs/modules/concelier/operations/connectors/ghsa.md) |
| Alpine SecDB | stable | none | [docs/modules/concelier/operations/connectors/alpine.md](docs/modules/concelier/operations/connectors/alpine.md) |
| Debian Security Tracker | stable | none | [docs/modules/concelier/operations/connectors/debian.md](docs/modules/concelier/operations/connectors/debian.md) |
| Ubuntu USN | stable | none | [docs/modules/concelier/operations/connectors/ubuntu.md](docs/modules/concelier/operations/connectors/ubuntu.md) |
| Red Hat OVAL/CSAF | stable | none | [docs/modules/concelier/operations/connectors/redhat.md](docs/modules/concelier/operations/connectors/redhat.md) |
| SUSE OVAL/CSAF | stable | none | [docs/modules/concelier/operations/connectors/suse.md](docs/modules/concelier/operations/connectors/suse.md) |
| Astra Linux | beta | none | [docs/modules/concelier/operations/connectors/astra.md](docs/modules/concelier/operations/connectors/astra.md) |
| CISA KEV | stable | none | [docs/modules/concelier/operations/connectors/cve-kev.md](docs/modules/concelier/operations/connectors/cve-kev.md) |
| CISA ICS-CERT | stable | none | [docs/modules/concelier/operations/connectors/ics-cisa.md](docs/modules/concelier/operations/connectors/ics-cisa.md) |
| CERT-CC | stable | none | [docs/modules/concelier/operations/connectors/cert-cc.md](docs/modules/concelier/operations/connectors/cert-cc.md) |
| CERT-FR | stable | none | [docs/modules/concelier/operations/connectors/cert-fr.md](docs/modules/concelier/operations/connectors/cert-fr.md) |
| CERT-Bund | stable | none | [docs/modules/concelier/operations/connectors/certbund.md](docs/modules/concelier/operations/connectors/certbund.md) |
| CERT-In | stable | none | [docs/modules/concelier/operations/connectors/cert-in.md](docs/modules/concelier/operations/connectors/cert-in.md) |
| ACSC | stable | none | [docs/modules/concelier/operations/connectors/acsc.md](docs/modules/concelier/operations/connectors/acsc.md) |
| CCCS | stable | none | [docs/modules/concelier/operations/connectors/cccs.md](docs/modules/concelier/operations/connectors/cccs.md) |
| KISA | stable | none | [docs/modules/concelier/operations/connectors/kisa.md](docs/modules/concelier/operations/connectors/kisa.md) |
| JVN | stable | none | [docs/modules/concelier/operations/connectors/jvn.md](docs/modules/concelier/operations/connectors/jvn.md) |
| FSTEC BDU | beta | none | [docs/modules/concelier/operations/connectors/fstec-bdu.md](docs/modules/concelier/operations/connectors/fstec-bdu.md) |
| NKCKI | beta | none | [docs/modules/concelier/operations/connectors/nkcki.md](docs/modules/concelier/operations/connectors/nkcki.md) |
| Microsoft MSRC | stable | none | [docs/modules/concelier/operations/connectors/msrc.md](docs/modules/concelier/operations/connectors/msrc.md) |
| Cisco PSIRT | stable | oauth | [docs/modules/concelier/operations/connectors/cisco.md](docs/modules/concelier/operations/connectors/cisco.md) |
| Oracle CPU | stable | none | [docs/modules/concelier/operations/connectors/oracle.md](docs/modules/concelier/operations/connectors/oracle.md) |
| VMware | stable | none | [docs/modules/concelier/operations/connectors/vmware.md](docs/modules/concelier/operations/connectors/vmware.md) |
| Adobe PSIRT | stable | none | [docs/modules/concelier/operations/connectors/adobe.md](docs/modules/concelier/operations/connectors/adobe.md) |
| Apple Security | stable | none | [docs/modules/concelier/operations/connectors/apple.md](docs/modules/concelier/operations/connectors/apple.md) |
| Chromium | stable | none | [docs/modules/concelier/operations/connectors/chromium.md](docs/modules/concelier/operations/connectors/chromium.md) |
| Kaspersky ICS-CERT | beta | none | [docs/modules/concelier/operations/connectors/kaspersky-ics.md](docs/modules/concelier/operations/connectors/kaspersky-ics.md) |
| EPSS v4 | stable | none | [docs/modules/concelier/operations/connectors/epss.md](docs/modules/concelier/operations/connectors/epss.md) |

---

## VEX Processing (Excititor/VexLens)

*VEX processing provides a full consensus engine with 5-state lattice, 9 trust factors, and conflict detection.*

| Capability | Notes |
|------------|-------|
| OpenVEX Ingestion | |
| CycloneDX VEX Ingestion | |
| CSAF VEX Ingestion | |
| **VEX Consensus Engine (5-state)** | Lattice-based resolution |
| Trust Vector Scoring (P/C/R) | |
| **Trust Weight Scoring (9 factors)** | Issuer, age, specificity, etc. |
| Claim Strength Multipliers | |
| Freshness Decay | 14-day half-life |
| Conflict Detection & Penalty | K4 lattice logic |
| VEX Conflict Studio UI | Visual resolution |
| VEX Hub (Distribution) | Internal VEX network |
| VEX Webhook Distribution | Pub/sub notifications |
| CSAF Provider Connectors (7) | RedHat, Ubuntu, Oracle, MSRC, Cisco, SUSE, VMware |
| Issuer Trust Registry | Key lifecycle, trust overrides |
| VEX from Drift Generation | `stella vex gen --from-drift` |
| Trust Calibration Service | Org-specific tuning |
| Consensus Rationale Export | Audit-grade explainability |

**CLI Commands:**
- `stella vex verify <statement>` — Verify VEX statement signature and content
- `stella vex consensus <digest>` — Show consensus status for digest
- `stella vex evidence export` — Export VEX evidence for audit
- `stella vex webhooks list/add/remove` — Manage VEX distribution
- `stella issuer keys list/create/rotate/revoke` — Issuer key management

---

## Policy Engine

*Policy engine implements Belnap K4 four-valued logic with 10+ gate types and 6 risk providers.*

| Capability | Notes |
|------------|-------|
| YAML Policy Rules | Basic rules |
| **Belnap K4 Four-Valued Logic** | True/False/Both/Neither |
| Security Atoms (6 types) | |
| Disposition Selection (ECMA-424) | |
| Minimum Confidence Gate | |
| **10+ Policy Gate Types** | Severity, reachability, age, etc. |
| **6 Risk Score Providers** | CVSS, KEV, EPSS, FixChain, etc. |
| Unknowns Budget Gate | |
| Determinization System | Signal weights, decay, uncertainty |
| Policy Simulation | `stella policy simulate` |
| Source Quota Gate | 60% cap enforcement |
| Reachability Requirement Gate | For criticals |
| OPA/Rego Integration | Custom policies |
| Exception Objects & Workflow | Approval chains |
| Score Policy YAML | Full customization |
| Configurable Scoring Profiles | Simple/Advanced |
| Policy Version History | Audit trail |
| Verdict Attestations | DSSE/Rekor signed verdicts |

**CLI Commands:**
- `stella policy list/show/create/update/delete` — Policy CRUD
- `stella policy simulate <digest>` — Simulate policy evaluation
- `stella policy validate <file>` — Validate policy YAML
- `stella policy decisions list/show` — View policy decisions
- `stella policy gates list` — List available gate types

---

## Attestation & Signing

*Attestation supports 25+ predicate types with keyless signing, key rotation, and attestation chains.*

| Capability | Notes |
|------------|-------|
| DSSE Envelope Signing | |
| in-toto Statement Structure | |
| **25+ Predicate Types** | SBOM, VEX, verdict, etc. |
| SBOM Predicate | |
| VEX Predicate | |
| Reachability Predicate | |
| Policy Decision Predicate | |
| Verdict Manifest (signed) | |
| Verdict Replay Verification | |
| Keyless Signing (Sigstore) | Fulcio-based OIDC |
| Delta Attestations (4 types) | VEX/SBOM/Verdict/Reachability |
| Attestation Chains | Linked attestation graphs |
| Human Approval Predicate | Workflow attestation |
| Boundary Predicate | Network exposure |
| Key Rotation Service | Automated key lifecycle |
| Trust Anchor Management | Root CA management |
| SLSA Provenance v1.0 | Supply chain |
| Rekor Transparency Log | Public attestation |
| Cosign Integration | Sigstore ecosystem |

**CLI Commands:**
- `stella attest sign <file>` — Sign attestation
- `stella attest verify <envelope>` — Verify attestation signature
- `stella attest predicates list` — List supported predicate types
- `stella attest export <digest>` — Export attestations for digest
- `stella keys list/create/rotate/revoke` — Key management

---

## Regional Crypto (Sovereign Profiles)

*Sovereign crypto is core to the open-source promise - no vendor lock-in on compliance. 8 signature profiles supported.*

| Capability | Notes |
|------------|-------|
| Default Crypto (Ed25519) | |
| FIPS 140-2/3 Mode | US Federal |
| eIDAS Signatures | EU Compliance |
| GOST/CryptoPro | Russia |
| SM National Standard | China |
| Post-Quantum (Dilithium) | Future-proof |
| Crypto Plugin Architecture | Custom HSM |
| Multi-Profile Signing | Sign with multiple algorithms |
| SM Remote Service | Chinese market HSM integration |
| HSM/PKCS#11 Integration | Hardware security modules |

**CLI Commands:**
- `stella crypto profiles list` — List available crypto profiles
- `stella crypto verify --profile <name>` — Verify with specific profile
- `stella crypto plugins list/status` — Manage crypto plugins

---

## Determinism & Reproducibility

| Capability | Notes |
|------------|-------|
| Canonical JSON Serialization | |
| Content-Addressed IDs | SHA-256 |
| Replay Manifest (SRM) | |
| `stella replay` CLI | |
| Score Explanation Arrays | |
| Evidence Freshness Multipliers | |
| Proof Coverage Metrics | |
| Fidelity Metrics (BF/SF/PF) | Audit dashboards |
| FN-Drift Rate Tracking | Quality monitoring |
| Determinism Gate CI | Automated checks |

---

## Scoring & Risk Assessment

| Capability | Notes |
|------------|-------|
| CVSS v4.0 Display | |
| EPSS v4 Probability | |
| Priority Band Classification | |
| EPSS-at-Scan Immutability | |
| Unified Confidence Model | 5-factor |
| Entropy-Based Scoring | Advanced |
| Gate Multipliers | Reachability-aware |
| Unknowns Pressure Factor | Risk budgets |
| Custom Scoring Profiles | Org-specific |

---

## Evidence & Findings

| Capability | Notes |
|------------|-------|
| Findings List | |
| Evidence Graph View | Basic |
| Decision Capsules | |
| Findings Ledger (Immutable) | Audit trail |
| Evidence Locker (Sealed) | Export/import |
| Evidence TTL Policies | Retention rules |
| Evidence Size Budgets | Storage governance |
| Retention Tiers | Hot/Warm/Cold |
| Privacy Controls | Redaction |
| Audit Pack Export | Compliance bundles |

---

## CLI Capabilities

| Capability | Notes |
|------------|-------|
| Scanner Commands | |
| SBOM Inspect & Diff | |
| Deterministic Replay | |
| Attestation Verify | |
| Unknowns Budget Check | |
| Evidence Export | |
| Audit Pack Operations | Full workflow |
| Binary Match Inspection | Advanced |
| Crypto Plugin Commands | Regional crypto |
| Admin Utilities | Ops tooling |

---

## Web UI Capabilities

| Capability | Notes |
|------------|-------|
| Dark/Light Mode | |
| Findings Row Component | |
| Evidence Drawer | |
| Proof Tab | |
| Confidence Meter | |
| Locale Support | Cyrillic, etc. |
| Reproduce Verdict Button | |
| Audit Trail UI | Full history |
| Trust Algebra Panel | P/C/R visualization |
| Claim Comparison Table | Conflict view |
| Policy Chips Display | Gate status |
| Reachability Mini-Map | Path visualization |
| Runtime Timeline | Temporal view |
| Operator/Auditor Toggle | Role separation |
| Knowledge Snapshot UI | Air-gap prep |
| Keyboard Shortcuts | Power users |

---

## Quota & Operations

| Plan | Scans per Day |
|------|:-------------:|
| **Free** | **333** |
| **Pro** | **3,333** |
| **Enterprise** | **Unlimited** |

**All other operational capabilities are available across all plans:**
- Usage API (`/quota`)
- Client-JWT authentication
- Rate Limiting & 429 Backpressure
- Retry-After Headers
- Priority Queue
- Burst Allowance (configurable)
- Custom Quotas (configurable)

---

## Offline & Air-Gap

| Capability | Notes |
|------------|-------|
| Offline Update Kits (OUK) | Available |
| Offline Signature Verify | |
| One-Command Replay | |
| Sealed Knowledge Snapshots | Full feed export |
| Air-Gap Bundle Manifest | Transfer packages |
| No-Egress Enforcement | Strict isolation |
| Offline JWT | Extended tokens |

---

## Deployment

| Capability | Notes |
|------------|-------|
| Docker Compose | Single-node |
| Helm Chart (K8s) | |
| PostgreSQL 16+ | |
| Valkey 8.0+ | |
| RustFS (S3) | |
| High-Availability | Multi-replica |
| Horizontal Scaling | Auto-scale |
| Dedicated Capacity | Reserved resources |

---

## Access Control & Identity (Authority)

*Authority provides OAuth 2.1/OIDC with 75+ authorization scopes, DPoP, and device authorization.*

| Capability | Notes |
|------------|-------|
| Basic Auth | |
| API Keys | With scopes and expiration |
| SSO/SAML Integration | Okta, Azure AD |
| OIDC Support | |
| Basic RBAC | User/Admin |
| 75+ Authorization Scopes | Fine-grained permissions |
| DPoP (Sender Constraints) | Token binding |
| mTLS Client Certificates | Certificate auth |
| Device Authorization Flow | CLI/IoT devices |
| PAR Support | Pushed Authorization Requests |
| User Federation (LDAP/SAML) | Directory integration |
| Multi-Factor Authentication | TOTP/WebAuthn |
| Advanced RBAC | Team-based scopes |
| Multi-Tenant Management | Org hierarchy |
| Audit Log Export | SIEM integration |

**CLI Commands:**
- `stella auth clients list/create/delete` — OAuth client management
- `stella auth roles list/show/assign` — Role management
- `stella auth scopes list` — List available scopes
- `stella auth token introspect <token>` — Token introspection
- `stella auth api-keys list/create/revoke` — API key management

---

## Notifications & Integrations

*10 notification channel types with template engine, routing rules, and escalation.*

| Capability | Notes |
|------------|-------|
| In-App Notifications | |
| Email Notifications | |
| EPSS Change Alerts | |
| Slack Integration | |
| Teams Integration | |
| Discord Integration | Webhook-based |
| PagerDuty Integration | Incident management |
| OpsGenie Integration | Alert routing |
| Zastava Registry Hooks | Auto-scan on push |
| Zastava K8s Admission | Validating/Mutating webhooks |
| Template Engine | Customizable templates |
| Channel Routing Rules | Severity/team routing |
| Escalation Policies | Time-based escalation |
| Notification Studio UI | Visual rule builder |
| Custom Webhooks | Any endpoint |
| CI/CD Gates | GitLab/GitHub/Jenkins |
| SCM Integrations | PR comments, status checks |
| Issue Tracker Integration | Jira, GitHub Issues |
| Enterprise Connectors | Grid/Premium APIs |

**CLI Commands:**
- `stella notify channels list/test` — Channel management
- `stella notify rules list/create` — Routing rules
- `stella zastava install/configure/status` — K8s webhook management

---

## Scheduling & Automation

| Capability | Notes |
|------------|-------|
| Manual Scans | |
| Scheduled Scans | Cron-based |
| Task Pack Orchestration | Declarative workflows |
| EPSS Daily Refresh | Auto-update |
| Event-Driven Scanning | On registry push |

---

## Observability & Telemetry

| Capability | Notes |
|------------|-------|
| Basic Metrics | |
| Opt-In Telemetry | |
| OpenTelemetry Traces | Full tracing |
| Prometheus Export | Custom dashboards |
| Quality KPIs Dashboard | Triage metrics |
| SLA Monitoring | Uptime tracking |

---

## Support & Services

| Capability | Notes |
|------------|-------|
| Documentation | |
| Community Forums | |
| GitHub Issues | |
| Email Support | Business hours |
| Priority Support | 4hr response |
| 24/7 Critical Support | Add-on |
| Dedicated CSM | Named contact |
| Professional Services | Implementation |
| Training & Certification | Team enablement |
| SLA Guarantee | 99.9% uptime |

---

## Version Comparison

| Capability | Notes |
|------------|-------|
| RPM (NEVRA) | |
| Debian (EVR) | |
| Alpine (APK) | |
| SemVer | |
| PURL Resolution | |

---

> **Legend:** ⏳ = Planned

---

*Last updated: 17 Jan 2026 (rev 6.0 - All features available across all tiers)*