# stella offline — Command Guide

## Overview

The `stella offline` command group manages air-gap “offline kits” locally, with verification (DSSE + optional Rekor receipt checks), monotonic version gating, and quarantine on validation failures.

## Commands

### `offline import`

```bash
stella offline import \
  --bundle ./bundle-2025-12-14.tar.zst \
  --verify-dsse \
  --verify-rekor \
  --trust-root /evidence/keys/roots/stella-root.pub
```

**Notes**
- `--verify-dsse` defaults to `true` and requires `--trust-root`.
- `--force-activate` requires `--force-reason` and records a non-monotonic activation override.
- `--dry-run` validates the kit without activating it.
- Uses the configured kits directory (default `offline-kits/`) for state (`offline-kits/.state/`) and quarantine (`offline-kits/quarantine/`).

### `offline status`

```bash
stella offline status --output json
```

Displays the currently active kit (if any), staleness, and quarantined bundle count.

## Exit codes

Offline exit codes are defined in `src/Cli/StellaOps.Cli/Commands/OfflineExitCodes.cs` (advisory A11), including:
- `0` success
- `1` file not found
- `2` checksum mismatch
- `5` DSSE verification failed
- `6` Rekor verification failed
- `8` version non-monotonic (not force-activated)
- `11` validation failed
- `130` cancelled