# Pack 1 — Release Control (root menus)

## Legend (used everywhere)

* **CritR** = *Critical Reachable* findings count (hybrid reachability)
* **SBOM** = SBOM presence + freshness (OK / Stale / Missing)
* **Cov** = reachability coverage sources: **B/I/R** = Build / Image (Dover/Docker) / Runtime
  Example: `Cov 2/3` means two sources available; hover shows which.
* **Hybrid Reachability** = union/merge of Build + Image + Runtime reachability signals.

---

## 0) Left-nav structure (Release Control as root)

```mermaid
flowchart TB
  subgraph LeftNav["Left Nav"]
    subgraph RC["Release Control (ROOT)"]
      DASH["Dashboard<br/>(formerly: Control Plane)"]
      REL["Releases<br/>(formerly: Releases)"]
      BUN["Bundles<br/>(NEW: Release Bundle Organizer)"]
      APR["Approvals<br/>(formerly: Approvals)"]
      DEP["Deployments<br/>(formerly: Active Deployments widget)"]
      REG["Regions & Environments<br/>(formerly: env pipeline widget)"]
    end

    subgraph SR["Security & Risk (group)"]
      SR1["Risk Overview (formerly: Security Overview)"]
      SR2["Findings (formerly: Security Findings)"]
      SR3["Reachability Coverage (NEW)"]
      SR4["SBOM Explorer (formerly: SBOM Graph)"]
      SR5["VEX Hub (formerly: VEX Hub)"]
      SR6["Exceptions (formerly: Exceptions)"]
    end

    subgraph EA["Evidence & Audit (group)"]
      EA1["Decision Capsules (formerly: Evidence Bundles / Packets)"]
      EA2["Proof Chains (formerly: Proof Chains)"]
      EA3["Replay / Verify (formerly: Replay/Verify)"]
      EA4["Export Center (formerly: Export)"]
      EA5["Coverage Metrics (formerly: SBOM Lake)"]
    end

    subgraph IN["Integrations (group)"]
      IN1["Integrations Hub (formerly: Integrations)"]
      IN2["Feeds & Mirrors (formerly: Operations → Feeds)"]
    end

    subgraph PO["Platform Ops (group)"]
      PO1["Nightly Ops Report (NEW)"]
      PO2["Platform Health (formerly: Platform Health)"]
      PO3["Jobs / Orchestrator (formerly: Orchestrator)"]
      PO4["Scheduler Runs (formerly: Scheduler)"]
      PO5["Dead Letter (formerly: Dead Letter)"]
      PO6["Quotas & Usage (formerly: Quotas)"]
    end

    subgraph AD["Administration (group)"]
      AD1["Policy Governance"]
      AD2["Trust & Signing"]
      AD3["Identity & Access"]
      AD4["System"]
    end
  end
```

---

## 1) Release Control — menu/screen graph (Pack 1 scope)

```mermaid
flowchart LR
  DASH --> REL
  DASH --> BUN
  DASH --> APR
  DASH --> DEP
  DASH --> REG

  REL --> RDETAIL["Release Detail"]
  BUN --> BDETAIL["Bundle Detail / Compose"]
  APR --> ADETAIL["Approval Detail"]
  REG --> EDETAIL["Environment Detail"]
  DEP --> DDETAIL["Deployment Detail"]

  %% common crosslinks (second-class but not buried)
  DASH -. "CritR hotspots" .-> FIND["Security & Risk → Findings"]
  RDETAIL -. "Risk tab" .-> FIND
  BDETAIL -. "Component findings" .-> FIND
  ADETAIL -. "Evidence preview" .-> CAPS["Evidence & Audit → Decision Capsule"]
  DDETAIL -. "Proof" .-> CAPS

  %% nightly ops signal (dashboard card)
  DASH -. "Nightly failures" .-> NIGHT["Platform Ops → Nightly Ops Report"]
```

---

# Screen 1 — Dashboard (Release Control)

**Formerly:** `Control Plane` (plus some signals scattered in `Security Overview`, `Integrations`, `Platform Health`).
**Why changed:** Stella Ops needs a **release-centric “mission board”**: what is promoting, what is blocked, and what is risky *by region/env* — including **SBOM status + hybrid reachability (CritR)** and **nightly data freshness**. This prevents “green deploy / red risk” blind spots.

### Mermaid — Dashboard navigation graph

```mermaid
flowchart TB
  DASH["Dashboard"] -->|click release row| RDETAIL["Release Detail"]
  DASH -->|pending approvals| APR["Approvals"]
  DASH -->|active deployments| DEP["Deployments"]
  DASH -->|region pipeline| REG["Regions & Environments"]
  DASH -->|CritR hotspot| FIND["Security & Risk → Findings (filtered)"]
  DASH -->|Nightly failures| NIGHT["Platform Ops → Nightly Ops Report"]
```

### ASCII wireframe — Dashboard

```text
+----------------------------------------------------------------------------------+
| Stella Ops  [Search releases/digests/CVEs]  Region: All▼  Env: All▼  Time: 24h▼ |
| Status: Offline OK | Feed: Live | Policy Pack: latest | Evidence: ON             |
+----------------------------------------------------------------------------------+
| RELEASE CONTROL DASHBOARD  (formerly: Control Plane)                              |
|----------------------------------------------------------------------------------|
| Region Pipelines (Deploy + SBOM + Risk)                                           |
|  US-East:  Dev[Deploy OK|SBOM OK|CritR 0|Cov 3/3] -> Stg[OK|OK|0|3/3] ->          |
|           Prod[DEGRADED|SBOM STALE|CritR 4|Cov 2/3]                                |
|  EU-West:  Dev[OK|OK|0|3/3] -> Stg[OK|MISSING|CritR ?|Cov 1/3] -> Prod[OK|OK|1|3/3]|
|  APAC:     ...                                                                    |
|----------------------------------------------------------------------------------|
| Pending Approvals (2)           | Active Deployments (1)                         |
| - API Gateway v2.1.0 US-E/Prod  | - Hotfix 1.2.4  US-East/Prod  RUNNING          |
|   Gate: PASS  Approvals: 1/2    |   Targets: 1/1  Evidence: sealing...          |
| - User Service v3.0.0-rc1 EU/Prod|                                                  |
|   Gate: BLOCK (CritR 2)         |                                                  |
|----------------------------------------------------------------------------------|
| Critical Reachable Hotspots (CritR)             | Nightly Ops Signals             |
| - US-East/Prod: CritR 4 (openssl, log4j...)     | SBOM Rescan: WARN (1 failed)    |
| - EU-West/Prod: CritR 1 (glibc...)              | CVE Feeds: ERROR (NVD stale 18h)|
| - APAC/Stg: CritR 2 (xz...)                     | Integrations: DEGRADED (Jenkins)|
| [View Findings]                                  | Reachability ingest: WARN (Runtime)|
|----------------------------------------------------------------------------------|
| Recent Releases / Promotions                                                     |
| Release            Type    Status      Regions     CritR max   Evidence          |
| Hotfix 1.2.4       Single  PROMOTING   US-East     4           Sealing...        |
| Platform 1.3.0-rc1 Bundle  READY       All         0           Ready             |
|----------------------------------------------------------------------------------|
```

---

# Screen 2 — Releases (ledger)

**Formerly:** `Releases`.
**Why changed:** keep the ledger, but make it **digest-first + bundle-aware**, and show **risk + SBOM freshness + reachability coverage** at the list level so operators don’t need to click into each release to see “is it actually safe to promote”.

### Mermaid — Releases navigation graph

```mermaid
flowchart TB
  REL["Releases"] -->|select row| RDETAIL["Release Detail"]
  REL -->|Create Hotfix| NEWREL["New Release (Single Digest)"]
  REL -->|Create from Bundle| BUN["Bundles"]
  REL -->|Compare| COMP["Compare Releases (diff)"]
  REL -. "Export evidence" .-> EA4["Export Center"]
```

### ASCII wireframe — Releases

```text
+----------------------------------------------------------------------------------+
| Releases  (formerly: Releases)      [Create Hotfix] [Create from Bundle]         |
| Filters: Region▼  Env Path▼  Type▼  Status▼   Search...                          |
+----------------------------------------------------------------------------------+
| Release / Version         Type     Status       Regions     Env Path  CritR  SBOM |
|----------------------------------------------------------------------------------|
| Hotfix 1.2.4              Single   PROMOTING    US-East     Stg→Prod     4  STALE |
| Platform Release 1.3.0-rc1 Bundle  READY        All         Stg→Prod     0  OK    |
| Platform Release 1.2.3     Bundle  DEPLOYED     All         Prod         0  OK    |
| Feature Branch 2.0.0-a     Bundle  DRAFT        EU-West     Dev          -  -     |
| Platform Release 1.2.2     Bundle  ROLLED_BACK  US-East     Prod         -  OK    |
|----------------------------------------------------------------------------------|
| Row actions: [View] [Compare] [Evidence] [Rollback] [Promote]                    |
+----------------------------------------------------------------------------------+
```

---

# Screen 3 — Release Detail (case file)

**Formerly:** scattered between `Releases` (list), `Approvals` (decision context), `Security Findings` (risk details), and `Export/Replay`.
**Why changed:** Stella Ops’ center of gravity is a **release decision bound to a digest** (or bundle digest). This screen becomes the “case file”: promotion edge, risk, reachability sources, policy inputs, approvals, deployment, and evidence — in one place.

### Mermaid — Release Detail navigation graph

```mermaid
flowchart TB
  RDETAIL["Release Detail"] --> APR["Approvals (filtered to this release)"]
  RDETAIL --> DEP["Deployments (filtered)"]
  RDETAIL --> FIND["Findings (filtered)"]
  RDETAIL --> CAPS["Decision Capsule (for this edge)"]
  RDETAIL --> BDETAIL["Bundle Detail (if Type=Bundle)"]
  RDETAIL --> REG["Regions & Environments (focus edge)"]
```

### ASCII wireframe — Release Detail

```text
+----------------------------------------------------------------------------------+
| Release: Hotfix 1.2.4  Type: Single Digest  Digest: sha256:abcd...              |
| Path: US-East  Staging → Production     Status: PROMOTING                         |
| Summary: CritR 4 | SBOM STALE | Cov 2/3 (Build+Image; Runtime missing)            |
|----------------------------------------------------------------------------------|
| Promotion Timeline (edges)                | Gate Summary                          |
| Staging → Prod  [BLOCKED?]                | Policy: PASS                           |
|   - Findings: CritR 4                     | Data freshness: WARN (SBOM stale)      |
|   - Approvals: 1/2                        | Reachability: WARN (Runtime missing)   |
|   - Evidence: Sealing...                  | Human: PENDING (1 remaining)           |
|----------------------------------------------------------------------------------|
| Tabs: [Overview] [Components] [Risk] [Reachability] [Approvals] [Deployments] [Evidence] |
|----------------------------------------------------------------------------------|
| Overview:                                                                         |
| - Requested by: security-team        - Change summary: "Critical security patch" |
| - Inputs frozen: Policy Pack vX.Y    - SBOM scan time: 18h ago (stale threshold 6h)|
|----------------------------------------------------------------------------------|
| Risk (summary):                                                                  |
| CritR: 4  HighR: 7  MedR: 12  (hybrid reachability)                               |
| Top drivers: openssl CVE-xxxx, libxml2 CVE-yyyy                                   |
| [Open Findings (filtered)]                                                       |
|----------------------------------------------------------------------------------|
| Evidence:                                                                         |
| Decision Capsule: DSSE ✓  Rekor ✓  Replayable ✓   [View Capsule] [Export]        |
+----------------------------------------------------------------------------------+
```

---

# Screen 4 — Bundles (Release Bundle Organizer) **NEW**

**Formerly:** not present; *closest concept* was `Export Center → StellaBundle` but that is an **audit/export artifact**, not an operator workflow for composing deployable multi-service releases.
**Why added / why here:** You need a **bundle organizer** to turn “microservice digest + env-derived variables + other microservices + changelog” into a **bundle version** with a **bundle digest**. This stays digest-first (everything pinned by digest), but becomes human-operable for multi-service systems.

### Bundle concept (explicit)

A **Bundle** =

* Components: `service/repo → digest → derived component version`
* Config Snapshot per region/env: references to Vault/Consul inputs + hashes (no secret values)
* Changelog per repo: commit/PR range between previous bundle and this bundle
* Bundle digest: hash of the bundle manifest (components + config snapshot refs + metadata)
* Used to create **Releases** (promotions) across environments.

### Mermaid — Bundles navigation graph

```mermaid
flowchart TB
  BUN["Bundles"] -->|select bundle| BDETAIL["Bundle Detail / Compose"]
  BUN -->|Create bundle| BCREATE["Create Bundle (from repos/services)"]
  BDETAIL -->|Generate Release Candidate| REL["Releases (new release from bundle)"]
  BDETAIL -->|Compare to previous bundle| BDIFF["Bundle Diff (components+config+changelog)"]
  BDETAIL -->|Fetch config snapshot| CFG["Config Snapshot (Vault/Consul refs)"]
  BDETAIL -. "Risk preview" .-> FIND["Findings (bundle-filtered)"]
```

### ASCII wireframe — Bundles (Organizer)

```text
+----------------------------------------------------------------------------------+
| Bundles  (NEW)   (formerly: N/A; concept overlaps Export Center but different)   |
| [Create Bundle]  Filters: Repo▼  Region▼  Env▼  Status▼  Search...               |
+----------------------------------------------------------------------------------+
| Bundle / Version        Status   Components  Regions   Env Baseline  CritR  SBOM |
|----------------------------------------------------------------------------------|
| Platform Bundle 1.3.0   READY    12          All      Stg baseline       0   OK  |
| Checkout Bundle 2026.02 DRAFT    7           EU-West  Dev baseline        -   -  |
| Hotfix Set 1.2.4        READY    1           US-East  Prod baseline       4   STALE|
|----------------------------------------------------------------------------------|
| Row actions: [Compose] [Compare] [Create Release] [Export Manifest]              |
+----------------------------------------------------------------------------------+
```

---

# Screen 5 — Bundle Detail / Compose (Bundle “case file”)

**Formerly:** not present; composition typically happens in external tooling (CI/CD templates, Helm charts, spreadsheets).
**Why changed:** This is the missing “organizer” you called out. It makes bundles **auditable, repeatable, and env-config-aware**, while preserving digest-first identity.

### Mermaid — Bundle Detail / Compose graph

```mermaid
flowchart TB
  BDETAIL["Bundle Detail / Compose"] -->|Edit components| COMP["Component Picker (repo/service)"]
  BDETAIL -->|Pin digest & derive version| MAP["Digest→Version Mapping"]
  BDETAIL -->|Fetch env config refs| CFG["Config Snapshot (Vault/Consul)"]
  BDETAIL -->|View changelog| CHG["Changelog (per repo)"]
  BDETAIL -->|Validate| VAL["Bundle Validation (SBOM, attestation, policy inputs)"]
  BDETAIL -->|Lock| LOCK["Lock Bundle (freeze manifest)"]
  BDETAIL -->|Create Release| REL["Create Release from Bundle"]
  BDETAIL -. "Preview risk" .-> FIND["Findings (bundle-filtered)"]
```

### ASCII wireframe — Bundle Detail / Compose

```text
+----------------------------------------------------------------------------------+
| Bundle: Platform Bundle 1.3.0   Status: DRAFT   Bundle Digest: sha256:bund...    |
| Baseline: Staging  Regions: All  Last updated: 5m ago                            |
| Actions: [Validate] [Lock Bundle] [Create Release] [Export Manifest]             |
+----------------------------------------------------------------------------------+
| Tabs: [Components] [Config Snapshots] [Changelog] [Risk Preview] [Evidence Inputs]|
|----------------------------------------------------------------------------------|
| Components (12)                                                                 |
| Service/Repo           Digest                Derived Ver   SBOM   CritR   Prov     |
| api-service            sha256:aaa...         2.1.0         OK       0    SLSA ✓   |
| web-frontend           sha256:bbb...         2.0.0         OK       0    SLSA ✓   |
| worker                 sha256:ccc...         3.1.0         STALE    1    SLSA ✓   |
| ...                                                                              |
| [Add Component] [Pin Digest] [Import from CI]                                     |
|----------------------------------------------------------------------------------|
| Config Snapshots (refs only — no secret values)                                  |
| Region/Env     Vault paths (count)   Consul prefixes (count)   Snapshot Hash     |
| US-East/Prod   12                    6                         sha256:cfg1...    |
| EU-West/Prod   11                    6                         sha256:cfg2...    |
| Notes: "Vault unreachable" would show as ERROR and block Lock/Release optionally |
| [Fetch Snapshots] [View Ref List] [Diff vs previous bundle]                       |
|----------------------------------------------------------------------------------|
| Changelog (per repo)                                                             |
| api-service: v2.0.8 → v2.1.0   (12 PRs)  [View]                                  |
| web-frontend: v1.9.1 → v2.0.0  (30 PRs)  [View]                                  |
|----------------------------------------------------------------------------------|
```

---

# Screen 6 — Approvals (queue)

**Formerly:** `Approvals`.
**Why changed:** Keep it, but make approvals explicitly tied to **promotion edges** and show the **risk + freshness + reachability** context right in the queue so reviewers don’t approve blind.

### Mermaid — Approvals navigation graph

```mermaid
flowchart TB
  APR["Approvals"] -->|open request| ADETAIL["Approval Detail"]
  APR -->|filter by region/env| APR
  ADETAIL -->|Approve/Reject| APR
  ADETAIL -. "Open release case file" .-> RDETAIL["Release Detail"]
  ADETAIL -. "Open findings" .-> FIND["Findings (filtered)"]
  ADETAIL -. "Open capsule preview" .-> CAPS["Decision Capsule"]
```

### ASCII wireframe — Approvals

```text
+----------------------------------------------------------------------------------+
| Approvals (formerly: Approvals)   Filters: Region▼ Env▼ Status▼ Risk▼ Search... |
+----------------------------------------------------------------------------------+
| Request                          Edge            Gate     Approvals  CritR  SBOM |
|----------------------------------------------------------------------------------|
| API Gateway v2.1.0               US-East Stg→Prod PASS     1/2        0     OK   |
| User Service v3.0.0-rc1          EU-West Stg→Prod BLOCK    0/2        2     OK   |
| Notes: BLOCK reasons show inline: (Policy fail / CritR / data stale / missing Cov)|
|----------------------------------------------------------------------------------|
| Actions per row: [Approve] [Reject] [View Detail]                                 |
+----------------------------------------------------------------------------------+
```

---

# Screen 7 — Approval Detail (gate breakdown + evidence preview)

**Formerly:** “View Details” from `Approvals` (implied) + bits from `Findings` and `Export/Replay`.
**Why changed:** The approver needs a single page that explains **why** an edge is blocked/passing, with **hybrid reachability** and **data freshness** spelled out, plus a preview of the evidence capsule that will be sealed.

### Mermaid — Approval Detail graph

```mermaid
flowchart TB
  ADETAIL["Approval Detail"] -->|Approve| ACT1["Approve action"]
  ADETAIL -->|Reject| ACT2["Reject action"]
  ADETAIL --> RDETAIL["Release Detail"]
  ADETAIL --> FIND["Findings (edge-filtered)"]
  ADETAIL --> CAPS["Decision Capsule Preview"]
```

### ASCII wireframe — Approval Detail

```text
+----------------------------------------------------------------------------------+
| Approval Detail  (formerly: Approvals → View Details)                             |
| Release: User Service v3.0.0-rc1  Edge: EU-West Staging → Production              |
|----------------------------------------------------------------------------------|
| Gate Summary: BLOCK                                                              |
| - Policy: PASS                                                                   |
| - Risk: CritR 2  (Hybrid reachability)                                            |
| - SBOM: OK (fresh)                                                               |
| - Reachability Coverage: 3/3 (Build+Image+Runtime)                                |
| - Data Freshness: OK (Feeds synced 2h ago)                                       |
|----------------------------------------------------------------------------------|
| Risk Drivers (CritR):                                                            |
| - CVE-XXXX in package foo@1.2.3  Reachable via path: foo->bar->...                |
| - CVE-YYYY in package baz@4.5.6  Reachable via runtime trace                      |
| [Open Findings (filtered)]                                                       |
|----------------------------------------------------------------------------------|
| Evidence Preview:                                                                |
| Capsule will include: policy inputs, SBOM refs, reachability sources, decision log|
| DSSE: pending seal   Rekor: pending   Replay: enabled                             |
| [View Capsule Draft] [Approve] [Reject]                                          |
+----------------------------------------------------------------------------------+
```

---

# Screen 8 — Regions & Environments (promotion graph + env tiles)

**Formerly:** pipeline widget on `Control Plane` (flat, not region-first).
**Why changed:** You explicitly need **Region → Environments** as a first-class topology, and each env must summarize not only “deploy health” but also **SBOM + CritR + Cov**.

### Mermaid — Regions & Environments graph

```mermaid
flowchart TB
  REG["Regions & Environments"] -->|select env node| EDETAIL["Environment Detail"]
  REG -->|select edge| EDGE["Edge Inspector (gates, approvals, evidence)"]
  REG -. "View findings for env" .-> FIND["Findings (env-filtered)"]
  REG -. "View deployments for env" .-> DEP["Deployments (env-filtered)"]
```

### ASCII wireframe — Regions & Environments

```text
+----------------------------------------------------------------------------------+
| Regions & Environments (formerly: Control Plane pipeline)  Region: US-East▼      |
| [Edit Graph] (role-gated)                                                         |
+----------------------------------------------------------------------------------+
| Promotion Graph (US-East)                                                         |
|  Dev [OK|SBOM OK|CritR 0|Cov 3/3]  -->  Staging [OK|OK|0|3/3]  -->  Prod [DEG|STALE|4|2/3] |
|                                                                                   |
| Right Inspector (selected: Prod node)                                             |
| - Deploy health: DEGRADED (1 target failing)                                      |
| - SBOM: STALE (last scan 18h)                                                     |
| - CritR: 4 (hybrid)                                                               |
| - Coverage: Build ✓  Image ✓  Runtime ✗                                          |
| - Feed freshness: NVD stale 18h (WARN/ERROR)                                      |
| Actions: [View Findings] [View Deployments] [View Config Snapshot]                |
+----------------------------------------------------------------------------------+
```

---

# Screen 9 — Environment Detail (region/env “single pane”)

**Formerly:** no dedicated page; fragments in `Control Plane`, `Platform Health`, `Findings`, and CI/CD/inventory.
**Why changed:** Operators need a **per region/env** summary showing *what’s deployed* and *what’s risky* with **SBOM status** and **reachability source coverage** — so it’s clear if risk posture is trustworthy.

### Mermaid — Environment Detail graph

```mermaid
flowchart TB
  EDETAIL["Environment Detail"] --> FIND["Findings (env-filtered)"]
  EDETAIL --> DEP["Deployments (env-filtered)"]
  EDETAIL --> CFG["Config Snapshot refs (env)"]
  EDETAIL -. "Nightly issues affecting this env" .-> NIGHT["Nightly Ops Report"]
```

### ASCII wireframe — Environment Detail

```text
+----------------------------------------------------------------------------------+
| Environment Detail  US-East / Production  (formerly: N/A)                         |
| Deploy: DEGRADED | SBOM: STALE | CritR: 4 | Cov: 2/3 | Feeds: NVD stale 18h       |
+----------------------------------------------------------------------------------+
| Deployed Workloads (by digest)                                                    |
| Service          Image Digest         Version   SBOM   CritR  Last Deploy         |
| api-service      sha256:aaa...        2.1.0     OK     0     08:12                |
| web-frontend     sha256:bbb...        2.0.0     OK     0     08:12                |
| worker           sha256:ccc...        3.1.0     STALE  1     08:12                |
|----------------------------------------------------------------------------------|
| Critical Reachable Findings (CritR 4)  [Open Findings]                            |
| - CVE-XXXX foo@1.2.3 reachable via ...                                           |
| - CVE-YYYY bar@4.5.6 reachable via runtime traces (missing today!)               |
|----------------------------------------------------------------------------------|
| Config Snapshot (refs only)                                                       |
| Vault refs: 12 paths | Consul refs: 6 prefixes | Snapshot hash: sha256:cfg1...    |
| [View refs] [Diff vs last snapshot]                                               |
|----------------------------------------------------------------------------------|
| Related: [Deployments] [Approvals] [Evidence]                                     |
+----------------------------------------------------------------------------------+
```

---

# Screen 10 — Deployments (promotion execution view)

**Formerly:** “Active Deployments” widget + implicit status in Releases list.
**Why changed:** Keep the operational view, but tie it to **release/bundle digests** and show **SBOM/risk context** so deployments aren’t treated as purely operational success/failure.

### Mermaid — Deployments graph

```mermaid
flowchart TB
  DEP["Deployments"] -->|select run| DDETAIL["Deployment Detail"]
  DEP -->|filter by release/env| DEP
  DDETAIL --> RDETAIL["Release Detail"]
  DDETAIL --> CAPS["Decision Capsule"]
```

### ASCII wireframe — Deployments

```text
+----------------------------------------------------------------------------------+
| Deployments (formerly: Active Deployments widget)                                 |
| Filters: Region▼ Env▼ Status▼ Release▼ Search...                                  |
+----------------------------------------------------------------------------------+
| Release        Region/Env       Status     Targets   SBOM   CritR  Evidence       |
|----------------------------------------------------------------------------------|
| Hotfix 1.2.4   US-East/Prod     RUNNING    1/1       STALE  4      Sealing...     |
| Platform 1.2.3 EU-West/Prod     COMPLETED  3/3       OK     0      Sealed ✓       |
|----------------------------------------------------------------------------------|
| Actions: [View Detail]                                                            |
+----------------------------------------------------------------------------------+
```

---

# Screen 11 — Deployment Detail (run + proof)

**Formerly:** not a dedicated PoC screen (implied behind deployment status).
**Why changed:** When something fails, you need traceability: what digest was applied, where, what verification occurred, and what evidence was produced.

### Mermaid — Deployment Detail graph

```mermaid
flowchart TB
  DDETAIL["Deployment Detail"] --> CAPS["Decision Capsule (final)"]
  DDETAIL --> EDETAIL["Environment Detail"]
  DDETAIL --> RDETAIL["Release Detail"]
```

### ASCII wireframe — Deployment Detail

```text
+----------------------------------------------------------------------------------+
| Deployment Detail (formerly: N/A)                                                  |
| Release: Hotfix 1.2.4  Edge: US-East Staging→Prod  Run: dep-0042                  |
| Status: RUNNING  Targets: 1/1  Started: 08:12  Actor: deploy-bot                  |
+----------------------------------------------------------------------------------+
| Steps / Timeline                                                                  |
| 1) Resolve artifact digests      ✓                                                |
| 2) Fetch config snapshot refs    ✓ (vault ok, consul ok)                          |
| 3) Apply to target(s)            ✓                                                |
| 4) Post-deploy verification      WARN (runtime reachability missing)              |
| 5) Seal evidence capsule         IN PROGRESS                                      |
|----------------------------------------------------------------------------------|
| Deployed Digests                                                                  |
| - api-service sha256:aaa...  - worker sha256:ccc...                               |
|----------------------------------------------------------------------------------|
| Evidence                                                                           |
| Capsule: DSSE pending | Rekor pending | Replay enabled                            |
| [View Capsule] [Replay/Verify] [Export]                                           |
+----------------------------------------------------------------------------------+
```

---

## Release Bundle Organizer — key design notes (so it matches your requirement)

What you asked for, explicitly, is now represented in **Bundles + Bundle Detail**:

* **“microservice with digest becomes version X”**

  * Bundle composer maintains a **Digest→Version mapping** per component (derived from git tag/build metadata or manually pinned).
* **“variables derived from vaults and consul for this env”**

  * Bundle stores **config snapshot references + hashes** per region/env; values are not shown, but the snapshot is reproducible and auditable.
* **“other microservices becomes bundle along with change log. per repository.”**

  * Bundle includes per-repo changelog (diff vs prior bundle baseline).
* **“release digest first”**

  * The bundle itself has a **bundle digest** (manifest hash). Promotions can be bound to that digest exactly like a single-image hotfix.

---