## Pack 3 — Security + Evidence & Audit + Operations

This pack adds the missing **SBOM/Finding signals**, **hybrid reachability (build/image/runtime)**, and a first-class **Nightly Ops Report**, while keeping the “release/hotfix + security + audit” spine. ([Stella Ops Suite][1])

---

# 0) Design rule for this pack (why these screens look the way they do)

When Stella Ops opens, the UI must communicate fast:

* **What is deployed where (by digest)**
* **What is allowed to ship next**
* **Why it is allowed/blocked (policy + reachability evidence)**
* **Where the evidence is (one-click proof/export)** ([Gitea: Git with a cup of tea][2])

Everything in this pack is arranged to serve that rule.

---

# 1) SECURITY — menus + screens

## 1.1 Security menu graph (Mermaid)

```mermaid
flowchart TD
  S0["Security (menu)"]
  S1["Security Overview (global)"]
  S2["Findings (SBOM + CVE)"]
  S3["Finding Detail"]
  S4["Hybrid Reachability (build/image/runtime)"]
  S5["Reachability Evidence Detail"]
  S6["VEX Hub"]
  S7["VEX Statement Detail"]
  S8["Exceptions"]
  S9["Exception Detail"]
  S10["SBOM Explorer (Graph)"]

  S0 --> S1
  S0 --> S2 --> S3 --> S5
  S0 --> S4 --> S5
  S0 --> S6 --> S7
  S0 --> S8 --> S9
  S0 --> S10
```

---

## 1.2 Screen — Security Overview (global)

**New location:** `Security → Security Overview`
**Previously:** `Security → Overview` (“Security Overview”)
**Why changed:**

* Your dashboard needs **emerged SBOM/finding signal** and “which env/region is burning” in one glance (not “0 across the board” unless truly 0).
* This overview becomes the **security posture rollup** across regions/environments with **reachability emphasis** (reachable CVEs are what matter for decisions).

### Screen graph (Mermaid)

```mermaid
flowchart LR
  A["Security Overview"] --> B["Findings (filtered)"]
  A --> C["Hybrid Reachability"]
  A --> D["VEX Hub"]
  A --> E["Exceptions"]
  A --> F["Evidence Capsule (latest)"]
  A --> G["Ops: Nightly Report (security pipelines)"]
```

### ASCII mock

```text
+--------------------------------------------------------------------------------------------------+
| Stella Ops                                                          [Search releases/digests…]  |
|--------------------------------------------------------------------------------------------------|
| NAV                     | Security / Overview                                                     |
|------------------------| formerly: Security → Overview (Security Overview)                         |
| Dashboard               |-------------------------------------------------------------------------|
| Release Control         | GLOBAL POSTURE (last refresh 2m)                                          |
| Security (YOU ARE)      |  Reachable CVEs:  CRIT [2]  HIGH [7]  MED [14]  LOW [33]                 |
| Evidence & Audit        |  Non-reachable CVEs (noise): 1,284                                        |
| Operations              |-------------------------------------------------------------------------|
| Integrations            | HOTSPOTS (Reachable CRIT/HIGH by env)                                    |
| Administration          |  prod/us-east-1   CRIT=2 HIGH=3   |  prod/eu-west-1   CRIT=0 HIGH=4       |
|                         |  staging/us-east-1 CRIT=0 HIGH=1   |  dev/*           CRIT=0 HIGH=0       |
|                         |-------------------------------------------------------------------------|
|                         | HYBRID REACHABILITY COVERAGE (must not be “third class”)                 |
|                         |  Build: 92%  |  Image (Dover): 100%  |  Runtime: 63%                     |
|                         |  Gaps: prod/eu-west-1 runtime ingest delayed (last 6h)                   |
|                         |-------------------------------------------------------------------------|
|                         | Quick actions: [View Findings] [Reachability] [VEX Hub] [Exceptions]     |
+--------------------------------------------------------------------------------------------------+
```

---

## 1.3 Screen — Findings (SBOM + CVE unified)

**New location:** `Security → Findings`
**Previously:**

* `Security → Findings` (“Security Findings”)
* `Security → Vulnerabilities` (“Vulnerabilities”)
  **Why changed:**
* **One list** with consistent semantics: “CVE + package + reachability + environments + releases/bundles impacted”.
* The old “Vulnerabilities” page becomes a **redirect** to this screen with preset filters (e.g., `View=CVE Catalog`).

### Screen graph (Mermaid)

```mermaid
flowchart TD
  L["Findings (SBOM + CVE)"] --> F["Finding Detail"]
  L --> X["Export CSV"]
  L --> V["VEX Hub (context)"]
  L --> E["Create Exception (pre-filled)"]
  L --> R["Reachability view (hybrid columns)"]
```

### ASCII mock

```text
+--------------------------------------------------------------------------------------------------+
| Security / Findings                                                     [Export CSV] [Saved Views]|
| formerly: Security → Findings (Security Findings) + Security → Vulnerabilities (Vulnerabilities) |
|--------------------------------------------------------------------------------------------------|
| Filters: Severity [All]  Reachability [Any/Reachable]  Source [Build/Image/Runtime/Any]          |
|         Region [All]     Environment [All]            VEX [Any/Has VEX/Needs VEX]                |
|--------------------------------------------------------------------------------------------------|
| CVE        PACKAGE         SEV  CVSS  REACHABILITY (B/I/R)  VEX   RELEASE/BUNDLE   ENVS          |
| CVE-...    openssl         CRIT 9.8   ✅ / ✅ / ✅           —     hotfix-auth 1.2.4 prod/us-east-1|
| CVE-...    log4j           HIGH 8.1   ✅ / ✅ / ☐            vendor platform 1.3.0   prod/eu-west-1|
| CVE-...    zlib            MED  6.5   ☐ / ✅ / ☐             local payments 2.8.4    staging/us-e1|
|--------------------------------------------------------------------------------------------------|
| Notes: Reachability columns are hybrid: Build analysis, Image (Dover), Runtime (deployed).       |
+--------------------------------------------------------------------------------------------------+
```

---

## 1.4 Screen — Finding Detail (evidence-first)

**New location:** `Security → Findings → (Finding Detail)`
**Previously:** fragmented across Findings + (future) SBOM Graph + VEX Hub
**Why changed:**

* A decision is only as good as its proof: this page centers **reachability evidence**, **affected environments**, **VEX**, and **the promotion impact** (blocked vs allowed) with links to **Decision Capsule**.

### Screen graph (Mermaid)

```mermaid
flowchart LR
  D["Finding Detail"] --> R["Reachability Evidence (hybrid)"]
  D --> V["VEX Statements"]
  D --> P["Promotion Impact (gates + approvals)"]
  D --> X["Request Exception"]
  D --> E["Evidence Capsule (view/download)"]
  D --> A["Remediation actions (upgrade/patch)"]
```

### ASCII mock

```text
+--------------------------------------------------------------------------------------------------+
| Finding: CVE-2026-XXXX (openssl)                                         [Request Exception]     |
| formerly: (spread across) Security Findings + VEX Hub + (SBOM Graph placeholder)                 |
|--------------------------------------------------------------------------------------------------|
| Summary: CRITICAL  CVSS 9.8   Package: openssl@3.0.x                                              |
| Affected artifacts (digests): sha256:aaaa… sha256:bbbb…                                           |
|--------------------------------------------------------------------------------------------------|
| Reachability (hybrid)                                                                            |
|  Build: ✅ reachable (call path: api-gateway -> tls -> openssl)                                   |
|  Image (Dover): ✅ reachable (static analysis)                                                    |
|  Runtime: ✅ reachable (trace evidence: prod/us-east-1)                                           |
|  [View Reachability Evidence]                                                                    |
|--------------------------------------------------------------------------------------------------|
| Environments impacted                                                                            |
|  prod/us-east-1 (2 services)   prod/eu-west-1 (1 service)                                        |
|--------------------------------------------------------------------------------------------------|
| VEX                                                                                              |
|  Vendor VEX: none  | Local VEX: draft                                                            |
|  [Open VEX Hub pre-filtered]                                                                     |
|--------------------------------------------------------------------------------------------------|
| Promotion impact                                                                                 |
|  Gate: "No reachable CRIT" ❌ BLOCKS  |  Required: patch or approved exception with expiry        |
|  Evidence capsule: sealed? ✅   [Open Capsule] [Export]                                          |
+--------------------------------------------------------------------------------------------------+
```

---

## 1.5 Screen — Hybrid Reachability (coverage + gaps)

**New location:** `Security → Hybrid Reachability`
**Previously:** *not visible as a coherent surface*
**Why changed:**

* You explicitly require reachability from **Build**, **Image (Dover)**, and **Runtime** to be **second-class (visible)**, not buried.
* This page answers: “Do we trust our reachability picture for each env/region right now?”

### Screen graph (Mermaid)

```mermaid
flowchart TD
  H["Hybrid Reachability (Coverage)"] --> M["Coverage Matrix (region/env x source)"]
  H --> G["Gap Drilldown (why missing runtime?)"]
  H --> F["Findings filtered by 'reachability missing'"]
  H --> O["Ops: ingestion pipeline health"]
```

### ASCII mock

```text
+--------------------------------------------------------------------------------------------------+
| Security / Hybrid Reachability                                             [Export] [Explain]   |
| formerly: (missing / implicit)                                                                  |
|--------------------------------------------------------------------------------------------------|
| Coverage Matrix (last 24h)                                                                       |
| Region/Env          BUILD        IMAGE (DOVER)      RUNTIME        NOTES                         |
| prod/us-east-1      98% ✅        100% ✅           72% ⚠           runtime ingest lag 2h         |
| prod/eu-west-1      93% ✅        100% ✅           41% ❌           agent offline                |
| staging/us-east-1   90% ✅        100% ✅           60% ⚠           sampling low                 |
| dev/us-east-1       80% ⚠         95% ⚠            10% ⚠           instrumentation off          |
|--------------------------------------------------------------------------------------------------|
| Gap drilldown (selected: prod/eu-west-1 runtime)                                                  |
|  - Missing agent heartbeat (Integrations: Agents)                                                 |
|  - Last success: Feb 17 02:10                                                                     |
|  Links: [Ops Platform Health] [Scheduler Run] [Agent Config]                                      |
+--------------------------------------------------------------------------------------------------+
```

---

## 1.6 Screen — Reachability Evidence Detail

**New location:** via `Finding Detail` or `Hybrid Reachability` drilldowns
**Previously:** not present
**Why changed:**

* Reachability must be inspectable and exportable as evidence; otherwise it’s a black box.

### Screen graph (Mermaid)

```mermaid
flowchart LR
  E["Reachability Evidence Detail"] --> C["Call graph / trace proof"]
  E --> S["Source selector: Build vs Image vs Runtime"]
  E --> V["Link to VEX statement"]
  E --> P["Link to Policy decision + capsule"]
```

### ASCII mock

```text
+--------------------------------------------------------------------------------------------------+
| Reachability Evidence: CVE-2026-XXXX in prod/us-east-1                         [Download Proof]  |
| formerly: (missing / implicit)                                                                  |
|--------------------------------------------------------------------------------------------------|
| Source: [Build ✅] [Image (Dover) ✅] [Runtime ✅]                                                |
|--------------------------------------------------------------------------------------------------|
| Proof summary                                                                                     |
|  Entry point: api-gateway                                                                         |
|  Path: api-gateway -> tls_handler -> openssl::SSL_read -> vulnerable_fn                           |
|  Confidence: High                                                                                |
|--------------------------------------------------------------------------------------------------|
| Linked artifacts                                                                                  |
|  SBOM: sbom@sha256:...   Trace: runtime-trace@sha256:...  Policy: core-pack v12                   |
|  Capsule: capsule-prod-us-east-1-2026-02-18                                                       |
+--------------------------------------------------------------------------------------------------+
```

---

## 1.7 Screen — VEX Hub

**New location:** `Security → VEX Hub`
**Previously:** `Security → VEX Hub` (“VEX Statement Dashboard”)
**Why changed:**

* Keep it in Security, but make it clearly part of the “evidence chain”: VEX must link to findings and reachability proof (not just a statement list). ([Gitea: Git with a cup of tea][3])

### Screen graph (Mermaid)

```mermaid
flowchart TD
  V["VEX Hub"] --> S["Search Statements"]
  V --> I["Import Vendor VEX"]
  V --> D["VEX Statement Detail"]
  D --> F["Linked Findings"]
  D --> E["Evidence Capsule / Proof chain"]
```

### ASCII mock

```text
+--------------------------------------------------------------------------------------------------+
| Security / VEX Hub                                                    [Search] [Import Vendor]  |
| formerly: Security → VEX Hub                                                                    |
|--------------------------------------------------------------------------------------------------|
| Search: [CVE____] [Package____] [Product____] [Issuer____] [Env____]                             |
|--------------------------------------------------------------------------------------------------|
| STATEMENT ID    CVE           PRODUCT/BUNDLE        ISSUER     STATUS     LINKED FINDINGS        |
| vex-1021        CVE-...       platform 1.3.0        vendorA    Verified   3 (2 reachable)        |
| vex-1022        CVE-...       payments 2.8.4        local      Draft      1 (reachability pending)|
|--------------------------------------------------------------------------------------------------|
| Note: Statements should reference reachability proof & capsule for audit replay.                 |
+--------------------------------------------------------------------------------------------------+
```

---

## 1.8 Screen — VEX Statement Detail

**New location:** `Security → VEX Hub → (Statement)`
**Previously:** not clearly separated
**Why changed:**

* Needed for auditors: statement, issuer, scope, and the linked evidence objects.

### Screen graph (Mermaid)

```mermaid
flowchart LR
  D["VEX Statement Detail"] --> L["Linked findings + reachability"]
  D --> P["Proof chain"]
  D --> X["Export VEX + evidence refs"]
```

### ASCII mock

```text
+--------------------------------------------------------------------------------------------------+
| VEX Statement: vex-1021 (vendorA)                                          [Export] [Verify]    |
| formerly: Security → VEX Hub (inline row)                                                        |
|--------------------------------------------------------------------------------------------------|
| CVE: CVE-2026-XXXX   Disposition: Not Affected   Justification: component not used at runtime    |
| Scope: platform-release 1.3.0-rc1   Envs: prod/*                                                 |
|--------------------------------------------------------------------------------------------------|
| Linked evidence                                                                                   |
|  - Reachability proof: runtime shows NOT reachable in prod/eu-west-1 (trace id …)                 |
|  - Capsule: capsule-prod-eu-west-1-…                                                              |
|--------------------------------------------------------------------------------------------------|
| Linked findings                                                                                   |
|  Finding list: 3  (reachable: 0)                                                                  |
+--------------------------------------------------------------------------------------------------+
```

---

## 1.9 Screen — Exceptions (risk exceptions)

**New location:** `Security → Exceptions`
**Previously:** `Security → Exceptions` (“Security Exceptions”)
**Why changed:**

* Exceptions must show **scope + expiry + approvers + linked evidence**, and tie to policy workflow configured in Administration.

### Screen graph (Mermaid)

```mermaid
flowchart TD
  X["Exceptions"] --> D["Exception Detail"]
  X --> R["Request Exception"]
  D --> A["Approval trail"]
  D --> F["Linked Findings / Bundles"]
  D --> E["Evidence capsule references"]
```

### ASCII mock

```text
+--------------------------------------------------------------------------------------------------+
| Security / Exceptions                                                   [Request Exception]      |
| formerly: Security → Exceptions                                                                  |
|--------------------------------------------------------------------------------------------------|
| EXC ID     SCOPE                 REASON               REQUESTED BY   EXPIRES     STATUS          |
| exc-221    CVE-… in prod/us-e1    hotfix window        alice          2026-03-01  Pending         |
| exc-222    bundle payments 2.8.4  vendor patch delayed david          2026-02-25  Approved        |
|--------------------------------------------------------------------------------------------------|
| Notes: every exception must be time-bounded and linked to evidence & approver signatures.        |
+--------------------------------------------------------------------------------------------------+
```

---

## 1.10 Screen — Exception Detail

**New location:** `Security → Exceptions → (Exception)`
**Previously:** not clearly separated
**Why changed:**

* Needed for audit and for “why allowed even though finding exists”.

### Screen graph (Mermaid)

```mermaid
flowchart LR
  D["Exception Detail"] --> S["Scope + expiry"]
  D --> J["Justification + attachments"]
  D --> A["Approvals/signatures"]
  D --> L["Linked findings + affected envs"]
  D --> C["Capsules impacted (promotion events)"]
```

### ASCII mock

```text
+--------------------------------------------------------------------------------------------------+
| Exception: exc-222 (Approved)                                             [Revoke] [Extend]     |
| formerly: Security → Exceptions (row)                                                        |
|--------------------------------------------------------------------------------------------------|
| Scope: Bundle payments-suite 2.8.4   Env: prod/eu-west-1                                         |
| Expires: 2026-02-25 23:59 UTC        Risk: HIGH reachable allowed with 2 approvals                |
|--------------------------------------------------------------------------------------------------|
| Justification: vendor patch ETA + compensating controls                                           |
| Approvals: ✅ alice (sig…)   ✅ security-lead (sig…)                                               |
|--------------------------------------------------------------------------------------------------|
| Linked findings:                                                                                |
|  - CVE-… log4j (HIGH reachable)                                                                  |
| Capsules impacted:                                                                              |
|  - capsule-prod-eu-west-1-2026-02-18 (promotion allowed due to exc-222)                          |
+--------------------------------------------------------------------------------------------------+
```

---

## 1.11 Screen — SBOM Explorer (Graph)

**New location:** `Security → SBOM Explorer (Graph)`
**Previously:** `Security → SBOM Graph` (“SBOM Graph”)
**Why changed:**

* Keep it visible but explicitly “supporting detail”: useful to investigate dependency trees, but not the main control-plane.
* If still not implemented, show it as **(coming soon)** with deep links to Findings and Coverage metrics.

### Screen graph (Mermaid)

```mermaid
flowchart TD
  G["SBOM Explorer (Graph)"] --> N["Node detail (package/component)"]
  N --> F["Findings for node"]
  N --> R["Reachability evidence"]
  G --> C["Coverage metrics"]
```

### ASCII mock

```text
+--------------------------------------------------------------------------------------------------+
| Security / SBOM Explorer (Graph)                                         [Beta] [Open Findings] |
| formerly: Security → SBOM Graph                                                                  |
|--------------------------------------------------------------------------------------------------|
| If graph rendering is not available in this build:                                                |
|  - Show “Graph unavailable” + shortcuts: [Findings filtered by component] [Coverage Metrics]     |
|--------------------------------------------------------------------------------------------------|
| Graph area (when enabled):                                                                       |
|  [service: api-gateway] --depends--> [openssl] --depends--> [zlib]                                |
|  click node → right panel: packages, versions, linked CVEs, reachability paths                   |
+--------------------------------------------------------------------------------------------------+
```

---

# 2) EVIDENCE & AUDIT — menus + screens

## 2.1 Evidence & Audit menu graph (Mermaid)

```mermaid
flowchart TD
  E0["Evidence & Audit (menu)"]
  E1["Evidence Home (latest capsules)"]
  E2["Decision Capsules (Bundles list)"]
  E3["Decision Capsule Detail"]
  E4["Evidence Packets"]
  E5["Packet Detail"]
  E6["Proof Chains"]
  E7["Proof Chain Detail"]
  E8["Replay / Verify"]
  E9["Replay Result Detail"]
  E10["Export Center"]
  E11["Export Run Detail"]
  E12["Coverage Metrics (Attestation coverage)"]

  E0 --> E1
  E0 --> E2 --> E3
  E0 --> E4 --> E5
  E0 --> E6 --> E7
  E0 --> E8 --> E9
  E0 --> E10 --> E11
  E0 --> E12
```

---

## 2.2 Screen — Evidence Home (quick proof access)

**New location:** `Evidence & Audit → Home`
**Previously:** no single landing (Evidence items were separate)
**Why changed:**

* “Where is the evidence?” must be one click. This home page lists latest capsules and quick exports. ([Gitea: Git with a cup of tea][2])

### Screen graph (Mermaid)

```mermaid
flowchart LR
  H["Evidence Home"] --> C["Decision Capsules"]
  H --> P["Evidence Packets"]
  H --> R["Replay / Verify"]
  H --> X["Export Center"]
  H --> M["Coverage Metrics"]
```

### ASCII mock

```text
+--------------------------------------------------------------------------------------------------+
| Evidence & Audit / Home                                                  [Export] [Verify Tool] |
| formerly: (no single landing)                                                                  |
|--------------------------------------------------------------------------------------------------|
| Latest Decision Capsules (sealed)                                                                |
|  capsule-prod-us-east-1-2026-02-18   bundle: hotfix-auth 1.2.4   verdict: PASS* (exc applied)    |
|  capsule-prod-eu-west-1-2026-02-18   bundle: platform 1.3.0-rc1   verdict: BLOCK (reachable CRIT)|
|  [View all capsules]                                                                             |
|--------------------------------------------------------------------------------------------------|
| Quick proof actions                                                                              |
|  [Replay a verdict]  [Verify signatures]  [Export Audit Bundle]  [Open Proof Chains]             |
|--------------------------------------------------------------------------------------------------|
| Coverage snapshot                                                                                |
|  SBOM: 100%  Reachability proofs: 78%  VEX: 41%  Approvals recorded: 100%                         |
+--------------------------------------------------------------------------------------------------+
```

---

## 2.3 Screen — Decision Capsules (Evidence Bundles list)

**New location:** `Evidence & Audit → Decision Capsules`
**Previously:** `Evidence → Evidence Bundles` (“Evidence Bundles”)
**Why changed:**

* Rename to match the concept used in docs/marketing: a “decision capsule” binds SBOM + frozen inputs + reachability + policy + signatures so audits can replay deterministically. ([Stella Ops Suite][4])

### Screen graph (Mermaid)

```mermaid
flowchart TD
  L["Decision Capsules (list)"] --> D["Capsule Detail"]
  L --> V["Verify bundle signatures"]
  L --> X["Export (zip/tgz/oci)"]
  D --> R["Replay / Verify"]
  D --> P["Proof chain"]
```

### ASCII mock

```text
+--------------------------------------------------------------------------------------------------+
| Evidence & Audit / Decision Capsules                                      [Verify] [Export]      |
| formerly: Evidence → Evidence Bundles                                                             |
|--------------------------------------------------------------------------------------------------|
| Filters: Region [All] Env [All] Bundle/Release [____] Date [last 30d] Status [All]               |
|--------------------------------------------------------------------------------------------------|
| CAPSULE ID                    BUNDLE/RELEASE      ENV             VERDICT   SEALED  ACTIONS      |
| capsule-prod-us-e1-...        hotfix-auth 1.2.4   prod/us-east-1   PASS      ✅      View Export  |
| capsule-prod-eu-w1-...        platform 1.3.0-rc1  prod/eu-west-1   BLOCK     ✅      View Replay  |
|--------------------------------------------------------------------------------------------------|
| Each capsule must be exportable and replayable for audit.                                         |
+--------------------------------------------------------------------------------------------------+
```

---

## 2.4 Screen — Decision Capsule Detail

**New location:** `Evidence & Audit → Decision Capsules → (Capsule)`
**Previously:** partially in export flows
**Why changed:**

* This is the “auditor view”: list exact inputs (SBOM + feed snapshot + policy version), outputs (verdict), and signatures. ([Stella Ops Suite][4])

### Screen graph (Mermaid)

```mermaid
flowchart LR
  D["Capsule Detail"] --> I["Inputs (SBOM, feeds, policy, tools)"]
  D --> O["Outputs (verdict, risk, VEX)"]
  D --> S["Signatures (DSSE) + transparency refs"]
  D --> P["Proof chain graph"]
  D --> R["Replay this capsule"]
  D --> X["Export formats"]
```

### ASCII mock

```text
+--------------------------------------------------------------------------------------------------+
| Capsule: capsule-prod-us-east-1-2026-02-18                       [Replay] [Export] [Verify Sig] |
| formerly: Evidence → Evidence Bundles (detail)                                                    |
|--------------------------------------------------------------------------------------------------|
| Inputs                                                                                            |
|  SBOM: sbom@sha256:...     Feed snapshots: osv@... nvd@...     Policy: core-pack v12              |
|  Tools: scanner@sha256:... Reachability: runtime-proof@sha256:...                                 |
|--------------------------------------------------------------------------------------------------|
| Outputs                                                                                           |
|  Verdict: PASS (exception exc-222)   Reachable CVEs: 1 HIGH    VEX: derived/linked                |
|--------------------------------------------------------------------------------------------------|
| Signatures                                                                                        |
|  DSSE envelope: ✅  Rekor/log ref: ✅  Certificate chain: ✅                                      |
|--------------------------------------------------------------------------------------------------|
| Links: [Proof Chain] [Related Approvals] [Related Bundle Version]                                 |
+--------------------------------------------------------------------------------------------------+
```

---

## 2.5 Screen — Evidence Packets (formerly “Packets”)

**New location:** `Evidence & Audit → Evidence Packets`
**Previously:** `Evidence → Packets` (“Packets”)
**Why changed:**

* “Packets” is ambiguous; “Evidence Packets” communicates that these are artifact bundles used by capsules/exports/replay.

### Screen graph (Mermaid)

```mermaid
flowchart TD
  P["Evidence Packets"] --> D["Packet Detail"]
  P --> C["Create/collect packet (job output)"]
  D --> X["Export packet"]
  D --> L["Link to capsules using it"]
```

### ASCII mock

```text
+--------------------------------------------------------------------------------------------------+
| Evidence & Audit / Evidence Packets                                      [Create] [Export]       |
| formerly: Evidence → Packets                                                                      |
|--------------------------------------------------------------------------------------------------|
| PACKET ID          TYPE            SOURCE JOB             CREATED        USED BY CAPSULES        |
| pkt-7712           build-sbom       jenkins#7712           Feb 18         2                         |
| pkt-opsv-sync      advisory-snap    mirror-sync            Feb 18         5                         |
| pkt-runtime-trace  runtime-proof    agent/prod-us-e1       Feb 18         1                         |
+--------------------------------------------------------------------------------------------------+
```

---

## 2.6 Screen — Packet Detail

**New location:** `Evidence Packets → (Packet)`
**Previously:** not explicit
**Why changed:**

* Lets operators/auditors see exactly what artifacts are inside and where they were consumed.

### Screen graph (Mermaid)

```mermaid
flowchart LR
  D["Packet Detail"] --> A["Artifacts list (SBOM, traces, logs, attestations)"]
  D --> M["Manifest + hashes"]
  D --> U["Used-by capsules"]
  D --> X["Export"]
```

### ASCII mock

```text
+--------------------------------------------------------------------------------------------------+
| Evidence Packet: pkt-7712 (build-sbom)                                    [Export] [Verify Hash] |
| formerly: Evidence → Packets (row)                                                                |
|--------------------------------------------------------------------------------------------------|
| Manifest                                                                                          |
|  - sbom.cdx.json (sha256:...)                                                                     |
|  - findings.sarif (sha256:...)                                                                    |
|  - build-provenance.json (sha256:...)                                                             |
|--------------------------------------------------------------------------------------------------|
| Used by capsules                                                                                  |
|  - capsule-prod-us-east-1-2026-02-18                                                              |
|  - capsule-staging-us-east-1-2026-02-18                                                           |
+--------------------------------------------------------------------------------------------------+
```

---

## 2.7 Screen — Proof Chains

**New location:** `Evidence & Audit → Proof Chains`
**Previously:** `Evidence → Proof Chains`
**Why changed:**

* Proof chain view is a top “audit navigation” path: show chain-of-custody from bundle → scan → reachability → policy → approval → capsule.

### Screen graph (Mermaid)

```mermaid
flowchart TD
  P["Proof Chains"] --> D["Proof Chain Detail"]
  D --> C["Capsules"]
  D --> A["Approvals"]
  D --> R["Replay entries"]
```

### ASCII mock

```text
+--------------------------------------------------------------------------------------------------+
| Evidence & Audit / Proof Chains                                          [Search] [Export Graph] |
| formerly: Evidence → Proof Chains                                                                 |
|--------------------------------------------------------------------------------------------------|
| CHAIN ID         SUBJECT (digest/bundle)            LAST EVENT        CAPSULES  STATUS            |
| chain-901        bundle platform 1.3.0-rc1          promotion blocked  1        ⚠ blocked         |
| chain-902        digest sha256:aaaa… (hotfix-auth)  promoted to prod    1        ✅ complete       |
+--------------------------------------------------------------------------------------------------+
```

---

## 2.8 Screen — Proof Chain Detail

**New location:** `Proof Chains → (Chain)`
**Previously:** not clear
**Why changed:**

* Auditors want a single timeline/graph; engineers want quick links back to the cause (finding, missing feed, exception).

### Screen graph (Mermaid)

```mermaid
flowchart LR
  D["Proof Chain Detail"] --> G["Chain graph (events)"]
  D --> T["Timeline"]
  D --> L["Linked objects (findings, vex, exceptions, capsules)"]
```

### ASCII mock

```text
+--------------------------------------------------------------------------------------------------+
| Proof Chain: chain-902 (hotfix-auth 1.2.4)                             [Export] [Replay Capsule] |
| formerly: Evidence → Proof Chains (row)                                                           |
|--------------------------------------------------------------------------------------------------|
| Graph (simplified)                                                                               |
|  Digest sha256:aaaa… → SBOM pkt-7712 → Findings → Reachability proof → Policy gates → Approvals → |
|  Capsule sealed → Promotion executed                                                              |
|--------------------------------------------------------------------------------------------------|
| Timeline                                                                                          |
|  07:10 SBOM created  | 07:12 findings evaluated | 07:20 approval signed | 07:30 promoted          |
+--------------------------------------------------------------------------------------------------+
```

---

## 2.9 Screen — Replay / Verify

**New location:** `Evidence & Audit → Replay / Verify`
**Previously:** `Evidence → Replay/Verify` (“Verdict Replay”)
**Why changed:**

* Deterministic replay is a core audit tool; keep it under Evidence and give it a clear “replay inputs, compare diffs” workflow. ([Gitea: Git with a cup of tea][5])

### Screen graph (Mermaid)

```mermaid
flowchart TD
  R["Replay / Verify"] --> Q["Request Replay"]
  R --> L["Replay Requests list"]
  L --> D["Replay Result Detail"]
  D --> C["Compare outputs (feeds/policy/tool versions)"]
```

### ASCII mock

```text
+--------------------------------------------------------------------------------------------------+
| Evidence & Audit / Replay / Verify                                       [Request Replay]        |
| formerly: Evidence → Replay/Verify (Verdict Replay)                                              |
|--------------------------------------------------------------------------------------------------|
| Request Replay: [Verdict ID or Digest ____]   Reason [____________________]   [Run]             |
|--------------------------------------------------------------------------------------------------|
| Requests                                                                                          |
|  rr-001  digest sha256:aaaa…  COMPLETED  Feb 18 08:30  match: ✅                                  |
|  rr-002  digest sha256:bbbb…  RUNNING    Feb 18 07:30                                            |
|--------------------------------------------------------------------------------------------------|
| Determinism: compares outputs to original capsule inputs; highlights feed/policy/tool diffs.     |
+--------------------------------------------------------------------------------------------------+
```

---

## 2.10 Screen — Replay Result Detail

**New location:** `Replay/Verify → (Replay Result)`
**Previously:** not explicit
**Why changed:**

* Needed to explain mismatches (policy pack changed, feed snapshot updated, tool version drift).

### Screen graph (Mermaid)

```mermaid
flowchart LR
  D["Replay Result Detail"] --> M["Match summary"]
  D --> DI["Diff view (inputs/outputs)"]
  D --> X["Re-seal capsule (optional)"]
```

### ASCII mock

```text
+--------------------------------------------------------------------------------------------------+
| Replay Result: rr-001 (MATCH ✅)                                          [Download Diff]        |
| formerly: Evidence → Replay/Verify (inline)                                                       |
|--------------------------------------------------------------------------------------------------|
| Compared to capsule: capsule-prod-us-east-1-2026-02-18                                            |
| Inputs: SBOM ✅ same   Feeds ✅ same snapshot   Policy ✅ same   Tools ✅ same                     |
| Outputs: Findings ✅ same  Reachability ✅ same  VEX ✅ same  Verdict ✅ same                      |
+--------------------------------------------------------------------------------------------------+
```

---

## 2.11 Screen — Export Center

**New location:** `Evidence & Audit → Export Center`
**Previously:** `Evidence → Export` (“Export Center”)
**Why changed:**

* Keep it evidence-centered; export is how auditors receive proof (zip/tgz/OCI).

### Screen graph (Mermaid)

```mermaid
flowchart TD
  X["Export Center"] --> P["Profiles"]
  X --> R["Export Runs"]
  P --> E["Edit Profile"]
  R --> D["Export Run Detail"]
```

### ASCII mock

```text
+--------------------------------------------------------------------------------------------------+
| Evidence & Audit / Export Center                                          [Create Profile]       |
| formerly: Evidence → Export (Export Center)                                                       |
|--------------------------------------------------------------------------------------------------|
| Profiles                                                                                          |
|  - StellaBundle (OCI referrer)  includes: SBOM, findings, attestations, provenance, VEX, policy   |
|  - Daily Compliance Export     schedule: daily → S3 compliance-bucket                             |
|  - Audit Bundle               manual zip for external auditors                                    |
|--------------------------------------------------------------------------------------------------|
| Tabs: [Profiles] [Export Runs]                                                                    |
+--------------------------------------------------------------------------------------------------+
```

---

## 2.12 Screen — Export Run Detail

**New location:** `Export Center → Export Runs → (Run)`
**Previously:** not explicit
**Why changed:**

* Make exports verifiable: show hash, signature status, destinations, and linked capsules.

### Screen graph (Mermaid)

```mermaid
flowchart LR
  D["Export Run Detail"] --> A["Artifacts produced"]
  D --> S["Signatures + verification"]
  D --> DST["Destinations + delivery logs"]
```

### ASCII mock

```text
+--------------------------------------------------------------------------------------------------+
| Export Run: exp-8812 (SUCCESS ✅)                                        [Download] [Verify]     |
| formerly: Evidence → Export (run row)                                                            |
|--------------------------------------------------------------------------------------------------|
| Profile: Audit Bundle   Output: audit-bundle-2026-02-18.zip   sha256:...   DSSE: ✅               |
| Contents: 14 capsules, 32 packets, proof graphs, policy pack v12, feed snapshots                 |
| Destinations: S3://compliance-bucket (ok)                                                         |
+--------------------------------------------------------------------------------------------------+
```

---

## 2.13 Screen — Coverage Metrics (Attestation coverage)

**New location:** `Evidence & Audit → Coverage Metrics`
**Previously:** `Analytics → SBOM Lake` (“SBOM Lake”)
**Why changed:**

* This is not “analytics for analytics sake”; it’s **audit readiness coverage** (SBOM, reachability, VEX, policy decision, approvals).
* Renaming aligns it with operational meaning.

### Screen graph (Mermaid)

```mermaid
flowchart TD
  C["Coverage Metrics"] --> F["Filters (region/env/time/severity)"]
  C --> T["Coverage by attestation type"]
  C --> G["Gaps list (what's missing where)"]
  G --> L["Deep links: jobs/integrations causing gaps"]
```

### ASCII mock

```text
+--------------------------------------------------------------------------------------------------+
| Evidence & Audit / Coverage Metrics                                      [Export CSV] [Refresh]  |
| formerly: Analytics → SBOM Lake                                                                 |
|--------------------------------------------------------------------------------------------------|
| Filters: Region [All] Env [All] Time [30d] Min Severity [All]                                     |
|--------------------------------------------------------------------------------------------------|
| Coverage by attestation type                                                                      |
|  SBOM             100%   (0 missing)                                                              |
|  Reachability     78%    (runtime missing in prod/eu-west-1)                                      |
|  Policy Decision  100%                                                                               |
|  Human Approval   100%                                                                               |
|  VEX              41%    (vendor statements not imported for 12 CVEs)                             |
|--------------------------------------------------------------------------------------------------|
| Gap list (actionable)                                                                             |
|  - prod/eu-west-1: runtime reachability missing → agent offline (link: Ops Platform Health)      |
|  - advisory freshness: NVD stale 26h → mirror sync failing (link: Ops Feeds & AirGap)            |
+--------------------------------------------------------------------------------------------------+
```

---

# 3) OPERATIONS — menus + screens

## 3.1 Operations menu graph (Mermaid)

```mermaid
flowchart TD
  O0["Operations (menu)"]
  O1["Ops Summary / Nightly Ops Report"]
  O2["Platform Health"]
  O3["Scheduler Runs"]
  O4["Scheduler Run Detail"]
  O5["Orchestrator Jobs"]
  O6["Orchestrator Job Detail"]
  O7["Dead Letter Queue"]
  O8["Quotas & Throttles"]
  O9["Worker Fleet"]
  O10["Feeds & AirGap (see Pack 2)"]

  O0 --> O1
  O0 --> O2
  O0 --> O3 --> O4
  O0 --> O5 --> O6
  O0 --> O7
  O0 --> O8
  O3 --> O9
  O0 --> O10
```

---

## 3.2 Screen — Ops Summary / Nightly Ops Report (NEW)

**New location:** `Operations → Ops Summary / Nightly Report`
**Previously:** *missing* (signals scattered across Scheduler/Feeds/Integrations)
**Why changed:**

* You requested a report that tells you when nightly jobs detect issues:

  * SBOM re-scan failures
  * CVE source not synced / stale
  * integrations not connectable
  * reachability ingest gaps
* This page is the “operators’ morning brief” and feeds both Dashboard and Security coverage.

### Screen graph (Mermaid)

```mermaid
flowchart LR
  N["Nightly Ops Report"] --> J["Job Health (nightly suites)"]
  N --> F["Feed Freshness (OSV/NVD/etc)"]
  N --> I["Integration Connectivity"]
  N --> C["Coverage Gaps (SBOM/reachability/VEX)"]
  N --> D["Deep links: Scheduler run / Mirror detail / Integration detail"]
```

### ASCII mock

```text
+--------------------------------------------------------------------------------------------------+
| Operations / Nightly Ops Report                                          [Export] [Acknowledge] |
| formerly: (missing / implicit)                                                                  |
|--------------------------------------------------------------------------------------------------|
| Nightly suites (last run window)                                                                 |
|  ✅ SBOM Rescan (images)            02:00–02:18   ok                                              |
|  ⚠ Runtime Reachability Ingest      02:00–02:30   degraded (prod/eu-west-1 no agent)             |
|  ❌ NVD Mirror Sync                  02:00–02:10   failed (timeout)                               |
|  ✅ Evidence Seal/Archive            02:20–02:22   ok                                              |
|--------------------------------------------------------------------------------------------------|
| Impact summary                                                                                   |
|  - Promotions at risk: prod policy requires “fresh advisories” → NVD stale blocks promotions     |
|  - Security signal degraded: runtime reachability coverage down in prod/eu-west-1                |
|--------------------------------------------------------------------------------------------------|
| Deep links                                                                                       |
|  [Open Scheduler run: nvd-sync#run-881] [Open Feed mirror: nvd-mirror-1] [Open Agent status]     |
+--------------------------------------------------------------------------------------------------+
```

---

## 3.3 Screen — Platform Health (services + security pipelines)

**New location:** `Operations → Platform Health`
**Previously:** `Operations → Platform Health` (“Platform Health”)
**Why changed:**

* This must show not only “docker/service up”, but whether **security pipelines** are healthy:

  * advisory freshness, SBOM ingestion, reachability ingestion, evidence sealing, replay service.

### Screen graph (Mermaid)

```mermaid
flowchart TD
  P["Platform Health"] --> S["Service health (APIs/workers)"]
  P --> D["Dependencies (db/queue/storage)"]
  P --> SP["Security pipelines (feeds/sbom/reachability/vex)"]
  P --> L["Live incidents (last 24h)"]
  SP --> N["Nightly report"]
```

### ASCII mock

```text
+--------------------------------------------------------------------------------------------------+
| Operations / Platform Health                                            [Refresh] [View Incidents]|
| formerly: Operations → Platform Health                                                           |
|--------------------------------------------------------------------------------------------------|
| Core Services                      | Dependencies                    | Security Pipelines        |
|------------------------------------+---------------------------------+---------------------------|
| API Gateway          ✅             | Database           ✅            | Advisory freshness  ❌ NVD |
| Policy Engine        ✅             | Queue / Broker     ✅            | SBOM ingest         ✅     |
| Evidence Locker      ✅             | Object Storage     ✅            | Reachability ingest ⚠     |
| Replay Service       ✅             | Rekor/Transparency ✅            | VEX import          ⚠     |
|--------------------------------------------------------------------------------------------------|
| Incident timeline (24h): no user-facing incidents; 2 pipeline degradations tracked               |
+--------------------------------------------------------------------------------------------------+
```

---

## 3.4 Screen — Scheduler Runs

**New location:** `Operations → Scheduler Runs`
**Previously:** `Operations → Scheduler` (“Scheduler Runs”)
**Why changed:**

* Keep the page, but make it oriented around **nightly suites** and **data freshness** with links back to impact (coverage gaps, blocked promotions).

### Screen graph (Mermaid)

```mermaid
flowchart TD
  S["Scheduler Runs"] --> R["Run Detail"]
  S --> M["Manage Schedules"]
  S --> W["Worker Fleet"]
  R --> L["Logs"]
  R --> I["Impact (coverage/gates)"]
```

### ASCII mock

```text
+--------------------------------------------------------------------------------------------------+
| Operations / Scheduler Runs                                              [Manage Schedules]      |
| formerly: Operations → Scheduler (Scheduler Runs)                                               |
|--------------------------------------------------------------------------------------------------|
| Filters: Status [All]  Window [Last 24h]  Job type [All]                                         |
|--------------------------------------------------------------------------------------------------|
| JOB                LAST RUN         STATUS     DURATION   NEXT RUN   ACTIONS                      |
| nightly-sbom       Feb 18 02:00     ✅         18m        Feb 19     View Logs                     |
| nightly-runtime    Feb 18 02:00     ⚠         30m        Feb 19     View Logs  View Impact        |
| nvd-sync           Feb 18 02:00     ❌         10m        retry      View Logs  Open Mirror        |
+--------------------------------------------------------------------------------------------------+
```

---

## 3.5 Screen — Scheduler Run Detail

**New location:** `Scheduler Runs → (Run)`
**Previously:** minimal
**Why changed:**

* Adds “impact” panel: what did this job affect (coverage, promotions, alerts).

### Screen graph (Mermaid)

```mermaid
flowchart LR
  D["Scheduler Run Detail"] --> L["Logs"]
  D --> E["Errors + retries"]
  D --> O["Outputs (packets/snapshots)"]
  D --> I["Impact (coverage/gates)"]
```

### ASCII mock

```text
+--------------------------------------------------------------------------------------------------+
| Scheduler Run: nvd-sync#run-881 (FAILED ❌)                             [Retry] [Open Mirror]    |
| formerly: Operations → Scheduler (inline)                                                        |
|--------------------------------------------------------------------------------------------------|
| Error: timeout contacting upstream NVD                                                            |
| Outputs: none                                                                                    |
| Impact:                                                                                           |
|  - Advisory freshness: NVD stale 26h                                                              |
|  - Promotion gate: “fresh advisories” will BLOCK prod promotions                                 |
| Links: [Nightly Ops Report] [Feed Mirror Detail]                                                  |
+--------------------------------------------------------------------------------------------------+
```

---

## 3.6 Screen — Orchestrator Jobs

**New location:** `Operations → Orchestrator`
**Previously:** `Operations → Orchestrator` (“Orchestrator Dashboard”)
**Why changed:**

* Keep access controls, but the main view must be **job status + history** with drilldowns (promotions, rescans, evidence sealing, backfills).

### Screen graph (Mermaid)

```mermaid
flowchart TD
  O["Orchestrator Jobs"] --> J["Job list"]
  O --> A["Access rights panel"]
  J --> D["Job Detail"]
  D --> L["Logs"]
  D --> DLQ["Send to Dead Letter / recover"]
```

### ASCII mock

```text
+--------------------------------------------------------------------------------------------------+
| Operations / Orchestrator Jobs                                           [Jobs] [Backfills]      |
| formerly: Operations → Orchestrator (Orchestrator Dashboard)                                     |
|--------------------------------------------------------------------------------------------------|
| Access (current user)                                                                            |
|  View jobs: ✅ Granted  | Operate: ❌ Denied  | Manage quotas: ❌ Denied  | Backfill: ❌ Denied     |
|--------------------------------------------------------------------------------------------------|
| Recent jobs                                                                                       |
| JOB ID     TYPE             TARGET/ENV         STATUS     START      ACTIONS                      |
| job-551    promotion        prod/us-east-1     RUNNING    08:10      View                          |
| job-552    nightly-sbom     all                COMPLETED  02:00      View                          |
+--------------------------------------------------------------------------------------------------+
```

---

## 3.7 Screen — Orchestrator Job Detail

**New location:** `Orchestrator → (Job)`
**Previously:** not clear
**Why changed:**

* Single place for logs, produced artifacts (packets/capsules), and failure recovery actions.

### Screen graph (Mermaid)

```mermaid
flowchart LR
  D["Job Detail"] --> S["Steps (workflow graph)"]
  D --> L["Logs"]
  D --> A["Artifacts produced"]
  D --> R["Recovery / retry"]
```

### ASCII mock

```text
+--------------------------------------------------------------------------------------------------+
| Job: job-551 (promotion)                                                   [View Capsule]        |
| formerly: Operations → Orchestrator (job row)                                                   |
|--------------------------------------------------------------------------------------------------|
| Workflow steps: Resolve digests → Evaluate policy → Collect approvals → Deploy → Seal capsule    |
| Status: RUNNING (Deploy step)                                                                    |
| Artifacts: pkt-...  capsule-... (pending)                                                        |
+--------------------------------------------------------------------------------------------------+
```

---

## 3.8 Screen — Dead Letter Queue

**New location:** `Operations → Dead Letter Queue`
**Previously:** `Operations → Dead Letter` (“Dead-Letter Queue Management”)
**Why changed:**

* DLQ is for failed jobs and should integrate with retry/replay and exports (so you can attach failure evidence).

### Screen graph (Mermaid)

```mermaid
flowchart TD
  D["Dead Letter Queue"] --> E["Entry Detail"]
  E --> R["Replay / retry job"]
  E --> L["Logs"]
  E --> X["Export failure bundle (optional)"]
```

### ASCII mock

```text
+--------------------------------------------------------------------------------------------------+
| Operations / Dead Letter Queue                                          [Export CSV] [Replay All]|
| formerly: Operations → Dead Letter (Dead-Letter Queue Management)                                |
|--------------------------------------------------------------------------------------------------|
| Filters: Error type [All] Status [All] Search [job id / entry id]                                |
|--------------------------------------------------------------------------------------------------|
| ENTRY ID   JOB ID    ERROR                 FIRST SEEN     STATUS     ACTIONS                      |
| dlq-001    job-77    feed timeout (NVD)    Feb 18 02:05   retriable  View  Replay                 |
| dlq-002    job-88    agent offline         Feb 18 02:06   blocked    View  Diagnose               |
+--------------------------------------------------------------------------------------------------+
```

---

## 3.9 Screen — Quotas & Throttles (runtime ops)

**New location:** `Operations → Quotas & Throttles`
**Previously:** `Operations → Quotas` (“Operator Quota Dashboard”)
**Why changed:**

* Separate **runtime throttling + recent throttle events** (Ops) from **tenant quota configuration** (Administration → Usage & Limits).

### Screen graph (Mermaid)

```mermaid
flowchart LR
  Q["Quotas & Throttles"] --> C["Consumption trend (scans/evidence/api)"]
  Q --> T["Throttle events"]
  Q --> A["Admin: Usage & Limits (configure)"]
```

### ASCII mock

```text
+--------------------------------------------------------------------------------------------------+
| Operations / Quotas & Throttles                                         [Configure Alerts]       |
| formerly: Operations → Quotas (Operator Quota Dashboard)                                         |
|--------------------------------------------------------------------------------------------------|
| Consumption (30d): Scans ████░  Evidence packets ███░  API █████░  Storage ███░                   |
|--------------------------------------------------------------------------------------------------|
| Recent throttle events (24h): none                                                                |
| Note: configure limits in Administration → Usage & Limits.                                        |
+--------------------------------------------------------------------------------------------------+
```

---

## 3.10 Screen — Worker Fleet

**New location:** `Operations → Scheduler Runs → Worker Fleet`
**Previously:** “Worker Fleet” button existed but not surfaced as a core operational screen
**Why changed:**

* Reachability runtime ingestion and SBOM jobs depend on workers/agents; fleet health should be one click from Scheduler and from Hybrid Reachability gaps.

### Screen graph (Mermaid)

```mermaid
flowchart TD
  W["Worker Fleet"] --> N["Nodes/workers list"]
  W --> H["Heartbeat + load"]
  W --> C["Capabilities (sbom, reachability, export)"]
```

### ASCII mock

```text
+--------------------------------------------------------------------------------------------------+
| Operations / Worker Fleet                                                [Drain] [Restart]       |
| formerly: Scheduler → Worker Fleet (button)                                                     |
|--------------------------------------------------------------------------------------------------|
| WORKER           ROLE(S)                    HEARTBEAT     LOAD   STATUS                           |
| worker-us-e1-01  sbom, policy, export       10s           0.4    ✅                              |
| agent-eu-w1-01   runtime reachability       6h            —      ❌ offline                       |
|--------------------------------------------------------------------------------------------------|
| Note: offline runtime agents directly reduce hybrid reachability coverage.                        |
+--------------------------------------------------------------------------------------------------+
```

---

## Your “continue” pointer

If you want **Pack 4**, I’ll cover the remaining *Release Control* runtime screens (Releases, Approvals, Deployments, Regions/Env detail) with the same: **menu mermaid + per-screen mermaid + ASCII + formerly/why**—but I didn’t repeat them here to avoid duplicating what we already established in Packs 1–2.

[1]: https://stella-ops.org/?utm_source=chatgpt.com "Stella Ops Suite - Evidence-Grade Release Control for Non ..."
[2]: https://git.stella-ops.org/stella-ops.org/git.stella-ops.org/src/commit/490339561842d30f212e390efb9e8409cd395fe3/docs-archived/ui-analysis/rework/01-ui-rework-adivsory.md?utm_source=chatgpt.com "git.stella-ops.org/01-ui-rework-adivsory.md at ... - Stella Ops Suite"
[3]: https://git.stella-ops.org/stella-ops.org/git.stella-ops.org/src/commit/3130cdb702f34e550725717c6f13a4919bac0bb3/docs/marketing/evidence-linked-vex.md?utm_source=chatgpt.com "git.stella-ops.org/evidence-linked-vex.md at ... - Stella Ops Suite"
[4]: https://stella-ops.org/docs/key-features/?utm_source=chatgpt.com "Stella Ops – Signed Reachability · Deterministic Replay · Sovereign ..."
[5]: https://git.stella-ops.org/stella-ops.org/git.stella-ops.org/src/commit/342c35f8ce1544cf816d8a4b41ebaff6187e7016/docs/replay/DEVS_GUIDE_REPLAY.md?utm_source=chatgpt.com "Stella Ops — Developer Guide: Deterministic Replay"