541a936d03
This commit completes the MongoDB and MinIO removal from the StellaOps platform and integrates the CLI consolidation work from remote. ## Infrastructure Changes - PostgreSQL v16+ is now the ONLY supported database - Valkey v8.0 replaces Redis for caching, DPoP security, and event streams - RustFS is the primary object storage (MinIO fully removed) - NATS is OPTIONAL for messaging (Valkey is default transport) ## Docker Compose Updates Updated all deployment profiles: - deploy/compose/docker-compose.dev.yaml - deploy/compose/docker-compose.airgap.yaml - deploy/compose/docker-compose.stage.yaml - deploy/compose/docker-compose.prod.yaml All profiles now use PostgreSQL + Valkey + RustFS stack. ## Environment Configuration Updated all env.example files with: - Removed: MONGO_*, MINIO_* variables - Added: POSTGRES_*, VALKEY_* variables - Updated: SCANNER_QUEUE_BROKER to use Valkey by default - Enhanced: Surface.Env and Offline Kit configurations ## Aoc.Cli Changes - Removed --mongo option entirely - Made --postgres option required - Removed VerifyMongoAsync method - PostgreSQL is now the only supported backend ## CLI Consolidation (from merge) Integrated plugin architecture for unified CLI: - stella aoc verify (replaces stella-aoc) - stella symbols (replaces stella-symbols) - Plugin manifests and command modules - Migration guide for users ## Documentation Updates - README.md: Updated deployment workflow notes - DEVELOPER_ONBOARDING.md: Complete Valkey-centric flow diagrams - QUICKSTART_HYBRID_DEBUG.md: Removed MongoDB/MinIO references - VERSION_MATRIX.md: Updated infrastructure dependencies - CLEANUP_SUMMARY.md: Marked all cleanup tasks complete - 07_HIGH_LEVEL_ARCHITECTURE.md: Corrected infrastructure stack - 11_DATA_SCHEMAS.md: Valkey keyspace documentation ## Merge Resolution Resolved merge conflicts by accepting incoming changes which had more complete Surface.Env and Offline Kit configurations. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Stella Ops
Stella Ops isn't just another scanner—it's a different product category: deterministic, evidence-linked vulnerability decisions that survive auditors, regulators, and supply-chain propagation.
Stella Ops delivers four capabilities no competitor offers together:
- Signed Reachability – Every reachability graph is sealed with DSSE; optional edge-bundle attestations for runtime/init/contested paths. Both static call-graph edges and runtime-derived edges can be attested—true hybrid reachability.
- Deterministic Replay – Scans run bit-for-bit identical from frozen feeds and analyzer manifests. Auditors and incident responders can re-run historical findings and trust the results weren't tampered with.
- Explainable Policy (Lattice VEX) – The lattice engine merges SBOM data, advisories, VEX statements, and waivers into a single verdict with human-readable justifications. Explicit "Unknown" state handling ensures incomplete data never leads to false safety.
- Sovereign + Offline Operation – FIPS, eIDAS, GOST, SM, or PQC profiles are first-class toggles. Offline Kits and regional crypto profiles keep every decision inside your perimeter—air-gapped verification works by default.
Proof points: Decision Capsules (sealed evidence bundles), SBOM cartographing, deterministic replay manifests, lattice policy UI with OpenVEX, evidence-linked VEX decisions, and post‑quantum trust packs ready for regulated sectors.
Choose Your Path
| If you want to… | Open this | Read time |
|---|---|---|
| Understand the promise and pain we solve | overview.md |
≈ 2 min |
| Run a first scan and see the CLI | quickstart.md |
≈ 5 min |
| Browse key capabilities at a glance | key-features.md |
≈ 3 min |
| Check architecture, road to production, or evaluate fit | See "Dig deeper" below | ≤ 30 min curated set |
Explore the Essentials
- Value in context – Overview compresses the "Why" + "What" stories and shows how Stella Ops stands apart.
- Try it fast – Quickstart walks through fetching the signed bundles, configuring
.env, and verifying the first scan. - Feature confidence – Key Features gives nine capability cards covering Decision Capsules, Delta SBOM, VEX-first policy, Sovereign crypto, Deterministic replay, and more.
- Up-next checkpoints – Evaluation checklist helps teams plan Day-0 to Day-30 adoption milestones.
- Be dev-ready – Developer Quickstart (29-Nov-2025 advisory) walks through the core repos, determinism tests, attestations, and starter issues for a mid-level .NET engineer.
Key capabilities that define Stella Ops
| Capability | What ships | Why it matters |
|---|---|---|
| Decision Capsules | Every scan result is sealed in a content-addressed bundle containing SBOM, vuln feed snapshots, reachability evidence, policy version, derived VEX, and signatures. | Auditors can re-run any capsule bit-for-bit to verify the outcome—audit-grade evidence bundles. |
| Deterministic Δ‑SBOM & replay bundles | Layer-aware cache + replay manifests keep scans reproducible even months later. | Auditors can re-run any verdict with identical inputs, proving integrity without SaaS dependencies. |
| Pristine advisory mirrors | OSV, GHSA, NVD, CNVD, CNNVD, ENISA, JVN, BDU, etc. are mirrored as immutable, per-source snapshots—never merged. | Policy (via scanner.* / SCANNER__*) can trust, down-rank, or ignore sources without rewriting upstream data. |
| Lattice VEX engine (Evidence-Linked) | OpenVEX, waivers, mitigations, and configs flow through deterministic lattice logic with proof-linked decisions. | Every block/allow decision is explainable, replayable, evidence-linked, and environment-specific. Explicit "Unknown" state handling ensures incomplete data never leads to false safety. |
| Hybrid Reachability | Static call-graph analysis + optional runtime/eBPF probes; both edge types can be attested with DSSE. | Build + runtime signals share one verdict; prioritisation spans first-party code, base images, and live telemetry. |
| Transparency log + trust credits | Cosign/DSSE bundles push to a Rekor-compatible log; the trust-credit ledger records who accepted a risk. | Compliance teams get provenance plus accountable ownership trails. |
| Sovereign crypto profiles | Swap in FIPS, eIDAS, GOST, SM, or PQ-ready providers without code changes. | Meets regional crypto rules while keeping attestations verifiable. |
| Offline-first operations | Offline Kit packages the pristine feeds, plug-ins, and configs; import CLI verifies everything locally. | Air-gapped clouds get the same security posture as connected sites. |
| VEX Propagation | Generate vulnerability status attestations your downstream consumers can automatically trust and ingest. | Scalable VEX sharing across the supply chain—competitors export VEX formats; Stella provides a unified proof model that can be verified independently. |
| Enterprise readiness | Transparent quotas, LDAP/AD SSO, restart-time plug-in SDK, generous free tier. | Large teams keep their workflows without surrendering control to SaaS platforms. |
Where Stella Ops differs from incumbents
| Vendor | Where they stop | Stella Ops difference |
|---|---|---|
| Trivy / Syft | SBOM generation as a CLI add-on; policy left to other products. | SBOM + VEX are the system of record with deterministic replay, Decision Capsules, and signed evidence. |
| Snyk Container | Static reachability bounded to first-party code. | Hybrid reachability links code, base images, cluster policies, and optional runtime probes so the entire stack shares one score. |
| JFrog Xray | Contextual scoring lives behind a closed service. | Policies, DSSE bundles, Decision Capsules, and transparency logs are open, auditable, and portable. |
| Docker Scout | Provenance remains inside Docker's ecosystem. | Any OCI provenance is ingested, signed with your crypto profile, and replayed offline with full evidence. |
| Wiz / runtime sensors | Runtime telemetry is separate from build-time SBOM/VEX evidence. | Optional runtime probes feed the same deterministic lattice so build- and run-time context stay consistent; all evidence sealed in Decision Capsules. |
Dig Deeper (curated reading)
- Install & operations: Installation guide, Offline Update Kit, Security hardening.
- Binary prerequisites & offline layout: Binary prereqs covering curated NuGet feed, manifests, and CI guards.
- Architecture & modules: High-level architecture, Module dossiers, Strategic differentiators.
- Reachability drift: Architecture, API reference, Operations guide.
- Advisory AI: Module dossier & deployment covering RAG pipeline, guardrails, offline bundle outputs, and operations.
- Policy & governance: Policy templates, Legal & quota FAQ, Governance charter.
- UI & glossary: Console guide, Accessibility, Glossary.
- Technical documentation: Full technical index for architecture, APIs, module dossiers, and operations playbooks.
- FAQs & readiness: FAQ matrix, Roadmap (external), Release engineering playbook.
Need more? The full documentation tree – ADRs, per‑module operations, schemas, developer references – stays untouched under the existing directories (modules/, api/, dev/, ops/), ready when you are.
Configuration note: Feature exposure stays governed by
StellaOps.Scanner.WebService(scanner.*/SCANNER__*) settings. See modules/scanner/architecture.md and modules/scanner/design/surface-env.md for the authoritative schema; the docs remain pristine while configuration decides what surfaces for each deployment.
© 2025 Stella Ops contributors – AGPL‑3.0‑or‑later