7503c19b8f
- Implemented comprehensive tests for verdict artifact generation to ensure deterministic outputs across various scenarios, including identical inputs, parallel execution, and change ordering. - Created helper methods for generating sample verdict inputs and computing canonical hashes. - Added tests to validate the stability of canonical hashes, proof spine ordering, and summary statistics. - Introduced a new PowerShell script to update SHA256 sums for files, ensuring accurate hash generation and file integrity checks.
26 lines
2.1 KiB
Markdown
Executable File
26 lines
2.1 KiB
Markdown
Executable File
# FAQ (stakeholder matrix)
|
|
|
|
## Quick answers
|
|
|
|
| Question | Short answer |
|
|
| --- | --- |
|
|
| What is StellaOps? | A sovereign, offline-first container-security platform focused on deterministic, replayable evidence: SBOMs, advisories, VEX, policy decisions, and attestations bound to image digests. |
|
|
| What makes it “deterministic”? | The same inputs produce the same outputs (stable ordering, stable IDs, replayable artifacts). Determinism is treated as a product feature and enforced by tests and fixtures. |
|
|
| Does it run fully offline? | Yes. Offline operation is a first-class workflow (bundles, mirrors, importer/controller). See `docs/24_OFFLINE_KIT.md` and `docs/airgap/overview.md`. |
|
|
| Which formats are supported? | SBOMs: SPDX 3.0.1 and CycloneDX 1.6. VEX: OpenVEX-first decisioning with issuer trust and consensus. Attestations: in-toto/DSSE where enabled. |
|
|
| How do I deploy it? | Use deterministic bundles under `deploy/` (Compose/Helm) with digests sourced from `deploy/releases/`. Start with `docs/21_INSTALL_GUIDE.md`. |
|
|
| How do policy gates work? | Policy combines VEX-first inputs with lattice/precedence rules so outcomes are stable and explainable. See `docs/policy/vex-trust-model.md`. |
|
|
| Is multi-tenancy supported? | Yes; tenancy boundaries and roles/scopes are documented and designed to support regulated environments. See `docs/security/tenancy-overview.md` and `docs/security/scopes-and-roles.md`. |
|
|
| Can I extend it? | Yes: connectors, plugins, and policy packs are designed to be composable without losing determinism. Start with module dossiers under `docs/modules/`. |
|
|
| Where is the roadmap? | `docs/05_ROADMAP.md` (priority bands + definition of “done”). |
|
|
| Where do I find deeper docs? | `docs/technical/README.md` is the detailed index; `docs/modules/` contains per-module dossiers. |
|
|
|
|
## Further reading
|
|
- Vision: `docs/03_VISION.md`
|
|
- Feature matrix: `docs/04_FEATURE_MATRIX.md`
|
|
- Architecture overview: `docs/40_ARCHITECTURE_OVERVIEW.md`
|
|
- High-level architecture: `docs/07_HIGH_LEVEL_ARCHITECTURE.md`
|
|
- Offline kit: `docs/24_OFFLINE_KIT.md`
|
|
- Install guide: `docs/21_INSTALL_GUIDE.md`
|
|
- Quickstart: `docs/quickstart.md`
|