939 lines
49 KiB
Markdown
939 lines
49 KiB
Markdown
# Complete Feature Matrix - Stella Ops Suite
|
||
*(Auto-generated with code mapping)*
|
||
|
||
> This document extends `FEATURE_MATRIX.md` with module/file mappings and CLI/UI coverage verification.
|
||
|
||
---
|
||
|
||
## SBOM & Ingestion
|
||
|
||
| Feature | Tiers | Module | Key Files | CLI | UI | Status |
|
||
|---------|-------|--------|-----------|-----|----|----|
|
||
| Trivy-JSON Ingestion | Free/Pro/Ent | Concelier | `TrivyDbExporterPlugin.cs`, `TrivyDbBoltBuilder.cs` | - | `/concelier/trivy-db-settings` | Implemented |
|
||
| SPDX-JSON 3.0.1 Ingestion | Free/Pro/Ent | Concelier, Scanner | `SbomParser.cs`, `SpdxJsonLdSerializer.cs` | `stella sbom list --format spdx` | `/sbom-sources` | Implemented |
|
||
| CycloneDX 1.7 Ingestion | Free/Pro/Ent | Concelier, Scanner | `SbomParser.cs`, `CycloneDxComposer.cs` | `stella sbom list --format cyclonedx` | `/sbom-sources` | Implemented |
|
||
| Auto-format Detection | Free/Pro/Ent | Concelier | `ISbomParser.cs`, `SbomParser.cs` (DetectFormatAsync) | Implicit in `stella sbom` | Implicit | Implemented |
|
||
| Delta-SBOM Cache | Free/Pro/Ent | SbomService | `VexDeltaRepository.cs`, `InMemoryLineageCompareCache.cs`, `ValkeyLineageCompareCache.cs` | - | - | Implemented |
|
||
| SBOM Generation (all formats) | Free/Pro/Ent | Scanner | `SpdxComposer.cs`, `CycloneDxComposer.cs`, `SpdxLayerWriter.cs`, `CycloneDxLayerWriter.cs` | `stella scan run` | `/findings` (scan results) | Implemented |
|
||
| Semantic SBOM Diff | Free/Pro/Ent | Scanner, SbomService | `SbomDiff.cs`, `SbomDiffEngine.cs`, `LineageCompareService.cs` | - | `/lineage` | Implemented |
|
||
| BYOS (Bring-Your-Own-SBOM) | Free/Pro/Ent | Scanner | `SbomByosUploadService.cs`, `SbomUploadStore.cs`, `SbomUploadEndpoints.cs` | `stella sbom upload` (pending) | `/sbom-sources` | Implemented |
|
||
| SBOM Lineage Ledger | Enterprise | SbomService | `SbomLineageEdgeRepository.cs`, `SbomLedgerModels.cs`, `SbomServiceDbContext.cs` | - | `/lineage` | Implemented |
|
||
| SBOM Lineage API | Enterprise | SbomService, Graph | `ILineageGraphService.cs`, `SbomLineageGraphService.cs`, `LineageExportService.cs`, `LineageController.cs` | - | `/lineage` | Implemented |
|
||
|
||
### CLI Commands (SBOM)
|
||
|
||
| Command | Description | Status |
|
||
|---------|-------------|--------|
|
||
| `stella sbom list` | List SBOMs with filters (--image, --digest, --format, --created-after/before) | Implemented |
|
||
| `stella sbom show <id>` | Display SBOM details | Implemented |
|
||
| `stella sbom upload` | Upload external SBOM (BYOS) | Pending verification |
|
||
| `stella sbomer layer list` | List layer fragments for a scan | Implemented |
|
||
| `stella sbomer compose` | Compose layer SBOMs | Implemented |
|
||
| `stella sbomer verify` | Verify Merkle tree integrity | Implemented |
|
||
|
||
### UI Routes (SBOM)
|
||
|
||
| Route | Feature | Status |
|
||
|-------|---------|--------|
|
||
| `/sbom-sources` | SBOM ingestion source management | Implemented |
|
||
| `/lineage` | SBOM lineage graph and smart diff | Implemented |
|
||
| `/graph` | Interactive SBOM dependency visualization | Implemented |
|
||
| `/concelier/trivy-db-settings` | Trivy vulnerability database configuration | Implemented |
|
||
|
||
### Coverage Gaps (SBOM)
|
||
|
||
| Feature | Has CLI | Has UI | Notes |
|
||
|---------|---------|--------|-------|
|
||
| Delta-SBOM Cache | No | No | Internal optimization, no direct exposure needed |
|
||
| Auto-format Detection | Implicit | Implicit | Works automatically, no explicit command |
|
||
| SBOM Lineage Ledger | No | Yes | CLI access would be useful for automation |
|
||
| SBOM Lineage API | No | Yes | CLI access would be useful for automation |
|
||
|
||
---
|
||
|
||
## Scanning & Detection
|
||
|
||
| Feature | Tiers | Module | Key Files | CLI | UI | Status |
|
||
|---------|-------|--------|-----------|-----|----|----|
|
||
| CVE Lookup via Local DB | Free/Pro/Ent | Scanner | `VulnSurfaceService.cs`, `AdvisoryClient.cs` | `stella scan run` | `/findings` | Implemented |
|
||
| License-Risk Detection | All (Planned) | Scanner | Package manifest extraction only | - | - | Planned (Q4-2025) |
|
||
| **.NET/C# Analyzer** | Free/Pro/Ent | Scanner | `DotNetLanguageAnalyzer.cs`, `DotNetDependencyCollector.cs`, `MsBuildProjectParser.cs` | `stella scan run` | `/findings` | Implemented |
|
||
| **Java Analyzer** | Free/Pro/Ent | Scanner | `JavaLanguageAnalyzer.cs`, `JavaWorkspaceNormalizer.cs` | `stella scan run` | `/findings` | Implemented |
|
||
| **Go Analyzer** | Free/Pro/Ent | Scanner | `GoLanguageAnalyzer.cs` | `stella scan run` | `/findings` | Implemented |
|
||
| **Python Analyzer** | Free/Pro/Ent | Scanner | `PythonLanguageAnalyzer.cs`, `PythonEnvironmentDetector.cs`, `ContainerLayerAdapter.cs` | `stella scan run` | `/findings` | Implemented |
|
||
| **Node.js Analyzer** | Free/Pro/Ent | Scanner | `NodeLanguageAnalyzer.cs` | `stella scan run` | `/findings` | Implemented |
|
||
| **Ruby Analyzer** | Free/Pro/Ent | Scanner | `RubyLanguageAnalyzer.cs`, `RubyVendorArtifactCollector.cs` | `stella ruby inspect` | `/findings` | Implemented |
|
||
| **Bun Analyzer** | Free/Pro/Ent | Scanner | `BunLanguageAnalyzer.cs` | `stella bun inspect` | `/findings` | Implemented |
|
||
| **Deno Analyzer** | Free/Pro/Ent | Scanner | `DenoLanguageAnalyzer.cs` | `stella scan run` | `/findings` | Implemented |
|
||
| **PHP Analyzer** | Free/Pro/Ent | Scanner | `PhpLanguageAnalyzer.cs` | `stella php inspect` | `/findings` | Implemented |
|
||
| **Rust Analyzer** | Free/Pro/Ent | Scanner | `RustLanguageAnalyzer.cs` | `stella scan run` | `/findings` | Implemented |
|
||
| **Native Binary Analyzer** | Free/Pro/Ent | Scanner | `NativeAnalyzer.cs` | `stella binary` | `/analyze/patch-map` | Implemented |
|
||
| Quick Mode | Free/Pro/Ent | Scanner | `FidelityLevel.cs`, `FidelityConfiguration.cs`, `FidelityAwareAnalyzer.cs` | `stella scan run --fidelity quick` | `/ops/scanner` | Implemented |
|
||
| Standard Mode | Free/Pro/Ent | Scanner | `FidelityLevel.cs`, `FidelityConfiguration.cs` | `stella scan run --fidelity standard` | `/ops/scanner` | Implemented |
|
||
| Deep Mode | Pro/Ent | Scanner | `FidelityLevel.cs`, `FidelityConfiguration.cs` | `stella scan run --fidelity deep` | `/ops/scanner` | Implemented |
|
||
| Base Image Detection | Free/Pro/Ent | Scanner | `OciImageInspector.cs`, `OciImageConfig.cs` | `stella image inspect` | `/findings` | Implemented |
|
||
| Layer-Aware Analysis | Free/Pro/Ent | Scanner | `LayeredRootFileSystem.cs`, `ContainerLayerAdapter.cs` | `stella scan layer-sbom` | `/findings` | Implemented |
|
||
| Concurrent Scan Workers | 1/3/Unlimited | Scanner | `IScanQueue.cs`, `NatsScanQueue.cs`, `ScanJobProcessor.cs` | - | `/ops/scanner` | Implemented |
|
||
|
||
### CLI Commands (Scanning)
|
||
|
||
| Command | Description | Status |
|
||
|---------|-------------|--------|
|
||
| `stella scan run` | Execute scanner with --runner, --entry, --target | Implemented |
|
||
| `stella scan upload` | Upload completed scan results | Implemented |
|
||
| `stella scan entrytrace` | Show entry trace summary for a scan | Implemented |
|
||
| `stella scan sarif` | Export scan results in SARIF 2.1.0 format | Implemented |
|
||
| `stella scan replay` | Replay scan with deterministic hashes | Implemented |
|
||
| `stella scan gate-policy` | VEX gate evaluation | Implemented |
|
||
| `stella scan layers` | Container layer operations | Implemented |
|
||
| `stella scan layer-sbom` | Layer SBOM composition | Implemented |
|
||
| `stella scan diff` | Binary diff analysis | Implemented |
|
||
| `stella image inspect` | Inspect OCI image manifest and layers | Implemented |
|
||
| `stella ruby inspect` | Inspect Ruby workspace | Implemented |
|
||
| `stella php inspect` | Inspect PHP workspace | Implemented |
|
||
| `stella python inspect` | Inspect Python workspace/venv | Implemented |
|
||
| `stella bun inspect` | Inspect Bun workspace | Implemented |
|
||
| `stella scanner download` | Download latest scanner bundle | Implemented |
|
||
|
||
### UI Routes (Scanning)
|
||
|
||
| Route | Feature | Status |
|
||
|-------|---------|--------|
|
||
| `/findings` | Vulnerability findings with diff-first view | Implemented |
|
||
| `/findings/:scanId` | Scan-specific findings | Implemented |
|
||
| `/scans/:scanId` | Individual scan result inspection | Implemented |
|
||
| `/vulnerabilities` | CVE/vulnerability database explorer | Implemented |
|
||
| `/vulnerabilities/:vulnId` | Vulnerability detail view | Implemented |
|
||
| `/ops/scanner` | Scanner offline kits, baselines, determinism settings | Implemented |
|
||
| `/analyze/patch-map` | Fleet-wide binary patch coverage heatmap | Implemented |
|
||
|
||
### Coverage Gaps (Scanning)
|
||
|
||
| Feature | Has CLI | Has UI | Notes |
|
||
|---------|---------|--------|-------|
|
||
| License-Risk Detection | No | No | Planned feature, not yet implemented |
|
||
| Concurrent Worker Config | No | Yes | Worker count configured via ops UI/environment |
|
||
|
||
---
|
||
|
||
## Reachability Analysis
|
||
|
||
| Feature | Tiers | Module | Key Files | CLI | UI | Status |
|
||
|---------|-------|--------|-----------|-----|----|----|
|
||
| Static Call Graph | Free/Pro/Ent | Scanner, ReachGraph | `ReachabilityAnalyzer.cs`, `ReachGraphEdge.cs` | `stella reachgraph slice` | `/reachability` | Implemented |
|
||
| Entrypoint Detection (9+ types) | Free/Pro/Ent | Scanner | `JavaEntrypointClassifier.cs`, `EntryTraceResponse.cs` | `stella scan entrytrace` | `/reachability` | Implemented |
|
||
| BFS Reachability | Free/Pro/Ent | Scanner | `ReachabilityAnalyzer.cs` (BFS traversal, max depth 256) | `stella reachgraph slice --depth` | `/reachability` | Implemented |
|
||
| Reachability Drift Detection | Free/Pro/Ent | Reachability.Core | `ReachabilityLattice.cs` (8-state machine) | `stella drift` | `/reachability` | Implemented |
|
||
| Binary Loader Resolution | Pro/Ent | Scanner | `GuardDetector.cs` (PLT/IAT), Binary entrypoint classifiers | `stella binary` | `/analyze/patch-map` | Implemented |
|
||
| Feature Flag/Config Gating | Pro/Ent | Scanner | `GuardDetector.cs` (env guards, platform checks, feature flags) | - | `/reachability` | Implemented |
|
||
| Runtime Signal Correlation | Enterprise | Signals | `EvidenceWeightedScoreCalculator.cs`, `ISignalsAdapter.cs` | - | `/reachability` | Implemented |
|
||
| Gate Detection (auth/admin) | Enterprise | Scanner | `GuardDetector.cs` (20+ patterns across 5+ languages) | - | `/reachability` | Implemented |
|
||
| Path Witness Generation | Enterprise | Scanner, ReachGraph | `ReachabilityAnalyzer.cs` (deterministic path ordering) | `stella witness` | - | Implemented |
|
||
| Reachability Mini-Map API | Enterprise | ReachGraph | `ReachGraphStoreService.cs`, `ReachGraphContracts.cs` | `stella reachgraph slice` | `/reachability` | Implemented |
|
||
| Runtime Timeline API | Enterprise | Signals | `ISignalsAdapter.cs`, Evidence window configuration | - | `/reachability` | Implemented |
|
||
|
||
### CLI Commands (Reachability)
|
||
|
||
| Command | Description | Status |
|
||
|---------|-------------|--------|
|
||
| `stella reachgraph slice` | Query slice of reachability graph (--cve, --purl, --entrypoint, --depth) | Implemented |
|
||
| `stella reachgraph replay` | Replay reachability analysis for verification | Implemented |
|
||
| `stella reachgraph verify` | Verify graph integrity | Implemented |
|
||
| `stella reachability show` | Display reachability subgraph (table, json, dot, mermaid) | Implemented |
|
||
| `stella reachability export` | Export reachability data | Implemented |
|
||
| `stella scan entrytrace` | Show entry trace summary with semantic analysis | Implemented |
|
||
| `stella witness` | Path witness operations | Implemented |
|
||
| `stella drift` | Reachability drift detection | Implemented |
|
||
|
||
### UI Routes (Reachability)
|
||
|
||
| Route | Feature | Status |
|
||
|-------|---------|--------|
|
||
| `/reachability` | Reachability center - analysis and coverage | Implemented |
|
||
| `/graph` | Interactive dependency graph with reachability overlay | Implemented |
|
||
|
||
### Key Implementation Details
|
||
|
||
**Reachability Lattice (8 States):**
|
||
1. Unknown (0.00-0.29 confidence)
|
||
2. StaticReachable (0.30-0.49)
|
||
3. StaticUnreachable (0.50-0.69)
|
||
4. RuntimeObserved (0.70-0.89)
|
||
5. RuntimeUnobserved (0.70-0.89)
|
||
6. ConfirmedReachable (0.90-1.00)
|
||
7. ConfirmedUnreachable (0.90-1.00)
|
||
8. Contested (static/runtime conflict)
|
||
|
||
**Entrypoint Framework Types Detected:**
|
||
- HTTP Handlers (Spring MVC, JAX-RS, Micronaut, GraphQL)
|
||
- Message Handlers (Kafka, RabbitMQ, JMS)
|
||
- Scheduled Jobs (Spring @Scheduled, Micronaut, JAX-EJB)
|
||
- gRPC Methods (Spring Boot gRPC, Netty gRPC)
|
||
- Event Handlers (Spring @EventListener)
|
||
- CLI Commands (main() method)
|
||
- Servlet Handlers (HttpServlet subclass)
|
||
|
||
### Coverage Gaps (Reachability)
|
||
|
||
| Feature | Has CLI | Has UI | Notes |
|
||
|---------|---------|--------|-------|
|
||
| Runtime Signal Correlation | No | Yes | Consider CLI for signal inspection |
|
||
| Gate Detection | No | Yes | Guard conditions visible in reachability UI |
|
||
| Path Witness Generation | Yes | No | Consider UI visualization of witness paths |
|
||
|
||
---
|
||
|
||
## Binary Analysis (BinaryIndex)
|
||
|
||
| Feature | Tiers | Module | Key Files | CLI | UI | Status |
|
||
|---------|-------|--------|-----------|-----|----|----|
|
||
| Binary Identity Extraction | Free/Pro/Ent | BinaryIndex | `BinaryIdentity.cs`, `IBinaryFeatureExtractor.cs` | `stella binary inspect` | `/analyze/patch-map` | Implemented |
|
||
| Build-ID Vulnerability Lookup | Free/Pro/Ent | BinaryIndex | `IBinaryVulnerabilityService.cs`, `ResolutionController.cs` | `stella binary lookup` | `/analyze/patch-map` | Implemented |
|
||
| Debian/Ubuntu Corpus | Free/Pro/Ent | BinaryIndex | `DebianCorpusConnector.cs`, `CorpusIngestionService.cs` | - | - | Implemented |
|
||
| RPM/RHEL Corpus | Pro/Ent | BinaryIndex | `RpmCorpusConnector.cs` | - | - | Implemented |
|
||
| Patch-Aware Backport Detection | Pro/Ent | BinaryIndex | `IFixIndexBuilder.cs`, `FixEvidence.cs`, `DebianChangelogParser.cs` | `stella patch-verify` | - | Implemented |
|
||
| PE/Mach-O/ELF Parsers | Pro/Ent | BinaryIndex | Binary format detection in `BinaryIdentity.cs` | `stella binary inspect` | - | Implemented |
|
||
| Binary Fingerprint Generation | Enterprise | BinaryIndex | `IVulnFingerprintGenerator.cs`, `BasicBlockFingerprintGenerator.cs`, `ControlFlowGraphFingerprintGenerator.cs`, `StringRefsFingerprintGenerator.cs` | `stella binary fingerprint` | - | Implemented |
|
||
| Fingerprint Matching Engine | Enterprise | BinaryIndex | `IFingerprintMatcher.cs`, `FingerprintMatcher.cs` | `stella binary lookup --fingerprint` | - | Implemented |
|
||
| DWARF/Symbol Analysis | Enterprise | BinaryIndex | Symbol extraction in corpus functions | `stella binary symbols` | - | Implemented |
|
||
|
||
### CLI Commands (Binary)
|
||
|
||
| Command | Description | Status |
|
||
|---------|-------------|--------|
|
||
| `stella binary inspect` | Inspect binary identity (Build-ID, hashes, architecture) | Implemented |
|
||
| `stella binary lookup` | Lookup vulnerabilities by binary identity/fingerprint | Implemented |
|
||
| `stella binary symbols` | Extract symbols from binary | Implemented |
|
||
| `stella binary fingerprint` | Generate fingerprints for binary functions | Implemented |
|
||
| `stella binary verify` | Verify binary match evidence | Implemented |
|
||
| `stella binary submit` | Submit binary for analysis | Implemented |
|
||
| `stella binary info` | Get binary analysis info | Implemented |
|
||
| `stella binary callgraph` | Extract call graph digest | Implemented |
|
||
| `stella scan diff` | Binary diff analysis | Implemented |
|
||
| `stella patch-verify` | Patch verification for backport detection | Implemented |
|
||
| `stella patch-attest` | Patch attestation operations | Implemented |
|
||
| `stella deltasig` | Delta signature operations | Implemented |
|
||
|
||
### UI Routes (Binary)
|
||
|
||
| Route | Feature | Status |
|
||
|-------|---------|--------|
|
||
| `/analyze/patch-map` | Fleet-wide binary patch coverage heatmap | Implemented |
|
||
|
||
### Key Implementation Details
|
||
|
||
**Fingerprint Algorithms (4 types):**
|
||
1. **BasicBlock** - Instruction-level basic block hashing (16 bytes)
|
||
2. **ControlFlowGraph** - Weisfeiler-Lehman graph hash (32 bytes)
|
||
3. **StringRefs** - String reference pattern hash (16 bytes)
|
||
4. **Combined** - Multi-algorithm ensemble
|
||
|
||
**Fix Detection Methods:**
|
||
1. SecurityFeed - Official OVAL, DSA feeds
|
||
2. Changelog - Debian/Ubuntu changelog parsing
|
||
3. PatchHeader - DEP-3 patch header extraction
|
||
4. UpstreamPatchMatch - Upstream patch database
|
||
|
||
**Supported Distributions:**
|
||
- Debian, Ubuntu (DebianCorpusConnector)
|
||
- RHEL, Fedora, CentOS, Rocky, AlmaLinux (RpmCorpusConnector)
|
||
- Alpine Linux (AlpineCorpusConnector)
|
||
|
||
### Coverage Gaps (Binary)
|
||
|
||
| Feature | Has CLI | Has UI | Notes |
|
||
|---------|---------|--------|-------|
|
||
| Debian/Ubuntu Corpus | No | No | Internal corpus management - admin only |
|
||
| RPM/RHEL Corpus | No | No | Internal corpus management - admin only |
|
||
| Fingerprint Generation | Yes | No | Consider UI for fingerprint visualization |
|
||
| Corpus Ingestion | No | No | Admin operation - consider ops UI |
|
||
|
||
---
|
||
|
||
## Advisory Sources (Concelier)
|
||
|
||
| Feature | Tiers | Module | Key Files | CLI | UI | Status |
|
||
|---------|-------|--------|-----------|-----|----|----|
|
||
| NVD | Free/Pro/Ent | Concelier | `NvdConnector.cs`, `NvdMapper.cs` | `stella db fetch nvd` | `/concelier` | Implemented |
|
||
| GHSA | Free/Pro/Ent | Concelier | `GhsaConnector.cs` (GraphQL, rate limits) | `stella db fetch ghsa` | `/concelier` | Implemented |
|
||
| OSV | Free/Pro/Ent | Concelier | `OsvConnector.cs` (multi-ecosystem) | `stella db fetch osv` | `/concelier` | Implemented |
|
||
| Alpine SecDB | Free/Pro/Ent | Concelier | `Connector.Distro.Alpine/` | `stella db fetch alpine` | `/concelier` | Implemented |
|
||
| Debian Security Tracker | Free/Pro/Ent | Concelier | `Connector.Distro.Debian/` (DSA, EVR) | `stella db fetch debian` | `/concelier` | Implemented |
|
||
| Ubuntu USN | Free/Pro/Ent | Concelier | `Connector.Distro.Ubuntu/` | `stella db fetch ubuntu` | `/concelier` | Implemented |
|
||
| RHEL/CentOS OVAL | Pro/Ent | Concelier | `Connector.Distro.RedHat/` (OVAL, NEVRA) | `stella db fetch redhat` | `/concelier` | Implemented |
|
||
| KEV (Exploited Vulns) | Free/Pro/Ent | Concelier | `KevConnector.cs` (CISA catalog) | `stella db fetch kev` | `/concelier` | Implemented |
|
||
| EPSS v4 | Free/Pro/Ent | Concelier | `Connector.Epss/` | `stella db fetch epss` | `/concelier` | Implemented |
|
||
| Custom Advisory Connectors | Enterprise | Concelier | `IFeedConnector` interface | - | `/admin` | Implemented |
|
||
| Advisory Merge Engine | Enterprise | Concelier | `AdvisoryPrecedenceMerger.cs`, `AffectedPackagePrecedenceResolver.cs` | `stella db merge` | - | Implemented |
|
||
|
||
### CLI Commands (Advisory)
|
||
|
||
| Command | Description | Status |
|
||
|---------|-------------|--------|
|
||
| `stella db fetch` | Trigger connector fetch/parse/map | Implemented |
|
||
| `stella db merge` | Run canonical merge reconciliation | Implemented |
|
||
| `stella db export` | Run Concelier export jobs | Implemented |
|
||
| `stella sources ingest` | Validate source documents | Implemented |
|
||
| `stella feeds snapshot` | Create/list/export/import feed snapshots | Implemented |
|
||
| `stella advisory` | Advisory listing and search | Implemented |
|
||
| `stella admin feeds` | Feed management (admin) | Implemented |
|
||
|
||
### UI Routes (Advisory)
|
||
|
||
| Route | Feature | Status |
|
||
|-------|---------|--------|
|
||
| `/concelier/trivy-db-settings` | Trivy vulnerability database configuration | Implemented |
|
||
| `/ops/feeds` | Feed mirror dashboard and air-gap bundles | Implemented |
|
||
|
||
### Key Implementation Details
|
||
|
||
**Source Precedence (Lower = Higher Priority):**
|
||
- **Rank 0:** redhat, ubuntu, debian, suse, alpine (distro PSIRTs)
|
||
- **Rank 1:** msrc, oracle, adobe, apple, cisco, vmware (vendor PSIRTs)
|
||
- **Rank 2:** ghsa, osv (ecosystem registries)
|
||
- **Rank 3:** jvn, acsc, cccs, cert-fr, cert-in, certbund, ru-bdu, kisa (regional CERTs)
|
||
- **Rank 4:** kev (exploit annotations)
|
||
- **Rank 5:** nvd (baseline)
|
||
|
||
**Version Comparators:**
|
||
- NEVRA (RPM): epoch:version-release with rpmvercmp
|
||
- EVR (Debian/Ubuntu): epoch:upstream_version-debian_revision
|
||
- APK (Alpine): `-r<pkgrel>` with suffix ordering
|
||
|
||
### Coverage Gaps (Advisory)
|
||
|
||
| Feature | Has CLI | Has UI | Notes |
|
||
|---------|---------|--------|-------|
|
||
| Advisory Merge Engine | Yes | No | Consider merge status UI |
|
||
| Custom Connectors | No | No | Enterprise feature - needs admin UI |
|
||
| Feed Scheduling | No | Partial | Consider `stella feeds schedule` command |
|
||
|
||
---
|
||
|
||
## VEX Processing (Excititor, VexLens, VexHub, IssuerDirectory)
|
||
|
||
| Feature | Tiers | Module | Key Files | CLI | UI | Status |
|
||
|---------|-------|--------|-----------|-----|----|----|
|
||
| OpenVEX Format Support | Free/Pro/Ent | Excititor | `Formats.OpenVEX/`, `OpenVexParser.cs` | `stella vex` | `/vex` | Implemented |
|
||
| CycloneDX VEX Format | Free/Pro/Ent | Excititor | `Formats.CycloneDX/` | `stella vex` | `/vex` | Implemented |
|
||
| CSAF Format Support | Free/Pro/Ent | Excititor | `Formats.CSAF/` | `stella vex` | `/vex` | Implemented |
|
||
| VEX Ingestion API | Free/Pro/Ent | Excititor | `IngestEndpoints.cs`, `IVexObservationQueryService.cs` | - | `/vex` | Implemented |
|
||
| VEX Observation Store | Free/Pro/Ent | Excititor | `VexObservationQueryService.cs`, AOC-compliant storage | - | - | Implemented |
|
||
| VEX Consensus Engine | Pro/Ent | VexLens | `VexConsensusEngine.cs`, `IVexConsensusEngine.cs` | `stella vex consensus` | `/vex` | Implemented |
|
||
| Trust Weight Scoring | Pro/Ent | VexLens | `ITrustWeightEngine.cs`, `TrustDecayService.cs` | - | `/vex` | Implemented |
|
||
| Issuer Trust Registry | Pro/Ent | IssuerDirectory | Full issuer CRUD and key management | - | `/issuer-directory` | Implemented |
|
||
| VEX Distribution Hub | Enterprise | VexHub | `IVexIngestionService.cs`, `IVexExportService.cs` | - | - | Implemented |
|
||
| VEX Gate Integration | Pro/Ent | Scanner | `IVexGateService.cs`, `VexGateScanCommandGroup.cs` | `stella scan gate-policy` | `/findings` | Implemented |
|
||
| VEX from Drift Generation | Pro/Ent | CLI | `VexGenCommandGroup.cs` | `stella vex gen --from-drift` | - | Implemented |
|
||
| Conflict Detection | Pro/Ent | VexLens, Excititor | `VexLinksetDisagreementService.cs`, `NoiseGateService.cs` | - | `/vex` | Implemented |
|
||
|
||
### CSAF Provider Connectors
|
||
|
||
| Connector | Module | Key Files | CLI | Status |
|
||
|-----------|--------|-----------|-----|--------|
|
||
| Red Hat CSAF | Excititor | `Connectors.RedHat.CSAF/` | - | Implemented |
|
||
| Ubuntu CSAF | Excititor | `Connectors.Ubuntu.CSAF/` | - | Implemented |
|
||
| Oracle CSAF | Excititor | `Connectors.Oracle.CSAF/` | - | Implemented |
|
||
| Microsoft MSRC CSAF | Excititor | `Connectors.MSRC.CSAF/` | - | Implemented |
|
||
| Cisco CSAF | Excititor | `Connectors.Cisco.CSAF/` | - | Implemented |
|
||
| SUSE RancherVEXHub | Excititor | `Connectors.SUSE.RancherVEXHub/` | - | Implemented |
|
||
| OCI OpenVEX Attestation | Excititor | `Connectors.OCI.OpenVEX.Attest/` | - | Implemented |
|
||
|
||
### CLI Commands (VEX)
|
||
|
||
| Command | Description | Status |
|
||
|---------|-------------|--------|
|
||
| `stella vex consensus` | Query VexLens consensus (--query, --output json/ndjson/table) | Implemented |
|
||
| `stella vex get` | Fetch single consensus record with rationale | Implemented |
|
||
| `stella vex simulate` | Test VEX policy decisions (aggregation-only) | Implemented |
|
||
| `stella vex gen --from-drift` | Generate VEX from container drift analysis | Implemented |
|
||
| `stella scan gate-policy` | VEX gate evaluation for findings | Implemented |
|
||
|
||
### UI Routes (VEX)
|
||
|
||
| Route | Feature | Status |
|
||
|-------|---------|--------|
|
||
| `/vex` | VEX consensus and statement browser | Implemented |
|
||
| `/issuer-directory` | Issuer trust registry management | Implemented |
|
||
| `/findings` (VEX overlay) | VEX status overlay on findings | Implemented |
|
||
|
||
### Key Implementation Details
|
||
|
||
**Consensus Lattice States:**
|
||
- `unknown` (0.00) - No information
|
||
- `under_investigation` (0.25) - Being analyzed
|
||
- `not_affected` (0.50) - Confirmed not vulnerable
|
||
- `affected` (0.75) - Confirmed vulnerable
|
||
- `fixed` (1.00) - Patch applied
|
||
|
||
**Trust Weight Factors (9 total):**
|
||
1. Issuer tier (critical/high/medium/low)
|
||
2. Confidence score (0-1)
|
||
3. Cryptographic attestation status
|
||
4. Statement age (freshness decay)
|
||
5. Patch applicability
|
||
6. Source authority scope (PURL patterns)
|
||
7. Key lifecycle status
|
||
8. Justification quality
|
||
9. Historical accuracy
|
||
|
||
**AOC (Aggregation-Only Contract):**
|
||
- Raw VEX stored verbatim with provenance
|
||
- No derived data at ingest time
|
||
- Linkset-only references
|
||
- Roslyn analyzers enforce compliance
|
||
|
||
**Determinism Guarantees:**
|
||
- RFC 8785 canonical JSON serialization
|
||
- Stable ordering (timestamp DESC, source ASC, hash ASC)
|
||
- UTC ISO-8601 timestamps
|
||
- SHA-256 consensus digests
|
||
|
||
### Coverage Gaps (VEX)
|
||
|
||
| Feature | Has CLI | Has UI | Notes |
|
||
|---------|---------|--------|-------|
|
||
| CSAF Provider Connectors | No | No | Internal connector management |
|
||
| Trust Weight Configuration | No | Partial | Consider CLI for trust weight tuning |
|
||
| VEX Distribution Webhooks | No | No | VexHub webhook config needs exposure |
|
||
| Conflict Resolution UI | No | Partial | Interactive conflict resolution would help |
|
||
|
||
---
|
||
|
||
## Policy Engine (Policy, RiskEngine)
|
||
|
||
| Feature | Tiers | Module | Key Files | CLI | UI | Status |
|
||
|---------|-------|--------|-----------|-----|----|----|
|
||
| K4 Lattice Logic | Pro/Ent | Policy | `K4Lattice.cs`, `TrustLatticeEngine.cs` | - | `/policy` | Implemented |
|
||
| Policy Gate Evaluation | Free/Pro/Ent | Policy | `PolicyGateEvaluator.cs`, `IPolicyGate.cs` | `stella policy simulate` | `/policy` | Implemented |
|
||
| Evidence Gate | Free/Pro/Ent | Policy | `EvidenceGate.cs` | - | `/policy` | Implemented |
|
||
| VEX Trust Gate | Pro/Ent | Policy | `VexTrustGate.cs`, `VexProofSpineService.cs` | - | `/policy` | Implemented |
|
||
| Confidence Gate | Pro/Ent | Policy | `MinimumConfidenceGate.cs` | - | `/policy` | Implemented |
|
||
| Exception Management | Pro/Ent | Policy | `IExceptionService.cs`, `ExceptionAdapter.cs` | - | `/policy/exceptions` | Implemented |
|
||
| Risk Scoring (6 providers) | Pro/Ent | RiskEngine | `IRiskScoreProvider.cs`, `CvssKevProvider.cs` | - | `/risk` | Implemented |
|
||
| Verdict Attestations | Enterprise | Policy | `IVerdictAttestationService.cs`, `IPolicyDecisionAttestationService.cs` | - | - | Implemented |
|
||
| Policy Simulation | Pro/Ent | Policy | `IPolicySimulationService.cs` | `stella policy simulate` | `/policy/simulate` | Implemented |
|
||
| Sealed Mode (Air-Gap) | Enterprise | Policy | `ISealedModeService.cs` | - | `/ops` | Implemented |
|
||
| Determinization System | Pro/Ent | Policy | `UncertaintyScoreCalculator.cs`, `DecayedConfidenceCalculator.cs` | - | - | Implemented |
|
||
| Score Policy (YAML) | Pro/Ent | Policy | `ScorePolicyService.cs`, `ScorePolicyModels.cs` | `stella policy validate` | `/policy` | Implemented |
|
||
|
||
### K4 Lattice (Belnap Four-Valued Logic)
|
||
|
||
| State | Symbol | Description |
|
||
|-------|--------|-------------|
|
||
| Unknown | ⊥ | No evidence available |
|
||
| True | T | Evidence supports true |
|
||
| False | F | Evidence supports false |
|
||
| Conflict | ⊤ | Credible evidence for both (contested) |
|
||
|
||
**Operations:**
|
||
- `Join(a, b)` - Knowledge union (monotone aggregation)
|
||
- `Meet(a, b)` - Knowledge intersection (dependency chains)
|
||
- `Negate(v)` - Swaps True ↔ False
|
||
- `FromSupport(hasTrueSupport, hasFalseSupport)` - Constructs K4 from claims
|
||
|
||
### Policy Gate Types (10+)
|
||
|
||
| Gate | Purpose |
|
||
|------|---------|
|
||
| Evidence Gate | Validates sufficient evidence backing |
|
||
| Lattice State Gate | K4 states (U, SR, SU, RO, RU, CR, CU, X) |
|
||
| VEX Trust Gate | Confidence-based VEX scoring |
|
||
| Uncertainty Tier Gate | T1-T4 uncertainty classification |
|
||
| Minimum Confidence Gate | Enforces confidence floors |
|
||
| Evidence Freshness Gate | Staleness checks |
|
||
| VEX Proof Gate | Validates VEX proof chains |
|
||
| Reachability Requirement Gate | Reachability evidence |
|
||
| Facet Quota Gate | Facet-based quotas |
|
||
| Source Quota Gate | Source credibility quotas |
|
||
| Unknowns Budget Gate | Limits unknown assertions |
|
||
|
||
### Risk Score Providers (6)
|
||
|
||
| Provider | Key Files | Purpose |
|
||
|----------|-----------|---------|
|
||
| CVSS/KEV | `CvssKevProvider.cs` | CVSS + Known Exploited Vulns |
|
||
| EPSS | `EpssProvider.cs` | Exploit Prediction Scoring |
|
||
| FixChain | `FixChainRiskProvider.cs` | Fix availability and timeline |
|
||
| FixExposure | `FixExposureProvider.cs` | Patch adoption curves |
|
||
| VexGate | `VexGateProvider.cs` | VEX decisions as risk gates |
|
||
| DefaultTransforms | `DefaultTransformsProvider.cs` | Signal normalization |
|
||
|
||
### Determinization Signal Weights
|
||
|
||
| Signal | Weight |
|
||
|--------|--------|
|
||
| VEX | 35% |
|
||
| Reachability | 25% |
|
||
| Runtime | 15% |
|
||
| EPSS | 10% |
|
||
| Backport | 10% |
|
||
| SBOM Lineage | 5% |
|
||
|
||
### Score Policy Weights (Basis Points)
|
||
|
||
| Dimension | Default Weight |
|
||
|-----------|---------------|
|
||
| Base Severity | 10% (1000 BPS) |
|
||
| Reachability | 45% (4500 BPS) |
|
||
| Evidence | 30% (3000 BPS) |
|
||
| Provenance | 15% (1500 BPS) |
|
||
|
||
### CLI Commands (Policy)
|
||
|
||
| Command | Description | Status |
|
||
|---------|-------------|--------|
|
||
| `stella policy validate <path>` | Validate policy YAML (--schema, --strict) | Implemented |
|
||
| `stella policy install <pack>` | Install policy pack (--version, --env) | Implemented |
|
||
| `stella policy list` | List installed policies | Implemented |
|
||
| `stella policy simulate` | Simulate policy decisions | Implemented |
|
||
|
||
### UI Routes (Policy)
|
||
|
||
| Route | Feature | Status |
|
||
|-------|---------|--------|
|
||
| `/policy` | Policy management and evaluation | Implemented |
|
||
| `/policy/exceptions` | Exception management | Implemented |
|
||
| `/policy/simulate` | Policy simulation runner | Implemented |
|
||
| `/risk` | Risk scoring dashboard | Implemented |
|
||
|
||
### API Endpoints (45+)
|
||
|
||
**Core:**
|
||
- `/policy/eval/batch` - Batch evaluation
|
||
- `/policy/packs` - Policy pack management
|
||
- `/policy/runs` - Run lifecycle
|
||
- `/policy/decisions` - Decision queries
|
||
|
||
**Simulation:**
|
||
- `/policy/simulate` - Policy simulation
|
||
- `/policy/merge-preview` - Merge preview
|
||
- `/overlay-simulation` - Overlay projection
|
||
|
||
**Governance:**
|
||
- `/api/v1/policy/registry/packs` - Pack registry
|
||
- `/api/v1/policy/registry/promote` - Promotion workflows
|
||
- `/api/v1/policy/registry/publish` - Publishing pipelines
|
||
|
||
### Coverage Gaps (Policy)
|
||
|
||
| Feature | Has CLI | Has UI | Notes |
|
||
|---------|---------|--------|-------|
|
||
| K4 Lattice Debug | No | Partial | Consider `stella policy lattice explain` |
|
||
| Risk Provider Config | No | No | Provider-level configuration needs exposure |
|
||
| Exception Approval API | No | Yes | Consider `stella policy exception approve` |
|
||
| Determinization Tuning | No | No | Signal weights should be configurable |
|
||
|
||
---
|
||
|
||
## Attestation & Signing (Attestor, Signer, Provenance)
|
||
|
||
| Feature | Tiers | Module | Key Files | CLI | UI | Status |
|
||
|---------|-------|--------|-----------|-----|----|----|
|
||
| DSSE Envelope Handling | Free/Pro/Ent | Attestor | `DsseHelper.cs`, `DsseEnvelope.cs`, `DsseVerifier.cs` | `stella attest` | `/attestations` | Implemented |
|
||
| In-Toto Statement Format | Free/Pro/Ent | Attestor | `InTotoStatement.cs`, `IInTotoLinkSigningService.cs` | `stella attest attach` | - | Implemented |
|
||
| SPDX SBOM Predicates | Free/Pro/Ent | Attestor | `SpdxPredicateParser.cs` | `stella attest attach` | - | Implemented |
|
||
| CycloneDX SBOM Predicates | Free/Pro/Ent | Attestor | `CycloneDxPredicateParser.cs` | `stella attest attach` | - | Implemented |
|
||
| SLSA Provenance Predicates | Pro/Ent | Attestor | `SlsaProvenancePredicateParser.cs` | `stella attest attach` | - | Implemented |
|
||
| Keyless Signing (Fulcio) | Pro/Ent | Signer | `KeylessDsseSigner.cs`, `HttpFulcioClient.cs` | `stella sign keyless` | - | Implemented |
|
||
| Rekor Transparency Log | Pro/Ent | Signer, Attestor | `RekorHttpClient.cs`, `IRekorClient.cs` | `stella sign keyless --rekor` | - | Implemented |
|
||
| Key Rotation Service | Enterprise | Signer | `IKeyRotationService.cs`, `KeyRotationService.cs` | `/keys/rotate` endpoint | - | Implemented |
|
||
| Trust Anchor Management | Enterprise | Signer | `ITrustAnchorManager.cs`, `TrustAnchorManager.cs` | - | - | Implemented |
|
||
| Attestation Chains | Enterprise | Attestor | `AttestationChain.cs`, `AttestationChainBuilder.cs` | - | - | Implemented |
|
||
| Delta Attestations | Pro/Ent | Attestor | `IDeltaAttestationService.cs` (VEX/SBOM/Verdict/Reachability) | - | - | Implemented |
|
||
| Offline/Air-Gap Bundles | Enterprise | Attestor | `IAttestorBundleService.cs` | - | `/ops/offline-kit` | Implemented |
|
||
|
||
### Predicate Types (25+ Types)
|
||
|
||
**Standard Predicates:**
|
||
| Predicate | Parser | Purpose |
|
||
|-----------|--------|---------|
|
||
| SPDX | `SpdxPredicateParser.cs` | SBOM attestation (2.2/2.3/3.0.1) |
|
||
| CycloneDX | `CycloneDxPredicateParser.cs` | SBOM attestation (1.7) |
|
||
| SLSA Provenance | `SlsaProvenancePredicateParser.cs` | Build provenance (v1.0) |
|
||
| VEX Override | `VexOverridePredicateParser.cs` | VEX decision overrides |
|
||
| Binary Diff | `BinaryDiffPredicateBuilder.cs` | Binary change attestation |
|
||
|
||
**Stella-Ops Specific Predicates:**
|
||
- AIArtifactBasePredicate, AIAuthorityClassifier, AIExplanationPredicate
|
||
- AIPolicyDraftPredicate, AIRemediationPlanPredicate, AIVexDraftPredicate
|
||
- BinaryFingerprintEvidencePredicate, BudgetCheckPredicate, ChangeTracePredicate
|
||
- DeltaVerdictPredicate, EvidencePredicate, PolicyDecisionPredicate
|
||
- ProofSpinePredicate, ReachabilityDriftPredicate, ReachabilitySubgraphPredicate
|
||
- SbomDeltaPredicate, UnknownsBudgetPredicate, VerdictDeltaPredicate
|
||
- VexDeltaPredicate, VexPredicate, TrustVerdictPredicate, FixChainPredicate
|
||
|
||
### CLI Commands (Attestation & Signing)
|
||
|
||
| Command | Description | Status |
|
||
|---------|-------------|--------|
|
||
| `stella attest attach` | Attach DSSE attestation to OCI artifact | Implemented |
|
||
| `stella attest verify` | Verify attestations on OCI artifact | Implemented |
|
||
| `stella attest list` | List attestations on OCI artifact | Implemented |
|
||
| `stella attest fetch` | Fetch specific attestation by predicate type | Implemented |
|
||
| `stella attest fix-chain` | FixChain attestation command | Implemented |
|
||
| `stella attest patch` | Patch attestation command | Implemented |
|
||
| `stella sign keyless` | Sigstore keyless signing | Implemented |
|
||
| `stella sign verify-keyless` | Verify keyless signature | Implemented |
|
||
|
||
### Signing Modes
|
||
|
||
| Mode | Description | Key Files |
|
||
|------|-------------|-----------|
|
||
| Keyless | Fulcio-based ephemeral keys | `KeylessDsseSigner.cs` |
|
||
| KMS | External key management system | `CryptoDsseSigner.cs` |
|
||
| HMAC | HMAC-based signing | `HmacDsseSigner.cs` |
|
||
|
||
### Crypto Algorithm Support
|
||
|
||
| Algorithm | Files | Purpose |
|
||
|-----------|-------|---------|
|
||
| RSA | `CryptoDsseSigner.cs` | Traditional RSA signing |
|
||
| ECDSA | `CryptoDsseSigner.cs` | Elliptic curve signing |
|
||
| SM2 | `CryptoDsseSigner.cs` | Chinese national standard |
|
||
|
||
### API Endpoints (Attestor)
|
||
|
||
| Endpoint | Purpose |
|
||
|----------|---------|
|
||
| `/api/v1/anchors` | Attestation anchors |
|
||
| `/api/v1/bundles` | DSSE bundle operations |
|
||
| `/api/v1/chains` | Attestation chain queries |
|
||
| `/api/v1/proofs` | Proof operations |
|
||
| `/api/v1/verify` | Verification endpoints |
|
||
|
||
### API Endpoints (Signer)
|
||
|
||
| Endpoint | Purpose |
|
||
|----------|---------|
|
||
| `POST /sign` | Sign artifact |
|
||
| `POST /sign/verify` | Verify signature |
|
||
| `GET /keys` | List signing keys |
|
||
| `POST /keys/rotate` | Rotate signing key |
|
||
| `POST /keys/revoke` | Revoke signing key |
|
||
|
||
### Coverage Gaps (Attestation)
|
||
|
||
| Feature | Has CLI | Has UI | Notes |
|
||
|---------|---------|--------|-------|
|
||
| Key Rotation | No (API only) | No | Add `stella keys rotate` CLI |
|
||
| Trust Anchor Management | No | No | Consider trust anchor CLI |
|
||
| Attestation Chains UI | No | Partial | Chain visualization needed |
|
||
| Predicate Registry | No | No | Consider `stella attest predicates list` |
|
||
|
||
---
|
||
|
||
## Regional Crypto (Cryptography, SmRemote)
|
||
|
||
| Feature | Tiers | Module | Key Files | CLI | UI | Status |
|
||
|---------|-------|--------|-----------|-----|----|----|
|
||
| EdDSA (Ed25519) Baseline | Free/Pro/Ent | Cryptography | `Ed25519Signer.cs`, `Ed25519Verifier.cs` | - | - | Implemented |
|
||
| ECDSA P-256 (FIPS) | Pro/Ent | Cryptography | `EcdsaP256Signer.cs` | - | - | Implemented |
|
||
| FIPS 140-2 Plugin | Enterprise | Cryptography | `FipsPlugin.cs` (RSA, ECDSA, AES) | - | - | Implemented |
|
||
| GOST R 34.10-2012 Plugin | Enterprise | Cryptography | `GostPlugin.cs` (256/512-bit) | - | - | Implemented |
|
||
| SM2/SM3/SM4 Plugin | Enterprise | Cryptography | `SmPlugin.cs` | - | - | Implemented |
|
||
| eIDAS Plugin | Enterprise | Cryptography | `EidasPlugin.cs` (CAdES, RFC 3161) | - | - | Implemented |
|
||
| HSM Plugin (PKCS#11) | Enterprise | Cryptography | `HsmPlugin.cs` | - | - | Implemented |
|
||
| CryptoPro GOST | Enterprise | Cryptography | `CryptoProGostCryptoProvider.cs` (Windows) | - | - | Implemented |
|
||
| SM Remote Service | Enterprise | SmRemote | `Program.cs` (SM2 signing service) | - | - | Implemented |
|
||
| Multi-Profile Signing | Enterprise | Cryptography | `MultiProfileSigner.cs` | - | - | Implemented |
|
||
| Post-Quantum (Defined) | Future | Cryptography | `SignatureProfile.cs` (Dilithium, Falcon) | - | - | Planned |
|
||
|
||
### Signature Profiles (8 Defined)
|
||
|
||
| Profile | Standard | Algorithm | Status |
|
||
|---------|----------|-----------|--------|
|
||
| EdDsa | RFC 8032 | Ed25519 | Implemented |
|
||
| EcdsaP256 | FIPS 186-4 | ES256 | Implemented |
|
||
| RsaPss | FIPS 186-4, RFC 8017 | PS256/384/512 | Implemented |
|
||
| Gost2012 | GOST R 34.10-2012 | GOST 256/512-bit | Implemented |
|
||
| SM2 | GM/T 0003.2-2012 | SM2-SM3 | Implemented |
|
||
| Eidas | ETSI TS 119 312 | RSA-SHA*, ECDSA-SHA* | Implemented |
|
||
| Dilithium | NIST PQC | CRYSTALS-Dilithium | Planned |
|
||
| Falcon | NIST PQC | Falcon-512/1024 | Planned |
|
||
|
||
### Regional Compliance Matrix
|
||
|
||
| Region | Standard | Plugin | Algorithms |
|
||
|--------|----------|--------|------------|
|
||
| US | FIPS 140-2 | FipsPlugin | RSA-SHA*, ECDSA-P256/384/521, AES-GCM |
|
||
| Russia | GOST R 34.10-2012 | GostPlugin, CryptoPro | GOST 256/512-bit signatures |
|
||
| China | GM/T 0003-0004 | SmPlugin, SmRemote | SM2, SM3, SM4-CBC/GCM |
|
||
| EU | eIDAS | EidasPlugin | CAdES-BES, XAdES-BES, RFC 3161 TSA |
|
||
| Hardware | PKCS#11 | HsmPlugin | HSM-RSA, HSM-ECDSA, HSM-AES |
|
||
|
||
### Key Service Interfaces
|
||
|
||
| Interface | Purpose |
|
||
|-----------|---------|
|
||
| `IContentSigner` | Core signing abstraction |
|
||
| `IContentVerifier` | Signature verification |
|
||
| `ICryptoCapability` | Plugin capability reporting |
|
||
| `IHsmClient` | HSM abstraction (simulated/PKCS#11) |
|
||
|
||
### Plugin Configuration Options
|
||
|
||
**FIPS Plugin:**
|
||
- RequireFipsMode, RsaKeySize (2048-4096), EcdsaCurve (P-256/384/521)
|
||
|
||
**GOST Plugin:**
|
||
- KeyStorePath, DefaultKeyId, PrivateKeyBase64, KeySize (256/512)
|
||
|
||
**SM Plugin:**
|
||
- PrivateKeyHex, GenerateKeyOnInit, UserId
|
||
|
||
**eIDAS Plugin:**
|
||
- CertificatePath, TimestampAuthorityUrl, ValidateCertificateChain
|
||
|
||
**HSM Plugin:**
|
||
- LibraryPath, SlotId, Pin, TokenLabel
|
||
|
||
### Coverage Gaps (Regional Crypto)
|
||
|
||
| Feature | Has CLI | Has UI | Notes |
|
||
|---------|---------|--------|-------|
|
||
| Crypto Profile Selection | No | No | Configuration-only, no CLI |
|
||
| Key Management | No | No | Plugin-specific configuration |
|
||
| Post-Quantum Crypto | No | No | Profiles defined but not implemented |
|
||
| HSM Status | No | No | Consider health check endpoint |
|
||
|
||
---
|
||
|
||
## Evidence & Findings (EvidenceLocker, Findings, ExportCenter)
|
||
|
||
| Feature | Tiers | Module | Key Files | CLI | UI | Status |
|
||
|---------|-------|--------|-----------|-----|----|----|
|
||
| Sealed Evidence Bundles | Pro/Ent | EvidenceLocker | `S3EvidenceObjectStore.cs` (WORM) | `stella evidence export` | `/evidence-export` | Implemented |
|
||
| Verdict Attestations | Pro/Ent | EvidenceLocker | `VerdictEndpoints.cs`, `VerdictContracts.cs` | - | `/evidence-export` | Implemented |
|
||
| Append-Only Ledger | Pro/Ent | Findings | `ILedgerEventRepository.cs`, `LedgerEventModels.cs` | - | `/findings` | Implemented |
|
||
| Alert Triage Workflow | Pro/Ent | Findings | `DecisionModels.cs` (hot/warm/cold bands) | - | `/findings` | Implemented |
|
||
| Merkle Anchoring | Pro/Ent | Findings | `Infrastructure/Merkle/` | - | - | Implemented |
|
||
| Evidence Packs | Pro/Ent | Evidence.Pack | `IEvidencePackService.cs`, `EvidencePack.cs` | - | `/evidence-thread` | Implemented |
|
||
| Evidence Cards | Pro/Ent | Evidence.Pack | `IEvidenceCardService.cs`, `EvidenceCard.cs` | - | - | Implemented |
|
||
| Profile-Based Exports | Pro/Ent | ExportCenter | `ExportApiEndpoints.cs`, `ExportProfile` | - | `/evidence-export` | Implemented |
|
||
| Risk Bundle Export | Enterprise | ExportCenter | `RiskBundleEndpoints.cs` | - | `/evidence-export` | Implemented |
|
||
| Lineage Evidence Export | Enterprise | ExportCenter | `LineageExportEndpoints.cs` | - | `/lineage` | Implemented |
|
||
| Offline Verification | Enterprise | EvidenceLocker | `verify-offline.md` | `stella evidence verify --offline` | - | Implemented |
|
||
|
||
### CLI Commands (Evidence)
|
||
|
||
| Command | Description | Status |
|
||
|---------|-------------|--------|
|
||
| `stella evidence export` | Export evidence bundle (--bundle, --format, --compression) | Implemented |
|
||
| `stella evidence verify` | Verify bundle (--offline, --rekor-key) | Implemented |
|
||
| `stella evidence status` | Bundle status check | Implemented |
|
||
|
||
### UI Routes (Evidence)
|
||
|
||
| Route | Feature | Status |
|
||
|-------|---------|--------|
|
||
| `/evidence-export` | Evidence bundle management and export | Implemented |
|
||
| `/evidence-thread` | Evidence thread visualization | Implemented |
|
||
| `/findings` | Findings ledger with triage | Implemented |
|
||
|
||
---
|
||
|
||
## Determinism & Replay (Replay, Signals, HLC)
|
||
|
||
| Feature | Tiers | Module | Key Files | CLI | UI | Status |
|
||
|---------|-------|--------|-----------|-----|----|----|
|
||
| Hybrid Logical Clock | Pro/Ent | HybridLogicalClock | `HybridLogicalClock.cs`, `HlcTimestamp.cs` | - | - | Implemented |
|
||
| Canonical JSON (RFC 8785) | Pro/Ent | Canonical.Json | `CanonJson.cs` | - | - | Implemented |
|
||
| Replay Manifests (V1/V2) | Pro/Ent | Replay.Core | `ReplayManifest.cs`, `KnowledgeSnapshot.cs` | `stella scan replay` | - | Implemented |
|
||
| Evidence Weighted Scoring | Pro/Ent | Signals | `EvidenceWeightedScoreCalculator.cs` (6 factors) | - | - | Implemented |
|
||
| Timeline Events | Pro/Ent | Eventing | `TimelineEvent.cs`, `ITimelineEventEmitter.cs` | - | - | Implemented |
|
||
| Replay Proofs | Pro/Ent | Replay.Core | `ReplayProof.cs`, `ReplayManifestValidator.cs` | `stella prove` | - | Implemented |
|
||
| Deterministic Event IDs | Pro/Ent | Eventing | `EventIdGenerator.cs` (SHA-256 based) | - | - | Implemented |
|
||
| Attested Reduction | Pro/Ent | Signals | Short-circuit rules for anchored VEX | - | - | Implemented |
|
||
|
||
### Evidence Weighted Scoring (6 Factors)
|
||
|
||
| Factor | Symbol | Weight | Description |
|
||
|--------|--------|--------|-------------|
|
||
| Reachability | RCH | Configurable | Static/runtime reachability |
|
||
| Runtime | RTS | Configurable | Runtime telemetry |
|
||
| Backport | BKP | Configurable | Backport evidence |
|
||
| Exploit | XPL | Configurable | Exploit likelihood (EPSS) |
|
||
| Source Trust | SRC | Configurable | Feed trustworthiness |
|
||
| Mitigations | MIT | Configurable | Mitigation evidence (reduces score) |
|
||
|
||
### CLI Commands (Replay)
|
||
|
||
| Command | Description | Status |
|
||
|---------|-------------|--------|
|
||
| `stella scan replay` | Deterministic verdict reproduction | Implemented |
|
||
| `stella prove` | Generate replay proofs | Implemented |
|
||
| `stella verify --proof` | Verify replay proofs | Implemented |
|
||
|
||
---
|
||
|
||
## Operations (Scheduler, Orchestrator, TaskRunner, TimelineIndexer)
|
||
|
||
| Feature | Tiers | Module | Key Files | CLI | UI | Status |
|
||
|---------|-------|--------|-----------|-----|----|----|
|
||
| Job Scheduling | Pro/Ent | Scheduler | `IGraphJobService.cs`, `RunEndpoints.cs` | - | `/ops/scheduler` | Implemented |
|
||
| Impact Targeting | Pro/Ent | Scheduler | `IImpactIndex.cs` (Roaring bitmaps) | - | - | Implemented |
|
||
| Job Orchestration | Pro/Ent | Orchestrator | `IJobRepository.cs`, `Job.cs` | - | `/orchestrator` | Implemented |
|
||
| Dead Letter Queue | Pro/Ent | Orchestrator | `DeadLetterEntry.cs`, `DeadLetterEndpoints.cs` | - | `/orchestrator` | Implemented |
|
||
| Task Pack Execution | Pro/Ent | TaskRunner | `ITaskRunnerClient.cs`, `PackRunWorkerService.cs` | - | - | Implemented |
|
||
| Plan-Hash Binding | Pro/Ent | TaskRunner | Deterministic execution validation | - | - | Implemented |
|
||
| Timeline Indexing | Pro/Ent | TimelineIndexer | `ITimelineQueryService.cs`, `TimelineEventView.cs` | - | - | Implemented |
|
||
| Lease Management | Pro/Ent | Orchestrator | `LeaseNextAsync()`, `ExtendLeaseAsync()` | - | - | Implemented |
|
||
|
||
### API Endpoints (Operations)
|
||
|
||
**Scheduler:**
|
||
- `POST /api/v1/scheduler/runs` - Create run
|
||
- `GET /api/v1/scheduler/runs/{runId}/stream` - SSE stream
|
||
- `POST /api/v1/scheduler/runs/preview` - Dry-run preview
|
||
|
||
**Orchestrator:**
|
||
- `GET /api/v1/orchestrator/jobs` - List jobs
|
||
- `GET /api/v1/orchestrator/dag` - Job DAG
|
||
- `GET /api/v1/orchestrator/deadletter` - Dead letter queue
|
||
- `GET /api/v1/orchestrator/kpi` - KPI metrics
|
||
|
||
**TaskRunner:**
|
||
- `POST /api/runs` - Create pack run
|
||
- `GET /api/runs/{runId}/logs` - SSE log stream
|
||
- `POST /api/runs/{runId}/approve` - Approval decision
|
||
|
||
### UI Routes (Operations)
|
||
|
||
| Route | Feature | Status |
|
||
|-------|---------|--------|
|
||
| `/ops/scheduler` | Scheduler runs and impact preview | Implemented |
|
||
| `/orchestrator` | Job dashboard and dead letters | Implemented |
|
||
|
||
---
|
||
|
||
## Release Orchestration (ReleaseOrchestrator)
|
||
|
||
| Feature | Tiers | Module | Key Files | CLI | UI | Status |
|
||
|---------|-------|--------|-----------|-----|----|----|
|
||
| Promotion Workflows | Enterprise | ReleaseOrchestrator | `GateModels.cs`, `StepModels.cs` | - | `/releases` | Implemented |
|
||
| Integration Hub | Enterprise | ReleaseOrchestrator | `IIntegrationManager.cs` | - | `/integrations` | Implemented |
|
||
| Deployment Agents | Enterprise | Agent.Core | `IAgentCapability.cs`, `ComposeCapability.cs` | - | - | Implemented |
|
||
| Plugin System (3-Surface) | Enterprise | ReleaseOrchestrator.Plugin | `IStepProviderCapability.cs`, `IGateProviderCapability.cs` | - | `/plugins` | Implemented |
|
||
| Gate Evaluation | Enterprise | ReleaseOrchestrator | `IGateEvaluator.cs` | - | `/releases` | Implemented |
|
||
| Step Execution | Enterprise | ReleaseOrchestrator | `IStepExecutor.cs` | - | - | Implemented |
|
||
| Connector Invoker | Enterprise | ReleaseOrchestrator | `IConnectorInvoker.cs` | - | - | Implemented |
|
||
|
||
### Integration Types
|
||
|
||
| Type | Description | Examples |
|
||
|------|-------------|----------|
|
||
| Scm | Source Control | GitHub, GitLab, Gitea |
|
||
| Ci | Continuous Integration | Jenkins, GitHub Actions |
|
||
| Registry | Container Registry | Docker Hub, Harbor, ACR, ECR, GCR |
|
||
| Vault | Secrets | HashiCorp Vault, Azure Key Vault |
|
||
| Notify | Notifications | Slack, Teams, Email, Webhooks |
|
||
| SettingsStore | Config | Consul, etcd, Parameter Store |
|
||
|
||
### Deployment Agent Types
|
||
|
||
| Agent | Key Files | Tasks |
|
||
|-------|-----------|-------|
|
||
| Docker Compose | `ComposeCapability.cs` | pull, up, down, scale, health-check, ps |
|
||
| SSH/WinRM | (planned) | Remote execution |
|
||
| ECS | (planned) | AWS ECS deployment |
|
||
| Nomad | (planned) | HashiCorp Nomad |
|
||
|
||
---
|
||
|
||
## Auth & Access Control (Authority, Registry)
|
||
|
||
| Feature | Tiers | Module | Key Files | CLI | UI | Status |
|
||
|---------|-------|--------|-----------|-----|----|----|
|
||
| OAuth2/OIDC Token Service | Free/Pro/Ent | Authority | `IStellaOpsTokenClient.cs` | `stella auth` | `/login` | Implemented |
|
||
| DPoP (Proof-of-Possession) | Pro/Ent | Authority | DPoP header injection | - | - | Implemented |
|
||
| mTLS Certificate Binding | Enterprise | Authority | `cnf.x5t#S256` tokens | - | - | Implemented |
|
||
| 75+ Authorization Scopes | Pro/Ent | Authority | `StellaOpsScopes.cs` | - | - | Implemented |
|
||
| Registry Token Service | Pro/Ent | Registry | `RegistryTokenIssuer.cs` | - | - | Implemented |
|
||
| Plan-Based Authorization | Pro/Ent | Registry | `PlanRegistry.cs` | - | - | Implemented |
|
||
| LDAP Integration | Enterprise | Authority.Plugin.Ldap | LDAP connector | - | `/admin` | Implemented |
|
||
| Device Code Flow | Pro/Ent | Authority | CLI headless login | `stella auth login` | - | Implemented |
|
||
|
||
### Authentication Flows
|
||
|
||
| Flow | Use Case |
|
||
|------|----------|
|
||
| Client Credentials | Service-to-service |
|
||
| Device Code | CLI headless login |
|
||
| Authorization Code + PKCE | Web UI browser login |
|
||
| DPoP Handshake | Proof-of-possession for all API calls |
|
||
|
||
### Scope Categories
|
||
|
||
| Category | Example Scopes |
|
||
|----------|---------------|
|
||
| Signer | `signer.sign` |
|
||
| Scanner | `scanner:scan`, `scanner:export` |
|
||
| VEX | `vex:read`, `vex:ingest` |
|
||
| Policy | `policy:author`, `policy:approve`, `policy:publish` |
|
||
| Authority Admin | `authority:tenants.write`, `authority:roles.write` |
|
||
|
||
---
|
||
|
||
## Notifications & Integrations (Notify, Notifier, Integrations, Zastava)
|
||
|
||
| Feature | Tiers | Module | Key Files | CLI | UI | Status |
|
||
|---------|-------|--------|-----------|-----|----|----|
|
||
| Multi-Channel Notifications | Pro/Ent | Notify | `NotifyChannel.cs`, `NotifyEvent.cs` | - | `/notifications` | Implemented |
|
||
| Rule-Based Routing | Pro/Ent | Notify | `NotifyRule.cs`, `INotifyRuleEvaluator.cs` | - | `/notifications` | Implemented |
|
||
| Incident Correlation | Pro/Ent | Notifier | `ICorrelationEngine.cs` | - | `/incidents` | Implemented |
|
||
| Escalation Policies | Pro/Ent | Notifier | `EscalationEndpoints.cs` | - | `/notifications` | Implemented |
|
||
| Storm Breaker | Pro/Ent | Notifier | `StormBreakerEndpoints.cs` | - | - | Implemented |
|
||
| External Integrations | Enterprise | Integrations | `IIntegrationConnectorPlugin.cs` | - | `/integrations` | Implemented |
|
||
| Kubernetes Admission | Enterprise | Zastava | `AdmissionEndpoint.cs`, `AdmissionDecision.cs` | - | - | Implemented |
|
||
| Runtime Event Collection | Enterprise | Zastava | `RuntimeEvent.cs`, `RuntimeEventFactory.cs` | - | - | Implemented |
|
||
|
||
### Notification Channels (10 Types)
|
||
|
||
| Channel | Adapter | Status |
|
||
|---------|---------|--------|
|
||
| Slack | `SlackChannelAdapter.cs` | Implemented |
|
||
| Teams | `ChatWebhookChannelAdapter.cs` | Implemented |
|
||
| Email | `EmailChannelAdapter.cs` | Implemented |
|
||
| Webhook | `ChatWebhookChannelAdapter.cs` | Implemented |
|
||
| PagerDuty | `PagerDutyChannelAdapter.cs` | Implemented |
|
||
| OpsGenie | `OpsGenieChannelAdapter.cs` | Implemented |
|
||
| CLI | `CliChannelAdapter.cs` | Implemented |
|
||
| InApp | `InAppChannelAdapter.cs` | Implemented |
|
||
| InAppInbox | `InAppInboxChannelAdapter.cs` | Implemented |
|
||
| Custom | Plugin-based | Implemented |
|
||
|
||
### Runtime Event Types (Zastava)
|
||
|
||
| Event Kind | Description |
|
||
|------------|-------------|
|
||
| ContainerStart | Container lifecycle start |
|
||
| ContainerStop | Container lifecycle stop |
|
||
| Drift | Filesystem/binary changes |
|
||
| PolicyViolation | Policy rule breach |
|
||
| AttestationStatus | Signature/attestation verification |
|
||
|
||
---
|
||
|
||
## Summary Statistics
|
||
|
||
| Category | Count |
|
||
|----------|-------|
|
||
| Total Features in Matrix | ~200 original |
|
||
| Discovered Features | 200+ additional |
|
||
| CLI Commands | 80+ |
|
||
| UI Routes | 75+ |
|
||
| API Endpoints | 500+ |
|
||
| Service Interfaces | 300+ |
|
||
| Language Analyzers | 11+ |
|
||
| Advisory Connectors | 33+ |
|
||
| Notification Channels | 10 |
|
||
| Crypto Profiles | 8 |
|
||
| Policy Gate Types | 10+ |
|
||
| Risk Score Providers | 6 |
|
||
| Attestation Predicates | 25+ |
|
||
|
||
---
|
||
|
||
*Document generated via automated feature extraction from Stella Ops codebase (20,723+ .cs files across 1,024 projects)*
|