540 lines
36 KiB
Markdown
540 lines
36 KiB
Markdown
## Pack 19 — Security consolidated around **release decisions + audit outputs** (preserving all PoC screens; reachability stays 2nd‑class)
|
||
|
||
Below:
|
||
|
||
1. **Security menu graph (Mermaid)**
|
||
2. For **each screen**:
|
||
|
||
* **Formerly** (old name/location)
|
||
* **Why moved/reshaped**
|
||
* **Screen navigation graph (Mermaid)**
|
||
* **ASCII mock**
|
||
|
||
---
|
||
|
||
# 19.1 Security menu graph (Mermaid)
|
||
|
||
This keeps every PoC screen, but organizes them in a “Stella Ops” order: **decision‑centric first**, then exploration, then data backends, then attestations/waivers.
|
||
|
||
```mermaid
|
||
flowchart TD
|
||
SEC[Security (ROOT)] --> SEC_OV[Risk Overview]
|
||
SEC --> SEC_FIND[Findings Explorer]
|
||
SEC --> SEC_VULN[Vulnerabilities Explorer]
|
||
SEC --> SEC_SBOM[SBOM Data]
|
||
SEC_SBOM --> SEC_LAKE[SBOM Lake]
|
||
SEC_SBOM --> SEC_GRAPH[SBOM Graph]
|
||
SEC --> SEC_VEX[VEX & Exceptions]
|
||
SEC_VEX --> SEC_VEXH[VEX Hub]
|
||
SEC_VEX --> SEC_EXC[Exceptions]
|
||
|
||
%% Cross-links (no duplication)
|
||
SEC_OV -. "data confidence" .-> OPS_DI[Ops: Data Integrity]
|
||
SEC_FIND -. "open env" .-> RC_ENV[Release Control: Env Detail]
|
||
SEC_FIND -. "open bundle version" .-> BVER[Bundles: Bundle Version Detail]
|
||
SEC_FIND -. "export decision pack" .-> EVID[Evidence: Export Center]
|
||
SEC_VULN -. "graph" .-> SEC_GRAPH
|
||
SEC_EXC -. "approval gating" .-> APPR[Approvals]
|
||
SEC_VEXH -. "issuer trust" .-> TRUST[Evidence: Trust & Signing]
|
||
```
|
||
|
||
**Key consolidation rule:**
|
||
|
||
* **Findings** = “what is actually present in a specific env/bundle/digest, and is it reachable?”
|
||
* **Vulnerabilities** = “the CVE/catalog view (global), then drill down to where it hits.”
|
||
* **SBOM Lake/Graph** = storage/exploration backends (kept, but demoted under “SBOM Data”).
|
||
* **VEX/Exceptions** = disposition/waiver layer tied to approvals and audit.
|
||
|
||
---
|
||
|
||
# 19.2 Security screen — Risk Overview
|
||
|
||
### Formerly
|
||
|
||
* **Security → Overview** (`security overview.png`)
|
||
(cards and summary, not tightly tied to env/bundle decision outcomes)
|
||
|
||
### Why changed like this
|
||
|
||
This becomes the security commander’s “brief”: **what blocks promotions**, **which envs have critical reachable**, **SBOM freshness/coverage**, **VEX/exceptions posture**, and **data confidence** (feeds/jobs/integrations).
|
||
|
||
Reachability is **not** promoted to a top-level area; it appears as:
|
||
|
||
* summary metrics
|
||
* filters
|
||
* drilldowns into Findings.
|
||
|
||
### Screen graph (Mermaid)
|
||
|
||
```mermaid
|
||
flowchart TD
|
||
A[Security: Risk Overview] --> B[Critical reachable by environment]
|
||
A --> C[Blocked approvals due to security]
|
||
A --> D[SBOM coverage & freshness summary]
|
||
A --> E[Top CVEs impacting deployed bundles]
|
||
A --> F[VEX coverage / exceptions expiring soon]
|
||
A --> G[Data Confidence banner -> Ops Data Integrity]
|
||
A --> H[Drilldowns -> Findings Explorer]
|
||
A --> I[Drilldowns -> Vulnerabilities Explorer]
|
||
```
|
||
|
||
### ASCII mock
|
||
|
||
```text
|
||
┌──────────────────────────────────────────────────────────────────────────────────────────────┐
|
||
│ SECURITY ▸ RISK OVERVIEW │
|
||
│ Formerly: Security ▸ Overview (security overview.png) │
|
||
├──────────────────────────────────────────────────────────────────────────────────────────────┤
|
||
│ Data Confidence: WARN (NVD stale 3h; SBOM rescan FAIL; Jenkins DEGRADED; DLQ runtime 1,230) │
|
||
│ [Open Ops → Data Integrity] │
|
||
├──────────────────────────────────────────────────────────────────────────────────────────────┤
|
||
│ Snapshot (24h) │
|
||
│ Envs with Crit Reachable: 2 Total Crit Reachable: 3 │
|
||
│ Envs SBOM stale/missing: 3 VEX coverage: 62% │
|
||
│ Approvals blocked (security): 2 Exceptions expiring < 7d: 4 │
|
||
├──────────────────────────────────────────────────────────────────────────────────────────────┤
|
||
│ Critical Reachable by Environment │
|
||
│ US-East/us-prod: 2 US-East/us-uat: 1 EU-West/eu-prod: 0 APAC/apac-prod: 0 │
|
||
│ [Open Findings filtered to Crit Reachable] │
|
||
├──────────────────────────────────────────────────────────────────────────────────────────────┤
|
||
│ Top drivers (click to drill) │
|
||
│ CVE-2026-1234 (openssl) → affects user-service in US-East/us-prod (reachable) │
|
||
│ CVE-2026-9001 (log4j) → affects api-gateway (not reachable; VEX present) │
|
||
│ [Open Vulnerabilities Explorer] │
|
||
├──────────────────────────────────────────────────────────────────────────────────────────────┤
|
||
│ SBOM posture │
|
||
│ Coverage: 98% digests scanned | Freshness: 3 envs > 24h | Pending scans: 1 digest │
|
||
│ [Open Findings] [Open SBOM Lake] │
|
||
├──────────────────────────────────────────────────────────────────────────────────────────────┤
|
||
│ VEX & Exceptions │
|
||
│ VEX statements imported (24h): 12 | Exceptions active: 9 | expiring soon: 4 │
|
||
│ [Open VEX Hub] [Open Exceptions] │
|
||
└──────────────────────────────────────────────────────────────────────────────────────────────┘
|
||
```
|
||
|
||
---
|
||
|
||
# 19.3 Security screen — Findings Explorer
|
||
|
||
### Formerly
|
||
|
||
* **Security → Findings** (`findings.png`)
|
||
(global list; in PoC the table looked empty / placeholder)
|
||
|
||
### Why changed like this
|
||
|
||
Findings are what matter for release decisions. This screen becomes the primary explorer with **first-class filters**:
|
||
|
||
* Region / Env / Env type
|
||
* Bundle version (manifest digest)
|
||
* Component digest
|
||
* Severity
|
||
* **Reachability class** (reachable / not reachable / unknown)
|
||
* **Hybrid evidence presence** (B/I/R) as filters/columns (2nd-class, but not buried)
|
||
* SBOM freshness status (ok/stale/missing/pending)
|
||
|
||
It also shows a **Data Confidence banner** so you never misread stale results as “clean”.
|
||
|
||
### Screen graph (Mermaid)
|
||
|
||
```mermaid
|
||
flowchart TD
|
||
A[Findings Explorer] --> B[Finding Detail]
|
||
A --> C[Filter to Environment -> Env Detail]
|
||
A --> D[Filter to Bundle Version -> Bundle Version Detail]
|
||
A --> E[Open Vulnerability Detail]
|
||
A --> F[Open VEX Hub (statement for CVE)]
|
||
A --> G[Open Exceptions (waiver scope)]
|
||
A --> H[Export filtered set -> Evidence Export]
|
||
A --> I[Data Confidence -> Ops Data Integrity]
|
||
```
|
||
|
||
### ASCII mock
|
||
|
||
```text
|
||
┌──────────────────────────────────────────────────────────────────────────────────────────────┐
|
||
│ SECURITY ▸ FINDINGS EXPLORER │
|
||
│ Formerly: Security ▸ Findings (findings.png) │
|
||
├──────────────────────────────────────────────────────────────────────────────────────────────┤
|
||
│ Data Confidence: WARN (NVD stale 3h; SBOM rescan FAIL) [Open Data Integrity] │
|
||
│ Filters: Region ▾ Env ▾ EnvType ▾ BundleVersion ▾ Severity ▾ Reachability ▾ SBOM ▾ │
|
||
│ Hybrid evidence: Build ✓/✗ Image ✓/✗ Runtime ✓/✗ Time window ▾ (24h/7d/30d) │
|
||
│ Actions: [Export filtered findings] [Open as Evidence Attachment] │
|
||
├──────────────────────────────────────────────────────────────────────────────────────────────┤
|
||
│ Findings (env‑context) │
|
||
│ ┌──────────────┬──────────────┬─────────────┬──────────────┬──────────┬─────────┬───────────┐ │
|
||
│ │ Env │ Component │ CVE │ Package │ Severity │ Reach │ B/I/R │ │
|
||
│ ├──────────────┼──────────────┼─────────────┼──────────────┼──────────┼─────────┼───────────┤ │
|
||
│ │ us-prod │ user-service │ 2026-1234 │ openssl │ CRIT │ YES │ 0/1/0 │ │
|
||
│ │ us-uat │ user-service │ 2026-2222 │ glibc │ CRIT │ YES │ 0/1/0 │ │
|
||
│ │ us-prod │ api-gateway │ 2026-9001 │ log4j │ HIGH │ NO │ 1/1/1 │ │
|
||
│ └──────────────┴──────────────┴─────────────┴──────────────┴──────────┴─────────┴───────────┘ │
|
||
│ Click a row → Finding Detail │
|
||
└──────────────────────────────────────────────────────────────────────────────────────────────┘
|
||
```
|
||
|
||
---
|
||
|
||
# 19.4 Security screen — Finding Detail (new, minimal but necessary)
|
||
|
||
### Formerly
|
||
|
||
* No explicit “Finding Detail” screen shown; users would pivot:
|
||
|
||
* Vulnerabilities list
|
||
* SBOM Graph
|
||
* VEX Hub
|
||
* Exceptions
|
||
…without a single “case file.”
|
||
|
||
### Why changed like this
|
||
|
||
This is the decision artifact:
|
||
|
||
* “Is it reachable?” and **why** (and with what hybrid evidence)
|
||
* What envs/bundles are impacted
|
||
* Whether VEX exists / whether an exception exists
|
||
* Links to approvals blocked by this finding
|
||
|
||
### Screen graph (Mermaid)
|
||
|
||
```mermaid
|
||
flowchart TD
|
||
A[Finding Detail] --> B[Reachability evidence (B/I/R) + age]
|
||
A --> C[Impacted envs + bundle versions]
|
||
A --> D[Related CVE record -> Vulnerability Detail]
|
||
A --> E[VEX statements -> VEX Hub]
|
||
A --> F[Exceptions -> Exceptions]
|
||
A --> G[Blocked approvals -> Approvals]
|
||
A --> H[Export case -> Evidence Export]
|
||
```
|
||
|
||
### ASCII mock
|
||
|
||
```text
|
||
┌──────────────────────────────────────────────────────────────────────────────────────────────┐
|
||
│ FINDING DETAIL │
|
||
│ Formerly: implicit drilldowns from Findings/Vulnerabilities/SBOM Graph (no unified “case file”) │
|
||
├──────────────────────────────────────────────────────────────────────────────────────────────┤
|
||
│ CVE: CVE-2026-1234 Package: openssl Severity: CRITICAL │
|
||
│ Component: user-service v3.0.0-rc1 digest sha256:2222... │
|
||
│ Environment: US-East/us-prod │
|
||
│ Reachability: REACHABLE (confidence: MEDIUM) │
|
||
│ Hybrid evidence: Build ✗ (missing) | Image ✓ (1h) | Runtime ✗ (26h stale) │
|
||
├──────────────────────────────────────────────────────────────────────────────────────────────┤
|
||
│ Impact │
|
||
│ - Environments: us-prod (crit reachable), us-uat (crit reachable) │
|
||
│ - Bundle versions: Platform 1.3.0-rc1 (manifest sha256:beef...) │
|
||
│ - Approvals blocked: 1 [Open approvals filtered] │
|
||
├──────────────────────────────────────────────────────────────────────────────────────────────┤
|
||
│ Disposition │
|
||
│ VEX: none found | Exceptions: none active │
|
||
│ Actions: [Create Exception Request] [Search/Import VEX] [Export as Evidence] │
|
||
└──────────────────────────────────────────────────────────────────────────────────────────────┘
|
||
```
|
||
|
||
---
|
||
|
||
# 19.5 Security screen — Vulnerabilities Explorer
|
||
|
||
### Formerly
|
||
|
||
* **Security → Vulnerabilities** (`vulnerabilities.png`)
|
||
(CVE catalog list)
|
||
|
||
### Why changed like this
|
||
|
||
This remains the catalog view, but becomes **release-relevant** by adding:
|
||
|
||
* “impacted environments count”
|
||
* “crit reachable envs count”
|
||
* “affected bundle versions count”
|
||
* quick filters: “only affecting prod”, “only reachable”, “only without VEX”, “only with expiring exception”.
|
||
|
||
Reachability remains **2nd-class**: it’s derived from correlated findings, not a separate domain.
|
||
|
||
### Screen graph (Mermaid)
|
||
|
||
```mermaid
|
||
flowchart TD
|
||
A[Vulnerabilities Explorer] --> B[Vulnerability Detail]
|
||
A --> C[Open Findings (filtered by CVE)]
|
||
A --> D[Open VEX Hub (statements for CVE)]
|
||
A --> E[Open Exceptions (scoped to CVE)]
|
||
A --> F[Open SBOM Graph (package path)]
|
||
A --> G[Export report -> Evidence Export]
|
||
```
|
||
|
||
### ASCII mock
|
||
|
||
```text
|
||
┌──────────────────────────────────────────────────────────────────────────────────────────────┐
|
||
│ SECURITY ▸ VULNERABILITIES EXPLORER │
|
||
│ Formerly: Security ▸ Vulnerabilities (vulnerabilities.png) │
|
||
├──────────────────────────────────────────────────────────────────────────────────────────────┤
|
||
│ Filters: Severity ▾ Has VEX ▾ Has Exception ▾ Reachable in Prod ▾ Window ▾ │
|
||
│ Data Confidence banner (if stale): WARN (NVD stale 3h) [Open Data Integrity] │
|
||
├──────────────────────────────────────────────────────────────────────────────────────────────┤
|
||
│ ┌──────────────┬──────────┬──────────────┬───────────────┬──────────────┬───────────────────┐ │
|
||
│ │ CVE │ Severity │ Package │ Impacted envs │ CritR envs │ Disposition │ │
|
||
│ ├──────────────┼──────────┼──────────────┼───────────────┼──────────────┼───────────────────┤ │
|
||
│ │ 2026-1234 │ CRIT │ openssl │ 2 │ 2 │ no VEX / no exc │ │
|
||
│ │ 2026-9001 │ HIGH │ log4j │ 4 │ 0 │ VEX present │ │
|
||
│ └──────────────┴──────────┴──────────────┴───────────────┴──────────────┴───────────────────┘ │
|
||
│ Click a CVE → Vulnerability Detail │
|
||
└──────────────────────────────────────────────────────────────────────────────────────────────┘
|
||
```
|
||
|
||
---
|
||
|
||
# 19.6 Security screen — Vulnerability Detail (new, minimal but necessary)
|
||
|
||
### Formerly
|
||
|
||
* No explicit detail page shown; users used SBOM graph or external CVE pages and then filtered Findings.
|
||
|
||
### Why changed like this
|
||
|
||
This is the “CVE dossier” inside Stella:
|
||
|
||
* shows where it hits (envs/bundles/components)
|
||
* reachability distribution
|
||
* VEX statements and exceptions status
|
||
* links to SBOM Graph paths and evidence export
|
||
|
||
### Screen graph (Mermaid)
|
||
|
||
```mermaid
|
||
flowchart TD
|
||
A[Vulnerability Detail] --> B[Impacted envs/bundles/components]
|
||
A --> C[Reachability distribution]
|
||
A --> D[VEX statements]
|
||
A --> E[Exceptions / waivers]
|
||
A --> F[SBOM Graph path explorer]
|
||
A --> G[Export as evidence report]
|
||
```
|
||
|
||
### ASCII mock
|
||
|
||
```text
|
||
┌──────────────────────────────────────────────────────────────────────────────────────────────┐
|
||
│ VULNERABILITY DETAIL: CVE-2026-1234 │
|
||
│ Formerly: inferred via Vulnerabilities list + Findings filters + external CVE lookup │
|
||
├──────────────────────────────────────────────────────────────────────────────────────────────┤
|
||
│ Package: openssl Severity: CRITICAL EPSS/KEV: (if present via feeds) │
|
||
│ Data confidence: WARN (NVD stale 3h) │
|
||
├──────────────────────────────────────────────────────────────────────────────────────────────┤
|
||
│ Impact summary │
|
||
│ Impacted envs: 2 (Prod impacted: 1) │
|
||
│ Findings: 3 total | Reachable: 3 | Not reachable: 0 | Unknown: 0 │
|
||
│ Affected components: user-service sha256:2222... │
|
||
│ Affected bundle versions: Platform 1.3.0-rc1 (sha256:beef...) │
|
||
├──────────────────────────────────────────────────────────────────────────────────────────────┤
|
||
│ Disposition │
|
||
│ VEX: none | Exceptions: none │
|
||
│ Actions: [Open Findings] [Open SBOM Graph] [Create Exception] [Export Report] │
|
||
└──────────────────────────────────────────────────────────────────────────────────────────────┘
|
||
```
|
||
|
||
---
|
||
|
||
# 19.7 Security screen — SBOM Lake
|
||
|
||
### Formerly
|
||
|
||
* **Security → SBOM Lake** (`sbom lake.png`)
|
||
(raw SBOM index / ingestion storage view)
|
||
|
||
### Why changed like this
|
||
|
||
Keep it intact, but reframe it as **backend exploration**:
|
||
|
||
* clearly marked as “data plane”
|
||
* supports filtering by digest / component / bundle version / env
|
||
* adds a “Used in decisions” panel (which approvals/promotions reference this SBOM snapshot)
|
||
|
||
### Screen graph (Mermaid)
|
||
|
||
```mermaid
|
||
flowchart TD
|
||
A[SBOM Lake] --> B[SBOM Record Detail (by digest)]
|
||
A --> C[Pivot to Findings (derived)]
|
||
A --> D[Pivot to SBOM Graph (relationships)]
|
||
A --> E[Pivot to Bundle Version Detail]
|
||
A --> F[Export SBOM snapshot -> Evidence]
|
||
```
|
||
|
||
### ASCII mock
|
||
|
||
```text
|
||
┌──────────────────────────────────────────────────────────────────────────────────────────────┐
|
||
│ SECURITY ▸ SBOM DATA ▸ SBOM LAKE │
|
||
│ Formerly: Security ▸ SBOM Lake (sbom lake.png) │
|
||
├──────────────────────────────────────────────────────────────────────────────────────────────┤
|
||
│ Purpose: raw SBOM store / index (data plane). Use Findings/Vulns for decision views. │
|
||
│ Filters: Digest ▾ Component ▾ BundleVersion ▾ Env ▾ Freshness ▾ │
|
||
│ Actions: [Export SBOM snapshot] [Open derived Findings] │
|
||
├──────────────────────────────────────────────────────────────────────────────────────────────┤
|
||
│ SBOM Records │
|
||
│ sha256:1111... api-gateway generated: 2h ago format: SPDX status: OK │
|
||
│ sha256:2222... user-service generated: 26h ago format: SPDX status: OK (STALE) │
|
||
│ sha256:4444... worker generated: — format: — status: PENDING │
|
||
│ Click record → SBOM Record Detail │
|
||
└──────────────────────────────────────────────────────────────────────────────────────────────┘
|
||
```
|
||
|
||
---
|
||
|
||
# 19.8 Security screen — SBOM Graph
|
||
|
||
### Formerly
|
||
|
||
* **Security → SBOM Graph** (`sbom graph.png`)
|
||
(graph traversal of dependencies)
|
||
|
||
### Why changed like this
|
||
|
||
Keep intact, but make it **decision-connected**:
|
||
|
||
* start from **bundle version** or **env deployed digest** as entry points
|
||
* show “paths to vulnerable package”
|
||
* add “show reachable paths only” as an overlay (2nd-class reachability filter)
|
||
|
||
### Screen graph (Mermaid)
|
||
|
||
```mermaid
|
||
flowchart TD
|
||
A[SBOM Graph] --> B[Select root: env/bundle/digest/package]
|
||
A --> C[Graph view + path explorer]
|
||
A --> D[Overlay: highlight vulnerable packages]
|
||
A --> E[Overlay: reachable-only / evidence source]
|
||
A --> F[Pivot: open Finding / Vulnerability detail]
|
||
```
|
||
|
||
### ASCII mock
|
||
|
||
```text
|
||
┌──────────────────────────────────────────────────────────────────────────────────────────────┐
|
||
│ SECURITY ▸ SBOM DATA ▸ SBOM GRAPH │
|
||
│ Formerly: Security ▸ SBOM Graph (sbom graph.png) │
|
||
├───────────────────────────────────────────────────────────────────────────────┬──────────────┤
|
||
│ Entry point (choose one): │ Overlays │
|
||
│ (•) Deployed env: US-East/us-prod │ [x] highlight│
|
||
│ ( ) Bundle version: Platform 1.3.0-rc1 │ CVEs │
|
||
│ ( ) Digest: sha256:2222... │ [ ] reachable│
|
||
│ ( ) Package: openssl │ only │
|
||
├───────────────────────────────────────────────────────────────────────────────┴──────────────┤
|
||
│ Graph view (nodes: packages/components; edges: depends-on) │
|
||
│ Path explorer: user-service → openssl → … │
|
||
│ Click node → [Open Vulnerability] [Open Findings] [Open SBOM record] │
|
||
└──────────────────────────────────────────────────────────────────────────────────────────────┘
|
||
```
|
||
|
||
---
|
||
|
||
# 19.9 Security screen — VEX Hub
|
||
|
||
### Formerly
|
||
|
||
* **Security → VEX Hub** (`vex hub.png`)
|
||
(statement ingestion/management)
|
||
|
||
### Why changed like this
|
||
|
||
Keep intact, but align to governance:
|
||
|
||
* show “statements affecting blocked approvals”
|
||
* show issuer trust status (links to Evidence → Trust & Signing)
|
||
* provide “apply VEX to finding” workflow as a controlled action (audited)
|
||
|
||
### Screen graph (Mermaid)
|
||
|
||
```mermaid
|
||
flowchart TD
|
||
A[VEX Hub] --> B[VEX Statement Detail]
|
||
A --> C[Filter by CVE/package/component/env]
|
||
A --> D[Issuer trust -> Trust & Signing]
|
||
A --> E[Apply statement -> affects Findings]
|
||
A --> F[Export VEX set -> Evidence]
|
||
```
|
||
|
||
### ASCII mock
|
||
|
||
```text
|
||
┌──────────────────────────────────────────────────────────────────────────────────────────────┐
|
||
│ SECURITY ▸ VEX & EXCEPTIONS ▸ VEX HUB │
|
||
│ Formerly: Security ▸ VEX Hub (vex hub.png) │
|
||
├──────────────────────────────────────────────────────────────────────────────────────────────┤
|
||
│ Filters: Issuer ▾ CVE ▾ Component ▾ Env ▾ Status ▾ │
|
||
│ Summary: Statements imported (24h): 12 | affecting blocked approvals: 1 │
|
||
│ Issuer trust: 2 trusted / 1 untrusted [Open Trust & Signing] │
|
||
├──────────────────────────────────────────────────────────────────────────────────────────────┤
|
||
│ Statements │
|
||
│ VendorA CVE-2026-9001 status: not affected scope: api-gateway evidence: signed ✓ │
|
||
│ InternalSec CVE-2026-1234 status: under investigation scope: user-service signed ✓ │
|
||
│ Actions: [Import] [Validate signatures] [Export] │
|
||
└──────────────────────────────────────────────────────────────────────────────────────────────┘
|
||
```
|
||
|
||
---
|
||
|
||
# 19.10 Security screen — Exceptions
|
||
|
||
### Formerly
|
||
|
||
* **Security → Exceptions** (`exceptions.png`)
|
||
(likely waivers, policy exceptions, risk acceptances)
|
||
|
||
### Why changed like this
|
||
|
||
Keep it intact, but force “release governance shape”:
|
||
|
||
* exceptions are **time-bound**, **scoped** (env/bundle/component/CVE), and **audited**
|
||
* shows “exceptions expiring soon” prominently
|
||
* links to approvals using this exception (so you see operational dependency)
|
||
|
||
### Screen graph (Mermaid)
|
||
|
||
```mermaid
|
||
flowchart TD
|
||
A[Exceptions] --> B[Exception Detail]
|
||
A --> C[Create exception request]
|
||
A --> D[Link to Approval / Promotion]
|
||
A --> E[Link to Finding / Vulnerability]
|
||
A --> F[Export exception ledger -> Evidence]
|
||
```
|
||
|
||
### ASCII mock
|
||
|
||
```text
|
||
┌──────────────────────────────────────────────────────────────────────────────────────────────┐
|
||
│ SECURITY ▸ VEX & EXCEPTIONS ▸ EXCEPTIONS │
|
||
│ Formerly: Security ▸ Exceptions (exceptions.png) │
|
||
├──────────────────────────────────────────────────────────────────────────────────────────────┤
|
||
│ Filters: Status ▾ Expiring <7d ▾ Env ▾ BundleVersion ▾ CVE ▾ Owner ▾ │
|
||
│ Summary: Active: 9 | Expiring soon: 4 | Used by pending approvals: 1 │
|
||
├──────────────────────────────────────────────────────────────────────────────────────────────┤
|
||
│ Exceptions (waivers / risk acceptance) │
|
||
│ ┌──────────────┬───────────────┬──────────────┬───────────┬───────────────┬─────────────────┐ │
|
||
│ │ Scope │ CVE/Issue │ Reason │ Expires │ Approvers │ Used by │ │
|
||
│ ├──────────────┼───────────────┼──────────────┼───────────┼───────────────┼─────────────────┤ │
|
||
│ │ us-prod │ CVE-2026-9001 │ VEX says not │ 2026-03-01│ sec+relmgr │ 0 approvals │ │
|
||
│ │ eu-prod │ policy override│ hotfix window │ 2026-02-20│ sec+relmgr │ 1 approval │ │
|
||
│ └──────────────┴───────────────┴──────────────┴───────────┴───────────────┴─────────────────┘ │
|
||
│ Actions: [+ Request Exception] [Export ledger] │
|
||
└──────────────────────────────────────────────────────────────────────────────────────────────┘
|
||
```
|
||
|
||
---
|
||
|
||
## What this consolidation fixes (in practical terms)
|
||
|
||
* **Decision-first navigation**: security starts with “what blocks releases / where CritR exists”, not raw SBOM tooling.
|
||
* **Reachability is second-class but visible**: it’s a column/filter everywhere it matters (Findings/Vulns/Detail), not a buried third-class afterthought.
|
||
* **Audit friendliness**: each screen has explicit export hooks into Evidence (decision packets, exception ledger, filtered findings sets).
|
||
* **No feature loss**: SBOM Lake/Graph, VEX Hub, Exceptions remain exactly as capabilities—just grouped and linked to approvals/releases/environment context.
|
||
|
||
---
|
||
|
||
If you want the next pack, **Pack 20** can do the same consolidation for **Evidence & Audit** (Evidence Bundles, Export Center, Replay/Verify, Trust & Signing) so audit outputs are “release/bundle/env centric” and still preserve all PoC screens.
|