git.stella-ops.org/docs/features/unchecked/cli/cli-forensic-snapshot-commands.md

CLI Forensic Snapshot Commands

Module

Cli

Status

IMPLEMENTED

Description

CLI commands for creating, listing, and showing forensic snapshots with DSSE verification and timeline validation, enabling incident response workflows from the command line.

Implementation Details

• Command Handlers: src/Cli/StellaOps.Cli/Commands/CommandHandlers.cs -- partial class with forensic snapshot handlers
• Forensic Services: src/Cli/StellaOps.Cli/Services/ForensicSnapshotClient.cs / IForensicSnapshotClient.cs -- API client for forensic snapshot operations
• Forensic Verifier: src/Cli/StellaOps.Cli/Services/ForensicVerifier.cs / IForensicVerifier.cs -- DSSE verification for forensic snapshots
• Sprint: SPRINT_0201_0001_0001_cli_i
• Commands:
  • stella forensic create --digest <digest> --reason <reason> -- create a forensic snapshot for an artifact
  • stella forensic list -- list forensic snapshots with status and timestamps
  • stella forensic show <snapshot-id> -- show snapshot details including evidence, timeline
  • stella forensic verify <snapshot-id> -- verify DSSE signature and timeline integrity
• DSSE Integration: Snapshots are DSSE-signed for tamper-evidence

E2E Test Plan

• Run stella forensic create --digest sha256:abc123 --reason "Incident investigation" and verify snapshot created
• Run stella forensic list and verify snapshots listed with ID, digest, reason, timestamp
• Run stella forensic show <id> and verify detailed snapshot with evidence links and timeline
• Run stella forensic verify <id> and verify DSSE signature validation passes
• Verify timeline validation detects gaps or ordering violations
• Verify --format json provides structured output
• Verify error handling for non-existent snapshot IDs