Policy and VEX Evidence Reads

Source-verified against commit 2021a48f6e (2026-10-05). Re-verify the named source contracts before applying this description to an installation. Re-verify: git show HEAD:src/Vulnerabilities/__Libraries/StellaOps.Vulnerabilities.Consensus/ConsensusEvaluator.cs.

The former POST /policy/evidence/component composition proposal is a historical design. Use the current owner contracts to retrieve statements, decisions and promotion evidence.

Read sequence

1. Read hub statements and provenance with the VEX owner API contract.
2. Read the authenticated tenant’s effective status with POST /api/policy/vex/effective-status (policy:read).
3. Read Findings decisions and the displayed finding through the Findings owner.
4. Obtain the actual promotion evaluation and its evidence through the promotion ownership contract.

The effective-status response contains decisionHash, contested and overlayApplied. It answers from Policy’s projection. It does not combine advisory linksets or manufacture a promotion verdict. Missing projection data is not an unaffected verdict.

See the consensus runbook and Findings architecture.

The earlier design is frozen history. It does not describe the current runtime.