VEX Decision Hashes and Provenance
Source-verified against commit
2021a48f6e(2026-10-05). Re-verify the named source contracts before applying this description to an installation. Re-verify:git show HEAD:src/Policy/StellaOps.Policy.Engine/Endpoints/VexEffectiveStatusEndpoints.cs.
The supported VEX decision path uses a deterministic consensus decision hash. The former VexLens proof object and consensus:withProof endpoint are withdrawn.
Effective-status response
POST /api/policy/vex/effective-status requires policy:read and an authenticated tenant. The request names at most 500 (vulnerabilityId, productKey) pairs. Each returned item has:
| Field | Meaning |
|---|---|
vulnerabilityId, productKey | The issue identity; product keys carry no version. |
status, justification | The effective tenant decision and its justification. |
winningIssuers | Issuers behind the selected consensus status. |
contested | Live statements disagree. |
overlayApplied | A tenant overlay changed the consensus outcome. |
decisionHash | SHA-256 of canonical evaluation inputs, trust configuration, overlays and outcome. |
An unavailable projection answers 503. An issue omitted from the response is not a proof that the component is unaffected.
Verification boundary
The hash binds a deterministic evaluation; it is not a signature, a transparency inclusion proof or a standalone offline replay bundle. Preserve the statements, their provenance, trust configuration and tenant overlays to explain the decision.
A signed Findings decision can carry an attestationDigest on its overlay state. That attestation and the consensus hash have separate meanings. Do not treat one as the other.
The canonical types and hashing implementation live in src/Vulnerabilities/__Libraries/StellaOps.Vulnerabilities.Consensus/ConsensusEvaluator.cs. The HTTP response is defined by VexEffectiveStatusEndpoints in Policy.
See the consensus runbook and the overlay feed contract.
The earlier design is frozen history. It does not describe the current runtime.