Assurance and Compliance Packs
This page is the entry point for operators and product teams who need regulatory and standards evidence from Stella Ops. It explains what the Assurance packs do, where their boundaries lie, and the canonical wording to use when describing them.
Stella Ops is a release-control and evidence platform — not a Europe-centric compliance product. Regional and regulatory support is delivered through optional Assurance packs that register mappings, exports, timelines, and setup prerequisites over Stella’s existing evidence primitives. Each pack is opt-in, and the operator always remains the regulated decision-maker.
In the Console: Assurance is the “Account” tier of the Proof pillar (the regulator-facing destination alongside Chain and Estate), reached via the Account nav item (cockpit route /compliance, framework lenses NIS2/DORA/CRA as children). The canonical route is /compliance/* (c10 R1 swap — the surface is named “Compliance” end-to-end, so the URL matches; legacy /assurance/* redirects here). See Assurance Packs Shell for the full IA.
Start with these two architecture references:
- Assurance Runtime — the canonical architecture for this layer.
- Assurance Scope Model — the evidence-ownership and software-estate boundary.
Product Boundary
Stella Core owns the primitives that are useful in many compliance regimes:
| Primitive | Owner | Current path |
|---|---|---|
| Control and policy mapping | Policy | src/Policy/ |
| Evidence records and durable audit | EvidenceLocker | src/EvidenceLocker/ |
| Evidence exports and signed bundles | ExportCenter | src/ExportCenter/ |
| Reporting timelines and channels | Notify | src/Notify/ |
| Asset and inventory graph | Graph | src/Graph/ |
| Tenant profile and operator settings | Authority | src/Authority/ |
| Operator UX | Web | src/Web/ |
| Automation and offline verification | CLI | src/Cli/ |
Assurance packs consume those primitives. They do not own duplicate timeline stores, duplicate asset registries, duplicate tenant profile schemas, or a separate Europe-specific module.
Optional Packs
Initial packs:
| Pack | Purpose | Claim boundary |
|---|---|---|
| NIS2 Evidence Pack | Control register, Statement of Applicability export, incident timeline views, KPI/effectiveness evidence, standards mappings. | operator-support |
| DORA Operational Resilience Pack | Major ICT incident handoff, annual RoI local-contract export, TLPT evidence packs, Article 45 information-sharing support, and retention evidence. | operator-support |
| CRA Product Security Pack | Stella’s own CVD policy, security.txt, product advisory feed, support lifecycle, and live publication preflight. | manufacturer-self |
| CRA Technical Documentation Pack | Technical-file and conformity-dossier exports for products that need CRA evidence packages. | manufacturer-customer-support |
DORA and NIS2 are software-estate Assurance packs. They support evidence for software Stella deploys, scans, observes, or controls, plus labelled operator-supplied evidence gaps. They are not broad legal, HR, physical security, contract, or regulator-filing systems.
DORA is exposed through generic Web/CLI Assurance discovery as an optional operator-support pack. Pack-specific CLI and module routes can prepare local artifacts, while generic readiness must remain unavailable or blocked until the owning Authority, ExportCenter, Notify, Trust, and Evidence surfaces report tenant-ready state.
Future packs should use the same runtime shape: ISO/IEC 27001, SOC 2, IEC 62443, FedRAMP-style evidence, or customer-specific assurance packs.
Each regime has its own index page with the full pack contents and setup detail:
Console Surface
The Web Console exposes optional packs through /assurance. This is the canonical product surface for pack discovery, enablement status, export readiness, reporting readiness, and setup gaps. Existing /compliance/nis2/* routes remain compatibility links for bookmarked NIS2 Evidence Pack pages.
The UI contract is documented in Assurance Packs Shell.
Claim Boundaries
Use these labels in docs, Web, CLI, and setup copy:
| Label | Meaning | Example |
|---|---|---|
operator-support | Stella helps a customer/operator collect, review, and export evidence. The customer remains the regulated decision-maker. | NIS2 control register and SoA export. |
manufacturer-self | Stella’s own product obligation as manufacturer or supplier. | Stella CVD policy and product-security publication. |
manufacturer-customer-support | Stella helps a customer that is the manufacturer of another product assemble evidence. | CRA technical file for a customer’s released product. |
auditor-evidence | Stella packages evidence for audit review without regulator submission. | Signed evidence bundle or standards-mapping export. |
regulator-handoff | Stella produces a signed packet for operator-controlled handoff to an authority or intake channel. | NIS2 CSIRT packet or CRA Article 14 packet. |
Forbidden product copy:
- “Stella is NIS2 compliant.”
- “Turn on DORA compliant mode.”
- “Turn on CRA compliant mode.”
- “European compliance is the product category.”
Approved product copy:
- “NIS2 evidence support.”
- “DORA operational resilience evidence support.”
- “CRA technical documentation support.”
- “Operator-owned compliance configuration.”
- “Manufacturer publication preflight.”
Evidence Scopes
Use Assurance Scope Model labels in Web, CLI, exports, and docs:
| Scope | Meaning |
|---|---|
stella-product | Stella-owned product/security/release evidence. |
stella-supplier | Stella evidence supplied to an operator about Stella as a supplier or ICT third party. |
operator-observed-estate | Software estate facts Stella can monitor, deploy, scan, or control for the operator. |
operator-supplied | Legal, governance, process, HR, physical security, contract, filing, and authority facts supplied by the operator. |
Setup Posture
Assurance packs are optional. Setup must allow an operator to skip all packs. When a pack is enabled, setup should show readiness separately for:
- local evidence-only use;
- signed export readiness;
- regulator handoff readiness;
- live public publication readiness.
For example, a NIS2 SoA signed export needs Authority profile access, ExportCenter storage, signing provider configuration, and tenant export trust roots. A DORA RoI local-contract export needs tenant compliance profile data, asset/integration source snapshots, retention policy resolution, and local schema/taxonomy status visibility. A CRA Product Security Pack can be export-ready while live publication is still blocked by mailbox/key preflight.
Regional Crypto
Regional cryptography support (eIDAS, FIPS, GOST, SM, PQ) is delivered through pluggable providers; see the Cryptography module. For a reproducible, test-only EU/eIDAS plumbing demo (an eidas.sim sign → verify round-trip against the universal crypto simulator, with the soft-posture caveats and the eidas.soft production gap called out), see the eIDAS sim-crypto round-trip demo. That path is a simulator (deterministic HMAC, production=false / testOnly=true), not a certified eIDAS qualified electronic signature.
Relationship to Europe Research Docs
docs/europe/ remains regulatory research, decision history, and sprint planning context. Product architecture and user-facing pack guidance belongs under docs/compliance/.