CRA Assurance Packs

This is the index for Stella Ops’ EU Cyber Resilience Act (CRA) support. It is for operators and product teams who need CRA evidence — either for Stella as a manufacturer or for a customer’s released product. For the wider Assurance framing and claim-boundary wording, see the parent Assurance and Compliance Packs index.

CRA support is split into two optional Assurance packs because the underlying product responsibilities are different.

Evidence scopes:

• CRA Product Security Pack uses stella-product and can export stella-supplier evidence for customers that deploy Stella.
• CRA Technical Documentation Pack uses operator-supplied manufacturer evidence plus signed Stella evidence services.

Pack Surfaces

• Product security
• Technical file
• Conformity dossier
• Publication preflight

ExportCenter Profiles

Reporting Timeline Profiles

Source Contracts And Module Docs

• Assurance Runtime
• Assurance Scope Model
• Assurance Pack v1
• Assurance Evidence Export v1
• Assurance Setup Prerequisites v1
• CRA Technical File v1
• CRA Conformity Dossier v1
• Stella Product CSAF Advisory Contract v1
• Stella Supplier Evidence Profile v1
• ENISA Incident Reporting Contract v1
• ExportCenter architecture
• CLI export command guide

Product Boundary

Do not collapse CRA product-security obligations and customer technical-file support into one “CRA mode.” A local signed export can be ready while live public publication remains blocked by mailbox, key, route, or lifecycle preflight.

ExportCenter therefore reports signedExportReady and livePublicationReady separately for CRA Assurance profiles.

Notify reports Article 14 timeline readiness separately as operatorHandoffReady and autoSubmitReady. The default path is a local signed handoff; auto-submit remains explicit opt-in and must not be presented as live regulator receipt.

Change Log