DORA TLPT Evidence

The TLPT evidence surface prepares deterministic white-team planning, baseline, and evidence-pack artifacts for DORA TLPT support. Stella does not run offensive tests, select targets by itself, or submit TLPT artifacts to a regulator. Operators and their appointed TLPT roles own scope approval, execution, findings treatment, and reporting.

This is a surface of the DORA Operational Resilience Pack.

Claim boundary: operator-support.

Source Docs

Runtime Boundary

The local CLI flow covers deterministic handoff artifacts:

stella tlpt scope reads local asset registry and reachability subgraph inputs, then writes tlpt-scope.v1;
stella tlpt baseline binds the approved scope to a replay baseline;
stella replay <baseline> verifies the frozen baseline offline;
stella tlpt pack creates a signed TLPT EvidenceLocker capsule handoff;
stella verify tlpt-pack verifies the local pack offline.

Live Graph asset registry query mode is not part of this local CLI slice. EvidenceLocker TLPT audit action emission remains service-owned follow-up work.

Evidence Pack

The target Assurance export profile id is dora.tlpt-evidence-pack. The current compatibility route is stella tlpt pack plus stella verify tlpt-pack.

Expected evidence includes:

approved scope id and hash;
frozen baseline id and hash;
ReachGraph subgraph digest;
asset registry snapshot digest;
signer key id and DSSE payload type;
content hash and normalized assembly inputs;
operator approval refs where the tenant requires them.

Boundaries

The TLPT surface must not:

launch offensive tooling;
infer the legally required TLPT scope without operator approval;
fetch live regulator, threat-intelligence, or schema endpoints;
mutate a signed pack after generation;
present local CLI output as regulator receipt.

Any live-service implementation must preserve the same offline verification properties as the CLI handoff.