checkId: check.timestamp.evidence.staleness plugin: stellaops.doctor.timestamping severity: warn tags: [timestamping, evidence, staleness, retimestamp]

Evidence Staleness

This Stella Ops Doctor check is the aggregated early-warning signal for timestamp evidence that is ageing toward unverifiable. It rolls up six focused checks into a single result so operators can schedule re-timestamping before release evidence loses its chain of trust. For deeper investigation of any one dimension, follow the focused checks linked under Related Checks.

What It Checks

Aggregates timestamp evidence staleness across six dimensions:

Fails if any dimension is unhealthy (count exceeds CriticalStaleCount, default 10). Warns if any dimension is degraded.

Why It Matters

Stale evidence loses its verifiability over time. Expired timestamps, deprecated algorithms, and missing revocation data all weaken the chain of trust. Proactive detection enables scheduled re-timestamping before evidence becomes unverifiable.

Common Causes

How to Fix

Docker Compose

# Run evidence refresh
docker exec <platform-container> stella evidence refresh --all

# Run retimestamp queue
docker exec <platform-container> stella retimestamp run

Bare Metal / systemd

# Check evidence status
stella evidence audit --staleness

# Refresh stale evidence
stella evidence refresh --all

# Process retimestamp queue
stella retimestamp run

# Schedule automatic refresh
stella retimestamp schedule create --interval daily

Kubernetes / Helm

timestamping:
  evidenceStaleness:
    tstWarnDays: 180
    tstCriticalDays: 90
    criticalStaleCount: 10
    retimestampSchedule: "0 1 * * *"

Verification

stella doctor run --check check.timestamp.evidence.staleness