Feature Matrix — Stella Ops Suite

(rev 5.1 · 16 Jan 2026)

Looking for a quick read? Check key-features.mdfor the short capability cards; this matrix keeps full tier-by-tier detail.

Product Evolution

Stella Ops Suite is now a centralized, auditable release control plane for non-Kubernetes container estates. The platform combines release orchestration with security decisioning as a gate.

  • Release orchestration — UI-driven promotion (Dev → Stage → Prod), approvals, policy gates, rollbacks
  • Security decisioning as a gate — Scan on build, evaluate on release, re-evaluate on CVE updates
  • OCI-digest-first releases — Immutable digest-based release identity
  • Evidence packets — Every release decision is cryptographically signed and stored

Competitive Moat Features

These differentiators are available across all plans.

CapabilityNotes
Signed Replayable Risk VerdictsCore differentiator
Decision CapsulesAudit-grade evidence bundles
VEX Decisioning EngineTrust lattice + conflict resolution
Reachability with Portable ProofsThree-layer analysis
Smart-Diff (Semantic Risk Delta)Material change detection
Unknowns as First-Class StateUncertainty budgets
Deterministic Replaystella replay srm.yaml
Non-Kubernetes First-ClassDocker/Compose/ECS/Nomad targets
Digest-First Release IdentityImmutable releases

Release Orchestration (Planned)

Release orchestration capabilities are planned for implementation.

| Capability | Notes | | Environment Management | | | Environment CRUD | ⏳ Dev/Stage/Prod definitions | | Freeze Windows | ⏳ Calendar-based blocking | | Approval Policies | ⏳ Per-environment rules | | Release Management | | | Component Registry | ⏳ Service → repository mapping | | Release Bundles | ⏳ Component → digest bundles | | Semantic Versioning | ⏳ SemVer release versions | | Tag → Digest Resolution | ⏳ Immutable digest pinning | | Promotion & Gates | | | Promotion Workflows | ⏳ Environment transitions | | Security Gate | ⏳ Scan verdict evaluation | | Approval Gate | ⏳ Human sign-off | | Freeze Window Gate | ⏳ Calendar enforcement | | Policy Gate (OPA/Rego) | ⏳ Custom rules | | Decision Records | ⏳ Evidence-linked decisions | | Deployment Execution | | | Docker Host Agent | ⏳ Direct container deployment | | Compose Host Agent | ⏳ Docker Compose deployment | | SSH Agentless | ⏳ Linux remote execution | | WinRM Agentless | ⏳ Windows remote execution | | ECS Agent | ⏳ AWS ECS deployment | | Nomad Agent | ⏳ HashiCorp Nomad deployment | | Rollback | ⏳ Previous version restore | | Progressive Delivery | | | A/B Releases | ⏳ Traffic splitting | | Canary Deployments | ⏳ Gradual rollout | | Blue-Green | ⏳ Zero-downtime switch | | Traffic Routing Plugins | ⏳ Nginx/HAProxy/Traefik/ALB | | Workflow Engine | | | DAG Workflow Execution | ⏳ Directed acyclic graphs | | Step Registry | ⏳ Built-in + custom steps | | Workflow Templates | ⏳ Reusable workflows | | Script Steps (Bash/C#) | ⏳ Custom automation | | Evidence & Audit | | | Evidence Packets | ⏳ Sealed decision bundles | | Version Stickers | ⏳ On-target deployment records | | Audit Export | ⏳ Compliance reporting | | Integrations | | | GitHub Integration | ⏳ SCM + webhooks | | GitLab Integration | ⏳ SCM + webhooks | | Harbor Integration | ⏳ Registry + scanning | | HashiCorp Vault | ⏳ Secrets management | | AWS Secrets Manager | ⏳ Secrets management | | Plugin System | | | Plugin Manifest | ⏳ Static declarations | | Connector Runtime | ⏳ Dynamic execution | | Step Providers | ⏳ Custom workflow steps | | Agent Types | ⏳ Custom deployment targets |

Plan Limits

LimitFreeProEnterprise
Environments333Unlimited
New Digests/Day3333,333Unlimited

SBOM & Ingestion

CapabilityNotes
Trivy-JSON Ingestion
SPDX-JSON 3.0.1 Ingestion
CycloneDX 1.7 Ingestion (1.6 backward compatible)
Auto-format Detection
Delta-SBOM CacheWarm scans <1s
SBOM Generation (all formats)
Semantic SBOM Diff
BYOS (Bring-Your-Own-SBOM)
SBOM Lineage LedgerFull versioned history
SBOM Lineage APITraversal queries

Scanning & Detection

CapabilityNotes
CVE Lookup via Local DB
Licence-Risk Detection⏳ Q4-2025
Automatic Detection (Class A)Runs implicitly during scan
— Secrets DetectionAPI keys, tokens, passwords; results in findings (see docs/modules/ui/components/findings-list.md)
— OS Package Analyzersapk, apt, yum, dnf, rpm, pacman; results in SBOM (see docs/modules/cli/guides/commands/sbom.md)
Language Analyzers (All 11)
— .NET/C#, Java, Go, Python
— Node.js, Ruby, Bun, Deno
— PHP, Rust, Native binaries
Progressive Fidelity Modes
— Quick Mode
— Standard Mode
— Deep ModeFull analysis
Base Image Detection
Layer-Aware Analysis
Concurrent Scan WorkersConfigurable

Reachability Analysis

CapabilityNotes
Static Call Graph
Entrypoint Detection9+ framework types
BFS Reachability
Reachability Drift Detection
Binary Loader ResolutionELF/PE/Mach-O
Feature Flag/Config GatingLayer 3 analysis
Runtime Signal CorrelationZastava integration
Gate Detection (auth/admin)Enterprise policies
Path Witness GenerationAudit evidence
Reachability Mini-Map APIUI visualization
Runtime Timeline APITemporal analysis

Binary Analysis (BinaryIndex)

Binary analysis capabilities are CLI-first (Class B). UI integration is minimal until user demand validates.

CapabilityNotes
Binary Identity ExtractionBuild-ID, hashes
Build-ID Vulnerability Lookup
Debian/Ubuntu Corpus
RPM/RHEL Corpus
Patch-Aware Backport Detection
PE/Mach-O/ELF Parsers
Binary Fingerprint GenerationCLI: stella binary fingerprint export
Fingerprint Matching EngineSimilarity search
Binary DiffCLI: stella binary diff <base> <candidate>
DWARF/Symbol AnalysisDebug symbols

CLI Commands (Class B):

  • stella binary fingerprint export <artifact> — Export fingerprint data (function hashes, section hashes, symbol table)
  • stella binary diff <base> <candidate> — Compare binaries with function/symbol-level diff
  • Output formats: --format json|yaml|table
  • Usage and examples: docs/modules/cli/guides/commands/binary.md

Advisory Sources (Concelier)

Concelier provides 33+ vulnerability feed connectors with automatic sync, health monitoring, and conflict detection.

ConnectorNotes
National CVE Databases
— NVD (NIST)Primary CVE source
— CVE (MITRE)CVE Record format 5.0
OSS Ecosystems
— OSVMulti-ecosystem
— GHSAGitHub Security Advisories
Linux Distributions
— Alpine SecDB
— Debian Security Tracker
— Ubuntu USN
— RHEL/CentOS OVAL
— SUSE OVAL
— Astra LinuxRussian distro
CERTs / National CSIRTs
— CISA KEVKnown Exploited Vulns
— CISA ICS-CERTIndustrial control systems
— CERT-CCCarnegie Mellon
— CERT-FRFrance
— CERT-Bund (BSI)Germany
— CERT-InIndia
— ACSCAustralia
— CCCSCanada
— KISASouth Korea
— JVNJapan
Russian Federation Sources
— FSTEC BDURussian vuln database
— NKCKICritical infrastructure
Vendor PSIRTs
— Microsoft MSRC
— Cisco PSIRT
— Oracle CPU
— VMware
— Adobe PSIRT
— Apple Security
— Chromium
ICS/SCADA
— Kaspersky ICS-CERTIndustrial security
Risk Scoring
— EPSS v4Exploit prediction
Additional Features
Custom Advisory ConnectorsPrivate feeds
Advisory Merge EngineConflict resolution
Connector Health CLIstella db connectors status

Connector Operations Matrix (Status/Auth/Runbooks):

ConnectorStatusAuthOps Runbook
NVD (NIST)stableapi-keydocs/modules/concelier/operations/connectors/nvd.md
CVE (MITRE)stablenonedocs/modules/concelier/operations/connectors/cve.md
OSVstablenonedocs/modules/concelier/operations/connectors/osv.md
GHSAstableapi-tokendocs/modules/concelier/operations/connectors/ghsa.md
Alpine SecDBstablenonedocs/modules/concelier/operations/connectors/alpine.md
Debian Security Trackerstablenonedocs/modules/concelier/operations/connectors/debian.md
Ubuntu USNstablenonedocs/modules/concelier/operations/connectors/ubuntu.md
Red Hat OVAL/CSAFstablenonedocs/modules/concelier/operations/connectors/redhat.md
SUSE OVAL/CSAFstablenonedocs/modules/concelier/operations/connectors/suse.md
Astra Linuxbetanonedocs/modules/concelier/operations/connectors/astra.md
CISA KEVstablenonedocs/modules/concelier/operations/connectors/cve-kev.md
CISA ICS-CERTstablenonedocs/modules/concelier/operations/connectors/ics-cisa.md
CERT-CCstablenonedocs/modules/concelier/operations/connectors/cert-cc.md
CERT-FRstablenonedocs/modules/concelier/operations/connectors/cert-fr.md
CERT-Bundstablenonedocs/modules/concelier/operations/connectors/certbund.md
CERT-Instablenonedocs/modules/concelier/operations/connectors/cert-in.md
ACSCstablenonedocs/modules/concelier/operations/connectors/acsc.md
CCCSstablenonedocs/modules/concelier/operations/connectors/cccs.md
KISAstablenonedocs/modules/concelier/operations/connectors/kisa.md
JVNstablenonedocs/modules/concelier/operations/connectors/jvn.md
FSTEC BDUbetanonedocs/modules/concelier/operations/connectors/fstec-bdu.md
NKCKIbetanonedocs/modules/concelier/operations/connectors/nkcki.md
Microsoft MSRCstablenonedocs/modules/concelier/operations/connectors/msrc.md
Cisco PSIRTstableoauthdocs/modules/concelier/operations/connectors/cisco.md
Oracle CPUstablenonedocs/modules/concelier/operations/connectors/oracle.md
VMwarestablenonedocs/modules/concelier/operations/connectors/vmware.md
Adobe PSIRTstablenonedocs/modules/concelier/operations/connectors/adobe.md
Apple Securitystablenonedocs/modules/concelier/operations/connectors/apple.md
Chromiumstablenonedocs/modules/concelier/operations/connectors/chromium.md
Kaspersky ICS-CERTbetanonedocs/modules/concelier/operations/connectors/kaspersky-ics.md
EPSS v4stablenonedocs/modules/concelier/operations/connectors/epss.md

VEX Processing (Excititor/VexLens)

VEX processing provides a full consensus engine with 5-state lattice, 9 trust factors, and conflict detection.

CapabilityNotes
OpenVEX Ingestion
CycloneDX VEX Ingestion
CSAF VEX Ingestion
VEX Consensus Engine (5-state)Lattice-based resolution
Trust Vector Scoring (P/C/R)
Trust Weight Scoring (9 factors)Issuer, age, specificity, etc.
Claim Strength Multipliers
Freshness Decay14-day half-life
Conflict Detection & PenaltyK4 lattice logic
VEX Conflict Studio UIVisual resolution
VEX Hub (Distribution)Internal VEX network
VEX Webhook DistributionPub/sub notifications
CSAF Provider Connectors (7)RedHat, Ubuntu, Oracle, MSRC, Cisco, SUSE, VMware
Issuer Trust RegistryKey lifecycle, trust overrides
VEX from Drift Generationstella vex gen --from-drift
Trust Calibration ServiceOrg-specific tuning
Consensus Rationale ExportAudit-grade explainability

CLI Commands:

  • stella vex verify <statement> — Verify VEX statement signature and content
  • stella vex consensus <digest> — Show consensus status for digest
  • stella vex evidence export — Export VEX evidence for audit
  • stella vex webhooks list/add/remove — Manage VEX distribution
  • stella issuer keys list/create/rotate/revoke — Issuer key management

Policy Engine

Policy engine implements Belnap K4 four-valued logic with 10+ gate types and 6 risk providers.

CapabilityNotes
YAML Policy RulesBasic rules
Belnap K4 Four-Valued LogicTrue/False/Both/Neither
Security Atoms (6 types)
Disposition Selection (ECMA-424)
Minimum Confidence Gate
10+ Policy Gate TypesSeverity, reachability, age, etc.
6 Risk Score ProvidersCVSS, KEV, EPSS, FixChain, etc.
Unknowns Budget Gate
Determinization SystemSignal weights, decay, uncertainty
Policy Simulationstella policy simulate
Source Quota Gate60% cap enforcement
Reachability Requirement GateFor criticals
OPA/Rego IntegrationCustom policies
Exception Objects & WorkflowApproval chains
Score Policy YAMLFull customization
Configurable Scoring ProfilesSimple/Advanced
Policy Version HistoryAudit trail
Verdict AttestationsDSSE/Rekor signed verdicts

CLI Commands:

  • stella policy list/show/create/update/delete — Policy CRUD
  • stella policy simulate <digest> — Simulate policy evaluation
  • stella policy validate <file> — Validate policy YAML
  • stella policy decisions list/show — View policy decisions
  • stella policy gates list — List available gate types

Attestation & Signing

Attestation supports 25+ predicate types with keyless signing, key rotation, and attestation chains.

CapabilityNotes
DSSE Envelope Signing
in-toto Statement Structure
25+ Predicate TypesSBOM, VEX, verdict, etc.
SBOM Predicate
VEX Predicate
Reachability Predicate
Policy Decision Predicate
Verdict Manifest (signed)
Verdict Replay Verification
Keyless Signing (Sigstore)Fulcio-based OIDC
Delta Attestations (4 types)VEX/SBOM/Verdict/Reachability
Attestation ChainsLinked attestation graphs
Human Approval PredicateWorkflow attestation
Boundary PredicateNetwork exposure
Key Rotation ServiceAutomated key lifecycle
Trust Anchor ManagementRoot CA management
SLSA Provenance v1.0Supply chain
Rekor Transparency LogPublic attestation
Cosign IntegrationSigstore ecosystem

CLI Commands:

  • stella attest sign <file> — Sign attestation
  • stella attest verify <envelope> — Verify attestation signature
  • stella attest predicates list — List supported predicate types
  • stella attest export <digest> — Export attestations for digest
  • stella keys list/create/rotate/revoke — Key management

Regional Crypto (Sovereign Profiles)

Sovereign crypto is core to the open-source promise - no vendor lock-in on compliance. 8 signature profiles supported.

CapabilityNotes
Default Crypto (Ed25519)
FIPS 140-2/3 ModeUS Federal
eIDAS SignaturesEU Compliance
GOST/CryptoProRussia
SM National StandardChina
Post-Quantum (Dilithium)Future-proof
Crypto Plugin ArchitectureCustom HSM
Multi-Profile SigningSign with multiple algorithms
SM Remote ServiceChinese market HSM integration
HSM/PKCS#11 IntegrationHardware security modules

CLI Commands:

  • stella crypto profiles list — List available crypto profiles
  • stella crypto verify --profile <name> — Verify with specific profile
  • stella crypto plugins list/status — Manage crypto plugins

Determinism & Reproducibility

CapabilityNotes
Canonical JSON Serialization
Content-Addressed IDsSHA-256
Replay Manifest (SRM)
stella replay CLI
Score Explanation Arrays
Evidence Freshness Multipliers
Proof Coverage Metrics
Fidelity Metrics (BF/SF/PF)Audit dashboards
FN-Drift Rate TrackingQuality monitoring
Determinism Gate CIAutomated checks

Scoring & Risk Assessment

CapabilityNotes
CVSS v4.0 Display
EPSS v4 Probability
Priority Band Classification
EPSS-at-Scan Immutability
Unified Confidence Model5-factor
Entropy-Based ScoringAdvanced
Gate MultipliersReachability-aware
Unknowns Pressure FactorRisk budgets
Custom Scoring ProfilesOrg-specific

Evidence & Findings

CapabilityNotes
Findings List
Evidence Graph ViewBasic
Decision Capsules
Findings Ledger (Immutable)Audit trail
Evidence Locker (Sealed)Export/import
Evidence TTL PoliciesRetention rules
Evidence Size BudgetsStorage governance
Retention TiersHot/Warm/Cold
Privacy ControlsRedaction
Audit Pack ExportCompliance bundles

CLI Capabilities

CapabilityNotes
Scanner Commands
SBOM Inspect & Diff
Deterministic Replay
Attestation Verify
Unknowns Budget Check
Evidence Export
Audit Pack OperationsFull workflow
Binary Match InspectionAdvanced
Crypto Plugin CommandsRegional crypto
Admin UtilitiesOps tooling

Web UI Capabilities

CapabilityNotes
Dark/Light Mode
Findings Row Component
Evidence Drawer
Proof Tab
Confidence Meter
Locale SupportCyrillic, etc.
Reproduce Verdict Button
Audit Trail UIFull history
Trust Algebra PanelP/C/R visualization
Claim Comparison TableConflict view
Policy Chips DisplayGate status
Reachability Mini-MapPath visualization
Runtime TimelineTemporal view
Operator/Auditor ToggleRole separation
Knowledge Snapshot UIAir-gap prep
Keyboard ShortcutsPower users

Quota & Operations

PlanScans per Day
Free333
Pro3,333
EnterpriseUnlimited

All other operational capabilities are available across all plans:

  • Usage API (/quota)
  • Client-JWT authentication
  • Rate Limiting & 429 Backpressure
  • Retry-After Headers
  • Priority Queue
  • Burst Allowance (configurable)
  • Custom Quotas (configurable)

Offline & Air-Gap

CapabilityNotes
Offline Update Kits (OUK)Available
Offline Signature Verify
One-Command Replay
Sealed Knowledge SnapshotsFull feed export
Air-Gap Bundle ManifestTransfer packages
No-Egress EnforcementStrict isolation
Offline JWTExtended tokens

Deployment

CapabilityNotes
Docker ComposeSingle-node
Helm Chart (K8s)
PostgreSQL 16+
Valkey 8.0+
RustFS (S3)
High-AvailabilityMulti-replica
Horizontal ScalingAuto-scale
Dedicated CapacityReserved resources

Access Control & Identity (Authority)

Authority provides OAuth 2.1/OIDC with 75+ authorization scopes, DPoP, and device authorization.

CapabilityNotes
Basic Auth
API KeysWith scopes and expiration
SSO/SAML IntegrationOkta, Azure AD
OIDC Support
Basic RBACUser/Admin
75+ Authorization ScopesFine-grained permissions
DPoP (Sender Constraints)Token binding
mTLS Client CertificatesCertificate auth
Device Authorization FlowCLI/IoT devices
PAR SupportPushed Authorization Requests
User Federation (LDAP/SAML)Directory integration
Multi-Factor AuthenticationTOTP/WebAuthn
Advanced RBACTeam-based scopes
Multi-Tenant ManagementOrg hierarchy
Audit Log ExportSIEM integration

CLI Commands:

  • stella auth clients list/create/delete — OAuth client management
  • stella auth roles list/show/assign — Role management
  • stella auth scopes list — List available scopes
  • stella auth token introspect <token> — Token introspection
  • stella auth api-keys list/create/revoke — API key management

Notifications & Integrations

10 notification channel types with template engine, routing rules, and escalation.

CapabilityNotes
In-App Notifications
Email Notifications
EPSS Change Alerts
Slack Integration
Teams Integration
Discord IntegrationWebhook-based
PagerDuty IntegrationIncident management
OpsGenie IntegrationAlert routing
Zastava Registry HooksAuto-scan on push
Zastava K8s AdmissionValidating/Mutating webhooks
Template EngineCustomizable templates
Channel Routing RulesSeverity/team routing
Escalation PoliciesTime-based escalation
Notification Studio UIVisual rule builder
Custom WebhooksAny endpoint
CI/CD GatesGitLab/GitHub/Jenkins
SCM IntegrationsPR comments, status checks
Issue Tracker IntegrationJira, GitHub Issues
Enterprise ConnectorsGrid/Premium APIs

CLI Commands:

  • stella notify channels list/test — Channel management
  • stella notify rules list/create — Routing rules
  • stella zastava install/configure/status — K8s webhook management

Scheduling & Automation

CapabilityNotes
Manual Scans
Scheduled ScansCron-based
Task Pack OrchestrationDeclarative workflows
EPSS Daily RefreshAuto-update
Event-Driven ScanningOn registry push

Observability & Telemetry

CapabilityNotes
Basic Metrics
Opt-In Telemetry
OpenTelemetry TracesFull tracing
Prometheus ExportCustom dashboards
Quality KPIs DashboardTriage metrics
SLA MonitoringUptime tracking

Support & Services

CapabilityNotes
Documentation
Community Forums
GitHub Issues
Email SupportBusiness hours
Priority Support4hr response
24/7 Critical SupportAdd-on
Dedicated CSMNamed contact
Professional ServicesImplementation
Training & CertificationTeam enablement
SLA Guarantee99.9% uptime

Version Comparison

CapabilityNotes
RPM (NEVRA)
Debian (EVR)
Alpine (APK)
SemVer
PURL Resolution

Legend: ⏳ = Planned

Last updated: 17 Jan 2026 (rev 6.0 - All features available across all tiers)