Feature Matrix — Stella Ops Suite

(rev 6.1 · 6 Feb 2026)

Looking for a quick read? Check key-features.mdfor the short capability cards; this matrix keeps the full tier-by-tier detail.

Legend: ✅ = available · ⏳ = planned. Unless a row is marked ⏳, the capability is available across all plans (Stella Ops does not gate features by plan — limits are environments and new digests/day; see Plan Limits).

Product Evolution

Stella Ops Suite is now a centralized, auditable release control plane for non-Kubernetes container estates. The platform combines release orchestration with security decisioning as a gate.

• Release orchestration — UI-driven promotion (Dev → Stage → Prod), approvals, policy gates, rollbacks
• Security decisioning as a gate — Scan on build, evaluate on release, re-evaluate on CVE updates
• OCI-digest-first releases — Immutable digest-based release identity
• Evidence packets — Every release decision is cryptographically signed and stored

Competitive Moat Features

These differentiators are available across all plans.

Release Orchestration

Release orchestration capabilities for environment promotion, policy gates, and deployment execution.

Plan Limits

Free-tier numbers follow the LICENSE Free Usage Limits: no more than 3 Environments and no more than 999 New Hash Scans in any rolling 24-hour period, per Installation.

SBOM & Ingestion

Scanning & Detection

Reachability Analysis

Binary Analysis (BinaryIndex)

Binary analysis capabilities are CLI-first (Class B). UI integration is minimal until user demand validates.

CLI Commands (Class B):

• stella binary fingerprint export <artifact> — Export fingerprint data (function hashes, section hashes, symbol table)
• stella binary diff <base> <candidate> — Compare binaries with function/symbol-level diff
• Output formats: --format json|yaml|table
• Usage and examples: docs/modules/cli/guides/commands/binary.md

Advisory Sources (Concelier)

Concelier provides 33+ vulnerability feed connectors with automatic sync, health monitoring, and conflict detection.

Connector Operations Matrix (Status/Auth/Runbooks):

VEX Processing (Excititor/VexLens)

VEX processing provides a full consensus engine with 5-state lattice, 9 trust factors, and conflict detection.

CLI Commands (verified against src/Cli/StellaOps.Cli 2026-07-29):

• stella vex consensus list — List consensus decisions with filters and pagination
• stella vex consensus show <vulnerability-id> <product-key> — Quorum, evidence, rationale, signature status
• stella vex explain <vulnerability-id> — Explain a decision with reachability evidence and verification status
• stella vex export — Export consensus data as an NDJSON bundle, optionally signed
• stella vex obs — Query VEX observations (Link-Not-Merge)
• stella vex gen --from-drift --image <ref> — Generate VEX statements from facet drift
• stella vex providers — Inspect and update persisted Excititor provider configuration
• stella issuer keys list/create/rotate/revoke — Issuer key management

There is no stella vex verify, stella vex evidence or stella vex webhooks command group. Verification of a signed VEX bundle goes through stella verify or stella attest verify.

Policy Engine

Policy engine implements Belnap K4 four-valued logic with 10+ gate types and 6 risk providers.

CLI Commands (verified against src/Cli/StellaOps.Cli 2026-07-29):

• stella policy new <name> / init <path> / edit <file> — Author policy DSL locally
• stella policy lint <file> — Validate a policy DSL file locally, without contacting the backend
• stella policy validate-yaml <path> — Validate a policy pack YAML file against schema
• stella policy compile <file> / test <file> — Compile to IR and run coverage fixtures
• stella policy simulate <policy-id> — Simulate a revision against selected SBOMs and environment
• stella policy submit/review/publish/activate/rollback <policy-id> — Revision lifecycle
• stella policy sign <policy-id> / verify-signature <policy-id> — Signed revisions
• stella policy explain — Show the explanation tree for a decision
• stella policy verdicts — Export and inspect verdict history
• stella policy lattice — Inspect lattice structure and evaluation order
• stella policy history <policy-id> / version — Run history and version management

There is no stella policy list, validate, decisions or gates subcommand. Policy documents are authored as files and moved through the revision lifecycle above; verdict history is verdicts, and gate/evaluation structure is lattice.

Attestation & Signing

Attestation supports 25+ predicate types with keyless signing, key rotation, and attestation chains.

CLI Commands (verified against src/Cli/StellaOps.Cli 2026-07-29):

• stella attest sign — Create and sign a DSSE attestation envelope
• stella attest verify — Verify a DSSE envelope offline against policy and trust roots
• stella attest build — Mint build provenance (commit to artifact) via the Attestor
• stella attest list / show — List and inspect stored attestations
• stella attest fetch — Download attestation envelopes and payloads to disk
• stella attest bundle — Build and verify attestation bundles
• stella attest attach / oci-list / oci-verify — Attach and verify attestations on an OCI artifact
• stella attest link — Create a signed in-toto link attestation for a supply-chain step
• stella attest key — Manage attestation signing keys

There is no stella attest predicates, stella attest export or top-level stella keys command group. Key management is split by trust domain: stella attest key (attestation signing), stella issuer keys (issuer keys), stella key <verb> <anchor-id> (trust-anchor keys), stella crypto keys (Sigstore/cosign material), and stella kms (file-backed signing keys).

Regional Crypto (Sovereign Profiles)

Sovereign crypto is core to the open-source promise - no vendor lock-in on compliance. 8 signature profiles supported.

CLI Commands (verified against src/Cli/StellaOps.Cli 2026-07-29):

• stella crypto profiles list — List available crypto profiles
• stella crypto profiles select <profile> / show — Select and inspect the active profile
• stella crypto provider / providers — Manage and list the installation crypto provider
• stella crypto verify --input <path> [--provider <name>] — Verify a signature; the provider is selected with --provider, not --profile
• stella crypto plugins status — Show crypto plug-in status
• stella crypto fips — Manage FIPS-140 mode for the International provider

Determinism & Reproducibility

Scoring & Risk Assessment

Evidence & Findings

CLI Capabilities

Web UI Capabilities

Quota & Operations

Plan limits are stated once, in Plan Limits. The Free tier is 3 Environments and 999 New-Digest Scans in any rolling 24-hour period, per Installation.

How the limits are applied: the Free Usage Limits are a contractual term of the LICENSE, observed on the honour system. The server does not count New Hash Scans, does not meter them per Installation, and does not refuse work when the contractual limit is passed. There is no licence token or key that raises the limits, and no usage report is sent anywhere. Nothing in this table should be read as an enforced technical ceiling.

Operational controls that do ship, on all plans:

Offline & Air-Gap

Deployment

Access Control & Identity (Authority)

Authority provides OAuth 2.1/OIDC with 75+ authorization scopes, DPoP, and device authorization.

CLI Commands (verified against src/Cli/StellaOps.Cli 2026-07-29):

• stella auth login / logout — Acquire and clear cached access tokens
• stella auth status — Show cached token status
• stella auth whoami — Show cached token claims (subject, scopes, expiry)
• stella auth token mint — Mint a service-account token
• stella auth token delegate — Delegate your token to another principal
• stella auth revoke — Manage revocation exports
• stella identity-providers (alias idp) — Manage Authority-owned global identity providers
• stella tenants — Manage tenant contexts

Client, role, scope and API-key administration is a Console and Authority API surface. There is no stella auth clients, roles, scopes or api-keys subcommand, and no stella auth token introspect.

Notifications & Integrations

10 notification channel types with template engine, routing rules, and escalation.

CLI Commands (verified against src/Cli/StellaOps.Cli 2026-07-29):

• stella notify channels list/show/test — Channel management and test sends
• stella notify rules list — List routing rules
• stella notify deliveries — View and manage deliveries
• stella notify simulate — Simulate routing rules against events
• stella notify send <event-type> <body> / ack — Send and acknowledge notifications
• stella notify inbox — Read and acknowledge in-app inbox notifications

Rule authoring is a Console surface; there is no stella notify rules create. There is no stella zastava command group.

Scheduling & Automation

Observability & Telemetry

Support & Services

Version Comparison (Package Schemes)

Last updated: 6 Feb 2026 (rev 6.1 — Web UI Validation Results added). Legend defined at the top of this document.

Web UI Validation Results (6 Feb 2026)

Systematic Playwright-based validation of all Web UI routes and features. Sprint: SPRINT_20260206_021.

Validation Summary

Bugs Found

Feature Area Validation Status

Interactive Workflow Validation (Batch 4, 6 Feb 2026)

Total validated: 94+ pages/routes/workflows across 4 batches.

PASS* = UI renders correctly but API calls failed due to CORS (BUG-003, now FIXED — requires container rebuild)