VEX Statements, Review and Effective Status

Source-verified against commit 2021a48f6e (2026-10-05). Re-verify the named source contracts before applying this description to an installation. Re-verify: git show HEAD:src/Findings/__Libraries/StellaOps.Findings.Ledger.Application/Services/VexDecisionOverlayComposer.cs.

The supported flow combines issuer statements with operator decisions. Automatic AI authoring, signing and submission of a complete OpenVEX document is not a contract of this flow.

Statement path

  1. The Vulnerabilities hub ingests advisory and VEX facts with provenance.
  2. Signed issuer pushes use POST /api/vulnerabilities/v1/issuers/{issuerId}/vex. The configured issuer, OAuth client and verification key must agree.
  3. Scanner and Policy read the hub’s live facts and evaluate them with the shared consensus evaluator. Scanner scopes distro facts to the image’s release.
  4. Policy persists the tenant’s effective result in its gate projection.

Operator review

Findings serves POST and PATCH /api/findings/v1/vex-decisions. A component decision with a derivable product key can become a tenant-wide status overlay. A narrower environment, project or SBOM-node scope is stored and displayed without becoming that tenant-wide overlay.

Findings appends the overlay state in the decision’s transaction. Policy consumes the feed, re-derives the issue and applies the validity window. A superseded or withdrawn decision removes its effect. Findings displays Policy’s answer through the effective-status owner API.

Advisory AI’s POST /v1/advisory-ai/justify drafts rationale for a caller-proposed status and justification. A draft does not persist a Findings decision or submit a signed issuer document.

Verification

Read the issue’s hub facts, Policy’s tenant answer and the displayed finding after a decision. Evaluate the same promotion before, during and after withdrawal. A successful decision write alone does not establish that the projection or promotion has applied it.

See the consensus runbook, overlay feed contract and Policy architecture.

The earlier design is frozen history. It does not describe the current runtime.