A concise, single-page “what does that acronym actually mean?” reference for developers, DevOps engineers, IT managers, and auditors who are new to the Stella Ops documentation set.
If you meet a term in any Stella Ops doc that is not listed here, please open a PR and append it alphabetically.
Note: definitions are kept deliberately short. For authoritative detail, follow the linked module dossier under docs/modules/** or the architecture index in ARCHITECTURE_REFERENCE.md.
| Term | Definition | Notes |
|---|
| ADR | Architecture Decision Record — lightweight Markdown file capturing one design decision. | Accepted ADRs live at docs/architecture/decisions/; proposals (RFCs) live at docs/rfcs/. |
| AIRE | AI Risk Evaluator — optional plug-in that suggests mute rules using an ONNX model. | Commercial feature. |
| Azure Pipelines | CI/CD service in Microsoft Azure DevOps. | Integrate via the stella CLI. |
| BDU | Russian (FSTEC) national vulnerability database (База данных уязвимостей). | Aggregated alongside NVD by Concelier. |
| Binary diff | Section-hash comparison between two binaries or images to detect changes without source. | Used by stella scan diff and the BinaryDiffV1 predicate. |
| BuildKit | Modern Docker build engine with caching and concurrency. | Needed for layer-cache patterns. |
| CI | Continuous Integration — automated build/test pipeline. | Stella integrates via the CLI. |
| Concelier | Vulnerability ingest/merge/export service that aggregates advisory feeds (NVD, GHSA, OSV, BDU, and more) into the canonical PostgreSQL store and export artifacts. | See docs/modules/concelier/. Preserves provenance (aggregation, not silent merge). |
| Cosign | Open-source Sigstore tool that signs and verifies container images and files. | Used for images and Offline Kit tarballs. |
| CWV / CLS | Core Web Vitals — Cumulative Layout Shift metric. | UI budget ≤ 0.1. |
| CycloneDX | Open SBOM (BOM) standard; an alternative to SPDX. | Supported ingest and export format. |
| Term | Definition | Notes |
|---|
| Digest (image) | SHA-256 hash uniquely identifying a container image or layer. | Releases pin digests, not tags, for reproducibility. |
| Docker-in-Docker (DinD) | Running a Docker daemon inside a CI container. | Used in some CI recipes. |
| DSSE envelope | Signed DSSE v1 wrapper that binds payload bytes to one or more signatures. | Used for attestations and binary-diff evidence. |
| DTO | Data Transfer Object — C# record serialized to JSON. | See docs/DATA_SCHEMAS.md (via docs/technical/DATA_SCHEMAS.md). |
| EPSS | Exploit Prediction Scoring System — probability that a CVE will be exploited. | Ingested by Concelier; consumed by the Policy Engine. |
| FSTEC | Russian regulator issuing SOBIT certificates. | Relevant to sovereign/regional crypto profiles. |
| Gitea | Self-hosted Git service. | Used for OSS hosting and mirrors. |
| GOST TLS | TLS cipher suites defined by Russian GOST R 34.10-2012 / 34.11-2012. | Provided via a crypto plug-in (for example CryptoPro). |
| Grype | Alternative OSS vulnerability scanner; can be hot-loaded as a plug-in. | Implements the IScannerRunner contract. |
| Term | Definition | Notes |
|---|
| Helm | Kubernetes package manager (charts). | Chart provided for K8s deployments. |
| HLC | Hybrid Logical Clock — (PhysicalTime, LogicalCounter, NodeId) tuple used for audit-safe total ordering. | See the HLC section of ARCHITECTURE_REFERENCE.md. |
| Hot-load | Runtime discovery and loading of plug-ins without restart. | Cosign-signed DLLs. |
| Hyperfine | CLI micro-benchmark tool used in performance benchmarks. | Outputs CSV. |
| JWT | JSON Web Token — bearer auth token issued by Authority. | Carries scopes and tenant claims. |
| K3s / RKE2 | Lightweight Kubernetes distributions (Rancher). | Supported in the K8s deployment guide. |
| Kubernetes NetworkPolicy | K8s resource controlling pod traffic. | Used to isolate Valkey/PostgreSQL. |
| Term | Definition | Notes |
|---|
| Mute rule | JSON object that suppresses specific CVEs until expiry. | Schema mute-rule-1.json. |
| NVD | US-based National Vulnerability Database. | Primary CVE source. |
| ONNX | Portable neural-network model format; used by AIRE and unified search. | Runs in-process. |
| OpenIddict | .NET library implementing OAuth 2 / OIDC inside the Authority service. | Embedded identity provider. |
| OUK | Offline Update Kit — signed tarball with images and feeds for air-gapped installs. | See OFFLINE_KIT.md. |
| OTLP | OpenTelemetry Protocol — exporter for traces and metrics. | Powers the /metrics surface. |
| Term | Definition | Notes |
|---|
| P95 | 95th-percentile latency metric. | Target ≤ 5 s on the SBOM path. |
| PDF SAR | Security Assessment Report PDF produced by the Pro edition. | Cosign-signed. |
| Plug-in | Hot-loadable DLL implementing a Stella contract (IScannerRunner, ITlsProvider, etc.). | Signed with Cosign. |
| PostgreSQL | Canonical relational store for module schemas, history, and audit logs. | Required for production. |
| Problem Details | RFC 7807 JSON error format returned by the API. | See docs/api/overview.md. |
| PURL | Package URL — canonical identifier for a software package. | Used in SBOM and version resolution. |
| Rekor | Sigstore transparency log used to anchor signatures. | Optional; mirror-capable for air-gap. |
| RPS | Requests Per Second. | Backend performance budget. |
| SBOM | Software Bill of Materials — inventory of packages in an image. | Ingest formats: Trivy JSON, SPDX, CycloneDX. |
| Section hash | Stable hash of a binary section (for example .text or .rodata). | Used for binary diff and backport evidence. |
| Seccomp | Linux syscall filter (JSON profile). | Backend ships non-root. |
| SLA | Service-Level Agreement. | Defined per support tier. |
| Span<T> | .NET ref-like struct for zero-allocation slicing. | Allowed with benchmarks. |
| Stella CLI | The stella command-line client for scanning, evidence, and operations. | See API_CLI_REFERENCE.md. |
| Stryker.NET | Mutation-testing runner used on critical libraries. | Coverage target ≥ 60 %. |
| Term | Definition | Notes |
|---|
| Trivy | OSS CVE scanner powering the default IScannerRunner. | CLI pinned per global.json/build config. |
| Trivy-srv | Long-running Trivy server exposing a gRPC API; speeds up remote scans. | Optional deployment variant. |
| UI tile | Dashboard element showing a live metric (scans today, feed age, etc.). | Built with Angular Signals. |
| Valkey | In-memory datastore (Redis-compatible) used for queues and cache. | Port 6379; also stores DPoP nonces. |
| VEX | Vulnerability Exploitability eXchange — statement asserting whether a product is affected by a CVE. | Processed by Excititor / VEX Lens. |
| Vendor backport | Vendor patch applied without a version bump; diff evidence proves the patch is present. | Key signal for VEX decisions. |
| WebSocket | Full-duplex channel used by the UI for real-time tiles. | For example /ws/scan, /ws/stats. |
| Zastava | Lightweight runtime agent that inventories running containers and can enforce kills. | Runtime signal source. |
| Version | Date | Notes |
|---|
| v1.1 | 2026-05-31 | Editorial pass: fixed alphabetical ordering, normalized hyphens, refreshed stale cross-references, added HLC/EPSS/PURL/VEX. |
| v1.0 | 2025-07-12 | First populated glossary — 52 terms covering the core docs. |
