DeltaSig v2 predicate

Verified against commit 942a18727c (2026-09-26). Re-verify with: git grep -n "PredicateType\|JsonPropertyName\|public const string" -- src/Vulnerabilities/__Libraries/StellaOps.Vulnerabilities.BinaryArtifacts/DeltaSig/Attestation/DeltaSigPredicateV2.cs

DeltaSig v2 is a function-level binary diff predicate. It adds per-function match states, optional symbol provenance, optional references to content-addressed IR diffs, and an explicit verdict with a confidence score to the v1 predicate.

The record types live in the closed BinaryArtifacts SDK: src/Vulnerabilities/__Libraries/StellaOps.Vulnerabilities.BinaryArtifacts/DeltaSig/Attestation/DeltaSigPredicateV2.cs (namespace StellaOps.BinaryIndex.DeltaSig.Attestation). The JSON Schema is docs/schemas/predicates/deltasig-v2.schema.json.

Identifiers

Constant	Value
`DeltaSigPredicateV2.PredicateType`	`https://stella-ops.org/predicates/deltasig/v2`
`DeltaSigPredicateV2.PredicateTypeName`	`stellaops/delta-sig/v2`
`schemaVersion` default	`2.0.0`

Root fields

Field	Required	Type	Notes
`schemaVersion`	yes	string	`2.0.0`
`subject`	yes	object	`purl`, `digest` (algorithm to value map); optional `arch`, `filename`, `size`, `debugId`
`functionMatches`	yes	array	See below
`verdict`	yes	string	`DeltaSigVerdicts`: `vulnerable`, `patched`, `unknown`, `partial`, `partially_patched`, `inconclusive`
`confidence`	no	number	0.0 to 1.0
`cveIds`	no	array of string
`computedAt`	yes	timestamp
`tooling`	yes	object	`lifter`, `lifterVersion`, `canonicalIr`, `matchAlgorithm`, `binaryIndexVersion` (required); `normalizationRecipe`, `hashAlgorithm` (default `sha256`), `casBackend`
`summary`	yes	object	`totalFunctions`, `vulnerableFunctions`, `patchedFunctions`, `unknownFunctions`, `functionsWithProvenance`, `functionsWithIrDiff`, `avgMatchScore`, `minMatchScore`, `maxMatchScore`, `totalIrDiffSize`
`advisories`	no	array of string	Omitted when null
`metadata`	no	object	Omitted when null
`sbomDigest`	no	string	Omitted when null
`largeBlobs`	no	array	`LargeBlobReference` entries; omitted when null

Function match

Field	Required	Notes
`name`	yes	Function name
`beforeHash`, `afterHash`	no	Function hashes before and after the change
`matchScore`	no	Number
`matchMethod`	yes	`MatchMethods`: `semantic_ksg`, `byte_exact`, `cfg_structural`, `ir_semantic`, `chunk_rolling`
`matchState`	yes	`MatchStates`: `vulnerable`, `patched`, `modified`, `unchanged`, `unknown`
`symbolProvenance`	no	`sourceId`, `observationId`, `fetchedAt`, `signatureState` (required); `packageName`, `packageVersion`, `distro`, `distroVersion`, `debugId`
`irDiff`	no	`casDigest` (required), `addedBlocks`, `removedBlocks`, `changedInstructions`; optional `statementsAdded`, `statementsRemoved`, `irFormat`, `casUrl`, `diffSize`
`address`, `size`	no	Numbers
`section`	no	Default `.text`
`explanation`	no	String

signatureState uses SignatureStates: verified, unverified, expired, invalid, failed, unknown, none.

Conversion from v1

DeltaSigPredicateConverter.ToV2(DeltaSigPredicate) composes a v2 predicate from the v1 base produced by the generation pipeline. Provenance and IR diff references are empty after conversion. There is no v2 to v1 downgrade: ToV1 and the CLI convert surface were removed.

Consumers

src/Cli/__Libraries/StellaOps.Cli.Plugins.DeltaSig/ contains a deltasig inspect command that detects the predicate type and prints v1 or v2 summaries, and a deltasig version command. No CLI host project references this library at the verified commit.
stella binary delta-sig (diff, attest, verify, gate) generates and verifies v1 predicates through DeltaSigService. stella deltasig works on delta signatures (extract, author, match, pack and related commands), not on the v2 predicate.