Binary operations diagnostics
stella binary ops health and stella binary ops config read the Vulnerabilities hub through the existing ops.health capability. Both support --format text and --format json.
stella binary ops health --format json
stella binary ops config --format json
The hub URL comes from StellaOps:VulnerabilitiesUrl (or STELLAOPS_VULNERABILITIES_URL), with StellaOps:BackendUrl as the shared gateway fallback. The commands use the existing CLI API-key or Authority token configuration.
| Command | Authoritative response |
|---|---|
health | The hub web host’s measurement time and committed row counts for binary identities, package maps, binary facts and fingerprints. Empty tables remain measured zero counts. |
config | The database and role used by the hub connection, plus its registered binary serving routes. Connection secrets are excluded. |
These diagnostics describe vulnerabilities-web. Worker analyzer admission and reference-generation configuration remain at the worker; the web response does not report their defaults as active settings.
An unavailable store, denied request, missing URL, unreachable hub or malformed response produces a nonzero CLI exit and no diagnostic result. The owner endpoints are GET /api/vulnerabilities/v1/binaries/ops/health and GET /api/vulnerabilities/v1/binaries/ops/config.
Withdrawn predecessor commands
BIN-8 removes stella binary ops bench and stella binary ops cache. The predecessor benchmark collected no lifter samples and stopped timing cache calls before awaiting their completion. Its cache service is no longer registered in production, so the cache endpoint returned fabricated disabled/zero values. There is no replacement runtime benchmark or cache-statistics claim for those commands.
For vulnerability facts and distro fix state, the supported owner reads remain stella binary lookup and stella binary fix-status; those commands are separate from operational diagnostics.
stella binary fix-status debian bookworm openssl --format json reads current retained distributor statements for an exact release and source package. Debian security-tracker and Alpine secdb are the supported producers. A fixedVersion is a threshold, not a verdict about an unspecified installed binary. Each supported row includes its canonical evidenceHash and owner evidenceRef; the distribution evidence contract describes their binding and the Findings version comparison. The CLI requests Authority’s required advisory:read aoc:verify scope pair for these reads; operational diagnostics retain their separate ops.health request and token cache identity.