Audience: Docs Guild, Console Guild, CLI Guild, DevOps automation.
Scope: Track feature-level parity between the StellaOps Console and the stella CLI, and surface pending work. The matrix is maintained by hand; no CI lane reads it (section 9).
Status key:
- ✅ Available – command exists in
StellaOps.Cli and is documented. - 🟡 In progress – command implemented but still under active delivery (task status
DOING). - 🟩 Planned – command spec’d but not yet implemented (task
TODO). - ⚪ UI-only – no CLI equivalent required.
- 🔴 Gap – CLI feature missing with no active task; file a task before sprint exit.
- ❌ Withdrawn – the CLI command was withdrawn because no service serves its route.
| UI capability | CLI command(s) | Status | Notes / Tasks |
|---|
Login / token cache status (/console/profile) | stella auth login, stella auth status, stella auth whoami | ✅ Available | Command definitions in CommandFactory.BuildAuthCommand. |
| Fresh-auth challenge for sensitive actions | stella auth fresh-auth | ✅ Available | Referenced in docs/UI_GUIDE.md (Admin). |
| Tenant switcher (UI shell) | --tenant flag across CLI commands | ✅ Available | All multi-tenant commands require explicit --tenant. |
| Tenant creation / suspension | (pending CLI) | 🟩 Planned | No stella auth tenant * commands yet – track via CLI-TEN-47-001 (scopes & tenancy). |
| UI capability | CLI command(s) | Status | Notes / Tasks |
|---|
| Policy simulation diff, explain | stella policy simulate | 🟡 In progress | Implementation present; task CLI-POLICY-20-002 marked DOING. |
| Promote / activate policy | stella policy promote, stella policy activate | 🟩 Planned | Spec tracked under CLI-POLICY-23-005. |
| History & explain trees | stella policy history, stella policy explain | 🟩 Planned | CLI-POLICY-23-006. |
| Findings explorer export | stella findings get, stella findings export | 🟩 Planned | Part of CLI-POLICY-20-003. |
| Explain drawer JSON | stella policy simulate --format json | 🟡 In progress | Same command; JSON output flagged for CLI tests. |
| UI capability | CLI command(s) | Status | Notes / Tasks |
|---|
| Run retry / cancel | stella runs retry, stella runs cancel | 🟩 Planned | Included in export suite task CLI-EXPORT-35-001. |
| Manual run submit / preview | stella runs submit, stella runs preview | 🟩 Planned | CLI-EXPORT-35-001. |
| Evidence bundle export | stella runs export --run <id> --bundle | 🟩 Planned | CLI-EXPORT-35-001. |
| Run status polling | stella runs status | 🟩 Planned | Same task. |
| UI capability | CLI command(s) | Status | Notes / Tasks |
|---|
| Advisory observations search | stella vuln observations | ✅ Available | Implemented via BuildVulnCommand. |
| Advisory linkset export | stella advisory linkset show/export | 🟩 Planned | CLI-LNM-22-001. |
| VEX observations / linksets | none | ❌ Withdrawn | The CLI commands called tenant observation routes no service serves; withdrawn 2026-09-30 (SPRINT_20260930_002 PCD-198). |
| SBOM overlay export | stella sbom overlay apply/export | 🟩 Planned | Scoped to upcoming SBOM CLI sprint (SBOM-CONSOLE-23-001/002 + CLI backlog). |
Advisory source generations (Console /ops/integrations/advisory-vex-sources) | `stella config sources list | status` | ✅ Available |
VEX provider catalog (Console /ops/integrations/advisory-vex-sources/vex-providers) | none | ❌ Withdrawn | The CLI provider commands called the retired Excititor host’s /excititor/providers/*; withdrawn 2026-09-30 (SPRINT_20260930_002 PCD-198). |
| UI capability | CLI command(s) | Status | Notes / Tasks |
|---|
| Manifest lookup (Console Downloads) | stella downloads manifest show --artifact <id> | 🟩 Planned | Delivered with CONSOLE-DOC-23-502 + CLI parity commands. |
| Mirror digest to OCI archive | stella downloads mirror --artifact <id> --to <target> | 🟩 Planned | Same task bundle (CONSOLE-DOC-23-502). |
| Console health check | stella console status --endpoint <url> | 🟩 Planned | Tracked in CONSOLE-DOC-23-502; interim use curl as documented. |
| Offline kit import and status | stella offline import --bundle <path>, stella offline status, stella offline kit status | ✅ Available | offline kit import and offline kit pull were deleted (OK-7, EA-1); air-gap ingress is stella airgap pull --run <id> then stella airgap import --bundle <path>. |
| UI capability | CLI command(s) | Status | Notes / Tasks |
|---|
| Compliance profile selection (Console crypto-provider panel) | stella crypto profiles list, stella crypto profiles show, stella crypto profiles select <name> | ✅ Available — converged | Both surfaces now persist via the same store. CLI uses hybrid persistence: platform admin endpoint (PUT /api/v1/admin/crypto-providers/preferences) when BackendUrl is configured, local YAML (~/.stellaops/appsettings.crypto.yaml) otherwise. Sprint SPRINT_20260503_006_Cli_crypto_profile_persistence. |
| UI capability | CLI command(s) | Status | Notes / Tasks |
|---|
| Client creation / rotation | stella auth client create (planned) | 🟩 Planned | Pending tenancy backlog CLI-TEN-47-001. |
| Token revoke | stella auth revoke export/verify | ✅ Available | Already implemented. |
| Audit export | stella auth audit export | 🟩 Planned | Needs CLI work item (Authority guild). |
| Signing key rotation | stella auth signing rotate | 🟩 Planned | To be added with AUTH-CONSOLE-23-003 follow-up. |
| UI capability | CLI command(s) | Status | Notes / Tasks |
|---|
| Telemetry dashboard parity | stella obs top, stella obs trace, stella obs logs | 🟩 Planned | CLI observability epic (CLI-OBS-51-001, CLI-OBS-52-001). |
| Incident mode toggle | `stella obs incident-mode enable | disable | status` |
| Verify console telemetry health | stella console status --telemetry | 🟩 Planned | Part of CONSOLE-DOC-23-502. |
- Tenant and client lifecycle CLI: create/suspend tenants, manage clients. Coordinate with Authority CLI epic (
CLI-TEN-47-001, CLI-TEN-49-001). - Downloads parity commands: blocked on
CONSOLE-DOC-23-502 and DevOps pipeline DOWNLOADS-CONSOLE-23-001. - Policy promotion/history: requires completion of CLI policy epic (
CLI-POLICY-23-005/23-006). - Runs/evidence exports: waiting on
CLI-EXPORT-35-001. - Observability tooling: deliver
stella obs commands before marking the telemetry rows Available.
Document updates should occur whenever a row changes status. When promoting a command from Planned → Available, ensure:
- CLI command merged with help text.
- Relevant UI doc references updated to remove “pending” callouts.
- This matrix row status updated to ✅ and task IDs moved to release notes.
- No CI lane or
stella subcommand reads this matrix. It is reviewed by hand for each release (operations/release-and-packaging.md, section 6). - The planned
cli-parity-console.yml workflow and check-console-cli-parity.sh script were never committed. The former check_cli_parity.py release script was removed on 2026-09-26: it read a path this file no longer lives at, no workflow ran it, and its glyph set did not match the status key above. - What is checked automatically:
CliDocumentationContractTests in StellaOps.Cli.Tests parses every runnable-looking stella example in docs/, including the command cells of this matrix, against the real command tree. A Planned command that does not parse must be listed in unshipped-command-examples.json; a listed command that starts parsing fails the test until its entry is removed, which is the signal to move the row to ✅.
- [ ] Matrix reflects latest command availability (statuses accurate, task IDs linked).
- [ ] Notes include owning backlog items for every 🟩 / 🟡 row.
- [ ] CLI commands marked ✅ have corresponding entries in
/docs/modules/cli/guides/*.md or module-specific docs. - [ ] Install / observability guides reference this matrix for pending CLI parity.
- [ ] Offline workflows capture CLI fallbacks when commands are pending.
- [ ] Docs Guild review recorded in the release sprint’s Execution Log.
docs/UI_GUIDE.md – console workflow overview for parity context./docs/operations/console-docker-install.md – CLI parity section for deployments./docs/observability/ui-telemetry.md – telemetry metrics referencing CLI checks./docs/security/console-security.md – security metrics & CLI parity expectations.- Active sprint files under
docs/implplan/ – the only task ledger for CLI work (src/Cli/StellaOps.Cli/TASKS.md no longer exists). /docs/implplan/archived/updates/2025-10-28-docs-guild.md – coordination note for Authority/Security follow-up.
Last updated: 2026-05-04 (Sprint SPRINT_20260503_013 — VEX provider parity + advisory sources catalog rows).
Aligned sprints:
SPRINT_20260226_222_Cli_proof_chain_verification_and_replay_paritySPRINT_20260226_227_FE_triage_risk_score_widget_wiring_and_parity
Parity outcomes in this batch:
- CLI proof verification flows now align with deterministic verification contracts used by UI evidence and score surfaces.
- UI risk and score widgets are covered by active E2E suites and no longer tracked as skipped test debt.
- Replay/score explain integration paths use the same deterministic error semantics across CLI and UI consumers.
