stella assurance — Command Guide

Audience: Compliance operators and tenant administrators preparing regulatory evidence (NIS2, DORA, CRA). Scope: Assurance pack discovery, tenant readiness checks, and tenant-owned operator configuration. Artifact creation lives in the export commands.

The stella assurance commands expose optional Assurance pack discovery and tenant readiness without making the CLI region-specific. The commands use pack ids such as nis2, dora, cra.product-security, and cra.technical-documentation; jurisdiction is descriptor metadata, not a CLI namespace.

Commands

• stella assurance packs list [--json]
• stella assurance pack inspect <packId> [--json]
• stella assurance pack status <packId> --tenant <tenant> [--json]
• stella assurance operator-config show --tenant <tenant> [--json]
• stella assurance operator-config export --tenant <tenant> --output <path> [--json]
• stella assurance operator-config update --tenant <tenant> --input <path> --reason <reason> [--json]

Descriptor Discovery

packs list and pack inspect read the embedded assurance-pack-v1 descriptors packaged with the CLI. They do not contact Authority, ExportCenter, Notify, or any external network.

JSON output is deterministic:

• list output uses schema version assurance-pack-discovery.v1;
• pack ordering is by packId using ordinal ordering;
• descriptor inspection returns the embedded assurance-pack-v1 document.
• descriptors include evidence scope metadata and coverage summaries so NIS2 and DORA remain scoped to Stella-observed software estate plus labelled operator-supplied gaps.

The embedded descriptors are:

NIS2 and DORA descriptors must include:

• operator-observed-estate for services, releases, images, integrations, plugins, host agents, and evidence bundles Stella can observe or control;
• operator-supplied for legal, governance, contract, HR, physical security, risk-tolerance, and filing facts the operator must supply;
• stella-supplier when Stella’s signed release, SBOM/VEX, lifecycle, CVD, and incident-notification posture is attached as supplier evidence.

The dora descriptor is documented in docs/compliance/packs/dora/README.md. Descriptor discovery does not mean tenant readiness. stella assurance pack status dora may return unavailable or blocked until Authority pack enablement, ExportCenter DORA export profiles, and Notify DORA reporting profile readiness are wired and configured.

Tenant Readiness

pack status checks live tenant readiness and exits fail-closed unless every required readiness line is configured.

The command composes:

• Authority pack enablement/readiness: GET /api/v1/tenants/{tenantId}/assurance-packs
• ExportCenter profile readiness: GET /v1/exports/assurance/profiles/{profileId}/readiness
• Notify reporting timeline readiness: GET /api/v1/assurance/reporting-timeline-profiles/{timelineProfileId}/readiness

JSON output uses schema version assurance-pack-status.v1 and includes stable reason codes. Non-configured states return SERVICE_NOT_CONFIGURED.

Fail-closed examples include:

• authority-api-unavailable
• pack-disabled
• exportcenter-api-unavailable
• export-profile-not-found
• signing-key-missing
• tenant-export-trust-roots-missing
• notify-api-unavailable
• reporting-profile-not-found

The command must not print private key material, secret values, local secret paths, or response bodies from failed service calls.

Operator Configuration

operator-config reads and writes tenant-owned Assurance settings through the Authority Console admin surface:

• GET /console/admin/tenants/{tenantId}/operator-compliance
• PUT /console/admin/tenants/{tenantId}/operator-compliance

The output schema is operator-compliance-config.v1. It includes the Authority settings hash, sanitized tenant-operator-compliance-settings.v1, counts for approvers, Assurance packs, retention policies, channels, and effective retention policy rows. The CLI resolves absent dora-roi retention to the Authority default of 7 years so operators can see the effective policy without claiming legal compliance.

operator-config export writes the sanitized JSON view to disk. If Authority ever returns a secret-like key or private-key material, the CLI redacts the value, sets secretValuesRedacted=true, and exits non-zero.

operator-config update accepts either a raw tenant-operator-compliance-settings.v1 JSON document or an export wrapper with a top-level settings object. It refuses input containing secret-like or deployment-posture fields such as privateKey, secretRef, token, trustRoot, or deploymentPosture; those values must remain sealed or environment configuration.

Relationship to Export Commands

Assurance pack status is a readiness and discovery surface. It does not replace the pack-specific export and verification commands.

Use the existing commands to create and verify artifacts:

• NIS2: stella export nis2-soa, stella export nis2-effectiveness, stella verify nis2-effectiveness
• DORA: stella incident classify, stella export dora-incident-report, stella verify dora-incident-report, stella export dora-roi, stella verify dora-roi, stella export dora-info-sharing, stella verify dora-info-sharing, stella tlpt pack, stella verify tlpt-pack
• CRA technical documentation: stella export cra-tech-file, stella verify cra-tech-file, stella export conformity-dossier

See stella export for export command inputs, local signing keys, offline behavior, and fail-closed rules.