stella - DORA incident commands

Audience: customer operators who must classify, package, and verify evidence for major ICT-related incidents under the EU Digital Operational Resilience Act (DORA).

Purpose

The DORA incident commands give operators an offline, deterministic handoff flow for major ICT-related incident evidence:

• stella incident classify <id> classifies frozen incident facts against the seven DORA criteria.
• stella export dora-incident-report <id> produces a signed filesystem handoff for the initial, intermediate, or final report variant.
• stella verify dora-incident-report <path> replays the handoff manifest, artifact hashes, DSSE payload binding, and local HMAC signature offline.

The commands do not submit to a regulator. They produce local evidence that the operator can review, approve, retain, and file through the configured authority process.

Classification

Prepare a local doraIncidentClassification input JSON containing incident facts, the tenant compliance profile snapshot, and any frozen telemetry snapshot. The command fails closed when the input is missing, malformed, or the incident id does not match the command argument.

stella incident classify incident-dora-payments-001 \
  --input ./evidence/dora/incident-dora-payments-001/classification-input.json \
  --output ./evidence/dora/incident-dora-payments-001/classification.json \
  --json

The output includes the schema version, legal basis, seven criterion results, evidence refs, and override audit records already present in the classifier contract. Re-running with the same frozen input produces the same JSON bytes.

Report Export

Prepare a local dora-major-incident-report.v1 input JSON. The export command uses the existing DORA encoder and outbound filesystem channel to produce:

• XBRL report artifact.
• Inline XBRL report artifact.
• Local report envelope.
• DSSE signed envelope.
• Handoff manifest with artifact hashes.

stella export dora-incident-report incident-dora-payments-001 \
  --variant initial \
  --input ./evidence/dora/incident-dora-payments-001/initial-report-input.json \
  --output ./handoff/dora \
  --signing-key-file ./trust/local-dora-handoff.key \
  --signing-key-id dora-handoff-2026-04 \
  --produced-at 2026-04-30T10:15:00Z \
  --json

Supported variants are initial, intermediate, and final. The output path is deterministic:

<output>/<tenantId>/<incidentId>/<variant>/

Use --overwrite only when replacing a local generated handoff before it has been approved or retained. Do not edit generated artifacts by hand; correct the source input and re-run the command.

Handoff Verification

Run the verifier before approval, filing, or retention. The path may be the variant directory, a parent handoff directory that contains exactly one *.handoff-manifest.json, or the exact manifest file.

stella verify dora-incident-report ./handoff/dora/tenant-bank-de/incident-dora-payments-001/initial-report \
  --signing-key-file ./trust/local-dora-handoff.key \
  --signing-key-id dora-handoff-2026-04 \
  --json

The verifier fails closed when any listed artifact is missing or has a hash mismatch, when the DSSE payload differs from the unsigned envelope artifact, or when the local HMAC signature cannot be reproduced with the supplied key. The local HMAC signature is an offline handoff tamper check only; it is not production CAdES/KMS signing or regulator submission.

Verification Checklist

• Confirm the classification output hash is stable across two clean runs.
• Confirm the handoff manifest hash is stable across two clean report exports from the same input, signing key, and --produced-at timestamp.
• Run stella verify dora-incident-report and confirm the verifier reports isValid: true.
• Confirm the DSSE envelope hash is present in the handoff manifest and the verifier replays the DSSE payload binding to the unsigned envelope artifact.
• Confirm autoSubmit is NotRequested unless the tenant has separately configured an approved DORA outbound channel.
• Store the command output, generated artifacts, hashes, and operator approval references in Evidence Locker.

Blocking Conditions

Do not use the generated handoff for filing when any of these are true:

• The tenant compliance profile is missing LEI, jurisdiction, or financial entity status.
• Any DORA report input validation fails.
• The produced handoff hash differs between clean runs from the same frozen inputs.
• stella verify dora-incident-report reports an artifact hash mismatch, DSSE payload mismatch, or signature mismatch.
• The operator approval reference is missing for a report variant that requires approval.
• The tenant intends auto-submit but lacks explicit channel opt-in, authorized approvers, and fresh authentication evidence.

Related Documents

• DORA gap closure plan
• EU sprint execution directions
• DORA RoI export runbook