stella export dora-roi — Annual Filing Runbook

Audience: compliance owners and operators at a DORA financial-entity tenant who produce the annual Register of Information handoff bundle.

Status: implemented local-contract CLI surface. Official EBA taxonomy/XSD validation remains blocked until the approved taxonomy package is available offline.

Purpose

stella export dora-roi produces the annual DORA Register of Information (RoI) handoff bundle for a financial-entity tenant from a local dora-roi.v1 input JSON file. Stella supplies the deterministic local export, local HMAC signature, prior-year hash binding, and evidence-retention defaults. The customer/operator remains responsible for the RoI content, legal review, competent-authority submission, and effective tenant retention choice.

This runbook follows the local DORA-Q1 and DORA-Q6 decisions: produce-and-sign is the default submission posture, and RoI snapshots retain for 7 years by default with a tenant override allowed only in the inclusive 5 to 10 year range.

Required Inputs

Local dora-roi.v1 register JSON with LEI, legal entity name, jurisdiction, DORA financial-entity flag, functions, ICT services, providers, contractual arrangements, and subcontracting-chain provenance.
RoI encoder output is produced by the CLI for templates B.01 through B.14.
The local taxonomy marker is its-eu-2024-2956-local-contract-v1. This is not an EBA taxonomy package and must not be represented as fileable XBRL.
A pinned official RoI schema/taxonomy package is still required before the bundle can be treated as regulator-fileable.
Prior-year RoI bundle or prior-year bundle hash when a previous annual filing exists.
Evidence Locker retention policy for annual RoI snapshots. See DORA RoI retention.

Do not edit generated XML or bundle indexes by hand. Correct source data in the tenant profile, asset registry, or integration metadata, then re-export.

Command Shape

Export:

stella export dora-roi \
  --year 2026 \
  --tenant tenant-bank-de \
  --input ./inputs/dora-roi/tenant-bank-de/2026/register.json \
  --output ./exports/dora-roi/tenant-bank-de/2026/roi-2026.zip \
  --signing-key-file ./keys/dora-roi.hmac \
  --retention-years 7 \
  --offline \
  --json

Verify:

stella verify dora-roi \
  ./exports/dora-roi/tenant-bank-de/2026/roi-2026.zip \
  --signing-key-file ./keys/dora-roi.hmac \
  --json

Options:

Option	Use
`--input <path>`	Required local `dora-roi.v1` register JSON.
`--signing-key-file <path>`	Required local HMAC key file for deterministic offline signing and verification.
`--signing-key-id <id>`	Optional key id recorded in `signature.json`; if omitted, the CLI derives one from the key hash.
`--prior-year-bundle <path>`	Compute and bind the previous annual bundle archive hash.
`--prior-year-hash sha256:<hex>`	Bind the new manifest to the previous annual snapshot when the prior bundle is already retained elsewhere.
`--retention-years <5..10>`	Apply a tenant-approved retention override for this RoI snapshot.
`--retention-override-ticket <id>`	Required when `--retention-years` differs from the tenant default.
`--retention-override-reason <text>`	Required when `--retention-years` differs from the tenant default.
`--offline`	Operator assertion that the command uses local input only.
`--format json` or `--json`	Emit machine-readable summary for evidence capture.
`--overwrite`	Replace an existing destination bundle.

Annual Filing Flow

Freeze the reporting window.
- Confirm the reporting year.
- Record the tenant compliance profile revision, asset registry revision, integrations snapshot, RoI contract version, and local schema/taxonomy package version.
- Confirm all source timestamps are UTC and the exporter runs with --offline.
Check operator-filled fields.
- LEI and legal entity name must match the tenant compliance profile.
- Contract references, start dates, end dates, criticality, governing-law country, and provider country must be complete where required by the RoI templates.
- Direct ICT providers can be auto-captured from integrations. Deeper subcontracting-chain ranks are operator-filled and must carry provenance.

Export the annual bundle.

stella export dora-roi \
  --year 2026 \
  --tenant tenant-bank-de \
  --input ./inputs/dora-roi/tenant-bank-de/2026/register.json \
  --output ./exports/dora-roi/tenant-bank-de/2026/roi-2026.zip \
  --signing-key-file ./keys/dora-roi.hmac \
  --retention-years 7 \
  --offline \
  --json \
  > ./exports/dora-roi/tenant-bank-de/2026/roi-2026.summary.json

Verify deterministic output.
- Re-run the export from the same frozen inputs.
- The bundle hash, template hashes, prior-year hash, and summary JSON must match byte-for-byte.
- Verify the signed bundle with the local HMAC key:
```
stella verify dora-roi \
  ./exports/dora-roi/tenant-bank-de/2026/roi-2026.zip \
  --signing-key-file ./keys/dora-roi.hmac \
  --json
```
Store evidence.
- Store the signed RoI bundle in Evidence Locker.
- Store the summary JSON and verification output.
- Record Evidence Locker IDs, bundle hash, signer key ID, retention years, retain-until date, and any prior-year hash in the tenant filing ticket.
Submit outside Stella unless the tenant has separately enabled an approved auto-submit channel. The default Stella outcome is a signed handoff bundle for the operator to file under its own governance.

Prior-Year Binding

When a previous annual filing exists, bind the new bundle to the previous archive hash:

stella export dora-roi \
  --year 2026 \
  --tenant tenant-bank-de \
  --input ./inputs/dora-roi/tenant-bank-de/2026/register.json \
  --output ./exports/dora-roi/tenant-bank-de/2026/roi-2026.zip \
  --prior-year-bundle ./exports/dora-roi/tenant-bank-de/2025/roi-2025.zip \
  --signing-key-file ./keys/dora-roi.hmac \
  --retention-years 7 \
  --offline \
  --json

Current CLI behavior records only the prior-year archive hash in manifest.json; it does not generate a row-level diff report. A deterministic row diff remains a future follow-up and must be implemented against the same local contract before it is documented as a command option.

Operator review is required for:

Provider additions or removals.
Contract dates, contract references, annual value, or criticality changes.
Any subcontracting-chain change beyond direct-provider rank 1.
Any change caused by operator-filled data rather than Stella-observed source data.

If no prior-year bundle exists, record the reason in the filing ticket and preserve the first-year bundle hash as the future diff anchor.

Retention Overrides

Default annual RoI retention is 7 years. A customer/operator may set a tenant override between 5 and 10 years. Values outside that range must fail closed.

Use an override only when the tenant compliance owner has approved it:

stella export dora-roi \
  --year 2026 \
  --tenant tenant-bank-de \
  --input ./inputs/dora-roi/tenant-bank-de/2026/register.json \
  --output ./exports/dora-roi/tenant-bank-de/2026/roi-2026.zip \
  --signing-key-file ./keys/dora-roi.hmac \
  --retention-years 10 \
  --retention-override-ticket DORA-RET-2026-0042 \
  --retention-override-reason "Tenant policy requires ten-year RoI evidence retention" \
  --offline \
  --json

The export summary includes the effective retention years and retain-until date. The bundle manifest records the retention basis plus optional override ticket and reason. Shortening retention below an already committed regulatory or customer period requires counsel approval and a new audit event.

Blocking Conditions

Do not submit the bundle when any of these are true:

The tenant is not marked as a DORA financial entity.
LEI validation fails.
Required B.01 through B.14 source fields are missing.
The schema/taxonomy package is not pinned locally and the bundle is marked as local-contract-only.
The prior-year hash in the new bundle does not match the prior signed bundle.
The retention override is outside 5 to 10 years or lacks audit metadata.
Bundle verification fails or produces a different hash on a clean re-run.

Evidence Checklist

Signed RoI ZIP and content hash.
index.json with template hashes and schema/taxonomy version.
manifest.json with payload type, input hash, retention metadata, and optional prior-year hash.
signature.json with local HMAC key id and manifest signature.
Verification output from the local HMAC verifier.
Prior-year hash or first-year no-prior-year justification.
Retention declaration and retain-until date.
Retention override approval, when used.
Operator sign-off and filing ticket.
Evidence Locker IDs and audit event IDs.