stella export — Command Guide

Audience: compliance and release operators who produce deterministic, locally verifiable evidence bundles (mirror, conformity dossiers, CRA technical files, NIS2 and DORA filings) from a connected or air-gapped Stella Ops install.

Product-facing assurance pack summaries live under NIS2 SoA export, NIS2 KPI dashboard, CRA technical file, and CRA conformity dossier. This guide documents the CLI command surface and local/offline execution details. Use stella assurance to list optional packs, inspect embedded descriptors, and check tenant readiness before running pack-specific exports.

Commands

Flags (common)

Inputs/outputs

Assurance readiness

stella assurance pack status <packId> --tenant <tenant> is the generic readiness check for optional packs. It composes Authority pack enablement, ExportCenter export readiness, and Notify reporting timeline readiness. A non-configured result fails closed with stable reason codes and does not print secret values or local secret paths.

Assurance status does not replace export commands. It points operators to the pack-specific command that creates the artifact:

CRA conformity dossier

stella export conformity-dossier is an offline/local command that calls the Export Center cra:conformity-dossier adapter directly. It does not query live services and does not synthesize missing evidence.

Flags:

Example:

stella export conformity-dossier \
  --module A \
  --product product:stella-ops \
  --input ./cra/conformity-input.json \
  --output ./out/stella-ops.conformity-dossier-a.tar.gz \
  --json

The input file binds frozen local evidence refs to the adapter contract. The shape below is abbreviated; arrays shown as empty must be populated according to the fail-closed rules for the selected module.

{
  "schemaVersion": "conformity-dossier-cli-input-v1",
  "generatedAt": "2026-04-30T10:00:00Z",
  "product": {
    "name": "Stella Ops",
    "version": "2026.04",
    "manufacturer": "Stella Ops",
    "description": "Self-hosted release control plane"
  },
  "release": {
    "version": "2026.04",
    "releaseManifestRef": "attestor://release-manifests/stella-2026.04",
    "sbomRef": "evidence://cra/sbom",
    "placedOnMarketAt": "2026-04-30",
    "supportUntil": "2031-04-30"
  },
  "evidenceRefs": [],
  "harmonisedStandards": [],
  "euDeclarationOfConformity": {
    "status": "draft",
    "manufacturerName": "Stella Ops",
    "manufacturerAddress": "TBD",
    "responsibleRole": "product-owner",
    "declarationRef": "docs/legal/cra-product-classification.md"
  },
  "supportPolicy": {
    "policyRef": "docs/europe/stella-supplier-security-statement.md",
    "supportWindow": "5-year minor-train security support baseline",
    "securityContactRef": "docs/product/security-contact.md"
  },
  "sourceRefs": {},
  "declaredControls": [],
  "evidenceLinks": [],
  "testCertificates": [],
  "auditSignatures": [],
  "qmsEvidence": [],
  "iso27001ControlEffectiveness": []
}

Fail-closed rules:

CRA technical file

stella export cra-tech-file creates the deterministic CRA Annex VII technical file bundle from a local cra-tech-file-cli-input-v1 JSON file and verifies the generated archive before reporting success. stella verify cra-tech-file replays bundle integrity and the local HMAC DSSE signature offline.

See stella export cra-tech-file for the input schema, signing-key options, and fail-closed verification rules.

NIS2 Statement of Applicability

stella export nis2-soa creates a deterministic signed NIS2 Statement of Applicability bundle from a local nis2-control-register-v1 snapshot and a tenant compliance profile. The profile can be supplied from a local file or resolved from Authority by tenant id when the CLI is configured for live API access.

Flags:

Fail-closed rules:

Standards mapping

stella export standards-mapping is an offline/local command that calls the Export Center standards:mapping adapter directly. It reads only local YAML files and writes a deterministic signed .tar.gz bundle.

Supported targets:

Flags:

Example:

stella export standards-mapping \
  --target iso27001 \
  --mapping-dir docs/europe/standards-mapping \
  --signing-key-file ./keys/standards-mapping.hmac \
  --signing-key-id eu-local-standards-mapping \
  --output ./out/iso27001.standards-mapping.tar.gz \
  --json

Fail-closed rules:

NIS2 effectiveness report

stella export nis2-effectiveness creates the deterministic monthly NIS2 effectiveness report bundle from a local nis2-effectiveness-dashboard-v1 JSON report and verifies the generated bundle before reporting success. stella verify nis2-effectiveness replays the same checks offline.

Flags:

Example:

stella export nis2-effectiveness \
  --month 2026-04 \
  --report ./out/nis2-effectiveness-dashboard.json \
  --signing-key-file ./keys/nis2-effectiveness.hmac \
  --signing-key-id eu-local-nis2-effectiveness \
  --target-document-ref policy://target-documents/nis2/2026-04 \
  --control-register-snapshot-ref policy://control-registers/nis2/2026-04 \
  --policy-snapshot-ref policy://snapshots/nis2/2026-04 \
  --output ./out/nis2-effectiveness-tenant-a-202604.bundle.json \
  --json

Verify:

stella verify nis2-effectiveness \
  --bundle ./out/nis2-effectiveness-tenant-a-202604.bundle.json \
  --signing-key-file ./keys/nis2-effectiveness.hmac \
  --signing-key-id eu-local-nis2-effectiveness \
  --json

Fail-closed rules:

DORA Register of Information

stella export dora-roi creates a deterministic signed ZIP bundle from a local dora-roi.v1 register JSON file. stella verify dora-roi replays the ZIP index, manifest, template hashes, bundle hash, and local HMAC signature offline.

Flags:

Example:

stella export dora-roi \
  --year 2026 \
  --tenant tenant-bank-de \
  --input ./inputs/dora-roi/tenant-bank-de/2026/register.json \
  --output ./out/tenant-bank-de.roi-2026.zip \
  --signing-key-file ./keys/dora-roi.hmac \
  --json

Verify:

stella verify dora-roi \
  ./out/tenant-bank-de.roi-2026.zip \
  --signing-key-file ./keys/dora-roi.hmac \
  --json

Fail-closed rules:

DORA major incident report

stella export dora-incident-report creates an offline filesystem handoff for an initial, intermediate, or final DORA major-incident report. stella verify dora-incident-report replays the handoff manifest, artifact hashes, DSSE payload binding, and local HMAC signature without live Stella services.

Flags:

Example:

stella export dora-incident-report incident-dora-payments-001 \
  --variant initial \
  --input ./inputs/dora/incident-dora-payments-001/initial.json \
  --output ./out/dora \
  --signing-key-file ./keys/dora-incident.hmac \
  --signing-key-id eu-local-dora-incident \
  --produced-at 2026-04-30T10:15:00Z \
  --json

Verify:

stella verify dora-incident-report ./out/dora/tenant-bank-de/incident-dora-payments-001/initial-report \
  --signing-key-file ./keys/dora-incident.hmac \
  --signing-key-id eu-local-dora-incident \
  --json

Fail-closed rules:

DORA information sharing

stella export dora-info-sharing creates an offline filesystem handoff for a DORA Article 45 STIX/TAXII information-sharing batch. stella verify dora-info-sharing replays the receipt, artifact hashes, TAXII manifest purpose, DSSE payload hash, and local HMAC signature without live Stella services or a live TAXII endpoint.

Flags:

Example:

stella export dora-info-sharing \
  --input ./inputs/dora-info-sharing/peer-bank-a.json \
  --output ./out/dora-info-sharing/peer-bank-a \
  --signing-key-file ./keys/dora-info-sharing.hmac \
  --signing-key-id eu-local-dora-info-sharing \
  --json

Verify:

stella verify dora-info-sharing ./out/dora-info-sharing/peer-bank-a \
  --signing-key-file ./keys/dora-info-sharing.hmac \
  --signing-key-id eu-local-dora-info-sharing \
  --json

Fail-closed rules:

Determinism rules

Offline/air-gap notes