stella offline — Command Guide

Audience: operators who import and activate air-gapped “offline kits” on a disconnected Stella Ops install.

Overview

The stella offline command group manages air-gapped “offline kits” locally, with verification (DSSE plus optional Rekor receipt checks), monotonic version gating, and quarantine on validation failures.

Commands

offline import

stella offline import \
  --bundle ./bundle-2025-12-14.tar.zst \
  --verify-dsse \
  --verify-rekor \
  --trust-root /evidence/keys/roots/stella-root.pub

Notes

• --verify-dsse defaults to true and requires --trust-root.
• --force-activate requires --force-reason and records a non-monotonic activation override.
• --dry-run validates the kit without activating it.
• Uses the configured kits directory (default offline-kits/) for state (offline-kits/.state/) and quarantine (offline-kits/quarantine/).

offline status

stella offline status --output json

Displays the currently active kit (if any), staleness, and quarantined bundle count.

Exit codes

Offline exit codes are defined in src/Cli/StellaOps.Cli/Commands/OfflineExitCodes.cs (advisory A11), including:

• 0 success
• 1 file not found
• 2 checksum mismatch
• 5 DSSE verification failed
• 6 Rekor verification failed
• 8 version non-monotonic (not force-activated)
• 11 validation failed
• 130 cancelled

Related Documentation

• CLI Air-Gap Guide — end-to-end offline and sealed-mode workflows.
• Output and exit codes