Local replay proof

stella prove reads an existing local replay bundle and compares the replayed CGS evidence hash with the manifest’s expected hash. Both --image and --bundle are required.

stella prove --image sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa --bundle /path/to/bundle --output json

Replace the example image digest with the complete SHA-256 or SHA-512 digest in your bundle’s scan.imageDigest. The command normalizes supported digest spelling and refuses a different image before producing a proof. The bundle must contain manifest.json with its required strings and scan/input/output descriptors, and the files needed for evidence replay. Declared paths must remain inside that directory. Child filesystem links are refused; the selected root itself may be linked. These structure/path checks do not verify descriptor hash claims.

The registered command performs actual VerdictBuilder replay with no signer. A matching CGS hash returns 0; a changed evidence hash returns 5 and an explicit mismatch proof. JSON output includes verdictRoot, verdictMatches, artifactDigest, bundleHash, policyVersion and execution metadata. The command leaves input files unchanged and uses no HTTP provider. compact is the default output; json and full are also supported.

This evidence-hash comparison does not evaluate policy, authorize a release or establish trusted signing. Signature verification remains unset. The bundle hash preserves the existing protocol: SHA-256 of concatenated file bytes in ordinal full-path order. It is not a signed package identity.

Timestamp/latest selection (--at/-a) and explicit snapshot selection (--snapshot/-s) are withdrawn. Replay advisory/feed snapshots and AuditPack bundle production use different semantics from the retired image-verdict snapshot/store caller; there is no compatible online replacement registered by this command.

Argument-parser errors, including a missing required bundle, return 2. An invalid image or image mismatch returns 1. An absent local directory/manifest returns 7, an invalid/incomplete manifest returns 8, replay failure returns 4, cancellation returns 130 and an unexpected error returns 99. Historical constants 2, 3 and 6 remain defined, with no active online branch.

See the CLI architecture and replay proof schema.