stella CLI — Complete Command Reference

This is the consolidated reference for the stella command-line interface, the operator-facing client for the Stella Ops release control plane. It catalogs every command group with usage, options, examples, and exit codes.

Audience: operators, security engineers, and CI authors. For a guided introduction, start with the CLI overview and quickstart; for deep dives, follow the per-command guides linked under See Also.

Command Overview

The stella CLI provides 50+ commands organized into functional groups:

graph TD
    CLI[stella CLI] --> SCAN[Scanning & Analysis]
    CLI --> CRYPTO[Cryptography]
    CLI --> ADMIN[Administration]
    CLI --> AUTH[Authentication]
    CLI --> POLICY[Policy Management]
    CLI --> EXPLAIN[Explainability]
    CLI --> VEX[VEX & Decisioning]
    CLI --> SBOM[SBOM Operations]
    CLI --> ANALYTICS[Analytics & Insights]
    CLI --> REPORT[Reporting & Export]
    CLI --> OFFLINE[Offline Operations]
    CLI --> SYSTEM[System & Config]

Global Options

Available for all commands:

Attestor Transparency Commands

stella attestor transparency targets

Manage external transparency mirror targets.

Usage:

stella attestor transparency targets <list|show|upsert|enable|disable> [options]

Examples:

stella attestor transparency targets list --json

stella attestor transparency targets upsert \
  --name public-rekor \
  --kind rekor-compatible \
  --endpoint-url https://rekor.example \
  --trust-root-ref trust-root:public-rekor \
  --auth-ref secret://attestor/public-rekor-token \
  --required-crypto-profile eidas-qes \
  --operator-label ops-window-20260524

Raw bearer tokens, client secrets, and credential material are rejected in --auth-ref; pass a Secret Authority reference instead.

stella attestor transparency sync

Run connected-window external mirror sync. Dry-run is the default; live sync requires an explicit egress-window acknowledgement.

stella attestor transparency sync run --target public-rekor --max-entries 100 --json

stella attestor transparency sync run \
  --target public-rekor \
  --live \
  --confirm-egress-window \
  --max-runtime-seconds 300 \
  --operator-label ops-window-20260524

stella attestor transparency sync report --target public-rekor --limit 20

Live sync is refused while the CLI is in sealed/offline mode. Human output labels external publication as External mirror receipt, External mirror pending, or External mirror failed.

stella attestor transparency receipts

Inspect Attestor receipt status without treating external mirrors as the primary local receipt.

stella attestor transparency receipts list --subject sha256:... --page-size 50
stella attestor transparency receipts show <local-receipt-uuid> --refresh --json

JSON preserves localTransparencyReceipt and externalMirrorReceipts[]. Human output uses Local transparency receipt for the sealed-site primary receipt and external mirror labels only for additive mirror evidence.

Both reads use the backend URL with the Evidence routes /api/evidence/v1/attestations and /api/evidence/v1/attestations/{uuid}. Authority requests use attest:read regardless of the configured default scope. The detail UUID is trimmed and escaped as one path segment.

Blank filters are omitted. The owner orders results by creation time descending, then UUID ascending. Invalid page sizes, dates, reversed bounds and continuation tokens return an error. --refresh requests best-effort proof refresh for an existing receipt. The owner may retain the stored proof when refresh fails or yields no proof; refresh does not create a missing receipt. JSON retains proof readError, checkpoint signedNote and all local/external receipt metadata. These fields are owner data; displaying them does not verify a proof or checkpoint signature.

An empty list returns success. A detail 404 returns exit 4 and an error, while list 404, unavailable or refused owner calls return exit 1 without a receipt result. CLI tenant selection uses the shared token/header rule described in the architecture. Owner receipt tenant isolation and deployed routing are outside the PCD-465 caller proof.

stella airgap exchange transparency

Create and import controlled-media transparency exchange packages. The same implementation is available as stella attestor transparency exchange ....

stella airgap exchange transparency schedule create \
  --target public-rekor \
  --index-start 1000 \
  --index-end 1200 \
  --out ./tx-schedule \
  --media-id usb-42 \
  --operator-label export-20260524 \
  --required-crypto-profile eidas-qes

stella airgap exchange transparency relay-import create \
  --schedule ./tx-schedule \
  --target public-rekor \
  --out ./tx-import \
  --relay-id relay-sofia \
  --operator-label import-20260524

stella airgap exchange transparency import validate --package ./tx-import
stella airgap exchange transparency import apply --package ./tx-import --operator-label apply-20260524
stella airgap exchange transparency status --manifest-digest sha256:...

The CLI writes package file bytes returned by Attestor and a descriptor named stellaops-transparency-package.json. Certificates, signatures, algorithms, and crypto profile metadata are selected by Attestor/Authority according to installation regional crypto settings; the CLI never exports private keys or external-log credentials.

Integration Catalog Commands

stella config integrations

Manage the live Integration Catalog through the Integrations service.

Usage:

stella config integrations <command> [options]

Subcommands:

• list - List catalog entries with filtering and paging
• providers - List supported providers and discovery metadata
• get / show - Display a single integration
• create - Create an integration entry
• update - Update an integration entry
• delete / remove - Delete an integration entry
• test - Run connector connectivity test
• health - Query connector health
• impact - Show workflow impact summary
• discover - Discover provider resources such as repositories, projects, jobs, pipelines, or tags
• bootstrap local - Bootstrap the Stella-owned local compose fixture catalog end to end
• secrets targets / secrets upsert-bundle - Stage authref-backed secret bundles against writable secret-authority targets

stella config integrations bootstrap local

Bootstrap the owned local compose fixture lane without dropping into fixture-native APIs.

Usage:

stella config integrations bootstrap local [--include-gitlab] [--include-gitlab-registry] [--format table|json]

Options:

Examples:

# Bootstrap the default 13-entry local compose fixture catalog
stella config integrations bootstrap local

# Add the owned local GitLab SCM and CI fixtures
stella config integrations bootstrap local --include-gitlab

# Add the full 16-entry local fixture catalog including GitLab registry
stella config integrations bootstrap local --include-gitlab --include-gitlab-registry --format json

Contract:

• This command is only for Stella-owned local compose fixtures.
• Default mode creates or updates 13 deterministic local integrations and runs test plus health verification for each.
• --include-gitlab stages the managed local GitLab PAT through Secret Authority and binds the resulting authref://... values to GitLab Server and GitLab CI.
• Production and customer-managed third-party systems still use secrets targets, secrets upsert-bundle, and explicit create or update operations with operator-provided credentials.

Examples:

# Show live providers (default hides test-only providers)
stella config integrations providers

# Include test-only providers such as InMemory
stella config integrations providers --include-test-only --format json

# Create a GitLab server entry
stella config integrations create \
  --name local-gitlab \
  --type scm \
  --provider gitlabserver \
  --endpoint http://gitlab.stella-ops.local:8929 \
  --secret-ref authref://vault/gitlab#access-token

# Discover projects from an existing integration
stella config integrations discover <integration-id> --resource-type projects

# Discover tags within a repository
stella config integrations discover <integration-id> \
  --resource-type tags \
  --filter repository=team/api \
  --filter namePattern='v*'

# Register local MinIO through the object-storage provider
stella config integrations create \
  --name local-minio \
  --type objectstorage \
  --provider s3compatible \
  --endpoint http://minio.stella-ops.local:9000

Notes:

• providers returns isTestOnly, supportsDiscovery, and supportedResourceTypes.
• integrations create|update accepts --secret-ref <url> for auth material and validates the URL with the shared SecretReference grammar before contacting the backend. --secret-ref is the only spelling; the pre-release --authref alias was removed and is rejected as an unrecognized option.
• bootstrap local returns exit code 0 only when every selected integration tests healthy and reports healthy runtime status.
• There is no top-level integrations group; the legacy alias table that forwarded it to config integrations was deleted with the rest of the pre-release aliases. Use stella config integrations ....
• Unsupported discovery requests return a client error instead of silently falling back to sample data.

Scanning & Analysis Commands

stella scan

Scan container images for vulnerabilities and generate SBOMs.

Usage:

stella scan <image> [options]

Arguments:

• <image> - Container image reference (e.g., docker://nginx:latest, tar://image.tar)

Options:

Examples:

# Basic scan
stella scan docker://nginx:latest --output scan-result.json

# Generate SPDX SBOM only
stella scan docker://nginx:latest --sbom-only --sbom-format spdx --output nginx.spdx.json

# Scan with attestation and policy enforcement
stella scan docker://nginx:latest \
  --attestation \
  --policy company-policy.yaml \
  --fail-on-policy-violations \
  --output results/

# Scan local tar archive
stella scan tar://image.tar --output scan.json

Exit Codes:

• 0 - Success
• 1 - Scan error
• 2 - Policy violations (with --fail-on-policy-violations)

aoc (withdrawn)

The CLI has no aoc command. The core aoc verify (it posted to api/aoc/verify, which no service maps) was withdrawn on 2026-10-01, and no attestation generator exists under that name. See the aoc command guide.

stella symbols

Extract and index debug symbols from containers.

Usage:

stella symbols <command> [options]

Subcommands:

• extract - Extract debug symbols
• index - Index symbols for lookup
• query - Query symbol database

Example:

# Extract symbols
stella symbols extract docker://myapp:v1.2.3 --output symbols/

# Index symbols
stella symbols index symbols/ --output symbols.db

# Query symbols
stella symbols query --db symbols.db --address 0x12345678

Cryptography Commands

stella crypto sign

Sign files with cryptographic algorithms.

Usage:

stella crypto sign [options]

Options:

Examples:

# Sign with default provider (ECDSA)
stella crypto sign \
  --provider default \
  --algorithm ECDSA-P256 \
  --key-id prod-key \
  --file document.pdf \
  --output document.pdf.sig

# Sign with GOST (Russia distribution)
stella crypto sign \
  --provider gost \
  --algorithm GOST12-256 \
  --key-id gost-key-2024 \
  --file document.pdf \
  --output document.pdf.sig

# Sign with eIDAS QES (EU distribution)
stella crypto sign \
  --provider eidas \
  --algorithm ECDSA-P256-QES \
  --key-id eidas-qes-key \
  --file contract.pdf \
  --output contract.pdf.sig

Distribution Availability:

• Default provider: All
• GOST provider: Russia
• eIDAS provider: EU
• SM provider: China

stella crypto verify

Verify cryptographic signatures.

Usage:

stella crypto verify [options]

Options:

Example:

stella crypto verify \
  --provider gost \
  --algorithm GOST12-256 \
  --key-id gost-key-2024 \
  --file document.pdf \
  --signature document.pdf.sig

Output:

✅ Signature valid
Provider: gost
Algorithm: GOST12-256
Signer: CN=Company GOST Key 2024

Exit Codes:

• 0 - Signature valid
• 1 - Signature invalid or verification error

stella crypto profiles

Manage crypto profiles for easy provider/key switching.

Usage:

stella crypto profiles [command]

Subcommands:

• list - List crypto profiles
• create - Create new profile
• use - Set active profile
• delete - Delete profile

Examples:

# List profiles
stella crypto profiles list

# Create GOST profile
stella crypto profiles create gost-prod \
  --provider gost \
  --algorithm GOST12-256 \
  --key-id gost-key-2024

# Use profile
stella crypto profiles use gost-prod

# Sign using active profile
stella crypto sign --file document.pdf --output document.pdf.sig

Administration Commands

Local Authority recovery and readiness

admin users password-set remains governed local Authority recovery. Policy/system groups and user list/add/revoke/update verbs were withdrawn under PCD-292 because their routes were never served. See the admin reference for the recovery boundary.

stella admin users password-set --help
stella admin diagnostics health --format json

Advisory source status

The admin feeds group was removed on 2026-10-02: its /api/v1/admin/feeds* routes are served by no Stella Ops service. Use stella sources status and stella config sources list for the read-only source view (Vulnerabilities owner, api/vulnerabilities/v1/sources). Source refresh and sync history have no owner API; sources are enabled and scheduled through configuration.

Authentication Commands

stella auth login

Authenticate with platform (interactive).

Usage:

stella auth login [--force] [--verbose]

Example:

# Interactive login on the seeded human client
stella auth login

# Re-authenticate even when a cached token exists
stella auth login --force

Output:

Authority username: admin
Authority password for admin:
Login successful. Access token expires at 2026-04-16 12:00:00Z.

When no Authority client ID is configured, the CLI defaults to the seeded human client stellaops-cli and prompts for username/password in an interactive shell. For automation, configure a confidential client such as stellaops-cli-automation.

stella auth logout

Log out from platform.

Usage:

stella auth logout [--verbose]

stella auth whoami

Show current authentication status.

Usage:

stella auth whoami [--verbose]

Output:

Authenticated as: alice@example.com
Tenant: acme-corp
Scopes: scan.read, scan.write, admin.policy
Token expires: 2025-12-24T10:30:00Z

Score Commands

stella score explain

Display the Signals score explanation for a digest through Score.Read (score.read).

Usage:

stella score explain <DIGEST> [--format table|json|markdown] [--server <BACKEND-URL>]

Examples:

stella score explain sha256:abc123
stella score explain sha256:abc123 --format markdown

stella score replay

Ask Scanner to replay scoring for an existing scan using its stored manifest.

Usage:

stella score replay --scan <SCAN-ID> [OPTIONS]

Options:

Examples:

stella score replay --scan 00000000-0000-0000-0000-000000000123
stella score replay --scan 00000000-0000-0000-0000-000000000123 --freeze 2026-10-06T00:00:00Z --output json

stella score bundle

Read Scanner bundle metadata (scanId, rootHash, bundleUri, manifestDsseValid, createdAt). This command does not download the server-side archive.

stella score bundle --scan 00000000-0000-0000-0000-000000000123 --output json

--scan/-s is required; --output/-o accepts text (default) or json.

stella score verify

Ask Scanner to verify a score bundle against an expected root and optional canonical input binding.

Usage:

stella score verify --scan <SCAN-ID> --root-hash <HASH> [OPTIONS]

Options:

Examples:

stella score verify --scan 00000000-0000-0000-0000-000000000123 --root-hash sha256:def456 --output json
stella score verify --scan 00000000-0000-0000-0000-000000000123 --root-hash sha256:def456 --canonical-input-hash sha256:abc123 --canonical-input-payload canonical-input.json

Replay and verify use /api/v1/scans/{scanId}/score/replay|verify with scanner:read scanner:write; bundle uses /api/v1/scans/{scanId}/score/bundle with scanner:read. All three use authenticated Backend Router clients and accept --verbose. A well-formed verification refusal (valid:false, including HTTP 200) exits 2. Provider and malformed-response failures fail without fabricating a result. See score replay commands for full response fields, restart binding, payload handling and evidence limits.

The unregistered ScoreCommandGroup duplicate was withdrawn under PCD-429. Score-ID replay and direct score compute|history|compare are not shipped CLI commands; Signals’ owner APIs retain their separate semantics.

stella gate score evaluate

Compute unified score as part of a gate evaluation (enhanced with unknowns support).

Usage:

stella gate score evaluate [OPTIONS]

Additional Options (new):

stella gate score weights

Manage EWS weight manifests.

Usage:

stella gate score weights <SUBCOMMAND>

Subcommands:

Examples:

stella gate score weights list
stella gate score weights show v2026-01-22
stella gate score weights diff v2026-01-22 v2026-02-01

Budget Commands

stella budget offers status, consume, check, history and list through Policy Engine’s /api/v1/policy/budget contract. Consumption requires --service, --points and --release-id; a release check requires --service, --tier and --diff-category. History’s --limit affects the text display only. The owner’s current empty list placeholder causes an inventory-unavailable failure, not a zero-budget result.

See the budget command guide for options, scopes, response fields and failure behavior.

Policy Commands

stella policy test

Compile a stella-dsl@1 policy and evaluate its coverage fixtures through the policy evaluator, reporting a true pass/fail per fixture. Fixture format and evaluation semantics: Policy Test Fixtures.

Usage:

stella policy test <file> [-d|--fixtures <dir>] [--filter <text>] [-f|--format table|json]
                          [-o|--output <file>] [--fail-fast] [--verbose]

Fixtures default to tests/policy/<policy-name>/cases/**/*.json.

Example:

stella policy test ./policies/default.stella \
  --fixtures ./tests/policy/default/cases \
  --format json --output coverage.json

Output:

Test Results for default

┌──────────────┬──────────┬────────────────────────────────────────────────┐
│ Fixture      │ Status   │ Detail                                         │
├──────────────┼──────────┼────────────────────────────────────────────────┤
│ cleared.json │ ✓ passed │ vendor cleared the component                   │
│ blocks.json  │ ✗ failed │ expected outcome 'pass' but got 'fail'         │
└──────────────┴──────────┴────────────────────────────────────────────────┘

Summary: 1 passed, 1 failed, 0 errors

Exit codes: 0 all fixtures evaluated and passed · 1 a fixture failed, errored, or nothing was evaluated · 4 the policy could not be used (missing/uncompilable, no fixtures, or it uses built-ins the fixture evaluator cannot evaluate).

stella policy validate

Validate policy syntax and logic.

Usage:

stella policy validate --file <path> [--verbose]

VEX & Decisioning Commands

stella vex generate

Generate VEX document from scan results.

Usage:

stella vex generate --scan <path> [--output <path>] [--verbose]

Example:

stella vex generate \
  --scan scan-result.json \
  --output vex-doc.json

stella vex merge

Merge multiple VEX documents.

Usage:

stella vex merge --vex <path1> --vex <path2> [--output <path>] [--verbose]

stella decision

Manage vulnerability decisions (VEX workflow).

Usage:

stella decision <command> [options]

Subcommands:

• create - Create new decision
• list - List decisions
• update - Update decision
• export - Export decisions to VEX

Example:

# Mark CVE as not_affected
stella decision create \
  --cve CVE-2024-12345 \
  --status not_affected \
  --justification vulnerable_code_not_in_execute_path \
  --impact-statement "Vulnerable function not called in our application"

SBOM Operations

stella sbom generate

Generate SBOM from source code or container.

Usage:

stella sbom generate <target> [options]

Options:

Example:

# Generate SPDX SBOM from source
stella sbom generate . --format spdx --output sbom.spdx.json

# Generate CycloneDX SBOM from container
stella sbom generate docker://myapp:v1 --format cyclonedx --output sbom.cdx.json

stella sbom validate

Validate SBOM against schema.

Usage:

stella sbom validate --file <path> [--verbose]

stella sbom merge

Merge multiple SBOMs.

Usage:

stella sbom merge --sbom <path1> --sbom <path2> [--output <path>] [--verbose]

Analytics Commands

The analytics command group is withdrawn (2026-09-30); see analytics.md.

Function Map Commands

stella function-map generate

Generate a function map predicate from an SBOM and optional static analysis.

Usage:

stella function-map generate [OPTIONS]

Options:

Examples:

# Basic generation from SBOM
stella function-map generate --sbom app.cdx.json --service my-backend

# With hot function filtering and custom thresholds
stella function-map generate \
  --sbom app.cdx.json \
  --service my-backend \
  --hot-functions "crypto/*" --hot-functions "auth/*" \
  --min-rate 0.90 --window 3600 \
  --output function-map.json

stella function-map verify

Verify runtime observations against a function map predicate.

Usage:

stella function-map verify [OPTIONS]

Options:

Examples:

# Online verification against live observations
stella function-map verify \
  --function-map function-map.json \
  --from "2026-01-23T00:00:00Z" --to "2026-01-23T01:00:00Z"

# Offline verification with bundled observations
stella function-map verify \
  --function-map function-map.json \
  --offline --observations obs.ndjson \
  --format json --output report.json

Observations Commands

stella observations query

Query runtime observations from the observation store.

Usage:

stella observations query [OPTIONS]

Options:

Examples:

# Query all crypto-related observations
stella observations query --symbol "crypto_*" --from "2026-01-23T00:00:00Z"

# Summary for a specific container
stella observations query --container abc123 --summary

# Export as CSV for analysis
stella observations query --pod my-service-pod --format csv --output obs.csv

Ground-Truth Corpus Commands (withdrawn)

The groundtruth command group and its plug-in were withdrawn on 2026-09-12 (SPRINT_20260722_014 BIN-10): source and pair handlers returned placeholder data and validation had no configured implementation. The frozen source is under src/__Obsoleted/Cli/. Binary generation and symbol management use the Vulnerabilities owner paths (binary, symbols); benchmark KPI computation remains in Bench.Oracle.

Attestation Commands

stella attest attach

Attach an attestation (DSSE envelope) to an OCI image via ORAS referrers.

Sprint: SPRINT_20260122_040_Platform_oci_delta_attestation_pipeline (040-01)

Usage:

stella attest attach --image <ref> --attestation <path> [options]

Options:

Example:

stella attest attach \
  --image registry.example.com/app:v1.2 \
  --attestation delta-sig.dsse.json \
  --verbose

Append a local ES256 software signature before attach:

stella attest attach \
  --image registry.example.com/app@sha256:abc123 \
  --attestation delta-sig.dsse.json \
  --sign \
  --key ./keys/operator-p256.pem \
  --key-id operator-key-2026-06

--sign signs the DSSE pre-authentication encoding for the existing envelope payload and appends a signature; it does not rewrite the payload. --offline writes the signed envelope into the generated local bundle when both flags are used. --sign-keyless is reported as unsupported for this command rather than falling through as a no-op.

Exit Codes:

• 0 - Attestation attached successfully
• 1 - Validation failed, duplicate attestation without --replace, or unsupported keyless signing
• 2 - Registry communication or other execution failure
• 3 - Policy gate denied the attachment

stella attest verify

Verify attestations attached to an OCI image. Lists and validates DSSE envelopes, checks signatures, and optionally verifies Rekor annotations.

Sprint: SPRINT_20260122_040_Platform_oci_delta_attestation_pipeline (040-02)

Usage:

stella attest verify --image <ref> [options]

Options:

Example:

stella attest verify \
  --image registry.example.com/app:v1.2 \
  --predicate-type "https://stellaops.dev/delta-sig/v1" \
  --require-rekor \
  --output json

Exit Codes:

• 0 - All attestations verified successfully
• 1 - One or more attestations failed verification
• 2 - Invalid input or configuration error

Binary Analysis Commands

stella binary export-index

Download the Vulnerabilities owner’s current build-id index and sign its digest/length descriptor with the enrolled generic-dsse purpose key.

stella binary export-index --output-directory <new-directory>

Requires the configured hub URL/authentication, advisory:read capability and tenant signing-key custody. The required --output-directory must not exist. Successful output contains index.ndjson, index.dsse.json and public-jwks.json, published together by an atomic directory rename. Failures return a nonzero exit. There are no raw-key or algorithm override options.

The public JWKS is enrollment material. Consumer trust must be provisioned independently under the binary-build-id-index purpose; the consumer never trusts the artifact’s adjacent keys automatically. See export and enrollment.

stella binary delta-sig attest

Sign a delta-sig predicate with the enrolled generic-dsse purpose key and optionally submit to a configured Rekor transparency log. Produces a DSSE envelope suitable for stella attest attach.

Sprint: SPRINT_20260122_040_Platform_oci_delta_attestation_pipeline (040-05)

Usage:

stella binary delta-sig attest <predicate-file> [options]

Options:

Example:

# Sign predicate and submit to Rekor
stella binary delta-sig attest \
  delta-sig-predicate.json \
  --output signed-envelope.dsse.json \
  --rekor-url https://rekor.example.com \
  --receipt rekor-receipt.json \
  --verbose

# Dry run (validate only)
stella binary delta-sig attest \
  delta-sig-predicate.json \
  --dry-run

Signing Behavior:

• The CLI tenant context must identify the tenant whose generic-dsse key is enrolled. The existing cryptography library owns custody decoding and provider/algorithm selection. No raw-key override or generated fallback is accepted.
• Produces an in-toto v1 statement wrapping the predicate as DSSE payload
• PAE (Pre-Authentication Encoding) used per DSSE specification
• Signature is Base64-encoded in the envelope

Rekor Submission:

• When --rekor-url is provided, the signed envelope is submitted to the transparency log
• On success, Rekor UUID and log index are displayed
• Receipt JSON includes uuid, logIndex, integratedTime, and logUrl

Exit Codes:

• 0 - Signing (and optional Rekor submission) succeeded
• 1 - Signing or submission failed
• Missing or unavailable requested signing/submission services fail before output is written; a later Rekor transport failure retains the already signed envelope and returns 1.

Bundle Commands

stella verify offline-seed

Verify a PacksRegistry offline-seed export archive (POST /api/v1/export/offline-seed) offline: internal consistency (every declared digest has its bytes, no orphan payload), DSSE binding of catalog-manifest.json.dsse.json to the shipped manifest, signature authenticity under a supplied trust root, and the audit-aware determinism check between two exports of an unchanged catalog. Same checks, codes and verdicts as tools/scripts/packs/verify_offline_seed_archive.py; see docs/security/pack-signing-and-rbac.md §7.1.

Sprint: SPRINT_20260914_003 (JEF-5)

Usage:

stella verify offline-seed --archive <zip> [--public-key <pem> | --trust-set <json>] [--compare <zip>] [--integrity-only] [--output table|json]

Options:

Exit codes (CliExitConvention): 0 verified; 1 any finding, or a signature verdict other than VERIFIED (fails closed without a trust root unless --integrity-only); 2 usage or I/O (missing/unreadable archive, key, trust set or comparison archive; both key forms given).

JSON output: {archive, verdict, integrityOnly, summary{declaredPackCount, manifestPacks, packsNdjsonRows, objectEntries, digestsVerified}, signature{verdict, keyId, trustSource}, findings[{code, detail}], compare{archive, findings}?}.

stella bundle verify

Verify offline evidence bundles with full cryptographic verification. Checks manifest integrity, blob digests, DSSE signatures, Rekor proofs, timestamps, payload types, and optionally replays large blob content verification.

Sprint: SPRINT_20260122_040_Platform_oci_delta_attestation_pipeline (040-06)

Usage:

stella bundle verify --bundle <path> [options]

Options:

Verification Steps:

1. Manifest checksum - Validate bundle manifest integrity
2. Blob digests - Verify all blob file SHA-256 digests match manifest
3. DSSE signatures - Validate envelope signatures against trusted keys
4. Rekor proofs - Verify inclusion proofs against checkpoint (when provided)
5. Timestamps - Validate RFC 3161 timestamps against TSA certificates
6. Payload types - Verify predicate types match expectations
7. Blob Replay (when --replay) - Fetch and verify large blobs referenced in attestations

Blob Replay Behavior:

• For full bundles (blobs embedded): verifies content from blobs/ directory against attestation digests
• For light bundles (metadata only): fetches blobs from --blob-source (local dir or registry URL)
• Supports sha256, sha384, sha512 digest algorithms
• In --offline mode, blob fetch from registries is blocked (only local sources work)

Example:

# Basic verification
stella bundle verify --bundle evidence-bundle.tar.gz

# Full verification with replay and trust root
stella bundle verify \
  --bundle /path/to/bundle \
  --trust-root /etc/stellaops/tsa-root.pem \
  --rekor-checkpoint checkpoint.json \
  --replay \
  --verbose

# Light bundle with local blob source
stella bundle verify \
  --bundle light-bundle/ \
  --replay \
  --blob-source /path/to/blobs/

# Strict offline verification with signed report
stella bundle verify \
  --bundle evidence-bundle/ \
  --offline \
  --strict \
  --signer report-key.pem \
  --signer-cert report-cert.pem

Exit Codes:

• 0 - All verifications passed
• 1 - One or more verifications failed
• 2 - Invalid input or configuration error

Evidence Commands

stella evidence export-bundle

Export evidence bundles for offline verification. Supports two-tier export modes: light (metadata and attestations only) and full (includes embedded binary blobs).

Sprint: SPRINT_20260122_040_Platform_oci_delta_attestation_pipeline (040-04)

Usage:

stella evidence export-bundle --image <ref> --output <path> [options]

Options:

Export Modes:

Example:

# Light export (default)
stella evidence export-bundle \
  --image registry.example.com/app:v1.2 \
  --output evidence-light.tar.gz

# Full export with embedded blobs
stella evidence export-bundle \
  --image registry.example.com/app:v1.2 \
  --output evidence-full.tar.gz \
  --full \
  --verbose

Exit Codes:

• 0 - Bundle exported successfully
• 1 - Export failed
• 2 - Invalid input or configuration error

Reporting & Export Commands

stella report

Generate compliance reports from scan results.

Usage:

stella report --scan <path> --format <format> [--output <path>] [--verbose]

Formats:

• html - HTML report
• pdf - PDF report
• markdown - Markdown report
• csv - CSV export
• json - JSON export

Example:

# Generate HTML report
stella report --scan scan-result.json --format html --output report.html

# Generate PDF report
stella report --scan scan-result.json --format pdf --output report.pdf

stella export

Export scan results in various formats.

Usage:

stella export --scan <path> --format <format> [--output <path>] [--verbose]

Formats:

• csv - CSV export for spreadsheets
• sarif - SARIF format for CI/CD integration
• json - JSON export
• xml - XML export

Example:

# Export to CSV for Excel analysis
stella export --scan scan-result.json --format csv --output vulnerabilities.csv

# Export to SARIF for GitHub Code Scanning
stella export --scan scan-result.json --format sarif --output results.sarif

Offline Operations

stella offline sync

Synchronize offline package for air-gapped environments.

Usage:

stella offline sync [--output <path>] [--feeds nvd,osv,github] [--verbose]

Example:

# Create offline package
stella offline sync \
  --feeds nvd,osv,github \
  --output stellaops-offline-$(date +%F).tar.gz

stella offline load

Load offline package into air-gapped instance.

Usage:

stella offline load --package <path> [--verbose]

Example:

stella offline load --package stellaops-offline-2025-12-23.tar.gz

System & Configuration

stella config

Manage CLI configuration.

Usage:

stella config <command> [options]

Subcommands:

• show - Show current configuration
• set - Set configuration value
• get - Get configuration value
• list - List all configuration keys
• profile - Manage profiles

Examples:

# Show current config
stella config show

# Set backend URL
stella config set Backend.BaseUrl https://api.stellaops.example.com

# Get backend URL
stella config get Backend.BaseUrl

# Create profile
stella config profile create prod --backend-url https://api.stellaops.example.com

# Switch profile
stella config profile use prod

stella system diagnostics

Run system diagnostics.

Usage:

stella system diagnostics [--verbose]

Output:

System Diagnostics:
✅ CLI version: 2.1.0
✅ .NET Runtime: 10.0.0
✅ Backend reachable: https://api.stellaops.example.com
✅ Authentication: Valid (expires 2025-12-24)
✅ Crypto providers: default, gost
⚠️  PostgreSQL: Not configured (offline mode)

stella version

Show version information.

Usage:

stella version [--verbose]

Output:

stella CLI version 2.1.0
Build: 2025-12-23T10:00:00Z
Commit: dfaa207
Distribution: stella-russia
Platform: linux-x64
.NET Runtime: 10.0.0

Artifact block explanation (withdrawn)

PCD-448 withdrew the top-level artifact block explanation command. Neither its online artifact-digest lookup nor its offline cache branch had a compatible owner contract. The CLI rejects these invocations with usage-error exit code 2 before making HTTP requests or creating output. No explanation or artifact-presence verdict is produced. See the withdrawal and owner contract boundary.

Additional Commands

stella vuln query

Query vulnerability database.

Usage:

stella vuln query <cve-id> [--verbose]

stella findings

Manage scan findings.

Usage:

stella findings <command> [options]

stella advise

Get AI-powered remediation advice for vulnerabilities.

Usage:

stella advise --cve <cve-id> [--verbose]

stella reachability

Analyze vulnerability reachability in code.

Usage:

stella reachability analyze --scan <path> --code <path> [--output <path>]

stella graph

Call graph evidence and lineage commands.

Usage:

stella graph explain --graph-id <id> [--vuln-id <id>] [--purl <purl>] [--json]
stella graph verify --hash <blake3:...> [--format text|json|markdown]
stella graph lineage show <digest|purl> [--format json|graphson|mermaid] [--output <path>]

stella mirror

Manage local package mirrors for offline operation.

Usage:

stella mirror <command> [options]

stella notify

Send notifications about scan results.

Usage:

stella notify --scan <path> --channel slack --webhook <url>

stella issuer

Manage issuer keys for signing and verification.

Usage:

stella issuer keys list --format json
stella issuer keys create --type ecdsa --name primary --format json
stella issuer keys rotate <id> --format json
stella issuer keys revoke <id> --format json

Language-Specific Commands

stella ruby

Ruby-specific operations.

stella ruby analyze <path>

stella python

Python-specific operations.

stella python analyze <path>

stella php

PHP-specific operations.

stella php analyze <path>

Exit Codes

Standard exit codes across all commands:

Environment Variables

See Also

• CLI Overview — quick start and installation
• CLI Architecture — plugin architecture
• Admin Reference — detailed admin command reference
• Crypto Plugins — crypto plugin development
• Compliance Guide — regional compliance requirements
• Troubleshooting — common issues and solutions
• Output and Exit Codes — canonical CLI exit-code reference