stella tlpt — Command Guide

Audience: Compliance and security engineers preparing DORA Threat-Led Penetration Testing (TLPT) evidence with Stella Ops. Scope: The offline stella tlpt command group plus the related stella replay and stella verify tlpt-pack commands.

The stella tlpt commands produce local, offline handoff artifacts for DORA TLPT evidence preparation. They do not query live Graph APIs, run offensive tooling, submit regulator artifacts, or replace the EvidenceLocker service audit trail.

Commands at a glance

CommandPurpose
stella tlpt scopeGenerate a deterministic tlpt-scope.v1 JSON document.
stella tlpt baselineBuild a deterministic tlpt-baseline.v1 Replay baseline.
stella replay <baseline>Verify a baseline hash offline and return the frozen Stella state.
stella tlpt packAssemble and sign an offline tlpt-pack-cli-bundle.v1 evidence-pack handoff.
stella verify tlpt-packVerify an evidence-pack handoff bundle offline.

Scope

stella tlpt scope `
  --tenant tenant-a `
  --criticality-threshold high `
  --asset-registry .\asset-registry.json `
  --reachability-subgraph .\reachgraph-subgraph.json `
  --frozen-baseline-hash sha256:<64-hex> `
  --valid-from 2026-05-01T00:00:00Z `
  --valid-to 2026-08-01T00:00:00Z `
  --output .\scope.json

scope wraps the local StellaOps.Tools.TlptScoper contract. It reads deterministic asset-registry.v1 input, binds a ReachGraph subgraph digest, and writes canonical tlpt-scope.v1 JSON.

Baseline

stella tlpt baseline `
  --scope .\scope.json `
  --input .\baseline-input.json `
  --output .\baseline.json

The baseline input schema is tlpt-baseline-cli-input-v1. The command reads tenantId, scopeId, and scopeHash from the scope document, then calls Replay Core to write canonical tlpt-baseline.v1 JSON and verify its hash offline before writing.

Replay

stella replay .\baseline.json

replay <baseline> reads a tlpt-baseline.v1 file, verifies the Replay Core baselineHash offline, and returns the frozen Stella state represented by the baseline. Replaying the same verified baseline later returns identical JSON state. Tampered baselines fail closed with VerificationFailed and a deterministic verification reason such as baseline-hash-mismatch.

Pack

stella tlpt pack `
  --tenant tenant-a `
  --input .\pack-input.json `
  --output .\tlpt-pack.json `
  --created-at 2026-05-16T12:00:00Z `
  --signing-key-file .\ed25519.hex

pack accepts the tlpt-evidence-pack.v1 request shape from the EvidenceLocker contract, assembles the manifest through CapsuleService, signs with a local deterministic Ed25519 key, and writes a tlpt-pack-cli-bundle.v1 JSON handoff containing the canonical manifest, DSSE envelope, content hash, and normalized assembly inputs.

The signing key file must contain a 32-byte Ed25519 seed or 64-byte expanded secret key as raw bytes, hex, or base64. This local signing path is for offline handoff verification; production KMS/CAdES and TLPT audit-action emission remain service-owned work.

Verify

stella verify tlpt-pack .\tlpt-pack.json --signing-key-file .\ed25519.hex --json

The verifier is offline. It checks the bundle schema, manifest kind/schema, canonical content hash, TLPT DSSE payload type, and Ed25519 DSSE signature. Tampered manifests or mismatched keys return VerificationFailed.

Remaining Live-Service Boundaries