stella vex — Command Guide

The stella vex command group works with Vulnerability Exploitability eXchange (VEX) data in Stella Ops: it explains the consensus of one issue from the statements the vulnerabilities hub holds, generates VEX statements from facet-drift analysis, and groups the verdict and unknowns commands.

Audience: release operators, security engineers, and CI/CD pipelines that gate deployments on VEX status.

Command summary

The consensus listing, simulation and export commands, the observation and linkset commands, the provider commands and the gate-scan commands were withdrawn on 2026-09-30: they called routes that no service serves.

stella vex explain

Explain the VEX consensus for one vulnerability and product. The command reads the live statements behind the issue from the vulnerabilities hub (GET /api/vulnerabilities/v1/issues/{vulnerabilityId}/{productKey}/facts, scope advisory:read) and evaluates them with the shared consensus evaluator that the Scanner’s matcher and Policy’s gate projection also use.

Usage

stella vex explain <vulnerability-id> --product-key <product-key> [--json]

Scope of the evaluation

• Global consensus. Tenant VEX decisions and tenant trust overrides are not applied.
• Default issuer tiers. Curated distribution feeds rank above aggregators; unlisted issuers rank community. The CLI uses the shared evaluator’s shipped defaults and does not read an operator’s runtime trust file. See the issuer-tier configuration for the exact defaults. A service with customized trust can resolve an issue differently.
• Issuer ambiguity. Contradictory concrete claims from different issuers at the best tier return under_investigation with issuer_confirmation_required, no winning issuers and no affected ranges. Within that best tier, an open investigation does not contradict another issuer’s concrete claim: an affected claim alongside under_investigation retains its winning issuer and any affected range it carries. Claims from one issuer still use status precedence (affected, fixed, not_affected, under_investigation).
• No statements is not not_affected. An issue without statements evaluates to under_investigation, and the output says that the hub holds no statements.

Output

The explanation carries the effective status, justification and severity, the winning issuers, whether any statement disagrees (contested), the affected ranges of the winning statements, the evaluation’s decision hash, and every statement with its issuer, status, justification, applicability and fact id. The hub resolves a fact id’s provenance with GET /api/vulnerabilities/v1/facts/{factId}/evidence.

stella vex explain CVE-2024-1234 --product-key pkg:npm/lodash
stella vex explain CVE-2024-1234 --product-key pkg:npm/lodash --json

Exit codes

The hub URL is StellaOps:VulnerabilitiesUrl (or STELLAOPS_VULNERABILITIES_URL); without it the command uses StellaOps:BackendUrl, because the gateway forwards /api/vulnerabilities/v1 to the hub.

stella vex gen --from-drift

Sprint: SPRINT_20260105_002_004_CLI

Generate VEX statements from facet drift analysis. This command analyzes drift between a baseline seal and the current image state, then generates OpenVEX documents for facets that require authorization.

Usage

stella vex gen --from-drift --image <IMAGE> [OPTIONS]

Required Options

Optional Options

Examples

Generate VEX from drift

stella vex gen --from-drift --image sha256:abc123

Specify baseline seal

stella vex gen --from-drift --image myregistry.io/app:v2.0 --baseline seal-xyz789

Output to file with specific status

stella vex gen --from-drift --image sha256:abc123 \
  --output vex-authorization.json \
  --status not_affected

Output Format (OpenVEX)

{
  "@context": "https://openvex.dev/ns",
  "@id": "https://stellaops.io/vex/abc123-def456",
  "author": "StellaOps CLI",
  "timestamp": "2026-01-05T10:30:00Z",
  "version": 1,
  "statements": [
    {
      "@id": "vex:statement-1",
      "status": "under_investigation",
      "timestamp": "2026-01-05T10:30:00Z",
      "products": [
        {
          "@id": "sha256:abc123...",
          "identifiers": {
            "facet": "runtime"
          }
        }
      ],
      "justification": "Facet drift authorization for runtime. Churn: 15.50% (3 added, 1 removed, 2 modified)",
      "action_statement": "Review required before deployment"
    }
  ]
}

Exit Codes

Workflow Integration

The vex gen --from-drift command is typically used in a release pipeline:

1. Build — the container image is built.
2. Seal — stella seal creates a baseline seal at build time.
3. Deploy — the release is submitted through the release control plane.
4. Drift detection — if facet drift exceeds quota, the release is blocked.
5. VEX generation — stella vex gen --from-drift creates an authorization document.
6. Review — the security team reviews and signs the VEX.
7. Retry — with the VEX in place, the release proceeds.

# After a release is blocked due to drift
stella vex gen --from-drift --image $IMAGE_DIGEST \
  --output vex-authorization.json

Review the document, sign it as a DSSE envelope with the issuer’s key, and push it to the vulnerabilities hub (POST /api/vulnerabilities/v1/issuers/{issuerId}/vex; the issuer must be allowlisted). The CLI has no VEX sign or ingest command. Then retry the release.

Related documentation

• Facet Seal command
• Facet Drift analysis
• VEX consensus reference