stella CLI — Parity Matrix
This page maps each stella command surface to the Stella Ops service API behind it, the output contract it must honour, and its offline behaviour. It is the reference for CLI maintainers and reviewers verifying that the CLI stays faithful to the services it fronts. Every row must stay deterministic and aggregation-only: the CLI surfaces published evidence and never infers verdicts of its own.
| Area | Server/API | CLI command(s) | Output contract | Offline support | Notes |
|---|---|---|---|---|---|
| Policy eval/simulate | Policy Engine /policy/eval /policy/simulate | stella policy eval, stella policy simulate | Stable JSON/NDJSON; includes correlationId, policyVersion, rationaleIds | Must run with cached bundles when --offline | No verdict inference beyond engine response. |
| VEX consensus | VexLens /vex/consensus | stella vex consensus | Deterministic pagination; weights/issuers/rationale echoed | Cached consensus snapshots permitted | Uses aggregation-only contract. |
| Vulnerability list/detail | Vuln Explorer /vuln | stella vuln list, stella vuln get | Sorted by vulnId; includes provenance pointers; no missing fields inferred | Must respect --offline using cached snapshots | |
| Export/mirror bundles | Export Service /export/* | stella export mirror, stella export verify | Emits manifest + checksums; verification errors are deterministic | Yes (air-gap bundles) | All paths must be relative and normalized. |
| Air-gap import/export | AirGap /airgap/* | stella airgap import, stella airgap export | Returns sealed bundle IDs, provenance hashes | Yes; network calls forbidden when --offline or sealed mode | |
| Attestor transparency mirror | Attestor /api/v1/transparency/*, /api/v1/attestations* | stella attestor transparency targets, stella attestor transparency sync, stella attestor transparency receipts, stella airgap exchange transparency | JSON preserves localTransparencyReceipt and externalMirrorReceipts[]; package writer preserves signed file bytes plus descriptor | Yes for manual exchange; connected live sync is refused in offline/sealed mode | Dry-run is the default for connected sync; live sync requires --confirm-egress-window. |
| Task Runner | TaskRunner /runs | stella task-runner run, stella task-runner logs | Monotonic log stream; stable ordering by sequence | Local/log-only when offline; remote requires connectivity | |
| Attestations | Attestor /attest/* | stella attest verify, stella attest list | Verification results include DSSE status, signature details; no risk scoring | Yes, using cached trust roots/bundles | |
| SBOM | Scanner /sbom/* | stella sbom generate, stella sbom compose | Emits SPDX/CycloneDX + hashes; preserves ordering | Yes; reads local images/files when offline |
Validation checklist
- Commands echo correlation/trace IDs on errors (verbose mode) to match server logs.
- Exit codes follow the contract in output-and-exit-codes.md.
- When a server feature is unavailable offline, the CLI must fail with exit code 5 and an actionable message.