Stella Ops CLI

Verified against commit 942a18727c (2026-09-26, DOC-2 of SPRINT_20260926_001). Re-verify by reading the evidence paths listed in the Evidence section.

Service wiring (image, database and role, compose profile, bundle presence) is generated in the service inventory; this dossier does not restate it.

The stella (also stellaops) command-line interface drives scans, SBOM handling, policy and gate decisions, verification, offline-kit and air-gap operations, and installation setup from a terminal or a CI job. It is a client of the Stella Ops services; it owns no database.

Responsibilities

• Expose the registered command tree (CommandFactory.Create) for scanning, SBOM, policy, VEX, verification, evidence, release decisions, crypto/compliance settings and administration.
• Authenticate against Authority with a personal access token, the password grant (operator login) or client credentials, using one grant rule and one tenant rule for every client.
• Verify evidence locally (DSSE envelopes, signed manifests, offline bundles) and fail closed when a verifier, trust root or owner service is unavailable.
• Produce machine-readable output (OutputFormat: table, json, yaml, sarif) for CI.

Key components

• src/Cli/StellaOps.Cli/ — the .NET 10 console app (StellaOps.Cli.dll). Program.cs composes services and HTTP clients; Commands/CommandFactory.cs builds the root command.
• src/Cli/StellaOps.Cli/Configuration/ — configuration bootstrap (CliBootstrapper), the grant and tenant rules (AuthorityTokenUtilities), policy-gateway URL resolution, profiles and secret protectors.
• src/Cli/__Libraries/StellaOps.Cli.Plugins.* and src/Cli/plugins/cli/ — restart-time plug-ins. Five are shipped (NonCore, Policy, Symbols, Timestamp, Verdict); only NonCore adds commands that the core tree does not already register (excititor, runtime, offline kit status).
• src/Cli/__Tests/ — unit, golden-output, conformance and plug-in integration tests.

Integrations and dependencies

• Authority for tokens (StellaOps.Auth.Client): password and client-credentials grants; the token endpoint comes from OIDC discovery or STELLAOPS_AUTHORITY_TOKEN_ENDPOINT.
• Service APIs through the gateway URL (STELLAOPS_BACKEND_URL), with service-specific overrides for Advisory AI, Vulnerabilities, Evidence and the policy gateway. Every client passes the air-gap egress guard.
• Local cryptography through the Stella Ops crypto registry, including the regional providers compiled into a distribution.

Distribution

• Published image registry.stella-ops.org/stella-cli, built from devops/stella-cli/Dockerfile by .gitea/workflows/stella-cli-publish.yml (no plug-ins).
• Source-free operator image with plug-ins, devops/docker/Dockerfile.cli, run through devops/compose/docker-compose.cli.yml and devops/compose/scripts/stella-cli.*.
• Per-RID binaries from .gitea/scripts/build/build-cli.sh.

Start here

• Architecture — process model, configuration, authentication, command surface, plug-ins, exit codes, packaging.
• Released-site operation: released-site operator quickstart
• Source checkout: quickstart
• Build and distribution: distribution matrix
• Command guides: command reference and guides/commands/
• Credentials on disk: credential storage
• Documentation example gate: unshipped command examples

Related resources

• CLI reference
• Operator decision signing
• Policy
• Trust profiles
• Analytics (withdrawn)
• DORA RoI export

Evidence