StellaOps CLI

The stella CLI is the operator-facing Swiss army knife for scans, exports, policy management, offline kit operations, and automation scripting.

Responsibilities

Deliver deterministic verbs for scan, diff, export, policy, and observability operations.
Handle interactive and non-interactive authentication via Authority (seeded human username/password bootstrap, client credentials for automation).
Support offline kit workflows including bundle verification and seed installation.
Expose machine-readable outputs (the OutputFormat enum supports table (default), json, yaml, and sarif) suitable for CI parity and golden tests.

StellaOps.Cli main host (the stella/stellaops binary; net10.0, Native-AOT is roadmap not yet enabled). Verb plumbing, config, HTTP, and auth live inside this project — there is no StellaOps.Cli.Core.
Authoritative root command tree in Commands/CommandFactory.cs (CommandFactory.Create).
Restart-time plug-ins under src/Cli/__Libraries/StellaOps.Cli.Plugins.*; the released image packages Aoc, GroundTruth, NonCore, Policy, Symbols, Timestamp, Verdict, and Vex under /app/plugins/cli. The loader skips duplicate root tokens already present in the core command tree and activates non-conflicting plug-in additions such as excititor, runtime, and offline kit.
Source-free container distribution via devops/docker/Dockerfile.cli; compose deployments run it through devops/compose/docker-compose.cli.yml and devops/compose/scripts/stella-cli.*.

Authority for token exchange (OAuth2 password / client_credentials grants; token endpoint resolved via OIDC discovery — StellaOpsTokenClient + StellaOpsDiscoveryCache).
Backend APIs reached through per-target named HttpClients registered in Program.cs (each guarded by AddEgressPolicyGuard): Scanner, Policy, Export Center, Notify, Concelier (+ federation), JobEngine/orchestrator, Timeline, EvidenceLocker/forensic, Attestor + OCI registry, VEX, observability, packs, exceptions, SBOM/SBOMer, triage, CVSS, platform envsettings, Assurance, and operator-compliance Authority. The list above is the canonical set, not exhaustive — see the stellaops-cli.* client names in Program.cs.
Offline kit bundles and the OS-protected on-disk secrets blob (ISecretProtector backends: DPAPI on Windows, Keychain on macOS, libsecret on Linux; with a machine-id-derived AES-GCM file fallback and an in-memory backend). DPoP sender-constrained tokens are roadmap: a dpopPrivateKeyPem field is reserved in the profile secrets store (CliProfileSecrets) but no command or token client uses it yet.

Deterministic output fixtures under src/Cli/StellaOps.Cli.Tests.
Versioned command docs in docs/modules/cli/guides.
Plugin catalogue in plugins/cli/** (restart-only).
Manifest-backed CLI plug-ins are covered by the focused .gitea/workflows/cli-plugin-integration.yml lane, which runs CliPluginPayloadIntegrationTests and source-free image help smoke checks for the packaged plug-in command surface.
Released-site setup/status/admin operations can be run from the CLI image without repository sources by setting STELLAOPS_CLI_IMAGE, STELLAOPS_BACKEND_URL, and Authority auth env vars.

./guides/20_REFERENCE.md
./guides/cli-reference.md
./guides/released-site-operator-quickstart.md
./guides/commands/analytics.md
./guides/commands/export-dora-roi.md
./guides/operator-decision-signing.md
./guides/policy.md
./guides/trust-profiles.md
./operations/credential-storage.md (CLI on-disk token encryption, --no-save, machine-id fallback policy)

CLI-CORE-41-001 epic in src/Cli/StellaOps.Cli/TASKS.md (this ID is referenced throughout the CLI source, e.g. Output/OutputFormat.cs, Configuration/CliProfile.cs).
Doc-tracker items DOCS-CLI-OBS-52-001 / DOCS-CLI-FORENSICS-53-001 are not yet present in the codebase; the previously linked ../../TASKS.md does not exist in this docs tree and the link has been removed.

The previously referenced active docs sprint docs/implplan/SPRINT_0316_0001_0001_docs_modules_cli.md is no longer present in docs/implplan/ (archived/superseded). Treat this workstream list as historical until a current sprint is linked.

Epic 2 – Policy Engine & Editor: deliver deterministic policy authoring, simulation, and explain verbs.
Epic 4 – Policy Studio: integrate registry/promotion workflows, approvals, and lint tooling.
Epic 6 – Vulnerability Explorer: surface triage and ledger operations.
Epic 10 – Export Center: orchestrate export requests, verification, and Offline Kit automation.
Epic 11 – Notifications Studio: manage notification authoring/previews from the command line.

Epic Milestones:

Epic 2 (Policy Engine & Editor) – Deliver deterministic policy verbs, simulation, and explain outputs
Epic 4 (Policy Studio) – Add registry/promotion workflows, lint tooling, and approvals UX
Epic 6 (Vulnerability Explorer) – Integrate ledger/triage operations
Epic 10 (Export Center) – Automate export verification and Offline Kit flows
Epic 11 (Notifications Studio) – Manage rule/channel authoring and previews via CLI

Key Responsibilities:

Deterministic verbs for scan, diff, export, policy, and observability operations
Interactive and non-interactive authentication via Authority (seeded human username/password bootstrap, client credentials for automation)
Offline kit workflows including bundle verification and seed installation
Machine-readable outputs (table/json/yaml/sarif) suitable for CI parity and golden tests

Operational Focus: