Export Center Overview

The Export Center packages StellaOps evidence and policy outputs into portable, verifiable bundles. It provides one workflow for operators to deliver advisories, SBOMs, VEX statements, and policy decisions into downstream systems or air-gapped environments without rewriting data or violating the Aggregation-Only Contract (AOC).

What the Export Center delivers

Unified export service. A dedicated exporter service coordinates profiles, runs, signing, and distribution targets with deterministic manifests.
Profile catalogue. Out of the box variants include json:raw, json:policy, trivy:db, trivy:java-db, mirror:full, and mirror:delta, each aligned with AOC rules and downstream compatibility requirements.
Surface parity. Operators can create, monitor, and download exports through the Web API gateway, Console workflows, and the CLI (stella export ...). All surfaces enforce tenant scope and RBAC consistently.
Automation hooks. One-off, cron, and event triggers are orchestrated via the Scheduler/Orchestrator integration. Export telemetry (durations, bundle size, verification outcomes) feeds structured logs, metrics, and optional OpenTelemetry traces.

Profile variants at a glance

Profile	Contents	Primary scenarios	Distribution defaults
`json:raw`	Canonical advisories, VEX, SBOM JSONL with hashes	Downstream analytics, evidence escrow	HTTP download, object storage
`json:policy`	`json:raw` plus policy snapshot, evaluated findings	Policy attestation, audit packages	HTTP download, object storage
`trivy:db` / `trivy:java-db`	Trivy-compatible vulnerability databases	Feed external scanners and CI	OCI artifact push, download
`mirror:full`	Complete evidence, indexes, policy, provenance	Air-gap mirror, disaster recovery	Filesystem bundle, OCI artifact
`mirror:delta`	Changes relative to prior manifest	Incremental updates to mirrors	Filesystem bundle, OCI artifact

How it works end-to-end

Profile & scope resolution. A profile defines export type, content filters, and bundle settings. Scope selectors target tenants, artifacts, time windows, ecosystems, or SBOM subjects.
Ledger collection. Workers stream canonical data from Findings Ledger, VEX Lens, Concelier feeds, and the SBOM service. Policy exports pin a deterministic policy snapshot from the Policy Engine.
Adapter execution. JSON adapters produce normalized .jsonl.zst outputs, Trivy adapters translate to the Trivy DB schema, and mirror adapters build filesystem or OCI bundle layouts.
Manifesting & provenance. Every run emits export.json (profile, filters, counts, checksums) and provenance.json (source artifacts, policy snapshot ids, signature references).
Signing & distribution. Bundles are signed via configured KMS (cosign-compatible) and distributed through HTTP streaming, OCI registry pushes, or object storage staging.

Refer to the Export Center Architecture for component diagrams and adapter internals.

Security and compliance guardrails

AOC alignment. Exports bundle raw evidence and optional policy evaluations without mutating source content. Policy overlays remain attributed to Policy Engine and are clearly partitioned.
Tenant isolation. All queries, manifests, and bundle paths carry tenant identifiers. Cross-tenant exports require explicit signed approval and ship with provenance trails.
Signing and encryption. Manifests and payloads are signed using the platform KMS. Mirror profiles support optional in-bundle encryption (age/AES-GCM) with key wrapping.
Determinism. Identical inputs yield identical bundles. Timestamps serialize in UTC ISO-8601; manifests include content hashes for audit replay.
Audit bundles. Audit packs use the audit bundle index schema and list transparency and timestamp references when available.

See Policy governance and the Aggregation-Only Contract for broader guardrail context.

Operating it offline

Offline Kit integration. Air-gapped deployments receive pre-built export profiles and object storage layout templates through the Offline Kit bundles.
Mirror bundles. mirror:full packages raw evidence, normalized indexes, policy snapshots, and provenance in a portable filesystem layout suitable for disconnected environments. mirror:delta tracks changes relative to a prior export manifest.
No unsanctioned egress. The exporter respects the platform allowlist. External calls (e.g., OCI pushes) require explicit configuration and are disabled by default for offline installs.

Consult the Offline Kit guide for Offline Kit delivery and Concelier mirror operations for mirror ingestion procedures.

Getting started

Choose a profile. Map requirements to the profile table above. Policy-aware exports need a published policy snapshot.
Define selectors. Decide on tenants, products, SBOM subjects, or time windows to include. Default selectors export the entire tenant scope.
Run via preferred surface.
- Console: Navigate to the Export Center view, create a run, monitor progress, and download artifacts.
- CLI: Use stella export run --profile <name> --selector <filters> to submit a job, then stella export download.
- API: POST to /api/export/runs with profile id and scope payload; stream results from /api/export/runs/{id}/download.
Verify bundles. Use the attached provenance manifest and cosign signature to validate contents before distributing downstream.

Refer to the Export Center CLI commands for detailed command syntax and automation examples.

Observability & troubleshooting

Structured logs emit lifecycle events (fetch, adapter, sign, publish) with correlation IDs for parallel job tracing.
Metrics exporter_run_duration_seconds, exporter_bundle_bytes_total, and exporter_run_failures_total feed the Grafana dashboards defined in the Operations Runbook.
Verification failures or schema mismatches bubble up through failure events and appear in the Console and CLI with actionable error messages. Inspect the run’s audit log and provenance.json for root cause.

See the Telemetry policy guide and the Deployment and upgrade runbook for telemetry and operations guidance.