Mirror

Mirror lets a sealed or disconnected estate stay current without direct access to upstream feeds: content is exported on a connected host, carried across the gap with verified digests, and applied on the far side by the service that owns it. This page is for operators moving vulnerability data offline and for engineers looking for where the mirror code lives.

Mirror is a capability, not a service. It has no src/Mirror root, no host and no database.

Source: src/Vulnerabilities/ (data owner), src/Cli/StellaOps.Cli/Commands/MirrorSeedCommandGroup.cs, src/OfflineKit/ (mirror export profile and carrier)

Where to start

• Move vulnerability data offline: Vulnerability mirror seeds is the operator reference for stella mirror seed export, validate, import and download.
• Architecture: architecture.mdmaps each mirror responsibility to its owning module, lists the retired predecessors (Concelier, src/Mirror) and where their work went, and names the contracts.
• Mirror export profiles and carriers: the OfflineKit dossier owns export runs, including the mirror profile kind, and Offline Kit carrier activation.

Current status

• Mirror seeds are the supported offline path for vulnerability and VEX data. The hub imports a seed through its owner API and publishes the corpus afterwards, also in a sealed estate.
• A mirror export profile (ExportProfileKind.Mirror) runs on offlinekit-worker and writes a self-contained mirror bundle from local file:// or absolute-path sources.
• stella mirror create fails closed with exit code 9 (mirror_create_not_implemented) and writes no files.
• The old Mirror Creator planning library and its shell scripts were withdrawn on 2026-09-26 to src/__Obsoleted/OfflineKit/__Libraries/StellaOps.Mirror.Creator/. Its runtime service failed closed and it had no consumer outside its own tests.

Other pages in this directory

These are dated planning and format records from the thin-bundle work. They describe proposals and sample outputs, not a supported operator path; check each claim against src/ before use.

• Thin-bundle assembler: thin-bundle-assembler.md, assembler.md, milestone-0-thin-bundle.md
• DSSE and TUF profile and signing: dsse-tuf-profile.md, signing-runbook.md, dsse-revision-decision.md
• Provenance observers draft: provenance/observers.md

Related documentation

• Vulnerabilities hub: ../vulnerabilities/architecture.md
• OfflineKit: ../offlinekit/
• Mirror bundle layout: ../export-center/mirror-bundles.md
• AirGap posture: ../airgap/