Moat Gap Analysis: StellaOps Competitive Position

Source Advisory: 19-Dec-2025 - Stella Ops candidate features mapped to moat strength Analysis Date: 2025-12-22 Status: Sprints created, implementation pending

Executive Summary

This document captures the gap analysis between the competitive moat advisory and StellaOps’ current implementation, along with the sprint plan to address identified gaps.

Moat Scale Reference

Feature Implementation Matrix

Detailed Gap Analysis

1. Signed, Replayable Risk Verdicts (Moat 5)

What exists:

• VerdictReceiptStatement with in-toto predicate
• ProofSpine and ProofChainBuilder infrastructure
• TrustLatticeEngine.Evaluate() producing ProofBundle
• ReplayManifest and ReplayVerifier
• Input hashing (sbomDigest, feedsDigest, policyDigest)

Gaps:

Moat Thesis: “We don’t output findings; we output an attestable decision that can be replayed.”

2. VEX Decisioning Engine (Moat 4)

What exists:

• VexConsensusEngine with 5 modes
• TrustLatticeEngine with K4 lattice atoms
• TrustWeightEngine for issuer weighting
• VEX normalizers for CycloneDX, OpenVEX, CSAF
• VexLens module with consensus rationale

Gaps:

Moat Thesis: “We treat VEX as a logical claim system, not a suppression file.”

3. Reachability with Proof (Moat 4)

What exists:

• ReachabilityWitnessStatement attestation type
• PathWitnessBuilder for call-path proofs
• CallPath models with entrypoint → symbol chain
• ReachabilityLattice for state management
• CompositeGateDetector for boundary extraction

Gaps:

Moat Thesis: “We provide proof of exploitability in this artifact, not just a badge.”

4. Smart-Diff Semantic Risk Delta (Moat 4)

What exists:

• MaterialRiskChangeDetector with R1-R4 rules
• RiskStateSnapshot capturing full finding state
• Detection of all flip types
• Priority scoring algorithm
• SARIF output generation

Gaps:

Moat Thesis: “We explain what changed in exploitable surface area, not what changed in CVE count.”

5. Unknowns as First-Class State (Moat 4)

What exists:

• UncertaintyTier (T1-T4) with entropy classification
• UnknownStateLedger tracking marker kinds
• Risk modifiers from uncertainty
• BlocksNotAffected() gate on T1 tier

Gaps:

Moat Thesis: “We quantify uncertainty and gate on it.”

6. Air-Gapped Epistemic Mode (Moat 4)

What exists:

• AirGap.Controller with state management
• ReplayVerifier with depth levels
• TrustStore and TufMetadataValidator
• EgressPolicy enforcement
• TimeAnchor for offline time validation

Gaps:

Moat Thesis: Air-gapped “runtime” is common; air-gapped reproducibility is not.

7. SBOM Ledger + Lineage (Moat 3)

What exists:

• SbomService with versioning events
• CatalogRecord for storage
• Graph module for dependency indexing
• SbomVersionEvents

Gaps:

Moat Strategy: Make the ledger valuable via semantic diff, evidence joins, and provenance.

8. Policy Engine with Proofs (Moat 3)

What exists:

• PolicyEvaluation with PolicyExplanation
• OPA/Rego integration
• ProofBundle generation from TrustLattice
• Evidence pointers in verdict statements

Gaps:

Moat Strategy: Keep policy language small but rigorous; always emit evidence pointers.

9. VEX Distribution Network (Moat 3-4)

What exists:

• Excititor ingests from 7+ VEX sources
• VexConnectorMetadata for source tracking

Gaps:

Moat Strategy: Differentiate with verification + trust scoring of VEX sources.

10. Signed Execution Evidence (Moat 3-4)

Added 2026-02-19 from advisory review (rescoped from external “sandbox traces” proposal).

What exists:

• RuntimeTracesEndpoints — runtime trace ingestion in Findings module
• RuntimeSignalIngester — containment/blast-radius signal ingestion in Unknowns
• SignalSnapshotBuilder — signal snapshot composition for replay/audit
• Signals POST /signals/runtime-facts — runtime fact ingestion (eBPF/ETW)
• InMemoryRuntimeInstrumentationServices — address canonicalization, hot-symbol aggregation

Gaps:

Moat Thesis: “We don’t just claim it ran — we provide signed, replayable proof of execution with deterministic trace summarization.”

Moat Strategy: Elevates from Level 3 (runtime instrumentation exists elsewhere) to Level 4 when combined with existing proof chain (signed execution evidence + verdict + reachability = attestable decision lifecycle).

11. Runtime Beacon Attestations (Moat 3)

Added 2026-02-19 from advisory review (rescoped from external “canary beacons” proposal).

What exists:

• Signals runtime-facts ingestion pipeline
• Zastava module (planned runtime protection/admission controller)
• Doctor module runtime host capabilities (eBPF, ETW, dyld agents)

Gaps:

Moat Thesis: “Low-volume signed proof that this artifact actually ran in this environment — verifiable offline, no image modification required.”

Moat Strategy: Level 3 standalone; combined with execution evidence and proof chain, contributes to the “attestable decision lifecycle” story for compliance-oriented customers.

12. Privacy-Preserving Federated Runtime Telemetry (New L5 — Structural)

Added 2026-02-19 from moat-gap advisory.

What exists:

• Signals runtime-facts ingestion pipeline (eBPF/ETW/dyld)
• FederationHub / CrossRegionSync for bundle transport
• DsseEnvelope signing infrastructure
• AirGap egress policy enforcement

Implementation (Sprints 20260220_005-009):

Moat Thesis: “We share exploit intelligence across sites without sharing raw code — privacy-preserving, consent-proven, offline-compatible.”

Moat Strategy: No competitor has DP + k-anonymity over federated runtime signals with DSSE consent. Network-effect moat: each new participant enriches the shared corpus. Combined with existing proof chain, creates attestable federated intelligence lifecycle.

13. Developer-Facing Signed-PR Remediation Marketplace (New L4 — Strong)

Added 2026-02-19 from moat-gap advisory.

What exists:

• FixChainAttestationService (DSSE-signed fix chain proofs)
• SCM webhook pipeline in Signals
• ReachGraph for reachability delta computation
• Integration Hub plugin framework

Implementation (Sprints 20260220_010-015):

Moat Thesis: “Every remediation PR is verified against reachability proof deltas and cryptographically attested — not just a patch, but proof the fix actually reduces exploitable surface.”

Moat Strategy: No competitor has PR-level fix attestations verified against reachability proof deltas. Six-module integration depth (Attestor + ReachGraph + Signals + Scanner + Policy + EvidenceLocker) creates deep switching cost.

Sprint Roadmap

Phase 1: Moat 5 Anchor (P0)

4300_0001_0001 → 4300_0001_0002
     │
     └── Verdict becomes portable, replayable

Phase 2: Moat 4 Hardening (P1)

4300_0002_0001 → 4300_0002_0002
     │
     └── Unknowns become actionable

4300_0003_0001
     │
     └── Air-gap becomes reproducible

4500_0001_0001 → 4500_0001_0002
     │
     └── VEX becomes distributable

Phase 3: Moat 4 Extensions (P2)

4400_0001_0001 (Delta Verdict)
4400_0001_0002 (Reachability Artifact)

Phase 4: Moat 3 Foundation (P2)

4600_0001_0001 → 4600_0001_0002
     │
     └── SBOM becomes historical

Phase 5: Runtime Evidence (P2-P3)

20260219_013 (SEE-01 → SEE-04)
     │
     └── Execution becomes attestable

20260219_014 (BEA-01 → BEA-04)
     │
     └── Presence becomes provable

Phase 6: Moat Expansion — Three New Capabilities (P1)

20260220_001 → 20260220_002 → 20260220_003
     │
     └── Symbol Marketplace (L4 @ 95%)

20260220_005 → 20260220_006 → 20260220_007 → 20260220_008
     │
     └── Federated Telemetry (New L5)

20260220_010 → 20260220_011 → 20260220_012 → 20260220_013 → 20260220_014
     │
     └── Remediation Marketplace (New L4)

Competitive Positioning Summary

Where StellaOps Is Strong

1. VEX decisioning — Multi-mode consensus engine is ahead of all competitors (including Docker Scout, JFrog)
2. Smart-Diff — R1-R4 rules with priority scoring is unique
3. Policy engine — OPA/Rego with proof output is mature
4. Attestor — in-toto/DSSE infrastructure is complete
5. Symbolized call-stack proofs — No competitor (Docker Scout, Trivy, JFrog) delivers function-level symbol evidence with demangled names and build-ID binding
6. Deterministic signed scoring — JFrog centralizes evidence but can’t replay; Stella produces seeded, verifiable scoring envelopes
7. Rekor size-aware strategy — Hash pointer in Rekor + full payload in Evidence Locker solves real ~100KB upload constraints
8. Federated telemetry — Privacy-preserving cross-site exploit intelligence with DP + k-anonymity + DSSE consent proofs
9. Remediation marketplace — Signed-PR fix attestations verified against reachability proof deltas with contributor trust scoring

Where StellaOps Must Improve

1. Verdict portability — OCI push makes verdicts first-class artifacts
2. Audit replay — One-command replay is essential for compliance
3. VEX distribution — Hub layer creates network effects
4. Unknown governance — Policy budgets make uncertainty actionable

Avoid Head-On Fights

• Snyk: Don’t compete on developer UX; compete on proof-carrying reachability
• Prisma: Don’t compete on CNAPP breadth; compete on decision integrity
• Anchore: Don’t compete on SBOM storage; compete on semantic diff + VEX reasoning
• Docker Scout: Don’t compete on registry-native DHI integration; compete on call-stack symbolization, replay, and lattice VEX
• JFrog: Don’t compete on artifact management breadth; compete on deterministic scoring, replayable verdicts, and function-level proofs

References

• Sprints: docs/implplan/SPRINT_4300_*.md, SPRINT_4400_*.md, SPRINT_4500_*.md, SPRINT_4600_*.md
• Original Advisory: docs/product/advisories/archived/19-Dec-2025 - Stella Ops candidate features mapped to moat strength.md
• Architecture: docs/ARCHITECTURE_OVERVIEW.md