Developer Tools

CLI utilities, benchmarks, SDK generators, and the developer portal that support building, testing, and shipping Stella Ops.

Audience: Stella Ops developers and operators working in local and CI workflows.

Purpose

Developer Tools is a collection of standalone utilities used during development and CI. Each tool addresses a specific concern — refreshing golden test fixtures from live APIs, validating policy DSL files, running smoke tests, generating CI workflow definitions, benchmarking subsystems, or verifying offline evidence bundles. None of these tools are deployed as services; they run locally or in CI pipelines.

Quick Links

Status

Attribute	Value
Maturity	Production
Source	`src/Tools/`

Key Features

FixtureUpdater: deterministic refresh of Concelier OSV/GHSA/NVD golden fixtures (--repo-root, --osv-fixtures, --ghsa-fixtures, --nvd-fixtures, --fixed-time)
GoldenPairs: SBOM/advisory corpus management
PolicyDslValidator: policy DSL validation (thin CLI over StellaOps.Policy.Tools)
PolicySchemaExporter: policy JSON schema export (thin CLI over StellaOps.Policy.Tools)
PolicySimulationSmoke: policy simulation smoke tests
LanguageAnalyzerSmoke: language detection tests
NotifySmokeCheck: end-to-end Notify smoke check — verifies expected scanner event kinds appear in the Redis/Valkey stella.events stream and in Notify /api/v1/deliveries within a configurable lookback (configured via NOTIFY_SMOKE_* environment variables)
RustFsMigrator: copies objects from an S3-compatible source bucket into RustFS storage over HTTP PUT (--s3-bucket, --rustfs-endpoint, --rustfs-bucket, --prefix, --immutable, --retain-days, --dry-run); supports retries with exponential backoff
WorkflowGenerator: C# library that emits CI/CD workflow YAML (via YamlDotNet) for GitHub Actions, GitLab CI, Azure DevOps, and Gitea Actions (CiPlatform enum)
StellaOps.OpenApi.DocGen: renders an OpenAPI (JSON/YAML) spec into a deterministic Markdown API reference (--input, --output, --title, --source-label, --path-prefix)
Supply-chain hardening suite: deterministic mutation/negative-path security gates under src/__Tests/supply-chain/ (suites 01-jcs-property, 02-schema-fuzz, 03-rekor-neg, 04-big-dsse-referrers, 05-corpus)
StellaOps.Bench: performance benchmarks for LinkNotMerge, VEX, Notify, Policy, and Scanner subsystems (absorbed from src/Bench/)
StellaOps.Verifier: standalone offline evidence bundle verifier for air-gapped environments (absorbed from src/Verifier/)
StellaOps.Tools.TlptScoper: deterministic DORA TLPT scope JSON generator over Asset Registry v1 local inputs or live Graph Asset Registry queries
StellaOps.Sdk.Generator: multi-language SDK code generation from OpenAPI spec (absorbed from src/Sdk/)
StellaOps.Sdk.Release: SDK release automation (absorbed from src/Sdk/)
StellaOps.DevPortal.Site: Astro-based interactive developer portal with API docs and Try-It console (absorbed from src/DevPortal/)

Dependencies

Upstream

Policy Engine libraries (StellaOps.Policy.Tools) - policy DSL parsing, validation, and JSON schema export (backing PolicyDslValidator/PolicySchemaExporter)
Scanner libraries - language analyzer and SBOM processing
Notify libraries - notification model definitions (Bench.Notify)
Graph API contracts (StellaOps.Graph.Api.Contracts) - live Asset Registry queries for TLPT Scoper
TestKit - shared test infrastructure for benchmark test projects
System.CommandLine - CLI parsing (FixtureUpdater, GoldenPairs, PolicySchemaExporter, Verifier, TLPT Scoper)
YamlDotNet - YAML emit/parse for WorkflowGenerator and OpenApi.DocGen
StackExchange.Redis - Redis/Valkey stream reads for NotifySmokeCheck
AWSSDK.S3 (Amazon.S3) - S3-compatible source reads for RustFsMigrator
Astro/Starlight (Node.js) - DevPortal static site framework

Downstream

CI pipelines - consume generated workflow definitions
Test suites - consume golden fixtures and SBOM/advisory pairs
SDK consumers - consume generated Go/Java/Python/TypeScript clients
Auditors - consume Verifier output in air-gapped verification workflows