VEX Observations and Linksets

Audience: engineers and operators who need to understand how VEX evidence is stored and correlated before consensus runs.

This document describes how Stella Ops stores and correlates VEX statements without rewriting upstream sources. The model is evidence-first: raw documents are preserved immutably, normalization is a projection, and correlation never erases disagreement.

Observations (Append-Only Evidence)

An observation is the immutable record of a VEX document as received.

Recorded fields typically include:

• Provenance: tenant, provider/issuer identity, retrieved/received timestamps (UTC), signature verification status, trust metadata, and content digest.
• Raw payload: stored losslessly to support audit and offline verification.
• Derived indexes: extracted identifiers and tuples used to correlate evidence (without replacing the raw payload).

If upstream republishes a VEX document, the new version is stored as a new observation with a supersedes relationship.

Normalization (Projection Only)

Normalization produces tuples used by downstream layers:

• (vulnerabilityId, productKey) keys for correlation
• VEX status and justification
• Optional scope and validity windows

Normalization is a projection; it does not delete, mutate, or merge upstream evidence.

Linksets (Correlation Without Precedence)

Linksets group tuples that refer to the same conceptual product-vulnerability pair.

Properties:

• Deterministic: linkset identifiers are derived from canonical, sorted key material.
• Conflict-preserving: disagreements remain visible (status, scope, justification, issuer identity).
• Provenance-linked: every item in a linkset references its source observation digest and issuer metadata.

Downstream consumers (Policy, Console, Exports) use linksets to explain what disagrees and why.

References

• VEX consensus guide — conceptual model
• Excititor architecture — ingestion and raw store
• VEX Lens architecture — consensus and issuer trust
• Consensus algorithm (deterministic) — how linksets become an effective status