VEX wire formats

StellaOps.Vulnerabilities.Contracts.Vex.VexWireSerializer serializes OpenVEX 0.2 and CSAF 2.0 from explicitly selected VexWireStatement values. It replaces the predecessor exporter types without importing their observation, persistence or hosting model.

The caller supplies document identity, issuer/namespace, publication time and selected statements. The serializer does not choose consensus or turn a version range into a product-wide claim. Callers must retain exact product applicability. One vulnerability/product pair cannot carry conflicting statements. A not_affected assertion requires a justification or impact statement; CSAF remediation text requires an explicit remediation category. Revised CSAF documents require the caller’s publication history.

Object keys and collections use stable ordering. The serializers perform no I/O, key lookup or signing. Signed delivery uses the existing cryptography purpose-key and envelope services in the owning caller. These are library wire APIs; this page does not claim a separate HTTP document export endpoint or a deployed binary-evidence deriver.

Verification uses the pinned CSAF schema with invalid controls, deterministic repeated output, and round trips through the current hub normalizers for all four statuses.