Decision Capsules — Audit-Grade Evidence Bundles

Current product direction, 2026-09-30: the promise is a governed release, safe recovery and independently checkable proof of the finalized decision revision. A capsule concept does not establish that every scan or release already has sealed, replayable evidence. See the vision, acceptance contract and current Evidence contract. The dated diagrams, comparisons, example schemas and command notes below retain their original context; they are not current sales claims or complete implementation guarantees. Recheck serving contracts and CLI behavior before operational use.

Status: Concept reference for v1.0.0-RC1 · CLI surface verified 2026-07-28 Audience: Technical buyers, security architects, compliance teams

Executive Summary

Stella Ops isn’t just another scanner—it’s a different product category: deterministic, evidence-linked vulnerability decisions that survive auditors, regulators, and supply-chain propagation.

Decision Capsules describe the intended evidence package: exact inputs, outputs and verification material for an identified decision. Whether a record can be independently verified or replayed depends on the material actually retained and the checks performed. Durable completion of release-decision proof remains explicit program work.

Key message: “Prove every fix, audit every finding.”

What is a Decision Capsule?

A Decision Capsule is a signed, immutable bundle containing:

Component	Description	Purpose
Exact SBOM	The precise software bill of materials used for the scan	Reproducibility
Vuln feed snapshots	Frozen advisory data (NVD, OSV, GHSA, etc.) at scan time	Consistency
Reachability evidence	Static call-graph artifacts + runtime traces	Proof of analysis
Policy version	Lattice rules and threshold configuration	Explainability
Derived VEX	The vulnerability status decision with justification	Outcome
DSSE signatures	Cryptographic signatures over all contents	Integrity

┌─────────────────────────────────────────────────────────────┐
│                    Decision Capsule                          │
├─────────────────────────────────────────────────────────────┤
│  ┌─────────┐  ┌─────────────┐  ┌──────────────────┐        │
│  │  SBOM   │  │ Vuln Feeds  │  │ Reachability     │        │
│  │ (exact) │  │ (snapshots) │  │ Evidence         │        │
│  └─────────┘  └─────────────┘  └──────────────────┘        │
│                                                              │
│  ┌─────────────┐  ┌─────────────┐  ┌──────────────────┐    │
│  │ Policy Ver  │  │ Derived VEX │  │ DSSE Signatures  │    │
│  │ + Lattice   │  │ + Justify.  │  │ (integrity)      │    │
│  └─────────────┘  └─────────────┘  └──────────────────┘    │
└─────────────────────────────────────────────────────────────┘

Why Decision Capsules Matter

For Security Teams

Reproduce any finding: Re-run a scan from 6 months ago with identical results
Trust the evidence: Every decision has cryptographic proof
Explain to stakeholders: Clear justification for every block/allow decision

For Compliance Teams

Audit-ready artifacts: Evidence bundles meet regulatory requirements
Chain of custody: Full provenance from scan to decision
Tamper-evident: Any modification breaks the signature

For Developers

No “works on my machine”: Reproducible results across environments
Fast debugging: Trace exactly why a vulnerability was flagged
CI/CD integration: Capsules fit into existing pipelines

Competitive Differentiation

Capability	Stella Ops	Competitors
Sealed evidence	Decision Capsules with DSSE signatures	Scan reports (mutable)
Reproducibility	Bit-for-bit replay from frozen feeds	“Re-scan” with current data
Evidence linking	Every VEX decision has proof pointers	VEX statements without proof
Offline verification	Full verification without network	Requires SaaS connection

Battlecard one-liner: “Prove every fix, audit every finding—Decision Capsules seal evidence so you can replay scans bit-for-bit.”

Technical Details

Capsule Format

apiVersion: capsule.stellaops.dev/v1
metadata:
  id: "cap-2025-12-11-abc123"
  timestamp: "2025-12-11T14:30:00Z"
  scan_id: "scan-xyz789"
inputs:
  sbom:
    format: "cyclonedx@1.6"
    digest: "sha256:..."
  feeds:
    - name: "nvd"
      snapshot: "2025-12-11"
      digest: "sha256:..."
    - name: "osv"
      snapshot: "2025-12-11"
      digest: "sha256:..."
  policy:
    version: "corp-policy@2025-12-01"
    digest: "sha256:..."
  reachability:
    graph_hash: "blake3:..."
    edge_bundles: ["bundle:001", "bundle:002"]
outputs:
  vex:
    format: "openvex"
    digest: "sha256:..."
  findings:
    digest: "sha256:..."
signatures:
  - scheme: "DSSE"
    profile: "FIPS-140-3"
    signer: "build-ca@corp"

CLI Commands

There is no stella capsule command. “Decision Capsule” is the concept name used on this page and in marketing copy; the shipped CLI surface for it is stella evidence. Verified 2026-07-28 against src/Cli/StellaOps.Cli/bin/Debug/net10.0/StellaOps.Cli.exe: stella capsule verify exits 2 with Unrecognized command or argument 'capsule'. Never add a command to this page without running it against the shipped binary first.

The current Evidence export surface uses the consolidated owner API:

# Export an already-sealed bundle through its asynchronous export job
stella evidence export <bundle-id> --include-rekor-proofs --output evidence-bundle.tar.gz
stella evidence status <export-id> --bundle <bundle-id>

# Retrieve the release's portable bundle, save the published signing key set,
# then verify the bundle offline against that declared trust root
stella evidence export --release <release-id> --output release-evidence.tgz
curl -fsS https://<console-host>/api/evidence/v1/evidence/capsules/signing-keys/jwks -o evidence-signing-keys.jwks.json
stella evidence verify-offline release-evidence.tgz --trust-root evidence-signing-keys.jwks.json --output json

stella evidence verify-offline fails with trust_root_missing (exit 4) when no trust root is given: archive integrity alone does not establish who signed the bundle. Outcomes and limits are in Evidence offline verification.

The unsupported card-export command and its unused card trust-root option are withdrawn. Existing card and legacy archive readers report authenticity as unverified and return nonzero; parsing DSSE fields or a Rekor receipt does not establish cryptographic validity.

Deterministic replay is a separate command group, and it takes a run manifest rather than a capsule file:

# Replay from a run manifest and write the resulting verdict
stella replay --manifest run-manifest.json --output verdict.json

# Replay twice and assert the two runs agree
stella replay verify --manifest run-manifest.json

# Compare two verdict files
stella replay diff --a verdict-a.json --b verdict-b.json

There is no --assert-digest flag; determinism is asserted by stella replay verify (replay twice, compare) or by stella replay diff against a stored verdict.

SBOM generation is stella sbom generate; stella scan is a command group with no --image option of its own and no --capsule-out flag anywhere in the CLI.

stella sbom generate --image reg/app@sha256:... --format cyclonedx --output sbom.json

Confirm any invocation on this page with stella <verb> --help before relying on it.

Integration with Four Capabilities

Decision Capsules connect all four capabilities:

Signed Reachability → Reachability evidence sealed in capsule
Deterministic Replay → Capsule enables bit-for-bit replay
Explainable Policy → Policy version + derived VEX in capsule
Sovereign Offline → Capsule verifiable without network

docs/key-features.md — Feature overview
Product vision — Current promise, focus and acceptance boundaries
docs/modules/graph/reachability/guides/lattice.md — Reachability scoring
docs/VEX_CONSENSUS_GUIDE.md — VEX consensus and issuer trust