Decision Capsules — Audit-Grade Evidence Bundles

Status: Concept reference for v1.0.0-RC1 · CLI surface verified 2026-07-28 Audience: Technical buyers, security architects, compliance teams

Executive Summary

Stella Ops isn’t just another scanner—it’s a different product category: deterministic, evidence-linked vulnerability decisions that survive auditors, regulators, and supply-chain propagation.

Decision Capsules are the mechanism that makes this possible: content-addressed bundles that seal every scan result with all inputs, outputs, and evidence needed to reproduce and verify vulnerability decisions. This is the heart of audit-grade assurance—every decision becomes a provable, replayable fact.

Key message: “Prove every fix, audit every finding.”

What is a Decision Capsule?

A Decision Capsule is a signed, immutable bundle containing:

Component	Description	Purpose
Exact SBOM	The precise software bill of materials used for the scan	Reproducibility
Vuln feed snapshots	Frozen advisory data (NVD, OSV, GHSA, etc.) at scan time	Consistency
Reachability evidence	Static call-graph artifacts + runtime traces	Proof of analysis
Policy version	Lattice rules and threshold configuration	Explainability
Derived VEX	The vulnerability status decision with justification	Outcome
DSSE signatures	Cryptographic signatures over all contents	Integrity

┌─────────────────────────────────────────────────────────────┐
│                    Decision Capsule                          │
├─────────────────────────────────────────────────────────────┤
│  ┌─────────┐  ┌─────────────┐  ┌──────────────────┐        │
│  │  SBOM   │  │ Vuln Feeds  │  │ Reachability     │        │
│  │ (exact) │  │ (snapshots) │  │ Evidence         │        │
│  └─────────┘  └─────────────┘  └──────────────────┘        │
│                                                              │
│  ┌─────────────┐  ┌─────────────┐  ┌──────────────────┐    │
│  │ Policy Ver  │  │ Derived VEX │  │ DSSE Signatures  │    │
│  │ + Lattice   │  │ + Justify.  │  │ (integrity)      │    │
│  └─────────────┘  └─────────────┘  └──────────────────┘    │
└─────────────────────────────────────────────────────────────┘

Why Decision Capsules Matter

For Security Teams

Reproduce any finding: Re-run a scan from 6 months ago with identical results
Trust the evidence: Every decision has cryptographic proof
Explain to stakeholders: Clear justification for every block/allow decision

For Compliance Teams

Audit-ready artifacts: Evidence bundles meet regulatory requirements
Chain of custody: Full provenance from scan to decision
Tamper-evident: Any modification breaks the signature

For Developers

No “works on my machine”: Reproducible results across environments
Fast debugging: Trace exactly why a vulnerability was flagged
CI/CD integration: Capsules fit into existing pipelines

Competitive Differentiation

Capability	Stella Ops	Competitors
Sealed evidence	Decision Capsules with DSSE signatures	Scan reports (mutable)
Reproducibility	Bit-for-bit replay from frozen feeds	“Re-scan” with current data
Evidence linking	Every VEX decision has proof pointers	VEX statements without proof
Offline verification	Full verification without network	Requires SaaS connection

Battlecard one-liner: “Prove every fix, audit every finding—Decision Capsules seal evidence so you can replay scans bit-for-bit.”

Technical Details

Capsule Format

apiVersion: capsule.stellaops.dev/v1
metadata:
  id: "cap-2025-12-11-abc123"
  timestamp: "2025-12-11T14:30:00Z"
  scan_id: "scan-xyz789"
inputs:
  sbom:
    format: "cyclonedx@1.6"
    digest: "sha256:..."
  feeds:
    - name: "nvd"
      snapshot: "2025-12-11"
      digest: "sha256:..."
    - name: "osv"
      snapshot: "2025-12-11"
      digest: "sha256:..."
  policy:
    version: "corp-policy@2025-12-01"
    digest: "sha256:..."
  reachability:
    graph_hash: "blake3:..."
    edge_bundles: ["bundle:001", "bundle:002"]
outputs:
  vex:
    format: "openvex"
    digest: "sha256:..."
  findings:
    digest: "sha256:..."
signatures:
  - scheme: "DSSE"
    profile: "FIPS-140-3"
    signer: "build-ca@corp"

CLI Commands

There is no stella capsule command. “Decision Capsule” is the concept name used on this page and in marketing copy; the shipped CLI surface for it is stella evidence. Verified 2026-07-28 against src/Cli/StellaOps.Cli/bin/Debug/net10.0/StellaOps.Cli.exe: stella capsule verify exits 2 with Unrecognized command or argument 'capsule'. Never add a command to this page without running it against the shipped binary first.

The real surface, with real flags:

# Export an evidence pack as a single-file evidence card
stella evidence card export <pack-id> --output card.evidence-card.json

# Verify DSSE signatures and Rekor receipts in a card
stella evidence card verify card.evidence-card.json

# Verify fully offline (air-gapped: skips the Rekor transparency-log lookup)
stella evidence card verify card.evidence-card.json --offline --trust-root ./trust-root.json

# Export a full evidence bundle for an audit, and verify it fail-closed
stella evidence export <bundle-id> --include-rekor-proofs
stella evidence export --release <release-id>      # "the audit bundle for release X"
stella evidence verify-offline evidence-bundle-<id>.tar.gz

--format on stella evidence card export accepts json (default) or yaml — there is no audit-bundle value. <pack-id> is an evidence pack ID (e.g. evp-2026-01-14-abc123), not a release name.

Deterministic replay is a separate command group, and it takes a run manifest rather than a capsule file:

# Replay from a run manifest and write the resulting verdict
stella replay --manifest run-manifest.json --output verdict.json

# Replay twice and assert the two runs agree
stella replay verify --manifest run-manifest.json

# Compare two verdict files
stella replay diff --a verdict-a.json --b verdict-b.json

There is no --assert-digest flag; determinism is asserted by stella replay verify (replay twice, compare) or by stella replay diff against a stored verdict.

SBOM generation is stella sbom generate; stella scan is a command group with no --image option of its own and no --capsule-out flag anywhere in the CLI.

stella sbom generate --image reg/app@sha256:... --format cyclonedx --output sbom.json

Confirm any invocation on this page with stella <verb> --help before relying on it.

Integration with Four Capabilities

Decision Capsules connect all four capabilities:

Signed Reachability → Reachability evidence sealed in capsule
Deterministic Replay → Capsule enables bit-for-bit replay
Explainable Policy → Policy version + derived VEX in capsule
Sovereign Offline → Capsule verifiable without network

docs/key-features.md — Feature overview
docs/VISION.md — Product vision and moats
docs/modules/reach-graph/guides/lattice.md — Reachability scoring
docs/VEX_CONSENSUS_GUIDE.md — VEX consensus and issuer trust