Golden Corpus Operations Runbook
Withdrawn procedures (2026-09-27). The ground-truth corpus procedures this runbook used to describe were withdrawn: mirror sync, KPI baselines, bundle export and import, and validation runs. The
groundtruthcommand group and its CLI plug-in were withdrawn on 2026-09-12 (SPRINT_20260722_014 BIN-10; the source is frozen undersrc/__Obsoleted/Cli/). The Doctor checkscheck.binaryanalysis.corpus.mirror.freshnessandcheck.binaryanalysis.corpus.kpi.baselinefollowed on 2026-09-27, because they inspected artifacts only those commands produced. The former text is preserved unchanged atdocs-archive/runbooks/ci/golden-corpus-operations.md; do not follow it.
Audience: BinaryIndex operators and on-call engineers.
This page lists only what an operator can run today.
Binary-analysis Doctor checks
The four checks of StellaOps.Doctor.Plugin.BinaryAnalysis are live. stella doctor --check takes one exact check ID; it does not accept globs or wildcards.
| Task | Command |
|---|---|
| Check debuginfod availability | stella doctor --check check.binaryanalysis.debuginfod.available |
| Check the ddeb repository | stella doctor --check check.binaryanalysis.ddeb.enabled |
| Check the buildinfo cache | stella doctor --check check.binaryanalysis.buildinfo.cache |
| Check the symbol-recovery fallback | stella doctor --check check.binaryanalysis.symbol.recovery.fallback |
Each check’s remediation article is under docs/doctor/articles/binary-analysis/.
Golden-set bench tooling (stella golden)
stella golden manages golden-set YAML files in a local corpus directory: the --corpus value, else $STELLAOPS_CORPUS, else ./golden-corpus. These subcommands are bench tooling over local YAML files; they do not touch the golden_sets schema. BIN-5 (SPRINT_20260722_014) removed golden build-index; the hub’s build-id index exporter produces that artifact instead.
| Task | Command |
|---|---|
| Write a golden-set template for an advisory ID | stella golden init CVE-2024-0567 --component openssl --output openssl.golden.yaml |
| Validate a golden-set file | stella golden validate openssl.golden.yaml --strict |
| Import it into the corpus | stella golden import openssl.golden.yaml --corpus ./golden-corpus |
| List golden sets | stella golden list --corpus ./golden-corpus --output json |
| Show one golden set | stella golden show ./golden-corpus/openssl.golden.yaml |
golden init writes a template only; it fetches no advisory data. Before golden validate passes, fill in at least one entry under targets, plus metadata.author_id and metadata.source_ref. The --nvd, --osv and --ghsa switches only set the template’s informational sources block. golden import refuses to replace a file of the same name already in the corpus; add --force to overwrite it (stella golden import openssl.golden.yaml --corpus ./golden-corpus --force). Run stella golden <subcommand> --help for the full option list of your build.
Related
- Ground-truth CLI guide (frozen history; commands withdrawn)
- Golden corpus KPIs