VEX Operations Runbook

Audience: Platform on-call and operators triaging VEX (Vulnerability Exploitability eXchange) ingestion and mapping problems in a Stella Ops deployment.

Purpose: Triage issuer admission, statement provenance, Policy projection and Findings display failures without losing the audit trail.

Supported Scope

This runbook covers VEX operations for Docker Compose, Offline Kit, signed release manifests, and host/service-manager deployments.

Kubernetes and Helm deployment procedures are retired. Do not use Helm mock overlays, helm upgrade, helm rollback, kubectl logs, or Kubernetes resource captures as Stella Ops VEX operations evidence.

Related runbooks: VEX Consensus Operations · VEX Consensus Troubleshooting · Vulnerability Operations

Triage

  1. Capture the VEX document id, tenant, product, release manifest digest, and affected vulnerability ids.
  2. Verify VEX document signature, digest, and source against the release or Offline Kit evidence.
  3. Check vulnerabilities-web, policy-engine and findings-web health and projection logs. VexLens is withdrawn.
  4. Compare hub facts, Policy’s authenticated tenant effective-status answer and the displayed finding.

Mitigation

  1. Reject unsigned, stale, or mismatched VEX documents.
  2. For a refused signed push, check the configured issuer, OAuth client and public verification key.
  3. Diagnose feed failure or projection lag before applying the recovery in the consensus troubleshooting guide.
  4. Capture before/after effective status and promotion results. A restart or accepted decision write is not proof of convergence.

Evidence