Advisory Architecture Alignment Report

Audience: product and architecture reviewers assessing how the Stella Ops implementation maps to the reference advisory architecture. This report is a point-in-time alignment snapshot — confirm specific claims against the cited source files under src/ before relying on them.

Executive Summary

This report validates that Stella Ops is fully aligned with the reference advisory architecture, which specifies CycloneDX 1.7, VEX-first decisioning, in-toto attestations, and signal-based contracts.

Overall alignment score: 100%

Component-by-Component Alignment

1. DSSE/in-toto Attestations

Advisory Requirement:

All security artifacts must be wrapped in DSSE-signed in-toto attestations with specific predicate types.

StellaOps Implementation: ✅ 19 Predicate Types

Evidence:

• src/Signer/StellaOps.Signer/StellaOps.Signer.Core/PredicateTypes.cs
• src/Attestor/StellaOps.Attestor.Envelope/DsseEnvelope.cs

2. VEX Multi-Format Support

Advisory Requirement:

Support OpenVEX, CycloneDX VEX, and CSAF formats with aggregation and precedence.

StellaOps Implementation: ✅ 4 Format Families

Evidence:

• src/Excititor/__Libraries/StellaOps.Excititor.VexParsing/
• src/Policy/__Libraries/StellaOps.Policy/Lattice/VexLattice.cs
• Lattice aggregation with justified_negation_bias

3. CVSS v4.0

Advisory Requirement:

Support CVSS v4.0 with full vector parsing and MacroVector computation.

StellaOps Implementation: ✅ Full Support

Evidence:

• src/Signals/StellaOps.Signals/Cvss/Cvss4Parser.cs
• src/Signals/StellaOps.Signals/Cvss/MacroVectorComputer.cs

4. EPSS Integration

Advisory Requirement:

Track EPSS with model_date provenance (not version numbers).

StellaOps Implementation: ✅ Correct Model Dating

Evidence:

• src/Scanner/__Libraries/StellaOps.Scanner.Storage/Epss/
• docs-archive/technical/architecture/epss-versioning-clarification.md

5. Deterministic Scoring

Advisory Requirement:

Scores must be reproducible given same inputs (canonical JSON, sorted keys, UTC timestamps).

StellaOps Implementation: ✅ 3 Scoring Engines

Determinism Guarantees:

• StellaOps.Canonical.Json for sorted-key serialization
• ScannerTimestamps.Normalize() for UTC normalization
• Hash-tracked input snapshots (ScoringRulesSnapshot)

Evidence:

• src/__Libraries/StellaOps.Canonical.Json/CanonJson.cs
• src/Policy/__Libraries/StellaOps.Policy/Scoring/

6. Reachability Analysis

Advisory Requirement:

Static + dynamic call graph analysis with entrypoint-to-sink reachability.

StellaOps Implementation: ✅ Hybrid Analysis

Evidence:

• src/Scanner/__Libraries/StellaOps.Scanner.CallGraph/
• src/Scanner/__Libraries/StellaOps.Scanner.Reachability/

7. Call-Stack Witnesses

Advisory Requirement:

DSSE-signed witnesses proving entrypoint → sink paths.

StellaOps Implementation: ✅ Full Witness System

Evidence:

• src/Scanner/__Libraries/StellaOps.Scanner.Reachability/Witnesses/
• docs/contracts/witness-v1.md

8. Smart-Diff

Advisory Requirement:

Detect material risk changes between scan runs.

StellaOps Implementation: ✅ 4 Detection Rules

Evidence:

• src/Scanner/__Libraries/StellaOps.Scanner.SmartDiff/

9. Unknowns Handling

Advisory Requirement:

Track uncertainty with multi-dimensional scoring.

StellaOps Implementation: ✅ 11 Unknown Types, 5 Dimensions

Unknown Types:

1. missing_vex - No VEX statement
2. ambiguous_indirect_call - Unresolved call target
3. unanalyzed_dependency - Dependency not scanned
4. stale_sbom - SBOM age threshold exceeded
5. missing_reachability - No reachability data
6. unmatched_cpe - CPE lookup failed
7. conflict_vex - Conflicting VEX statements
8. native_code - Unanalyzed native component
9. generated_code - Generated code boundary
10. dynamic_dispatch - Runtime-resolved call
11. external_boundary - External service call

Scoring Dimensions:

1. Blast radius (dependents, network-facing, privilege)
2. Evidence scarcity
3. Exploit pressure (EPSS, KEV)
4. Containment signals
5. Time decay

Evidence:

• src/Scanner/__Libraries/StellaOps.Scanner.Unknowns/
• docs/technical/architecture/signal-contract-mapping.md (Signal-14 section)

10. CycloneDX Version

Advisory Requirement:

Use CycloneDX 1.7 as baseline SBOM envelope.

StellaOps Implementation: ✅ Using 1.7

Status: Upgraded from 1.6 to 1.7 in Sprint 3200 (November 2024). All scanner output now generates CycloneDX 1.7 by default, with backward compatibility for 1.6 ingestion.

Areas Where StellaOps Exceeds Advisory

1. More Predicate Types: 19 vs. advisory’s implied 5-8
2. Offline/Air-Gap Support: Full bundle-based operation
3. Regional Crypto: GOST, SM2/SM3, PQ-safe modes
4. Multi-Tenant: Enterprise-grade tenant isolation
5. BLAKE3 Hashing: Faster, more secure than SHA-256
6. Sigstore Rekor Integration: Transparency log support
7. Native Binary Analysis: PE/ELF/Mach-O identity extraction

Remaining Gaps

Conclusion

StellaOps demonstrates 100% alignment with the reference advisory architecture. All requirements are met, including CycloneDX 1.7 support.

Recommendation: Full production deployment approved. All advisory architecture requirements satisfied.

References

• CycloneDX Specification
• in-toto Attestation Framework
• FIRST.org EPSS
• OpenVEX Specification
• docs/technical/architecture/signal-contract-mapping.md
• docs-archive/technical/architecture/epss-versioning-clarification.md