VEX Consensus and Issuer Trust

Source-verified against commit 2021a48f6e (2026-10-05). Re-verify the named source contracts before applying this description to an installation. Re-verify: git show HEAD:src/Vulnerabilities/__Libraries/StellaOps.Vulnerabilities.Consensus/ConsensusEvaluator.cs.

Stella Ops evaluates live statements for one vulnerability and one versionless product key. The Vulnerabilities hub owns statements and provenance. Policy owns the tenant’s effective gate projection. Findings owns operator decisions and displays Policy’s projected status.

Consensus and tenant decisions

The shared ConsensusEvaluator selects the highest-ranked issuer tier, then uses status precedence inside that tier. Conflicting statements remain visible through contested. No statements means under_investigation, never an implicit clearance.

Scanner, Policy and stella vex explain use the shared evaluator. Scanner first scopes distro statements to the scanned image’s release. Policy adds tenant overlays from Findings. A supported component decision changes the tenant’s status through the retained overlay feed; its validity window and withdrawal are enforced by the projection.

Operations

Use the VEX Consensus Operations Runbook for issuer tiers, signed OpenVEX admission, consumer configuration and routine checks. Use the troubleshooting guide to compare hub statements with Policy’s tenant answer.

Decision-overlay contract defines the Findings-to-Policy feed. VEX decision hashes explains the evidence boundary.

The earlier design is frozen history. It does not describe the current runtime.