Vulnerability Explorer — conceptual model & determinism

The Vulnerability Explorer is the operator surface for reviewing and triaging vulnerability findings. In the console it lives at the UI route /security/vulnerabilities; its data and decisions are served by the Findings Ledger web service (which absorbed the former VulnExplorer API — see Findings Ledger).

This page is the conceptual guide referenced from the UI and VEX-Lens docs. For the step-by-step console walkthrough see UI_GUIDE.md; for API and CLI surfaces see the links below.

Triage model

Every finding carries a deterministic verdict plus the evidence that produced it. When you open a finding you review, in order:

1. Verdict + “why” summary — the gate decision and a plain-language explanation.
2. Effective VEX status and issuer provenance — the consensus VEX status and which issuer(s) contributed it (VEX-first decisioning). See VEX consensus & issuer trust.
3. Reachability / impact signals (when available) — reachability-aware prioritization that distinguishes “present” from “actually reachable”.
4. Policy explanation trace — the policy rules and the specific gate that produced the verdict.
5. Triage action — assign / comment / ack / mute / request exception, each recorded with a justification.
6. Evidence bundle export — for escalation or offline verification.

Determinism requirements

The Explorer is built on the Findings Ledger, an append-only, Merkle-anchored event store, so its outputs are reproducible and auditable:

• Deterministic replay — finding state at any point in time can be reconstructed by replaying the ledger events; the same inputs always yield the same verdict.
• Tamper-evident history — event chains are Merkle-linked; every state change records actor metadata and cryptographic hashes.
• Tenant isolation — findings and events are partitioned per tenant; cross-tenant reads are forbidden.
• Deterministic upstream inputs — SBOMs feeding the Explorer follow the SBOM determinism guide.

See the Findings Ledger architecture for the event model, projections, and anchoring policy.

Related interfaces

• CLI — Vulnerability Explorer CLI guide.
• API — VulnExplorer triage API (/v1/vulns, /v1/vex-decisions, /v1/evidence-subgraph, /v1/fix-verifications, /v1/audit-bundles), now served by the Findings Ledger web service.