Features
What Stella Ops does
Stella Ops promotes container releases with evidence: which vulnerabilities can actually execute, why each release was approved, and proof that can be re-checked later — on Docker Compose and plain hosts, connected or air-gapped.
v1.0-RC1, release candidate. Tiers never gate features — every capability in the release is available in every tier; limits are environments and scan volume.
The baseline
Deployment and vulnerability scanning are built in: releases go to Docker Compose, Swarm, and SSH/WinRM hosts; every image gets an SBOM, advisory matching, and policy gates. Every serious tool covers this ground. What follows is what the baseline alone cannot do.
Proven-reachable risk blocks the release — unproven risk stays visible
Reachability separates vulnerabilities that can execute from vulnerabilities that merely exist in the image. Each graph is signed, so the proof travels with the finding instead of staying inside the tool. ReachabilityAnalysis that proves whether vulnerable code is actually called by your application — filtering out false positives from scanner noise
- → Three evidence layers: static call graph, binary symbol presence, runtime observation
- → Static call-graph support: compiler-grade for Go, Java and .NET; from source text for Python, JavaScript, TypeScript, Rust, PHP and Ruby
- → Graphs sealed with DSSE — the exact call path, signed, not asserted
Every decision carries proof you can re-run
Every verdict is computed deterministically from frozen inputs — feed snapshots, analyzer versions, policy rules — and sealed in a DSSE envelope signed with a key that never leaves your installation. Verification runs against a trust root you configure, and fails closed without one. Re-run it months later: the output matches, or the assertion fails loudly. DSSEDead Simple Signing Envelope - a simple, flexible standard for signing arbitrary data with cryptographic signatures Decision CapsuleA signed, exportable evidence bundle that seals every input and output of a release decision for offline audit and deterministic replay
- → Frozen inputs: feed snapshots with Merkle roots, analyzer versions, and the policy hash
- → DSSE envelopes over inputs, evidence, and outputs — one content-addressed capsule per decision
- → Replay is a verification step with a pass or fail result, not a screenshot of an old report
$ stella replay verify --manifest run-manifest.json
The command replays the run manifest twice and compares the verdict digests. Identical results exit 0; any difference is listed and the command fails.
Commands as shown in the product console (v1.0-RC1).
And when evidence is absent, the verdict says so: unknowns are recorded as open states with review windows — never papered over. How unknowns are tracked →
Everything works with the network unplugged
Offline is not a degraded mode. Sealed knowledge snapshots — advisory feeds, policy, trust material, with Merkle roots — cross the boundary as one bundle, and every verdict records which snapshot it reasoned from, so an air-gapped decision replays identically outside the gap.
- → Offline Update Kit: feeds, revocation lists, and a local transparency mirror
- → Verdicts cite their snapshot, so what was known at decision time has an exact answer
- → Regional cryptography ships as selectable profiles — FIPS, GOST, SM, eIDAS — so signatures match the jurisdiction that must accept them.
Sovereign and offline operation → · Availability and sanctions notice →
Also in the product
Each of these is a capability in its own right. One line here; the full story is one click away.
Estate watch → The digest running on every host is compared with the digest a signed decision approved; drift is surfaced, never quietly reconciled.
VEX decisioning → Claims from many issuers are weighed with provenance kept; disagreement is recorded as a conflict, not suppressed.
Smart-Diff → Between two releases, review time goes to what changed in meaning, not to re-counting findings.
Unknowns tracking → Missing evidence is scored into HOT, WARM and COLD bands with review windows until it is resolved.
Compliance packs → Custody evidence mapped to NIS2, DORA and CRA obligations — evidence collection only, with known gaps labeled.
Digest-first identity → A release is an immutable set of OCI digests; a mismatch at pull time fails the deployment.
Deployment strategies → Canary, rolling and blue-green, agent-based or agentless, with rollback to known-good digests.
Integrations → Connectors are pluggable; the evidence chain is stable — swapping one never changes what a capsule proves.
Operations → One release model across heterogeneous targets, with offline-capable routines and control kept in your environment.
What you can validate in 30 minutes
Install
Docker Compose deployment
Scan
SBOM plus reachability
Gate
Policy verdict on the digest
Export
Signed Decision Capsule
Free tier: 3 environments and up to 100 new-digest scans per rolling 24 h, every capability included.
Run your first digest through Stella
Run one digest through scan, gate, promotion, and replay; measure reachable-CVE reduction, replay match, and audit packet generation time.