Runtime Facts (Signals / Zastava)

How runtime reachability observations are ingested, stamped, stored, and folded into reachability scoring.

Audience: Engineers integrating runtime collectors (Signals / Zastava) with the reachability pipeline, and reviewers tracing how runtime evidence affects scores and replay.

Runtime facts are observations that a symbol was actually exercised at runtime (a call hit, a loaded module, an open socket). Stella Ops ingests them through the Signals API, aggregates them per symbol, and feeds them into reachability scoring. Runtime confirmation raises the confidence attached to an existing path/verdict; it does not replace the static path-proof bucket or lower its risk weight. See the ReachGraph architecture for how runtime facts join static and framework graphs, and Deterministic Replay for how runtime traces are sealed for byte-for-byte reproduction.

Payload shapes

Structured (POST /signals/runtime-facts):
- subject (imageDigest | scanId | component+version)
- callgraphId (required)
- events[]: { symbolId, codeId?, purl?, buildId?, loaderBase?, processId?, processName?, socketAddress?, containerId?, evidenceUri?, hitCount, observedAt?, metadata{} }
Streaming NDJSON (POST /signals/runtime-facts/ndjson): one JSON object per line with the same fields; supports Content-Encoding: gzip; callgraphId provided via query/header metadata.

Provenance/metadata

Signals stamps:
- provenance.source (defaults to runtime unless provided in metadata)
- provenance.ingestedAt (ISO-8601 UTC)
- provenance.callgraphId
Runtime hits are aggregated per symbolId (summing hitCount) before persisting and feeding scoring.

Validation

symbolId required; events list must not be empty.
callgraphId required and must resolve to a stored callgraph/union bundle.
Subject must yield a non-empty subjectKey.
Empty runtime stream is rejected.

Storage and cache

Stored alongside reachability facts in PostgreSQL table reachability_facts.
Runtime hits cached in Valkey via reachability_cache:* entries; invalidated on ingest.

Interaction with scoring

Ingest triggers recompute: runtime hits added to prior facts’ hits, targets set to symbols observed, entryPoints taken from callgraph.
Reachability states include runtime evidence on the path. New scoring keeps the path/verdict bucket stable and applies the bounded RuntimeBonus to confidence. The legacy runtime key remains read compatibility for stored v0 facts only.
Unknowns registry stays separate; unknowns count still factors into fact score via pressure penalty.

Replay alignment

Runtime traces packaged under CAS namespace runtime_traces; referenced in replay manifest with namespace and analysisId to link to static graphs.

Determinism rules

Keep NDJSON ordering stable when generating bundles.
Use UTC timestamps; avoid environment-dependent metadata values.
No external network lookups during ingest.