Reachability Signals

Audience: Signals Guild, Policy authors consuming reachability evidence.

Scope: How the Signals module represents reachability state and keeps verified observations distinct from missing or unsupported collection.

Reachability signals tell the rest of Stella Ops whether a vulnerable symbol can actually be reached in a given build. Policy uses that state to decide whether a finding gates a release, so the evidence behind each state must be honest about what was — and was not — observed.

Runtime evidence truthfulness

Reachability state must distinguish verified observations from unavailable or unsupported collection. Static callgraph reachability, runtime facts, and replay evidence each retain separate provenance so downstream policy can explain why a target is observed, not_observed, unknown, or unsupported.

Synthetic runtime probes are local-harness fixtures only. They are useful for deterministic ingestion tests, but they are not release-policy evidence and are not exposed by production Signals hosts. See Runtime Facts for the full evidence boundary and the rules for batch ingestion.

Determinism checklist

Reachability artifacts must reproduce byte-for-byte across runs and across air-gapped sites. When adding examples, fixtures, or captures to this folder: