Runtime Facts

Audience: Signals Guild, runtime-collector operators (Zastava Observer), offline-kit maintainers.

Scope: What counts as a real runtime fact, how batch ingestion is hashed and stored, and the fail-closed rules that keep placeholders out of release evidence.

Runtime facts record that a symbol was actually executed in a running workload. Because they can flip a vulnerability verdict from “present but unreachable” to “observed in production,” Signals treats them as high-trust evidence and refuses to synthesize them.

Evidence Boundary

Runtime facts are release-relevant only when they come from a real runtime collector such as Zastava Observer, a configured runtime agent, or an attested replay bundle. If collection is unavailable or unsupported, Signals records the state as unavailable or unknown. It must not convert a placeholder into an observed/reachable fact.

Batch runtime-facts ingestion is allowed to produce evidence references only after the raw NDJSON or gzip payload is hashed by the configured Stella Ops crypto hash provider and persisted by the runtime-facts artifact store. If either dependency is missing, or if the batch contains no valid runtime events, ingestion fails closed and no synthetic cas:// reference is returned.

The filesystem and RustFS storage drivers both support runtime-facts artifact storage. RustFS deployments configure Signals:Storage:Driver=rustfs, Signals:Storage:BucketName, Signals:Storage:RuntimeFactsRootPrefix, and Signals:Storage:RustFs:BaseUrl; if Signals:Storage:RustFs:ApiKeyHeader is set, Signals:Storage:RustFs:ApiKey must also be non-empty. RustFS object keys are deterministic and content-addressed: {RuntimeFactsRootPrefix}/{first2}/{blake3}/runtime-facts.ndjson[.gz]. Writes, reads, existence checks, and deletes verify the BLAKE3-256 digest and fail closed on missing, tampered, or partially configured storage.

The /signals/runtime-facts/synthetic probe endpoint is available only in explicit Development/Testing local harness mode. It generates deterministic fixture events from an existing callgraph so tests can exercise ingestion and scoring plumbing. Production hosts do not map the route, and synthetic probe output is not verified runtime evidence for release policy, VEX, or audit decisions.

Determinism Checklist

Runtime-fact fixtures and captures must reproduce byte-for-byte. When adding examples to this folder:

• [ ] Hash any inbound assets or payloads and place the sums alongside the artifacts (for example, a SHA256SUMS file in this folder).
• [ ] Keep examples offline-friendly and deterministic — fixed seeds, pinned versions, stable ordering.
• [ ] Record the source and approver for any provided captures or schemas.

Related

• Reachability Signals — how runtime facts combine with static reachability to produce verdicts.
• Provenance Appendix Checklist (SIGNALS-24-003) — provenance fields attached to each runtime fact.
• signals.fact.updated Event Contract (SIGNALS-24-005) — event emitted when a runtime fact changes.
• Unknowns Ranking Algorithm Reference — runtime.updated events and how runtime observations drive rescans.