Runtime Facts

Audience: Signals Guild, runtime-collector operators (Zastava Observer), offline-kit maintainers.

Scope: What counts as a real runtime fact, how batch ingestion is hashed and stored, and the fail-closed rules that keep placeholders out of release evidence.

Runtime facts record that a symbol was actually executed in a running workload. Because they can flip a vulnerability verdict from “present but unreachable” to “observed in production,” Signals treats them as high-trust evidence and refuses to synthesize them.

Evidence Boundary

Runtime facts are release-relevant only when they come from a real runtime collector such as Zastava Observer, a configured runtime agent, or an attested replay bundle. If collection is unavailable or unsupported, Signals records the state as unavailable or unknown. It must not convert a placeholder into an observed/reachable fact.

Batch runtime-facts ingestion is allowed to produce evidence references only after the raw NDJSON or gzip payload is hashed by the configured Stella Ops crypto hash provider and persisted by the runtime-facts artifact store. If either dependency is missing, or if the batch contains no valid runtime events, ingestion fails closed and no synthetic cas:// reference is returned.

The filesystem and RustFS storage drivers both support runtime-facts artifact storage. RustFS deployments configure Signals:Storage:Driver=rustfs, Signals:Storage:BucketName, Signals:Storage:RuntimeFactsRootPrefix, and Signals:Storage:RustFs:BaseUrl; if Signals:Storage:RustFs:ApiKeyHeader is set, Signals:Storage:RustFs:ApiKey must also be non-empty. RustFS object keys are deterministic and content-addressed: {RuntimeFactsRootPrefix}/{first2}/{blake3}/runtime-facts.ndjson[.gz]. Writes, reads, existence checks, and deletes verify the BLAKE3-256 digest and fail closed on missing, tampered, or partially configured storage.

The /signals/runtime-facts/synthetic probe endpoint is available only in explicit Development/Testing local harness mode. It generates deterministic fixture events from an existing callgraph so tests can exercise ingestion and persistence plumbing. Production hosts do not map the route.

Route isolation is only the first guard. RuntimeFactEvent and the persisted RuntimeFactDocument carry the structural origin value Observed or Synthetic; the synthetic builder sets it directly, and aggregation keys keep observed and synthetic records separate even when their symbol identity matches. The public ingest response reports observed and synthetic fact/hit counts separately, and AOC provenance exports carry evidenceOrigin. A synthetic record uses runtime.fixture.synthetic, has no observation confidence, and identifies static analysis as its capture method. Signals excludes synthetic facts from runtime.updated, reachability runtime hits and score bonuses, execution-evidence predicates, and the observed runtime-fact count in signals.fact.updated. Metadata such as probe=synthetic remains useful diagnostics but is not trusted as the evidence classification.

Determinism Checklist

Runtime-fact fixtures and captures must reproduce byte-for-byte. When adding examples to this folder:

• [ ] Hash any inbound assets or payloads and place the sums alongside the artifacts (for example, a SHA256SUMS file in this folder).
• [ ] Keep examples offline-friendly and deterministic — fixed seeds, pinned versions, stable ordering.
• [ ] Record the source and approver for any provided captures or schemas.

Related

• Reachability Signals — how runtime facts combine with static reachability to produce verdicts.
• Provenance Appendix Checklist (SIGNALS-24-003) — provenance fields attached to each runtime fact.
• signals.fact.updated Event Contract (SIGNALS-24-005) — event emitted when a runtime fact changes.
• Unknowns Ranking Algorithm Reference — runtime.updated events and how runtime observations drive rescans.