StellaOps Release Notes — Findings Ledger Runtime Instrumentation

Module: Findings Ledger Sprint set: SPRINT_20260429_011..015_FindingsLedger_runtime_* Date: 2026-04-28

Overview

Findings Ledger now exposes runtime instrumentation endpoints. Operators can ingest eBPF / syscall / APM trace observations correlated to findings, read a per-finding runtime trustworthiness score (0…100), list per-function aggregates, and walk a chronological event timeline.

Runtime instrumentation is disabled by default on new and upgraded deployments. Operators opt in by toggling findings:ledger:runtime:enabled = true. While disabled, ingest endpoints return 202 Accepted (no-op), and reads return 404 NotFound — mirroring the “no data yet” wire shape so client logic is uniform.

What’s new

Endpoint	Description
`POST /api/v1/findings/{id}/runtime/traces`	Ingest a runtime trace observation
`GET /api/v1/findings/{id}/runtime/traces`	List per-function aggregates
`GET /api/v1/findings/{id}/runtime/score`	Read the current runtime score (with breakdown)
`GET /api/v1/findings/{id}/runtime-timeline`	Read chronological events in `[from, to]`

CLI bindings ship under stellaops findings runtime:

stellaops findings runtime traces ingest --finding-id <guid> --trace-file <path>
stellaops findings runtime traces list   --finding-id <guid> [--limit] [--sort-by]
stellaops findings runtime score get     --finding-id <guid>
stellaops findings runtime timeline range --finding-id <guid> [--from] [--to]

A C# SDK sample lives at docs/samples/findings-runtime-sdk/.

Configuration

Key	Default	Description
`findings:ledger:runtime:enabled`	`false`	Master toggle for runtime instrumentation

When the toggle is false, the WebService binds null-pattern repository implementations — no rows are written to findings.runtime_* tables and all read endpoints return 404 NotFound. See ADR-013 Findings Runtime Disabled Mode.

Migration

No operator action is required for upgrade. Schema changes apply automatically on first startup via AddStartupMigrations per CODE_OF_CONDUCT §2.7. Specifically, two SQL migrations land:

011_runtime_traces.sql — findings.runtime_traces and findings.runtime_trace_aggregates.
012_runtime_scores_timeline.sql — findings.runtime_scores and findings.runtime_timeline_events.

Existing deployments that upgrade to this build will get the empty tables created on first restart, but no data will be ingested or surfaced until findings:ledger:runtime:enabled is flipped to true.

Privacy posture

Runtime symbols carry per-process address tokens (@0x[hex]+) that we strip before any persistence path executes. The aggregator’s bucket key is the redacted symbol, so traces from differently-ASLR’d processes collapse into a single aggregate. Per-process address tokens are never written to disk.

Full per-field redaction rules and rationale: ADR-015 Findings Runtime Privacy Filter.

Documentation

Document	Topic
Architecture overview	High-level pipeline, data model, components
API reference	Per-endpoint reference with curl samples
Algorithms	Privacy filter, aggregator, score formula
Enable guide	1-page operator how-to
CLI reference	`stellaops findings runtime` subcommands
UI requirements	Web console integration spec (draft)
ADR-014 Findings Runtime Persistence	3-table schema rationale
ADR-015 Findings Runtime Privacy Filter	Redaction contract
ADR-016 Findings Runtime Score Formula	Four-component weighted score formula
ADR-013 Findings Runtime Disabled Mode	Null-pattern + 202/404 contract

Known limitations

The aggregate query is bounded at limit=200. Findings with > 200 distinct vulnerable functions need to use sortBy=hits to see the hottest paths — UI pagination beyond the first page is deferred to the future FE sprint.
Score recompute happens in-line on each ingest. For very high trace-rate findings this adds ~5-10 ms per ingest; an off-line recompute path may land in a follow-up sprint if needed.

Compatibility

No breaking changes to existing Findings Ledger endpoints.
The new endpoints add to the existing /api/v1/findings/{id}/... namespace; clients that don’t consume them are unaffected.
Authority scopes added: findings.runtime.read, findings.runtime.write. These are granted explicitly — the bootstrap admin role already includes them in fresh installs (see Authority bootstrap script).