[karthickmk2001]

Closes #53

What does this change, and why?

The shared contract for runtime evidence that #54 (coverage import), #55/#56 (Python and Node probes), #57 (SCA dashboard) and the live sensor (#66/#67) all build on. It follows the format in the issue exactly, so those can start in parallel.

Event format. NDJSON with session, load and hit lines, using the fields and enums from the issue. There's a JSON Schema in src/secfoo/runtime/evidence.schema.json, and the full field table is in docs/REFERENCE.md → Runtime evidence.

Storage. schema.sql gains runtime_sessions, runtime_evidence and runtime_packages:

• runtime_evidence has a foreign key to sca_findings on (project, fingerprint), with one row per session, finding, symbol and route.
• runtime_packages holds the loaded inventory per session.
• They're CREATE TABLE IF NOT EXISTS, so existing stores get them on the next open. A test drops them from an existing DB and reopens it.

secfoo runtime ingest events.ndjson --project <id|name|path>. Validation and the idempotent upsert live in one module, secfoo/runtime/evidence.py (ingest_events(conn, project_id, lines)), so the live API in #66 can reuse it as asked. The CLI prints what was stored and lists each skipped line with its number. It exits 1 if anything was skipped, so CI notices.

• Malformed line: skipped and reported with its line number and the field at fault. The rest of the file is still stored.
• Unknown fingerprint: a hit for a fingerprint that isn't one of the project's SCA findings is skipped with a warning.
• Re-ingesting the same file doesn't double-count. Sessions are keyed by the producer's id, hits by (session, fingerprint, symbol, route). A hit's count is the session's running total, so a re-ingest or a later flush of the same session replaces the value instead of summing. first_seen/last_seen keep the earliest and latest. A later file may add hits to a session stored earlier.

Privacy, per #51 rule 3:

• Only the documented fields are stored. Unknown fields such as args or request_body are dropped before the database, and a test checks this.
• A route with a scheme, query string or fragment is rejected as a concrete URL.
• entry_frame and stack_sample must be file:line frames, at most 50.

Two decisions for reviewers:

• count is replace-on-reingest, not additive. Additive would double-count a re-ingested file, which the issue rules out. Probes should therefore send running totals per session.
• Hits with no request context store route as ''. That keeps the uniqueness key working, since SQLite treats NULLs as distinct.

Testing

• pytest tests passes. 1050 passed locally. The only failures are the 4 existing Windows-only POSIX permission and symlink tests that fail on main too; Linux CI is unaffected.
• ruff check . adds no new findings (the new files are clean; changed files match main's count).
• Added tests/test_runtime/test_evidence.py (29 tests):
  • a valid file, and minimal optional fields
  • malformed lines skipped and reported while the rest is stored
  • unknown fingerprint, unknown session, and another project's findings
  • re-ingest without double-counting, a later flush, and one row per route
  • privacy rejections and dropped unknown fields
  • per-field error messages
  • the JSON Schema agreeing with the validator
  • the migration on an existing DB
  • the CLI exit codes and output

🤖 Generated with Claude Code

[github-actions]

Leaderboard update

• Closed Runtime evidence format, storage and secfoo runtime ingest #53 (difficulty: hard): +10 points

karthickmk2001 now has 19 points (rank #1). 6 more to reach Bronze.

Full leaderboard