[karthickmk2001]

Closes #57

Stacked on #88 (#53). It reads the runtime tables #88 adds, so this branch contains #88's commit. Merge #88 first; this diff then shrinks to the dashboard commit only. It doesn't need #89.

What does this change, and why?

Shows #53's runtime evidence next to the static reachability verdict, as #57 describes.

Demo data from a throwaway store. pyyaml was rated Not reachable but was reached on POST /upload, so the row is highlighted. jinja2 ran at startup (Executed). requests is loaded at 2.31.0 while 2.19.0 was scanned (version drift).

States. Each (project, finding) gets one state, strongest first (src/secfoo/web/sca_runtime.py):

State	Shown as
Reached from traffic	Reached · POST /upload (anonymous) · 312: a hit on a request route
Executed	Executed · 13 hits · last 2026-11-08: hits on startup / job:* / unknown / no route
Loaded	Loaded · no watched call, plus · version drift when the loaded version isn't the scanned one (#68)
Not loaded	Sessions recorded an inventory without this package: Not loaded · 74% coverage · 6h
Not observed	Sessions without inventory: Not observed · 74% coverage · 6h
No runtime data	No sessions for the project

"Not observed" and "Not loaded" always carry the coverage % and observation window (#51 rule 4). The detail page also says outright that it isn't proof of unreachability.

Where it shows:

• Vulnerabilities list (sca_vulnerabilities_list.html): a new Runtime column with the strongest state across affected projects.
• Priority hint: a static Not reachable that was Executed or Reached gets a highlighted row and a "Conflicts with static verdict" badge.
• Vulnerability detail (sca_vulnerability_detail.html): per project, the state, source (sensor / coverage), and a hits table (symbol, route, auth, hits, last seen, app/env, entry frame, stack sample). Loaded versions and drift are shown too. A conflict gets an alert at the top.
• Overview (sca_dashboard.html): a Runtime-confirmed reachable card, split into reached from traffic and executed, plus the conflict count. It renders only once a project has runtime data, so with no sensor the page is unchanged (Tracking: Runtime reachability for SCA (in-app probe + live sensor) #51 rule 0).

Styling: existing badge classes only (badge--error/warning/primary/teal/neutral). The conflict row uses the existing --color-error / --color-error-bg tokens, with no new colors.

Joining evidence to rows: the dashboard is built from report text, so each Risk Register row gets its persisted sca_findings.fingerprint via the existing findings_with_fingerprints(). That's the key runtime hits attach to.

Out of scope here: the "via E1 (B1)" threat-model entry-point annotation, which needs #70.

Testing

• pytest tests passes. 1066 passed locally. The only failures are the 4 existing Windows-only POSIX permission and symlink tests that fail on main too; Linux CI is unaffected.
• ruff check . adds no new findings.
• Added tests/test_web/test_sca_runtime.py (16 tests). Data goes in through Runtime evidence format, storage and secfoo runtime ingest #53's real ingest_events. They cover:
  • every runtime state
  • the strongest state across projects
  • the conflict highlight: on for Not reachable plus a request route or startup; off for Reachable plus ran, and for Not reachable plus only loaded
  • the rendered list, detail and overview pages
  • the overview card staying hidden without runtime data

The existing SCA dashboard and route tests still pass unchanged.

🤖 Generated with Claude Code

[github-actions]

Leaderboard update

• Closed Runtime evidence in the SCA dashboard #57 (difficulty: medium): +6 points

karthickmk2001 now has 19 points (rank #1). 6 more to reach Bronze.

Full leaderboard