feat(runtime): ingest local telemetry evidence

[kunaldhongade]

Summary

• add bounded, repo-local ingestion for OTLP JSON traces and structured error exports
• redact secrets, authorization data, personal data, request bodies, and query strings before report assembly
• classify evidence by source revision, correlate operations with service topology, and produce cited investigation tasks
• expose the workflow through codedecay runtime with JSON and Markdown reports

Why

CodeDecay needs runtime evidence to show which production paths are exercised or failing without turning historical or sampled telemetry into false proof that the current tree is safe. This first slice is local-only, performs no network calls or project command execution, and keeps source references inspectable.

Validation

• pnpm run lint
• pnpm typecheck
• pnpm test (769 passed)
• pnpm build
• pnpm --filter @submuxhq/codedecay pack --dry-run
• packed npm install suite
• built CLI help, analyze, and no-provider runtime smoke tests

Remaining Issue Scope

This PR intentionally does not close the full issue. Provider adapter contracts, requirement and product-flow correlation, learning proposals, environment allowlists, and explicit live-provider query intent remain follow-up work.

Refs #685

[github-actions]

CodeDecay PR Check

Lead catch: No direct high-signal catch found

CodeDecay did not find a strong direct regression or weak-test signal in this run.

Risk: Medium · Merge 39/100 · Decay 54/100 · Security 0/100

This score is conservative pending stronger direct evidence. Treat structural-only signals as review guidance, not proof of a regression.

Full CodeDecay report

CodeDecay Report

Overall risk: Medium

Score	Value
Merge risk	39/100
Decay risk	54/100
Security risk	0/100

Findings	Count
High	3
Medium	8
Low	15

Changed Files

• packages/cli/src/commands/registry.ts modified (+5/-0)
• packages/cli/src/commands/runtime.ts added (+34/-0)
• packages/cli/src/docs/command-docs/analysis.ts modified (+21/-0)
• packages/cli/src/docs/command-docs/order.ts modified (+1/-1)
• packages/cli/src/parsers/args.ts modified (+1/-0)
• packages/cli/src/parsers/runtime.ts added (+46/-0)
• packages/cli/src/types/index.ts modified (+1/-0)
• packages/cli/src/types/runtime.ts added (+12/-0)
• packages/cli/test/runtime.test.ts added (+66/-0)
• packages/knowledge/src/index.ts modified (+11/-0)
• packages/knowledge/src/runtime/ingest.ts added (+299/-0)
• packages/knowledge/src/runtime/render.ts added (+26/-0)
• packages/knowledge/src/runtime/types.ts added (+73/-0)
• packages/knowledge/test/runtime-evidence.test.ts added (+106/-0)

Likely Impacted Areas

• Low Documentation (docs): packages/cli/src/docs/command-docs/analysis.ts, packages/cli/src/docs/command-docs/order.ts
• Low Source code (source): packages/cli/src/commands/registry.ts, packages/cli/src/commands/runtime.ts, packages/cli/src/parsers/args.ts, packages/cli/src/parsers/runtime.ts, packages/cli/src/types/index.ts, packages/cli/src/types/runtime.ts, packages/knowledge/src/index.ts, packages/knowledge/src/runtime/ingest.ts, packages/knowledge/src/runtime/render.ts, packages/knowledge/src/runtime/types.ts
• Low Tests (test): packages/cli/test/runtime.test.ts, packages/knowledge/test/runtime-evidence.test.ts

Normalized Impact Graph

Graph artifact: .codedecay/local/impact-graph.json (4217 node(s), 8594 edge(s))

• Confidence: Direct: 8594, inferred: 0, heuristic: 0
• codedecay-js-babel-symbols via @babel/parser (available, adapter 1.0.0)
  • Limitation: Call expressions are not connected to target symbols in this adapter version.
  • Limitation: Only JavaScript and TypeScript files parsed by @babel/parser are represented.
  • Limitation: Static import resolution does not resolve runtime dependency injection or dynamic imports.
• codedecay-python-lezer via @lezer/python (available, adapter 1.0.0)
  • Limitation: Dynamic imports, dependency injection, decorators without literal routes, and framework route registries are not resolved.
  • Limitation: Python impact evidence uses the @lezer/python grammar and conservative module-to-file resolution.
  • Limitation: Static test imports do not prove execution or assertion quality.
• Graph limitation: A static test import does not prove the symbol executed or that assertions cover its behavior.

Symbol Impact Evidence

Graph artifact: .codedecay/local/symbol-impact-graph.json (903 file(s), 5356 edge(s))

• packages/cli/src/commands/registry.ts#createCommandHandlers -> packages/cli/src/index.ts
• packages/cli/src/commands/runtime.ts#runRuntimeCommand -> packages/cli/src/commands/registry.ts
• packages/cli/src/docs/command-docs/analysis.ts#ANALYSIS_COMMAND_DOCS -> packages/cli/src/docs/commands.ts
• packages/cli/src/docs/command-docs/order.ts#COMMAND_ORDER -> packages/cli/src/commands/help.ts, packages/cli/src/docs/commands.ts
• packages/cli/src/parsers/args.ts#parseRuntimeArgs -> packages/cli/src/commands/runtime.ts
• packages/cli/src/parsers/runtime.ts#parseRuntimeArgs -> packages/cli/src/commands/runtime.ts, packages/cli/src/parsers/args.ts
• packages/cli/src/types/runtime.ts#RuntimeOptions -> packages/cli/src/commands/runtime.ts, packages/cli/src/parsers/runtime.ts, packages/cli/src/types.ts, packages/cli/src/types/index.ts
• packages/knowledge/src/index.ts#ingestRuntimeEvidence -> packages/cli/src/commands/runtime.ts, packages/knowledge/test/runtime-evidence.test.ts
  • Likely tests: packages/knowledge/test/runtime-evidence.test.ts
• packages/knowledge/src/index.ts#renderRuntimeEvidenceMarkdown -> packages/cli/src/commands/runtime.ts
• packages/knowledge/src/runtime/ingest.ts#ingestRuntimeEvidence -> packages/cli/src/commands/runtime.ts, packages/knowledge/src/index.ts, packages/knowledge/test/runtime-evidence.test.ts
  • Likely tests: packages/knowledge/test/runtime-evidence.test.ts
• packages/knowledge/src/runtime/ingest.ts#IngestRuntimeEvidenceOptions -> packages/knowledge/src/index.ts
• packages/knowledge/src/runtime/render.ts#renderRuntimeEvidenceMarkdown -> packages/cli/src/commands/runtime.ts, packages/knowledge/src/index.ts
• ...and 6 more symbol impact(s)

Language And Parser Coverage

• Source files classified: 14
• Fully supported parser files: 14
• Limited files: 0
• Unsupported files: 0

Merge Risk Breakdown

• Score: 39/100
• Raw score before dampeners: 70/100
• Adjusted score before severity cap: 54/100
• Highest contributing severity: Low
• Evidence mode: heuristic-only

Top contributors:

• +8 Change size (structural): Changed lines amplify review cost across 14 file(s).
• +6 File spread (structural): Change breadth spans 14 file(s).
• +4 Docs area changed (heuristic): packages/cli/src/docs/command-docs/analysis.ts touches a docs area and should be reviewed for regression impact.
• +4 Docs area changed (heuristic): packages/cli/src/docs/command-docs/order.ts touches a docs area and should be reviewed for regression impact.
• +4 Source area changed (heuristic): packages/cli/src/commands/registry.ts touches a source area and should be reviewed for regression impact.

Dampeners:

• -16 Heuristic-only dampener: Merge risk stays conservative until direct evidence exists.

Notes:

• Heuristic-only merge risk is capped at 54/100 until direct evidence exists.
• Untrusted memory context is visible but contributes 0 score until trusted evidence corroborates it.

Decay Risk Breakdown

• Score: 54/100
• Raw score before dampeners: 84/100
• Adjusted score before severity cap: 68/100
• Highest contributing severity: Medium
• Evidence mode: heuristic-only

Top contributors:

• +10 Broad unrelated change set (heuristic): This PR changes 12 files across 1 top-level areas and 2 risk categories.
• +10 Duplicated added logic (heuristic): A similar block of added logic appears 4 times across 1 file(s).
• +10 Duplicated added logic (heuristic): A similar block of added logic appears 3 times across 1 file(s).
• +10 Duplicated added logic (heuristic): A similar block of added logic appears 2 times across 2 file(s).
• +10 Duplicated added logic (heuristic): A similar block of added logic appears 2 times across 2 file(s).

Dampeners:

• -16 Heuristic-only dampener: Decay stays conservative until direct evidence exists.

Notes:

• Heuristic-only decay is capped at 54/100 until direct evidence exists.

Security Risk Breakdown

• Score: 0/100
• Raw score before dampeners: 0/100
• Adjusted score before severity cap: 0/100

Security Matcher Coverage

• Changed source files scanned: 12
• Security candidates found: 0
• Skipped files: 0

Test Evidence

• Mode: heuristic-only
• Sources: none
• Changed source coverage:
• packages/cli/src/commands/registry.ts: not measured (no measurable changed lines)
• packages/cli/src/commands/runtime.ts: not measured (no measurable changed lines)
• packages/cli/src/docs/command-docs/analysis.ts: not measured (no measurable changed lines)
• packages/cli/src/docs/command-docs/order.ts: not measured (no measurable changed lines)
• packages/cli/src/parsers/args.ts: not measured (no measurable changed lines)
• packages/cli/src/parsers/runtime.ts: not measured (no measurable changed lines)
• packages/cli/src/types/index.ts: not measured (no measurable changed lines)
• packages/cli/src/types/runtime.ts: not measured (no measurable changed lines)
• Notes:
• No runtime coverage artifact was found. Test audit remains heuristic-only.

Changed Path Test Proof

Status	Count
Runtime-proven	0
Static-only	6
Weakened by mocks	0
Unproven	13

• Unproven packages/cli/src/commands/registry.ts#createCommandHandlers (missing-proof, heuristic)
  • Evidence: No runtime coverage or static test reference was found for this changed path.
  • Repair task: Add an integration test that reaches packages/cli/src/commands/registry.ts#createCommandHandlers without mocking the changed boundary.
• Static-only packages/cli/src/commands/runtime.ts#runRuntimeCommand (static-reference, deterministic)
  • Evidence: Referenced by packages/cli/test/runtime.test.ts, packages/knowledge/test/runtime-evidence.test.ts, but no runtime coverage artifact proves changed lines executed.
  • Static references: packages/cli/test/runtime.test.ts, packages/knowledge/test/runtime-evidence.test.ts
  • Repair task: Strengthen packages/cli/test/runtime.test.ts so it executes packages/cli/src/commands/runtime.ts#runRuntimeCommand with assertions; static import alone is not proof.
• Unproven packages/cli/src/docs/command-docs/analysis.ts#ANALYSIS_COMMAND_DOCS (missing-proof, heuristic)
  • Evidence: No runtime coverage or static test reference was found for this changed path.
  • Repair task: Add an integration test that reaches packages/cli/src/docs/command-docs/analysis.ts#ANALYSIS_COMMAND_DOCS without mocking the changed boundary.
• Unproven packages/cli/src/docs/command-docs/order.ts#COMMAND_ORDER (missing-proof, heuristic)
  • Evidence: No runtime coverage or static test reference was found for this changed path.
  • Repair task: Add an integration test that reaches packages/cli/src/docs/command-docs/order.ts#COMMAND_ORDER without mocking the changed boundary.
• Static-only packages/cli/src/parsers/args.ts#parseRuntimeArgs (static-reference, deterministic)
  • Evidence: Referenced by packages/cli/test/runtime.test.ts, but no runtime coverage artifact proves changed lines executed.
  • Static references: packages/cli/test/runtime.test.ts
  • Repair task: Strengthen packages/cli/test/runtime.test.ts so it executes packages/cli/src/parsers/args.ts#parseRuntimeArgs with assertions; static import alone is not proof.
• Static-only packages/cli/src/parsers/runtime.ts#parseRuntimeArgs (static-reference, deterministic)
  • Evidence: Referenced by packages/cli/test/runtime.test.ts, packages/knowledge/test/runtime-evidence.test.ts, but no runtime coverage artifact proves changed lines executed.
  • Static references: packages/cli/test/runtime.test.ts, packages/knowledge/test/runtime-evidence.test.ts
  • Repair task: Strengthen packages/cli/test/runtime.test.ts so it executes packages/cli/src/parsers/runtime.ts#parseRuntimeArgs with assertions; static import alone is not proof.
• Unproven packages/cli/src/types/index.ts (missing-proof, heuristic)
  • Evidence: No runtime coverage or static test reference was found for this changed path.
  • Repair task: Add an integration test that reaches packages/cli/src/types/index.ts without mocking the changed boundary.
• Static-only packages/cli/src/types/runtime.ts#RuntimeOptions (static-reference, deterministic)
  • Evidence: Referenced by packages/cli/test/runtime.test.ts, packages/knowledge/test/runtime-evidence.test.ts, but no runtime coverage artifact proves changed lines executed.
  • Static references: packages/cli/test/runtime.test.ts, packages/knowledge/test/runtime-evidence.test.ts
  • Repair task: Strengthen packages/cli/test/runtime.test.ts so it executes packages/cli/src/types/runtime.ts#RuntimeOptions with assertions; static import alone is not proof.
• ...and 11 more changed path proof entries

Untrusted Memory Context

• Project invariant may be impacted (packages/cli/src/commands/registry.ts:22): Untrusted memory context: invariant "No hidden cloud or model call" applies to this change. The OSS CLI must remain useful without telemetry, API keys, hosted services, required LLM calls, or CodeDecayCloud.
• Project invariant may be impacted (packages/cli/src/commands/registry.ts:22): Untrusted memory context: invariant "Commands are explicit" applies to this change. CodeDecay must not run project commands unless they are configured and safety.allowCommands is true.
• Project invariant may be impacted (packages/cli/src/commands/registry.ts:22): Untrusted memory context: invariant "Tool evidence is separate from AI suggestions" applies to this change. Reports must not present agent/model suggestions as verified evidence unless backed by deterministic checks or command output.
• Project invariant may be impacted (packages/cli/src/commands/registry.ts:22): Untrusted memory context: invariant "Output must be actionable" applies to this change. Redteam reports and agent bundles should say what behavior to verify, which test proof is weak or missing, and what task a coding agent should perform.
• Architecture note applies (packages/cli/src/commands/registry.ts:22): Untrusted architecture context: CLI is the published surface: The public npm package is @submuxhq/codedecay and the binary is codedecay. Internal workspace packages are implementation details.

Medium Risk Findings

• Broad unrelated change set: This PR changes 12 files across 1 top-level areas and 2 risk categories.
• Duplicated added logic (packages/cli/src/docs/command-docs/analysis.ts:10): A similar block of added logic appears 4 times across 1 file(s).
• Duplicated added logic (packages/cli/src/parsers/runtime.ts:8): A similar block of added logic appears 3 times across 1 file(s).
• Duplicated added logic (packages/knowledge/src/runtime/ingest.ts:34): A similar block of added logic appears 2 times across 2 file(s).
• Duplicated added logic (packages/knowledge/src/runtime/ingest.ts:41): A similar block of added logic appears 2 times across 2 file(s).
• Duplicated added logic (packages/knowledge/src/runtime/ingest.ts:42): A similar block of added logic appears 2 times across 2 file(s).
• High complexity in changed function (packages/knowledge/src/runtime/ingest.ts:88): loadOtlp has estimated cyclomatic complexity 13.

Low Risk Findings

• Docs area changed (packages/cli/src/docs/command-docs/analysis.ts:4): packages/cli/src/docs/command-docs/analysis.ts touches a docs area and should be reviewed for regression impact.
• Docs area changed (packages/cli/src/docs/command-docs/order.ts:1): packages/cli/src/docs/command-docs/order.ts touches a docs area and should be reviewed for regression impact.
• Source area changed (packages/cli/src/commands/registry.ts:22): packages/cli/src/commands/registry.ts touches a source area and should be reviewed for regression impact.
• Source area changed (packages/cli/src/commands/runtime.ts:1): packages/cli/src/commands/runtime.ts touches a source area and should be reviewed for regression impact.
• Source area changed (packages/cli/src/parsers/args.ts:16): packages/cli/src/parsers/args.ts touches a source area and should be reviewed for regression impact.
• Source area changed (packages/cli/src/parsers/runtime.ts:1): packages/cli/src/parsers/runtime.ts touches a source area and should be reviewed for regression impact.
• Source area changed (packages/cli/src/types/index.ts:20): packages/cli/src/types/index.ts touches a source area and should be reviewed for regression impact.
• Source area changed (packages/cli/src/types/runtime.ts:1): packages/cli/src/types/runtime.ts touches a source area and should be reviewed for regression impact.
• Source area changed (packages/knowledge/src/index.ts:46): packages/knowledge/src/index.ts touches a source area and should be reviewed for regression impact.
• Source area changed (packages/knowledge/src/runtime/ingest.ts:1): packages/knowledge/src/runtime/ingest.ts touches a source area and should be reviewed for regression impact.
• Source area changed (packages/knowledge/src/runtime/render.ts:1): packages/knowledge/src/runtime/render.ts touches a source area and should be reviewed for regression impact.
• Source area changed (packages/knowledge/src/runtime/types.ts:1): packages/knowledge/src/runtime/types.ts touches a source area and should be reviewed for regression impact.
• Test area changed (packages/cli/test/runtime.test.ts:1): packages/cli/test/runtime.test.ts touches a test area and should be reviewed for regression impact.
• Test area changed (packages/knowledge/test/runtime-evidence.test.ts:1): packages/knowledge/test/runtime-evidence.test.ts touches a test area and should be reviewed for regression impact.

Recommended Checks

• Add an integration test that reaches packages/cli/src/commands/registry.ts#createCommandHandlers without mocking the changed boundary.
• Add an integration test that reaches packages/cli/src/docs/command-docs/analysis.ts#ANALYSIS_COMMAND_DOCS without mocking the changed boundary.
• Add an integration test that reaches packages/cli/src/docs/command-docs/order.ts#COMMAND_ORDER without mocking the changed boundary.
• Add an integration test that reaches packages/cli/src/types/index.ts without mocking the changed boundary.
• Add an integration test that reaches packages/knowledge/src/index.ts#renderRuntimeEvidenceMarkdown without mocking the changed boundary.
• Add an integration test that reaches packages/knowledge/src/runtime/ingest.ts#IngestRuntimeEvidenceOptions without mocking the changed boundary.
• Add an integration test that reaches packages/knowledge/src/runtime/render.ts#renderRuntimeEvidenceMarkdown without mocking the changed boundary.
• Add an integration test that reaches packages/knowledge/src/runtime/types.ts#RUNTIME_EVIDENCE_SCHEMA_VERSION without mocking the changed boundary.
• Add an integration test that reaches packages/knowledge/src/runtime/types.ts#RuntimeErrorEvidence without mocking the changed boundary.
• Add an integration test that reaches packages/knowledge/src/runtime/types.ts#RuntimeEvidenceReport without mocking the changed boundary.
• Add an integration test that reaches packages/knowledge/src/runtime/types.ts#RuntimeEvidenceSource without mocking the changed boundary.
• Add an integration test that reaches packages/knowledge/src/runtime/types.ts#RuntimeEvidenceTrust without mocking the changed boundary.

Notes

CodeDecay is deterministic and local-first. This report was generated without telemetry, API keys, LLMs, or model calls.

---

Found by CodeDecay - deterministic, local-first, no telemetry.