RT003 · Observed capability absent from both registry and declarations
Traces show the agent exercising a capability the static scan never found and no declaration covers — its real reach exceeds everything on paper.
- Severity: high · Confidence: medium (a static-scan blind spot is
a plausible alternative explanation, and the finding says so).
- Gates: no (v1 shadow mode). Kind: runtime contradiction
(scanned+declared vs. observed) — the runtime analogue of DECL004. Emitted by: stoa runtime merge.
Detection
Fires per observed capability that is (a) in the scanner's own capability vocabulary and (b) absent from the agent's static capabilities. Custom capability ids recorded by the SDK are reported in the analysis document but never fire RT003 — an id the scanner couldn't have found can't be meaningfully compared to static reach. Data-class signals are out of scope under redact-by-default tracing (content is never recorded).
Evidence: trace_ref — the first span exercising the capability.
Example
{"kind": "tool_call", "span_id": "d1", "agent_id": "b02789752d1c",
"capability": "filesystem_write", "tool": "audit_log_writer"}…for an agent whose registry record lists no filesystem_write.
Fix
Locate the code path — it often lives in an unscanned dependency, a separate service, or a dynamically-loaded tool — and bring it under scan (widen the scanned tree) or under declaration. If the capability is intentional, the next scan of the widened tree makes this finding disappear on its own.
Suppress: stoa.toml → [runtime] suppress = ["RT003:<agent_id>"].