RT004 · Monitoring declared for a production agent, but no traces observed
Observability is claimed, not evidenced.
- Severity: medium · Gates: no (v1 shadow mode).
- Kind: runtime contradiction (declared vs. observed absence).
Cadence: once per agent per analysis. Emitted by: stoa runtime merge.
Detection
Fires when all three hold:
1. the agent is declared production_status = "production"; 2. stoa-declared.toml declares monitoring evidence ([[evidence.monitoring]] pointers); 3. the analyzed trace window contains zero spans for this agent (it appears in the analysis document's no_runtime_evidence list).
The declaration side is cited (declared_ref → agents."<id>".production_status); the trace side is an explicit absence, so the message states the window and total span count instead of a trace_ref.
RT004 is deliberately the mirror image of DECL005: DECL005 says no observability construct was scanned; RT004 says the observability that was declared produced no observable evidence.
What this is not
Not a claim that the agent isn't running — "no spans observed" can mean the agent is idle, instrumented elsewhere, or not instrumented at all. That is exactly the gap the finding names: the claim is unevidenced, not false.
Fix
Instrument the agent with stoa.runtime (or widen the trace window under analysis), or correct the declaration.
Suppress: stoa.toml → [runtime] suppress = ["RT004:<agent_id>"].