Risk OS Red Try Stoa

RT004 · Monitoring declared for a production agent, but no traces observed

Observability is claimed, not evidenced.

Cadence: once per agent per analysis. Emitted by: stoa runtime merge.

Detection

Fires when all three hold:

1. the agent is declared production_status = "production"; 2. stoa-declared.toml declares monitoring evidence ([[evidence.monitoring]] pointers); 3. the analyzed trace window contains zero spans for this agent (it appears in the analysis document's no_runtime_evidence list).

The declaration side is cited (declared_refagents."<id>".production_status); the trace side is an explicit absence, so the message states the window and total span count instead of a trace_ref.

RT004 is deliberately the mirror image of DECL005: DECL005 says no observability construct was scanned; RT004 says the observability that was declared produced no observable evidence.

What this is not

Not a claim that the agent isn't running — "no spans observed" can mean the agent is idle, instrumented elsewhere, or not instrumented at all. That is exactly the gap the finding names: the claim is unevidenced, not false.

Fix

Instrument the agent with stoa.runtime (or widen the trace window under analysis), or correct the declaration.

Suppress: stoa.toml → [runtime] suppress = ["RT004:<agent_id>"].