Evidence-first signals for Linux and Kubernetes.

Capabilities

Runtime signals without application SDKs.

The current foundation captures process, network, DNS, HTTP/1, HTTP/2, extension-free WebSocket metadata, and gRPC-Web metadata at runtime, reassembles and matches Kafka, MongoDB, MySQL, NATS, PostgreSQL, Redis, and gRPC requests to their responses for real latency and status, reads TLS plaintext at the userspace library boundary through OpenSSL, GnuTLS, and version-gated unstripped Linux/amd64 Go crypto/tls uprobes (interception, not on-the-wire decryption), accounts for TCP retransmits, resets, and state transitions, samples and symbolizes periodic CPU, scheduler off-CPU, and futex-wait lock profiles, and turns resource, trace, peer-aware directional L4 bytes, and security observations into bounded native E-Navigator signals. A disabled-by-default plaintext HTTP/1 path can inject W3C context for a strict, qualified subset; TLS, HTTP/2, HTTP/3, segmented writes, and async continuation remain explicit non-claims. An optional capture filter scopes which workloads are probed by Kubernetes namespace and label on unified cgroup v2 nodes. Bounded inotify discovery wakes the controller for new cgroups, while a 2-second polling reconciliation remains as a recovery path. Five homelab runs per mode measured a 0.463 ms event-driven median versus 1,148.131 ms with polling for the scoped new-Pod exec workload. Legacy and hybrid layouts force deny before probe attachment instead of guessing a hierarchy. Supported kernels use BPF ring buffers with explicit producer-loss accounting; a separately built perf-event path remains for older kernels and strict diagnostics. BTF-capable kernels also use preflighted fexit hooks for scalar network read/write accounting, with syscall tracepoints retained as the strict compatibility path. An opt-in Linux 6.6 reduced-capability profile removes SYS_ADMIN, retaining only BPF, PERFMON, and SYS_PTRACE for the complete source set proven on the homelab.