Evidence-first signals for Linux and Kubernetes.

Capabilities

Runtime signals without application SDKs.

The current foundation captures process, network, DNS, HTTP/1, HTTP/2, extension-free WebSocket metadata, and gRPC-Web metadata at runtime, optionally discovers uniquely identifiable supported plaintext protocols on arbitrary TCP ports, correlation-matches Kafka and MongoDB, and matches MySQL, NATS, PostgreSQL, Redis, and gRPC requests to their responses for real latency and status, reads TLS plaintext at the userspace library boundary through OpenSSL, GnuTLS, and version-gated unstripped Linux/amd64 Go crypto/tls uprobes (interception, not on-the-wire decryption), accounts for TCP retransmits, resets, and state transitions, samples and symbolizes periodic CPU, scheduler off-CPU, and futex-wait lock profiles with bounded Alloy-compatible C++ demangling, with separately bounded opt-in kernel frames that retain user and interpreter frames, and turns resource, trace, peer-aware directional L4 bytes, and security observations into bounded native E-Navigator signals. A disabled-by-default plaintext HTTP/1 path can inject a child W3C traceparent, preserve valid inbound tracestate, and handle bounded exact Content-Length, or chunked framing only when every byte in the current syscall is captured, when complete headers fit one contiguous captured prefix. It length-accounts as many as 40 iovecs while capturing only the first three 96-byte prefixes. TLS, HTTP/2, HTTP/3, headers segmented across syscalls, multiple pipelined requests, pre-existing connections, and async continuation remain explicit non-claims. An optional capture filter scopes which workloads are probed by Kubernetes namespace and label on unified cgroup v2 nodes. Bounded inotify discovery wakes the controller for new cgroups, while a 2-second polling reconciliation remains as a recovery path. Five homelab runs per mode measured a 0.463 ms event-driven median versus 1,148.131 ms with polling for the scoped new-Pod exec workload. Legacy and hybrid layouts force deny before probe attachment instead of guessing a hierarchy. Supported kernels use BPF ring buffers with explicit producer-loss accounting; a separately built perf-event path remains for older kernels and strict diagnostics. BTF-capable kernels also use preflighted fexit hooks for scalar network read/write accounting, with syscall tracepoints retained as the strict compatibility path. An opt-in Linux 6.6 reduced-capability profile removes SYS_ADMIN, retaining only BPF, PERFMON, and SYS_PTRACE for the complete source set proven on the homelab.