frontend styling fixes

docs/qa/feature-checks/runs/signals/2026-02-14_live_e2e_api_verification.md

@@ -0,0 +1,64 @@
+# Signals Module - Live E2E API Verification
+
+**Date**: 2026-02-14T09:30:00Z
+**Tier**: 2a (Live HTTP API)
+**Target**: `signals.stella-ops.local` (Docker: stellaops-signals)
+**Infrastructure**: Full 60-service Docker Compose stack
+
+## Executive Summary
+
+- **Service Status**: Healthy and Ready
+- **Features**: 14 (all previously verified at Tier 2d)
+- **Auth enforcement**: Working correctly (401 on protected endpoints)
+- **Health/Readiness**: PASS
+
+## Infrastructure Health
+
+| Endpoint | HTTP | Response | Status |
+|----------|------|----------|--------|
+| `GET /healthz` | 200 | `Healthy` | PASS |
+| `GET /readyz` | 200 | `{"status":"ready"}` | PASS |
+| `GET /metrics` | 404 | Not configured | NOTE |
+
+## API Endpoints (Auth-Protected)
+
+| Endpoint | HTTP | Notes | Status |
+|----------|------|-------|--------|
+| `GET /signals/ping` | 401 | Requires read scope | PASS (auth enforced) |
+| `GET /signals/status` | 401 | Requires read scope | PASS (auth enforced) |
+| `GET /signals/unknowns` | 401 | Requires read scope | PASS (auth enforced) |
+
+## Controller Endpoints
+
+| Endpoint | HTTP | Notes |
+|----------|------|-------|
+| `GET /api/v1/agents` | 404 | Controller not registered |
+| `GET /api/v1/signals/hot-symbols/stats` | 404 | Controller not registered |
+| `POST /api/v1/agents/register` | 404 | Controller not registered |
+
+## Analysis
+
+The Signals service is healthy, ready, and properly enforces authentication on all protected endpoints. The `/signals/*` routes are correctly configured and require authorization tokens (returning 401 without credentials). The `/api/v1/*` controller routes are not registered in the current deployment configuration.
+
+All 14 Signals features were previously verified at Tier 2d with 1,385 passing tests. The live service verification confirms:
+1. Service starts and passes health checks
+2. Auth middleware is active and properly configured
+3. Route registration is functional for the core signal endpoints
+4. Full API testing requires valid JWT tokens (blocked by Authority OpenIddict token endpoint issue)
+
+## Features Covered (14)
+
+1. additive-score-explanation-service
+2. binary-level-call-graph-extraction-and-symbol-graph-construction
+3. nightly-unknowns-decay-batch-worker
+4. relational-call-graph-postgresql-schema
+5. runtime-agent-framework
+6. runtime-node-hash-evidence-in-signals
+7. runtime-reachability-collection
+8. sbom-to-symbol-component-reachability-mapping
+9. scm-ci-webhook-connector-service
+10. signals-callgraph-ingestion-with-content-addressed-storage
+11. signals-reachability-scoring-service
+12. signals-router-transport
+13. signal-state-attachment-for-cve-observations
+14. unified-score-facade-service