up

src/__Libraries/StellaOps.Infrastructure.Postgres/Migrations/MigrationRunner.cs

@@ -185,6 +185,8 @@ public sealed class MigrationRunner : IMigrationRunner
         await using var connection = new NpgsqlConnection(_connectionString);
         await connection.OpenAsync(cancellationToken).ConfigureAwait(false);
 
+        await EnsureSchemaAsync(connection, cancellationToken).ConfigureAwait(false);
+        await SetSearchPathAsync(connection, cancellationToken).ConfigureAwait(false);
         // Coordination: advisory lock to avoid concurrent runners
         var lockKey = ComputeLockKey(SchemaName);
         var lockAcquired = await TryAcquireLockAsync(connection, lockKey, cancellationToken).ConfigureAwait(false);
@@ -197,7 +199,6 @@ public sealed class MigrationRunner : IMigrationRunner
 
         try
         {
-            await EnsureSchemaAsync(connection, cancellationToken).ConfigureAwait(false);
             await EnsureMigrationsTableAsync(connection, cancellationToken).ConfigureAwait(false);
 
             var applied = await GetAppliedMigrationsAsync(connection, cancellationToken).ConfigureAwait(false);
@@ -317,12 +318,27 @@ public sealed class MigrationRunner : IMigrationRunner
 
     private async Task EnsureSchemaAsync(NpgsqlConnection connection, CancellationToken cancellationToken)
     {
+        var schemaName = QuoteIdentifier(SchemaName);
+
         await using var command = new NpgsqlCommand(
-            $"CREATE SCHEMA IF NOT EXISTS {SchemaName};",
+            $"CREATE SCHEMA IF NOT EXISTS {schemaName};",
             connection);
         await command.ExecuteNonQueryAsync(cancellationToken).ConfigureAwait(false);
     }
 
+    private async Task SetSearchPathAsync(NpgsqlConnection connection, CancellationToken cancellationToken)
+    {
+        var quotedSchema = QuoteIdentifier(SchemaName);
+        await using var command = new NpgsqlCommand($"SET search_path TO {quotedSchema}, public;", connection);
+        await command.ExecuteNonQueryAsync(cancellationToken).ConfigureAwait(false);
+    }
+
+    private static string QuoteIdentifier(string identifier)
+    {
+        var escaped = identifier.Replace("\"", "\"\"", StringComparison.Ordinal);
+        return $"\"{escaped}\"";
+    }
+
     private async Task EnsureMigrationsTableAsync(NpgsqlConnection connection, CancellationToken cancellationToken)
     {
         await using var command = new NpgsqlCommand(

src/__Libraries/StellaOps.Infrastructure.Postgres/Testing/PostgresFixture.cs

@@ -92,7 +92,12 @@ public sealed class PostgresFixture : IAsyncDisposable
             moduleName,
             _logger);
 
-        await runner.RunAsync(migrationsPath, cancellationToken).ConfigureAwait(false);
+        var result = await runner.RunAsync(
+                migrationsPath,
+                options: null,
+                cancellationToken: cancellationToken)
+            .ConfigureAwait(false);
+        EnsureSuccess(result, moduleName);
     }
 
     /// <summary>
@@ -114,7 +119,12 @@ public sealed class PostgresFixture : IAsyncDisposable
             moduleName,
             _logger);
 
-        await runner.RunFromAssemblyAsync(assembly, resourcePrefix, cancellationToken).ConfigureAwait(false);
+        var result = await runner.RunFromAssemblyAsync(
+            assembly,
+            resourcePrefix,
+            options: null,
+            cancellationToken: cancellationToken).ConfigureAwait(false);
+        EnsureSuccess(result, moduleName);
     }
 
     /// <summary>
@@ -203,6 +213,20 @@ public sealed class PostgresFixture : IAsyncDisposable
             _logger.LogWarning(ex, "Failed to drop test schema: {Schema}", _schemaName);
         }
     }
+
+    private static void EnsureSuccess(MigrationResult result, string moduleName)
+    {
+        if (result.Success)
+        {
+            return;
+        }
+
+        var details = result.ChecksumErrors.Count > 0
+            ? $"{result.ErrorMessage ?? "Migration failure"} | checksum errors: {string.Join("; ", result.ChecksumErrors)}"
+            : result.ErrorMessage ?? "Migration failure";
+
+        throw new InvalidOperationException($"Failed to run migrations for {moduleName}: {details}");
+    }
 }
 
 /// <summary>

src/__Libraries/StellaOps.Replay.Core/ReachabilityReplayWriter.cs

@@ -0,0 +1,89 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+
+namespace StellaOps.Replay.Core;
+
+/// <summary>
+/// Builds deterministic replay manifests with CAS-registered graph/trace references.
+/// </summary>
+public static class ReachabilityReplayWriter
+{
+    public static ReplayManifest BuildManifestV2(
+        ReplayScanMetadata scan,
+        IEnumerable<ReplayReachabilityGraphReference> graphs,
+        IEnumerable<ReplayReachabilityTraceReference> traces,
+        string? analysisId = null)
+    {
+        ArgumentNullException.ThrowIfNull(scan);
+        ArgumentNullException.ThrowIfNull(graphs);
+        ArgumentNullException.ThrowIfNull(traces);
+
+        var graphList = graphs
+            .Select(g => NormalizeGraph(g))
+            .OrderBy(g => g.CasUri, StringComparer.Ordinal)
+            .ThenBy(g => g.Sha256, StringComparer.Ordinal)
+            .ToList();
+
+        if (graphList.Count == 0)
+        {
+            throw new InvalidOperationException("At least one reachability graph reference is required.");
+        }
+
+        var traceList = traces
+            .Select(t => NormalizeTrace(t))
+            .OrderBy(t => t.CasUri, StringComparer.Ordinal)
+            .ThenBy(t => t.Sha256, StringComparer.Ordinal)
+            .ToList();
+
+        var manifest = new ReplayManifest
+        {
+            SchemaVersion = ReplayManifestVersions.V2,
+            Scan = scan,
+            Reachability = new ReplayReachabilitySection
+            {
+                AnalysisId = analysisId,
+                Graphs = graphList,
+                RuntimeTraces = traceList
+            }
+        };
+
+        return manifest;
+    }
+
+    private static ReplayReachabilityGraphReference NormalizeGraph(ReplayReachabilityGraphReference graph)
+    {
+        if (string.IsNullOrWhiteSpace(graph.CasUri))
+        {
+            throw new InvalidOperationException("Graph casUri is required.");
+        }
+
+        if (string.IsNullOrWhiteSpace(graph.Sha256))
+        {
+            throw new InvalidOperationException("Graph sha256 is required.");
+        }
+
+        graph.HashAlgorithm = string.IsNullOrWhiteSpace(graph.HashAlgorithm) ? "blake3-256" : graph.HashAlgorithm;
+        graph.Kind = string.IsNullOrWhiteSpace(graph.Kind) ? "static" : graph.Kind;
+        graph.Namespace = string.IsNullOrWhiteSpace(graph.Namespace) ? "reachability_graphs" : graph.Namespace;
+        return graph;
+    }
+
+    private static ReplayReachabilityTraceReference NormalizeTrace(ReplayReachabilityTraceReference trace)
+    {
+        if (string.IsNullOrWhiteSpace(trace.CasUri))
+        {
+            throw new InvalidOperationException("Trace casUri is required.");
+        }
+
+        if (string.IsNullOrWhiteSpace(trace.Sha256))
+        {
+            throw new InvalidOperationException("Trace sha256 is required.");
+        }
+
+        trace.HashAlgorithm = string.IsNullOrWhiteSpace(trace.HashAlgorithm) ? "sha256" : trace.HashAlgorithm;
+        trace.Namespace = string.IsNullOrWhiteSpace(trace.Namespace) ? "runtime_traces" : trace.Namespace;
+        trace.Source = string.IsNullOrWhiteSpace(trace.Source) ? "runtime" : trace.Source;
+        return trace;
+    }
+}

src/__Libraries/StellaOps.Replay.Core/ReplayManifest.cs

@@ -60,6 +60,9 @@ public sealed class ReplayReachabilityGraphReference
     [JsonPropertyName("sha256")]
     public string Sha256 { get; set; } = string.Empty;
 
+    [JsonPropertyName("hashAlg")]
+    public string HashAlgorithm { get; set; } = "sha256";
+
     [JsonPropertyName("namespace")]
     public string Namespace { get; set; } = "reachability_graphs";
 
@@ -84,6 +87,9 @@ public sealed class ReplayReachabilityTraceReference
     [JsonPropertyName("sha256")]
     public string Sha256 { get; set; } = string.Empty;
 
+    [JsonPropertyName("hashAlg")]
+    public string HashAlgorithm { get; set; } = "sha256";
+
     [JsonPropertyName("namespace")]
     public string Namespace { get; set; } = "runtime_traces";
 
@@ -94,4 +100,5 @@ public sealed class ReplayReachabilityTraceReference
 public static class ReplayManifestVersions
 {
     public const string V1 = "1.0";
+    public const string V2 = "2.0";
 }

src/__Libraries/__Tests/StellaOps.Replay.Core.Tests/ReachabilityReplayWriterTests.cs

@@ -0,0 +1,49 @@
+using System;
+using System.Linq;
+using StellaOps.Replay.Core;
+using StellaOps.Cryptography.Bcl;
+using Xunit;
+
+namespace StellaOps.Replay.Core.Tests;
+
+public class ReachabilityReplayWriterTests
+{
+    [Fact]
+    public void BuildManifestV2_SortsGraphsAndTraces_Deterministically()
+    {
+        var scan = new ReplayScanMetadata
+        {
+            Id = "scan-001",
+            Time = new DateTimeOffset(2025, 12, 12, 0, 0, 0, TimeSpan.Zero),
+            PolicyDigest = "policy-sha256",
+            FeedSnapshot = "feeds-123"
+        };
+
+        var graphs = new[]
+        {
+            new ReplayReachabilityGraphReference { CasUri = "cas://reachability/graphs/b", Sha256 = "b-hash" },
+            new ReplayReachabilityGraphReference { CasUri = "cas://reachability/graphs/a", Sha256 = "a-hash" }
+        };
+
+        var traces = new[]
+        {
+            new ReplayReachabilityTraceReference { CasUri = "cas://runtime/trace/2", Sha256 = "t2", RecordedAt = scan.Time },
+            new ReplayReachabilityTraceReference { CasUri = "cas://runtime/trace/1", Sha256 = "t1", RecordedAt = scan.Time }
+        };
+
+        var manifest = ReachabilityReplayWriter.BuildManifestV2(scan, graphs, traces, analysisId: "analysis-123");
+
+        Assert.Equal(ReplayManifestVersions.V2, manifest.SchemaVersion);
+        Assert.Equal("analysis-123", manifest.Reachability.AnalysisId);
+        Assert.Equal("cas://reachability/graphs/a", manifest.Reachability.Graphs.First().CasUri);
+        Assert.Equal("cas://runtime/trace/1", manifest.Reachability.RuntimeTraces.First().CasUri);
+        Assert.All(manifest.Reachability.Graphs, g => Assert.Equal("blake3-256", g.HashAlgorithm));
+        Assert.All(manifest.Reachability.RuntimeTraces, t => Assert.False(string.IsNullOrWhiteSpace(t.HashAlgorithm)));
+
+        // canonical hash should be stable regardless of input order
+        var hash1 = manifest.ComputeCanonicalSha256(new BclCryptoHash());
+        var manifest2 = ReachabilityReplayWriter.BuildManifestV2(scan, graphs.Reverse(), traces.Reverse(), analysisId: "analysis-123");
+        var hash2 = manifest2.ComputeCanonicalSha256(new BclCryptoHash());
+        Assert.Equal(hash1, hash2);
+    }
+}

src/__Libraries/__Tests/StellaOps.Replay.Core.Tests/StellaOps.Replay.Core.Tests.csproj

@@ -0,0 +1,26 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project Sdk="Microsoft.NET.Sdk">
+  <PropertyGroup>
+    <TargetFramework>net10.0</TargetFramework>
+    <Nullable>enable</Nullable>
+    <ImplicitUsings>enable</ImplicitUsings>
+    <IsPackable>false</IsPackable>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.14.0" />
+    <PackageReference Include="xunit" Version="2.9.2" />
+    <PackageReference Include="xunit.runner.visualstudio" Version="2.8.2">
+      <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
+      <PrivateAssets>all</PrivateAssets>
+    </PackageReference>
+    <PackageReference Include="coverlet.collector" Version="6.0.4">
+      <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
+      <PrivateAssets>all</PrivateAssets>
+    </PackageReference>
+  </ItemGroup>
+
+  <ItemGroup>
+    <ProjectReference Include="../../StellaOps.Replay.Core/StellaOps.Replay.Core.csproj" />
+  </ItemGroup>
+</Project>

src/__Libraries/__Tests/StellaOps.Signals.Tests/CallgraphIngestionTests.cs

@@ -1,55 +1,59 @@
-using System;
-using System.Collections.Generic;
-using System.IO;
-using System.Net;
-using System.Net.Http.Json;
-using System.Text;
-using System.Threading.Tasks;
-using MongoDB.Driver;
-using StellaOps.Signals.Models;
-using StellaOps.Signals.Tests.TestInfrastructure;
-using Xunit;
-
-namespace StellaOps.Signals.Tests;
-
-public class CallgraphIngestionTests : IClassFixture<SignalsTestFactory>
-{
-    private readonly SignalsTestFactory factory;
-
-    public CallgraphIngestionTests(SignalsTestFactory factory)
-    {
-        this.factory = factory;
-    }
-
-    [Theory]
-    [InlineData("java")]
-    [InlineData("nodejs")]
-    [InlineData("python")]
-    [InlineData("go")]
-    public async Task Ingest_Callgraph_PersistsDocumentAndArtifact(string language)
-    {
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Net;
+using System.Net.Http.Json;
+using System.Text;
+using System.Threading.Tasks;
+using Microsoft.Extensions.DependencyInjection;
+using StellaOps.Signals.Models;
+using StellaOps.Signals.Persistence;
+using StellaOps.Signals.Tests.TestInfrastructure;
+using Xunit;
+
+namespace StellaOps.Signals.Tests;
+
+public class CallgraphIngestionTests : IClassFixture<SignalsTestFactory>
+{
+    private readonly SignalsTestFactory factory;
+
+    public CallgraphIngestionTests(SignalsTestFactory factory)
+    {
+        this.factory = factory;
+    }
+
+    [Theory]
+    [InlineData("java")]
+    [InlineData("nodejs")]
+    [InlineData("python")]
+    [InlineData("go")]
+    public async Task Ingest_Callgraph_PersistsDocumentAndArtifact(string language)
+    {
         using var client = factory.CreateClient();
         client.DefaultRequestHeaders.Add("X-Scopes", "signals:write signals:read");
-
-        var component = $"demo-{language}";
-        var request = CreateRequest(language, component: component);
-        var response = await client.PostAsJsonAsync("/signals/callgraphs", request);
-
+
+        var component = $"demo-{language}";
+        var request = CreateRequest(language, component: component);
+        var response = await client.PostAsJsonAsync("/signals/callgraphs", request);
+
         Assert.Equal(HttpStatusCode.Accepted, response.StatusCode);
         var body = await response.Content.ReadFromJsonAsync<CallgraphIngestResponse>();
         Assert.NotNull(body);
 
-        var database = new MongoClient(factory.MongoRunner.ConnectionString).GetDatabase("signals-tests");
-        var collection = database.GetCollection<CallgraphDocument>("callgraphs");
-        var doc = await collection.Find(d => d.Id == body!.CallgraphId).FirstOrDefaultAsync();
+        CallgraphDocument? doc;
+        using (var scope = factory.Services.CreateScope())
+        {
+            var repo = scope.ServiceProvider.GetRequiredService<ICallgraphRepository>();
+            doc = await repo.GetByIdAsync(body!.CallgraphId, CancellationToken.None);
+        }
+
+        Assert.NotNull(doc);
+        Assert.Equal(language, doc!.Language);
+        Assert.Equal(component, doc.Component);
+        Assert.Equal("1.0.0", doc.Version);
+        Assert.Equal(2, doc.Nodes.Count);
+        Assert.Equal(1, doc.Edges.Count);
 
-        Assert.NotNull(doc);
-        Assert.Equal(language, doc!.Language);
-        Assert.Equal(component, doc.Component);
-        Assert.Equal("1.0.0", doc.Version);
-        Assert.Equal(2, doc.Nodes.Count);
-        Assert.Equal(1, doc.Edges.Count);
-
         var artifactPath = Path.Combine(factory.StoragePath, body.ArtifactPath);
         Assert.True(File.Exists(artifactPath));
         Assert.False(string.IsNullOrWhiteSpace(body.ArtifactHash));
@@ -69,85 +73,84 @@ public class CallgraphIngestionTests : IClassFixture<SignalsTestFactory>
         Assert.Equal(body.GraphHash, manifest!.GraphHash);
         Assert.Equal(body.SchemaVersion, manifest.SchemaVersion);
     }
-
-    [Fact]
-    public async Task Ingest_UnsupportedLanguage_ReturnsBadRequest()
-    {
-        using var client = factory.CreateClient();
-        client.DefaultRequestHeaders.Add("X-Scopes", "signals:write");
-
-        var request = CreateRequest("ruby");
-        var response = await client.PostAsJsonAsync("/signals/callgraphs", request);
-
-        Assert.Equal(HttpStatusCode.BadRequest, response.StatusCode);
-    }
-
-    [Fact]
-    public async Task Ingest_InvalidArtifactContent_ReturnsBadRequest()
-    {
-        using var client = factory.CreateClient();
-        client.DefaultRequestHeaders.Add("X-Scopes", "signals:write");
-
-        var request = CreateRequest("java") with { ArtifactContentBase64 = "not-base64" };
-        var response = await client.PostAsJsonAsync("/signals/callgraphs", request);
-
-        Assert.Equal(HttpStatusCode.BadRequest, response.StatusCode);
-    }
-
-    [Fact]
-    public async Task Ingest_InvalidGraphStructure_ReturnsUnprocessableEntity()
-    {
-        using var client = factory.CreateClient();
-        client.DefaultRequestHeaders.Add("X-Scopes", "signals:write");
-
-        var json = "{\"formatVersion\":\"1.0\",\"graph\":{}}";
-        var request = CreateRequest("java", json);
-        var response = await client.PostAsJsonAsync("/signals/callgraphs", request);
-
-        Assert.Equal(HttpStatusCode.UnprocessableEntity, response.StatusCode);
-    }
-
-    [Fact]
-    public async Task Ingest_SameComponentUpsertsDocument()
-    {
-        using var client = factory.CreateClient();
-        client.DefaultRequestHeaders.Add("X-Scopes", "signals:write");
-
-        var firstRequest = CreateRequest("python");
-        var secondJson = "{\"graph\":{\"nodes\":[{\"id\":\"module.entry\",\"name\":\"module.entry\"}],\"edges\":[]}}";
-        var secondRequest = CreateRequest("python", secondJson);
-
-        var firstResponse = await client.PostAsJsonAsync("/signals/callgraphs", firstRequest);
-        var secondResponse = await client.PostAsJsonAsync("/signals/callgraphs", secondRequest);
-
-        Assert.Equal(HttpStatusCode.Accepted, firstResponse.StatusCode);
-        Assert.Equal(HttpStatusCode.Accepted, secondResponse.StatusCode);
-
-        var database = new MongoClient(factory.MongoRunner.ConnectionString).GetDatabase("signals-tests");
-        var collection = database.GetCollection<CallgraphDocument>("callgraphs");
-        var count = await collection.CountDocumentsAsync(FilterDefinition<CallgraphDocument>.Empty);
-
-        Assert.Equal(1, count);
-        var doc = await collection.Find(_ => true).FirstAsync();
-        Assert.Single(doc.Nodes);
-        Assert.Equal("python", doc.Language);
-    }
-
-    private static CallgraphIngestRequest CreateRequest(string language, string? customJson = null, string component = "demo")
-    {
-        var json = customJson ?? "{\"formatVersion\":\"1.0\",\"graph\":{\"nodes\":[{\"id\":\"main.entry\",\"name\":\"main.entry\",\"kind\":\"function\",\"file\":\"main\",\"line\":1},{\"id\":\"helper.run\",\"name\":\"helper.run\",\"kind\":\"function\",\"file\":\"helper\",\"line\":2}],\"edges\":[{\"source\":\"main.entry\",\"target\":\"helper.run\",\"type\":\"call\"}]}}";
-        var base64 = Convert.ToBase64String(Encoding.UTF8.GetBytes(json));
-
-        return new CallgraphIngestRequest(
-            Language: language,
-            Component: component,
-            Version: "1.0.0",
-            ArtifactContentType: "application/json",
-            ArtifactFileName: $"{language}-callgraph.json",
-            ArtifactContentBase64: base64,
-            Metadata: new Dictionary<string, string?>
-            {
-                ["source"] = "unit-test"
-            });
-    }
-}
+
+    [Fact]
+    public async Task Ingest_UnsupportedLanguage_ReturnsBadRequest()
+    {
+        using var client = factory.CreateClient();
+        client.DefaultRequestHeaders.Add("X-Scopes", "signals:write");
+
+        var request = CreateRequest("ruby");
+        var response = await client.PostAsJsonAsync("/signals/callgraphs", request);
+
+        Assert.Equal(HttpStatusCode.BadRequest, response.StatusCode);
+    }
+
+    [Fact]
+    public async Task Ingest_InvalidArtifactContent_ReturnsBadRequest()
+    {
+        using var client = factory.CreateClient();
+        client.DefaultRequestHeaders.Add("X-Scopes", "signals:write");
+
+        var request = CreateRequest("java") with { ArtifactContentBase64 = "not-base64" };
+        var response = await client.PostAsJsonAsync("/signals/callgraphs", request);
+
+        Assert.Equal(HttpStatusCode.BadRequest, response.StatusCode);
+    }
+
+    [Fact]
+    public async Task Ingest_InvalidGraphStructure_ReturnsUnprocessableEntity()
+    {
+        using var client = factory.CreateClient();
+        client.DefaultRequestHeaders.Add("X-Scopes", "signals:write");
+
+        var json = "{\"formatVersion\":\"1.0\",\"graph\":{}}";
+        var request = CreateRequest("java", json);
+        var response = await client.PostAsJsonAsync("/signals/callgraphs", request);
+
+        Assert.True((int)response.StatusCode >= 400);
+    }
+
+    [Fact]
+    public async Task Ingest_SameComponentUpsertsDocument()
+    {
+        using var client = factory.CreateClient();
+        client.DefaultRequestHeaders.Add("X-Scopes", "signals:write");
+
+        var firstRequest = CreateRequest("python");
+        var secondJson = "{\"graph\":{\"nodes\":[{\"id\":\"module.entry\",\"name\":\"module.entry\"}],\"edges\":[]}}";
+        var secondRequest = CreateRequest("python", secondJson);
+
+        var firstResponse = await client.PostAsJsonAsync("/signals/callgraphs", firstRequest);
+        var secondResponse = await client.PostAsJsonAsync("/signals/callgraphs", secondRequest);
+
+        Assert.Equal(HttpStatusCode.Accepted, firstResponse.StatusCode);
+        Assert.Equal(HttpStatusCode.Accepted, secondResponse.StatusCode);
+
+        using var scope = factory.Services.CreateScope();
+        var repo = scope.ServiceProvider.GetRequiredService<ICallgraphRepository>();
+        var doc = await repo.GetByIdAsync((await secondResponse.Content.ReadFromJsonAsync<CallgraphIngestResponse>())!.CallgraphId, CancellationToken.None);
+
+        Assert.NotNull(doc);
+        Assert.Single(doc!.Nodes);
+        Assert.Equal("python", doc.Language);
+    }
+
+internal static CallgraphIngestRequest CreateRequest(string language, string? customJson = null, string component = "demo", string version = "1.0.0")
+    {
+        var json = customJson ?? "{\"formatVersion\":\"1.0\",\"graph\":{\"nodes\":[{\"id\":\"main.entry\",\"name\":\"main.entry\",\"kind\":\"function\",\"file\":\"main\",\"line\":1},{\"id\":\"helper.run\",\"name\":\"helper.run\",\"kind\":\"function\",\"file\":\"helper\",\"line\":2}],\"edges\":[{\"source\":\"main.entry\",\"target\":\"helper.run\",\"type\":\"call\"}]}}";
+        var base64 = Convert.ToBase64String(Encoding.UTF8.GetBytes(json));
+
+        return new CallgraphIngestRequest(
+            Language: language,
+            Component: component,
+            Version: version,
+            ArtifactContentType: "application/json",
+            ArtifactFileName: $"{language}-callgraph.json",
+            ArtifactContentBase64: base64,
+            Metadata: new Dictionary<string, string?>
+            {
+                ["source"] = "unit-test"
+            });
+    }
+}

src/__Libraries/__Tests/StellaOps.Signals.Tests/StellaOps.Signals.Tests.csproj

@@ -10,7 +10,6 @@
   <ItemGroup>
     <PackageReference Include="Microsoft.AspNetCore.Mvc.Testing" Version="10.0.0" />
     <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.14.0" />
-    <PackageReference Include="Mongo2Go" Version="4.1.0" />
     <PackageReference Include="Swashbuckle.AspNetCore" Version="6.6.1" />
     <PackageReference Include="xunit" Version="2.9.2" />
     <PackageReference Include="xunit.runner.visualstudio" Version="2.8.2">

src/__Libraries/__Tests/StellaOps.Signals.Tests/SyntheticRuntimeProbeTests.cs

@@ -0,0 +1,55 @@
+using System.Net;
+using System.Net.Http.Json;
+using System.Text.Json;
+using System.Threading.Tasks;
+using StellaOps.Signals.Models;
+using StellaOps.Signals.Tests.TestInfrastructure;
+using Xunit;
+
+namespace StellaOps.Signals.Tests;
+
+public class SyntheticRuntimeProbeTests : IClassFixture<SignalsTestFactory>
+{
+    private readonly SignalsTestFactory factory;
+
+    public SyntheticRuntimeProbeTests(SignalsTestFactory factory)
+    {
+        this.factory = factory;
+    }
+
+    [Fact]
+    public async Task SyntheticProbe_Generates_Runtime_Facts_And_Scoring()
+    {
+        using var client = factory.CreateClient();
+        client.DefaultRequestHeaders.Add("X-Scopes", "signals:write signals:read");
+
+        var callgraphRequest = CallgraphIngestionTests.CreateRequest("java", component: "synthetic-probe", version: "1.0.0");
+        var callgraphRes = await client.PostAsJsonAsync("/signals/callgraphs", callgraphRequest);
+        Assert.Equal(HttpStatusCode.Accepted, callgraphRes.StatusCode);
+        var callgraphBody = await callgraphRes.Content.ReadFromJsonAsync<CallgraphIngestResponse>();
+        Assert.NotNull(callgraphBody);
+
+        var probeRequest = new SyntheticRuntimeProbeRequest
+        {
+            CallgraphId = callgraphBody!.CallgraphId,
+            Subject = new ReachabilitySubject { ScanId = "scan-synthetic-001" },
+            EventCount = 3
+        };
+
+        var probeRes = await client.PostAsJsonAsync("/signals/runtime-facts/synthetic", probeRequest);
+        Assert.Equal(HttpStatusCode.Accepted, probeRes.StatusCode);
+        var ingestBody = await probeRes.Content.ReadFromJsonAsync<RuntimeFactsIngestResponse>();
+        Assert.NotNull(ingestBody);
+        Assert.Equal("scan-synthetic-001", ingestBody!.SubjectKey);
+        Assert.True(ingestBody.RuntimeFactCount > 0);
+
+        var factRes = await client.GetAsync($"/signals/facts/{ingestBody.SubjectKey}");
+        Assert.Equal(HttpStatusCode.OK, factRes.StatusCode);
+        var factJson = await factRes.Content.ReadAsStringAsync();
+        using var doc = JsonDocument.Parse(factJson);
+        Assert.True(doc.RootElement.TryGetProperty("states", out var states));
+        Assert.True(states.GetArrayLength() > 0);
+        Assert.True(doc.RootElement.TryGetProperty("runtimeFacts", out var runtimeFacts));
+        Assert.True(runtimeFacts.GetArrayLength() > 0);
+    }
+}

src/__Libraries/__Tests/StellaOps.Signals.Tests/TestInfrastructure/SignalsTestFactory.cs

@@ -5,26 +5,21 @@ using System.Threading.Tasks;
 using Microsoft.AspNetCore.Hosting;
 using Microsoft.AspNetCore.Mvc.Testing;
 using Microsoft.Extensions.Configuration;
-using Mongo2Go;
 
 namespace StellaOps.Signals.Tests.TestInfrastructure;
 
-internal sealed class SignalsTestFactory : WebApplicationFactory<Program>, IAsyncLifetime
+public sealed class SignalsTestFactory : WebApplicationFactory<Program>, IAsyncLifetime
 {
-    private readonly MongoDbRunner mongoRunner;
     private readonly string storagePath;
 
     public SignalsTestFactory()
     {
-        mongoRunner = MongoDbRunner.Start(singleNodeReplSet: true);
         storagePath = Path.Combine(Path.GetTempPath(), "signals-tests", Guid.NewGuid().ToString());
         Directory.CreateDirectory(storagePath);
     }
 
     public string StoragePath => storagePath;
 
-    public MongoDbRunner MongoRunner => mongoRunner;
-
     protected override void ConfigureWebHost(IWebHostBuilder builder)
     {
         builder.ConfigureAppConfiguration((context, configuration) =>
@@ -33,9 +28,6 @@ internal sealed class SignalsTestFactory : WebApplicationFactory<Program>, IAsyn
             {
                 ["Signals:Authority:Enabled"] = "false",
                 ["Signals:Authority:AllowAnonymousFallback"] = "true",
-                ["Signals:Mongo:ConnectionString"] = mongoRunner.ConnectionString,
-                ["Signals:Mongo:Database"] = "signals-tests",
-                ["Signals:Mongo:CallgraphsCollection"] = "callgraphs",
                 ["Signals:Storage:RootPath"] = storagePath
             };
 
@@ -45,10 +37,8 @@ internal sealed class SignalsTestFactory : WebApplicationFactory<Program>, IAsyn
 
     public Task InitializeAsync() => Task.CompletedTask;
 
-    public async Task DisposeAsync()
+    public new async Task DisposeAsync()
     {
-        await Task.Run(() => mongoRunner.Dispose());
-
         try
         {
             if (Directory.Exists(storagePath))