fix(health): redact public readiness diagnostics - #70
Conversation
|
Warning Review limit reached
Next review available in: 59 minutes You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (19)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
@coderabbitai review @opencode-agent @cwl-noema-review Review-only request for exact source head |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
base="bf2cc2e140dc3ff4a56c3203f80f41bb9fed5d10"
head="2706029f5497e51b8bb7099765f8a9432b100d24"
printf '%s\n' '== revisions =='
git rev-parse HEAD
git cat-file -t "$base"
git cat-file -t "$head"
git merge-base --is-ancestor "$base" "$head" && echo "base_is_ancestor=yes" || echo "base_is_ancestor=no"
printf '%s\n' '== changed files and change types =='
git diff --name-status "$base" "$head"
printf '%s\n' '== changed Python symbols =='
git diff --unified=0 "$base" "$head" -- '*.py'
printf '%s\n' '== Python file outlines =='
fd -e py . | xargs -r ast-grep outline --items all --type class,function --view compact
printf '%s\n' '== focused health-related references =='
rg -n -C 4 -g '*.py' \
'public_health_report|check_health|HEALTH_STATEMENT_TIMEOUT_MILLISECONDS|statement_timeout|set_config|healthz|Cache-Control|no-store' .
printf '%s\n' '== health-related test references =='
rg -n -C 3 -g '*test*.py' -g '*.py' \
'public_health_report|check_health|statement_timeout|healthz|Cache-Control|no-store|unexpected' .
printf '%s\n' '== schema, credentials, release, and generated artifact indicators in diff =='
git diff --name-only "$base" "$head" | rg -n \
'(?i)(migration|schema|\.sql$|credential|secret|token|key|version|release|dist/|build/|\.lock$|generated)' \
|| trueLength of output: 14750 🏁 Script executed: #!/bin/bash
set -euo pipefail
base="bf2cc2e140dc3ff4a56c3203f80f41bb9fed5d10"
head="2706029f5497e51b8bb7099765f8a9432b100d24"
printf '%s\n' '== diff whitespace validation =='
git diff --check "$base" "$head"
printf '%s\n' '== health module outline =='
ast-grep outline pg_llm_batch/health.py --items all --view expanded
printf '%s\n' '== health module at exact head =='
git show "$head:pg_llm_batch/health.py" | nl -ba
printf '%s\n' '== health tests at exact head =='
git show "$head:tests/test_health.py" | nl -ba
printf '%s\n' '== malformed report / fail-closed test cases =='
git grep -n -E 'public_health_report|unexpected|malformed|invalid|TypeError|KeyError|fail.closed|fail-closed' "$head" -- \
':(glob)**/*.py' ':(glob)**/*.md' || true
printf '%s\n' '== changed documentation at exact head =='
for file in AGENTS.md CHANGELOG.md docs/adr/0014-public-healthz-readiness.md docs/doctoring/public-healthz-readiness.md; do
printf '\n--- %s ---\n' "$file"
git show "$head:$file" | nl -ba
done
printf '%s\n' '== changed files by extension =='
git diff --name-only "$base" "$head" | awk '
{ n=$0; sub(/^.*\//, "", n); if (n !~ /\./) ext="[no extension]"; else { sub(/^.*\./, ".", n); ext=n } count[ext]++ }
END { for (ext in count) print ext, count[ext] }
' | sortLength of output: 2233 🏁 Script executed: #!/bin/bash
set -euo pipefail
base="bf2cc2e140dc3ff4a56c3203f80f41bb9fed5d10"
head="2706029f5497e51b8bb7099765f8a9432b100d24"
show_numbered() {
git show "$head:$1" | awk '{ printf "%6d %s\n", NR, $0 }'
}
printf '%s\n' '== health module at exact head =='
show_numbered pg_llm_batch/health.py
printf '%s\n' '== health tests at exact head =='
show_numbered tests/test_health.py
printf '%s\n' '== documentation-contract tests at exact head =='
show_numbered tests/test_health_public_documentation.py
printf '%s\n' '== malformed report / fail-closed references =='
git grep -n -E 'public_health_report|unexpected|malformed|invalid|TypeError|KeyError|fail.closed|fail-closed' "$head" -- \
':(glob)**/*.py' ':(glob)**/*.md' || true
printf '%s\n' '== changed documentation at exact head =='
for file in AGENTS.md CHANGELOG.md docs/adr/0014-public-healthz-readiness.md docs/doctoring/public-healthz-readiness.md; do
printf '\n--- %s ---\n' "$file"
show_numbered "$file"
done
printf '%s\n' '== changed files by extension =='
git diff --name-only "$base" "$head" | awk '
{
name=$0
if (name !~ /\./) extension="[no extension]"
else { sub(/^.*\./, ".", name); extension=name }
count[extension]++
}
END { for (extension in count) print extension, count[extension] }
' | sortLength of output: 71028 🏁 Script executed: #!/bin/bash
set -euo pipefail
head="2706029f5497e51b8bb7099765f8a9432b100d24"
repo="ContextualWisdomLab/pg-llm-batch"
printf '%s\n' '== coverage and test configuration files =='
fd -HI -t f '^(pyproject\.toml|pytest\.ini|setup\.cfg|tox\.ini|\.coveragerc)$' . \
| sort \
| while IFS= read -r file; do
printf '\n--- %s ---\n' "$file"
awk '{ printf "%6d %s\n", NR, $0 }' "$file"
done
printf '%s\n' '== test workflow coverage/docstring references =='
if [ -d .github ]; then
rg -n -i -C 3 \
'coverage|branch|docstring|interrogate|pytest|ruff|health_public_documentation' \
.github
fi
printf '%s\n' '== GitHub check runs on exact source head =='
gh api \
-H 'Accept: application/vnd.github+json' \
"/repos/${repo}/commits/${head}/check-runs?per_page=100" \
--jq '.check_runs[] | [.name, .status, .conclusion, .head_sha, .details_url] | `@tsv`' \
| sort
printf '%s\n' '== GitHub combined commit status on exact source head =='
gh api \
-H 'Accept: application/vnd.github+json' \
"/repos/${repo}/commits/${head}/status" \
--jq '.state, (.statuses[]? | [.context, .state, .target_url] | `@tsv`)' \
|| true
printf '%s\n' '== pull request head/base metadata =='
gh pr view 70 --repo "$repo" \
--json number,isDraft,headRefOid,baseRefOid,mergeStateStatus,statusCheckRollup \
--jq '{number, isDraft, headRefOid, baseRefOid, mergeStateStatus, checks: [.statusCheckRollup[] | {name, status, conclusion, headSha: .commit.oid}]}'Length of output: 16271
I found no blocking issue. Verified items:
The fixed allow-list is fail-closed for future diagnostic fields because it constructs the public object from approved fields instead of removing known sensitive fields. I did not treat the successful check runs as proof of protected integration. PR
|
|
@coderabbitai review @opencode-agent @cwl-noema-review Review-only request for exact current source head |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
base="bf2cc2e140dc3ff4a56c3203f80f41bb9fed5d10"
head="d83f28e438f757f36cf14ffb5556f71b5bdc01be"
repo="ContextualWisdomLab/pg-llm-batch"
echo "== Revision identity =="
printf 'checked_out='; git rev-parse HEAD
printf 'base_type='; git cat-file -t "$base"
printf 'head_type='; git cat-file -t "$head"
git merge-base --is-ancestor "$base" "$head" && echo "base_ancestor_of_head=yes" || echo "base_ancestor_of_head=no"
echo "== Changed files =="
git diff --name-status "$base" "$head"
echo "== Whitespace validation =="
git diff --check "$base" "$head"
echo "== Focused health implementation outline =="
fd -t f -e py . | rg '(^|/)(health|test_health).*\.py$' | while IFS= read -r file; do
echo "--- $file ---"
ast-grep outline "$file" --items all --view compact
done
echo "== Exact-head health source and tests =="
for file in pg_llm_batch/health.py tests/test_health.py; do
if git cat-file -e "$head:$file" 2>/dev/null; then
echo "--- $file ---"
git show "$head:$file" | nl -ba
fi
done
echo "== Relevant exact-head references =="
git grep -n -E \
'public_health_report|check_health|HEALTH_STATEMENT_TIMEOUT_MILLISECONDS|statement_timeout|set_config|pg_llm_batch_health_check|healthz|Cache-Control|no-store|malformed|unexpected|is_ready|ready' \
"$head" -- ':(glob)**/*.py' ':(glob)pyproject.toml' ':(glob).github/**' || true
echo "== Coverage, docstring, package, and container configuration =="
fd -HI -t f '^(pyproject\.toml|pytest\.ini|setup\.cfg|tox\.ini|\.coveragerc|Dockerfile.*|docker-compose.*|compose\.ya?ml)$' . \
| sort \
| while IFS= read -r file; do
echo "--- $file ---"
nl -ba "$file"
done
echo "== Disallowed change indicators =="
git diff --name-only "$base" "$head" | rg -n -i \
'(migration|schema|\.sql$|credential|secret|token|key|version|release|dist/|build/|\.lock$|generated)' || true
echo "== Exact-head check runs =="
gh api -H 'Accept: application/vnd.github+json' \
"/repos/${repo}/commits/${head}/check-runs?per_page=100" \
--jq '.check_runs[] | [.name, .status, .conclusion, .head_sha, .details_url] | `@tsv`' \
| sort || true
echo "== PR metadata and check association =="
gh pr view 70 --repo "$repo" \
--json isDraft,headRefOid,baseRefOid,mergeStateStatus,statusCheckRollup \
--jq '{isDraft, headRefOid, baseRefOid, mergeStateStatus, checks: [.statusCheckRollup[] | {name, status, conclusion, headSha: .commit.oid}]}' || trueLength of output: 3371 🏁 Script executed: #!/bin/bash
set -euo pipefail
base="bf2cc2e140dc3ff4a56c3203f80f41bb9fed5d10"
head="d83f28e438f757f36cf14ffb5556f71b5bdc01be"
repo="ContextualWisdomLab/pg-llm-batch"
echo "== Focused health implementation outline =="
for file in pg_llm_batch/health.py tests/test_health.py tests/test_health_public_documentation.py; do
if [ -f "$file" ]; then
echo "--- $file ---"
ast-grep outline "$file" --items all --view signatures
fi
done
echo "== Exact-head health source and tests =="
for file in pg_llm_batch/health.py tests/test_health.py tests/test_health_public_documentation.py; do
if git cat-file -e "$head:$file" 2>/dev/null; then
echo "--- $file ---"
git show "$head:$file" | nl -ba
fi
done
echo "== Exact-head health diff =="
git diff --find-renames --unified=80 "$base" "$head" -- \
pg_llm_batch/health.py tests/test_health.py tests/test_health_public_documentation.py
echo "== Relevant exact-head references =="
git grep -n -E \
'public_health_report|check_health|HEALTH_STATEMENT_TIMEOUT_MILLISECONDS|statement_timeout|set_config|pg_llm_batch_health_check|healthz|Cache-Control|no-store|malformed|unexpected|is_ready|ready' \
"$head" -- ':(glob)**/*.py' ':(glob)pyproject.toml' ':(glob).github/**' || true
echo "== Changed documentation =="
for file in AGENTS.md CHANGELOG.md docs/adr/0014-public-healthz-readiness.md docs/doctoring/public-healthz-readiness.md; do
echo "--- $file ---"
git show "$head:$file" | nl -ba
done
echo "== Coverage, docstring, package, and container configuration =="
fd -HI -t f '^(pyproject\.toml|pytest\.ini|setup\.cfg|tox\.ini|\.coveragerc|Dockerfile.*|docker-compose.*|compose\.ya?ml)$' . \
| sort \
| while IFS= read -r file; do
echo "--- $file ---"
nl -ba "$file"
done
echo "== Exact-head check runs =="
gh api -H 'Accept: application/vnd.github+json' \
"/repos/${repo}/commits/${head}/check-runs?per_page=100" \
--jq '.check_runs[] | [.name, .status, .conclusion, .head_sha, .details_url] | `@tsv`' \
| sort || true
echo "== Exact-head combined status and PR check association =="
gh api -H 'Accept: application/vnd.github+json' \
"/repos/${repo}/commits/${head}/status" \
--jq '.state, (.statuses[]? | [.context, .state, .target_url] | `@tsv`)' || true
gh pr view 70 --repo "$repo" \
--json isDraft,headRefOid,baseRefOid,mergeStateStatus,statusCheckRollup \
--jq '{isDraft, headRefOid, baseRefOid, mergeStateStatus, checks: [.statusCheckRollup[] | {name, status, conclusion, headSha: .commit.oid}]}' || true
echo "== Changed-file category checks =="
git diff --name-only "$base" "$head" | sort
git diff --name-only "$base" "$head" | rg -n -i \
'(migration|schema|\.sql$|credential|secret|token|key|version|release|dist/|build/|\.lock$|generated)' || trueLength of output: 5335 🏁 Script executed: #!/bin/bash
set -euo pipefail
base="bf2cc2e140dc3ff4a56c3203f80f41bb9fed5d10"
head="d83f28e438f757f36cf14ffb5556f71b5bdc01be"
repo="ContextualWisdomLab/pg-llm-batch"
numbered_head_file() {
local file="$1"
echo "--- $file ---"
git show "$head:$file" | awk '{printf "%5d %s\n", NR, $0}'
}
echo "== Health implementation and tests at exact head =="
numbered_head_file pg_llm_batch/health.py
numbered_head_file tests/test_health.py
numbered_head_file tests/test_health_public_documentation.py
echo "== Focused exact-head diff =="
git diff --unified=100 "$base" "$head" -- \
pg_llm_batch/health.py tests/test_health.py tests/test_health_public_documentation.py
echo "== Authoritative changed documentation =="
for file in AGENTS.md CHANGELOG.md docs/adr/0014-public-healthz-readiness.md docs/doctoring/public-healthz-readiness.md; do
numbered_head_file "$file"
done
echo "== Coverage, docstring, package, and container configuration =="
fd -HI -t f '^(pyproject\.toml|pytest\.ini|setup\.cfg|tox\.ini|\.coveragerc|Dockerfile.*|docker-compose.*|compose\.ya?ml)$' . \
| sort \
| while IFS= read -r file; do
echo "--- $file ---"
awk '{printf "%5d %s\n", NR, $0}' "$file"
done
echo "== Relevant exact-head source references =="
git grep -n -E \
'public_health_report|check_health|HEALTH_STATEMENT_TIMEOUT_MILLISECONDS|statement_timeout|set_config|pg_llm_batch_health_check|healthz|Cache-Control|no-store|malformed|unexpected|is_ready|ready' \
"$head" -- ':(glob)**/*.py' ':(glob)pyproject.toml' ':(glob).github/**' || true
echo "== Exact-head check runs =="
gh api -H 'Accept: application/vnd.github+json' \
"/repos/${repo}/commits/${head}/check-runs?per_page=100" \
--jq '.check_runs[] | [.name, .status, .conclusion, .head_sha, .details_url] | `@tsv`' \
| sort || true
echo "== Exact-head combined status =="
gh api -H 'Accept: application/vnd.github+json' \
"/repos/${repo}/commits/${head}/status" \
--jq '.state, (.statuses[]? | [.context, .state, .target_url] | `@tsv`)' || true
echo "== Pull request check association =="
gh pr view 70 --repo "$repo" \
--json isDraft,headRefOid,baseRefOid,mergeStateStatus,statusCheckRollup \
--jq '{isDraft, headRefOid, baseRefOid, mergeStateStatus, checks: [.statusCheckRollup[] | {name, status, conclusion, headSha: .commit.oid}]}' || true
echo "== Changed-file category checks =="
git diff --name-only "$base" "$head" | sort
git diff --name-only "$base" "$head" | rg -n -i \
'(migration|schema|\.sql$|credential|secret|token|key|version|release|dist/|build/|\.lock$|generated)' || trueLength of output: 118660
I found no blocking implementation issue. Verified items:
The repository configuration enforces branch coverage, Merge evidence remains incomplete. The exact-head
|
|
@coderabbitai review Please review exact current head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
base="bf2cc2e140dc3ff4a56c3203f80f41bb9fed5d10"
head="879b8ef02d3e1b724b738f0f4173a5d3068f3cd0"
repo="ContextualWisdomLab/pg-llm-batch"
show_head() {
local file="$1"
printf '\n--- %s @ %s ---\n' "$file" "$head"
git show "$head:$file" | awk '{ printf "%5d %s\n", NR, $0 }'
}
printf '%s\n' '== revision identity =='
printf 'checked_out='; git rev-parse HEAD
printf 'base='; git rev-parse "$base"
printf 'head='; git rev-parse "$head"
git merge-base --is-ancestor "$base" "$head" && echo 'base_ancestor_of_head=yes' || echo 'base_ancestor_of_head=no'
printf '%s\n' '== changed files =='
git diff --name-status "$base" "$head"
printf '%s\n' '== whitespace validation =='
git diff --check "$base" "$head"
printf '%s\n' '== candidate Docker and health files =='
fd -HI -t f . | rg '(^|/)(Dockerfile[^/]*|health\.py|test_health[^/]*\.py|pyproject\.toml|AGENTS\.md|CHANGELOG\.md)$|(^|/)docs/.*health.*\.md$' | sort
printf '%s\n' '== exact-head Dockerfiles and health code =='
while IFS= read -r file; do
case "$file" in
*Dockerfile*|pg_llm_batch/health.py|tests/test_health.py|tests/test_health_public_documentation.py|pyproject.toml|AGENTS.md|CHANGELOG.md|docs/adr/0014-public-healthz-readiness.md|docs/doctoring/public-healthz-readiness.md)
if git cat-file -e "$head:$file" 2>/dev/null; then show_head "$file"; fi
;;
esac
done < <(fd -HI -t f . | sort)
printf '%s\n' '== health module AST outline =='
git show "$head:pg_llm_batch/health.py" > /tmp/health.py
ast-grep outline /tmp/health.py --items all --view expanded
printf '%s\n' '== focused diff =='
git diff --unified=100 "$base" "$head" -- \
pg_llm_batch/health.py tests/test_health.py tests/test_health_public_documentation.py \
Dockerfile AGENTS.md CHANGELOG.md docs/adr/0014-public-healthz-readiness.md \
docs/doctoring/public-healthz-readiness.md
printf '%s\n' '== exact-head Docker, CLI, listener, and health references =='
git grep -n -E \
'CMD|HEALTHCHECK|ENTRYPOINT|sh -c|PG_LLM_BATCH_HEALTH_PORT|curl|8080|serve-healthz|--host|--port|validate|public_health_report|check_health|REQUIRED_COMPONENTS|statement_timeout|set_config|ThreadingMixIn|BoundedSemaphore|Semaphore|request_timeout|send_response|Cache-Control|no-store' \
"$head" -- ':(glob)**/*.py' ':(glob)Dockerfile*' ':(glob)pyproject.toml' ':(glob)**/*.md' || true
printf '%s\n' '== all serve-healthz call sites and Docker instructions =='
git grep -n -E 'serve-healthz|^(CMD|ENTRYPOINT|HEALTHCHECK)' \
"$head" -- ':(glob)**/*' || true
printf '%s\n' '== out-of-scope changed-file indicators =='
git diff --name-only "$base" "$head" | sort
git diff --name-only "$base" "$head" | rg -n -i \
'(migration|schema|\.sql$|credential|secret|token|key|provider|model|version|release|dist/|build/|\.lock$|generated|writer)' || true
printf '%s\n' '== exact-head check runs and PR metadata =='
gh api -H 'Accept: application/vnd.github+json' \
"/repos/${repo}/commits/${head}/check-runs?per_page=100" \
--jq '.check_runs[] | [.name, .status, .conclusion, .head_sha] | `@tsv`' | sort || true
gh pr view 70 --repo "$repo" \
--json isDraft,headRefOid,baseRefOid,mergeStateStatus,statusCheckRollup \
--jq '{isDraft,headRefOid,baseRefOid,mergeStateStatus,checks:[.statusCheckRollup[]|{name,status,conclusion,headSha:.commit.oid}]}' || trueLength of output: 5239 🏁 Script executed: #!/bin/bash
set -euo pipefail
base="bf2cc2e140dc3ff4a56c3203f80f41bb9fed5d10"
head="879b8ef02d3e1b724b738f0f4173a5d3068f3cd0"
repo="ContextualWisdomLab/pg-llm-batch"
show_head() {
local file="$1"
printf '\n--- %s @ %s ---\n' "$file" "$head"
git show "$head:$file" | awk '{ printf "%5d %s\n", NR, $0 }'
}
printf '%s\n' '== exact-head implementation =='
for file in \
Dockerfile \
pg_llm_batch/cli.py \
pg_llm_batch/health.py \
tests/test_health.py \
tests/test_health_cli_network_boundary.py \
tests/test_health_listener_validation.py \
tests/test_health_server_concurrency.py \
tests/test_health_public_documentation.py \
tests/test_health_database_boolean_boundary.py
do
git cat-file -e "$head:$file"
show_head "$file"
done
printf '%s\n' '== health AST outline =='
git show "$head:pg_llm_batch/health.py" > /tmp/health.py
ast-grep outline /tmp/health.py --items all --view expanded
printf '%s\n' '== focused diff =='
git diff --unified=100 "$base" "$head" -- \
Dockerfile pg_llm_batch/cli.py pg_llm_batch/health.py \
tests/test_health.py tests/test_health_cli_network_boundary.py \
tests/test_health_listener_validation.py tests/test_health_server_concurrency.py \
tests/test_health_public_documentation.py tests/test_health_database_boolean_boundary.py
printf '%s\n' '== command authority and listener reference set =='
git grep -n -E \
'^(CMD|ENTRYPOINT|HEALTHCHECK)|sh -c|PG_LLM_BATCH_HEALTH_PORT|curl|8080|serve-healthz|--host|--port|_validate|validate_|public_health_report|check_health|REQUIRED_COMPONENTS|statement_timeout|set_config|ThreadingMixIn|BoundedSemaphore|Semaphore|request_timeout|send_response|Cache-Control|no-store' \
"$head" -- ':(glob)**/*.py' ':(glob)Dockerfile*' ':(glob)pyproject.toml' ':(glob)**/*.md' || true
printf '%s\n' '== exact-head checks =='
gh api -H 'Accept: application/vnd.github+json' \
"/repos/${repo}/commits/${head}/check-runs?per_page=100" \
--jq '.check_runs[] | [.name, .status, .conclusion, .head_sha] | `@tsv`' | sort || true
gh pr view 70 --repo "$repo" \
--json isDraft,headRefOid,baseRefOid,mergeStateStatus,statusCheckRollup \
--jq '{isDraft,headRefOid,baseRefOid,mergeStateStatus,checks:[.statusCheckRollup[]|{name,status,conclusion,headSha:.commit.oid}]}' || trueLength of output: 184747
If Validate I verified the requested Docker command-authority boundary:
I also verified the existing source contracts:
The exact-head checks are successful for unit tests, coverage/docstrings/lint/package, container builds, and security scans. You are interacting with an AI system. |
1 participant
Purpose
Harden the standalone
/healthztrust boundary without removing trusted local operator diagnostics. The public endpoint redacts diagnostic detail and arbitrary component identities, rejects malformed readiness evidence without truth coercion, bounds PostgreSQL health work, suppresses the stdlib/PythonServerfingerprint, serves bounded concurrent probes with finite read lifetime, makes broad listener exposure explicit, validates listener input before socket construction, and removes shell interpretation from the bundled container readiness command path.Bounded implementation
check_health()retains detailed local/operator diagnostics and requires exactly one observation for every required component.is_readyvalues are accepted only when their exact Python type isbool; malformed values are never truth-coerced.public_health_report()exposes only top-levelreadypluscomponentandis_readyfor the fixed required-component allow-list; diagnostic detail and unknown component identities remain local.statement_timeoutbeforepg_llm_batch_health_check()./healthzpreserves 200/503 semantics, unrelated paths remain 404, responses useCache-Control: no-store, and the default stdlib/PythonServerfingerprint is omitted.serve-healthzinvocation defaults to loopback127.0.0.1; the bundled container opts into0.0.0.0explicitly.1..65535.8080;PG_LLM_BATCH_HEALTH_PORTis not shell-expanded throughsh -c.The branch retains test-first RED→GREEN provenance for redaction, malformed/duplicate readiness evidence, exact database booleans, SQL statement bounds, runtime-header suppression, listener concurrency/read bounds, loopback defaults, listener validation, and the no-shell container-command boundary. Predecessor-head evidence does not transfer after a source-head change.
Current exact state
ab38b80240fb8705122ee347c421316599175119.main:bf2cc2e140dc3ff4a56c3203f80f41bb9fed5d10.31361759779: completed / success.31361759700: completed / success.31361759715: completed / success.Repository CI still predates protected-main exact-source governance #88, so these successful PR-triggered runs are staged integration evidence rather than final source-head acceptance.
Dependency and merge boundary
Keep Draft until #88 reaches protected
mainand the read-only central review-evidence prerequisite materially changes. Reconcile this branch onto the resulting protected base only when integration correctness requires it, then regenerate final exact-source CI, security, dependency, packaging, provenance, semantic-review, and branch-policy evidence. Do not churn a clean source head solely to retrigger an unchanged external reviewer path.Merge only with zero valid unresolved findings, live repository policy/protection satisfied, every required exact-current-head gate passing, and current review/approval evidence where live policy actually requires it. The protected code-owner gate remains disabled/on hold for the solo-maintainer state and is not a universal approval requirement. Predecessor, stale-base, queued, pending, cancelled, skipped-required, absent, neutral-required, status-only, author-only, synthetic-only, infrastructure-only, rate-limited, or failed evidence is not acceptance.