fix(health): keep liveness probes free of store I/O

[cursor]

Why

PR #91 exposes GET /live and GET /ready, but the PostgreSQL adapter observes the store before parsing the request and before accept(). A hung store can take down liveness, and a stale snapshot can return HTTP 200 on /ready after the store becomes read-only. Bare /ready also ignored postgres_operational_store, so a default Kubernetes readiness path could keep sending writes to a store that cannot persist. The listener had no I/O timeout and treated an oversized request with a valid first line as a successful /live probe.

TDD

RED 90a2a7e required store-free /live, fail-closed bare /ready on a read-only transaction, HTTP 400 for incomplete and oversized requests without echo, and an as-built OpenAPI /live 503. GREEN 79aa953 is the narrow fix.

Scope

• GET /live answers process liveness only and does not perform store I/O.
• GET /ready observes PostgreSQL after accept; a bare /ready requires postgres_operational_store.
• The bound listener applies a 2-second read/write timeout, rejects incomplete or oversized requests without echoing input, sends Cache-Control: no-store, and includes Allow: GET on 405.
• openapi/health-probes.yaml documents /live 503.
• Public/admin product routes, TLS, measured SLO values, and deployment-profile evidence remain outside this slice.

This branch continues the #91 operator-probe stack with those production-safety corrections. Do not merge until exact-head checks and independent last-push approval are satisfied. Never self-approve.

Operator next action

Review the probe contract tests, then use GET /live for process liveness and GET /ready (bare or ?capability=postgres_operational_store) for write-readiness. Do not point a load balancer at /live as a readiness signal.

  

[cursor]

Stale comment

Current-head review (79aa953)

The #91 production defects are addressed on this head.

• handle_postgres_health_http_request returns a process-liveness snapshot for every non-GET-/ready request, so GET /live and 400/404/405 do not call observe_postgres_operational_snapshot.
• accept_one_postgres_health_http reads the request first through accept_one_health_http_with, then observes PostgreSQL only if the accepted request is GET /ready.
• Bare GET /ready injects postgres_operational_store. A read-only or unsupported-major store therefore cannot return HTTP 200 to a default Kubernetes readiness path.
• The listener sets a 2-second read/write timeout. Incomplete or oversized requests become empty request text and fail closed as HTTP 400 without echoing input. 405 includes Allow: GET. Responses send Cache-Control: no-store.

Residual, not blocking this slice

RFC 9457 problem bodies still use "type":"about:blank". #87 requires an explicit HTTPS or URN problem type before that primitive lands. Keep that on #87; do not block operator probes on it.

Do not merge until exact-head required checks and independent last-push approval are satisfied. Close or supersede #91 after this lands. Point liveness at GET /live and readiness at GET /ready (bare or ?capability=postgres_operational_store). Do not treat /live HTTP 200 as write-readiness.

View PR

  

_{Sent by Cursor Automation: Fix Issues}

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[cursor]

Stale comment

Verdict: comment on 79aa953

The four #91 production defects are fixed in this head, not only restated:

1. /live, 400, 404, and 405 no longer observe PostgreSQL. accept_one_health_http_with is now accept → I/O timeout → read → handler.
2. Bare /ready on the postgres adapter requires postgres_operational_store. The generic translator still uses is_ready_for(&[]) — do not compose observe_postgres_operational_snapshot with accept_one_health_http or the old default returns.
3. Read/write timeouts are 2s before the request is read. A hung client gets 400 instead of a wedged accept loop.
4. An oversized buffer or a missing \r \r becomes an empty request and 400, including a valid /live first line plus padding. The body does not echo input.

Not approving: the PR is still Draft, TRACEABILITY/ADR-0014 still name Active PR #91, and /ready still has no statement timeout (a serial accept loop can head-of-line-block /live while one /ready waits on PostgreSQL). That last item is caller-owned session state, not a fail-open in this slice.

Do not merge #91 at ec32f969. Land this successor after required checks.

View PR

  

_{Sent by Cursor Automation: Fix Issues}

[cursor]

Verdict: comment on 79aa953

The four #91 production defects are fixed on this head.

1. GET /live, 400, 404, and 405 never call observe_postgres_operational_snapshot. handle_postgres_health_http_request returns a process-liveness snapshot unless the request is GET /ready.
2. accept_one_postgres_health_http is accept → 2s I/O timeout → read → handler. Store observation cannot start before accept.
3. Bare GET /ready on the PostgreSQL adapter requires postgres_operational_store. A read-only or unsupported-major store cannot return HTTP 200 to a default Kubernetes readiness path.
4. Incomplete or oversized requests become empty request text and HTTP 400 without echoing input. 405 includes Allow: GET. Responses send Cache-Control: no-store. OpenAPI documents /live 503.

TRACEABILITY and ADR-0014 still name Active PR #91. That is not a correctness failure: #91 and #102 share this SHA, and the documented probe contract matches the code. Close or supersede the non-merge vehicle after landing.

A PostgreSQL statement_timeout on observe is not required for this one-shot acceptor. Add it only when a long-running serial accept loop would otherwise let one hung /ready starve /live.

Do not merge until exact-head required checks and independent last-push approval are satisfied. Never self-approve. Point kubelet liveness at GET /live and readiness at GET /ready. Do not treat /live HTTP 200 as write-readiness.

  

_{Sent by Cursor Automation: Fix Issues}

[seonghobae]

Closing as a proven superseded duplicate/predecessor. This PR's exact head 79aa9534 is the same commit as closed #91 and fresh compare shows that commit is the merge base/ancestor of #132 head e7440491. #132 carries the store-free liveness/readiness safety contract forward through resilient serving and the deployable env-bound health process. Continue exact-head CI/review on #132; do not merge #102 separately.