feat(operations): separate liveness and readiness probes - #295
feat(operations): separate liveness and readiness probes#295seonghobae wants to merge 4 commits into
Conversation
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Comment |
|
@coderabbitai review @opencode-agent @cwl-noema-review Independently review exact current head |
|
|
|
@coderabbitai review Retry exact-head review for |
|
|
|
@coderabbitai review @opencode-agent @cwl-noema-review Re-run an exact-head review for |
|
I will assess only the current availability slice. I will report path-specific findings or the current-head disposition. I will not transfer evidence from
|
|
@coderabbitai review @opencode-agent @cwl-noema-review Retry independent review of exact current head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
HEAD_SHA='c4aaab9275073927f642c2bcf3596f7efa5da1ee'
BASE_SHA='ed3863209109cd24a3cf1f1d6bdcd51db16fbef1'
REPO='ContextualWisdomLab/clearfolio'
echo '== Local commit identity and changed paths =='
git rev-parse HEAD
git cat-file -t "$HEAD_SHA"
git cat-file -t "$BASE_SHA"
git diff --name-status "$BASE_SHA" "$HEAD_SHA"
echo '== Diff stat =='
git diff --stat "$BASE_SHA" "$HEAD_SHA"
echo '== Exact diff =='
git diff --find-renames --find-copies --unified=80 "$BASE_SHA" "$HEAD_SHA"
echo '== GitHub PR identity, mergeability, and check rollup =='
gh pr view 295 --repo "$REPO" --json number,state,headRefOid,baseRefOid,mergeStateStatus,mergeable,statusCheckRollup,url
echo '== Exact-head check suites =='
gh api "repos/$REPO/commits/$HEAD_SHA/check-suites?per_page=100" --paginate
echo '== Exact-head legacy statuses =='
gh api "repos/$REPO/commits/$HEAD_SHA/status"
echo '== Repository branch protection / rulesets summary =='
gh api "repos/$REPO/branches/main/protection" 2>&1 || true
gh api "repos/$REPO/rulesets?includes_parents=true" 2>&1 || trueLength of output: 117319 🏁 Script executed: #!/bin/bash
set -euo pipefail
echo '== Candidate files =='
fd -HI '^(pom\.xml|AGENTS\.md|.*\.ya?ml|.*\.java|.*\.py)$' .github src scripts . 2>/dev/null | \
rg '(^|/)(pom\.xml|AGENTS\.md|.*(?:Security|Filter|HealthController|Application)\.java|.*(?:HealthController|Security|Filter).*Test\.java|.*\.ya?ml|.*\.py)$' || true
echo '== Java route/security/filter declarations and availability usage =='
rg -n -C 5 --glob '*.java' \
'(SecurityWebFilterChain|WebFilter|HandlerFilterFunction|`@RequestMapping`|`@GetMapping`|/healthz|/readyz|ApplicationAvailability|LivenessState|ReadinessState)' \
src/main/java src/test/java
echo '== Build lifecycle, coverage, Javadoc, and script-test configuration =='
rg -n -C 6 \
'(jacoco|maven-javadoc-plugin|maven-surefire-plugin|exec-maven-plugin|verify_maven_test_reports|scripts|<phase>verify</phase>|<includes>|<excludes>)' \
pom.xml AGENTS.md 2>/dev/null || true
echo '== Workflow inventory and triggers =='
fd -HI -e yml -e yaml .github 2>/dev/null | while IFS= read -r file; do
echo "--- $file"
sed -n '1,260p' "$file"
done
echo '== Full active rulesets =='
gh api 'repos/ContextualWisdomLab/clearfolio/rulesets/18156473?includes_parents=true'
gh api 'repos/ContextualWisdomLab/clearfolio/rulesets/13042993?includes_parents=true'
echo '== Required check contexts reported by GitHub for PR `#295` =='
gh pr checks 295 --repo ContextualWisdomLab/clearfolio --required --json name,state,workflow,link 2>&1 || trueLength of output: 69522 🏁 Script executed: #!/bin/bash
set -euo pipefail
echo '== Health controller and only applicable WebFilter =='
cat -n src/main/java/com/clearfolio/viewer/controller/HealthController.java
cat -n src/main/java/com/clearfolio/viewer/config/ViewerSecurityHeadersWebFilter.java
echo '== Maven gate definitions =='
sed -n '175,275p' pom.xml
echo '== Repository gate instructions =='
sed -n '1,115p' AGENTS.md
echo '== CI workflow =='
cat -n .github/workflows/ci.yml
echo '== Fuzz workflow =='
cat -n .github/workflows/fuzz.yml
echo '== Pull request merge commit and review state =='
gh pr view 295 --repo ContextualWisdomLab/clearfolio \
--json headRefOid,baseRefName,baseRefOid,mergeCommit,reviews,reviewDecision,statusCheckRollup
echo '== Check runs for the PR merge commit, if GitHub has created one =='
merge_sha="$(gh pr view 295 --repo ContextualWisdomLab/clearfolio --json mergeCommit --jq '.mergeCommit.oid // empty')"
if [ -n "$merge_sha" ]; then
printf 'merge_sha=%s\n' "$merge_sha"
gh api "repos/ContextualWisdomLab/clearfolio/commits/$merge_sha/check-runs?per_page=100"
else
echo 'No GitHub synthetic merge commit is available.'
fiLength of output: 29709
I reviewed only I found no actionable path-specific defect in the 11-file availability slice. Static review confirms:
Approval is blocked by current evidence:
After You are interacting with an AI system. |
|
@coderabbitai review @opencode-agent @cwl-noema-review Re-run an independent review of exact current head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/clearfolio'
pr='295'
head='c4aaab9275073927f642c2bcf3596f7efa5da1ee'
base='ed3863209109cd24a3cf1f1d6bdcd51db16fbef1'
echo '== Commit identity and exact changed paths =='
printf 'checked-out HEAD: '; git rev-parse HEAD
git cat-file -e "${head}^{commit}"
git cat-file -e "${base}^{commit}"
git diff --name-status "$base" "$head"
git diff --stat "$base" "$head"
echo '== Exact availability-slice diff =='
git diff --find-renames --unified=40 "$base" "$head"
echo '== Relevant source and test structure =='
fd -HI -t f . | rg '(^|/)(HealthController|ViewerSecurityHeadersWebFilter|.*Health.*Test|pom\.xml|AGENTS\.md|.*\.ya?ml|.*\.md)$' || true
for f in \
src/main/java/com/clearfolio/viewer/controller/HealthController.java \
src/main/java/com/clearfolio/viewer/config/ViewerSecurityHeadersWebFilter.java \
pom.xml \
AGENTS.md \
.github/workflows/ci.yml \
.github/workflows/fuzz.yml
do
if [ -f "$f" ]; then
echo "--- $f"
cat -n "$f"
fi
done
echo '== Route, availability, test assertion, documentation, coverage, and Javadoc references =='
rg -n -C 4 \
--glob '*.java' --glob '*.xml' --glob '*.md' --glob '*.yml' --glob '*.yaml' \
'(/healthz|/readyz|ApplicationAvailability|LivenessState|ReadinessState|Cache-Control|no-store|status"\s*:|status\(|assertThat|jacoco|javadoc|livenessProbe|readinessProbe|startupProbe)' \
src pom.xml AGENTS.md .github 2>/dev/null || true
echo '== Pull request state and current check rollup =='
gh pr view "$pr" --repo "$repo" \
--json number,state,headRefOid,baseRefName,baseRefOid,mergeable,mergeStateStatus,mergeCommit,reviewDecision,statusCheckRollup,url
echo '== Exact-head check runs, check suites, and legacy statuses =='
gh api "repos/$repo/commits/$head/check-runs?per_page=100"
gh api "repos/$repo/commits/$head/check-suites?per_page=100"
gh api "repos/$repo/commits/$head/status"
echo '== Synthetic-merge evidence, when GitHub has a merge commit =='
merge_sha="$(gh pr view "$pr" --repo "$repo" --json mergeCommit --jq '.mergeCommit.oid // empty')"
if [ -n "$merge_sha" ]; then
printf 'synthetic_merge_sha=%s\n' "$merge_sha"
gh api "repos/$repo/commits/$merge_sha/check-runs?per_page=100"
gh api "repos/$repo/commits/$merge_sha/check-suites?per_page=100"
gh api "repos/$repo/commits/$merge_sha/status"
else
echo 'No synthetic merge commit is available.'
fi
echo '== Required check contexts and applicable repository rules =='
gh pr checks "$pr" --repo "$repo" --required --json name,state,workflow,link 2>&1 || true
gh api "repos/$repo/branches/main/protection" 2>&1 || true
gh api "repos/$repo/rulesets?includes_parents=true" 2>&1 || trueLength of output: 211776
I reviewed only head I found no actionable path-specific defect in the 11-file availability slice. Static review confirms:
Approval is blocked by current evidence:
After You are interacting with an AI system. |
|
@coderabbitai review @opencode-agent @cwl-noema-review Independently review exact current head |
|
@coderabbitai review @opencode-agent @cwl-noema-review Independently review exact current head Verify the 11-file availability slice: Spring Exact-head CI |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/clearfolio'
pr='295'
head='05b3f2c23ed4fc2c64e66e99016f73a0cb29e2e9'
base='ed3863209109cd24a3cf1f1d6bdcd51db16fbef1'
echo '== Exact commit identity and bounded change list =='
printf 'checked_out_head='; git rev-parse HEAD
git cat-file -e "${head}^{commit}"
git cat-file -e "${base}^{commit}"
git diff --name-status "$base" "$head"
git diff --stat "$base" "$head"
echo '== Exact availability-slice diff =='
git diff --find-renames --find-copies --unified=60 "$base" "$head"
echo '== Candidate source structure =='
fd -HI -t f . | rg '(^|/)(HealthController|ViewerSecurityHeadersWebFilter|.*Health.*Test|pom\.xml|AGENTS\.md|.*\.ya?ml|.*\.md)$' || true
echo '== Health controller outline =='
health_file="$(fd -HI -t f '^HealthController\.java$' src 2>/dev/null | head -n1 || true)"
if [ -n "$health_file" ]; then
ast-grep outline "$health_file" --items all --view expanded
echo "--- $health_file"
cat -n "$health_file"
fi
echo '== Availability routes, tests, documentation, coverage, and Javadoc configuration =='
rg -n -C 5 \
--glob '*.java' --glob '*.xml' --glob '*.md' --glob '*.yml' --glob '*.yaml' \
'(/healthz|/readyz|ApplicationAvailability|LivenessState|ReadinessState|Cache-Control|no-store|status"\s*:|assertThat|jacoco|javadoc|livenessProbe|readinessProbe|startupProbe|APA)' \
src pom.xml AGENTS.md .github 2>/dev/null || true
echo '== Exact-head PR state, reviews, and checks =='
gh pr view "$pr" --repo "$repo" \
--json number,state,headRefOid,baseRefName,baseRefOid,mergeable,mergeStateStatus,mergeCommit,reviewDecision,reviews,statusCheckRollup,url
echo '== Named exact-head workflow runs =='
gh run view 31150168874 --repo "$repo" --json databaseId,headSha,event,status,conclusion,name,workflowName,url,jobs
gh run view 31150168889 --repo "$repo" --json databaseId,headSha,event,status,conclusion,name,workflowName,url,jobs
echo '== Exact-head check runs and status =='
gh api "repos/$repo/commits/$head/check-runs?per_page=100"
gh api "repos/$repo/commits/$head/status"
echo '== Synthetic-merge evidence when available =='
merge_sha="$(gh pr view "$pr" --repo "$repo" --json mergeCommit --jq '.mergeCommit.oid // empty')"
if [ -n "$merge_sha" ]; then
printf 'synthetic_merge_sha=%s\n' "$merge_sha"
gh api "repos/$repo/commits/$merge_sha/check-runs?per_page=100"
gh api "repos/$repo/commits/$merge_sha/status"
else
echo 'No synthetic merge commit is available.'
fi
echo '== Required checks for the current target =='
gh pr checks "$pr" --repo "$repo" --required --json name,state,workflow,link 2>&1 || trueLength of output: 176591 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/clearfolio'
pr='295'
head='05b3f2c23ed4fc2c64e66e99016f73a0cb29e2e9'
parent_pr='270'
echo '== Repository workflow definitions =='
fd -HI -t f -e yml -e yaml .github/workflows 2>/dev/null | sort | while IFS= read -r file; do
echo "--- $file"
cat -n "$file"
done
echo '== All workflow runs associated with the exact head =='
gh run list --repo "$repo" --commit "$head" --limit 100 \
--json databaseId,workflowName,headSha,event,status,conclusion,url,createdAt,updatedAt
echo '== Exact-head check suites by workflow application =='
gh api "repos/$repo/commits/$head/check-suites?per_page=100"
echo '== Current repository rulesets and main protection =='
gh api "repos/$repo/rulesets?includes_parents=true" 2>&1 || true
gh api "repos/$repo/branches/main/protection" 2>&1 || true
echo '== Parent PR current identity and check evidence (context only) =='
gh pr view "$parent_pr" --repo "$repo" \
--json number,state,headRefOid,baseRefName,baseRefOid,mergeable,mergeStateStatus,statusCheckRollup,reviewDecision,url
parent_head="$(gh pr view "$parent_pr" --repo "$repo" --json headRefOid --jq .headRefOid)"
printf 'parent_head=%s\n' "$parent_head"
gh run list --repo "$repo" --commit "$parent_head" --limit 100 \
--json databaseId,workflowName,headSha,event,status,conclusion,urlLength of output: 1689 🏁 Script executed: #!/bin/bash
set -u
repo='ContextualWisdomLab/clearfolio'
head='05b3f2c23ed4fc2c64e66e99016f73a0cb29e2e9'
parent_pr='270'
run() {
echo "== $1 =="
shift
"$@" || echo "[command failed: $*]"
}
run 'GitHub workflow inventory' \
gh workflow list --repo "$repo"
run 'All exact-head workflow runs' \
gh run list --repo "$repo" --commit "$head" --limit 100 \
--json databaseId,workflowName,headSha,event,status,conclusion,url,createdAt,updatedAt
run 'Exact-head check suites' \
gh api "repos/$repo/commits/$head/check-suites?per_page=100"
run 'Repository rulesets' \
gh api "repos/$repo/rulesets?includes_parents=true"
run 'Main branch protection' \
gh api "repos/$repo/branches/main/protection"
run 'Parent PR state and checks' \
gh pr view "$parent_pr" --repo "$repo" \
--json number,state,headRefOid,baseRefName,baseRefOid,mergeable,mergeStateStatus,statusCheckRollup,reviewDecision,url
parent_head="$(gh pr view "$parent_pr" --repo "$repo" --json headRefOid --jq .headRefOid 2>/dev/null || true)"
if [ -n "$parent_head" ]; then
run 'Parent exact-head workflow runs' \
gh run list --repo "$repo" --commit "$parent_head" --limit 100 \
--json databaseId,workflowName,headSha,event,status,conclusion,url
fiLength of output: 75052
I reviewed only I found no actionable path-specific defect in the 11-file availability slice. Static review confirms the following:
Approval is blocked by current integration and security evidence:
After You are interacting with an AI system. |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/clearfolio'
pr='295'
head='05b3f2c23ed4fc2c64e66e99016f73a0cb29e2e9'
base='ed3863209109cd24a3cf1f1d6bdcd51db16fbef1'
echo '== Commit identity and changed files =='
printf 'checked_out_head='; git rev-parse HEAD
git cat-file -e "${head}^{commit}"
git cat-file -e "${base}^{commit}"
git diff --name-status "$base" "$head"
echo '-- changed file count --'
git diff --name-only "$base" "$head" | wc -l
echo '== Diff stat =='
git diff --stat "$base" "$head"
echo '== Exact availability diff =='
git diff --find-renames --find-copies --unified=60 "$base" "$head"
echo '== Relevant file map =='
fd -HI -t f . | rg '(^|/)(HealthController|.*Health.*Test|.*Security.*|.*Filter.*|pom\.xml|AGENTS\.md|.*\.ya?ml|.*\.md)$' || true
echo '== Route and availability declarations =='
rg -n -C 5 --glob '*.java' \
'(@(?:Rest)?Controller|`@GetMapping`|/healthz|/readyz|ApplicationAvailability|LivenessState|ReadinessState|Cache-Control|no-store)' \
src/main/java src/test/java 2>/dev/null || true
echo '== Security and unauthenticated route policy =='
rg -n -C 6 --glob '*.java' \
'(SecurityWebFilterChain|authorizeExchange|pathMatchers|permitAll|authenticated|WebFilter|/healthz|/readyz)' \
src/main/java src/test/java 2>/dev/null || true
echo '== Operations documentation and APA-style reference candidates =='
rg -n -C 4 --glob '*.md' \
'(/healthz|/readyz|liveness|readiness|startupProbe|livenessProbe|readinessProbe|recovery|rollback|References|APA|Kubernetes|Spring Boot)' \
. 2>/dev/null || true
echo '== Maven coverage, Javadoc, report, SBOM/dependency configuration =='
rg -n -C 6 \
'(jacoco|javadoc|maven-javadoc-plugin|dependency-check|cyclonedx|SBOM|surefire|failsafe|verify|missed)' \
pom.xml AGENTS.md 2>/dev/null || true
echo '== Exact-head GitHub evidence =='
gh run view 31150168874 --repo "$repo" --json databaseId,headSha,headBranch,event,status,conclusion,name,url,jobs
gh run view 31150168889 --repo "$repo" --json databaseId,headSha,headBranch,event,status,conclusion,name,url,jobs
gh pr view "$pr" --repo "$repo" \
--json headRefOid,baseRefOid,baseRefName,mergeable,mergeStateStatus,reviewDecision,statusCheckRollup,reviews,url
echo '== Exact-head check runs and legacy statuses =='
gh api "repos/$repo/commits/$head/check-runs?per_page=100"
gh api "repos/$repo/commits/$head/status"Length of output: 202365 🏁 Script executed: #!/bin/bash
set -euo pipefail
head='05b3f2c23ed4fc2c64e66e99016f73a0cb29e2e9'
base='ed3863209109cd24a3cf1f1d6bdcd51db16fbef1'
repo='ContextualWisdomLab/clearfolio'
echo '== Exact changed paths =='
git diff --name-status "$base" "$head"
echo '== Changed Java source and test files =='
git diff --name-only "$base" "$head" -- 'src/main/java/**/*.java' 'src/test/java/**/*.java'
echo '== HealthController changed implementation =='
git diff --unified=120 "$base" "$head" -- \
'src/main/java/com/clearfolio/viewer/controller/HealthController.java'
echo '== HealthController changed tests =='
git diff --unified=160 "$base" "$head" -- \
'src/test/java/com/clearfolio/viewer/controller/HealthControllerTest.java'
echo '== Current HealthController and its test =='
cat -n src/main/java/com/clearfolio/viewer/controller/HealthController.java
cat -n src/test/java/com/clearfolio/viewer/controller/HealthControllerTest.java
echo '== Route security configuration =='
security_files="$(fd -HI -t f -e java . src/main/java | rg '(Security|Filter|WebFlux).*\.java$' || true)"
if [ -n "$security_files" ]; then
while IFS= read -r file; do
echo "--- $file"
cat -n "$file"
done <<< "$security_files"
fi
echo '== Operations ADR and changed availability documentation =='
cat -n docs/operations/2026-08-05-availability-probes.md
git diff --unified=80 "$base" "$head" -- \
'docs/operations/2026-08-05-availability-probes.md' \
'docs/engineering/acceptance-criteria.md' \
'ARCHITECTURE.md' \
'docs/architecture.md'
echo '== Exact coverage rule and dependency/SBOM plugins =='
sed -n '203,290p' pom.xml
rg -n -C 5 '(cyclonedx|dependency-check|trivy|semgrep|scorecard|OSV|Security Scan|SAST)' \
.github AGENTS.md pom.xml 2>/dev/null || true
echo '== Current exact-head security check state =='
gh pr checks 295 --repo "$repo" --json name,state,workflow,link
gh api "repos/$repo/commits/$head/check-suites?per_page=100" --jq \
'.check_suites[] | {app: .app.slug, status, conclusion, head_sha: .head_commit.id}'Length of output: 71739
I reviewed The 11-file slice meets the requested availability contract:
This is a no-blocker code-review conclusion, not an approval. Exact-head Codecov, Claude, and CodeRabbit suites remain queued. The successful CodeRabbit status says that review is disabled for the current base branch. It is not formal review evidence. Security Scan, SAST, Strix, protected- You are interacting with an AI system. |
|
@coderabbitai review @opencode-agent @cwl-noema-review Please independently review exact current head |
Rate Limit Exceeded
|
|
@coderabbitai review @opencode-agent @cwl-noema-review Independently review exact current head Verify the exact 11-file availability slice: process liveness versus traffic readiness; controlled Exact-head CI |
Rate Limit Exceeded
|
1 participant
Buyer-visible operational gap
Separate process liveness from traffic readiness so an orchestrator does not route requests to a live-but-unready instance.
Exact current stack
05b3f2c23ed4fc2c64e66e99016f73a0cb29e2e9;ed3863209109cd24a3cf1f1d6bdcd51db16fbef1;Availability contract
GET /healthzmaps process liveness to controlled200 {"status":"ok"}or503 {"status":"broken"}responses without coupling restart eligibility to shared-service health.GET /readyzreturns200 {"status":"ready"}only while the instance accepts traffic, otherwise503 {"status":"not_ready"}.Cache-Control: no-storeand expose no tenant, secret, topology, dependency, build, queue, credential, or exception detail.ApplicationAvailabilityrather than inventing healthy state.Exact-head evidence
For
05b3f2c23ed4fc2c64e66e99016f73a0cb29e2e9:31150168874: success.31150168889: success across all configured targets.Queued, pending, cancelled, skipped-required, absent-required, stale-head, predecessor-head, advisory-only, local-only, or synthetic-only evidence is not passing approval evidence.
Merge gate
Parent #270 must integrate first. Then reconcile this unchanged 11-file availability slice to protected
main, confirm effective diff and ancestry, rerun every exact-head and base-sensitive CI, security, coverage, documentation, review, merge-compatibility, and branch-protection gate, require a qualifying independent approval, and merge only without bypass. Do not couple liveness to shared dependencies, expose diagnostic internals, weaken controlled response labels, or reuse #265 evidence.