Strict vertical RED-GREEN TDD across eight review blockers:
- drill baseline: requires every required boundary check explicitly
passing plus zero alerts of any severity before anything is announced
or flipped; unknown, degraded, malformed, missing-boundary, and
backlog-warning baselines exit 2 with switch count zero, and stdout
stays empty whenever no drill actually ran
- manual fallback: deterministic truthful states — app-down,
local-journal, none-required, and new app-state-unknown (availability
null) so unknown telemetry can never render as proven availability or
'no degradation'; runbook gains a state table with exact wording
- exact schema types: schemaVersion must be JSON number 1; counters and
latency must be finite bounded integers (0..1e6, 0..3600000);
generatedAtUtc must be canonical real UTC surviving round-trip;
releaseTag/commit keep exact safe types; coercions reject
- control-safety: controlSafe strips LF/CR too, so hostile paths can no
longer forge terminal lines (regression test ships a path embedding
LF + forged PAGE text); read errors use fixed wording instead of
echoing attacker-derived message bytes
- malformed checks reject the whole evidence object instead of silently
disappearing beside healthy checks; forbidden top-level keys now fail
closed rather than being ignored
- status/failureClass consistency: pass/unknown checks carrying any
failureClass reject the file, so all-pass evidence can never page
worker.outage (fail/degraded may stay classless, preserving the
closed vocabulary and nullable schema)
- sanitization idempotence: omitted latency stays omitted on a second
pass; explicit null latency rejects since the schema forbids it
- removed the always-false queue-depth tautology in the shared fixture
and made the runbook contract test verify each rule's real numeric
threshold against DEFAULT_ALERT_RULES
Preserved: closed failure-class vocabulary, queue depth 9/10/11 edges,
raw loopback-origin validation, app-down fallback, missing-boundary
rejection, transition semantics, and every independent drill case.
Strict RED-GREEN TDD over PR review blockers; every fix landed test-first
with the failing run observed before implementation.
- failureClass: closed privacy-safe vocabulary (worker.unavailable,
vision.timeout, model.error) under strict dotted slug grammar. Newlines,
carriage returns, ANSI/control characters, secrets, medical text, SQL,
oversized values, and off-vocabulary classes fail the entire evidence
file closed; nothing hostile can reach rendering.
- depth: added to the counter vocabulary so queue.backlog can fire at all;
bounded counters (0..1,000,000, integer) fail closed above the ceiling.
9/10/11 edge tests pin silent/at-threshold/above-threshold; backlog is
suppressed while worker.outage pages (depth is residual from the same
incident) and returns the moment the page clears.
- drill integrity: the pre-drill baseline is now read from the fixture
itself and must be genuinely healthy; already-outaged fixtures are
refused with exit 2 without touching their switch, and a flip that
produces no real healthy-to-outage transition reports DRILL FAIL
instead of passing vacuously.
- manual fallback: deterministic contract replaces the tautology.
available+none-required when healthy, available+local-journal under any
degradation, unavailable+app-down only when the app boundary itself is
down.
- fail-closed telemetry: evidence missing any of the four boundaries is
rejected; unknown statuses surface as a warn telemetry.gap alert with
owner/threshold/runbook instead of passing as healthy (documented in
the runbook inventory).
- drill origin: validateLoopbackOrigin gates every network path before
any fetch. Only a bare http://127.0.0.1:<port> URL passes; credentials,
DNS names, hex/decimal/percent-encoded IP encodings, IPv6 forms, paths,
queries, fragments, and non-http schemes are refused pre-contact
(raw-string grammar gate plus parse round-trip, because the URL parser
canonicalizes hostile encodings).
- terminal safety: controlSafe() strips C0/C1 control characters from all
dynamically produced CLI output so hostile evidence paths cannot inject
ANSI escapes into a terminal.
Gates: npm test 98/98, check:syntax, npm audit (0 vulns), check:diff,
deploy_staging status read-only; 30 adversarial probes against sanitizer,
alert edges, and live loopback CLI all pass. No merge, no deploy.
