Strict vertical RED-GREEN TDD across eight review blockers:
- drill baseline: requires every required boundary check explicitly
passing plus zero alerts of any severity before anything is announced
or flipped; unknown, degraded, malformed, missing-boundary, and
backlog-warning baselines exit 2 with switch count zero, and stdout
stays empty whenever no drill actually ran
- manual fallback: deterministic truthful states — app-down,
local-journal, none-required, and new app-state-unknown (availability
null) so unknown telemetry can never render as proven availability or
'no degradation'; runbook gains a state table with exact wording
- exact schema types: schemaVersion must be JSON number 1; counters and
latency must be finite bounded integers (0..1e6, 0..3600000);
generatedAtUtc must be canonical real UTC surviving round-trip;
releaseTag/commit keep exact safe types; coercions reject
- control-safety: controlSafe strips LF/CR too, so hostile paths can no
longer forge terminal lines (regression test ships a path embedding
LF + forged PAGE text); read errors use fixed wording instead of
echoing attacker-derived message bytes
- malformed checks reject the whole evidence object instead of silently
disappearing beside healthy checks; forbidden top-level keys now fail
closed rather than being ignored
- status/failureClass consistency: pass/unknown checks carrying any
failureClass reject the file, so all-pass evidence can never page
worker.outage (fail/degraded may stay classless, preserving the
closed vocabulary and nullable schema)
- sanitization idempotence: omitted latency stays omitted on a second
pass; explicit null latency rejects since the schema forbids it
- removed the always-false queue-depth tautology in the shared fixture
and made the runbook contract test verify each rule's real numeric
threshold against DEFAULT_ALERT_RULES
Preserved: closed failure-class vocabulary, queue depth 9/10/11 edges,
raw loopback-origin validation, app-down fallback, missing-boundary
rejection, transition semantics, and every independent drill case.
