feat(operations): separate liveness and readiness probes - #295
feat(operations): separate liveness and readiness probes#295seonghobae wants to merge 2 commits into
Conversation
|
Warning Review limit reached
Next review available in: 48 minutes You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (3)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
@coderabbitai review @opencode-agent @cwl-noema-review Independently review exact current head |
|
|
|
@coderabbitai review Retry exact-head review for |
|
|
|
@coderabbitai review @opencode-agent @cwl-noema-review Re-run an exact-head review for |
|
I will assess only the current availability slice. I will report path-specific findings or the current-head disposition. I will not transfer evidence from
|
|
@coderabbitai review @opencode-agent @cwl-noema-review Retry independent review of exact current head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
HEAD_SHA='c4aaab9275073927f642c2bcf3596f7efa5da1ee'
BASE_SHA='ed3863209109cd24a3cf1f1d6bdcd51db16fbef1'
REPO='ContextualWisdomLab/clearfolio'
echo '== Local commit identity and changed paths =='
git rev-parse HEAD
git cat-file -t "$HEAD_SHA"
git cat-file -t "$BASE_SHA"
git diff --name-status "$BASE_SHA" "$HEAD_SHA"
echo '== Diff stat =='
git diff --stat "$BASE_SHA" "$HEAD_SHA"
echo '== Exact diff =='
git diff --find-renames --find-copies --unified=80 "$BASE_SHA" "$HEAD_SHA"
echo '== GitHub PR identity, mergeability, and check rollup =='
gh pr view 295 --repo "$REPO" --json number,state,headRefOid,baseRefOid,mergeStateStatus,mergeable,statusCheckRollup,url
echo '== Exact-head check suites =='
gh api "repos/$REPO/commits/$HEAD_SHA/check-suites?per_page=100" --paginate
echo '== Exact-head legacy statuses =='
gh api "repos/$REPO/commits/$HEAD_SHA/status"
echo '== Repository branch protection / rulesets summary =='
gh api "repos/$REPO/branches/main/protection" 2>&1 || true
gh api "repos/$REPO/rulesets?includes_parents=true" 2>&1 || trueLength of output: 117319 🏁 Script executed: #!/bin/bash
set -euo pipefail
echo '== Candidate files =='
fd -HI '^(pom\.xml|AGENTS\.md|.*\.ya?ml|.*\.java|.*\.py)$' .github src scripts . 2>/dev/null | \
rg '(^|/)(pom\.xml|AGENTS\.md|.*(?:Security|Filter|HealthController|Application)\.java|.*(?:HealthController|Security|Filter).*Test\.java|.*\.ya?ml|.*\.py)$' || true
echo '== Java route/security/filter declarations and availability usage =='
rg -n -C 5 --glob '*.java' \
'(SecurityWebFilterChain|WebFilter|HandlerFilterFunction|`@RequestMapping`|`@GetMapping`|/healthz|/readyz|ApplicationAvailability|LivenessState|ReadinessState)' \
src/main/java src/test/java
echo '== Build lifecycle, coverage, Javadoc, and script-test configuration =='
rg -n -C 6 \
'(jacoco|maven-javadoc-plugin|maven-surefire-plugin|exec-maven-plugin|verify_maven_test_reports|scripts|<phase>verify</phase>|<includes>|<excludes>)' \
pom.xml AGENTS.md 2>/dev/null || true
echo '== Workflow inventory and triggers =='
fd -HI -e yml -e yaml .github 2>/dev/null | while IFS= read -r file; do
echo "--- $file"
sed -n '1,260p' "$file"
done
echo '== Full active rulesets =='
gh api 'repos/ContextualWisdomLab/clearfolio/rulesets/18156473?includes_parents=true'
gh api 'repos/ContextualWisdomLab/clearfolio/rulesets/13042993?includes_parents=true'
echo '== Required check contexts reported by GitHub for PR `#295` =='
gh pr checks 295 --repo ContextualWisdomLab/clearfolio --required --json name,state,workflow,link 2>&1 || trueLength of output: 69522 🏁 Script executed: #!/bin/bash
set -euo pipefail
echo '== Health controller and only applicable WebFilter =='
cat -n src/main/java/com/clearfolio/viewer/controller/HealthController.java
cat -n src/main/java/com/clearfolio/viewer/config/ViewerSecurityHeadersWebFilter.java
echo '== Maven gate definitions =='
sed -n '175,275p' pom.xml
echo '== Repository gate instructions =='
sed -n '1,115p' AGENTS.md
echo '== CI workflow =='
cat -n .github/workflows/ci.yml
echo '== Fuzz workflow =='
cat -n .github/workflows/fuzz.yml
echo '== Pull request merge commit and review state =='
gh pr view 295 --repo ContextualWisdomLab/clearfolio \
--json headRefOid,baseRefName,baseRefOid,mergeCommit,reviews,reviewDecision,statusCheckRollup
echo '== Check runs for the PR merge commit, if GitHub has created one =='
merge_sha="$(gh pr view 295 --repo ContextualWisdomLab/clearfolio --json mergeCommit --jq '.mergeCommit.oid // empty')"
if [ -n "$merge_sha" ]; then
printf 'merge_sha=%s\n' "$merge_sha"
gh api "repos/ContextualWisdomLab/clearfolio/commits/$merge_sha/check-runs?per_page=100"
else
echo 'No GitHub synthetic merge commit is available.'
fiLength of output: 29709
I reviewed only I found no actionable path-specific defect in the 11-file availability slice. Static review confirms:
Approval is blocked by current evidence:
After You are interacting with an AI system. |
|
@coderabbitai review @opencode-agent @cwl-noema-review Re-run an independent review of exact current head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/clearfolio'
pr='295'
head='c4aaab9275073927f642c2bcf3596f7efa5da1ee'
base='ed3863209109cd24a3cf1f1d6bdcd51db16fbef1'
echo '== Commit identity and exact changed paths =='
printf 'checked-out HEAD: '; git rev-parse HEAD
git cat-file -e "${head}^{commit}"
git cat-file -e "${base}^{commit}"
git diff --name-status "$base" "$head"
git diff --stat "$base" "$head"
echo '== Exact availability-slice diff =='
git diff --find-renames --unified=40 "$base" "$head"
echo '== Relevant source and test structure =='
fd -HI -t f . | rg '(^|/)(HealthController|ViewerSecurityHeadersWebFilter|.*Health.*Test|pom\.xml|AGENTS\.md|.*\.ya?ml|.*\.md)$' || true
for f in \
src/main/java/com/clearfolio/viewer/controller/HealthController.java \
src/main/java/com/clearfolio/viewer/config/ViewerSecurityHeadersWebFilter.java \
pom.xml \
AGENTS.md \
.github/workflows/ci.yml \
.github/workflows/fuzz.yml
do
if [ -f "$f" ]; then
echo "--- $f"
cat -n "$f"
fi
done
echo '== Route, availability, test assertion, documentation, coverage, and Javadoc references =='
rg -n -C 4 \
--glob '*.java' --glob '*.xml' --glob '*.md' --glob '*.yml' --glob '*.yaml' \
'(/healthz|/readyz|ApplicationAvailability|LivenessState|ReadinessState|Cache-Control|no-store|status"\s*:|status\(|assertThat|jacoco|javadoc|livenessProbe|readinessProbe|startupProbe)' \
src pom.xml AGENTS.md .github 2>/dev/null || true
echo '== Pull request state and current check rollup =='
gh pr view "$pr" --repo "$repo" \
--json number,state,headRefOid,baseRefName,baseRefOid,mergeable,mergeStateStatus,mergeCommit,reviewDecision,statusCheckRollup,url
echo '== Exact-head check runs, check suites, and legacy statuses =='
gh api "repos/$repo/commits/$head/check-runs?per_page=100"
gh api "repos/$repo/commits/$head/check-suites?per_page=100"
gh api "repos/$repo/commits/$head/status"
echo '== Synthetic-merge evidence, when GitHub has a merge commit =='
merge_sha="$(gh pr view "$pr" --repo "$repo" --json mergeCommit --jq '.mergeCommit.oid // empty')"
if [ -n "$merge_sha" ]; then
printf 'synthetic_merge_sha=%s\n' "$merge_sha"
gh api "repos/$repo/commits/$merge_sha/check-runs?per_page=100"
gh api "repos/$repo/commits/$merge_sha/check-suites?per_page=100"
gh api "repos/$repo/commits/$merge_sha/status"
else
echo 'No synthetic merge commit is available.'
fi
echo '== Required check contexts and applicable repository rules =='
gh pr checks "$pr" --repo "$repo" --required --json name,state,workflow,link 2>&1 || true
gh api "repos/$repo/branches/main/protection" 2>&1 || true
gh api "repos/$repo/rulesets?includes_parents=true" 2>&1 || trueLength of output: 211776
I reviewed only head I found no actionable path-specific defect in the 11-file availability slice. Static review confirms:
Approval is blocked by current evidence:
After You are interacting with an AI system. |
|
@coderabbitai review @opencode-agent @cwl-noema-review Independently review exact current head |
|
@coderabbitai review @opencode-agent @cwl-noema-review Independently review exact current head Verify the 11-file availability slice: Spring Exact-head CI |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/clearfolio'
pr='295'
head='05b3f2c23ed4fc2c64e66e99016f73a0cb29e2e9'
base='ed3863209109cd24a3cf1f1d6bdcd51db16fbef1'
echo '== Exact commit identity and bounded change list =='
printf 'checked_out_head='; git rev-parse HEAD
git cat-file -e "${head}^{commit}"
git cat-file -e "${base}^{commit}"
git diff --name-status "$base" "$head"
git diff --stat "$base" "$head"
echo '== Exact availability-slice diff =='
git diff --find-renames --find-copies --unified=60 "$base" "$head"
echo '== Candidate source structure =='
fd -HI -t f . | rg '(^|/)(HealthController|ViewerSecurityHeadersWebFilter|.*Health.*Test|pom\.xml|AGENTS\.md|.*\.ya?ml|.*\.md)$' || true
echo '== Health controller outline =='
health_file="$(fd -HI -t f '^HealthController\.java$' src 2>/dev/null | head -n1 || true)"
if [ -n "$health_file" ]; then
ast-grep outline "$health_file" --items all --view expanded
echo "--- $health_file"
cat -n "$health_file"
fi
echo '== Availability routes, tests, documentation, coverage, and Javadoc configuration =='
rg -n -C 5 \
--glob '*.java' --glob '*.xml' --glob '*.md' --glob '*.yml' --glob '*.yaml' \
'(/healthz|/readyz|ApplicationAvailability|LivenessState|ReadinessState|Cache-Control|no-store|status"\s*:|assertThat|jacoco|javadoc|livenessProbe|readinessProbe|startupProbe|APA)' \
src pom.xml AGENTS.md .github 2>/dev/null || true
echo '== Exact-head PR state, reviews, and checks =='
gh pr view "$pr" --repo "$repo" \
--json number,state,headRefOid,baseRefName,baseRefOid,mergeable,mergeStateStatus,mergeCommit,reviewDecision,reviews,statusCheckRollup,url
echo '== Named exact-head workflow runs =='
gh run view 31150168874 --repo "$repo" --json databaseId,headSha,event,status,conclusion,name,workflowName,url,jobs
gh run view 31150168889 --repo "$repo" --json databaseId,headSha,event,status,conclusion,name,workflowName,url,jobs
echo '== Exact-head check runs and status =='
gh api "repos/$repo/commits/$head/check-runs?per_page=100"
gh api "repos/$repo/commits/$head/status"
echo '== Synthetic-merge evidence when available =='
merge_sha="$(gh pr view "$pr" --repo "$repo" --json mergeCommit --jq '.mergeCommit.oid // empty')"
if [ -n "$merge_sha" ]; then
printf 'synthetic_merge_sha=%s\n' "$merge_sha"
gh api "repos/$repo/commits/$merge_sha/check-runs?per_page=100"
gh api "repos/$repo/commits/$merge_sha/status"
else
echo 'No synthetic merge commit is available.'
fi
echo '== Required checks for the current target =='
gh pr checks "$pr" --repo "$repo" --required --json name,state,workflow,link 2>&1 || trueLength of output: 176591 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/clearfolio'
pr='295'
head='05b3f2c23ed4fc2c64e66e99016f73a0cb29e2e9'
parent_pr='270'
echo '== Repository workflow definitions =='
fd -HI -t f -e yml -e yaml .github/workflows 2>/dev/null | sort | while IFS= read -r file; do
echo "--- $file"
cat -n "$file"
done
echo '== All workflow runs associated with the exact head =='
gh run list --repo "$repo" --commit "$head" --limit 100 \
--json databaseId,workflowName,headSha,event,status,conclusion,url,createdAt,updatedAt
echo '== Exact-head check suites by workflow application =='
gh api "repos/$repo/commits/$head/check-suites?per_page=100"
echo '== Current repository rulesets and main protection =='
gh api "repos/$repo/rulesets?includes_parents=true" 2>&1 || true
gh api "repos/$repo/branches/main/protection" 2>&1 || true
echo '== Parent PR current identity and check evidence (context only) =='
gh pr view "$parent_pr" --repo "$repo" \
--json number,state,headRefOid,baseRefName,baseRefOid,mergeable,mergeStateStatus,statusCheckRollup,reviewDecision,url
parent_head="$(gh pr view "$parent_pr" --repo "$repo" --json headRefOid --jq .headRefOid)"
printf 'parent_head=%s\n' "$parent_head"
gh run list --repo "$repo" --commit "$parent_head" --limit 100 \
--json databaseId,workflowName,headSha,event,status,conclusion,urlLength of output: 1689 🏁 Script executed: #!/bin/bash
set -u
repo='ContextualWisdomLab/clearfolio'
head='05b3f2c23ed4fc2c64e66e99016f73a0cb29e2e9'
parent_pr='270'
run() {
echo "== $1 =="
shift
"$@" || echo "[command failed: $*]"
}
run 'GitHub workflow inventory' \
gh workflow list --repo "$repo"
run 'All exact-head workflow runs' \
gh run list --repo "$repo" --commit "$head" --limit 100 \
--json databaseId,workflowName,headSha,event,status,conclusion,url,createdAt,updatedAt
run 'Exact-head check suites' \
gh api "repos/$repo/commits/$head/check-suites?per_page=100"
run 'Repository rulesets' \
gh api "repos/$repo/rulesets?includes_parents=true"
run 'Main branch protection' \
gh api "repos/$repo/branches/main/protection"
run 'Parent PR state and checks' \
gh pr view "$parent_pr" --repo "$repo" \
--json number,state,headRefOid,baseRefName,baseRefOid,mergeable,mergeStateStatus,statusCheckRollup,reviewDecision,url
parent_head="$(gh pr view "$parent_pr" --repo "$repo" --json headRefOid --jq .headRefOid 2>/dev/null || true)"
if [ -n "$parent_head" ]; then
run 'Parent exact-head workflow runs' \
gh run list --repo "$repo" --commit "$parent_head" --limit 100 \
--json databaseId,workflowName,headSha,event,status,conclusion,url
fiLength of output: 75052
I reviewed only I found no actionable path-specific defect in the 11-file availability slice. Static review confirms the following:
Approval is blocked by current integration and security evidence:
After You are interacting with an AI system. |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/clearfolio'
pr='295'
head='05b3f2c23ed4fc2c64e66e99016f73a0cb29e2e9'
base='ed3863209109cd24a3cf1f1d6bdcd51db16fbef1'
echo '== Commit identity and changed files =='
printf 'checked_out_head='; git rev-parse HEAD
git cat-file -e "${head}^{commit}"
git cat-file -e "${base}^{commit}"
git diff --name-status "$base" "$head"
echo '-- changed file count --'
git diff --name-only "$base" "$head" | wc -l
echo '== Diff stat =='
git diff --stat "$base" "$head"
echo '== Exact availability diff =='
git diff --find-renames --find-copies --unified=60 "$base" "$head"
echo '== Relevant file map =='
fd -HI -t f . | rg '(^|/)(HealthController|.*Health.*Test|.*Security.*|.*Filter.*|pom\.xml|AGENTS\.md|.*\.ya?ml|.*\.md)$' || true
echo '== Route and availability declarations =='
rg -n -C 5 --glob '*.java' \
'(@(?:Rest)?Controller|`@GetMapping`|/healthz|/readyz|ApplicationAvailability|LivenessState|ReadinessState|Cache-Control|no-store)' \
src/main/java src/test/java 2>/dev/null || true
echo '== Security and unauthenticated route policy =='
rg -n -C 6 --glob '*.java' \
'(SecurityWebFilterChain|authorizeExchange|pathMatchers|permitAll|authenticated|WebFilter|/healthz|/readyz)' \
src/main/java src/test/java 2>/dev/null || true
echo '== Operations documentation and APA-style reference candidates =='
rg -n -C 4 --glob '*.md' \
'(/healthz|/readyz|liveness|readiness|startupProbe|livenessProbe|readinessProbe|recovery|rollback|References|APA|Kubernetes|Spring Boot)' \
. 2>/dev/null || true
echo '== Maven coverage, Javadoc, report, SBOM/dependency configuration =='
rg -n -C 6 \
'(jacoco|javadoc|maven-javadoc-plugin|dependency-check|cyclonedx|SBOM|surefire|failsafe|verify|missed)' \
pom.xml AGENTS.md 2>/dev/null || true
echo '== Exact-head GitHub evidence =='
gh run view 31150168874 --repo "$repo" --json databaseId,headSha,headBranch,event,status,conclusion,name,url,jobs
gh run view 31150168889 --repo "$repo" --json databaseId,headSha,headBranch,event,status,conclusion,name,url,jobs
gh pr view "$pr" --repo "$repo" \
--json headRefOid,baseRefOid,baseRefName,mergeable,mergeStateStatus,reviewDecision,statusCheckRollup,reviews,url
echo '== Exact-head check runs and legacy statuses =='
gh api "repos/$repo/commits/$head/check-runs?per_page=100"
gh api "repos/$repo/commits/$head/status"Length of output: 202365 🏁 Script executed: #!/bin/bash
set -euo pipefail
head='05b3f2c23ed4fc2c64e66e99016f73a0cb29e2e9'
base='ed3863209109cd24a3cf1f1d6bdcd51db16fbef1'
repo='ContextualWisdomLab/clearfolio'
echo '== Exact changed paths =='
git diff --name-status "$base" "$head"
echo '== Changed Java source and test files =='
git diff --name-only "$base" "$head" -- 'src/main/java/**/*.java' 'src/test/java/**/*.java'
echo '== HealthController changed implementation =='
git diff --unified=120 "$base" "$head" -- \
'src/main/java/com/clearfolio/viewer/controller/HealthController.java'
echo '== HealthController changed tests =='
git diff --unified=160 "$base" "$head" -- \
'src/test/java/com/clearfolio/viewer/controller/HealthControllerTest.java'
echo '== Current HealthController and its test =='
cat -n src/main/java/com/clearfolio/viewer/controller/HealthController.java
cat -n src/test/java/com/clearfolio/viewer/controller/HealthControllerTest.java
echo '== Route security configuration =='
security_files="$(fd -HI -t f -e java . src/main/java | rg '(Security|Filter|WebFlux).*\.java$' || true)"
if [ -n "$security_files" ]; then
while IFS= read -r file; do
echo "--- $file"
cat -n "$file"
done <<< "$security_files"
fi
echo '== Operations ADR and changed availability documentation =='
cat -n docs/operations/2026-08-05-availability-probes.md
git diff --unified=80 "$base" "$head" -- \
'docs/operations/2026-08-05-availability-probes.md' \
'docs/engineering/acceptance-criteria.md' \
'ARCHITECTURE.md' \
'docs/architecture.md'
echo '== Exact coverage rule and dependency/SBOM plugins =='
sed -n '203,290p' pom.xml
rg -n -C 5 '(cyclonedx|dependency-check|trivy|semgrep|scorecard|OSV|Security Scan|SAST)' \
.github AGENTS.md pom.xml 2>/dev/null || true
echo '== Current exact-head security check state =='
gh pr checks 295 --repo "$repo" --json name,state,workflow,link
gh api "repos/$repo/commits/$head/check-suites?per_page=100" --jq \
'.check_suites[] | {app: .app.slug, status, conclusion, head_sha: .head_commit.id}'Length of output: 71739
I reviewed The 11-file slice meets the requested availability contract:
This is a no-blocker code-review conclusion, not an approval. Exact-head Codecov, Claude, and CodeRabbit suites remain queued. The successful CodeRabbit status says that review is disabled for the current base branch. It is not formal review evidence. Security Scan, SAST, Strix, protected- You are interacting with an AI system. |
|
@coderabbitai review @opencode-agent @cwl-noema-review Please independently review exact current head |
Rate Limit Exceeded
|
|
@coderabbitai review @opencode-agent @cwl-noema-review Independently review exact current head Verify the exact 11-file availability slice: process liveness versus traffic readiness; controlled Exact-head CI |
Rate Limit Exceeded
|
05b3f2c to
3c78219
Compare
|
@opencode-agent @cwl-noema-review Please independently review exact current head |
1 participant
Buyer-visible operational gap
Separate process liveness from traffic readiness so an orchestrator does not route requests to a live-but-unready instance or restart a recoverable process during a temporary readiness condition.
Fresh exact state — 2026-08-10
c483c87dcac8568756e36127eeba3055343353e4;main:55d7ae8647208e301f282350f076eeddaba61d11after protected merge of fix(security): harden audit pseudonymization and refresh Netty evidence #270;31388207104: success;31388207985: success;31388207139: success;31388207812: success;The former divergent stack and predecessor runs are historical. The feature was rebuilt directly on protected main. The dedicated operations document is no longer presented as a competing canonical ADR; it identifies ADR-0006 in the canonical documentation line as the decision owner.
Availability contract
GET /healthzmaps Spring Boot process liveness to controlled200 {"status":"ok"}or503 {"status":"broken"}without coupling restart eligibility to shared-service health;GET /readyzreturns200 {"status":"ready"}only while the instance accepts traffic, otherwise503 {"status":"not_ready"};Cache-Control: no-storeand expose no tenant, secret, topology, dependency, build, queue, credential, or exception detail;ApplicationAvailabilityrather than inventing healthy state;Clean changed paths
src/main/java/com/clearfolio/viewer/controller/HealthController.javasrc/test/java/com/clearfolio/viewer/controller/HealthControllerTest.javadocs/operations/2026-08-05-availability-probes.mdRoot README, Architecture, CLAUDE, CHANGELOG, engineering acceptance, and shared security documents were intentionally not copied from the historical branch. PR #305 owns the canonical cross-cutting graph and can classify this exact slice without one feature PR overwriting current protected-main evidence.
Merge gate
Move to Ready for ordinary independent review. Merge only if this unchanged exact head continues to satisfy every live required check, zero valid unresolved findings, the counted write-authorized independent approval required by repository policy, and expected-head-safe protection. Never infer approval from checks or reuse predecessor-base evidence.