⛔ Ungraded and unrouted — domain:*, priority and type are triage's. Filed unassigned by the domain:cli dispatching seat as the deliberate follow-up to #15366 / PR #15909, whose round raised it and correctly refused to widen into it.
What #15909 changes, and the cost it accepts
#15909 applies #13906 decision 1 option A at the runtime door: a tenancy service that is registered and failed to build is no longer absorbed into 「no posture」 but re-raised as AuthzStoreUnavailableError (503). That closes a real permissive hole — a failed security service reading as 「this check does not apply」.
resolveRequestScope reads the posture for every request, credentialed or not. So, measured on the delivery: GET /health with no credential goes 200 → 503 during such an outage.
⭐ Why that is worth its own card rather than a shrug
This runtime already separates liveness from readiness. packages/runtime/src/dispatcher-plugin.ts:1052 serves GET /health; :1068 serves GET /ready, and /ready already distinguishes running from initializing.
⇒ answering 503 on both does not preserve a distinction — it collapses one the runtime already makes, and it collapses it onto the one route whose consumer reacts by restarting the process.
⚠️ A liveness probe that reads 503 during a configuration fault restarts the pod; the tenancy service fails to build again; it restarts again. A restart cannot fix a service that cannot build. ⇒ the failure mode is a restart loop that hides the real fault, which is the opposite of what making the fault loud was for.
/ready, meanwhile, is exactly the route whose job is 「this deployment is not serving correctly」, and it is already wired to say so.
The options as the round left them, with this card's refinement
⭐ This seat's contribution, ⛔ not a ruling: the measurement above makes C the more principled shape than B, and the round could not state it because it had not measured that /ready already exists and already reports initializing. B changes when the posture is read for every anonymous request — a broader behavioural surface — to reach an outcome C reaches by naming the one route that means 「restart me」.
⚠️ ⛔ Neither is free. C needs a definition of which routes are liveness that does not become a second, drifting route list; B risks a credentialed/anonymous split in when a security-relevant value is resolved, which is its own hazard.
Published
The 503 is a wire-visible behaviour of a shipped door. @objectstack/runtime publishes; the change lands there.
⛔ What is NOT claimed
⛔ Not that #15909 should have solved this — the brief forbade widening and the round was right to refuse. ⛔ Not that A is wrong: during the outage the deployment genuinely is not serving correctly. ⛔ Not that this is urgent: it requires a tenancy service that fails to build, which #15909's own sizing notes needs an embedder factory registration or one of the loader's other unbranded rejections, with no p0 evidence of it happening.
Re-check
git show origin/main:packages/runtime/src/dispatcher-plugin.ts | grep -nE "'/health'|'/ready'"
# and on #15909's head: GET /health with no credential under a registered-and-failed tenancy build
Related
#15366 (the card) · PR #15909 (the delivery, and its adoption comment where A is ruled for that card) · #13906 decision 1 option A (the ruling being applied) · #15900 (the same collapsing probe at two other gates) · #13279 (the store-outage class this net also lets through as 503).
Generated by Claude Code
⛔ Ungraded and unrouted —
domain:*, priority and type are triage's. Filed unassigned by thedomain:clidispatching seat as the deliberate follow-up to #15366 / PR #15909, whose round raised it and correctly refused to widen into it.What #15909 changes, and the cost it accepts
#15909 applies #13906 decision 1 option A at the runtime door: a
tenancyservice that is registered and failed to build is no longer absorbed into 「no posture」 but re-raised asAuthzStoreUnavailableError(503). That closes a real permissive hole — a failed security service reading as 「this check does not apply」.resolveRequestScopereads the posture for every request, credentialed or not. So, measured on the delivery:GET /healthwith no credential goes 200 → 503 during such an outage.⭐ Why that is worth its own card rather than a shrug
This runtime already separates liveness from readiness.
packages/runtime/src/dispatcher-plugin.ts:1052servesGET /health;:1068servesGET /ready, and/readyalready distinguishesrunningfrominitializing.⇒ answering 503 on both does not preserve a distinction — it collapses one the runtime already makes, and it collapses it onto the one route whose consumer reacts by restarting the process.
/ready, meanwhile, is exactly the route whose job is 「this deployment is not serving correctly」, and it is already wired to say so.The options as the round left them, with this card's refinement
/health). This is what fix(runtime): the tenancy posture seam tells "never registered" from "registered and failed" at the runtime door #15909 ships, and it is the ruled direction; ⛔ nothing here says it was wrong to ship./healthstays 200./readyanswering 503.⭐ This seat's contribution, ⛔ not a ruling: the measurement above makes C the more principled shape than B, and the round could not state it because it had not measured that
/readyalready exists and already reportsinitializing. B changes when the posture is read for every anonymous request — a broader behavioural surface — to reach an outcome C reaches by naming the one route that means 「restart me」.Published
The 503 is a wire-visible behaviour of a shipped door.
@objectstack/runtimepublishes; the change lands there.⛔ What is NOT claimed
⛔ Not that #15909 should have solved this — the brief forbade widening and the round was right to refuse. ⛔ Not that A is wrong: during the outage the deployment genuinely is not serving correctly. ⛔ Not that this is urgent: it requires a tenancy service that fails to build, which #15909's own sizing notes needs an embedder factory registration or one of the loader's other unbranded rejections, with no p0 evidence of it happening.
Re-check
Related
#15366 (the card) · PR #15909 (the delivery, and its adoption comment where A is ruled for that card) · #13906 decision 1 option A (the ruling being applied) · #15900 (the same collapsing probe at two other gates) · #13279 (the store-outage class this net also lets through as 503).
Generated by Claude Code