fix(runtime): fail closed on offline artifact misses

2026-07-30 22:19:01 +03:00
parent 81d7ad1a77
commit 8c91d40e2e
12 changed files with 510 additions and 29 deletions
@@ -63,9 +63,10 @@ gateway remains a same-process data-plane route; portable stream/media IPC is a
 separate future gate.

 `GET /api/v1/device-plugin-runtimes` exposes the small lifecycle snapshots. The
-main health response reports ready/total runtime counts. These values do not
-claim device connectivity, sensor health, process containment or durable
-supervision.
+main health response includes ready/total runtime counts as one component beside
+recording-cache, shared-artifact, media-tool and catalog-reconciler readiness.
+The plugin values still do not claim device connectivity, sensor health,
+process containment or durable supervision.

 ## Acceptance

@@ -77,6 +77,11 @@ Contour health reads only live contracts:
 - `GET /api/v1/polygon/worker`;
 - current Mission Runtime state for active device and perception metrics.

+The base health contract now separates local operational readiness from
+production shared-artifact readiness and reports bounded cache, catalog
+reconciler, media-tool and Map Gateway configuration states. It performs no
+remote fan-out and never invents Worker 006 or device health.
+
 Unknown or unavailable values remain empty/offline. The UI does not invent
 load, latency, activity or connected devices.

@@ -84,6 +84,10 @@ The integrated-perception endpoint resolves
 results. A sealed central/local CAS hit therefore needs neither Worker 006 nor
 the original E10 result tree. Invalid central metadata fails closed; a genuinely
 absent central role can still use the existing local materialization path.
+When the central store is unavailable, however, a missing local CAS role is not
+treated as an absent role: base RRD export and overlay rendering both fail with
+an explicit offline-cache error. This prevents one disconnected operator host
+from silently producing a second derived truth.

 ## Persistent pins and offline use

@@ -105,7 +109,15 @@ When the central root is unavailable:

 - a sealed local reference, manifest, and object resolve normally;
 - an absent local object returns an explicit offline-cache error;
- Mission Core does not silently fetch from Worker 006 or start a heavy AI run.
+- Mission Core does not invoke the local RRD exporter, scan stale worker
+  results, render an overlay, fetch from Worker 006 or start a heavy AI run.
+
+`GET /api/health` exposes the effective shared/standalone mode, central-store
+availability, bounded CAS and RRD-cache occupancy, media-tool availability and
+the background catalog reconciler state without disclosing filesystem paths.
+Operational readiness remains distinct from production shared-artifact
+readiness so an offline, already pinned field host stays observable rather than
+being mistaken for a fully connected host.

 ## RAVNOVES00 migration acceptance