usps-support 0.2.49 → 0.2.51

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 5764f3cd03bbd09cf0cc9be4873c9ecba705c6f4a5676058a6577de01999a66f
-  data.tar.gz: 50784833a152814d04f12ad8785f2d4c6199b0b88af40ead54c7d0e8c6a0cdf9
+  metadata.gz: 3b6c4b733379c3005f044d0d8e780dcb4b9f1c37124f97ff61eaf3ab5844ba81
+  data.tar.gz: 00c8be1ab0bc6fa06aac0a195a431ed055300d1be7e44441a13d106045bfc01d
 SHA512:
-  metadata.gz: 1ad1f146fd493edbeb08d110abb5de5b825cb5ab93ef494c6f8e12b554615a056940acf8d9ef9a3f39f64fb6ea2adba5ac7f8870282cecd4dd838f2aa01547fd
-  data.tar.gz: 6d0a9a31c61db44949f1852853f53e2eb29b6b47cb2aa828398cdc1492f81d29c511d250eae688463a5f018b418a64949bd071bec798db7bd8ff23cb790b98db
+  metadata.gz: 1bfca2dd2afc4080aa03b98fb2c1fa88d3049e1c9db9415ae6bd096b14196135718f1846af24900e6db82f82a8c30c3055bd866aa5e187666def7999834b03b7
+  data.tar.gz: 758b292a1469fd630c0b2281f5ee9db88d0b97a96d2339c19983c4aabd9e1426f12a54762c7547e8b8217abc80d3a6b4629984aa7e52457b7d0475dae4843455

data/app/controllers/concerns/usps/support/dependency_gate.rb

@@ -0,0 +1,148 @@
+# frozen_string_literal: true
+
+module Usps::Support
+  # Fails requests fast, with the branded 503 page, while a dependency the app cannot work without
+  # is known to be down — instead of letting every request discover that for itself by blocking on
+  # the dead dependency.
+  #
+  # ## Why
+  #
+  # The HQ member database is in the request path of *every authenticated request*:
+  # `authenticate_user_from_jwt!` resolves the JWT's certificate through `Members::Member.find`.
+  # While HQ is unreachable each of those requests blocks until the database client's connect
+  # timeout expires, then raises a connection error that ApplicationController rescues into the 503
+  # page. The page is correct; paying a connect timeout to produce it is what hurts. The web tier
+  # serves a small, fixed number of requests concurrently, so a per-request stall of seconds is
+  # enough to occupy every worker: requests queue, nginx gives up on the upstream, and an app that
+  # is *up and answering correctly* reads to users as hard down.
+  #
+  # This gate closes that gap: the app already *knows* HQ is down, because HealthController's
+  # monitor probes it on a background thread and leaves the verdict in memory (see
+  # health_check_refresh_design.md). Consulting that costs no I/O and no worker time, so the request
+  # returns the same 503 immediately instead of after a timeout.
+  #
+  # ## Contract
+  #
+  # - **/health is untouched.** The gate is a *reader* of the snapshot; it never runs a check, never
+  #   changes what /health probes, renders, or reports to CloudWatch. The synthetic probes and
+  #   Statuspage components keep behaving exactly as they do today — the app's own gating must never
+  #   become the thing that decides whether we call ourselves up.
+  # - **Never blocks.** It reads the last completed snapshot only (HealthMonitor#cached), so a
+  #   process that has not yet run a round serves the request normally rather than paying for a
+  #   round on the request thread.
+  # - **Fails open.** No snapshot, a stale one (a wedged refresher), or any error reading it means
+  #   "no opinion" and the request proceeds — the pre-existing `rescue_from` for the connection
+  #   errors is still the backstop, so failing open costs latency, never correctness.
+  # - **Requires a sustained failure.** Gating opens only after `dependency_gate_threshold`
+  #   consecutive failed rounds, so a single slow round — one that merely overran its check budget —
+  #   can't blackhole a healthy app. It closes again on the first passing round, with no deploy or
+  #   restart needed.
+  #
+  # ## Wiring
+  #
+  #   class ApplicationController < ActionController::Base
+  #     include Usps::Support::DependencyGate
+  #     self.dependency_gate_title = 'Exams System'
+  #   end
+  #
+  # `gated_dependencies` defaults to `%i[hq_database]` — the only check that is in the user request
+  # path. iMIS deliberately is not: it is an external service reached outside the VPN and is touched
+  # only by rescued admin reports and Sidekiq jobs, so an iMIS outage must not gate the app.
+  #
+  # Actions that genuinely do not need the gated dependency opt out the same way they opt out of
+  # authentication, and for the same reason — keeping work that still functions during an HQ outage
+  # (e.g. the unauthenticated online-examination flow, which lives entirely in RDS) working:
+  #
+  #   skip_before_action :require_gated_dependencies!, only: %i[exam submit_response]
+  #
+  module DependencyGate
+    extend ActiveSupport::Concern
+
+    included do
+      # Checks (by their HealthController CHECKS name) that must be up for a request to be served.
+      class_attribute :gated_dependencies, default: %i[hq_database]
+
+      # Consecutive failed check rounds before the gate opens; rounds are health_refresh_interval
+      # apart, so this trades detection speed against tolerance for a one-off slow round.
+      class_attribute :dependency_gate_threshold, default: 2
+
+      # Title for the rendered error page, matching what the rescue path uses ('Exams System').
+      class_attribute :dependency_gate_title, default: nil
+
+      # The app's HealthController subclass, whose monitor owns the snapshot. Resolved lazily (and
+      # by name) so this loads cleanly in an app whose controllers autoload later.
+      class_attribute :dependency_gate_health_controller, default: -> { ::HealthController }
+
+      # Runs before every other filter — notably before authentication, which is itself what reaches
+      # HQ and would block.
+      prepend_before_action :require_gated_dependencies!
+    end
+
+    # Logs gate open/close transitions once per process rather than once per request: during an
+    # outage every request is gated, and a per-request line would bury everything else in the log.
+    # A race between threads can duplicate a line; that is cheaper than a lock on the request path.
+    def self.log_transition(down)
+      return if @down == down
+
+      was_open = @down.present?
+      @down = down
+
+      if down.any?
+        ::Rails.logger.warn("[dependency-gate] open: #{down.join(', ')} down, serving 503 until recovered")
+      elsif was_open
+        ::Rails.logger.warn('[dependency-gate] closed: gated dependencies recovered, serving normally')
+      end
+      # A process whose first request is already healthy has nothing to announce.
+    end
+
+    # Forgets the last logged state. For tests.
+    def self.reset_transition_log! = @down = nil
+
+  private
+
+    def require_gated_dependencies!
+      down = unavailable_dependencies
+      DependencyGate.log_transition(down)
+      return if down.empty?
+
+      render_dependencies_unavailable
+    end
+
+    # Gated dependencies whose failure has persisted for at least the threshold. Anything the
+    # snapshot has no entry for — unknown, cold, or stale — is absent from the status hash and so
+    # reads as available (fail open).
+    def unavailable_dependencies
+      status = dependency_gate_status
+
+      gated_dependencies.select { |name| status.dig(name, :consecutive_failures).to_i >= dependency_gate_threshold }
+    end
+
+    # Deliberately swallows everything: a gate that raises would turn a degraded app into a broken
+    # one, which is the opposite of the point.
+    def dependency_gate_status
+      dependency_gate_health_controller.call.dependency_status
+    rescue StandardError => e
+      ::Rails.logger.warn("[dependency-gate] status unavailable (#{e.class}: #{e.message}); serving normally")
+      {}
+    end
+
+    # The same branded 503 the ActiveRecord rescue path renders, so a gated request is
+    # indistinguishable to a user (and to a browser, which honours Retry-After) from one that
+    # discovered the outage the slow way. No Bugsnag notify: unlike the rescue path this fires on
+    # *every* request for the duration of an outage, and the CloudWatch alarm and Statuspage
+    # component already own that signal.
+    #
+    # The `error` layout is required — the application layout reads `current_user`, which would
+    # reconnect to the unavailable HQ database from inside the handler.
+    def render_dependencies_unavailable
+      @title = dependency_gate_title
+      response.set_header('Retry-After', '30')
+
+      respond_to do |format|
+        format.html { render('errors/service_unavailable', layout: 'error', status: :service_unavailable) }
+        format.json { render(json: { error: 'Service unavailable.' }, status: :service_unavailable) }
+        format.any  { head(:service_unavailable) }
+      end
+    end
+  end
+end

data/app/controllers/usps/support/health_controller.rb

@@ -1,14 +1,14 @@
 # frozen_string_literal: true
 
 require 'net/http'
+require 'timeout'
 
 module Usps::Support
   # Base controller for external synthetic health probes (see the infrastructure repo's
   # doc/application_health_probes.md). Unlike Rails' /up (boot-only) and nginx's static
   # /instance-health-check, this exercises an app's *critical dependencies* and returns the sentinel
-  # "HEALTHCHECK_OK <app>" only when every check passes — a Route 53 HTTPS_STR_MATCH probe asserts
-  # the "HEALTHCHECK_OK" prefix, so a quiet app-level failure flips the Statuspage component even
-  # with no organic traffic.
+  # "HEALTHCHECK_OK <app>" only when every check passes, so a Route 53 HTTPS_STR_MATCH probe
+  # asserting that prefix flips the Statuspage component even with no organic traffic.
   #
   # Host apps subclass this and declare which dependencies to probe with a CHECKS constant — a list
   # of symbols, each naming a #check_<symbol> method:
@@ -17,15 +17,18 @@ module Usps::Support
   #     CHECKS = %i[database redis hq_database imis].freeze
   #   end
   #
-  # and route to it (`get 'health' => 'health#show'`). Each check_* primitive returns a boolean or
-  # raises; the base times every check and treats a raise as a failed check, so the action always
-  # responds. Apps run only the checks they list — admin-console has no HQ connection, so it omits
-  # :hq_database; an iMIS-backed app adds :imis. For a bespoke dependency, define a #check_<name> in
-  # the subclass (e.g. wrapping #check_http(url)) and add <name> to CHECKS.
+  # and route to it (`get 'health' => 'health#show'`). For a bespoke dependency, define a
+  # #check_<name> in the subclass (e.g. wrapping #check_http(url)) and add <name> to CHECKS.
   #
-  # Every probe's per-component results (ok, latency, error) are also handed to
-  # Usps::Support::HealthDiagnostics, which — when enabled — publishes them to CloudWatch so a past
-  # failure can be attributed to a specific component after it has recovered.
+  # Checks run on a background thread, not the request thread: a per-process refresher updates a
+  # cached snapshot every health_refresh_interval seconds and #show serves that snapshot, so a slow
+  # or wedged dependency can't tie up the Passenger worker pool. Each check also runs under
+  # health_check_timeout, and a raise or timeout reads as a failed check (its error captured) so the
+  # action always responds. See doc/health_check_refresh_design.md.
+  #
+  # Per-component results (ok, latency, error) are handed to Usps::Support::HealthDiagnostics once
+  # per refresh which — when enabled — publishes them to CloudWatch so a past failure can be
+  # attributed to a specific component after it has recovered.
   #
   # Inherits ActionController::Base directly — NOT the host's ApplicationController — to bypass
   # Devise auth, Pundit authorization, PaperTrail, and especially `allow_browser`, whose
@@ -34,47 +37,136 @@ module Usps::Support
   class HealthController < ActionController::Base # rubocop:disable Rails/ApplicationController
     SENTINEL_PREFIX = 'HEALTHCHECK_OK'
 
+    # Raised when a single check overruns the per-check timeout; recorded as a failed check.
+    class CheckTimeout < StandardError; end
+
     # Symbols naming the dependency checks to run; each invokes the matching #check_<symbol>.
     # Override per app by defining a CHECKS constant. Default probes the primary database only,
     # which presumably every app needs.
     CHECKS = %i[database].freeze
 
+    # Tunables (overridable per subclass, e.g. `self.health_check_timeout = 1` or in a test):
+    #   health_check_timeout      — per-check budget in seconds; a check that overruns is a failure
+    #   health_refresh_interval   — seconds between background refreshes of the cached snapshot
+    #   health_snapshot_max_age   — a cached snapshot older than this is refreshed inline before serving
+    #   health_background_refresh — run the background refresher; off under test, where refreshes run
+    #                               synchronously and an unannounced thread probing real dependencies
+    #                               (DependencyGate starts one from any request) would be a surprise
+    #   health_status_max_age     — .dependency_status ignores a snapshot older than this (fails open)
+    class_attribute :health_check_timeout, default: 2
+    class_attribute :health_refresh_interval, default: 15
+    class_attribute :health_snapshot_max_age, default: 45
+    class_attribute :health_background_refresh, default: !::Rails.env.test?
+    class_attribute :health_status_max_age, default: 90
+
+    class << self
+      # One monitor per concrete subclass, per process. Built lazily so the background thread starts
+      # after Passenger forks its workers (threads do not survive fork).
+      def health_monitor
+        klass = self
+        @health_monitor ||= HealthMonitor.new(
+          interval: health_refresh_interval,
+          max_age: health_snapshot_max_age,
+          background: health_background_refresh,
+          runner: -> { klass.new.send(:run_and_record) }
+        )
+      end
+
+      # Read-only, non-blocking view of the last completed round, for callers on a *user* request
+      # thread — specifically Usps::Support::DependencyGate, which uses it to fail a request fast
+      # rather than discovering the outage by blocking on the dead dependency itself:
+      #
+      #   { hq_database: { ok: false, consecutive_failures: 4 }, database: { ok: true, ... } }
+      #
+      # Runs no check and takes no lock; it reads whatever the background refresher last stored.
+      # Returns {} — "no opinion", so callers fail *open* — when no round has completed yet (cold
+      # worker) or the snapshot has aged past health_status_max_age, which means the refresher itself
+      # is wedged and its last verdict is no longer evidence about the dependency.
+      def dependency_status
+        snapshot = health_monitor.cached
+        return {} unless snapshot && health_monitor.age_of(snapshot) <= health_status_max_age
+
+        snapshot.data&.[](:status) || {}
+      end
+
+      # Consecutive failed rounds per check, updated once per refresh so a gate can require a
+      # *sustained* failure and ignore a single slow round. Called only from the monitor's runner,
+      # and the monitor serialises refreshes under its own mutex, so this needs no lock of its own.
+      def record_streaks(results)
+        @streaks ||= Hash.new(0)
+        results.each { |name, ok| ok ? @streaks[name] = 0 : @streaks[name] += 1 }
+        results.to_h { |name, ok| [name, { ok:, consecutive_failures: @streaks[name] }] }
+      end
+
+      # Drops the memoized monitor (stopping its thread) and the failure streaks. For tests.
+      def reset_health_monitor!
+        @health_monitor&.stop
+        @health_monitor = nil
+        @streaks = nil
+      end
+    end
+
     def show
-      results = checks
-      healthy = results.values.all?
+      data = self.class.health_monitor.current
+      return render_unavailable unless data
 
-      body = "#{healthy ? "#{SENTINEL_PREFIX} #{app_name}" : "HEALTHCHECK_FAIL #{app_name}"}\n"
-      results.each { |name, ok| body << "#{name}=#{ok ? 'ok' : 'fail'}\n" }
+      render_health(data)
+    end
+
+  private
+
+    # Renders the sentinel line, per-check status lines, and cache/retry headers from a snapshot.
+    def render_health(data)
+      healthy = data[:results].values.all?
+
+      body = "#{healthy ? "#{SENTINEL_PREFIX} #{data[:app]}" : "HEALTHCHECK_FAIL #{data[:app]}"}\n"
+      data[:results].each { |name, ok| body << "#{name}=#{ok ? 'ok' : 'fail'}\n" }
 
       response.set_header('Cache-Control', 'no-store')
       response.set_header('Retry-After', '30') unless healthy
-      HealthDiagnostics.record(app: app_name, components: @measurements)
       render(plain: body, content_type: 'text/plain', status: healthy ? :ok : :service_unavailable)
     end
 
-  private
+    # Fallback for the (rare) case where not even the first refresh could produce a snapshot.
+    def render_unavailable
+      response.set_header('Cache-Control', 'no-store')
+      response.set_header('Retry-After', '30')
+      render(plain: "HEALTHCHECK_FAIL #{app_name}\nsnapshot=unavailable\n",
+             content_type: 'text/plain', status: :service_unavailable)
+    end
+
+    # One round of checks + diagnostics, invoked by the monitor's runner (background thread, or the
+    # inline cold/stale path). Wrapped in the Rails executor so ActiveRecord connections checked out
+    # by the DB checks are returned even though this runs outside a request. Returns the render data.
+    def run_and_record
+      data = nil
+      ::Rails.application.executor.wrap { data = perform_checks }
+      HealthDiagnostics.record(app: data[:app], components: data[:measurements])
+      data
+    end
 
-    # Runs each configured check, returning { label => boolean }. Reads the subclass's CHECKS
-    # constant, so apps pick checks by listing symbols rather than overriding this method. Each run
-    # is timed and its outcome captured in @measurements for HealthDiagnostics.
-    def checks
-      @measurements = []
-      self.class::CHECKS.index_with { |name| measure(name) }
+    # Runs each configured check, returning { app:, results: { label => boolean }, measurements:,
+    # status: }. Only :results feeds the rendered body; :status carries the per-check failure streaks
+    # that .dependency_status hands to the request-path gate.
+    def perform_checks
+      measurements = []
+      results = self.class::CHECKS.index_with { |name| measure(name, measurements) }
+      { app: app_name, results:, measurements:, status: self.class.record_streaks(results) }
     end
 
-    # Runs a single named check, timing it and recording its outcome. A raised error reads as a
-    # failed check and its class/message is captured, so a dependency that blows up is attributable
-    # rather than a 500.
-    def measure(name)
+    # Runs a single named check under the per-check timeout, timing it and recording its outcome. A
+    # raised error or a timeout reads as a failed check (its class/message captured), so a dependency
+    # that blows up or hangs is attributable rather than a 500 or a stalled worker.
+    def measure(name, measurements)
       started = Process.clock_gettime(Process::CLOCK_MONOTONIC)
       begin
-        ok = send(:"check_#{name}") ? true : false
+        ok = Timeout.timeout(health_check_timeout, CheckTimeout) { send(:"check_#{name}") } ? true : false
         error = nil
       rescue StandardError => e
         ok = false
         error = "#{e.class}: #{e.message}"
       end
-      @measurements << { label: name.to_s, ok:, latency_ms: elapsed_ms(started), error: }
+      measurements << { label: name.to_s, ok:, latency_ms: elapsed_ms(started), error: }
       ok
     end
 
@@ -85,8 +177,9 @@ module Usps::Support
     def app_name = Rails.application.class.module_parent_name.underscore.dasherize
 
     # --- Check primitives. Each returns true on success and returns false or raises on failure;
-    # #measure catches the raise, so a dead dependency reads as a failed check (with its error
-    # captured) rather than a 500. Named check_<name>, not <name>?, to drive CHECKS dispatch. ---
+    # #measure catches the raise/timeout, so a dead or slow dependency reads as a failed check (with
+    # its error captured) rather than a 500. Named check_<name>, not <name>?, to drive CHECKS
+    # dispatch. ---
 
     # rubocop:disable Naming/PredicateMethod
 

data/lib/usps/support/health_monitor.rb

@@ -0,0 +1,108 @@
+# frozen_string_literal: true
+
+module Usps
+  module Support
+    # Keeps a process-local snapshot of the latest health-check results so /health can answer from
+    # memory instead of running the checks on the request thread. See
+    # doc/health_check_refresh_design.md for the rationale.
+    #
+    # runner is a callable that runs one full round of checks and returns whatever the caller needs
+    # to render (HealthController returns { app:, results:, measurements: }). It is expected to bound
+    # its own checks; the monitor adds no timeout of its own.
+    #
+    # One monitor exists per concrete HealthController subclass, per process. It is created lazily on
+    # the first request, so the background thread starts after Passenger forks its workers (threads
+    # do not survive fork).
+    class HealthMonitor
+      Snapshot = Struct.new(:data, :at, keyword_init: true)
+
+      # interval:   seconds between background refreshes
+      # max_age:    a snapshot older than this is refreshed inline before use, so a wedged or
+      #             never-started background thread can't serve dangerously old data
+      # runner:     callable that runs one round of checks and returns the render data
+      # background: start the background refresher (false in tests, so refreshes are synchronous)
+      # clock:      monotonic clock (seconds) to read; injectable for deterministic staleness tests
+      def initialize(interval:, max_age:, runner:, background: true, clock: nil)
+        @interval = interval
+        @max_age = max_age
+        @runner = runner
+        @background = background
+        @clock = clock || -> { Process.clock_gettime(Process::CLOCK_MONOTONIC) }
+        @mutex = Mutex.new
+      end
+
+      # The latest results. Serves a fresh cached snapshot without touching any dependency; on a cold
+      # (first call) or stale snapshot, refreshes inline so the answer is never dangerously old. Also
+      # starts the background refresher on first use. Returns the runner's data, or nil only if the
+      # very first refresh failed and there is no prior snapshot to fall back on.
+      def current
+        ensure_running if @background
+
+        snapshot = @snapshot
+        return snapshot.data if snapshot && fresh?(snapshot)
+
+        refresh
+      end
+
+      # Runs one round of checks and stores the snapshot; returns the fresh data. On a runner error,
+      # keeps the last good snapshot and returns its data (nil if there was none), so a transient
+      # failure to run the checks never blanks out /health.
+      def refresh
+        @mutex.synchronize do
+          data = @runner.call
+          @snapshot = Snapshot.new(data:, at: @clock.call)
+          data
+        end
+      rescue StandardError
+        @snapshot&.data
+      end
+
+      def fresh?(snapshot) = (@clock.call - snapshot.at) <= @max_age
+
+      # The last completed snapshot, or nil if none has been taken yet -- *without* refreshing, even
+      # when stale. #current is for /health, which must answer accurately and may pay for an inline
+      # round; this is for callers on a user request thread (Usps::Support::DependencyGate), where
+      # running a check would reintroduce exactly the stall they exist to avoid. Starts the
+      # background refresher on first use so a process that never serves /health still gets one.
+      # Callers judge staleness themselves via #age_of.
+      def cached
+        ensure_running if @background
+
+        @snapshot
+      end
+
+      # Seconds since the snapshot was taken, on the monitor's own (monotonic) clock -- callers can't
+      # compare `snapshot.at` against a wall clock of their own.
+      def age_of(snapshot) = @clock.call - snapshot.at
+
+      # Stops the background refresher. Used by tests; also safe to call on shutdown.
+      def stop
+        @mutex.synchronize do
+          @thread&.kill
+          @thread = nil
+        end
+      end
+
+    private
+
+      # Starts the background refresher thread; exercised in prod (and the background spec) rather
+      # than counted as a unit, matching HealthDiagnostics' delivery worker.
+      # :nocov:
+      def ensure_running
+        return if @thread&.alive?
+
+        @mutex.synchronize do
+          return if @thread&.alive?
+
+          @thread = Thread.new do
+            loop do
+              refresh
+              sleep(@interval)
+            end
+          end
+        end
+      end
+      # :nocov:
+    end
+  end
+end

data/lib/usps/support/version.rb

@@ -2,6 +2,6 @@
 
 module Usps
   module Support
-    VERSION = '0.2.49'
+    VERSION = '0.2.51'
   end
 end

data/lib/usps/support.rb

@@ -18,6 +18,7 @@ require_relative 'support/helpers'
 require_relative 'support/models'
 require_relative 'support/lib'
 require_relative 'support/health_diagnostics'
+require_relative 'support/health_monitor'
 
 # The Engine require lives in `usps/all`, not here. This file can
 # legitimately be required before Rails is loaded (e.g. from .simplecov to pull

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: usps-support
 version: !ruby/object:Gem::Version
-  version: 0.2.49
+  version: 0.2.51
 platform: ruby
 authors:
 - Julian Fiander
@@ -46,7 +46,7 @@ dependencies:
         version: '0'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 0.14.1
+        version: 0.15.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -56,7 +56,7 @@ dependencies:
         version: '0'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 0.14.1
+        version: 0.15.0
 - !ruby/object:Gem::Dependency
   name: usps-jwt_auth
   requirement: !ruby/object:Gem::Requirement
@@ -86,6 +86,7 @@ extra_rdoc_files: []
 files:
 - Readme.md
 - app/controllers/concerns/usps/support/admin_menu.rb
+- app/controllers/concerns/usps/support/dependency_gate.rb
 - app/controllers/usps/support/admins_controller.rb
 - app/controllers/usps/support/health_controller.rb
 - app/models/usps/support/policy/admin_context.rb
@@ -98,6 +99,7 @@ files:
 - lib/usps/support/db/websites_schema.rb
 - lib/usps/support/engine.rb
 - lib/usps/support/health_diagnostics.rb
+- lib/usps/support/health_monitor.rb
 - lib/usps/support/helpers.rb
 - lib/usps/support/helpers/badges_helper.rb
 - lib/usps/support/helpers/flags_helper.rb