@sigrun/sigrun 0.0.0-stage → 0.1.0

package/dist/server/routes/metrics.js

@@ -0,0 +1,219 @@
+/**
+ * W2 Task 8 (spec §6.9): `GET /metrics` — the Prometheus text
+ * exposition of in-process state. The families:
+ *
+ * - `sigrun_up` — 1, or 0 when `harness.inspect()` throws (Review Focus
+ *   5: a scrape racing shutdown must degrade, never 500 — a closed
+ *   harness fails the inspect, the route still answers 200 with the
+ *   inspect-derived families omitted);
+ * - `sigrun_ready` — core-hardening Task 5: `checkStorage` (the SAME
+ *   root-conversation read `/readyz` gates on) as a gauge — 1 when
+ *   `"ok"`, 0 when `"failed"`. Always emitted: the finding was a
+ *   storage read failing while inspection stayed healthy (`sigrun_up
+ *   1`), so `/readyz` 503'd but the scrape stayed green and nothing
+ *   paged; sharing one derivation means the gauge and the probe
+ *   cannot disagree.
+ * - `sigrun_live_runs` — conversations with a placed-but-unsettled input
+ *   submission (one run per conversation at a time), durable-derived
+ *   from the same inspection;
+ * - `sigrun_inflight_submission_oldest_seconds` — the event bus's
+ *   admission clock (`oldestLiveAdmissionMs`; 0 when no run is live).
+ *   In-process: a run admitted before a restart is invisible until it
+ *   settles (spec §6.9 accepts this for a wedge-while-up alarm);
+ * - `sigrun_tasks_live{status}` — live tasks grouped by scheduler state
+ *   kind, the full five-kind vocabulary emitted (0s included) so the
+ *   family's label set is scrape-stable. `inspect()` is a Session-line
+ *   read (scrape-rate only, never a hot path);
+ * - `sigrun_provider_ready{provider,status}` — the per-provider auth
+ *   readiness derivation (`providerAuthStatus`, the exact chain
+ *   `GET /v1/auth/check` serves), value 1 at the current status;
+ * - `sigrun_extensions{status}` — load outcomes (`ok` | `quarantined`),
+ *   both emitted even at 0 for the same label-stability reason;
+ * - `sigrun_backup_last_success_timestamp_seconds` — Task 7's marker,
+ *   read per request like `meta.ts` does (the CronJob is a separate
+ *   process; the filesystem is the only fresh-enough view). OMITTED when
+ *   backup is unconfigured or no marker exists — absence is what the
+ *   `SigrunBackupStale` alert's chart gate keys on.
+ * - W4 Task 4's job families: `sigrun_job_last_run_timestamp_seconds
+ *   {job,outcome}` and `sigrun_job_next_run_timestamp_seconds{job}` —
+ *   per-record gauges re-read per scrape (the same scrape-rate posture
+ *   as the inspect families); `sigrun_job_runs_total{outcome}` — a
+ *   COUNTER over the boot's in-process run-settle observation (reset on
+ *   restart by design; the durable history lives in the run records).
+ *   Families with no samples are omitted (the backup-marker
+ *   convention).
+ *
+ * ACCESS: `/metrics` is public iff `config.metricsPublic` (strict
+ * `SIGRUN_METRICS_PUBLIC`, W1 Task 1) — the decision is made by the
+ * matched-route auth pipeline (`src/server/auth/pipeline.ts` rule 2:
+ * pattern `/metrics` and `metricsPublic` → public, else authenticated).
+ * The chart pins the env `true` so the in-cluster scrape survives.
+ *
+ * FORMAT: every family carries `# HELP` + `# TYPE` lines (gauge, or
+ * counter for the one cumulative family); label values escape
+ * backslash, quote, and newline per the exposition format; the content
+ * type is `text/plain; version=0.0.4; charset=utf-8`.
+ */
+import { BACKGROUND_CONTEXT } from "@earendil-works/chord/context";
+import { readBackupMarker } from "../../backup/marker.js";
+import { scanJobs } from "../../jobs/docs.js";
+import { providerAuthStatus } from "../helpers.js";
+import { checkStorage } from "../readiness.js";
+/** The exposition content type (spec §6.9's format rule). */
+const EXPOSITION_CONTENT_TYPE = "text/plain; version=0.0.4; charset=utf-8";
+/** Escape one label value per the exposition format: `\` → `\\`,
+ *  `"` → `\"`, newline → `\n`. */
+function escapeLabelValue(value) {
+    return value.replaceAll("\\", "\\\\").replaceAll('"', '\\"').replaceAll("\n", "\\n");
+}
+/** Render one label set (`{a="1",b="2"}`, or `""` when label-less). */
+function renderLabels(labels) {
+    const entries = Object.entries(labels);
+    if (entries.length === 0)
+        return "";
+    return `{${entries.map(([name, value]) => `${name}="${escapeLabelValue(value)}"`).join(",")}}`;
+}
+/**
+ * Register `GET /metrics`.
+ *
+ * One family per call: the HELP/TYPE lines plus one sample per
+ * `{labels, value}` pair, appended to the shared line buffer. A family
+ * with NO samples is omitted entirely (the backup-marker case) —
+ * callers that must always exist pass their 0-valued sample themselves.
+ */
+export function registerMetricsRoutes(app, ctx) {
+    const { opened, config } = ctx;
+    app.get("/metrics", async (_request, reply) => {
+        const lines = [];
+        const family = (name, help, samples, type = "gauge") => {
+            if (samples.length === 0)
+                return;
+            lines.push(`# HELP ${name} ${help}`);
+            lines.push(`# TYPE ${name} ${type}`);
+            for (const sample of samples) {
+                lines.push(`${name}${renderLabels(sample.labels)} ${sample.value}`);
+            }
+        };
+        // Review Focus 5: the harness liveness probe. `inspect()` throws on
+        // a closed harness (the shutdown race) and on storage failure — the
+        // scrape degrades to `sigrun_up 0` with the inspect-derived
+        // families (live runs, wedge age, tasks) omitted rather than 500ing.
+        let up = 1;
+        try {
+            const inspection = await opened.harness.inspect(BACKGROUND_CONTEXT);
+            // Live runs: conversations holding a placed-but-unsettled INPUT
+            // submission (queued inputs run nothing yet; write-type
+            // submissions never run at all). Durable-derived, so a
+            // pre-restart run still counts — only the wedge AGE above is
+            // restart-invisible.
+            const liveConversations = new Set();
+            for (const submission of inspection.submissions) {
+                if (submission.type !== "input" || submission.status !== "placed") {
+                    continue;
+                }
+                liveConversations.add(submission.conversationId);
+            }
+            family("sigrun_live_runs", "Conversations with a live input run", [
+                { labels: {}, value: liveConversations.size },
+            ]);
+            // The wedge gauge: the admission clock's age over the oldest
+            // live run. Always exists while the harness answers (0 when no
+            // run is live — the alert's `> 1800` must not key on absence).
+            const oldestMs = opened.eventBus.oldestLiveAdmissionMs();
+            family("sigrun_inflight_submission_oldest_seconds", "Age of the oldest in-flight submission's admission (0 when none; in-process clock — a pre-restart run is invisible until it settles)", [{ labels: {}, value: Math.round((oldestMs ?? 0) / 1000) }]);
+            // Live tasks by scheduler state kind. The full five-kind
+            // vocabulary is emitted (0s included) for label stability.
+            const taskStatuses = {
+                running: 0,
+                ready: 0,
+                waiting: 0,
+                completing: 0,
+                blocked: 0,
+            };
+            for (const task of inspection.tasks) {
+                taskStatuses[task.state.kind] = (taskStatuses[task.state.kind] ?? 0) + 1;
+            }
+            family("sigrun_tasks_live", "Live tasks by scheduler state", Object.entries(taskStatuses).map(([status, count]) => ({
+                labels: { status },
+                value: count,
+            })));
+            // W4 Task 4's job families — record-derived gauges, scrape-rate
+            // reads over the same records-only scan the jobs service lists
+            // through (inside the inspect guard: a closed harness degrades to
+            // omission, never a 500).
+            const jobRecords = await scanJobs(opened.storage, BACKGROUND_CONTEXT);
+            const epochSeconds = (iso) => Math.floor(Date.parse(iso) / 1000);
+            family("sigrun_job_last_run_timestamp_seconds", "Unix time of each job's last run (by outcome)", jobRecords.flatMap(({ id, record }) => record.lastRun === undefined
+                ? []
+                : [
+                    {
+                        labels: { job: id, outcome: record.lastRun.outcome },
+                        value: epochSeconds(record.lastRun.settledAt ?? record.lastRun.startedAt),
+                    },
+                ]));
+            family("sigrun_job_next_run_timestamp_seconds", "Unix time of each job's next scheduled fire", jobRecords.flatMap(({ id, record }) => record.nextRun === undefined
+                ? []
+                : [
+                    {
+                        labels: { job: id },
+                        value: epochSeconds(record.nextRun),
+                    },
+                ]));
+        }
+        catch (error) {
+            up = 0;
+            console.error("metrics: harness inspection failed:", error);
+        }
+        family("sigrun_up", "1 when the harness answers inspection", [
+            { labels: {}, value: up },
+        ]);
+        // Core-hardening Task 5: the readiness storage check as a gauge —
+        // the exact call /readyz gates on (never throws, never omitted), so
+        // SigrunNotReady's `or sigrun_ready == 0` arm fires on a storage
+        // failure even while inspection (and the whole scrape) stays green.
+        const storage = await checkStorage(ctx);
+        family("sigrun_ready", "1 when the readiness storage check (the /readyz root-conversation read) succeeds", [{ labels: {}, value: storage === "ok" ? 1 : 0 }]);
+        // Provider readiness: the shared derivation (`GET /v1/auth/check`'s
+        // exact chain), one 1-valued sample per (provider, current status).
+        const producersByName = new Map(opened.providerHealth.map((producer) => [producer.name, producer]));
+        family("sigrun_provider_ready", "1 per provider at its current auth-readiness status", opened.models.getProviders().map(({ id }) => ({
+            labels: {
+                provider: id,
+                status: providerAuthStatus(opened, id, producersByName).status,
+            },
+            value: 1,
+        })));
+        // Extension load outcomes: both statuses emitted even at 0 so the
+        // family exists on a bare-core deploy (label stability).
+        const extensionCounts = { ok: 0, quarantined: 0 };
+        for (const outcome of opened.extensionOutcomes) {
+            extensionCounts[outcome.status] =
+                (extensionCounts[outcome.status] ?? 0) + 1;
+        }
+        family("sigrun_extensions", "Configured extensions by load outcome", Object.entries(extensionCounts).map(([status, count]) => ({
+            labels: { status },
+            value: count,
+        })));
+        // The in-process run counter (§6.9): boot counts run SETTLES from
+        // `sigrun.job.run` commits in this process — reset on restart by
+        // design; the alert's `increase(…[1h])` reads the deltas.
+        family("sigrun_job_runs_total", "Job runs settled by outcome since process start", [...opened.jobRunTotals()].map(([outcome, count]) => ({
+            labels: { outcome },
+            value: count,
+        })), "counter");
+        // Task 7's marker, read per request like meta.ts (the CronJob is a
+        // separate process). Omitted when backup is unconfigured or the
+        // marker is absent/corrupt — the SigrunBackupStale alert's chart
+        // gate treats an unbacked deploy as "no series, no page".
+        if (config.backup !== undefined) {
+            const marker = await readBackupMarker(config.stateDir);
+            if (marker !== undefined) {
+                const seconds = Math.floor(Date.parse(marker.at) / 1000);
+                if (Number.isFinite(seconds)) {
+                    family("sigrun_backup_last_success_timestamp_seconds", "Unix time of the last successful backup run", [{ labels: {}, value: seconds }]);
+                }
+            }
+        }
+        return await reply.code(200).type(EXPOSITION_CONTENT_TYPE).send(`${lines.join("\n")}\n`);
+    });
+}

package/dist/server/routes/onboarding.js

@@ -0,0 +1,268 @@
+/**
+ * The onboarding routes (core hardening W1 Task 4, spec §5.8): the
+ * unclaimed state's whole surface. The pipeline public-paths
+ * `/v1/onboarding*` (stage 2), so these routes resolve trust THEMSELVES:
+ * a trusted proxy identity (headers from a trusted peer) or a loopback
+ * bind is trust enough to claim with no code; everything else must
+ * present the setup code (the unclaimed boot's one-shot credential) or,
+ * once claimed, a valid invite code.
+ *
+ * Claims and invite redemptions serialize on the ONE in-process claim
+ * mutex (`claim-lock.ts`) with the directory write atomic — concurrent
+ * correct claims yield exactly one 200; the rest get 409
+ * `already_claimed`.
+ */
+import { BACKGROUND_CONTEXT } from "@earendil-works/chord/context";
+import { timingSafeEqual } from "node:crypto";
+import { withClaimLock } from "../auth/claim-lock.js";
+import { ipAllowed } from "../auth/ip.js";
+import { isLoopbackHost } from "../auth/loopback.js";
+import { readSetupCode, clearSetupCode } from "../../harness/identity/index.js";
+import { stampSessionOwner } from "../helpers.js";
+import { buildSessionCookie } from "./auth.js";
+/** One header read (Fastify headers are string | string[]; first wins). */
+function headerOf(request, name) {
+    const value = request.headers[name.toLowerCase()];
+    const single = Array.isArray(value) ? value[0] : value;
+    return single?.trim() || undefined;
+}
+/** The username rule (spec §5.8, shared with the directory's own check). */
+const USERNAME_PATTERN = /^[a-z0-9][a-z0-9._-]*$/;
+/** Constant-time string equality (the pipeline's discipline). */
+function timingSafeStringEqual(a, b) {
+    const left = Buffer.from(a, "utf8");
+    const right = Buffer.from(b, "utf8");
+    if (left.length !== right.length)
+        return false;
+    return timingSafeEqual(left, right);
+}
+/**
+ * Resolve the request's trusted proxy identity WITHOUT provisioning: the
+ * proxy method must be configured, the peer trusted, and the user header
+ * present (and a shape the directory could hold — the pipeline's
+ * invalid-username posture). When a shared secret is configured, it is
+ * required here TOO — the pipeline never runs on public paths (stage 2
+ * returns before the proxy method), so these routes own the same secret
+ * discipline, and the header is deleted from the request after the check
+ * exactly as the pipeline would have done. Name/email ride their headers
+ * when present.
+ */
+function resolveProxyIdentity(request, ctx) {
+    if (!ctx.methods.includes("proxy"))
+        return undefined;
+    const { proxy } = ctx.config.auth;
+    if (!ipAllowed(request.socket.remoteAddress, proxy.trustedProxies)) {
+        return undefined;
+    }
+    if (proxy.secret !== undefined && proxy.secretHeader !== undefined) {
+        const name = proxy.secretHeader.toLowerCase();
+        const presented = headerOf(request, name);
+        delete request.headers[name];
+        if (presented === undefined ||
+            !timingSafeStringEqual(presented, proxy.secret)) {
+            return undefined;
+        }
+    }
+    const user = headerOf(request, proxy.userHeader);
+    if (user === undefined || !USERNAME_PATTERN.test(user))
+        return undefined;
+    const name = headerOf(request, proxy.nameHeader);
+    const email = headerOf(request, proxy.emailHeader);
+    return {
+        user,
+        ...(name === undefined ? {} : { name }),
+        ...(email === undefined ? {} : { email }),
+    };
+}
+/**
+ * Validate the claim body strictly: unknown keys and wrong types are
+ * client errors (the repo's fail-loud validator posture).
+ */
+function validateClaimBody(body) {
+    if (body === undefined)
+        return {};
+    if (typeof body !== "object" || Array.isArray(body)) {
+        return { error: "invalid_body" };
+    }
+    const record = body;
+    const result = {};
+    for (const key of Object.keys(record)) {
+        const value = record[key];
+        switch (key) {
+            case "code":
+            case "user":
+            case "name":
+            case "email":
+            case "tokenName":
+                if (typeof value !== "string")
+                    return { error: "invalid_body" };
+                result[key] = value;
+                break;
+            case "issueToken":
+                if (typeof value !== "boolean")
+                    return { error: "invalid_body" };
+                result.issueToken = value;
+                break;
+            default:
+                return { error: "invalid_field", field: key };
+        }
+    }
+    return result;
+}
+/** Register the onboarding state + claim routes. */
+export function registerOnboardingRoutes(app, ctx) {
+    const { identity } = ctx.opened;
+    app.get("/v1/onboarding", async (request) => {
+        const proxyIdentity = resolveProxyIdentity(request, ctx);
+        // Loopback is the trust itself; a trusted proxy identity likewise.
+        const codeRequired = !isLoopbackHost(ctx.listenHost) && proxyIdentity === undefined;
+        return {
+            state: identity.users.isClaimed() ? "claimed" : "unclaimed",
+            methods: ctx.methods,
+            codeRequired,
+            ...(proxyIdentity === undefined ? {} : { proxyIdentity }),
+        };
+    });
+    app.post("/v1/onboarding/claim", async (request, reply) => {
+        const validated = validateClaimBody(request.body);
+        if ("error" in validated) {
+            return await reply.code(400).send(validated);
+        }
+        const proxyIdentity = resolveProxyIdentity(request, ctx);
+        const loopback = isLoopbackHost(ctx.listenHost);
+        // The code's validity is evaluated ONCE, BEFORE the mutex: the winner
+        // clears the setup-code file inside its critical section, so a claim
+        // that loses the race must still be recognizable as having held a
+        // valid code — it gets 409 `already_claimed` (the brief's "one
+        // claimant wins and the rest get 409"), never a misleading 403.
+        const codeWasSetup = validated.code !== undefined &&
+            validated.code === readSetupCode(identity.cacheDir);
+        // The claim critical section: read state, decide, add — all inside
+        // the one mutex, so concurrent claims cannot both pass the gate.
+        const outcome = await withClaimLock(async () => {
+            const claimed = identity.users.isClaimed();
+            if (!claimed) {
+                // The first admin: proxy headers, loopback bind, or the setup
+                // code ("the first invite" — same shape, admin grant).
+                let grant;
+                if (proxyIdentity !== undefined) {
+                    // Proxy claims take identity from the headers, verbatim
+                    // (body identity fields are ignored — the proxy vouched).
+                    grant = { ...proxyIdentity, source: "proxy" };
+                }
+                else if (loopback) {
+                    if (validated.user === undefined)
+                        return { status: 400, error: "invalid_body" };
+                    grant = {
+                        user: validated.user,
+                        ...(validated.name === undefined ? {} : { name: validated.name }),
+                        ...(validated.email === undefined ? {} : { email: validated.email }),
+                        source: "cli",
+                    };
+                }
+                else if (codeWasSetup) {
+                    if (validated.user === undefined)
+                        return { status: 400, error: "invalid_body" };
+                    grant = {
+                        user: validated.user,
+                        ...(validated.name === undefined ? {} : { name: validated.name }),
+                        ...(validated.email === undefined ? {} : { email: validated.email }),
+                        source: "cli",
+                    };
+                }
+                else {
+                    // Wrong or absent code where one is required.
+                    return { status: 403, error: "invalid_code" };
+                }
+                if (!USERNAME_PATTERN.test(grant.user)) {
+                    return { status: 400, error: "invalid_username" };
+                }
+                const record = await identity.users.add({
+                    user: grant.user,
+                    ...(grant.name === undefined ? {} : { name: grant.name }),
+                    ...(grant.email === undefined ? {} : { email: grant.email }),
+                    admin: true,
+                    source: grant.source,
+                });
+                // The setup code dies with the claim (single-shot); the
+                // pinned env form re-materializes at the next unclaimed
+                // boot, which no longer exists once claimed.
+                await clearSetupCode(identity.cacheDir);
+                // The reserved root conversation belongs to the claimant —
+                // the server's first configured resource.
+                const root = await ctx.opened.harness.conversation(ctx.rootId, BACKGROUND_CONTEXT);
+                if (root !== undefined) {
+                    await stampSessionOwner(root, record.user);
+                }
+                return { status: 200, record };
+            }
+            // Claimed: an invite code admits one more user; a codeless
+            // proxy/loopback caller auto-provisions (or re-surfaces); a code
+            // that WAS the setup code lost the race — 409, per the mutex
+            // contract (one winner, the rest already_claimed).
+            if (codeWasSetup) {
+                return { status: 409, error: "already_claimed" };
+            }
+            if (validated.code !== undefined) {
+                const invite = validated.user === undefined
+                    ? undefined
+                    : await identity.invites.redeem(validated.code, validated.user);
+                if (invite === undefined) {
+                    return { status: 403, error: "invalid_code" };
+                }
+                const record = await identity.users.add({
+                    user: validated.user,
+                    ...(validated.name === undefined ? {} : { name: validated.name }),
+                    ...(validated.email === undefined ? {} : { email: validated.email }),
+                    admin: invite.admin,
+                    source: "invite",
+                });
+                return { status: 200, record };
+            }
+            // Claimed + no code: only a trusted proxy identity still
+            // admits (auto-provision, or the existing record back) — a
+            // loopback/token caller has “nothing valid” and gets 409.
+            if (proxyIdentity === undefined) {
+                return { status: 409, error: "already_claimed" };
+            }
+            const existing = identity.users.get(proxyIdentity.user);
+            if (existing !== undefined)
+                return { status: 200, record: existing };
+            const record = await identity.users.add({
+                user: proxyIdentity.user,
+                ...(proxyIdentity.name === undefined ? {} : { name: proxyIdentity.name }),
+                ...(proxyIdentity.email === undefined ? {} : { email: proxyIdentity.email }),
+                admin: false,
+                source: "proxy",
+            });
+            return { status: 200, record };
+        });
+        if (outcome.status !== 200) {
+            return await reply.code(outcome.status).send({ error: outcome.error });
+        }
+        const response = {
+            user: {
+                user: outcome.record.user,
+                ...(outcome.record.name === undefined ? {} : { name: outcome.record.name }),
+                ...(outcome.record.email === undefined ? {} : { email: outcome.record.email }),
+                admin: outcome.record.admin,
+                createdAt: outcome.record.createdAt,
+                source: outcome.record.source,
+            },
+            ...(validated.issueToken
+                ? {
+                    token: (await identity.tokens.create(validated.tokenName ?? "onboarding", outcome.record.user)).token,
+                }
+                : {}),
+        };
+        // issueToken also logs the browser in: the session cookie is the
+        // webui's (and the TUI attach flow's) carry-home credential.
+        if (validated.issueToken && response.token !== undefined) {
+            return await reply
+                .code(200)
+                .header("set-cookie", buildSessionCookie(response.token, request, ctx))
+                .send(response);
+        }
+        return await reply.code(200).send(response);
+    });
+}

package/dist/server/routes/probes.js

@@ -0,0 +1,53 @@
+/**
+ * The deploy probes (spec §4.4 "distinguishes process-up from
+ * harness-ready"): liveness and readiness, both scrape-compatible plain
+ * text. Registered before the API routes, matching the unsplit server's
+ * registration order.
+ */
+import { checkStorage } from "../readiness.js";
+/**
+ * Register `GET /healthz` + `GET /readyz`.
+ *
+ * Liveness: 200 ALWAYS once listening — no aggregation, no storage; the
+ * dead-simple "the event loop answers" signal. The body is a single
+ * Prometheus-exposition gauge line so the endpoint is scrape-compatible
+ * (`/v1/meta` is JSON and cannot be scraped). A degraded-but-alive process
+ * must NOT fail liveness — the kubelet would restart a process that is
+ * merely degraded.
+ *
+ * Readiness: 200 only when the harness is GENUINELY ready — and in W2
+ * (§6.1) that is STORAGE-ONLY: boot complete + a real storage read.
+ * Provider and memory health do NOT gate readiness — a degraded upstream
+ * is never a Service outage (no endpoint gap, no pod eviction); they stay
+ * visible in `/v1/meta`, `/v1/providers` (W1), and `/metrics` (W2 Task 8).
+ * The derivation, evaluated per request:
+ *  1. booted — trivially true while this route answers (the server only
+ *     exists after `openHarness` completed); documented, not probed.
+ *  2. `checkStorage` (core-hardening Task 5) — a cheap REAL storage read
+ *     resolving the reserved root conversation through the session line.
+ *     The SAME call feeds `/metrics`'s `sigrun_ready` gauge, so the k8s
+ *     probe and the alert signal cannot disagree.
+ * Not ready ⇒ 503 + `{ ready: false, checks: { storage: "failed" } }` (so
+ * a `kubectl get endpoints` gap has a story). Ready ⇒ the exposition
+ * line, scrape-compatible for the same reason as `/healthz`.
+ */
+export function registerProbeRoutes(app, ctx) {
+    app.get("/healthz", async (_request, reply) => {
+        return await reply
+            .code(200)
+            .type("text/plain; version=0.0.4; charset=utf-8")
+            .send("sigrun_liveness 1\n");
+    });
+    app.get("/readyz", async (_request, reply) => {
+        if ((await checkStorage(ctx)) !== "ok") {
+            return await reply.code(503).send({
+                ready: false,
+                checks: { storage: "failed" },
+            });
+        }
+        return await reply
+            .code(200)
+            .type("text/plain; version=0.0.4; charset=utf-8")
+            .send("sigrun_readiness 1\n");
+    });
+}