Observability and operational boundaries
Check liveness, readiness and the outcome of an operation separately. The process can answer HTTP while its authentication dependencies or database roles are unavailable.
Interpret the listener checks
| Check | What it establishes |
|---|---|
| Liveness | The loopback listener answers the HTTP probe. |
| Unsigned denial | The unsigned probe returns HTTP 401. |
| Readiness | The unsigned request is denied, the configured OIDC signing keys can be retrieved and each distinct configured database connection sees the exact packaged migration version. The database connection has a bounded statement timeout. |
| Business outcome | The scoped job, task or receipt and affected revision establish the effect. For a missing response, reconcile the original request before retrying. |
Check service roles and the steady-state inventory separately. PostgreSQL pg_isready establishes whether the database server accepts connections. It is a narrower check than the listener's schema and identity probes.
Use bounded operational telemetry
Watch http.server.request.duration, http.server.authentication.failures, openepm.queue.oldest_age_seconds and openepm.worker.lease.losses, along with connection pressure, lock waits and disk usage. Request completion logs carry a correlation ID, route, status and duration. Correlate these with separately retrieved scoped task or receipt records. The packaged collector is private and drops sensitive attributes such as authorization and SQL. Capacity claims require measurements for the exact deployment and workload.
See Health and capacity for a scoped administrator check and Tasks and receipts for effect reconciliation.