decomposer: generate deliverable files for Define the service contract and project architecture for the FastAPI endpoint monitoring service.; Implement the typed monitor CRUD API and concurrency-safe in-memory state according to the service design.; Implement secure on-demand endpoint checks with status updates, latency measurement, robust error handling, and redacted structured logs.; Add operational API endpoints and environment-driven runtime configuration to the monitoring service.; Create automated tests for the monitoring service.; Package the service with Docker and developer documentation.; Validate the complete project.

docs/verification.md

@@ -1,23 +1,15 @@
-# Verification record and runbook
+# Verification procedure and evidence
 
-The repository contains executable validation rather than a CI-only claim. Run from a clean checkout with Python 3.12:
+Run `./scripts/verify.sh` from a development environment with Python 3.12 and Docker. It is a
+fail-fast executable contract that runs formatting, lint, strict typing, all automated tests,
+a production image build, container startup/readiness, and create/list API smoke tests. The
+individual commands are documented in `README.md` for environments without Docker.
 
-```bash
-python -m venv .venv
-. .venv/bin/activate
-pip install -e '.[dev]'
-ruff format --check .
-ruff check .
-mypy app
-pytest -q
-docker build -t endpoint-monitor:verify .
-docker run -d --rm --name endpoint-monitor-verify -p 18000:8000 endpoint-monitor:verify
-curl --fail http://127.0.0.1:18000/healthz
-curl --fail http://127.0.0.1:18000/readyz
-curl --fail -H 'content-type: application/json' -d '{"name":"example","url":"https://example.com"}' http://127.0.0.1:18000/monitors
-docker stop endpoint-monitor-verify
-```
+Expected test evidence includes: CRUD and stable 404/422 bodies; 100 concurrent creates; atomic
+update/status interleaving; on-demand status persistence; DNS rejection before transport;
+redirect target revalidation; and query/credential log redaction. Outbound calls are mocked.
 
-`pytest` covers CRUD, status publication, error envelopes, timeout/network mapping, stale-update conflicts, DNS filtering, redirect revalidation, and log redaction with no live outbound traffic. A successful smoke response is `{"status":"ok"}` for both operational endpoints and a 201 monitor document.
-
-Generation environments that do not expose a command runner cannot truthfully record execution results here. The commands above are the exact execution contract; downstream validation should record tool versions, exit codes, and test count. The architectural limitation remains that all monitor data is process-local, ephemeral, and isolated per worker.
+Generation environments do not necessarily expose a shell or Docker daemon. A committed script
+is not itself a claim that it ran: consumers should preserve the actual command output in CI.
+The architectural limitation remains that state is ephemeral and unique to one process, so the
+container command intentionally selects one worker.