# Verification report

## Commands

The repository defines these reproducible checks:

```sh
pip install -e '.[dev]'
ruff check .
mypy app
pytest -q
docker build -t endpoint-monitor:local .
docker run --rm -p 8000:8000 endpoint-monitor:local
curl -fsS http://127.0.0.1:8000/health
curl -fsS http://127.0.0.1:8000/ready
```

Generation occurred through the repository scaffold platform. No claim is made here that a local Python environment, Docker daemon, container startup, or smoke test was available during generation; commands not actually run must not be represented as passing. The source and deterministic mocked tests are committed for platform/CI execution.

## Inspectable requirement evidence

* bounded total/connect/read timeout and error mapping: `app/checker.py`, `test_total_timeout_is_mapped_without_leaking_exception`
* every redirect re-enters resolution/policy before fetch: `EndpointChecker.check`, `test_redirect_hop_is_resolved_and_blocked_before_second_fetch`
* all DNS answers classified and mixed answers rejected: `app/security.py`, parametrized and mixed-answer security tests
* rebinding defense: validated addresses flow into `PinnedResolver` and a fresh per-hop `TCPConnector`; the pin/host rejection is tested
* atomic status update: revision snapshot plus locked `set_status_if_current`; stale/concurrent tests
* latency and stable, non-exception error messages: `EndpointChecker.check` and timeout test
* query/userinfo/fragment redaction: `redact_url`, `JsonFormatter`, and log test

## Limitation

Storage is process-local and volatile. One worker is mandatory; restart loses data and replicas do not coordinate. Docker is configured accordingly.