33 lines
1.6 KiB
Markdown
33 lines
1.6 KiB
Markdown
# Verification report
|
|
|
|
## Commands
|
|
|
|
The repository defines these reproducible checks:
|
|
|
|
```sh
|
|
pip install -e '.[dev]'
|
|
ruff check .
|
|
mypy app
|
|
pytest -q
|
|
docker build -t endpoint-monitor:local .
|
|
docker run --rm -p 8000:8000 endpoint-monitor:local
|
|
curl -fsS http://127.0.0.1:8000/health
|
|
curl -fsS http://127.0.0.1:8000/ready
|
|
```
|
|
|
|
Generation occurred through the repository scaffold platform. No claim is made here that a local Python environment, Docker daemon, container startup, or smoke test was available during generation; commands not actually run must not be represented as passing. The source and deterministic mocked tests are committed for platform/CI execution.
|
|
|
|
## Inspectable requirement evidence
|
|
|
|
* bounded total/connect/read timeout and error mapping: `app/checker.py`, `test_total_timeout_is_mapped_without_leaking_exception`
|
|
* every redirect re-enters resolution/policy before fetch: `EndpointChecker.check`, `test_redirect_hop_is_resolved_and_blocked_before_second_fetch`
|
|
* all DNS answers classified and mixed answers rejected: `app/security.py`, parametrized and mixed-answer security tests
|
|
* rebinding defense: validated addresses flow into `PinnedResolver` and a fresh per-hop `TCPConnector`; the pin/host rejection is tested
|
|
* atomic status update: revision snapshot plus locked `set_status_if_current`; stale/concurrent tests
|
|
* latency and stable, non-exception error messages: `EndpointChecker.check` and timeout test
|
|
* query/userinfo/fragment redaction: `redact_url`, `JsonFormatter`, and log test
|
|
|
|
## Limitation
|
|
|
|
Storage is process-local and volatile. One worker is mandatory; restart loses data and replicas do not coordinate. Docker is configured accordingly.
|