Make relay readiness process-local

.github/workflows/_ci-relay.yml

@@ -198,6 +198,8 @@ jobs:
         with:
           name: desktop-e2e-relay
           path: target/ci
+      - name: Restore relay executable permission
+        run: chmod +x ./target/ci/buzz-relay
       - name: PostgreSQL-backed tests
         env:
           BUZZ_POSTGRES_ADMIN_URL: postgres://buzz:${{ env.BUZZ_TEST_POSTGRES_PASSWORD }}@localhost:5432/postgres

ARCHITECTURE.md

@@ -644,7 +644,7 @@ pub enum AuthState { Pending { challenge: String }, Authenticated(AuthContext),
 | GET | `/.well-known/nostr.json` | NIP-05 identity |
 | GET | `/health` | Health check |
 | GET | `/_liveness` | Liveness probe |
-| GET | `/_readiness` | Readiness probe |
+| GET | `/_readiness` | Readiness probe — local process lifecycle only |
 | POST | `/events` | Submit a signed Nostr event over HTTP (same ingest path as WebSocket `EVENT`) |
 | POST | `/query` | Query Nostr events over HTTP with NIP-01 filters |
 | POST | `/count` | Count Nostr events over HTTP with NIP-45 filters |

Justfile

@@ -463,7 +463,7 @@ test-unit:
         # the ~30s sqlx acquire timeout, so they do not belong in the infra-free
         # unit job either.
         cargo nextest run -p buzz-relay --lib \
-            -E 'test(/^api::admin::/) + test(/^handlers::channel_authz::/) + test(/^handlers::moderation_authz::/) + test(/^handlers::side_effects::tests::/) + test(/^storage_sweep::tests::/)'
+            -E 'test(/^api::admin::/) + test(/^handlers::channel_authz::/) + test(/^handlers::moderation_authz::/) + test(/^handlers::side_effects::tests::/) + test(/^storage_sweep::tests::/) + test(/^readiness::tests::/) + test(/^router::tests::/) + test(=state::tests::neither_a_confirmed_inactive_community_nor_a_failed_lookup_admits_the_socket)'
         # ACP author-gate and queue tests protect the trust boundary between
         # relay events and agent prompts. They are infra-free; ignored lifecycle
         # tests remain excluded and run in their dedicated integration lanes.

crates/buzz-relay/src/lib.rs

@@ -37,7 +37,8 @@ pub mod nip11;
 pub mod protocol;
 /// Durable NIP-PL matcher and delivery worker.
 pub mod push_runtime;
-mod readiness;
+/// Readiness-probe telemetry and the per-pod dependency sampler behind `/_status`.
+pub mod readiness;
 /// Axum router construction.
 pub mod router;
 /// Shared application state.

crates/buzz-relay/src/main.rs

@@ -227,6 +227,10 @@ async fn run_relay_main(boot: BootTracker) -> anyhow::Result<()> {
 
     let usage_interval_secs = usage_metrics_interval_secs();
     let usage_idle_timeout_secs = usage_metrics_idle_timeout_secs(usage_interval_secs);
+    let dependency_sample_completion_republish_interval =
+        buzz_relay::readiness::dependency_sample_completion_republish_interval(
+            usage_idle_timeout_secs,
+        );
     let (boot, ()) = boot.run_required(
         StartupPhase::MetricsBind,
         || relay_metrics::try_install(config.metrics_port, usage_idle_timeout_secs),
@@ -244,6 +248,7 @@ async fn run_relay_main(boot: BootTracker) -> anyhow::Result<()> {
     info!(
         port = config.metrics_port,
         idle_timeout_secs = usage_idle_timeout_secs,
+        completion_republish_secs = dependency_sample_completion_republish_interval.as_secs(),
         "Prometheus metrics exporter started"
     );
 
@@ -455,7 +460,13 @@ async fn run_relay_main(boot: BootTracker) -> anyhow::Result<()> {
         cfg.create_pool(Some(deadpool_redis::Runtime::Tokio1))
             .map_err(|e| anyhow::anyhow!("Redis pool creation failed: {e}"))?
     };
-    let redis_health_pool = redis_pool.clone(); // cheap Arc clone — shared with readiness handler
+    let redis_health_pool = redis_pool.clone(); // cheap Arc clone — shared with AppState
+                                                // One-time bootstrap gate, deliberately before AppState and therefore before
+                                                // the health listener binds. Post-start Redis failures are dependency
+                                                // failures and must never move readiness; never having connected at all is
+                                                // a broken deployment, not a blip.
+    buzz_relay::state::verify_redis_command_path(&redis_health_pool).await?;
+    info!("Redis command path connected");
     let pubsub = Arc::new(
         PubSubManager::new(&config.redis_url, redis_pool)
             .await
@@ -1043,6 +1054,16 @@ async fn run_relay_main(boot: BootTracker) -> anyhow::Result<()> {
         ));
     }
 
+    // Per-pod dependency diagnostics runtime: one seam starts the dependency
+    // sampler and its independent completion-epoch republisher together.
+    {
+        let diagnostics_state = Arc::clone(&state);
+        buzz_relay::readiness::start_dependency_sampler_and_completion_publisher(
+            diagnostics_state,
+            dependency_sample_completion_republish_interval,
+        );
+    }
+
     // Cross-pod connection-control consumer: receive disconnect commands from
     // Redis pub/sub (published by the pod that recorded a ban) and close any
     // matching local sockets. A member's live connections may land on any pod,
@@ -1216,6 +1237,8 @@ async fn run_relay_main(boot: BootTracker) -> anyhow::Result<()> {
 
     serve(router, health_router, Arc::clone(&state)).await?;
     state.community_revalidator_cancel.cancel();
+    state.dependency_sampler_cancel.cancel();
+    state.dependency_completion_publisher_cancel.cancel();
 
     // Signal the audit worker to stop accepting, flush buffered entries, and
     // exit. Uses a CancellationToken so it works regardless of how many

crates/buzz-relay/src/metrics.rs

@@ -290,6 +290,7 @@ pub fn try_install(port: u16, gauge_idle_timeout_secs: u64) -> Result<(), Metric
     metrics::set_global_recorder(recorder)
         .map_err(|_error| MetricsInstallError::RecorderConflict)?;
     describe_readiness_metrics();
+    describe_community_admission_metrics();
     describe_db_pool_metrics();
     describe_auth_metrics();
     initialize_auth_metric_series();
@@ -306,24 +307,42 @@ pub fn install(port: u16, gauge_idle_timeout_secs: u64) {
         .unwrap_or_else(|error| panic!("metrics exporter must install exactly once: {error}"));
 }
 
-/// Register the frozen readiness metric descriptions with the active recorder.
+/// Register the frozen readiness and dependency-diagnostic metric descriptions.
+///
+/// The two `buzz_readiness_*` probe families describe local process lifecycle.
+/// The dependency families keep their names for dashboard continuity but are
+/// published by the per-pod dependency sampler, not by the Kubernetes probe or
+/// by an `/_status` request — a shared-dependency failure no longer deroutes
+/// the pod, and nobody has to read the endpoint for the metrics to move.
 pub(crate) fn describe_readiness_metrics() {
     metrics::describe_counter!(
         "buzz_readiness_checks_total",
-        "Kubernetes health-listener readiness probes by terminal bounded reason"
+        "Kubernetes health-listener readiness probes by lifecycle reason (ready, shutting_down)"
     );
     metrics::describe_counter!(
         "buzz_readiness_dependency_checks_total",
-        "Completed readiness dependency attempts by dependency and bounded outcome"
+        "Completed dependency-sampler attempts by dependency and bounded outcome"
     );
     metrics::describe_histogram!(
         "buzz_readiness_check_duration_seconds",
         metrics::Unit::Seconds,
-        "Completed readiness check duration without outcome label multiplication"
+        "Completed dependency-sampler check duration without outcome label multiplication"
     );
     metrics::describe_gauge!(
         "buzz_readiness_state",
-        "Latest publishable readiness state by check, where 1 is ready and 0 is not ready"
+        "Latest private readiness-probe observation, where 1 is ready and 0 is shutting down"
+    );
+    metrics::describe_gauge!(
+        "buzz_readiness_dependency_sample_completed_timestamp_seconds",
+        "Unix time the cached /_status dependency report completed, absent until the first sample completes; sampler completion advances it and the publisher re-emits it"
+    );
+}
+
+/// Register the bounded community-admission contract.
+pub(crate) fn describe_community_admission_metrics() {
+    metrics::describe_counter!(
+        "buzz_community_admission_checks_total",
+        "Durable community-active checks at socket admission by bounded outcome"
     );
 }
 
@@ -541,7 +560,17 @@ pub(crate) fn readiness_test_recorder() -> (
     metrics_exporter_prometheus::PrometheusRecorder,
     metrics_exporter_prometheus::PrometheusHandle,
 ) {
-    let recorder = configured_prometheus_builder(300).build_recorder();
+    readiness_test_recorder_with_idle_timeout(300)
+}
+
+#[cfg(test)]
+pub(crate) fn readiness_test_recorder_with_idle_timeout(
+    gauge_idle_timeout_secs: u64,
+) -> (
+    metrics_exporter_prometheus::PrometheusRecorder,
+    metrics_exporter_prometheus::PrometheusHandle,
+) {
+    let recorder = configured_prometheus_builder(gauge_idle_timeout_secs).build_recorder();
     let handle = recorder.handle();
     (recorder, handle)
 }