Your health check is lying: three ways a green pipeline stays broken

Description and use

False green statuses in a pipeline were fixed by adding real checks, three‑valued verdicts, and layer‑specific failure reporting.

A scraper pipeline reported success for five weeks while it was actually non‑functional.

The pipeline now accurately reflects operational status, avoiding false positives and ensuring failures are actionable.

1. Replace offline credential check with an actual identity endpoint request and interpret status codes. 2. Resolve binary paths from environment variables and treat missing binaries as hard failures. 3. Modify channel gate to report the specific network layer that failed (DNS, TCP, TLS, HTTP, auth, parse).
4. Adopt probe rules: one real request per claim, three‑valued verdicts, layer reporting, actionable failure messages, minimal evidence storage, and blocking writes until probes pass.

The check ran auth status --offline. That flag does exactly what it says: read the credential file, make no network request.

The replacement: exactly one request to an identity endpoint, judged by status code.

The wrapper caught the launch error and logged it at debug level, so the daily job reported a successful run that produced zero items.

The gate printed "API channel failed": an accurate observation about the instrument and a wrong conclusion about the world.