Instrument the chain, reap expired entries, record disclosures

FeatureSecurityService
Shipped
August 3, 2026 at 3:02 AM UTC
Author
Kamo
Commit
584d798

Every failure mode in this feature is silent. A latched circuit breaker, a worker queue discarding every task, a provider that started returning HTML — each looks exactly like "this correspondent has no photo", which is also what correct behaviour looks like. There is no user-visible difference between working and completely dead, so it has to be measured. Metrics (Prometheus was already wired up, so this is mostly naming): cache hit ratio, chain duration tagged by the tier that answered, per-provider hit/miss, worker queue depth, and a discarded-task total. That last one previously used DiscardPolicy, which drops silently by design; it now increments a counter, and the counter is declared before the executor because field initializers run in source order and relying on lazy capture would break on a harmless reorder. Disclosures go to their own logger. Only the identity tier is a personal disclosure — the domain tiers transmit the right-hand side of an address, which identifies no one — and it is recorded before the call rather than after, so the trail exists even when the request then fails. The address is written in full and deliberately: the point is to answer "who was this person's data shared with", and a hash cannot answer that. The reaper closes a leak: deleteExpiredBefore existed and nothing called it, so sender_identity grew forever. A busy mailbox touches thousands of correspondents once each and leaves a negative row behind for every one. Tests cover the fetcher against a real socket, because the interesting cases are all provider behaviours rather than logic: a 404 carrying a valid image (DuckDuckGo), a soft-404 serving HTML, an origin understating Content-Length, a 1x1 stub, and a redirect aimed into the pod network. The production client cannot be pointed at a loopback test server — its DNS pin refuses to resolve anything private, which is the whole point — so those run against a relaxed client and the pin is asserted separately.

All changes

Like what you see shipping?

Every one of these updates lands in your workspace automatically. Start free and watch it grow week after week.

Start Free ForeverView Pricing