- Shipped
- August 25, 2026 at 3:34 PM UTC
- Author
- Kamo
- Commit
- ba3f85c
The KamoDesktop canary needs a link minted the way the icon mints one. It holds the same signing key, so it could build its own — and would then be testing itself. The outage it exists to catch lived entirely in how SecurityService builds the link, and a self-minting canary would have sailed past it green. So **************** walks the icon's path: same provision gate, same agent preflight, same buildAutoConnectUrl. If the icon would hand a user a broken link, the probe gets the same broken link. It reports the stage it reached rather than a bare boolean, so an alert can name the broken link instead of the symptom, and it answers 200 either way — "the desktop is broken" and "SecurityService is unreachable" are different alerts with different runbooks, and a 5xx would collapse them. Gated on X-Internal-Auth, constant-time, failing closed when unconfigured. The body is a credential (the url embeds the member's encrypted Linux password), which is also why this is not an open health endpoint. The probe member is whoever has the lowest-id usable dev-machine account, filtered in Java over findAll() rather than by a hand-written query: a pinned member id rots, and a bespoke JPQL string can only be proven by booting the service. This class exists to keep KamoDesktop up; it must not be why SecurityService fails to start.