Audit finding. Healthy consults only the app port (native.go:556-558); Watch restarts on app death only; the adopt path checks only app health and never calls Up — so the gateway kill-preflight (#268/#270) can't run there. Consequences: a crashed bifrost under a live app stays down until manual Restart; a version-stale bifrost under a live app (the original Aug-7 drift) remains possible via adoption even post-fix.
Fix direction: Watch probes the gateway port too (restart path already exists); adoption verifies the gateway's identity+liveness via portHolderPid + marker, and triggers a Down/Up cycle when the gateway is missing or fails identity.
Status (re-triaged 2026-08-28)
Partly addressed: the gateway preflight/heal exists in Up (native.go) and version drift on the update path is bounded by Native.Running. Still open: Healthy probes the app port only, Watch restarts only on app unhealth, and the adopt path never runs Up. Design first: restart the whole stack vs gateway-only, and the 3-per-10-min restart budget.
Done means: With the app healthy and bifrost killed, Watch notices within one tick and returns the stack to both ports healthy.
Audit finding.
Healthyconsults only the app port (native.go:556-558); Watch restarts on app death only; the adopt path checks only app health and never calls Up — so the gateway kill-preflight (#268/#270) can't run there. Consequences: a crashed bifrost under a live app stays down until manual Restart; a version-stale bifrost under a live app (the original Aug-7 drift) remains possible via adoption even post-fix.Fix direction: Watch probes the gateway port too (restart path already exists); adoption verifies the gateway's identity+liveness via portHolderPid + marker, and triggers a Down/Up cycle when the gateway is missing or fails identity.
Status (re-triaged 2026-08-28)
Partly addressed: the gateway preflight/heal exists in
Up(native.go) and version drift on the update path is bounded byNative.Running. Still open:Healthyprobes the app port only,Watchrestarts only on app unhealth, and the adopt path never runs Up. Design first: restart the whole stack vs gateway-only, and the 3-per-10-min restart budget.Done means: With the app healthy and bifrost killed, Watch notices within one tick and returns the stack to both ports healthy.