Live · 05 — status

A pult that shows numbers,
not an inventory.

One question — is the work running? — answered with five figures: uptime over thirty days, the latency 95 % of responses stay under, requests a day, whether the last backup check passed, and every outage with a date and a duration. What the board does not carry is the map: no host, no address, no service name, no log line, no client record. That is not modesty. It is the schema.

The board

Five figures, one window.

Window 30 days · refresh at most once every 5 minutes

Uptime, 30 days: —
Latency p95: —
Requests per day: —
Backups: —
Incidents, 30 days: —

Reading the aggregate feed…

The figures are drawn from this site's own JSON endpoint, which returns the aggregate snapshot and nothing else; with JavaScript off, that snapshot is still readable directly at /.netlify/functions/status. Everything else on this page — the schema, the refusals and the limits — reads without it.

The feed

Where the numbers come from.

Source: public aggregate feed
Window: 30 days
Refresh: ≤ 1 / 5 min
Schema: closed
Visitor input: none
Browser → internals: never

The pult cannot be used to probe anything. It takes no parameters, reads one address fixed by configuration, and holds the answer for five minutes — so a visitor cannot turn it into a load generator against the systems it reports on.

The rulebook behind this — what the site reads, what it refuses, every limit as a number — is on /security.

Refusals

Never on this board.

Each of these has no field to live in: the snapshot is validated against a closed schema before it leaves the function, and the values are scanned as well, so an address smuggled into a string fails the snapshot instead of being published.

What the aggregates schema cannot carry
Never published	Why the schema is built this way
Host names	A name is half an attack surface: it invites the probe that follows. The board describes work, not real estate.
Network addresses	Public or private, an address on a page tells a stranger where to knock. Values are regex-scanned for IPv4 and IPv6, so one cannot ride in inside a string.
Service names and topology	Which component talks to which is the part of an estate that takes years to learn and seconds to abuse.
Logs and error text	A log line carries paths, versions and names by accident. A failure here is a code — `unavailable`, nothing more.
Client data	No visitor identity, no IP, no user agent, no referer, no request records. The board has no per-visitor accounting to publish.
Per-request records	Aggregates only means exactly that: a percentile and a count survive, the individual call does not.

Path

Four steps, no shortcut.

The browser talks to this site and to nothing else. The site talks to one aggregator. The aggregator is the only place that knows what a host is called.

Aggregator

A monitor runs where the systems are — an Uptime Kuma status page or a small endpoint of my own — and keeps the probes, the history and the names.

Aggregate

It publishes numbers, not observations: a percentage, two percentiles, a count, a backup state, a list of outages with a date and a duration.

Validate

This site's function reads that feed, refuses anything off-schema — an extra key, an address in a string — and holds the accepted snapshot for five minutes.

Draw

The page draws the numbers it was handed and formats nothing else. If the feed is not attached or does not answer, the board says so instead of showing zeroes.

Limits

What it cannot tell you.

Latency: one vantage point, not yours
Incident length: in heartbeat intervals
Backups: only if the feed reports them
Requests: only if the feed counts them
Availability: of what is monitored, not all of it

A field the feed does not report is printed as not reported, never as zero. A monitor that only checks the front door cannot testify about the cellar — and a board that hides that difference is decoration, not evidence.

The same function serves the live audit: one public URL at a time, refused before it can reach anything private.