Source health

What the canary asks

Four indicators whose answer should not change, each asked of every source that supports its type. A run costs one request per active source, so it bypasses the cache on purpose: a cached answer would hide exactly the breakage it is looking for.

sha256  275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f  EICAR test file
url     http://malware.testing.google.test/testing/malware/             Safe Browsing sample
domain  example.com                                                       stable, benign
ip      8.8.8.8                                                           stable, benign

The first healthy answer becomes the expected one. From then on a source that answers "not found" where it used to answer "found" is a warning rather than a success — that is the shape of both silent breakages fixed in 2.6.0 and 2.7.0, neither of which returned an error.

Machine-readable: /api/v1/status returns the same data, and ?strict=1 answers 503 unless every active source is healthy.