mirror of
https://github.com/luxfi/aml.git
synced 2026-09-24 00:25:20 +00:00
zeekayandHanzo Dev
9f072a8b2c
The defect that hid two dead endpoints for months was not that they were dead. It was that nothing could be asked whether they were alive. Screening failure is silent by construction: an empty list matches nobody, and neither does a clean party, so "no designations matched this payment" is the same answer either way. Monitor keeps the outcome of the last refresh of each list — entry count, load date, payload digest, and the reason if the last attempt failed. A failed attempt keeps the previous successful load rather than erasing it, because that data is still what screening runs against; but it ages out instead of staying fresh forever on the strength of one old success. A list that has never loaded is reported as unfit, not omitted. Ready is all-or-nothing on purpose. Screening against three of four lists is not three-quarters of a control: a party designated only on the missing list passes completely, and the result is indistinguishable from a clean one. GET /v1/aml/sanctions/sources serves this and answers 503 when any list is unfit, so a readiness probe and the dashboard read one truth instead of each deciding for itself. The dashboard panel leads with whether the instance can screen at all, above the case counts — a queue length means nothing if the lists behind it are empty — and states in words that a result against unfit lists cannot be read as clean. Six mutants killed, including the two that matter most: treating a zero-entry load as fresh, and letting three-of-four report ready. Co-authored-by: Hanzo Dev <[email protected]>