Skip to main content
A process may answer a health check while lacking the permissions, approved supply or protected storage needed to execute a model call safely. Gateway’s design therefore separates liveness from serving readiness. Readiness is specific to the profile and capabilities being offered, not one global green light for every possible path.

​
Identify the actual running profile

Begin with the installed binary or image, source and dependency versions, enabled features and effective configuration. The database routines and permissions must match the intended composition. A historical source commit or a successful local build does not identify what is serving today. Mixing individually valid pieces from different source generations also does not prove that their combination is qualified.

​
Establish current permission

The serving process needs its actual authorized writer and reader context, current credential custody and permitted targets. These facts come from their owning issuers and installed controls. A role name, environment variable or startup identifier cannot attest all of that by itself. Current revocation and scope restrictions must still be enforceable.

​
Install a coherent approved catalogue

Gateway needs the complete applicable supply and policy version, with valid references and the information required to interpret it later. If the mandatory baseline is missing, startup must not quietly route through a permissive baked-in model configuration. A valid old pin may explain an earlier call; it is not a substitute for current admission requirements.

​
Check the evidence and resource boundaries

Protected execution transactions and confirmation must be usable. Required native capacity mapping, finite queues, byte limits and time controls must fit the profile. Persistent failure of mandatory execution storage removes readiness for new affected model work. By contrast, degradation of the separate provider-observation reporting path is visible but normally does not block inference. These failures have different consequences because the records have different jobs. A financial profile also needs its required genuine producer and receiver inputs before claiming qualified settlement behavior. A fake acknowledgement is not a startup fallback.

​
Explain what is unavailable

A failed readiness gate should name the missing or incompatible dependency. It should not silently borrow another credential, broaden a region policy or advertise a capability that was never qualified. An individual offering may be excluded while other approved routes remain usable. That is not the same as declaring the entire engine healthy or unhealthy for every request.

​
This is a review path, not a live runbook

The source set does not establish today’s deployed endpoint names, alert thresholds or exact operator commands. Those belong in the selected deployment’s operational supplement. Use this page to ask the right questions, then attach actual observed answers for the running environment. See What has actually been demonstrated and Investigating a request.