---
id: server-healthz-decoy
name: /healthz raw route and stealth decoy fallback
status: pending
depends_on: [server-core-types]
scope: narrow
risk: low
impact: component
level: implementation
tags: [server, phase-1]
---

## Description

Port `healthz` (`server/healthz.rs` — raw 200 "ok", no auth, no call
protocol) and the decoy fallback (`server/decoy.rs` — fake nginx-style
404, static site, or redirect per `DecoyConfig`). Ported from
`/workspace/@alkdev/alknet/crates/alknet-http/src/server/{healthz,decoy}.rs`.
Tests: healthz responds without auth; decoy serves all three configs.

## Acceptance Criteria

- [ ] `/healthz` returns 200 text/plain without auth
- [ ] Decoy fallback for unmatched paths per DecoyConfig (404/static/redirect)
- [ ] Reserved paths (6 gateway + /healthz + /openapi.json + /mcp + /alk/channels) never hit the decoy
- [ ] `cargo test` passes

## References

- docs/architecture/http-server.md (§/healthz, §Stealth decoy)
- docs/architecture/decisions/010-alpn-router-and-endpoint.md

## Notes

> Agent fills during implementation.

## Summary

> Agent fills on completion.