---
id: server-healthz-decoy
name: /healthz raw route and stealth decoy fallback
status: completed
depends_on: [server-core-types]
scope: narrow
risk: low
impact: component
level: implementation
tags: [server, phase-1]
---

## Description

Port `healthz` (`server/healthz.rs` — raw 200 "ok", no auth, no call
protocol) and the decoy fallback (`server/decoy.rs` — fake nginx-style
404, static site, or redirect per `DecoyConfig`). Ported from
`/workspace/@alkdev/alknet/crates/alknet-http/src/server/{healthz,decoy}.rs`.
Tests: healthz responds without auth; decoy serves all three configs.

## Acceptance Criteria

- [x] `/healthz` returns 200 text/plain without auth
- [x] Decoy fallback for unmatched paths per DecoyConfig (404/static/redirect)
- [x] Reserved paths (6 gateway + /healthz + /openapi.json + /mcp + /alk/channels) never hit the decoy
- [x] `cargo test` passes

## References

- docs/architecture/http-server.md (§/healthz, §Stealth decoy)
- docs/architecture/decisions/010-alpn-router-and-endpoint.md

## Notes

> Agent fills during implementation.

## Summary

Ported `src/server/healthz.rs` (raw 200 "ok", no auth) and
`src/server/decoy.rs` (fake nginx 404 / static site with path-traversal
guard / redirect). Reserved-path protection is enforced in
`HttpAdapter`'s router (gateway routes take precedence; decoy is the
fallback). Tests: 7 decoy + 2 healthz.