From 9b3e49c90916695aa4aa576e9f8c9cd0ca84a257 Mon Sep 17 00:00:00 2001
From: kronecker <2026692687@qq.com>
Date: Tue, 13 Oct 2026 07:11:29 +0800
Subject: [PATCH] fix(proxy): expose bounded process liveness for TLS readiness

---
 scripts/release/README.md | 3 +++
 scripts/release/proxy.py  | 4 ++++
 2 files changed, 7 insertions(+)

diff --git a/scripts/release/README.md b/scripts/release/README.md
index cc9e647..b4d85c5 100644
--- a/scripts/release/README.md
+++ b/scripts/release/README.md
@@ -371,3 +371,6 @@ starts no server. Maintenance includes the proxy in start/drain/stop ordering.
 Readiness uses fixed loopback TLS with the supplied certificate as an explicit
 local trust anchor and checks hostname/leaf identity plus the API live response;
 it does not substitute for actual browser CA/HTTPS/security acceptance in the VM.
+The exact `/api/v1/health/live` route permits GET/HEAD for this bounded process
+liveness check. Other health, internal, execution and control routes remain
+outside the public proxy allowlist; liveness does not attest judging readiness.
diff --git a/scripts/release/proxy.py b/scripts/release/proxy.py
index c574a75..9b56d50 100644
--- a/scripts/release/proxy.py
+++ b/scripts/release/proxy.py
@@ -121,6 +121,10 @@ http {
         limit_conn per_site 32;
         add_header X-Content-Type-Options nosniff always;
         add_header X-Frame-Options DENY always;
+        location = /api/v1/health/live {
+            limit_except GET { deny all; }
+            PROXY
+        }
         location ~ "UPLOAD" {
             client_max_body_size 64m;
             limit_except PUT { deny all; }