Exempt /liveness and /readiness from auth

[JannikSt]

Kubernetes liveness and readiness probes can't carry Bearer tokens or API keys, so authenticating them gates the router's own readiness on having a valid token. When JWT verification is enabled this becomes a chicken-and-egg problem:

/readiness → 401 → probe fails → pod NotReady → service has no ready endpoints → upstream consumers (e.g. the platform's find_router_url) fall back to bypassing the router → no per-run metrics

Today this only matters once you turn on --jwt-public-key-path (or --api-key-validation-urls), so prod is unaffected. But it blocks the JWT rollout the moment you flip it on.

The probes expose no sensitive information — just "process is alive" and "at least one worker is ready" — so it's safe to leave them open. User-facing /health and /health_generate keep auth.

Companion to PrimeIntellect-ai/platform#914 and #6.

---

Note

Medium Risk
Changes authentication behavior by making two endpoints publicly accessible, which could be abused for lightweight service discovery but exposes only minimal status information.

Overview
Removes the auth check from /liveness and /readiness so Kubernetes probes continue to work when JWT or API-key validation is enabled.

Adds an explicit comment documenting why these endpoints are intentionally unauthenticated, while /health (and other routes) remain protected by authorize_request.

^{Reviewed by Cursor Bugbot for commit 6dcbd14. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Exempt /liveness and /readiness endpoints from authentication

The /liveness and /readiness handlers in server.rs no longer extract headers or call authorize_request. Both endpoints now unconditionally return the router's liveness/readiness response, making them accessible without credentials.

^{Macroscope summarized 6dcbd14.}

[macroscopeapp]

Approvability

Verdict: Needs human review

This PR removes authentication checks from /liveness and /readiness endpoints. While the rationale (Kubernetes probes can't carry auth tokens) is reasonable, removing authorization from any endpoint is a security-sensitive change that requires human review to verify these endpoints expose no sensitive information.

^{You can customize Macroscope's approvability policy. Learn more.}