[Regression] /api/health still always reports operational — #151 was closed Completed without any code change

Severity: Medium (false operational signal; confirmed regression) Confidence: Confirmed by direct inspection of the current, unmodified route. Audited commit: bd4057567de8ee18d49a8b2744c9746bcd67f3e0 (master, 2026-09-13 audit).

This is the third report of the identical defect. #33 reported that /api/health always reports status: 'operational' with no dependency checks. #151 re-reported the exact same code after #33 was closed, and #151 was itself closed with stateReason: COMPLETED on 2026-05-21. Four months later, on the audited commit, the route is byte-for-byte the same defect: it still unconditionally returns status: 'operational' and never probes any dependency.

Evidence

• src/app/api/health/route.ts:1-21 — the entire route body:

export async function GET() {
  return NextResponse.json({
    status: 'operational',
    platform: 'OSIRIS',
    version: '1.0.0',
    uptime: process.uptime ? Math.round(process.uptime()) : 0,
    timestamp: new Date().toISOString(),
    endpoints: [ /* static list */ ],
  });
}

No fetch, no dependency probe, no cache/freshness check for any of the eight listed endpoints. status cannot be anything other than 'operational'.

Why this matters

• This is not a new bug — it is confirmation that closing #151 as "Completed" did not correspond to any code change to the file it was about.
• A health endpoint that can never report anything but healthy is worse than no health endpoint, because operators, monitors, and integrators will configure alerting against it believing it reflects real state.

Smallest correction and acceptance criteria

• Same as originally requested in #33/#151: probe at least one real dependency (e.g. a fast upstream reachability check, or freshness of the primary data caches) and let status reflect an actual failure mode, or explicitly rename/redocument the field as static build metadata if a real health check is out of scope.
• Acceptance: forcing a dependency this endpoint claims to represent into a failed state must change the reported status; if no dependency is actually checked, the response must not use a field named status: 'operational' that implies one is.
• Process ask: when closing a report as Completed, the fix should be verifiable in the diff. Re-verify #151's resolution before considering this one closed.

Prior-issue check: this is a confirmed, unresolved regression of #33 (closed) and #151 (closed as Completed, 2026-05-21) — not a new independent finding.