Agent-readiness probe — live task success rates + circuit-breaker state

Zero-auth, per-IP rate-limited (Category A — 1000/min soft cap), and NEVER cached (Cache-Control: no-store). Call this BEFORE submitting a batch of compliance workflows to decide whether to proceed, throttle, or hand over to a human.

Returns two health signals. (1) circuit_breaker — the live Maskinporten circuit-breaker verdict: CLOSED = healthy, OPEN / HALF_OPEN = the upstream is failing or probing recovery, UNKNOWN = the breaker read itself failed. status is the boolean projection — ready only when the breaker is CLOSED, otherwise degraded. (2) endpoints — per-workflow-class live task success rate + p95 latency drawn from the task_success_log telemetry view.

Each endpoints.* entry carries a source flag: live when the value came from accumulated telemetry, fallback when no rows have been logged yet for that workflow class and a conservative static default (derived from load-test + staging) was substituted. Treat fallback rates as indicative, not measured. A null entry means the underlying read rejected unexpectedly — degrade gracefully rather than blocking.

This surface is distinct from the un-versioned infrastructure liveness check at /api/health: that one answers 'is the process up?', this one answers 'should an agent trust Apier with a workflow right now?'. The response always uses HTTP 200 — a degraded verdict is reported in the body, never via status code, so the probe always answers.

The envelope _meta.source is the honesty signal for the rates above: it reads apier.no telemetry when at least one endpoint's rate came from measured live telemetry, and the neutral apier.no when every endpoint is still serving its static fallback (the low-traffic default today, and the case when both reads reject) — so the envelope never advertises a measurement it doesn't have.