Remove legacy health plugin namespace

Author: marcofortina

docs/plugins/generated.md

@@ -4561,144 +4561,6 @@ with:
   name: nginx
 ```
 
-## health
-
-### `health.http`
-
-Assert HTTP status and optional body content from the controller.
-
-- Remote session: `false`
-- Dry-run support: `true`
-- Check mode support: `false`
-
-| Parameter | Required | Type | Default | Description |
-|---|---:|---|---|---|
-| `url` | yes | `string` |  | HTTP URL. |
-| `method` | no | `string` | `GET` | HTTP request method. |
-| `headers` | no | `mapping` |  | HTTP request headers. |
-| `body` | no | `string` |  | Raw HTTP request body. |
-| `json` | no | `mapping` |  | JSON HTTP request body. |
-| `timeout` | no | `number` |  | Operation timeout in seconds. |
-| `encoding` | no | `string` | `utf-8` | Text encoding used for command output, HTTP bodies or file content. |
-| `validate_tls` | no | `boolean` | `True` | Validate TLS certificates for HTTPS requests. |
-| `expected_status` | no | `integer` | `200` | Expected HTTP status code. |
-| `status` | no | `integer` |  | Expected HTTP status code alias. |
-| `contains` | no | `string` |  | Required substring in stdout or HTTP response body. |
-
-Result fields:
-
-- `changed`: Whether the plugin changed the target or controller state.
-- `message`: Human-readable result message.
-- `rc`: Process or command return code when applicable.
-- `stdout`: Captured standard output when applicable.
-- `stderr`: Captured standard error when applicable.
-- `data`: Plugin-specific structured result data.
-
-Example:
-
-```yaml
-use: health.http
-with:
-  url: https://example.invalid/health
-```
-
-### `health.listen`
-
-Assert that a TCP port is listening on the target.
-
-- Remote session: `true`
-- Dry-run support: `true`
-- Check mode support: `false`
-
-| Parameter | Required | Type | Default | Description |
-|---|---:|---|---|---|
-| `port` | yes | `integer` |  | TCP port number. |
-| `host` | no | `string` |  | Hostname or IP address to check from the controller. |
-| `listen` | no | `boolean` | `True` | Check whether a port is listening on the target. |
-| `timeout` | no | `number` |  | Operation timeout in seconds. |
-| `sudo` | no | `boolean` | `False` | Run the remote operation through sudo -n when supported. |
-
-Result fields:
-
-- `changed`: Whether the plugin changed the target or controller state.
-- `message`: Human-readable result message.
-- `rc`: Process or command return code when applicable.
-- `stdout`: Captured standard output when applicable.
-- `stderr`: Captured standard error when applicable.
-- `data`: Plugin-specific structured result data.
-
-Example:
-
-```yaml
-use: health.listen
-with:
-  port: 22
-```
-
-### `health.port`
-
-Assert that a TCP port is reachable from the controller or listening on the target.
-
-- Remote session: `true`
-- Dry-run support: `true`
-- Check mode support: `false`
-
-| Parameter | Required | Type | Default | Description |
-|---|---:|---|---|---|
-| `port` | yes | `integer` |  | TCP port number. |
-| `host` | no | `string` |  | Hostname or IP address to check from the controller. |
-| `listen` | no | `boolean` | `True` | Check whether a port is listening on the target. |
-| `timeout` | no | `number` |  | Operation timeout in seconds. |
-| `sudo` | no | `boolean` | `False` | Run the remote operation through sudo -n when supported. |
-
-Result fields:
-
-- `changed`: Whether the plugin changed the target or controller state.
-- `message`: Human-readable result message.
-- `rc`: Process or command return code when applicable.
-- `stdout`: Captured standard output when applicable.
-- `stderr`: Captured standard error when applicable.
-- `data`: Plugin-specific structured result data.
-
-Example:
-
-```yaml
-use: health.port
-with:
-  port: 22
-```
-
-### `health.process`
-
-Assert that a remote process matching a pattern exists or is absent.
-
-- Remote session: `true`
-- Dry-run support: `true`
-- Check mode support: `false`
-
-| Parameter | Required | Type | Default | Description |
-|---|---:|---|---|---|
-| `pattern` | yes | `string` |  | Regex, process pattern or search pattern. |
-| `state` | no | `string` |  | Desired state such as present, absent, started or stopped. |
-| `sudo` | no | `boolean` | `False` | Run the remote operation through sudo -n when supported. |
-
-Result fields:
-
-- `changed`: Whether the plugin changed the target or controller state.
-- `message`: Human-readable result message.
-- `rc`: Process or command return code when applicable.
-- `stdout`: Captured standard output when applicable.
-- `stderr`: Captured standard error when applicable.
-- `data`: Plugin-specific structured result data.
-
-Example:
-
-```yaml
-use: health.process
-with:
-  pattern: KEY=.*
-```
-
 ## hostname
 
 ### `hostname.set`

docs/plugins/index.md

@@ -150,10 +150,6 @@ group.exists
 group.member_absent
 group.members
 group.remove
-health.http
-health.listen
-health.port
-health.process
 hostname.set
 hosts.entry
 http.assert

docs/plugins/linux-operations.md

@@ -113,12 +113,12 @@ backend-aware through the same safety rules as `network.dns`: managed or
 symlinked resolver files are not overwritten silently.
 
 
-## Service health assertions
+## Runtime service checks
 
-Use `health.port`, `health.listen`, `health.process` and `health.http` to assert
-that ports, processes and HTTP endpoints are available after a change. These
-macros are read-only and provide explicit no-diff reasons plus copy/pasteable
-manual checks.
+Use `network.port_check` for target-side TCP/UDP connectivity checks,
+`http.request` for controller-side HTTP probes, and the `process.*` family for
+process lifecycle checks. The former service-health wrapper namespace is
+intentionally not part of the public plugin surface.
 
 
 ## Certificate and PKI operations

examples/runbooks/RUNBOOK_INDEX.md

@@ -26,7 +26,6 @@ Per-plugin runbooks only. No combined runbook, no reused runtime smoke flow, and
 | `runbooks/20-fs.check.yaml` | `fs` | 27 |
 | `runbooks/21-fstab.check.yaml` | `fstab` | 4 |
 | `runbooks/22-group.check.yaml` | `group` | 5 |
-| `runbooks/23-health.check.yaml` | `health` | 4 |
 | `runbooks/24-hostname.check.yaml` | `hostname` | 1 |
 | `runbooks/25-hosts.check.yaml` | `hosts` | 1 |
 | `runbooks/26-http.check.yaml` | `http` | 3 |

examples/runbooks/runbooks/23-health.check.yaml

@@ -328,12 +328,6 @@ def build_builtin_registry(extra_plugin_paths: Iterable[str] = ()) -> PluginRegi
         PamSucceedIfPlugin,
         PamValidatePlugin,
     )
-    from automax.plugins.health import (
-        HealthHttpPlugin,
-        HealthListenPlugin,
-        HealthPortPlugin,
-        HealthProcessPlugin,
-    )
     from automax.plugins.pki import (
         PkiCaInstallPlugin,
         PkiCertExpiryAssertPlugin,
@@ -764,10 +758,6 @@ def build_builtin_registry(extra_plugin_paths: Iterable[str] = ()) -> PluginRegi
         NetworkRouteAssertPlugin(),
         NetworkDnsAssertPlugin(),
         NetworkPortCheckPlugin(),
-        HealthPortPlugin(),
-        HealthListenPlugin(),
-        HealthProcessPlugin(),
-        HealthHttpPlugin(),
         PkiCaInstallPlugin(),
         PkiKeyPermissionsPlugin(),
         PkiCertExpiryAssertPlugin(),

src/automax/plugins/health.py

@@ -838,6 +838,22 @@ def test_read_only_command_plugin_is_shared_base_class():
 
 
 
+
+def test_health_namespace_is_removed_from_public_documentation_and_runbooks():
+    from automax.plugins.registry import build_builtin_registry
+
+    assert not any(name.startswith("health.") for name in build_builtin_registry().names())
+
+    searched = [
+        Path("docs/plugins/index.md"),
+        Path("docs/plugins/linux-operations.md"),
+        Path("docs/plugins/generated.md"),
+        Path("examples/runbooks/RUNBOOK_INDEX.md"),
+        *Path("examples/runbooks/runbooks").glob("*.check.yaml"),
+    ]
+    offenders = [str(path) for path in searched if "health." in path.read_text(encoding="utf-8")]
+    assert offenders == []
+
 def test_resolver_namespace_is_not_public_plugin_surface():
     from automax.plugins.registry import build_builtin_registry
 

src/automax/plugins/registry.py

@@ -3639,19 +3639,14 @@ def test_network_plugins_render_interface_route_bond_vlan_dns():
     assert NetworkDnsPlugin().manual_commands({"nameservers": ["192.0.2.53"]}, context)
 
 
-def test_health_plugins_render_safe_assertions():
-    from automax.plugins.health import HealthHttpPlugin, HealthListenPlugin, HealthPortPlugin, HealthProcessPlugin
-
+def test_health_namespace_is_not_public_plugin_surface():
     names = AutomaxEngine().plugin_registry.names()
-    for name in ("health.port", "health.listen", "health.process", "health.http"):
-        assert name in names
 
-    context = _sysops_preview_context()
-    assert "ss -H -ltn" in HealthPortPlugin().manual_commands({"port": 443}, context)[0]
-    assert "ss -H -ltn" in HealthListenPlugin().manual_commands({"port": 8443}, context)[0]
-    assert "pgrep -af" in HealthProcessPlugin().manual_commands({"pattern": "sshd"}, context)[0]
-    assert "read-only process assertion" in HealthProcessPlugin().diff_preview_reason({"pattern": "sshd"}, context)
-    assert HealthHttpPlugin().name == "health.http"
+    assert not any(name.startswith("health.") for name in names)
+    assert "http.request" in names
+    assert "network.port_check" in names
+    assert "process.assert_absent" in names
+    assert "process.assert_count" in names
 
 
 def test_pki_plugins_install_permissions_and_expiry_preview():