A health check is an application-supplied diagnostic. It implements org.eclipse.microprofile.health.HealthCheck and returns a HealthCheckResponse carrying a name, a status (UP/DOWN) and an optional data map. A check is associated with exactly one probe through its qualifier.

A probe is a category of checks answering a specific operational question. Knock models them with the ProbeType enum:

The registry holds the registered checks and returns them filtered by probe type. The contract is the HealthCheckRegistry interface (in knock-api); the standalone implementation is KnockHealthCheckRegistry (in knock-core). It is virtual-thread friendly: state lives in a ConcurrentHashMap, never guarded by synchronized.

Aggregation reduces a set of individual responses to a single status. The rule (spec §3.2): the group is DOWN if at least one check is DOWN; an empty group is UP; an exception is folded into a DOWN check rather than being propagated. KnockAggregator implements this and produces a HealthSnapshot.

A snapshot (HealthSnapshot, an immutable record) captures the result of an aggregation: the probe type, the overall status, and the immutable list of individual checks. It is the input handed to serialisation, decoupling computation from rendering.

The JSON contract (spec §3.1) is fixed:

Knock renders it with Jakarta JSON-P only — no StringBuilder, no third-party JSON library. HealthReport wraps the serialised payload together with the HTTP status.

In a CDI deployment, checks are discovered by a Build Compatible Extension (HealthCheckCdiExtension) running on Vauban. It validates the single-qualifier rule at build time, then HealthCheckRegistrar registers each discovered bean into the registry when @Initialized(ApplicationScoped.class) fires. Outside CDI, the same registry is fed manually — the core never depends on a container.

Knock keeps responsibilities split so the core stays dependency-light:

Internal packages (io.vidocq.knock.internal, io.vidocq.knock.cdi.internal) are never exported.