Multi-source alert fallback (NWS CAP feed) #78

Closed
opened 2026-07-18 05:31:39 +00:00 by claude-bot · 1 comment
Contributor

Single-sourcing api.weather.gov is exactly what makes F-01 dangerous. NWS also publishes alerts via a separate CAP/ATOM feed on a different host; using it as a fallback when the primary API is unreachable turns "we go blind on an outage" into "we degrade to the backup." Missed because single-source was the natural MVP. Effort M, value High — structurally de-risks the top bug in this audit.


Filed from the 2026-07-17 codebase audit (docs/.internal/report-2026-07-17.md), finding I-08.

Single-sourcing `api.weather.gov` is exactly what makes F-01 dangerous. NWS also publishes alerts via a separate CAP/ATOM feed on a different host; using it as a fallback when the primary API is unreachable turns "we go blind on an outage" into "we degrade to the backup." Missed because single-source was the natural MVP. Effort M, value High — structurally de-risks the top bug in this audit. --- _Filed from the 2026-07-17 codebase audit (`docs/.internal/report-2026-07-17.md`), finding I-08._
Author
Contributor

Done in #101 (merged). When the primary /alerts/active JSON fetch exhausts its retries, the poller falls back to the CAP ATOM feed (api.weather.gov/alerts/active.atom, parsed with stdlib ElementTree) into the same NWSAlert objects, gated by NWS_CAP_FALLBACK_ENABLED (default on). Best-effort: any CAP error falls through to None, preserving the skip-cycle-on-outage semantics.

⚠️ Scope caveat: the independent alerts.weather.gov CAP host was retired and now redirects to api.weather.gov, so the fallback shares a host with the primary. It therefore guards against JSON-path-specific failures (a bad page / 5xx on that route / a parse blowup) but not a full api.weather.gov outage. True host-independent multi-source fallback would need a third-party CAP mirror — left as a possible follow-up rather than assuming one.

Done in #101 (merged). When the primary `/alerts/active` JSON fetch exhausts its retries, the poller falls back to the CAP ATOM feed (`api.weather.gov/alerts/active.atom`, parsed with stdlib ElementTree) into the same `NWSAlert` objects, gated by `NWS_CAP_FALLBACK_ENABLED` (default on). Best-effort: any CAP error falls through to `None`, preserving the skip-cycle-on-outage semantics. ⚠️ Scope caveat: the independent `alerts.weather.gov` CAP host was **retired** and now redirects to `api.weather.gov`, so the fallback shares a host with the primary. It therefore guards against JSON-path-specific failures (a bad page / 5xx on that route / a parse blowup) but **not** a full `api.weather.gov` outage. True host-independent multi-source fallback would need a third-party CAP mirror — left as a possible follow-up rather than assuming one.
Sign in to join this conversation.
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
rbrooks/WeatherBot#78
No description provided.