feat(server): say at startup when alerting is unconfigured (#107) (#140)

feat(server): say at startup when alerting is unconfigured (#107)

WARN once at startup when BRAIN_NTFY_URL is unset, naming what will not fire (brain_edit_root governance rewrites, capture audit degradation). Rebase of PR #108 (never CI-tested) onto current main, no functional change to alertingWarnings.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Co-authored-by: Mathias <mthbqv@gmail.com>

ingestion/cmd/server/main.go

@@ -147,6 +147,37 @@ func envInt(key string, fallback int) int {
 // buildNotifier returns the ntfy notifier, or a nil interface when
 // BRAIN_NTFY_URL is unset. A nil *interface* (not a typed-nil) is required so
 // DegradingSink/Reconcile and the governance observer skip it cleanly.
+// alertingWarnings names every alert that will not fire under the current
+// configuration (#107).
+//
+// buildNotifier returns a nil interface when BRAIN_NTFY_URL is unset, and every
+// consumer skips a nil notifier silently — right for an unconfigured homelab,
+// wrong for an alert whose entire value is that someone finds out. The cost of
+// the silence is that "configured and working" and "never configured" are
+// byte-identical in behaviour: no error, no warning, only a message that never
+// arrives, which nobody notices because nobody is waiting for an alert they
+// have never seen. Two alerts were dark in production for exactly that reason
+// (#100), found by firing a real event rather than by reading anything.
+//
+// WARN rather than fatal, deliberately. The brain sibling rule
+// (`empty-credential-must-refuse-to-start-not-switch-modes`) says an empty
+// credential must be a startup error, never a silent mode switch — but that is
+// about a control being removed. Here observability is degraded, not a gate
+// bypassed, and refusing to boot would break the unconfigured-homelab case the
+// nil notifier exists to support. What the rule does demand, and what this
+// provides, is that the mode switch stops being silent.
+//
+// Pure and env-injected so the message is testable without a running server:
+// the reason this gap survived is that nothing about it was observable.
+func alertingWarnings(getenv func(string) string) []string {
+	var out []string
+	if getenv("BRAIN_NTFY_URL") == "" {
+		out = append(out, "alerting DISABLED: BRAIN_NTFY_URL unset — "+
+			"brain_edit_root governance rewrites and capture audit degradation will not notify")
+	}
+	return out
+}
+
 func buildNotifier() audit.Notifier {
 	if n := audit.NewNtfyNotifier(os.Getenv("BRAIN_NTFY_URL"), os.Getenv("BRAIN_NTFY_TOKEN")); n != nil {
 		return n
@@ -203,6 +234,10 @@ func systemHostname() string {
 func main() {
 	logger := slog.New(slog.NewJSONHandler(os.Stdout, nil))
 
+	for _, w := range alertingWarnings(os.Getenv) {
+		logger.Warn(w)
+	}
+
 	brainDir := envOr("INGEST_BRAIN_DIR", "../brain")
 	port := envOr("INGEST_PORT", "3300")