Address publication review feedback

Add the AGPL LICENSE file and a deployment-security note in the README
to clarify that the unauthenticated /collect endpoint must run on a
trusted network.

Fix the IPv6 reachability rule so it consults the IP actually probed:
PingTargetResult now carries ResolvedIP populated from pinger.IPAddr(),
which lets the rule classify hostname targets correctly instead of
always reporting "No IPv6 target pinged".

Tighten error handling: ipsFromService now propagates JSON errors,
ExtractMetrics wraps decode failures, the count option returns an
explicit error when out of range instead of silently clamping, and the
"all pings failed" message no longer concatenates every per-target
error. Threshold validation is factored into validateThresholdPair and
shared between the RTT and packet-loss rules.

Add unit tests covering address resolution, threshold validation, and
each rule's evaluation paths.

checker/collect.go

@@ -26,7 +26,6 @@ import (
 	"encoding/json"
 	"fmt"
 	"net"
-	"strings"
 	"time"
 
 	probing "github.com/prometheus-community/pro-bing"
@@ -45,12 +44,10 @@ func (p *pingProvider) Collect(ctx context.Context, opts sdk.CheckerOptions) (an
 		return nil, err
 	}
 
+	const minCount, maxCount = 1, 20
 	count := sdk.GetIntOption(opts, "count", 5)
-	if count < 1 {
-		count = 1
-	}
-	if count > 20 {
-		count = 20
+	if count < minCount || count > maxCount {
+		return nil, fmt.Errorf("count must be between %d and %d, got %d", minCount, maxCount, count)
 	}
 
 	data := &PingData{}
@@ -76,8 +73,13 @@ func (p *pingProvider) Collect(ctx context.Context, opts sdk.CheckerOptions) (an
 		}
 
 		stats := pinger.Statistics()
+		var resolved string
+		if ip := pinger.IPAddr(); ip != nil {
+			resolved = ip.IP.String()
+		}
 		data.Targets = append(data.Targets, PingTargetResult{
 			Address:    addr,
+			ResolvedIP: resolved,
 			RTTMin:     float64(stats.MinRtt.Microseconds()) / 1000.0,
 			RTTAvg:     float64(stats.AvgRtt.Microseconds()) / 1000.0,
 			RTTMax:     float64(stats.MaxRtt.Microseconds()) / 1000.0,
@@ -88,7 +90,7 @@ func (p *pingProvider) Collect(ctx context.Context, opts sdk.CheckerOptions) (an
 	}
 
 	if len(data.Targets) == 0 {
-		return nil, fmt.Errorf("all pings failed: %s", strings.Join(errs, "; "))
+		return nil, fmt.Errorf("all %d ping(s) failed; first error: %s", len(errs), errs[0])
 	}
 
 	return data, nil
@@ -128,7 +130,10 @@ func resolveAddresses(opts sdk.CheckerOptions) ([]string, error) {
 		if svc.Type != "abstract.Server" {
 			return nil, fmt.Errorf("service is %s, expected abstract.Server", svc.Type)
 		}
-		ips := ipsFromService(&svc)
+		ips, err := ipsFromService(&svc)
+		if err != nil {
+			return nil, fmt.Errorf("decode service payload: %w", err)
+		}
 		if len(ips) > 0 {
 			addrs := make([]string, len(ips))
 			for i, ip := range ips {
@@ -142,10 +147,10 @@ func resolveAddresses(opts sdk.CheckerOptions) ([]string, error) {
 	return nil, fmt.Errorf("no addresses provided: set 'addresses', 'address', or 'service' in options")
 }
 
-func ipsFromService(svc *happydns.ServiceMessage) []net.IP {
+func ipsFromService(svc *happydns.ServiceMessage) ([]net.IP, error) {
 	var server abstract.Server
 	if err := json.Unmarshal(svc.Service, &server); err != nil {
-		return nil
+		return nil, err
 	}
 
 	var ips []net.IP
@@ -155,5 +160,5 @@ func ipsFromService(svc *happydns.ServiceMessage) []net.IP {
 	if server.AAAA != nil && len(server.AAAA.AAAA) > 0 {
 		ips = append(ips, server.AAAA.AAAA)
 	}
-	return ips
+	return ips, nil
 }

checker/collect_test.go

@@ -0,0 +1,121 @@
+// This file is part of the happyDomain (R) project.
+// Copyright (c) 2020-2026 happyDomain
+// Authors: Pierre-Olivier Mercier, et al.
+//
+// This program is offered under a commercial and under the AGPL license.
+// For commercial licensing, contact us at <contact@happydomain.org>.
+//
+// For AGPL licensing:
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+package checker
+
+import (
+	"encoding/json"
+	"net"
+	"strings"
+	"testing"
+
+	sdk "git.happydns.org/checker-sdk-go/checker"
+	happydns "git.happydns.org/happyDomain/model"
+	"git.happydns.org/happyDomain/services/abstract"
+	"github.com/miekg/dns"
+)
+
+func TestResolveAddressesAddressesSlice(t *testing.T) {
+	cases := []sdk.CheckerOptions{
+		{"addresses": []string{"1.1.1.1", "2.2.2.2"}},
+		{"addresses": []any{"1.1.1.1", "2.2.2.2"}},
+		{"addresses": []any{"1.1.1.1", "", "2.2.2.2"}}, // empties dropped
+	}
+	for i, opts := range cases {
+		got, err := resolveAddresses(opts)
+		if err != nil {
+			t.Fatalf("[%d] err: %v", i, err)
+		}
+		if len(got) != 2 || got[0] != "1.1.1.1" || got[1] != "2.2.2.2" {
+			t.Errorf("[%d] got %v", i, got)
+		}
+	}
+}
+
+func TestResolveAddressesSingle(t *testing.T) {
+	got, err := resolveAddresses(sdk.CheckerOptions{"address": "8.8.8.8"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(got) != 1 || got[0] != "8.8.8.8" {
+		t.Errorf("got %v", got)
+	}
+}
+
+func TestResolveAddressesMissing(t *testing.T) {
+	if _, err := resolveAddresses(sdk.CheckerOptions{}); err == nil {
+		t.Error("expected error for missing addresses")
+	}
+}
+
+func TestResolveAddressesEmptyStringIgnored(t *testing.T) {
+	if _, err := resolveAddresses(sdk.CheckerOptions{"address": ""}); err == nil {
+		t.Error("expected error when address is empty string")
+	}
+}
+
+func TestResolveAddressesWrongServiceType(t *testing.T) {
+	svc := happydns.ServiceMessage{
+		ServiceMeta: happydns.ServiceMeta{Type: "abstract.NotAServer"},
+		Service:     json.RawMessage(`{}`),
+	}
+	_, err := resolveAddresses(sdk.CheckerOptions{"service": svc})
+	if err == nil || !strings.Contains(err.Error(), "expected abstract.Server") {
+		t.Errorf("got err=%v", err)
+	}
+}
+
+func TestIpsFromService(t *testing.T) {
+	srv := abstract.Server{
+		A:    &dns.A{A: net.ParseIP("192.0.2.1").To4()},
+		AAAA: &dns.AAAA{AAAA: net.ParseIP("2001:db8::1")},
+	}
+	raw, err := json.Marshal(srv)
+	if err != nil {
+		t.Fatal(err)
+	}
+	msg := &happydns.ServiceMessage{Service: raw}
+	ips, err := ipsFromService(msg)
+	if err != nil {
+		t.Fatalf("err: %v", err)
+	}
+	if len(ips) != 2 {
+		t.Fatalf("got %d ips, want 2: %v", len(ips), ips)
+	}
+}
+
+func TestIpsFromServiceMalformed(t *testing.T) {
+	msg := &happydns.ServiceMessage{Service: json.RawMessage(`{not json`)}
+	if _, err := ipsFromService(msg); err == nil {
+		t.Error("expected error on malformed payload")
+	}
+}
+
+func TestIpsFromServiceEmpty(t *testing.T) {
+	msg := &happydns.ServiceMessage{Service: json.RawMessage(`{}`)}
+	ips, err := ipsFromService(msg)
+	if err != nil {
+		t.Fatalf("err: %v", err)
+	}
+	if len(ips) != 0 {
+		t.Errorf("expected 0 ips, got %v", ips)
+	}
+}

checker/provider.go

@@ -23,6 +23,7 @@ package checker
 
 import (
 	"encoding/json"
+	"fmt"
 	"time"
 
 	happydns "git.happydns.org/checker-sdk-go/checker"
@@ -51,7 +52,7 @@ func (p *pingProvider) Key() happydns.ObservationKey {
 func (p *pingProvider) ExtractMetrics(ctx happydns.ReportContext, collectedAt time.Time) ([]happydns.CheckMetric, error) {
 	var data PingData
 	if err := json.Unmarshal(ctx.Data(), &data); err != nil {
-		return nil, err
+		return nil, fmt.Errorf("decode ping data: %w", err)
 	}
 
 	metrics := Metrics(&data, collectedAt)

checker/rule.go

@@ -42,11 +42,20 @@ func Rules() []sdk.CheckRule {
 	}
 }
 
-// Rule returns the primary rule (reachability) for backward compatibility
-// with callers that expect a single rule; prefer Rules() which returns the
-// full rule set.
-func Rule() sdk.CheckRule {
-	return &reachabilityRule{}
+// validateThresholdPair checks that warn and crit are within [min, max] and
+// that crit is strictly greater than warn. The names are used in error
+// messages so callers get diagnostics naming their actual options.
+func validateThresholdPair(warnName, critName string, warn, crit, min, max float64) error {
+	if warn < min || warn > max {
+		return fmt.Errorf("%s must be between %v and %v", warnName, min, max)
+	}
+	if crit < min || crit > max {
+		return fmt.Errorf("%s must be between %v and %v", critName, min, max)
+	}
+	if crit <= warn {
+		return fmt.Errorf("%s (%v) must be greater than %s (%v)", critName, crit, warnName, warn)
+	}
+	return nil
 }
 
 // loadPingData fetches the ping observation. On error, returns a CheckState

checker/rule_test.go

@@ -0,0 +1,113 @@
+// This file is part of the happyDomain (R) project.
+// Copyright (c) 2020-2026 happyDomain
+// Authors: Pierre-Olivier Mercier, et al.
+//
+// This program is offered under a commercial and under the AGPL license.
+// For commercial licensing, contact us at <contact@happydomain.org>.
+//
+// For AGPL licensing:
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+package checker
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"testing"
+
+	sdk "git.happydns.org/checker-sdk-go/checker"
+)
+
+// stubObs implements sdk.ObservationGetter for tests. If err is non-nil, Get
+// returns it; otherwise it JSON-roundtrips data into dest so callers see the
+// same shape they would get over HTTP.
+type stubObs struct {
+	data any
+	err  error
+}
+
+func (s stubObs) Get(_ context.Context, _ sdk.ObservationKey, dest any) error {
+	if s.err != nil {
+		return s.err
+	}
+	raw, err := json.Marshal(s.data)
+	if err != nil {
+		return err
+	}
+	return json.Unmarshal(raw, dest)
+}
+
+func (s stubObs) GetRelated(_ context.Context, _ sdk.ObservationKey) ([]sdk.RelatedObservation, error) {
+	return nil, nil
+}
+
+func obsWith(targets ...PingTargetResult) stubObs {
+	return stubObs{data: PingData{Targets: targets}}
+}
+
+func TestIsIPv6(t *testing.T) {
+	cases := []struct {
+		addr string
+		want bool
+	}{
+		{"::1", true},
+		{"2001:db8::1", true},
+		{"127.0.0.1", false},
+		{"::ffff:192.0.2.1", false}, // IPv4-mapped is treated as IPv4
+		{"example.com", false},
+		{"", false},
+		{"not-an-ip", false},
+	}
+	for _, c := range cases {
+		if got := isIPv6(c.addr); got != c.want {
+			t.Errorf("isIPv6(%q) = %v, want %v", c.addr, got, c.want)
+		}
+	}
+}
+
+func TestLoadPingDataError(t *testing.T) {
+	_, st := loadPingData(context.Background(), stubObs{err: errors.New("boom")})
+	if st == nil {
+		t.Fatal("expected error CheckState, got nil")
+	}
+	if st.Status != sdk.StatusError {
+		t.Errorf("status = %v, want StatusError", st.Status)
+	}
+	if st.Code != "ping.observation_error" {
+		t.Errorf("code = %q, want ping.observation_error", st.Code)
+	}
+}
+
+func TestLoadPingDataOK(t *testing.T) {
+	d, st := loadPingData(context.Background(), obsWith(PingTargetResult{Address: "1.1.1.1"}))
+	if st != nil {
+		t.Fatalf("unexpected error state: %+v", st)
+	}
+	if len(d.Targets) != 1 || d.Targets[0].Address != "1.1.1.1" {
+		t.Errorf("unexpected data: %+v", d)
+	}
+}
+
+func TestRulesContainsAll(t *testing.T) {
+	names := map[string]bool{}
+	for _, r := range Rules() {
+		names[r.Name()] = true
+	}
+	for _, want := range []string{"ping.reachable", "ping.packet_loss", "ping.rtt", "ping.ipv6_reachable"} {
+		if !names[want] {
+			t.Errorf("Rules() missing %q", want)
+		}
+	}
+}

checker/rules_ipv6.go

@@ -45,7 +45,11 @@ func (r *ipv6ReachabilityRule) Evaluate(ctx context.Context, obs sdk.Observation
 
 	var ipv6Total, ipv6Reachable int
 	for _, t := range data.Targets {
-		if !isIPv6(t.Address) {
+		probed := t.ResolvedIP
+		if probed == "" {
+			probed = t.Address
+		}
+		if !isIPv6(probed) {
 			continue
 		}
 		ipv6Total++

checker/rules_ipv6_test.go

@@ -0,0 +1,80 @@
+// This file is part of the happyDomain (R) project.
+// Copyright (c) 2020-2026 happyDomain
+// Authors: Pierre-Olivier Mercier, et al.
+//
+// This program is offered under a commercial and under the AGPL license.
+// For commercial licensing, contact us at <contact@happydomain.org>.
+//
+// For AGPL licensing:
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+package checker
+
+import (
+	"context"
+	"testing"
+
+	sdk "git.happydns.org/checker-sdk-go/checker"
+)
+
+func TestIPv6ReachabilityEvaluate(t *testing.T) {
+	r := &ipv6ReachabilityRule{}
+	ctx := context.Background()
+
+	cases := []struct {
+		name     string
+		targets  []PingTargetResult
+		wantStat sdk.Status
+		wantCode string
+	}{
+		{
+			name:     "no v6 targets",
+			targets:  []PingTargetResult{{Address: "1.1.1.1", Sent: 5, Received: 5}},
+			wantStat: sdk.StatusUnknown,
+			wantCode: "ping.ipv6_reachable.skipped",
+		},
+		{
+			name: "v6 reachable",
+			targets: []PingTargetResult{
+				{Address: "1.1.1.1", Sent: 5, Received: 5},
+				{Address: "2001:db8::1", Sent: 5, Received: 5},
+			},
+			wantStat: sdk.StatusOK,
+			wantCode: "ping.ipv6_reachable.ok",
+		},
+		{
+			name: "all v6 unreachable",
+			targets: []PingTargetResult{
+				{Address: "2001:db8::1", Sent: 5, Received: 0},
+				{Address: "2001:db8::2", Sent: 5, Received: 0},
+			},
+			wantStat: sdk.StatusWarn,
+			wantCode: "ping.ipv6_reachable.unreachable",
+		},
+	}
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			states := r.Evaluate(ctx, obsWith(c.targets...), sdk.CheckerOptions{})
+			if len(states) != 1 {
+				t.Fatalf("got %d states, want 1", len(states))
+			}
+			if states[0].Status != c.wantStat {
+				t.Errorf("status = %v, want %v", states[0].Status, c.wantStat)
+			}
+			if states[0].Code != c.wantCode {
+				t.Errorf("code = %q, want %q", states[0].Code, c.wantCode)
+			}
+		})
+	}
+}

checker/rules_loss.go

@@ -40,16 +40,7 @@ func (r *packetLossRule) Description() string {
 func (r *packetLossRule) ValidateOptions(opts sdk.CheckerOptions) error {
 	warn := sdk.GetFloatOption(opts, "warningPacketLoss", 10)
 	crit := sdk.GetFloatOption(opts, "criticalPacketLoss", 50)
-	if warn < 0 || warn > 100 {
-		return fmt.Errorf("warningPacketLoss must be between 0 and 100")
-	}
-	if crit < 0 || crit > 100 {
-		return fmt.Errorf("criticalPacketLoss must be between 0 and 100")
-	}
-	if crit <= warn {
-		return fmt.Errorf("criticalPacketLoss (%v) must be greater than warningPacketLoss (%v)", crit, warn)
-	}
-	return nil
+	return validateThresholdPair("warningPacketLoss", "criticalPacketLoss", warn, crit, 0, 100)
 }
 
 func (r *packetLossRule) Evaluate(ctx context.Context, obs sdk.ObservationGetter, opts sdk.CheckerOptions) []sdk.CheckState {

checker/rules_loss_test.go

@@ -0,0 +1,83 @@
+// This file is part of the happyDomain (R) project.
+// Copyright (c) 2020-2026 happyDomain
+// Authors: Pierre-Olivier Mercier, et al.
+//
+// This program is offered under a commercial and under the AGPL license.
+// For commercial licensing, contact us at <contact@happydomain.org>.
+//
+// For AGPL licensing:
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+package checker
+
+import (
+	"context"
+	"testing"
+
+	sdk "git.happydns.org/checker-sdk-go/checker"
+)
+
+func TestPacketLossValidateOptions(t *testing.T) {
+	r := &packetLossRule{}
+	cases := []struct {
+		name    string
+		opts    sdk.CheckerOptions
+		wantErr bool
+	}{
+		{"defaults", sdk.CheckerOptions{}, false},
+		{"valid", sdk.CheckerOptions{"warningPacketLoss": 5.0, "criticalPacketLoss": 25.0}, false},
+		{"warn negative", sdk.CheckerOptions{"warningPacketLoss": -1.0, "criticalPacketLoss": 50.0}, true},
+		{"crit over 100", sdk.CheckerOptions{"warningPacketLoss": 10.0, "criticalPacketLoss": 150.0}, true},
+		{"crit equal warn", sdk.CheckerOptions{"warningPacketLoss": 20.0, "criticalPacketLoss": 20.0}, true},
+		{"crit below warn", sdk.CheckerOptions{"warningPacketLoss": 30.0, "criticalPacketLoss": 10.0}, true},
+	}
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			err := r.ValidateOptions(c.opts)
+			if (err != nil) != c.wantErr {
+				t.Errorf("err=%v, wantErr=%v", err, c.wantErr)
+			}
+		})
+	}
+}
+
+func TestPacketLossEvaluate(t *testing.T) {
+	r := &packetLossRule{}
+	ctx := context.Background()
+	opts := sdk.CheckerOptions{"warningPacketLoss": 10.0, "criticalPacketLoss": 50.0}
+
+	states := r.Evaluate(ctx, obsWith(
+		PingTargetResult{Address: "ok", PacketLoss: 0, Sent: 5, Received: 5},
+		PingTargetResult{Address: "warn", PacketLoss: 20, Sent: 5, Received: 4},
+		PingTargetResult{Address: "crit", PacketLoss: 80, Sent: 5, Received: 1},
+	), opts)
+
+	if len(states) != 3 {
+		t.Fatalf("got %d states, want 3", len(states))
+	}
+	want := []sdk.Status{sdk.StatusOK, sdk.StatusWarn, sdk.StatusCrit}
+	for i, s := range states {
+		if s.Status != want[i] {
+			t.Errorf("state[%d] status = %v, want %v", i, s.Status, want[i])
+		}
+	}
+}
+
+func TestPacketLossEvaluateNoTargets(t *testing.T) {
+	r := &packetLossRule{}
+	states := r.Evaluate(context.Background(), obsWith(), sdk.CheckerOptions{})
+	if len(states) != 1 || states[0].Status != sdk.StatusUnknown {
+		t.Errorf("expected single Unknown state, got %+v", states)
+	}
+}

checker/rules_reachability_test.go

@@ -0,0 +1,55 @@
+// This file is part of the happyDomain (R) project.
+// Copyright (c) 2020-2026 happyDomain
+// Authors: Pierre-Olivier Mercier, et al.
+//
+// This program is offered under a commercial and under the AGPL license.
+// For commercial licensing, contact us at <contact@happydomain.org>.
+//
+// For AGPL licensing:
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+package checker
+
+import (
+	"context"
+	"testing"
+
+	sdk "git.happydns.org/checker-sdk-go/checker"
+)
+
+func TestReachabilityEvaluate(t *testing.T) {
+	r := &reachabilityRule{}
+	states := r.Evaluate(context.Background(), obsWith(
+		PingTargetResult{Address: "up", Sent: 5, Received: 5},
+		PingTargetResult{Address: "down", Sent: 5, Received: 0},
+	), sdk.CheckerOptions{})
+
+	if len(states) != 2 {
+		t.Fatalf("got %d states, want 2", len(states))
+	}
+	if states[0].Status != sdk.StatusOK || states[0].Code != "ping.reachable.ok" {
+		t.Errorf("up: %+v", states[0])
+	}
+	if states[1].Status != sdk.StatusCrit || states[1].Code != "ping.reachable.unreachable" {
+		t.Errorf("down: %+v", states[1])
+	}
+}
+
+func TestReachabilityNoTargets(t *testing.T) {
+	r := &reachabilityRule{}
+	states := r.Evaluate(context.Background(), obsWith(), sdk.CheckerOptions{})
+	if len(states) != 1 || states[0].Status != sdk.StatusUnknown {
+		t.Errorf("expected single Unknown state, got %+v", states)
+	}
+}

checker/rules_rtt.go

@@ -44,9 +44,6 @@ func (r *rttRule) ValidateOptions(opts sdk.CheckerOptions) error {
 	if warn <= 0 {
 		return fmt.Errorf("warningRTT must be positive")
 	}
-	if crit <= 0 {
-		return fmt.Errorf("criticalRTT must be positive")
-	}
 	if crit <= warn {
 		return fmt.Errorf("criticalRTT (%v) must be greater than warningRTT (%v)", crit, warn)
 	}

checker/rules_rtt_test.go

@@ -0,0 +1,79 @@
+// This file is part of the happyDomain (R) project.
+// Copyright (c) 2020-2026 happyDomain
+// Authors: Pierre-Olivier Mercier, et al.
+//
+// This program is offered under a commercial and under the AGPL license.
+// For commercial licensing, contact us at <contact@happydomain.org>.
+//
+// For AGPL licensing:
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+package checker
+
+import (
+	"context"
+	"testing"
+
+	sdk "git.happydns.org/checker-sdk-go/checker"
+)
+
+func TestRTTValidateOptions(t *testing.T) {
+	r := &rttRule{}
+	cases := []struct {
+		name    string
+		opts    sdk.CheckerOptions
+		wantErr bool
+	}{
+		{"defaults", sdk.CheckerOptions{}, false},
+		{"valid", sdk.CheckerOptions{"warningRTT": 50.0, "criticalRTT": 200.0}, false},
+		{"warn zero", sdk.CheckerOptions{"warningRTT": 0.0, "criticalRTT": 100.0}, true},
+		{"crit negative", sdk.CheckerOptions{"warningRTT": 50.0, "criticalRTT": -1.0}, true},
+		{"crit equal warn", sdk.CheckerOptions{"warningRTT": 100.0, "criticalRTT": 100.0}, true},
+	}
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			err := r.ValidateOptions(c.opts)
+			if (err != nil) != c.wantErr {
+				t.Errorf("err=%v, wantErr=%v", err, c.wantErr)
+			}
+		})
+	}
+}
+
+func TestRTTEvaluate(t *testing.T) {
+	r := &rttRule{}
+	ctx := context.Background()
+	opts := sdk.CheckerOptions{"warningRTT": 100.0, "criticalRTT": 500.0}
+
+	states := r.Evaluate(ctx, obsWith(
+		PingTargetResult{Address: "ok", RTTAvg: 50, Sent: 5, Received: 5},
+		PingTargetResult{Address: "warn", RTTAvg: 200, Sent: 5, Received: 5},
+		PingTargetResult{Address: "crit", RTTAvg: 600, Sent: 5, Received: 5},
+		PingTargetResult{Address: "dead", RTTAvg: 0, Sent: 5, Received: 0},
+	), opts)
+
+	if len(states) != 4 {
+		t.Fatalf("got %d states, want 4", len(states))
+	}
+	want := []sdk.Status{sdk.StatusOK, sdk.StatusWarn, sdk.StatusCrit, sdk.StatusUnknown}
+	wantCode := []string{"ping.rtt.ok", "ping.rtt.warning", "ping.rtt.critical", "ping.rtt.no_replies"}
+	for i, s := range states {
+		if s.Status != want[i] {
+			t.Errorf("state[%d] status = %v, want %v", i, s.Status, want[i])
+		}
+		if s.Code != wantCode[i] {
+			t.Errorf("state[%d] code = %q, want %q", i, s.Code, wantCode[i])
+		}
+	}
+}

checker/types.go

@@ -29,9 +29,15 @@ type PingData struct {
 	Targets []PingTargetResult `json:"targets"`
 }
 
-// PingTargetResult contains the ping statistics for a single IP address.
+// PingTargetResult contains the ping statistics for a single target.
+//
+// Address is the user-supplied label (hostname or IP). ResolvedIP is the
+// IP that was actually probed; rules that need to reason about address
+// family (e.g. IPv6 reachability) must consult ResolvedIP because Address
+// can be a hostname.
 type PingTargetResult struct {
 	Address    string  `json:"address"`
+	ResolvedIP string  `json:"resolved_ip,omitempty"`
 	RTTMin     float64 `json:"rtt_min"`
 	RTTAvg     float64 `json:"rtt_avg"`
 	RTTMax     float64 `json:"rtt_max"`