A missing key self-disables
An unset env var returns Disabled, not an error — the platform never breaks on a missing feed.
The worst kind of failure on a platform with many optional feeds is for one missing credential to take the whole thing down. deino-atlas makes that failure mode impossible by construction: a source whose env var is unset returns Disabled, not an error.
The worst kind of failure on a platform with many optional feeds is for one missing credential to take the whole thing down. deino-atlas makes that failure mode impossible by construction: a source whose env var is unset returns Disabled, not an error.
Disabled, not broken
Every SourceDescriptor names a key_env — the environment variable that holds its credential. When the poller runs, it checks that env var first. If the var is set, the source polls. If it is not, the source returns Ok(None) and is marked Disabled. The platform keeps running; that one feed is dark. The other sources — the ones with their credentials present — keep polling and publishing. A missing key is a quiet absence, not a crash.
Why Ok(None), not an error
The obvious design is to error when a credential is missing — fail loud, so someone notices. The problem is that loud failure on a multi-source platform is a pager storm that does not tell you which feed matters. A platform that ingests flights, vessels, quakes, weather, and conflict has a different operational posture: not every feed is load-bearing for every user. Self-disabling lets the platform degrade gracefully — the quake feed stays up when the flight key expires, and the operator sees one Disabled line in the status, not a traceback.
A missing key is a quiet absence, not a crash. The feeds that have their credentials keep running; the one that does not goes dark.
The status surface
Disabled is a first-class status, not an absence of status. The source list endpoint reports it — which sources are Live, which are Disabled, and why. An operator reads the list and sees that the flight feed is dark because OPENSKY_KEY is unset. That is actionable without being a fire. The platform never breaks on a missing feed; it reports it.
- Self-disabling by construction: unset key_env returns Ok(None) and Disabled, never an error.
- Graceful degradation: other sources keep polling; the missing one goes dark, not down.
- Disabled is a status, not a silence — the source list reports it, with the reason.
What this assumes
The assumption is that not every source is critical to every query — which is true for a World Monitor that serves many viewports. A query over conflict signals does not need the weather feed; a query over vessel traffic does not need the quake feed. Self-disabling is the right design when partial is acceptable, and it is the wrong design when partial is not. For the feeds where partial is not acceptable, the answer is not to remove self-disabling; it is to alert on Disabled for those specific sources. The mechanism is the same; the operational posture on top of it differs.
The platform never breaks on a missing feed. It reports it. The difference between those two is the difference between a 3 a.m. pager and a morning status check.
— deino-atlas operations note
What it is not
Self-disabling is not a claim that missing credentials do not matter. They do — a Disabled source is a dark viewport for the users who need it. The claim is narrower and more honest: a missing key degrades one feed, not the platform. We are pre-revenue and building the POC; the self-disabling behavior is built, and the sources that are live depend on which credentials are present on the box, not on any accuracy posture.