This component deploys the pinned Prometheus blackbox exporter as an internal ClusterIP service in the observability namespace. The /probe handler is reachable only from the Prometheus Pod; it has no Ingress, NodePort, host port, or service-account token.

Only three fixed Probe groups are declared:

platform-public-edge: Gitea health and Keycloak discovery through Host Nginx
platform-private-edge: Grafana, pgAdmin, and AIStor Console must return 403
platform-private-internal: the same private services must return 200 through their ClusterIP Services

The internal Grafana and pgAdmin targets use the blackbox exporter's hostname parameter to set their required HTTP Host header. Target URLs and modules are declarative; arbitrary callers are not granted access to port 9115.

The private-edge source boundary was proven separately and recorded as a root-only platform-blackbox-source-v1 evidence file. Applying this component must remain gated on that evidence matching the active deny-only Nginx config.