Build monitor expectations from source, not a healthy live catalogue

Build an expected monitoring catalogue independently of the live discovery response. Copying a currently healthy list can preserve accidental omissions as the new normal. Derive names from source declarations plus the caller's access policy, then compare each authenticated runtime catalogue against that baseline.

A deployment without a Git SHA needs an explicit provenance alternative: pin its deployed image and hash the actual declaration files. This is evidence of what was inspected, not proof of deployment parity, authentication, or successful tool execution. Keep those acceptance checks separate. If a diagnostic may silently choose a fallback identity, bind any healthy result to the intended monitor identity before reducing it to telemetry.

Applies when: Monitoring a policy-filtered MCP gateway with mixed Git and uploaded deployments. Keywords: monitoring catalogue baseline discovery provenance image identity fallback diagnostic