One group per own service with application-level checks (json-query on health/API endpoints where ungated, keyword otherwise) and a Third-party group with plain checks. Endpoints verified from the Kuma VPS. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>