cdsr: initial import of deployed stack (runtime 4.133.0, pinned extensions, SSOT vault)

q5vault/operations/verification.md

@@ -0,0 +1,127 @@
+---
+title: ✅ Verification
+description: "Numbered proof checklist for the deployed cdsr stack: service health, auth gate, wiki public, extensions audit, browser smoke, dev proxy, and wiki build."
+source: verified deployment on the loca operator host, 2026-08-19
+reviewed: 2026-08-19
+---
+
+# ✅ Verification checklist
+
+Run in order. Each step must produce the expected output before proceeding.
+
+## 1. systemd service
+
+```bash
+systemctl status cdsr --no-pager
+```
+Expected: `Active: active (running)` with `Main PID` present.
+
+## 2. code-server loopback health
+
+```bash
+curl -sf http://127.0.0.1:52224/healthz
+```
+Expected (no editor session): JSON `{"status":"expired","lastHeartbeat":0}`
+Expected (with browser session connected): JSON `{"status":"alive",...}`
+
+```bash
+curl -s -o /dev/null -w '%{http_code}' http://127.0.0.1:52224/
+```
+Expected: `200`
+
+## 3. app host requires Authelia
+
+```bash
+curl -sSI https://cdsr.loca.zone/
+```
+Expected: `HTTP/1.1 302` with `Location: https://auth.loca.zone/?rd=https%3A%2F%2Fcdsr.loca.zone%2F&rm=HEAD` (or equivalent redirect into Authelia).
+
+## 4. wiki host is public
+
+```bash
+curl -sSI https://wiki.cdsr.loca.zone/
+```
+Expected: `HTTP/1.1 200` with `Content-Type: text/html` and no `Location` header pointing to `auth.loca.zone`.
+
+## 5. Authelia config valid and container up
+
+```bash
+cd /home/loca/dev/services/authelia && sudo -n docker compose config
+```
+Expected: clean YAML output, no errors.
+
+```bash
+cd /home/loca/dev/services/authelia && sudo -n docker compose ps
+```
+Expected: `authelia` container `Up` (healthy).
+
+## 6. extension baseline audit
+
+```bash
+cd /home/loca/dev/code-server && ./scripts/list-extension-versions.sh
+```
+Expected:
+```
+ok       Continue.continue@2.1.0
+ok       Anthropic.claude-code@2.1.235
+ok       ms-python.python@2026.4.0
+ok       ms-python.debugpy@2026.6.0
+ok       ms-toolsai.jupyter@2025.9.1
+ok       ms-azuretools.vscode-containers@2.4.5
+```
+Exit code: `0`
+
+## 7. browser smoke (manual)
+
+1. Open `https://cdsr.loca.zone` in a browser.
+2. Complete Authelia one-factor login at `auth.loca.zone`.
+3. Confirm code-server editor shell loads (activity bar, file explorer, terminals).
+4. Open Extensions view (Ctrl+Shift+X): verify `Continue` and `Claude Code` are installed and enabled.
+5. Open integrated terminal (Ctrl+`): run `whoami` -> output `loca`.
+
+## 8. dev-routing smoke (manual)
+
+1. In the integrated terminal from step 7, run:
+   ```bash
+   python3 -m http.server 52325 --bind 127.0.0.1
+   ```
+2. In the browser, open `https://cdsr.loca.zone/proxy/52325/`
+3. Expected: directory listing or test page renders through code-server's built-in proxy.
+
+## 9. wiki build smoke
+
+```bash
+cd /home/loca/dev/wikis && ./build.sh cdsr
+```
+Expected: build completes, emits `current -> dist-<timestamp>` symlink. A `git` warning about the vault not being a git repository is normal and expected.
+
+Then open `https://wiki.cdsr.loca.zone/`:
+- quick-start page renders
+- internal wikilinks resolve (e.g. `[[operations/extensions]]`, `[[architecture/runtime-topology]]`)
+- footer links point to `https://cdsr.loca.zone` and `https://loca.zone`
+
+## Pre-publish wiki lint gate
+
+Run before every `build.sh` invocation, so ahead of step 9 above. This is a gate, not a smoke test: a non-zero exit means nothing gets published.
+
+```bash
+python3 /home/loca/dev/wikis/lint-vault.py /home/loca/dev/code-server/q5vault
+```
+
+Expected: `11 pages, 0 findings, all 5 checks clean` and exit code `0`.
+
+- `--quiet` suppresses the clean summary so only failures print, which is the form to use in a wrapper
+- the vault may be named instead of pathed: `python3 /home/loca/dev/wikis/lint-vault.py cdsr` resolves `/home/loca/dev/wikis/cdsr/content`, the symlink into this vault
+- why it exists: a frontmatter `description:` whose value held an unquoted colon-space made the Quartz note-properties transformer fail its YAML parse, and esbuild then died with a Go `all goroutines are asleep - deadlock!` panic instead of a readable error. One unquoted colon cost a whole build with no usable diagnostic
+- it complements `scripts/validate-ssot.py`, which `build.sh` runs itself: that validator only gates wikis shipping a `wiki-ia.json` manifest, and this wiki ships none, so its `SSOT Validation passed` line is a vacuous pass here and this linter is the only real pre-publish gate on the vault
+- check 1, frontmatter scalars: unquoted values containing a colon-space, starting with `#`, `@`, `*`, `&`, `!`, `%` or a backtick, ending in a colon, carrying an inline ` #` comment that would silently truncate the value, or holding an unterminated quote. Reported as `file:line` plus the offending key
+- check 2, wikilinks in tables: an unescaped `|` inside `[[...]]` on a table row splits the cell, and an alias containing `/` is truncated at the slash when rendered
+- check 3, dead wikilinks: every target must resolve to a real `.md` in the vault, tried vault-root-relative first and then relative to the linking page, tolerating a leading `./` and an optional `#anchor`
+- check 4, house style: no markdown bold anywhere
+- check 5, page shape: no second H1 in one file, and no page without a frontmatter block
+- checks 2 to 5 ignore fenced blocks and inline code spans, because nothing in those regions renders as markdown, so the example wikilinks in step 9 above are not treated as links
+- standard library only, so it runs on any host with `python3` and needs no pyyaml
+
+---
+
+Note: the git-repository warning from `build.sh` is normal -- the vault is a plain directory, not a git repo.