---
title: ✅ Verification
description: "Numbered proof checklist for the deployed cdsr stack: service health, auth gate, wiki public, extensions audit, browser smoke, dev proxy, and wiki build."
source: verified deployment on the loca operator host, 2026-08-19
reviewed: 2026-08-19
---

# ✅ Verification checklist

Run in order. Each step must produce the expected output before proceeding.

## 1. systemd service

```bash
systemctl status cdsr --no-pager
```
Expected: `Active: active (running)` with `Main PID` present.

## 2. code-server loopback health

```bash
curl -sf http://127.0.0.1:52224/healthz
```
Expected (no editor session): JSON `{"status":"expired","lastHeartbeat":0}`
Expected (with browser session connected): JSON `{"status":"alive",...}`

```bash
curl -s -o /dev/null -w '%{http_code}' http://127.0.0.1:52224/
```
Expected: `200`

## 3. app host requires Authelia

```bash
curl -sSI https://cdsr.loca.zone/
```
Expected: `HTTP/1.1 302` with `Location: https://auth.loca.zone/?rd=https%3A%2F%2Fcdsr.loca.zone%2F&rm=HEAD` (or equivalent redirect into Authelia).

## 4. wiki host is public

```bash
curl -sSI https://wiki.cdsr.loca.zone/
```
Expected: `HTTP/1.1 200` with `Content-Type: text/html` and no `Location` header pointing to `auth.loca.zone`.

## 5. Authelia config valid and container up

```bash
cd /home/loca/dev/services/authelia && sudo -n docker compose config
```
Expected: clean YAML output, no errors.

```bash
cd /home/loca/dev/services/authelia && sudo -n docker compose ps
```
Expected: `authelia` container `Up` (healthy).

## 6. extension baseline audit

```bash
cd /home/loca/dev/code-server && ./scripts/list-extension-versions.sh
```
Expected:
```
ok       Continue.continue@2.1.0
ok       Anthropic.claude-code@2.1.235
ok       ms-python.python@2026.4.0
ok       ms-python.debugpy@2026.6.0
ok       ms-toolsai.jupyter@2025.9.1
ok       ms-azuretools.vscode-containers@2.4.5
```
Exit code: `0`

## 7. browser smoke (manual)

1. Open `https://cdsr.loca.zone` in a browser.
2. Complete Authelia one-factor login at `auth.loca.zone`.
3. Confirm code-server editor shell loads (activity bar, file explorer, terminals).
4. Open Extensions view (Ctrl+Shift+X): verify `Continue`, `Claude Code` and `ACP Client` are installed and enabled.
5. Open integrated terminal (Ctrl+`): run `whoami` -> output `loca`.
6. If the activity bar shows no third-party icons, the folder is in Restricted Mode: Command Palette → `Workspaces: Manage Workspace Trust` → Trust. Workspace Trust silently disables every third-party extension, which looks exactly like a failed install.

## 7b. OMP agent panel over ACP (manual)

Proves the `omp` harness is reachable as a native agent, end to end.

1. Activity bar → `ACP Client`. The `AGENTS` tree lists `Oh My Pi` alongside the extension's shipped defaults; only `Oh My Pi` is a pinned local binary.
2. Command Palette → `ACP: New Conversation` → pick `Oh My Pi`.
3. Status bar reads `ACP: Oh My Pi`. The chat header shows the open folder and OMP's own session controls: mode (Default/Plan), model, thinking level.
4. Send `Reply with exactly: IDE-ACP-OK`. Expect the reply text plus rendered tool-call and plan cards.
5. Agent-side check without the IDE, if the panel misbehaves:
   ```bash
   printf '%s\n' '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":1,"clientCapabilities":{"fs":{"readTextFile":true,"writeTextFile":true}}}}' | omp acp
   ```
   Expect one JSON line containing `"protocolVersion":1` and `"agentInfo":{"name":"oh-my-pi"`. If that works and the panel does not, the fault is the extension or `acp.agents`, not OMP.

## 8. dev-routing smoke (manual)

1. In the integrated terminal from step 7, run:
   ```bash
   python3 -m http.server 52325 --bind 127.0.0.1
   ```
2. In the browser, open `https://cdsr.loca.zone/proxy/52325/`
3. Expected: directory listing or test page renders through code-server's built-in proxy.

## 9. wiki build smoke

```bash
cd /home/loca/dev/wikis && ./build.sh cdsr
```
Expected: build completes, emits `current -> dist-<timestamp>` symlink. A `git` warning about the vault not being a git repository is normal and expected.

Then open `https://wiki.cdsr.loca.zone/`:
- quick-start page renders
- internal wikilinks resolve (e.g. `[[operations/extensions]]`, `[[architecture/runtime-topology]]`)
- footer links point to `https://cdsr.loca.zone` and `https://loca.zone`

## Pre-publish wiki lint gate

Run before every `build.sh` invocation, so ahead of step 9 above. This is a gate, not a smoke test: a non-zero exit means nothing gets published.

```bash
python3 /home/loca/dev/wikis/lint-vault.py /home/loca/dev/code-server/q5vault
```

Expected: `11 pages, 0 findings, all 5 checks clean` and exit code `0`.

- `--quiet` suppresses the clean summary so only failures print, which is the form to use in a wrapper
- the vault may be named instead of pathed: `python3 /home/loca/dev/wikis/lint-vault.py cdsr` resolves `/home/loca/dev/wikis/cdsr/content`, the symlink into this vault
- why it exists: a frontmatter `description:` whose value held an unquoted colon-space made the Quartz note-properties transformer fail its YAML parse, and esbuild then died with a Go `all goroutines are asleep - deadlock!` panic instead of a readable error. One unquoted colon cost a whole build with no usable diagnostic
- it complements `scripts/validate-ssot.py`, which `build.sh` runs itself: that validator only gates wikis shipping a `wiki-ia.json` manifest, and this wiki ships none, so its `SSOT Validation passed` line is a vacuous pass here and this linter is the only real pre-publish gate on the vault
- check 1, frontmatter scalars: unquoted values containing a colon-space, starting with `#`, `@`, `*`, `&`, `!`, `%` or a backtick, ending in a colon, carrying an inline ` #` comment that would silently truncate the value, or holding an unterminated quote. Reported as `file:line` plus the offending key
- check 2, wikilinks in tables: an unescaped `|` inside `[[...]]` on a table row splits the cell, and an alias containing `/` is truncated at the slash when rendered
- check 3, dead wikilinks: every target must resolve to a real `.md` in the vault, tried vault-root-relative first and then relative to the linking page, tolerating a leading `./` and an optional `#anchor`
- check 4, house style: no markdown bold anywhere
- check 5, page shape: no second H1 in one file, and no page without a frontmatter block
- checks 2 to 5 ignore fenced blocks and inline code spans, because nothing in those regions renders as markdown, so the example wikilinks in step 9 above are not treated as links
- standard library only, so it runs on any host with `python3` and needs no pyyaml

---

Note: the git-repository warning from `build.sh` is normal -- the vault is a plain directory, not a git repo.