Verification checklist

11 checks before reporting completion

Run the applicable checks and the Verify steps in every selected guide, in a fresh shell such as one started with bash --norc --noprofile -i. Replace REPLACE_WITH_YOUR_HOST with your own host before running anything. Record each result as pass, fail, untested, or not applicable, with evidence or a reason.

Scope

The README marks every checklist item REASONED: each rests on its cited sources and records that it was not run against a deployment. Items 1 to 4 record local syntax checks and stub runs only. Item 8 names tools rather than a command and sets no pass threshold.

Rule

Report a control as verified only for the checks that passed, and report every item you could not test instead of asserting that it passed.

Checklist, 11 items

Verification checklist
No.	Check	Command or method
1	No plaintext listener on a public interface, except a listener whose only job is to redirect to HTTPS.	`ss -tlnp`
2	Where HTTP is offered, the redirect works and carries a `Location: https://...` header.	`curl -sS -o /dev/null -w '%{http_code} %{redirect_url}\n' http://REPLACE_WITH_YOUR_HOST/`
3	TLS works without `-k`.	`curl -sS -o /dev/null -w '%{http_code}\n' https://REPLACE_WITH_YOUR_HOST/`
4	Old protocols are refused: TLS 1.2 is the minimum. Confirm that the refusal came from the server and not from your own client.	`openssl s_client -connect REPLACE_WITH_YOUR_HOST:443 -tls1_1`
5	An unauthenticated request to any non-public path returns 401, 403, or a login redirect, never data.	The guarded anonymous probe in oidc-integration.md (opens in a new tab), once per non-public path
6	No default credentials remain, and no secret is committed to the repository.	`gitleaks git . && echo clean` for committed secrets; default accounts have no generic command, so check each service against its guide
7	Where ACME is used, renewal is automated, and something is actually scheduled to run it.	`sudo certbot renew --dry-run --run-deploy-hooks`, then `sudo systemctl list-timers \| grep -i certbot` or a `certbot renew` cron entry; for Caddy or Traefik, a completed renewal in their logs
8	Public endpoints are scanned with the Qualys SSL Labs test or testssl.sh.	Qualys SSL Labs (opens in a new tab) or testssl.sh (opens in a new tab); no command and no pass threshold
9	Human-facing logins carry a second factor where the stack supports one.	An interactive login with only the password, attempting an MFA-protected operation
10	Probed from outside the deployment network, from a second host, only the intended ports answer.	The guarded `nmap -Pn -p-` block in deployment-lifecycle.md (opens in a new tab), and its IPv6 companion, from a second host
11	Where login comes from an identity provider, an identity outside the allowed tenant, domain, group, or users is denied.	An interactive sign-in with an account outside the allowlist

Each item is set out in full, with what it rests on, in the README verification checklist (opens in a new tab); its sources are in README.sources.md (opens in a new tab), numbered to match.

The ready-made tasks that change your project end by running this checklist.

Copy a ready-made task