Release integrity
- The installed Helm chart or VM image references exactly match one published
stack-versions.yamlrelease matrix. - No component was upgraded independently from the rest of its pinned stack.
- The deployed image digests were recorded after registries resolved the pinned tags.
Public access
- The management console loads through the intended console host.
- The public API is reachable only through the intended API and console proxy routes.
- OIDC returns to the exact registered callback.
- Execution-engine and LLM-gateway endpoints are not publicly reachable.
- NetworkPolicy ingress-controller peers match the controller that actually owns public routing.
State and coordination
- Control-plane and LLM-gateway database migrations completed.
- Postgres and Redis use durable, monitored services.
- Backup and recovery procedures are documented and tested.
- Multiple replicas use the required Redis coordination paths.
Identity and policy
- Enabled sign-in methods match deployment policy.
- Self-service signup and development login are disabled unless explicitly intended.
- Workspace roles and capability ceilings are reviewed.
- Admin API enablement, token storage, scopes, and audit handling are reviewed.
Models and tools
- At least one approved provider and model is ready.
- A read-only run can stream events and complete.
- Write-capable tools require the intended approval policy.
- MCP and webhook egress allow only intended destinations.
- Remote credentials remain secret-backed.
- Provider base URLs and the OpenAI API surface match the intended endpoints and required native-tool behavior.
Target connectivity
- A workspace can be created and listed.
- A registered AgentK can connect and report cluster inventory.
- A clean supported VM can install read-only AgentV using only the one copied enrollment command and report host inventory.
- A read-write VM installs only the selected exact restart-service allowlist and exposes
restart_service; the default run policy requires approval, and an explicit auto-run policy still cannot bypass the local allowlist. - The AgentV release matrix references a published bootstrap, archive, and checksum for the exact pinned version.
- AgentV same-command rerun, credential-free repair, failed-cutover rollback, reboot recovery, and credential replacement have passed the Ubuntu 24.04 live-systemd gate.
- AgentK keys and AgentV credentials can be replaced through their distinct supported flows.
- Connected targets require no public inbound route.
- Private-CA bundles are mounted where required without disabling certificate or hostname verification.
Operations
- Health endpoints and metrics are scraped.
- Supplied alert rules are loaded.
- Logs exclude credentials, tokens, prompts, tool arguments, and sensitive target output.
- Complete tool-result artifacts and generated documents use approved size and retention limits.
- Upgrade, rollback, secret rotation, and incident ownership are documented.
- High-availability behavior has been exercised outside production when running multiple replicas.