# Deploy Validation

> Deploy Validation

- Skill: `websoft9/deploy-validation` (Agent Skill, multi-file: 4 files)
- Install (CLI): `npx skillmds@latest add websoft9/deploy-validation`
- Raw SKILL.md: https://api.skillmd.com/api/skills/websoft9/deploy-validation/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: websoft9 (https://skillmd.com/u/websoft9)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/websoft9/deploy-validation

---


# Deploy Validation

Prove one app package deploys correctly. Shared by the `new-app`, `app-update`, and `restore-app` workflows.

This skill follows `docs/ai-sdlc/05-quality-gates.md` and `docs/ai-sdlc/06-test-report-format.md`.

Supporting files in this skill:

- `checklist.md`
- `prompt-fragments.md`
- `report-template.md`

## Inputs

- app name (required)
- target: local | remote (default from `.secrets/remote.env`; fallback local)
- ssh host (required when target=remote)
- ssh user (optional when target=remote; defaults to `root`)
- deploy root (default `/opt/websoft9-test/apps`; the app target is `<deploy_root>/<app>`)
- ssh secret path (default `.secrets/ssh/default.pem` under the repository root; git-ignored, chmod 600; never commit it)

## Steps

1. Run the gates locally: `make --no-print-directory libs ARGS="check --app <app> --json"`. On failure, stop and report the first blocking error.
2. Run `make --no-print-directory libs ARGS="app-deploy --app <app> [--target <local|remote>] [--ssh-host <ip> --ssh-user <name> --ssh-secret-path <path> --deploy-root <dir>] --json"` to perform the compose deployment primitive. It handles local vs remote resolution, sync, network creation, `config`, `up -d`, and `ps` evidence.
3. Run `make --no-print-directory libs ARGS="app-tests --app <app> [--base-url <url>] [--ssh-host <ip> --ssh-user <name> --ssh-secret-path <path> --deploy-root <dir>] --json"` to perform functional checks. When `tests/cases.yml` is absent, the command still runs the default required checks.
4. Check container logs for blocking errors.
5. Cleanup in all outcomes with `make --no-print-directory libs ARGS="app-deploy --app <app> [--target <local|remote>] [--ssh-host <ip> --ssh-user <name> --ssh-secret-path <path> --deploy-root <dir>] --down --json"`. For remote, the server itself stays running; deletion stays manual.
6. Return validation evidence: gates, deploy, functional checks, logs, cleanup, and the server identity when remote.

## Output

- target and server identity (remote only)
- structure gate result
- policy gate result
- deploy result
- functional check result
- log check result
- cleanup status
- first blocking error (when failed)

## Rules

- Validation only; never modify app files.
- Never skip a failed gate; report the first blocking error.
- When the ssh user is not provided, default to `root`. If SSH auth fails with the default user, stop and ask the user for the correct user and secret path; do not retry with guessed users.
- The server is assumed dedicated and ephemeral; its IP is public information and is recorded openly in the report.
- Environment limitations (e.g. registry unreachable, missing docker daemon) are reported as environment blocks, not app defects.
- `down -v` runs even when validation fails; server deletion stays manual.
- Produce evidence in the same language the user used unless the user asks otherwise.