STD-002: Deployment Validation Standards

No failed services

systemctl --failed

0 units listed

No kernel errors

journalctl -b -p err --no-pager | tail -20

No unexpected errors (firmware warnings are typically noise)

Boot time analysis

systemd-analyze

Userspace < 30s to graphical target (kernel time dominated by LUKS unlock is expected)

Slowest services

systemd-analyze blame | head -10

No single service > 15s unless justified (e.g., LUKS, firmware init)

Kernel version

uname -r

Expected kernel (mainline or LTS)

LUKS volumes open

lsblk -f | grep -E 'crypto_LUKS|crypt'

All expected encrypted volumes open and mounted

Filesystem subvolumes

sudo btrfs subvolume list / | awk '{print $NF}'

Expected subvolumes present (e.g., @, @snapshots, @var_log)

Swap active

zramctl or swapon --show

Swap device present with expected size and algorithm

Boot entries valid

bootctl list

All entries resolve — no "No such file or directory" warnings

ESP kernel sync

diff <(md5sum /boot/vmlinuz-linux | awk '{print $1}') <(md5sum /boot/efi/vmlinuz-linux | awk '{print $1}')

MATCH (only applies when kernels are synced to ESP)

Kernel parameters

cat /proc/cmdline

Expected parameters present (LUKS UUID, rootflags, security modules, GPU modesetting)

LSM stack

cat /sys/kernel/security/lsm

Expected modules present (e.g., capability,landlock,lockdown,yama,apparmor,bpf)

MAC framework active

sudo aa-status | head -5 (AppArmor) or getenforce (SELinux)

Profiles loaded and enforcing / Enforcing mode

MAC in kernel cmdline

grep -E 'apparmor|selinux' /proc/cmdline

Security module enabled at boot (not just userspace)

Critical profiles enforced

sudo aa-status | awk '/in enforce/{p="enforce"} /in unconfined/{p="unconfined"} /firefox|chrome|chromium/{print p": "$0}'

Browsers and sensitive applications show "enforce", not "unconfined"

Firewall status

sudo ufw status verbose or sudo firewall-cmd --state

Active with expected rules

SSH hardening

sudo sshd -T | grep -iE 'permitroot|passwordauth|maxauthtries'

PermitRootLogin no, PasswordAuthentication no (or as policy dictates)

Open ports audit

ss -tlnp | awk 'NR>1{print $4, $6}' | sort

Only expected listeners — SSH, localhost services. No unexpected public listeners.

Display server

echo $XDG_SESSION_TYPE

wayland or x11 as expected

GPU detected

nvidia-smi --query-gpu=name,driver_version,memory.total --format=csv,noheader or lspci | grep -i vga

Correct GPU, driver version, VRAM

GPU modesetting

cat /sys/module/nvidia_drm/parameters/modeset or check kernel cmdline

Y or nvidia_drm.modeset=1 present

GPU persistence

systemctl is-active nvidia-persistenced.service

active (NVIDIA only — prevents cold-start delays)

Audio — not dummy

wpctl status | grep -A5 'Sinks:'

Real audio devices listed — NOT "Dummy Output"

Audio playback

pw-play /usr/share/sounds/freedesktop/stereo/bell.oga

Sound plays through expected output device

Audio — SOF firmware

journalctl -b --grep='sof|cs35l56|cs42l43' --no-pager | tail -5

Firmware loaded, calibration applied (Intel laptops with SOF audio)

Bluetooth controller

bluetoothctl show | grep -E 'Name|Powered|Address'

Controller present and powered

Session processes

for proc in waybar mako pipewire wireplumber; do pgrep -x $proc > /dev/null && echo "✓ $proc" || echo "✗ $proc"; done

All expected session processes running (adapt list to your compositor)

Monitor config

Compositor-specific: hyprctl monitors, swaymsg -t get_outputs, or xrandr

Correct resolution, refresh rate, scaling

Notifications

notify-send "Validation" "Desktop operational"

Notification appears on screen

Screenshot pipeline

grim -g "$(slurp)" /tmp/test-screenshot.png && ls -lh /tmp/test-screenshot.png

File created (Wayland); adapt for X11

Clipboard

echo "test" | wl-copy && wl-paste

Output matches input

Languages installed

python3 --version && node --version && rustc --version && go version

All expected languages present with expected versions

Package managers

uv --version && npm --version && cargo --version

All expected package managers present

Editor config

nvim --version | head -1 && ls ~/.config/nvim/init.lua

Editor installed, config loaded

AI coding tools

claude --version

Installed and version reported

Git SSH connectivity

ssh -T git@github.com

"Hi <user>! You’ve successfully authenticated"

Git remotes

git -C <repo-path> remote -v | awk '{print $1, $2}' | sort -u

Expected remotes configured (origin, upstream, etc.)

Inference engine running

systemctl is-active ollama.service

active

Models loaded

ollama list

Expected models present

Model storage

mount | grep ollama-models or du -sh /usr/share/ollama/.ollama/models/

Models on correct partition (not root, if large)

Inference test

ollama run <model> "What is 2+2?" 2>/dev/null | head -1

Coherent response returned

GPG key present

gpg --list-secret-keys --keyid-format long | grep -c sec

≥ 1 secret key

SSH keys present

ls ~/.ssh/id_ed25519_* | wc -l

Expected key count

SSH cert validity

ssh-keygen -L -f ~/.ssh/id_ed25519_vault-cert.pub | grep Valid

Certificate not expired (if Vault SSH certs are used)

age identities

test -f ~/.age/identities && echo "OK" || echo "MISSING"

OK

Password manager

gopass ls | head -5

Store accessible, entries listed

Encrypted vault

ls ~/.credentials/ && echo "mounted" || echo "not mounted"

Mounted (if gocryptfs or similar is used)

Active connection

nmcli connection show --active

Expected connection active (WiFi EAP-TLS, wired, VPN, etc.)

DNS resolution

dig +short <hostname> or getent hosts <hostname>

IP address returned for internal hostnames

DNS tools available

dig -v or drill -v

Installed (if DNS diagnostics are part of your workflow)

EAP-TLS cert expiration

openssl x509 -in <cert-path> -noout -enddate

notAfter date is > 30 days out

External connectivity

curl -sI github.com | head -1

HTTP/2 200

Boot

systemd-boot, ESP sync, btrfs

GRUB2, LVM, XFS/ext4

LUKS, kernel params

Security

AppArmor, aa-status

SELinux, getenforce

LSM stack, firewall, SSH

Desktop

Hyprland, PipeWire, pw-play

GNOME, PipeWire or PulseAudio

Skip for headless

GPU

nvidia-open (Blackwell+)

nvidia or nouveau

nvidia-smi, modesetting

Audio firmware

sof-firmware (Intel laptops)

Usually kernel-included

Check wpctl status regardless

Package managers

pacman, yay, uv, npm, cargo

dnf, pip, npm, cargo

Language-specific are universal

Firewall

UFW

firewalld

Verify rules match policy