task: add an external verification suite for the deployed host

[tucktuck101]

Parent PRD

#5

Objective

Add a machine-runnable verification suite under launchpad/deploy/ that checks a deployed host from both an authorised operator's perspective and an untrusted internet client's, and fails when the security expectations are not met.

Definition of done

• The suite runs from a machine that is not the deployed host
• It asserts that expected public endpoints are reachable and that the relay is healthy
• It asserts that PostgreSQL, Redis, object-storage administration and metrics are not publicly reachable, by scanning rather than by reading configuration
• It asserts TLS behaves as intended, including that a plaintext connection to the public endpoint fails
• It asserts that remote privileged access matches the declared policy from the administrative-access ADR
• It asserts that the required security controls are active on the host
• It asserts that Buzz is running the expected pinned deployment version
• It exits non-zero on any failure, so it can gate a deployment rather than merely print a report
• It is proven to fail against a deliberately misconfigured host, not only to pass against a good one
• Anything Ruling 12 lists that the suite cannot practically check is recorded as unchecked rather than quietly omitted

Impacted components

launchpad/deploy/     new: external verification suite

Out of scope

• The two-person connection verification, which task: verify two people on two machines can talk on the deployed relay #23 covers under prd 0 - Deploy the relay to a VPS and verify two people can log in #2. Ruling 12 requires it, and this suite references that evidence rather than duplicating it.
• Wiring the suite into CI as a deployment gate. That belongs to the pipeline task, so the checks exist and are reviewable before anything depends on them.
• Penetration testing or vulnerability scanning beyond asserting the declared posture.
• Continuous or scheduled running. This task builds a suite that can be run; scheduling it is separate.

---

_{Filed by an AI agent (Claude Opus 5) on behalf of @tucktuck101 as part of a decomposition of #5. Drafted, not executed. The requirement that the suite be proven to fail against a misconfigured host is added deliberately: a verification suite that has only ever passed is not evidence, and the destroyable VM is where a deliberately broken host can be produced safely.}

[serina-mcfall]

This work is superseded, not just relocated. Per the private launchpad-26/buzz-infrastructure repository's PRD-01 (infra#23), an external verification pass already ran on 2026-08-14 — CIS L1/L2, Docker Bench, an external port scan, TLS posture, and per-image vulnerability scans — with full evidence retained at evidence/2026-08-14/ in that repository. The PRD's own success criteria note this was "demonstrated true on 2026-08-14, but not yet produced by automation, and not yet re-verified after any firewall work" — so the remaining gap (making it automated and repeatable) is tracked there, not here.

Tracking for this area of work continues privately per ADR-0016. This close is a pointer, not a redaction.