arn-infra-verify

Arness Infra Verify

Run post-deployment verification against a target environment to confirm that infrastructure is healthy, endpoints are reachable, DNS resolves correctly, SSL certificates are valid, and resource state matches the expected topology. Updates issue labels and environments.md with verification results.

This skill invokes the arn-infra-verifier agent to perform the actual health checks and produces a structured verification report.

Prerequisites

Read ## Arness from the project's CLAUDE.md. If no ## Arness section exists or Arness Infra fields are missing, inform the user: "Arness Infra is not configured for this project yet. Run /arn-infra-wizard to get started — it will set everything up automatically." Do not proceed without it.

Check the Deferred field. If Deferred: yes, inform the user: "Infrastructure is in deferred mode. Verification is not available until infrastructure is fully configured. Run /arn-infra-assess to un-defer." Stop.

Extract:

• Experience level -- derived from user profile. Read ~/.arness/user-profile.yaml (or .claude/arness-profile.local.md if it exists — project override takes precedence). Apply the experience derivation mapping from ${CLAUDE_PLUGIN_ROOT}/skills/arn-infra-ensure-config/references/experience-derivation.md. If no profile exists, check for legacy Experience level in ## Arness as fallback.
• Environments -- environment names for target selection
• Environments config -- path to environments.md for deployment state
• Resource manifest -- path to active-resources.json for expected resource state
• Tooling manifest -- path to tooling-manifest.json for available CLIs
• Providers -- which cloud providers are configured
• Providers config -- path to providers.md
• Platform -- for issue label management
• Issue tracker -- for label updates and issue lifecycle
• Infra specs directory -- from ## Arness config, for locating handoff files (default: .arness/infra-specs)
• Reference overrides -- path to local reference override directory (for evolving reference reads)

Workflow

Step 1: Determine Target Environment

Ask the user which environment to verify (if not specified in the invocation):

"Which environment would you like to verify? [list environments from config]"

Read the environment's deployment state from environments.md:

• Last deployed: timestamp of the most recent deployment
• If Last deployed is -- (never deployed): inform the user: "The [environment] environment has not been deployed yet. Run /arn-infra-deploy first." Stop.

Step 2: Gather Expected State

Collect the expected state from multiple sources:

2a. Resource manifest:

Read the resource manifest (active-resources.json):

Read <resource-manifest-path>

Filter resources for the target environment. Extract:

• Resource IDs and types
• Expected endpoints (URLs, DNS names)
• Health check paths
• Provider and region information

2b. Handoff file:

Look for the handoff file for the target environment:

Glob <specs-dir>/INFRA_HANDOFF_<environment>*

If found, read it and extract:

• Endpoint URLs and health check paths
• Expected connection string references (for connectivity verification)
• Monitoring endpoints

2c. INFRA spec:

Look for the infrastructure architecture spec:

Glob <specs-dir>/INFRA_*

If found, read it for the expected resource topology (resource types, counts, configurations).

If no expected state is available: Warn: "No resource manifest or handoff file found for [environment]. I can still run basic health checks if you provide endpoint URLs. Would you like to provide URLs manually, or run /arn-infra-deploy first?"

If the user provides URLs manually, proceed with those as the expected state.

Step 3: Invoke Verifier Agent

Read the local override or plugin default for health-check-patterns.md.

Invoke the arn-infra-verifier agent via the Task tool, passing the model from .arness/agent-models/infra.md as the model parameter (see plugins/arn-infra/skills/arn-infra-ensure-config/references/ensure-config.md "Dispatch convention" for fallback). Context:

--- EXPECTED STATE --- Resources: [filtered resource manifest for the target environment] Endpoints: [list of endpoints with health check paths] DNS names: [list of DNS names with expected targets] SSL domains: [list of HTTPS domains requiring certificate validation] --- END EXPECTED STATE ---

--- PROVIDER CONTEXT --- Provider(s): [from providers.md] Available CLIs: [from tooling manifest -- which CLIs can query resource state] Environment: [target environment name] --- END PROVIDER CONTEXT ---

--- TOOLING --- Available tools: [list of installed verification tools from tooling manifest] curl: [available/unavailable] dig/nslookup: [available/unavailable] openssl: [available/unavailable] Provider CLIs: [list with auth status] --- END TOOLING ---

--- INSTRUCTIONS --- Run the following verification checks in order:

1. HTTP health checks on all endpoints
2. DNS resolution for all configured domains
3. SSL/TLS certificate validation for all HTTPS endpoints
4. Resource state comparison against the expected state using available provider CLIs
5. Database connectivity verification (if database endpoints are configured)
6. Environment variable injection verification (check that required env vars are set in the deployed application)

Produce a structured verification report with overall PASS/WARN/FAIL verdict. --- END INSTRUCTIONS ---

Step 4: Process Verification Results

Read the verification report from the agent. Parse the overall status: PASS, WARN, or FAIL.

Read ${CLAUDE_PLUGIN_ROOT}/skills/arn-infra-verify/references/verification-report-template.md for the expected report format.

On PASS:

1. Present the verification results to the user:

"Verification PASSED for [environment]. All health checks, DNS, SSL, and resource state checks succeeded."

1. Update issue labels (if issue tracking is configured):
2. Add label arn-infra-verified
3. Remove label arn-infra-failed (if present from a previous failed attempt)
4. If this is a production environment AND the deployment issue exists: close the issue with a comment "Production deployment verified successfully."

1. Update active-resources.json:
2. Set lastVerified to the current ISO 8601 timestamp for all resources in the target environment

1. Update environments.md:
2. Add verification result under the target environment entry:

```

• Last verified: [ISO 8601 timestamp]
• Verification status: PASS

```

On WARN:

1. Present the verification results with warnings:

"Verification completed with WARNINGS for [environment]. The deployment is functional but the following issues were detected: [list warnings]."

1. Update issue labels:
2. Add label arn-infra-verified (functional despite warnings)
3. Add a comment to the issue listing the warnings

1. Update active-resources.json:
2. Set lastVerified to the current timestamp

1. Update environments.md:
2. Add verification result:

```

• Last verified: [ISO 8601 timestamp]
• Verification status: WARN ([summary])

```

On FAIL:

1. Present the verification results with failures:

"Verification FAILED for [environment]. The following critical checks failed: [list failures]."

1. Categorize failures:
2. Critical: service down, endpoints unreachable, SSL expired, DNS not resolving
3. Warning: slow response times, certificate expiring soon, minor resource drift
4. Info: non-critical differences from expected state

1. Suggest remediation for each failure:
2. Endpoint unreachable: "Check if the service is running. Review deployment logs."
3. DNS not resolving: "Check DNS configuration. Allow up to 48h for propagation."
4. SSL invalid: "Check certificate configur