Verify the deployed showcase

The complete lifecycle writes sanitized receipts outside the repository. Its last receipt must be a refresh-enabled zero-change plan from the second build. A successful apply or a static Terraform test does not establish a healthy showcase.

The disposable origin VM waits for its NIC security-group association before boot. Its HTTP allowlist uses all published F5 Regional Edge and CDN networks, exact owned demo sources, and private workstation IPv4 /32 exceptions. An explicit deny rule blocks other ingress, including SSH. The origin reserves management subnet host offset 30 so it cannot take a CE or FRR address.

Azure US

Run the regional verifier with the configured subscription, which may differ from the Azure CLI default:

scripts/verify-deployment.sh \
  --terraform-dir terraform \
  --evidence-dir '<NEW_PRIVATE_EVIDENCE_DIRECTORY>' \
  --subscription "$(terraform -chdir=terraform output -raw azure_subscription_id)" \
  --skip-console

The verifier checks three registered ONLINE CEs in each region, Azure VM and password-extension readiness, and all three CE Site Console TCP/65500 backends. Approval receipts remain tracked when the same registration becomes ONLINE; the provider verifies already-approved nodes without another approval action. For each of the two FRR relays per region, it requires three direct CE sessions, two Route Server sessions, and the CE-learned application VIP /32. The regional client must have both FRR next hops for that VIP. Terraform creates the Route Server BGP peers sequentially through Network API 2022-01-01, with a separate 30-minute deadline for each peer. The lifecycle applies Azure MAC bindings, registration approvals, and status convergence sequentially to keep XC site updates from overlapping.

It sends time-separated HTTP batches from each region’s own client through the external BGP VIP, the inside ILB application frontend, and the origin control. The application ILB frontend is .10 on the inside subnet and uses the separate private domain. Site Console uses .11 and a nonfloating TCP/65500 rule. The external and inside paths are independent; send the matching Host domain for each one.

The lifecycle also runs scripts/verify-azure-failover.sh. In each region it stops one CE, confirms a direct session withdraws from the FRRs while traffic continues, starts the CE and confirms recovery, then does the same with one FRR. The client must have one VIP next hop during the FRR outage and two after recovery. The script restarts a stopped VM if a gate fails and stops the lifecycle for a source fix.

AWS

The live UAT uses the same isolated AWS SSO credential-process route as the lifecycle for every root Terraform refresh. Child KVM and Azure verifiers and saved-plan readers share that route, including nested wrapper calls.

The AWS UAT receipt requires three independent sites, six Connect peers, twelve established sessions, workload and VIP HTTP responses, and zero VIP failures in its sampled window. It stops one CE, expects eight sessions, proves traffic continuity, restarts that CE, and waits for twelve sessions. Healthy KVM registration counts may settle through a reviewed output-only refresh; BGP, mapping, and the one-session invariant must remain healthy. The final zero-change plan confirms the recovered deployment has no Terraform actions. Raw transport transients are reported separately from successful application retries.

KVM physical LAN

The lifecycle runs scripts/verify-kvm-lan-client.py after configuring the provider-owned SLI and custom inside VIP. It checks the distinct SLO and SLI identities, one registered ONLINE CE, and FRR BGP convergence. From the independent NUC client on xckvmlan, it confirms the VIP route uses the physical LAN address, private name resolution maps to the VIP, the Terraform-managed origin responds with its marker, and ten HTTP requests through the custom VIP return that marker. It checks that the client’s default routes and the Ubuntu shared bridge/uplink remain intact.

The shared br-kvm-lan bridge and enp3s0 uplink are prerequisites outside Terraform ownership. The private LAN allocation record and the evidence receipts stay outside Git. Site health, BGP state, origin traffic, and client VIP traffic must all pass before the KVM path is called complete.

Observed 2026-08-08 Azure route and traffic samples and earlier AWS acceptance were for previous source and topology. Use the current deployment’s receipts for presentation and failure claims.

The Canadian regional deployment is maintained independently in Canada Topology.