/arn-infra-verify

name: arn-infra-verify
description: >-
  This skill should be used when the user says "verify deployment", "verify infra",
  "check deployment", "arn infra verify", "infra verify", "health check",
  "check health", "verify staging", "verify production", "is my deployment healthy",
  "check if deployment worked", "run health checks", "deployment verification",
  "check infrastructure", "validate deployment", "verify environment",
  "post-deployment check", "infra health", "check dns", "check ssl",
  "verify endpoints", "smoke test", "integration test",
  or wants to validate that a deployed environment is healthy
  and its resources match the expected state. This skill runs health checks,
  DNS verification, SSL validation, resource state comparison, and updates
  issue labels and environments.md with verification results.
version: 1.0.0

Arness Infra Verify

Run post-deployment verification against a target environment to confirm that infrastructure is healthy, endpoints are reachable, DNS resolves correctly, SSL certificates are valid, and resource state matches the expected topology. Updates issue labels and environments.md with verification results.

This skill invokes the `arn-infra-verifier` agent to perform the actual health checks and produces a structured verification report.

Prerequisites

Read `## Arness` from the project's CLAUDE.md. If no `## Arness` section exists or Arness Infra fields are missing, inform the user: "Arness Infra is not configured for this project yet. Run `/arn-infra-wizard` to get started — it will set everything up automatically." Do not proceed without it.

Check the **Deferred** field. If `Deferred: yes`, inform the user: "Infrastructure is in deferred mode. Verification is not available until infrastructure is fully configured. Run `/arn-infra-assess` to un-defer." Stop.

Extract:

• **Experience level** -- derived from user profile. Read `~/.arness/user-profile.yaml` (or `.claude/arness-profile.local.md` if it exists — project override takes precedence). Apply the experience derivation mapping from `${CLAUDE_PLUGIN_ROOT}/skills/arn-infra-ensure-config/references/experience-derivation.md`. If no profile exists, check for legacy `Experience level` in `## Arness` as fallback.
• **Environments** -- environment names for target selection
• **Environments config** -- path to `environments.md` for deployment state
• **Resource manifest** -- path to `active-resources.json` for expected resource state
• **Tooling manifest** -- path to `tooling-manifest.json` for available CLIs
• **Providers** -- which cloud providers are configured
• **Providers config** -- path to `providers.md`
• **Platform** -- for issue label management
• **Issue tracker** -- for label updates and issue lifecycle
• **Infra specs directory** -- from `## Arness` config, for locating handoff files (default: `.arness/infra-specs`)
• **Reference overrides** -- path to local reference override directory (for evolving reference reads)

---

Workflow

Step 1: Determine Target Environment

Ask the user which environment to verify (if not specified in the invocation):

"Which environment would you like to verify? [list environments from config]"

Read the environment's deployment state from `environments.md`:

• **Last deployed:** timestamp of the most recent deployment
• If `Last deployed` is `--` (never deployed): inform the user: "The [environment] environment has not been deployed yet. Run `/arn-infra-deploy` first." Stop.

---

Step 2: Gather Expected State

Collect the expected state from multiple sources:

**2a. Resource manifest:**

Read the resource manifest (`active-resources.json`):

Read <resource-manifest-path>

Filter resources for the target environment. Extract:

• Resource IDs and types
• Expected endpoints (URLs, DNS names)
• Health check paths
• Provider and region information

**2b. Handoff file:**

Look for the handoff file for the target environment:

Glob <specs-dir>/INFRA_HANDOFF_<environment>*

If found, read it and extract:

• Endpoint URLs and health check paths
• Expected connection string references (for connectivity verification)
• Monitoring endpoints

**2c. INFRA spec:**

Look for the infrastructure architecture spec:

Glob <specs-dir>/INFRA_*

If found, read it for the expected resource topology (resource types, counts, configurations).

**If no expected state is available:** Warn: "No resource manifest or handoff file found for [environment]. I can still run basic health checks if you provide endpoint URLs. Would you like to provide URLs manually, or run `/arn-infra-deploy` first?"

If the user provides URLs manually, proceed with those as the expected state.

---

Step 3: Invoke Verifier Agent

> Read the local override or plugin default for `health-check-patterns.md`.

Invoke the `arn-infra-verifier` agent via the Task tool, passing the model from `.arness/agent-models/infra.md` as the `model` parameter (see `plugins/arn-infra/skills/arn-infra-ensure-config/references/ensure-config.md` "Dispatch convention" for fallback). Context:

--- EXPECTED STATE --- Resources: [filtered resource manifest for the target environment] Endpoints: [list of endpoints with health check paths] DNS names: [list of DNS names with expected targets] SSL domains: [list of HTTPS domains requiring certificate validation] --- END EXPECTED STATE ---

--- PROVIDER CONTEXT --- Provider(s): [from providers.md] Available CLIs: [from tooling manifest -- which CLIs can query resource state] Environment: [target environment name] --- END PROVIDER CONTEXT ---

--- TOOLING --- Available tools: [list of installed verification tools from tooling manifest] curl: [available/unavailable] dig/nslookup: [available/unavailable] openssl: [available/unavailable] Provider CLIs: [list with auth status] --- END TOOLING ---

--- INSTRUCTIONS --- Run the following verification checks in order:

1. HTTP health checks on all endpoints 2. DNS resolution for all configure