Verify: the Seal
You don't have to take the installer's word for it. The
seal check is a read-only verification pass you run
yourself: exit code 0 means your installation is sealed
— serving a real app over a real certificate, with its security
gates re-proven live. It mutates nothing.
kapable-ops --helpYou should see the operator command list.
Running it
Append --seal-check to the same bootstrap command:
kapable-ops bootstrap ... --seal-check
# === seal-check (verify-only; mutates nothing) ===
# ✓ berth fails-closed gate
# ✓ gateway insecure-default probe (401 without token)
# ✓ first-org login cookie round-trip
#
# SEAL CHECK PASSED: zero open receipts, all re-probed gates green.
echo $? # 0A non-zero exit prints which gate failed and why. The check is safe to run any time — in cron, in your monitoring, after an incident, before an upgrade.
The three gates
| Gate | What it proves |
|---|---|
| Berth fails closed | The deploy orchestrator rejects unsigned work. Nobody — including a compromised CI step — can push an unsigned binary onto your box. |
| Gateway fails closed | The route-management API answers 401 without its token. The edge cannot be reconfigured anonymously. |
| Login round-trip | A real login POST with your owner account returns a valid session cookie for your domain — auth, database, TLS, and cookie scoping all working together, end to end. |
The convergence signal
The deeper health check is the plain re-run: execute the full
bootstrap command (without --seal-check) and read the
outcomes. All ten nodes reporting NO-CHANGE means the
system matches its specification exactly. Any APPLIED on
a re-run is the installer telling you it found drift — and
that it just repaired it. The node name tells you what drifted.
Next Steps
Operate
Day-2: healing, upgrades, and backups.
Install
Back to the command and the graph.
Security & Compliance
The platform security model in depth.