Verification checks
Every check below is computed from real responses and configuration reads, and recorded as evidence in each run's report.
| ID | Check | Evidence recorded |
|---|---|---|
| D1 | Site reachable on its domain | HTTPS status, content type |
| D2 | HTTPS with a trusted chain | TLS version, cipher, verification result |
| D3 | HTTP redirects to HTTPS | 301 status and Location header |
| D4 | Certificate matches the domain | SANs, issuer, expiry |
| D5 | Pages and assets load | Status per page and asset |
| D6 | Direct S3 access denied | 403 AccessDenied from S3 endpoints |
| D7 | CloudFront serves content | Via, X-Cache, POP headers |
| D8 | Custom error page | 404 status and page marker |
| C1–C7 | AWS configuration | Viewer policy, OAC, bucket policy, certificate, DNS alias |
Controlled failure drill
A human deliberately breaks one setting. The Verifier detects it, the Diagnostician names the cause and proposes a playbook, a human approves, the playbook runs, and the checks are polled until the site recovers.