# Validation Checklist

Use this after restoring the app on the new server.

## System Checks

```bash
lsb_release -a
timedatectl
id agent
groups agent
php -v
nginx -v
node -v
npm -v
jq --version
curl --version | head -2
git --version
claude --version
nordvpn --version
```

Expected highlights:

- Timezone: `America/Mexico_City`
- `agent` in groups: `agent sudo nordvpn`
- PHP 8.3 FPM installed
- Node 20+ installed
- Claude Code installed for `agent`
- NordVPN installed and logged in

## Web Checks

```bash
sudo nginx -t
systemctl status nginx --no-pager
systemctl status php8.3-fpm --no-pager
curl -I https://www.tonki.dev/digest/
curl -I https://www.tonki.dev/digest/digest-archive/2026-06-11/
```

Expected:

- Nginx config ok.
- HTTP redirects to `https://www.tonki.dev`.
- Digest archive URL returns 200.
- PHP feedback form does not expose source code.

## File Permission Checks

```bash
stat -c '%A %U:%G %n' \
  /workspace \
  /workspace/digest \
  /workspace/digest/SUGGESTIONS-FROM-USER.MD \
  /workspace/digest/run-digest-orchestrator.sh \
  /workspace/digest/vpn-health.sh \
  /workspace/digest/validate-links.sh

sudo -u www-data test -r /workspace/digest/digest-archive/2026-06-11/index.php && echo "www-data can read digest"
sudo -u www-data test -w /workspace/digest/SUGGESTIONS-FROM-USER.MD && echo "www-data can write suggestions"
```

Expected:

- Scripts executable.
- `www-data` can read digest PHP.
- `www-data` can write `SUGGESTIONS-FROM-USER.MD`.

## Claude And MCP Checks

```bash
sudo -iu agent claude --version
sudo -iu agent claude mcp list
```

Expected:

`reddit-mcp-buddy: npx -y reddit-mcp-buddy - Connected`

Optional direct npx check:

```bash
sudo -iu agent npx -y reddit-mcp-buddy --help
```

## NordVPN Checks

```bash
sudo -iu agent sg nordvpn -c "nordvpn status"
sudo -iu agent sg nordvpn -c "nordvpn settings"
sudo -iu agent /workspace/digest/vpn-health.sh check
```

Expected:

- Status connected.
- Technology NORDLYNX.
- Protocol UDP.
- Firewall enabled.
- Kill Switch disabled.
- Auto-connect enabled.
- Allowlisted ports 22/80/443.
- `vpn-health.sh check` exits 0.

## Product Hunt Check

```bash
sudo -iu agent bash -lc 'cd /workspace/digest && ./DIGESTS/0-PRODUCTHUNT/fetch-producthunt.sh "$(date +%Y-%m-%d)" | head -60'
```

Expected:

- Markdown output.
- `Products found: N`.
- No GraphQL auth error.

## Link Validator Check

```bash
sudo -iu agent bash -lc 'cd /workspace/digest && ./validate-links.sh digest-archive/2026-06-11/index.php'
```

Warnings can happen for 403 bot protection. Broken links must be fixed before considering a new daily digest complete.

## Systemd Checks

```bash
sudo systemctl daemon-reload
sudo systemctl enable --now digest-vpn-health.timer digest-orchestrator.timer
systemctl list-timers --all | grep digest
systemctl status digest-orchestrator.timer --no-pager
systemctl status digest-vpn-health.timer --no-pager
```

Expected:

- `digest-vpn-health.timer` active and waiting.
- `digest-orchestrator.timer` active and waiting.

## Orchestrator Simulation

This does not spend Claude tokens:

```bash
sudo -iu agent bash -lc 'cd /workspace/digest && ./run-digest-orchestrator.sh --simulate --ignore-ack --date-iso 2030-01-01 --attempt-timeout-seconds 5 --poll-seconds 1 --max-attempts 1'
```

Expected:

- VPN preflight runs.
- Worker starts and times out.
- Logs are created under `logs/raw` and `logs/past-logs`.
- Exit can be nonzero because the simulated worker never writes the completion ledger.

## Real One-Off Test

Only run when ready to spend Claude usage:

```bash
sudo -iu agent bash -lc 'cd /workspace/digest && ./run-digest-orchestrator.sh --ignore-ack'
```

Success criteria:

- New `digest-archive/YYYY-MM-DD/index.php`.
- New `digest-archive/YYYY-MM-DD/checkpoint.md`.
- Today's date appended once to `COMPLETED-DAYS.md`.
- `.orchestrator-ack-YYYY-MM-DD` created.
- Telegram notification sent.
- Public URL loads.

