---
id: TECH-TESTING
type: technical
status: active
title: Testing
created: '2026-09-09'
updated: 2026-09-09
tags:
- technical
- testing
related:
- MOD-005
source_paths: []
confidence: confirmed
---

# Testing

## Automated Tests

- None found. The repository has no test suite, no CI configuration, and no
  lint config (`confidence: confirmed` for absence in the working tree).

## Verification Approach (documented in AGENTS.md / README)

1. Run changes in the Docker container: `./execute.sh` (image
   `ansible:deb13`, repo mounted at `/ansible`).
2. Optional lint: `ansible-lint` (recommended by AGENTS.md, not installed in
   the image by default).
3. Dry runs with `ansible-playbook --check` where sensible.
4. Role-level documentation duty: update the role README with every
   variable/task/template change.

## Built-In Quality Gates

- Playbook-level Debian guard (`os_family` check) on all playbooks except
  `playbooks/hardening/manage-ssh-keys.yml`.
- `healthcheck` role: post-update container quality gate, optionally failing
  the play (`healthcheck_fail_on_unhealthy`, default false).
- `monitoring` role: PSK format/length assertion, role input validation task
  (`validate.yml`).