Preflight and diagnostics

Use opt-in integration preflight and redacted installed-agent diagnostics without confusing a read check with deployment acceptance.

Read-only checks

Inspect before you change.

Save the integration, then run preflight. Network probes are opt-in and run from the server’s vantage point. Inspect each pass, failure, warning and unknown; HTTP 200 only means a report was produced. Download the redacted JSON when investigating.

  • Read access does not prove DNS writes, CA entitlement, reload permissions, message delivery or undo.
  • Agent-assigned targets need checks from the agent’s network and service identity. Server-side preflight cannot prove that access.
  • Notification Send test is a separate action and actually sends a message.
Installed Linux agent · local redacted diagnostics
sudo /opt/clm-agent/clm-agent \
  -credentials /etc/clm-agent/identity.json \
  -state-dir /var/lib/clm-agent -json doctor

Doctor creates no state and contacts no endpoints. It omits configured paths, hostnames and credentials. Exit 0 may still contain warnings or unknowns; service permissions and live TLS need separate acceptance.