"It seems to work" is not a state a CA is allowed to be in. A fresh install should pass all five of these — each one checks a different failure class:
docker compose ps # both services healthy curl -sk -H "$A" $API/v1/status/components # every role heartbeating curl -sk -H "$A" "$API/v1/audit/verify?limit=0" # → "status":"intact" curl -sk -H "$A" $API/v1/audit/checkpoints # ≥1 signed head after ~5 min curl -sk -H "$A" $API/v1/status/edge-tls # every listener "source":"issued"
In order: the containers run; every role is alive and reporting; the audit chain verifies end to end; the chain has at least one signed head (impatient? POST /v1/audit/checkpoints forces one immediately); and every listener serves a certificate goca issued to itself rather than the bootstrap fallback.
In the console, Status → Audit & Logs should show intact plus a green signed heads badge. Run the five checks now, while everything is known-good — that gives you a baseline to compare against on the day something isn't.
Now I can prove a fresh install is healthy instead of assuming it.