Completion checklist

Record the source revision, exact boot image name, VM architecture, Compose version, profiles and each observed result. Keep the evidence free of secrets.

• ARM64 Ubuntu host verified. Effective firewall reviewed and IAP SSH tested before assigning the reserved address. The final interface reports the expected address.
• Pinned source revision and private environment file verified.
• Fresh database initialized, service roles bootstrapped and the exact operator identity enrolled.
• Expected services running, scoped listener profile confirmed and unsigned loopback web request denied.
• When available, authenticated HTTPS gateway and correct browser and MCP audiences verified.
• Administrator sign-in and the first scoped workspace/application access confirmed with the intended identity.

Record any missing gateway or signed release dependency as pending. Before retaining business data, use the Administration Guide to plan health checks, backups, restoration and upgrades.