7. Verify fail-closed access

Run this from the VM after the web service reports healthy. Check the status of the unsigned request.

curl -sS -o /dev/null -w '%{http_code}\n' http://127.0.0.1:5195/

Expect HTTP 401. Confirm the development host only publishes ports 5193, 5194 and 5195 on loopback with the core profile. The optional workspace listener uses 5192. The database stays on the Compose network.

When the deployment has a verified HTTPS gateway, check the browser redirect to the configured issuer, a successful authorized browser session and an authenticated MCP tool discovery. Test unsigned access and a mismatched audience with a disposable identity. A ready container or a single 401 does not establish that the gateway or its permissions work.