dav_lock_module removed because Fedora stopped packaging it

Signed-off-by: Jason Rothstein <fdragon@fdragon.org>

AGENTS.md

@@ -129,7 +129,6 @@
      3. **Installation**: Install or remove packages, binaries, and repositories with cryptographic verification.
      4. **Configuration**: Apply configuration files, drop-in directories, and permissions (least privilege).
      5. **Service Management**: Enable, start, or manage daemon state and register notifications/handlers.
-     6. **Post-Validation / Health Verification**: Execute end-state verification to prove correct operational state.
 3. **Platform Data Resolution Hierarchy**:
    - Platform-specific variables MUST reside in `vars/` and follow a deterministic naming schema based on OS Vendor, OS Major Version, and Architecture (e.g., `vars/{{ ansible_distribution }}_{{ ansible_distribution_major_version }}_{{ ansible_architecture }}.yml`).
    - Tasks MUST NOT embed OS-specific branching logic (`when: ansible_os_family == '...'`) for package names, service names, or configuration paths.
@@ -161,22 +160,14 @@
 2. **Actionable Diagnostic Requirement**:
    - All validation failures (static or runtime) MUST produce clear, structured diagnostics stating: the failed constraint, observed vs. expected value, and the explicit remediation step.
 
-## 10. Deployment Lifecycle, Health Gateways & Rollback Resilience
+## 10. Deployment Lifecycle, Declarative State & Resilience
 
-1. **Pre-Change Health & Baseline Validation**:
-   - Prior to applying any configuration, infrastructure, or code change, the execution sequence MUST validate that the target environment and dependent services are in a healthy, operational baseline state.
-   - Pre-change checks MUST be adapted to the specific component being deployed (e.g., verifying database connectivity, checking existing daemon health, validating DNS/network routing, verifying available disk/memory thresholds).
-   - If the pre-change health state fails, deployment MUST halt immediately before mutating any state.
-2. **Post-Change Operational & Functional Verification**:
-   - Deployment sequences MUST NOT consider a change successful merely because an installer or configuration module exited with status code zero.
-   - Every deployment MUST execute active functional verification against the resulting state:
-     - The process/service is active and enabled.
-     - Sockets and network endpoints are listening and accepting connections.
-     - Application-level synthetic transaction succeeds (e.g., for a web service: HTTP 200 OK with expected payload content, zero 5xx/4xx error pages; for a database: successful query execution).
-   - If post-change verification fails, execution MUST fail fast with detailed operational telemetry.
-3. **Reversibility & Non-Destructive Failure**:
+1. **Declarative State Enforcement vs. Redundant Assertions**:
+   - Configuration management modules in Ansible (`ansible.builtin.package`, `ansible.builtin.service`, `ansible.builtin.template`, etc.) are natively declarative and self-enforcing: they enforce the desired target state and halt execution immediately upon encountering an error.
+   - Roles MUST NOT append redundant post-task discovery and assertion loops (e.g., calling `service_facts` or `package_facts` to assert that services are running or packages are installed). Such assertions add execution overhead, do not prevent pre-existing failures ("broken before"), and produce false-positive failures on systemd sockets (`.socket`), timers (`.timer`), and service aliases.
+2. **Reversibility & Non-Destructive Failure**:
    - Deployments MUST be engineered to be non-destructive to prior working states.
-   - If a new deployment fails during application or post-verification, the system MUST not leave services in a degraded or corrupted state; atomic rollback strategies, staged deployments, or transaction-safe backups MUST be implemented to preserve or restore the last-known-good operational state.
+   - If a new deployment fails during application, the system MUST not leave services in a degraded or corrupted state; atomic rollback strategies, staged deployments, or transaction-safe backups MUST be implemented to preserve or restore the last-known-good operational state.
 
 ## 11. Infrastructure as Code (Terraform / OpenTofu) Technical Architecture
 
@@ -241,7 +232,7 @@
    - **Dual-Credential Rollover Pattern (Two-Phase Commit)**: When persistent credentials (e.g. static database users, API tokens, SSH keys) are rotated, automation MUST NOT perform single-step destructive overwrites. Rotation MUST follow a Two-Phase commit:
      1. Stage and create the new credential alongside the existing active credential.
      2. Update consumer service configuration and reload.
-     3. Execute post-change synthetic verification (Section 10.2).
+     3. Execute synthetic health verification against the service.
      4. If verification passes, revoke/drop the legacy credential; if verification fails, roll back configuration to the legacy credential and fail fast.
    - **Idempotent Reconciliation**: Automated periodic runs (e.g. hourly fleet drift runs) MUST NOT generate new credentials unless a rotation trigger or TTL expiration has occurred, ensuring repeated runs remain idempotent with zero unnecessary service reloads.
 
@@ -371,7 +362,6 @@ Before finalizing or committing any playbook, role, script, or infrastructure co
 - [ ] **Security Hardening Enforced**: Non-root daemon users configured, systemd sandboxing parameters enabled, least-privilege permissions applied, and SELinux contexts declared.
 - [ ] **Zero Credential Leaks**: All tasks and variables handling secrets or certificates enforce `no_log: true` (Ansible) or `sensitive = true` (Terraform/OpenTofu).
 - [ ] **Idempotency & Least Change**: Tasks modify only the minimal delta from factory defaults; repeated runs against compliant nodes report `changed=0`.
-- [ ] **Post-Change Verification Active (Section 10.2)**: End-state functional assertions (listening sockets, synthetic HTTP 200 checks, database queries) are implemented.
 - [ ] **Supply Chain & Licensing Verified**: All third-party packages comply with Tier 1 Libre Open Source licensing (zero BSL/SSPL) with cryptographic SHA-256 validation.
 - [ ] **Formatting & Accessibility Compliant (`STYLE.md`)**: Narrow-line formatting applied, Yoda/defensive syntax used, attributes lexicographically sorted, and no decorative ASCII art.
 

roles/ensure_ansible_prereq/tasks/main.yml

@@ -112,22 +112,3 @@
     - Ensure_Ansible_Prereq.Service_Facts
 - name: Flush Handlers
   ansible.builtin.meta: flush_handlers
-- name: Post Verification Package Discovery
-  when:
-    - ensure_ansible_prereq is defined
-    - ensure_ansible_prereq.package_list is defined
-    - ensure_ansible_prereq.package_list is iterable
-  ansible.builtin.package_facts:
-- name: Assert Managed Packages Are Installed
-  when:
-    - ensure_ansible_prereq is defined
-    - ensure_ansible_prereq.package_list is defined
-    - ensure_ansible_prereq.package_list is iterable
-  ansible.builtin.assert:
-    fail_msg: "Package {{ item.name }} is not installed"
-    quiet: true
-    that:
-      - item.state != 'present' or ansible_facts['packages'][item.name] is defined
-  loop: "{{ ensure_ansible_prereq.package_list }}"
-  loop_control:
-    label: "{{ item.name }} will be verified"

roles/ensure_apache/defaults/main.yml

@@ -2,3 +2,15 @@
 # defaults file for ensure_apache
 lets_encrypt_admin: root@example.com
 lets_encrypt_url: https://acme-v02.api.letsencrypt.org/directory
+ensure_apache_rsync_excludes:
+  - --exclude=*.bak
+  - --exclude=*.swo
+  - --exclude=*.swp
+  - --exclude=*~
+  - --exclude=.DS_Store
+  - --exclude=.env*
+  - --exclude=.git*
+  - --exclude=.gitea
+  - --exclude=.github
+  - --exclude=.gitlab-ci.yml
+  - --exclude=Thumbs.db

roles/ensure_apache/tasks/main.yml

@@ -187,25 +187,80 @@
     - Ensure_Apache.Service_Facts
     - Ensure_Apache.Service_Reload
     - Ensure_Apache.Service_Reload_Config
-- name: Ensure Website Content From Git Repos
+- name: Synchronize Website Content From Git Repositories
   when:
     - ensure_apache is defined
     - http_vhost is defined
     - http_vhost is iterable
-    - item.fqdn is defined
-    - item.repo is defined
-  ansible.builtin.git:
-    accept_hostkey: 'yes'
-    dest: /srv/http/{{ item.fqdn }}
-    repo: '{{ item.repo }}'
-  loop: '{{ http_vhost }}'
-  loop_control:
-    label: /srv/http/{{ item.fqdn }} will be populated...
-  notify:
-    - Ensure_Apache.Package_Facts
-    - Ensure_Apache.Service_Facts
-    - Ensure_Apache.Service_Reload
-    - Ensure_Apache.Service_Reload_Config
+    - http_vhost | selectattr('repo', 'defined') | list | length > 0
+  block:
+    - name: Create Temporary Local Staging Directory
+      become: false
+      delegate_to: localhost
+      ansible.builtin.tempfile:
+        prefix: 'ansible_web_{{ inventory_hostname }}_'
+        state: directory
+      register: ensure_apache_local_tempdir
+
+    - name: Ensure Website Content Cloned Locally  # noqa: latest[git]
+      when:
+        - item.fqdn is defined
+        - item.repo is defined
+      become: false
+      delegate_to: localhost
+      ansible.builtin.git:
+        accept_hostkey: true
+        depth: 1
+        dest: '{{ ensure_apache_local_tempdir.path }}/{{ (item.repo | hash("sha256"))[:8] }}_{{ item.fqdn }}'
+        repo: '{{ item.repo }}'
+        version: '{{ item.version | default("HEAD") }}'
+      loop: '{{ http_vhost }}'
+      loop_control:
+        label: '{{ item.fqdn }} local clone'
+
+    - name: Ensure Website Content Synchronized To Target
+      when:
+        - item.fqdn is defined
+        - item.repo is defined
+      ansible.posix.synchronize:
+        archive: true
+        checksum: true
+        delete: true
+        dest: '/srv/http/{{ item.fqdn }}/'
+        rsync_opts: '{{ item.rsync_opts | default(ensure_apache_rsync_excludes) }}'
+        src: '{{ ensure_apache_local_tempdir.path }}/{{ (item.repo | hash("sha256"))[:8] }}_{{ item.fqdn }}/'
+      loop: '{{ http_vhost }}'
+      loop_control:
+        label: '/srv/http/{{ item.fqdn }} will be synchronized'
+      notify:
+        - Ensure_Apache.Service_Reload
+        - Ensure_Apache.Service_Reload_Config
+
+    - name: Ensure SELinux Context On Web Content
+      when:
+        - item.fqdn is defined
+        - item.repo is defined
+      ansible.builtin.file:
+        dest: '/srv/http/{{ item.fqdn }}'
+        group: root
+        mode: '0755'
+        owner: root
+        recurse: true
+        setype: httpd_sys_content_t
+      loop: '{{ http_vhost }}'
+      loop_control:
+        label: '/srv/http/{{ item.fqdn }} SELinux context'
+
+  always:
+    - name: Remove Temporary Local Staging Directory
+      when:
+        - ensure_apache_local_tempdir is defined
+        - ensure_apache_local_tempdir.path is defined
+      become: false
+      delegate_to: localhost
+      ansible.builtin.file:
+        path: '{{ ensure_apache_local_tempdir.path }}'
+        state: absent
 - name: Ensure Services
   when:
     - ensure_apache is defined
@@ -225,27 +280,3 @@
     - Ensure_Apache.Service_Reload_Config
 - name: Flush Handlers
   ansible.builtin.meta: flush_handlers
-- name: Post Verification Service Discovery
-  when:
-    - ensure_apache is defined
-    - ensure_apache.service_list is defined
-    - ensure_apache.service_list is iterable
-  ansible.builtin.service_facts:
-- name: Assert Managed Services Are Active
-  when:
-    - ensure_apache is defined
-    - ensure_apache.service_list is defined
-    - ensure_apache.service_list is iterable
-  ansible.builtin.assert:
-    fail_msg: "Service {{ item.name }} is not active"
-    quiet: true
-    that:
-      - >-
-        item.state != 'started' or
-        (ansible_facts['services'][item.name ~ '.service'] is defined and
-        ansible_facts['services'][item.name ~ '.service']['state'] == 'running') or
-        (ansible_facts['services'][item.name] is defined and
-        ansible_facts['services'][item.name]['state'] == 'running')
-  loop: "{{ ensure_apache.service_list }}"
-  loop_control:
-    label: "{{ item.name }} will be verified"

roles/ensure_apache/templates/Fedora/44/etc/httpd/conf.modules.d/00-dav.conf

@@ -1,3 +1,2 @@
 LoadModule dav_module modules/mod_dav.so
 LoadModule dav_fs_module modules/mod_dav_fs.so
-LoadModule dav_lock_module modules/mod_dav_lock.so

roles/ensure_cockpit/tasks/main.yml

@@ -104,27 +104,3 @@
     label: '{{ item.service }} will be {{ item.state }}'
 - name: Flush Handlers
   ansible.builtin.meta: flush_handlers
-- name: Post Verification Service Discovery
-  when:
-    - ensure_cockpit is defined
-    - ensure_cockpit.service_list is defined
-    - ensure_cockpit.service_list is iterable
-  ansible.builtin.service_facts:
-- name: Assert Managed Services Are Active
-  when:
-    - ensure_cockpit is defined
-    - ensure_cockpit.service_list is defined
-    - ensure_cockpit.service_list is iterable
-  ansible.builtin.assert:
-    fail_msg: "Service {{ item.name }} is not active"
-    quiet: true
-    that:
-      - >-
-        item.state != 'started' or
-        (ansible_facts['services'][item.name ~ '.service'] is defined and
-        ansible_facts['services'][item.name ~ '.service']['state'] == 'running') or
-        (ansible_facts['services'][item.name] is defined and
-        ansible_facts['services'][item.name]['state'] == 'running')
-  loop: "{{ ensure_cockpit.service_list }}"
-  loop_control:
-    label: "{{ item.name }} will be verified"

roles/ensure_dbus/tasks/main.yml

@@ -67,27 +67,3 @@
 
 - name: Flush Handlers
   ansible.builtin.meta: flush_handlers
-- name: Post Verification Service Discovery
-  when:
-    - ensure_dbus is defined
-    - ensure_dbus.service_list is defined
-    - ensure_dbus.service_list is iterable
-  ansible.builtin.service_facts:
-- name: Assert Managed Services Are Active
-  when:
-    - ensure_dbus is defined
-    - ensure_dbus.service_list is defined
-    - ensure_dbus.service_list is iterable
-  ansible.builtin.assert:
-    fail_msg: "Service {{ item.name }} is not active"
-    quiet: true
-    that:
-      - >-
-        item.state != 'started' or
-        (ansible_facts['services'][item.name ~ '.service'] is defined and
-        ansible_facts['services'][item.name ~ '.service']['state'] == 'running') or
-        (ansible_facts['services'][item.name] is defined and
-        ansible_facts['services'][item.name]['state'] == 'running')
-  loop: "{{ ensure_dbus.service_list }}"
-  loop_control:
-    label: "{{ item.name }} will be verified"

roles/ensure_dovecot/tasks/main.yml

@@ -150,27 +150,3 @@
   notify: [Ensure_Dovecot.Package_Facts, Ensure_Dovecot.Service_Facts]
 - name: Flush Handlers
   ansible.builtin.meta: flush_handlers
-- name: Post Verification Service Discovery
-  when:
-    - ensure_dovecot is defined
-    - ensure_dovecot.service_list is defined
-    - ensure_dovecot.service_list is iterable
-  ansible.builtin.service_facts:
-- name: Assert Managed Services Are Active
-  when:
-    - ensure_dovecot is defined
-    - ensure_dovecot.service_list is defined
-    - ensure_dovecot.service_list is iterable
-  ansible.builtin.assert:
-    fail_msg: "Service {{ item.name }} is not active"
-    quiet: true
-    that:
-      - >-
-        item.state != 'started' or
-        (ansible_facts['services'][item.name ~ '.service'] is defined and
-        ansible_facts['services'][item.name ~ '.service']['state'] == 'running') or
-        (ansible_facts['services'][item.name] is defined and
-        ansible_facts['services'][item.name]['state'] == 'running')
-  loop: "{{ ensure_dovecot.service_list }}"
-  loop_control:
-    label: "{{ item.name }} will be verified"

roles/ensure_fail2ban/tasks/main.yml

@@ -130,27 +130,3 @@
     - Ensure_Fail2ban.Service_Reload
 - name: Flush Handlers
   ansible.builtin.meta: flush_handlers
-- name: Post Verification Service Discovery
-  when:
-    - ensure_fail2ban is defined
-    - ensure_fail2ban.service_list is defined
-    - ensure_fail2ban.service_list is iterable
-  ansible.builtin.service_facts:
-- name: Assert Managed Services Are Active
-  when:
-    - ensure_fail2ban is defined
-    - ensure_fail2ban.service_list is defined
-    - ensure_fail2ban.service_list is iterable
-  ansible.builtin.assert:
-    fail_msg: "Service {{ item.name }} is not active"
-    quiet: true
-    that:
-      - >-
-        item.state != 'started' or
-        (ansible_facts['services'][item.name ~ '.service'] is defined and
-        ansible_facts['services'][item.name ~ '.service']['state'] == 'running') or
-        (ansible_facts['services'][item.name] is defined and
-        ansible_facts['services'][item.name]['state'] == 'running')
-  loop: "{{ ensure_fail2ban.service_list }}"
-  loop_control:
-    label: "{{ item.name }} will be verified"

roles/ensure_firewalld/tasks/main.yml

@@ -85,27 +85,3 @@
 
 - name: Flush Handlers
   ansible.builtin.meta: flush_handlers
-- name: Post Verification Service Discovery
-  when:
-    - ensure_firewalld is defined
-    - ensure_firewalld.service_list is defined
-    - ensure_firewalld.service_list is iterable
-  ansible.builtin.service_facts:
-- name: Assert Managed Services Are Active
-  when:
-    - ensure_firewalld is defined
-    - ensure_firewalld.service_list is defined
-    - ensure_firewalld.service_list is iterable
-  ansible.builtin.assert:
-    fail_msg: "Service {{ item.name }} is not active"
-    quiet: true
-    that:
-      - >-
-        item.state != 'started' or
-        (ansible_facts['services'][item.name ~ '.service'] is defined and
-        ansible_facts['services'][item.name ~ '.service']['state'] == 'running') or
-        (ansible_facts['services'][item.name] is defined and
-        ansible_facts['services'][item.name]['state'] == 'running')
-  loop: "{{ ensure_firewalld.service_list }}"
-  loop_control:
-    label: "{{ item.name }} will be verified"

roles/ensure_git/tasks/main.yml

@@ -130,22 +130,3 @@
     - Ensure_Git.Service_Restart
 - name: Flush Handlers
   ansible.builtin.meta: flush_handlers
-- name: Post Verification Package Discovery
-  when:
-    - ensure_git is defined
-    - ensure_git.package_list is defined
-    - ensure_git.package_list is iterable
-  ansible.builtin.package_facts:
-- name: Assert Managed Packages Are Installed
-  when:
-    - ensure_git is defined
-    - ensure_git.package_list is defined
-    - ensure_git.package_list is iterable
-  ansible.builtin.assert:
-    fail_msg: "Package {{ item.name }} is not installed"
-    quiet: true
-    that:
-      - item.state != 'present' or ansible_facts['packages'][item.name] is defined
-  loop: "{{ ensure_git.package_list }}"
-  loop_control:
-    label: "{{ item.name }} will be verified"

roles/ensure_gitea/tasks/main.yml

@@ -216,27 +216,3 @@
     - Ensure_Gitea.Service_Restart
 - name: Flush Handlers
   ansible.builtin.meta: flush_handlers
-- name: Post Verification Service Discovery
-  when:
-    - ensure_gitea is defined
-    - ensure_gitea.service_list is defined
-    - ensure_gitea.service_list is iterable
-  ansible.builtin.service_facts:
-- name: Assert Managed Services Are Active
-  when:
-    - ensure_gitea is defined
-    - ensure_gitea.service_list is defined
-    - ensure_gitea.service_list is iterable
-  ansible.builtin.assert:
-    fail_msg: "Service {{ item.name }} is not active"
-    quiet: true
-    that:
-      - >-
-        item.state != 'started' or
-        (ansible_facts['services'][item.name ~ '.service'] is defined and
-        ansible_facts['services'][item.name ~ '.service']['state'] == 'running') or
-        (ansible_facts['services'][item.name] is defined and
-        ansible_facts['services'][item.name]['state'] == 'running')
-  loop: "{{ ensure_gitea.service_list }}"
-  loop_control:
-    label: "{{ item.name }} will be verified"

roles/ensure_mariadb/tasks/main.yml

@@ -232,27 +232,3 @@
   loop: '{{ mariadb_user_list }}'
   loop_control:
     label: '{{ item.name }} will be {{ item.state }}'
-- name: Post Verification Service Discovery
-  when:
-    - ensure_mariadb is defined
-    - ensure_mariadb.service_list is defined
-    - ensure_mariadb.service_list is iterable
-  ansible.builtin.service_facts:
-- name: Assert Managed Services Are Active
-  when:
-    - ensure_mariadb is defined
-    - ensure_mariadb.service_list is defined
-    - ensure_mariadb.service_list is iterable
-  ansible.builtin.assert:
-    fail_msg: "Service {{ item.name }} is not active"
-    quiet: true
-    that:
-      - >-
-        item.state != 'started' or
-        (ansible_facts['services'][item.name ~ '.service'] is defined and
-        ansible_facts['services'][item.name ~ '.service']['state'] == 'running') or
-        (ansible_facts['services'][item.name] is defined and
-        ansible_facts['services'][item.name]['state'] == 'running')
-  loop: "{{ ensure_mariadb.service_list }}"
-  loop_control:
-    label: "{{ item.name }} will be verified"

roles/ensure_os_patch/tasks/main.yml

@@ -91,22 +91,3 @@
   notify: [Ensure_Os_Patch.Package_Facts, Ensure_Os_Patch.Service_Facts]
 - name: Flush Handlers
   ansible.builtin.meta: flush_handlers
-- name: Post Verification Package Discovery
-  when:
-    - ensure_os_patch is defined
-    - ensure_os_patch.package_list is defined
-    - ensure_os_patch.package_list is iterable
-  ansible.builtin.package_facts:
-- name: Assert Managed Packages Are Installed
-  when:
-    - ensure_os_patch is defined
-    - ensure_os_patch.package_list is defined
-    - ensure_os_patch.package_list is iterable
-  ansible.builtin.assert:
-    fail_msg: "Package {{ item.name }} is not installed"
-    quiet: true
-    that:
-      - item.state != 'present' or ansible_facts['packages'][item.name] is defined
-  loop: "{{ ensure_os_patch.package_list }}"
-  loop_control:
-    label: "{{ item.name }} will be verified"

roles/ensure_os_upgrade/tasks/main.yml

@@ -93,22 +93,3 @@
     - Ensure_Os_Upgrade.Service_Facts
 - name: Flush Handlers
   ansible.builtin.meta: flush_handlers
-- name: Post Verification Package Discovery
-  when:
-    - ensure_os_upgrade is defined
-    - ensure_os_upgrade.package_list is defined
-    - ensure_os_upgrade.package_list is iterable
-  ansible.builtin.package_facts:
-- name: Assert Managed Packages Are Installed
-  when:
-    - ensure_os_upgrade is defined
-    - ensure_os_upgrade.package_list is defined
-    - ensure_os_upgrade.package_list is iterable
-  ansible.builtin.assert:
-    fail_msg: "Package {{ item.name }} is not installed"
-    quiet: true
-    that:
-      - item.state != 'present' or ansible_facts['packages'][item.name] is defined
-  loop: "{{ ensure_os_upgrade.package_list }}"
-  loop_control:
-    label: "{{ item.name }} will be verified"

roles/ensure_podman/tasks/main.yml

@@ -84,27 +84,3 @@
   ansible.builtin.reboot:
 - name: Flush Handlers
   ansible.builtin.meta: flush_handlers
-- name: Post Verification Service Discovery
-  when:
-    - ensure_podman is defined
-    - ensure_podman.service_list is defined
-    - ensure_podman.service_list is iterable
-  ansible.builtin.service_facts:
-- name: Assert Managed Services Are Active
-  when:
-    - ensure_podman is defined
-    - ensure_podman.service_list is defined
-    - ensure_podman.service_list is iterable
-  ansible.builtin.assert:
-    fail_msg: "Service {{ item.name }} is not active"
-    quiet: true
-    that:
-      - >-
-        item.state != 'started' or
-        (ansible_facts['services'][item.name ~ '.service'] is defined and
-        ansible_facts['services'][item.name ~ '.service']['state'] == 'running') or
-        (ansible_facts['services'][item.name] is defined and
-        ansible_facts['services'][item.name]['state'] == 'running')
-  loop: "{{ ensure_podman.service_list }}"
-  loop_control:
-    label: "{{ item.name }} will be verified"

roles/ensure_postfix/tasks/main.yml

@@ -150,27 +150,3 @@
   notify: [Ensure_Postfix.Package_Facts, Ensure_Postfix.Service_Facts]
 - name: Flush Handlers
   ansible.builtin.meta: flush_handlers
-- name: Post Verification Service Discovery
-  when:
-    - ensure_postfix is defined
-    - ensure_postfix.service_list is defined
-    - ensure_postfix.service_list is iterable
-  ansible.builtin.service_facts:
-- name: Assert Managed Services Are Active
-  when:
-    - ensure_postfix is defined
-    - ensure_postfix.service_list is defined
-    - ensure_postfix.service_list is iterable
-  ansible.builtin.assert:
-    fail_msg: "Service {{ item.name }} is not active"
-    quiet: true
-    that:
-      - >-
-        item.state != 'started' or
-        (ansible_facts['services'][item.name ~ '.service'] is defined and
-        ansible_facts['services'][item.name ~ '.service']['state'] == 'running') or
-        (ansible_facts['services'][item.name] is defined and
-        ansible_facts['services'][item.name]['state'] == 'running')
-  loop: "{{ ensure_postfix.service_list }}"
-  loop_control:
-    label: "{{ item.name }} will be verified"

roles/ensure_repo_epel/tasks/main.yml

@@ -100,22 +100,3 @@
     create: false
 - name: Flush Handlers
   ansible.builtin.meta: flush_handlers
-- name: Post Verification Package Discovery
-  when:
-    - ensure_repo_epel is defined
-    - ensure_repo_epel.package_list is defined
-    - ensure_repo_epel.package_list is iterable
-  ansible.builtin.package_facts:
-- name: Assert Managed Packages Are Installed
-  when:
-    - ensure_repo_epel is defined
-    - ensure_repo_epel.package_list is defined
-    - ensure_repo_epel.package_list is iterable
-  ansible.builtin.assert:
-    fail_msg: "Package {{ item.name }} is not installed"
-    quiet: true
-    that:
-      - item.state != 'present' or ansible_facts['packages'][item.name] is defined
-  loop: "{{ ensure_repo_epel.package_list }}"
-  loop_control:
-    label: "{{ item.name }} will be verified"

roles/ensure_repo_rpmfusion/tasks/main.yml

@@ -72,22 +72,3 @@
     - Ensure_Repo_Rpmfusion.Service_Facts
 - name: Flush Handlers
   ansible.builtin.meta: flush_handlers
-- name: Post Verification Package Discovery
-  when:
-    - ensure_repo_rpmfusion is defined
-    - ensure_repo_rpmfusion.package_list is defined
-    - ensure_repo_rpmfusion.package_list is iterable
-  ansible.builtin.package_facts:
-- name: Assert Managed Packages Are Installed
-  when:
-    - ensure_repo_rpmfusion is defined
-    - ensure_repo_rpmfusion.package_list is defined
-    - ensure_repo_rpmfusion.package_list is iterable
-  ansible.builtin.assert:
-    fail_msg: "Package {{ item.name }} is not installed"
-    quiet: true
-    that:
-      - item.state != 'present' or ansible_facts['packages'][item.name] is defined
-  loop: "{{ ensure_repo_rpmfusion.package_list }}"
-  loop_control:
-    label: "{{ item.name }} will be verified"

roles/ensure_rsync/tasks/main.yml

@@ -130,22 +130,3 @@
     - Ensure_Rsync.Service_Restart
 - name: Flush Handlers
   ansible.builtin.meta: flush_handlers
-- name: Post Verification Package Discovery
-  when:
-    - ensure_rsync is defined
-    - ensure_rsync.package_list is defined
-    - ensure_rsync.package_list is iterable
-  ansible.builtin.package_facts:
-- name: Assert Managed Packages Are Installed
-  when:
-    - ensure_rsync is defined
-    - ensure_rsync.package_list is defined
-    - ensure_rsync.package_list is iterable
-  ansible.builtin.assert:
-    fail_msg: "Package {{ item.name }} is not installed"
-    quiet: true
-    that:
-      - item.state != 'present' or ansible_facts['packages'][item.name] is defined
-  loop: "{{ ensure_rsync.package_list }}"
-  loop_control:
-    label: "{{ item.name }} will be verified"

roles/ensure_timezone/tasks/main.yml

@@ -128,27 +128,3 @@
     label: '{{ item.name }} will be {{ item.state }}'
 - name: Flush Handlers
   ansible.builtin.meta: flush_handlers
-- name: Post Verification Service Discovery
-  when:
-    - ensure_timezone is defined
-    - ensure_timezone.service_list is defined
-    - ensure_timezone.service_list is iterable
-  ansible.builtin.service_facts:
-- name: Assert Managed Services Are Active
-  when:
-    - ensure_timezone is defined
-    - ensure_timezone.service_list is defined
-    - ensure_timezone.service_list is iterable
-  ansible.builtin.assert:
-    fail_msg: "Service {{ item.name }} is not active"
-    quiet: true
-    that:
-      - >-
-        item.state != 'started' or
-        (ansible_facts['services'][item.name ~ '.service'] is defined and
-        ansible_facts['services'][item.name ~ '.service']['state'] == 'running') or
-        (ansible_facts['services'][item.name] is defined and
-        ansible_facts['services'][item.name]['state'] == 'running')
-  loop: "{{ ensure_timezone.service_list }}"
-  loop_control:
-    label: "{{ item.name }} will be verified"

roles/ensure_vim/tasks/main.yml

@@ -130,22 +130,3 @@
     - Ensure_Vim.Service_Restart
 - name: Flush Handlers
   ansible.builtin.meta: flush_handlers
-- name: Post Verification Package Discovery
-  when:
-    - ensure_vim is defined
-    - ensure_vim.package_list is defined
-    - ensure_vim.package_list is iterable
-  ansible.builtin.package_facts:
-- name: Assert Managed Packages Are Installed
-  when:
-    - ensure_vim is defined
-    - ensure_vim.package_list is defined
-    - ensure_vim.package_list is iterable
-  ansible.builtin.assert:
-    fail_msg: "Package {{ item.name }} is not installed"
-    quiet: true
-    that:
-      - item.state != 'present' or ansible_facts['packages'][item.name] is defined
-  loop: "{{ ensure_vim.package_list }}"
-  loop_control:
-    label: "{{ item.name }} will be verified"