feat(ensure_apache): synchronize website content from local temp staging

Replace remote git checkouts on target web nodes with an orchestrated
local staging and rsync deployment pipeline.

Recent OpenSSH updates in Fedora dropped agent forwarding into remote
sessions, breaking remote git fetch operations. Furthermore, pulling
directly from Git on production servers exposed .git repositories in
public webroots and required target servers to hold Git credentials.

- Create an ephemeral, unguessable local staging directory (0700) on
  localhost via ansible.builtin.tempfile scoped by inventory_hostname.
- Stage checkouts using repo hash prefixes to prevent collision when
  public and private servers share identical FQDNs.
- Execute shallow checkouts (depth: 1) on the control node using local
  credentials.
- Push website content to /srv/http/{fqdn}/ via ansible.posix.synchronize
  with checksum delta comparisons and automated cleanup (--delete).
- Introduce ensure_apache_rsync_excludes in role defaults to strip
  .git*, .env*, CI/CD pipelines (.gitea, .github), editor swap files,
  and OS metadata while preserving .htaccess and /.well-known/.
- Enforce httpd_sys_content_t SELinux context recursively across webroots.
- Guarantee staging directory cleanup on localhost via an always block.

AGENTS.md

@@ -129,7 +129,6 @@
      3. **Installation**: Install or remove packages, binaries, and repositories with cryptographic verification.
      4. **Configuration**: Apply configuration files, drop-in directories, and permissions (least privilege).
      5. **Service Management**: Enable, start, or manage daemon state and register notifications/handlers.
-     6. **Post-Validation / Health Verification**: Execute end-state verification to prove correct operational state.
 3. **Platform Data Resolution Hierarchy**:
    - Platform-specific variables MUST reside in `vars/` and follow a deterministic naming schema based on OS Vendor, OS Major Version, and Architecture (e.g., `vars/{{ ansible_distribution }}_{{ ansible_distribution_major_version }}_{{ ansible_architecture }}.yml`).
    - Tasks MUST NOT embed OS-specific branching logic (`when: ansible_os_family == '...'`) for package names, service names, or configuration paths.
@@ -161,22 +160,14 @@
 2. **Actionable Diagnostic Requirement**:
    - All validation failures (static or runtime) MUST produce clear, structured diagnostics stating: the failed constraint, observed vs. expected value, and the explicit remediation step.
 
-## 10. Deployment Lifecycle, Health Gateways & Rollback Resilience
+## 10. Deployment Lifecycle, Declarative State & Resilience
 
-1. **Pre-Change Health & Baseline Validation**:
-   - Prior to applying any configuration, infrastructure, or code change, the execution sequence MUST validate that the target environment and dependent services are in a healthy, operational baseline state.
-   - Pre-change checks MUST be adapted to the specific component being deployed (e.g., verifying database connectivity, checking existing daemon health, validating DNS/network routing, verifying available disk/memory thresholds).
-   - If the pre-change health state fails, deployment MUST halt immediately before mutating any state.
-2. **Post-Change Operational & Functional Verification**:
-   - Deployment sequences MUST NOT consider a change successful merely because an installer or configuration module exited with status code zero.
-   - Every deployment MUST execute active functional verification against the resulting state:
-     - The process/service is active and enabled.
-     - Sockets and network endpoints are listening and accepting connections.
-     - Application-level synthetic transaction succeeds (e.g., for a web service: HTTP 200 OK with expected payload content, zero 5xx/4xx error pages; for a database: successful query execution).
-   - If post-change verification fails, execution MUST fail fast with detailed operational telemetry.
-3. **Reversibility & Non-Destructive Failure**:
+1. **Declarative State Enforcement vs. Redundant Assertions**:
+   - Configuration management modules in Ansible (`ansible.builtin.package`, `ansible.builtin.service`, `ansible.builtin.template`, etc.) are natively declarative and self-enforcing: they enforce the desired target state and halt execution immediately upon encountering an error.
+   - Roles MUST NOT append redundant post-task discovery and assertion loops (e.g., calling `service_facts` or `package_facts` to assert that services are running or packages are installed). Such assertions add execution overhead, do not prevent pre-existing failures ("broken before"), and produce false-positive failures on systemd sockets (`.socket`), timers (`.timer`), and service aliases.
+2. **Reversibility & Non-Destructive Failure**:
    - Deployments MUST be engineered to be non-destructive to prior working states.
-   - If a new deployment fails during application or post-verification, the system MUST not leave services in a degraded or corrupted state; atomic rollback strategies, staged deployments, or transaction-safe backups MUST be implemented to preserve or restore the last-known-good operational state.
+   - If a new deployment fails during application, the system MUST not leave services in a degraded or corrupted state; atomic rollback strategies, staged deployments, or transaction-safe backups MUST be implemented to preserve or restore the last-known-good operational state.
 
 ## 11. Infrastructure as Code (Terraform / OpenTofu) Technical Architecture
 
@@ -241,7 +232,7 @@
    - **Dual-Credential Rollover Pattern (Two-Phase Commit)**: When persistent credentials (e.g. static database users, API tokens, SSH keys) are rotated, automation MUST NOT perform single-step destructive overwrites. Rotation MUST follow a Two-Phase commit:
      1. Stage and create the new credential alongside the existing active credential.
      2. Update consumer service configuration and reload.
-     3. Execute post-change synthetic verification (Section 10.2).
+     3. Execute synthetic health verification against the service.
      4. If verification passes, revoke/drop the legacy credential; if verification fails, roll back configuration to the legacy credential and fail fast.
    - **Idempotent Reconciliation**: Automated periodic runs (e.g. hourly fleet drift runs) MUST NOT generate new credentials unless a rotation trigger or TTL expiration has occurred, ensuring repeated runs remain idempotent with zero unnecessary service reloads.
 
@@ -371,7 +362,6 @@ Before finalizing or committing any playbook, role, script, or infrastructure co
 - [ ] **Security Hardening Enforced**: Non-root daemon users configured, systemd sandboxing parameters enabled, least-privilege permissions applied, and SELinux contexts declared.
 - [ ] **Zero Credential Leaks**: All tasks and variables handling secrets or certificates enforce `no_log: true` (Ansible) or `sensitive = true` (Terraform/OpenTofu).
 - [ ] **Idempotency & Least Change**: Tasks modify only the minimal delta from factory defaults; repeated runs against compliant nodes report `changed=0`.
-- [ ] **Post-Change Verification Active (Section 10.2)**: End-state functional assertions (listening sockets, synthetic HTTP 200 checks, database queries) are implemented.
 - [ ] **Supply Chain & Licensing Verified**: All third-party packages comply with Tier 1 Libre Open Source licensing (zero BSL/SSPL) with cryptographic SHA-256 validation.
 - [ ] **Formatting & Accessibility Compliant (`STYLE.md`)**: Narrow-line formatting applied, Yoda/defensive syntax used, attributes lexicographically sorted, and no decorative ASCII art.
 

roles/ensure_ansible_prereq/tasks/main.yml

@@ -112,22 +112,3 @@
     - Ensure_Ansible_Prereq.Service_Facts
 - name: Flush Handlers
   ansible.builtin.meta: flush_handlers
-- name: Post Verification Package Discovery
-  when:
-    - ensure_ansible_prereq is defined
-    - ensure_ansible_prereq.package_list is defined
-    - ensure_ansible_prereq.package_list is iterable
-  ansible.builtin.package_facts:
-- name: Assert Managed Packages Are Installed
-  when:
-    - ensure_ansible_prereq is defined
-    - ensure_ansible_prereq.package_list is defined
-    - ensure_ansible_prereq.package_list is iterable
-  ansible.builtin.assert:
-    fail_msg: "Package {{ item.name }} is not installed"
-    quiet: true
-    that:
-      - item.state != 'present' or ansible_facts['packages'][item.name] is defined
-  loop: "{{ ensure_ansible_prereq.package_list }}"
-  loop_control:
-    label: "{{ item.name }} will be verified"

roles/ensure_apache/defaults/main.yml

@@ -2,3 +2,15 @@
 # defaults file for ensure_apache
 lets_encrypt_admin: root@example.com
 lets_encrypt_url: https://acme-v02.api.letsencrypt.org/directory
+ensure_apache_rsync_excludes:
+  - --exclude=*.bak
+  - --exclude=*.swo
+  - --exclude=*.swp
+  - --exclude=*~
+  - --exclude=.DS_Store
+  - --exclude=.env*
+  - --exclude=.git*
+  - --exclude=.gitea
+  - --exclude=.github
+  - --exclude=.gitlab-ci.yml
+  - --exclude=Thumbs.db

roles/ensure_apache/tasks/main.yml

@@ -187,25 +187,80 @@
     - Ensure_Apache.Service_Facts
     - Ensure_Apache.Service_Reload
     - Ensure_Apache.Service_Reload_Config
-- name: Ensure Website Content From Git Repos
+- name: Synchronize Website Content From Git Repositories
   when:
     - ensure_apache is defined
     - http_vhost is defined
     - http_vhost is iterable
+    - http_vhost | selectattr('repo', 'defined') | list | length > 0
+  block:
+    - name: Create Temporary Local Staging Directory
+      become: false
+      delegate_to: localhost
+      ansible.builtin.tempfile:
+        prefix: 'ansible_web_{{ inventory_hostname }}_'
+        state: directory
+      register: ensure_apache_local_tempdir
+
+    - name: Ensure Website Content Cloned Locally  # noqa: latest[git]
+      when:
         - item.fqdn is defined
         - item.repo is defined
+      become: false
+      delegate_to: localhost
       ansible.builtin.git:
-    accept_hostkey: 'yes'
-    dest: /srv/http/{{ item.fqdn }}
+        accept_hostkey: true
+        depth: 1
+        dest: '{{ ensure_apache_local_tempdir.path }}/{{ (item.repo | hash("sha256"))[:8] }}_{{ item.fqdn }}'
         repo: '{{ item.repo }}'
+        version: '{{ item.version | default("HEAD") }}'
       loop: '{{ http_vhost }}'
       loop_control:
-    label: /srv/http/{{ item.fqdn }} will be populated...
+        label: '{{ item.fqdn }} local clone'
+
+    - name: Ensure Website Content Synchronized To Target
+      when:
+        - item.fqdn is defined
+        - item.repo is defined
+      ansible.posix.synchronize:
+        archive: true
+        checksum: true
+        delete: true
+        dest: '/srv/http/{{ item.fqdn }}/'
+        rsync_opts: '{{ item.rsync_opts | default(ensure_apache_rsync_excludes) }}'
+        src: '{{ ensure_apache_local_tempdir.path }}/{{ (item.repo | hash("sha256"))[:8] }}_{{ item.fqdn }}/'
+      loop: '{{ http_vhost }}'
+      loop_control:
+        label: '/srv/http/{{ item.fqdn }} will be synchronized'
       notify:
-    - Ensure_Apache.Package_Facts
-    - Ensure_Apache.Service_Facts
         - Ensure_Apache.Service_Reload
         - Ensure_Apache.Service_Reload_Config
+
+    - name: Ensure SELinux Context On Web Content
+      when:
+        - item.fqdn is defined
+        - item.repo is defined
+      ansible.builtin.file:
+        dest: '/srv/http/{{ item.fqdn }}'
+        group: root
+        mode: '0755'
+        owner: root
+        recurse: true
+        setype: httpd_sys_content_t
+      loop: '{{ http_vhost }}'
+      loop_control:
+        label: '/srv/http/{{ item.fqdn }} SELinux context'
+
+  always:
+    - name: Remove Temporary Local Staging Directory
+      when:
+        - ensure_apache_local_tempdir is defined
+        - ensure_apache_local_tempdir.path is defined
+      become: false
+      delegate_to: localhost
+      ansible.builtin.file:
+        path: '{{ ensure_apache_local_tempdir.path }}'
+        state: absent
 - name: Ensure Services
   when:
     - ensure_apache is defined
@@ -225,27 +280,3 @@
     - Ensure_Apache.Service_Reload_Config
 - name: Flush Handlers
   ansible.builtin.meta: flush_handlers
-- name: Post Verification Service Discovery
-  when:
-    - ensure_apache is defined
-    - ensure_apache.service_list is defined
-    - ensure_apache.service_list is iterable
-  ansible.builtin.service_facts:
-- name: Assert Managed Services Are Active
-  when:
-    - ensure_apache is defined
-    - ensure_apache.service_list is defined
-    - ensure_apache.service_list is iterable
-  ansible.builtin.assert:
-    fail_msg: "Service {{ item.name }} is not active"
-    quiet: true
-    that:
-      - >-
-        item.state != 'started' or
-        (ansible_facts['services'][item.name ~ '.service'] is defined and
-        ansible_facts['services'][item.name ~ '.service']['state'] == 'running') or
-        (ansible_facts['services'][item.name] is defined and
-        ansible_facts['services'][item.name]['state'] == 'running')
-  loop: "{{ ensure_apache.service_list }}"
-  loop_control:
-    label: "{{ item.name }} will be verified"

roles/ensure_cockpit/tasks/main.yml

@@ -104,27 +104,3 @@
     label: '{{ item.service }} will be {{ item.state }}'
 - name: Flush Handlers
   ansible.builtin.meta: flush_handlers
-- name: Post Verification Service Discovery
-  when:
-    - ensure_cockpit is defined
-    - ensure_cockpit.service_list is defined
-    - ensure_cockpit.service_list is iterable
-  ansible.builtin.service_facts:
-- name: Assert Managed Services Are Active
-  when:
-    - ensure_cockpit is defined
-    - ensure_cockpit.service_list is defined
-    - ensure_cockpit.service_list is iterable
-  ansible.builtin.assert:
-    fail_msg: "Service {{ item.name }} is not active"
-    quiet: true
-    that:
-      - >-
-        item.state != 'started' or
-        (ansible_facts['services'][item.name ~ '.service'] is defined and
-        ansible_facts['services'][item.name ~ '.service']['state'] == 'running') or
-        (ansible_facts['services'][item.name] is defined and
-        ansible_facts['services'][item.name]['state'] == 'running')
-  loop: "{{ ensure_cockpit.service_list }}"
-  loop_control:
-    label: "{{ item.name }} will be verified"

roles/ensure_dbus/tasks/main.yml

@@ -67,27 +67,3 @@
 
 - name: Flush Handlers
   ansible.builtin.meta: flush_handlers
-- name: Post Verification Service Discovery
-  when:
-    - ensure_dbus is defined
-    - ensure_dbus.service_list is defined
-    - ensure_dbus.service_list is iterable
-  ansible.builtin.service_facts:
-- name: Assert Managed Services Are Active
-  when:
-    - ensure_dbus is defined
-    - ensure_dbus.service_list is defined
-    - ensure_dbus.service_list is iterable
-  ansible.builtin.assert:
-    fail_msg: "Service {{ item.name }} is not active"
-    quiet: true
-    that:
-      - >-
-        item.state != 'started' or
-        (ansible_facts['services'][item.name ~ '.service'] is defined and
-        ansible_facts['services'][item.name ~ '.service']['state'] == 'running') or
-        (ansible_facts['services'][item.name] is defined and
-        ansible_facts['services'][item.name]['state'] == 'running')
-  loop: "{{ ensure_dbus.service_list }}"
-  loop_control:
-    label: "{{ item.name }} will be verified"

roles/ensure_dovecot/tasks/main.yml

@@ -150,27 +150,3 @@
   notify: [Ensure_Dovecot.Package_Facts, Ensure_Dovecot.Service_Facts]
 - name: Flush Handlers
   ansible.builtin.meta: flush_handlers
-- name: Post Verification Service Discovery
-  when:
-    - ensure_dovecot is defined
-    - ensure_dovecot.service_list is defined
-    - ensure_dovecot.service_list is iterable
-  ansible.builtin.service_facts:
-- name: Assert Managed Services Are Active
-  when:
-    - ensure_dovecot is defined
-    - ensure_dovecot.service_list is defined
-    - ensure_dovecot.service_list is iterable
-  ansible.builtin.assert:
-    fail_msg: "Service {{ item.name }} is not active"
-    quiet: true
-    that:
-      - >-
-        item.state != 'started' or
-        (ansible_facts['services'][item.name ~ '.service'] is defined and
-        ansible_facts['services'][item.name ~ '.service']['state'] == 'running') or
-        (ansible_facts['services'][item.name] is defined and
-        ansible_facts['services'][item.name]['state'] == 'running')
-  loop: "{{ ensure_dovecot.service_list }}"
-  loop_control:
-    label: "{{ item.name }} will be verified"

roles/ensure_fail2ban/tasks/main.yml

@@ -130,27 +130,3 @@
     - Ensure_Fail2ban.Service_Reload
 - name: Flush Handlers
   ansible.builtin.meta: flush_handlers
-- name: Post Verification Service Discovery
-  when:
-    - ensure_fail2ban is defined
-    - ensure_fail2ban.service_list is defined
-    - ensure_fail2ban.service_list is iterable
-  ansible.builtin.service_facts:
-- name: Assert Managed Services Are Active
-  when:
-    - ensure_fail2ban is defined
-    - ensure_fail2ban.service_list is defined
-    - ensure_fail2ban.service_list is iterable
-  ansible.builtin.assert:
-    fail_msg: "Service {{ item.name }} is not active"
-    quiet: true
-    that:
-      - >-
-        item.state != 'started' or
-        (ansible_facts['services'][item.name ~ '.service'] is defined and
-        ansible_facts['services'][item.name ~ '.service']['state'] == 'running') or
-        (ansible_facts['services'][item.name] is defined and
-        ansible_facts['services'][item.name]['state'] == 'running')
-  loop: "{{ ensure_fail2ban.service_list }}"
-  loop_control:
-    label: "{{ item.name }} will be verified"

roles/ensure_firewalld/tasks/main.yml

@@ -85,27 +85,3 @@
 
 - name: Flush Handlers
   ansible.builtin.meta: flush_handlers
-- name: Post Verification Service Discovery
-  when:
-    - ensure_firewalld is defined
-    - ensure_firewalld.service_list is defined
-    - ensure_firewalld.service_list is iterable
-  ansible.builtin.service_facts:
-- name: Assert Managed Services Are Active
-  when:
-    - ensure_firewalld is defined
-    - ensure_firewalld.service_list is defined
-    - ensure_firewalld.service_list is iterable
-  ansible.builtin.assert:
-    fail_msg: "Service {{ item.name }} is not active"
-    quiet: true
-    that:
-      - >-
-        item.state != 'started' or
-        (ansible_facts['services'][item.name ~ '.service'] is defined and
-        ansible_facts['services'][item.name ~ '.service']['state'] == 'running') or
-        (ansible_facts['services'][item.name] is defined and
-        ansible_facts['services'][item.name]['state'] == 'running')
-  loop: "{{ ensure_firewalld.service_list }}"
-  loop_control:
-    label: "{{ item.name }} will be verified"

roles/ensure_git/tasks/main.yml

@@ -130,22 +130,3 @@
     - Ensure_Git.Service_Restart
 - name: Flush Handlers
   ansible.builtin.meta: flush_handlers
-- name: Post Verification Package Discovery
-  when:
-    - ensure_git is defined
-    - ensure_git.package_list is defined
-    - ensure_git.package_list is iterable
-  ansible.builtin.package_facts:
-- name: Assert Managed Packages Are Installed
-  when:
-    - ensure_git is defined
-    - ensure_git.package_list is defined
-    - ensure_git.package_list is iterable
-  ansible.builtin.assert:
-    fail_msg: "Package {{ item.name }} is not installed"
-    quiet: true
-    that:
-      - item.state != 'present' or ansible_facts['packages'][item.name] is defined
-  loop: "{{ ensure_git.package_list }}"
-  loop_control:
-    label: "{{ item.name }} will be verified"

roles/ensure_gitea/tasks/main.yml

@@ -216,27 +216,3 @@
     - Ensure_Gitea.Service_Restart
 - name: Flush Handlers
   ansible.builtin.meta: flush_handlers
-- name: Post Verification Service Discovery
-  when:
-    - ensure_gitea is defined
-    - ensure_gitea.service_list is defined
-    - ensure_gitea.service_list is iterable
-  ansible.builtin.service_facts:
-- name: Assert Managed Services Are Active
-  when:
-    - ensure_gitea is defined
-    - ensure_gitea.service_list is defined
-    - ensure_gitea.service_list is iterable
-  ansible.builtin.assert:
-    fail_msg: "Service {{ item.name }} is not active"
-    quiet: true
-    that:
-      - >-
-        item.state != 'started' or
-        (ansible_facts['services'][item.name ~ '.service'] is defined and
-        ansible_facts['services'][item.name ~ '.service']['state'] == 'running') or
-        (ansible_facts['services'][item.name] is defined and
-        ansible_facts['services'][item.name]['state'] == 'running')
-  loop: "{{ ensure_gitea.service_list }}"
-  loop_control:
-    label: "{{ item.name }} will be verified"

roles/ensure_mariadb/tasks/main.yml

@@ -232,27 +232,3 @@
   loop: '{{ mariadb_user_list }}'
   loop_control:
     label: '{{ item.name }} will be {{ item.state }}'
-- name: Post Verification Service Discovery
-  when:
-    - ensure_mariadb is defined
-    - ensure_mariadb.service_list is defined
-    - ensure_mariadb.service_list is iterable
-  ansible.builtin.service_facts:
-- name: Assert Managed Services Are Active
-  when:
-    - ensure_mariadb is defined
-    - ensure_mariadb.service_list is defined
-    - ensure_mariadb.service_list is iterable
-  ansible.builtin.assert:
-    fail_msg: "Service {{ item.name }} is not active"
-    quiet: true
-    that:
-      - >-
-        item.state != 'started' or
-        (ansible_facts['services'][item.name ~ '.service'] is defined and
-        ansible_facts['services'][item.name ~ '.service']['state'] == 'running') or
-        (ansible_facts['services'][item.name] is defined and
-        ansible_facts['services'][item.name]['state'] == 'running')
-  loop: "{{ ensure_mariadb.service_list }}"
-  loop_control:
-    label: "{{ item.name }} will be verified"

roles/ensure_os_patch/tasks/main.yml

@@ -91,22 +91,3 @@
   notify: [Ensure_Os_Patch.Package_Facts, Ensure_Os_Patch.Service_Facts]
 - name: Flush Handlers
   ansible.builtin.meta: flush_handlers
-- name: Post Verification Package Discovery
-  when:
-    - ensure_os_patch is defined
-    - ensure_os_patch.package_list is defined
-    - ensure_os_patch.package_list is iterable
-  ansible.builtin.package_facts:
-- name: Assert Managed Packages Are Installed
-  when:
-    - ensure_os_patch is defined
-    - ensure_os_patch.package_list is defined
-    - ensure_os_patch.package_list is iterable
-  ansible.builtin.assert:
-    fail_msg: "Package {{ item.name }} is not installed"
-    quiet: true
-    that:
-      - item.state != 'present' or ansible_facts['packages'][item.name] is defined
-  loop: "{{ ensure_os_patch.package_list }}"
-  loop_control:
-    label: "{{ item.name }} will be verified"

roles/ensure_os_upgrade/tasks/main.yml

@@ -93,22 +93,3 @@
     - Ensure_Os_Upgrade.Service_Facts
 - name: Flush Handlers
   ansible.builtin.meta: flush_handlers
-- name: Post Verification Package Discovery
-  when:
-    - ensure_os_upgrade is defined
-    - ensure_os_upgrade.package_list is defined
-    - ensure_os_upgrade.package_list is iterable
-  ansible.builtin.package_facts:
-- name: Assert Managed Packages Are Installed
-  when:
-    - ensure_os_upgrade is defined
-    - ensure_os_upgrade.package_list is defined
-    - ensure_os_upgrade.package_list is iterable
-  ansible.builtin.assert:
-    fail_msg: "Package {{ item.name }} is not installed"
-    quiet: true
-    that:
-      - item.state != 'present' or ansible_facts['packages'][item.name] is defined
-  loop: "{{ ensure_os_upgrade.package_list }}"
-  loop_control:
-    label: "{{ item.name }} will be verified"

roles/ensure_podman/tasks/main.yml

@@ -84,27 +84,3 @@
   ansible.builtin.reboot:
 - name: Flush Handlers
   ansible.builtin.meta: flush_handlers
-- name: Post Verification Service Discovery
-  when:
-    - ensure_podman is defined
-    - ensure_podman.service_list is defined
-    - ensure_podman.service_list is iterable
-  ansible.builtin.service_facts:
-- name: Assert Managed Services Are Active
-  when:
-    - ensure_podman is defined
-    - ensure_podman.service_list is defined
-    - ensure_podman.service_list is iterable
-  ansible.builtin.assert:
-    fail_msg: "Service {{ item.name }} is not active"
-    quiet: true
-    that:
-      - >-
-        item.state != 'started' or
-        (ansible_facts['services'][item.name ~ '.service'] is defined and
-        ansible_facts['services'][item.name ~ '.service']['state'] == 'running') or
-        (ansible_facts['services'][item.name] is defined and
-        ansible_facts['services'][item.name]['state'] == 'running')
-  loop: "{{ ensure_podman.service_list }}"
-  loop_control:
-    label: "{{ item.name }} will be verified"

roles/ensure_postfix/tasks/main.yml

@@ -150,27 +150,3 @@
   notify: [Ensure_Postfix.Package_Facts, Ensure_Postfix.Service_Facts]
 - name: Flush Handlers
   ansible.builtin.meta: flush_handlers
-- name: Post Verification Service Discovery
-  when:
-    - ensure_postfix is defined
-    - ensure_postfix.service_list is defined
-    - ensure_postfix.service_list is iterable
-  ansible.builtin.service_facts:
-- name: Assert Managed Services Are Active
-  when:
-    - ensure_postfix is defined
-    - ensure_postfix.service_list is defined
-    - ensure_postfix.service_list is iterable
-  ansible.builtin.assert:
-    fail_msg: "Service {{ item.name }} is not active"
-    quiet: true
-    that:
-      - >-
-        item.state != 'started' or
-        (ansible_facts['services'][item.name ~ '.service'] is defined and
-        ansible_facts['services'][item.name ~ '.service']['state'] == 'running') or
-        (ansible_facts['services'][item.name] is defined and
-        ansible_facts['services'][item.name]['state'] == 'running')
-  loop: "{{ ensure_postfix.service_list }}"
-  loop_control:
-    label: "{{ item.name }} will be verified"

roles/ensure_repo_epel/tasks/main.yml

@@ -100,22 +100,3 @@
     create: false
 - name: Flush Handlers
   ansible.builtin.meta: flush_handlers
-- name: Post Verification Package Discovery
-  when:
-    - ensure_repo_epel is defined
-    - ensure_repo_epel.package_list is defined
-    - ensure_repo_epel.package_list is iterable
-  ansible.builtin.package_facts:
-- name: Assert Managed Packages Are Installed
-  when:
-    - ensure_repo_epel is defined
-    - ensure_repo_epel.package_list is defined
-    - ensure_repo_epel.package_list is iterable
-  ansible.builtin.assert:
-    fail_msg: "Package {{ item.name }} is not installed"
-    quiet: true
-    that:
-      - item.state != 'present' or ansible_facts['packages'][item.name] is defined
-  loop: "{{ ensure_repo_epel.package_list }}"
-  loop_control:
-    label: "{{ item.name }} will be verified"

roles/ensure_repo_rpmfusion/tasks/main.yml

@@ -72,22 +72,3 @@
     - Ensure_Repo_Rpmfusion.Service_Facts
 - name: Flush Handlers
   ansible.builtin.meta: flush_handlers
-- name: Post Verification Package Discovery
-  when:
-    - ensure_repo_rpmfusion is defined
-    - ensure_repo_rpmfusion.package_list is defined
-    - ensure_repo_rpmfusion.package_list is iterable
-  ansible.builtin.package_facts:
-- name: Assert Managed Packages Are Installed
-  when:
-    - ensure_repo_rpmfusion is defined
-    - ensure_repo_rpmfusion.package_list is defined
-    - ensure_repo_rpmfusion.package_list is iterable
-  ansible.builtin.assert:
-    fail_msg: "Package {{ item.name }} is not installed"
-    quiet: true
-    that:
-      - item.state != 'present' or ansible_facts['packages'][item.name] is defined
-  loop: "{{ ensure_repo_rpmfusion.package_list }}"
-  loop_control:
-    label: "{{ item.name }} will be verified"

roles/ensure_rsync/tasks/main.yml

@@ -130,22 +130,3 @@
     - Ensure_Rsync.Service_Restart
 - name: Flush Handlers
   ansible.builtin.meta: flush_handlers
-- name: Post Verification Package Discovery
-  when:
-    - ensure_rsync is defined
-    - ensure_rsync.package_list is defined
-    - ensure_rsync.package_list is iterable
-  ansible.builtin.package_facts:
-- name: Assert Managed Packages Are Installed
-  when:
-    - ensure_rsync is defined
-    - ensure_rsync.package_list is defined
-    - ensure_rsync.package_list is iterable
-  ansible.builtin.assert:
-    fail_msg: "Package {{ item.name }} is not installed"
-    quiet: true
-    that:
-      - item.state != 'present' or ansible_facts['packages'][item.name] is defined
-  loop: "{{ ensure_rsync.package_list }}"
-  loop_control:
-    label: "{{ item.name }} will be verified"

roles/ensure_timezone/tasks/main.yml

@@ -128,27 +128,3 @@
     label: '{{ item.name }} will be {{ item.state }}'
 - name: Flush Handlers
   ansible.builtin.meta: flush_handlers
-- name: Post Verification Service Discovery
-  when:
-    - ensure_timezone is defined
-    - ensure_timezone.service_list is defined
-    - ensure_timezone.service_list is iterable
-  ansible.builtin.service_facts:
-- name: Assert Managed Services Are Active
-  when:
-    - ensure_timezone is defined
-    - ensure_timezone.service_list is defined
-    - ensure_timezone.service_list is iterable
-  ansible.builtin.assert:
-    fail_msg: "Service {{ item.name }} is not active"
-    quiet: true
-    that:
-      - >-
-        item.state != 'started' or
-        (ansible_facts['services'][item.name ~ '.service'] is defined and
-        ansible_facts['services'][item.name ~ '.service']['state'] == 'running') or
-        (ansible_facts['services'][item.name] is defined and
-        ansible_facts['services'][item.name]['state'] == 'running')
-  loop: "{{ ensure_timezone.service_list }}"
-  loop_control:
-    label: "{{ item.name }} will be verified"

roles/ensure_vim/tasks/main.yml

@@ -130,22 +130,3 @@
     - Ensure_Vim.Service_Restart
 - name: Flush Handlers
   ansible.builtin.meta: flush_handlers
-- name: Post Verification Package Discovery
-  when:
-    - ensure_vim is defined
-    - ensure_vim.package_list is defined
-    - ensure_vim.package_list is iterable
-  ansible.builtin.package_facts:
-- name: Assert Managed Packages Are Installed
-  when:
-    - ensure_vim is defined
-    - ensure_vim.package_list is defined
-    - ensure_vim.package_list is iterable
-  ansible.builtin.assert:
-    fail_msg: "Package {{ item.name }} is not installed"
-    quiet: true
-    that:
-      - item.state != 'present' or ansible_facts['packages'][item.name] is defined
-  loop: "{{ ensure_vim.package_list }}"
-  loop_control:
-    label: "{{ item.name }} will be verified"