---
# verify-refresh.yaml — Install/refresh Goss, run assertions, fetch TAP.
#
# This is a host-mutating operation. Review the rendered baseline and use it
# only when updating the verification surface. Routine verification and the S1
# handoff use the read-only verify.yaml playbook.

- name: Refresh and verify the managed Goss surface
  hosts: all
  become: true
  gather_facts: true
  vars_files:
    - ../inventory/group_vars/all.yaml
  roles:
    - role: goss