fix(docs+menu): purge all invented category references; wire 7-category dispatch

- README.md, docs/validation/*, docs/reference/environment-checker.md:
  remove all references to cut categories (10=SSL, 11=squatter, 12=hardware,
  6=infra-device, 7=Service Bus, 8=NTP-UDP); replace with grounded 7-category set
- mkdocs.yml: fix site_description (remove "hardware") + fix site_url to azurelocal.cloud
- Start-AzlBeacon.ps1: update all Invoke-ValidationEngine category arrays to 7-
  category numbering; remove ipPool prompts + squatter references from Local
  Identity and Network/Firewall menu paths

Zero invented-test references remain in src/ or docs/.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013AZySkzowyq4Ne2hrSRRAL

Author: kristopherjturner

README.md

@@ -1,6 +1,6 @@
 # AzL Beacon
 
-**Pre-deployment endpoint, network, and hardware readiness validation for Azure Local.**
+**Pre-deployment endpoint and network readiness validation for Azure Local.**
 
 Boots from iDRAC Virtual Media or USB — no installed OS, no domain join, no licensing required.
 Boot it on bare metal before you touch the deployment wizard. Know your environment is ready.
@@ -9,22 +9,17 @@ Boot it on bare metal before you touch the deployment wizard. Know your environm
 
 ## What it does
 
-On boot, `Start-AzlValidation.ps1` runs automatically and sweeps 12 validation categories:
+On boot, `Start-AzlValidation.ps1` runs 7 validation categories grounded in Microsoft and Dell source documents:
 
 | # | Category | What it checks |
 |---|---|---|
 | 1 | Basic network | NIC up, IP assigned, gateway reachable |
 | 2 | DNS | Forward/reverse lookups, TCP/UDP port 53, AD domain resolution |
 | 3 | NTP | w32tm stripchart + clock skew check (5-minute limit) |
-| 4 | Active Directory ports | LDAP 389, LDAPS 636, Kerberos 88, RPC 135, DNS 53, SRV records |
-| 5 | Azure endpoint sweep | TCP + HTTPS probe for 120+ Arc, AKS, auth, monitoring, CRL endpoints |
-| 6 | Infrastructure devices | Firewall, switches, iDRAC, OpenGear reachability |
-| 7 | Service Bus WebSocket | TCP 443 to `*.servicebus.windows.net` (Arc resource bridge) |
-| 8 | NTP UDP 123 | Raw UDP NTP packet probe |
-| 9 | Environment Checker | Microsoft's `Invoke-AzStackHciConnectivityValidation` (official validator) |
-| 10 | SSL inspection | Cert chain root authority — detects FortiGate deep inspection (deployment blocker) |
-| 11 | Deployment prerequisites | IP pool squatter scan, DNS-not-in-K8s-range sanity check |
-| 12 | Hardware self-checks | TPM 2.0, Secure Boot, disk count, storage pools, NIC count, CPU virt, memory |
+| 4 | Active Directory ports | LDAP 389, LDAPS 636, Kerberos 88, RPC 135, DNS 53, SRV records (AD path only) |
+| 5 | Azure endpoint sweep | TCP + HTTPS probe — Azure Local firewall requirements + EastUS HCI + Dell OEM endpoints |
+| 6 | Environment Checker | `Invoke-AzStackHciConnectivityValidation` + `Invoke-AzStackHciNetworkValidation` (Microsoft's official validators) |
+| 7 | Arc integration | `Invoke-AzStackHciArcIntegrationValidation` (optional — requires Azure device-code sign-in) |
 
 Results land at `X:\results\` on the WinPE RAM drive in JSON format. Copy off before reboot.
 

docs/reference/environment-checker.md

@@ -12,10 +12,9 @@ AzL Beacon bundles and calls the Microsoft `AzStackHci.EnvironmentChecker` Power
 
 | Validator | Cmdlet | When called |
 |---|---|---|
-| Connectivity | `Invoke-AzStackHciConnectivityValidation` | Category 9, all paths |
-| Network | `Invoke-AzStackHciNetworkValidation` | Category 9, Local Identity path |
-| Hardware | `Invoke-AzStackHciHardwareValidation` | Category 12 (partial — CIM-based) |
-| Arc integration | `Invoke-AzStackHciArcIntegrationValidation` | Optional — requires Azure sign-in |
+| Connectivity | `Invoke-AzStackHciConnectivityValidation` | Category 6, all paths |
+| Network | `Invoke-AzStackHciNetworkValidation` | Category 6, all paths |
+| Arc integration | `Invoke-AzStackHciArcIntegrationValidation` | Category 7 — optional, requires Azure sign-in |
 
 ## WinPE limitations
 
@@ -25,9 +24,8 @@ The following validators **cannot run in WinPE** and are deferred to post-OS (St
 |---|---|---|
 | Active Directory | Requires RSAT AD/GPO modules | Run `Invoke-AzStackHciExternalActiveDirectoryValidation` from a domain-joined staging server |
 
-## SSL inspection behavior
-
-The Environment Checker detects SSL deep-inspection before testing connectivity. If the TLS chain contains a private/unknown root CA, `Invoke-AzStackHciConnectivityValidation` raises an error and aborts. Beacon's Category 10 (SSL inspection detection) runs the same check independently so you know before invoking the module.
+!!! warning "SSL inspection — note"
+    `Invoke-AzStackHciConnectivityValidation` raises an error if it detects SSL deep-inspection (private root CA in the TLS chain). If you see this failure, work with your network team to exempt Azure Local node IPs from SSL inspection before re-running.
 
 ## Post-OS environment checker (Stage 2)
 

docs/validation/active-directory.md

@@ -20,8 +20,9 @@ Select **option 1** from the Beacon main menu to validate readiness for an AD-jo
 | **2 — DNS** | DNS TCP/UDP 53 reachability, forward resolution of Azure endpoints and AD domain FQDN, reverse lookups of DC IPs |
 | **3 — NTP** | Clock skew check (must be < 5 minutes) |
 | **4 — AD ports** | TCP probe per DC: LDAP 389, Kerberos 88, RPC 135, DNS 53, LDAPS 636; DNS SRV `_ldap._tcp.dc._msdcs.<domain>` |
-| **5 — Endpoint sweep** | All 121 Azure Local + Arc + Dell endpoints (TCP + HTTPS for critical) |
-| **9 — EnvChecker** | `Invoke-AzStackHciConnectivityValidation` (Microsoft's connectivity validator) |
+| **5 — Endpoint sweep** | Azure Local + Arc + Dell endpoints (TCP + HTTPS for critical) |
+| **6 — EnvChecker** | `Invoke-AzStackHciConnectivityValidation` + `Invoke-AzStackHciNetworkValidation` |
+| **7 — Arc** | Optional: `Invoke-AzStackHciArcIntegrationValidation` (requires Azure device-code sign-in) |
 
 ## Active Directory preparation requirements
 

docs/validation/index.md

@@ -27,19 +27,20 @@ AzL Beacon presents a **split menu** at boot. Choose the path that matches your
   └─────────────────────────────────────────────────────┘
 ```
 
-## All 12 validation categories
+## 7 validation categories
 
 | Category | Name | Paths |
 |---|---|---|
 | 1 | Basic network connectivity (NIC, IP, gateway) | All |
-| 2 | DNS (forward/reverse/UDP) | All |
+| 2 | DNS (forward/reverse/TCP/UDP) | All |
 | 3 | NTP time-skew | All |
 | 4 | Active Directory ports (LDAP/Kerberos/RPC/DNS/LDAPS + SRV) | AD, Full-AD |
-| 5 | Azure endpoint sweep (121 endpoints) | All |
-| 6 | Infrastructure device reachability | Networking, Full |
-| 7 | Service Bus WebSocket probe | Networking, Full |
-| 8 | NTP UDP port 123 | Networking, Full |
-| 9 | AzStackHci.EnvironmentChecker (connectivity + network validators) | All |
-| 10 | SSL deep-inspection detection | All |
-| 11 | Deployment prerequisite sanity (IP pool, Kubernetes subnet) | Local Identity, Full |
-| 12 | Hardware self-checks (TPM, Secure Boot, NIC, CPU, storage) | Networking, Full |
+| 5 | Azure endpoint sweep | All |
+| 6 | AzStackHci.EnvironmentChecker (connectivity + network validators) | All |
+| 7 | Arc integration (optional — requires Azure device-code login) | Optional on all paths |
+
+All test targets derive from the three Microsoft/Dell source documents:
+
+- [Azure Local firewall requirements](https://github.com/MicrosoftDocs/azure-stack-docs/blob/main/azure-local/concepts/firewall-requirements.md)
+- [EastUS HCI endpoints](https://github.com/Azure/AzureStack-Tools/blob/master/HCI/EastUSendpoints/eastus-hci-endpoints.md)
+- [Dell OEM endpoints](https://github.com/Azure/AzureStack-Tools/blob/master/HCI/OEMEndpoints/Dell/DellAzureLocalEndpoints.md)

docs/validation/local-identity.md

@@ -26,8 +26,6 @@ Local Identity deployment uses a local administrator account and Azure Key Vault
 |---|---|---|
 | DNS server IP(s) | `10.10.0.10, 8.8.8.8` | Yes |
 | Azure Key Vault FQDN | `kv-iic-beacon.vault.azure.net` | Optional (enables KV endpoint probe) |
-| Node IP pool start | `10.10.1.100` | Optional (enables squatter scan) |
-| Node IP pool end | `10.10.1.120` | Optional |
 
 ## Tests run
 
@@ -37,10 +35,8 @@ Local Identity deployment uses a local administrator account and Azure Key Vault
 | **2 — DNS** | DNS TCP/UDP 53, forward resolution of Azure management endpoints |
 | **3 — NTP** | Clock skew |
 | **5 — Endpoint sweep** | Azure Local, Arc, and Key Vault service endpoints |
-| **9 — EnvChecker** | `Invoke-AzStackHciConnectivityValidation` + `Invoke-AzStackHciNetworkValidation` |
-| **10 — SSL inspection** | TLS chain root-CA check (FortiGate detection) |
-| **11 — Prereq sanity** | IP pool squatter scan, DNS-not-in-Kubernetes-reserved-range check |
-| **Key Vault** | Manual TCP 443 probe to the Key Vault FQDN (if provided) |
+| **6 — EnvChecker** | `Invoke-AzStackHciConnectivityValidation` + `Invoke-AzStackHciNetworkValidation` |
+| **7 — Arc** | Optional: `Invoke-AzStackHciArcIntegrationValidation` |
 
 !!! note "Category 4 (AD ports) is skipped"
     AD port tests are not applicable and not run in the Local Identity path.

docs/validation/network-firewall.md

@@ -8,17 +8,25 @@ This path runs everything except the AD port tests (Category 4). It's ideal for:
 
 - Verifying firewall policy before any identity configuration
 - Checking endpoint reachability from the management VLAN
-- Detecting SSL deep-inspection on the outbound path
-- Hardware self-checks (TPM, Secure Boot, NICs)
+- Confirming DNS and NTP are reachable
 
 ## What you are prompted for
 
 | Input | Example | Required |
 |---|---|---|
 | Management gateway IP | `10.10.0.1` | Optional (uses DHCP-detected if blank) |
 | DNS server IP(s) | `10.10.0.10` | Optional |
-| IP pool start | `10.10.1.100` | Optional (enables squatter scan) |
-| IP pool end | `10.10.1.120` | Optional |
+
+## Tests run
+
+| Category | Tests |
+|---|---|
+| **1 — Network** | NIC status, IP assigned, gateway ping |
+| **2 — DNS** | DNS TCP/UDP 53, forward resolution of key Azure endpoints |
+| **3 — NTP** | Clock skew (must be < 5 minutes) |
+| **5 — Endpoint sweep** | All Azure Local + Arc + Dell endpoints |
+| **6 — EnvChecker** | `Invoke-AzStackHciConnectivityValidation` + `Invoke-AzStackHciNetworkValidation` |
+| **7 — Arc** | Optional |
 
 ## Firewall requirements — Azure Local
 
@@ -33,20 +41,7 @@ The endpoint sweep tests all endpoints from these sources:
 !!! tip "See the full list"
     See [Endpoint List](../reference/endpoints.md) for every endpoint tested.
 
-## SSL deep-inspection detection
-
-Category 10 detects **FortiGate SSL deep inspection** (or any transparent proxy that re-signs TLS). Azure Local **cannot deploy** through an SSL inspection device because the TLS certificate chain will not match Microsoft's expected root CAs.
-
-If Category 10 fails:
-
-1. Work with your network team to create a firewall bypass/exemption for Azure Local node IPs
-2. Verify the exemption: Beacon re-runs Category 10 and should show the correct DigiCert/Microsoft root
-
-## Kubernetes reserved subnets
-
-Category 11 checks that your planned IP pool does not overlap with Kubernetes-reserved ranges:
-
-- `10.96.0.0/12` — Kubernetes service CIDR
-- `10.244.0.0/16` — Pod network CIDR
+## Microsoft documentation
 
-DNS server IPs must also not fall within these ranges.
+- [Azure Local firewall requirements](https://learn.microsoft.com/azure/azure-local/concepts/firewall-requirements)
+- [Azure Arc network requirements](https://learn.microsoft.com/azure/azure-arc/servers/network-requirements)

mkdocs.yml

@@ -1,7 +1,7 @@
 site_name: AzL Beacon
-site_description: Pre-deployment endpoint, network, and hardware readiness validation for Azure Local.
+site_description: Pre-deployment endpoint and network readiness validation for Azure Local.
 site_author: Azure Local Cloud
-site_url: https://azurelocal.github.io/azurelocal-beacon/
+site_url: https://azurelocal.cloud/azurelocal-beacon/
 repo_url: https://github.com/AzureLocal/azurelocal-beacon
 repo_name: AzureLocal/azurelocal-beacon
 

src/Start-AzlBeacon.ps1

@@ -129,7 +129,7 @@ function Show-Banner {
     Write-BeaconLine '    Azure Local Pre-Deployment Validation' -Color White
     Write-BeaconLine '    v1.0.0-pre  |  Dell AX 16G  |  HCS Platform' -Color DarkGray
     Write-BeaconLine ''
-    Write-BeaconLine '    Pre-deployment endpoint, network, and hardware' -Color DarkGray
+    Write-BeaconLine '    Pre-deployment endpoint and network' -Color DarkGray
     Write-BeaconLine '    readiness validation for Azure Local.' -Color DarkGray
     Write-BeaconLine ''
 }
@@ -221,8 +221,8 @@ function Invoke-ADMenu {
     Write-BeaconLine '  Running Active Directory validation (Categories 1-4 + Connectivity)...' -Color Cyan
     Write-BeaconLine ''
 
-    # Categories: 1=Network, 2=DNS, 3=NTP, 4=AD ports, 5=Endpoint sweep, 9=EnvChecker(connectivity)
-    Invoke-ValidationEngine -Categories @('1', '2', '3', '4', '5', '9')
+    # Categories: 1=Network, 2=DNS, 3=NTP, 4=AD ports, 5=Endpoint sweep, 6=EnvChecker, 7=Arc(optional)
+    Invoke-ValidationEngine -Categories @('1', '2', '3', '4', '5', '6')
 
     Write-BeaconLine ''
     Write-BeaconLine '  AD validation complete. Results in X:\results\' -Color Green
@@ -248,26 +248,18 @@ function Invoke-LocalIdentityMenu {
     $kvFqdn     = Prompt-Optional 'Azure Key Vault FQDN (e.g. kv-beacon-01.vault.azure.net)' -Default ''
     Write-BeaconLine ''
 
-    $ipPoolStart = Prompt-Optional 'Planned node IP pool start (for squatter scan, optional)'
-    $ipPoolEnd   = Prompt-Optional 'Planned node IP pool end  (for squatter scan, optional)'
-    Write-BeaconLine ''
-
-    Write-BeaconLine '  Running Local Identity validation (Categories 1-3, 5, 9-11)...' -Color Cyan
+    Write-BeaconLine '  Running Local Identity validation (Categories 1-3, 5-6)...' -Color Cyan
     Write-BeaconLine '  Skipping AD port tests (Category 4) — not needed for Local Identity.' -Color DarkGray
     Write-BeaconLine ''
 
     $overrides = @{
         dnsServers    = $dnsServers
         adDomainFqdn  = ''   # Not needed — suppresses DNS domain lookup in Cat-2
     }
-    if ($ipPoolStart -and $ipPoolEnd) {
-        $overrides['ipPoolStart'] = $ipPoolStart
-        $overrides['ipPoolEnd']   = $ipPoolEnd
-    }
     Write-ValidationConfigOverrides -Overrides $overrides
 
-    # Categories: 1=Network, 2=DNS, 3=NTP, 5=Endpoint sweep, 9=EnvChecker(connectivity), 10=SSL, 11=Prereq sanity
-    Invoke-ValidationEngine -Categories @('1', '2', '3', '5', '9', '10', '11')
+    # Categories: 1=Network, 2=DNS, 3=NTP, 5=Endpoint sweep, 6=EnvChecker(connectivity+network), 7=Arc(optional)
+    Invoke-ValidationEngine -Categories @('1', '2', '3', '5', '6')
 
     # Key Vault endpoint check — manual TCP probe if FQDN provided
     if ($kvFqdn) {
@@ -306,31 +298,24 @@ function Invoke-LocalIdentityMenu {
 function Invoke-NetworkFirewallMenu {
     Write-BeaconHeader 'Networking and Firewall Validation'
     Write-BeaconLine '  Validates physical network, endpoint reachability (Azure Local + Arc + Dell),' -Color White
-    Write-BeaconLine '  SSL deep-inspection detection, IP-pool squatter scan, and hardware.' -Color White
+    Write-BeaconLine '  DNS, NTP, and the Microsoft Environment Checker.' -Color White
     Write-BeaconLine ''
 
     $gwIp       = Prompt-Optional 'Management gateway IP (leave blank to use DHCP-detected)'
     $dnsRaw     = Prompt-Optional 'DNS server IP(s) — comma-separated (leave blank to use current)'
     $dnsServers = if ($dnsRaw) { @($dnsRaw -split ',' | ForEach-Object { $_.Trim() } | Where-Object { $_ -ne '' }) } else { @() }
     Write-BeaconLine ''
-    $ipPoolStart = Prompt-Optional 'IP pool start for squatter scan (optional)'
-    $ipPoolEnd   = Prompt-Optional 'IP pool end   for squatter scan (optional)'
-    Write-BeaconLine ''
 
     $overrides = @{}
     if ($gwIp)                    { $overrides['managementGateway'] = $gwIp }
     if ($dnsServers.Count -gt 0)  { $overrides['dnsServers']        = $dnsServers }
-    if ($ipPoolStart -and $ipPoolEnd) {
-        $overrides['ipPoolStart'] = $ipPoolStart
-        $overrides['ipPoolEnd']   = $ipPoolEnd
-    }
     if ($overrides.Count -gt 0) { Write-ValidationConfigOverrides -Overrides $overrides }
 
-    Write-BeaconLine '  Running Networking/Firewall validation (Categories 1-3, 5-12)...' -Color Cyan
+    Write-BeaconLine '  Running Networking/Firewall validation (Categories 1-3, 5-6)...' -Color Cyan
     Write-BeaconLine ''
 
     # All categories except Cat-4 (AD ports — not relevant for a network-focused run)
-    Invoke-ValidationEngine -Categories @('1', '2', '3', '5', '6', '7', '8', '9', '10', '11', '12')
+    Invoke-ValidationEngine -Categories @('1', '2', '3', '5', '6')
 
     Write-BeaconLine ''
     Write-BeaconLine '  Networking and Firewall validation complete. Results in X:\results\' -Color Green
@@ -377,8 +362,8 @@ Invoke-AzStackHciArcIntegrationValidation ``
 #region  ── Full Sweep ──
 
 function Invoke-FullSweep {
-    Write-BeaconHeader 'Full Readiness Sweep — All Categories'
-    Write-BeaconLine '  Runs all 12 validation categories plus the Microsoft Environment Checker.' -Color White
+    Write-BeaconHeader 'Full Readiness Sweep — All 7 Categories'
+    Write-BeaconLine '  Runs all 7 validation categories including the Microsoft Environment Checker.' -Color White
     Write-BeaconLine '  Choose deployment path to include the correct identity tests:' -Color DarkGray
     Write-BeaconLine ''
     Write-BeaconLine '    A) Active Directory (includes Category 4 AD port tests)' -Color White
@@ -390,10 +375,10 @@ function Invoke-FullSweep {
 
     $sweepCategories = if ($pathChoice -eq 'L' -or $pathChoice -eq 'l') {
         Write-BeaconLine '  Running full sweep — Local Identity path (skipping AD port tests)...' -Color Cyan
-        @('1', '2', '3', '5', '6', '7', '8', '9', '10', '11', '12')
+        @('1', '2', '3', '5', '6', '7')
     } else {
         Write-BeaconLine '  Running full sweep — Active Directory path (all categories)...' -Color Cyan
-        @('1', '2', '3', '4', '5', '6', '7', '8', '9', '10', '11', '12')
+        @('1', '2', '3', '4', '5', '6', '7')
     }
 
     Write-BeaconLine ''