update check active

agent/README.md

@@ -88,4 +88,28 @@ APT components use a fixed manifest contract and never accept shell commands:
 }
 ```
 
-The package name must be present in `ALLOWED_APT_PACKAGES` (default: `postgresql`). For PostgreSQL, the Agent refreshes the APT index, installs the distro package non-interactively, verifies `postgresql.service`, and waits for `pg_isready` before completing the task.
+The package name must be present in `ALLOWED_APT_PACKAGES` (default: `postgresql`). After installation, the Agent discovers concrete systemd `.service` units shipped by the trusted package and reads their state with a fixed `systemctl show` argv (no shell command is accepted from the manifest or Web Client). The structured result is returned as `serviceCheckStatus` and `serviceChecks` from the task component API and is retained with the installed app for the UI.
+
+PostgreSQL keeps an additional trusted policy: the Agent enables and starts `postgresql.service`, verifies that it is active, and waits for `pg_isready`. Other discovered package services are checked read-only; they are not blindly enabled or started because packages can ship optional or one-shot units.
+
+`GET /apps/installed` refreshes the current systemd state for retained service names. For the trusted PostgreSQL policy it also re-runs `pg_isready`, so the UI does not report a healthy meta-service while the database is unavailable.
+
+Example task component service result:
+
+```json
+{
+  "serviceCheckStatus": "healthy",
+  "serviceChecks": [
+    {
+      "serviceName": "postgresql.service",
+      "loadState": "loaded",
+      "activeState": "active",
+      "subState": "running",
+      "unitFileState": "enabled",
+      "healthy": true,
+      "readinessStatus": "ready",
+      "checkedAt": "2026-07-20T00:00:00Z"
+    }
+  ]
+}
+```