From cce11b259133e4c26d2352e3ecef1a3693239bc2 Mon Sep 17 00:00:00 2001 From: Pieter Viljoen Date: Sun, 9 Aug 2026 11:11:04 -0700 Subject: [PATCH 1/3] Drop a count that only stayed true by being dated The HUGO_BASEURL item said a wrong base URL would have run 1,245 requests at the live site. That was the live check size on 2026-08-07 and the sentence is a counterfactual about that day, so it was defensible, and leaving it meant a reader validating a deploy met 1,245 and 1,253 in one file with nothing connecting them. The number was never load-bearing there. The point is that the check would have been aimed at the old platform, which the sentence makes without it. Same reasoning as removing the duplicated release id: a value that has to be dated to stay true is better removed than dated, because the next reader has no way to know which vintage they are holding. Found by Copilot review on #83, as a suppressed comment, having been declined once on the grounds that the counterfactual was accurate. Co-Authored-By: Claude Opus 5 (1M context) --- TODO.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/TODO.md b/TODO.md index 7628b51..86634c0 100644 --- a/TODO.md +++ b/TODO.md @@ -31,7 +31,7 @@ The site is built, gated in CI, and deployed to staging by pipeline. It is not y - **Prove a rollback through the pipeline.** A forced mid-deploy failure, then a flip back to the previous release, verified by `EXPECT_RELEASE` rather than by the transport exiting zero. The server side has been measured at well under a second by hand; what is unproven is that a **pipeline** run leaves the site serving when its deploy fails part way. - **Production is deployed, which the VPS agent calls M7a, done 2026-08-08.** `blog.insanegenius.net` answers `200` unauthenticated on a Let's Encrypt certificate issued 2026-08-07, with the serving release read from the `X-Blog-Release` header rather than from a pipeline's exit code. **M7a itself was `20260808-154717`. What it serves today is in the State table above and is deliberately not repeated here**, since a release id moves with every deploy and a second copy of it goes stale by the afternoon. The host side verified that first production release independently, 9/9 unauthenticated with the built `baseURL` read from the deployed bytes rather than from this repo's config, across a 3,095-request gate run with no unexplained 404s. What remains is **M7b, the `.com` cutover**, and the sub-items below are where this repo stands against it, two of them owed and one already answered. The VPS agent's §19, §20, §23 and §24 carry the detail and that file is not in the repository, so pull it first per [`OPERATIONS.md`](./OPERATIONS.md) "The Channel Between the Two Sides": - - **`HUGO_BASEURL` on the `production` environment is set to `https://blog.insanegenius.net/`**, done 2026-08-07. It held `https://blog.insanegenius.com/`, the live WordPress address, which is what the workflow both builds with and points the live check at, so a deploy would have baked the old platform's address into every canonical tag, feed link and `sitemap.xml` and then run 1,245 requests at the live site to verify it. **Setting it back to `.com` at M7b is the other half and is not done.** + - **`HUGO_BASEURL` on the `production` environment is set to `https://blog.insanegenius.net/`**, done 2026-08-07. It held `https://blog.insanegenius.com/`, the live WordPress address, which is what the workflow both builds with and points the live check at, so a deploy would have baked the old platform's address into every canonical tag, feed link and `sitemap.xml` and then run the whole live check at the live site to verify it. **Setting it back to `.com` at M7b is the other half and is not done.** - **Production emits `X-Robots-Tag: noindex, nofollow` for the length of the rehearsal**, deliberately, because `.net` serves a public duplicate of a live site and Certificate Transparency publishes the hostname. Where a check asserts `index, follow`, make the expected value a parameter rather than flipping a literal, since it reverts at M7b and a hardcoded literal is one more thing to remember at the wrong moment. - **The two questions in §19.3 are answered.** `HUGO_BASEURL` holds the interim `.net` name, per the item above. Exactly one place hardcodes `blog.insanegenius.com`: `baseURL` on line 1 of `hugo.yaml`, which is the production default every environment overrides through `HUGO_BASEURL`. Nothing under `checks/`, `deploy/`, `layouts/`, or `.github/` carries it. - **`robots.txt` is decided, built, and deployed, 2026-08-08.** The site emits one, `enableRobotsTXT` is set, and the theme's template derives the `Sitemap:` line from the built `baseURL`, so it names `.net` during the rehearsal and `.com` after the cutover with nothing to remember at M7b. `/robots.txt/` redirects to the real file rather than to the home page, and `check-url-parity.py` gates all of it. Verified from the served bytes on release `20260808-154717`: `/robots.txt` answers 200 advertising `https://blog.insanegenius.net/sitemap.xml`, `/robots.txt/` 301s to it, and `sitemap.xml` carries 312 `.net` URLs and zero `.com`. The record below is kept because the reasoning is what the next decision about crawl directives will need. From 082ef785307fcb496471e48e0eb939cc45e8da27 Mon Sep 17 00:00:00 2001 From: Pieter Viljoen Date: Sun, 9 Aug 2026 11:15:32 -0700 Subject: [PATCH 2/3] Stop the live check miscounting itself in its own comments Two comments said the script runs 1,245 requests. It runs 1,253: the 1,245-URL contract plus the eight media probes added when the live media check landed. The file describing what it does was the last thing to know what it does. Neither states a number now. One says it runs one request per URL checked and the other says one request before the rest, which is what each comment was actually about, and neither goes stale when a list grows. The three other occurrences in the repository are correct and are left alone. 1,245 is the URL contract, 328 render plus 917 redirect, and 1,253 is what the live check requests because it adds eight media URLs. The blog post contrasting 1,245 with the sitemap 111, the audit report quoting a 2026-08-04 run, and the parity note about a build baked with the wrong host all mean the contract and all say so correctly. Found by Copilot review on #85, which caught the PR description claiming 1,245 appeared nowhere when it had only been grepped out of two files. Co-Authored-By: Claude Opus 5 (1M context) --- checks/check-live-urls.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/checks/check-live-urls.sh b/checks/check-live-urls.sh index e37f12d..497ff6a 100755 --- a/checks/check-live-urls.sh +++ b/checks/check-live-urls.sh @@ -114,7 +114,7 @@ echo "==> tagging requests X-Blog-Check: $CHECK_TAG" # A resource access token opens the proxy's auth gate. # It goes into a curl config file because bash cannot export an array to the parallel checks. -# A command line is also world-readable in ps output, and this runs 1,245 of them. +# A command line is also world-readable in ps output, and this runs one per URL checked. if [ -n "${PANGOLIN_ACCESS_TOKEN_ID:-}" ] && [ -n "${PANGOLIN_ACCESS_TOKEN:-}" ]; then # Same hazard as CHECK_TAG above and the same reason, but a narrower rule, because the # grammar of a credential is the issuer's to define and not this script's. Only the @@ -269,7 +269,7 @@ export BASE FAILED CURLRC CHECKRC echo "==> $BASE" -# One request before the 1,245, because an auth gate turns a bad credential into a total failure. +# One request before the rest, because an auth gate turns a bad credential into a total failure. # Otherwise the output reads as a vanished site rather than a wrong token. # Transport failures are separated from HTTP ones, since a name that does not resolve otherwise # reports as a status code and gets diagnosed as a credential or a symlink. From ee0d7f3973b6744d9430addfdfcd0394fb9ee20e Mon Sep 17 00:00:00 2001 From: Pieter Viljoen Date: Sun, 9 Aug 2026 11:18:16 -0700 Subject: [PATCH 3/3] Say every request carries it, since a URL is not one request The comment claimed one invocation per URL checked. A render check is one curl, a redirect check is three, and the media check reaches six, so the count was wrong in the direction that understates the exposure the comment exists to explain. It now says every request would carry the token, which is the actual reason the credential goes in a config file rather than on a command line, and which no list or code path can make stale. Found by Copilot review on #85, as a suppressed comment, on wording I had introduced one commit earlier to remove a different stale count. Co-Authored-By: Claude Opus 5 (1M context) --- checks/check-live-urls.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/checks/check-live-urls.sh b/checks/check-live-urls.sh index 497ff6a..feb66b3 100755 --- a/checks/check-live-urls.sh +++ b/checks/check-live-urls.sh @@ -114,7 +114,7 @@ echo "==> tagging requests X-Blog-Check: $CHECK_TAG" # A resource access token opens the proxy's auth gate. # It goes into a curl config file because bash cannot export an array to the parallel checks. -# A command line is also world-readable in ps output, and this runs one per URL checked. +# A command line is also world-readable in ps output, and every request would carry it. if [ -n "${PANGOLIN_ACCESS_TOKEN_ID:-}" ] && [ -n "${PANGOLIN_ACCESS_TOKEN:-}" ]; then # Same hazard as CHECK_TAG above and the same reason, but a narrower rule, because the # grammar of a credential is the issuer's to define and not this script's. Only the