Staging Host and Runtime Validation Report

Status

Current implementation and validation report for IARPG-OPS-2 2.0.8-wip. The release remains work in progress.

Purpose

Record the isolated Apache staging deployment, defects discovered through real HTTP requests, corrective implementation, browser-fixture coverage, and the remaining evidence boundary for stable promotion.

Scope

This report covers the supplied 2.0.7-wip flat deployment and the resulting 2.0.8-wip candidate. It evaluates actual Apache rewrite and header behavior on an isolated local staging host, current source and fixture behavior, public discovery artifacts, and browser-rendered interaction fixtures. It does not claim production-host deployment, external search-engine inclusion, field Core Web Vitals, native Firefox execution, or native assistive-technology speech output.

Executive Summary

The 2.0.7-wip package was deployed to an isolated Apache 2.4 staging host with rewrite, headers, compression, PHP, and per-directory policy enabled. Real requests exposed five material defects that static rendering had not established: public pages started a PHP session and emitted a cookie plus no-cache headers; shared security headers were duplicated; direct query-driven PHP renderers did not redirect to their clean canonical routes; the temporary hosting diagnostic was publicly advertised and enabled by default; and three of five Round-Trip Laboratory choices silently loaded the wrong fixture body.

The 2.0.8-wip implementation starts sessions only for routes that require CSRF, flash, or gateway state; gives ordinary public pages a short public cache policy while keeping interactive routes private; normalizes shared server security headers; adds clean redirects for standard, mission, role, and report renderers plus non-directory trailing slashes; disables the hosting diagnostic unless a host operator explicitly sets an environment flag; removes that diagnostic from public navigation, search, and sitemap; and loads every round-trip fixture from its declared local source. An actual-host validator and a browser-fixture validator now make these checks repeatable.

The isolated Apache staging suite passes, including all sitemap routes, raw-companion noindex policy, internal-directory denial, compression, clean redirects, singular security headers, discovery artifacts, canonical HTML metadata, and session/cache separation. Current browser fixtures pass the published round-trip, responsive, high-zoom, menu, theme, blocked-storage, reduced-motion, forced-colors, print, and offline/no-network checks that can be exercised under the managed Chromium environment. Stable promotion remains blocked because unrestricted navigated Chromium, native Firefox, native assistive-technology speech output, production-host behavior, field performance, and live search-console or crawler-log evidence are not available.

Evidence Reviewed

• The complete 2.0.7-wip flat deployment, AGENTS.md, active .uai startup records, durable memory index, manifests, promotion gates, and current validators.
• Real HTTP responses from an isolated Apache 2.4 staging process using the package .htaccess rules and PHP runtime.
• Representative public, interactive, error, discovery, raw-companion, static-asset, canonical-redirect, and denied-path requests.
• Every route published by sitemap.xml.
• The five published records in roundtrip-fixtures.json and their local source bodies.
• Server-rendered HTML with current CSS and JavaScript executed in managed Chromium fixtures.
• The current release-promotion, accessibility, browser-runtime, performance, source, report, UAI, and checksum records.
• Machine-readable isolated Apache staging evidence and its human-readable companion.
• Machine-readable Chromium fixture evidence and its human-readable companion.

Findings

Session, privacy, and cache boundary

The prior bootstrap started a session on every request. Apache therefore returned a marketing-named session cookie and PHP's default no-store, no-cache, Expires, and Pragma headers even for ordinary public documents. Sessions now start lazily through ensuresession(), and the remaining route-specific cookie uses the neutral iarpgsession name. The play gateway and signup API explicitly start a session and remain private/no-store; ordinary publication pages send no cookie and use short public caching. This improves privacy, cacheability, and crawl efficiency without weakening CSRF or flash behavior.

Canonical routing and HTTP truth

Query-driven standard.php, mission.php, role.php, and docs/view.php requests now issue permanent redirects to the single clean public route. Non-directory clean routes with a trailing slash also redirect to their canonical form. Canonical URLs in the HTML remain rooted at https://iarpg.com, and the diagnostic route is absent from canonical discovery.

Security headers and protected paths

Apache and PHP previously emitted duplicate copies of several shared security headers. The server policy now removes overlap before setting one authoritative server copy, while PHP continues to provide the nonce-bearing Content Security Policy and cross-origin policies. .uai/ and application internals remain denied. Raw JSON, Markdown, UAI, and checksum companions remain retrievable where intended but carry X-Robots-Tag: noindex.

Operator-only hosting diagnostic

hosting-check.php is disabled by default and returns a noindex, no-store 404 unless the staging or hosting process explicitly sets IARPGENABLEHOSTING_CHECK=1. Public navigation, search, and sitemap no longer advertise it. Operators can temporarily enable it without placing a credential or secret in the deployment package.

Round-trip fixture integrity

The Round-Trip Laboratory previously used the embedded operation package for every fixture without an inline body. That made migration, merge, and backup selections misleading. The loader is now asynchronous and fetches each declared same-origin source, validates it with the strict canonical parser, preserves the current original when a load fails, and reports request errors without silent replacement. All five published fixture choices now load distinct intended artifacts and preserve every parsed path through normalization and reimport.

Browser and accessibility fixture coverage

Managed Chromium still blocks unrestricted navigation to local HTTP hosts, so the current harness uses server-rendered HTML with local release assets supplied to the fixture. Within that boundary it verifies the centered menu as the only sticky surface, mobile menu containment, keyboard dismissal and focus restoration, light default, stored dark initialization, blocked-storage fallback, storage-event synchronization, required viewport widths, high zoom, reduced motion, reduced transparency fallback, forced colors, print, and offline/no-network behavior. This is meaningful lab evidence but not native Firefox or native screen-reader speech evidence.

Search, answer, and generative discovery boundary

Sitemap, Atom, OpenSearch, answer catalog, robots.txt, and llms.txt are fetchable from isolated staging. HTML pages retain one H1, unique page metadata, canonical URLs, and parseable JSON-LD. Visible FAQ and machine answer parity remains locally validated. No claim is made that Google, Bing, generative systems, or other external services indexed, ranked, cited, or accepted the publication.

Decisions or Recommendations

1. Keep public page sessions lazy and route-specific; do not reintroduce a global session in the bootstrap.
2. Keep hosting-check.php operator-only, environment-gated, noindex, no-store, and absent from public discovery.
3. Run scripts/validatestaginghost.py against every production-matched staging deployment and preserve only sanitized aggregate evidence.
4. Run the full critical interaction matrix in unrestricted Chromium and native Firefox, then run native screen-reader speech output before stable promotion.
5. Use host-owned credentials and keys outside the package for Search Console, Bing Webmaster, and IndexNow; record outcomes without storing secrets.
6. Keep .menu-strip as the only sticky surface.

Risks and Limitations

• Isolated local Apache is production-configuration evidence, not evidence from the actual iarpg.com account, TLS terminator, CDN, reverse proxy, or hosting control plane.
• Managed Chromium policy prevents unrestricted local route navigation, so fixture results cannot satisfy the complete navigated-runtime gate.
• No native Firefox executable or native assistive-technology speech stack was available in the build environment.
• No Google Search Console, Rich Results live test, Bing Webmaster, IndexNow submission, production crawler log, or field Core Web Vitals credential/evidence was available. No credentials were requested or embedded.
• Lab performance and cache assertions cannot predict field user experience.

Validation Performed

• PHP lint, JavaScript syntax, JSON parsing, XML parsing, schema validation, memory-link and checksum validation.
• Actual Apache request validation for public/session cache separation, cookies, redirects, response codes, security headers, denied paths, raw-companion noindex policy, cache policy, compression, discovery files, and all sitemap routes.
• A temporary operator-controlled IARPGENABLEHOSTING_CHECK=1 run that passed all ten safe diagnostic checks, exposed no secret or absolute-path patterns, and was disabled immediately afterward.
• Browser fixture validation for all round-trip sources, preservation and rejection behavior, responsive widths, high zoom, sticky policy, menu containment, theme states, storage failure and synchronization, reduced motion, forced colors, print, and offline behavior.
• Flat archive inspection, nested-archive rejection, hidden-file presence, ZIP integrity, and external SHA-256 verification.

Memory References

• Hot memory index
• Current progress
• Hosting validation
• Browser validation
• Test plan
• Release promotion

Related Durable Documents

• [UI/UX, SEO, AEO, and GEO Improvement Report](ui-ux-seo-aeo-geo-improvement-report.md#executive-summary)
• [UAI Memory Organization Report](uai-memory-organization-report.md#executive-summary)
• Split-Memory Architecture
• Memory Authority and Conflict Audit

Supersession Status

Current for IARPG-OPS-2 2.0.8-wip staging and runtime evidence. It augments rather than supersedes the 2.0.7-wip interface and discoverability report.