IARPG staging host validation — 2.0.8-wip
Generated UTC: 2026-07-21T03:00:31Z
Target: isolated-apache-staging
Result: 19 pass / 0 fail / 19 total
Sitemap: 334/334 routes HTTP 200; 334/334 HTML metadata pass

[PASS] HOST-HTTP-001 — Public home response: HTTP 200.
[PASS] HOST-HTTP-002 — Public response is session-free: Observed 0 Set-Cookie fields.
[PASS] HOST-HTTP-003 — Public response is briefly cacheable: Cache policy: public, max-age=300, stale-while-revalidate=60.
[PASS] HOST-HTTP-009 — Public response has no legacy session-cache headers: Pragma present=False; legacy Expires present=False.
[PASS] HOST-HTTP-004 — Shared security headers are singular: Each shared field appears exactly once.
[PASS] HOST-HTTP-005 — Nonce-bearing CSP is present: CSP contains nonce and frame restriction.
[PASS] HOST-HTTP-006 — Content language is declared: Content-Language: en.
[PASS] HOST-HTTP-007 — Play gateway starts an intentional session: HTTP 200; Set-Cookie fields: 1.
[PASS] HOST-HTTP-008 — Play gateway is private and no-store: Cache policy: private, no-store, max-age=0.
[PASS] HOST-HTTP-010 — Session cookie uses the neutral name and safety attributes: name_ok=True; httponly=True; samesite_lax=True; path_root=True; secure_required=False.
[PASS] HOST-ROUTE-001 — Canonical redirects: /index.php=301:/; /faq.php=301:/faq; /standard.php?slug=mission-lifecycle=301:/standard/mission-lifecycle; /mission.php?slug=hollow-signal=301:/mission/hollow-signal; /role.php?slug=case-officer=301:/role/case-officer; /docs/view.php?doc=staging-host-and-runtime-validation-report=301:/docs/report/staging-host-and-runtime-validation-report; /faq/=301:/faq
[PASS] HOST-ERROR-001 — Unknown route returns noindex 404: HTTP 404; X-Robots-Tag: noindex, follow, noarchive.
[PASS] HOST-ERROR-002 — Operator diagnostic is disabled by default: HTTP 404; noindex=True; no-store=True.
[PASS] HOST-PRIVATE-001 — Internal paths are denied: Statuses: [403, 403, 403].
[PASS] HOST-RAW-001 — Raw companions are fetchable and noindex: /answers.json:200:noindex=True; /docs/long-term-memory/reports/staging-host-and-runtime-validation-report.md:200:noindex=True; /docs/uai/index.uai:200:noindex=True; /docs/checksums.sha256:200:noindex=True
[PASS] HOST-ASSET-001 — Versioned static asset is immutable: HTTP 200; cache=public, max-age=31536000, immutable.
[PASS] HOST-COMPRESS-001 — HTML and CSS compression: Encodings: ['gzip', 'gzip'].
[PASS] HOST-DISCOVERY-001 — Discovery artifacts: /sitemap.xml:200:application/xml; /feed.xml:200:application/xml; /opensearch.xml:200:application/xml; /answers.json:200:application/json; /robots.txt:200:text/plain; /llms.txt:200:text/plain
[PASS] HOST-CRAWL-001 — Complete sitemap crawl: 334/334 HTTP 200; 334/334 HTML metadata records passed.

Truth boundary: isolated staging evidence is not production-host, external-indexing, native-Firefox, or native-assistive-technology evidence.