---
uai: "1.0"
type: topic-memory
status: active
project: iarpg.com
release: "IARPG-OPS-2"
version: "2.0.13-wip"
review_state: current-until-superseded
---

# Hosting Validation

## Purpose

Define safe, repeatable deployment evidence for Apache or LiteSpeed hosts.

## Current Doctrine

- Isolated Apache direct-origin and controlled local TLS reverse-proxy topologies pass the current host suite for rewrites, canonical redirects and Link headers, TLS negotiation, HSTS, singular security headers, public/session cache separation, Secure cookies, compression, discovery files, raw-companion noindex policy, protected paths, synthetic crawler-agent boundaries, and every sitemap route.
- `hosting-check.php` is operator-only: it is disabled by default, noindex and no-store, and temporarily enabled only through `IARPG_ENABLE_HOSTING_CHECK=1` in the host environment.
- Forwarded scheme headers are ignored by default. Enable `IARPG_TRUST_PROXY_HEADERS=1` only on an origin protected from direct public access and behind a proxy that overwrites `Forwarded`, `X-Forwarded-Proto`, and `X-Forwarded-SSL`. The diagnostic must never expose secrets, environment values, absolute paths, session data, account details, or private configuration.
- Public navigation, search, and sitemap must not advertise the diagnostic endpoint.
- Controlled local TLS evidence establishes packaged proxy behavior, not the externally reachable production account, public certificate chain, CDN geography, or field behavior.
- Current evidence passes 22/22 certificate-verified local TLS checks, 370/370 sitemap and metadata routes, 59/59 aggregate controlled-edge checks, 89 structural-accessibility routes with zero deterministic findings, and 10/10 delivery budgets. Evidence: [staging host](../STAGING-HOST-EVIDENCE-IARPG-OPS-2-2.0.13-wip.json) and [edge topology](../EDGE-PROXY-EVIDENCE-IARPG-OPS-2-2.0.13-wip.json).

Evidence: [production-edge findings](../docs/long-term-memory/reports/production-edge-security-and-accessibility-validation-report.md#proxy-aware-transport-security).

## Shared Constraints

- Apply [repository constraints](constraints.uai#non-negotiable-constraints).

## Relevant Standards

- https://iarpg.com/standard/target-hosting-smoke-evidence

## Related UAI Records

- [Release promotion](release-promotion.uai)
- [Testing](testing.uai)
- [Architecture](architecture.uai)
- [Progress](progress.uai#open-blockers)

## Current Durable Research Routes

- [Fictional RPG Portal Technical Quality, Security, Privacy, Performance, SEO, and Reliability Audit](../docs/long-term-memory/reports/fictional-rpg-portal-technical-quality-security-privacy-performance-seo-and-reliability-audit.md#reviewed-synthesis) — reviewed with limitations; use only the linked Reviewed Synthesis and retain its truth boundary.