fix: require genuine live hosting evidence

This commit is contained in:
donghyeon-ka
2026-07-25 22:25:04 +09:00
parent 4667cafa43
commit c089e749d0
4 changed files with 160 additions and 12 deletions
+4 -1
View File
@@ -26,4 +26,7 @@ to the declared allowlist; a cache-correct response with a mismatched
`corepack pnpm verify:hosting-headers` uses a deterministic fixture locally.
Set `HOSTING_BASE_URL` to probe deployed responses; production promotion
requires the artifact to report `mode: "live"`.
requires the artifact to report `mode: "live"`. The live target must be its
canonical, non-loopback HTTPS root URL. Each required surface must return HTTP
200 without leaving that origin before its cache, content-type, and security
headers can count as deployment evidence.