[ptr727]

Summary

A hand run of checks/check-live-urls.sh counts as measured through Cloudflare only once the target answers server: cloudflare with a cf-ray header. Right after a hostname flips to proxied, the resolver on the machine running the check can keep answering with the origin for minutes. This happened after both production flips. OPERATIONS.md "Deploying" now says to read those headers from the same machine before the run, and gives the command.

This is step 1 of handoff #493. It is docs only and needs no release of its own.

Verification

• The documented curl -sSI ... | grep -iE '^(server|cf-ray):' printed both headers against production.
• prose_lint.py --diff and its sentence-length check are clean.

Local review

The local strict pass ran twice. The first raised two introduced findings on the new paragraph: it credited DNS over HTTPS rather than a different resolver cache, and it was not scoped to a hand run on the checking machine. Both were fixed in 079ba9f, and the second pass found nothing.

🤖 Generated with Claude Code

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 7599c6ea-7af6-47d4-98e4-c25803de659f

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[ptr727]

A recorded local strict-review pass covers head 079ba9fa61c5de030de738ff0f54d68c4b6a6647, the content this pull request carries at that commit against develop, and it recorded 0 findings.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 49.70%. Comparing base (f35ec08) to head (77eb03f).

Additional details and impacted files

@@           Coverage Diff            @@
##           develop     #498   +/-   ##
========================================
  Coverage    49.70%   49.70%           
========================================
  Files           10       10           
  Lines         3058     3058           
========================================
  Hits          1520     1520           
  Misses        1538     1538           

Flag	Coverage Δ
python-3.13	49.70% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[Copilot]

🔵 Needs a closer look

The documented probe must be corrected to use the same curl configuration behavior as the checker and to require both proxy headers.

No open issues 🎉

What changed in this PR

This documentation-only PR adds a Cloudflare proxy verification step before running hand-checked production URL checks.

Changes:

• Documents the required server: cloudflare and cf-ray response headers.
• Adds a same-machine curl probe before the live URL check.
• Explains resolver-cache delays after proxy changes.

File	Summary
OPERATIONS.md	Adds Cloudflare proxy-header confirmation guidance; the probe should also ignore local curl configuration and independently require both headers.

_{Review effort: Lite}

[ptr727]

A recorded local strict-review pass covers head 77eb03f6f1c82597af63098cf2b9cddf1bcbb0c3, the content this pull request carries at that commit against develop, and it recorded 1 finding.

[ptr727]

Answering the round on 079ba9f, "use the same curl configuration behavior as the checker and require both proxy headers":

• Same curl configuration: fixed in 77eb03f. The probe now runs curl -q -sSI, so a local .curlrc is skipped, as checks/check-live-urls.sh does with its own -q as the first argument.
• Require both headers: declined. The probe prints each matching header line, so a missing cf-ray, or a server other than cloudflare, shows on screen. The paragraph's rule sentence already requires both. A stronger approach, printing the proxy state from the checker's own preflight so no hand probe is needed, is tracked on Assert the Security Headers in the Live Check #500.