[ptr727]

Summary

This fixes the Copilot round on promotion #502 (head 4493967), thread on OPERATIONS.md:137.

• The proxy probe gives a verdict for every host. It printed header lines and left the reader to judge them, and it named one host. It now loops over the blog and family hosts. It prints <host> proxied only when a host answers both server: cloudflare and cf-ray, and <host> UNCONFIRMED otherwise, a curl failure included. The gate says to go ahead only when each host prints proxied. This "require both headers" point came up on Confirm the Proxy Headers Before Calling a Run Proxied #498 and again on Promote Consistent Site Security Headers and the Proxied-Run Check #502, so the doc now states it outright instead of leaving it to the reader.
• HSTS nit from the same round. The includeSubDomains reason in deploy/README.md now says plainly that it extends the policy to subdomains of the site's hostname.

Verification

• Ran the loop against the live hosts. The proxied production names print proxied. A DNS-only host answering 401 prints UNCONFIRMED, and so does an unreachable port.
• prose_lint.py --diff and its sentence-length check are clean.

Local review

The first pass raised one introduced finding. The failure verdict NOT proxied contained proxied, so a test for the word passed on a failure. Fixed in f12a2dd with UNCONFIRMED. The second pass found nothing.

🤖 Generated with Claude Code

[ptr727]

A recorded local strict-review pass covers head f12a2dd00c44dccd7eb4deefe97f97b75620e573, the content this pull request carries at that commit against develop, and it recorded 0 findings.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: e83833c0-2f29-4361-9ebc-ffac5e8362d5

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 49.70%. Comparing base (4493967) to head (d0109be).

Additional details and impacted files

@@           Coverage Diff            @@
##           develop     #503   +/-   ##
========================================
  Coverage    49.70%   49.70%           
========================================
  Files           10       10           
  Lines         3058     3058           
========================================
  Hits          1520     1520           
  Misses        1538     1538           

Flag	Coverage Δ
python-3.13	49.70% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[Copilot]

🟡 Changes recommended

The documented probe still has unresolved portability, header-matching, timeout, and curl-failure handling issues.

1 open issue

• Use POSIX syntax in the documented sh probe · New

What changed in this PR

This pull request updates deployment documentation to provide explicit Cloudflare proxy verdicts for both site hosts and clarifies HSTS subdomain coverage.

Changes:

• Adds per-host checks for the blog and family hosts.
• Reports proxied only when both required Cloudflare headers are present; otherwise reports UNCONFIRMED.
• Clarifies that HSTS includeSubDomains applies to subdomains of the site's hostname.

File	Description
OPERATIONS.md	Documents per-host Cloudflare proxy verification and verdict output.
deploy/​README.md	Clarifies the HSTS includeSubDomains explanation.

_{Review effort: Lite}

[ptr727]

A recorded local strict-review pass covers head d0109bec55d3f14736a8db20bcfb67ff435d7abd, the content this pull request carries at that commit against develop, and it recorded 0 findings.

[ptr727]

Answering the outdated thread on OPERATIONS.md:139 (use POSIX syntax in the sh probe): fixed in d0109be. Each here-string is now printf '%s\n' "$h" | grep -qi ..., so the block runs under /bin/sh. Under dash against live hosts, it printed proxied for proxied names and UNCONFIRMED for a DNS-only host and an unreachable port.