rdmsm4x changelog — Preview edge hardening

Preview-only technical edge hardening was implemented and committed in an isolated worktree; no deployment or UI/content change was made.

Scope

• Host: rdmsm4x
• Project: amagansett.app
• Worktree: /Users/richh/dev/_handoff/codex-out/amagansett-preview-edge-20260825
• Branch: codex/amagansett-preview-edge-20260825
• Base: f05b771390ff44c28ed879850c8b12d341ea186e
• Result: e3b7833761a1ecf7daad1b3fadb87628b8e2d153
• Privacy: private prototype; no credentials, source-site sessions, signed URLs, or remote deployment

Files changed

• /Users/richh/dev/_handoff/codex-out/amagansett-preview-edge-20260825/sites/preview/public/_headers
• /Users/richh/dev/_handoff/codex-out/amagansett-preview-edge-20260825/deploy/preview.wrangler.jsonc
• /Users/richh/dev/_handoff/codex-out/amagansett-preview-edge-20260825/tests/integration/preview-wrangler-local-contract.zsh
• /Users/richh/dev/_handoff/codex-out/amagansett-preview-edge-20260825/package.json
• /Users/richh/dev/_handoff/codex-out/amagansett-preview-edge-20260825/.superpowers/sdd/2026-08-25-technical-completion/task-preview-edge-implementation.md

Commands and evidence

• npm run build:preview — PASS
• tests/integration/preview-wrangler-local-contract.zsh — PASS
• npm run check:preview-worker — PASS
• npx wrangler deploy --dry-run --config deploy/preview.wrangler.jsonc — PASS; no bindings, no deploy
• npm run typecheck — PASS
• npm test — PASS; 10 files / 65 tests
• zsh -n tests/integration/preview-wrangler-local-contract.zsh — PASS
• git diff --check — PASS

The local contract validated root and hash navigation, generated security/cache headers, MIME types for hashed JS/CSS and concept PNG, and empty-body 404 responses for missing JS/CSS/PNG/PDF assets. It terminated the Wrangler process it started.

Backup / rollback

• Source rollback: retain base commit f05b771390ff44c28ed879850c8b12d341ea186e and this isolated worktree.
• No production deployment, Pages version, Worker version, or external state was changed.

Undo

The parent integration owner can omit commit e3b7833761a1ecf7daad1b3fadb87628b8e2d153 from integration. Do not alter the canonical checkout from this worker lane.

Outstanding owner actions

• Lead agent must review and cherry-pick this commit into the main isolated integration worktree if accepted.
• Lead agent must run the full release gates and separately capture Preview Pages/Worker deployment IDs, rollback anchors, Access denial matrix, immutable hostname, and authenticated owner verification before any deployment.