Project Laboratory · Web operations
Website Infrastructure, Hosting & Security
Local mirrors, deployment boundaries, backups, hosting experiments, security controls, and recoverability.
Record scope. Public records describe architecture and verified boundaries without publishing addresses, credentials, private paths, or exploitable configuration details.
Chronological record
Prepare a bounded first-wave release of The Buried Sky and Project Laboratory while keeping all historical transcripts private and leaving production unchanged.
2026-10-23 · Contemporaneous local preflight session; publication evidence retains date precision.
Evidence source
Local release manifests, an isolated WordPress rehearsal, anonymous HTTP checks, responsive browser checks, public-site comparison, and recovery tests.
Verified starting state
- The reviewed book and laboratory pages existed only as local drafts, and the transcript collection remained unpublished.
- A previous production archive was readable but was not fresh enough to serve as the required cutover recovery point.
- The live public page and post inventory had no additions newer than the earlier reconciliation checkpoint.
Actions recorded
- Built an explicit allowlist containing six book pages and seven Project Laboratory pages, with the transcript index and all transcript parts on a denylist.
- Created an isolated loopback WordPress clone, rehearsed authenticated page publication, and performed a production-URL conversion dry run without contacting production.
- Added local homepage promotion and top-level Books and Project Lab navigation, then tested desktop and mobile layout.
- Kept archival image originals private and directed public gallery links to hash-verified WebP derivatives.
- Restored the fresh staging database archive into a temporary database and verified the pre-release draft boundary; reconstructed the exact pre-change theme files and verified their recorded digests.
- Compared the local public inventory with production and reviewed the release pages for external links, rights notes, attribution, and AI disclosure.
Results, failures, and uncertainty
failure
The first rehearsal importer ran without an authenticated editor identity, so WordPress removed inline style wrappers and the exact-content check stopped the import. The importer was corrected to require an administrator capability before retrying.
The first rehearsal importer ran without an authenticated editor identity, so WordPress removed inline style wrappers and the exact-content check stopped the import. The importer was corrected to require an administrator capability before retrying.
failure
The first media check compared deployable WebP files against source-identity hashes. The release manifest was corrected to retain source identity separately and verify the actual file bytes.
The first media check compared deployable WebP files against source-identity hashes. The release manifest was corrected to retain source identity separately and verify the actual file bytes.
verified outcome
All 13 allowlisted pages rendered successfully in staging; all 33 transcript-related pages returned anonymous not-found responses; 78 manifest media files, 88 internal links, and 102 rendered assets passed.
All 13 allowlisted pages rendered successfully in staging; all 33 transcript-related pages returned anonymous not-found responses; 78 manifest media files, 88 internal links, and 102 rendered assets passed.
verified outcome
The staged homepage promotion, navigation, and galleries rendered without horizontal overflow at tested desktop and mobile widths.
The staged homepage promotion, navigation, and galleries rendered without horizontal overflow at tested desktop and mobile widths.
verified outcome
A temporary-database restore recovered 69 tables, all 13 release pages as drafts, and no published transcript records; the temporary database was then removed.
A temporary-database restore recovered 69 tables, all 13 release pages as drafts, and no published transcript records; the temporary database was then removed.
uncertainty
A fresh production database-and-files backup could not be created because the production administration session was not authenticated. Production publication remains blocked until that recovery point is created and tested.
A fresh production database-and-files backup could not be created because the production administration session was not authenticated. Production publication remains blocked until that recovery point is created and tested.
Next action: After an authorized administrator creates and verifies a fresh production database-and-files recovery point, repeat the final production-delta check and request one explicit first-wave deployment approval.
Evidence:
- Anonymous staging audit for public pages, protected drafts, media, assets, and internal links · SHA-256
9cec601aa82307feb12cd578689de4c676ee67f1012da07b01498e176eef39e7· observed 2026-10-23 - Fresh local staging database seed used for the isolated restore test · SHA-256
c3e0164960e80188f0d57524601ca1fd7b712a50df2e4f7ca1cfc211e565c9c5· observed 2026-10-23 - Hash-verified pre-change header, homepage, and responsive stylesheet files · observed 2026-10-23
- Public REST and rendered-body comparison found no new production content after the prior reconciliation checkpoint · observed 2026-10-23
Related entries: 2026-10-23-buried-sky-prepublication-state, 2026-10-23-buried-sky-final-path-redaction
Record ID · 2026-10-23-website-production-preflight
Define a bounded website-development laboratory without granting production authority or duplicating private tools.
2026-10-14 · Date stated in the infrastructure inventory; exact inspection time was not preserved in the report.
Evidence source
A local infrastructure inventory describing reusable resources, security boundaries, and deferred production work.
Verified starting state
- A local workstation already provided container tooling, storage, an authenticated operator boundary, and private research capabilities.
- Production services existed and were explicitly out of scope for the laboratory.
Actions recorded
- Defined fixed development runtimes and constrained preview behavior.
- Documented isolation controls and exclusions for credentials, privileged host access, public DNS, and live deployment.
- Deferred CMS selection, public deployment, real user accounts, and privileged remote repair.
Results, failures, and uncertainty
verified outcome
The inventory records a local-only laboratory boundary and explicitly withholds live deployment authority.
The inventory records a local-only laboratory boundary and explicitly withholds live deployment authority.
uncertainty
The inventory is a point-in-time report; current service state must be rechecked before relying on it operationally.
The inventory is a point-in-time report; current service state must be rechecked before relying on it operationally.
Next action: Append a new entry whenever a hosting boundary, deployment process, or security control materially changes.
Evidence:
- Web-development infrastructure inventory — October 14, 2026 · SHA-256
0763e27ca31755aa63ee7089990324a9378e705fb7b005524d96d384fd61c038· observed 2026-10-23
Record ID · 2026-10-14-web-development-boundary
