Release Candidate 2026-08-28 16:01:40 +0900

[github-actions]

• POC (#68): git-backed handbook on Astro + Cloudflare — GitHub auth, review workflow, no CMS/DB #72 @VibratingKoala
• Modify start-pull-request.yml to pass label values through env instead of inline interpolation #97 @VibratingKoala
• Add Terraform for a CloudFront distribution and CloudFront Function reverse-proxying the handbook Worker #99 @sn0wm1ku
• Worker side of the CloudFront origin lock; fix the cache policy name blocking the plan #101 @VibratingKoala
• Add the content guide for AI agents, and update README for production #105 @sn0wm1ku

[sn0wm1ku]

Release review of the sole payload, #99 (infra/ — CloudFront reverse proxy for the handbook Worker), judged against the OSBR engineering handbook (code-review.md §3-2 priority order; style-guide-terraform.md; infra-planning-policy.md; security-policy.md / application-security.md). LGTM — no blocking findings; safe to release.

Correctness (KISS/DRY/YAGNI)

• Managed CloudFront policies are used everywhere they fit; the only owned policy is the HSTS response-headers policy the origin genuinely lacks. No speculative modules or wrappers (style-guide-terraform.md §7).
• The viewer-request function does only its two irreducible jobs (Origin rewrite, post-cutover canonical redirect), and the 18 unit tests load the exact file Terraform uploads — tested code is shipped code.

Security

• No secret in the tree: origin_secret is sensitive, no default, fed via TF_VAR_; backend.hcl and *.tfvars are gitignored (style-guide-terraform.md §6).
• Remote S3 state with use_lockfile = true; no local state committed (§5).
• Cache design prevents cross-reader leakage: all-cookies cache key on the default behaviour, CachingDisabled on /api/*, CachingOptimized only on content-hashed /_astro/*.
• Origin rewrite preserves the CSRF property (only the one legitimate public origin is translated; cross-site Origin passes through and is still rejected) and the Location sanitisation is tested against CRLF, fragment truncation and parameter smuggling.
• HSTS added with override = false; TLS 1.2+ on both viewer and origin legs; X-Origin-Verify anti-bypass header cannot be forged from outside.

Style-guide conformance

• Conventional file split, alphabetical variables.tf/outputs.tf, every variable typed and described (§3); required_version set and provider pinned ~> 6.0 with the lock file committed (§4); snake_case names without type repetition (§2); fmt -check/validate pass per the evidence (§1).
• One Tool Owns Each Resource is respected and cited: Terraform owns AWS only, never the Worker (§8).

Release safety. enable_dns_cutover defaults to false, there is no CI apply path, and both scripts are guarded (plan → saved tfplan → apply-what-was-read). Merging main → release ships inert IaC plus documentation; nothing changes for readers.

Open items — documented deferrals, not blockers (recorded in the PR body and infra/README.md, as the handbook requires for deviations): Worker-side X-Origin-Verify check (other repository), OAUTH_ORIGIN on the Worker at cutover, DNS cutover deliberately not armed, CI with OIDC pending the IAM role (acceptance criterion of #98 — keep #98's tracking open until it lands), WAF and access logging deferred. First-apply evidence (console/curl) should be attached at apply time as the PR body promises.

---

_{🤖 auto-posted by sn0wm1ku/ghDuty · co-authored by Claude (claude-opus-4-8)}

[sn0wm1ku]

Re-review after the RC regenerated (my 08-25 review was auto-dismissed when #72 merged into main). Judged per code-review.md §3-2 and the matching style guides. LGTM — approve; safe to release.

Payload #99 (infra/ — CloudFront reverse proxy). Byte-identical to what I release-reviewed on 08-25: the delta since that review touches zero infra/ files. That LGTM stands in full (secrets handling per style-guide-terraform.md §6, remote locked state §5, managed policies §7, enable_dns_cutover=false, no CI apply path).

Payload #72 (Astro + Cloudflare Workers handbook app). Already carried my standing APPROVED review on its own PR (2026-08-24), and no commit postdates that approval (last commit 2026-08-21, merged 2026-08-27). The delta on this RC is exactly that approved payload — 107 commits, 147 files, all under app/, doc/ frontmatter, POC.md, workflows — with no conflict-resolution drift against infra/.

Release safety of the merge itself. deploy-worker.yml triggers on pushes to i68-handbook-poc and main only — a merge to release fires no deploy, and the workflow is inert regardless until CLOUDFLARE_API_TOKEN exists. run-tests.yml targets the app on its own branches. Merging this RC changes nothing running.

Open items from the 08-25 review remain documented deferrals, not blockers (Worker-side X-Origin-Verify, OAUTH_ORIGIN at cutover, DNS cutover unarmed, OIDC CI pending #98, WAF/logging deferred).

---

_{🤖 auto-posted by sn0wm1ku/ghDuty · co-authored by Claude (claude-opus-4-8)}

[sn0wm1ku]

Re-review after the RC regenerated a second time (my 10:09 review was auto-dismissed when #101 merged into main at 10:56). Judged per code-review.md §3-2 (correctness → security → readability) and the matching style guides. LGTM — approve; safe to release.

Delta since the dismissed review: exactly #101, with no drift. fc89368..b8a4fd1 is two commits — #101's single commit 2ea53b8 and its merge. The merge commit's tree (610e5799…) is byte-identical to 2ea53b8's tree, so the merge into main resolved nothing and re-wrote nothing: what sits on this RC is precisely what I reviewed.

Payload #101 (Worker-side X-Origin-Verify origin lock; cache-policy name fix). Carries my standing APPROVED review on its own PR (2026-08-27 10:55:18, against 2ea53b8), and no commit postdates that approval (2ea53b8 committed 10:41:08; merged 10:56:37). The full handbook-cited review is on #101: infra/main.tf cache-policy name verified against AWS's own managed-policy documentation; the off-until-ORIGIN_VERIFY_SECRET-is-set default recorded as an application-security.md §3-16 relaxation with scope, duration and rollback (wrangler secret delete) stated in the PR body and POC.md step 6; no secret in the diff. That LGTM stands in full.

Payloads #72 and #99. Untouched by the delta except where #101 deliberately edits them (infra/main.tf name fix, astro.config.mjs comment correction, ribbon removal, POC-branch retirement) — all reviewed under #101. My 08-25 and 10:09 LGTMs on those payloads stand.

Release safety of the merge itself. deploy-worker.yml at the RC head triggers on push to main only (the POC branch was retired in #101), paths app/** and doc/** — a merge to release fires no deploy, and the workflow stays inert until CLOUDFLARE_API_TOKEN exists. The origin lock is inert until the Worker secret is set by hand. Merging this RC changes nothing running.

Open items remain documented deferrals, not blockers: OAUTH_ORIGIN at cutover, DNS cutover unarmed (enable_dns_cutover=false), OIDC CI pending #98, WAF/logging deferred. The Worker-side X-Origin-Verify item from my 08-25 list is now closed by #101.

---

_{🤖 auto-posted by sn0wm1ku/ghDuty · co-authored by Claude (claude-opus-4-8)}

[sn0wm1ku]

Re-review after the RC regenerated a third time (my 08-27 11:09 review was auto-dismissed when #97 merged into main at 2026-08-28 03:38 UTC). Judged per code-review.md §3-2 (correctness → security → readability) and the matching handbook standards. LGTM — approve; safe to release.

Delta since the dismissed review: exactly #97, with no drift. b8a4fd1..fe6a391 is five commits — #97's three content commits (5ba6ba8, 6aa8b23, 8841740, all 2026-08-24), the base-merge de47e60 (08-28 03:37) and the merge fe6a391 (08-28 03:38). The only file that changes on the RC is .github/workflows/start-pull-request.yml (+9/−8). Its blob at the RC head is 6be7c6f, byte-identical to the blob at 8841740 — so the base-merge into the branch and the merge into main rewrote nothing in the payload.

Payload #97 (start-pull-request.yml — untrusted values reach the shell via env, not ${{ }} interpolation). Carries my standing APPROVED review on its own PR (2026-08-24 10:13:12 UTC), and no content commit postdates that approval (last content commit 8841740 at 08:47:50; the only later commit is the base-merge, which the blob comparison above shows touched nothing). Re-verified against the file at the RC head: every ${{ }} removed from run: script text now arrives as a real environment variable at its point of use — LABELS / ASSIGNEES / NEW_BRANCH_NAME written to $GITHUB_ENV by earlier steps, REPO / ISSUE_NUM / ISSUE_TITLE / DEFAULT_BRANCH in the job-level env: block — and no ${{ }} remains inside any run: block. A shell variable's value is not re-scanned for $() / backticks, so a metacharacter-bearing label name can no longer execute in a job holding contents / issues / pull-requests / id-token: write. That is the shape application-security.md §3-10 requires (untrusted input MUST NOT be passed to a shell as script text; §3-9 parameterise at the sink). Minimal and matching #95 exactly (code-review.md §3-2 KISS/YAGNI).

Payloads #72, #99 and #101. Untouched by the delta — zero files under app/, infra/, doc/ or POC.md change between b8a4fd1 and fe6a391. My 08-25, 08-27 10:09 and 08-27 11:09 LGTMs on those payloads stand in full.

Release safety of the merge itself. start-pull-request.yml triggers on issues: assigned, and GitHub runs issue-event workflows from the default branch's copy — a merge to release neither fires it nor changes which copy runs. deploy-worker.yml at the RC head triggers on push to main only and stays inert until CLOUDFLARE_API_TOKEN exists. Merging this RC changes nothing running.

Advisory, not gating (code-review.md §3-3), pre-existing and outside the delta: actions/checkout@v4 in this workflow is tag-pinned; supply-chain-risk.md says third-party actions SHOULD be pinned to a full commit SHA. Belongs in its own issue, not on this RC.

Open items remain documented deferrals, not blockers: OAUTH_ORIGIN at cutover, DNS cutover unarmed (enable_dns_cutover=false), OIDC CI pending #98, WAF/logging deferred.

---

_{🤖 auto-posted by sn0wm1ku/ghDuty · co-authored by Claude (claude-opus-4-8)}

[sn0wm1ku]

Re-review after the RC regenerated a fourth time (my 08-28 04:10 review was auto-dismissed when #105 merged into main at 2026-08-28 07:01 UTC). Judged per code-review.md §3-2 (correctness → security → readability) and §3-3 (concrete, cited findings), plus repository-documentation-standards.md §4-2 (one fact, one place). LGTM — approve; safe to release.

Delta since the dismissed review: exactly #105, with no drift. fe6a391..0682f9a is eleven commits — #105's ten content commits (babc0fd … 00765c7, all 2026-08-28 03:57–04:49 UTC) and the merge 0682f9a (07:01:23). The merge commit's tree (a566882d) is byte-identical to 00765c7's tree, so the merge into main resolved nothing and re-wrote nothing: what sits on this RC is precisely the payload I reviewed on #105.

Payload #105 (.claude/CONTENT-GUIDE.md new; README.md, CLAUDE.md, .gitignore). Carries my standing APPROVED review on its own PR (2026-08-28 05:10:49 UTC, against 00765c7 — the same head that merged), and no commit postdates that approval (last content commit 00765c7 at 04:49:09; merged 07:01:24). That review verified every factual claim in the guide and README against main source (content.config.ts loader, serialize.ts H1 round-trip, markdown.ts heading extraction and raw-HTML drop, Sidebar.astro generation, auth/github.ts no-allow-list, every package.json script named). Re-checked at the RC head: the four changed files are documentation and ignore rules only — no code, no workflow, no doc/, app/ or infra/ file; no secrets, tokens, account ids or personal addresses in the diff (application-security.md §3-2 security lens); .gitignore gains only scratch paths under .claude/ and no broader rule shadows the tracked guide. That LGTM stands in full.

Payloads #72, #97, #99 and #101. Untouched by the delta — zero files under app/, infra/, doc/, .github/ or POC.md change between fe6a391 and 0682f9a. My 08-25, 08-27 10:09, 08-27 11:09 and 08-28 04:10 LGTMs on those payloads stand.

Release safety of the merge itself. release.yml fires on push to release and republishes the legacy VitePress site to GitHub Pages; this delta touches no doc/ file, so that build's artefact is identical to what the previous RC head would have produced. The live site is the Worker, and deploy-worker.yml at the RC head triggers on push to main only (paths app/**, doc/**) — a merge to release fires no Worker deploy, and the workflow stays inert until CLOUDFLARE_API_TOKEN exists. start-pull-request.yml runs from the default branch's copy regardless. Merging this RC changes nothing readers get.

Advisory, not gating (code-review.md §3-3), carried over from the #105 review: POC.md still records the pre-cutover DNS statement while the guide and README now state the measured CloudFront → Worker path — two disagreeing facts in one repository (repository-documentation-standards.md §4-2). #105's body names it as its own follow-up; belongs in its own issue, not on this RC. Same for the tag-pinned actions/checkout noted on the previous RC review (supply-chain-risk.md).

Open items remain documented deferrals, not blockers: OAUTH_ORIGIN at cutover, DNS cutover unarmed (enable_dns_cutover=false), OIDC CI pending #98, WAF/logging deferred.

---

_{🤖 auto-posted by sn0wm1ku/ghDuty · co-authored by Claude (claude-opus-4-8)}