# IARPG Hosting Smoke Test

**Release:** IARPG-OPS-2 2.0.10-wip  
**Status:** Work in progress

## Purpose

`/hosting-check` is an operator-gated, sanitized diagnostic for an actual Apache or LiteSpeed account. It reports bounded pass/fail metadata and must not expose environment values, absolute paths, cookies, credentials, private keys, or server configuration bodies.

## Reverse-Proxy Trust Boundary

Forwarded scheme headers are ignored by default. When HTTPS terminates at a trusted reverse proxy, the operator must prevent direct public access to the origin, overwrite `Forwarded`, `X-Forwarded-Proto`, and `X-Forwarded-SSL`, and enable `IARPG_TRUST_PROXY_HEADERS=1` only on that protected origin. Never enable proxy trust merely because a client supplies a forwarded header.

## Procedure

1. Deploy the complete flat ZIP so `index.php`, `.htaccess`, `.uai/`, and `.well-known/` are present at the document root.
2. Verify ordinary publication pages over HTTPS before enabling the diagnostic. Confirm HSTS, canonical `Link`, singular security headers, no public session cookie, compression, and clean routing.
3. Temporarily set the host environment variable `IARPG_ENABLE_HOSTING_CHECK=1`.
4. Request `/hosting-check?format=json` over the public HTTPS route. The 2.0.10-wip diagnostic should report 12 checks covering PHP, required files, write access, rewrites, headers, private paths, JSON, static assets, compression, UTC, HTTPS/HSTS, and the proxy trust boundary.
5. Save only the sanitized JSON result as release evidence. Do not save environment dumps, raw access logs containing sensitive values, cookie values, or private configuration.
6. Unset `IARPG_ENABLE_HOSTING_CHECK` immediately. Confirm `/hosting-check` returns a noindex, no-store 404.
7. Review sanitized aggregate access logs for public routes and denial of private paths. Keep host-owned search, crawler, and IndexNow credentials outside the package.

## Stable Promotion Rule

The controlled local TLS proxy harness proves the packaged behavior under a production-pattern topology, but it does not replace evidence from the externally reachable target host. Stable `2.1.0` remains blocked until required native browser, assistive-technology, actual edge, field-performance, and host-owned discovery gates have current direct evidence.