H3.3 — Tools Subdomain Parallel Validation

[maruson08]

Goal

Prepare the repository and validation contract for a future parallel Cloudflare Pages custom domain:

\ ools.securetools.app → secure-tools-web-bridge`n
This issue covers the preparation PR and the later activation gate. The first run stops before custom-domain attachment or DNS changes.

Preparation scope

• document activation order, TLS/DNS invariants, rollback, SEO isolation, and the manual browser QA gate
• extend bridge validation so the custom domain can be validated after activation without making the pre-activation PR predictably fail
• preserve the stable \secure-tools-web-bridge.pages.dev\ endpoint
• keep \securetools.app\ on its existing GitHub Pages deployment unchanged

Activation gate

Before attaching the custom domain, require human browser QA on the Pages bridge: one PDF operation, one image operation, one metadata operation, and Network-panel confirmation that selected files are not uploaded.

Non-goals

No DNS or custom-domain change in the preparation run; no apex, CNAME, Search Console, canonical, og:url, sitemap, redirect, GitHub Pages, application behavior, H3.4, or v3 changes.

[maruson08]

manual QA passed

[maruson08]

Reopening briefly for the H3.3 activation sequence. Manual browser QA and Cloudflare custom-domain activation are reported complete, but PR #71 and its resulting main deployment still require validation. This issue will close after that deployed validation succeeds.

[maruson08]

Reopening after PR #71 merge because H3.3 remains incomplete until the resulting main deployment and all deployed endpoint checks succeed. Merge SHA: 2bdaa72.

[maruson08]

H3.3 is complete. Manual browser QA was confirmed before activation. PR #71 merged as 2bdaa72, and automatic run https://github.com/SecureToolsProject/Secure_Tools/actions/runs/33475092368 succeeded. The authenticated Pages project contract reports secure-tools-web-bridge, main, Direct Upload, custom domain tools.securetools.app, and Web Analytics disabled. The immutable deployment is https://560bbc4b.secure-tools-web-bridge.pages.dev. Post-deployment checks passed on tools.securetools.app, the stable pages.dev alias, and securetools.app: all 19 routes plus 7 representative assets, no HTTP redirects, exact bridge X-Robots-Tag: noindex, nofollow, unchanged production canonical/og:url inventory, and no bridge noindex on production. GitHub Pages deployment also succeeded. No H3.4 work was performed.