H3.5 — Coordinated Production Domain Cutover

[maruson08]

Track the read-only H3.5.0 final preflight, rollback snapshot, and later coordinated production cutover.

Prepared changes:

• Hub PR H3.4B — Hub Apex Cutover Preparation #15 — H3.4B Hub Apex Cutover Preparation
• Secure_Tools PR #73 — H3.4A Web Utilities SEO Cutover Preparation
• H3.1 migration contract: https://github.com/SecureToolsProject/hub/blob/main/docs/migrations/h3-migration-contract.md
• H3.5 cutover runbook (prepared in PR H3.4B — Hub Apex Cutover Preparation #15): https://github.com/SecureToolsProject/hub/blob/seo/h3-hub-apex-cutover/docs/migrations/h3.5-cutover-runbook.md

H3.5.0 is read-only with respect to production infrastructure. It captures exact DNS, TLS, GitHub Pages, Cloudflare Pages, redirect, endpoint, prepared-artifact, and rollback state and ends with an explicit GO or NO-GO.

This issue does not authorize merging either preparation PR, changing DNS, attaching the apex, modifying redirect rules, changing GitHub Pages or Search Console, removing noindex, or beginning H3.6.

[maruson08]

H3.5.0 preflight snapshot — NO-GO

Captured read-only on 2026-09-01. No production setting was changed.

Preparation PRs

• Hub PR H3.4B — Hub Apex Cutover Preparation #15: OPEN, MERGEABLE/CLEAN, CI success, head 9f1d88e, base/main 9770238, behind 0.
• Secure_Tools PR #73: OPEN, MERGEABLE/CLEAN, CI success, head c91f36c7a05eb11e3b2539df8fc651e4be4bbe5b, base/main 2bdaa72074794f3eeb6d9ed40f3e77d03a1683aa, behind 0.

Public DNS rollback values

Apex securetools.app:

• A 185.199.108.153, TTL 300
• A 185.199.109.153, TTL 300
• A 185.199.110.153, TTL 300
• A 185.199.111.153, TTL 300
• no public apex AAAA or CNAME answer
• public answers and Server: GitHub.com are consistent with DNS-only GitHub Pages delivery

WWW:

• CNAME www.securetools.app → securetoolsproject.github.io, TTL 300
• public behavior is GitHub Pages 301 to the same apex path; query string is preserved

Tools:

• active Cloudflare Pages custom domain for secure-tools-web-bridge
• public TTL 300; Cloudflare anycast A 104.21.45.168, 172.67.217.3
• public AAAA 2606:4700:3032::ac43:d903, 2606:4700:3033::6815:2da8
• latest authenticated deployment workflow contract recorded the sole custom domain as ools.securetools.app

CAA:

• raw type-257 query returned NOERROR with zero CAA answers; no public CAA issuance restriction was found.

TLS

All four HTTPS handshakes succeeded:

• apex and WWW certificate: Let's Encrypt YR2, valid through 2026-11-25
• tools certificate: Google Trust Services WE1, valid through 2026-11-30
• Hub pages.dev certificate: Google Trust Services WE1, valid through 2026-11-29

GitHub Pages rollback origin

• repository: SecureToolsProject/Secure_Tools
• build type: legacy
• source: main, path /
• custom domain/CNAME: securetools.app
• HTTPS enforcement: enabled
• Pages status: built; certificate approved for apex and WWW
• latest successful GitHub Pages Deployment ID: 6195383822
• deployment SHA: 2bdaa72074794f3eeb6d9ed40f3e77d03a1683aa
• environment URL: https://securetools.app/

Cloudflare Pages provenance

Hub:

• project secure-tools-hub
• GitHub Actions Direct Upload from main
• stable URL https://secure-tools-hub-53i.pages.dev
• latest immutable URL https://b9f9354d.secure-tools-hub-53i.pages.dev
• latest successful GitHub Deployment ID 6193187162
• SHA 9770238
• public apex remains GitHub Pages, so securetools.app is not active on the Hub

Web Utilities:

• project secure-tools-web-bridge
• authenticated workflow validation recorded: Direct Upload, production branch main, custom domain ools.securetools.app, no Git integration, Web Analytics disabled
• stable URL https://secure-tools-web-bridge.pages.dev
• latest immutable URL https://560bbc4b.secure-tools-web-bridge.pages.dev
• latest successful GitHub Deployment ID 6195383855
• SHA 2bdaa72074794f3eeb6d9ed40f3e77d03a1683aa

Live validation

• securetools.app: 19 routes + 7 assets passed, no redirects, no bridge header, 18 old-host canonicals plus intentional noindex legacy alias
• ools.securetools.app: 19 routes + 7 assets passed, exact X-Robots-Tag: noindex, nofollow, old-host canonicals
• stable Web Utilities pages.dev: same 19-route/7-asset bridge contract passed
• Hub pages.dev: 10 routes + 3 representative assets passed; current deferred canonical/og:url behavior retained
• WWW root, nested route, and query test: direct 301 to matching apex URL with path/query preserved

Prepared artifact validation

Hub PR #15:

• 10 self-canonical records
• 10 unique Hub sitemap URLs
• stable/immutable Pages hostname noindex rules
• exact 18 same-path 301 mappings
• one root no-redirect reservation
• no Hub route collisions

Secure_Tools PR #73:

• full repository suite passed
• 18 tools-host canonical and og:url files
• 18 unique tools sitemap URLs
• no old apex or pages.dev sitemap URL
• tools custom-domain indexable target plus stable/immutable pages.dev noindex contract
• intentional noindex legacy alias retained

Exact rollback actions

Apex failure:

1. detach/stop the Hub apex association as appropriate;
2. restore the four captured DNS-only GitHub Pages A records above at TTL 300;
3. retain Secure_Tools CNAME=securetools.app, source main:/, and HTTPS enforcement;
4. verify the latest known-good GitHub Pages deployment and all 19 routes.

WWW failure:

1. disable/remove the new Cloudflare Bulk Redirect rule/list item;
2. remove the redirect-only proxied placeholder record;
3. restore DNS-only CNAME www → securetoolsproject.github.io, TTL 300;
4. verify root, nested path, and query-preserving 301 behavior.

Hub failure:

• leave/restore apex on GitHub Pages; keep Hub available only at its pages.dev validation endpoint.

Tools SEO failure:

• revert the PR #73 merge commit and allow the main deployment to restore old-host canonicals and tools noindex; do not remove ools.securetools.app unless the tools domain itself fails.

Later WWW configuration

Required Cloudflare Pages documented model:

• Bulk Redirect source https://www.securetools.app/
• target https://securetools.app/
• status 301
• subpath matching enabled
• preserve path suffix enabled
• preserve query string enabled
• a proxied redirect-only www A placeholder record, replacing the current GitHub Pages CNAME

Activation order after blocker resolution

1. Capture/export authenticated DNS, Hub Pages domain/analytics, and account Bulk Redirect state.
2. Normalize WWW to the Cloudflare redirect while apex still serves Web Utilities; verify path/query.
3. Merge Hub PR H3.4B — Hub Apex Cutover Preparation #15 and verify immutable/stable Pages deployment, aliases, metadata, and 18 redirects.
4. Merge Secure_Tools PR #73 and immediately verify tools indexability, self-canonical metadata, sitemap/robots, and alias noindex.
5. Immediately attach securetools.app to secure-tools-hub.
6. Verify apex DNS/TLS, ten Hub routes, root 200/no redirect, and 18 direct same-path 301s.
7. Reverify WWW, tools, both Pages alias families, privacy/network behavior, and preserved GitHub Pages rollback infrastructure.

NO-GO blocker

The Cloudflare authenticated read surface was unavailable in this session. Before production cutover, capture and review:

• exact current zone record objects/IDs and proxy flags for apex, WWW, and tools;
• the complete Hub Pages custom-domain and Web Analytics state;
• existing account-level Bulk Redirect lists/rules and zone Redirect Rules, including dormant entries.

Public DNS and deployment evidence is healthy, but it cannot prove the absence of a dormant or conflicting Cloudflare redirect rule. H3.5 GO criteria therefore are not fully satisfied.