Web publishing evidence: prove the build, deployment, and live route separately

Operational decision

For a training portal, revision 72 adds a guide under /devops/build-deployment-live-route-evidence. The release operator first records the commit and build artifact digest, then confirms that the production deployment names that commit and contains the generated route. A synthetic request fetches the public path, checks a successful status and the expected heading, and records the response's deployment marker. It repeats the request from a second network after cache expiry. If the route returns an old page, the operator does not close the change merely because the build command exited zero. The fault is isolated by comparing the artifact, deployment identifier, route configuration, and cache response in that order.

set -euo pipefail
: "${SITE_ORIGIN:?set the public origin}"
: "${EXPECTED_MARKER:?set the release marker}"
page=$(mktemp)
trap 'rm -f "$page"' EXIT
status=$(curl --silent --show-error --location --output "$page" --write-out '%{http_code}' "${SITE_ORIGIN}/devops/build-deployment-live-route-evidence")
test "$status" = 200
grep -Fq "$EXPECTED_MARKER" "$page"

Cost and verification

The probe transfers O(B) bytes for a B-byte page and scans O(B) bytes for the marker. Running it once per deployed route can become expensive for a large catalog, so gate every changed route and sample unchanged routes by risk. A single successful response proves one observation, not global propagation. Store the observed status, resolved deployment ID, cache status, and content revision; repeat after the declared cache window when freshness matters. A deployment that never became active cannot be repaired by purging the cache.

Common Mistakes

• Do not equate a successful build with a public deployment.
• Do not probe only a preview hostname when the release target is production.
• Do not treat one cached response as evidence of worldwide freshness.

Connected lessons

• DevOps: delivery, infrastructure, and reliable operations
• Release evidence: tie one deployed digest to one approval decision
• Synthetic transactions: measure the route a user actually takes
• Versioned edge assets: make long cache lifetimes safe through content identity

Practice and check

• Project: publish, unpublish, and recover a headless learning site
• DevOps web publishing decisions

Browser and edge security follow-up

• Security headers: verify static, server-rendered, and error responses independently