ci: serve the dplaax.dev wire surface from S3 + CloudFront - #4
Merged
Conversation
GitHub Pages derives Content-Type from the file extension only and cannot override response headers, so the frozen extensionless wire URI /vc/v1 was served as application/octet-stream. Move the apex wire surface (/vc/v1, /schemas/*, /oauth/grant-type/did) to a dedicated S3 bucket behind CloudFront, where object metadata sets application/ld+json. The served tree is assembled from the same single sources as the Pages workflow (contexts/v1.jsonld, schemas/*.json, site/) and guarded by the existing sha256 pin. Ships disabled (if: false) until the bucket and distribution exist; pages.yml is retired after the DNS cutover is verified. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The apex A/AAAA records moved from the Pages IPs to the wire distribution (E3OEG9PWPHUC8W / wire.dplaax.dev bucket) and the full §5 battery passed against production: /vc/v1 byte-exact under the signing-scope pin AND Content-Type: application/ld+json — the header Pages could not set — plus all 16 schemas byte-exact, the grant-type page, and root/404. The last Pages deployment stays up untouched as the DNS rollback target; only the workflow that would redeploy it is removed. site/README.md now documents the S3 publishing path. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
The frozen wire URI
/vc/v1is extensionless. GitHub Pages derivesContent-Typefrom the file extension alone and offers no header override, so the context was served asapplication/octet-stream. S3 object metadata serves it asapplication/ld+json— that single constraint moves the apex wire surface off Pages.What
.github/workflows/deploy.yml— assembles the served tree from the canonical sources (contexts/v1.jsonld→/vc/v1,schemas/*.json→/schemas/*,site/), guards the signing-scope sha256 pin (9716bca…), refuses tosync --deleteany bucket not namedwire.*, excludes the extensionless identifier keys from the bulk sync (single-write upload with the correct media type — no transient octet-stream window), and invalidates CloudFront. Ships disabled (if: false) until the OIDC role + repo secrets are wired.infra/deploy.md— target topology (Route 53 → CloudFront (OAC) → privatewire.dplaax.devbucket, versioning on), the served-object/media-type table, the Pages→S3 migration order, and a fail-fast, pin-guarded manual fallback.pages.ymlretired +site/README.mdupdated — the cutover already happened and was verified against production: apex A/AAAA now alias the wire distribution, andhttps://dplaax.dev/vc/v1returns 200 +application/ld+json, byte-exact under the pin; all 16 schemas byte-exact; grant-type page and root/404 behavior intact;www.dplaax.dev(LP) unaffected. The last Pages deployment stays untouched as the DNS rollback target.Verification (production, 2026-07-24)
Reviewed by multi-agent review (Claude + Codex ×2 rounds); all actionable findings addressed in-branch.
🤖 Generated with Claude Code