Complete GitHub Pages custom-domain release configuration

[erinepshovel-code]

Why this exists

PR #7 makes the repository emit and verify an exact public build identity, but repository source cannot change GitHub Pages administration, DNS, TLS, environment policy, or branch protection.

Required administration

• Settings → Pages → Build and deployment → Source: set to GitHub Actions.
• Custom domain: set to interdependentway.org.
• Confirm the apex DNS records and any intended www record satisfy GitHub Pages' domain check.
• Enable Enforce HTTPS when the certificate is available.
• Confirm the github-pages environment permits .github/workflows/pages.yml to deploy.
• Require the pull-request check named Verify generated site before merging to main.
• Merge PR Repair release integrity and complete Article Two evidence #7 after its full release gate is green.
• Confirm https://interdependentway.org/build.json reports the merged main SHA and wayseer00/main:canon/INTERDEPENDENT_WAY.txt provenance.
• Confirm these routes return the generated site: /, /articles/, all eight /articles/article-* routes, /way/, /lab/, /source/, /projects/, /artifacts/, and /fallback/.

Evidence contract

The Pages workflow will fail after deployment when either the Pages URL or custom domain serves a stale or missing /build.json. This is intentional: an uploaded artifact is not the same thing as a verified public release.

hmmm

DNS/provider account access and the current Pages settings are not exposed through the connected repository API. Completion requires a repository administrator to make and record those settings here.

[erinepshovel-code]

Implementation and deployment evidence — July 21, 2026

Repository-controlled work is complete and merged:

• PR Repair release integrity and complete Article Two evidence #7 merged at 9d750bdd5aacfb0b695ab979f7e8c5bc00e56971 after the full build, canon-integrity, browser-route, accessibility, and CodeQL gates passed.
• The first production Pages run successfully built, tested, uploaded, and deployed that verified artifact. The post-deployment verifier then exposed a workflow-wiring defect: its separate runner had not checked out scripts/verify-live-deployment.mjs.
• PR Checkout the live deployment verifier #9 repaired that single defect using the approved full-SHA checkout action; its complete PR gate passed and it merged at e41c52263d8652bab21dcac220a03315d40ba321.

The first production deployment proves these administrative facts:

• GitHub Pages accepted an Actions artifact from main.
• The github-pages environment permitted deployment.
• GitHub reported the deployment URL as https://interdependentway.org/.

Still requiring independent evidence before this issue can close:

• whether branch protection requires Verify generated site;
• whether Enforce HTTPS is explicitly enabled rather than merely available;
• whether the apex/www DNS records pass GitHub's own domain check;
• whether the corrected production run serves e41c52263d8652bab21dcac220a03315d40ba321 at /build.json and all intended routes.

No failure notification for the corrected e41c522 Pages run has arrived as of 02:26 America/Los_Angeles, but absence of a notification is not treated as proof. Leave this issue open until the live identity is directly recorded.

hmmm

The build is proven; the artifact was accepted; deployment was accepted. The last unresolved boundary is not code—it is independently witnessing what the public edge serves.

[erinepshovel-code]

Preamble one-click contract — July 21, 2026

PR #10 passed the complete generated-site, browser, and accessibility gate and merged to main at 5b63b00db4addac28e2f10d2c1616a8e9e3f13c5.

The generated artifact now provides:

• stable /preamble/ route derived from the selected canonical Preamble unit;
• Read the Preamble as the first homepage action;
• Preamble in primary navigation on every generated page;
• provenance, source line, and unit-digest evidence;
• regression tests that fail if the route or one-click links disappear.

Direct public inspection immediately after merge still returned the older site surface rather than the generated artifact, and /preamble/ was not independently observed live. This reinforces the existing Pages-source/public-edge boundary tracked here.

hmmm

The one-click Preamble contract is implemented and test-backed in main; public availability still depends on the domain serving the verified generated artifact rather than the stale site.